fix(webview): launch web Play buttons without waiting for navigation

Roblox defers a launchGame sent from the WebView until the Lua app next navigates, so joining a private server stalled until a sidebar tab was clicked. Parse launchGame in the runtime, queue it through the experience launch pipeline, and close the WebView. Other commands still reach Roblox. Fixes #169
Fix catalog unable to tell arm64 from x86_64 profiles for the same version. (#167 )
2026-10-17 20:00:46 +02:00 · 2026-09-24 23:01:44 -05:00 · 2026-09-24 20:12:18 +03:00 · 2026-09-24 19:03:22 +03:00 · 2026-09-23 18:31:41 +03:00 · 2026-09-23 12:04:53 +03:00
151 changed files with 8955 additions and 808 deletions
@@ -8,22 +8,32 @@ on:
      - 'CMakeLists.txt'
      - 'Makefile'
      - 'README.md'
+      - '.gitmodules'
+      - 'cmake/**'
      - 'config/**'
+      - 'include/**'
      - 'packaging/**'
      - 'scripts/**'
+      - 'src/**'
      - 'stubs/**'
      - 'tests/**'
+      - 'third_party/**'
  pull_request:
    paths:
      - '.github/workflows/**'
      - 'CMakeLists.txt'
      - 'Makefile'
      - 'README.md'
+      - '.gitmodules'
+      - 'cmake/**'
      - 'config/**'
+      - 'include/**'
      - 'packaging/**'
      - 'scripts/**'
+      - 'src/**'
      - 'stubs/**'
      - 'tests/**'
+      - 'third_party/**'
  workflow_dispatch:

 permissions:
@@ -64,3 +74,44 @@ jobs:
          bash tests/managed_payload_build_contract_test.sh .
          bash tests/flatpak_packaging_test.sh .
          bash tests/native_packaging_test.sh .
+          bash tests/anylinux_dependencies_test.sh .
+
+  native-build:
+    name: Native build (${{ matrix.arch }})
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: x86_64
+            runner: ubuntu-26.04
+          - arch: aarch64
+            runner: ubuntu-26.04-arm
+    steps:
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          submodules: recursive
+
+      - name: Install build dependencies
+        shell: bash
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes --no-install-recommends \
+            build-essential binutils cmake git ninja-build pkg-config lld \
+            libsdl3-dev libsdl3-ttf-dev libcurl4-openssl-dev libssl-dev \
+            nlohmann-json3-dev libyaml-dev libelf-dev libminizip-dev \
+            libcapstone-dev libgtk-4-dev libadwaita-1-dev libwebkitgtk-6.0-dev \
+            libutf8proc-dev libfontconfig1-dev libegl-dev libvulkan-dev \
+            libplacebo-dev libpng-dev zlib1g-dev
+
+      - name: Build and check native executables
+        shell: bash
+        run: |
+          test "$(uname -m)" = "${{ matrix.arch }}"
+          cmake -S . -B build-ci -G Ninja \
+            -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=OFF
+          cmake --build build-ci --parallel 4
+          ./build-ci/mocktail --help
+          ./build-ci/mocktail_updater status
@@ -38,15 +38,24 @@ concurrency:

 jobs:
  flatpak:
-    name: Flatpak build
+    name: Flatpak build (${{ matrix.arch }})
    if: >-
      github.event_name != 'workflow_run' ||
      (github.event.workflow_run.conclusion == 'success' &&
      github.event.workflow_run.event != 'pull_request' &&
      github.event.workflow_run.head_branch == 'main')
-    runs-on: ubuntu-24.04
+    runs-on: ${{ matrix.runner }}
    timeout-minutes: 120
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: x86_64
+            runner: ubuntu-24.04
+          - arch: aarch64
+            runner: ubuntu-24.04-arm
    env:
+      FLATPAK_ARCH: ${{ matrix.arch }}
      MOCKTAIL_PUBLISH: ${{ (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event != 'pull_request' && github.event.workflow_run.head_branch == 'main') || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main') }}
      MOCKTAIL_SOURCE_SHA: ${{ github.event.workflow_run.head_sha || github.sha }}
    steps:
@@ -57,8 +66,92 @@ jobs:
          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
          submodules: recursive

+      - name: Install Flatpak builder
+        shell: bash
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes flatpak flatpak-builder gnupg
+          flatpak remote-add --user --if-not-exists flathub \
+            https://dl.flathub.org/repo/flathub.flatpakrepo
+
+      - name: Build Flatpak bundle
+        shell: bash
+        env:
+          FLATPAK_GPG_PRIVATE_KEY: ${{ secrets.FLATPAK_GPG_PRIVATE_KEY }}
+          FLATPAK_GPG_KEY_ID: ${{ secrets.FLATPAK_GPG_KEY_ID }}
+        run: |
+          set -Eeuo pipefail
+          git update-ref refs/heads/main "$MOCKTAIL_SOURCE_SHA"
+          builder_signing=()
+          bundle_keys=()
+          if [[ "$MOCKTAIL_PUBLISH" == true ]]; then
+            [[ -n "$FLATPAK_GPG_PRIVATE_KEY" && \
+               -n "$FLATPAK_GPG_KEY_ID" ]]
+            install -d -m 0700 "$RUNNER_TEMP/mocktail-gnupg"
+            printf '%s' "$FLATPAK_GPG_PRIVATE_KEY" | \
+              gpg --batch --homedir "$RUNNER_TEMP/mocktail-gnupg" --import
+            gpg --batch --homedir "$RUNNER_TEMP/mocktail-gnupg" \
+              --export "$FLATPAK_GPG_KEY_ID" >mocktail-flatpak.gpg
+            builder_signing=(
+              "--gpg-sign=$FLATPAK_GPG_KEY_ID"
+              "--gpg-homedir=$RUNNER_TEMP/mocktail-gnupg"
+            )
+            bundle_keys=(--gpg-keys=mocktail-flatpak.gpg)
+          fi
+          flatpak-builder \
+            --arch="$FLATPAK_ARCH" \
+            --jobs=4 \
+            --user \
+            --install-deps-from=flathub \
+            --disable-rofiles-fuse \
+            --force-clean \
+            --default-branch=stable \
+            --repo=repo \
+            "${builder_signing[@]}" \
+            build-flatpak-ci \
+            packaging/flatpak/space.bigrat.mocktail.json
+          flatpak build-bundle \
+            --arch="$FLATPAK_ARCH" \
+            "${bundle_keys[@]}" \
+            repo \
+            "Mocktail-${FLATPAK_ARCH}.flatpak" \
+            space.bigrat.mocktail \
+            stable
+
+      - name: Upload Flatpak
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: Mocktail-${{ matrix.arch }}-flatpak
+          path: Mocktail-${{ matrix.arch }}.flatpak
+          if-no-files-found: error
+          retention-days: 14
+
+  publish:
+    name: Assemble multi-architecture Flatpak repository
+    if: >-
+      (github.event_name == 'workflow_run' &&
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event != 'pull_request' &&
+      github.event.workflow_run.head_branch == 'main') ||
+      (github.event_name == 'workflow_dispatch' &&
+      github.ref == 'refs/heads/main')
+    needs: flatpak
+    runs-on: ubuntu-24.04
+    timeout-minutes: 120
+    steps:
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.workflow_run.head_sha || github.sha }}
+
+      - name: Download both Flatpak bundles
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: Mocktail-*-flatpak
+          path: flatpak-bundles
+          merge-multiple: true
+
      - name: Download package repositories
-        if: env.MOCKTAIL_PUBLISH == 'true'
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
@@ -84,86 +177,53 @@ jobs:
             -d native-repositories/downloads && \
             -s native-repositories/mocktail-packages.gpg ]]

-      - name: Install Flatpak builder
+      - name: Install Flatpak repository tools
        shell: bash
        run: |
          sudo apt-get update
-          sudo apt-get install --yes flatpak flatpak-builder gnupg
-          flatpak remote-add --user --if-not-exists flathub \
-            https://dl.flathub.org/repo/flathub.flatpakrepo
+          sudo apt-get install --yes --no-install-recommends flatpak gnupg ostree

-      - name: Build Flatpak repository and bundle
+      - name: Sign and publish both architectures
        shell: bash
        env:
          FLATPAK_GPG_PRIVATE_KEY: ${{ secrets.FLATPAK_GPG_PRIVATE_KEY }}
          FLATPAK_GPG_KEY_ID: ${{ secrets.FLATPAK_GPG_KEY_ID }}
        run: |
          set -Eeuo pipefail
-          git update-ref refs/heads/main "$MOCKTAIL_SOURCE_SHA"
-          builder_signing=()
-          bundle_keys=()
-          if [[ "$MOCKTAIL_PUBLISH" == true ]]; then
-            [[ -n "$FLATPAK_GPG_PRIVATE_KEY" && \
-               -n "$FLATPAK_GPG_KEY_ID" ]]
-            install -d -m 0700 "$RUNNER_TEMP/mocktail-gnupg"
-            printf '%s' "$FLATPAK_GPG_PRIVATE_KEY" | \
-              gpg --batch --homedir "$RUNNER_TEMP/mocktail-gnupg" --import
-            gpg --batch --homedir "$RUNNER_TEMP/mocktail-gnupg" \
-              --export "$FLATPAK_GPG_KEY_ID" >mocktail-flatpak.gpg
-            builder_signing=(
-              "--gpg-sign=$FLATPAK_GPG_KEY_ID"
-              "--gpg-homedir=$RUNNER_TEMP/mocktail-gnupg"
-            )
-            bundle_keys=(--gpg-keys=mocktail-flatpak.gpg)
-          fi
-          flatpak-builder \
-            --arch=x86_64 \
-            --jobs=4 \
-            --user \
-            --install-deps-from=flathub \
-            --disable-rofiles-fuse \
-            --force-clean \
-            --default-branch=stable \
-            --repo=repo \
-            "${builder_signing[@]}" \
-            build-flatpak-ci \
-            packaging/flatpak/space.bigrat.mocktail.json
-          if [[ "$MOCKTAIL_PUBLISH" == true ]]; then
-            flatpak build-update-repo \
-              --generate-static-deltas \
-              --static-delta-jobs=2 \
-              --prune \
+          [[ -n "$FLATPAK_GPG_PRIVATE_KEY" && -n "$FLATPAK_GPG_KEY_ID" ]]
+          [[ -s flatpak-bundles/Mocktail-x86_64.flatpak && \
+             -s flatpak-bundles/Mocktail-aarch64.flatpak ]]
+          install -d -m 0700 "$RUNNER_TEMP/mocktail-gnupg"
+          printf '%s' "$FLATPAK_GPG_PRIVATE_KEY" | \
+            gpg --batch --homedir "$RUNNER_TEMP/mocktail-gnupg" --import
+          gpg --batch --homedir "$RUNNER_TEMP/mocktail-gnupg" \
+            --export "$FLATPAK_GPG_KEY_ID" >mocktail-flatpak.gpg
+          ostree --repo=repo init --mode=archive
+          for arch in x86_64 aarch64; do
+            flatpak build-import-bundle \
              --gpg-sign="$FLATPAK_GPG_KEY_ID" \
              --gpg-homedir="$RUNNER_TEMP/mocktail-gnupg" \
-              repo
-          fi
-          flatpak build-bundle \
-            --arch=x86_64 \
-            "${bundle_keys[@]}" \
-            repo \
-            Mocktail-x86_64.flatpak \
-            space.bigrat.mocktail \
-            stable
-          if [[ "$MOCKTAIL_PUBLISH" == true ]]; then
-            ./scripts/assemble_flatpak_pages.sh \
-              repo Mocktail-x86_64.flatpak mocktail-flatpak.gpg \
-              public native-repositories
-          fi
-
-      - name: Upload Flatpak
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: Mocktail-x86_64-flatpak
-          path: Mocktail-x86_64.flatpak
-          if-no-files-found: error
-          retention-days: 14
+              --no-update-summary \
+              repo "flatpak-bundles/Mocktail-${arch}.flatpak"
+            ostree --repo=repo refs | \
+              grep -Fxq "app/space.bigrat.mocktail/${arch}/stable"
+          done
+          flatpak build-update-repo \
+            --generate-static-deltas \
+            --static-delta-jobs=2 \
+            --prune \
+            --gpg-sign="$FLATPAK_GPG_KEY_ID" \
+            --gpg-homedir="$RUNNER_TEMP/mocktail-gnupg" \
+            repo
+          ./scripts/assemble_flatpak_pages.sh \
+            repo flatpak-bundles/Mocktail-x86_64.flatpak \
+            flatpak-bundles/Mocktail-aarch64.flatpak \
+            mocktail-flatpak.gpg public native-repositories

      - name: Configure GitHub Pages
-        if: env.MOCKTAIL_PUBLISH == 'true'
        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0

      - name: Upload GitHub Pages repository
-        if: env.MOCKTAIL_PUBLISH == 'true'
        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
        with:
          path: public
@@ -177,7 +237,7 @@ jobs:
      github.event.workflow_run.head_branch == 'main') ||
      (github.event_name == 'workflow_dispatch' &&
      github.ref == 'refs/heads/main')
-    needs: flatpak
+    needs: publish
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
@@ -45,16 +45,19 @@ jobs:

      - name: Build AppImage
        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
        run: |
          docker run --rm \
            --volume "$GITHUB_WORKSPACE:/workspace" \
            --workdir /workspace \
+            --env GH_TOKEN \
            ghcr.io/archlinux/archlinux:base-devel@sha256:c3953446016873a756fb7814f10087cac1634c127f7302e80c81c512da796d05 bash -Eeuo pipefail -c '
              pacman -Syu --noconfirm --needed \
                cmake git ninja pkgconf lld sdl3 sdl3_ttf curl openssl \
                nlohmann-json libyaml libelf minizip minizip-ng capstone gtk4 \
                libadwaita webkitgtk-6.0 libutf8proc fontconfig libglvnd \
-                vulkan-headers zlib libplacebo bubblewrap xdg-dbus-proxy \
+                vulkan-headers zlib libplacebo libpng bubblewrap xdg-dbus-proxy \
                patchelf jq unzip file ca-certificates dbus zsync

              # Reduced ABI-compatible packages belong only in this builder.
@@ -140,6 +143,117 @@ jobs:
          if-no-files-found: error
          retention-days: 14

+  appimage-aarch64:
+    name: AppImage (AnyLinux aarch64)
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 120
+    steps:
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          submodules: recursive
+
+      - name: Build aarch64 AppImage
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          docker run --rm --platform linux/arm64 \
+            --volume "$GITHUB_WORKSPACE:/workspace" \
+            --workdir /workspace \
+            --env GH_TOKEN \
+            ghcr.io/pkgforge-dev/archlinux:latest@sha256:b2507f1964270cab3cc190aa8df858521f6a7e45e969146a012877891d5dfc9b bash -Eeuo pipefail -c '
+              test "$(uname -m)" = aarch64
+              pacman-key --init
+              pacman -Syy --noconfirm archlinux-keyring
+              pacman -Syu --noconfirm --needed \
+                base-devel cmake git ninja pkgconf lld sdl3 sdl3_ttf curl openssl \
+                nlohmann-json libyaml libelf minizip minizip-ng capstone gtk4 \
+                libadwaita webkitgtk-6.0 libutf8proc fontconfig libglvnd \
+                vulkan-headers zlib libplacebo libpng bubblewrap xdg-dbus-proxy \
+                patchelf jq unzip file ca-certificates dbus zsync
+
+              ./scripts/install_anylinux_dependencies.sh
+
+              curl --fail --location --retry 3 \
+                --output /tmp/quick-sharun \
+                https://raw.githubusercontent.com/pkgforge-dev/Anylinux-AppImages/2a025cef14483c5bc2a75b479071f4d5c58a906f/useful-tools/quick-sharun.sh
+              echo "fa66d0189e1e87df781c049dfb23cbb1e753786056f693a4483d6d3af61e7ee1  /tmp/quick-sharun" | \
+                sha256sum --check --strict
+              chmod 0755 /tmp/quick-sharun
+
+              curl --fail --location --retry 3 \
+                --output /tmp/sharun \
+                https://github.com/pkgforge-dev/Anylinux-sharun/releases/download/2.2.6/sharun-aarch64
+              echo "3b64db0727a9d5c8212c4b2342770583ce552deac0644d2d6033e9ec280f7635  /tmp/sharun" | \
+                sha256sum --check --strict
+              chmod 0755 /tmp/sharun
+
+              curl --fail --location --retry 3 \
+                --output /tmp/anylinux.c \
+                https://raw.githubusercontent.com/pkgforge-dev/Anylinux-AppImages/2a025cef14483c5bc2a75b479071f4d5c58a906f/useful-tools/lib/anylinux.c
+              echo "f50650ad96d177559bdd0737df509fa20bd4af08887631c738fc1f31bfac185f  /tmp/anylinux.c" | \
+                sha256sum --check --strict
+
+              curl --fail --location --retry 3 \
+                --output /tmp/appimagetool \
+                https://github.com/pkgforge-dev/appimagetool/releases/download/0.3.3/appimagetool-aarch64-linux
+              echo "298f5293c41f9b2b46290b246e6419783940824ce20b98775a5a153b18fe8422  /tmp/appimagetool" | \
+                sha256sum --check --strict
+              chmod 0755 /tmp/appimagetool
+
+              curl --fail --location --retry 3 \
+                --output /tmp/uruntime \
+                https://github.com/VHSgunzo/uruntime/releases/download/v0.5.9/uruntime-appimage-dwarfs-lite-aarch64
+              echo "5686f126b22d944b2b9c862ee004b4c590b5a5e5215d8790cc0420f1fbbea942  /tmp/uruntime" | \
+                sha256sum --check --strict
+              chmod 0755 /tmp/uruntime
+
+              curl --fail --location --retry 3 \
+                --output /tmp/mkdwarfs \
+                https://github.com/mhx/dwarfs/releases/download/v0.15.6/dwarfs-universal-0.15.6-Linux-aarch64
+              echo "2d513c43ad652163e5e31c1a96f3c736e7e188e661ff62fc9143ea7147bd936b  /tmp/mkdwarfs" | \
+                sha256sum --check --strict
+              chmod 0755 /tmp/mkdwarfs
+
+              git config --global --add safe.directory /workspace
+              git config --global --add safe.directory /workspace/third_party/Vulkan-Headers
+              git config --global --add safe.directory /workspace/third_party/libjnivm
+              export MOCKTAIL_ANYLINUX_SYSTEM_INSTALL=1
+              export MOCKTAIL_ANYLINUX_SHARUN=/tmp/sharun
+              export MOCKTAIL_ANYLINUX_C_SOURCE=/tmp/anylinux.c
+              export RUNTIME=/tmp/uruntime
+              export DWARFS_CMD=/tmp/mkdwarfs
+              make appimage BUILD_DIR=build-appimage-aarch64 JOBS=4 \
+                APPIMAGE=dist/Mocktail-aarch64.AppImage \
+                PORTABLE_MODE=standalone APPIMAGE_FORMAT=anylinux \
+                ANYLINUX_PACKAGER=/tmp/quick-sharun \
+                ANYLINUX_APPIMAGETOOL=/tmp/appimagetool
+              test -x dist/Mocktail-aarch64.AppImage
+            '
+
+      - name: Smoke-test aarch64 AppImage without FUSE
+        shell: bash
+        run: |
+          smoke_dir="$(mktemp -d)"
+          trap 'rm -rf -- "$smoke_dir"' EXIT
+          export XDG_DATA_HOME="$smoke_dir/data"
+          export XDG_CONFIG_HOME="$smoke_dir/config"
+          export XDG_CACHE_HOME="$smoke_dir/cache"
+          export XDG_STATE_HOME="$smoke_dir/state"
+          mkdir -p "$XDG_DATA_HOME" "$XDG_CONFIG_HOME" "$XDG_CACHE_HOME" "$XDG_STATE_HOME"
+          timeout 60s dist/Mocktail-aarch64.AppImage --appimage-extract-and-run --help
+          timeout 60s dist/Mocktail-aarch64.AppImage --appimage-extract-and-run mocktail_updater status
+
+      - name: Upload aarch64 AppImage
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: Mocktail-AppImage-aarch64
+          path: dist/Mocktail-aarch64.AppImage
+          if-no-files-found: error
+          retention-days: 14
+
  deb:
    name: DEB (Ubuntu 26.04)
    runs-on: ubuntu-24.04
@@ -169,7 +283,7 @@ jobs:
                libyaml-dev libelf-dev libminizip-dev libcapstone-dev \
                libgtk-4-dev libadwaita-1-dev libwebkitgtk-6.0-dev \
                libutf8proc-dev libfontconfig1-dev libegl-dev \
-                libvulkan-dev libplacebo-dev zlib1g-dev
+                libvulkan-dev libplacebo-dev libpng-dev zlib1g-dev
              cmake -S . -B build-deb -G Ninja \
                -DCMAKE_BUILD_TYPE=Release \
                -DCMAKE_INSTALL_PREFIX=/usr \
@@ -217,7 +331,7 @@ jobs:
                minizip-ng-compat-devel capstone-devel gtk4-devel libadwaita-devel \
                webkitgtk6.0-devel utf8proc-devel fontconfig-devel \
                libglvnd-devel vulkan-headers vulkan-loader-devel \
-                libplacebo-devel zlib-ng-compat-devel
+                libplacebo-devel libpng-devel zlib-ng-compat-devel
              cmake -S . -B build-rpm -G Ninja \
                -DCMAKE_BUILD_TYPE=Release \
                -DCMAKE_INSTALL_PREFIX=/usr \
@@ -261,7 +375,7 @@ jobs:
                cmake git ninja pkgconf lld sdl3 sdl3_ttf curl openssl \
                nlohmann-json libyaml libelf minizip capstone gtk4 \
                libadwaita webkitgtk-6.0 libutf8proc fontconfig \
-                libplacebo vulkan-headers vulkan-icd-loader libglvnd zlib
+                libplacebo libpng vulkan-headers vulkan-icd-loader libglvnd zlib
              useradd --create-home builder
              chown -R builder:builder /workspace
              runuser -u builder -- env MOCKTAIL_SOURCE_DIR=/workspace \
@@ -283,7 +397,7 @@ jobs:
  publish:
    name: Publish continuous packages
    if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
-    needs: [appimage, deb, rpm, arch]
+    needs: [appimage, appimage-aarch64, deb, rpm, arch]
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
@@ -305,7 +419,8 @@ jobs:
        shell: bash
        run: |
          set -Eeuo pipefail
-          mv -- release/*.AppImage release/mocktail-nightly.AppImage
+          mv -- release/Mocktail-x86_64.AppImage release/mocktail-nightly.AppImage
+          mv -- release/Mocktail-aarch64.AppImage release/mocktail-nightly-aarch64.AppImage
          mv -- release/*.deb release/mocktail-nightly.deb
          mv -- release/*.rpm release/mocktail-nightly.rpm
          mv -- release/*.pkg.tar.zst release/mocktail-nightly.pkg.tar.zst
@@ -360,7 +475,7 @@ jobs:
          gh release upload continuous release/* --clobber
          while IFS= read -r asset; do
            case "$asset" in
-              mocktail-nightly.AppImage|mocktail-nightly.deb|mocktail-nightly.rpm|mocktail-nightly.pkg.tar.zst)
+              mocktail-nightly.AppImage|mocktail-nightly-aarch64.AppImage|mocktail-nightly.deb|mocktail-nightly.rpm|mocktail-nightly.pkg.tar.zst)
                ;;
              Mocktail-*.AppImage|mocktail_*.deb|mocktail-*.deb|mocktail-*.rpm|mocktail-*.pkg.tar.zst)
                gh release delete-asset continuous "$asset" --yes
@@ -57,19 +57,7 @@ Makefile.cmake
 /cmake-build-release/

 # Roblox payload
-/rbx_bin/libroblox.so
-/rbx_bin/libroblox.so.*
-/rbx_bin/client_settings_android.json
-/rbx_bin/assets/
-/rbx_bin/android/
-/rbx_bin/sober_apk/
-/rbx_bin/versions/
-/rbx_bin/.payload-update.*/
-/rbx_bin/*.apk
-/rbx_bin/*.so
-/rbx_bin/*.so.*
-
-!/rbx_bin/.gitkeep
+/rbx_bin/

 # Runtime state
 /runtime/
@@ -8,8 +8,8 @@

 cmake_minimum_required(VERSION 3.20)
 project(Mocktail
-  VERSION 1.0.3
-  DESCRIPTION "Android x86-64 Roblox compatibility runtime for Linux"
+  VERSION 1.0.4
+  DESCRIPTION "Android Roblox compatibility runtime for Linux"
  LANGUAGES CXX
 )

@@ -264,10 +264,12 @@ add_library(mocktail_runtime STATIC
  src/runtime/command_line.cc
  src/runtime/crash_report_policy.cc
  src/runtime/discord_rpc.cc
+  src/runtime/device_memory_profile.cc
  src/runtime/device_profile.cc
  src/runtime/environment.cc
  src/runtime/external_launch_broker.cc
  src/runtime/frame_rate_policy.cc
+  src/runtime/fleasion.cc
  src/runtime/game_mode.cc
  src/runtime/game_session_coordinator.cc
  src/runtime/graphics_launch_policy.cc
@@ -286,6 +288,8 @@ add_library(mocktail_runtime STATIC
  src/runtime/roblox_web_view_bridge.cc
  src/runtime/roblox_permissions_bridge.cc
  src/runtime/payload_update_preflight.cc
+  src/runtime/process_launch_policy.cc
+  src/runtime/process_diagnostics.cc
  src/runtime/runtime_config.cc
  src/runtime/runtime_config_bootstrap.cc
  src/runtime/runtime_config_file.cc
@@ -327,6 +331,7 @@ if(CMAKE_CXX_COMPILER_ID STREQUAL "GNU" AND
 endif()
 target_link_libraries(mocktail_runtime PUBLIC Threads::Threads)
 target_link_libraries(mocktail_runtime PRIVATE
+  OpenSSL::Crypto
  CURL::libcurl
  nlohmann_json::nlohmann_json
  PkgConfig::GIO
@@ -465,7 +470,7 @@ target_link_libraries(mocktail_window PUBLIC
  Mocktail::SdlVulkanWsi
  SDL3::SDL3
  ${CMAKE_DL_LIBS}
-  PRIVATE Mocktail::Runtime
+  PRIVATE Mocktail::Runtime Mocktail::GlesTextOverlay
 )

 add_library(mocktail_roblox_output_device_runtime STATIC
@@ -643,6 +648,11 @@ target_link_options(mocktail PRIVATE
 )

 # Native FreeBSD helper for Linuxulator's unsupported DF socket option.
+# The helper is x86-64 assembly; other host architectures have nothing to
+# assemble.
+if(NOT CMAKE_SYSTEM_PROCESSOR MATCHES "^(x86_64|amd64|AMD64)$")
+  set(MOCKTAIL_BUILD_FREEBSD_SOCKET_HELPER OFF)
+endif()
 option(MOCKTAIL_BUILD_FREEBSD_SOCKET_HELPER
  "Build the native FreeBSD Linuxulator socket helper" ON)
 if(MOCKTAIL_BUILD_FREEBSD_SOCKET_HELPER)
@@ -787,7 +797,7 @@ set(CPACK_PACKAGE_CONTACT "komaruworld <rtysus228@gmail.com>")
 set(CPACK_PACKAGE_HOMEPAGE_URL "https://github.com/komaruworld/mocktail")
 set(CPACK_PACKAGE_DESCRIPTION_SUMMARY "${PROJECT_DESCRIPTION}")
 set(CPACK_PACKAGE_DESCRIPTION
-  "Runs the Android x86-64 Roblox client on Linux."
+  "Runs the Android Roblox client on Linux."
 )
 set(CPACK_RESOURCE_FILE_LICENSE "${CMAKE_SOURCE_DIR}/LICENSE")
 set(CPACK_PACKAGING_INSTALL_PREFIX "/usr")
@@ -1,20 +1,64 @@
-# Frequently asked questions
+# FAQ

-[How do I change my FPS?](/FAQ.md#how-do-i-change-my-fps)
+## How do I enable Discord RPC?

-### How do I change my FPS?
+RPC is disabled by default. Launch Mocktail once to create the config, then
+close it. Open `config.yaml`:

+- Native / AppImage: `~/.config/mocktail/config.yaml`
+- Flatpak: `~/.var/app/space.bigrat.mocktail/config/mocktail/config.yaml`

-Go to $HOME/.config/mocktail, there is a file called config.yaml (appears after opening for the first time mocktail)
+For native installs, a custom `$XDG_CONFIG_HOME` replaces `~/.config`.

+Set `enabled` to `true` under `integrations.discord_rpc`. If the block is
+missing, add it under the existing `integrations` section:

-<img width="460" height="241" alt="image" src="https://github.com/user-attachments/assets/b30b1fea-4937-4858-937a-3096a9e8b2ad" />
+```yaml
+integrations:
+  discord_rpc:
+    enabled: true
+```

+Save the file, open Discord Desktop, and restart Mocktail. Set `enabled`
+back to `false` to disable RPC.

-with your text editor of preference search for "graphics" 
+## Where can I find logs for a bug report?

+Mocktail saves logs automatically. Reproduce the issue, close Mocktail, and
+attach `latest.log`:

-<img width="1022" height="619" alt="image" src="https://github.com/user-attachments/assets/f86791e9-7ac3-4d13-b81b-3cf9e3e64c3d" />
+- Native / AppImage: `~/.local/state/mocktail/logs/latest.log`
+- Flatpak: `~/.var/app/space.bigrat.mocktail/.local/state/mocktail/logs/latest.log`

+For native installs, a custom `$XDG_STATE_HOME` replaces `~/.local/state`.

-change the display value to your desired fps, also turn off vsync if you want more fps than your display supports
+## Can I run multiple Roblox instances?
+
+No. Mocktail won't add multi-instance launching. It would mean working around
+Roblox's restrictions on running several clients. The [Roblox Terms of Use](https://en.help.roblox.com/hc/en-us/articles/115004647846-Roblox-Terms-of-Use)
+prohibit bypassing technical protections, and violating the terms can get your
+account suspended.
+
+Bloxstrap brought the option back in [v2.9.0](https://github.com/bloxstraplabs/bloxstrap/releases/tag/v2.9.0)
+with a "use at your own risk" warning, then removed it in
+[v2.10.0](https://github.com/bloxstraplabs/bloxstrap/releases/tag/v2.10.0)
+after Roblox added measures against running multiple clients.
+
+## Can I play in VR?
+
+VR is experimental. Install the [build dependencies](README.md#building),
+then switch to the `vr` branch and build:
+
+```bash
+git fetch origin
+git switch vr
+git submodule update --init --recursive
+cmake -S . -B build -DCMAKE_BUILD_TYPE=Release -DMOCKTAIL_ENABLE_VR=ON
+cmake --build build -j4
+```
+
+Start WiVRn or SteamVR/ALVR, connect your headset, then run:
+
+```bash
+./build/mocktail -vr
+```
@@ -129,8 +129,8 @@ auto-run: ## Build/run loop with crash summaries
 run-gles: build ## Run strict system EGL/OpenGL ES 3 without Vulkan fallback
 	@$(BINARY) --graphics opengl

-run-angle: ## Run with ANGLE/Vulkan compatibility backend
-	@MOCKTAIL_GRAPHICS_BACKEND=angle-vulkan ./scripts/run_sober.sh
+run-angle: build ## Run with ANGLE/Vulkan compatibility backend
+	@$(BINARY) --graphics angle-vulkan

 update-roblox: ## Validate and import the current x86_64 Roblox bundle cached by Sober
 	@./scripts/update_roblox_payload.sh
@@ -6,10 +6,11 @@
 [![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
 [![Discord](https://img.shields.io/discord/1543955607869063269?label=discord)](https://discord.gg/rhgpfcmFSD)

-Mocktail runs the Android `x86_64` Roblox client on Linux, including a Linux
-userspace hosted by FreeBSD's Linuxulator. It provides the Android ABI and JNI
-pieces the client expects, then connects them to SDL3 and Vulkan or OpenGL on
-the Linux side.
+Mocktail runs the Android `x86_64` Roblox client on Linux and has experimental
+`aarch64` builds for the Android `arm64-v8a` client. It also runs in a Linux
+userspace hosted by FreeBSD's Linuxulator. Mocktail provides the Android ABI
+and JNI pieces the client expects, then connects them to SDL3 and Vulkan or
+OpenGL on the Linux side.

 Mocktail is an independent community project. It is not affiliated with Roblox
 Corporation or VinegarHQ and does not distribute the Roblox client.
@@ -107,6 +108,10 @@ Direct AppImage, DEB, and RPM downloads are available from the
 Put a JSON object in `$XDG_CONFIG_HOME/mocktail/fflags.json` (usually
 `~/.config/mocktail/fflags.json`). Mocktail applies it on the next launch.

+PC profiles use the legacy Charts page by default to avoid the blank screen
+caused by `Color3` errors in the newer SDUI page. An explicit
+`FFlagLuaAppChartsAppPage` override takes precedence over this default.
+
 ```json
 {
  "FFlagExample": "True",
@@ -120,10 +125,12 @@ To see the most Frequently Asked Question go check [FAQ.md](FAQ.md)

 ## Building

-Linux `x86_64` is supported. Experimental FreeBSD 15.1 Linuxulator support has
-been tested with an `x86_64` Fedora 44 userspace. On FreeBSD, Mocktail runs
-inside Linuxulator; it is not a native FreeBSD binary. Building requires CMake
-3.20+, Git, pkg-config, LLD, binutils, a C++17 compiler, SDL 3.4+, SDL3_ttf,
+Linux `x86_64` is supported. Linux `aarch64` builds are available, with Roblox
+runtime validation still experimental. FreeBSD 15.1 Linuxulator support is
+experimental and has been tested with an `x86_64` Fedora 44 userspace. On
+FreeBSD, Mocktail runs inside Linuxulator; it is not a native FreeBSD binary.
+Building requires CMake 3.20+, Git, pkg-config, LLD, binutils, a C++17
+compiler, SDL 3.4+, SDL3_ttf,
 Vulkan, EGL, libplacebo, fontconfig, libcurl, OpenSSL, libelf, libyaml, minizip,
 Capstone 5, utf8proc, nlohmann/json, GTK4, libadwaita 1.6+, and WebKitGTK 6.0.

@@ -139,7 +146,7 @@ sudo apt install build-essential cmake git ninja-build pkg-config lld \
  nlohmann-json3-dev libyaml-dev libelf-dev libminizip-dev \
  libcapstone-dev libgtk-4-dev libadwaita-1-dev libwebkitgtk-6.0-dev \
  libutf8proc-dev libfontconfig1-dev libegl-dev libvulkan-dev \
-  libplacebo-dev zlib1g-dev
+  libplacebo-dev libpng-dev zlib1g-dev
 ```
 </details>

@@ -9,6 +9,7 @@ get_filename_component(MOCKTAIL_PLATFORM_GRAPHICS_ROOT

 find_package(SDL3 3.4 REQUIRED CONFIG)
 find_path(MOCKTAIL_EGL_INCLUDE_DIR EGL/egl.h REQUIRED)
+find_path(MOCKTAIL_GLES3_INCLUDE_DIR GLES3/gl3.h REQUIRED)

 set(MOCKTAIL_WINDOW_ICON_PNG
  "${MOCKTAIL_PLATFORM_GRAPHICS_ROOT}/packaging/icons/hicolor/48x48/apps/space.bigrat.mocktail.png"
@@ -103,6 +104,18 @@ target_link_libraries(mocktail_graphics_foundation PRIVATE
 target_compile_features(mocktail_graphics_foundation PUBLIC cxx_std_17)
 add_library(Mocktail::GraphicsFoundation ALIAS mocktail_graphics_foundation)

+add_library(mocktail_gles_text_overlay STATIC
+  ${MOCKTAIL_PLATFORM_GRAPHICS_ROOT}/src/graphics/gles_text_overlay_compositor.cc
+)
+target_include_directories(mocktail_gles_text_overlay
+  PUBLIC ${MOCKTAIL_PLATFORM_GRAPHICS_ROOT}/include
+  PRIVATE ${MOCKTAIL_GLES3_INCLUDE_DIR}
+)
+target_link_libraries(mocktail_gles_text_overlay PUBLIC SDL3::SDL3)
+target_compile_features(mocktail_gles_text_overlay PUBLIC cxx_std_17)
+mocktail_apply_compile_options(mocktail_gles_text_overlay)
+add_library(Mocktail::GlesTextOverlay ALIAS mocktail_gles_text_overlay)
+
 add_library(mocktail_sdl_vulkan_wsi STATIC
  ${MOCKTAIL_PLATFORM_GRAPHICS_ROOT}/src/graphics/sdl_vulkan_wsi.cc
  ${MOCKTAIL_PLATFORM_GRAPHICS_ROOT}/src/graphics/android_vulkan_wsi_adapter.cc
@@ -120,6 +133,16 @@ target_compile_features(mocktail_sdl_vulkan_wsi PUBLIC cxx_std_17)
 add_library(Mocktail::SdlVulkanWsi ALIAS mocktail_sdl_vulkan_wsi)

 if(BUILD_TESTING AND TARGET GTest::gtest_main)
+  add_executable(gles_text_overlay_compositor_test
+    ${MOCKTAIL_PLATFORM_GRAPHICS_ROOT}/tests/gles_text_overlay_compositor_test.cc
+  )
+  target_include_directories(gles_text_overlay_compositor_test PRIVATE
+    ${MOCKTAIL_GLES3_INCLUDE_DIR}
+  )
+  target_link_libraries(gles_text_overlay_compositor_test PRIVATE
+    Mocktail::GlesTextOverlay
+    GTest::gtest_main
+  )
  add_executable(bionic_egl_bridge_test
    ${MOCKTAIL_PLATFORM_GRAPHICS_ROOT}/tests/bionic_egl_bridge_test.cc
  )
@@ -153,6 +176,7 @@ if(BUILD_TESTING AND TARGET GTest::gtest_main)
    GTest::gtest_main
  )
  include(GoogleTest)
+  gtest_discover_tests(gles_text_overlay_compositor_test)
  gtest_discover_tests(bionic_egl_bridge_test)
  gtest_discover_tests(platform_graphics_foundation_test)
  gtest_discover_tests(display_refresh_capabilities_test)
@@ -75,6 +75,16 @@ audio:
  input_device: default

 integrations:
+  fleasion:
+    # Boolean (default: false): trust Fleasion's CA without editing Roblox files.
+    enabled: false
+    # String: match Fleasion's routing mode: env or hosts.
+    proxy_mode: env
+    # Integer: Fleasion's local HTTP proxy port in env mode.
+    proxy_port: 58443
+    # Optional absolute public CA path. Default: $XDG_CONFIG_HOME/Fleasion/proxy_ca/ca.crt
+    # or ~/.config/Fleasion/proxy_ca/ca.crt. Never select ca.key.
+    # ca_certificate: /home/user/.config/Fleasion/proxy_ca/ca.crt
  discord_rpc:
    # Boolean (default: false): publish Mocktail activity to Discord Desktop.
    # This never signs in to Discord and never reads an account token.
@@ -4,6 +4,7 @@
    {
      "version_name": "2.721.1108",
      "version_code": 2350,
+      "abi": "x86_64",
      "elf_build_id": "50e1b0abd123350e794226062fe3a1ef360c5f0d",
      "status": "legacy-researched",
      "default_allowed": false,
@@ -15,6 +16,7 @@
    {
      "version_name": "2.725.1142",
      "version_code": 2546,
+      "abi": "x86_64",
      "elf_build_id": "d0cb1fa0deb3d9161b4cd77530cbcd2e50de3a21",
      "status": "supported",
      "default_allowed": true,
@@ -35,6 +37,7 @@
    {
      "version_name": "2.727.1199",
      "version_code": 2628,
+      "abi": "x86_64",
      "elf_build_id": "1686400865ae0e408cd7bd67de7a439625c6fd13",
      "status": "supported",
      "default_allowed": true,
@@ -46,6 +49,7 @@
    {
      "version_name": "2.734.917",
      "version_code": 2908,
+      "abi": "x86_64",
      "elf_build_id": "63c5109637b7d7b2bdb8ed8f858023ff5ef49326",
      "status": "supported",
      "default_allowed": true,
@@ -66,6 +70,19 @@
    {
      "version_name": "2.736.1408",
      "version_code": 2998,
+      "abi": "arm64-v8a",
+      "elf_build_id": "ed2b035768b1513561d0e6ea7f9bbec35b0e60e5",
+      "status": "supported",
+      "default_allowed": true,
+      "allow_legacy_binary_patches": false,
+      "allow_host_abi_bridges": true,
+      "allow_host_constructor_replay": true,
+      "reason": "AArch64 arm64-v8a payload of the same 2.736.1408 release as the verified x86-64 profile; allocator, constructor replay, and pre-JNI bootstrap RVAs were derived by cross-architecture semantic matching."
+    },
+    {
+      "version_name": "2.736.1408",
+      "version_code": 2998,
+      "abi": "x86_64",
      "elf_build_id": "ade08266c67aee88ec9c1d00902150e1684dad3a",
      "status": "supported",
      "default_allowed": true,
@@ -79,7 +96,11 @@
        "count_method_rva": "0x32d0ee0",
        "info_method_rva": "0x32d0f80",
        "current_method_rva": "0x32d0f30",
-        "select_method_rva": "0x32d0cb4"
+        "select_method_rva": "0x32d0cb4",
+        "input_count_method_rva": "0x32d12dc",
+        "input_info_method_rva": "0x32d12ea",
+        "input_current_method_rva": "0x32d13a6",
+        "input_select_method_rva": "0x32d0a56"
      },
      "reason": "Verified 2026-09-06: exact Build-ID profile passed two isolated no-recovery Tier C Vulkan canaries and real game sessions, including fullscreen state synchronization and host FMOD output-device interposition; legacy executable patches and signal recovery remain disabled."
    }
@@ -33,6 +33,23 @@ void SetLegacyBionicDiagnosticsEnabled(bool enabled);
 // guest layout explicit instead of exposing the incompatible host libc type.
 using MocktailBionicMutexAttr = int64_t;

+// Bionic LP64 pthread_attr_t: 56 bytes with explicit field offsets. The host
+// glibc layout is opaque and wider on aarch64, so guest buffers must be read
+// and written through this struct only.
+struct MocktailBionicPthreadAttr {
+  std::uint32_t flags;
+  void* stack_base;
+  std::size_t stack_size;
+  std::size_t guard_size;
+  std::int32_t sched_policy;
+  std::int32_t sched_priority;
+  char reserved[16];
+};
+static_assert(sizeof(MocktailBionicPthreadAttr) == 56);
+
+inline constexpr std::uint32_t kMocktailBionicAttrFlagDetached = 0x1;
+inline constexpr std::uint32_t kMocktailBionicAttrFlagUserStack = 0x2;
+
 extern "C" {

 void mocktail_set_current_jni_env(void* env);
@@ -84,6 +101,19 @@ int mocktail_pthread_barrier_init(pthread_barrier_t* barrier,
 int mocktail_pthread_barrier_destroy(pthread_barrier_t* barrier);
 int mocktail_pthread_barrier_wait(pthread_barrier_t* barrier);

+int mocktail_pthread_attr_init(MocktailBionicPthreadAttr* attr);
+int mocktail_pthread_attr_destroy(MocktailBionicPthreadAttr* attr);
+int mocktail_pthread_attr_setstacksize(MocktailBionicPthreadAttr* attr,
+                                       size_t stack_size);
+int mocktail_pthread_attr_setdetachstate(MocktailBionicPthreadAttr* attr,
+                                         int detach_state);
+int mocktail_pthread_attr_setschedparam(MocktailBionicPthreadAttr* attr,
+                                        const struct sched_param* parameters);
+int mocktail_pthread_getattr_np(pthread_t thread,
+                                MocktailBionicPthreadAttr* attr);
+int mocktail_pthread_attr_getstack(const MocktailBionicPthreadAttr* attr,
+                                   void** stack_base, size_t* stack_size);
+
 extern void* mocktail_gameactivity_on_start_native;
 extern void* mocktail_gameactivity_on_resume_native;
 extern void* mocktail_gameactivity_on_surface_created_native;
@@ -2,6 +2,8 @@
 #define MOCKTAIL_COMPAT_BIONIC_PTHREAD_CREATE_RUNTIME_H_

 #include <pthread.h>
+#include <sched.h>
+#include <sys/types.h>

 #include <cstddef>

@@ -23,10 +25,17 @@ void ConfigureBionicPthreadThreadInitializer(

 }  // namespace mocktail::compat

+struct MocktailBionicPthreadAttr;
+
 // Rebuilds attributes instead of passing Android pthread_attr_t to glibc.
-extern "C" int mocktail_bionic_pthread_create(pthread_t* thread,
-                                               const pthread_attr_t* attr,
-                                               void* (*start_routine)(void*),
-                                               void* argument);
+extern "C" int mocktail_bionic_pthread_create(
+    pthread_t* thread, const MocktailBionicPthreadAttr* attr,
+    void* (*start_routine)(void*), void* argument);
+
+// Guest real-time scheduling is denied to avoid the host RLIMIT_RTTIME watchdog.
+extern "C" int mocktail_bionic_pthread_setschedparam(
+    pthread_t thread, int policy, const struct sched_param* parameters);
+extern "C" int mocktail_bionic_sched_setscheduler(
+    pid_t tid, int policy, const struct sched_param* parameters);

 #endif  // MOCKTAIL_COMPAT_BIONIC_PTHREAD_CREATE_RUNTIME_H_
@@ -1,6 +1,9 @@
 #ifndef MOCKTAIL_COMPAT_BUILD_PROFILE_H_
 #define MOCKTAIL_COMPAT_BUILD_PROFILE_H_

+#include <array>
+
+#include <cstddef>
 #include <cstdint>
 #include <optional>
 #include <string>
@@ -22,6 +25,27 @@ struct FmodOutputDeviceBridgeProfile {
  std::uintptr_t info_method_rva = 0;
  std::uintptr_t current_method_rva = 0;
  std::uintptr_t select_method_rva = 0;
+  // Roblox 2.738 inserted device-list methods before the current/select slots.
+  int vtable_layout_version = 1;
+
+  // Optional exact-build input count/info/current/select methods.
+  std::array<std::uintptr_t, 4> input_method_rvas{};
+  bool has_input_devices() const { return input_method_rvas[0] != 0; }
+  std::array<std::size_t, 4> input_vtable_indexes() const {
+    return vtable_layout_version == 2
+               ? std::array<std::size_t, 4>{9, 10, 12, 18}
+               : std::array<std::size_t, 4>{8, 9, 10, 16};
+  }
+
+  bool valid_vtable_layout() const {
+    return vtable_layout_version == 1 || vtable_layout_version == 2;
+  }
+  std::size_t current_vtable_index() const {
+    return vtable_layout_version == 2 ? 8 : 7;
+  }
+  std::size_t select_vtable_index() const {
+    return vtable_layout_version == 2 ? 19 : 17;
+  }
 };

 struct BuildProfile {
@@ -0,0 +1,42 @@
+#ifndef MOCKTAIL_COMPAT_FMOD_OUTPUT_DEVICE_CONTRACT_H_
+#define MOCKTAIL_COMPAT_FMOD_OUTPUT_DEVICE_CONTRACT_H_
+
+#include <cstddef>
+#include <initializer_list>
+#include <string_view>
+
+namespace mocktail::compat {
+
+// The 2.738 integer-index selector adds a feature-flag dispatch before the
+// count/clamp/setDriver path. Keep the calling convention, count slot (5),
+// object offset (0x28), and branch into that path exact. Only relocated
+// addresses and non-local branch/call targets vary between builds.
+inline constexpr char kFmodDeviceListsSelectContract[] =
+    "\x55\x48\x89\xe5\x41\x57\x41\x56\x41\x54\x53\x48\x83\xec\x50\x41"
+    "\x89\xf7\x49\x89\xfe\x4c\x8b\x25\x00\x00\x00\x00\x49\x8b\x04\x24"
+    "\x48\x89\x45\xd8\x80\x3d\x00\x00\x00\x00\x00\x74\x25\x49\x8b\x04"
+    "\x24\x48\x3b\x45\xd8\x0f\x85\x00\x00\x00\x00\x4c\x89\xf7\x44\x89"
+    "\xfe\x48\x83\xc4\x50\x5b\x41\x5c\x41\x5e\x41\x5f\x5d\xe9\x00\x00"
+    "\x00\x00\x49\x8b\x06\x4c\x89\xf7\xff\x50\x28\x44\x39\xf8\x0f\x8e"
+    "\x00\x00\x00\x00\x31\xdb\x45\x85\xff\x41\x0f\x4f\xdf\x49\x8b\x7e"
+    "\x28\x89\xde\xe8\x00\x00\x00\x00";
+inline constexpr std::size_t kFmodDeviceListsSelectContractSize =
+    sizeof(kFmodDeviceListsSelectContract) - 1;
+
+inline bool HasFmodDeviceListsSelectContract(std::string_view code) {
+  if (code.size() < kFmodDeviceListsSelectContractSize) return false;
+  for (std::size_t index = 0; index < kFmodDeviceListsSelectContractSize;
+       ++index) {
+    bool relocated = false;
+    for (const std::size_t start : {24, 38, 55, 78, 96, 116}) {
+      if (index >= start && index < start + 4) relocated = true;
+    }
+    if (!relocated && code[index] != kFmodDeviceListsSelectContract[index])
+      return false;
+  }
+  return true;
+}
+
+}  // namespace mocktail::compat
+
+#endif  // MOCKTAIL_COMPAT_FMOD_OUTPUT_DEVICE_CONTRACT_H_
@@ -0,0 +1,38 @@
+#ifndef MOCKTAIL_COMPAT_GUEST_ABI_H_
+#define MOCKTAIL_COMPAT_GUEST_ABI_H_
+
+#include <elf.h>
+#include <string_view>
+
+namespace mocktail::compat {
+
+#if defined(__aarch64__)
+// Android ABI name as it appears in APK lib/ directories and build metadata.
+inline constexpr std::string_view kGuestAbi = "arm64-v8a";
+// APK split-config name carrying the guest native libraries.
+inline constexpr std::string_view kGuestApkSplitName = "config.arm64_v8a";
+// File name the payload store uses for the split APK.
+inline constexpr std::string_view kGuestSplitApkFile =
+    "split_config.arm64_v8a.apk";
+// sha256 map key holding the split APK digest in payload metadata.
+inline constexpr std::string_view kGuestSplitApkHashKey = "arm64_v8a_split_apk";
+// Short CPU label for device metadata and user-facing strings.
+inline constexpr std::string_view kGuestCpuName = "aarch64";
+inline constexpr int kGuestElfMachine = EM_AARCH64;
+#elif defined(__x86_64__)
+inline constexpr std::string_view kGuestAbi = "x86_64";
+inline constexpr std::string_view kGuestApkSplitName = "config.x86_64";
+inline constexpr std::string_view kGuestSplitApkFile = "split_config.x86_64.apk";
+inline constexpr std::string_view kGuestSplitApkHashKey = "x86_64_split_apk";
+inline constexpr std::string_view kGuestCpuName = "x86_64";
+inline constexpr int kGuestElfMachine = EM_X86_64;
+#else
+#error "mocktail only supports aarch64 and x86_64 hosts"
+#endif
+
+// APK zip entry holding the guest libroblox.so.
+inline constexpr std::string_view kGuestLibApkEntryPrefix = "lib/";
+
+}  // namespace mocktail::compat
+
+#endif  // MOCKTAIL_COMPAT_GUEST_ABI_H_
@@ -48,9 +48,15 @@ struct PlatformIdentity {
  std::string manufacturer = "Mocktail";
  std::string model = "Mocktail Headless";
  std::string brand = "Mocktail";
+#if defined(__aarch64__)
+  std::string device_code = "linux-arm64";
+  std::string device_sku = "mocktail-arm64";
+  std::string soc_model = "aarch64";
+#else
  std::string device_code = "linux-x86_64";
  std::string device_sku = "mocktail-x86_64";
  std::string soc_model = "x86_64";
+#endif
 };

 struct RobloxCredentialView {
@@ -0,0 +1,88 @@
+#ifndef MOCKTAIL_AUDIO_FMOD_THREAD_FLOATING_POINT_H_
+#define MOCKTAIL_AUDIO_FMOD_THREAD_FLOATING_POINT_H_
+
+#include <string_view>
+
+#if defined(__x86_64__)
+#include <xmmintrin.h>
+#endif
+#if defined(__aarch64__)
+#include <cstdint>
+#endif
+
+namespace mocktail::audio {
+
+// FMOD's Android threads identify themselves through JavaVMAttachArgs before
+// entering their mix loop. Voice DSP filters can accumulate subnormal values
+// and spend an entire x86 core on floating-point assists (issue #128).
+// Limit FTZ/DAZ to these audio threads; retain the caller's other FP controls.
+class FmodThreadFloatingPointMode final {
+ public:
+  FmodThreadFloatingPointMode() = default;
+  ~FmodThreadFloatingPointMode() { Restore(); }
+  FmodThreadFloatingPointMode(const FmodThreadFloatingPointMode&) = delete;
+  FmodThreadFloatingPointMode& operator=(const FmodThreadFloatingPointMode&) =
+      delete;
+
+  bool Enable(const char* thread_name) noexcept {
+#if defined(__x86_64__) || defined(__aarch64__)
+    if (active_ || thread_name == nullptr) return false;
+    const std::string_view name(thread_name);
+    if (name != "FMOD mixer thread" && name != "FMOD feeder thread" &&
+        name != "FMOD Convolution thread" && name != "FMOD Worker Thread") {
+      return false;
+    }
+#if defined(__x86_64__)
+    const unsigned int control = _mm_getcsr();
+    original_mode_ = control & kModeMask;
+    _mm_setcsr(control | kModeMask);
+#else
+    std::uint64_t control;
+    __asm__ volatile("mrs %0, fpcr" : "=r"(control));
+    original_mode_ = control & kModeMask;
+    __asm__ volatile("msr fpcr, %0" ::"r"(control | kModeMask));
+#endif
+    active_ = true;
+    return true;
+#else
+    (void)thread_name;
+    return false;
+#endif
+  }
+
+  void Restore() noexcept {
+#if defined(__x86_64__) || defined(__aarch64__)
+    if (active_) {
+      // Restore only our two bits, preserving rounding, exception masks and
+      // status flags set by the guest while the thread was attached.
+#if defined(__x86_64__)
+      _mm_setcsr((_mm_getcsr() & ~kModeMask) | original_mode_);
+#else
+      std::uint64_t control;
+      __asm__ volatile("mrs %0, fpcr" : "=r"(control));
+      __asm__ volatile("msr fpcr, %0" ::"r"((control & ~kModeMask) |
+                                          original_mode_));
+#endif
+      active_ = false;
+    }
+#endif
+  }
+
+ private:
+#if defined(__x86_64__)
+  static constexpr unsigned int kModeMask = (1U << 15) | (1U << 6);
+  unsigned int original_mode_ = 0;
+  bool active_ = false;
+#elif defined(__aarch64__)
+  // FPCR FZ flushes single/double subnormals; FZ16 covers the half-precision
+  // path used by some voice DSP filters.
+  static constexpr std::uint64_t kModeMask =
+      (std::uint64_t{1} << 24) | (std::uint64_t{1} << 19);
+  std::uint64_t original_mode_ = 0;
+  bool active_ = false;
+#endif
+};
+
+}  // namespace mocktail::audio
+
+#endif  // MOCKTAIL_AUDIO_FMOD_THREAD_FLOATING_POINT_H_
@@ -4,6 +4,7 @@
 #include <array>
 #include <cstdint>
 #include <mutex>
+#include <memory>
 #include <string>
 #include <string_view>
 #include <vector>
@@ -13,13 +14,15 @@

 namespace mocktail::audio {

-// Replaces only the output-device query/select slots of the exact
+class NativeInputCapture;
+
+// Replaces the profiled input/output-device query/select slots of the exact
 // Build-ID-scoped FmodAudioDevice vtable. Roblox keeps owning its FMOD engine,
 // while the existing settings UI sees and selects the SDL host routes that
 // consume Android AudioTrack PCM.
 class RobloxOutputDeviceBridge final {
 public:
-  RobloxOutputDeviceBridge() = default;
+  RobloxOutputDeviceBridge();
  ~RobloxOutputDeviceBridge();

  RobloxOutputDeviceBridge(const RobloxOutputDeviceBridge&) = delete;
@@ -48,16 +51,25 @@ class RobloxOutputDeviceBridge final {
  Status Activate(std::uintptr_t image_base);
  Status PatchVtableLocked();
  bool RestoreVtableLocked();
-  int DeviceCount();
-  void* DeviceInfo(void* result, int index);
-  int CurrentDevice();
-  void SelectDevice(int index);
+  static int GetInputDeviceCount(void *self);
+  static void *GetInputDeviceInfo(void *result, void *self, int index);
+  static int GetCurrentInputDevice(void *self);
+  static void SetCurrentInputDevice(void *self, int index);
+  int DeviceCount(bool input = false);
+  void *DeviceInfo(void *result, int index, bool input = false);
+  int CurrentDevice(bool input = false);
+  void SelectDevice(int index, bool input = false);
  void ConstructGuestString(void* destination, std::string_view value) const;

+  std::unique_ptr<NativeInputCapture> capture_;
+  bool capture_profile_supported_ = false;
+  std::array<std::uintptr_t, 6> original_capture_methods_{};
  mutable std::mutex mutex_;
  compat::FmodOutputDeviceBridgeProfile profile_;
  std::vector<MenuDevice> devices_;
-  std::array<std::uintptr_t, 4> original_methods_{};
+  std::vector<MenuDevice> input_devices_;
+  int selected_input_index_ = 0;
+  std::array<std::uintptr_t, 8> original_methods_{};
  std::uintptr_t library_base_ = 0;
  std::uintptr_t* vtable_ = nullptr;
  void* string_constructor_ = nullptr;
@@ -36,6 +36,10 @@ Status ConfigureSdlRecordingDevice(
 Status GetConfiguredSdlRecordingDevice(std::uint32_t* recording_device_id,
                                       std::string* resolved_name);

+// Migrates live captures without changing their format or callback buffers.
+Status SwitchSdlRecordingDevice(std::uint32_t recording_device_id,
+                                std::string *resolved_name);
+
 using AudioCaptureDataCallback = void (*)(void* context,
                                          std::size_t size_bytes);

@@ -0,0 +1,53 @@
+#ifndef MOCKTAIL_GRAPHICS_ETC2_DECODER_H_
+#define MOCKTAIL_GRAPHICS_ETC2_DECODER_H_
+
+#include <cstddef>
+#include <cstdint>
+
+namespace mocktail::graphics {
+
+enum class EtcFormat {
+  kEtc2Rgb8,
+  kEtc2Rgb8A1,
+  kEtc2Rgba8,
+  kEacR11,
+  kEacR11Signed,
+  kEacRg11,
+  kEacRg11Signed,
+};
+
+std::size_t EtcBlockBytes(EtcFormat format);
+
+std::size_t EtcDecodedTexelBytes(EtcFormat format);
+
+bool DecodeEtcImage(EtcFormat format, const std::uint8_t* source,
+                    std::size_t source_bytes, std::uint32_t width,
+                    std::uint32_t height, std::uint8_t* destination,
+                    std::size_t destination_bytes);
+
+bool DecodeEtcImageBlockRows(EtcFormat format, const std::uint8_t* source,
+                             std::size_t source_bytes, std::uint32_t width,
+                             std::uint32_t height,
+                             std::uint32_t first_block_row,
+                             std::uint32_t block_row_count,
+                             std::uint8_t* destination,
+                             std::size_t destination_bytes);
+
+struct EtcDecodeJob {
+  EtcFormat format = EtcFormat::kEtc2Rgb8;
+  const std::uint8_t* source = nullptr;
+  std::size_t source_bytes = 0;
+  std::uint32_t width = 0;
+  std::uint32_t height = 0;
+  std::uint8_t* destination = nullptr;
+  std::size_t destination_bytes = 0;
+  bool ok = false;
+};
+
+// Synchronous; job destination buffers must not overlap.
+void DecodeEtcJobs(EtcDecodeJob* jobs, std::size_t count,
+                   unsigned worker_count);
+
+}  // namespace mocktail::graphics
+
+#endif  // MOCKTAIL_GRAPHICS_ETC2_DECODER_H_
@@ -0,0 +1,36 @@
+#ifndef MOCKTAIL_GRAPHICS_GLES_TEXT_OVERLAY_COMPOSITOR_H_
+#define MOCKTAIL_GRAPHICS_GLES_TEXT_OVERLAY_COMPOSITOR_H_
+
+#include <memory>
+
+#include "mocktail/graphics/text_overlay_frame.h"
+
+struct SDL_Window;
+
+namespace mocktail::graphics {
+
+struct GlesTextOverlaySource {
+  bool (*may_present)() = nullptr;
+  bool (*query)(MocktailTextOverlayFrameInfo *) = nullptr;
+  bool (*copy)(std::uint64_t, void *, std::size_t) = nullptr;
+};
+
+// Composites the host text editor before SDL swaps the game's GLES backbuffer.
+// Draw and destruction use the owning GL context when it is current. If that
+// context is no longer current at destruction, its destruction frees the GL
+// resources. Create a new compositor when creating a new context.
+class GlesTextOverlayCompositor {
+public:
+  explicit GlesTextOverlayCompositor(GlesTextOverlaySource source);
+  ~GlesTextOverlayCompositor();
+
+  bool Draw(SDL_Window *window);
+
+private:
+  struct Impl;
+  std::unique_ptr<Impl> impl_;
+};
+
+} // namespace mocktail::graphics
+
+#endif // MOCKTAIL_GRAPHICS_GLES_TEXT_OVERLAY_COMPOSITOR_H_
@@ -4,7 +4,7 @@
 #include <cstddef>
 #include <cstdint>

-// Process-local ABI with libvulkan.so. Pixels are RGBA8; consumers must copy a
+// Process-local ABI for host compositors. Pixels are RGBA8; consumers must copy a
 // matching revision before the producer clears its storage.
 struct MocktailTextOverlayFrameInfo {
  static constexpr std::uint32_t kAbiVersion = 2;
@@ -0,0 +1,55 @@
+#ifndef MOCKTAIL_GRAPHICS_TEXTURE_OVERRIDE_H_
+#define MOCKTAIL_GRAPHICS_TEXTURE_OVERRIDE_H_
+
+#include <cstddef>
+#include <cstdint>
+#include <memory>
+#include <mutex>
+#include <string>
+#include <unordered_map>
+#include <unordered_set>
+#include <vector>
+
+namespace mocktail::graphics {
+
+struct RgbaImage {
+  std::uint32_t width = 0;
+  std::uint32_t height = 0;
+  std::vector<std::uint8_t> pixels;
+};
+
+std::uint64_t HashBytes(const std::uint8_t* data, std::size_t size);
+std::string HashName(std::uint64_t hash);
+
+bool ReadPngRgba(const std::string& path, RgbaImage* image);
+bool WritePngRgba(const std::string& path, const RgbaImage& image);
+
+void ResampleRgba(const RgbaImage& source, std::uint32_t width,
+                  std::uint32_t height, std::uint8_t* destination);
+void ResampleRgba(const std::uint8_t* source, std::uint32_t source_width,
+                  std::uint32_t source_height, std::uint32_t width,
+                  std::uint32_t height, std::uint8_t* destination);
+
+class TextureOverrides {
+ public:
+  TextureOverrides(std::string override_dir, std::string dump_dir);
+  static TextureOverrides FromEnvironment();
+
+  bool enabled() const { return !override_dir_.empty() || !dump_dir_.empty(); }
+  bool dumping() const { return !dump_dir_.empty(); }
+
+  std::shared_ptr<const RgbaImage> Lookup(std::uint64_t hash);
+  void Dump(std::uint64_t hash, std::uint32_t width, std::uint32_t height,
+            const std::uint8_t* rgba);
+
+ private:
+  std::string override_dir_;
+  std::string dump_dir_;
+  std::mutex mutex_;
+  std::unordered_map<std::uint64_t, std::shared_ptr<const RgbaImage>> cache_;
+  std::unordered_set<std::uint64_t> dumped_;
+};
+
+}  // namespace mocktail::graphics
+
+#endif  // MOCKTAIL_GRAPHICS_TEXTURE_OVERRIDE_H_
@@ -0,0 +1,102 @@
+#ifndef MOCKTAIL_GRAPHICS_VULKAN_ETC2_EMULATION_H_
+#define MOCKTAIL_GRAPHICS_VULKAN_ETC2_EMULATION_H_
+
+#include <vulkan/vulkan.h>
+
+#include <cstdint>
+
+#include "mocktail/graphics/etc2_decoder.h"
+
+namespace mocktail::graphics {
+
+struct Etc2EmulatedFormat {
+  VkFormat host_format = VK_FORMAT_UNDEFINED;
+  EtcFormat etc_format = EtcFormat::kEtc2Rgb8;
+};
+
+bool LookupEmulatedEtc2Format(VkFormat format, Etc2EmulatedFormat* out);
+
+VkFormatFeatureFlags EmulatedEtc2FormatFeatures(
+    VkFormatFeatureFlags host_features);
+
+bool Etc2UploadByteCounts(EtcFormat format, const VkExtent3D& extent,
+                          std::uint32_t layer_count, VkDeviceSize* compressed,
+                          VkDeviceSize* decoded);
+
+bool Etc2SupportAdvertised(const char* value);
+bool Etc2SupportAdvertised();
+
+inline constexpr std::uint32_t kSmallTextureMaxExtent = 64;
+inline constexpr std::uint32_t kDefaultSmallTextureUpscale = 4;
+std::uint32_t SmallTextureUpscale(const char* value);
+
+class VulkanEtc2Emulation final {
+ public:
+  VulkanEtc2Emulation();
+  ~VulkanEtc2Emulation();
+  VulkanEtc2Emulation(const VulkanEtc2Emulation&) = delete;
+  VulkanEtc2Emulation& operator=(const VulkanEtc2Emulation&) = delete;
+
+  bool PhysicalDeviceNeedsEmulation(VkPhysicalDevice physical_device,
+                                    PFN_vkGetPhysicalDeviceFeatures host);
+
+  void RegisterDevice(VkDevice device, VkPhysicalDevice physical_device,
+                      bool emulated,
+                      const VkPhysicalDeviceMemoryProperties& memory,
+                      PFN_vkGetDeviceProcAddr get_device_proc_addr);
+  void DestroyDevice(VkDevice device);
+
+  VkResult CreateImage(VkDevice device, const VkImageCreateInfo* create_info,
+                       const VkAllocationCallbacks* allocator, VkImage* image);
+  void DestroyImage(VkDevice device, VkImage image,
+                    const VkAllocationCallbacks* allocator);
+  VkResult CreateImageView(VkDevice device,
+                           const VkImageViewCreateInfo* create_info,
+                           const VkAllocationCallbacks* allocator,
+                           VkImageView* view);
+  VkResult BindBufferMemory(VkDevice device, VkBuffer buffer,
+                            VkDeviceMemory memory, VkDeviceSize offset);
+  VkResult BindBufferMemory2(VkDevice device, std::uint32_t count,
+                             const VkBindBufferMemoryInfo* infos);
+  VkResult MapMemory(VkDevice device, VkDeviceMemory memory,
+                     VkDeviceSize offset, VkDeviceSize size,
+                     VkMemoryMapFlags flags, void** data);
+  VkResult MapMemory2(VkDevice device, const VkMemoryMapInfo* info,
+                      void** data);
+  void UnmapMemory(VkDevice device, VkDeviceMemory memory);
+  VkResult UnmapMemory2(VkDevice device, const VkMemoryUnmapInfo* info);
+  void FreeMemory(VkDevice device, VkDeviceMemory memory,
+                  const VkAllocationCallbacks* allocator);
+  void DestroyBuffer(VkDevice device, VkBuffer buffer,
+                     const VkAllocationCallbacks* allocator);
+  void CmdCopyBufferToImage(VkDevice device, VkCommandBuffer command_buffer,
+                            VkBuffer source, VkImage destination,
+                            VkImageLayout layout, std::uint32_t region_count,
+                            const VkBufferImageCopy* regions);
+  void CmdCopyBufferToImage2(VkDevice device, VkCommandBuffer command_buffer,
+                             const VkCopyBufferToImageInfo2* info);
+  void CmdCopyImage(VkDevice device, VkCommandBuffer command_buffer,
+                    VkImage source, VkImageLayout source_layout,
+                    VkImage destination, VkImageLayout destination_layout,
+                    std::uint32_t region_count, const VkImageCopy* regions);
+  void CmdCopyImage2(VkDevice device, VkCommandBuffer command_buffer,
+                     const VkCopyImageInfo2* info);
+  void CmdExecuteCommands(VkDevice device, VkCommandBuffer command_buffer,
+                          std::uint32_t count,
+                          const VkCommandBuffer* secondaries);
+
+  // Resubmission must reread the source bytes.
+  void PrepareSubmit(const VkCommandBuffer* command_buffers,
+                     std::uint32_t count);
+  // Call only after the command buffer is no longer pending.
+  void ReleaseCommandBuffer(VkCommandBuffer command_buffer);
+
+  struct State;
+
+ private:
+  State* state_;
+};
+
+}  // namespace mocktail::graphics
+
+#endif  // MOCKTAIL_GRAPHICS_VULKAN_ETC2_EMULATION_H_
@@ -0,0 +1,23 @@
+#ifndef MOCKTAIL_RUNTIME_DEVICE_MEMORY_PROFILE_H_
+#define MOCKTAIL_RUNTIME_DEVICE_MEMORY_PROFILE_H_
+
+#include <cstdint>
+
+namespace mocktail {
+namespace runtime {
+
+struct DeviceMemoryProfile {
+  std::int32_t total_memory_mb = 0;
+  std::int32_t memory_class_mb = 0;
+  std::int32_t large_memory_class_mb = 0;
+  std::int64_t low_memory_killer_background_threshold = 0;
+  std::int64_t low_memory_killer_foreground_threshold = 0;
+  bool low_ram_device = false;
+};
+
+DeviceMemoryProfile BuildDeviceMemoryProfile(std::uint64_t host_memory_bytes);
+
+}  // namespace runtime
+}  // namespace mocktail
+
+#endif  // MOCKTAIL_RUNTIME_DEVICE_MEMORY_PROFILE_H_
@@ -0,0 +1,66 @@
+#ifndef MOCKTAIL_RUNTIME_DISPLAY_SIZE_H_
+#define MOCKTAIL_RUNTIME_DISPLAY_SIZE_H_
+
+#include <cstdint>
+#include <limits>
+
+namespace mocktail {
+namespace runtime {
+
+struct DisplaySize {
+  std::int32_t width = 1920;
+  std::int32_t height = 1080;
+};
+
+// Physical pixels; window size is captured at startup.
+inline constexpr const char* kDisplaySizeEnvironment =
+    "MOCKTAIL_DISPLAY_SIZE_INTERNAL";
+inline constexpr const char* kWindowSizeEnvironment =
+    "MOCKTAIL_WINDOW_SIZE_INTERNAL";
+
+inline DisplaySize ParseDisplaySize(const char* value) {
+  const DisplaySize fallback;
+  if (value == nullptr) {
+    return fallback;
+  }
+  std::int64_t parts[2] = {0, 0};
+  const char* cursor = value;
+  for (int index = 0; index < 2; ++index) {
+    if (*cursor < '0' || *cursor > '9') {
+      return fallback;
+    }
+    std::int64_t parsed = 0;
+    while (*cursor >= '0' && *cursor <= '9') {
+      parsed = parsed * 10 + (*cursor - '0');
+      if (parsed > std::numeric_limits<std::int32_t>::max()) {
+        return fallback;
+      }
+      ++cursor;
+    }
+    if (parsed == 0) {
+      return fallback;
+    }
+    parts[index] = parsed;
+    if (index == 0) {
+      if (*cursor != 'x') {
+        return fallback;
+      }
+      ++cursor;
+    }
+  }
+  if (*cursor != '\0') {
+    return fallback;
+  }
+  return {static_cast<std::int32_t>(parts[0]),
+          static_cast<std::int32_t>(parts[1])};
+}
+
+inline std::int32_t PixelsToMillimetersAt160Dpi(std::int32_t pixels) {
+  return static_cast<std::int32_t>(static_cast<std::int64_t>(pixels) * 254 /
+                                   1600);
+}
+
+}  // namespace runtime
+}  // namespace mocktail
+
+#endif  // MOCKTAIL_RUNTIME_DISPLAY_SIZE_H_
@@ -0,0 +1,28 @@
+#ifndef MOCKTAIL_RUNTIME_FLEASION_H_
+#define MOCKTAIL_RUNTIME_FLEASION_H_
+
+#include <filesystem>
+#include <string>
+
+#include "runtime/runtime_config.h"
+#include "runtime/runtime_paths.h"
+
+namespace mocktail::runtime {
+
+struct FleasionPreparation {
+  std::filesystem::path certificate;
+  std::filesystem::path base_bundle;
+  std::filesystem::path bundle;
+  std::string error;
+  explicit operator bool() const { return error.empty(); }
+};
+
+// Generates a private, replaceable trust bundle outside the managed payload.
+// Reads certificates only; never reads Fleasion's private key or changes it.
+FleasionPreparation PrepareFleasion(const RuntimeConfig& config,
+                                   const Environment& environment,
+                                   const RuntimePaths& paths);
+
+}  // namespace mocktail::runtime
+
+#endif
@@ -65,6 +65,10 @@ bool MergeRuntimeClientSettingsOverrides(const FrameRatePolicy& frame_rate,
 // Keeps the legacy test bypass disabled. The host PermissionsProtocol now
 // answers microphone authorization from capture configuration. No permission
 // query opens a recording device.
+bool MergeAudioDeviceMenuClientSettingsOverrides(std::string_view base_json,
+                                                 std::string *merged_json,
+                                                 std::string *error);
+
 bool MergeAudioCaptureClientSettingsOverrides(bool microphone_enabled,
                                              std::string_view base_json,
                                              std::string* merged_json,
@@ -0,0 +1,15 @@
+#ifndef MOCKTAIL_RUNTIME_PROCESS_DIAGNOSTICS_H_
+#define MOCKTAIL_RUNTIME_PROCESS_DIAGNOSTICS_H_
+
+namespace mocktail::runtime {
+
+enum class ProcessDiagnosticStage { kStartup, kNativeRuntime, kShutdown };
+
+// Installs a diagnostic handler only if SIGXCPU still has its default action.
+// The handler logs to stderr and re-delivers SIGXCPU with the default action.
+void InstallCpuLimitDiagnostics();
+void LogProcessDiagnostics(ProcessDiagnosticStage stage);
+
+}  // namespace mocktail::runtime
+
+#endif  // MOCKTAIL_RUNTIME_PROCESS_DIAGNOSTICS_H_
@@ -0,0 +1,16 @@
+#ifndef MOCKTAIL_RUNTIME_PROCESS_LAUNCH_POLICY_H_
+#define MOCKTAIL_RUNTIME_PROCESS_LAUNCH_POLICY_H_
+
+#include <string>
+
+namespace mocktail::runtime {
+
+// Call only for interactive launches, before creating any threads. Removes an
+// inherited soft CPU limit when the hard limit is unlimited and demotes the
+// calling thread from FIFO/RR scheduling. Returns diagnostics for the session
+// log, including failures; never changes hard limits or signal dispositions.
+std::string ApplyInteractiveProcessLaunchPolicy();
+
+}  // namespace mocktail::runtime
+
+#endif  // MOCKTAIL_RUNTIME_PROCESS_LAUNCH_POLICY_H_
@@ -138,6 +138,8 @@ struct RobloxInputSnapshot {
  uint64_t keyboard_events = 0;
  uint64_t ignored_text_events = 0;
  uint64_t text_events = 0;
+  // Zero after the host editor finishes, even if Roblox sends no hide callback.
+  uint64_t text_focus_generation = 0;
  uint64_t native_errors = 0;
  uint32_t active_mouse_buttons = 0;
  uint32_t active_touches = 0;
@@ -19,6 +19,13 @@ inline constexpr std::size_t kMaximumRobloxLaunchUriBytes = 64 * 1024;
 Status ParseRobloxLaunchUri(std::string_view uri,
                            RobloxExperienceLaunchRequest* request);

+// Converts a WebView launchGame command
+// ({"functionName":"launchGame","params":{"request":{...}}}) into the same
+// contract. Returns kUnsupported for other commands and kInvalidArgument for
+// a malformed launchGame request.
+Status ParseRobloxWebViewLaunchGame(std::string_view command,
+                                    RobloxExperienceLaunchRequest* request);
+
 }  // namespace runtime
 }  // namespace mocktail

@@ -119,6 +119,13 @@ class RuntimeConfig {
  }
  bool ca_bundle_valid() const { return ca_bundle_valid_; }
  bool use_system_proxy() const { return use_system_proxy_; }
+  bool fleasion_enabled() const { return fleasion_enabled_; }
+  bool fleasion_valid() const { return fleasion_valid_; }
+  const std::string& fleasion_proxy_mode() const { return fleasion_proxy_mode_; }
+  int fleasion_proxy_port() const { return fleasion_proxy_port_; }
+  const std::optional<std::filesystem::path>& fleasion_ca_certificate() const {
+    return fleasion_ca_certificate_;
+  }
  const DiscordRpcConfig& discord_rpc() const { return discord_rpc_; }
  bool discord_rpc_valid() const { return discord_rpc_valid_; }

@@ -152,6 +159,11 @@ class RuntimeConfig {
  std::string audio_input_device_ = "default";
  bool audio_input_device_valid_ = true;
  bool use_system_proxy_ = false;
+  bool fleasion_enabled_ = false;
+  bool fleasion_valid_ = true;
+  std::string fleasion_proxy_mode_ = "env";
+  int fleasion_proxy_port_ = 58443;
+  std::optional<std::filesystem::path> fleasion_ca_certificate_;
  std::optional<NetworkProxyConfig> network_proxy_;
  std::optional<std::filesystem::path> ca_bundle_;
  bool ca_bundle_valid_ = true;
@@ -14,7 +14,7 @@ struct ActivePayloadPaths {
  std::filesystem::path root;
  std::filesystem::path roblox_library;
  std::filesystem::path base_apk;
-  std::filesystem::path x86_64_split_apk;
+  std::filesystem::path arch_split_apk;
  std::filesystem::path assets_content;
  std::filesystem::path compatibility_manifest;
  std::filesystem::path host_abi_profile;
@@ -0,0 +1,10 @@
+# Allowed reduced aarch64 packages from pkgforge-dev/archlinux-pkgs-debloated.
+# The installer verifies the rolling release asset IDs and SHA256 digests.
+ffmpeg-mini-aarch64.pkg.tar.zst
+gdk-pixbuf2-mini-aarch64.pkg.tar.xz
+gtk4-mini-aarch64.pkg.tar.zst
+icu-mini-aarch64.pkg.tar.zst
+librsvg-mini-aarch64.pkg.tar.zst
+libxml2-mini-aarch64.pkg.tar.zst
+mesa-mini-aarch64.pkg.tar.zst
+opus-mini-aarch64.pkg.tar.zst
@@ -1,11 +0,0 @@
-# pkgforge-dev/archlinux-pkgs-debloated, continuous release, 2026-09-11.
-# These assets are rolling. Refresh names/hashes together; do not bypass a
-# checksum mismatch. Only the disposable AppImage build container installs them.
-19e57cf78e309052b1ce55293374599f19fbc56cd2ac572191f475e718b42503  ffmpeg-mini-x86_64.pkg.tar.zst
-5a796f6846a898d5f706d92ae34a70d6f6cf28595369ccafbfda21ad6ccc6b7f  gdk-pixbuf2-mini-x86_64.pkg.tar.zst
-9a42b41a03fc493a9bc4d00c9882e34ee28b5239a79175cc47e1dfe869f5d4a6  gtk4-mini-x86_64.pkg.tar.zst
-8bec7844a49eb7e3efc020ba0858e69cfb4fed64b83c116df04b4179cc2fa1a6  icu-mini-x86_64.pkg.tar.zst
-91fd7550208a306ff4e43fe10f405db01f2bc1ce8bdad5469229c05185201983  librsvg-mini-x86_64.pkg.tar.zst
-d5220136f8d9b4eaaf173a44d3f0092e97b61cfe9f5d627c570c6e81add9e789  libxml2-mini-x86_64.pkg.tar.zst
-90ec938ec71e62478745185f76d64253cc0a7ac2e0a18aaff0fb59cd70eb1f92  mesa-mini-x86_64.pkg.tar.zst
-857f7d895a471786b7920b430fbf0b91078bfb8efc6bf332c27928f6104929ae  opus-mini-x86_64.pkg.tar.zst
@@ -0,0 +1,12 @@
+# Allowed reduced packages from pkgforge-dev/archlinux-pkgs-debloated.
+# continuous is rolling: the installer snapshots GitHub asset IDs and SHA256
+# digests together at build time, and verifies every archive before installation.
+# Only the disposable AppImage build container installs these packages.
+ffmpeg-mini-x86_64.pkg.tar.zst
+gdk-pixbuf2-mini-x86_64.pkg.tar.zst
+gtk4-mini-x86_64.pkg.tar.zst
+icu-mini-x86_64.pkg.tar.zst
+librsvg-mini-x86_64.pkg.tar.zst
+libxml2-mini-x86_64.pkg.tar.zst
+mesa-mini-x86_64.pkg.tar.zst
+opus-mini-x86_64.pkg.tar.zst
@@ -16,6 +16,7 @@ depends=(
  'libelf'
  'libglvnd'
  'libplacebo'
+  'libpng'
  'libutf8proc'
  'libyaml'
  'minizip'
@@ -1,7 +1,7 @@
 pkgbase = mocktail-bin
 	pkgdesc = Android x86-64 Roblox compatibility runtime for Linux (prebuilt)
-	pkgver = 1.0.3
-	pkgrel = 2
+	pkgver = 1.0.4
+	pkgrel = 1
 	url = https://github.com/komaruworld/mocktail
 	arch = x86_64
 	license = Apache-2.0
@@ -17,6 +17,7 @@ pkgbase = mocktail-bin
 	depends = libelf
 	depends = libglvnd
 	depends = libplacebo
+	depends = libpng
 	depends = libsoup3
 	depends = libutf8proc
 	depends = libyaml
@@ -31,10 +32,10 @@ pkgbase = mocktail-bin
 	provides = mocktail
 	conflicts = mocktail
 	conflicts = mocktail-git
-	noextract = mocktail-1.0.3-2-x86_64.pkg.tar.zst
+	noextract = mocktail-1.0.4-x86_64.pkg.tar.zst
 	options = !debug
 	options = !strip
-	source = mocktail-1.0.3-2-x86_64.pkg.tar.zst::https://github.com/komaruworld/mocktail/releases/download/1.0.3/mocktail-1.0.3-2-x86_64.pkg.tar.zst
-	sha256sums = be945181d73d28d9bf09a93927a215d03a3a8b479ffddab3378a8113b56e4b99
+	source = mocktail-1.0.4-x86_64.pkg.tar.zst::https://github.com/komaruworld/mocktail/releases/download/1.0.4/mocktail-1.0.4-x86_64.pkg.tar.zst
+	sha256sums = d5cc7216e88fd2889369e8eb7fba4276b2746c2b084dce566aaaa7505bc2ffb7

 pkgname = mocktail-bin
@@ -1,8 +1,8 @@
 # Maintainer: komaruworld <rtysus228 at gmail dot com>

 pkgname=mocktail-bin
-pkgver=1.0.3
-pkgrel=2
+pkgver=1.0.4
+pkgrel=1
 pkgdesc='Android x86-64 Roblox compatibility runtime for Linux (prebuilt)'
 arch=('x86_64')
 url='https://github.com/komaruworld/mocktail'
@@ -20,6 +20,7 @@ depends=(
  'libelf'
  'libglvnd'
  'libplacebo'
+  'libpng'
  'libsoup3'
  'libutf8proc'
  'libyaml'
@@ -35,10 +36,11 @@ optdepends=('gamemode: Feral GameMode integration')
 provides=('mocktail')
 conflicts=('mocktail' 'mocktail-git')
 options=('!debug' '!strip')
-_archive="mocktail-${pkgver}-${pkgrel}-${CARCH}.pkg.tar.zst"
+# Release asset names do not include the AUR package release.
+_archive="mocktail-${pkgver}-${CARCH}.pkg.tar.zst"
 source=("${_archive}::https://github.com/komaruworld/mocktail/releases/download/${pkgver}/${_archive}")
 noextract=("${_archive}")
-sha256sums=('be945181d73d28d9bf09a93927a215d03a3a8b479ffddab3378a8113b56e4b99')
+sha256sums=('d5cc7216e88fd2889369e8eb7fba4276b2746c2b084dce566aaaa7505bc2ffb7')

 package() {
  bsdtar -xf "${srcdir}/${_archive}" -C "${pkgdir}" usr
@@ -24,6 +24,7 @@ pkgbase = mocktail-git
 	depends = libelf
 	depends = libglvnd
 	depends = libplacebo
+	depends = libpng
 	depends = libsoup3
 	depends = libutf8proc
 	depends = libyaml
@@ -20,6 +20,7 @@ depends=(
  'libelf'
  'libglvnd'
  'libplacebo'
+  'libpng'
  'libsoup3'
  'libutf8proc'
  'libyaml'
@@ -1,7 +1,7 @@
 pkgbase = mocktail
 	pkgdesc = Android x86-64 Roblox compatibility runtime for Linux
-	pkgver = 1.0.3
-	pkgrel = 2
+	pkgver = 1.0.4
+	pkgrel = 1
 	url = https://github.com/komaruworld/mocktail
 	arch = x86_64
 	license = Apache-2.0
@@ -24,6 +24,7 @@ pkgbase = mocktail
 	depends = libelf
 	depends = libglvnd
 	depends = libplacebo
+	depends = libpng
 	depends = libsoup3
 	depends = libutf8proc
 	depends = libyaml
@@ -39,7 +40,7 @@ pkgbase = mocktail
 	conflicts = mocktail-git
 	options = !debug
 	options = !lto
-	source = mocktail::git+https://github.com/komaruworld/mocktail.git#tag=1.0.3
+	source = mocktail::git+https://github.com/komaruworld/mocktail.git#tag=1.0.4
 	sha256sums = SKIP

 pkgname = mocktail
@@ -1,8 +1,8 @@
 # Maintainer: komaruworld <rtysus228 at gmail dot com>

 pkgname=mocktail
-pkgver=1.0.3
-pkgrel=2
+pkgver=1.0.4
+pkgrel=1
 pkgdesc='Android x86-64 Roblox compatibility runtime for Linux'
 arch=('x86_64')
 url='https://github.com/komaruworld/mocktail'
@@ -20,6 +20,7 @@ depends=(
  'libelf'
  'libglvnd'
  'libplacebo'
+  'libpng'
  'libsoup3'
  'libutf8proc'
  'libyaml'
@@ -42,7 +43,6 @@ makedepends=(
 )
 optdepends=('gamemode: Feral GameMode integration')
 conflicts=('mocktail-bin' 'mocktail-git')
-# The 1.0.3 tag predates the source-level FORTIFY/LTO isolation fix.
 options=('!debug' '!lto')
 source=(
  "mocktail::git+https://github.com/komaruworld/mocktail.git#tag=${pkgver}"
@@ -23,6 +23,7 @@
  elfutils,
  libglvnd,
  libplacebo,
+  libpng,
  libsoup_3,
  libutf8proc,
  libyaml,
@@ -92,6 +93,7 @@ stdenv.mkDerivation (finalAttrs: {
    elfutils
    libglvnd
    libplacebo
+    libpng
    libsoup_3
    libutf8proc
    libyaml
@@ -55,6 +55,19 @@
    <binary>mocktail</binary>
  </provides>
  <releases>
+    <release version="1.0.4" date="2026-09-11">
+      <description>
+        <ul>
+          <li>Fixed login issues</li>
+          <li>Fixed low-resolution textures, skybox rendering and HiDPI scaling.</li>
+          <li>Added vc support.</li>
+          <li>Added Xbox and PlayStation gamepad support.</li>
+          <li>Added Nix support</li>
+          <li>Improved text input, fullscreen mode, window sizing, and mouse controls.</li>
+          <li>Updated support for Roblox 2.736.1408.</li>
+        </ul>
+      </description>
+    </release>
    <release version="1.0.3" date="2026-08-16">
      <description>
        <ul>
@@ -6,10 +6,11 @@ set -Eeuo pipefail
 umask 022

 readonly REPOSITORY="${1:?Flatpak repository path is required}"
-readonly BUNDLE="${2:?Flatpak bundle path is required}"
-readonly PUBLIC_KEY="${3:?GPG public key path is required}"
-readonly OUTPUT="${4:?Pages output path is required}"
-readonly NATIVE_REPOSITORIES="${5:?Native repositories path is required}"
+readonly X86_64_BUNDLE="${2:?x86_64 Flatpak bundle path is required}"
+readonly AARCH64_BUNDLE="${3:?aarch64 Flatpak bundle path is required}"
+readonly PUBLIC_KEY="${4:?GPG public key path is required}"
+readonly OUTPUT="${5:?Pages output path is required}"
+readonly NATIVE_REPOSITORIES="${6:?Native repositories path is required}"
 readonly BASE_URL="https://mocktail.bigrat.space"
 readonly SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"
 readonly PROJECT_DIR="$(dirname -- "${SCRIPT_DIR}")"
@@ -18,10 +19,12 @@ readonly PROJECT_DIR="$(dirname -- "${SCRIPT_DIR}")"
  printf 'Flatpak repository is missing or unsafe: %s\n' "${REPOSITORY}" >&2
  exit 1
 }
-[[ -f "${BUNDLE}" && ! -L "${BUNDLE}" ]] || {
-  printf 'Flatpak bundle is missing or unsafe: %s\n' "${BUNDLE}" >&2
-  exit 1
-}
+for bundle in "${X86_64_BUNDLE}" "${AARCH64_BUNDLE}"; do
+  [[ -f "${bundle}" && ! -L "${bundle}" ]] || {
+    printf 'Flatpak bundle is missing or unsafe: %s\n' "${bundle}" >&2
+    exit 1
+  }
+done
 [[ -s "${PUBLIC_KEY}" && ! -L "${PUBLIC_KEY}" ]] || {
  printf 'Flatpak public key is missing or unsafe: %s\n' "${PUBLIC_KEY}" >&2
  exit 1
@@ -40,7 +43,8 @@ readonly PROJECT_DIR="$(dirname -- "${SCRIPT_DIR}")"

 mkdir -p -- "${OUTPUT}"
 cp -a -- "${REPOSITORY}" "${OUTPUT}/repo"
-install -m 0644 -- "${BUNDLE}" "${OUTPUT}/Mocktail-x86_64.flatpak"
+install -m 0644 -- "${X86_64_BUNDLE}" "${OUTPUT}/Mocktail-x86_64.flatpak"
+install -m 0644 -- "${AARCH64_BUNDLE}" "${OUTPUT}/Mocktail-aarch64.flatpak"
 install -m 0644 -- "${PUBLIC_KEY}" "${OUTPUT}/mocktail-flatpak.gpg"
 install -m 0644 -- \
  "${PROJECT_DIR}/packaging/space.bigrat.mocktail.svg" \
@@ -69,7 +73,7 @@ Title=Mocktail Nightly
 Url=${BASE_URL}/repo/
 Homepage=https://github.com/komaruworld/mocktail
 Comment=Nightly builds of Mocktail
-Description=Signed x86_64 nightly builds published from the latest Mocktail main branch
+Description=Signed x86_64 and aarch64 nightly builds published from the latest Mocktail main branch
 Icon=${BASE_URL}/mocktail.svg
 GPGKey=${GPG_KEY}
 EOF
@@ -461,6 +461,7 @@ LatestSupportedBootstrapProfile() {
              .version_code <= ($remote_version_code | tonumber)) and
             .status == "supported" and .default_allowed == true and
             .allow_legacy_binary_patches == false and
+             (.abi // "x86_64") == "x86_64" and
             (.version_name | type) == "string" and
             (.version_name | length) > 0)] |
    group_by(.version_code) |
@@ -495,6 +496,7 @@ SelectSupportedBootstrapFallback() {
    bootstrap_source="$(jq -er --argjson version_code "${fallback_version_code}" '
      [.sources[]? |
       select(.version_code == $version_code and
+              (.abi // "x86_64") == "x86_64" and
              .provider == "uptodown")] |
      if length == 1 then .[0].provider else empty end
    ' "${BOOTSTRAP_SOURCES_PATH}" 2>/dev/null || true)"
@@ -329,6 +329,7 @@ def run_trial(args, max_ctors, skipped_offsets, trial_id):
  log_path = args.log_dir / f"trial_{trial_id:03d}_max_{max_ctors}.log"
  env = os.environ.copy()
  env.update({
+      "ROBLOX_LIB_PATH": str(args.libroblox),
      "MOCKTAIL_RUN_LIBROBLOX_CTORS": "1",
      "MOCKTAIL_LIBROBLOX_CTOR_POLICY": args.ctor_policy,
      "MOCKTAIL_GRAPHICS_BACKEND": args.graphics_backend,
@@ -500,7 +501,7 @@ def parse_args():
  parser = argparse.ArgumentParser()
  parser.add_argument("--project-root", type=Path, default=project_root)
  parser.add_argument("--run-script", type=Path,
-                      default=project_root / "scripts" / "run_sober.sh")
+                      default=project_root / "build" / "mocktail")
  parser.add_argument("--libroblox", type=Path,
                      default=project_root / "rbx_bin" / "libroblox.so")
  parser.add_argument("--log-dir", type=Path,
@@ -15,7 +15,7 @@ Usage() {
  cat <<'EOF'
 Usage: scripts/build_flatpak.sh [OPTIONS]

-Build and install Mocktail as a per-user x86-64 Flatpak.
+Build and install Mocktail as a per-user Flatpak for the host architecture.

 Options:
  --build-dir DIR  Builder output directory (default: build-flatpak).
@@ -92,8 +92,11 @@ done
 [[ "${JOBS}" =~ ^[1-9][0-9]*$ && "${JOBS}" -le 256 ]] ||
  Die "--jobs must be an integer between 1 and 256"

-[[ "$(uname -m)" == x86_64 ]] ||
-  Die "the Roblox payload and Flatpak manifest currently require x86-64"
+HOST_ARCH="$(uname -m)"
+case "${HOST_ARCH}" in
+  x86_64|aarch64) ;;
+  *) Die "Flatpak builds require an x86_64 or aarch64 Linux host" ;;
+esac
 command -v flatpak >/dev/null 2>&1 || Die "flatpak is required"

 MANIFEST="$(realpath -e -- "${MANIFEST}")" ||
@@ -122,7 +125,7 @@ CleanupStaleBuilderMounts

 cd -- "${PROJECT_ROOT}"
 exec "${builder[@]}" \
-  --arch=x86_64 \
+  --arch="${HOST_ARCH}" \
  --jobs="${JOBS}" \
  --force-clean \
  --install-deps-from=flathub \
@@ -61,6 +61,7 @@ def supported_profiles(catalog: dict) -> list[dict]:
        if isinstance(profile, dict)
        and profile.get("status") == "supported"
        and profile.get("default_allowed") is True
+        and profile.get("abi", ARCHITECTURE) == ARCHITECTURE
        and isinstance(profile.get("version_name"), str)
        and isinstance(profile.get("version_code"), int)
    ]
@@ -1271,6 +1271,33 @@ def has_fmod_string_constructor_contract(image: ElfImage, rva: int) -> bool:
        return False


+def has_fmod_device_lists_select_contract(image: ElfImage, rva: int) -> bool:
+    # Keep in sync with compat/fmod_output_device_contract.h. The fixed bytes
+    # bind the int-index ABI, count slot, clamp, and FMOD system-object offset.
+    expected = bytes.fromhex(
+        "55 48 89 e5 41 57 41 56 41 54 53 48 83 ec 50 41 "
+        "89 f7 49 89 fe 4c 8b 25 00 00 00 00 49 8b 04 24 "
+        "48 89 45 d8 80 3d 00 00 00 00 00 74 25 49 8b 04 "
+        "24 48 3b 45 d8 0f 85 00 00 00 00 4c 89 f7 44 89 "
+        "fe 48 83 c4 50 5b 41 5c 41 5e 41 5f 5d e9 00 00 "
+        "00 00 49 8b 06 4c 89 f7 ff 50 28 44 39 f8 0f 8e "
+        "00 00 00 00 31 db 45 85 ff 41 0f 4f df 49 8b 7e "
+        "28 89 de e8 00 00 00 00"
+    )
+    try:
+        image.require_code_rva(rva, len(expected))
+        offset = image.rva_to_offset(rva, len(expected))
+        code = image.bytes_at(offset, len(expected), "FMOD device-list selector")
+    except AnalyzerError:
+        return False
+    relocated = {index for start in (24, 38, 55, 78, 96, 116)
+                 for index in range(start, start + 4)}
+    return len(code) == len(expected) and all(
+        index in relocated or actual == wanted
+        for index, (actual, wanted) in enumerate(zip(code, expected))
+    )
+
+
 def load_reference_runtime_profile(
    paths: Sequence[Path], reference_build_id: str
 ) -> dict[str, Any]:
@@ -1306,7 +1333,11 @@ def load_reference_runtime_profile(
                }
                if (
                    not isinstance(bridge, dict)
-                    or set(bridge) != fields
+                    or not fields <= set(bridge)
+                    or set(bridge) - fields - {"vtable_layout_version"} - {
+                        "input_count_method_rva", "input_info_method_rva",
+                        "input_current_method_rva", "input_select_method_rva",
+                    }
                    or profile.get("allow_host_abi_bridges") is not True
                ):
                    raise AnalyzerError(
@@ -1315,12 +1346,32 @@ def load_reference_runtime_profile(
                discovered["fmod_output_device_bridge"] = {
                    field: parse_rva(value, f"reference FMOD {field}")
                    for field, value in bridge.items()
+                    if field != "vtable_layout_version"
                }
+                layout = bridge.get("vtable_layout_version", 1)
+                if type(layout) is not int or layout not in (1, 2):
+                    raise AnalyzerError("reference FMOD vtable layout is unsupported")
+                if layout != 1:
+                    discovered["fmod_output_device_bridge"]["vtable_layout_version"] = layout
            for field, value in discovered.items():
-                if field in result and result[field] != value:
-                    raise AnalyzerError(
-                        f"reference compatibility manifests disagree on {field}"
-                    )
+                if field in result:
+                    previous = result[field]
+                    if field == "fmod_output_device_bridge":
+                        input_fields = {
+                            "input_count_method_rva", "input_info_method_rva",
+                            "input_current_method_rva", "input_select_method_rva",
+                        }
+                        compatible = ((set(previous) ^ set(value)) <= input_fields and
+                            all(previous[key] == value[key]
+                                for key in previous.keys() & value.keys()))
+                        if compatible:
+                            value = {**previous, **value}
+                    else:
+                        compatible = previous == value
+                    if not compatible:
+                        raise AnalyzerError(
+                            f"reference compatibility manifests disagree on {field}"
+                        )
                result[field] = value
    return result

@@ -1329,12 +1380,13 @@ def derive_fmod_output_device_bridge(
    reference: ElfImage,
    candidate: ElfImage,
    source: dict[str, int],
-) -> dict[str, str]:
+) -> dict[str, Any]:
+    source_layout = source.get("vtable_layout_version", 1)
    indexes = {
        "count_method_rva": 5,
        "info_method_rva": 6,
-        "current_method_rva": 7,
-        "select_method_rva": 17,
+        "current_method_rva": 8 if source_layout == 2 else 7,
+        "select_method_rva": 19 if source_layout == 2 else 17,
    }
    source_vtable = source["vtable_rva"]
    reference.require_relro_rva(source_vtable, (max(indexes.values()) + 1) * 8)
@@ -1368,16 +1420,20 @@ def derive_fmod_output_device_bridge(
            minimum_anchor_bytes=3,
        ),
    ).rva
-    select_method = unique_semantic_signature_match(
-        reference,
-        candidate,
-        SignatureSpec(
-            "fmod-output-select",
-            source["select_method_rva"],
-            18,
-            minimum_anchor_bytes=3,
-        ),
-    ).rva
+    try:
+        select_method = unique_semantic_signature_match(
+            reference,
+            candidate,
+            SignatureSpec(
+                "fmod-output-select",
+                source["select_method_rva"],
+                18,
+                minimum_anchor_bytes=3,
+            ),
+        ).rva
+    except AnalyzerError:
+        # The device-list layout has a separately checked selector contract.
+        select_method = None
    count_candidates = {
        match.rva
        for match in find_signature_matches(
@@ -1416,32 +1472,35 @@ def derive_fmod_output_device_bridge(
            continue
        vtable = offset - indexes["info_method_rva"] * 8
        count_method = relocations.get(vtable + indexes["count_method_rva"] * 8)
-        current_method = relocations.get(
-            vtable + indexes["current_method_rva"] * 8
-        )
-        if (
-            vtable % 8 == 0
-            and count_method in count_candidates
-            and current_method in current_candidates
-            and count_method != current_method
-            and relocations.get(vtable + indexes["select_method_rva"] * 8)
-            == select_method
-        ):
+        for layout, current_index, select_index in ((1, 7, 17), (2, 8, 19)):
+            current_method = relocations.get(vtable + current_index * 8)
+            selected = relocations.get(vtable + select_index * 8)
+            if (
+                vtable % 8 != 0
+                or count_method not in count_candidates
+                or current_method not in current_candidates
+                or count_method == current_method
+                or selected is None
+            ):
+                continue
            try:
-                candidate.require_relro_rva(
-                    vtable, (max(indexes.values()) + 1) * 8
-                )
+                candidate.require_relro_rva(vtable, (select_index + 1) * 8)
            except AnalyzerError:
                continue
-            vtables.append((vtable, count_method, current_method))
+            if layout == 1:
+                if source_layout != 1 or select_method is None or selected != select_method:
+                    continue
+            elif not has_fmod_device_lists_select_contract(candidate, selected):
+                continue
+            vtables.append((vtable, count_method, current_method, selected, layout))
    if len(vtables) != 1:
        raise AnalyzerError(
            f"FMOD output vtable matched {len(vtables)} candidate locations"
        )
-    vtable, count_method, current_method = vtables[0]
+    vtable, count_method, current_method, select_method, layout = vtables[0]
    if not has_fmod_string_constructor_contract(candidate, string_constructor):
        raise AnalyzerError("candidate FMOD string constructor contract changed")
-    return {
+    result = {
        "vtable_rva": format_rva(vtable),
        "string_constructor_rva": format_rva(string_constructor),
        "count_method_rva": format_rva(count_method),
@@ -1449,6 +1508,33 @@ def derive_fmod_output_device_bridge(
        "current_method_rva": format_rva(current_method),
        "select_method_rva": format_rva(select_method),
    }
+    if layout != 1:
+        result["vtable_layout_version"] = layout
+    input_fields = (
+        "input_count_method_rva", "input_info_method_rva",
+        "input_current_method_rva", "input_select_method_rva",
+    )
+    if any(field in source for field in input_fields):
+        if not all(field in source for field in input_fields):
+            raise AnalyzerError("reference FMOD input profile is incomplete")
+        source_slots = (9, 10, 12, 18) if source_layout == 2 else (8, 9, 10, 16)
+        target_slots = (9, 10, 12, 18) if layout == 2 else (8, 9, 10, 16)
+        for field, old_slot, new_slot, length in zip(
+            input_fields, source_slots, target_slots, (4, 16, 12, 16)
+        ):
+            if reference_relocations.get(source_vtable + old_slot * 8) != source[field]:
+                raise AnalyzerError("reference FMOD input slot changed")
+            target = relocations.get(vtable + new_slot * 8)
+            matches = find_signature_matches(
+                reference, candidate,
+                SignatureSpec(field, source[field], length, minimum_anchor_bytes=3),
+                allow_multiple_candidates=True,
+            )
+            if target is None or target not in {match.rva for match in matches}:
+                raise AnalyzerError(f"candidate FMOD input contract changed: {field}")
+            candidate.require_code_rva(target)
+            result[field] = format_rva(target)
+    return result


 def derive_runtime_compatibility(
@@ -4,36 +4,131 @@

 set -Eeuo pipefail

-# The reduced packages are intentionally limited to the disposable builder.
-# Never replace a developer's desktop / graphics packages on the host.
-[[ -f /.dockerenv || -f /run/.containerenv ]] || {
-  printf 'AnyLinux dependency installation requires a disposable container\n' >&2
-  exit 1
-}
-[[ "$(id -u)" == 0 ]] || {
-  printf 'AnyLinux dependency installation requires container root\n' >&2
+AnyLinuxDependencyDie() {
+  printf '[anylinux-dependencies] error: %s\n' "$*" >&2
  exit 1
 }

-readonly ROOT="$(cd -P -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
-readonly MANIFEST="${ROOT}/packaging/anylinux-dependencies.sha256"
-readonly DOWNLOADS="$(mktemp -d "${TMPDIR:-/tmp}/mocktail-debloated.XXXXXX")"
-trap 'rm -rf -- "${DOWNLOADS}"' EXIT
-readonly BASE_URL=https://github.com/pkgforge-dev/archlinux-pkgs-debloated/releases/download/continuous
-declare -a packages=()
-while read -r digest filename remainder; do
-  [[ -n "${digest}" && "${digest}" != \#* ]] || continue
-  [[ "${digest}" =~ ^[0-9a-f]{64}$ &&
-     "${filename}" =~ ^[a-z0-9-]+-x86_64\.pkg\.tar\.zst$ &&
-     -z "${remainder}" ]] || {
-    printf 'Invalid AnyLinux dependency manifest entry\n' >&2
-    exit 1
-  }
-  curl --fail --location --retry 3 --output "${DOWNLOADS}/${filename}" \
-    "${BASE_URL}/${filename}"
-  printf '%s  %s\n' "${digest}" "${DOWNLOADS}/${filename}" |
-    sha256sum --check --strict
-  packages+=("${DOWNLOADS}/${filename}")
-done <"${MANIFEST}"
-(( ${#packages[@]} > 0 ))
-pacman -U --noconfirm --needed "${packages[@]}"
+AnyLinuxDependencyRequireContainer() {
+  # Never replace a developer's desktop / graphics packages on the host.
+  [[ -f /.dockerenv || -f /run/.containerenv ]] ||
+    AnyLinuxDependencyDie 'installation requires a disposable container'
+  [[ "$(id -u)" == 0 ]] ||
+    AnyLinuxDependencyDie 'installation requires container root'
+}
+
+AnyLinuxDependencySnapshot() {
+  local manifest="$1" release="$2" host_arch="${3:-$(uname -m)}"
+  local filename remainder names_json
+  [[ "${host_arch}" == x86_64 || "${host_arch}" == aarch64 ]] ||
+    AnyLinuxDependencyDie 'unsupported AppImage architecture'
+  local -a names=()
+  local -A seen=()
+  while read -r filename remainder || [[ -n "${filename}" ]]; do
+    [[ -n "${filename}" && "${filename}" != \#* ]] || continue
+    [[ "${filename}" =~ ^[a-z0-9-]+-mini-${host_arch}\.pkg\.tar\.(zst|xz)$ &&
+       -z "${remainder}" && -z "${seen[${filename}]:-}" ]] ||
+      AnyLinuxDependencyDie 'invalid or duplicate dependency manifest entry'
+    seen["${filename}"]=1
+    names+=("${filename}")
+  done <"${manifest}"
+  (( ${#names[@]} > 0 )) || AnyLinuxDependencyDie 'empty dependency manifest'
+  names_json="$(printf '%s\n' "${names[@]}" | jq --raw-input --slurp \
+    'split("\n")[:-1]')"
+
+  # continuous assets are replaced on upstream rebuilds. Resolve all required
+  # names and GitHub-computed digests in one response, then download by asset ID
+  # rather than by rolling filename. These are per-build integrity checks, not
+  # immutable version pins. Never accept absent digests or compute our own trust.
+  jq --exit-status --raw-output --argjson names "${names_json}" \
+    --arg base 'https://api.github.com/repos/pkgforge-dev/archlinux-pkgs-debloated/releases/assets/' '
+      (if .tag_name != "continuous" or (.assets | type) != "array" then
+        error("invalid continuous release metadata")
+      else .assets end) as $assets |
+      $names[] as $name |
+      [$assets[] | select(.name == $name)] as $matches |
+      if ($matches | length) != 1 then
+        error("missing or duplicate dependency asset: " + $name)
+      else $matches[0] end |
+      if .state != "uploaded" or (.id | type) != "number" or
+         .id <= 0 or .id != (.id | floor) or
+         (.digest | type) != "string" then
+        error("invalid dependency asset metadata: " + $name)
+      elif (.digest | test("^sha256:[0-9a-f]{64}$") | not) or
+           .url != ($base + (.id | tostring)) then
+        error("invalid dependency digest or URL: " + $name)
+      else
+        [(.digest | ltrimstr("sha256:")), $name, .url] | @tsv
+      end
+    ' "${release}" || AnyLinuxDependencyDie 'cannot resolve verified dependency assets'
+}
+
+AnyLinuxDownloadDependencies() {
+  local manifest="$1" downloads="$2" attempt digest filename url failed
+  local -a curl_options=(
+    --fail --silent --show-error --location --retry 3
+    --proto '=https' --proto-redir '=https'
+    --connect-timeout 15 --max-time 180
+    --header 'X-GitHub-Api-Version: 2022-11-28'
+  )
+  if [[ -n "${GH_TOKEN:-}" ]]; then
+    curl_options+=(--header "Authorization: Bearer ${GH_TOKEN}")
+  fi
+  for attempt in 1 2 3; do
+    curl "${curl_options[@]}" --header 'Accept: application/vnd.github+json' \
+      --output "${downloads}/release.json" \
+      https://api.github.com/repos/pkgforge-dev/archlinux-pkgs-debloated/releases/tags/continuous ||
+      AnyLinuxDependencyDie 'cannot fetch upstream release metadata'
+    AnyLinuxDependencySnapshot "${manifest}" "${downloads}/release.json" \
+      >"${downloads}/dependencies.tsv"
+    : >"${downloads}/SHA256SUMS"
+    failed=false
+    while IFS=$'\t' read -r digest filename url; do
+      printf '[anylinux-dependencies] downloading %s (SHA256 %s)\n' \
+        "${filename}" "${digest}" >&2
+      if ! curl "${curl_options[@]}" --header 'Accept: application/octet-stream' \
+          --output "${downloads}/${filename}" "${url}"; then
+        failed=true
+        break
+      fi
+      printf '%s  %s\n' "${digest}" "${filename}" >>"${downloads}/SHA256SUMS"
+    done <"${downloads}/dependencies.tsv"
+    if [[ "${failed}" == true ]]; then
+      # An upstream upload can delete an ID between resolution and download.
+      # Retry a complete snapshot, never mix old checksums with new filenames.
+      printf '[anylinux-dependencies] download failed; refreshing snapshot (%s/3)\n' \
+        "${attempt}" >&2
+      continue
+    fi
+    (cd -- "${downloads}" && sha256sum --check --strict SHA256SUMS) ||
+      AnyLinuxDependencyDie 'dependency checksum verification failed'
+    return 0
+  done
+  AnyLinuxDependencyDie 'dependency downloads failed after 3 snapshots'
+}
+
+AnyLinuxDependenciesMain() (
+  AnyLinuxDependencyRequireContainer
+  (( $# == 0 )) || AnyLinuxDependencyDie 'no arguments are supported'
+  readonly ROOT="$(cd -P -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
+  local host_arch="$(uname -m)" manifest_name
+  case "${host_arch}" in
+    x86_64) manifest_name=anylinux-dependencies.txt ;;
+    aarch64) manifest_name=anylinux-dependencies-aarch64.txt ;;
+    *) AnyLinuxDependencyDie "unsupported AppImage architecture: ${host_arch}" ;;
+  esac
+  readonly MANIFEST="${ROOT}/packaging/${manifest_name}"
+  readonly DOWNLOADS="$(mktemp -d "${TMPDIR:-/tmp}/mocktail-debloated.XXXXXX")"
+  trap 'rm -rf -- "${DOWNLOADS}"' EXIT
+  AnyLinuxDownloadDependencies "${MANIFEST}" "${DOWNLOADS}"
+  local digest filename url
+  local -a packages=()
+  while IFS=$'\t' read -r digest filename url; do
+    packages+=("${DOWNLOADS}/${filename}")
+  done <"${DOWNLOADS}/dependencies.tsv"
+  pacman -U --noconfirm --needed "${packages[@]}"
+)
+
+if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
+  AnyLinuxDependenciesMain "$@"
+fi
@@ -119,6 +119,7 @@ libyaml
 fontconfig
 minizip
 libplacebo
+libpng
 util-linux'
      INSTALL_ARGS='-S --needed --noconfirm'
      ;;
@@ -144,6 +145,7 @@ libyaml
 fontconfig
 minizip
 libplacebo
+libpng
 util-linux'
      if HostUsesMusl; then
        PACKAGES="$PACKAGES gcompat"
@@ -172,6 +174,7 @@ libyaml
 fontconfig
 minizip
 libplacebo
+libpng
 coreutils
 findutils
 util-linux'
@@ -1,127 +0,0 @@
-#!/usr/bin/env bash
-# Copyright 2026 Mocktail Project Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
-BUILD_DIR="${MOCKTAIL_BUILD_DIR:-${PROJECT_ROOT}/build}"
-BINARY="${BUILD_DIR}/mocktail"
-LIBROBLOX_PATH="${ROBLOX_LIB_PATH:-${PROJECT_ROOT}/rbx_bin/libroblox.so}"
-
-if [[ "${LIBROBLOX_PATH}" != /* ]]; then
-  LIBROBLOX_PATH="${PROJECT_ROOT}/${LIBROBLOX_PATH}"
-fi
-
-target_user_home() {
-  local user="$1"
-  local entry
-  entry="$(getent passwd "${user}" 2>/dev/null || true)"
-  if [[ -z "${entry}" ]]; then
-    return 1
-  fi
-  local name passwd uid gid gecos home shell
-  IFS=: read -r name passwd uid gid gecos home shell <<< "${entry}"
-  printf '%s\n' "${home}"
-}
-
-configure_wayland_env() {
-  local uid="$1"
-
-  export XDG_RUNTIME_DIR="${XDG_RUNTIME_DIR:-/run/user/${uid}}"
-  export WAYLAND_DISPLAY="${WAYLAND_DISPLAY:-wayland-0}"
-  export DBUS_SESSION_BUS_ADDRESS="${DBUS_SESSION_BUS_ADDRESS:-unix:path=${XDG_RUNTIME_DIR}/bus}"
-  export MOCKTAIL_PREFER_WAYLAND="${MOCKTAIL_PREFER_WAYLAND:-1}"
-
-  # Leave SDL_VIDEODRIVER unset so the runtime policy can avoid native
-  # Wayland Vulkan WSI on NVIDIA. Explicit caller overrides remain untouched.
-}
-
-if [[ ! -f "${LIBROBLOX_PATH}" ]]; then
-  echo "[error] libroblox.so not found: ${LIBROBLOX_PATH}" >&2
-  echo "        Put an x86_64 Roblox lib at rbx_bin/libroblox.so or set ROBLOX_LIB_PATH." >&2
-  exit 1
-fi
-
-if [[ ! -x "${BINARY}" ]]; then
-  cmake -S "${PROJECT_ROOT}" -B "${BUILD_DIR}" -DCMAKE_BUILD_TYPE=Debug
-  cmake --build "${BUILD_DIR}" -j"$(nproc)"
-fi
-
-cd "${PROJECT_ROOT}"
-
-export ROBLOX_LIB_PATH="${LIBROBLOX_PATH}"
-export MOCKTAIL_SOBER_MODE="${MOCKTAIL_SOBER_MODE:-1}"
-export MOCKTAIL_ASSET_ROOT="${MOCKTAIL_ASSET_ROOT:-${PROJECT_ROOT}/rbx_bin/assets}"
-export MOCKTAIL_ASSET_PATH="${MOCKTAIL_ASSET_PATH:-rbx_bin/assets/content}"
-export MOCKTAIL_SOBER_BOOTSTRAP_ONLY="${MOCKTAIL_SOBER_BOOTSTRAP_ONLY:-0}"
-export MOCKTAIL_GRAPHICS_BACKEND="${MOCKTAIL_GRAPHICS_BACKEND:-system}"
-
-RUN_AS_USER="${MOCKTAIL_RUN_AS_USER:-}"
-if [[ -n "${RUN_AS_USER}" && "${MOCKTAIL_RUNNER_REEXECED:-0}" == "0" &&
-      "$(id -un)" != "${RUN_AS_USER}" ]]; then
-  if [[ "$(id -u)" != "0" ]]; then
-    echo "[warn] not running as root; cannot switch GUI process to ${RUN_AS_USER}" >&2
-  elif ! id "${RUN_AS_USER}" >/dev/null 2>&1; then
-    echo "[warn] user not found: ${RUN_AS_USER}; running as $(id -un)" >&2
-  else
-    RUN_AS_UID="$(id -u "${RUN_AS_USER}")"
-    RUN_AS_HOME="$(target_user_home "${RUN_AS_USER}")"
-    configure_wayland_env "${RUN_AS_UID}"
-    echo "[info] switching GUI process to ${RUN_AS_USER} on ${WAYLAND_DISPLAY}"
-    exec runuser -u "${RUN_AS_USER}" -- env \
-      HOME="${RUN_AS_HOME}" \
-      USER="${RUN_AS_USER}" \
-      LOGNAME="${RUN_AS_USER}" \
-      XDG_RUNTIME_DIR="${XDG_RUNTIME_DIR}" \
-      WAYLAND_DISPLAY="${WAYLAND_DISPLAY}" \
-      DBUS_SESSION_BUS_ADDRESS="${DBUS_SESSION_BUS_ADDRESS}" \
-      SDL_VIDEODRIVER="${SDL_VIDEODRIVER:-}" \
-      MOCKTAIL_RUNNER_REEXECED=1 \
-      ROBLOX_LIB_PATH="${ROBLOX_LIB_PATH}" \
-      MOCKTAIL_BUILD_DIR="${BUILD_DIR}" \
-      MOCKTAIL_SOBER_MODE="${MOCKTAIL_SOBER_MODE}" \
-      MOCKTAIL_ASSET_ROOT="${MOCKTAIL_ASSET_ROOT}" \
-      MOCKTAIL_ASSET_PATH="${MOCKTAIL_ASSET_PATH}" \
-      MOCKTAIL_SOBER_BOOTSTRAP_ONLY="${MOCKTAIL_SOBER_BOOTSTRAP_ONLY}" \
-      MOCKTAIL_GRAPHICS_BACKEND="${MOCKTAIL_GRAPHICS_BACKEND}" \
-      MOCKTAIL_PREFER_WAYLAND="${MOCKTAIL_PREFER_WAYLAND}" \
-      MOCKTAIL_EGL_LIBRARY="${MOCKTAIL_EGL_LIBRARY:-}" \
-      MOCKTAIL_GLES_LIBRARY="${MOCKTAIL_GLES_LIBRARY:-}" \
-      MOCKTAIL_FORCE_X11="${MOCKTAIL_FORCE_X11:-0}" \
-      MOCKTAIL_ANGLE_FORCE_X11="${MOCKTAIL_ANGLE_FORCE_X11:-0}" \
-      "${BASH}" "${BASH_SOURCE[0]}" "$@"
-  fi
-fi
-
-if [[ -n "${RUN_AS_USER}" && "$(id -un)" == "${RUN_AS_USER}" ]]; then
-  configure_wayland_env "$(id -u)"
-fi
-
-if [[ "${MOCKTAIL_SOBER_BOOTSTRAP_ONLY}" != "0" ]]; then
-  export MOCKTAIL_STEP_APP_BRIDGE_APP_START="${MOCKTAIL_STEP_APP_BRIDGE_APP_START:-0}"
-  export MOCKTAIL_STEP_START_LUA_APP_DM="${MOCKTAIL_STEP_START_LUA_APP_DM:-0}"
-fi
-
-echo "[info] starting Mocktail"
-echo "[info] SDL video driver: ${SDL_VIDEODRIVER:-auto}"
-echo "[info] graphics backend: ${MOCKTAIL_GRAPHICS_BACKEND}"
-echo "[info] display: DISPLAY=${DISPLAY:-unset} WAYLAND_DISPLAY=${WAYLAND_DISPLAY:-unset}"
-echo "[info] bootstrap-only: ${MOCKTAIL_SOBER_BOOTSTRAP_ONLY}"
-echo "[info] press Ctrl+C to stop"
-
-if [[ -n "${MOCKTAIL_LOG_PATH:-}" ]]; then
-  set +e
-  "${BINARY}" "$@" 2>&1 | tee "${MOCKTAIL_LOG_PATH}"
-  binary_status="${PIPESTATUS[0]}"
-  set -e
-  exit "${binary_status}"
-fi
-
-exec "${BINARY}" "$@"
@@ -110,8 +110,14 @@ for elf in "$@"; do
  fi
  machine="$(LC_ALL=C readelf --file-header "${elf}" 2>/dev/null |
    sed -n 's/^[[:space:]]*Machine:[[:space:]]*//p')"
-  if [[ "${machine}" != *X86-64* ]]; then
-    printf 'ABI check: %s is not x86-64 (%s)\n' "${elf}" "${machine}" >&2
+  case "$(uname -m)" in
+    x86_64) expected_machine='X86-64' ;;
+    aarch64) expected_machine='AArch64' ;;
+    *) expected_machine='X86-64' ;;
+  esac
+  if [[ "${machine}" != *"${expected_machine}"* ]]; then
+    printf 'ABI check: %s is not %s (%s)\n' "${elf}" "${expected_machine}" \
+      "${machine}" >&2
    status=1
  fi

@@ -10,7 +10,7 @@
 <body><main>
  <img src="../packaging/space.bigrat.mocktail.svg" alt="Mocktail logo">
  <h1>Mocktail</h1>
-  <p>Play Roblox on Linux. Use the stable Flathub release, or try the latest nightly build from main.</p>
+  <p>Play Roblox on Linux. Use the stable Flathub release, or try the latest nightly build from main. Nightly Flatpaks are available for x86_64 and aarch64; Roblox runtime support on aarch64 is experimental.</p>
  <a class="button" href="https://flathub.org/apps/space.bigrat.mocktail">Stable on Flathub</a>
  <a class="button secondary" href="https://mocktail.bigrat.space/mocktail.flatpakref">Nightly build</a>
  <div class="commands">
@@ -19,6 +19,10 @@
    <p>Nightly</p>
    <code>flatpak install --user https://mocktail.bigrat.space/mocktail.flatpakref</code>
  </div>
+  <p class="links">
+    <a href="Mocktail-x86_64.flatpak">x86_64 nightly Flatpak</a>
+    <a href="Mocktail-aarch64.flatpak">aarch64 nightly Flatpak</a>
+  </p>
  <h2>AUR packages</h2>
  <p>Available from the AUR. Choose one package:</p>
  <p class="links">
@@ -51,7 +55,7 @@ sudo apt update</code>
    <code>sudo apt install mocktail-nightly</code>
  </div>
  <h2>Direct downloads</h2>
-  <p>Prebuilt packages for Linux x86_64.</p>
+  <p>Prebuilt Linux packages. DEB and RPM are for x86_64; the nightly AppImage also has an aarch64 build.</p>
  <p class="download-label">Stable</p>
  <p class="links">
    <a href="https://github.com/komaruworld/mocktail/releases/latest/download/Mocktail-x86_64.AppImage">AppImage</a>
@@ -60,7 +64,8 @@ sudo apt update</code>
  </p>
  <p class="download-label">Nightly</p>
  <p class="links">
-    <a href="https://github.com/komaruworld/mocktail/releases/download/continuous/mocktail-nightly.AppImage">AppImage</a>
+    <a href="https://github.com/komaruworld/mocktail/releases/download/continuous/mocktail-nightly.AppImage">AppImage (x86_64)</a>
+    <a href="https://github.com/komaruworld/mocktail/releases/download/continuous/mocktail-nightly-aarch64.AppImage">AppImage (aarch64)</a>
    <a href="https://github.com/komaruworld/mocktail/releases/download/continuous/mocktail-nightly.deb">DEB</a>
    <a href="https://github.com/komaruworld/mocktail/releases/download/continuous/mocktail-nightly.rpm">RPM</a>
  </p>
@@ -0,0 +1,225 @@
+#ifndef MOCKTAIL_AUDIO_NATIVE_INPUT_CAPTURE_H_
+#define MOCKTAIL_AUDIO_NATIVE_INPUT_CAPTURE_H_
+
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+#include <map>
+#include <memory>
+#include <mutex>
+#include <vector>
+
+#include "mocktail/audio/sdl_audio_capture.h"
+
+namespace mocktail::audio {
+class NativeInputCapture;
+
+struct NativePcmFormat {
+  std::uint32_t rate = 48000;
+  std::uint8_t channels = 1;
+  std::uint8_t bytes_per_sample = 2;
+  std::uint8_t flags = 0;
+  std::uint8_t padding = 0;
+};
+struct NativeOptionalFormat {
+  NativePcmFormat format{};
+  std::uint64_t present = 0;
+};
+struct NativeSharedSink { void* object; void* owner; };
+static_assert(sizeof(NativeOptionalFormat) == 16);
+static_assert(sizeof(NativePcmFormat) == 8);
+inline std::atomic<NativeInputCapture*> g_native_capture{nullptr};
+
+class NativeInputCapture {
+ public:
+  using DeliverPcm = std::size_t (*)(void*, const void*, std::size_t,
+                                    std::uint64_t, const NativePcmFormat*);
+  using Destroy = void (*)(NativeSharedSink*);
+  using OriginalLatency = void (*)(void*, std::uint32_t*, std::uint32_t*);
+  struct SinkAbi {
+    std::uintptr_t vtable;
+    DeliverPcm deliver;
+    Destroy release;
+    OriginalLatency latency;
+  };
+  NativeInputCapture(SinkAbi abi, bool enabled)
+      : abi_(abi), enabled_(enabled) {}
+  ~NativeInputCapture() { Shutdown(); }
+
+  static NativeOptionalFormat Format(void*) {
+    auto* capture = g_native_capture.load(std::memory_order_acquire);
+    return {{}, capture && capture->enabled_ ? 1ULL : 0ULL};
+  }
+  static void Latency(void* self, std::uint32_t* playback,
+                      std::uint32_t* recording) {
+    // Preserve the native playback latency and report the host capture queue.
+    auto* capture = g_native_capture.load(std::memory_order_acquire);
+    if (!capture) return;
+    capture->abi_.latency(self, playback, recording);
+    if (recording) {
+      std::lock_guard lock(capture->mutex_);
+      *recording = 10;
+      auto it = capture->sessions_.find(self);
+      if (it != capture->sessions_.end()) {
+        std::lock_guard queue_lock(it->second->queue_mutex);
+        *recording += static_cast<std::uint32_t>(it->second->count * 10);
+      }
+    }
+  }
+  static bool Start(void* self, NativeSharedSink* sink) {
+    auto* capture = g_native_capture.load(std::memory_order_acquire);
+    return capture && capture->StartSink(self, sink);
+  }
+  static void Stop(void* self, NativeSharedSink* sink) {
+    auto* capture = g_native_capture.load(std::memory_order_acquire);
+    if (capture) capture->StopSink(self, sink);
+  }
+  static bool Recording(void* self) {
+    auto* capture = g_native_capture.load(std::memory_order_acquire);
+    if (!capture) return false;
+    std::lock_guard lock(capture->mutex_);
+    return capture->sessions_.find(self) != capture->sessions_.end();
+  }
+  static void Poll(void* self) {
+    auto* capture = g_native_capture.load(std::memory_order_acquire);
+    if (capture) capture->Deliver(self);
+  }
+  void Shutdown() {
+    std::lock_guard lock(mutex_);
+    for (auto& [self, session] : sessions_) Close(*session);
+    sessions_.clear();
+  }
+
+ private:
+  struct Session {
+    std::unique_ptr<AudioCapture> input;
+    std::vector<NativeSharedSink> sinks;
+    std::mutex queue_mutex;
+    // At most 200 ms; a stalled consumer must not accumulate stale speech.
+    std::array<std::array<std::int16_t, 480>, 20> frames{};
+    std::size_t head = 0, count = 0;
+    std::uint64_t delivered = 0, dropped = 0;
+    bool audible = false;
+  };
+  static void OnData(void* context, std::size_t bytes) {
+    auto& session = *static_cast<Session*>(context);
+    if (bytes != sizeof(session.frames[0])) return;
+    std::lock_guard lock(session.queue_mutex);
+    if (session.count == session.frames.size()) {
+      session.head = (session.head + 1) % session.frames.size();
+      --session.count;
+      ++session.dropped;
+    }
+    std::memcpy(session.frames[(session.head + session.count) %
+                                  session.frames.size()].data(),
+                session.input->buffer_data(), bytes);
+    ++session.count;
+  }
+  bool StartSink(void* self, NativeSharedSink* sink) {
+    std::lock_guard lock(mutex_);
+    if (!enabled_ || !self || !sink || !sink->object || !sink->owner)
+      return false;
+    auto* table = *reinterpret_cast<std::uintptr_t**>(sink->object);
+    if (reinterpret_cast<std::uintptr_t>(table) != abi_.vtable ||
+        table[2] != reinterpret_cast<std::uintptr_t>(abi_.deliver)) {
+      std::fprintf(stderr, "  [audio-input] unsupported native PCM sink ABI\n");
+      return false;
+    }
+    auto it = sessions_.find(self);
+    if (it != sessions_.end()) {
+      for (const auto& existing : it->second->sinks)
+        if (existing.object == sink->object) return true;
+    } else {
+      auto session = std::make_unique<Session>();
+      SdlAudioCaptureOptions options;
+      options.output_spec.channels = 1;
+      options.data_callback = &OnData;
+      options.data_context = session.get();
+      auto status = CreateSdlAudioCapture(options, &session->input);
+      if (status.ok()) status = session->input->Start();
+      if (!status.ok()) {
+        std::fprintf(stderr, "  [audio-input] capture start failed: %s\n",
+                     status.message().c_str());
+        return false;
+      }
+      it = sessions_.emplace(self, std::move(session)).first;
+      std::fprintf(stderr,
+          "  [audio-input] native capture started: 48000 Hz mono signed16\n");
+    }
+    // The native parameter is a by-value shared_ptr. Retain its existing
+    // ownership by moving it, leaving the caller's temporary empty.
+    it->second->sinks.push_back(*sink);
+    *sink = {};
+    return true;
+  }
+  void Release(NativeSharedSink& sink) {
+    abi_.release(&sink);
+    sink = {};
+  }
+  void Close(Session& session) {
+    session.input->Shutdown();
+    for (auto& sink : session.sinks) Release(sink);
+    session.sinks.clear();
+    std::fprintf(stderr,
+        "  [audio-input] native capture stopped: delivered=%llu dropped=%llu\n",
+        static_cast<unsigned long long>(session.delivered),
+        static_cast<unsigned long long>(session.dropped));
+  }
+  void StopSink(void* self, NativeSharedSink* sink) {
+    std::lock_guard lock(mutex_);
+    auto it = sessions_.find(self);
+    if (it == sessions_.end() || !sink) return;
+    auto& session = *it->second;
+    auto existing = std::find_if(session.sinks.begin(), session.sinks.end(),
+        [&](const auto& entry) { return entry.object == sink->object; });
+    if (existing == session.sinks.end()) return;
+    Release(*existing);
+    session.sinks.erase(existing);
+    if (session.sinks.empty()) {
+      Close(session);
+      sessions_.erase(it);
+    }
+  }
+  void Deliver(void* self) {
+    // Invoked by Roblox's recording thread. Guest code and allocator TLS must
+    // never run on SDL's capture callback thread.
+    std::lock_guard lock(mutex_);
+    auto it = sessions_.find(self);
+    if (it == sessions_.end()) return;
+    auto& session = *it->second;
+    for (std::size_t n = 0; n < session.frames.size(); ++n) {
+      std::array<std::int16_t, 480> pcm;
+      std::uint64_t delay;
+      {
+        std::lock_guard queue_lock(session.queue_mutex);
+        if (!session.count) break;
+        pcm = session.frames[session.head];
+        delay = session.count * 10000000ULL;
+        session.head = (session.head + 1) % session.frames.size();
+        --session.count;
+      }
+      const NativePcmFormat format;
+      for (const auto& sink : session.sinks)
+        abi_.deliver(
+            sink.object, pcm.data(), pcm.size(), delay, &format);
+      if (++session.delivered == 1)
+        std::fprintf(stderr, "  [audio-input] PCM delivered to native voice sink\n");
+      if (!session.audible && std::any_of(pcm.begin(), pcm.end(),
+                                        [](auto value) { return value != 0; })) {
+        session.audible = true;
+        std::fprintf(stderr, "  [audio-input] nonzero microphone PCM delivered\n");
+      }
+    }
+  }
+  SinkAbi abi_;
+  bool enabled_;
+  std::mutex mutex_;
+  std::map<void*, std::unique_ptr<Session>> sessions_;
+};
+
+
+}  // namespace mocktail::audio
+#endif
@@ -12,6 +12,7 @@
 #include <cstddef>
 #include <cstdint>
 #include <cstdio>
+#include <cstdlib>
 #include <cstring>
 #include <limits>
 #include <string>
@@ -20,7 +21,9 @@
 #include <vector>

 #include "audio/roblox_output_device_bridge_internal.h"
+#include "audio/native_input_capture.h"
 #include "linker/linker.h"
+#include "mocktail/audio/sdl_audio_capture.h"
 #include "mocktail/audio/sdl_audio_sink.h"

 namespace mocktail::audio {
@@ -28,8 +31,6 @@ namespace {

 constexpr std::size_t kOutputCountVtableIndex = 5;
 constexpr std::size_t kOutputInfoVtableIndex = 6;
-constexpr std::size_t kCurrentOutputVtableIndex = 7;
-constexpr std::size_t kSelectOutputVtableIndex = 17;
 constexpr std::size_t kGuestStringSize = 24;
 constexpr std::size_t kGuestDeviceInfoSize = kGuestStringSize * 2 + 1;
 constexpr std::size_t kStringConstructorContractSize = 24;
@@ -94,7 +95,8 @@ bool IsRelroImageRange(std::uintptr_t image_base, std::uintptr_t rva,
  return IsProgramHeaderRange(image_base, rva, size, PT_GNU_RELRO, 0);
 }

-bool SetVtableWritable(std::uintptr_t* vtable, bool writable) {
+bool SetVtableWritable(std::uintptr_t* vtable, std::size_t select_index,
+                       bool writable) {
  if (vtable == nullptr) {
    return false;
  }
@@ -104,9 +106,9 @@ bool SetVtableWritable(std::uintptr_t* vtable, bool writable) {
  }
  const std::uintptr_t page_size = static_cast<std::uintptr_t>(page_size_value);
  const std::uintptr_t first =
-      reinterpret_cast<std::uintptr_t>(vtable + kOutputCountVtableIndex);
+      reinterpret_cast<std::uintptr_t>(vtable + 4);
  const std::uintptr_t last =
-      reinterpret_cast<std::uintptr_t>(vtable + kSelectOutputVtableIndex + 1);
+      reinterpret_cast<std::uintptr_t>(vtable + select_index + 1);
  if (last <= first) {
    return false;
  }
@@ -128,6 +130,16 @@ std::uintptr_t FunctionAddress(Function function) {

 }  // namespace

+// ABI verified for Roblox 2.738.1397. Keep capture separate from the menu
+// profile: relocating query methods alone does not establish a recording ABI.
+namespace {
+constexpr std::array<std::size_t, 6> kCaptureSlots{4, 13, 14, 15, 16, 17};
+constexpr std::array<std::uintptr_t, 6> kCaptureRvas{
+    0x320c630, 0x320bcf6, 0x320d4b4, 0x320dd94, 0x320b844, 0x320e49a};
+}  // namespace
+
+RobloxOutputDeviceBridge::RobloxOutputDeviceBridge() = default;
+
 namespace internal {

 bool HasExpectedFmodStringConstructorContract(const std::uint8_t* code,
@@ -145,8 +157,19 @@ bool HasExpectedFmodStringConstructorContract(const std::uint8_t* code,
 bool HasExpectedFmodOutputDeviceVtable(
    const std::uintptr_t* vtable, std::uintptr_t image_base,
    const compat::FmodOutputDeviceBridgeProfile& profile) {
-  return vtable != nullptr && image_base != 0 &&
-         vtable[kOutputCountVtableIndex] ==
+  const std::size_t kCurrentOutputVtableIndex = profile.current_vtable_index();
+  const std::size_t kSelectOutputVtableIndex = profile.select_vtable_index();
+  if (vtable == nullptr || image_base == 0 || !profile.valid_vtable_layout())
+    return false;
+  if (profile.has_input_devices()) {
+    const auto indexes = profile.input_vtable_indexes();
+    for (std::size_t i = 0; i < indexes.size(); ++i) {
+      if (profile.input_method_rvas[i] == 0 ||
+          vtable[indexes[i]] != image_base + profile.input_method_rvas[i])
+        return false;
+    }
+  }
+  return vtable[kOutputCountVtableIndex] ==
             image_base + profile.count_method_rva &&
         vtable[kOutputInfoVtableIndex] ==
             image_base + profile.info_method_rva &&
@@ -191,6 +214,9 @@ Status RobloxOutputDeviceBridge::Install(const compat::BuildProfile& profile) {
    return FailedPrecondition(
        "FMOD output-device profile requires host ABI bridges");
  }
+  if (!profile.fmod_output_device_bridge->valid_vtable_layout()) {
+    return FailedPrecondition("unsupported FMOD output-device vtable layout");
+  }

  RobloxOutputDeviceBridge* expected = nullptr;
  if (!g_active_bridge.compare_exchange_strong(expected, this,
@@ -200,6 +226,10 @@ Status RobloxOutputDeviceBridge::Install(const compat::BuildProfile& profile) {
        "another Roblox output-device bridge owns the process");
  }
  profile_ = *profile.fmod_output_device_bridge;
+  capture_profile_supported_ =
+      profile.elf_build_id == "5f0704edd9064f566ee3d6df2bd2fabbcc709f03" &&
+      profile_.vtable_rva == 0x6cd3ce0 &&
+      profile_.vtable_layout_version == 2 && profile_.has_input_devices();
  if (!linker::SetAndroidLibraryLoadObserver(&ObserveAndroidLibrary, this)) {
    g_active_bridge.store(nullptr, std::memory_order_release);
    profile_ = {};
@@ -225,8 +255,12 @@ void RobloxOutputDeviceBridge::Shutdown() {
                   "  [audio-menu] failed to restore FmodAudioDevice "
                   "vtable protection\n");
    }
+    g_native_capture.store(nullptr, std::memory_order_release);
+    capture_.reset();
    active_ = false;
    devices_.clear();
+    input_devices_.clear();
+    selected_input_index_ = 0;
    string_constructor_ = nullptr;
    library_base_ = 0;
    vtable_ = nullptr;
@@ -318,6 +352,37 @@ Status RobloxOutputDeviceBridge::Activate(std::uintptr_t image_base) {
    return FailedPrecondition("configured SDL audio output disappeared");
  }

+  input_devices_.clear();
+  selected_input_index_ = 0;
+  const char *input_target = std::getenv("MOCKTAIL_AUDIO_INPUT_DEVICE");
+  if (profile_.has_input_devices() &&
+      (input_target == nullptr ||
+       std::string_view(input_target) != "disabled")) {
+    std::vector<SdlRecordingDevice> recording_devices;
+    status = ListSdlRecordingDevices(&recording_devices);
+    if (!status.ok())
+      return status;
+    if (recording_devices.size() + 1 > kMaximumMenuDevices)
+      return InvalidArgument("host exposes too many audio input devices");
+    std::uint32_t selected = 0;
+    std::string selected_name;
+    status = GetConfiguredSdlRecordingDevice(&selected, &selected_name);
+    if (!status.ok())
+      return status;
+    input_devices_.push_back({0, "System Default", "mocktail:input:default"});
+    for (const auto &device : recording_devices) {
+      if (device.name.empty() || device.name.size() > kMaximumDeviceNameBytes)
+        return InvalidArgument("SDL audio input name is empty or too long");
+      input_devices_.push_back(
+          {device.id, device.name,
+           "input:" + internal::MakeOutputDeviceGuid(device.id, device.name)});
+      if (device.id == selected)
+        selected_input_index_ = static_cast<int>(input_devices_.size() - 1);
+    }
+    if (selected != 0 && selected_input_index_ == 0)
+      return FailedPrecondition("configured SDL audio input disappeared");
+  }
+
  library_base_ = image_base;
  vtable_ = reinterpret_cast<std::uintptr_t*>(image_base + profile_.vtable_rva);
  string_constructor_ =
@@ -325,6 +390,8 @@ Status RobloxOutputDeviceBridge::Activate(std::uintptr_t image_base) {
  status = PatchVtableLocked();
  if (!status.ok()) {
    devices_.clear();
+    input_devices_.clear();
+    selected_input_index_ = 0;
    string_constructor_ = nullptr;
    library_base_ = 0;
    vtable_ = nullptr;
@@ -338,19 +405,29 @@ Status RobloxOutputDeviceBridge::Activate(std::uintptr_t image_base) {
  for (const MenuDevice& device : devices_) {
    std::fprintf(stderr, "    [audio-menu] %s\n", device.name.c_str());
  }
+  if (profile_.has_input_devices()) {
+    std::fprintf(stderr,
+                 "  [audio-menu] exposed %zu host input routes; selected=%s\n",
+                 input_devices_.size(),
+                 input_devices_.empty()
+                     ? "disabled"
+                     : input_devices_[selected_input_index_].name.c_str());
+  }
  return Status::Ok();
 }

 Status RobloxOutputDeviceBridge::PatchVtableLocked() {
+  const std::size_t kCurrentOutputVtableIndex = profile_.current_vtable_index();
+  const std::size_t kSelectOutputVtableIndex = profile_.select_vtable_index();
  if (profile_.vtable_rva >
      std::numeric_limits<std::uintptr_t>::max() -
          (kSelectOutputVtableIndex + 1) * sizeof(std::uintptr_t)) {
    return FailedPrecondition("FMOD output-device vtable range overflows");
  }
  const std::uintptr_t first_slot_rva =
-      profile_.vtable_rva + kOutputCountVtableIndex * sizeof(std::uintptr_t);
+      profile_.vtable_rva + 4 * sizeof(std::uintptr_t);
  const std::size_t slot_range_size =
-      (kSelectOutputVtableIndex - kOutputCountVtableIndex + 1) *
+      (kSelectOutputVtableIndex - 4 + 1) *
      sizeof(std::uintptr_t);
  if (!IsRelroImageRange(library_base_, first_slot_rva, slot_range_size) ||
      !IsExecutableImageRange(library_base_, profile_.string_constructor_rva,
@@ -362,6 +439,15 @@ Status RobloxOutputDeviceBridge::PatchVtableLocked() {
    return FailedPrecondition(
        "FMOD output-device profile points outside verified image ranges");
  }
+  if (profile_.has_input_devices()) {
+    for (const auto rva : profile_.input_method_rvas) {
+      if (rva == 0 ||
+          rva > std::numeric_limits<std::uintptr_t>::max() - library_base_ ||
+          !IsExecutableImageRange(library_base_, rva, 1))
+        return FailedPrecondition(
+            "FMOD input profile points outside executable image");
+    }
+  }
  if (!internal::HasExpectedFmodOutputDeviceVtable(vtable_, library_base_,
                                                   profile_)) {
    return FailedPrecondition(
@@ -375,13 +461,41 @@ Status RobloxOutputDeviceBridge::PatchVtableLocked() {
        "FmodAudioDevice string ABI contract validation failed");
  }

+  if (capture_profile_supported_) {
+    for (std::size_t i = 0; i < kCaptureSlots.size(); ++i) {
+      if (!IsExecutableImageRange(library_base_, kCaptureRvas[i], 1) ||
+          vtable_[kCaptureSlots[i]] != library_base_ + kCaptureRvas[i])
+        return FailedPrecondition("native input capture vtable ABI mismatch");
+      original_capture_methods_[i] = vtable_[kCaptureSlots[i]];
+    }
+    if (!IsExecutableImageRange(library_base_, 0x3213154, 1) ||
+        !IsExecutableImageRange(library_base_, 0x1dc4cd0, 1) ||
+        !IsRelroImageRange(library_base_, 0x6cd4550, 24))
+      return FailedPrecondition("native input capture sink ABI outside image");
+    capture_ = std::make_unique<NativeInputCapture>(
+        NativeInputCapture::SinkAbi{
+            library_base_ + 0x6cd4550,
+            reinterpret_cast<NativeInputCapture::DeliverPcm>(
+                library_base_ + 0x3213154),
+            reinterpret_cast<NativeInputCapture::Destroy>(
+                library_base_ + 0x1dc4cd0),
+            reinterpret_cast<NativeInputCapture::OriginalLatency>(
+                library_base_ + kCaptureRvas[1])},
+        !input_devices_.empty());
+  }
+
  original_methods_ = {
      vtable_[kOutputCountVtableIndex],
      vtable_[kOutputInfoVtableIndex],
      vtable_[kCurrentOutputVtableIndex],
      vtable_[kSelectOutputVtableIndex],
  };
-  if (!SetVtableWritable(vtable_, true)) {
+  if (profile_.has_input_devices()) {
+    const auto indexes = profile_.input_vtable_indexes();
+    for (std::size_t i = 0; i < indexes.size(); ++i)
+      original_methods_[4 + i] = vtable_[indexes[i]];
+  }
+  if (!SetVtableWritable(vtable_, kSelectOutputVtableIndex, true)) {
    return Status::Error(StatusCode::kPlatformError,
                         "cannot make FmodAudioDevice vtable writable");
  }
@@ -394,7 +508,29 @@ Status RobloxOutputDeviceBridge::PatchVtableLocked() {
                   FunctionAddress(&GetCurrentOutputDevice), __ATOMIC_RELEASE);
  __atomic_store_n(&vtable_[kSelectOutputVtableIndex],
                   FunctionAddress(&SetCurrentOutputDevice), __ATOMIC_RELEASE);
-  if (!SetVtableWritable(vtable_, false)) {
+  if (profile_.has_input_devices()) {
+    const auto indexes = profile_.input_vtable_indexes();
+    const std::array<std::uintptr_t, 4> methods = {
+        FunctionAddress(&GetInputDeviceCount),
+        FunctionAddress(&GetInputDeviceInfo),
+        FunctionAddress(&GetCurrentInputDevice),
+        FunctionAddress(&SetCurrentInputDevice)};
+    for (std::size_t i = 0; i < indexes.size(); ++i)
+      __atomic_store_n(&vtable_[indexes[i]], methods[i], __ATOMIC_RELEASE);
+  }
+  if (capture_) {
+    g_native_capture.store(capture_.get(), std::memory_order_release);
+    const std::array<std::uintptr_t, 6> methods{
+        FunctionAddress(&NativeInputCapture::Format),
+        FunctionAddress(&NativeInputCapture::Latency),
+        FunctionAddress(&NativeInputCapture::Start),
+        FunctionAddress(&NativeInputCapture::Stop),
+        FunctionAddress(&NativeInputCapture::Poll),
+        FunctionAddress(&NativeInputCapture::Recording)};
+    for (std::size_t i = 0; i < kCaptureSlots.size(); ++i)
+      __atomic_store_n(&vtable_[kCaptureSlots[i]], methods[i], __ATOMIC_RELEASE);
+  }
+  if (!SetVtableWritable(vtable_, kSelectOutputVtableIndex, false)) {
    __atomic_store_n(&vtable_[kOutputCountVtableIndex], original_methods_[0],
                     __ATOMIC_RELEASE);
    __atomic_store_n(&vtable_[kOutputInfoVtableIndex], original_methods_[1],
@@ -403,7 +539,20 @@ Status RobloxOutputDeviceBridge::PatchVtableLocked() {
                     __ATOMIC_RELEASE);
    __atomic_store_n(&vtable_[kSelectOutputVtableIndex], original_methods_[3],
                     __ATOMIC_RELEASE);
-    (void)SetVtableWritable(vtable_, false);
+    if (profile_.has_input_devices()) {
+      const auto indexes = profile_.input_vtable_indexes();
+      for (std::size_t i = 0; i < indexes.size(); ++i)
+        __atomic_store_n(&vtable_[indexes[i]], original_methods_[4 + i],
+                         __ATOMIC_RELEASE);
+    }
+    if (capture_) {
+      for (std::size_t i = 0; i < kCaptureSlots.size(); ++i)
+        __atomic_store_n(&vtable_[kCaptureSlots[i]], original_capture_methods_[i],
+                         __ATOMIC_RELEASE);
+      g_native_capture.store(nullptr, std::memory_order_release);
+      capture_.reset();
+    }
+    (void)SetVtableWritable(vtable_, kSelectOutputVtableIndex, false);
    return Status::Error(StatusCode::kPlatformError,
                         "cannot restore FmodAudioDevice RELRO protection");
  }
@@ -411,7 +560,10 @@ Status RobloxOutputDeviceBridge::PatchVtableLocked() {
 }

 bool RobloxOutputDeviceBridge::RestoreVtableLocked() {
-  if (vtable_ == nullptr || !SetVtableWritable(vtable_, true)) {
+  const std::size_t kCurrentOutputVtableIndex = profile_.current_vtable_index();
+  const std::size_t kSelectOutputVtableIndex = profile_.select_vtable_index();
+  if (vtable_ == nullptr ||
+      !SetVtableWritable(vtable_, kSelectOutputVtableIndex, true)) {
    return false;
  }
  __atomic_store_n(&vtable_[kOutputCountVtableIndex], original_methods_[0],
@@ -422,7 +574,18 @@ bool RobloxOutputDeviceBridge::RestoreVtableLocked() {
                   __ATOMIC_RELEASE);
  __atomic_store_n(&vtable_[kSelectOutputVtableIndex], original_methods_[3],
                   __ATOMIC_RELEASE);
-  return SetVtableWritable(vtable_, false);
+  if (profile_.has_input_devices()) {
+    const auto indexes = profile_.input_vtable_indexes();
+    for (std::size_t i = 0; i < indexes.size(); ++i)
+      __atomic_store_n(&vtable_[indexes[i]], original_methods_[4 + i],
+                       __ATOMIC_RELEASE);
+  }
+  if (capture_) {
+    for (std::size_t i = 0; i < kCaptureSlots.size(); ++i)
+      __atomic_store_n(&vtable_[kCaptureSlots[i]], original_capture_methods_[i],
+                       __ATOMIC_RELEASE);
+  }
+  return SetVtableWritable(vtable_, kSelectOutputVtableIndex, false);
 }

 int RobloxOutputDeviceBridge::GetOutputDeviceCount(void* self) {
@@ -462,22 +625,51 @@ void RobloxOutputDeviceBridge::SetCurrentOutputDevice(void* self, int index) {
  }
 }

-int RobloxOutputDeviceBridge::DeviceCount() {
-  std::lock_guard<std::mutex> lock(mutex_);
-  return active_ ? static_cast<int>(devices_.size()) : 0;
+int RobloxOutputDeviceBridge::GetInputDeviceCount(void *) {
+  auto *bridge = g_active_bridge.load(std::memory_order_acquire);
+  return bridge ? bridge->DeviceCount(true) : 0;
 }

-void* RobloxOutputDeviceBridge::DeviceInfo(void* result, int index) {
+void *RobloxOutputDeviceBridge::GetInputDeviceInfo(void *result, void *,
+                                                   int index) {
+  auto *bridge = g_active_bridge.load(std::memory_order_acquire);
+  if (bridge)
+    return bridge->DeviceInfo(result, index, true);
+  if (result)
+    std::memset(result, 0, kGuestDeviceInfoSize);
+  return result;
+}
+
+int RobloxOutputDeviceBridge::GetCurrentInputDevice(void *) {
+  auto *bridge = g_active_bridge.load(std::memory_order_acquire);
+  return bridge ? bridge->CurrentDevice(true) : 0;
+}
+
+void RobloxOutputDeviceBridge::SetCurrentInputDevice(void *, int index) {
+  auto *bridge = g_active_bridge.load(std::memory_order_acquire);
+  if (bridge)
+    bridge->SelectDevice(index, true);
+}
+
+int RobloxOutputDeviceBridge::DeviceCount(bool input) {
+  const auto &devices = input ? input_devices_ : devices_;
+  std::lock_guard<std::mutex> lock(mutex_);
+  return active_ ? static_cast<int>(devices.size()) : 0;
+}
+
+void *RobloxOutputDeviceBridge::DeviceInfo(void *result, int index,
+                                           bool input) {
+  const auto &devices = input ? input_devices_ : devices_;
  if (result == nullptr) {
    return nullptr;
  }
  std::memset(result, 0, kGuestDeviceInfoSize);
  std::lock_guard<std::mutex> lock(mutex_);
  if (!active_ || index < 0 ||
-      static_cast<std::size_t>(index) >= devices_.size()) {
+      static_cast<std::size_t>(index) >= devices.size()) {
    return result;
  }
-  const MenuDevice& device = devices_[static_cast<std::size_t>(index)];
+  const MenuDevice &device = devices[static_cast<std::size_t>(index)];
  ConstructGuestString(result, device.name);
  ConstructGuestString(static_cast<std::uint8_t*>(result) + kGuestStringSize,
                       device.guid);
@@ -485,29 +677,33 @@ void* RobloxOutputDeviceBridge::DeviceInfo(void* result, int index) {
  return result;
 }

-int RobloxOutputDeviceBridge::CurrentDevice() {
+int RobloxOutputDeviceBridge::CurrentDevice(bool input) {
  std::lock_guard<std::mutex> lock(mutex_);
-  return active_ ? selected_index_ : 0;
+  return active_ ? (input ? selected_input_index_ : selected_index_) : 0;
 }

-void RobloxOutputDeviceBridge::SelectDevice(int index) {
+void RobloxOutputDeviceBridge::SelectDevice(int index, bool input) {
+  const auto &devices = input ? input_devices_ : devices_;
  std::lock_guard<std::mutex> lock(mutex_);
  if (!active_ || index < 0 ||
-      static_cast<std::size_t>(index) >= devices_.size()) {
+      static_cast<std::size_t>(index) >= devices.size()) {
    return;
  }
-  const MenuDevice& device = devices_[static_cast<std::size_t>(index)];
+  const MenuDevice &device = devices[static_cast<std::size_t>(index)];
  std::string resolved_name;
  const Status status =
-      SwitchSdlPlaybackDevice(device.playback_device_id, &resolved_name);
+      input
+          ? SwitchSdlRecordingDevice(device.playback_device_id, &resolved_name)
+          : SwitchSdlPlaybackDevice(device.playback_device_id, &resolved_name);
  if (!status.ok()) {
-    std::fprintf(stderr, "  [audio-menu] cannot select host output '%s': %s\n",
-                 device.name.c_str(), status.message().c_str());
+    std::fprintf(stderr, "  [audio-menu] cannot select host %s '%s': %s\n",
+                 input ? "input" : "output", device.name.c_str(),
+                 status.message().c_str());
    return;
  }
-  selected_index_ = index;
-  std::fprintf(stderr, "  [audio-menu] selected host output=%s\n",
-               resolved_name.c_str());
+  (input ? selected_input_index_ : selected_index_) = index;
+  std::fprintf(stderr, "  [audio-menu] selected host %s=%s\n",
+               input ? "input" : "output", resolved_name.c_str());
 }

 void RobloxOutputDeviceBridge::ConstructGuestString(
@@ -16,11 +16,13 @@
 namespace mocktail::audio {
 namespace {

+class SdlAudioCapture;
+
 struct SdlRecordingSubsystemState {
  std::mutex mutex;
  std::uint32_t configured_device_id = 0;
  std::string configured_device_name = "default";
-  std::size_t live_captures = 0;
+  std::vector<SdlAudioCapture *> live_captures;
 };

 SdlRecordingSubsystemState& RecordingSubsystemState() {
@@ -63,42 +65,6 @@ SDL_AudioFormat ToSdlFormat(PcmSampleFormat format) {
  return SDL_AUDIO_UNKNOWN;
 }

-Status ResolveConfiguredDevice(std::uint32_t requested_device_id,
-                               std::uint32_t* resolved_device_id) {
-  if (resolved_device_id == nullptr) {
-    return InvalidArgument("resolved SDL recording device pointer is null");
-  }
-  if (!AudioSubsystemInitialized()) {
-    return FailedPrecondition(
-        "SDL audio subsystem must be initialized before recording");
-  }
-  SdlRecordingSubsystemState& state = RecordingSubsystemState();
-  std::lock_guard<std::mutex> lock(state.mutex);
-  *resolved_device_id = requested_device_id == 0
-                            ? state.configured_device_id
-                            : requested_device_id;
-  return Status::Ok();
-}
-
-Status RegisterCapture() {
-  if (!AudioSubsystemInitialized()) {
-    return FailedPrecondition(
-        "SDL audio subsystem stopped while opening a capture");
-  }
-  SdlRecordingSubsystemState& state = RecordingSubsystemState();
-  std::lock_guard<std::mutex> lock(state.mutex);
-  ++state.live_captures;
-  return Status::Ok();
-}
-
-void ReleaseCapture() {
-  SdlRecordingSubsystemState& state = RecordingSubsystemState();
-  std::lock_guard<std::mutex> lock(state.mutex);
-  if (state.live_captures != 0) {
-    --state.live_captures;
-  }
-}
-
 class SdlAudioCapture final : public AudioCapture {
 public:
  SdlAudioCapture(PcmSpec spec, std::size_t frames_per_buffer,
@@ -155,6 +121,8 @@ class SdlAudioCapture final : public AudioCapture {
  }

  void Shutdown() override {
+    auto &state = RecordingSubsystemState();
+    std::lock_guard<std::mutex> registry_lock(state.mutex);
    std::lock_guard<std::mutex> lock(operation_mutex_);
    if (stream_ == nullptr) {
      return;
@@ -166,10 +134,63 @@ class SdlAudioCapture final : public AudioCapture {
    stream_ = nullptr;
    if (registered_) {
      registered_ = false;
-      ReleaseCapture();
+      auto &captures = state.live_captures;
+      captures.erase(std::remove(captures.begin(), captures.end(), this),
+                     captures.end());
    }
  }

+  std::mutex &operation_mutex() { return operation_mutex_; }
+
+  // The registry and operation mutexes are held throughout a migration.
+  Status PrepareSwitch(std::uint32_t id) {
+    SDL_AudioSpec spec{};
+    spec.format = ToSdlFormat(output_spec_.format);
+    spec.channels = output_spec_.channels;
+    spec.freq = output_spec_.sample_rate_hz;
+    replacement_ = SDL_OpenAudioDeviceStream(
+        id == 0 ? SDL_AUDIO_DEVICE_DEFAULT_RECORDING : id, &spec,
+        &OnAudioAvailable, this);
+    return replacement_ ? Status::Ok()
+                        : SdlError("open replacement microphone");
+  }
+
+  Status PauseForSwitch() {
+    if (!SDL_PauseAudioStreamDevice(stream_))
+      return SdlError("pause old microphone");
+    // Wait for an in-flight callback before the replacement can use buffer_.
+    if (!SDL_LockAudioStream(stream_))
+      return SdlError("lock old microphone");
+    SDL_UnlockAudioStream(stream_);
+    return Status::Ok();
+  }
+
+  Status StartReplacement() {
+    if (running_.load(std::memory_order_acquire) &&
+        !SDL_ResumeAudioStreamDevice(replacement_))
+      return SdlError("resume replacement microphone");
+    return Status::Ok();
+  }
+
+  void CancelReplacement() {
+    if (replacement_) {
+      SDL_DestroyAudioStream(replacement_);
+      replacement_ = nullptr;
+    }
+  }
+
+  Status RestoreAfterSwitch() {
+    if (running_.load(std::memory_order_acquire) &&
+        !SDL_ResumeAudioStreamDevice(stream_))
+      return SdlError("restore original microphone");
+    return Status::Ok();
+  }
+
+  void CommitSwitch() {
+    SDL_DestroyAudioStream(stream_);
+    stream_ = std::exchange(replacement_, nullptr);
+  }
+
  static void SDLCALL OnAudioAvailable(void* userdata,
                                       SDL_AudioStream* stream,
                                       int /*additional_amount*/,
@@ -202,6 +223,7 @@ class SdlAudioCapture final : public AudioCapture {
  std::size_t frames_per_buffer_ = 0;
  std::vector<std::uint8_t> buffer_;
  SDL_AudioStream* stream_ = nullptr;
+  SDL_AudioStream *replacement_ = nullptr;
  AudioCaptureDataCallback callback_ = nullptr;
  void* callback_context_ = nullptr;
  std::mutex operation_mutex_;
@@ -335,7 +357,7 @@ Status ConfigureSdlRecordingDevice(

  SdlRecordingSubsystemState& state = RecordingSubsystemState();
  std::lock_guard<std::mutex> lock(state.mutex);
-  if (state.live_captures != 0) {
+  if (!state.live_captures.empty()) {
    return FailedPrecondition(
        "SDL recording device must be configured before opening a capture");
  }
@@ -391,12 +413,14 @@ Status CreateSdlAudioCapture(const SdlAudioCaptureOptions& options,
    return InvalidArgument("SDL capture frame size is invalid");
  }

-  std::uint32_t recording_device_id = 0;
-  status = ResolveConfiguredDevice(options.recording_device_id,
-                                   &recording_device_id);
-  if (!status.ok()) {
-    return status;
-  }
+  auto &state = RecordingSubsystemState();
+  std::unique_lock<std::mutex> registry_lock(state.mutex);
+  if (!AudioSubsystemInitialized())
+    return FailedPrecondition(
+        "SDL audio subsystem stopped while opening capture");
+  const std::uint32_t recording_device_id = options.recording_device_id == 0
+                                                ? state.configured_device_id
+                                                : options.recording_device_id;
  const SDL_AudioDeviceID device =
      recording_device_id == 0
          ? SDL_AUDIO_DEVICE_DEFAULT_RECORDING
@@ -417,25 +441,87 @@ Status CreateSdlAudioCapture(const SdlAudioCaptureOptions& options,
  SDL_AudioStream* stream = SDL_OpenAudioDeviceStream(
      device, &spec, &SdlAudioCapture::OnAudioAvailable, implementation);
  if (stream == nullptr) {
+    registry_lock.unlock();
    delete implementation;
    return SdlError("SDL_OpenAudioDeviceStream(recording)");
  }

  implementation->AdoptStream(stream);
-  status = RegisterCapture();
-  if (!status.ok()) {
-    delete implementation;
-    return status;
-  }
+  state.live_captures.push_back(implementation);
  implementation->MarkRegistered();
  capture->reset(implementation);
  return Status::Ok();
 }

+Status SwitchSdlRecordingDevice(std::uint32_t recording_device_id,
+                                std::string *resolved_name) {
+  if (resolved_name == nullptr)
+    return InvalidArgument("microphone switch output is null");
+  resolved_name->clear();
+  std::vector<SdlRecordingDevice> devices;
+  Status status = ListSdlRecordingDevices(&devices);
+  if (!status.ok())
+    return status;
+  std::uint32_t resolved_id = 0;
+  std::string name;
+  status = ResolveSdlRecordingDevice(
+      recording_device_id == 0 ? "default"
+                               : "id:" + std::to_string(recording_device_id),
+      devices, &resolved_id, &name);
+  if (!status.ok())
+    return status;
+
+  auto &state = RecordingSubsystemState();
+  std::lock_guard<std::mutex> registry_lock(state.mutex);
+  if (!AudioSubsystemInitialized())
+    return FailedPrecondition(
+        "SDL audio subsystem stopped during microphone switch");
+  std::vector<std::unique_lock<std::mutex>> locks;
+  locks.reserve(state.live_captures.size());
+  for (auto *capture : state.live_captures)
+    locks.emplace_back(capture->operation_mutex());
+  // Keep the old streams alive until every replacement is ready and running.
+  for (auto *capture : state.live_captures) {
+    status = capture->PrepareSwitch(resolved_id);
+    if (!status.ok())
+      break;
+  }
+  if (status.ok()) {
+    for (auto *capture : state.live_captures) {
+      status = capture->PauseForSwitch();
+      if (!status.ok())
+        break;
+    }
+  }
+  if (status.ok()) {
+    for (auto *capture : state.live_captures) {
+      status = capture->StartReplacement();
+      if (!status.ok())
+        break;
+    }
+  }
+  if (!status.ok()) {
+    for (auto *capture : state.live_captures)
+      capture->CancelReplacement();
+    for (auto *capture : state.live_captures) {
+      const Status restored = capture->RestoreAfterSwitch();
+      if (!restored.ok())
+        return restored;
+    }
+    return status;
+  }
+  for (auto *capture : state.live_captures)
+    capture->CommitSwitch();
+  state.configured_device_id = resolved_id;
+  state.configured_device_name = name;
+  *resolved_name = name;
+  return Status::Ok();
+}
+
 Status PrepareSdlAudioCaptureSubsystemShutdown() {
  SdlRecordingSubsystemState& state = RecordingSubsystemState();
  std::lock_guard<std::mutex> lock(state.mutex);
-  if (state.live_captures != 0) {
+  if (!state.live_captures.empty()) {
    return FailedPrecondition(
        "SDL audio shutdown requires every capture to close");
  }
@@ -30,6 +30,9 @@ struct CaptureSession {
  void* data_context = nullptr;
  std::unique_ptr<AudioCapture> capture;
  std::shared_ptr<std::atomic<bool>> microphone_muted;
+  std::atomic<std::uint64_t> delivered_buffers{0};
+  std::atomic<std::uint64_t> audible_buffers{0};
+  std::atomic<std::uint64_t> muted_buffers{0};
 };

 struct PlayoutSession {
@@ -112,22 +115,40 @@ void DisposeManager(void* opaque_context, const void* identity) {
 void SetMicrophoneMute(void* opaque_context, bool muted) {
  auto* context = static_cast<WebRtcJniAudioBridgeContext*>(opaque_context);
  if (context == nullptr) return;
-  context->microphone_muted->store(muted, std::memory_order_release);
+  if (context->microphone_muted->exchange(muted, std::memory_order_acq_rel) != muted) {
+    std::cerr << "  [mocktail][audio] WebRTC microphone muted=" << muted << '\n';
+  }
 }

 void OnCapturedAudio(void* opaque_session, std::size_t size_bytes) {
  auto* session = static_cast<CaptureSession*>(opaque_session);
  if (session != nullptr && session->data_callback != nullptr) {
+    if (session->capture == nullptr ||
+        size_bytes > session->capture->buffer_size_bytes()) {
+      return;
+    }
+    const auto* samples = static_cast<const unsigned char*>(
+        session->capture->buffer_data());
+    int peak = 0;
+    for (std::size_t i = 0; i + 1 < size_bytes; i += 2) {
+      const int word = samples[i] | (static_cast<int>(samples[i + 1]) << 8);
+      peak = std::max(peak, std::abs(word >= 32768 ? word - 65536 : word));
+    }
+    if (peak != 0 && session->audible_buffers.fetch_add(1) == 0) {
+      std::cerr << "  [mocktail][audio] WebRTC microphone first nonzero PCM"
+                << " peak=" << peak << "/32768\n";
+    }
    if (session->microphone_muted != nullptr &&
        session->microphone_muted->load(std::memory_order_acquire)) {
-      if (session->capture == nullptr ||
-          size_bytes > session->capture->buffer_size_bytes()) {
-        return;
-      }
+      session->muted_buffers.fetch_add(1, std::memory_order_relaxed);
      std::memset(session->capture->buffer_data(), 0, size_bytes);
    }
    session->data_callback(session->data_context, session->identity,
                           size_bytes);
+    if (session->delivered_buffers.fetch_add(1) == 0) {
+      std::cerr << "  [mocktail][audio] WebRTC microphone first JNI delivery"
+                << " bytes=" << size_bytes << '\n';
+    }
  }
 }

@@ -137,6 +158,10 @@ void CloseCaptureSession(const std::shared_ptr<CaptureSession>& session) {
  }
  (void)session->capture->Stop();
  session->capture->Shutdown();
+  std::cerr << "  [mocktail][audio] WebRTC microphone capture summary"
+            << " buffers=" << session->delivered_buffers.load()
+            << " nonzero=" << session->audible_buffers.load()
+            << " muted=" << session->muted_buffers.load() << '\n';
 }

 int Init(void* opaque_context, const void* identity, int sample_rate_hz,
@@ -16,6 +16,8 @@
 #include <cstdlib>
 #include <cstring>

+#include "compat/bionic_pthread_create_runtime.h"
+#include "compat/guest_abi.h"
 #include "compat/http_client_spin_guard.h"
 #include "window/window.h"

@@ -31,6 +33,14 @@ const char* EnvironmentOr(const char* name, const char* fallback) {
  return value != nullptr && value[0] != '\0' ? value : fallback;
 }

+const char* GuestAbiPropertyValue() {
+#if defined(__aarch64__)
+  return "arm64-v8a";
+#else
+  return "x86_64";
+#endif
+}
+
 int CallHostVsnprintf(char* dst, size_t count, const char* format,
                      va_list args) {
  using HostVsnprintf = int (*)(char*, size_t, const char*, va_list);
@@ -173,8 +183,12 @@ int __system_property_get(const char* name, char* value) {
    result = "35";
  } else if (std::strcmp(name, "ro.build.version.release") == 0) {
    result = "15";
-  } else if (std::strcmp(name, "ro.product.cpu.abi") == 0) {
-    result = "x86_64";
+  } else if (std::strcmp(name, "ro.product.cpu.abi") == 0 ||
+             std::strcmp(name, "ro.product.cpu.abilist") == 0 ||
+             std::strcmp(name, "ro.product.cpu.abilist64") == 0) {
+    result = GuestAbiPropertyValue();
+  } else if (std::strcmp(name, "ro.product.cpu.abilist32") == 0) {
+    result = "";
  } else if (std::strcmp(name, "ro.product.manufacturer") == 0) {
    result = EnvironmentOr("MOCKTAIL_DEVICE_MANUFACTURER", "Mocktail");
  } else if (std::strcmp(name, "ro.product.model") == 0) {
@@ -1,9 +1,14 @@
 #include "compat/bionic_pthread_create_runtime.h"

+#include "compat/bionic_abi_exports.h"
+
 #include <errno.h>
+#include <stdio.h>
+#include <unistd.h>

 #include <algorithm>
 #include <atomic>
+#include <cstring>
 #include <limits>
 #include <new>

@@ -22,6 +27,24 @@ struct ThreadStartContext {

 std::atomic<NativeThreadInitializer> g_thread_initializer{nullptr};

+// Roblox requests maximum-priority FIFO for its Main thread. On hosts with
+// RLIMIT_RTPRIO=99 this succeeds and later trips the finite RLIMIT_RTTIME.
+bool RejectRealtimeScheduling(int policy) noexcept {
+  const int base_policy = policy & ~SCHED_RESET_ON_FORK;
+  if (base_policy != SCHED_FIFO && base_policy != SCHED_RR) {
+    return false;
+  }
+  static std::atomic_flag logged = ATOMIC_FLAG_INIT;
+  if (!logged.test_and_set(std::memory_order_relaxed)) {
+    const int saved_errno = errno;
+    fprintf(stderr, "  [scheduler] denied guest real-time scheduling (policy=%d): "
+                    "keeping host scheduling to prevent RLIMIT_RTTIME SIGXCPU\n",
+            policy);
+    errno = saved_errno;
+  }
+  return true;
+}
+
 size_t HostStackSizeForGuest(size_t guest_stack_size) noexcept {
 #if defined(__GLIBC__)
  using GetStaticTlsInfo = void (*)(size_t*, size_t*);
@@ -50,24 +73,28 @@ size_t HostStackSizeForGuest(size_t guest_stack_size) noexcept {
  return guest_stack_size;
 }

-int CopySupportedThreadAttributes(const pthread_attr_t& source,
+// Guest pthread_attr_t buffers use the Bionic LP64 layout; they are never a
+// host pthread_attr_t, so decode the fixed fields directly.
+int GuestDetachState(const MocktailBionicPthreadAttr& source) noexcept {
+  return (source.flags & kMocktailBionicAttrFlagDetached) != 0
+             ? PTHREAD_CREATE_DETACHED
+             : PTHREAD_CREATE_JOINABLE;
+}
+
+size_t GuestStackSize(const MocktailBionicPthreadAttr& source) noexcept {
+  return source.stack_size != 0 ? source.stack_size
+                                : kBionicLp64DefaultThreadStackSize;
+}
+
+int CopySupportedThreadAttributes(const MocktailBionicPthreadAttr& source,
                                  pthread_attr_t* destination) noexcept {
-  int detach_state = PTHREAD_CREATE_JOINABLE;
-  int result = pthread_attr_getdetachstate(&source, &detach_state);
-  if (result != 0) {
-    return result;
-  }
-  result = pthread_attr_setdetachstate(destination, detach_state);
+  int result =
+      pthread_attr_setdetachstate(destination, GuestDetachState(source));
  if (result != 0) {
    return result;
  }

-  size_t guard_size = 0;
-  result = pthread_attr_getguardsize(&source, &guard_size);
-  if (result != 0) {
-    return result;
-  }
-  result = pthread_attr_setguardsize(destination, guard_size);
+  result = pthread_attr_setguardsize(destination, source.guard_size);
  if (result != 0) {
    return result;
  }
@@ -76,50 +103,38 @@ int CopySupportedThreadAttributes(const pthread_attr_t& source,
  // pthread_attr_setstack. Copying pthread_attr_getstack's address is unsafe:
  // glibc represents an automatically allocated stack with a synthetic
  // address derived from its size.
-  size_t stack_size = 0;
-  result = pthread_attr_getstacksize(&source, &stack_size);
-  if (result != 0) {
-    return result;
-  }
-  result = pthread_attr_setstacksize(destination,
-                                     HostStackSizeForGuest(stack_size));
+  result = pthread_attr_setstacksize(
+      destination, HostStackSizeForGuest(GuestStackSize(source)));
  if (result != 0) {
    return result;
  }

-  int inherit_scheduler = PTHREAD_INHERIT_SCHED;
-  result = pthread_attr_getinheritsched(&source, &inherit_scheduler);
-  if (result != 0) {
-    return result;
+  // Bionic applies the attribute's scheduling policy at creation whenever it
+  // differs from the normal policy.
+  if (RejectRealtimeScheduling(source.sched_policy)) {
+    return EPERM;
  }
-  if (inherit_scheduler == PTHREAD_EXPLICIT_SCHED) {
-    int scheduler_policy = 0;
-    sched_param scheduler_parameters{};
-    result = pthread_attr_getschedpolicy(&source, &scheduler_policy);
-    if (result == 0) {
-      result = pthread_attr_getschedparam(&source, &scheduler_parameters);
-    }
-    if (result == 0) {
-      result = pthread_attr_setschedpolicy(destination, scheduler_policy);
-    }
-    if (result == 0) {
-      result = pthread_attr_setschedparam(destination, &scheduler_parameters);
-    }
+  if (source.sched_policy != SCHED_NORMAL) {
+    result = pthread_attr_setschedpolicy(destination, source.sched_policy);
    if (result != 0) {
      return result;
    }
+    sched_param scheduler_parameters{};
+    scheduler_parameters.sched_priority = source.sched_priority;
+    result = pthread_attr_setschedparam(destination, &scheduler_parameters);
+    if (result != 0) {
+      return result;
+    }
+    return pthread_attr_setinheritsched(destination, PTHREAD_EXPLICIT_SCHED);
  }
-  return pthread_attr_setinheritsched(destination, inherit_scheduler);
+
+  return pthread_attr_setinheritsched(destination, PTHREAD_INHERIT_SCHED);
 }

-int CopyRequiredThreadAttributes(const pthread_attr_t& source,
+int CopyRequiredThreadAttributes(const MocktailBionicPthreadAttr& source,
                                 pthread_attr_t* destination) noexcept {
-  int detach_state = PTHREAD_CREATE_JOINABLE;
-  int result = pthread_attr_getdetachstate(&source, &detach_state);
-  if (result != 0) {
-    return result;
-  }
-  result = pthread_attr_setdetachstate(destination, detach_state);
+  int result =
+      pthread_attr_setdetachstate(destination, GuestDetachState(source));
  if (result != 0) {
    return result;
  }
@@ -127,32 +142,20 @@ int CopyRequiredThreadAttributes(const pthread_attr_t& source,
  // The retry must retain an explicitly requested guest stack. Falling back
  // to a null/default host attr is unsafe on musl, whose default stack is much
  // smaller than Bionic's and can be exhausted by a single libroblox frame.
-  size_t stack_size = 0;
-  result = pthread_attr_getstacksize(&source, &stack_size);
-  if (result != 0) {
-    return result;
-  }
-  return pthread_attr_setstacksize(destination,
-                                   HostStackSizeForGuest(stack_size));
+  return pthread_attr_setstacksize(
+      destination, HostStackSizeForGuest(GuestStackSize(source)));
 }

-int ConfigureHostSafeStackFallback(const pthread_attr_t* source,
+int ConfigureHostSafeStackFallback(const MocktailBionicPthreadAttr* source,
                                   pthread_attr_t* destination) noexcept {
  size_t guest_stack_size = 0;
  if (source != nullptr) {
-    int detach_state = PTHREAD_CREATE_JOINABLE;
-    int result = pthread_attr_getdetachstate(source, &detach_state);
-    if (result != 0) {
-      return result;
-    }
-    result = pthread_attr_setdetachstate(destination, detach_state);
-    if (result != 0) {
-      return result;
-    }
-    result = pthread_attr_getstacksize(source, &guest_stack_size);
+    int result =
+        pthread_attr_setdetachstate(destination, GuestDetachState(*source));
    if (result != 0) {
      return result;
    }
+    guest_stack_size = GuestStackSize(*source);
  }

  size_t host_default_stack_size = 0;
@@ -185,7 +188,8 @@ void ConfigureBionicPthreadThreadInitializer(
  g_thread_initializer.store(initializer, std::memory_order_release);
 }

-int CreateBionicPthread(pthread_t* thread, const pthread_attr_t* attr,
+int CreateBionicPthread(pthread_t* thread,
+                        const MocktailBionicPthreadAttr* attr,
                        void* (*start_routine)(void*), void* argument) {
  if (thread == nullptr || start_routine == nullptr) {
    return EINVAL;
@@ -267,10 +271,141 @@ int CreateBionicPthread(pthread_t* thread, const pthread_attr_t* attr,

 }  // namespace mocktail::compat

-extern "C" int mocktail_bionic_pthread_create(pthread_t* thread,
-                                               const pthread_attr_t* attr,
-                                               void* (*start_routine)(void*),
-                                               void* argument) {
+extern "C" {
+
+int mocktail_pthread_attr_init(MocktailBionicPthreadAttr* attr) {
+  if (attr == nullptr) {
+    return EINVAL;
+  }
+  attr->flags = 0;
+  attr->stack_base = nullptr;
+  attr->stack_size =
+      mocktail::compat::kBionicLp64DefaultThreadStackSize;
+  const long page_size = sysconf(_SC_PAGESIZE);
+  attr->guard_size = page_size > 0 ? static_cast<size_t>(page_size) : 0;
+  attr->sched_policy = SCHED_OTHER;
+  attr->sched_priority = 0;
+  std::memset(attr->reserved, 0, sizeof(attr->reserved));
+  return 0;
+}
+
+int mocktail_pthread_attr_destroy(MocktailBionicPthreadAttr* attr) {
+  (void)attr;
+  return 0;
+}
+
+int mocktail_pthread_attr_setstacksize(MocktailBionicPthreadAttr* attr,
+                                       size_t stack_size) {
+  if (attr == nullptr || stack_size < PTHREAD_STACK_MIN) {
+    return EINVAL;
+  }
+  attr->stack_size = stack_size;
+  attr->flags &= ~kMocktailBionicAttrFlagUserStack;
+  return 0;
+}
+
+int mocktail_pthread_attr_setdetachstate(MocktailBionicPthreadAttr* attr,
+                                         int detach_state) {
+  if (attr == nullptr || (detach_state != PTHREAD_CREATE_DETACHED &&
+                          detach_state != PTHREAD_CREATE_JOINABLE)) {
+    return EINVAL;
+  }
+  if (detach_state == PTHREAD_CREATE_DETACHED) {
+    attr->flags |= kMocktailBionicAttrFlagDetached;
+  } else {
+    attr->flags &= ~kMocktailBionicAttrFlagDetached;
+  }
+  return 0;
+}
+
+int mocktail_pthread_attr_setschedparam(MocktailBionicPthreadAttr* attr,
+                                        const struct sched_param* parameters) {
+  if (attr == nullptr || parameters == nullptr) {
+    return EINVAL;
+  }
+  attr->sched_priority = parameters->sched_priority;
+  return 0;
+}
+
+int mocktail_pthread_getattr_np(pthread_t thread,
+                                MocktailBionicPthreadAttr* attr) {
+  if (attr == nullptr) {
+    return EINVAL;
+  }
+  pthread_attr_t host_attr;
+  int result = pthread_getattr_np(thread, &host_attr);
+  if (result != 0) {
+    return result;
+  }
+  void* stack_base = nullptr;
+  size_t stack_size = 0;
+  result = pthread_attr_getstack(&host_attr, &stack_base, &stack_size);
+  size_t guard_size = 0;
+  if (result == 0) {
+    result = pthread_attr_getguardsize(&host_attr, &guard_size);
+  }
+  int detach_state = PTHREAD_CREATE_JOINABLE;
+  if (result == 0) {
+    result = pthread_attr_getdetachstate(&host_attr, &detach_state);
+  }
+  sched_param parameters{};
+  int policy = SCHED_OTHER;
+  if (result == 0) {
+    result = pthread_getschedparam(thread, &policy, &parameters);
+  }
+  pthread_attr_destroy(&host_attr);
+  if (result != 0) {
+    return result;
+  }
+  attr->flags = detach_state == PTHREAD_CREATE_DETACHED
+                    ? kMocktailBionicAttrFlagDetached
+                    : 0;
+  attr->stack_base = stack_base;
+  attr->stack_size = stack_size;
+  attr->guard_size = guard_size;
+  attr->sched_policy = policy;
+  attr->sched_priority = parameters.sched_priority;
+  std::memset(attr->reserved, 0, sizeof(attr->reserved));
+  return 0;
+}
+
+int mocktail_pthread_attr_getstack(const MocktailBionicPthreadAttr* attr,
+                                   void** stack_base, size_t* stack_size) {
+  if (attr == nullptr) {
+    return EINVAL;
+  }
+  if (stack_base != nullptr) {
+    *stack_base = attr->stack_base;
+  }
+  if (stack_size != nullptr) {
+    *stack_size = attr->stack_size;
+  }
+  return 0;
+}
+
+
+}  // extern "C"
+
+extern "C" int mocktail_bionic_pthread_create(
+    pthread_t* thread, const MocktailBionicPthreadAttr* attr,
+    void* (*start_routine)(void*), void* argument) {
  return mocktail::compat::CreateBionicPthread(thread, attr, start_routine,
                                               argument);
 }
+
+extern "C" int mocktail_bionic_pthread_setschedparam(
+    pthread_t thread, int policy, const struct sched_param* parameters) {
+  if (mocktail::compat::RejectRealtimeScheduling(policy)) {
+    return EPERM;
+  }
+  return pthread_setschedparam(thread, policy, parameters);
+}
+
+extern "C" int mocktail_bionic_sched_setscheduler(
+    pid_t tid, int policy, const struct sched_param* parameters) {
+  if (mocktail::compat::RejectRealtimeScheduling(policy)) {
+    errno = EPERM;
+    return -1;
+  }
+  return sched_setscheduler(tid, policy, parameters);
+}
@@ -119,11 +119,33 @@ bool ParseOptionalFmodOutputDeviceBridge(
    return false;
  }

+  int layout = 1;
+  const auto layout_field = field->find("vtable_layout_version");
+  if (layout_field != field->end()) {
+    if (!layout_field->is_number_integer() ||
+        (*layout_field != 1 && *layout_field != 2)) {
+      return false;
+    }
+    layout = layout_field->get<int>();
+  }
  *bridge_profile = FmodOutputDeviceBridgeProfile{
      *vtable_rva,      *string_constructor_rva, *count_method_rva,
-      *info_method_rva, *current_method_rva,     *select_method_rva,
+      *info_method_rva, *current_method_rva,     *select_method_rva, layout,
  };
-  return true;
+  constexpr const char *input_fields[] = {
+      "input_count_method_rva", "input_info_method_rva",
+      "input_current_method_rva", "input_select_method_rva"};
+  std::size_t input_fields_present = 0;
+  for (std::size_t i = 0; i < 4; ++i) {
+    std::optional<std::uintptr_t> rva;
+    if (!ParseOptionalRva(*field, input_fields[i], &rva))
+      return false;
+    if (rva) {
+      ++input_fields_present;
+      (*bridge_profile)->input_method_rvas[i] = *rva;
+    }
+  }
+  return input_fields_present == 0 || input_fields_present == 4;
 }

 }  // namespace
@@ -229,6 +251,22 @@ ProfileLookupResult FindBuildProfile(const std::string& manifest_path,
                     normalized_requested);
    }

+    // Upgrade previously cached manifests for these exact, validated images.
+    // This adds input routes without changing the payload's approval status.
+    if (fmod_output_device_bridge &&
+        !fmod_output_device_bridge->has_input_devices()) {
+      auto &bridge = *fmod_output_device_bridge;
+      if (normalized_profile == "ade08266c67aee88ec9c1d00902150e1684dad3a" &&
+          bridge.vtable_rva == 0x6c58040 && bridge.vtable_layout_version == 1) {
+        bridge.input_method_rvas = {0x32d12dc, 0x32d12ea, 0x32d13a6, 0x32d0a56};
+      } else if (normalized_profile ==
+                     "5f0704edd9064f566ee3d6df2bd2fabbcc709f03" &&
+                 bridge.vtable_rva == 0x6cd3ce0 &&
+                 bridge.vtable_layout_version == 2) {
+        bridge.input_method_rvas = {0x320ccf6, 0x320cd04, 0x320d152, 0x320bd18};
+      }
+    }
+
    matched_profile = BuildProfile{
        version_name->get_ref<const std::string&>(),
        version_code->get<int>(),
@@ -39,12 +39,23 @@ bool PatchAbsoluteJump(uintptr_t address, void *target) noexcept {
    return false;
  }

+#if defined(__aarch64__)
+  // ldr x16, #8 ; br x16 ; .quad target
+  // x16 is the intra-procedure-call scratch register, free to clobber.
+  unsigned char patch[] = {
+      0x50, 0x00, 0x00, 0x58, 0x00, 0x02, 0x1f, 0xd6,
+      0,    0,    0,    0,    0,    0,    0,    0,
+  };
+  const uintptr_t target_address = reinterpret_cast<uintptr_t>(target);
+  std::memcpy(patch + 8, &target_address, sizeof(target_address));
+#else
  unsigned char patch[] = {
      0x48, 0xb8,                               // movabs rax, imm64
      0,    0,    0, 0, 0, 0, 0, 0, 0xff, 0xe0, // jmp rax
  };
  const uintptr_t target_address = reinterpret_cast<uintptr_t>(target);
  std::memcpy(patch + 2, &target_address, sizeof(target_address));
+#endif

  const uintptr_t page_mask = static_cast<uintptr_t>(page_size) - 1;
  const uintptr_t page = address & ~page_mask;
@@ -6,6 +6,34 @@ namespace mocktail::compat {
 namespace {

 constexpr HostAbiProfile kProfiles[] = {
+    // Roblox 2.736.1408 arm64-v8a. Every RVA was derived from the AArch64
+    // payload of the same release as the x86-64 reference above, matched by
+    // allocator internals, init_array call graphs, and static state layout.
+    // Constructor policy mirrors x86-64 by semantic role: the pre-init
+    // entries 0..3 stay skipped, index 4 is mi_process_load (thread init
+    // checkpoint), index 5 is allocator wiring and index 6 is the lazy clock
+    // singleton getter, both excluded under host bridges only.
+    {"ed2b035768b1513561d0e6ea7f9bbec35b0e60e5",
+     {{{0x1d53840, HostBridgeKind::kAllocate, "small-allocate"},
+       {0x1d56c34, HostBridgeKind::kUsableSize, "usable-size"},
+       {0x1d6ef80, HostBridgeKind::kReallocate, "reallocate"},
+       {0x1d53568, HostBridgeKind::kAllocate, "allocate"},
+       {0x61d3850, HostBridgeKind::kAlignedAllocate,
+        "aligned-allocate-direct"},
+       {0x1d57328, HostBridgeKind::kFree, "free"}}},
+     6,
+     {0, 0, 0x7296c88, 0x400, 0x1d53c54, 0x1dc76a0,
+      0x71d6c90, 0x71d2c40, 0x400000},
+     {0x1d53568, 0x1d57328},
+     0x6733128,
+     3565,
+     {{{4, 5}, {7, 3565}}},
+     2,
+     {{{4, 3565}}},
+     1,
+     4,
+     {0x2132c5c, 0x71d6d30},
+     HostAllocatorStrategy::kNativeMimalloc},
    // Roblox 2.736.1408. Derived from the verified 2908 profile and validated
    // by two isolated no-recovery Vulkan canaries and real game sessions.
    {"ade08266c67aee88ec9c1d00902150e1684dad3a",
@@ -32,6 +32,7 @@
 #include <openssl/evp.h>

 #include "compat/elf_build_id.h"
+#include "compat/guest_abi.h"

 namespace mocktail::compat {
 namespace {
@@ -611,19 +612,26 @@ std::unique_ptr<OwnedHostAbiProfile> ParseProfile(const Json& root,
    *error = "external host ABI profile has inconsistent constructor policy";
    return nullptr;
  }
-  if (owned->profile.init_array_count <= 5 ||
+  // The verified constructor layout is the same on both guest ABIs: a single
+  // process-load constructor at the thread-initializer checkpoint, two wiring
+  // entries excluded under host bridges, and one contiguous native-mimalloc
+  // replay from the checkpoint to the end of .init_array. Only the checkpoint
+  // index itself differs between payloads.
+  const std::size_t checkpoint =
+      owned->profile.native_mimalloc_thread_initializer_after_constructor;
+  if (owned->profile.init_array_count <= checkpoint + 3 ||
      owned->profile.constructor_run_range_count != 2 ||
-      owned->profile.constructor_run_ranges[0].begin != 2 ||
-      owned->profile.constructor_run_ranges[0].end_exclusive != 3 ||
-      owned->profile.constructor_run_ranges[1].begin != 5 ||
+      owned->profile.constructor_run_ranges[0].begin != checkpoint ||
+      owned->profile.constructor_run_ranges[0].end_exclusive != checkpoint + 1 ||
+      owned->profile.constructor_run_ranges[1].begin != checkpoint + 3 ||
      owned->profile.constructor_run_ranges[1].end_exclusive !=
          owned->profile.init_array_count ||
      owned->profile.native_mimalloc_constructor_run_range_count != 1 ||
-      owned->profile.native_mimalloc_constructor_run_ranges[0].begin != 2 ||
+      owned->profile.native_mimalloc_constructor_run_ranges[0].begin !=
+          checkpoint ||
      owned->profile.native_mimalloc_constructor_run_ranges[0].end_exclusive !=
          owned->profile.init_array_count ||
-      owned->profile.native_mimalloc_thread_initializer_after_constructor !=
-          2) {
+      (kGuestElfMachine == EM_X86_64 && checkpoint != 2)) {
    *error =
        "external host ABI profile changed the verified constructor policy";
    return nullptr;
@@ -669,9 +677,10 @@ bool ValidateProfileAgainstElf(const std::string& payload_path,
  }
  GElf_Ehdr header{};
  if (gelf_getehdr(elf.get(), &header) == nullptr ||
-      gelf_getclass(elf.get()) != ELFCLASS64 || header.e_machine != EM_X86_64 ||
-      header.e_type != ET_DYN) {
-    *error = "payload must be an x86-64 ET_DYN ELF object";
+      gelf_getclass(elf.get()) != ELFCLASS64 ||
+      header.e_machine != kGuestElfMachine || header.e_type != ET_DYN) {
+    *error = "payload must be a " + std::string(kGuestAbi) +
+             " ET_DYN ELF object";
    return false;
  }

@@ -1,3 +1,4 @@
+// Includes changes by vii from CoderDayton/nightcap.
 // Android Vulkan loader ABI -> host Vulkan loader + SDL3 WSI.

 #include <dlfcn.h>
@@ -17,6 +18,7 @@

 #include "mocktail/graphics/android_vulkan_wsi_adapter.h"
 #include "mocktail/graphics/present_mode_policy.h"
+#include "mocktail/graphics/vulkan_etc2_emulation.h"
 #include "mocktail/graphics/vulkan_text_overlay_compositor.h"
 #include "mocktail/platform/platform_runtime.h"

@@ -188,6 +190,7 @@ struct AdapterState {
  VkInstance latest_instance = VK_NULL_HANDLE;
  size_t active_instance_count = 0;
  mocktail::graphics::VulkanTextOverlayCompositor text_overlay;
+  mocktail::graphics::VulkanEtc2Emulation etc2;
  std::atomic<NotePresentFn> note_present{nullptr};
  std::atomic<NoteHostPresentBeginFn> note_host_present_begin{nullptr};
  std::atomic<NoteHostPresentEndFn> note_host_present_end{nullptr};
@@ -727,12 +730,90 @@ PFN_vkVoidFunction AdapterProc(const char* name) {
  MOCKTAIL_VK_PROC(vkQueueWaitIdle)
  MOCKTAIL_VK_PROC(vkDeviceWaitIdle)
  MOCKTAIL_VK_PROC(vkQueuePresentKHR)
+  MOCKTAIL_VK_PROC(vkGetPhysicalDeviceFeatures)
+  MOCKTAIL_VK_PROC(vkGetPhysicalDeviceFeatures2)
+  MOCKTAIL_VK_PROC(vkGetPhysicalDeviceFormatProperties)
+  MOCKTAIL_VK_PROC(vkGetPhysicalDeviceFormatProperties2)
+  MOCKTAIL_VK_PROC(vkGetPhysicalDeviceImageFormatProperties)
+  MOCKTAIL_VK_PROC(vkGetPhysicalDeviceImageFormatProperties2)
+  MOCKTAIL_VK_PROC(vkCreateImage)
+  MOCKTAIL_VK_PROC(vkDestroyImage)
+  MOCKTAIL_VK_PROC(vkCreateImageView)
+  MOCKTAIL_VK_PROC(vkBindBufferMemory)
+  MOCKTAIL_VK_PROC(vkBindBufferMemory2)
+  MOCKTAIL_VK_PROC(vkMapMemory)
+  MOCKTAIL_VK_PROC(vkMapMemory2)
+  MOCKTAIL_VK_PROC(vkUnmapMemory)
+  MOCKTAIL_VK_PROC(vkUnmapMemory2)
+  MOCKTAIL_VK_PROC(vkFreeMemory)
+  MOCKTAIL_VK_PROC(vkDestroyBuffer)
+  MOCKTAIL_VK_PROC(vkCmdCopyBufferToImage)
+  MOCKTAIL_VK_PROC(vkCmdCopyImage)
+  MOCKTAIL_VK_PROC(vkCmdCopyImage2)
+  MOCKTAIL_VK_PROC(vkCmdCopyBufferToImage2)
+  MOCKTAIL_VK_PROC(vkCmdExecuteCommands)
 #undef MOCKTAIL_VK_PROC
+#define MOCKTAIL_VK_ALIAS(alias, function)                 \
+  if (std::strcmp(name, #alias) == 0) {                    \
+    return reinterpret_cast<PFN_vkVoidFunction>(function); \
+  }
+  MOCKTAIL_VK_ALIAS(vkGetPhysicalDeviceFeatures2KHR,
+                    vkGetPhysicalDeviceFeatures2)
+  MOCKTAIL_VK_ALIAS(vkGetPhysicalDeviceFormatProperties2KHR,
+                    vkGetPhysicalDeviceFormatProperties2)
+  MOCKTAIL_VK_ALIAS(vkGetPhysicalDeviceImageFormatProperties2KHR,
+                    vkGetPhysicalDeviceImageFormatProperties2)
+  MOCKTAIL_VK_ALIAS(vkBindBufferMemory2KHR, vkBindBufferMemory2)
+  MOCKTAIL_VK_ALIAS(vkCmdCopyImage2KHR, vkCmdCopyImage2)
+  MOCKTAIL_VK_ALIAS(vkMapMemory2KHR, vkMapMemory2)
+  MOCKTAIL_VK_ALIAS(vkUnmapMemory2KHR, vkUnmapMemory2)
+  MOCKTAIL_VK_ALIAS(vkCmdCopyBufferToImage2KHR, vkCmdCopyBufferToImage2)
+#undef MOCKTAIL_VK_ALIAS
  return nullptr;
 }

+bool NameInList(const char* name, const char* const* names,
+                std::size_t count) {
+  return name != nullptr &&
+         std::any_of(names, names + count, [name](const char* candidate) {
+           return std::strcmp(name, candidate) == 0;
+         });
+}
+
+bool IsEtc2DeviceProc(const char* name) {
+  static constexpr const char* kNames[] = {
+      "vkCreateImage",          "vkDestroyImage",
+      "vkCreateImageView",      "vkBindBufferMemory",
+      "vkBindBufferMemory2",    "vkBindBufferMemory2KHR",
+      "vkMapMemory",            "vkMapMemory2",
+      "vkMapMemory2KHR",        "vkUnmapMemory",
+      "vkUnmapMemory2",         "vkUnmapMemory2KHR",
+      "vkFreeMemory",           "vkDestroyBuffer",
+      "vkCmdCopyBufferToImage", "vkCmdCopyBufferToImage2",
+      "vkCmdCopyImage",         "vkCmdCopyImage2",
+      "vkCmdCopyImage2KHR",
+      "vkCmdCopyBufferToImage2KHR", "vkCmdExecuteCommands",
+  };
+  return NameInList(name, kNames, sizeof(kNames) / sizeof(kNames[0]));
+}
+
+bool IsEtc2PhysicalDeviceProc(const char* name) {
+  static constexpr const char* kNames[] = {
+      "vkGetPhysicalDeviceFeatures",
+      "vkGetPhysicalDeviceFeatures2",
+      "vkGetPhysicalDeviceFeatures2KHR",
+      "vkGetPhysicalDeviceFormatProperties",
+      "vkGetPhysicalDeviceFormatProperties2",
+      "vkGetPhysicalDeviceFormatProperties2KHR",
+      "vkGetPhysicalDeviceImageFormatProperties",
+      "vkGetPhysicalDeviceImageFormatProperties2",
+      "vkGetPhysicalDeviceImageFormatProperties2KHR",
+  };
+  return NameInList(name, kNames, sizeof(kNames) / sizeof(kNames[0]));
+}
+
 bool IsDeviceAdapterProc(const char* name) {
-  return name != nullptr && (std::strcmp(name, "vkDestroyDevice") == 0 ||
+  return name != nullptr && (IsEtc2DeviceProc(name) || std::strcmp(name, "vkDestroyDevice") == 0 ||
                             std::strcmp(name, "vkGetDeviceQueue") == 0 ||
                             std::strcmp(name, "vkGetDeviceQueue2") == 0 ||
                             std::strcmp(name, "vkCreateSwapchainKHR") == 0 ||
@@ -959,11 +1040,23 @@ struct FpsWaitTrace {
  std::atomic<std::uint64_t> total_ns{0};
  std::atomic<std::uint64_t> max_ns{0};
  std::atomic<std::uint64_t> window_start_ns{0};
+  std::atomic<std::uint64_t> max_gap_ns{0};
+  std::atomic<std::uint64_t> last_start_ns{0};

  void Record(std::uint64_t start_ns) {
    if (name == nullptr || start_ns == 0) {
      return;
    }
+    const std::uint64_t previous_start =
+        last_start_ns.exchange(start_ns, std::memory_order_relaxed);
+    if (previous_start != 0 && start_ns > previous_start) {
+      const std::uint64_t gap_ns = start_ns - previous_start;
+      std::uint64_t max_gap = max_gap_ns.load(std::memory_order_relaxed);
+      while (gap_ns > max_gap &&
+             !max_gap_ns.compare_exchange_weak(max_gap, gap_ns,
+                                               std::memory_order_relaxed)) {
+      }
+    }
    const std::uint64_t wait_ns = MonotonicNanos() - start_ns;
    total_ns.fetch_add(wait_ns, std::memory_order_relaxed);
    std::uint64_t max_wait = max_ns.load(std::memory_order_relaxed);
@@ -984,14 +1077,18 @@ struct FpsWaitTrace {
    const std::uint64_t total = total_ns.exchange(0, std::memory_order_relaxed);
    const std::uint64_t peak = max_ns.exchange(0, std::memory_order_relaxed);
    const std::uint64_t count = samples.exchange(0, std::memory_order_relaxed);
+    const std::uint64_t gap_peak =
+        max_gap_ns.exchange(0, std::memory_order_relaxed);
    window_start_ns.store(start_ns, std::memory_order_relaxed);
    if (count == 0) {
      return;
    }
-    std::fprintf(stderr, "  [fps] %s n=%llu avg=%llu us max=%llu us\n", name,
-                 static_cast<unsigned long long>(count),
+    std::fprintf(stderr,
+                 "  [fps] %s n=%llu avg=%llu us max=%llu us gap_max=%llu us\n",
+                 name, static_cast<unsigned long long>(count),
                 static_cast<unsigned long long>(total / count / 1000ULL),
-                 static_cast<unsigned long long>(peak / 1000ULL));
+                 static_cast<unsigned long long>(peak / 1000ULL),
+                 static_cast<unsigned long long>(gap_peak / 1000ULL));
  }
 };

@@ -1042,6 +1139,58 @@ ObservedHostQueuePresent(VkQueue queue, const VkPresentInfoKHR* present_info) {
  return result;
 }

+template <typename Function>
+Function HostPhysicalDeviceProc(const char* name, const char* alias) {
+  VkInstance instance = VK_NULL_HANDLE;
+  {
+    AdapterState& state = State();
+    std::lock_guard<std::mutex> lock(state.mutex);
+    instance = state.latest_instance;
+  }
+  PFN_vkVoidFunction proc = HostInstanceProc(instance, name);
+  if (proc == nullptr && alias != nullptr) {
+    proc = HostInstanceProc(instance, alias);
+  }
+  return reinterpret_cast<Function>(proc);
+}
+
+bool Etc2EmulatedPhysicalDevice(VkPhysicalDevice physical_device) {
+  return State().etc2.PhysicalDeviceNeedsEmulation(
+      physical_device, HostPhysicalDeviceProc<PFN_vkGetPhysicalDeviceFeatures>(
+                           "vkGetPhysicalDeviceFeatures", nullptr));
+}
+
+void ReleaseEtc2PoolCommandBuffers(VkDevice device,
+                                   VkCommandPool command_pool) {
+  std::vector<VkCommandBuffer> command_buffers;
+  {
+    AdapterState& state = State();
+    std::lock_guard<std::mutex> lock(state.mutex);
+    for (const auto& binding : state.command_buffer_bindings) {
+      if (binding.device == device && binding.command_pool == command_pool) {
+        command_buffers.push_back(binding.command_buffer);
+      }
+    }
+  }
+  for (VkCommandBuffer command_buffer : command_buffers) {
+    State().etc2.ReleaseCommandBuffer(command_buffer);
+  }
+}
+
+void PrepareEtc2Submit2(std::uint32_t submit_count,
+                        const VkSubmitInfo2* submits) {
+  if (submits == nullptr) {
+    return;
+  }
+  for (std::uint32_t index = 0; index < submit_count; ++index) {
+    for (std::uint32_t info = 0; info < submits[index].commandBufferInfoCount;
+         ++info) {
+      State().etc2.PrepareSubmit(
+          &submits[index].pCommandBufferInfos[info].commandBuffer, 1);
+    }
+  }
+}
+
 }  // namespace

 extern "C" {
@@ -1247,7 +1396,7 @@ vkGetInstanceProcAddr(VkInstance instance, const char* name) {
  }
  if (const PFN_vkVoidFunction adapter = AdapterProc(name);
      adapter != nullptr) {
-    if (IsDeviceAdapterProc(name) &&
+    if ((IsDeviceAdapterProc(name) || IsEtc2PhysicalDeviceProc(name)) &&
        HostInstanceProc(instance, name) == nullptr) {
      return nullptr;
    }
@@ -1306,6 +1455,30 @@ VKAPI_ATTR VkResult VKAPI_CALL vkCreateDevice(

  VkDeviceCreateInfo host_info = *create_info;
  EnabledDeviceFeatures enabled = InspectEnabledFeatures(*create_info);
+  const bool etc2_emulated = State().etc2.PhysicalDeviceNeedsEmulation(
+      physical_device, reinterpret_cast<PFN_vkGetPhysicalDeviceFeatures>(
+                           HostInstanceProc(instance,
+                                            "vkGetPhysicalDeviceFeatures")));
+  VkPhysicalDeviceFeatures host_enabled_features{};
+  VkPhysicalDeviceFeatures2* requested_features2 = nullptr;
+  VkBool32 requested_features2_etc2 = VK_FALSE;
+  if (etc2_emulated) {
+    enabled.root.features.textureCompressionETC2 = VK_FALSE;
+    if (create_info->pEnabledFeatures != nullptr) {
+      host_enabled_features = *create_info->pEnabledFeatures;
+      host_enabled_features.textureCompressionETC2 = VK_FALSE;
+      host_info.pEnabledFeatures = &host_enabled_features;
+    }
+    // Restore the caller-owned feature bit after the host call.
+    requested_features2 = const_cast<VkPhysicalDeviceFeatures2*>(
+        reinterpret_cast<const VkPhysicalDeviceFeatures2*>(FindFeature(
+            create_info->pNext, VK_STRUCTURE_TYPE_PHYSICAL_DEVICE_FEATURES_2)));
+    if (requested_features2 != nullptr) {
+      requested_features2_etc2 =
+          requested_features2->features.textureCompressionETC2;
+      requested_features2->features.textureCompressionETC2 = VK_FALSE;
+    }
+  }
  enabled.root.pNext = &enabled.vulkan11;
  enabled.vulkan11.pNext = &enabled.vulkan12;
  enabled.vulkan12.pNext = nullptr;
@@ -1341,11 +1514,25 @@ VKAPI_ATTR VkResult VKAPI_CALL vkCreateDevice(

  const VkResult result =
      host_create(physical_device, &host_info, allocator, device);
+  if (requested_features2 != nullptr) {
+    requested_features2->features.textureCompressionETC2 =
+        requested_features2_etc2;
+  }
  if (result != VK_SUCCESS) {
    return result;
  }
  RegisterHostDeviceDispatch(*device, physical_device,
                             host_get_device_proc_addr);
+  VkPhysicalDeviceMemoryProperties memory_properties{};
+  if (const auto host_memory_properties =
+          reinterpret_cast<PFN_vkGetPhysicalDeviceMemoryProperties>(
+              HostInstanceProc(instance,
+                               "vkGetPhysicalDeviceMemoryProperties"));
+      host_memory_properties != nullptr) {
+    host_memory_properties(physical_device, &memory_properties);
+  }
+  State().etc2.RegisterDevice(*device, physical_device, etc2_emulated,
+                              memory_properties, host_get_device_proc_addr);

  std::uint32_t queue_family_count = 0;
  const auto host_get_queue_families =
@@ -1403,6 +1590,7 @@ vkDestroyDevice(VkDevice device, const VkAllocationCallbacks* allocator) {
  const auto host_destroy = reinterpret_cast<PFN_vkDestroyDevice>(
      HostDeviceProc(device, "vkDestroyDevice"));
  State().text_overlay.DestroyDevice(device);
+  State().etc2.DestroyDevice(device);
  if (host_destroy != nullptr) {
    host_destroy(device, allocator);
  }
@@ -1650,6 +1838,7 @@ VKAPI_ATTR VkResult VKAPI_CALL vkResetCommandPool(
    observation.SetResult(VK_ERROR_INITIALIZATION_FAILED);
    return VK_ERROR_INITIALIZATION_FAILED;
  }
+  ReleaseEtc2PoolCommandBuffers(device, command_pool);
  const VkResult result = host_reset(device, command_pool, flags);
  observation.SetResult(result);
  return result;
@@ -1706,6 +1895,11 @@ VKAPI_ATTR void VKAPI_CALL vkFreeCommandBuffers(
    observation.SetResult(VK_ERROR_INITIALIZATION_FAILED);
    return;
  }
+  if (command_buffers != nullptr) {
+    for (std::uint32_t index = 0; index < command_buffer_count; ++index) {
+      State().etc2.ReleaseCommandBuffer(command_buffers[index]);
+    }
+  }
  host_free(device, command_pool, command_buffer_count, command_buffers);
  RemoveHostCommandBuffers(device, command_pool, command_buffer_count,
                           command_buffers);
@@ -1722,6 +1916,7 @@ VKAPI_ATTR void VKAPI_CALL vkDestroyCommandPool(
    observation.SetResult(VK_ERROR_INITIALIZATION_FAILED);
    return;
  }
+  ReleaseEtc2PoolCommandBuffers(device, command_pool);
  host_destroy(device, command_pool, allocator);
  RemoveHostCommandPoolBindings(device, command_pool);
  observation.SetResult(VK_SUCCESS);
@@ -1737,6 +1932,7 @@ VKAPI_ATTR VkResult VKAPI_CALL vkBeginCommandBuffer(
    observation.SetResult(VK_ERROR_INITIALIZATION_FAILED);
    return VK_ERROR_INITIALIZATION_FAILED;
  }
+  State().etc2.ReleaseCommandBuffer(command_buffer);
  const VkResult result = host_begin(command_buffer, begin_info);
  observation.SetResult(result);
  return result;
@@ -1765,6 +1961,7 @@ VKAPI_ATTR VkResult VKAPI_CALL vkResetCommandBuffer(
    observation.SetResult(VK_ERROR_INITIALIZATION_FAILED);
    return VK_ERROR_INITIALIZATION_FAILED;
  }
+  State().etc2.ReleaseCommandBuffer(command_buffer);
  const VkResult result = host_reset(command_buffer, flags);
  observation.SetResult(result);
  return result;
@@ -1801,6 +1998,12 @@ VKAPI_ATTR VkResult VKAPI_CALL vkQueueSubmit(
    observation.SetResult(VK_ERROR_INITIALIZATION_FAILED);
    return VK_ERROR_INITIALIZATION_FAILED;
  }
+  if (submits != nullptr) {
+    for (std::uint32_t index = 0; index < submit_count; ++index) {
+      State().etc2.PrepareSubmit(submits[index].pCommandBuffers,
+                                 submits[index].commandBufferCount);
+    }
+  }
  const VkResult result = State().text_overlay.QueueSubmit(
      queue, submit_count, submits, fence, host_submit);
  observation.SetResult(result);
@@ -1817,6 +2020,7 @@ VKAPI_ATTR VkResult VKAPI_CALL vkQueueSubmit2(
    observation.SetResult(VK_ERROR_INITIALIZATION_FAILED);
    return VK_ERROR_INITIALIZATION_FAILED;
  }
+  PrepareEtc2Submit2(submit_count, submits);
  const VkResult result = State().text_overlay.QueueSubmit2(
      queue, submit_count, submits, fence, host_submit);
  observation.SetResult(result);
@@ -1833,6 +2037,7 @@ VKAPI_ATTR VkResult VKAPI_CALL vkQueueSubmit2KHR(
    observation.SetResult(VK_ERROR_INITIALIZATION_FAILED);
    return VK_ERROR_INITIALIZATION_FAILED;
  }
+  PrepareEtc2Submit2(submit_count, submits);
  const VkResult result = State().text_overlay.QueueSubmit2(
      queue, submit_count, submits, fence,
      reinterpret_cast<PFN_vkQueueSubmit2>(host_submit));
@@ -2025,4 +2230,250 @@ vkQueuePresentKHR(VkQueue queue, const VkPresentInfoKHR* present_info) {
  return normalized_result;
 }

+VKAPI_ATTR void VKAPI_CALL vkGetPhysicalDeviceFeatures(
+    VkPhysicalDevice physical_device, VkPhysicalDeviceFeatures* features) {
+  const auto host = HostPhysicalDeviceProc<PFN_vkGetPhysicalDeviceFeatures>(
+      "vkGetPhysicalDeviceFeatures", nullptr);
+  if (host == nullptr || features == nullptr) {
+    return;
+  }
+  host(physical_device, features);
+  if (Etc2EmulatedPhysicalDevice(physical_device) &&
+      mocktail::graphics::Etc2SupportAdvertised()) {
+    features->textureCompressionETC2 = VK_TRUE;
+  }
+}
+
+VKAPI_ATTR void VKAPI_CALL vkGetPhysicalDeviceFeatures2(
+    VkPhysicalDevice physical_device, VkPhysicalDeviceFeatures2* features) {
+  const auto host = HostPhysicalDeviceProc<PFN_vkGetPhysicalDeviceFeatures2>(
+      "vkGetPhysicalDeviceFeatures2", "vkGetPhysicalDeviceFeatures2KHR");
+  if (host == nullptr || features == nullptr) {
+    return;
+  }
+  host(physical_device, features);
+  if (Etc2EmulatedPhysicalDevice(physical_device) &&
+      mocktail::graphics::Etc2SupportAdvertised()) {
+    features->features.textureCompressionETC2 = VK_TRUE;
+  }
+}
+
+VKAPI_ATTR void VKAPI_CALL vkGetPhysicalDeviceFormatProperties(
+    VkPhysicalDevice physical_device, VkFormat format,
+    VkFormatProperties* properties) {
+  const auto host =
+      HostPhysicalDeviceProc<PFN_vkGetPhysicalDeviceFormatProperties>(
+          "vkGetPhysicalDeviceFormatProperties", nullptr);
+  if (host == nullptr || properties == nullptr) {
+    return;
+  }
+  mocktail::graphics::Etc2EmulatedFormat mapped;
+  if (!mocktail::graphics::LookupEmulatedEtc2Format(format, &mapped) ||
+      !Etc2EmulatedPhysicalDevice(physical_device)) {
+    host(physical_device, format, properties);
+    return;
+  }
+  host(physical_device, mapped.host_format, properties);
+  properties->linearTilingFeatures = 0;
+  properties->optimalTilingFeatures =
+      mocktail::graphics::EmulatedEtc2FormatFeatures(
+          properties->optimalTilingFeatures);
+  properties->bufferFeatures = 0;
+}
+
+VKAPI_ATTR void VKAPI_CALL vkGetPhysicalDeviceFormatProperties2(
+    VkPhysicalDevice physical_device, VkFormat format,
+    VkFormatProperties2* properties) {
+  const auto host =
+      HostPhysicalDeviceProc<PFN_vkGetPhysicalDeviceFormatProperties2>(
+          "vkGetPhysicalDeviceFormatProperties2",
+          "vkGetPhysicalDeviceFormatProperties2KHR");
+  if (host == nullptr || properties == nullptr) {
+    return;
+  }
+  mocktail::graphics::Etc2EmulatedFormat mapped;
+  if (!mocktail::graphics::LookupEmulatedEtc2Format(format, &mapped) ||
+      !Etc2EmulatedPhysicalDevice(physical_device)) {
+    host(physical_device, format, properties);
+    return;
+  }
+  host(physical_device, mapped.host_format, properties);
+  VkFormatProperties& base = properties->formatProperties;
+  base.linearTilingFeatures = 0;
+  base.optimalTilingFeatures =
+      mocktail::graphics::EmulatedEtc2FormatFeatures(base.optimalTilingFeatures);
+  base.bufferFeatures = 0;
+  if (auto* extended = const_cast<VkFormatProperties3*>(
+          reinterpret_cast<const VkFormatProperties3*>(FindFeature(
+              properties->pNext, VK_STRUCTURE_TYPE_FORMAT_PROPERTIES_3)));
+      extended != nullptr) {
+    extended->linearTilingFeatures = 0;
+    extended->optimalTilingFeatures =
+        mocktail::graphics::EmulatedEtc2FormatFeatures(
+            static_cast<VkFormatFeatureFlags>(
+                extended->optimalTilingFeatures));
+    extended->bufferFeatures = 0;
+  }
+}
+
+VKAPI_ATTR VkResult VKAPI_CALL vkGetPhysicalDeviceImageFormatProperties(
+    VkPhysicalDevice physical_device, VkFormat format, VkImageType type,
+    VkImageTiling tiling, VkImageUsageFlags usage, VkImageCreateFlags flags,
+    VkImageFormatProperties* properties) {
+  const auto host =
+      HostPhysicalDeviceProc<PFN_vkGetPhysicalDeviceImageFormatProperties>(
+          "vkGetPhysicalDeviceImageFormatProperties", nullptr);
+  if (host == nullptr) {
+    return VK_ERROR_INITIALIZATION_FAILED;
+  }
+  mocktail::graphics::Etc2EmulatedFormat mapped;
+  if (!mocktail::graphics::LookupEmulatedEtc2Format(format, &mapped) ||
+      !Etc2EmulatedPhysicalDevice(physical_device)) {
+    return host(physical_device, format, type, tiling, usage, flags,
+                properties);
+  }
+  if (tiling != VK_IMAGE_TILING_OPTIMAL || type != VK_IMAGE_TYPE_2D) {
+    return VK_ERROR_FORMAT_NOT_SUPPORTED;
+  }
+  return host(physical_device, mapped.host_format, type, tiling, usage,
+              flags & ~static_cast<VkImageCreateFlags>(
+                          VK_IMAGE_CREATE_BLOCK_TEXEL_VIEW_COMPATIBLE_BIT),
+              properties);
+}
+
+VKAPI_ATTR VkResult VKAPI_CALL vkGetPhysicalDeviceImageFormatProperties2(
+    VkPhysicalDevice physical_device,
+    const VkPhysicalDeviceImageFormatInfo2* info,
+    VkImageFormatProperties2* properties) {
+  const auto host =
+      HostPhysicalDeviceProc<PFN_vkGetPhysicalDeviceImageFormatProperties2>(
+          "vkGetPhysicalDeviceImageFormatProperties2",
+          "vkGetPhysicalDeviceImageFormatProperties2KHR");
+  if (host == nullptr || info == nullptr) {
+    return VK_ERROR_INITIALIZATION_FAILED;
+  }
+  mocktail::graphics::Etc2EmulatedFormat mapped;
+  if (!mocktail::graphics::LookupEmulatedEtc2Format(info->format, &mapped) ||
+      !Etc2EmulatedPhysicalDevice(physical_device)) {
+    return host(physical_device, info, properties);
+  }
+  if (info->tiling != VK_IMAGE_TILING_OPTIMAL ||
+      info->type != VK_IMAGE_TYPE_2D) {
+    return VK_ERROR_FORMAT_NOT_SUPPORTED;
+  }
+  VkPhysicalDeviceImageFormatInfo2 host_info = *info;
+  host_info.format = mapped.host_format;
+  host_info.flags &= ~static_cast<VkImageCreateFlags>(
+      VK_IMAGE_CREATE_BLOCK_TEXEL_VIEW_COMPATIBLE_BIT);
+  return host(physical_device, &host_info, properties);
+}
+
+VKAPI_ATTR VkResult VKAPI_CALL vkCreateImage(
+    VkDevice device, const VkImageCreateInfo* create_info,
+    const VkAllocationCallbacks* allocator, VkImage* image) {
+  return State().etc2.CreateImage(device, create_info, allocator, image);
+}
+
+VKAPI_ATTR void VKAPI_CALL vkDestroyImage(
+    VkDevice device, VkImage image, const VkAllocationCallbacks* allocator) {
+  State().etc2.DestroyImage(device, image, allocator);
+}
+
+VKAPI_ATTR VkResult VKAPI_CALL vkCreateImageView(
+    VkDevice device, const VkImageViewCreateInfo* create_info,
+    const VkAllocationCallbacks* allocator, VkImageView* view) {
+  return State().etc2.CreateImageView(device, create_info, allocator, view);
+}
+
+VKAPI_ATTR VkResult VKAPI_CALL vkBindBufferMemory(VkDevice device,
+                                                  VkBuffer buffer,
+                                                  VkDeviceMemory memory,
+                                                  VkDeviceSize offset) {
+  return State().etc2.BindBufferMemory(device, buffer, memory, offset);
+}
+
+VKAPI_ATTR VkResult VKAPI_CALL vkBindBufferMemory2(
+    VkDevice device, std::uint32_t count,
+    const VkBindBufferMemoryInfo* infos) {
+  return State().etc2.BindBufferMemory2(device, count, infos);
+}
+
+VKAPI_ATTR VkResult VKAPI_CALL vkMapMemory(VkDevice device,
+                                           VkDeviceMemory memory,
+                                           VkDeviceSize offset,
+                                           VkDeviceSize size,
+                                           VkMemoryMapFlags flags,
+                                           void** data) {
+  return State().etc2.MapMemory(device, memory, offset, size, flags, data);
+}
+
+VKAPI_ATTR VkResult VKAPI_CALL vkMapMemory2(VkDevice device,
+                                            const VkMemoryMapInfo* info,
+                                            void** data) {
+  return State().etc2.MapMemory2(device, info, data);
+}
+
+VKAPI_ATTR void VKAPI_CALL vkUnmapMemory(VkDevice device,
+                                         VkDeviceMemory memory) {
+  State().etc2.UnmapMemory(device, memory);
+}
+
+VKAPI_ATTR VkResult VKAPI_CALL vkUnmapMemory2(VkDevice device,
+                                              const VkMemoryUnmapInfo* info) {
+  return State().etc2.UnmapMemory2(device, info);
+}
+
+VKAPI_ATTR void VKAPI_CALL vkFreeMemory(
+    VkDevice device, VkDeviceMemory memory,
+    const VkAllocationCallbacks* allocator) {
+  State().etc2.FreeMemory(device, memory, allocator);
+}
+
+VKAPI_ATTR void VKAPI_CALL vkDestroyBuffer(
+    VkDevice device, VkBuffer buffer, const VkAllocationCallbacks* allocator) {
+  State().etc2.DestroyBuffer(device, buffer, allocator);
+}
+
+VKAPI_ATTR void VKAPI_CALL vkCmdCopyBufferToImage(
+    VkCommandBuffer command_buffer, VkBuffer source, VkImage destination,
+    VkImageLayout layout, std::uint32_t region_count,
+    const VkBufferImageCopy* regions) {
+  State().etc2.CmdCopyBufferToImage(
+      HostDispatchForCommandBuffer(command_buffer).device, command_buffer,
+      source, destination, layout, region_count, regions);
+}
+
+VKAPI_ATTR void VKAPI_CALL vkCmdCopyBufferToImage2(
+    VkCommandBuffer command_buffer, const VkCopyBufferToImageInfo2* info) {
+  State().etc2.CmdCopyBufferToImage2(
+      HostDispatchForCommandBuffer(command_buffer).device, command_buffer,
+      info);
+}
+
+VKAPI_ATTR void VKAPI_CALL vkCmdCopyImage(
+    VkCommandBuffer command_buffer, VkImage source,
+    VkImageLayout source_layout, VkImage destination,
+    VkImageLayout destination_layout, std::uint32_t region_count,
+    const VkImageCopy* regions) {
+  State().etc2.CmdCopyImage(
+      HostDispatchForCommandBuffer(command_buffer).device, command_buffer,
+      source, source_layout, destination, destination_layout, region_count,
+      regions);
+}
+
+VKAPI_ATTR void VKAPI_CALL vkCmdCopyImage2(VkCommandBuffer command_buffer,
+                                           const VkCopyImageInfo2* info) {
+  State().etc2.CmdCopyImage2(
+      HostDispatchForCommandBuffer(command_buffer).device, command_buffer,
+      info);
+}
+
+VKAPI_ATTR void VKAPI_CALL vkCmdExecuteCommands(
+    VkCommandBuffer command_buffer, std::uint32_t count,
+    const VkCommandBuffer* secondaries) {
+  State().etc2.CmdExecuteCommands(
+      HostDispatchForCommandBuffer(command_buffer).device, command_buffer,
+      count, secondaries);
+}
+
 }  // extern "C"
@@ -0,0 +1,398 @@
+#include "mocktail/graphics/etc2_decoder.h"
+
+#include <algorithm>
+#include <array>
+#include <pthread.h>
+
+#include <atomic>
+#include <limits>
+#include <vector>
+
+namespace mocktail::graphics {
+namespace {
+
+constexpr std::array<int, 8> kDistance = {3, 6, 11, 16, 23, 32, 41, 64};
+
+// Indexed by (msb << 1) | lsb.
+constexpr int kEtc1Modifiers[8][4] = {
+    {2, 8, -2, -8},     {5, 17, -5, -17},   {9, 29, -9, -29},
+    {13, 42, -13, -42}, {18, 60, -18, -60}, {24, 80, -24, -80},
+    {33, 106, -33, -106}, {47, 183, -47, -183},
+};
+
+constexpr int kEacModifiers[16][8] = {
+    {-3, -6, -9, -15, 2, 5, 8, 14},  {-3, -7, -10, -13, 2, 6, 9, 12},
+    {-2, -5, -8, -13, 1, 4, 7, 12},  {-2, -4, -6, -13, 1, 3, 5, 12},
+    {-3, -6, -8, -12, 2, 5, 7, 11},  {-3, -7, -9, -11, 2, 6, 8, 10},
+    {-4, -7, -8, -11, 3, 6, 7, 10},  {-3, -5, -8, -11, 2, 4, 7, 10},
+    {-2, -6, -8, -10, 1, 5, 7, 9},   {-2, -5, -8, -10, 1, 4, 7, 9},
+    {-2, -4, -8, -10, 1, 3, 7, 9},   {-2, -5, -7, -10, 1, 4, 6, 9},
+    {-3, -4, -7, -10, 2, 3, 6, 9},   {-1, -2, -3, -10, 0, 1, 2, 9},
+    {-4, -6, -8, -9, 3, 5, 7, 8},    {-3, -5, -7, -9, 2, 4, 6, 8},
+};
+
+std::uint8_t Clamp255(int value) {
+  return static_cast<std::uint8_t>(std::clamp(value, 0, 255));
+}
+
+int Expand4(int value) { return (value << 4) | value; }
+int Expand5(int value) { return (value << 3) | (value >> 2); }
+int Expand6(int value) { return (value << 2) | (value >> 4); }
+int Expand7(int value) { return (value << 1) | (value >> 6); }
+
+// Texels use column-major indexing: x * 4 + y.
+void DecodeRgbBlock(const std::uint8_t* b, bool punchthrough,
+                    std::array<std::uint8_t, 64>* out) {
+  static constexpr int kDelta[8] = {0, 1, 2, 3, -4, -3, -2, -1};
+  const bool diff_or_opaque = (b[3] & 2) != 0;
+  const bool opaque = !punchthrough || diff_or_opaque;
+  const int msb = (b[4] << 8) | b[5];
+  const int lsb = (b[6] << 8) | b[7];
+  auto index_of = [msb, lsb](int texel) {
+    return (((msb >> texel) & 1) << 1) | ((lsb >> texel) & 1);
+  };
+  auto write = [out](int texel, int r, int g, int bl, int a) {
+    const std::size_t o = static_cast<std::size_t>(texel) * 4;
+    (*out)[o] = Clamp255(r);
+    (*out)[o + 1] = Clamp255(g);
+    (*out)[o + 2] = Clamp255(bl);
+    (*out)[o + 3] = static_cast<std::uint8_t>(a);
+  };
+
+  const int r_sum = (b[0] >> 3) + kDelta[b[0] & 7];
+  const int g_sum = (b[1] >> 3) + kDelta[b[1] & 7];
+  const int b_sum = (b[2] >> 3) + kDelta[b[2] & 7];
+  const bool individual = !punchthrough && !diff_or_opaque;
+
+  if (!individual && (r_sum < 0 || r_sum > 31 || g_sum < 0 || g_sum > 31)) {
+    std::array<std::array<int, 3>, 4> paint{};
+    if (r_sum < 0 || r_sum > 31) {
+      const std::array<int, 3> c1 = {
+          Expand4((((b[0] >> 3) & 3) << 2) | (b[0] & 3)),
+          Expand4(b[1] >> 4), Expand4(b[1] & 15)};
+      const std::array<int, 3> c2 = {Expand4(b[2] >> 4), Expand4(b[2] & 15),
+                                     Expand4(b[3] >> 4)};
+      const int d = kDistance[(((b[3] >> 2) & 3) << 1) | (b[3] & 1)];
+      for (int c = 0; c < 3; ++c) {
+        paint[0][c] = c1[c];
+        paint[1][c] = c2[c] + d;
+        paint[2][c] = c2[c];
+        paint[3][c] = c2[c] - d;
+      }
+    } else {
+      const std::array<int, 3> c1 = {
+          Expand4((b[0] >> 3) & 15),
+          Expand4(((b[0] & 7) << 1) | ((b[1] >> 4) & 1)),
+          Expand4((b[1] & 8) | ((b[1] & 3) << 1) | (b[2] >> 7))};
+      const std::array<int, 3> c2 = {
+          Expand4((b[2] >> 3) & 15), Expand4(((b[2] & 7) << 1) | (b[3] >> 7)),
+          Expand4((b[3] >> 3) & 15)};
+      const int v1 = (c1[0] << 16) | (c1[1] << 8) | c1[2];
+      const int v2 = (c2[0] << 16) | (c2[1] << 8) | c2[2];
+      const int d =
+          kDistance[(b[3] & 4) | ((b[3] & 1) << 1) | (v1 >= v2 ? 1 : 0)];
+      for (int c = 0; c < 3; ++c) {
+        paint[0][c] = c1[c] + d;
+        paint[1][c] = c1[c] - d;
+        paint[2][c] = c2[c] + d;
+        paint[3][c] = c2[c] - d;
+      }
+    }
+    for (int texel = 0; texel < 16; ++texel) {
+      const int index = index_of(texel);
+      if (!opaque && index == 2) {
+        write(texel, 0, 0, 0, 0);
+      } else {
+        write(texel, paint[index][0], paint[index][1], paint[index][2], 255);
+      }
+    }
+    return;
+  }
+
+  if (!individual && (b_sum < 0 || b_sum > 31)) {
+    const int ro = Expand6((b[0] >> 1) & 63);
+    const int go = Expand7(((b[0] & 1) << 6) | ((b[1] >> 1) & 63));
+    const int bo = Expand6(((b[1] & 1) << 5) | (b[2] & 0x18) |
+                           ((b[2] & 3) << 1) | (b[3] >> 7));
+    const int rh = Expand6(((b[3] & 0x7c) >> 1) | (b[3] & 1));
+    const int gh = Expand7(b[4] >> 1);
+    const int bh = Expand6(((b[4] & 1) << 5) | (b[5] >> 3));
+    const int rv = Expand6(((b[5] & 7) << 3) | (b[6] >> 5));
+    const int gv = Expand7(((b[6] & 31) << 2) | (b[7] >> 6));
+    const int bv = Expand6(b[7] & 63);
+    for (int x = 0; x < 4; ++x) {
+      for (int y = 0; y < 4; ++y) {
+        write(x * 4 + y, (x * (rh - ro) + y * (rv - ro) + 4 * ro + 2) >> 2,
+              (x * (gh - go) + y * (gv - go) + 4 * go + 2) >> 2,
+              (x * (bh - bo) + y * (bv - bo) + 4 * bo + 2) >> 2, 255);
+      }
+    }
+    return;
+  }
+
+  std::array<std::array<int, 3>, 2> base{};
+  for (int c = 0; c < 3; ++c) {
+    if (individual) {
+      base[0][c] = Expand4(b[c] >> 4);
+      base[1][c] = Expand4(b[c] & 15);
+    } else {
+      base[0][c] = Expand5(b[c] >> 3);
+      base[1][c] = Expand5((b[c] >> 3) + kDelta[b[c] & 7]);
+    }
+  }
+  const int tables[2] = {b[3] >> 5, (b[3] >> 2) & 7};
+  const bool flipped = (b[3] & 1) != 0;
+  for (int x = 0; x < 4; ++x) {
+    for (int y = 0; y < 4; ++y) {
+      const int texel = x * 4 + y;
+      const int index = index_of(texel);
+      if (!opaque && index == 2) {
+        write(texel, 0, 0, 0, 0);
+        continue;
+      }
+      const int sub = flipped ? (y >= 2 ? 1 : 0) : (x >= 2 ? 1 : 0);
+      const int modifier =
+          (!opaque && index == 0) ? 0 : kEtc1Modifiers[tables[sub]][index];
+      write(texel, base[sub][0] + modifier, base[sub][1] + modifier,
+            base[sub][2] + modifier, 255);
+    }
+  }
+}
+
+int EacIndex(const std::uint8_t* b, int texel) {
+  std::uint64_t bits = 0;
+  for (int i = 2; i < 8; ++i) {
+    bits = (bits << 8) | b[i];
+  }
+  return static_cast<int>((bits >> (45 - texel * 3)) & 7);
+}
+
+int EacModifier(const std::uint8_t* b, int texel) {
+  return kEacModifiers[b[1] & 15][EacIndex(b, texel)];
+}
+
+std::uint16_t DecodeR11(const std::uint8_t* b, int texel, bool is_signed) {
+  const int multiplier = b[1] >> 4;
+  const int modifier = EacModifier(b, texel);
+  const int scaled = multiplier != 0 ? modifier * multiplier * 8 : modifier;
+  if (!is_signed) {
+    const int value = std::clamp(b[0] * 8 + 4 + scaled, 0, 2047);
+    return static_cast<std::uint16_t>((value << 5) | (value >> 6));
+  }
+  const int base = std::max(-127, static_cast<int>(static_cast<std::int8_t>(b[0])));
+  const int value = std::clamp(base * 8 + scaled, -1023, 1023);
+  const int magnitude = value < 0 ? -value : value;
+  const int expanded = (magnitude << 5) | (magnitude >> 5);
+  return static_cast<std::uint16_t>(
+      static_cast<std::int16_t>(value < 0 ? -expanded : expanded));
+}
+
+}  // namespace
+
+std::size_t EtcBlockBytes(EtcFormat format) {
+  switch (format) {
+    case EtcFormat::kEtc2Rgba8:
+    case EtcFormat::kEacRg11:
+    case EtcFormat::kEacRg11Signed:
+      return 16;
+    default:
+      return 8;
+  }
+}
+
+std::size_t EtcDecodedTexelBytes(EtcFormat format) {
+  switch (format) {
+    case EtcFormat::kEacR11:
+    case EtcFormat::kEacR11Signed:
+      return 2;
+    default:
+      return 4;
+  }
+}
+
+namespace {
+
+constexpr std::uint64_t kBlocksPerBand = 16384;
+constexpr std::uint64_t kParallelMinimumBlocks = 65536;
+
+bool ImageFits(EtcFormat format, const std::uint8_t* source,
+               std::size_t source_bytes, std::uint32_t width,
+               std::uint32_t height, const std::uint8_t* destination,
+               std::size_t destination_bytes) {
+  if (source == nullptr || destination == nullptr || width == 0 ||
+      height == 0) {
+    return false;
+  }
+  const std::uint64_t blocks_wide = (static_cast<std::uint64_t>(width) + 3) / 4;
+  const std::uint64_t blocks_high =
+      (static_cast<std::uint64_t>(height) + 3) / 4;
+  return blocks_wide * blocks_high * EtcBlockBytes(format) <= source_bytes &&
+         static_cast<std::uint64_t>(width) * height *
+                 EtcDecodedTexelBytes(format) <=
+             destination_bytes;
+}
+
+}  // namespace
+
+bool DecodeEtcImage(EtcFormat format, const std::uint8_t* source,
+                    std::size_t source_bytes, std::uint32_t width,
+                    std::uint32_t height, std::uint8_t* destination,
+                    std::size_t destination_bytes) {
+  return DecodeEtcImageBlockRows(format, source, source_bytes, width, height, 0,
+                                 (height + 3) / 4, destination,
+                                 destination_bytes);
+}
+
+namespace {
+
+struct DecodeBand {
+  EtcDecodeJob* job;
+  std::uint32_t first_block_row;
+  std::uint32_t block_row_count;
+};
+
+struct DecodeBandQueue {
+  std::vector<DecodeBand> bands;
+  std::atomic<std::size_t> next{0};
+
+  void Run() {
+    for (;;) {
+      const std::size_t index = next.fetch_add(1, std::memory_order_relaxed);
+      if (index >= bands.size()) {
+        return;
+      }
+      const DecodeBand& band = bands[index];
+      const EtcDecodeJob& job = *band.job;
+      DecodeEtcImageBlockRows(job.format, job.source, job.source_bytes,
+                              job.width, job.height, band.first_block_row,
+                              band.block_row_count, job.destination,
+                              job.destination_bytes);
+    }
+  }
+};
+
+void* RunDecodeBandQueue(void* queue) {
+  static_cast<DecodeBandQueue*>(queue)->Run();
+  return nullptr;
+}
+
+}  // namespace
+
+void DecodeEtcJobs(EtcDecodeJob* jobs, std::size_t count,
+                   unsigned worker_count) {
+  if (jobs == nullptr) {
+    return;
+  }
+  DecodeBandQueue queue;
+  std::vector<DecodeBand>& bands = queue.bands;
+  std::uint64_t total_blocks = 0;
+  for (std::size_t index = 0; index < count; ++index) {
+    EtcDecodeJob& job = jobs[index];
+    job.ok = ImageFits(job.format, job.source, job.source_bytes, job.width,
+                       job.height, job.destination, job.destination_bytes);
+    if (!job.ok) {
+      continue;
+    }
+    const std::uint32_t blocks_wide = (job.width + 3) / 4;
+    const std::uint32_t blocks_high = (job.height + 3) / 4;
+    const std::uint32_t rows_per_band = static_cast<std::uint32_t>(
+        std::max<std::uint64_t>(1, kBlocksPerBand / blocks_wide));
+    for (std::uint32_t row = 0; row < blocks_high; row += rows_per_band) {
+      bands.push_back(
+          {&job, row, std::min(rows_per_band, blocks_high - row)});
+    }
+    total_blocks += static_cast<std::uint64_t>(blocks_wide) * blocks_high;
+  }
+
+  const std::size_t threads =
+      total_blocks < kParallelMinimumBlocks
+          ? 1
+          : std::min<std::size_t>(std::max(worker_count, 1U), bands.size());
+  std::vector<pthread_t> workers;
+  workers.reserve(threads > 0 ? threads - 1 : 0);
+  for (std::size_t index = 1; index < threads; ++index) {
+    pthread_t worker;
+    if (pthread_create(&worker, nullptr, RunDecodeBandQueue, &queue) != 0) {
+      break;
+    }
+    workers.push_back(worker);
+  }
+  queue.Run();
+  for (pthread_t worker : workers) {
+    pthread_join(worker, nullptr);
+  }
+}
+
+bool DecodeEtcImageBlockRows(EtcFormat format, const std::uint8_t* source,
+                             std::size_t source_bytes, std::uint32_t width,
+                             std::uint32_t height,
+                             std::uint32_t first_block_row,
+                             std::uint32_t block_row_count,
+                             std::uint8_t* destination,
+                             std::size_t destination_bytes) {
+  if (!ImageFits(format, source, source_bytes, width, height, destination,
+                 destination_bytes)) {
+    return false;
+  }
+  const std::uint64_t blocks_wide = (static_cast<std::uint64_t>(width) + 3) / 4;
+  const std::uint64_t blocks_high =
+      (static_cast<std::uint64_t>(height) + 3) / 4;
+  if (static_cast<std::uint64_t>(first_block_row) + block_row_count >
+      blocks_high) {
+    return false;
+  }
+  const std::size_t texel_bytes = EtcDecodedTexelBytes(format);
+  const std::size_t block_bytes = EtcBlockBytes(format);
+
+  std::array<std::uint8_t, 64> rgba{};
+  const std::uint64_t end_block_row =
+      static_cast<std::uint64_t>(first_block_row) + block_row_count;
+  for (std::uint64_t by = first_block_row; by < end_block_row; ++by) {
+    for (std::uint64_t bx = 0; bx < blocks_wide; ++bx) {
+      const std::uint8_t* block =
+          source + (by * blocks_wide + bx) * block_bytes;
+      if (format == EtcFormat::kEtc2Rgb8 || format == EtcFormat::kEtc2Rgb8A1) {
+        DecodeRgbBlock(block, format == EtcFormat::kEtc2Rgb8A1, &rgba);
+      } else if (format == EtcFormat::kEtc2Rgba8) {
+        DecodeRgbBlock(block + 8, false, &rgba);
+      }
+      for (std::uint32_t y = 0; y < 4 && by * 4 + y < height; ++y) {
+        for (std::uint32_t x = 0; x < 4 && bx * 4 + x < width; ++x) {
+          const int texel = static_cast<int>(x * 4 + y);
+          std::uint8_t* out =
+              destination + ((by * 4 + y) * width + bx * 4 + x) * texel_bytes;
+          switch (format) {
+            case EtcFormat::kEtc2Rgb8:
+            case EtcFormat::kEtc2Rgb8A1:
+            case EtcFormat::kEtc2Rgba8:
+              std::copy_n(rgba.data() + texel * 4, 4, out);
+              if (format == EtcFormat::kEtc2Rgba8) {
+                const int alpha =
+                    block[0] + EacModifier(block, texel) * (block[1] >> 4);
+                out[3] = Clamp255(alpha);
+              }
+              break;
+            case EtcFormat::kEacR11:
+            case EtcFormat::kEacR11Signed:
+            case EtcFormat::kEacRg11:
+            case EtcFormat::kEacRg11Signed: {
+              const bool is_signed = format == EtcFormat::kEacR11Signed ||
+                                     format == EtcFormat::kEacRg11Signed;
+              const int channels = texel_bytes / 2;
+              for (int channel = 0; channel < channels; ++channel) {
+                const std::uint16_t value =
+                    DecodeR11(block + channel * 8, texel, is_signed);
+                out[channel * 2] = static_cast<std::uint8_t>(value);
+                out[channel * 2 + 1] = static_cast<std::uint8_t>(value >> 8);
+              }
+              break;
+            }
+          }
+        }
+      }
+    }
+  }
+  return true;
+}
+
+}  // namespace mocktail::graphics
@@ -0,0 +1,375 @@
+#include "mocktail/graphics/gles_text_overlay_compositor.h"
+
+#include <GLES3/gl3.h>
+#include <SDL3/SDL.h>
+
+#include <array>
+#include <cstdio>
+#include <vector>
+
+namespace mocktail::graphics {
+namespace {
+
+constexpr std::uint64_t kMaximumOverlayBytes = 64ULL * 1024ULL * 1024ULL;
+
+#define OVERLAY_GL_FUNCTIONS(F)                                                \
+  F(PFNGLACTIVETEXTUREPROC, ActiveTexture)                                     \
+  F(PFNGLATTACHSHADERPROC, AttachShader)                                       \
+  F(PFNGLBINDBUFFERPROC, BindBuffer)                                           \
+  F(PFNGLBINDFRAMEBUFFERPROC, BindFramebuffer)                                 \
+  F(PFNGLBINDSAMPLERPROC, BindSampler)                                         \
+  F(PFNGLBINDTEXTUREPROC, BindTexture)                                         \
+  F(PFNGLBINDVERTEXARRAYPROC, BindVertexArray)                                 \
+  F(PFNGLBLENDEQUATIONSEPARATEPROC, BlendEquationSeparate)                     \
+  F(PFNGLBLENDFUNCSEPARATEPROC, BlendFuncSeparate)                             \
+  F(PFNGLCOLORMASKPROC, ColorMask)                                             \
+  F(PFNGLCOMPILESHADERPROC, CompileShader)                                     \
+  F(PFNGLCREATEPROGRAMPROC, CreateProgram)                                     \
+  F(PFNGLCREATESHADERPROC, CreateShader)                                       \
+  F(PFNGLDELETEPROGRAMPROC, DeleteProgram)                                     \
+  F(PFNGLDELETESHADERPROC, DeleteShader)                                       \
+  F(PFNGLDELETETEXTURESPROC, DeleteTextures)                                   \
+  F(PFNGLDELETEVERTEXARRAYSPROC, DeleteVertexArrays)                           \
+  F(PFNGLDISABLEPROC, Disable)                                                 \
+  F(PFNGLDRAWARRAYSPROC, DrawArrays)                                           \
+  F(PFNGLDRAWBUFFERSPROC, DrawBuffers)                                         \
+  F(PFNGLENABLEPROC, Enable)                                                   \
+  F(PFNGLGENTEXTURESPROC, GenTextures)                                         \
+  F(PFNGLGENVERTEXARRAYSPROC, GenVertexArrays)                                 \
+  F(PFNGLGETBOOLEANVPROC, GetBooleanv)                                         \
+  F(PFNGLGETINTEGERVPROC, GetIntegerv)                                         \
+  F(PFNGLGETPROGRAMINFOLOGPROC, GetProgramInfoLog)                             \
+  F(PFNGLGETPROGRAMIVPROC, GetProgramiv)                                       \
+  F(PFNGLGETSHADERINFOLOGPROC, GetShaderInfoLog)                               \
+  F(PFNGLGETSHADERIVPROC, GetShaderiv)                                         \
+  F(PFNGLGETUNIFORMLOCATIONPROC, GetUniformLocation)                           \
+  F(PFNGLISENABLEDPROC, IsEnabled)                                             \
+  F(PFNGLLINKPROGRAMPROC, LinkProgram)                                         \
+  F(PFNGLPIXELSTOREIPROC, PixelStorei)                                         \
+  F(PFNGLSHADERSOURCEPROC, ShaderSource)                                       \
+  F(PFNGLTEXIMAGE2DPROC, TexImage2D)                                           \
+  F(PFNGLTEXPARAMETERIPROC, TexParameteri)                                     \
+  F(PFNGLUNIFORM1IPROC, Uniform1i)                                             \
+  F(PFNGLUNIFORM4FPROC, Uniform4f)                                             \
+  F(PFNGLUSEPROGRAMPROC, UseProgram)                                           \
+  F(PFNGLVIEWPORTPROC, Viewport)
+
+struct Gl {
+#define DECLARE_GL(type, name) type name = nullptr;
+  OVERLAY_GL_FUNCTIONS(DECLARE_GL)
+#undef DECLARE_GL
+
+  bool Load() {
+#define LOAD_GL(type, name)                                                    \
+  name = reinterpret_cast<type>(SDL_GL_GetProcAddress("gl" #name));            \
+  if (name == nullptr)                                                         \
+    return false;
+    OVERLAY_GL_FUNCTIONS(LOAD_GL)
+#undef LOAD_GL
+    return true;
+  }
+};
+#undef OVERLAY_GL_FUNCTIONS
+
+constexpr GLenum kCapabilities[] = {GL_BLEND,
+                                    GL_CULL_FACE,
+                                    GL_DEPTH_TEST,
+                                    GL_STENCIL_TEST,
+                                    GL_SCISSOR_TEST,
+                                    GL_RASTERIZER_DISCARD,
+                                    GL_SAMPLE_ALPHA_TO_COVERAGE,
+                                    GL_SAMPLE_COVERAGE};
+constexpr GLenum kUnpackParameters[] = {
+    GL_UNPACK_ALIGNMENT, GL_UNPACK_ROW_LENGTH, GL_UNPACK_SKIP_ROWS,
+    GL_UNPACK_SKIP_PIXELS};
+
+// Roblox caches GL state. Every binding and state changed here must be restored
+// even if a new overlay revision disappears while it is being copied.
+struct SavedGlState {
+  explicit SavedGlState(Gl &api) : gl(api) {
+    gl.GetIntegerv(GL_CURRENT_PROGRAM, &program);
+    gl.GetIntegerv(GL_VERTEX_ARRAY_BINDING, &vertex_array);
+    gl.GetIntegerv(GL_DRAW_FRAMEBUFFER_BINDING, &framebuffer);
+    gl.GetIntegerv(GL_VIEWPORT, viewport.data());
+    gl.GetIntegerv(GL_ACTIVE_TEXTURE, &active_texture);
+    gl.ActiveTexture(GL_TEXTURE0);
+    gl.GetIntegerv(GL_TEXTURE_BINDING_2D, &texture);
+    gl.GetIntegerv(GL_SAMPLER_BINDING, &sampler);
+    gl.GetIntegerv(GL_PIXEL_UNPACK_BUFFER_BINDING, &unpack_buffer);
+    for (std::size_t i = 0; i < unpack.size(); ++i) {
+      gl.GetIntegerv(kUnpackParameters[i], &unpack[i]);
+    }
+    gl.GetIntegerv(GL_BLEND_SRC_RGB, &blend_src_rgb);
+    gl.GetIntegerv(GL_BLEND_DST_RGB, &blend_dst_rgb);
+    gl.GetIntegerv(GL_BLEND_SRC_ALPHA, &blend_src_alpha);
+    gl.GetIntegerv(GL_BLEND_DST_ALPHA, &blend_dst_alpha);
+    gl.GetIntegerv(GL_BLEND_EQUATION_RGB, &blend_equation_rgb);
+    gl.GetIntegerv(GL_BLEND_EQUATION_ALPHA, &blend_equation_alpha);
+    gl.GetBooleanv(GL_COLOR_WRITEMASK, color_mask.data());
+    for (std::size_t i = 0; i < enabled.size(); ++i) {
+      enabled[i] = gl.IsEnabled(kCapabilities[i]);
+    }
+    gl.BindFramebuffer(GL_DRAW_FRAMEBUFFER, 0);
+    gl.GetIntegerv(GL_DRAW_BUFFER0, &backbuffer_draw_buffer);
+  }
+
+  ~SavedGlState() {
+    const GLenum draw_buffer = static_cast<GLenum>(backbuffer_draw_buffer);
+    gl.DrawBuffers(1, &draw_buffer);
+    gl.BindFramebuffer(GL_DRAW_FRAMEBUFFER, framebuffer);
+    gl.Viewport(viewport[0], viewport[1], viewport[2], viewport[3]);
+    gl.UseProgram(program);
+    gl.BindVertexArray(vertex_array);
+    gl.BindTexture(GL_TEXTURE_2D, texture);
+    gl.BindSampler(0, sampler);
+    gl.ActiveTexture(active_texture);
+    gl.BindBuffer(GL_PIXEL_UNPACK_BUFFER, unpack_buffer);
+    for (std::size_t i = 0; i < unpack.size(); ++i) {
+      gl.PixelStorei(kUnpackParameters[i], unpack[i]);
+    }
+    gl.BlendFuncSeparate(blend_src_rgb, blend_dst_rgb, blend_src_alpha,
+                         blend_dst_alpha);
+    gl.BlendEquationSeparate(blend_equation_rgb, blend_equation_alpha);
+    gl.ColorMask(color_mask[0], color_mask[1], color_mask[2], color_mask[3]);
+    for (std::size_t i = 0; i < enabled.size(); ++i) {
+      (enabled[i] ? gl.Enable : gl.Disable)(kCapabilities[i]);
+    }
+  }
+
+  Gl &gl;
+  GLint program = 0, vertex_array = 0, framebuffer = 0;
+  GLint active_texture = GL_TEXTURE0, texture = 0, sampler = 0;
+  GLint unpack_buffer = 0, backbuffer_draw_buffer = GL_BACK;
+  GLint blend_src_rgb = 0, blend_dst_rgb = 0;
+  GLint blend_src_alpha = 0, blend_dst_alpha = 0;
+  GLint blend_equation_rgb = 0, blend_equation_alpha = 0;
+  std::array<GLint, 4> viewport{}, unpack{};
+  std::array<GLboolean, 4> color_mask{};
+  std::array<GLboolean, sizeof(kCapabilities) / sizeof(kCapabilities[0])>
+      enabled{};
+};
+
+struct PixelCopy {
+  explicit PixelCopy(std::size_t bytes) : pixels(bytes) {}
+  ~PixelCopy() {
+    volatile std::uint8_t *bytes = pixels.data();
+    for (std::size_t i = 0; i < pixels.size(); ++i)
+      bytes[i] = 0;
+  }
+  std::vector<std::uint8_t> pixels;
+};
+
+bool ValidFrame(const MocktailTextOverlayFrameInfo &frame) {
+  const std::uint64_t row_bytes = std::uint64_t{frame.width} * 4;
+  const std::uint64_t bytes = row_bytes * frame.height;
+  return frame.abi_version == MocktailTextOverlayFrameInfo::kAbiVersion &&
+         frame.coordinate_width != 0 && frame.coordinate_height != 0 &&
+         frame.width != 0 && frame.height != 0 &&
+         row_bytes <= kMaximumOverlayBytes && bytes <= kMaximumOverlayBytes &&
+         frame.row_bytes == row_bytes && frame.rgba_bytes == bytes;
+}
+
+} // namespace
+
+struct GlesTextOverlayCompositor::Impl {
+  explicit Impl(GlesTextOverlaySource input) : source(input) {}
+  ~Impl() {
+    if (context != nullptr && SDL_GL_GetCurrentContext() == context) {
+      if (texture != 0)
+        gl.DeleteTextures(1, &texture);
+      if (vertex_array != 0)
+        gl.DeleteVertexArrays(1, &vertex_array);
+      if (program != 0)
+        gl.DeleteProgram(program);
+    }
+  }
+
+  bool Fail(const char *message) {
+    if (!failure_logged) {
+      std::fprintf(stderr, "  [gles-overlay] %s\n", message);
+      failure_logged = true;
+    }
+    return false;
+  }
+
+  GLuint Compile(GLenum type, const char *code) {
+    const GLuint shader = gl.CreateShader(type);
+    if (shader == 0)
+      return 0;
+    gl.ShaderSource(shader, 1, &code, nullptr);
+    gl.CompileShader(shader);
+    GLint compiled = GL_FALSE;
+    gl.GetShaderiv(shader, GL_COMPILE_STATUS, &compiled);
+    if (compiled == GL_TRUE)
+      return shader;
+    char log[1024]{};
+    gl.GetShaderInfoLog(shader, sizeof(log), nullptr, log);
+    Fail(log);
+    gl.DeleteShader(shader);
+    return 0;
+  }
+
+  bool CreateResources() {
+    constexpr const char *vertex_source = R"(#version 300 es
+precision highp float;
+uniform vec4 bounds;
+out vec2 uv;
+void main() {
+  vec2 corners[4] = vec2[4](vec2(0, 0), vec2(1, 0),
+                            vec2(0, 1), vec2(1, 1));
+  uv = corners[gl_VertexID];
+  gl_Position = vec4(mix(bounds.xy, bounds.zw, uv), 0, 1);
+}
+)";
+    constexpr const char *fragment_source = R"(#version 300 es
+precision mediump float;
+uniform sampler2D image;
+in vec2 uv;
+out vec4 color;
+void main() { color = texture(image, uv); }
+)";
+    const GLuint vertex = Compile(GL_VERTEX_SHADER, vertex_source);
+    const GLuint fragment = Compile(GL_FRAGMENT_SHADER, fragment_source);
+    if (vertex == 0 || fragment == 0) {
+      if (vertex != 0)
+        gl.DeleteShader(vertex);
+      if (fragment != 0)
+        gl.DeleteShader(fragment);
+      return false;
+    }
+    program = gl.CreateProgram();
+    if (program != 0) {
+      gl.AttachShader(program, vertex);
+      gl.AttachShader(program, fragment);
+      gl.LinkProgram(program);
+    }
+    gl.DeleteShader(vertex);
+    gl.DeleteShader(fragment);
+    GLint linked = GL_FALSE;
+    if (program != 0)
+      gl.GetProgramiv(program, GL_LINK_STATUS, &linked);
+    if (linked != GL_TRUE) {
+      char log[1024] = "unable to create the GLES text program";
+      if (program != 0)
+        gl.GetProgramInfoLog(program, sizeof(log), nullptr, log);
+      return Fail(log);
+    }
+    bounds_location = gl.GetUniformLocation(program, "bounds");
+    image_location = gl.GetUniformLocation(program, "image");
+    gl.GenVertexArrays(1, &vertex_array);
+    gl.GenTextures(1, &texture);
+    gl.GetIntegerv(GL_MAX_TEXTURE_SIZE, &max_texture_size);
+    return vertex_array != 0 && texture != 0 && bounds_location >= 0 &&
+           image_location >= 0;
+  }
+
+  GlesTextOverlaySource source;
+  Gl gl;
+  SDL_GLContext context = nullptr;
+  GLuint program = 0, vertex_array = 0, texture = 0;
+  GLint bounds_location = -1, image_location = -1, max_texture_size = 0;
+  bool initialized = false, failed = false, failure_logged = false;
+  bool uploaded = false, ready_logged = false;
+  std::uint64_t revision = 0;
+  std::uint32_t width = 0, height = 0;
+};
+
+GlesTextOverlayCompositor::GlesTextOverlayCompositor(
+    GlesTextOverlaySource source)
+    : impl_(std::make_unique<Impl>(source)) {}
+GlesTextOverlayCompositor::~GlesTextOverlayCompositor() = default;
+
+bool GlesTextOverlayCompositor::Draw(SDL_Window *window) {
+  Impl &state = *impl_;
+  const GlesTextOverlaySource &source = state.source;
+  if (source.may_present != nullptr && !source.may_present())
+    return true;
+  if (source.query == nullptr || source.copy == nullptr)
+    return true;
+  MocktailTextOverlayFrameInfo frame{};
+  if (!source.query(&frame) || frame.visible == 0)
+    return true;
+  if (!ValidFrame(frame))
+    return state.Fail("invalid text overlay frame");
+  int pixel_width = 0, pixel_height = 0;
+  if (window == nullptr ||
+      !SDL_GetWindowSizeInPixels(window, &pixel_width, &pixel_height) ||
+      pixel_width <= 0 || pixel_height <= 0)
+    return false;
+  if (state.failed)
+    return false;
+  if (!state.initialized) {
+    state.context = SDL_GL_GetCurrentContext();
+    if (state.context == nullptr || !state.gl.Load()) {
+      state.failed = true;
+      return state.Fail("OpenGL ES 3.0 functions are unavailable");
+    }
+  } else if (SDL_GL_GetCurrentContext() != state.context) {
+    return state.Fail("text overlay called with a different GL context");
+  }
+  Gl &gl = state.gl;
+  SavedGlState saved(gl);
+  if (!state.initialized) {
+    if (!state.CreateResources()) {
+      state.failed = true;
+      return state.Fail("unable to initialize the GLES text overlay");
+    }
+    state.initialized = true;
+  }
+  if (frame.width > static_cast<std::uint32_t>(state.max_texture_size) ||
+      frame.height > static_cast<std::uint32_t>(state.max_texture_size)) {
+    return state.Fail("text overlay exceeds GL_MAX_TEXTURE_SIZE");
+  }
+  gl.BindTexture(GL_TEXTURE_2D, state.texture);
+  gl.BindSampler(0, 0);
+  if (!state.uploaded || state.revision != frame.revision ||
+      state.width != frame.width || state.height != frame.height) {
+    PixelCopy copy(static_cast<std::size_t>(frame.rgba_bytes));
+    if (!source.copy(frame.revision, copy.pixels.data(), copy.pixels.size())) {
+      return false;
+    }
+    gl.BindBuffer(GL_PIXEL_UNPACK_BUFFER, 0);
+    gl.PixelStorei(GL_UNPACK_ALIGNMENT, 1);
+    gl.PixelStorei(GL_UNPACK_ROW_LENGTH, 0);
+    gl.PixelStorei(GL_UNPACK_SKIP_ROWS, 0);
+    gl.PixelStorei(GL_UNPACK_SKIP_PIXELS, 0);
+    gl.TexImage2D(GL_TEXTURE_2D, 0, GL_RGBA8, frame.width, frame.height, 0,
+                  GL_RGBA, GL_UNSIGNED_BYTE, copy.pixels.data());
+    gl.TexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
+    gl.TexParameteri(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
+    gl.TexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE);
+    gl.TexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE);
+    state.revision = frame.revision;
+    state.width = frame.width;
+    state.height = frame.height;
+    state.uploaded = true;
+  }
+  for (GLenum capability : kCapabilities)
+    gl.Disable(capability);
+  gl.Enable(GL_BLEND);
+  gl.BlendEquationSeparate(GL_FUNC_ADD, GL_FUNC_ADD);
+  gl.BlendFuncSeparate(GL_SRC_ALPHA, GL_ONE_MINUS_SRC_ALPHA, GL_ONE,
+                       GL_ONE_MINUS_SRC_ALPHA);
+  gl.ColorMask(GL_TRUE, GL_TRUE, GL_TRUE, GL_TRUE);
+  const GLenum back = GL_BACK;
+  gl.DrawBuffers(1, &back);
+  gl.Viewport(0, 0, pixel_width, pixel_height);
+  gl.UseProgram(state.program);
+  gl.BindVertexArray(state.vertex_array);
+  gl.Uniform1i(state.image_location, 0);
+  const double x_scale = 2.0 / frame.coordinate_width;
+  const double y_scale = 2.0 / frame.coordinate_height;
+  gl.Uniform4f(state.bounds_location, frame.x * x_scale - 1.0,
+               1.0 - frame.y * y_scale,
+               (static_cast<double>(frame.x) + frame.width) * x_scale - 1.0,
+               1.0 - (static_cast<double>(frame.y) + frame.height) * y_scale);
+  gl.DrawArrays(GL_TRIANGLE_STRIP, 0, 4);
+  if (!state.ready_logged) {
+    std::fprintf(stderr,
+                 "  [gles-overlay] same-surface TextBox compositor ready\n");
+    state.ready_logged = true;
+  }
+  return true;
+}
+
+} // namespace mocktail::graphics
@@ -0,0 +1,182 @@
+#include "mocktail/graphics/texture_override.h"
+
+#include <png.h>
+
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <filesystem>
+
+namespace mocktail::graphics {
+
+std::uint64_t HashBytes(const std::uint8_t* data, std::size_t size) {
+  std::uint64_t hash = 0xcbf29ce484222325ULL;
+  for (std::size_t index = 0; index < size; ++index) {
+    hash ^= data[index];
+    hash *= 0x100000001b3ULL;
+  }
+  return hash;
+}
+
+std::string HashName(std::uint64_t hash) {
+  char text[17];
+  std::snprintf(text, sizeof(text), "%016llx",
+                static_cast<unsigned long long>(hash));
+  return text;
+}
+
+bool ReadPngRgba(const std::string& path, RgbaImage* image) {
+  if (image == nullptr) {
+    return false;
+  }
+  png_image png{};
+  png.version = PNG_IMAGE_VERSION;
+  if (png_image_begin_read_from_file(&png, path.c_str()) == 0) {
+    return false;
+  }
+  png.format = PNG_FORMAT_RGBA;
+  RgbaImage result;
+  result.width = png.width;
+  result.height = png.height;
+  result.pixels.resize(PNG_IMAGE_SIZE(png));
+  if (png_image_finish_read(&png, nullptr, result.pixels.data(), 0,
+                            nullptr) == 0) {
+    png_image_free(&png);
+    return false;
+  }
+  *image = std::move(result);
+  return true;
+}
+
+bool WritePngRgba(const std::string& path, const RgbaImage& image) {
+  if (image.width == 0 || image.height == 0 ||
+      image.pixels.size() !=
+          static_cast<std::size_t>(image.width) * image.height * 4) {
+    return false;
+  }
+  png_image png{};
+  png.version = PNG_IMAGE_VERSION;
+  png.width = image.width;
+  png.height = image.height;
+  png.format = PNG_FORMAT_RGBA;
+  const int written = png_image_write_to_file(&png, path.c_str(), 0,
+                                              image.pixels.data(), 0, nullptr);
+  png_image_free(&png);
+  return written != 0;
+}
+
+void ResampleRgba(const RgbaImage& source, std::uint32_t width,
+                  std::uint32_t height, std::uint8_t* destination) {
+  if (source.pixels.size() <
+      static_cast<std::size_t>(source.width) * source.height * 4) {
+    return;
+  }
+  ResampleRgba(source.pixels.data(), source.width, source.height, width,
+               height, destination);
+}
+
+void ResampleRgba(const std::uint8_t* source, std::uint32_t source_width,
+                  std::uint32_t source_height, std::uint32_t width,
+                  std::uint32_t height, std::uint8_t* destination) {
+  if (source == nullptr || destination == nullptr || width == 0 ||
+      height == 0 || source_width == 0 || source_height == 0) {
+    return;
+  }
+  for (std::uint32_t y = 0; y < height; ++y) {
+    const std::uint64_t y0 = static_cast<std::uint64_t>(y) * source_height / height;
+    std::uint64_t y1 =
+        (static_cast<std::uint64_t>(y) + 1) * source_height / height;
+    if (y1 <= y0) {
+      y1 = y0 + 1;
+    }
+    for (std::uint32_t x = 0; x < width; ++x) {
+      const std::uint64_t x0 = static_cast<std::uint64_t>(x) * source_width / width;
+      std::uint64_t x1 =
+          (static_cast<std::uint64_t>(x) + 1) * source_width / width;
+      if (x1 <= x0) {
+        x1 = x0 + 1;
+      }
+      std::uint64_t sum[4] = {0, 0, 0, 0};
+      for (std::uint64_t sy = y0; sy < y1; ++sy) {
+        for (std::uint64_t sx = x0; sx < x1; ++sx) {
+          const std::uint8_t* pixel = source + (sy * source_width + sx) * 4;
+          for (int channel = 0; channel < 4; ++channel) {
+            sum[channel] += pixel[channel];
+          }
+        }
+      }
+      const std::uint64_t count = (y1 - y0) * (x1 - x0);
+      std::uint8_t* out = destination + (static_cast<std::size_t>(y) * width + x) * 4;
+      for (int channel = 0; channel < 4; ++channel) {
+        out[channel] =
+            static_cast<std::uint8_t>((sum[channel] + count / 2) / count);
+      }
+    }
+  }
+}
+
+namespace {
+
+std::string EnvironmentString(const char* name) {
+  const char* value = std::getenv(name);
+  return value != nullptr ? value : "";
+}
+
+}  // namespace
+
+TextureOverrides::TextureOverrides(std::string override_dir,
+                                   std::string dump_dir)
+    : override_dir_(std::move(override_dir)), dump_dir_(std::move(dump_dir)) {}
+
+TextureOverrides TextureOverrides::FromEnvironment() {
+  return TextureOverrides(EnvironmentString("MOCKTAIL_TEXTURE_OVERRIDE_DIR"),
+                          EnvironmentString("MOCKTAIL_TEXTURE_DUMP_DIR"));
+}
+
+std::shared_ptr<const RgbaImage> TextureOverrides::Lookup(std::uint64_t hash) {
+  if (override_dir_.empty()) {
+    return nullptr;
+  }
+  std::lock_guard<std::mutex> lock(mutex_);
+  const auto cached = cache_.find(hash);
+  if (cached != cache_.end()) {
+    return cached->second;
+  }
+  std::shared_ptr<const RgbaImage> loaded;
+  RgbaImage image;
+  const std::string path = override_dir_ + "/" + HashName(hash) + ".png";
+  if (ReadPngRgba(path, &image) && image.width > 0 && image.height > 0) {
+    loaded = std::make_shared<const RgbaImage>(std::move(image));
+    std::fprintf(stderr, "  [vulkan] texture override loaded: %s (%ux%u)\n",
+                 path.c_str(), loaded->width, loaded->height);
+  }
+  cache_[hash] = loaded;
+  return loaded;
+}
+
+void TextureOverrides::Dump(std::uint64_t hash, std::uint32_t width,
+                            std::uint32_t height, const std::uint8_t* rgba) {
+  if (dump_dir_.empty() || rgba == nullptr || width == 0 || height == 0) {
+    return;
+  }
+  {
+    std::lock_guard<std::mutex> lock(mutex_);
+    if (!dumped_.insert(hash).second) {
+      return;
+    }
+  }
+  std::error_code error;
+  std::filesystem::create_directories(dump_dir_, error);
+  RgbaImage image;
+  image.width = width;
+  image.height = height;
+  image.pixels.assign(rgba, rgba + static_cast<std::size_t>(width) * height * 4);
+  const std::string path = dump_dir_ + "/" + HashName(hash) + "_" +
+                           std::to_string(width) + "x" +
+                           std::to_string(height) + ".png";
+  if (!WritePngRgba(path, image)) {
+    std::fprintf(stderr, "  [vulkan] texture dump failed: %s\n", path.c_str());
+  }
+}
+
+}  // namespace mocktail::graphics
@@ -1,5 +1,7 @@
 #include "jnivm/jnivm.h"

+#include "mocktail/audio/fmod_thread_floating_point.h"
+
 #include <algorithm>
 #include <atomic>
 #include <cctype>
@@ -21,6 +23,8 @@
 #include <unordered_set>
 #include <vector>

+#include "runtime/display_size.h"
+
 namespace jnivm {

 void Class::RegisterMethod(const std::string& method_name,
@@ -56,6 +60,7 @@ namespace {
 thread_local JNIEnv* g_thread_local_env = nullptr;
 thread_local JNIEnv g_thread_env_storage = {};
 thread_local VM* g_thread_vm_instance = nullptr;
+thread_local mocktail::audio::FmodThreadFloatingPointMode g_thread_audio_fp_mode;
 thread_local std::vector<std::vector<jobject>> g_local_frames;

 std::recursive_mutex g_jni_state_mutex;
@@ -559,13 +564,25 @@ bool ResolvedDarkTheme() {
 }

 jint IntResultForName(const char* name) {
-  if (std::strcmp(name, "getScreenWidth") == 0 ||
-      std::strcmp(name, "getWidth") == 0) {
-    return 1280;
+  if (std::strcmp(name, "getScreenWidth") == 0) {
+    return mocktail::runtime::ParseDisplaySize(
+               std::getenv(mocktail::runtime::kDisplaySizeEnvironment))
+        .width;
  }
-  if (std::strcmp(name, "getScreenHeight") == 0 ||
-      std::strcmp(name, "getHeight") == 0) {
-    return 720;
+  if (std::strcmp(name, "getScreenHeight") == 0) {
+    return mocktail::runtime::ParseDisplaySize(
+               std::getenv(mocktail::runtime::kDisplaySizeEnvironment))
+        .height;
+  }
+  if (std::strcmp(name, "getWidth") == 0) {
+    return mocktail::runtime::ParseDisplaySize(
+               std::getenv(mocktail::runtime::kWindowSizeEnvironment))
+        .width;
+  }
+  if (std::strcmp(name, "getHeight") == 0) {
+    return mocktail::runtime::ParseDisplaySize(
+               std::getenv(mocktail::runtime::kWindowSizeEnvironment))
+        .height;
  }
  if (std::strcmp(name, "getDensityDpi") == 0) {
    return 160;
@@ -2272,8 +2289,11 @@ jobject MakeDeviceStaticParamsObject() {
    pseudo_object->object_fields["soc_model"] =
        MakeString(identity.soc_model.c_str());
    pseudo_object->boolean_fields["cpu64Bit"] = JNI_TRUE;
-    pseudo_object->int_fields["screenWidth"] = 1280;
-    pseudo_object->int_fields["screenHeight"] = 720;
+    const mocktail::runtime::DisplaySize host_display =
+        mocktail::runtime::ParseDisplaySize(
+            std::getenv(mocktail::runtime::kDisplaySizeEnvironment));
+    pseudo_object->int_fields["screenWidth"] = host_display.width;
+    pseudo_object->int_fields["screenHeight"] = host_display.height;
    pseudo_object->int_fields["screenDensityDpi"] = 160;
    pseudo_object->int_fields["apiVersion"] = 33;
    pseudo_object->int_fields["sdkVersion"] = 33;
@@ -2443,14 +2463,17 @@ void EnsureAndroidObjectGraph() {
  SetObjectFieldRaw(decor_view, "holder", surface_holder);
  SetObjectFieldRaw(decor_view, "surface", surface);
  SetObjectFieldRaw(decor_view, "display", display);
-  SetIntFieldRaw(decor_view, "width", 1280);
-  SetIntFieldRaw(decor_view, "height", 720);
+  const mocktail::runtime::DisplaySize host_window =
+      mocktail::runtime::ParseDisplaySize(
+          std::getenv(mocktail::runtime::kWindowSizeEnvironment));
+  SetIntFieldRaw(decor_view, "width", host_window.width);
+  SetIntFieldRaw(decor_view, "height", host_window.height);

  SetObjectFieldRaw(surface_view, "holder", surface_holder);
  SetObjectFieldRaw(surface_view, "surface", surface);
  SetObjectFieldRaw(surface_view, "rootView", root_view);
-  SetIntFieldRaw(surface_view, "width", 1280);
-  SetIntFieldRaw(surface_view, "height", 720);
+  SetIntFieldRaw(surface_view, "width", host_window.width);
+  SetIntFieldRaw(surface_view, "height", host_window.height);

  SetObjectFieldRaw(surface_holder, "surface", surface);
  SetObjectFieldRaw(surface_holder, "surfaceFrame",
@@ -2458,11 +2481,14 @@ void EnsureAndroidObjectGraph() {
  SetBooleanFieldRaw(surface, "valid", JNI_TRUE);
  SetBooleanFieldRaw(surface, "isValid", JNI_TRUE);

-  SetIntFieldRaw(display, "width", 1280);
-  SetIntFieldRaw(display, "height", 720);
+  const mocktail::runtime::DisplaySize host_display =
+      mocktail::runtime::ParseDisplaySize(
+          std::getenv(mocktail::runtime::kDisplaySizeEnvironment));
+  SetIntFieldRaw(display, "width", host_display.width);
+  SetIntFieldRaw(display, "height", host_display.height);
  SetIntFieldRaw(display, "rotation", 0);
-  SetIntFieldRaw(display_metrics, "widthPixels", 1280);
-  SetIntFieldRaw(display_metrics, "heightPixels", 720);
+  SetIntFieldRaw(display_metrics, "widthPixels", host_display.width);
+  SetIntFieldRaw(display_metrics, "heightPixels", host_display.height);
  SetIntFieldRaw(display_metrics, "densityDpi", 160);
  SetFloatFieldRaw(display_metrics, "density", 1.0f);
  SetFloatFieldRaw(display_metrics, "scaledDensity", 1.0f);
@@ -2473,9 +2499,10 @@ void EnsureAndroidObjectGraph() {
                             : PlatformIdentity{};
  SetIntFieldRaw(configuration, "orientation", 2);
  SetIntFieldRaw(configuration, "densityDpi", 160);
-  SetIntFieldRaw(configuration, "screenWidthDp", 1280);
-  SetIntFieldRaw(configuration, "screenHeightDp", 720);
-  SetIntFieldRaw(configuration, "smallestScreenWidthDp", 720);
+  SetIntFieldRaw(configuration, "screenWidthDp", host_window.width);
+  SetIntFieldRaw(configuration, "screenHeightDp", host_window.height);
+  SetIntFieldRaw(configuration, "smallestScreenWidthDp",
+                 std::min(host_window.width, host_window.height));
  SetIntFieldRaw(configuration, "touchscreen", identity.touch_enabled ? 3 : 1);
  SetIntFieldRaw(configuration, "keyboard", identity.keyboard_enabled ? 2 : 1);
  SetIntFieldRaw(configuration, "keyboardHidden",
@@ -4949,10 +4976,14 @@ jobject CreateAndroidConfiguration(JNIEnv* env) {
  SetIntFieldRaw(configuration, "navigation", 1);
  SetIntFieldRaw(configuration, "navigationHidden", 1);
  SetIntFieldRaw(configuration, "orientation", 2);
-  SetIntFieldRaw(configuration, "screenHeightDp", 720);
+  const mocktail::runtime::DisplaySize config_window =
+      mocktail::runtime::ParseDisplaySize(
+          std::getenv(mocktail::runtime::kWindowSizeEnvironment));
+  SetIntFieldRaw(configuration, "screenHeightDp", config_window.height);
  SetIntFieldRaw(configuration, "screenLayout", 0);
-  SetIntFieldRaw(configuration, "screenWidthDp", 1280);
-  SetIntFieldRaw(configuration, "smallestScreenWidthDp", 720);
+  SetIntFieldRaw(configuration, "screenWidthDp", config_window.width);
+  SetIntFieldRaw(configuration, "smallestScreenWidthDp",
+                 std::min(config_window.width, config_window.height));
  SetIntFieldRaw(configuration, "touchscreen", identity.touch_enabled ? 3 : 1);
  SetIntFieldRaw(configuration, "uiMode", 0);
  return configuration;
@@ -4970,6 +5001,7 @@ VM::~VM() {
    g_live_vms.erase(std::remove(g_live_vms.begin(), g_live_vms.end(), this),
                    g_live_vms.end());
    if (g_thread_vm_instance == this) {
+      g_thread_audio_fp_mode.Restore();
      g_thread_vm_instance = nullptr;
      g_thread_local_env = nullptr;
      g_thread_env_storage.functions = nullptr;
@@ -6323,6 +6355,7 @@ JNIEnv* VM::GetJNIEnv() {
    }
    return g_thread_local_env;
  }
+  g_thread_audio_fp_mode.Restore();
  g_thread_vm_instance = this;
  g_thread_env_storage.functions = &native_interface_;
  g_thread_local_env = &g_thread_env_storage;
@@ -6372,7 +6405,7 @@ std::shared_ptr<Class> VM::FindClass(const std::string& class_name) const {

 void VM::InitJNIFunctionTables() {
  invoke_interface_.AttachCurrentThread =
-      [](JavaVM* vm, void** env, void* /*args*/) -> jint {
+      [](JavaVM* vm, void** env, void* args) -> jint {
    if (JniVmTraceEnabled()) {
      std::cout << "  [JNI] AttachCurrentThread enter vm=" << vm
                << " env_out=" << env << '\n';
@@ -6389,6 +6422,7 @@ void VM::InitJNIFunctionTables() {
      return JNI_EINVAL;
    }
    if (g_thread_vm_instance != owner || !IsThreadLocalEnvValid()) {
+      g_thread_audio_fp_mode.Restore();
      g_thread_vm_instance = owner;
      if (!owner->jni_env_) {
        owner->jni_env_ = &owner->jni_env_storage_;
@@ -6398,6 +6432,12 @@ void VM::InitJNIFunctionTables() {
          owner->jni_env_->functions ? owner->jni_env_->functions
                                    : &owner->native_interface_;
      g_thread_local_env = &g_thread_env_storage;
+      const auto* attach_args = static_cast<const JavaVMAttachArgs*>(args);
+      if (attach_args != nullptr &&
+          g_thread_audio_fp_mode.Enable(attach_args->name)) {
+        std::fprintf(stderr, "  [mocktail][audio] %s: enabled FTZ/DAZ\n",
+                     attach_args->name);
+      }
    }
    // Reattaching to the same VM must retain any guest JNI table wrapper.
    *env = g_thread_local_env;
@@ -6421,6 +6461,7 @@ void VM::InitJNIFunctionTables() {
    if (g_thread_vm_instance != owner || !IsThreadLocalEnvValid()) {
      return JNI_EDETACHED;
    }
+    g_thread_audio_fp_mode.Restore();
    g_thread_local_env = nullptr;
    g_thread_vm_instance = nullptr;
    g_thread_env_storage.functions = nullptr;
@@ -3,6 +3,7 @@
 #include <cctype>
 #include <cerrno>
 #include <chrono>
+#include <cmath>
 #include <cstdarg>
 #include <cstdio>
 #include <cstdlib>
@@ -35,7 +36,9 @@
 #include <fcntl.h>
 #include <unistd.h>
 #include <sys/prctl.h>
+#if defined(__x86_64__)
 #include <asm/prctl.h>
+#endif
 #include <sys/syscall.h>
 #include <vector>

@@ -48,6 +51,7 @@
 #include "compat/bionic_socket_runtime.h"
 #include "compat/build_profile.h"
 #include "compat/elf_build_id.h"
+#include "compat/guest_abi.h"
 #include "compat/host_abi_experiment.h"
 #include "compat/host_abi_profile.h"
 #include "compat/host_allocator_bridge.h"
@@ -56,6 +60,8 @@
 #include "libc_shim/libc_shim.h"
 #include "linker/linker.h"
 #include "mocktail/graphics/bionic_egl_bridge.h"
+#include "runtime/device_memory_profile.h"
+#include "runtime/display_size.h"
 #include "runtime/environment.h"
 #include "runtime/discord_rpc.h"
 #include "runtime/jnivm_platform_web_callbacks.h"
@@ -70,6 +76,7 @@
 #include "runtime/roblox_text_input_jni_bridge.h"
 #include "runtime/runtime_config.h"
 #include "runtime/runtime_paths.h"
+#include "runtime/texture_memory_policy.h"
 #include "services/client_settings_service.h"
 #include "services/http_client.h"
 #include "window/window.h"
@@ -1002,7 +1009,7 @@ struct BionicAddrInfo {
 };

 static_assert(sizeof(BionicAddrInfo) == 48,
-              "unexpected x86_64 bionic addrinfo size");
+              "unexpected bionic addrinfo size");

 bool DnsTraceEnabled() {
  return IsEnabled("MOCKTAIL_DNS_TRACE");
@@ -1367,15 +1374,31 @@ bool IsUnsafeSoftTimeoutModule(void* rip) {
 void JniOnLoadTimeoutAlarm(int, siginfo_t* info, void* context) {
  static_cast<void>(info);
  auto* uc = static_cast<ucontext_t*>(context);
+#if defined(__x86_64__)
  auto rip = uc ? static_cast<uintptr_t>(uc->uc_mcontext.gregs[REG_RIP]) : 0;
  auto rsp = uc ? static_cast<uintptr_t>(uc->uc_mcontext.gregs[REG_RSP]) : 0;
  auto rbp = uc ? static_cast<uintptr_t>(uc->uc_mcontext.gregs[REG_RBP]) : 0;
  auto rax = uc ? static_cast<uintptr_t>(uc->uc_mcontext.gregs[REG_RAX]) : 0;
+  const char* regs_format =
+      "  [timeout] RIP=0x%016llx RSP=0x%016llx RBP=0x%016llx "
+      "RAX=0x%016llx\n";
+#elif defined(__aarch64__)
+  auto rip = uc ? static_cast<uintptr_t>(uc->uc_mcontext.pc) : 0;
+  auto rsp = uc ? static_cast<uintptr_t>(uc->uc_mcontext.sp) : 0;
+  auto rbp = uc ? static_cast<uintptr_t>(uc->uc_mcontext.regs[29]) : 0;
+  auto rax = uc ? static_cast<uintptr_t>(uc->uc_mcontext.regs[0]) : 0;
+  const char* regs_format =
+      "  [timeout] PC=0x%016llx SP=0x%016llx FP=0x%016llx "
+      "X0=0x%016llx\n";
+#else
+  uintptr_t rip = 0, rsp = 0, rbp = 0, rax = 0;
+  const char* regs_format =
+      "  [timeout] PC=0x%016llx SP=0x%016llx FP=0x%016llx "
+      "X0=0x%016llx\n";
+#endif
  char regs_msg[192];
  int len = std::snprintf(
-      regs_msg, sizeof(regs_msg),
-      "  [timeout] RIP=0x%016llx RSP=0x%016llx RBP=0x%016llx "
-      "RAX=0x%016llx\n",
+      regs_msg, sizeof(regs_msg), regs_format,
      static_cast<unsigned long long>(rip), static_cast<unsigned long long>(rsp),
      static_cast<unsigned long long>(rbp), static_cast<unsigned long long>(rax));
  write(2, regs_msg, static_cast<size_t>(len));
@@ -2393,6 +2416,21 @@ void InstallNativeGlJavaImplementation(JNIEnv* env, jclass native_gl_java_class)

 jobject BuildPlatformParams(JNIEnv* env, jobject surface, bool is_headless);

+mocktail::runtime::DisplaySize HostDisplaySize() {
+  return mocktail::runtime::ParseDisplaySize(
+      std::getenv(mocktail::runtime::kDisplaySizeEnvironment));
+}
+
+mocktail::runtime::DisplaySize HostWindowPixelSize() {
+  const mocktail::window::WindowViewportSnapshot viewport =
+      mocktail::window::GetWindowViewportSnapshot();
+  if (viewport.valid()) {
+    return {viewport.pixel_width, viewport.pixel_height};
+  }
+  return mocktail::runtime::ParseDisplaySize(
+      std::getenv(mocktail::runtime::kWindowSizeEnvironment));
+}
+
 jobject BuildDeviceParams(JNIEnv* env) {
  jobject params = NewObject(env, "com/roblox/engine/jni/model/DeviceParams");
  if (!params) {
@@ -2403,10 +2441,12 @@ jobject BuildDeviceParams(JNIEnv* env) {
      GetEnvString("MOCKTAIL_DEVICE_NAME", "Mocktail Linux");
  const std::string manufacturer =
      GetEnvString("MOCKTAIL_DEVICE_MANUFACTURER", "Mocktail");
-  const std::string device_sku =
-      GetEnvString("MOCKTAIL_DEVICE_SKU", "mocktail-x86_64");
+  const std::string device_sku = GetEnvString(
+      "MOCKTAIL_DEVICE_SKU",
+      ("mocktail-" + std::string(mocktail::compat::kGuestCpuName)).c_str());
  const std::string soc_model =
-      GetEnvString("MOCKTAIL_DEVICE_SOC_MODEL", "x86_64");
+      GetEnvString("MOCKTAIL_DEVICE_SOC_MODEL",
+                   std::string(mocktail::compat::kGuestCpuName).c_str());
  SetStringField(env, params, "osVersion", "33");
  SetStringField(env, params, "deviceName", device_name.c_str());
  const std::string app_version =
@@ -2414,27 +2454,40 @@ jobject BuildDeviceParams(JNIEnv* env) {
  SetStringField(env, params, "appVersion", app_version.c_str());
  SetStringField(env, params, "country", "US");
  SetStringField(env, params, "manufacturer", manufacturer.c_str());
-  SetStringField(env, params, "displayResolution", "1280x720");
+  const mocktail::runtime::DisplaySize display_size =
+      mocktail::runtime::ParseDisplaySize(
+          std::getenv(mocktail::runtime::kDisplaySizeEnvironment));
+  const std::string display_resolution = std::to_string(display_size.width) +
+                                         "x" +
+                                         std::to_string(display_size.height);
+  SetStringField(env, params, "displayResolution", display_resolution.c_str());
  SetStringField(env, params, "networkType", "wifi");
  SetStringField(env, params, "deviceSku", device_sku.c_str());
  SetStringField(env, params, "socModel", soc_model.c_str());
  SetStringField(env, params, "appBuildVariant", "googleProdRelease");
  SetStringField(env, params, "testDeviceName", device_name.c_str());

-  const bool is_low_ram = !IsEnabled("MOCKTAIL_DISABLE_LOW_RAM_DEVICE");
-  SetIntField(env, params, "deviceTotalMemoryMB", is_low_ram ? 2048 : 4096);
-  SetIntField(env, params, "displayPhysicalWidthPixels", 1280);
-  SetIntField(env, params, "displayPhysicalHeightPixels", 720);
-  SetIntField(env, params, "memoryClass", is_low_ram ? 256 : 512);
-  SetIntField(env, params, "largeMemoryClass", is_low_ram ? 512 : 1024);
+  std::uint64_t host_memory_bytes = mocktail::runtime::DetectHostMemoryBytes();
+  if (IsEnabled("MOCKTAIL_DISABLE_LOW_RAM_DEVICE")) {
+    host_memory_bytes =
+        std::max<std::uint64_t>(host_memory_bytes, 4096ULL * 1024ULL * 1024ULL);
+  }
+  const mocktail::runtime::DeviceMemoryProfile memory =
+      mocktail::runtime::BuildDeviceMemoryProfile(host_memory_bytes);
+  SetIntField(env, params, "deviceTotalMemoryMB", memory.total_memory_mb);
+  SetIntField(env, params, "displayPhysicalWidthPixels", display_size.width);
+  SetIntField(env, params, "displayPhysicalHeightPixels",
+              display_size.height);
+  SetIntField(env, params, "memoryClass", memory.memory_class_mb);
+  SetIntField(env, params, "largeMemoryClass", memory.large_memory_class_mb);
  SetLongField(env, params, "lowMemoryKillerBackgroundAppThreshold",
-               is_low_ram ? 256 : 0);
+               memory.low_memory_killer_background_threshold);
  SetLongField(env, params, "lowMemoryKillerForegroundAppThreshold",
-               is_low_ram ? 512 : 0);
+               memory.low_memory_killer_foreground_threshold);
  SetBooleanField(env, params, "cpu64Bit", JNI_TRUE);
  SetBooleanField(env, params, "isChrome", JNI_FALSE);
  SetBooleanField(env, params, "isLowRamDevice",
-                  is_low_ram ? JNI_TRUE : JNI_FALSE);
+                  memory.low_ram_device ? JNI_TRUE : JNI_FALSE);
  return params;
 }

@@ -2534,8 +2587,9 @@ jobject BuildAppBridgeInitParams(JNIEnv* env, jstring client_settings,
  SetStringField(env, params, "locale", "en_us");
  SetRobloxServiceUrlFields(env, params);

-  SetIntField(env, params, "screenWidth", 1280);
-  SetIntField(env, params, "screenHeight", 720);
+  const mocktail::runtime::DisplaySize init_display = HostDisplaySize();
+  SetIntField(env, params, "screenWidth", init_display.width);
+  SetIntField(env, params, "screenHeight", init_display.height);
  SetIntField(env, params, "densityDpi", 160);
  SetIntField(env, params, "sdkVersion", 33);
  jboolean headless = is_headless ? JNI_TRUE : JNI_FALSE;
@@ -2569,13 +2623,19 @@ jobject BuildPlatformParams(JNIEnv* env, jobject surface, bool is_headless) {
  SetStringField(env, params, "deviceName", platform_device_name.c_str());
  SetStringField(env, params, "locale", "en_us");
  SetStringField(env, params, "assetFolderPath", DefaultAssetPath().c_str());
-  SetIntField(env, params, "width", 1280);
-  SetIntField(env, params, "height", 720);
-  SetIntField(env, params, "screenWidth", 1280);
-  SetIntField(env, params, "screenHeight", 720);
+  const mocktail::runtime::DisplaySize platform_window = HostWindowPixelSize();
+  const mocktail::runtime::DisplaySize platform_display = HostDisplaySize();
+  SetIntField(env, params, "width", platform_window.width);
+  SetIntField(env, params, "height", platform_window.height);
+  SetIntField(env, params, "screenWidth", platform_display.width);
+  SetIntField(env, params, "screenHeight", platform_display.height);
  SetIntField(env, params, "densityDpi", 160);
-  SetIntField(env, params, "viewportWidthMm", 203);
-  SetIntField(env, params, "viewportHeightMm", 114);
+  SetIntField(env, params, "viewportWidthMm",
+              mocktail::runtime::PixelsToMillimetersAt160Dpi(
+                  platform_window.width));
+  SetIntField(env, params, "viewportHeightMm",
+              mocktail::runtime::PixelsToMillimetersAt160Dpi(
+                  platform_window.height));
  const mocktail::window::WindowViewportSnapshot viewport =
      mocktail::window::GetWindowViewportSnapshot();
  SetFloatField(env, params, "dpiScale", viewport.dpi_scale);
@@ -2684,10 +2744,12 @@ jobject BuildStartAppParams(JNIEnv* env, jstring app_params,
  SetStringField(env, params, "deviceName", start_device_name.c_str());
  SetStringField(env, params, "locale", "en_us");
  SetRobloxServiceUrlFields(env, params);
-  SetIntField(env, params, "width", 1280);
-  SetIntField(env, params, "height", 720);
-  SetIntField(env, params, "screenWidth", 1280);
-  SetIntField(env, params, "screenHeight", 720);
+  const mocktail::runtime::DisplaySize start_window = HostWindowPixelSize();
+  const mocktail::runtime::DisplaySize start_display = HostDisplaySize();
+  SetIntField(env, params, "width", start_window.width);
+  SetIntField(env, params, "height", start_window.height);
+  SetIntField(env, params, "screenWidth", start_display.width);
+  SetIntField(env, params, "screenHeight", start_display.height);
  SetIntField(env, params, "densityDpi", 160);
  SetIntField(env, params, "sdkVersion", 33);
  SetIntField(env, params, "placeId", 0);
@@ -2815,8 +2877,9 @@ jobject BuildMockSurface(JNIEnv* env) {
  if (!surface) {
    return nullptr;
  }
-  SetIntField(env, surface, "width", 1280);
-  SetIntField(env, surface, "height", 720);
+  const mocktail::runtime::DisplaySize surface_size = HostWindowPixelSize();
+  SetIntField(env, surface, "width", surface_size.width);
+  SetIntField(env, surface, "height", surface_size.height);
  SetBooleanField(env, surface, "valid", JNI_TRUE);
  SetBooleanField(env, surface, "isValid", JNI_TRUE);
  return surface;
@@ -3913,7 +3976,10 @@ std::cerr << "  [engine] nativeAppBridgeV2InitWithParams recovered\n"
        on_surface_created(env, game_activity, handle, surface);
      }
      if (run_lifecycle_callbacks && on_surface_changed) {
-        on_surface_changed(env, game_activity, handle, surface, 4, 1280, 720);
+        const mocktail::runtime::DisplaySize changed_size =
+            HostWindowPixelSize();
+        on_surface_changed(env, game_activity, handle, surface, 4,
+                           changed_size.width, changed_size.height);
      }
      if (run_lifecycle_callbacks && on_surface_redraw_needed) {
        on_surface_redraw_needed(env, game_activity, handle, surface);
@@ -4084,8 +4150,9 @@ std::cerr << "  [engine] nativeAppBridgeV2InitWithParams recovered\n"
      ShouldRunStartupStep("MOCKTAIL_UPDATE_APP_UI_SIZES", false)) {
    env = ensure_env();
    std::cout << "  [engine] updateAppUISizes\n" << std::flush;
-    context->native_update_app_ui_sizes(env, native_gl_class, 1280, 720, 0, 0,
-                                        0);
+    const mocktail::runtime::DisplaySize ui_size = HostWindowPixelSize();
+    context->native_update_app_ui_sizes(env, native_gl_class, ui_size.width,
+                                        ui_size.height, 0, 0, 0);
    std::cout << "  [engine] updateAppUISizes returned\n" << std::flush;
  }

@@ -4575,12 +4642,14 @@ int mocktail::legacy::Run(const runtime::CommandLineOptions& options,

  // Roblox internal threads trigger SI_KERNEL traps from CET shadow-stack
  // return mismatches. Unsupported kernels ignore this request.
+#if defined(__x86_64__)
  {
    long r = syscall(SYS_arch_prctl, ARCH_SHSTK_DISABLE, ARCH_SHSTK_SHSTK);
    if (r == 0) {
      std::cout << "  [cet] shadow-stack (SHSTK) disabled\n";
    }
  }
+#endif

  if (build_profile.allow_legacy_binary_patches) {
    std::cerr
@@ -4726,6 +4795,37 @@ int mocktail::legacy::Run(const runtime::CommandLineOptions& options,
                << std::flush;
    }
  }
+  if (window_initialised) {
+    auto* sdl_window =
+        static_cast<SDL_Window*>(mocktail::window::GetBackendWindow());
+    const SDL_DisplayID display =
+        sdl_window != nullptr ? SDL_GetDisplayForWindow(sdl_window) : 0;
+    const SDL_DisplayMode* mode =
+        display != 0 ? SDL_GetCurrentDisplayMode(display) : nullptr;
+    if (mode != nullptr && mode->w > 0 && mode->h > 0) {
+      // SDL mode dimensions need pixel_density to become physical pixels.
+      const float density = mode->pixel_density > 0.0f ? mode->pixel_density
+                                                       : 1.0f;
+      const std::string display_size =
+          std::to_string(std::lround(mode->w * density)) + "x" +
+          std::to_string(std::lround(mode->h * density));
+      setenv(mocktail::runtime::kDisplaySizeEnvironment, display_size.c_str(),
+             1);
+      std::cout << "  [window] host display " << display_size << " pixels\n"
+                << std::flush;
+    }
+  }
+  if (window_initialised) {
+    const mocktail::window::WindowViewportSnapshot viewport =
+        mocktail::window::GetWindowViewportSnapshot();
+    if (viewport.valid()) {
+      const std::string window_size = std::to_string(viewport.pixel_width) +
+                                      "x" +
+                                      std::to_string(viewport.pixel_height);
+      setenv(mocktail::runtime::kWindowSizeEnvironment, window_size.c_str(),
+             1);
+    }
+  }
  const SDL_SystemTheme system_theme =
      window_initialised ? SDL_GetSystemTheme() : SDL_SYSTEM_THEME_UNKNOWN;
  const bool system_dark_theme = system_theme == SDL_SYSTEM_THEME_DARK;
@@ -5161,7 +5261,6 @@ int mocktail::legacy::Run(const runtime::CommandLineOptions& options,
      "pthread_kill",
      "pthread_exit",
      "pthread_getschedparam",
-      "pthread_setschedparam",
      "pthread_key_create",
      "pthread_key_delete",
      "pthread_getspecific",
@@ -5469,6 +5568,27 @@ int mocktail::legacy::Run(const runtime::CommandLineOptions& options,
                         reinterpret_cast<void*>(mocktail_pthread_spin_trylock));
  linker::RegisterSymbol("pthread_spin_unlock",
                         reinterpret_cast<void*>(mocktail_pthread_spin_unlock));
+  linker::RegisterSymbol(
+      "pthread_attr_init",
+      reinterpret_cast<void*>(mocktail_pthread_attr_init));
+  linker::RegisterSymbol(
+      "pthread_attr_destroy",
+      reinterpret_cast<void*>(mocktail_pthread_attr_destroy));
+  linker::RegisterSymbol(
+      "pthread_attr_setstacksize",
+      reinterpret_cast<void*>(mocktail_pthread_attr_setstacksize));
+  linker::RegisterSymbol(
+      "pthread_attr_setdetachstate",
+      reinterpret_cast<void*>(mocktail_pthread_attr_setdetachstate));
+  linker::RegisterSymbol(
+      "pthread_attr_setschedparam",
+      reinterpret_cast<void*>(mocktail_pthread_attr_setschedparam));
+  linker::RegisterSymbol(
+      "pthread_getattr_np",
+      reinterpret_cast<void*>(mocktail_pthread_getattr_np));
+  linker::RegisterSymbol(
+      "pthread_attr_getstack",
+      reinterpret_cast<void*>(mocktail_pthread_attr_getstack));
  linker::RegisterSymbol("pthread_barrier_init",
                         reinterpret_cast<void*>(mocktail_pthread_barrier_init));
  linker::RegisterSymbol(
@@ -5479,6 +5599,12 @@ int mocktail::legacy::Run(const runtime::CommandLineOptions& options,
  linker::RegisterSymbol(
      "pthread_create",
      reinterpret_cast<void*>(mocktail_bionic_pthread_create));
+  linker::RegisterSymbol(
+      "pthread_setschedparam",
+      reinterpret_cast<void*>(mocktail_bionic_pthread_setschedparam));
+  linker::RegisterSymbol(
+      "sched_setscheduler",
+      reinterpret_cast<void*>(mocktail_bionic_sched_setscheduler));
  linker::RegisterSymbol("abort", reinterpret_cast<void*>(mocktail_abort));
  linker::RegisterSymbol("__stack_chk_fail", reinterpret_cast<void*>(mocktail_recover_stack_chk_fail));
  (void)registered;
@@ -5582,7 +5708,8 @@ int mocktail::legacy::Run(const runtime::CommandLineOptions& options,

  if (roblox_handle == nullptr) {
    std::cerr << "\n[FATAL] Could not load '" << library_path << "'.\n"
-              << "  Extract lib/x86_64/libroblox.so from a Roblox APK and\n"
+              << "  Extract lib/" << compat::kGuestAbi
+              << "/libroblox.so from a Roblox APK and\n"
              << "  place it at the path above (or set ROBLOX_LIB_PATH).\n";
    return EXIT_FAILURE;
  }
@@ -8,16 +8,19 @@
 #include <cstdlib>
 #include <cstring>
 #include <fcntl.h>
+#include <filesystem>
 #include <iostream>
 #include <limits.h>
 #include <unordered_map>
 #include <unistd.h>
+#include <vector>

 namespace libc_shim {

 namespace {

 std::unordered_map<std::string, std::string> g_path_mappings;
+std::vector<std::string> g_ca_bundle_aliases;

 bool g_installed = false;
 std::atomic<GuestAllocator> g_guest_allocator{nullptr};
@@ -27,9 +30,15 @@ constexpr std::array<const char*, 2> kDefaultCaBundles = {
    "/etc/ssl/cert.pem",
    "/etc/ssl/certs/ca-certificates.crt",
 };
-constexpr std::array<const char*, 2> kAndroidCaBundlePaths = {
+constexpr std::array<const char*, 8> kAndroidCaBundlePaths = {
    "/data/user/0/com.roblox.client/files/exe/cacert.pem",
    "/data/data/com.roblox.client/files/exe/cacert.pem",
+    "/data/user/0/com.roblox.client/files/exe/ssl/cacert.pem",
+    "/data/data/com.roblox.client/files/exe/ssl/cacert.pem",
+    "ssl/cacert.pem",
+    "content/ssl/cacert.pem",
+    "rbx_bin/assets/ssl/cacert.pem",
+    "rbx_bin/assets/content/ssl/cacert.pem",
 };

 bool IsEnabled(const char* name) {
@@ -192,17 +201,22 @@ HostCaBundleResolution ResolveHostCaBundle() {
 }

 HostCaBundleResolution ConfigureHostCaBundlePathMappings() {
-  for (const char* android_path : kAndroidCaBundlePaths) {
-    g_path_mappings.erase(android_path);
+  for (const auto& alias : g_ca_bundle_aliases) g_path_mappings.erase(alias);
+  g_ca_bundle_aliases.assign(kAndroidCaBundlePaths.begin(), kAndroidCaBundlePaths.end());
+  if (const char* content = GetEnvNonEmpty("MOCKTAIL_ASSET_PATH")) {
+    auto root = std::filesystem::path(content).lexically_normal();
+    if (root.filename().empty()) root = root.parent_path();
+    g_ca_bundle_aliases.push_back((root / "ssl/cacert.pem").string());
+    if (root.filename() == "content")
+      g_ca_bundle_aliases.push_back((root.parent_path() / "ssl/cacert.pem").string());
  }

  HostCaBundleResolution resolution = ResolveHostCaBundle();
  if (!resolution.ok()) {
    return resolution;
  }
-  for (const char* android_path : kAndroidCaBundlePaths) {
-    RegisterPathMapping(android_path, resolution.host_path);
-  }
+  for (const auto& alias : g_ca_bundle_aliases)
+    RegisterPathMapping(alias, resolution.host_path);
  return resolution;
 }

@@ -308,6 +322,7 @@ void RegisterPathMapping(const std::string& android_prefix,

 void ClearPathMappings() {
  g_path_mappings.clear();
+  g_ca_bundle_aliases.clear();
 }

 }  // namespace libc_shim
@@ -29,12 +29,15 @@
 #include "runtime/environment.h"
 #include "runtime/external_launch_broker.h"
 #include "runtime/failure_dialog.h"
+#include "runtime/fleasion.h"
 #include "runtime/game_mode.h"
 #include "runtime/graphics_launch_policy.h"
 #include "runtime/memory_limit.h"
 #include "runtime/payload_update_preflight.h"
 #include "runtime/performance_policy.h"
 #include "runtime/platform_cache_migration.h"
+#include "runtime/process_diagnostics.h"
+#include "runtime/process_launch_policy.h"
 #include "runtime/roblox_desktop_app_policy.h"
 #include "runtime/roblox_experience_launch_bridge.h"
 #include "runtime/roblox_fullscreen_runtime_bridge.h"
@@ -123,6 +126,10 @@ void PromptFirstLaunchSignIn(
      environment.Get("MOCKTAIL_SKIP_FIRST_LAUNCH_LOGIN") == "1") {
    return;
  }
+  if (environment.Get("MOCKTAIL_NATIVE_LOGIN") != "0") {
+    std::cout << "  [auth] native sign-in selected; opening Roblox welcome screen\n";
+    return;
+  }

  std::filesystem::path helper;
  const char* helper_override = std::getenv("MOCKTAIL_WEBVIEW_HELPER");
@@ -251,6 +258,12 @@ int main(int argc, char* argv[]) {
        command_line.options.program_name);
    return EXIT_SUCCESS;
  }
+  // Normalize inherited process state before bootstrap or helpers can create
+  // threads. Keep research/canary resource limits under their caller's control.
+  const std::string process_launch_diagnostics =
+      command_line.options.mode == mocktail::runtime::CommandMode::kRun
+          ? mocktail::runtime::ApplyInteractiveProcessLaunchPolicy()
+          : std::string{};
  std::string command_line_error;
  if (!mocktail::runtime::ApplySupportedLaunchPolicy(
          command_line.options.mode == mocktail::runtime::CommandMode::kRun,
@@ -456,6 +469,42 @@ int main(int argc, char* argv[]) {
      std::cerr << "  [session] automatic logging unavailable: "
                << session_log.error() << '\n';
    }
+    std::cout << process_launch_diagnostics << std::flush;
+    mocktail::runtime::InstallCpuLimitDiagnostics();
+    mocktail::runtime::LogProcessDiagnostics(
+        mocktail::runtime::ProcessDiagnosticStage::kStartup);
+  }
+  if (runtime_config.config.fleasion_enabled()) {
+    const auto fleasion = mocktail::runtime::PrepareFleasion(
+        runtime_config.config, environment, paths);
+    if (!fleasion ||
+        setenv("MOCKTAIL_CA_BUNDLE", fleasion.bundle.c_str(), 1) != 0 ||
+        setenv("MOCKTAIL_FLEASION_BASE_CA_BUNDLE", fleasion.base_bundle.c_str(), 1) != 0 ||
+        setenv("MOCKTAIL_FLEASION_GENERATED_BUNDLE", fleasion.bundle.c_str(), 1) != 0 ||
+        setenv("MOCKTAIL_FLEASION_CA_CERTIFICATE", fleasion.certificate.c_str(), 1) != 0) {
+      std::cerr << "[FATAL] Cannot prepare Fleasion: "
+                << (!fleasion ? fleasion.error : "cannot export certificate paths") << '\n';
+      return EXIT_FAILURE;
+    }
+    if (const auto& proxy = runtime_config.config.network_proxy(); proxy &&
+        (setenv("MOCKTAIL_HTTP_PROXY_HOST", proxy->host.c_str(), 1) != 0 ||
+         setenv("MOCKTAIL_HTTP_PROXY_PORT", std::to_string(proxy->port).c_str(), 1) != 0 ||
+         setenv("MOCKTAIL_HTTP_PROXY_SCHEME", proxy->scheme.c_str(), 1) != 0)) {
+      std::cerr << "[FATAL] Cannot export Fleasion proxy\n";
+      return EXIT_FAILURE;
+    }
+    runtime_config = mocktail::runtime::LoadRuntimeConfig(environment, paths.config_file());
+    if (!runtime_config) {
+      std::cerr << "[FATAL] Cannot apply Fleasion: " << runtime_config.error << '\n';
+      return EXIT_FAILURE;
+    }
+    std::cout << "  [fleasion] mode=" << runtime_config.config.fleasion_proxy_mode()
+              << " certificate=" << fleasion.certificate
+              << " trust_bundle=" << fleasion.bundle << '\n';
+    if (runtime_config.config.network_proxy()) {
+      std::cout << "  [fleasion] proxy=" << mocktail::runtime::BuildNetworkProxyUrl(
+          *runtime_config.config.network_proxy()) << "; start Fleasion before Roblox\n";
+    }
  }
  if (config_bootstrap.created()) {
    std::cout << "  [runtime] created first-run configuration: "
@@ -840,6 +889,21 @@ int main(int argc, char* argv[]) {
                << fullscreen_status.message() << '\n';
      return EXIT_FAILURE;
    }
+    if (compatibility.profile.fmod_output_device_bridge &&
+        compatibility.profile.fmod_output_device_bridge->has_input_devices()) {
+      std::string menu_settings;
+      const char *settings =
+          std::getenv("MOCKTAIL_CLIENT_SETTINGS_OVERRIDES_JSON");
+      if (!mocktail::runtime::MergeAudioDeviceMenuClientSettingsOverrides(
+              settings ? settings : "{}", &menu_settings,
+              &command_line_error) ||
+          setenv("MOCKTAIL_CLIENT_SETTINGS_OVERRIDES_JSON",
+                 menu_settings.c_str(), 1) != 0) {
+        std::cerr << "[FATAL] Cannot configure host audio device menu: "
+                  << command_line_error << '\n';
+        return EXIT_FAILURE;
+      }
+    }
    const mocktail::Status output_device_status =
        output_device_bridge.Install(compatibility.profile);
    if (!output_device_status.ok()) {
@@ -1024,8 +1088,18 @@ int main(int argc, char* argv[]) {
  }
  failure_dialog.SetMessage(
      "Roblox closed unexpectedly because of an internal error.");
+  if (command_line.options.mode == mocktail::runtime::CommandMode::kRun) {
+    mocktail::runtime::LogProcessDiagnostics(
+        mocktail::runtime::ProcessDiagnosticStage::kNativeRuntime);
+  }
  int runtime_status =
      mocktail::legacy::Run(command_line.options, std::move(dependencies));
+  if (command_line.options.mode == mocktail::runtime::CommandMode::kRun) {
+    mocktail::runtime::LogProcessDiagnostics(
+        mocktail::runtime::ProcessDiagnosticStage::kShutdown);
+    std::cerr << "[diagnostic] native runtime exit_status=" << runtime_status
+              << '\n';
+  }
  const mocktail::Status launch_broker_shutdown_status =
      external_launch_broker.Shutdown();
  if (!launch_broker_shutdown_status.ok()) {
@@ -1,7 +1,5 @@
 #include "mocktail/platform/sdl_event_converter.h"

-#include <SDL3/SDL_mouse.h>
-
 #include <cstdint>

 namespace mocktail {
@@ -71,14 +69,11 @@ bool ConvertSdlEvent(SDL_Window* window, const SDL_Event& source,
          source.button.x, source.button.y};
      return true;
    case SDL_EVENT_MOUSE_WHEEL: {
-      float delta_x = source.wheel.x;
-      float delta_y = source.wheel.y;
-      if (source.wheel.direction == SDL_MOUSEWHEEL_FLIPPED) {
-        delta_x = -delta_x;
-        delta_y = -delta_y;
-      }
+      // SDL already applies the host's natural-scrolling preference to x/y.
+      // Undoing SDL_MOUSEWHEEL_FLIPPED here would ignore the OS setting.
      destination->payload = MouseWheelEvent{
-          delta_x, delta_y, source.wheel.mouse_x, source.wheel.mouse_y};
+          source.wheel.x, source.wheel.y, source.wheel.mouse_x,
+          source.wheel.mouse_y};
      return true;
    }
    case SDL_EVENT_FINGER_DOWN:
@@ -5,6 +5,7 @@
 #include <string>
 #include <string_view>

+#include "compat/guest_abi.h"
 #include "runtime/roblox_launch_uri.h"

 namespace mocktail {
@@ -241,11 +242,12 @@ std::string CommandLineUsage(const std::string& program_name) {
  usage
      << "Usage: " << (program_name.empty() ? "mocktail" : program_name)
      << " [options] [roblox-uri]\n\n"
-      << "Normal startup downloads and activates a verified managed x86_64 "
-         "Roblox payload automatically.\n\n"
+      << "Normal startup downloads and activates a verified managed "
+      << compat::kGuestAbi
+      << " Roblox payload automatically.\n\n"
      << "Options:\n"
      << "  --roblox-lib <path>      Development override for a specific "
-         "x86_64 libroblox.so\n"
+      << compat::kGuestAbi << " libroblox.so\n"
      << "  --headless               Run without creating an SDL window\n"
      << "  --windowed               Force windowed startup (default)\n"
      << "  --graphics <backend>     direct-vulkan | opengl | system | "
@@ -258,10 +260,13 @@ std::string CommandLineUsage(const std::string& program_name) {
         "website link\n"
      << "  --help, -h               Show this help\n\n"
      << "Auth:\n"
-      << "  When no saved Roblox cookie is found, Roblox starts in guest mode "
-         "and\n"
-      << "  uses its native sign-in flow. New credentials are stored "
-         "privately.\n\n"
+      << "  When no saved Roblox session is found, Roblox's welcome screen "
+         "opens with the native sign-in flow.\n"
+      << "  Set MOCKTAIL_NATIVE_LOGIN=0 to use the optional WebView sign-in "
+         "window.\n"
+      << "  Roblox may still open a WebView for required verification "
+         "challenges.\n"
+      << "  New credentials are stored privately.\n\n"
      << "Additional runtime options are available as MOCKTAIL_* environment "
         "variables.\n";
  return usage.str();
@@ -0,0 +1,35 @@
+#include "runtime/device_memory_profile.h"
+
+#include <algorithm>
+#include <limits>
+
+namespace mocktail {
+namespace runtime {
+namespace {
+
+constexpr std::uint64_t kMebibyte = 1024U * 1024U;
+constexpr std::uint64_t kMinimumNormalRamBytes = 4096U * kMebibyte;
+
+}  // namespace
+
+DeviceMemoryProfile BuildDeviceMemoryProfile(std::uint64_t host_memory_bytes) {
+  DeviceMemoryProfile profile;
+  if (host_memory_bytes < kMinimumNormalRamBytes) {
+    profile.total_memory_mb = 2048;
+    profile.memory_class_mb = 256;
+    profile.large_memory_class_mb = 512;
+    profile.low_memory_killer_background_threshold = 256;
+    profile.low_memory_killer_foreground_threshold = 512;
+    profile.low_ram_device = true;
+    return profile;
+  }
+  profile.total_memory_mb = static_cast<std::int32_t>(std::min<std::uint64_t>(
+      host_memory_bytes / kMebibyte,
+      static_cast<std::uint64_t>(std::numeric_limits<std::int32_t>::max())));
+  profile.memory_class_mb = 512;
+  profile.large_memory_class_mb = 1024;
+  return profile;
+}
+
+}  // namespace runtime
+}  // namespace mocktail
@@ -422,8 +422,12 @@ std::optional<Json> GetRobloxJson(std::string url) {
    if (proxy.has_value()) {
      proxy_url = BuildNetworkProxyUrl(*proxy);
      curl_easy_setopt(curl, CURLOPT_PROXY, proxy_url.c_str());
+      curl_easy_setopt(curl, CURLOPT_NOPROXY, "");
    }
  }
+  if (const char* ca_bundle = std::getenv("MOCKTAIL_CA_BUNDLE")) {
+    curl_easy_setopt(curl, CURLOPT_CAINFO, ca_bundle);
+  }
  const CURLcode status = curl_easy_perform(curl);
  long http_status = 0;
  if (status == CURLE_OK) {
@@ -0,0 +1,151 @@
+#include "runtime/fleasion.h"
+
+#include <openssl/err.h>
+#include <openssl/pem.h>
+#include <openssl/x509v3.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+#include <cerrno>
+#include <fstream>
+#include <memory>
+
+namespace mocktail::runtime {
+namespace {
+
+using Bio = std::unique_ptr<BIO, decltype(&BIO_free)>;
+using Certificate = std::unique_ptr<X509, decltype(&X509_free)>;
+
+bool ReadFile(const std::filesystem::path& path, std::string* contents) {
+  std::error_code error;
+  if (!path.is_absolute() || !std::filesystem::is_regular_file(path, error))
+    return false;
+  const auto size = std::filesystem::file_size(path, error);
+  if (error || size == 0 || size > 4 * 1024 * 1024) return false;
+  std::ifstream input(path, std::ios::binary);
+  contents->resize(static_cast<std::size_t>(size));
+  return static_cast<bool>(input.read(contents->data(), contents->size()));
+}
+
+std::filesystem::path DefaultCertificate(const Environment& environment,
+                                         const RuntimePaths& paths) {
+  std::filesystem::path root = environment.GetOr("XDG_CONFIG_HOME", "");
+  if (!root.is_absolute()) root = paths.home() / ".config";
+  return root / "Fleasion/proxy_ca/ca.crt";
+}
+
+bool WriteBundle(const std::filesystem::path& destination,
+                  const char* contents, std::size_t size) {
+  std::error_code error;
+  std::filesystem::create_directories(destination.parent_path(), error);
+  if (error || std::filesystem::is_symlink(destination.parent_path(), error))
+    return false;
+  std::string temporary = destination.string() + ".XXXXXX";
+  const int descriptor = mkstemp(temporary.data());
+  if (descriptor < 0) return false;
+  std::size_t offset = 0;
+  while (offset < size) {
+    const ssize_t count = write(descriptor, contents + offset, size - offset);
+    if (count < 0 && errno == EINTR) continue;
+    if (count <= 0) break;
+    offset += static_cast<std::size_t>(count);
+  }
+  bool ok = offset == size && fsync(descriptor) == 0;
+  if (close(descriptor) != 0) ok = false;
+  if (ok) ok = rename(temporary.c_str(), destination.c_str()) == 0;
+  if (!ok) unlink(temporary.c_str());
+  return ok;
+}
+
+}  // namespace
+
+FleasionPreparation PrepareFleasion(const RuntimeConfig& config,
+                                   const Environment& environment,
+                                   const RuntimePaths& paths) {
+  FleasionPreparation result;
+  if (!config.fleasion_enabled()) return result;
+  if (!config.fleasion_valid()) {
+    result.error = "invalid Fleasion configuration";
+    return result;
+  }
+  result.certificate = config.fleasion_ca_certificate().value_or(
+      DefaultCertificate(environment, paths));
+  result.bundle = paths.cache_root() / "fleasion/cacert.pem";
+  result.base_bundle = config.ca_bundle().value_or(std::filesystem::path{});
+  // Re-exec and updater canaries inherit the generated bundle. Rebuild from
+  // the original roots so a rotated Fleasion CA does not accumulate forever.
+  if (result.base_bundle == result.bundle ||
+      result.base_bundle == environment.GetOr("MOCKTAIL_FLEASION_GENERATED_BUNDLE", "")) {
+    result.base_bundle = environment.GetOr("MOCKTAIL_FLEASION_BASE_CA_BUNDLE", "");
+  }
+  if (result.base_bundle.empty()) {
+    for (const char* candidate : {"/etc/ssl/cert.pem", "/etc/ssl/certs/ca-certificates.crt"}) {
+      std::error_code error;
+      if (std::filesystem::is_regular_file(candidate, error)) {
+        result.base_bundle = candidate;
+        break;
+      }
+    }
+  }
+  std::error_code equivalent_error;
+  const bool certificate_is_output = std::filesystem::equivalent(
+      result.certificate, result.bundle, equivalent_error);
+  equivalent_error.clear();
+  const bool base_is_output = std::filesystem::equivalent(
+      result.base_bundle, result.bundle, equivalent_error);
+  if (result.certificate == result.bundle || result.base_bundle == result.bundle ||
+      certificate_is_output || base_is_output) {
+    result.error = "Fleasion source certificates must be outside its generated bundle";
+    return result;
+  }
+  std::string ca_pem;
+  if (!ReadFile(result.certificate, &ca_pem)) {
+    result.error = "cannot read Fleasion CA certificate at " + result.certificate.string() +
+                   "; start Fleasion first or set integrations.fleasion.ca_certificate";
+    return result;
+  }
+  Bio ca_input(BIO_new_mem_buf(ca_pem.data(), static_cast<int>(ca_pem.size())), BIO_free);
+  Certificate ca(ca_input ? PEM_read_bio_X509(ca_input.get(), nullptr, nullptr, nullptr)
+                         : nullptr, X509_free);
+  if (!ca || X509_check_ca(ca.get()) <= 0 ||
+      X509_cmp_current_time(X509_get0_notBefore(ca.get())) >= 0 ||
+      X509_cmp_current_time(X509_get0_notAfter(ca.get())) <= 0) {
+    ERR_clear_error();
+    result.error = "Fleasion CA must be a currently valid PEM CA certificate";
+    return result;
+  }
+  std::string roots;
+  if (!ReadFile(result.base_bundle, &roots)) {
+    result.error = "cannot read base CA bundle for Fleasion: " + result.base_bundle.string();
+    return result;
+  }
+  Bio input(BIO_new_mem_buf(roots.data(), static_cast<int>(roots.size())), BIO_free);
+  Bio output(BIO_new(BIO_s_mem()), BIO_free);
+  if (!input || !output) {
+    result.error = "cannot allocate Fleasion certificate bundle";
+    return result;
+  }
+  int count = 0;
+  for (;;) {
+    Certificate root(PEM_read_bio_X509(input.get(), nullptr, nullptr, nullptr), X509_free);
+    if (!root) break;
+    ++count;
+    if (X509_cmp(root.get(), ca.get()) != 0 &&
+        PEM_write_bio_X509(output.get(), root.get()) != 1) {
+      result.error = "cannot encode base CA certificate";
+      return result;
+    }
+  }
+  ERR_clear_error();
+  if (count == 0 || PEM_write_bio_X509(output.get(), ca.get()) != 1) {
+    result.error = "base bundle must contain PEM certificates";
+    return result;
+  }
+  char* bytes = nullptr;
+  const long size = BIO_get_mem_data(output.get(), &bytes);
+  if (size <= 0 || !WriteBundle(result.bundle, bytes, static_cast<std::size_t>(size)))
+    result.error = "cannot write generated Fleasion CA bundle: " + result.bundle.string();
+  return result;
+}
+
+}  // namespace mocktail::runtime
@@ -18,11 +18,8 @@ namespace mocktail {
 namespace runtime {
 namespace {

-// TextureManager2 selects its mobile MipPackStream path on Android Vulkan and
-// can keep world textures at low-resolution mips. TM1 preserves full texture
-// fidelity until that path is compatible with the host Vulkan adapter.
 constexpr char kVulkanClientSettingsOverrides[] =
-    R"({"FStringGraphicsTextureManager2DenyPattern2":".*","FStringGraphicsVulkanShaderMTDenyPattern":"4318:.*"})";
+    R"({"FStringGraphicsVulkanShaderMTDenyPattern":"4318:.*"})";

 constexpr const char* kIcdDirectories[] = {
    "/usr/share/vulkan/icd.d",
@@ -30,12 +27,21 @@ constexpr const char* kIcdDirectories[] = {
    "/usr/local/share/vulkan/icd.d",
 };

+#if defined(__aarch64__)
+constexpr char kNativeArchitecture[] = "aarch64";
+
+constexpr const char* kForeignArchitectures[] = {
+    "i686",  "i586", "i486",  "i386",    "x86_64",  "x86.",
+    "amd64", "armhf", "armv7", "ppc64", "riscv64", "s390x",
+};
+#else
 constexpr char kNativeArchitecture[] = "x86_64";

 constexpr const char* kForeignArchitectures[] = {
    "i686", "i586", "i486", "i386",   "x86.",   "aarch64",
    "arm64", "armhf", "armv7", "ppc64", "riscv64", "s390x",
 };
+#endif

 struct HostGpus {
  bool intel = false;
@@ -367,6 +367,26 @@ bool MergeRuntimeClientSettingsOverrides(const FrameRatePolicy& frame_rate,
                                                 merged_json, error);
 }

+bool MergeAudioDeviceMenuClientSettingsOverrides(std::string_view base_json,
+                                                 std::string *merged_json,
+                                                 std::string *error) {
+  if (merged_json == nullptr)
+    return false;
+  auto overrides = nlohmann::json::parse(base_json.empty() ? "{}" : base_json,
+                                         nullptr, false, true);
+  if (overrides.is_discarded() || !overrides.is_object()) {
+    if (error)
+      *error = "audio device menu overrides must be a JSON object";
+    return false;
+  }
+  // Use the profiled FMOD count/info/select interface for device enumeration.
+  // RemoteAudioDeviceSync instead uses the unbridged device-list virtuals.
+  overrides["FFlagDebugUseWebRtcAudioDevices"] = "False";
+  overrides["FFlagRemoteAudioDeviceSync"] = "False";
+  *merged_json = overrides.dump();
+  return true;
+}
+
 bool MergeAudioCaptureClientSettingsOverrides(bool microphone_enabled,
                                              std::string_view base_json,
                                              std::string* merged_json,
@@ -0,0 +1,181 @@
+#include "runtime/process_diagnostics.h"
+
+#include <fcntl.h>
+#include <sched.h>
+#include <signal.h>
+#include <sys/syscall.h>
+#include <time.h>
+#include <ucontext.h>
+#include <unistd.h>
+
+#include <cerrno>
+#include <cstddef>
+#include <cstdint>
+
+namespace mocktail::runtime {
+namespace {
+
+volatile sig_atomic_t current_stage = 0;
+
+const char* StageName() {
+  switch (current_stage) {
+    case 1: return "native-runtime";
+    case 2: return "shutdown";
+    default: return "startup";
+  }
+}
+
+// All helpers used by the signal handler use fixed storage and system calls;
+// no iostreams, allocation, unwinding, or locks in the crashing thread.
+void WriteBytes(const char* bytes, std::size_t size) {
+  while (size > 0) {
+    const ssize_t count = write(STDERR_FILENO, bytes, size);
+    if (count < 0 && errno == EINTR) continue;
+    if (count <= 0) return;
+    bytes += count;
+    size -= static_cast<std::size_t>(count);
+  }
+}
+
+void Text(const char* text) {
+  std::size_t length = 0;
+  while (text[length] != '\0') ++length;
+  WriteBytes(text, length);
+}
+
+void Number(std::uint64_t value, unsigned base = 10) {
+  char buffer[32];
+  std::size_t start = sizeof(buffer);
+  do {
+    buffer[--start] = "0123456789abcdef"[value % base];
+    value /= base;
+  } while (value != 0);
+  WriteBytes(buffer + start, sizeof(buffer) - start);
+}
+
+void SignedNumber(long value) {
+  if (value < 0) {
+    Text("-");
+    Number(static_cast<std::uint64_t>(-(value + 1)) + 1);
+  } else {
+    Number(static_cast<std::uint64_t>(value));
+  }
+}
+
+void CpuTime(const char* label, clockid_t clock) {
+  Text(label);
+  timespec time{};
+  if (clock_gettime(clock, &time) == 0) {
+    Number(static_cast<std::uint64_t>(time.tv_sec) * 1000000000ULL +
+           static_cast<std::uint64_t>(time.tv_nsec));
+  } else {
+    Text("unavailable");
+  }
+}
+
+void DumpFile(const char* path, std::size_t maximum_bytes) {
+  Text("[diagnostic] ");
+  Text(path);
+  Text("\n");
+  const int descriptor = open(path, O_RDONLY | O_CLOEXEC);
+  if (descriptor < 0) {
+    Text("unavailable errno=");
+    SignedNumber(errno);
+    Text("\n");
+    return;
+  }
+  char buffer[2048];
+  while (maximum_bytes > 0) {
+    const std::size_t capacity = maximum_bytes < sizeof(buffer)
+                                     ? maximum_bytes : sizeof(buffer);
+    const ssize_t count = read(descriptor, buffer, capacity);
+    if (count < 0 && errno == EINTR) continue;
+    if (count <= 0) break;
+    WriteBytes(buffer, static_cast<std::size_t>(count));
+    maximum_bytes -= static_cast<std::size_t>(count);
+  }
+  if (maximum_bytes == 0) Text("\n[diagnostic] file output capped\n");
+  close(descriptor);
+}
+
+void Snapshot() {
+  Text("[diagnostic] stage=");
+  Text(StageName());
+  Text(" pid=");
+  Number(getpid());
+  Text(" ppid=");
+  Number(getppid());
+  Text(" tid=");
+  SignedNumber(syscall(SYS_gettid));
+  Text(" scheduler=");
+  SignedNumber(syscall(SYS_sched_getscheduler, 0));
+  Text(" (OTHER=0 FIFO=1 RR=2 BATCH=3 IDLE=5; RESET_ON_FORK=1073741824)");
+  CpuTime(" process_cpu_ns=", CLOCK_PROCESS_CPUTIME_ID);
+  CpuTime(" thread_cpu_ns=", CLOCK_THREAD_CPUTIME_ID);
+  CpuTime(" monotonic_ns=", CLOCK_MONOTONIC);
+  Text("\n");
+  DumpFile("/proc/self/limits", 8192);
+  DumpFile("/proc/self/cgroup", 4096);
+}
+
+void CpuLimitSignal(int signal_number, siginfo_t* info, void* context) {
+  Text("\n[crash] SIGXCPU signal=");
+  SignedNumber(signal_number);
+  Text(" si_code=");
+  SignedNumber(info != nullptr ? info->si_code : 0);
+  Text(" (SI_KERNEL=128 SI_USER=0 SI_TKILL=-6) ip=0x");
+  std::uintptr_t instruction = 0;
+  if (context != nullptr) {
+#if defined(__x86_64__)
+    instruction = static_cast<ucontext_t*>(context)->uc_mcontext.gregs[REG_RIP];
+#elif defined(__aarch64__)
+    instruction = static_cast<ucontext_t*>(context)->uc_mcontext.pc;
+#endif
+  }
+  Number(instruction, 16);
+  Text("\n");
+  Snapshot();
+  DumpFile("/proc/thread-self/comm", 256);
+  DumpFile("/proc/thread-self/sched", 8192);
+  DumpFile("/proc/self/maps", 65536);
+  Text("[crash] SIGXCPU diagnostics complete; preserving fatal signal. "
+       "For SI_KERNEL, compare CPU time with Max cpu time and the failing "
+       "thread's policy with Max realtime timeout. Collect coredumpctl info "
+       "for this PID.\n");
+  // SA_RESETHAND already restored SIG_DFL. The signal is blocked during this
+  // handler and is delivered to this same thread when the handler returns.
+  if (syscall(SYS_tgkill, getpid(), syscall(SYS_gettid), signal_number) < 0) {
+    _exit(128 + signal_number);
+  }
+}
+
+}  // namespace
+
+void InstallCpuLimitDiagnostics() {
+  struct sigaction previous{};
+  if (sigaction(SIGXCPU, nullptr, &previous) != 0) {
+    Text("[diagnostic] cannot inspect SIGXCPU handler\n");
+    return;
+  }
+  if (previous.sa_handler != SIG_DFL) {
+    Text("[diagnostic] existing SIGXCPU handler retained\n");
+    return;
+  }
+  struct sigaction action{};
+  action.sa_sigaction = CpuLimitSignal;
+  action.sa_flags = SA_SIGINFO | SA_RESETHAND;
+  sigemptyset(&action.sa_mask);
+  if (sigaction(SIGXCPU, &action, nullptr) != 0) {
+    Text("[diagnostic] cannot install SIGXCPU diagnostics\n");
+    return;
+  }
+  Text("[diagnostic] SIGXCPU diagnostics enabled; output goes to console and "
+       "the active session log\n");
+}
+
+void LogProcessDiagnostics(ProcessDiagnosticStage stage) {
+  current_stage = static_cast<sig_atomic_t>(stage);
+  Snapshot();
+}
+
+}  // namespace mocktail::runtime
@@ -0,0 +1,82 @@
+#include "runtime/process_launch_policy.h"
+
+#include <sched.h>
+#include <sys/resource.h>
+
+#include <cerrno>
+#include <cstring>
+#include <sstream>
+
+namespace mocktail::runtime {
+namespace {
+
+std::string LimitValue(rlim_t value) {
+  return value == RLIM_INFINITY ? "unlimited" : std::to_string(value);
+}
+
+void LogLimit(std::ostringstream& log, const char* name, const rlimit& limit,
+              const char* units) {
+  log << "  [process] " << name << " soft=" << LimitValue(limit.rlim_cur)
+      << " hard=" << LimitValue(limit.rlim_max) << " units=" << units << '\n';
+}
+
+}  // namespace
+
+std::string ApplyInteractiveProcessLaunchPolicy() {
+  std::ostringstream log;
+  // Browser protocol handlers inherit the browser's scheduling policy. A
+  // compute-heavy engine thread running FIFO/RR can exhaust RLIMIT_RTTIME and
+  // receive SIGXCPU even when the ordinary CPU-time limit is unlimited.
+  const int policy = sched_getscheduler(0);
+  if (policy < 0) {
+    log << "  [process] cannot read scheduling policy: " << std::strerror(errno)
+        << '\n';
+  } else {
+    log << "  [process] inherited scheduler=" << policy << '\n';
+    const int base_policy = policy & ~SCHED_RESET_ON_FORK;
+    if (base_policy == SCHED_FIFO || base_policy == SCHED_RR) {
+      const sched_param parameters{};
+      // Clearing RESET_ON_FORK requires CAP_SYS_NICE, even when demoting.
+      const int target_policy = SCHED_OTHER | (policy & SCHED_RESET_ON_FORK);
+      if (sched_setscheduler(0, target_policy, &parameters) == 0) {
+        log << "  [process] reset inherited real-time scheduler to SCHED_OTHER\n";
+      } else {
+        log << "  [process] cannot reset real-time scheduler: "
+            << std::strerror(errno) << "; RLIMIT_RTTIME may terminate startup\n";
+      }
+    }
+  }
+
+  rlimit cpu{};
+  if (getrlimit(RLIMIT_CPU, &cpu) == 0) {
+    LogLimit(log, "RLIMIT_CPU", cpu, "seconds");
+    if (cpu.rlim_cur != RLIM_INFINITY && cpu.rlim_max == RLIM_INFINITY) {
+      cpu.rlim_cur = RLIM_INFINITY;
+      if (setrlimit(RLIMIT_CPU, &cpu) == 0) {
+        log << "  [process] cleared inherited soft CPU-time limit\n";
+      } else {
+        log << "  [process] cannot clear soft CPU-time limit: "
+            << std::strerror(errno) << '\n';
+      }
+    } else if (cpu.rlim_max != RLIM_INFINITY) {
+      log << "  [process] finite CPU-time limit retained; if startup ends with "
+             "SIGXCPU, adjust the launching service's LimitCPU or launch from "
+             "a terminal with an unlimited CPU-time limit\n";
+    }
+  } else {
+    log << "  [process] cannot read RLIMIT_CPU: " << std::strerror(errno) << '\n';
+  }
+
+  // Keep the real-time watchdog intact for any threads that deliberately opt
+  // into real-time scheduling later (for example, an audio backend).
+  rlimit realtime{};
+  if (getrlimit(RLIMIT_RTTIME, &realtime) == 0) {
+    LogLimit(log, "RLIMIT_RTTIME", realtime, "microseconds");
+  } else {
+    log << "  [process] cannot read RLIMIT_RTTIME: " << std::strerror(errno)
+        << '\n';
+  }
+  return log.str();
+}
+
+}  // namespace mocktail::runtime
@@ -357,6 +357,10 @@ bool MergeDesktopAppPolicyClientSettingsOverride(std::string_view policy_json,
    return false;
  }
  overrides[std::string(kDesktopAppPolicyOverride)] = policy_json;
+  // The SDUI Charts page in 2.736/2.738 can pass a table to TextColor3 and
+  // leave the whole LuaApp blank. Default to the working legacy page while
+  // preserving explicit user overrides for testing newer UI patches.
+  overrides.emplace("FFlagLuaAppChartsAppPage", "False");
  *merged_json = overrides.dump();
  return true;
 }
@@ -11,6 +11,7 @@

 #include "jnivm/jnivm.h"
 #include "runtime/external_launch_broker.h"
+#include "runtime/roblox_launch_uri.h"
 #include "runtime/webview_helper_launcher.h"
 #include "window/window.h"

@@ -623,21 +624,22 @@ Status RobloxExperienceComposition::CloseWebSurface() {
    if (web_surface_route_ == WebSurfaceRoute::kNone) {
      return Status::Ok();
    }
-    process = web_surface_process_;
+    process = std::move(web_surface_process_);
+    web_surface_process_generation_ = 0;
    exit_observer = std::move(web_surface_logical_exit_observer_);
    web_surface_route_ = WebSurfaceRoute::kNone;
    web_surface_logical_generation_ = 0;
  }
-  const bool hidden =
-      process == nullptr || !process->running() || process->SetVisible(false);
+  // A closed challenge must stop executing. Reusing its hidden document lets
+  // late callbacks from the old attempt reach the next login attempt. The APK
+  // removes its WebView fragment here and creates a new one on the next open.
+  const bool closed =
+      process == nullptr || !process->running() || process->RequestClose();
  if (exit_observer.valid()) {
    exit_observer.on_exit(exit_observer.context.get());
  }
-  if (!hidden) {
-    if (process != nullptr) {
-      (void)process->RequestClose();
-    }
-    return Unavailable("could not hide reusable Roblox web surface");
+  if (!closed) {
+    return Unavailable("could not close Roblox web surface");
  }
  return Status::Ok();
 }
@@ -950,9 +952,23 @@ Status RobloxExperienceComposition::RouteCurrentWebSurfaceEvent(
    route = web_surface_route_;
    web_view_bridge = web_view_bridge_.get();
  }
-  return event.type == WebViewHelperEventType::kRobloxCookie
-             ? AcceptWebViewRobloxCookie(event.payload)
-             : RouteWebSurfaceEvent(route, event, web_view_bridge);
+  if (event.type == WebViewHelperEventType::kRobloxCookie) {
+    return AcceptWebViewRobloxCookie(event.payload);
+  }
+  if (event.type == WebViewHelperEventType::kExecuteRoblox) {
+    // Roblox defers a signalled launchGame until the Lua app next navigates.
+    // A parsed launchGame is launched here and never forwarded, so a deferred
+    // copy cannot start a second join later.
+    RobloxExperienceLaunchRequest request;
+    if (ParseRobloxWebViewLaunchGame(event.payload, &request).ok() &&
+        Dispatch(request).ok()) {
+      std::fprintf(stderr,
+                   "[experience] WebView launchGame queued place_id=%lld\n",
+                   static_cast<long long>(request.place_id));
+      return CloseWebSurface();
+    }
+  }
+  return RouteWebSurfaceEvent(route, event, web_view_bridge);
 }

 Status RobloxExperienceComposition::DrainPlatformEvents() {
@@ -526,7 +526,10 @@ RobloxInputDispatchResult RobloxInputRouter::HandleEvent(

 RobloxInputSnapshot RobloxInputRouter::Snapshot() const {
  std::lock_guard<std::mutex> lock(mutex_);
-  return snapshot_;
+  RobloxInputSnapshot snapshot = snapshot_;
+  const RobloxTextEditorSnapshot text = text_editor_.Snapshot();
+  snapshot.text_focus_generation = text.focused ? text.generation : 0;
+  return snapshot;
 }

 RobloxInputDispatchResult RobloxInputRouter::HandleMouseMotionLocked(
@@ -640,5 +640,64 @@ Status ParseRobloxLaunchUri(std::string_view uri,
  return MakeRequest(fields, request);
 }

+Status ParseRobloxWebViewLaunchGame(std::string_view command,
+                                    RobloxExperienceLaunchRequest* request) {
+  if (request == nullptr) {
+    return Invalid("Roblox launchGame output is null");
+  }
+  *request = {};
+  const nlohmann::json document =
+      command.size() <= kMaximumRobloxLaunchUriBytes
+          ? nlohmann::json::parse(command, nullptr, false)
+          : nlohmann::json();
+  const auto function_name = document.is_object()
+                                 ? document.find("functionName")
+                                 : document.end();
+  if (!document.is_object() || function_name == document.end() ||
+      *function_name != "launchGame") {
+    return Status::Error(StatusCode::kUnsupported,
+                         "WebView command is not launchGame");
+  }
+  const auto params = document.find("params");
+  if (params == document.end() || !params->is_object()) {
+    return Invalid("Roblox launchGame has no params");
+  }
+  const auto launch = params->find("request");
+  if (launch == params->end() || !launch->is_object()) {
+    return Invalid("Roblox launchGame has no request");
+  }
+  if (launch->size() > kMaximumParameterCount) {
+    return Invalid("Roblox launchGame request has too many fields");
+  }
+  LaunchFields fields;
+  for (const auto& [key, value] : launch->items()) {
+    std::string text;
+    if (value.is_string()) {
+      text = value.get<std::string>();
+    } else if (value.is_number_unsigned()) {
+      text = std::to_string(value.get<uint64_t>());
+    } else {
+      continue;
+    }
+    if (text.size() > kMaximumParameterValueBytes ||
+        ContainsControlBytes(text)) {
+      return Invalid("Roblox launchGame field is invalid");
+    }
+    Status status = AssignField(key == "requestType" ? "request" : key,
+                                std::move(text), false, &fields);
+    if (!status.ok()) {
+      return status;
+    }
+  }
+  if (fields.request_type.empty()) {
+    return Invalid("Roblox launchGame request type is missing");
+  }
+  Status status = MakeRequest(fields, request);
+  if (!status.ok()) {
+    *request = {};
+  }
+  return status;
+}
+
 }  // namespace runtime
 }  // namespace mocktail
@@ -14,8 +14,6 @@ namespace mocktail {
 namespace runtime {
 namespace {

-constexpr int kMinimumNativeWidth = 32;
-constexpr int kMinimumNativeHeight = 18;
 constexpr char kPasswordBullet[] = "\xE2\x80\xA2";

 void SecureClear(std::string* value) {
@@ -83,8 +81,8 @@ bool ValidateAndCountUtf8(const char* text, std::size_t size,
 bool NativeGeometryIntersectsViewport(
    const RobloxTextDisplayUpdate& update,
    const RobloxTextOverlayViewport& viewport) {
-  if (!viewport.valid() || update.area_width < kMinimumNativeWidth ||
-      update.area_height < kMinimumNativeHeight) {
+  if (!viewport.valid() || update.area_width <= 0 ||
+      update.area_height <= 0) {
    return false;
  }
  const int64_t right = static_cast<int64_t>(update.area_x) +
@@ -142,6 +142,9 @@ class ProductionTextInputBackend final
    return runtime_->EndTextFocusSession(textbox_handle, generation,
                                         notify_native);
  }
+  bool IsTextFocusSessionActive(uint64_t generation) override {
+    return runtime_->Snapshot().text_focus_generation == generation;
+  }
  Status ReplaceFocusedTextFromEngine(uint64_t generation,
                                      std::string authoritative_utf8) override {
    return runtime_->ReplaceFocusedTextFromEngine(
@@ -559,6 +562,44 @@ struct RobloxTextInputJniBridge::State {
      return CompleteTerminalOnMainThread("queue");
    }

+    // RbxKeyboard hides its own editor after Enter/Escape. The native side
+    // need not echo hideKeyboard, so reconcile the host editor before polling
+    // properties or replaying delayed text updates from that focus session.
+    if (applied_active &&
+        !backend->IsTextFocusSessionActive(applied_generation)) {
+      const uint64_t ended_generation = applied_generation;
+      if (!backend->RequestHideTextInput(ended_generation)) {
+        for (Command& command : pending) command.ClearSensitiveData();
+        {
+          std::lock_guard<std::mutex> lock(mutex);
+          EnterTerminalLocked("SDL text-input completion hide was rejected");
+        }
+        return CompleteTerminalOnMainThread("host-focus-end");
+      }
+      {
+        std::lock_guard<std::mutex> lock(mutex);
+        if (active_generation == ended_generation) {
+          desired_active = false;
+          active_handle = 0;
+          active_info = {};
+          active_geometry = {};
+          has_active_geometry = false;
+          geometry_refresh_pumps = 0;
+        }
+      }
+      for (auto it = pending.begin(); it != pending.end();) {
+        if (it->generation == ended_generation) {
+          it->ClearSensitiveData();
+          it = pending.erase(it);
+        } else {
+          ++it;
+        }
+      }
+      applied_active = false;
+      applied_generation = 0;
+      applied_handle = 0;
+    }
+
    AppendGeometryRefresh(&pending);

    bool success = true;
@@ -27,6 +27,7 @@ class RobloxTextInputJniBridgeBackend {
  virtual Status EndTextFocusSession(int64_t textbox_handle,
                                     uint64_t generation,
                                     bool notify_native) = 0;
+  virtual bool IsTextFocusSessionActive(uint64_t generation) = 0;
  virtual Status ReplaceFocusedTextFromEngine(
      uint64_t generation, std::string authoritative_utf8) = 0;
  virtual Status QueryCurrentTextBoxInfo(
@@ -431,13 +431,12 @@ Status RobloxTextSurfaceOverlay::RasterizeLocked() {
      static_cast<std::size_t>(width * height * 4), 0);
  const int frame_width = static_cast<int>(width);
  const int frame_height = static_cast<int>(height);
-  // Use Roblox's horizontal text bounds directly. Inventing padding from
-  // the field's width or position shifts text away from its native origin
-  // and makes long lines scroll before they reach the field's actual edge.
+  // Use Roblox's text bounds directly. Extra padding shifts the native text
+  // origin, scrolls long lines too early and clips compact chat fields.
  const int clip_left = 0;
  const int clip_right = frame_width;
-  const int clip_top = 3;
-  const int clip_bottom = std::max(clip_top, frame_height - 3);
+  const int clip_top = 0;
+  const int clip_bottom = frame_height;
  const int available_width = std::max(1, clip_right - clip_left);
  const bool wrapped_layout =
      presentation.multiline || presentation.text_wrapped;
@@ -8,6 +8,8 @@
 #include <string>
 #include <utility>

+#include "runtime/environment.h"
+
 namespace mocktail {
 namespace runtime {
 namespace {
@@ -1207,7 +1209,23 @@ Status RobloxWebViewBridge::DispatchOpenRequest(
  if (!status.ok()) {
    return status;
  }
-  const bool browser_login_fallback = IsLoginChallengeUrl(request.url);
+  // Native sign-in must keep the original challenge and its return token so
+  // Roblox can finish the in-app login instead of starting a browser login.
+  const bool login_challenge = IsLoginChallengeUrl(request.url);
+  const bool browser_login_fallback =
+      ProcessEnvironment{}.Get("MOCKTAIL_NATIVE_LOGIN") == "0" &&
+      login_challenge;
+  if (login_challenge) {
+    // Roblox can preload challenges with isVisible=false and ask to reveal
+    // them only after the page signals readiness. A failed resource load then
+    // leaves the native login waiting behind an inaccessible host window.
+    // Present verification immediately so it can always be seen and closed.
+    request.is_visible = true;
+    if (request.title.empty()) {
+      request.title = "Roblox verification";
+    }
+    std::fprintf(stderr, "  [webview] presenting login verification window\n");
+  }
  if (browser_login_fallback) {
    request.url = kBrowserLoginUrl;
    request.title = "Roblox sign in";
@@ -287,6 +287,35 @@ RuntimeConfig RuntimeConfig::FromEnvironment(const Environment& environment) {
  config.use_system_proxy_ =
      LegacyEnabled(environment, "MOCKTAIL_USE_SYSTEM_PROXY");
  config.network_proxy_ = ReadNetworkProxy(environment);
+  config.fleasion_enabled_ = ReadBoolean(
+      environment, "MOCKTAIL_FLEASION_ENABLED", false, &config.fleasion_valid_);
+  config.fleasion_proxy_mode_ = environment.GetOr("MOCKTAIL_FLEASION_PROXY_MODE", "env");
+  const auto fleasion_proxy = ParseNetworkProxyConfig(
+      "127.0.0.1", environment.GetOr("MOCKTAIL_FLEASION_PROXY_PORT", "58443"));
+  if (!fleasion_proxy || (config.fleasion_proxy_mode_ != "env" &&
+                         config.fleasion_proxy_mode_ != "hosts")) {
+    config.fleasion_valid_ = false;
+  } else {
+    config.fleasion_proxy_port_ = fleasion_proxy->port;
+  }
+  if (const auto certificate = environment.Get("MOCKTAIL_FLEASION_CA_CERTIFICATE")) {
+    config.fleasion_ca_certificate_ = *certificate;
+    if (certificate->empty() || !config.fleasion_ca_certificate_->is_absolute())
+      config.fleasion_valid_ = false;
+  }
+  if (config.fleasion_enabled_) {
+    if (config.use_system_proxy_) config.fleasion_valid_ = false;
+    if (config.fleasion_proxy_mode_ == "env" && fleasion_proxy) {
+      if (config.network_proxy_ &&
+          (config.network_proxy_->host != fleasion_proxy->host ||
+           config.network_proxy_->port != fleasion_proxy->port ||
+           config.network_proxy_->scheme != "http"))
+        config.fleasion_valid_ = false;
+      config.network_proxy_ = fleasion_proxy;
+    } else if (config.network_proxy_) {
+      config.fleasion_valid_ = false;
+    }
+  }
  if (const std::optional<std::string> ca_bundle =
          environment.Get("MOCKTAIL_CA_BUNDLE");
      ca_bundle.has_value()) {
@@ -93,6 +93,16 @@ audio:
  input_device: default

 integrations:
+  fleasion:
+    # Boolean (default: false): trust Fleasion's CA without editing Roblox files.
+    enabled: false
+    # String: match Fleasion's routing mode: env or hosts.
+    proxy_mode: env
+    # Integer: Fleasion's local HTTP proxy port in env mode.
+    proxy_port: 58443
+    # Optional absolute public CA path. Default: $XDG_CONFIG_HOME/Fleasion/proxy_ca/ca.crt
+    # or ~/.config/Fleasion/proxy_ca/ca.crt. Never select ca.key.
+    # ca_certificate: /home/user/.config/Fleasion/proxy_ca/ca.crt
  discord_rpc:
    # Boolean (default: false): publish Mocktail activity to Discord Desktop.
    # This never signs in to Discord and never reads an account token.
@@ -188,6 +188,10 @@ bool ValidateAndMap(const ValueMap& yaml, ValueMap* environment,
      "network.proxy_host",
      "network.proxy_port",
      "network.ca_bundle",
+      "integrations.fleasion.enabled",
+      "integrations.fleasion.proxy_mode",
+      "integrations.fleasion.proxy_port",
+      "integrations.fleasion.ca_certificate",
      "integrations.discord_rpc.enabled",
      "integrations.discord_rpc.show_place_name",
      "integrations.discord_rpc.show_elapsed_time",
@@ -483,6 +487,7 @@ bool ValidateAndMap(const ValueMap& yaml, ValueMap* environment,
           std::pair<std::string_view, std::string_view>(
               "integrations.discord_rpc.enabled",
               "MOCKTAIL_DISCORD_RPC_ENABLED"),
+           {"integrations.fleasion.enabled", "MOCKTAIL_FLEASION_ENABLED"},
           {"integrations.discord_rpc.show_place_name",
            "MOCKTAIL_DISCORD_RPC_SHOW_PLACE_NAME"},
           {"integrations.discord_rpc.show_elapsed_time",
@@ -503,6 +508,15 @@ bool ValidateAndMap(const ValueMap& yaml, ValueMap* environment,
    }
    (*environment)[std::string(variable)] = parsed ? "1" : "0";
  }
+  for (const auto& [key, variable] : {
+           std::pair<std::string_view, std::string_view>(
+               "integrations.fleasion.proxy_mode", "MOCKTAIL_FLEASION_PROXY_MODE"),
+           {"integrations.fleasion.proxy_port", "MOCKTAIL_FLEASION_PROXY_PORT"},
+           {"integrations.fleasion.ca_certificate", "MOCKTAIL_FLEASION_CA_CERTIFICATE"},
+       }) {
+    if (const auto configured = value(key))
+      (*environment)[std::string(variable)] = *configured;
+  }
  if (const auto application_id =
          value("integrations.discord_rpc.application_id");
      application_id.has_value()) {
@@ -751,6 +765,10 @@ RuntimeConfigLoadResult LoadRuntimeConfig(
    result.error = "GameMode policy is invalid";
  } else if (!result.config.performance().physics_worker_mode_valid) {
    result.error = "physics worker policy is invalid";
+  } else if (!result.config.fleasion_valid()) {
+    result.error = "Fleasion configuration is invalid: use proxy_mode env or hosts, "
+                   "a port from 1 to 65535, an absolute CA certificate path, and "
+                   "no conflicting system/fixed proxy";
  } else if (!result.config.ca_bundle_valid()) {
    result.error = "CA bundle path is invalid";
  } else if (!result.config.discord_rpc_valid()) {
@@ -761,6 +779,10 @@ RuntimeConfigLoadResult LoadRuntimeConfig(

 bool ExportRuntimeConfigEnvironment(const RuntimeConfig& config,
                                    std::string* error) {
+  if (!config.fleasion_valid()) {
+    if (error != nullptr) *error = "cannot export invalid Fleasion configuration";
+    return false;
+  }
  if (!config.device_profile_valid()) {
    if (error != nullptr) {
      *error = "cannot export an invalid device profile";
@@ -910,6 +932,20 @@ bool ExportRuntimeConfigEnvironment(const RuntimeConfig& config,
  if (!base_exported) {
    return false;
  }
+  if (!SetEnvironmentValue("MOCKTAIL_FLEASION_ENABLED",
+                           config.fleasion_enabled() ? "1" : "0", error) ||
+      !SetEnvironmentValue("MOCKTAIL_FLEASION_PROXY_MODE",
+                           config.fleasion_proxy_mode(), error) ||
+      !SetEnvironmentValue("MOCKTAIL_FLEASION_PROXY_PORT",
+                           std::to_string(config.fleasion_proxy_port()), error))
+    return false;
+  if (config.fleasion_ca_certificate()) {
+    if (!SetEnvironmentValue("MOCKTAIL_FLEASION_CA_CERTIFICATE",
+                             config.fleasion_ca_certificate()->string(), error))
+      return false;
+  } else if (!UnsetEnvironmentValue("MOCKTAIL_FLEASION_CA_CERTIFICATE", error)) {
+    return false;
+  }
  if (config.ca_bundle().has_value()) {
    if (!SetEnvironmentValue("MOCKTAIL_CA_BUNDLE",
                             config.ca_bundle()->string(), error)) {
@@ -1,3 +1,4 @@
+// Includes changes by vii from CoderDayton/nightcap.
 #include "runtime/runtime_paths.h"

 #define JSON_NOEXCEPTION 1
@@ -13,6 +14,8 @@
 #include <unistd.h>
 #include <utility>

+#include "compat/guest_abi.h"
+
 namespace mocktail {
 namespace runtime {
 namespace {
@@ -437,8 +440,8 @@ ActivePayloadPaths RuntimePaths::ResolveActivePayload() const {
  const std::filesystem::path library = canonical_root / "libroblox.so";
  const std::filesystem::path package_root = canonical_root / "sober_apk";
  const std::filesystem::path base_apk = package_root / "base.apk";
-  const std::filesystem::path x86_64_split_apk =
-      package_root / "split_config.x86_64.apk";
+  const std::filesystem::path arch_split_apk =
+      package_root / compat::kGuestSplitApkFile;
  const std::filesystem::path assets_root = canonical_root / "assets";
  const std::filesystem::path assets = canonical_root / "assets/content";
  const std::filesystem::file_status library_status =
@@ -459,7 +462,8 @@ ActivePayloadPaths RuntimePaths::ResolveActivePayload() const {
  for (const auto& [path, name] :
       std::array<std::pair<std::filesystem::path, const char*>, 2>{
           std::pair{base_apk, "base.apk"},
-           std::pair{x86_64_split_apk, "split_config.x86_64.apk"}}) {
+           std::pair{arch_split_apk,
+                     compat::kGuestSplitApkFile.data()}}) {
    const std::filesystem::file_status status =
        std::filesystem::symlink_status(path, filesystem_error);
    if (filesystem_error || !std::filesystem::is_regular_file(status) ||
@@ -488,7 +492,7 @@ ActivePayloadPaths RuntimePaths::ResolveActivePayload() const {
  result.root = canonical_root;
  result.roblox_library = library;
  result.base_apk = base_apk;
-  result.x86_64_split_apk = x86_64_split_apk;
+  result.arch_split_apk = arch_split_apk;
  result.assets_content = assets;

  const auto compatibility_manifest =
@@ -603,7 +607,9 @@ bool ExportRuntimePathEnvironment(const RuntimePaths& paths,
         SetEnvironmentDefault("MOCKTAIL_ANDROID_CACHE_HOST_ROOT",
                               paths.android_cache_root(), error) &&
         SetEnvironmentDefault("MOCKTAIL_VULKAN_SHADER_CACHE_HOST_PATH",
-                               paths.vulkan_shader_cache_file(), error);
+                               paths.vulkan_shader_cache_file(), error) &&
+         SetEnvironmentDefault("MOCKTAIL_TEXTURE_OVERRIDE_DIR",
+                               paths.config_root() / "textures", error);
 }

 bool PrepareManagedPayloadWorkingDirectory(const RuntimePaths& paths,
Author	SHA1	Message	Date
vii	0f6847d6d7	fix(webview): launch web Play buttons without waiting for navigation Roblox defers a launchGame sent from the WebView until the Lua app next navigates, so joining a private server stalled until a sidebar tab was clicked. Parse launchGame in the runtime, queue it through the experience launch pipeline, and close the WebView. Other commands still reach Roblox. Fixes #169	2026-09-24 23:01:44 -05:00
珍惜andHttpAnimations	30d50f15d1	Fix catalog unable to tell arm64 from x86_64 profiles for the same version. (#167 ) Co-authored-by: HttpAnimations <shawndouglasyt@gmail.com>	2026-09-24 20:12:18 +03:00
komaruworld	ab940acfb5	add arm64 ci with build fog, update faq	2026-09-24 19:03:22 +03:00
farwhile	719b1fdd22	fix/respect host natural scrolling direction (#163 )	2026-09-23 18:31:41 +03:00
珍惜andHttpAnimations	1fa2e116b3	Fix crashing on x86 hosts (#162 ) Co-authored-by: HttpAnimations <shawndouglasyt@gmail.com>	2026-09-23 12:04:53 +03:00
珍惜andHttpAnimations	40237fae72	arm 64 (#152 ) Co-authored-by: HttpAnimations <shawndouglasyt@gmail.com>	2026-09-21 20:09:37 +03:00
komaruworld	854969457f	Fix textures and device info from Nightcap Ported from CoderDayton/nightcap	2026-09-18 16:55:29 +03:00
komaruworld	b54c896498	ci hate me?	2026-09-15 19:52:24 +03:00
komaruworld	1cd7b7db8f	Fuck ci	2026-09-15 19:42:56 +03:00
komaruworld	cdbf9ac1eb	revert commit `fdce534`	2026-09-15 18:26:13 +03:00
komaruworld	f383fbbff4	update faq.md	2026-09-15 12:08:18 +03:00
komaruworld	d76d75b7f8	rollback to native login not fully test	2026-09-14 19:03:36 +03:00
komaruworld	537828acc2	Fix vc Fixes #128 Fixes #132	2026-09-14 16:36:35 +03:00
komaruworld	5be2f68a55	Support input devices Fix ci, some shit with webkit on wayland	2026-09-14 15:24:04 +03:00
komaruworld	f7e519bae1	I forgot to add changelog	2026-09-14 14:50:12 +03:00
komaruworld	ad8fbfcf65	Add 1.0.4 release to flathub metadata	2026-09-14 14:36:49 +03:00
komaruworld	96e1966d16	sigxcpu crashes fix Refs #84	2026-09-14 13:15:54 +03:00
komaruworld	becaee71c0	Add fleasion support Close #18	2026-09-14 13:05:24 +03:00
komaruworld	ab4944a907	Fix shit with sigxcpu Refs #84	2026-09-14 12:34:09 +03:00
komaruworld	017f79398d	Fix crash in resize windows	2026-09-13 14:32:41 +03:00
komaruworld	fc120e8285	support rbx 2.738 with fix charts	2026-09-13 13:02:25 +03:00
komaruworld	117b9b2016	Update mocktail package in aur 😢	2026-09-12 23:21:27 +03:00
komaruworld	1376ab2474	Ci fixes sha256 i skoro sha snesy naher	2026-09-12 23:13:55 +03:00
komaruworld	fdce53421f	Fix low textures THX HIPPO! <3	2026-09-12 20:52:25 +03:00
komaruworld	770ed086d5	Fix aur bin Close #132 :(	2026-09-12 19:27:53 +03:00
komaruworld	c48db09f13	Fix chat text render on opengl	2026-09-12 15:59:03 +03:00
komaruworld	0548ebd253	Fix chat text render and chat shiftlock issues Fixes 106, Fixes #127, Refs #116	2026-09-12 14:45:29 +03:00