Roadmap: network version 32, bots' ladders and paths

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/build.yml

@@ -99,7 +99,7 @@ jobs:
 
       - name: Test
         run: |
-          python -m pytest -q tools/test_linux_port.py tools/test_android_asm_convert.py tools/test_host_watch_hash.py tools/test_touch_menu.py tools/harness tools/test_profile.py
+          python -m pytest -q tools/test_linux_port.py tools/test_android_asm_convert.py tools/test_host_watch_hash.py tools/test_touch_menu.py tools/harness tools/test_profile.py tools/stagekit/tests tools/test_net_compare.py
           python tools/test_light_storage.py
 
       - name: Compile cache
@@ -125,10 +125,15 @@ jobs:
       - name: Install the toolchain
         run: |
           mkdir -p "$RUNNER_TEMP/tools"
+          # (each download checked against the hash it had when it was pinned)
           curl -fsSL -o ninja.zip https://github.com/ninja-build/ninja/releases/download/v1.12.1/ninja-linux.zip
+          curl -fsSL -o ccache.tar.xz https://github.com/ccache/ccache/releases/download/v4.10.2/ccache-4.10.2-linux-x86_64.tar.xz
+          sha256sum -c - <<'EOF'
+          6f98805688d19672bd699fbbfa2c2cf0fc054ac3df1f0e6a47664d963d530255  ninja.zip
+          80cab87bd510eca796467aee8e663c398239e0df1c4800a0b5dff11dca0b4f18  ccache.tar.xz
+          EOF
           unzip -q ninja.zip -d "$RUNNER_TEMP/tools" && rm ninja.zip
-          curl -fsSL https://github.com/ccache/ccache/releases/download/v4.10.2/ccache-4.10.2-linux-x86_64.tar.xz \
-            | tar -xJ -C "$RUNNER_TEMP/tools" --strip-components=1 ccache-4.10.2-linux-x86_64/ccache
+          tar -xJf ccache.tar.xz -C "$RUNNER_TEMP/tools" --strip-components=1 ccache-4.10.2-linux-x86_64/ccache && rm ccache.tar.xz
           echo "$RUNNER_TEMP/tools" >> "$GITHUB_PATH"
 
       - uses: actions/checkout@v4
@@ -212,8 +217,11 @@ jobs:
         shell: pwsh
         run: |
           Invoke-WebRequest -OutFile ninja.zip https://github.com/ninja-build/ninja/releases/download/v1.12.1/ninja-win.zip
-          Expand-Archive ninja.zip -DestinationPath "$env:RUNNER_TEMP\tools"
           Invoke-WebRequest -OutFile ccache.zip https://github.com/ccache/ccache/releases/download/v4.10.2/ccache-4.10.2-windows-x86_64.zip
+          # (each download checked against the hash it had when it was pinned)
+          if ((Get-FileHash ninja.zip -Algorithm SHA256).Hash -ne "F550FEC705B6D6FF58F2DB3C374C2277A37691678D6ABA463ADCBB129108467A") { throw "ninja.zip: unexpected SHA-256" }
+          if ((Get-FileHash ccache.zip -Algorithm SHA256).Hash -ne "6252F081876A9A9F700FAE13A5AEC5D0D486B28261D7F1F72AC11C7AD9DF4DA9") { throw "ccache.zip: unexpected SHA-256" }
+          Expand-Archive ninja.zip -DestinationPath "$env:RUNNER_TEMP\tools"
           Expand-Archive ccache.zip -DestinationPath $env:RUNNER_TEMP
           Copy-Item "$env:RUNNER_TEMP\ccache-4.10.2-windows-x86_64\ccache.exe" "$env:RUNNER_TEMP\tools"
           Remove-Item ninja.zip, ccache.zip
@@ -371,7 +379,6 @@ jobs:
         with:
           sparse-checkout: |
             port/android
-            port/third_party/extract-xiso
             tools
 
       - uses: actions/download-artifact@v4

AGENTS.md

@@ -25,7 +25,7 @@ end.
 | `port/assets/` | What the builds embed or ship: high-res HUD (`hud/`), fonts, titles, menus (`menus/`), icons, network brokers |
 | `port/third_party/` | Vendored libraries, each with a README naming its upstream, version and checksum |
 | `port/tools/` | Stand-alone tools (`cache_file_report.c`) |
-| `tools/` | Build scripts (`linux_build.py`, `windows_build.py`, `android_build.py`, `web_build.py`, `ci_build.py`, `web_serve.py`), generators (`ce_menus.py`, `port_settings.py`, `hud_assets.py`, `title_assets.py`, `embed_assets.py`, `xdk_headers.py`) and tests |
+| `tools/` | Build scripts (`linux_build.py`, `windows_build.py`, `android_build.py`, `web_build.py`, `ci_build.py`, `web_serve.py`), generators (`ce_menus.py`, `port_settings.py`, `hud_assets.py`, `title_assets.py`, `embed_assets.py`, `xdk_headers.py`), tests, and `stagekit/` (scenarios staged and instrumented on the real engine, no retail assets) |
 | `docs/` | Longer design notes (`custom_edition_caches.md`, `mods.md`) |
 | `pgo/` | Profile-guided optimisation profiles |
 | `assets/` | Game data for local runs (gitignored: `maps/`, `custom_maps/`) |
@@ -39,7 +39,7 @@ ninja linux                    # build/linux/halo
 ninja android                  # the Android guest image and native libraries
 ninja android_apk              # the APK (Gradle)
 ninja web                      # build/web/site (Emscripten: port/web/README.md)
-ninja windows                  # on Windows only
+ninja windows                  # on Windows, or on Linux after configure.py --windows-cross
 python tools/ci_build.py linux release   # what CI builds
 ```
 
@@ -83,8 +83,10 @@ setting (`game.custom_edition`), checked at run time with
 
 ```sh
 python -m pytest -q tools/harness tools/test_touch_menu.py   # the engine's functions in a fake world
+python -m pytest -q tools/stagekit/tests                    # scenarios on the real engine, no retail assets (Linux)
 python -m pytest -q tools/test_linux_port.py                # the build, the maps' checks (needs assets/maps)
 python -m pytest -q tools/test_mods.py                      # mods played over a map (needs assets/maps)
+python -m pytest -q tools/test_bots.py                      # the bots in local games (needs assets/maps)
 python -m pytest -q tools/test_cache_file_formats.py tools/test_bmp_files.py tools/test_profile.py
 python tools/test_touch_layout.py                           # the Android touch layout (JDK 17+)
 python tools/test_light_storage.py
@@ -92,10 +94,14 @@ python tools/test_death_timing.py
 python -m pytest -q tools/test_web_build.py                 # the web build's graph, sockets, menus
 node --test "port/web/tests/*.test.js"                      # the web page's importer and service worker
 node port/web/tests/webrtc_native.mjs chromium firefox      # the native builds' WebRTC with browsers (Playwright)
+python -m pytest -q tools/test_net_compare.py               # net_compare.py's judging of logs, its copies and their processes
+python tools/net_compare.py --a build/linux/halo --b <other build> --data <game data> --swap
+                                                            # two builds in one network game, in step (retail maps: local only)
 ```
 
 `tools/harness/README.md` explains how to add an asset-free test: the code
-under test is taken from the sources, not copied.
+under test is taken from the sources, not copied. `tools/stagekit/README.md`
+explains how to add a scenario: the real engine, with no retail assets.
 
 Running the game without a person at it:
 
@@ -190,10 +196,18 @@ otherwise.
 
 ### Third-party code and licences
 
-The repository is CC0. Vendored code goes in `port/third_party/<name>`,
-copied unchanged, with a README naming the upstream, the version or commit,
-the checksum and what uses it. GPL code (OpenSauce, Reclaimer) may be read
-as documentation of file formats, never copied.
+The repository is `AGPL-3.0-or-later` (`LICENSE`); the commits before the
+change, and the releases built from them, stay CC0 (`LICENSES/CC0-1.0.txt`).
+The README's "Licence" section says what each part is under. Vendored code
+goes in `port/third_party/<name>`, copied unchanged, with a README naming
+the upstream, the version or commit, the licence, the checksum and what uses
+it. Its licence must let it be combined with the AGPL 3.0: MIT, BSD (without
+an advertising clause), ISC, zlib, Apache 2.0, MPL 2.0, LGPL or GPL 3.0 or
+later, public domain. GPL-2.0-only code and the 4-clause BSD licence cannot
+be. Code taken from another project, GPL 3.0 code included, keeps its
+notices and its licence, and says where it came from.
+The decompilation's upstream, punpckhdq/halo, is AGPL 3.0 from 17 October
+2026; bnunu/halo-1 is CC0.
 
 ### Commits and pull requests
 
@@ -224,5 +238,6 @@ as documentation of file formats, never copied.
 | [port/assets/menus/UNWIRED.md](port/assets/menus/UNWIRED.md) | Menu functions that do nothing yet |
 | [port/assets/fonts/README.md](port/assets/fonts/README.md) | The fonts and their licences |
 | [tools/harness/README.md](tools/harness/README.md) | Asset-free regression tests |
+| [tools/stagekit/README.md](tools/stagekit/README.md) | Scenarios staged and instrumented on the real engine, no retail assets |
 | `port/third_party/*/README.md` | Each vendored library |
 | [AUTHORS.md](AUTHORS.md) | Art credits |

LICENSE

@@ -0,0 +1,661 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.

README.md

@@ -170,8 +170,9 @@ Ringfall: Mjolnir VR stands on the work of others:
 - **[HaloCE-VR](https://github.com/astromaddie/HaloCE-VR)** by astromaddie
   (CC0): the Steam Frame work, whose findings (such as quieting Mesa's
   trace markers) are used here.
-- **[extract-xiso](https://github.com/XboxDev/extract-xiso)**: the disc
-  image readers follow its format handling.
+- **[xboxdevwiki](https://xboxdevwiki.net/XDVDFS)**: its description of
+  the Xbox's disc file system, which the disc image readers are written
+  from.
 - The libraries and fonts in [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
 
 Thank you all.
@@ -198,6 +199,26 @@ distributed. You need your own, legally purchased copy of the game. If
 you enjoy this mod, please support the creators of the original by buying
 their games.
 
-This project's own code is released under [CC0 1.0](LICENSE.md), as the
-decompilation it builds on. Third-party code and fonts keep their own
-licenses: see [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
+### Licence
+
+Ringfall: Mjolnir VR is free software: you can give it to others and change
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, version 3 of the License or (at your option)
+any later version (`AGPL-3.0-or-later`), as OpenCE, which it builds on, is.
+It comes with no warranty. The full text is in [LICENSE](LICENSE).
+
+- **From build 312 on.** The AGPL applies from the commit that took in
+  OpenCE's change of licence (19 October 2026), and to each release built
+  from it or a later one. Earlier releases, and the source at every earlier
+  commit, were released under [CC0 1.0](LICENSES/CC0-1.0.txt) and stay
+  that way.
+- **Hosts and servers.** If you change the game and let other persons play
+  with your version over a network (for example, as the host of an
+  internet game), the AGPL asks you to offer them the source of your
+  version. The game as released has its source here, and each release's
+  source is its tag (`build-<n>`).
+- **Third-party code and fonts** keep their own licences: see
+  [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
+- **Halo is not covered.** The licence covers the work of this project's
+  and OpenCE's authors. It gives no rights in Halo, its maps or anything
+  else that Microsoft owns.

THIRD_PARTY_NOTICES.md

@@ -1,14 +1,16 @@
 # Third-party notices
 
-Ringfall: Mjolnir VR's own code is released under [CC0 1.0](LICENSE.md).
-It includes or builds on the following, under their own licenses; each
-license's full text is in the file named.
+Ringfall: Mjolnir VR is released under the GNU Affero General Public
+License, version 3 or later ([LICENSE](LICENSE)); releases before build 312
+were released under [CC0 1.0](LICENSES/CC0-1.0.txt). It includes or builds
+on the following, under their own licenses; each license's full text is in
+the file named.
 
 ## Code
 
 | Component | Used for | License | Text |
 | --- | --- | --- | --- |
-| [OpenCE](https://github.com/OpenCommunityEdition/OpenCE) and the decompilation ([bnunu/halo-1](https://github.com/bnunu/halo-1), [punpckhdq/halo](https://github.com/punpckhdq/halo)) | the game's code, the port | CC0 1.0 | [LICENSE.md](LICENSE.md) |
+| [OpenCE](https://github.com/OpenCommunityEdition/OpenCE) and the decompilation ([bnunu/halo-1](https://github.com/bnunu/halo-1), [punpckhdq/halo](https://github.com/punpckhdq/halo)) | the game's code, the port | AGPL 3.0 or later (OpenCE from 19 October 2026, punpckhdq/halo from 17 October 2026; CC0 1.0 before); bnunu/halo-1: CC0 1.0 | [LICENSE](LICENSE), [LICENSES/CC0-1.0.txt](LICENSES/CC0-1.0.txt) |
 | [HaloCE-Quest-VR](https://github.com/moistman42069/HaloCE-Quest-VR) | the arm IK, forearm twist and finger poses (`port/linux/game/vr_arms.c`) | CC0 1.0 | (its repository) |
 | [HaloCE-VR](https://github.com/astromaddie/HaloCE-VR) | Steam Frame findings | CC0 1.0 | (its repository) |
 | [SDL 3](https://libsdl.org) | windows, input, sound | zlib | (in SDL's source, `LICENSE.txt`) |
@@ -22,11 +24,11 @@ license's full text is in the file named.
 | [tomlc17](https://github.com/cktan/tomlc17) | reading `config.toml` | MIT | [port/third_party/tomlc17/LICENSE](port/third_party/tomlc17/LICENSE) |
 | [stb](https://github.com/nothings/stb) | drawing the game's text sharply (stb_truetype) | MIT or public domain | [port/third_party/stb/LICENSE](port/third_party/stb/LICENSE) |
 | [SMAA](https://www.iryoku.com/smaa/) | anti-aliasing (flat screens; off in VR) | MIT | [port/third_party/smaa/LICENSE](port/third_party/smaa/LICENSE) |
-| [extract-xiso](https://github.com/XboxDev/extract-xiso) | reading disc images (followed by `XisoExtractor.java`, `steam_frame_xiso.py`, `xiso.c`) | BSD-style (in@fishtank.com) | [port/third_party/extract-xiso/LICENSE.TXT](port/third_party/extract-xiso/LICENSE.TXT) |
 
-The disc image readers include this acknowledgement, as extract-xiso's
-license asks: *This product includes software developed by in
-<in@fishtank.com>.*
+The disc image readers (`XisoExtractor.java`, `steam_frame_xiso.py`,
+`xiso.c`) are written from a description of the Xbox's disc file system
+([xboxdevwiki's XDVDFS page](https://xboxdevwiki.net/XDVDFS)), not from
+extract-xiso, which earlier releases followed.
 
 ## Fonts
 

configure.py

@@ -16,6 +16,11 @@ from tools.linux_build import check_profile_options, generate_linux_build, linux
 from tools.web_build import generate_web_build, web_configure_inputs
 from tools.windows_build import generate_windows_build, windows_configure_inputs
 
+
+def is_windows() -> bool:
+    return os.name == "nt"
+
+
 # arguments
 parser = argparse.ArgumentParser()
 parser.add_argument(
@@ -89,6 +94,38 @@ parser.add_argument(
     type=str,
     help="Emscripten's emcc for `ninja web` (default: emcc on the PATH, then EMSDK's or ~/emsdk's)",
 )
+
+# no need to spam those extra flags when running on Windows
+if not is_windows():
+    parser.add_argument(
+        "--windows-cross",
+        action="store_true",
+        help="generate the Windows build (`ninja windows`) on Linux, cross-compiling "
+        "with clang against an MSVC toolchain (--windows-vctools-dir and --windows-sdk-dir), "
+        "and make it the default target",
+    )
+    parser.add_argument(
+        "--windows-cc",
+        metavar="BINARY",
+        help="compiler for the Windows cross build, `ninja windows` (default: clang). "
+             "Only clang is supported for now.",
+    )
+    parser.add_argument(
+        "--windows-vctools-dir",
+        metavar="DIR",
+        type=Path,
+        help="the Visual C++ tools of the MSVC toolchain a --windows-cross build compiles "
+        "and links against: the versioned folder under VC/Tools/MSVC, the one with `include` "
+        "and `lib` (default: VCToolsInstallDir)",
+    )
+    parser.add_argument(
+        "--windows-sdk-dir",
+        metavar="DIR",
+        type=Path,
+        help="the Windows SDK a --windows-cross build compiles and links against: the "
+        "folder with `Include` and `Lib`, each with a versioned folder (default: WindowsSdkDir)",
+    )
+
 args = parser.parse_args()
 try:
     check_profile_options(args.profile, args.pgo)
@@ -110,10 +147,11 @@ sln = SimpleNamespace(
     android_guest_cc=args.android_guest_cc,
     web_emcc=args.web_emcc,
 )
-
-
-def is_windows() -> bool:
-    return os.name == "nt"
+if not is_windows():
+    sln.windows_cc = args.windows_cc
+    sln.windows_cross = args.windows_cross
+    sln.windows_vctools_dir = args.windows_vctools_dir
+    sln.windows_sdk_dir = args.windows_sdk_dir
 
 
 # build.ninja
@@ -159,7 +197,7 @@ n.newline()
 
 # the build for this computer, where it could be generated (the Windows
 # build is left out when SDL cannot be fetched, for instance)
-default = "windows" if is_windows() else "linux"
+default = "windows" if is_windows() or sln.windows_cross else "linux"
 if f"\nbuild {default}: " in out.getvalue():
     n.comment("Default rule: the build for this computer")
     n.default(default)

docs/OPENCE_README.md

@@ -207,3 +207,34 @@ Enter `adb pull` to copy the recording parts to a computer.
 
 A profiling build plays with normal builds. It does not use
 `--pgo=train`.
+
+## Licence
+
+OpenCE is free software: you can give it to others and change it under the
+terms of the GNU Affero General Public License as published by the Free
+Software Foundation, version 3 of the License or (at your option) any later
+version (`AGPL-3.0-or-later`). It comes with no warranty. The full text is in
+[LICENSE](LICENSE).
+
+- **From the change.** The AGPL applies from the commit that made the change,
+  and to each release built from that commit or a later one. Earlier
+  releases, and the source at every earlier commit, were released under
+  [CC0 1.0](LICENSES/CC0-1.0.txt) and stay that way.
+- **What OpenCE builds on.** The decompilation of
+  [punpckhdq/halo](https://github.com/punpckhdq/halo) is under the AGPL 3.0
+  from 17 October 2026, and under CC0 1.0 before that date.
+  [bnunu/halo-1](https://github.com/bnunu/halo-1) is under CC0 1.0.
+- **Contributions** are under `AGPL-3.0-or-later`. A change taken from a
+  project under GPL 3.0 keeps that licence and its notices; the GPL 3.0 and
+  the AGPL 3.0 let the two be combined (section 13 of each).
+- **Hosts and servers.** If you change the game and let other persons play
+  with your version over a network (for example, as the host of an internet
+  game, or on a web site), the AGPL asks you to offer them the source of
+  your version (section 13). The game as released has its source here, and
+  each release's source is its tag (`build-<n>`).
+- **Third-party code, fonts and art** keep their own licences, which are
+  next to them (`port/third_party`, `port/assets/fonts`,
+  `port/assets/icons`, `port/assets/text_filter`). The release downloads and
+  the web site's `licenses.txt` carry their notices.
+- **Halo is not covered.** The licence covers the work of OpenCE's authors.
+  It gives no rights in Halo, its maps or anything else that Microsoft owns.

docs/custom_edition_caches.md

@@ -493,9 +493,9 @@ file the same as the host's; with `network.map_download` off, or a host with
   but their model parts have its 0x68-byte layout and their shader types its
   numbering, which makes them a check on what the conversion produces.
 
-OpenSauce and Reclaimer are GPL-3.0 and this repository is CC0: no code from
-either was copied. They were read as documentation of the file formats, and
-every layout used was then checked against the sample maps.
+No code from OpenSauce or Reclaimer (both GPL-3.0) was copied: they were
+read as documentation of the file formats, and every layout used was then
+checked against the sample maps.
 
 ### Documented facts (source, checked against the sample maps)
 

port/android/README.md

@@ -575,4 +575,7 @@ assembly of the port is necessary:
   page contents once a frame instead ("write tracking: page hashes" in the
   log). This is slower, and a write shows one frame later, so moving
   geometry can glitch briefly. `debug.memory_watch = false` does the same
-  on a device.
+  on a device. The translation also has no scalar conversion from floating
+  point to an integer in a SIMD register (`fcvtzs s0, s1`, an illegal
+  instruction there), so `tools/android_asm_convert.py` writes each as the
+  vector form, which leaves the register and the exception flags the same.

port/android/VR_ROADMAP.md

@@ -24,8 +24,8 @@ named where code is taken over.
 | Scores | The menu button held shows the scores on the Quest (a press pauses, as it is let go); the Steam Frame's View button as before; the text chat's lines where the desktop has them (2026-10-18) |
 | Comfort | Snap or smooth turning, a comfort vignette in vehicles, VR options in the main and pause menus (Y), a page of every controller button |
 | Menus | The PC version's menus in VR (`vr.menus`), clicked with a laser; text typed on the on-screen keyboard |
-| Multiplayer | Up to date with OpenCE (network version 29, 2026-10-14): cross-play, its server browser, co-op campaign, password lobbies; join codes and the VR online list |
-| Bots | Bots in multiplayer: on foot (paths, items, objectives), in vehicles and at turrets; they make room for a joining person, on the LAN too (a lobby they fill is advertised open, 2026-10-18) |
+| Multiplayer | Up to date with OpenCE (network version 32, 2026-10-20; HDR kept off in VR): cross-play, its server browser, co-op campaign, password lobbies; join codes and the VR online list |
+| Bots | Bots in multiplayer (`host_bots.c`; OpenCE's own, `bots.c`, are local split screen games' and off in VR): on foot (paths, items, objectives), in vehicles and at turrets; they make room for a joining person, on the LAN too (2026-10-18); they climb ladders (Damnation's) and take paths as near their goal as a search reaches, as OpenCE's do: on Damnation 0 searches of 1747 failed, 1078 of 1605 before (2026-10-20). Later: OpenCE's bots' aiming (lead, bursts, taps for the pistol and sniper rifle, field of view), learnt obstacles and map fixes into ours |
 | Voice chat | Push to talk on any button (`vr.button_talk`, BUTTONS page; the free hand's grip by default, sending nothing while it reaches for the foregrip or the wheel), open mic, off (2026-10-13) |
 | Builds | The Android build's assembly conversion (`tools/android_asm_convert.py`) keeps string data as it is: strings and tables starting with "_" or holding \" lost a "_" (Opus's pulse cache among them: the Steam Frame's crashes in online games while talking), 2026-10-13 |
 | Languages | The European disc in Spanish and Italian (a maps folder for each, `maps_es` and `maps_it`, none called `maps`) imported on the Quest and the Steam Frame: the headset's language's, its language the game's and the menus' (`maps/language.txt`, unless `game.language` is set), 2026-10-17; not yet tried with that disc |

port/android/app/src/main/java/com/halo/decomp/XisoExtractor.java

@@ -4,101 +4,101 @@ import java.io.File;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.nio.ByteBuffer;
-import java.nio.ByteOrder;
 import java.nio.channels.FileChannel;
 import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.BitSet;
 import java.util.List;
 import java.util.Locale;
 
 /**
- * Copies the maps folder out of an Xbox disc image (an "xiso", or a whole
- * disc's ".iso"), as the desktop games do (port/linux/src/xiso.c, which this
- * follows).
+ * Copies the maps folder out of the player's Xbox disc image of Halo, for
+ * LauncherActivity, as the desktop games do (port/linux/src/xiso.c; the web
+ * page's is port/web/site/xiso-worker.js). The image is a document the
+ * player picked, read through its FileChannel at absolute positions.
  *
- * The image's file system is XDVDFS, read as extract-xiso does
- * (https://github.com/XboxDev/extract-xiso, extract-xiso.c, whose format
- * handling this follows; its license is below and in
- * port/third_party/extract-xiso/LICENSE.TXT): 2048-byte sectors; a volume
- * descriptor at 0x10000 that starts and ends with "MICROSOFT*XBOX*MEDIA" and
- * gives the root directory's sector and size; and directories whose entries
- * form a binary tree (each entry: left and right subtree offsets in 4-byte
- * units, the start sector, the size, attributes, the name's length and the
- * name, 4-byte aligned). Images made from a whole disc put the game partition
- * further in, at one of the offsets below.
+ * Written from a description of the Xbox's disc file system, XDVDFS
+ * (xboxdevwiki's XDVDFS page, https://xboxdevwiki.net/XDVDFS, and the format
+ * facts OpenCE's readers rely on). What this class relies on:
  *
- * The files are written to maps.partial first and moved into maps once they
- * all are, so an interrupted extraction never leaves maps/ui.map behind.
+ * - Sectors are 2048 bytes and integers little-endian. Sector numbers count
+ *   from the start of the game partition: an image of the partition alone
+ *   has it at 0, an image of a whole disc further in (0x0FD90000, 0x02080000
+ *   or 0x18300000 for XGD2, XGD3 and XGD1 discs). They are tried in that
+ *   order.
+ * - The volume descriptor is the partition's sector 32 (at 0x10000). It
+ *   holds "MICROSOFT*XBOX*MEDIA" at its start and again at 0x7EC, and the
+ *   root directory table's start sector (u32 at 0x14) and size in bytes (u32
+ *   at 0x18).
+ * - A directory table is a binary tree of entries whose root is the entry at
+ *   offset 0. An entry is a left and a right subtree link (u16 each, in
+ *   4-byte units from the table's start, 0 for none), the start sector and
+ *   the size of the file or of the subdirectory's table (u32 each), the
+ *   attributes (u8, 0x10 for a directory), the name's length (u8) and the
+ *   name. Unused bytes of a table are 0xFF, so a left link of 0xFFFF is
+ *   padding, not an entry.
+ * - A file is one contiguous run of bytes from the start of its sector.
  *
- * A European disc in two languages (Spanish and Italian) has no maps folder
- * but one for each, maps_es and maps_it: the device's language's is taken,
- * else English's, else the first, and its language written to
- * maps/language.txt, which the game asks the Xbox for (game.language unset,
- * port/linux/src/xbox_xapi.c): the menus in it too.
+ * The image is the player's file and nothing read from it is trusted. Only
+ * the root's table and the maps folder's are read, each whole and at most
+ * 4 MB; the walk of a table visits each offset once, goes at most 64 links
+ * deep and looks at most 4096 entries; and a file is written only under a
+ * plain name that no file before it had (ignoring case).
  *
- * Some parts of this code are copyright in@fishtank.com. This product
- * includes software developed by in <in@fishtank.com>.
+ * The loading screen's picture, which the retail disc has no file of, is
+ * taken out of the root's default.xbe (read whole, at most 64 MB) and
+ * written beside the maps as the loading.tga the game reads, when the maps
+ * folder has none (loadingPicture, as xiso.c's xiso_write_loading_picture);
+ * without it the light sweeps over black, as the game's own does.
  *
- * Copyright (c) 2003 in <in@fishtank.com>
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *
- *    This product includes software developed by in <in@fishtank.com>.
- *
- * 4. Neither the name of "in" nor the email address "in@fishtank.com"
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED `AS IS' AND ANY EXPRESS OR IMPLIED WARRANTIES
- * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
- * FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
- * AUTHOR OR ANY CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
- * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
- * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
- * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
- * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * The app starts the game once maps/ui.map exists, and makes the maps folder
+ * itself, so the copy is written to maps.partial (emptied first of what an
+ * earlier attempt left) and its files moved into maps once all are
+ * complete, ui.map last.
  */
 final class XisoExtractor {
     private static final int SECTOR_SIZE = 2048;
-    private static final long VOLUME_DESCRIPTOR_OFFSET = 0x10000;
-    private static final int ENTRY_HEADER_SIZE = 14;
+    private static final int DESCRIPTOR_OFFSET = 0x10000;
+    private static final byte[] MAGIC = "MICROSOFT*XBOX*MEDIA".getBytes(StandardCharsets.ISO_8859_1);
+    private static final int SECOND_MAGIC_OFFSET = 0x7EC;
+    private static final int ENTRY_FIXED_SIZE = 14;
     private static final int ATTRIBUTE_DIRECTORY = 0x10;
-    /* directory tables are a few sectors; anything much larger is not one */
-    private static final long MAXIMUM_DIRECTORY_SIZE = 4 << 20;
-    private static final int MAXIMUM_FILES = 256;
-    private static final int COPY_BUFFER_SIZE = 1 << 20;
-    private static final byte[] VOLUME_MAGIC = "MICROSOFT*XBOX*MEDIA".getBytes(StandardCharsets.US_ASCII);
-
-    /* where the game partition starts: a plain image, and whole-disc images
-    (extract-xiso's GLOBAL, XGD3 and XGD1 offsets) */
-    private static final long[] PARTITION_OFFSETS = { 0, 0x0FD90000L, 0x02080000L, 0x18300000L };
+    private static final int PADDING_LINK = 0xFFFF;
+    /** where the game partition may start, in the order they are tried */
+    private static final long[] PARTITION_STARTS = {
+        0x00000000L, // an image of the game partition alone
+        0x0FD90000L, // a whole XGD2 disc
+        0x02080000L, // a whole XGD3 disc
+        0x18300000L, // a whole XGD1 disc (the original Xbox's)
+    };
+    /** directory tables are a few sectors; anything much larger is not one */
+    private static final int MAXIMUM_TABLE_SIZE = 4 * 1024 * 1024;
+    private static final int MAXIMUM_DEPTH = 64;
+    private static final int MAXIMUM_VISITS = 4096;
+    private static final int MAXIMUM_ENTRIES = 256;
+    private static final int COPY_CHUNK = 1024 * 1024;
+    private static final String PARTIAL_DIRECTORY = "maps.partial";
+    /** the loading screen's picture (source/interface/progress_bar.c), out of default.xbe; the executable is a few MB */
+    private static final int LOADING_WIDTH = 320;
+    private static final int LOADING_HEIGHT = 240;
+    private static final int TGA_HEADER_SIZE = 18;
+    private static final long MAXIMUM_XBE_SIZE = 64 * 1024 * 1024;
+    private static final String LOADING_PICTURE = "loading.tga";
 
+    /** Told as the copy goes: the file being copied, and the bytes copied of all the files'. */
     interface Progress {
         void report(String file, long done, long total);
     }
 
-    /** a reason the player can act on */
+    /** A reason the player can act on: its message is shown as it is. */
     static final class ExtractException extends IOException {
         ExtractException(String message) {
             super(message);
         }
     }
 
+    /** a file or folder found in a directory table */
     private static final class Entry {
         final String name;
         final long sector;
@@ -111,140 +111,66 @@ final class XisoExtractor {
         }
     }
 
-    private final FileChannel image;
-    private long partition;
-
-    private XisoExtractor(FileChannel image) {
-        this.image = image;
+    private XisoExtractor() {
     }
 
-    /** copies the image's maps folder to destination/maps */
+    /** Copies the image's maps folder to destination/maps. */
     static void extractMaps(FileChannel image, File destination, Progress progress) throws IOException {
-        new XisoExtractor(image).extract(destination, progress);
-    }
+        long imageSize = image.size();
+        long partition = -1;
+        long rootSector = 0, rootSize = 0;
+        ByteBuffer descriptor = ByteBuffer.allocate(SECTOR_SIZE);
 
-    private void readAt(long offset, ByteBuffer buffer) throws IOException {
-        while (buffer.hasRemaining()) {
-            int count = image.read(buffer, offset);
-
-            if (count <= 0)
-                throw new ExtractException("Could not read the disc image (is it complete?).");
-            offset += count;
-        }
-        buffer.flip();
-    }
-
-    private static boolean magicAt(ByteBuffer buffer, int offset) {
-        for (int index = 0; index < VOLUME_MAGIC.length; index++) {
-            if (buffer.get(offset + index) != VOLUME_MAGIC[index])
-                return false;
-        }
-        return true;
-    }
-
-    /** whether a name is one to write in the maps folder: no path, no "." or
-     * "..", and only printable ASCII that every file system takes as a plain
-     * name (a disc's maps folder holds .map files and loading.tga) */
-    static boolean isPlainName(String name) {
-        if (name.isEmpty() || name.equals(".") || name.equals(".."))
-            return false;
-        for (int index = 0; index < name.length(); index++) {
-            char c = name.charAt(index);
-            if (c < 0x20 || c > 0x7E || "/\\:*?\"<>|".indexOf(c) >= 0)
-                return false;
-        }
-        return true;
-    }
-
-    /** the partition's volume descriptor: the root directory's sector and size */
-    private long[] findVolume() throws IOException {
-        for (long offset : PARTITION_OFFSETS) {
-            ByteBuffer descriptor = ByteBuffer.allocate(SECTOR_SIZE).order(ByteOrder.LITTLE_ENDIAN);
-
-            try {
-                readAt(offset + VOLUME_DESCRIPTOR_OFFSET, descriptor);
-            } catch (IOException e) {
+        for (long start : PARTITION_STARTS) {
+            if (start + DESCRIPTOR_OFFSET + SECTOR_SIZE > imageSize)
                 continue;
-            }
-            if (!magicAt(descriptor, 0) || !magicAt(descriptor, 0x7EC))
+            descriptor.clear();
+            if (!readFully(image, descriptor, start + DESCRIPTOR_OFFSET))
                 continue;
-            partition = offset;
-            return new long[] {
-                descriptor.getInt(20) & 0xFFFFFFFFL, descriptor.getInt(24) & 0xFFFFFFFFL,
-            };
+            byte[] bytes = descriptor.array();
+            if (!hasMagic(bytes, 0) || !hasMagic(bytes, SECOND_MAGIC_OFFSET))
+                continue;
+            partition = start;
+            rootSector = u32(bytes, 0x14);
+            rootSize = u32(bytes, 0x18);
+            break;
         }
-        throw new ExtractException("This is not an Xbox disc image.");
-    }
+        if (partition < 0)
+            throw new ExtractException("This is not an Xbox disc image.");
 
-    /** a directory's table, read whole */
-    private ByteBuffer readDirectory(long sector, long size, String what) throws IOException {
-        if (size <= 0 || size > MAXIMUM_DIRECTORY_SIZE)
-            throw new ExtractException(what);
-        ByteBuffer table = ByteBuffer.allocate((int) size).order(ByteOrder.LITTLE_ENDIAN);
-        readAt(partition + sector * SECTOR_SIZE, table);
-        return table;
-    }
-
-    /**
-     * collects the entries of the subtree at offset (4-byte units), files or
-     * directories as asked
-     */
-    private static void walk(ByteBuffer table, long offset, int depth, boolean directories, List<Entry> out,
-        int[] visited) {
-        offset *= 4;
-        /* a malformed table must not loop or run off its end */
-        if (depth > 64 || ++visited[0] > 4096 || offset + ENTRY_HEADER_SIZE > table.limit())
-            return;
-        int at = (int) offset;
-        int left = table.getShort(at) & 0xFFFF;
-        int right = table.getShort(at + 2) & 0xFFFF;
-        /* 0xFFFF: padding, an empty directory */
-        if (left == 0xFFFF)
-            return;
-        int nameLength = table.get(at + 13) & 0xFF;
-        if (left != 0)
-            walk(table, left, depth + 1, directories, out, visited);
-        boolean isDirectory = (table.get(at + 12) & ATTRIBUTE_DIRECTORY) != 0;
-        if (at + ENTRY_HEADER_SIZE + nameLength <= table.limit() && nameLength > 0 && isDirectory == directories
-            && out.size() < MAXIMUM_FILES) {
-            byte[] bytes = new byte[nameLength];
-            for (int index = 0; index < nameLength; index++)
-                bytes[index] = table.get(at + ENTRY_HEADER_SIZE + index);
-            String name = new String(bytes, StandardCharsets.ISO_8859_1);
-            /* (as extract-xiso refuses them: no name may leave the folder, and
-            none but a plain file name is written) */
-            if (isPlainName(name))
-                out.add(new Entry(name, table.getInt(at + 4) & 0xFFFFFFFFL, table.getInt(at + 8) & 0xFFFFFFFFL));
-        }
-        if (right != 0)
-            walk(table, right, depth + 1, directories, out, visited);
-    }
-
-    private void extract(File destination, Progress progress) throws IOException {
-        long[] root = findVolume();
-
-        /* the root's maps folder */
-        ByteBuffer table = readDirectory(root[0], root[1], "The disc image's file system is damaged.");
-        List<Entry> directories = new ArrayList<>();
-        walk(table, 0, 0, true, directories, new int[1]);
+        // the root's maps folder
+        byte[] root = readTable(image, partition, rootSector, rootSize, "The disc image's file system is damaged.");
         Entry maps = null;
-        for (Entry entry : directories) {
-            if (entry.name.equalsIgnoreCase("maps"))
-                maps = entry;
+        Entry xbe = null;
+        for (Entry entry : walkTable(root, false)) {
+            if (entry.name.equalsIgnoreCase("default.xbe"))
+                xbe = entry;
         }
+        List<Entry> directories = walkTable(root, true);
+        for (Entry entry : directories) {
+            if (entry.name.equalsIgnoreCase("maps")) {
+                maps = entry;
+                break;
+            }
+        }
+        // (Ringfall: a European disc in two languages, Spanish and Italian,
+        // has no maps folder but one for each, maps_es and maps_it: the
+        // device's language's is taken, else English's, else the first, and
+        // its language written to maps/language.txt, which the game asks the
+        // Xbox for while game.language is unset: port/linux/src/xbox_xapi.c)
         String language = null;
         if (maps == null) {
             String wanted = Locale.getDefault().getLanguage();
             Entry english = null, first = null;
 
-            for (Entry entry : directories) {
+            for (Entry entry : walkTable(root, true)) {
                 String code = mapsLanguage(entry.name);
 
                 if (code == null)
                     continue;
-                if (code.equals(wanted))
+                if (code.equals(wanted) && maps == null)
                     maps = entry;
-                if (code.equals("en"))
+                if (code.equals("en") && english == null)
                     english = entry;
                 if (first == null)
                     first = entry;
@@ -257,73 +183,72 @@ final class XisoExtractor {
         if (maps == null)
             throw new ExtractException("The disc image has no maps folder: it is not a Halo disc.");
 
-        /* its files */
-        table = readDirectory(maps.sector, maps.size, "The disc image's maps folder is damaged.");
-        List<Entry> files = new ArrayList<>();
-        walk(table, 0, 0, false, files, new int[1]);
-        long total = 0;
-        boolean hasUi = false;
+        // its files
+        byte[] table = readTable(image, partition, maps.sector, maps.size, "The disc image's maps folder is damaged.");
+        List<Entry> files = walkTable(table, false);
+        Entry userInterface = null;
+        boolean hasLoading = false;
         for (Entry file : files) {
-            total += file.size;
-            hasUi |= file.name.equalsIgnoreCase("ui.map");
+            if (file.name.equalsIgnoreCase("ui.map"))
+                userInterface = file;
+            hasLoading |= file.name.equalsIgnoreCase(LOADING_PICTURE);
         }
-        if (!hasUi)
+        if (userInterface == null)
             throw new ExtractException("The disc image's maps folder has no ui.map: it is not a Halo disc.");
-
-        File partial = new File(destination, "maps.partial");
-        File finished = new File(destination, "maps");
-        if (!partial.isDirectory() && !partial.mkdirs())
-            throw new ExtractException("Could not create " + partial + ".");
-        ByteBuffer buffer = ByteBuffer.allocateDirect(COPY_BUFFER_SIZE);
-        long done = 0;
+        // (an image that ends before a file does is refused before anything
+        // is written; an empty file's sector need not be anywhere)
+        long total = 0;
         for (Entry file : files) {
-            File path = new File(partial, file.name);
-            long offset = partition + file.sector * SECTOR_SIZE;
-            long remaining = file.size;
+            if (file.size > 0 && partition + file.sector * SECTOR_SIZE + file.size > imageSize)
+                throw new ExtractException(readFailure(file));
+            total += file.size;
+        }
 
-            try (FileOutputStream out = new FileOutputStream(path)) {
-                FileChannel output = out.getChannel();
-
-                while (remaining > 0) {
-                    buffer.clear();
-                    buffer.limit((int) Math.min(remaining, COPY_BUFFER_SIZE));
-                    readAt(offset, buffer);
-                    int count = buffer.remaining();
-                    while (buffer.hasRemaining())
-                        output.write(buffer);
-                    offset += count;
-                    remaining -= count;
-                    done += count;
-                    progress.report(file.name, done, total);
-                }
-            } catch (ExtractException e) {
-                throw new ExtractException("Could not read " + file.name + " from the disc image (is it complete?).");
-            } catch (IOException e) {
-                throw new ExtractException("Could not write " + path + " (is the storage full?).");
+        // the copy, to maps.partial
+        File partial = new File(destination, PARTIAL_DIRECTORY);
+        if (partial.isDirectory()) {
+            File[] leftovers = partial.listFiles();
+            if (leftovers != null) {
+                for (File leftover : leftovers)
+                    leftover.delete();
             }
+        } else {
+            partial.delete();
+            partial.mkdirs();
         }
+        if (!partial.isDirectory())
+            throw new ExtractException("Could not create " + partial.getPath() + ".");
+        ByteBuffer buffer = ByteBuffer.allocate(COPY_CHUNK);
+        long done = 0;
+        for (Entry file : files)
+            done = copyFile(image, partition, file, new File(partial, file.name), buffer, done, total, progress);
+        if (!hasLoading && writeLoadingPicture(image, imageSize, partition, xbe, new File(partial, LOADING_PICTURE)))
+            files.add(new Entry(LOADING_PICTURE, 0, 0));
 
-        /* (the maps folder may be there, empty: the app makes it for adb) */
-        if (!finished.isDirectory() && !finished.mkdirs())
-            throw new ExtractException("Could not create " + finished + ".");
-        for (Entry file : files) {
-            File from = new File(partial, file.name);
-            File to = new File(finished, file.name);
-
-            to.delete();
-            if (!from.renameTo(to))
-                throw new ExtractException("Could not move " + file.name + " into " + finished + ".");
-        }
-        partial.delete();
-        File languageFile = new File(finished, "language.txt");
+        // then into maps, ui.map (the app's sign that the data is there) last
+        File mapsFolder = new File(destination, "maps");
+        if (!mapsFolder.isDirectory() && !mapsFolder.mkdirs() && !mapsFolder.isDirectory())
+            throw new ExtractException("Could not create " + mapsFolder.getPath() + ".");
+        // (the language of a language's maps folder: before ui.map is there)
+        File languageFile = new File(mapsFolder, "language.txt");
         languageFile.delete();
         if (language != null) {
             try (FileOutputStream out = new FileOutputStream(languageFile)) {
                 out.write((language + "\n").getBytes(StandardCharsets.US_ASCII));
             } catch (IOException e) {
-                throw new ExtractException("Could not write " + languageFile + " (is the storage full?).");
+                throw new ExtractException("Could not write " + languageFile.getPath() + " (is the storage full?).");
             }
         }
+        List<Entry> order = new ArrayList<>(files);
+        order.remove(userInterface);
+        order.add(userInterface);
+        for (Entry file : order) {
+            File target = new File(mapsFolder, file.name);
+            target.delete();
+            if (!new File(partial, file.name).renameTo(target))
+                throw new ExtractException("Could not move " + file.name + " into " + mapsFolder.getPath() + ".");
+        }
+        partial.delete();
     }
 
     /** a language's maps folder's language ("maps_it": "it"), else null */
@@ -333,4 +258,267 @@ final class XisoExtractor {
         String code = name.substring(5).toLowerCase(Locale.ROOT);
         return Character.isLetter(code.charAt(0)) && Character.isLetter(code.charAt(1)) ? code : null;
     }
+
+    /** No path, no . or .., and only printable ASCII that every file system takes as a plain name. */
+    static boolean isPlainName(String name) {
+        if (name == null || name.isEmpty() || name.equals(".") || name.equals(".."))
+            return false;
+        for (int index = 0; index < name.length(); index++) {
+            char character = name.charAt(index);
+
+            if (character < 0x20 || character > 0x7E || "/\\:*?\"<>|".indexOf(character) >= 0)
+                return false;
+        }
+        return true;
+    }
+
+    /* ---------- the image */
+
+    private static long u16(byte[] bytes, int offset) {
+        return (bytes[offset] & 0xFF) | (bytes[offset + 1] & 0xFF) << 8;
+    }
+
+    private static long u32(byte[] bytes, int offset) {
+        return u16(bytes, offset) | u16(bytes, offset + 2) << 16;
+    }
+
+    private static boolean hasMagic(byte[] bytes, int offset) {
+        for (int index = 0; index < MAGIC.length; index++) {
+            if (bytes[offset + index] != MAGIC[index])
+                return false;
+        }
+        return true;
+    }
+
+    /** Fills buffer from the image at position; false if the image ends first. */
+    private static boolean readFully(FileChannel image, ByteBuffer buffer, long position) throws IOException {
+        while (buffer.hasRemaining()) {
+            int count = image.read(buffer, position);
+
+            if (count <= 0)
+                return false;
+            position += count;
+        }
+        return true;
+    }
+
+    private static byte[] readTable(FileChannel image, long partition, long sector, long size, String damaged)
+            throws IOException {
+        if (size == 0 || size > MAXIMUM_TABLE_SIZE)
+            throw new ExtractException(damaged);
+        ByteBuffer table = ByteBuffer.allocate((int) size);
+        if (!readFully(image, table, partition + sector * SECTOR_SIZE))
+            throw new ExtractException("Could not read the disc image (is it complete?).");
+        return table.array();
+    }
+
+    /* ---------- directory tables */
+
+    private static final class Walk {
+        final byte[] table;
+        final boolean directories;
+        final BitSet visited = new BitSet();
+        final List<Entry> entries = new ArrayList<>();
+        int visits;
+        boolean stopped;
+
+        Walk(byte[] table, boolean directories) {
+            this.table = table;
+            this.directories = directories;
+        }
+    }
+
+    /** The folders (or the files) of a table with plain names, in the tree's order. */
+    private static List<Entry> walkTable(byte[] table, boolean directories) {
+        Walk walk = new Walk(table, directories);
+
+        walkEntry(walk, 0, 0);
+        return walk.entries;
+    }
+
+    /**
+     * The subtree whose root entry is at offset: its left subtree, the
+     * entry, its right subtree. A link to padding, past the table or back to
+     * an entry already visited ends that branch.
+     */
+    private static void walkEntry(Walk walk, int offset, int depth) {
+        byte[] table = walk.table;
+
+        if (walk.stopped || depth > MAXIMUM_DEPTH)
+            return;
+        if (offset >= table.length || table.length - offset < ENTRY_FIXED_SIZE)
+            return;
+        int left = (int) u16(table, offset);
+        int right = (int) u16(table, offset + 2);
+        if (left == PADDING_LINK || walk.visited.get(offset / 4))
+            return;
+        walk.visited.set(offset / 4);
+        if (walk.visits >= MAXIMUM_VISITS) {
+            walk.stopped = true;
+            return;
+        }
+        walk.visits++;
+
+        if (left != 0)
+            walkEntry(walk, left * 4, depth + 1);
+        int nameLength = table[offset + 13] & 0xFF;
+        if (nameLength != 0 && nameLength <= table.length - offset - ENTRY_FIXED_SIZE)
+            collect(walk, offset, nameLength);
+        if (right != 0)
+            walkEntry(walk, right * 4, depth + 1);
+    }
+
+    private static void collect(Walk walk, int offset, int nameLength) {
+        byte[] table = walk.table;
+        boolean directory = (table[offset + 12] & ATTRIBUTE_DIRECTORY) != 0;
+
+        if (directory != walk.directories || walk.entries.size() >= MAXIMUM_ENTRIES)
+            return;
+        String name = new String(table, offset + ENTRY_FIXED_SIZE, nameLength, StandardCharsets.ISO_8859_1);
+        if (!isPlainName(name))
+            return;
+        // (the destination's file system may ignore case)
+        for (Entry entry : walk.entries) {
+            if (entry.name.equalsIgnoreCase(name))
+                return;
+        }
+        walk.entries.add(new Entry(name, u32(table, offset + 4), u32(table, offset + 8)));
+    }
+
+    /* ---------- the loading screen's picture */
+
+    /**
+     * The loading screen's picture out of a default.xbe, as the TGA the game
+     * reads (uncompressed, 24 bits, rows from the bottom), or null. The
+     * executable holds it, 320 by 240, as runs of 4-bit greys (a byte each:
+     * the grey's high four bits in its low nibble, the run's length in its
+     * high one) after the width and height as u32s: found by those two
+     * numbers followed by runs that fill the picture exactly (a run of none,
+     * or one past the picture's end, is not it).
+     */
+    static byte[] loadingPicture(byte[] xbe) {
+        int pixels = LOADING_WIDTH * LOADING_HEIGHT;
+        byte[] greys = new byte[pixels];
+        boolean found = false;
+
+        for (int at = 0; at + 8 <= xbe.length && !found; at++) {
+            if (u32(xbe, at) != LOADING_WIDTH || u32(xbe, at + 4) != LOADING_HEIGHT)
+                continue;
+            int pixel = 0;
+            for (int next = at + 8; next < xbe.length && pixel < pixels; next++) {
+                int run = (xbe[next] & 0xFF) >> 4;
+
+                if (run == 0 || run > pixels - pixel)
+                    break;
+                Arrays.fill(greys, pixel, pixel + run, (byte) ((xbe[next] & 0x0F) << 4));
+                pixel += run;
+            }
+            found = pixel == pixels;
+        }
+        if (!found)
+            return null;
+        byte[] tga = new byte[TGA_HEADER_SIZE + pixels * 3];
+        tga[2] = 2;
+        tga[12] = (byte) (LOADING_WIDTH & 0xFF);
+        tga[13] = (byte) (LOADING_WIDTH >> 8);
+        tga[14] = (byte) (LOADING_HEIGHT & 0xFF);
+        tga[15] = (byte) (LOADING_HEIGHT >> 8);
+        tga[16] = 24;
+        for (int y = 0; y < LOADING_HEIGHT; y++) {
+            int row = (LOADING_HEIGHT - 1 - y) * LOADING_WIDTH;
+            for (int x = 0; x < LOADING_WIDTH; x++) {
+                int out = TGA_HEADER_SIZE + (y * LOADING_WIDTH + x) * 3;
+
+                tga[out] = tga[out + 1] = tga[out + 2] = greys[row + x];
+            }
+        }
+        return tga;
+    }
+
+    /**
+     * Writes default.xbe's picture to output, if it has one; whether it did.
+     * One that cannot be written whole is removed (the loading screen would
+     * read past one cut short).
+     */
+    private static boolean writeLoadingPicture(FileChannel image, long imageSize, long partition, Entry xbe,
+            File output) {
+        if (xbe == null || xbe.size <= 0 || xbe.size > MAXIMUM_XBE_SIZE
+                || partition + xbe.sector * SECTOR_SIZE + xbe.size > imageSize)
+            return false;
+        try {
+            ByteBuffer bytes = ByteBuffer.allocate((int) xbe.size);
+            if (!readFully(image, bytes, partition + xbe.sector * SECTOR_SIZE))
+                return false;
+            byte[] tga = loadingPicture(bytes.array());
+            if (tga == null)
+                return false;
+            try (FileOutputStream stream = new FileOutputStream(output)) {
+                stream.write(tga);
+            }
+            return true;
+        } catch (IOException | OutOfMemoryError exception) {
+            output.delete();
+            return false;
+        }
+    }
+
+    /* ---------- the copy */
+
+    private static String readFailure(Entry file) {
+        return "Could not read " + file.name + " from the disc image (is it complete?).";
+    }
+
+    /** Copies one file of the image to output; returns the bytes copied of all the files so far. */
+    private static long copyFile(FileChannel image, long partition, Entry file, File output, ByteBuffer buffer,
+            long done, long total, Progress progress) throws IOException {
+        String writeFailure = "Could not write " + output.getPath() + " (is the storage full?).";
+        long position = partition + file.sector * SECTOR_SIZE;
+        long remaining = file.size;
+        FileOutputStream stream = null;
+
+        try {
+            stream = new FileOutputStream(output);
+            FileChannel channel = stream.getChannel();
+            while (remaining > 0) {
+                int count = (int) Math.min(remaining, COPY_CHUNK);
+                boolean read;
+
+                buffer.clear();
+                buffer.limit(count);
+                try {
+                    read = readFully(image, buffer, position);
+                } catch (IOException exception) {
+                    read = false;
+                }
+                if (!read)
+                    throw new ExtractException(readFailure(file));
+                buffer.flip();
+                while (buffer.hasRemaining()) {
+                    if (channel.write(buffer) <= 0)
+                        throw new ExtractException(writeFailure);
+                }
+                position += count;
+                remaining -= count;
+                done += count;
+                if (progress != null)
+                    progress.report(file.name, done, total);
+            }
+            FileOutputStream closing = stream;
+            stream = null;
+            closing.close();
+        } catch (ExtractException exception) {
+            throw exception;
+        } catch (IOException exception) {
+            throw new ExtractException(writeFailure);
+        } finally {
+            if (stream != null) {
+                try {
+                    stream.close();
+                } catch (IOException ignored) {
+                    // (the copy failed already)
+                }
+            }
+        }
+        return done;
+    }
 }

port/android/host/host_memory.c

@@ -834,6 +834,10 @@ long host_guest_mprotect(uint64_t address, uint64_t size, int protection)
 
 #define WATCH_PAGE_COUNT (HALO_GUEST_WINDOW_SIZE / PAGE)
 
+/* (each page: 0 not watched, 1 watched and read-only, 2 made writable by a
+watched write. A fault on a page at 2 is a write another thread made as
+this one was making the page writable, and is made again; one on a page at
+0, freed memory or none of the watch's, is a crash) */
 static uint8_t page_protected[WATCH_PAGE_COUNT];
 static uint32_t page_generation[WATCH_PAGE_COUNT];
 static volatile uint32_t current_generation = 1;
@@ -867,7 +871,7 @@ static uint64_t watch_page(uint64_t address)
 static void mark_written(uint64_t page)
 {
 	page_generation[page] = __sync_add_and_fetch(&current_generation, 1);
-	page_protected[page] = 0;
+	page_protected[page] = 2;
 	mprotect((void *)(HALO_GUEST_WINDOW_BASE + page * PAGE), PAGE, PROT_READ | PROT_WRITE);
 }
 
@@ -934,11 +938,13 @@ static void segv_handler(int signal_number, siginfo_t *information, void *contex
 	{
 		uint64_t page = watch_page(address);
 
-		if (page_protected[page])
+		if (page_protected[page] == 1)
 		{
 			mark_written(page);
 			return;
 		}
+		if (page_protected[page] == 2)
+			return;
 	}
 	report_crash(signal_number, information, context);
 	chain(&previous_segv, signal_number, information, context);
@@ -1001,7 +1007,7 @@ void host_memory_watch_protect(uint32_t address, uint32_t size)
 	}
 	for (page = first; page <= last; page++)
 	{
-		if (!page_protected[page])
+		if (page_protected[page] != 1)
 		{
 			page_protected[page] = 1;
 			mprotect((void *)(HALO_GUEST_WINDOW_BASE + page * PAGE), PAGE, PROT_READ);
@@ -1056,7 +1062,7 @@ void host_memory_watch_prepare_write(uint32_t address, uint32_t size)
 		last = WATCH_PAGE_COUNT - 1;
 	for (page = first; page <= last; page++)
 	{
-		if (page_protected[page])
+		if (page_protected[page] == 1)
 			mark_written(page);
 	}
 }

port/android/steam_frame_xiso.py

@@ -1,66 +1,50 @@
 #!/usr/bin/env python3
 """
-Copies the maps folder out of an Xbox disc image (an "xiso", or a whole
-disc's ".iso") on the Steam Frame's SteamOS side, for its installer
-(steam_frame_install.sh). It reads the image as the app's own import does
+Copies the maps folder out of the player's Xbox disc image of Halo (an
+"xiso", or a whole disc's ".iso") on the Steam Frame's SteamOS side, for
+its installer (steam_frame_install.sh), as the app's own import does
 (app/src/main/java/com/halo/decomp/XisoExtractor.java, which this follows;
 the desktop games' is port/linux/src/xiso.c).
 
     steam_frame_xiso.py <image> <destination>
 
-writes <destination>/maps (through maps.partial, so an interrupted copy
-never leaves maps/ui.map behind) and prints its progress for zenity
---progress: a percentage on a line of its own, and "# <text>" lines. On
-failure it prints "error: <reason the player can act on>" to stderr and
-exits 1.
+writes <destination>/maps (through maps.partial, ui.map moved in last, so
+an interrupted copy never leaves maps/ui.map behind) and prints its
+progress for zenity --progress: a percentage on a line of its own, and
+"# <text>" lines. On failure it prints "error: <reason the player can act
+on>" to stderr and exits 1.
 
-The image's file system is XDVDFS, read as extract-xiso does
-(https://github.com/XboxDev/extract-xiso, extract-xiso.c, whose format
-handling this follows; its license is below and in
-port/third_party/extract-xiso/LICENSE.TXT): 2048-byte sectors; a volume
-descriptor at 0x10000 that starts and ends with "MICROSOFT*XBOX*MEDIA" and
-gives the root directory's sector and size; and directories whose entries
-form a binary tree (each entry: left and right subtree offsets in 4-byte
-units, the start sector, the size, attributes, the name's length and the
-name). Images made from a whole disc put the game partition further in, at
-one of the offsets below.
+Written from a description of the Xbox's disc file system, XDVDFS
+(xboxdevwiki's XDVDFS page, https://xboxdevwiki.net/XDVDFS), as
+XisoExtractor.java is:
 
-Some parts of this code are copyright in@fishtank.com. This product
-includes software developed by in <in@fishtank.com>.
+- Sectors are 2048 bytes and integers little-endian. Sector numbers count
+  from the start of the game partition: an image of the partition alone has
+  it at 0, an image of a whole disc further in (PARTITION_STARTS, tried in
+  that order).
+- The volume descriptor is the partition's sector 32 (at 0x10000). It holds
+  "MICROSOFT*XBOX*MEDIA" at its start and again at 0x7EC, and the root
+  directory table's start sector (u32 at 0x14) and size in bytes (u32 at
+  0x18).
+- A directory table is a binary tree of entries whose root is the entry at
+  offset 0. An entry is a left and a right subtree link (u16 each, in 4-byte
+  units from the table's start, 0 for none), the start sector and the size
+  of the file or of the subdirectory's table (u32 each), the attributes (u8,
+  0x10 for a directory), the name's length (u8) and the name. Unused bytes
+  are 0xFF, so a left link of 0xFFFF is padding, not an entry.
+- A file is one contiguous run of bytes from the start of its sector.
 
-Copyright (c) 2003 in <in@fishtank.com>
-All rights reserved.
+The image is the player's file and nothing read from it is trusted: only
+the root's table and the maps folder's are read, each whole and at most
+4 MB; a table's walk visits each offset once, goes at most 64 links deep
+and looks at most 4096 entries; and a file is written only under a plain
+name that no file before it had (ignoring case).
 
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions
-are met:
-
-1. Redistributions of source code must retain the above copyright
-   notice, this list of conditions and the following disclaimer.
-
-2. Redistributions in binary form must reproduce the above copyright
-   notice, this list of conditions and the following disclaimer in the
-   documentation and/or other materials provided with the distribution.
-
-3. All advertising materials mentioning features or use of this software
-   must display the following acknowledgement:
-
-   This product includes software developed by in <in@fishtank.com>.
-
-4. Neither the name of "in" nor the email address "in@fishtank.com"
-   may be used to endorse or promote products derived from this software
-   without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED `AS IS' AND ANY EXPRESS OR IMPLIED WARRANTIES
-INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
-FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
-AUTHOR OR ANY CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
-PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
-OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
-WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
-OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
-ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+A European disc in two languages (Spanish and Italian) has no maps folder
+but one for each, maps_es and maps_it: the one for the language asked for
+(RINGFALL_LANGUAGE, else the system's) is taken, else English's, else the
+first, and its language written to maps/language.txt, which the game takes
+as the Xbox's language while game.language is unset.
 """
 
 import os
@@ -68,74 +52,100 @@ import struct
 import sys
 
 SECTOR_SIZE = 2048
-VOLUME_DESCRIPTOR_OFFSET = 0x10000
-ENTRY_HEADER_SIZE = 14
+DESCRIPTOR_OFFSET = 0x10000
+MAGIC = b"MICROSOFT*XBOX*MEDIA"
+SECOND_MAGIC_OFFSET = 0x7EC
+ENTRY_FIXED_SIZE = 14
 ATTRIBUTE_DIRECTORY = 0x10
+PADDING_LINK = 0xFFFF
+# where the game partition may start: an image of the partition alone, a
+# whole XGD2, XGD3 and XGD1 (the original Xbox's) disc
+PARTITION_STARTS = (0x00000000, 0x0FD90000, 0x02080000, 0x18300000)
 # directory tables are a few sectors; anything much larger is not one
-MAXIMUM_DIRECTORY_SIZE = 4 << 20
-MAXIMUM_FILES = 256
-COPY_BUFFER_SIZE = 1 << 20
-VOLUME_MAGIC = b"MICROSOFT*XBOX*MEDIA"
-# where the game partition starts: a plain image, and whole-disc images
-# (extract-xiso's GLOBAL, XGD3 and XGD1 offsets)
-PARTITION_OFFSETS = (0, 0x0FD90000, 0x02080000, 0x18300000)
+MAXIMUM_TABLE_SIZE = 4 << 20
+MAXIMUM_DEPTH = 64
+MAXIMUM_VISITS = 4096
+MAXIMUM_ENTRIES = 256
+COPY_CHUNK = 1 << 20
+PARTIAL_DIRECTORY = "maps.partial"
 
 
 class ExtractError(Exception):
     """a reason the player can act on"""
 
 
-def read_at(image, offset, size):
-    image.seek(offset)
+def read_exactly(image, position, size):
+    """size bytes of the image from position; None if it ends first"""
+    image.seek(position)
     data = image.read(size)
-    if len(data) != size:
-        raise ExtractError("Could not read the disc image (is it complete?).")
-    return data
+    return data if len(data) == size else None
 
 
-def find_volume(image):
-    """the game partition's offset, and the root directory's sector and size"""
-    for offset in PARTITION_OFFSETS:
-        try:
-            descriptor = read_at(image, offset + VOLUME_DESCRIPTOR_OFFSET, SECTOR_SIZE)
-        except ExtractError:
+def find_partition(image, image_size):
+    """the game partition's start, and the root table's sector and size"""
+    for start in PARTITION_STARTS:
+        if start + DESCRIPTOR_OFFSET + SECTOR_SIZE > image_size:
             continue
-        if descriptor[:20] != VOLUME_MAGIC or descriptor[0x7EC:0x7EC + 20] != VOLUME_MAGIC:
+        descriptor = read_exactly(image, start + DESCRIPTOR_OFFSET, SECTOR_SIZE)
+        if (descriptor is None or descriptor[:len(MAGIC)] != MAGIC or
+                descriptor[SECOND_MAGIC_OFFSET:SECOND_MAGIC_OFFSET + len(MAGIC)] != MAGIC):
             continue
-        sector, size = struct.unpack_from("<II", descriptor, 20)
-        return offset, sector, size
+        sector, size = struct.unpack_from("<II", descriptor, 0x14)
+        return start, sector, size
     raise ExtractError("This is not an Xbox disc image.")
 
 
-def read_directory(image, partition, sector, size, what):
-    if size <= 0 or size > MAXIMUM_DIRECTORY_SIZE:
-        raise ExtractError(what)
-    return read_at(image, partition + sector * SECTOR_SIZE, size)
+def read_table(image, partition, sector, size, damaged):
+    if size == 0 or size > MAXIMUM_TABLE_SIZE:
+        raise ExtractError(damaged)
+    table = read_exactly(image, partition + sector * SECTOR_SIZE, size)
+    if table is None:
+        raise ExtractError("Could not read the disc image (is it complete?).")
+    return table
 
 
-def walk(table, offset, depth, directories, out, visited):
-    """collects the entries (name, sector, size) of the subtree at offset
-    (4-byte units), files or directories as asked"""
-    at = offset * 4
-    # a malformed table must not loop or run off its end
-    visited[0] += 1
-    if depth > 64 or visited[0] > 4096 or at + ENTRY_HEADER_SIZE > len(table):
-        return
-    left, right, sector, size, attributes, name_length = struct.unpack_from("<HHIIBB", table, at)
-    # 0xFFFF: padding, an empty directory
-    if left == 0xFFFF:
-        return
-    if left:
-        walk(table, left, depth + 1, directories, out, visited)
-    is_directory = bool(attributes & ATTRIBUTE_DIRECTORY)
-    if (at + ENTRY_HEADER_SIZE + name_length <= len(table) and name_length > 0
-            and is_directory == directories and len(out) < MAXIMUM_FILES):
-        name = table[at + ENTRY_HEADER_SIZE:at + ENTRY_HEADER_SIZE + name_length].decode("latin-1")
-        # (as extract-xiso refuses them: no name may leave the folder)
-        if name not in (".", "..") and "/" not in name and "\\" not in name:
-            out.append((name, sector, size))
-    if right:
-        walk(table, right, depth + 1, directories, out, visited)
+def is_plain_name(name):
+    """no path, no . or .., and only printable ASCII that every file system
+    takes as a plain name"""
+    if not name or name in (".", ".."):
+        return False
+    return all(0x20 <= ord(character) <= 0x7E and character not in '/\\:*?"<>|' for character in name)
+
+
+def walk_table(table, directories):
+    """the folders (or the files) of a table with plain names, as (name,
+    sector, size), in the tree's order: each entry's left subtree, the entry,
+    its right subtree; a link to padding, past the table or back to an entry
+    already visited ends that branch"""
+    entries, visited = [], set()
+    visits = [0]
+
+    def walk(offset, depth):
+        if depth > MAXIMUM_DEPTH or visits[0] >= MAXIMUM_VISITS:
+            return
+        if offset >= len(table) or len(table) - offset < ENTRY_FIXED_SIZE:
+            return
+        left, right = struct.unpack_from("<HH", table, offset)
+        if left == PADDING_LINK or offset // 4 in visited:
+            return
+        visited.add(offset // 4)
+        visits[0] += 1
+        if left:
+            walk(left * 4, depth + 1)
+        name_length = table[offset + 13]
+        if name_length and name_length <= len(table) - offset - ENTRY_FIXED_SIZE:
+            is_directory = bool(table[offset + 12] & ATTRIBUTE_DIRECTORY)
+            name = table[offset + ENTRY_FIXED_SIZE:offset + ENTRY_FIXED_SIZE + name_length].decode("latin-1")
+            # (the destination's file system may ignore case)
+            if (is_directory == directories and len(entries) < MAXIMUM_ENTRIES and is_plain_name(name) and
+                    all(entry[0].lower() != name.lower() for entry in entries)):
+                sector, size = struct.unpack_from("<II", table, offset + 4)
+                entries.append((name, sector, size))
+        if right:
+            walk(right * 4, depth + 1)
+
+    walk(0, 0)
+    return entries
 
 
 def maps_language(name):
@@ -145,65 +155,67 @@ def maps_language(name):
     return None
 
 
+def choose_maps(folders):
+    """the maps folder, and its language (None for a plain "maps")"""
+    for folder in folders:
+        if folder[0].lower() == "maps":
+            return folder, None
+    languages = [(maps_language(folder[0]), folder) for folder in folders if maps_language(folder[0])]
+    wanted = (os.environ.get("RINGFALL_LANGUAGE") or os.environ.get("LC_ALL") or
+        os.environ.get("LC_MESSAGES") or os.environ.get("LANG") or "")[:2].lower()
+    for preferred in (wanted, "en"):
+        for language, folder in languages:
+            if language == preferred:
+                return folder, language
+    if languages:
+        return languages[0][1], languages[0][0]
+    raise ExtractError("The disc image has no maps folder: it is not a Halo disc.")
+
+
 def extract(image_path, destination):
     with open(image_path, "rb") as image:
-        partition, root_sector, root_size = find_volume(image)
+        image_size = os.fstat(image.fileno()).st_size
+        partition, root_sector, root_size = find_partition(image, image_size)
 
         # the root's maps folder
-        table = read_directory(image, partition, root_sector, root_size,
-            "The disc image's file system is damaged.")
-        directories = []
-        walk(table, 0, 0, True, directories, [0])
-        maps = [entry for entry in directories if entry[0].lower() == "maps"]
-        # (a European disc in two languages, Spanish and Italian, has a maps
-        # folder for each, maps_es and maps_it: the one for the language
-        # asked for (RINGFALL_LANGUAGE, else the system's), else English's,
-        # else the first; its language goes into maps/language.txt, which the
-        # game takes as game.language's when that is unset)
-        language = None
-        if not maps:
-            languages = [(maps_language(entry[0]), entry) for entry in directories if maps_language(entry[0])]
-            wanted = (os.environ.get("RINGFALL_LANGUAGE") or os.environ.get("LC_ALL") or
-                os.environ.get("LC_MESSAGES") or os.environ.get("LANG") or "")[:2].lower()
-            for preferred in (wanted, "en"):
-                chosen = [pair for pair in languages if pair[0] == preferred]
-                if chosen:
-                    break
-            chosen = chosen or languages[:1]
-            if chosen:
-                language, entry = chosen[0]
-                maps = [entry]
-        if not maps:
-            raise ExtractError("The disc image has no maps folder: it is not a Halo disc.")
+        root = read_table(image, partition, root_sector, root_size, "The disc image's file system is damaged.")
+        (_, maps_sector, maps_size), language = choose_maps(walk_table(root, True))
 
         # its files
-        table = read_directory(image, partition, maps[-1][1], maps[-1][2],
-            "The disc image's maps folder is damaged.")
-        files = []
-        walk(table, 0, 0, False, files, [0])
-        if not any(name.lower() == "ui.map" for name, _, _ in files):
+        table = read_table(image, partition, maps_sector, maps_size, "The disc image's maps folder is damaged.")
+        files = walk_table(table, False)
+        user_interface = next((file for file in files if file[0].lower() == "ui.map"), None)
+        if user_interface is None:
             raise ExtractError("The disc image's maps folder has no ui.map: it is not a Halo disc.")
+        # (an image that ends before a file does is refused before anything
+        # is written; an empty file's sector need not be anywhere)
+        for name, sector, size in files:
+            if size and partition + sector * SECTOR_SIZE + size > image_size:
+                raise ExtractError("Could not read %s from the disc image (is it complete?)." % name)
         total = sum(size for _, _, size in files) or 1
 
-        partial = os.path.join(destination, "maps.partial")
-        finished = os.path.join(destination, "maps")
+        # the copy, to maps.partial (emptied of what an earlier attempt left)
+        partial = os.path.join(destination, PARTIAL_DIRECTORY)
         try:
             os.makedirs(partial, exist_ok=True)
+            for leftover in os.listdir(partial):
+                os.remove(os.path.join(partial, leftover))
         except OSError:
             raise ExtractError("Could not create %s." % partial)
-        done = 0
-        shown = -1
+        done, shown = 0, -1
         for name, sector, size in files:
             path = os.path.join(partial, name)
-            offset = partition + sector * SECTOR_SIZE
-            remaining = size
+            position, remaining = partition + sector * SECTOR_SIZE, size
             print("# Copying maps/%s" % name, flush=True)
             try:
                 with open(path, "wb") as out:
                     while remaining > 0:
-                        count = min(remaining, COPY_BUFFER_SIZE)
-                        out.write(read_at(image, offset, count))
-                        offset += count
+                        count = min(remaining, COPY_CHUNK)
+                        data = read_exactly(image, position, count)
+                        if data is None:
+                            raise ExtractError("Could not read %s from the disc image (is it complete?)." % name)
+                        out.write(data)
+                        position += count
                         remaining -= count
                         done += count
                         # (zenity closes at 100: that is left to the caller)
@@ -211,23 +223,24 @@ def extract(image_path, destination):
                         if percent != shown:
                             print(percent, flush=True)
                             shown = percent
-            except ExtractError:
-                raise ExtractError("Could not read %s from the disc image (is it complete?)." % name)
             except OSError:
                 raise ExtractError("Could not write %s (is the storage full?)." % path)
 
-    # (the maps folder may be there, empty)
+    # then into maps (which may be there, empty), the language before and
+    # ui.map (the sign that the data is there) last
+    finished = os.path.join(destination, "maps")
     try:
         os.makedirs(finished, exist_ok=True)
-        for name, _, _ in files:
-            os.replace(os.path.join(partial, name), os.path.join(finished, name))
-        os.rmdir(partial)
         language_file = os.path.join(finished, "language.txt")
         if os.path.exists(language_file):
             os.remove(language_file)
         if language:
             with open(language_file, "w") as out:
                 out.write(language + "\n")
+        order = [file for file in files if file is not user_interface] + [user_interface]
+        for name, _, _ in order:
+            os.replace(os.path.join(partial, name), os.path.join(finished, name))
+        os.rmdir(partial)
     except OSError as error:
         raise ExtractError("Could not move the maps into %s (%s)." % (finished, error.strerror))
 

port/assets/hud/custom_edition.json

@@ -0,0 +1,197 @@
+{
+ "note": "High-res HUD textures whose bitmap has the same layout in Halo Custom Edition (the same sprites, the same size or twice it), compared against the stock bitmaps.map and bloodgulch.map; hud_hires.c draws them for a Custom Edition map's stock bitmap of that name as well.",
+ "assets": [
+  {
+   "tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_outlines",
+   "bitmap": 0
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_outlines",
+   "bitmap": 1
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_outlines",
+   "bitmap": 2
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_outlines",
+   "bitmap": 3
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_type_icons",
+   "bitmap": 0
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_type_icons",
+   "bitmap": 1
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_type_icons",
+   "bitmap": 2
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_type_icons",
+   "bitmap": 3
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\combined\\hud_ammo_type_icons",
+   "bitmap": 4
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\combined\\hud_counter_numbers",
+   "bitmap": 0
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\combined\\hud_damage_arrows",
+   "bitmap": 0
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\combined\\hud_unit_backgrounds",
+   "bitmap": 0
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\combined\\hud_unit_backgrounds",
+   "bitmap": 1
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\combined\\hud_unit_backgrounds",
+   "bitmap": 2
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\combined\\hud_unit_backgrounds",
+   "bitmap": 3
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\combined\\hud_unit_backgrounds",
+   "bitmap": 4
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\combined\\hud_unit_backgrounds",
+   "bitmap": 5
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\combined\\hud_unit_backgrounds",
+   "bitmap": 6
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\combined\\hud_unit_backgrounds",
+   "bitmap": 7
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\combined\\hud_waypoints",
+   "bitmap": 0
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\combined\\hud_weapon_backgrounds",
+   "bitmap": 0
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\combined\\hud_weapon_backgrounds",
+   "bitmap": 1
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\combined\\hud_weapon_backgrounds",
+   "bitmap": 2
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\combined\\hud_weapon_backgrounds",
+   "bitmap": 3
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\combined\\hud_weapon_backgrounds",
+   "bitmap": 4
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\hud_health_base",
+   "bitmap": 0
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\hud_multiplayer",
+   "bitmap": 0
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\hud_sensor_blip",
+   "bitmap": 0
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\hud_sensor_blip_custom",
+   "bitmap": 0
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\hud_sweeper",
+   "bitmap": 0
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\hud_sweeper_mask",
+   "bitmap": 0
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\pistol\\pistol_scope_mask",
+   "bitmap": 0
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\pistol\\pistol_scope_mask split",
+   "bitmap": 0
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs2",
+   "bitmap": 0
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs2",
+   "bitmap": 1
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs2",
+   "bitmap": 2
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs2",
+   "bitmap": 3
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs2",
+   "bitmap": 4
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs_sm",
+   "bitmap": 0
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs_sm",
+   "bitmap": 1
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs_sm",
+   "bitmap": 2
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs_sm",
+   "bitmap": 3
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_crosshairs_sm",
+   "bitmap": 4
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_mask2",
+   "bitmap": 0
+  },
+  {
+   "tag": "ui\\hud\\bitmaps\\sniper\\sniper_scope_mask_sm",
+   "bitmap": 0
+  },
+  {
+   "tag": "weapons\\sniper rifle\\bitmaps\\angle_ticks",
+   "bitmap": 0
+  },
+  {
+   "tag": "weapons\\sniper rifle\\bitmaps\\angle_ticks2",
+   "bitmap": 0
+  },
+  {
+   "tag": "weapons\\sniper rifle\\bitmaps\\angle_ticks_mask",
+   "bitmap": 0
+  }
+ ]
+}

port/assets/menus/NON_HANDDRAWN.md

@@ -62,7 +62,7 @@ until it is redrawn.
 | `ce/shell/main_menu/settings_select/player_setup/player_profile_edit/profile_options__6.png` | 512x256 | `shell/main_menu/settings_select/player_setup/player_profile_edit/profile_options__6.png` |
 | `ce/shell/main_menu/settings_select/player_setup/player_profile_edit/profile_options__8.png` | 512x256 | `shell/main_menu/settings_select/player_setup/player_profile_edit/profile_options__8.png` |
 
-13 of 177 frames are placeholders.
+13 of 183 frames are placeholders.
 
 The PC version's `ui\gamespy` and `ui\ticker` fonts are drawn with `ui\small_ui`, which
 the Xbox's map has.

port/assets/menus/README.md

@@ -100,6 +100,14 @@ the bitmap has exactly two frames; the game's functions choose others.
 
 A list of texts, which widgets show by number. `\n` starts a new line.
 
+A list may name the PC version's list of the same texts with `map=` (its tag,
+`ui\shell\main_menu\main_menu_options`), and each of its texts that is one
+of that list's its number there (`<string text="NEW CAMPAIGN" map="0"/>`).
+Each Custom Edition has that list in its language in its `loc.map`: with
+`display.menu_language = "maps"`, a text with a number is the list's from
+the `loc.map` in `custom_maps`, when it has the list and the number. A text
+without one (the port's own) is always the file's.
+
 ### `<widget>`
 
 A screen, or a part of one. Its children are `<widget>` elements in it, or

port/assets/menus/ce/bitmaps.xml

@@ -348,25 +348,31 @@
 		<frame png="ce/port/pause/pausebox_left__0.png" width="16" height="256"/>
 		<frame png="ce/port/pause/pausebox_left__1.png" width="16" height="256"/>
 		<frame png="ce/port/pause/pausebox_left__2.png" width="16" height="256"/>
+		<frame png="ce/port/pause/pausebox_left__3.png" width="16" height="256"/>
 	</bitmap>
 	<bitmap name="pause/pausebox_center">
 		<frame png="ce/port/pause/pausebox_center__0.png" width="4" height="256"/>
 		<frame png="ce/port/pause/pausebox_center__1.png" width="4" height="256"/>
 		<frame png="ce/port/pause/pausebox_center__2.png" width="4" height="256"/>
+		<frame png="ce/port/pause/pausebox_center__3.png" width="4" height="256"/>
 	</bitmap>
 	<bitmap name="pause/pausebox_right">
 		<frame png="ce/port/pause/pausebox_right__0.png" width="16" height="256"/>
 		<frame png="ce/port/pause/pausebox_right__1.png" width="16" height="256"/>
 		<frame png="ce/port/pause/pausebox_right__2.png" width="16" height="256"/>
+		<frame png="ce/port/pause/pausebox_right__3.png" width="16" height="256"/>
 	</bitmap>
 	<bitmap name="pause/objectives_left">
 		<frame png="ce/port/pause/objectives_left__0.png" width="16" height="256"/>
+		<frame png="ce/port/pause/objectives_left__1.png" width="16" height="256"/>
 	</bitmap>
 	<bitmap name="pause/objectives_center">
 		<frame png="ce/port/pause/objectives_center__0.png" width="4" height="256"/>
+		<frame png="ce/port/pause/objectives_center__1.png" width="4" height="256"/>
 	</bitmap>
 	<bitmap name="pause/objectives_right">
 		<frame png="ce/port/pause/objectives_right__0.png" width="16" height="256"/>
+		<frame png="ce/port/pause/objectives_right__1.png" width="16" height="256"/>
 	</bitmap>
 	<bitmap name="voice/speaker">
 		<frame png="ce/port/voice/speaker__0.png" width="24" height="24"/>

port/assets/menus/ce/main_menu.multiplayer_type_select.server_settings.xml

@@ -236,9 +236,11 @@
 		<on event="created" run="port setup options init"/>
 		<child widget="main_menu/multiplayer_type_select/server_settings/coop_options/op_coop_friendly_fire" x="54" y="73"/>
 		<child widget="main_menu/multiplayer_type_select/server_settings/coop_options/op_coop_extra_enemies" x="54" y="103"/>
-		<child widget="main_menu/multiplayer_type_select/server_settings/coop_options/op_coop_enemies_per_player" x="54" y="133"/>
-		<child widget="main_menu/multiplayer_type_select/server_settings/coop_options/op_coop_enemies_multiplier" x="54" y="133"/>
-		<child widget="main_menu/multiplayer_type_select/server_settings/coop_options/op_coop_player_collisions" x="54" y="163"/>
+		<child widget="main_menu/multiplayer_type_select/server_settings/coop_options/op_coop_extra_pickups" x="54" y="133"/>
+		<child widget="main_menu/multiplayer_type_select/server_settings/coop_options/op_coop_extra_vehicles" x="54" y="163"/>
+		<child widget="main_menu/multiplayer_type_select/server_settings/coop_options/op_coop_enemies_multiplier" x="54" y="193"/>
+		<child widget="main_menu/multiplayer_type_select/server_settings/coop_options/op_coop_enemies_per_player" x="54" y="223"/>
+		<child widget="main_menu/multiplayer_type_select/server_settings/coop_options/op_coop_player_collisions" x="54" y="253"/>
 		<child widget="main_menu/multiplayer_type_select/server_settings/coop_options/coop_options_button_bar" y="414"/>
 	</widget>
 	<widget name="main_menu/multiplayer_type_select/server_settings/coop_options/coop_options_button_bar" type="column_list" width="640" height="28" flags="pass_unhandled_to_focused_child left_right_tabs_items">
@@ -276,31 +278,43 @@
 		<on event="left_mouse" run="mouse spinner 1wide click"/>
 	</widget>
 	<strings name="main_menu/multiplayer_type_select/server_settings/coop_options/var_coop_extra_enemies">
-		<string text="NONE"/>
 		<string text="PER PLAYER"/>
 		<string text="STATIC MULTIPLIER"/>
+		<string text="NONE"/>
 	</strings>
-	<widget name="main_menu/multiplayer_type_select/server_settings/coop_options/op_coop_enemies_per_player" width="512" height="28" flags="pass_unhandled_to_focused_child" bitmap="bitmaps/option_bkds" color="#FF2896FF">
-		<child widget="main_menu/multiplayer_type_select/server_settings/coop_options/coop_enemies_per_player_label"/>
-		<child widget="main_menu/multiplayer_type_select/server_settings/coop_options/coop_enemies_per_player_spinner" x="286" y="1"/>
+	<widget name="main_menu/multiplayer_type_select/server_settings/coop_options/op_coop_extra_pickups" width="512" height="28" flags="pass_unhandled_to_focused_child" bitmap="bitmaps/option_bkds" color="#FF2896FF">
+		<child widget="main_menu/multiplayer_type_select/server_settings/coop_options/coop_extra_pickups_label"/>
+		<child widget="main_menu/multiplayer_type_select/server_settings/coop_options/coop_extra_pickups_spinner" x="286" y="1"/>
 	</widget>
-	<widget name="main_menu/multiplayer_type_select/server_settings/coop_options/coop_enemies_per_player_label" type="text" controller="1" width="300" height="22" string_list="main_menu/multiplayer_type_select/server_settings/coop_options/coop_options_labels" string_index="2" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
+	<widget name="main_menu/multiplayer_type_select/server_settings/coop_options/coop_extra_pickups_label" type="text" controller="1" width="300" height="22" string_list="main_menu/multiplayer_type_select/server_settings/coop_options/coop_options_labels" string_index="2" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
 	</widget>
-	<widget name="main_menu/multiplayer_type_select/server_settings/coop_options/coop_enemies_per_player_spinner" type="spinner" top="2" width="206" height="20" flags="pass_unhandled_to_focused_child left_right_tabs_items" string_list="main_menu/multiplayer_type_select/server_settings/coop_options/var_coop_enemies_per_player" font="ui\large_ui" color="#FF2896FF" align="center" text_y="4" list_flags="items_from_strings" header_bitmap="bitmaps/arrow_sm_left" footer_bitmap="bitmaps/arrow_sm_right" header_bounds="7 -13 19 -7" footer_bounds="7 208 19 214">
+	<widget name="main_menu/multiplayer_type_select/server_settings/coop_options/coop_extra_pickups_spinner" type="spinner" top="2" width="206" height="20" flags="pass_unhandled_to_focused_child left_right_tabs_items" string_list="main_menu/multiplayer_type_select/server_settings/coop_options/var_coop_extra_pickups" font="ui\large_ui" color="#FF2896FF" align="center" text_y="4" list_flags="items_from_strings" header_bitmap="bitmaps/arrow_sm_left" footer_bitmap="bitmaps/arrow_sm_right" header_bounds="7 -13 19 -7" footer_bounds="7 208 19 214">
 		<on event="left_mouse" run="mouse spinner 1wide click"/>
 	</widget>
-	<strings name="main_menu/multiplayer_type_select/server_settings/coop_options/var_coop_enemies_per_player">
-		<string text="25%"/>
-		<string text="50%"/>
-		<string text="100%"/>
-		<string text="150%"/>
-		<string text="200%"/>
+	<strings name="main_menu/multiplayer_type_select/server_settings/coop_options/var_coop_extra_pickups">
+		<string text="PER PLAYER"/>
+		<string text="STATIC MULTIPLIER"/>
+		<string text="NONE"/>
+	</strings>
+	<widget name="main_menu/multiplayer_type_select/server_settings/coop_options/op_coop_extra_vehicles" width="512" height="28" flags="pass_unhandled_to_focused_child" bitmap="bitmaps/option_bkds" color="#FF2896FF">
+		<child widget="main_menu/multiplayer_type_select/server_settings/coop_options/coop_extra_vehicles_label"/>
+		<child widget="main_menu/multiplayer_type_select/server_settings/coop_options/coop_extra_vehicles_spinner" x="286" y="1"/>
+	</widget>
+	<widget name="main_menu/multiplayer_type_select/server_settings/coop_options/coop_extra_vehicles_label" type="text" controller="1" width="300" height="22" string_list="main_menu/multiplayer_type_select/server_settings/coop_options/coop_options_labels" string_index="3" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
+	</widget>
+	<widget name="main_menu/multiplayer_type_select/server_settings/coop_options/coop_extra_vehicles_spinner" type="spinner" top="2" width="206" height="20" flags="pass_unhandled_to_focused_child left_right_tabs_items" string_list="main_menu/multiplayer_type_select/server_settings/coop_options/var_coop_extra_vehicles" font="ui\large_ui" color="#FF2896FF" align="center" text_y="4" list_flags="items_from_strings" header_bitmap="bitmaps/arrow_sm_left" footer_bitmap="bitmaps/arrow_sm_right" header_bounds="7 -13 19 -7" footer_bounds="7 208 19 214">
+		<on event="left_mouse" run="mouse spinner 1wide click"/>
+	</widget>
+	<strings name="main_menu/multiplayer_type_select/server_settings/coop_options/var_coop_extra_vehicles">
+		<string text="PER PLAYER"/>
+		<string text="STATIC MULTIPLIER"/>
+		<string text="NONE"/>
 	</strings>
 	<widget name="main_menu/multiplayer_type_select/server_settings/coop_options/op_coop_enemies_multiplier" width="512" height="28" flags="pass_unhandled_to_focused_child" bitmap="bitmaps/option_bkds" color="#FF2896FF">
 		<child widget="main_menu/multiplayer_type_select/server_settings/coop_options/coop_enemies_multiplier_label"/>
 		<child widget="main_menu/multiplayer_type_select/server_settings/coop_options/coop_enemies_multiplier_spinner" x="286" y="1"/>
 	</widget>
-	<widget name="main_menu/multiplayer_type_select/server_settings/coop_options/coop_enemies_multiplier_label" type="text" controller="1" width="300" height="22" string_list="main_menu/multiplayer_type_select/server_settings/coop_options/coop_options_labels" string_index="3" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
+	<widget name="main_menu/multiplayer_type_select/server_settings/coop_options/coop_enemies_multiplier_label" type="text" controller="1" width="300" height="22" string_list="main_menu/multiplayer_type_select/server_settings/coop_options/coop_options_labels" string_index="4" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
 	</widget>
 	<widget name="main_menu/multiplayer_type_select/server_settings/coop_options/coop_enemies_multiplier_spinner" type="spinner" top="2" width="206" height="20" flags="pass_unhandled_to_focused_child left_right_tabs_items" string_list="main_menu/multiplayer_type_select/server_settings/coop_options/var_coop_enemies_multiplier" font="ui\large_ui" color="#FF2896FF" align="center" text_y="4" list_flags="items_from_strings" header_bitmap="bitmaps/arrow_sm_left" footer_bitmap="bitmaps/arrow_sm_right" header_bounds="7 -13 19 -7" footer_bounds="7 208 19 214">
 		<on event="left_mouse" run="mouse spinner 1wide click"/>
@@ -312,11 +326,27 @@
 		<string text="16X"/>
 		<string text="32X"/>
 	</strings>
+	<widget name="main_menu/multiplayer_type_select/server_settings/coop_options/op_coop_enemies_per_player" width="512" height="28" flags="pass_unhandled_to_focused_child" bitmap="bitmaps/option_bkds" color="#FF2896FF">
+		<child widget="main_menu/multiplayer_type_select/server_settings/coop_options/coop_enemies_per_player_label"/>
+		<child widget="main_menu/multiplayer_type_select/server_settings/coop_options/coop_enemies_per_player_spinner" x="286" y="1"/>
+	</widget>
+	<widget name="main_menu/multiplayer_type_select/server_settings/coop_options/coop_enemies_per_player_label" type="text" controller="1" width="300" height="22" string_list="main_menu/multiplayer_type_select/server_settings/coop_options/coop_options_labels" string_index="5" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
+	</widget>
+	<widget name="main_menu/multiplayer_type_select/server_settings/coop_options/coop_enemies_per_player_spinner" type="spinner" top="2" width="206" height="20" flags="pass_unhandled_to_focused_child left_right_tabs_items" string_list="main_menu/multiplayer_type_select/server_settings/coop_options/var_coop_enemies_per_player" font="ui\large_ui" color="#FF2896FF" align="center" text_y="4" list_flags="items_from_strings" header_bitmap="bitmaps/arrow_sm_left" footer_bitmap="bitmaps/arrow_sm_right" header_bounds="7 -13 19 -7" footer_bounds="7 208 19 214">
+		<on event="left_mouse" run="mouse spinner 1wide click"/>
+	</widget>
+	<strings name="main_menu/multiplayer_type_select/server_settings/coop_options/var_coop_enemies_per_player">
+		<string text="25%"/>
+		<string text="50%"/>
+		<string text="100%"/>
+		<string text="150%"/>
+		<string text="200%"/>
+	</strings>
 	<widget name="main_menu/multiplayer_type_select/server_settings/coop_options/op_coop_player_collisions" width="512" height="28" flags="pass_unhandled_to_focused_child" bitmap="bitmaps/option_bkds" color="#FF2896FF">
 		<child widget="main_menu/multiplayer_type_select/server_settings/coop_options/coop_player_collisions_label"/>
 		<child widget="main_menu/multiplayer_type_select/server_settings/coop_options/coop_player_collisions_spinner" x="286" y="1"/>
 	</widget>
-	<widget name="main_menu/multiplayer_type_select/server_settings/coop_options/coop_player_collisions_label" type="text" controller="1" width="300" height="22" string_list="main_menu/multiplayer_type_select/server_settings/coop_options/coop_options_labels" string_index="4" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
+	<widget name="main_menu/multiplayer_type_select/server_settings/coop_options/coop_player_collisions_label" type="text" controller="1" width="300" height="22" string_list="main_menu/multiplayer_type_select/server_settings/coop_options/coop_options_labels" string_index="6" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
 	</widget>
 	<widget name="main_menu/multiplayer_type_select/server_settings/coop_options/coop_player_collisions_spinner" type="spinner" top="2" width="206" height="20" flags="pass_unhandled_to_focused_child left_right_tabs_items" string_list="main_menu/multiplayer_type_select/server_settings/coop_options/var_coop_player_collisions" font="ui\large_ui" color="#FF2896FF" align="center" text_y="4" list_flags="items_from_strings" header_bitmap="bitmaps/arrow_sm_left" footer_bitmap="bitmaps/arrow_sm_right" header_bounds="7 -13 19 -7" footer_bounds="7 208 19 214">
 		<on event="left_mouse" run="mouse spinner 1wide click"/>
@@ -328,8 +358,10 @@
 	<strings name="main_menu/multiplayer_type_select/server_settings/coop_options/coop_options_labels">
 		<string text="FRIENDLY FIRE:"/>
 		<string text="EXTRA ENEMIES:"/>
-		<string text="PER PLAYER:"/>
+		<string text="EXTRA PICKUPS:"/>
+		<string text="EXTRA VEHICLES:"/>
 		<string text="MULTIPLIER:"/>
+		<string text="PER PLAYER:"/>
 		<string text="PLAYER COLLISIONS:"/>
 	</strings>
 	<strings name="main_menu/multiplayer_type_select/server_settings/coop_options/cap_coop_options">
@@ -337,19 +369,25 @@
 		<string text="Players can be hurt by weapons or explosives\nfired by the other players."/>
 		<string text="Damage from the other players will only reduce\nshields. Health will be unaffected."/>
 		<string text="Players can be hurt by damage from explosives\nfired by the other players."/>
+		<string text="Enemy squads grow with the players: by the value of\n'Per Player' for each player past the first."/>
+		<string text="Enemy squads use 'Multiplier', however many players\nthere are."/>
 		<string text="Enemy squads are as the campaign has them."/>
-		<string text="Enemy squads grow with the players: by the amount\nbelow for each player past the first."/>
-		<string text="Enemy squads are the amount below times as large,\nhowever many players there are."/>
-		<string text="For each player past the first, enemy squads get\nthis much more of themselves (100%: as many again)."/>
-		<string text="For each player past the first, enemy squads get\nthis much more of themselves (100%: as many again)."/>
-		<string text="For each player past the first, enemy squads get\nthis much more of themselves (100%: as many again)."/>
-		<string text="For each player past the first, enemy squads get\nthis much more of themselves (100%: as many again)."/>
-		<string text="For each player past the first, enemy squads get\nthis much more of themselves (100%: as many again)."/>
-		<string text="Each enemy squad is this many times as large."/>
-		<string text="Each enemy squad is this many times as large."/>
-		<string text="Each enemy squad is this many times as large."/>
-		<string text="Each enemy squad is this many times as large."/>
-		<string text="Each enemy squad is this many times as large."/>
+		<string text="Pickups grow with the players: by the value of\n'Per Player' for each player past the first."/>
+		<string text="Pickups use 'Multiplier', up to eight times as many,\nhowever many players there are."/>
+		<string text="Pickups are as the campaign has them."/>
+		<string text="Vehicles respawn after being driven a short distance\nbased on the number of players: by two thirds the value of\n'Per Player' for each player past the first."/>
+		<string text="Vehicles respawn after being driven a short distance,\nwith extra copies equal to ('Multiplier' - 1) * 2/3,\nrounded down, however many players there are."/>
+		<string text="Vehicles are as the campaign has them."/>
+		<string text="Static amounts for the options set to this mode.\nPickups are capped at eight times as many."/>
+		<string text="Static amounts for the options set to this mode.\nPickups are capped at eight times as many."/>
+		<string text="Static amounts for the options set to this mode.\nPickups are capped at eight times as many."/>
+		<string text="Static amounts for the options set to this mode.\nPickups are capped at eight times as many."/>
+		<string text="Static amounts for the options set to this mode.\nPickups are capped at eight times as many."/>
+		<string text="For each player past the first, options set to Per\nPlayer get this much more (100%: as many again)."/>
+		<string text="For each player past the first, options set to Per\nPlayer get this much more (100%: as many again)."/>
+		<string text="For each player past the first, options set to Per\nPlayer get this much more (100%: as many again)."/>
+		<string text="For each player past the first, options set to Per\nPlayer get this much more (100%: as many again)."/>
+		<string text="For each player past the first, options set to Per\nPlayer get this much more (100%: as many again)."/>
 		<string text="Players bump into each other, as in the campaign."/>
 		<string text="Players walk through each other, so that no one\nblocks a doorway. The AI's characters still block."/>
 	</strings>

port/assets/menus/ce/main_menu.settings_select.multiplayer_setup.player_options_edit.port.xml

@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- The port's multiplayer screens, in the PC version's style (tools/port_settings.py) -->
+<menus>
+	<widget name="main_menu/settings_select/multiplayer_setup/player_options_edit/op_aim_assist" width="512" height="28" flags="pass_unhandled_to_focused_child" bitmap="bitmaps/option_bkds" color="#FF2896FF">
+		<child widget="main_menu/settings_select/multiplayer_setup/player_options_edit/aim_assist_label"/>
+		<child widget="main_menu/settings_select/multiplayer_setup/player_options_edit/aim_assist_spinner" x="286" y="1"/>
+	</widget>
+	<widget name="main_menu/settings_select/multiplayer_setup/player_options_edit/aim_assist_label" type="text" controller="1" width="280" height="22" string_list="main_menu/settings_select/multiplayer_setup/player_options_edit/player_options_labels" string_index="8" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
+	</widget>
+	<widget name="main_menu/settings_select/multiplayer_setup/player_options_edit/aim_assist_spinner" type="spinner" top="2" width="206" height="20" flags="pass_unhandled_to_focused_child left_right_tabs_items" string_list="main_menu/settings_select/multiplayer_setup/player_options_edit/var_aim_assist" font="ui\large_ui" color="#FF2896FF" align="center" text_y="4" list_flags="items_from_strings" header_bitmap="bitmaps/arrow_sm_left" footer_bitmap="bitmaps/arrow_sm_right" header_bounds="7 -13 19 -7" footer_bounds="7 208 19 214">
+		<on event="left_mouse" run="mouse spinner 1wide click"/>
+	</widget>
+	<strings name="main_menu/settings_select/multiplayer_setup/player_options_edit/var_aim_assist">
+		<string text="ALLOWED"/>
+		<string text="BLOCK M+KB"/>
+	</strings>
+</menus>

port/assets/menus/ce/main_menu.settings_select.multiplayer_setup.player_options_edit.xml

@@ -65,7 +65,7 @@
 		<on event="start" run="mp profile set player options" back="true"/>
 		<on event="left_mouse" run="mouse emit accept event"/>
 	</widget>
-	<widget name="main_menu/settings_select/multiplayer_setup/player_options_edit/player_options_help" type="text" controller="1" left="68" top="321" width="482" height="79" string_list="main_menu/settings_select/multiplayer_setup/player_options_edit/cap_player_options" font="ui\large_ui" color="#FFFFFFFF">
+	<widget name="main_menu/settings_select/multiplayer_setup/player_options_edit/player_options_help" type="text" controller="1" left="68" top="345" width="482" height="60" string_list="main_menu/settings_select/multiplayer_setup/player_options_edit/cap_player_options" font="ui\large_ui" color="#FFFFFFFF">
 	</widget>
 	<widget name="main_menu/settings_select/multiplayer_setup/player_options_edit/player_options_menu" type="column_list" width="640" height="480" flags="pass_unhandled_to_focused_child up_down_tabs_children" description="main_menu/settings_select/multiplayer_setup/player_options_edit/player_options_help">
 		<data input="game settings lists text update"/>
@@ -78,6 +78,7 @@
 		<child widget="main_menu/settings_select/multiplayer_setup/player_options_edit/op_odd_man_out" x="54" y="223"/>
 		<child widget="main_menu/settings_select/multiplayer_setup/player_options_edit/op_invisible_players" x="54" y="253"/>
 		<child widget="main_menu/settings_select/multiplayer_setup/player_options_edit/op_suicide_penalty" x="54" y="283"/>
+		<child widget="main_menu/settings_select/multiplayer_setup/player_options_edit/op_aim_assist" x="54" y="313"/>
 		<child widget="main_menu/settings_select/multiplayer_setup/player_options_edit/player_button_bar" y="414"/>
 	</widget>
 	<widget name="main_menu/settings_select/multiplayer_setup/player_options_edit/player_options_screen" width="640" height="480" flags="pass_unhandled_to_focused_child" bitmap="bitmaps/gradient">

port/assets/menus/ce/main_menu.settings_select.player_setup.player_profile_edit.gamepad_setup.xml

@@ -70,7 +70,7 @@
 	</widget>
 	<widget name="main_menu/settings_select/player_setup/player_profile_edit/gamepad_setup/button_preset_label" type="text" controller="1" width="300" height="22" string_list="main_menu/settings_select/player_setup/player_profile_edit/gamepad_setup/labels" string_index="4" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
 	</widget>
-	<widget name="main_menu/settings_select/player_setup/player_profile_edit/gamepad_setup/button_preset_spinner" type="spinner" left="3" top="2" width="147" height="20" flags="pass_unhandled_to_focused_child left_right_tabs_items" strings="DEFAULT|SWAP TRIGGERS|SWAP A, L TRIGGER|SWAP B, L TRIGGER|SWAP B, R STICK" setting="profile.button_preset" values="0|1|2|3|4" font="ui\large_ui" color="#FF2896FF" align="center" text_y="1" header_bitmap="bitmaps/arrow_sm_left" footer_bitmap="bitmaps/arrow_sm_right" header_bounds="7 -6 19 0" footer_bounds="7 150 19 156">
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/gamepad_setup/button_preset_spinner" type="spinner" left="3" top="2" width="147" height="20" flags="pass_unhandled_to_focused_child left_right_tabs_items" strings="DEFAULT|SWAP TRIGGERS|SWAP A, L TRIGGER|SWAP B, L TRIGGER|SWAP B, R STICK|BUMPER JUMPER" setting="profile.button_preset" values="0|1|2|3|4|5" font="ui\large_ui" color="#FF2896FF" align="center" text_y="1" header_bitmap="bitmaps/arrow_sm_left" footer_bitmap="bitmaps/arrow_sm_right" header_bounds="7 -6 19 0" footer_bounds="7 150 19 156">
 		<on event="created" run="port setting load"/>
 	</widget>
 	<widget name="main_menu/settings_select/player_setup/player_profile_edit/gamepad_setup/op_joystick_preset" width="512" height="28" flags="pass_unhandled_to_focused_child" bitmap="bitmaps/option_bkds" color="#FF2896FF">

port/assets/menus/ce/main_menu.settings_select.player_setup.player_profile_edit.video_settings.extra_effects.xml

@@ -0,0 +1,98 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- The port's settings screen, in the PC version's style (tools/port_settings.py) -->
+<menus>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/extra_effects_settings_screen" width="640" height="480" flags="pass_unhandled_to_focused_child pause_game" bitmap="bitmaps/gradient">
+		<on event="b" back="true"/>
+		<on event="back" back="true"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/header_profile_video_settings"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/options_menu"/>
+	</widget>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/header_profile_video_settings" controller="1" left="35" top="11" width="605" height="59" bitmap="main_menu/settings_select/player_setup/player_profile_edit/video_settings/header_profile_video_settings">
+	</widget>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/help" type="text" controller="1" left="68" top="350" width="482" height="60" string_list="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/help_strings" font="ui\large_ui" color="#FFFFFFFF">
+	</widget>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/options_menu" type="column_list" width="640" height="480" flags="pass_unhandled_to_focused_child up_down_tabs_children" description="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/help">
+		<data input="port settings help"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/op_overshield_effect" x="54" y="73"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/op_shield_glow" x="54" y="103"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/op_shield_glow_intensity" x="54" y="133"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/op_hdr" x="54" y="163"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/op_hdr_output" x="54" y="193" platform="desktop"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/button_bar" y="414"/>
+	</widget>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/button_bar" type="column_list" width="640" height="28" flags="pass_unhandled_to_focused_child left_right_tabs_items">
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/button_defaults" y="1"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/button_ok" x="380" y="1"/>
+		<child widget="common_button_cancel" x="510" y="1"/>
+	</widget>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/op_overshield_effect" width="512" height="28" flags="pass_unhandled_to_focused_child" bitmap="bitmaps/option_bkds" color="#FF2896FF">
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/overshield_effect_label"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/overshield_effect_spinner" x="320" y="1"/>
+	</widget>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/overshield_effect_label" type="text" controller="1" width="300" height="22" string_list="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/labels" string_index="0" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
+	</widget>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/overshield_effect_spinner" type="spinner" left="3" top="2" width="147" height="20" flags="pass_unhandled_to_focused_child left_right_tabs_items" strings="ON|OFF" setting="display.overshield_effect" values="true|false" font="ui\large_ui" color="#FF2896FF" align="center" text_y="1" header_bitmap="bitmaps/arrow_sm_left" footer_bitmap="bitmaps/arrow_sm_right" header_bounds="7 -6 19 0" footer_bounds="7 150 19 156">
+		<on event="created" run="port setting load"/>
+	</widget>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/op_shield_glow" width="512" height="28" flags="pass_unhandled_to_focused_child" bitmap="bitmaps/option_bkds" color="#FF2896FF">
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/shield_glow_label"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/shield_glow_spinner" x="320" y="1"/>
+	</widget>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/shield_glow_label" type="text" controller="1" width="300" height="22" string_list="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/labels" string_index="1" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
+	</widget>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/shield_glow_spinner" type="spinner" left="3" top="2" width="147" height="20" flags="pass_unhandled_to_focused_child left_right_tabs_items" strings="ON|OFF" setting="display.shield_glow" values="true|false" font="ui\large_ui" color="#FF2896FF" align="center" text_y="1" header_bitmap="bitmaps/arrow_sm_left" footer_bitmap="bitmaps/arrow_sm_right" header_bounds="7 -6 19 0" footer_bounds="7 150 19 156">
+		<on event="created" run="port setting load"/>
+	</widget>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/op_shield_glow_intensity" width="512" height="28" flags="pass_unhandled_to_focused_child" bitmap="bitmaps/option_bkds" color="#FF2896FF">
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/shield_glow_intensity_label"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/shield_glow_intensity_spinner" x="320" y="1"/>
+	</widget>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/shield_glow_intensity_label" type="text" controller="1" width="300" height="22" string_list="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/labels" string_index="2" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
+	</widget>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/shield_glow_intensity_spinner" type="spinner" left="3" top="2" width="147" height="20" flags="pass_unhandled_to_focused_child left_right_tabs_items" strings="DEFAULT|LIGHT SHOW" setting="display.shield_glow_intensity" values="default|light_show" font="ui\large_ui" color="#FF2896FF" align="center" text_y="1" header_bitmap="bitmaps/arrow_sm_left" footer_bitmap="bitmaps/arrow_sm_right" header_bounds="7 -6 19 0" footer_bounds="7 150 19 156">
+		<on event="created" run="port setting load"/>
+	</widget>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/op_hdr" width="512" height="28" flags="pass_unhandled_to_focused_child" bitmap="bitmaps/option_bkds" color="#FF2896FF">
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/hdr_label"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/hdr_spinner" x="320" y="1"/>
+	</widget>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/hdr_label" type="text" controller="1" width="300" height="22" string_list="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/labels" string_index="3" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
+	</widget>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/hdr_spinner" type="spinner" left="3" top="2" width="147" height="20" flags="pass_unhandled_to_focused_child left_right_tabs_items" strings="ON|OFF" setting="display.hdr" values="true|false" font="ui\large_ui" color="#FF2896FF" align="center" text_y="1" header_bitmap="bitmaps/arrow_sm_left" footer_bitmap="bitmaps/arrow_sm_right" header_bounds="7 -6 19 0" footer_bounds="7 150 19 156">
+		<on event="created" run="port setting load"/>
+	</widget>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/op_hdr_output" width="512" height="28" flags="pass_unhandled_to_focused_child" bitmap="bitmaps/option_bkds" color="#FF2896FF" platform="desktop">
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/hdr_output_label"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/hdr_output_spinner" x="320" y="1"/>
+	</widget>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/hdr_output_label" type="text" controller="1" width="300" height="22" string_list="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/labels" string_index="4" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
+	</widget>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/hdr_output_spinner" type="spinner" left="3" top="2" width="147" height="20" flags="pass_unhandled_to_focused_child left_right_tabs_items" strings="ON|OFF" setting="display.hdr_output" values="true|false" font="ui\large_ui" color="#FF2896FF" align="center" text_y="1" header_bitmap="bitmaps/arrow_sm_left" footer_bitmap="bitmaps/arrow_sm_right" header_bounds="7 -6 19 0" footer_bounds="7 150 19 156">
+		<on event="created" run="port setting load"/>
+	</widget>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/button_defaults" type="text" width="128" height="24" bitmap="bitmaps/text_button_background" string_list="strings/common_button_captions" string_index="3" font="ui\small_ui" color="#FFFFFFFF" align="center" text_y="2">
+		<on event="a" run="port settings defaults"/>
+		<on event="start" run="port settings defaults"/>
+		<on event="left_mouse" run="mouse emit accept event"/>
+	</widget>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/button_ok" type="text" width="128" height="24" bitmap="bitmaps/text_button_background" string_list="strings/common_button_captions" string_index="1" font="ui\small_ui" color="#FFFFFFFF" align="center" text_y="2">
+		<on event="a" run="port settings save" back="true"/>
+		<on event="start" run="port settings save" back="true"/>
+		<on event="left_mouse" run="mouse emit accept event"/>
+	</widget>
+	<strings name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/labels">
+		<string text="OVERSHIELD:"/>
+		<string text="SHIELD GLOW:"/>
+		<string text="GLOW INTENSITY:"/>
+		<string text="HDR:"/>
+		<string text="HDR DISPLAY:"/>
+	</strings>
+	<strings name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/help_strings">
+		<string text=""/>
+		<string text="The overshield rises up the body as it charges\nand stays lit, in its own color. Off: stock."/>
+		<string text="Shields light their surroundings as they flare,\nin the shield's own color."/>
+		<string text="Light Show: the shield glow three times as far,\nat full from a third of the flare."/>
+		<string text="Keep the light of explosions, plasma and the sun\npast white, and roll it off instead of clipping."/>
+		<string text="With HDR, on an HDR display, show that light\nbrighter than white. From the next start."/>
+	</strings>
+</menus>

port/assets/menus/ce/main_menu.settings_select.player_setup.player_profile_edit.video_settings.fov_viewmodels.xml

@@ -16,9 +16,10 @@
 		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/op_fov" x="54" y="73"/>
 		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/op_viewmodel_fov" x="54" y="103"/>
 		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/op_viewmodel_visible" x="54" y="133"/>
-		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/op_viewmodel_shield" x="54" y="163"/>
-		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/op_first_person_legs" x="54" y="193"/>
-		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/op_shield_color" x="54" y="223"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/op_passenger_third_person" x="54" y="163"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/op_viewmodel_shield" x="54" y="193"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/op_first_person_legs" x="54" y="223"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/op_shield_color" x="54" y="253"/>
 		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/button_bar" y="414"/>
 	</widget>
 	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/button_bar" type="column_list" width="640" height="28" flags="pass_unhandled_to_focused_child left_right_tabs_items">
@@ -53,11 +54,20 @@
 	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/viewmodel_visible_spinner" type="spinner" left="3" top="2" width="147" height="20" flags="pass_unhandled_to_focused_child left_right_tabs_items" strings="ON|OFF" setting="display.viewmodel_visible" values="true|false" font="ui\large_ui" color="#FF2896FF" align="center" text_y="1" header_bitmap="bitmaps/arrow_sm_left" footer_bitmap="bitmaps/arrow_sm_right" header_bounds="7 -6 19 0" footer_bounds="7 150 19 156">
 		<on event="created" run="port setting load"/>
 	</widget>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/op_passenger_third_person" width="512" height="28" flags="pass_unhandled_to_focused_child" bitmap="bitmaps/option_bkds" color="#FF2896FF">
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/passenger_third_person_label"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/passenger_third_person_spinner" x="320" y="1"/>
+	</widget>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/passenger_third_person_label" type="text" controller="1" width="300" height="22" string_list="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/labels" string_index="3" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
+	</widget>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/passenger_third_person_spinner" type="spinner" left="3" top="2" width="147" height="20" flags="pass_unhandled_to_focused_child left_right_tabs_items" strings="ON|OFF" setting="display.passenger_third_person" values="true|false" font="ui\large_ui" color="#FF2896FF" align="center" text_y="1" header_bitmap="bitmaps/arrow_sm_left" footer_bitmap="bitmaps/arrow_sm_right" header_bounds="7 -6 19 0" footer_bounds="7 150 19 156">
+		<on event="created" run="port setting load"/>
+	</widget>
 	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/op_viewmodel_shield" width="512" height="28" flags="pass_unhandled_to_focused_child" bitmap="bitmaps/option_bkds" color="#FF2896FF">
 		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/viewmodel_shield_label"/>
 		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/viewmodel_shield_spinner" x="320" y="1"/>
 	</widget>
-	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/viewmodel_shield_label" type="text" controller="1" width="300" height="22" string_list="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/labels" string_index="3" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/viewmodel_shield_label" type="text" controller="1" width="300" height="22" string_list="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/labels" string_index="4" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
 	</widget>
 	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/viewmodel_shield_spinner" type="spinner" left="3" top="2" width="147" height="20" flags="pass_unhandled_to_focused_child left_right_tabs_items" strings="ON|OFF" setting="display.viewmodel_shield" values="true|false" font="ui\large_ui" color="#FF2896FF" align="center" text_y="1" header_bitmap="bitmaps/arrow_sm_left" footer_bitmap="bitmaps/arrow_sm_right" header_bounds="7 -6 19 0" footer_bounds="7 150 19 156">
 		<on event="created" run="port setting load"/>
@@ -66,7 +76,7 @@
 		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/first_person_legs_label"/>
 		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/first_person_legs_spinner" x="320" y="1"/>
 	</widget>
-	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/first_person_legs_label" type="text" controller="1" width="300" height="22" string_list="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/labels" string_index="4" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/first_person_legs_label" type="text" controller="1" width="300" height="22" string_list="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/labels" string_index="5" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
 	</widget>
 	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/first_person_legs_spinner" type="spinner" left="3" top="2" width="147" height="20" flags="pass_unhandled_to_focused_child left_right_tabs_items" strings="ON|OFF" setting="display.first_person_legs" values="true|false" font="ui\large_ui" color="#FF2896FF" align="center" text_y="1" header_bitmap="bitmaps/arrow_sm_left" footer_bitmap="bitmaps/arrow_sm_right" header_bounds="7 -6 19 0" footer_bounds="7 150 19 156">
 		<on event="created" run="port setting load"/>
@@ -75,7 +85,7 @@
 		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/shield_color_label"/>
 		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/shield_color_spinner" x="320" y="1"/>
 	</widget>
-	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/shield_color_label" type="text" controller="1" width="300" height="22" string_list="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/labels" string_index="5" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/shield_color_label" type="text" controller="1" width="300" height="22" string_list="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/labels" string_index="6" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
 	</widget>
 	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels/shield_color_spinner" type="spinner" left="3" top="2" width="147" height="20" flags="pass_unhandled_to_focused_child left_right_tabs_items" strings="DEFAULT|WHITE|BLACK|RED|BLUE|GRAY|YELLOW|GREEN|PINK|PURPLE|CYAN|COBALT|ORANGE|TEAL|SAGE|BROWN|TAN|MAROON|SALMON" setting="display.shield_color" values="default|white|black|red|blue|gray|yellow|green|pink|purple|cyan|cobalt|orange|teal|sage|brown|tan|maroon|salmon" font="ui\large_ui" color="#FF2896FF" align="center" text_y="1" header_bitmap="bitmaps/arrow_sm_left" footer_bitmap="bitmaps/arrow_sm_right" header_bounds="7 -6 19 0" footer_bounds="7 150 19 156">
 		<on event="created" run="port setting load"/>
@@ -94,6 +104,7 @@
 		<string text="FOV:"/>
 		<string text="VIEWMODEL FOV:"/>
 		<string text="VIEWMODELS:"/>
+		<string text="PASSENGER THIRD PERSON:"/>
 		<string text="ARM SHIELDS:"/>
 		<string text="LEGS:"/>
 		<string text="SHIELD COLOR:"/>
@@ -103,6 +114,7 @@
 		<string text="On foot, horizontal at 16:9, in degrees.\nDefault keeps the stock view."/>
 		<string text="The weapon and hands, horizontal at 16:9.\nDefault keeps the weapon's stock view."/>
 		<string text="Draw first-person weapons, hands and attached\nvisuals. Gameplay and sound continue when off."/>
+		<string text="Third-person Warthog and Scorpion passengers in\nthe campaign and co-op. Weapon zoom is disabled."/>
 		<string text="The energy shield's flare on your first-person\narms too, as on your body."/>
 		<string text="Your legs in first person, seen looking down,\nmoving as you run. Your body as others see it."/>
 		<string text="Your shield's flare in an armor color, whatever\nyour armor. Only you see it. Default: its own."/>

port/assets/menus/ce/main_menu.settings_select.player_setup.player_profile_edit.video_settings.graphics.xml

@@ -18,10 +18,11 @@
 		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/op_high_res_text" x="54" y="133"/>
 		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/op_anti_aliasing" x="54" y="163" platform="desktop"/>
 		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/op_anti_aliasing_android" x="54" y="163" platform="android web"/>
-		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/op_shadow_resolution" x="54" y="193"/>
-		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/op_per_pixel_lighting" x="54" y="223"/>
-		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/op_shield_glow" x="54" y="253"/>
-		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/op_shield_glow_intensity" x="54" y="283"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/op_anisotropic_filtering" x="54" y="193"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/op_shadow_resolution" x="54" y="223"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/op_per_pixel_lighting" x="54" y="253"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/op_model_detail" x="54" y="283"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/op_match_timer" x="54" y="313"/>
 		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/button_bar" y="414"/>
 	</widget>
 	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/button_bar" type="column_list" width="640" height="28" flags="pass_unhandled_to_focused_child left_right_tabs_items">
@@ -74,11 +75,20 @@
 	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/anti_aliasing_android_spinner" type="spinner" left="3" top="2" width="147" height="20" flags="pass_unhandled_to_focused_child left_right_tabs_items" strings="OFF|FXAA|MSAA 2X|MSAA 4X" setting="display.anti_aliasing" values="off|fxaa|msaa2x|msaa4x" font="ui\large_ui" color="#FF2896FF" align="center" text_y="1" header_bitmap="bitmaps/arrow_sm_left" footer_bitmap="bitmaps/arrow_sm_right" header_bounds="7 -6 19 0" footer_bounds="7 150 19 156">
 		<on event="created" run="port setting load"/>
 	</widget>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/op_anisotropic_filtering" width="512" height="28" flags="pass_unhandled_to_focused_child" bitmap="bitmaps/option_bkds" color="#FF2896FF">
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/anisotropic_filtering_label"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/anisotropic_filtering_spinner" x="320" y="1"/>
+	</widget>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/anisotropic_filtering_label" type="text" controller="1" width="300" height="22" string_list="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/labels" string_index="5" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
+	</widget>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/anisotropic_filtering_spinner" type="spinner" left="3" top="2" width="147" height="20" flags="pass_unhandled_to_focused_child left_right_tabs_items" strings="OFF|2X|4X|8X|16X" setting="display.anisotropic_filtering" values="0|2|4|8|16" font="ui\large_ui" color="#FF2896FF" align="center" text_y="1" header_bitmap="bitmaps/arrow_sm_left" footer_bitmap="bitmaps/arrow_sm_right" header_bounds="7 -6 19 0" footer_bounds="7 150 19 156">
+		<on event="created" run="port setting load"/>
+	</widget>
 	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/op_shadow_resolution" width="512" height="28" flags="pass_unhandled_to_focused_child" bitmap="bitmaps/option_bkds" color="#FF2896FF">
 		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/shadow_resolution_label"/>
 		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/shadow_resolution_spinner" x="320" y="1"/>
 	</widget>
-	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/shadow_resolution_label" type="text" controller="1" width="300" height="22" string_list="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/labels" string_index="5" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/shadow_resolution_label" type="text" controller="1" width="300" height="22" string_list="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/labels" string_index="6" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
 	</widget>
 	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/shadow_resolution_spinner" type="spinner" left="3" top="2" width="147" height="20" flags="pass_unhandled_to_focused_child left_right_tabs_items" strings="128|256|512|1024" setting="display.shadow_resolution" values="128|256|512|1024" font="ui\large_ui" color="#FF2896FF" align="center" text_y="1" header_bitmap="bitmaps/arrow_sm_left" footer_bitmap="bitmaps/arrow_sm_right" header_bounds="7 -6 19 0" footer_bounds="7 150 19 156">
 		<on event="created" run="port setting load"/>
@@ -87,27 +97,27 @@
 		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/per_pixel_lighting_label"/>
 		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/per_pixel_lighting_spinner" x="320" y="1"/>
 	</widget>
-	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/per_pixel_lighting_label" type="text" controller="1" width="300" height="22" string_list="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/labels" string_index="6" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/per_pixel_lighting_label" type="text" controller="1" width="300" height="22" string_list="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/labels" string_index="7" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
 	</widget>
 	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/per_pixel_lighting_spinner" type="spinner" left="3" top="2" width="147" height="20" flags="pass_unhandled_to_focused_child left_right_tabs_items" strings="ON|OFF" setting="display.per_pixel_lighting" values="true|false" font="ui\large_ui" color="#FF2896FF" align="center" text_y="1" header_bitmap="bitmaps/arrow_sm_left" footer_bitmap="bitmaps/arrow_sm_right" header_bounds="7 -6 19 0" footer_bounds="7 150 19 156">
 		<on event="created" run="port setting load"/>
 	</widget>
-	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/op_shield_glow" width="512" height="28" flags="pass_unhandled_to_focused_child" bitmap="bitmaps/option_bkds" color="#FF2896FF">
-		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/shield_glow_label"/>
-		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/shield_glow_spinner" x="320" y="1"/>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/op_model_detail" width="512" height="28" flags="pass_unhandled_to_focused_child" bitmap="bitmaps/option_bkds" color="#FF2896FF">
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/model_detail_label"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/model_detail_spinner" x="320" y="1"/>
 	</widget>
-	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/shield_glow_label" type="text" controller="1" width="300" height="22" string_list="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/labels" string_index="7" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/model_detail_label" type="text" controller="1" width="300" height="22" string_list="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/labels" string_index="8" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
 	</widget>
-	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/shield_glow_spinner" type="spinner" left="3" top="2" width="147" height="20" flags="pass_unhandled_to_focused_child left_right_tabs_items" strings="ON|OFF" setting="display.shield_glow" values="true|false" font="ui\large_ui" color="#FF2896FF" align="center" text_y="1" header_bitmap="bitmaps/arrow_sm_left" footer_bitmap="bitmaps/arrow_sm_right" header_bounds="7 -6 19 0" footer_bounds="7 150 19 156">
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/model_detail_spinner" type="spinner" left="3" top="2" width="147" height="20" flags="pass_unhandled_to_focused_child left_right_tabs_items" strings="STOCK|NATIVE|HIGHEST" setting="display.model_detail" values="stock|native|highest" font="ui\large_ui" color="#FF2896FF" align="center" text_y="1" header_bitmap="bitmaps/arrow_sm_left" footer_bitmap="bitmaps/arrow_sm_right" header_bounds="7 -6 19 0" footer_bounds="7 150 19 156">
 		<on event="created" run="port setting load"/>
 	</widget>
-	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/op_shield_glow_intensity" width="512" height="28" flags="pass_unhandled_to_focused_child" bitmap="bitmaps/option_bkds" color="#FF2896FF">
-		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/shield_glow_intensity_label"/>
-		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/shield_glow_intensity_spinner" x="320" y="1"/>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/op_match_timer" width="512" height="28" flags="pass_unhandled_to_focused_child" bitmap="bitmaps/option_bkds" color="#FF2896FF">
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/match_timer_label"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/match_timer_spinner" x="320" y="1"/>
 	</widget>
-	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/shield_glow_intensity_label" type="text" controller="1" width="300" height="22" string_list="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/labels" string_index="8" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/match_timer_label" type="text" controller="1" width="300" height="22" string_list="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/labels" string_index="9" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
 	</widget>
-	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/shield_glow_intensity_spinner" type="spinner" left="3" top="2" width="147" height="20" flags="pass_unhandled_to_focused_child left_right_tabs_items" strings="DEFAULT|LIGHT SHOW" setting="display.shield_glow_intensity" values="default|light_show" font="ui\large_ui" color="#FF2896FF" align="center" text_y="1" header_bitmap="bitmaps/arrow_sm_left" footer_bitmap="bitmaps/arrow_sm_right" header_bounds="7 -6 19 0" footer_bounds="7 150 19 156">
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/match_timer_spinner" type="spinner" left="3" top="2" width="147" height="20" flags="pass_unhandled_to_focused_child left_right_tabs_items" strings="ON|OFF" setting="display.match_timer" values="true|false" font="ui\large_ui" color="#FF2896FF" align="center" text_y="1" header_bitmap="bitmaps/arrow_sm_left" footer_bitmap="bitmaps/arrow_sm_right" header_bounds="7 -6 19 0" footer_bounds="7 150 19 156">
 		<on event="created" run="port setting load"/>
 	</widget>
 	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/button_defaults" type="text" width="128" height="24" bitmap="bitmaps/text_button_background" string_list="strings/common_button_captions" string_index="3" font="ui\small_ui" color="#FFFFFFFF" align="center" text_y="2">
@@ -126,10 +136,11 @@
 		<string text="HIGH-RES TEXT:"/>
 		<string text="ANTI-ALIASING:"/>
 		<string text="ANTI-ALIASING:"/>
+		<string text="TEXTURE FILTERING:"/>
 		<string text="SHADOW RESOLUTION:"/>
 		<string text="PER-PIXEL LIGHTING:"/>
-		<string text="SHIELD GLOW:"/>
-		<string text="GLOW INTENSITY:"/>
+		<string text="MODEL DETAIL:"/>
+		<string text="MATCH TIMER:"/>
 	</strings>
 	<strings name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/graphics/help_strings">
 		<string text=""/>
@@ -138,9 +149,10 @@
 		<string text="Draw text and titles with high-res fonts; off\ndraws the game's own."/>
 		<string text="Smooth jagged edges, which the Xbox did not. FXAA\nand SMAA are cheap; SSAA and MSAA are sharper."/>
 		<string text="Smooth jagged edges, which the Xbox did not. FXAA\nis cheap; MSAA is sharper."/>
+		<string text="Keep floors and walls sharp at a grazing angle,\nwhich the Xbox did not. Off: as the Xbox."/>
 		<string text="The size objects' shadows are drawn at: 128 as on\nthe Xbox; larger for smoother, as soft, edges."/>
 		<string text="Light models for each pixel, without the facets\nof the Xbox's lighting for each vertex."/>
-		<string text="Shields light their surroundings as they flare,\nin the shield's own color."/>
-		<string text="Light Show: the shield glow three times as far,\nat full from a third of the flare."/>
+		<string text="Stock picks models' detail by the Xbox's 480 lines;\nnative by this display's; highest, always the best."/>
+		<string text="Draw a clock at the bottom right in multiplayer,\ncounting up from the start of the game."/>
 	</strings>
 </menus>

port/assets/menus/ce/main_menu.settings_select.player_setup.player_profile_edit.video_settings.xml

@@ -34,6 +34,9 @@
 		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/op_fov_viewmodels" x="54" y="313" platform="desktop"/>
 		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/op_fov_viewmodels" x="54" y="163" platform="android"/>
 		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/op_fov_viewmodels" x="54" y="253" platform="web"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/op_extra_effects" x="54" y="343" platform="desktop"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/op_extra_effects" x="54" y="193" platform="android"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/op_extra_effects" x="54" y="283" platform="web"/>
 		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/button_bar" y="414"/>
 	</widget>
 	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/button_bar" type="column_list" width="640" height="28" flags="pass_unhandled_to_focused_child left_right_tabs_items">
@@ -129,6 +132,14 @@
 	</widget>
 	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/fov_viewmodels_label" type="text" controller="1" width="512" height="22" string_list="main_menu/settings_select/player_setup/player_profile_edit/video_settings/labels" string_index="9" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
 	</widget>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/op_extra_effects" width="512" height="28" flags="pass_unhandled_to_focused_child" bitmap="bitmaps/option_bkds" color="#FF2896FF">
+		<on event="a" open="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/extra_effects_settings_screen"/>
+		<on event="start" open="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects/extra_effects_settings_screen"/>
+		<on event="left_mouse" run="mouse emit accept event"/>
+		<child widget="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects_label"/>
+	</widget>
+	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/extra_effects_label" type="text" controller="1" width="512" height="22" string_list="main_menu/settings_select/player_setup/player_profile_edit/video_settings/labels" string_index="10" font="ui\large_ui" color="#FF2896FF" text_x="13" text_y="4">
+	</widget>
 	<widget name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/button_defaults" type="text" width="128" height="24" bitmap="bitmaps/text_button_background" string_list="strings/common_button_captions" string_index="3" font="ui\small_ui" color="#FFFFFFFF" align="center" text_y="2">
 		<on event="a" run="port settings defaults"/>
 		<on event="start" run="port settings defaults"/>
@@ -150,6 +161,7 @@
 		<string text="INSTANT AIM:"/>
 		<string text="GRAPHICS:"/>
 		<string text="FOV AND VIEWMODELS:"/>
+		<string text="EXTRA EFFECTS:"/>
 	</strings>
 	<strings name="main_menu/settings_select/player_setup/player_profile_edit/video_settings/help_strings">
 		<string text=""/>
@@ -161,7 +173,8 @@
 		<string text="With V-Sync off, the most frames a second. Auto:\ntwice the display's refresh rate."/>
 		<string text="Draw a frame for every display refresh, blending\nbetween the game's 30 ticks a second."/>
 		<string text="In first person, turn the view the moment the\nmouse moves, not up to two ticks later."/>
-		<string text="The HUD, text, anti-aliasing, shadows and\nlighting."/>
+		<string text="The HUD, text, anti-aliasing, shadows,\nlighting and HDR."/>
 		<string text="The field of view and the first-person\nweapon. Their defaults keep the stock view."/>
+		<string text="Visual modifiers the stock game does not\nhave, such as the shield glow."/>
 	</strings>
 </menus>

port/assets/menus/menus.json

@@ -27,6 +27,7 @@
   "ce/main_menu.settings_select.multiplayer_setup.item_options_edit.port.xml",
   "ce/main_menu.settings_select.multiplayer_setup.item_options_edit.xml",
   "ce/main_menu.settings_select.multiplayer_setup.name_edit.xml",
+  "ce/main_menu.settings_select.multiplayer_setup.player_options_edit.port.xml",
   "ce/main_menu.settings_select.multiplayer_setup.player_options_edit.xml",
   "ce/main_menu.settings_select.multiplayer_setup.playlist_edit.ctf_edit.xml",
   "ce/main_menu.settings_select.multiplayer_setup.playlist_edit.game_type_select.xml",
@@ -52,6 +53,7 @@
   "ce/main_menu.settings_select.player_setup.player_profile_edit.network_setup.multiplayer_hud.xml",
   "ce/main_menu.settings_select.player_setup.player_profile_edit.network_setup.streamer_mode.xml",
   "ce/main_menu.settings_select.player_setup.player_profile_edit.network_setup.xml",
+  "ce/main_menu.settings_select.player_setup.player_profile_edit.video_settings.extra_effects.xml",
   "ce/main_menu.settings_select.player_setup.player_profile_edit.video_settings.fov_viewmodels.xml",
   "ce/main_menu.settings_select.player_setup.player_profile_edit.video_settings.graphics.xml",
   "ce/main_menu.settings_select.player_setup.player_profile_edit.video_settings.xml",
@@ -80,17 +82,23 @@
   "ce/port/mods/status_small__1.png",
   "ce/port/mods/status_small__2.png",
   "ce/port/pause/objectives_center__0.png",
+  "ce/port/pause/objectives_center__1.png",
   "ce/port/pause/objectives_left__0.png",
+  "ce/port/pause/objectives_left__1.png",
   "ce/port/pause/objectives_right__0.png",
+  "ce/port/pause/objectives_right__1.png",
   "ce/port/pause/pausebox_center__0.png",
   "ce/port/pause/pausebox_center__1.png",
   "ce/port/pause/pausebox_center__2.png",
+  "ce/port/pause/pausebox_center__3.png",
   "ce/port/pause/pausebox_left__0.png",
   "ce/port/pause/pausebox_left__1.png",
   "ce/port/pause/pausebox_left__2.png",
+  "ce/port/pause/pausebox_left__3.png",
   "ce/port/pause/pausebox_right__0.png",
   "ce/port/pause/pausebox_right__1.png",
   "ce/port/pause/pausebox_right__2.png",
+  "ce/port/pause/pausebox_right__3.png",
   "ce/port/voice/speaker__0.png",
   "ce/port/voice/speaker__1.png",
   "ce/shell/bitmaps/alert_bkd__0.png",

port/assets/menus/port_svg/pause/objectives_center__1.svg

@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="4" height="256" viewBox="0 0 4 256">
+  <defs><linearGradient id="body" gradientUnits="userSpaceOnUse" x1="0" y1="29" x2="0" y2="223">
+    <stop offset="0" stop-color="#0a2649"/>
+    <stop offset="1" stop-color="#050d1c"/>
+  </linearGradient></defs>
+  <rect x="0" y="2" width="4" height="221" fill="url(#body)" fill-opacity="0.75"/>
+  <rect x="0" y="0" width="4" height="2" fill="#2896ff"/>
+  <rect x="0" y="223" width="4" height="2" fill="#2896ff"/>
+  <g>
+    <rect x="0" y="2" width="4" height="26" fill="black"/>
+    <rect x="0" y="28" width="4" height="0.75" fill="#2896ff"/>
+  </g>
+</svg>

port/assets/menus/port_svg/pause/objectives_left__1.svg

@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="16" height="256" viewBox="0 0 16 256">
+  <defs><linearGradient id="body" gradientUnits="userSpaceOnUse" x1="0" y1="29" x2="0" y2="223">
+    <stop offset="0" stop-color="#0a2649"/>
+    <stop offset="1" stop-color="#050d1c"/>
+  </linearGradient></defs>
+  <path d="M9.5,1 H17 V224 H9.5 A8.5,8.5 0 0 1 1,215.5 V9.5 A8.5,8.5 0 0 1 9.5,1 Z" fill="url(#body)" fill-opacity="0.75" fill-rule="evenodd"/>
+  <path d="M17,1 H9.5 A8.5,8.5 0 0 0 1,9.5 V215.5 A8.5,8.5 0 0 0 9.5,224 H17" fill="none" stroke="#2896ff" stroke-width="2"/>
+  <defs><clipPath id="strip"><rect x="2" y="2" width="32" height="221" rx="7.5"/></clipPath></defs>
+  <g clip-path="url(#strip)">
+    <rect x="0" y="2" width="16" height="26" fill="black"/>
+    <rect x="0" y="28" width="16" height="0.75" fill="#2896ff"/>
+  </g>
+</svg>

port/assets/menus/port_svg/pause/objectives_right__1.svg

@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="16" height="256" viewBox="0 0 16 256">
+  <defs><linearGradient id="body" gradientUnits="userSpaceOnUse" x1="0" y1="29" x2="0" y2="223">
+    <stop offset="0" stop-color="#0a2649"/>
+    <stop offset="1" stop-color="#050d1c"/>
+  </linearGradient></defs>
+  <g transform="matrix(-1 0 0 1 16 0)">
+    <path d="M9.5,1 H17 V224 H9.5 A8.5,8.5 0 0 1 1,215.5 V9.5 A8.5,8.5 0 0 1 9.5,1 Z" fill="url(#body)" fill-opacity="0.75" fill-rule="evenodd"/>
+    <path d="M17,1 H9.5 A8.5,8.5 0 0 0 1,9.5 V215.5 A8.5,8.5 0 0 0 9.5,224 H17" fill="none" stroke="#2896ff" stroke-width="2"/>
+  </g>
+  <defs><clipPath id="strip"><rect x="-16" y="2" width="30" height="221" rx="7.5"/></clipPath></defs>
+  <g clip-path="url(#strip)">
+    <rect x="0" y="2" width="16" height="26" fill="black"/>
+    <rect x="0" y="28" width="16" height="0.75" fill="#2896ff"/>
+  </g>
+</svg>

port/assets/menus/port_svg/pause/pausebox_center__3.svg

@@ -0,0 +1,14 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="4" height="256" viewBox="0 0 4 256">
+  <defs><clipPath id="body-area"><rect x="-16" y="0" width="48" height="197"/></clipPath></defs>
+  <defs><linearGradient id="body" gradientUnits="userSpaceOnUse" x1="0" y1="2" x2="0" y2="197">
+    <stop offset="0" stop-color="#0a2649"/>
+    <stop offset="1" stop-color="#050d1c"/>
+  </linearGradient></defs>
+  <rect x="0" y="2" width="4" height="221" fill="url(#body)" fill-opacity="0.75" clip-path="url(#body-area)"/>
+  <rect x="0" y="0" width="4" height="2" fill="#2896ff"/>
+  <rect x="0" y="223" width="4" height="2" fill="#2896ff"/>
+  <g>
+    <rect x="0" y="197" width="4" height="26" fill="black" fill-opacity="0.75"/>
+    <rect x="0" y="197" width="4" height="0.75" fill="#2896ff"/>
+  </g>
+</svg>

port/assets/menus/port_svg/pause/pausebox_left__3.svg

@@ -0,0 +1,14 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="16" height="256" viewBox="0 0 16 256">
+  <defs><clipPath id="body-area"><rect x="-16" y="0" width="48" height="197"/></clipPath></defs>
+  <defs><linearGradient id="body" gradientUnits="userSpaceOnUse" x1="0" y1="2" x2="0" y2="197">
+    <stop offset="0" stop-color="#0a2649"/>
+    <stop offset="1" stop-color="#050d1c"/>
+  </linearGradient></defs>
+  <path d="M9.5,1 H17 V224 H9.5 A8.5,8.5 0 0 1 1,215.5 V9.5 A8.5,8.5 0 0 1 9.5,1 Z" fill="url(#body)" fill-opacity="0.75" fill-rule="evenodd" clip-path="url(#body-area)"/>
+  <path d="M17,1 H9.5 A8.5,8.5 0 0 0 1,9.5 V215.5 A8.5,8.5 0 0 0 9.5,224 H17" fill="none" stroke="#2896ff" stroke-width="2"/>
+  <defs><clipPath id="strip"><rect x="2" y="2" width="32" height="221" rx="7.5"/></clipPath></defs>
+  <g clip-path="url(#strip)">
+    <rect x="0" y="197" width="16" height="26" fill="black" fill-opacity="0.75"/>
+    <rect x="0" y="197" width="16" height="0.75" fill="#2896ff"/>
+  </g>
+</svg>

port/assets/menus/port_svg/pause/pausebox_right__3.svg

@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="16" height="256" viewBox="0 0 16 256">
+  <defs><clipPath id="body-area"><rect x="-16" y="0" width="48" height="197"/></clipPath></defs>
+  <defs><linearGradient id="body" gradientUnits="userSpaceOnUse" x1="0" y1="2" x2="0" y2="197">
+    <stop offset="0" stop-color="#0a2649"/>
+    <stop offset="1" stop-color="#050d1c"/>
+  </linearGradient></defs>
+  <g transform="matrix(-1 0 0 1 16 0)">
+    <path d="M9.5,1 H17 V224 H9.5 A8.5,8.5 0 0 1 1,215.5 V9.5 A8.5,8.5 0 0 1 9.5,1 Z" fill="url(#body)" fill-opacity="0.75" fill-rule="evenodd" clip-path="url(#body-area)"/>
+    <path d="M17,1 H9.5 A8.5,8.5 0 0 0 1,9.5 V215.5 A8.5,8.5 0 0 0 9.5,224 H17" fill="none" stroke="#2896ff" stroke-width="2"/>
+  </g>
+  <defs><clipPath id="strip"><rect x="-16" y="2" width="30" height="221" rx="7.5"/></clipPath></defs>
+  <g clip-path="url(#strip)">
+    <rect x="0" y="197" width="16" height="26" fill="black" fill-opacity="0.75"/>
+    <rect x="0" y="197" width="16" height="0.75" fill="#2896ff"/>
+  </g>
+</svg>

port/linux/NETCODE.md

@@ -84,6 +84,13 @@ with ideas from VALORANT's netcode articles, keeping the 30 Hz tick:
   actor pool, `halo_port_capacity.h`, holds 1024). Riders a dropship has no
   seats for are kept, and placed beside its riders once they get out. Only
   the host runs the AI, so the clients see them as the host's other actors.
+
+  Each player chooses whether to play with friendly fire between players
+  (`network.coop_own_friendly_fire`, FRIENDLY FIRE in the pause menu): two
+  players hurt each other only if both do. A client's input tells the host
+  its choice. A player with no input for over 70 seconds (no button pressed
+  or let go, no stick or trigger held) is hurt by every player, whatever
+  either chose, until their next input.
 - **Host authoritative.** The host alone decides damage, deaths, spawns,
   pickups, scores and the game's objects; clients do not decide them but
   apply what the host sends.
@@ -122,13 +129,23 @@ with ideas from VALORANT's netcode articles, keeping the 30 Hz tick:
   than the player goes of their own (and up, what its tick added but a
   jump's), so a client that says it goes faster (a copy said to hover and
   fall, gaining the host's gravity each tick) gains nothing by it. A
-  teleporter, which moves the host's own copy too, starts afresh. On a
-  moving elevator the host takes only where a client's player is across,
+  teleporter, which moves the host's own copy too, starts afresh. Riding an
+  elevator (moving, or at rest with the player on its floor) the host takes
+  only where a client's player is across,
   not how high: the client's elevator follows the host's (co-op's device
   sync), so its player's height reaches the host a round trip behind the
   host's elevator, under its floor going up, where the host's copy would
   fall through it. Each machine's elevator carries its own copy up and
-  down, and they meet where it stops.
+  down, and they meet where it stops. Floor contact keeps that protection
+  through a stop or reversal; the remembered attachment alone after leaving
+  a stopped platform does not. A client echoing a prediction while still on
+  the same elevator keeps its local floor height, rather than applying the
+  difference between the platforms' phases to its current height, when that
+  difference is within 4 world units (the platform's travel over a round
+  trip); a greater one, jumps, leaving the platform and authoritative
+  teleports correct normally. Rider carry uses the platform's current
+  collision displacement, including phase corrections, rather than its
+  previous tick's displacement (network version 30).
 - **Shooter's hits.** A client reports what its own players hit; the host
   checks the report (the player's, a weapon they carry, fired from within
   its reach, the target where the host had it when the shooter saw it, no
@@ -201,7 +218,22 @@ limits, and readies a second weapon picked up while firing; version 29 names
 a Custom Edition map by its own name (`custom_maps\hugeass`, which every
 screen shows) and says which version it is by the map version of the game
 record, its hash's first 32 bits (the header checksum before), which a
-client finds its file by (below, "Map sharing").
+client finds its file by (below, "Map sharing"); version 30 carries an
+elevator's riders by its movement of the same tick, which the Xbox game did
+a tick late, so that every machine moves them alike; version 31 puts the
+Xbox game's begin game, graceful exit and pregame keep-alive field lists
+under their own messages (its table had each on its neighbour's) and makes
+the keep-alive a long, as it was sent: not a byte on the wire moves but the
+keep-alive's last two, the sender's stack before and zero now, and the
+table's record changed with it; and with it, every machine drops a datagram
+of the netcode stamped more than 15 seconds from its sender's latest, the
+host takes a client's hits, Discord user and readiness only over its
+connection, and the host answers each machine's datagrams where they come
+from, so that a second copy of the game on one computer, on a port of its
+own, plays too; version 32 sends the host's mouse aim assist policy
+(distributed message 90, `network_aim_assist.c`), which a client must not
+ignore, and has a client's input say whether its player plays co-op with
+friendly fire.
 
 `port/linux/network_format.txt` records the wire format of the current
 version (`tools/network_format.py`): `test_linux_port.py` fails when the
@@ -360,6 +392,15 @@ A speed hack of less than a tenth is let be: the host's bounds on how far
 and how fast a client's player moves and fires hold it to the host's time
 anyway.
 
+The host's AIM ASSIST option in Player Options defaults to ALLOWED.
+BLOCK M+KB overrides optional mouse magnetism on every machine, including
+the host. Aiming with the controller or touch retains its existing behavior;
+the player's saved preference and the bullets' autoaim are unchanged.
+`network_aim_assist.c` sends the policy reliably on client ready and on
+change. Clients take it only from the host and default to blocked until it
+arrives. This adds distributed message 90; network version 32 requires
+matching builds so an older client cannot silently ignore the rule.
+
 ## Joining a game in progress
 
 A game stays open when it starts (on the Xbox it closed, since every
@@ -419,8 +460,14 @@ its name alone beside it, has its name given back as the map lists find it.
   map, bitmaps.map, sounds.map and loc.map it lacks) instead of leaving, if
   `network.map_download` lets it. Its players wait to join until the host's settings
   have named the map, and for a game in progress until it is downloaded; in
-  the lobby they join at once, and the host's start waits for the machine to
-  precache the map, as it waits for any machine.
+  the lobby they join at once. A host that starts while a machine is still
+  downloading starts the others without it: the machine's players are held
+  out of the game, and so is any player it asks for meanwhile (a machine
+  whose download began in the lobby does not know the game has started),
+  and the machine joins the game in progress once the map is there. A
+  client told to start before its download is done (by a host of an earlier
+  build) puts the start off until the map is there, rather than loading a
+  map it does not have yet (the damaged disc error, which stops the game).
 - **The offer.** A host that shares maps (`network.map_share`) hashes the
   map, and the resource maps the map needs (its tag index says which: a tag
   whose entry's word at 0x18 is set is held whole by bitmaps.map for a
@@ -538,7 +585,16 @@ its name alone beside it, has its name given back as the map lists find it.
      and delete theirs to match. A client that has loaded asks for all the
      host's objects and is told when it has them; from then on it deletes
      any such object the host has not told it of, and nothing but the
-     host's word deletes the host's.
+     host's word deletes the host's. That word has deleted a CTF flag or
+     an oddball, which the game itself never deletes (two assertions,
+     in `objects.c` and `weapons.c`, stop a build that is not `--release`
+     there). Why the host deleted it is not known; the client follows
+     the host's word whatever the reason: it takes the flag or ball out
+     of its carrier's hands, and the goal its game type shows at it goes
+     with it. The two assertions are not made for anything a client
+     deletes in `distributed_client_delete`: the host's objects on its
+     word, one in the place of an object the host creates, and its own
+     the host has not told it of.
    - The objects placed when the map loads are placed alike everywhere:
      the host's word finds a client's already there. Past loading, a
      client's own objects (projectiles, effects: what only it sees) take
@@ -701,7 +757,12 @@ Unity's Netcode for Entities, lightyear, netfox and the Ares source):
   messages (checked as the host's below); the game's own messages (a player
   added or removed, the game begun or over, its settings), which the host
   sends over its connection, are ignored in a datagram
-  (`network_client_message_handler.c`).
+  (`network_client_message_handler.c`). The host takes a client's hits,
+  Discord user and readiness only over its connection too, and every
+  machine drops a datagram of the netcode stamped with a tick more than 15
+  seconds from the latest it had from that machine (one stamped far ahead
+  would have the machine's newer ones taken for stale); a message over the
+  connection is taken whatever its tick (`network_distributed.c`).
 - **Nothing held back.** The game's connections (the reliable messages:
   objects made and deleted, the game type's state, hits, pickups) send each
   write at once (`TCP_NODELAY`, in `xnet.c` for the game's sockets and in
@@ -779,12 +840,25 @@ Unity's Netcode for Entities, lightyear, netfox and the Ares source):
   took to come (the reliable channel's resending holds it up), that is
   when the shooter saw the target (as far back as the host keeps). A
   report made more than three seconds ago is refused.
+- **The latency meter** (`latency_meter.c`, `display.latency_meter`) shows
+  the same round trips, timed in milliseconds by when each machine sent the
+  tick they come back naming (the last 64 ticks' send times kept), with
+  nothing more sent: the host each client's, by the host tick its input
+  names; a client its own, by its tick the host's state of its player (or,
+  driving, its vehicle) says the host has it at. Each is the network both
+  ways plus each machine's wait for its next tick, so a LAN reads 15 to 35
+  ms. A client that has heard nothing from the host for two seconds shows
+  "Connection problem"; the host logs a client silent as long. With the
+  meter on, the scoreboard shows these where the machine has them (the
+  host every client's, a client its own players'), and the host's measure
+  in ticks, which every machine is sent, for the others.
 
 ## Testing
 
 `debug.network_test` (`port/linux/game/network_test.c`) hosts or joins a
 game without the menus (in a team game the joining player takes the other
-team), and `debug.test_input` plays controller 1 with a scripted bot (or,
+team; `local:<map>` plays a local split screen game instead, which the
+bots of `bots.count` join), and `debug.test_input` plays controller 1 with a scripted bot (or,
 `look:<seed>`, one that stands still, only turning and looking up and
 down); each machine logs every player's position, health and shields,
 where they aim and face, their animation state and how hard they move,
@@ -825,7 +899,130 @@ started first), to test that nothing another machine sends can crash the
 game: a host and a client with a third of their datagrams damaged must play
 on, their logs noting what they refused.
 
+With `log`, `debug.network_test` hosts and joins nothing: it logs the game
+one machine plays (a `map_name` in `init.txt` plays one without the menus),
+as above. `debug.network_test_cues` has the host, or that machine, run
+console lines at their ticks, from the first tick every player is in.
+
 The host logs to `debug.txt` when a player on another machine presses the
 action button where the host has nothing for them to pick up, with where it
 has them and the nearest item: a client that sees a pickup the host does
 not.
+
+### Comparing two builds
+
+`tools/net_compare.py` checks that two builds play a network game in step:
+a build with a change to the simulation, the compiler or the maths against
+one without. It plays them together on the loopback, build A
+hosting and B joining (and, with `--swap`, the other way round), on each
+map given, each copy's player a seeded bot (`debug.test_input`
+`bot:<seed>`, `--events` adds `debug.network_test_shoot` and
+`debug.network_test_kill`), headless (`debug.null_renderer`, with no
+display; or with `--window` a hidden window, on the display the tool was
+started with, `DISPLAY` or `WAYLAND_DISPLAY`, or `--display`'s: a virtual
+one, Xvfb, rather than a desktop), and compares the two machines' logs:
+
+```sh
+python tools/net_compare.py --a build/linux/halo --b <other checkout>/build/linux/halo \
+    --data <folder holding maps/> --maps bloodgulch,beavercreek,hangemhigh --swap
+```
+
+It needs the retail maps, so it runs on a developer's machine or a
+self-hosted runner, not in the public CI; run it before merging a change to
+a build's compiler, maths or the simulation itself. A build
+is its executable: a build's (`build/linux/halo`) or a release's. Each copy
+gets its own folder (an executable, `config.toml` written in the copy's
+folder, a data root linking the maps, and saves) in `build/net_compare/`,
+removed when every game passes. It prints PASS, FAIL (with the first
+divergent player, tick and field) or ERROR (a copy that did not start, join or log) for each game and
+a line of figures; a copy's log and the end of its `debug.txt` are kept for
+each game. It exits 0 when every game passes, 1 when any fails, even if
+another was an error (a divergence is the finding; an error only a gap in
+it), else 2 when any was an error. Each copy runs in a process group of its
+own, which the tool ends however it ends: stopped with Ctrl-C, SIGTERM or
+SIGHUP, it stops the copies and exits 128 plus the signal's number, and
+killed outright, the kernel ends the copies (`PR_SET_PDEATHSIG`). `--compare <host log>
+<client log>` judges two logs already written, and
+`--a-wrapper`/`--b-wrapper` run a build under another program (a tracer, a
+debugger). Both builds
+must log the drift (below): one built before it is an error.
+
+The host decides and a client predicts its own player, so the comparison
+is not lockstep's bit for bit, but of what the netcode allows:
+
+- **Each second's state.** For every player, what the host logged and what
+  the client logged at the same tick (the machines' clocks agree: the
+  ticks match). Positions within 1 world unit: a remote player's word
+  comes a tick or so late, a client's prediction reaches the host as late,
+  and a player runs about 0.08 world units a tick, so identical builds are
+  0.04 apart on average and 0.24 at most, and a client puts its copy of a
+  remote player where the host has it past `REMOTE_BLEND_DISTANCE` (1
+  world unit); out for 2 seconds in a row fails. Aim within 15 degrees,
+  body and shield within 0.15, and alive or dead, riding, grenades,
+  weapons, score, kills, deaths and team the same: out for 3 seconds in a
+  row fails, as the host's word on damage, a death, a pickup or a score is
+  a round trip, or a death blow's wait, late, and a player thrown by a
+  blast aims as no input says for a second or two. Rounds within 3: out
+  for 6 seconds fails, as a client keeps its own player's ammunition
+  while it fires and takes the host's (a pickup's) only once it stops
+  (`network_objects.c`).
+- **Drift.** Those agree between builds that simulate differently too,
+  as the netcode corrects every copy toward the host's. What does not is
+  how the host moves a client's player: each tick the host moves it on
+  from where it took the client's last prediction, with the client's
+  input, and then hears the client's prediction of the same tick. Where
+  the host took the last a tick ago, it was of the client's tick before,
+  and the host has the input of the client's tick, both machines moved
+  the player one tick with the same input from much the same place, and
+  `distributed_take_prediction` (network_distributed.c) notes how far
+  apart the two moves were, and whether further than
+  `DIVERGENCE_APART_DISTANCE` (0.0001 world units, far above the last
+  bits' rounding). (The moves, not where they end: the host puts its copy
+  only halfway to a prediction a little off, so where it ends would be as
+  far off for ticks after anything that set them apart.) Identical builds
+  move it alike to the last bit but where the player touched something
+  the two machines have in slightly different places (the other player,
+  a grenade's blast, an item knocked about). A build that moves a player
+  otherwise is apart in most of the ticks the player moves. More than 60%
+  of the ticks apart fails.
+
+The per-second line each machine logs (`network_test_log_players`) is:
+
+```
+network test: tick <tick> player <index>: (<x> <y> <z>) h<body>/<shield>[ riding][ camo] g<grenades>/<grenades> w
+  a<aim yaw>/<aim pitch> f<facing yaw> l<look yaw>/<look pitch> as<aiming screen>/<looking screen> st<animation state>
+  thr<throttle>[ <weapon tag>:<rounds>...] s<score> k<kills> d<deaths> f<team kills> t<team> m<machine>
+  [player <index>: dead s<score> k<kills> d<deaths> f<team kills> t<team> m<machine>] ...
+  | items <on the ground> (+<created> -<deleted> !<failed> x<removed>) | <playing|game over> to <score to win>
+  | sent <n> received <n> corrected <n> | hits <n> dealt <n> rejected <n> replayed <n>
+  | local <player> camera (<x> <y> <z>) respawn <ticks> | drift <ticks> <apart> <mean> <largest>
+```
+
+(on one line; a riding player's position is the vehicle's, angles are in
+degrees, a weapon's tag is its tag index's low 16 bits in hexadecimal, and
+its rounds are those loaded and in reserve). `drift` is the host's: how
+many ticks of the second it compared a client's move of its player with
+its own (above), how many of them were apart, and the mean and largest
+distance apart (world units); a client's is 0. net_compare.py reads every
+field but the items, the hits and the camera, and compares the last game a
+log has.
+
+Calibration (on one 24-thread computer, with up to four games played at
+once, 60 seconds each, both ways round, on bloodgulch, beavercreek,
+hangemhigh, chillout, prisoner, ratrace, longest and carousel):
+
+| Builds | Games | Result | Ticks apart |
+| --- | --- | --- | --- |
+| The Linux build against itself | 64 | 63 pass (one copy crashed, an error) | 0-13%, up to 42% with the frames uneven |
+| The Linux build against itself, `--events` | 12 | 12 pass | 7-36% |
+| B's players 0.5% faster | 10 | 10 fail, at the first second compared | 77-88% |
+| B's players 2% faster | 6 | 6 fail, at the first second compared | 88-93% |
+| B's gravity 0.5% or 2% stronger | 14 | 14 pass | 25-38% |
+
+(B a build of the same sources with `movement_desired` or `global_gravity`
+scaled in `biped_update_physics`, a change made for the test.) A change to
+how players move on the ground is caught in the first second; one that
+changes only the ticks in the air, as gravity does, is within what
+identical builds show, and not caught. Positions agree to 0.04 world units
+on average, 0.24 at most, in every game, perturbed or not: the netcode
+corrects them.

port/linux/README.md

@@ -35,9 +35,11 @@ To start the game:
 - The 32-bit OpenGL libraries (`lib32-mesa`).
 - The 32-bit PipeWire or PulseAudio client libraries (`lib32-pipewire` or
   `lib32-libpulse`).
-- The 32-bit X11 libraries (`lib32-libx11`, `lib32-libxext`). In a Wayland
-  session, the game uses them through XWayland. SDL uses Wayland itself
-  only if the 32-bit Wayland libraries are version 1.20 or later
+- The 32-bit X11 libraries (`lib32-libx11`, `lib32-libxext`, and
+  `lib32-libxi`, with which SDL holds the mouse; without it the game hides
+  the pointer and moves it back to the middle of the window instead). In a
+  Wayland session, the game uses them through XWayland. SDL uses Wayland
+  itself only if the 32-bit Wayland libraries are version 1.20 or later
   (`lib32-wayland`, `lib32-libxkbcommon`; Debian 11, Ubuntu 20.04 and
   Fedora 32 have older ones) and the compositor has the fifo-v1 protocol.
   On GNOME, the window then has borders only with the 32-bit libdecor
@@ -76,7 +78,10 @@ against it.
 To make the portable build you need, in addition to the tools above,
 CMake, `pkg-config` (`pkgconf`) and `wayland-scanner` (`wayland` on Arch
 Linux, `libwayland-bin` on Debian and Ubuntu). You do not need the 32-bit
-SDL3. You need the 32-bit glibc only for the tests.
+SDL3. You need the 32-bit glibc only for the tests. Keep the checkout in a
+folder whose path has no spaces: SDL's build takes the system root's
+include folders from `pkg-config`, which splits a path at its spaces, so the
+portable build stops with a message there.
 
 To see the glibc version that a build needs, enter
 `readelf -V build/linux/halo | grep -o 'GLIBC_[0-9.]*' | sort -uV | tail -1`.
@@ -107,11 +112,23 @@ sequence:
    contains the executable.
 
 If the game finds no data, it asks for an Xbox disc image (`.xiso` or
-`.iso`). This occurs at the first start:
+`.iso`). This occurs at the first start. First the game looks for a disc
+image in the folder of the executable (a name that ends in `.iso` or
+`.xiso`, in capitals or not). If it finds one, it names that image in its
+question:
 
 - Select "No" to stop the game.
-- Select "Yes" to open a file picker. Select the disc image. The game copies
-  `maps/` next to the executable and shows the progress.
+- Select "Yes" to copy `maps/` from the disc image. If the game found an
+  image next to the executable, it uses that image and shows no file picker.
+  Otherwise it opens a file picker: select the disc image, or cancel to see
+  the question again. The game copies `maps/` next to the executable and
+  shows the progress. If the copy from the image found next to the
+  executable fails, the next "Yes" opens the file picker.
+
+On Linux, the file picker needs the desktop portal or `zenity`. If neither
+is present, the game says to put the disc image next to the executable (or
+to install `zenity`) and stops. Put the image there and start the game
+again.
 
 The game writes the copy to `maps.partial`. When the copy is complete, the
 game changes the name to `maps`. If the copy stops before it is complete,
@@ -149,6 +166,21 @@ Do the set-up in Desktop Mode: unpack the release, put `maps/` next to
   wait: the host drops a machine that it has not heard from for 15 seconds,
   and while a Deck that hosts sleeps, the other players have no host.
 
+### NVIDIA on Wayland
+
+The game is a 32-bit program. NVIDIA's driver draws OpenGL into a Wayland
+window through its `egl-wayland` library, which most distributions only
+ship 64-bit (Arch and its derivatives have no 32-bit package of it). A
+32-bit OpenGL window on Wayland then falls back to Mesa's `llvmpipe`, which
+draws on the processor: the log shows `OpenGL ... on llvmpipe`, and the
+game is slow or never finishes loading.
+
+So on a Wayland desktop with NVIDIA's driver loaded, the game opens its
+window through XWayland (X11), where the 32-bit driver draws, unless a
+32-bit `egl-wayland` is installed. The log says so ("video: NVIDIA's
+driver ..."). `SDL_VIDEO_DRIVER=wayland` or `SDL_VIDEO_DRIVER=x11` chooses
+the video driver yourself.
+
 ## Files and folders
 
 | Xbox drive | Folder |
@@ -191,7 +223,9 @@ computer (co-op, or split screen in a network game) and only one gamepad,
 that gamepad is controller 2 (player 2) and the keyboard and mouse stay
 controller 1. The gamepad changes controller only when none of its buttons
 is held. The profile's button layout (Settings > Gamepads) is the
-gamepads' only.
+gamepads' only. Besides the Xbox's five, it has the Master Chief
+Collection's Bumper Jumper: jump on the left bumper, melee on the right,
+switching grenades on A, action and reload on B and the flashlight on X.
 
 | Action | Keys and buttons (default) |
 | --- | --- |
@@ -266,6 +300,13 @@ change. The screens open, close and move between each other as the PC
 version's. `display.menus = "xbox"` gives the Xbox's menus, which start every
 kind of game.
 
+The menus' text is in the language of the Custom Edition whose `loc.map` is
+in `custom_maps` (French, German, Italian, Spanish and so on), as that
+edition shows it: each of the PC version's texts is that `loc.map`'s
+(`display.menu_language`). Without one, and for the lines the port adds,
+it is English. The pictures with words in them (the screens' titles, the
+main menu's items) are drawn in English.
+
 Multiplayer > CO-OP CAMPAIGN is the Xbox's cooperative play, which the PC
 version does not have: two players on this computer play the campaign in
 split screen. Player 1 is the player who chose it, on the current profile.
@@ -280,7 +321,9 @@ player's profile is chosen on the ADD PLAYER screen that opens (with any
 controller). With one gamepad, choose the lobby's ADD PLAYER button first:
 until then that gamepad shares controller 1 with the keyboard. Two players on one profile get different names from the host. A
 player's B in the lobby leaves the game alone, and the last player of the
-computer leaves it for all of them. In the game, each player's pause menu
+computer leaves it for all of them. When all the players are on the host's
+computer, START NOW starts the game without another computer, and a team
+game does not need a player on each team. In the game, each player's pause menu
 opens on their part of the screen, and its LEAVE GAME is theirs: their part
 of the screen stays until the game ends. A game under way shows its own
 screen before JOIN GAME: players join there the same way, START or ADD
@@ -307,6 +350,11 @@ while the game stays paused, with only Controls, Gamepads, Mouse, Audio and
 Video Setup; Gamepads' OK saves the profile at once. In co-op the settings
 have Network Setup too, with its in-game pages as in a multiplayer game.
 
+In an online co-op game, the pause menu also has FRIENDLY FIRE ON or
+FRIENDLY FIRE OFF, after SETTINGS, in a box drawn taller for it: whether this
+computer's players hurt, and are hurt by, the other players
+(`network.coop_own_friendly_fire`). A or enter changes it, from that moment.
+
 The menus are XML files in `port/assets/menus` (`tools/ce_menus.py` writes
 them from the PC version's tags), which the game contains. To change them,
 put files in a `menus` folder next to `config.toml`: a file with the same
@@ -315,6 +363,21 @@ path replaces one of the game's, and another `.xml` file is added.
 the game uses the Xbox's menus and the log names the file, the line and the
 problem.
 
+## Bots
+
+Computer players (bots) can play a local multiplayer game with you:
+`bots.count` (1 to 15) of them join the lobby of a Slayer game played on
+this computer, which is Multiplayer > Split Screen in the Xbox's menus
+(`display.menus = "xbox"`; the PC version's menus have no game of this
+computer alone). They are players as you are: in the scores, the respawns
+and the game's rules, on the teams that `bots.teams` asks for, and they
+follow the teams' changes in the lobby. They look for enemies, aim, fire,
+throw grenades and pick up better weapons, as well as `bots.skill` lets
+them, and walk the paths that the campaign's AI finds on the maps' walkable
+surfaces (`game/bots.c`). They are never in system link or internet games,
+nor in other gametypes, and nothing that the machines send each other
+changes.
+
 ## Settings
 
 The settings are in `config.toml` next to the executable
@@ -324,7 +387,9 @@ values again, delete the file.
 
 The game reads the file at start-up. If a key is not correct, or a value
 has the wrong type, the game writes the line to the log and uses the default
-value. The Settings menu (Video, Mouse, Audio, Network and Controls Setup)
+value. A key in the wrong section is named with the section it goes under. A
+file that cannot be parsed leaves every setting at its default; a word value
+needs its quotes (`menus = "pc"`, not `menus = pc`). The Settings menu (Video, Mouse, Audio, Network and Controls Setup)
 changes the useful settings, writes them into the file (only their lines
 change) and applies them at once, but `audio.enabled`, and `display.menus`
 from the next main menu.
@@ -349,6 +414,7 @@ the setting for one start of the game. It has priority over the file.
 | `display.fov` | `0.0` | `HALO_FOV` | The first-person view's field of view on foot, in degrees across at 16:9, from 20 to 150. `0`: the stock view. Refer to "Field of view". |
 | `display.viewmodel_fov` | `0.0` | `HALO_VIEWMODEL_FOV` | The first-person weapon's and hands' field of view, in degrees across at 16:9, from 20 to 150. `0`: the weapon's stock view, also when `display.fov` widens the world. Refer to "Field of view". |
 | `display.viewmodel_visible` | `true` | `HALO_VIEWMODEL_VISIBLE` | `true`: the first-person weapon, hands and what is attached to them are drawn. `false`: they are not; firing, animation, sound and lights go on, and other players' models are drawn. |
+| `display.passenger_third_person` | `false` | `HALO_PASSENGER_THIRD_PERSON` | Third-person view for the Warthog's passenger and the Scorpion's four passengers. Uses the gunner's camera on the Warthog and the driver's on the Scorpion, within the passenger's firing arc. Smooth entry and exit; weapon zoom is disabled while riding. The reticle follows the shot's centre ray. Local view only. In the campaign and co-op only: not in multiplayer, where seeing around the vehicle would be an advantage. |
 | `display.viewmodel_shield` | `false` | `HALO_VIEWMODEL_SHIELD` | `true`: the energy shield's flare (its hits, its charging, its fall) is drawn on the first-person arms too, as on the body, with the unit's own shield shader, kept closer to the arms than to the body. The stock game draws it on the body only. |
 | `display.first_person_legs` | `false` | `HALO_FIRST_PERSON_LEGS` | `true`: your own body is drawn from the waist down in first person, so you see your legs when you look down, moving as the body's animation moves them. Refer to "Field of view". |
 | `display.shield_color` | `default` | `HALO_SHIELD_COLOR` | Your energy shield's flare as this machine draws it: `default` (the shield's own) or a multiplayer armor color (`white`, `black`, `red`, `blue`, `gray`, `yellow`, `green`, `pink`, `purple`, `cyan`, `cobalt`, `orange`, `teal`, `sage`, `brown`, `tan`, `maroon`, `salmon`), whatever the armor's, on the body and, with `display.viewmodel_shield`, on the first-person arms. The shield's own shader is drawn with its two colors replaced at their brightness; the flare is added to what is behind it, so `black` is drawn a faint grey. Only this machine sees it. |
@@ -356,20 +422,33 @@ the setting for one start of the game. It has priority over the file.
 | `display.high_res_text` | `true` | `HALO_HIGH_RES_TEXT` | `true`: the menus' and HUD's text is drawn with the fonts in `port/assets/fonts` (Overpass, in place of the maps' Interstate) at the resolution the game draws at, laid out as before; the menus' titles are drawn from the high-res pictures in `port/assets/titles`, and the controller button icons from those in `port/assets/buttons`. `false`: the maps' bitmap fonts, titles and button icons. |
 | `display.shadow_resolution` | `128` | `HALO_SHADOW_RESOLUTION` | The size of the maps that the shadows of the objects are drawn in, in pixels each way: `128`, `256`, `512` or `1024` (other values go down to one of these). The game draws the shadow of each object into a map of 128x128 pixels, blurs it and projects it onto the ground. On a large screen, the edges of these shadows show steps that move when the object moves. A larger map makes the edges smooth; the blur is made wider to match, so the shadows are as soft as on the Xbox. Each doubling adds two passes of the blur. `128`: as on the Xbox. |
 | `display.menus` | `"pc"` | `HALO_MENUS` | `"pc"`: the PC version's menus, from the files in `port/assets/menus` and a `menus` folder next to `config.toml`. Refer to "Menus". `"xbox"`: the Xbox's menus. |
+| `display.menu_language` | `"maps"` | `HALO_MENU_LANGUAGE` | The PC menus' language. `"maps"`: the language of the Custom Edition whose `loc.map` is in `custom_maps` (English without one). `"english"`: English. The port's own lines are English. |
 | `display.player_names` | `"all"` | `HALO_PLAYER_NAMES` | In multiplayer, whose names are drawn above their heads: `"all"`, `"allies"`, `"enemies"` or `"none"`. An ally's name is drawn above the triangle the game shows over teammates. An enemy's name shows only within the motion sensor's reach, while the enemy is in sight and not camouflaged, so it never shows where an enemy hides. The gametype's motion tracker setting also applies: no names if it shows no players, only allies' if it shows only friends. |
 | `display.player_name_scale` | `1.0` | `HALO_PLAYER_NAME_SCALE` | How large the players' names are drawn: `1.0` is three quarters of the size of the HUD's text, from `0.25` to `4`. With high-res text, larger names are rasterized at their size, so they stay sharp. |
+| `display.match_timer` | `false` | `HALO_MATCH_TIMER` | `true`: a multiplayer game draws its clock at the bottom right, counting up from the game's first tick, which the items' respawn periods count from too: a weapon is back on the map at every multiple of its period on the clock. Campaign and co-op have none. MATCH TIMER in Video Setup > Graphics. |
 | `display.text_chat` | `true` | `HALO_TEXT_CHAT` | Show the text chat of network games (Settings > Network Setup > Multiplayer HUD > TEXT CHAT). `false` hides its lines, and its keys and a controller's D-pad Up open nothing. Refer to "Text chat". |
 | `display.chat_style` | `"colors"` | `HALO_CHAT_STYLE` | The text chat's colours (Settings > Network Setup > Multiplayer HUD > CHAT TEXT): `"colors"`, the player's name in their team's colour and the text a pale blue; `"white"`, all of it white, as Custom Edition. |
 | `display.scoreboard_team_layout` | `"teams"` | `HALO_SCOREBOARD_TEAM_LAYOUT` | How the multiplayer scoreboard (hold BACK, or tab) lists a team game's players. `"teams"`: a column for each team, red on the left and blue on the right. `"score"`: all the players in order of score. With more players than fit, the mouse wheel and Page Up / Page Down scroll the scoreboard. |
 | `display.scoreboard_background` | `true` | `HALO_SCOREBOARD_BACKGROUND` | `true`: the multiplayer scoreboard (hold BACK, or tab) has a panel behind its text, for clearer text. |
 | `display.scoreboard_background_color` | `"16, 16, 16, 150"` | `HALO_SCOREBOARD_BACKGROUND_COLOR` | The colour of the scoreboard's panel: `"red, green, blue, alpha"`, each from `0` to `255`. Alpha `0` is see-through, `255` is solid. |
+| `display.anisotropic_filtering` | `0` | `HALO_ANISOTROPIC_FILTERING` | Textures seen at a grazing angle (floors, walls, terrain) are sampled along the angle from finer mip levels, so they stay sharp; the Xbox game asks for none. `0` or `1`: as on the Xbox. `2`, `4`, `8` or `16`: at most that many samples (at most the GPU's); `4` keeps most of `16`'s sharpness at less cost on slower GPUs. TEXTURE FILTERING in Video Setup > Graphics. It applies to the textures of the map that have mip levels and are filtered linearly (base, detail, bump and environment maps; lightmaps have no mip levels), not to what the game renders, such as the water's ripples. On Android and the web, only where the GPU has `GL_EXT_texture_filter_anisotropic`. |
+| `display.latency_meter` | `false` | `HALO_LATENCY_METER` | `true`: in a network game, your round trip to the host in milliseconds at the top right of the screen, "Ping 45 ms" with four bars: green below 80 ms, yellow below 150, red from 150. The host shows "Max ping", its slowest player's. A player's machine that has heard nothing from the host for two seconds shows "Connection problem". The round trip includes each machine's wait for its next tick, so a LAN reads 15 to 35 ms. Not shown in the menus, after the game, in a co-op cutscene or when the host plays alone. The scoreboard's pings take the same colours, and show the round trips this machine times itself (the host: each player's; a player: their own), so they agree with the meter. Nothing more is sent. Only in config.toml, not in the menus. |
 | `display.per_pixel_lighting` | `false` | `HALO_PER_PIXEL_LIGHTING` | `false`: the models (characters, weapons, vehicles, scenery) are lit at each vertex and the light is blended between them, as on the Xbox. The light across a curved surface then shows facets, and a point light that passes close lights only the vertices it reaches. `true`: the models are lit at each pixel by the same lights (the ambient light, two distant lights and two point lights), which changes their look. |
-| `display.shield_glow` | `false` | `HALO_SHIELD_GLOW` | `true`: as a unit's energy shield flares (hit, charging, falling), it lights what is around it and itself, as a plasma bolt does, in the shield shader's own color (a Spartan's gold, an Elite's blue), rising and falling with the flare seen on the body. An ordinary dynamic light of the game's, drawn with a light definition the map has (`shield_glow.c`). Up to 8 units near the camera. |
-| `display.shield_glow_intensity` | `default` | `HALO_SHIELD_GLOW_INTENSITY` | The shield glow's reach and brightness: `default`, or `light_show` (three times as far, and at full strength from a third of the flare: a light is no brighter than full). The units glowing are those near any local player's camera, so each of a split screen's views has the same. |
+| `display.structure_culling` | `31` | `HALO_STRUCTURE_CULLING` | Which tests skip the triangles of the level (its walls, floors and terrain) that the camera cannot see before they are drawn, as bits added together: `1`, triangles outside the view; `2`, groups of triangles that all face away from the camera; `4`, single triangles that face away; `8`, smaller groups, so that more of them are skipped whole; `16`, the rooms nearest the camera first. Each test is conservative: the picture is the same, with fewer triangles drawn. `0`: the original walk, which draws every triangle of each visible room. The console's `structure_culling <bits>` changes it until the game quits, and `debug_structure_culling true` shows what was skipped (red: outside the view, blue: facing away). |
+| `display.shield_glow` | `false` | `HALO_SHIELD_GLOW` | `true`: as a unit's energy shield flares (hit, charging, falling), it lights what is around it and itself, as a plasma bolt does, in the shield shader's own color (a Spartan's gold, an Elite's blue), rising and falling with the flare seen on the body. An ordinary dynamic light of the game's, drawn with a light definition the map has (`shield_glow.c`). Up to 8 units near the camera. Video Setup's Extra Effects screen sets it. |
+| `display.shield_glow_intensity` | `default` | `HALO_SHIELD_GLOW_INTENSITY` | The shield glow's reach and brightness: `default`, or `light_show` (three times as far, and at full strength from a third of the flare: a light is no brighter than full). The units glowing are those near any local player's camera, so each of a split screen's views has the same. Video Setup's Extra Effects screen sets it. |
+| `display.overshield_effect` | `false` | `HALO_OVERSHIELD_EFFECT` | `true`: the overshield's flare rises up the body from the feet as it charges, with a soft edge (2 seconds, the charge's time from a full shield; 3 from a shield that was down; 2 from any other), then stays lit, whole, for as long as the overshield lasts, its energy moving at 30% of its speed, in its own color (the powerup's, 253, 78, 116), whatever shield color its player chose; the shield's own flares are not drawn over it, and its glow (`display.shield_glow`) rises and stays with it. With `display.viewmodel_shield` it comes up on the first-person arms as the rise reaches them. A hit on it plays what the projectile plays on an Elite's shield (its sound, sparks and light), when the map has that effect and it only shows and sounds. `false`: the overshield as the stock game draws it. Only this machine's drawing and sounds change (`overshield_effect.c`; the rise is a fade in the vertex shader, `d3d8_gl_set_height_fade`). Video Setup's Extra Effects screen sets it. |
+| `display.model_detail` | `"stock"` | `HALO_MODEL_DETAIL` | Which level of detail (of up to five) each model is drawn at. The game measures a model by its size in the lines of its 480-line screen, at any resolution, so at 1440 lines a model three times larger than the levels were made for is drawn as the Xbox drew it. `"stock"`: as on the Xbox. `"native"`: measured in the lines of the display (not supersampling's), so more detail is kept at a distance at high resolutions, and small far models that the Xbox left out are drawn. `"highest"`: measured as `"native"` for which models are drawn, and those drawn at their most detailed level. With either, a part that has no geometry at the level chosen draws its most detailed level below that has some, and a level made for a model's inside (one for a size over 1000 pixels, as the top level of a10's cryotubes) is drawn only while the camera is inside the model. Models whose map gives one level (the trees and rocks of b30) do not change. On Android, which draws 480 lines, `"native"` is `"stock"`. |
+| `display.hdr` | `false` | `HALO_HDR` | `true`: the back buffer that the 3D view is drawn into holds half floats (`GL_RGBA16F`) in place of 8 bits a channel, so that the light the game adds up (blended lights, glows, fog, particles) is kept past white in place of being clipped. Before the HUD and the menus, a tone mapping pass brings it back into the display's range (`display.hdr_tone_mapping`). The HUD and the menus do not change. On Android, only with a GPU that draws into half floats (OpenGL ES 3.2, `GL_EXT_color_buffer_half_float` or `GL_EXT_color_buffer_float`); otherwise off, with a line in the log. A change applies from the next frame. Video Setup's GRAPHICS screen sets it (HDR) and `display.hdr_output` (HDR DISPLAY). Refer to "HDR" in "What operates". |
+| `display.hdr_exposure` | `1.0` | `HALO_HDR_EXPOSURE` | With `display.hdr`, the light of the 3D view is multiplied by this before the tone mapping, from `0.25` to `4.0`. |
+| `display.hdr_tone_mapping` | `"neutral"` | `HALO_HDR_TONE_MAPPING` | With `display.hdr`, the curve that brings the light into the display's range. `"neutral"`: the picture is as without HDR up to 80% of white, and the light past it rolls off to white in place of being clipped. `"aces"`: the ACES filmic curve (Narkowicz's fit), with more contrast and darker shadows. `"reinhard"`: the extended Reinhard curve on luminance, softer and darker. |
+| `display.hdr_output` | `false` | `HALO_HDR_OUTPUT` | Not on Android or in a browser. With `display.hdr`, `true`: the window asks for floating-point pixels (scRGB). On a display that has HDR on (on Windows, "Use HDR"), the tone mapping then goes up to the display's headroom over SDR white, and the light past white is shown brighter than white. Without an HDR display the picture is as with `false`; if the driver has no such window, the game makes an 8-bit one. Read at start. With NVIDIA's driver on Windows, the NVIDIA Control Panel's "Vulkan/OpenGL present method" must be "Prefer layered on DXGI Swapchain": otherwise a fullscreen or borderless window turns black, then oversaturated. Experimental. |
 | `audio.enabled` | `true` | `HALO_NO_AUDIO=1` sets `false` | `false`: no audio device. The sound continues without output. |
 | `audio.volume` | `1.0` | `HALO_VOLUME` | The master volume. |
 | `audio.music_volume` | `1.0` | `HALO_MUSIC_VOLUME` | The music's volume, of the master volume. |
 | `audio.effects_volume` | `1.0` | `HALO_EFFECTS_VOLUME` | The volume of the other sounds (effects and speech), of the master volume. |
+| `audio.buffer_frames` | `512` | `HALO_AUDIO_BUFFER_FRAMES` | The audio device's buffer, in sample frames at 48 kHz, from `64` to `8192`. Larger rides out stalls that would cut the sound out; smaller has less delay (512 is 11 ms, 2048 is 43 ms). Not on Android or the web. |
+| `audio.channels` | `"stereo"` | `HALO_AUDIO_CHANNELS` | `"stereo"`, or `"5.1"` for surround sound as with Dolby Digital on the Xbox. `"auto"`: 5.1 if the sound device has 6 or more channels. Linux and Windows only. |
 | `audio.reverb` | `true` | `HALO_REVERB` | `true`: the sounds of the world reverberate as the place the player is in does: the sound environments of the maps (a corridor, a cave, a large hall, outdoors) set the reverberation, as the I3DL2 reverb of the Xbox did. A sound behind a wall or a door is muffled in it too. `false`: no reverberation (sounds behind a wall are still muffled). |
 | `audio.resampler` | `"sinc"` | `HALO_AUDIO_RESAMPLER` | How the sounds are converted to the output's rate (48 kHz): `"sinc"` with a band-limited low pass, which keeps out the images above the sound's own rate; `"linear"` between neighbouring samples, which lets some of them through and sounds brighter for it. Audio Setup's SOUND PROCESSING screen sets it, with `audio.reverb`. |
 | `audio.voice_chat` | `"push_to_talk"` | `HALO_VOICE_CHAT` | How you talk in voice chat: `"push_to_talk"` (while `controls.push_to_talk` is held; the microphone opens when you first press it), `"open_mic"` (when the microphone hears speech), or `"off"`. You hear the other players in every case. Refer to "Voice chat". |
@@ -377,12 +456,18 @@ the setting for one start of the game. It has priority over the file.
 | `audio.output_device`, `audio.input_device` | `"default"` | `HALO_AUDIO_OUTPUT_DEVICE`, `HALO_AUDIO_INPUT_DEVICE` | The speakers and the microphone, by the name that Settings > Audio shows, or `"default"` for the device of the system. If the device is not found, the game uses the device of the system. Not on Android. |
 | `input.mouse_sensitivity` | `1.0` | `HALO_MOUSE_SENSITIVITY` | The multiplier for the mouse aim. |
 | `input.mouse_vertical_sensitivity` | `0.0` | `HALO_MOUSE_VERTICAL_SENSITIVITY` | The multiplier for the vertical mouse aim. `0`: the same as `input.mouse_sensitivity`. |
+| `input.playstation_kernel_driver` | `false` | `HALO_PLAYSTATION_KERNEL_DRIVER` | Linux: `true` drives a PlayStation controller (DualSense, DualShock 4) through the kernel's driver of it (`hid-playstation` since Linux 5.12, `hid-sony`): its buttons, sticks, triggers and rumble, with no setup, but not its lightbar. `false`: SDL's own driver, which needs access to the controller's `/dev/hidraw` device, as Steam's udev rules give it (`steam-devices`, or Steam installed). Read at start-up. |
 | `input.invert_mouse` | `false` | `HALO_MOUSE_INVERT=1` sets `true` | `true`: the vertical mouse aim is inverted. |
 | `input.mouse_aim_assist` | `false` | `HALO_MOUSE_AIM_ASSIST` | `true`: the magnetism of the controller also operates for the mouse. `false`: when the mouse moved after the right stick, the view is not slowed or dragged by a target. The autoaim of the bullets operates in both cases. |
-| `controls.<action>` | (the table in "Controls") | `HALO_KEY_<ACTION>` | The keys and mouse buttons of an action, up to two, separated by a comma: `move_forward`, `move_backward`, `strafe_left`, `strafe_right`, `jump`, `crouch`, `fire`, `throw_grenade`, `melee`, `reload`, `zoom`, `switch_weapon`, `switch_grenade`, `action`, `flashlight`, `scoreboard`, `pause`, `screenshot`, `push_to_talk`, `chat`, `team_chat`. Keys by their names (`"W"`, `"Space"`, `"Left Ctrl"`, `"F1"`), and `"Mouse Left"`, `"Mouse Right"`, `"Mouse Middle"`, `"Mouse 4"`, `"Mouse 5"`, `"Wheel"` (either way), `"Wheel Up"`, `"Wheel Down"`. |
+| `controls.<action>` | (the table in "Controls") | `HALO_KEY_<ACTION>` | The keys and mouse buttons of an action, up to two, separated by a comma: `move_forward`, `move_backward`, `strafe_left`, `strafe_right`, `jump`, `crouch`, `fire`, `throw_grenade`, `melee`, `reload`, `zoom`, `switch_weapon`, `switch_grenade`, `action`, `flashlight`, `scoreboard`, `pause`, `screenshot`, `push_to_talk`, `chat`, `team_chat`. Keys by their names on a US keyboard (`"W"`, `"Space"`, `"Left Ctrl"`, `"F1"`): a key is the one in that place on any keyboard, which Controls Setup shows by its own label (the US name on Android). Buttons: `"Mouse Left"`, `"Mouse Right"`, `"Mouse Middle"`, `"Mouse 4"`, `"Mouse 5"`, `"Wheel"` (either way), `"Wheel Up"`, `"Wheel Down"`. |
+| `game.downloaded_maps` | `""` | `HALO_DOWNLOADED_MAPS` | Maps to play as downloaded maps, besides the maps that map sharing downloaded (it names them in `downloaded_maps.txt` in `custom_maps`): their names (`bloodgulch`, `hugeass`), separated by commas, or `"*"` for all the maps. The scripts of a downloaded map cannot change the settings of the player or the games of other players. `debug.txt` names what the game refused. |
 | `game.console_log` | `"important"` | `HALO_CONSOLE_LOG` | What the console shows on the screen. `"important"`: bans, players that the host drops for cheating, the reasons that the game refuses a command, and the asserts that stop the game. `"all"`: all the lines. `"none"`: only the asserts that stop the game. The output of a command always shows. `debug.txt` gets all the lines. |
 | `game.language` | `""` | `HALO_LANGUAGE` | The language of the menus: `ja`, `de`, `fr`, `es` or `it`. Empty: English. |
 | `game.enhanced_animations` | `true` | `HALO_ENHANCED_ANIMATIONS` | `true`: the player bipeds' grenade throws keep their legs moving, blended by speed and direction (crouched throws stay crouched, throws in the air use the jump's legs), Warthog and Scorpion riders stay seated to throw and let go of the grips to throw and reload, and a player turns with the aim while throwing, as while meleeing. `false`: the original animations, which freeze the legs during a throw and stand a rider up. Only in config.toml, not in the menus. |
+| `game.unlock_all_levels` | `false` | `HALO_UNLOCK_ALL_LEVELS` | `true`: a profile created afterward starts with all the campaign levels finished on all the difficulties. `false`: a new profile starts at The Pillar of Autumn, and each level opens when you finish the level before it, as on the Xbox. Existing profiles keep their progress. To start a profile over, type `profile_reset_campaign` in the console. |
+| `bots.count` | `0` | `HALO_BOTS` | Computer players (bots) in a local (split screen) Slayer game: `0` to `15` join its lobby with the players, as far as the game has room. Not in system link or internet games. `0`: none, as in the stock game. Refer to "Bots". |
+| `bots.skill` | `"normal"` | `HALO_BOT_SKILL` | How well the bots play: `"easy"`, `"normal"`, `"heroic"` or `"legendary"`: how soon they react, how far and how wide they see, how large their aim error is and how fast it settles, how fast they turn. |
+| `bots.teams` | `"even"` | `HALO_BOT_TEAMS` | In a team game: `"even"` puts the bots on both teams, evening them with the players; `"against"` puts them all on the team the players are not on. |
 | `paths.data` | `""` | `HALO_DATA_ROOT` | The data root. Refer to "Start the game". |
 | `paths.saves` | `""` | `HALO_SAVE_ROOT` | The save root. Refer to "Files and folders". |
 | `network.address` | `""` | `HALO_NET_ADDRESS` | The IPv4 address of this machine for system link. Refer to "Play on one computer". |
@@ -394,10 +479,13 @@ the setting for one start of the game. It has priority over the file.
 | `network.public_lobby` | `true` | `HALO_NET_PUBLIC_LOBBY` | `true`: the server browser. Public games are listed, and Join Game > Server Browser shows them. `false`: no games are listed or shown. Refer to "Server browser". |
 | `network.host_public` | `true` | `HALO_NET_HOST_PUBLIC` | `true`: a new game of Create Game > Internet starts as PUBLIC. `false`: it starts as PRIVATE. LISTING in Server Setup changes it for each game. Refer to "Server browser". |
 | `network.coop_friendly_fire` | `"on"` | `HALO_NET_COOP_FRIENDLY_FIRE` | Whether the players of an online co-op game hurt each other: `"off"`, `"on"`, `"shields_only"` or `"explosives_only"`. FRIENDLY FIRE in co-op's Server Setup > Co-op Options writes its choice here. Their AI allies they always can, as in the campaign. |
+| `network.coop_own_friendly_fire` | `true` | `HALO_NET_COOP_OWN_FRIENDLY_FIRE` | Whether this machine's players hurt, and are hurt by, the other players of an online co-op game. Two players hurt each other only if both have it `true`, and then as the host's `network.coop_friendly_fire` says. FRIENDLY FIRE in that game's pause menu writes its choice here. A player away from the controls for over 70 seconds is hurt by every player, whatever either chose. |
 | `network.coop_player_collisions` | `true` | `HALO_NET_COOP_PLAYER_COLLISIONS` | Whether the players of an online co-op game bump into each other. `false`: they walk through each other, so that one cannot block a doorway or stand on another; they still bump into the AI's characters. PLAYER COLLISIONS in co-op's Server Setup > Co-op Options writes its choice here. |
 | `network.coop_enemies_mode` | `"per_player"` | `HALO_NET_COOP_ENEMIES_MODE` | Online co-op's extra enemies: `"none"`; `"per_player"`, each squad of enemies that a level places grows by `network.coop_enemies` for each player past the first; or `"multiplier"`, each squad is `network.coop_enemies_multiplier` times as large, for any number of players. The extra enemies stand around the squad's places, and those that a dropship has no seats for drop out of it after its passengers. EXTRA ENEMIES in co-op's Server Setup > Co-op Options writes its choice here. |
 | `network.coop_enemies` | `50` | `HALO_NET_COOP_ENEMIES` | The extra enemies per player, a percentage from `25` to `200`: for each player past the first, each squad of enemies gets this much of itself more (`100`: as many again, so four players meet four times the squad), up to 8 times the squad however many players there are. PER PLAYER in co-op's Server Setup > Co-op Options writes its choice here. |
-| `network.coop_enemies_multiplier` | `2` | `HALO_NET_COOP_ENEMIES_MULTIPLIER` | The static multiplier of the enemies, `2` to `32`: each squad of enemies is this many times as large. MULTIPLIER in co-op's Server Setup > Co-op Options writes its choice here. |
+| `network.coop_pickups` | `"none"` | `HALO_NET_COOP_PICKUPS` | EXTRA PICKUPS in co-op Server Setup > Co-op Options. Modes: `"per_player"`, `"multiplier"`, `"none"`. Static mode uses the shared MULTIPLIER, capped at 8x. In per-player mode, the host scales scenario-placed campaign weapons, grenades, health kits, overshields and active camouflage by the shared PER PLAYER percentage, capped at 8 times their original count. Fractions are distributed over placements of the same item. Copies retain weapon ammunition and use clear nearby floor in the active BSP. No safe space or capacity means no extra pickup. Enemy drops, inventory and vehicles are excluded. Script-created supplies count surviving copies against their placement budget. Checkpoints retain pending counts and copies together, without multiplying again on restore. |
+| `network.coop_vehicles` | `"none"` | `HALO_NET_COOP_VEHICLES` | EXTRA VEHICLES after EXTRA PICKUPS in Co-op Options. Modes: `"per_player"`, `"multiplier"`, `"none"`. Each authored driveable vehicle supplies floor((players - 1) * Per Player * 2 / 300) extra copies in per-player mode, or floor((Multiplier - 1) * 2 / 3) extras in static mode, one at a time after a player drives the previous one clear of the home by the sum of both bounding-sphere radii plus 15%. Vehicle growth has an exact 2/3 modifier before rounding down; the default 50% requires four players for the first copy. Pelican cargo uses its unloaded resting position. Only the host spawns; obstructed pads and exhausted object capacity wait. Copies have no script name or AI passengers. In-memory checkpoint reverts restore the home table and budgets together; loading a disk/core checkpoint without that table forgets its old homes. None by default. |
+| `network.coop_enemies_multiplier` | `2` | `HALO_NET_COOP_ENEMIES_MULTIPLIER` | The shared static multiplier, `2` to `32`, for options set to STATIC MULTIPLIER. Enemy squads are this many times as large; pickups are capped at 8x; vehicles supply floor((Multiplier - 1) * 2 / 3) extra copies. MULTIPLIER in co-op's Server Setup > Co-op Options writes its choice here. |
 | `network.voice_lobby` | `true` | `HALO_NET_VOICE_LOBBY` | When you host: `true`, all players hear all players in the lobby, before and after a game. |
 | `network.voice_mode` | `"team_global_enemy_proximity"` | `HALO_NET_VOICE_MODE` | When you host: who hears whom during a game. `"off"`; `"team_proximity"` (teammates who are near); `"team_enemy_proximity"` (all players who are near); `"team_global"` (all teammates); `"team_global_enemy_proximity"` (all teammates, and enemies who are near). Refer to "Voice chat". |
 | `network.voice_kbps` | `24` | `HALO_NET_VOICE_KBPS` | When you host: the voice quality in the lobby and in a game, in kilobits per second, `8` to `64`. |
@@ -406,6 +494,7 @@ the setting for one start of the game. It has priority over the file.
 | `network.votekick` | `true` | `HALO_NET_VOTEKICK` | When you host: `true`, the players can vote to kick a player. Refer to "Security". `false`: no votes. VOTE KICK in Server Setup > Teamplay Options (in co-op, Voice and Voting) writes its choice here. |
 | `network.votekick_minutes` | `5` | `HALO_NET_VOTEKICK_MINUTES` | When you host: the minutes that a player must play on the server before the player can start a vote to kick (`0` to `60`). To vote, a player must play for 2 minutes, or for this time if it is less. |
 | `network.votekick_ban_minutes` | `30` | `HALO_NET_VOTEKICK_BAN_MINUTES` | When you host: the minutes that a player who is kicked by a vote cannot join again (`1` to `1440`). |
+| `network.block_mouse_aim_assist` | `false` | `HALO_NET_BLOCK_MOUSE_AIM_ASSIST` | Host: Player Options > Aim Assist, Allowed or Block M+KB. Block overrides optional mouse magnetism while mouse/keyboard aims, including on the host, without changing the saved preference. Controllers and touch retain their existing behavior; bullet autoaim is unchanged. |
 | `network.map_share` | `true` | `HALO_NET_MAP_SHARE` | When you host: send a player who joins without the game's Custom Edition map the map, and the resource maps that it needs and that the player does not have. SHARE MAPS in Server Setup > Map Sharing writes its choice here. Refer to "Map sharing". |
 | `network.map_share_upload` | `1024` | `HALO_NET_MAP_SHARE_UPLOAD` | When you host: the most kilobytes per second that the game sends of maps (`16` to `20480`, 20 MB/s). UPLOAD LIMIT in Server Setup > Map Sharing writes its choice here. |
 | `network.map_seed` | `true` | `HALO_NET_MAP_SEED` | When you play in the game of another machine: help send its map to players who join without it. HELP SEND MAPS in Settings > Network Setup > Map Sharing. |
@@ -422,14 +511,18 @@ the setting for one start of the game. It has priority over the file.
 | `streamer.insults` | `"off"` | `HALO_STREAMER_INSULTS` | With `streamer.enabled`, the insults that are not slurs hidden: `"off"`, `"severe"`, `"strong"` or `"mild"`. CENSOR INSULTS in Settings > Network Setup > Streamer Mode. |
 | `crash_reports.upload` | `"ask"` | `HALO_CRASH_REPORTS` | Windows only. `"yes"`: the game sends a report of each crash to the developers. `"no"`: the game sends no reports. `"ask"`: the game asks at the next crash and writes the answer here. Refer to "Crash reports" in [port/windows/README.md](../windows/README.md#crash-reports). |
 | `debug.update_answer` | `""` | `HALO_UPDATE_ANSWER` | The answer to the update question, for automatic tests: `yes`, `no` or `never`. Empty: the game asks. |
-| `debug.exit_after` | `0.0` | `HALO_EXIT_AFTER` | The game stops after this number of seconds. `0`: never. |
+| `debug.fixed_step` | `false` | `HALO_FIXED_STEP` | `true`: a game of this computer alone runs one tick a frame, whatever time has passed, so that it plays the same every time (tests). |
+| `debug.exit_after` | `0.0` | `HALO_EXIT_AFTER` | The game stops after this number of seconds (from when its window opens; with `debug.null_renderer`, or no display, from its first frame). `0`: never. |
 | `debug.screenshot_directory`, `debug.screenshot_every` | `""`, `0` | `HALO_SCREENSHOT_DIR`, `HALO_SCREENSHOT_EVERY` | The game writes each Nth frame to this folder as a BMP file. |
 | `debug.hidden_window`, `debug.null_renderer` | `false` | `HALO_HIDDEN_WINDOW`, `HALO_NULL_RENDERER` | `true`: no visible window, or no graphics. |
 | `debug.gpu_stats`, `debug.gpu_trace_frame`, `debug.gpu_trace_constants`, `debug.gpu_dump_shaders`, `debug.texture_dump_directory`, `debug.texture_log`, `debug.gl_debug`, `debug.texture_no_cache` | off | `HALO_GPU_STATS`, `HALO_GPU_TRACE`, `HALO_GPU_TRACE_CONSTANTS`, `HALO_GPU_DUMP_SHADERS`, `HALO_TEXTURE_DUMP`, `HALO_TEXTURE_LOG`, `HALO_GL_DEBUG`, `HALO_TEXTURE_NO_CACHE` | Tools to find problems in the graphics: counts for each frame, all the GL state of one frame, the GLSL code, the textures. |
 | `debug.menu_open` | `""` | `HALO_MENU_OPEN` | Start on this screen of the menus (`main_menu/settings_select/...`, as `port/assets/menus` names it), a player profile being edited, to look at it. |
 | `debug.gpu_skip_vertex_shaders`, `debug.gpu_debug_expression`, `debug.gpu_debug_flat`, `debug.gpu_debug_texture0` | off | `HALO_GPU_SKIP_VS`, `HALO_GPU_DEBUG_EXPR`, `HALO_GPU_DEBUG_FLAT`, `HALO_GPU_DEBUG_T0` | Tools to find problems in the graphics: skip the draws of a vertex shader, or replace the output of all pixel shaders with a GLSL expression (for example `t0.rgb`). |
-| `debug.network_test`, `debug.network_test_start`, `debug.network_test_kill`, `debug.network_test_score`, `debug.network_test_shoot`, `debug.network_test_vehicle`, `debug.network_test_pickup`, `debug.network_test_pickup_weapon`, `debug.network_test_chat`, `debug.network_test_name`, `debug.network_test_public`, `debug.test_input` | off | `HALO_NETWORK_TEST`, `HALO_NETWORK_TEST_START`, `HALO_NETWORK_TEST_KILL`, `HALO_NETWORK_TEST_SCORE`, `HALO_NETWORK_TEST_SHOOT`, `HALO_NETWORK_TEST_VEHICLE`, `HALO_NETWORK_TEST_PICKUP`, `HALO_NETWORK_TEST_PICKUP_WEAPON`, `HALO_NETWORK_TEST_CHAT`, `HALO_NETWORK_TEST_NAME`, `HALO_NETWORK_TEST_PUBLIC`, `HALO_TEST_INPUT` | Automatic tests of system link (`game/network_test.c`). Refer to `NETCODE.md`. |
+| `debug.network_test`, `debug.network_test_start`, `debug.network_test_kill`, `debug.network_test_score`, `debug.network_test_shoot`, `debug.network_test_vehicle`, `debug.network_test_pickup`, `debug.network_test_pickup_weapon`, `debug.network_test_chat`, `debug.network_test_name`, `debug.network_test_public`, `debug.test_input` | off | `HALO_NETWORK_TEST`, `HALO_NETWORK_TEST_START`, `HALO_NETWORK_TEST_KILL`, `HALO_NETWORK_TEST_SCORE`, `HALO_NETWORK_TEST_SHOOT`, `HALO_NETWORK_TEST_VEHICLE`, `HALO_NETWORK_TEST_PICKUP`, `HALO_NETWORK_TEST_PICKUP_WEAPON`, `HALO_NETWORK_TEST_CHAT`, `HALO_NETWORK_TEST_NAME`, `HALO_NETWORK_TEST_PUBLIC`, `HALO_TEST_INPUT` | Automatic tests of system link, or (`log`) a log of the game one machine plays (`game/network_test.c`). Refer to `NETCODE.md`. `debug.test_input = "menu:a down down a"` presses menu buttons one a second (`a`, `b`, `x`, `y`, `up`, `down`, `left`, `right`, `start`, `back` or `wait`), for testing the menus. |
+| `debug.network_test_cues`, `debug.network_test_cue_players` | none, `1` | `HALO_NETWORK_TEST_CUES`, `HALO_NETWORK_TEST_CUE_PLAYERS` | Console lines a test runs at their seconds, from the first tick that many players are in (`"<second> <line>\|..."`; not on the web). |
+| `debug.bot_trace` | `0` | `HALO_BOT_TRACE` | Every this many seconds, each bot's state is written to the log: where it is and where it goes, its path, its target and its weapon. `0`: never. |
 | `debug.touch_targets` | `false` | `HALO_TOUCH_TARGETS` | Outlines the tap targets of the menus (item green, value blue, list slot yellow, legend button red, the band beside the slots of a list orange, keys of the on-screen keyboard white), marks where the last finger went down and the last tap landed for 3 seconds, and logs each tap with the target that it hit (for a value, also where it splits into previous and next): to judge the accuracy of touch. |
+| `debug.log_addresses` | `false` | `HALO_LOG_ADDRESSES=1` sets `true` | `true`: other machines' internet addresses are written whole in `debug.txt` and the console, for debugging your own network. `false`: a public address is written as a tag (`addr#3f2a9c`) that matches up only within one run; local network addresses are always whole. Do not post a `debug.txt` written with this on. |
 | `debug.network_latency`, `debug.network_loss`, `debug.network_corrupt`, `debug.network_corrupt_stream`, `debug.network_corrupt_after` | `0` | `HALO_NETWORK_LATENCY`, `HALO_NETWORK_LOSS`, `HALO_NETWORK_CORRUPT`, `HALO_NETWORK_CORRUPT_STREAM`, `HALO_NETWORK_CORRUPT_AFTER` | The game holds all the data that it receives for this number of milliseconds, ignores this percentage of the datagrams, and damages this percentage of the datagrams it receives, and this percentage of its reads of streams, at random (bytes changed, cut short, stretched or replaced), from this many seconds after the start. Use the first two to test the netcode as on the internet, and the others to test that nothing another machine sends can crash the game (a damaged stream is closed, so a little goes a long way; a host's messages to its own client are damaged too, so start damaging once the game has started). |
 | `debug.voice_test` | `false` | `HALO_VOICE_TEST` | Automatic tests of voice chat: a tone replaces the microphone, and each voice that the game hears is written to the log once each second. |
 | `debug.telnet_console`, `debug.telnet_console_port` | `false`, `2323` | `HALO_TELNET_CONSOLE`, `HALO_TELNET_CONSOLE_PORT` | The game listens on 127.0.0.1, on this port, for a script console (connect with telnet). The console has no password, so only this computer can reach it. |
@@ -456,6 +549,11 @@ If the latest release is newer, the game asks: "Do you want to update?"
   writes `auto = false` in the `[update]` section of `config.toml`. To get
   the questions again, set `auto = true`.
 
+Under gamescope (the Game Mode of the Steam Deck), the game does not ask,
+because a system dialog stops the game there. The game writes the new
+version in the log. To update, start the game from the desktop, or set
+`update_answer = "yes"` in the `[debug]` section of `config.toml`.
+
 The game downloads through HTTPS. It examines the certificate of the server
 against the certificate authorities of the system: on Linux, the bundle of
 the distribution (`src/posix_update.c`, with Mbed TLS); on Windows, the
@@ -827,11 +925,23 @@ GAME joins only with the correct password. The invite link of the game joins
 it without the password. The host keeps the password only while the game
 runs.
 
-In the Server Browser, select a game to join it. The game joins the invite
-of the game, as for a link. When it reaches the host, it opens the lobby.
-If it cannot reach the host in 30 seconds, it marks the game FAILED. A game
-that is full or starting shows CLOSED. REFRESH asks the hosts for their
-listings again.
+In the Server Browser, as in Custom Edition's, a click selects a game
+(outlined in yellow), and a click on the selected game, a double click, A,
+Enter or JOIN joins it. The game joins the invite of the game, as for a
+link. When it reaches the host, it opens the lobby. If it cannot reach the
+host in 30 seconds, it marks the game FAILED; when this machine's NAT gives
+each destination its own port and no router forwards
+`network.tunnel_port`, the line below the games says so (turn on UPnP on
+the router, or forward the port: refer to "Connection").
+
+The PING column shows the round trip to each host in milliseconds. The
+browser times it as a join would reach the host: it makes the tunnel with
+the listing's invite, keeps the shortest of three pings, and closes the
+tunnel again. It times a few hosts at once, each again every two minutes
+and on REFRESH. Joining a host whose tunnel is open uses that tunnel. A
+game with a password, whose invite the listing hides, shows no ping, nor
+does a host not reached; a game that is full or starting shows CLOSED.
+REFRESH also asks the hosts for their listings again.
 
 How it operates (`src/p2p_lobby.c`):
 
@@ -870,8 +980,9 @@ as for any public server.
 The brokers are in `brokers.txt` next to the executable (from
 `port/assets/network/brokers.txt`; on Android, the app writes it next to
 `config.toml` at each start), one `host:port` on each line. The game uses
-all of them at once (up to 4), so one that works is enough. An update
-replaces `brokers.txt`: to use brokers of your own, put them in another
+all of them at once (up to 4), so one that works is enough. Without the
+file (a game run from somewhere the builds did not put it), the game uses
+its own copy of the list. An update replaces `brokers.txt`: to use brokers of your own, put them in another
 file and name it in `network.brokers_file`. All the players must use the
 same broker to see each other's games. The game uses
 MQTT 5 if the broker has it, else MQTT 3.1.1. A broker that does not keep
@@ -1216,7 +1327,8 @@ crafted file) is refused, and the level starts over.
 | High-res HUD | The HUD is drawn from high-res assets: redraws at 8x the size of the maps' bitmaps (4x for the largest), in `port/assets/hud`. They cover the meters, counters, panels and their outlines, the motion sensor, reticles, waypoints and scopes, but no bitmap with English text. `tools/hud_assets.py` makes them from the SVG redraws (the weapons' reticles from those of the PC HUD sheet that match the Xbox's exactly, the sniper rifle's 2x and 10x set in Overpass), and the build embeds them in the executable. When the game uploads one of those bitmaps, `src/hud_hires.c` gives the high-res texture in its place, if the bitmap's pixels are those of the English maps: another language's maps keep their own. The game sizes and places the HUD from its tags as before. `display.high_res_hud = false` turns this off. |
 | High-res text | The menus' and HUD's text is drawn with Overpass (`port/assets/fonts`, SIL Open Font License) in place of the maps' bitmap fonts, which are Interstate. `src/text_hires.c` rasterizes each glyph with stb_truetype (`port/third_party/stb`) at the resolution the game draws at, into an atlas that a placeholder bitmap of the game stands for. The game lays the text out from its font tags as before: each font is as tall as its tag's capitals, and narrowed where the tag's letters are narrower than the Xbox maps' (the fonts of a Custom Edition `loc.map`), so that its letters do not run into each other. The menus' titles (the screens' headers and the main menu's items) are pictures of text in the maps, so they are drawn as the high-res HUD is: `tools/title_assets.py` sets each one again in OpenCE, Roger White's public-domain Newtown respaced to match the maps' commercial title typeface (`tools/title_font.py`), at 4x the bitmap's size over its own plate or glow, each letter placed where the map's letter is, in `port/assets/titles`. The postgame carnage report's title is set over a hand-made SVG redraw of its panel (`port/assets/titles/svg`) instead. The A, B, X and Y button icons beside the menus' key labels and in their text ("Press A to Join") are drawn from hand-made SVG redraws at 8x the size of the maps' bitmaps (`port/assets/buttons`, made by `tools/button_assets.py`), in the same sizes and places. `display.high_res_text = false` turns it off. |
 | Anti-aliasing | Off unless `display.anti_aliasing` is set (`src/d3d8_gl.c`, `src/xgpu_post.c`). FXAA (written in the port) and SMAA (`port/third_party/smaa`, MIT licensed, at its HIGH preset, compiled as GLSL) are passes over the 3D view of each window, after the lens flares and before the HUD and the menus (`render/render.c`). Their programs are built when the setting is chosen. Supersampling draws the render targets the size of the screen at two times the resolution in each direction, and the display blit scales them down. Multisampling draws the back buffer and its depth buffer into multisampled renderbuffers, and with them any target that is drawn together with one of them (a mirror's view, in the secondary target with the back buffer's depth buffer), so that the attachments of a framebuffer are all multisampled or none is. A target's pixels are resolved into its texture before something reads the texture (as a texture, or at the display blit). Visibility tests count samples, divided by the samples of a pixel. An alpha-tested surface (foliage, grates) covers the samples of a pixel in proportion to its alpha past the reference (`gl_SampleMask`, not on Android). |
-| Sound | Xbox DirectSound on SDL3 audio (`src/dsound_sdl.c`): PCM and Xbox ADPCM, mixed at 48 kHz, with volume, pitch, mix bins, distance, stereo pan, occlusion and obstruction. There is no Doppler effect, no cones and no reverb. |
+| HDR | Off unless `display.hdr` is set (`src/d3d8_gl.c`, `src/xgpu_post.c`). The back buffer's texture, and its multisampled renderbuffer, is `GL_RGBA16F` (`GL_HALF_FLOAT` on Android), with the same `GL_DEPTH24_STENCIL8` depth buffer. The game's pixel shaders give colours from 0 to 1, as the NV2A's register combiners did, so the light past white comes from blending, which a floating-point target does not clamp. The tone mapping pass is a pass over the 3D view of each window, before the anti-aliasing (`render/render.c`): it takes each pixel from gamma 2.2 to linear light, multiplies it by `display.hdr_exposure`, applies the curve, and returns to gamma 2.2. It writes the colour only, since the game keeps its own data in the alpha. The display blit becomes a draw that clamps to 1, or, in a floating-point window, gives scRGB (linear light, 1 at the display's SDR white, which SDL reports with the headroom). The settings are read between frames; a change of `display.hdr` makes the back buffer again in the other format. |
+| Sound | Xbox DirectSound on SDL3 audio (`src/dsound_sdl.c`): PCM and Xbox ADPCM, mixed at 48 kHz in stereo or 5.1, with volume, pitch, mix bins, distance, pan, occlusion and obstruction. There is no Doppler effect and no cones. On 5.1 the game gets the AC-3 speaker setting of the Xbox and sends its 2D sounds to the center and back speakers, 3D sounds pan across the five speakers, and the reverb plays from the front and back pairs. The game sends nothing to the LFE channel. |
 | Input | XInput on SDL3 (`src/xinput_sdl.c`): keyboard, mouse, gamepads with rumble, and the debug keyboard for the console. |
 | Files | The Win32 file functions and the MSVC file functions on POSIX, with the translation of Xbox paths. |
 | Threads | Threads, events, mutexes, critical sections, interlocked operations and alertable waits. |
@@ -1307,7 +1419,8 @@ Other changes:
 | `rasterizer/xbox/rasterizer_xbox_environment_fog.c` | A local pointer gets its value from the file-scope array with the same name. |
 | `game/player_control.c` | The mouse aims the player on controller 1 directly. |
 | `sound/game_sound.c` | The game calculates the obstruction of each sound one time for each tick, not for each frame. |
-| `cseries/errors.c` | `debug.txt` stays open between lines. |
+| `sound/sound_manager.c` | A track of a looping sound that is gone stops, even in the millisecond it started (`refresh_sound`). The Xbox never drew three frames in one millisecond; the port can (the null renderer, no frame limit), and then read the deleted looping sound and crashed. |
+| `cseries/errors.c` | `debug.txt` stays open between lines. A line that is the same as the line before it is counted, not written again (`last line repeated N times`). At 64 MB, `debug.txt` becomes `debug.old.txt` and a new `debug.txt` starts. |
 | `networking/`, `game/`, `interface/`, `bungie_net/network/` and the pools of objects, effects and sounds | The system link limits and the memory for them. |
 | `game/`, `objects/`, `units/`, `networking/` | The distributed netcode. Refer to `NETCODE.md`. |
 | `cache/cache_files.c` | When a map's tags load and unload, the port finds the bitmaps that the high-res HUD replaces (`game/hud_hires_tags.c`), adds the tags of the menus to the menus' map (`game/menu_tags.c`), and plays the mods' tags (`game/mods.c`). |
@@ -1315,17 +1428,22 @@ Other changes:
 | `hs/hs.c` | The console's `mods_reload`, `mods_enable` and `mods_list`, which a client may run too. |
 | `interface/ui_widget.c`, `interface/ui_widget_event_handler_functions.c`, `interface/ui_widget_game_data_input_functions.c` | The main menu is the PC version's from `port/assets/menus` (`display.menus`); the menus' widgets can call the port's functions (`game/menu_functions.c`) and send the PC version's custom activation event; the widgets' memory is 256 KB, not 16 KB; the main menu and Multiplayer clear co-op's controllers, so that a gamepad going back to controller 1 is not a controller unplugged; the lobby's split screen players leave alone, and one who quits in game is not joined to the next game (`interface/player_ui.c`). |
 | `interface/player_ui.c` | Fast setup opens the pregame screen through the port's menus (the lobby), as `interface/ui_widget.c` does. |
+| `game/game_time.c`, `main/main.c` | With `debug.fixed_step`, a game of one machine runs a tick a frame, each frame taking a tick's time, so that it plays the same every time (`tools/stagekit`). |
 | `input/input_abstraction.c`, `game/player_control.c`, `game/players.c`, `game/player_queues_new.c`, `units/units.h` | The keyboard and mouse's actions (`src/xinput_sdl.c`, `include/halo_keyboard.h`) join controller 1's game controls; their reload key reloads on its own, and their action key only acts (a control flag of the port's, sent with the player's action, stops the reload the controller's X falls back to). |
+| `saved games/player_profile.h`, `interface/player_ui.c` | A sixth button layout, the Master Chief Collection's Bumper Jumper (`profile.button_preset` 5). A layout the build does not know (a later build's) gets the standard buttons, not none, which moved start and back and stopped the game. |
 | `sound/sound_manager.c`, `interface/hud.c`, `game/game_engine.c` | The music's and the other sounds' volumes; the HUD's and the scoreboard's settings are read again when Settings changes them. |
 | `rasterizer/xbox/rasterizer_xbox_shadows.c` | With larger shadow maps (`display.shadow_resolution`), the blur's taps stay half a texel apart, and more passes widen it to cover the same part of the map as on the Xbox. |
 | `rasterizer/rasterizer.c` | The 128 KB of vertices of the debug display of a model's vertices are static, not on the stack: the compiler inlines the function in `render_model`, and the Windows build probed the stack a page at a time for every model drawn. |
-| `render/render.c` | The 3D view of each window is antialiased before the HUD is drawn (`display.anti_aliasing`). |
+| `render/render.c` | The 3D view of each window is tone mapped (`display.hdr`) and antialiased (`display.anti_aliasing`) before the HUD is drawn. |
+| `render/render.c` | `render_initialize` reads the structure culling tests from `display.structure_culling`. |
+| `models/models.c` | A model's size, which chooses its level of detail and whether it is drawn, is scaled as `display.model_detail` says (`halo_model_detail_scale`, `src/d3d8_gl.c`), and each permutation draws the level `game/model_detail.c` chooses from the model's (stock: the model's). |
 | `interface/hud.c` | In multiplayer, players' names are drawn above their heads (`display.player_names`, `display.player_name_scale`). |
 | `text/draw_string.c`, `interface/terminal.c`, `interface/virtual_keyboard.c` | Streamer mode's words are hidden in every string drawn or measured (`game/text_filter.c`), but in the console's line and the virtual keyboard's text being typed. |
 | `rasterizer/rasterizer_text.c`, `text/draw_string.c` | Text is drawn from an atlas of the fonts' glyphs, rasterized at the resolution the game draws at (`src/text_hires.c`), when the font has every character of the string. Text can be drawn scaled about a point (`rasterizer_text_set_scale`), as the players' names are. Each glyph's advance is centred on the font tag character's, so the layout is the same, and a glyph is cut at a text box only where the font tag's character visibly was. |
 | `interface/first_person_weapons.c` | The first-person hands are drawn with the unit's shield modifier shader, as its body is (`display.viewmodel_shield`). |
 | `render/render_objects.c`, `objects/objects.c` | In first person, your own body is drawn from the waist down with the pose `first_person_legs.c` makes (`display.first_person_legs`); the waist it found and the mesh `object_mesh.c` read are forgotten on a new map. |
 | `objects/object_lights.c` | Glows the port lights itself (`shield_glow.c`): dynamic lights attached to an object's node, colored and sized each frame by their maker, drawn with a light definition the map has. |
+| `render/render_objects.c`, `interface/first_person_weapons.c`, `rasterizer/xbox/rasterizer_xbox_plasma_energy.c`, `items/projectiles.c` | An overshield as `overshield_effect.c` draws it (`display.overshield_effect`): in its own color, its intensity full, its energy slower, faded above the height it has risen to; a hit on it plays the projectile's effect for an Elite's energy shield in place of its own (only the effect: the projectile's response is its own). |
 | `render/render_objects.c`, `interface/first_person_weapons.c`, `rasterizer/xbox/rasterizer_xbox_plasma_energy.c` | A local player's shield plasma is drawn in the chosen armor color (`display.shield_color`, `shield_color.c`), on the body and on the first-person arms. |
 | `rasterizer/xbox/rasterizer_xbox_text.c`, `rasterizer/rasterizer_text.c` | The characters of a string are one draw, not a draw each (and a second for the drop shadow). The batch is drawn early before a character is cached and before the high-res glyph atlas starts over (`src/text_hires.c`). |
 | `rasterizer/xbox/rasterizer_xbox_decals.c` | Decals drawn one after another with the same blend function and bitmap are one draw, with each decal's color in its vertices, not a draw each: a long fight leaves hundreds in view. Within a run of decals whose blend functions commute (multiply, add, min, max, reverse subtract), they are drawn by bitmap, so more of them share a draw. |
@@ -1335,6 +1453,7 @@ Other changes:
 | `cache/cache_files.c`, `networking/network_client_manager.c`, `networking/network_server_manager.c`, `networking/network_server_message_handler.c`, `main/main.c`, `interface/interface.c` | Map sharing (`game/map_share.c`): a client that does not have the game's Custom Edition map asks the host for it instead of leaving, is not given time to precache it until it has it, and adds its players to a game in progress only then; the host gives the game's map its own name and its version (its hash's start), takes the requests from any machine in the game, lobby too, and does not drop a machine that downloads; the transfers run each frame, and their progress is drawn over the screen. |
 | `cutscene/cinematics.c` | A scenario's titles (some Custom Edition maps show their name for the whole game) are not drawn over a menu, as the letterbox is not: the screen's overlays are drawn after the players' menus. |
 | `tag_files/tag_groups.h` | `TAG_BLOCK_GET_ELEMENT` returns an element in the block without a call, and calls `tag_block_get_element_with_size` for anything else. |
+| `game/players.c`, `networking/network_server_manager.c` | Bots (`game/bots.c`, `bots.count`): the lobby of a local Slayer game takes the bot players, each the one player of a machine of its own that no real machine is, and every tick their actions come from `game/bots.c` instead of their empty queues. Nothing changes in a system link or internet game. |
 | `input/input_xbox.c`, `physics/collision_usage.c` | The clock is read only for a button held, and for collision tests only when their times are shown: a read of the clock is slow in a browser. |
 | `main/main.c`, `interface/hud.c`, `interface/hud_unit.c`, `interface/hud_draw.c`, `game/game_engine.c` | The text chat of network games (`game/network_chat.c`): its keys are read each frame, and the debug keys are not while a line is typed; each view's HUD draws its lines, above the motion sensor, whose place the HUD notes (the left of the last picture drawn); the scoreboard's menu has Mute voice and chat, and the host's Mute for everyone. |
 

port/linux/game/bots.h

@@ -0,0 +1,49 @@
+/* bots.h: computer players for local multiplayer games (port/linux/game/bots.c)
+
+A bot is a player of a local (split screen) game whose controls come from
+code instead of a controller: it is in the lobby, the scores and the game's
+rules as any player is, spawns, respawns and scores. Each bot is the one
+player of a machine of its own at the top of the machine indices
+(BOTS_FIRST_MACHINE up), which no real machine takes: a split screen game has
+only its own machine. The bots have no view and no controller: nothing is
+drawn for them. */
+#ifndef HALO_BOTS_H
+#define HALO_BOTS_H
+
+struct player_action;
+struct network_player;
+
+/* the most bots in one game (with one player, the Xbox's 16) */
+#define BOTS_MAXIMUM 15
+/* the first bot's machine index (the last machine indices of the session) */
+#define BOTS_FIRST_MACHINE (HALO_PORT_MAXIMUM_NETWORK_MACHINES - BOTS_MAXIMUM)
+
+enum
+{
+	/* bots.teams: in a team game, the bots on both teams (evening them
+	with the players), or all on the team the players are not on */
+	_bots_teams_even = 0,
+	_bots_teams_against,
+};
+
+/* the settings (bots.count, bots.skill, bots.teams) */
+long bots_wanted_count(void);
+short bots_skill(void);
+short bots_teams(void);
+
+/* a machine is a bot's */
+int bots_machine_is_bot(long machine_index);
+/* the network player for bot number `bot_index` (0 up): its machine,
+controller, name and no team or colour yet */
+void bots_network_player(long bot_index, struct network_player *player);
+
+/* the game tick (players_update_before_game): every bot's controls this
+tick, into the actions of the players by their index; nothing outside a
+local game */
+void bots_update_actions(struct player_action *actions);
+
+/* a map's start and end (players.c) */
+void bots_initialize_for_new_map(void);
+void bots_dispose_from_old_map(void);
+
+#endif

port/linux/game/cache_file_formats.c

@@ -14,11 +14,11 @@ Sources for the layouts, cited per structure below:
 - BlamLib, in the same archive: the font and unicode string list layouts.
 - Reclaimer (GPL-3.0, Gravemind2401; the Reclaimer-master archive): how
   bitmap tags and pixel data are found in bitmaps.map.
-No code from either project is used: they are documentation here, and this
-repository is CC0. Facts that neither source states were established by
-reading the sample Custom Edition maps; the comments below say so where they
-are used ("observed", "every map examined"), and
-docs/custom_edition_caches.md lists each with its evidence.
+No code from either project is used: they are documentation here. Facts
+that neither source states were established by reading the sample Custom
+Edition maps; the comments below say so where they are used ("observed",
+"every map examined"), and docs/custom_edition_caches.md lists each with its
+evidence.
 */
 
 /* ---------- headers */

port/linux/game/coop_pickups.c

@@ -0,0 +1,329 @@
+/*
+COOP_PICKUPS.C
+
+Server Setup's EXTRA PICKUPS (network.coop_pickups): weapons, grenades,
+health kits, overshields and camouflage placed by the campaign, grown by PER PLAYER
+(network.coop_enemies) or STATIC MULTIPLIER (network.coop_enemies_multiplier),
+to at most eight times their number. Fractions
+are distributed over placements of the same definition, rather than
+rounding every loose grenade up. Enemies' drops and inventory are not
+scenario placements and never enter here.
+
+Only the host creates copies. A source's remaining count is kept in its
+item flags, alongside a placement identity and a copy marker, in the existing
+checkpoint image: no allocation or datum size changes. A revert restores
+them together; scripted recreation counts surviving copies against the budget.
+Copies are made once the source is connected to the current BSP, with
+ground, a clear bounding sphere and no wall between them and the source.
+No safe position means no copy; the level's originals are never moved.
+*/
+
+#include "cseries.h"
+#include "game/game.h"
+#include "items/equipment.h"
+#include "items/equipment_definitions.h"
+#include "items/items.h"
+#include "items/weapons.h"
+#include "networking/network_game_globals.h"
+#include "networking/network_game_manager.h"
+#include "objects/objects.h"
+#include "physics/collision_models.h"
+#include "physics/collisions.h"
+#include "scenario/scenario.h"
+#include "scenario/scenario_definitions.h"
+#include "coop_pickups.h"
+#include "coop_scaling.h"
+#include "network_coop.h"
+
+#include <math.h>
+
+char const *config_string(char const *name);
+long config_integer(char const *name);
+/* collisions.c's: TRUE outside the BSP or when the sphere touches it */
+boolean collision_test_sphere(real_point3d const *center, real radius, long ignore_object_index);
+
+enum
+{
+	/* items.h uses bits 0..6. These three bits store 0..7 extras and are
+	cleared before creating them; ordinary copies keep zero here. */
+	PICKUPS_COUNT_SHIFT = 7,
+	PICKUPS_COUNT_MASK = 7 << PICKUPS_COUNT_SHIFT,
+	/* Saved provenance for scripted recreation: bit 10 marks copies,
+	bits 11..25 identify the scenario placement (1..SHORT_MAX). */
+	PICKUPS_COPY_FLAG = 1 << 10,
+	PICKUPS_ID_SHIFT = 11,
+	PICKUPS_ID_MASK = 0x7fff << PICKUPS_ID_SHIFT,
+	PICKUPS_SOURCES_PER_TICK = 8,
+	PICKUPS_RINGS = 5,
+	PICKUPS_PLACES_PER_RING = 12,
+};
+
+#define PICKUPS_COLLISION_FLAGS (FLAG(_collision_test_structure_bit) | FLAG(_collision_test_objects_bit) | \
+	_collision_test_objects_sight_blocking_flags | FLAG(_collision_test_front_facing_surfaces_bit) | \
+	FLAG(_collision_test_back_facing_surfaces_bit))
+
+static boolean pickups_enabled;
+static short pickups_percent;
+static short pickups_multiplier;
+
+static boolean pickups_host(void)
+{
+	return pickups_enabled && game_connection() == _game_connection_network_server && network_coop_active();
+}
+
+/* Incremental rounding gives a group of N placements exactly
+round(N * growth / 100) extras, up to 7*N. */
+static short pickups_extra_count(long ordinal, short players, short percent, short multiplier)
+{
+	long growth;
+
+	if (ordinal < 1 || ordinal > SHORT_MAX)
+		return 0;
+	growth = multiplier > 0 ? (MIN(multiplier, COOP_SCALING_MAXIMUM_GROWTH) - 1) * 100 :
+		coop_scaling_growth(players, percent);
+	return (short)((ordinal * growth + 50) / 100 - ((ordinal - 1) * growth + 50) / 100);
+}
+
+static short pickups_player_count(void)
+{
+	struct network_game *game = network_game_get_game();
+	short index, count = 0;
+
+	for (index = 0; game && index < HALO_PORT_MAXIMUM_NETWORK_PLAYERS; index++)
+		if (network_player_is_valid(&game->players[index]))
+			count++;
+	return count;
+}
+
+static boolean pickups_definition_allowed(long definition_index)
+{
+	struct object_definition *definition = object_definition_get(definition_index);
+
+	if (definition->object.type == _object_type_weapon)
+		return TRUE;
+	if (definition->object.type == _object_type_equipment)
+	{
+		short type = equipment_definition_get(definition_index)->equipment.powerup_type;
+
+		return type == _equipment_powerup_grenade || type == _equipment_powerup_overshield ||
+			type == _equipment_powerup_active_camouflage || type == _equipment_powerup_health;
+	}
+	return FALSE;
+}
+
+/* Placement identity is the address in the scenario block, not a position
+that two items might share. Only earlier placements of this same tag
+contribute to fractional rounding. */
+static long pickups_ordinal(struct item_datum const *item, struct scenario_object_datum const *source,
+	struct tag_block *palette, long *identity)
+{
+	long element_size, index, ordinal = 0;
+	struct tag_block *placements = scenario_get_object_type_scenario_datums(global_scenario_get(),
+		item->object.type, &element_size);
+
+	for (index = 0; index < MIN(placements->count, SHORT_MAX); index++)
+	{
+		struct scenario_object_datum *entry = tag_block_get_element_with_size(placements, index, element_size);
+
+		if (VALID_INDEX(entry->palette_entry_index, palette->count) &&
+			TAG_BLOCK_GET_ELEMENT(palette, entry->palette_entry_index, struct scenario_object_palette_entry)->reference.index ==
+			item->definition_index)
+			ordinal++;
+		if (entry == source)
+		{
+			*identity = index + 1;
+			return ordinal;
+		}
+	}
+	return 0;
+}
+
+/* A script may recreate a named supply. Surviving copies (even in an
+inventory) count against that placement's budget, rather than producing
+another complete set. Identity and provenance travel in saved item flags. */
+static short pickups_existing_copies(long definition_index, unsigned long identity)
+{
+	struct object_iterator iterator;
+	struct item_datum *item;
+	short count = 0;
+
+	object_iterator_new(&iterator, _object_mask_weapon | _object_mask_equipment, 0);
+	while ((item = object_iterator_next(&iterator)) != NULL)
+		if (item->definition_index == definition_index && (item->item.flags & PICKUPS_COPY_FLAG) &&
+			(item->item.flags & PICKUPS_ID_MASK) == identity && ++count >= COOP_SCALING_MAXIMUM_GROWTH - 1)
+			break;
+	return count;
+}
+
+/* Bounding spheres keep pickups apart. For large scenery bounds, test
+the collision mesh as well so a room-sized crate group does not exclude
+all otherwise free floor. */
+static boolean pickups_occupied(real_point3d const *center, real radius, long source_index)
+{
+	struct location location;
+	long indices[64];
+	short count, index;
+
+	scenario_location_from_point(&location, center);
+	if (location.leaf_index == NONE || location.cluster_index == NONE)
+		return TRUE;
+	count = objects_in_sphere(0, _object_mask_all & ~_object_mask_projectile, &location, center,
+		radius + 0.04f, indices, NUMBEROF(indices));
+	if (count == NUMBEROF(indices))
+		return TRUE;
+	for (index = 0; index < count; index++)
+	{
+		struct object_datum *object = object_get(indices[index]);
+		real dx = object->object.bounding_sphere_center.x - center->x;
+		real dy = object->object.bounding_sphere_center.y - center->y;
+		real dz = object->object.bounding_sphere_center.z - center->z;
+		real clearance = radius + object->object.bounding_sphere_radius + 0.04f;
+
+		if (object->object.parent_object_index != NONE || dx*dx + dy*dy + dz*dz >= clearance*clearance)
+			continue;
+		if (indices[index] != source_index && TEST_FLAG(_object_mask_sightblocking | _object_mask_device,
+			object->object.type))
+		{
+			struct collision_model_instance instance;
+
+			if (collision_model_instance_new(&instance, indices[index]) &&
+				!collision_model_test_sphere(&instance, center, radius + 0.04f))
+				continue;
+		}
+		return TRUE;
+	}
+	return FALSE;
+}
+
+static boolean pickups_position(long source_index, real_point3d const *origin, real radius,
+	long attempt, real_point3d *center)
+{
+	short ring = (short)(attempt / PICKUPS_PLACES_PER_RING);
+	short place = (short)(attempt % PICKUPS_PLACES_PER_RING);
+	real angle = ((real)place + 0.5f * (ring % 2)) * (_pi * 2.0f / PICKUPS_PLACES_PER_RING);
+	real distance = (2.0f * radius + 0.15f) * (ring + 1);
+	real_point3d from = *origin;
+	real_point3d above;
+	real_vector3d down = {0.0f, 0.0f, -2.0f};
+	real_vector3d way;
+	struct collision_result collision;
+
+	from.z += 0.75f;
+	above = from;
+	above.x += cosf(angle) * distance;
+	above.y += sinf(angle) * distance;
+	vector_from_points3d(&from, &above, &way);
+	if (collision_test_vector(PICKUPS_COLLISION_FLAGS, &from, &way, source_index, &collision) ||
+		!collision_test_vector(PICKUPS_COLLISION_FLAGS, &above, &down, source_index, &collision) ||
+		collision.plane.n.k < 0.7f)
+		return FALSE;
+	*center = collision.point;
+	center->z += radius + 0.04f;
+	if (fabsf(center->z - origin->z) > 0.75f || collision_test_sphere(center, radius + 0.02f, source_index) ||
+		pickups_occupied(center, radius, source_index))
+		return FALSE;
+	vector_from_points3d(origin, center, &way);
+	return !collision_test_vector(PICKUPS_COLLISION_FLAGS, origin, &way, source_index, &collision);
+}
+
+static void pickups_place(long source_index)
+{
+	struct item_datum *source = item_get(source_index);
+	struct object_placement_data placement;
+	struct weapon_magazine magazines[2];
+	real_point3d origin = source->object.bounding_sphere_center;
+	real_vector3d offset;
+	real radius = source->object.bounding_sphere_radius;
+	short remaining = (short)((source->item.flags & PICKUPS_COUNT_MASK) >> PICKUPS_COUNT_SHIFT);
+	short type = source->object.type;
+	unsigned long identity = source->item.flags & PICKUPS_ID_MASK;
+	long item_flags = source->item.flags & (FLAG(_item_does_not_accelerate_bit) | FLAG(_equipment_orient_to_ground_bit));
+	long object_flags = source->object.flags & (FLAG(_object_cannot_be_garbage_bit) | FLAG(_object_shadowless_bit));
+	long attempt;
+
+	/* Clear first, including invalid/no-space cases. This saved source can
+	never amplify itself again; copies have no pending count. */
+	source->item.flags &= ~PICKUPS_COUNT_MASK;
+	remaining = (short)MAX(0, remaining - pickups_existing_copies(source->definition_index, identity));
+	if (!remaining || !(radius > 0.0f && radius < 2.0f) || source->object.parent_object_index != NONE)
+		return;
+	vector_from_points3d(&source->object.position, &origin, &offset);
+	object_placement_data_new(&placement, source->definition_index, NONE);
+	placement.forward = source->object.forward;
+	placement.up = source->object.up;
+	placement.variant_number = source->object.forced_shader_permutation_index;
+	csmemcpy(placement.change_colors, source->object.base_change_colors, sizeof(placement.change_colors));
+	if (type == _object_type_weapon)
+		csmemcpy(magazines, weapon_get(source_index)->weapon.magazines, sizeof(magazines));
+	for (attempt = 0; remaining > 0 && attempt < PICKUPS_RINGS * PICKUPS_PLACES_PER_RING; attempt++)
+	{
+		real_point3d center;
+		long copy_index;
+		struct item_datum *copy;
+
+		/* Leave room for the campaign's actors and scripted objects. */
+		if (object_header_data->actual_count >= MAXIMUM_OBJECTS_PER_MAP - 512)
+			break;
+		if (!pickups_position(source_index, &origin, radius, attempt, &center))
+			continue;
+		placement.position.x = center.x - offset.i;
+		placement.position.y = center.y - offset.j;
+		placement.position.z = center.z - offset.k;
+		copy_index = object_new(&placement);
+		if (copy_index == NONE)
+			break;
+		copy = item_get(copy_index);
+		copy->item.flags |= item_flags | identity | PICKUPS_COPY_FLAG;
+		copy->object.flags |= object_flags;
+		if (type == _object_type_weapon)
+			csmemcpy(weapon_get(copy_index)->weapon.magazines, magazines, sizeof(magazines));
+		remaining--;
+	}
+}
+
+void coop_pickups_new_game(void)
+{
+	char const *mode = config_string("network.coop_pickups");
+
+	pickups_enabled = !strcmp(mode, "per_player") || !strcmp(mode, "multiplier");
+	pickups_percent = (short)PIN(config_integer("network.coop_enemies"), 25, 200);
+	pickups_multiplier = !strcmp(mode, "multiplier") ?
+		(short)PIN(config_integer("network.coop_enemies_multiplier"), 2, 32) : 0;
+}
+
+void coop_pickups_register(long object_index, struct scenario_object_datum const *source, struct tag_block *palette)
+{
+	struct item_datum *item;
+	short extra;
+	long identity = 0;
+
+	if (!pickups_host())
+		return;
+	item = item_try_and_get(object_index);
+	if (!item || !pickups_definition_allowed(item->definition_index))
+		return;
+	extra = pickups_extra_count(pickups_ordinal(item, source, palette, &identity), pickups_player_count(),
+		pickups_percent, pickups_multiplier);
+	item->item.flags = (item->item.flags & ~(PICKUPS_COUNT_MASK | PICKUPS_ID_MASK | PICKUPS_COPY_FLAG)) |
+		((unsigned long)extra << PICKUPS_COUNT_SHIFT) | ((unsigned long)identity << PICKUPS_ID_SHIFT);
+}
+
+/* After the host's tick, outside object iteration/physics: object_new may
+compact the object pool. Gather indices before allocating any copies. */
+void coop_pickups_update(void)
+{
+	struct object_iterator iterator;
+	struct item_datum *item;
+	long indices[PICKUPS_SOURCES_PER_TICK];
+	short count = 0, index;
+
+	if (!pickups_host())
+		return;
+	object_iterator_new(&iterator, _object_mask_weapon | _object_mask_equipment, 0);
+	while ((item = object_iterator_next(&iterator)) != NULL && count < NUMBEROF(indices))
+		if ((item->item.flags & PICKUPS_COUNT_MASK) && TEST_FLAG(item->object.flags, _object_connected_to_map_bit) &&
+			!TEST_FLAG(item->object.flags, _object_outside_of_map_bit))
+			indices[count++] = iterator.index;
+	for (index = 0; index < count; index++)
+		pickups_place(indices[index]);
+}

port/linux/game/coop_pickups.h

@@ -0,0 +1,16 @@
+/*
+COOP_PICKUPS.H
+
+The co-op host's extra campaign pickups (coop_pickups.c).
+*/
+#ifndef __COOP_PICKUPS_H
+#define __COOP_PICKUPS_H
+
+struct scenario_object_datum;
+struct tag_block;
+
+void coop_pickups_new_game(void);
+void coop_pickups_register(long object_index, struct scenario_object_datum const *source, struct tag_block *palette);
+void coop_pickups_update(void);
+
+#endif

port/linux/game/coop_scaling.h

@@ -0,0 +1,16 @@
+/* Shared per-player growth; the first player never adds growth. */
+#ifndef __COOP_SCALING_H
+#define __COOP_SCALING_H
+
+enum { COOP_SCALING_MAXIMUM_GROWTH = 8 };
+
+static inline long coop_scaling_growth(short players, short percent)
+{
+	if (players <= 1 || percent <= 0)
+		return 0;
+	return MIN((long)MIN(percent, 200) *
+		(MIN(players, HALO_PORT_MAXIMUM_NETWORK_PLAYERS) - 1),
+		(COOP_SCALING_MAXIMUM_GROWTH - 1) * 100);
+}
+
+#endif

port/linux/game/coop_vehicles.c

@@ -0,0 +1,338 @@
+/*
+COOP_VEHICLES.C
+
+EXTRA VEHICLES: one replacement at the cleared starting place whenever a
+player clears the previous vehicle from the home, with a 15 percent buffer. Each authored placement
+has its own floor-rounded PER PLAYER budget or STATIC MULTIPLIER total;
+copies never register as new
+sources. Pelican cargo is anchored only after detaching and coming to rest.
+
+The host alone makes ordinary networked objects. Keep full salted handles,
+never datum pointers across object_new (which can compact the object pool).
+The small home table follows in-memory campaign checkpoints through the
+save/load callbacks, without changing the game's saved allocations or datums.
+A disk/core load without a matching in-memory checkpoint forgets the table;
+it must not manufacture homes or budgets from coop_vehicle_homes in an unknown state.
+*/
+#include "cseries.h"
+#include "game/game.h"
+#include "game/players.h"
+#include "networking/network_game_globals.h"
+#include "networking/network_game_manager.h"
+#include "objects/objects.h"
+#include "physics/collisions.h"
+#include "physics/collision_models.h"
+#include "physics/physics_definitions.h"
+#include "scenario/scenario.h"
+#include "scenario/scenario_definitions.h"
+#include "units/vehicles.h"
+#include "units/vehicle_datum.h"
+#include "units/vehicle_definitions.h"
+#include "network_coop.h"
+#include "coop_vehicles.h"
+
+char const *config_string(char const *name);
+long config_integer(char const *name);
+boolean collision_test_sphere(real_point3d const *center, real radius, long ignore_object_index);
+
+/* vehicles.c's tag layout; the public header deliberately leaves it opaque. */
+struct coop_vehicle_definition
+{
+	byte unused[0x2f4];
+	short type;
+};
+typedef char coop_vehicle_type_offset_assert[
+	offsetof(struct coop_vehicle_definition, type) == 0x2f4 ? 1 : -1];
+
+enum { VEHICLE_HOMES = 256, VEHICLE_SETTLE_TICKS = 15 };
+#define VEHICLE_CLEARANCE 1.15f
+#define VEHICLE_SCALING_NUMERATOR 2
+#define VEHICLE_SCALING_DENOMINATOR 3
+#define VEHICLE_COLLISION_FLAGS (FLAG(_collision_test_structure_bit) | FLAG(_collision_test_objects_bit) | \
+	_collision_test_objects_sight_blocking_flags | FLAG(_collision_test_front_facing_surfaces_bit) | \
+	FLAG(_collision_test_back_facing_surfaces_bit))
+
+struct coop_vehicle_home
+{
+	struct scenario_object_datum const *source;
+	long current;
+	long definition;
+	short copies;
+	short settled;
+	short bsp;
+	boolean anchored;
+	boolean entered;
+	struct object_placement_data placement;
+	real_point3d center;
+	real radius;
+};
+
+static struct
+{
+	short count;
+	struct coop_vehicle_home homes[VEHICLE_HOMES];
+} coop_vehicle_homes, saved_vehicles;
+static boolean vehicles_enabled, saved_valid;
+static short vehicles_percent, vehicles_multiplier;
+static long saved_tick;
+
+static boolean vehicles_host(void)
+{
+	return vehicles_enabled && game_connection() == _game_connection_network_server && network_coop_active();
+}
+
+/* Apply two-thirds extra growth in either mode, then round down. */
+static short vehicles_extra_count(short players, short percent, short multiplier)
+{
+	return multiplier > 0 ? (short)((PIN(multiplier, 2, 32) - 1) * VEHICLE_SCALING_NUMERATOR / VEHICLE_SCALING_DENOMINATOR) :
+		(short)(MAX(0, MIN(players, HALO_PORT_MAXIMUM_NETWORK_PLAYERS) - 1) *
+		(long)PIN(percent, 25, 200) * VEHICLE_SCALING_NUMERATOR / (100 * VEHICLE_SCALING_DENOMINATOR));
+}
+
+static short vehicles_player_count(void)
+{
+	struct network_game *game = network_game_get_game();
+	short index, count = 0;
+
+	for (index = 0; game && index < HALO_PORT_MAXIMUM_NETWORK_PLAYERS; index++)
+		if (network_player_is_valid(&game->players[index]))
+			count++;
+	return count;
+}
+
+static boolean vehicles_player_driving(long index, struct vehicle_datum const *vehicle)
+{
+	struct unit_datum *driver = unit_try_and_get(vehicle->unit.driver_object_index);
+	struct player_datum *player;
+
+	if (!driver || driver->object.parent_object_index != index || driver->unit.player_index == NONE)
+		return FALSE;
+	player = player_try_and_get(driver->unit.player_index);
+	return player && player->unit_index == vehicle->unit.driver_object_index;
+}
+
+/* Capture an unloaded, upright vehicle's resting pose, rather than a
+dropship's airborne authored placement. A ray below it must find ground. */
+static boolean vehicles_anchor(struct coop_vehicle_home *home, struct vehicle_datum const *vehicle)
+{
+	real_point3d above = vehicle->object.position;
+	real_vector3d down = {0.0f, 0.0f, -1.5f};
+	real_vector3d const *speed = &vehicle->object.translational_velocity;
+	struct collision_result hit;
+
+	if (vehicle->vehicle.airborne_ticks || vehicle->object.up.k < 0.5f || speed->i*speed->i + speed->j*speed->j + speed->k*speed->k > 0.0004f ||
+		TEST_FLAG(vehicle->unit.flags, _unit_possessed_by_recording_bit))
+		return FALSE;
+	above.z += 0.2f;
+	if (!collision_test_vector(VEHICLE_COLLISION_FLAGS, &above, &down, home->current, &hit) || hit.plane.n.k < 0.65f)
+		return FALSE;
+	object_placement_data_new(&home->placement, vehicle->definition_index, NONE);
+	home->placement.position = vehicle->object.position;
+	home->placement.forward = vehicle->object.forward;
+	home->placement.up = vehicle->object.up;
+	home->placement.variant_number = vehicle->object.variant_number;
+	csmemcpy(home->placement.change_colors, vehicle->object.base_change_colors, sizeof(home->placement.change_colors));
+	home->center = vehicle->object.bounding_sphere_center;
+	home->radius = vehicle->object.bounding_sphere_radius;
+	home->bsp = global_structure_bsp_index;
+	return TRUE;
+}
+
+/* Use the physics mass points, not the vehicle's large bounding sphere
+(which normally intersects its own floor). Check their upper halves with
+a small lift above contact, and check nearby objects against their collision meshes.
+An obstructed pad is retried later, never replaced by a guessed nearby spot. */
+static boolean vehicles_home_clear(struct coop_vehicle_home const *home)
+{
+	struct unit_definition *definition = vehicle_definition_get(home->definition);
+	struct physics_definition *physics;
+	struct location location;
+	real_vector3d left;
+	long indices[64];
+	short index, count;
+
+	if (home->bsp != global_structure_bsp_index || definition->object.physics.index == NONE)
+		return FALSE;
+	scenario_location_from_point(&location, &home->center);
+	if (location.leaf_index == NONE || location.cluster_index == NONE)
+		return FALSE;
+	count = objects_in_sphere(0, _object_mask_all & ~_object_mask_projectile, &location,
+		&home->center, home->radius + 0.1f, indices, NUMBEROF(indices));
+	if (count == NUMBEROF(indices))
+		return FALSE;
+	physics = physics_definition_get(definition->object.physics.index);
+	if (physics->mass_points.count < 1 || physics->mass_points.count > MAXIMUM_MASS_POINTS_PER_PHYSICS)
+		return FALSE;
+	cross_product3d(&home->placement.up, &home->placement.forward, &left);
+	for (index = 0; index < physics->mass_points.count; index++)
+	{
+		struct mass_point_definition const *point = TAG_BLOCK_GET_ELEMENT(&physics->mass_points, index, struct mass_point_definition);
+		real_point3d center = home->placement.position;
+		real radius = MAX(0.02f, point->radius * 0.5f);
+
+		center.x += home->placement.forward.i * point->position.x + left.i * point->position.y + home->placement.up.i * point->position.z;
+		center.y += home->placement.forward.j * point->position.x + left.j * point->position.y + home->placement.up.j * point->position.z;
+		center.z += home->placement.forward.k * point->position.x + left.k * point->position.y + home->placement.up.k * point->position.z + 0.1f;
+		if (collision_test_sphere(&center, radius, home->current))
+			return FALSE;
+		{
+			short other;
+
+			for (other = 0; other < count; other++)
+			{
+				struct object_datum *object = object_get(indices[other]);
+				struct collision_model_instance instance;
+				real dx, dy, dz, clearance;
+
+				if (object->object.parent_object_index != NONE)
+					continue;
+				if (collision_model_instance_new(&instance, indices[other]))
+				{
+					if (!collision_model_test_sphere(&instance, &center, radius))
+						continue;
+				}
+				else
+				{
+					dx = object->object.bounding_sphere_center.x - center.x;
+					dy = object->object.bounding_sphere_center.y - center.y;
+					dz = object->object.bounding_sphere_center.z - center.z;
+					clearance = radius + object->object.bounding_sphere_radius;
+					if (dx*dx + dy*dy + dz*dz >= clearance*clearance)
+						continue;
+				}
+				return FALSE;
+			}
+		}
+	}
+	return TRUE;
+}
+
+void coop_vehicles_new_game(void)
+{
+	char const *mode = config_string("network.coop_vehicles");
+
+	csmemset(&coop_vehicle_homes, 0, sizeof(coop_vehicle_homes));
+	saved_valid = FALSE;
+	vehicles_enabled = !strcmp(mode, "per_player") || !strcmp(mode, "multiplier");
+	vehicles_percent = (short)PIN(config_integer("network.coop_enemies"), 25, 200);
+	vehicles_multiplier = !strcmp(mode, "multiplier") ?
+		(short)PIN(config_integer("network.coop_enemies_multiplier"), 2, 32) : 0;
+}
+
+void coop_vehicles_register(long index, struct scenario_object_datum const *source)
+{
+	struct vehicle_datum *vehicle;
+	struct coop_vehicle_definition const *definition;
+	struct coop_vehicle_home *home;
+	short number;
+
+	if (!vehicles_host())
+		return;
+	vehicle = vehicle_datum_try_and_get(index);
+	if (!vehicle)
+		return;
+	definition = (struct coop_vehicle_definition const *)vehicle_definition_get(vehicle->definition_index);
+	/* Tanks, Warthogs, Ghosts and Banshees; no dropships or fixed turrets. */
+	if (definition->type != 0 && definition->type != 1 && definition->type != 4 && definition->type != 5)
+		return;
+	for (number = 0; number < coop_vehicle_homes.count; number++)
+		if (coop_vehicle_homes.homes[number].source == source)
+			break;
+	if (number == coop_vehicle_homes.count)
+	{
+		if (coop_vehicle_homes.count == VEHICLE_HOMES)
+			return;
+		coop_vehicle_homes.count++;
+	}
+	home = &coop_vehicle_homes.homes[number];
+	/* Scripted recreation cannot reset the used budget or displace a copy. */
+	if (home->source && vehicle_try_and_get(home->current))
+		return;
+	home->source = source;
+	home->definition = vehicle->definition_index;
+	home->current = index;
+	home->settled = 0;
+	home->anchored = home->entered = FALSE;
+}
+
+void coop_vehicles_update(void)
+{
+	short number, budget;
+
+	if (!vehicles_host())
+		return;
+	budget = vehicles_extra_count(vehicles_player_count(), vehicles_percent, vehicles_multiplier);
+	for (number = 0; number < coop_vehicle_homes.count; number++)
+	{
+		struct coop_vehicle_home *home = &coop_vehicle_homes.homes[number];
+		struct vehicle_datum *vehicle = vehicle_datum_try_and_get(home->current);
+		real dx, dy, dz, clearance;
+		long copy;
+		struct object_placement_data placement;
+
+		if (!vehicle || vehicle->definition_index != home->definition ||
+			TEST_FLAG(vehicle->object.damage_flags, _object_dead_bit))
+			continue;
+		if (vehicle->object.parent_object_index != NONE)
+		{
+			home->anchored = home->entered = FALSE;
+			home->settled = 0;
+			continue;
+		}
+		if (!TEST_FLAG(vehicle->object.flags, _object_connected_to_map_bit) ||
+			TEST_FLAG(vehicle->object.flags, _object_outside_of_map_bit))
+			continue;
+		if (!home->anchored)
+		{
+			if (!vehicles_anchor(home, vehicle))
+				home->settled = 0;
+			else if (++home->settled >= VEHICLE_SETTLE_TICKS)
+				home->anchored = TRUE;
+			continue;
+		}
+		if (vehicles_player_driving(home->current, vehicle))
+			home->entered = TRUE;
+		if (!home->entered || home->copies >= budget || game_time_get() % 6)
+			continue;
+		/* Separate both bounding spheres, including a buffer, before
+		checking the pad against the collision meshes. */
+		clearance = (home->radius + vehicle->object.bounding_sphere_radius) * VEHICLE_CLEARANCE;
+		dx = vehicle->object.bounding_sphere_center.x - home->center.x;
+		dy = vehicle->object.bounding_sphere_center.y - home->center.y;
+		dz = vehicle->object.bounding_sphere_center.z - home->center.z;
+		if (dx*dx + dy*dy + dz*dz < clearance*clearance ||
+			object_header_data->actual_count >= MAXIMUM_OBJECTS_PER_MAP - 512 || !vehicles_home_clear(home))
+			continue;
+		placement = home->placement;
+		/* vehicle_new lifts physics objects by half their tag radius. */
+		placement.position.z -= vehicle_definition_get(home->definition)->object.bounding_radius * 0.5f;
+		copy = object_new(&placement);
+		if (copy == NONE)
+			continue;
+		home->current = copy;
+		home->copies++;
+		home->entered = FALSE;
+		/* Only one allocation per tick, outside object/physics iteration. */
+		break;
+	}
+}
+
+void coop_vehicles_before_save(void)
+{
+	if (vehicles_host())
+	{
+		saved_vehicles = coop_vehicle_homes;
+		saved_tick = game_time_get();
+		saved_valid = TRUE;
+	}
+}
+
+void coop_vehicles_after_load(void)
+{
+	if (!vehicles_host())
+		return;
+	if (saved_valid && saved_tick == game_time_get())
+		coop_vehicle_homes = saved_vehicles;
+	else
+		csmemset(&coop_vehicle_homes, 0, sizeof(coop_vehicle_homes));
+}

port/linux/game/coop_vehicles.h

@@ -0,0 +1,12 @@
+/* The host's optional campaign vehicle copies (coop_vehicles.c). */
+#ifndef __COOP_VEHICLES_H
+#define __COOP_VEHICLES_H
+
+struct scenario_object_datum;
+void coop_vehicles_new_game(void);
+void coop_vehicles_register(long object_index, struct scenario_object_datum const *source);
+void coop_vehicles_update(void);
+void coop_vehicles_before_save(void);
+void coop_vehicles_after_load(void);
+
+#endif

port/linux/game/custom_edition_cache.c

@@ -375,6 +375,153 @@ static boolean custom_edition_resource_map_path(
 	return TRUE;
 }
 
+/* the locale resource map custom_edition_locale_open opened */
+static struct
+{
+	boolean open;
+	struct custom_edition_file file;
+	struct resource_map map;
+} custom_edition_locale;
+
+/* a unicode string list tag: its strings' block (count, address and
+definition), each element a tag_data of the string's UTF-16 characters
+(size, then the address 12 bytes in) */
+#define STRING_LIST_HEADER_BYTES 12
+#define STRING_LIST_ELEMENT_BYTES 20
+#define STRING_LIST_ELEMENT_ADDRESS_OFFSET 12
+#define STRING_LIST_MAXIMUM_COUNT 32767
+
+boolean custom_edition_locale_open(
+	void)
+{
+	char path[MAP_PATH_SIZE];
+	short folder;
+
+	custom_edition_locale_close();
+	for (folder = 0; folder < NUMBER_OF_MAPS_FOLDERS; folder++)
+	{
+		if (maps_folder_has(maps_folder(folder), resource_map_type_describe(_resource_map_locale), MAP_FILE_EXTENSION, path))
+		{
+			break;
+		}
+	}
+	if (folder == NUMBER_OF_MAPS_FOLDERS || !custom_edition_file_open(&custom_edition_locale.file, path))
+	{
+		return FALSE;
+	}
+	if (resource_map_open(&custom_edition_locale.file.source, _resource_map_locale, &custom_edition_locale.map) !=
+		_cache_file_status_ok)
+	{
+		error(_error_silent, "custom edition: '%s' is not a locale resource map", path);
+		custom_edition_file_close(&custom_edition_locale.file);
+		return FALSE;
+	}
+	custom_edition_locale.open = TRUE;
+
+	return TRUE;
+}
+
+void custom_edition_locale_close(
+	void)
+{
+	if (custom_edition_locale.open)
+	{
+		resource_map_close(&custom_edition_locale.map);
+		custom_edition_file_close(&custom_edition_locale.file);
+		custom_edition_locale.open = FALSE;
+	}
+
+	return;
+}
+
+struct custom_edition_string_list *custom_edition_locale_strings(
+	char const *name)
+{
+	struct resource_map const *map = &custom_edition_locale.map;
+	struct resource_map_item const *item = NULL;
+	struct custom_edition_string_list *list = NULL;
+	byte *tag;
+	int32_t count, index;
+	uint32_t address, text_bytes = 0;
+	unsigned short *characters;
+
+	for (index = 0; custom_edition_locale.open && index < map->item_count && !item; index++)
+	{
+		if (!csstrcasecmp(map->items[index].name, name))
+		{
+			item = &map->items[index];
+		}
+	}
+	if (!item || item->size < STRING_LIST_HEADER_BYTES || !(tag = malloc(item->size)))
+	{
+		return NULL;
+	}
+	if (!custom_edition_locale.file.source.read(custom_edition_locale.file.source.context, item->data_offset, item->size, tag))
+	{
+		goto done;
+	}
+	/* (the tag's addresses count from its start; every string lies within
+	it, so together they are no longer than it) */
+	memcpy(&count, tag, sizeof(count));
+	memcpy(&address, tag + sizeof(count), sizeof(address));
+	if (count <= 0 || count > STRING_LIST_MAXIMUM_COUNT || address > item->size ||
+		(uint32_t)count > (item->size - address) / STRING_LIST_ELEMENT_BYTES)
+	{
+		goto done;
+	}
+	for (index = 0; index < count; index++)
+	{
+		byte const *element = tag + address + (uint32_t)index * STRING_LIST_ELEMENT_BYTES;
+		int32_t size;
+		uint32_t data;
+
+		memcpy(&size, element, sizeof(size));
+		memcpy(&data, element + STRING_LIST_ELEMENT_ADDRESS_OFFSET, sizeof(data));
+		if (size < 0 || (size & 1) || data > item->size || (uint32_t)size > item->size - data ||
+			(uint32_t)size > item->size - text_bytes)
+		{
+			goto done;
+		}
+		text_bytes += (uint32_t)size;
+	}
+	/* one block: the list, its strings' addresses and lengths, then their
+	characters, each terminated */
+	list = malloc(sizeof(*list) + (size_t)count * (sizeof(*list->strings) + sizeof(*list->lengths)) +
+		(size_t)text_bytes + (size_t)count * sizeof(unsigned short));
+	if (!list)
+	{
+		goto done;
+	}
+	list->count = count;
+	list->strings = (unsigned short const **)(list + 1);
+	list->lengths = (long *)(list->strings + count);
+	characters = (unsigned short *)(list->lengths + count);
+	for (index = 0; index < count; index++)
+	{
+		byte const *element = tag + address + (uint32_t)index * STRING_LIST_ELEMENT_BYTES;
+		int32_t size;
+		uint32_t data;
+		long length;
+
+		memcpy(&size, element, sizeof(size));
+		memcpy(&data, element + STRING_LIST_ELEMENT_ADDRESS_OFFSET, sizeof(data));
+		memcpy(characters, tag + data, (size_t)size);
+		length = size / 2;
+		if (!length || characters[length - 1])
+		{
+			characters[length++] = 0;
+		}
+		list->strings[index] = characters;
+		list->lengths[index] = length;
+		characters += length;
+	}
+
+done:
+	free(tag);
+
+	return list;
+}
+
 static void custom_edition_cache_files_close(
 	void)
 {

port/linux/game/custom_edition_cache.h

@@ -158,6 +158,27 @@ struct cache_file_tag_header *custom_edition_cache_tags_load(
 (paths.custom_edition) */
 boolean custom_edition_install_present(
 	void);
+
+/* The locale resource map (loc.map) of the maps folders, which holds the
+text of the Custom Edition the maps come from, in its language: opened (FALSE
+if there is none, or it is not one) until custom_edition_locale_close. */
+boolean custom_edition_locale_open(
+	void);
+void custom_edition_locale_close(
+	void);
+/* The strings of its unicode string list tag `name` (as
+"ui\\shell\\main_menu\\..."): each string's UTF-16 characters, its
+terminator included, lengths[index] of them from strings[index]. One
+block, released with free(); NULL if it holds no such list, or one that
+does not fit in its tag. */
+struct custom_edition_string_list
+{
+	long count;
+	unsigned short const **strings;
+	long *lengths;
+};
+struct custom_edition_string_list *custom_edition_locale_strings(
+	char const *name);
 boolean custom_edition_cache_tags_loaded(
 	void);
 /* Whether the structure bsp reference (of the loaded map's scenario) names

port/linux/game/hud_hires_tags.c

@@ -33,6 +33,7 @@ When the texture cannot be drawn, the sprites are drawn from their bitmap.
 #include "rasterizer/rasterizer.h"
 #include "text/draw_string.h"
 #include "hud_button_layout.h"
+#include "scenario/scenario_definitions.h"
 
 /* the platform layer's (port/linux/src) */
 void platform_log(char const *format, ...);
@@ -46,8 +47,13 @@ long hud_hires_asset_fits(long asset, long width, long height);
 unsigned long hud_hires_asset_sprites(long asset);
 int hud_hires_sprites_drawable(long asset, unsigned long address, unsigned long level0_size);
 void hud_hires_register_placeholder(long asset, unsigned long const *texture);
+int hud_hires_asset_custom_edition(long asset);
+/* (custom_edition_cache.c) */
+boolean custom_edition_cache_stock_tag(long tag_index);
 
-void hud_hires_tags_loaded(void);
+void hud_hires_map_loaded(const long *assets, long count);
+void hud_hires_map_unloaded(void);
+void hud_hires_tags_loaded(long scenario_index);
 void hud_hires_tags_unloaded(void);
 long hud_hires_asset_at(unsigned long address, long width, long height);
 struct bitmap_data const *hud_hires_sprite_bitmap(struct bitmap_data const *bitmap, short sequence_index);
@@ -66,6 +72,9 @@ static struct
 {
 	struct bitmap_data *bitmap;
 	long asset;
+	/* a Custom Edition map's stock bitmap of a layout the texture was made
+	for, whose pixels are its own: drawn without the pixels' check */
+	boolean stock_custom_edition;
 } hires_bitmaps[MAXIMUM_HIRES_BITMAPS];
 static long hires_bitmap_count = 0;
 
@@ -136,7 +145,7 @@ static void hud_hires_sprite_bitmaps_forget(
 /* ---------- public code */
 
 void hud_hires_tags_loaded(
-	void)
+	long scenario_index)
 {
 	long asset_count = hud_hires_asset_count();
 	long asset;
@@ -204,11 +213,27 @@ void hud_hires_tags_loaded(
 		{
 			hires_bitmaps[hires_bitmap_count].bitmap = bitmap;
 			hires_bitmaps[hires_bitmap_count].asset = asset;
+			hires_bitmaps[hires_bitmap_count].stock_custom_edition =
+				hud_hires_asset_custom_edition(asset) && custom_edition_cache_stock_tag(group_index);
 			hires_bitmap_count++;
 		}
 	}
 	platform_log("high-res hud: %ld of %ld bitmaps in this map, %ld for some of their sprites (%ld not in it)",
 		hires_bitmap_count + hires_sprite_bitmap_count, asset_count, hires_sprite_bitmap_count, missing);
+	/* (their PNGs decoded now, ahead of the HUD's first frame: not the main
+	menu's, which draws no HUD) */
+	if (scenario_definition_get(scenario_index)->type != _scenario_type_main_menu)
+	{
+		long assets[MAXIMUM_HIRES_BITMAPS + MAXIMUM_HIRES_SPRITE_BITMAPS];
+		long count = 0;
+		long index;
+
+		for (index = 0; index < hires_bitmap_count; index++)
+			assets[count++] = hires_bitmaps[index].asset;
+		for (index = 0; index < hires_sprite_bitmap_count; index++)
+			assets[count++] = hires_sprite_bitmaps[index].asset;
+		hud_hires_map_loaded(assets, count);
+	}
 
 	return;
 }
@@ -219,6 +244,7 @@ void hud_hires_tags_unloaded(
 	hires_bitmap_count = 0;
 	upscale_bitmap_count = 0;
 	hud_hires_sprite_bitmaps_forget();
+	hud_hires_map_unloaded();
 
 	return;
 }
@@ -290,6 +316,30 @@ struct bitmap_data const *hud_hires_sprite_bitmap(
 	return bitmap;
 }
 
+/* whether the bitmap at address that `asset` stands for is a Custom Edition
+map's stock one (its pixels are not those the texture was drawn from) */
+long hud_hires_asset_stock_custom_edition(
+	unsigned long address,
+	long width,
+	long height,
+	long asset)
+{
+	long index;
+
+	for (index = 0; index < hires_bitmap_count; index++)
+	{
+		struct bitmap_data *bitmap = hires_bitmaps[index].bitmap;
+
+		if (hires_bitmaps[index].asset == asset && bitmap->cache_block_index != NONE &&
+			(unsigned long)bitmap->base_address == address && bitmap->width == width && bitmap->height == height)
+		{
+			return hires_bitmaps[index].stock_custom_edition;
+		}
+	}
+
+	return FALSE;
+}
+
 long hud_hires_asset_at(
 	unsigned long address,
 	long width,

port/linux/game/latency_meter.c

@@ -0,0 +1,258 @@
+/*
+LATENCY_METER.C
+
+The latency meter of a network game (display.latency_meter, off by
+default): this machine's round trip to the host, "Ping 45 ms" with four
+bars, green below 80 ms, yellow below 150, red from 150, at the screen's top
+right under the shields while a game is played (the frame rate counter is at
+the bottom right, a map's download at the top). With the meter on, the
+scoreboard's pings are drawn in the same colours, and where this machine
+times a player's round trip itself (the host: every client's; a client: its
+own players'), the scoreboard shows that, so it agrees with the meter; the
+others are the host's measure in ticks, which every machine is sent
+(game_engine.c).
+
+What it shows is the distributed netcode's own round trip (NETCODE.md),
+timed in milliseconds rather than ticks (network_distributed.c): nothing is
+sent for it, so it is the same over system link, internet play's tunnel
+and a browser's WebRTC data channel.
+
+- A client: its players' input names the host's latest tick it had, and the
+  host's state of its player names the client's tick the host has it at
+  (its own prediction come back; driving, its vehicle's). The time since
+  this machine sent that tick is the round trip: the network both ways, and
+  each machine's wait for its next tick to send what it had (up to a tick,
+  33 ms, each; on a LAN 15 to 35 ms in all). A client that has heard nothing
+  from the host for two seconds shows "Connection problem", pulsing,
+  instead.
+- The host: its clients' round trips, timed the same way by when it sent
+  the tick each client's input names. It shows "Max ping", its slowest
+  client's (one silent for a while, as long as it has been); alone,
+  nothing.
+
+Never shown in the menus, a game over, a co-op cutscene (but a connection
+problem), or a game the host plays alone.
+*/
+
+#include "cseries.h"
+#include "cutscene/cinematics.h"
+#include "game/game.h"
+#include "game/game_engine.h"
+#include "interface/interface.h"
+#include "rasterizer/rasterizer.h"
+#include "render/render.h"
+#include "text/draw_string.h"
+#include "text/font_group.h"
+#include "network_distributed.h"
+#include "latency_meter.h"
+
+#include <stdio.h>
+
+/* ---------- constants */
+
+enum
+{
+	/* the colours' bounds (milliseconds): green below the first, yellow
+	below the second, red from it; four bars below the first, three below
+	the second, two below the third, one */
+	LATENCY_GOOD_MILLISECONDS = 80,
+	LATENCY_FAIR_MILLISECONDS = 150,
+	LATENCY_POOR_MILLISECONDS = 250,
+	LATENCY_BARS = 4,
+	/* the longest shown */
+	LATENCY_MAXIMUM_MILLISECONDS = 9999,
+	/* the meter's right edge from the screen's, its bars' width and gap,
+	and the gap between the bars and the text (the HUD's 480 lines) */
+	LATENCY_RIGHT_MARGIN = 12,
+	LATENCY_BAR_WIDTH = 4,
+	LATENCY_BAR_GAP = 1,
+	LATENCY_TEXT_GAP = 4,
+	/* draw_string.c's right-justified text (its enum is its own) */
+	_latency_text_right = 1,
+};
+
+/* its top: this share of the screen's height down, clear of the shields
+and health at the top right */
+#define LATENCY_TOP_FRACTION 0.15f
+
+/* ---------- prototypes */
+
+/* port_config.c's, cseries_windows.c's, cinematics.c's */
+int config_boolean(const char *name);
+unsigned long config_changes(void);
+unsigned long system_milliseconds(void);
+void draw_quad(rectangle2d *rectangle, pixel32 color);
+
+/* ---------- private code */
+
+static pixel32 latency_pixel(
+	real_argb_color const *color)
+{
+	return ((pixel32)(PIN(color->alpha, 0.0f, 1.0f) * 255.0f + 0.5f) << 24) |
+		((pixel32)(PIN(color->red, 0.0f, 1.0f) * 255.0f + 0.5f) << 16) |
+		((pixel32)(PIN(color->green, 0.0f, 1.0f) * 255.0f + 0.5f) << 8) |
+		(pixel32)(PIN(color->blue, 0.0f, 1.0f) * 255.0f + 0.5f);
+}
+
+/* ... and over the screen: not over a co-op cutscene (but a connection
+problem) */
+static boolean latency_meter_drawn(
+	void)
+{
+	return latency_meter_shown() && (!cinematic_in_progress() || distributed_connection_problem());
+}
+
+/* ---------- public code */
+
+boolean latency_meter_enabled(
+	void)
+{
+	static unsigned long changes = (unsigned long)-1;
+	static boolean enabled = FALSE;
+
+	if (changes != config_changes())
+	{
+		changes = config_changes();
+		enabled = config_boolean("display.latency_meter") != 0;
+	}
+	return enabled;
+}
+
+boolean latency_meter_shown(
+	void)
+{
+	short connection = game_connection();
+
+	return (connection == _game_connection_network_client || connection == _game_connection_network_server) &&
+		latency_meter_enabled() && game_in_progress() && game_engine_in_play();
+}
+
+short latency_meter_color(
+	long milliseconds,
+	real_argb_color *color)
+{
+	short bars;
+
+	color->alpha = 1.0f;
+	if (milliseconds < LATENCY_GOOD_MILLISECONDS)
+	{
+		bars = 4;
+		color->red = 0.35f;
+		color->green = 1.0f;
+		color->blue = 0.35f;
+	}
+	else if (milliseconds < LATENCY_FAIR_MILLISECONDS)
+	{
+		bars = 3;
+		color->red = 1.0f;
+		color->green = 0.85f;
+		color->blue = 0.25f;
+	}
+	else
+	{
+		bars = milliseconds < LATENCY_POOR_MILLISECONDS ? 2 : 1;
+		color->red = 1.0f;
+		color->green = 0.3f;
+		color->blue = 0.3f;
+	}
+	return bars;
+}
+
+long latency_meter_player_ping(
+	short player_index)
+{
+	long ping = latency_meter_shown() ? distributed_player_measured_ping(player_index) : NONE;
+
+	return ping != NONE ? ping : distributed_player_ping(player_index);
+}
+
+void latency_meter_draw(
+	void)
+{
+	long font_index;
+	struct font_header *font;
+	short line_height;
+	short bar_height;
+	short top;
+	short right;
+	short bars = 0;
+	short index;
+	long ping;
+	char text[32];
+	real_argb_color color;
+	rectangle2d bounds;
+
+	if (!latency_meter_drawn())
+		return;
+	font_index = interface_get_tag_index(_interface_font_terminal);
+	if (font_index == NONE)
+		return;
+	font = font_definition_get(font_index);
+	line_height = (short)(font->ascending_height + font->descending_height + font->leading_height);
+	if (line_height <= 0)
+		return;
+	if (game_connection() == _game_connection_network_server)
+	{
+		/* (the host: its slowest client's; alone, nothing) */
+		ping = distributed_slowest_client_ping();
+		if (ping == NONE)
+			return;
+		bars = latency_meter_color(ping, &color);
+		snprintf(text, sizeof(text), "Max ping %ld ms", MIN(ping, (long)LATENCY_MAXIMUM_MILLISECONDS));
+	}
+	else if (distributed_connection_problem())
+	{
+		/* (pulsing, the bars empty) */
+		color.alpha = system_milliseconds() % 1000 < 500 ? 1.0f : 0.45f;
+		color.red = 1.0f;
+		color.green = 0.3f;
+		color.blue = 0.3f;
+		snprintf(text, sizeof(text), "Connection problem");
+	}
+	else
+	{
+		ping = distributed_own_ping();
+		if (ping == NONE)
+		{
+			color.alpha = 1.0f;
+			color.red = color.green = color.blue = 0.6f;
+			snprintf(text, sizeof(text), "Ping -- ms");
+		}
+		else
+		{
+			bars = latency_meter_color(ping, &color);
+			snprintf(text, sizeof(text), "Ping %ld ms", MIN(ping, (long)LATENCY_MAXIMUM_MILLISECONDS));
+		}
+	}
+
+	bounds = render.camera.window_bounds;
+	offset_rectangle2d(&bounds, (short)-render.camera.viewport_bounds.x0, (short)-render.camera.viewport_bounds.y0);
+	top = (short)(bounds.y0 + (bounds.y1 - bounds.y0) * LATENCY_TOP_FRACTION);
+	right = (short)(bounds.x1 - LATENCY_RIGHT_MARGIN);
+	/* the bars, drawn quads rising left to right, at the right: lit as many
+	as earned, the rest dim */
+	bar_height = (short)MAX(line_height - 4, 4);
+	for (index = 0; index < LATENCY_BARS; index++)
+	{
+		rectangle2d bar;
+		real_argb_color bar_color = color;
+		short height = (short)(bar_height * (index + 1) / LATENCY_BARS);
+
+		if (index >= bars)
+		{
+			bar_color.red = bar_color.green = bar_color.blue = 0.25f;
+			bar_color.alpha = 0.6f * color.alpha;
+		}
+		bar.x0 = (short)(right - (LATENCY_BARS - index) * (LATENCY_BAR_WIDTH + LATENCY_BAR_GAP) + LATENCY_BAR_GAP);
+		bar.x1 = (short)(bar.x0 + LATENCY_BAR_WIDTH);
+		bar.y1 = (short)(top + line_height - 2);
+		bar.y0 = (short)(bar.y1 - height);
+		draw_quad(&bar, latency_pixel(&bar_color));
+	}
+	/* the text, right-justified to their left */
+	bounds.x1 = (short)(right - LATENCY_BARS * (LATENCY_BAR_WIDTH + LATENCY_BAR_GAP) - LATENCY_TEXT_GAP);
+	bounds.y0 = top;
+	bounds.y1 = (short)(top + line_height);
+	draw_string_set_draw_mode(font_index, NONE, _latency_text_right, 0, &color);
+	rasterizer_draw_string(&bounds, NULL, NULL, 0, text);
+}

port/linux/game/latency_meter.h

@@ -0,0 +1,25 @@
+/*
+LATENCY_METER.H
+
+A network game's round trip to the host, at the screen's top right while
+the game is played (display.latency_meter: latency_meter.c).
+*/
+
+#ifndef __LATENCY_METER_H
+#define __LATENCY_METER_H
+
+/* display.latency_meter */
+boolean latency_meter_enabled(void);
+/* ... and a network game being played */
+boolean latency_meter_shown(void);
+/* a round trip's colour (green, yellow or red), and the bars it earns (4
+to 1) */
+short latency_meter_color(long milliseconds, real_argb_color *color);
+/* (the scoreboard, game_engine.c) a player's ping in milliseconds, NONE for
+not known: with the meter shown, as this machine times it where it does,
+else distributed_player_ping's */
+long latency_meter_player_ping(short player_index);
+/* (interface.c's overlays, over the whole screen) */
+void latency_meter_draw(void);
+
+#endif

port/linux/game/map_share.c

@@ -82,6 +82,7 @@ hashing thread allocates what the game's thread frees) */
 network_server_manager.c's, cseries_windows.c's */
 int config_boolean(const char *name);
 long config_integer(const char *name);
+const char *config_string(const char *name);
 boolean network_distributed_client_send_reliably(void *message, word size);
 boolean network_distributed_server_send_to_machine_reliably(long machine_index, void *message, word size);
 unsigned long network_game_server_machine_address(long machine_index);
@@ -1035,9 +1036,16 @@ static void connection_close(
 		return;
 	if (reason || connection->bytes_in || connection->bytes_out)
 	{
-		error(_error_silent, "map sharing: the connection with %d.%d.%d.%d closed: %s (%lu bytes in, %lu out)",
-			(int)(connection->address >> 24), (int)(connection->address >> 16 & 255),
-			(int)(connection->address >> 8 & 255), (int)(connection->address & 255), reason ? reason : "done",
+		unsigned char bytes[4];
+		char address[56];
+
+		/* (a public address as a tag: log_address.h) */
+		bytes[0] = (unsigned char)(connection->address >> 24);
+		bytes[1] = (unsigned char)(connection->address >> 16);
+		bytes[2] = (unsigned char)(connection->address >> 8);
+		bytes[3] = (unsigned char)connection->address;
+		error(_error_silent, "map sharing: the connection with %s closed: %s (%lu bytes in, %lu out)",
+			log_address(bytes, 4, -1, address, sizeof(address)), reason ? reason : "done",
 			connection->bytes_in, connection->bytes_out);
 	}
 	if (connection->source != NONE && connection->source < download->source_count)
@@ -1831,6 +1839,124 @@ static void download_unfinish(
 	custom_edition_maps_look_again();
 }
 
+/* ---------- downloaded maps
+
+The maps map sharing downloaded are named, a file name a line, in
+DOWNLOADED_MAPS_FILE beside them in custom_maps: their scripts are held to
+tighter rules (hs.c's hs_scenario_functions_check) in this run and the ones
+after it. game.downloaded_maps names more, by the names the game loads maps
+by, or "*" for all. */
+
+#define DOWNLOADED_MAPS_FILE "downloaded_maps.txt"
+
+/* the list's path beside a map's file */
+static boolean downloaded_maps_list_path(
+	char const *map_path,
+	char *list_path,
+	long size)
+{
+	char const *slash = strrchr(map_path, '\\');
+	char const *other = strrchr(map_path, '/');
+	long folder_length;
+
+	if (other && (!slash || other > slash))
+		slash = other;
+	folder_length = slash ? (long)(slash - map_path) + 1 : 0;
+	if (folder_length + (long)sizeof(DOWNLOADED_MAPS_FILE) > size)
+		return FALSE;
+	csmemcpy(list_path, map_path, folder_length);
+	csstrncpy(list_path + folder_length, DOWNLOADED_MAPS_FILE, size - folder_length - 1);
+	list_path[size - 1] = 0;
+	return TRUE;
+}
+
+/* a map file's name (past its folder) */
+static char const *downloaded_maps_file_name(
+	char const *map_path)
+{
+	char const *slash = strrchr(map_path, '\\');
+	char const *other = strrchr(map_path, '/');
+
+	if (other && (!slash || other > slash))
+		slash = other;
+	return slash ? slash + 1 : map_path;
+}
+
+/* whether the list beside a map's file names it */
+static boolean downloaded_maps_listed(
+	char const *map_path)
+{
+	char list_path[MAP_SHARE_PATH_SIZE];
+	char line[MAP_SHARE_PATH_SIZE];
+	char const *name = downloaded_maps_file_name(map_path);
+	boolean listed = FALSE;
+	FILE *stream;
+
+	if (!downloaded_maps_list_path(map_path, list_path, sizeof(list_path)))
+		return FALSE;
+	stream = fopen(list_path, "rb");
+	if (!stream)
+		return FALSE;
+	while (!listed && fgets(line, sizeof(line), stream))
+	{
+		line[strcspn(line, "\r\n")] = 0;
+		listed = line[0] && !csstrcasecmp(line, name);
+	}
+	fclose(stream);
+	return listed;
+}
+
+/* a map file map sharing downloaded, named in the list beside it */
+static void downloaded_maps_mark(
+	char const *map_path)
+{
+	char list_path[MAP_SHARE_PATH_SIZE];
+	FILE *stream;
+
+	if (downloaded_maps_listed(map_path) ||
+		!downloaded_maps_list_path(map_path, list_path, sizeof(list_path)))
+	{
+		return;
+	}
+	stream = fopen(list_path, "ab");
+	if (!stream)
+	{
+		error(_error_silent, "map sharing: could not name %s in %s", downloaded_maps_file_name(map_path), list_path);
+		return;
+	}
+	fprintf(stream, "%s\r\n", downloaded_maps_file_name(map_path));
+	fclose(stream);
+}
+
+/* (halo_linux_source_fixups.h) */
+int map_share_map_downloaded(
+	char const *map_name)
+{
+	char const *setting = config_string("game.downloaded_maps");
+	char const *path = custom_edition_cache_loaded_path();
+	char const *stripped;
+
+	if (path && downloaded_maps_listed(path))
+		return TRUE;
+	if (!map_name || !*map_name)
+		return FALSE;
+	stripped = tag_name_strip_path(map_name);
+	/* (game.downloaded_maps: names separated by commas or spaces, or "*") */
+	while (setting && *setting)
+	{
+		long length = (long)strcspn(setting, ", ");
+
+		if ((length == 1 && *setting == '*') ||
+			(length > 0 && (long)strlen(stripped) == length && !_strnicmp(setting, stripped, length)))
+		{
+			return TRUE;
+		}
+		setting += length;
+		setting += strspn(setting, ", ");
+	}
+	return FALSE;
+}
+
 /* the download's files, all had: renamed, the map checked (each deleted
 again if it cannot be played) */
 static void download_finish(
@@ -1869,6 +1995,12 @@ static void download_finish(
 		return;
 	}
 	error(_error_silent, "map sharing: downloaded %s (%lu bytes)", download->level_name, download->done_bytes);
+	/* (its scripts held to tighter rules: downloaded_maps_mark) */
+	for (index = 0; index < download->file_count; index++)
+	{
+		if (download->files[index].kind == _map_share_file_map)
+			downloaded_maps_mark(download->files[index].final_path);
+	}
 	download_report(_progress_done);
 	/* (sent on to the others from here, without hashing them again) */
 	for (index = 0; index < download->file_count; index++)

port/linux/game/menu_functions.c

@@ -106,6 +106,7 @@ void platform_display_apply(void);
 void platform_binding_capture_begin(void);
 int platform_binding_capture_poll(int *input);
 void halo_input_name(int input, char *name, unsigned int size);
+void halo_input_shown_name(char const *binding, char *shown, unsigned int size);
 short pc_menu_string_index(long definition_index);
 /* cseries_windows.c's */
 unsigned long system_milliseconds(void);
@@ -578,6 +579,7 @@ reached, and (map_data) a saved game on the level */
 #define ROW_TEXT_LENGTH 64
 #define MAXIMUM_PROFILES 32
 #define SOUND_ERROR 4
+#define SOUND_CURSOR 1
 #define SOUND_FORWARD 2
 #define SOUND_BACK 3
 
@@ -988,6 +990,8 @@ static short map_kind_first(short chosen, short count)
 	return (short)PIN(chosen - MAP_KIND_ROWS / 2, 0, MAX(count - MAP_KIND_ROWS, 0));
 }
 
+static boolean list_scrolls_at_end(void);
+
 static void map_kind_focus(struct widget_instance *list, short first, short chosen)
 {
 	focus_row(list, (short)(1 + chosen - first));
@@ -1003,12 +1007,12 @@ static short map_kind_rows_update(struct widget_instance *list, short *first, sh
 	short row = focused_row(list), index = 0;
 	struct widget_instance *child;
 
-	if (row != NONE && row >= 1 && row == shown && *first + shown < count)
+	if (row != NONE && row >= 1 && row == shown && *first + shown < count && list_scrolls_at_end())
 	{
 		(*first)++;
 		focus_row(list, --row);
 	}
-	else if (row == 1 && *first > 0)
+	else if (row == 1 && *first > 0 && list_scrolls_at_end())
 	{
 		(*first)--;
 		focus_row(list, ++row);
@@ -1213,11 +1217,17 @@ static void level_list_update(struct widget_instance *list)
 
 /* "solo level set map": the level shown, if reached, or the Custom Edition
 campaign map, for the difficulty menu; or the multiplayer map, played at
-once (FALSE: no difficulty menu) */
-static boolean level_choose(short controller)
+once (FALSE: no difficulty menu). The list is read again first: a tap on
+the touchscreen focuses a row and activates it at once, before the list's
+update has read which row it is (it started the level shown before, Pillar
+of Autumn on a new profile). The map and gametype lists do the same. */
+static boolean level_choose(struct widget_instance *list, short controller)
 {
-	short level = campaign.shown_level;
-	short count = map_kind_count(level_list.kind, level_list.map_count);
+	short level, count;
+
+	level_list_update(list);
+	level = campaign.shown_level;
+	count = map_kind_count(level_list.kind, level_list.map_count);
 
 	if (level_list.kind != MAP_KIND_SINGLEPLAYER && (level_list.chosen < 0 || level_list.chosen >= count))
 		return campaign_fail();
@@ -1590,6 +1600,7 @@ static boolean color_list_initialize(struct widget_instance *list)
 
 /* (ui_widget.c) whether the pointer moved the menus' focus last */
 boolean ui_widget_port_pointer_focused(void);
+boolean ui_widget_port_hover_focused(void);
 
 /* Whether a list whose focus is on its first or last row moves on: when the
 d-pad put it there. The pointer resting there would make it move every
@@ -1657,20 +1668,23 @@ BITMAP_FRAMES): Gamepad Setup's row's, as the list numbers its rows
 the PC version's nine the Xbox's five of the button settings */
 #define PROFILE_GAMEPAD_FRAME 2
 #define PROFILE_FIRST_LAYOUT_FRAME 9
+#define PROFILE_LAYOUT_FRAMES (_button_preset_swap_b_and_right_thumb + 1)
 
 /* "port gamepad layout preview" (the picture's own): on Gamepad Setup's
-row, the edited profile's button settings */
+row, the edited profile's button settings; the port's own (Bumper Jumper),
+of which the Xbox has no picture, keeps the row's */
 static void profile_gamepad_layout(struct widget_instance *picture)
 {
 	struct player_profile *profile = player_ui_get_edit_player_profile();
 	short frame = picture->animation.current_frame_index;
 
 	if (frame == PROFILE_GAMEPAD_FRAME ||
-		(frame >= PROFILE_FIRST_LAYOUT_FRAME && frame < PROFILE_FIRST_LAYOUT_FRAME + NUMBER_OF_BUTTON_PRESETS))
+		(frame >= PROFILE_FIRST_LAYOUT_FRAME && frame < PROFILE_FIRST_LAYOUT_FRAME + PROFILE_LAYOUT_FRAMES))
 	{
-		picture->animation.current_frame_index = (short)(PROFILE_FIRST_LAYOUT_FRAME +
-			(profile && profile->controller_settings.button_preset < NUMBER_OF_BUTTON_PRESETS ?
-				profile->controller_settings.button_preset : _button_preset_standard));
+		byte preset = profile ? profile->controller_settings.button_preset : (byte)_button_preset_standard;
+
+		picture->animation.current_frame_index = preset < PROFILE_LAYOUT_FRAMES ?
+			(short)(PROFILE_FIRST_LAYOUT_FRAME + preset) : PROFILE_GAMEPAD_FRAME;
 	}
 }
 
@@ -2172,15 +2186,21 @@ static void controls_update(struct widget_instance *list)
 		{
 			char const *binding = controls_screen.bindings[control][slot];
 			wchar_t text[ROW_TEXT_LENGTH];
+			char name[CONTROL_NAME_LENGTH];
 			char shown[64];
 			short index;
 
+			/* (the key as the keyboard's layout labels it: xinput_sdl.c) */
+			if (*binding)
+				halo_input_shown_name(binding, name, sizeof(name));
+			else
+				snprintf(name, sizeof(name), "%s", "-");
 			if (controls_screen.capturing_control == control && controls_screen.capturing_slot == slot)
 				snprintf(shown, sizeof(shown), "%s", "PRESS A KEY");
 			else if (row == focused_row && controls_screen.slot == slot)
-				snprintf(shown, sizeof(shown), "> %s <", *binding ? binding : "-");
+				snprintf(shown, sizeof(shown), "> %s <", name);
 			else
-				snprintf(shown, sizeof(shown), "%s", *binding ? binding : "-");
+				snprintf(shown, sizeof(shown), "%s", name);
 			for (index = 0; shown[index] && index < ROW_TEXT_LENGTH - 1; index++)
 				text[index] = (wchar_t)(unsigned char)shown[index];
 			text[index] = 0;
@@ -3163,7 +3183,10 @@ difficulties, or the level at the difficulty chosen. FALSE stays on the Map
 screen (the gametypes open on TRUE). */
 static boolean map_list_choose(struct widget_instance *list, boolean *widget_deleted)
 {
-	short chosen = map_list.chosen;
+	short chosen;
+
+	map_list_update(list);
+	chosen = map_list.chosen;
 
 	if (chosen >= map_step_count())
 		return campaign_fail();
@@ -3347,8 +3370,9 @@ static void gametype_list_update(struct widget_instance *list)
 }
 
 /* "mp profile set for game" */
-static boolean gametype_choose(void)
+static boolean gametype_choose(struct widget_instance *list)
 {
+	gametype_list_update(list);
 	gametype_setup_end();
 	if (multiplayer.gametype_chosen >= multiplayer.bank_count)
 		return campaign_fail();
@@ -3406,9 +3430,9 @@ gametype_options' coop_extra_enemies_spinner has them, in this order): its
 amount's row is the choice's */
 enum
 {
-	_cooperative_enemies_none,
 	_cooperative_enemies_per_player,
 	_cooperative_enemies_multiplier,
+	_cooperative_enemies_none,
 	NUMBER_OF_COOPERATIVE_ENEMIES_MODES
 };
 
@@ -3548,7 +3572,8 @@ static void server_settings_update(struct widget_instance *list)
 	browser, or PRIVATE, for this game. Its help is its choice's */
 	visible_set(named(list, "op_listing", 0), multiplayer.mode == _multiplayer_mode_host_internet &&
 		config_boolean("network.online") && config_boolean("network.public_lobby"));
-	if ((spinner = named(list, "listing_spinner", 0)) != NULL && named(list, "op_listing", 0)->visible)
+	if ((spinner = named(list, "listing_spinner", 0)) != NULL && named(list, "op_listing", 0) &&
+		named(list, "op_listing", 0)->visible)
 	{
 		boolean public = spinner->parameters.list.selected_index == 0;
 		struct widget_instance *help = list->parameters.list.extended_description;
@@ -3710,6 +3735,38 @@ static short browser_row_index(struct widget_instance *row)
 	return row && !strncmp(row->name, "server_item_", 12) ? (short)(atoi(row->name + 12) - 1) : NONE;
 }
 
+/* the ping each row shows (-1: none), coloured by pc_menu_text_color: green
+under PING_GOOD milliseconds, yellow under PING_FAIR, red above */
+static short browser_row_pings[BROWSER_ROWS];
+enum
+{
+	PING_GOOD = 80,
+	PING_FAIR = 160,
+};
+#define PING_COLOR_GOOD 0x5ED38CFFUL
+#define PING_COLOR_FAIR 0xE8C547FFUL
+#define PING_COLOR_POOR 0xE86A5AFFUL
+
+/* ui_widget.c: a text's colour in place of its own (FALSE: its own): a
+server browser row's ping by how good it is */
+boolean pc_menu_text_color(struct widget_instance *widget, real_argb_color *color)
+{
+	short row = widget->parent ? browser_row_index(widget->parent) : NONE;
+	short ping;
+	unsigned long rgba;
+
+	if (row < 0 || row >= BROWSER_ROWS || strcmp(widget->name, "server_item_ping"))
+		return FALSE;
+	ping = browser_row_pings[row];
+	if (ping < 0)
+		return FALSE;
+	rgba = ping < PING_GOOD ? PING_COLOR_GOOD : ping < PING_FAIR ? PING_COLOR_FAIR : PING_COLOR_POOR;
+	color->red = (real)((rgba >> 24) & 0xFF) / 255.0f;
+	color->green = (real)((rgba >> 16) & 0xFF) / 255.0f;
+	color->blue = (real)((rgba >> 8) & 0xFF) / 255.0f;
+	return TRUE;
+}
+
 /* a bar of buttons' focus, off one hidden: on its first one shown */
 static void focus_off_hidden(struct widget_instance *bar)
 {
@@ -3735,21 +3792,25 @@ static boolean browser_item_usable(struct widget_instance *child)
 }
 
 /* the browser's focus, off what cannot have it (at the start, or a row whose
-game went): the first game, else the buttons (off those hidden) */
-static void browser_focus(struct widget_instance *list)
+game went): the first game, else the buttons (off those hidden); the row of
+the game chosen is `chosen_row` (NONE: none shown) */
+static void browser_focus(struct widget_instance *list, short chosen_row)
 {
 	char const *const choices[] = { "server_item_1", "join_game_button_bar" };
 	struct widget_instance *focused = list->focused_child;
 	struct widget_instance *row;
 	short index;
 
-	/* (the rows' backgrounds: the focused one's outlined frame. The engine
-	shows a list item's focus only on a bitmap of two frames, and theirs has
-	three: normal, focused, selected) */
+	/* (the rows' backgrounds, as Custom Edition's: the chosen game's
+	outlined in yellow, the focused one's in blue. The engine shows a list
+	item's focus only on a bitmap of two frames, and theirs has three:
+	normal, focused, selected) */
 	for (row = list->child; row; row = row->next)
 	{
-		if (browser_row_index(row) != NONE)
-			row->animation.current_frame_index = row == focused ? 1 : 0;
+		short row_index = browser_row_index(row);
+
+		if (row_index != NONE)
+			row->animation.current_frame_index = row_index == chosen_row ? 2 : row == focused ? 1 : 0;
 	}
 	focus_off_hidden(named(list, "join_game_button_bar", 0));
 	if (focused && focused->visible && !focused->disabled)
@@ -3802,7 +3863,7 @@ static boolean browser_initialize(struct widget_instance *screen, struct event_r
 		for (child = list ? list->child : NULL; child; child = child->next)
 			child->disabled = !browser_item_usable(child);
 		if (list)
-			browser_focus(list);
+			browser_focus(list, NONE);
 	}
 	visible_set(named(screen, "scroll_up_button", 0), FALSE);
 	visible_set(named(screen, "scroll_down_button", 0), FALSE);
@@ -3931,6 +3992,7 @@ static struct
 	/* the last that failed, and when */
 	char failed_name[P2P_LISTING_NAME_SIZE + 1];
 	unsigned long failed_time;
+	boolean failed_nat_strict;
 	/* a game with a password chosen: the password screen's (its own copy:
 	the rows' are read again each frame), and a join it began, which the
 	browser takes up again as it comes back */
@@ -3938,6 +4000,17 @@ static struct
 	boolean password_joined;
 } lobby_browser;
 
+/* the row of the browser's chosen game, NONE if it is not on the rows */
+static short browser_chosen_row(void)
+{
+	boolean server_browser = multiplayer.mode == _multiplayer_mode_server_browser;
+	short chosen = server_browser ? lobby_browser.chosen : multiplayer.game_chosen;
+	short row = server_browser ? (short)(chosen - lobby_browser.first) : chosen;
+
+	return chosen < (server_browser ? lobby_browser.count : multiplayer.game_count) && row >= 0 &&
+		row < BROWSER_ROWS ? row : NONE;
+}
+
 static void lobby_browser_begin(void)
 {
 	lobby_browser.count = 0;
@@ -4070,9 +4143,10 @@ static void lobby_browser_update(struct widget_instance *list)
 			first_row->visible = TRUE;
 			lobby_browser_focus_row(list, 0);
 			focused = 0;
+			lobby_browser.chosen = lobby_browser.first;
 		}
 	}
-	if (focused != NONE)
+	if (focused != NONE && !ui_widget_port_hover_focused())
 		lobby_browser.chosen = (short)(lobby_browser.first + focused);
 	chosen = lobby_browser.chosen;
 	for (row = list->child; row; row = row->next)
@@ -4094,9 +4168,11 @@ static void lobby_browser_update(struct widget_instance *list)
 		text_set(named(row, "server_item_type", 0), game_type_name(game->engine_type));
 		usnprintf(text, ROW_TEXT_LENGTH - 1, L"%d/%d", game->player_count, game->maximum_player_count);
 		text_set(named(row, "server_item_players", 0), text);
-		/* (no ping yet: its host is reached only on joining) */
-		text_set(named(row, "server_item_ping", 0), game->failed ? L"FAILED" : !game->open ? L"CLOSED" :
-			game->in_progress ? L"LIVE" : L"-");
+		/* (its host's ping, once probed: p2p_lobby.c) */
+		browser_row_pings[index - lobby_browser.first] = game->failed ? -1 : game->ping;
+		usnprintf(text, ROW_TEXT_LENGTH - 1, L"%d", game->ping);
+		text_set(named(row, "server_item_ping", 0), game->failed ? L"FAILED" : game->ping >= 0 ? text :
+			!game->open ? L"CLOSED" : game->in_progress ? L"LIVE" : L"-");
 		/* (the lock: a game with a password. Its bitmap's first frame is
 		empty, the PC version's for no lock; the next is the lock, in the
 		menus' blue) */
@@ -4147,6 +4223,7 @@ static void lobby_browser_update(struct widget_instance *list)
 			p2p_lobby_mark_failed(lobby_browser.identifier);
 			csmemcpy(lobby_browser.failed_name, lobby_browser.name, sizeof(lobby_browser.failed_name));
 			lobby_browser.failed_time = now ? now : 1;
+			lobby_browser.failed_nat_strict = p2p_nat_strict();
 			lobby_browser.joining = FALSE;
 			platform_log("menus: could not reach the server browser's game %s", lobby_browser.name);
 			ui_play_audio_feedback_sound(SOUND_ERROR);
@@ -4168,12 +4245,26 @@ static void lobby_browser_update(struct widget_instance *list)
 		else if (lobby_browser.failed_time && now - lobby_browser.failed_time < LOBBY_BROWSER_FAILED_TIME)
 		{
 			text_to_wide(lobby_browser.failed_name, name, NUMBEROF(name));
-			usnprintf(text, NUMBEROF(text) - 1, L"Could not reach %s", name);
+			/* (and why, when this network's NAT is what stops it: the router's
+			UPnP, or a forwarded network.tunnel_port, lets it through) */
+			usnprintf(text, NUMBEROF(text) - 1, lobby_browser.failed_nat_strict ?
+				L"Strict NAT, turn on UPnP: could not reach %s" :
+				L"Could not reach %s", name);
 		}
 		else if (!lobby_browser.count)
 		{
-			usnprintf(text, NUMBEROF(text) - 1, L"%s", now - lobby_browser.begin_time < LOBBY_BROWSER_LOOK_TIME ?
-				L"Looking for public games..." : L"No public games found");
+			/* (an old build sees none of the games: it says why) */
+			int newer = p2p_lobby_newer_games();
+
+			if (now - lobby_browser.begin_time < LOBBY_BROWSER_LOOK_TIME)
+				usnprintf(text, NUMBEROF(text) - 1, L"Looking for public games...");
+			else if (newer)
+			{
+				usnprintf(text, NUMBEROF(text) - 1, L"%d %s on a newer version: update the game to join", newer,
+					newer == 1 ? L"game is" : L"games are");
+			}
+			else
+				usnprintf(text, NUMBEROF(text) - 1, L"No public games found");
 		}
 		else if (chosen < lobby_browser.count)
 		{
@@ -4211,7 +4302,7 @@ static void lobby_browser_update(struct widget_instance *list)
 		usnprintf(text, ROW_TEXT_LENGTH - 1, L"%s %d", label, lobby_browser.count);
 		text_set(named(stats, "server_count_label", 0), text);
 	}
-	browser_focus(list);
+	browser_focus(list, browser_chosen_row());
 }
 
 /* the game's host reached by its invite (joined, once it is reached:
@@ -4409,13 +4500,14 @@ static void browser_update(struct widget_instance *list)
 		return;
 	}
 	browser_games_read();
-	if (focused != NONE && focused < multiplayer.game_count)
+	if (focused != NONE && focused < multiplayer.game_count && !ui_widget_port_hover_focused())
 		multiplayer.game_chosen = focused;
 	for (row = list->child; row; row = row->next)
 	{
 		short index = browser_row_index(row);
 		struct advertised_game *game;
 		wchar_t text[ROW_TEXT_LENGTH];
+		int ping;
 
 		if (index == NONE)
 			continue;
@@ -4431,7 +4523,11 @@ static void browser_update(struct widget_instance *list)
 		text_set(named(row, "server_item_type", 0), game_type_name(game->engine_type));
 		usnprintf(text, ROW_TEXT_LENGTH - 1, L"%d/%d", game->player_count, game->maximum_player_count);
 		text_set(named(row, "server_item_players", 0), text);
-		text_set(named(row, "server_item_ping", 0), advertised_in_progress(game) ? L"LIVE" : L"");
+		/* (a Direct Link game's host: the tunnel's ping) */
+		ping = multiplayer.mode == _multiplayer_mode_direct_link ? p2p_peer_ping(game->xnaddr + 2) : -1;
+		browser_row_pings[index] = (short)ping;
+		usnprintf(text, ROW_TEXT_LENGTH - 1, L"%d", ping);
+		text_set(named(row, "server_item_ping", 0), ping >= 0 ? text : advertised_in_progress(game) ? L"LIVE" : L"");
 		visible_set(named(row, "server_item_locked", 0), FALSE);
 		visible_set(named(row, "server_item_dedicated", 0), FALSE);
 		visible_set(named(row, "server_item_classic", 0), FALSE);
@@ -4477,7 +4573,7 @@ static void browser_update(struct widget_instance *list)
 		usnprintf(text, ROW_TEXT_LENGTH - 1, L"%s %d", label, multiplayer.game_count);
 		text_set(named(stats, "server_count_label", 0), text);
 	}
-	browser_focus(list);
+	browser_focus(list, browser_chosen_row());
 }
 
 /* "direct ip connect go" (Direct Link's PASTE LINK): the invite
@@ -4513,13 +4609,25 @@ static boolean browser_join(struct widget_instance *widget, short controller, bo
 	return ui_widget_port_join(widget, multiplayer.games[multiplayer.game_chosen], LOBBY_NAME, widget_deleted);
 }
 
-/* "gamespy select item" (a row: joins its game) and "gamespy select button"
-(Join) */
+/* "gamespy select item" (a row: chooses its game, or joins it once chosen)
+and "gamespy select button" (Join) */
 static boolean browser_select(struct widget_instance *widget, struct event_record *event, short controller,
 	boolean *widget_deleted)
 {
 	short row = browser_row_index(widget);
 
+	/* (a row not chosen, clicked after the pointer passed over it: chosen,
+	as Custom Edition's; a click on it chosen, a double click, A or JOIN
+	joins its game. Not the A press a join posts: lobby_browser_select) */
+	if (row != NONE && row != browser_chosen_row() && !lobby_browser.ready)
+	{
+		if (multiplayer.mode == _multiplayer_mode_server_browser)
+			lobby_browser.chosen = (short)(lobby_browser.first + row);
+		else
+			multiplayer.game_chosen = row;
+		ui_play_audio_feedback_sound(SOUND_CURSOR);
+		return TRUE;
+	}
 	if (multiplayer.mode == _multiplayer_mode_server_browser)
 		return lobby_browser_select(widget, controller, row, widget_deleted);
 	if (row != NONE)
@@ -4597,6 +4705,24 @@ static boolean pause_end_game(void)
 	return TRUE;
 }
 
+/* "port coop friendly fire" (network co-op's pause menu's FRIENDLY FIRE,
+menu_tags.c): switches this machine's own friendly fire, from now on */
+static boolean coop_friendly_fire_change(void)
+{
+	char const *choice = config_boolean("network.coop_own_friendly_fire") ? "false" : "true";
+
+	if (!config_write("network.coop_own_friendly_fire", choice))
+		platform_log("menus: could not write network.coop_own_friendly_fire to config.toml");
+	ui_play_audio_feedback_sound(SOUND_FORWARD);
+	return TRUE;
+}
+
+/* "port coop friendly fire text": the button's text, ON or OFF */
+static void coop_friendly_fire_text(struct widget_instance *button)
+{
+	button->parameters.text_box.string_list_index = config_boolean("network.coop_own_friendly_fire") ? 0 : 1;
+}
+
 /* ---- the lobby: the game's players (up to the port's 128), its map and
 gametype, the countdown */
 
@@ -5312,12 +5438,17 @@ static struct gametype_option const gametype_options[] =
 	{ "votekick_spinner", _option_setting, 0, 0, 2, { 0 }, "network.votekick", { "true", "false" } },
 	/* (and the text chat: port/linux/game/network_chat.c) */
 	{ "text_chat_spinner", _option_setting, 0, 0, 3, { 0 }, "network.text_chat", { "on", "links", "off" } },
+	{ "aim_assist_spinner", _option_setting, 0, 0, 2, { 0 }, "network.block_mouse_aim_assist", { "false", "true" } },
 	/* co-op's options (Server Setup's CO-OP OPTIONS: tools/port_settings.py's
 	COOP_SETUP_SCREENS; coop_enemies.c) */
 	{ "coop_friendly_fire_spinner", _option_setting, 0, 0, 4, { 0 }, "network.coop_friendly_fire",
 		{ "off", "on", "shields_only", "explosives_only" } },
 	{ "coop_extra_enemies_spinner", _option_setting, 0, 0, 3, { 0 }, "network.coop_enemies_mode",
-		{ "none", "per_player", "multiplier" } },
+		{ "per_player", "multiplier", "none" } },
+	{ "coop_extra_pickups_spinner", _option_setting, 0, 0, 3, { 0 }, "network.coop_pickups",
+		{ "per_player", "multiplier", "none" } },
+	{ "coop_extra_vehicles_spinner", _option_setting, 0, 0, 3, { 0 }, "network.coop_vehicles",
+		{ "per_player", "multiplier", "none" } },
 	{ "coop_enemies_per_player_spinner", _option_setting, 0, 0, 5, { 0 }, "network.coop_enemies",
 		{ "25", "50", "100", "150", "200" } },
 	{ "coop_enemies_multiplier_spinner", _option_setting, 0, 0, 5, { 0 }, "network.coop_enemies_multiplier",
@@ -5872,14 +6003,37 @@ static void gametype_option_help(struct widget_instance *list)
 	/* (TEXT CHAT held at OFF while the game is listed: text_chat_locked) */
 	if (named(list, TEXT_CHAT_SPINNER, 0) && p2p_hosting_listed())
 		named(list, TEXT_CHAT_SPINNER, 0)->parameters.list.selected_index = TEXT_CHAT_OFF;
-	/* (CO-OP OPTIONS: the row of the amount of the extra enemies chosen,
-	PER PLAYER's or MULTIPLIER's, in the one place) */
+	/* CO-OP OPTIONS: enemies, pickups and vehicles share the amount rows.
+	Mixed modes may need both rows at once. */
 	if (named(list, "coop_extra_enemies_spinner", 0))
 	{
 		short mode = named(list, "coop_extra_enemies_spinner", 0)->parameters.list.selected_index;
 
-		visible_set(named(list, "op_coop_enemies_per_player", 0), mode == _cooperative_enemies_per_player);
-		visible_set(named(list, "op_coop_enemies_multiplier", 0), mode == _cooperative_enemies_multiplier);
+		struct widget_instance *pickups = named(list, "coop_extra_pickups_spinner", 0);
+		struct widget_instance *vehicles = named(list, "coop_extra_vehicles_spinner", 0);
+		boolean per_player = mode == _cooperative_enemies_per_player ||
+			(pickups && pickups->parameters.list.selected_index == _cooperative_enemies_per_player) ||
+			(vehicles && vehicles->parameters.list.selected_index == _cooperative_enemies_per_player);
+		boolean multiplier = mode == _cooperative_enemies_multiplier ||
+			(pickups && pickups->parameters.list.selected_index == _cooperative_enemies_multiplier) ||
+			(vehicles && vehicles->parameters.list.selected_index == _cooperative_enemies_multiplier);
+
+		visible_set(named(list, "op_coop_enemies_per_player", 0), per_player);
+		visible_set(named(list, "op_coop_enemies_multiplier", 0), multiplier);
+
+		/* Hidden amounts must not reserve a blank row. Offsets are relative
+		to the parent: moving only the row carries its labels and spinners
+		with it when widget_instance_render_recursive draws and notes targets. */
+		{
+			short y = 73;
+
+			for (row = list->child; row; row = row->next)
+				if (row->visible && !strncmp(row->name, "op_coop_", 8))
+				{
+					row->vertical_offset = y;
+					y += 30;
+				}
+		}
 	}
 	/* (the server browser's filters, hidden: their helps are fewer than
 	their values) */
@@ -6111,6 +6265,10 @@ boolean pc_menu_event_function_invoke(
 		{
 			return pause_end_game();
 		}
+		else if (!strcmp(name, "port coop friendly fire"))
+		{
+			return coop_friendly_fire_change();
+		}
 		else if (!strcmp(name, "player profile save changes"))
 		{
 			return profile_save_changes(widget, widget_deleted);
@@ -6147,7 +6305,7 @@ boolean pc_menu_event_function_invoke(
 		}
 		else if (!strcmp(name, "mp profile set for game"))
 		{
-			return gametype_choose();
+			return gametype_choose(widget);
 		}
 		else if (!strcmp(name, "server settings init"))
 		{
@@ -6312,7 +6470,7 @@ boolean pc_menu_event_function_invoke(
 		}
 		else if (!strcmp(name, "solo level set map"))
 		{
-			return level_choose(controller);
+			return level_choose(widget, controller);
 		}
 		else if (!strcmp(name, "difficulty item select"))
 		{
@@ -6408,4 +6566,6 @@ void pc_menu_game_data_function_invoke(
 		saved_game_list_update(widget);
 	else if (!strcmp(name, "port gamepad layout preview"))
 		profile_gamepad_layout(widget);
+	else if (!strcmp(name, "port coop friendly fire text"))
+		coop_friendly_fire_text(widget);
 }

port/linux/game/menu_tags.c

@@ -30,7 +30,8 @@ pictures, sounds and screens) are none, a missing picture drawn blank, and
 no screen pauses the game (a network game's clock runs on).
 
 So does a single-player campaign's map (pause_campaign_patch), whose screens
-pause it as its pause menu does.
+pause it as its pause menu does, and a network co-op game's, whose pause
+menu gets FRIENDLY FIRE too.
 */
 
 #include "cseries.h"
@@ -42,6 +43,7 @@ pause it as its pause menu does.
 
 #include "halo_menus.h"
 #include "halo_vr.h"
+#include "custom_edition_cache.h"
 
 #include <stdlib.h>
 #include <string.h>
@@ -82,7 +84,8 @@ adds to */
 #define MULTIPLAYER_COLLECTION "ui\\shell\\multiplayer"
 /* the campaign's full screen pause screen, which pause_campaign_patch adds to */
 #define CAMPAIGN_PAUSE_SCREEN "ui\\shell\\solo_game\\pause_game\\pause_game"
-/* the tags pause_patch adds: two buttons and their texts */
+/* the tags pause_patch or pause_campaign_patch adds: two buttons and their
+texts (SETTINGS, and END GAME or FRIENDLY FIRE) */
 #define PAUSE_PATCH_TAGS 4
 /* what a frame of ui.map's is drawn as in a game map, which has not got it */
 #define BLANK_PNG "ce/port/blank__0.png"
@@ -364,7 +367,7 @@ static char const *const port_function_names[] =
 	"port setup edit",
 	"port setup options init", "port setup options save",
 	"port map list back",
-	"port pause end game",
+	"port pause end game", "port coop friendly fire",
 	"port coop begin", "port coop player 2 list initialize", "port coop player 2",
 	"port lobby open", "port lobby add player", "port lobby join", "port lobby leave",
 	"port lobby player list initialize", "port lobby player choose",
@@ -414,6 +417,8 @@ static char const *const port_game_data_input_names[] =
 	"port gamepad layout preview",
 	/* (the main menu's Mods) */
 	"port mods update",
+	/* (network co-op's pause menu's FRIENDLY FIRE: its text, ON or OFF) */
+	"port coop friendly fire text",
 };
 
 static struct
@@ -453,6 +458,10 @@ static struct
 	boolean game_map;
 	/* a single-player campaign's map's, whose screens pause the game */
 	boolean campaign;
+	/* the strings taken from the Custom Edition's loc.map */
+	long map_strings;
+	/* a network co-op game's map's: its pause menu gets FRIENDLY FIRE too */
+	boolean coop;
 } build;
 
 /* ---------- private code */
@@ -707,8 +716,11 @@ static void parse_bounds(char const *text, rectangle2d *bounds, char const *file
 	}
 }
 
-/* a 'ustr' of the strings */
-static void *string_list_build(char const *const *strings, long count)
+/* a 'ustr' of the strings; each with an index in the list `map` (the
+Custom Edition's in its language, or NULL) given by maps is its string
+there */
+static void *string_list_build(char const *const *strings, long const *maps, long count,
+	struct custom_edition_string_list const *map)
 {
 	struct string_list *list = allocate(sizeof(struct string_list));
 	struct string_list_entry *entries = allocate(count * sizeof(struct string_list_entry));
@@ -721,9 +733,22 @@ static void *string_list_build(char const *const *strings, long count)
 	for (index = 0; index < count; index++)
 	{
 		long length = (long)strlen(strings[index]);
-		unsigned short *characters = allocate((length * 2 + 2) * sizeof(unsigned short));
+		unsigned short *characters;
 		long written;
 
+		if (map && maps[index] != HALO_MENU_NONE && maps[index] < map->count)
+		{
+			length = map->lengths[maps[index]];
+			characters = allocate(length * sizeof(unsigned short));
+			if (!characters)
+				return list;
+			memcpy(characters, map->strings[maps[index]], length * sizeof(unsigned short));
+			entries[index].string.size = length * (long)sizeof(unsigned short);
+			entries[index].string.address = characters;
+			build.map_strings++;
+			continue;
+		}
+		characters = allocate((length * 2 + 2) * sizeof(unsigned short));
 		if (!characters)
 			return list;
 		written = halo_menus_utf16(strings[index], characters, length * 2 + 2);
@@ -1532,23 +1557,38 @@ static long pause_quit_button(struct ui_widget_definition const *list, long quit
 
 /* a button like the model (its look), its own text, each of the model's
 events (its A and Start) running the function and opening the widget (if
-not NONE) */
+not NONE); with other_text, a second text, which the game data input (input)
+chooses between */
 static void *pause_button(struct cache_file_tag_instance *instances, struct ui_widget_definition const *model,
-	char const *name, char const *text, long function, long widget_tag)
+	char const *name, char const *text, long function, long widget_tag, char const *other_text, long input)
 {
 	struct ui_widget_definition *button = allocate(sizeof(*button));
 	struct ui_widget_event_handler_reference *handlers =
 		allocate(model->event_handlers.count * sizeof(struct ui_widget_event_handler_reference));
 	long text_tag = next_tag(), handler;
+	char const *texts[2];
 
 	if (!button || !handlers)
 		return NULL;
 	memcpy(button, model, sizeof(*button));
-	instance_set(instances, UNICODE_STRING_LIST_TAG, text_tag, name, " text", string_list_build(&text, 1));
+	texts[0] = text;
+	texts[1] = other_text;
+	instance_set(instances, UNICODE_STRING_LIST_TAG, text_tag, name, " text",
+		string_list_build(texts, NULL, other_text ? 2 : 1, NULL));
 	reference_set(&button->text_label_string_list, UNICODE_STRING_LIST_TAG, text_tag);
 	button->string_list_index = 0;
 	button->game_data_inputs.count = 0;
 	button->game_data_inputs.address = NULL;
+	if (other_text)
+	{
+		struct ui_widget_game_data_input_reference *inputs = allocate(sizeof(*inputs));
+
+		if (!inputs)
+			return NULL;
+		inputs->function = (short)input;
+		button->game_data_inputs.count = 1;
+		button->game_data_inputs.address = inputs;
+	}
 	/* (the game's memcpy asserts on a NULL source, even for nothing) */
 	if (model->event_handlers.count)
 		memcpy(handlers, model->event_handlers.address, model->event_handlers.count * sizeof(*handlers));
@@ -1568,37 +1608,42 @@ static void *pause_button(struct cache_file_tag_instance *instances, struct ui_w
 	return button;
 }
 
-/* the list's buttons: SETTINGS (and the host's END GAME) put before LEAVE
-GAME (quit); returns how many were added, and how much taller the list
-grew for them (growth) */
+/* the list's buttons: SETTINGS, and the host's END GAME or network co-op's
+FRIENDLY FIRE (whose text says the machine's choice: menu_functions.c), put
+before LEAVE GAME or REVERT TO SAVED (quit); returns how many were added, and
+how much taller the list grew for them (growth) */
 static long pause_list_patch(struct cache_file_tag_instance *instances, struct ui_widget_definition *list, long quit,
 	boolean host, short *growth)
 {
 	struct ui_widget_child_reference *children = list->child_widgets.address;
-	long count = list->child_widgets.count, added = host ? 2 : 1, child;
+	long count = list->child_widgets.count, added = host || build.coop ? 2 : 1, child;
 	struct ui_widget_child_reference *grown = allocate((count + added) * sizeof(struct ui_widget_child_reference));
 	struct ui_widget_definition const *model = tag_get(UI_WIDGET_DEFINITION_TAG, children[quit].widget_tag.index);
 	long settings_widget = widget_named(PAUSE_SETTINGS_SCREEN);
 	short spacing = count >= 2 ? (short)(children[count - 1].vertical_offset - children[count - 2].vertical_offset) :
 		PAUSE_BUTTON_SPACING;
+	char const *names[2];
 	void *buttons[2];
 	long tags[2];
 
 	if (!grown || settings_widget == NONE || spacing <= 0)
 		return 0;
+	names[0] = "pause/settings_button";
 	tags[0] = next_tag();
-	buttons[0] = pause_button(instances, model, "pause/settings_button", "SETTINGS",
-		function_index("profile set edit begin", "pause", 0), build.widget_tags[settings_widget]);
-	tags[1] = host ? next_tag() : NONE;
-	buttons[1] = host ? pause_button(instances, model, "pause/end_game_button", "END GAME",
-		function_index("port pause end game", "pause", 0), NONE) : NULL;
-	if (!buttons[0] || (host && !buttons[1]))
+	buttons[0] = pause_button(instances, model, names[0], "SETTINGS",
+		function_index("profile set edit begin", "pause", 0), build.widget_tags[settings_widget], NULL, NONE);
+	names[1] = build.coop ? "pause/friendly_fire_button" : "pause/end_game_button";
+	tags[1] = added > 1 ? next_tag() : NONE;
+	buttons[1] = build.coop ?
+		pause_button(instances, model, names[1], "FRIENDLY FIRE ON",
+			function_index("port coop friendly fire", "pause", 0), NONE, "FRIENDLY FIRE OFF",
+			game_data_input_index("port coop friendly fire text", "pause", 0)) :
+		host ? pause_button(instances, model, names[1], "END GAME",
+			function_index("port pause end game", "pause", 0), NONE, NULL, NONE) : NULL;
+	if (!buttons[0] || (added > 1 && !buttons[1]))
 		return 0;
 	for (child = 0; child < added; child++)
-	{
-		instance_set(instances, UI_WIDGET_DEFINITION_TAG, tags[child],
-			child ? "pause/end_game_button" : "pause/settings_button", "", buttons[child]);
-	}
+		instance_set(instances, UI_WIDGET_DEFINITION_TAG, tags[child], names[child], "", buttons[child]);
 	if (quit)
 		memcpy(grown, children, quit * sizeof(*grown));
 	for (child = 0; child < added; child++)
@@ -1755,15 +1800,15 @@ static void pause_patch(struct cache_file_tag_instance *instances)
 		platform_log("menus: the pause menu has SETTINGS%s", host ? " and END GAME" : "");
 }
 
-/* ---------- the single-player campaign's pause menu
+/* ---------- the campaign's pause menu
 
 Its list gets the same SETTINGS (pause_list_patch) before REVERT TO SAVED, a
-copy of it. The rows use the PC version's pause menu's pitch, so a
-highlight sits clear of the next label. The prompts (B and A) stay that same
-gap under the last row, and the box beside the mission objectives grows with
-them. Settings there has only the items
-that work in a game (pause_settings_patch), and Gamepads' OK saves the
-profile itself. */
+copy of it, and in network co-op FRIENDLY FIRE after SETTINGS. The rows use
+the PC version's pause menu's pitch, so a highlight sits clear of the next
+label. The prompts (B and A) stay that same gap under the last row, and the
+box beside the mission objectives grows with them. Settings there has only
+the items that work in a game (pause_settings_patch), and Gamepads' OK saves
+the profile itself. */
 
 #define PAUSE_SETTINGS_LIST "main_menu/settings_select/player_setup/player_profile_edit/profile_edit_select_list"
 #define PAUSE_SETTINGS_GAMEPADS_OK "main_menu/settings_select/player_setup/player_profile_edit/gamepad_setup/button_ok"
@@ -1782,12 +1827,13 @@ static char const *const pause_settings_hidden_items[] =
 	"main_menu/settings_select/player_setup/player_profile_edit/about_item",
 };
 
-/* the PC version's pause menu's row pitch (30 apart). The third pause box
-frame is the stock 159 grown by the 36 that five rows at this pitch add
-(tools/port_settings.py) */
+/* the PC version's pause menu's row pitch (30 apart). The pause box's frames
+from the third, and the mission objectives' box's, are the stock 159 grown by
+the 36 that five rows at this pitch add (SETTINGS), then by the 66 that six
+add (network co-op's FRIENDLY FIRE too: tools/port_settings.py) */
 #define PAUSE_CAMPAIGN_ROW_PITCH 30
 #define PAUSE_CAMPAIGN_BOX_FRAME 2
-#define PAUSE_CAMPAIGN_BOX_HEIGHT 195
+static short const pause_campaign_box_heights[] = { 195, 225 };
 
 /* the port box piece for one of the map's pause box pieces, else NULL */
 static char const *pause_campaign_box_bitmap(long tag_index)
@@ -1877,9 +1923,14 @@ static void pause_campaign_grow_box(struct ui_widget_definition *widget, short s
 			/* (bitmap_name is the lookup, not piece_bitmap: find calls it) */
 			long bitmap = find(piece_bitmap, build.menus->bitmap_count, bitmap_name);
 			short height = (short)(child_widget->bounds.y1 - child_widget->bounds.y0);
-			short frame = strstr(piece_bitmap, "objectives_") ? 0 : PAUSE_CAMPAIGN_BOX_FRAME;
+			short frame = NONE, size;
 
-			if (bitmap != NONE && (short)(height + shift) == PAUSE_CAMPAIGN_BOX_HEIGHT)
+			for (size = 0; size < (short)NUMBEROF(pause_campaign_box_heights); size++)
+			{
+				if ((short)(height + shift) == pause_campaign_box_heights[size])
+					frame = (short)((strstr(piece_bitmap, "objectives_") ? 0 : PAUSE_CAMPAIGN_BOX_FRAME) + size);
+			}
+			if (bitmap != NONE && frame != NONE)
 			{
 				struct bitmap_group *group = bitmap_group_get(build.bitmap_tags[bitmap]);
 				struct bitmap_group_sequence *sequence = group ? group->sequences.address : NULL;
@@ -1889,7 +1940,7 @@ static void pause_campaign_grow_box(struct ui_widget_definition *widget, short s
 					sequence->first_bitmap_index = frame;
 					sequence->bitmap_count = 1;
 					reference_set(&child_widget->background_bitmap, BITMAP_GROUP_TAG, build.bitmap_tags[bitmap]);
-					child_widget->bounds.y1 = (short)(child_widget->bounds.y0 + PAUSE_CAMPAIGN_BOX_HEIGHT);
+					child_widget->bounds.y1 = (short)(child_widget->bounds.y0 + height + shift);
 				}
 			}
 			else
@@ -2068,7 +2119,7 @@ static void pause_campaign_patch(struct cache_file_tag_instance *instances)
 				pause_campaign_grow_box(definition, need);
 			}
 			pause_settings_patch();
-			platform_log("menus: the pause menu has SETTINGS");
+			platform_log("menus: the pause menu has SETTINGS%s", build.coop ? " and FRIENDLY FIRE" : "");
 		}
 		return;
 	}
@@ -2083,6 +2134,13 @@ static boolean full_screen_campaign_map(void)
 		(game_connection() != _game_connection_local || network_game_is_active() || !game_is_cooperative());
 }
 
+/* of those, a network game's: network co-op, whose pause menu gets FRIENDLY
+FIRE too */
+static boolean network_coop_campaign_map(void)
+{
+	return full_screen_campaign_map() && game_connection() != _game_connection_local && network_game_is_active();
+}
+
 /* whether display.menus asks for the PC version's menus: "pc" in any case
 (a value neither "pc" nor "xbox" is said once in the log, and is the Xbox's) */
 static boolean menus_pc_chosen(void)
@@ -2100,18 +2158,38 @@ static boolean menus_pc_chosen(void)
 	return FALSE;
 }
 
+/* whether the PC menus' text is the language of the maps' Custom Edition
+(display.menu_language), else English */
+static boolean menus_language_maps(void)
+{
+	static boolean said;
+	char const *value = config_string("display.menu_language");
+
+	if (!csstrcasecmp(value, "maps"))
+		return TRUE;
+	if (csstrcasecmp(value, "english") && !said)
+	{
+		platform_log("menus: display.menu_language \"%s\" is not \"maps\" or \"english\": English", value);
+		said = TRUE;
+	}
+	return FALSE;
+}
+
 void menu_tags_loaded(
 	char const *map_name)
 {
 	struct halo_menus const *menus;
 	struct cache_file_tag_instance *instances;
 	long widget_count, own_lists = 0, total, index;
+	boolean locale;
 
 	boolean game_map = strcmp(map_name, "ui") != 0;
 	boolean campaign = game_map && full_screen_campaign_map();
+	boolean coop = game_map && network_coop_campaign_map();
 
 	/* (ui.map, and a multiplayer map: its pause menu's SETTINGS; a
-	single-player campaign's too) */
+	campaign's too, single player's or network co-op's, which also gets
+	FRIENDLY FIRE) */
 	if ((game_map && tag_loaded('Soul', MULTIPLAYER_COLLECTION) == NONE && !campaign) ||
 		!menus_pc_chosen())
 	{
@@ -2129,6 +2207,7 @@ void menu_tags_loaded(
 	/* Settings must not pause the simulation in a network campaign. */
 	build.campaign = campaign && game_connection() == _game_connection_local &&
 		!network_game_is_active() && !game_is_cooperative();
+	build.coop = coop;
 	widget_count = menus->widget_count;
 	build.widget_tags = malloc((widget_count + 1) * sizeof(long));
 	build.text_tags = malloc((widget_count + 1) * sizeof(long));
@@ -2168,12 +2247,24 @@ void menu_tags_loaded(
 		instance_set(instances, BITMAP_GROUP_TAG, build.bitmap_tags[index], menus->bitmaps[index].name, "",
 			bitmap_build(&menus->bitmaps[index], build.bitmap_tags[index]));
 	}
+	/* (the PC version's strings in the language of the Custom Edition the
+	maps come from, its loc.map's, unless English is chosen) */
+	locale = menus_language_maps() && custom_edition_locale_open();
 	for (index = 0; index < menus->string_list_count && !build.failed; index++)
 	{
 		struct halo_menu_strings const *list = &menus->string_lists[index];
+		struct custom_edition_string_list *map = locale && list->map ? custom_edition_locale_strings(list->map) : NULL;
 
 		instance_set(instances, UNICODE_STRING_LIST_TAG, build.strings_tags[index], list->name, "",
-			string_list_build(menus->strings + list->first, list->count));
+			string_list_build(menus->strings + list->first, menus->string_maps + list->first, list->count, map));
+		if (map)
+			free(map);
+	}
+	if (locale)
+	{
+		custom_edition_locale_close();
+		if (!game_map)
+			platform_log("menus: %ld strings from the Custom Edition's loc.map", build.map_strings);
 	}
 	for (index = 0; index < widget_count && !build.failed; index++)
 	{
@@ -2182,7 +2273,7 @@ void menu_tags_loaded(
 		if (widget->text)
 		{
 			instance_set(instances, UNICODE_STRING_LIST_TAG, build.text_tags[index], widget->name, " text",
-				string_list_build(&widget->text, 1));
+				string_list_build(&widget->text, NULL, 1, NULL));
 		}
 		if (widget->strings)
 		{
@@ -2190,7 +2281,7 @@ void menu_tags_loaded(
 			long count = spinner_split(widget, FALSE, pieces);
 
 			instance_set(instances, UNICODE_STRING_LIST_TAG, build.spinner_tags[index], widget->name, " strings",
-				string_list_build(pieces, count));
+				string_list_build(pieces, NULL, count, NULL));
 		}
 		instance_set(instances, UI_WIDGET_DEFINITION_TAG, build.widget_tags[index], widget->name, "", NULL);
 	}

port/linux/game/model_detail.c

@@ -0,0 +1,90 @@
+/*
+MODEL_DETAIL.C
+
+The geometry each of a model's permutations draws when display.model_detail
+is "native" or "highest" (halo_model_detail_scale, port/linux/src/d3d8_gl.c),
+which choose the model's level of detail at sizes the Xbox's 480 lines
+rarely or never reached (render_model, source/models/models.c). "stock"
+draws each permutation at the model's level, as the Xbox did.
+
+Two kinds of a map's levels are not made for those sizes:
+- a permutation may have no geometry at a level, and draw nothing there:
+  "highest" would leave the part out at every distance, so it draws its
+  most detailed level below that has some;
+- a level whose cutoff is over 1000 pixels is the model's inside, made for
+  a camera within it (a10's cryotube's top level, at 3000, is the inside of
+  the tube without its outside), so it is drawn only while the camera is
+  inside the model's bounding sphere, and the level below otherwise.
+*/
+
+#include "cseries.h"
+#include "model_detail.h"
+#include "models/model_definitions.h"
+#include "rasterizer/rasterizer_console_vars.h"
+#include "render/render.h"
+#include "render/render_cameras.h"
+
+/* ---------- constants */
+
+enum
+{
+	/* the cutoff over which a level is a model's inside */
+	MODEL_DETAIL_INTERIOR_CUTOFF_PIXELS = 1000,
+};
+
+/* ---------- public code */
+
+short model_detail_rules(struct model const *model, real_point3d const *centroid, real radius)
+{
+	if (halo_model_detail_stock() || rasterizer_debug_options.debug_model_lod!=NONE)
+	{
+		return _model_detail_rules_stock;
+	}
+	return model_detail_camera_inside(model, &render.camera.position, centroid, radius) ?
+		_model_detail_rules_inside :
+		_model_detail_rules_outside;
+}
+
+boolean model_detail_camera_inside(struct model const *model, real_point3d const *camera,
+	real_point3d const *centroid, real radius)
+{
+	short level;
+
+	for (level = 0; level<(short)NUMBEROF(model->detail_cutoff_pixels); level++)
+	{
+		if (model->detail_cutoff_pixels[level]>MODEL_DETAIL_INTERIOR_CUTOFF_PIXELS)
+		{
+			real x, y, z;
+
+			/* (a sphere of no size, infinite or not a number holds nothing) */
+			if (!(radius>0.f && radius<=REAL_MAX))
+			{
+				return FALSE;
+			}
+			x = camera->x-centroid->x;
+			y = camera->y-centroid->y;
+			z = camera->z-centroid->z;
+			return x*x+y*y+z*z<radius*radius;
+		}
+	}
+	return FALSE;
+}
+
+short model_detail_geometry_index(struct model const *model,
+	struct model_region_permutation const *permutation, short level, short rules)
+{
+	if (rules==_model_detail_rules_stock)
+	{
+		return permutation->geometry_indices[level];
+	}
+	for (; level>=0; level--)
+	{
+		if (permutation->geometry_indices[level]!=NONE &&
+			(rules==_model_detail_rules_inside ||
+				model->detail_cutoff_pixels[level]<=MODEL_DETAIL_INTERIOR_CUTOFF_PIXELS))
+		{
+			return permutation->geometry_indices[level];
+		}
+	}
+	return NONE;
+}

port/linux/game/model_detail.h

@@ -0,0 +1,38 @@
+/*
+MODEL_DETAIL.H
+
+The geometry each of a model's permutations draws at the level of detail
+display.model_detail chose for the model (model_detail.c).
+*/
+
+#ifndef MODEL_DETAIL_H
+#define MODEL_DETAIL_H
+
+#include "math/real_math.h"
+
+struct model;
+struct model_region_permutation;
+
+/* how a model's permutations take its level (model_detail_rules) */
+enum
+{
+	/* each the model's level, as the Xbox did ("stock", or rasterizer_debug_model_lod) */
+	_model_detail_rules_stock,
+	/* each its most detailed level at or below the model's that has geometry,
+	not one of the model's inside */
+	_model_detail_rules_outside,
+	/* the same, the camera being inside the model, whose inside it sees */
+	_model_detail_rules_inside,
+};
+
+/* the rules for a model drawn this frame, its bounding sphere in the world */
+short model_detail_rules(struct model const *model, real_point3d const *centroid, real radius);
+/* whether the camera is inside a model that has levels of its inside only:
+FALSE for any other model, and for a sphere that is not one */
+boolean model_detail_camera_inside(struct model const *model, real_point3d const *camera,
+	real_point3d const *centroid, real radius);
+/* the geometry a permutation draws for the model's level, NONE for none */
+short model_detail_geometry_index(struct model const *model,
+	struct model_region_permutation const *permutation, short level, short rules);
+
+#endif

port/linux/game/network_aim_assist.c

@@ -0,0 +1,80 @@
+/* Host policy for the mouse's optional magnetism. The user's preference
+   stays intact; a controller or touch aiming takes its usual path. */
+#include "cseries.h"
+#include "game/game.h"
+#include "interface/ui_widget.h"
+#include "main/main.h"
+#include "networking/network_game_globals.h"
+#include "network_distributed.h"
+#include "network_aim_assist.h"
+#include <string.h>
+
+int config_boolean(char const *name);
+static boolean client_blocks_mouse = TRUE;
+static short sent_policy = NONE;
+struct aim_assist_policy_message
+{
+    struct distributed_message_header header;
+    word block_mouse;
+    word reserved;
+};
+
+void network_aim_assist_reset(void)
+{
+    /* Until the host's reliable policy arrives, a client cannot opt in. */
+    client_blocks_mouse = TRUE;
+    sent_policy = NONE;
+}
+
+boolean network_aim_assist_block_mouse(void)
+{
+    if (!game_in_progress() || main_menu_is_active()) return FALSE;
+    if (game_connection() == _game_connection_network_server)
+        return config_boolean("network.block_mouse_aim_assist") != 0;
+    return game_connection() == _game_connection_network_client && client_blocks_mouse;
+}
+
+void network_aim_assist_send_policy(long machine_index)
+{
+    struct aim_assist_policy_message message;
+    if (game_connection() != _game_connection_network_server) return;
+    memset(&message, 0, sizeof(message));
+    message.block_mouse = config_boolean("network.block_mouse_aim_assist") != 0;
+    distributed_send_to_machine_reliably(machine_index, &message,
+        _distributed_message_aim_assist_policy, 1, sizeof(message));
+}
+
+void network_aim_assist_update(void)
+{
+    struct aim_assist_policy_message message;
+    short policy;
+    if (!game_in_progress() || main_menu_is_active() ||
+        game_connection() != _game_connection_network_server) return;
+    policy = config_boolean("network.block_mouse_aim_assist") != 0;
+    if (sent_policy == policy) return;
+    sent_policy = policy;
+    memset(&message, 0, sizeof(message));
+    message.block_mouse = policy;
+    distributed_send(&message, _distributed_message_aim_assist_policy, 1,
+        sizeof(message), _distributed_to_clients_reliably);
+}
+
+boolean network_aim_assist_handles_message(word const *message, word size)
+{
+    struct distributed_message_header header;
+    if (size < sizeof(header)) return FALSE;
+    memcpy(&header, message, sizeof(header));
+    return header.type == _distributed_message_aim_assist_policy;
+}
+
+void network_aim_assist_handle_message(long machine_index, word const *data, word size)
+{
+    struct aim_assist_policy_message message;
+    if (machine_index != NONE || game_connection() != _game_connection_network_client ||
+        !game_in_progress() || main_menu_is_active() || network_connection_last_read_was_unreliable() || size != sizeof(message)) return;
+    memcpy(&message, data, sizeof(message));
+    if (GET_MESSAGE_TYPE(message.header.header) != 2 ||
+        message.header.type != _distributed_message_aim_assist_policy ||
+        message.header.count != 1 || message.block_mouse > 1 || message.reserved != 0) return;
+    client_blocks_mouse = message.block_mouse != 0;
+}

port/linux/game/network_aim_assist.h

@@ -0,0 +1,10 @@
+#ifndef NETWORK_AIM_ASSIST_H
+#define NETWORK_AIM_ASSIST_H
+#include "cseries.h"
+void network_aim_assist_reset(void);
+void network_aim_assist_update(void);
+void network_aim_assist_send_policy(long machine_index);
+boolean network_aim_assist_block_mouse(void);
+boolean network_aim_assist_handles_message(word const *message, word size);
+void network_aim_assist_handle_message(long machine_index, word const *message, word size);
+#endif

port/linux/game/network_coop.c

@@ -49,6 +49,12 @@ The host also makes up for scripts written for one player: vitality they
 set on player0 is set on every player (a10's shields), and a Pelican's
 Warthog drop brings more Warthogs in a larger game.
 
+Friendly fire between two players is also each player's own choice
+(network.coop_own_friendly_fire): both must play with it. A client's input
+says its choice, and the host, which alone deals damage, keeps everyone's.
+A player away from the controls for over 70 seconds is hurt by every
+player, whatever either chose, until their next input.
+
 Skipping a cutscene is a vote. Pressing the skip key during a skippable
 cutscene votes (a client sends its vote to the host every tick), and the
 host skips once more than half the machines have voted. The skip itself is
@@ -111,6 +117,8 @@ index and tag, since the map placed them at the same index everywhere.
 #include "sound/sound_definitions.h"
 #include "units/units.h"
 #include "coop_enemies.h"
+#include "coop_pickups.h"
+#include "coop_vehicles.h"
 #include "coop_spectate.h"
 #include "network_coop.h"
 #include "network_distributed.h"
@@ -168,6 +176,9 @@ enum
 	/* the types network_objects.c syncs; the object names sync skips them */
 	NETWORKED_OBJECT_TYPES = _object_mask_biped | _object_mask_vehicle | _object_mask_weapon | _object_mask_equipment,
 
+	/* a player with no input for longer than this is away from the controls:
+	every player's fire hurts them */
+	FRIENDLY_FIRE_AWAY_TICKS = 70 * TICKS_PER_SECOND,
 	/* the host forgets a client's skip vote it hasn't heard again for this long */
 	SKIP_VOTE_HELD_TICKS = TICKS_PER_SECOND,
 	/* After a skip the cutscene stays skippable until the script reaches
@@ -563,6 +574,8 @@ static struct
 static void client_play_presentation(void);
 /* unit_scripting_commands.c */
 void unit_scripting_set_current_vitality_of(long unit_index, real body_vitality, real shield_vitality);
+/* port_config.c */
+int config_boolean(char const *name);
 
 /* ---------- private code */
 
@@ -970,6 +983,17 @@ static struct
 NONE before its first input */
 static short host_player_structure_bsps[MAXIMUM_TRACKED_PLAYERS];
 
+/* host: each player's friendly fire, by the player's absolute index: whether
+they chose to play without it, the buttons of their last input, and the ticks
+since an input showed them at the controls */
+static struct friendly_fire_player
+{
+	long player_index;
+	boolean declined;
+	unsigned long control_flags;
+	long idle_ticks;
+} host_friendly_fire[MAXIMUM_TRACKED_PLAYERS];
+
 /* host, each tick: the devices that moved or changed power (and, with the
 resent state, all that ever have) */
 static void host_send_device_states(
@@ -1894,6 +1918,66 @@ static short coop_player_count(
 	return count;
 }
 
+/* host: the player's friendly fire, begun again for a new player in the place
+of one who left (NULL: no such player) */
+static struct friendly_fire_player *host_friendly_fire_player(
+	long player_index)
+{
+	long absolute_index = DATUM_INDEX_TO_ABSOLUTE_INDEX(player_index);
+	struct friendly_fire_player *entry;
+
+	if (player_index == NONE || absolute_index >= MAXIMUM_TRACKED_PLAYERS)
+		return NULL;
+	entry = &host_friendly_fire[absolute_index];
+	if (entry->player_index != player_index)
+	{
+		csmemset(entry, 0, sizeof(*entry));
+		entry->player_index = player_index;
+	}
+	return entry;
+}
+
+/* host, each tick: the host's own players' choice, and how long each player
+has been away from the controls. The input the tick ran for them shows them
+there if a button was pressed or let go, or a stick or the trigger is held
+(the game itself turns a player's view and chooses their weapon). */
+static void host_friendly_fire_update(
+	void)
+{
+	long update_number = update_server_ticked_update_number();
+	short action_count = 0;
+	struct player_action const *actions =
+		update_number != NONE ? update_server_update_actions(update_number, &action_count) : NULL;
+	struct data_iterator iterator;
+	struct player_datum *player;
+
+	data_iterator_new(&iterator, player_data);
+	while ((player = data_iterator_next(&iterator)) != NULL)
+	{
+		short absolute_index = (short)DATUM_INDEX_TO_ABSOLUTE_INDEX(iterator.datum_index);
+		struct friendly_fire_player *entry = host_friendly_fire_player(iterator.datum_index);
+		struct player_action const *action;
+
+		if (!entry)
+			continue;
+		if (player->local_player_index != NONE)
+			entry->declined = !network_coop_own_friendly_fire();
+		if (!actions || absolute_index >= action_count)
+			continue;
+		action = &actions[absolute_index];
+		if (action->control_flags != entry->control_flags || action->throttle.i != 0.0f ||
+			action->throttle.j != 0.0f || action->primary_trigger != 0.0f)
+		{
+			entry->idle_ticks = 0;
+		}
+		else if (entry->idle_ticks <= FRIENDLY_FIRE_AWAY_TICKS)
+		{
+			entry->idle_ticks++;
+		}
+		entry->control_flags = action->control_flags;
+	}
+}
+
 static boolean tag_name_has(
 	long definition_index,
 	char const *text)
@@ -1947,6 +2031,7 @@ void network_coop_new_game(
 	csmemset(host_sent_looks, 0, sizeof(host_sent_looks));
 	csmemset(host_sent_devices, 0, sizeof(host_sent_devices));
 	csmemset(host_player_structure_bsps, NONE, sizeof(host_player_structure_bsps));
+	csmemset(host_friendly_fire, 0, sizeof(host_friendly_fire));
 	csmemset(&host_sent_screen_effect, 0, sizeof(host_sent_screen_effect));
 	csmemset(&host_resend, 0, sizeof(host_resend));
 	csmemset(&players_vitality, 0, sizeof(players_vitality));
@@ -1960,6 +2045,8 @@ void network_coop_new_game(
 	skip_vote.cooldown_until = 0;
 	skip_vote.skip_save_written = FALSE;
 	coop_enemies_new_game();
+	coop_pickups_new_game();
+	coop_vehicles_new_game();
 }
 
 /* A network game on a campaign scenario with no game engine. Checking the
@@ -1984,6 +2071,40 @@ boolean network_coop_player_collisions(
 	return !TEST_FLAG(game->cooperative_flags, _network_game_cooperative_no_player_collisions_bit);
 }
 
+boolean network_coop_own_friendly_fire(
+	void)
+{
+	return config_boolean("network.coop_own_friendly_fire") != 0;
+}
+
+void network_coop_note_player_friendly_fire(
+	long player_index,
+	boolean friendly_fire)
+{
+	struct friendly_fire_player *entry = coop_host() ? host_friendly_fire_player(player_index) : NULL;
+
+	if (entry)
+		entry->declined = !friendly_fire;
+}
+
+boolean network_coop_players_friendly_fire(
+	long attacker_player_index,
+	long victim_player_index)
+{
+	struct friendly_fire_player *attacker, *victim;
+
+	/* (a client deals no damage, and a player's own fire is the game's) */
+	if (!coop_host() || attacker_player_index == victim_player_index)
+		return TRUE;
+	attacker = host_friendly_fire_player(attacker_player_index);
+	victim = host_friendly_fire_player(victim_player_index);
+	if (!attacker || !victim)
+		return TRUE;
+	/* one who is away is hurt whatever either chose; else both must play
+	with it */
+	return victim->idle_ticks > FRIENDLY_FIRE_AWAY_TICKS || (!attacker->declined && !victim->declined);
+}
+
 boolean network_coop_devices_remote(
 	void)
 {
@@ -2624,7 +2745,10 @@ void network_coop_host_tick(
 		return;
 	host_resend_update();
 	players_vitality_keep();
+	host_friendly_fire_update();
 	coop_enemies_update();
+	coop_pickups_update();
+	coop_vehicles_update();
 	host_count_skip_votes();
 	host_presentation(&message.presentation);
 	send_to_clients(&message, _distributed_message_coop_presentation, 1, sizeof(message.presentation));
@@ -3013,8 +3137,9 @@ static void client_presentation_apply(
 	a dead camera at the world origin. */
 	client_host_camera_set((coop_presentation.cinematic_started && presentation->camera_scripted &&
 		!coop_spectate_watching_rider(0)) || coop_spectate_nothing_to_watch(0));
-	if (coop_presentation.cinematic_started)
-		cinematic_show_letterbox(TEST_FLAG(presentation->flags, _presentation_letterbox_bit));
+	/* (also outside a cinematic: a cutscene that leaves the players their
+	controls shows the bars too) */
+	cinematic_show_letterbox(TEST_FLAG(presentation->flags, _presentation_letterbox_bit));
 	objects_port_set_activating_cluster((short)(presentation->activating_cluster - 1));
 	if (coop_presentation.host_camera)
 	{

port/linux/game/network_coop.h

@@ -48,6 +48,14 @@ boolean network_coop_active(void);
 /* whether the players collide with each other: FALSE in a co-op game whose
 host set Server Setup's PLAYER COLLISIONS off (bipeds.c, collisions.c) */
 boolean network_coop_player_collisions(void);
+/* whether this machine's players play with friendly fire between players
+(network.coop_own_friendly_fire: the pause menu's FRIENDLY FIRE) */
+boolean network_coop_own_friendly_fire(void);
+/* host: the choice a client's player's input says is theirs */
+void network_coop_note_player_friendly_fire(long player_index, boolean friendly_fire);
+/* host: whether one player's hit may hurt another: both chose friendly fire,
+or the one hit has been away from the controls for over 70 seconds */
+boolean network_coop_players_friendly_fire(long attacker_player_index, long victim_player_index);
 /* whether this machine is a co-op client, whose devices only the host moves */
 boolean network_coop_devices_remote(void);
 /* devices.c: a group's devices were set straight to its value */

port/linux/game/network_distributed.c

@@ -19,8 +19,9 @@ rest as the host has it:
   (player_queues_new.c).
 - Every tick, a client sends the host where its own players' units are (it
   predicts them from its own input); the host takes that as they are,
-  within a tolerance, as later Halo engines do, at its next tick (on a
-  moving elevator, only across: its own elevator takes them up and down).
+  within a tolerance, as later Halo engines do, at its next tick (riding
+  an elevator, moving or underfoot at rest, only across: its own elevator
+  takes them up and down).
 - Every tick, the host sends every client every player's unit: which unit
   the player has, alive or not, the seat it rides, its shields and health
   (down, recharging, the damage they show), and where it is (dead: who
@@ -76,7 +77,9 @@ machine (their datum identifiers need not be).
 #include "network_coop.h"
 #include "network_distributed.h"
 #include "network_voice.h"
+#include "network_aim_assist.h"
 #include "map_share.h"
+#include "latency_meter.h"
 #include "profile_sections.h"
 
 #include <limits.h>
@@ -108,7 +111,10 @@ void p2p_hardware_id_sanitize(char *destination, int size, const char *source);
 void p2p_discord_sanitize(char *destination, int size, const char *source, int name);
 void p2p_discord_identity(char *id, int id_size, char *name, int name_size);
 unsigned long p2p_peer_endpoint_address(unsigned long virtual_address);
+/* network_connection.c's */
+boolean network_connection_last_read_was_unreliable(void);
 unsigned long system_milliseconds(void);
+void platform_log(char const *format, ...);
 void console_warning(const char *format, ...);
 
 /* the host: a client's game run faster than its clock (a speed hack, which
@@ -128,6 +134,10 @@ host's copies go as its own ticks have them) ... */
 #define CLIENT_CLOCK_FAST_WINDOWS 5
 /* the longest notice's text (_distributed_message_notice) */
 #define MAXIMUM_NOTICE_LENGTH 160
+/* how far a datagram's tick may be from the latest a message from its
+sender had, either way (distributed_sender_times): as long as a machine may
+go silent before it is dropped */
+#define DISTRIBUTED_TIME_WINDOW_TICKS (15 * TICKS_PER_SECOND)
 /* a Discord user's id and name as kept, with their ends (p2p.h's
 P2P_DISCORD_ID_SIZE and P2P_DISCORD_NAME_SIZE) */
 #define DISCORD_ID_SIZE 24
@@ -182,6 +192,15 @@ enum
 	/* ... and beyond it, the ticks a client's own player may ride otherwise
 	than the host has it */
 	SEAT_DISAGREEMENT_SLACK_TICKS = 6,
+	/* the latency meter (latency_meter.c): the same round trips timed in
+	milliseconds, by when each of the last ticks was sent (a power of two,
+	more than the longest round trip); the longest shown; how often what is
+	shown is refreshed; and how long the host (to a client) or a client (to
+	the host) says nothing before it is said to have a connection problem */
+	TICK_SENT_TIMES = 64,
+	MAXIMUM_PING_MILLISECONDS = 9999,
+	PING_REFRESH_TICKS = TICKS_PER_SECOND / 2,
+	CONNECTION_PROBLEM_MILLISECONDS = 2000,
 	/* a client: where its own players' units were, the last ticks (a power
 	of two, more than the longest round trip) */
 	OWN_POSITION_TICKS = 64,
@@ -249,12 +268,24 @@ enum
 	_distributed_unit_part_killer_bit,
 };
 
+/* world units: how far apart the host's run of a client's player and the
+client's may be, a tick from the same place, and agree (distributed_divergence:
+well past the last bits' rounding, well short of a player running 1% faster) */
+#define DIVERGENCE_APART_DISTANCE 0.0001f
+
 /* world units: how far a client's own player's unit may be from the host's
 before the host takes it no longer, and before the client is put where the
 host has it (no further than that: between the two they would disagree for
 good, the host's player somewhere its own is not) */
 #define HOST_ACCEPT_TOLERANCE 3.5f
 #define LOCAL_CORRECTION_TOLERANCE 3.0f
+/* world units: how far below or above the host's echo of its prediction a
+client's own player standing on the same elevator may be and keep its own
+floor's height (distributed_correct_own_unit). The two machines' elevators
+are apart by what the platform travels in a round trip (the history below
+holds 64 ticks, two seconds); a greater difference is not that lag but a
+teleport, a fall or a platform out of step, and is corrected. */
+#define ELEVATOR_PHASE_TOLERANCE 4.0f
 /* how fast a client's own player's unit moves at most (world units a tick) */
 #define MAXIMUM_PREDICTED_SPEED 2.0f
 /* ... on foot: this many times as fast as a player runs and jumps, or as
@@ -332,7 +363,9 @@ struct distributed_player_input
 	byte player_index;
 	/* co-op: the structure BSP the client has loaded */
 	byte structure_bsp_index;
-	byte pad[2];
+	/* co-op: the player chose to play without friendly fire */
+	byte coop_no_friendly_fire;
+	byte pad;
 	/* the client's tick */
 	long tick;
 	/* the latest host tick the client has had a message of (the host
@@ -564,6 +597,8 @@ static struct distributed_own_position
 	long time;
 	long unit_index;
 	real_point3d position;
+	/* local history only: NONE after jumping or walking off the platform */
+	long elevator_index;
 } distributed_own_positions[MAXIMUM_LOCAL_PLAYERS][OWN_POSITION_TICKS];
 static real distributed_own_round_trip;
 /* the host: the players each machine had when it last told the host that it
@@ -621,6 +656,14 @@ static long distributed_game_state_time;
 /* the latest tick of each kind of unreliable message had from each sender
 (a machine, or the host), NONE for none */
 static long distributed_received_times[MAXIMUM_SENDERS][NUMBER_OF_DISTRIBUTED_MESSAGES];
+/* the latest tick of any message had from each sender, NONE for none: a
+datagram, which anyone can send as from another machine, is dropped when
+its tick is further from it than DISTRIBUTED_TIME_WINDOW_TICKS (one stamped
+far ahead would have every newer one of the sender's taken for stale, and
+its clock for fast); a message over the sender's stream, which only it can
+send, is taken whatever its tick, and moves it
+(distributed_message_time_bounded) */
+static long distributed_sender_times[MAXIMUM_SENDERS];
 /* the host: each client machine's clock, measured (CLIENT_CLOCK_WINDOW_MILLISECONDS):
 its latest tick, and its tick and the host's time as the window began
 (NONE: none begun); how many windows in a row it went fast, and whether
@@ -648,15 +691,45 @@ static struct distributed_client_clock
 /* the host: whether the message being handled came over its machine's
 stream (network_distributed_handle_stream_message) */
 static boolean distributed_handling_stream_message;
-/* a client: the host's latest tick it has had a message of */
+/* a client: the host's latest tick it has had a message of, and when that
+message came (system_milliseconds) */
 static long distributed_host_time = NONE;
-/* the host: each client's round trip, in ticks, and its jitter */
+static unsigned long distributed_host_time_received;
+/* the host: each client's round trip, in ticks, and its jitter; the same
+in milliseconds (the latency meter's); and when the client was last heard
+from (system_milliseconds) */
 static struct
 {
 	boolean valid;
 	real average;
 	real deviation;
+	boolean milliseconds_valid;
+	real milliseconds;
+	unsigned long heard;
+	/* (logged: silent since when it was heard, 0 for not silent) */
+	unsigned long silent_since;
 } distributed_round_trips[HALO_PORT_MAXIMUM_NETWORK_MACHINES];
+/* the latency meter: when each of this machine's last ticks was sent
+(system_milliseconds), by tick; a round trip coming back naming one of
+them is timed by it */
+static struct
+{
+	long time;
+	unsigned long milliseconds;
+} distributed_tick_sent_times[TICK_SENT_TIMES];
+/* ... a client: its own round trip in milliseconds, as the host has its
+players and tells it back, and whether it is measured; and since when the
+host has been silent (logged), 0 for not silent */
+static boolean distributed_own_ping_valid;
+static real distributed_own_ping_milliseconds;
+static unsigned long distributed_host_silent_since;
+/* ... what is shown (refreshed in the tick every PING_REFRESH_TICKS, so
+the render reads it whole): each player's round trip as this machine times
+it (the host: each client's, its own players' 0; a client: its own
+players'), a client's own, and the host's slowest client's; NONE for none */
+static long distributed_shown_pings[MAXIMUM_TRACKED_PLAYERS];
+static long distributed_shown_own_ping = NONE;
+static long distributed_shown_slowest_ping = NONE;
 /* a client: each player's ping as the host last told it (UNKNOWN_PING: not
 told) */
 static word distributed_player_pings[MAXIMUM_TRACKED_PLAYERS];
@@ -683,6 +756,35 @@ static struct
 	long received;
 	long corrections;
 } distributed_statistics;
+/* ... and (the host) how far apart a client's player moved in a tick on the
+client and on the host, where the host took the client's last prediction
+the tick before, that was of the client's tick before, and the host's tick
+ran the player with the client's input of that tick: both machines then
+moved the player one tick with the same input from much the same place, so
+builds that simulate alike move it alike to the last bit (but where the
+player touched something the two have in different places), and a build
+that moves a player otherwise moves it otherwise, every tick the player
+moves (tools/net_compare.py). The move, not where it ends: the host's
+copy is put only halfway to a prediction a little off, and would be as far
+off the next for ticks after. Since network_distributed_divergence last
+read them: how many such ticks, how many of them further apart than
+DIVERGENCE_APART_DISTANCE, and the mean and the largest distance. */
+static struct
+{
+	long samples;
+	long apart;
+	real total;
+	real largest;
+	/* the tick of the client's and of the host's last prediction taken */
+	long taken_time[MAXIMUM_TRACKED_PLAYERS];
+	long taken_host_time[MAXIMUM_TRACKED_PLAYERS];
+	/* where that prediction had the player, and where it left the host's */
+	real_point3d taken_position[MAXIMUM_TRACKED_PLAYERS];
+	real_point3d taken_host_position[MAXIMUM_TRACKED_PLAYERS];
+	/* the client's tick of the latest input the host has of each player
+	(what the host's tick ran it with) */
+	long input_time[MAXIMUM_TRACKED_PLAYERS];
+} distributed_divergence;
 
 /* ---------- shared (network_distributed.h) */
 
@@ -702,6 +804,22 @@ void distributed_count_correction(
 	distributed_statistics.corrections++;
 }
 
+void network_distributed_divergence(
+	long *samples,
+	long *apart,
+	real *mean,
+	real *largest)
+{
+	*samples = distributed_divergence.samples;
+	*apart = distributed_divergence.apart;
+	*mean = distributed_divergence.samples ? distributed_divergence.total / (real)distributed_divergence.samples : 0.0f;
+	*largest = distributed_divergence.largest;
+	distributed_divergence.samples = 0;
+	distributed_divergence.apart = 0;
+	distributed_divergence.total = 0.0f;
+	distributed_divergence.largest = 0.0f;
+}
+
 boolean distributed_real_valid(
 	real value)
 {
@@ -1275,6 +1393,7 @@ static boolean distributed_machine_loaded(
 		sizeof(distributed_machine_players[machine_index]));
 	for (type = 0; type < NUMBER_OF_DISTRIBUTED_MESSAGES; type++)
 		distributed_received_times[machine_index][type] = NONE;
+	distributed_sender_times[machine_index] = NONE;
 	csmemset(&distributed_round_trips[machine_index], 0, sizeof(distributed_round_trips[machine_index]));
 	csmemset(distributed_viewers[machine_index], 0, sizeof(distributed_viewers[machine_index]));
 	csmemset(&distributed_client_clocks[machine_index], 0, sizeof(distributed_client_clocks[machine_index]));
@@ -1347,6 +1466,210 @@ real distributed_machine_round_trip_ticks(
 	return distributed_round_trips[machine_index].average + 2.0f * distributed_round_trips[machine_index].deviation;
 }
 
+/* ---------- the latency meter's round trips */
+
+/* the milliseconds since this machine sent the messages of its tick (at
+most MAXIMUM_PING_MILLISECONDS), NONE if that tick is not one of the last
+TICK_SENT_TIMES */
+static long distributed_milliseconds_since_tick(
+	long time)
+{
+	unsigned long elapsed;
+
+	if (time == NONE || distributed_tick_sent_times[time & (TICK_SENT_TIMES - 1)].time != time)
+		return NONE;
+	elapsed = system_milliseconds() - distributed_tick_sent_times[time & (TICK_SENT_TIMES - 1)].milliseconds;
+	return elapsed > (unsigned long)MAXIMUM_PING_MILLISECONDS ? MAXIMUM_PING_MILLISECONDS : (long)elapsed;
+}
+
+/* a round trip in milliseconds into a smoothed one (as TCP smooths its own,
+an eighth), the first as it is */
+static void distributed_smooth_ping(
+	boolean *valid,
+	real *milliseconds,
+	long sample)
+{
+	if (!*valid)
+	{
+		*valid = TRUE;
+		*milliseconds = (real)sample;
+	}
+	else
+	{
+		*milliseconds += ((real)sample - *milliseconds) / 8.0f;
+	}
+}
+
+/* (a client) the milliseconds since the host's latest message came, NONE
+before the first */
+static long distributed_host_silence(
+	void)
+{
+	return distributed_host_time == NONE ? NONE : (long)(system_milliseconds() - distributed_host_time_received);
+}
+
+/* (the host) whether the client machine has said nothing for a while */
+static boolean distributed_machine_silent(
+	long machine_index)
+{
+	return game_engine_in_play() && machine_index >= 0 && machine_index < HALO_PORT_MAXIMUM_NETWORK_MACHINES &&
+		distributed_round_trips[machine_index].heard &&
+		system_milliseconds() - distributed_round_trips[machine_index].heard > CONNECTION_PROBLEM_MILLISECONDS;
+}
+
+/* (a client) the host has its players (or its vehicle) at that tick of this
+machine's, as told now: its own round trip timed */
+void distributed_note_own_round_trip(
+	long time)
+{
+	long sample = distributed_milliseconds_since_tick(time);
+
+	if (sample != NONE && game_connection() == _game_connection_network_client)
+		distributed_smooth_ping(&distributed_own_ping_valid, &distributed_own_ping_milliseconds, sample);
+}
+
+/* what the latency meter shows, refreshed in the tick (with Latency meter
+On): a client's own round trip, the host's slowest client's (one silent
+for a while as long as it has been); and in the log, each connection
+problem as it starts and ends, and the round trips every ten seconds */
+static void distributed_refresh_pings(
+	void)
+{
+	short connection = game_connection();
+	short player_index;
+
+	distributed_shown_own_ping = NONE;
+	distributed_shown_slowest_ping = NONE;
+	if (connection == _game_connection_network_client && distributed_own_ping_valid)
+		distributed_shown_own_ping = (long)(distributed_own_ping_milliseconds + 0.5f);
+	for (player_index = 0; player_index < MAXIMUM_TRACKED_PLAYERS; player_index++)
+	{
+		long ping = NONE;
+
+		if (!distributed_player(player_index))
+			;
+		else if (connection == _game_connection_network_server)
+		{
+			long machine_index = distributed_player_machines[player_index];
+
+			if (machine_index == NONE)
+				ping = 0;
+			else if (machine_index >= 0 && machine_index < HALO_PORT_MAXIMUM_NETWORK_MACHINES &&
+				distributed_round_trips[machine_index].milliseconds_valid)
+			{
+				ping = (long)(distributed_round_trips[machine_index].milliseconds + 0.5f);
+			}
+		}
+		else if (distributed_player_is_local(player_index))
+		{
+			ping = distributed_shown_own_ping;
+		}
+		distributed_shown_pings[player_index] = ping;
+	}
+	if (connection == _game_connection_network_server)
+	{
+		long machine_indices[HALO_PORT_MAXIMUM_NETWORK_MACHINES];
+		short count = distributed_client_machines(machine_indices, HALO_PORT_MAXIMUM_NETWORK_MACHINES);
+		boolean log_round_trips = game_time_get() % (10 * TICKS_PER_SECOND) == 0;
+		char line[512];
+		int length = 0;
+		short index;
+
+		line[0] = 0;
+		for (index = 0; index < count; index++)
+		{
+			long machine_index = machine_indices[index];
+			boolean silent;
+			long ping;
+
+			if (machine_index < 0 || machine_index >= HALO_PORT_MAXIMUM_NETWORK_MACHINES)
+				continue;
+			silent = distributed_machine_silent(machine_index);
+			if (silent && !distributed_round_trips[machine_index].silent_since)
+			{
+				distributed_round_trips[machine_index].silent_since = distributed_round_trips[machine_index].heard;
+				platform_log("latency: machine %ld silent for %lu ms: connection problem", machine_index,
+					system_milliseconds() - distributed_round_trips[machine_index].heard);
+			}
+			else if (!silent && distributed_round_trips[machine_index].silent_since)
+			{
+				platform_log("latency: machine %ld heard again after %lu ms", machine_index,
+					distributed_round_trips[machine_index].heard - distributed_round_trips[machine_index].silent_since);
+				distributed_round_trips[machine_index].silent_since = 0;
+			}
+			if (!distributed_round_trips[machine_index].milliseconds_valid)
+				continue;
+			ping = (long)(distributed_round_trips[machine_index].milliseconds + 0.5f);
+			if (silent)
+			{
+				ping = MAX(ping, (long)MIN(system_milliseconds() - distributed_round_trips[machine_index].heard,
+					(unsigned long)MAXIMUM_PING_MILLISECONDS));
+			}
+			distributed_shown_slowest_ping = MAX(distributed_shown_slowest_ping, ping);
+			if (log_round_trips && length < (int)sizeof(line) - 64)
+			{
+				length += snprintf(line + length, sizeof(line) - length, "%s machine %ld %ld ms (%.1f ticks)%s",
+					length ? "," : "", machine_index, ping, distributed_round_trips[machine_index].average,
+					silent ? " silent" : "");
+			}
+		}
+		if (length)
+			platform_log("latency: the clients' round trips:%s", line);
+	}
+	else if (connection == _game_connection_network_client)
+	{
+		boolean problem = distributed_connection_problem();
+
+		if (problem && !distributed_host_silent_since)
+		{
+			distributed_host_silent_since = distributed_host_time_received ? distributed_host_time_received : 1;
+			platform_log("latency: the host silent for %ld ms: connection problem", distributed_host_silence());
+		}
+		else if (!problem && distributed_host_silent_since)
+		{
+			platform_log("latency: the host heard again after %lu ms",
+				distributed_host_time_received - distributed_host_silent_since);
+			distributed_host_silent_since = 0;
+		}
+		if (game_time_get() % (10 * TICKS_PER_SECOND) == 0 && distributed_own_ping_valid)
+		{
+			platform_log("latency: round trip to the host %ld ms (%.1f ticks)%s", distributed_shown_own_ping,
+				distributed_own_round_trip, problem ? ", connection problem" : "");
+		}
+	}
+}
+
+long distributed_player_measured_ping(
+	short player_index)
+{
+	return player_index >= 0 && player_index < MAXIMUM_TRACKED_PLAYERS ? distributed_shown_pings[player_index] : NONE;
+}
+
+long distributed_own_ping(
+	void)
+{
+	return game_connection() == _game_connection_network_client ? distributed_shown_own_ping : NONE;
+}
+
+long distributed_slowest_client_ping(
+	void)
+{
+	return game_connection() == _game_connection_network_server ? distributed_shown_slowest_ping : NONE;
+}
+
+boolean distributed_connection_problem(
+	void)
+{
+	/* (a game over: the host sends nothing of it) */
+	if (game_connection() == _game_connection_network_client && game_engine_in_play())
+	{
+		long silence = distributed_host_silence();
+
+		return silence != NONE && silence > CONNECTION_PROBLEM_MILLISECONDS;
+	}
+	return FALSE;
+}
+
 /* ---------- units */
 
 static void distributed_state_from_player(
@@ -1630,6 +1953,26 @@ static boolean distributed_apply_state(
 	return TRUE;
 }
 
+/* the elevator a unit stands on this tick, or NONE. A remembered elevator
+lasts after a jump. Only a current floor contact allows ignoring a height
+difference caused by the platforms' different phases. biped_update_moving
+(bipeds.c) sets elevator_ticks to 60 each tick the biped's physics finds it
+on an elevator, and counts it down from then on. */
+static long distributed_supported_elevator(
+	long unit_index)
+{
+	struct biped_datum *biped = (struct biped_datum *)object_try_and_get_and_verify_type(unit_index,
+		_object_mask_biped);
+	struct device_datum *elevator;
+
+	if (!biped || TEST_FLAG(biped->biped.flags, _biped_airborne_bit) ||
+		biped->biped.support_surface_index == NONE || biped->biped.elevator_ticks != 60)
+		return NONE;
+	elevator = (struct device_datum *)object_try_and_get_and_verify_type(biped->biped.elevator_object_index,
+		_object_mask_machine);
+	return elevator ? biped->biped.elevator_object_index : NONE;
+}
+
 /* (a client) where its own players' units are this tick, noted */
 static void distributed_note_own_positions(
 	void)
@@ -1649,6 +1992,7 @@ static void distributed_note_own_positions(
 			unit_index = NONE;
 		own->time = game_time_get();
 		own->unit_index = unit_index;
+		own->elevator_index = unit_index != NONE ? distributed_supported_elevator(unit_index) : NONE;
 		if (unit_index != NONE)
 			own->position = object_get(unit_index)->object.position;
 	}
@@ -1695,9 +2039,21 @@ static void distributed_correct_own_unit(
 				distributed_own_round_trip = (real)(now - time);
 			else
 				distributed_own_round_trip += ((real)(now - time) - distributed_own_round_trip) / 8.0f;
+			distributed_note_own_round_trip(time);
 			error.i = state->position.x - own->position.x;
 			error.j = state->position.y - own->position.y;
 			error.k = state->position.z - own->position.z;
+			/* The host echoes our prediction on its own elevator's floor. If
+			we still stand on that platform, a small height error is its phase
+			lag, not player motion. Keep local floor contact; teleports across,
+			a height error past the lag, a jump, a different platform and
+			unpredicted states correct normally. */
+			if (own->elevator_index != NONE &&
+				own->elevator_index == distributed_supported_elevator(unit_index) &&
+				error.i * error.i + error.j * error.j <=
+					LOCAL_CORRECTION_TOLERANCE * LOCAL_CORRECTION_TOLERANCE &&
+				error.k >= -ELEVATOR_PHASE_TOLERANCE && error.k <= ELEVATOR_PHASE_TOLERANCE)
+				error.k = 0.0f;
 			if (!(error.i * error.i + error.j * error.j + error.k * error.k >
 				LOCAL_CORRECTION_TOLERANCE * LOCAL_CORRECTION_TOLERANCE))
 			{
@@ -2028,9 +2384,12 @@ static boolean distributed_on_foot_move_valid(
 	return dx * dx + dy * dy + rise * rise <= reach * reach && -dz <= fall_reach;
 }
 
-/* (the host) whether a unit rides an elevator that is moving (bipeds.c's
-elevator, kept a moment after the unit leaves its floor, as in a jump) */
-static boolean distributed_riding_moving_elevator(
+/* (the host) whether a unit rides an elevator: one that is moving (bipeds.c's
+elevator, kept a moment after the unit leaves its floor, as in a jump), or
+one at rest whose floor it stands on, since a stop or reversal must not
+admit a delayed height under the floor. The remembered elevator alone, after
+leaving a stopped one, is not riding it. */
+static boolean distributed_riding_elevator(
 	long unit_index)
 {
 	struct biped_datum *biped = (struct biped_datum *)object_try_and_get_and_verify_type(unit_index,
@@ -2040,19 +2399,21 @@ static boolean distributed_riding_moving_elevator(
 	if (!biped || biped->biped.elevator_object_index == NONE)
 		return FALSE;
 	elevator = (struct device_datum *)object_try_and_get_and_verify_type(biped->biped.elevator_object_index,
-		_object_mask_device);
-	return elevator && elevator->device.position_velocity != 0.0f;
+		_object_mask_machine);
+	return elevator && (elevator->device.position_velocity != 0.0f ||
+		distributed_supported_elevator(unit_index) != NONE);
 }
 
 /* (the host) a client's player's prediction of its unit on foot, taken
-where it says within a tolerance (distributed_apply_predictions). Riding a
-moving elevator, only across: a client's elevator follows the host's
-(network_coop.c), behind it by the time the host's word takes to come, and
-the client's prediction a round trip behind the host's elevator when it
-comes. Taken up and down too, it would put the host's unit under its own
-elevator's floor going up, to fall through it, and the client's after it
-(distributed_correct_own_unit); each machine's elevator carries its own
-unit up and down as it moves, and they meet where it stops. */
+where it says within a tolerance (distributed_apply_predictions). Riding an
+elevator (distributed_riding_elevator), only across: a client's elevator
+follows the host's (network_coop.c), behind it by the time the host's word
+takes to come, and the client's prediction a round trip behind the host's
+elevator when it comes. Taken up and down too, it would put the host's unit
+under its own elevator's floor going up, to fall through it, and the
+client's after it (distributed_correct_own_unit); each machine's elevator
+carries its own unit up and down as it moves, and they meet where it
+stops. */
 static void distributed_take_prediction(
 	short player_index,
 	long unit_index,
@@ -2064,11 +2425,35 @@ static void distributed_take_prediction(
 	real_point3d position = state->position;
 	real dx, dy, dz;
 
-	if (distributed_riding_moving_elevator(unit_index))
+	if (distributed_riding_elevator(unit_index))
 		position.z = object->object.position.z;
 	dx = position.x - object->object.position.x;
 	dy = position.y - object->object.position.y;
 	dz = position.z - object->object.position.z;
+	/* (for the tests' reports: a tick on from the last taken, on both, with
+	the input the client's tick ran: an input's tick is the client's time
+	before it ran, a prediction's after; the prediction's time is the
+	client's word, kept from overflowing) */
+	if (distributed_divergence.taken_host_time[player_index] == now - 1 &&
+		distributed_predictions[player_index].time != LONG_MIN &&
+		distributed_divergence.taken_time[player_index] == distributed_predictions[player_index].time - 1 &&
+		distributed_divergence.input_time[player_index] == distributed_predictions[player_index].time - 1)
+	{
+		real_point3d const *client_from = &distributed_divergence.taken_position[player_index];
+		real_point3d const *host_from = &distributed_divergence.taken_host_position[player_index];
+		real mx = (position.x - client_from->x) - (object->object.position.x - host_from->x);
+		real my = (position.y - client_from->y) - (object->object.position.y - host_from->y);
+		real mz = (position.z - client_from->z) - (object->object.position.z - host_from->z);
+		real distance = (real)sqrt(mx * mx + my * my + mz * mz);
+
+		distributed_divergence.samples++;
+		if (distance > DIVERGENCE_APART_DISTANCE)
+			distributed_divergence.apart++;
+		distributed_divergence.total += distance;
+		if (distance > distributed_divergence.largest)
+			distributed_divergence.largest = distance;
+	}
+	distributed_divergence.taken_host_time[player_index] = NONE;
 	if (!(dx * dx + dy * dy + dz * dz <= HOST_ACCEPT_TOLERANCE * HOST_ACCEPT_TOLERANCE))
 		return;
 	if (distributed_accepted[player_index].valid)
@@ -2107,6 +2492,10 @@ static void distributed_take_prediction(
 	{
 		distributed_predictions[player_index].taken_time = distributed_predictions[player_index].time;
 		distributed_predictions[player_index].taken_host_time = now;
+		distributed_divergence.taken_time[player_index] = distributed_predictions[player_index].time;
+		distributed_divergence.taken_host_time[player_index] = now;
+		distributed_divergence.taken_position[player_index] = position;
+		distributed_divergence.taken_host_position[player_index] = object->object.position;
 		/* (a new anchor: the first, one a second on, or after a jump) */
 		if (!distributed_accepted[player_index].valid ||
 			now - distributed_accepted[player_index].host_time >= PREDICTION_ANCHOR_TICKS)
@@ -2369,6 +2758,7 @@ static void distributed_client_send_inputs(
 			continue;
 		input->player_index = distributed_player_to_byte(player_index);
 		input->structure_bsp_index = (byte)global_structure_bsp_index_get();
+		input->coop_no_friendly_fire = network_coop_active() && !network_coop_own_friendly_fire();
 		input->host_time = distributed_host_time;
 		count++;
 	}
@@ -2443,8 +2833,22 @@ static void distributed_handle_inputs(
 		if (network_coop_active() && player->unit_index != NONE)
 			distributed_note_input_actions(input->player_index, &action);
 		network_coop_note_player_structure_bsp(input->player_index, input->structure_bsp_index);
+		network_coop_note_player_friendly_fire(DATUM_INDEX_NEW(input->player_index, player->identifier),
+			!input->coop_no_friendly_fire);
 		update_server_handle_distributed_input(DATUM_INDEX_NEW(input->player_index, player->identifier), input->tick,
 			&action, input->control_flags, DISTRIBUTED_INPUT_HISTORY);
+		/* (for the tests' reports: the newest, as the input taken is, or one
+		a second or more older, the client's clock set back; the subtraction
+		kept from overflowing, as the tick is the client's word) */
+		{
+			long newest = distributed_divergence.input_time[input->player_index];
+
+			if (newest == NONE || input->tick > newest ||
+				(newest >= LONG_MIN + TICKS_PER_SECOND && input->tick < newest - TICKS_PER_SECOND))
+			{
+				distributed_divergence.input_time[input->player_index] = input->tick;
+			}
+		}
 		if (input->host_time != NONE && (host_time == NONE || input->host_time > host_time))
 			host_time = input->host_time;
 	}
@@ -2472,6 +2876,17 @@ static void distributed_handle_inputs(
 					((real)fabs(difference) - distributed_round_trips[machine_index].deviation) / 4.0f;
 			}
 		}
+		/* (the same timed in milliseconds, for the latency meter: by when
+		this machine sent that tick) */
+		{
+			long milliseconds = distributed_milliseconds_since_tick(host_time);
+
+			if (milliseconds != NONE)
+			{
+				distributed_smooth_ping(&distributed_round_trips[machine_index].milliseconds_valid,
+					&distributed_round_trips[machine_index].milliseconds, milliseconds);
+			}
+		}
 	}
 }
 
@@ -3337,6 +3752,7 @@ void network_distributed_new_game(
 		distributed_batches[sender].size = 0;
 		for (type = 0; type < NUMBER_OF_DISTRIBUTED_MESSAGES; type++)
 			distributed_received_times[sender][type] = NONE;
+		distributed_sender_times[sender] = NONE;
 	}
 	for (player_index = 0; player_index < MAXIMUM_TRACKED_PLAYERS; player_index++)
 	{
@@ -3354,12 +3770,29 @@ void network_distributed_new_game(
 	}
 	distributed_own_round_trip = 0.0f;
 	csmemset(distributed_player_pings, 0xFF, sizeof(distributed_player_pings));
+	distributed_own_ping_valid = FALSE;
+	distributed_own_ping_milliseconds = 0.0f;
+	distributed_host_silent_since = 0;
+	distributed_shown_own_ping = NONE;
+	distributed_shown_slowest_ping = NONE;
+	for (player_index = 0; player_index < MAXIMUM_TRACKED_PLAYERS; player_index++)
+		distributed_shown_pings[player_index] = NONE;
+	for (type = 0; type < TICK_SENT_TIMES; type++)
+		distributed_tick_sent_times[type].time = NONE;
 	csmemset(distributed_machine_players, 0xFF, sizeof(distributed_machine_players));
 	distributed_machines.in_tick = FALSE;
 	distributed_machines.valid = FALSE;
 	distributed_host_time = NONE;
 	distributed_statistics_due = FALSE;
 	distributed_pickup_count = 0;
+	/* (the tests' drift figures: none taken, no input had, of this game) */
+	csmemset(&distributed_divergence, 0, sizeof(distributed_divergence));
+	for (player_index = 0; player_index < MAXIMUM_TRACKED_PLAYERS; player_index++)
+	{
+		distributed_divergence.taken_time[player_index] = NONE;
+		distributed_divergence.taken_host_time[player_index] = NONE;
+		distributed_divergence.input_time[player_index] = NONE;
+	}
 	/* (each player's latest input: player_queues_new.c) */
 	update_queues_distributed_reset();
 	network_objects_new_game();
@@ -3368,6 +3801,7 @@ void network_distributed_new_game(
 	bots_new_game();
 	network_actors_new_game();
 	network_coop_new_game();
+	network_aim_assist_reset();
 	network_votekick_new_game();
 }
 
@@ -3412,6 +3846,8 @@ void network_distributed_tick(
 		distributed_statistics_due = FALSE;
 		if (game_time_get() % PING_INTERVAL_TICKS == 0)
 			profile_scope(distributed_tick_send_pings_section, distributed_send_pings();)
+		if (game_time_get() % PING_REFRESH_TICKS == 0 && latency_meter_enabled())
+			distributed_refresh_pings();
 		/* (before the players, so clients load a new BSP before they hear
 		where the host moved everyone into it) */
 		if (network_coop_active() && (global_structure_bsp_index_get() != distributed_sent_structure_bsp_index ||
@@ -3432,6 +3868,8 @@ void network_distributed_tick(
 	else if (connection == _game_connection_network_client)
 	{
 		profile_scope(distributed_tick_note_own_positions_section, distributed_note_own_positions();)
+		if (game_time_get() % PING_REFRESH_TICKS == 0 && latency_meter_enabled())
+			distributed_refresh_pings();
 		profile_scope(distributed_tick_send_inputs_section, distributed_client_send_inputs();)
 		network_vr_tick();
 		profile_scope(distributed_tick_send_predictions_section, distributed_client_send_predictions();)
@@ -3439,11 +3877,70 @@ void network_distributed_tick(
 		profile_scope(distributed_tick_damage_client_tick_section, network_damage_client_tick();)
 		profile_scope(distributed_tick_coop_client_tick_section, network_coop_client_tick();)
 	}
+	/* (when this tick's messages were sent: the round trips that name it
+	are timed by it) */
+	distributed_tick_sent_times[game_time_get() & (TICK_SENT_TIMES - 1)].time = game_time_get();
+	distributed_tick_sent_times[game_time_get() & (TICK_SENT_TIMES - 1)].milliseconds = system_milliseconds();
 	profile_scope(distributed_tick_batches_flush_section, distributed_batches_flush();)
 	distributed_machines.in_tick = FALSE;
 	distributed_machines.valid = FALSE;
 }
 
+/* whether a message's tick is near enough the latest had from its sender
+to be taken (distributed_sender_times); from_stream: it came over the
+sender's stream (or a client's connection to the host), not in a datagram */
+static boolean distributed_message_time_bounded(
+	long machine_index,
+	long game_time,
+	boolean from_stream)
+{
+	short sender = machine_index == NONE ? HOST_SENDER : (short)machine_index;
+	long *latest;
+	unsigned long distance;
+	short type;
+
+	if (sender < 0 || sender >= MAXIMUM_SENDERS)
+		return FALSE;
+	latest = &distributed_sender_times[sender];
+	if (*latest == NONE)
+	{
+		*latest = game_time;
+		return TRUE;
+	}
+	/* (unsigned: no tick, however far, overflows it) */
+	distance = game_time > *latest ?
+		(unsigned long)game_time - (unsigned long)*latest :
+		(unsigned long)*latest - (unsigned long)game_time;
+	if (distance > DISTRIBUTED_TIME_WINDOW_TICKS)
+	{
+		static unsigned long last_logged_time;
+		static boolean logged;
+
+		if (!from_stream)
+		{
+			unsigned long now = system_milliseconds();
+
+			if (!logged || now - last_logged_time >= 1000)
+			{
+				error(_error_silent, "distributed message stamped %ld ticks from its sender's latest in a datagram; dropped",
+					game_time > *latest ? (long)distance : -(long)distance);
+				last_logged_time = now;
+				logged = TRUE;
+			}
+			return FALSE;
+		}
+		/* (the sender's own word: what a datagram sent as from it had moved
+		its latest to is forgotten) */
+		*latest = game_time;
+		for (type = 0; type < NUMBER_OF_DISTRIBUTED_MESSAGES; type++)
+			distributed_received_times[sender][type] = NONE;
+		return TRUE;
+	}
+	if (game_time > *latest)
+		*latest = game_time;
+	return TRUE;
+}
+
 /* whether an unreliable message of the kind is older than one had already
 (then it is dropped: the newer has overtaken it) */
 static boolean distributed_message_stale(
@@ -3628,7 +4125,8 @@ unsigned long distributed_machine_real_address(
 }
 
 /* (the host) a client machine's address as text: its real one, for an
-internet play peer's stand-in (p2p.c) */
+internet play peer's stand-in (p2p.c). Whole, for the host's own CHEATERS_FILE
+and BANS_FILE, which match on it: never for the log (log_address.h) */
 static void distributed_address_text(
 	unsigned long address,
 	char *text,
@@ -3979,6 +4477,11 @@ void network_distributed_handle_message(
 	word entry_size;
 
 	/* (voice chat's, in the lobby too: network_voice.c) */
+	if (network_aim_assist_handles_message(message, size))
+	{
+		network_aim_assist_handle_message(machine_index, message, size);
+		return;
+	}
 	if (network_voice_handles_message(message, size))
 	{
 		network_voice_handle_message(machine_index, message, size);
@@ -4090,6 +4593,15 @@ void network_distributed_handle_message(
 	}
 	distributed_statistics.received++;
 
+	/* (the kinds a client sends only over its stream: in a datagram, which
+	anyone can send as from it, they are not its) */
+	if ((header.type == _distributed_message_client_ready ||
+			header.type == _distributed_message_client_identity ||
+			header.type == _distributed_message_hit_reports) &&
+		!distributed_handling_stream_message)
+	{
+		return;
+	}
 	/* (each kind from the host, or from a client; a VR player's hands
 	both ways) */
 	if (header.type == _distributed_message_vr_poses)
@@ -4116,16 +4628,28 @@ void network_distributed_handle_message(
 	case _distributed_message_chat_up:
 		if (machine_index == NONE || game_connection() != _game_connection_network_server)
 			return;
+		/* (heard from: the latency meter's connection problem) */
+		if (machine_index >= 0 && machine_index < HALO_PORT_MAXIMUM_NETWORK_MACHINES)
+			distributed_round_trips[machine_index].heard = system_milliseconds();
 		break;
 	default:
 		if (game_connection() != _game_connection_network_client)
 			return;
-		/* (the host's latest tick, which this client's input messages tell
-		it back) */
-		if (distributed_host_time == NONE || header.game_time > distributed_host_time)
-			distributed_host_time = header.game_time;
 		break;
 	}
+	if (!distributed_message_time_bounded(machine_index, header.game_time,
+		machine_index == NONE ? !network_connection_last_read_was_unreliable() : distributed_handling_stream_message))
+	{
+		return;
+	}
+	/* (a client: the host's latest tick, which its input messages tell it
+	back; and when it came, the latency meter's) */
+	if (machine_index == NONE &&
+		(distributed_host_time == NONE || header.game_time > distributed_host_time))
+	{
+		distributed_host_time = header.game_time;
+		distributed_host_time_received = system_milliseconds();
+	}
 	if ((distributed_handling_batch || header.type != _distributed_message_damage_events) &&
 		distributed_message_stale(machine_index, &header))
 	{
@@ -4293,6 +4817,7 @@ void network_distributed_handle_message(
 
 		/* (its count 1: the client asks again, having failed to make one of
 		the host's objects) */
+		network_aim_assist_send_policy(machine_index);
 		network_objects_client_asked(machine_index, header.count != 0);
 		/* (a machine new at its index, which may have joined the game in
 		progress: every player's statistics and the game type's state, after

port/linux/game/network_distributed.h

@@ -134,6 +134,10 @@ enum
 	may chat and send links, to every client, reliably */
 	_distributed_message_chat_config = 89,
 
+	/* the host's mouse aim assist policy (network_aim_assist.c), to every
+	client, reliably, when it is ready and when the policy changes */
+	_distributed_message_aim_assist_policy = 90,
+
 	/* The VR port's own messages, numbered far past the game's (240 on),
 	so that messages upstream adds never take their numbers: a build
 	without them drops them, as it drops any type past its own. */
@@ -250,6 +254,23 @@ real distributed_own_round_trip_ticks(void);
 back, as the host measures it) in milliseconds: 0 for the host's own
 players, NONE before it is known */
 long distributed_player_ping(short player_index);
+/* the latency meter (latency_meter.c): the round trips above timed in
+milliseconds by when this machine sent the tick they come back naming,
+nothing more sent; what is shown of them is refreshed twice a second in the
+tick (with Latency meter On), so the render reads it whole. (A client) its
+round trip to the host, NONE before it is known or on the host */
+long distributed_own_ping(void);
+/* a player's round trip as this machine times it: the host each client's
+(its own players' 0), a client its own players'; NONE for another's, or
+before it is known */
+long distributed_player_measured_ping(short player_index);
+/* (the host) its slowest client's, NONE for none */
+long distributed_slowest_client_ping(void);
+/* (a client) the host has sent nothing for two seconds */
+boolean distributed_connection_problem(void);
+/* (a client) the host has its players (or its vehicle) at that tick of this
+machine's, as told now: its own round trip timed */
+void distributed_note_own_round_trip(long time);
 /* (the host, in its tick) the client machine a player is on, NONE for none
 (the host's own players') */
 long distributed_player_machine(short player_index);

port/linux/game/network_objects.c

@@ -588,6 +588,15 @@ boolean network_objects_may_delete(
 		objects_client_has[absolute_index] != object_index;
 }
 
+/* whether a client is in distributed_client_delete: deleting an object on
+the host's word, or one of its own the host never told it of; a flag or
+ball among them, which the game itself never deletes (objects.c, weapons.c) */
+boolean network_objects_client_deleting(
+	void)
+{
+	return objects_client_deleting;
+}
+
 /* the map's objects placed (game.c): a client's own come from the upper
 half from now on */
 void network_objects_placed(
@@ -2113,6 +2122,12 @@ static void distributed_client_delete(
 		return;
 	if (TEST_FLAG(_object_mask_item, object->object.type))
 		distributed_client_release_item(object_index, TRUE);
+	/* (a flag or ball, which the game never deletes but a host has, for a
+	reason not known: the client follows its word all the same. Out of its
+	carrier's hands above, as any weapon; and the goal its game type shows
+	at it goes too) */
+	if (object->object.type == _object_type_weapon && game_engine_running() && weapon_is_flag(object_index))
+		game_engine_objective_weapon_deleted(object_index);
 	if (TEST_FLAG(_object_mask_unit, object->object.type))
 	{
 		struct unit_datum *unit = unit_get(object_index);
@@ -2487,6 +2502,9 @@ static boolean distributed_client_correct_own_vehicle(
 	{
 		return FALSE;
 	}
+	/* (driving: the round trip as the host has its vehicle, the latency
+	meter's) */
+	distributed_note_own_round_trip(time);
 	{
 		struct distributed_own_vehicle const *own =
 			&objects_client_own_vehicles[local_player_index][time & (OWN_VEHICLE_POSITION_TICKS - 1)];
@@ -2941,6 +2959,27 @@ static void distributed_client_apply_inventory(
 				unit->unit.grenade_counts[grenade_type] = count;
 			}
 		}
+		/* an AI unit's grenade type: the host's actor chose it as it gave the
+		unit its grenades (unit_add_grenade_type_to_inventory), and a client
+		has no actors. Without one, the throws the host's control starts
+		never begin here (unit_throw_grenade_begin), and the grenades, whose
+		blasts the host's damage brings, are never seen. The type it carries
+		is it; not changed in the middle of a throw */
+		if (!own && unit->unit.player_index == NONE &&
+			unit->unit.grenade_throw_state == _unit_grenade_throw_idle &&
+			(unit->unit.current_grenade_index == NONE ||
+				unit->unit.grenade_counts[unit->unit.current_grenade_index] == 0))
+		{
+			for (grenade_type = 0; grenade_type < NUMBER_OF_UNIT_GRENADE_TYPES; grenade_type++)
+			{
+				if (unit->unit.grenade_counts[grenade_type] > 0)
+				{
+					unit->unit.current_grenade_index = grenade_type;
+					unit->unit.desired_grenade_index = grenade_type;
+					break;
+				}
+			}
+		}
 	}
 	/* (what the host changed here is not this machine's doing) */
 	if (own)

port/linux/game/network_test.c

@@ -13,15 +13,23 @@ Automated system link sessions for testing the netcode without the menus
   with a path is that level (custom_maps\a30, a Custom Edition map's), and
   the variant "coop" makes the game network co-op on it, at normal
   difficulty, as the Map screen does for a campaign level;
+- "local:<map>[:<variant>...]" the same with a local (split screen) game of
+  one player, as Multiplayer > Split Screen of the Xbox's menus sets one up
+  (no other machine joins it: the bots' games, bots.count);
 - "join" searches for games and joins the first it finds, as picking it in
   the system link list does;
 - "browse" joins the game with the most players that the server browser
   lists after five seconds (internet play's public games: a host's with
   debug.network_test_public), co-op ones last, as picking it there does,
   and then as "join". It logs what it lists.
+- "log" hosts and joins nothing: the game that runs (map_name, in init.txt,
+  plays one without the menus) is logged, as below.
 
 Once the game runs, every second each machine logs where every player's
-unit is, so the machines' views of the game can be compared.
+unit is, so the machines' views of the game can be compared, and the host
+how far its own run of each client's player came from the client's
+(network_distributed_divergence): tools/net_compare.py compares two builds
+so (port/linux/NETCODE.md, "Comparing two builds", has the line's format).
 
 Scripted play for the netcode's parts the bots' wandering does not reach:
 debug.network_test_kill (the host kills the last player every so often),
@@ -35,11 +43,16 @@ and debug.network_test_pickup (the last player stands on a weapon lying
 about that many seconds in, and a joining machine's player holds the action
 button a second later, to pick it up).
 
+debug.network_test_cues: console lines the host (or a game of one machine)
+runs at their ticks, counted from the first tick every player of
+debug.network_test_cue_players has a unit (tools/stagekit's scenarios).
+
 Called from the main loop every frame (main.c).
 */
 
 #include "cseries.h"
 #include "main/main.h"
+#include "bink/bink_playback.h"
 #include "interface/player_ui.h"
 #include "saved games/player_profile.h"
 #include "interface/ui_widget.h"
@@ -60,6 +73,7 @@ Called from the main loop every frame (main.c).
 #include "scenario/scenario.h"
 #include "tag_files/tag_files.h"
 #include "camera/observer.h"
+#include "hs/hs.h"
 
 #include "../src/p2p.h" /* port: port/linux/src/p2p.c, p2p_lobby.c */
 #include "network_chat.h"
@@ -69,6 +83,7 @@ Called from the main loop every frame (main.c).
 #include <math.h>
 #include <stdarg.h>
 #include <stdio.h>
+#include <stdlib.h>
 #include <string.h>
 
 /* the platform layer's (port/linux/src/port_config.c) */
@@ -82,6 +97,7 @@ void platform_log(char const *format, ...);
 void damage_kill_object_for_player(long object_index, long player_index);
 /* network_distributed.c's */
 void network_distributed_statistics(long *sent, long *received, long *corrections);
+void network_distributed_divergence(long *samples, long *apart, real *mean, real *largest);
 void network_distributed_item_statistics(long *creates, long *deletes, long *failures, long *removed);
 void network_damage_statistics(long *sent_reports, long *dealt_reports, long *rejected_reports, long *replayed_events);
 /* xinput_sdl.c's */
@@ -94,6 +110,7 @@ enum
 	_network_test_host,
 	_network_test_join,
 	_network_test_browse,
+	_network_test_log,
 };
 
 static struct
@@ -102,6 +119,8 @@ static struct
 	short mode;
 	char map_name[64];
 	char variant_name[64];
+	/* "local:": a local (split screen) game, not a system link one */
+	boolean local;
 	/* ... the variant of this game, of variant_name's list; and the seconds
 	the last game's scores have been shown */
 	short variant_index;
@@ -131,6 +150,17 @@ static struct
 	boolean browsing;
 	boolean browse_listed;
 	float browse_seconds;
+	/* debug.network_test_cues: each line and its tick from the cues' start,
+	the first tick every player of cue_players has a unit (NONE until then) */
+	struct
+	{
+		long tick;
+		char line[256];
+	} cues[32];
+	short cue_count;
+	short next_cue;
+	long cue_players;
+	long cues_start;
 } network_test;
 
 /* the variant at the index of the list (copied to name), FALSE past its end */
@@ -164,12 +194,13 @@ static void network_test_read_settings(
 	char const *setting = config_string("debug.network_test");
 
 	network_test.checked = TRUE;
-	if (!strncmp(setting, "host:", 5) && setting[5])
+	if ((!strncmp(setting, "host:", 5) && setting[5]) || (!strncmp(setting, "local:", 6) && setting[6]))
 	{
 		char *colon;
 
 		network_test.mode = _network_test_host;
-		snprintf(network_test.map_name, sizeof(network_test.map_name), "%s", setting + 5);
+		network_test.local = setting[0] == 'l';
+		snprintf(network_test.map_name, sizeof(network_test.map_name), "%s", strchr(setting, ':') + 1);
 		snprintf(network_test.variant_name, sizeof(network_test.variant_name), "slayer");
 		colon = strchr(network_test.map_name, ':');
 		if (colon)
@@ -186,6 +217,10 @@ static void network_test_read_settings(
 	{
 		network_test.mode = _network_test_browse;
 	}
+	else if (!strcmp(setting, "log"))
+	{
+		network_test.mode = _network_test_log;
+	}
 	network_test.public_game = config_boolean("debug.network_test_public") != 0;
 	network_test.start_delay = (real)config_real("debug.network_test_start");
 	network_test.kill_interval = (real)config_real("debug.network_test_kill");
@@ -196,6 +231,47 @@ static void network_test_read_settings(
 	snprintf(network_test.pickup_weapon, sizeof(network_test.pickup_weapon), "%s",
 		config_string("debug.network_test_pickup_weapon"));
 	network_test.score_to_win = (long)config_integer("debug.network_test_score");
+	network_test.cue_players = MAX(1, config_integer("debug.network_test_cue_players"));
+	network_test.cues_start = NONE;
+#ifndef HALO_WEB
+	/* (not on the web, where a link's ?set= would have it run what it says) */
+	{
+		char const *cue = config_string("debug.network_test_cues");
+
+		while (*cue)
+		{
+			char const *end = strchr(cue, '|');
+			int length = end ? (int)(end - cue) : (int)strlen(cue);
+			char *line;
+			double second = strtod(cue, &line);
+			short index;
+
+			if (!(second >= 0.0 && second < 86400.0) || line == cue || line >= cue + length ||
+				cue + length - line >= (int)sizeof(network_test.cues[0].line))
+			{
+				platform_log("network test: cue \"%.*s\" is not \"<second> <line>\" of %d characters at most: left out",
+					length, cue, (int)sizeof(network_test.cues[0].line) - 1);
+			}
+			else if (network_test.cue_count >= (short)NUMBEROF(network_test.cues))
+			{
+				platform_log("network test: cues past %d left out", (int)NUMBEROF(network_test.cues));
+			}
+			else
+			{
+				/* (in the order they run) */
+				long tick = (long)(second * TICKS_PER_SECOND + 0.5);
+
+				for (index = network_test.cue_count; index > 0 && network_test.cues[index - 1].tick > tick; index--)
+					network_test.cues[index] = network_test.cues[index - 1];
+				network_test.cues[index].tick = tick;
+				snprintf(network_test.cues[index].line, sizeof(network_test.cues[index].line), "%.*s",
+					(int)(cue + length - line), line);
+				network_test.cue_count++;
+			}
+			cue += length + (end != NULL);
+		}
+	}
+#endif
 	if (network_test.mode != _network_test_off)
 		platform_log("network test: %s", setting);
 }
@@ -341,9 +417,14 @@ static void network_test_log_players(
 		spawns leaves it where it began) */
 		long local_player_index = local_player_get_player_index(0);
 		struct observer_result const *camera = observer_get_camera(0);
+		long divergence_samples, divergence_apart;
+		real divergence_mean, divergence_largest;
+
+		network_distributed_divergence(&divergence_samples, &divergence_apart, &divergence_mean, &divergence_largest);
 
 		platform_log("network test: tick %ld%s | items %ld (+%ld -%ld !%ld x%ld) | %s to %ld | sent %ld received %ld corrected %ld"
-			" | hits %ld dealt %ld rejected %ld replayed %ld | local %ld camera (%.1f %.1f %.1f) respawn %ld",
+			" | hits %ld dealt %ld rejected %ld replayed %ld | local %ld camera (%.1f %.1f %.1f) respawn %ld"
+			" | drift %ld %ld %.6f %.6f",
 			game_time_get(), line, ground_items, creates, deletes, failures, removed,
 			game_engine_can_score() ? "playing" : "game over",
 			game_engine_running() ? (long)game_engine_get_variant()->universal_variant.score_to_win : 0L,
@@ -351,7 +432,8 @@ static void network_test_log_players(
 			sent_reports, dealt_reports, rejected_reports, replayed_events,
 			local_player_index == NONE ? -1L : (long)DATUM_INDEX_TO_ABSOLUTE_INDEX(local_player_index),
 			camera ? camera->position.x : 0.0f, camera ? camera->position.y : 0.0f, camera ? camera->position.z : 0.0f,
-			local_player_index == NONE ? 0L : (long)player_get(local_player_index)->respawn_timer);
+			local_player_index == NONE ? 0L : (long)player_get(local_player_index)->respawn_timer,
+			divergence_samples, divergence_apart, divergence_mean, divergence_largest);
 	}
 }
 
@@ -878,6 +960,37 @@ static void network_test_second_weapon(
 	}
 }
 
+/* debug.network_test_cues: from the first tick every player waited for has a
+unit (logged, cues or not: where a test's seconds start), each line at its
+tick (the host's, or a game of one machine: a client runs none) */
+static void network_test_run_cues(
+	void)
+{
+	if (network_test.mode != _network_test_host && network_test.mode != _network_test_log)
+		return;
+	if (network_test.cues_start == NONE)
+	{
+		struct data_iterator iterator;
+		struct player_datum *player;
+		long players = 0;
+
+		data_iterator_new(&iterator, player_data);
+		while ((player = (struct player_datum *)data_iterator_next(&iterator)) != NULL)
+			players += player->unit_index != NONE;
+		if (players < network_test.cue_players)
+			return;
+		network_test.cues_start = game_time_get();
+		platform_log("network test: cues from tick %ld", network_test.cues_start);
+	}
+	while (network_test.next_cue < network_test.cue_count &&
+		game_time_get() >= network_test.cues_start + network_test.cues[network_test.next_cue].tick)
+	{
+		platform_log("network test: cue at tick %ld: %s", game_time_get(), network_test.cues[network_test.next_cue].line);
+		hs_compile_and_evaluate(network_test.cues[network_test.next_cue].line);
+		network_test.next_cue++;
+	}
+}
+
 /* both machines stand the last player on the first weapon lying about that
 it does not carry (the same object on both: a client's own player is where
 it has it, within a tolerance) */
@@ -956,10 +1069,16 @@ void network_test_update(
 		network_test_keyboard_line(game_time_get() - (long)(network_test.chat_time * TICKS_PER_SECOND) -
 			32 * TICKS_PER_SECOND);
 	}
-	/* the game running: report (from the start of each game: the next
-	game's time starts over) */
+	/* the game running: report (from the start of each game, or a revert to
+	a checkpoint: the time starts over, and the cues with it) */
 	if (game_in_progress() && game_time_get() < network_test.logged_time)
+	{
 		network_test.logged_time = 0;
+		network_test.cues_start = NONE;
+		network_test.next_cue = 0;
+	}
+	if (game_in_progress() && !main_menu_loaded)
+		network_test_run_cues();
 	if (game_in_progress() && !main_menu_loaded && game_time_get() - network_test.logged_time >= TICKS_PER_SECOND)
 	{
 		network_test.logged_time = game_time_get();
@@ -1274,12 +1393,25 @@ void network_test_update(
 			holds the countdown) */
 			if (global_network_game_server_get())
 				network_game_server_pause_countdown(global_network_game_server_get(), FALSE);
+			/* a join that arrived as the last game ended would refuse every
+			later one, the server holding it behind the queued player */
+			network_game_server_port_clear_queued_players(global_network_game_server_get());
 			platform_log("network test: the next game");
 		}
 	}
 
 	if (!main_menu_loaded)
 		return;
+	/* the intro movie skipped first, as a button press does: the movie
+	holds the texture cache's spare memory, which starting the map
+	takes too (texture_cache_steal_memory's assertion) */
+	if (bink_playback_in_progress())
+	{
+		bink_playback_stop();
+		network_test.menu_seconds = 0.0f;
+		platform_log("network test: skipped the movie");
+		return;
+	}
 	network_test.menu_seconds += seconds;
 	/* (the main menu settling first) */
 	if (network_test.menu_seconds < 2.0f)
@@ -1337,11 +1469,34 @@ void network_test_update(
 		{
 			network_test.set_up = TRUE;
 			main_set_multiplayer_map_name(network_test.map_name);
-			player_ui_fast_setup_network_server();
-			platform_log("network test: hosting %s", network_test.map_name);
-			/* (in the server browser, as Create Game > Internet's PUBLIC) */
-			if (network_test.public_game)
-				p2p_set_hosting_public(TRUE);
+			if (network_test.local)
+			{
+				/* as Multiplayer > Split Screen does (split_screen_game_initialize) */
+				ui_widgets_close_all();
+				dispose_global_network_game_server();
+				dispose_global_network_game_client();
+				network_game_accept_remote_connections(FALSE);
+				game_engine_playlist_initialize();
+				if (create_global_network_game_server())
+				{
+					game_engine_playlist_begin();
+					game_connection_set(_game_connection_network_server);
+				}
+				if (!global_network_game_client_get())
+					create_global_network_game_client();
+				ui_widget_load_by_name_or_tag(
+					"ui\\shell\\main_menu\\multiplayer_type_select\\split_screen\\pregame\\splitscreen_pregame_wrapper_normal",
+					NONE, NULL, NONE, NONE, NONE, NONE);
+				platform_log("network test: a local game on %s", network_test.map_name);
+			}
+			else
+			{
+				player_ui_fast_setup_network_server();
+				platform_log("network test: hosting %s", network_test.map_name);
+				/* (in the server browser, as Create Game > Internet's PUBLIC) */
+				if (network_test.public_game)
+					p2p_set_hosting_public(TRUE);
+			}
 		}
 		else if (!network_test.started)
 		{
@@ -1438,3 +1593,11 @@ void network_test_update(
 		break;
 	}
 }
+
+/* the game's time in seconds while a game runs, -1 otherwise: the scripted
+player's clock (xinput_sdl.c, debug.test_input) */
+double network_test_game_seconds(
+	void)
+{
+	return game_time_initialized() && game_in_progress() ? (double)game_time_get() / TICKS_PER_SECOND : -1.0;
+}

port/linux/game/overshield_effect.c

@@ -0,0 +1,434 @@
+/*
+OVERSHIELD_EFFECT.C
+
+The overshield, as this machine draws it (Video Setup > Graphics >
+Overshield, display.overshield_effect; off, the game's own):
+
+- As it charges, the shield's flare rises up the body from the feet to the
+  top of the head, its edge soft, and stays lit, whole, for as long as the
+  overshield lasts. The rise takes 2 seconds, the time the charge takes from
+  a full shield, or 3 seconds when the shield was down (the charge's from
+  nothing); from any other shield, 2. Meanwhile the shield's own flares
+  (its hits, its recharge) are not drawn over it.
+- The flare's energy moves at 30% of its speed, in the overshield's own
+  color (the powerup's), whatever shield color its player chose.
+- On the first-person arms (with display.viewmodel_shield) it comes up as
+  the rise reaches them, and stays.
+- A hit on it plays what a hit on an Elite's shield plays (the hitting
+  projectile's own effect for an Elite's energy shield: its sound, sparks
+  and light), when the map has it.
+
+Only what is drawn and heard: the overshield is the game's. The rise is
+each machine's own, from when it sees the shield over charging (a machine
+sent the unit's shields by its host sees it with them).
+
+The rise is drawn by the GPU: the plasma shader's noise coordinate is the
+vertex's position on its model, at rest (rasterizer_xbox_plasma_energy.c),
+from which the vertex shader fades its colors out above a height
+(d3d8_gl_set_height_fade); the height runs over the skeleton's rest pose,
+from below its lowest node to above its highest.
+*/
+
+#include "cseries.h"
+#include "real_math.h"
+#include "objects/objects.h"
+#include "objects/object_definitions.h"
+#include "models/model_definitions.h"
+#include "rasterizer/rasterizer.h"
+#include "shaders/shader_definitions.h"
+#include "shaders/shaders.h"
+#include "units/units.h"
+#include "effects/effect_definitions.h"
+#include "effects/decal_definitions.h"
+#include "effects/contrail_definitions.h"
+#include "effects/particle_system_definitions.h"
+#include "effects/particles.h"
+#include "sound/sound_definitions.h"
+#include "objects/light_definitions.h"
+
+/* port/linux/game/view_fov.c */
+boolean viewmodel_shield_is_visible(void);
+
+enum
+{
+	_shader_type_transparent_plasma_glow = 10, /* (shader_get_and_verify_type's plasma, as shield_glow.c has it) */
+	OVERSHIELD_EFFECT_MAXIMUM = 16,
+	OVERSHIELD_EFFECT_MODELS = 8,
+};
+
+/* seconds the rise takes: from a full shield (or any but a down one), and
+from a down one (the charge's own times: 2 and 3 of shield a second) */
+#define OVERSHIELD_EFFECT_RISE 2.f
+#define OVERSHIELD_EFFECT_RISE_FROM_DOWN 3.f
+/* a shield at most this when the overshield begins is down */
+#define OVERSHIELD_EFFECT_DOWN 0.12f
+/* the flare's energy's speed */
+#define OVERSHIELD_EFFECT_ENERGY_SPEED 0.3f
+/* the soft edge, as a share of the body's height */
+#define OVERSHIELD_EFFECT_EDGE 0.12f
+/* where on the rise the arms come up, and over how much of it */
+#define OVERSHIELD_EFFECT_ARMS_START 0.55f
+#define OVERSHIELD_EFFECT_ARMS_LENGTH 0.3f
+/* effects.c's _effect_definition_must_be_deterministic_bit, of an effect
+definition's flags (its enum is effects.c's own) */
+#define EFFECT_MUST_BE_DETERMINISTIC_BIT 1
+
+/* the overshield's color: the powerup's */
+static real_rgb_color const overshield_effect_rgb = { 0.992f, 0.306f, 0.455f }; /* (253, 78, 116) */
+
+/* the plasma shader's fields after its header (rasterizer_xbox_plasma_energy.c's) */
+struct overshield_effect_plasma
+{
+	byte reserved00[4];
+	short intensity_exponent_source;
+};
+
+struct overshield_effect
+{
+	long unit_index; /* NONE: free */
+	real start; /* the game's seconds (render_interpolation_game_time_sec) */
+	real rise;
+	real last_seen;
+	/* the values the unit's modifier shader is drawn with, its intensity's
+	full: one copy for the body, one for the arms */
+	real body_values[4];
+	real arms_values[4];
+	/* this frame's: how far up (0..1, eased), and the model's heights */
+	real progress;
+	real bottom;
+	real top;
+};
+
+static struct overshield_effect overshield_effects[OVERSHIELD_EFFECT_MAXIMUM];
+static boolean overshield_effects_initialized = FALSE;
+
+/* the heights of a model's skeleton at rest, its lowest node's and its
+highest's (from each node's default inverse, the model's space to the
+node's) */
+static struct
+{
+	long model_index;
+	real bottom;
+	real top;
+} overshield_effect_models[OVERSHIELD_EFFECT_MODELS];
+static short overshield_effect_next_model = 0;
+
+/* port/linux/src/port_config.c */
+int config_boolean(const char *name);
+unsigned long config_changes(void);
+
+static boolean overshield_effect_enabled(
+	void)
+{
+	static unsigned long changes = (unsigned long)-1;
+	static boolean enabled = FALSE;
+
+	if (changes != config_changes())
+	{
+		changes = config_changes();
+		enabled = config_boolean("display.overshield_effect") != 0;
+	}
+	return enabled;
+}
+
+static boolean overshield_effect_model_heights(
+	long model_index,
+	real *bottom,
+	real *top)
+{
+	struct model *model;
+	short index;
+
+	if (model_index == NONE)
+		return FALSE;
+	for (index = 0; index < OVERSHIELD_EFFECT_MODELS; index++)
+	{
+		if (overshield_effect_models[index].model_index == model_index)
+		{
+			*bottom = overshield_effect_models[index].bottom;
+			*top = overshield_effect_models[index].top;
+			return *top > *bottom;
+		}
+	}
+	model = model_definition_get(model_index);
+	if (!model || model->nodes.count <= 0)
+		return FALSE;
+	*bottom = REAL_MAX;
+	*top = -REAL_MAX;
+	for (index = 0; index < model->nodes.count; index++)
+	{
+		struct model_node const *node = TAG_BLOCK_GET_ELEMENT(&model->nodes, index, struct model_node);
+		real_matrix4x3 const *inverse = &node->runtime_default_inverse_matrix;
+		/* (the node's origin, p, has inverse p = 0: p = -R^T t / scale) */
+		real z = -(inverse->up.i * inverse->position.x + inverse->up.j * inverse->position.y +
+			inverse->up.k * inverse->position.z);
+
+		if (inverse->scale > _real_epsilon)
+			z /= inverse->scale;
+		if (!valid_real(z))
+			continue;
+		*bottom = MIN(*bottom, z);
+		*top = MAX(*top, z);
+	}
+	if (!(*top > *bottom))
+		return FALSE;
+	/* (the skin past the nodes: the soles below the toes, the helmet over
+	the head) */
+	{
+		real height = *top - *bottom;
+
+		*bottom -= 0.08f * height;
+		*top += 0.18f * height;
+	}
+	index = overshield_effect_next_model;
+	overshield_effect_next_model = (short)((overshield_effect_next_model + 1) % OVERSHIELD_EFFECT_MODELS);
+	overshield_effect_models[index].model_index = model_index;
+	overshield_effect_models[index].bottom = *bottom;
+	overshield_effect_models[index].top = *top;
+	return TRUE;
+}
+
+/* the source of the intensity of the unit's modifier shader (a plasma one),
+0..3; NONE for none */
+static short overshield_effect_intensity_source(
+	long unit_index)
+{
+	struct object_definition *definition = object_definition_get(object_get(unit_index)->definition_index);
+	struct shader *shader;
+	short source;
+
+	if (!definition || definition->object.modifier_shader.index == NONE)
+		return NONE;
+	shader = shader_definition_get(definition->object.modifier_shader.index);
+	if (!shader || shader->base.type != _shader_type_transparent_plasma_glow)
+		return NONE;
+	source = ((struct overshield_effect_plasma const *)((byte const *)shader + sizeof(struct shader)))->
+		intensity_exponent_source;
+	return source >= 1 && source <= 4 ? (short)(source - 1) : NONE;
+}
+
+/* a unit's overshield, while it has one and lives (its shield over 1, or
+charging past it); NULL for none */
+static struct overshield_effect *overshield_effect_get(
+	long unit_index)
+{
+	struct unit_datum *unit = unit_try_and_get(unit_index);
+	struct overshield_effect *effect = NULL;
+	struct overshield_effect *free_effect = NULL;
+	boolean charging;
+	real now;
+	short index;
+
+	if (!overshield_effects_initialized)
+	{
+		for (index = 0; index < OVERSHIELD_EFFECT_MAXIMUM; index++)
+			overshield_effects[index].unit_index = NONE;
+		for (index = 0; index < OVERSHIELD_EFFECT_MODELS; index++)
+			overshield_effect_models[index].model_index = NONE;
+		overshield_effects_initialized = TRUE;
+	}
+	now = global_frame_parameters.game_time_sec;
+	for (index = 0; index < OVERSHIELD_EFFECT_MAXIMUM; index++)
+	{
+		struct overshield_effect *each = &overshield_effects[index];
+
+		/* (one not looked at for a while: its unit gone, or out of sight) */
+		if (each->unit_index != NONE && (now - each->last_seen > 1.f || now < each->last_seen - 1.f))
+			each->unit_index = NONE;
+		if (each->unit_index == unit_index)
+			effect = each;
+		else if (each->unit_index == NONE && !free_effect)
+			free_effect = each;
+	}
+	if (!unit || !overshield_effect_enabled())
+		return NULL;
+	charging = TEST_FLAG(unit->object.damage_flags, _object_shield_over_charging_bit);
+	if (TEST_FLAG(unit->object.damage_flags, _object_dead_bit) ||
+		!(charging || unit->object.shield_vitality > 1.f))
+	{
+		if (effect)
+			effect->unit_index = NONE;
+		return NULL;
+	}
+	if (!effect)
+	{
+		real shield = unit->object.shield_vitality;
+
+		if (!free_effect)
+			return NULL;
+		effect = free_effect;
+		effect->unit_index = unit_index;
+		effect->rise = charging && shield <= OVERSHIELD_EFFECT_DOWN ?
+			OVERSHIELD_EFFECT_RISE_FROM_DOWN : OVERSHIELD_EFFECT_RISE;
+		/* (seen part of the way through its charge: as far on; seen charged,
+		risen) */
+		effect->start = now;
+		if (!charging)
+			effect->start = now - effect->rise;
+		else if (shield > 1.f)
+			effect->start = now - MIN(shield - 1.f, effect->rise);
+	}
+	effect->last_seen = now;
+	{
+		real t = PIN((now - effect->start) / effect->rise, 0.f, 1.f);
+
+		/* (smooth at both ends) */
+		effect->progress = t * t * (3.f - 2.f * t);
+	}
+	return effect;
+}
+
+/* ---------- public code */
+
+/* whether the unit has an overshield, as this machine draws it */
+boolean overshield_effect_active(
+	long object_index)
+{
+	struct object_datum *object = object_try_and_get(object_index);
+
+	return object && TEST_FLAG(_object_mask_unit, object->object.type) && overshield_effect_get(object_index) != NULL;
+}
+
+/* the values a unit's modifier shader is drawn with, given its own: with an
+overshield, a copy whose intensity is full (on the body, or the arms) that
+overshield_effect_draw knows again; otherwise its own */
+real const *overshield_effect_values(
+	long unit_index,
+	real const *values,
+	boolean arms)
+{
+	struct overshield_effect *effect;
+	short source;
+	real *copy;
+
+	if (!values || !overshield_effect_enabled())
+		return values;
+	effect = overshield_effect_get(unit_index);
+	source = effect ? overshield_effect_intensity_source(unit_index) : NONE;
+	if (!effect || source == NONE)
+		return values;
+	copy = arms ? effect->arms_values : effect->body_values;
+	csmemcpy(copy, values, sizeof(effect->body_values));
+	if (arms)
+	{
+		copy[source] = PIN((effect->progress - OVERSHIELD_EFFECT_ARMS_START) / OVERSHIELD_EFFECT_ARMS_LENGTH, 0.f, 1.f);
+	}
+	else
+	{
+		copy[source] = 1.f;
+		if (!overshield_effect_model_heights(
+			object_definition_get(object_get(unit_index)->definition_index)->object.model.index,
+			&effect->bottom, &effect->top))
+		{
+			effect->bottom = effect->top = 0.f;
+		}
+	}
+	return copy;
+}
+
+/* a plasma shader drawn with values from overshield_effect_values: the
+speed its energy moves at, and the height it fades above on its model (the
+fade's inverse softness and height: 0 and 0 for none); FALSE for values not
+from it */
+boolean overshield_effect_draw(
+	real const *values,
+	real *energy_speed,
+	real *inverse_softness,
+	real *height)
+{
+	short index;
+
+	if (!values)
+		return FALSE;
+	for (index = 0; index < OVERSHIELD_EFFECT_MAXIMUM; index++)
+	{
+		struct overshield_effect const *effect = &overshield_effects[index];
+
+		if (effect->unit_index == NONE || (values != effect->body_values && values != effect->arms_values))
+			continue;
+		*energy_speed = OVERSHIELD_EFFECT_ENERGY_SPEED;
+		*inverse_softness = 0.f;
+		*height = 0.f;
+		if (values == effect->body_values && effect->top > effect->bottom && effect->progress < 1.f)
+		{
+			real edge = OVERSHIELD_EFFECT_EDGE * (effect->top - effect->bottom);
+
+			/* (from all of the edge below the feet to all of it above the
+			head) */
+			*inverse_softness = 1.f / edge;
+			*height = effect->bottom + (effect->top - effect->bottom + edge) * effect->progress;
+		}
+		return TRUE;
+	}
+	return FALSE;
+}
+
+/* the unit's overshield's flare, for its glow (shield_glow.c): 0..1, or
+NONE (-1) for no overshield */
+real overshield_effect_flare(
+	long unit_index)
+{
+	struct overshield_effect *effect = overshield_effect_get(unit_index);
+
+	return effect ? effect->progress : -1.f;
+}
+
+/* whether an effect a hit on an overshield may play in place of its own:
+one that only shows and sounds (sounds, lights, decals, particles,
+contrails), so that nothing of the game changes */
+boolean overshield_effect_hit_effect_allowed(
+	long effect_index)
+{
+	struct effect_definition const *definition;
+	short event_index;
+
+	if (effect_index == NONE)
+		return FALSE;
+	definition = (struct effect_definition const *)tag_get(EFFECT_DEFINITION_TAG, effect_index);
+	/* (nor one that must be deterministic: it draws from the game's random
+	seed, which every machine must use alike, as this machine's swap would not) */
+	if (!definition || TEST_FLAG(definition->flags, EFFECT_MUST_BE_DETERMINISTIC_BIT))
+		return FALSE;
+	for (event_index = 0; event_index < definition->events.count; event_index++)
+	{
+		struct effect_event_definition const *event =
+			TAG_BLOCK_GET_ELEMENT(&definition->events, event_index, struct effect_event_definition);
+		short part_index;
+
+		for (part_index = 0; part_index < event->parts.count; part_index++)
+		{
+			struct effect_part_definition const *part =
+				TAG_BLOCK_GET_ELEMENT(&event->parts, part_index, struct effect_part_definition);
+			unsigned long group = part->reference.group_tag;
+
+			if (part->reference.index != NONE && group != SOUND_DEFINITION_TAG && group != LIGHT_DEFINITION_TAG &&
+				group != DECAL_GROUP_TAG && group != PARTICLE_SYSTEM_DEFINITION_TAG && group != PARTICLE_TAG &&
+				group != CONTRAIL_DEFINITION_TAG)
+			{
+				return FALSE;
+			}
+		}
+	}
+	return TRUE;
+}
+
+/* the color a plasma shader drawn with values from overshield_effect_values
+is drawn in, the overshield's own; FALSE for values not from it */
+boolean overshield_effect_color(
+	real const *values,
+	real_rgb_color *color)
+{
+	real energy_speed, inverse_softness, height;
+
+	if (!overshield_effect_draw(values, &energy_speed, &inverse_softness, &height))
+		return FALSE;
+	*color = overshield_effect_rgb;
+	return TRUE;
+}
+
+/* the overshield's color, for its glow */
+real_rgb_color const *overshield_effect_glow_color(
+	void)
+{
+	return &overshield_effect_rgb;
+}

port/linux/game/passenger_camera.c

@@ -0,0 +1,178 @@
+/*
+PASSENGER_CAMERA.C
+
+An optional local view for the Warthog's passenger and the Scorpion's four
+passengers. The reference seat supplies the camera track and pivot only;
+the passenger keeps their own aim and its limits. No seat tags are changed,
+and the deterministic camera used for shooting keeps its original view.
+*/
+
+#include "cseries.h"
+#include "passenger_camera.h"
+#include "camera/director.h"
+#include "cutscene/cinematics.h"
+#include "game/game_engine.h"
+#include "game/players.h"
+#include "items/weapons.h"
+#include "objects/objects.h"
+#include "physics/collisions.h"
+#include "render/render.h"
+#include "render/render_cameras.h"
+#include "tag_files/tag_groups.h"
+#include "units/unit_definitions.h"
+#include "units/units.h"
+#include "units/vehicles.h"
+
+#include <string.h>
+
+int config_boolean(const char *name);
+
+static boolean reticle_active;
+static real_point2d reticle_offset;
+
+/* Match stock vehicle tag paths, including the PC multiplayer Warthog.
+Seat roles identify the passengers without relying on their array order. */
+static struct unit_seat const *reference_seat(short local_player_index, long *vehicle_index)
+{
+	long unit_index, player_index;
+	struct unit_datum *unit, *vehicle;
+	struct unit_definition const *definition;
+	struct unit_seat const *seat;
+	char const *name;
+	short reference_role, index;
+
+	/* (not in multiplayer, where seeing around the vehicle is an advantage the
+	other players do not have) */
+	if (local_player_index < 0 || local_player_index >= MAXIMUM_LOCAL_PLAYERS ||
+		!config_boolean("display.passenger_third_person") || game_engine_running() || cinematic_in_progress() ||
+		(director_camera_scripted && *director_camera_scripted))
+		return NULL;
+	player_index = local_player_get_player_index(local_player_index);
+	if (player_index == NONE)
+		return NULL;
+	unit_index = player_control_get_unit_index(local_player_index);
+	if (unit_index == NONE || player_get(player_index)->unit_index != unit_index)
+		return NULL;
+	unit = unit_try_and_get(unit_index);
+	if (!unit || TEST_FLAG(unit->object.damage_flags, _object_dead_bit) ||
+		unit->object.parent_object_index == NONE || unit->unit.parent_seat_index < 0)
+		return NULL;
+	vehicle = vehicle_try_and_get(unit->object.parent_object_index);
+	if (!vehicle || TEST_FLAG(vehicle->object.damage_flags, _object_dead_bit))
+		return NULL;
+	name = tag_get_name(vehicle->definition_index);
+	if (!name)
+		return NULL;
+	if (!strcmp(name, "vehicles\\warthog\\warthog") ||
+		!strcmp(name, "vehicles\\warthog\\mp_warthog"))
+		reference_role = _unit_seat_gunner_bit;
+	else if (!strcmp(name, "vehicles\\scorpion\\scorpion") ||
+		!strcmp(name, "vehicles\\scorpion\\scorpion_mp"))
+		reference_role = _unit_seat_driver_bit;
+	else
+		return NULL;
+	definition = unit_definition_get(vehicle->definition_index);
+	if (unit->unit.parent_seat_index >= definition->unit.seats.count)
+		return NULL;
+	seat = TAG_BLOCK_GET_ELEMENT(&definition->unit.seats, unit->unit.parent_seat_index, struct unit_seat);
+	if (seat->flags & (FLAG(_unit_seat_driver_bit) | FLAG(_unit_seat_gunner_bit) |
+		FLAG(_unit_seat_invisible_bit)))
+		return NULL;
+	for (index = 0; index < definition->unit.seats.count; index++)
+	{
+		seat = TAG_BLOCK_GET_ELEMENT(&definition->unit.seats, index, struct unit_seat);
+		if (TEST_FLAG(seat->flags, reference_role))
+		{
+			*vehicle_index = unit->object.parent_object_index;
+			return seat;
+		}
+	}
+	return NULL;
+}
+
+boolean passenger_camera_enabled(short local_player_index)
+{
+	long vehicle_index;
+
+	return reference_seat(local_player_index, &vehicle_index) != NULL;
+}
+
+boolean passenger_camera_info(short local_player_index, struct player_control_unit_camera_info *info)
+{
+	long vehicle_index;
+	struct unit_seat const *seat = reference_seat(local_player_index, &vehicle_index);
+
+	if (!seat)
+		return FALSE;
+	info->camera = &seat->camera;
+	info->position = unit_get(vehicle_index)->object.position;
+	if (seat->camera.marker_name[0])
+	{
+		struct object_marker marker;
+
+		object_get_marker_by_name(vehicle_index, seat->camera.marker_name, &marker, 1);
+		info->position = marker.matrix.position;
+	}
+	return TRUE;
+}
+
+void passenger_camera_clamp_facing(short local_player_index, real_euler_angles2d *facing)
+{
+	real_vector3d direction;
+
+	if (!passenger_camera_enabled(local_player_index))
+		return;
+	/* The ordinary input path already applies the passenger seat's yaw and
+	pitch limits. Apply its weapon animation's narrower aiming bounds too. */
+	vector3d_from_euler_angles2d(&direction, facing);
+	if (unit_clip_to_aiming_bounds(player_control_get_unit_index(local_player_index), &direction, TRUE))
+	{
+		euler_angles2d_from_vector3d(facing, &direction);
+		if (facing->yaw < 0.0f)
+			facing->yaw += 2.0f * _pi;
+	}
+}
+
+boolean passenger_camera_reticle_begin(short local_player_index, long weapon_index)
+{
+	long unit_index;
+	real_point3d origin, target;
+	real_vector3d direction, ray;
+	real_point2d screen;
+	struct collision_result collision;
+
+	reticle_active = FALSE;
+	if (!passenger_camera_enabled(local_player_index) ||
+		director_get_perspective(local_player_index) != _director_perspective_third_person)
+		return TRUE;
+	unit_index = player_control_get_unit_index(local_player_index);
+	if (weapon_index == NONE || !weapon_get_projectile_ray(weapon_index, 0, &origin, &direction))
+		return FALSE;
+	/* The same finite ray as the shot's aiming reference, before random
+	spread or a projectile's flight. Its origin remains at the weapon. */
+	scale_vector3d(&direction, 128.0f, &ray);
+	if (collision_test_vector(_collision_test_for_projectiles_flags, &origin, &ray, unit_index, &collision))
+		target = collision.point;
+	else
+		point_from_line3d(&origin, &direction, 128.0f, &target);
+	if (!render_camera_world_to_screen(&render.camera, &render.frustum, &target, &screen))
+		return FALSE;
+	reticle_offset.x = screen.x - (render.camera.window_bounds.x0 + render.camera.window_bounds.x1) * 0.5f;
+	reticle_offset.y = screen.y - (render.camera.window_bounds.y0 + render.camera.window_bounds.y1) * 0.5f;
+	reticle_active = TRUE;
+	return TRUE;
+}
+
+void passenger_camera_reticle_offset(point2d *point)
+{
+	if (reticle_active)
+	{
+		point->x = (short)(point->x + reticle_offset.x);
+		point->y = (short)(point->y + reticle_offset.y);
+	}
+}
+
+void passenger_camera_reticle_end(void)
+{
+	reticle_active = FALSE;
+}

port/linux/game/passenger_camera.h

@@ -0,0 +1,18 @@
+/* The local Warthog and Scorpion passenger view (passenger_camera.c). */
+#ifndef PASSENGER_CAMERA_H
+#define PASSENGER_CAMERA_H
+
+#include "math/real_math.h"
+
+struct player_control_unit_camera_info;
+
+boolean passenger_camera_enabled(short local_player_index);
+boolean passenger_camera_info(short local_player_index, struct player_control_unit_camera_info *info);
+void passenger_camera_clamp_facing(short local_player_index, real_euler_angles2d *facing);
+
+/* Scoped to crosshairs_draw: one ray query for all of a reticle's pieces. */
+boolean passenger_camera_reticle_begin(short local_player_index, long weapon_index);
+void passenger_camera_reticle_offset(point2d *point);
+void passenger_camera_reticle_end(void);
+
+#endif

port/linux/game/shield_glow.c

@@ -52,6 +52,9 @@ boolean vr_graphics_allows_shield_glow(void);
 /* object_lights.c (port) */
 long light_port_glow_definition_get(void);
 boolean light_port_glow_set(long light_index, long object_index, real_rgb_color const *color, real radius);
+/* port/linux/game/overshield_effect.c */
+real overshield_effect_flare(long unit_index);
+real_rgb_color const *overshield_effect_glow_color(void);
 
 enum
 {
@@ -175,11 +178,21 @@ static real shield_glow_flare(
 	if (source < 1 || source > 4)
 		return 0.f;
 	value = object->object.outgoing_function_values[source - 1];
+	/* (an overshield: lit as it rises, then whole while it lasts) */
+	{
+		real overshield = overshield_effect_flare(unit_index);
+
+		if (overshield >= 0.f)
+			value = overshield;
+	}
 	if (!(value > 0.f))
 		return 0.f;
 	value = (real)pow((double)value, (double)plasma->intensity_exponent);
 
 	*color = plasma->perpendicular_color;
+	/* (an overshield: its own color) */
+	if (overshield_effect_flare(unit_index) >= 0.f)
+		*color = *overshield_effect_glow_color();
 	peak = MAX(color->red, MAX(color->green, color->blue));
 	if (!(peak > 0.f))
 		return 0.f;

port/linux/game/structure_culling.h

@@ -0,0 +1,93 @@
+/*
+STRUCTURE_CULLING.H
+
+Conservative geometry tests for the structure's visible surface walk.
+*/
+
+#ifndef STRUCTURE_CULLING_H
+#define STRUCTURE_CULLING_H
+
+#include "cseries.h"
+#include "math/real_math.h"
+
+/* ---------- constants */
+
+enum
+{
+	_structure_culling_triangle_frustum_bit,
+	_structure_culling_bucket_facing_bit,
+	_structure_culling_triangle_facing_bit,
+	_structure_culling_finer_buckets_bit,
+	_structure_culling_near_first_bit,
+	NUMBER_OF_STRUCTURE_CULLING_TESTS
+};
+
+enum
+{
+	_structure_culling_facing_away,
+	_structure_culling_facing_toward,
+	_structure_culling_facing_mixed
+};
+
+/* ---------- structures */
+
+struct structure_bsp;
+struct profile_section;
+
+struct structure_culling_cone
+{
+	real_point3d center;
+	real radius;
+	real_vector3d axis;
+	real cutoff;
+};
+
+struct structure_culling_split_surface
+{
+	long surface_index;
+	real_point3d centroid;
+	real_vector3d normal;
+	boolean facing_eligible;
+};
+
+struct structure_culling_pairing
+{
+	long surface_index;
+	short material_index;
+	boolean testable; /* ownerless or invalid-vertex subcluster pairings stay visible without triangle tests */
+};
+
+/* ---------- globals */
+
+extern struct profile_section render_structure_visibility_subcluster_traversal;
+extern struct profile_section render_structure_visibility_surface_traversal;
+
+/* ---------- prototypes */
+
+boolean structure_culling_triangle_outside(
+	real_plane3d const planes[6], real_point3d const *point0, real_point3d const *point1, real_point3d const *point2);
+boolean structure_culling_triangle_faces_away(
+	real_point3d const *camera, real_point3d const *point0, real_point3d const *point1, real_point3d const *point2);
+void structure_culling_cone_build(struct structure_culling_cone *cone, long triangle_count, real_point3d const *points);
+/* away and toward apply to every triangle; mixed leaves each triangle to be tested */
+short structure_culling_cone_facing(struct structure_culling_cone const *cone, real_point3d const *camera);
+/* 0 is outside, 1 intersects a plane, and 2 is fully inside all six planes */
+short structure_culling_box_test(real_plane3d const planes[6], real_rectangle3d const *box);
+/* reserve one end slot per input surface; zero means there was not enough room */
+long structure_culling_split(
+	struct structure_culling_split_surface *surfaces, long surface_count, long *bucket_ends, long maximum_buckets);
+/* the caller resolves group materials or first owners into the same flat table */
+long structure_culling_gather_pairings(long const *list, long list_count, boolean from_surface_list,
+	short group_material, long surface_count, short const *surface_materials, long const *material_vertex_counts,
+	word const *surface_vertex_indices, struct structure_culling_pairing *pairings);
+void structure_culling_structure_bsp_loaded(void);
+void structure_culling_dispose(void);
+void structure_culling_order_clusters(short *order, real const *distances, short count);
+boolean structure_culling_traverse(struct structure_bsp *structure);
+/* reads the starting tests from the settings */
+void structure_culling_initialize(void);
+void structure_culling_set_tests(long tests);
+void structure_culling_debug(boolean enable);
+void structure_culling_render_debug(void);
+
+#endif

port/linux/game/tag_schema_models.c

@@ -762,7 +762,10 @@ static struct tag_schema_field const gbxmodel_fields[] =
 	TAG_SCHEMA_BLOCK(struct model, nodes, model_node_schema, MAXIMUM_NODES_PER_MODEL),
 	TAG_SCHEMA_BLOCK(struct model, regions, model_region_schema, MAXIMUM_REGIONS_PER_MODEL),
 	TAG_SCHEMA_BLOCK(struct model, geometries, gbxmodel_geometry_schema, MAXIMUM_GEOMETRIES_PER_MODEL),
-	TAG_SCHEMA_BLOCK(struct model, shaders, model_shader_reference_schema, MAXIMUM_SHADERS_PER_MODEL),
+	/* (the tools' 32: the game reads a model's shaders only through their
+	block, by its parts' shader indices, which are checked against it. Halo
+	PC's engine took more; h3_foundry's spartan has 56) */
+	TAG_SCHEMA_TOOL_BLOCK(struct model, shaders, model_shader_reference_schema, MAXIMUM_SHADERS_PER_MODEL),
 	TAG_SCHEMA_CHECK(model_check),
 	TAG_SCHEMA_END
 };

port/linux/game/tag_schema_render.c

@@ -1310,9 +1310,20 @@ static boolean bitmap_group_check(
 					bitmap_index, bitmap->pixels_size, bitmap_read_pixel_data_size(bitmap),
 					(unsigned long)bitmap->pixels_offset, (unsigned long)group->pixel_data.file_offset);
 				bitmap_make_empty(bitmap);
-				/* (the group's offset is added by the game: the start of the
-				file is where it stands) */
-				bitmap->pixels_offset = -group->pixel_data.file_offset;
+				/* (the group's offset is added by the game: its pixel at the
+				group's data, which is in the file unless the data starts at
+				its end, as bitmap_data_check has a bitmap's offset alone. A
+				negative one, the start of the file, was corrected again by
+				bitmap_data_check. Data starting at the end of the file is
+				moved to its start, and the bitmaps checked again) */
+				if (group->pixel_data.file_offset != 0 &&
+					!tag_validate_file_contains(validation, group->pixel_data.file_offset, 1))
+				{
+					tag_validate_correct(validation, "has its pixel data at %08lx, the end of the map's files: 0",
+						(unsigned long)group->pixel_data.file_offset);
+					group->pixel_data.file_offset = 0;
+					bitmap_index = -1;
+				}
 			}
 		}
 	}

port/linux/game/tag_validate.c

@@ -750,6 +750,22 @@ static void validate_value(
 
 		if ((value >= 0 && value < field->maximum && value != none) || (none_allowed && value == none))
 			break;
+		/* (a Custom Edition map's tools left some shorts big-endian, as tag
+		files store them: Hornet's Nest's assault rifle muzzle flash light
+		has function types of 256 for 1. The value with its bytes swapped is
+		taken when that is one of the field's) */
+		if (tag_validate_globals.custom_edition && field->size == 2)
+		{
+			long swapped = ((value & 0xFF) << 8) | ((value >> 8) & 0xFF);
+
+			if (swapped < field->maximum)
+			{
+				tag_validate_correct(validation, "is %ld, past its %ld values: %ld, its bytes swapped",
+					value, field->maximum, swapped);
+				integer_set(address, field->size, swapped);
+				break;
+			}
+		}
 		tag_validate_correct(validation, "is %ld, past its %ld values: %s",
 			value, field->maximum, none_allowed ? "none" : "0");
 		integer_set(address, field->size, none_allowed ? NONE : 0);

port/linux/include/halo_linux_source_fixups.h

@@ -26,9 +26,21 @@ void render_interpolation_first_person(short local_player_index, struct real_mat
 	short node_count, struct render_camera const *camera);
 float render_interpolation_game_time_sec(long ticks);
 
+/* whether the map being loaded, by the name it was loaded by, is a
+downloaded one, whose scripts may call and set less: one map sharing
+downloaded, or one game.downloaded_maps names (port/linux/game/map_share.c) */
+int map_share_map_downloaded(char const *map_name);
+
+/* an IP address as the log may show it: a public one as a tag of the run's,
+never whole (port/linux/src/log_address.c, log_address.h) */
+const char *log_address(const unsigned char *bytes, int length, int port, char *text, int size);
+
 /* the port's menus' screen for one of ui.map's, by name, else the name
 (port/linux/game/menu_tags.c) */
 char const *pc_menus_screen(char const *name);
+/* debug.fixed_step: a game of this machine alone runs a tick a frame
+(port/linux/src/port_config.c; game_time.c, main.c) */
+int halo_fixed_step(void);
 /* the Custom Edition tag cache window, or NULL unless the
 game.custom_edition setting reserved it (port/linux/src/xbox_memory.c) */
 void *halo_custom_edition_tag_cache(void);
@@ -57,6 +69,13 @@ long halo_screen_commit(void);
 /* the shadow maps' pixels for each of their 128 texels each way, a power of
 two (display.shadow_resolution) */
 long halo_shadow_map_scale(void);
+/* how many times a model's size in the 480-line screen's pixels to measure
+it at (display.model_detail, source/models/models.c): level nonzero, to
+choose its level of detail, otherwise whether it is drawn */
+float halo_model_detail_scale(int level);
+/* whether display.model_detail is "stock" (port/linux/src/d3d8_gl.c), for
+each permutation's level (port/linux/game/model_detail.c) */
+int halo_model_detail_stock(void);
 /* while TRUE, drawing shifts right to center 640-column layouts */
 void halo_screen_ui_offset(unsigned char centered);
 /* names a model lighting vertex program, whose draws can be lit for each
@@ -70,6 +89,9 @@ with last time made ready; and as it goes, its list of them kept
 (port/linux/src/xgpu_program_cache.c, the Android app's) */
 void halo_shader_programs_map_loaded(char const *map_name);
 void halo_shader_programs_map_disposed(void);
+/* display.hdr's tone mapping of a window's 3D view, before its
+anti-aliasing (source/render/render.c) */
+void halo_screen_tone_map(short x0, short y0, short x1, short y1);
 /* the mouse in the menus (source/interface/ui_widget.c) */
 #include "halo_ui_pointer.h"
 

port/linux/include/halo_menus.h

@@ -51,6 +51,9 @@ struct halo_menu_strings
 	char const *name;
 	/* its strings: count from first in the strings */
 	long first, count;
+	/* the PC version's list of the same strings (its tag's name), which a
+	map in another language has in its language; NULL if none */
+	char const *map;
 	char const *file;
 	long line;
 };
@@ -123,6 +126,9 @@ struct halo_menus
 	struct halo_menu_strings *string_lists;
 	long string_list_count;
 	char const **strings;
+	/* each string's index in its list's map list (HALO_MENU_NONE: the
+	port's own, in English only) */
+	long *string_maps;
 	long string_count;
 	struct halo_menu_widget *widgets;
 	long widget_count;

port/linux/include/halo_port_capacity.h

@@ -69,6 +69,26 @@ the Xbox's. */
 #define HALO_PORT_SOUND_CACHE_SIZE 0x1000000 /* (0x400000) */
 #endif
 
+/* ---------- particles and lights a frame draws
+
+What one view draws in a frame, past which the rest is not drawn: the runs
+of particles that share a definition, and the dynamic lights (an assault
+rifle's flashlight, each plasma bolt's light) found in the clusters it sees.
+A busy multiplayer fight spends the Xbox's 512 and 128, and plasma bolts,
+charge glows and flashlights stop drawing. The desktop builds draw four
+times as many. Only what is drawn changes: these are rebuilt every frame,
+outside the game state, and nothing of them reaches the network, so
+machines with other limits still play the same game. Android's and the web
+build's keep the Xbox's. (The transparent geometry groups: below.) */
+
+#if defined(HALO_ARM64_GUEST) || defined(HALO_WEB)
+#define HALO_PORT_MAXIMUM_RENDERED_PARTICLE_GROUPS 512 /* (512) */
+#define HALO_PORT_MAXIMUM_RENDERED_LIGHTS 128 /* (128) */
+#else
+#define HALO_PORT_MAXIMUM_RENDERED_PARTICLE_GROUPS 2048 /* (512) */
+#define HALO_PORT_MAXIMUM_RENDERED_LIGHTS 512 /* (128) */
+#endif
+
 /* ---------- AI
 
 Network co-op adds enemies for its players (port/linux/game/coop_enemies.c):

port/linux/include/halo_port_limits.h

@@ -66,7 +66,7 @@ is newer (network_client_manager.c). A host advertises it, with its netcode,
 in its game's advertisement's reserved bytes (network_server_message_handler.c),
 which hosts built before there was a version send as zeros: version 0.
 Raise it with any change to what the machines send each other. */
-#define HALO_PORT_NETWORK_VERSION 29
+#define HALO_PORT_NETWORK_VERSION 32
 /* ... the advertisement's reserved bytes: the version (a little-endian word),
 then flags */
 #define HALO_PORT_ADVERTISED_VERSION_OFFSET 0

port/linux/network_format.txt

@@ -1,4 +1,4 @@
-version 29
+version 32
 bound CHAT_TEXT_SIZE 64
 bound DISCORD_ID_SIZE 24
 bound DISCORD_NAME_SIZE 40
@@ -29,6 +29,7 @@ bound NUMBER_OF_UNIT_GRENADE_TYPES enum a0462dbcbdd9
 bound OBJECT_NAME_BYTES MAXIMUM_OBJECT_NAMES_PER_SCENARIO / 8
 bound P2P_PLAYER_KEY_HASH_SIZE 16
 define DISTRIBUTED_ANGULAR_VELOCITY_SCALE 4096.0f
+define DISTRIBUTED_TIME_WINDOW_TICKS (15 * TICKS_PER_SECOND)
 define DISTRIBUTED_UNIT_SCALE 32767.0f
 define DISTRIBUTED_VELOCITY_SCALE 1024.0f
 enum _distributed_actor_camouflaged_bit 4
@@ -41,6 +42,7 @@ enum _distributed_actor_shield_over_charging_bit 3
 enum _distributed_actor_super_camouflaged_bit 5
 enum _distributed_message_actor_damage 73
 enum _distributed_message_actor_states 64
+enum _distributed_message_aim_assist_policy 90
 enum _distributed_message_batch 16
 enum _distributed_message_chat_config 89
 enum _distributed_message_chat_down 88
@@ -168,7 +170,7 @@ fields client_remove_player_request_pregame 06ff007a9b35
 fields client_settings_request d6a7048d6284
 fields client_switch_to_pregame 678699dea271
 fields server_add_player_ingame 06ff007a9b35
-fields server_begin_game 678699dea271
+fields server_begin_game 87e5d5c7565c
 fields server_game_advertise 2d5f42b781a4
 fields server_game_over 678699dea271
 fields server_game_settings_update 4c2744d8b8e8
@@ -180,7 +182,7 @@ fields server_machine_rejected 758215ada4e1
 fields server_pong 678699dea271
 fields server_postgame_keep_alive 758215ada4e1
 fields server_pregame_countdown 758215ada4e1
-fields server_pregame_keep_alive 758215ada4e1
+fields server_pregame_keep_alive 678699dea271
 fields server_remove_player_ingame 1718d4189972
 fields server_switch_to_pregame 678699dea271
 size message_client_add_player_request_ingame 0x20
@@ -215,7 +217,7 @@ size message_server_machine_rejected 0x02
 size message_server_pong 0x04
 size message_server_postgame_keep_alive 0x02
 size message_server_pregame_countdown 0x02
-size message_server_pregame_keep_alive 0x02
+size message_server_pregame_keep_alive 0x04
 size message_server_remove_player_ingame 0x24
 size message_server_switch_to_pregame 0x04
 struct distributed_actor_damage 96a57e13e2b8
@@ -263,7 +265,7 @@ struct distributed_object_state 1b656bbda892
 struct distributed_object_state_message 004c4b7aa530
 struct distributed_pickup 46e6f981ac40
 struct distributed_pings_message 35c6009dee29
-struct distributed_player_input b8d724b59f5c
+struct distributed_player_input a0cf65a1197c
 struct distributed_player_ping 377e0e3045f4
 struct distributed_player_statistics 2a44afb8f96c
 struct distributed_statistics_message 79134e6e9811

port/linux/src/dsound_sdl.c

@@ -22,6 +22,15 @@ resampling) and applies:
 (reverb). Doppler and cones are not modelled. A look-ahead limiter keeps the
 sum under full scale (limit).
 
+The output is stereo or 5.1 (audio.channels). For 5.1 the speaker config
+reports AC-3, as an Xbox set to Dolby Digital does: the game then sends its
+2D voices to the center and back mix bins too (dsound_initialize_channel),
+3D voices and stereo voices positioned in the world are panned around the
+five full range speakers (surround_pan), and the reverb plays from the
+front and back pairs. The mix bins 0-5 are in SDL's 5.1 order (FL, FR, FC,
+LFE, BL, BR), so bin n is output channel n. The game sends nothing to the
+LFE bin. Stereo output mixes exactly as before.
+
 Packets the mixer has finished are completed from DirectSoundDoWork, which
 the game calls every frame, and from Flush, never from the audio thread:
 the game's completion callback is not meant to run concurrently with it.
@@ -32,7 +41,8 @@ buffer, so streams still drain at their real rate.
 audio.volume sets the master volume (default 1.0); audio.reverb = false
 turns the reverb off; audio.resampler = "linear" resamples between
 neighbouring frames instead of with the sinc low pass; audio.enabled = false
-skips opening a device (port_config.c).
+skips opening a device; audio.channels chooses stereo or 5.1
+(port_config.c).
 */
 
 #include "platform.h"
@@ -49,7 +59,8 @@ skips opening a device (port_config.c).
 #include <unistd.h>
 
 #define OUTPUT_RATE 48000
-#define OUTPUT_CHANNELS 2
+#define OUTPUT_CHANNELS 2 /* the stereo mix's, and the reverb's outputs */
+#define MAXIMUM_OUTPUT_CHANNELS 6
 #define MAXIMUM_STREAM_PACKETS 64
 #define MIX_CHUNK_FRAMES 1024
 
@@ -107,6 +118,9 @@ struct sdl_stream
 	float stereo_distance;
 	float stereo_distance_fade;
 	float headroom;
+	/* on 5.1 (output_channels 6): the gains from each source channel to
+	each speaker mix bin (SetMixBins, SetMixBinVolumes) */
+	float surround_bins[2][MAXIMUM_OUTPUT_CHANNELS];
 
 	/* 3D */
 	BOOL has_3d;
@@ -141,6 +155,7 @@ struct sdl_stream
 	clicks */
 	float current_left, current_right, current_room;
 	float current_direct_lowpass, current_room_lowpass;
+	float current_surround[2][MAXIMUM_OUTPUT_CHANNELS];
 	BOOL gains_valid;
 	/* the direct path's low pass, for each channel, and the room send's */
 	float direct_lowpass[2];
@@ -163,6 +178,9 @@ static struct
 } listener = { { 0, 0, 0 }, { 0, 0, 1 }, { 0, 1, 0 }, 1.0f, 1.0f };
 
 static float master_volume = 1.0f;
+/* 2 or 6 (audio.channels), chosen when the device first opens; the game
+sets its mix bins by it, so it holds while the game runs */
+static unsigned long output_channels = 2;
 
 /* the I3DL2 listener properties (SetI3DL2Listener), which the reverb models:
 DirectSound's defaults until the game sets an environment, their room level
@@ -457,6 +475,138 @@ static void voice_gains(const struct sdl_stream *stream, float *left, float *rig
 	*room *= stream->volume * master_volume;
 }
 
+/* the 5.1 speakers around the listener, clockwise from the center, and
+their directions in radians (ITU-R BS.775: fronts at 30 degrees, backs at
+110) */
+#define SURROUND_RING_SPEAKERS 5
+static const unsigned long surround_ring_channel[SURROUND_RING_SPEAKERS] = { 2, 1, 5, 4, 0 };
+static const float surround_ring_angle[SURROUND_RING_SPEAKERS + 1] =
+{
+	0.0f, 0.52359878f, 1.91986218f, 4.36332313f, 5.75958653f, 6.28318531f,
+};
+
+/* the speaker gains of a sound from a direction, side (right) and ahead: an
+equal power pan between the two speakers either side of it, blended (in
+power) towards all five equally by spread, 0 to 1. Their power sums to 1, as
+the stereo pan's does */
+static void surround_pan(float side, float ahead, float spread, float *gains)
+{
+	float angle = atan2f(side, ahead);
+	unsigned long segment, speaker;
+
+	for (speaker = 0; speaker < MAXIMUM_OUTPUT_CHANNELS; speaker++)
+		gains[speaker] = 0.0f;
+	if (angle < 0.0f)
+		angle += 6.28318531f;
+	for (segment = 0; segment < SURROUND_RING_SPEAKERS - 1; segment++)
+	{
+		if (angle < surround_ring_angle[segment + 1])
+			break;
+	}
+	{
+		float width = surround_ring_angle[segment + 1] - surround_ring_angle[segment];
+		float position = (angle - surround_ring_angle[segment]) / width;
+
+		position = position < 0.0f ? 0.0f : position > 1.0f ? 1.0f : position;
+		gains[surround_ring_channel[segment]] = cosf(position * 1.57079633f);
+		gains[surround_ring_channel[(segment + 1) % SURROUND_RING_SPEAKERS]] = sinf(position * 1.57079633f);
+	}
+	for (speaker = 0; speaker < SURROUND_RING_SPEAKERS; speaker++)
+	{
+		float *gain = &gains[surround_ring_channel[speaker]];
+
+		*gain = sqrtf((1.0f - spread) * *gain * *gain + spread / SURROUND_RING_SPEAKERS);
+	}
+}
+
+/* on 5.1, a voice's gains from each source channel to each speaker (the
+direct path's; its room send and low passes are voice_gains'):
+	- a 3D voice is panned around the speakers from its direction, a little
+	  spread so that it never vanishes between two, spread out towards all
+	  five inside its minimum distance and above or below, as the stereo pan
+	  centres those;
+	- a stereo voice positioned in the world has its channels' middle (the
+	  first row) panned towards it in the front half, and their difference
+	  (the second) kept on the front pair as wide as the stereo mix keeps it;
+	- a 2D voice goes by its mix bins. */
+static void voice_surround_gains(const struct sdl_stream *stream, float gains[2][MAXIMUM_OUTPUT_CHANNELS])
+{
+	float scale = stream->volume * master_volume;
+	unsigned long speaker;
+
+	memset(gains, 0, 2 * sizeof(gains[0]));
+	if (stream->has_3d && stream->mode != DS3DMODE_DISABLE)
+	{
+		float offset[3], right_axis[3], side, ahead, distance, horizontal, attenuation, spread = 0.1f;
+		int axis;
+
+		if (stream->mode == DS3DMODE_HEADRELATIVE)
+		{
+			for (axis = 0; axis < 3; axis++)
+				offset[axis] = stream->position[axis];
+			side = offset[0];
+			ahead = offset[2];
+		}
+		else
+		{
+			for (axis = 0; axis < 3; axis++)
+				offset[axis] = stream->position[axis] - listener.position[axis];
+			right_axis[0] = listener.top[1] * listener.front[2] - listener.top[2] * listener.front[1];
+			right_axis[1] = listener.top[2] * listener.front[0] - listener.top[0] * listener.front[2];
+			right_axis[2] = listener.top[0] * listener.front[1] - listener.top[1] * listener.front[0];
+			side = dot3(offset, right_axis);
+			ahead = dot3(offset, listener.front);
+		}
+		horizontal = sqrtf(side * side + ahead * ahead);
+		distance = sqrtf(dot3(offset, offset));
+		if (horizontal <= 1.0e-4f)
+			spread = 1.0f;
+		else if (distance > 1.0e-4f && 0.5f * (1.0f - horizontal / distance) > spread)
+			spread = 0.5f * (1.0f - horizontal / distance);
+		if (distance < stream->minimum_distance && stream->minimum_distance > 0.0f &&
+			1.0f - distance / stream->minimum_distance > spread)
+		{
+			spread = 1.0f - distance / stream->minimum_distance;
+		}
+		surround_pan(side, ahead, spread, gains[0]);
+		attenuation = distance_attenuation(stream, distance, listener.rolloff_factor) *
+			gain_from_millibels(stream->direct);
+		for (speaker = 0; speaker < MAXIMUM_OUTPUT_CHANNELS; speaker++)
+		{
+			gains[0][speaker] *= attenuation;
+			/* a stereo 3D voice: both channels from where it is */
+			if (stream->channels == 2)
+				gains[1][speaker] = gains[0][speaker] *= 0.5f;
+		}
+	}
+	else if (stream->channels == 2 && stream->stereo_positioned)
+	{
+		float pan = stream->stereo_pan < -1.0f ? -1.0f : stream->stereo_pan > 1.0f ? 1.0f : stream->stereo_pan;
+		float angle = (pan + 1.0f) * 0.25f * 3.14159265f;
+		float direct = gain_from_millibels(stream->direct);
+		float far_gain = (cosf(angle) < sinf(angle) ? cosf(angle) : sinf(angle)) * 1.41421356f;
+
+		/* the middle at the stereo pan's level (1 on each side when centred,
+		a power of 2) */
+		surround_pan(sinf(pan * 1.57079633f), cosf(pan * 1.57079633f), 0.1f, gains[0]);
+		for (speaker = 0; speaker < MAXIMUM_OUTPUT_CHANNELS; speaker++)
+			gains[0][speaker] *= 1.41421356f * stream->mix_left * direct;
+		gains[1][0] = far_gain * stream->mix_left * direct;
+		gains[1][1] = -far_gain * stream->mix_right * direct;
+	}
+	else
+	{
+		memcpy(gains, stream->surround_bins, 2 * sizeof(gains[0]));
+		if (stream->channels == 1)
+			memset(gains[1], 0, sizeof(gains[1]));
+	}
+	for (speaker = 0; speaker < MAXIMUM_OUTPUT_CHANNELS; speaker++)
+	{
+		gains[0][speaker] *= scale;
+		gains[1][speaker] *= scale;
+	}
+}
+
 /* ---------- resampling
 
 Each voice is resampled to the output rate by band-limited interpolation (J.
@@ -705,8 +855,8 @@ static BOOL voice_has_frames(struct sdl_stream *stream)
 
 /* ---------- mixing */
 
-/* mixes one voice into output (frames of stereo float), and into the reverb's
-send (frames of mono) */
+/* mixes one voice into output (frames of output_channels floats), and into
+the reverb's send (frames of mono) */
 static void mix_voice(struct sdl_stream *stream, float *output, float *send, unsigned long frames)
 {
 	double step;
@@ -718,6 +868,11 @@ static void mix_voice(struct sdl_stream *stream, float *output, float *send, uns
 	unsigned long frame;
 	/* (a stereo voice panned towards its sound: voice_gains) */
 	BOOL positioned = stream->channels == 2 && stream->stereo_positioned;
+	/* on 5.1, the speakers' gains (voice_surround_gains) */
+	BOOL surround = output_channels == 6;
+	float target_surround[2][MAXIMUM_OUTPUT_CHANNELS], surround_gains[2][MAXIMUM_OUTPUT_CHANNELS];
+	float ramp_surround[2][MAXIMUM_OUTPUT_CHANNELS];
+	unsigned long speaker;
 
 	if (stream->paused || !stream->packet_count || !stream->sample_rate)
 		return;
@@ -737,8 +892,12 @@ static void mix_voice(struct sdl_stream *stream, float *output, float *send, uns
 		stream->gains_valid = FALSE;
 	}
 	voice_gains(stream, &target_left, &target_right, &target_room, &target_direct_lowpass, &target_room_lowpass);
+	if (surround)
+		voice_surround_gains(stream, target_surround);
 	if (!stream->gains_valid)
 	{
+		if (surround)
+			memcpy(stream->current_surround, target_surround, sizeof(target_surround));
 		stream->current_left = target_left;
 		stream->current_right = target_right;
 		stream->current_room = target_room;
@@ -763,6 +922,16 @@ static void mix_voice(struct sdl_stream *stream, float *output, float *send, uns
 	ramp_room = (target_room - room) / (float)frames;
 	ramp_direct_lowpass = (target_direct_lowpass - direct_lowpass) / (float)frames;
 	ramp_room_lowpass = (target_room_lowpass - room_lowpass) / (float)frames;
+	if (surround)
+	{
+		for (speaker = 0; speaker < MAXIMUM_OUTPUT_CHANNELS; speaker++)
+		{
+			surround_gains[0][speaker] = stream->current_surround[0][speaker];
+			surround_gains[1][speaker] = stream->current_surround[1][speaker];
+			ramp_surround[0][speaker] = (target_surround[0][speaker] - surround_gains[0][speaker]) / (float)frames;
+			ramp_surround[1][speaker] = (target_surround[1][speaker] - surround_gains[1][speaker]) / (float)frames;
+		}
+	}
 
 	for (frame = 0; frame < frames; frame++)
 	{
@@ -860,7 +1029,23 @@ static void mix_voice(struct sdl_stream *stream, float *output, float *send, uns
 		}
 		direct_state[0] = sample_left;
 		direct_state[1] = sample_right;
-		if (stream->channels == 1)
+		if (surround)
+		{
+			/* the first row's gains take the left (a mono voice's only)
+			channel, or a positioned voice's middle; the second the right, or
+			its difference */
+			float *speakers = output + frame * MAXIMUM_OUTPUT_CHANNELS;
+			float first = positioned ? 0.5f * (sample_left + sample_right) : sample_left;
+			float second = positioned ? 0.5f * (sample_left - sample_right) : stream->channels == 2 ? sample_right : 0.0f;
+
+			for (speaker = 0; speaker < MAXIMUM_OUTPUT_CHANNELS; speaker++)
+			{
+				speakers[speaker] += first * surround_gains[0][speaker] + second * surround_gains[1][speaker];
+				surround_gains[0][speaker] += ramp_surround[0][speaker];
+				surround_gains[1][speaker] += ramp_surround[1][speaker];
+			}
+		}
+		else if (stream->channels == 1)
 		{
 			output[frame * 2] += sample_left * left;
 			output[frame * 2 + 1] += sample_left * right;
@@ -902,6 +1087,8 @@ static void mix_voice(struct sdl_stream *stream, float *output, float *send, uns
 	stream->current_room = target_room;
 	stream->current_direct_lowpass = target_direct_lowpass;
 	stream->current_room_lowpass = target_room_lowpass;
+	if (surround)
+		memcpy(stream->current_surround, target_surround, sizeof(target_surround));
 }
 
 /* ---------- reverb
@@ -1169,8 +1356,19 @@ static void reverb_process(const float *send, float *output, unsigned long frame
 			float left = early[0] * reflections_gain + late_left * late_gain;
 			float right = early[1] * reflections_gain + late_right * late_gain;
 
-			output[frame * 2] += left * reverb.level;
-			output[frame * 2 + 1] += right * reverb.level;
+			if (output_channels == 6)
+			{
+				/* from the front and back pairs, at the same power */
+				output[frame * 6] += left * reverb.level * 0.70710678f;
+				output[frame * 6 + 1] += right * reverb.level * 0.70710678f;
+				output[frame * 6 + 4] += left * reverb.level * 0.70710678f;
+				output[frame * 6 + 5] += right * reverb.level * 0.70710678f;
+			}
+			else
+			{
+				output[frame * 2] += left * reverb.level;
+				output[frame * 2 + 1] += right * reverb.level;
+			}
 			peak = fabsf(left) > peak ? fabsf(left) : peak;
 			peak = fabsf(right) > peak ? fabsf(right) : peak;
 			peak = fabsf(send[frame]) > peak ? fabsf(send[frame]) : peak;
@@ -1215,7 +1413,7 @@ The gain comes back up over LIMITER_RELEASE_SECONDS. */
 static struct
 {
 	/* the frames the output is delayed by, and the gain each needs */
-	float delay[LIMITER_LOOKAHEAD][OUTPUT_CHANNELS];
+	float delay[LIMITER_LOOKAHEAD][MAXIMUM_OUTPUT_CHANNELS];
 	float needed[LIMITER_LOOKAHEAD];
 	/* how many of them are under 1: none while nothing is too loud, when the
 	smallest is 1 without looking */
@@ -1247,13 +1445,13 @@ static void limit(float *output, unsigned long frames)
 	}
 	for (frame = 0; frame < frames; frame++)
 	{
-		float *sample = output + frame * OUTPUT_CHANNELS;
+		float *sample = output + frame * output_channels;
 		unsigned long position = limiter.position;
 		unsigned long oldest = (position + 1) % LIMITER_LOOKAHEAD;
 		float peak = 0.0f, lowest, gain;
 
 		/* the new frame takes the slot of the oldest, which has played */
-		for (channel = 0; channel < OUTPUT_CHANNELS; channel++)
+		for (channel = 0; channel < output_channels; channel++)
 		{
 			if (fabsf(sample[channel]) > peak)
 				peak = fabsf(sample[channel]);
@@ -1280,7 +1478,7 @@ static void limit(float *output, unsigned long frames)
 		limiter.history[position] = limiter.held;
 		gain = (float)(limiter.history_sum / LIMITER_LOOKAHEAD);
 		/* the frame LIMITER_LOOKAHEAD - 1 frames old plays */
-		for (channel = 0; channel < OUTPUT_CHANNELS; channel++)
+		for (channel = 0; channel < output_channels; channel++)
 			sample[channel] = limiter.delay[oldest][channel] * gain;
 		limiter.position = oldest;
 	}
@@ -1293,7 +1491,7 @@ static void mix(float *output, unsigned long frames)
 	BOOL enabled = reverb_enabled, changed = FALSE;
 	unsigned long serial = 0;
 
-	memset(output, 0, frames * OUTPUT_CHANNELS * sizeof(float));
+	memset(output, 0, frames * output_channels * sizeof(float));
 	memset(reverb.send, 0, frames * sizeof(float));
 	pthread_mutex_lock(&mixer_lock);
 	for (stream = streams; stream; stream = stream->next)
@@ -1316,8 +1514,25 @@ static void mix(float *output, unsigned long frames)
 		if ((!enabled && reverb.level <= 0.0f) || reverb.quiet > REVERB_QUIET_FRAMES)
 			reverb_clear();
 	}
-	/* the players' voices (voice_audio.c), dry, under the limiter */
-	voice_audio_mix(output, frames);
+	/* the players' voices (voice_audio.c), dry, under the limiter; on 5.1
+	from the front pair */
+	if (output_channels == 6)
+	{
+		float voices[MIX_CHUNK_FRAMES * OUTPUT_CHANNELS];
+		unsigned long frame;
+
+		memset(voices, 0, frames * OUTPUT_CHANNELS * sizeof(float));
+		voice_audio_mix(voices, frames);
+		for (frame = 0; frame < frames; frame++)
+		{
+			output[frame * 6] += voices[frame * 2];
+			output[frame * 6 + 1] += voices[frame * 2 + 1];
+		}
+	}
+	else
+	{
+		voice_audio_mix(output, frames);
+	}
 	limit(output, frames);
 }
 
@@ -1367,13 +1582,13 @@ static const char *audio_device_setting(void)
 
 static void SDLCALL audio_callback(void *userdata, SDL_AudioStream *stream, int additional_amount, int total_amount)
 {
-	float buffer[MIX_CHUNK_FRAMES * OUTPUT_CHANNELS];
+	float buffer[MIX_CHUNK_FRAMES * MAXIMUM_OUTPUT_CHANNELS];
 
 	(void)userdata;
 	(void)total_amount;
 	while (additional_amount > 0)
 	{
-		unsigned long frames = (unsigned long)additional_amount / (OUTPUT_CHANNELS * sizeof(float));
+		unsigned long frames = (unsigned long)additional_amount / (output_channels * sizeof(float));
 
 		if (frames > MIX_CHUNK_FRAMES)
 			frames = MIX_CHUNK_FRAMES;
@@ -1381,16 +1596,16 @@ static void SDLCALL audio_callback(void *userdata, SDL_AudioStream *stream, int
 			frames = 1;
 		mix(buffer, frames);
 		if (audio_log)
-			audio_log_level(buffer, frames * OUTPUT_CHANNELS);
-		SDL_PutAudioStreamData(stream, buffer, (int)(frames * OUTPUT_CHANNELS * sizeof(float)));
-		additional_amount -= (int)(frames * OUTPUT_CHANNELS * sizeof(float));
+			audio_log_level(buffer, frames * output_channels);
+		SDL_PutAudioStreamData(stream, buffer, (int)(frames * output_channels * sizeof(float)));
+		additional_amount -= (int)(frames * output_channels * sizeof(float));
 	}
 }
 
 /* without a device, drain voices in real time */
 static void *silent_clock_thread(void *parameter)
 {
-	float buffer[480 * OUTPUT_CHANNELS];
+	float buffer[480 * MAXIMUM_OUTPUT_CHANNELS];
 	struct timespec next;
 
 	(void)parameter;
@@ -1409,6 +1624,32 @@ static void *silent_clock_thread(void *parameter)
 	return NULL;
 }
 
+/* audio.channels: "stereo", "5.1", or "auto" for 5.1 when the device has
+at least six channels. Android and the browser play stereo */
+static unsigned long choose_output_channels(SDL_AudioDeviceID device)
+{
+#if defined(HALO_ANDROID) || defined(HALO_WEB) || defined(HALO_ARM64_GUEST)
+	(void)device;
+	return 2;
+#else
+	const char *setting = config_string("audio.channels");
+	SDL_AudioSpec format;
+
+	if (!strcmp(setting, "5.1"))
+		return 6;
+	if (strcmp(setting, "auto"))
+	{
+		if (strcmp(setting, "stereo"))
+			platform_log("audio.channels \"%s\" is not \"auto\", \"stereo\" or \"5.1\"; using stereo", setting);
+		return 2;
+	}
+	if ((SDL_GetAudioDeviceFormat(device, &format, NULL) ||
+		SDL_GetAudioDeviceFormat(SDL_AUDIO_DEVICE_DEFAULT_PLAYBACK, &format, NULL)) && format.channels >= 6)
+		return 6;
+	return 2;
+#endif
+}
+
 static void audio_start(void)
 {
 	SDL_AudioSpec spec;
@@ -1426,8 +1667,11 @@ static void audio_start(void)
 
 	if (config_boolean("audio.enabled") && platform_sdl_initialize())
 	{
+		snprintf(audio_device_name, sizeof(audio_device_name), "%s", audio_device_setting());
+		output_channels = choose_output_channels(platform_audio_device(FALSE, audio_device_name));
+		platform_log("sound: %s", output_channels == 6 ? "5.1 surround" : "stereo");
 		spec.format = SDL_AUDIO_F32;
-		spec.channels = OUTPUT_CHANNELS;
+		spec.channels = (int)output_channels;
 		spec.freq = OUTPUT_RATE;
 #ifdef HALO_ARM64_GUEST
 		/* frames per callback: on Android each callback is handed to a thread
@@ -1438,9 +1682,19 @@ static void audio_start(void)
 #elif !defined(HALO_WEB)
 		/* (a browser's, SDL's own: with room for the page's scheduling, which
 		512 frames underran) */
-		SDL_SetHint(SDL_HINT_AUDIO_DEVICE_SAMPLE_FRAMES, "512");
+		{
+			/* audio.buffer_frames: the device's buffer (port_config.c) */
+			long buffer_frames = config_integer("audio.buffer_frames");
+			char frames[16];
+
+			if (buffer_frames < 64)
+				buffer_frames = 64;
+			if (buffer_frames > 8192)
+				buffer_frames = 8192;
+			snprintf(frames, sizeof(frames), "%ld", buffer_frames);
+			SDL_SetHint(SDL_HINT_AUDIO_DEVICE_SAMPLE_FRAMES, frames);
+		}
 #endif
-		snprintf(audio_device_name, sizeof(audio_device_name), "%s", audio_device_setting());
 		audio_device_read_at = config_changes();
 		audio_stream = SDL_OpenAudioDeviceStream(platform_audio_device(FALSE, audio_device_name), &spec,
 			audio_callback, NULL);
@@ -1454,6 +1708,7 @@ static void audio_start(void)
 			return;
 		}
 		platform_log("cannot open an audio device (%s); sound is silent", SDL_GetError());
+		output_channels = 2;
 	}
 	{
 		pthread_t thread;
@@ -1478,7 +1733,9 @@ void dsound_sdl_output_device_check(void)
 		return;
 	snprintf(audio_device_name, sizeof(audio_device_name), "%s", audio_device_setting());
 	spec.format = SDL_AUDIO_F32;
-	spec.channels = OUTPUT_CHANNELS;
+	/* (the game's mix bins are set for the channels the sound started with;
+	SDL turns them into the new device's) */
+	spec.channels = (int)output_channels;
 	spec.freq = OUTPUT_RATE;
 	SDL_DestroyAudioStream(audio_stream);
 	stream = SDL_OpenAudioDeviceStream(platform_audio_device(FALSE, audio_device_name), &spec, audio_callback, NULL);
@@ -1784,7 +2041,7 @@ HRESULT WINAPI IDirectSound_GetCaps(LPDIRECTSOUND sound, LPDSCAPS caps)
 HRESULT WINAPI IDirectSound_GetSpeakerConfig(LPDIRECTSOUND sound, LPDWORD speaker_config)
 {
 	(void)sound;
-	*speaker_config = DSSPEAKER_STEREO;
+	*speaker_config = output_channels == 6 ? DSSPEAKER_ENABLE_AC3 : DSSPEAKER_STEREO;
 	return DS_OK;
 }
 
@@ -1900,6 +2157,8 @@ HRESULT WINAPI IDirectSound_CreateSoundStream(LPDIRECTSOUND sound, LPCDSSTREAMDE
 	stereo voice's channels to the front left and right */
 	stream->mix_left = 1.0f;
 	stream->mix_right = 1.0f;
+	stream->surround_bins[0][0] = 1.0f;
+	stream->surround_bins[stream->channels - 1][1] = 1.0f;
 	stream->has_3d = (description->dwFlags & DSSTREAMCAPS_CTRL3D) != 0;
 	stream->mode = DS3DMODE_NORMAL;
 	stream->minimum_distance = DS3D_DEFAULTMINDISTANCE;
@@ -1949,11 +2208,36 @@ HRESULT WINAPI IDirectSoundStream_SetVolume(LPDIRECTSOUNDSTREAM stream, LONG vol
 	STREAM_SETTER(record->volume = gain_from_millibels(volume))
 }
 
+/* the speaker bins of a mask, for 5.1, in the order of its set bits: a stereo
+voice sends its left channel to the first, third, ... and its right to the
+second, fourth, ... (the game's stereo voices on AC-3 take front left, front
+right, back left, back right). The crosstalk, reverb and effect sends are not
+speakers. volumes is NULL for 0 dB. */
+static void stream_set_surround_bins(struct sdl_stream *record, DWORD mix_bin_mask, const LONG *volumes, BOOL clear)
+{
+	unsigned long bit, index = 0;
+
+	if (clear)
+		memset(record->surround_bins, 0, sizeof(record->surround_bins));
+	for (bit = 0; bit < 32; bit++)
+	{
+		if (!(mix_bin_mask & (1UL << bit)))
+			continue;
+		if ((1UL << bit) & DSMIXBIN_SPEAKER_MASK)
+		{
+			record->surround_bins[record->channels == 2 ? index & 1 : 0][bit] =
+				volumes ? gain_from_millibels(volumes[index]) : 1.0f;
+		}
+		index++;
+	}
+}
+
 HRESULT WINAPI IDirectSoundStream_SetMixBins(LPDIRECTSOUNDSTREAM stream, DWORD mix_bin_mask)
 {
 	STREAM_SETTER(
 		record->mix_left = (mix_bin_mask & DSMIXBIN_FRONT_LEFT) ? 1.0f : 0.0f;
-		record->mix_right = (mix_bin_mask & DSMIXBIN_FRONT_RIGHT) ? 1.0f : 0.0f)
+		record->mix_right = (mix_bin_mask & DSMIXBIN_FRONT_RIGHT) ? 1.0f : 0.0f;
+		stream_set_surround_bins(record, mix_bin_mask, NULL, TRUE))
 }
 
 /* volumes come in the order of the set bits of the mask */
@@ -1973,6 +2257,7 @@ HRESULT WINAPI IDirectSoundStream_SetMixBinVolumes(LPDIRECTSOUNDSTREAM stream, D
 			record->mix_right = gain_from_millibels(volumes[index]);
 		index++;
 	}
+	stream_set_surround_bins(record, mix_bin_mask, volumes, FALSE);
 	pthread_mutex_unlock(&mixer_lock);
 	return DS_OK;
 }

port/linux/src/gl.h

@@ -139,7 +139,8 @@ this list to generate the guest's entry points */
 	X(glFramebufferTextureLayer) \
 	X(glFramebufferTextureMultiviewOVR) \
 	X(glIsEnabled) \
-	X(glGetQueryObjectuiv)
+	X(glGetQueryObjectuiv) \
+	X(glGetInternalformativ)
 /* entry points of extensions, which a driver may lack: loaded where the
 context has the extension, never required (gl_functions.c). On ES 3.0 and
 3.1 these stand in for glDrawElementsBaseVertex */
@@ -221,6 +222,7 @@ GL_KHR_parallel_shader_compile, as above */
 	X(glBindFramebuffer) \
 	X(glFramebufferTexture2D) \
 	X(glCheckFramebufferStatus) \
+	X(glGetFramebufferAttachmentParameteriv) \
 	X(glBlitFramebuffer) \
 	X(glDrawBuffers) \
 	X(glGenRenderbuffers) \
@@ -247,7 +249,6 @@ GL_KHR_parallel_shader_compile, as above */
 	X(glVertexAttribBinding) \
 	X(glBindVertexBuffer) \
 	X(glBindTextures) \
-	X(glGetQueryBufferObjectuiv) \
 	X(glVertexAttrib4fv) \
 	X(glVertexAttribI4ui) \
 	X(glDrawArrays) \
@@ -278,6 +279,12 @@ GL_KHR_parallel_shader_compile, as above */
 	X(glEndQuery) \
 	X(glGetQueryObjectuiv) \
 	X(glMemoryBarrier) \
+	X(glCreateQueries) \
+	X(glIsQuery) \
+	X(glGetQueryBufferObjectuiv) \
+	X(glFenceSync) \
+	X(glClientWaitSync) \
+	X(glDeleteSync) \
 	X(glDebugMessageCallback)
 #endif
 
@@ -413,6 +420,7 @@ pointers, sees the declarations without these aliases */
 #define glProgramBinary halo_glProgramBinary
 #define glGetTexParameteriv halo_glGetTexParameteriv
 #endif
+#define glGetInternalformativ halo_glGetInternalformativ
 #else
 #define glGetString halo_glGetString
 #define glGetIntegerv halo_glGetIntegerv
@@ -471,6 +479,7 @@ pointers, sees the declarations without these aliases */
 #define glBindFramebuffer halo_glBindFramebuffer
 #define glFramebufferTexture2D halo_glFramebufferTexture2D
 #define glCheckFramebufferStatus halo_glCheckFramebufferStatus
+#define glGetFramebufferAttachmentParameteriv halo_glGetFramebufferAttachmentParameteriv
 #define glBlitFramebuffer halo_glBlitFramebuffer
 #define glDrawBuffers halo_glDrawBuffers
 #define glGenRenderbuffers halo_glGenRenderbuffers
@@ -497,7 +506,6 @@ pointers, sees the declarations without these aliases */
 #define glVertexAttribBinding halo_glVertexAttribBinding
 #define glBindVertexBuffer halo_glBindVertexBuffer
 #define glBindTextures halo_glBindTextures
-#define glGetQueryBufferObjectuiv halo_glGetQueryBufferObjectuiv
 #define glVertexAttrib4fv halo_glVertexAttrib4fv
 #define glVertexAttribI4ui halo_glVertexAttribI4ui
 #define glDrawArrays halo_glDrawArrays
@@ -528,6 +536,12 @@ pointers, sees the declarations without these aliases */
 #define glEndQuery halo_glEndQuery
 #define glGetQueryObjectuiv halo_glGetQueryObjectuiv
 #define glMemoryBarrier halo_glMemoryBarrier
+#define glCreateQueries halo_glCreateQueries
+#define glIsQuery halo_glIsQuery
+#define glGetQueryBufferObjectuiv halo_glGetQueryBufferObjectuiv
+#define glFenceSync halo_glFenceSync
+#define glClientWaitSync halo_glClientWaitSync
+#define glDeleteSync halo_glDeleteSync
 #define glDebugMessageCallback halo_glDebugMessageCallback
 
 #endif

port/linux/src/hud_hires.c

@@ -10,7 +10,10 @@ first drawn and kept: up to 71 of the HUD's, about 227 MB with their mip
 levels, though a game draws only some (the scopes' only when zoomed), and
 the titles of the menus shown, about 3 MB each (11 MB for the carnage
 report's, a whole panel), and their button icons, about 0.3 MB each (5.3
-MB for the message icons' sheet).
+MB for the message icons' sheet). On the desktop builds a map's HUD PNGs
+are decoded as it loads, on a thread of their own, so that the HUD's first
+frame only uploads them (decoding them there held that frame up); what is
+decoded and not drawn is let go when the map is unloaded.
 They are drawn with linear filtering and their mip levels (d3d8_gl.c,
 configure_sampler), as they are larger than they appear.
 
@@ -27,11 +30,16 @@ zlib (port/third_party/zlib).
 
 #include "zlib_prefixed.h"
 
+#if !defined(HALO_ANDROID) && !defined(HALO_WEB)
+#define HUD_HIRES_DECODE_AHEAD
+#include <pthread.h>
+#endif
 #include <stdlib.h>
 #include <string.h>
 
 /* the game's (port/linux/game/hud_hires_tags.c) */
 long hud_hires_asset_at(unsigned long address, long width, long height);
+long hud_hires_asset_stock_custom_edition(unsigned long address, long width, long height, long asset);
 
 /* Include every embedded HUD and button style, including stick frames. */
 #define MAXIMUM_TEXTURES 256
@@ -40,19 +48,47 @@ a 4096 by 4096 sheet (the largest shipped, 2048 by 2048, takes 32 MB), and
 no more for a small file that names a large size (a menus folder's) */
 #define MAXIMUM_DECODED_SIZE (192UL << 20)
 
+/* a texture's PNG decoded ahead of its first draw (decode_state) */
+enum
+{
+	_decode_none,
+	_decode_queued,
+	_decode_decoding,
+	_decode_done,
+};
+
 static struct
 {
 	unsigned int texture;
 	unsigned long levels;
 	int failed;
 	int other_pixels_logged;
+	/* (decoded ahead: these, the decoding thread's until it is done, under
+	decode_lock) */
+	int decode_state;
+	unsigned char *pixels;
+	unsigned long width, height;
 } textures[MAXIMUM_TEXTURES];
 
+#ifdef HUD_HIRES_DECODE_AHEAD
+/* (the thread, detached, is waited for by its decode_running) */
+static pthread_mutex_t decode_lock = PTHREAD_MUTEX_INITIALIZER;
+static pthread_cond_t decode_finished = PTHREAD_COND_INITIALIZER;
+static int decode_running, decode_stopping;
+#endif
+
 long hud_hires_asset_count(void)
 {
 	return hud_hires_embedded_count < MAXIMUM_TEXTURES ? (long)hud_hires_embedded_count : MAXIMUM_TEXTURES;
 }
 
+/* whether the texture may stand for a Custom Edition map's stock bitmap of
+its name too (port/assets/hud/custom_edition.json) */
+int hud_hires_asset_custom_edition(long asset)
+{
+	return asset >= 0 && asset < hud_hires_asset_count() && hud_hires_embedded[asset].custom_edition;
+}
+
 char const *hud_hires_asset_tag(long asset)
 {
 	return hud_hires_embedded[asset].tag;
@@ -118,6 +154,10 @@ long hud_hires_override_find(unsigned long address, unsigned long width, unsigne
 		return -1;
 	if (!(hud_hires_embedded[asset].title ? titles_enabled : hud_enabled))
 		return -1;
+	/* (a Custom Edition map's stock HUD bitmap, laid out as this texture's,
+	has its own pixels) */
+	if (hud_hires_asset_stock_custom_edition(address, (long)width, (long)height, asset))
+		return asset;
 	if (crc32(0L, (const Bytef *)address, (uInt)level0_size) != hud_hires_embedded[asset].crc)
 	{
 		if (!textures[asset].other_pixels_logged)
@@ -493,20 +533,8 @@ failed:
 	return NULL;
 }
 
-unsigned char *hud_hires_png_pixels(const void *png, unsigned long size, unsigned long *width, unsigned long *height)
-{
-	return png_decode(png, size, width, height);
-}
-
-unsigned int hud_hires_png_texture(const void *png, unsigned long size, unsigned long *levels)
-{
-	unsigned long width = 0, height = 0;
-	unsigned char *pixels = png_decode(png, size, &width, &height);
-
-	return pixels ? hud_hires_pixels_texture(pixels, width, height, levels) : 0;
-}
-
-unsigned int hud_hires_pixels_texture(unsigned char *pixels, unsigned long width, unsigned long height,
+/* a GL texture of a decoded PNG's texels (which it frees), as below */
+static unsigned int png_pixels_texture(unsigned char *pixels, unsigned long width, unsigned long height,
 	unsigned long *levels)
 {
 	unsigned long largest;
@@ -528,6 +556,27 @@ unsigned int hud_hires_pixels_texture(unsigned char *pixels, unsigned long width
 	return texture;
 }
 
+unsigned int hud_hires_png_texture(const void *png, unsigned long size, unsigned long *levels)
+{
+	unsigned long width = 0, height = 0;
+	unsigned char *pixels = png_decode(png, size, &width, &height);
+
+	return png_pixels_texture(pixels, width, height, levels);
+}
+
+/* (port, Ringfall: the same in two steps, the decode on any thread:
+menu_files.c's menu pictures) */
+unsigned char *hud_hires_png_pixels(const void *png, unsigned long size, unsigned long *width, unsigned long *height)
+{
+	return png_decode(png, size, width, height);
+}
+
+unsigned int hud_hires_pixels_texture(unsigned char *pixels, unsigned long width, unsigned long height,
+	unsigned long *levels)
+{
+	return pixels ? png_pixels_texture(pixels, width, height, levels) : 0;
+}
+
 unsigned int hud_hires_override_texture(long asset, unsigned long *levels)
 {
 	const struct hud_hires_embedded *embedded;
@@ -540,7 +589,31 @@ unsigned int hud_hires_override_texture(long asset, unsigned long *levels)
 		return textures[asset].texture;
 	}
 	embedded = &hud_hires_embedded[asset];
-	textures[asset].texture = hud_hires_png_texture(embedded->png, embedded->png_size, &textures[asset].levels);
+	{
+		unsigned char *pixels = NULL;
+		unsigned long width = 0, height = 0;
+		int decoded = 0;
+
+#ifdef HUD_HIRES_DECODE_AHEAD
+		/* (its PNG decoded as the map loaded, or being decoded: waited for) */
+		pthread_mutex_lock(&decode_lock);
+		while (textures[asset].decode_state == _decode_decoding)
+			pthread_cond_wait(&decode_finished, &decode_lock);
+		if (textures[asset].decode_state == _decode_done)
+		{
+			pixels = textures[asset].pixels;
+			width = textures[asset].width;
+			height = textures[asset].height;
+			textures[asset].pixels = NULL;
+			decoded = 1;
+		}
+		textures[asset].decode_state = _decode_none;
+		pthread_mutex_unlock(&decode_lock);
+#endif
+		if (!decoded)
+			pixels = png_decode((const unsigned char *)embedded->png, embedded->png_size, &width, &height);
+		textures[asset].texture = png_pixels_texture(pixels, width, height, &textures[asset].levels);
+	}
 	if (!textures[asset].texture)
 	{
 		platform_log("high-res hud: could not decode the texture for %s bitmap %d", embedded->tag, embedded->bitmap);
@@ -550,3 +623,108 @@ unsigned int hud_hires_override_texture(long asset, unsigned long *levels)
 	*levels = textures[asset].levels;
 	return textures[asset].texture;
 }
+
+/* ---------- decoding ahead */
+
+#ifdef HUD_HIRES_DECODE_AHEAD
+static void *decode_thread_main(void *unused)
+{
+	long asset, count = hud_hires_asset_count();
+
+	(void)unused;
+	for (asset = 0; asset < count; asset++)
+	{
+		const struct hud_hires_embedded *embedded = &hud_hires_embedded[asset];
+		unsigned long width = 0, height = 0;
+		unsigned char *pixels;
+
+		pthread_mutex_lock(&decode_lock);
+		if (decode_stopping)
+		{
+			pthread_mutex_unlock(&decode_lock);
+			break;
+		}
+		if (textures[asset].decode_state != _decode_queued)
+		{
+			pthread_mutex_unlock(&decode_lock);
+			continue;
+		}
+		textures[asset].decode_state = _decode_decoding;
+		pthread_mutex_unlock(&decode_lock);
+		pixels = png_decode((const unsigned char *)embedded->png, embedded->png_size, &width, &height);
+		pthread_mutex_lock(&decode_lock);
+		textures[asset].pixels = pixels;
+		textures[asset].width = width;
+		textures[asset].height = height;
+		textures[asset].decode_state = _decode_done;
+		pthread_cond_broadcast(&decode_finished);
+		pthread_mutex_unlock(&decode_lock);
+	}
+	pthread_mutex_lock(&decode_lock);
+	decode_running = 0;
+	pthread_cond_broadcast(&decode_finished);
+	pthread_mutex_unlock(&decode_lock);
+	return NULL;
+}
+#endif
+
+void hud_hires_map_unloaded(void)
+{
+#ifdef HUD_HIRES_DECODE_AHEAD
+	long asset;
+
+	pthread_mutex_lock(&decode_lock);
+	decode_stopping = 1;
+	while (decode_running)
+		pthread_cond_wait(&decode_finished, &decode_lock);
+	pthread_mutex_unlock(&decode_lock);
+	for (asset = 0; asset < MAXIMUM_TEXTURES; asset++)
+	{
+		free(textures[asset].pixels);
+		textures[asset].pixels = NULL;
+		textures[asset].decode_state = _decode_none;
+	}
+#endif
+}
+
+void hud_hires_map_loaded(const long *assets, long count)
+{
+#ifdef HUD_HIRES_DECODE_AHEAD
+	long index, queued = 0;
+	pthread_t thread;
+
+	hud_hires_map_unloaded();
+	/* (none for a test's run that draws nothing, or with the high-res HUD
+	off: then each is decoded when first drawn, as titles are) */
+	if (!config_boolean("display.high_res_hud") || config_boolean("debug.null_renderer"))
+		return;
+	for (index = 0; index < count; index++)
+	{
+		long asset = assets[index];
+
+		if (asset >= 0 && asset < hud_hires_asset_count() && !hud_hires_embedded[asset].title &&
+			!textures[asset].texture && !textures[asset].failed)
+		{
+			textures[asset].decode_state = _decode_queued;
+			queued++;
+		}
+	}
+	if (!queued)
+		return;
+	decode_stopping = 0;
+	decode_running = 1;
+	if (pthread_create(&thread, NULL, decode_thread_main, NULL) == 0)
+	{
+		pthread_detach(thread);
+	}
+	else
+	{
+		decode_running = 0;
+		for (index = 0; index < MAXIMUM_TEXTURES; index++)
+			textures[index].decode_state = _decode_none;
+	}
+#else
+	(void)assets;
+	(void)count;
+#endif
+}

port/linux/src/hud_hires.h

@@ -44,6 +44,9 @@ struct hud_hires_embedded
 	int point_threshold; /* red: exact discrete meter thresholds, zero elsewhere */
 	int title;
 	unsigned int sprites;
+	/* drawn for a Custom Edition map's stock bitmap of its name too, whose
+	layout is its own (port/assets/hud/custom_edition.json) */
+	int custom_edition;
 	const unsigned int *png;
 	unsigned int png_size;
 };
@@ -75,6 +78,13 @@ may decode), and a texture of them (which frees them) */
 unsigned char *hud_hires_png_pixels(const void *png, unsigned long size, unsigned long *width, unsigned long *height);
 unsigned int hud_hires_pixels_texture(unsigned char *pixels, unsigned long width, unsigned long height,
 	unsigned long *levels);
+/* the HUD's textures for a map's bitmaps (port/linux/game/hud_hires_tags.c),
+decoded from their PNGs as it loads, on a thread of their own, so that they
+are only uploaded when first drawn; and, as it is unloaded, that stopped and
+what was decoded and not drawn let go. The desktop builds' alone: Android
+and the web decode each when it is first drawn */
+void hud_hires_map_loaded(const long *assets, long count);
+void hud_hires_map_unloaded(void);
 /* whether its green is its coverage (d3d8_gl.c, nv2a_psh.c: coverage_alpha) */
 int hud_hires_override_coverage(long asset);
 /* the GL texture of the texture drawn for some of a bitmap's sprites whose

port/linux/src/log_address.c

@@ -0,0 +1,132 @@
+/*
+LOG_ADDRESS.C
+
+An IP address as the log may show it (log_address.h): a public one as a
+tag of this run's, the rest as they are, all of them whole with
+debug.log_addresses.
+*/
+
+#include "platform.h"
+#include "posix.h"
+#include "port_config.h"
+#include "p2p_internal.h"
+#include "log_address.h"
+
+#include <stdio.h>
+#include <string.h>
+
+enum
+{
+	SALT_SIZE = 16,
+	/* bytes of the hash in a tag (6 hexadecimal digits) */
+	TAG_SIZE = 3,
+};
+
+/* (made once, by the first thread to log an address: 0 none, 1 being made,
+2 made. Not pthread_once, which the Android guest's C library cannot link) */
+static volatile int salt_state;
+static unsigned char salt[SALT_SIZE];
+
+static void make_salt(void)
+{
+	if (salt_state == 2)
+		return;
+	if (__sync_bool_compare_and_swap(&salt_state, 0, 1))
+	{
+		posix_random_bytes(salt, sizeof(salt));
+		__sync_synchronize();
+		salt_state = 2;
+		return;
+	}
+	while (salt_state != 2)
+	{
+	}
+	__sync_synchronize();
+}
+
+/* whether an address is no one's on the internet (log_address.h) */
+static int local_address(const unsigned char *bytes, int length)
+{
+	if (length == 4)
+	{
+		return bytes[0] == 0 || bytes[0] == 10 || bytes[0] == 127 ||
+			(bytes[0] == 172 && (bytes[1] & 0xF0) == 16) || (bytes[0] == 192 && bytes[1] == 168) ||
+			(bytes[0] == 169 && bytes[1] == 254) || (bytes[0] == 100 && (bytes[1] & 0xC0) == 64);
+	}
+	else
+	{
+		static const unsigned char zero[15] = { 0 };
+
+		/* ::1 and :: */
+		if (!memcmp(bytes, zero, 15) && bytes[15] <= 1)
+			return 1;
+		/* fc00::/7 and fe80::/10 */
+		return (bytes[0] & 0xFE) == 0xFC || (bytes[0] == 0xFE && (bytes[1] & 0xC0) == 0x80);
+	}
+}
+
+const char *log_address(const unsigned char *bytes, int length, int port, char *text, int size)
+{
+	char address[48];
+	int used;
+
+	if (!text || size <= 0)
+		return "";
+	if (!bytes || (length != 4 && length != 16))
+	{
+		snprintf(text, (size_t)size, "unknown");
+		return text;
+	}
+	if (local_address(bytes, length) || config_boolean("debug.log_addresses"))
+	{
+		if (length == 4)
+		{
+			snprintf(address, sizeof(address), "%u.%u.%u.%u", bytes[0], bytes[1], bytes[2], bytes[3]);
+		}
+		else
+		{
+			int group;
+
+			for (group = 0, used = 0; group < 8; group++)
+			{
+				used += snprintf(address + used, sizeof(address) - (size_t)used, "%s%x", group ? ":" : "",
+					(unsigned int)(bytes[2 * group] << 8 | bytes[2 * group + 1]));
+			}
+		}
+	}
+	else
+	{
+		unsigned char data[SALT_SIZE + 1 + 16];
+		unsigned char digest[P2P_SHA256_SIZE];
+		char tag[2 * TAG_SIZE + 1];
+
+		make_salt();
+		memcpy(data, salt, SALT_SIZE);
+		data[SALT_SIZE] = (unsigned char)length;
+		memcpy(data + SALT_SIZE + 1, bytes, (size_t)length);
+		p2p_sha256(data, SALT_SIZE + 1 + length, digest);
+		p2p_hex(digest, TAG_SIZE, tag);
+		snprintf(address, sizeof(address), "addr#%s", tag);
+		/* (a tag has no colons: no brackets) */
+		length = 4;
+	}
+	if (port < 0)
+		snprintf(text, (size_t)size, "%s", address);
+	else if (length == 16)
+		snprintf(text, (size_t)size, "[%s]:%d", address, port);
+	else
+		snprintf(text, (size_t)size, "%s:%d", address, port);
+	return text;
+}
+
+const char *log_address_ipv4(unsigned long network_address, unsigned short network_port, char *text, int size)
+{
+	/* (the 32 bits of a sockaddr_in's address, in its byte order) */
+	unsigned int value = (unsigned int)network_address;
+	unsigned char bytes[4];
+	unsigned char port[2];
+
+	memcpy(bytes, &value, 4);
+	memcpy(port, &network_port, 2);
+	return log_address(bytes, 4, network_port ? (port[0] << 8 | port[1]) : -1, text, size);
+}

port/linux/src/log_address.h

@@ -0,0 +1,46 @@
+/*
+LOG_ADDRESS.H
+
+The one way an IP address is written into the log (debug.txt, the terminal,
+the console, a dedicated server's journal): players post debug.txt in
+public, and a host's log names everyone who joined it. So a public address
+is never written whole, only as a tag, "addr#3f2a9c", the same for the same
+address all run long (a hash of it with a secret random salt of the run's),
+so a log's lines can still be matched up, but one run's tags say nothing of
+another's, and nothing of the address. The port follows as it is
+(":51234"): it is not who someone is, and it is what NAT debugging needs.
+
+Addresses that are no one's on the internet are written as they are:
+loopback, unspecified, the private ranges (10/8, 172.16/12, 192.168/16),
+link-local (169.254/16), 100.64/10 (carrier NAT, and internet play's
+stand-in addresses of its peers, xnet.c), and IPv6's ::1, ::, fc00::/7 and
+fe80::/10.
+
+debug.log_addresses (config.toml) writes every address whole, for a
+developer's own debugging; a log written that way is not one to post.
+
+Anything new that logs an address goes through log_address: never a
+"%u.%u.%u.%u" of its own.
+*/
+
+#ifndef LOG_ADDRESS_H
+#define LOG_ADDRESS_H
+
+enum
+{
+	/* the longest text log_address writes, with its terminator ("[" an IPv6
+	address "]:65535") */
+	LOG_ADDRESS_SIZE = 56,
+};
+
+/* an address as the log may show it (above): length 4 (IPv4) or 16 (IPv6)
+bytes, first byte first (the order an address is written in, network byte
+order); port in host byte order, or negative for none. Writes text (size
+bytes, LOG_ADDRESS_SIZE enough for any) and returns it */
+const char *log_address(const unsigned char *bytes, int length, int port, char *text, int size);
+
+/* the same for an IPv4 address in network byte order (a sockaddr_in's), and
+a port in network byte order (0: none) */
+const char *log_address_ipv4(unsigned long network_address, unsigned short network_port, char *text, int size);
+
+#endif

port/linux/src/memory_watch.c

@@ -15,6 +15,13 @@ buffer) would fail with EFAULT instead of faulting, so the file layer reads
 guest memory through a bounce buffer (xbox_files.c). Unprotecting ahead of
 such a write (memory_watch_prepare_write) is not enough on its own: the
 renderer can protect the pages again before the kernel writes them.
+
+The same handler reports a crash (SIGSEGV, and SIGBUS, SIGILL, SIGFPE and
+SIGABRT too): the signal, the registers and the calls, to the terminal and
+debug.txt, and then hands the signal to the handler before it, or the
+default action. It is installed before main, so that a crash at any time
+is reported; a library that installs its own later would take the watch's
+faults, so the renderer's device installs it again, chained to that one.
 */
 
 #include "platform.h"
@@ -30,12 +37,25 @@ renderer can protect the pages again before the kernel writes them.
 #define WATCH_PAGE_SIZE 0x1000UL
 #define WATCH_PAGE_COUNT (PLATFORM_CONTIGUOUS_SIZE / WATCH_PAGE_SIZE)
 
+/* (each page: 0 not watched, 1 watched and read-only, 2 made writable by a
+watched write. A fault on a page at 2 is a write another thread made as
+this one was making the page writable, and is made again; one on a page at
+0, freed memory or none of the watch's, is a crash) */
 static unsigned char page_protected[WATCH_PAGE_COUNT];
 static unsigned long page_generation[WATCH_PAGE_COUNT];
 static volatile unsigned long current_generation = 1;
-static struct sigaction previous_segv_action;
 static BOOL watch_active = FALSE;
 
+/* the signals reported as a crash, SIGSEGV first (the write tracking's), and
+what handled each before this file's handler */
+static const int crash_signals[] = { SIGSEGV, SIGBUS, SIGILL, SIGFPE, SIGABRT };
+#define CRASH_SIGNAL_COUNT (int)(sizeof(crash_signals) / sizeof(crash_signals[0]))
+static struct sigaction previous_actions[CRASH_SIGNAL_COUNT];
+/* a crash being reported: a handler chained to that hands the signal back
+here (one installed after this file's, which took this file's as its
+previous) gets the default action instead of a loop */
+static volatile sig_atomic_t crash_chaining = 0;
+
 static unsigned long page_index(unsigned long address)
 {
 	return (address - PLATFORM_CONTIGUOUS_BASE) / WATCH_PAGE_SIZE;
@@ -44,7 +64,7 @@ static unsigned long page_index(unsigned long address)
 static void mark_written(unsigned long page)
 {
 	page_generation[page] = __sync_add_and_fetch(&current_generation, 1);
-	page_protected[page] = 0;
+	page_protected[page] = 2;
 	mprotect((void *)(PLATFORM_CONTIGUOUS_BASE + page * WATCH_PAGE_SIZE), WATCH_PAGE_SIZE, PROT_READ | PROT_WRITE);
 }
 
@@ -66,79 +86,203 @@ static void crash_debug_line(const char *line)
 	write_to_error_file(text, 1);
 }
 
-static void segv_handler(int signal_number, siginfo_t *information, void *context)
+static const char *crash_signal_name(int signal_number)
 {
-	unsigned long address = (unsigned long)information->si_addr;
-
-	if (platform_is_contiguous((void *)address))
+	switch (signal_number)
 	{
-		unsigned long page = page_index(address);
+	case SIGSEGV:
+		return "segmentation fault";
+	case SIGBUS:
+		return "bus error";
+	case SIGILL:
+		return "illegal instruction";
+	case SIGFPE:
+		return "arithmetic exception";
+	case SIGABRT:
+		return "abort";
+	}
+	return "signal";
+}
 
-		if (page_protected[page])
+static int crash_signal_index(int signal_number)
+{
+	int index;
+
+	for (index = 0; index < CRASH_SIGNAL_COUNT; index++)
+	{
+		if (crash_signals[index] == signal_number)
+			return index;
+	}
+	return -1;
+}
+
+/* the report: the signal, the registers, the top of the stack and the
+calls, to the terminal and debug.txt */
+static void crash_report(int signal_number, siginfo_t *information, void *context)
+{
+	ucontext_t *ucontext = context;
+	char line[200];
+	void *frames[48];
+	unsigned long pc, frame, stack;
+	int count, length;
+
+#if defined(__i386__)
+	pc = (unsigned long)ucontext->uc_mcontext.gregs[REG_EIP];
+	frame = (unsigned long)ucontext->uc_mcontext.gregs[REG_EBP];
+	stack = (unsigned long)ucontext->uc_mcontext.gregs[REG_ESP];
+#elif defined(__x86_64__)
+	pc = (unsigned long)ucontext->uc_mcontext.gregs[REG_RIP];
+	frame = (unsigned long)ucontext->uc_mcontext.gregs[REG_RBP];
+	stack = (unsigned long)ucontext->uc_mcontext.gregs[REG_RSP];
+#else
+	pc = frame = stack = 0;
+	(void)ucontext;
+#endif
+	length = snprintf(line, sizeof(line), "halo-linux: %s (signal %d, code %d) at %p, eip %08lx ebp %08lx esp %08lx\n",
+		crash_signal_name(signal_number), signal_number, information ? information->si_code : 0,
+		information ? information->si_addr : NULL, pc, frame, stack);
+	write(STDERR_FILENO, line, (size_t)length);
+	crash_debug_line(line);
+	if (stack)
+	{
+		/* the return address a call through a bad pointer left behind */
+		const unsigned *words = (const unsigned *)stack;
+
+		length = snprintf(line, sizeof(line), "halo-linux: stack %08x %08x %08x %08x %08x %08x\n",
+			words[0], words[1], words[2], words[3], words[4], words[5]);
+		write(STDERR_FILENO, line, (size_t)length);
+		crash_debug_line(line);
+	}
+	count = backtrace(frames, 48);
+	backtrace_symbols_fd(frames, count, STDERR_FILENO);
+	{
+		int index;
+
+		for (index = 0; index < count; index++)
+		{
+			snprintf(line, sizeof(line), "halo-linux: called from %p\n", frames[index]);
+			crash_debug_line(line);
+		}
+	}
+}
+
+/* hands the signal to what handled it before this file's handler, which
+is put back: a fault returned from runs its instruction again under it, and
+a signal sent (kill, abort's raise) is raised again for it, once this
+handler returns */
+static void crash_chain(int index, int signal_number, siginfo_t *information, void *context)
+{
+	struct sigaction previous = previous_actions[index];
+
+	if (crash_chaining)
+	{
+		/* (back here from the handler chained to: its default ends it) */
+		signal(signal_number, SIG_DFL);
+		if (!information || information->si_code <= 0)
+			raise(signal_number);
+		return;
+	}
+	crash_chaining = 1;
+	sigaction(signal_number, &previous, NULL);
+	if (previous.sa_flags & SA_SIGINFO)
+	{
+		if (previous.sa_sigaction)
+			previous.sa_sigaction(signal_number, information, context);
+	}
+	else if (previous.sa_handler == SIG_DFL)
+	{
+		if (!information || information->si_code <= 0)
+			raise(signal_number);
+	}
+	else if (previous.sa_handler != SIG_IGN)
+	{
+		previous.sa_handler(signal_number);
+	}
+	crash_chaining = 0;
+}
+
+static void crash_handler(int signal_number, siginfo_t *information, void *context)
+{
+	int index = crash_signal_index(signal_number);
+
+	if (signal_number == SIGSEGV && information && platform_is_contiguous(information->si_addr))
+	{
+		unsigned long page = page_index((unsigned long)information->si_addr);
+
+		/* a write to a page the renderer watches: noted, and let through */
+		if (page < WATCH_PAGE_COUNT && page_protected[page] == 1)
 		{
 			mark_written(page);
 			return;
 		}
+		if (page < WATCH_PAGE_COUNT && page_protected[page] == 2)
+			return;
 	}
-	/* a genuine crash: report it, then hand it to whatever handled SIGSEGV
-	before */
+	if (index < 0)
+		return;
+	/* (a signal sent, not a fault, that was ignored before: still ignored) */
+	if (!crash_chaining && previous_actions[index].sa_handler == SIG_IGN &&
+		!(previous_actions[index].sa_flags & SA_SIGINFO) && information && information->si_code <= 0)
 	{
-		ucontext_t *ucontext = context;
-		char line[160];
-		void *frames[48];
-		int count, length;
-
-		length = snprintf(line, sizeof(line), "halo-linux: segmentation fault at %p, eip %08x ebp %08x esp %08x\n",
-			information->si_addr, (unsigned)ucontext->uc_mcontext.gregs[REG_EIP],
-			(unsigned)ucontext->uc_mcontext.gregs[REG_EBP], (unsigned)ucontext->uc_mcontext.gregs[REG_ESP]);
-		write(STDERR_FILENO, line, (size_t)length);
-		crash_debug_line(line);
-		{
-			/* the return address a call through a bad pointer left behind */
-			const unsigned *stack = (const unsigned *)ucontext->uc_mcontext.gregs[REG_ESP];
-
-			length = snprintf(line, sizeof(line), "halo-linux: stack %08x %08x %08x %08x %08x %08x\n",
-				stack[0], stack[1], stack[2], stack[3], stack[4], stack[5]);
-			write(STDERR_FILENO, line, (size_t)length);
-			crash_debug_line(line);
-		}
-		count = backtrace(frames, 48);
-		backtrace_symbols_fd(frames, count, STDERR_FILENO);
-		{
-			int frame;
-
-			for (frame = 0; frame < count; frame++)
-			{
-				snprintf(line, sizeof(line), "halo-linux: called from %p\n", frames[frame]);
-				crash_debug_line(line);
-			}
-		}
+		return;
 	}
-	sigaction(SIGSEGV, &previous_segv_action, NULL);
-	if (previous_segv_action.sa_flags & SA_SIGINFO)
-	{
-		if (previous_segv_action.sa_sigaction)
-			previous_segv_action.sa_sigaction(signal_number, information, context);
-	}
-	else if (previous_segv_action.sa_handler != SIG_DFL && previous_segv_action.sa_handler != SIG_IGN)
-	{
-		previous_segv_action.sa_handler(signal_number);
-	}
-	/* returning re-executes the faulting instruction under the old handler */
+	/* a genuine crash: report it (once), then hand it on */
+	if (!crash_chaining)
+		crash_report(signal_number, information, context);
+	crash_chain(index, signal_number, information, context);
 }
 
-void memory_watch_initialize(void)
+static BOOL crash_handler_installed(int signal_number, struct sigaction *current)
 {
-	struct sigaction action;
+	return sigaction(signal_number, NULL, current) == 0 && (current->sa_flags & SA_SIGINFO) &&
+		current->sa_sigaction == crash_handler;
+}
+
+/* the handler, for each signal where it is not the one installed (first, or
+a library put its own in since: a GL driver's, a sound library's), chained
+to the one that is; TRUE if SIGSEGV's is this file's */
+static BOOL crash_handlers_install(void)
+{
+	struct sigaction action, current;
+	int index;
 
-	if (watch_active)
-		return;
 	memset(&action, 0, sizeof(action));
-	action.sa_sigaction = segv_handler;
+	action.sa_sigaction = crash_handler;
+	/* (SA_NODEFER: a fault in the handler, or a write fault of the watch
+	in a nested one, comes back here) */
 	action.sa_flags = SA_SIGINFO | SA_NODEFER;
 	sigemptyset(&action.sa_mask);
-	if (sigaction(SIGSEGV, &action, &previous_segv_action) == 0)
-		watch_active = TRUE;
+	for (index = 0; index < CRASH_SIGNAL_COUNT; index++)
+	{
+		if (crash_handler_installed(crash_signals[index], &current))
+			continue;
+		previous_actions[index] = current;
+		sigaction(crash_signals[index], &action, NULL);
+		/* (a handler chained to that jumped out of the signal, instead of
+		returning, left the chaining unfinished) */
+		crash_chaining = 0;
+	}
+	return crash_handler_installed(SIGSEGV, &current);
+}
+
+/* at the renderer's device (d3d8_gl.c), before any page is protected; and
+from the start (below). A library that installed a SIGSEGV handler in
+between (the GL driver's, as the window opened) would get the protected
+pages' faults, and crash or hang at the first write to a texture: the
+handler goes in again, chained to that one */
+void memory_watch_initialize(void)
+{
+	watch_active = crash_handlers_install();
+}
+
+/* the handler from the start, for its crash report: the renderer's device
+(d3d8_gl.c) installs it too, but a game with debug.null_renderer (the
+network tests, net_compare) creates none, and a crash before the device
+went unreported */
+__attribute__((constructor))
+static void memory_watch_install(void)
+{
+	memory_watch_initialize();
 }
 
 void memory_watch_protect(unsigned long address, unsigned long size)
@@ -153,7 +297,7 @@ void memory_watch_protect(unsigned long address, unsigned long size)
 		last = WATCH_PAGE_COUNT - 1;
 	for (page = first; page <= last; page++)
 	{
-		if (!page_protected[page])
+		if (page_protected[page] != 1)
 		{
 			page_protected[page] = 1;
 			mprotect((void *)(PLATFORM_CONTIGUOUS_BASE + page * WATCH_PAGE_SIZE), WATCH_PAGE_SIZE, PROT_READ);
@@ -201,7 +345,7 @@ void memory_watch_prepare_write(void *address, unsigned long size)
 		last = WATCH_PAGE_COUNT - 1;
 	for (page = first; page <= last; page++)
 	{
-		if (page_protected[page])
+		if (page_protected[page] == 1)
 			mark_written(page);
 	}
 }
@@ -224,7 +368,11 @@ void memory_watch_forget(void *address, unsigned long size)
 	}
 }
 
-/* page protection sees each write at once: nothing to do per frame */
+/* page protection sees each write at once; once a frame, the handler is
+checked to be the one installed (a library may put its own in at any time:
+a sound device opened, a gamepad's) */
 void memory_watch_begin_frame(void)
 {
+	if (watch_active)
+		crash_handlers_install();
 }

port/linux/src/menu_files.c

@@ -577,7 +577,7 @@ static void read_strings(struct reader *reader, const XML_Char **attributes)
 {
 	struct halo_menus *menus = &reader->menus;
 	struct halo_menu_strings strings;
-	struct attribute table[] = { { "name", &strings.name } };
+	struct attribute table[] = { { "name", &strings.name }, { "map", &strings.map } };
 
 	memset(&strings, 0, sizeof(strings));
 	strings.first = menus->string_count;
@@ -594,11 +594,16 @@ static void read_string(struct reader *reader, const XML_Char **attributes, long
 {
 	struct halo_menus *menus = &reader->menus;
 	const char *text = NULL;
-	struct attribute table[] = { { "text", &text } };
+	long map = HALO_MENU_NONE, map_given = 0;
+	struct attribute table[] = { { "text", &text }, { "map", NULL, &map, &map_given } };
 
 	read_attributes(reader, "string", attributes, table, sizeof(table) / sizeof(*table));
 	if (!reader->failed && !text)
 		reader_error(reader, "a <string> needs text");
+	if (!reader->failed && map_given && (map < 0 || !menus->string_lists[owner].map))
+		reader_error(reader, "a <string>'s map= is an index in its <strings>' map list");
+	GROW(reader, menus->string_maps, menus->string_count);
+	menus->string_maps[menus->string_count] = map_given ? map : HALO_MENU_NONE;
 	GROW(reader, menus->strings, menus->string_count);
 	menus->strings[menus->string_count++] = text ? text : "";
 	menus->string_lists[owner].count++;

port/linux/src/nv2a_psh.c

@@ -289,6 +289,19 @@ static unsigned long stage_mode(const struct nv2a_pixel_shader_key *key, int sta
 	return (key->texture_modes >> (5 * stage)) & 0x1f;
 }
 
+/* whether a stage replaces the fragment's depth (DOT_ZW) */
+static BOOL replaces_depth(const struct nv2a_pixel_shader_key *key)
+{
+	int stage;
+
+	for (stage = 1; stage < 4; stage++)
+	{
+		if (stage_mode(key, stage) == _mode_dot_zw)
+			return TRUE;
+	}
+	return FALSE;
+}
+
 static int stage_input(const DWORD *state, int stage)
 {
 	switch (stage)
@@ -447,6 +460,20 @@ static void texture_stage(struct xgpu_text *text, const struct nv2a_pixel_shader
 		xgpu_text_append(text, "\tdot%d = dot(xT%d.xyz, ", stage, stage);
 		dot_input(text, state, stage);
 		xgpu_text_append(text, ");\n\tt%d = vec4(0.0);\n", stage);
+		/* the stage replaces the fragment's depth with the previous stage's
+		dot product over its own, in the depth buffer's units (the game's
+		z-sprites: a particle's card tested as the rounded puff its second
+		map describes, up to its radius nearer than the card, so that the
+		surface it stands on doesn't cut it in half). The game's depth
+		buffer is 24 bits and its viewport's depth range 0 to 1
+		(rasterizer_xbox.c), so the units are 1 / 16777215 of the window's
+		depth. A divisor that is not positive (a fragment behind the eye)
+		gives the far plane */
+		if (stage >= 1)
+		{
+			xgpu_text_append(text, "\treplaced_depth = dot%d > 0.0 ? clamp(dot%d / dot%d / 16777215.0, 0.0, 1.0) : 1.0;\n",
+				stage, stage - 1, stage);
+		}
 		break;
 	case _mode_dot_reflect_diffuse:
 		/* the normal takes its third component from stage 3's dot product */
@@ -642,6 +669,8 @@ char *nv2a_pixel_shader_to_glsl(const struct nv2a_pixel_shader_key *key)
 		"\tfloat dot0 = 0.0, dot1 = 0.0, dot2 = 0.0, dot3 = 0.0;\n");
 	if (key->per_pixel_lighting)
 		xgpu_text_append(&text, "\tv0.rgb = model_lighting();\n");
+	if (replaces_depth(key))
+		xgpu_text_append(&text, "\tfloat replaced_depth = 1.0;\n");
 
 	for (stage = 0; stage < 4; stage++)
 		texture_stage(&text, key, stage);
@@ -747,6 +776,8 @@ char *nv2a_pixel_shader_to_glsl(const struct nv2a_pixel_shader_key *key)
 	if (key->count_samples)
 		xgpu_text_append(&text, "\tatomicCounterIncrement(visible_samples);\n");
 #endif
+	if (replaces_depth(key))
+		xgpu_text_append(&text, "\tgl_FragDepth = replaced_depth;\n");
 	if (key->source_blend)
 	{
 		static const char *const factors[] =

port/linux/src/nv2a_vsh.c

@@ -342,6 +342,9 @@ static const char shader_prologue[] =
 	"uniform float point_size;\n"
 	/* columns the menus shift by to center on a wide screen (d3d8_gl.c) */
 	"uniform float screen_offset;\n"
+	/* a fade above a height on the model (d3d8_gl_set_height_fade): off
+	while w is zero */
+	"uniform vec4 height_fade;\n"
 	"out vec4 xD0;\n"
 	"out vec4 xD1;\n"
 	"out vec4 xB0;\n"
@@ -547,6 +550,13 @@ char *nv2a_vertex_shader_to_glsl(const DWORD *instructions, unsigned long instru
 			break;
 	}
 
+	xgpu_text_append(&text,
+		"\tif (height_fade.w != 0.0)\n"
+		"\t{\n"
+		"\t\tfloat faded = clamp((height_fade.y - (oT0.z - height_fade.z) / height_fade.w) * height_fade.x, 0.0, 1.0);\n"
+		"\t\toD0 *= faded;\n"
+		"\t\toD1 *= faded;\n"
+		"\t}\n");
 	xgpu_text_append(&text,
 		"\t/* undo the screen-space conversion done with c[-38] and c[-37] */\n"
 		"\tvec3 scale = vec3(viewport_scale.x != 0.0 ? viewport_scale.x : 1.0,\n"
@@ -627,3 +637,41 @@ char *nv2a_vertex_shader_to_glsl(const DWORD *instructions, unsigned long instru
 		);
 	return text.buffer;
 }
+
+/* The fixed-function pipeline's vertex shader, for the draws that select it
+(SetVertexShader with 0): only the loading screen's
+(progress_bar.c), which gives each vertex its position, diffuse color and
+up to four texture coordinates in immediate mode. d3d8_gl.c transforms the
+positions by the world, view and projection matrices before the draw, so the
+position here is already in Direct3D's clip space. */
+char *nv2a_fixed_function_glsl(void)
+{
+	struct xgpu_text text = { 0 };
+	unsigned long index;
+
+#ifdef HALO_GLES
+	xgpu_text_append(&text, "#version %s\n", xgpu_capabilities.shading_language);
+#endif
+	xgpu_text_append(&text, "%s", shader_prologue);
+	for (index = 0; index < XGPU_VERTEX_ATTRIBUTE_COUNT; index++)
+		xgpu_text_append(&text, "layout(location = %lu) in vec4 v%lu_in;\n", index, index);
+	xgpu_text_append(&text,
+		"void main()\n{\n"
+		"\tgl_Position = v0_in;\n"
+#ifdef HALO_GLES
+		"\tgl_Position.y = -gl_Position.y;\n"
+		"\tgl_Position.z = 2.0 * gl_Position.z - gl_Position.w;\n"
+#endif
+		"\tgl_PointSize = 1.0;\n"
+		"\txD0 = clamp(v3_in, 0.0, 1.0);\n"
+		"\txD1 = clamp(v4_in, 0.0, 1.0);\n"
+		"\txB0 = vec4(0.0, 0.0, 0.0, 1.0);\n"
+		"\txB1 = vec4(0.0, 0.0, 0.0, 1.0);\n"
+		"\txT0 = v9_in;\n"
+		"\txT1 = v10_in;\n"
+		"\txT2 = v11_in;\n"
+		"\txT3 = v12_in;\n"
+		"\txFog = 1.0;\n"
+		"}\n");
+	return text.buffer;
+}

port/linux/src/p2p.c

@@ -47,6 +47,11 @@ link games as if they were on one LAN, without a server of this project's.
   joiners' system link lists, and joining works as on a LAN. A peer reaches
   only the game's own ports (xnet.c says which it has), and has a few
   stand-ins and connections at a time.
+- The server browser times the tunnel to each public game's host (its
+  ping): a probe makes the tunnel as a join does, with the listing's token,
+  keeps the shortest of a few pings' round trips, and says goodbye. The
+  game sees nothing of a probe's peer; a join of its host takes its tunnel
+  up.
 
 The work happens on a thread of its own, under p2p_lock (let go of for
 whatever may wait: DNS, the desktop's link handlers); the game's threads
@@ -57,6 +62,7 @@ only look up and create stand-ins.
 #include "posix.h"
 #include "port_config.h"
 #include "p2p_internal.h"
+#include "log_address.h"
 #include "ikcp.h"
 #ifdef HALO_PROFILE
 #include "profile_trace.h"
@@ -123,6 +129,10 @@ enum
 	JOIN_TIMEOUT = 90000,
 	/* another player of the game joined, asked for (p2p_reach_player) */
 	PLAYER_REACH_TIMEOUT = 30000,
+	/* a public game's host probed for its ping (p2p_probe_start): its
+	round trip timed over this many pings, and given up after this long */
+	PROBE_PINGS = 3,
+	PROBE_TIMEOUT = 15000,
 	STREAM_LINGER_TIME = 10000,
 	PROXY_IDLE_TIME = 60000,
 	STUN_RETRY_INTERVAL = 500,
@@ -204,6 +214,12 @@ struct peer
 	unsigned long endpoint_heard_time;
 	unsigned long sent_time;
 	unsigned long round_trip;
+	/* the pings answered, and the shortest round trip of them */
+	int pongs;
+	unsigned long shortest_round_trip;
+	/* a public game's host probed for its ping (p2p_probe_start): none of
+	its traffic is the game's */
+	int probe;
 };
 
 /* a UDP stand-in for one port of a peer */
@@ -388,6 +404,15 @@ static struct
 		unsigned long time;
 	} reaching[P2P_MAXIMUM_PLAYER_JOINS];
 
+	/* the server browser's probes of public games' hosts
+	(p2p_probe_start): each host's identifier, and since when */
+	struct
+	{
+		int used;
+		unsigned char identifier[P2P_IDENTIFIER_SIZE];
+		unsigned long time;
+	} probes[P2P_MAXIMUM_PROBES];
+
 	/* joining: until the host is reached, or JOIN_TIMEOUT */
 	int join_requested;
 	int joining;
@@ -519,15 +544,6 @@ static void make_address(struct sockaddr_in *address, unsigned long ip, unsigned
 	address->sin_addr.s_addr = ip;
 }
 
-static const char *address_text(unsigned long ip, unsigned short port, char *text)
-{
-	unsigned long value = network_long(ip);
-
-	sprintf(text, "%lu.%lu.%lu.%lu:%u", value >> 24, (value >> 16) & 255, (value >> 8) & 255, value & 255,
-		network_short(port));
-	return text;
-}
-
 /* a UDP or TCP socket bound to ip:port (0 for any), not blocking; its port
 through bound_port; -1 on failure */
 static int open_socket(int type, unsigned long ip, unsigned short port, unsigned short *bound_port)
@@ -655,7 +671,7 @@ static struct peer *find_peer_by_address(unsigned long address)
 
 	for (index = 0; index < P2P_MAXIMUM_PEERS; index++)
 	{
-		if (p2p.peers[index].used && p2p.peers[index].virtual_address == address)
+		if (p2p.peers[index].used && !p2p.peers[index].probe && p2p.peers[index].virtual_address == address)
 			return &p2p.peers[index];
 	}
 	return NULL;
@@ -944,7 +960,6 @@ static int address_retired(unsigned long address)
 
 static void drop_peer(struct peer *peer, const char *reason)
 {
-	struct retired_session *retired = &p2p.retired[p2p.retired_next++ % MAXIMUM_RETIRED_SESSIONS];
 	int ask_again = p2p.joining && peer->is_host && !memcmp(peer->identifier, p2p.join_host, P2P_IDENTIFIER_SIZE);
 
 	if (peer->is_host && !memcmp(peer->identifier, p2p.join_host, P2P_IDENTIFIER_SIZE) &&
@@ -953,8 +968,11 @@ static void drop_peer(struct peer *peer, const char *reason)
 		p2p.join_state = peer->connected ? P2P_JOIN_LOST : P2P_JOIN_BLOCKED;
 	}
 
-	platform_log("Internet play: %s %s: %s", peer->is_host && !peer->is_player ? "host" : "player", peer->name,
-		reason);
+	if (!peer->probe)
+	{
+		platform_log("Internet play: %s %s: %s", peer->is_host && !peer->is_player ? "host" : "player", peer->name,
+			reason);
+	}
 	if (peer->connected)
 	{
 		unsigned char bye = _packet_bye;
@@ -965,10 +983,16 @@ static void drop_peer(struct peer *peer, const char *reason)
 	if (peer->connection >= 0)
 		p2p_webrtc_close(peer->connection);
 	/* a session that ended does not come back: its packets would pass
-	again */
-	memcpy(retired->secret, peer->secret, P2P_SHA256_SIZE);
-	retired->virtual_address = peer->virtual_address;
-	memcpy(retired->identifier, peer->identifier, P2P_IDENTIFIER_SIZE);
+	again. (Not a probe's, which pushes no other's out: its request ended
+	with it, and the game never had its address) */
+	if (!peer->probe)
+	{
+		struct retired_session *retired = &p2p.retired[p2p.retired_next++ % MAXIMUM_RETIRED_SESSIONS];
+
+		memcpy(retired->secret, peer->secret, P2P_SHA256_SIZE);
+		retired->virtual_address = peer->virtual_address;
+		memcpy(retired->identifier, peer->identifier, P2P_IDENTIFIER_SIZE);
+	}
 	memset(peer, 0, sizeof(*peer));
 	/* still joining: a new request, with a nonce of its own (the host
 	makes no second session from one request, which anyone who saw it could
@@ -977,6 +1001,16 @@ static void drop_peer(struct peer *peer, const char *reason)
 		p2p_signal_join(p2p.join_host_hash, p2p.join_token);
 }
 
+/* whether an offered address could be a machine's: not 0.0.0.0/8,
+multicast, reserved or broadcast (224.0.0.0 up), nor port 0. Loopback and
+LAN addresses stay: two copies on one machine or network use them */
+static int candidate_usable(const struct p2p_candidate *candidate)
+{
+	unsigned long first = network_long(candidate->address) >> 24;
+
+	return first != 0 && first < 224 && candidate->port != 0;
+}
+
 static void add_candidates(struct peer *peer, const struct p2p_candidate *candidates, int count)
 {
 	int index;
@@ -985,6 +1019,8 @@ static void add_candidates(struct peer *peer, const struct p2p_candidate *candid
 	{
 		int known;
 
+		if (!candidate_usable(&candidates[index]))
+			continue;
 		for (known = 0; known < peer->candidate_count; known++)
 		{
 			if (peer->candidates[known].address == candidates[index].address &&
@@ -1087,11 +1123,15 @@ int p2p_peer_offered(const unsigned char *peer_identifier, const unsigned char *
 		peer->virtual_address = virtual_address_for(peer_identifier);
 		peer->is_host = is_host;
 		peer->is_player = offered == _p2p_offered_player;
+		peer->probe = offered == _p2p_offered_probe;
 		p2p_key_hash(public_key, peer->key_hash);
 		peer->connection = -1;
 		peer->offered_time = p2p_now();
-		platform_log("Internet play: reaching %s %s%s", offered == _p2p_offered_host ? "host" : "player", peer->name,
-			webrtc->kind == _p2p_webrtc_browser ? " (a browser)" : "");
+		if (!peer->probe)
+		{
+			platform_log("Internet play: reaching %s %s%s", offered == _p2p_offered_host ? "host" : "player",
+				peer->name, webrtc->kind == _p2p_webrtc_browser ? " (a browser)" : "");
+		}
 	}
 	add_candidates(peer, candidates, count);
 	peer->connection = p2p_webrtc_offered(peer->connection, (int)(peer - p2p.peers), peer->secret, webrtc,
@@ -1159,14 +1199,16 @@ static void peer_heard(struct peer *peer, unsigned long address, unsigned short
 	peer->heard_time = now;
 	if (!peer->connected)
 	{
-		char text[32];
+		char text[LOG_ADDRESS_SIZE];
 
 		peer->connected = 1;
 		peer->endpoint.address = address;
 		peer->endpoint.port = port;
 		peer->endpoint_heard_time = now;
+		if (peer->probe)
+			return;
 		platform_log("Internet play: connected to %s %s at %s", peer->is_host && !peer->is_player ? "host" : "player",
-			peer->name, address_text(address, port, text));
+			peer->name, log_address_ipv4(address, port, text, sizeof(text)));
 		if (peer->is_host && !peer->is_player)
 		{
 			if (!memcmp(p2p.join_host, peer->identifier, P2P_IDENTIFIER_SIZE) && p2p.join_state != P2P_JOIN_NONE)
@@ -1307,12 +1349,15 @@ static void stun_update(void)
 
 		if (!server->address && !server->attempts)
 		{
-			/* looked up once, here on the p2p thread */
+			/* looked up here on the p2p thread, until it is found */
 			server->address = p2p_resolve(server->host);
 			if (!server->address)
 			{
 				platform_log("Internet play: cannot look up the STUN server %s", server->host);
+				/* (looked up again a refresh's time from now, below: the
+				network may not have been up yet) */
 				server->attempts = STUN_ATTEMPTS;
+				server->sent_time = p2p_now();
 				continue;
 			}
 		}
@@ -1329,7 +1374,7 @@ static void stun_update(void)
 		{
 			stun_send(server);
 		}
-		else if (server->attempts >= STUN_ATTEMPTS && server->address && elapsed(server->sent_time, STUN_REFRESH_INTERVAL))
+		else if (server->attempts >= STUN_ATTEMPTS && elapsed(server->sent_time, STUN_REFRESH_INTERVAL))
 		{
 			server->attempts = 0;
 		}
@@ -1382,14 +1427,14 @@ static void stun_received(const unsigned char *packet, int size, const struct so
 			}
 			if (!server->has_mapped)
 			{
-				char text[32];
+				char text[LOG_ADDRESS_SIZE];
 				int other;
 
 				memcpy(&server->mapped.address, ip, 4);
 				memcpy(&server->mapped.port, port, 2);
 				server->has_mapped = 1;
 				platform_log("Internet play: this machine's public address is %s (from %s)",
-					address_text(server->mapped.address, server->mapped.port, text), server->host);
+					log_address_ipv4(server->mapped.address, server->mapped.port, text, sizeof(text)), server->host);
 				for (other = 0; other < p2p.stun_count; other++)
 				{
 					if (other != index && p2p.stun[other].has_mapped &&
@@ -1776,7 +1821,7 @@ int p2p_broadcast_targets(unsigned short port, unsigned long *addresses, unsigne
 	{
 		struct proxy *proxy;
 
-		if (!p2p.peers[index].used || !p2p.peers[index].connected)
+		if (!p2p.peers[index].used || !p2p.peers[index].connected || p2p.peers[index].probe)
 			continue;
 		proxy = find_proxy(index, port, 1);
 		if (proxy)
@@ -1845,7 +1890,7 @@ int p2p_peer_address(const unsigned char *peer_identifier, unsigned long *addres
 	pthread_mutex_lock(&p2p_lock);
 	/* reached or not (until it is, sending there fails: p2p_outgoing) */
 	peer = find_peer(peer_identifier);
-	if (peer)
+	if (peer && !peer->probe)
 	{
 		*address = peer->virtual_address;
 		result = 1;
@@ -1854,6 +1899,21 @@ int p2p_peer_address(const unsigned char *peer_identifier, unsigned long *addres
 	return result;
 }
 
+int p2p_peer_ping(const unsigned char *peer_identifier)
+{
+	struct peer *peer;
+	int ping = -1;
+
+	if (!p2p.running)
+		return -1;
+	pthread_mutex_lock(&p2p_lock);
+	peer = find_peer(peer_identifier);
+	if (peer && peer->connected && !peer->probe && peer->pongs)
+		ping = (int)peer->round_trip;
+	pthread_mutex_unlock(&p2p_lock);
+	return ping;
+}
+
 /* ---------- the game's ports: all that peers may reach */
 
 void p2p_socket_port(int socket, int stream, int listening, unsigned short port)
@@ -2000,8 +2060,8 @@ static void datagram_received(struct peer *peer, const unsigned char *inner, int
 	struct proxy *proxy;
 	struct sockaddr_in to;
 
-	/* only to the game */
-	if (size < 5 || !game_port_open(0, get_short(inner + 3)))
+	/* only to the game, from a peer of its */
+	if (size < 5 || peer->probe || !game_port_open(0, get_short(inner + 3)))
 		return;
 	proxy = find_proxy((int)(peer - p2p.peers), get_short(inner + 1), 1);
 	if (!proxy)
@@ -2171,7 +2231,7 @@ static void stream_received(struct peer *peer, const unsigned char *data, int si
 	int count = 0, opening = 0;
 	int index;
 
-	if (size < 24)
+	if (size < 24 || peer->probe)
 		return;
 	conversation = ikcp_getconv(data);
 	for (index = 0; index < MAXIMUM_STREAMS && !stream; index++)
@@ -2363,6 +2423,8 @@ static void tunnel_received(const unsigned char *packet, int size, const struct
 
 			memcpy(&sent, inner + 1, 4);
 			peer->round_trip = (unsigned int)p2p_now() - sent;
+			if (!peer->pongs++ || peer->round_trip < peer->shortest_round_trip)
+				peer->shortest_round_trip = peer->round_trip;
 		}
 		break;
 	case _packet_datagram:
@@ -2414,6 +2476,125 @@ static void tunnel_readable(void)
 	}
 }
 
+/* ---------- the server browser's probes of public games' hosts */
+
+/* the probe of the host with this identifier, or -1 */
+static int probe_index(const unsigned char *host)
+{
+	int index;
+
+	for (index = 0; index < P2P_MAXIMUM_PROBES; index++)
+	{
+		if (p2p.probes[index].used && !memcmp(p2p.probes[index].identifier, host, P2P_IDENTIFIER_SIZE))
+			return index;
+	}
+	return -1;
+}
+
+/* a probe ends: its request, and its peer (unless a join took it up), go;
+the browser is told the shortest round trip timed, if any */
+static void probe_end(int index)
+{
+	unsigned char host[P2P_IDENTIFIER_SIZE];
+	struct peer *peer;
+	int ping;
+
+	memcpy(host, p2p.probes[index].identifier, P2P_IDENTIFIER_SIZE);
+	p2p.probes[index].used = 0;
+	p2p_signal_stop_probe(host);
+	peer = find_peer(host);
+	ping = peer && peer->pongs ? (int)peer->shortest_round_trip : -1;
+	if (peer && peer->probe)
+		drop_peer(peer, "probed");
+	p2p_lobby_probed(host, ping);
+}
+
+int p2p_probe_start(const unsigned char *host_hash, const unsigned char *token)
+{
+#ifdef HALO_WEB
+	/* (a browser reaches a host only by a WebRTC connection of its own) */
+	return 0;
+#else
+	unsigned char host[P2P_IDENTIFIER_SIZE];
+	struct peer *peer;
+	int free_index = -1;
+	int index;
+
+	p2p_identifier_from_hash(host_hash, host);
+	peer = find_peer(host);
+	/* (this machine's own game, and a host the tunnel reaches already: no
+	tunnel to make) */
+	if (!memcmp(host, identifier, P2P_IDENTIFIER_SIZE) || (peer && peer->connected && !peer->probe))
+	{
+		p2p_lobby_probed(host, peer && peer->pongs ? (int)peer->round_trip : -1);
+		return 1;
+	}
+	if (probe_index(host) >= 0)
+		return 1;
+	/* (a session with it under way, or a join of it: their own) */
+	if (peer || ((p2p.joining || p2p.join_requested) && !memcmp(host, p2p.join_host, P2P_IDENTIFIER_SIZE)))
+		return 0;
+	for (index = 0; index < P2P_MAXIMUM_PROBES && free_index < 0; index++)
+	{
+		if (!p2p.probes[index].used)
+			free_index = index;
+	}
+	if (free_index < 0)
+		return 0;
+	/* (the request carries the public address) */
+	p2p.stun_started = 1;
+	if (!stun_settled())
+		return 0;
+	p2p_signal_start();
+	if (!p2p_signal_probe(host_hash, token))
+		return 0;
+	p2p.probes[free_index].used = 1;
+	memcpy(p2p.probes[free_index].identifier, host, P2P_IDENTIFIER_SIZE);
+	p2p.probes[free_index].time = p2p_now();
+	return 1;
+#endif
+}
+
+/* the probes timed (PROBE_PINGS answered) end, as do those not reached in
+PROBE_TIMEOUT, and all of them once the browser closes */
+static void update_probes(void)
+{
+	int browsing = p2p_lobby_browsing();
+	int index;
+
+	for (index = 0; index < P2P_MAXIMUM_PROBES; index++)
+	{
+		struct peer const *peer;
+
+		if (!p2p.probes[index].used)
+			continue;
+		peer = find_peer(p2p.probes[index].identifier);
+		if (!browsing || (peer && peer->probe && peer->pongs >= PROBE_PINGS) ||
+			elapsed(p2p.probes[index].time, PROBE_TIMEOUT))
+		{
+			probe_end(index);
+		}
+	}
+}
+
+/* a join of a host being probed: the probe's tunnel, if it reached the
+host, is the join's (1); else the probe is given up, as the join's own
+session could not be made beside its */
+static int probe_taken_up(const unsigned char *host)
+{
+	int index = probe_index(host);
+	struct peer *peer = find_peer(host);
+	int taken = peer && peer->probe && peer->connected;
+
+	if (taken)
+		peer->probe = 0;
+	if (index >= 0)
+		probe_end(index);
+	else if (peer && peer->probe)
+		drop_peer(peer, "probe given up for a join");
+	return taken;
+}
+
 /* ---------- invites */
 
 /* the host's key hash and the token in an invite link or code within text:
@@ -2494,6 +2675,28 @@ static int join_invite(const char *text)
 	p2p_identifier_from_hash(hash, host);
 	if (!memcmp(host, identifier, P2P_IDENTIFIER_SIZE))
 		return 1;
+	if (probe_taken_up(host))
+	{
+		int index;
+
+		/* (a join of another game under way ends, and the last game's
+		players are not this one's) */
+		if (p2p.joining)
+			p2p_signal_stop_joining();
+		p2p.joining = p2p.join_requested = 0;
+		for (index = 0; index < P2P_MAXIMUM_PLAYER_JOINS; index++)
+		{
+			if (p2p.reaching[index].used && p2p.reaching[index].asked)
+				p2p_signal_stop_joining_player(p2p.reaching[index].identifier);
+		}
+		memset(p2p.reaching, 0, sizeof(p2p.reaching));
+		memcpy(p2p.join_host, host, sizeof(host));
+		memcpy(p2p.join_host_hash, hash, sizeof(hash));
+		memcpy(p2p.join_token, token, sizeof(token));
+		platform_log("Internet play: joining %s's game, reached already; it is listed under Multiplayer, "
+			"System Link", find_peer(host)->name);
+		return 1;
+	}
 	peer = find_peer(host);
 	if (peer && peer->connected)
 	{
@@ -2511,6 +2714,33 @@ static int join_invite(const char *text)
 	return 1;
 }
 
+/* (p2p.h) */
+const char *p2p_invite_log_text(const char *invite, char *text, int size)
+{
+	enum { SHOWN_DIGITS = 8 };
+	const char *start = invite;
+	const char *search;
+	size_t kept;
+
+	/* (after "halo://join/" or "halo://key/", if there is one) */
+	for (search = invite; *search; search++)
+	{
+		if (!strncmp(search, "://", 3))
+		{
+			const char *slash = strchr(search + 3, '/');
+
+			start = slash ? slash + 1 : search + 3;
+			break;
+		}
+	}
+	kept = (size_t)(start - invite) + SHOWN_DIGITS;
+	if (strlen(invite) <= kept)
+		snprintf(text, (size_t)size, "%s", invite);
+	else
+		snprintf(text, (size_t)size, "%.*s... (the rest is left out of the log)", (int)kept, invite);
+	return text;
+}
+
 int p2p_join_invite(const char *text)
 {
 	int result;
@@ -2812,8 +3042,12 @@ void p2p_new_invite_if_listed(void)
 	if (!p2p.has_token || !p2p.token_listed)
 		return;
 	make_invite();
-	platform_log("Internet play: a new invite, so that the one listed lets no one in (private, or a new password): %s",
-		p2p.invite);
+	{
+		char shown[128];
+
+		platform_log("Internet play: a new invite, so that the one listed lets no one in (private, or a new password): %s",
+			p2p_invite_log_text(p2p.invite, shown, sizeof(shown)));
+	}
 	if (p2p.hosting)
 	{
 		p2p_signal_host(p2p.token);
@@ -2849,13 +3083,16 @@ static void update_hosting(void)
 		{
 			/* (and a join code for it, p2p_code.c) */
 			unsigned char bytes[P2P_KEY_HASH_SIZE + P2P_TOKEN_SIZE];
+			char shown[128];
 
 			p2p_key_hash(p2p_public_key(), bytes);
 			memcpy(bytes + P2P_KEY_HASH_SIZE, p2p.token, P2P_TOKEN_SIZE);
 			p2p_code_host(bytes);
+			/* (whole on the clipboard and in the menus) */
+			platform_log("Internet play: hosting. Invite players with this link (it only works while this "
+				"copy of the game runs; it is on the clipboard): %s",
+				p2p_invite_log_text(p2p.invite, shown, sizeof(shown)));
 		}
-		platform_log("Internet play: hosting. Invite players with this link (it only works while this "
-			"copy of the game runs): %s", p2p.invite);
 		if (!p2p.invite_copied)
 		{
 			memcpy(p2p.clipboard, p2p.invite, sizeof(p2p.clipboard));
@@ -2956,6 +3193,18 @@ int p2p_reach_player(const unsigned char *key_hash)
 	return result;
 }
 
+int p2p_nat_strict(void)
+{
+	int strict;
+
+	if (!p2p.running)
+		return 0;
+	pthread_mutex_lock(&p2p_lock);
+	strict = p2p.reported_symmetric && !p2p.upnp_forwarded;
+	pthread_mutex_unlock(&p2p_lock);
+	return strict;
+}
+
 int p2p_peer_reached(const unsigned char *peer_identifier, unsigned long *address)
 {
 	struct peer *peer;
@@ -3034,13 +3283,13 @@ static void *upnp_thread(void *unused)
 	p2p.upnp_time = p2p_now();
 	if (forwarded)
 	{
-		char text[32];
+		char text[LOG_ADDRESS_SIZE];
 
 		if (!p2p.upnp_forwarded || p2p.upnp_candidate.address != address ||
 			p2p.upnp_candidate.port != external_port)
 		{
 			platform_log("Internet play: the router forwards %s to this machine (UPnP)",
-				address_text(address, external_port, text));
+				log_address_ipv4(address, external_port, text, sizeof(text)));
 		}
 		p2p.upnp_forwarded = 1;
 		p2p.upnp_candidate.address = address;
@@ -3106,7 +3355,7 @@ static int upnp_needed(void)
 	{
 		struct peer const *peer = &p2p.peers[index];
 
-		if (peer->used && !peer->connected &&
+		if (peer->used && !peer->connected && !peer->probe &&
 			((p2p.hosting && !peer->is_host) || elapsed(peer->offered_time, UPNP_JOIN_DELAY)))
 		{
 			return 1;
@@ -3518,6 +3767,7 @@ static void *p2p_thread(void *unused)
 		profile_trace_end(p2p_profile_names.kcp_update);
 #endif
 		update_peers();
+		update_probes();
 		webrtc_busy = p2p_webrtc_update();
 		expire_proxies();
 		stun_update();

port/linux/src/p2p.h

@@ -88,6 +88,9 @@ const unsigned char *p2p_identifier(void);
 /* the address the game reaches the machine with this identifier at, if it
 is an internet play peer (reached yet or not) */
 int p2p_peer_address(const unsigned char *identifier, unsigned long *address);
+/* the ping to the machine with this identifier, in milliseconds, if the
+tunnel reaches it; -1 if not, or not timed yet */
+int p2p_peer_ping(const unsigned char *identifier);
 
 /* a destination the game sends to or connects to (stream: a TCP socket;
 socket: the game's UDP socket connected to it, else -1): 1 if it is a peer's
@@ -135,6 +138,10 @@ void p2p_set_hosting_allowed(int allowed);
 /* the invite link of the game this machine hosts (empty, 0: none, or LAN
 only) */
 int p2p_invite_link(char *link, int size);
+/* an invite (a link or a code, or any text holding one) as the log shows
+it: its first digits only, since players post their logs and an invite lets
+anyone join; the dedicated server's log, its operator's, has it whole */
+const char *p2p_invite_log_text(const char *invite, char *text, int size);
 
 /* the hosted game's players and the most it takes, which Discord shows
 (0, 0: not hosting; until the game says, the machines the tunnel reaches
@@ -215,6 +222,9 @@ int p2p_joined_listed_host(void);
 /* a copy of the public games found, in the order shown (the most players
 first; then those not failed, the open ones, by name); returns their count */
 int p2p_lobby_games(struct p2p_listing *games, int maximum_count);
+/* how many hosts list a game of a newer network version, which is not
+shown (an old build sees none of the games) */
+int p2p_lobby_newer_games(void);
 /* a game the browser could not join: kept, marked failed, for this run */
 void p2p_lobby_mark_failed(const unsigned char *identifier);
 /* a locked game's invite (into its invite), if the password is its own:
@@ -279,6 +289,9 @@ int p2p_reach_player(const unsigned char *key_hash);
 /* whether the tunnel reaches the machine with this identifier, and the
 virtual address (network byte order) the game reaches it at */
 int p2p_peer_reached(const unsigned char *identifier, unsigned long *address);
+/* this network's NAT gives each destination its own port and no router
+forwards the tunnel's: only games behind more lenient NATs can be reached */
+int p2p_nat_strict(void);
 
 /* BLAKE2b with a 32-byte digest (Monocypher's): a map's pieces
 (map_share.c) */

port/linux/src/p2p_discord.c

@@ -173,7 +173,10 @@ static void send_activity(void)
 	else
 	{
 		size = snprintf(json, sizeof(json),
-			"{\"cmd\":\"SET_ACTIVITY\",\"nonce\":\"%lu\",\"args\":{\"pid\":%lu}}",
+			"{\"cmd\":\"SET_ACTIVITY\",\"nonce\":\"%lu\",\"args\":{\"pid\":%lu,\"activity\":{"
+			"\"details\":\"In Menus\","
+			"\"assets\":{\"large_image\":\"logo\",\"large_text\":\"Halo: Combat Evolved\"},"
+			"\"instance\":false}}}",
 			++discord.nonce, (unsigned long)posix_process_id());
 	}
 	discord_send(_opcode_frame, json, size);
@@ -315,7 +318,10 @@ void p2p_discord_update(void)
 		const char *application = config_string("discord.application_id");
 
 		discord.checked = 1;
-		if (*application && strlen(application) < sizeof(discord.application))
+		/* (an application's id is digits: it goes into a file's path and
+		the handshake's JSON) */
+		if (*application && strlen(application) < sizeof(discord.application) &&
+			strspn(application, "0123456789") == strlen(application))
 		{
 			char scheme[48];
 

port/linux/src/p2p_internal.h

@@ -34,19 +34,24 @@ enum
 	/* the other players of its game a machine asks to reach at once
 	(p2p_reach_player) */
 	P2P_MAXIMUM_PLAYER_JOINS = 8,
+	/* the server browser's public games' hosts probed at once, for their
+	ping (p2p_probe_start) */
+	P2P_MAXIMUM_PROBES = 4,
 };
 
 typedef char p2p_player_key_hash_size_assert[P2P_PLAYER_KEY_HASH_SIZE == P2P_KEY_HASH_SIZE ? 1 : -1];
 
 /* who offered a session (p2p_peer_offered): a joiner (to this machine,
-hosting or answering its game's players), the invite's host, or another
-player of the host's game this machine asked for (p2p_reach_player), which
-answers as a host does */
+hosting or answering its game's players), the invite's host, another player
+of the host's game this machine asked for (p2p_reach_player), which answers
+as a host does, or a public game's host probed for its ping
+(p2p_probe_start) */
 enum
 {
 	_p2p_offered_joiner,
 	_p2p_offered_host,
 	_p2p_offered_player,
+	_p2p_offered_probe,
 };
 
 typedef char p2p_listing_invite_size_assert[P2P_LISTING_INVITE_SIZE == P2P_LINK_SIZE ? 1 : -1];
@@ -152,6 +157,12 @@ the host; 0 if there is no room, or the request to the host is of another
 token. Stopped by its identifier */
 int p2p_signal_join_player(const unsigned char *player_hash, const unsigned char *token);
 void p2p_signal_stop_joining_player(const unsigned char *identifier);
+/* ... and a public game's host (whose key has this hash) with its listing's
+token, only to time the tunnel to it (p2p_probe_start): a request of its own
+token, whose answers come to a topic of their own; 0 if there is no room.
+Stopped by its identifier */
+int p2p_signal_probe(const unsigned char *host_hash, const unsigned char *token);
+void p2p_signal_stop_probe(const unsigned char *identifier);
 /* whether any broker is connected */
 int p2p_signal_connected(void);
 /* (for p2p_code.c) the topics every broker listens on, as they are now; and
@@ -375,6 +386,13 @@ void p2p_tunnel_send(unsigned long address, unsigned short port, const void *dat
 void p2p_peer_name(int peer, char *name);
 /* the tunnel's socket's port (network byte order) */
 unsigned short p2p_tunnel_local_port(void);
+/* the server browser's probe of a public game's host (its key's hash, its
+listing's token): the tunnel to it made, timed and closed again, its ping
+told p2p_lobby_probed (at once for this machine's own game, and a host the
+tunnel reaches already); 0 if it cannot start now (no room, the public
+address not known yet). The probes end as the browser closes. Under
+p2p_lock, on the p2p thread */
+int p2p_probe_start(const unsigned char *host_hash, const unsigned char *token);
 
 /* ---------- p2p_lobby.c: public games' listings */
 
@@ -389,6 +407,9 @@ slot's retained copy, sent on subscribing */
 void p2p_lobby_slot_heard(const char *hash_text, const unsigned char *payload, int size, int retained);
 /* a query was heard */
 void p2p_lobby_query_heard(void);
+/* a probe of a host (its identifier) ended: its ping in milliseconds, -1 if
+it was not reached; under p2p_lock */
+void p2p_lobby_probed(const unsigned char *identifier, int ping);
 /* the game is quitting: a listed game's tombstone, and its slot cleared,
 written to the brokers at once; under p2p_lock */
 void p2p_lobby_quit(void);

port/linux/src/p2p_lobby.c

@@ -35,8 +35,10 @@ one deletes or keeps is no authority, so
   keeps the newest of each host (by sequence), drops one not heard in
   GAME_EXPIRY (on its own clock; a retained copy is taken only if its time
   is within RETAINED_WINDOW of this machine's, from a host that died and
-  left it), takes a host's closing listing (a tombstone) as its end, and
-  ignores an emptied slot (a wipe is not a delete).
+  left it, and a live one only within LIVE_WINDOW, so an old listing
+  published again by someone else does not list a game long gone), takes
+  a host's closing listing (a tombstone) as its end, and ignores an
+  emptied slot (a wipe is not a delete).
 A host that stops publishes a tombstone, then clears its slot. Going private
 makes a new invite (p2p.c), so a listing seen before lets no one in.
 
@@ -51,6 +53,10 @@ going private does.
 Checking signatures takes work, and anyone can send listings: at most
 VERIFY_BUDGET milliseconds of it each pass of the p2p thread, from a queue
 of MAXIMUM_QUEUED; the rest is dropped (hosts publish again).
+
+Each game's host is probed for its ping (p2p_probe_start: the tunnel to it
+timed, p2p.c), a few at once, again each PROBE_REFRESH and on Refresh. A
+game with a password is not: its token is sealed.
 */
 
 #include "platform.h"
@@ -90,10 +96,13 @@ enum
 	TRIGGER_INTERVAL = 5000,
 	QUERY_JITTER = 2000,
 	GAME_EXPIRY = 90000,
+	PROBE_REFRESH = 120000,
 	TOMBSTONE_TIME = 600000,
 	VERIFY_BUDGET = 2,
 	/* seconds */
 	RETAINED_WINDOW = 600,
+	/* (wide: a host whose clock is off is still listed) */
+	LIVE_WINDOW = 3600,
 };
 
 static const char signature_label[] = "hceu-lobby-1";
@@ -131,6 +140,13 @@ struct game
 	unsigned char payload[MAXIMUM_LISTING_SIZE];
 	int payload_size;
 	struct p2p_listing listing;
+	/* its invite's token (none: a password's game); its host's ping
+	(-1: not known), whether it is being probed, and when it last was */
+	int has_token;
+	unsigned char token[P2P_TOKEN_SIZE];
+	int ping;
+	int probing;
+	unsigned long probed_time;
 };
 
 struct tombstone
@@ -185,6 +201,15 @@ static struct
 	/* the identifiers of games joining failed */
 	unsigned char failed[MAXIMUM_GAMES][P2P_IDENTIFIER_SIZE];
 	int failed_count;
+	/* the hosts heard listing a game of a newer network version, which are
+	not shown (an old build sees none of the games: the browser says why),
+	each forgotten as a game is (GAME_EXPIRY) */
+	struct
+	{
+		unsigned char key_hash[P2P_KEY_HASH_SIZE];
+		unsigned long heard_time;
+		int used;
+	} newer[MAXIMUM_GAMES];
 } lobby;
 
 static int elapsed(unsigned long since, unsigned long time)
@@ -607,6 +632,7 @@ static void listing_take(const struct queued *queued, const struct listing *list
 		game = &lobby.games[index];
 		memset(game, 0, sizeof(*game));
 		memcpy(game->key_hash, queued->key_hash, P2P_KEY_HASH_SIZE);
+		game->ping = -1;
 		game->used = 1;
 	}
 	game->sequence = listing->sequence;
@@ -615,6 +641,8 @@ static void listing_take(const struct queued *queued, const struct listing *list
 	game->payload_size = queued->size;
 	shown = &game->listing;
 	shown->locked = (listing->flags & _listing_password) != 0;
+	game->has_token = !shown->locked;
+	memcpy(game->token, listing->token, P2P_TOKEN_SIZE);
 	if (shown->locked)
 	{
 		/* (its invite once the password opens its token: p2p_listing_unlock) */
@@ -640,7 +668,57 @@ static void listing_take(const struct queued *queued, const struct listing *list
 	shown->open = (listing->flags & _listing_open) != 0;
 	shown->in_progress = (listing->flags & _listing_in_progress) != 0;
 	shown->has_teams = (listing->flags & _listing_has_teams) != 0;
-	shown->ping = -1;
+}
+
+/* the hosts' pings: those not known lately probed, while there is room (a
+few refused, and the rest wait for a later pass) */
+static void update_probes(void)
+{
+	int refused = 0;
+	int index;
+
+	for (index = 0; index < MAXIMUM_GAMES && refused < P2P_MAXIMUM_PROBES; index++)
+	{
+		struct game *game = &lobby.games[index];
+
+		if (!game->used || !game->has_token || game->probing ||
+			(game->probed_time && !elapsed(game->probed_time, PROBE_REFRESH)))
+		{
+			continue;
+		}
+		/* (set first: a probe that needs no tunnel ends at once,
+		p2p_lobby_probed) */
+		game->probing = 1;
+		game->probed_time = p2p_now() | 1;
+		if (!p2p_probe_start(game->key_hash, game->token))
+		{
+			game->probing = 0;
+			game->probed_time = 0;
+			refused++;
+		}
+	}
+}
+
+/* a host heard listing a game of a newer network version (lobby.newer) */
+static void newer_heard(const unsigned char *key_hash)
+{
+	int index, free_index = -1;
+
+	for (index = 0; index < MAXIMUM_GAMES; index++)
+	{
+		if (lobby.newer[index].used && !memcmp(lobby.newer[index].key_hash, key_hash, P2P_KEY_HASH_SIZE))
+		{
+			lobby.newer[index].heard_time = p2p_now();
+			return;
+		}
+		if (!lobby.newer[index].used && free_index < 0)
+			free_index = index;
+	}
+	if (free_index < 0)
+		return;
+	memcpy(lobby.newer[free_index].key_hash, key_hash, P2P_KEY_HASH_SIZE);
+	lobby.newer[free_index].heard_time = p2p_now();
+	lobby.newer[free_index].used = 1;
 }
 
 static void update_browsing(void)
@@ -662,18 +740,27 @@ static void update_browsing(void)
 		int good;
 
 		memmove(lobby.queue, lobby.queue + 1, sizeof(*lobby.queue) * (size_t)(--lobby.queue_count));
+		/* (a newer version's game is counted, not shown: its host's key
+		hash only, unverified, so it is no more than a count) */
+		if (lobby.browsing && listing_read(queued.payload, queued.size, &listing) &&
+			listing.version > HALO_PORT_NETWORK_VERSION && !(listing.flags & _listing_closed))
+		{
+			newer_heard(queued.key_hash);
+			continue;
+		}
 		if (!listing_read(queued.payload, queued.size, &listing) || listing.version != HALO_PORT_NETWORK_VERSION ||
 			!signing_key_hash(listing.key, key_hash) || memcmp(key_hash, queued.key_hash, P2P_KEY_HASH_SIZE))
 		{
 			continue;
 		}
 		/* a slot's retained copy: only one of about now (a host that died
-		left it, and nothing cleared it) */
-		if (queued.retained)
+		left it, and nothing cleared it); a live one: not one long gone,
+		published again by someone who kept it */
 		{
 			long difference = (long)(listing.time - (unsigned long)time(NULL));
+			long window = queued.retained ? RETAINED_WINDOW : LIVE_WINDOW;
 
-			if (difference > RETAINED_WINDOW || difference < -RETAINED_WINDOW)
+			if (difference > window || difference < -window)
 				continue;
 		}
 		/* (the work, without the lock: the game's threads need not wait) */
@@ -689,6 +776,29 @@ static void update_browsing(void)
 	{
 		if (lobby.games[index].used && elapsed(lobby.games[index].heard_time, GAME_EXPIRY))
 			lobby.games[index].used = 0;
+		if (lobby.newer[index].used && elapsed(lobby.newer[index].heard_time, GAME_EXPIRY))
+			lobby.newer[index].used = 0;
+	}
+	if (lobby.browsing)
+		update_probes();
+}
+
+void p2p_lobby_probed(const unsigned char *identifier, int ping)
+{
+	int index;
+
+	for (index = 0; index < MAXIMUM_GAMES; index++)
+	{
+		struct game *game = &lobby.games[index];
+
+		if (game->used && !memcmp(game->listing.identifier, identifier, P2P_IDENTIFIER_SIZE))
+		{
+			game->probing = 0;
+			game->probed_time = p2p_now() | 1;
+			/* (one not reached this time keeps the last it had) */
+			if (ping >= 0)
+				game->ping = ping;
+		}
 	}
 }
 
@@ -804,6 +914,7 @@ void p2p_lobby_browse(int on)
 		if (!on)
 		{
 			memset(lobby.games, 0, sizeof(lobby.games));
+			memset(lobby.newer, 0, sizeof(lobby.newer));
 			lobby.queue_count = 0;
 		}
 		lobby.query_wanted = on;
@@ -814,9 +925,17 @@ void p2p_lobby_browse(int on)
 
 void p2p_lobby_refresh(void)
 {
+	int index;
+
 	pthread_mutex_lock(&p2p_lock);
 	if (lobby.browsing)
 		lobby.query_wanted = 1;
+	/* (the pings timed again) */
+	for (index = 0; index < MAXIMUM_GAMES; index++)
+	{
+		if (!lobby.games[index].probing)
+			lobby.games[index].probed_time = 0;
+	}
 	pthread_mutex_unlock(&p2p_lock);
 }
 
@@ -852,6 +971,7 @@ int p2p_lobby_games(struct p2p_listing *games, int maximum_count)
 			continue;
 		games[count] = lobby.games[index].listing;
 		games[count].failed = (unsigned char)identifier_failed(games[count].identifier);
+		games[count].ping = (short)lobby.games[index].ping;
 		count++;
 	}
 	pthread_mutex_unlock(&p2p_lock);
@@ -881,6 +1001,18 @@ int p2p_listing_unlock(struct p2p_listing *listing, const char *password)
 	return opened;
 }
 
+int p2p_lobby_newer_games(void)
+{
+	int count = 0;
+	int index;
+
+	pthread_mutex_lock(&p2p_lock);
+	for (index = 0; index < MAXIMUM_GAMES; index++)
+		count += lobby.newer[index].used;
+	pthread_mutex_unlock(&p2p_lock);
+	return count;
+}
+
 void p2p_lobby_mark_failed(const unsigned char *identifier)
 {
 	pthread_mutex_lock(&p2p_lock);

port/linux/src/p2p_signal.c

@@ -112,8 +112,6 @@ enum
 	MAXIMUM_LISTING_SIZE = 320,
 	/* the publishes awaiting acknowledgement on a broker */
 	MAXIMUM_IN_FLIGHT = 4,
-	/* the topics a broker is subscribed to (_topic_*) */
-	NUMBER_OF_TOPICS = 8,
 	/* a broker's publishes: at most PUBLISH_BURST at once, one more each
 	PUBLISH_INTERVAL milliseconds (EMQX drops a connection's publishes past
 	about 10 a second, without a word) */
@@ -174,7 +172,8 @@ enum
 {
 	_topic_host,
 	_topic_join,
-	/* the server browser's (p2p_lobby.c): the own slot, queries, all slots */
+	/* the server browser's (p2p_lobby.c): the own slot, queries, all slots,
+	and each probe's answers (p2p_signal_probe) */
 	_topic_own_slot,
 	_topic_query,
 	_topic_slots,
@@ -183,6 +182,9 @@ enum
 	_topic_code_host,
 	_topic_code_look,
 	_topic_list,
+	_topic_probe,
+	/* the topics a broker is subscribed to */
+	NUMBER_OF_TOPICS = _topic_probe + P2P_MAXIMUM_PROBES,
 };
 
 /* MQTT 5's properties */
@@ -312,6 +314,16 @@ struct budget
 	unsigned long time;
 };
 
+/* a public game's host asked only to time the tunnel to it
+(p2p_signal_probe): a request of its listing's token, whose answers come
+sealed with its key to its topic */
+struct probe
+{
+	struct join join;
+	unsigned char key[P2P_SHA256_SIZE];
+	char topic[TOPIC_SIZE];
+};
+
 struct used_request
 {
 	/* the joiner's identifier and nonce */
@@ -367,6 +379,9 @@ static struct
 	unsigned char join_token[P2P_TOKEN_SIZE];
 	unsigned char join_key[P2P_SHA256_SIZE];
 	char join_topic[TOPIC_SIZE];
+
+	/* the server browser's probes (p2p_signal_probe) */
+	struct probe probes[P2P_MAXIMUM_PROBES];
 } signalling;
 
 static int elapsed(unsigned long since, unsigned long time)
@@ -664,7 +679,9 @@ static int broker_publish_listing(struct broker *broker, const unsigned char *pa
 	if (size)
 		memcpy(broker->in_flight[free_index].payload, payload, (size_t)size);
 	broker_publish_slot(broker, broker->in_flight[free_index].identifier, payload, size, 0);
-	return 1;
+	/* (not sent if the send closed the broker: published again once it is
+	connected, as its will cleared the slot) */
+	return broker->state == _broker_ready;
 }
 
 /* whether the broker carries the server browser: retained messages and
@@ -691,6 +708,8 @@ static void broker_sync_topics(struct broker *broker)
 	/* (the VR port's join codes and public games: p2p_code.c, p2p_list.c) */
 	p2p_code_topics(&wanted[_topic_code_host], &wanted[_topic_code_look]);
 	wanted[_topic_list] = p2p_list_topic();
+	for (index = 0; index < P2P_MAXIMUM_PROBES; index++)
+		wanted[_topic_probe + index] = signalling.probes[index].join.active ? signalling.probes[index].topic : "";
 	for (index = 0; index < NUMBER_OF_TOPICS; index++)
 	{
 		char *had = broker->topics[index];
@@ -701,6 +720,10 @@ static void broker_sync_topics(struct broker *broker)
 			broker_topic(broker, had, 0, 0);
 		if (wanted[index][0])
 			broker_topic(broker, wanted[index], 1, index == _topic_own_slot);
+		/* (a send that failed closed the broker, which forgot its topics:
+		they are asked for again once it is ready again) */
+		if (broker->state != _broker_ready)
+			return;
 		/* (once subscribed to the slots, the hosts are asked to publish:
 		retained copies come at once, but may be old) */
 		if (index == _topic_slots && wanted[index][0])
@@ -1074,8 +1097,22 @@ static int host_nonce_current(const unsigned char *public_key, const unsigned ch
 
 /* ---------- the messages */
 
+/* the probe a request is, or NULL (one of the joins) */
+static struct probe *join_probe(struct join *join)
+{
+	int index;
+
+	for (index = 0; index < P2P_MAXIMUM_PROBES; index++)
+	{
+		if (join == &signalling.probes[index].join)
+			return &signalling.probes[index];
+	}
+	return NULL;
+}
+
 static void send_join(struct join *join)
 {
+	struct probe const *probe = join_probe(join);
 	unsigned char message[MAXIMUM_MESSAGE_SIZE];
 	unsigned char sealed[MAXIMUM_MESSAGE_SIZE + P2P_SEAL_OVERHEAD];
 	int size = 0;
@@ -1096,7 +1133,7 @@ static void send_join(struct join *join)
 		message_tag(join->base, "join", message, size, message + size);
 		size += TAG_SIZE;
 	}
-	size = p2p_seal(signalling.join_key, message, size, sealed);
+	size = p2p_seal(probe ? probe->key : signalling.join_key, message, size, sealed);
 	publish_everywhere(join->host_topic, sealed, size);
 	join->sent_time = p2p_now();
 }
@@ -1114,14 +1151,14 @@ static int joins_active(void)
 	return 0;
 }
 
-/* starts a request to the machine whose key has this hash, with a new
-nonce (the host makes one session of a request) */
-static void join_start(struct join *join, const unsigned char *host_hash)
+/* starts a request to the machine whose key has this hash, holding this
+token, with a new nonce (the host makes one session of a request) */
+static void join_start(struct join *join, const unsigned char *host_hash, const unsigned char *token)
 {
 	memset(join, 0, sizeof(*join));
 	memcpy(join->host_hash, host_hash, P2P_KEY_HASH_SIZE);
 	p2p_identifier_from_hash(host_hash, join->host);
-	make_topic(signalling.join_token, "host", join->host, join->host_topic);
+	make_topic(token, "host", join->host, join->host_topic);
 	posix_random_bytes(join->nonce, NONCE_SIZE);
 	join->nonce_time = p2p_now();
 	join->active = 1;
@@ -1381,10 +1418,13 @@ static void accept_received(const unsigned char *message, int size)
 	if (size < fixed + 1 + TAG_SIZE)
 		return;
 	/* (the request it answers: by its nonce) */
-	for (index = 0; index < MAXIMUM_JOINS && !join; index++)
+	for (index = 0; index < MAXIMUM_JOINS + P2P_MAXIMUM_PROBES && !join; index++)
 	{
-		if (signalling.joins[index].active && !memcmp(nonce, signalling.joins[index].nonce, NONCE_SIZE))
-			join = &signalling.joins[index];
+		struct join *asked = index < MAXIMUM_JOINS ? &signalling.joins[index] :
+			&signalling.probes[index - MAXIMUM_JOINS].join;
+
+		if (asked->active && !memcmp(nonce, asked->nonce, NONCE_SIZE))
+			join = asked;
 	}
 	if (!join)
 		return;
@@ -1417,7 +1457,8 @@ static void accept_received(const unsigned char *message, int size)
 	}
 	session_secret(join->base, nonce, host_nonce, secret);
 	if (!p2p_peer_offered(join->host, host_public, secret, candidates, count, &webrtc,
-		join == &signalling.joins[0] ? _p2p_offered_host : _p2p_offered_player) || join->answered)
+		join_probe(join) ? _p2p_offered_probe : join == &signalling.joins[0] ? _p2p_offered_host :
+		_p2p_offered_player) || join->answered)
 	{
 		return;
 	}
@@ -1459,6 +1500,22 @@ static void publish_received(struct broker *broker, const char *topic, const uns
 		if (message_size >= 2 && message[0] == _message_accept && message[1] == MESSAGE_VERSION)
 			accept_received(message, message_size);
 	}
+	else
+	{
+		int index;
+
+		for (index = 0; index < P2P_MAXIMUM_PROBES; index++)
+		{
+			struct probe const *probe = &signalling.probes[index];
+
+			if (!probe->join.active || strcmp(topic, probe->topic))
+				continue;
+			message_size = p2p_open(probe->key, payload, size, message);
+			if (message_size >= 2 && message[0] == _message_accept && message[1] == MESSAGE_VERSION)
+				accept_received(message, message_size);
+			break;
+		}
+	}
 }
 
 /* a CONNACK: 0 if the connection is closed (refused, or to try 3.1.1) */
@@ -1709,10 +1766,15 @@ static void broker_readable(struct broker *broker)
 
 /* ---------- p2p.c's side */
 
+/* port/assets/network/brokers.txt's brokers, for a game with no such file
+beside its config.toml (one run from somewhere the builds did not put it).
+Keep it the same as that file (test_linux_port.py checks) */
+#define DEFAULT_BROKERS "opence.milenko.org:1883,broker.emqx.io:1883,broker.hivemq.com:1883,test.mosquitto.org:1883"
+
 /* the brokers in network.brokers_file (beside config.toml, unless a full
 path: port/assets/network/brokers.txt, which the builds put there), one on
 each line, "#" starting a comment, into text: host:port entries separated by
-commas; empty if the file cannot be read */
+commas; DEFAULT_BROKERS if the file cannot be read */
 static void brokers_list(char *text, size_t size)
 {
 	const char *name = config_string("network.brokers_file");
@@ -1745,7 +1807,9 @@ static void brokers_list(char *text, size_t size)
 	file = config_file_read(path, &file_size);
 	if (!file)
 	{
-		platform_log("Internet play: the brokers' file %s cannot be read (network.brokers_file)", path);
+		platform_log("Internet play: the brokers' file %s cannot be read (network.brokers_file); "
+			"using the game's own list", path);
+		snprintf(text, size, "%s", DEFAULT_BROKERS);
 		return;
 	}
 	for (index = 0; index < file_size && length + 1 < size; index++)
@@ -1899,9 +1963,10 @@ void p2p_signal_update(const int *read, int read_count, const int *write, int wr
 		}
 		broker_update_lobby(broker);
 	}
-	for (index = 0; index < MAXIMUM_JOINS; index++)
+	for (index = 0; index < MAXIMUM_JOINS + P2P_MAXIMUM_PROBES; index++)
 	{
-		struct join *join = &signalling.joins[index];
+		struct join *join = index < MAXIMUM_JOINS ? &signalling.joins[index] :
+			&signalling.probes[index - MAXIMUM_JOINS].join;
 
 		if (!join->active)
 			continue;
@@ -2027,7 +2092,7 @@ void p2p_signal_join(const unsigned char *host_hash, const unsigned char *token)
 	/* (new each time: the host makes one session of a request; a browser's
 	connection for the last goes, unless a session took it up) */
 	p2p_webrtc_new_request();
-	join_start(&signalling.joins[0], host_hash);
+	join_start(&signalling.joins[0], host_hash, token);
 }
 
 void p2p_signal_stop_joining(void)
@@ -2063,7 +2128,7 @@ int p2p_signal_join_player(const unsigned char *player_hash, const unsigned char
 		for (index = 1; index < MAXIMUM_JOINS; index++)
 			signalling.joins[index].active = 0;
 	}
-	join_start(free_join, player_hash);
+	join_start(free_join, player_hash, token);
 	return 1;
 }
 
@@ -2081,6 +2146,40 @@ void p2p_signal_stop_joining_player(const unsigned char *identifier)
 	}
 }
 
+int p2p_signal_probe(const unsigned char *host_hash, const unsigned char *token)
+{
+	int index;
+
+	for (index = 0; index < P2P_MAXIMUM_PROBES; index++)
+	{
+		struct probe *probe = &signalling.probes[index];
+
+		if (probe->join.active)
+			continue;
+		derive(token, "seal", NULL, probe->key);
+		make_topic(token, "joiner", p2p_identifier(), probe->topic);
+		join_start(&probe->join, host_hash, token);
+		return 1;
+	}
+	return 0;
+}
+
+void p2p_signal_stop_probe(const unsigned char *identifier)
+{
+	int index;
+
+	for (index = 0; index < P2P_MAXIMUM_PROBES; index++)
+	{
+		struct join *join = &signalling.probes[index].join;
+
+		if (join->active && !memcmp(join->host, identifier, P2P_IDENTIFIER_SIZE))
+		{
+			join->active = 0;
+			sync_all_topics();
+		}
+	}
+}
+
 void p2p_signal_lobby_topics(int listed, int browsing)
 {
 	signalling.lobby_listed = listed;