feat(update): add an evidence-scoring solver for HostAbi addresses with a check command

test(update): add a 2908 to 3222 regression set for the HostAbi deriver
Share the input checks and FMOD slot tables so the solver reuses them.
2026-10-17 20:00:46 +02:00 · 2026-10-15 01:49:19 -05:00 · 2026-10-15 01:49:19 -05:00 · 2026-10-15 01:31:02 -05:00 · 2026-10-15 01:31:02 -05:00 · 2026-10-15 01:26:27 -05:00
114 changed files with 8673 additions and 1676 deletions
@@ -0,0 +1,119 @@
+name: Publish AUR packages
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Release tag to publish, such as v0.3.4
+        required: true
+        type: string
+  workflow_call:
+    inputs:
+      tag:
+        required: true
+        type: string
+    secrets:
+      AUR_SSH_PRIVATE_KEY:
+        required: false
+
+permissions:
+  contents: read
+
+concurrency:
+  group: aur-publish
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    name: Publish nightcap and nightcap-bin
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    environment: release
+    steps:
+      - name: Check out the release
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.tag }}
+          persist-credentials: false
+
+      - name: Render the recipes
+        shell: bash
+        env:
+          TAG: ${{ inputs.tag }}
+        run: |
+          set -Eeuo pipefail
+          [[ "$TAG" =~ ^v[0-9]+(\.[0-9]+)*$ ]]
+          version="${TAG#v}"
+          archive="nightcap-${version}-1-x86_64.pkg.tar.zst"
+          # nightcap-bin installs the pacman package from the release page, so
+          # its checksum is the one published beside that asset.
+          checksum="$(curl -fsSL \
+            "https://github.com/${GITHUB_REPOSITORY}/releases/download/${TAG}/${archive}.sha256" |
+            awk '{print $1}')"
+          [[ "$checksum" =~ ^[0-9a-f]{64}$ ]]
+
+          sed -i "s/^pkgver=.*/pkgver=${version}/" \
+            packaging/aur/nightcap/PKGBUILD packaging/aur/nightcap-bin/PKGBUILD
+          sed -i "s/^sha256sums=('SKIP')$/sha256sums=('${checksum}')/" \
+            packaging/aur/nightcap-bin/PKGBUILD
+          grep -Fqx "sha256sums=('${checksum}')" packaging/aur/nightcap-bin/PKGBUILD
+
+          docker run --rm \
+            --volume "$GITHUB_WORKSPACE/packaging/aur:/aur" \
+            ghcr.io/archlinux/archlinux:base-devel@sha256:c3953446016873a756fb7814f10087cac1634c127f7302e80c81c512da796d05 bash -Eeuo pipefail -c '
+              useradd --create-home builder
+              for package in nightcap nightcap-bin; do
+                install -d -o builder -g builder "/tmp/${package}"
+                install -o builder -g builder -m 0644 \
+                  "/aur/${package}/PKGBUILD" "/tmp/${package}/PKGBUILD"
+                runuser -u builder -- bash -c \
+                  "cd /tmp/${package} && makepkg --printsrcinfo" \
+                  > "/aur/${package}/.SRCINFO"
+              done
+            '
+
+          for package in nightcap nightcap-bin; do
+            grep -Fqx "pkgver=${version}" "packaging/aur/${package}/PKGBUILD"
+            grep -Fqx $'\tpkgver = '"${version}" "packaging/aur/${package}/.SRCINFO"
+          done
+          echo "VERSION=${version}" >> "$GITHUB_ENV"
+
+      - name: Push to the AUR
+        shell: bash
+        env:
+          AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
+        run: |
+          set -Eeuo pipefail
+          if [[ -z "${AUR_SSH_PRIVATE_KEY}" ]]; then
+            echo "::notice::AUR_SSH_PRIVATE_KEY is not set; nothing was pushed to the AUR"
+            exit 0
+          fi
+
+          ssh_dir="$(mktemp -d)"
+          trap 'rm -rf "$ssh_dir"' EXIT
+          install -m 0600 /dev/null "$ssh_dir/key"
+          printf '%s\n' "$AUR_SSH_PRIVATE_KEY" > "$ssh_dir/key"
+          # The AUR lists this key's fingerprint on its front page:
+          # SHA256:RFzBCUItH9LZS0cKB5UE6ceAYhBD5C8GeOBip8Z11+4
+          printf '%s\n' \
+            'aur.archlinux.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEuBKrPzbawxA/k2g6NcyV5jmqwJ2s+zpgZGZ7tpLIcN' \
+            > "$ssh_dir/known_hosts"
+          export GIT_SSH_COMMAND="ssh -i $ssh_dir/key -o IdentitiesOnly=yes -o UserKnownHostsFile=$ssh_dir/known_hosts -o StrictHostKeyChecking=yes"
+
+          for package in nightcap nightcap-bin; do
+            checkout="$ssh_dir/$package"
+            git clone "ssh://aur@aur.archlinux.org/${package}.git" "$checkout"
+            cp "packaging/aur/${package}/PKGBUILD" "packaging/aur/${package}/.SRCINFO" \
+              "$checkout/"
+            git -C "$checkout" add PKGBUILD .SRCINFO
+            if git -C "$checkout" diff --cached --quiet; then
+              echo "::notice::${package} is already at ${VERSION}"
+              continue
+            fi
+            git -C "$checkout" \
+              -c user.name='Nightcap release' \
+              -c user.email='CoderDayton@users.noreply.github.com' \
+              commit --quiet -m "Update to ${VERSION}"
+            # The AUR only accepts the master branch.
+            git -C "$checkout" push origin HEAD:master
+          done
@@ -38,6 +38,9 @@ jobs:
    name: Flatpak build
    runs-on: ubuntu-24.04
    timeout-minutes: 120
+    # The signing key lives in the release environment, which only main and
+    # v* tags may use. Builds that do not publish run without it.
+    environment: ${{ (startsWith(github.ref, 'refs/tags/v') || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main')) && 'release' || '' }}
    env:
      # Publish on release tags and on manual runs from main. Pull requests
      # only verify that the manifest still builds.
@@ -44,6 +44,8 @@ jobs:
    if: needs.probe.outputs.build == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 90
+    env:
+      UPINFO: gh-releases-zsync|${{ github.repository_owner }}|${{ github.event.repository.name }}|continuous|Nightcap-nightly-x86_64.AppImage.zsync
    steps:
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -60,6 +62,7 @@ jobs:
            --volume "$GITHUB_WORKSPACE:/workspace" \
            --workdir /workspace \
            --env GH_TOKEN \
+            --env UPINFO \
            ghcr.io/archlinux/archlinux:base-devel@sha256:c3953446016873a756fb7814f10087cac1634c127f7302e80c81c512da796d05 bash -Eeuo pipefail -c '
              pacman -Syu --noconfirm --needed \
                cmake git ninja pkgconf lld sdl3 sdl3_ttf curl openssl \
@@ -123,11 +126,12 @@ jobs:
              export RUNTIME=/tmp/uruntime
              export DWARFS_CMD=/tmp/mkdwarfs
              make appimage BUILD_DIR=build-appimage JOBS=4 \
-                APPIMAGE=dist/Mocktail-x86_64.AppImage \
+                APPIMAGE=dist/Nightcap-nightly-x86_64.AppImage \
                PORTABLE_MODE=standalone APPIMAGE_FORMAT=anylinux \
                ANYLINUX_PACKAGER=/tmp/quick-sharun \
                ANYLINUX_APPIMAGETOOL=/tmp/appimagetool
-              test -x dist/Mocktail-x86_64.AppImage
+              test -x dist/Nightcap-nightly-x86_64.AppImage
+              test -s dist/Nightcap-nightly-x86_64.AppImage.zsync
            '

      - name: Smoke-test AppImage without FUSE
@@ -140,14 +144,17 @@ jobs:
          export XDG_CACHE_HOME="$smoke_dir/cache"
          export XDG_STATE_HOME="$smoke_dir/state"
          mkdir -p "$XDG_DATA_HOME" "$XDG_CONFIG_HOME" "$XDG_CACHE_HOME" "$XDG_STATE_HOME"
-          timeout 60s dist/Mocktail-x86_64.AppImage --appimage-extract-and-run --help
-          timeout 60s dist/Mocktail-x86_64.AppImage --appimage-extract-and-run mocktail_updater status
+          test "$(dist/Nightcap-nightly-x86_64.AppImage --appimage-updateinformation)" = "$UPINFO"
+          timeout 60s dist/Nightcap-nightly-x86_64.AppImage --appimage-extract-and-run --help
+          timeout 60s dist/Nightcap-nightly-x86_64.AppImage --appimage-extract-and-run mocktail_updater status

      - name: Upload AppImage
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: Nightcap-AppImage
-          path: dist/Mocktail-x86_64.AppImage
+          path: |
+            dist/Nightcap-nightly-x86_64.AppImage
+            dist/Nightcap-nightly-x86_64.AppImage.zsync
          if-no-files-found: error
          retention-days: 14

@@ -173,13 +180,14 @@ jobs:
          name: Nightcap-AppImage
          path: release

-      - name: Name and checksum the nightly build
+      - name: Checksum the nightly build
        shell: bash
        run: |
          set -Eeuo pipefail
-          # The Makefile builds under upstream's artifact name; the published
-          # asset carries this fork's.
-          mv -- release/Mocktail-x86_64.AppImage release/Nightcap-nightly-x86_64.AppImage
+          # The .zsync file names the AppImage it updates, so the build already
+          # carries the published name.
+          test -s release/Nightcap-nightly-x86_64.AppImage
+          test -s release/Nightcap-nightly-x86_64.AppImage.zsync
          (cd release && sha256sum Nightcap-nightly-x86_64.AppImage \
            > Nightcap-nightly-x86_64.AppImage.sha256)
          find release -maxdepth 1 -type f -print
@@ -206,7 +214,7 @@ jobs:
          # Drop assets left by earlier runs under other names.
          while IFS= read -r asset; do
            case "$asset" in
-              Nightcap-nightly-x86_64.AppImage|Nightcap-nightly-x86_64.AppImage.sha256)
+              Nightcap-nightly-x86_64.AppImage|Nightcap-nightly-x86_64.AppImage.zsync|Nightcap-nightly-x86_64.AppImage.sha256)
                ;;
              *)
                gh release delete-asset continuous "$asset" --yes
@@ -336,3 +336,15 @@ jobs:
            --title "Nightcap $tag" --notes-file release/notes.md
          gh release upload "$tag" --repo "$GITHUB_REPOSITORY" --clobber \
            "${uploads[@]}"
+
+  # nightcap-bin downloads the pacman package from the release page, so this
+  # waits for the upload.
+  aur:
+    name: Publish AUR packages
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: publish
+    uses: ./.github/workflows/aur-publish.yml
+    with:
+      tag: ${{ github.ref_name }}
+    secrets:
+      AUR_SSH_PRIVATE_KEY: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
@@ -1,248 +1,265 @@
 # Changelog

-All notable changes to Nightcap. The format follows
-[Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Release notes on
-GitHub are taken from the matching section here.
+All notable changes to Nightcap. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+Release notes on GitHub are taken from the matching section here.

 ## [Unreleased]

+### Added
+
+- An asset overlay folder, `~/.local/share/mocktail/asset_overlay`. A file there replaces the file Roblox
+  ships at the same path, such as a cursor, a font or a sky texture, and it stays in place when Roblox
+  updates. The layout matches Sober's `asset_overlay` folder. `MOCKTAIL_ASSET_OVERLAY_DIR` moves it. Thanks to
+  @dim-ghub.
+- The asset overlay folder now also replaces files Roblox downloads and no longer ships, such as the shift
+  lock and text cursors. Put the file under `content/`, at the path Roblox uses. Thanks to @dim-ghub for the
+  idea.
+- `MOCKTAIL_ASSET_TRACE=1` now also prints the files Roblox asks for and does not get, as `[asset] miss`.
+- Arch Linux: `nightcap-git` is on the AUR and builds the current `main` branch. Thanks to @dim-ghub, who
+  maintains it.
+- The log now names each Roblox Java call that Nightcap has no handler for, once per call, as
+  `[JNI] no handler for <class>.<method><signature>`. This shows what a new Roblox version needs.
+
+### Changed
+
+- Nightcap answers Roblox's Java calls with less work per call, and the audio thread no longer allocates
+  memory for each block of sound it plays.
+
+## [0.3.4] - 2026-10-11
+
+### Added
+
+- The AppImage build now makes a `.zsync` file, so tools like `appimageupdatetool` can update the AppImage.
+- The desktop side panel menu now shows by default on PC profiles. Set `FIntFlyoutTestVariantRollout12` in
+  `fflags.json` to change it.
+
+### Changed
+
+- The Flatpak build asks for the X11 socket only when there is no Wayland session, as before 0.3.3.
+- Nightcap now uses Wayland on a Wayland session with NVIDIA drivers too, however it is started. It used to
+  fall back to X11 there when started from a terminal.
+- Building Nightcap no longer needs libexecinfo.
+
+### Fixed
+
+- Fixed Roblox 2.742 being rejected as an update, which left the game on the older version. Nightcap now
+  accepts Roblox versions that change the order of their start-up steps.
+- Fixed Nightcap reporting Mocktail's version number, 1.0.4, in session logs and support bundles. It now
+  reports its own version.
+- Fixed the old Roblox home screen showing instead of the new one with the Me tab and the "For you" and
+  "Charts" tabs. Nightcap now runs the Roblox start-up step that loads the new interface for your account.
+- Fixed anti-aliasing being forced off at every graphics quality level. Roblox now picks it, and a
+  `FIntDebugForceMSAASamples` value in `fflags.json` still applies. Thanks to @qutad.
+- Fixed the voice chat microphone only working on Roblox 2.738. It no longer depends on one Roblox version.
+- Fixed other players not hearing you in voice chat after a Roblox update. The updater now rebuilds the
+  audio device data when the previous version's profile has none.
+- Fixed frame hitches while textures load on graphics cards that need ETC2 textures decoded on the CPU.
+- Fixed problems on Chimera Linux and other musl systems, including error messages that differed from the
+  ones Roblox expects.
+- Fixed the nightly AppImage build failing when a bundled GTK 4 was older than the one libadwaita needs.
+- Fixed a random crash on Wayland with NVIDIA drivers, where the game window closed after you let go of the
+  camera or left mouse lock. The log showed `wp_linux_drm_syncobj_surface_v1` error 3.
+- Fixed some menu actions being ignored. The Chat button on a profile now opens the Party tab with that
+  player, and clicking a search suggestion now runs the search instead of closing the search menu.
+- Fixed possible crashes when the game calls an Android function Nightcap did not provide, or releases the
+  same reference twice.
+- Fixed a possible hang on close when a web view process stayed open. Nightcap now stops waiting for the log
+  writer after 2 seconds.
+- Fixed a possible missing picture on graphics drivers that reject the low-latency present mode. Nightcap now
+  retries with the game's own mode.
+- Fixed a possible Wayland crash when the window first appears on the OpenGL graphics path.
+- Fixed a missing picture on machines where the graphics card runs a different driver than the one Nightcap
+  picked, such as an NVIDIA card on nouveau or a laptop with an Intel chip and an older second card. Nightcap
+  now picks the Vulkan driver that matches the running kernel driver, and says so when no card can run Vulkan.
+
 ## [0.3.3] - 2026-10-04

 ### Added

- Joining a friend from a Roblox "follow user" link now works. Nightcap looks
-  up which game they are in and joins it.
+- Joining a friend from a Roblox "follow user" link now works. Nightcap looks up which game they are in and
+  joins it.
 - Nix users get a desktop entry for the app.

 ### Changed

- Roblox textures now decode about 3 times faster, which shortens the stalls
-  when a place loads and when new parts of the map stream in. Thanks to
-  @glook9001.
+- Roblox textures now decode about 3 times faster, which shortens the stalls when a place loads and when new
+  parts of the map stream in. Thanks to @glook9001.

 ### Fixed

- `make update-roblox` no longer deletes your previous Roblox install when an
-  import fails partway through. If a step fails, the old files are put back,
-  or kept in a folder whose path is printed. Thanks to @kimlherme.
- A failed Roblox update now restores your previous version's records instead
-  of leaving them half switched. A damaged version file is rejected instead of
-  being half read, and a temporary failure to start the startup check no longer
-  marks a working Roblox build as broken for good. Thanks to @kimlherme.
- Fixed a possible crash when Roblox clears its audio queue while sound is
-  still playing, and a memory leak in lists of objects passed to Roblox's Java
-  code. Thanks to @kimlherme.
- Fixed a possible crash when the text overlay shuts down, a freeze when Roblox
-  releases the mouse lock while another release is already in progress, and
-  network lookups that misread Roblox's options. Thanks to @kimlherme.
- Fixed the sky sometimes rendering with the wrong textures in the Vulkan
-  renderer.
- Clicking while a Roblox text box has focus no longer closes it. Only Roblox
-  decides when a click ends typing.
- Going to another page in the web view, such as Friends from a profile, no
-  longer closes the web view. It crashed on every page change on Wayland
-  systems whose GL setup GTK could not use.
- Fixed a crash when Roblox's saved dark or light theme setting was missing or
-  damaged.
- The Flatpak build now detects an NVIDIA driver from inside its sandbox, so it
-  uses X11 instead of native Wayland where both are available. This avoids
-  Wayland hangs and display disconnects.
+- `make update-roblox` no longer deletes your previous Roblox install when an import fails partway through. If
+  a step fails, the old files are put back, or kept in a folder whose path is printed. Thanks to @kimlherme.
+- A failed Roblox update now restores your previous version's records instead of leaving them half switched. A
+  damaged version file is rejected instead of being half read, and a temporary failure to start the startup
+  check no longer marks a working Roblox build as broken for good. Thanks to @kimlherme.
+- Fixed a possible crash when Roblox clears its audio queue while sound is still playing, and a memory leak in
+  lists of objects passed to Roblox's Java code. Thanks to @kimlherme.
+- Fixed a possible crash when the text overlay shuts down, a freeze when Roblox releases the mouse lock while
+  another release is already in progress, and network lookups that misread Roblox's options. Thanks to
+  @kimlherme.
+- Fixed the sky sometimes rendering with the wrong textures in the Vulkan renderer.
+- Clicking while a Roblox text box has focus no longer closes it. Only Roblox decides when a click ends
+  typing.
+- Going to another page in the web view, such as Friends from a profile, no longer closes the web view. It
+  crashed on every page change on Wayland systems whose GL setup GTK could not use.
+- Fixed a crash when Roblox's saved dark or light theme setting was missing or damaged.

 ## [0.3.2] - 2026-09-29

 ### Added

- Performance recordings made with `--profile` now show how busy the CPU was
-  during each frame, which makes it easier to tell what caused a stutter.
- Experimental support for ARM64 (`aarch64`) Linux, running Roblox's Android
-  `arm64-v8a` client.
+- Performance recordings made with `--profile` now show how busy the CPU was during each frame, which makes it
+  easier to tell what caused a stutter.
+- Experimental support for ARM64 (`aarch64`) Linux, running Roblox's Android `arm64-v8a` client.

 ### Fixed

- When Roblox asks for a Google Play device check during login, Nightcap now
-  answers right away that it isn't supported. Before, the "Verifying you're
-  not a bot" screen waited about a minute for an answer and then sent you
-  back to the login screen.
- Solving a login challenge now closes its window. Before, Roblox's
-  "challenge completed" signal was ignored and the window stayed open.
-  Thanks to @glook9001.
- Login no longer stalls after you pass a verification check. Before, Roblox
-  only saw the page's "challenge completed" signal after a one-minute
-  timeout, so it gave up and the login failed. On a Roblox build Nightcap
-  can't handle this way, the log says "WebViewProtocol getter not
-  recognized" and web pages behave as before.
- Login check windows and other web pages get 5 seconds to start instead of
-  3, so a slow start no longer closes them. The log says how long each one
-  took to open.
- Less stutter while joining a game and while textures load in. In Blade
-  Ball, loading hitches dropped by about half, and the worst one went from
-  0.8 seconds to 0.55 seconds.
- Clicking Play on a private server now joins right away. Before, nothing
-  happened until you clicked a sidebar tab like Home.
+- When Roblox asks for a Google Play device check during login, Nightcap now answers right away that it isn't
+  supported. Before, the "Verifying you're not a bot" screen waited about a minute for an answer and then sent
+  you back to the login screen.
+- Solving a login challenge now closes its window. Before, Roblox's "challenge completed" signal was ignored
+  and the window stayed open. Thanks to @glook9001.
+- Login no longer stalls after you pass a verification check. Before, Roblox only saw the page's "challenge
+  completed" signal after a one-minute timeout, so it gave up and the login failed. On a Roblox build Nightcap
+  can't handle this way, the log says "WebViewProtocol getter not recognized" and web pages behave as before.
+- Login check windows and other web pages get 5 seconds to start instead of 3, so a slow start no longer
+  closes them. The log says how long each one took to open.
+- Less stutter while joining a game and while textures load in. In Blade Ball, loading hitches dropped by
+  about half, and the worst one went from 0.8 seconds to 0.55 seconds.
+- Clicking Play on a private server now joins right away. Before, nothing happened until you clicked a sidebar
+  tab like Home.
 - Middle click now reaches Roblox as the middle mouse button.
 - Scrolling follows your system's natural scrolling setting.
- Fixed a crash on some x86_64 hosts when Roblox asked about a thread other
-  than the one making the call.
- Roblox updates no longer mix up the ARM64 and x86_64 compatibility profiles
-  for the same version.
- A partial or out-of-range user id in `MOCKTAIL_ROBLOX_USER_ID` or
-  `MOCKTAIL_LOCAL_STORAGE_CURRENT_USER_ID` is now ignored instead of being
-  partly read.
+- Fixed a crash on some x86_64 hosts when Roblox asked about a thread other than the one making the call.
+- Roblox updates no longer mix up the ARM64 and x86_64 compatibility profiles for the same version.
+- A partial or out-of-range user id in `MOCKTAIL_ROBLOX_USER_ID` or `MOCKTAIL_LOCAL_STORAGE_CURRENT_USER_ID`
+  is now ignored instead of being partly read.

 ### Changed

- `make flatpak` and `scripts/build_flatpak.sh` now build with 2 jobs by
-  default instead of 4, so a local Flatpak build is less likely to run out
-  of memory. Set `FLATPAK_JOBS` or `MOCKTAIL_FLATPAK_JOBS` to use more.
-  Thanks to @glook9001.
+- `make flatpak` and `scripts/build_flatpak.sh` now build with 2 jobs by default instead of 4, so a local
+  Flatpak build is less likely to run out of memory. Set `FLATPAK_JOBS` or `MOCKTAIL_FLATPAK_JOBS` to use
+  more. Thanks to @glook9001.

 ## [0.3.1] - 2026-09-20

 ### Added

- Each release carries a DEB, an RPM, and a pacman package beside the
-  AppImage, with a `.sha256` for every file. They install `/usr/bin/mocktail`
-  and conflict with each other and with upstream's `mocktail` package.
-  Nightcap is in no distribution repository or the AUR; the recipes under
-  `packaging/aur/nightcap{,-bin,-git}` build from this repository locally.
- The AppStream metadata lists the Nightcap releases, so software centres
-  show the release history instead of upstream's.
+- Each release carries a DEB, an RPM, and a pacman package beside the AppImage, with a `.sha256` for every
+  file. They install `/usr/bin/mocktail` and conflict with each other and with upstream's `mocktail` package.
+  Nightcap is in no distribution repository or the AUR; the recipes under `packaging/aur/nightcap{,-bin,-git}`
+  build from this repository locally.
+- The AppStream metadata lists the Nightcap releases, so software centres show the release history instead of
+  upstream's.

 ### Fixed

- ETC2 texture decoding no longer blocks the thread that submits the frame.
-  Uploads decode on a background dispatcher and the submit carries a timeline
-  semaphore wait, so the GPU waits for the texture instead of the render
-  thread. Reading the application's compressed bytes moves to that dispatcher
-  too whenever they are already mapped. In Blade Ball the worst
-  `vkQueueSubmit` fell from 140ms to 1ms, its p99 from 4.9ms to 0.05ms, and
-  the total time spent in submits from 2534ms to 309ms. Frame interval is
-  unchanged: the remaining tail is the engine's own main-thread step. A device
-  without the `timelineSemaphore` feature decodes inline as before, as does a
-  submit whose `pNext` already sizes arrays by its semaphore counts.
- The mouse pointer jumped when a right-click camera drag ended, and drifted
-  to the viewport edge during one. The input router inferred pointer capture
-  from SDL reporting zero absolute coordinates, which holds on X11 but not on
-  Wayland, where the reported position accumulates the relative deltas and
-  leaves the window. Motion, button, and wheel events now carry the window's
-  relative mouse mode. The right-click camera fallback also only captures
-  inside an experience, so the cursor stays free over the app surface.
- Shutting the window down while an experience was starting or leaving could
-  free the pointer capture owner underneath the thread using it. Callers off
-  the SDL thread now hold a reference for the length of their call.
- The TextBox caret did not move when a trailing space was typed in a
-  single-line field. The final cluster rect SDL_ttf reports stops at the last
-  inked glyph, so the laid-out width is used there instead. Wrapped layouts
-  keep the clamp, because their width is the widest line rather than the last.
- Every TextBox keystroke re-ran `TTF_Init`, a fontconfig sort, six
-  `TTF_OpenFont` calls, and `TTF_Quit` on the render thread. The overlay holds
-  its opened fonts and reopens them only when the Roblox font or the point
-  size changes, keeping the current set when a reopen fails. Measured over 100
-  rasters, 1.59ms to 0.12ms per keystroke.
- Staged ETC2 copies now carry an explicit host-write barrier. A queue
-  submission only makes host writes from before it visible to the device, and
-  an asynchronous decode writes after the submit, so without the barrier those
-  texels were not guaranteed to reach the copy that reads them.
+- ETC2 texture decoding no longer blocks the thread that submits the frame. Uploads decode on a background
+  dispatcher and the submit carries a timeline semaphore wait, so the GPU waits for the texture instead of the
+  render thread. Reading the application's compressed bytes moves to that dispatcher too whenever they are
+  already mapped. In Blade Ball the worst `vkQueueSubmit` fell from 140ms to 1ms, its p99 from 4.9ms to
+  0.05ms, and the total time spent in submits from 2534ms to 309ms. Frame interval is unchanged: the remaining
+  tail is the engine's own main-thread step. A device without the `timelineSemaphore` feature decodes inline
+  as before, as does a submit whose `pNext` already sizes arrays by its semaphore counts.
+- The mouse pointer jumped when a right-click camera drag ended, and drifted to the viewport edge during one.
+  The input router inferred pointer capture from SDL reporting zero absolute coordinates, which holds on X11
+  but not on Wayland, where the reported position accumulates the relative deltas and leaves the window.
+  Motion, button, and wheel events now carry the window's relative mouse mode. The right-click camera fallback
+  also only captures inside an experience, so the cursor stays free over the app surface.
+- Shutting the window down while an experience was starting or leaving could free the pointer capture owner
+  underneath the thread using it. Callers off the SDL thread now hold a reference for the length of their
+  call.
+- The TextBox caret did not move when a trailing space was typed in a single-line field. The final cluster
+  rect SDL_ttf reports stops at the last inked glyph, so the laid-out width is used there instead. Wrapped
+  layouts keep the clamp, because their width is the widest line rather than the last.
+- Every TextBox keystroke re-ran `TTF_Init`, a fontconfig sort, six `TTF_OpenFont` calls, and `TTF_Quit` on
+  the render thread. The overlay holds its opened fonts and reopens them only when the Roblox font or the
+  point size changes, keeping the current set when a reopen fails. Measured over 100 rasters, 1.59ms to 0.12ms
+  per keystroke.
+- Staged ETC2 copies now carry an explicit host-write barrier. A queue submission only makes host writes from
+  before it visible to the device, and an asynchronous decode writes after the submit, so without the barrier
+  those texels were not guaranteed to reach the copy that reads them.

 ### Changed

- `docs/PERFORMANCE.md` documents the GameMode settings to run with. A
-  `desiredgov=powersave` in `~/.config/gamemode.ini` overrides the packaged
-  `performance` default and clocks the CPU down for the whole session while
-  still reporting an active performance request.
+- `docs/PERFORMANCE.md` documents the GameMode settings to run with. A `desiredgov=powersave` in
+  `~/.config/gamemode.ini` overrides the packaged `performance` default and clocks the CPU down for the whole
+  session while still reporting an active performance request.

 ## [0.3.0] - 2026-09-18

 ### Added

- Custom Discord presence. `integrations.discord_rpc.text.title` replaces the
-  name in "Playing Nightcap", and `integrations.discord_rpc.images` sets the
-  large and small icons and their hover text. Text and image fields accept
-  `{place_name}`, `{place_icon}`, and `{creator_name}`. A field that expands
-  an empty placeholder is left out, and `text.state: ""` hides the state line.
- The default Discord card now matches Sober: the title is "Roblox", the
-  details line is "Playing <experience>", the state is "by <creator>", and
-  the Roblox badge sits inside the experience icon. The creator comes from the
-  same Roblox games request that already fetches the experience name. With
-  `show_place_name: false` the creator is hidden too, so the card shows only
-  the title and timer.
- `--profile <file>` writes a Chrome-format trace of the Vulkan adapter's
-  work: presents, GPU waits, submits, ETC2 texture decode, and pipeline and
-  shader creation. Open it in ui.perfetto.dev. `docs/BENCHMARKING.md`
-  describes the benchmark runs, and `scripts/summarize_profile_trace.py`
-  turns traces into a before and after table.
+- Custom Discord presence. `integrations.discord_rpc.text.title` replaces the name in "Playing Nightcap", and
+  `integrations.discord_rpc.images` sets the large and small icons and their hover text. Text and image fields
+  accept `{place_name}`, `{place_icon}`, and `{creator_name}`. A field that expands an empty placeholder is
+  left out, and `text.state: ""` hides the state line.
+- The default Discord card now matches Sober: the title is "Roblox", the details line is "Playing
+  <experience>", the state is "by <creator>", and the Roblox badge sits inside the experience icon. The
+  creator comes from the same Roblox games request that already fetches the experience name. With
+  `show_place_name: false` the creator is hidden too, so the card shows only the title and timer.
+- `--profile <file>` writes a Chrome-format trace of the Vulkan adapter's work: presents, GPU waits, submits,
+  ETC2 texture decode, and pipeline and shader creation. Open it in ui.perfetto.dev. `docs/BENCHMARKING.md`
+  describes the benchmark runs, and `scripts/summarize_profile_trace.py` turns traces into a before and after
+  table.

 ### Fixed

- Texture uploads stalled the frame they were submitted on. ETC2 batches
-  decoded on worker threads but were then resampled one upload at a time on
-  the submitting thread, which at the default 4x upscale is sixteen times the
-  decoded texels. Resampling now runs on the same worker pool, in two passes so
-  mip level 0 still resolves before the mips built from it. In a 70k-part
-  place the worst `vkQueueSubmit` fell from 167ms to 92ms.
- Most ETC2 batches decoded on a single thread. Workers were created and
-  joined per batch, so the parallel floor had to cover that cost and sat at a
-  1024x1024 image; batches under it ran on the caller, which was 54% of all
-  decode time in a 70k-part place. Decode workers are now a persistent pool,
-  and the floor drops to a 128x128 image. Mean decode time in that place fell
-  from 8.2ms to 4.7ms, and 11.8ms before both texture fixes.
- On CPUs with a wide core-speed spread, Feral GameMode pinned the process to
-  the few fastest cores, concentrating Roblox's worker pool onto them instead
-  of spreading it. With `performance.gamemode: auto`, a request that narrows
-  the CPU affinity is now released again, which releases the pin. Set
-  `pin_cores=no` in `~/.config/gamemode.ini` to keep GameMode without the
-  pinning, or `performance.gamemode: on` to accept it. See
-  `docs/PERFORMANCE.md`.
- With `show_place_name: false`, Discord no longer shows the experience
-  thumbnail or its name on hover.
- The host main thread no longer spins on the engine's message pump, which
-  cost about half a core and 146,000 empty calls a second. It now rests 100 µs
-  between polls: sleeping when the governor is `performance`, parking the
-  core with TPAUSE on CPUs that have it, spinning otherwise. With GameMode
-  setting the governor, process CPU in a 60k-part place fell from 216% to
-  107% at the same 120 fps. `MOCKTAIL_ENGINE_PUMP_REST` forces a mode; see
-  `docs/PERFORMANCE.md`.
- ETC2 uploads with a `bufferRowLength` or `bufferImageHeight` larger than
-  the image read the padded rows as packed data and decoded garbage.
- ETC2 resampling created and joined worker threads on every batch. It now
-  runs on the persistent decode pool.
- A failed trace write left the profile writer thread waking every 250 ms
-  for the rest of the session. It now exits.
- The `--profile` trace gains a `pump` slice for the engine's main-thread
-  step.
+- Texture uploads stalled the frame they were submitted on. ETC2 batches decoded on worker threads but were
+  then resampled one upload at a time on the submitting thread, which at the default 4x upscale is sixteen
+  times the decoded texels. Resampling now runs on the same worker pool, in two passes so mip level 0 still
+  resolves before the mips built from it. In a 70k-part place the worst `vkQueueSubmit` fell from 167ms to
+  92ms.
+- Most ETC2 batches decoded on a single thread. Workers were created and joined per batch, so the parallel
+  floor had to cover that cost and sat at a 1024x1024 image; batches under it ran on the caller, which was 54%
+  of all decode time in a 70k-part place. Decode workers are now a persistent pool, and the floor drops to a
+  128x128 image. Mean decode time in that place fell from 8.2ms to 4.7ms, and 11.8ms before both texture
+  fixes.
+- On CPUs with a wide core-speed spread, Feral GameMode pinned the process to the few fastest cores,
+  concentrating Roblox's worker pool onto them instead of spreading it. With `performance.gamemode: auto`, a
+  request that narrows the CPU affinity is now released again, which releases the pin. Set `pin_cores=no` in
+  `~/.config/gamemode.ini` to keep GameMode without the pinning, or `performance.gamemode: on` to accept it.
+  See `docs/PERFORMANCE.md`.
+- With `show_place_name: false`, Discord no longer shows the experience thumbnail or its name on hover.
+- The host main thread no longer spins on the engine's message pump, which cost about half a core and 146,000
+  empty calls a second. It now rests 100 µs between polls: sleeping when the governor is `performance`,
+  parking the core with TPAUSE on CPUs that have it, spinning otherwise. With GameMode setting the governor,
+  process CPU in a 60k-part place fell from 216% to 107% at the same 120 fps. `MOCKTAIL_ENGINE_PUMP_REST`
+  forces a mode; see `docs/PERFORMANCE.md`.
+- ETC2 uploads with a `bufferRowLength` or `bufferImageHeight` larger than the image read the padded rows as
+  packed data and decoded garbage.
+- ETC2 resampling created and joined worker threads on every batch. It now runs on the persistent decode pool.
+- A failed trace write left the profile writer thread waking every 250 ms for the rest of the session. It now
+  exits.
+- The `--profile` trace gains a `pump` slice for the engine's main-thread step.

 ## [0.2.0] - 2026-09-16

 ### Added

 - FAQ covering Discord RPC, log locations, and VR, adapted from upstream.
- `input.raw_mouse` in `config.yaml` sends mouse look deltas in the host's
-  own units. Turn it on when first-person aiming feels too slow or too fast
-  under fractional display scaling. Off by default.
- Nightly AppImage builds, published as the `continuous` prerelease. They are
-  untested; use a tagged release for normal play.
+- `input.raw_mouse` in `config.yaml` sends mouse look deltas in the host's own units. Turn it on when
+  first-person aiming feels too slow or too fast under fractional display scaling. Off by default.
+- Nightly AppImage builds, published as the `continuous` prerelease. They are untested; use a tagged release
+  for normal play.

 ### Changed

- Values in `fflags.json` now win over the performance preset instead of
-  stopping the launch. Startup prints each key it kept.
- Discord Rich Presence uses Nightcap's own Discord application, so it shows
-  as "Playing Nightcap". Terms and privacy pages for it live on the
-  project site.
- Discord Rich Presence is on by default. Set
-  `integrations.discord_rpc.enabled: false` to turn it off.
- The AppImage build verifies its reduced dependency packages against digests
-  taken at build time, rather than a digest list kept in the repository.
+- Values in `fflags.json` now win over the performance preset instead of stopping the launch. Startup prints
+  each key it kept.
+- Discord Rich Presence uses Nightcap's own Discord application, so it shows as "Playing Nightcap". Terms and
+  privacy pages for it live on the project site.
+- Discord Rich Presence is on by default. Set `integrations.discord_rpc.enabled: false` to turn it off.
+- The AppImage build verifies its reduced dependency packages against digests taken at build time, rather than
+  a digest list kept in the repository.

 ### Fixed

- Mouse look keeps responding after a long turn. The tracked pointer position
-  could drift past the edge of the view, which swallowed every reversal until
-  the mouse travelled all the way back.
- Nightcap no longer refuses to start with `cannot lock appStorage`. It
-  created its own credential directory using the process umask, then rejected
-  that directory for being group writable. Systems with a permissive umask,
-  such as `002`, failed on first run.
+- Mouse look keeps responding after a long turn. The tracked pointer position could drift past the edge of the
+  view, which swallowed every reversal until the mouse travelled all the way back.
+- Nightcap no longer refuses to start with `cannot lock appStorage`. It created its own credential directory
+  using the process umask, then rejected that directory for being group writable. Systems with a permissive
+  umask, such as `002`, failed on first run.

 ## [0.1.0] - 2026-09-15

@@ -250,37 +267,32 @@ First Nightcap release, forked from komaruworld/mocktail.

 ### Added

- ETC2 and EAC texture emulation on Vulkan, so games that use compressed
-  mobile textures render correctly on desktop GPUs. Decoding runs on worker
-  threads to avoid stutter.
- PNG texture overrides in `~/.config/mocktail/textures`, keyed by upload
-  hash, with a dump mode to find the texture you want to replace.
- Small textures are upscaled 4x by default. Set
-  `MOCKTAIL_SMALL_TEXTURE_UPSCALE=1` to turn it off.
- AppImage and signed Flatpak builds on every release tag. The Flatpak repo
-  is published at https://coderdayton.github.io/nightcap/.
+- ETC2 and EAC texture emulation on Vulkan, so games that use compressed mobile textures render correctly on
+  desktop GPUs. Decoding runs on worker threads to avoid stutter.
+- PNG texture overrides in `~/.config/mocktail/textures`, keyed by upload hash, with a dump mode to find the
+  texture you want to replace.
+- Small textures are upscaled 4x by default. Set `MOCKTAIL_SMALL_TEXTURE_UPSCALE=1` to turn it off.
+- AppImage and signed Flatpak builds on every release tag. The Flatpak repo is published at
+  https://coderdayton.github.io/nightcap/.
 - Roadmap in `docs/ROADMAP.md`.

 ### Changed

- Frames are presented as soon as they are ready instead of waiting in a
-  queue, which lowers input latency.
- Roblox now sees the real host RAM and display size instead of a low-end
-  phone profile.
- App ID is `io.github.CoderDayton.nightcap`, so Nightcap installs next to
-  upstream Mocktail. The binary and config paths keep the `mocktail` name.
+- Frames are presented as soon as they are ready instead of waiting in a queue, which lowers input latency.
+- Roblox now sees the real host RAM and display size instead of a low-end phone profile.
+- App ID is `io.github.CoderDayton.nightcap`, so Nightcap installs next to upstream Mocktail. The binary and
+  config paths keep the `mocktail` name.
 - New name, icon, and colors.
 - The desktop entry launches on Wayland and points at the installed binary.

 ### Fixed

 - Servers no longer kick with error 319 shortly after joining.
- The FMOD output-device bridge is optional, so the updater no longer fails
-  without it.
- The AppImage build no longer fails on stale checksums for the slimmed
-  Arch packages.
+- The FMOD output-device bridge is optional, so the updater no longer fails without it.
+- The AppImage build no longer fails on stale checksums for the slimmed Arch packages.

-[Unreleased]: https://github.com/CoderDayton/nightcap/compare/v0.3.3...HEAD
+[Unreleased]: https://github.com/CoderDayton/nightcap/compare/v0.3.4...HEAD
+[0.3.4]: https://github.com/CoderDayton/nightcap/releases/tag/v0.3.4
 [0.3.3]: https://github.com/CoderDayton/nightcap/releases/tag/v0.3.3
 [0.3.2]: https://github.com/CoderDayton/nightcap/releases/tag/v0.3.2
 [0.3.1]: https://github.com/CoderDayton/nightcap/releases/tag/v0.3.1
@@ -9,7 +9,7 @@

 cmake_minimum_required(VERSION 3.20)
 project(Mocktail
-  VERSION 1.0.4
+  VERSION 0.3.4
  DESCRIPTION "Android Roblox compatibility runtime for Linux"
  LANGUAGES CXX
 )
@@ -252,6 +252,7 @@ add_library(mocktail_legacy_jnivm STATIC
  src/jnivm/jni_references.cc
  src/jnivm/jni_fields.cc
  src/jnivm/jni_strings.cc
+  src/jnivm/jni_method_names.cc
 )
 add_library(Mocktail::LegacyJni ALIAS mocktail_legacy_jnivm)
 target_include_directories(mocktail_legacy_jnivm PUBLIC include)
@@ -298,6 +299,7 @@ add_library(mocktail_runtime STATIC
  src/runtime/payload_update_preflight.cc
  src/runtime/process_launch_policy.cc
  src/runtime/process_diagnostics.cc
+  src/runtime/asset_overlay_names.cc
  src/runtime/runtime_config.cc
  src/runtime/runtime_config_bootstrap.cc
  src/runtime/runtime_config_file.cc
@@ -561,50 +563,6 @@ target_link_libraries(mocktail_bionic_abi_exports PRIVATE
  Threads::Threads
 )

-include(CheckCXXSourceCompiles)
-include(CheckIncludeFileCXX)
-include(CMakePushCheckState)
-
-check_include_file_cxx(execinfo.h MOCKTAIL_HAVE_EXECINFO_H)
-if(NOT MOCKTAIL_HAVE_EXECINFO_H)
-  message(FATAL_ERROR
-    "execinfo.h is required for crash diagnostics; on musl install "
-    "libexecinfo-devel"
-  )
-endif()
-
-set(MOCKTAIL_EXECINFO_LINK_LIBRARY "")
-set(_mocktail_execinfo_link_probe [=[
-  #include <execinfo.h>
-  int main() {
-    void* frames[1] = {};
-    const int count = backtrace(frames, 1);
-    return backtrace_symbols(frames, count) == nullptr;
-  }
-]=])
-check_cxx_source_compiles(
-  "${_mocktail_execinfo_link_probe}"
-  MOCKTAIL_EXECINFO_IN_HOST_LIBC
-)
-if(NOT MOCKTAIL_EXECINFO_IN_HOST_LIBC)
-  find_library(MOCKTAIL_EXECINFO_LIBRARY NAMES execinfo REQUIRED)
-  cmake_push_check_state(RESET)
-  set(CMAKE_REQUIRED_LIBRARIES "${MOCKTAIL_EXECINFO_LIBRARY}")
-  check_cxx_source_compiles(
-    "${_mocktail_execinfo_link_probe}"
-    MOCKTAIL_EXECINFO_IN_EXTERNAL_LIBRARY
-  )
-  cmake_pop_check_state()
-  if(NOT MOCKTAIL_EXECINFO_IN_EXTERNAL_LIBRARY)
-    message(FATAL_ERROR
-      "execinfo.h is available, but backtrace and backtrace_symbols cannot "
-      "be linked"
-    )
-  endif()
-  set(MOCKTAIL_EXECINFO_LINK_LIBRARY "${MOCKTAIL_EXECINFO_LIBRARY}")
-endif()
-unset(_mocktail_execinfo_link_probe)
-
 add_library(mocktail_legacy_runtime STATIC
  src/legacy/legacy_runtime.cc
  src/runtime/roblox_text_input_jni_bridge.cc
@@ -629,7 +587,6 @@ target_link_libraries(mocktail_legacy_runtime PRIVATE
  libc_shim
  mocktail_window
  mocktail_graphics_foundation
-  ${MOCKTAIL_EXECINFO_LINK_LIBRARY}
 )
 target_compile_definitions(mocktail_legacy_runtime PRIVATE
  "MOCKTAIL_DEFAULT_COMPATIBILITY_MANIFEST=\"${MOCKTAIL_DEFAULT_COMPATIBILITY_MANIFEST}\""
@@ -56,15 +56,14 @@ after Roblox added measures against running multiple clients.

 ## Can I play in VR?

-VR is experimental and lives on upstream's `vr` branch, which does not
-include the Nightcap changes. Install the
+Yes, as an experiment. VR lives on Nightcap's `vr` branch and is not in the
+releases yet. It works on Roblox builds 2998, 3092 and 3222. Install the
 [build dependencies](README.md#building), then switch to that branch and
 build:

 ```bash
-git remote add upstream https://github.com/komaruworld/mocktail.git
-git fetch upstream
-git switch -c vr upstream/vr
+git fetch origin
+git switch vr
 git submodule update --init --recursive
 cmake -S . -B build -DCMAKE_BUILD_TYPE=Release -DMOCKTAIL_ENABLE_VR=ON
 cmake --build build -j4
@@ -73,5 +72,10 @@ cmake --build build -j4
 Start WiVRn or SteamVR/ALVR, connect your headset, then run:

 ```bash
-./build/mocktail -vr
+./build/mocktail --vr
 ```
+
+That branch's
+[README](https://github.com/CoderDayton/nightcap/blob/vr/README.md#experimental-vr)
+and [docs/VR.md](https://github.com/CoderDayton/nightcap/blob/vr/docs/VR.md)
+have the details, including how to try it without a headset.
@@ -7,13 +7,16 @@
    <a href="https://github.com/CoderDayton/nightcap/actions/workflows/ci.yml"><img src="https://github.com/CoderDayton/nightcap/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
    <a href="https://github.com/CoderDayton/nightcap/stargazers"><img src="https://img.shields.io/github/stars/CoderDayton/nightcap?style=flat&logo=github" alt="Stars"></a>
    <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0-blue.svg" alt="License"></a>
+    <a href="https://discord.gg/DbAUG9hBFU"><img alt="Discord" src="https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fdiscord.com%2Fapi%2Fv10%2Finvites%2FDbAUG9hBFU%3Fwith_counts%3Dtrue&query=%24.approximate_member_count&label=Discord&logo=discord&logoColor=white&color=5865F2&suffix=%20members"></a>
  </h1>
 </div>

-Nightcap is Mocktail, tuned for playing on a real PC. It runs the Android
-`x86_64` Roblox client on Linux, including a Linux userspace hosted by
-FreeBSD's Linuxulator. It provides the Android ABI and JNI pieces the client
-expects, then connects them to SDL3 and Vulkan or OpenGL on the Linux side.
+Nightcap is Roblox on Linux, tuned for desktop play. It is a Mocktail fork
+that keeps up with Roblox updates, with extra bug fixes, custom assets and
+more. It runs the Android `x86_64` Roblox client on Linux, including a Linux
+userspace hosted by FreeBSD's Linuxulator. It provides the Android ABI and JNI
+pieces the client expects, then connects them to SDL3 and Vulkan or OpenGL on
+the Linux side.

 Nightcap is an independent community project. It is not affiliated with Roblox
 Corporation or VinegarHQ and does not distribute the Roblox client.
@@ -26,23 +29,25 @@ with extra fixes for playing on a PC. The program and config paths keep the
 `io.github.CoderDayton.nightcap`, so Nightcap and upstream can be installed
 side by side.

- **Lower input lag.** Frames are shown as soon as they are ready instead of
-  waiting in a queue.
- **Sharper textures.** Small textures are upscaled 4x by default, and you
-  can replace any texture with your own PNG in `~/.config/mocktail/textures`.
-  A ready-made crosshair is in [`textures/`](textures/README.md). Set
-  `MOCKTAIL_SMALL_TEXTURE_UPSCALE=1` to turn the upscale off.
- **ETC2 textures on any GPU.** Games that use compressed mobile textures now
-  render correctly on desktop GPUs, without stutter.
- **No more error 319 kicks.** Servers no longer drop you shortly after
-  joining.
- **Correct device info.** Roblox sees your real RAM and screen size.
- **Better desktop launcher.** Runs on Wayland and always finds the installed
-  binary.
+- **Keeps up with Roblox.** New Roblox versions work soon after they come out.
+- **Plays more games.** Nightcap answers a server check that some experiences
+  use, so you can join and stay in those too.
+- **Voice chat that keeps working.** Your microphone still works after a
+  Roblox update.
+- **Logging in works.** Verification checks and captchas finish instead of
+  hanging.
+- **The current Roblox look.** The new home screen and side menu, like on
+  Windows.
+- **Your own cursors, fonts and skies.** Drop files in
+  `~/.local/share/mocktail/asset_overlay` and Nightcap uses them. The layout
+  matches Sober's `asset_overlay` folder.
+- **Smoother mouse and a cooler PC.** Optional raw mouse input, and less CPU
+  use while idle.

-Everything else works the same as upstream. See the
-[roadmap](docs/ROADMAP.md) for what is coming next, the
-[changelog](CHANGELOG.md) for what each release changed,
+Everything else works the same as upstream. See
+[`textures/`](textures/README.md) for custom textures, a ready-made crosshair
+and the asset overlay folder, the [roadmap](docs/ROADMAP.md) for what is
+coming next, the [changelog](CHANGELOG.md) for what each release changed,
 [performance](docs/PERFORMANCE.md) for CPU load, heat and the knobs that change
 them, and the [FAQ](FAQ.md) for Discord RPC, logs, and VR.

@@ -79,8 +84,17 @@ sudo pacman -U nightcap-<version>-1-x86_64.pkg.tar.zst
 ```

 They install `/usr/bin/mocktail`, so they conflict with upstream's `mocktail`
-package. Nightcap is not in any distribution repository or the AUR; the
-recipes under `packaging/aur` are kept for local builds only.
+package.
+
+On Arch Linux, [`nightcap-git`](https://aur.archlinux.org/packages/nightcap-git)
+is on the AUR. It builds the current `main` branch and is maintained by
+[@dim-ghub](https://github.com/dim-ghub):
+
+```bash
+yay -S nightcap-git
+```
+
+Nightcap is in no other distribution repository.

 Or build and install from source using the steps under
 [Building](#building).
@@ -108,8 +122,6 @@ removing the marker.

 ![Roblox gameplay in Nightcap](assets/screenshots/flatpak-gameplay-tower.png)

-![Roblox experience in Nightcap](assets/screenshots/flatpak-gameplay-lobby.png)
-
 </details>

 ## FFlag overrides
@@ -121,6 +133,9 @@ PC profiles use the legacy Charts page by default to avoid the blank screen
 caused by `Color3` errors in the newer SDUI page. An explicit
 `FFlagLuaAppChartsAppPage` override takes precedence over this default.

+PC profiles also set `FIntFlyoutTestVariantRollout12` to `2`, which shows the
+desktop side panel menu. An explicit override takes precedence.
+
 ```json
 {
  "FFlagExample": "True",
@@ -32,7 +32,7 @@
      "mode": "vendored-patched-snapshot",
      "url": "https://github.com/minecraft-linux/mcpelauncher-linker.git",
      "upstream_commit": "1ac3ea6c1cf4f73a84d73f0bff510fba94a7d0f2",
-      "vendor_tree": "fca44d85e3773c135ccfc603b14abdf6aeb8efd1",
+      "vendor_tree": "0637221e48f382ec8d0bc701385f4b10bcd07a65",
      "patch": "third_party/patches/mcpelauncher-linker.patch",
      "nested_sources": {
        "android_bionic": {
@@ -22,20 +22,6 @@ what you are playing and you can switch it all off in one click.
 Done when every option in `config/mocktail.example.yaml` that a player would
 touch can be set without a text editor.

-## 2. Controller button glyphs
-
-Upstream added Xbox and PlayStation gamepad support through SDL. Controllers
-already hot-plug and release their held inputs when unplugged. One rough edge
-is left.
-
- Correct button glyphs for the connected pad. `SDL_GetGamepadType` is only
-read for Xbox and PlayStation pads, so a Switch Pro, a GameCube pad, or any
-generic pad SDL reports as `SDL_GAMEPAD_TYPE_STANDARD` reaches Roblox as
-type 0 and draws generic glyphs. `SDL_GetRealGamepadType`, and the vendor
-and product IDs, are available and unused.
-
-Done when a plugged-in pad shows its own buttons.
-
 ## Shipped

 - Lower input latency: frames are presented as soon as they are ready.
@@ -11,19 +11,27 @@

 namespace mocktail::compat {

+// glibc's atoi is (int)strtol(), exactly like Bionic's, so the host symbol is
+// used as-is there. Other libcs (musl) differ on overflow and need the shim.
+#ifdef __GLIBC__
+inline constexpr bool kHostAtoiMatchesBionic = true;
+#else
+inline constexpr bool kHostAtoiMatchesBionic = false;
+#endif
+
 // Android uses size_t fields here; glibc uses int and musl has no equivalent.
 // An all-zero fallback means unknown, not zero usage.
 struct BionicMallinfoSnapshot {
-  size_t arena = 0;
-  size_t ordblks = 0;
-  size_t smblks = 0;
-  size_t hblks = 0;
-  size_t hblkhd = 0;
-  size_t usmblks = 0;
-  size_t fsmblks = 0;
-  size_t uordblks = 0;
-  size_t fordblks = 0;
-  size_t keepcost = 0;
+  size_t arena;
+  size_t ordblks;
+  size_t smblks;
+  size_t hblks;
+  size_t hblkhd;
+  size_t usmblks;
+  size_t fsmblks;
+  size_t uordblks;
+  size_t fordblks;
+  size_t keepcost;
 };

 struct BionicLocaleState;
@@ -90,6 +98,7 @@ int mocktail_bionic_cxa_thread_atexit_impl(
    mocktail::compat::BionicThreadDestructor destructor, void* argument,
    void* dso_handle);
 void mocktail_bionic_arc4random_buf(void* buffer, size_t size);
+int mocktail_bionic_atoi(const char* text);
 mocktail::compat::BionicMallinfoSnapshot mocktail_bionic_mallinfo();
 int mocktail_bionic_sysinfo(struct sysinfo* info);
 int mocktail_bionic_uname(struct utsname* name);
@@ -36,6 +36,11 @@ struct FmodOutputDeviceBridgeProfile {
               ? std::array<std::size_t, 4>{9, 10, 12, 18}
               : std::array<std::size_t, 4>{8, 9, 10, 16};
  }
+  std::array<std::size_t, 6> capture_vtable_indexes() const {
+    return vtable_layout_version == 2
+               ? std::array<std::size_t, 6>{4, 13, 14, 15, 16, 17}
+               : std::array<std::size_t, 6>{4, 11, 12, 13, 14, 15};
+  }

  bool valid_vtable_layout() const {
    return vtable_layout_version == 1 || vtable_layout_version == 2;
@@ -109,6 +109,15 @@ struct HostAbiProfile {
  size_t NativeMimallocConstructorRangeEndExclusive() const noexcept;
  bool ShouldInitializeNativeMimallocThreadAfterConstructor(
      size_t index) const noexcept;
+  // True when both replays have the one verified shape. The native replay is
+  // one range that runs to the end of .init_array. Its first four
+  // constructors are the process-load constructor at the thread-initializer
+  // checkpoint, the JNI singleton initializer, and two wiring entries. The
+  // host-bridge replay runs the same constructors without the two wiring
+  // entries. `jni_singleton_constructor` is the .init_array index of the JNI
+  // singleton initializer.
+  bool HasVerifiedConstructorPolicy(
+      size_t jni_singleton_constructor) const noexcept;
  bool HasValidNativePreJniBootstrap() const noexcept;
  HostAllocatorStrategy ResolveAllocatorStrategy(
      bool host_bridges_override_present,
@@ -61,8 +61,7 @@ class RobloxOutputDeviceBridge final {
  void SelectDevice(int index, bool input = false);
  void ConstructGuestString(void* destination, std::string_view value) const;

-  std::unique_ptr<NativeInputCapture> capture_;
-  bool capture_profile_supported_ = false;
+  std::shared_ptr<NativeInputCapture> capture_;
  std::array<std::uintptr_t, 6> original_capture_methods_{};
  mutable std::mutex mutex_;
  compat::FmodOutputDeviceBridgeProfile profile_;
@@ -2,6 +2,7 @@
 #define MOCKTAIL_GRAPHICS_PRESENT_MODE_POLICY_H_

 #include <cstdint>
+#include <cstdio>
 #include <string_view>
 #include <vector>

@@ -29,6 +30,36 @@ FilterPresentModes(PresentModePolicy policy,
 const char *PresentModePolicyName(PresentModePolicy policy);
 const char *PresentModeKhrName(VkPresentModeKHR mode);

+// Creates the swapchain with the mode in `info`. A driver can reject a mode
+// that the device did not enable, so a failed create is retried once with the
+// mode the game asked for. `create` takes the info and returns a VkResult.
+template <typename Create>
+VkResult CreateSwapchainWithPresentModeFallback(VkSwapchainCreateInfoKHR &info,
+                                                VkPresentModeKHR requested,
+                                                Create create) {
+  const VkResult result = create(info);
+  if (result == VK_SUCCESS || info.presentMode == requested) {
+    return result;
+  }
+  switch (result) {
+  case VK_ERROR_OUT_OF_HOST_MEMORY:
+  case VK_ERROR_OUT_OF_DEVICE_MEMORY:
+  case VK_ERROR_DEVICE_LOST:
+  case VK_ERROR_SURFACE_LOST_KHR:
+  case VK_ERROR_NATIVE_WINDOW_IN_USE_KHR:
+    return result; // Another present mode cannot fix these.
+  default:
+    break;
+  }
+  std::fprintf(stderr,
+               "  [vulkan] swapchain presentMode %s failed (%d); retrying "
+               "with %s\n",
+               PresentModeKhrName(info.presentMode), static_cast<int>(result),
+               PresentModeKhrName(requested));
+  info.presentMode = requested;
+  return create(info);
+}
+
 // Extra images so acquire does not wait on the compositor-held buffer.
 std::uint32_t PreferSwapchainMinImageCount(PresentModePolicy policy,
                                           std::uint32_t requested,
@@ -0,0 +1,27 @@
+#ifndef MOCKTAIL_RUNTIME_ASSET_OVERLAY_NAMES_H_
+#define MOCKTAIL_RUNTIME_ASSET_OVERLAY_NAMES_H_
+
+#include <cstddef>
+#include <cstdint>
+#include <filesystem>
+#include <string>
+#include <vector>
+
+namespace mocktail {
+namespace runtime {
+
+// The rbxasset:// name of every regular file under <overlay_dir>/content, such
+// as rbxasset://textures/MouseLockedCursor.png. Sorted.
+std::vector<std::string> OverlayRbxAssetNames(
+    const std::filesystem::path& overlay_dir);
+
+// Roblox opens no local file for an rbxasset:// name it maps to a download.
+// Writes '!' over the first byte of each whole NUL-terminated copy of a name
+// in `data`, which unmaps it. Returns the number of copies changed.
+std::size_t DisableAssetNameMappings(std::uint8_t* data, std::size_t size,
+                                     const std::vector<std::string>& names);
+
+}
+}
+
+#endif
@@ -18,6 +18,26 @@ std::string SelectVulkanIcdManifest(
    const std::vector<std::filesystem::path>& directories,
    std::string_view vendor);

+// One GPU as the kernel reports it.
+struct HostGpu {
+  unsigned int vendor = 0;    // PCI vendor ID.
+  std::string kernel_driver;  // Bound kernel driver; empty when unknown.
+};
+
+struct VulkanIcdSelection {
+  std::string manifest;              // Empty when no GPU has a usable driver.
+  std::vector<std::string> skipped;  // Why each passed-over GPU was skipped.
+};
+
+// ICD manifest for the first GPU whose bound kernel driver has an installed
+// Vulkan driver. NVIDIA and AMD cards are tried before Intel when
+// `prefer_discrete` is set, and after it otherwise. A GPU with an unknown
+// kernel driver is matched by vendor alone.
+VulkanIcdSelection SelectHostVulkanIcd(
+    const std::vector<HostGpu>& gpus,
+    const std::vector<std::filesystem::path>& directories,
+    bool prefer_discrete);
+
 // Publishes the resolved graphics backend before the managed payload updater
 // starts. OpenGL is a strict system EGL/GLES path; it never silently retries
 // through ANGLE/Vulkan or accepts a window without a real graphics context.
@@ -32,6 +32,9 @@ inline constexpr char kRobloxOpenCaptchaViewNotification[] =
    "OPEN_CAPTCHA_VIEW";
 inline constexpr char kRobloxViewProfileNotification[] = "VIEW_PROFILE";
 inline constexpr char kRobloxPurchaseRobuxNotification[] = "PURCHASE_ROBUX";
+// Sent with a decimal user id when the app asks for a chat with that user.
+inline constexpr char kRobloxLaunchConversationNotification[] =
+    "LAUNCH_CONVERSATION";

 // Owned subset of WebViewProtocol's openWindow payload. The URL is copied
 // before the MessageBus RawCallback returns, so no JNI local reference escapes.
@@ -115,6 +118,14 @@ using PublishWebViewRawFn = void (*)(JNIEnv *, jobject, jstring, jstring);
 using BroadcastWebViewDataModelFocusFn = void (*)(JNIEnv *, jclass, jstring,
                                                  jstring, jstring);
 using SignalWebViewJavascriptCallbackFn = void (*)(JNIEnv*, jclass, jstring);
+// NativeGLInterface.nativeAppBridgeV2SendAppEventOnGameLoaded(namespace,
+// detail, detailType).
+using SendRobloxAppEventOnGameLoadedFn = void (*)(JNIEnv*, jclass, jstring,
+                                                  jstring, jstring);
+// NativeGLInterface.nativeAppBridgeV2SendAppEventOnAppReady(namespace, detail,
+// detailType, appName). The engine holds the event until appName is ready.
+using SendRobloxAppEventOnAppReadyFn = void (*)(JNIEnv*, jclass, jstring,
+                                                jstring, jstring, jstring);
 using UpdateRobloxCookieSetHandlerFn =
    void (*)(JNIEnv*, jobject, jobject);
 // Roblox's counted handle to its Subsystem<IWebViewProtocol>. The protocol,
@@ -167,6 +178,9 @@ struct RobloxWebViewMessageBusSymbols {
  UpdateRobloxCookieSetHandlerFn update_cookie_set_handler = nullptr;
  // Optional: found by code contract, not by symbol name.
  AcquireWebViewProtocolFn acquire_web_view_protocol = nullptr;
+  // Optional: without them LAUNCH_CONVERSATION is reported as unavailable.
+  SendRobloxAppEventOnGameLoadedFn send_app_event_on_game_loaded = nullptr;
+  SendRobloxAppEventOnAppReadyFn send_app_event_on_app_ready = nullptr;

  bool complete() const {
    return get_open_window_id != nullptr &&
@@ -270,11 +284,14 @@ private:
   kDataModelUnfocused,
   kDataModelFocused,
   kMessageBusWindowClose,
+   kStartConversationWithUser,
 };

 struct PendingHostWindowEvent {
   HostWindowEventType type = HostWindowEventType::kDataModelUnfocused;
   uint64_t generation = 0;
+   // Decimal user id of a kStartConversationWithUser event.
+   std::string user_id;
 };

  Status CheckJniException(JNIEnv *env, const char *operation) const;
@@ -283,6 +300,8 @@ private:
  Status DispatchOpenRequest(RobloxWebViewOpenRequest request,
                             OpenSource source);
  void QueueHostWindowEvent(HostWindowEventType type, uint64_t generation);
+  void QueueStartConversation(std::string user_id);
+  Status SendStartConversationEvents(JNIEnv* env, const std::string& user_id);
  Status BeginDispatch();
  void EndDispatch();
  static void RawMessageCallback(void *context, JNIEnv *env, jstring message);
@@ -67,6 +67,9 @@ class RuntimePaths {
    return active_payload_manifest_;
  }
  const std::filesystem::path& cookie_file() const { return cookie_file_; }
+  const std::filesystem::path& asset_overlay_dir() const {
+    return asset_overlay_dir_;
+  }
  bool use_real_sober_paths() const { return use_real_sober_paths_; }

  std::filesystem::path DefaultAssetPath() const;
@@ -99,6 +102,7 @@ class RuntimePaths {
  std::filesystem::path config_file_;
  std::filesystem::path active_payload_manifest_;
  std::filesystem::path cookie_file_;
+  std::filesystem::path asset_overlay_dir_;
  bool use_real_sober_paths_ = false;
 };

@@ -11,6 +11,10 @@ struct HostAbiDerivationOptions {
  std::filesystem::path reference_library;
  std::filesystem::path reference_profile;
  std::vector<std::filesystem::path> reference_compatibility_manifests;
+  // Optional libroblox.so of another build that the compatibility manifests
+  // describe. It supplies the FMOD output-device anchors when the manifests
+  // have none for the reference build.
+  std::filesystem::path runtime_fallback_library;
  std::filesystem::path candidate_payload_directory;
  std::filesystem::path output_directory;
 };
@@ -13,6 +13,11 @@ pre-commit:
    desktop-entry:
      glob: "*.desktop"
      run: desktop-file-validate {staged_files}
+    changelog-width:
+      glob: "CHANGELOG.md"
+      run: >-
+        git diff --cached -U0 -- CHANGELOG.md |
+        awk '/^\+[^+]/ && length($0) > 111 { print "CHANGELOG.md: added line over 110 characters: " substr($0, 2); bad = 1 } END { exit bad }'

 pre-push:
  commands:
@@ -1,7 +1,7 @@
 # Maintainer: vii <coderdayton14@gmail.com>

 pkgname=nightcap
-pkgver=0.3.1
+pkgver=0.3.4
 pkgrel=1
 pkgdesc='Android x86-64 Roblox compatibility runtime for Linux'
 arch=('x86_64')
@@ -1,6 +1,6 @@
 pkgbase = nightcap-bin
 	pkgdesc = Android x86-64 Roblox compatibility runtime for Linux (prebuilt)
-	pkgver = 0.3.1
+	pkgver = 0.3.4
 	pkgrel = 1
 	url = https://github.com/CoderDayton/nightcap
 	arch = x86_64
@@ -34,10 +34,10 @@ pkgbase = nightcap-bin
 	conflicts = mocktail
 	conflicts = nightcap
 	conflicts = nightcap-git
-	noextract = nightcap-0.3.1-1-x86_64.pkg.tar.zst
+	noextract = nightcap-0.3.4-1-x86_64.pkg.tar.zst
 	options = !debug
 	options = !strip
-	source = nightcap-0.3.1-1-x86_64.pkg.tar.zst::https://github.com/CoderDayton/nightcap/releases/download/v0.3.1/nightcap-0.3.1-1-x86_64.pkg.tar.zst
+	source = nightcap-0.3.4-1-x86_64.pkg.tar.zst::https://github.com/CoderDayton/nightcap/releases/download/v0.3.4/nightcap-0.3.4-1-x86_64.pkg.tar.zst
 	sha256sums = SKIP

 pkgname = nightcap-bin
@@ -1,7 +1,7 @@
 # Maintainer: vii <coderdayton14 at gmail dot com>

 pkgname=nightcap-bin
-pkgver=0.3.1
+pkgver=0.3.4
 pkgrel=1
 pkgdesc='Android x86-64 Roblox compatibility runtime for Linux (prebuilt)'
 arch=('x86_64')
@@ -1,6 +1,6 @@
 pkgbase = nightcap
 	pkgdesc = Android x86-64 Roblox compatibility runtime for Linux
-	pkgver = 0.3.1
+	pkgver = 0.3.4
 	pkgrel = 1
 	url = https://github.com/CoderDayton/nightcap
 	arch = x86_64
@@ -42,7 +42,7 @@ pkgbase = nightcap
 	conflicts = nightcap-git
 	options = !debug
 	options = !lto
-	source = nightcap::git+https://github.com/CoderDayton/nightcap.git#tag=v0.3.1
+	source = nightcap::git+https://github.com/CoderDayton/nightcap.git#tag=v0.3.4
 	sha256sums = SKIP

 pkgname = nightcap
@@ -1,7 +1,7 @@
 # Maintainer: vii <coderdayton14 at gmail dot com>

 pkgname=nightcap
-pkgver=0.3.1
+pkgver=0.3.4
 pkgrel=1
 pkgdesc='Android x86-64 Roblox compatibility runtime for Linux'
 arch=('x86_64')
@@ -9,7 +9,7 @@
    "--share=ipc",
    "--share=network",
    "--socket=wayland",
-    "--socket=x11",
+    "--socket=fallback-x11",
    "--socket=pulseaudio",
    "--device=dri",
    "--talk-name=com.feralinteractive.GameMode",
@@ -28,16 +28,12 @@
  </description>
  <screenshots>
    <screenshot type="default">
-      <image>https://raw.githubusercontent.com/komaruworld/mocktail/88b7382577aa138a2d16619b091f69abcdf7da15/assets/screenshots/flatpak-home.png</image>
+      <image>https://raw.githubusercontent.com/CoderDayton/nightcap/main/assets/screenshots/flatpak-home.png</image>
      <caption>Browse Roblox experiences</caption>
    </screenshot>
    <screenshot>
-      <image>https://raw.githubusercontent.com/komaruworld/mocktail/88b7382577aa138a2d16619b091f69abcdf7da15/assets/screenshots/flatpak-gameplay-tower.png</image>
-      <caption>Play Tower of Hell on Linux</caption>
-    </screenshot>
-    <screenshot>
-      <image>https://raw.githubusercontent.com/komaruworld/mocktail/88b7382577aa138a2d16619b091f69abcdf7da15/assets/screenshots/flatpak-gameplay-lobby.png</image>
-      <caption>Play DOORS on Linux</caption>
+      <image>https://raw.githubusercontent.com/CoderDayton/nightcap/main/assets/screenshots/flatpak-gameplay-tower.png</image>
+      <caption>Play Murder Mystery 2 on Linux</caption>
    </screenshot>
  </screenshots>
  <launchable type="desktop-id">io.github.CoderDayton.nightcap.desktop</launchable>
@@ -57,6 +53,19 @@
    <binary>mocktail</binary>
  </provides>
  <releases>
+    <release version="0.3.4" date="2026-10-11">
+      <description>
+        <ul>
+          <li>Fixed Roblox 2.742 being rejected as an update.</li>
+          <li>The new Roblox home screen and its side menu now show.</li>
+          <li>Fixed the voice chat microphone after Roblox updates.</li>
+          <li>Anti-aliasing is no longer forced off.</li>
+          <li>Nightcap now uses Wayland on NVIDIA Wayland sessions.</li>
+          <li>Fixed a missing picture on machines whose graphics card runs a different driver.</li>
+          <li>Fewer frame hitches while textures load.</li>
+        </ul>
+      </description>
+    </release>
    <release version="0.3.3" date="2026-10-04">
      <description>
        <ul>
@@ -67,7 +76,6 @@
          <li>Going to another page in the web view no longer closes it.</li>
          <li>Clicking while typing no longer closes the text box.</li>
          <li>Fixed the sky showing the wrong textures.</li>
-          <li>The Flatpak build on NVIDIA now uses X11 to avoid Wayland hangs.</li>
        </ul>
      </description>
    </release>
@@ -62,7 +62,7 @@ Branch=stable
 Url=${BASE_URL}/repo/
 RuntimeRepo=https://dl.flathub.org/repo/flathub.flatpakrepo
 Homepage=https://github.com/CoderDayton/nightcap
-Comment=Roblox on Linux, tuned for a real PC
+Comment=Roblox on Linux, tuned for desktop play
 Icon=${BASE_URL}/nightcap.svg
 GPGKey=${GPG_KEY}
 IsRuntime=false
@@ -72,3 +72,20 @@ install -m 0644 -- "${PROJECT_DIR}/site/index.html" "${OUTPUT}/index.html"
 install -m 0644 -- "${PROJECT_DIR}/site/styles.css" "${OUTPUT}/styles.css"
 install -m 0644 -- "${PROJECT_DIR}/site/terms.html" "${OUTPUT}/terms.html"
 install -m 0644 -- "${PROJECT_DIR}/site/privacy.html" "${OUTPUT}/privacy.html"
+install -m 0644 -- "${PROJECT_DIR}/site/preview.png" "${OUTPUT}/preview.png"
+
+cat >"${OUTPUT}/robots.txt" <<EOF
+User-agent: *
+Allow: /
+
+Sitemap: ${BASE_URL}/sitemap.xml
+EOF
+
+cat >"${OUTPUT}/sitemap.xml" <<EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
+  <url><loc>${BASE_URL}/</loc></url>
+  <url><loc>${BASE_URL}/terms.html</loc></url>
+  <url><loc>${BASE_URL}/privacy.html</loc></url>
+</urlset>
+EOF
@@ -23,6 +23,7 @@ supported.
 from __future__ import annotations

 import argparse
+import contextlib
 from dataclasses import dataclass
 import hashlib
 import json
@@ -161,6 +162,10 @@ class SignatureSpec:
    allow_registry_object_size_change: bool = False
    minimum_anchor_bytes: int = 6
    registry_size_indices: tuple[int, int] = (8, 12)
+    # Instructions whose register operands the compiler may have chosen
+    # differently. Each reference register must stand for one candidate
+    # register across all of them, and the reverse.
+    renamed_register_indices: tuple[int, ...] = ()


@dataclass(frozen=True)
@@ -1075,6 +1080,51 @@ def semantic_shape(
    )


+def register_family(name: str) -> str:
+    """Return the 64-bit register that name is all or part of."""
+    if len(name) >= 2 and name[0] == "r" and name[1].isdigit():
+        return name.rstrip("bwd")
+    for family in ("ax", "bx", "cx", "dx", "si", "di", "bp", "sp"):
+        if name in (family, "e" + family, "r" + family):
+            return "r" + family
+    return name
+
+
+def renamed_shapes_match(
+    reference_shape: tuple[Any, ...],
+    candidate_shape: tuple[Any, ...],
+    forward: dict[str, str],
+    backward: dict[str, str],
+) -> bool:
+    """Compare two semantic shapes, letting register operands be renamed.
+
+    forward and backward hold the renames accepted so far and gain new ones.
+    """
+    reference_mnemonic, reference_operands = reference_shape
+    candidate_mnemonic, candidate_operands = candidate_shape
+    if reference_mnemonic != candidate_mnemonic or len(reference_operands) != len(
+        candidate_operands
+    ):
+        return False
+    for left, right in zip(reference_operands, candidate_operands):
+        if left[0] != "reg" or right[0] != "reg":
+            if left != right:
+                return False
+            continue
+        if left[2] != right[2]:
+            return False
+        reference_family = register_family(left[1])
+        candidate_family = register_family(right[1])
+        if (
+            forward.setdefault(reference_family, candidate_family)
+            != candidate_family
+            or backward.setdefault(candidate_family, reference_family)
+            != reference_family
+        ):
+            return False
+    return True
+
+
 def validate_semantic_match(
    reference: Sequence[Any],
    candidate: Sequence[Any],
@@ -1082,6 +1132,8 @@ def validate_semantic_match(
 ) -> None:
    if len(reference) != len(candidate):
        raise AnalyzerError("normalized signature instruction count changed")
+    forward: dict[str, str] = {}
+    backward: dict[str, str] = {}
    for index, (reference_instruction, candidate_instruction) in enumerate(
        zip(reference, candidate)
    ):
@@ -1089,8 +1141,14 @@ def validate_semantic_match(
            spec.allow_registry_object_size_change
            and index in spec.registry_size_indices
        )
-        if semantic_shape(reference_instruction, wildcard_size) != semantic_shape(
-            candidate_instruction, wildcard_size
+        reference_shape = semantic_shape(reference_instruction, wildcard_size)
+        candidate_shape = semantic_shape(candidate_instruction, wildcard_size)
+        if (
+            not renamed_shapes_match(
+                reference_shape, candidate_shape, forward, backward
+            )
+            if index in spec.renamed_register_indices
+            else reference_shape != candidate_shape
        ):
            raise AnalyzerError(
                f"normalized instruction semantics changed at signature index {index}"
@@ -1298,6 +1356,35 @@ def has_fmod_device_lists_select_contract(image: ElfImage, rva: int) -> bool:
    )


+FMOD_OUTPUT_FIELDS = frozenset({
+    "vtable_rva",
+    "string_constructor_rva",
+    "count_method_rva",
+    "info_method_rva",
+    "current_method_rva",
+    "select_method_rva",
+})
+FMOD_INPUT_FIELDS = (
+    "input_count_method_rva",
+    "input_info_method_rva",
+    "input_current_method_rva",
+    "input_select_method_rva",
+)
+
+
+def fmod_vtable_slots(layout: int, with_input: bool) -> dict[str, int]:
+    """Vtable slot of each FMOD method field in vtable layout 1 or 2."""
+    slots = {
+        "count_method_rva": 5,
+        "info_method_rva": 6,
+        "current_method_rva": 8 if layout == 2 else 7,
+        "select_method_rva": 19 if layout == 2 else 17,
+    }
+    if with_input:
+        slots.update(zip(FMOD_INPUT_FIELDS, (9, 10, 12, 18) if layout == 2 else (8, 9, 10, 16)))
+    return slots
+
+
 def load_reference_runtime_profile(
    paths: Sequence[Path], reference_build_id: str
 ) -> dict[str, Any]:
@@ -1323,21 +1410,11 @@ def load_reference_runtime_profile(
                )
            if "fmod_output_device_bridge" in profile:
                bridge = profile["fmod_output_device_bridge"]
-                fields = {
-                    "vtable_rva",
-                    "string_constructor_rva",
-                    "count_method_rva",
-                    "info_method_rva",
-                    "current_method_rva",
-                    "select_method_rva",
-                }
                if (
                    not isinstance(bridge, dict)
-                    or not fields <= set(bridge)
-                    or set(bridge) - fields - {"vtable_layout_version"} - {
-                        "input_count_method_rva", "input_info_method_rva",
-                        "input_current_method_rva", "input_select_method_rva",
-                    }
+                    or not FMOD_OUTPUT_FIELDS <= set(bridge)
+                    or set(bridge) - FMOD_OUTPUT_FIELDS - {"vtable_layout_version"}
+                    - set(FMOD_INPUT_FIELDS)
                    or profile.get("allow_host_abi_bridges") is not True
                ):
                    raise AnalyzerError(
@@ -1357,10 +1434,7 @@ def load_reference_runtime_profile(
                if field in result:
                    previous = result[field]
                    if field == "fmod_output_device_bridge":
-                        input_fields = {
-                            "input_count_method_rva", "input_info_method_rva",
-                            "input_current_method_rva", "input_select_method_rva",
-                        }
+                        input_fields = set(FMOD_INPUT_FIELDS)
                        compatible = ((set(previous) ^ set(value)) <= input_fields and
                            all(previous[key] == value[key]
                                for key in previous.keys() & value.keys()))
@@ -1382,12 +1456,7 @@ def derive_fmod_output_device_bridge(
    source: dict[str, int],
 ) -> dict[str, Any]:
    source_layout = source.get("vtable_layout_version", 1)
-    indexes = {
-        "count_method_rva": 5,
-        "info_method_rva": 6,
-        "current_method_rva": 8 if source_layout == 2 else 7,
-        "select_method_rva": 19 if source_layout == 2 else 17,
-    }
+    indexes = fmod_vtable_slots(source_layout, False)
    source_vtable = source["vtable_rva"]
    reference.require_relro_rva(source_vtable, (max(indexes.values()) + 1) * 8)
    reference_relocations = relative_relocation_map(reference)
@@ -1472,7 +1541,10 @@ def derive_fmod_output_device_bridge(
            continue
        vtable = offset - indexes["info_method_rva"] * 8
        count_method = relocations.get(vtable + indexes["count_method_rva"] * 8)
-        for layout, current_index, select_index in ((1, 7, 17), (2, 8, 19)):
+        for layout in (1, 2):
+            layout_slots = fmod_vtable_slots(layout, False)
+            current_index = layout_slots["current_method_rva"]
+            select_index = layout_slots["select_method_rva"]
            current_method = relocations.get(vtable + current_index * 8)
            selected = relocations.get(vtable + select_index * 8)
            if (
@@ -1510,18 +1582,13 @@ def derive_fmod_output_device_bridge(
    }
    if layout != 1:
        result["vtable_layout_version"] = layout
-    input_fields = (
-        "input_count_method_rva", "input_info_method_rva",
-        "input_current_method_rva", "input_select_method_rva",
-    )
-    if any(field in source for field in input_fields):
-        if not all(field in source for field in input_fields):
+    if any(field in source for field in FMOD_INPUT_FIELDS):
+        if not all(field in source for field in FMOD_INPUT_FIELDS):
            raise AnalyzerError("reference FMOD input profile is incomplete")
-        source_slots = (9, 10, 12, 18) if source_layout == 2 else (8, 9, 10, 16)
-        target_slots = (9, 10, 12, 18) if layout == 2 else (8, 9, 10, 16)
-        for field, old_slot, new_slot, length in zip(
-            input_fields, source_slots, target_slots, (4, 16, 12, 16)
-        ):
+        source_slots = fmod_vtable_slots(source_layout, True)
+        target_slots = fmod_vtable_slots(layout, True)
+        for field, length in zip(FMOD_INPUT_FIELDS, (4, 16, 12, 16)):
+            old_slot, new_slot = source_slots[field], target_slots[field]
            if reference_relocations.get(source_vtable + old_slot * 8) != source[field]:
                raise AnalyzerError("reference FMOD input slot changed")
            target = relocations.get(vtable + new_slot * 8)
@@ -1541,6 +1608,7 @@ def derive_runtime_compatibility(
    reference: ElfImage,
    candidate: ElfImage,
    manifests: Sequence[Path],
+    fallback: ElfImage | None = None,
 ) -> dict[str, Any]:
    source = load_reference_runtime_profile(manifests, reference.build_id)
    result: dict[str, Any] = {}
@@ -1563,9 +1631,38 @@ def derive_runtime_compatibility(
        result["fmod_output_device_bridge"] = derive_fmod_output_device_bridge(
            reference, candidate, fmod
        )
+    elif fallback is not None:
+        bridge = derive_fallback_fmod_output_device_bridge(
+            fallback, candidate, manifests
+        )
+        if bridge is not None:
+            result["fmod_output_device_bridge"] = bridge
    return result


+def derive_fallback_fmod_output_device_bridge(
+    fallback: ElfImage,
+    candidate: ElfImage,
+    manifests: Sequence[Path],
+) -> dict[str, Any] | None:
+    """Derive the optional FMOD bridge from another build in the manifests.
+
+    Any failure leaves the bridge out.
+    """
+    if fallback.build_id == candidate.build_id:
+        return None
+    try:
+        fallback.validate_toolchain()
+        fmod = load_reference_runtime_profile(manifests, fallback.build_id).get(
+            "fmod_output_device_bridge"
+        )
+        if fmod is None:
+            return None
+        return derive_fmod_output_device_bridge(fallback, candidate, fmod)
+    except AnalyzerError:
+        return None
+
+
 def find_registry_function_entry(
    candidate: ElfImage,
    body_rva: int,
@@ -1613,6 +1710,73 @@ def find_registry_function_entry(
    return entries[0]


+def find_renamed_registry_body_match(
+    reference: ElfImage,
+    candidate: ElfImage,
+    reference_body: Sequence[Any],
+    minimum_anchor_bytes: int,
+) -> SignatureMatch:
+    """Find the registry initializer body under other temporary registers.
+
+    The body allocates the registry, clears it, and starts filling it:
+
+       0  mov edi, SIZE          6  xor esi, esi
+       1  call allocate          7  call memset
+       2  mov rbx, rax           8  mov ONE, 0x3f800000
+       3  xor ZERO, ZERO         9  mov dword ptr [rbx + 0x20], ONE
+       4  mov edx, SIZE         10  lea FIELD, [rbx + 0x28]
+       5  mov rdi, rax
+
+    ZERO, ONE and FIELD are the compiler's choice. Instructions 4 to 7 use
+    registers the calling convention fixes, so they are searched for by bytes
+    and every hit is then checked against all eleven instructions.
+    """
+    clear_index = 4
+    clear_matches = find_signature_matches(
+        reference,
+        candidate,
+        SignatureSpec(
+            "registry-initializer-clear",
+            reference_body[clear_index].address,
+            4,
+            True,
+            minimum_anchor_bytes,
+            (0, 0),
+        ),
+        allow_multiple_candidates=True,
+    )
+    body_spec = SignatureSpec(
+        "registry-initializer-body",
+        reference_body[0].address,
+        len(reference_body),
+        True,
+        minimum_anchor_bytes,
+        (0, 4),
+        (3, 8, 9, 10),
+    )
+    # Instructions 0 to 3 keep their lengths as long as ZERO stays one of r8
+    # to r15, so the body starts this far before the clear sequence.
+    lead = reference_body[clear_index].address - reference_body[0].address
+    found = []
+    for clear in clear_matches:
+        if clear.rva < lead:
+            continue
+        try:
+            body = disassemble(candidate, clear.rva - lead, len(reference_body))
+            if body[clear_index].address != clear.rva:
+                continue
+            validate_semantic_match(reference_body, body, body_spec)
+        except AnalyzerError:
+            continue
+        found.append(SignatureMatch(clear.rva - lead, tuple(reference_body), body))
+    if len(found) != 1:
+        raise AnalyzerError(
+            f"signature registry-initializer-body matched {len(found)} "
+            "candidate locations with renamed registers"
+        )
+    return found[0]
+
+
 def find_registry_signature_match(
    reference: ElfImage,
    candidate: ElfImage,
@@ -1633,7 +1797,18 @@ def find_registry_signature_match(
        spec.minimum_anchor_bytes,
        (0, 4),
    )
-    body_match = find_signature_match(reference, candidate, body_spec)
+    try:
+        body_match = find_signature_match(reference, candidate, body_spec)
+    except AnalyzerError:
+        body_match = find_renamed_registry_body_match(
+            reference,
+            candidate,
+            reference_full[
+                body_instruction_index : body_instruction_index
+                + body_instruction_count
+            ],
+            spec.minimum_anchor_bytes,
+        )
    candidate_entry = find_registry_function_entry(
        candidate,
        body_match.rva,
@@ -1671,14 +1846,14 @@ def find_constructor_boundary_match(
    reference: ElfImage,
    candidate: ElfImage,
    spec: SignatureSpec,
-    reference_entry: int,
-    candidate_entry: int,
+    candidate_entries: Sequence[int],
 ) -> SignatureMatch:
-    if reference_entry != spec.reference_rva:
-        raise AnalyzerError(
-            "reference constructor boundary moved outside init-array index 4"
-        )
-    reference_wrapper = disassemble(reference, reference_entry, 1)
+    """Match a constructor that is one jump to its body.
+
+    The body is found by signature, and the candidate constructor is the one
+    of candidate_entries that jumps to it.
+    """
+    reference_wrapper = disassemble(reference, spec.reference_rva, 1)
    reference_target = direct_jump_target(
        reference_wrapper[0], "reference constructor boundary"
    )
@@ -1686,20 +1861,29 @@ def find_constructor_boundary_match(
        reference,
        candidate,
        SignatureSpec(
-            "constructor-4-target",
+            f"{spec.name}-target",
            reference_target,
            spec.instruction_count,
        ),
    )
-    candidate_wrapper = disassemble(candidate, candidate_entry, 1)
-    candidate_target = direct_jump_target(
-        candidate_wrapper[0], "candidate constructor boundary"
-    )
-    if candidate_target != target_match.rva:
+    found = []
+    for candidate_entry in candidate_entries:
+        try:
+            candidate_wrapper = disassemble(candidate, candidate_entry, 1)
+            candidate_target = direct_jump_target(
+                candidate_wrapper[0], "candidate constructor boundary"
+            )
+        except AnalyzerError:
+            continue
+        if candidate_target == target_match.rva:
+            found.append(
+                SignatureMatch(candidate_entry, reference_wrapper, candidate_wrapper)
+            )
+    if len(found) != 1:
        raise AnalyzerError(
-            "constructor index 4 no longer targets its verified boundary"
+            f"{spec.name} no longer targets its verified boundary"
        )
-    return SignatureMatch(candidate_entry, reference_wrapper, candidate_wrapper)
+    return found[0]


 def rip_targets(instruction: Any) -> tuple[int, ...]:
@@ -1713,6 +1897,161 @@ def rip_targets(instruction: Any) -> tuple[int, ...]:
    return tuple(targets)


+def is_register_operand(operand: Any, register: int) -> bool:
+    return operand.type == capstone_x86.X86_OP_REG and operand.reg == register
+
+
+def jni_singleton_publication(image: ElfImage, entry: int) -> tuple[Any, ...]:
+    """Return the instructions that publish the JNI singleton.
+
+    They open its initializer at entry, after a stack frame if it has one:
+
+       lea rax, [rip + OBJECT]
+       xchg qword ptr [rip + SLOT], rax
+       mov qword ptr [rip + OBJECT], rax
+
+    OBJECT is the eight bytes after SLOT.
+    """
+    for frame in (0, 2):
+        try:
+            decoded = disassemble(image, entry, frame + 3)
+        except AnalyzerError:
+            continue
+        if frame:
+            push, link = decoded[:2]
+            if (
+                push.mnemonic != "push"
+                or len(push.operands) != 1
+                or not is_register_operand(push.operands[0], capstone_x86.X86_REG_RBP)
+                or link.mnemonic != "mov"
+                or len(link.operands) != 2
+                or not is_register_operand(link.operands[0], capstone_x86.X86_REG_RBP)
+                or not is_register_operand(link.operands[1], capstone_x86.X86_REG_RSP)
+            ):
+                continue
+        load, exchange, store = decoded[frame:]
+        object_targets = rip_targets(load)
+        slot_targets = rip_targets(exchange)
+        stored_targets = rip_targets(store)
+        if (
+            load.mnemonic == "lea"
+            and len(load.operands) == 2
+            and is_register_operand(load.operands[0], capstone_x86.X86_REG_RAX)
+            and exchange.mnemonic == "xchg"
+            and len(exchange.operands) == 2
+            and exchange.operands[0].size == 8
+            and is_register_operand(exchange.operands[1], capstone_x86.X86_REG_RAX)
+            and store.mnemonic == "mov"
+            and len(store.operands) == 2
+            and store.operands[0].size == 8
+            and is_register_operand(store.operands[1], capstone_x86.X86_REG_RAX)
+            and len(object_targets) == 1
+            and len(slot_targets) == 1
+            and len(stored_targets) == 1
+            and object_targets[0] == stored_targets[0]
+            and object_targets[0] == slot_targets[0] + 8
+        ):
+            return decoded[frame:]
+    raise AnalyzerError(
+        f"JNI singleton initializer at {format_rva(entry)} "
+        "does not publish its singleton"
+    )
+
+
+def find_jni_singleton_match(
+    reference: ElfImage,
+    candidate: ElfImage,
+    spec: SignatureSpec,
+    candidate_entries: Sequence[int],
+) -> SignatureMatch:
+    """Find the JNI singleton initializer among candidate_entries.
+
+    The instructions after the publication follow the singleton's layout, so
+    when a release changes that layout only the publication is matched. The
+    initializer itself runs from the init-array either way.
+    """
+    try:
+        return find_signature_match(reference, candidate, spec)
+    except AnalyzerError:
+        pass
+    reference_publication = jni_singleton_publication(reference, spec.reference_rva)
+    found = find_signature_match(
+        reference,
+        candidate,
+        SignatureSpec(
+            "jni-singleton-publication",
+            reference_publication[0].address,
+            len(reference_publication),
+            minimum_anchor_bytes=3,
+        ),
+    )
+    for entry in candidate_entries:
+        try:
+            publication = jni_singleton_publication(candidate, entry)
+        except AnalyzerError:
+            continue
+        if publication[0].address == found.rva:
+            return SignatureMatch(entry, reference_publication, publication)
+    raise AnalyzerError("JNI singleton initializer is not a leading constructor")
+
+
+# The native replay starts at this init-array index on x86_64.
+LEADING_CONSTRUCTOR_BEGIN = 2
+# The process-load constructor, the JNI singleton initializer and two wiring
+# entries. A release may put them in any order.
+LEADING_CONSTRUCTOR_COUNT = 4
+
+
+def match_leading_constructors(
+    reference: ElfImage,
+    candidate: ElfImage,
+    constructor_anchors: dict[str, Any],
+    jni_spec: SignatureSpec,
+    reference_init: Sequence[int],
+    candidate_init: Sequence[int],
+) -> tuple[tuple[int, ...], SignatureMatch]:
+    """Find each reference leading constructor in the candidate by its code.
+
+    Returns, for each reference leading constructor, the candidate init-array
+    index of the same constructor, both counted from
+    LEADING_CONSTRUCTOR_BEGIN, and the JNI singleton initializer match.
+    """
+    moved = "constructor moved outside verified init-array boundary"
+    end = LEADING_CONSTRUCTOR_BEGIN + LEADING_CONSTRUCTOR_COUNT
+    if len(reference_init) < end or len(candidate_init) < end:
+        raise AnalyzerError("init-array shape is not derivable")
+    candidate_entries = tuple(candidate_init[LEADING_CONSTRUCTOR_BEGIN:end])
+    candidate_offsets = []
+    jni_match = None
+    for index in range(LEADING_CONSTRUCTOR_BEGIN, end):
+        reference_entry = reference_init[index]
+        name = f"constructor-{index}"
+        if parse_rva(constructor_anchors.get(str(index)), name) != reference_entry:
+            raise AnalyzerError(moved)
+        if reference_entry == jni_spec.reference_rva:
+            match = find_jni_singleton_match(
+                reference, candidate, jni_spec, candidate_entries
+            )
+            jni_match = match
+        else:
+            spec = SignatureSpec(name, reference_entry, 24)
+            if disassemble(reference, reference_entry, 1)[0].mnemonic == "jmp":
+                match = find_constructor_boundary_match(
+                    reference, candidate, spec, candidate_entries
+                )
+            else:
+                match = find_signature_match(reference, candidate, spec)
+        if match.rva not in candidate_entries:
+            raise AnalyzerError(moved)
+        candidate_offset = candidate_entries.index(match.rva)
+        if candidate_offset in candidate_offsets:
+            raise AnalyzerError(moved)
+        candidate_offsets.append(candidate_offset)
+    if jni_match is None:
+        raise AnalyzerError("JNI singleton initializer is not a leading constructor")
+    return tuple(candidate_offsets), jni_match
+
+
 def mapped_rip_target(
    match: SignatureMatch, reference_target: int, description: str
 ) -> int:
@@ -1805,7 +2144,6 @@ def create_signature_specs(
    bridges = bridge_map(profile)
    data_seeds = profile["data_seeds"]
    bootstrap = profile["native_pre_jni_bootstrap"]
-    constructor_rvas = anchors["constructor_rvas"]
    return [
        SignatureSpec(
            "small-allocate",
@@ -1870,45 +2208,60 @@ def create_signature_specs(
            parse_rva(anchors["jni_singleton_initializer_rva"], "JNI singleton anchor"),
            11,
        ),
-        SignatureSpec(
-            "constructor-2", parse_rva(constructor_rvas["2"], "constructor 2"), 24
-        ),
-        SignatureSpec(
-            "constructor-3", parse_rva(constructor_rvas["3"], "constructor 3"), 24
-        ),
-        SignatureSpec(
-            "constructor-4",
-            parse_rva(constructor_rvas["4"], "constructor 4"),
-            24,
-            minimum_anchor_bytes=3,
-        ),
    ]


-def adjusted_ranges(
-    ranges: list[dict[str, int]], reference_count: int, candidate_count: int
+def remapped_constructor_ranges(
+    ranges: list[dict[str, int]],
+    candidate_offsets: Sequence[int],
+    reference_count: int,
+    candidate_count: int,
 ) -> list[dict[str, int]]:
-    result = []
+    """Rewrite the reference constructor ranges for the candidate init-array.
+
+    Each leading constructor keeps its place in or out of the replay under
+    its candidate index, and every later constructor runs.
+    """
+    cannot_fit = "reference constructor range cannot fit candidate init-array"
+    leading_end = LEADING_CONSTRUCTOR_BEGIN + LEADING_CONSTRUCTOR_COUNT
+    ranges = validated_ranges(ranges, "reference constructor ranges", reference_count)
+    if (
+        ranges[0]["begin"] < LEADING_CONSTRUCTOR_BEGIN
+        or ranges[-1]["begin"] > leading_end
+        or ranges[-1]["end_exclusive"] != reference_count
+        or reference_count <= leading_end
+        or candidate_count <= leading_end
+    ):
+        raise AnalyzerError(cannot_fit)
+    runs = [False] * LEADING_CONSTRUCTOR_COUNT
    for item in ranges:
-        end = (
-            candidate_count
-            if item["end_exclusive"] == reference_count
-            else item["end_exclusive"]
-        )
-        if end > candidate_count:
-            raise AnalyzerError(
-                "reference constructor range cannot fit candidate init-array"
-            )
-        result.append({"begin": item["begin"], "end_exclusive": end})
+        for index in range(item["begin"], min(item["end_exclusive"], leading_end)):
+            runs[candidate_offsets[index - LEADING_CONSTRUCTOR_BEGIN]] = True
+    result = []
+    run_begin = None
+    for offset, run in enumerate(runs):
+        index = LEADING_CONSTRUCTOR_BEGIN + offset
+        if run:
+            if run_begin is None:
+                run_begin = index
+        elif run_begin is not None:
+            result.append({"begin": run_begin, "end_exclusive": index})
+            run_begin = None
+    result.append(
+        {
+            "begin": leading_end if run_begin is None else run_begin,
+            "end_exclusive": candidate_count,
+        }
+    )
    return validated_ranges(result, "derived constructor ranges", candidate_count)


-def derive_profile(
+def check_derivation_inputs(
    reference: ElfImage,
    candidate: ElfImage,
    reference_sidecar: dict[str, Any],
-) -> tuple[dict[str, Any], dict[str, Any]]:
-    require_capstone()
+) -> tuple[tuple[int, ...], tuple[int, ...]]:
+    """Rejects inputs no derivation may use; returns both init-arrays."""
    if (
        reference.build_id != reference_sidecar["elf_build_id"]
        or reference.sha256 != reference_sidecar["payload_sha256"]
@@ -1926,17 +2279,28 @@ def derive_profile(
            "candidate is missing required JNI exports: "
            + ", ".join(sorted(missing_exports))
        )
-
-    reference_profile = reference_sidecar["profile"]
-    anchors = reference_sidecar["derivation_anchors"]
    reference_init = reference.init_array_relocations()
    candidate_init = candidate.init_array_relocations()
-    if len(reference_init) != reference_profile["init_array_count"]:
+    if len(reference_init) != reference_sidecar["profile"]["init_array_count"]:
        raise AnalyzerError(
            "reference sidecar init-array count differs from ELF metadata"
        )
    if len(candidate_init) < 8:
        raise AnalyzerError("candidate init-array is unexpectedly short")
+    return reference_init, candidate_init
+
+
+def derive_profile(
+    reference: ElfImage,
+    candidate: ElfImage,
+    reference_sidecar: dict[str, Any],
+) -> tuple[dict[str, Any], dict[str, Any]]:
+    require_capstone()
+    reference_init, candidate_init = check_derivation_inputs(
+        reference, candidate, reference_sidecar
+    )
+    reference_profile = reference_sidecar["profile"]
+    anchors = reference_sidecar["derivation_anchors"]
    matches = {}
    allocate_matches = ()
    for spec in create_signature_specs(reference_profile, anchors):
@@ -1948,13 +2312,14 @@ def derive_profile(
            matches[spec.name] = find_registry_signature_match(
                reference, candidate, spec
            )
-        elif spec.name == "constructor-4":
-            matches[spec.name] = find_constructor_boundary_match(
+        elif spec.name == "jni-singleton-initializer":
+            leading_offsets, matches[spec.name] = match_leading_constructors(
                reference,
                candidate,
+                anchors["constructor_rvas"],
                spec,
-                reference_init[4],
-                candidate_init[4],
+                reference_init,
+                candidate_init,
            )
        else:
            matches[spec.name] = find_signature_match(reference, candidate, spec)
@@ -1990,21 +2355,7 @@ def derive_profile(
            "registry allocator call"
        )
    matches["allocate"] = selected_allocate[0]
-    for index in (2, 3, 4):
-        match = matches[f"constructor-{index}"]
-        if (
-            reference_init[index] != match.reference_instructions[0].address
-            or candidate_init[index] != match.rva
-        ):
-            raise AnalyzerError(
-                f"constructor {index} moved outside its verified init-array boundary"
-            )
    singleton_match = matches["jni-singleton-initializer"]
-    if (
-        reference_init[5] != singleton_match.reference_instructions[0].address
-        or candidate_init[5] != singleton_match.rva
-    ):
-        raise AnalyzerError("JNI singleton initializer is not constructor index 5")

    candidate_bridge_entries = []
    for entry in reference_profile["bridge_entries"]:
@@ -2075,28 +2426,34 @@ def derive_profile(
    init_section = candidate.sections[".init_array"]
    reference_count = reference_profile["init_array_count"]
    candidate_count = len(candidate_init)
-    constructor_ranges = adjusted_ranges(
-        validated_ranges(
-            reference_profile["constructor_run_ranges"],
-            "reference constructor ranges",
-            reference_count,
-        ),
+    constructor_ranges = remapped_constructor_ranges(
+        reference_profile["constructor_run_ranges"],
+        leading_offsets,
        reference_count,
        candidate_count,
    )
-    native_ranges = adjusted_ranges(
-        validated_ranges(
-            reference_profile["native_mimalloc_constructor_run_ranges"],
-            "reference native constructor ranges",
-            reference_count,
-        ),
+    native_ranges = remapped_constructor_ranges(
+        reference_profile["native_mimalloc_constructor_run_ranges"],
+        leading_offsets,
        reference_count,
        candidate_count,
    )
-    thread_boundary = reference_profile[
+    reference_thread_boundary = reference_profile[
        "native_mimalloc_thread_initializer_after_constructor"
    ]
-    if thread_boundary != 2 or not any(
+    if not (
+        LEADING_CONSTRUCTOR_BEGIN
+        <= reference_thread_boundary
+        < LEADING_CONSTRUCTOR_BEGIN + LEADING_CONSTRUCTOR_COUNT
+    ):
+        raise AnalyzerError("native allocator TLS boundary is no longer verified")
+    # The thread initializer follows the process-load constructor to its
+    # candidate index.
+    thread_boundary = (
+        LEADING_CONSTRUCTOR_BEGIN
+        + leading_offsets[reference_thread_boundary - LEADING_CONSTRUCTOR_BEGIN]
+    )
+    if not any(
        item["begin"] <= thread_boundary < item["end_exclusive"]
        for item in native_ranges
    ):
@@ -2243,13 +2600,22 @@ def analyze(arguments: argparse.Namespace) -> tuple[dict[str, Any], dict[str, An
    metadata_path = Path(arguments.payload_metadata)
    sidecar_path = Path(arguments.reference_profile)
    reference_sidecar = validated_sidecar(sidecar_path)
-    with ElfImage(reference_path) as reference, ElfImage(candidate_path) as candidate:
+    with contextlib.ExitStack() as stack:
+        reference = stack.enter_context(ElfImage(reference_path))
+        candidate = stack.enter_context(ElfImage(candidate_path))
+        fallback = None
+        if arguments.runtime_fallback_lib is not None:
+            with contextlib.suppress(AnalyzerError):
+                fallback = stack.enter_context(
+                    ElfImage(Path(arguments.runtime_fallback_lib))
+                )
        metadata = validated_payload_metadata(metadata_path, candidate_path, candidate)
        profile, anchors = derive_profile(reference, candidate, reference_sidecar)
        runtime_compatibility = derive_runtime_compatibility(
            reference,
            candidate,
            tuple(Path(path) for path in arguments.reference_compatibility),
+            fallback,
        )
        return output_documents(
            candidate,
@@ -2274,6 +2640,12 @@ def parse_arguments(argv: Sequence[str]) -> argparse.Namespace:
        metavar="MANIFEST",
        help="compatibility manifest containing exact reference runtime anchors",
    )
+    parser.add_argument(
+        "--runtime-fallback-lib",
+        metavar="LIB",
+        help="libroblox.so of another build in the compatibility manifests; "
+        "supplies the FMOD output-device anchors when the reference has none",
+    )
    parser.add_argument("--candidate-lib", required=True, metavar="LIB")
    parser.add_argument("--payload-metadata", required=True, metavar="META")
    parser.add_argument("--output", required=True, metavar="PROFILE")
@@ -107,6 +107,28 @@ AnyLinuxDownloadDependencies() {
  AnyLinuxDependencyDie 'dependency downloads failed after 3 snapshots'
 }

+# Prints the package name and path of each archive that is older than the
+# installed package.
+AnyLinuxDependencyDowngrades() {
+  local package name version installed
+  for package in "$@"; do
+    read -r name version < <(pacman -Qp -- "${package}")
+    installed="$(pacman -Q -- "${name}" 2>/dev/null | cut -d ' ' -f 2)" || continue
+    [[ -n "${installed}" ]] || continue
+    if (( $(vercmp "${version}" "${installed}") < 0 )); then
+      printf '%s\t%s\n' "${name}" "${package}"
+    fi
+  done
+}
+
+# Prints each pkg-config module whose requirements are not met.
+AnyLinuxDependencyBrokenModules() {
+  local module
+  while read -r module; do
+    pkg-config --exists "${module}" 2>/dev/null || printf '%s\n' "${module}"
+  done < <(pkg-config --list-package-names 2>/dev/null)
+}
+
 AnyLinuxDependenciesMain() (
  AnyLinuxDependencyRequireContainer
  (( $# == 0 )) || AnyLinuxDependencyDie 'no arguments are supported'
@@ -126,7 +148,35 @@ AnyLinuxDependenciesMain() (
  while IFS=$'\t' read -r digest filename url; do
    packages+=("${DOWNLOADS}/${filename}")
  done <"${DOWNLOADS}/dependencies.tsv"
-  pacman -U --noconfirm --needed "${packages[@]}"
+  local broken name package
+  local -a current=() older=() older_names=()
+  local -A is_older=()
+  while IFS=$'\t' read -r name package; do
+    older_names+=("${name}")
+    is_older["${package}"]=1
+  done < <(AnyLinuxDependencyDowngrades "${packages[@]}")
+  for package in "${packages[@]}"; do
+    if [[ -n "${is_older[${package}]:-}" ]]; then
+      older+=("${package}")
+    else
+      current+=("${package}")
+    fi
+  done
+  (( ${#current[@]} == 0 )) || pacman -U --noconfirm --needed "${current[@]}"
+  (( ${#older[@]} > 0 )) || return 0
+  # A reduced package can lag the distribution. If the older version leaves
+  # another package's pkg-config requirements unmet, build with the
+  # distribution's package for that library. Modules that the reduced
+  # packages of the current version already leave unmet do not count.
+  broken="$(AnyLinuxDependencyBrokenModules)"
+  pacman -U --noconfirm --needed "${older[@]}"
+  if [[ "$(AnyLinuxDependencyBrokenModules)" != "${broken}" ]]; then
+    printf '[anylinux-dependencies] reduced packages are too old; restoring %s\n' \
+      "${older_names[*]}" >&2
+    pacman -S --noconfirm "${older_names[@]}"
+    [[ "$(AnyLinuxDependencyBrokenModules)" == "${broken}" ]] ||
+      AnyLinuxDependencyDie 'reduced packages break pkg-config requirements'
+  fi
 )

 if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
@@ -207,7 +207,13 @@ EOF
    "${ANYLINUX_TOOL}" --make-appimage
  local result="${ANYLINUX_WORK}/image/$(basename -- "${ANYLINUX_OUTPUT}")"
  [[ -x "${result}" ]] || AnyLinuxDie "quick-sharun did not create the requested AppImage"
+  if [[ -n "${UPINFO:-}" ]]; then
+    [[ -s "${result}.zsync" ]] || AnyLinuxDie "update information was set but no .zsync was generated"
+  fi
  mv -f -- "${result}" "${ANYLINUX_OUTPUT}"
+  if [[ -f "${result}.zsync" ]]; then
+    mv -fT -- "${result}.zsync" "${ANYLINUX_OUTPUT}.zsync"
+  fi
  printf '[anylinux] AppImage ready: %s\n' "${ANYLINUX_OUTPUT}" >&2
 }

@@ -0,0 +1,173 @@
+#!/usr/bin/env python3
+# Copyright 2026 Mocktail Project Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Run the HostAbi deriver and the solver on one update and compare them.
+
+Usage:
+    python3 roblox_abi_check.py --reference-lib OLD.so \\
+        --reference-profile OLD_PROFILE.json \\
+        --reference-compatibility config/roblox_compatibility.json \\
+        --candidate-lib NEW.so
+
+Prints every field where the two disagree. Exit status: 0 agree, 1 differ or
+one side failed, 2 both failed.
+"""
+
+from __future__ import annotations
+
+import argparse
+import importlib.util
+from pathlib import Path
+import sys
+from typing import Any, Sequence
+
+
+def _load_solver():
+    name = "mocktail_roblox_abi_solver"
+    if name in sys.modules:
+        return sys.modules[name]
+    path = Path(__file__).resolve().with_name("roblox_abi_solver.py")
+    specification = importlib.util.spec_from_file_location(name, path)
+    if specification is None or specification.loader is None:
+        raise RuntimeError("cannot load roblox_abi_solver.py")
+    module = importlib.util.module_from_spec(specification)
+    sys.modules[name] = module
+    specification.loader.exec_module(module)
+    return module
+
+
+SOLVER = _load_solver()
+DERIVER = SOLVER.DERIVER
+AnalyzerError = SOLVER.AnalyzerError
+format_rva = SOLVER.format_rva
+
+
+def compare_results(derived: Any, solved: Any, path: str = "") -> list[str]:
+    """Returns one line for every leaf value where the two results differ."""
+    if isinstance(derived, dict) and isinstance(solved, dict):
+        lines = []
+        for key in sorted(derived.keys() | solved.keys(), key=str):
+            child = f"{path}.{key}" if path else str(key)
+            if key not in solved:
+                lines.append(f"{child}: deriver {derived[key]}, solver missing")
+            elif key not in derived:
+                lines.append(f"{child}: deriver missing, solver {solved[key]}")
+            else:
+                lines.extend(compare_results(derived[key], solved[key], child))
+        return lines
+    if isinstance(derived, list) and isinstance(solved, list) and len(derived) == len(solved):
+        return [
+            line
+            for index, (left, right) in enumerate(zip(derived, solved))
+            for line in compare_results(left, right, f"{path}[{index}]")
+        ]
+    return [] if derived == solved else [f"{path}: deriver {derived}, solver {solved}"]
+
+
+def check_status(
+    derived: Any, solved: Any, deriver_error: str | None, solver_error: str | None
+) -> tuple[int, list[str]]:
+    """Exit status and report lines: 0 agree, 1 differ or one failed, 2 both failed."""
+    lines = []
+    if deriver_error is not None:
+        lines.append(f"deriver failed: {deriver_error}")
+    if solver_error is not None:
+        lines.append(f"solver failed: {solver_error}")
+    if deriver_error is not None and solver_error is not None:
+        return 2, lines
+    if deriver_error is not None or solver_error is not None:
+        return 1, lines
+    differences = compare_results(derived, solved)
+    if differences:
+        return 1, differences
+    return 0, ["deriver and solver agree on every field"]
+
+
+def _solver_runtime_source(source: dict[str, Any]) -> dict[str, Any]:
+    # The deriver's loader returns integers; the solver reads hex strings.
+    result: dict[str, Any] = {}
+    for key, value in source.items():
+        if isinstance(value, dict):
+            result[key] = {
+                field: item if field == "vtable_layout_version" else format_rva(item)
+                for field, item in value.items()
+            }
+        else:
+            result[key] = format_rva(value)
+    return result
+
+
+def _describe(error: Exception) -> str:
+    if isinstance(error, AnalyzerError):
+        return str(error)
+    return f"{type(error).__name__}: {error}"
+
+
+def check(arguments: argparse.Namespace) -> int:
+    """Runs the deriver and the solver on one update and compares them."""
+    sidecar = DERIVER.validated_sidecar(Path(arguments.reference_profile))
+    manifests = [Path(path) for path in arguments.reference_compatibility]
+    cache_dir = Path(arguments.cache_dir) if arguments.cache_dir else None
+    derived = solved = deriver_error = solver_error = None
+    with DERIVER.ElfImage(Path(arguments.reference_lib)) as reference, DERIVER.ElfImage(
+        Path(arguments.candidate_lib)
+    ) as candidate:
+        try:
+            profile, anchors = DERIVER.derive_profile(reference, candidate, sidecar)
+            runtime = DERIVER.derive_runtime_compatibility(reference, candidate, manifests)
+            derived = {"profile": profile, "derivation_anchors": anchors, "runtime": runtime}
+        except Exception as error:
+            deriver_error = _describe(error)
+        try:
+            # The input checks are cheap; indexing both libraries is not.
+            SOLVER.check_inputs(reference, candidate, sidecar)
+            solver = SOLVER.Solver(reference, candidate, cache_dir)
+            profile, anchors = solver.derive_profile(sidecar)
+            source = DERIVER.load_reference_runtime_profile(manifests, reference.build_id)
+            runtime = solver.derive_runtime_compatibility(_solver_runtime_source(source))
+            solved = {"profile": profile, "derivation_anchors": anchors, "runtime": runtime}
+        except Exception as error:
+            solver_error = _describe(error)
+    status, lines = check_status(derived, solved, deriver_error, solver_error)
+    for line in lines:
+        print(line)
+    return status
+
+
+def main(argv: Sequence[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(
+        description="Run the HostAbi deriver and the solver on one update and compare them"
+    )
+    parser.add_argument("--reference-lib", required=True, metavar="REF")
+    parser.add_argument("--reference-profile", required=True, metavar="REFJSON")
+    parser.add_argument(
+        "--reference-compatibility", action="append", default=[], metavar="MANIFEST"
+    )
+    parser.add_argument("--candidate-lib", required=True, metavar="LIB")
+    parser.add_argument(
+        "--cache-dir",
+        default=str(Path.home() / ".cache" / "mocktail" / "function_index"),
+        help="where function indexes are kept; empty to disable",
+    )
+    arguments = parser.parse_args(sys.argv[1:] if argv is None else argv)
+    try:
+        return check(arguments)
+    except AnalyzerError as error:
+        print(f"roblox-abi-check: error: {error}", file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -0,0 +1,401 @@
+#!/usr/bin/env python3
+# Copyright 2026 Mocktail Project Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Evidence-scoring solver that finds HostAbi addresses in a new libroblox.
+
+Each function in both builds is indexed by `roblox_function_index.py`. A
+reference function is matched through independent clues:
+
+- the same instruction shape, unique in both builds
+- callers and callees that are already matched
+- the strings it references
+- its data references, shifted by the distance mapped for those addresses
+- its place between matched neighbours
+
+A match is accepted only with a score of at least ACCEPT_SCORE and a lead of
+at least ACCEPT_LEAD over the runner-up. `roblox_abi_targets.py` turns the
+matches into a profile with the same shape as the one
+`derive_roblox_host_abi_profile.py` writes, and `roblox_abi_check.py`
+compares the two on one update.
+"""
+
+from __future__ import annotations
+
+import bisect
+import collections
+from dataclasses import dataclass
+import difflib
+import importlib.util
+from pathlib import Path
+import sys
+from typing import Any, Callable, Sequence
+
+
+def _load_sibling(name: str, file_name: str):
+    if name in sys.modules:
+        return sys.modules[name]
+    path = Path(__file__).resolve().with_name(file_name)
+    specification = importlib.util.spec_from_file_location(name, path)
+    if specification is None or specification.loader is None:
+        raise RuntimeError(f"cannot load {file_name}")
+    module = importlib.util.module_from_spec(specification)
+    sys.modules[name] = module
+    specification.loader.exec_module(module)
+    return module
+
+
+INDEX = _load_sibling("mocktail_roblox_function_index", "roblox_function_index.py")
+TARGETS = _load_sibling("mocktail_roblox_abi_targets", "roblox_abi_targets.py")
+DERIVER = INDEX.DERIVER
+FunctionIndex = INDEX.FunctionIndex
+Instruction = INDEX.Instruction
+AnalyzerError = DERIVER.AnalyzerError
+format_rva = DERIVER.format_rva
+check_inputs = TARGETS.check_inputs
+validate_fmod_source = TARGETS.validate_fmod_source
+
+ACCEPT_SCORE = 0.6
+ACCEPT_LEAD = 0.2
+# Candidates that get the full, disassembling score after the cheap one.
+FULL_SCORE_LIMIT = 64
+# A data address used by more functions than this is too common to narrow
+# the candidates by itself.
+XREF_FANOUT_LIMIT = 64
+# Scores are float sums; a lead that equals ACCEPT_LEAD on paper may be
+# a few ulps short.
+_TOLERANCE = 1e-9
+
+
+def choose_candidate(
+    scored: Sequence[tuple[float, int]], tie_breaker: int | None = None
+) -> int | None:
+    """Returns the leading candidate, or None when no lead is clear.
+
+    `tie_breaker` picks among the candidates that clear ACCEPT_SCORE and sit
+    within ACCEPT_LEAD of the best; it cannot lift or overrule any other.
+    """
+    if not scored:
+        return None
+    ranked = sorted(scored, key=lambda item: item[0], reverse=True)
+    best_score, best = ranked[0]
+    runner_up = ranked[1][0] if len(ranked) > 1 else 0.0
+    if best_score >= ACCEPT_SCORE and best_score - runner_up >= ACCEPT_LEAD - _TOLERANCE:
+        return best
+    tied = {
+        rva for value, rva in ranked
+        if value >= ACCEPT_SCORE and best_score - value < ACCEPT_LEAD - _TOLERANCE
+    }
+    return tie_breaker if tie_breaker in tied else None
+
+
+def align_instructions(
+    reference_shapes: Sequence[str], candidate_shapes: Sequence[str]
+) -> dict[int, int]:
+    """Maps reference instruction indexes to candidate indexes of equal shape."""
+    matcher = difflib.SequenceMatcher(
+        None, reference_shapes, candidate_shapes, autojunk=False
+    )
+    mapping = {}
+    for block in matcher.get_matching_blocks():
+        for offset in range(block.size):
+            mapping[block.a + offset] = block.b + offset
+    return mapping
+
+
+@dataclass(frozen=True)
+class Match:
+    rva: int
+    score: float
+    lead: float
+    # "score" when the score alone decided, "vtable" when a slot broke a tie.
+    decided_by: str
+
+
+def _share(expected: Sequence[Any], present: set[Any]) -> float | None:
+    if not expected:
+        return None
+    return sum(1 for item in expected if item in present) / len(expected)
+
+
+def _weighted(parts: Sequence[tuple[float | None, float]]) -> float:
+    present = [(value, weight) for value, weight in parts if value is not None]
+    return sum(value * weight for value, weight in present) / sum(
+        weight for _, weight in present
+    )
+
+
+class Solver(TARGETS.TargetDerivation):
+    def __init__(self, reference: Any, candidate: Any, cache_dir: Path | None = None):
+        self._start(FunctionIndex(reference, cache_dir), FunctionIndex(candidate, cache_dir))
+
+    @classmethod
+    def from_indexes(cls, reference: Any, candidate: Any) -> "Solver":
+        solver = cls.__new__(cls)
+        solver._start(reference, candidate)
+        return solver
+
+    def _start(self, reference: Any, candidate: Any) -> None:
+        self.reference = reference
+        self.candidate = candidate
+        self.pairs: dict[int, int] = {}
+        self._owners: dict[int, int] = {}
+        for start, other in self._shape_anchors().items():
+            self._pair(start, other)
+        self._propagate_calls()
+        self.data_map = self._map_data_references()
+        self.matches: dict[str, Match] = {}
+        self._claimed: dict[int, int] = {}
+
+    def _pair(self, start: int, other: int) -> None:
+        """Pairs two functions, dropping any pair that held either one."""
+        owner = self._owners.get(other)
+        if owner is not None and owner != start:
+            del self.pairs[owner]
+        previous = self.pairs.get(start)
+        if previous is not None and previous != other:
+            del self._owners[previous]
+        self.pairs[start] = other
+        self._owners[other] = start
+
+    def _shape_anchors(self) -> dict[int, int]:
+        reference_hashes = collections.defaultdict(list)
+        candidate_hashes = collections.defaultdict(list)
+        for start, info in self.reference.functions.items():
+            reference_hashes[info.shape_hash].append(start)
+        for start, info in self.candidate.functions.items():
+            candidate_hashes[info.shape_hash].append(start)
+        pairs = {}
+        for shape_hash, starts in reference_hashes.items():
+            others = candidate_hashes.get(shape_hash, ())
+            if len(starts) == 1 and len(others) == 1:
+                pairs[starts[0]] = others[0]
+        return pairs
+
+    def _propagate_calls(self) -> None:
+        # Matched functions with as many calls pair their callees in order.
+        reference, candidate = self.reference.functions, self.candidate.functions
+        pending = list(self.pairs.items())
+        while pending:
+            discovered = []
+            for reference_start, candidate_start in pending:
+                reference_calls = reference[reference_start].calls
+                candidate_calls = candidate[candidate_start].calls
+                if len(reference_calls) != len(candidate_calls):
+                    continue
+                for callee, other in zip(reference_calls, candidate_calls):
+                    if (
+                        callee in self.pairs
+                        or other in self._owners
+                        or callee not in reference
+                        or other not in candidate
+                    ):
+                        continue
+                    size = reference[callee].size
+                    if abs(size - candidate[other].size) <= max(16, size // 4):
+                        self._pair(callee, other)
+                        discovered.append((callee, other))
+            pending = discovered
+
+    def _map_data_references(self) -> dict[int, int]:
+        votes: dict[int, collections.Counter] = collections.defaultdict(collections.Counter)
+        for reference_start, candidate_start in self.pairs.items():
+            reference_refs = self.reference.functions[reference_start].refs
+            candidate_refs = self.candidate.functions[candidate_start].refs
+            if len(reference_refs) == len(candidate_refs):
+                for reference_target, candidate_target in zip(reference_refs, candidate_refs):
+                    votes[reference_target][candidate_target] += 1
+        return {target: counter.most_common(1)[0][0] for target, counter in votes.items()}
+
+    def _gap_candidates(self, start: int) -> list[int]:
+        starts = self.reference.starts
+        index = bisect.bisect_left(starts, start)
+        below = next(
+            (self.pairs[starts[i]] for i in range(index - 1, -1, -1) if starts[i] in self.pairs),
+            self.candidate.text.address,
+        )
+        above = next(
+            (self.pairs[starts[i]] for i in range(index + 1, len(starts)) if starts[i] in self.pairs),
+            self.candidate.text.address + self.candidate.text.size,
+        )
+        if above <= below:
+            return []
+        low = bisect.bisect_left(self.candidate.starts, below)
+        high = bisect.bisect_right(self.candidate.starts, above)
+        return self.candidate.starts[low:high]
+
+    def _neighbour_candidates(self, start: int) -> set[int]:
+        found = set()
+        for callee in self.reference.functions[start].calls:
+            if callee in self.pairs:
+                found.update(self.candidate.callers.get(self.pairs[callee], ()))
+        for caller in self.reference.callers.get(start, ()):
+            if caller in self.pairs:
+                found.update(
+                    target
+                    for target in self.candidate.functions[self.pairs[caller]].calls
+                    if target in self.candidate.functions
+                )
+        return found
+
+    def _pattern_candidates(self, start: int) -> set[int]:
+        # Data a function touches usually moves as one block, so its
+        # references shifted by a mapped distance find it in the candidate.
+        refs = set(self.reference.functions[start].refs)
+        distances = collections.Counter(
+            self.data_map[target] - target for target in refs if target in self.data_map
+        )
+        # A common address adds a vote but cannot bring in a candidate alone.
+        votes = collections.Counter()
+        found_by_rare = set()
+        for target in refs:
+            users = set()
+            for distance, _ in distances.most_common(3):
+                found = self.candidate.data_users.get(target + distance, ())
+                users.update(found)
+                if len(found) <= XREF_FANOUT_LIMIT:
+                    found_by_rare.update(found)
+            votes.update(users)
+        needed = max(1, len(refs) // 2)
+        return {user for user in found_by_rare if votes[user] >= needed}
+
+    def _graph_score(self, start: int, other: int) -> float:
+        reference = self.reference.functions[start]
+        candidate = self.candidate.functions[other]
+        size = min(reference.size, candidate.size) / max(reference.size, candidate.size)
+        calls = [self.pairs[c] for c in reference.calls if c in self.pairs]
+        callers = [self.pairs[c] for c in self.reference.callers.get(start, ()) if c in self.pairs]
+        data = [self.data_map[t] for t in reference.refs if t in self.data_map]
+        return _weighted(
+            (
+                (size, 1.0),
+                (_share(calls, set(candidate.calls)), 2.0),
+                (_share(callers, set(self.candidate.callers.get(other, ()))), 2.0),
+                (_share(data, set(candidate.refs)), 2.0),
+            )
+        )
+
+    def _full_score(self, start: int, other: int, graph: float) -> float:
+        similarity = difflib.SequenceMatcher(
+            None, self.reference.shapes(start), self.candidate.shapes(other), autojunk=False
+        ).ratio()
+        strings = [
+            text
+            for text in map(self.reference.string_at, self.reference.functions[start].refs)
+            if text is not None
+        ]
+        candidate_strings = set(
+            map(self.candidate.string_at, self.candidate.functions[other].refs)
+        )
+        return _weighted(
+            (
+                (similarity, 3.0),
+                (_share(strings, candidate_strings), 2.0),
+                (graph, 5.0),
+            )
+        )
+
+    def match_function(
+        self,
+        name: str,
+        start: int,
+        contract: Callable[[Any, int], bool] | None = None,
+        vtable_slot: int | None = None,
+    ) -> int:
+        """Matches one reference function.
+
+        A contract drops candidates outright. `vtable_slot` is the candidate
+        that sits in the matching slot of an already located vtable; it only
+        breaks a tie between candidates that pass on their own evidence.
+        """
+        if start not in self.reference.functions:
+            raise AnalyzerError(f"reference {name} is not a function start")
+        if name in self.matches:
+            return self.matches[name].rva
+        candidates = set(self._gap_candidates(start))
+        candidates |= self._neighbour_candidates(start)
+        candidates |= self._pattern_candidates(start)
+        if start in self.pairs:
+            candidates.add(self.pairs[start])
+        if vtable_slot in self.candidate.functions:
+            candidates.add(vtable_slot)
+        size = self.reference.functions[start].size
+        candidates = {
+            other
+            for other in candidates
+            if self._claimed.get(other, start) == start
+            and self.candidate.functions[other].size <= 8 * size + 64
+            and (contract is None or contract(self.candidate.image, other))
+        }
+        graph = {other: self._graph_score(start, other) for other in candidates}
+        shortlist = sorted(candidates, key=graph.__getitem__, reverse=True)[:FULL_SCORE_LIMIT]
+        if vtable_slot in candidates and vtable_slot not in shortlist:
+            shortlist.append(vtable_slot)
+        scored = [(self._full_score(start, other, graph[other]), other) for other in shortlist]
+        chosen = choose_candidate(scored)
+        decided_by = "score"
+        if chosen is None and vtable_slot is not None:
+            chosen = choose_candidate(scored, tie_breaker=vtable_slot)
+            decided_by = "vtable"
+        if chosen is None:
+            ranked = sorted(scored, reverse=True)[:2]
+            raise AnalyzerError(
+                f"{name} has no clear candidate: "
+                + ", ".join(f"{format_rva(rva)}={value:.2f}" for value, rva in ranked)
+            )
+        chosen_score = next(value for value, other in scored if other == chosen)
+        runner_up = max((value for value, other in scored if other != chosen), default=0.0)
+        self.matches[name] = Match(chosen, chosen_score, chosen_score - runner_up, decided_by)
+        self._claimed[chosen] = start
+        self._pair(start, chosen)
+        return chosen
+
+    def _aligned(self, name: str, start: int) -> tuple[list[Instruction], list[Instruction], dict[int, int]]:
+        other = self.match_function(name, start)
+        reference = self.reference.instructions(start)
+        candidate = self.candidate.instructions(other)
+        mapping = align_instructions(
+            [item.shape for item in reference], [item.shape for item in candidate]
+        )
+        return reference, candidate, mapping
+
+    def map_instruction(self, name: str, rva: int) -> int:
+        start = self.reference.containing(rva)
+        if start is None:
+            raise AnalyzerError(f"reference {name} is outside every function")
+        reference, candidate, mapping = self._aligned(f"{name} function", start)
+        index = next((i for i, item in enumerate(reference) if item.address == rva), None)
+        if index is None or index not in mapping:
+            raise AnalyzerError(f"{name} instruction has no counterpart")
+        return candidate[mapping[index]].address
+
+    def map_data(self, name: str, function_name: str, start: int, target: int) -> int:
+        reference, candidate, mapping = self._aligned(function_name, start)
+        found = set()
+        for index, item in enumerate(reference):
+            if target not in item.rip_targets:
+                continue
+            if index not in mapping:
+                raise AnalyzerError(f"{name} reference instruction has no counterpart")
+            other = candidate[mapping[index]]
+            if len(other.rip_targets) != len(item.rip_targets):
+                raise AnalyzerError(f"{name} RIP-relative operand count changed")
+            found.update(
+                other.rip_targets[position]
+                for position, value in enumerate(item.rip_targets)
+                if value == target
+            )
+        if len(found) != 1:
+            raise AnalyzerError(f"{name} has no unique mapped data address")
+        return found.pop()
@@ -0,0 +1,375 @@
+#!/usr/bin/env python3
+# Copyright 2026 Mocktail Project Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""HostAbi targets that `roblox_abi_solver.py` derives from its matches.
+
+`TargetDerivation` turns matched functions into the HostAbi profile, the
+derivation anchors and the runtime compatibility block, in the shape that
+`derive_roblox_host_abi_profile.py` writes. It reuses the deriver's input
+checks, contracts and post-processing.
+"""
+
+from __future__ import annotations
+
+import importlib.util
+from pathlib import Path
+import sys
+from typing import Any, Callable
+
+
+def _load_index():
+    name = "mocktail_roblox_function_index"
+    if name in sys.modules:
+        return sys.modules[name]
+    path = Path(__file__).resolve().with_name("roblox_function_index.py")
+    specification = importlib.util.spec_from_file_location(name, path)
+    if specification is None or specification.loader is None:
+        raise RuntimeError("cannot load roblox_function_index.py")
+    module = importlib.util.module_from_spec(specification)
+    sys.modules[name] = module
+    specification.loader.exec_module(module)
+    return module
+
+
+DERIVER = _load_index().DERIVER
+AnalyzerError = DERIVER.AnalyzerError
+format_rva = DERIVER.format_rva
+FMOD_OUTPUT_FIELDS = DERIVER.FMOD_OUTPUT_FIELDS
+FMOD_INPUT_FIELDS = DERIVER.FMOD_INPUT_FIELDS
+fmod_slots = DERIVER.fmod_vtable_slots
+
+
+def check_inputs(reference: Any, candidate: Any, reference_sidecar: dict[str, Any]) -> None:
+    """Applies the deriver's identity and preflight checks to both builds."""
+    DERIVER.check_derivation_inputs(reference, candidate, reference_sidecar)
+
+
+def validate_fmod_source(source: Any) -> int:
+    """Checks a reference FMOD bridge the way the deriver does; returns its layout."""
+    if (
+        not isinstance(source, dict)
+        or not FMOD_OUTPUT_FIELDS <= source.keys()
+        or source.keys() - FMOD_OUTPUT_FIELDS - set(FMOD_INPUT_FIELDS) - {"vtable_layout_version"}
+    ):
+        raise AnalyzerError("reference FMOD output-device profile is incomplete")
+    present = [field for field in FMOD_INPUT_FIELDS if field in source]
+    if present and len(present) != len(FMOD_INPUT_FIELDS):
+        raise AnalyzerError("reference FMOD input profile is incomplete")
+    layout = source.get("vtable_layout_version", 1)
+    if type(layout) is not int or layout not in (1, 2):
+        raise AnalyzerError("reference FMOD vtable layout is unsupported")
+    return layout
+
+
+class TargetDerivation:
+    """Mixin for `Solver`: needs `reference`, `candidate`, `matches`,
+    `match_function`, `map_data` and `map_instruction`."""
+
+    def _check_registry_allocator(
+        self,
+        reference_registry: int,
+        candidate_registry: int,
+        reference_allocate: int,
+        candidate_allocate: int,
+    ) -> None:
+        # The registry initializer's tenth instruction calls the allocator bridge.
+        for index, start, allocate, side in (
+            (self.reference, reference_registry, reference_allocate, "reference"),
+            (self.candidate, candidate_registry, candidate_allocate, "candidate"),
+        ):
+            code = index.instructions(start)
+            if len(code) <= 9 or code[9].shape != "call" or code[9].branch_target != allocate:
+                raise AnalyzerError(
+                    f"{side} registry initializer does not call its allocator bridge"
+                )
+
+    def derive_profile(
+        self, reference_sidecar: dict[str, Any]
+    ) -> tuple[dict[str, Any], dict[str, Any]]:
+        reference_profile = reference_sidecar["profile"]
+        anchors = reference_sidecar["derivation_anchors"]
+        DERIVER.validate_profile_shape(reference_profile, anchors)
+        reference_image = self.reference.image
+        candidate_image = self.candidate.image
+        check_inputs(reference_image, candidate_image, reference_sidecar)
+        parse = DERIVER.parse_rva
+        bridges = []
+        found = {}
+        for entry in reference_profile["bridge_entries"]:
+            rva = self.match_function(entry["label"], parse(entry["rva"], entry["label"]))
+            found[entry["label"]] = rva
+            bridges.append({"rva": format_rva(rva), "kind": entry["kind"], "label": entry["label"]})
+
+        seeds = reference_profile["data_seeds"]
+        arena_initializer = parse(seeds["arena_initializer"], "arena initializer")
+        thread_initializer = parse(seeds["allocator_thread_initializer"], "thread initializer")
+        self.match_function("arena-initializer", arena_initializer)
+        self.match_function("allocator-thread-initializer", thread_initializer)
+
+        bootstrap = reference_profile["native_pre_jni_bootstrap"]
+        DERIVER.validate_reference_registry_slot(reference_image, bootstrap)
+        registry = self.match_function(
+            "registry-initializer", parse(bootstrap["registry_initializer"], "registry")
+        )
+        reference_allocate = parse(
+            DERIVER.bridge_map(reference_profile)["allocate"]["rva"], "reference allocate"
+        )
+        self._check_registry_allocator(
+            parse(bootstrap["registry_initializer"], "registry"),
+            registry, reference_allocate, found["allocate"],
+        )
+        registry_slot = DERIVER.derive_registry_slot(candidate_image, registry)
+
+        reference_init = reference_image.init_array_relocations()
+        candidate_init = candidate_image.init_array_relocations()
+        begin = DERIVER.LEADING_CONSTRUCTOR_BEGIN
+        count = DERIVER.LEADING_CONSTRUCTOR_COUNT
+        leading = candidate_init[begin : begin + count]
+        offsets = []
+        for index in range(begin, begin + count):
+            expected = parse(anchors["constructor_rvas"][str(index)], f"constructor {index}")
+            if reference_init[index] != expected:
+                raise AnalyzerError(f"reference constructor {index} differs from its anchor")
+            rva = self.match_function(f"constructor-{index}", expected)
+            if leading.count(rva) != 1:
+                raise AnalyzerError(f"constructor {index} left the leading constructors")
+            offsets.append(leading.index(rva))
+        if sorted(offsets) != list(range(count)):
+            raise AnalyzerError("leading constructors do not map one to one")
+
+        singleton = parse(anchors["jni_singleton_initializer_rva"], "JNI singleton")
+        jni_singleton = self.match_function("jni-singleton-initializer", singleton)
+        allocator_anchor = parse(anchors["allocator_object_initializer_rva"], "allocator anchor")
+        empty_anchor = parse(anchors["empty_string_initializer_rva"], "empty string anchor")
+        allocator_function = self.reference.containing(allocator_anchor)
+        empty_function = self.reference.containing(empty_anchor)
+        if allocator_function is None or empty_function is None:
+            raise AnalyzerError("reference anchor is outside every function")
+
+        slots = {
+            "allocator_object_slot": self.map_data(
+                "allocator object slot", "allocator-object-initializer function",
+                allocator_function, parse(seeds["allocator_object_slot"], "allocator slot"),
+            ),
+            "empty_string_slot": self.map_data(
+                "empty string slot", "empty-string-initializer function",
+                empty_function, parse(seeds["empty_string_slot"], "empty string slot"),
+            ),
+            "jni_singleton_slot": self.map_data(
+                "JNI singleton slot", "jni-singleton-initializer",
+                singleton, parse(seeds["jni_singleton_slot"], "JNI singleton slot"),
+            ),
+            "arena_guard_slot": self.map_data(
+                "arena guard slot", "arena-initializer",
+                arena_initializer, parse(seeds["arena_guard_slot"], "arena guard slot"),
+            ),
+            "arena_table_slot": self.map_data(
+                "arena table slot", "usable-size",
+                parse(DERIVER.bridge_map(reference_profile)["usable-size"]["rva"], "usable size"),
+                parse(seeds["arena_table_slot"], "arena table slot"),
+            ),
+        }
+        for slot in slots.values():
+            candidate_image.require_writable_rva(slot, 8)
+
+        candidate_count = len(candidate_init)
+        reference_count = reference_profile["init_array_count"]
+        boundary = reference_profile["native_mimalloc_thread_initializer_after_constructor"]
+        if not begin <= boundary < begin + count:
+            raise AnalyzerError("native allocator TLS boundary is no longer verified")
+        thread_boundary = begin + offsets[boundary - begin]
+        native_ranges = DERIVER.remapped_constructor_ranges(
+            reference_profile["native_mimalloc_constructor_run_ranges"],
+            offsets, reference_count, candidate_count,
+        )
+        if not any(item["begin"] <= thread_boundary < item["end_exclusive"] for item in native_ranges):
+            raise AnalyzerError("native allocator TLS boundary is no longer verified")
+        profile = {
+            "elf_build_id": candidate_image.build_id,
+            "bridge_entries": bridges,
+            "data_seeds": {
+                "allocator_object_slot": format_rva(slots["allocator_object_slot"]),
+                "empty_string_slot": format_rva(slots["empty_string_slot"]),
+                "jni_singleton_slot": format_rva(slots["jni_singleton_slot"]),
+                "jni_singleton_bytes": seeds["jni_singleton_bytes"],
+                "arena_initializer": format_rva(self.matches["arena-initializer"].rva),
+                "allocator_thread_initializer": format_rva(
+                    self.matches["allocator-thread-initializer"].rva
+                ),
+                "arena_guard_slot": format_rva(slots["arena_guard_slot"]),
+                "arena_table_slot": format_rva(slots["arena_table_slot"]),
+                "arena_table_slot_count": seeds["arena_table_slot_count"],
+            },
+            "native_allocator": {
+                "allocate": format_rva(found["allocate"]),
+                "deallocate": format_rva(found["free"]),
+            },
+            "init_array_offset": format_rva(candidate_image.sections[".init_array"].address),
+            "init_array_count": candidate_count,
+            "constructor_run_ranges": DERIVER.remapped_constructor_ranges(
+                reference_profile["constructor_run_ranges"],
+                offsets, reference_count, candidate_count,
+            ),
+            "native_mimalloc_constructor_run_ranges": native_ranges,
+            "native_mimalloc_thread_initializer_after_constructor": thread_boundary,
+            "native_pre_jni_bootstrap": {
+                "registry_initializer": format_rva(registry),
+                "registry_slot": format_rva(registry_slot),
+            },
+            "default_allocator_strategy": "native_mimalloc",
+        }
+        derived_anchors = {
+            "signature_version": 1,
+            "allocator_object_initializer_rva": format_rva(
+                self.map_instruction("allocator-object-initializer", allocator_anchor)
+            ),
+            "empty_string_initializer_rva": format_rva(
+                self.map_instruction("empty-string-initializer", empty_anchor)
+            ),
+            "jni_singleton_initializer_rva": format_rva(jni_singleton),
+            "constructor_rvas": {
+                str(index): format_rva(candidate_init[index])
+                for index in range(begin, begin + count)
+            },
+        }
+        DERIVER.validate_profile_shape(profile, derived_anchors)
+        return profile, derived_anchors
+
+    def derive_runtime_compatibility(self, source: dict[str, Any]) -> dict[str, Any]:
+        result: dict[str, Any] = {}
+        fullscreen = source.get("user_game_settings_fullscreen_setter_rva")
+        if fullscreen is not None:
+            reference_setter = DERIVER.parse_rva(fullscreen, "fullscreen setter")
+            if not DERIVER.has_fullscreen_setter_contract(self.reference.image, reference_setter):
+                raise AnalyzerError("reference fullscreen setter contract changed")
+            setter = self.match_function(
+                "fullscreen-setter", reference_setter, DERIVER.has_fullscreen_setter_contract
+            )
+            result["user_game_settings_fullscreen_setter_rva"] = format_rva(setter)
+        fmod = source.get("fmod_output_device_bridge")
+        if fmod is not None:
+            result["fmod_output_device_bridge"] = self._derive_fmod_bridge(fmod)
+        return result
+
+    def _derive_fmod_bridge(self, source: dict[str, Any]) -> dict[str, Any]:
+        layout = validate_fmod_source(source)
+        has_input = FMOD_INPUT_FIELDS[0] in source
+        slots = fmod_slots(layout, has_input)
+        parse = DERIVER.parse_rva
+        vtable = parse(source["vtable_rva"], "FMOD vtable")
+        reference_relocations = DERIVER.relative_relocation_map(self.reference.image)
+        methods = {}
+        unresolved = []
+        for field, slot in slots.items():
+            method = parse(source[field], field)
+            if reference_relocations.get(vtable + slot * 8) != method:
+                raise AnalyzerError("reference FMOD vtable does not match its methods")
+            try:
+                methods[field] = self.match_function(
+                    f"fmod-{field}", method, self._fmod_contract(layout, field)
+                )
+            except AnalyzerError:
+                unresolved.append(field)
+        string_constructor = parse(source["string_constructor_rva"], "FMOD string constructor")
+        if not DERIVER.has_fmod_string_constructor_contract(self.reference.image, string_constructor):
+            raise AnalyzerError("reference FMOD string constructor contract changed")
+        candidate_string_constructor = self.match_function(
+            "fmod-string-constructor",
+            string_constructor,
+            DERIVER.has_fmod_string_constructor_contract,
+        )
+
+        relocations = DERIVER.relative_relocation_map(self.candidate.image)
+        located = self._locate_fmod_vtables(relocations, methods)
+        vtables = sorted({vtable for vtable, _ in located})
+        if len(vtables) != 1:
+            raise AnalyzerError(f"FMOD output vtable matched {len(vtables)} candidate locations")
+        # The located vtable breaks ties for the methods that did not resolve.
+        # Count and info share slots 5 and 6 in both layouts, so the vtable can
+        # fit both; exactly one layout must then hold every method.
+        solutions = []
+        for located_vtable, target_layout in located:
+            target_slots = fmod_slots(target_layout, has_input)
+            resolved = dict(methods)
+            try:
+                for field in unresolved:
+                    resolved[field] = self.match_function(
+                        f"fmod-{field}",
+                        parse(source[field], field),
+                        self._fmod_contract(target_layout, field),
+                        relocations.get(located_vtable + target_slots[field] * 8),
+                    )
+            except AnalyzerError:
+                continue
+            if self._locate_fmod_vtables(relocations, resolved) != [
+                (located_vtable, target_layout)
+            ]:
+                continue
+            if target_layout == 2 and not DERIVER.has_fmod_device_lists_select_contract(
+                self.candidate.image, resolved["select_method_rva"]
+            ):
+                continue
+            solutions.append((located_vtable, target_layout, target_slots, resolved))
+        if len(solutions) != 1:
+            raise AnalyzerError(f"FMOD output vtable holds every method in {len(solutions)} layouts")
+        located_vtable, target_layout, target_slots, methods = solutions[0]
+        self.candidate.image.require_relro_rva(
+            located_vtable, (max(target_slots.values()) + 1) * 8
+        )
+        result = {"vtable_rva": format_rva(located_vtable)}
+        result["string_constructor_rva"] = format_rva(candidate_string_constructor)
+        result.update((field, format_rva(rva)) for field, rva in methods.items())
+        if target_layout != 1:
+            result["vtable_layout_version"] = target_layout
+        return result
+
+    @staticmethod
+    def _fmod_contract(layout: int, field: str) -> Callable[[Any, int], bool] | None:
+        if layout == 2 and field == "select_method_rva":
+            return DERIVER.has_fmod_device_lists_select_contract
+        return None
+
+    @staticmethod
+    def _locate_fmod_vtables(
+        relocations: dict[int, int], methods: dict[str, int]
+    ) -> list[tuple[int, int]]:
+        """Returns (vtable, layout) for each vtable holding every method."""
+        located = []
+        for layout in (1, 2):
+            slots = fmod_slots(layout, True)
+            held = {slots[field]: rva for field, rva in methods.items()}
+            located.extend(
+                (vtable, layout)
+                for vtable in TargetDerivation._vtables_holding(relocations, held)
+            )
+        return sorted(located)
+
+    @staticmethod
+    def _vtables_holding(relocations: dict[int, int], methods: dict[int, int]) -> list[int]:
+        """Returns every vtable whose slots hold all of `methods`."""
+        if not methods:
+            raise AnalyzerError("no vtable method was matched")
+        slot, method = next(iter(methods.items()))
+        return sorted(
+            offset - slot * 8
+            for offset, value in relocations.items()
+            if value == method
+            and offset >= slot * 8
+            and (offset - slot * 8) % 8 == 0
+            and all(
+                relocations.get(offset - slot * 8 + index * 8) == rva
+                for index, rva in methods.items()
+            )
+        )
@@ -0,0 +1,291 @@
+#!/usr/bin/env python3
+# Copyright 2026 Mocktail Project Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Function index of one libroblox image for `roblox_abi_solver.py`.
+
+Every function listed in `.eh_frame_hdr` is decoded once and reduced to a
+normalized instruction shape, its direct calls and its RIP-relative data
+references. Shapes drop branch targets, RIP displacements and immediates of
+0x1000 and above, so a function moved by the linker keeps its shape.
+"""
+
+from __future__ import annotations
+
+import bisect
+import collections
+from dataclasses import dataclass
+import gzip
+import hashlib
+import importlib.util
+import json
+import os
+from pathlib import Path
+import re
+import struct
+import sys
+import tempfile
+from typing import Any
+
+
+def _load_deriver():
+    name = "mocktail_host_abi_deriver_for_solver"
+    if name in sys.modules:
+        return sys.modules[name]
+    path = Path(__file__).resolve().with_name("derive_roblox_host_abi_profile.py")
+    specification = importlib.util.spec_from_file_location(name, path)
+    if specification is None or specification.loader is None:
+        raise RuntimeError("cannot load the HostAbi deriver")
+    module = importlib.util.module_from_spec(specification)
+    sys.modules[name] = module
+    specification.loader.exec_module(module)
+    return module
+
+
+DERIVER = _load_deriver()
+AnalyzerError = DERIVER.AnalyzerError
+
+_RIP_OPERAND = re.compile(r"\[rip ([+-]) (0x[0-9a-f]+|\d+)\]")
+_IMMEDIATE = re.compile(r"0x[0-9a-f]+|\b\d+\b")
+# Smaller immediates are offsets and flags that stay put between builds.
+# Larger ones are addresses and sizes that move.
+_STABLE_IMMEDIATE_LIMIT = 0x1000
+
+
+def _stable_immediate(match: re.Match) -> str:
+    return "I" if int(match.group(0), 0) >= _STABLE_IMMEDIATE_LIMIT else match.group(0)
+
+
+@dataclass(frozen=True)
+class Instruction:
+    address: int
+    shape: str
+    rip_targets: tuple[int, ...]
+    branch_target: int | None
+
+
+def decode_function(
+    decoder: Any, code: bytes, start: int
+) -> list[Instruction]:
+    end = start + len(code)
+    instructions = []
+    for address, size, mnemonic, operands in decoder.disasm_lite(code, start):
+        if (mnemonic == "call" or mnemonic.startswith("j")) and operands.startswith("0x"):
+            target = int(operands, 16)
+            if mnemonic == "call":
+                shape = "call"
+            else:
+                shape = mnemonic + (" in" if start <= target < end else " out")
+            instructions.append(Instruction(address, shape, (), target))
+            continue
+        rip_targets = []
+        for match in _RIP_OPERAND.finditer(operands):
+            displacement = int(match.group(2), 0)
+            rip_targets.append(
+                address + size + (-displacement if match.group(1) == "-" else displacement)
+            )
+        operands = _IMMEDIATE.sub(_stable_immediate, _RIP_OPERAND.sub("[rip]", operands))
+        instructions.append(
+            Instruction(address, f"{mnemonic} {operands}", tuple(rip_targets), None)
+        )
+    return instructions
+
+
+@dataclass(frozen=True)
+class FunctionInfo:
+    size: int
+    shape_hash: bytes
+    calls: tuple[int, ...]
+    refs: tuple[int, ...]
+
+
+def function_table(image: Any) -> list[tuple[int, int]]:
+    """Returns (start, size) for every FDE indexed by `.eh_frame_hdr`."""
+    header = image.sections.get(".eh_frame_hdr")
+    if header is None:
+        raise AnalyzerError("libroblox has no .eh_frame_hdr")
+    raw = image.section_bytes(header)
+    # Version 1, a 4-byte eh_frame_ptr, udata4 count, datarel sdata4 table.
+    if len(raw) < 12 or raw[0] != 1 or raw[2] != 0x03 or raw[3] != 0x3B:
+        raise AnalyzerError(".eh_frame_hdr uses an unsupported encoding")
+    if raw[1] == 0xFF or raw[1] & 0x0F not in (0x03, 0x0B):
+        raise AnalyzerError(".eh_frame_hdr eh_frame_ptr encoding is not 4 bytes")
+    count = struct.unpack_from("<I", raw, 8)[0]
+    if 12 + count * 8 > len(raw):
+        raise AnalyzerError(".eh_frame_hdr table exceeds its section")
+    table = []
+    for index in range(count):
+        location, fde = struct.unpack_from("<ii", raw, 12 + index * 8)
+        start = header.address + location
+        fde_rva = header.address + fde
+        offset = image.rva_to_offset(fde_rva, 16)
+        length, _, begin, size = struct.unpack_from("<IIiI", image.data, offset)
+        # An FDE starts with its length, CIE pointer, then a pcrel sdata4
+        # pc_begin and its udata4 range.
+        if length == 0xFFFFFFFF or fde_rva + 8 + begin != start:
+            raise AnalyzerError(".eh_frame FDE does not match its index entry")
+        table.append((start, size))
+    table.sort()
+    return table
+
+
+_SOURCE_DIGEST = hashlib.sha256(Path(__file__).read_bytes()).hexdigest()[:16]
+
+
+def cache_path(cache_dir: Path, library_sha256: str) -> Path:
+    """Cache file for one library; shapes depend on this code and capstone."""
+    version = getattr(DERIVER.capstone, "__version__", "unknown")
+    return cache_dir / f"{library_sha256}-{_SOURCE_DIGEST}-capstone{version}.json.gz"
+
+
+def link_functions(
+    functions: dict[int, FunctionInfo],
+) -> tuple[dict[int, list[int]], dict[int, list[int]]]:
+    """Returns each function's callers and each data address's users, once each."""
+    callers: dict[int, list[int]] = collections.defaultdict(list)
+    data_users: dict[int, list[int]] = collections.defaultdict(list)
+    for start, info in functions.items():
+        for target in dict.fromkeys(info.calls):
+            if target in functions:
+                callers[target].append(start)
+        for target in dict.fromkeys(info.refs):
+            data_users[target].append(start)
+    return callers, data_users
+
+
+def _int_list(value: Any) -> tuple[int, ...]:
+    if not isinstance(value, list) or not all(type(item) is int for item in value):
+        raise ValueError("cached index entry is malformed")
+    return tuple(value)
+
+
+def _read_cache(path: Path) -> dict[int, FunctionInfo] | None:
+    """Returns the cached functions, or None when the file is missing or bad."""
+    try:
+        with gzip.open(path, "rt", encoding="utf-8") as stream:
+            entries = json.load(stream)
+        if not isinstance(entries, list) or not entries:
+            raise ValueError("cached index is empty")
+        functions = {}
+        for entry in entries:
+            start, size, shape_hash, calls, refs = entry
+            if type(start) is not int or type(size) is not int:
+                raise ValueError("cached index entry is malformed")
+            functions[start] = FunctionInfo(
+                size, bytes.fromhex(shape_hash), _int_list(calls), _int_list(refs)
+            )
+        return functions
+    except (OSError, EOFError, ValueError, TypeError):
+        return None
+
+
+def _write_cache(path: Path, functions: dict[int, FunctionInfo]) -> None:
+    # A cache that cannot be written only costs the next run a rebuild.
+    entries = [
+        [start, info.size, info.shape_hash.hex(), list(info.calls), list(info.refs)]
+        for start, info in functions.items()
+    ]
+    try:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        descriptor, temporary = tempfile.mkstemp(dir=path.parent, suffix=".tmp")
+    except OSError:
+        return
+    try:
+        with os.fdopen(descriptor, "wb") as raw, gzip.open(raw, "wt", encoding="utf-8") as stream:
+            json.dump(entries, stream, separators=(",", ":"))
+        os.replace(temporary, path)
+    except OSError:
+        Path(temporary).unlink(missing_ok=True)
+
+
+class FunctionIndex:
+    """Normalized shapes, calls and data references of every function.
+
+    With `cache_dir`, the per-function data is kept in a file named after the
+    library's SHA-256, this module's source and the capstone version, and read
+    back instead of decoding the library again.
+    """
+
+    def __init__(self, image: Any, cache_dir: Path | None = None):
+        DERIVER.require_capstone()
+        self.image = image
+        self.decoder = DERIVER.capstone.Cs(
+            DERIVER.capstone.CS_ARCH_X86, DERIVER.capstone.CS_MODE_64
+        )
+        self.text = image.sections[".text"]
+        self._decoded: dict[int, list[Instruction]] = {}
+        path = None if cache_dir is None else cache_path(Path(cache_dir), image.sha256)
+        functions = None if path is None else _read_cache(path)
+        if functions is None:
+            functions = self._decode_all()
+            if path is not None:
+                _write_cache(path, functions)
+        self.functions = functions
+        self.starts = sorted(self.functions)
+        self.callers, self.data_users = link_functions(self.functions)
+
+    def _decode_all(self) -> dict[int, FunctionInfo]:
+        text_end = self.text.address + self.text.size
+        functions = {}
+        for start, size in function_table(self.image):
+            if size == 0 or not self.text.address <= start < text_end:
+                continue
+            instructions = self.instructions(start, size, cache=False)
+            shape_hash = hashlib.blake2b(
+                "\n".join(item.shape for item in instructions).encode(), digest_size=8
+            ).digest()
+            calls = tuple(
+                item.branch_target
+                for item in instructions
+                if item.branch_target is not None
+                and (item.shape == "call" or item.shape.endswith(" out"))
+            )
+            refs = tuple(target for item in instructions for target in item.rip_targets)
+            functions[start] = FunctionInfo(size, shape_hash, calls, refs)
+        return functions
+
+    def instructions(
+        self, start: int, size: int | None = None, cache: bool = True
+    ) -> list[Instruction]:
+        if cache and start in self._decoded:
+            return self._decoded[start]
+        if size is None:
+            size = self.functions[start].size
+        offset = self.text.offset + start - self.text.address
+        decoded = decode_function(self.decoder, self.image.data[offset : offset + size], start)
+        if cache:
+            self._decoded[start] = decoded
+        return decoded
+
+    def shapes(self, start: int) -> list[str]:
+        # Scoring reads each candidate once; only aligned functions stay cached.
+        return [item.shape for item in self.instructions(start, cache=start in self._decoded)]
+
+    def containing(self, rva: int) -> int | None:
+        index = bisect.bisect_right(self.starts, rva) - 1
+        if index < 0:
+            return None
+        start = self.starts[index]
+        return start if rva < start + self.functions[start].size else None
+
+    def string_at(self, rva: int) -> bytes | None:
+        segment = self.image.segment_for_rva(rva)
+        if segment is None or not segment.contains_file_data(rva):
+            return None
+        offset = self.image.rva_to_offset(rva)
+        raw = self.image.data[offset : offset + 96]
+        end = raw.find(b"\0")
+        if end < 4 or not all(32 <= byte < 127 for byte in raw[:end]):
+            return None
+        return raw[:end]
@@ -5,52 +5,132 @@
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <meta name="color-scheme" content="dark">
-  <title>Nightcap for Linux</title>
+  <title>Nightcap: Roblox on Linux</title>
+  <meta name="description" content="Roblox on Linux, tuned for desktop play. A Mocktail fork that keeps up with Roblox updates, with extra bug fixes, custom assets and more.">
+  <meta name="google-site-verification" content="vznL8W2txRlmfwhGg7ZBPSxQaPV9OtaIUoYPvmd9aUA">
+  <link rel="canonical" href="https://coderdayton.github.io/nightcap/">
  <link rel="icon" href="nightcap.svg" type="image/svg+xml">
+  <meta property="og:type" content="website">
+  <meta property="og:site_name" content="Nightcap">
+  <meta property="og:title" content="Nightcap: Roblox on Linux">
+  <meta property="og:description" content="Roblox on Linux, tuned for desktop play. A Mocktail fork that keeps up with Roblox updates, with extra bug fixes, custom assets and more.">
+  <meta property="og:url" content="https://coderdayton.github.io/nightcap/">
+  <meta property="og:image" content="https://coderdayton.github.io/nightcap/preview.png">
+  <meta property="og:image:alt" content="Roblox running on Linux with Nightcap">
+  <meta name="twitter:card" content="summary_large_image">
+  <script type="application/ld+json">
+  {
+    "@context": "https://schema.org",
+    "@type": "SoftwareApplication",
+    "name": "Nightcap",
+    "description": "Roblox on Linux, tuned for desktop play. A Mocktail fork that keeps up with Roblox updates, with extra bug fixes, custom assets and more.",
+    "applicationCategory": "GameApplication",
+    "operatingSystem": "Linux",
+    "url": "https://coderdayton.github.io/nightcap/",
+    "downloadUrl": "https://github.com/CoderDayton/nightcap/releases/latest",
+    "license": "https://www.apache.org/licenses/LICENSE-2.0",
+    "offers": { "@type": "Offer", "price": "0", "priceCurrency": "USD" }
+  }
+  </script>
  <link rel="stylesheet" href="styles.css">
 </head>
-<body><main>
-  <img src="nightcap.svg" alt="Nightcap logo">
-  <h1>Nightcap</h1>
-  <p>Play Roblox on Linux like it was made for your PC. Nightcap is Mocktail, tuned to feel fast and look sharp.</p>
-  <a class="button" href="https://github.com/CoderDayton/nightcap/releases/latest/download/Nightcap-x86_64.AppImage">Download AppImage</a>
-  <a class="button secondary" href="nightcap.flatpakref">Install with Flatpak</a>
-  <div class="commands">
-    <p>AppImage</p>
-    <code>chmod +x Nightcap-x86_64.AppImage
-./Nightcap-x86_64.AppImage</code>
-    <p>Flatpak</p>
-    <code>flatpak install --user https://coderdayton.github.io/nightcap/nightcap.flatpakref
-flatpak run io.github.CoderDayton.nightcap</code>
-    <p>DEB, RPM and pacman</p>
-    <code>sudo apt install ./nightcap_&lt;version&gt;-1_amd64.deb
+<body>
+  <header class="hero">
+    <div class="wrap">
+      <p class="top">
+        <a href="https://github.com/CoderDayton/nightcap" aria-label="Nightcap on GitHub" title="GitHub"><svg viewBox="0 0 16 16" width="24" height="24" aria-hidden="true"><path fill="currentColor" d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/></svg></a>
+        <a href="https://discord.gg/DbAUG9hBFU" aria-label="Nightcap on Discord" title="Discord"><svg viewBox="0 0 24 24" width="24" height="24" aria-hidden="true"><path fill="currentColor" d="M20.317 4.3698a19.7913 19.7913 0 00-4.8851-1.5152.0741.0741 0 00-.0785.0371c-.211.3753-.4447.8648-.6083 1.2495-1.8447-.2762-3.68-.2762-5.4868 0-.1636-.3933-.4058-.8742-.6177-1.2495a.077.077 0 00-.0785-.037 19.7363 19.7363 0 00-4.8852 1.515.0699.0699 0 00-.0321.0277C.5334 9.0458-.319 13.5799.0992 18.0578a.0824.0824 0 00.0312.0561c2.0528 1.5076 4.0413 2.4228 5.9929 3.0294a.0777.0777 0 00.0842-.0276c.4616-.6304.8731-1.2952 1.226-1.9942a.076.076 0 00-.0416-.1057c-.6528-.2476-1.2743-.5495-1.8722-.8923a.077.077 0 01-.0076-.1277c.1258-.0943.2517-.1923.3718-.2914a.0743.0743 0 01.0776-.0105c3.9278 1.7933 8.18 1.7933 12.0614 0a.0739.0739 0 01.0785.0095c.1202.099.246.1981.3728.2924a.077.077 0 01-.0066.1276 12.2986 12.2986 0 01-1.873.8914.0766.0766 0 00-.0407.1067c.3604.698.7719 1.3628 1.225 1.9932a.076.076 0 00.0842.0286c1.961-.6067 3.9495-1.5219 6.0023-3.0294a.077.077 0 00.0313-.0552c.5004-5.177-.8382-9.6739-3.5485-13.6604a.061.061 0 00-.0312-.0286zM8.02 15.3312c-1.1825 0-2.1569-1.0857-2.1569-2.419 0-1.3332.9555-2.4189 2.157-2.4189 1.2108 0 2.1757 1.0952 2.1568 2.419 0 1.3332-.9555 2.4189-2.1569 2.4189zm7.9748 0c-1.1825 0-2.1569-1.0857-2.1569-2.419 0-1.3332.9554-2.4189 2.1569-2.4189 1.2108 0 2.1757 1.0952 2.1568 2.419 0 1.3332-.946 2.4189-2.1568 2.4189z"/></svg></a>
+      </p>
+      <p class="eyebrow">Roblox on Linux, tuned for desktop play</p>
+      <h1><img src="nightcap.svg" alt=""><span>Nightcap</span></h1>
+      <p class="lede">A Mocktail fork that keeps up with Roblox updates, with extra bug fixes, custom assets and more.</p>
+      <p class="actions">
+        <a class="button" href="https://github.com/CoderDayton/nightcap/releases/latest/download/Nightcap-x86_64.AppImage">Download AppImage</a>
+        <a class="button secondary" href="nightcap.flatpakref">Install with Flatpak</a>
+      </p>
+    </div>
+  </header>
+
+  <main class="wrap">
+    <section class="row stacked">
+      <h2>Install</h2>
+      <dl class="body install">
+        <dt>AppImage</dt>
+        <dd><pre><code>chmod +x Nightcap-x86_64.AppImage
+./Nightcap-x86_64.AppImage</code></pre></dd>
+        <dt>Flatpak</dt>
+        <dd><pre><code>flatpak install --user https://coderdayton.github.io/nightcap/nightcap.flatpakref
+flatpak run io.github.CoderDayton.nightcap</code></pre></dd>
+        <dt>DEB, RPM, pacman</dt>
+        <dd><pre><code>sudo apt install ./nightcap_&lt;version&gt;-1_amd64.deb
 sudo dnf install ./nightcap-&lt;version&gt;-1.x86_64.rpm
-sudo pacman -U nightcap-&lt;version&gt;-1-x86_64.pkg.tar.zst</code>
-    <p>Build from source</p>
-    <code>git clone --recurse-submodules https://github.com/CoderDayton/nightcap.git
+sudo pacman -U nightcap-&lt;version&gt;-1-x86_64.pkg.tar.zst</code></pre></dd>
+        <dt>Source</dt>
+        <dd><pre><code>git clone --recurse-submodules https://github.com/CoderDayton/nightcap.git
 cd nightcap &amp;&amp; make build
-./build/mocktail</code>
-  </div>
-  <h2>What's different</h2>
-  <ul>
-    <li>Lower input lag. Frames are shown as soon as they are ready.</li>
-    <li>Sharper textures, with your own PNG overrides if you want them.</li>
-    <li>ETC2 textures render correctly on desktop GPUs.</li>
-    <li>No more error 319 kicks after joining a server.</li>
-    <li>Roblox sees your real RAM and screen size.</li>
-  </ul>
-  <h2>Direct downloads</h2>
-  <p>Prebuilt builds for Linux x86_64.</p>
-  <p class="links">
-    <a href="https://github.com/CoderDayton/nightcap/releases/latest/download/Nightcap-x86_64.AppImage">AppImage</a>
-    <a href="Nightcap-x86_64.flatpak">Flatpak bundle</a>
-    <a href="https://github.com/CoderDayton/nightcap/releases/latest">DEB, RPM, pacman</a>
-    <a href="nightcap-flatpak.gpg">Signing key</a>
-    <a href="terms.html">Terms</a>
-    <a href="privacy.html">Privacy</a>
-  </p>
-  <p><a class="source" href="https://github.com/CoderDayton/nightcap">Source code</a> ·
-     <a class="source" href="https://github.com/komaruworld/mocktail">Upstream Mocktail</a></p>
-  <p>Nightcap is an independent community project and is not affiliated with Roblox Corporation.</p>
-</main></body>
+./build/mocktail</code></pre></dd>
+      </dl>
+    </section>
+
+    <section class="row">
+      <h2>What's different</h2>
+      <dl class="body facts">
+        <dt>Roblox updates</dt>
+        <dd>New Roblox versions work soon after they come out.</dd>
+        <dt>More games</dt>
+        <dd>Answers a server check some experiences use, so you can play those too.</dd>
+        <dt>Voice chat</dt>
+        <dd>Your microphone still works after a Roblox update.</dd>
+        <dt>Login</dt>
+        <dd>Verification checks and captchas finish instead of hanging.</dd>
+        <dt>Look</dt>
+        <dd>The new home screen and side menu, like on Windows.</dd>
+        <dt>Your own assets</dt>
+        <dd>Drop in your own cursors, fonts and skies. The folder layout matches Sober's.</dd>
+        <dt>Mouse and CPU</dt>
+        <dd>Optional raw mouse input, and less CPU use while idle.</dd>
+      </dl>
+    </section>
+
+    <section class="row">
+      <h2>Direct downloads</h2>
+      <div class="body">
+        <p>Prebuilt builds for Linux x86_64.</p>
+        <ul class="links">
+          <li><a href="https://github.com/CoderDayton/nightcap/releases/latest/download/Nightcap-x86_64.AppImage"><span class="name">AppImage</span><span class="file">Nightcap-x86_64.AppImage</span><span class="go" aria-hidden="true">↓</span></a></li>
+          <li><a href="Nightcap-x86_64.flatpak"><span class="name">Flatpak bundle</span><span class="file">Nightcap-x86_64.flatpak</span><span class="go" aria-hidden="true">↓</span></a></li>
+          <li><a href="https://github.com/CoderDayton/nightcap/releases/latest"><span class="name">DEB, RPM, pacman</span><span class="file">GitHub releases page</span><span class="go" aria-hidden="true">↗</span></a></li>
+          <li><a href="nightcap-flatpak.gpg"><span class="name">Signing key</span><span class="file">nightcap-flatpak.gpg</span><span class="go" aria-hidden="true">↓</span></a></li>
+        </ul>
+      </div>
+    </section>
+  </main>
+
+  <footer class="wrap foot">
+    <p>
+      <a href="https://github.com/CoderDayton/nightcap">Source code</a> ·
+      <a href="https://github.com/komaruworld/mocktail">Upstream Mocktail</a> ·
+      <a href="terms.html">Terms</a> ·
+      <a href="privacy.html">Privacy</a>
+    </p>
+    <p>Nightcap is an independent community project and is not affiliated with Roblox Corporation.</p>
+  </footer>
+
+  <script>
+    // Adds a copy button to each command block. The page works without it.
+    document.querySelectorAll('.install dd').forEach(function (block) {
+      var button = document.createElement('button');
+      button.type = 'button';
+      button.textContent = 'copy';
+      button.addEventListener('click', function () {
+        if (!navigator.clipboard) return;
+        navigator.clipboard.writeText(block.querySelector('code').textContent).then(function () {
+          button.textContent = 'copied';
+          setTimeout(function () { button.textContent = 'copy'; }, 1600);
+        });
+      });
+      block.appendChild(button);
+    });
+  </script>
+</body>
 </html>
@@ -8,36 +8,46 @@
  <link rel="icon" href="nightcap.svg" type="image/svg+xml">
  <link rel="stylesheet" href="styles.css">
 </head>
-<body><main>
-  <h1>Privacy Policy</h1>
-  <p>Nightcap is a Linux runtime for the Roblox Android client. This policy covers Nightcap itself and its Discord application. Roblox and Discord have their own policies for the data they handle.</p>
+<body>
+  <header class="wrap bar">
+    <a class="brand" href="index.html"><img src="nightcap.svg" alt="" width="30" height="30"><span>Nightcap</span></a>
+    <p class="top">
+      <a href="https://github.com/CoderDayton/nightcap" aria-label="Nightcap on GitHub" title="GitHub"><svg viewBox="0 0 16 16" width="24" height="24" aria-hidden="true"><path fill="currentColor" d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/></svg></a>
+      <a href="https://discord.gg/DbAUG9hBFU" aria-label="Nightcap on Discord" title="Discord"><svg viewBox="0 0 24 24" width="24" height="24" aria-hidden="true"><path fill="currentColor" d="M20.317 4.3698a19.7913 19.7913 0 00-4.8851-1.5152.0741.0741 0 00-.0785.0371c-.211.3753-.4447.8648-.6083 1.2495-1.8447-.2762-3.68-.2762-5.4868 0-.1636-.3933-.4058-.8742-.6177-1.2495a.077.077 0 00-.0785-.037 19.7363 19.7363 0 00-4.8852 1.515.0699.0699 0 00-.0321.0277C.5334 9.0458-.319 13.5799.0992 18.0578a.0824.0824 0 00.0312.0561c2.0528 1.5076 4.0413 2.4228 5.9929 3.0294a.0777.0777 0 00.0842-.0276c.4616-.6304.8731-1.2952 1.226-1.9942a.076.076 0 00-.0416-.1057c-.6528-.2476-1.2743-.5495-1.8722-.8923a.077.077 0 01-.0076-.1277c.1258-.0943.2517-.1923.3718-.2914a.0743.0743 0 01.0776-.0105c3.9278 1.7933 8.18 1.7933 12.0614 0a.0739.0739 0 01.0785.0095c.1202.099.246.1981.3728.2924a.077.077 0 01-.0066.1276 12.2986 12.2986 0 01-1.873.8914.0766.0766 0 00-.0407.1067c.3604.698.7719 1.3628 1.225 1.9932a.076.076 0 00.0842.0286c1.961-.6067 3.9495-1.5219 6.0023-3.0294a.077.077 0 00.0313-.0552c.5004-5.177-.8382-9.6739-3.5485-13.6604a.061.061 0 00-.0312-.0286zM8.02 15.3312c-1.1825 0-2.1569-1.0857-2.1569-2.419 0-1.3332.9555-2.4189 2.157-2.4189 1.2108 0 2.1757 1.0952 2.1568 2.419 0 1.3332-.9555 2.4189-2.1569 2.4189zm7.9748 0c-1.1825 0-2.1569-1.0857-2.1569-2.419 0-1.3332.9554-2.4189 2.1569-2.4189 1.2108 0 2.1757 1.0952 2.1568 2.419 0 1.3332-.946 2.4189-2.1568 2.4189z"/></svg></a>
+    </p>
+  </header>

-  <h2>What Nightcap collects</h2>
-  <p>Nothing. Nightcap has no server. It does not collect, store, or send telemetry, analytics, crash reports, or account data to the Nightcap project.</p>
+  <main class="wrap prose">
+    <h1>Privacy Policy</h1>
+    <p>Nightcap is a Linux runtime for the Roblox Android client. This policy covers Nightcap itself and its Discord application. Roblox and Discord have their own policies for the data they handle.</p>

-  <h2>What stays on your machine</h2>
-  <ul>
-    <li>Configuration in <code>~/.config/mocktail/</code></li>
-    <li>Session logs and support bundles in <code>~/.local/state/mocktail/</code></li>
-    <li>Roblox login session under <code>~/.local/share/mocktail/</code></li>
-    <li>Roblox cache, downloaded payloads, and shader cache under <code>~/.cache/mocktail/</code></li>
-  </ul>
-  <p>Flatpak installs keep the same layout under <code>~/.var/app/io.github.CoderDayton.nightcap/</code>.</p>
+    <h2>What Nightcap collects</h2>
+    <p>Nothing. Nightcap has no server. It does not collect, store, or send telemetry, analytics, crash reports, or account data to the Nightcap project.</p>

-  <h2>Discord Rich Presence</h2>
-  <p>When Rich Presence is on, Nightcap sends the current experience name, its public icon URL, elapsed time, and an optional public server join code to the Discord desktop client on the same machine over a local socket. Discord displays this on your profile under its own privacy settings. Nightcap never signs in to Discord, never reads a Discord token, and never contacts Discord's servers.</p>
-  <p>Set <code>integrations.discord_rpc.enabled: false</code> in <code>config.yaml</code> to turn it off.</p>
+    <h2>What stays on your machine</h2>
+    <ul>
+      <li>Configuration in <code>~/.config/mocktail/</code></li>
+      <li>Session logs and support bundles in <code>~/.local/state/mocktail/</code></li>
+      <li>Roblox login session under <code>~/.local/share/mocktail/</code></li>
+      <li>Roblox cache, downloaded payloads, and shader cache under <code>~/.cache/mocktail/</code></li>
+    </ul>
+    <p>Flatpak installs keep the same layout under <code>~/.var/app/io.github.CoderDayton.nightcap/</code>.</p>

-  <h2>Roblox</h2>
-  <p>Nightcap talks to Roblox's services exactly as the Roblox client would. That traffic is covered by the Roblox Privacy Policy.</p>
+    <h2>Discord Rich Presence</h2>
+    <p>When Rich Presence is on, Nightcap sends the current experience name, its public icon URL, elapsed time, and an optional public server join code to the Discord desktop client on the same machine over a local socket. Discord displays this on your profile under its own privacy settings. Nightcap never signs in to Discord, never reads a Discord token, and never contacts Discord's servers.</p>
+    <p>Set <code>integrations.discord_rpc.enabled: false</code> in <code>config.yaml</code> to turn it off.</p>

-  <h2>Contact</h2>
-  <p>Open an issue at <a class="source" href="https://github.com/CoderDayton/nightcap/issues">github.com/CoderDayton/nightcap/issues</a>.</p>
+    <h2>Roblox</h2>
+    <p>Nightcap talks to Roblox's services exactly as the Roblox client would. That traffic is covered by the Roblox Privacy Policy.</p>

-  <p class="links">
-    <a href="index.html">Home</a>
-    <a href="terms.html">Terms of Service</a>
-    <a href="https://github.com/CoderDayton/nightcap">Source code</a>
-  </p>
-</main></body>
+    <h2>Contact</h2>
+    <p>Open an issue at <a href="https://github.com/CoderDayton/nightcap/issues">github.com/CoderDayton/nightcap/issues</a>.</p>
+
+    <p class="legal-nav">
+      <a href="index.html">Home</a>
+      <a href="terms.html">Terms of Service</a>
+      <a href="https://github.com/CoderDayton/nightcap">Source code</a>
+    </p>
+  </main>
+</body>
 </html>
@@ -1,94 +1,305 @@
 /* Modified by vii from komaruworld/mocktail. See README "About this fork". */
 :root {
-  font: 17px/1.55 system-ui, sans-serif;
+  --bg: #14122b;
+  --ink: #ece8ff;
+  --muted: #b3aad6;
+  --accent: #6c4fd1;
+  --link: #a78bfa;
+  --line: #3a3470;
+  --code-bg: #1d1a3d;
+  font: 17px/1.6 system-ui, sans-serif;
  color-scheme: dark;
 }

+* { box-sizing: border-box; }
+
 body {
  margin: 0;
-  background: #14122b;
-  color: #ece8ff;
+  background: var(--bg);
+  color: var(--ink);
 }

-main {
-  max-width: 680px;
-  margin: 12vh auto;
-  padding: 32px;
+a { color: var(--link); }
+a:focus-visible,
+button:focus-visible { outline: 2px solid var(--link); outline-offset: 3px; }
+
+.wrap {
+  position: relative;
+  max-width: 920px;
+  margin: 0 auto;
+  padding: 0 24px;
 }

-img {
-  width: 88px;
-  height: 88px;
+.hero { padding-bottom: clamp(48px, 10vh, 110px); }
+
+.top {
+  margin: 0;
+  padding-top: 22px;
+  display: flex;
+  justify-content: flex-end;
+  gap: 18px;
 }

-h1 {
-  margin: .2rem 0;
-  font-size: clamp(2.5rem, 8vw, 4.5rem);
+.top a {
+  display: block;
+  color: var(--muted);
+  line-height: 0;
 }

-h2 {
-  margin: 32px 0 0;
-  font-size: 1.15rem;
+.top a:hover { color: var(--ink); }
+
+.eyebrow {
+  display: inline-block;
+  margin: clamp(48px, 12vh, 130px) 0 0;
+  padding: 6px 12px;
+  border: 1px solid var(--line);
+  background: var(--code-bg);
+  color: var(--link);
+  font-size: .85rem;
+  font-weight: 700;
+  letter-spacing: .06em;
+  text-transform: uppercase;
 }

-p,
-li {
-  color: #b3aad6;
+.hero h1 {
+  margin: 18px 0 0;
+  font-size: clamp(3.6rem, 15vw, 9.5rem);
+  font-weight: 800;
+  line-height: .95;
+  letter-spacing: -.045em;
+  display: flex;
+  align-items: center;
+  gap: .16em;
 }

-ul {
-  padding-left: 1.2rem;
+.hero h1 img {
+  height: .78em;
+  width: auto;
+  flex: none;
 }

+.lede {
+  max-width: 34ch;
+  margin: 22px 0 0;
+  color: var(--ink);
+  font-size: 1.25rem;
+  line-height: 1.45;
+}
+
+.actions { margin: 28px 0 0; }
+
 a.button {
  display: inline-block;
-  margin: 16px 8px 16px 0;
-  padding: 12px 18px;
-  border-radius: 9px;
-  background: #6c4fd1;
-  color: white;
+  margin: 0 10px 10px 0;
+  padding: 12px 20px;
+  border: 2px solid var(--accent);
+  background: var(--accent);
+  color: #fff;
  font-weight: 700;
  text-decoration: none;
 }

-a.secondary {
-  background: #2f2a6b;
+a.button:hover { background: #7d62dd; border-color: #7d62dd; }
+
+a.button.secondary {
+  background: var(--bg);
+  border-color: var(--link);
+  color: var(--ink);
 }

-.commands {
-  margin-top: 10px;
+a.button.secondary:hover { background: var(--code-bg); }
+
+/* Every section is a label on the left and its content on the right. */
+.row {
+  display: grid;
+  grid-template-columns: 200px 1fr;
+  gap: 8px 32px;
+  padding: 36px 0;
+  border-top: 1px solid var(--line);
 }

-.commands p,
-.download-label {
-  margin: 14px 0 5px;
-  color: #ece8ff;
-  font-size: .82rem;
+h2 {
+  margin: 0;
+  font-size: 1rem;
  font-weight: 700;
-  letter-spacing: .04em;
-  text-transform: uppercase;
+}
+
+.row.stacked { grid-template-columns: 1fr; gap: 20px; }
+
+.body { margin: 0; min-width: 0; }
+.body p { margin: 0 0 12px; color: var(--muted); }
+
+dl.body {
+  display: grid;
+  grid-template-columns: max-content 1fr;
+  gap: 0 28px;
+}
+
+dt {
+  padding: 9px 0;
+  color: var(--muted);
+}
+
+dd {
+  position: relative;
+  margin: 0;
+  padding: 9px 0;
+  min-width: 0;
+}
+
+.facts dt,
+.facts dd { border-bottom: 1px solid var(--line); }
+.facts dt:last-of-type,
+.facts dd:last-of-type { border-bottom: 0; }
+.facts dt { color: var(--ink); font-weight: 700; }
+
+dl.body.install { display: block; }
+
+.install dt {
+  padding: 18px 0 6px;
+  font-size: .9rem;
+}
+
+.install dt:first-child { padding-top: 0; }
+.install dd { padding: 0; }
+
+pre {
+  margin: 0;
+  padding: 14px;
+  overflow-x: auto;
+  border-left: 3px solid var(--accent);
+  background: var(--code-bg);
 }

 code {
-  display: block;
-  padding: 14px;
-  overflow-wrap: anywhere;
-  border: 1px solid #3a3470;
-  border-radius: 6px;
-  background: #1d1a3d;
+  font: .9rem/1.7 ui-monospace, "DejaVu Sans Mono", "JetBrains Mono", monospace;
  white-space: pre-wrap;
+  overflow-wrap: anywhere;
 }

+dd button {
+  position: absolute;
+  top: -30px;
+  right: 0;
+  padding: 2px 0 2px 8px;
+  border: 0;
+  background: transparent;
+  color: var(--muted);
+  font: .8rem ui-monospace, monospace;
+  cursor: pointer;
+}
+
+dd button:hover { color: var(--ink); text-decoration: underline; }
+
 .links {
-  margin: 10px 0 14px;
+  margin: 0;
+  padding: 0;
+  list-style: none;
+  border-top: 1px solid var(--line);
 }

+.links li { border-bottom: 1px solid var(--line); }
+
 .links a {
-  display: inline-block;
-  margin: 0 14px 6px 0;
-  color: #a78bfa;
+  display: grid;
+  grid-template-columns: 200px 1fr 24px;
+  align-items: baseline;
+  gap: 4px 16px;
+  margin: 0 -8px;
+  padding: 12px 24px 12px 8px;
+  color: var(--ink);
+  font-weight: 700;
+  text-decoration: none;
 }

-a.source {
-  color: #a78bfa;
+.links a:hover { background: var(--code-bg); }
+.links a:hover .name { text-decoration: underline; text-decoration-color: var(--link); text-underline-offset: 4px; }
+
+.links .file {
+  color: var(--muted);
+  font: 400 .88rem ui-monospace, "DejaVu Sans Mono", monospace;
+  overflow-wrap: anywhere;
+}
+
+.links .go { color: var(--link); text-align: right; }
+
+.foot {
+  padding-bottom: 48px;
+  color: var(--muted);
+  font-size: .9rem;
+}
+
+.foot::before {
+  content: "";
+  display: block;
+  margin-bottom: 24px;
+  border-top: 1px solid var(--line);
+}
+
+.foot p { margin: 0 0 8px; }
+
+/* Terms and privacy pages: a header bar and one readable column. */
+.bar {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding-top: 22px;
+}
+
+.bar .top { padding-top: 0; }
+
+.brand {
+  display: inline-flex;
+  align-items: center;
+  gap: 10px;
+  color: var(--ink);
+  font-size: 1.15rem;
+  font-weight: 800;
+  letter-spacing: -.02em;
+  text-decoration: none;
+}
+
+.brand img { width: 30px; height: 30px; }
+
+.prose {
+  padding-top: clamp(32px, 8vh, 80px);
+  padding-bottom: 48px;
+}
+
+.prose > * { max-width: 700px; }
+
+.prose h1 {
+  margin: 0 0 16px;
+  font-size: clamp(2rem, 6vw, 3rem);
+  line-height: 1.1;
+  letter-spacing: -.03em;
+}
+
+.prose h2 {
+  margin: 36px 0 6px;
+  padding-top: 20px;
+  border-top: 1px solid var(--line);
+  font-size: 1.05rem;
+}
+
+.prose p,
+.prose li { margin: 0 0 12px; }
+.prose ul { margin: 0 0 12px; padding-left: 1.2rem; }
+
+.prose code {
+  padding: 1px 6px;
+  background: var(--code-bg);
+  font-size: .85rem;
+  white-space: normal;
+}
+
+.legal-nav { display: flex; flex-wrap: wrap; gap: 4px 20px; margin-top: 28px; }
+
+@media (max-width: 720px) {
+  .row { grid-template-columns: 1fr; padding: 28px 0; }
+  dl.body:not(.install) { grid-template-columns: 1fr; }
+  .facts dt { padding-bottom: 0; border-bottom: 0; }
+  .links a { grid-template-columns: 1fr 24px; }
+  .links .file { grid-column: 1; grid-row: 2; }
+  .links .go { grid-column: 2; grid-row: 1 / span 2; align-self: center; }
 }
@@ -8,29 +8,39 @@
  <link rel="icon" href="nightcap.svg" type="image/svg+xml">
  <link rel="stylesheet" href="styles.css">
 </head>
-<body><main>
-  <h1>Terms of Service</h1>
-  <p>Nightcap is free and open-source software licensed under the Apache License, Version 2.0. The license text shipped with the source governs your use of the software.</p>
+<body>
+  <header class="wrap bar">
+    <a class="brand" href="index.html"><img src="nightcap.svg" alt="" width="30" height="30"><span>Nightcap</span></a>
+    <p class="top">
+      <a href="https://github.com/CoderDayton/nightcap" aria-label="Nightcap on GitHub" title="GitHub"><svg viewBox="0 0 16 16" width="24" height="24" aria-hidden="true"><path fill="currentColor" d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/></svg></a>
+      <a href="https://discord.gg/DbAUG9hBFU" aria-label="Nightcap on Discord" title="Discord"><svg viewBox="0 0 24 24" width="24" height="24" aria-hidden="true"><path fill="currentColor" d="M20.317 4.3698a19.7913 19.7913 0 00-4.8851-1.5152.0741.0741 0 00-.0785.0371c-.211.3753-.4447.8648-.6083 1.2495-1.8447-.2762-3.68-.2762-5.4868 0-.1636-.3933-.4058-.8742-.6177-1.2495a.077.077 0 00-.0785-.037 19.7363 19.7363 0 00-4.8852 1.515.0699.0699 0 00-.0321.0277C.5334 9.0458-.319 13.5799.0992 18.0578a.0824.0824 0 00.0312.0561c2.0528 1.5076 4.0413 2.4228 5.9929 3.0294a.0777.0777 0 00.0842-.0276c.4616-.6304.8731-1.2952 1.226-1.9942a.076.076 0 00-.0416-.1057c-.6528-.2476-1.2743-.5495-1.8722-.8923a.077.077 0 01-.0076-.1277c.1258-.0943.2517-.1923.3718-.2914a.0743.0743 0 01.0776-.0105c3.9278 1.7933 8.18 1.7933 12.0614 0a.0739.0739 0 01.0785.0095c.1202.099.246.1981.3728.2924a.077.077 0 01-.0066.1276 12.2986 12.2986 0 01-1.873.8914.0766.0766 0 00-.0407.1067c.3604.698.7719 1.3628 1.225 1.9932a.076.076 0 00.0842.0286c1.961-.6067 3.9495-1.5219 6.0023-3.0294a.077.077 0 00.0313-.0552c.5004-5.177-.8382-9.6739-3.5485-13.6604a.061.061 0 00-.0312-.0286zM8.02 15.3312c-1.1825 0-2.1569-1.0857-2.1569-2.419 0-1.3332.9555-2.4189 2.157-2.4189 1.2108 0 2.1757 1.0952 2.1568 2.419 0 1.3332-.9555 2.4189-2.1569 2.4189zm7.9748 0c-1.1825 0-2.1569-1.0857-2.1569-2.419 0-1.3332.9554-2.4189 2.1569-2.4189 1.2108 0 2.1757 1.0952 2.1568 2.419 0 1.3332-.946 2.4189-2.1568 2.4189z"/></svg></a>
+    </p>
+  </header>

-  <h2>No warranty</h2>
-  <p>Nightcap is provided "as is", without warranty of any kind. The authors are not liable for any loss, damage, or account action that results from using it. See sections 7 and 8 of the Apache License.</p>
+  <main class="wrap prose">
+    <h1>Terms of Service</h1>
+    <p>Nightcap is free and open-source software licensed under the Apache License, Version 2.0. The license text shipped with the source governs your use of the software.</p>

-  <h2>Not affiliated</h2>
-  <p>Nightcap is an independent community project. It is not affiliated with, endorsed by, or supported by Roblox Corporation or Discord Inc. Roblox and Discord are trademarks of their respective owners.</p>
+    <h2>No warranty</h2>
+    <p>Nightcap is provided "as is", without warranty of any kind. The authors are not liable for any loss, damage, or account action that results from using it. See sections 7 and 8 of the Apache License.</p>

-  <h2>Your responsibility</h2>
-  <p>You are responsible for following the Roblox Terms of Use and the Discord Terms of Service while using Nightcap with those services. Nightcap does not modify Roblox game logic, does not bypass Roblox security, and is not a cheat.</p>
+    <h2>Not affiliated</h2>
+    <p>Nightcap is an independent community project. It is not affiliated with, endorsed by, or supported by Roblox Corporation or Discord Inc. Roblox and Discord are trademarks of their respective owners.</p>

-  <h2>Discord application</h2>
-  <p>The Nightcap Discord application only provides Rich Presence for the Nightcap desktop runtime. It requests no permissions, has no bot, and does not access your Discord account.</p>
+    <h2>Your responsibility</h2>
+    <p>You are responsible for following the Roblox Terms of Use and the Discord Terms of Service while using Nightcap with those services. Nightcap does not modify Roblox game logic, does not bypass Roblox security, and is not a cheat.</p>

-  <h2>Changes</h2>
-  <p>These terms may change with new releases. The current version always lives at this address.</p>
+    <h2>Discord application</h2>
+    <p>The Nightcap Discord application only provides Rich Presence for the Nightcap desktop runtime. It requests no permissions, has no bot, and does not access your Discord account.</p>

-  <p class="links">
-    <a href="index.html">Home</a>
-    <a href="privacy.html">Privacy Policy</a>
-    <a href="https://github.com/CoderDayton/nightcap">Source code</a>
-  </p>
-</main></body>
+    <h2>Changes</h2>
+    <p>These terms may change with new releases. The current version always lives at this address.</p>
+
+    <p class="legal-nav">
+      <a href="index.html">Home</a>
+      <a href="privacy.html">Privacy Policy</a>
+      <a href="https://github.com/CoderDayton/nightcap">Source code</a>
+    </p>
+  </main>
+</body>
 </html>
@@ -7,6 +7,7 @@
 #include <cstdint>
 #include <cstdio>
 #include <cstring>
+#include <initializer_list>
 #include <map>
 #include <memory>
 #include <mutex>
@@ -31,18 +32,18 @@ struct NativeOptionalFormat {
 struct NativeSharedSink { void* object; void* owner; };
 static_assert(sizeof(NativeOptionalFormat) == 16);
 static_assert(sizeof(NativePcmFormat) == 8);
-inline std::atomic<NativeInputCapture*> g_native_capture{nullptr};
+inline std::shared_ptr<NativeInputCapture> g_native_capture;

 class NativeInputCapture {
 public:
  using DeliverPcm = std::size_t (*)(void*, const void*, std::size_t,
                                    std::uint64_t, const NativePcmFormat*);
-  using Destroy = void (*)(NativeSharedSink*);
  using OriginalLatency = void (*)(void*, std::uint32_t*, std::uint32_t*);
+  using ImageRange = bool (*)(std::uintptr_t, std::uintptr_t, std::size_t);
  struct SinkAbi {
-    std::uintptr_t vtable;
-    DeliverPcm deliver;
-    Destroy release;
+    std::uintptr_t image_base;
+    ImageRange is_image_relro;
+    ImageRange is_image_code;
    OriginalLatency latency;
  };
  NativeInputCapture(SinkAbi abi, bool enabled)
@@ -50,17 +51,22 @@ class NativeInputCapture {
  ~NativeInputCapture() { Shutdown(); }

  static NativeOptionalFormat Format(void*) {
-    auto* capture = g_native_capture.load(std::memory_order_acquire);
-    return {{}, capture && capture->enabled_ ? 1ULL : 0ULL};
+    auto capture =
+        std::atomic_load_explicit(&g_native_capture, std::memory_order_acquire);
+    if (!capture) return {};
+    std::lock_guard lock(capture->mutex_);
+    return {{}, capture->enabled_ && !capture->closed_ ? 1ULL : 0ULL};
  }
  static void Latency(void* self, std::uint32_t* playback,
                      std::uint32_t* recording) {
    // Preserve the native playback latency and report the host capture queue.
-    auto* capture = g_native_capture.load(std::memory_order_acquire);
+    auto capture =
+        std::atomic_load_explicit(&g_native_capture, std::memory_order_acquire);
    if (!capture) return;
+    std::lock_guard lock(capture->mutex_);
+    if (capture->closed_) return;
    capture->abi_.latency(self, playback, recording);
    if (recording) {
-      std::lock_guard lock(capture->mutex_);
      *recording = 10;
      auto it = capture->sessions_.find(self);
      if (it != capture->sessions_.end()) {
@@ -70,33 +76,48 @@ class NativeInputCapture {
    }
  }
  static bool Start(void* self, NativeSharedSink* sink) {
-    auto* capture = g_native_capture.load(std::memory_order_acquire);
+    auto capture =
+        std::atomic_load_explicit(&g_native_capture, std::memory_order_acquire);
    return capture && capture->StartSink(self, sink);
  }
  static void Stop(void* self, NativeSharedSink* sink) {
-    auto* capture = g_native_capture.load(std::memory_order_acquire);
+    auto capture =
+        std::atomic_load_explicit(&g_native_capture, std::memory_order_acquire);
    if (capture) capture->StopSink(self, sink);
  }
  static bool Recording(void* self) {
-    auto* capture = g_native_capture.load(std::memory_order_acquire);
+    auto capture =
+        std::atomic_load_explicit(&g_native_capture, std::memory_order_acquire);
    if (!capture) return false;
    std::lock_guard lock(capture->mutex_);
    return capture->sessions_.find(self) != capture->sessions_.end();
  }
  static void Poll(void* self) {
-    auto* capture = g_native_capture.load(std::memory_order_acquire);
+    auto capture =
+        std::atomic_load_explicit(&g_native_capture, std::memory_order_acquire);
    if (capture) capture->Deliver(self);
  }
  void Shutdown() {
    std::lock_guard lock(mutex_);
+    closed_ = true;
    for (auto& [self, session] : sessions_) Close(*session);
    sessions_.clear();
  }

 private:
+  struct Sink {
+    NativeSharedSink shared;
+    DeliverPcm deliver;
+  };
+  struct SharedCount {
+    const std::uintptr_t* vtable;
+    long shared_owners;
+    long weak_owners;
+  };
+  using ControlBlockHook = void (*)(void*);
  struct Session {
    std::unique_ptr<AudioCapture> input;
-    std::vector<NativeSharedSink> sinks;
+    std::vector<Sink> sinks;
    std::mutex queue_mutex;
    // At most 200 ms; a stalled consumer must not accumulate stale speech.
    std::array<std::array<std::int16_t, 480>, 20> frames{};
@@ -118,20 +139,33 @@ class NativeInputCapture {
                session.input->buffer_data(), bytes);
    ++session.count;
  }
+  bool IsGuestVtable(const void* object, std::size_t size,
+                     std::initializer_list<std::size_t> methods) const {
+    const auto base = abi_.image_base;
+    const auto* table = *static_cast<const std::uintptr_t* const*>(object);
+    const auto address = reinterpret_cast<std::uintptr_t>(table);
+    if (address < base ||
+        !abi_.is_image_relro(base, address - base, size * sizeof(*table)))
+      return false;
+    for (const auto slot : methods)
+      if (table[slot] < base ||
+          !abi_.is_image_code(base, table[slot] - base, 1))
+        return false;
+    return true;
+  }
  bool StartSink(void* self, NativeSharedSink* sink) {
    std::lock_guard lock(mutex_);
-    if (!enabled_ || !self || !sink || !sink->object || !sink->owner)
+    if (closed_ || !enabled_ || !self || !sink || !sink->object || !sink->owner)
      return false;
-    auto* table = *reinterpret_cast<std::uintptr_t**>(sink->object);
-    if (reinterpret_cast<std::uintptr_t>(table) != abi_.vtable ||
-        table[2] != reinterpret_cast<std::uintptr_t>(abi_.deliver)) {
+    if (!IsGuestVtable(sink->object, 3, {2}) ||
+        !IsGuestVtable(sink->owner, 5, {2, 4})) {
      std::fprintf(stderr, "  [audio-input] unsupported native PCM sink ABI\n");
      return false;
    }
    auto it = sessions_.find(self);
    if (it != sessions_.end()) {
      for (const auto& existing : it->second->sinks)
-        if (existing.object == sink->object) return true;
+        if (existing.shared.object == sink->object) return true;
    } else {
      auto session = std::make_unique<Session>();
      SdlAudioCaptureOptions options;
@@ -151,13 +185,20 @@ class NativeInputCapture {
    }
    // The native parameter is a by-value shared_ptr. Retain its existing
    // ownership by moving it, leaving the caller's temporary empty.
-    it->second->sinks.push_back(*sink);
+    const auto* table = *static_cast<const std::uintptr_t* const*>(sink->object);
+    it->second->sinks.push_back({*sink, reinterpret_cast<DeliverPcm>(table[2])});
    *sink = {};
    return true;
  }
-  void Release(NativeSharedSink& sink) {
-    abi_.release(&sink);
+  static void Release(Sink& sink) {
+    auto* count = static_cast<SharedCount*>(sink.shared.owner);
    sink = {};
+    if (__atomic_fetch_sub(&count->shared_owners, 1, __ATOMIC_ACQ_REL) != 0)
+      return;
+    reinterpret_cast<ControlBlockHook>(count->vtable[2])(count);
+    if (__atomic_load_n(&count->weak_owners, __ATOMIC_ACQUIRE) == 0 ||
+        __atomic_fetch_sub(&count->weak_owners, 1, __ATOMIC_ACQ_REL) == 0)
+      reinterpret_cast<ControlBlockHook>(count->vtable[4])(count);
  }
  void Close(Session& session) {
    session.input->Shutdown();
@@ -174,7 +215,7 @@ class NativeInputCapture {
    if (it == sessions_.end() || !sink) return;
    auto& session = *it->second;
    auto existing = std::find_if(session.sinks.begin(), session.sinks.end(),
-        [&](const auto& entry) { return entry.object == sink->object; });
+        [&](const auto& entry) { return entry.shared.object == sink->object; });
    if (existing == session.sinks.end()) return;
    Release(*existing);
    session.sinks.erase(existing);
@@ -203,8 +244,7 @@ class NativeInputCapture {
      }
      const NativePcmFormat format;
      for (const auto& sink : session.sinks)
-        abi_.deliver(
-            sink.object, pcm.data(), pcm.size(), delay, &format);
+        sink.deliver(sink.shared.object, pcm.data(), pcm.size(), delay, &format);
      if (++session.delivered == 1)
        std::fprintf(stderr, "  [audio-input] PCM delivered to native voice sink\n");
      if (!session.audible && std::any_of(pcm.begin(), pcm.end(),
@@ -216,6 +256,7 @@ class NativeInputCapture {
  }
  SinkAbi abi_;
  bool enabled_;
+  bool closed_ = false;
  std::mutex mutex_;
  std::map<void*, std::unique_ptr<Session>> sessions_;
 };
@@ -130,14 +130,6 @@ std::uintptr_t FunctionAddress(Function function) {

 }  // namespace

-// ABI verified for Roblox 2.738.1397. Keep capture separate from the menu
-// profile: relocating query methods alone does not establish a recording ABI.
-namespace {
-constexpr std::array<std::size_t, 6> kCaptureSlots{4, 13, 14, 15, 16, 17};
-constexpr std::array<std::uintptr_t, 6> kCaptureRvas{
-    0x320c630, 0x320bcf6, 0x320d4b4, 0x320dd94, 0x320b844, 0x320e49a};
-}  // namespace
-
 RobloxOutputDeviceBridge::RobloxOutputDeviceBridge() = default;

 namespace internal {
@@ -226,10 +218,6 @@ Status RobloxOutputDeviceBridge::Install(const compat::BuildProfile& profile) {
        "another Roblox output-device bridge owns the process");
  }
  profile_ = *profile.fmod_output_device_bridge;
-  capture_profile_supported_ =
-      profile.elf_build_id == "5f0704edd9064f566ee3d6df2bd2fabbcc709f03" &&
-      profile_.vtable_rva == 0x6cd3ce0 &&
-      profile_.vtable_layout_version == 2 && profile_.has_input_devices();
  if (!linker::SetAndroidLibraryLoadObserver(&ObserveAndroidLibrary, this)) {
    g_active_bridge.store(nullptr, std::memory_order_release);
    profile_ = {};
@@ -255,7 +243,10 @@ void RobloxOutputDeviceBridge::Shutdown() {
                   "  [audio-menu] failed to restore FmodAudioDevice "
                   "vtable protection\n");
    }
-    g_native_capture.store(nullptr, std::memory_order_release);
+    std::atomic_store_explicit(&g_native_capture,
+                              std::shared_ptr<NativeInputCapture>{},
+                              std::memory_order_release);
+    if (capture_) capture_->Shutdown();
    capture_.reset();
    active_ = false;
    devices_.clear();
@@ -419,6 +410,7 @@ Status RobloxOutputDeviceBridge::Activate(std::uintptr_t image_base) {
 Status RobloxOutputDeviceBridge::PatchVtableLocked() {
  const std::size_t kCurrentOutputVtableIndex = profile_.current_vtable_index();
  const std::size_t kSelectOutputVtableIndex = profile_.select_vtable_index();
+  const auto capture_indexes = profile_.capture_vtable_indexes();
  if (profile_.vtable_rva >
      std::numeric_limits<std::uintptr_t>::max() -
          (kSelectOutputVtableIndex + 1) * sizeof(std::uintptr_t)) {
@@ -461,26 +453,25 @@ Status RobloxOutputDeviceBridge::PatchVtableLocked() {
        "FmodAudioDevice string ABI contract validation failed");
  }

-  if (capture_profile_supported_) {
-    for (std::size_t i = 0; i < kCaptureSlots.size(); ++i) {
-      if (!IsExecutableImageRange(library_base_, kCaptureRvas[i], 1) ||
-          vtable_[kCaptureSlots[i]] != library_base_ + kCaptureRvas[i])
+  if (profile_.has_input_devices()) {
+    for (std::size_t i = 0; i < capture_indexes.size(); ++i) {
+      const auto method = vtable_[capture_indexes[i]];
+      if (method < library_base_ ||
+          !IsExecutableImageRange(library_base_, method - library_base_, 1) ||
+          std::find(profile_.input_method_rvas.begin(),
+                    profile_.input_method_rvas.end(), method - library_base_) !=
+              profile_.input_method_rvas.end() ||
+          std::find(original_capture_methods_.begin(),
+                    original_capture_methods_.begin() + i, method) !=
+              original_capture_methods_.begin() + i)
        return FailedPrecondition("native input capture vtable ABI mismatch");
-      original_capture_methods_[i] = vtable_[kCaptureSlots[i]];
+      original_capture_methods_[i] = method;
    }
-    if (!IsExecutableImageRange(library_base_, 0x3213154, 1) ||
-        !IsExecutableImageRange(library_base_, 0x1dc4cd0, 1) ||
-        !IsRelroImageRange(library_base_, 0x6cd4550, 24))
-      return FailedPrecondition("native input capture sink ABI outside image");
-    capture_ = std::make_unique<NativeInputCapture>(
+    capture_ = std::make_shared<NativeInputCapture>(
        NativeInputCapture::SinkAbi{
-            library_base_ + 0x6cd4550,
-            reinterpret_cast<NativeInputCapture::DeliverPcm>(
-                library_base_ + 0x3213154),
-            reinterpret_cast<NativeInputCapture::Destroy>(
-                library_base_ + 0x1dc4cd0),
+            library_base_, &IsRelroImageRange, &IsExecutableImageRange,
            reinterpret_cast<NativeInputCapture::OriginalLatency>(
-                library_base_ + kCaptureRvas[1])},
+                original_capture_methods_[1])},
        !input_devices_.empty());
  }

@@ -519,7 +510,8 @@ Status RobloxOutputDeviceBridge::PatchVtableLocked() {
      __atomic_store_n(&vtable_[indexes[i]], methods[i], __ATOMIC_RELEASE);
  }
  if (capture_) {
-    g_native_capture.store(capture_.get(), std::memory_order_release);
+    std::atomic_store_explicit(&g_native_capture, capture_,
+                              std::memory_order_release);
    const std::array<std::uintptr_t, 6> methods{
        FunctionAddress(&NativeInputCapture::Format),
        FunctionAddress(&NativeInputCapture::Latency),
@@ -527,8 +519,8 @@ Status RobloxOutputDeviceBridge::PatchVtableLocked() {
        FunctionAddress(&NativeInputCapture::Stop),
        FunctionAddress(&NativeInputCapture::Poll),
        FunctionAddress(&NativeInputCapture::Recording)};
-    for (std::size_t i = 0; i < kCaptureSlots.size(); ++i)
-      __atomic_store_n(&vtable_[kCaptureSlots[i]], methods[i], __ATOMIC_RELEASE);
+    for (std::size_t i = 0; i < capture_indexes.size(); ++i)
+      __atomic_store_n(&vtable_[capture_indexes[i]], methods[i], __ATOMIC_RELEASE);
  }
  if (!SetVtableWritable(vtable_, kSelectOutputVtableIndex, false)) {
    __atomic_store_n(&vtable_[kOutputCountVtableIndex], original_methods_[0],
@@ -546,10 +538,13 @@ Status RobloxOutputDeviceBridge::PatchVtableLocked() {
                         __ATOMIC_RELEASE);
    }
    if (capture_) {
-      for (std::size_t i = 0; i < kCaptureSlots.size(); ++i)
-        __atomic_store_n(&vtable_[kCaptureSlots[i]], original_capture_methods_[i],
+      for (std::size_t i = 0; i < capture_indexes.size(); ++i)
+        __atomic_store_n(&vtable_[capture_indexes[i]], original_capture_methods_[i],
                         __ATOMIC_RELEASE);
-      g_native_capture.store(nullptr, std::memory_order_release);
+      std::atomic_store_explicit(&g_native_capture,
+                                std::shared_ptr<NativeInputCapture>{},
+                                std::memory_order_release);
+      capture_->Shutdown();
      capture_.reset();
    }
    (void)SetVtableWritable(vtable_, kSelectOutputVtableIndex, false);
@@ -581,8 +576,9 @@ bool RobloxOutputDeviceBridge::RestoreVtableLocked() {
                       __ATOMIC_RELEASE);
  }
  if (capture_) {
-    for (std::size_t i = 0; i < kCaptureSlots.size(); ++i)
-      __atomic_store_n(&vtable_[kCaptureSlots[i]], original_capture_methods_[i],
+    const auto capture_indexes = profile_.capture_vtable_indexes();
+    for (std::size_t i = 0; i < capture_indexes.size(); ++i)
+      __atomic_store_n(&vtable_[capture_indexes[i]], original_capture_methods_[i],
                       __ATOMIC_RELEASE);
  }
  return SetVtableWritable(vtable_, kSelectOutputVtableIndex, false);
@@ -150,6 +150,15 @@ Result ParseInHostCLocale(Parser parser) noexcept {
  return result;
 }

+// Highest errno in Bionic's message table (EHWPOISON). Numbers 41 and 58 are
+// unassigned in the generic Linux errno list, so Bionic has no text for them.
+constexpr int kBionicMaxErrno = 133;
+
+constexpr bool HasBionicErrnoMessage(int error_number) noexcept {
+  return error_number >= 0 && error_number <= kBionicMaxErrno &&
+         error_number != 41 && error_number != 58;
+}
+
 template <typename Result>
 const char* HostStrErrorResult(Result result, char* buffer) noexcept {
  if constexpr (std::is_integral_v<Result>) {
@@ -318,10 +327,16 @@ int BionicStrError(int error_number, char* buffer,
    return -1;
  }

+  // Bionic's table ends at EHWPOISON. Unknown numbers get the same text on
+  // every host instead of whatever the host libc prints (musl has no
+  // "Unknown error N" form).
  std::array<char, 256> host_buffer{};
-  auto host_result =
-      ::strerror_r(error_number, host_buffer.data(), host_buffer.size());
-  const char* message = HostStrErrorResult(host_result, host_buffer.data());
+  const char* message = nullptr;
+  if (HasBionicErrnoMessage(error_number)) {
+    auto host_result =
+        ::strerror_r(error_number, host_buffer.data(), host_buffer.size());
+    message = HostStrErrorResult(host_result, host_buffer.data());
+  }

  std::array<char, 64> unknown_buffer{};
  if (message == nullptr) {
@@ -373,6 +388,10 @@ extern "C" void mocktail_bionic_arc4random_buf(void* buffer, size_t size) {
  mocktail::compat::BionicArc4RandomBuffer(buffer, size);
 }

+extern "C" int mocktail_bionic_atoi(const char* text) {
+  return static_cast<int>(std::strtol(text, nullptr, 10));
+}
+
 extern "C" mocktail::compat::BionicMallinfoSnapshot mocktail_bionic_mallinfo() {
  return mocktail::compat::BionicMallinfo();
 }
@@ -114,7 +114,7 @@ int CopySupportedThreadAttributes(const MocktailBionicPthreadAttr& source,
  if (RejectRealtimeScheduling(source.sched_policy)) {
    return EPERM;
  }
-  if (source.sched_policy != SCHED_NORMAL) {
+  if (source.sched_policy != SCHED_OTHER) {
    result = pthread_attr_setschedpolicy(destination, source.sched_policy);
    if (result != 0) {
      return result;
@@ -270,6 +270,42 @@ bool HostAbiProfile::ShouldInitializeNativeMimallocThreadAfterConstructor(
         index == native_mimalloc_thread_initializer_after_constructor;
 }

+bool HostAbiProfile::HasVerifiedConstructorPolicy(
+    size_t jni_singleton_constructor) const noexcept {
+  constexpr size_t kLeadingConstructors = 4;
+  constexpr size_t kWiringConstructors = 2;
+  if (!HasValidConstructorRanges() ||
+      !HasValidNativeMimallocConstructorRanges() ||
+      native_mimalloc_constructor_run_range_count != 1) {
+    return false;
+  }
+  const size_t begin = native_mimalloc_constructor_run_ranges[0].begin;
+  const size_t checkpoint =
+      native_mimalloc_thread_initializer_after_constructor;
+  const ConstructorRange &tail =
+      constructor_run_ranges[constructor_run_range_count - 1];
+  if (init_array_count < begin + kLeadingConstructors ||
+      native_mimalloc_constructor_run_ranges[0].end_exclusive !=
+          init_array_count ||
+      checkpoint < begin || checkpoint >= begin + kLeadingConstructors ||
+      !AllowsConstructor(checkpoint) || jni_singleton_constructor < begin ||
+      jni_singleton_constructor >= begin + kLeadingConstructors ||
+      jni_singleton_constructor == checkpoint ||
+      !AllowsConstructor(jni_singleton_constructor) ||
+      ConstructorRangeBegin() < begin ||
+      tail.begin > begin + kLeadingConstructors ||
+      tail.end_exclusive != init_array_count) {
+    return false;
+  }
+  size_t excluded = 0;
+  for (size_t index = begin; index < begin + kLeadingConstructors; ++index) {
+    if (!AllowsConstructor(index)) {
+      ++excluded;
+    }
+  }
+  return excluded == kWiringConstructors;
+}
+
 bool HostAbiProfile::HasValidNativePreJniBootstrap() const noexcept {
  return native_pre_jni_bootstrap.IsValid();
 }
@@ -612,26 +612,26 @@ std::unique_ptr<OwnedHostAbiProfile> ParseProfile(const Json& root,
    *error = "external host ABI profile has inconsistent constructor policy";
    return nullptr;
  }
-  // The verified constructor layout is the same on both guest ABIs: a single
-  // process-load constructor at the thread-initializer checkpoint, two wiring
-  // entries excluded under host bridges, and one contiguous native-mimalloc
-  // replay from the checkpoint to the end of .init_array. Only the checkpoint
-  // index itself differs between payloads.
-  const std::size_t checkpoint =
-      owned->profile.native_mimalloc_thread_initializer_after_constructor;
-  if (owned->profile.init_array_count <= checkpoint + 3 ||
-      owned->profile.constructor_run_range_count != 2 ||
-      owned->profile.constructor_run_ranges[0].begin != checkpoint ||
-      owned->profile.constructor_run_ranges[0].end_exclusive != checkpoint + 1 ||
-      owned->profile.constructor_run_ranges[1].begin != checkpoint + 3 ||
-      owned->profile.constructor_run_ranges[1].end_exclusive !=
-          owned->profile.init_array_count ||
-      owned->profile.native_mimalloc_constructor_run_range_count != 1 ||
-      owned->profile.native_mimalloc_constructor_run_ranges[0].begin !=
-          checkpoint ||
-      owned->profile.native_mimalloc_constructor_run_ranges[0].end_exclusive !=
-          owned->profile.init_array_count ||
-      (kGuestElfMachine == EM_X86_64 && checkpoint != 2)) {
+  // The verified constructor layout is the same on both guest ABIs. Payloads
+  // differ in the order of the four leading constructors, and the guest ABIs
+  // differ in the index the native replay starts at.
+  // derivation_code_rvas holds three initializer anchors, then the anchors of
+  // the four leading constructors in .init_array order.
+  constexpr size_t kJniSingletonAnchor = 2;
+  constexpr size_t kFirstConstructorAnchor = 3;
+  constexpr size_t kConstructorAnchors = 4;
+  size_t jni_singleton_constructor = owned->profile.init_array_count;
+  for (size_t anchor = 0; anchor < kConstructorAnchors; ++anchor) {
+    if (owned->derivation_code_rvas[kFirstConstructorAnchor + anchor] ==
+        owned->derivation_code_rvas[kJniSingletonAnchor]) {
+      jni_singleton_constructor =
+          owned->profile.NativeMimallocConstructorRangeBegin() + anchor;
+      break;
+    }
+  }
+  if (!owned->profile.HasVerifiedConstructorPolicy(jni_singleton_constructor) ||
+      (kGuestElfMachine == EM_X86_64 &&
+       owned->profile.NativeMimallocConstructorRangeBegin() != 2)) {
    *error =
        "external host ABI profile changed the verified constructor policy";
    return nullptr;
@@ -2000,7 +2000,11 @@ VKAPI_ATTR VkResult VKAPI_CALL vkCreateSwapchainKHR(
    }
  }
  const VkResult result =
-      host_create(device, &host_info, allocator, swapchain);
+      mocktail::graphics::CreateSwapchainWithPresentModeFallback(
+          host_info, create_info->presentMode,
+          [&](const VkSwapchainCreateInfoKHR& attempt) {
+            return host_create(device, &attempt, allocator, swapchain);
+          });
  if (result != VK_SUCCESS) {
    return result;
  }
@@ -0,0 +1,18 @@
+#include "jni_method_names.h"
+
+#include <unordered_map>
+
+namespace jnivm::internal {
+
+JniMethod LookupJniMethod(std::string_view name) {
+  static const auto* const kMethods =
+      new std::unordered_map<std::string_view, JniMethod>{
+#define MOCKTAIL_JNI_METHOD_ENTRY(id, text) {text, JniMethod::id},
+          MOCKTAIL_JNI_METHOD_NAMES(MOCKTAIL_JNI_METHOD_ENTRY)
+#undef MOCKTAIL_JNI_METHOD_ENTRY
+      };
+  const auto it = kMethods->find(name);
+  return it == kMethods->end() ? JniMethod::kUnknown : it->second;
+}
+
+}  // namespace jnivm::internal
@@ -0,0 +1,266 @@
+#ifndef MOCKTAIL_JNIVM_JNI_METHOD_NAMES_H_
+#define MOCKTAIL_JNIVM_JNI_METHOD_NAMES_H_
+
+#include <cstdint>
+#include <string_view>
+
+namespace jnivm::internal {
+
+// Every Java method name the JNI dispatch matches on. GetMethodID and
+// GetStaticMethodID resolve a name to its entry once, so dispatch compares
+// enum values. A name that is not listed resolves to JniMethod::kUnknown.
+#define MOCKTAIL_JNI_METHOD_NAMES(X) \
+  X(kA, "a") \
+  X(kApply, "apply") \
+  X(kAttachObserver, "attachObserver") \
+  X(kBootstrapTheApp, "bootstrapTheApp") \
+  X(kCheckInit, "checkInit") \
+  X(kClose, "close") \
+  X(kCommit, "commit") \
+  X(kConnect, "connect") \
+  X(kConstructor, "<init>") \
+  X(kContains, "contains") \
+  X(kCurrentActivity, "currentActivity") \
+  X(kCurrentTimeMillis, "currentTimeMillis") \
+  X(kD, "d") \
+  X(kDeleteCurrentUserValues, "deleteCurrentUserValues") \
+  X(kDeleteSecureValue, "deleteSecureValue") \
+  X(kDeleteUserValues, "deleteUserValues") \
+  X(kDetachObserver, "detachObserver") \
+  X(kDispose, "dispose") \
+  X(kDoSubscribeProtocolMethodResponseRaw, "doSubscribeProtocolMethodResponseRaw") \
+  X(kEdit, "edit") \
+  X(kEnableBuiltInAEC, "enableBuiltInAEC") \
+  X(kEnableBuiltInAGC, "enableBuiltInAGC") \
+  X(kEnableBuiltInNS, "enableBuiltInNS") \
+  X(kF, "f") \
+  X(kFindClass, "findClass") \
+  X(kForName, "forName") \
+  X(kG, "g") \
+  X(kGameActivityHideKeyboard, "gameActivity_hideKeyboard") \
+  X(kGameActivityOnAppReady, "gameActivity_onAppReady") \
+  X(kGameActivityOnDidLogInReceived, "gameActivity_onDidLogInReceived") \
+  X(kGameActivityOnDidLogOutReceived, "gameActivity_onDidLogOutReceived") \
+  X(kGameActivityOnDidSignUp, "gameActivity_onDidSignUp") \
+  X(kGameActivityOnDidSwitchAccountReceived, "gameActivity_onDidSwitchAccountReceived") \
+  X(kGameActivityOnEngineInitialized, "gameActivity_onEngineInitialized") \
+  X(kGameActivityOnExperienceStart, "gameActivity_onExperienceStart") \
+  X(kGameActivityOnExperienceStop, "gameActivity_onExperienceStop") \
+  X(kGameActivityOnFlagsFailed, "gameActivity_onFlagsFailed") \
+  X(kGameActivityOnFlagsLoaded, "gameActivity_onFlagsLoaded") \
+  X(kGameActivityOnGameLoaded, "gameActivity_onGameLoaded") \
+  X(kGameActivityOnLuaAppDidReturn, "gameActivity_onLuaAppDidReturn") \
+  X(kGameActivityOnLuaTextBoxChanged, "gameActivity_onLuaTextBoxChanged") \
+  X(kGameActivityOnLuaTextBoxPropertyChanged, "gameActivity_onLuaTextBoxPropertyChanged") \
+  X(kGameActivityOnMotionEventListening, "gameActivity_onMotionEventListening") \
+  X(kGameActivityOnRestartLuaApp, "gameActivity_onRestartLuaApp") \
+  X(kGameActivityOnScanQrCode, "gameActivity_onScanQrCode") \
+  X(kGameActivityOnScreenOrientationChanged, "gameActivity_onScreenOrientationChanged") \
+  X(kGameActivityOnScreenshotReady, "gameActivity_onScreenshotReady") \
+  X(kGameActivitySetAppUpgradeStatus, "gameActivity_setAppUpgradeStatus") \
+  X(kGameActivityShowKeyboard, "gameActivity_showKeyboard") \
+  X(kGameDidLeave, "gameDidLeave") \
+  X(kGet, "get") \
+  X(kGetAbsolutePath, "getAbsolutePath") \
+  X(kGetActivity, "getActivity") \
+  X(kGetAlternateName, "getAlternateName") \
+  X(kGetAndroidApiVersion, "getAndroidApiVersion") \
+  X(kGetApiBaseUrl, "getApiBaseUrl") \
+  X(kGetApiGatewayUrl, "getApiGatewayUrl") \
+  X(kGetApiVersion, "getApiVersion") \
+  X(kGetApplicationContext, "getApplicationContext") \
+  X(kGetApplicationInfo, "getApplicationInfo") \
+  X(kGetAppVersion, "getAppVersion") \
+  X(kGetAssetManager, "getAssetManager") \
+  X(kGetAssets, "getAssets") \
+  X(kGetBaseContext, "getBaseContext") \
+  X(kGetBaseURL, "getBaseURL") \
+  X(kGetBaseUrl, "getBaseUrl") \
+  X(kGetBrand, "getBrand") \
+  X(kGetBufferSizeInFrames, "getBufferSizeInFrames") \
+  X(kGetBuildId, "getBuildId") \
+  X(kGetBuildRelease, "getBuildRelease") \
+  X(kGetBuildType, "getBuildType") \
+  X(kGetBytes, "getBytes") \
+  X(kGetCacheDir, "getCacheDir") \
+  X(kGetCanonicalPath, "getCanonicalPath") \
+  X(kGetClassLoader, "getClassLoader") \
+  X(kGetClientSettingsUrl, "getClientSettingsUrl") \
+  X(kGetContext, "getContext") \
+  X(kGetCookie, "getCookie") \
+  X(kGetCurrentText, "getCurrentText") \
+  X(kGetCurrentTextBoxInfo, "getCurrentTextBoxInfo") \
+  X(kGetCurrentUser, "getCurrentUser") \
+  X(kGetDecorView, "getDecorView") \
+  X(kGetDefaultDisplay, "getDefaultDisplay") \
+  X(kGetDensityDpi, "getDensityDpi") \
+  X(kGetDevice, "getDevice") \
+  X(kGetDeviceManufacturer, "getDeviceManufacturer") \
+  X(kGetDeviceModel, "getDeviceModel") \
+  X(kGetDeviceStaticParams, "getDeviceStaticParams") \
+  X(kGetDisplay, "getDisplay") \
+  X(kGetDisplayName, "getDisplayName") \
+  X(kGetExternalFilesDir, "getExternalFilesDir") \
+  X(kGetFilesDir, "getFilesDir") \
+  X(kGetGameLocale, "getGameLocale") \
+  X(kGetHeight, "getHeight") \
+  X(kGetHint, "getHint") \
+  X(kGetHolder, "getHolder") \
+  X(kGetId, "getId") \
+  X(kGetImplementation, "getImplementation") \
+  X(kGetInstallerPackageName, "getInstallerPackageName") \
+  X(kGetInt, "getInt") \
+  X(kGetLastLoggedInUser, "getLastLoggedInUser") \
+  X(kGetLastLoggedInUserId, "getLastLoggedInUserId") \
+  X(kGetLastRaw, "getLastRaw") \
+  X(kGetLocale, "getLocale") \
+  X(kGetManufacturer, "getManufacturer") \
+  X(kGetMessageBus, "getMessageBus") \
+  X(kGetMessageBusConnection, "getMessageBusConnection") \
+  X(kGetMode, "getMode") \
+  X(kGetModel, "getModel") \
+  X(kGetNativeHelper, "getNativeHelper") \
+  X(kGetNativeTextBoxInfo, "getNativeTextBoxInfo") \
+  X(kGetOutputBlockSize, "getOutputBlockSize") \
+  X(kGetOutputSampleRate, "getOutputSampleRate") \
+  X(kGetPackageInfo, "getPackageInfo") \
+  X(kGetPackageManager, "getPackageManager") \
+  X(kGetPackageName, "getPackageName") \
+  X(kGetPath, "getPath") \
+  X(kGetPlaceholder, "getPlaceholder") \
+  X(kGetPlatformName, "getPlatformName") \
+  X(kGetPlatformSystemDialogHandler, "getPlatformSystemDialogHandler") \
+  X(kGetProduct, "getProduct") \
+  X(kGetProperty, "getProperty") \
+  X(kGetPublicIPv4Addresseses, "getPublicIPv4Addresseses") \
+  X(kGetRefreshRate, "getRefreshRate") \
+  X(kGetResources, "getResources") \
+  X(kGetRobloxLocale, "getRobloxLocale") \
+  X(kGetRootView, "getRootView") \
+  X(kGetRotation, "getRotation") \
+  X(kGetScreenHeight, "getScreenHeight") \
+  X(kGetScreenWidth, "getScreenWidth") \
+  X(kGetSdkVersion, "getSdkVersion") \
+  X(kGetSecureValue, "getSecureValue") \
+  X(kGetSecureValueForCurrentUser, "getSecureValueForCurrentUser") \
+  X(kGetSecureValueForUser, "getSecureValueForUser") \
+  X(kGetSettingsUrl, "getSettingsUrl") \
+  X(kGetSharedPreferences, "getSharedPreferences") \
+  X(kGetStreamMaxVolume, "getStreamMaxVolume") \
+  X(kGetStreamVolume, "getStreamVolume") \
+  X(kGetString, "getString") \
+  X(kGetSurface, "getSurface") \
+  X(kGetSystemDialogHandler, "getSystemDialogHandler") \
+  X(kGetSystemService, "getSystemService") \
+  X(kGetSystemTheme, "getSystemTheme") \
+  X(kGetTargetSdkVersion, "getTargetSdkVersion") \
+  X(kGetText, "getText") \
+  X(kGetTextBoxInfo, "getTextBoxInfo") \
+  X(kGetTheme, "getTheme") \
+  X(kGetUserId, "getUserId") \
+  X(kGetUsername, "getUsername") \
+  X(kGetUsers, "getUsers") \
+  X(kGetVideoCodecs, "getVideoCodecs") \
+  X(kGetWidth, "getWidth") \
+  X(kGetWindow, "getWindow") \
+  X(kGetWindowManager, "getWindowManager") \
+  X(kGetWWWBaseUrl, "getWWWBaseUrl") \
+  X(kGetWwwBaseUrl, "getWwwBaseUrl") \
+  X(kH, "h") \
+  X(kHasNext, "hasNext") \
+  X(kHasSystemFeature, "hasSystemFeature") \
+  X(kHideKeyboard, "hideKeyboard") \
+  X(kIdentityHashCode, "identityHashCode") \
+  X(kInit, "init") \
+  X(kInitPlayout, "initPlayout") \
+  X(kInitRecording, "initRecording") \
+  X(kIsAAudioSupported, "isAAudioSupported") \
+  X(kIsAudioConfigVerified, "isAudioConfigVerified") \
+  X(kIsAudioSourceMatchingRecordingSession, "isAudioSourceMatchingRecordingSession") \
+  X(kIsAvailable, "isAvailable") \
+  X(kIsBluetoothA2dpOn, "isBluetoothA2dpOn") \
+  X(kIsBluetoothOn, "isBluetoothOn") \
+  X(kIsBluetoothScoOn, "isBluetoothScoOn") \
+  X(kIsChangingConfigurations, "isChangingConfigurations") \
+  X(kIsCommunicationModeEnabled, "isCommunicationModeEnabled") \
+  X(kIsConnected, "isConnected") \
+  X(kIsDestroyed, "isDestroyed") \
+  X(kIsDeviceBlacklistedForOpenSLESUsage, "isDeviceBlacklistedForOpenSLESUsage") \
+  X(kIsEmpty, "isEmpty") \
+  X(kIsFinishing, "isFinishing") \
+  X(kIsLowLatencyInputSupported, "isLowLatencyInputSupported") \
+  X(kIsLowLatencyOutputSupported, "isLowLatencyOutputSupported") \
+  X(kIsProAudioSupported, "isProAudioSupported") \
+  X(kIsSystemThemeAvailable, "isSystemThemeAvailable") \
+  X(kIsValid, "isValid") \
+  X(kIterator, "iterator") \
+  X(kK1, "k1") \
+  X(kL0, "l0") \
+  X(kLength, "length") \
+  X(kLoadClass, "loadClass") \
+  X(kLowLatencyFlag, "lowLatencyFlag") \
+  X(kNanoTime, "nanoTime") \
+  X(kNativeGetCookiesForDomain, "nativeGetCookiesForDomain") \
+  X(kNativeGetCookiesInNetscapeFormat, "nativeGetCookiesInNetscapeFormat") \
+  X(kNativeGetTextBoxInfo, "nativeGetTextBoxInfo") \
+  X(kOnAppBridgeNotification, "onAppBridgeNotification") \
+  X(kOnDataModelNotificationCallback, "onDataModelNotificationCallback") \
+  X(kOnItemSet, "onItemSet") \
+  X(kOnLuaTextBoxChangedCallback, "onLuaTextBoxChangedCallback") \
+  X(kOnLuaTextBoxPropertyChangedCallback, "onLuaTextBoxPropertyChangedCallback") \
+  X(kOnSetCookie, "onSetCookie") \
+  X(kOpen, "open") \
+  X(kOpenNativeOverlay, "openNativeOverlay") \
+  X(kOpenWebActivity, "openWebActivity") \
+  X(kOptString, "optString") \
+  X(kOutputAAudioHeadphonesChanged, "OutputAAudioHeadphonesChanged") \
+  X(kProAudioFlag, "proAudioFlag") \
+  X(kQ, "q") \
+  X(kRequestOrientationAsDefault, "requestOrientationAsDefault") \
+  X(kRequestResponse, "requestResponse") \
+  X(kRestartInput, "restartInput") \
+  X(kRun, "run") \
+  X(kRunOnUiThread, "runOnUiThread") \
+  X(kSetAppBridgeNotificationListener, "setAppBridgeNotificationListener") \
+  X(kSetBaseUrl, "setBaseUrl") \
+  X(kSetCookie, "setCookie") \
+  X(kSetCookiesFromDisk, "setCookiesFromDisk") \
+  X(kSetCurrentUser, "setCurrentUser") \
+  X(kSetImeEditorInfoFields, "setImeEditorInfoFields") \
+  X(kSetImplementation, "setImplementation") \
+  X(kSetMicrophoneMute, "setMicrophoneMute") \
+  X(kSetRequestHandler, "setRequestHandler") \
+  X(kSetRequestHandlerRaw, "setRequestHandlerRaw") \
+  X(kSetSecureValue, "setSecureValue") \
+  X(kSetSecureValueForCurrentUser, "setSecureValueForCurrentUser") \
+  X(kSetSecureValueForUser, "setSecureValueForUser") \
+  X(kSetSoftKeyboardActive, "setSoftKeyboardActive") \
+  X(kSetState, "setState") \
+  X(kSetStreamVolume, "setStreamVolume") \
+  X(kSetWindowFlags, "setWindowFlags") \
+  X(kShowKeyboard, "showKeyboard") \
+  X(kShowLeaveAppPrompt, "showLeaveAppPrompt") \
+  X(kSize, "size") \
+  X(kStartPlayout, "startPlayout") \
+  X(kStartRecording, "startRecording") \
+  X(kStopPlayout, "stopPlayout") \
+  X(kStopRecording, "stopRecording") \
+  X(kSubscribe, "subscribe") \
+  X(kSubscribeProtocolMethodResponseRaw, "subscribeProtocolMethodResponseRaw") \
+  X(kSupportsAAudio, "supportsAAudio") \
+  X(kSupportsLowLatency, "supportsLowLatency") \
+  X(kSyncCookiesFromEngine, "syncCookiesFromEngine") \
+  X(kWrite, "write")
+
+enum class JniMethod : std::uint16_t {
+  kUnknown = 0,
+#define MOCKTAIL_JNI_METHOD_ENUMERATOR(id, name) id,
+  MOCKTAIL_JNI_METHOD_NAMES(MOCKTAIL_JNI_METHOD_ENUMERATOR)
+#undef MOCKTAIL_JNI_METHOD_ENUMERATOR
+};
+
+JniMethod LookupJniMethod(std::string_view name);
+
+}  // namespace jnivm::internal
+
+#endif  // MOCKTAIL_JNIVM_JNI_METHOD_NAMES_H_
@@ -222,14 +222,17 @@ void ReleaseJniReference(jobject obj) {
  if (g_shutting_down_jnivm) {
    return;
  }
+  // Every live object and array holds a count, so a handle without one was
+  // already released. Releasing it again would queue its slot twice.
  auto ref_it = g_jni_ref_counts.find(obj);
-  if (ref_it != g_jni_ref_counts.end()) {
-    if (ref_it->second > 1) {
-      --ref_it->second;
-      return;
-    }
-    g_jni_ref_counts.erase(ref_it);
+  if (ref_it == g_jni_ref_counts.end()) {
+    return;
  }
+  if (ref_it->second > 1) {
+    --ref_it->second;
+    return;
+  }
+  g_jni_ref_counts.erase(ref_it);

  auto arr_it = g_array_storage.find(reinterpret_cast<jarray>(obj));
  if (arr_it != g_array_storage.end()) {
@@ -31,7 +31,6 @@
 #include <sys/socket.h>
 #include <sys/time.h>
 #include <time.h>
-#include <execinfo.h>
 #include <ucontext.h>
 #include <elf.h>
 #include <fcntl.h>
@@ -70,6 +69,7 @@
 #include "runtime/jnivm_platform_web_callbacks.h"
 #include "runtime/owned_pthread.h"
 #include "runtime/platform_cache_migration.h"
+#include "runtime/asset_overlay_names.h"
 #include "runtime/roblox_app_lifecycle.h"
 #include "runtime/roblox_capability_resolver.h"
 #include "runtime/roblox_platform_web_symbols.h"
@@ -651,10 +651,10 @@ void ApplyRuntimeDefaults() {
  SetEnvDefault("MOCKTAIL_INIT_CLIENT_SETTINGS", "0");
  SetEnvDefault("MOCKTAIL_POST_CLIENT_SETTINGS", "0");
  SetEnvDefault("MOCKTAIL_ALLOW_NO_COOKIE_LUA_APP", "1");
-  // Current Roblox Android builds drive app startup through NativeGLInterface's
-  // V2 app bridge path. The legacy NativeAppBridgeInterface entry point stays
-  // available by opt-in, but running it in parallel can block V2 init.
-  SetEnvDefault("MOCKTAIL_APP_BRIDGE_APP_START", "0");
+  // nativeAppBridgeAppStart runs Roblox's StartupController, which builds the
+  // experimentation protocol that writes ClientSettings/IxpSettings.json. It
+  // runs inline before V2 init; on its own thread it can block V2 init.
+  SetEnvDefault("MOCKTAIL_APP_BRIDGE_APP_START", "1");
  SetEnvDefault("MOCKTAIL_APP_BRIDGE_APP_START_THREAD", "0");
  SetEnvDefault("MOCKTAIL_START_LUA_APP_DM", "1");
  SetEnvDefault("MOCKTAIL_START_LUA_APP_DM_INLINE", "0");
@@ -1964,6 +1964,48 @@ extern "C" void MocktailConstructorWrapper() {
  MaybePrintLibRobloxConstructorSummary(idx);
 }

+// Unmaps the rbxasset:// names that have a file in the asset overlay folder, so
+// Roblox opens those files instead of downloading the stock asset. Must run
+// before any libroblox code does: the segment loses PROT_EXEC while it is
+// written.
+void DisableOverlaidAssetMappings(uintptr_t base) {
+  const std::vector<std::string> names = mocktail::runtime::OverlayRbxAssetNames(
+      CurrentRuntimePaths().asset_overlay_dir());
+  const long page_size = sysconf(_SC_PAGESIZE);
+  if (names.empty() || page_size <= 0) {
+    return;
+  }
+  const auto* header = reinterpret_cast<const Elf64_Ehdr*>(base);
+  const auto* segments =
+      reinterpret_cast<const Elf64_Phdr*>(base + header->e_phoff);
+  std::size_t changed = 0;
+  for (std::size_t index = 0; index < header->e_phnum; ++index) {
+    const Elf64_Phdr& segment = segments[index];
+    if (segment.p_type != PT_LOAD || (segment.p_flags & PF_W) != 0 ||
+        segment.p_filesz == 0) {
+      continue;
+    }
+    const uintptr_t begin = base + segment.p_vaddr;
+    const uintptr_t page_mask = static_cast<uintptr_t>(page_size) - 1;
+    const uintptr_t page_begin = begin & ~page_mask;
+    const std::size_t span =
+        ((begin + segment.p_filesz + page_mask) & ~page_mask) - page_begin;
+    const int original =
+        PROT_READ | ((segment.p_flags & PF_X) != 0 ? PROT_EXEC : 0);
+    if (mprotect(reinterpret_cast<void*>(page_begin), span,
+                 PROT_READ | PROT_WRITE) != 0) {
+      continue;
+    }
+    changed += mocktail::runtime::DisableAssetNameMappings(
+        reinterpret_cast<std::uint8_t*>(begin), segment.p_filesz, names);
+    mprotect(reinterpret_cast<void*>(page_begin), span, original);
+  }
+  std::cout << "  [asset] overlay holds " << names.size()
+            << " rbxasset file(s); unmapped " << changed
+            << " download name(s)\n"
+            << std::flush;
+}
+
 extern "C" void mocktail_before_soinfo_constructors(const char* realpath,
                                                    uintptr_t base) {
  if (realpath == nullptr || std::strstr(realpath, "libroblox.so") == nullptr ||
@@ -1972,6 +2014,7 @@ extern "C" void mocktail_before_soinfo_constructors(const char* realpath,
  }

  g_libroblox_base = base;
+  DisableOverlaidAssetMappings(base);
  g_mocktail_abort_libroblox_base = base;
  g_libroblox_base_static = base;

@@ -135,6 +135,7 @@ bool IsBionicLibcOnlySymbol(std::string_view symbol) {
  return symbol == "__cmsg_nxthdr" || symbol == "__cxa_thread_atexit_impl" ||
         symbol == "__readlink_chk" || symbol == "__register_atfork" ||
         symbol == "arc4random_buf" || symbol == "geteuid" ||
+         (!mocktail::compat::kHostAtoiMatchesBionic && symbol == "atoi") ||
         symbol == "getuid" || symbol == "lseek64" ||
         symbol == "mallinfo" || symbol == "pread64" || symbol == "pwrite64" ||
         symbol == "sigaction" || symbol == "strerror_r" ||
@@ -384,6 +385,10 @@ void RegisterBionicHostLibcRuntimeForLibc() {
  RegisterSyntheticSymbol("libc.so", "arc4random_buf",
                          reinterpret_cast<void*>(
                              mocktail_bionic_arc4random_buf));
+  if (!mocktail::compat::kHostAtoiMatchesBionic) {
+    RegisterSyntheticSymbol("libc.so", "atoi",
+                            reinterpret_cast<void*>(mocktail_bionic_atoi));
+  }
  RegisterSyntheticSymbol("libc.so", "mallinfo",
                          reinterpret_cast<void*>(mocktail_bionic_mallinfo));
  RegisterSyntheticSymbol("libc.so", "sysinfo",
@@ -0,0 +1,64 @@
+#include "runtime/asset_overlay_names.h"
+
+#include <algorithm>
+#include <cstring>
+#include <system_error>
+
+namespace mocktail {
+namespace runtime {
+
+std::vector<std::string> OverlayRbxAssetNames(
+    const std::filesystem::path& overlay_dir) {
+  std::vector<std::string> names;
+  const std::filesystem::path content = overlay_dir / "content";
+  std::error_code error;
+  std::filesystem::recursive_directory_iterator it(
+      content, std::filesystem::directory_options::skip_permission_denied,
+      error);
+  const std::filesystem::recursive_directory_iterator end;
+  for (; !error && it != end; it.increment(error)) {
+    std::error_code entry_error;
+    if (!it->is_regular_file(entry_error)) {
+      continue;
+    }
+    const std::filesystem::path relative =
+        it->path().lexically_relative(content);
+    names.push_back("rbxasset://" + relative.generic_string());
+  }
+  std::sort(names.begin(), names.end());
+  return names;
+}
+
+std::size_t DisableAssetNameMappings(std::uint8_t* data, std::size_t size,
+                                     const std::vector<std::string>& names) {
+  std::size_t changed = 0;
+  if (data == nullptr) {
+    return changed;
+  }
+  std::uint8_t* const end = data + size;
+  for (const std::string& name : names) {
+    // The trailing NUL is part of the needle, so a longer string never matches.
+    const std::size_t needle_size = name.size() + 1;
+    if (name.empty() || needle_size > size) {
+      continue;
+    }
+    std::uint8_t* cursor = data;
+    while (cursor + needle_size <= end) {
+      auto* found = static_cast<std::uint8_t*>(
+          memmem(cursor, static_cast<std::size_t>(end - cursor), name.c_str(),
+                 needle_size));
+      if (found == nullptr) {
+        break;
+      }
+      if (found == data || found[-1] == 0) {
+        found[0] = '!';
+        ++changed;
+      }
+      cursor = found + needle_size;
+    }
+  }
+  return changed;
+}
+
+}  // namespace runtime
+}  // namespace mocktail
@@ -10,6 +10,7 @@
 #include <sys/eventfd.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
+#include <sys/time.h>
 #include <sys/un.h>
 #include <unistd.h>

@@ -12,6 +12,7 @@
 #include <string_view>
 #include <system_error>
 #include <unistd.h>
+#include <utility>
 #include <vector>

 namespace mocktail {
@@ -45,11 +46,9 @@ constexpr const char* kForeignArchitectures[] = {
 };
 #endif

-struct HostGpus {
-  bool intel = false;
-  bool nvidia = false;
-  bool amd = false;
-};
+constexpr unsigned int kPciVendorAmd = 0x1002;
+constexpr unsigned int kPciVendorNvidia = 0x10de;
+constexpr unsigned int kPciVendorIntel = 0x8086;

 bool ForeignArchitecture(const std::string& name) {
  for (const char* architecture : kForeignArchitectures) {
@@ -110,75 +109,86 @@ bool ParsePciVendor(const std::string& raw, unsigned int* vendor) {
  return true;
 }

-HostGpus DetectHostGpus() {
-  HostGpus gpus;
+std::vector<HostGpu> DetectHostGpus() {
+  std::vector<HostGpu> gpus;
  for (int index = 0; index < 16; ++index) {
-    const std::string path = "/sys/class/drm/card" + std::to_string(index) +
-                             "/device/vendor";
-    std::ifstream input(path);
+    const std::string device =
+        "/sys/class/drm/card" + std::to_string(index) + "/device";
+    std::ifstream input(device + "/vendor");
    std::string raw;
-    unsigned int vendor = 0;
-    if (!(input >> raw) || !ParsePciVendor(raw, &vendor)) {
+    HostGpu gpu;
+    if (!(input >> raw) || !ParsePciVendor(raw, &gpu.vendor)) {
      continue;
    }
-    if (vendor == 0x8086) {
-      gpus.intel = true;
-    } else if (vendor == 0x10de) {
-      gpus.nvidia = true;
-    } else if (vendor == 0x1002) {
-      gpus.amd = true;
+    std::error_code error;
+    const std::filesystem::path driver =
+        std::filesystem::read_symlink(device + "/driver", error);
+    if (!error) {
+      gpu.kernel_driver = driver.filename().string();
    }
+    gpus.push_back(std::move(gpu));
  }
  return gpus;
 }

-std::string FindIcdFile(const char* filename_needle) {
-  if (filename_needle == nullptr || filename_needle[0] == '\0') {
-    return {};
-  }
-  std::vector<std::filesystem::path> directories;
-  for (const char* directory : kIcdDirectories) {
-    directories.emplace_back(directory);
-  }
-  return SelectVulkanIcdManifest(directories, filename_needle);
+bool HasVendor(const std::vector<HostGpu>& gpus, unsigned int vendor) {
+  return std::any_of(gpus.begin(), gpus.end(), [vendor](const HostGpu& gpu) {
+    return gpu.vendor == vendor;
+  });
 }

-std::string SelectHardwareIcd(const HostGpus& gpus) {
-  const bool prefer_discrete = !EnvIsOff("DRI_PRIME") &&
-                               !EnvIsOff("__NV_PRIME_RENDER_OFFLOAD");
-  if (prefer_discrete && gpus.nvidia) {
-    std::string nvidia = FindIcdFile("nvidia_icd");
-    if (nvidia.empty()) {
-      nvidia = FindIcdFile("nouveau_icd");
-    }
-    if (!nvidia.empty()) {
-      return nvidia;
-    }
+const char* VendorName(unsigned int vendor) {
+  switch (vendor) {
+    case kPciVendorAmd:
+      return "AMD";
+    case kPciVendorNvidia:
+      return "NVIDIA";
+    case kPciVendorIntel:
+      return "Intel";
+    default:
+      return "unknown";
  }
-  if (prefer_discrete && gpus.amd) {
-    const std::string amd = FindIcdFile("radeon_icd");
-    if (!amd.empty()) {
-      return amd;
-    }
+}
+
+// ICD manifest names that can drive `gpu`, best first. Empty when the bound
+// kernel driver has no Vulkan driver at all.
+std::vector<const char*> VulkanIcdsFor(const HostGpu& gpu) {
+  switch (gpu.vendor) {
+    case kPciVendorNvidia:
+      if (gpu.kernel_driver == "nvidia") {
+        return {"nvidia_icd"};
+      }
+      if (gpu.kernel_driver == "nouveau") {
+        return {"nouveau_icd"};
+      }
+      return {"nvidia_icd", "nouveau_icd"};
+    case kPciVendorAmd:
+      // RADV needs the amdgpu kernel driver.
+      if (gpu.kernel_driver == "radeon") {
+        return {};
+      }
+      return {"radeon_icd"};
+    case kPciVendorIntel:
+      return {"intel_icd", "intel_hasvk_icd"};
+    default:
+      return {};
  }
-  if (gpus.intel) {
-    std::string intel = FindIcdFile("intel_icd");
-    if (intel.empty()) {
-      intel = FindIcdFile("intel_hasvk_icd");
-    }
-    return intel;
+}
+
+std::string SkipReason(const HostGpu& gpu,
+                       const std::vector<const char*>& icds) {
+  std::string reason = std::string(VendorName(gpu.vendor)) + " card";
+  if (!gpu.kernel_driver.empty()) {
+    reason += " on the \"" + gpu.kernel_driver + "\" kernel driver";
  }
-  if (gpus.nvidia) {
-    std::string nvidia = FindIcdFile("nvidia_icd");
-    if (nvidia.empty()) {
-      nvidia = FindIcdFile("nouveau_icd");
-    }
-    return nvidia;
+  if (icds.empty()) {
+    return reason + " has no Vulkan support";
  }
-  if (gpus.amd) {
-    return FindIcdFile("radeon_icd");
+  reason += " has no installed Vulkan driver (looked for";
+  for (const char* icd : icds) {
+    reason += std::string(" ") + icd;
  }
-  return {};
+  return reason + ")";
 }

 // Match Mesa ANV: 75% of RAM when the machine has more than 4GiB, else 50%.
@@ -197,7 +207,8 @@ const char* AnvSysMemLimitPercent() {
  return "50";
 }

-bool ApplyVulkanIcdPolicy(const HostGpus& gpus, std::string* error) {
+bool ApplyVulkanIcdPolicy(const std::vector<HostGpu>& gpus,
+                          std::string* error) {
  // Drop software/emulation ICDs even when the user already pinned a driver
  // list. Old loaders ignore this variable.
  if (!SetDefault("VK_LOADER_DRIVERS_DISABLE",
@@ -210,17 +221,61 @@ bool ApplyVulkanIcdPolicy(const HostGpus& gpus, std::string* error) {
      (existing_icds != nullptr && existing_icds[0] != '\0')) {
    return true;
  }
-  const std::string icd = SelectHardwareIcd(gpus);
-  if (icd.empty()) {
+  std::vector<std::filesystem::path> directories;
+  for (const char* directory : kIcdDirectories) {
+    directories.emplace_back(directory);
+  }
+  const bool prefer_discrete = !EnvIsOff("DRI_PRIME") &&
+                               !EnvIsOff("__NV_PRIME_RENDER_OFFLOAD");
+  const VulkanIcdSelection selection =
+      SelectHostVulkanIcd(gpus, directories, prefer_discrete);
+  for (const std::string& reason : selection.skipped) {
+    std::fprintf(stderr, "  [runtime] vulkan: %s\n", reason.c_str());
+  }
+  if (selection.manifest.empty()) {
+    if (!selection.skipped.empty()) {
+      std::fprintf(stderr,
+                   "  [runtime] vulkan: no GPU here can run Vulkan; set "
+                   "graphics.backend: opengl in the config\n");
+    }
    return true;
  }
-  std::fprintf(stderr, "  [runtime] vulkan ICD=%s\n", icd.c_str());
-  return SetDefault("VK_DRIVER_FILES", icd, error) &&
-         SetDefault("VK_ICD_FILENAMES", icd, error);
+  std::fprintf(stderr, "  [runtime] vulkan ICD=%s\n",
+               selection.manifest.c_str());
+  return SetDefault("VK_DRIVER_FILES", selection.manifest, error) &&
+         SetDefault("VK_ICD_FILENAMES", selection.manifest, error);
 }

 }  // namespace

+VulkanIcdSelection SelectHostVulkanIcd(
+    const std::vector<HostGpu>& gpus,
+    const std::vector<std::filesystem::path>& directories,
+    bool prefer_discrete) {
+  constexpr unsigned int kDiscreteFirst[] = {kPciVendorNvidia, kPciVendorAmd,
+                                             kPciVendorIntel};
+  constexpr unsigned int kIntegratedFirst[] = {
+      kPciVendorIntel, kPciVendorNvidia, kPciVendorAmd};
+  VulkanIcdSelection selection;
+  for (const unsigned int vendor :
+       prefer_discrete ? kDiscreteFirst : kIntegratedFirst) {
+    for (const HostGpu& gpu : gpus) {
+      if (gpu.vendor != vendor) {
+        continue;
+      }
+      const std::vector<const char*> icds = VulkanIcdsFor(gpu);
+      for (const char* icd : icds) {
+        selection.manifest = SelectVulkanIcdManifest(directories, icd);
+        if (!selection.manifest.empty()) {
+          return selection;
+        }
+      }
+      selection.skipped.push_back(SkipReason(gpu, icds));
+    }
+  }
+  return selection;
+}
+
 std::string SelectVulkanIcdManifest(
    const std::vector<std::filesystem::path>& directories,
    std::string_view vendor) {
@@ -291,7 +346,7 @@ bool ApplyGraphicsLaunchPolicy(const RuntimeConfig& config,
  if (direct_vulkan) {
    const char* wsi_mode =
        UnthrottledPresentation(config) ? "immediate" : "mailbox";
-    const HostGpus gpus = DetectHostGpus();
+    const std::vector<HostGpu> gpus = DetectHostGpus();
    if (!SetDefault("MOCKTAIL_CLIENT_SETTINGS_OVERRIDES_JSON",
                    kVulkanClientSettingsOverrides, error) ||
        !SetDefault("ANV_SYS_MEM_LIMIT", AnvSysMemLimitPercent(), error) ||
@@ -304,7 +359,9 @@ bool ApplyGraphicsLaunchPolicy(const RuntimeConfig& config,
    }
    // Low FRM only on Intel-only machines. Hybrid NVIDIA/AMD laptops should
    // keep the desktop quality default on the discrete GPU.
-    if (gpus.intel && !gpus.nvidia && !gpus.amd &&
+    if (HasVendor(gpus, kPciVendorIntel) &&
+        !HasVendor(gpus, kPciVendorNvidia) &&
+        !HasVendor(gpus, kPciVendorAmd) &&
        !SetDefault("MOCKTAIL_GRAPHICS_QUALITY", "1", error)) {
      return false;
    }
@@ -243,7 +243,9 @@ bool MergePerformanceClientSettingsOverrides(

    // ForceCacheSize settings are byte counts. Let Roblox size its mesh and
    // SLIM content caches; values like 256/128 would cap them to a few bytes.
-    const std::array<ClientSetting, 68> rendering_settings = {{
+    // Leave MSAA selection to Roblox or explicit client-settings overrides.
+    // Forcing one sample disables anti-aliasing even at maximum quality.
+    const std::array<ClientSetting, 67> rendering_settings = {{
        {"FIntSmoothClusterTaskQueueMaxParallelTasks", workers},
        {"FIntOcclusionWorkerThreadCount", occlusion_workers},
        {"FFlagMovePrerenderV2", "True"},
@@ -300,7 +302,6 @@ bool MergePerformanceClientSettingsOverrides(
        {"FFlagRenderAllocateShadowMapResourcesOnDemand", "True"},
        {"FIntRenderShadowMapDepthCacheMemLimit", "16"},
        {"FIntTM2ShadowMapMaxMips", "1"},
-        {"FIntDebugForceMSAASamples", "1"},
        {"FFlagLuauStartupGcSuppression", "False"},
        {"FIntLuauGcStepMul", "300"},
        {"FIntLuauGcGoalCore", "120"},
@@ -361,6 +361,10 @@ bool MergeDesktopAppPolicyClientSettingsOverride(std::string_view policy_json,
  // leave the whole LuaApp blank. Default to the working legacy page while
  // preserving explicit user overrides for testing newer UI patches.
  overrides.emplace("FFlagLuaAppChartsAppPage", "False");
+  // Roblox enrolls desktop clients in the flyout side panel through a
+  // server-side experiment that does not reach this client. Variant 2 is the
+  // desktop side panel; an explicit user override is preserved.
+  overrides.emplace("FIntFlyoutTestVariantRollout12", "2");
  *merged_json = overrides.dump();
  return true;
 }
@@ -125,6 +125,16 @@ RobloxPlatformWebSymbols ResolveRobloxPlatformWebSymbols(
          roblox_library,
          "Java_com_roblox_universalapp_cookie_JNICookieProtocol_"
          "updateOnSetCookieHandler");
+  symbols.web_view.send_app_event_on_game_loaded =
+      Resolve<SendRobloxAppEventOnGameLoadedFn>(
+          roblox_library,
+          "Java_com_roblox_engine_jni_NativeGLInterface_"
+          "nativeAppBridgeV2SendAppEventOnGameLoaded");
+  symbols.web_view.send_app_event_on_app_ready =
+      Resolve<SendRobloxAppEventOnAppReadyFn>(
+          roblox_library,
+          "Java_com_roblox_engine_jni_NativeGLInterface_"
+          "nativeAppBridgeV2SendAppEventOnAppReady");

  symbols.browser_service.bind = Resolve<BindRobloxMemStorageFn>(
      roblox_library, "Java_com_roblox_engine_jni_memstorage_MemStorage_bind");
@@ -36,6 +36,8 @@ constexpr char kNativeGlInterfaceClass[] =
    "com/roblox/engine/jni/NativeGLInterface";
 constexpr char kConnectionPointerField[] = "a";
 constexpr std::size_t kMaximumPendingHostWindowEvents = 256;
+// Digits of the largest signed 64-bit user id.
+constexpr std::size_t kMaximumRobloxUserIdDigits = 19;
 constexpr std::string_view kBrowserLoginUrl = "https://www.roblox.com/login";

 bool EqualsIgnoreCase(std::string_view a, std::string_view b) {
@@ -96,6 +98,21 @@ bool IsLoginChallengeUrl(std::string_view url) {
  return false;
 }

+// A positive decimal that fits a signed 64-bit integer, without sign, spaces
+// or leading zero.
+bool IsRobloxUserId(std::string_view value) {
+  constexpr std::string_view kLargest = "9223372036854775807";
+  if (value.empty() || value.size() > kLargest.size() || value[0] == '0') {
+    return false;
+  }
+  for (const char digit : value) {
+    if (digit < '0' || digit > '9') {
+      return false;
+    }
+  }
+  return value.size() < kLargest.size() || value <= kLargest;
+}
+
 Status Invalid(std::string message) {
  return Status::Error(StatusCode::kInvalidArgument, std::move(message));
 }
@@ -1355,7 +1372,20 @@ void RobloxWebViewBridge::QueueHostWindowEvent(HostWindowEventType type,
                 "  [webview] pending host event queue overflow; preserving "
                 "newest lifecycle state\n");
  }
-  pending_host_window_events_.push_back({type, generation});
+  pending_host_window_events_.push_back({type, generation, {}});
+}
+
+void RobloxWebViewBridge::QueueStartConversation(std::string user_id) {
+  std::lock_guard<std::mutex> lock(host_window_event_mutex_);
+  if (pending_host_window_events_.size() == kMaximumPendingHostWindowEvents) {
+    pending_host_window_events_.pop_front();
+    std::fprintf(stderr,
+                 "  [webview] pending host event queue overflow; preserving "
+                 "newest lifecycle state\n");
+  }
+  pending_host_window_events_.push_back(
+      {HostWindowEventType::kStartConversationWithUser, 0,
+       std::move(user_id)});
 }

 Status RobloxWebViewBridge::DrainHostWindowEvents() {
@@ -1418,8 +1448,24 @@ Status RobloxWebViewBridge::DrainHostWindowEvents() {
        }
        break;
      }
+      case HostWindowEventType::kStartConversationWithUser: {
+        // A failed send is dropped, not retried: the click that asked for
+        // the conversation is stale by the next drain.
+        const Status sent = SendStartConversationEvents(env, event.user_id);
+        if (sent.ok()) {
+          std::fprintf(stderr,
+                       "  [app-shell] Chat opened with a conversation "
+                       "request\n");
+        } else {
+          std::fprintf(stderr,
+                       "  [app-shell] conversation request failed: %s\n",
+                       sent.message().c_str());
+        }
+        break;
+      }
    }
-    if (status.ok() && event.type != HostWindowEventType::kDataModelUnfocused) {
+    if (status.ok() && event.type != HostWindowEventType::kDataModelUnfocused &&
+        event.type != HostWindowEventType::kStartConversationWithUser) {
      const std::shared_ptr<HostWindowCloseTarget> target =
          host_window_close_target_;
      if (target != nullptr) {
@@ -1472,6 +1518,28 @@ Status RobloxWebViewBridge::HandleDataModelNotification(JNIEnv* env,
                                        OpenSource::kDataModelNotification);
  }

+  if (owned_type == kRobloxLaunchConversationNotification) {
+    std::string user_id;
+    status = CopyJniString(env, data, kMaximumRobloxUserIdDigits,
+                           "conversation user id", &user_id);
+    if (!status.ok()) {
+      return status;
+    }
+    if (!IsRobloxUserId(user_id)) {
+      return Invalid("LAUNCH_CONVERSATION payload is not a user id");
+    }
+    if (symbols_.send_app_event_on_game_loaded == nullptr ||
+        symbols_.send_app_event_on_app_ready == nullptr) {
+      return Unavailable("Roblox app event entrypoints are unavailable");
+    }
+    std::fprintf(stderr,
+                 "  [app-shell] LAUNCH_CONVERSATION notification received\n");
+    // The engine is inside its notification callback. The reply is sent from
+    // the next host event drain, as Android posts it to its main thread.
+    QueueStartConversation(std::move(user_id));
+    return Status::Ok();
+  }
+
  RobloxWebViewOpenRequest request;
  if (owned_type == kRobloxViewProfileNotification) {
    std::string owned_url;
@@ -1652,6 +1720,53 @@ Status RobloxWebViewBridge::BroadcastDataModelFocus(JNIEnv *env,
  return CheckJniException(env, "broadcast AppInput DataModel focus event");
 }

+// Mirrors the Android app shell's reply to LAUNCH_CONVERSATION: switch the
+// Lua app to its Chat destination, then ask Chat to start the conversation
+// once that app reports ready.
+Status RobloxWebViewBridge::SendStartConversationEvents(
+    JNIEnv* env, const std::string& user_id) {
+  if (env == nullptr || symbols_.send_app_event_on_game_loaded == nullptr ||
+      symbols_.send_app_event_on_app_ready == nullptr) {
+    return Unavailable("Roblox app event entrypoints are unavailable");
+  }
+  jclass native_gl_class = env->FindClass(kNativeGlInterfaceClass);
+  const std::array<jstring, 7> strings = {
+      env->NewStringUTF("Navigations"),
+      env->NewStringUTF(R"({"appName":"Chat"})"),
+      env->NewStringUTF("Destination"),
+      env->NewStringUTF("AppShellNotifications"),
+      env->NewStringUTF(user_id.c_str()),
+      env->NewStringUTF("StartConversationWithUserId"),
+      env->NewStringUTF("Chat"),
+  };
+  bool allocated = native_gl_class != nullptr;
+  for (jstring value : strings) {
+    allocated = allocated && value != nullptr;
+  }
+  Status status = allocated
+                      ? Status::Ok()
+                      : Unavailable("could not allocate conversation events");
+  if (status.ok()) {
+    symbols_.send_app_event_on_game_loaded(env, native_gl_class, strings[0],
+                                           strings[1], strings[2]);
+    status = CheckJniException(env, "send Chat destination app event");
+  }
+  if (status.ok()) {
+    symbols_.send_app_event_on_app_ready(env, native_gl_class, strings[3],
+                                         strings[4], strings[5], strings[6]);
+    status = CheckJniException(env, "send start conversation app event");
+  }
+  for (jstring value : strings) {
+    if (value != nullptr) {
+      env->DeleteLocalRef(value);
+    }
+  }
+  if (native_gl_class != nullptr) {
+    env->DeleteLocalRef(native_gl_class);
+  }
+  return status;
+}
+
 Status RobloxWebViewBridge::BeginDispatch() {
  std::lock_guard<std::mutex> lock(mutex_);
  if ((!initializing_ && !initialized_) || !accepting_messages_) {
@@ -349,6 +349,14 @@ RuntimePaths RuntimePaths::FromEnvironment(
  paths.cookie_file_ = paths.auth_root_ / "roblox.cookie";
  paths.use_real_sober_paths_ =
      LegacyEnabled(environment, "MOCKTAIL_USE_REAL_SOBER_PATHS");
+  if (environment.HasNonEmpty("MOCKTAIL_ASSET_OVERLAY_DIR")) {
+    paths.asset_overlay_dir_ =
+        environment.GetOr("MOCKTAIL_ASSET_OVERLAY_DIR", "");
+  } else {
+    paths.asset_overlay_dir_ = paths.DefaultSoberAwarePath(
+        paths.sober_data_root_ / "asset_overlay",
+        paths.data_root_ / "asset_overlay");
+  }
  return paths;
 }

@@ -593,7 +601,8 @@ bool ExportRuntimePathEnvironment(const RuntimePaths& paths,
  std::error_code filesystem_error;
  for (const std::filesystem::path& directory :
       {paths.android_runtime_root(), paths.android_cache_root(),
-        paths.vulkan_shader_cache_file().parent_path()}) {
+        paths.vulkan_shader_cache_file().parent_path(),
+        paths.asset_overlay_dir()}) {
    if (!RuntimePaths::EnsureDirectory(directory, &filesystem_error)) {
      if (error != nullptr) {
        *error = "cannot create resolved runtime path: " + directory.string();
@@ -609,7 +618,9 @@ bool ExportRuntimePathEnvironment(const RuntimePaths& paths,
         SetEnvironmentDefault("MOCKTAIL_VULKAN_SHADER_CACHE_HOST_PATH",
                               paths.vulkan_shader_cache_file(), error) &&
         SetEnvironmentDefault("MOCKTAIL_TEXTURE_OVERRIDE_DIR",
-                               paths.config_root() / "textures", error);
+                               paths.config_root() / "textures", error) &&
+         SetEnvironmentDefault("MOCKTAIL_ASSET_OVERLAY_DIR",
+                               paths.asset_overlay_dir(), error);
 }

 bool PrepareManagedPayloadWorkingDirectory(const RuntimePaths& paths,
@@ -12,6 +12,7 @@
 #include <array>
 #include <cctype>
 #include <cerrno>
+#include <chrono>
 #include <cstdint>
 #include <cstdio>
 #include <cstring>
@@ -707,6 +708,28 @@ std::string SessionLog::Header(const Environment& environment,
  return output.str();
 }

+namespace {
+
+constexpr std::chrono::seconds kLoggerExitTimeout(2);
+
+// The writer exits once every copy of the pipe write ends is closed, and a
+// child process can hold one open. Past the timeout it is killed so that
+// shutdown cannot hang.
+void ReapLogger(pid_t child) {
+  const auto deadline = std::chrono::steady_clock::now() + kLoggerExitTimeout;
+  for (;;) {
+    const pid_t reaped = waitpid(child, nullptr, WNOHANG);
+    if (reaped == child || (reaped < 0 && errno != EINTR)) return;
+    if (std::chrono::steady_clock::now() >= deadline) break;
+    std::this_thread::sleep_for(std::chrono::milliseconds(1));
+  }
+  (void)kill(child, SIGKILL);
+  while (waitpid(child, nullptr, 0) < 0 && errno == EINTR) {
+  }
+}
+
+}  // namespace
+
 void SessionLog::Stop() {
  if (!active_) return;
  std::cout.flush();
@@ -718,9 +741,7 @@ void SessionLog::Stop() {
  close(original_stderr_);
  original_stdout_ = -1;
  original_stderr_ = -1;
-  const pid_t child = static_cast<pid_t>(logger_process_);
-  while (waitpid(child, nullptr, 0) < 0 && errno == EINTR) {
-  }
+  ReapLogger(static_cast<pid_t>(logger_process_));
  logger_process_ = -1;
  active_ = false;
 }
@@ -53,6 +53,14 @@ bool ReadStorage(const std::filesystem::path& path, nlohmann::json* storage,
    *storage = nlohmann::json::object();
    return !filesystem_error;
  }
+  // The storage directory may have been writable by other users, so a file
+  // another user owns, a symlink, or a second hard link is not trusted.
+  struct stat metadata = {};
+  if (lstat(path.c_str(), &metadata) != 0 || !S_ISREG(metadata.st_mode) ||
+      metadata.st_uid != geteuid() || metadata.st_nlink != 1) {
+    *error = "appStorage is not a private regular file";
+    return false;
+  }
  const auto size = std::filesystem::file_size(path, filesystem_error);
  if (filesystem_error || size > kMaximumStorageBytes) {
    *error = "appStorage is unavailable or exceeds the size limit";
@@ -193,6 +201,23 @@ bool IsPrivateDirectory(const struct stat& metadata) {
         (metadata.st_mode & (S_IWGRP | S_IWOTH)) == 0;
 }

+// Removes group and world write access from a directory this user owns.
+// Roblox creates its storage directories with the process umask, which is 002
+// on many desktops. A directory owned by another user is left untouched.
+void TightenOwnedDirectory(const std::filesystem::path& directory) {
+  const int descriptor = open(directory.c_str(),
+                              O_RDONLY | O_DIRECTORY | O_CLOEXEC | O_NOFOLLOW);
+  if (descriptor < 0) return;
+  struct stat metadata = {};
+  if (fstat(descriptor, &metadata) == 0 && S_ISDIR(metadata.st_mode) &&
+      metadata.st_uid == geteuid() &&
+      (metadata.st_mode & (S_IWGRP | S_IWOTH)) != 0) {
+    (void)fchmod(descriptor,
+                 (metadata.st_mode & 07777) & ~(S_IWGRP | S_IWOTH));
+  }
+  close(descriptor);
+}
+
 bool FindExistingDirectoryAncestor(const std::filesystem::path& directory,
                                   std::filesystem::path* ancestor) {
  if (directory.empty() || ancestor == nullptr) return false;
@@ -491,6 +516,7 @@ BrowserTrackerResult BrowserTrackerService::EnsureInitialized(
    return result;
  }
  const bool lock_parent_existed = existing_lock_ancestor == lock_parent;
+  if (lock_parent_existed) TightenOwnedDirectory(lock_parent);
  const bool lock_parent_created =
      CreatePrivateDirectories(lock_parent, existing_lock_ancestor);
  struct stat lock_parent_status = {};
@@ -537,10 +563,14 @@ BrowserTrackerResult BrowserTrackerService::EnsureInitialized(

  const auto existing = storage.find("BrowserTrackerId");
  std::string stored_id;
+  // Roblox stores "0" when it starts without a tracker identity.
+  const bool stored_unset =
+      existing != storage.end() && existing->is_string() &&
+      existing->get_ref<const std::string&>() == "0";
  if (existing != storage.end() && existing->is_string() &&
      IsValidId(existing->get_ref<const std::string&>())) {
    stored_id = existing->get<std::string>();
-  } else if (existing != storage.end()) {
+  } else if (existing != storage.end() && !stored_unset) {
    result.error = "appStorage BrowserTrackerId is invalid";
    close(lock);
    return result;
@@ -887,6 +887,10 @@ struct SignatureSpec {
  bool registry_size_may_change = false;
  std::size_t minimum_anchor_bytes = 6;
  std::array<std::size_t, 2> registry_size_indices = {8, 12};
+  // Instructions whose register operands the compiler may have chosen
+  // differently. Each reference register must stand for one candidate
+  // register across all of them, and the reverse.
+  std::vector<std::size_t> renamed_register_indices = {};
 };

 struct SignatureMatch {
@@ -895,10 +899,46 @@ struct SignatureMatch {
  std::vector<Instruction> candidate;
 };

+// The 64-bit register that `name` is all or part of, such as rax for eax.
+std::string RegisterFamily(std::string_view name) {
+  if (name.size() >= 2 && name[0] == 'r' && name[1] >= '0' && name[1] <= '9') {
+    while (!name.empty() && (name.back() < '0' || name.back() > '9')) {
+      name.remove_suffix(1);
+    }
+    return std::string(name);
+  }
+  for (const std::string_view family :
+       {"ax", "bx", "cx", "dx", "si", "di", "bp", "sp"}) {
+    if (name == family || (name.size() == 3 && name.substr(1) == family &&
+                           (name[0] == 'e' || name[0] == 'r'))) {
+      return "r" + std::string(family);
+    }
+  }
+  return std::string(name);
+}
+
+// Reference register families and the candidate families that stand for them.
+struct RegisterRenames {
+  std::map<std::string, std::string> forward;
+  std::map<std::string, std::string> backward;
+
+  bool Accept(std::string_view reference, std::string_view candidate) {
+    const std::string left = RegisterFamily(reference);
+    const std::string right = RegisterFamily(candidate);
+    const auto forward_found = forward.emplace(left, right).first;
+    const auto backward_found = backward.emplace(right, left).first;
+    return forward_found->second == right && backward_found->second == left;
+  }
+};
+
 bool SameSemanticOperand(const Operand& left, const Operand& right,
-                         bool control_flow, bool wildcard_size) {
+                         bool control_flow, bool wildcard_size,
+                         RegisterRenames* renames = nullptr) {
  if (left.type != right.type || left.size != right.size) return false;
  if (left.type == Operand::Type::kRegister) {
+    if (renames != nullptr) {
+      return renames->Accept(left.register_name, right.register_name);
+    }
    return left.register_name == right.register_name;
  }
  if (left.type == Operand::Type::kImmediate) {
@@ -918,6 +958,7 @@ bool ValidateSemantics(const std::vector<Instruction>& reference,
    *error = "normalized signature instruction count changed";
    return false;
  }
+  RegisterRenames renames;
  for (std::size_t index = 0; index < reference.size(); ++index) {
    const Instruction& left = reference[index];
    const Instruction& right = candidate[index];
@@ -925,6 +966,10 @@ bool ValidateSemantics(const std::vector<Instruction>& reference,
        spec.registry_size_may_change &&
        (index == spec.registry_size_indices[0] ||
         index == spec.registry_size_indices[1]);
+    const bool renamed =
+        std::find(spec.renamed_register_indices.begin(),
+                  spec.renamed_register_indices.end(),
+                  index) != spec.renamed_register_indices.end();
    if (left.mnemonic != right.mnemonic ||
        left.operands.size() != right.operands.size()) {
      *error = "normalized instruction semantics changed at index " +
@@ -933,7 +978,8 @@ bool ValidateSemantics(const std::vector<Instruction>& reference,
    }
    for (std::size_t operand = 0; operand < left.operands.size(); ++operand) {
      if (!SameSemanticOperand(left.operands[operand], right.operands[operand],
-                               left.control_flow, wildcard)) {
+                               left.control_flow, wildcard,
+                               renamed ? &renames : nullptr)) {
        *error = "normalized instruction operand changed at index " +
                 std::to_string(index);
        return false;
@@ -1569,6 +1615,74 @@ std::optional<std::uint64_t> FindRegistryFunctionEntry(
  return entries.front();
 }

+// Finds the registry initializer body when a rebuild holds its temporaries in
+// other registers, which changes the bytes the exact search needs.
+//
+// The body allocates the registry, clears it, and starts filling it:
+//
+//    0  mov edi, SIZE          6  xor esi, esi
+//    1  call allocate          7  call memset
+//    2  mov rbx, rax           8  mov ONE, 0x3f800000
+//    3  xor ZERO, ZERO         9  mov dword ptr [rbx + 0x20], ONE
+//    4  mov edx, SIZE         10  lea FIELD, [rbx + 0x28]
+//    5  mov rdi, rax
+//
+// ZERO, ONE and FIELD are the compiler's choice. Instructions 4 to 7 use
+// registers the calling convention fixes, so they are searched for by bytes
+// and every hit is then checked against all eleven instructions.
+std::optional<SignatureMatch> FindRenamedRegistryBodyMatch(
+    const ElfImage& reference, const ElfImage& candidate,
+    const Disassembler& disassembler,
+    const std::vector<Instruction>& reference_body,
+    std::size_t minimum_anchor_bytes, std::string* error) {
+  constexpr std::size_t kClearIndex = 4;
+  constexpr std::size_t kClearInstructionCount = 4;
+  const SignatureSpec clear_spec{
+      "registry-initializer-clear",
+      reference_body[kClearIndex].address,
+      kClearInstructionCount,
+      true,
+      minimum_anchor_bytes,
+      {0, 0},
+  };
+  const auto clear_matches = FindSignatureMatches(
+      reference, candidate, disassembler, clear_spec, true, error);
+  if (!clear_matches.has_value()) return std::nullopt;
+  SignatureSpec body_spec{
+      "registry-initializer-body",
+      reference_body.front().address,
+      reference_body.size(),
+      true,
+      minimum_anchor_bytes,
+      {0, 4},
+  };
+  body_spec.renamed_register_indices = {3, 8, 9, 10};
+  // Instructions 0 to 3 keep their lengths as long as ZERO stays one of r8
+  // to r15, so the body starts this far before the clear sequence.
+  const std::uint64_t lead =
+      reference_body[kClearIndex].address - reference_body.front().address;
+  std::vector<SignatureMatch> found;
+  for (const SignatureMatch& clear : *clear_matches) {
+    if (clear.rva < lead) continue;
+    std::string ignored;
+    const auto body = disassembler.Decode(candidate, clear.rva - lead,
+                                          reference_body.size(), 4096,
+                                          &ignored);
+    if (!body.has_value() || (*body)[kClearIndex].address != clear.rva ||
+        !ValidateSemantics(reference_body, *body, body_spec, &ignored)) {
+      continue;
+    }
+    found.push_back(SignatureMatch{clear.rva - lead, reference_body, *body});
+  }
+  if (found.size() != 1U) {
+    *error = "signature registry-initializer-body matched " +
+             std::to_string(found.size()) +
+             " candidate locations with renamed registers";
+    return std::nullopt;
+  }
+  return std::move(found.front());
+}
+
 std::optional<SignatureMatch> FindRegistrySignatureMatch(
    const ElfImage& reference, const ElfImage& candidate,
    const Disassembler& disassembler, const SignatureSpec& spec,
@@ -1590,8 +1704,18 @@ std::optional<SignatureMatch> FindRegistrySignatureMatch(
      spec.minimum_anchor_bytes,
      {0, 4},
  };
-  const auto body_match =
+  auto body_match =
      FindSignatureMatch(reference, candidate, disassembler, body_spec, error);
+  if (!body_match.has_value()) {
+    error->clear();
+    body_match = FindRenamedRegistryBodyMatch(
+        reference, candidate, disassembler,
+        std::vector<Instruction>(
+            std::next(reference_full->begin(), kBodyInstructionIndex),
+            std::next(reference_full->begin(),
+                      kBodyInstructionIndex + kBodyInstructionCount)),
+        spec.minimum_anchor_bytes, error);
+  }
  if (!body_match.has_value()) return std::nullopt;
  const std::vector<Instruction> reference_prologue(
      reference_full->begin(),
@@ -1633,39 +1757,48 @@ std::optional<std::uint64_t> DirectJumpTarget(
  return static_cast<std::uint64_t>(instruction.operands[0].value);
 }

+// Matches a constructor that is one jump to its body. The body is found by
+// signature, and the candidate constructor is the one of `candidate_entries`
+// that jumps to it.
 std::optional<SignatureMatch> FindConstructorBoundaryMatch(
    const ElfImage& reference, const ElfImage& candidate,
    const Disassembler& disassembler, const SignatureSpec& spec,
-    std::uint64_t reference_entry, std::uint64_t candidate_entry,
-    std::string* error) {
-  if (reference_entry != spec.reference_rva) {
-    *error = "reference constructor boundary moved outside init-array index 4";
-    return std::nullopt;
-  }
+    const std::vector<std::uint64_t>& candidate_entries, std::string* error) {
  const auto reference_wrapper =
-      disassembler.Decode(reference, reference_entry, 1, 16, error);
+      disassembler.Decode(reference, spec.reference_rva, 1, 16, error);
  if (!reference_wrapper.has_value()) return std::nullopt;
  const auto reference_target = DirectJumpTarget(
      reference_wrapper->front(), "reference constructor boundary", error);
  if (!reference_target.has_value()) return std::nullopt;
-  const SignatureSpec target_spec{"constructor-4-target", *reference_target,
+  const SignatureSpec target_spec{spec.name + "-target", *reference_target,
                                  spec.instruction_count};
  const auto target_match = FindSignatureMatch(
      reference, candidate, disassembler, target_spec, error);
  if (!target_match.has_value()) return std::nullopt;
-  const auto candidate_wrapper =
-      disassembler.Decode(candidate, candidate_entry, 1, 16, error);
-  if (!candidate_wrapper.has_value()) return std::nullopt;
-  const auto candidate_target = DirectJumpTarget(
-      candidate_wrapper->front(), "candidate constructor boundary", error);
-  if (!candidate_target.has_value() || *candidate_target != target_match->rva) {
-    if (error->empty()) {
-      *error = "constructor index 4 no longer targets its verified boundary";
+  std::optional<SignatureMatch> found;
+  for (const std::uint64_t candidate_entry : candidate_entries) {
+    std::string ignored;
+    const auto candidate_wrapper =
+        disassembler.Decode(candidate, candidate_entry, 1, 16, &ignored);
+    if (!candidate_wrapper.has_value()) continue;
+    const auto candidate_target = DirectJumpTarget(
+        candidate_wrapper->front(), "candidate constructor boundary",
+        &ignored);
+    if (!candidate_target.has_value() ||
+        *candidate_target != target_match->rva) {
+      continue;
    }
-    return std::nullopt;
+    if (found.has_value()) {
+      found.reset();
+      break;
+    }
+    found = SignatureMatch{candidate_entry, *reference_wrapper,
+                           *candidate_wrapper};
  }
-  return SignatureMatch{candidate_entry, *reference_wrapper,
-                        *candidate_wrapper};
+  if (!found.has_value()) {
+    *error = spec.name + " no longer targets its verified boundary";
+  }
+  return found;
 }

 std::vector<std::uint64_t> RipTargets(const Instruction& instruction) {
@@ -1678,6 +1811,187 @@ std::vector<std::uint64_t> RipTargets(const Instruction& instruction) {
  return result;
 }

+bool IsRegisterOperand(const Operand& operand, std::string_view name) {
+  return operand.type == Operand::Type::kRegister &&
+         operand.register_name == name;
+}
+
+// The instructions that publish the JNI singleton, which open its
+// initializer at `entry`, after a stack frame if it has one:
+//
+//    lea rax, [rip + OBJECT]
+//    xchg qword ptr [rip + SLOT], rax
+//    mov qword ptr [rip + OBJECT], rax
+//
+// OBJECT is the eight bytes after SLOT.
+std::optional<std::vector<Instruction>> JniSingletonPublication(
+    const ElfImage& image, const Disassembler& disassembler,
+    std::uint64_t entry, std::string* error) {
+  for (const std::size_t frame : {std::size_t{0}, std::size_t{2}}) {
+    std::string ignored;
+    const auto decoded =
+        disassembler.Decode(image, entry, frame + 3, 64, &ignored);
+    if (!decoded.has_value()) continue;
+    if (frame != 0) {
+      const Instruction& push = (*decoded)[0];
+      const Instruction& link = (*decoded)[1];
+      if (push.mnemonic != "push" || push.operands.size() != 1 ||
+          !IsRegisterOperand(push.operands[0], "rbp") ||
+          link.mnemonic != "mov" || link.operands.size() != 2 ||
+          !IsRegisterOperand(link.operands[0], "rbp") ||
+          !IsRegisterOperand(link.operands[1], "rsp")) {
+        continue;
+      }
+    }
+    const Instruction& load = (*decoded)[frame];
+    const Instruction& exchange = (*decoded)[frame + 1];
+    const Instruction& store = (*decoded)[frame + 2];
+    const auto object = RipTargets(load);
+    const auto slot = RipTargets(exchange);
+    const auto stored = RipTargets(store);
+    if (load.mnemonic != "lea" || load.operands.size() != 2 ||
+        !IsRegisterOperand(load.operands[0], "rax") ||
+        exchange.mnemonic != "xchg" || exchange.operands.size() != 2 ||
+        exchange.operands[0].size != 8 ||
+        !IsRegisterOperand(exchange.operands[1], "rax") ||
+        store.mnemonic != "mov" || store.operands.size() != 2 ||
+        store.operands[0].size != 8 ||
+        !IsRegisterOperand(store.operands[1], "rax") || object.size() != 1 ||
+        slot.size() != 1 || stored.size() != 1 || object[0] != stored[0] ||
+        object[0] != slot[0] + 8) {
+      continue;
+    }
+    return std::vector<Instruction>(std::next(decoded->begin(), frame),
+                                    decoded->end());
+  }
+  *error = "JNI singleton initializer at " + FormatRva(entry) +
+           " does not publish its singleton";
+  return std::nullopt;
+}
+
+// Finds the JNI singleton initializer among `candidate_entries`. The
+// instructions after the publication follow the singleton's layout, so when
+// a release changes that layout only the publication is matched. The
+// initializer itself runs from the init-array either way.
+std::optional<SignatureMatch> FindJniSingletonMatch(
+    const ElfImage& reference, const ElfImage& candidate,
+    const Disassembler& disassembler, const SignatureSpec& spec,
+    const std::vector<std::uint64_t>& candidate_entries, std::string* error) {
+  auto whole =
+      FindSignatureMatch(reference, candidate, disassembler, spec, error);
+  if (whole.has_value()) return whole;
+  error->clear();
+  const auto reference_publication = JniSingletonPublication(
+      reference, disassembler, spec.reference_rva, error);
+  if (!reference_publication.has_value()) return std::nullopt;
+  const SignatureSpec publication_spec{
+      "jni-singleton-publication", reference_publication->front().address,
+      reference_publication->size(), false, 3};
+  const auto found = FindSignatureMatch(reference, candidate, disassembler,
+                                        publication_spec, error);
+  if (!found.has_value()) return std::nullopt;
+  for (const std::uint64_t entry : candidate_entries) {
+    std::string ignored;
+    const auto publication =
+        JniSingletonPublication(candidate, disassembler, entry, &ignored);
+    if (publication.has_value() &&
+        publication->front().address == found->rva) {
+      return SignatureMatch{entry, *reference_publication, *publication};
+    }
+  }
+  *error = "JNI singleton initializer is not a leading constructor";
+  return std::nullopt;
+}
+
+// The native replay starts at this init-array index on x86_64.
+constexpr std::size_t kLeadingConstructorBegin = 2;
+// The process-load constructor, the JNI singleton initializer and two wiring
+// entries. A release may put them in any order.
+constexpr std::size_t kLeadingConstructorCount = 4;
+
+struct LeadingConstructors {
+  // For each reference leading constructor, the candidate init-array index
+  // of the same constructor. Both count from kLeadingConstructorBegin.
+  std::array<std::size_t, kLeadingConstructorCount> candidate_offset{};
+  SignatureMatch jni_singleton;
+};
+
+// Finds each reference leading constructor among the candidate's leading
+// constructors by its code.
+std::optional<LeadingConstructors> MatchLeadingConstructors(
+    const ElfImage& reference, const ElfImage& candidate,
+    const Disassembler& disassembler, const Json& constructor_anchors,
+    const SignatureSpec& jni_spec,
+    const std::vector<std::uint64_t>& reference_init,
+    const std::vector<std::uint64_t>& candidate_init, std::string* error) {
+  constexpr std::size_t kConstructorInstructionCount = 24;
+  constexpr char kMoved[] =
+      "constructor moved outside verified init-array boundary";
+  const std::size_t end = kLeadingConstructorBegin + kLeadingConstructorCount;
+  if (reference_init.size() < end || candidate_init.size() < end) {
+    *error = "init-array shape is not derivable";
+    return std::nullopt;
+  }
+  const std::vector<std::uint64_t> candidate_entries(
+      std::next(candidate_init.begin(), kLeadingConstructorBegin),
+      std::next(candidate_init.begin(), end));
+  LeadingConstructors result;
+  std::array<bool, kLeadingConstructorCount> taken{};
+  bool found_jni = false;
+  for (std::size_t offset = 0; offset < kLeadingConstructorCount; ++offset) {
+    const std::size_t index = kLeadingConstructorBegin + offset;
+    const std::uint64_t reference_entry = reference_init[index];
+    const std::string name = "constructor-" + std::to_string(index);
+    const auto anchor = ParseRva(
+        constructor_anchors.value(std::to_string(index), Json()), name, error);
+    if (!anchor.has_value()) return std::nullopt;
+    if (*anchor != reference_entry) {
+      *error = kMoved;
+      return std::nullopt;
+    }
+    std::optional<SignatureMatch> match;
+    if (reference_entry == jni_spec.reference_rva) {
+      match = FindJniSingletonMatch(reference, candidate, disassembler,
+                                    jni_spec, candidate_entries, error);
+      if (!match.has_value()) return std::nullopt;
+      result.jni_singleton = *match;
+      found_jni = true;
+    } else {
+      const auto first =
+          disassembler.Decode(reference, reference_entry, 1, 16, error);
+      if (!first.has_value()) return std::nullopt;
+      const SignatureSpec spec{name, reference_entry,
+                               kConstructorInstructionCount};
+      match = first->front().mnemonic == "jmp"
+                  ? FindConstructorBoundaryMatch(reference, candidate,
+                                                 disassembler, spec,
+                                                 candidate_entries, error)
+                  : FindSignatureMatch(reference, candidate, disassembler,
+                                       spec, error);
+      if (!match.has_value()) return std::nullopt;
+    }
+    const auto found = std::find(candidate_entries.begin(),
+                                 candidate_entries.end(), match->rva);
+    if (found == candidate_entries.end()) {
+      *error = kMoved;
+      return std::nullopt;
+    }
+    const std::size_t candidate_offset =
+        static_cast<std::size_t>(found - candidate_entries.begin());
+    if (taken[candidate_offset]) {
+      *error = kMoved;
+      return std::nullopt;
+    }
+    taken[candidate_offset] = true;
+    result.candidate_offset[offset] = candidate_offset;
+  }
+  if (!found_jni) {
+    *error = "JNI singleton initializer is not a leading constructor";
+    return std::nullopt;
+  }
+  return result;
+}
+
 std::optional<std::uint64_t> MappedRipTarget(const SignatureMatch& match,
                                             std::uint64_t reference_target,
                                             std::string_view description,
@@ -1755,16 +2069,23 @@ std::optional<std::size_t> PositiveSize(const Json& value,
  return static_cast<std::size_t>(number);
 }

-std::optional<Json> AdjustRanges(const Json& ranges,
-                                 std::size_t reference_count,
-                                 std::size_t candidate_count,
-                                 std::string* error) {
+// Rewrites the reference constructor ranges for the candidate init-array.
+// Each leading constructor keeps its place in or out of the replay under its
+// candidate index, and every later constructor runs.
+std::optional<Json> RemapConstructorRanges(
+    const Json& ranges, const LeadingConstructors& leading,
+    std::size_t reference_count, std::size_t candidate_count,
+    std::string* error) {
  if (!ranges.is_array() || ranges.empty()) {
    *error = "constructor ranges are missing";
    return std::nullopt;
  }
-  Json result = Json::array();
+  const std::size_t leading_end =
+      kLeadingConstructorBegin + kLeadingConstructorCount;
+  std::array<bool, kLeadingConstructorCount> runs{};
  std::size_t previous_end = 0;
+  std::size_t tail_begin = SIZE_MAX;
+  std::size_t tail_end = 0;
  for (const Json& range : ranges) {
    if (!range.is_object() || !range.contains("begin") ||
        !range.contains("end_exclusive") ||
@@ -1774,15 +2095,39 @@ std::optional<Json> AdjustRanges(const Json& ranges,
      return std::nullopt;
    }
    const std::size_t begin = range["begin"].get<std::size_t>();
-    std::size_t end = range["end_exclusive"].get<std::size_t>();
-    if (end == reference_count) end = candidate_count;
-    if (begin >= end || begin < previous_end || end > candidate_count) {
+    const std::size_t end = range["end_exclusive"].get<std::size_t>();
+    if (begin >= end || begin < previous_end || end > reference_count ||
+        begin < kLeadingConstructorBegin) {
      *error = "constructor range cannot fit candidate init-array";
      return std::nullopt;
    }
-    result.push_back({{"begin", begin}, {"end_exclusive", end}});
+    for (std::size_t index = begin; index < std::min(end, leading_end);
+         ++index) {
+      runs[leading.candidate_offset[index - kLeadingConstructorBegin]] = true;
+    }
    previous_end = end;
+    tail_begin = begin;
+    tail_end = end;
  }
+  if (tail_begin > leading_end || tail_end != reference_count ||
+      reference_count <= leading_end || candidate_count <= leading_end) {
+    *error = "constructor range cannot fit candidate init-array";
+    return std::nullopt;
+  }
+  Json result = Json::array();
+  std::size_t run_begin = SIZE_MAX;
+  for (std::size_t offset = 0; offset < kLeadingConstructorCount; ++offset) {
+    const std::size_t index = kLeadingConstructorBegin + offset;
+    if (runs[offset]) {
+      if (run_begin == SIZE_MAX) run_begin = index;
+    } else if (run_begin != SIZE_MAX) {
+      result.push_back({{"begin", run_begin}, {"end_exclusive", index}});
+      run_begin = SIZE_MAX;
+    }
+  }
+  result.push_back(
+      {{"begin", run_begin == SIZE_MAX ? leading_end : run_begin},
+       {"end_exclusive", candidate_count}});
  return result;
 }

@@ -1826,7 +2171,6 @@ std::optional<std::vector<SignatureSpec>> SignatureSpecs(const Json& sidecar,
  };
  const Json& seeds = profile["data_seeds"];
  const Json& bootstrap = profile["native_pre_jni_bootstrap"];
-  const Json& constructors = anchors["constructor_rvas"];
  std::vector<SignatureSpec> result;
  const auto add = [&](std::string name, const Json& encoded, std::size_t count,
                       bool registry = false, std::size_t minimum = 6) -> bool {
@@ -1859,10 +2203,7 @@ std::optional<std::vector<SignatureSpec>> SignatureSpecs(const Json& sidecar,
      !add("empty-string-initializer", anchors["empty_string_initializer_rva"],
           23) ||
      !add("jni-singleton-initializer",
-           anchors["jni_singleton_initializer_rva"], 11) ||
-      !add("constructor-2", constructors["2"], 24) ||
-      !add("constructor-3", constructors["3"], 24) ||
-      !add("constructor-4", constructors["4"], 24, false, 3)) {
+           anchors["jni_singleton_initializer_rva"], 11)) {
    return std::nullopt;
  }
  return result;
@@ -1966,7 +2307,17 @@ std::optional<std::pair<Json, Json>> DeriveDocuments(const ElfImage& reference,
  }
  std::map<std::string, SignatureMatch> matches;
  std::vector<SignatureMatch> allocate_matches;
+  std::optional<LeadingConstructors> leading;
  for (const SignatureSpec& spec : *specs) {
+    if (spec.name == "jni-singleton-initializer") {
+      leading = MatchLeadingConstructors(
+          reference, candidate, disassembler,
+          sidecar["derivation_anchors"]["constructor_rvas"], spec,
+          *reference_init, *candidate_init, error);
+      if (!leading.has_value()) return std::nullopt;
+      matches.emplace(spec.name, leading->jni_singleton);
+      continue;
+    }
    if (spec.name == "allocate") {
      auto candidates = FindSignatureMatches(reference, candidate,
                                             disassembler, spec, true, error);
@@ -1979,11 +2330,6 @@ std::optional<std::pair<Json, Json>> DeriveDocuments(const ElfImage& reference,
        return FindRegistrySignatureMatch(reference, candidate, disassembler,
                                          spec, error);
      }
-      if (spec.name == "constructor-4") {
-        return FindConstructorBoundaryMatch(
-            reference, candidate, disassembler, spec, (*reference_init)[4],
-            (*candidate_init)[4], error);
-      }
      return FindSignatureMatch(reference, candidate, disassembler, spec,
                                error);
    }();
@@ -2028,21 +2374,7 @@ std::optional<std::pair<Json, Json>> DeriveDocuments(const ElfImage& reference,
    return std::nullopt;
  }
  matches.emplace("allocate", std::move(*selected_allocate));
-  for (const std::size_t index : {2U, 3U, 4U}) {
-    const SignatureMatch& match =
-        matches["constructor-" + std::to_string(index)];
-    if ((*reference_init)[index] != match.reference[0].address ||
-        (*candidate_init)[index] != match.rva) {
-      *error = "constructor moved outside verified init-array boundary";
-      return std::nullopt;
-    }
-  }
  const SignatureMatch& singleton = matches["jni-singleton-initializer"];
-  if ((*reference_init)[5] != singleton.reference[0].address ||
-      (*candidate_init)[5] != singleton.rva) {
-    *error = "JNI singleton initializer is not constructor index 5";
-    return std::nullopt;
-  }

  Json candidate_bridges = Json::array();
  std::map<std::string, std::uint64_t> bridge_rvas;
@@ -2112,21 +2444,29 @@ std::optional<std::pair<Json, Json>> DeriveDocuments(const ElfImage& reference,
    return std::nullopt;
  }

-  const auto constructor_ranges =
-      AdjustRanges(reference_profile["constructor_run_ranges"],
-                   *reference_count, candidate_init->size(), error);
-  const auto native_ranges =
-      AdjustRanges(reference_profile["native_mimalloc_constructor_run_ranges"],
-                   *reference_count, candidate_init->size(), error);
+  const auto constructor_ranges = RemapConstructorRanges(
+      reference_profile["constructor_run_ranges"], *leading, *reference_count,
+      candidate_init->size(), error);
+  const auto native_ranges = RemapConstructorRanges(
+      reference_profile["native_mimalloc_constructor_run_ranges"], *leading,
+      *reference_count, candidate_init->size(), error);
  if (!constructor_ranges.has_value() || !native_ranges.has_value()) {
    return std::nullopt;
  }
-  const std::size_t thread_boundary = reference_profile.value(
+  const std::size_t reference_thread_boundary = reference_profile.value(
      "native_mimalloc_thread_initializer_after_constructor", SIZE_MAX);
-  if (thread_boundary != 2) {
+  if (reference_thread_boundary < kLeadingConstructorBegin ||
+      reference_thread_boundary >=
+          kLeadingConstructorBegin + kLeadingConstructorCount) {
    *error = "native allocator TLS boundary is no longer verified";
    return std::nullopt;
  }
+  // The thread initializer follows the process-load constructor to its
+  // candidate index.
+  const std::size_t thread_boundary =
+      kLeadingConstructorBegin +
+      leading->candidate_offset[reference_thread_boundary -
+                                kLeadingConstructorBegin];
  const auto singleton_bytes =
      PositiveSize(seeds["jni_singleton_bytes"], "JNI singleton size", error);
  const auto arena_slots = PositiveSize(seeds["arena_table_slot_count"],
@@ -2223,6 +2563,35 @@ std::optional<std::pair<Json, Json>> DeriveDocuments(const ElfImage& reference,
  return std::pair<Json, Json>{std::move(derived), std::move(compatibility)};
 }

+// Derives the optional FMOD output-device bridge from `library`, another build
+// the manifests describe. Any failure leaves the manifest without the bridge.
+void AddFallbackFmodBridge(const std::filesystem::path& library,
+                           const std::vector<std::filesystem::path>& manifests,
+                           const ElfImage& candidate, Json* compatibility) {
+  std::string error;
+  ElfImage fallback;
+  if (!fallback.Open(library, &error) ||
+      fallback.build_id() == candidate.build_id() ||
+      !fallback.ValidateToolchain(&error)) {
+    return;
+  }
+  const auto anchors =
+      LoadRuntimeCompatibilityAnchors(manifests, fallback.build_id(), &error);
+  if (!anchors.has_value() || !anchors->fmod.has_value()) return;
+  Disassembler disassembler;
+  if (!disassembler.Open(&error)) return;
+  RuntimeCompatibilityAnchors source;
+  source.fmod = anchors->fmod;
+  const auto derived = DeriveRuntimeCompatibility(fallback, candidate,
+                                                  disassembler, source, &error);
+  if (!derived.has_value() ||
+      !derived->contains("fmod_output_device_bridge")) {
+    return;
+  }
+  (*compatibility)["profiles"][0]["fmod_output_device_bridge"] =
+      (*derived)["fmod_output_device_bridge"];
+}
+
 }  // namespace

 HostAbiSidecarIdentity ReadHostAbiSidecarIdentity(
@@ -2280,10 +2649,15 @@ HostAbiDerivationResult DeriveHostAbiProfile(
      options.reference_compatibility_manifests, reference.build_id(),
      &result.error);
  if (!runtime_source.has_value()) return result;
-  const auto documents = DeriveDocuments(reference, candidate, *sidecar,
-                                         *metadata, *runtime_source,
-                                         &result.error);
+  auto documents = DeriveDocuments(reference, candidate, *sidecar, *metadata,
+                                   *runtime_source, &result.error);
  if (!documents.has_value()) return result;
+  if (!runtime_source->fmod.has_value() &&
+      !options.runtime_fallback_library.empty()) {
+    AddFallbackFmodBridge(options.runtime_fallback_library,
+                          options.reference_compatibility_manifests, candidate,
+                          &documents->second);
+  }
  result.profile = options.output_directory / "host_abi_profile.json";
  result.compatibility_manifest =
      options.output_directory / "compatibility.json";
@@ -312,7 +312,10 @@ bool CloneOrCopyFile(const std::filesystem::path& source,
  }
  bool copied = false;
 #if defined(__linux__) && defined(FICLONE)
-  copied = ioctl(output, FICLONE, input) == 0;
+  struct stat cloned_metadata = {};
+  copied = ioctl(output, FICLONE, input) == 0 &&
+           fstat(output, &cloned_metadata) == 0 &&
+           cloned_metadata.st_size == metadata.st_size;
 #endif
 #if defined(__linux__)
  if (!copied) {
@@ -320,6 +320,7 @@ CanaryResult RunReadinessCanary(const CanaryOptions& options) {
           "LOGNAME",
           "VK_DRIVER_FILES",
           "VK_ICD_FILENAMES",
+           "vk_require_etc2",
           "MESA_LOADER_DRIVER_OVERRIDE",
           "DRI_PRIME",
           "__NV_PRIME_RENDER_OFFLOAD",
@@ -472,7 +473,9 @@ CanaryResult RunReadinessCanary(const CanaryOptions& options) {
  }
  std::filesystem::remove_all(isolated, filesystem_error);
  if (!result.error.empty()) return result;
-  result.exit_code = WIFEXITED(status) ? WEXITSTATUS(status) : 128;
+  result.exit_code = WIFEXITED(status)
+                         ? WEXITSTATUS(status)
+                         : 128 + (WIFSIGNALED(status) ? WTERMSIG(status) : 0);
  if (result.exit_code != 0) {
    result.error =
        "graphics canary exited with status " +
@@ -301,6 +301,9 @@ struct ReferenceProfile {
  std::filesystem::path library;
  std::filesystem::path profile;
  std::vector<std::filesystem::path> compatibility_manifests;
+  // libroblox.so of the shipped reference payload when the reference is a
+  // different, machine-derived payload. Empty when it is not staged.
+  std::filesystem::path runtime_fallback_library;
  std::string error;

  explicit operator bool() const {
@@ -367,6 +370,23 @@ ReferenceProfile ResolveReference(
               paths.compatibility_manifest)) {
        result.compatibility_manifests.push_back(paths.compatibility_manifest);
      }
+      // A machine-derived profile can lack the optional FMOD output-device
+      // anchors. The shipped reference payload stays staged and has them.
+      const std::optional<SupportedPayloadProfile> shipped =
+          ResolveReferenceProfile(paths.host_abi_reference_profile, profiles,
+                                  nullptr);
+      if (shipped.has_value()) {
+        const std::string shipped_id = std::to_string(shipped->version_code) +
+                                       "-" + shipped->elf_build_id;
+        const std::filesystem::path shipped_directory =
+            paths.data_root / "payloads" / shipped_id;
+        const PayloadIntegrityResult shipped_payload =
+            InspectPreparedPayload(shipped_directory);
+        if (shipped_id != installed.payload_id && shipped_payload &&
+            shipped_payload.payload_id == shipped_id) {
+          result.runtime_fallback_library = shipped_directory / "libroblox.so";
+        }
+      }
      return result;
    }
  }
@@ -475,6 +495,7 @@ UpdateResult RunUnsafeLatest(
    derivation.reference_profile = reference.profile;
    derivation.reference_compatibility_manifests =
        reference.compatibility_manifests;
+    derivation.runtime_fallback_library = reference.runtime_fallback_library;
    derivation.candidate_payload_directory = candidate.staged.payload_directory;
    derivation.output_directory = workspace / "derived";
    Progress(request.progress_fd, "Deriving latest Roblox compatibility...");
@@ -853,6 +874,8 @@ UpdateResult RunUpdate(const UpdatePaths& paths, const UpdateRequest& request) {
        derivation.reference_profile = reference.profile;
        derivation.reference_compatibility_manifests =
            reference.compatibility_manifests;
+        derivation.runtime_fallback_library =
+            reference.runtime_fallback_library;
        derivation.candidate_payload_directory =
            candidate.staged.payload_directory;
        derivation.output_directory =
@@ -0,0 +1,76 @@
+#ifndef MOCKTAIL_WINDOW_HOST_SURFACE_COMMIT_GATE_H_
+#define MOCKTAIL_WINDOW_HOST_SURFACE_COMMIT_GATE_H_
+
+#include <atomic>
+#include <chrono>
+#include <mutex>
+#include <thread>
+
+namespace mocktail {
+namespace window {
+
+// Keeps main-thread wl_surface commits out of a host vkQueuePresentKHR call.
+// With explicit sync a Wayland driver sends its sync points, buffer attach
+// and commit as separate requests inside that call. A commit from another
+// thread between them carries sync points without a buffer, which is a
+// no_buffer protocol error that disconnects the client.
+class HostSurfaceCommitGate final {
+ public:
+  // A host present can block for as long as the compositor withholds a
+  // frame, so the main thread proceeds unguarded after this wait.
+  static constexpr std::chrono::milliseconds kMainThreadWait{50};
+
+  HostSurfaceCommitGate() = default;
+  HostSurfaceCommitGate(const HostSurfaceCommitGate&) = delete;
+  HostSurfaceCommitGate& operator=(const HostSurfaceCommitGate&) = delete;
+
+  void BeginHostPresent() {
+    if (present_thread_.load(std::memory_order_acquire) ==
+        std::this_thread::get_id()) {
+      // The previous present on this thread never reported its end.
+      return;
+    }
+    mutex_.lock();
+    present_thread_.store(std::this_thread::get_id(),
+                          std::memory_order_release);
+  }
+
+  void EndHostPresent() {
+    if (present_thread_.load(std::memory_order_acquire) !=
+        std::this_thread::get_id()) {
+      return;
+    }
+    present_thread_.store(std::thread::id(), std::memory_order_release);
+    mutex_.unlock();
+  }
+
+  // Held around SDL calls that can commit the window surface.
+  class MainThreadScope final {
+   public:
+    explicit MainThreadScope(
+        HostSurfaceCommitGate& gate,
+        std::chrono::nanoseconds wait = kMainThreadWait)
+        : lock_(gate.mutex_, wait) {}
+    MainThreadScope(const MainThreadScope&) = delete;
+    MainThreadScope& operator=(const MainThreadScope&) = delete;
+
+    bool owns_lock() const { return lock_.owns_lock(); }
+
+   private:
+    std::unique_lock<std::timed_mutex> lock_;
+  };
+
+ private:
+  std::timed_mutex mutex_;
+  std::atomic<std::thread::id> present_thread_{};
+};
+
+inline HostSurfaceCommitGate& ProcessHostSurfaceCommitGate() {
+  static HostSurfaceCommitGate gate;
+  return gate;
+}
+
+}  // namespace window
+}  // namespace mocktail
+
+#endif  // MOCKTAIL_WINDOW_HOST_SURFACE_COMMIT_GATE_H_
@@ -1,8 +1,6 @@
 #include "window/video_driver_policy.h"

 #include <algorithm>
-#include <system_error>
-#include <unistd.h>

 namespace mocktail {
 namespace window {
@@ -18,10 +16,6 @@ VideoDriverChoice ResolveVideoDriverChoice(
  if (input.force_x11 && input.has_x11_display) {
    return VideoDriverChoice::kX11;
  }
-  if (input.uses_direct_vulkan && input.has_nvidia_kernel_driver &&
-      input.has_wayland_session && input.has_x11_display) {
-    return VideoDriverChoice::kNvidiaDirectVulkanX11;
-  }
  if (input.prefer_wayland && input.has_wayland_session) {
    return VideoDriverChoice::kWayland;
  }
@@ -33,7 +27,6 @@ const char* VideoDriverChoiceName(VideoDriverChoice choice) {
    case VideoDriverChoice::kWayland:
      return "wayland";
    case VideoDriverChoice::kX11:
-    case VideoDriverChoice::kNvidiaDirectVulkanX11:
      return "x11";
    case VideoDriverChoice::kSdlDefault:
      return nullptr;
@@ -41,16 +34,6 @@ const char* VideoDriverChoiceName(VideoDriverChoice choice) {
  return nullptr;
 }

-bool HasNvidiaKernelDriver(const std::filesystem::path& proc_version,
-                          const std::filesystem::path& pci_driver) {
-  if (access(proc_version.c_str(), R_OK) == 0) {
-    return true;
-  }
-
-  std::error_code error;
-  return std::filesystem::is_directory(pci_driver, error);
-}
-
 bool HasAvailableVideoDriverCandidate(
    std::string_view requested,
    const std::vector<std::string_view>& available_drivers) {
@@ -1,7 +1,6 @@
 #ifndef MOCKTAIL_WINDOW_VIDEO_DRIVER_POLICY_H_
 #define MOCKTAIL_WINDOW_VIDEO_DRIVER_POLICY_H_

-#include <filesystem>
 #include <string_view>
 #include <vector>

@@ -12,7 +11,6 @@ enum class VideoDriverChoice {
  kSdlDefault,
  kWayland,
  kX11,
-  kNvidiaDirectVulkanX11,
 };

 struct VideoDriverPolicyInput {
@@ -22,23 +20,15 @@ struct VideoDriverPolicyInput {
  bool prefer_wayland = true;
  bool has_wayland_session = false;
  bool has_x11_display = false;
-  bool uses_direct_vulkan = false;
-  bool has_nvidia_kernel_driver = false;
 };

 // Resolves the SDL video backend before SDL_Init. An explicit SDL driver is
-// always authoritative. NVIDIA's direct Vulkan WSI uses X11/XWayland by
-// default when both display transports are available to avoid native Wayland
-// WSI hangs and explicit-sync protocol errors that disconnect the display.
+// always authoritative. A Wayland session uses native Wayland unless X11 is
+// forced or the Wayland preference is disabled.
 VideoDriverChoice ResolveVideoDriverChoice(const VideoDriverPolicyInput& input);

 const char* VideoDriverChoiceName(VideoDriverChoice choice);

-// Also detects sandboxed drivers through sysfs when procfs is unavailable.
-bool HasNvidiaKernelDriver(
-    const std::filesystem::path& proc_version = "/proc/driver/nvidia/version",
-    const std::filesystem::path& pci_driver = "/sys/bus/pci/drivers/nvidia");
-
 // SDL accepts a comma-separated priority list. An inherited override is only
 // useful when at least one requested driver exists in the linked SDL build.
 bool HasAvailableVideoDriverCandidate(
@@ -24,6 +24,7 @@
 #include "mocktail/platform/sdl_application_metadata.h"
 #include "mocktail/platform/sdl_event_converter.h"
 #include "mocktail/platform/sdl_window_icon.h"
+#include "window/host_surface_commit_gate.h"
 #include "window/input_pump_pacer.h"
 #include "window/main_thread_command_gate.h"
 #include "window/roblox_fullscreen_menu_request_gate.h"
@@ -125,7 +126,9 @@ struct WindowState {
  int height = 720;
  bool initialised = false;
  bool quit_requested = false;
-  bool visible = false;
+  // Written on the main thread. The render thread reads it to decide whether
+  // to ask for the window to be shown.
+  std::atomic<bool> visible{false};
  bool software_window = false;
  bool direct_vulkan = false;
  bool input_test_sequence_queued = false;
@@ -144,6 +147,9 @@ struct WindowState {

 static WindowState g_state;
 static std::atomic<int> g_real_swap_count{0};
+// Set by the render thread at its first frame; the main thread shows the
+// window, because SDL window calls belong to the main thread.
+static std::atomic<bool> g_show_window_requested{false};
 static std::atomic<uint64_t> g_first_present_ticks_ns{0};
 static InputPumpPacer g_input_pump_pacer;
 static PresentLifecycleGate g_present_lifecycle;
@@ -475,8 +481,6 @@ VideoDriverChoice ResolveConfiguredVideoDriverChoice() {
      !StringEquals(GetEnvNonEmpty("MOCKTAIL_FORCE_WAYLAND"), "0");
  input.has_wayland_session = HasWaylandSession();
  input.has_x11_display = GetEnvNonEmpty("DISPLAY") != nullptr;
-  input.uses_direct_vulkan = ShouldUseNativeVulkanBackend();
-  input.has_nvidia_kernel_driver = HasNvidiaKernelDriver();
  return ResolveVideoDriverChoice(input);
 }

@@ -665,11 +669,6 @@ bool ConfigureGraphicsBackendBeforeSDL() {
    setenv("SDL_VIDEODRIVER", video_driver, 1);
    SDL_SetHint(SDL_HINT_VIDEO_DRIVER, video_driver);
  }
-  if (video_driver_choice == VideoDriverChoice::kNvidiaDirectVulkanX11) {
-    fprintf(stderr,
-            "  [window] NVIDIA direct Vulkan on Wayland session: using "
-            "X11/XWayland WSI; set SDL_VIDEODRIVER=wayland to override\n");
-  }

  const GraphicsLibraries libraries = ResolveGraphicsLibraries();
  const char* egl_library =
@@ -1642,6 +1641,21 @@ void ShowIfHidden() {
      IsDisabledEnv("MOCKTAIL_SHOW_WINDOW_ON_FIRST_SWAP")) {
    return;
  }
+  g_show_window_requested.store(true, std::memory_order_release);
+}
+
+// Main thread only. Shows the window once a frame has asked for it.
+void ApplyShowWindowRequest() {
+  if (!g_show_window_requested.load(std::memory_order_acquire) ||
+      g_state.sdl_window == nullptr) {
+    return;  // Without a window the request stays for the next pump.
+  }
+  g_show_window_requested.store(false, std::memory_order_relaxed);
+  if (g_state.visible) {
+    return;
+  }
+  HostSurfaceCommitGate::MainThreadScope commit_scope(
+      ProcessHostSurfaceCommitGate());
  SDL_ShowWindow(g_state.sdl_window);
  SDL_RaiseWindow(g_state.sdl_window);
  g_state.visible = true;
@@ -1846,6 +1860,7 @@ extern "C" bool mocktail_window_uses_direct_vulkan() {
 extern "C" void mocktail_window_note_vulkan_present() { NoteVulkanPresent(); }

 extern "C" void mocktail_window_note_vulkan_host_present_begin() {
+  ProcessHostSurfaceCommitGate().BeginHostPresent();
  g_vulkan_host_present_sequence =
      g_vulkan_present_progress_gate.NotifyHostPresentBegin(
          SDL_GetTicksNS(), SDL_GetCurrentThreadID());
@@ -1856,6 +1871,7 @@ extern "C" void mocktail_window_note_vulkan_host_present_end(
  g_vulkan_present_progress_gate.NotifyHostPresentEnd(
      g_vulkan_host_present_sequence);
  g_vulkan_host_present_sequence = 0;
+  ProcessHostSurfaceCommitGate().EndHostPresent();
 }

 extern "C" std::uint64_t mocktail_window_note_vulkan_call_begin(
@@ -1995,6 +2011,8 @@ bool RequestFullscreenState(bool fullscreen, const char* reason) {
  if (current_fullscreen != fullscreen) {
    // Save the restore rectangle before SDL replaces it with monitor bounds.
    CaptureWindowState();
+    HostSurfaceCommitGate::MainThreadScope commit_scope(
+        ProcessHostSurfaceCommitGate());
    if (!SDL_SetWindowFullscreen(g_state.sdl_window, fullscreen)) {
      fprintf(stderr, "  [fullscreen] SDL request failed: %s\n",
              SDL_GetError());
@@ -2192,6 +2210,7 @@ void MaybeReportVulkanPresentStall() {
 }

 bool PumpEvents() {
+  ApplyShowWindowRequest();
  MaybeSynchronizeRestoredFullscreenState();
  MaybeApplyRobloxFullscreenMenuRequest();
  MaybeApplyAndroidFullscreenRequest();
@@ -5,6 +5,8 @@

 #include <cstdio>

+#include "window/host_surface_commit_gate.h"
+
 namespace mocktail {
 namespace window {

@@ -203,6 +205,10 @@ bool SdlPointerCaptureBackend::Apply(bool relative_mode, bool cursor_visible) {
    return false;
  }

+  // Leaving relative mode makes SDL warp the pointer, which commits the
+  // window surface on Wayland compositors without wp_pointer_warp_v1.
+  HostSurfaceCommitGate::MainThreadScope commit_scope(
+      ProcessHostSurfaceCommitGate());
  if (relative_mode && !relative_mode_) {
    SDL_GetMouseState(&capture_anchor_x_, &capture_anchor_y_);
    capture_anchor_valid_ = true;
@@ -43,6 +43,7 @@ struct AAsset {
  std::string apk_entry;
  std::vector<unsigned char> data;
  bool transcoded = false;
+  bool is_overlay = false;
  size_t offset = 0;
 };
 struct AAssetDir {};
@@ -115,25 +116,46 @@ bool FileExists(const std::string& path) {
  return !path.empty() && ::stat(path.c_str(), &st) == 0 && S_ISREG(st.st_mode);
 }

+struct ResolvedAsset {
+  std::string path;
+  bool is_overlay = false;
+};
+
 struct AssetLookupCache {
  std::mutex mutex;
-  std::unordered_map<std::string, std::string> resolved_paths;
+  std::unordered_map<std::string, ResolvedAsset> resolved_paths;
 };

 AssetLookupCache g_asset_lookup_cache;
 constexpr std::size_t kMaxCachedAssetPaths = 1024 * 5;

 std::string AssetCacheKey(const std::string& root,
+                          const std::string& overlay,
                          const std::string& requested) {
  std::string key;
-  key.reserve(root.size() + 1 + requested.size());
+  key.reserve(root.size() + 1 + overlay.size() + 1 + requested.size());
  key.append(root);
  key.push_back('\0');
+  key.append(overlay);
+  key.push_back('\0');
  key.append(requested);
  return key;
 }

-std::string ResolveAssetPath(const char* filename) {
+// Stores a resolved asset, dropping one entry first when the cache is full.
+ResolvedAsset CacheResolvedAsset(const std::string& cache_key,
+                                 ResolvedAsset resolved) {
+  std::scoped_lock lock(g_asset_lookup_cache.mutex);
+  auto& cached = g_asset_lookup_cache.resolved_paths;
+  if (cached.size() >= kMaxCachedAssetPaths &&
+      cached.find(cache_key) == cached.end()) {
+    cached.erase(cached.begin());
+  }
+  cached.insert_or_assign(cache_key, resolved);
+  return resolved;
+}
+
+ResolvedAsset ResolveAssetPath(const char* filename) {
  if (filename == nullptr) {
    return {};
  }
@@ -145,13 +167,16 @@ std::string ResolveAssetPath(const char* filename) {
  const std::string requested(requested_view);
  const char* root_env = GetEnvNonEmpty("MOCKTAIL_ASSET_ROOT");
  const std::string root = root_env != nullptr ? root_env : "rbx_bin/assets";
-  const std::string cache_key = AssetCacheKey(root, requested);
+  const char* overlay_env = GetEnvNonEmpty("MOCKTAIL_ASSET_OVERLAY_DIR");
+  const std::string overlay =
+      overlay_env != nullptr ? overlay_env : "rbx_bin/asset_overlay";
+  const std::string cache_key = AssetCacheKey(root, overlay, requested);

  {
    std::scoped_lock lock(g_asset_lookup_cache.mutex);
    auto it = g_asset_lookup_cache.resolved_paths.find(cache_key);
    if (it != g_asset_lookup_cache.resolved_paths.end()) {
-      if (FileExists(it->second)) {
+      if (FileExists(it->second.path)) {
        return it->second;
      }
      g_asset_lookup_cache.resolved_paths.erase(it);
@@ -160,25 +185,33 @@ std::string ResolveAssetPath(const char* filename) {

  const std::string stripped(StripAndroidAssetPrefix(requested_view));

-  const std::vector<std::string> candidates = {
+  if (!overlay.empty()) {
+    const std::vector<std::string> overlay_candidates = {
+        overlay + "/" + requested,
+        overlay + "/" + stripped,
+        overlay + "/content/" + requested,
+        overlay + "/content/" + stripped,
+        overlay + "/ExtraContent/" + requested,
+        overlay + "/ExtraContent/" + stripped,
+    };
+    for (const std::string& candidate : overlay_candidates) {
+      if (FileExists(candidate)) {
+        return CacheResolvedAsset(cache_key, {candidate, true});
+      }
+    }
+  }
+
+  const std::vector<std::string> root_candidates = {
      root + "/" + requested,
      root + "/" + stripped,
+      root + "/content/" + requested,
+      root + "/content/" + stripped,
      root + "/ExtraContent/" + requested,
      root + "/ExtraContent/" + stripped,
  };
-  for (const std::string& candidate : candidates) {
+  for (const std::string& candidate : root_candidates) {
    if (FileExists(candidate)) {
-      std::scoped_lock lock(g_asset_lookup_cache.mutex);
-      if (g_asset_lookup_cache.resolved_paths.size() >=
-              kMaxCachedAssetPaths &&
-          g_asset_lookup_cache.resolved_paths.find(cache_key) ==
-              g_asset_lookup_cache.resolved_paths.end()) {
-        g_asset_lookup_cache.resolved_paths.erase(
-            g_asset_lookup_cache.resolved_paths.begin());
-      }
-      g_asset_lookup_cache.resolved_paths.insert_or_assign(cache_key,
-                                                           candidate);
-      return candidate;
+      return CacheResolvedAsset(cache_key, {candidate, false});
    }
  }

@@ -330,24 +363,31 @@ AAsset* AAssetManager_open(AAssetManager* mgr, const char* filename,
  if (mgr == nullptr) {
    return nullptr;
  }
-  std::string path = ResolveAssetPath(filename);
-  if (path.empty()) {
+  ResolvedAsset resolved = ResolveAssetPath(filename);
+  if (resolved.path.empty()) {
+    if (AssetTraceEnabled()) {
+      std::fprintf(stderr, "[asset] miss %s\n",
+                   filename != nullptr ? filename : "(null)");
+    }
    return nullptr;
  }
  auto* asset = new AAsset;
-  asset->path = path;
+  asset->path = resolved.path;
  asset->apk_entry = ApkEntryName(filename);
-  if (!LoadFile(path, &asset->data)) {
+  asset->is_overlay = resolved.is_overlay;
+  if (!LoadFile(resolved.path, &asset->data)) {
    delete asset;
    return nullptr;
  }
  if (MocktailUsesDirectVulkan()) {
    asset->transcoded =
-        libc_shim::TranscodeEtc1SkyTextureForVulkan(path.c_str(), &asset->data);
+        libc_shim::TranscodeEtc1SkyTextureForVulkan(resolved.path.c_str(),
+                                                    &asset->data);
  }
  if (AssetTraceEnabled()) {
-    std::fprintf(stderr, "[asset] open %s -> %s (%zu bytes)\n", filename,
-                 path.c_str(), asset->data.size());
+    std::fprintf(stderr, "[asset] open %s -> %s (%zu bytes%s)\n", filename,
+                 resolved.path.c_str(), asset->data.size(),
+                 resolved.is_overlay ? " [overlay]" : "");
  }
  return asset;
 }
@@ -464,7 +504,8 @@ int AAsset_openFileDescriptor(AAsset* asset, off_t* outStart,
  int fd = -1;
  off_t start = 0;
  off_t descriptor_length = static_cast<off_t>(asset->data.size());
-  if (!OpenStoredApkEntryDescriptor(asset->apk_entry, &fd, &start,
+  if (asset->is_overlay ||
+      !OpenStoredApkEntryDescriptor(asset->apk_entry, &fd, &start,
                                    &descriptor_length)) {
    fd = ::open(asset->path.c_str(), O_RDONLY | O_CLOEXEC);
  }
@@ -11,6 +11,14 @@ target_link_libraries(jnivm_test PRIVATE
  GTest::gtest_main
 )

+add_executable(jnivm_fmod_write_allocation_test
+  jnivm_fmod_write_allocation_test.cc
+)
+target_link_libraries(jnivm_fmod_write_allocation_test PRIVATE
+  Mocktail::LegacyJni
+  GTest::gtest_main
+)
+
 add_executable(jnivm_fields_test jnivm_fields_test.cc)
 target_link_libraries(jnivm_fields_test PRIVATE
  Mocktail::LegacyJni
@@ -214,6 +222,12 @@ target_link_libraries(runtime_paths_test PRIVATE
  GTest::gtest_main
 )

+add_executable(asset_overlay_names_test asset_overlay_names_test.cc)
+target_link_libraries(asset_overlay_names_test PRIVATE
+  Mocktail::Runtime
+  GTest::gtest_main
+)
+
 add_executable(single_instance_lock_test single_instance_lock_test.cc)
 target_link_libraries(single_instance_lock_test PRIVATE
  Mocktail::Runtime
@@ -510,6 +524,16 @@ target_link_libraries(vulkan_surface_recovery_gate_test PRIVATE
 )
 mocktail_apply_compile_options(vulkan_surface_recovery_gate_test)

+add_executable(host_surface_commit_gate_test
+  host_surface_commit_gate_test.cc
+)
+target_link_libraries(host_surface_commit_gate_test PRIVATE
+  mocktail_window
+  GTest::gtest_main
+  Threads::Threads
+)
+mocktail_apply_compile_options(host_surface_commit_gate_test)
+
 add_executable(vulkan_present_progress_gate_test
  vulkan_present_progress_gate_test.cc
 )
@@ -559,6 +583,17 @@ target_link_libraries(texture_override_test PRIVATE GTest::gtest_main
  PkgConfig::LIBPNG)
 mocktail_apply_compile_options(texture_override_test)

+add_executable(texture_resample_test
+  texture_resample_test.cc
+  ${PROJECT_SOURCE_DIR}/src/graphics/texture_override.cc
+)
+target_include_directories(texture_resample_test PRIVATE
+  ${PROJECT_SOURCE_DIR}/include
+)
+target_link_libraries(texture_resample_test PRIVATE GTest::gtest_main
+  PkgConfig::LIBPNG)
+mocktail_apply_compile_options(texture_resample_test)
+
 add_executable(chrome_trace_writer_test
  chrome_trace_writer_test.cc
  ${PROJECT_SOURCE_DIR}/src/graphics/chrome_trace_writer.cc
@@ -999,6 +1034,7 @@ target_link_libraries(headless_graphics_test PRIVATE
 include(GoogleTest)
 gtest_discover_tests(jnivm_test)
 gtest_discover_tests(jnivm_fields_test)
+gtest_discover_tests(jnivm_fmod_write_allocation_test)
 gtest_discover_tests(runtime_config_test)
 gtest_discover_tests(runtime_config_file_test)
 gtest_discover_tests(payload_update_preflight_test)
@@ -1024,6 +1060,7 @@ gtest_discover_tests(game_mode_link_namespace_test PROPERTIES
 )
 gtest_discover_tests(memory_limit_test)
 gtest_discover_tests(runtime_paths_test)
+gtest_discover_tests(asset_overlay_names_test)
 gtest_discover_tests(single_instance_lock_test)
 gtest_discover_tests(supported_launch_policy_test)
 gtest_discover_tests(process_launch_policy_test)
@@ -1058,9 +1095,12 @@ gtest_discover_tests(vulkan_present_observer_test)
 gtest_discover_tests(input_pump_pacer_test)
 gtest_discover_tests(input_pump_pacing_runtime_test)
 gtest_discover_tests(vulkan_surface_recovery_gate_test)
+gtest_discover_tests(host_surface_commit_gate_test)
 gtest_discover_tests(vulkan_present_progress_gate_test)
 gtest_discover_tests(vulkan_text_overlay_compositor_test)
 gtest_discover_tests(etc2_decoder_test)
+gtest_discover_tests(texture_override_test)
+gtest_discover_tests(texture_resample_test)
 gtest_discover_tests(chrome_trace_writer_test)
 gtest_discover_tests(vulkan_etc2_emulation_test)
 gtest_discover_tests(video_driver_policy_test)
@@ -102,21 +102,69 @@ curl() {
 }

 pacman() {
-  [[ "$#" == 5 && "$1" == -U && "$2" == --noconfirm && "$3" == --needed ]]
-  if [[ "${SCENARIO}" == replaced ]]; then
-    cmp "${TEMP_DIR}/updated-ffmpeg" "$4"
-  else
-    cmp "${TEMP_DIR}/ffmpeg" "$4"
-  fi
-  cmp "${TEMP_DIR}/opus" "$5"
-  local downloads="${4%/*}"
+  local name
+  case "$1" in
+    -Qp)
+      # The stale scenario offers an ffmpeg older than the installed one.
+      name="${3##*/}"
+      name="${name%%-mini-*}"
+      if [[ "${SCENARIO}" == stale && "${name}" == ffmpeg ]]; then
+        printf '%s 1-1\n' "${name}"
+      else
+        printf '%s 2-1\n' "${name}"
+      fi
+      return 0 ;;
+    -Q)
+      printf '%s 2-1\n' "$3"
+      return 0 ;;
+    -S)
+      [[ "$2" == --noconfirm ]]
+      printf '%s\n' "${@:3}" >"${TEMP_DIR}/restored"
+      return 0 ;;
+  esac
+  [[ "$#" -ge 4 && "$1" == -U && "$2" == --noconfirm && "$3" == --needed ]]
+  local archive downloads="${4%/*}"
  (cd "${downloads}" && sha256sum --check --strict SHA256SUMS)
-  cp "$4" "$5" "${downloads}/SHA256SUMS" "${downloads}/dependencies.tsv" \
+  for archive in "${@:4}"; do
+    case "${archive##*/}" in
+      "${FFMPEG}")
+        if [[ "${SCENARIO}" == replaced ]]; then
+          cmp "${TEMP_DIR}/updated-ffmpeg" "${archive}"
+        else
+          cmp "${TEMP_DIR}/ffmpeg" "${archive}"
+        fi ;;
+      "${OPUS}") cmp "${TEMP_DIR}/opus" "${archive}" ;;
+      *) Fail "unexpected archive: ${archive}" ;;
+    esac
+    cp "${archive}" "${TEMP_DIR}/${SCENARIO}/"
+  done
+  cp "${downloads}/SHA256SUMS" "${downloads}/dependencies.tsv" \
    "${TEMP_DIR}/${SCENARIO}/"
  touch "${TEMP_DIR}/installed"
 }

-export -f curl pacman Fail
+vercmp() {
+  if [[ "$1" == "$2" ]]; then printf '0\n'; else printf -- '-1\n'; fi
+}
+
+# opus never resolves once its reduced package is installed. libadwaita-1
+# stops resolving while the stale ffmpeg is installed.
+pkg-config() {
+  case "$1" in
+    --list-package-names) printf 'ffmpeg\nlibadwaita-1\nopus\n' ;;
+    --exists)
+      if [[ "$2" == opus ]]; then
+        [[ ! -e "${TEMP_DIR}/${SCENARIO}/${OPUS}" ]]
+        return
+      fi
+      [[ "${SCENARIO}" != stale || "$2" != libadwaita-1 ||
+         ! -e "${TEMP_DIR}/${SCENARIO}/${FFMPEG}" ||
+         -e "${TEMP_DIR}/restored" ]] ;;
+    *) Fail "unexpected pkg-config option: $1" ;;
+  esac
+}
+
+export -f curl pacman vercmp pkg-config Fail
 export TEMP_DIR API FFMPEG OPUS SCENARIO TEST_RELEASE

 ExpectRejectedSnapshot() {
@@ -190,7 +238,7 @@ for invalid_manifest in '../ffmpeg-mini-x86_64.pkg.tar.zst' \
  fi
 done

-for SCENARIO in success replaced corrupted download-failure metadata-failure invalid-metadata; do
+for SCENARIO in success replaced stale corrupted download-failure metadata-failure invalid-metadata; do
  TEST_RELEASE="${TEMP_DIR}/release.json"
  if [[ "${SCENARIO}" == invalid-metadata ]]; then
    # A valid first row must not allow downloads when a later row is invalid.
@@ -206,13 +254,15 @@ for SCENARIO in success replaced corrupted download-failure metadata-failure inv
      AnyLinuxDependenciesMain
    ' _ "${TEMP_DIR}" \
      >"${TEMP_DIR}/${SCENARIO}.log" 2>&1; then
-    [[ "${SCENARIO}" == success || "${SCENARIO}" == replaced ]] ||
+    [[ "${SCENARIO}" == success || "${SCENARIO}" == replaced ||
+       "${SCENARIO}" == stale ]] ||
      Fail "installed packages after ${SCENARIO}"
    [[ -f "${TEMP_DIR}/installed" ]]
    (cd "${TEMP_DIR}/${SCENARIO}" && sha256sum --check --strict SHA256SUMS)
    rm -- "${TEMP_DIR}/installed"
  else
-    if [[ "${SCENARIO}" == success || "${SCENARIO}" == replaced ]]; then
+    if [[ "${SCENARIO}" == success || "${SCENARIO}" == replaced ||
+          "${SCENARIO}" == stale ]]; then
      cat -- "${TEMP_DIR}/${SCENARIO}.log" >&2
      Fail "valid download failed: ${SCENARIO}"
    fi
@@ -220,6 +270,8 @@ for SCENARIO in success replaced corrupted download-failure metadata-failure inv
  fi
  case "${SCENARIO}" in
    success)
+      [[ ! -e "${TEMP_DIR}/restored" ]] ||
+        Fail 'restored a package that broke nothing'
      [[ "$(wc -l <"${TEMP_DIR}/calls")" == 3 ]]
      grep -Fq "${API}/assets/10" "${TEMP_DIR}/calls" ;;
    replaced)
@@ -227,6 +279,10 @@ for SCENARIO in success replaced corrupted download-failure metadata-failure inv
      grep -Fq "${API}/assets/11" "${TEMP_DIR}/calls"
      grep -Fq "${API}/assets/11" "${TEMP_DIR}/replaced/dependencies.tsv"
      grep -Fq "${API}/assets/21" "${TEMP_DIR}/replaced/dependencies.tsv" ;;
+    stale)
+      [[ "$(cat -- "${TEMP_DIR}/restored" 2>/dev/null)" == ffmpeg ]] ||
+        Fail 'kept a stale package that broke another package'
+      rm -- "${TEMP_DIR}/restored" ;;
    corrupted)
      grep -Fq 'dependency checksum verification failed' "${TEMP_DIR}/${SCENARIO}.log" ;;
    download-failure)
@@ -11,6 +11,7 @@ readonly TEMP_DIR="$(mktemp -d "${TMPDIR:-/tmp}/mocktail-anylinux-test.XXXXXX")"
 trap 'rm -rf -- "${TEMP_DIR}"' EXIT

 source "${ROOT}/scripts/package_anylinux.sh"
+export UPINFO=""
 mkdir -p -- "${TEMP_DIR}/fixtures"

 # Compile the real adapter loader and updater canary. The fake runtime
@@ -79,6 +80,18 @@ if [[ "$1" == --make-appimage ]]; then
  printf 'make-appimage\n' >>"${MOCKTAIL_PACKAGING_FIXTURES}/calls"
  mkdir -p -- "${OUTPATH}"
  cp -- "$(type -P true)" "${OUTPATH}/${OUTNAME}"
+  if [[ -n "${UPINFO:-}" ]]; then
+    printf '%s\n' "${UPINFO}" >"${OUTPATH}/update-info"
+    case "${MOCKTAIL_TEST_ZSYNC:-present}" in
+      present)
+        printf 'Filename: %s\nURL: %s\n\n\0checksum fixture' "${OUTNAME}" "${OUTNAME}" \
+          >"${OUTPATH}/${OUTNAME}.zsync"
+        cp -- "${OUTPATH}/${OUTNAME}.zsync" "${OUTPATH}/expected.zsync"
+        ;;
+      empty) touch "${OUTPATH}/${OUTNAME}.zsync" ;;
+      missing) : ;;
+    esac
+  fi
  exit 0
 fi
 [[ "$#" == 7 && "$1" == /usr/bin/mocktail &&
@@ -145,8 +158,41 @@ mkdir -p -- "${ANYLINUX_WORK}"
 AnyLinuxVerifyInstalled() { :; }
 AnyLinuxDeploy
 [[ -x "${ANYLINUX_OUTPUT}" ]]
+[[ ! -e "${ANYLINUX_OUTPUT}.zsync" ]]
 [[ "$(<"${TEMP_DIR}/fixtures/calls")" == $'deploy-usr\nmake-appimage' ]]

+for filename in mocktail-nightly.AppImage mocktail-nightly-aarch64.AppImage \
+    Mocktail-1.0.5-x86_64.AppImage; do
+  (
+    ANYLINUX_WORK="${TEMP_DIR}/updates/${filename}"
+    ANYLINUX_OUTPUT="${TEMP_DIR}/${filename}"
+    export UPINFO="gh-releases-zsync|owner|repository|continuous|${filename}.zsync"
+    if [[ "${filename}" == Mocktail-* ]]; then
+      UPINFO='gh-releases-zsync|owner|repository|latest|Mocktail-*-x86_64.AppImage.zsync'
+    fi
+    AnyLinuxDeploy
+    [[ "$(<"${ANYLINUX_WORK}/image/update-info")" == "${UPINFO}" ]]
+    cmp -- "${ANYLINUX_WORK}/image/expected.zsync" "${ANYLINUX_OUTPUT}.zsync"
+    grep -aFxq "URL: ${filename}" "${ANYLINUX_OUTPUT}.zsync"
+    [[ ! -e "${ANYLINUX_WORK}/image/${filename}.zsync" ]]
+  )
+done
+
+for sidecar in missing empty; do
+  if (
+    ANYLINUX_WORK="${TEMP_DIR}/updates/${sidecar}"
+    ANYLINUX_OUTPUT="${TEMP_DIR}/${sidecar}.AppImage"
+    export UPINFO="gh-releases-zsync|owner|repository|continuous|${sidecar}.AppImage.zsync"
+    export MOCKTAIL_TEST_ZSYNC="${sidecar}"
+    AnyLinuxDeploy
+  ) >"${TEMP_DIR}/${sidecar}.log" 2>&1; then
+    printf 'packager accepted a %s .zsync file\n' "${sidecar}" >&2
+    exit 1
+  fi
+  grep -Fq 'no .zsync was generated' "${TEMP_DIR}/${sidecar}.log"
+  [[ ! -e "${TEMP_DIR}/${sidecar}.AppImage" ]]
+done
+
 mv -- "${ANYLINUX_WORK}/AppDir" "${TEMP_DIR}/relocated AppDir"
 app_dir="${TEMP_DIR}/relocated AppDir"
 AnyLinuxVerifyAppDir "${app_dir}"
@@ -55,6 +55,7 @@ class AssetManagerTest : public ::testing::Test {
    root_ = MakeTempRoot();
    ASSERT_FALSE(root_.empty());
    setenv("MOCKTAIL_ASSET_ROOT", root_.c_str(), 1);
+    unsetenv("MOCKTAIL_ASSET_OVERLAY_DIR");
    const char* backend = std::getenv("MOCKTAIL_GRAPHICS_BACKEND");
    had_backend_ = backend != nullptr;
    previous_backend_ = backend != nullptr ? backend : "";
@@ -63,6 +64,7 @@ class AssetManagerTest : public ::testing::Test {

  void TearDown() override {
    unsetenv("MOCKTAIL_ASSET_ROOT");
+    unsetenv("MOCKTAIL_ASSET_OVERLAY_DIR");
    if (had_backend_) {
      setenv("MOCKTAIL_GRAPHICS_BACKEND", previous_backend_.c_str(), 1);
    } else {
@@ -298,4 +300,115 @@ TEST_F(AssetManagerTest, CacheSeparatesRuntimeAssetRootChanges) {
  AAsset_close(second);
 }

+TEST_F(AssetManagerTest, OverlayAssetTakesPrecedenceOverRootAsset) {
+  WriteAsset("content/textures/Cursors/KeyboardMouse/ArrowCursor.png",
+             "stock-arrow");
+  const std::string overlay_root = MakeTempRoot();
+  ASSERT_FALSE(overlay_root.empty());
+  WriteAssetAt(overlay_root,
+               "content/textures/Cursors/KeyboardMouse/ArrowCursor.png",
+               "custom-overlay-arrow");
+  ASSERT_EQ(setenv("MOCKTAIL_ASSET_OVERLAY_DIR", overlay_root.c_str(), 1), 0);
+
+  AAssetManager* manager = AAssetManager_fromJava(nullptr, nullptr);
+
+  // 1. Direct content/ path
+  AAsset* direct = AAssetManager_open(
+      manager, "content/textures/Cursors/KeyboardMouse/ArrowCursor.png", 0);
+  ASSERT_NE(direct, nullptr);
+  EXPECT_EQ(std::string(static_cast<const char*>(AAsset_getBuffer(direct)),
+                        static_cast<std::size_t>(AAsset_getLength(direct))),
+            "custom-overlay-arrow");
+  AAsset_close(direct);
+
+  // 2. rbxasset:// URI prefix without content/
+  AAsset* rbxasset = AAssetManager_open(
+      manager, "rbxasset://textures/Cursors/KeyboardMouse/ArrowCursor.png", 0);
+  ASSERT_NE(rbxasset, nullptr);
+  EXPECT_EQ(std::string(static_cast<const char*>(AAsset_getBuffer(rbxasset)),
+                        static_cast<std::size_t>(AAsset_getLength(rbxasset))),
+            "custom-overlay-arrow");
+  AAsset_close(rbxasset);
+
+  // 3. Bare textures/ prefix
+  AAsset* bare = AAssetManager_open(
+      manager, "textures/Cursors/KeyboardMouse/ArrowCursor.png", 0);
+  ASSERT_NE(bare, nullptr);
+  EXPECT_EQ(std::string(static_cast<const char*>(AAsset_getBuffer(bare)),
+                        static_cast<std::size_t>(AAsset_getLength(bare))),
+            "custom-overlay-arrow");
+  AAsset_close(bare);
+}
+
+TEST_F(AssetManagerTest, OverlayOpenFileDescriptorReadsDirectlyFromFile) {
+  const std::string overlay_root = MakeTempRoot();
+  ASSERT_FALSE(overlay_root.empty());
+  WriteAssetAt(overlay_root, "content/custom_shader.bin", "custom-overlay-shader");
+  ASSERT_EQ(setenv("MOCKTAIL_ASSET_OVERLAY_DIR", overlay_root.c_str(), 1), 0);
+  // Point APK path to non-existent or dummy file to ensure descriptor reads overlay
+  ASSERT_EQ(setenv("MOCKTAIL_ASSET_APK_PATH", "/nonexistent/apk/path.apk", 1), 0);
+
+  AAssetManager* manager = AAssetManager_fromJava(nullptr, nullptr);
+  AAsset* asset = AAssetManager_open(manager, "content/custom_shader.bin", 0);
+  ASSERT_NE(asset, nullptr);
+
+  off_t start = -1;
+  off_t length = -1;
+  int fd = AAsset_openFileDescriptor(asset, &start, &length);
+  ASSERT_GE(fd, 0);
+  EXPECT_EQ(start, 0);
+  EXPECT_EQ(length, 21);
+
+  char buf[32] = {};
+  EXPECT_EQ(pread(fd, buf, 21, start), 21);
+  EXPECT_STREQ(buf, "custom-overlay-shader");
+  close(fd);
+  AAsset_close(asset);
+  unsetenv("MOCKTAIL_ASSET_APK_PATH");
+}
+
+TEST_F(AssetManagerTest, NonOverlaidAssetFallsBackToRootAsset) {
+  WriteAsset("content/sounds/oof.mp3", "stock-sound");
+  const std::string overlay_root = MakeTempRoot();
+  ASSERT_FALSE(overlay_root.empty());
+  WriteAssetAt(overlay_root, "content/textures/unrelated.png", "other-texture");
+  ASSERT_EQ(setenv("MOCKTAIL_ASSET_OVERLAY_DIR", overlay_root.c_str(), 1), 0);
+
+  AAssetManager* manager = AAssetManager_fromJava(nullptr, nullptr);
+  AAsset* asset = AAssetManager_open(manager, "sounds/oof.mp3", 0);
+  ASSERT_NE(asset, nullptr);
+  EXPECT_EQ(std::string(static_cast<const char*>(AAsset_getBuffer(asset)),
+                        static_cast<std::size_t>(AAsset_getLength(asset))),
+            "stock-sound");
+  AAsset_close(asset);
+}
+
+TEST_F(AssetManagerTest, CacheSeparatesOverlayDirectoryChanges) {
+  WriteAsset("content/test.txt", "stock");
+  const std::string first_overlay = MakeTempRoot();
+  ASSERT_FALSE(first_overlay.empty());
+  WriteAssetAt(first_overlay, "content/test.txt", "overlay-1");
+  ASSERT_EQ(setenv("MOCKTAIL_ASSET_OVERLAY_DIR", first_overlay.c_str(), 1), 0);
+
+  AAssetManager* manager = AAssetManager_fromJava(nullptr, nullptr);
+  AAsset* first = AAssetManager_open(manager, "content/test.txt", 0);
+  ASSERT_NE(first, nullptr);
+  EXPECT_EQ(std::string(static_cast<const char*>(AAsset_getBuffer(first)),
+                        static_cast<std::size_t>(AAsset_getLength(first))),
+            "overlay-1");
+  AAsset_close(first);
+
+  const std::string second_overlay = MakeTempRoot();
+  ASSERT_FALSE(second_overlay.empty());
+  WriteAssetAt(second_overlay, "content/test.txt", "overlay-2");
+  ASSERT_EQ(setenv("MOCKTAIL_ASSET_OVERLAY_DIR", second_overlay.c_str(), 1), 0);
+
+  AAsset* second = AAssetManager_open(manager, "content/test.txt", 0);
+  ASSERT_NE(second, nullptr);
+  EXPECT_EQ(std::string(static_cast<const char*>(AAsset_getBuffer(second)),
+                        static_cast<std::size_t>(AAsset_getLength(second))),
+            "overlay-2");
+  AAsset_close(second);
+}
+
 }  // namespace
@@ -0,0 +1,122 @@
+#include "runtime/asset_overlay_names.h"
+
+#include <gtest/gtest.h>
+#include <unistd.h>
+
+#include <cstdint>
+#include <filesystem>
+#include <fstream>
+#include <string>
+#include <string_view>
+#include <vector>
+
+namespace {
+
+using mocktail::runtime::DisableAssetNameMappings;
+using mocktail::runtime::OverlayRbxAssetNames;
+
+class TemporaryDirectory {
+ public:
+  TemporaryDirectory() {
+    char pattern[] = "/tmp/mocktail_asset_overlay_names_XXXXXX";
+    char* created = mkdtemp(pattern);
+    if (created != nullptr) {
+      path_ = created;
+    }
+  }
+
+  ~TemporaryDirectory() {
+    std::error_code error;
+    std::filesystem::remove_all(path_, error);
+  }
+
+  const std::filesystem::path& path() const { return path_; }
+
+ private:
+  std::filesystem::path path_;
+};
+
+void WriteFile(const std::filesystem::path& path) {
+  std::filesystem::create_directories(path.parent_path());
+  std::ofstream(path) << "x";
+}
+
+// Joins strings the way a string table stores them: each followed by a NUL.
+std::vector<std::uint8_t> StringTable(
+    const std::vector<std::string_view>& strings) {
+  std::vector<std::uint8_t> table;
+  for (std::string_view text : strings) {
+    table.insert(table.end(), text.begin(), text.end());
+    table.push_back(0);
+  }
+  return table;
+}
+
+std::string TextAt(const std::vector<std::uint8_t>& table, std::size_t offset) {
+  return std::string(reinterpret_cast<const char*>(table.data()) + offset);
+}
+
+TEST(AssetOverlayNamesTest, ListsFilesUnderContentAsRbxAssetNames) {
+  TemporaryDirectory overlay;
+  ASSERT_FALSE(overlay.path().empty());
+  WriteFile(overlay.path() / "content/textures/MouseLockedCursor.png");
+  WriteFile(overlay.path() /
+            "content/textures/Cursors/KeyboardMouse/IBeamCursor.png");
+  WriteFile(overlay.path() / "notes.txt");
+  std::filesystem::create_directories(overlay.path() / "content/empty");
+
+  EXPECT_EQ(OverlayRbxAssetNames(overlay.path()),
+            (std::vector<std::string>{
+                "rbxasset://textures/Cursors/KeyboardMouse/IBeamCursor.png",
+                "rbxasset://textures/MouseLockedCursor.png",
+            }));
+}
+
+TEST(AssetOverlayNamesTest, MissingOverlayFolderHasNoNames) {
+  TemporaryDirectory overlay;
+  ASSERT_FALSE(overlay.path().empty());
+
+  EXPECT_TRUE(OverlayRbxAssetNames(overlay.path() / "absent").empty());
+  EXPECT_TRUE(OverlayRbxAssetNames(overlay.path()).empty());
+}
+
+TEST(AssetOverlayNamesTest, ChangesOnlyTheNamedWholeStrings) {
+  const std::string name = "rbxasset://textures/MouseLockedCursor.png";
+  const std::string longer = name + ".bak";
+  const std::string prefixed = "x" + name;
+  std::vector<std::uint8_t> table =
+      StringTable({"first", name, longer, prefixed, name});
+  const std::size_t first_copy = 6;
+  const std::size_t longer_copy = first_copy + name.size() + 1;
+  const std::size_t prefixed_copy = longer_copy + longer.size() + 1;
+  const std::size_t second_copy = prefixed_copy + prefixed.size() + 1;
+
+  EXPECT_EQ(DisableAssetNameMappings(table.data(), table.size(), {name}), 2u);
+
+  EXPECT_EQ(TextAt(table, 0), "first");
+  EXPECT_EQ(TextAt(table, first_copy), "!" + name.substr(1));
+  EXPECT_EQ(TextAt(table, longer_copy), longer);
+  EXPECT_EQ(TextAt(table, prefixed_copy), prefixed);
+  EXPECT_EQ(TextAt(table, second_copy), "!" + name.substr(1));
+}
+
+TEST(AssetOverlayNamesTest, MatchesANameAtTheStartOfTheData) {
+  const std::string name = "rbxasset://textures/IBeamCursor.png";
+  std::vector<std::uint8_t> table = StringTable({name, "other"});
+
+  EXPECT_EQ(DisableAssetNameMappings(table.data(), table.size(), {name}), 1u);
+  EXPECT_EQ(TextAt(table, 0), "!" + name.substr(1));
+}
+
+TEST(AssetOverlayNamesTest, LeavesDataAloneWithoutAMatch) {
+  std::vector<std::uint8_t> table = StringTable({"alpha", "beta"});
+  const std::vector<std::uint8_t> before = table;
+
+  EXPECT_EQ(DisableAssetNameMappings(table.data(), table.size(),
+                                     {"rbxasset://missing.png", ""}),
+            0u);
+  EXPECT_EQ(table, before);
+  EXPECT_EQ(DisableAssetNameMappings(nullptr, 0, {"alpha"}), 0u);
+}
+
+}  // namespace
@@ -13,6 +13,7 @@
 #include <cstdint>
 #include <cstring>
 #include <limits>
+#include <string>
 #include <thread>

 #include "libc_shim/libc_shim.h"
@@ -205,6 +206,21 @@ TEST(BionicHostLibcRuntimeTest, HidesPrivilegedHostIdentityFromAndroidGuest) {
            mocktail::compat::NormalizeBionicApplicationUid(::geteuid()));
 }

+TEST(BionicHostLibcRuntimeTest, ParsesAtoiWithBionicOverflowBehavior) {
+  EXPECT_EQ(mocktail_bionic_atoi(""), 0);
+  EXPECT_EQ(mocktail_bionic_atoi("invalid"), 0);
+  EXPECT_EQ(mocktail_bionic_atoi("  -42suffix"), -42);
+  EXPECT_EQ(mocktail_bionic_atoi("2147483647"), INT_MAX);
+  EXPECT_EQ(mocktail_bionic_atoi("-2147483648"), INT_MIN);
+  EXPECT_EQ(mocktail_bionic_atoi("2147483648"), INT_MIN);
+  EXPECT_EQ(mocktail_bionic_atoi("4294967295"), -1);
+  EXPECT_EQ(mocktail_bionic_atoi("9999999999"), 1410065407);
+
+  errno = 0;
+  EXPECT_EQ(mocktail_bionic_atoi("9223372036854775808"), -1);
+  EXPECT_EQ(errno, ERANGE);
+}
+
 TEST(BionicHostLibcRuntimeTest, UsesBionicPosixStrErrorContract) {
  std::array<char, 128> buffer{};

@@ -214,9 +230,18 @@ TEST(BionicHostLibcRuntimeTest, UsesBionicPosixStrErrorContract) {
  EXPECT_NE(std::strstr(buffer.data(), "Invalid"), nullptr);
  EXPECT_EQ(errno, EDOM);

-  buffer.fill('\0');
-  EXPECT_EQ(mocktail_bionic_strerror_r(4567, buffer.data(), buffer.size()), 0);
-  EXPECT_NE(std::strstr(buffer.data(), "4567"), nullptr);
+  EXPECT_EQ(mocktail_bionic_strerror_r(0, buffer.data(), buffer.size()), 0);
+  EXPECT_STREQ(buffer.data(), std::strerror(0));
+  EXPECT_EQ(errno, EDOM);
+
+  for (const int error_number : {-1, 41, 58, 134, 4567, INT_MIN, INT_MAX}) {
+    errno = EDOM;
+    ASSERT_EQ(mocktail_bionic_strerror_r(error_number, buffer.data(),
+                                       buffer.size()), 0);
+    EXPECT_EQ(std::string(buffer.data()),
+              "Unknown error " + std::to_string(error_number));
+    EXPECT_EQ(errno, EDOM);
+  }

  std::array<char, 2> truncated{};
  errno = 0;
@@ -231,9 +231,79 @@ TEST_F(BrowserTrackerServiceTest,
  EXPECT_EQ(storage_parent.st_mode & 0777, 0700U);
 }

+TEST_F(BrowserTrackerServiceTest, TightensOwnedGroupWritableStorageDirectory) {
+  std::filesystem::create_directories(Storage().parent_path());
+  ASSERT_EQ(chmod(Storage().parent_path().c_str(), 0775), 0);
+  std::ofstream(Cookies()) << ".ROBLOSECURITY=secret";
+  FakeHttpClient http;
+  http.response = {true,
+                   200,
+                   R"({"browserTrackerId":987654321})",
+                   "",
+                   {"Set-Cookie: RBXEventTrackerV2="
+                    "CreateDate=1&rbxid=2&browserid=987654321; Path=/"}};
+
+  const BrowserTrackerResult result =
+      BrowserTrackerService(http).EnsureInitialized(Storage(), Cookies(), true);
+
+  ASSERT_TRUE(result) << result.error;
+  EXPECT_EQ(result.browser_tracker_id, "987654321");
+  struct stat storage_parent = {};
+  ASSERT_EQ(stat(Storage().parent_path().c_str(), &storage_parent), 0);
+  EXPECT_EQ(storage_parent.st_mode & 0777, 0755U);
+}
+
+TEST_F(BrowserTrackerServiceTest, RejectsStorageFileItCannotVouchFor) {
+  std::filesystem::create_directories(Storage().parent_path());
+  ASSERT_EQ(chmod(Storage().parent_path().c_str(), 0775), 0);
+  const std::filesystem::path planted = root_ / "planted.json";
+  std::ofstream(planted) << R"({"BrowserTrackerId":"123456"})";
+  std::ofstream(Cookies()) << ".ROBLOSECURITY=secret";
+  FakeHttpClient http;
+
+  // A second hard link means another name can still change the contents.
+  std::filesystem::create_hard_link(planted, Storage());
+  BrowserTrackerResult result =
+      BrowserTrackerService(http).EnsureInitialized(Storage(), Cookies(), true);
+  EXPECT_FALSE(result);
+  EXPECT_EQ(result.error, "appStorage is not a private regular file");
+
+  std::filesystem::remove(Storage());
+  std::filesystem::create_symlink(planted, Storage());
+  result =
+      BrowserTrackerService(http).EnsureInitialized(Storage(), Cookies(), true);
+  EXPECT_FALSE(result);
+  EXPECT_EQ(result.error, "appStorage is not a private regular file");
+  EXPECT_EQ(http.post_count, 0);
+  EXPECT_EQ(ReadFile(planted), R"({"BrowserTrackerId":"123456"})");
+}
+
+TEST_F(BrowserTrackerServiceTest, ReplacesRobloxUnsetStoredIdentity) {
+  std::filesystem::create_directories(Storage().parent_path());
+  std::ofstream(Storage()) << R"({"BrowserTrackerId":"0","keep":true})";
+  std::ofstream(Cookies()) << ".ROBLOSECURITY=secret";
+  FakeHttpClient http;
+  http.response = {true,
+                   200,
+                   R"({"browserTrackerId":987654321})",
+                   "",
+                   {"Set-Cookie: RBXEventTrackerV2="
+                    "CreateDate=1&rbxid=2&browserid=987654321; Path=/"}};
+
+  const BrowserTrackerResult result =
+      BrowserTrackerService(http).EnsureInitialized(Storage(), Cookies(), true);
+
+  ASSERT_TRUE(result) << result.error;
+  EXPECT_EQ(result.status, BrowserTrackerStatus::kCreated);
+  std::ifstream input(Storage());
+  const nlohmann::json saved = nlohmann::json::parse(input);
+  EXPECT_EQ(saved.at("BrowserTrackerId"), "987654321");
+  EXPECT_TRUE(saved.at("keep"));
+}
+
 TEST_F(BrowserTrackerServiceTest, RejectsCorruptStoredIdentityFailClosed) {
  std::filesystem::create_directories(Storage().parent_path());
-  std::ofstream(Storage()) << R"({"BrowserTrackerId":"0"})";
+  std::ofstream(Storage()) << R"({"BrowserTrackerId":"12x"})";
  std::ofstream(Cookies()) << ".ROBLOSECURITY=secret";
  FakeHttpClient http;

@@ -364,7 +434,7 @@ TEST_F(BrowserTrackerServiceTest,
      BrowserTrackerService(http).EnsureInitialized(Storage(), Cookies(), true);

  EXPECT_FALSE(result);
-  EXPECT_EQ(result.error, "cannot atomically replace appStorage");
+  EXPECT_EQ(result.error, "appStorage is not a private regular file");
  EXPECT_EQ(http.post_count, 0);
  EXPECT_EQ(ReadFile(protected_storage), storage_contents);
  EXPECT_EQ(ReadFile(Storage()), storage_contents);
@@ -29,6 +29,13 @@ import types
 import unittest
 from unittest import mock

+from host_abi_regression import (
+    expected_runtime,
+    load_regression_build,
+    regression_library,
+    regression_manifest,
+    regression_sidecar,
+)

 PROJECT_ROOT = Path(__file__).resolve().parents[1]
 ANALYZER_PATH = PROJECT_ROOT / "scripts" / "derive_roblox_host_abi_profile.py"
@@ -50,6 +57,10 @@ LATEST_CANDIDATE_METADATA = (
 LATEST_REFERENCE_PROFILE = REFERENCE_PROFILE_PATH
 DEVICE_LISTS_PAYLOAD_ID = "3092-5f0704edd9064f566ee3d6df2bd2fabbcc709f03"
 DEVICE_LISTS_LIBRARY = PAYLOAD_ROOT / DEVICE_LISTS_PAYLOAD_ID / "libroblox.so"
+FALLBACK_CANDIDATE_PAYLOAD_ID = "3222-a67a91ef96c700c0730acd36a250c2f93cfafbc1"
+FALLBACK_CANDIDATE_LIBRARY = (
+    PAYLOAD_ROOT / FALLBACK_CANDIDATE_PAYLOAD_ID / "libroblox.so"
+)


 def load_analyzer():
@@ -356,6 +367,61 @@ class SignatureSemanticsTest(unittest.TestCase):

        ANALYZER.validate_semantic_match(reference, candidate, spec)

+    REGISTRY_BODY = (
+        "bf38030000 e800000000 4889c3 4531f6 ba38030000 "
+        "4889c7 31f6 e800000000 b80000803f 894320 488d4b28"
+    )
+
+    def renamed_registry_body_spec(self, renamed: tuple[int, ...]):
+        return ANALYZER.SignatureSpec(
+            "registry-body", 0x1000, 11, True, 6, (0, 4), renamed
+        )
+
+    def test_registry_body_registers_may_be_renamed(self) -> None:
+        reference = decode_x86(bytes.fromhex(self.REGISTRY_BODY))
+        # r15d for r14d, r13d for eax, r12 for rcx, and a smaller object.
+        candidate = decode_x86(
+            bytes.fromhex(
+                "bff8020000 e800000000 4889c3 4531ff baf8020000 "
+                "4889c7 31f6 e800000000 41bd0000803f 44896b20 4c8d6328"
+            ),
+            0x2000,
+        )
+
+        ANALYZER.validate_semantic_match(
+            reference, candidate, self.renamed_registry_body_spec((3, 8, 9, 10))
+        )
+        with self.assertRaisesRegex(ANALYZER.AnalyzerError, "semantics changed"):
+            ANALYZER.validate_semantic_match(
+                reference, candidate, self.renamed_registry_body_spec(())
+            )
+
+    def test_renamed_registers_must_stay_consistent(self) -> None:
+        reference = decode_x86(bytes.fromhex(self.REGISTRY_BODY))
+        # The constant goes to r13d but r14d is stored.
+        two_for_one = decode_x86(
+            bytes.fromhex(
+                "bff8020000 e800000000 4889c3 4531ff baf8020000 "
+                "4889c7 31f6 e800000000 41bd0000803f 44897320 4c8d6328"
+            ),
+            0x2000,
+        )
+        # r13 stands for both r14 and rax.
+        one_for_two = decode_x86(
+            bytes.fromhex(
+                "bff8020000 e800000000 4889c3 4531ed baf8020000 "
+                "4889c7 31f6 e800000000 41bd0000803f 44896b20 4c8d6328"
+            ),
+            0x2000,
+        )
+        spec = self.renamed_registry_body_spec((3, 8, 9, 10))
+
+        for candidate in (two_for_one, one_for_two):
+            with self.assertRaisesRegex(
+                ANALYZER.AnalyzerError, "semantics changed"
+            ):
+                ANALYZER.validate_semantic_match(reference, candidate, spec)
+
    def test_short_anchor_is_opt_in(self) -> None:
        encoded = b"abc\0def"
        mask = b"\x01\x01\x01\0\x01\x01\x01"
@@ -364,6 +430,116 @@ class SignatureSemanticsTest(unittest.TestCase):
        self.assertEqual(ANALYZER.longest_fixed_anchor(encoded, mask, 3), (0, b"abc"))


+class ConstructorRangeRemapTest(unittest.TestCase):
+    HOST_BRIDGE = [
+        {"begin": 2, "end_exclusive": 3},
+        {"begin": 5, "end_exclusive": 100},
+    ]
+    NATIVE = [{"begin": 2, "end_exclusive": 100}]
+    # The 2.742 order: reference constructors 2, 3, 4, 5 are candidate
+    # constructors 5, 2, 4, 3.
+    REORDERED = (3, 0, 2, 1)
+
+    def test_same_order_only_moves_the_end(self) -> None:
+        self.assertEqual(
+            ANALYZER.remapped_constructor_ranges(
+                self.HOST_BRIDGE, (0, 1, 2, 3), 100, 120
+            ),
+            [
+                {"begin": 2, "end_exclusive": 3},
+                {"begin": 5, "end_exclusive": 120},
+            ],
+        )
+
+    def test_leading_constructors_follow_their_new_index(self) -> None:
+        self.assertEqual(
+            ANALYZER.remapped_constructor_ranges(
+                self.HOST_BRIDGE, self.REORDERED, 100, 120
+            ),
+            [
+                {"begin": 3, "end_exclusive": 4},
+                {"begin": 5, "end_exclusive": 120},
+            ],
+        )
+        self.assertEqual(
+            ANALYZER.remapped_constructor_ranges(
+                self.NATIVE, self.REORDERED, 100, 120
+            ),
+            [{"begin": 2, "end_exclusive": 120}],
+        )
+
+    def test_rejects_ranges_outside_the_verified_shape(self) -> None:
+        for ranges in (
+            # Runs a constructor before the leading four.
+            [{"begin": 1, "end_exclusive": 100}],
+            # Stops before the end of the init-array.
+            [{"begin": 2, "end_exclusive": 99}],
+            # Skips a constructor after the leading four.
+            [{"begin": 2, "end_exclusive": 6}, {"begin": 7, "end_exclusive": 100}],
+        ):
+            with self.assertRaisesRegex(ANALYZER.AnalyzerError, "cannot fit"):
+                ANALYZER.remapped_constructor_ranges(
+                    ranges, self.REORDERED, 100, 120
+                )
+
+
+@unittest.skipIf(ANALYZER.capstone is None, "Python capstone is unavailable")
+class JniSingletonPublicationTest(unittest.TestCase):
+    class Image:
+        def __init__(self, encoded: bytes):
+            self.data = encoded
+            self.file_size = len(encoded)
+
+        def require_code_rva(self, rva: int, size: int = 1) -> None:
+            if rva != 0x1000 or size > len(self.data):
+                raise ANALYZER.AnalyzerError("unexpected code RVA")
+
+        def rva_to_offset(self, rva: int, size: int = 1) -> int:
+            return rva - 0x1000
+
+        def bytes_at(self, offset: int, size: int, _description: str) -> bytes:
+            return self.data[offset : offset + size]
+
+    @staticmethod
+    def publication(rva: int, slot: int, stored: int) -> bytes:
+        def rip(opcode: str, instruction_rva: int, target: int) -> bytes:
+            return bytes.fromhex(opcode) + struct.pack(
+                "<i", target - (instruction_rva + 7)
+            )
+
+        return (
+            rip("488d05", rva, slot + 8)
+            + rip("488705", rva + 7, slot)
+            + rip("488905", rva + 14, stored)
+        )
+
+    def test_finds_the_publication_with_and_without_a_frame(self) -> None:
+        bare = self.Image(self.publication(0x1000, 0x2000, 0x2008) + b"\xc3")
+        framed = self.Image(
+            bytes.fromhex("554889e5")
+            + self.publication(0x1004, 0x2000, 0x2008)
+            + b"\x5d\xc3"
+        )
+
+        self.assertEqual(
+            ANALYZER.jni_singleton_publication(bare, 0x1000)[0].address, 0x1000
+        )
+        publication = ANALYZER.jni_singleton_publication(framed, 0x1000)
+        self.assertEqual(len(publication), 3)
+        self.assertEqual(publication[0].address, 0x1004)
+        self.assertEqual(ANALYZER.rip_targets(publication[1]), (0x2000,))
+
+    def test_rejects_code_that_publishes_nothing(self) -> None:
+        other_object = self.Image(
+            self.publication(0x1000, 0x2000, 0x2010) + b"\xc3"
+        )
+        unrelated = self.Image(bytes.fromhex("554889e5 4157 4156 4155 c3"))
+
+        for image in (other_object, unrelated):
+            with self.assertRaisesRegex(ANALYZER.AnalyzerError, "does not publish"):
+                ANALYZER.jni_singleton_publication(image, 0x1000)
+
+
@unittest.skipIf(ANALYZER.capstone is None, "Python capstone is unavailable")
 class RegistrySlotDerivationTest(unittest.TestCase):
    class Image:
@@ -634,5 +810,88 @@ class DeviceListsRuntimeCompatibilityAcceptanceTest(unittest.TestCase):
            self.assertEqual(derived["fmod_output_device_bridge"], self.EXPECTED_BRIDGE)


+@unittest.skipUnless(
+    ANALYZER.capstone is not None
+    and CANDIDATE_LIBRARY.is_file()
+    and DEVICE_LISTS_LIBRARY.is_file()
+    and FALLBACK_CANDIDATE_LIBRARY.is_file(),
+    "local exact 2998, 3092 and 3222 payloads are unavailable",
+)
+class FallbackRuntimeCompatibilityAcceptanceTest(unittest.TestCase):
+    MANIFESTS = (PROJECT_ROOT / "config" / "roblox_compatibility.json",)
+
+    def test_fallback_library_supplies_missing_fmod_bridge(self):
+        # The shipped manifest describes 2998 but not 3092.
+        with ANALYZER.ElfImage(DEVICE_LISTS_LIBRARY) as reference, ANALYZER.ElfImage(
+            FALLBACK_CANDIDATE_LIBRARY
+        ) as candidate, ANALYZER.ElfImage(CANDIDATE_LIBRARY) as fallback:
+            without = ANALYZER.derive_runtime_compatibility(
+                reference, candidate, self.MANIFESTS)
+            derived = ANALYZER.derive_runtime_compatibility(
+                reference, candidate, self.MANIFESTS, fallback)
+        self.assertNotIn("fmod_output_device_bridge", without)
+        bridge = derived["fmod_output_device_bridge"]
+        self.assertEqual(bridge["vtable_layout_version"], 2)
+        self.assertIn("input_count_method_rva", bridge)
+
+    def test_fallback_without_anchors_leaves_bridge_out(self):
+        with ANALYZER.ElfImage(DEVICE_LISTS_LIBRARY) as reference, ANALYZER.ElfImage(
+            FALLBACK_CANDIDATE_LIBRARY
+        ) as candidate:
+            derived = ANALYZER.derive_runtime_compatibility(
+                reference, candidate, self.MANIFESTS, reference)
+        self.assertNotIn("fmod_output_device_bridge", derived)
+
+
+# Each pair derives the second build from the first.
+REGRESSION_PAIRS = (("2908", "2998"), ("2998", "3092"), ("3092", "3222"))
+
+
+def regression_reference_inputs(build: dict, directory: Path) -> tuple[Path, Path]:
+    sidecar_path = directory / "reference_profile.json"
+    manifest_path = directory / "reference_compatibility.json"
+    sidecar_path.write_text(json.dumps(regression_sidecar(build)), encoding="utf-8")
+    manifest_path.write_text(json.dumps(regression_manifest(build)), encoding="utf-8")
+    return sidecar_path, manifest_path
+
+
+@unittest.skipUnless(ANALYZER.capstone is not None, "Python capstone is unavailable")
+class KnownBuildRegressionTest(unittest.TestCase):
+    def test_fixtures_match_their_build_identity(self) -> None:
+        for name in {name for pair in REGRESSION_PAIRS for name in pair}:
+            build = load_regression_build(name)
+            self.assertEqual(build["payload_id"].split("-", 1), [name, build["elf_build_id"]])
+            self.assertEqual(build["profile"]["elf_build_id"], build["elf_build_id"])
+            self.assertNotEqual(build["reference"]["elf_build_id"], build["elf_build_id"])
+
+    def test_derives_each_build_from_its_predecessor(self) -> None:
+        for reference_name, candidate_name in REGRESSION_PAIRS:
+            with self.subTest(reference=reference_name, candidate=candidate_name):
+                self.derive_pair(reference_name, candidate_name)
+
+    def derive_pair(self, reference_name: str, candidate_name: str) -> None:
+        reference = load_regression_build(reference_name)
+        candidate = load_regression_build(candidate_name)
+        reference_library = regression_library(reference)
+        candidate_library = regression_library(candidate)
+        if reference_library is None or candidate_library is None:
+            self.skipTest(f"exact {reference_name} and {candidate_name} payloads are unavailable")
+        with tempfile.TemporaryDirectory() as temporary:
+            sidecar_path, manifest_path = regression_reference_inputs(reference, Path(temporary))
+            sidecar = ANALYZER.validated_sidecar(sidecar_path)
+            with ANALYZER.ElfImage(reference_library) as reference_image, ANALYZER.ElfImage(
+                candidate_library
+            ) as candidate_image:
+                profile, anchors = ANALYZER.derive_profile(
+                    reference_image, candidate_image, sidecar
+                )
+                runtime = ANALYZER.derive_runtime_compatibility(
+                    reference_image, candidate_image, (manifest_path,)
+                )
+        self.assertEqual(profile, candidate["profile"])
+        self.assertEqual(anchors, candidate["derivation_anchors"])
+        self.assertEqual(runtime, expected_runtime(reference, candidate))
+
+
 if __name__ == "__main__":
    unittest.main()
@@ -0,0 +1,109 @@
+{
+  "derivation_anchors": {
+    "allocator_object_initializer_rva": "0x2186a91",
+    "constructor_rvas": {
+      "2": "0x1cf9f31",
+      "3": "0x1cf5680",
+      "4": "0x1cf63c8",
+      "5": "0x1cf6309"
+    },
+    "empty_string_initializer_rva": "0x2192669",
+    "jni_singleton_initializer_rva": "0x1cf6309",
+    "signature_version": 1
+  },
+  "elf_build_id": "63c5109637b7d7b2bdb8ed8f858023ff5ef49326",
+  "libroblox_sha256": "72c3b1a5c151b5ac0bfc5394ce3a91775884fbd777589ccab8ac1c4f9885f739",
+  "payload_id": "2908-63c5109637b7d7b2bdb8ed8f858023ff5ef49326",
+  "profile": {
+    "bridge_entries": [
+      {
+        "kind": "allocate",
+        "label": "small-allocate",
+        "rva": "0x1cf69e2"
+      },
+      {
+        "kind": "usable_size",
+        "label": "usable-size",
+        "rva": "0x1cf9c3a"
+      },
+      {
+        "kind": "reallocate",
+        "label": "reallocate",
+        "rva": "0x21af33f"
+      },
+      {
+        "kind": "allocate",
+        "label": "allocate",
+        "rva": "0x1cf677e"
+      },
+      {
+        "kind": "aligned_allocate",
+        "label": "aligned-allocate-direct",
+        "rva": "0x1d12197"
+      },
+      {
+        "kind": "free",
+        "label": "free",
+        "rva": "0x1cfa1d9"
+      }
+    ],
+    "constructor_run_ranges": [
+      {
+        "begin": 2,
+        "end_exclusive": 3
+      },
+      {
+        "begin": 5,
+        "end_exclusive": 3556
+      }
+    ],
+    "data_seeds": {
+      "allocator_object_slot": "0x7571570",
+      "allocator_thread_initializer": "0x1d82be7",
+      "arena_guard_slot": "0x7a10730",
+      "arena_initializer": "0x1cf6df8",
+      "arena_table_slot": "0x7a107c0",
+      "arena_table_slot_count": 4194304,
+      "empty_string_slot": "0x767e428",
+      "jni_singleton_bytes": 1024,
+      "jni_singleton_slot": "0x7ad47e8"
+    },
+    "default_allocator_strategy": "native_mimalloc",
+    "elf_build_id": "63c5109637b7d7b2bdb8ed8f858023ff5ef49326",
+    "init_array_count": 3556,
+    "init_array_offset": "0x6f78a18",
+    "native_allocator": {
+      "allocate": "0x1cf677e",
+      "deallocate": "0x1cfa1d9"
+    },
+    "native_mimalloc_constructor_run_ranges": [
+      {
+        "begin": 2,
+        "end_exclusive": 3556
+      }
+    ],
+    "native_mimalloc_thread_initializer_after_constructor": 2,
+    "native_pre_jni_bootstrap": {
+      "registry_initializer": "0x21b1889",
+      "registry_slot": "0x7a14898"
+    }
+  },
+  "reference": {
+    "elf_build_id": "1686400865ae0e408cd7bd67de7a439625c6fd13",
+    "payload_sha256": "3e9c26c81186f93458ff65d8a8bc240c220974db02b8388b91340b77b336997d"
+  },
+  "runtime_compatibility": {
+    "fmod_output_device_bridge": {
+      "count_method_rva": "0x32736d2",
+      "current_method_rva": "0x3273722",
+      "info_method_rva": "0x3273772",
+      "select_method_rva": "0x32734a6",
+      "string_constructor_rva": "0x1cfd5ec",
+      "vtable_rva": "0x6b7eee8"
+    },
+    "user_game_settings_fullscreen_setter_rva": "0x44fee64"
+  },
+  "schema_version": 1,
+  "version_code": 2908,
+  "version_name": "2.734.917"
+}
@@ -0,0 +1,113 @@
+{
+  "derivation_anchors": {
+    "allocator_object_initializer_rva": "0x21bde7d",
+    "constructor_rvas": {
+      "2": "0x1d2f731",
+      "3": "0x1d2af84",
+      "4": "0x1d2bc08",
+      "5": "0x1d2aec0"
+    },
+    "empty_string_initializer_rva": "0x21c9a86",
+    "jni_singleton_initializer_rva": "0x1d2aec0",
+    "signature_version": 1
+  },
+  "elf_build_id": "ade08266c67aee88ec9c1d00902150e1684dad3a",
+  "libroblox_sha256": "4343a6a900d1fca27ff8e10b9d9c86bee40a5d0ba547cb29903b7769f4f42a9d",
+  "payload_id": "2998-ade08266c67aee88ec9c1d00902150e1684dad3a",
+  "profile": {
+    "bridge_entries": [
+      {
+        "kind": "allocate",
+        "label": "small-allocate",
+        "rva": "0x1d2c1e2"
+      },
+      {
+        "kind": "usable_size",
+        "label": "usable-size",
+        "rva": "0x1d2f43a"
+      },
+      {
+        "kind": "reallocate",
+        "label": "reallocate",
+        "rva": "0x21e68bf"
+      },
+      {
+        "kind": "allocate",
+        "label": "allocate",
+        "rva": "0x1d2bf82"
+      },
+      {
+        "kind": "aligned_allocate",
+        "label": "aligned-allocate-direct",
+        "rva": "0x1d47a63"
+      },
+      {
+        "kind": "free",
+        "label": "free",
+        "rva": "0x1d2f9d9"
+      }
+    ],
+    "constructor_run_ranges": [
+      {
+        "begin": 2,
+        "end_exclusive": 3
+      },
+      {
+        "begin": 5,
+        "end_exclusive": 3570
+      }
+    ],
+    "data_seeds": {
+      "allocator_object_slot": "0x7652e70",
+      "allocator_thread_initializer": "0x1db7b57",
+      "arena_guard_slot": "0x7af0430",
+      "arena_initializer": "0x1d2c5f8",
+      "arena_table_slot": "0x7af04c0",
+      "arena_table_slot_count": 4194304,
+      "empty_string_slot": "0x775fd28",
+      "jni_singleton_bytes": 1024,
+      "jni_singleton_slot": "0x7bb4340"
+    },
+    "default_allocator_strategy": "native_mimalloc",
+    "elf_build_id": "ade08266c67aee88ec9c1d00902150e1684dad3a",
+    "init_array_count": 3570,
+    "init_array_offset": "0x7057818",
+    "native_allocator": {
+      "allocate": "0x1d2bf82",
+      "deallocate": "0x1d2f9d9"
+    },
+    "native_mimalloc_constructor_run_ranges": [
+      {
+        "begin": 2,
+        "end_exclusive": 3570
+      }
+    ],
+    "native_mimalloc_thread_initializer_after_constructor": 2,
+    "native_pre_jni_bootstrap": {
+      "registry_initializer": "0x21e8e09",
+      "registry_slot": "0x7af4598"
+    }
+  },
+  "reference": {
+    "elf_build_id": "63c5109637b7d7b2bdb8ed8f858023ff5ef49326",
+    "payload_sha256": "72c3b1a5c151b5ac0bfc5394ce3a91775884fbd777589ccab8ac1c4f9885f739"
+  },
+  "runtime_compatibility": {
+    "fmod_output_device_bridge": {
+      "count_method_rva": "0x32d0ee0",
+      "current_method_rva": "0x32d0f30",
+      "info_method_rva": "0x32d0f80",
+      "input_count_method_rva": "0x32d12dc",
+      "input_current_method_rva": "0x32d13a6",
+      "input_info_method_rva": "0x32d12ea",
+      "input_select_method_rva": "0x32d0a56",
+      "select_method_rva": "0x32d0cb4",
+      "string_constructor_rva": "0x1d32df8",
+      "vtable_rva": "0x6c58040"
+    },
+    "user_game_settings_fullscreen_setter_rva": "0x45ad8aa"
+  },
+  "schema_version": 1,
+  "version_code": 2998,
+  "version_name": "2.736.1408"
+}
@@ -0,0 +1,114 @@
+{
+  "derivation_anchors": {
+    "allocator_object_initializer_rva": "0x2206883",
+    "constructor_rvas": {
+      "2": "0x1d76971",
+      "3": "0x1d721bf",
+      "4": "0x1d72e43",
+      "5": "0x1d72100"
+    },
+    "empty_string_initializer_rva": "0x2212949",
+    "jni_singleton_initializer_rva": "0x1d72100",
+    "signature_version": 1
+  },
+  "elf_build_id": "5f0704edd9064f566ee3d6df2bd2fabbcc709f03",
+  "libroblox_sha256": "8f7079c8977b88c8d9b61be201f7156b5041d7623863357f9ad6c3b0062531e9",
+  "payload_id": "3092-5f0704edd9064f566ee3d6df2bd2fabbcc709f03",
+  "profile": {
+    "bridge_entries": [
+      {
+        "kind": "allocate",
+        "label": "small-allocate",
+        "rva": "0x1d73422"
+      },
+      {
+        "kind": "usable_size",
+        "label": "usable-size",
+        "rva": "0x1d7667a"
+      },
+      {
+        "kind": "reallocate",
+        "label": "reallocate",
+        "rva": "0x222f4c0"
+      },
+      {
+        "kind": "allocate",
+        "label": "allocate",
+        "rva": "0x1d731c2"
+      },
+      {
+        "kind": "aligned_allocate",
+        "label": "aligned-allocate-direct",
+        "rva": "0x1d8e7f9"
+      },
+      {
+        "kind": "free",
+        "label": "free",
+        "rva": "0x1d76c19"
+      }
+    ],
+    "constructor_run_ranges": [
+      {
+        "begin": 2,
+        "end_exclusive": 3
+      },
+      {
+        "begin": 5,
+        "end_exclusive": 3599
+      }
+    ],
+    "data_seeds": {
+      "allocator_object_slot": "0x76e2da0",
+      "allocator_thread_initializer": "0x1dffad7",
+      "arena_guard_slot": "0x7b87830",
+      "arena_initializer": "0x1d73838",
+      "arena_table_slot": "0x7b878c0",
+      "arena_table_slot_count": 4194304,
+      "empty_string_slot": "0x77efb98",
+      "jni_singleton_bytes": 1024,
+      "jni_singleton_slot": "0x7c4b780"
+    },
+    "default_allocator_strategy": "native_mimalloc",
+    "elf_build_id": "5f0704edd9064f566ee3d6df2bd2fabbcc709f03",
+    "init_array_count": 3599,
+    "init_array_offset": "0x70e1618",
+    "native_allocator": {
+      "allocate": "0x1d731c2",
+      "deallocate": "0x1d76c19"
+    },
+    "native_mimalloc_constructor_run_ranges": [
+      {
+        "begin": 2,
+        "end_exclusive": 3599
+      }
+    ],
+    "native_mimalloc_thread_initializer_after_constructor": 2,
+    "native_pre_jni_bootstrap": {
+      "registry_initializer": "0x22308d3",
+      "registry_slot": "0x7b8b998"
+    }
+  },
+  "reference": {
+    "elf_build_id": "ade08266c67aee88ec9c1d00902150e1684dad3a",
+    "payload_sha256": "4343a6a900d1fca27ff8e10b9d9c86bee40a5d0ba547cb29903b7769f4f42a9d"
+  },
+  "runtime_compatibility": {
+    "fmod_output_device_bridge": {
+      "count_method_rva": "0x320c676",
+      "current_method_rva": "0x320c6c6",
+      "info_method_rva": "0x320c716",
+      "input_count_method_rva": "0x320ccf6",
+      "input_current_method_rva": "0x320d152",
+      "input_info_method_rva": "0x320cd04",
+      "input_select_method_rva": "0x320bd18",
+      "select_method_rva": "0x320bf78",
+      "string_constructor_rva": "0x1d7a038",
+      "vtable_layout_version": 2,
+      "vtable_rva": "0x6cd3ce0"
+    },
+    "user_game_settings_fullscreen_setter_rva": "0x45c5f42"
+  },
+  "schema_version": 1,
+  "version_code": 3092,
+  "version_name": "2.738.1397"
+}
@@ -0,0 +1,114 @@
+{
+  "derivation_anchors": {
+    "allocator_object_initializer_rva": "0x221bb6b",
+    "constructor_rvas": {
+      "2": "0x1e140f0",
+      "3": "0x1e14f8b",
+      "4": "0x1e13f80",
+      "5": "0x1e189db"
+    },
+    "empty_string_initializer_rva": "0x2227e95",
+    "jni_singleton_initializer_rva": "0x1e14f8b",
+    "signature_version": 1
+  },
+  "elf_build_id": "a67a91ef96c700c0730acd36a250c2f93cfafbc1",
+  "libroblox_sha256": "4892d8949918db453f72d3db64093bc985f3ed6dba870a6381d9f3be3b7a3338",
+  "payload_id": "3222-a67a91ef96c700c0730acd36a250c2f93cfafbc1",
+  "profile": {
+    "bridge_entries": [
+      {
+        "kind": "allocate",
+        "label": "small-allocate",
+        "rva": "0x1e154a2"
+      },
+      {
+        "kind": "usable_size",
+        "label": "usable-size",
+        "rva": "0x1e18647"
+      },
+      {
+        "kind": "reallocate",
+        "label": "reallocate",
+        "rva": "0x22446da"
+      },
+      {
+        "kind": "allocate",
+        "label": "allocate",
+        "rva": "0x1e15256"
+      },
+      {
+        "kind": "aligned_allocate",
+        "label": "aligned-allocate-direct",
+        "rva": "0x1e2eae7"
+      },
+      {
+        "kind": "free",
+        "label": "free",
+        "rva": "0x1e18c83"
+      }
+    ],
+    "constructor_run_ranges": [
+      {
+        "begin": 3,
+        "end_exclusive": 4
+      },
+      {
+        "begin": 5,
+        "end_exclusive": 3678
+      }
+    ],
+    "data_seeds": {
+      "allocator_object_slot": "0x732dec8",
+      "allocator_thread_initializer": "0x1e95df7",
+      "arena_guard_slot": "0x7a75430",
+      "arena_initializer": "0x1e15827",
+      "arena_table_slot": "0x7a754c0",
+      "arena_table_slot_count": 4194304,
+      "empty_string_slot": "0x79a6130",
+      "jni_singleton_bytes": 1024,
+      "jni_singleton_slot": "0x7a66658"
+    },
+    "default_allocator_strategy": "native_mimalloc",
+    "elf_build_id": "a67a91ef96c700c0730acd36a250c2f93cfafbc1",
+    "init_array_count": 3678,
+    "init_array_offset": "0x72a74f0",
+    "native_allocator": {
+      "allocate": "0x1e15256",
+      "deallocate": "0x1e18c83"
+    },
+    "native_mimalloc_constructor_run_ranges": [
+      {
+        "begin": 2,
+        "end_exclusive": 3678
+      }
+    ],
+    "native_mimalloc_thread_initializer_after_constructor": 5,
+    "native_pre_jni_bootstrap": {
+      "registry_initializer": "0x2245a0c",
+      "registry_slot": "0x79a9478"
+    }
+  },
+  "reference": {
+    "elf_build_id": "5f0704edd9064f566ee3d6df2bd2fabbcc709f03",
+    "payload_sha256": "8f7079c8977b88c8d9b61be201f7156b5041d7623863357f9ad6c3b0062531e9"
+  },
+  "runtime_compatibility": {
+    "fmod_output_device_bridge": {
+      "count_method_rva": "0x2ee4890",
+      "current_method_rva": "0x2ee48e0",
+      "info_method_rva": "0x2ee4930",
+      "input_count_method_rva": "0x2ee4f10",
+      "input_current_method_rva": "0x2ee536c",
+      "input_info_method_rva": "0x2ee4f1e",
+      "input_select_method_rva": "0x2ee3f32",
+      "select_method_rva": "0x2ee4192",
+      "string_constructor_rva": "0x1e1c0b4",
+      "vtable_layout_version": 2,
+      "vtable_rva": "0x6e3d1d0"
+    },
+    "user_game_settings_fullscreen_setter_rva": "0x5d0af38"
+  },
+  "schema_version": 1,
+  "version_code": 3222,
+  "version_name": "2.742.1059"
+}
@@ -37,14 +37,14 @@ finish_args = set(manifest["finish-args"])
 required_permissions = {
    "--share=network",
    "--socket=wayland",
-    "--socket=x11",
+    "--socket=fallback-x11",
    "--socket=pulseaudio",
    "--device=dri",
    "--filesystem=xdg-run/discord-ipc-0:rw",
 }
 assert required_permissions <= finish_args
-# Keep NVIDIA's XWayland fallback available even when Wayland is present.
-assert "--socket=fallback-x11" not in finish_args
+# X11 is only a fallback; Wayland sessions get no X11 socket.
+assert "--socket=x11" not in finish_args
 assert not any(argument.startswith("--filesystem=host") for argument in finish_args)
 assert not any(argument == "--filesystem=home" for argument in finish_args)

@@ -193,9 +193,14 @@ cat >"${TEMP_DIR}/bin/flatpak" <<'EOF'
 exit 1
 EOF
 chmod 0755 "${TEMP_DIR}/bin/uname" "${TEMP_DIR}/bin/flatpak"
+# The helper sees only these tools, so a flatpak-builder on the host stays
+# out of its PATH.
+for tool in bash dirname realpath; do
+  ln -s -- "$(command -v "${tool}")" "${TEMP_DIR}/bin/${tool}"
+done

 set +e
-PATH="${TEMP_DIR}/bin:/usr/bin:/bin" \
+PATH="${TEMP_DIR}/bin" \
  "${BUILD_HELPER}" --build-dir "${ROOT}/build-flatpak-test" \
  >"${TEMP_DIR}/stdout" 2>"${TEMP_DIR}/stderr"
 helper_status=$?
@@ -154,6 +154,84 @@ TEST(HostAbiProfileTest, ResearchedBaselineKeepsHostBridgeDefault) {
            HostAllocatorStrategy::kNativeMimalloc);
 }

+// A profile of 100 constructors whose native replay starts at index 2.
+HostAbiProfile ConstructorPolicyProfile(
+    size_t checkpoint, std::initializer_list<ConstructorRange> host_ranges) {
+  HostAbiProfile profile;
+  profile.init_array_count = 100;
+  for (const ConstructorRange& range : host_ranges) {
+    profile.constructor_run_ranges[profile.constructor_run_range_count++] =
+        range;
+  }
+  profile.native_mimalloc_constructor_run_ranges[0] = {2, 100};
+  profile.native_mimalloc_constructor_run_range_count = 1;
+  profile.native_mimalloc_thread_initializer_after_constructor = checkpoint;
+  return profile;
+}
+
+TEST(HostAbiProfileTest, ConstructorPolicyAcceptsProcessLoadConstructorFirst) {
+  EXPECT_TRUE(ConstructorPolicyProfile(2, {{2, 3}, {5, 100}})
+                  .HasVerifiedConstructorPolicy(5));
+}
+
+TEST(HostAbiProfileTest, ConstructorPolicyAcceptsProcessLoadConstructorLast) {
+  // The 2.742 order: wiring, JNI singleton, wiring, process-load constructor.
+  EXPECT_TRUE(ConstructorPolicyProfile(5, {{3, 4}, {5, 100}})
+                  .HasVerifiedConstructorPolicy(3));
+}
+
+TEST(HostAbiProfileTest, ConstructorPolicyRequiresJniSingletonConstructor) {
+  // Host bridges run a wiring constructor and skip the JNI singleton.
+  EXPECT_FALSE(ConstructorPolicyProfile(2, {{2, 4}, {6, 100}})
+                   .HasVerifiedConstructorPolicy(5));
+  EXPECT_FALSE(ConstructorPolicyProfile(5, {{2, 3}, {5, 100}})
+                   .HasVerifiedConstructorPolicy(3));
+  // The JNI singleton constructor is the checkpoint constructor.
+  EXPECT_FALSE(ConstructorPolicyProfile(2, {{2, 3}, {5, 100}})
+                   .HasVerifiedConstructorPolicy(2));
+  // The JNI singleton constructor is outside the four leading constructors.
+  EXPECT_FALSE(ConstructorPolicyProfile(2, {{2, 3}, {5, 100}})
+                   .HasVerifiedConstructorPolicy(6));
+}
+
+TEST(HostAbiProfileTest, ConstructorPolicyRejectsOtherShapes) {
+  // The checkpoint is outside the four leading constructors.
+  EXPECT_FALSE(ConstructorPolicyProfile(6, {{2, 3}, {5, 100}})
+                   .HasVerifiedConstructorPolicy(5));
+  // The checkpoint constructor does not run under host bridges.
+  EXPECT_FALSE(ConstructorPolicyProfile(3, {{2, 3}, {5, 100}})
+                   .HasVerifiedConstructorPolicy(5));
+  // Only one wiring constructor is excluded.
+  EXPECT_FALSE(ConstructorPolicyProfile(2, {{2, 4}, {5, 100}})
+                   .HasVerifiedConstructorPolicy(5));
+  // A constructor after the leading four is excluded.
+  EXPECT_FALSE(ConstructorPolicyProfile(2, {{2, 3}, {5, 6}, {7, 100}})
+                   .HasVerifiedConstructorPolicy(5));
+  // Host bridges run a constructor the native replay skips.
+  EXPECT_FALSE(ConstructorPolicyProfile(2, {{1, 3}, {5, 100}})
+                   .HasVerifiedConstructorPolicy(5));
+  // The replay stops before the end of the init-array.
+  EXPECT_FALSE(ConstructorPolicyProfile(2, {{2, 3}, {5, 99}})
+                   .HasVerifiedConstructorPolicy(5));
+
+  HostAbiProfile split_native = ConstructorPolicyProfile(2, {{2, 3}, {5, 100}});
+  split_native.native_mimalloc_constructor_run_ranges[0] = {2, 50};
+  split_native.native_mimalloc_constructor_run_ranges[1] = {50, 100};
+  split_native.native_mimalloc_constructor_run_range_count = 2;
+  EXPECT_FALSE(split_native.HasVerifiedConstructorPolicy(5));
+
+  // The init-array ends inside the four leading constructors.
+  HostAbiProfile too_short = ConstructorPolicyProfile(2, {{2, 3}});
+  too_short.init_array_count = 5;
+  too_short.native_mimalloc_constructor_run_ranges[0] = {2, 5};
+  EXPECT_FALSE(too_short.HasVerifiedConstructorPolicy(4));
+
+  HostAbiProfile shortest = ConstructorPolicyProfile(2, {{2, 3}, {5, 6}});
+  shortest.init_array_count = 6;
+  shortest.native_mimalloc_constructor_run_ranges[0] = {2, 6};
+  EXPECT_TRUE(shortest.HasVerifiedConstructorPolicy(5));
+}
+
 TEST(HostAbiProfileTest, UnknownBuildHasNoNativeOffsets) {
  EXPECT_EQ(FindHostAbiProfile("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"),
            nullptr);
@@ -428,7 +506,7 @@ class ExternalHostAbiProfileLoaderTest : public ::testing::Test {
          {"empty_string_initializer_rva",
           Hex(SymbolRva("MocktailFixtureThreadInitialize"))},
          {"jni_singleton_initializer_rva",
-           Hex(SymbolRva("MocktailFixtureRegistryInitialize"))},
+           Hex(SymbolRva("MocktailFixtureConstructorFive"))},
          {"constructor_rvas",
           {{"2", Hex(SymbolRva("MocktailFixtureConstructorTwo"))},
            {"3", Hex(SymbolRva("MocktailFixtureConstructorThree"))},
@@ -0,0 +1,96 @@
+# Copyright 2026 Mocktail Project Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Known Roblox builds shared by the HostAbi deriver and solver tests.
+
+Every fixture holds answers that a real launch of that build accepted. A
+build's library is used only when its bytes match the fixture's SHA-256.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+from pathlib import Path
+from typing import Any
+
+PROJECT_ROOT = Path(__file__).resolve().parents[1]
+PAYLOAD_ROOT = Path.home() / ".local" / "share" / "mocktail" / "payloads"
+# Holds <payload_id>/libroblox.so for builds outside the payload store.
+REGRESSION_CACHE = Path.home() / ".cache" / "mocktail" / "host_abi_regression"
+REGRESSION_FIXTURES = PROJECT_ROOT / "tests" / "fixtures" / "host_abi_regression"
+
+
+def load_regression_build(name: str) -> dict[str, Any]:
+    path = REGRESSION_FIXTURES / f"{name}.json"
+    return json.loads(path.read_text(encoding="utf-8"))
+
+
+def regression_library(build: dict[str, Any]) -> Path | None:
+    for root in (PAYLOAD_ROOT, REGRESSION_CACHE):
+        library = root / build["payload_id"] / "libroblox.so"
+        if not library.is_file():
+            continue
+        digest = hashlib.sha256()
+        with library.open("rb") as stream:
+            for chunk in iter(lambda: stream.read(1 << 20), b""):
+                digest.update(chunk)
+        if digest.hexdigest() == build["libroblox_sha256"]:
+            return library
+    return None
+
+
+def expected_runtime(reference: dict[str, Any], candidate: dict[str, Any]) -> dict[str, Any]:
+    """The candidate's runtime answers that the reference has inputs for."""
+    expected = json.loads(json.dumps(candidate["runtime_compatibility"]))
+    source = reference["runtime_compatibility"].get("fmod_output_device_bridge", {})
+    bridge = expected.get("fmod_output_device_bridge")
+    if bridge is not None:
+        # Input methods are derived only from a reference that lists them.
+        for field in [name for name in bridge if name.startswith("input_")]:
+            if field not in source:
+                del bridge[field]
+    return expected
+
+
+def regression_sidecar(build: dict[str, Any]) -> dict[str, Any]:
+    """Returns the build as the reference sidecar the deriver reads."""
+    sidecar = {
+        key: build[key]
+        for key in (
+            "schema_version",
+            "elf_build_id",
+            "payload_id",
+            "reference",
+            "profile",
+            "derivation_anchors",
+        )
+    }
+    sidecar["payload_sha256"] = build["libroblox_sha256"]
+    sidecar["payload_path"] = f"payloads/{build['payload_id']}"
+    return sidecar
+
+
+def regression_manifest(build: dict[str, Any]) -> dict[str, Any]:
+    """Returns the build's runtime answers as a reference compatibility manifest."""
+    return {
+        "schema_version": 1,
+        "profiles": [
+            {
+                "elf_build_id": build["elf_build_id"],
+                "allow_host_abi_bridges": True,
+                **build["runtime_compatibility"],
+            }
+        ],
+    }
@@ -0,0 +1,107 @@
+#include "window/host_surface_commit_gate.h"
+
+#include <gtest/gtest.h>
+
+#include <atomic>
+#include <chrono>
+#include <thread>
+
+namespace mocktail {
+namespace window {
+namespace {
+
+using std::chrono::milliseconds;
+
+TEST(HostSurfaceCommitGateTest, MainThreadWaitsForHostPresentToFinish) {
+  HostSurfaceCommitGate gate;
+  std::atomic<bool> present_done{false};
+  std::atomic<bool> saw_present_done{false};
+  std::atomic<bool> owned{false};
+
+  gate.BeginHostPresent();
+  std::thread main_thread([&] {
+    HostSurfaceCommitGate::MainThreadScope scope(gate, milliseconds(5000));
+    owned.store(scope.owns_lock());
+    saw_present_done.store(present_done.load());
+  });
+  std::this_thread::sleep_for(milliseconds(50));
+  present_done.store(true);
+  gate.EndHostPresent();
+  main_thread.join();
+
+  EXPECT_TRUE(owned.load());
+  EXPECT_TRUE(saw_present_done.load());
+}
+
+TEST(HostSurfaceCommitGateTest, HostPresentWaitsForMainThreadScope) {
+  HostSurfaceCommitGate gate;
+  std::atomic<bool> scope_released{false};
+  std::atomic<bool> saw_scope_released{false};
+  std::thread render_thread;
+
+  {
+    HostSurfaceCommitGate::MainThreadScope scope(gate, milliseconds(5000));
+    ASSERT_TRUE(scope.owns_lock());
+    render_thread = std::thread([&] {
+      gate.BeginHostPresent();
+      saw_scope_released.store(scope_released.load());
+      gate.EndHostPresent();
+    });
+    std::this_thread::sleep_for(milliseconds(50));
+    scope_released.store(true);
+  }
+  render_thread.join();
+
+  EXPECT_TRUE(saw_scope_released.load());
+}
+
+TEST(HostSurfaceCommitGateTest, MainThreadGivesUpWhenHostPresentIsStuck) {
+  HostSurfaceCommitGate gate;
+  std::atomic<bool> owned{true};
+
+  gate.BeginHostPresent();
+  std::thread main_thread([&] {
+    HostSurfaceCommitGate::MainThreadScope scope(gate, milliseconds(1));
+    owned.store(scope.owns_lock());
+  });
+  main_thread.join();
+  gate.EndHostPresent();
+
+  EXPECT_FALSE(owned.load());
+}
+
+TEST(HostSurfaceCommitGateTest, EndWithoutBeginIsIgnored) {
+  HostSurfaceCommitGate gate;
+
+  gate.EndHostPresent();
+  HostSurfaceCommitGate::MainThreadScope scope(gate, milliseconds(1));
+
+  EXPECT_TRUE(scope.owns_lock());
+}
+
+TEST(HostSurfaceCommitGateTest, BeginWithoutEndDoesNotBlockTheNextPresent) {
+  HostSurfaceCommitGate gate;
+
+  gate.BeginHostPresent();
+  gate.BeginHostPresent();
+  gate.EndHostPresent();
+  HostSurfaceCommitGate::MainThreadScope scope(gate, milliseconds(1));
+
+  EXPECT_TRUE(scope.owns_lock());
+}
+
+TEST(HostSurfaceCommitGateTest, PresentsFromOneThreadCanRepeat) {
+  HostSurfaceCommitGate gate;
+
+  for (int frame = 0; frame < 3; ++frame) {
+    gate.BeginHostPresent();
+    gate.EndHostPresent();
+  }
+  HostSurfaceCommitGate::MainThreadScope scope(gate, milliseconds(1));
+
+  EXPECT_TRUE(scope.owns_lock());
+}
+
+}  // namespace
+}  // namespace window
+}  // namespace mocktail
@@ -0,0 +1,80 @@
+// Counts heap allocations made on the audio thread by FMOD AudioDevice.write.
+#include "jnivm/jnivm.h"
+
+#include <gtest/gtest.h>
+
+#include <cstdint>
+#include <cstdlib>
+#include <memory>
+#include <new>
+
+namespace {
+thread_local bool g_counting = false;
+thread_local std::size_t g_allocations = 0;
+
+void* CountedAllocate(std::size_t size) noexcept {
+  if (g_counting) {
+    ++g_allocations;
+  }
+  return std::malloc(size == 0 ? 1 : size);
+}
+}  // namespace
+
+void* operator new(std::size_t size) {
+  if (void* memory = CountedAllocate(size)) {
+    return memory;
+  }
+  throw std::bad_alloc();
+}
+void* operator new[](std::size_t size) { return operator new(size); }
+void* operator new(std::size_t size, const std::nothrow_t&) noexcept {
+  return CountedAllocate(size);
+}
+void* operator new[](std::size_t size, const std::nothrow_t&) noexcept {
+  return CountedAllocate(size);
+}
+void operator delete(void* memory) noexcept { std::free(memory); }
+void operator delete[](void* memory) noexcept { std::free(memory); }
+void operator delete(void* memory, std::size_t) noexcept { std::free(memory); }
+void operator delete[](void* memory, std::size_t) noexcept {
+  std::free(memory);
+}
+
+namespace {
+
+struct WriteProbe {
+  int writes = 0;
+};
+
+TEST(FmodAudioDeviceWrite, SteadyStateWriteDoesNotAllocate) {
+  auto vm = std::make_shared<jnivm::VM>();
+  JNIEnv* env = vm->GetJNIEnv();
+  auto probe = std::make_shared<WriteProbe>();
+  jnivm::FmodAudioDeviceCallbacks callbacks;
+  callbacks.write = [](void* context, const void*, const std::uint8_t*,
+                       std::size_t) {
+    ++static_cast<WriteProbe*>(context)->writes;
+    return true;
+  };
+  vm->SetFmodAudioDeviceCallbacks(probe, callbacks);
+
+  jclass device_class = env->FindClass("org/fmod/AudioDevice");
+  jobject device = env->NewObject(
+      device_class, env->GetMethodID(device_class, "<init>", "()V"));
+  const jmethodID write = env->GetMethodID(device_class, "write", "([BI)V");
+  jbyteArray block = env->NewByteArray(4096);
+  env->CallVoidMethod(device, write, block, 4096);
+
+  g_allocations = 0;
+  g_counting = true;
+  for (int i = 0; i < 64; ++i) {
+    env->CallVoidMethod(device, write, block, 4096);
+  }
+  g_counting = false;
+
+  EXPECT_EQ(g_allocations, 0u);
+  EXPECT_EQ(probe->writes, 65);
+  vm->ClearFmodAudioDeviceCallbacks();
+}
+
+}  // namespace
@@ -3,6 +3,7 @@

 #include <gtest/gtest.h>

+#include <array>
 #include <chrono>
 #include <condition_variable>
 #include <cstdarg>
@@ -382,6 +383,31 @@ TEST_F(JniVmTest, JniEnvPointerIsNotNull) {
  EXPECT_NE(vm_->GetJNIEnv(), nullptr);
 }

+TEST_F(JniVmTest, EveryJniFunctionSlotHoldsAFunction) {
+  JNIEnv* env = vm_->GetJNIEnv();
+  ASSERT_NE(env, nullptr);
+  // The first four slots are reserved and null by definition.
+  constexpr std::size_t kReservedSlots = 4;
+  std::array<void*, sizeof(JNINativeInterface_) / sizeof(void*)> slots;
+  std::memcpy(slots.data(), env->functions, sizeof(JNINativeInterface_));
+  std::string null_slots;
+  for (std::size_t slot = kReservedSlots; slot < slots.size(); ++slot) {
+    if (slots[slot] == nullptr) {
+      null_slots += " " + std::to_string(slot);
+    }
+  }
+  EXPECT_TRUE(null_slots.empty()) << "null JNI slots:" << null_slots;
+}
+
+TEST_F(JniVmTest, UnimplementedJniFunctionsReturnZeroInsteadOfCrashing) {
+  JNIEnv* env = vm_->GetJNIEnv();
+  ASSERT_NE(env, nullptr);
+  EXPECT_EQ(env->NewIntArray(4), nullptr);
+  EXPECT_EQ(env->CallNonvirtualIntMethod(nullptr, nullptr, nullptr), 0);
+  EXPECT_EQ(env->CallNonvirtualDoubleMethod(nullptr, nullptr, nullptr), 0.0);
+  env->SetIntArrayRegion(nullptr, 0, 0, nullptr);
+}
+
 #if defined(__x86_64__)
 constexpr unsigned int kAudioFpMode = (1U << 15) | (1U << 6);

@@ -681,6 +707,21 @@ TEST_F(JniVmTest, TraceAllNeverPrintsJStringContentOrPrefix) {
  EXPECT_EQ(trace_output.find("SECRET_CANARY_PREFIX"), std::string::npos);
 }

+// Creates strings, which fixes the process-wide trace setting, so it stays
+// below the test that sets MOCKTAIL_TRACE_ALL.
+TEST_F(JniVmTest, ReleasingAReferenceTwiceDoesNotGiveOneHandleToTwoObjects) {
+  JNIEnv* env = vm_->GetJNIEnv();
+  ASSERT_NE(env, nullptr);
+  jstring stale = env->NewStringUTF("stale");
+  env->DeleteLocalRef(stale);
+  env->DeleteLocalRef(stale);
+  jstring first = env->NewStringUTF("first");
+  jstring second = env->NewStringUTF("second");
+  EXPECT_NE(first, second);
+  EXPECT_EQ(ReadJavaString(env, first), "first");
+  EXPECT_EQ(ReadJavaString(env, second), "second");
+}
+
 TEST_F(JniVmTest, InitialClassCountIsZero) {
  EXPECT_EQ(vm_->GetClassCount(), 0u);
 }
@@ -3170,5 +3211,164 @@ TEST_F(JniVmTest, DeletedHighIndexStringHandleReadsAsEmpty) {
  EXPECT_EQ(env->GetStringLength(high), 0);
 }

+std::size_t CountOccurrences(const std::string &text,
+                             const std::string &needle) {
+  std::size_t count = 0;
+  for (std::size_t at = text.find(needle); at != std::string::npos;
+       at = text.find(needle, at + needle.size())) {
+    ++count;
+  }
+  return count;
+}
+
+TEST_F(JniVmTest, UnhandledCallIsReportedOncePerClassAndMethod) {
+  JNIEnv *env = vm_->GetJNIEnv();
+  jclass first = env->FindClass("example/UnhandledFirst");
+  jclass second = env->FindClass("example/UnhandledSecond");
+  const jmethodID constructor = env->GetMethodID(first, "<init>", "()V");
+  jobject first_object = env->NewObject(first, constructor);
+  jobject second_object = env->NewObject(second, constructor);
+  const jmethodID method = env->GetMethodID(first, "zzReportedVoid", "(I)V");
+
+  ::testing::internal::CaptureStderr();
+  env->CallVoidMethod(first_object, method, 1);
+  env->CallVoidMethod(first_object, method, 2);
+  CallVoidMethodVForTest(env, first_object, method, 3);
+  env->CallVoidMethod(second_object, method, 4);
+  const std::string output = ::testing::internal::GetCapturedStderr();
+
+  EXPECT_EQ(CountOccurrences(output, "  [JNI] no handler for "
+                                     "example/UnhandledFirst.zzReportedVoid(I)V\n"),
+            1u);
+  EXPECT_EQ(CountOccurrences(output, "  [JNI] no handler for "
+                                     "example/UnhandledSecond.zzReportedVoid(I)V\n"),
+            1u);
+}
+
+TEST_F(JniVmTest, UnhandledCallsAreReportedForEveryResultType) {
+  JNIEnv *env = vm_->GetJNIEnv();
+  jclass cls = env->FindClass("example/UnhandledResults");
+  jobject object =
+      env->NewObject(cls, env->GetMethodID(cls, "<init>", "()V"));
+  const auto id = [&](const char *name, const char *sig) {
+    return env->GetMethodID(cls, name, sig);
+  };
+  const auto static_id = [&](const char *name, const char *sig) {
+    return env->GetStaticMethodID(cls, name, sig);
+  };
+
+  ::testing::internal::CaptureStderr();
+  EXPECT_EQ(env->CallObjectMethod(object, id("zzObject", "()Ljava/lang/Object;")),
+            nullptr);
+  EXPECT_EQ(env->CallBooleanMethod(object, id("zzBoolean", "()Z")), JNI_FALSE);
+  EXPECT_EQ(env->CallIntMethod(object, id("zzInt", "()I")), 0);
+  EXPECT_EQ(env->CallLongMethod(object, id("zzLong", "()J")), 0);
+  EXPECT_EQ(env->CallFloatMethod(object, id("zzFloat", "()F")), 0.0f);
+  EXPECT_EQ(env->CallDoubleMethod(object, id("zzDouble", "()D")), 0.0);
+  EXPECT_EQ(env->CallByteMethod(object, id("zzByte", "()B")), 0);
+  env->CallStaticVoidMethod(cls, static_id("zzStaticVoid", "()V"));
+  EXPECT_EQ(env->CallStaticObjectMethod(
+                cls, static_id("zzStaticObject", "()Ljava/lang/Object;")),
+            nullptr);
+  EXPECT_EQ(
+      env->CallStaticBooleanMethod(cls, static_id("zzStaticBoolean", "()Z")),
+      JNI_FALSE);
+  EXPECT_EQ(env->CallStaticIntMethod(cls, static_id("zzStaticInt", "()I")), 0);
+  EXPECT_EQ(env->CallStaticLongMethod(cls, static_id("zzStaticLong", "()J")),
+            0);
+  EXPECT_EQ(env->CallStaticFloatMethod(cls, static_id("zzStaticFloat", "()F")),
+            0.0f);
+  const std::string output = ::testing::internal::GetCapturedStderr();
+
+  const std::string prefix = "  [JNI] no handler for example/UnhandledResults.";
+  const std::string static_prefix =
+      "  [JNI] no handler for static example/UnhandledResults.";
+  for (const char *method :
+       {"zzObject()Ljava/lang/Object;", "zzBoolean()Z", "zzInt()I", "zzLong()J",
+        "zzFloat()F", "zzDouble()D", "zzByte()B"}) {
+    EXPECT_EQ(CountOccurrences(output, prefix + method + "\n"), 1u) << method;
+  }
+  for (const char *method :
+       {"zzStaticVoid()V", "zzStaticObject()Ljava/lang/Object;",
+        "zzStaticBoolean()Z", "zzStaticInt()I", "zzStaticLong()J",
+        "zzStaticFloat()F"}) {
+    EXPECT_EQ(CountOccurrences(output, static_prefix + method + "\n"), 1u)
+        << method;
+  }
+}
+
+TEST_F(JniVmTest, HandledAndDeliberatelyIgnoredCallsAreNotReported) {
+  JNIEnv *env = vm_->GetJNIEnv();
+  jclass cls = env->FindClass("example/HandledProbe");
+  jobject object =
+      env->NewObject(cls, env->GetMethodID(cls, "<init>", "()V"));
+  env->SetIntField(object, env->GetFieldID(cls, "zzCount", "I"), 7);
+  jclass callback_class =
+      env->FindClass("com/roblox/engine/jni/EngineJavaCallback2");
+  jobject callback = env->NewObject(
+      callback_class, env->GetMethodID(callback_class, "<init>", "()V"));
+  jclass helper_class = env->FindClass("com/roblox/client/startup/NativeHelper");
+  jobject helper = env->NewObject(
+      helper_class, env->GetMethodID(helper_class, "<init>", "()V"));
+  jvalue no_args[1] = {};
+
+  ::testing::internal::CaptureStderr();
+  (void)env->CallIntMethod(object, env->GetMethodID(cls, "getScreenWidth", "()I"));
+  EXPECT_EQ(env->CallIntMethod(object, env->GetMethodID(cls, "getZzCount", "()I")),
+            7);
+  env->CallVoidMethod(callback,
+                      env->GetMethodID(callback_class, "c", "()V"));
+  env->CallVoidMethodA(
+      helper, env->GetMethodID(helper_class, "gameActivity_zzLater", "()V"),
+      no_args);
+  const std::string output = ::testing::internal::GetCapturedStderr();
+
+  EXPECT_EQ(output.find("no handler for"), std::string::npos) << output;
+}
+
+TEST_F(JniVmTest, UnmatchedRunAAndFVoidCallsAreReported) {
+  JNIEnv *env = vm_->GetJNIEnv();
+  jclass cls = env->FindClass("example/UnmatchedShortNames");
+  jobject object =
+      env->NewObject(cls, env->GetMethodID(cls, "<init>", "()V"));
+  jvalue no_args[1] = {};
+
+  ::testing::internal::CaptureStderr();
+  env->CallVoidMethod(object, env->GetMethodID(cls, "run", "()V"));
+  env->CallVoidMethod(object, env->GetMethodID(cls, "f", "()V"));
+  env->CallVoidMethodA(object, env->GetMethodID(cls, "a", "()V"), no_args);
+  const std::string output = ::testing::internal::GetCapturedStderr();
+
+  const std::string prefix =
+      "  [JNI] no handler for example/UnmatchedShortNames.";
+  for (const char *method : {"run()V", "f()V", "a()V"}) {
+    EXPECT_EQ(CountOccurrences(output, prefix + method + "\n"), 1u) << method;
+  }
+}
+
+TEST_F(JniVmTest, UnknownGameActivityCallbackIsRecordedOnEveryVoidPath) {
+  JNIEnv *env = vm_->GetJNIEnv();
+  jclass helper_class = env->FindClass("com/roblox/client/startup/NativeHelper");
+  jobject helper = env->NewObject(
+      helper_class, env->GetMethodID(helper_class, "<init>", "()V"));
+  jvalue no_args[1] = {};
+
+  ::testing::internal::CaptureStderr();
+  env->CallVoidMethod(
+      helper, env->GetMethodID(helper_class, "gameActivity_zzViaV", "()V"));
+  env->CallVoidMethodA(
+      helper, env->GetMethodID(helper_class, "gameActivity_zzViaA", "()V"),
+      no_args);
+  const std::string output = ::testing::internal::GetCapturedStderr();
+
+  EXPECT_EQ(output.find("no handler for"), std::string::npos) << output;
+  for (const char *name : {"gameActivity_zzViaV", "gameActivity_zzViaA"}) {
+    EXPECT_EQ(env->GetBooleanField(helper,
+                                   env->GetFieldID(helper_class, name, "Z")),
+              JNI_TRUE)
+        << name;
+  }
+}
+
 } // namespace
 } // namespace jnivm
@@ -130,6 +130,12 @@ TEST(LinkerRegistryTest, KeepsHostIndependentBionicAbiOwnedByLibc) {
            reinterpret_cast<void *>(mocktail___readlink_chk));
  EXPECT_EQ(symbols.at("arc4random_buf"),
            reinterpret_cast<void *>(mocktail_bionic_arc4random_buf));
+  if (mocktail::compat::kHostAtoiMatchesBionic) {
+    EXPECT_EQ(symbols.count("atoi"), 0u);
+  } else {
+    EXPECT_EQ(symbols.at("atoi"),
+              reinterpret_cast<void *>(mocktail_bionic_atoi));
+  }
  EXPECT_EQ(symbols.at("mallinfo"),
            reinterpret_cast<void *>(mocktail_bionic_mallinfo));
  EXPECT_EQ(symbols.at("sysinfo"),
@@ -15,6 +15,7 @@ readonly AUR_BIN_SRCINFO="${ROOT}/packaging/aur/nightcap-bin/.SRCINFO"
 readonly AUR_PKGBUILD="${ROOT}/packaging/aur/nightcap-git/PKGBUILD"
 readonly AUR_SRCINFO="${ROOT}/packaging/aur/nightcap-git/.SRCINFO"
 readonly AUR_WORKFLOW="${ROOT}/.github/workflows/aur.yml"
+readonly AUR_PUBLISH_WORKFLOW="${ROOT}/.github/workflows/aur-publish.yml"
 readonly WORKFLOW="${ROOT}/.github/workflows/packages.yml"
 readonly RELEASE_WORKFLOW="${ROOT}/.github/workflows/release.yml"
 readonly README="${ROOT}/README.md"
@@ -93,11 +94,11 @@ grep -Fq 'git describe' "${AUR_PKGBUILD}" ||
 grep -Fq 'git describe' "${AUR_WORKFLOW}" ||
  Fail 'AUR workflow does not version from the release tag'
 for pkgbuild in "${PKGBUILD}" "${AUR_STABLE_PKGBUILD}" "${AUR_BIN_PKGBUILD}"; do
-  grep -Fqx 'pkgver=0.3.1' "${pkgbuild}" ||
+  grep -Fqx 'pkgver=0.3.4' "${pkgbuild}" ||
    Fail "package version does not match the release being prepared: ${pkgbuild}"
 done

-# Nightcap keeps its AUR recipes in the tree. Nothing publishes them.
+# aur.yml only checks the nightcap-git recipe. Publishing is aur-publish.yml.
 for unexpected in \
    'aur.archlinux.org' \
    'AUR_SSH_PRIVATE_KEY' \
@@ -106,6 +107,34 @@ for unexpected in \
    Fail "AUR workflow should not publish: ${unexpected}"
  fi
 done
+
+for expected in \
+    'workflow_call:' \
+    'workflow_dispatch:' \
+    'for package in nightcap nightcap-bin' \
+    '${archive}.sha256' \
+    'makepkg --printsrcinfo' \
+    'secrets.AUR_SSH_PRIVATE_KEY' \
+    'ssh://aur@aur.archlinux.org/' \
+    'aur.archlinux.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEuBKrPzbawxA/k2g6NcyV5jmqwJ2s+zpgZGZ7tpLIcN' \
+    'StrictHostKeyChecking=yes'; do
+  grep -Fq -- "${expected}" "${AUR_PUBLISH_WORKFLOW}" ||
+    Fail "AUR publish workflow is missing: ${expected}"
+done
+
+# The publish workflow holds the AUR key. It runs for a release tag or by hand,
+# never for a push or a pull request, and it leaves nightcap-git to its own
+# maintainer.
+for unexpected in \
+    'pull_request' \
+    'push:' \
+    'nightcap-git' \
+    'StrictHostKeyChecking=no' \
+    'set -x'; do
+  if grep -Fq -- "${unexpected}" "${AUR_PUBLISH_WORKFLOW}"; then
+    Fail "AUR publish workflow should not contain: ${unexpected}"
+  fi
+done
 grep -Fq 'LINKER:--no-as-needed' "${STUB_CMAKE}" ||
  Fail 'system shims can lose their host libc dependencies'
 grep -Fq 'MOCKTAIL_MINIZIP_HAS_STREAM_TELL' "${STUB_CMAKE}" ||
@@ -121,8 +150,12 @@ for expected in \
    '--env GH_TOKEN' \
    'MOCKTAIL_ANYLINUX_SYSTEM_INSTALL=1' \
    '--appimage-extract-and-run mocktail_updater status' \
-    'Mocktail-x86_64.AppImage' \
-    'Nightcap-nightly-x86_64.AppImage' \
+    'APPIMAGE=dist/Nightcap-nightly-x86_64.AppImage' \
+    '|continuous|Nightcap-nightly-x86_64.AppImage.zsync' \
+    '--env UPINFO' \
+    'test -s dist/Nightcap-nightly-x86_64.AppImage.zsync' \
+    '--appimage-updateinformation' \
+    'Nightcap-nightly-x86_64.AppImage.zsync|' \
    'github-actions[bot]' \
    'gh release upload continuous'; do
  grep -Fq -- "${expected}" "${WORKFLOW}" ||
@@ -151,13 +184,14 @@ for expected in \
    '-DMOCKTAIL_PACKAGE_NAME=nightcap' \
    '-DMOCKTAIL_PACKAGE_VERSION=' \
    'Nightcap-x86_64.AppImage' \
-    'gh release upload'; do
+    'gh release upload' \
+    'uses: ./.github/workflows/aur-publish.yml'; do
  grep -Fq -- "${expected}" "${RELEASE_WORKFLOW}" ||
    Fail "release workflow is missing: ${expected}"
 done

-# Nightcap publishes its packages on the release page only. Pushing them to
-# APT, RPM or AUR repositories is out of scope for this workflow.
+# This workflow publishes on the release page only. It hands the AUR push to
+# aur-publish.yml, and APT and RPM repositories are out of scope.
 for unexpected in \
    'createrepo' \
    'reprepro' \
@@ -1,9 +1,11 @@
 #include <gtest/gtest.h>
 #include <minizip/zip.h>
 #include <sys/stat.h>
+#include <sys/wait.h>
 #include <unistd.h>

 #include <cerrno>
+#include <csignal>
 #include <cstdlib>
 #include <filesystem>
 #include <fstream>
@@ -242,6 +244,53 @@ TEST(HttpDownloadPolicyTest, RejectsCredentialsAndHostSuffixTricks) {
  EXPECT_FALSE(IsTrustedHttpsUrl("https://user@pureapk.com/a", hosts));
 }

+TEST(ReadinessCanaryTest, PreservesEtc2DriverOverride) {
+  TemporaryDirectory temporary;
+  CanaryOptions options;
+  options.runtime_binary = temporary.root() / "runtime";
+  options.cache_root = temporary.root() / "cache";
+  options.state_root = temporary.root() / "state";
+  options.payload_directory = temporary.root() / "payload";
+  options.timeout_seconds = 5;
+  Write(options.runtime_binary,
+        "#!/bin/sh\nprintf 'etc2=%s\\n' \"$vk_require_etc2\"\n");
+  ASSERT_EQ(chmod(options.runtime_binary.c_str(), 0700), 0);
+  for (const char* value : {"true", "false"}) {
+    const pid_t child = fork();
+    ASSERT_GE(child, 0);
+    if (child == 0) {
+      if (setenv("vk_require_etc2", value, 1) != 0) std::_Exit(1);
+      const auto result = RunReadinessCanary(options);
+      std::_Exit(result.exit_code == 0 &&
+                          ReadFile(result.log_path) ==
+                              std::string("etc2=") + value + "\n"
+                      ? 0 : 2);
+    }
+    int status = 0;
+    ASSERT_EQ(waitpid(child, &status, 0), child);
+    ASSERT_TRUE(WIFEXITED(status));
+    EXPECT_EQ(WEXITSTATUS(status), 0);
+  }
+}
+
+TEST(ReadinessCanaryTest, ReportsTerminatingSignal) {
+  TemporaryDirectory temporary;
+  CanaryOptions options;
+  options.runtime_binary = temporary.root() / "runtime";
+  options.cache_root = temporary.root() / "cache";
+  options.state_root = temporary.root() / "state";
+  options.payload_directory = temporary.root() / "payload";
+  options.timeout_seconds = 5;
+  Write(options.runtime_binary, "#!/bin/sh\nkill -TERM $$\n");
+  ASSERT_EQ(chmod(options.runtime_binary.c_str(), 0700), 0);
+
+  const auto result = RunReadinessCanary(options);
+  EXPECT_FALSE(result);
+  EXPECT_EQ(result.exit_code, 128 + SIGTERM);
+  EXPECT_EQ(result.error, "graphics canary exited with status " +
+                             std::to_string(128 + SIGTERM));
+}
+
 TEST(ReadinessCanaryTest, AcceptsRealPresentWithoutShaderPackSummary) {
  const std::string valid =
      "[compat] legacy binary patches: disabled\n"
@@ -1721,6 +1770,7 @@ TEST(PayloadStoreTest, StagesAndPromotesVerifiedExactPayload) {
      temporary.root() / "compatibility.json";
  Write(compatibility,
        "{\"schema_version\":1,\"profiles\":[{"
+        "\"abi\":\"" + std::string(compat::kGuestAbi) + "\","
        "\"version_name\":\"2.727.1199\",\"version_code\":2628,"
        "\"elf_build_id\":\"1686400865ae0e408cd7bd67de7a439625c6fd13\","
        "\"status\":\"supported\",\"default_allowed\":true,"
@@ -2062,5 +2112,71 @@ TEST(PayloadStoreTest, RequiresTwoRuntimeBoundCanariesForLatestCandidate) {
            metadata["sha256"]["libroblox"]);
 }

+// Needs real Roblox payloads. MOCKTAIL_TEST_UPDATE_DATA_ROOT is an updater data
+// root whose derived 3092 profile has no FMOD output-device bridge.
+TEST(HostAbiDeriverRealPayloadTest, FallbackLibrarySuppliesMissingFmodBridge) {
+  const char* data_root = std::getenv("MOCKTAIL_TEST_UPDATE_DATA_ROOT");
+  if (data_root == nullptr) {
+    GTEST_SKIP() << "real Roblox payloads were not explicitly provided";
+  }
+  const std::filesystem::path root = data_root;
+  const std::string reference_id =
+      "3092-5f0704edd9064f566ee3d6df2bd2fabbcc709f03";
+  // Derived profiles are named <payload id>-<runtime hash>.json.
+  std::string installed_profile;
+  std::error_code scan_error;
+  for (const auto& entry : std::filesystem::directory_iterator(
+           root / "host_abi_profiles", scan_error)) {
+    const std::string name = entry.path().filename().string();
+    if (name.rfind(reference_id + "-", 0) == 0 &&
+        std::filesystem::exists(root / "compatibility_profiles" / name)) {
+      installed_profile = name;
+      break;
+    }
+  }
+  ASSERT_FALSE(installed_profile.empty());
+  char pattern[] = "/tmp/mocktail_fmod_fallback_XXXXXX";
+  const char* created = mkdtemp(pattern);
+  ASSERT_NE(created, nullptr);
+  const std::filesystem::path output = created;
+
+  const auto derive = [&](const std::filesystem::path& directory,
+                          const std::filesystem::path& fallback) {
+    HostAbiDerivationOptions options;
+    options.reference_library =
+        root / "payloads" / reference_id / "libroblox.so";
+    options.reference_profile = root / "host_abi_profiles" / installed_profile;
+    options.reference_compatibility_manifests = {
+        root / "compatibility_profiles" / installed_profile,
+        std::filesystem::path(MOCKTAIL_TEST_SOURCE_DIR) /
+            "config/roblox_compatibility.json"};
+    options.runtime_fallback_library = fallback;
+    options.candidate_payload_directory =
+        root / "payloads/3222-a67a91ef96c700c0730acd36a250c2f93cfafbc1";
+    options.output_directory = directory;
+    const HostAbiDerivationResult derived = DeriveHostAbiProfile(options);
+    EXPECT_TRUE(derived) << derived.error;
+    std::ifstream input(derived.compatibility_manifest);
+    const nlohmann::json manifest =
+        nlohmann::json::parse(input, nullptr, false);
+    return manifest.is_object() ? manifest["profiles"][0] : nlohmann::json();
+  };
+
+  const nlohmann::json without = derive(output / "without", {});
+  EXPECT_FALSE(without.contains("fmod_output_device_bridge"));
+
+  const nlohmann::json with = derive(
+      output / "with",
+      root / "payloads/2998-ade08266c67aee88ec9c1d00902150e1684dad3a/"
+             "libroblox.so");
+  ASSERT_TRUE(with.contains("fmod_output_device_bridge"));
+  EXPECT_TRUE(
+      with["fmod_output_device_bridge"].contains("input_count_method_rva"));
+  EXPECT_EQ(with["fmod_output_device_bridge"]["vtable_layout_version"], 2);
+
+  std::error_code filesystem_error;
+  std::filesystem::remove_all(output, filesystem_error);
+}
+
 }  // namespace
 }  // namespace mocktail::update
@@ -155,6 +155,34 @@ TEST(PerformancePolicyTest, WorkerModesRetainRobloxManagedAssetCacheSizes) {
  }
 }

+TEST(PerformancePolicyTest, WorkerModesPreserveRobloxAndExplicitMsaaSelection) {
+  for (const bool throughput : {false, true}) {
+    PerformancePolicy policy;
+    policy.multithreaded_rendering = !throughput;
+    policy.physical_core_count = 14;
+    policy.physics_worker_mode = throughput ? PhysicsWorkerMode::kThroughput
+                                            : PhysicsWorkerMode::kAuto;
+    for (const std::string samples : {"", "1", "4", "8"}) {
+      nlohmann::json requested = nlohmann::json::object();
+      if (!samples.empty()) {
+        requested["FIntDebugForceMSAASamples"] = samples;
+      }
+      std::string merged;
+      std::string error;
+      ASSERT_TRUE(MergeRuntimeClientSettingsOverrides(
+          ParseFrameRatePolicy("144"), policy, requested.dump(), &merged,
+          &error)) << error;
+      const auto parsed = nlohmann::json::parse(merged);
+      EXPECT_FALSE(parsed.contains(""));
+      if (samples.empty()) {
+        EXPECT_FALSE(parsed.contains("FIntDebugForceMSAASamples"));
+      } else {
+        EXPECT_EQ(parsed.at("FIntDebugForceMSAASamples"), samples);
+      }
+    }
+  }
+}
+
 TEST(PerformancePolicyTest, PreservesExplicitAssetCacheByteBudgets) {
  const nlohmann::json requested = {
      {"FIntMeshContentProviderForceCacheSize", "268435456"},
@@ -245,9 +273,10 @@ TEST(PerformancePolicyTest, KeepsUserOverridesThatConflictWithPreset) {
  EXPECT_EQ(parsed.at("FFlagMovePrerenderV2"), true);
  EXPECT_EQ(parsed.at("FIntDebugForceMSAASamples"), 4);
  EXPECT_EQ(parsed.at("FFlagFastGPULightGrid"), "True");
+  // The preset does not set MSAA, so that value passes through without
+  // counting as a kept conflict.
  EXPECT_EQ(kept, (std::vector<std::string>{"FIntOcclusionWorkerThreadCount",
-                                            "FFlagMovePrerenderV2",
-                                            "FIntDebugForceMSAASamples"}));
+                                            "FFlagMovePrerenderV2"}));

  PerformancePolicy latency =
      ParsePerformancePolicy("true", "0", "auto", "latency");
@@ -73,6 +73,83 @@ TEST(PresentModePolicyTest, RequestsExtraSwapchainImagesWhenUnthrottled) {
      5U);
 }

+TEST(PresentModePolicyTest, RetriesWithTheGamesModeWhenTheDriverRejectsOurs) {
+  VkSwapchainCreateInfoKHR info{};
+  info.presentMode = VK_PRESENT_MODE_FIFO_LATEST_READY_KHR;
+  std::vector<VkPresentModeKHR> attempts;
+  const VkResult result = CreateSwapchainWithPresentModeFallback(
+      info, VK_PRESENT_MODE_FIFO_KHR,
+      [&](const VkSwapchainCreateInfoKHR &attempt) {
+        attempts.push_back(attempt.presentMode);
+        return attempt.presentMode == VK_PRESENT_MODE_FIFO_LATEST_READY_KHR
+                   ? VK_ERROR_INITIALIZATION_FAILED
+                   : VK_SUCCESS;
+      });
+  EXPECT_EQ(result, VK_SUCCESS);
+  EXPECT_EQ(attempts, (std::vector<VkPresentModeKHR>{
+                          VK_PRESENT_MODE_FIFO_LATEST_READY_KHR,
+                          VK_PRESENT_MODE_FIFO_KHR}));
+  EXPECT_EQ(info.presentMode, VK_PRESENT_MODE_FIFO_KHR);
+}
+
+TEST(PresentModePolicyTest, DoesNotRetryWhenThereIsNothingToFallBackTo) {
+  VkSwapchainCreateInfoKHR info{};
+  info.presentMode = VK_PRESENT_MODE_MAILBOX_KHR;
+  int calls = 0;
+  EXPECT_EQ(CreateSwapchainWithPresentModeFallback(
+                info, VK_PRESENT_MODE_FIFO_KHR,
+                [&](const VkSwapchainCreateInfoKHR &) {
+                  ++calls;
+                  return VK_SUCCESS;
+                }),
+            VK_SUCCESS);
+  EXPECT_EQ(calls, 1);
+
+  info.presentMode = VK_PRESENT_MODE_FIFO_KHR;
+  calls = 0;
+  EXPECT_EQ(CreateSwapchainWithPresentModeFallback(
+                info, VK_PRESENT_MODE_FIFO_KHR,
+                [&](const VkSwapchainCreateInfoKHR &) {
+                  ++calls;
+                  return VK_ERROR_SURFACE_LOST_KHR;
+                }),
+            VK_ERROR_SURFACE_LOST_KHR);
+  EXPECT_EQ(calls, 1);
+}
+
+TEST(PresentModePolicyTest, DoesNotRetryAfterErrorsAnotherModeCannotFix) {
+  for (const VkResult error :
+       {VK_ERROR_OUT_OF_HOST_MEMORY, VK_ERROR_OUT_OF_DEVICE_MEMORY,
+        VK_ERROR_DEVICE_LOST, VK_ERROR_SURFACE_LOST_KHR,
+        VK_ERROR_NATIVE_WINDOW_IN_USE_KHR}) {
+    VkSwapchainCreateInfoKHR info{};
+    info.presentMode = VK_PRESENT_MODE_FIFO_LATEST_READY_KHR;
+    int calls = 0;
+    EXPECT_EQ(CreateSwapchainWithPresentModeFallback(
+                  info, VK_PRESENT_MODE_FIFO_KHR,
+                  [&](const VkSwapchainCreateInfoKHR &) {
+                    ++calls;
+                    return error;
+                  }),
+              error);
+    EXPECT_EQ(calls, 1) << "error " << static_cast<int>(error);
+  }
+}
+
+TEST(PresentModePolicyTest, ReturnsTheRetrysResultWhenItAlsoFails) {
+  VkSwapchainCreateInfoKHR info{};
+  info.presentMode = VK_PRESENT_MODE_FIFO_LATEST_READY_KHR;
+  int calls = 0;
+  EXPECT_EQ(CreateSwapchainWithPresentModeFallback(
+                info, VK_PRESENT_MODE_FIFO_KHR,
+                [&](const VkSwapchainCreateInfoKHR &) {
+                  return ++calls == 1 ? VK_ERROR_INITIALIZATION_FAILED
+                                      : VK_ERROR_OUT_OF_HOST_MEMORY;
+                }),
+            VK_ERROR_OUT_OF_HOST_MEMORY);
+  EXPECT_EQ(calls, 2);
+}
+
 } // namespace
 } // namespace graphics
 } // namespace mocktail
Author	SHA1	Message	Date
vii	a3a2b76a06	feat(update): add an evidence-scoring solver for HostAbi addresses with a check command	2026-10-15 01:49:19 -05:00
vii	f333399e18	test(update): add a 2908 to 3222 regression set for the HostAbi deriver Share the input checks and FMOD slot tables so the solver reuses them.	2026-10-15 01:49:19 -05:00
vii	3062909209	refactor(jnivm): resolve method names once and log calls with no handler GetMethodID maps each name to a JniMethod enum, so dispatch compares numbers instead of strings. Calls that reach no handler print one "no handler for" line per class, method and signature. Unknown gameActivity_ callbacks are recorded on the CallVoidMethod path too. The FMOD write path reuses a per-thread buffer instead of allocating.	2026-10-15 01:31:02 -05:00
vii	049784d0f8	fix(docs): restore the screenshots at full quality with transparency	2026-10-15 01:31:02 -05:00
vii	ccf910f064	chore(ci): keep the signing and AUR keys in a release environment The release environment only accepts main and v* tags, so a workflow pushed on another branch cannot read the keys. Flatpak builds that do not publish run without it.	2026-10-15 01:26:27 -05:00
vii	23e7831149	fix(site): keep the screenshots transparent The first retake was flattened to RGB, which turned the transparent window edges black.	2026-10-13 21:34:07 -05:00
vii	5b2ee2c7f3	docs(site): rewrite the description and feature list, add SEO tags, refresh screenshots New intro and feature list in the README and the site. The site gets a title with Roblox, link preview tags, structured data, a sitemap, robots.txt, a preview image and the Search Console tag. Screenshots are retaken, the old lobby shot is removed and the store listing points at the new ones.	2026-10-13 21:29:12 -05:00
vii	63ed62b4aa	docs(faq): point the VR answer at Nightcap's vr branch	2026-10-13 20:21:33 -05:00
vii	81de528668	feat(packaging): publish nightcap and nightcap-bin to the AUR on release Pushes nothing until the AUR_SSH_PRIVATE_KEY secret is set. Recipes move to 0.3.4.	2026-10-12 01:44:21 -05:00
vii	ff81882cb0	docs: point Arch users to nightcap-git on the AUR The package is maintained by @dim-ghub.	2026-10-12 01:44:21 -05:00
vii	a87373d003	feat(assets): let the overlay replace files Roblox downloads Roblox maps some rbxasset:// names to downloads and opens no local file for them. For each file under content/ in the overlay folder, change its name in the loaded libroblox so Roblox opens the local file. Idea from @dim-ghub in #20.	2026-10-12 01:20:13 -05:00
vii	b46098c211	feat(assets): trace asset lookups that find no file	2026-10-12 01:20:13 -05:00
vii	144350090e	docs: describe the asset overlay folder	2026-10-11 23:58:26 -05:00
vii	3ed0418997	refactor(assets): share the asset lookup cache insert	2026-10-11 23:58:26 -05:00
vii	8410070eec	Merge pull request #19 from dim-ghub/main Add Sober-compatible asset overlay system	2026-10-11 23:56:58 -05:00
dim-ghub	a1166fb6ba	Add Sober-compatible asset overlay system	2026-10-11 23:11:54 -05:00
vii	c9eb4fb7f0	docs(changelog): credit @qutad for the anti-aliasing fix	2026-10-10 22:02:40 -05:00
vii	b59c070cc0	docs(changelog): release 0.3.4 Report Nightcap's own version instead of Mocktail's.	2026-10-10 21:27:00 -05:00
vii	4a9acf8c49	feat(site): redesign the landing page and legal pages	2026-10-10 21:07:33 -05:00
vii	c342bab7b5	docs(changelog): note the voice chat fix after a Roblox update	2026-10-10 00:33:00 -05:00
vii	a3b9c872a5	fix(update): derive the FMOD bridge from the shipped reference when the installed profile lacks it	2026-10-10 00:33:00 -05:00
vii	4f45baf3f7	docs(changelog): note the anti-aliasing and voice chat microphone fixes	2026-10-10 00:09:42 -05:00
vii	0ddb546ba8	chore(merge): merge upstream komaruworld/mocktail main	2026-10-10 00:09:42 -05:00
vii	7ba752ebb7	docs(changelog): bring the unreleased section up to date	2026-10-09 23:57:41 -05:00
vii	227895faa4	feat(window): use Wayland on NVIDIA Wayland sessions The X11/XWayland fallback guarded against the explicit-sync disconnect that is fixed, so the rule and its driver detection are removed.	2026-10-09 23:57:41 -05:00
vii	dfc3c8d555	docs(changelog): note the Roblox 2.742 update and new interface fixes	2026-10-09 23:48:55 -05:00
vii	e490dff97f	feat(runtime): show the desktop side panel menu by default	2026-10-09 23:48:55 -05:00
vii	b5b9990017	fix(services): let the BrowserTracker bootstrap use Roblox's storage directory Tighten a group-writable directory this user owns, reject a storage file this user cannot vouch for, and treat a stored ID of "0" as unset.	2026-10-09 23:48:55 -05:00
vii	d278c0fe0a	fix(runtime): run nativeAppBridgeAppStart by default It starts Roblox's StartupController, which fetches the account's flag-linked experiments and writes ClientSettings/IxpSettings.json.	2026-10-09 23:48:55 -05:00
vii	044f97e476	fix(update): accept payloads that reorder the leading constructors Roblox 2.742 moves the process-load constructor behind the JNI singleton initializer and renames registers in the registry initializer. The deriver finds each leading constructor by its code, and the loader checks that host bridges run the checkpoint and JNI singleton constructors and skip the two wiring entries.	2026-10-09 23:48:55 -05:00
vii	321ba5b3a2	test(flatpak): keep a host flatpak-builder out of the missing-builder check	2026-10-09 14:19:01 -05:00
vii	fd364a7bf2	docs: wrap the changelog at 110 columns and drop the glyphs roadmap item Add a pre-commit check for added changelog lines over 110 characters. Roblox has no Nintendo glyph set, so the roadmap item cannot be met.	2026-10-09 13:50:46 -05:00
vii	5253563e3f	fix(appimage): restore a distribution package when its reduced build is too old A reduced gtk4 older than the one libadwaita requires failed the nightly configure step.	2026-10-09 13:49:38 -05:00
komaruworld	551d2a1829	Probably a vc fix	2026-10-09 15:49:35 +03:00
farwhile	37b88103f4	fix(runtime): stop forcing single-sample MSAA (#185 ) * fix(runtime): stop forcing single-sample MSAA * test removed * Fix race in webview helper launcher test	2026-10-09 08:33:32 +03:00
vii	763faed0e3	fix(graphics): pick the Vulkan driver that matches the bound kernel driver Skip a GPU whose kernel driver has no installed Vulkan driver and try the next one. Log why when none can run Vulkan.	2026-10-08 18:41:36 -05:00
komaruworld	74eedada0b	improve evilbsd support Netbsd hi	2026-10-09 00:45:05 +03:00
vii	6cb3dd00a9	fix(compat): bound Bionic strerror_r by errno table and gate atoi shim to non-glibc strerror_r: Bionic's message table covers errno 0..133 except the unassigned 41 and 58. Numbers outside that set now get "Unknown error N" without consulting the host, so the text is the same on glibc and musl and no longer relies on comparing against strerror_r(-1). atoi: glibc's atoi is (int)strtol() like Bionic's, so the host symbol is used there as before. The Bionic shim is registered only on libcs where that is not true (musl). linker_registry_test expects the matching result.	2026-10-08 16:10:03 -05:00
vii	fe2f641a9e	chore(merge): merge upstream komaruworld/mocktail main Brings in `3e6f63e` (drop libexecinfo), `aa31cdf` (Chimera/musl portability), `bc10810` (Bionic atoi, canary signal exit codes) and `cb2e9dd` (CI fixes). Conflicts: - tests/native_update_test.cc: keep both <cerrno> and <csignal>. - tests/webview_helper_launcher_test.cc: keep the existing python3 socket read; it already solves the dash multi-digit fd redirection problem that upstream fixed by switching the helper to bash.	2026-10-08 16:10:03 -05:00
komaruworld	cb2e9dd598	Small ci fix	2026-10-08 21:12:29 +03:00
komaruworld	bc108106db	mog chimera	2026-10-08 18:14:23 +03:00
komaruworld	aa31cdf395	Improve chimera support	2026-10-08 16:59:11 +03:00
komaruworld	3e6f63ea93	remove libexecinfo dependency	2026-10-08 16:13:41 +03:00
vii	bfa6811417	docs(changelog): note the crash and hang fixes	2026-10-07 14:22:39 -05:00
vii	84502c0a1a	fix(window): show the hidden window from the main thread The render thread called SDL_ShowWindow outside the surface commit gate. It now sets a flag, and PumpEvents shows the window inside the gate.	2026-10-07 14:20:16 -05:00
vii	46d1d5ffbe	fix(graphics): retry swapchain creation with the game's present mode A driver can reject a present mode the device did not enable. Retry once with the mode the game asked for, except after errors another mode cannot fix.	2026-10-07 14:20:16 -05:00
vii	545fd8344f	fix(session-log): stop waiting for the log writer after 2 seconds A child that kept the log pipes open made Stop wait forever. Poll for the writer, then SIGKILL it after 2 seconds.	2026-10-07 14:20:16 -05:00
vii	4c40fcdc99	fix(jnivm): stub missing JNI functions and ignore repeat releases Fill the 65 unimplemented JNI table slots with stubs that log once and return zero, so a call no longer jumps to address 0. A release of a handle with no reference count now returns, so a double release cannot queue one slot twice and give two objects the same handle.	2026-10-07 14:20:16 -05:00
vii	d4c7a6f741	fix(app-shell): answer LAUNCH_CONVERSATION so chat requests open	2026-10-07 13:04:31 -05:00
vii	491925f59e	test(graphics): register texture_override_test with ctest	2026-10-07 12:01:14 -05:00
vii	2917bc5423	chore(merge): merge upstream komaruworld/mocktail main	2026-10-07 12:01:14 -05:00
komaruworld	2451264696	ETC2 texture fixes Refs #191	2026-10-07 19:02:35 +03:00
komaruworld	a9a96c6861	Add zsync file fixes #182	2026-10-07 17:35:33 +03:00
vii	5bf4eeb41b	fix(window): keep main-thread surface commits out of host present With explicit sync, a wl_surface commit from the SDL thread can land between the driver's sync points and its buffer attach. The compositor answers with a no_buffer protocol error and disconnects the client.	2026-10-06 19:24:27 -05:00
vii	d937dd7ea6	fix(flatpak): ask for the X11 socket only as a fallback	2026-10-04 21:08:23 -05:00