From 86cfaa4a6b257db9c8ad30798d34f0734c6ccf08 Mon Sep 17 00:00:00 2001
From: SpeedBreaker Project <speedbreaker-project@users.noreply.github.com>
Date: Thu, 22 Oct 2026 14:02:14 +0000
Subject: [PATCH] SpeedBreaker v0.1.8

Co-authored-by: byteofmydream <12628004+byteofmydream@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                      |   45 +
 CMakeLists.txt                    |    2 +-
 README.md                         |   33 +-
 docs/TESTING.md                   |    4 +
 runtime/apu/ea_cpu_budget.cpp     |   59 ++
 runtime/apu/ea_cpu_budget.h       |  100 ++
 runtime/game/cover_callers.cpp    |  157 +++
 runtime/game/cover_callers.h      |   47 +
 runtime/game/hfr.cpp              | 1497 +++++++++++++++++++++++++++++
 runtime/game/hfr.h                |   61 ++
 runtime/game/hfr_blend.h          |  150 +++
 runtime/game/hfr_diag.cpp         |  230 +++++
 runtime/game/hfr_grid.h           |   38 +
 runtime/game/hfr_writeset.cpp     |  304 ++++++
 runtime/game/light_trails.cpp     |    6 +-
 runtime/game/split_screen.cpp     |   43 +
 runtime/game/split_screen.h       |   62 ++
 runtime/gpu/command_processor.cpp |   73 +-
 runtime/gpu/covers.h              |  265 +++++
 runtime/gpu/edge_bars.h           |  104 +-
 runtime/gpu/imports_video.cpp     |   26 +-
 runtime/gpu/renderer.cpp          |  651 ++++++++++++-
 runtime/gpu/renderer.h            |   13 +-
 runtime/gpu/shader_translator.cpp |   16 +
 runtime/gpu/shader_translator.h   |   11 +
 runtime/gpu/split_views.h         |   79 ++
 runtime/hid/input.cpp             |  762 +++++++++++++--
 runtime/hid/input.h               |   22 +
 runtime/hid/player_slots.h        |  187 ++++
 runtime/hid/wheel.cpp             | 1116 +++++++++++++++++++++
 runtime/hid/wheel.h               |  150 +++
 runtime/hid/wheel_map.h           | 1151 ++++++++++++++++++++++
 runtime/kernel/vmem.cpp           |   37 +-
 runtime/kernel/vmem.h             |   19 +
 runtime/kernel/write_watch.cpp    |   27 +-
 runtime/main.cpp                  |    2 +
 runtime/ui/settings_menu.cpp      |  176 +++-
 runtime/ui/ui.cpp                 |  153 ++-
 runtime/user/settings.cpp         |  116 ++-
 runtime/user/settings.h           |   41 +-
 runtime/video/hfr_schedule.h      |   88 ++
 runtime/video/presenter.cpp       |  386 +++++++-
 runtime/video/presenter.h         |   37 +-
 runtime/video/refresh_notice.h    |    3 +
 runtime/video/vblank_lock.cpp     |   10 +-
 runtime/video/vblank_lock.h       |   10 +-
 tests/CMakeLists.txt              |   38 +
 tests/covers_test.cpp             |  211 ++++
 tests/ea_cpu_budget_test.cpp      |  206 ++++
 tests/fade_layers_test.cpp        |  393 ++++++++
 tests/hfr_blend_test.cpp          |  209 ++++
 tests/hfr_grid_test.cpp           |   91 ++
 tests/hfr_schedule_test.cpp       |   73 ++
 tests/player_slots_test.cpp       |  161 ++++
 tests/refresh_notice_test.cpp     |    3 +
 tests/settings_keys_test.cpp      |    4 +-
 tests/split_views_test.cpp        |  132 +++
 tests/vmem_host_pages_test.cpp    |  297 ++++++
 tests/wheel_map_test.cpp          |  880 +++++++++++++++++
 tests/write_watch_test.cpp        |   27 +-
 60 files changed, 11082 insertions(+), 212 deletions(-)
 create mode 100644 runtime/apu/ea_cpu_budget.cpp
 create mode 100644 runtime/apu/ea_cpu_budget.h
 create mode 100644 runtime/game/cover_callers.cpp
 create mode 100644 runtime/game/cover_callers.h
 create mode 100644 runtime/game/hfr.cpp
 create mode 100644 runtime/game/hfr.h
 create mode 100644 runtime/game/hfr_blend.h
 create mode 100644 runtime/game/hfr_diag.cpp
 create mode 100644 runtime/game/hfr_grid.h
 create mode 100644 runtime/game/hfr_writeset.cpp
 create mode 100644 runtime/game/split_screen.cpp
 create mode 100644 runtime/game/split_screen.h
 create mode 100644 runtime/gpu/covers.h
 create mode 100644 runtime/gpu/split_views.h
 create mode 100644 runtime/hid/player_slots.h
 create mode 100644 runtime/hid/wheel.cpp
 create mode 100644 runtime/hid/wheel.h
 create mode 100644 runtime/hid/wheel_map.h
 create mode 100644 runtime/video/hfr_schedule.h
 create mode 100644 tests/covers_test.cpp
 create mode 100644 tests/ea_cpu_budget_test.cpp
 create mode 100644 tests/fade_layers_test.cpp
 create mode 100644 tests/hfr_blend_test.cpp
 create mode 100644 tests/hfr_grid_test.cpp
 create mode 100644 tests/hfr_schedule_test.cpp
 create mode 100644 tests/player_slots_test.cpp
 create mode 100644 tests/split_views_test.cpp
 create mode 100644 tests/vmem_host_pages_test.cpp
 create mode 100644 tests/wheel_map_test.cpp

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 74ccb6e..03b96b9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,51 @@ What changed in each SpeedBreaker release, newest first. Each release's notes on
 its entry here, and the game shows the entry once, the first time a new version starts (offline:
 it's built into the game).
 
+## v0.1.8
+
+### What's new
+
+- **Two-player split screen** (Quick Race > Split Screen): with two controllers, each player gets
+  their own half of the screen. The second controller joins at "Player 2 press START". If either
+  player's controller disconnects, the game pauses and says so until it's back (issue #28).
+- **Smooth Motion** (Settings > Display), on a Mac with a 120 Hz screen (ProMotion or a 120 Hz
+  monitor): up to 120 fps. The game still runs at 60 steps a second, as on the console, and draws
+  one more picture between each two. It's off by default and takes effect the next time the game
+  starts. When a scene is too heavy, it eases off, down to an even 60 for a few seconds.
+- **USB steering wheels (experimental).** A Logitech G29 steers, the pedals are the throttle and
+  the brake, the paddles shift gears, and the menus work from the wheel's buttons. Settings > Wheel
+  (shown while a wheel is plugged in) has the steering range, deadzone, response, force feedback
+  and Calibrate for other wheels. Tested with a G29 on a Mac; the steering feel is still being
+  tuned, so feedback from wheel owners is very welcome. Thanks to byteofmydream, who wrote it
+  (pull request #29).
+
+### Fixed
+
+- Now and then in a race, especially on a busy Mac, the engine (or another sound) dropped to a
+  murmur until the next gear change. The game's own sound code took a moment where it didn't get to
+  run for a console overload and cut sounds; it no longer does. Thanks to Omega3komma3 for the
+  report and the video (issue #35).
+- The fade to black before some cutscenes and loads (such as the career prologue's last race)
+  now covers the whole screen, top and bottom, on screens taller than 16:9 (a MacBook, a Steam
+  Deck), instead of leaving the scene showing above and below it.
+- A preventive memory fix for Apple-silicon Macs, iPhones and iPads: handing memory back could
+  clear a little more than it should. It wasn't seen to happen in play.
+
+### More about it
+
+- Split screen runs at 60 fps on a Mac and on a Steam Deck at its Auto resolution; at higher
+  Internal Resolutions it can drop below.
+- Smooth Motion isn't on SteamOS, Linux or iPhone and iPad yet. Internal Resolution's Auto picks
+  for two pictures a step (1x on an M1 Pro); the controls answer a few milliseconds later.
+- Wheels: other wheels than the G29 are used as best the game can work them out; Calibrate teaches
+  it yours. Force feedback works on a Mac through SDL's own Logitech driver (the G29 in its PS3
+  position, G27, G25, Driving Force GT and Pro; not a G29 in its PS4 position, a G920 or a G923).
+  On SteamOS and Linux the wheel should steer as on a Mac; force feedback there isn't tested yet.
+- The log now says when the game's sound code would have dropped sounds, at most once a minute.
+- Updating keeps your saves, settings and the installed game, and needs no disc image: on a Mac,
+  drag the new app into Applications and choose Replace, then Open Anyway once more; on SteamOS,
+  unpack the new download over the old folder.
+
 ## v0.1.7
 
 ### What's new
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 92b5c0c..8ba9e84 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -66,7 +66,7 @@ endif()
 # apps' versions, the SteamOS bundles' VERSION file and the release tag
 # (v<version>). CHANGELOG.md has an entry for each version (the in-game
 # "What's new" note is built from it).
-project(SpeedBreaker VERSION 0.1.7 LANGUAGES C CXX)
+project(SpeedBreaker VERSION 0.1.8 LANGUAGES C CXX)
 
 set(CMAKE_CXX_STANDARD 20)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
diff --git a/README.md b/README.md
index 11a98f5..9b35a19 100644
--- a/README.md
+++ b/README.md
@@ -66,7 +66,11 @@ and a settings menu you can open mid-race.
   HUD and the rear-view mirror stay in place. A 4:3 iPad, a 3:2 screen or the 16:10 screens of
   the Steam Deck and many Macs show more above and below instead, and fill the screen.
 - **Up to 60 fps,** locked to your 60 Hz display. You can also pick a steady 30 at full game
-  speed, or *Auto*, which drops to 30 only while a device is hot or can't hold 60.
+  speed, or *Auto*, which drops to 30 only while a device is hot or can't hold 60. On a Mac with
+  a 120 Hz screen, *Smooth Motion* draws up to 120 fps (off by default).
+- **Two-player split screen** (Quick Race > Split Screen), with two controllers.
+- **USB steering wheels (experimental).** Tested with a Logitech G29 on a Mac, force feedback
+  included; the steering feel is still being tuned.
 - **The sun glare is back.** The low sun glows in open sky and fades behind buildings, as it did
   on the console.
 - **The original look:** sunlit roads and shadows as on the console, the picture a real Xbox 360
@@ -130,6 +134,13 @@ should say OK. What changed in each release is in [CHANGELOG.md](CHANGELOG.md).
 - **Everyone:** a disc image of your own **USA (NTSC-U) Xbox 360 disc** (see
   [Quick start](#quick-start)), about **7.2 GB** of free space, and a display running at about
   **60 Hz** (or 120 Hz, 180 Hz or 240 Hz on SteamOS and Linux).
+- **Split screen:** two controllers.
+- **Smooth Motion** (up to 120 fps): a Mac with a 120 Hz screen (a ProMotion MacBook Pro or a
+  120 Hz monitor). Not yet on SteamOS, Linux, iPhone or iPad.
+- **Steering wheels (experimental):** a USB wheel on a Mac, SteamOS or Linux. The Logitech G29
+  is the one tested (on a Mac). Force feedback works on a Mac with the G29 in its PS3 position,
+  the G27, G25, Driving Force GT and Pro; not yet a G29 in its PS4 position, a G920 or a G923,
+  and it isn't tested on SteamOS or Linux.
 - **Steam Deck, Steam Machine and Linux PCs** (the x86-64 SteamOS download): a 64-bit x86 CPU
   with AVX2 (x86-64-v3): Intel Haswell (2013) or newer, or AMD Excavator, Zen or newer. A
   Vulkan 1.2 graphics card.
@@ -362,6 +373,13 @@ is B, Square is X and Triangle is Y.
 
 - One player, one controller: the first one connected is used, and you can plug one in at any
   time. The keyboard always works as well.
+- **Split screen** (Quick Race > Split Screen): the second controller joins at "Player 2 press
+  START" and drives the second half of the screen. If a player's controller disconnects, the
+  game pauses and says so until it's back.
+- **A steering wheel** (experimental) is used instead of a controller while both are plugged in:
+  the wheel steers, the pedals are the throttle and the brake, the paddles shift gears, and the
+  menus work from its D-pad, Cross (A) and Circle (B). On a G29, Share + Options opens the
+  settings. See **Wheel** under [Settings](#settings).
 - Because Back + Start opens the settings, the game sees Back a moment late: a tap arrives when
   you let go, a hold after a quarter of a second.
 - The game shifts gears with the right stick, so from the keyboard you shift with O and L.
@@ -378,6 +396,7 @@ is B, Square is X and Triangle is Y.
 |---|---|
 | Keyboard | **F1** (on a Mac also **Cmd+,**) |
 | Xbox-style controller | **Back + Start** (View + Menu) together |
+| Logitech G29 wheel | **Share + Options** together |
 | Steam Deck | Hold **View**, press **Menu** |
 | Steam Frame | **Menu + View** together |
 | iPhone and iPad touchscreen | **Three-finger tap** |
@@ -401,6 +420,7 @@ switcher).
 | Fullscreen | On / Off | Off: a 1280x720 window you can resize. The game always starts as set here; on a Mac, the window's green button switches only until you quit, and the row then says NOW FULLSCREEN or NOW WINDOWED. Always on in SteamOS Game Mode. Not shown on iPhone and iPad, which are always full screen. |
 | V-Sync | On / Off | On. Off can tear, but shows frames sooner. |
 | Frame Rate | Auto / 60 fps / 30 fps | 60 fps on most devices. 30 fps keeps the game at full speed. Auto runs at 60, or at a steady 30 while the device is hot or can't hold 60. |
+| Smooth Motion | On / Off | Off. On a Mac with a 120 Hz screen: up to 120 fps. The game still runs at 60 steps a second, as on the console, and draws one more picture between each two; the controls answer a few milliseconds later. Heavy scenes ease off, down to an even 60 for a while. Takes effect the next time the game starts. Shown only where it works. |
 | Screen Resolution | Full / 75% | Full. iPhone and iPad only: 75% is slightly softer and saves graphics work. |
 | Aspect Ratio | Fill Screen / 16:9 | Fill Screen: wider screens get a wider view; 4:3, 3:2 and 16:10 screens (the Steam Deck, many Macs) a taller one. 16:9 always shows the classic picture with bars. |
 | Brightness | -5 to +5 | 0, the picture as it is. Each step makes the shadows and mid-tones a little lighter or darker, like a TV's brightness; black and white stay put, and the menus never change. |
@@ -427,6 +447,12 @@ game while its window isn't in front.
 **Input:** Stick Deadzone (8%; raise it if the car steers by itself), Trigger Deadzone (2%), and
 Vibration (On).
 
+**Wheel** (experimental; shown while a steering wheel is plugged in): Steering Wheel (On; Off
+lets a controller or the keyboard play while the wheel stays plugged in), Steering Range (360
+degrees lock to lock, of a G29's 900), Invert Steering, Steering Deadzone (0%), Steering Response
+(1.00), Force Feedback (100%), Centering Force, and **Calibrate**, which teaches the game a wheel
+other than the G29: both ends of its turn, each pedal, then a button for each control.
+
 **Controls:** the keyboard keys for each Xbox 360 control, two per control, as in the table under
 [Controls](#controls). The keys are saved by name in `settings.toml`'s `[keys]` table (`w`,
 `left_shift`, `keypad_1`, or `none`; `runtime/user/key_names.h` lists them).
@@ -450,7 +476,8 @@ online, and only when you press it). The page also shows which build you're runn
 - **MacBook Pro with a 120 Hz (ProMotion) screen:** since v0.1.4 SpeedBreaker asks for each frame
   to reach the screen 1/60 s after the last. Measured in fullscreen on an M1 Pro: 99.9% of frames
   in menus and about 94% while driving (fewer in the heaviest scenes). Other screens show frames
-  as before.
+  as before. Since v0.1.8, **Smooth Motion** (Settings > Display) draws up to 120 fps there;
+  Internal Resolution's Auto picks for it (1x on an M1 Pro).
 - **Start with Auto.** If busy scenes drop below 60, set Internal Resolution one step lower, or
   let Frame Rate *Auto* fall back to a steady 30.
 - **30 fps is a real option.** It's a steady 30 at full game speed, and the smooth choice in the
@@ -567,7 +594,7 @@ SpeedBreaker folder instead: `data/`, `data/game` and `cache/`.
 2. A notice says where the zip file went: your **Desktop** (on SteamOS, pick it up in Desktop
    Mode, or in the Desktop app on a Steam Frame), the **SpeedBreaker** folder in the Files app on
    iPhone and iPad, or the data folder above when there is no Desktop. Its name says which
-   version you were running, for example `speedbreaker-bug-report-v0.1.7-<date>_<time>.zip`.
+   version you were running, for example `speedbreaker-bug-report-v0.1.8-<date>_<time>.zip`.
 3. Open an [issue][issues], attach the zip, and say what you were doing, what you expected, what
    happened, and roughly how long into the session it happened.
 
diff --git a/docs/TESTING.md b/docs/TESTING.md
index 2431fde..598e88d 100644
--- a/docs/TESTING.md
+++ b/docs/TESTING.md
@@ -39,6 +39,10 @@ from you.
    what happened, and roughly how long into the session (the logs count
    seconds from launch).
 
+With **Smooth Motion** on (Settings > Display, on a Mac's 120 Hz screen), say so, and for a picture
+problem whether it showed in a race, a cutscene or a menu: the log records each step between full
+in-between pictures, lighter ones and 60 ("[hfr]" lines), and when.
+
 If the game **crashed**, just launch it again: it says it saved a crash
 report, and the next Save Bug Report includes it.
 
diff --git a/runtime/apu/ea_cpu_budget.cpp b/runtime/apu/ea_cpu_budget.cpp
new file mode 100644
index 0000000..19cef5b
--- /dev/null
+++ b/runtime/apu/ea_cpu_budget.cpp
@@ -0,0 +1,59 @@
+// SpeedBreaker runtime. GPL-3.0-or-later (see COPYING).
+//
+// EA SND's CPU budget on a host: never expel voices for time (see
+// ea_cpu_budget.h; GitHub issue #35).
+#include <stdafx.h>
+#include "ea_cpu_budget.h"
+#include <kernel/function.h>
+#include <report/report.h>
+
+extern "C" PPC_FUNC(__imp__sub_82601788);
+
+namespace
+{
+    const bool s_eaExpels = [] {
+        const bool on = apu::ea_budget::Expels(std::getenv("NFSMW_EA_CPU_BUDGET"));
+        if (on)
+            fprintf(stderr, "[audio] NFSMW_EA_CPU_BUDGET=1: EA's mixer drops sounds when a mix takes too long, as on the console\n");
+        return on;
+    }();
+
+    // EA's mixer (sub_82601528 runs on its thread, one block at a time).
+    struct
+    {
+        uint64_t times = 0, sinceLog = 0;
+        double worstMs = 0, lastLog = -1e9;
+    } s_skipped;
+}
+
+// sub_82601528's over-budget step: f1 = how far over, in EA's units (r3 =
+// mixer + 68). EA expels the lowest-priority voices until it fits.
+PPC_FUNC(sub_82601788)
+{
+    if (s_eaExpels)
+    {
+        __imp__sub_82601788(ctx, base);
+        return;
+    }
+    // Nothing is expelled. Say so, at most once a minute.
+    auto& s = s_skipped;
+    const double overMs = apu::ea_budget::ToMs(ctx.f1.f64);
+    uint32_t bits = PPC_LOAD_U32(PPC_LOAD_U32(ctx.r3.u32) + 16);  // the config's budget, %
+    float percent;
+    memcpy(&percent, &bits, 4);
+    s.times++;
+    s.sinceLog++;
+    s.worstMs = std::max(s.worstMs, overMs);
+    const double now = report::SessionSeconds();
+    if (now - s.lastLog >= 60.0)
+    {
+        fprintf(stderr, "[audio] the game's sound mixer took too long by its own clock (%.1f ms over its %.1f ms a block%s), "
+            "so EA's code would have dropped sounds (the engine's, say) until the next gear change; kept them "
+            "(%llu time%s so far)\n", s.worstMs, apu::ea_budget::ToMs(apu::ea_budget::Budget(percent)),
+            s.sinceLog > 1 ? std::format(" at worst, {} times since the last line", s.sinceLog).c_str() : "",
+            (unsigned long long)s.times, s.times == 1 ? "" : "s");
+        s.lastLog = now;
+        s.sinceLog = 0;
+        s.worstMs = 0;
+    }
+}
diff --git a/runtime/apu/ea_cpu_budget.h b/runtime/apu/ea_cpu_budget.h
new file mode 100644
index 0000000..f5678b0
--- /dev/null
+++ b/runtime/apu/ea_cpu_budget.h
@@ -0,0 +1,100 @@
+// SpeedBreaker runtime. GPL-3.0-or-later (see COPYING).
+//
+// EA SND's CPU budget, which drops sounds when the mix takes too long
+// (GitHub issue #35: one sound, usually the engine, suddenly much quieter
+// until the next gear shift). Header only, so that tests/ea_cpu_budget_test
+// runs the rule and checks the generated code it names.
+//
+// NFSMW's sound library (EA SND, statically linked) times its own mixer
+// thread (sub_825E3C30) with mftb (sub_825CFEB0): each 256-sample block
+// (5.33 ms) it adds up the thread's busy time between its own stamps (the
+// command buffer, the voices, the DAC; mixer + 68: +4 accumulated, +8 the
+// last stamp) and each voice's own time (voice + 48/52/56). Once a block,
+// sub_82601528 averages the busy time over the last three blocks, adds the
+// voices' costs, scales by 60 (CPU cycles per timebase tick, roughly: the
+// 360's 3.2 GHz over 49.875 MHz) and compares that with the configured share
+// of a block's cycles (config + 16: 90%; 3.2e9 / (48000 x 0.390625) x 90 =
+// 15.36 M, 5.13 ms of timebase). Over it, sub_82601788 expels voices, the
+// lowest priority first (sub_826016B8; priorities under 100 only), until it
+// fits: sub_825D04B8(voice, 0) kills each one for good. Every sample sound
+// NFSMW plays through EA's SND9 layer (engine layers, turbo, shifting,
+// skids, wind, the other cars) is such a voice, at priority 2.55; the game
+// doesn't start a killed loop again until its own logic next starts it (a
+// gear change, for the engine's).
+//
+// On the console the mixer has a hardware thread to itself, so the budget
+// only bites when the mix really is too big. Here the timebase is the host's
+// clock and the mixer an ordinary host thread: a block in which the OS
+// doesn't run it for a while (another thread on its core, a busy or hot Mac)
+// counts as the mix taking that long. One block held up about 14 ms puts the
+// three-block average over budget, and the mixer kills voices that cost
+// almost nothing (the recompiled mix takes about 2% of the budget on a
+// MacBook). In sandbox drag races on a MacBook it happened by itself in 3 of
+// 4 races, 5 times in one (blocks "mixing" for 16-77 ms with 1-5 ms of it
+// on a core); a 20 ms hold of the mixer thread
+// killed every SND9 voice playing, and with the Golf GTI the mix stayed 4.5-8
+// dB quieter until the next gear change.
+//
+// So the host never expels voices for time: sub_82601788 does nothing
+// unless NFSMW_EA_CPU_BUDGET=1 (the console's rule, for tests). The budget
+// check itself still runs (it only reads), and the log says when EA would
+// have dropped sounds.
+#pragma once
+#include <cstdint>
+
+namespace apu::ea_budget
+{
+    // The generated functions the rule hooks and the tests check.
+    inline constexpr uint32_t kMixerThread = 0x825E3C30;   // the mixer thread's loop
+    inline constexpr uint32_t kBudgetCheck = 0x82601528;   // once a block: average, compare
+    inline constexpr uint32_t kExpelOverBudget = 0x82601788;  // f1 = how far over; expels until it fits
+    inline constexpr uint32_t kPickVoice = 0x826016B8;     // the lowest-priority voice under 100
+    inline constexpr uint32_t kExpelVoice = 0x825D04B8;    // (voice, 0): expel it
+    inline constexpr uint32_t kTimebase = 0x825CFEB0;      // mftb
+
+    // EA's units: timebase ticks x 60 (sub_82601528 at 0x826015F0-0x82601628).
+    inline constexpr double kTicksPerMs = 49875.0;
+    inline constexpr double kScale = 60.0;
+    // The budget for `budgetPercent` (config + 16) of a block at `rate` Hz
+    // with the 360's 3.2 GHz clock (mixer + 96): EA's own arithmetic.
+    constexpr double Budget(double budgetPercent, double rate = 48000.0, double clock = 3.2e9)
+    {
+        return clock / (rate * 0.390625) * budgetPercent;
+    }
+    // How far over the budget a block is (> 0: EA expels voices), for the
+    // mixer's own time averaged over the last three blocks (ticks) and the
+    // voices' costs (ticks; each its own 3-block average). EA checks only
+    // while the budget is under 100%.
+    constexpr double Over(double averageTicks, double voiceTicks, double budgetPercent = 90.0)
+    {
+        if (budgetPercent >= 100.0)
+            return 0.0;
+        return (averageTicks + voiceTicks) * kScale - Budget(budgetPercent);
+    }
+    // In milliseconds of mixing a block (the log's unit).
+    constexpr double ToMs(double eaUnits) { return eaUnits / kScale / kTicksPerMs; }
+
+    // Whether EA's mixer may expel voices for time: only with
+    // NFSMW_EA_CPU_BUDGET=1 (`env` is its value, or null).
+    constexpr bool Expels(const char* env)
+    {
+        return env && env[0] == '1' && env[1] == '\0';
+    }
+
+    // EA's three-block average of the mixer's own busy time, as sub_82601528
+    // keeps it (mixer + 80: the average, +84/+88 the last two blocks, +92
+    // which one the next block replaces).
+    struct Average
+    {
+        double history[2] = { 0, 0 };
+        int next = 0;
+        double value = 0;
+        double Add(double blockTicks)
+        {
+            value = (history[0] + history[1] + blockTicks) * (1.0 / 3.0);
+            history[next] = blockTicks;
+            next ^= 1;
+            return value;
+        }
+    };
+}
diff --git a/runtime/game/cover_callers.cpp b/runtime/game/cover_callers.cpp
new file mode 100644
index 0000000..8167adf
--- /dev/null
+++ b/runtime/game/cover_callers.cpp
@@ -0,0 +1,157 @@
+// SpeedBreaker runtime. GPL-3.0-or-later (see COPYING). See cover_callers.h.
+#include <stdafx.h>
+#include "cover_callers.h"
+
+#include <kernel/function.h>
+
+#include <algorithm>
+#include <atomic>
+#include <cstdlib>
+#include <format>
+#include <mutex>
+#include <vector>
+
+namespace game::covers
+{
+    namespace
+    {
+        constexpr uint32_t kSlotBytes = 128;       // four 32-byte ePolys
+        constexpr uint32_t kEntries = 1u << 16;
+
+        struct Entry
+        {
+            std::atomic<uint64_t> physical{ 0 };
+            uint32_t lr[8];
+            uint32_t n;
+        };
+        Entry s_entries[kEntries];
+
+        uint32_t Index(uint64_t key)
+        {
+            return uint32_t(key ^ (key >> 29)) & (kEntries - 1);
+        }
+
+    }
+
+    std::atomic<uint64_t> s_noted{ 0 };
+
+    uint64_t Noted()
+    {
+        return s_noted.load(std::memory_order_relaxed);
+    }
+
+    void Note(uint64_t physical, const Chain& c)
+    {
+        s_noted.fetch_add(1, std::memory_order_relaxed);
+        {
+            Entry& e = s_entries[Index(physical)];
+            e.physical.store(0, std::memory_order_relaxed);
+            std::atomic_thread_fence(std::memory_order_release);
+            std::copy(c.lr, c.lr + 8, e.lr);
+            e.n = c.n;
+            e.physical.store(physical, std::memory_order_release);
+        }
+    }
+
+    uint64_t QuadKey(const uint32_t words[16])
+    {
+        uint64_t h = 1469598103934665603ull;  // FNV-1a over the words
+        for (uint32_t i = 0; i < 16; i++)
+        {
+            h ^= words[i];
+            h *= 1099511628211ull;
+        }
+        return h | 1;  // never 0 (an empty entry)
+    }
+
+    bool Enabled()
+    {
+        static const bool on = [] { const char* v = std::getenv("NFSMW_LOG_COVERS"); return v && v[0] == '1'; }();
+        return on;
+    }
+
+    bool CallerOf(uint64_t physical, Chain& out)
+    {
+        const Entry& e = s_entries[Index(physical)];
+        if (e.physical.load(std::memory_order_acquire) != physical)
+            return false;
+        Chain c;
+        std::copy(e.lr, e.lr + 8, c.lr);
+        c.n = std::min<uint32_t>(e.n, 8);
+        std::atomic_thread_fence(std::memory_order_acquire);
+        if (e.physical.load(std::memory_order_relaxed) != physical)
+            return false;
+        out = c;
+        return true;
+    }
+
+    std::string Describe(const Chain& chain)
+    {
+        // The recompiled functions' guest addresses, sorted (once).
+        static const std::vector<uint32_t> starts = [] {
+            std::vector<uint32_t> v;
+            for (size_t i = 0; PPCFuncMappings[i].guest != 0; i++)
+                v.push_back(PPCFuncMappings[i].guest);
+            std::sort(v.begin(), v.end());
+            return v;
+        }();
+        std::string s;
+        for (uint32_t i = 0; i < chain.n; i++)
+        {
+            const uint32_t lr = chain.lr[i];
+            auto it = std::upper_bound(starts.begin(), starts.end(), lr - 4);
+            if (!s.empty())
+                s += " <- ";
+            if (it == starts.begin())
+                s += std::format("{:08X}", lr);
+            else
+                s += std::format("sub_{:08X}+0x{:X}", *(it - 1), lr - *(it - 1));
+        }
+        return s.empty() ? "unknown" : s;
+    }
+}
+
+namespace
+{
+    // The chain above the caller: its return address (ctx.lr), then up the
+    // stack's back chain (each function here saves its LR at its entry SP - 8).
+    game::covers::Chain CallChain(PPCContext& ctx, uint8_t* base)
+    {
+        game::covers::Chain c;
+        c.lr[c.n++] = uint32_t(ctx.lr);
+        uint32_t sp = ctx.r1.u32;
+        for (int k = 0; k < 7; k++)
+        {
+            const uint32_t up = PPC_LOAD_U32(sp);
+            if (up <= sp || up - sp > 0x10000u)
+                break;
+            const uint32_t lr = PPC_LOAD_U32(up - 8);
+            if (lr < 0x82000000u || lr >= 0x82D00000u)
+                break;
+            c.lr[c.n++] = lr;
+            sp = up;
+        }
+        return c;
+    }
+}
+
+extern "C" PPC_FUNC(__imp__sub_824457B0);
+
+// The ePoly vertex writer (cover_callers.h): with NFSMW_LOG_COVERS=1, the
+// quad it wrote (at r3) and the return addresses above the call.
+PPC_FUNC(sub_824457B0)
+{
+    if (!game::covers::Enabled() || !ctx.r3.u32)
+    {
+        __imp__sub_824457B0(ctx, base);
+        return;
+    }
+    const uint32_t dest = ctx.r3.u32;
+    const game::covers::Chain chain = CallChain(ctx, base);
+    __imp__sub_824457B0(ctx, base);
+    uint32_t words[16];
+    for (uint32_t v = 0; v < 4; v++)
+        for (uint32_t j = 0; j < 4; j++)
+            words[v * 4 + j] = PPC_LOAD_U32(dest + v * 32 + j * 4);
+    game::covers::Note(game::covers::QuadKey(words), chain);
+}
diff --git a/runtime/game/cover_callers.h b/runtime/game/cover_callers.h
new file mode 100644
index 0000000..c0cd3e7
--- /dev/null
+++ b/runtime/game/cover_callers.h
@@ -0,0 +1,47 @@
+// SpeedBreaker runtime. GPL-3.0-or-later (see COPYING).
+//
+// NFSMW_LOG_COVERS=1 (gpu/covers.h): which guest code built a front-end
+// quad. A 2D quad of the front end (menus, HUD, fades, loading screens) is
+// written as four 32-byte ePolys (x, y, z, colour, two uv pairs) by
+// sub_824457B0 (from an ePoly source in pixels: x * k / f1 - k, the colour's
+// bytes R, G, B, A as one ARGB word), called by sub_82445C98 (into the poly
+// batcher's slot, sub_8245B588, or a buffer drawn at once) and
+// sub_82445FC8. While the log is on, a hook there keeps the return
+// addresses above the call (the caller's, and six more up the stack's back
+// chain: each function here saves its LR at its entry SP - 8) by the
+// quad's contents (each vertex's x, y, z and colour: what the GPU then
+// reads), and the renderer looks a quad up by the same words when it logs
+// one (identical quads of two callers name the later: diagnostic quality).
+#pragma once
+
+#include <cstdint>
+#include <string>
+
+namespace game::covers
+{
+    bool Enabled();
+
+    struct Chain
+    {
+        uint32_t lr[8] = {};
+        uint32_t n = 0;
+    };
+
+    // A quad's key: its four ePolys' x, y, z and colour words (host values of
+    // the guest's big-endian words), hashed.
+    uint64_t QuadKey(const uint32_t words[16]);
+
+    // The hook's: the chain that built the quad with this key.
+    void Note(uint64_t key, const Chain& chain);
+
+    // Quads noted so far (the hook ran).
+    uint64_t Noted();
+
+    // The chain recorded for the quad with this key (the latest of that
+    // content: identical quads share one).
+    bool CallerOf(uint64_t key, Chain& out);
+
+    // "sub_8243F2A0+0x5C <- sub_82441E10+0x1A8 <- ..." (the functions holding
+    // each return address).
+    std::string Describe(const Chain& chain);
+}
diff --git a/runtime/game/hfr.cpp b/runtime/game/hfr.cpp
new file mode 100644
index 0000000..f2f1cc9
--- /dev/null
+++ b/runtime/game/hfr.cpp
@@ -0,0 +1,1497 @@
+// SpeedBreaker runtime. GPL-3.0-or-later (see COPYING).
+//
+// HFR (v018-hfr; path A of the 120 fps study: v015/hfr-scoping, v017/hfr-spike
+// and v018/hfr in the work notes). NFSMW_HFR=1: the world keeps its 60 steps
+// a second and its 60 Hz guest vblank, and each step is drawn as many times as
+// the display shows pictures between two guest vblanks
+// (video::HfrPicturesPerStep: 2 at 120 Hz), first at fractions of the way
+// from the last step to this one, then as it is. The in-between pictures'
+// swaps wait for no guest vblank (as with D3DPRESENT_INTERVAL_IMMEDIATE), and
+// the presenter shows each at its share of the vblank before the real one.
+// The world never sees an in-between pose.
+//
+// The frame (sub_823AFE20) steps the world, updates the cameras (the camera
+// director, sub_82168028) and the cars' render copies (sub_824E9C38 copies the
+// body's matrix to the render object's +816), then renders (sub_823AFC68 ->
+// sub_82441050). For an in-between picture at fraction t:
+//   - each car's +816 is blended t of the way from its value before this
+//     frame's update to its value after it; each source camera's view matrix
+//     (and FOV) from the one the last real picture used to its current one.
+//     Cameras the render derives from those (the sun-shadow views, the
+//     reflections, the environment views) follow by themselves;
+//   - what the render changes every time it runs is put back afterwards, so
+//     the real picture is drawn exactly as it is at 60: the per-frame render
+//     flags (the particle buffer's gate keyed on RealTimeFrames, sub_8243B0B0:
+//     else the real picture draws no particles), the eye adaptation
+//     (sub_82223220 moves 2% per call) and its luminance ping-pong, the
+//     cameras' own history (sub_82161000 keeps the last call's pose and
+//     derives velocity from it), the camera-update counter, the render's clock,
+//     and the nitrous-trail rings (RenderFlares writes one per render);
+//   - the game renders on two threads ([0x828FBB50] set, as in races and
+//     cutscenes): this one records each pass as a callback, and the XEX's
+//     entry thread plays them back (sub_82441B60 -> sub_823C8290) while this
+//     one goes on (the next frame waits in sub_82441DB0 until [0x82A2CF40],
+//     "a frame being played", clears; this thread sets it as it starts a
+//     frame, sub_82441EF0). The passes read live state when they are played,
+//     and the end-of-frame pass adapts the exposure and presents, so the
+//     in-between picture's state is put back only once it has been played:
+//     this thread waits for it, as the game's next frame would.
+// Everything is put back before the real picture's render starts. A frame
+// that runs no world step (or several: a hitch) draws no in-between picture.
+#include <stdafx.h>
+#include "hfr.h"
+#include "hfr_blend.h"
+#include "hfr_grid.h"
+#include "frame_time.h"
+
+#include <kernel/function.h>
+#include <kernel/write_watch.h>
+#include <user/settings.h>
+#include <video/presenter.h>
+#include <video/vblank_lock.h>
+
+#include <algorithm>
+#include <atomic>
+#include <chrono>
+#include <cmath>
+#include <cstring>
+#include <format>
+#include <iterator>
+#include <string>
+#include <thread>
+#include <unordered_map>
+#include <unordered_set>
+#include <vector>
+
+namespace
+{
+    // Settings > Display > Smooth Motion (or NFSMW_HFR=1), as it was at
+    // launch: hfr::Init, after the settings load and before the game runs.
+    bool s_enabled = false;
+    bool s_render2 = false;
+    // NFSMW_HFR_PICTURES=<n> (2-4): that many pictures a step whatever the
+    // display (tests: headless, or a display the presenter can't time).
+    const int s_forcedPictures = [] {
+        const char* v = std::getenv("NFSMW_HFR_PICTURES");
+        const int n = v ? std::atoi(v) : 0;
+        return n >= 2 && n <= 4 ? n : 0;
+    }();
+    // NFSMW_HFR_FRACTIONS="<f>,<f>|<f>|...": the fractions each step draws,
+    // step after step in turn, the last of a step its own picture (1: the
+    // real one; less: a step drawn only between, as on a display that isn't
+    // a whole multiple of 60 Hz: "0.667|0.333,1" is 90 Hz's three pictures
+    // every two steps). DIAGNOSTIC, any display.
+    const std::vector<std::vector<float>> s_forcedFractions = [] {
+        std::vector<std::vector<float>> out;
+        if (const char* v = std::getenv("NFSMW_HFR_FRACTIONS"))
+        {
+            std::vector<float> step;
+            const char* p = v;
+            while (*p)
+            {
+                char* end = nullptr;
+                const float f = std::strtof(p, &end);
+                if (end == p)
+                    break;
+                if (f > 0.0f && f <= 1.0f && step.size() < 4)
+                    step.push_back(f);
+                p = end;
+                if (*p == ',')
+                    p++;
+                else if (*p == '|' || !*p)
+                {
+                    if (!step.empty())
+                        out.push_back(step);
+                    step.clear();
+                    if (*p)
+                        p++;
+                }
+            }
+            if (!step.empty())
+                out.push_back(step);
+            fprintf(stderr, "[hfr] NFSMW_HFR_FRACTIONS: %zu steps in turn (DIAGNOSTIC)\n", out.size());
+        }
+        return out;
+    }();
+    uint32_t s_fractionCycle = 0;
+    // NFSMW_HFR_BLEND=0: the in-between picture without the blending (the per-render state still put back);
+    // =cars, =cameras or =particles blends only those (DIAGNOSTIC: M1's launch A/B, M2's particles).
+    const char* const s_blendMode = std::getenv("NFSMW_HFR_BLEND");
+    const bool s_blendAll = !s_blendMode || std::strcmp(s_blendMode, "1") == 0;
+    const bool s_blendCars = s_blendAll || (s_blendMode && std::strcmp(s_blendMode, "cars") == 0);
+    const bool s_blendCameras = s_blendAll || (s_blendMode && std::strcmp(s_blendMode, "cameras") == 0);
+    const bool s_blendParticles = s_blendAll || (s_blendMode && std::strcmp(s_blendMode, "particles") == 0);
+    const bool s_blend = s_blendCars || s_blendCameras || s_blendParticles;
+
+    std::atomic<uint64_t> s_staleLuminance{ 0 };  // real pictures that took the last luminance reading (M3)
+    const bool s_vbSlot = [] { const char* v = std::getenv("NFSMW_HFR_VBSLOT"); return v && v[0] == '1'; }();
+    // Set by the main loop thread around an in-between picture; read by the
+    // render thread too (the picture's swap: sub_82598670 here, and VdSwap).
+    std::atomic<bool> s_inBetween{ false };
+    std::atomic<float> s_fraction{ 0.0f };
+    // A step whose own picture is drawn between too (its fraction < 1: no
+    // real picture), while it is drawn; 0 otherwise.
+    std::atomic<float> s_ownFraction{ 0.0f };
+    // On a grid that isn't a multiple of 60 Hz (video::HfrGrid): the step's
+    // pictures' refreshes (steady ns), and the one being drawn (its swap
+    // carries it to the presenter); 0 elsewhere.
+    int64_t s_targets[4] = {};
+    double s_gridFrom = 0;  // when the last step's state is shown (main loop thread)
+    std::atomic<int64_t> s_target{ 0 };
+    // How long after the guest vblank that releases a step its last picture
+    // is shown there: a step more than the vblank (pictures of a step are
+    // drawn after it, and the earliest falls just after the last step's) and
+    // the time to draw them.
+    constexpr int64_t kGridLeadNs = 5'000'000;
+    // Main loop thread only.
+    uint32_t s_step = 0;
+    uint32_t s_lastRealStep = 0;  // the step the last real picture showed
+    uint32_t s_threadedFrames = 0;  // frames since the render thread took the passes (0: not now)
+    bool s_lastDrewBetween = false; // the last frame drew in-between pictures
+    uint32_t s_steadyFrames = 0;    // drawn frames of exactly one world step in a row
+    uint64_t s_lastFrames = 0, s_lastMultiStep = 0, s_lastNoStep = 0;  // frame_time.cpp's counts at the last drawn frame
+    uint64_t s_frameCount = 0;      // render entries that rendered (NFSMW_HFR_WRITESET's frames)
+    int s_writeSet = 0;             // this frame's NFSMW_HFR_WRITESET phase
+
+    constexpr uint32_t kStepper = 0x82A2CB6C;            // the world stepper; +40: steps run
+    constexpr uint32_t kRenderThreaded = 0x828FBB50;     // nonzero: passes played on the render thread
+    constexpr uint32_t kFramePlaying = 0x82A2CF40;       // 1: the render thread is playing a frame
+    constexpr uint32_t kRenderSkip = 0x82A2CC08;         // > 0: the render entry skips (and counts down)
+    constexpr uint32_t kCarMatrix = 816;                 // vehicle render object: the body's matrix as drawn
+    constexpr uint32_t kCarInfo = 68;                    // -> its CarRenderInfo
+    constexpr uint32_t kTrailRing = 4512, kTrailRingBytes = 248;  // RenderFlares' 3 matrices, 3 positions, index
+    constexpr uint32_t kCameraFov = 196;                 // camera object: FOV (u16)
+    constexpr uint32_t kCameraBytes = 680;               // what sub_82161000 keeps (its dt at +676)
+    constexpr uint32_t kDevicePresentInterval = 13772;   // D3D device: 1, or 0x80000000 (immediate)
+
+    void Load(uint8_t* base, uint32_t a, float m[16])
+    {
+        for (int i = 0; i < 16; i++)
+        {
+            const uint32_t bits = PPC_LOAD_U32(a + i * 4);
+            memcpy(&m[i], &bits, 4);
+        }
+    }
+    void Store(uint8_t* base, uint32_t a, const float m[16])
+    {
+        for (int i = 0; i < 16; i++)
+        {
+            uint32_t bits;
+            memcpy(&bits, &m[i], 4);
+            PPC_STORE_U32(a + i * 4, bits);
+        }
+    }
+    uint32_t Step(uint8_t* base)
+    {
+        const uint32_t stepper = PPC_LOAD_U32(kStepper);
+        return stepper ? PPC_LOAD_U32(stepper + 40) : 0;
+    }
+
+    // Guest memory put back after the in-between picture (newest last).
+    struct Saved
+    {
+        uint32_t address;
+        std::vector<uint8_t> bytes;
+    };
+    std::vector<Saved> s_saved;
+    std::unordered_set<uint32_t> s_savedCameras;
+    void Save(uint8_t* base, uint32_t address, uint32_t size)
+    {
+        s_saved.push_back({ address, std::vector<uint8_t>(base + address, base + address + size) });
+    }
+    void RestoreAll(uint8_t* base)
+    {
+        for (auto it = s_saved.rbegin(); it != s_saved.rend(); ++it)
+            memcpy(base + it->address, it->bytes.data(), it->bytes.size());
+        s_saved.clear();
+        s_savedCameras.clear();
+    }
+
+    // A step's own picture drawn between (BeginOwn/EndOwn): the poses
+    // blended as for an in-between picture and put back once it has been
+    // played, but what the render changes every time it runs kept, as the
+    // real picture's would be. A camera's own history (sub_82161000 copies
+    // its state, +0-223, to +224 at each render) is left as the real
+    // picture would leave it, so the next step's motion is real to real, and
+    // the cameras' records (the next in-between picture's start) are the
+    // step's real poses.
+    struct OwnCamera
+    {
+        uint32_t camera;
+        uint8_t state[224];
+    };
+    std::vector<Saved> s_ownSaved;
+    std::vector<OwnCamera> s_ownCameras;
+
+    // A car's render copy: before and after this frame's update.
+    struct Car
+    {
+        float before[16], after[16];
+        uint32_t step = 0;
+    };
+    std::unordered_map<uint32_t, Car> s_cars;  // vehicle render object -> its poses
+    // A camera's view matrix and FOV as the last real picture used them.
+    struct Camera
+    {
+        float m[16];
+        uint16_t fov = 0;
+        uint32_t step = 0;
+    };
+    std::unordered_map<uint32_t, Camera> s_cameras;
+
+    // The emitter system's particles (smoke, dust, sparks: the emitter render
+    // sub_8222ADC0 draws them from here): [0x82A34940] > 0 while any exist;
+    // 66 lists (+268, 8 bytes each: a circular list's head) of nodes whose
+    // +8 is an emitter, whose particles hang off its +128 (circular, next at
+    // +0), each with its position at +80. The world moves them once a step;
+    // an in-between picture draws each t of the way from where it was at the
+    // last step, as the cars (a particle not seen then, or one that jumped,
+    // a reused slot, is drawn where it is).
+    constexpr uint32_t kEmitterSystem = 0x82A34940, kEmitterLists = 66, kEmitterListHeads = 268;
+    constexpr uint32_t kEmitterParticles = 128, kParticlePosition = 80;
+    constexpr float kParticleMaxMove = 5.0f;
+    struct Particle
+    {
+        float pos[3];
+        uint32_t step = 0;
+    };
+    std::unordered_map<uint32_t, Particle> s_particles;  // particle -> its position at a step
+    struct ParticleNow
+    {
+        uint32_t address;
+        float now[3], before[3];
+        bool blend;
+    };
+    std::vector<ParticleNow> s_particlesNow;  // this frame's (main loop thread)
+
+    template <typename F>
+    void ForEachParticle(uint8_t* base, F&& fn)
+    {
+        if (int32_t(PPC_LOAD_U32(kEmitterSystem)) <= 0)
+            return;
+        uint32_t guard = 0;
+        for (uint32_t i = 0; i < kEmitterLists; i++)
+        {
+            const uint32_t head = kEmitterSystem + kEmitterListHeads + i * 8;
+            for (uint32_t node = PPC_LOAD_U32(head); node && node != head && guard < 200000; node = PPC_LOAD_U32(node), guard++)
+            {
+                const uint32_t emitter = PPC_LOAD_U32(node + 8);
+                if (!emitter)
+                    continue;
+                const uint32_t list = emitter + kEmitterParticles;
+                for (uint32_t p = PPC_LOAD_U32(list); p && p != list && guard < 200000; p = PPC_LOAD_U32(p), guard++)
+                    fn(p);
+            }
+        }
+    }
+    void LoadVec(uint8_t* base, uint32_t a, float v[3])
+    {
+        for (int i = 0; i < 3; i++)
+        {
+            const uint32_t bits = PPC_LOAD_U32(a + i * 4);
+            memcpy(&v[i], &bits, 4);
+        }
+    }
+    void StoreVec(uint8_t* base, uint32_t a, const float v[3])
+    {
+        for (int i = 0; i < 3; i++)
+        {
+            uint32_t bits;
+            memcpy(&bits, &v[i], 4);
+            PPC_STORE_U32(a + i * 4, bits);
+        }
+    }
+    // Render entry (main loop thread, the world's step done): this step's
+    // particles against the last step's, and the last step's for next time.
+    void TrackParticles(uint8_t* base, uint32_t step)
+    {
+        s_particlesNow.clear();
+        ForEachParticle(base, [&](uint32_t p) {
+            ParticleNow n{ p, {}, {}, false };
+            LoadVec(base, p + kParticlePosition, n.now);
+            Particle& last = s_particles[p];
+            if (last.step + 1 == step)
+            {
+                const float dx = n.now[0] - last.pos[0], dy = n.now[1] - last.pos[1], dz = n.now[2] - last.pos[2];
+                if (dx * dx + dy * dy + dz * dz < kParticleMaxMove * kParticleMaxMove)
+                {
+                    memcpy(n.before, last.pos, sizeof(n.before));
+                    n.blend = true;
+                }
+            }
+            memcpy(last.pos, n.now, sizeof(last.pos));
+            last.step = step;
+            s_particlesNow.push_back(n);
+        });
+    }
+
+    // NFSMW_HFR_TIMELINE=<frame>,<frames> (DIAGNOSTIC): for that many frames
+    // from that one, a [hfrtime] line with when the frame's steps happened,
+    // in ms after the guest vblank before the frame's render entry: the
+    // entry, the last real picture played (the wait before), the in-between
+    // picture recorded, played (the wait after), the real one recorded. The
+    // command processor's swaps get lines of their own (hfr::NoteSwap).
+    struct Timeline
+    {
+        uint64_t from = 0, frames = 0;
+    };
+    const Timeline s_timeline = [] {
+        Timeline t;
+        if (const char* v = std::getenv("NFSMW_HFR_TIMELINE"))
+        {
+            unsigned long long a = 0, b = 0;
+            if (sscanf(v, "%llu,%llu", &a, &b) == 2)
+                t = { a, b };
+        }
+        return t;
+    }();
+    std::atomic<bool> s_timelineOn{ false };
+    double SinceVblankMs(int64_t vblank)
+    {
+        const int64_t now = std::chrono::duration_cast<std::chrono::nanoseconds>(std::chrono::steady_clock::now().time_since_epoch()).count();
+        return double(now - vblank) / 1e6;
+    }
+
+    // Stats for the [hfr] line (since the last).
+    struct Stats
+    {
+        uint64_t frames = 0, skippedNoStep = 0, skippedSteps = 0, skippedStart = 0, skippedLoad = 0, particles = 0, particlesBlended = 0;
+        uint64_t ownPictures = 0;  // steps whose own picture was drawn between
+        uint64_t pictures = 0, threaded = 0, cars = 0, carCuts = 0, cameras = 0, cameraCuts = 0, waitTimeouts = 0;
+        double waitMs = 0.0, waitMaxMs = 0.0, waitBeforeMs = 0.0;
+    } s_stats;
+
+    // Limits on one step's motion beyond which it isn't blended (a cut, a reset): 200 mph is 1.5 m a step.
+    constexpr float kCarMaxMove = 8.0f, kCarMaxTurn = 45.0f;
+    constexpr float kCameraMaxMove = 8.0f, kCameraMaxTurn = 30.0f;
+
+    // Wait for the render thread to have played the frame it is playing (its
+    // passes, its end-of-frame pass and Present included), as sub_82441DB0
+    // does before the next frame's passes are recorded. Before the in-between
+    // picture: the last real one may still be playing, and its end-of-frame
+    // pass adapts the exposure (and its passes read the cars' poses) after
+    // this thread moves on; saving or blending before it has finished put the
+    // real pictures one adaptation behind the in-between ones (the whole
+    // picture 1-3 levels darker every other frame, run h3).
+    void WaitPlayed(uint8_t* base, bool before)
+    {
+        if (!PPC_LOAD_U32(kRenderThreaded))
+            return;
+        if (!before)
+            s_stats.threaded++;
+        // As long as the game's own next frame would wait (a first frame's
+        // pipelines can take seconds to build with a cold shader cache: M1's
+        // 250 ms cap put the state back while the picture was still playing).
+        // The cap only keeps a wedged render thread from hanging this one.
+        const auto t0 = std::chrono::steady_clock::now();
+        bool said = false;
+        for (int spins = 0; PPC_LOAD_U32(kFramePlaying) == 1; spins++)
+        {
+            const double ms = std::chrono::duration<double, std::milli>(std::chrono::steady_clock::now() - t0).count();
+            if (ms > 250.0 && !said)
+            {
+                said = true;
+                static int lines = 0;
+                if (lines++ < 8)
+                    fprintf(stderr, "[hfr] render thread still playing after 250 ms (%s the in-between): recorded %u, played %u, "
+                                    "queue %u, end %u\n", before ? "before" : "after", PPC_LOAD_U32(0x82909650), PPC_LOAD_U32(0x82909654),
+                        PPC_LOAD_U32(0x8290965C), unsigned(PPC_LOAD_U8(0x82909658)));
+            }
+            if (ms > 10'000.0)
+            {
+                s_stats.waitTimeouts++;
+                fprintf(stderr, "[hfr] render thread still playing after 10 s: going on without it\n");
+                break;
+            }
+            if (spins < 64)
+                std::this_thread::yield();
+            else
+                std::this_thread::sleep_for(std::chrono::microseconds(50));
+        }
+        std::atomic_thread_fence(std::memory_order_acquire);
+        const double ms = std::chrono::duration<double, std::milli>(std::chrono::steady_clock::now() - t0).count();
+        (before ? s_stats.waitBeforeMs : s_stats.waitMs) += ms;
+        if (!before)
+            s_stats.waitMaxMs = std::max(s_stats.waitMaxMs, ms);
+    }
+
+    void BeginInBetween(uint8_t* base, float t)
+    {
+        WaitPlayed(base, true);
+        if (s_writeSet == 1)
+            hfrdiag::WriteSetBeforeBetween(base);
+        s_saved.clear();
+        s_savedCameras.clear();
+        // The dynamic vertex buffer manager at 0x82909730 (sub_82446830: 3 slots,
+        // +0 the slot, then its write state; +0x40-0x5F the per-frame gate
+        // the particles' fill keys on RealTimeFrames, sub_8243B0B0, sub_8243B100,
+        // sub_82447450: else the real picture draws no particles). M2 put all of
+        // it back, so the real picture rewrote the slot the in-between picture's
+        // draws were still reading (the write guard stalled sub_82445198 a
+        // picture, 3.8 ms each: M2's run gd2). NFSMW_HFR_VBSLOT=1 (M3) puts back
+        // only the gate: the in-between picture takes a slot of its own.
+        if (s_vbSlot)
+            Save(base, 0x82909770, 0x20);
+        else
+            Save(base, 0x82909730, 0x60);
+        // The eye adaptation (sub_82223220: adapted, measured at +0 and +4)
+        // and the post-processing state after it, which a render writes too
+        // (M2's write set ws1: 0x82908AC1-AF7 and 0x82908B42-B97 left changed
+        // by the in-between picture).
+        Save(base, 0x82908AB8, 0xE8);
+        Save(base, 0x82A2C480, 0x50);  // its luminance targets' ping-pong (sub_822234F0)
+        Save(base, 0x82A2D5E0, 4);     // the render's clock (sub_823AFC68)
+        Save(base, 0x82C5E348, 4);     // the camera-update counter (sub_82161000)
+        s_stats.pictures++;
+        if (s_blend)
+        {
+            for (auto& [object, car] : s_cars)
+            {
+                if (!s_blendCars || car.step != s_step)
+                    continue;  // not updated this frame (gone, or no world step)
+                float now[16], blended[16];
+                Load(base, object + kCarMatrix, now);
+                if (hfr::blend::WorldCut(car.before, now, kCarMaxMove, kCarMaxTurn) || !hfr::blend::World(car.before, now, t, blended))
+                {
+                    s_stats.carCuts++;
+                    continue;
+                }
+                Save(base, object + kCarMatrix, 64);
+                Store(base, object + kCarMatrix, blended);
+                s_stats.cars++;
+            }
+            for (auto& [camera, last] : s_cameras)
+            {
+                if (!s_blendCameras || last.step >= s_step || s_step - last.step > 2)
+                    continue;  // no step since (paused), or too old to be the last picture's
+                float now[16], blended[16];
+                Load(base, camera, now);
+                if (!memcmp(now, last.m, sizeof(now)))
+                    continue;
+                if (hfr::blend::ViewCut(last.m, now, kCameraMaxMove, kCameraMaxTurn) || !hfr::blend::View(last.m, now, t, blended))
+                {
+                    s_stats.cameraCuts++;
+                    continue;
+                }
+                Save(base, camera, kCameraBytes);
+                s_savedCameras.insert(camera);
+                Store(base, camera, blended);
+                const uint16_t fov = PPC_LOAD_U16(camera + kCameraFov);
+                if (last.fov && fov && std::abs(int(fov) - int(last.fov)) < 4096)
+                    PPC_STORE_U16(camera + kCameraFov, uint16_t(std::lround(float(last.fov) + t * float(int(fov) - int(last.fov)))));
+                s_stats.cameras++;
+            }
+        }
+        if (s_blendParticles)
+            for (const ParticleNow& n : s_particlesNow)
+            {
+                s_stats.particles++;
+                if (!n.blend)
+                    continue;
+                float blended[3];
+                for (int i = 0; i < 3; i++)
+                    blended[i] = n.before[i] + t * (n.now[i] - n.before[i]);
+                Save(base, n.address + kParticlePosition, 12);
+                StoreVec(base, n.address + kParticlePosition, blended);
+                s_stats.particlesBlended++;
+            }
+        // RenderFlares writes each car's trail ring once a render.
+        for (auto& [object, car] : s_cars)
+            if (car.step == s_step)
+                if (const uint32_t info = PPC_LOAD_U32(object + kCarInfo))
+                    Save(base, info + kTrailRing, kTrailRingBytes);
+        s_fraction.store(t, std::memory_order_relaxed);
+        s_inBetween.store(true, std::memory_order_release);
+    }
+
+    void EndInBetween(uint8_t* base)
+    {
+        WaitPlayed(base, false);
+        RestoreAll(base);
+        s_inBetween.store(false, std::memory_order_release);
+        s_fraction.store(0.0f, std::memory_order_relaxed);
+    }
+
+    void BeginOwn(uint8_t* base, float t)
+    {
+        WaitPlayed(base, true);
+        s_ownSaved.clear();
+        s_ownCameras.clear();
+        auto save = [&](uint32_t address, uint32_t size) {
+            s_ownSaved.push_back({ address, std::vector<uint8_t>(base + address, base + address + size) });
+        };
+        if (s_blendCars)
+            for (auto& [object, car] : s_cars)
+            {
+                if (car.step != s_step)
+                    continue;
+                float now[16], blended[16];
+                Load(base, object + kCarMatrix, now);
+                if (hfr::blend::WorldCut(car.before, now, kCarMaxMove, kCarMaxTurn) || !hfr::blend::World(car.before, now, t, blended))
+                    continue;
+                save(object + kCarMatrix, 64);
+                Store(base, object + kCarMatrix, blended);
+            }
+        if (s_blendCameras)
+            for (auto& [camera, last] : s_cameras)
+            {
+                if (last.step >= s_step || s_step - last.step > 2)
+                    continue;
+                float now[16], blended[16];
+                Load(base, camera, now);
+                if (!memcmp(now, last.m, sizeof(now)))
+                    continue;
+                if (hfr::blend::ViewCut(last.m, now, kCameraMaxMove, kCameraMaxTurn) || !hfr::blend::View(last.m, now, t, blended))
+                    continue;
+                OwnCamera c{ camera, {} };
+                memcpy(c.state, base + camera, sizeof(c.state));
+                s_ownCameras.push_back(c);
+                const uint16_t fov = PPC_LOAD_U16(camera + kCameraFov);
+                Store(base, camera, blended);
+                if (last.fov && fov && std::abs(int(fov) - int(last.fov)) < 4096)
+                    PPC_STORE_U16(camera + kCameraFov, uint16_t(std::lround(float(last.fov) + t * float(int(fov) - int(last.fov)))));
+                // The next in-between picture starts from this step's real pose.
+                memcpy(last.m, now, sizeof(now));
+                last.fov = fov;
+                last.step = s_step;
+            }
+        if (s_blendParticles)
+            for (const ParticleNow& n : s_particlesNow)
+            {
+                if (!n.blend)
+                    continue;
+                float blended[3];
+                for (int i = 0; i < 3; i++)
+                    blended[i] = n.before[i] + t * (n.now[i] - n.before[i]);
+                save(n.address + kParticlePosition, 12);
+                StoreVec(base, n.address + kParticlePosition, blended);
+            }
+        s_stats.ownPictures++;
+        s_ownFraction.store(t, std::memory_order_release);
+    }
+
+    void EndOwn(uint8_t* base)
+    {
+        WaitPlayed(base, false);
+        for (auto it = s_ownSaved.rbegin(); it != s_ownSaved.rend(); ++it)
+            memcpy(base + it->address, it->bytes.data(), it->bytes.size());
+        s_ownSaved.clear();
+        for (const OwnCamera& c : s_ownCameras)
+        {
+            memcpy(base + c.camera, c.state, sizeof(c.state));
+            memcpy(base + c.camera + 224, c.state, sizeof(c.state));
+        }
+        s_ownCameras.clear();
+        s_ownFraction.store(0.0f, std::memory_order_release);
+    }
+
+    // Load: in-between pictures only while the command processor and the
+    // GPU can do a step's pictures in a step. A frame whose work outlasts
+    // its vblank runs two world steps the next time, and the world plays
+    // differently for it (M2's A/B: 39-50 such frames at the race start on
+    // the M1 Pro, two pictures of 9.4 ms CP and 9.3 ms GPU each, and the
+    // launch, Razor and the coast-down moved with them; a 60 fps run beside
+    // a build overran as often and moved the same way). So when kLateOfRecent
+    // of the last kRecent frames with in-between pictures took the command
+    // processor or the GPU (execution, timestamps) more than kBudgetMs, the
+    // frames go on without them (60 fps, still even) until a step's pictures
+    // at twice the real picture's cost would take less than kResumeMs for 90%
+    // of the last kResumeWindow frames, `hold` (2 s at first, twice as long
+    // when that overloads again within kRecentResume, up to 32 s). M2's run
+    // dm5 found single frames' costs too noisy for anything stricter: one
+    // cutscene start turned them off for good; its race held 120 fps evenly
+    // with 15.8 ms of the command processor's and 11.2 of the GPU's a step,
+    // so the budget is nearly the whole step. A frame with in-between
+    // pictures that ran two world steps (it overran) after a second of frames
+    // of one step each turns them off at once (two-step frames in loads,
+    // movies and 30 fps menus come at 60 fps too: M2's run dm7 counted them,
+    // and their backoff kept HFR off for the race).
+    // NFSMW_HFR_LOAD=0: no check.
+    // M2's dm11: the race that held 120 evenly without the check (dm3: 0
+    // overruns) went over 16.2 ms in 4 of 8 frames now and then, and was
+    // held at 60 for 32 s at a time. The command processor's busy time isn't
+    // a step's capacity to the millisecond, so cost alone turns them off only
+    // past what no step can hold (kBudgetMs); overruns do the rest.
+    constexpr double kBudgetMs = 19.0, kResumeMs = 16.0;
+    constexpr uint32_t kRecent = 8, kLateOfRecent = 4, kResumeWindow = 120;
+    std::atomic<bool> s_overran{ false };  // main loop thread: frames with them overran (twice within kOverrunWindow)
+    // An overrun alone doesn't count: one comes with a load's or a pipeline's
+    // hitch at 60 fps too, and the first frames after in-between pictures
+    // come back have one now and then (M2's dm13 turned them off for good
+    // that way, in a race that held 120 with 0 overruns when left alone:
+    // gd1). Two within kOverrunWindow do, and none in kResumeGrace after a
+    // resume.
+    constexpr int64_t kOverrunWindowNs = 2'000'000'000, kResumeGraceNs = 2'000'000'000;
+    int64_t s_lastOverrunNs = 0;  // main loop thread
+    std::atomic<int64_t> s_resumedNs{ 0 };
+    // The hold doubles when they overload again within kRecentResume of
+    // coming back, and starts over at a lone overrun: that is as often a
+    // load's or a pipeline's hitch, which comes at 60 fps too (M2's dm10:
+    // hitches in the menus and at the race start grew the hold to 32 s, and
+    // the race, which held 120 evenly in dm3, waited 64 s for them).
+    // M3: kRecentResume 5 -> 30 s, and a lone overrun starts the hold over
+    // only kHoldResetNs after the last overload: a play-test race
+    // (2026-10-18) overloaded again 4-14 s after each of six resumes, each
+    // hold started over at 2 s, and it switched 12 times in 70 s.
+    constexpr int64_t kFirstHoldNs = 2'000'000'000, kMaxHoldNs = 16'000'000'000, kRecentResumeNs = 30'000'000'000,
+                      kHoldResetNs = 60'000'000'000;
+    // M3: an in-between picture's command-processor time as a share of a
+    // real one's (EMA while both are drawn: the passes it leaves out make it
+    // 0.3-0.6): a step's two pictures while overloaded are estimated at
+    // (1 + share) times the real picture's cost, not twice it.
+    std::atomic<float> s_betweenShare{ 1.0f };
+    const bool s_loadCheck = [] { const char* v = std::getenv("NFSMW_HFR_LOAD"); return !(v && v[0] == '0'); }();
+    std::atomic<bool> s_overloaded{ false };
+    struct LoadState  // command processor thread only
+    {
+        bool late[kRecent] = {};
+        uint32_t next = 0;
+        float costs[kResumeWindow] = {};  // overloaded: twice each frame's cost
+        uint32_t costCount = 0, costNext = 0;
+        int64_t since = 0, hold = kFirstHoldNs, resumedAt = 0, overloads = 0, overloadedAt = 0;
+        // The lite step (s_level 1): since when, how long before full
+        // in-between pictures are tried again, and when they last were.
+        int64_t liteSince = 0, liteHold = 0, fullTriedAt = 0;
+        float liteCosts[kResumeWindow] = {};  // lite: each step's estimated cost with full in-between pictures
+        uint32_t liteCount = 0, liteNext = 0;
+    } s_load;
+    // M3's ladder: full in-between pictures go lite at an overload, back
+    // to full after kFirstLiteHold of lite ones without one (twice that, at
+    // most kMaxLiteHold, when the full ones overload again within
+    // kRecentResume of the try); lite ones that overload go to none (the
+    // hold above), and come back lite.
+    constexpr int64_t kFirstLiteHoldNs = 10'000'000'000, kMaxLiteHoldNs = 120'000'000'000;
+    int64_t SteadyNs()
+    {
+        return std::chrono::duration_cast<std::chrono::nanoseconds>(std::chrono::steady_clock::now().time_since_epoch()).count();
+    }
+
+    // A step's pictures: their fractions of the way from the last step, in
+    // order, the last its own (1: the real picture). The display's
+    // (video::HfrPicturesPerStep: n pictures, i/n), NFSMW_HFR_PICTURES's or
+    // NFSMW_HFR_FRACTIONS's; one, the real one, while overloaded; 1/2, 1 for
+    // NFSMW_HFR_RENDER2.
+    int StepFractions(float f[4], uint32_t steps)
+    {
+        if (!s_enabled)
+        {
+            f[0] = 0.5f;
+            f[1] = 1.0f;
+            return 2;
+        }
+        if (s_overloaded.load(std::memory_order_relaxed))
+        {
+            f[0] = 1.0f;
+            return 1;
+        }
+        if (!s_forcedFractions.empty())
+        {
+            const std::vector<float>& step = s_forcedFractions[s_fractionCycle++ % s_forcedFractions.size()];
+            for (size_t i = 0; i < step.size(); i++)
+                f[i] = step[i];
+            return int(step.size());
+        }
+        const int n = s_forcedPictures ? s_forcedPictures : std::clamp(video::HfrPicturesPerStep(), 1, 4);
+        double period = 0;
+        int64_t grid = 0;
+        if (n == 1 && video::HfrGrid(period, grid))
+        {
+            // A picture for each refresh between the last step's last picture
+            // (shown at the vblank before, plus a vblank, plus kGridLeadNs)
+            // and this step's: 90 Hz's 2/3 | 1/3, 1, 144 Hz's 2-3 a step.
+            // `from` moves on a step at a time, so each step's pictures follow
+            // the last one's: the guest vblank before a render entry can be
+            // the same for two frames in a row (an entry just after it, the
+            // next just before the following one), and M2's run dg1 then drew
+            // a step's in-between picture for an earlier refresh than the
+            // last step's own. Back on the vblank's when that's half a step off.
+            // The step's own picture goes out two vblanks after the one before
+            // this render entry (M2's tl2: an entry 15 ms after a vblank, its
+            // real picture released by the vblank after next), so `from` (the
+            // last step's) is a vblank and kGridLeadNs past the next one: dg3
+            // asked for times 5 ms before the pictures were released.
+            const double step = video::GuestVblank().PeriodNs();
+            const double byVblank = double(video::LastGuestVblank()) + 2.0 * step + double(kGridLeadNs);
+            s_gridFrom += step * double(std::max<uint32_t>(steps, 1));
+            // The vblank before an entry flips between two (entries close to
+            // it): only further off than that is the schedule resynced.
+            if (!(std::fabs(s_gridFrom - byVblank) <= 1.5 * step))
+                s_gridFrom = byVblank;
+            if (const int count = hfr::grid::Pictures(double(grid), period, step, s_gridFrom, f, s_targets))
+                return count;
+        }
+        for (int i = 0; i < n; i++)
+        {
+            f[i] = float(i + 1) / float(n);
+            s_targets[i] = 0;
+        }
+        return n;
+    }
+
+}
+
+namespace
+{
+    enum SkipPass
+    {
+        kSkipShadow = 1, kSkipView4 = 2, kSkipEnv = 4, kSkipLum = 8
+    };
+    // Which passes an in-between picture leaves out: none at first (the
+    // left-out passes' contents are half a step old, and M3's Studio bursts
+    // (s9a) found the in-between pictures up to 1 px off halfway in some NIS
+    // shots with the shadow and environment maps left out); the "lite" set
+    // while the load check finds the full pictures too heavy (a ladder: full
+    // in-between pictures, lite ones, none), as on the M1 Pro, whose NIS
+    // drew in-between pictures in 85% of its frames instead of 59% with them
+    // left out (run d4e). NFSMW_HFR_SKIP=<list> leaves its passes out always,
+    // NFSMW_HFR_LITE=<list> picks the lite set (default shadow, env, mirror;
+    // none: no lite step): shadow, view4 or mirror, env, lum, all, none.
+    uint32_t ParseSkip(const char* v)
+    {
+        const std::string s = v;
+        uint32_t m = 0;
+        if (s.find("shadow") != std::string::npos || s == "all")
+            m |= kSkipShadow;
+        if (s.find("view4") != std::string::npos || s.find("mirror") != std::string::npos || s == "all")
+            m |= kSkipView4;
+        if (s.find("env") != std::string::npos || s == "all")
+            m |= kSkipEnv;
+        if (s.find("lum") != std::string::npos)
+            m |= kSkipLum;
+        return m;
+    }
+    // Always left out by default: the luminance measurement, whose reading
+    // an in-between picture never uses (sub_82223308 returns the last real
+    // one's, and the exposure is put back): its resolve went into the target
+    // the real picture reads when the GPU is behind (M3's run d8a: the real
+    // pictures' luminance reads still stalled 6 times a second).
+    const uint32_t s_forcedSkip = [] { const char* v = std::getenv("NFSMW_HFR_SKIP"); return v ? ParseSkip(v) : uint32_t(kSkipLum); }();
+    const uint32_t s_liteSkip = [] {
+        const char* v = std::getenv("NFSMW_HFR_LITE");
+        return v ? ParseSkip(v) : uint32_t(kSkipShadow | kSkipEnv | kSkipView4);
+    }();
+    // The load check's step (command processor thread writes, main loop
+    // thread reads): 0 full in-between pictures, 1 lite ones (s_overloaded:
+    // none). And what this in-between picture leaves out (main loop thread,
+    // latched at each frame's render entry so a step change can't split one).
+    std::atomic<int> s_level{ 0 };
+    std::atomic<uint32_t> s_activeSkip{ 0 };
+    uint32_t ActiveSkip()
+    {
+        return s_forcedSkip | (s_level.load(std::memory_order_relaxed) >= 1 ? s_liteSkip : 0u);
+    }
+    std::string SkipNames(uint32_t m)
+    {
+        std::string out;
+        for (auto [bit, name] : { std::pair{ kSkipShadow, "the shadow maps" }, std::pair{ kSkipEnv, "the environment map" },
+                 std::pair{ kSkipView4, "the mirror" }, std::pair{ kSkipLum, "the luminance measurement" } })
+            if (m & bit)
+                out += (out.empty() ? "" : ", ") + std::string(name);
+        return out.empty() ? "nothing" : out;
+    }
+    // A pass left out of an in-between picture leaves its targets as the
+    // real picture drew them, but the views it draws from are set up again
+    // from the in-between picture's cameras, and the main view looks the
+    // targets up through them: the shadows and what the environment map
+    // lights moved off halfway, 0.6-1.6 px at 1280 px in a slow NIS pan (M3
+    // runs s8e, s8s; s8n with nothing left out: 0.18). So those views keep
+    // the real picture's setup: views 13-16 (the shadow maps': sub_82454DC8
+    // fits 13 and sub_82456030 15 to view 1, 14 and 16 to view 2) and 18-23
+    // (the environment map's faces). NFSMW_HFR_KEEP_VIEWS=0: set up anyway.
+    constexpr uint32_t kViews = 0x82A38070, kViewBytes = 112;
+    const bool s_keepViews = [] { const char* v = std::getenv("NFSMW_HFR_KEEP_VIEWS"); return !(v && v[0] == '0'); }();
+    bool KeepView(uint32_t view)
+    {
+        if (!s_enabled || !s_keepViews || !s_inBetween.load(std::memory_order_acquire) || view < kViews || view >= kViews + 24 * kViewBytes)
+            return false;
+        const uint32_t index = (view - kViews) / kViewBytes;
+        const uint32_t m = s_activeSkip.load(std::memory_order_relaxed);
+        return ((m & kSkipShadow) && index >= 13 && index <= 16) || ((m & kSkipEnv) && index >= 18);
+    }
+    bool KeepShadowFit()
+    {
+        return s_enabled && s_keepViews && (s_activeSkip.load(std::memory_order_relaxed) & kSkipShadow) && s_inBetween.load(std::memory_order_acquire);
+    }
+    std::atomic<uint64_t> s_skipped[4];
+    bool Skip(uint32_t pass)
+    {
+        if (!(s_activeSkip.load(std::memory_order_relaxed) & pass) || !s_inBetween.load(std::memory_order_acquire))
+            return false;
+        s_skipped[pass == kSkipShadow ? 0 : pass == kSkipView4 ? 1 : pass == kSkipEnv ? 2 : 3].fetch_add(1, std::memory_order_relaxed);
+        return true;
+    }
+}
+
+namespace hfr
+{
+    void Init()
+    {
+        s_enabled = settings::GetBool(settings::Id::SmoothMotion);
+        if (s_enabled)
+            fprintf(stderr, "[hfr] Smooth Motion (NFSMW_HFR): each world step drawn as often as the display shows pictures between two "
+                            "guest vblanks, first between the last step and this one; in-between pictures leave out %s (NFSMW_HFR_SKIP), and "
+                            "%s more while the load check finds them too heavy (NFSMW_HFR_LITE)\n",
+                SkipNames(s_forcedSkip).c_str(), SkipNames(s_liteSkip & ~s_forcedSkip).c_str());
+        const char* v = std::getenv("NFSMW_HFR_RENDER2");
+        s_render2 = s_enabled || (v && v[0] == '1');
+        if (!s_enabled && s_render2)
+            fprintf(stderr, "[hfr] NFSMW_HFR_RENDER2=1: the render (sub_823AFC68) runs twice a frame (DIAGNOSTIC)\n");
+    }
+    bool Enabled() { return s_enabled; }
+    bool Render2() { return s_render2; }
+    bool InBetween() { return s_inBetween.load(std::memory_order_acquire); }
+    float InBetweenFraction() { return s_fraction.load(std::memory_order_relaxed); }
+    float OwnFraction() { return s_ownFraction.load(std::memory_order_acquire); }
+    int64_t PictureTarget() { return s_target.load(std::memory_order_relaxed); }
+
+    void NoteFrameCost(double cpMs, double gpuMs, bool hadBetween)
+    {
+        if (!s_enabled || !s_loadCheck)
+            return;
+        LoadState& l = s_load;
+        const int64_t now = SteadyNs();
+        const double cost = std::max(cpMs, gpuMs);
+        if (!s_overloaded.load(std::memory_order_relaxed))
+        {
+            const bool overran = s_overran.exchange(false, std::memory_order_relaxed);
+            if (!hadBetween && !overran)
+                return;
+            l.late[l.next++ % kRecent] = cost > kBudgetMs;
+            uint32_t late = 0;
+            for (bool b : l.late)
+                late += b;
+            if (late < kLateOfRecent && !overran)
+            {
+                // Lite: full ones again once a step's two full pictures look
+                // affordable (this step's cost, its in-between picture's
+                // share of a real one's swapped for a whole one), or as a try
+                // after the lite hold without an overload.
+                if (s_level.load(std::memory_order_relaxed) == 1)
+                {
+                    const double share = s_betweenShare.load(std::memory_order_relaxed);
+                    l.liteCosts[l.liteNext++ % kResumeWindow] = float(cost * 2.0 / (1.0 + share));
+                    l.liteCount = std::min(l.liteCount + 1, kResumeWindow);
+                    float p90 = 1e9f;
+                    if (l.liteCount == kResumeWindow)
+                    {
+                        float sorted[kResumeWindow];
+                        std::copy(std::begin(l.liteCosts), std::end(l.liteCosts), sorted);
+                        std::nth_element(sorted, sorted + kResumeWindow * 9 / 10, sorted + kResumeWindow);
+                        p90 = sorted[kResumeWindow * 9 / 10];
+                    }
+                    const bool affordable = p90 < kResumeMs && now - l.liteSince >= kFirstHoldNs;
+                    if (affordable || now - l.liteSince >= l.liteHold)
+                    {
+                        s_level.store(0, std::memory_order_relaxed);
+                        l.fullTriedAt = now;
+                        s_resumedNs.store(now, std::memory_order_relaxed);  // the overrun grace after a change
+                        fprintf(stderr, "[hfr] full in-between pictures again: %s (lite for %.0f s without an overload; two full pictures a "
+                                        "step would have taken %.1f ms or less in 90%% of the last %u frames)\n",
+                            affordable ? "affordable" : "trying", double(now - l.liteSince) / 1e9, p90, kResumeWindow);
+                    }
+                }
+                return;
+            }
+            // Full ones too heavy: lite ones first (the lite set left out).
+            if (s_level.load(std::memory_order_relaxed) == 0 && (s_liteSkip & ~s_forcedSkip))
+            {
+                if (l.fullTriedAt && now - l.fullTriedAt < kRecentResumeNs)
+                    l.liteHold = std::min(l.liteHold * 2, kMaxLiteHoldNs);
+                else if (!l.liteHold || now - l.liteSince >= kHoldResetNs)
+                    l.liteHold = kFirstLiteHoldNs;
+                l.liteSince = now;
+                l.liteCount = l.liteNext = 0;
+                std::fill(std::begin(l.late), std::end(l.late), false);
+                s_level.store(1, std::memory_order_relaxed);
+                s_resumedNs.store(now, std::memory_order_relaxed);  // the overrun grace after a change: d8a dropped lite to 60 5 s after
+                fprintf(stderr, "[hfr] lite in-between pictures for now: %s (the last frame: %.1f ms of the command processor, %.1f of the "
+                                "GPU); they leave out %s, full ones again after %.0f s without an overload\n",
+                    overran ? "a frame with full ones ran two world steps" : std::format("{} of the last {} frames with full ones took more than "
+                        "{:.1f} ms of the command processor or the GPU", late, kRecent, kBudgetMs).c_str(),
+                    cpMs, gpuMs, SkipNames(s_liteSkip & ~s_forcedSkip).c_str(), double(l.liteHold) / 1e9);
+                return;
+            }
+            // Again soon after a resume: twice the hold (at most kMaxHold); a
+            // lone overrun (a load's, a pipeline's hitch) a while after the
+            // last overload starts it over.
+            if (l.resumedAt && now - l.resumedAt < kRecentResumeNs)
+                l.hold = std::min(l.hold * 2, kMaxHoldNs);
+            else if (overran && now - l.overloadedAt >= kHoldResetNs)
+                l.hold = kFirstHoldNs;
+            l.overloadedAt = now;
+            std::fill(std::begin(l.late), std::end(l.late), false);
+            l.since = now;
+            l.costCount = l.costNext = 0;
+            l.overloads++;
+            s_overloaded.store(true, std::memory_order_relaxed);
+            fprintf(stderr, "[hfr] no in-between pictures for now: %s (the last frame: %.1f ms of the command processor, %.1f of the GPU); "
+                            "back when two pictures would take < %.1f ms in 90%% of %u frames (an in-between picture %.2f of a real one), after %.0f s at least (overload %lld)\n",
+                overran ? "a frame with them ran two world steps" : std::format("{} of the last {} frames with them took more than {:.1f} ms "
+                    "of the command processor or the GPU", late, kRecent, kBudgetMs).c_str(),
+                cpMs, gpuMs, kResumeMs, kResumeWindow, double(s_betweenShare.load(std::memory_order_relaxed)), double(l.hold) / 1e9,
+                (long long)l.overloads);
+            return;
+        }
+        // Overloaded: one picture a step; with its in-between picture, the
+        // step would take (1 + its measured share) times this.
+        l.costs[l.costNext++ % kResumeWindow] = float((1.0 + s_betweenShare.load(std::memory_order_relaxed)) * cost);
+        l.costCount = std::min(l.costCount + 1, kResumeWindow);
+        if (l.costCount < kResumeWindow || now - l.since < l.hold)
+            return;
+        float sorted[kResumeWindow];
+        std::copy(std::begin(l.costs), std::end(l.costs), sorted);
+        std::nth_element(sorted, sorted + kResumeWindow * 9 / 10, sorted + kResumeWindow);
+        const float p90 = sorted[kResumeWindow * 9 / 10];
+        // Twice a real picture's cost overstates a step's two (M2's dm8: the
+        // race that held 120 evenly in dm3 never looked affordable): after
+        // twice the hold, try them anyway (a try that overloads again within
+        // kRecentResume doubles the hold).
+        const bool tryAnyway = now - l.since >= 2 * l.hold;
+        if (p90 >= kResumeMs && !tryAnyway)
+            return;
+        l.resumedAt = now;
+        s_resumedNs.store(now, std::memory_order_relaxed);
+        // Back lite (when there is a lite step), full ones after its hold.
+        if (s_liteSkip & ~s_forcedSkip)
+        {
+            s_level.store(1, std::memory_order_relaxed);
+            l.liteSince = now;
+            l.liteCount = l.liteNext = 0;
+            if (!l.liteHold)
+                l.liteHold = kFirstLiteHoldNs;
+        }
+        s_overloaded.store(false, std::memory_order_relaxed);
+        fprintf(stderr, "[hfr] in-between pictures again%s: %s (two pictures a step would have taken %.1f ms or less in 90%% of the last %u "
+                        "frames)\n", s_level.load(std::memory_order_relaxed) == 1 ? ", lite" : "", p90 < kResumeMs ? "affordable" : "trying", p90,
+            kResumeWindow);
+    }
+
+    void NoteSwap(float between)
+    {
+        if (s_timelineOn.load(std::memory_order_relaxed))
+            fprintf(stderr, "[hfrtime] swap %s at %.2f ms after the guest vblank\n", between != 0.0f ? "in-between" : "real",
+                SinceVblankMs(video::LastGuestVblank()));
+    }
+}
+
+// The frame's render entry (sub_823AFC68: skips while [0x82A2CC08] > 0, else
+// times and calls the render frame sub_82441050). Called from the frame
+// (sub_823AFE20) after the world steps and the cameras' and cars' updates.
+extern "C" PPC_FUNC(__imp__sub_823AFC68);
+PPC_FUNC(sub_823AFC68)
+{
+    s_writeSet = 0;
+    float ownFraction = 1.0f;  // < 1: this step's own picture drawn between (no real picture)
+    bool drew = false;         // in-between (or own) pictures this frame
+    int64_t lastTarget = 0;    // the step's last picture's refresh (a grid's; 0: the usual way)
+    const int64_t vblank = video::LastGuestVblank();
+    double times[5] = { SinceVblankMs(vblank), -1, -1, -1, -1 };
+    const bool timeline = s_timeline.frames && s_frameCount + 1 >= s_timeline.from && s_frameCount + 1 < s_timeline.from + s_timeline.frames;
+    s_timelineOn.store(timeline, std::memory_order_relaxed);
+    if (s_render2 && PPC_LOAD_U32(kRenderSkip) == 0)
+    {
+        s_step = Step(base);
+        s_writeSet = s_enabled ? hfrdiag::WriteSetPhase(++s_frameCount) : 0;
+        // An overrun: this game frame (the one right after the last drawn)
+        // ran two world steps or more, after a second of frames of one
+        // (frame_time.cpp's counts: a frame whose render the game skipped,
+        // [0x82A2CC08], left the step count two apart without an overrun:
+        // M2's run dm12 took those for overruns).
+        if (s_enabled)
+        {
+            const game::FrameTimeStats ft = game::GetFrameTimeStats();
+            const bool next = ft.frames == s_lastFrames + 1, multi = ft.multiStep != s_lastMultiStep;
+            if (next && multi && s_lastDrewBetween && s_steadyFrames >= 60)
+            {
+                const int64_t now = SteadyNs();
+                if (now - s_resumedNs.load(std::memory_order_relaxed) >= kResumeGraceNs)
+                {
+                    if (s_lastOverrunNs && now - s_lastOverrunNs < kOverrunWindowNs)
+                        s_overran.store(true, std::memory_order_relaxed);
+                    s_lastOverrunNs = now;
+                }
+            }
+            s_steadyFrames = next && !multi && ft.noStep == s_lastNoStep ? s_steadyFrames + 1 : 0;
+            s_lastFrames = ft.frames;
+            s_lastMultiStep = ft.multiStep;
+            s_lastNoStep = ft.noStep;
+        }
+        if (s_enabled && s_blendParticles)
+            TrackParticles(base, s_step);
+        float fractions[4];
+        const int pictures = StepFractions(fractions, s_step - s_lastRealStep);
+        s_activeSkip.store(s_enabled ? ActiveSkip() : 0u, std::memory_order_relaxed);  // this frame's in-between pictures leave these out
+        const bool ownBetween = fractions[pictures - 1] < 0.999f;
+        if (s_enabled && pictures == 1 && !ownBetween)
+        {
+            s_stats.frames++;
+            if (s_overloaded.load(std::memory_order_relaxed))
+                s_stats.skippedLoad++;
+        }
+        if (pictures > 1 || ownBetween)
+        {
+            s_stats.frames++;
+            // One world step since the last real picture: in-between pictures
+            // of it. None (paused, or a frame given no vblank: it would show
+            // the last picture again) or several (a hitch: the frame is late
+            // already) gets the real picture only.
+            const uint32_t steps = s_step - s_lastRealStep;
+            // Nor the first frames the render thread plays (a race or a
+            // cutscene starting: they build what they draw first).
+            s_threadedFrames = PPC_LOAD_U32(kRenderThreaded) ? s_threadedFrames + 1 : 0;
+            if (s_threadedFrames == 1 || s_threadedFrames == 2)
+                s_stats.skippedStart++;
+            else if (s_writeSet == 2 || s_writeSet == 3)
+            {
+                // NFSMW_HFR_WRITESET's control frame (a real render alone) and noise frame.
+                WaitPlayed(base, true);
+                if (s_writeSet == 2)
+                    hfrdiag::WriteSetControlBefore(base);
+                else
+                    hfrdiag::WriteSetNoise(base);
+            }
+            else if (steps == 1 || !s_enabled)
+            {
+                if (s_enabled && ownBetween)
+                    ownFraction = fractions[pictures - 1];
+                lastTarget = s_targets[pictures - 1];
+                drew = pictures > 1 || ownFraction < 1.0f;
+                for (int i = 0; i + 1 < pictures; i++)
+                {
+                    const float t = fractions[i];
+                    if (s_enabled)
+                    {
+                        BeginInBetween(base, t);
+                        // After the last picture has been played: its swap reads the target too.
+                        s_target.store(s_targets[i], std::memory_order_relaxed);
+                        times[1] = SinceVblankMs(vblank);
+                    }
+                    else
+                    {
+                        WaitPlayed(base, true);
+                        s_fraction.store(t, std::memory_order_relaxed);
+                        s_inBetween.store(true, std::memory_order_release);
+                    }
+                    __imp__sub_823AFC68(ctx, base);
+                    times[2] = SinceVblankMs(vblank);
+                    if (s_enabled)
+                    {
+                        EndInBetween(base);
+                        times[3] = SinceVblankMs(vblank);
+                        if (s_writeSet == 1)
+                            hfrdiag::WriteSetAfterBetween(base);
+                    }
+                    else
+                    {
+                        WaitPlayed(base, false);
+                        s_inBetween.store(false, std::memory_order_release);
+                    }
+                }
+            }
+            else if (steps == 0)
+                s_stats.skippedNoStep++;
+            else
+                s_stats.skippedSteps++;
+        }
+        s_lastRealStep = s_step;
+        s_lastDrewBetween = drew;
+    }
+    if (ownFraction < 1.0f)
+        BeginOwn(base, ownFraction);
+    // The step's own picture's refresh. Its swap is played after this thread
+    // has moved on, so the value stays until the next picture's is set, each
+    // time after the last picture has been played (M2's dg1/dg2 lost it: the
+    // own pictures went out at the vblank's time instead of their refresh).
+    if (lastTarget != s_target.load(std::memory_order_relaxed))
+    {
+        if (ownFraction >= 1.0f)
+            WaitPlayed(base, true);
+        s_target.store(lastTarget, std::memory_order_relaxed);
+    }
+    __imp__sub_823AFC68(ctx, base);
+    if (ownFraction < 1.0f)
+        EndOwn(base);
+    times[4] = SinceVblankMs(vblank);
+    if (timeline)
+        fprintf(stderr, "[hfrtime] frame %llu step %u: entry %.2f, last real played %.2f, in-between recorded %.2f, played %.2f, "
+                        "real recorded %.2f (ms after the guest vblank)\n", (unsigned long long)s_frameCount, s_step, times[0], times[1],
+            times[2], times[3], times[4]);
+    if (s_writeSet == 1 || s_writeSet == 2)
+    {
+        WaitPlayed(base, false);
+        if (s_writeSet == 1)
+            hfrdiag::WriteSetAfterReal(base);
+        else
+            hfrdiag::WriteSetControlAfter(base);
+    }
+    hfrdiag::AfterRenderEntry(base);
+    // M3 (the load check's signal): how long the frame's render took on this
+    // thread (its in-between pictures and their waits included), and the
+    // main loop's frame (render entry to render entry), in frames with
+    // in-between pictures and without. The loop paces itself on the swaps
+    // the command processor releases at vblanks, not on the vblank (game/
+    // frame_time.cpp), so the render's share of the frame is the margin.
+    static std::vector<float> s_renderMs[2], s_frameMs[2];
+    static int64_t s_lastEntryNs = 0;
+    {
+        const int64_t nowNs = SteadyNs(), entryNs = nowNs - int64_t((times[4] - times[0]) * 1e6);
+        if (s_enabled && PPC_LOAD_U32(kRenderSkip) == 0)
+        {
+            s_renderMs[drew ? 1 : 0].push_back(float(times[4] - times[0]));
+            if (s_lastEntryNs)
+                s_frameMs[drew ? 1 : 0].push_back(float(double(entryNs - s_lastEntryNs) / 1e6));
+        }
+        s_lastEntryNs = entryNs;
+    }
+    // A line every 10 s of frames.
+    if (s_enabled && s_stats.frames >= 600)
+    {
+        std::string share;
+        for (int k = 1; k >= 0; k--)
+        {
+            std::vector<float>& r = s_renderMs[k];
+            std::vector<float>& f = s_frameMs[k];
+            if (r.empty())
+                continue;
+            std::sort(r.begin(), r.end());
+            std::sort(f.begin(), f.end());
+            share += std::format("{} {}: the render median {:.1f} ms, p90 {:.1f}, of frames median {:.1f}, p90 {:.1f}{}",
+                k ? "with in-between pictures" : "without", r.size(), r[r.size() / 2], r[r.size() * 9 / 10], f.empty() ? 0.0f : f[f.size() / 2],
+                f.empty() ? 0.0f : f[f.size() * 9 / 10], k ? "; " : "");
+            r.clear();
+            f.clear();
+        }
+        if (!share.empty())
+            fprintf(stderr, "[hfr] this thread's frames: %s\n", share.c_str());
+        fprintf(stderr, "[hfr] %llu frames, %llu in-between pictures, %llu steps drawn only between (none in %llu frames without a world step, %llu with several, %llu starting "
+                        "the render thread, %llu for the load; "
+                        "%llu on the render thread: waited %.2f ms each before, %.2f after, max %.2f, %llu timeouts): "
+                        "%.2f cars blended a picture (%llu cuts), %.2f cameras (%llu cuts), %.1f particles of %.1f; tracking %zu cars, %zu cameras\n",
+            (unsigned long long)s_stats.frames, (unsigned long long)s_stats.pictures, (unsigned long long)s_stats.ownPictures,
+            (unsigned long long)s_stats.skippedNoStep,
+            (unsigned long long)s_stats.skippedSteps, (unsigned long long)s_stats.skippedStart, (unsigned long long)s_stats.skippedLoad,
+            (unsigned long long)s_stats.threaded,
+            s_stats.threaded ? s_stats.waitBeforeMs / double(s_stats.threaded) : 0.0,
+            s_stats.threaded ? s_stats.waitMs / double(s_stats.threaded) : 0.0, s_stats.waitMaxMs, (unsigned long long)s_stats.waitTimeouts,
+            s_stats.pictures ? double(s_stats.cars) / double(s_stats.pictures) : 0.0, (unsigned long long)s_stats.carCuts,
+            s_stats.pictures ? double(s_stats.cameras) / double(s_stats.pictures) : 0.0, (unsigned long long)s_stats.cameraCuts,
+            s_stats.pictures ? double(s_stats.particlesBlended) / double(s_stats.pictures) : 0.0,
+            s_stats.pictures ? double(s_stats.particles) / double(s_stats.pictures) : 0.0, s_cars.size(), s_cameras.size());
+        s_stats = {};
+        // Forget what wasn't seen for a few seconds (render objects are freed and reused).
+        const uint32_t now = s_step;
+        std::erase_if(s_cars, [&](const auto& kv) { return now - kv.second.step > 300; });
+        std::erase_if(s_cameras, [&](const auto& kv) { return now - kv.second.step > 300; });
+        std::erase_if(s_particles, [&](const auto& kv) { return now - kv.second.step > 2; });
+    }
+}
+
+// A car's render update: copies the body's matrix (its pointer at +52) to
+// +816, deriving the render's velocities from the change (dt in f1).
+extern "C" PPC_FUNC(__imp__sub_824E9C38);
+PPC_FUNC(sub_824E9C38)
+{
+    if (!s_enabled)
+        return __imp__sub_824E9C38(ctx, base);
+    const uint32_t object = ctx.r3.u32;
+    Car& car = s_cars[object];
+    Load(base, object + kCarMatrix, car.before);
+    __imp__sub_824E9C38(ctx, base);
+    Load(base, object + kCarMatrix, car.after);
+    car.step = Step(base);
+}
+
+// A view setup: records the camera each view of the real picture used.
+extern "C" PPC_FUNC(__imp__sub_8243EAC0);
+PPC_FUNC(sub_8243EAC0)
+{
+    const uint32_t view = ctx.r4.u32;
+    // M3: an in-between picture that leaves a pass out keeps that pass's
+    // views as the real picture set them up (KeepView).
+    if (KeepView(view))
+        return;
+    if (s_enabled && !s_inBetween.load(std::memory_order_acquire) && s_ownFraction.load(std::memory_order_acquire) == 0.0f && view)
+        if (const uint32_t camera = PPC_LOAD_U32(view + 64))
+        {
+            Camera& c = s_cameras[camera];
+            Load(base, camera, c.m);
+            c.fov = PPC_LOAD_U16(camera + kCameraFov);
+            c.step = Step(base);
+        }
+    hfrdiag::OnViewSetup(base, view);
+    __imp__sub_8243EAC0(ctx, base);
+}
+
+// A camera's update (sub_82161000: keeps its last pose at +224 and derives
+// its motion from the change over dt, f1; dt kept at +676). During an
+// in-between picture the camera is put back afterwards, and it is given t of
+// the dt: it moved t of a step since the last real picture, so its velocity
+// (the motion blur's) is the step's, not t of it (run h5: the in-between
+// pictures' road streaks in a cutscene alternated by up to 14 levels).
+extern "C" PPC_FUNC(__imp__sub_82161000);
+PPC_FUNC(sub_82161000)
+{
+    if (s_enabled && s_inBetween.load(std::memory_order_acquire) && ctx.r3.u32)
+    {
+        if (s_savedCameras.insert(ctx.r3.u32).second)
+            Save(base, ctx.r3.u32, kCameraBytes);
+        if (s_blendCameras)
+            ctx.f1.f64 *= s_fraction.load(std::memory_order_relaxed);
+    }
+    else if (const float own = s_ownFraction.load(std::memory_order_acquire); s_enabled && own > 0.0f && s_blendCameras)
+        ctx.f1.f64 *= own;
+    __imp__sub_82161000(ctx, base);
+}
+
+// D3D's swap sync (sub_82598670, from the swap sub_82598DD0, before the
+// packet VdSwap writes): with the device's presentation interval [+13772] at
+// 1 it has the command processor raise an interrupt whose callback
+// (sub_825985A0) sets the vblanks to wait, then wait for them (WAIT_REG_MEM):
+// the swap goes out at the first vblank after the command processor reaches
+// it. An in-between picture's swap waits for none, as with
+// D3DPRESENT_INTERVAL_IMMEDIATE (0x80000000: the function then emits no
+// packets), so the guest vblank, the game's frame clock, still releases one
+// swap a step: the real picture's.
+extern "C" PPC_FUNC(__imp__sub_82598670);
+PPC_FUNC(sub_82598670)
+{
+    if (!s_inBetween.load(std::memory_order_acquire))
+        return __imp__sub_82598670(ctx, base);
+    const uint32_t device = ctx.r3.u32;
+    const uint32_t interval = PPC_LOAD_U32(device + kDevicePresentInterval);
+    PPC_STORE_U32(device + kDevicePresentInterval, 0x80000000u);
+    __imp__sub_82598670(ctx, base);
+    PPC_STORE_U32(device + kDevicePresentInterval, interval);
+}
+
+// D3D's command buffers (sub_82597FF0, device creation: the parameters at r4,
+// D3DRING_BUFFER_PARAMETERS-shaped: +4 the primary ring's size (0: 32 KB),
+// +8 its memory, +12 the secondary buffer's size (0: 2 MB), +16 its memory,
+// +20 the secondary's segments (0: 32)). The render thread can write
+// commands only as far ahead of the command processor as the secondary
+// buffer holds, and the command processor stops at each real picture's
+// vblank wait: M2's run tl1 found the render thread spinning for ring space
+// (sub_82597070 -> sub_82597498) through the in-between picture's playback,
+// until the vblank (12 ms of every 16.7 ms frame the main loop waited for
+// it). With HFR on, a step's two pictures need twice the room: the
+// secondary buffer is made kHfrSecondaryFactor times larger, in as many more
+// segments of the same size (when D3D allocates it itself: no memory given).
+// NFSMW_HFR_SECONDARY=<n> sets the factor (1: the game's own).
+extern "C" PPC_FUNC(__imp__sub_82597FF0);
+PPC_FUNC(sub_82597FF0)
+{
+    const uint32_t params = ctx.r4.u32;
+    if (params)
+    {
+        const uint32_t primary = PPC_LOAD_U32(params + 4), secondary = PPC_LOAD_U32(params + 12);
+        const uint32_t secondaryMemory = PPC_LOAD_U32(params + 16), segments = PPC_LOAD_U32(params + 20);
+        fprintf(stderr, "[hfr] D3D command buffers: primary %u bytes%s, secondary %u bytes in %u segments%s\n", primary ? primary : 32768u,
+            PPC_LOAD_U32(params + 8) ? " (the game's memory)" : "", secondary ? secondary : 2u << 20, segments ? segments : 32u,
+            secondaryMemory ? " (the game's memory)" : "");
+        static const uint32_t factor = [] {
+            const char* v = std::getenv("NFSMW_HFR_SECONDARY");
+            return v ? uint32_t(std::clamp(std::atoi(v), 1, 8)) : 4u;
+        }();
+        if (s_enabled && factor > 1 && !secondaryMemory)
+        {
+            const uint32_t size = (secondary ? secondary : 2u << 20) * factor, count = (segments ? segments : 32u) * factor;
+            PPC_STORE_U32(params + 12, size);
+            PPC_STORE_U32(params + 20, count);
+            fprintf(stderr, "[hfr] D3D's secondary command buffer made %u times larger for two pictures a step: %u bytes in %u segments\n",
+                factor, size, count);
+        }
+        // The primary ring too (NFSMW_HFR_PRIMARY=<n>, default 4; 1: the game's).
+        static const uint32_t primaryFactor = [] {
+            const char* v = std::getenv("NFSMW_HFR_PRIMARY");
+            return v ? uint32_t(std::clamp(std::atoi(v), 1, 8)) : 4u;
+        }();
+        if (s_enabled && primaryFactor > 1 && !PPC_LOAD_U32(params + 8))
+        {
+            const uint32_t size = (primary ? primary : 32768u) * primaryFactor;
+            PPC_STORE_U32(params + 4, size);
+            fprintf(stderr, "[hfr] D3D's primary ring made %u times larger: %u bytes\n", primaryFactor, size);
+        }
+    }
+    __imp__sub_82597FF0(ctx, base);
+}
+
+// The eye adaptation's luminance readback (sub_82223308, from sub_822234F0:
+// the average of a 4 KB luminance target the GPU resolved, in f1). An
+// in-between picture's would read it right after the last real picture's
+// resolve, and the write guard stalled that read on the GPU (M2's run gd1:
+// 237 of 400 logged stalls, 3-6 ms each; dm3's race 0.89 stalls and 4.07 ms
+// stalled a picture against 0.11 ms a frame at 60). Its result is put back
+// with the exposure after the picture anyway: an in-between picture uses
+// the last real one's.
+//   M3: a real picture's own read waits too when the GPU hasn't resolved
+// the target yet: at 120 fps the GPU is behind by the in-between picture's
+// work, and the guard stalled the render thread there 2.5 ms a second on the
+// M1 Pro (M3's run d4a: 141-180 stalls of 3-4 ms in 200 s; 33 at 60 fps). With
+// Smooth Motion the real picture then reads the last real picture's target
+// (a frame old: the exposure moves 2% a frame toward it, which doesn't show).
+// NFSMW_HFR_STALE_LUMINANCE=0: it waits, as before.
+extern "C" PPC_FUNC(__imp__sub_82223308);
+PPC_FUNC(sub_82223308)
+{
+    static double last = 0.0;  // the last real picture's (whichever thread plays it)
+    if (s_enabled && s_inBetween.load(std::memory_order_acquire))
+    {
+        ctx.f1.f64 = last;
+        return;
+    }
+    static const bool staleOk = [] { const char* v = std::getenv("NFSMW_HFR_STALE_LUMINANCE"); return !(v && v[0] == '0'); }();
+    // The game reads the target it has just resolved, of two it takes in
+    // turn: while the GPU is still on its way there (run d5a: 130-450 of
+    // 600 real pictures), the other one, which the last real picture
+    // resolved and the GPU has finished, is read instead. Failing that the
+    // last reading, at most kStaleReadings frames in a row.
+    constexpr int kStaleReadings = 3;
+    static int stale = 0;
+    static uint32_t targets[2] = {};  // the last two targets read (most recent first)
+    const uint32_t target = ctx.r3.u32;
+    if (target != targets[0])
+    {
+        targets[1] = targets[0];
+        targets[0] = target;
+    }
+    if (s_enabled && staleOk && writewatch::GpuWritePending(target & 0x1FFFFFFF, 4096))
+    {
+        const uint32_t other = targets[1];
+        if (other && other != target && !writewatch::GpuWritePending(other & 0x1FFFFFFF, 4096))
+        {
+            s_staleLuminance.fetch_add(1, std::memory_order_relaxed);
+            ctx.r3.u32 = other;
+            __imp__sub_82223308(ctx, base);
+            last = ctx.f1.f64;
+            stale = 0;
+            return;
+        }
+        if (stale < kStaleReadings)
+        {
+            stale++;
+            s_staleLuminance.fetch_add(1, std::memory_order_relaxed);
+            ctx.f1.f64 = last;
+            return;
+        }
+    }
+    stale = 0;
+    __imp__sub_82223308(ctx, base);
+    last = ctx.f1.f64;
+}
+
+// M3 (the in-between picture's cost): render passes it can leave out. The
+// frame's render (sub_824454F8) prepares the views (sub_82440728), then draws
+// the sun's shadow maps (sub_824439B0: worldShadows, worldModelShadows,
+// smackableShadows; views 13-14), view 4 and 5's pass (sub_82444178: world and
+// cars), the environment map's faces (sub_82444520: views 18-23, each while
+// its enable byte, +8, is set), and the main view (sub_82443088). A pass left
+// out of an in-between picture leaves its targets as the last real picture
+// drew them, and the main view samples those. Left out while the load
+// check holds the lite step (s_level, s_liteSkip), or always (s_forcedSkip);
+// counted on the [hfr] command processor line. Measured on the Studio's NIS (M3 runs s3a-s3e): an
+// in-between picture's command processor 5.0 ms, 3.2 without the shadow
+// maps, 3.8 without the environment map, 4.5 without the mirror, 1.6
+// without all three.
+extern "C" PPC_FUNC(__imp__sub_824439B0);
+PPC_FUNC(sub_824439B0)
+{
+    if (Skip(kSkipShadow))
+        return;
+    __imp__sub_824439B0(ctx, base);
+}
+
+// The shadow views' fit to the player's view (render setup sub_82440F98:
+// sub_82454DC8 sets up view 13 or 14 from view 1 or 2, sub_82456030 view 15
+// or 16): kept from the real picture with the shadow maps (KeepView).
+extern "C" PPC_FUNC(__imp__sub_82454DC8);
+PPC_FUNC(sub_82454DC8)
+{
+    if (KeepShadowFit())
+        return;
+    __imp__sub_82454DC8(ctx, base);
+}
+
+extern "C" PPC_FUNC(__imp__sub_82456030);
+PPC_FUNC(sub_82456030)
+{
+    if (KeepShadowFit())
+        return;
+    __imp__sub_82456030(ctx, base);
+}
+
+extern "C" PPC_FUNC(__imp__sub_82444178);
+PPC_FUNC(sub_82444178)
+{
+    if (Skip(kSkipView4))
+        return;
+    __imp__sub_82444178(ctx, base);
+}
+
+// The eye adaptation's luminance measurement (sub_822234F0: downsamples the
+// picture, resolves it into one of two small targets, reads the other back,
+// sub_82223308, and adapts the exposure, sub_82223220). An in-between picture's
+// reading is the last real one's anyway, and its exposure is put back after it;
+// and M2's run gd2 found the real picture's readback stalled 182 times (3.4 ms
+// each) where the game at 60 stalls there a few times: the guess is that it
+// waits for the in-between picture's resolve, in the same pages.
+// NFSMW_HFR_SKIP=lum (M3): none in in-between pictures.
+extern "C" PPC_FUNC(__imp__sub_822234F0);
+PPC_FUNC(sub_822234F0)
+{
+    if (Skip(kSkipLum))
+        return;
+    __imp__sub_822234F0(ctx, base);
+}
+
+extern "C" PPC_FUNC(__imp__sub_82444520);
+PPC_FUNC(sub_82444520)
+{
+    if (Skip(kSkipEnv))
+        return;
+    __imp__sub_82444520(ctx, base);
+}
+
+// M3: each picture's own command-processor time and draws (command processor
+// thread, at each swap: the work since the last swap is this picture's), in-between and real
+// pictures apart, a line every 1200 pictures.
+void hfr::NotePictureCost(bool between, double cpMs, uint64_t draws, uint64_t passes)
+{
+    if (!s_enabled)
+        return;
+    struct Sum
+    {
+        uint64_t n = 0, draws = 0, passes = 0;
+        double cp = 0, cpMax = 0;
+    };
+    static Sum sums[2];
+    static uint64_t pictures = 0;
+    // The in-between picture's share of a real one's cost (the load check's estimate).
+    static double emaBetween = 0, emaReal = 0, lastBetween = -1;
+    if (between)
+        lastBetween = cpMs;
+    else if (lastBetween >= 0)
+    {
+        emaBetween = emaBetween ? emaBetween * 0.98 + lastBetween * 0.02 : lastBetween;
+        emaReal = emaReal ? emaReal * 0.98 + cpMs * 0.02 : cpMs;
+        lastBetween = -1;
+        if (emaReal > 0.5)
+            s_betweenShare.store(float(std::clamp(emaBetween / emaReal, 0.25, 1.25)), std::memory_order_relaxed);
+    }
+    Sum& s = sums[between ? 1 : 0];
+    s.n++;
+    s.draws += draws;
+    s.passes += passes;
+    s.cp += cpMs;
+    s.cpMax = std::max(s.cpMax, cpMs);
+    if (++pictures % 1200)
+        return;
+    auto avg = [](const Sum& x, double v) { return x.n ? v / double(x.n) : 0.0; };
+    fprintf(stderr, "[hfr] command processor per picture: in-between %llu, %.2f ms (max %.2f), %.0f draws, %.1f passes; real %llu, "
+                    "%.2f ms (max %.2f), %.0f draws, %.1f passes; passes left out: %llu shadow, %llu view 4, %llu environment, %llu luminance; %llu real pictures took the last luminance reading\n",
+        (unsigned long long)sums[1].n, avg(sums[1], sums[1].cp), sums[1].cpMax, avg(sums[1], double(sums[1].draws)),
+        avg(sums[1], double(sums[1].passes)), (unsigned long long)sums[0].n, avg(sums[0], sums[0].cp), sums[0].cpMax,
+        avg(sums[0], double(sums[0].draws)), avg(sums[0], double(sums[0].passes)), (unsigned long long)s_skipped[0].exchange(0),
+        (unsigned long long)s_skipped[1].exchange(0), (unsigned long long)s_skipped[2].exchange(0), (unsigned long long)s_skipped[3].exchange(0),
+        (unsigned long long)s_staleLuminance.exchange(0));
+    sums[0] = sums[1] = {};
+}
diff --git a/runtime/game/hfr.h b/runtime/game/hfr.h
new file mode 100644
index 0000000..bf70ccb
--- /dev/null
+++ b/runtime/game/hfr.h
@@ -0,0 +1,61 @@
+// SpeedBreaker runtime. GPL-3.0-or-later (see COPYING).
+//
+// HFR (v018-hfr, path A of the 120 fps study): pictures between the world's
+// 1/60 s steps. Off unless NFSMW_HFR=1 (see game/hfr.cpp).
+#pragma once
+#include <cstdint>
+
+namespace hfr
+{
+    // At launch, after the settings load (main.cpp): Settings > Display >
+    // Smooth Motion (NFSMW_HFR=1), for this run (a Restart setting).
+    void Init();
+    // Smooth Motion (NFSMW_HFR=1): each world step is drawn more than once where the display
+    // can show it (video::HfrPicturesPerStep), first between the last step
+    // and this one, then as it is.
+    bool Enabled();
+    // Enabled(), or NFSMW_HFR_RENDER2=1 (the study's diagnostic: drawn twice,
+    // the same both times).
+    bool Render2();
+    // Any thread: an in-between picture's render is under way (the main loop
+    // thread draws it, the render thread plays its passes back, and both see
+    // this until it has been played).
+    bool InBetween();
+    // Its fraction of the step (0.5: halfway); 0 when there is none.
+    float InBetweenFraction();
+    // Any thread: a step drawn only between (a display that isn't a whole
+    // multiple of 60 Hz): its own picture's fraction while it is drawn
+    // (its swap is the step's, released by the vblank); 0 otherwise.
+    float OwnFraction();
+    // Any thread: the refresh (steady ns) the picture being drawn is for, on a
+    // display at a rate that isn't a whole multiple of 60 Hz (video::HfrGrid);
+    // 0 otherwise.
+    int64_t PictureTarget();
+    // The command processor reached a swap (NFSMW_HFR_TIMELINE's lines).
+    void NoteSwap(float between);
+    // Command processor, at each real picture's swap: the command
+    // processor's busy time and the GPU's since the last one (ms), and
+    // whether an in-between picture was drawn between them. Decides whether
+    // the next frames can afford in-between pictures (game/hfr.cpp).
+    void NoteFrameCost(double cpMs, double gpuMs, bool hadBetween);
+    // Command processor, at every swap: that picture's own busy time (ms),
+    // draws and passes (the work since the last swap), for the [hfr] line
+    // that compares in-between pictures' cost with real ones'.
+    void NotePictureCost(bool between, double cpMs, uint64_t draws, uint64_t passes);
+}
+
+namespace hfrdiag
+{
+    // game/hfr_diag.cpp (diagnostics; each off unless its variable is set).
+    void AfterRenderEntry(uint8_t* base);
+    void OnViewSetup(uint8_t* base, uint32_t view);
+    // game/hfr_writeset.cpp (NFSMW_HFR_WRITESET): the phase of a measurement
+    // a frame plays (0 none, 1 in-between, 2 control, 3 noise), and its steps.
+    int WriteSetPhase(uint64_t frame);
+    void WriteSetBeforeBetween(uint8_t* base);
+    void WriteSetAfterBetween(uint8_t* base);
+    void WriteSetAfterReal(uint8_t* base);
+    void WriteSetControlBefore(uint8_t* base);
+    void WriteSetControlAfter(uint8_t* base);
+    void WriteSetNoise(uint8_t* base);
+}
diff --git a/runtime/game/hfr_blend.h b/runtime/game/hfr_blend.h
new file mode 100644
index 0000000..f41320c
--- /dev/null
+++ b/runtime/game/hfr_blend.h
@@ -0,0 +1,150 @@
+// SpeedBreaker runtime. GPL-3.0-or-later (see COPYING).
+//
+// SPIKE (v017-hfr-spike, path A of the 120 fps study): blending two poses of
+// the game's 4x4 matrices for an in-between picture. Apart from game/hfr.cpp
+// so tests/hfr_blend_test.cpp can check it.
+//
+// NFSMW's matrices are row-major and act on row vectors (v' = v M): rows 0-2
+// are the basis, row 3 the translation, column 3 (0, 0, 0, 1).
+//   - A world matrix (a car's at its render object +816): rows 0-2 its axes
+//     in the world, row 3 its position.
+//   - A camera's (camera object +0, what the view setup sub_8243EAC0 reads)
+//     is a view matrix, world -> camera: v_cam = v_world R + t, so the
+//     camera's position p solves p R + t = 0: p = -t R^-1 (-t R^T only
+//     when R is orthonormal, which a cutscene camera's isn't quite: see
+//     ViewPosition). (Measured: its p sits a few metres from the player's car.)
+//     The blended view's translation is made from its blended axes and the
+//     blended position, so it puts the camera exactly there.
+// Axes are blended and made orthonormal again (Gram-Schmidt in row order,
+// which keeps the handedness: no cross product), each row's length blended
+// (a scaled model keeps its scale); positions are blended linearly. For the
+// small turns between two 1/60 s steps this is as good as a slerp.
+#pragma once
+#include <algorithm>
+#include <cmath>
+#include <cstring>
+
+namespace hfr::blend
+{
+    struct V3
+    {
+        float x, y, z;
+    };
+    inline V3 Row(const float m[16], int r) { return { m[r * 4], m[r * 4 + 1], m[r * 4 + 2] }; }
+    inline float Dot(V3 a, V3 b) { return a.x * b.x + a.y * b.y + a.z * b.z; }
+    inline float Len(V3 a) { return std::sqrt(Dot(a, a)); }
+    inline V3 Lerp(V3 a, V3 b, float t) { return { a.x + (b.x - a.x) * t, a.y + (b.y - a.y) * t, a.z + (b.z - a.z) * t }; }
+    inline V3 Sub(V3 a, V3 b) { return { a.x - b.x, a.y - b.y, a.z - b.z }; }
+    inline V3 Scale(V3 a, float s) { return { a.x * s, a.y * s, a.z * s }; }
+
+    // The axes of a and b blended at t, orthonormal, then scaled to their
+    // blended lengths. False when they collapse (a half turn: not blendable).
+    inline bool Axes(const float a[16], const float b[16], float t, V3 out[3])
+    {
+        for (int r = 0; r < 3; r++)
+        {
+            V3 v = Lerp(Row(a, r), Row(b, r), t);
+            for (int q = 0; q < r; q++)
+                v = Sub(v, Scale(out[q], Dot(v, out[q])));
+            const float l = Len(v);
+            if (!(l > 1e-6f))
+                return false;
+            out[r] = Scale(v, 1.0f / l);
+        }
+        for (int r = 0; r < 3; r++)
+        {
+            const float la = Len(Row(a, r)), lb = Len(Row(b, r));
+            out[r] = Scale(out[r], la + (lb - la) * t);
+        }
+        return true;
+    }
+
+    inline void Put(float m[16], int r, V3 v, float w)
+    {
+        m[r * 4] = v.x;
+        m[r * 4 + 1] = v.y;
+        m[r * 4 + 2] = v.z;
+        m[r * 4 + 3] = w;
+    }
+
+    // A world matrix between a (t = 0) and b (t = 1). False: not blendable.
+    inline bool World(const float a[16], const float b[16], float t, float out[16])
+    {
+        V3 axes[3];
+        if (!Axes(a, b, t, axes))
+            return false;
+        for (int r = 0; r < 3; r++)
+            Put(out, r, axes[r], a[r * 4 + 3] + (b[r * 4 + 3] - a[r * 4 + 3]) * t);
+        Put(out, 3, Lerp(Row(a, 3), Row(b, 3), t), a[15] + (b[15] - a[15]) * t);
+        return true;
+    }
+
+    // A view matrix's camera position: the point p that p R + t takes to the
+    // origin, p = -t R^-1 (in doubles). Not -t R^T: the game's cutscene (NIS)
+    // cameras aren't quite orthonormal (rows' lengths and dot products off by
+    // 2-7e-5), and 1.4 km from the world's origin R^T for R^-1 put them 4-10
+    // cm off. The in-between picture's camera went that far from halfway, and
+    // a car close to a long lens jumped 2-37 px (at 1280 px wide) in every
+    // in-between picture: the ghost seen in a play-test (2026-10-18,
+    // the pre-race pan, measured). A singular R: -t R^T.
+    inline V3 ViewPosition(const float m[16])
+    {
+        const double a = m[0], b = m[1], c = m[2], d = m[4], e = m[5], f = m[6], g = m[8], h = m[9], k = m[10];
+        // The adjugate's rows (inverse = adjugate / determinant).
+        const double i00 = e * k - f * h, i01 = c * h - b * k, i02 = b * f - c * e;
+        const double i10 = f * g - d * k, i11 = a * k - c * g, i12 = c * d - a * f;
+        const double i20 = d * h - e * g, i21 = b * g - a * h, i22 = a * e - b * d;
+        const double det = a * i00 + b * i10 + c * i20;
+        const double t0 = m[12], t1 = m[13], t2 = m[14];
+        if (!(std::fabs(det) > 1e-12))
+        {
+            const V3 t = Row(m, 3);
+            return { -Dot(t, Row(m, 0)), -Dot(t, Row(m, 1)), -Dot(t, Row(m, 2)) };
+        }
+        return { float(-(t0 * i00 + t1 * i10 + t2 * i20) / det), float(-(t0 * i01 + t1 * i11 + t2 * i21) / det),
+            float(-(t0 * i02 + t1 * i12 + t2 * i22) / det) };
+    }
+
+    // A view matrix between a (t = 0) and b (t = 1): the camera's position and
+    // axes blended, the translation made from them. False: not blendable.
+    inline bool View(const float a[16], const float b[16], float t, float out[16])
+    {
+        V3 axes[3];
+        if (!Axes(a, b, t, axes))
+            return false;
+        const V3 p = Lerp(ViewPosition(a), ViewPosition(b), t);
+        for (int r = 0; r < 3; r++)
+            Put(out, r, axes[r], a[r * 4 + 3] + (b[r * 4 + 3] - a[r * 4 + 3]) * t);
+        // t_j = -sum_i p_i R_ij (R's rows are axes[i]).
+        const V3 tr = { -(p.x * axes[0].x + p.y * axes[1].x + p.z * axes[2].x), -(p.x * axes[0].y + p.y * axes[1].y + p.z * axes[2].y),
+            -(p.x * axes[0].z + p.y * axes[1].z + p.z * axes[2].z) };
+        Put(out, 3, tr, a[15] + (b[15] - a[15]) * t);
+        return true;
+    }
+
+    // The largest turn of any axis between a and b, in degrees.
+    inline float TurnDegrees(const float a[16], const float b[16])
+    {
+        float worst = 0.0f;
+        for (int r = 0; r < 3; r++)
+        {
+            const V3 x = Row(a, r), y = Row(b, r);
+            const float lx = Len(x), ly = Len(y);
+            if (!(lx > 1e-6f) || !(ly > 1e-6f))
+                return 180.0f;
+            const float c = std::clamp(Dot(x, y) / (lx * ly), -1.0f, 1.0f);
+            worst = std::max(worst, std::acos(c) * 57.2957795f);
+        }
+        return worst;
+    }
+
+    // Too far apart to be one step's motion: a cut, a reset, a teleport.
+    inline bool WorldCut(const float a[16], const float b[16], float maxMove, float maxTurnDegrees)
+    {
+        return Len(Sub(Row(a, 3), Row(b, 3))) > maxMove || TurnDegrees(a, b) > maxTurnDegrees;
+    }
+    inline bool ViewCut(const float a[16], const float b[16], float maxMove, float maxTurnDegrees)
+    {
+        return Len(Sub(ViewPosition(a), ViewPosition(b))) > maxMove || TurnDegrees(a, b) > maxTurnDegrees;
+    }
+}
diff --git a/runtime/game/hfr_diag.cpp b/runtime/game/hfr_diag.cpp
new file mode 100644
index 0000000..ecf1e64
--- /dev/null
+++ b/runtime/game/hfr_diag.cpp
@@ -0,0 +1,230 @@
+// Diagnostics from the high-frame-rate (Smooth Motion) work, for testing
+// only: nothing here is on unless its variable is set.
+//
+// NFSMW_HFR_COUNT=<frames>: every <frames> calls of the frame's render entry
+// (sub_823AFC68), one "[hfr]" line: how many times each render-side guest
+// function ran per render entry and per world step (the stepper's step
+// counter, [0x82A2CB6C]+40), the RealTimeFrames advance, and the views set up
+// (sub_8243EAC0, by view id).
+//
+// NFSMW_HFR_RENDER2=1: the frame's render (sub_823AFC68: view setup, shadow
+// fit, every pass and the end-of-frame callback with its Present) runs twice
+// with the same world state (game/hfr.cpp: the first one's swap is presented
+// at once, as an in-between picture's, so the world keeps its 60 steps a
+// second at the 60 Hz guest vblank and each step is presented twice).
+#include <stdafx.h>
+#include <kernel/function.h>
+
+#include <atomic>
+#include <cstdlib>
+#include <string>
+
+#include "hfr.h"
+
+namespace
+{
+    enum Id
+    {
+        RenderEntry, RenderFrame, ViewSetup, CamDirector, Exposure, FrameGate, FrameGateReset, Present, Flares,
+        Emitters, WorldScene, TexAnim, Count
+    };
+    const char* kNames[Count] = { "render-entry 823AFC68", "render-frame 82441050", "view-setup 8243EAC0",
+        "camera-director 82168028", "exposure-adapt 82223220", "frame-gate 8243B0B0", "frame-gate-reset",
+        "present 825987E0", "RenderFlares 824E6220", "emitter-render 8222ADC0", "world-scene 82443088",
+        "tex-anim 822206C0" };
+
+    const uint32_t s_every = [] {
+        const char* v = std::getenv("NFSMW_HFR_COUNT");
+        return v ? uint32_t(std::max(0, std::atoi(v))) : 0u;
+    }();
+    std::atomic<uint64_t> s_n[Count];
+    std::atomic<uint64_t> s_views[32];
+
+    void Bump(Id id)
+    {
+        if (s_every)
+            s_n[id].fetch_add(1, std::memory_order_relaxed);
+    }
+
+    // Main loop thread only.
+    struct Last
+    {
+        uint64_t n[Count] = {};
+        uint64_t views[32] = {};
+        uint32_t steps = 0, rtf = 0;
+        bool valid = false;
+    } s_last;
+
+    void Report(uint8_t* base)
+    {
+        const uint32_t stepper = PPC_LOAD_U32(0x82A2CB6C);
+        const uint32_t steps = stepper ? PPC_LOAD_U32(stepper + 40) : 0;
+        const uint32_t rtf = PPC_LOAD_U32(0x828FD86C);
+        uint64_t n[Count], views[32];
+        for (int i = 0; i < Count; i++)
+            n[i] = s_n[i].load(std::memory_order_relaxed);
+        for (int i = 0; i < 32; i++)
+            views[i] = s_views[i].load(std::memory_order_relaxed);
+        if (s_last.valid)
+        {
+            const double entries = double(n[RenderEntry] - s_last.n[RenderEntry]);
+            const int64_t dSteps = int64_t(steps) - int64_t(s_last.steps);
+            std::string line = std::format("[hfr] {:.0f} render entries, {} world steps, RTF +{}:", entries, dSteps,
+                int64_t(rtf) - int64_t(s_last.rtf));
+            for (int i = 1; i < Count; i++)
+            {
+                const double d = double(n[i] - s_last.n[i]);
+                line += std::format(" | {} {:.2f}/entry", kNames[i], entries > 0 ? d / entries : 0.0);
+                if (dSteps > 0)
+                    line += std::format(" {:.2f}/step", d / double(dSteps));
+            }
+            line += " | views/entry:";
+            for (int i = 0; i < 32; i++)
+                if (views[i] != s_last.views[i])
+                    line += std::format(" {}:{:.2f}", i, entries > 0 ? double(views[i] - s_last.views[i]) / entries : 0.0);
+            fprintf(stderr, "%s\n", line.c_str());
+        }
+        for (int i = 0; i < Count; i++)
+            s_last.n[i] = n[i];
+        for (int i = 0; i < 32; i++)
+            s_last.views[i] = views[i];
+        s_last.steps = steps;
+        s_last.rtf = rtf;
+        s_last.valid = true;
+    }
+}
+
+// The frame's render entry (sub_823AFC68, overridden in game/hfr.cpp): once per call of it, after its renders.
+void hfrdiag::AfterRenderEntry(uint8_t* base)
+{
+    Bump(RenderEntry);
+    if (s_every && s_n[RenderEntry].load(std::memory_order_relaxed) % s_every == 0)
+        Report(base);
+}
+
+#define HFR_COUNT(sub, id)                \
+    extern "C" PPC_FUNC(__imp__##sub);    \
+    PPC_FUNC(sub)                         \
+    {                                     \
+        Bump(id);                         \
+        __imp__##sub(ctx, base);          \
+    }
+
+HFR_COUNT(sub_82441050, RenderFrame)
+HFR_COUNT(sub_82168028, CamDirector)
+// NFSMW_HFR_EXPOSURE_LOG=<from s>,<count>: each eye adaptation (sub_82223220, on the render thread when it plays the
+// end-of-frame pass): adapted before and after, measured, and whether it was the in-between picture's.
+namespace
+{
+    std::atomic<int> s_exposureLeft = [] {
+        const char* v = std::getenv("NFSMW_HFR_EXPOSURE_LOG");
+        const char* c = v ? std::strchr(v, ',') : nullptr;
+        return v ? (c ? std::atoi(c + 1) : 120) : 0;
+    }();
+    const double s_exposureFrom = [] { const char* v = std::getenv("NFSMW_HFR_EXPOSURE_LOG"); return v ? std::atof(v) : 0.0; }();
+    const auto s_exposureT0 = std::chrono::steady_clock::now();
+    float LoadF(uint8_t* base, uint32_t a)
+    {
+        const uint32_t bits = PPC_LOAD_U32(a);
+        float f;
+        memcpy(&f, &bits, 4);
+        return f;
+    }
+}
+extern "C" PPC_FUNC(__imp__sub_82223220);
+PPC_FUNC(sub_82223220)
+{
+    Bump(Exposure);
+    const bool log = s_exposureLeft.load() > 0 &&
+        std::chrono::duration<double>(std::chrono::steady_clock::now() - s_exposureT0).count() >= s_exposureFrom;
+    const float before = LoadF(base, 0x82908AB8), measured = LoadF(base, 0x82908ABC);
+    const bool between = hfr::InBetween();
+    __imp__sub_82223220(ctx, base);
+    if (log && s_exposureLeft.fetch_sub(1) > 0)
+        fprintf(stderr, "[hfrexpo] %s adapted %.6f -> %.6f measured %.6f\n", between ? "between" : "real", before,
+            LoadF(base, 0x82908AB8), measured);
+}
+HFR_COUNT(sub_825987E0, Present)
+HFR_COUNT(sub_824E6220, Flares)
+HFR_COUNT(sub_8222ADC0, Emitters)
+HFR_COUNT(sub_82443088, WorldScene)
+HFR_COUNT(sub_822206C0, TexAnim)
+
+// NFSMW_HFR_LOGVIEW=<from s>,<count>: from <from s> after launch, <count> lines: each setup of view 1 (the player's) with
+// the stepper's step counter, RealTimeFrames, the render entries so far, and its camera's matrix (view+64 -> camera, 16
+// floats; the layout as an earlier diagnostic logged it).
+namespace
+{
+    struct ViewLog
+    {
+        double fromS = -1;
+        int left = 0;
+        std::chrono::steady_clock::time_point t0 = std::chrono::steady_clock::now();
+        ViewLog()
+        {
+            if (const char* v = std::getenv("NFSMW_HFR_LOGVIEW"))
+            {
+                fromS = std::atof(v);
+                const char* c = std::strchr(v, ',');
+                left = c ? std::atoi(c + 1) : 40;
+            }
+        }
+    } s_viewLog;
+
+    void LogView(uint8_t* base, uint32_t view)
+    {
+        if (s_viewLog.left <= 0 || std::chrono::duration<double>(std::chrono::steady_clock::now() - s_viewLog.t0).count() < s_viewLog.fromS)
+            return;
+        if (PPC_LOAD_U32(view + 4) != 1)
+            return;
+        s_viewLog.left--;
+        const uint32_t cam = PPC_LOAD_U32(view + 64), stepper = PPC_LOAD_U32(0x82A2CB6C);
+        std::string m;
+        for (int i = 0; cam && i < 16; i++)
+        {
+            const uint32_t bits = PPC_LOAD_U32(cam + i * 4);
+            float f;
+            memcpy(&f, &bits, 4);
+            m += std::format("{}{:.6g}", i ? "," : "", f);
+        }
+        // The player's car (item 0 of the vehicle render list at 0x82C84D38): its matrix's position row as drawn.
+        std::string car = "-";
+        const uint32_t items = PPC_LOAD_U32(0x82C84D3C), count = PPC_LOAD_U32(0x82C84D44);
+        if (items && count)
+            if (const uint32_t object = PPC_LOAD_U32(items))
+            {
+                float p[3];
+                for (int i = 0; i < 3; i++)
+                {
+                    const uint32_t bits = PPC_LOAD_U32(object + 816 + 48 + i * 4);
+                    memcpy(&p[i], &bits, 4);
+                }
+                car = std::format("{:08X} {:.4f},{:.4f},{:.4f}", object, p[0], p[1], p[2]);
+            }
+        fprintf(stderr, "[hfrview] steps %u rtf %u entry %llu %s fov %u cam %08X M %s car %s\n", stepper ? PPC_LOAD_U32(stepper + 40) : 0,
+            PPC_LOAD_U32(0x828FD86C), (unsigned long long)s_n[RenderEntry].load(), hfr::InBetween() ? "between" : "real",
+            cam ? unsigned(PPC_LOAD_U16(cam + 196)) : 0u, cam, m.c_str(), car.c_str());
+    }
+}
+
+// A view setup (sub_8243EAC0, overridden in game/hfr.cpp), with the camera as it will be used.
+void hfrdiag::OnViewSetup(uint8_t* base, uint32_t view)
+{
+    if (s_every)
+    {
+        Bump(ViewSetup);
+        const uint32_t id = PPC_LOAD_U32(view + 4);
+        if (id < 32)
+            s_views[id].fetch_add(1, std::memory_order_relaxed);
+    }
+    LogView(base, view);
+}
+
+extern "C" PPC_FUNC(__imp__sub_8243B0B0);
+PPC_FUNC(sub_8243B0B0)
+{
+    Bump(FrameGate);
+    __imp__sub_8243B0B0(ctx, base);
+    if (ctx.r3.u32 == 1)
+        Bump(FrameGateReset);
+}
diff --git a/runtime/game/hfr_grid.h b/runtime/game/hfr_grid.h
new file mode 100644
index 0000000..7d5489a
--- /dev/null
+++ b/runtime/game/hfr_grid.h
@@ -0,0 +1,38 @@
+// SpeedBreaker runtime. GPL-3.0-or-later (see COPYING).
+//
+// HFR (game/hfr.h) on a display at a rate that isn't a whole multiple of
+// 60 Hz with a fixed refresh grid (90, 144, 165 Hz: video::HfrGrid): which
+// refreshes a world step's pictures are for, and their fractions of the way
+// from the last step. A step's pictures cover the refreshes after the last
+// step's last picture (`from`, ns) up to a step later; each one's fraction is
+// how far into the step its refresh falls. Header only:
+// tests/hfr_grid_test.cpp checks it.
+#pragma once
+#include <algorithm>
+#include <cmath>
+#include <cstdint>
+
+namespace hfr::grid
+{
+    // `gridNs`: a refresh's time; `periodNs`: the refresh period; `stepNs`:
+    // the world step (the guest vblank); `from`: when the last step's state
+    // is shown. Up to 4 pictures, in order; 0 when none falls in the step (a
+    // display slower than 60 Hz).
+    inline int Pictures(double gridNs, double periodNs, double stepNs, double from, float fractions[4], int64_t targets[4])
+    {
+        if (!(periodNs > 0) || !(stepNs > 0))
+            return 0;
+        int count = 0;
+        // The first refresh after `from` (a refresh exactly at it is the last step's).
+        double r = gridNs + std::floor((from - gridNs) / periodNs + 1.0) * periodNs;
+        if (r - from < 1.0)
+            r += periodNs;
+        for (; r <= from + stepNs + 1.0 && count < 4; r += periodNs)
+        {
+            fractions[count] = std::clamp(float((r - from) / stepNs), 0.01f, 1.0f);
+            targets[count] = int64_t(std::llround(r));
+            count++;
+        }
+        return count;
+    }
+}
diff --git a/runtime/game/hfr_writeset.cpp b/runtime/game/hfr_writeset.cpp
new file mode 100644
index 0000000..5b132a4
--- /dev/null
+++ b/runtime/game/hfr_writeset.cpp
@@ -0,0 +1,304 @@
+// SpeedBreaker runtime. GPL-3.0-or-later (see COPYING).
+//
+// DIAGNOSTIC for HFR (game/hfr.cpp), off unless NFSMW_HFR_WRITESET is set:
+// what an in-between picture leaves changed in guest memory once its state
+// has been put back, against what a real picture's render changes and what
+// the other threads change meanwhile. A leak (guest state the in-between
+// picture changes that the world reads after it) would make HFR play
+// differently from 60 fps.
+//
+// NFSMW_HFR_WRITESET=<frame>,<count>[,<file>]: from that frame of the render
+// entry, `count` measurements, each three frames long:
+//   1. a frame with an in-between picture: all committed guest memory (the
+//      three heaps and the XEX image, 0x82000000-0x82CD0000) copied just
+//      before the in-between picture's state is saved; compared once its
+//      state has been put back (B: what it left changed), and again after the
+//      frame's real picture has been played (R: what the real one changed
+//      besides, and which B bytes it wrote again);
+//   2. a frame without one (the control): copied before the real picture,
+//      compared after it has been played (C: a real render's writes, with
+//      the other threads');
+//   3. a frame where nothing is drawn between the copy and the comparison
+//      but a 10 ms sleep (N: the other threads alone).
+// Each changed run of bytes (runs closer than 64 bytes merged) goes to the
+// file (default hfr_writeset.txt in the working directory) with its
+// allocation; a summary line per measurement goes to stderr: B's bytes in
+// runs that neither C nor N touch are the leak candidates.
+#include <stdafx.h>
+#include <kernel/function.h>
+#include <kernel/vmem.h>
+
+#include "hfr.h"
+
+#include <algorithm>
+#include <chrono>
+#include <cstdio>
+#include <cstdlib>
+#include <iterator>
+#include <string>
+#include <thread>
+#include <vector>
+
+namespace
+{
+    struct Config
+    {
+        uint64_t from = 0, count = 0;
+        std::string file = "hfr_writeset.txt";
+    };
+    const Config s_config = [] {
+        Config c;
+        if (const char* v = std::getenv("NFSMW_HFR_WRITESET"))
+        {
+            char file[512] = {};
+            unsigned long long from = 0, count = 0;
+            const int n = sscanf(v, "%llu,%llu,%511s", &from, &count, file);
+            if (n >= 2)
+            {
+                c.from = from;
+                c.count = count;
+                if (n == 3)
+                    c.file = file;
+                fprintf(stderr, "[hfr] NFSMW_HFR_WRITESET: %llu measurements of guest memory from frame %llu into %s (DIAGNOSTIC)\n",
+                    count, from, c.file.c_str());
+            }
+        }
+        return c;
+    }();
+
+    struct Region
+    {
+        uint32_t address, size;
+    };
+    struct Run
+    {
+        uint32_t address, size;
+    };
+
+    std::vector<Region> CommittedRegions()
+    {
+        std::vector<Region> out;
+        for (vmem::PageHeap* heap : { &vmem::Virtual4K(), &vmem::Virtual64K(), &vmem::Physical() })
+        {
+            uint32_t a = heap->Base();
+            while (a < heap->End())
+            {
+                vmem::RegionInfo info{};
+                if (!heap->Query(a, &info) || !info.regionSize)
+                    break;
+                if (info.state & vmem::X_MEM_COMMIT)
+                    out.push_back({ info.baseAddress, info.regionSize });
+                a = info.baseAddress + info.regionSize;
+            }
+        }
+        out.push_back({ 0x82000000u, 0x00CD0000u });  // the XEX image with its data and BSS
+        return out;
+    }
+
+    struct Snapshot
+    {
+        std::vector<Region> regions;
+        std::vector<std::vector<uint8_t>> bytes;
+        void Take(uint8_t* base)
+        {
+            regions = CommittedRegions();
+            bytes.resize(regions.size());
+            for (size_t i = 0; i < regions.size(); i++)
+                bytes[i].assign(base + regions[i].address, base + regions[i].address + regions[i].size);
+        }
+        // Runs of bytes that differ now (gaps under 64 bytes merged).
+        std::vector<Run> Changed(uint8_t* base) const
+        {
+            std::vector<Run> runs;
+            for (size_t i = 0; i < regions.size(); i++)
+            {
+                const uint8_t* now = base + regions[i].address;
+                const uint8_t* was = bytes[i].data();
+                const uint32_t size = regions[i].size;
+                uint32_t k = 0;
+                while (k < size)
+                {
+                    // Fast skip of equal 8-byte words.
+                    while (k + 8 <= size && !memcmp(now + k, was + k, 8))
+                        k += 8;
+                    while (k < size && now[k] == was[k])
+                        k++;
+                    if (k >= size)
+                        break;
+                    const uint32_t start = k;
+                    uint32_t end = k + 1, quiet = 0;
+                    for (k++; k < size && quiet < 64; k++)
+                    {
+                        if (now[k] != was[k])
+                        {
+                            end = k + 1;
+                            quiet = 0;
+                        }
+                        else
+                            quiet++;
+                    }
+                    runs.push_back({ regions[i].address + start, end - start });
+                    k = end;
+                }
+            }
+            return runs;
+        }
+    };
+
+    uint64_t Bytes(const std::vector<Run>& runs)
+    {
+        uint64_t n = 0;
+        for (const Run& r : runs)
+            n += r.size;
+        return n;
+    }
+    bool Overlaps(const std::vector<Run>& sorted, const Run& r)
+    {
+        auto it = std::upper_bound(sorted.begin(), sorted.end(), r.address, [](uint32_t a, const Run& x) { return a < x.address; });
+        if (it != sorted.begin())
+        {
+            auto p = std::prev(it);
+            if (p->address + p->size > r.address)
+                return true;
+        }
+        return it != sorted.end() && it->address < r.address + r.size;
+    }
+    std::string Where(uint32_t address)
+    {
+        if (address >= 0x82000000u && address < 0x82CD0000u)
+            return "xex";
+        vmem::PageHeap* heap = vmem::HeapFor(address);
+        if (!heap)
+            return "?";
+        vmem::RegionInfo info{};
+        heap->Query(address, &info);
+        char s[64];
+        snprintf(s, sizeof(s), "%s alloc %08X", heap == &vmem::Physical() ? "phys" : heap == &vmem::Virtual64K() ? "v64k" : "v4k",
+            info.allocationBase);
+        return s;
+    }
+
+    // Main loop thread only.
+    Snapshot s_snapshot;
+    // The measurement under way: its phase (1-3), and the frame it may go on
+    // from (the copies take long enough that the next frames catch up with
+    // two world steps, and draw no in-between picture: 60 frames between
+    // measurements, and phase 1 waits for a frame that draws one).
+    int s_phase = 1;
+    uint64_t s_nextFrame = 0;
+    bool s_betweenTaken = false;
+    uint32_t s_wait = 0;  // frames to let pass before the next measurement
+    std::vector<Run> s_between, s_real, s_control, s_noise;
+    std::vector<std::pair<Run, std::vector<uint8_t>>> s_betweenBytes;  // B's runs as the in-between left them
+    FILE* s_out = nullptr;
+    uint64_t s_done = 0;
+
+    void Write(const char* what, const std::vector<Run>& runs, uint8_t* base)
+    {
+        fprintf(s_out, "%s: %zu runs, %llu bytes\n", what, runs.size(), (unsigned long long)Bytes(runs));
+        for (const Run& r : runs)
+        {
+            fprintf(s_out, "  %08X +%u %s |", r.address, r.size, Where(r.address).c_str());
+            for (uint32_t k = 0; k < std::min<uint32_t>(r.size, 16); k++)
+                fprintf(s_out, " %02X", base[r.address + k]);
+            fprintf(s_out, "\n");
+        }
+    }
+
+    void Summarize(uint8_t* base, uint64_t measurement)
+    {
+        auto sorted = [](std::vector<Run> v) { std::sort(v.begin(), v.end(), [](const Run& a, const Run& b) { return a.address < b.address; }); return v; };
+        const std::vector<Run> control = sorted(s_control), noise = sorted(s_noise), real = sorted(s_real);
+        std::vector<Run> suspects;
+        uint64_t rewritten = 0;
+        for (const auto& [r, bytes] : s_betweenBytes)
+        {
+            if (memcmp(base + r.address, bytes.data(), r.size))
+                rewritten += r.size;
+            if (!Overlaps(control, r) && !Overlaps(noise, r))
+                suspects.push_back(r);
+        }
+        fprintf(stderr, "[hfr] write set %llu: the in-between picture left %zu runs (%llu bytes) changed, %llu bytes written again by the real "
+                        "one; a real render changes %zu runs (%llu bytes), the other threads %zu (%llu bytes); %zu runs (%llu bytes) the "
+                        "in-between picture changed that neither does (leak candidates, in %s)\n",
+            (unsigned long long)measurement, s_between.size(), (unsigned long long)Bytes(s_between), (unsigned long long)rewritten,
+            s_control.size(), (unsigned long long)Bytes(s_control), s_noise.size(), (unsigned long long)Bytes(s_noise), suspects.size(),
+            (unsigned long long)Bytes(suspects), s_config.file.c_str());
+        fprintf(s_out, "=== measurement %llu\n", (unsigned long long)measurement);
+        Write("LEAK CANDIDATES (in-between left changed; no real render or other thread touches)", suspects, base);
+        Write("B: in-between left changed", s_between, base);
+        Write("R: changed since B, through the real picture", s_real, base);
+        Write("C: a real render (control frame)", s_control, base);
+        Write("N: other threads, 10 ms", s_noise, base);
+        fflush(s_out);
+    }
+}
+
+namespace hfrdiag
+{
+    // Main loop thread, from game/hfr.cpp's render entry: the phase this
+    // frame plays in a measurement (0: none). 1: snapshot before the
+    // in-between picture; 2: a control frame (no in-between picture); 3: the
+    // noise frame.
+    int WriteSetPhase(uint64_t frame)
+    {
+        if (!s_config.count || frame < s_config.from || s_done >= s_config.count)
+            return 0;
+        if (s_wait)
+        {
+            s_wait--;
+            return 0;
+        }
+        return s_phase;
+    }
+
+    void WriteSetBeforeBetween(uint8_t* base)
+    {
+        if (!s_out && !(s_out = fopen(s_config.file.c_str(), "w")))
+            return;
+        s_snapshot.Take(base);
+        s_betweenTaken = true;
+    }
+    void WriteSetAfterBetween(uint8_t* base)
+    {
+        if (!s_out)
+            return;
+        s_between = s_snapshot.Changed(base);
+        s_betweenBytes.clear();
+        for (const Run& r : s_between)
+            s_betweenBytes.push_back({ r, std::vector<uint8_t>(base + r.address, base + r.address + r.size) });
+    }
+    void WriteSetAfterReal(uint8_t* base)
+    {
+        if (!s_out || !s_betweenTaken)
+            return;  // no in-between picture this frame: phase 1 again next frame
+        s_betweenTaken = false;
+        s_real = s_snapshot.Changed(base);
+        s_phase = 2;
+        s_nextFrame = 0;
+    }
+    void WriteSetControlBefore(uint8_t* base)
+    {
+        if (s_out)
+            s_snapshot.Take(base);
+    }
+    void WriteSetControlAfter(uint8_t* base)
+    {
+        if (!s_out)
+            return;
+        s_control = s_snapshot.Changed(base);
+        s_phase = 3;
+    }
+    void WriteSetNoise(uint8_t* base)
+    {
+        if (!s_out)
+            return;
+        s_snapshot.Take(base);
+        std::this_thread::sleep_for(std::chrono::milliseconds(10));
+        s_noise = s_snapshot.Changed(base);
+        Summarize(base, ++s_done);
+        s_phase = 1;
+        s_nextFrame = 0;  // set by the caller's frame count: WriteSetPhase sees it next frame
+        s_wait = 60;
+    }
+}
diff --git a/runtime/game/light_trails.cpp b/runtime/game/light_trails.cpp
index eb9dd36..b141bad 100644
--- a/runtime/game/light_trails.cpp
+++ b/runtime/game/light_trails.cpp
@@ -11,6 +11,7 @@
 #include <stdafx.h>
 #include "light_trails.h"
 #include "frame_time.h"
+#include "hfr.h"
 
 #include <kernel/function.h>
 
@@ -92,7 +93,10 @@ namespace
                 s_lastPruneMs = ms;
             }
             History& h = s_cars[info];
-            h.Add(ms, now);
+            // SPIKE (v017-hfr-spike): the in-between picture (game/hfr.cpp) draws a blended pose at the frame's
+            // game time; only the real picture's pose goes into the history (the ring itself is put back).
+            if (!hfr::InBetween())
+                h.Add(ms, now);
             fill = FillFor(h, ms);
         }
         const uint32_t slot = uint32_t(newest);
diff --git a/runtime/game/split_screen.cpp b/runtime/game/split_screen.cpp
new file mode 100644
index 0000000..313ccdb
--- /dev/null
+++ b/runtime/game/split_screen.cpp
@@ -0,0 +1,43 @@
+// SpeedBreaker runtime. GPL-3.0-or-later (see COPYING). See split_screen.h.
+#include <stdafx.h>
+#include "split_screen.h"
+
+#include <kernel/memory.h>
+
+namespace
+{
+    const bool s_enabled = [] {
+        const char* v = std::getenv("NFSMW_SPLIT_SCREEN");
+        const bool on = !(v && v[0] == '0');
+        if (!on)
+            fprintf(stderr, "[split] NFSMW_SPLIT_SCREEN=0: one controller only, and no split-screen cut in the renderer (v0.1.7)\n");
+        return on;
+    }();
+
+    uint32_t LoadBig32(const uint8_t* host)
+    {
+        uint32_t v = __atomic_load_n(reinterpret_cast<const uint32_t*>(host), __ATOMIC_RELAXED);
+        return ByteSwap(v);
+    }
+}
+
+namespace game::split_screen
+{
+    bool Enabled()
+    {
+        return s_enabled;
+    }
+
+    bool GameSaysSplit()
+    {
+        if (!s_enabled || !g_memory.base)
+            return false;
+        const uint32_t db = LoadBig32(g_memory.base + kDatabasePointer);
+        if (!PlausibleObject(db))
+            return false;
+        const uint8_t players = __atomic_load_n(g_memory.base + db + kPlayersOffset, __ATOMIC_RELAXED);
+        if (players != 2)
+            return false;
+        return Decode(players, LoadBig32(g_memory.base + db + kFlagsOffset));
+    }
+}
diff --git a/runtime/game/split_screen.h b/runtime/game/split_screen.h
new file mode 100644
index 0000000..b707dcc
--- /dev/null
+++ b/runtime/game/split_screen.h
@@ -0,0 +1,62 @@
+// SpeedBreaker runtime. GPL-3.0-or-later (see COPYING).
+//
+// The Xbox 360 release's two-player split screen (Quick Race > Split Screen;
+// the PC release has none). The game does everything itself: the "Player 2
+// press START" screen, a car select and a HUD for each player, two views of
+// the world. The runtime has two jobs, both keyed to the game's own state:
+//   - hid/input.cpp shows the game a second controller (XInput user 1, and
+//     2-3 for more pads) only while the game is in split screen
+//     (hid/player_slots.h), so single player sees XInput user 0 alone, as
+//     before;
+//   - gpu/renderer.cpp cuts each untiled draw to its own view
+//     (gpu/split_views.h), so player 1's view can't draw over player 2's.
+//
+// The game's split-screen test, inline in 23 functions (front-end screens,
+// the in-game loader of Global\InGameSplitScreen.bun, the track streamer,
+// cutscenes, pause and post-race, audio streams): its FEDatabase object, a
+// pointer at 0x82A2C684, holds the number of players in byte 0 and flags in
+// the word at +300, bit 2 (& 4) = a quick race:
+//     lwz r7,300(rDB); rlwinm r6,r7,0,29,29; ...; lbz r5,0(rDB); cmplwi r5,2
+// (e.g. sub_823B2EF8). Quick Race's accept handler (sub_8255D328) writes 1
+// player for Quick Play and Custom Race, 2 for Split Screen, the moment it
+// is chosen: before "Player 2 press START".
+//
+// NFSMW_SPLIT_SCREEN=0: neither job (v0.1.7: one controller, and the
+// renderer's fallback to the whole target; the game then waits at "Player 2
+// press START").
+#pragma once
+#include <cstdint>
+
+namespace game::split_screen
+{
+    constexpr uint32_t kDatabasePointer = 0x82A2C684;  // FEDatabase*
+    constexpr uint32_t kPlayersOffset = 0;             // byte: number of players
+    constexpr uint32_t kFlagsOffset = 300;             // big-endian word
+    constexpr uint32_t kQuickRaceFlag = 4;
+
+    // The game's test, on the two fields.
+    constexpr bool Decode(uint8_t players, uint32_t flags)
+    {
+        return players == 2 && (flags & kQuickRaceFlag) != 0;
+    }
+
+    // Where a FEDatabase pointer may point: guest heap or image memory (the
+    // 4 KB and 64 KB virtual heaps, the image, the physical window). Anything
+    // else (0 before the front end starts) is no database: not split screen.
+    constexpr bool PlausibleObject(uint32_t address)
+    {
+        if (address & 3)
+            return false;  // an object's word at +300 is aligned
+        return (address >= 0x00010000u && address < 0x7F000000u - 512u) ||
+            (address >= 0x82000000u && address < 0x82CD0000u - 512u) ||
+            (address >= 0xA0000000u && address < 0xC0000000u - 512u);
+    }
+
+    // NFSMW_SPLIT_SCREEN != 0 (default on).
+    bool Enabled();
+
+    // The game's own predicate, read now from guest memory (any thread; two
+    // plain loads, racing the game's writes harmlessly). False when
+    // disabled, or before guest memory or the database exists.
+    bool GameSaysSplit();
+}
diff --git a/runtime/gpu/command_processor.cpp b/runtime/gpu/command_processor.cpp
index f72f7ca..aa7dcdd 100644
--- a/runtime/gpu/command_processor.cpp
+++ b/runtime/gpu/command_processor.cpp
@@ -1,6 +1,7 @@
 // SpeedBreaker runtime. GPL-3.0-or-later (see COPYING).
 // PM4 packet semantics follow Xenia (gpu/command_processor.cc, BSD license).
 #include <stdafx.h>
+#include <game/hfr.h>
 #include "command_processor.h"
 
 #include <kernel/vmem.h>
@@ -495,15 +496,43 @@ namespace gpu
                 r.Read();  // 'SWAP'
                 r.Read();  // front buffer (physical); also in the fetch constant
                 uint32_t width = r.Read(), height = r.Read();
-                r.Skip(count - 4);
+                // An in-between picture (game/hfr.h): 'HFRB' and its fraction of the
+                // step; a step drawn only between: 'HFRR' and its own picture's.
+                float between = 0.0f, shift = 0.0f;
+                int64_t target = 0;  // the refresh it is for, on a grid that isn't a multiple of 60 Hz
+                if (count >= 6)
+                {
+                    const uint32_t marker = r.Read(), bits = r.Read();
+                    float f = 0.0f;
+                    memcpy(&f, &bits, 4);
+                    if (marker == 0x48465242)
+                        between = f;
+                    else if (marker == 0x48465252 && f > 0.0f && f < 1.0f)
+                        shift = f - 1.0f;
+                    if (count >= 8)
+                    {
+                        const uint64_t hi = r.Read(), lo = r.Read();
+                        target = int64_t((hi << 32) | lo);
+                        r.Skip(count - 8);
+                    }
+                    else
+                        r.Skip(count - 6);
+                }
+                else
+                    r.Skip(count - 4);
                 // VdSwap wrote the front buffer's fetch constant into fetch slot 0.
                 // Presented from the GPU without waiting; frame dumps (and the
-                // headless case) take the CPU path, which needs the GPU idle.
+                // headless case) take the CPU path, which needs the GPU idle
+                // (and shows no in-between pictures).
                 static const bool dumping = std::getenv("NFSMW_DUMP_FRAMES") != nullptr;
-                if (dumping || !renderer::PresentFrontBuffer(&s_regs[0x4800], width, height))
+                hfr::NoteSwap(between);
+                if (dumping || !renderer::PresentFrontBuffer(&s_regs[0x4800], width, height, between, shift, target))
                 {
-                    renderer::Flush();
-                    video::SubmitFrontBuffer(&s_regs[0x4800], width, height);
+                    if (between == 0.0f)
+                    {
+                        renderer::Flush();
+                        video::SubmitFrontBuffer(&s_regs[0x4800], width, height);
+                    }
                 }
                 s_counter++;
                 timeline::Mark(timeline::Swap);
@@ -521,6 +550,40 @@ namespace gpu
                 static int64_t lastSwap = guesttime::NowNs();
                 static int64_t overlayTime = guesttime::NowNs();  // the last 30-swap mark
                 static double worstMs = 0;
+                // HFR (M3): this picture's own cost, in-between and real apart.
+                if (hfr::Enabled())
+                {
+                    static uint64_t pictureCpNs = 0, pictureDraws = 0, picturePasses = 0;
+                    AccountBusy();
+                    const uint64_t passes = renderer::GetStats().passes, draws = s_draws.load();
+                    if (pictureCpNs)
+                        hfr::NotePictureCost(between != 0.0f, double(renderer::g_cpBusyNs - pictureCpNs) / 1e6, draws - pictureDraws,
+                            passes - picturePasses);
+                    pictureCpNs = renderer::g_cpBusyNs;
+                    pictureDraws = draws;
+                    picturePasses = passes;
+                }
+                // HFR's load check (game/hfr.cpp): the command processor's
+                // and the GPU's time since the last real picture's swap.
+                {
+                    static uint64_t lastCpNs = 0, lastGpuUs = 0;
+                    static bool hadBetween = false;
+                    if (between != 0.0f)
+                        hadBetween = true;
+                    else
+                    {
+                        AccountBusy();
+                        const auto st = renderer::GetStats();
+                        const uint64_t gpuUs = st.gpuExecUs;  // execution only (0 without timestamps: the CP's time alone)
+                        if (lastCpNs)
+                            hfr::NoteFrameCost(double(renderer::g_cpBusyNs - lastCpNs) / 1e6, double(gpuUs - lastGpuUs) / 1e3, hadBetween);
+                        lastCpNs = renderer::g_cpBusyNs;
+                        lastGpuUs = gpuUs;
+                        hadBetween = false;
+                    }
+                }
+                // Game frames: an in-between picture's swap isn't one (its frame is the real picture's).
+                if (between == 0.0f)
                 {
                     AccountBusy();
                     int64_t swapNow = guesttime::NowNs();
diff --git a/runtime/gpu/covers.h b/runtime/gpu/covers.h
new file mode 100644
index 0000000..70b896c
--- /dev/null
+++ b/runtime/gpu/covers.h
@@ -0,0 +1,265 @@
+// SpeedBreaker runtime. GPL-3.0-or-later (see COPYING).
+//
+// Covers (NFSMW_LOG_COVERS=1, a diagnostic): find the draws and pictures
+// that leave a dark box, or a layer meant to cover the whole screen, short
+// of the picture's edges, so a play-through logs every such place once
+// instead of a player spotting each one. Vulkan-free: tests/covers_test.cpp
+// checks it alone.
+//
+// Two detectors share these rules:
+// - Draws (gpu/renderer.cpp, ClassifyQuad): each quad of a front-end draw
+//   (the front-end matrix, ePolys at fetch 95: every fade, dim, black frame,
+//   panel and backdrop of the menus, the loading screens and the in-game
+//   transitions), after the edge-bar and Vert+/Hor+ rules have moved it,
+//   as host pixels of the frame against the guest viewport the presenter
+//   shows. Logged once per draw site: the guest code that built the quad
+//   (game/cover_callers.h: the return addresses above the ePoly writer).
+// - Pictures (video/presenter.cpp, FindInsetBox): every presented picture,
+//   scaled down, for a dark box whose four edges all lie inside it with a
+//   lit border round it, or a dark layer across it lit above and below (or
+//   beside) it (whatever drew it: a movie, a target shown before it was
+//   drawn, a 2D quad).
+#pragma once
+
+#include <algorithm>
+#include <cmath>
+#include <cstdint>
+
+namespace gpu::covers
+{
+    // Host pixels, [x0, x1) x [y0, y1).
+    struct Rect
+    {
+        int32_t x0, y0, x1, y1;
+    };
+
+    inline int64_t Area(const Rect& r)
+    {
+        return r.x1 > r.x0 && r.y1 > r.y0 ? int64_t(r.x1 - r.x0) * (r.y1 - r.y0) : 0;
+    }
+
+    inline Rect Intersect(const Rect& a, const Rect& b)
+    {
+        return { std::max(a.x0, b.x0), std::max(a.y0, b.y0), std::min(a.x1, b.x1), std::min(a.y1, b.y1) };
+    }
+
+    enum class Kind : uint8_t
+    {
+        None,
+        InsetBox,     // dark, most of the picture, all four edges inside it
+        DarkShort,    // dark, most of the picture, one to three edges short of it
+        LayerShort,   // authored to cover the whole 16:9 frame (any colour), short of the picture's edges
+    };
+
+    inline const char* KindName(Kind k)
+    {
+        switch (k)
+        {
+        case Kind::InsetBox: return "a dark box inside the picture";
+        case Kind::DarkShort: return "a dark layer short of the picture's edges";
+        case Kind::LayerShort: return "a full-screen layer short of the picture's edges";
+        default: return "none";
+        }
+    }
+
+    struct Rule
+    {
+        uint32_t darkMax = 0x30;      // each of R, G, B (vertex colour times texel), 0..255
+        uint32_t spread = 0x18;       // the four vertices' colours within this of each other (near-uniform)
+        uint32_t visibleAlpha = 0x40; // the least vertex alpha that counts (alpha-blended draws)
+        float minShare = 0.5f;        // the quad's share of the picture's area (dark kinds)
+        float layerReach = 0.999f;    // band units each way a full-screen layer is authored to (|x| and |y|)
+        int32_t slack = 1;            // host pixels short of an edge that don't count
+    };
+
+    // One quad as the renderer sees it.
+    struct Quad
+    {
+        Rect host;            // its box in the target's host pixels, after every rule, clipped to the draw's scissor
+        Rect picture;         // the guest viewport in host pixels (what the presenter shows)
+        float band[4];        // its box in band units before the rules: x0, x1, y0, y1 (+-1: the 16:9 frame's edges)
+        uint32_t argb[4];     // vertex colours
+        uint32_t texel = 0xFFFFFFFFu;  // its texture's darkest sample (ARGB; white when untextured or the 32x32 white texture)
+        bool texelKnown = true;        // false: a texture it couldn't sample (its shape and colour unknown: never "dark")
+        bool blended = true;  // alpha blending on (else opaque)
+        bool filledOutside = false;  // an edge-bar fill draws or clears everything outside it opaque (black frames, backdrops)
+    };
+
+    struct Verdict
+    {
+        Kind kind = Kind::None;
+        int32_t shortBy[4] = {};  // left, top, right, bottom: host pixels the visible box stops short of the picture
+        float share = 0;          // its visible area / the picture's
+        uint32_t minAlpha = 0, maxRgb = 0;
+    };
+
+    inline uint32_t Channel(uint32_t argb, int k)
+    {
+        return (argb >> (k * 8)) & 0xFF;
+    }
+
+    inline Verdict ClassifyQuad(const Quad& q, const Rule& rule = {})
+    {
+        Verdict v;
+        const int64_t picture = Area(q.picture);
+        if (!picture)
+            return v;
+        const Rect seen = Intersect(q.host, q.picture);
+        v.share = float(double(Area(seen)) / double(picture));
+        if (!Area(seen))
+            return v;
+        v.minAlpha = 0xFF;
+        uint32_t lo[3] = { 255, 255, 255 }, hi[3] = { 0, 0, 0 };
+        for (const uint32_t c : q.argb)
+        {
+            if (q.blended)
+                v.minAlpha = std::min(v.minAlpha, c >> 24);
+            for (int k = 0; k < 3; k++)
+            {
+                // The front-end shader modulates: vertex colour times texel.
+                const uint32_t ch = Channel(c, k) * Channel(q.texel, k) / 255;
+                lo[k] = std::min(lo[k], ch);
+                hi[k] = std::max(hi[k], ch);
+            }
+        }
+        if (q.blended)
+            v.minAlpha = v.minAlpha * (q.texel >> 24) / 255;
+        v.maxRgb = std::max({ hi[0], hi[1], hi[2] });
+        v.shortBy[0] = seen.x0 - q.picture.x0;
+        v.shortBy[1] = seen.y0 - q.picture.y0;
+        v.shortBy[2] = q.picture.x1 - seen.x1;
+        v.shortBy[3] = q.picture.y1 - seen.y1;
+        int shortEdges = 0;
+        for (int32_t& s : v.shortBy)
+        {
+            if (s <= rule.slack)
+                s = 0;
+            shortEdges += s > 0;
+        }
+        if (!shortEdges || q.filledOutside || v.minAlpha < rule.visibleAlpha)
+            return v;
+        const bool uniform = hi[0] - lo[0] <= rule.spread && hi[1] - lo[1] <= rule.spread && hi[2] - lo[2] <= rule.spread;
+        const bool dark = q.texelKnown && uniform && v.maxRgb <= rule.darkMax;
+        if (dark && v.share >= rule.minShare)
+            v.kind = shortEdges == 4 ? Kind::InsetBox : Kind::DarkShort;
+        else if (-q.band[0] >= rule.layerReach && q.band[1] >= rule.layerReach && -q.band[2] >= rule.layerReach && q.band[3] >= rule.layerReach)
+            v.kind = Kind::LayerShort;
+        return v;
+    }
+
+    // A presented picture, scaled down: 8-bit luma rows.
+    struct Luma
+    {
+        const uint8_t* px;
+        int32_t w, h, stride;
+        uint8_t at(int32_t x, int32_t y) const { return px[size_t(y) * stride + x]; }
+    };
+
+    struct BoxRule
+    {
+        uint8_t darkMax = 12;         // luma of a dark pixel
+        float minShare = 0.25f;       // the box's share of the picture
+        float maxShare = 0.97f;       // larger: a black picture with a stray border row (not a box)
+        float insideDark = 0.995f;    // its interior's dark share
+        int32_t ring = 3;             // pixels of border sampled just outside each edge
+        float ringLit = 0.5f;         // the share of those that must be lit, on every side asked
+        int32_t margin = 2;           // an edge this close to the picture's touches it
+    };
+
+    enum class BoxKind : uint8_t
+    {
+        None,
+        Inset,  // all four edges inside the picture, lit all round
+        BandY,  // across the whole width, lit above and below it (a full-screen layer short of the top and bottom)
+        BandX,  // across the whole height, lit beside it
+    };
+
+    inline const char* BoxKindName(BoxKind k)
+    {
+        switch (k)
+        {
+        case BoxKind::Inset: return "a dark box inside the picture";
+        case BoxKind::BandY: return "a dark layer short of the picture's top and bottom";
+        case BoxKind::BandX: return "a dark layer short of the picture's sides";
+        default: return "none";
+        }
+    }
+
+    struct Box
+    {
+        bool found = false;
+        BoxKind kind = BoxKind::None;
+        Rect box{};
+        float share = 0;
+        float ringLit[4] = {};  // left, top, right, bottom (-1: on the picture's edge)
+    };
+
+    // A dark region around the picture's centre that stops short of the
+    // picture's edges with the picture lit just outside it: on all four sides
+    // (a box), or above and below it with its sides on the picture's (a band:
+    // a full-screen layer short of the top and bottom), or beside it (short
+    // of the sides). Grown from the centre along the middle row and column
+    // while dark, then checked: its interior dark, the lit border on every
+    // side that isn't the picture's edge.
+    inline Box FindInsetBox(const Luma& l, const BoxRule& rule = {})
+    {
+        Box b;
+        const int32_t cx = l.w / 2, cy = l.h / 2;
+        if (l.w < 16 || l.h < 16 || l.at(cx, cy) > rule.darkMax)
+            return b;
+        int32_t x0 = cx, x1 = cx, y0 = cy, y1 = cy;
+        while (x0 > 0 && l.at(x0 - 1, cy) <= rule.darkMax)
+            x0--;
+        while (x1 < l.w - 1 && l.at(x1 + 1, cy) <= rule.darkMax)
+            x1++;
+        while (y0 > 0 && l.at(cx, y0 - 1) <= rule.darkMax)
+            y0--;
+        while (y1 < l.h - 1 && l.at(cx, y1 + 1) <= rule.darkMax)
+            y1++;
+        b.box = { x0, y0, x1 + 1, y1 + 1 };
+        const bool onL = x0 < rule.margin, onR = x1 >= l.w - rule.margin, onT = y0 < rule.margin, onB = y1 >= l.h - rule.margin;
+        BoxKind kind = BoxKind::None;
+        if (!onL && !onR && !onT && !onB)
+            kind = BoxKind::Inset;
+        else if (onL && onR && !onT && !onB)
+            kind = BoxKind::BandY;
+        else if (onT && onB && !onL && !onR)
+            kind = BoxKind::BandX;
+        else
+            return b;
+        b.share = float(double(Area(b.box)) / (double(l.w) * l.h));
+        if (b.share < rule.minShare || b.share > rule.maxShare)
+            return b;
+        int64_t dark = 0, all = 0;
+        for (int32_t y = y0; y <= y1; y += 2)
+            for (int32_t x = x0; x <= x1; x += 2)
+            {
+                dark += l.at(x, y) <= rule.darkMax;
+                all++;
+            }
+        if (double(dark) < rule.insideDark * double(all))
+            return b;
+        // The ring just outside each edge, along that edge's middle 80%.
+        auto lit = [&](int32_t xa, int32_t xb, int32_t ya, int32_t yb) {
+            int64_t n = 0, on = 0;
+            for (int32_t y = std::max(ya, 0); y < std::min(yb, l.h); y++)
+                for (int32_t x = std::max(xa, 0); x < std::min(xb, l.w); x++)
+                {
+                    n++;
+                    on += l.at(x, y) > rule.darkMax;
+                }
+            return n ? float(double(on) / double(n)) : 0.0f;
+        };
+        const int32_t mx = (x1 - x0) / 10, my = (y1 - y0) / 10;
+        b.ringLit[0] = onL ? -1.0f : lit(x0 - rule.ring, x0, y0 + my, y1 - my);
+        b.ringLit[1] = onT ? -1.0f : lit(x0 + mx, x1 - mx, y0 - rule.ring, y0);
+        b.ringLit[2] = onR ? -1.0f : lit(x1 + 1, x1 + 1 + rule.ring, y0 + my, y1 - my);
+        b.ringLit[3] = onB ? -1.0f : lit(x0 + mx, x1 - mx, y1 + 1, y1 + 1 + rule.ring);
+        b.found = true;
+        for (const float r : b.ringLit)
+            if (r >= 0.0f && r < rule.ringLit)
+                b.found = false;
+        b.kind = b.found ? kind : BoxKind::None;
+        return b;
+    }
+}
diff --git a/runtime/gpu/edge_bars.h b/runtime/gpu/edge_bars.h
index 2fbfb9c..e673e6b 100644
--- a/runtime/gpu/edge_bars.h
+++ b/runtime/gpu/edge_bars.h
@@ -43,7 +43,9 @@
 // Two pictures the front end draws just short of the 16:9 frame's edges
 // get the screen's edges instead, on every screen shape: around the results
 // screen's backdrop the rows are cleared to black (PlanBackdrop), and the
-// Showcase's vignette is stretched to the screen's edges (PlanVignette).
+// Showcase's vignette is stretched to the screen's edges (PlanVignette); so
+// is a flat full-screen layer that stops short of them (the fade to black
+// before a load: PlanLayer).
 //
 // Units: the frame's clip space after the front-end matrix (w = 1), and
 // "band units" = clip / view scale (x / scaleX, y / scaleY): +-1 are the
@@ -509,14 +511,14 @@ namespace gpu::bars
         Rect scissor{};               // the draw's scissor (host pixels)
     };
 
-    enum class Fill : uint8_t { None, LeftBar, RightBar, Blackout, Backdrop, Vignette };
+    enum class Fill : uint8_t { None, LeftBar, RightBar, Blackout, Backdrop, Vignette, Layer };
 
     // What to draw after the draw: for a bar or a black frame, `rectCount`
     // more copies of it (none for a bar that reaches the screen edge), with
     // `posScale` and each rectangle as the scissor; for a backdrop, each
     // rectangle cleared to opaque black (its picture must not be copied);
-    // for a vignette, nothing after it: the draw itself is drawn with
-    // `posScale` instead of its own (no rectangles).
+    // for a vignette or a layer, nothing after it: the draw itself is drawn
+    // with `posScale` instead of its own (no rectangles).
     struct Plan
     {
         Fill fill = Fill::None;
@@ -730,6 +732,100 @@ namespace gpu::bars
         return p;
     }
 
+    // A full-screen layer short of the screen's edges: the fade to black
+    // before a load (FB000000 at its darkest, x +-1.121 and y +-0.972 of the
+    // 16:9 band: the career's EndingNis03 into the storyfmv_pin11 movie, the
+    // last prologue race's, and the loads round the career's races) and the
+    // dim over the loading screen (B8000000, x +-1.104, y -0.978..0.985):
+    // one front-end quad of one colour (any alpha: it fades), over the game's
+    // 32x32 white texture, centred in the band and covering 95% of it or more
+    // each way, but short of the screen's edge in x or y. On a 16:9 screen a
+    // thin strip of the scene shows at its top and bottom (10 rows of 720;
+    // a 360's own output has it, a period TV's overscan hid it); under Vert+
+    // the scene rendered above and below the band shows too (6.4% of a
+    // MacBook's height at each end, a black box over the middle of the
+    // picture for the fade's ~1.5 s), under Hor+ beside it (x +-1.121 of the
+    // band ends 17% short of a 21:9 screen's sides). None of the other rules
+    // takes it: the widen rule wants +-1.2 of the band (the fades and dims at
+    // +-1.29), the black frame rule 0.90..0.99 (and alpha F0 or more), the
+    // cover rule both band edges. The quad is stretched to the screen's
+    // edges (its box to +-kFillEdge: CoverFrame), on every screen shape, 16:9
+    // too (the period TV's look, as the results screen's overscan rows and
+    // the Showcase's vignette). It is flat, so nothing is distorted. The
+    // nearest draws it must not take: the intro's black frames (x +-0.970:
+    // the black frame rule's), the Blacklist bio's panel (0.976 x 0.985, the
+    // black frame rule's once opaque; during its fade-in this takes it, so
+    // its border no longer shows then either), the title's key art and the
+    // results picture (x +-1.104 but textured), the vid cam's overlays (x
+    // +-0.70) and dialog boxes (x +-0.58), the pause dim's side gradients
+    // (alpha varying across them), and any layer already past the screen's
+    // edges (nothing short to stretch).
+    struct LayerRule
+    {
+        float centreMax = 0.01f;       // |the box's centre|, each axis, band units
+        float extentMin = 0.95f;       // half its width and half its height, band units
+        float shortMin = 1e-3f;        // band units short of the screen's edge (1/scale) that count
+        float cornerTolerance = 1e-3f;  // clip units, as Rule's
+    };
+
+    inline bool MatchLayer(const Vertex v[4], float scaleX, float scaleY, const LayerRule& rule = {}, Box* box = nullptr)
+    {
+        if (!(scaleX > 0.0f && scaleY > 0.0f))
+            return false;
+        for (int i = 1; i < 4; i++)
+            if (v[i].argb != v[0].argb)
+                return false;
+        Box b;
+        if (!RectangleBox(v, rule.cornerTolerance, b))
+            return false;
+        const float midX = (b.x0 + b.x1) * 0.5f / scaleX, midY = (b.y0 + b.y1) * 0.5f / scaleY;
+        const float halfX = (b.x1 - b.x0) * 0.5f / scaleX, halfY = (b.y1 - b.y0) * 0.5f / scaleY;
+        if (!(std::fabs(midX) <= rule.centreMax && std::fabs(midY) <= rule.centreMax))
+            return false;
+        if (!(halfX >= rule.extentMin && halfY >= rule.extentMin))
+            return false;
+        // Its nearer reach in each axis against the screen's edge (clip 1 =
+        // 1/scale band units).
+        const float reachX = std::min(-b.x0, b.x1), reachY = std::min(-b.y0, b.y1);
+        if (!(reachX < 1.0f - rule.shortMin * scaleX || reachY < 1.0f - rule.shortMin * scaleY))
+            return false;
+        if (box)
+            *box = b;
+        return true;
+    }
+
+    // The plan for a layer: the draw's posScale stretched so its box reaches
+    // past every screen edge (CoverFrame), no rectangles. Candidate's
+    // register checks (one quad, the front-end shader, left alone by the
+    // other rules, alpha-blended or opaque, over the 32x32 white texture).
+    template <class ReadWord>
+    Plan PlanLayer(const Draw& d, ReadWord&& read, const LayerRule& rule = {})
+    {
+        Plan p;
+        if (!Candidate(d))
+            return p;
+        const float* c = d.c;
+        Vertex v[4];
+        for (uint32_t k = 0; k < 4; k++)
+        {
+            uint32_t w[4];
+            for (uint32_t j = 0; j < 4; j++)
+                if (!read(k, j, w[j]))
+                    return p;
+            float q[3];
+            std::memcpy(q, w, sizeof(q));
+            v[k] = { q[0] * c[0] + q[1] * c[1] + q[2] * c[2] + c[3], q[0] * c[4] + q[1] * c[5] + q[2] * c[6] + c[7], w[3] };
+        }
+        Box box{};
+        if (!MatchLayer(v, d.scaleX, d.scaleY, rule, &box))
+            return p;
+        p.fill = Fill::Layer;
+        p.box = box;
+        p.argb = v[0].argb;
+        CoverFrame(box, d.posScale, p.posScale);
+        return p;
+    }
+
     // The plan for a draw. read(k, j, word): word j of the draw's vertex k
     // (k 0..3 in draw order, through its indices; an ePoly's words 0..3 are
     // x, y, z and the colour), false past the vertex buffer. Register checks
diff --git a/runtime/gpu/imports_video.cpp b/runtime/gpu/imports_video.cpp
index 3e48051..f93a449 100644
--- a/runtime/gpu/imports_video.cpp
+++ b/runtime/gpu/imports_video.cpp
@@ -7,6 +7,7 @@
 #include <stdafx.h>
 #include <kernel/function.h>
 #include <kernel/vmem.h>
+#include <game/hfr.h>
 #include <report/report.h>
 #include "command_processor.h"
 
@@ -131,11 +132,34 @@ void VdSwap(be<uint32_t>* buffer, be<uint32_t>* fetch, void* unk2, void* unk3, v
     buffer[o++] = (0u << 30) | ((6 - 1) << 16) | 0x4800;  // type 0: SHADER_CONSTANT_FETCH_00_0, 6 regs
     for (int i = 0; i < 6; i++)
         buffer[o++] = words[i];
-    buffer[o++] = (3u << 30) | ((4 - 1) << 16) | (0x64 << 8);  // type 3: XE_SWAP, 4 dwords
+    // An in-between picture (game/hfr.h) carries 'HFRB' and its fraction of
+    // the step: the presenter shows it at its share of the vblank before the
+    // real picture.
+    // A step drawn only between (hfr::OwnFraction) carries 'HFRR' and its own
+    // picture's fraction: shown that much of a vblank before a real one.
+    const bool between = hfr::InBetween();
+    const float own = between ? 0.0f : hfr::OwnFraction();
+    // On a grid that isn't a multiple of 60 Hz, also the refresh it is for.
+    const int64_t target = hfr::PictureTarget();
+    const uint32_t count = target ? 8 : between || own > 0.0f ? 6 : 4;
+    buffer[o++] = (3u << 30) | ((count - 1) << 16) | (0x64 << 8);  // type 3: XE_SWAP
     buffer[o++] = 0x53574150;  // 'SWAP'
     buffer[o++] = frontPhysical;
     buffer[o++] = *width;
     buffer[o++] = *height;
+    if (between || own > 0.0f || target)
+    {
+        const float t = between ? hfr::InBetweenFraction() : own > 0.0f ? own : 1.0f;
+        uint32_t bits;
+        memcpy(&bits, &t, 4);
+        buffer[o++] = between ? 0x48465242 : 0x48465252;  // 'HFRB', 'HFRR'
+        buffer[o++] = bits;
+        if (target)
+        {
+            buffer[o++] = uint32_t(uint64_t(target) >> 32);
+            buffer[o++] = uint32_t(uint64_t(target));
+        }
+    }
     while (o < 64)
         buffer[o++] = 2u << 30;  // type-2 filler
 }
diff --git a/runtime/gpu/renderer.cpp b/runtime/gpu/renderer.cpp
index d89fc24..5c65037 100644
--- a/runtime/gpu/renderer.cpp
+++ b/runtime/gpu/renderer.cpp
@@ -9,6 +9,7 @@
 #include <debug/timeline.h>
 #include <unordered_set>
 #include "block_ranges.h"
+#include "covers.h"
 #include "edge_bars.h"
 #include "memory_plan.h"
 #include "pipeline_cache_header.h"
@@ -18,6 +19,7 @@
 #include "depth_only.h"
 #include "render_scale.h"
 #include "shared_memory_glsl.h"
+#include "split_views.h"
 #include "xenos/registers.h"
 
 #include <kernel/vmem.h>
@@ -25,8 +27,11 @@
 #include <video/presenter.h>
 #include <video/picture_fit.h>
 #include <video/scale_budget.h>
+#include <game/hfr.h>
 #include <user/paths.h>
 #include <user/settings.h>
+#include <game/cover_callers.h>
+#include <game/split_screen.h>
 #include <game/ultrawide.h>
 
 #include <glslang/Include/glslang_c_interface.h>
@@ -1425,6 +1430,44 @@ namespace gpu::renderer
             const std::string& preamble);
         std::atomic<uint64_t> s_shaderCacheHits{ 0 };
 
+        // HFR M3: large vertex ranges narrowed to a draw's vertices (see the
+        // draw's guard loop). NFSMW_NARROW_VERTICES=1/0; on by default with
+        // Smooth Motion (game/hfr.h), where the guard stalled on them.
+        bool NarrowVerticesOn()
+        {
+            static const bool on = [] {
+                const char* v = std::getenv("NFSMW_NARROW_VERTICES");
+                const bool r = v ? v[0] == '1' : hfr::Enabled();
+                if (r)
+                    fprintf(stderr, "[renderer] large dynamic vertex buffers copied or guarded as each draw's vertices only\n");
+                return r;
+            }();
+            return on;
+        }
+        // A large vertex range the CPU has written since a draw last read it
+        // (a dynamic buffer; once seen, kept): a small cache by base address.
+        bool DynamicVertexRange(uint32_t base, uint32_t size)
+        {
+            struct Entry
+            {
+                uint32_t base = 0, size = 0;
+                uint64_t seen = 0;
+                bool dynamic = false;
+            };
+            static Entry cache[256];
+            Entry& e = cache[(base >> 12) & 255];
+            const uint64_t now = writewatch::Current();
+            if (e.base != base || e.size != size)
+            {
+                e = { base, size, now, false };
+                return false;
+            }
+            if (!e.dynamic && writewatch::WrittenSince(base, size, e.seen))
+                e.dynamic = true;
+            e.seen = now;
+            return e.dynamic;
+        }
+
         std::vector<uint32_t> CompileGlsl(const std::string& source, glslang_stage_t stage, std::string& log,
             const std::string& shaderPreamble = {})
         {
@@ -1891,6 +1934,18 @@ namespace gpu::renderer
             // at 2x2), 9 on a Mac with an M3 or later Max or Ultra, and on an
             // iPhone or iPad the chip's (video/scale_budget: 1 on every chip
             // measured so far).
+            // HFR (game/hfr.h, NFSMW_HFR=1): two pictures a step, so half
+            // the budget, and the same scale both ways (a 1x2 picture is
+            // half as sharp across: M1 Pro at 2x2 under HFR drew 64-102 fps,
+            // and 5.3-8.2 ms of GPU a picture at 1x, near its 8.3 ms).
+            // Only where the screen can show them (video::HfrOffered: Smooth
+            // Motion on, a 60 Hz screen draws none).
+            if (hfr::Enabled() && video::HfrOffered())
+            {
+                video::AutoRenderScale(regionW, regionH, std::max(1u, s_scaleBudget / 2), sx, sy);
+                sx = sy = std::min(sx, sy);
+                return gpu::RenderScale::Whole(sx, sy);
+            }
             video::AutoRenderScale(regionW, regionH, s_scaleBudget, sx, sy);
             return gpu::RenderScale::Whole(sx, sy);
         }
@@ -1901,7 +1956,7 @@ namespace gpu::renderer
                 return "NFSMW_RENDER_SCALE";
             if (setting > 0)
                 return "setting";
-            return std::format("auto for a {}x{} picture", regionW, regionH);
+            return std::format("auto for a {}x{} picture{}", regionW, regionH, hfr::Enabled() && video::HfrOffered() ? ", half the budget for Smooth Motion's two pictures a step" : "");
         }
 
         void ReadRenderScale(const VkPhysicalDeviceProperties& props)
@@ -2843,6 +2898,24 @@ namespace gpu::renderer
             return s_untiledArea == 1 || (s_untiledArea == 2 && s_frame / 120 % 2 == 1);
         }
 
+        // Whether the game is in split screen (game/split_screen.h), read
+        // once a frame; its split-screen rules: gpu/split_views.h. CP thread.
+        bool SplitFrame()
+        {
+            static uint64_t frame = ~0ull;
+            static bool split = false;
+            if (frame != s_frame)
+            {
+                frame = s_frame;
+                const bool now = game::split_screen::GameSaysSplit();
+                if (now != split)
+                    fprintf(stderr, "[renderer] split screen %s at frame %llu%s\n", now ? "on" : "off", (unsigned long long)s_frame,
+                        now ? ": untiled draws are cut to their own view, a second view restarts its pass" : "");
+                split = now;
+            }
+            return split;
+        }
+
         // Where an untiled draw into `targets` (4 colour, then depth; any
         // null) may draw, in guest pixels of their common w x h (the caller
         // clamps to it): tile 0 draws the whole frame, so the whole target.
@@ -2856,11 +2929,14 @@ namespace gpu::renderer
         // 8192x8192). `why`: 0 cut to the viewport, 1 clipping off, 2 no
         // viewport transform (or garbage in it), 3 a target that fell back
         // to the whole target (wholeArea), 4 off.
+        // In split screen (gpu/split_views.h) every untiled draw is cut, and
+        // a fallback to the whole target doesn't hold.
         Rect UntiledScissor(RenderTarget* const targets[5], int32_t w, int32_t h, int* why = nullptr)
         {
             Rect r{ 0, 0, w, h };
             int reason = 4;
-            if (UntiledAreaOn())
+            const bool split = SplitFrame();
+            if (gpu::split_views::CutOn(UntiledAreaOn(), split))
             {
                 float ax = std::fabs(RegF(XE_GPU_REG_PA_CL_VPORT_XSCALE)), ox = RegF(XE_GPU_REG_PA_CL_VPORT_XOFFSET);
                 float ay = std::fabs(RegF(XE_GPU_REG_PA_CL_VPORT_YSCALE)), oy = RegF(XE_GPU_REG_PA_CL_VPORT_YOFFSET);
@@ -2868,7 +2944,7 @@ namespace gpu::renderer
                     reason = 1;
                 else if ((Reg<reg::PA_CL_VTE_CNTL>().value & 0xF) != 0xF || !std::isfinite(ax + ox + ay + oy))
                     reason = 2;
-                else if (std::any_of(targets, targets + 5, [](RenderTarget* rt) { return rt && rt->wholeArea; }))
+                else if (std::any_of(targets, targets + 5, [&](RenderTarget* rt) { return rt && gpu::split_views::KeepsWholeArea(rt->wholeArea, split); }))
                     reason = 3;
                 else
                     reason = 0;
@@ -2876,19 +2952,16 @@ namespace gpu::renderer
                 {
                     // As the host viewport: the window offset (0 for tile 0)
                     // and D3D's integer pixel centres. |scale|: y is flipped.
+                    float wx = 0.0f, wy = 0.0f;
                     if (Reg<reg::PA_SU_SC_MODE_CNTL>().vtx_window_offset_enable)
                     {
                         auto wo = Reg<reg::PA_SC_WINDOW_OFFSET>();
-                        ox += float(wo.window_x_offset);
-                        oy += float(wo.window_y_offset);
+                        wx = float(wo.window_x_offset);
+                        wy = float(wo.window_y_offset);
                     }
-                    if (Reg<reg::PA_SU_VTX_CNTL>().pix_center == xenos::PixelCenter::kD3DZero)
-                    {
-                        ox += 0.5f;
-                        oy += 0.5f;
-                    }
-                    auto edge = [](float v, int32_t hi) { return int32_t(std::fmax(0.0f, std::fmin(std::ceil(v - 0.5f), float(hi)))); };
-                    r = { edge(ox - ax, w), edge(oy - ay, h), edge(ox + ax, w), edge(oy + ay, h) };
+                    const bool d3dCenter = Reg<reg::PA_SU_VTX_CNTL>().pix_center == xenos::PixelCenter::kD3DZero;
+                    const gpu::split_views::GuestRect v = gpu::split_views::ViewportPixels(ax, ox, ay, oy, wx, wy, d3dCenter, w, h);
+                    r = { v.x0, v.y0, v.x1, v.y1 };
                 }
             }
             if (why)
@@ -2921,6 +2994,162 @@ namespace gpu::renderer
             }
         };
 
+        // NFSMW_LOG_COVERS=1 (gpu/covers.h, game/cover_callers.h): the
+        // current draw's quads, if it is a front-end draw (the front-end
+        // matrix in c0..c3 as the hook left it, ePolys at fetch 95 read by
+        // its vertex shader), as host pixels of its target after every rule
+        // (`posScale`, `scissor`), against its guest viewport in host pixels:
+        // ClassifyQuad's kinds, logged once per site.
+        std::atomic<uint64_t> s_coverHits{ 0 };
+        void LogCovers(uint32_t count, uint32_t prim, const IndexSource& src, const float posScale[4], const VkRect2D& scissor,
+            float hostW, float hostH, float fx, float fy, const gpu::bars::Plan& plan)
+        {
+            const float feX = game::FrontEndScaleX();
+            if (feX <= 0.0f || prim != 13 || count == 0 || count > 256 || count % 4)
+                return;
+            float c[8];
+            memcpy(c, &s_regs[XE_GPU_REG_SHADER_CONSTANT_000_X], sizeof(c));
+            const uint32_t* vf = &s_regs[XE_GPU_REG_SHADER_CONSTANT_FETCH_00_0 + 95 * 2];
+            if (!(std::fabs(c[0] - feX) <= feX * 1e-5f && c[1] == 0.0f && c[2] == 0.0f && (vf[0] & 3) == 3))
+                return;
+            const auto& vi = s_vs->info;
+            if (!(((vi.vertexFetchConstants[95 / 32] >> (95 % 32)) & 1) && (vi.constRelative || (vi.constUsed[0] & 0xFull) == 0xFull)))
+                return;
+            const float s = game::AspectScaleX(), sv = game::AspectScaleY();
+            const float bandMidX = c[3] * (1.0f - s), bandMidY = c[7] * (1.0f - sv);
+            // The guest viewport (what the presenter shows of this target), in
+            // host pixels, from the raw registers.
+            const float vsx = std::fabs(RegF(XE_GPU_REG_PA_CL_VPORT_XSCALE)), vox = RegF(XE_GPU_REG_PA_CL_VPORT_XOFFSET);
+            const float vsy = std::fabs(RegF(XE_GPU_REG_PA_CL_VPORT_YSCALE)), voy = RegF(XE_GPU_REG_PA_CL_VPORT_YOFFSET);
+            gpu::covers::Rect picture{ int32_t(std::lround((vox - vsx) * fx)), int32_t(std::lround((voy - vsy) * fy)),
+                int32_t(std::lround((vox + vsx) * fx)), int32_t(std::lround((voy + vsy) * fy)) };
+            picture = gpu::covers::Intersect(picture, { 0, 0, int32_t(hostW), int32_t(hostH) });
+            const gpu::covers::Rect sc{ scissor.offset.x, scissor.offset.y, scissor.offset.x + int32_t(scissor.extent.width),
+                scissor.offset.y + int32_t(scissor.extent.height) };
+            const uint32_t base = vf[0] & 0x1FFFFFFC, endian = vf[1] & 3;
+            const uint32_t words = (vf[1] >> 2) & 0xFFFFFF, first = s_regs[XE_GPU_REG_VGT_INDX_OFFSET];
+            const uint32_t blend0 = s_regs[XE_GPU_REG_RB_BLENDCONTROL0] & 0x1FFF1FFF;
+            // Blending on unless the colour's factors are one and zero
+            // (RB_BLENDCONTROL bits 0-4 and 8-12; 07060706: source alpha and
+            // one minus it, the front end's usual).
+            const bool blended = !((blend0 & 0x1F) == 1 && ((blend0 >> 8) & 0x1F) == 0);
+            xenos::xe_gpu_texture_fetch_t t0;
+            memcpy(&t0, &s_regs[XE_GPU_REG_SHADER_CONSTANT_FETCH_00_0], sizeof(t0));
+            const bool t0Sampled = (s_ps->info.texture2DMask & 1) != 0;
+            const uint32_t t0W = uint32_t(t0.size_2d.width) + 1, t0H = uint32_t(t0.size_2d.height) + 1;
+            // Its darkest texel of five (the centre and halfway to each corner),
+            // for a 32-bit t0 (format 6); white for the game's 32x32 white
+            // texture's size and anything unread.
+            uint32_t texel = 0xFFFFFFFFu;
+            const bool texelKnown = !t0Sampled || (t0W <= 32 && t0H <= 32) || uint32_t(t0.format) == 6;
+            if (t0Sampled && uint32_t(t0.format) == 6 && (t0W > 32 || t0H > 32))
+            {
+                const uint32_t t0Base = (uint32_t(t0.base_address) << 12) & 0x1FFFFFFFu, t0Pitch = uint32_t(t0.pitch) << 5;
+                uint32_t darkest = 0xFFFFFFFFu, darkestSum = 3 * 255 + 1;
+                const uint32_t at[5][2] = { { t0W / 2, t0H / 2 }, { t0W / 4, t0H / 4 }, { 3 * t0W / 4, t0H / 4 }, { t0W / 4, 3 * t0H / 4 },
+                    { 3 * t0W / 4, 3 * t0H / 4 } };
+                for (const auto& p : at)
+                    if (t0Pitch && p[0] < t0Pitch)
+                    {
+                        // k_8_8_8_8 as the front end's textures are stored: A in the top byte after the swap.
+                        const bool tiled = t0.tiled;
+                        const uint32_t texEndian = static_cast<uint32_t>(t0.endianness);
+                        const uint32_t w32 = GpuSwap(LoadPhysical(t0Base + gpu::bars::TexelOffset32(p[0], p[1], t0Pitch, tiled)), texEndian);
+                        const uint32_t sum = ((w32 >> 16) & 0xFF) + ((w32 >> 8) & 0xFF) + (w32 & 0xFF);
+                        if (sum < darkestSum)
+                        {
+                            darkestSum = sum;
+                            darkest = w32;
+                        }
+                    }
+                texel = darkest;
+            }
+            const bool filledOutside = plan.rectCount > 0 && (plan.fill == gpu::bars::Fill::Blackout || plan.fill == gpu::bars::Fill::Backdrop);
+            for (uint32_t v0 = 0; v0 < count; v0 += 4)
+            {
+                gpu::covers::Quad q;
+                float x0 = 1e30f, x1 = -1e30f, y0 = 1e30f, y1 = -1e30f;
+                bool valid = true;
+                for (uint32_t k = 0; k < 4 && valid; k++)
+                {
+                    const uint32_t v = src.Get(v0 + k) + first;
+                    if ((v + 1) * 8 > words)
+                    {
+                        valid = false;
+                        break;
+                    }
+                    float p[3];
+                    for (uint32_t j = 0; j < 3; j++)
+                    {
+                        const uint32_t b = GpuSwap(LoadPhysical(base + (v * 8 + j) * 4), endian);
+                        memcpy(&p[j], &b, 4);
+                    }
+                    const float x = p[0] * c[0] + p[1] * c[1] + p[2] * c[2] + c[3];
+                    const float y = p[0] * c[4] + p[1] * c[5] + p[2] * c[6] + c[7];
+                    x0 = std::min(x0, x);
+                    x1 = std::max(x1, x);
+                    y0 = std::min(y0, y);
+                    y1 = std::max(y1, y);
+                    q.argb[k] = GpuSwap(LoadPhysical(base + (v * 8 + 3) * 4), endian);
+                }
+                if (!valid)
+                    break;
+                const gpu::bars::Rect host = gpu::bars::ClipToHost(x0, x1, y0, y1, posScale, hostW, hostH);
+                q.host = gpu::covers::Intersect({ host.x0, host.y0, host.x1, host.y1 }, sc);
+                q.picture = picture;
+                q.band[0] = (x0 - bandMidX) / s;
+                q.band[1] = (x1 - bandMidX) / s;
+                q.band[2] = (y0 - bandMidY) / sv;
+                q.band[3] = (y1 - bandMidY) / sv;
+                q.texel = t0Sampled ? texel : 0xFFFFFFFFu;
+                q.texelKnown = texelKnown;
+                q.blended = blended;
+                q.filledOutside = filledOutside;
+                const gpu::covers::Verdict verdict = gpu::covers::ClassifyQuad(q);
+                if (verdict.kind == gpu::covers::Kind::None)
+                    continue;
+                game::covers::Chain chain;
+                uint32_t quadWords[16];
+                bool readable = true;
+                for (uint32_t k = 0; k < 4 && readable; k++)
+                {
+                    const uint32_t v = src.Get(v0 + k) + first;
+                    readable = (v + 1) * 8 <= words;
+                    for (uint32_t j = 0; j < 4 && readable; j++)
+                        quadWords[k * 4 + j] = GpuSwap(LoadPhysical(base + (v * 8 + j) * 4), endian);
+                }
+                const bool known = readable && game::covers::CallerOf(game::covers::QuadKey(quadWords), chain);
+                // Once per site, kind, extent (to 1% of the picture), opacity.
+                const float pw = float(std::max(picture.x1 - picture.x0, 1)), ph = float(std::max(picture.y1 - picture.y0, 1));
+                uint64_t key = uint64_t(verdict.kind) | (uint64_t(verdict.minAlpha >= 0xF0) << 3);
+                for (uint32_t i = 0; i < chain.n; i++)
+                    key = key * 1000003ull ^ chain.lr[i];
+                for (const int32_t e : verdict.shortBy)
+                    key = key * 131ull + uint64_t(std::lround(float(e) / std::min(pw, ph) * 100.0f));
+                key = key * 131ull + uint64_t(std::lround(s * 1000.0f)) * 7 + uint64_t(std::lround(sv * 1000.0f));
+                static std::unordered_set<uint64_t> logged;
+                if (logged.size() >= 512 || !logged.insert(key).second)
+                    continue;
+                s_coverHits.fetch_add(1, std::memory_order_relaxed);
+                fprintf(stderr,
+                    "[covers] %s: frame %llu caller %s; host [%d,%d)x[%d,%d) of the picture [%d,%d)x[%d,%d) (%.0f%% of it; short by "
+                    "left %d top %d right %d bottom %d px), band x %.3f..%.3f y %.3f..%.3f, view scale x %.4f y %.4f; colour %08X %08X %08X "
+                    "%08X (max RGB %02X, alpha %02X) blend %08X t0 %s; edge-bar rules: %s; vs_%016llx ps_%016llx n%u quad %u\n",
+                    gpu::covers::KindName(verdict.kind), (unsigned long long)s_frame, known ? game::covers::Describe(chain).c_str()
+                          : std::format("unknown (key {:016X}, {} quads noted)", readable ? game::covers::QuadKey(quadWords) : 0ull,
+                                game::covers::Noted()).c_str(),
+                    q.host.x0, q.host.x1, q.host.y0, q.host.y1, picture.x0, picture.x1, picture.y0, picture.y1, verdict.share * 100.0f,
+                    verdict.shortBy[0], verdict.shortBy[1], verdict.shortBy[2], verdict.shortBy[3], q.band[0], q.band[1], q.band[2], q.band[3], s,
+                    sv, q.argb[0], q.argb[1], q.argb[2], q.argb[3], verdict.maxRgb, verdict.minAlpha, blend0,
+                    t0Sampled ? std::format("{:08X} {}x{} f{} darkest {:08X}", (uint32_t(t0.base_address) << 12) & 0x1FFFFFFFu, t0W, t0H,
+                                    uint32_t(t0.format), texel).c_str()
+                              : "-",
+                    plan.fill == gpu::bars::Fill::None ? "none" : plan.rectCount ? "filled"
+                        : plan.fill == gpu::bars::Fill::Vignette || plan.fill == gpu::bars::Fill::Layer ? "stretched" : "matched, nothing to fill",
+                    (unsigned long long)s_vs->hash, (unsigned long long)s_ps->hash, count, v0 / 4);
+            }
+        }
+
         // Get() for a whole draw, written straight into the ring: `out16`
         // keeps 16-bit indices (the pipeline's restart index is then 0xFFFF,
         // so only when restart is off or the guest's reset index is 0xFFFF);
@@ -5193,7 +5422,7 @@ void main()
                     // frame. Blind: a cut inside another (their union is the
                     // larger). Needless (costing only the saving): a band only
                     // a clear covered, a target drawn since by non-untiled draws.
-                    if (s_untiledArea && source->cut && !source->wholeArea)
+                    if (s_untiledArea && source->cut && !source->wholeArea && gpu::split_views::FallsBack(SplitFrame()))
                     {
                         auto [shiftX, shiftY] = TileShift();
                         int32_t x0 = source->scale.x.EdgeAt(r.x0 + shiftX);
@@ -6027,6 +6256,10 @@ void main()
         // switches between them, e.g. around movies).
         Image s_front, s_frontScaled;
         uint32_t s_frontWidth = 0, s_frontHeight = 0, s_frontScaledWidth = 0, s_frontScaledHeight = 0;
+        // The same for in-between pictures (game/hfr.h), so the real picture
+        // right after one doesn't overwrite it before the presenter has read it.
+        Image s_frontBetween, s_frontBetweenScaled;
+        uint32_t s_frontBetweenWidth = 0, s_frontBetweenHeight = 0, s_frontBetweenScaledWidth = 0, s_frontBetweenScaledHeight = 0;
 
         // A front image the presenter may still show or be reading: taken
         // back from it, then destroyed once the queue is idle.
@@ -6855,7 +7088,10 @@ void main()
             VkQueryPoolCreateInfo qpci{ VK_STRUCTURE_TYPE_QUERY_POOL_CREATE_INFO };
             qpci.queryType = VK_QUERY_TYPE_TIMESTAMP;
             qpci.queryCount = kSlots * 2;
-            if (const char* v = std::getenv("NFSMW_GPU_TIMING"); v && v[0] == '1')
+            // HFR (game/hfr.h) needs the GPU's execution time for its load
+            // check: the busy time (submit to seen done) counts the queue's
+            // waits too, and read 9-12 ms a frame where execution took 5-8.
+            if (const char* v = std::getenv("NFSMW_GPU_TIMING"); (v && v[0] == '1') || (!(v && v[0] == '0') && hfr::Enabled()))
                 if (vkCreateQueryPool(s_dev, &qpci, nullptr, &s_timestamps) != VK_SUCCESS)
                     s_timestamps = VK_NULL_HANDLE;
             if (s_profileFrame >= 0)
@@ -6934,6 +7170,11 @@ void main()
         return true;
     }
 
+    uint64_t CoverHits()
+    {
+        return s_coverHits.load(std::memory_order_relaxed);
+    }
+
     bool Enabled()
     {
         return s_vk != nullptr;
@@ -7005,6 +7246,214 @@ void main()
         (type == 0 ? s_vs : s_ps) = slot.get();
     }
 
+    // DIAG (v0.1.5 HFR scoping): NFSMW_HFR_DRAWMATCH=<from s>,<frames>. For <frames> consecutive frames from <from s>
+    // after launch, each draw's identity (shaders, primitive type and count, render/depth target, textures) and hashes
+    // of the float constants its shaders read; at each swap one [drawmatch] line compares the frame with the one before:
+    // draws whose identity is unique in both frames, repeated identities (matched in order), and identities the
+    // previous frame lacks; for the matched draws, how many kept their constants, and how many read a vertex buffer at
+    // another address (dynamic vertex data: particles, text).
+    namespace
+    {
+        struct HfrConst { uint16_t index; uint32_t v[4]; };
+        struct HfrDraw { uint64_t key, vsc, psc, vb; bool rel; std::vector<HfrConst> vs; };
+        // The first draw of the frame that reads VS c26 (the per-render toggle the study found): its shader and value.
+        struct HfrC26 { bool seen = false; uint64_t vs = 0; float v[4] = {}; };
+        HfrC26 s_hfrC26;
+        struct HfrDrawMatch
+        {
+            double fromS = -1;
+            uint32_t frames = 0, done = 0;
+            bool active = false;
+            std::vector<HfrDraw> cur, prev;
+            std::chrono::steady_clock::time_point t0 = std::chrono::steady_clock::now();
+            HfrDrawMatch()
+            {
+                if (const char* v = std::getenv("NFSMW_HFR_DRAWMATCH"))
+                {
+                    fromS = std::atof(v);
+                    const char* c = std::strchr(v, ',');
+                    frames = c ? uint32_t(std::atoi(c + 1)) : 30u;
+                    fprintf(stderr, "[drawmatch] DIAGNOSTIC: %u frames from %.1f s\n", frames, fromS);
+                }
+            }
+        } s_hfrDm;  // command processor thread only
+
+        bool HfrDrawMatchActive()
+        {
+            return s_hfrDm.active;
+        }
+
+        void HfrDrawMatchRecord(uint64_t key, uint64_t vsc, uint64_t psc, uint64_t vb, bool rel, std::vector<HfrConst>&& vs)
+        {
+            if (!s_hfrC26.seen)
+                for (const HfrConst& c : vs)
+                    if (c.index == 26)
+                    {
+                        s_hfrC26.seen = true;
+                        memcpy(s_hfrC26.v, c.v, 16);
+                    }
+            s_hfrDm.cur.push_back({ key, vsc, psc, vb, rel, std::move(vs) });
+        }
+
+        void HfrDrawMatchSwap(uint64_t frame)
+        {
+            HfrDrawMatch& d = s_hfrDm;
+            if (d.fromS < 0 || d.done > d.frames)
+                return;
+            if (!d.active)
+            {
+                if (std::chrono::duration<double>(std::chrono::steady_clock::now() - d.t0).count() >= d.fromS)
+                {
+                    d.active = true;
+                    d.cur.clear();
+                }
+                return;
+            }
+            if (!d.prev.empty())
+            {
+                std::unordered_map<uint64_t, std::vector<const HfrDraw*>> before, now;
+                for (auto& x : d.prev)
+                    before[x.key].push_back(&x);
+                for (auto& x : d.cur)
+                    now[x.key].push_back(&x);
+                uint32_t unique = 0, ordered = 0, unmatched = 0, countChanged = 0, same = 0, vsChanged = 0, psOnly = 0,
+                         vbMoved = 0, rel = 0, relChanged = 0;
+                for (auto& [key, list] : now)
+                {
+                    auto it = before.find(key);
+                    if (it == before.end())
+                    {
+                        unmatched += uint32_t(list.size());
+                        continue;
+                    }
+                    if (it->second.size() != list.size())
+                        countChanged += uint32_t(list.size());
+                    const size_t n = std::min(list.size(), it->second.size());
+                    unmatched += uint32_t(list.size() - n);
+                    for (size_t i = 0; i < n; i++)
+                    {
+                        const HfrDraw &a = *it->second[i], &b = *list[i];
+                        (list.size() == 1 && it->second.size() == 1 ? unique : ordered)++;
+                        if (a.vsc == b.vsc && a.psc == b.psc)
+                            same++;
+                        else if (a.vsc != b.vsc)
+                            vsChanged++;
+                        else
+                            psOnly++;
+                        if (a.vb != b.vb)
+                            vbMoved++;
+                        if (b.rel)
+                        {
+                            rel++;
+                            if (a.vsc != b.vsc)
+                                relChanged++;
+                        }
+                    }
+                }
+                // Which VS constants changed between matched draws, and by how much (largest |difference|).
+                {
+                    std::map<uint16_t, std::pair<uint32_t, uint32_t>> seenChanged;  // index -> (draws reading it, changed)
+                    std::map<uint16_t, float> maxDiff;
+                    for (auto& [key, list] : now)
+                    {
+                        auto it = before.find(key);
+                        if (it == before.end())
+                            continue;
+                        const size_t n = std::min(list.size(), it->second.size());
+                        for (size_t i = 0; i < n; i++)
+                        {
+                            const HfrDraw &a = *it->second[i], &b = *list[i];
+                            if (a.vs.size() != b.vs.size())
+                                continue;
+                            for (size_t k = 0; k < b.vs.size(); k++)
+                            {
+                                auto& e = seenChanged[b.vs[k].index];
+                                e.first++;
+                                if (memcmp(a.vs[k].v, b.vs[k].v, 16) != 0)
+                                {
+                                    e.second++;
+                                    for (int c = 0; c < 4; c++)
+                                    {
+                                        float fa, fb;
+                                        memcpy(&fa, &a.vs[k].v[c], 4);
+                                        memcpy(&fb, &b.vs[k].v[c], 4);
+                                        if (std::isfinite(fa) && std::isfinite(fb))
+                                            maxDiff[b.vs[k].index] = std::max(maxDiff[b.vs[k].index], std::abs(fa - fb));
+                                    }
+                                }
+                            }
+                        }
+                    }
+                    std::vector<std::pair<uint32_t, uint16_t>> top;
+                    for (auto& [idx, e] : seenChanged)
+                        if (e.second)
+                            top.push_back({ e.second, idx });
+                    std::sort(top.rbegin(), top.rend());
+                    std::string t;
+                    for (size_t i = 0; i < std::min<size_t>(top.size(), 12); i++)
+                    {
+                        const auto& e = seenChanged[top[i].second];
+                        t += std::format(" c{} {}/{} (max {:.3g})", top[i].second, e.second, e.first, maxDiff[top[i].second]);
+                    }
+                    fprintf(stderr, "[drawmatch] frame %llu VS constants changed most:%s | c26 %s\n", (unsigned long long)frame, t.c_str(),
+                        s_hfrC26.seen ? std::format("{:.6g},{:.6g},{:.6g},{:.6g}", s_hfrC26.v[0], s_hfrC26.v[1], s_hfrC26.v[2], s_hfrC26.v[3]).c_str() : "-");
+                }
+                const double total = double(d.cur.size());
+                auto pct = [&](uint32_t v) { return total > 0 ? 100.0 * v / total : 0.0; };
+                fprintf(stderr, "[drawmatch] frame %llu: %zu draws (previous %zu), %zu identities | matched unique %.1f%%, "
+                                "repeated identities matched in order %.1f%% (identity count changed: %.1f%%), unmatched %.1f%% | of "
+                                "the matched: constants unchanged %.1f%%, VS constants changed %.1f%%, PS only %.1f%%, vertex "
+                                "buffer moved %.1f%%; relative-constant (palette) VS %u, %u changed\n",
+                    (unsigned long long)frame, d.cur.size(), d.prev.size(), now.size(), pct(unique), pct(ordered), pct(countChanged),
+                    pct(unmatched), pct(same), pct(vsChanged), pct(psOnly), pct(vbMoved), rel, relChanged);
+            }
+            // NFSMW_HFR_C26SCAN=1 (DIAGNOSTIC, M2): in the first two frames,
+            // where in guest memory c26's x, y, z sit (big-endian floats, in a
+            // row): the variable the game sets it from.
+            static const bool scan = [] { const char* v = std::getenv("NFSMW_HFR_C26SCAN"); return v && v[0] == '1'; }();
+            if (scan && s_hfrC26.seen && d.done < 2 && (s_hfrC26.v[0] != 0.0f || s_hfrC26.v[1] != 0.0f))
+            {
+                uint8_t pattern[12];
+                for (int k = 0; k < 3; k++)
+                {
+                    uint32_t bits;
+                    memcpy(&bits, &s_hfrC26.v[k], 4);
+                    bits = __builtin_bswap32(bits);
+                    memcpy(pattern + k * 4, &bits, 4);
+                }
+                std::string hits;
+                uint32_t count = 0;
+                auto scanRange = [&](uint32_t from, uint32_t size, const char* where) {
+                    const uint8_t* p = g_memory.base + from;
+                    for (uint32_t i = 0; i + 12 <= size && count < 16; i += 4)
+                        if (!memcmp(p + i, pattern, 12))
+                        {
+                            hits += std::format(" {:08X} ({})", from + i, where);
+                            count++;
+                        }
+                };
+                for (vmem::PageHeap* heap : { &vmem::Virtual4K(), &vmem::Virtual64K(), &vmem::Physical() })
+                    for (uint32_t a = heap->Base(); a < heap->End();)
+                    {
+                        vmem::RegionInfo info{};
+                        if (!heap->Query(a, &info) || !info.regionSize)
+                            break;
+                        if (info.state & vmem::X_MEM_COMMIT)
+                            scanRange(info.baseAddress, info.regionSize, heap == &vmem::Physical() ? "phys" : "virt");
+                        a = info.baseAddress + info.regionSize;
+                    }
+                scanRange(0x82000000u, 0x00CD0000u, "xex");
+                fprintf(stderr, "[drawmatch] frame %llu: c26's x, y, z in guest memory at:%s\n", (unsigned long long)frame,
+                    hits.empty() ? " nowhere" : hits.c_str());
+            }
+            d.prev.swap(d.cur);
+            d.cur.clear();
+            s_hfrC26 = {};
+            if (++d.done > d.frames)
+                d.active = false;
+        }
+    }
+
     void Draw(uint32_t initiatorValue, uint32_t dmaBase, uint32_t dmaSizeValue)
     {
         if (!s_vk)
@@ -7436,6 +7885,67 @@ void main()
         {
             constexpr uint32_t kSnapshotMax = 64 * 1024;
             using Range = SnapshotRange;
+            // HFR M3: the draw's vertex indices (with VGT_INDX_OFFSET), for a
+            // large buffer the CPU rewrites (a triple-buffered dynamic one:
+            // the sprite batch's three 128,000-byte slots under one fetch
+            // constant), so only this draw's vertices' records are copied or
+            // guarded and the CPU can fill the next slot while the GPU reads
+            // this one (the guard stalled sub_82445198 there 2.3 ms a second
+            // at 120 fps on the M1 Pro: M3's run d4a). Indexed draws are
+            // scanned up to kNarrowScan indices; static buffers (no CPU write
+            // since their last draw) keep the whole range.
+            constexpr uint32_t kNarrowScan = 4096;
+            int64_t vertexMin = -1, vertexMax = -1;  // -2: unknown
+            auto drawVertices = [&]() {
+                if (vertexMin != -1)
+                    return vertexMin >= 0;
+                vertexMin = vertexMax = -2;
+                const uint32_t first = s_regs[XE_GPU_REG_VGT_INDX_OFFSET];
+                if (count == 0)
+                    return false;
+                if (!src.indexed)
+                {
+                    vertexMin = int64_t(first);
+                    vertexMax = int64_t(first) + count - 1;
+                    return true;
+                }
+                if (count > kNarrowScan || uint64_t(src.base) + uint64_t(count) * (src.is32 ? 4 : 2) > kSharedSize)
+                    return false;
+                uint32_t lo = ~0u, hi = 0;
+                for (uint32_t i = 0; i < count; i++)
+                {
+                    const uint32_t v = src.Get(i);
+                    if (restartEnabled && v == resetIndex)
+                        continue;
+                    lo = std::min(lo, v);
+                    hi = std::max(hi, v);
+                }
+                if (lo > hi)
+                    return false;
+                vertexMin = int64_t(lo) + first;
+                vertexMax = int64_t(hi) + first;
+                return true;
+            };
+            auto narrow = [&](Range& r, uint32_t constant) {
+                const auto& info = s_vs->info;
+                const uint32_t stride = info.vertexStride[constant] * 4u, extent = info.vertexExtent[constant] * 4u;
+                if (((info.vertexIndexOther[constant / 32] >> (constant % 32)) & 1) || stride == 0 || extent == 0)
+                    return;
+                // Static buffers keep the whole range (no scan for them).
+                if (src.indexed && !DynamicVertexRange(r.base, r.size))
+                    return;
+                if (!drawVertices())
+                    return;
+                const uint64_t lo = uint64_t(vertexMin) * stride, hi = uint64_t(vertexMax) * stride + std::max(stride, extent);
+                if (lo >= r.size)
+                    return;
+                const uint32_t newBase = r.base + uint32_t(lo), newEnd = r.base + uint32_t(std::min<uint64_t>(hi, r.size));
+                if (newEnd > newBase && newEnd - newBase < r.size)
+                {
+                    s_stats.narrowedRanges++;
+                    r = { newBase, newEnd - newBase };
+                }
+            };
             for (const Shader* shader : { s_vs, s_ps })
                 for (uint32_t word = 0; word < 3; word++)
                     for (uint32_t bits = shader->info.vertexFetchConstants[word]; bits; bits &= bits - 1)
@@ -7444,6 +7954,8 @@ void main()
                         const uint32_t* vf = &s_regs[XE_GPU_REG_SHADER_CONSTANT_FETCH_00_0 + constant * 2];
                         Range r{ vf[0] & 0x1FFFFFFC, ((vf[1] >> 2) & 0xFFFFFF) * 4 };
                         r.size = std::min<uint32_t>(r.size, uint32_t(kSharedSize) - r.base);
+                        if (r.size > kSnapshotMax && shader == s_vs && NarrowVerticesOn())
+                            narrow(r, constant);
                         if (r.size == 0 || std::any_of(copies, copies + copyCount, [&](const Range& c) { return c.base == r.base && c.size == r.size; }))
                             continue;
                         if (g_eagerWrites && r.size <= kSnapshotMax && copyCount < 4 &&
@@ -7637,7 +8149,18 @@ void main()
         // whole target): those targets keep the whole target from now on, as
         // this draw does, so they restart this once. (Checked before a vertex
         // barrier may end the pass: then it gives way a draw early.)
+        // In split screen (gpu/split_views.h) the second view's first draw
+        // restarts the pass over both instead (BeginPass), once a frame.
         if (untiledPass && untiledWhy != 4 && x1 > x0 && y1 > y0 && s_passActive && depth == s_passDepth &&
+            std::equal(color, color + 4, s_passColor) &&
+            !Contains(s_passArea, HostRect(scale, x0, y0, x1, y1)) && !gpu::split_views::FallsBack(SplitFrame()))
+        {
+            const VkRect2D want = HostRect(scale, x0, y0, x1, y1);
+            LogOnce(0x35ull << 56, "split screen: frame %llu: a draw cut to %ux%u@%d,%d restarts its targets' pass (area %ux%u@%d,%d) over "
+                "both (scale %.2fx%.2f)", (unsigned long long)s_frame, want.extent.width, want.extent.height, want.offset.x, want.offset.y,
+                s_passArea.extent.width, s_passArea.extent.height, s_passArea.offset.x, s_passArea.offset.y, scaleX, scaleY);
+        }
+        else if (untiledPass && untiledWhy != 4 && x1 > x0 && y1 > y0 && s_passActive && depth == s_passDepth &&
             std::equal(color, color + 4, s_passColor) &&
             !Contains(s_passArea, HostRect(scale, x0, y0, x1, y1)))
         {
@@ -7726,7 +8249,8 @@ void main()
                     if (x1 <= x0 || y1 <= y0)
                         continue;
                     const VkRect2D& was = rt->cutDrawn;
-                    if (was.extent.width && !Contains(was, drew) && !Contains(drew, was) && !Adjoins(was, drew))
+                    if (was.extent.width && !Contains(was, drew) && !Contains(drew, was) && !Adjoins(was, drew) &&
+                        gpu::split_views::FallsBack(SplitFrame()))
                     {
                         rt->wholeArea = true;
                         LogOnce((0x34ull << 56) | (uint64_t(rt->base) << 24) | (uint64_t(rt->pitch) << 1) | uint64_t(rt->depth),
@@ -7904,6 +8428,10 @@ void main()
                 };
                 plan = gpu::bars::PlanVignette(draw, read, texel);
             }
+            // A flat full-screen layer short of the screen's edges (the fade
+            // to black before a load): stretched to them (gpu/edge_bars.h).
+            if (plan.fill == gpu::bars::Fill::None)
+                plan = gpu::bars::PlanLayer(draw, read);
             return plan;
         };
         auto logEdgeFill = [&](const gpu::bars::Plan& barPlan, float aspectX, float aspectY) {
@@ -7916,10 +8444,11 @@ void main()
             const bool blackout = barPlan.fill == gpu::bars::Fill::Blackout;
             const bool backdrop = barPlan.fill == gpu::bars::Fill::Backdrop;
             const bool vignette = barPlan.fill == gpu::bars::Fill::Vignette;
+            const bool layer = barPlan.fill == gpu::bars::Fill::Layer;
             const gpu::bars::Box& box = barPlan.box;
             const uint64_t key = (0x36ull << 56) | (uint64_t(kind) << 40) | (uint64_t(barPlan.rectCount) << 36) |
                 (uint64_t(std::lround(aspectX * 4096.0f)) << 18) | uint64_t(std::lround(aspectY * 4096.0f));
-            static uint64_t loggedKey[6] = { ~0ull, ~0ull, ~0ull, ~0ull, ~0ull, ~0ull };
+            static uint64_t loggedKey[7] = { ~0ull, ~0ull, ~0ull, ~0ull, ~0ull, ~0ull, ~0ull };
             if (loggedKey[kind] != key)
             {
                 loggedKey[kind] = key;
@@ -7930,26 +8459,27 @@ void main()
                             : blackout ? "outside it (past the 16:9 band, and the band's border round it)" : "past the 16:9 band", barPlan.rects[0].x0,
                         barPlan.rects[0].x1, barPlan.rects[0].y0, barPlan.rects[0].y1);
                 else
-                    snprintf(fills, sizeof(fills), "%s", vignette ? "stretched to the screen's edges"
+                    snprintf(fills, sizeof(fills), "%s", vignette || layer ? "stretched to the screen's edges"
                         : blackout || backdrop ? "fills nothing" : "reaches the screen edge: nothing to fill");
                 LogOnce(key,
                     "edge bars: frame %llu vs_%016llx ps_%016llx: %s (clip x %.3f..%.3f y %.3f..%.3f, colour %08X; view scale x %.4f y %.4f) %s",
                     (unsigned long long)s_frame, (unsigned long long)s_vs->hash, (unsigned long long)s_ps->hash,
-                    vignette ? "the Showcase's vignette (clear in the middle)" : backdrop ? "a full-band backdrop (black outside it)"
+                    vignette ? "the Showcase's vignette (clear in the middle)" : layer ? "a full-screen layer short of the screen's edges (a fade)"
+                        : backdrop ? "a full-band backdrop (black outside it)"
                         : blackout ? "a black frame" : kind == uint32_t(gpu::bars::Fill::RightBar) ? "the right vid-cam bar" : "the left vid-cam bar",
                     box.x0, box.x1, box.y0, box.y1, barPlan.argb, aspectX, aspectY, fills);
             }
             // NFSMW_LOG_FRONTEND=1: the first frame of each run of frames
             // with a match, bars and black frames apart (one run per vid-cam
             // scene and per cut; any other is a draw this should not take).
-            static uint64_t lastBarFrame[4] = { ~0ull - 1, ~0ull - 1, ~0ull - 1, ~0ull - 1 };
-            uint64_t& last = lastBarFrame[vignette ? 3 : backdrop ? 2 : blackout ? 1 : 0];
+            static uint64_t lastBarFrame[5] = { ~0ull - 1, ~0ull - 1, ~0ull - 1, ~0ull - 1, ~0ull - 1 };
+            uint64_t& last = lastBarFrame[layer ? 4 : vignette ? 3 : backdrop ? 2 : blackout ? 1 : 0];
             if (logFrontEnd && s_frame != last && s_frame != last + 1)
             {
                 xenos::xe_gpu_texture_fetch_t t0;
                 memcpy(&t0, &s_regs[XE_GPU_REG_SHADER_CONSTANT_FETCH_00_0], sizeof(t0));
                 fprintf(stderr, "[frontend] edge bars: matching from frame %llu: %s x %.3f..%.3f y %.3f..%.3f colour %08X blend %08X t0 %08X %ux%u, %u rect(s)\n",
-                    (unsigned long long)s_frame, vignette ? "vignette" : backdrop ? "backdrop" : blackout ? "black frame"
+                    (unsigned long long)s_frame, layer ? "layer" : vignette ? "vignette" : backdrop ? "backdrop" : blackout ? "black frame"
                         : kind == uint32_t(gpu::bars::Fill::RightBar) ? "right bar" : "left bar",
                     box.x0, box.x1, box.y0, box.y1, barPlan.argb, s_regs[XE_GPU_REG_RB_BLENDCONTROL0] & 0x1FFF1FFF,
                     (uint32_t(t0.base_address) << 12) & 0x1FFFFFFFu, uint32_t(t0.size_2d.width) + 1, uint32_t(t0.size_2d.height) + 1,
@@ -8269,6 +8799,9 @@ void main()
                     {
                         barPlan = planEdgeFills(c, feY, s, sv, feShader, kX == 1.0f && kY == 1.0f && kCover == 1.0f && !clipped);
                         logEdgeFill(barPlan, s, sv);
+                        // A layer short of the screen's edges, stretched to them.
+                        if (barPlan.fill == gpu::bars::Fill::Layer)
+                            memcpy(pc.posScale, barPlan.posScale, sizeof(pc.posScale));
                         if (barPlan.fill == gpu::bars::Fill::Vignette)
                             memcpy(pc.posScale, barPlan.posScale, sizeof(pc.posScale));
                     }
@@ -8322,6 +8855,7 @@ void main()
                         if (perT0Edge >= 4)
                             continue;
                         const std::string action = barPlan.fill == gpu::bars::Fill::Vignette ? std::string("vignette stretched to the screen's edges")
+                            : barPlan.fill == gpu::bars::Fill::Layer ? std::string("layer stretched to the screen's edges")
                             : barPlan.rectCount
                             ? std::string(barPlan.fill == gpu::bars::Fill::Backdrop ? "backdrop fill"
                                     : barPlan.fill == gpu::bars::Fill::Blackout ? "black frame fill" : "bar fill")
@@ -8441,11 +8975,23 @@ void main()
                         (vi.constRelative || (vi.constUsed[0] & 0xFull) == 0xFull);
                     barPlan = planEdgeFills(c, game::FrontEndScaleY(), s, sv, feShader, true);
                     logEdgeFill(barPlan, s, sv);
+                    if (barPlan.fill == gpu::bars::Fill::Layer)
+                        memcpy(pc.posScale, barPlan.posScale, sizeof(pc.posScale));
                     if (barPlan.fill == gpu::bars::Fill::Vignette)
                         memcpy(pc.posScale, barPlan.posScale, sizeof(pc.posScale));
                 }
             }
         }
+        // NFSMW_LOG_COVERS=1 (gpu/covers.h): each quad of a front-end draw
+        // (any screen shape), as drawn after the rules above, against the
+        // guest viewport the presenter shows: a dark box inside it, a dark
+        // layer short of its edges, or a layer authored to cover the 16:9
+        // frame that stops short of the picture's edges. Once per draw site
+        // (the guest code that built the quad, game/cover_callers.h), kind,
+        // extent (to 1% of the picture) and opacity; 512 lines at most.
+        if (game::covers::Enabled())
+            LogCovers(count, uint32_t(initiator.prim_type), src, pc.posScale, scissor, w * float(scaleX), h * float(scaleY), float(scaleX),
+                float(scaleY), barPlan);
         // NFSMW_LOG_DRAWS=<seconds>: every draw of one frame (target, viewport,
         // scissor, textures, shaders), consecutive duplicates folded.
         if (s_logDrawsNow)
@@ -8460,6 +9006,8 @@ void main()
                     : barPlan.fill == gpu::bars::Fill::Blackout ? "black frame" : "bar", barPlan.rectCount);
             else if (barPlan.fill == gpu::bars::Fill::Vignette)
                 line += " +vignette stretched";
+            else if (barPlan.fill == gpu::bars::Fill::Layer)
+                line += " +layer stretched";
             static std::string last;
             static uint32_t repeats = 0;
             if (line == last)
@@ -8473,6 +9021,40 @@ void main()
                 repeats = 0;
             }
         }
+        // DIAG (v0.1.5 HFR scoping): NFSMW_HFR_DRAWMATCH=<from s>,<frames>: draw-list stability between consecutive
+        // frames ([drawmatch] at each swap), for judging interpolation at the GPU command level.
+        if (HfrDrawMatchActive())
+        {
+            auto mix = [](uint64_t h, uint64_t v) { h ^= v + 0x9E3779B97F4A7C15ull + (h << 6) + (h >> 2); return h * 0x100000001B3ull; };
+            uint64_t key = mix(mix(mix(s_vs->hash, s_ps->hash), uint64_t(initiator.prim_type) << 32 | count),
+                uint64_t(s_regs[XE_GPU_REG_RB_SURFACE_INFO]) << 32 | s_regs[XE_GPU_REG_RB_COLOR_INFO]);
+            key = mix(key, s_regs[XE_GPU_REG_RB_DEPTH_INFO]);
+            for (uint32_t n = 0; n < 32; n++)
+                if ((s_ps->info.texture2DMask | s_ps->info.texture3DMask | s_ps->info.textureCubeMask) & (1u << n))
+                    key = mix(key, s_regs[XE_GPU_REG_SHADER_CONSTANT_FETCH_00_0 + n * 6 + 1] & 0x1FFFF000u);
+            auto constHash = [&](const Shader* sh, uint32_t reg0) {
+                uint64_t h = 0;
+                for (uint32_t i = 0; i < 256; i++)
+                    if (sh->info.constRelative || (sh->info.constUsed[i >> 6] >> (i & 63) & 1))
+                        for (uint32_t k = 0; k < 4; k++)
+                            h = mix(h, uint64_t(i) << 40 | uint64_t(k) << 32 | s_regs[reg0 + i * 4 + k]);
+                return h;
+            };
+            uint64_t vb = 0;
+            for (uint32_t word = 0; word < 3; word++)
+                for (uint32_t bits = s_vs->info.vertexFetchConstants[word]; bits; bits &= bits - 1)
+                    vb = mix(vb, s_regs[XE_GPU_REG_SHADER_CONSTANT_FETCH_00_0 + (word * 32 + uint32_t(__builtin_ctz(bits))) * 2] & 0x1FFFFFFC);
+            std::vector<HfrConst> vsConsts;
+            for (uint32_t i = 0; i < 256; i++)
+                if (!s_vs->info.constRelative && (s_vs->info.constUsed[i >> 6] >> (i & 63) & 1))
+                {
+                    HfrConst c{ uint16_t(i), {} };
+                    for (uint32_t k = 0; k < 4; k++)
+                        c.v[k] = s_regs[0x4000 + i * 4 + k];
+                    vsConsts.push_back(c);
+                }
+            HfrDrawMatchRecord(key, constHash(s_vs, 0x4000), constHash(s_ps, 0x4400), vb, s_vs->info.constRelative, std::move(vsConsts));
+        }
         pc.vsConstBase = 0;
         pc.psConstBase = 256;
         pc.indexOffset = s_regs[XE_GPU_REG_VGT_INDX_OFFSET];
@@ -8905,7 +9487,7 @@ void main()
         fprintf(stderr, "[zpd] %s: latest END counts:%s\n", what, line.empty() ? " none yet" : line.c_str());
     }
 
-    bool PresentFrontBuffer(const uint32_t fetch[6], uint32_t width, uint32_t height)
+    bool PresentFrontBuffer(const uint32_t fetch[6], uint32_t width, uint32_t height, float between, float shift, int64_t target)
     {
         if (!s_vk || width == 0 || height == 0)
             return false;
@@ -8938,9 +9520,10 @@ void main()
         bool scaled = pc.tiled && !showTexture[0] && s_scaled.enabled && s_scaled.scale.Exact(width, height) &&
             ScaledRangeValid(pc.base, frontBytes);
         uint32_t outW = scaled ? s_scaled.scale.x.Size(width) : width, outH = scaled ? s_scaled.scale.y.Size(height) : height;
-        Image& front = scaled ? s_frontScaled : s_front;
-        uint32_t& frontW = scaled ? s_frontScaledWidth : s_frontWidth;
-        uint32_t& frontH = scaled ? s_frontScaledHeight : s_frontHeight;
+        const bool b = between != 0.0f;
+        Image& front = scaled ? (b ? s_frontBetweenScaled : s_frontScaled) : (b ? s_frontBetween : s_front);
+        uint32_t& frontW = scaled ? (b ? s_frontBetweenScaledWidth : s_frontScaledWidth) : (b ? s_frontBetweenWidth : s_frontWidth);
+        uint32_t& frontH = scaled ? (b ? s_frontBetweenScaledHeight : s_frontScaledHeight) : (b ? s_frontBetweenHeight : s_frontHeight);
         if (outW != frontW || outH != frontH)
         {
             // A new size: wait for any use of the old image before replacing it.
@@ -8952,7 +9535,7 @@ void main()
             ToGeneral(front.image, VK_IMAGE_ASPECT_COLOR_BIT, 1);
             frontW = outW;
             frontH = outH;
-            fprintf(stderr, "[renderer] front image %ux%u (%s)\n", outW, outH, scaled ? "host resolution" : "1x");
+            fprintf(stderr, "[renderer] front image %ux%u (%s%s)\n", outW, outH, scaled ? "host resolution" : "1x", b ? ", in-between pictures" : "");
         }
         if (scaled)
         {
@@ -8988,11 +9571,16 @@ void main()
         GuardGpu(pc.base, frontBytes, false, "front buffer");
         FullBarrier();
         SubmitRecorded(7);  // the presenter's blit comes later in queue order
-        video::SubmitFrontImage(front.image, outW, outH, width, height);
+        video::SubmitFrontImage(front.image, outW, outH, width, height, between, shift, target);
         // Back at 1x (a live change): the host-resolution image is no longer
         // needed. The presenter has this frame to show instead.
-        if (!scaled && s_frontScaled.image && s_renderScale.IsOne())
-            DestroyFrontImage(s_frontScaled, s_frontScaledWidth, s_frontScaledHeight);
+        if (!scaled && s_renderScale.IsOne())
+        {
+            if (!b && s_frontScaled.image)
+                DestroyFrontImage(s_frontScaled, s_frontScaledWidth, s_frontScaledHeight);
+            if (b && s_frontBetweenScaled.image)
+                DestroyFrontImage(s_frontBetweenScaled, s_frontBetweenScaledWidth, s_frontBetweenScaledHeight);
+        }
         if (g_eagerWrites)
         {
             // With fences published early nothing else keeps the GPU from
@@ -9065,6 +9653,7 @@ void main()
 
     void OnSwap(uint64_t frame)
     {
+        HfrDrawMatchSwap(frame);  // DIAG (v0.1.5 HFR scoping)
         if (s_vk)
             ApplyLiveSettings();
         if (s_uploadLog)
@@ -9409,7 +9998,7 @@ void main()
             m.textureCount++;
         }
         m.scaled = s_scaled.poolBytes + s_scaled.tableBytes + s_scaled.scratchBytes;
-        m.front = s_front.bytes + s_frontScaled.bytes;
+        m.front = s_front.bytes + s_frontScaled.bytes + s_frontBetween.bytes + s_frontBetweenScaled.bytes;
         auto own = [&m](const Image& image) {
             if (image.memory && !image.block)
             {
@@ -9421,7 +10010,7 @@ void main()
             own(rt->image);
         for (const auto& [key, t] : s_textures)
             own(t->image);
-        for (const Image* image : { &s_front, &s_frontScaled, &s_dummy[0], &s_dummy[1], &s_dummy[2], &s_dummyStorage })
+        for (const Image* image : { &s_front, &s_frontScaled, &s_frontBetween, &s_frontBetweenScaled, &s_dummy[0], &s_dummy[1], &s_dummy[2], &s_dummyStorage })
             own(*image);
         for (const auto& block : s_blocks)
         {
diff --git a/runtime/gpu/renderer.h b/runtime/gpu/renderer.h
index ea55b8a..78f4387 100644
--- a/runtime/gpu/renderer.h
+++ b/runtime/gpu/renderer.h
@@ -34,6 +34,10 @@ namespace gpu::renderer
     bool Initialize(const uint32_t* regs);
     bool Enabled();
 
+    // NFSMW_LOG_COVERS=1 (gpu/covers.h): the lines logged so far (each a new
+    // place).
+    uint64_t CoverHits();
+
     // IM_LOAD / IM_LOAD_IMMEDIATE: `words` in guest (big-endian) order.
     void LoadShader(uint32_t type, const uint32_t* words, uint32_t dwords);
 
@@ -74,7 +78,13 @@ namespace gpu::renderer
 
     // XE_SWAP: convert the front buffer (its texture fetch constant) into an
     // image on the GPU and hand it to the presenter. False when headless.
-    bool PresentFrontBuffer(const uint32_t fetch[6], uint32_t width, uint32_t height);
+    // `between`: an in-between picture's fraction of the step (game/hfr.h; 0:
+    // a real picture), which gets an image of its own.
+    // `shift`: a real picture shown that much of a vblank early (a step drawn
+    // only between, its own picture's fraction minus 1; 0 otherwise).
+    // `target`: when to show it (video::SubmitFrontImage's).
+    bool PresentFrontBuffer(const uint32_t fetch[6], uint32_t width, uint32_t height, float between = 0.0f, float shift = 0.0f,
+        int64_t target = 0);
 
     // After each swap (NFSMW_PASS_PROFILE=<frame> prints that frame's passes).
     void OnSwap(uint64_t frame);
@@ -83,6 +93,7 @@ namespace gpu::renderer
     struct Stats
     {
         uint64_t draws, skipped, resolves, submits, pipelines, uploads, gpuBusyUs, passes, constantUploads, gpuExecUs, tileSkips, snapshotBytes, shadowWaits, shaderCacheHits, pipelineSkips, lateFrames;
+        uint64_t narrowedRanges;  // HFR M3: large vertex ranges copied or guarded as the draw's vertices only
     };
     Stats GetStats();
     // The scaled data path (internal resolution above 1x), totals so far:
diff --git a/runtime/gpu/shader_translator.cpp b/runtime/gpu/shader_translator.cpp
index e014056..7db3b0a 100644
--- a/runtime/gpu/shader_translator.cpp
+++ b/runtime/gpu/shader_translator.cpp
@@ -140,6 +140,8 @@ float xmul(float a, float b)
 
             // Previous vfetch_full, for vfetch_mini.
             VertexFetchInstruction lastFullFetch{};
+            // r0 (a vertex shader's incoming vertex index) written so far.
+            bool r0Written = false;
 
             void Error(const std::string& message)
             {
@@ -456,6 +458,9 @@ float xmul(float a, float b)
                 }
                 else
                 {
+                    if ((vecMask && (op.vector_dest() == 0 || op.is_vector_dest_relative())) ||
+                        (scaMask && (op.scalar_dest() == 0 || op.is_scalar_dest_relative())))
+                        r0Written = true;
                     if (vecMask)
                     {
                         std::string dst = Reg(op.vector_dest(), op.is_vector_dest_relative());
@@ -483,6 +488,8 @@ float xmul(float a, float b)
             // Destination swizzle for fetches: 3 bits per component.
             void StoreFetchResult(uint32_t dest, bool destRelative, uint32_t swizzle, const std::string& value)
             {
+                if (dest == 0 || destRelative)
+                    r0Written = true;
                 std::string dst = Reg(dest, destRelative);
                 for (uint32_t c = 0; c < 4; c++)
                 {
@@ -502,6 +509,15 @@ float xmul(float a, float b)
                 uint32_t slot = full.fetch_constant_index();  // 0..95 (3 per 6-dword slot)
                 out.vertexFetchMask |= 1u << (slot / 3);
                 out.vertexFetchConstants[slot / 32] |= 1u << (slot % 32);
+                // The vertices this fetch reads (see vertexStride).
+                if (stage != ShaderStage::Vertex || full.src() != 0 || full.is_src_relative() || (full.src_swizzle() & 3) != 0 || r0Written ||
+                    op.offset() < 0 || op.offset() > 251)
+                    out.vertexIndexOther[slot / 32] |= 1u << (slot % 32);
+                else
+                {
+                    out.vertexStride[slot] = uint8_t(std::max<uint32_t>(out.vertexStride[slot], full.stride()));
+                    out.vertexExtent[slot] = uint8_t(std::max<int32_t>(out.vertexExtent[slot], op.offset() + 4));
+                }
 
                 if (op.is_predicated())
                 {
diff --git a/runtime/gpu/shader_translator.h b/runtime/gpu/shader_translator.h
index 4e6d3a5..24d3190 100644
--- a/runtime/gpu/shader_translator.h
+++ b/runtime/gpu/shader_translator.h
@@ -37,6 +37,17 @@ namespace gpu
         bool usesMemExport = false;
         uint32_t vertexFetchMask = 0;    // fetch constant slots used by vfetch (x3 dwords... slot = const index)
         uint32_t vertexFetchConstants[3] = {};  // the vertex fetch constants (0..95) vfetch reads
+        // Per vertex fetch constant (0..95), for a vertex shader: the largest
+        // dword stride its vfetches use, and the furthest dword past a
+        // vertex's start they read (offset + 4); vertexIndexOther marks the
+        // constants some vfetch of which doesn't index by the vertex index as
+        // it comes in (r0.x, before anything writes r0), a negative offset, or
+        // a pixel shader's. The others read only the draw's vertices' records:
+        // the renderer copies or guards just those (HFR M3: the dynamic
+        // buffers' other slots stay writable).
+        uint8_t vertexStride[96] = {};
+        uint8_t vertexExtent[96] = {};
+        uint32_t vertexIndexOther[3] = {};
         uint32_t texture2DMask = 0;      // texture fetch slots used, by dimension
         uint32_t texture3DMask = 0;
         uint32_t textureCubeMask = 0;
diff --git a/runtime/gpu/split_views.h b/runtime/gpu/split_views.h
new file mode 100644
index 0000000..c096284
--- /dev/null
+++ b/runtime/gpu/split_views.h
@@ -0,0 +1,79 @@
+// SpeedBreaker runtime. GPL-3.0-or-later (see COPYING).
+//
+// Split screen's two views in one render target, untiled (gpu/renderer.cpp;
+// header only, tests/split_views_test.cpp).
+//
+// The game draws both players' views of the world into one 4x MSAA scene
+// target: player 1's viewport on the top rows, player 2's below (at 1280x720,
+// y 180 +- 180 and 540 +- 180), the HUDs over them. The console renders it
+// in EDRAM tiles, and each tile's window scissor keeps a view's geometry on
+// its rows: Xenos clips to its guard band, not the viewport, so geometry
+// reaches past a viewport's edge. Untiled rendering draws tile 0 over the
+// whole target, so a draw must be cut to its own viewport, or player 1's
+// geometry lands on player 2's rows (their depth too, so player 2's view
+// showed only in patches).
+//
+// NFSMW_UNTILED_AREA (on by default on Apple only) cuts untiled draws to
+// their viewports, but gave up on a second viewport in one pass: the targets
+// fell back to the whole target from then on. The split-screen rules, while
+// the game is in split screen (game/split_screen.h) and on every platform:
+//   - CutOn: untiled draws are cut to their viewports (also where
+//     NFSMW_UNTILED_AREA is off);
+//   - a target's earlier fallback to the whole target (wholeArea) doesn't
+//     hold (KeepsWholeArea);
+//   - a draw cut to a viewport its targets' open pass doesn't cover restarts
+//     the pass over both (the second view's first draw, once a frame)
+//     instead of the targets falling back (FallsBack), and neither other
+//     fallback is taken: two cuts whose union isn't exact, a resolve reading
+//     past what the cut draws drew (pixels the console never drew either).
+// Outside split screen every rule is as before. NFSMW_SPLIT_SCREEN=0: off.
+#pragma once
+#include <cmath>
+#include <cstdint>
+
+namespace gpu::split_views
+{
+    struct GuestRect
+    {
+        int32_t x0, y0, x1, y1;
+    };
+
+    // The guest pixels of a w x h target an untiled draw clipped to its
+    // viewport touches: those whose centres lie inside the viewport. ax, ay
+    // are |PA_CL_VPORT_[XY]SCALE| (y is flipped), ox, oy the offsets; the
+    // window offset added (0 for tile 0) where enabled, and D3D's integer
+    // pixel centres (+0.5) where they are its.
+    inline GuestRect ViewportPixels(float ax, float ox, float ay, float oy, float windowX, float windowY, bool d3dCenter, int32_t w,
+        int32_t h)
+    {
+        ox += windowX;
+        oy += windowY;
+        if (d3dCenter)
+        {
+            ox += 0.5f;
+            oy += 0.5f;
+        }
+        auto edge = [](float v, int32_t hi) { return int32_t(std::fmax(0.0f, std::fmin(std::ceil(v - 0.5f), float(hi)))); };
+        return { edge(ox - ax, w), edge(oy - ay, h), edge(ox + ax, w), edge(oy + ay, h) };
+    }
+
+    // Untiled draws cut to their viewports.
+    constexpr bool CutOn(bool untiledArea, bool split)
+    {
+        return untiledArea || split;
+    }
+
+    // A target that fell back to the whole target keeps it.
+    constexpr bool KeepsWholeArea(bool wholeArea, bool split)
+    {
+        return wholeArea && !split;
+    }
+
+    // A cut draw its open pass doesn't cover (or two cuts not exactly one
+    // rectangle, or a resolve past the cuts) makes its targets fall back to
+    // the whole target; in split screen the pass restarts instead.
+    constexpr bool FallsBack(bool split)
+    {
+        return !split;
+    }
+}
diff --git a/runtime/hid/input.cpp b/runtime/hid/input.cpp
index d7ff948..3e468db 100644
--- a/runtime/hid/input.cpp
+++ b/runtime/hid/input.cpp
@@ -1,8 +1,12 @@
 // SpeedBreaker runtime. GPL-3.0-or-later (see COPYING). See input.h.
+// A steering wheel's own side of this is hid/wheel.cpp.
 #include <stdafx.h>
 #include "input.h"
 #include "key_map.h"
+#include "player_slots.h"
+#include "wheel.h"
 #include <cpu/guest_time.h>
+#include <game/split_screen.h>
 #include <kernel/function.h>
 #include <ui/ui.h>
 #include <user/settings.h>
@@ -46,6 +50,93 @@ namespace
 
     SDL_Gamepad* s_gamepad = nullptr;
     std::atomic<bool> s_blocked{ false };
+
+    // Split screen (game/split_screen.h, hid/player_slots.h): XInput users
+    // 1-3 are the other players' controllers. Under s_mutex, written by
+    // Update and by a controller's removal; [0] unused (user 0 is s_pad).
+    struct OtherUser
+    {
+        bool connected = false;
+        Pad pad;
+        uint32_t packet = 0;
+        Pad last;  // the state packet counted last
+        uint16_t rumbleLow = 0, rumbleHigh = 0;
+        bool rumbleDirty = false;
+        bool told = false;  // connected, as the game last saw it (logged when it changes)
+    };
+    OtherUser s_users[hid::PlayerSlots::kUsers];
+    // Main thread: the controllers other than s_gamepad, open only while the
+    // game is in split screen, and which player each is.
+    struct OtherPad
+    {
+        SDL_JoystickID id = 0;
+        SDL_Gamepad* gamepad = nullptr;
+        uint16_t latched = 0;  // held when a menu closed (s_latchedButtons' rule)
+        int user = 0;          // as last logged
+    };
+    std::vector<OtherPad> s_others;
+    hid::PlayerSlots s_slots;
+    // NFSMW_OTHER_PADS=always, a diagnostic: the other controllers are users
+    // 1-3 in single player too (what a second pad would do there).
+    const bool s_otherPadsAlways = [] {
+        const char* v = std::getenv("NFSMW_OTHER_PADS");
+        const bool always = v && strcmp(v, "always") == 0;
+        if (always)
+            fprintf(stderr, "[input] NFSMW_OTHER_PADS=always: other controllers are XInput users 1-3 outside split screen too\n");
+        return always;
+    }();
+
+    // NFSMW_TEST_SPLIT="35-45,60-70" (tests): the input side of split screen
+    // (other controllers as users 1-3, the notices) on over those seconds of
+    // guest time too, whatever the game says; the renderer is not affected.
+    std::vector<std::pair<double, double>> ParseTestSplit()
+    {
+        std::vector<std::pair<double, double>> ranges;
+        const char* v = std::getenv("NFSMW_TEST_SPLIT");
+        for (std::string_view rest = v ? v : ""; !rest.empty();)
+        {
+            const size_t comma = rest.find(',');
+            const std::string item(rest.substr(0, comma));
+            rest = comma == std::string_view::npos ? std::string_view() : rest.substr(comma + 1);
+            const size_t dash = item.find('-');
+            if (dash != std::string::npos)
+                ranges.push_back({ std::atof(item.c_str()), std::atof(item.c_str() + dash + 1) });
+        }
+        if (!ranges.empty())
+            fprintf(stderr, "[input] NFSMW_TEST_SPLIT: %zu ranges of input-side split screen\n", ranges.size());
+        return ranges;
+    }
+    const std::vector<std::pair<double, double>> s_testSplit = ParseTestSplit();
+
+    // Main thread: the notices for a player whose controller went in split
+    // screen (bit 0: player 1's, bits 1-3: users 1-3's), as shown now.
+    // The game itself only pauses under a bare PAUSE banner (X360_Pause.fng,
+    // the screen it also shows under the 360's Guide): on a 360 the console's
+    // own overlay asked for the controller. Its leftover ControllerUnplugged.fng
+    // ("Please reconnect the controller to controller port %d and press START
+    // to continue.") is never pushed. Player 1 keeps the keyboard, so the game
+    // never sees user 0 go: a notice only.
+    uint32_t s_noticesShown = 0;
+    bool s_p1Lost = false;  // player 1's controller went in split screen, none since
+    std::string MissingNotice(int user)
+    {
+        if (user == 0)
+            return "Player 1's controller disconnected. Reconnect it, or play on with the keyboard.";
+        return "Player " + std::to_string(user + 1) + "'s controller disconnected. Reconnect it and press START.";
+    }
+
+    // SDL's buttons as XInput's.
+    const std::pair<SDL_GamepadButton, uint16_t> kButtonMap[] = {
+        { SDL_GAMEPAD_BUTTON_SOUTH, XAMINPUT_GAMEPAD_A }, { SDL_GAMEPAD_BUTTON_EAST, XAMINPUT_GAMEPAD_B },
+        { SDL_GAMEPAD_BUTTON_WEST, XAMINPUT_GAMEPAD_X }, { SDL_GAMEPAD_BUTTON_NORTH, XAMINPUT_GAMEPAD_Y },
+        { SDL_GAMEPAD_BUTTON_BACK, XAMINPUT_GAMEPAD_BACK }, { SDL_GAMEPAD_BUTTON_START, XAMINPUT_GAMEPAD_START },
+        { SDL_GAMEPAD_BUTTON_LEFT_STICK, XAMINPUT_GAMEPAD_LEFT_THUMB },
+        { SDL_GAMEPAD_BUTTON_RIGHT_STICK, XAMINPUT_GAMEPAD_RIGHT_THUMB },
+        { SDL_GAMEPAD_BUTTON_LEFT_SHOULDER, XAMINPUT_GAMEPAD_LEFT_SHOULDER },
+        { SDL_GAMEPAD_BUTTON_RIGHT_SHOULDER, XAMINPUT_GAMEPAD_RIGHT_SHOULDER },
+        { SDL_GAMEPAD_BUTTON_DPAD_UP, XAMINPUT_GAMEPAD_DPAD_UP }, { SDL_GAMEPAD_BUTTON_DPAD_DOWN, XAMINPUT_GAMEPAD_DPAD_DOWN },
+        { SDL_GAMEPAD_BUTTON_DPAD_LEFT, XAMINPUT_GAMEPAD_DPAD_LEFT }, { SDL_GAMEPAD_BUTTON_DPAD_RIGHT, XAMINPUT_GAMEPAD_DPAD_RIGHT },
+    };
     // Main thread: buttons held when a menu closed, hidden from the game
     // until each is released (the B, Start or A that closed it).
     uint16_t s_latchedButtons = 0;
@@ -53,6 +144,7 @@ namespace
     bool s_scriptSuppressed = false;  // under s_mutex: no scripted input while a menu is open
     std::chrono::steady_clock::time_point s_lastInput;  // main thread: a control last in use (SecondsSinceInput)
     bool s_inputSeen = false;
+    hid::wheelmap::WheelStill s_wheelStill;  // main thread: a wheel's steering counts when it turns (wheel_map.h)
 
     // The controller's Back is held back from the game until it's clear it
     // isn't the start of the Back + Start settings chord: released (then
@@ -111,7 +203,9 @@ namespace
 
     // A scripted input: buttons (or analog: RT/LT triggers, LL/LR/LU/LD left
     // stick) held over [time, time + duration).
-    struct ScriptTap { double time; uint16_t buttons; int16_t lx, ly; double duration = 0.15; uint8_t lt = 0, rt = 0; };
+    // `steps`: time and duration in world steps (the stepper's count, which
+    // restarts at each load) instead of seconds: "w6668~w7148:RT".
+    struct ScriptTap { double time; uint16_t buttons; int16_t lx, ly; double duration = 0.15; uint8_t lt = 0, rt = 0; bool steps = false; };
     std::vector<ScriptTap> s_script;
     // Guest ns at launch: the script and the virtual pad run on guest time,
     // so a press due while the game is suspended comes after it instead of
@@ -123,6 +217,23 @@ namespace
         return double(guesttime::NowNs() - s_start) / 1e9;
     }
 
+    // NFSMW_INPUT_STEPS_AFTER=<s>: world-step taps ("w..." times) count from
+    // this many seconds after launch (past the load whose steps they count),
+    // so automated runs press at the same world step whatever the loads took
+    // (the A/B tests of game/hfr.h: a wall-clock press lands on another step
+    // when a load is shorter).
+    const double s_stepsAfter = [] { const char* v = std::getenv("NFSMW_INPUT_STEPS_AFTER"); return v ? std::atof(v) : 0.0; }();
+
+    // The world stepper's count (game/hfr.cpp, frame_time.cpp: [0x82A2CB6C] + 40); -1 without one.
+    double WorldSteps()
+    {
+        uint8_t* base = g_memory.base;
+        if (!base)
+            return -1;
+        const uint32_t stepper = PPC_LOAD_U32(0x82A2CB6C);
+        return stepper ? double(PPC_LOAD_U32(stepper + 40)) : -1.0;
+    }
+
     int16_t ToShort(float v)
     {
         return int16_t(std::clamp(v * 32767.0f, -32768.0f, 32767.0f));
@@ -185,6 +296,13 @@ namespace
             std::string when = item.substr(0, colon);
             std::string name = item.substr(colon + 1);
             ScriptTap proto{ 0, ButtonByName(name), 0, 0 };
+            // World steps: "w<step>" (a tap of 9 steps) or "w<from>~w<to>" (held).
+            if (!when.empty() && when[0] == 'w')
+            {
+                proto.steps = true;
+                proto.duration = 9;
+                when.erase(std::remove(when.begin(), when.end(), 'w'), when.end());
+            }
             if (name == "RT") proto.rt = 255;
             else if (name == "LT") proto.lt = 255;
             else if (name == "LL") proto.lx = -32767;
@@ -234,8 +352,20 @@ namespace
         if (s_script.empty())
             return;
         double t = SecondsSinceLaunch();
+        const double steps = t >= s_stepsAfter ? WorldSteps() : -1.0;
+        // The first world-step tap that applies: a line saying when (checks the clock).
+        static bool said = false;
+        if (!said && steps >= 0)
+            for (const auto& tap : s_script)
+                if (tap.steps && steps >= tap.time && steps < tap.time + tap.duration)
+                {
+                    said = true;
+                    fprintf(stderr, "[input] script: first world-step tap (w%.0f) at world step %.0f, %.3f s after launch\n", tap.time, steps, t);
+                    break;
+                }
         for (const auto& tap : s_script)
-            if (t >= tap.time && t < tap.time + tap.duration)
+            if (tap.steps ? steps >= 0 && steps >= tap.time && steps < tap.time + tap.duration
+                          : t >= tap.time && t < tap.time + tap.duration)
             {
                 p.buttons |= tap.buttons;
                 p.leftTrigger = std::max(p.leftTrigger, tap.lt);
@@ -262,32 +392,77 @@ namespace
     // reach it as they would a real controller, for tests without one. Each
     // step logs what the game then gets; the rumble the game asks for and
     // the rumble the pad receives are logged.
+    // NFSMW_VIRTUAL_PAD_2 (and _3, _4), the same syntax: more virtual
+    // controllers, for split-screen tests (the other players' pads); with
+    // any of them set, only the virtual ones are opened. Two more steps for
+    // them: "40:DETACH" unplugs the pad (SDL removes it, as a real one
+    // going), "50:ATTACH" plugs it in again (a new SDL id).
     struct PadStep { double time; SDL_GamepadAxis axis; float value; std::string text; int button = -1; bool down = false; };
-    constexpr int kShotStep = -2;  // PadStep::button: a capture, not a button
-    std::vector<PadStep> s_padSteps;
-    size_t s_padNext = 0;
-    SDL_JoystickID s_virtualPadId = 0;
-    SDL_Joystick* s_virtualPad = nullptr;
-
-    bool SDLCALL VirtualPadRumble(void*, Uint16 low, Uint16 high)
+    constexpr int kShotStep = -2;    // PadStep::button: a capture, not a button
+    constexpr int kDetachStep = -3;  // unplug
+    constexpr int kAttachStep = -4;  // plug in again
+    struct VirtualPad
     {
-        fprintf(stderr, "[input] virtual pad: rumble low %u, high %u\n", unsigned(low), unsigned(high));
+        std::vector<PadStep> steps;
+        size_t next = 0;
+        SDL_JoystickID id = 0;          // 0: not attached
+        SDL_Joystick* joystick = nullptr;
+        int number = 1;                 // 1 = NFSMW_VIRTUAL_PAD
+    };
+    VirtualPad s_vpads[hid::PlayerSlots::kUsers];
+    bool s_virtualOnly = false;  // a virtual pad was asked for: real controllers are left alone
+
+    bool SDLCALL VirtualPadRumble(void* userdata, Uint16 low, Uint16 high)
+    {
+        const int number = int(reinterpret_cast<intptr_t>(userdata));
+        if (number == 1)
+            fprintf(stderr, "[input] virtual pad: rumble low %u, high %u\n", unsigned(low), unsigned(high));
+        else
+            fprintf(stderr, "[input] virtual pad %d: rumble low %u, high %u\n", number, unsigned(low), unsigned(high));
         return true;
     }
 
-    void AttachVirtualPad()
+    bool IsVirtualPad(SDL_JoystickID id)
+    {
+        for (const VirtualPad& v : s_vpads)
+            if (v.id && v.id == id)
+                return true;
+        return false;
+    }
+
+    bool PlugVirtualPad(VirtualPad& vp)
+    {
+        const std::string name = vp.number == 1 ? "SpeedBreaker virtual pad" : "SpeedBreaker virtual pad " + std::to_string(vp.number);
+        SDL_VirtualJoystickDesc desc;
+        SDL_INIT_INTERFACE(&desc);
+        desc.type = SDL_JOYSTICK_TYPE_GAMEPAD;
+        desc.naxes = SDL_GAMEPAD_AXIS_COUNT;
+        desc.nbuttons = SDL_GAMEPAD_BUTTON_COUNT;
+        desc.name = name.c_str();
+        if (vp.number > 1)
+            desc.product_id = Uint16(vp.number);  // its own SDL mapping, so its own name (pad 1's descriptor as before)
+        desc.Rumble = VirtualPadRumble;
+        desc.userdata = reinterpret_cast<void*>(intptr_t(vp.number));
+        vp.id = SDL_AttachVirtualJoystick(&desc);
+        vp.joystick = vp.id ? SDL_OpenJoystick(vp.id) : nullptr;
+        if (!vp.joystick)
+        {
+            fprintf(stderr, "[input] %s: no virtual controller: %s\n", vp.number == 1 ? "NFSMW_VIRTUAL_PAD" : name.c_str(), SDL_GetError());
+            if (vp.id)
+                SDL_DetachVirtualJoystick(vp.id);
+            vp.id = 0;
+            return false;
+        }
+        return true;
+    }
+
+    void ParseVirtualPad(const char* v, VirtualPad& vp)
     {
-        const char* v = std::getenv("NFSMW_VIRTUAL_PAD");
-        if (!v || !*v)
-            return;
-        // A test's window rarely has the keyboard focus (on the Mac it's
-        // started from a shell behind other windows), and without it SDL
-        // drops stick and trigger changes: the pad kept its first value.
-        SDL_SetHint(SDL_HINT_JOYSTICK_ALLOW_BACKGROUND_EVENTS, "1");
         static const std::pair<const char*, SDL_GamepadAxis> axes[] = {
             { "LX", SDL_GAMEPAD_AXIS_LEFTX }, { "LY", SDL_GAMEPAD_AXIS_LEFTY }, { "RX", SDL_GAMEPAD_AXIS_RIGHTX },
             { "RY", SDL_GAMEPAD_AXIS_RIGHTY }, { "LT", SDL_GAMEPAD_AXIS_LEFT_TRIGGER }, { "RT", SDL_GAMEPAD_AXIS_RIGHT_TRIGGER },
         };
+        const char* var = vp.number == 1 ? "NFSMW_VIRTUAL_PAD" : vp.number == 2 ? "NFSMW_VIRTUAL_PAD_2" : vp.number == 3 ? "NFSMW_VIRTUAL_PAD_3" : "NFSMW_VIRTUAL_PAD_4";
         for (std::string_view rest = v; !rest.empty();)
         {
             size_t comma = rest.find(',');
@@ -307,7 +482,12 @@ namespace
             };
             if (name == "SHOT")
             {
-                s_padSteps.push_back({ std::atof(item.c_str()), SDL_GAMEPAD_AXIS_INVALID, 0.0f, name, kShotStep, false });
+                vp.steps.push_back({ std::atof(item.c_str()), SDL_GAMEPAD_AXIS_INVALID, 0.0f, name, kShotStep, false });
+                continue;
+            }
+            if (name == "DETACH" || name == "ATTACH")
+            {
+                vp.steps.push_back({ std::atof(item.c_str()), SDL_GAMEPAD_AXIS_INVALID, 0.0f, name, name == "DETACH" ? kDetachStep : kAttachStep, false });
                 continue;
             }
             bool found = false;
@@ -318,13 +498,13 @@ namespace
                     if (equals == std::string::npos)
                     {
                         // A tap: down, and up again 0.15 s later.
-                        s_padSteps.push_back({ at, SDL_GAMEPAD_AXIS_INVALID, 0.0f, name + " down", int(button), true });
-                        s_padSteps.push_back({ at + 0.15, SDL_GAMEPAD_AXIS_INVALID, 0.0f, name + " up", int(button), false });
+                        vp.steps.push_back({ at, SDL_GAMEPAD_AXIS_INVALID, 0.0f, name + " down", int(button), true });
+                        vp.steps.push_back({ at + 0.15, SDL_GAMEPAD_AXIS_INVALID, 0.0f, name + " up", int(button), false });
                     }
                     else
                     {
                         const bool down = std::atof(item.c_str() + equals + 1) != 0.0;
-                        s_padSteps.push_back({ at, SDL_GAMEPAD_AXIS_INVALID, 0.0f, name + (down ? " down" : " up"), int(button), down });
+                        vp.steps.push_back({ at, SDL_GAMEPAD_AXIS_INVALID, 0.0f, name + (down ? " down" : " up"), int(button), down });
                     }
                     found = true;
                 }
@@ -332,93 +512,141 @@ namespace
                 continue;
             if (equals == std::string::npos)
             {
-                fprintf(stderr, "[input] NFSMW_VIRTUAL_PAD: unknown button in \"%s\"\n", item.c_str());
+                fprintf(stderr, "[input] %s: unknown button in \"%s\"\n", var, item.c_str());
                 continue;
             }
             for (auto& [n, axis] : axes)
                 if (name == n)
                 {
-                    s_padSteps.push_back({ std::atof(item.c_str()), axis, float(std::atof(item.c_str() + equals + 1)), item.substr(colon + 1) });
+                    vp.steps.push_back({ std::atof(item.c_str()), axis, float(std::atof(item.c_str() + equals + 1)), item.substr(colon + 1) });
                     found = true;
                 }
             if (!found)
-                fprintf(stderr, "[input] NFSMW_VIRTUAL_PAD: unknown axis in \"%s\"\n", item.c_str());
+                fprintf(stderr, "[input] %s: unknown axis in \"%s\"\n", var, item.c_str());
         }
-        std::stable_sort(s_padSteps.begin(), s_padSteps.end(), [](const PadStep& a, const PadStep& b) { return a.time < b.time; });
-        SDL_VirtualJoystickDesc desc;
-        SDL_INIT_INTERFACE(&desc);
-        desc.type = SDL_JOYSTICK_TYPE_GAMEPAD;
-        desc.naxes = SDL_GAMEPAD_AXIS_COUNT;
-        desc.nbuttons = SDL_GAMEPAD_BUTTON_COUNT;
-        desc.name = "SpeedBreaker virtual pad";
-        desc.Rumble = VirtualPadRumble;
-        s_virtualPadId = SDL_AttachVirtualJoystick(&desc);
-        s_virtualPad = s_virtualPadId ? SDL_OpenJoystick(s_virtualPadId) : nullptr;
-        if (!s_virtualPad)
-        {
-            fprintf(stderr, "[input] NFSMW_VIRTUAL_PAD: no virtual controller: %s\n", SDL_GetError());
-            return;
-        }
-        fprintf(stderr, "[input] virtual pad attached, %zu steps\n", s_padSteps.size());
+        std::stable_sort(vp.steps.begin(), vp.steps.end(), [](const PadStep& a, const PadStep& b) { return a.time < b.time; });
     }
 
-    // Moves the virtual pad's axes due by now. Returns the steps taken ("" if none).
-    std::string StepVirtualPad()
+    void AttachVirtualPad()
     {
-        if (!s_virtualPad || s_padNext >= s_padSteps.size())
-            return {};
-        double t = SecondsSinceLaunch();
-        std::string taken;
-        uint32_t changed = 0;  // buttons changed this frame
-        for (; s_padNext < s_padSteps.size() && s_padSteps[s_padNext].time <= t; s_padNext++)
+        static const char* const vars[] = { "NFSMW_VIRTUAL_PAD", "NFSMW_VIRTUAL_PAD_2", "NFSMW_VIRTUAL_PAD_3", "NFSMW_VIRTUAL_PAD_4" };
+        for (int n = 0; n < hid::PlayerSlots::kUsers; n++)
         {
-            const PadStep& step = s_padSteps[s_padNext];
-            if (step.button == kShotStep)
-            {
-                ui::RequestShot();
-                taken += (taken.empty() ? "" : " ") + step.text;
+            VirtualPad& vp = s_vpads[n];
+            vp.number = n + 1;
+            const char* v = std::getenv(vars[n]);
+            if (!v || !*v)
                 continue;
-            }
-            if (step.button >= 0)
-            {
-                if (changed & (1u << step.button))
-                    break;  // its next change waits a frame (the steps stay in order)
-                changed |= 1u << step.button;
-                SDL_SetJoystickVirtualButton(s_virtualPad, step.button, step.down);
-                taken += (taken.empty() ? "" : " ") + step.text;
+            // A test's window rarely has the keyboard focus (on the Mac it's
+            // started from a shell behind other windows), and without it SDL
+            // drops stick and trigger changes: the pad kept its first value.
+            SDL_SetHint(SDL_HINT_JOYSTICK_ALLOW_BACKGROUND_EVENTS, "1");
+            ParseVirtualPad(v, vp);
+            if (!PlugVirtualPad(vp))
                 continue;
-            }
-            float value = step.value;
-            bool trigger = step.axis == SDL_GAMEPAD_AXIS_LEFT_TRIGGER || step.axis == SDL_GAMEPAD_AXIS_RIGHT_TRIGGER;
-            if (step.axis == SDL_GAMEPAD_AXIS_LEFTY || step.axis == SDL_GAMEPAD_AXIS_RIGHTY)
-                value = -value;  // SDL: down is positive
-            // A virtual gamepad's triggers span the whole axis (-32768 is released).
-            float raw = trigger ? std::clamp(value, 0.0f, 1.0f) * 65535.0f - 32768.0f : std::clamp(value, -1.0f, 1.0f) * 32767.0f;
-            SDL_SetJoystickVirtualAxis(s_virtualPad, int(step.axis), Sint16(std::lround(std::clamp(raw, -32768.0f, 32767.0f))));
-            taken += (taken.empty() ? "" : " ") + step.text;
+            s_virtualOnly = true;
+            if (n == 0)
+                fprintf(stderr, "[input] virtual pad attached, %zu steps\n", vp.steps.size());
+            else
+                fprintf(stderr, "[input] virtual pad %d attached, %zu steps\n", vp.number, vp.steps.size());
         }
-        if (!taken.empty())
+    }
+
+    // Moves each virtual pad's axes and buttons due by now. taken[n]: pad
+    // n + 1's steps taken ("" if none).
+    void StepVirtualPads(std::string taken[hid::PlayerSlots::kUsers])
+    {
+        double t = SecondsSinceLaunch();
+        bool any = false;
+        for (int n = 0; n < hid::PlayerSlots::kUsers; n++)
+        {
+            VirtualPad& vp = s_vpads[n];
+            uint32_t changed = 0;  // buttons changed this frame
+            for (; vp.next < vp.steps.size() && vp.steps[vp.next].time <= t; vp.next++)
+            {
+                const PadStep& step = vp.steps[vp.next];
+                if (step.button == kShotStep)
+                {
+                    ui::RequestShot();
+                    taken[n] += (taken[n].empty() ? "" : " ") + step.text;
+                    continue;
+                }
+                if (step.button == kDetachStep || step.button == kAttachStep)
+                {
+                    if (step.button == kDetachStep && vp.joystick)
+                    {
+                        SDL_CloseJoystick(vp.joystick);
+                        vp.joystick = nullptr;
+                        SDL_DetachVirtualJoystick(vp.id);
+                        vp.id = 0;
+                    }
+                    else if (step.button == kAttachStep && !vp.joystick)
+                        PlugVirtualPad(vp);
+                    taken[n] += (taken[n].empty() ? "" : " ") + step.text;
+                    any = true;
+                    continue;
+                }
+                if (!vp.joystick)
+                    continue;  // unplugged: its steps pass
+                if (step.button >= 0)
+                {
+                    if (changed & (1u << step.button))
+                        break;  // its next change waits a frame (the steps stay in order)
+                    changed |= 1u << step.button;
+                    SDL_SetJoystickVirtualButton(vp.joystick, step.button, step.down);
+                    taken[n] += (taken[n].empty() ? "" : " ") + step.text;
+                    any = true;
+                    continue;
+                }
+                float value = step.value;
+                bool trigger = step.axis == SDL_GAMEPAD_AXIS_LEFT_TRIGGER || step.axis == SDL_GAMEPAD_AXIS_RIGHT_TRIGGER;
+                if (step.axis == SDL_GAMEPAD_AXIS_LEFTY || step.axis == SDL_GAMEPAD_AXIS_RIGHTY)
+                    value = -value;  // SDL: down is positive
+                // A virtual gamepad's triggers span the whole axis (-32768 is released).
+                float raw = trigger ? std::clamp(value, 0.0f, 1.0f) * 65535.0f - 32768.0f : std::clamp(value, -1.0f, 1.0f) * 32767.0f;
+                SDL_SetJoystickVirtualAxis(vp.joystick, int(step.axis), Sint16(std::lround(std::clamp(raw, -32768.0f, 32767.0f))));
+                taken[n] += (taken[n].empty() ? "" : " ") + step.text;
+                any = true;
+            }
+        }
+        if (any)
             SDL_UpdateJoysticks();  // read back this frame
-        return taken;
     }
 
     void OpenFirstGamepad()
     {
         if (s_gamepad)
             return;
-        if (s_virtualPad)
+        if (s_virtualOnly)
         {
             // Only the test's pad: a real controller nearby must not rumble.
-            s_gamepad = SDL_OpenGamepad(s_virtualPadId);
+            if (s_vpads[0].id)
+                s_gamepad = SDL_OpenGamepad(s_vpads[0].id);
             if (s_gamepad)
                 fprintf(stderr, "[input] gamepad: %s\n", SDL_GetGamepadName(s_gamepad));
             return;
         }
         int count = 0;
         SDL_JoystickID* ids = SDL_GetGamepads(&count);
-        if (ids && count > 0)
+        for (int i = 0; ids && i < count; i++)
         {
-            s_gamepad = SDL_OpenGamepad(ids[0]);
+            // In split screen, never another player's controller (one that
+            // isn't a player yet may take over player 1's).
+            if (s_slots.UserOf(ids[i]) != 0)
+                continue;
+            // A wheel SDL happens to have a gamepad mapping for belongs to the
+            // wheel, not to this path: one device, one owner (hid/wheel.h).
+            if (hid::wheel::Owns(ids[i]))
+                continue;
+            auto other = std::find_if(s_others.begin(), s_others.end(), [&](const OtherPad& o) { return o.id == ids[i]; });
+            if (other != s_others.end())
+            {
+                s_gamepad = other->gamepad;  // already open: player 1's now
+                s_others.erase(other);
+                s_slots.Remove(ids[i]);
+            }
+            else
+                s_gamepad = SDL_OpenGamepad(ids[i]);
             if (s_gamepad)
             {
                 // What it can do: a pad without motors takes rumble and ignores it.
@@ -427,10 +655,70 @@ namespace
                     SDL_GetBooleanProperty(props, SDL_PROP_GAMEPAD_CAP_RUMBLE_BOOLEAN, false) ? "yes" : "no",
                     SDL_GetBooleanProperty(props, SDL_PROP_GAMEPAD_CAP_TRIGGER_RUMBLE_BOOLEAN, false) ? "yes" : "no");
             }
+            break;
         }
         SDL_free(ids);
     }
 
+    // Split screen: open a controller as a possible other player (not player
+    // 1's, not one already open; with virtual pads, only theirs).
+    void OpenOtherPad(SDL_JoystickID id)
+    {
+        if (!id || hid::wheel::Owns(id) || (s_gamepad && SDL_GetGamepadID(s_gamepad) == id) || (s_virtualOnly && (!IsVirtualPad(id) || id == s_vpads[0].id)))
+            return;
+        if (std::any_of(s_others.begin(), s_others.end(), [&](const OtherPad& o) { return o.id == id; }))
+            return;
+        SDL_Gamepad* g = SDL_OpenGamepad(id);
+        if (!g)
+        {
+            fprintf(stderr, "[input] split screen: controller %u didn't open: %s\n", unsigned(id), SDL_GetError());
+            return;
+        }
+        s_others.push_back(OtherPad{ id, g });
+        SDL_PropertiesID props = SDL_GetGamepadProperties(g);
+        fprintf(stderr, "[input] split screen: %s open (rumble %s), a player once it's used\n", SDL_GetGamepadName(g),
+            SDL_GetBooleanProperty(props, SDL_PROP_GAMEPAD_CAP_RUMBLE_BOOLEAN, false) ? "yes" : "no");
+    }
+
+    void OpenOtherPads()
+    {
+        int count = 0;
+        SDL_JoystickID* ids = SDL_GetGamepads(&count);
+        for (int i = 0; ids && i < count; i++)
+            OpenOtherPad(ids[i]);
+        SDL_free(ids);
+    }
+
+    // A controller of s_others closed (removed, or split screen over): its
+    // user, if it was one, reads not connected from now on.
+    void CloseOtherPad(SDL_JoystickID id, const char* why)
+    {
+        auto it = std::find_if(s_others.begin(), s_others.end(), [&](const OtherPad& o) { return o.id == id; });
+        if (it == s_others.end())
+            return;
+        const std::string name = SDL_GetGamepadName(it->gamepad) ? SDL_GetGamepadName(it->gamepad) : "a controller";
+        SDL_RumbleGamepad(it->gamepad, 0, 0, 0);
+        SDL_CloseGamepad(it->gamepad);
+        s_others.erase(it);
+        const int user = s_slots.Remove(id);
+        if (user)
+        {
+            {
+                std::lock_guard lock(s_mutex);
+                s_users[user].connected = false;
+                s_users[user].pad = Pad{};
+            }
+            fprintf(stderr, "[input] player %d's controller (%s, XInput user %d) %s: the game sees it disconnected\n", user + 1,
+                name.c_str(), user, why);
+        }
+    }
+
+    void CloseOtherPads(const char* why)
+    {
+        while (!s_others.empty())
+            CloseOtherPad(s_others.back().id, why);
+    }
+
 #if defined(__APPLE__) && TARGET_OS_IOS
     // A phone or tablet has nothing to play the game with but a controller
     // (or a keyboard attached to it, which counts as on desktop), and a
@@ -459,7 +747,7 @@ namespace
             return;
         s_noControllerAt = 0;
         // (NFSMW_INPUT_SCRIPT is the controller of an automated run.)
-        if (s_gamepad || SDL_HasKeyboard() || !s_script.empty())
+        if (s_gamepad || hid::wheel::Playing() || SDL_HasKeyboard() || !s_script.empty())
             return;
         fprintf(stderr, "[input] no controller: %s\n", s_noControllerText);
         ui::Toast(s_noControllerText, 10.0);
@@ -494,15 +782,186 @@ namespace
         auto now = std::chrono::steady_clock::now();
         if (now - last < std::chrono::seconds(1))
             return;
+        // ...and how long the controls have been idle (the refresh-rate notice waits for 3 s of it).
+        const double idle = s_inputSeen ? std::chrono::duration<double>(now - s_lastInput).count() : 0.0;
         fprintf(stderr, "[input] left stick raw (%+.4f, %+.4f) range x[%+.4f, %+.4f] y[%+.4f, %+.4f] -> game (%d, %d); "
-                        "triggers raw (%.3f, %.3f) -> game (%u, %u)\n",
-            rawX, rawY, minX, maxX, minY, maxY, int(ToShort(x)), int(ToShort(y)), rawLt, rawRt, unsigned(lt), unsigned(rt));
+                        "triggers raw (%.3f, %.3f) -> game (%u, %u); idle %.1f s\n",
+            rawX, rawY, minX, maxX, minY, maxY, int(ToShort(x)), int(ToShort(y)), rawLt, rawRt, unsigned(lt), unsigned(rt), idle);
         minX = minY = 1;
         maxX = maxY = -1;
         last = now;
     }
 }
 
+namespace
+{
+    // Split screen, once a frame from Update (main thread): the mode (the
+    // game's own predicate, hid/player_slots.h), the other controllers as
+    // XInput users 1-3, and their rumble. Outside split screen nothing is
+    // open and this returns at once: single player is v0.1.7's.
+    void UpdateOtherPlayers(bool blocked, bool menuClosed, float deadzone, float triggerDeadzone, bool vibration,
+        bool vibrationChanged, const std::string padTaken[hid::PlayerSlots::kUsers])
+    {
+        constexpr int kUsers = hid::PlayerSlots::kUsers;
+        const int64_t now = guesttime::NowNs();
+        const double t = SecondsSinceLaunch();
+        const bool testSplit = std::any_of(s_testSplit.begin(), s_testSplit.end(), [&](const auto& r) { return t >= r.first && t < r.second; });
+        const bool said = game::split_screen::Enabled() && (s_otherPadsAlways || testSplit || game::split_screen::GameSaysSplit());
+        const bool split = s_slots.NoteSplit(said, now);
+        if (s_slots.Changed())
+        {
+            if (split)
+            {
+                OpenOtherPads();
+                fprintf(stderr, "[input] split screen%s: player 1 is the keyboard and %s; another controller is player 2 once it's "
+                                "used (%zu other open)\n",
+                    s_otherPadsAlways ? " (NFSMW_OTHER_PADS=always)" : " on (the game's Quick Race > Split Screen)",
+                    s_gamepad && SDL_GetGamepadName(s_gamepad) ? SDL_GetGamepadName(s_gamepad) : "no controller", s_others.size());
+            }
+            else
+            {
+                CloseOtherPads("closed: split screen is over");
+                {
+                    // (The players were forgotten before their pads closed:
+                    // every user reads not connected from here, explicitly.)
+                    std::lock_guard lock(s_mutex);
+                    for (int u = 1; u < kUsers; u++)
+                    {
+                        s_users[u].connected = false;
+                        s_users[u].pad = Pad{};
+                        s_users[u].rumbleLow = s_users[u].rumbleHigh = 0;
+                    }
+                }
+                fprintf(stderr, "[input] split screen off: one controller again (XInput users 1-3 not connected)\n");
+            }
+        }
+        // The notices: a player whose controller went (split screen only),
+        // up until a controller takes its place again.
+        if (s_gamepad || !split)
+            s_p1Lost = false;
+        uint32_t wanted = s_p1Lost ? 1u : 0u;
+        for (int u = 1; u < kUsers; u++)
+            if (s_slots.Missing(u))
+                wanted |= 1u << u;
+        for (int u = 0; u < kUsers; u++)
+        {
+            const uint32_t bit = 1u << u;
+            if ((wanted & bit) == (s_noticesShown & bit))
+                continue;
+            const std::string text = MissingNotice(u);
+            if (wanted & bit)
+            {
+                ui::Toast(text, 24.0 * 3600.0);  // until withdrawn
+                fprintf(stderr, "[input] notice shown: %s\n", text.c_str());
+            }
+            else
+            {
+                ui::WithdrawToast(text);
+                fprintf(stderr, "[input] notice withdrawn (player %d %s): %s\n", u + 1,
+                    split ? "is back" : "gone with split screen", text.c_str());
+            }
+        }
+        s_noticesShown = wanted;
+        for (int n = 1; n < kUsers; n++)
+            if (!padTaken[n].empty() && std::none_of(s_others.begin(), s_others.end(), [&](const OtherPad& o) { return o.id == s_vpads[n].id; }))
+                fprintf(stderr, "[input] virtual pad %d %s (%s)\n", n + 1, padTaken[n].c_str(),
+                    !s_vpads[n].id ? "unplugged" : split ? "not open" : "not open: not split screen");
+        if (!split && s_others.empty())
+            return;
+
+        Pad staged[kUsers];
+        for (OtherPad& o : s_others)
+        {
+            Pad p;
+            for (auto& [button, bit] : kButtonMap)
+                if (SDL_GetGamepadButton(o.gamepad, button))
+                    p.buttons |= bit;  // (Back straight through: our menu's chord is player 1's)
+            auto axis = [&](SDL_GamepadAxis a) { return float(SDL_GetGamepadAxis(o.gamepad, a)) / 32767.0f; };
+            float lx = axis(SDL_GAMEPAD_AXIS_LEFTX), ly = -axis(SDL_GAMEPAD_AXIS_LEFTY);  // XInput: up is positive
+            float rx = axis(SDL_GAMEPAD_AXIS_RIGHTX), ry = -axis(SDL_GAMEPAD_AXIS_RIGHTY);
+            const float lt = axis(SDL_GAMEPAD_AXIS_LEFT_TRIGGER), rt = axis(SDL_GAMEPAD_AXIS_RIGHT_TRIGGER);
+            ApplyDeadzone(lx, ly, deadzone);
+            ApplyDeadzone(rx, ry, deadzone);
+            p.lx = ToShort(lx);
+            p.ly = ToShort(ly);
+            p.rx = ToShort(rx);
+            p.ry = ToShort(ry);
+            p.leftTrigger = Trigger(lt, triggerDeadzone);
+            p.rightTrigger = Trigger(rt, triggerDeadzone);
+            const int user = s_slots.NoteInput(o.id, p.buttons, lt > 0.5f || rt > 0.5f, now);
+            if (user != o.user)
+            {
+                fprintf(stderr, "[input] player %d: %s is XInput user %d\n", user + 1,
+                    SDL_GetGamepadName(o.gamepad) ? SDL_GetGamepadName(o.gamepad) : "a controller", user);
+                SDL_SetGamepadPlayerIndex(o.gamepad, user);  // a DualSense's player lights
+                o.user = user;
+            }
+            if (user && (p.buttons || p.leftTrigger || p.rightTrigger || p.lx || p.ly || p.rx || p.ry))
+            {
+                s_lastInput = std::chrono::steady_clock::now();
+                s_inputSeen = true;
+            }
+            // A menu of ours open: the game sees idle pads, and after it
+            // closes each button held stays hidden until released (Update's
+            // rule for player 1).
+            if (menuClosed)
+                o.latched = p.buttons;
+            o.latched &= p.buttons;
+            if (blocked)
+                p = Pad{};
+            else
+                p.buttons &= ~o.latched;
+            if (user && s_slots.Arriving(user, now))
+                p = Pad{};
+            else if (user && !blocked)
+                p.buttons = s_slots.Shown(user, p.buttons, now);  // (the press that made it a player, replayed whole)
+            if (user)
+                staged[user] = p;
+            for (int n = 1; n < kUsers; n++)
+                if (!padTaken[n].empty() && s_vpads[n].id == o.id)
+                    fprintf(stderr, "[input] virtual pad %d %s: %s%s, the game gets buttons %04X, left stick (%d, %d), triggers (%u, %u)%s\n",
+                        n + 1, padTaken[n].c_str(), user ? "XInput user " : "not a player yet", user ? std::to_string(user).c_str() : "",
+                        unsigned(p.buttons), int(p.lx), int(p.ly), unsigned(p.leftTrigger), unsigned(p.rightTrigger),
+                        blocked ? " (a menu is open)" : user && s_slots.Arriving(user, now) ? " (arriving: idle for now)" : "");
+        }
+
+        uint16_t low[kUsers] = {}, high[kUsers] = {};
+        bool dirty[kUsers] = {};
+        {
+            std::lock_guard lock(s_mutex);
+            for (int u = 1; u < kUsers; u++)
+            {
+                OtherUser& ou = s_users[u];
+                ou.connected = s_slots.Connected(u);
+                ou.pad = ou.connected ? staged[u] : Pad{};
+                if (!ou.connected)
+                    ou.rumbleLow = ou.rumbleHigh = 0;  // the next player's starts still
+                dirty[u] = ou.rumbleDirty || vibrationChanged;
+                ou.rumbleDirty = false;
+                low[u] = ou.rumbleLow;
+                high[u] = ou.rumbleHigh;
+            }
+        }
+        for (OtherPad& o : s_others)
+            if (o.user && dirty[o.user])
+            {
+                const uint16_t l = vibration ? low[o.user] : 0, h = vibration ? high[o.user] : 0;
+                if (s_virtualOnly)
+                {
+                    static uint64_t logged[kUsers] = { ~0ull, ~0ull, ~0ull, ~0ull };
+                    const uint64_t key = uint64_t(low[o.user]) << 17 | uint64_t(high[o.user]) << 1 | (vibration ? 1u : 0u);
+                    if (key != logged[o.user])
+                    {
+                        logged[o.user] = key;
+                        fprintf(stderr, "[input] rumble: user %d: game low %u, high %u; Vibration %s\n", o.user, unsigned(low[o.user]),
+                            unsigned(high[o.user]), vibration ? "on" : "off (the controller gets 0)");
+                    }
+                }
+                SDL_RumbleGamepad(o.gamepad, l, h, l || h ? 5000 : 0);
+            }
+    }
+}
+
 namespace hid
 {
     void Initialize()
@@ -512,6 +971,10 @@ namespace hid
         fprintf(stderr, "[input] stick deadzone %.2f, trigger deadzone %.2f\n", settings::GetFloat(settings::Id::StickDeadzone),
             settings::GetFloat(settings::Id::TriggerDeadzone));
         AttachVirtualPad();
+        // A steering wheel (hid/wheel.h), unless this run has the test's
+        // own controller: then that is the only device.
+        if (!s_virtualOnly)
+            wheel::Initialize();
         OpenFirstGamepad();
         std::lock_guard lock(s_mutex);
         s_deviceConnected = true;  // the keyboard always counts as controller 0
@@ -526,11 +989,14 @@ namespace hid
 
     void HandleEvent(const SDL_Event& e)
     {
+        wheel::HandleEvent(e);  // a wheel coming or going
         if (e.type == SDL_EVENT_GAMEPAD_ADDED)
         {
             OpenFirstGamepad();
+            if (s_slots.Split())
+                OpenOtherPad(e.gdevice.which);  // (unless it just became player 1's)
 #if defined(__APPLE__) && TARGET_OS_IOS
-            if (s_gamepad)
+            if (s_gamepad || wheel::Playing())
                 WithdrawNoControllerNotice();
 #endif
         }
@@ -540,11 +1006,15 @@ namespace hid
             s_gamepad = nullptr;
             fprintf(stderr, "[input] gamepad removed\n");
             OpenFirstGamepad();
+            if (!s_gamepad && s_slots.Split())
+                s_p1Lost = true;  // (Update's notices)
 #if defined(__APPLE__) && TARGET_OS_IOS
-            if (!s_gamepad)
+            if (!s_gamepad && !wheel::Playing())
                 NoControllerNoticeIn(1'000'000'000, kControllerGone);
 #endif
         }
+        else if (e.type == SDL_EVENT_GAMEPAD_REMOVED)
+            CloseOtherPad(e.gdevice.which, "removed");  // (split screen: another player's)
 #if defined(__APPLE__) && TARGET_OS_IOS
         else if (e.type == SDL_EVENT_KEYBOARD_ADDED)
             WithdrawNoControllerNotice();  // (a keyboard counts as a controller here)
@@ -553,12 +1023,24 @@ namespace hid
 
     void Shutdown()
     {
+        wheel::Shutdown();
         if (s_gamepad)
         {
             SDL_RumbleGamepad(s_gamepad, 0, 0, 0);
             SDL_CloseGamepad(s_gamepad);
             s_gamepad = nullptr;
         }
+        for (OtherPad& o : s_others)
+        {
+            SDL_RumbleGamepad(o.gamepad, 0, 0, 0);
+            SDL_CloseGamepad(o.gamepad);
+        }
+        s_others.clear();
+    }
+
+    bool IsOtherPlayersPad(SDL_JoystickID id)
+    {
+        return s_slots.UserOf(id) != 0;
     }
 
     void Suspend()
@@ -567,6 +1049,9 @@ namespace hid
         // stop it now rather than buzz on for a game that stands still.
         if (s_gamepad)
             SDL_RumbleGamepad(s_gamepad, 0, 0, 0);
+        for (OtherPad& o : s_others)
+            SDL_RumbleGamepad(o.gamepad, 0, 0, 0);
+        wheel::Suspend();
     }
 
     void Resume()
@@ -575,6 +1060,8 @@ namespace hid
         // Vibration setting allows.
         std::lock_guard lock(s_mutex);
         s_rumbleDirty = true;
+        for (OtherUser& ou : s_users)
+            ou.rumbleDirty = true;
     }
 
     double SecondsSinceInput()
@@ -598,23 +1085,35 @@ namespace hid
         float lx = 0, ly = 0, rx = 0, ry = 0, lt = 0, rt = 0;
         bool padBack = false;  // the controller's Back, as the device reports it
         float rawX = 0, rawY = 0;  // the left stick before its deadzone (NFSMW_INPUT_LOG)
-        const std::string padSteps = StepVirtualPad();
+        std::string padTaken[hid::PlayerSlots::kUsers];
+        StepVirtualPads(padTaken);
+        const std::string& padSteps = padTaken[0];
         const float deadzone = settings::GetFloat(settings::Id::StickDeadzone);
         const float triggerDeadzone = settings::GetFloat(settings::Id::TriggerDeadzone);
-        if (s_gamepad)
+        // A steering wheel first, while one is plugged in and Settings >
+        // Wheel has it on: it brings its own steering curve and its pedals
+        // their own calibration (hid/wheel_map.h), so the stick's radial
+        // deadzone has nothing to do here. Its paddles push the right stick
+        // up and down, which is how the game shifts gears.
+        wheel::Reading wheelRead;
+        const bool onWheel = wheel::Sample(wheelRead);
+        bool lxFromWheel = onWheel;  // ...unless the keyboard sets it below
+        if (onWheel)
         {
-            static const std::pair<SDL_GamepadButton, uint16_t> map[] = {
-                { SDL_GAMEPAD_BUTTON_SOUTH, XAMINPUT_GAMEPAD_A }, { SDL_GAMEPAD_BUTTON_EAST, XAMINPUT_GAMEPAD_B },
-                { SDL_GAMEPAD_BUTTON_WEST, XAMINPUT_GAMEPAD_X }, { SDL_GAMEPAD_BUTTON_NORTH, XAMINPUT_GAMEPAD_Y },
-                { SDL_GAMEPAD_BUTTON_BACK, XAMINPUT_GAMEPAD_BACK }, { SDL_GAMEPAD_BUTTON_START, XAMINPUT_GAMEPAD_START },
-                { SDL_GAMEPAD_BUTTON_LEFT_STICK, XAMINPUT_GAMEPAD_LEFT_THUMB },
-                { SDL_GAMEPAD_BUTTON_RIGHT_STICK, XAMINPUT_GAMEPAD_RIGHT_THUMB },
-                { SDL_GAMEPAD_BUTTON_LEFT_SHOULDER, XAMINPUT_GAMEPAD_LEFT_SHOULDER },
-                { SDL_GAMEPAD_BUTTON_RIGHT_SHOULDER, XAMINPUT_GAMEPAD_RIGHT_SHOULDER },
-                { SDL_GAMEPAD_BUTTON_DPAD_UP, XAMINPUT_GAMEPAD_DPAD_UP }, { SDL_GAMEPAD_BUTTON_DPAD_DOWN, XAMINPUT_GAMEPAD_DPAD_DOWN },
-                { SDL_GAMEPAD_BUTTON_DPAD_LEFT, XAMINPUT_GAMEPAD_DPAD_LEFT }, { SDL_GAMEPAD_BUTTON_DPAD_RIGHT, XAMINPUT_GAMEPAD_DPAD_RIGHT },
-            };
-            for (auto& [button, bit] : map)
+            p.buttons = uint16_t(wheelRead.buttons & ~uint16_t(XAMINPUT_GAMEPAD_BACK));
+            padBack = wheelRead.back;
+            if (PadBackForGame(padBack, wheelRead.start))
+                p.buttons |= XAMINPUT_GAMEPAD_BACK;
+            lx = wheelRead.stick;  // past the game's own steering deadzone (wheel_map.h)
+            ry = float(wheelRead.rightY) / 32767.0f;
+            lt = wheelRead.brake;
+            rt = wheelRead.throttle;
+            rawX = wheelRead.steer;  // NFSMW_INPUT_LOG: the wheel's steering, then the stick the game gets
+            rawY = ly;
+        }
+        else if (s_gamepad)
+        {
+            for (auto& [button, bit] : kButtonMap)
                 if (bit != XAMINPUT_GAMEPAD_BACK && SDL_GetGamepadButton(s_gamepad, button))
                     p.buttons |= bit;
             padBack = SDL_GetGamepadButton(s_gamepad, SDL_GAMEPAD_BUTTON_BACK);
@@ -658,6 +1157,8 @@ namespace hid
             for (size_t a = 0; a < size_t(keymap::Axis::Count); a++)
                 if (r.axisSet[a])
                     *axes[a] = r.axis[a];
+            if (r.axisSet[size_t(keymap::Axis::LX)])
+                lxFromWheel = false;
         }
         p.lx = ToShort(lx);
         p.ly = ToShort(ly);
@@ -665,7 +1166,7 @@ namespace hid
         p.ry = ToShort(ry);
         p.leftTrigger = Trigger(lt, triggerDeadzone);
         p.rightTrigger = Trigger(rt, triggerDeadzone);
-        if (s_gamepad)
+        if (s_gamepad || onWheel)
             LogStick(rawX, rawY, lx, ly, rawLt, rawRt, p.leftTrigger, p.rightTrigger);
         if (!padSteps.empty())
             fprintf(stderr, "[input] virtual pad %s: left stick raw (%+.4f, %+.4f) -> game (%d, %d), right (%d, %d); "
@@ -679,6 +1180,12 @@ namespace hid
         {
             Pad scripted = p;
             ApplyScript(scripted);
+            // A wheel's steering counts when it turns, not for resting a little
+            // off its centre: without a deadzone it is rarely exactly 0, and the
+            // controls never read idle with a wheel plugged in.
+            const bool wheelTurned = onWheel && s_wheelStill.Turned(wheelRead.steer);
+            if (lxFromWheel && !wheelTurned && scripted.lx == p.lx)
+                scripted.lx = 0;
             if (scripted.buttons || scripted.leftTrigger || scripted.rightTrigger || scripted.lx || scripted.ly || scripted.rx ||
                 scripted.ry || !s_inputSeen)
             {
@@ -691,11 +1198,14 @@ namespace hid
         // closes, each button still held stays hidden until released, so the
         // press that closed the menu (B, Start, Esc) doesn't reach the game.
         bool blocked = s_blocked.load(std::memory_order_relaxed);
+        const bool menuClosed = s_wasBlocked && !blocked;
         if (s_wasBlocked && !blocked)
             s_latchedButtons = p.buttons;
         // A Back pressed in the menu (or the one that closed it) is never replayed.
         if ((blocked || s_wasBlocked) && padBack)
             s_backState = BackState::Swallow;
+        if (blocked != s_wasBlocked)
+            wheel::NoteMenu(blocked);  // a wheel's state in the log at every menu (nothing without one)
         s_wasBlocked = blocked;
         s_latchedButtons &= p.buttons;
         if (blocked)
@@ -715,12 +1225,14 @@ namespace hid
             high = s_rumbleHigh;
         }
         static bool vibration = true;
+        bool vibrationChanged = false;
         if (bool on = settings::GetBool(settings::Id::Vibration); on != vibration)
         {
             vibration = on;
             rumble = true;  // stop (or restart) a rumble under way
+            vibrationChanged = true;
         }
-        if (rumble && s_virtualPad)
+        if (rumble && s_vpads[0].joystick)
         {
             // What the game asked for and what the controller gets, on
             // change. Only with the test's pad: while driving the game
@@ -739,6 +1251,13 @@ namespace hid
             low = high = 0;
         if (rumble && s_gamepad)
             SDL_RumbleGamepad(s_gamepad, low, high, low || high ? 5000 : 0);
+        // The wheel's own force feedback: every frame, since Settings >
+        // Wheel > Force Feedback and Centering Force can change under it
+        // without the game asking for anything new.
+        wheel::Rumble(low, high, vibration);
+        wheel::Update();
+
+        UpdateOtherPlayers(blocked, menuClosed, deadzone, triggerDeadzone, vibration, vibrationChanged, padTaken);
     }
 }
 
@@ -835,9 +1354,26 @@ namespace
     }
 }
 
+// Users 1-3: the other players' controllers, connected only in split screen
+// (hid/player_slots.h); user 0 and 0xFF ("any"): player 1, as before.
+namespace
+{
+    bool OtherUserConnected(uint32_t userIndex)
+    {
+        std::lock_guard lock(s_mutex);
+        return s_users[userIndex].connected;
+    }
+}
+
 uint32_t XamInputGetCapabilities(uint32_t userIndex, uint32_t flags, XAMINPUT_CAPABILITIES* caps)
 {
     bool scripted = !s_script.empty();
+    if (userIndex >= 1 && userIndex < uint32_t(hid::PlayerSlots::kUsers))
+    {
+        if (!OtherUserConnected(userIndex))
+            return ERROR_DEVICE_NOT_CONNECTED;
+    }
+    else
     {
         std::lock_guard lock(s_mutex);
         if ((userIndex != 0 && userIndex != 0xFF) || !(s_deviceConnected || scripted))
@@ -860,6 +1396,26 @@ uint32_t XamInputGetState(uint32_t userIndex, uint32_t flags, XAMINPUT_STATE* st
 {
     Pad p;
     uint32_t packet;
+    if (userIndex >= 1 && userIndex < uint32_t(hid::PlayerSlots::kUsers))
+    {
+        std::lock_guard lock(s_mutex);
+        OtherUser& ou = s_users[userIndex];
+        if (ou.connected != ou.told)
+        {
+            ou.told = ou.connected;
+            fprintf(stderr, "[input] the game sees XInput user %u %s\n", userIndex, ou.connected ? "connected" : "not connected");
+        }
+        if (!ou.connected)
+            return ERROR_DEVICE_NOT_CONNECTED;
+        p = ou.pad;
+        if (memcmp(&p, &ou.last, sizeof(p)) != 0)
+        {
+            ou.packet++;
+            ou.last = p;
+        }
+        packet = ou.packet;
+    }
+    else
     {
         std::lock_guard lock(s_mutex);
         if ((userIndex != 0 && userIndex != 0xFF) || !(s_deviceConnected || !s_script.empty()))
@@ -887,6 +1443,16 @@ uint32_t XamInputGetState(uint32_t userIndex, uint32_t flags, XAMINPUT_STATE* st
 uint32_t XamInputSetState(uint32_t userIndex, uint32_t flags, XAMINPUT_VIBRATION* vibration)
 {
     std::lock_guard lock(s_mutex);
+    if (userIndex >= 1 && userIndex < uint32_t(hid::PlayerSlots::kUsers))
+    {
+        OtherUser& ou = s_users[userIndex];
+        if (!ou.connected)
+            return ERROR_DEVICE_NOT_CONNECTED;
+        ou.rumbleLow = ByteSwap(vibration->wLeftMotorSpeed);
+        ou.rumbleHigh = ByteSwap(vibration->wRightMotorSpeed);
+        ou.rumbleDirty = true;
+        return ERROR_SUCCESS;
+    }
     if ((userIndex != 0 && userIndex != 0xFF) || !(s_deviceConnected || !s_script.empty()))
         return ERROR_DEVICE_NOT_CONNECTED;
     s_rumbleLow = ByteSwap(vibration->wLeftMotorSpeed);
diff --git a/runtime/hid/input.h b/runtime/hid/input.h
index 1b3d546..65ffacb 100644
--- a/runtime/hid/input.h
+++ b/runtime/hid/input.h
@@ -3,6 +3,17 @@
 // Controller input (Phase 6): SDL3 gamepads and the keyboard, presented to
 // the game as XInput controller 0 through XamInputGetState.
 //
+//   - Split screen (game/split_screen.h; the rule is hid/player_slots.h):
+//     while the game is in Quick Race > Split Screen, every other controller
+//     is opened, and each one used becomes XInput user 1 (then 2, 3) with its
+//     own state and rumble; player 1 stays user 0, the keyboard and the
+//     controller that drove the menus. Outside split screen users 1-3 read
+//     not connected and only that one controller is opened, as before. Our
+//     menu's Back + Start is player 1's (IsOtherPlayersPad). A pad unplugged
+//     reads not connected (the game's own message). NFSMW_OTHER_PADS=always
+//     exposes them outside split screen too (a diagnostic);
+//     NFSMW_SPLIT_SCREEN=0, never.
+//
 //   - Sticks get a radial deadzone with rescaling (Settings > Input, or
 //     NFSMW_DEADZONE; default 0.08 of full deflection), so worn or drifting
 //     sticks rest at exactly zero while small movements still ramp up
@@ -14,6 +25,11 @@
 //     stick too, W/S = gas/brake (RT/LT), Space = A, Backspace = B,
 //     Left Shift = X, Left Ctrl = Y, Q/E = LB/RB, Enter = START, Esc = BACK,
 //     O/L/K/; = right stick, Z/C = the stick clicks. A key may drive several.
+//   - A USB steering wheel (hid/wheel.h and hid/wheel_map.h, Settings >
+//     Wheel) is used instead of a controller while one is plugged in: its
+//     own steering curve reaches the left stick, its pedals the triggers
+//     and its paddles the right stick, so the stick deadzone above is not
+//     applied to it. Its force feedback takes the rumble the game asks for.
 //   - NFSMW_INPUT_SCRIPT="12:START,15.5:A,30-90/4:DOWN,100~160:RT": taps
 //     (150 ms) at seconds since launch, taps every `step` seconds over a
 //     range, or inputs held over a range; RT/LT (triggers) and LL/LR/LU/LD
@@ -26,6 +42,9 @@
 //     "6:DOWN" for a tap), which reach the menus as a real controller's do.
 //     Both count seconds of guest time (cpu/guest_time.h): a suspension
 //     doesn't count, so what falls due during one happens after it.
+//     NFSMW_VIRTUAL_PAD_2 (_3, _4), the same syntax plus "40:DETACH" and
+//     "50:ATTACH" (unplug, plug in again): more virtual controllers, for
+//     split-screen tests.
 //   - NFSMW_INPUT_LOG=1: the left stick and triggers once a second, raw and
 //     as the game gets them.
 //   - iOS: with no controller (and no keyboard attached) a toast says the
@@ -54,6 +73,9 @@ namespace hid
     double SecondsSinceInput();
     // At exit: stop any rumble (the process may outlive nothing that would).
     void Shutdown();
+    // Main thread: the controller is another player's in split screen (XInput
+    // user 1-3), so our menu's Back + Start chord isn't its to fire.
+    bool IsOtherPlayersPad(SDL_JoystickID id);
     // Main thread, from the frame loop (not UIKit's callback), once the game
     // is suspended (iOS: the app isn't active) and once it's back: Suspend
     // stops any rumble, Resume sends the game's last request again.
diff --git a/runtime/hid/player_slots.h b/runtime/hid/player_slots.h
new file mode 100644
index 0000000..2d62e2c
--- /dev/null
+++ b/runtime/hid/player_slots.h
@@ -0,0 +1,187 @@
+// SpeedBreaker runtime. GPL-3.0-or-later (see COPYING).
+//
+// Which controller is which player in split screen (game/split_screen.h),
+// apart from SDL so tests/player_slots_test.cpp can drive it alone; header
+// only. hid/input.cpp keeps the SDL side. Pads are SDL joystick ids. Player
+// 1 is XInput user 0: the keyboard and the controller that has been driving
+// the game (input.cpp's first gamepad, as in single player), never one of
+// these.
+//
+//   - Split mode follows the game's own predicate: on the moment the game
+//     says split screen (Quick Race > Split Screen chosen, before "Player 2
+//     press START"), off kLeaveNs after it last did, so a flicker between
+//     screens changes nothing.
+//   - Outside split mode no other controller is a player: XInput users 1-3
+//     read not connected, as in v0.1.7. Single player sees one controller,
+//     so a second pad can't take over the title screen's "press START" (the
+//     game makes whichever port presses it the active one) or anything else.
+//   - In split mode a pad becomes a player the first time it is used (a
+//     button, or a trigger pressed past half): the lowest free user 1-3, kept
+//     while it stays connected. The game then does the rest: the first START
+//     from a port other than player 1's at "Player 2 press START" is player 2
+//     (FEDatabase byte 13). A pad that never sends input (Steam Input's or a
+//     receiver's phantom devices) never takes a user.
+//   - The press that made it a player still reaches the game, as one press:
+//     its user reads connected and idle for kArrivalNs, then the buttons
+//     that made it one held for at least kReplayNs (Shown), then the pad.
+//     The game ignores a press already down when a port connects (its
+//     PLUGGED flush sets each control's previous value to -1, and a press
+//     needs a previous value in [0, 0.5): two polls after the connection),
+//     and "Player 2 press START" (sub_825696C8) takes START's release
+//     (PAD_START_RELEASED): so a tap shorter than the idle time is still a
+//     press and a release.
+//   - Removed (unplugged, Bluetooth gone): its user reads not connected, and
+//     the game's own handling takes over (in a race it pauses under a bare
+//     PAUSE banner: on a 360 the console's own overlay said what to do), and
+//     the user is Missing until a pad takes it again (input.cpp shows a
+//     notice meanwhile); plugged in again it takes the lowest free user, its
+//     old one unless another pad took it meanwhile.
+//   - Leaving split mode frees every user (input.cpp closes those pads).
+#pragma once
+#include <algorithm>
+#include <cstdint>
+#include <vector>
+
+namespace hid
+{
+    class PlayerSlots
+    {
+    public:
+        static constexpr int kUsers = 4;                       // XInput users 0-3; 0 is player 1
+        static constexpr int64_t kLeaveNs = 2'000'000'000;     // split mode ends this long after the game's predicate
+        static constexpr int64_t kArrivalNs = 50'000'000;      // a new player's user reads idle this long first
+        static constexpr int64_t kReplayNs = 100'000'000;      // then the buttons that made it one, at least this long
+
+        // Once a frame, with the game's predicate (guest ns). Returns the
+        // mode; Changed() says whether this call changed it. Leaving frees
+        // every user and forgets which pads were used.
+        bool NoteSplit(bool predicate, int64_t now)
+        {
+            m_changed = false;
+            if (predicate)
+            {
+                m_lastSaid = now;
+                if (!m_split)
+                    m_split = m_changed = true;
+            }
+            else if (m_split && now - m_lastSaid >= kLeaveNs)
+            {
+                m_split = false;
+                m_changed = true;
+                m_pads.clear();
+                m_missing = 0;
+            }
+            return m_split;
+        }
+        bool Split() const { return m_split; }
+        bool Changed() const { return m_changed; }
+
+        // A pad's input now: its buttons (XInput bits), and whether a
+        // trigger is past half. Returns its user (0: none). A pad not known
+        // yet is added.
+        int NoteInput(uint32_t pad, uint16_t buttons, bool trigger, int64_t now)
+        {
+            Entry& e = Find(pad);
+            if (buttons || trigger)
+                e.used = true;
+            if (m_split && e.used && e.user == 0)
+                for (int u = 1; u < kUsers; u++)
+                    if (!Connected(u))
+                    {
+                        e.user = u;
+                        e.since = now;
+                        e.arrival = buttons;
+                        m_missing &= ~(1u << u);
+                        break;
+                    }
+            return e.user;
+        }
+
+        // The pad is gone (removed or closed). Returns the user it had (0: none).
+        int Remove(uint32_t pad)
+        {
+            for (size_t i = 0; i < m_pads.size(); i++)
+                if (m_pads[i].pad == pad)
+                {
+                    const int user = m_pads[i].user;
+                    m_pads.erase(m_pads.begin() + std::ptrdiff_t(i));
+                    if (m_split && user != 0)
+                        m_missing |= 1u << user;
+                    return user;
+                }
+            return 0;
+        }
+
+        // User `user` (1-3) lost its pad in split screen and no pad has taken
+        // it since (a notice says to reconnect it).
+        bool Missing(int user) const { return user > 0 && user < kUsers && ((m_missing >> user) & 1) != 0; }
+
+        int UserOf(uint32_t pad) const
+        {
+            for (const Entry& e : m_pads)
+                if (e.pad == pad)
+                    return e.user;
+            return 0;
+        }
+
+        // User `user` (1-3): whether a pad is it; its pad (0: none); whether
+        // it is still arriving (reads idle).
+        bool Connected(int user) const { return Has(user); }
+        uint32_t PadOf(int user) const
+        {
+            for (const Entry& e : m_pads)
+                if (e.user == user && user != 0)
+                    return e.pad;
+            return 0;
+        }
+        bool Arriving(int user, int64_t now) const
+        {
+            for (const Entry& e : m_pads)
+                if (e.user == user && user != 0)
+                    return now - e.since < kArrivalNs;
+            return false;
+        }
+        // The buttons user `user` shows the game, its pad's being `buttons`:
+        // none while arriving, then the arrival press held to kReplayNs.
+        uint16_t Shown(int user, uint16_t buttons, int64_t now) const
+        {
+            for (const Entry& e : m_pads)
+                if (e.user == user && user != 0)
+                {
+                    if (now - e.since < kArrivalNs)
+                        return 0;
+                    if (now - e.since < kArrivalNs + kReplayNs)
+                        return uint16_t(buttons | e.arrival);
+                    return buttons;
+                }
+            return buttons;
+        }
+
+    private:
+        struct Entry
+        {
+            uint32_t pad = 0;
+            bool used = false;
+            int user = 0;
+            int64_t since = 0;
+            uint16_t arrival = 0;  // the buttons down when it became a player
+        };
+        std::vector<Entry> m_pads;
+        bool m_split = false, m_changed = false;
+        uint32_t m_missing = 0;  // users whose pad went in split screen, not taken since
+        int64_t m_lastSaid = 0;
+
+        Entry& Find(uint32_t pad)
+        {
+            for (Entry& e : m_pads)
+                if (e.pad == pad)
+                    return e;
+            m_pads.push_back(Entry{ pad });
+            return m_pads.back();
+        }
+        bool Has(int user) const
+        {
+            return user != 0 && std::any_of(m_pads.begin(), m_pads.end(), [user](const Entry& e) { return e.user == user; });
+        }
+    };
+}
diff --git a/runtime/hid/wheel.cpp b/runtime/hid/wheel.cpp
new file mode 100644
index 0000000..03814fd
--- /dev/null
+++ b/runtime/hid/wheel.cpp
@@ -0,0 +1,1116 @@
+// SpeedBreaker runtime. GPL-3.0-or-later (see COPYING). See wheel.h.
+#include "wheel.h"
+#include "key_map.h"
+#include "wheel_map.h"
+
+#include <user/settings.h>
+
+#include <algorithm>
+#include <array>
+#include <chrono>
+#include <cmath>
+#include <cstdio>
+#include <cstdlib>
+#include <format>
+#include <string>
+#include <vector>
+
+#include <SDL3/SDL_haptic.h>
+#include <SDL3/SDL_joystick.h>
+#include <SDL3/SDL_timer.h>
+
+// wheel_map.h names XInput's bits as literals (it has no kernel header), as
+// key_map.h does; input.cpp checks key_map.h's against the bits the game
+// reads, so agreeing with it is enough.
+static_assert(hid::wheelmap::button::DpadUp == hid::keymap::button::DpadUp &&
+    hid::wheelmap::button::DpadDown == hid::keymap::button::DpadDown &&
+    hid::wheelmap::button::DpadLeft == hid::keymap::button::DpadLeft &&
+    hid::wheelmap::button::DpadRight == hid::keymap::button::DpadRight &&
+    hid::wheelmap::button::Start == hid::keymap::button::Start && hid::wheelmap::button::Back == hid::keymap::button::Back &&
+    hid::wheelmap::button::LeftThumb == hid::keymap::button::LeftThumb &&
+    hid::wheelmap::button::RightThumb == hid::keymap::button::RightThumb &&
+    hid::wheelmap::button::LeftShoulder == hid::keymap::button::LeftShoulder &&
+    hid::wheelmap::button::RightShoulder == hid::keymap::button::RightShoulder &&
+    hid::wheelmap::button::A == hid::keymap::button::A && hid::wheelmap::button::B == hid::keymap::button::B &&
+    hid::wheelmap::button::X == hid::keymap::button::X && hid::wheelmap::button::Y == hid::keymap::button::Y,
+    "wheel_map.h's button bits are key_map.h's, and so XInput's");
+// ...and its hat bits are SDL's.
+static_assert(hid::wheelmap::hat::Centred == SDL_HAT_CENTERED && hid::wheelmap::hat::Up == SDL_HAT_UP &&
+    hid::wheelmap::hat::Right == SDL_HAT_RIGHT && hid::wheelmap::hat::Down == SDL_HAT_DOWN &&
+    hid::wheelmap::hat::Left == SDL_HAT_LEFT, "wheel_map.h's hat bits are SDL's");
+
+namespace hid::wheel
+{
+    namespace
+    {
+        using wheelmap::Axes;
+        using wheelmap::Binding;
+
+        // A device reports at most this many buttons to us; the wheels we
+        // know report 25 (a G29 with a shifter attached).
+        constexpr int kMaxButtons = 64;
+        static_assert(size_t(kMaxButtons) == wheelmap::kCalibrateButtons, "Calibrate watches every button read");
+
+        bool s_started = false;
+        SDL_Joystick* s_joystick = nullptr;
+        SDL_JoystickID s_id = 0;
+        std::string s_name;
+        const wheelmap::Model* s_model = nullptr;
+        std::vector<Binding> s_bindings;
+        Axes s_axes;
+        wheelmap::Steering s_steering;  // the wheel's two ends, measured or assumed
+        wheelmap::Pedal s_pedals[3];  // in Step order: Throttle, Brake, Clutch
+        int s_fullTurn = 0;           // degrees lock to lock, 0: unknown
+        // The axes' resting places are read again on the first frame after
+        // the device was opened: a joystick SDL has not polled yet reads 0
+        // on every axis, and a pedal taken to rest at 0 when it really
+        // rests at one end would hold the throttle down.
+        bool s_restAgain = false;
+        // Which axes SDL has reported a value for. It sends an axis only
+        // when it moves, so everything reads 0 until something does: a
+        // reading from an axis that has never spoken means nothing.
+        std::vector<bool> s_axisSeen;
+
+        SDL_Haptic* s_haptic = nullptr;
+        bool s_canAutocentre = false;  // the wheel takes an autocentre level
+        bool s_canSpring = false;      // ...or a spring effect
+        bool s_canHapticRumble = false;  // SDL's own rumble: only where the wheel can't play a sine
+        bool s_canKnock = false;         // it plays a sine of ours: the knocks (wheel_map.h's Knock)
+        bool s_canJoystickRumble = false;
+        bool s_onlyOneEffect = false;  // a rumble would stop the centring: the centring wins
+        SDL_HapticEffectID s_spring = -1;
+        wheelmap::Centring s_centring;  // when the wheel is told its centring force (wheel_map.h)
+        bool s_reported = false;        // the wheel has sent an event (SDL's driver has cleared its autocentre)
+        Uint64 s_centringLogAt = 0;     // the per-minute count's last line (SDL ticks)
+        int s_centringLogged = 0;       // ...and s_centring.sends then
+        float s_rumble = 0.0f;         // what it was last told to play
+        // The knocks (wheel_map.h's Knock): the sine, made at the first one
+        // and kept, and what the one under way has done, for its log line.
+        SDL_HapticEffectID s_knockEffect = -1;
+        wheelmap::Knock s_knock;
+        Uint64 s_knockFrameNs = 0;   // the last frame's time (SDL_GetTicksNS)
+        Uint64 s_knockStartNs = 0;
+        float s_knockPeak = 0.0f;
+        int s_knockChanges = 0;
+        bool s_knockSustained = false;  // this knock became a long rumble (eased)
+        int s_knocks = 0;  // since the wheel opened: each one's log line has its number
+
+        const bool s_log = std::getenv("NFSMW_WHEEL_LOG") != nullptr;
+
+        // A pedal step's place in s_pedals, and back: slot 0 is the throttle,
+        // 1 the brake, 2 the clutch (wheel_map.h; Step starts with the wheel's
+        // two ends, so a slot is not a Step by itself).
+        int Slot(Step step) { return wheelmap::PedalSlot(step); }
+        using wheelmap::PedalStep;
+
+        settings::Id AxisOption(Step step)
+        {
+            switch (step)
+            {
+            case Step::Throttle: return settings::Id::WheelThrottleAxis;
+            case Step::Brake: return settings::Id::WheelBrakeAxis;
+            case Step::Clutch: return settings::Id::WheelClutchAxis;
+            default: return settings::Id::WheelSteerAxis;
+            }
+        }
+
+        settings::Id RestOption(Step step)
+        {
+            switch (step)
+            {
+            case Step::Brake: return settings::Id::BrakeRest;
+            case Step::Clutch: return settings::Id::ClutchRest;
+            default: return settings::Id::ThrottleRest;
+            }
+        }
+
+        settings::Id FullOption(Step step)
+        {
+            switch (step)
+            {
+            case Step::Brake: return settings::Id::BrakeFull;
+            case Step::Clutch: return settings::Id::ClutchFull;
+            default: return settings::Id::ThrottleFull;
+            }
+        }
+
+        // The setting holding the button given to a pad control; they run in
+        // Control order from ButtonA, as the static_assert below checks.
+        settings::Id ButtonOption(wheelmap::Control control)
+        {
+            return settings::Id(size_t(settings::Id::ButtonA) + size_t(control));
+        }
+        static_assert(size_t(settings::Id::ButtonShiftDown) - size_t(settings::Id::ButtonA) + 1 == wheelmap::kControlCount,
+            "one Button option per wheel_map.h Control, in Control order");
+
+        int AxisOf(Step step)
+        {
+            switch (step)
+            {
+            case Step::Throttle: return s_axes.throttle;
+            case Step::Brake: return s_axes.brake;
+            case Step::Clutch: return s_axes.clutch;
+            default: return s_axes.steer;
+            }
+        }
+
+        // What Calibrate recorded for each control, in Control order.
+        std::array<int, wheelmap::kControlCount> StoredButtons()
+        {
+            std::array<int, wheelmap::kControlCount> out{};
+            for (size_t i = 0; i < wheelmap::kControlCount; i++)
+                out[i] = settings::GetInt(ButtonOption(wheelmap::Control(i)));
+            return out;
+        }
+
+        int16_t AxisNow(int axis)
+        {
+            if (!s_joystick || axis < 0)
+                return 0;
+            return SDL_GetJoystickAxis(s_joystick, axis);
+        }
+
+        // Where every axis is now, which is where they rest when the device
+        // has just been opened.
+        std::vector<int16_t> AxisStates(bool initial)
+        {
+            std::vector<int16_t> values;
+            if (!s_joystick)
+                return values;
+            const int count = std::max(0, SDL_GetNumJoystickAxes(s_joystick));
+            values.resize(size_t(count));
+            for (int a = 0; a < count; a++)
+            {
+                Sint16 state = 0;
+                // The state SDL saw when the device turned up, which a pedal
+                // hasn't had a chance to move yet; failing that, now's.
+                if (!initial || !SDL_GetJoystickAxisInitialState(s_joystick, a, &state))
+                    state = SDL_GetJoystickAxis(s_joystick, a);
+                values[size_t(a)] = state;
+            }
+            return values;
+        }
+
+        // The axes the player assigned (Settings > Wheel > Calibrate); -1 each
+        // where they haven't.
+        Axes StoredAxes()
+        {
+            return { settings::GetInt(settings::Id::WheelSteerAxis), settings::GetInt(settings::Id::WheelThrottleAxis),
+                     settings::GetInt(settings::Id::WheelBrakeAxis), settings::GetInt(settings::Id::WheelClutchAxis) };
+        }
+
+        // Which axis is which, and each pedal's resting place: the model's
+        // idea, checked against where the axes rest, with the player's own
+        // assignments on top of both.
+        void Calibrate(bool initial)
+        {
+            const std::vector<int16_t> rest = AxisStates(initial);
+            bool anySeen = false;
+            for (size_t a = 0; a < s_axisSeen.size(); a++)
+                anySeen = anySeen || s_axisSeen[a];
+            const Axes stored = StoredAxes();
+            Axes preferred = s_model->axes;
+            if (stored.steer >= 0) preferred.steer = stored.steer;
+            if (stored.throttle >= 0) preferred.throttle = stored.throttle;
+            if (stored.brake >= 0) preferred.brake = stored.brake;
+            if (stored.clutch >= 0) preferred.clutch = stored.clutch;
+            // Where the axes rest only means something once they have
+            // reported: before that, the model's own layout is all there is.
+            s_axes = anySeen ? wheelmap::Detect(rest, preferred) : preferred;
+            // The player's assignments are not guesses: they stand.
+            if (stored.steer >= 0) s_axes.steer = stored.steer;
+            if (stored.throttle >= 0) s_axes.throttle = stored.throttle;
+            if (stored.brake >= 0) s_axes.brake = stored.brake;
+            if (stored.clutch >= 0) s_axes.clutch = stored.clutch;
+            // The wheel's two ends: both as Calibrate measured them, else
+            // the axis as it comes. Both have to be there - one alone would
+            // put the centre halfway to nowhere.
+            const int16_t left = int16_t(settings::GetInt(settings::Id::SteerLeft));
+            const int16_t right = int16_t(settings::GetInt(settings::Id::SteerRight));
+            if (left != right && left != 0 && right != 0)
+                s_steering.Start(left, right);
+            else
+                s_steering.Start(-wheelmap::kAxisMax, wheelmap::kAxisMax);
+            // Each pedal's axis and the span it runs over: what Calibrate
+            // measured, else what this wheel's model says its pedals do,
+            // else the axis itself once it has reported (its far end being
+            // as far as it can go). Without any of those it reads nothing,
+            // rather than reading as pressed.
+            struct Plan { int axis = -1; int16_t rest = 0, full = 0; bool known = false; };
+            Plan plan[3];
+            for (Step step : { Step::Throttle, Step::Brake, Step::Clutch })
+            {
+                Plan& it = plan[Slot(step)];
+                it.axis = AxisOf(step);
+                if (it.axis < 0 || size_t(it.axis) >= rest.size())
+                {
+                    it.axis = -1;
+                    continue;
+                }
+                const int16_t storedRest = int16_t(settings::GetInt(RestOption(step)));
+                const int16_t storedFull = int16_t(settings::GetInt(FullOption(step)));
+                if (storedRest != storedFull)
+                    it = { it.axis, storedRest, storedFull, true };
+                else if (s_model->pedalRest != s_model->pedalFull)
+                    it = { it.axis, s_model->pedalRest, s_model->pedalFull, true };
+                else if (size_t(it.axis) < s_axisSeen.size() && s_axisSeen[size_t(it.axis)])
+                {
+                    const int16_t at = rest[size_t(it.axis)];
+                    it = { it.axis, at, int16_t(at >= 0 ? -32768 : 32767), true };
+                }
+            }
+            // No two controls may read one axis the same way: that is how a
+            // calibration gone wrong has one pedal working two of the
+            // game's, while the other pedal does nothing at all. Two pedals
+            // sharing an axis is allowed only where their spans run
+            // opposite ways, which is how a wheel with both on one axis
+            // reports them. The wheel's own axis is never a pedal.
+            for (int a = 0; a < 3; a++)
+            {
+                if (plan[a].axis >= 0 && plan[a].axis == s_axes.steer)
+                {
+                    fprintf(stderr, "[wheel] %s is on the wheel's own axis %d: ignored\n", StepName(PedalStep(a)), plan[a].axis);
+                    plan[a] = {};
+                }
+                for (int b = a + 1; b < 3; b++)
+                {
+                    if (plan[a].axis < 0 || plan[a].axis != plan[b].axis)
+                        continue;
+                    const bool opposite = plan[a].known && plan[b].known &&
+                        (plan[a].full > plan[a].rest) != (plan[b].full > plan[b].rest);
+                    if (opposite)
+                        continue;  // one axis, one each way: both are real
+                    fprintf(stderr, "[wheel] %s and %s both read axis %d the same way: %s dropped (calibrate it)\n",
+                        StepName(PedalStep(a)), StepName(PedalStep(b)), plan[a].axis, StepName(PedalStep(b)));
+                    plan[b] = {};
+                    settings::Set(AxisOption(PedalStep(b)), -1);  // so it doesn't come back next run
+                }
+            }
+            for (Step step : { Step::Throttle, Step::Brake, Step::Clutch })
+            {
+                const Plan& it = plan[Slot(step)];
+                s_pedals[Slot(step)] = {};  // not ready: reads nothing
+                if (it.axis >= 0 && it.known)
+                    s_pedals[Slot(step)].Start(it.rest, it.full);
+            }
+            s_axes.throttle = plan[0].axis;
+            s_axes.brake = plan[1].axis;
+            s_axes.clutch = plan[2].axis;
+            // Each pedal's span as well as its axis: a pedal reading
+            // nothing, or reading backwards, shows here before anyone has
+            // to guess at it.
+            std::string pedals;
+            for (Step step : { Step::Throttle, Step::Brake, Step::Clutch })
+            {
+                const wheelmap::Pedal& it = s_pedals[Slot(step)];
+                pedals += std::format(", {} {}", StepName(step), AxisOf(step));
+                pedals += it.ready ? std::format(" ({:+d} to {:+d})", int(it.idle), int(it.full)) : std::string(" (not placed)");
+            }
+            fprintf(stderr, "[wheel] axes: steering %d%s (of %zu; rest", s_axes.steer, pedals.c_str(), rest.size());
+            for (int16_t v : rest)
+                fprintf(stderr, " %d", int(v));
+            fprintf(stderr, ")\n");
+        }
+
+        // The knock under way, in one line when it ends (every one: what the
+        // wheel did is what a tester's report is about). "up to" is the
+        // strength of a full rumble (Force Feedback applied), "force" the
+        // share of the wheel's own that the sine swung to.
+        void LogKnock(const char* how)
+        {
+            if (s_knockStartNs == 0)
+                return;
+            fprintf(stderr, "[wheel] knock %d: %.0f ms, up to %.0f%% (force %.0f%%, Force Feedback %d%%), %d changes%s, %s\n",
+                s_knocks, double(SDL_GetTicksNS() - s_knockStartNs) / 1e6, double(s_knockPeak) * 100.0,
+                double(s_knockPeak * wheelmap::kKnockGain) * 100.0, settings::GetInt(settings::Id::ForceFeedback), s_knockChanges,
+                s_knockSustained ? ", eased as a long rumble" : "", how);
+        }
+
+        void EndKnock(const char* how)
+        {
+            if (!s_knock.playing && s_knockStartNs == 0)
+                return;
+            if (s_haptic && s_knockEffect >= 0)
+                SDL_StopHapticEffect(s_haptic, s_knockEffect);
+            LogKnock(how);
+            s_knock = {};
+            s_knockStartNs = 0;
+            s_knockSustained = false;
+        }
+
+        // A frame of the knocks (wheel_map.h's Knock): the strength the game
+        // asks for now, at Settings > Wheel > Force Feedback.
+        void PlayKnock(float strength)
+        {
+            const Uint64 now = SDL_GetTicksNS();
+            const float ms = s_knockFrameNs ? float(double(now - s_knockFrameNs) / 1e6) : 0.0f;
+            s_knockFrameNs = now;
+            using Action = wheelmap::Knock::Action;
+            // (A long frame - a hitch, the menu - lets go of no more than 100 ms' worth.)
+            const bool wasSustained = s_knock.sustained;
+            const Action action = s_knock.Step(strength, std::min(ms, 100.0f));
+            if (s_knock.sustained && !wasSustained)
+            {
+                s_knockSustained = true;
+                fprintf(stderr, "[wheel] knock %d: a long rumble (asked for over %d ms, %.0f%% now): eased to %.0f%% of it\n",
+                    s_knocks, wheelmap::kKnockSustainMs, double(strength) * 100.0, double(wheelmap::kKnockSustainScale) * 100.0);
+            }
+            if (action == Action::None)
+                return;
+            if (action == Action::Stop)
+            {
+                EndKnock("let go");
+                return;
+            }
+            SDL_HapticEffect effect{};
+            effect.periodic.type = SDL_HAPTIC_SINE;
+            effect.periodic.direction.type = SDL_HAPTIC_CARTESIAN;
+            effect.periodic.direction.dir[0] = 1;  // along the wheel's one axis
+            effect.periodic.period = wheelmap::kKnockPeriodMs;
+            effect.periodic.magnitude = wheelmap::Knock::Magnitude(s_knock.level);
+            effect.periodic.length = SDL_HAPTIC_INFINITY;  // it plays until the knock is let go of
+            if (s_log)
+                fprintf(stderr, "[wheel] knock %s: magnitude %d\n", action == Action::Start ? "starts" : "changes",
+                    int(effect.periodic.magnitude));
+            if (action == Action::Change)
+            {
+                // In place: the driver keeps the sine where it is in its swing.
+                if (SDL_UpdateHapticEffect(s_haptic, s_knockEffect, &effect))
+                {
+                    s_knockChanges++;
+                    s_knockPeak = std::max(s_knockPeak, s_knock.level);
+                }
+                return;
+            }
+            // Start: made at the first knock and kept; each knock runs it from
+            // the start of its swing, where it pushes from nothing.
+            bool ok = s_knockEffect >= 0 ? SDL_UpdateHapticEffect(s_haptic, s_knockEffect, &effect)
+                                         : (s_knockEffect = SDL_CreateHapticEffect(s_haptic, &effect)) >= 0;
+            ok = ok && SDL_RunHapticEffect(s_haptic, s_knockEffect, 1);
+            if (!ok)
+            {
+                fprintf(stderr, "[wheel] knock failed: %s; SDL's rumble instead from now on\n", SDL_GetError());
+                if (s_knockEffect >= 0)
+                    SDL_DestroyHapticEffect(s_haptic, s_knockEffect);
+                s_knockEffect = -1;
+                s_knock = {};
+                s_canKnock = false;
+                s_canHapticRumble = SDL_InitHapticRumble(s_haptic);
+                return;
+            }
+            s_knockStartNs = now;
+            s_knockPeak = s_knock.level;
+            s_knockChanges = 0;
+            s_knockSustained = false;
+            s_knocks++;
+        }
+
+        void StopRumble()
+        {
+            s_rumble = 0.0f;
+            EndKnock("stopped");
+            if (s_haptic && s_canHapticRumble)
+                SDL_StopHapticRumble(s_haptic);
+            if (s_joystick && s_canJoystickRumble)
+                SDL_RumbleJoystick(s_joystick, 0, 0, 0);
+        }
+
+        void StopSpring()
+        {
+            if (s_haptic && s_spring >= 0)
+            {
+                SDL_StopHapticEffect(s_haptic, s_spring);
+                SDL_DestroyHapticEffect(s_haptic, s_spring);
+            }
+            s_spring = -1;
+        }
+
+        // Settings > Wheel > Centering Force: an autocentre level where the
+        // wheel takes one, else a spring effect that pulls it to the middle,
+        // said only when wheel_map.h's Centring says it is due (never on a
+        // timer: each time, SDL lets the wheel's centring go for a moment).
+        void ApplyCentering()
+        {
+            if (!s_haptic)
+                return;
+            const int percent = std::clamp(settings::GetInt(settings::Id::CenteringForce), 0, 100);
+            if (!s_centring.Due(percent, s_reported))
+                return;
+            if (s_log)
+                fprintf(stderr, "[wheel] centring %d%% said (%d since the wheel opened)\n", percent, s_centring.sends);
+            if (s_canAutocentre)
+            {
+                if (!SDL_SetHapticAutocenter(s_haptic, percent))
+                    fprintf(stderr, "[wheel] autocentre %d%% failed: %s\n", percent, SDL_GetError());
+                return;
+            }
+            if (!s_canSpring)
+                return;
+            if (percent == 0)
+            {
+                StopSpring();
+                return;
+            }
+            SDL_HapticEffect effect{};
+            effect.condition.type = SDL_HAPTIC_SPRING;
+            effect.condition.direction.type = SDL_HAPTIC_CARTESIAN;
+            effect.condition.direction.dir[0] = 1;
+            effect.condition.length = SDL_HAPTIC_INFINITY;
+            for (int axis = 0; axis < 3; axis++)
+            {
+                effect.condition.right_sat[axis] = wheelmap::SpringSaturation(percent);
+                effect.condition.left_sat[axis] = wheelmap::SpringSaturation(percent);
+                effect.condition.right_coeff[axis] = Sint16(wheelmap::SpringLevel(percent));
+                effect.condition.left_coeff[axis] = Sint16(wheelmap::SpringLevel(percent));
+            }
+            if (s_spring >= 0)
+            {
+                if (SDL_UpdateHapticEffect(s_haptic, s_spring, &effect))
+                    return;
+                StopSpring();  // it wouldn't take the change: make it afresh
+            }
+            s_spring = SDL_CreateHapticEffect(s_haptic, &effect);
+            if (s_spring < 0 || !SDL_RunHapticEffect(s_haptic, s_spring, SDL_HAPTIC_INFINITY))
+            {
+                fprintf(stderr, "[wheel] centring force failed: %s\n", SDL_GetError());
+                StopSpring();
+                s_canSpring = false;
+            }
+        }
+
+        // What the wheel can do with its motors, which needs the system to
+        // drive them: on a Mac SDL 3.4's own Logitech driver
+        // (SDL_hidapihaptic_lg4ff.c: a constant force, a sine, a spring, an
+        // autocentre level and gain, 16 effects at once, as measured on a
+        // G29), on Linux the kernel's driver (not tried yet).
+        void OpenHaptics()
+        {
+            s_canAutocentre = s_canSpring = s_canHapticRumble = s_canKnock = s_onlyOneEffect = false;
+            s_knockEffect = -1;
+            s_knock = {};
+            s_knockStartNs = 0;
+            s_canJoystickRumble = false;
+            s_centring = {};
+            s_centringLogged = 0;
+            s_centringLogAt = SDL_GetTicks();
+            if (!s_joystick)
+                return;
+            SDL_PropertiesID props = SDL_GetJoystickProperties(s_joystick);
+            s_canJoystickRumble = SDL_GetBooleanProperty(props, SDL_PROP_JOYSTICK_CAP_RUMBLE_BOOLEAN, false);
+            if (!SDL_IsJoystickHaptic(s_joystick))
+            {
+                fprintf(stderr, "[wheel] no force feedback on this system: the wheel stays slack%s\n",
+                    s_canJoystickRumble ? " (it does take plain rumble)" : "");
+                return;
+            }
+            s_haptic = SDL_OpenHapticFromJoystick(s_joystick);
+            if (!s_haptic)
+            {
+                fprintf(stderr, "[wheel] force feedback didn't open: %s\n", SDL_GetError());
+                return;
+            }
+            const Uint32 features = SDL_GetHapticFeatures(s_haptic);
+            s_canAutocentre = (features & SDL_HAPTIC_AUTOCENTER) != 0;
+            s_canSpring = (features & SDL_HAPTIC_SPRING) != 0;
+            // Knocks are a sine of our own where the wheel plays one (the
+            // Logitech wheels on a Mac); SDL's own rumble only where it
+            // can't (wheel_map.h's Knock says why).
+            s_canKnock = (features & SDL_HAPTIC_SINE) != 0;
+            s_canHapticRumble = !s_canKnock && SDL_InitHapticRumble(s_haptic);
+            // One effect at a time: a knock would take the centring force
+            // away, which matters far more while driving.
+            const int playing = SDL_GetMaxHapticEffectsPlaying(s_haptic);
+            s_onlyOneEffect = playing == 1 && !s_canAutocentre && s_canSpring;
+            const std::string sine = std::format("yes (our own {} ms sine at up to {:.0f}% of the wheel's force, rising over {} ms, "
+                                                 "let go of over {} ms)",
+                wheelmap::kKnockPeriodMs, double(wheelmap::kKnockGain) * 100.0, wheelmap::kKnockAttackMs, wheelmap::kKnockReleaseMs);
+            fprintf(stderr, "[wheel] force feedback: centring %s, knocks %s\n",
+                s_canAutocentre ? "autocentre" : s_canSpring ? "spring" : "no",
+                s_onlyOneEffect ? "no (one effect at a time: the centring force has it)"
+                : s_canKnock    ? sine.c_str()
+                                : s_canHapticRumble ? "yes" : s_canJoystickRumble ? "rumble" : "no");
+        }
+
+        void Close()
+        {
+            StopRumble();
+            StopSpring();
+            if (s_haptic)
+            {
+                if (s_canAutocentre)
+                    SDL_SetHapticAutocenter(s_haptic, 0);
+                SDL_CloseHaptic(s_haptic);
+                s_haptic = nullptr;
+            }
+            if (s_joystick)
+            {
+                SDL_CloseJoystick(s_joystick);
+                s_joystick = nullptr;
+            }
+            s_id = 0;
+            s_restAgain = false;
+            s_axisSeen.clear();
+            s_name.clear();
+            s_bindings.clear();
+            s_axes = {};
+            s_model = nullptr;
+            s_fullTurn = 0;
+            s_centring = {};
+            s_reported = false;
+        }
+
+        // NFSMW_WHEEL_BUTTONS="0=A,2=B,8=BACK,9=START,4=SHIFTUP": what the
+        // wheel's buttons do, for one whose numbering the model has wrong.
+        void TakeBindings()
+        {
+            // The model's buttons, with whatever Calibrate recorded on top.
+            const std::array<int, wheelmap::kControlCount> assigned = StoredButtons();
+            s_bindings = wheelmap::WithAssigned(s_model->buttons, assigned);
+            const char* text = std::getenv("NFSMW_WHEEL_BUTTONS");
+            if (!text || !*text)
+                return;
+            std::string error;
+            s_bindings = wheelmap::ParseBindings(text, s_bindings, error);
+            if (!error.empty())
+                fprintf(stderr, "[wheel] NFSMW_WHEEL_BUTTONS: can't read \"%s\"\n", error.c_str());
+            std::string shown;
+            for (const Binding& b : s_bindings)
+                shown += (shown.empty() ? "" : " ") + std::to_string(b.index) + "=" + std::string(wheelmap::NameOf(b));
+            fprintf(stderr, "[wheel] buttons: %s\n", shown.c_str());
+        }
+
+        void Open()
+        {
+            if (s_joystick || !s_started)
+                return;
+            int count = 0;
+            SDL_JoystickID* ids = SDL_GetJoysticks(&count);
+            if (!ids)
+                return;
+            for (int i = 0; i < count && !s_joystick; i++)
+            {
+                const SDL_JoystickID id = ids[i];
+                const char* name = SDL_GetJoystickNameForID(id);
+                const bool sdlSaysWheel = SDL_GetJoystickTypeForID(id) == SDL_JOYSTICK_TYPE_WHEEL;
+                const uint16_t vendor = SDL_GetJoystickVendorForID(id), product = SDL_GetJoystickProductForID(id);
+                SDL_Joystick* joystick = SDL_OpenJoystick(id);
+                if (!joystick)
+                {
+                    fprintf(stderr, "[wheel] joystick %u didn't open: %s\n", unsigned(id), SDL_GetError());
+                    continue;
+                }
+                // How many axes and buttons it has takes an open device, and
+                // tells a wheel from a gamepad whose name happens to match.
+                if (!wheelmap::LooksLikeWheel(sdlSaysWheel, vendor, product, name ? name : "",
+                        SDL_GetNumJoystickAxes(joystick), SDL_GetNumJoystickButtons(joystick)))
+                {
+                    SDL_CloseJoystick(joystick);
+                    continue;
+                }
+                // The device has only just been opened: make sure SDL has
+                // read it before its axes are taken for where they rest.
+                SDL_UpdateJoysticks();
+                s_joystick = joystick;
+                s_id = id;
+                s_name = name ? name : "Steering wheel";
+                s_model = &wheelmap::ModelFor(vendor, product);
+                s_fullTurn = s_model->fullTurnDegrees;
+                const std::string turn = s_fullTurn ? std::to_string(s_fullTurn) + " degrees" : "an unknown amount";
+                fprintf(stderr, "[wheel] %s (USB %04x:%04x, %s, %d axes, %d buttons, %d hats, turns %s)\n", s_name.c_str(),
+                    vendor, product, s_model->vendor ? s_model->name : "not one we know",
+                    SDL_GetNumJoystickAxes(s_joystick), SDL_GetNumJoystickButtons(s_joystick),
+                    SDL_GetNumJoystickHats(s_joystick), turn.c_str());
+                TakeBindings();
+                s_axisSeen.assign(size_t(std::max(0, SDL_GetNumJoystickAxes(s_joystick))), false);
+                Calibrate(true);
+                s_restAgain = true;
+                OpenHaptics();
+                ApplyCentering();
+            }
+            SDL_free(ids);
+        }
+
+        // Settings > Wheel > Calibrate (wheel_map.h's rules; Sample feeds it).
+        wheelmap::Calibration s_cal;
+
+        // The joystick button that is this pad button now (-1: none).
+        int JoystickButtonOf(uint16_t padButton)
+        {
+            for (const Binding& b : s_bindings)
+                if (b.role == wheelmap::Role::Button && b.button == padButton)
+                    return b.index;
+            return -1;
+        }
+
+        // What a calibration step did: a kept step is stored at once, so
+        // stopping (or the wheel going) keeps everything done so far.
+        void ApplyCalibration(wheelmap::Calibration::Event event)
+        {
+            using Event = wheelmap::Calibration::Event;
+            if (event == Event::None)
+                return;
+            const Step step = s_cal.LastStep();
+            if (event == Event::Kept)
+            {
+                const wheelmap::Calibration::Found f = s_cal.LastFound();
+                if (wheelmap::IsButtonStep(step))
+                {
+                    settings::Set(ButtonOption(wheelmap::ControlOf(step)), double(f.button));
+                    TakeBindings();
+                    fprintf(stderr, "[wheel] calibrate: %s: button %d\n", StepName(step), f.button);
+                }
+                else
+                {
+                    fprintf(stderr, "[wheel] calibrate: %s: axis %d, from %+d to %+d (%.0f%% of its travel)\n", StepName(step),
+                        f.axis, int(f.rest), int(f.full), double(f.moved) * 100.0);
+                    if (step == Step::SteerLeft)
+                    {
+                        settings::Set(settings::Id::WheelSteerAxis, double(f.axis));
+                        settings::Set(settings::Id::SteerLeft, double(f.full));
+                        // The two ends say which way round the wheel is, so
+                        // the manual flip starts clear.
+                        settings::Set(settings::Id::InvertSteering, 0.0);
+                    }
+                    else if (step == Step::SteerRight)
+                    {
+                        settings::Set(settings::Id::WheelSteerAxis, double(f.axis));
+                        settings::Set(settings::Id::SteerRight, double(f.full));
+                    }
+                    else
+                    {
+                        settings::Set(AxisOption(step), double(f.axis));
+                        settings::Set(RestOption(step), double(f.rest));
+                        settings::Set(FullOption(step), double(f.full));
+                    }
+                    Calibrate(false);
+                }
+            }
+            else if (event == Event::Skipped)
+                fprintf(stderr, "[wheel] calibrate: %s skipped\n", StepName(step));
+            else if (event == Event::Back)
+                fprintf(stderr, "[wheel] calibrate: back to %s\n", StepName(step));
+            else if (event == Event::Stopped)
+                fprintf(stderr, "[wheel] calibrate: stopped at %s\n", StepName(step));
+            if (!s_cal.Running() && event != Event::Stopped)
+                fprintf(stderr, "[wheel] calibrate: done\n");
+        }
+
+        // NFSMW_WHEEL_LOG=1: every button as it is pressed (which is how to
+        // find a wheel's numbering), and the axes once a second.
+        void LogSample(const std::array<bool, kMaxButtons>& buttons, const Reading& r)
+        {
+            if (!s_log)
+                return;
+            static std::array<bool, kMaxButtons> was{};
+            for (int b = 0; b < kMaxButtons; b++)
+                if (buttons[size_t(b)] != was[size_t(b)])
+                    fprintf(stderr, "[wheel] button %d %s\n", b, buttons[size_t(b)] ? "down" : "up");
+            was = buttons;
+            static auto last = std::chrono::steady_clock::now();
+            const auto now = std::chrono::steady_clock::now();
+            if (now - last < std::chrono::seconds(1))
+                return;
+            last = now;
+            fprintf(stderr, "[wheel] steering raw %d -> %+.3f (the game's stick %+.3f); pedals raw (%d, %d, %d) -> throttle %.2f, "
+                            "brake %.2f, clutch %.2f\n",
+                int(AxisNow(s_axes.steer)), r.steer, r.stick, int(AxisNow(s_axes.throttle)), int(AxisNow(s_axes.brake)),
+                int(AxisNow(s_axes.clutch)), r.throttle, r.brake, r.clutch);
+        }
+
+        std::array<bool, kMaxButtons> ButtonsNow()
+        {
+            std::array<bool, kMaxButtons> held{};
+            if (!s_joystick)
+                return held;
+            const int count = std::min(kMaxButtons, std::max(0, SDL_GetNumJoystickButtons(s_joystick)));
+            for (int b = 0; b < count; b++)
+                held[size_t(b)] = SDL_GetJoystickButton(s_joystick, b);
+            return held;
+        }
+
+        uint8_t HatNow()
+        {
+            if (!s_joystick || SDL_GetNumJoystickHats(s_joystick) < 1)
+                return wheelmap::hat::Centred;
+            return SDL_GetJoystickHat(s_joystick, 0);
+        }
+
+        // How far a pedal is down, or nothing at all while its axis has yet
+        // to report: until then the 0 SDL reads needn't be where the pedal
+        // is. On a wheel whose
+        // pedals run +32767 to -32768 that 0 is halfway, so without this a
+        // resting pedal reads half pressed.
+        float PedalValue(Step step)
+        {
+            const int axis = AxisOf(step);
+            if (axis < 0 || size_t(axis) >= s_axisSeen.size() || !s_axisSeen[size_t(axis)])
+                return 0.0f;
+            return s_pedals[Slot(step)].Value(AxisNow(axis));
+        }
+
+        bool InPlay()
+        {
+            return s_joystick != nullptr && settings::GetBool(settings::Id::Wheel);
+        }
+
+        Reading s_last;  // what Sample last read (Last)
+    }
+
+    bool StepIsButton(Step step)
+    {
+        return wheelmap::IsButtonStep(step);
+    }
+
+    const char* StepName(Step step)
+    {
+        switch (step)
+        {
+        case Step::SteerLeft: return "Full left";
+        case Step::SteerRight: return "Full right";
+        case Step::Throttle: return "Throttle";
+        case Step::Brake: return "Brake";
+        case Step::Clutch: return "Clutch";
+        default: break;
+        }
+        if (StepIsButton(step))
+            return wheelmap::kControls[size_t(step) - size_t(Step::ButtonA)].name;
+        return "?";
+    }
+
+    const char* StepAsk(Step step)
+    {
+        switch (step)
+        {
+        case Step::SteerLeft: return "Turn the wheel fully left";
+        case Step::SteerRight: return "Turn the wheel fully right";
+        case Step::Throttle: return "Press the throttle to the floor";
+        case Step::Brake: return "Press the brake to the floor";
+        case Step::Clutch: return "Press the clutch to the floor";
+        default: break;
+        }
+        return StepIsButton(step) ? "Press the wheel button you want for it" : "?";
+    }
+
+    void Initialize()
+    {
+        s_started = true;
+        // A Steering Response below 1.00 from a test build before the game's
+        // own 20% deadzone was stepped over (settings_version 0) was set to
+        // fight that deadzone, and now makes the centre far too sharp (0.50:
+        // the first 10% of steering inside 3 degrees of the wheel). Back to
+        // 1.00 once; the file takes it at the game's next save. A value set
+        // since (version 1) is the player's.
+        if (settings::GetInt(settings::Id::WheelSettingsVersion) < 1)
+        {
+            const float response = settings::GetFloat(settings::Id::SteeringResponse);
+            if (response < 1.0f && !settings::EnvOverride(settings::Id::SteeringResponse))
+            {
+                settings::Set(settings::Id::SteeringResponse, 1.0);
+                fprintf(stderr, "[wheel] Steering Response %.2f was set while the game's own steering deadzone was in the way: "
+                                "back to 1.00, which now steers in step with the wheel\n",
+                    double(response));
+            }
+            settings::Set(settings::Id::WheelSettingsVersion, 1.0);
+        }
+        // Every Wheel setting as it is read, so a run says for itself what
+        // it is playing by: a value here that differs from settings.toml
+        // means the file didn't reach the game.
+        fprintf(stderr, "[wheel] settings: wheel %s, range %s, invert %s, deadzone %.2f, response %.2f, "
+                        "force feedback %d%%, centring %d%%\n",
+            settings::GetBool(settings::Id::Wheel) ? "on" : "off",
+            settings::FormatValue(settings::Id::SteeringRange, settings::GetValue(settings::Id::SteeringRange)).c_str(),
+            settings::GetBool(settings::Id::InvertSteering) ? "yes" : "no",
+            double(settings::GetFloat(settings::Id::SteeringDeadzone)), double(settings::GetFloat(settings::Id::SteeringResponse)),
+            settings::GetInt(settings::Id::ForceFeedback), settings::GetInt(settings::Id::CenteringForce));
+        Open();
+    }
+
+    void HandleEvent(const SDL_Event& e)
+    {
+        if (!s_started)
+            return;
+        // The wheel's first event of any kind follows SDL's driver clearing
+        // its autocentre (on the first report that changed anything): the
+        // centring force is said once more (wheel_map.h Centring).
+        if (s_joystick && !s_reported &&
+            ((e.type == SDL_EVENT_JOYSTICK_AXIS_MOTION && e.jaxis.which == s_id) ||
+                ((e.type == SDL_EVENT_JOYSTICK_BUTTON_DOWN || e.type == SDL_EVENT_JOYSTICK_BUTTON_UP) && e.jbutton.which == s_id) ||
+                (e.type == SDL_EVENT_JOYSTICK_HAT_MOTION && e.jhat.which == s_id)))
+            s_reported = true;
+        if (e.type == SDL_EVENT_JOYSTICK_AXIS_MOTION && s_joystick && e.jaxis.which == s_id)
+        {
+            const int a = e.jaxis.axis;
+            if (a >= 0 && size_t(a) < s_axisSeen.size() && !s_axisSeen[size_t(a)])
+            {
+                s_axisSeen[size_t(a)] = true;
+                // SDL's first report of an axis carries where it was before it
+                // moved: a calibration step measures such an axis from there.
+                s_cal.FirstValue(a, e.jaxis.value);
+                // The device is certainly reporting now: whether it can knock
+                // is asked again if it said no (the centring: below).
+                if (s_haptic && !s_canKnock && !s_canHapticRumble && SDL_InitHapticRumble(s_haptic))
+                {
+                    s_canHapticRumble = true;
+                    fprintf(stderr, "[wheel] force feedback: knocks yes after all (the wheel was busy at first)\n");
+                }
+                // A pedal on this axis that had no resting place to work
+                // from takes the value it was at as it started to move,
+                // which is near enough where it rests. A wheel we know
+                // never gets here: its model said so at the open.
+                for (Step step : { Step::Throttle, Step::Brake, Step::Clutch })
+                    if (AxisOf(step) == a && !s_pedals[Slot(step)].ready)
+                    {
+                        // Where it was as it started to move is near enough
+                        // where it rests, and it can go as far as its axis.
+                        const int16_t at = e.jaxis.value;
+                        s_pedals[Slot(step)].Start(at, int16_t(at >= 0 ? -32768 : 32767));
+                        fprintf(stderr, "[wheel] %s: axis %d first reported %+d, taken as where it rests\n", StepName(step),
+                            a, int(at));
+                    }
+            }
+        }
+        else if (e.type == SDL_EVENT_JOYSTICK_ADDED)
+        {
+            Open();
+        }
+        else if (e.type == SDL_EVENT_JOYSTICK_REMOVED && s_joystick && e.jdevice.which == s_id)
+        {
+            fprintf(stderr, "[wheel] %s disconnected\n", s_name.c_str());
+            StopCalibrate();
+            Close();
+            Open();  // a second wheel, if one is plugged in
+        }
+    }
+
+    bool Found()
+    {
+        return s_joystick != nullptr;
+    }
+
+    bool Playing()
+    {
+        return InPlay();
+    }
+
+    bool Owns(SDL_JoystickID joystick)
+    {
+        return s_joystick != nullptr && joystick == s_id;
+    }
+
+    std::string Name()
+    {
+        return s_joystick ? s_name : std::string();
+    }
+
+    bool HasForceFeedback()
+    {
+        return s_haptic != nullptr && (s_canAutocentre || s_canSpring || s_canHapticRumble || s_canKnock);
+    }
+
+    bool Sample(Reading& out)
+    {
+        if (!s_joystick)
+            return false;
+        if (s_restAgain)
+        {
+            s_restAgain = false;
+            Calibrate(true);  // a frame on, with the device certainly read
+        }
+        const std::array<bool, kMaxButtons> held = ButtonsNow();
+        if (s_cal.Running())
+            ApplyCalibration(s_cal.Update(AxisStates(false), s_axisSeen, held, HatNow(), JoystickButtonOf(wheelmap::button::A),
+                JoystickButtonOf(wheelmap::button::B)));
+        const wheelmap::Pressed pressed = wheelmap::Resolve(held, HatNow(), s_bindings);
+        Reading r;
+        r.buttons = pressed.buttons;
+        r.rightY = pressed.rightY;
+        r.back = (pressed.buttons & wheelmap::button::Back) != 0;
+        r.start = (pressed.buttons & wheelmap::button::Start) != 0;
+        if (s_axes.steer >= 0)
+        {
+            float turn = s_steering.Fraction(AxisNow(s_axes.steer));
+            if (settings::GetBool(settings::Id::InvertSteering))
+                turn = -turn;
+            r.steer = wheelmap::Steer(turn, settings::GetInt(settings::Id::SteeringRange), s_fullTurn,
+                settings::GetFloat(settings::Id::SteeringDeadzone), settings::GetFloat(settings::Id::SteeringResponse));
+            r.stick = wheelmap::StickPastGameDeadzone(r.steer);
+        }
+        r.throttle = PedalValue(Step::Throttle);
+        r.brake = PedalValue(Step::Brake);
+        r.clutch = PedalValue(Step::Clutch);
+        LogSample(held, r);
+        s_last = r;
+        // Switched off, the wheel plays nothing - but it was still read, so
+        // Settings > Wheel keeps showing what it reads, and the menus (and
+        // the chord that opens them) keep working from it.
+        if (!settings::GetBool(settings::Id::Wheel))
+            return false;
+        out = r;
+        return true;
+    }
+
+    Reading Last()
+    {
+        return s_joystick ? s_last : Reading{};
+    }
+
+    uint16_t HeldButtons()
+    {
+        if (!s_joystick || s_cal.Running())  // Calibrate has the wheel's buttons
+            return 0;
+        return wheelmap::Resolve(ButtonsNow(), HatNow(), s_bindings).buttons;
+    }
+
+    uint16_t ButtonFor(SDL_JoystickID joystick, int button)
+    {
+        if (!s_joystick || joystick != s_id || s_cal.Running())  // Calibrate has the wheel's buttons
+            return 0;
+        for (const Binding& b : s_bindings)
+            if (b.index == button && b.role == wheelmap::Role::Button)
+                return b.button;
+        return 0;
+    }
+
+    void Rumble(uint16_t low, uint16_t high, bool vibration)
+    {
+        if (!s_joystick)
+            return;
+        const int percent = settings::GetInt(settings::Id::ForceFeedback);
+        const float strength = vibration ? wheelmap::RumbleStrength(low, high, percent) : 0.0f;
+        if (s_canKnock && !s_onlyOneEffect)
+        {
+            PlayKnock(strength);  // every frame: a knock is let go of over several
+            return;
+        }
+        if (strength == s_rumble)
+            return;
+        s_rumble = strength;
+        if (strength <= 0.0f)
+        {
+            StopRumble();
+            return;
+        }
+        if (s_onlyOneEffect)
+            return;  // the centring force has the wheel's one effect
+        if (s_canHapticRumble && SDL_PlayHapticRumble(s_haptic, strength, 5000))
+            return;
+        if (s_canJoystickRumble)
+            SDL_RumbleJoystick(s_joystick, uint16_t(low * percent / 100), uint16_t(high * percent / 100), 5000);
+    }
+
+    void Update()
+    {
+        if (!s_joystick)
+            return;
+        ApplyCentering();  // only when due: the setting changed, or the device's first report
+        // How often the centring was said, once a minute while a wheel is open
+        // (0 is the answer in play: a click a second was a re-send a second).
+        const Uint64 now = SDL_GetTicks();
+        if (s_haptic && now - s_centringLogAt >= 60000)
+        {
+            fprintf(stderr, "[wheel] centring said %d times in the last minute (%s at %d%%, %d since the wheel opened)\n",
+                s_centring.sends - s_centringLogged, s_canAutocentre ? "autocentre" : s_canSpring ? "spring" : "none",
+                settings::GetInt(settings::Id::CenteringForce), s_centring.sends);
+            s_centringLogged = s_centring.sends;
+            s_centringLogAt = now;
+        }
+    }
+
+    void NoteMenu(bool open)
+    {
+        if (!s_joystick)
+            return;
+        const char* knocks = s_haptic && s_onlyOneEffect ? "none (the centring force has the wheel's one effect)"
+            : s_haptic && s_canKnock                     ? "our sine"
+            : s_haptic && s_canHapticRumble              ? "SDL's rumble"
+            : s_canJoystickRumble                        ? "plain rumble"
+                                                         : "none (no force feedback here)";
+        fprintf(stderr, "[wheel] menu %s: knocks by %s (%d so far%s); centring %s at %d%%; Force Feedback %d%%; range %s, "
+                        "response %.2f, deadzone %.2f\n",
+            open ? "opened" : "closed", knocks, s_knocks, s_knock.playing ? ", one playing" : "",
+            !s_haptic ? "none" : s_canAutocentre ? "autocentre" : s_canSpring ? "spring" : "none",
+            settings::GetInt(settings::Id::CenteringForce),
+            settings::GetInt(settings::Id::ForceFeedback),
+            settings::FormatValue(settings::Id::SteeringRange, settings::GetValue(settings::Id::SteeringRange)).c_str(),
+            double(settings::GetFloat(settings::Id::SteeringResponse)), double(settings::GetFloat(settings::Id::SteeringDeadzone)));
+    }
+
+    void Suspend()
+    {
+        StopRumble();
+    }
+
+    void Shutdown()
+    {
+        Close();
+        s_started = false;
+    }
+
+    void StartCalibrate()
+    {
+        if (!s_joystick)
+            return;
+        s_cal.Start(AxisStates(false), s_axisSeen, ButtonsNow(), HatNow(), s_axes.steer);
+        fprintf(stderr, "[wheel] calibrate: started\n");
+    }
+
+    bool Calibrating()
+    {
+        return s_cal.Running();
+    }
+
+    Step CalibratingStep()
+    {
+        return s_cal.Current();
+    }
+
+    Candidate Watch()
+    {
+        return s_cal.Watch();
+    }
+
+    bool KeepStep()
+    {
+        const auto event = s_cal.Keep(AxisStates(false));
+        ApplyCalibration(event);
+        return event == wheelmap::Calibration::Event::Kept;
+    }
+
+    void SkipStep()
+    {
+        ApplyCalibration(s_cal.Skip(AxisStates(false)));
+    }
+
+    void BackStep()
+    {
+        ApplyCalibration(s_cal.Back(AxisStates(false)));
+    }
+
+    void StopCalibrate()
+    {
+        ApplyCalibration(s_cal.Stop());
+    }
+
+    Assignment Axes()
+    {
+        return { s_axes.steer, s_axes.throttle, s_axes.brake, s_axes.clutch };
+    }
+
+    void ResetAxes()
+    {
+        StopCalibrate();
+        for (settings::Id id : { settings::Id::WheelSteerAxis, settings::Id::WheelThrottleAxis, settings::Id::WheelBrakeAxis,
+                                 settings::Id::WheelClutchAxis })
+            settings::Set(id, -1);
+        for (settings::Id id : { settings::Id::InvertSteering, settings::Id::ThrottleRest, settings::Id::ThrottleFull,
+                                 settings::Id::BrakeRest, settings::Id::BrakeFull, settings::Id::ClutchRest,
+                                 settings::Id::ClutchFull, settings::Id::SteerLeft, settings::Id::SteerRight })
+            settings::Reset(id);
+        for (size_t i = 0; i < wheelmap::kControlCount; i++)
+            settings::Reset(ButtonOption(wheelmap::Control(i)));
+        if (s_joystick)
+            TakeBindings();
+        if (s_joystick)
+            Calibrate(false);
+    }
+}
diff --git a/runtime/hid/wheel.h b/runtime/hid/wheel.h
new file mode 100644
index 0000000..5c36bcf
--- /dev/null
+++ b/runtime/hid/wheel.h
@@ -0,0 +1,150 @@
+// SpeedBreaker runtime. GPL-3.0-or-later (see COPYING).
+//
+// A USB steering wheel (the Logitech G29 and its family, and any other
+// wheel SDL sees) as the Xbox 360 controller the game reads: the device
+// itself, its force feedback, and what it amounts to each frame.
+// hid/wheel_map.h holds the rules this follows; hid/input.cpp puts a
+// Reading in the pad, ui/ui.cpp asks ButtonFor for the settings chord and
+// the menu's navigation, and ui/settings_menu.cpp draws Settings > Wheel.
+//
+//   - A wheel is not a gamepad: SDL has no gamepad mapping for one, so it
+//     arrives as a plain joystick. The first one connected is used, and a
+//     wheel is preferred to a controller while both are plugged in. One
+//     connecting or going mid-game is picked up (Initialize is not needed
+//     again).
+//   - Force feedback goes through SDL's haptics. On a Mac that is SDL 3.4's
+//     own Logitech driver (src/haptic/hidapi/SDL_hidapihaptic_lg4ff.c),
+//     which talks to the wheel over HID with nothing of Logitech's
+//     installed: the wheels its joystick driver takes (a G29 in its PS3
+//     position, 046d:c24f; the G27, G25, Driving Force GT and Pro), not a
+//     G29 in its PS4 position, a G920 or a G923. On Linux it is the
+//     kernel's driver (untested here: mainline hid-lg4ff offers a constant
+//     force and autocentre, not the sine SDL's rumble needs). Where a
+//     system can't drive a wheel, the log says so and Settings > Wheel says
+//     so on the two rows that need the motors, while steering, the pedals
+//     and the buttons all work regardless.
+#pragma once
+#include <cstdint>
+#include <string>
+
+#include <SDL3/SDL_events.h>
+
+#include "wheel_map.h"
+
+namespace hid::wheel
+{
+    // Main thread, after SDL's gamepad (and so joystick) subsystem is up.
+    // Not called at all while NFSMW_VIRTUAL_PAD's test controller is
+    // attached: that run has its own idea of what is plugged in.
+    void Initialize();
+    // Main thread: every SDL event, for a wheel coming or going.
+    void HandleEvent(const SDL_Event& event);
+    // Main thread: a wheel is plugged in and open (Settings > Wheel's page
+    // shows itself while one is).
+    bool Found();
+    // Main thread: ...and Settings > Wheel has it on, so the game plays
+    // from it (a controller is then left alone). With it off the wheel
+    // still works the menus, so the page that switched it off can switch it
+    // back on.
+    bool Playing();
+    // Main thread: this joystick is the open wheel, so the gamepad path
+    // must leave it be.
+    bool Owns(SDL_JoystickID joystick);
+    // Main thread: the open wheel's name, "" with none.
+    std::string Name();
+    // Main thread: the wheel's force feedback can be driven on this system
+    // (Settings > Wheel says so where it can't).
+    bool HasForceFeedback();
+
+    // The wheel as the pad, before the deadzones and the keyboard
+    // (hid/input.cpp): the buttons as XInput's bits, with Back among them,
+    // and the axes as fractions, Settings > Wheel already applied.
+    struct Reading
+    {
+        uint16_t buttons = 0;
+        float steer = 0.0f;     // -1 (full left) to 1: how far the wheel steers (Settings > Wheel applied)
+        float stick = 0.0f;     // the left stick's X that steers the car that far: steer past the
+                                // game's own deadzone (wheel_map.h's StickPastGameDeadzone)
+        float throttle = 0.0f;  // 0 to 1: the right trigger
+        float brake = 0.0f;     // 0 to 1: the left trigger
+        float clutch = 0.0f;    // 0 to 1: nothing on the pad; Settings > Wheel shows it
+        int16_t rightY = 0;     // the paddles as the right stick, which is how the game shifts
+        bool back = false, start = false;  // as the device reports them (the settings chord)
+    };
+    // Main thread, once a frame. False, with `out` left alone, when no
+    // wheel is in play; the device is still read, so the page's readings
+    // stay live with the wheel switched off.
+    bool Sample(Reading& out);
+    // Main thread: what the last Sample read, for Settings > Wheel to show
+    // (the page is drawn between two samples). All zero with no wheel.
+    Reading Last();
+
+    // Main thread: the pad buttons the wheel is holding down now (ui/ui.cpp
+    // feeds them to ImGui, which knows only gamepads). 0 with no wheel.
+    uint16_t HeldButtons();
+    // Main thread: which pad button this joystick's button is, for the Back
+    // + Start chord (ui/ui.cpp). 0: none, or another device's.
+    uint16_t ButtonFor(SDL_JoystickID joystick, int button);
+
+    // Main thread, once a frame: the rumble the game asks for, as Settings >
+    // Wheel > Force Feedback and Settings > Input > Vibration allow. Where
+    // the wheel plays a sine (the Logitech wheels on a Mac) it is a knock of
+    // its own (wheel_map.h's Knock), let go of over a few frames; elsewhere
+    // SDL's rumble, told only when the request changes.
+    void Rumble(uint16_t low, uint16_t high, bool vibration);
+    // Main thread, once a frame: keeps the wheel's centring force as
+    // Settings > Wheel asks.
+    void Update();
+    // Main thread: a menu over the game opened or closed (the game sees an
+    // idle pad meanwhile). Logs what the wheel's force feedback is doing and
+    // the Wheel settings, so a session's log says it at every return.
+    void NoteMenu(bool open);
+    // Main thread: the game is suspended, or stopping. Suspend stops what
+    // the wheel is playing without letting the device go.
+    void Suspend();
+    void Shutdown();
+
+    // Settings > Wheel > Calibrate (ui/settings_menu.cpp draws it): the wheel's
+    // two ends, each pedal, then a button per pad control, one step at a
+    // time. hid/wheel_map.h's Calibration holds the rules (and says what each
+    // step watches for); this side feeds it the device every frame (Sample)
+    // and stores each step as it is kept, so stopping keeps what is done.
+    //
+    // While it runs the wheel's buttons are its own: they don't reach the
+    // menus (HeldButtons is 0) or the Back + Start chord (ButtonFor is 0), so
+    // Circle can be B and Share Back. The wheel's A keeps an axis step, its B
+    // stops one, and its D-pad moves along: right skips, left goes back, down
+    // stops. A button step takes the button pressed, kept through its release,
+    // and A or that button again keeps it.
+    using Step = wheelmap::Step;
+    constexpr size_t kStepCount = wheelmap::kStepCount;
+    // Main thread: what the step asks the player to do ("Turn the wheel
+    // fully left", "Press the throttle to the floor"), and a short name for
+    // it ("Full left", "Throttle", "A").
+    const char* StepAsk(Step step);
+    const char* StepName(Step step);
+    // Is it a button the step is after, rather than an axis?
+    bool StepIsButton(Step step);
+    // Main thread: start at the first step (a wheel must be found).
+    void StartCalibrate();
+    bool Calibrating();
+    // Main thread: which step is running (only meaningful while Calibrating).
+    Step CalibratingStep();
+    using Candidate = wheelmap::Calibration::Found;
+    // Main thread, while a step runs: what keeping it would store.
+    Candidate Watch();
+    // Main thread: the keyboard's or a controller's A, right, left, Esc / B
+    // (the wheel's own come through Sample). Keep is false while the step has
+    // nothing yet, and the step carries on.
+    bool KeepStep();
+    void SkipStep();
+    void BackStep();
+    void StopCalibrate();
+    // Main thread: the axis each role is reading, as the device numbers
+    // them; -1: none (shown in Settings > Wheel's Calibrate row).
+    struct Assignment { int steer = -1, throttle = -1, brake = -1, clutch = -1; };
+    Assignment Axes();
+    // Main thread: forget what Calibrate stored (the axes and the steering
+    // direction) and work them out from the device again (the page's Reset).
+    void ResetAxes();
+}
diff --git a/runtime/hid/wheel_map.h b/runtime/hid/wheel_map.h
new file mode 100644
index 0000000..394df9b
--- /dev/null
+++ b/runtime/hid/wheel_map.h
@@ -0,0 +1,1151 @@
+// SpeedBreaker runtime. GPL-3.0-or-later (see COPYING).
+//
+// A USB steering wheel as an Xbox 360 controller (Settings > Wheel): which
+// of a joystick's axes is the wheel and which are its pedals, how far a
+// turn and a pedal press reach, and which of its buttons are the pad's.
+// Header only and SDL-free: hid/wheel.cpp samples the device and feeds the
+// result to the pad, ui/settings_menu.cpp draws the page, and
+// tests/wheel_map_test.cpp checks the rules.
+//
+// A wheel is not a gamepad: SDL has no gamepad mapping for one, so it
+// arrives as a plain joystick whose axes and buttons mean nothing by
+// themselves. Three things sort that out, in this order:
+//
+//   - The model table below, for the wheels we know (the Logitech G29 and
+//     its family): which axis is the wheel, which pedal is which, how far
+//     the wheel turns, and what its buttons are.
+//   - Where the axes rest when the game opens the device, which tells a
+//     wheel (centred) from a pedal (held at one end by its spring) whatever
+//     the model says, so an unknown wheel still steers and brakes.
+//   - The player, through Settings > Wheel > Calibrate, whose stored axis
+//     numbers beat both (the pedals of a wheel we don't know are the one
+//     thing the first two can get wrong: three springs look alike).
+#pragma once
+#include <algorithm>
+#include <array>
+#include <cctype>
+#include <cmath>
+#include <cstddef>
+#include <cstdint>
+#include <span>
+#include <string>
+#include <string_view>
+#include <vector>
+
+namespace hid::wheelmap
+{
+    // XInput's button bits, as the game reads them (xbox.h's
+    // XAMINPUT_GAMEPAD_*; wheel.cpp asserts they agree), as in key_map.h.
+    namespace button
+    {
+        constexpr uint16_t DpadUp = 0x0001, DpadDown = 0x0002, DpadLeft = 0x0004, DpadRight = 0x0008;
+        constexpr uint16_t Start = 0x0010, Back = 0x0020, LeftThumb = 0x0040, RightThumb = 0x0080;
+        constexpr uint16_t LeftShoulder = 0x0100, RightShoulder = 0x0200;
+        constexpr uint16_t A = 0x1000, B = 0x2000, X = 0x4000, Y = 0x8000;
+    }
+
+    // A joystick hat's bits (SDL_HAT_*; wheel.cpp asserts they agree).
+    namespace hat
+    {
+        constexpr uint8_t Centred = 0x00, Up = 0x01, Right = 0x02, Down = 0x04, Left = 0x08;
+    }
+
+    // The full deflection of a joystick axis, as SDL reports it. The
+    // negative end is one more (-32768), which the readings clamp to this.
+    constexpr int kAxisMax = 32767;
+
+    // What one of a wheel's buttons does. The game shifts gears with the
+    // right stick (README, Controls), so a wheel's paddles push it up and
+    // down: ShiftUp and ShiftDown are not buttons the pad has.
+    enum class Role : uint8_t { Button, ShiftUp, ShiftDown };
+
+    struct Binding
+    {
+        int index = 0;             // the joystick button, as SDL numbers them
+        uint16_t button = 0;       // Role::Button: which pad button it is
+        Role role = Role::Button;
+    };
+
+    // Which axis is which. -1: the device hasn't got it (a wheel without a
+    // clutch), or nothing has said which it is yet.
+    struct Axes
+    {
+        int steer = -1, throttle = -1, brake = -1, clutch = -1;
+    };
+
+    // A wheel we know by its USB ids.
+    struct Model
+    {
+        const char* name;
+        uint16_t vendor = 0, product = 0;  // 0, 0: the fallback for every other wheel
+        Axes axes;
+        // Where its pedals rest and where they read floored. SDL can't be
+        // asked: until the device's first report every axis reads 0, and it
+        // sends no motion event for an axis until it moves (by more than
+        // 1/80 of its travel), so wheel.cpp can't tell an untouched pedal
+        // from one at 0. Equal values: unknown, and then a pedal reads
+        // nothing until its axis speaks for itself.
+        int16_t pedalRest = 0;
+        int16_t pedalFull = 0;
+        int fullTurnDegrees = 0;           // lock to lock; 0: unknown (Steering Range then has nothing to go by)
+        std::span<const Binding> buttons;
+    };
+
+    // The Logitech wheels' buttons, in the PlayStation layout they report
+    // over USB (the G29's own numbering, which the G920 and G923 share).
+    // Matched to the pad by position, as a PlayStation controller's are
+    // (README, Controls): Cross is A, Circle is B, Square is X, Triangle is
+    // Y. The paddles shift gears; R2 and L2, the two levers behind them,
+    // are the shoulder buttons.
+    inline constexpr Binding kLogitechButtons[] = {
+        { 0, button::A }, { 1, button::X }, { 2, button::B }, { 3, button::Y },
+        { 4, 0, Role::ShiftUp },    // R1: the right paddle
+        { 5, 0, Role::ShiftDown },  // L1: the left paddle
+        { 6, button::RightShoulder }, { 7, button::LeftShoulder },
+        { 8, button::Back },        // Share / Select
+        { 9, button::Start },       // Options / Start
+        { 10, button::RightThumb }, { 11, button::LeftThumb },
+    };
+
+    // Any other wheel: the order nearly every joystick reports its face
+    // buttons in, so the menus have A, B and a way out of them. Settings >
+    // Wheel's own rows (and NFSMW_WHEEL_BUTTONS) change it.
+    inline constexpr Binding kGenericButtons[] = {
+        { 0, button::A }, { 1, button::B }, { 2, button::X }, { 3, button::Y },
+        { 4, button::LeftShoulder }, { 5, button::RightShoulder },
+        { 6, button::Back }, { 7, button::Start },
+        { 8, button::LeftThumb }, { 9, button::RightThumb },
+    };
+
+    // The wheels we know.
+    //
+    // The G29's numbers are measured, on a Logitech G29 (046d:c24f) over
+    // USB on macOS: the wheel is axis 0 and turning left reads negative, as
+    // the pad wants; the pedals are throttle 2, brake 3, clutch 1 - not the
+    // order they sit in on the floor - and each rests at +32767 and runs to
+    // -32768 as it goes down, which is the pedalRest and pedalFull pair
+    // here. Its buttons are kLogitechButtons, confirmed
+    // one at a time, and its hat is the D-pad.
+    //
+    // That is exactly what SDL 3.4's own Logitech driver
+    // (src/joystick/hidapi/SDL_hidapi_lg4ff.c) makes of a G29's reports, and
+    // the same driver gives the G27 and G25 those axes and the Driving Force
+    // GT and Pro three (the gas on 1, the brake on 2): tests/wheel_map_test.cpp
+    // holds that table. SDL's driver doesn't take the G920 or the G923, so
+    // their entries are the G29's, guessed. Nothing here is trusted blindly
+    // in any case: Detect() checks the axes against where they rest, and
+    // Settings > Wheel > Calibrate overrules the lot.
+    inline constexpr Model kModels[] = {
+        { "Logitech G29 Driving Force", 0x046D, 0xC24F, { 0, 2, 3, 1 }, kAxisMax, -32768, 900, kLogitechButtons },
+        { "Logitech G29 Driving Force", 0x046D, 0xC260, { 0, 2, 3, 1 }, kAxisMax, -32768, 900, kLogitechButtons },
+        { "Logitech G920 Driving Force", 0x046D, 0xC262, { 0, 2, 3, 1 }, kAxisMax, -32768, 900, kLogitechButtons },
+        { "Logitech G923 Driving Force", 0x046D, 0xC266, { 0, 2, 3, 1 }, kAxisMax, -32768, 900, kLogitechButtons },
+        { "Logitech G923 Driving Force", 0x046D, 0xC26E, { 0, 2, 3, 1 }, kAxisMax, -32768, 900, kLogitechButtons },
+        { "Logitech G27 Racing Wheel", 0x046D, 0xC29B, { 0, 2, 3, 1 }, kAxisMax, -32768, 900, kLogitechButtons },
+        { "Logitech G25 Racing Wheel", 0x046D, 0xC299, { 0, 2, 3, 1 }, kAxisMax, -32768, 900, kLogitechButtons },
+        // Three axes, not four: the wheel, then the gas and the brake (no
+        // clutch), as SDL's driver reports them.
+        { "Logitech Driving Force GT", 0x046D, 0xC29A, { 0, 1, 2, -1 }, kAxisMax, -32768, 900, kLogitechButtons },
+        { "Logitech Driving Force Pro", 0x046D, 0xC298, { 0, 1, 2, -1 }, kAxisMax, -32768, 900, kLogitechButtons },
+        { "Steering wheel", 0, 0, { 0, 1, 2, 3 }, 0, 0, 0, kGenericButtons },
+    };
+    constexpr size_t kModelCount = sizeof(kModels) / sizeof(kModels[0]);
+    static_assert(kModels[kModelCount - 1].vendor == 0 && kModels[kModelCount - 1].product == 0,
+        "the last model is the fallback for every wheel we don't know");
+
+    inline const Model& Fallback()
+    {
+        return kModels[kModelCount - 1];
+    }
+
+    // The wheel with these USB ids, or the fallback.
+    inline const Model& ModelFor(uint16_t vendor, uint16_t product)
+    {
+        for (const Model& m : kModels)
+            if (m.vendor == vendor && m.product == product && m.vendor != 0)
+                return m;
+        return Fallback();
+    }
+
+    inline std::string Lowered(std::string_view text)
+    {
+        std::string out(text);
+        for (char& c : out)
+            c = char(std::tolower(static_cast<unsigned char>(c)));
+        return out;
+    }
+
+    // Is this joystick a wheel? SDL says so itself for the ones it knows
+    // (SDL_JOYSTICK_TYPE_WHEEL), our own table for the rest, and failing
+    // both the name, which is what a wheel SDL and we have never heard of
+    // leaves to go on. `axes` and `buttons` are what the device reports: a
+    // wheel has an axis to steer with and at least one pedal, so a name
+    // alone never makes a two-axis gamepad into one.
+    inline bool LooksLikeWheel(bool sdlSaysWheel, uint16_t vendor, uint16_t product, std::string_view name, int axes, int buttons)
+    {
+        if (axes < 2 || buttons < 1)
+            return false;
+        if (sdlSaysWheel)
+            return true;
+        if (&ModelFor(vendor, product) != &Fallback())
+            return true;
+        const std::string lowered = Lowered(name);
+        for (std::string_view hint : { "wheel", "driving force", "racing", "g29", "g920", "g923", "g27", "g25",
+                                       "thrustmaster", "fanatec", "logitech momo" })
+            if (lowered.find(hint) != std::string::npos)
+                return true;
+        return false;
+    }
+
+    // Where an axis rests, as a share of full deflection: a wheel's own
+    // axis rests centred, a pedal is held at one end by its spring. Half
+    // way is nowhere near either, so it splits them with room to spare (a
+    // wheel a little off centre at launch, a pedal that rests a touch short
+    // of its end).
+    constexpr float kRestsCentred = 0.5f;
+
+    constexpr bool RestsCentred(int16_t rest)
+    {
+        constexpr int limit = int(kRestsCentred * kAxisMax);
+        return rest >= -limit && rest <= limit;
+    }
+
+    // Which axis is which, for a device whose axes rest here. `preferred`
+    // is the model's (or the player's, which wheel.cpp puts in first).
+    //
+    //   - The wheel's own axis is the preferred one if it rests centred,
+    //     else the first axis that does. A wheel always has one and a pedal
+    //     never does, so this holds for a wheel we have never heard of.
+    //   - The pedals keep their preferred axes, but only if every one of
+    //     them the device has is free and resting at an end, as a pedal
+    //     under its spring does. If any doesn't check out, the model's
+    //     pedal layout is wrong for this device and is dropped whole rather
+    //     than half believed: the axes left over go to the throttle, the
+    //     brake and the clutch in the order the device reports them, which
+    //     is the order nearly every wheel has them in.
+    //   - A clutch is looked for only where the model asked for one.
+    //
+    // So a device with one centred axis and its pedals at their ends steers
+    // and brakes whatever we know about it, and a wheel whose pedals come
+    // out in the wrong places is the one thing the player has to put right
+    // (Settings > Wheel > Calibrate, whose axes arrive here as `preferred`,
+    // and are not guesses: wheel.cpp keeps them whatever this says).
+    inline Axes Detect(std::span<const int16_t> rest, const Axes& preferred)
+    {
+        const int count = int(rest.size());
+        auto has = [&](int axis) { return axis >= 0 && axis < count; };
+        Axes out;
+        std::vector<bool> taken(size_t(std::max(0, count)), false);
+        if (has(preferred.steer) && RestsCentred(rest[size_t(preferred.steer)]))
+            out.steer = preferred.steer;
+        else
+            for (int a = 0; a < count; a++)
+                if (RestsCentred(rest[size_t(a)]))
+                {
+                    out.steer = a;
+                    break;
+                }
+        if (out.steer >= 0)
+            taken[size_t(out.steer)] = true;
+        int* const pedals[] = { &out.throttle, &out.brake, &out.clutch };
+        const int wanted[] = { preferred.throttle, preferred.brake, preferred.clutch };
+        // Does the model's pedal layout hold for this device? Its throttle
+        // has to be there at all, and every pedal it names has to be free
+        // and resting at an end.
+        // One axis named for two pedals (a stored calibration gone wrong) can't
+        // hold either: each pedal takes its axis as it is checked.
+        bool layoutHolds = has(wanted[0]);
+        std::vector<bool> checked = taken;
+        for (size_t p = 0; p < 3 && layoutHolds; p++)
+            if (has(wanted[p]))
+            {
+                if (checked[size_t(wanted[p])] || RestsCentred(rest[size_t(wanted[p])]))
+                    layoutHolds = false;
+                else
+                    checked[size_t(wanted[p])] = true;
+            }
+        if (layoutHolds)
+        {
+            for (size_t p = 0; p < 3; p++)
+                if (has(wanted[p]))
+                {
+                    *pedals[p] = wanted[p];
+                    taken[size_t(wanted[p])] = true;
+                }
+            return out;
+        }
+        // It doesn't: the axes left over, in the order the device reports
+        // them.
+        for (int next = 0, p = 0; p < 3; p++)
+        {
+            if (p == 2 && wanted[2] < 0)
+                break;  // this wheel has no clutch to find
+            while (next < count && taken[size_t(next)])
+                next++;
+            if (next >= count)
+                break;
+            *pedals[p] = next;
+            taken[size_t(next)] = true;
+        }
+        return out;
+    }
+
+    // A pedal, as the span from where it rests to where it reads fully
+    // pressed. Both ends are measured - from the wheel's model, or from the
+    // player pressing it in Settings > Wheel > Calibrate - because neither
+    // can be assumed:
+    //
+    //   - which end a pedal rests at differs between wheels and between one
+    //     wheel's modes (a G29 rests at +32767 and runs to -32768);
+    //   - SDL reads every axis as 0 until the device first reports, and sends
+    //     no event for one until it moves, so a pedal's 0 can mean nothing;
+    //   - a pedal needn't reach the end of its axis, and the span says how
+    //     far it really goes, so a floored pedal reads as floored;
+    //   - and two pedals can share one axis, one taking it positive and the
+    //     other negative. Each has its own span, so each reads only its own
+    //     half and ignores the other's.
+    //
+    // Only movement towards the pressed end counts: the other way is a
+    // pedal still coming up, which is to say not pressed.
+    struct Pedal
+    {
+        int16_t idle = 0;  // where it rests
+        int16_t full = 0;  // where it reads fully pressed
+        bool ready = false;
+
+        // Both ends. Equal ends (or the 0, 0 of a pedal nobody has placed)
+        // leave it reading nothing, which is the safe way to be wrong.
+        constexpr void Start(int16_t rest, int16_t pressed)
+        {
+            idle = rest;
+            full = pressed;
+            ready = rest != pressed;
+        }
+
+        constexpr float Value(int16_t raw) const
+        {
+            if (!ready)
+                return 0.0f;
+            const int32_t span = int32_t(full) - int32_t(idle);
+            if (span == 0)
+                return 0.0f;
+            // max first, not clamp: a pedal at rest reads 0, not -0 ("-0%").
+            return std::min(1.0f, std::max(0.0f, float(int32_t(raw) - int32_t(idle)) / float(span)));
+        }
+    };
+
+    // The wheel's own axis, as the two places it reads at full lock. Like a
+    // pedal, both ends are measured rather than assumed, which gives three
+    // things at once: the centre (halfway between them), how far it turns
+    // each way (a wheel needn't be symmetrical, or reach the ends of its
+    // axis), and which way round it is - a wheel whose axis runs backwards
+    // has its ends the other way about, and needs nothing else said.
+    struct Steering
+    {
+        int16_t left = -kAxisMax, right = kAxisMax;
+        bool ready = false;
+
+        constexpr void Start(int16_t fullLeft, int16_t fullRight)
+        {
+            left = fullLeft;
+            right = fullRight;
+            ready = fullLeft != fullRight;
+        }
+
+        // -1 (full left) to 1, before Steering Range, the deadzone and the
+        // response curve. Each side is measured against its own end, so an
+        // off-centre or lopsided wheel still reaches full lock both ways.
+        constexpr float Fraction(int16_t raw) const
+        {
+            const float centre = (float(left) + float(right)) * 0.5f;
+            const float toRight = float(right) - centre;
+            const float toLeft = float(left) - centre;
+            if (toRight == 0.0f || toLeft == 0.0f)
+                return 0.0f;
+            const float v = float(raw) - centre;
+            // Whichever side of centre the reading is on, against that side's end.
+            const float t = (v * toRight >= 0.0f) ? v / toRight : -(v / toLeft);
+            return std::clamp(t, -1.0f, 1.0f);
+        }
+    };
+
+    // The controls Calibrate can learn a button for, in the order it asks
+    // for them. The D-pad is left out: it comes from the hat, whose four
+    // bits mean the same on every joystick SDL reports.
+    enum class Control : uint8_t { A, B, X, Y, LB, RB, Back, Start, LS, RS, ShiftUp, ShiftDown, Count };
+    constexpr size_t kControlCount = size_t(Control::Count);
+
+    struct ControlInfo
+    {
+        Control control;
+        uint16_t button;   // Role::Button: which pad button it is
+        Role role;
+        const char* name;  // what Calibrate calls it
+    };
+
+    inline constexpr ControlInfo kControls[kControlCount] = {
+        { Control::A, button::A, Role::Button, "A" },
+        { Control::B, button::B, Role::Button, "B" },
+        { Control::X, button::X, Role::Button, "X" },
+        { Control::Y, button::Y, Role::Button, "Y" },
+        { Control::LB, button::LeftShoulder, Role::Button, "LB" },
+        { Control::RB, button::RightShoulder, Role::Button, "RB" },
+        { Control::Back, button::Back, Role::Button, "Back" },
+        { Control::Start, button::Start, Role::Button, "Start" },
+        { Control::LS, button::LeftThumb, Role::Button, "Left stick click" },
+        { Control::RS, button::RightThumb, Role::Button, "Right stick click" },
+        { Control::ShiftUp, 0, Role::ShiftUp, "Shift up" },
+        { Control::ShiftDown, 0, Role::ShiftDown, "Shift down" },
+    };
+
+    consteval bool ControlsInOrder()
+    {
+        for (size_t i = 0; i < kControlCount; i++)
+            if (size_t(kControls[i].control) != i)
+                return false;
+        return true;
+    }
+    static_assert(ControlsInOrder(), "one row per Control, in Control order");
+
+    // The model's buttons with the player's own on top: `assigned[i]` is the
+    // joystick button Calibrate recorded for Control(i), or -1 for none of
+    // its doing. A button the player gives to one control is taken off
+    // whatever else had it, so no press can mean two things.
+    inline std::vector<Binding> WithAssigned(std::span<const Binding> from, std::span<const int> assigned)
+    {
+        std::vector<Binding> out(from.begin(), from.end());
+        for (size_t i = 0; i < assigned.size() && i < kControlCount; i++)
+        {
+            const int index = assigned[i];
+            if (index < 0)
+                continue;
+            const ControlInfo& c = kControls[i];
+            std::erase_if(out, [&](const Binding& b) {
+                return b.index == index || (b.role == c.role && (c.role != Role::Button || b.button == c.button));
+            });
+            out.push_back({ index, c.button, c.role });
+        }
+        std::stable_sort(out.begin(), out.end(), [](const Binding& a, const Binding& b) { return a.index < b.index; });
+        return out;
+    }
+
+    // ---- Settings > Wheel > Calibrate --------------------------------------
+    //
+    // One step at a time: the wheel's two ends, each pedal, then a button for
+    // every pad control. hid/wheel.cpp feeds the device in every frame
+    // (Calibration::Update) and stores each step as it is kept; the menu draws
+    // it and passes on the keyboard's and a controller's keys. Kept here,
+    // SDL-free, so tests/wheel_map_test.cpp can drive it frame by frame.
+    //
+    //   - An axis step watches every axis and takes the one that has gone
+    //     furthest from where it started the step - or, on an axis an earlier
+    //     pedal of this run took, from that pedal's resting place and only the
+    //     other way. So letting the throttle up while pressing the brake (a full
+    //     sweep of the throttle's axis) counts for nothing in the brake's step,
+    //     while two pedals sharing one axis, one each way, still each find their
+    //     half. The wheel's own axis is never a pedal's, and the second end of
+    //     the wheel is looked for on the axis the first was found on.
+    //   - What an axis step keeps is the end the axis reached, not where it
+    //     happens to be when A is pressed: let the wheel go and it is still the
+    //     lock it reached.
+    //   - A button step takes a fresh press (a button going down; one held as
+    //     the step began counts once it has been let go and pressed again) and
+    //     keeps it through its release. Pressing A then, or the same button
+    //     again, keeps it; any other button replaces it. So Cross can be A (press
+    //     it, then press it again) and Circle can be B.
+    //   - The wheel's D-pad (its hat, never one of its buttons) moves Calibrate
+    //     along: right skips a step (a wheel without a clutch), left goes back
+    //     one, down stops. In an axis step the wheel's A keeps and its B stops.
+    enum class Step : uint8_t
+    {
+        SteerLeft, SteerRight, Throttle, Brake, Clutch,
+        ButtonA, ButtonB, ButtonX, ButtonY, ButtonLB, ButtonRB,
+        ButtonBack, ButtonStart, ButtonLS, ButtonRS, ShiftUp, ShiftDown,
+        Count
+    };
+    constexpr size_t kStepCount = size_t(Step::Count);
+    static_assert(size_t(Step::Count) - size_t(Step::ButtonA) == kControlCount, "a button step per Control, in Control order");
+    constexpr bool IsSteerStep(Step s) { return s == Step::SteerLeft || s == Step::SteerRight; }
+    constexpr bool IsPedalStep(Step s) { return s >= Step::Throttle && s <= Step::Clutch; }
+    constexpr bool IsButtonStep(Step s) { return s >= Step::ButtonA && s < Step::Count; }
+    // A pedal step's slot (0 the throttle, 1 the brake, 2 the clutch) and back.
+    constexpr int PedalSlot(Step s) { return int(s) - int(Step::Throttle); }
+    constexpr Step PedalStep(int slot) { return Step(int(Step::Throttle) + slot); }
+    constexpr Control ControlOf(Step s) { return Control(size_t(s) - size_t(Step::ButtonA)); }
+    static_assert(PedalStep(0) == Step::Throttle && PedalStep(2) == Step::Clutch && PedalSlot(Step::Brake) == 1, "pedal slots");
+
+    // How far an axis must move in a step to be the one meant: a third of its
+    // travel, which no amount of jitter reaches and a deliberate press passes.
+    constexpr int kCalibrateMoved = kAxisMax / 3;
+    // The joystick buttons a step watches (the wheels we know have 25).
+    constexpr size_t kCalibrateButtons = 64;
+
+    class Calibration
+    {
+    public:
+        enum class Event : uint8_t { None, Kept, Skipped, Back, Stopped };
+
+        // What the step under way has found (Watch), and what a kept step
+        // stored (LastFound): an axis with where it rested and the end it
+        // reached, or a button.
+        struct Found
+        {
+            bool found = false;
+            int axis = -1;
+            int16_t rest = 0, full = 0;
+            float moved = 0.0f;  // how far it went, as a share of its travel
+            int button = -1;
+        };
+
+        // `seen`: which axes the device has reported (one that hasn't reads 0,
+        // which says nothing about where it is). `steerAxis`: the wheel's own
+        // axis as the device is read now, never a pedal's; this run's steering
+        // steps replace it.
+        void Start(std::span<const int16_t> axes, const std::vector<bool>& seen, std::span<const bool> buttons, uint8_t hat,
+            int steerAxis)
+        {
+            running_ = true;
+            step_ = last_ = Step::SteerLeft;
+            steerAxis_ = steerAxis;
+            results_ = {};
+            prev_ = {};
+            for (size_t b = 0; b < prev_.size() && b < buttons.size(); b++)
+                prev_[b] = buttons[b];
+            prevHat_ = hat;
+            seen_ = seen;
+            BeginStep(axes);
+        }
+
+        bool Running() const { return running_; }
+        Step Current() const { return step_; }
+        // After Kept, Skipped, Back or Stopped: the step it happened to; after
+        // Kept, what that step stored.
+        Step LastStep() const { return last_; }
+        Found LastFound() const { return results_[size_t(last_)]; }
+
+        // SDL's first report of an axis carries where it was before it moved
+        // (wheel.cpp passes it on): an axis that hadn't reported when the step
+        // began is measured from there.
+        void FirstValue(int axis, int16_t value)
+        {
+            if (!running_ || axis < 0 || size_t(axis) >= fromFirst_.size() || !fromFirst_[size_t(axis)])
+                return;
+            fromFirst_[size_t(axis)] = false;
+            ref_[size_t(axis)] = value;
+            far_[size_t(axis)] = value;
+            dist_[size_t(axis)] = -1;
+        }
+
+        // One frame of the device. `aButton`, `bButton`: the joystick buttons
+        // that are the pad's A and B now (-1: none).
+        Event Update(std::span<const int16_t> axes, const std::vector<bool>& seen, std::span<const bool> buttons, uint8_t hat,
+            int aButton, int bButton)
+        {
+            if (!running_)
+                return Event::None;
+            seen_ = seen;
+            std::array<bool, kCalibrateButtons> pressed{};
+            for (size_t b = 0; b < pressed.size(); b++)
+            {
+                const bool down = b < buttons.size() && buttons[b];
+                pressed[b] = down && !prev_[b];
+                prev_[b] = down;
+            }
+            const uint8_t newHat = uint8_t(hat & ~prevHat_);
+            prevHat_ = hat;
+            if (newHat & hat::Down)
+                return Stop();
+            if (newHat & hat::Right)
+                return Skip(axes);
+            if (newHat & hat::Left)
+                return Back(axes);
+            if (IsButtonStep(step_))
+            {
+                for (size_t b = 0; b < pressed.size(); b++)
+                {
+                    if (!pressed[b])
+                        continue;
+                    if (candidate_ >= 0 && (int(b) == candidate_ || int(b) == aButton))
+                        return Keep(axes);
+                    candidate_ = int(b);
+                }
+                return Event::None;
+            }
+            Fold(axes);
+            if (bButton >= 0 && size_t(bButton) < pressed.size() && pressed[size_t(bButton)])
+                return Stop();
+            if (aButton >= 0 && size_t(aButton) < pressed.size() && pressed[size_t(aButton)] && Watch().found)
+                return Keep(axes);
+            return Event::None;
+        }
+
+        Found Watch() const
+        {
+            Found f;
+            if (!running_)
+                return f;
+            if (IsButtonStep(step_))
+            {
+                f.found = candidate_ >= 0;
+                f.button = candidate_;
+                return f;
+            }
+            int32_t widest = -1;
+            for (size_t a = 0; a < dist_.size(); a++)
+                if (dist_[a] > widest)
+                {
+                    widest = dist_[a];
+                    f.axis = int(a);
+                }
+            if (widest < kCalibrateMoved)
+                return Found{};
+            f.found = true;
+            f.rest = int16_t(ref_[size_t(f.axis)]);
+            f.full = int16_t(far_[size_t(f.axis)]);
+            const float span = RestsCentred(f.rest) ? float(kAxisMax) : float(2 * kAxisMax);
+            f.moved = std::clamp(float(widest) / span, 0.0f, 1.0f);
+            return f;
+        }
+
+        // A from the keyboard or a controller (the wheel's own comes through
+        // Update): keep what the step found and go on. None while it has
+        // nothing yet, and the step carries on.
+        Event Keep(std::span<const int16_t> axes)
+        {
+            const Found f = Watch();
+            if (!running_ || !f.found)
+                return Event::None;
+            results_[size_t(step_)] = f;
+            last_ = step_;
+            if (IsSteerStep(step_))
+                steerAxis_ = f.axis;
+            Next(axes);
+            return Event::Kept;
+        }
+
+        // On without keeping anything for this step (what was stored before
+        // stays): a wheel without a clutch, or a control it has no button for.
+        Event Skip(std::span<const int16_t> axes)
+        {
+            if (!running_)
+                return Event::None;
+            last_ = step_;
+            Next(axes);
+            return Event::Skipped;
+        }
+
+        // The step before, again.
+        Event Back(std::span<const int16_t> axes)
+        {
+            if (!running_)
+                return Event::None;
+            if (step_ != Step::SteerLeft)
+                step_ = Step(int(step_) - 1);
+            last_ = step_;
+            results_[size_t(step_)] = {};
+            BeginStep(axes);
+            return Event::Back;
+        }
+
+        Event Stop()
+        {
+            if (!running_)
+                return Event::None;
+            last_ = step_;
+            running_ = false;
+            return Event::Stopped;
+        }
+
+    private:
+        void Next(std::span<const int16_t> axes)
+        {
+            if (size_t(step_) + 1 >= kStepCount)
+            {
+                running_ = false;
+                return;
+            }
+            step_ = Step(int(step_) + 1);
+            BeginStep(axes);
+        }
+
+        // An axis an earlier step of this run kept is measured from where it
+        // rested then, and only the other way: Full right from Full left's
+        // centre, away from the left end; a pedal sharing an earlier pedal's
+        // axis from that pedal's rest, away from its press.
+        void FromEarlier(Step earlierStep)
+        {
+            const Found& earlier = results_[size_t(earlierStep)];
+            if (!earlier.found || earlier.axis < 0 || size_t(earlier.axis) >= ref_.size())
+                return;
+            const size_t a = size_t(earlier.axis);
+            ref_[a] = far_[a] = earlier.rest;
+            forbid_[a] = earlier.full > earlier.rest ? 1 : -1;
+            fromFirst_[a] = false;
+        }
+
+        void BeginStep(std::span<const int16_t> axes)
+        {
+            candidate_ = -1;
+            const size_t n = axes.size();
+            ref_.assign(n, 0);
+            far_.assign(n, 0);
+            dist_.assign(n, -1);
+            forbid_.assign(n, 0);
+            allowed_.assign(n, true);
+            fromFirst_.assign(n, false);
+            for (size_t a = 0; a < n; a++)
+            {
+                ref_[a] = far_[a] = axes[a];
+                fromFirst_[a] = a >= seen_.size() || !seen_[a];  // its 0 means nothing yet
+            }
+            if (step_ == Step::SteerRight && results_[size_t(Step::SteerLeft)].found)
+            {
+                for (size_t a = 0; a < n; a++)
+                    allowed_[a] = int(a) == results_[size_t(Step::SteerLeft)].axis;
+                FromEarlier(Step::SteerLeft);
+            }
+            if (IsPedalStep(step_))
+            {
+                if (steerAxis_ >= 0 && size_t(steerAxis_) < n)
+                    allowed_[size_t(steerAxis_)] = false;
+                for (int slot = 0; slot < PedalSlot(step_); slot++)
+                    FromEarlier(PedalStep(slot));
+            }
+        }
+
+        void Fold(std::span<const int16_t> axes)
+        {
+            for (size_t a = 0; a < dist_.size() && a < axes.size(); a++)
+            {
+                if (!allowed_[a] || fromFirst_[a] || a >= seen_.size() || !seen_[a])
+                    continue;
+                const int32_t d = int32_t(axes[a]) - ref_[a];
+                if (d == 0 || (forbid_[a] > 0 && d > 0) || (forbid_[a] < 0 && d < 0))
+                    continue;
+                const int32_t m = d < 0 ? -d : d;
+                if (m > dist_[a])
+                {
+                    dist_[a] = m;
+                    far_[a] = axes[a];
+                }
+            }
+        }
+
+        bool running_ = false;
+        Step step_ = Step::SteerLeft, last_ = Step::SteerLeft;
+        int steerAxis_ = -1;
+        std::array<Found, kStepCount> results_{};
+        std::array<bool, kCalibrateButtons> prev_{};
+        uint8_t prevHat_ = 0;
+        int candidate_ = -1;
+        std::vector<bool> seen_;
+        std::vector<int32_t> ref_, far_, dist_;
+        std::vector<int> forbid_;       // +1: nothing above ref counts, -1: nothing below
+        std::vector<bool> allowed_;     // may be this step's axis at all
+        std::vector<bool> fromFirst_;   // hadn't reported when the step began: ref comes from FirstValue
+    };
+
+    // An axis read the other way round (Settings > Wheel > Invert
+    // Steering, or a wheel whose axis runs the opposite way): -32768 has no
+    // positive twin, so it clamps to the end of the other side instead of
+    // wrapping back to itself.
+    constexpr int16_t Flip(int16_t raw)
+    {
+        return int16_t(-std::clamp(int(raw), -kAxisMax, kAxisMax));
+    }
+
+    // The wheel as the game's left stick, -1 (full left) to 1, from the
+    // turn as a fraction of full lock (Steering::Fraction).
+    //
+    //   - `range` degrees of the wheel's turn reach full lock, out of the
+    //     `full` degrees it turns altogether (either 0: all of it). We can't
+    //     tell the wheel itself to turn less - that needs the maker's own
+    //     driver - so a smaller range means full lock comes up before the
+    //     wheel's stop does.
+    //   - `deadzone` of the turn either side of centre reads as straight
+    //     ahead, and the rest is rescaled so it still reaches full lock.
+    //   - `response` bends what's left: 1 is straight through, above 1 is
+    //     gentler near the centre and sharper near full lock, below 1 the
+    //     other way round.
+    inline float Steer(float turn, int range, int full, float deadzone, float response)
+    {
+        float x = std::clamp(turn, -1.0f, 1.0f);
+        const float sign = x < 0 ? -1.0f : 1.0f;
+        float m = std::abs(x);
+        deadzone = std::clamp(deadzone, 0.0f, 0.95f);
+        if (m <= deadzone)
+            return 0.0f;
+        m = (m - deadzone) / (1.0f - deadzone);
+        if (range > 0 && full > 0 && range < full)
+            m = m * float(full) / float(range);
+        m = std::min(1.0f, m);
+        if (response > 0.0f && response != 1.0f)
+            m = std::pow(m, response);
+        return sign * std::clamp(m, 0.0f, 1.0f);
+    }
+
+    // The game's own steering deadzone. The game was made for a pad, and the
+    // player's car ignores the left stick within 20% of its centre, then
+    // steers (|x| - 0.2) / 0.8 of full lock: measured in a race (round 2 of
+    // the G29 test, NOTES.md), the stick swept in 1% steps and the car's
+    // steering input read back each frame. Steering follows the stick at
+    // once (no ramp in between); its arithmetic on the way:
+    //   - XInput's -32768..32767 becomes an int, -1000..1000 (sub_8261BBA0:
+    //     (s + 32768) * 2000 / 65535 - 1000, rounded down), GameStickUnits;
+    //   - that, as a fraction, the 20% deadzone and the rescale, GameSteer.
+    // On a wheel it was 54 degrees of a G29's turn (20% of 270 at Steering
+    // Range 540) with the car going straight: the first thing a G29
+    // test found.
+    constexpr float kGameSteerDeadzone = 0.2f;
+    constexpr int kGameStickUnits = 1000;     // the int's full scale
+    constexpr int kGameDeadzoneUnits = 200;   // ...and the deadzone in it
+    constexpr int kGameSteerSteps = kGameStickUnits - kGameDeadzoneUnits;  // what the car's steering tells apart
+
+    constexpr int GameStickUnits(int16_t stick)
+    {
+        return int((int64_t(stick) + 32768) * 2000 / 65535) - kGameStickUnits;
+    }
+
+    inline float GameSteer(int16_t stick)
+    {
+        const int units = GameStickUnits(stick);
+        const float m = float(units < 0 ? -units : units) / float(kGameStickUnits);
+        if (m <= kGameSteerDeadzone)
+            return 0.0f;
+        return (units < 0 ? -1.0f : 1.0f) * (m - kGameSteerDeadzone) / (1.0f - kGameSteerDeadzone);
+    }
+
+    // The left stick (as hid/input.cpp's ToShort reads a fraction: times
+    // 32767, towards zero) that makes the game steer `steer` (-1 to 1): its
+    // deadzone stepped over, so the car turns from the wheel's first degree
+    // and follows it to full lock. The game tells 800 steps apart past its
+    // deadzone (a G29 at Steering Range 360: a quarter of a degree each); a
+    // turn of less than half of one is straight ahead, so a wheel resting a
+    // hair off its centre doesn't steer, or creep through the menus.
+    // A pad never comes here: its stick reaches the game as before.
+    inline float StickPastGameDeadzone(float steer)
+    {
+        const float y = std::clamp(steer, -1.0f, 1.0f);
+        const int steps = int(std::lround(std::abs(y) * float(kGameSteerSteps)));
+        if (steps == 0)
+            return 0.0f;
+        const int sign = y < 0 ? -1 : 1;
+        const int units = sign * (kGameDeadzoneUnits + steps);
+        // The smallest stick the game reads as those units: GameStickUnits
+        // rounds down, so the first stick at or past (units + 1000) / 2000
+        // of the way from -32768.
+        const int64_t num = int64_t(units + kGameStickUnits) * 65535;
+        const int stick = int(std::clamp<int64_t>((num + 1999) / 2000 - 32768, -32768, 32767));
+        // ...as a fraction ToShort turns back into exactly that stick.
+        return (float(stick) + 0.5f * float(sign)) / 32767.0f;
+    }
+
+    // Has the wheel been used? The game's idle check (SecondsSinceInput, which
+    // v0.1.7's refresh-rate notice waits on for 3 s) counts a control away from
+    // zero as in use. That suits a stick, whose deadzone makes one at rest
+    // exactly 0; a wheel has none (Steering Deadzone starts at 0%) and rests a
+    // little off its measured centre, so it was never idle and the notice never
+    // came. A wheel is in use when it has turned since it was last counted, by
+    // more than jitter.
+    constexpr float kWheelTurned = 0.02f;  // of full lock
+
+    struct WheelStill
+    {
+        float at = 0.0f;
+        bool started = false;
+
+        bool Turned(float steer)
+        {
+            if (started && std::abs(steer - at) <= kWheelTurned)
+                return false;
+            const bool was = started;
+            started = true;
+            at = steer;
+            return was;  // where it first is says nothing
+        }
+    };
+
+    // What the wheel's buttons and its hat amount to. The hat is the D-pad;
+    // the paddles push the right stick up and down, which is how the game
+    // shifts gears.
+    struct Pressed
+    {
+        uint16_t buttons = 0;
+        int16_t rightY = 0;
+    };
+
+    constexpr Pressed Resolve(std::span<const bool> buttons, uint8_t hatBits, std::span<const Binding> map)
+    {
+        Pressed out;
+        bool up = false, down = false;
+        for (const Binding& b : map)
+        {
+            if (b.index < 0 || size_t(b.index) >= buttons.size() || !buttons[size_t(b.index)])
+                continue;
+            switch (b.role)
+            {
+            case Role::Button: out.buttons |= b.button; break;
+            case Role::ShiftUp: up = true; break;
+            case Role::ShiftDown: down = true; break;
+            }
+        }
+        // Both paddles at once is no gear change either way (as holding
+        // both keys of a stick's pair centres it: hid/key_map.h).
+        out.rightY = int16_t(up == down ? 0 : up ? kAxisMax : -kAxisMax);
+        if (hatBits & hat::Up)
+            out.buttons |= button::DpadUp;
+        if (hatBits & hat::Down)
+            out.buttons |= button::DpadDown;
+        if (hatBits & hat::Left)
+            out.buttons |= button::DpadLeft;
+        if (hatBits & hat::Right)
+            out.buttons |= button::DpadRight;
+        return out;
+    }
+
+    // A pad control's name in NFSMW_WHEEL_BUTTONS, and in the log line that
+    // says what a wheel's buttons do.
+    inline constexpr std::pair<std::string_view, Binding> kNames[] = {
+        { "A", { 0, button::A } }, { "B", { 0, button::B } }, { "X", { 0, button::X } }, { "Y", { 0, button::Y } },
+        { "LB", { 0, button::LeftShoulder } }, { "RB", { 0, button::RightShoulder } },
+        { "BACK", { 0, button::Back } }, { "START", { 0, button::Start } },
+        { "LS", { 0, button::LeftThumb } }, { "RS", { 0, button::RightThumb } },
+        { "UP", { 0, button::DpadUp } }, { "DOWN", { 0, button::DpadDown } },
+        { "LEFT", { 0, button::DpadLeft } }, { "RIGHT", { 0, button::DpadRight } },
+        { "SHIFTUP", { 0, 0, Role::ShiftUp } }, { "SHIFTDOWN", { 0, 0, Role::ShiftDown } },
+        { "NONE", { 0, 0 } },
+    };
+
+    // What a Binding does, for the log.
+    inline std::string_view NameOf(const Binding& b)
+    {
+        for (const auto& [name, binding] : kNames)
+            if (binding.role == b.role && (b.role != Role::Button || binding.button == b.button))
+                return name;
+        return "?";
+    }
+
+    // NFSMW_WHEEL_BUTTONS="0=A,2=B,8=BACK,9=START,4=SHIFTUP": what a wheel's
+    // buttons do, for a wheel whose numbering we have wrong (the log's
+    // "[wheel] button n" lines say which is which). Every button named
+    // replaces what the model gave it; NONE takes one out, and the rest of
+    // the model's bindings stay. Returns the bindings, and in `error` the
+    // first item it couldn't read ("" when all of them were fine).
+    inline std::vector<Binding> ParseBindings(std::string_view text, std::span<const Binding> from, std::string& error)
+    {
+        std::vector<Binding> out(from.begin(), from.end());
+        error.clear();
+        while (!text.empty())
+        {
+            const size_t comma = text.find(',');
+            std::string_view item = text.substr(0, comma);
+            text = comma == std::string_view::npos ? std::string_view() : text.substr(comma + 1);
+            while (!item.empty() && std::isspace(static_cast<unsigned char>(item.front())))
+                item.remove_prefix(1);
+            while (!item.empty() && std::isspace(static_cast<unsigned char>(item.back())))
+                item.remove_suffix(1);
+            if (item.empty())
+                continue;
+            const size_t equals = item.find('=');
+            if (equals == std::string_view::npos || equals == 0)
+            {
+                if (error.empty())
+                    error = std::string(item);
+                continue;
+            }
+            int index = 0;
+            bool digits = true;
+            for (char c : item.substr(0, equals))
+                if (std::isdigit(static_cast<unsigned char>(c)))
+                    index = std::min(256, index * 10 + (c - '0'));  // past 255 is refused below, never past an int
+                else
+                    digits = false;
+            std::string name;
+            for (char c : item.substr(equals + 1))
+                name += char(std::toupper(static_cast<unsigned char>(c)));
+            const Binding* found = nullptr;
+            for (const auto& [known, binding] : kNames)
+                if (known == name)
+                    found = &binding;
+            if (!digits || index > 255 || !found)
+            {
+                if (error.empty())
+                    error = std::string(item);
+                continue;
+            }
+            std::erase_if(out, [&](const Binding& b) { return b.index == index; });
+            if (name != "NONE")
+                out.push_back({ index, found->button, found->role });
+        }
+        std::stable_sort(out.begin(), out.end(), [](const Binding& a, const Binding& b) { return a.index < b.index; });
+        return out;
+    }
+
+    // Settings > Wheel > Force Feedback: the rumble the game asks for
+    // (XInput's two motor speeds) as one strength, 0 to 1, at `percent` of
+    // full. The stronger motor has it: the game uses the two together for
+    // one knock.
+    inline float RumbleStrength(uint16_t low, uint16_t high, int percent)
+    {
+        const float strength = float(std::max(low, high)) / 65535.0f;
+        return std::clamp(strength * float(std::clamp(percent, 0, 100)) / 100.0f, 0.0f, 1.0f);
+    }
+
+    // A knock as the wheel plays it: one sine of the wheel's own, started
+    // when the game starts to rumble, its strength changed in place while it
+    // plays (it is never restarted), and let go of when the game stops.
+    //
+    // SDL's rumble (SDL_PlayHapticRumble) is the wrong shape for a wheel. On
+    // the Logitech wheels (SDL 3.4's SDL_hidapihaptic_lg4ff.c) it is a sine
+    // with a 1 s period that each call starts again from 0 degrees, and the
+    // game changes its rumble every frame, so the wheel only ever got the
+    // first 6 degrees of it: a push to one side of a tenth of the strength
+    // asked for, dropped to nothing at the next frame. The game knocks with
+    // a single frame of full rumble (both motors, 32767 to 65535, then back
+    // to 0: wall hits, bumps, gear changes), which came out as a 4% push
+    // for 10 ms - the click. Changing the sine in place instead keeps where
+    // it is in its swing (the driver carries the phase over an update).
+    //
+    // The shape (round 3 of the G29 test: the clicking came back while
+    // driving). The game's rumble while scraping a wall or driving off the
+    // road swings between ~25% and 100% a few times a second, with a frame
+    // of jitter on top. Through a simulation of SDL's driver (its 2 ms
+    // timer, ported), build 284's 75 ms sine at full strength, which took
+    // each rise in one frame and started again on a new knock, reversed the
+    // wheel's force ~15 times a second and jolted it (a 2 ms change of
+    // slope over 8% of full force) ~12 times a second: a rattle through
+    // the G29's gears. Now a 150 ms sine (fewer reversals), rising over at
+    // least kKnockAttackMs (no jolts), at kKnockGain of the wheel's force:
+    // ~7 reversals and under 0.5 jolts a second on the same rumble.
+    constexpr int kKnockPeriodMs = 150;    // ~6.7 Hz: a thump, not a rattle
+    constexpr int kKnockAttackMs = 33;     // from nothing to full strength (two frames)
+    constexpr int kKnockReleaseMs = 200;   // from full strength to nothing
+    constexpr float kKnockGain = 0.6f;     // a full rumble at Force Feedback 100%: 60% of the wheel's force
+    constexpr float kKnockStep = 1.0f / 32.0f;  // smaller changes wait (each one costs the sine up to 2 ms of phase)
+    // Long rumbles (the G29 retest of build 287): nitrous makes the game ask
+    // for 3.5-4.4 s of rumble at 75-100%, which as a knock shook the rim the
+    // whole time. A knock is short (a crash, a bump: a frame to a few hundred
+    // ms); a rumble the game keeps asking for past kKnockSustainMs eases, at
+    // the release, to kKnockSustainScale of what it asks, until it has been
+    // quiet for kKnockSustainGapMs.
+    constexpr int kKnockSustainMs = 300;       // longer than this is a rumble, not a knock
+    constexpr float kKnockSustainScale = 0.15f;  // a long rumble: 15% of the knock's strength
+    constexpr int kKnockSustainGapMs = 100;    // quiet this long: the next one is a knock again
+
+    struct Knock
+    {
+        enum class Action { None, Start, Change, Stop };
+        float level = 0.0f;  // what the wheel plays now, 0 to 1 (of a full rumble)
+        float sent = 0.0f;   // what it was last told
+        bool playing = false;
+        float heldMs = 0.0f;   // how long the game has kept asking (gaps under kKnockSustainGapMs included)
+        float quietMs = 0.0f;  // how long it has asked for nothing
+        bool sustained = false;  // past kKnockSustainMs: played at kKnockSustainScale
+
+        // Once a frame: the strength the game asks for now (RumbleStrength)
+        // and the milliseconds since the last frame. Start: run the sine at
+        // `level`, from the start of its swing; Change: give it `level`
+        // without restarting it; Stop: stop it (it is at 0 by then).
+        Action Step(float target, float ms)
+        {
+            target = std::clamp(target, 0.0f, 1.0f);
+            ms = std::max(ms, 0.0f);
+            if (target > 0.0f)
+            {
+                quietMs = 0.0f;
+                heldMs += ms;
+                sustained = sustained || heldMs > float(kKnockSustainMs);
+            }
+            else if ((quietMs += ms) >= float(kKnockSustainGapMs))
+            {
+                heldMs = 0.0f;
+                sustained = false;
+            }
+            if (sustained)
+                target *= kKnockSustainScale;
+            if (target >= level)
+                level = std::min(target, level + ms / float(kKnockAttackMs));
+            else
+                level = std::max(target, level - ms / float(kKnockReleaseMs));
+            if (!playing)
+            {
+                if (level <= 0.0f)
+                    return Action::None;
+                playing = true;
+                sent = level;
+                return Action::Start;
+            }
+            if (level <= 0.0f)
+            {
+                playing = false;
+                sent = 0.0f;
+                heldMs = 0.0f;
+                sustained = false;
+                return Action::Stop;
+            }
+            if (std::abs(level - sent) >= kKnockStep || (level == target && level != sent))
+            {
+                sent = level;
+                return Action::Change;
+            }
+            return Action::None;
+        }
+
+        // The sine's magnitude for `level` (SDL_HapticPeriodic's 0 to 32767).
+        static int16_t Magnitude(float level)
+        {
+            return int16_t(std::lround(std::clamp(level, 0.0f, 1.0f) * kKnockGain * 32767.0f));
+        }
+    };
+
+    // When the wheel is told its centring force (Settings > Wheel >
+    // Centering Force): once when it opens, again when the setting changes,
+    // and once more when the device first reports anything, because SDL's
+    // Logitech driver sets the wheel's autocentre to 0 on its first report
+    // (SDL_hidapi_lg4ff.c, with the range). Never on a timer: SDL says an
+    // autocentre level by switching the wheel's centring off, setting it and
+    // switching it on (SDL_hidapihaptic_lg4ff.c: 0xf5, 0xfe 0x0d, 0x14), and
+    // builds up to 286 said it again every second while no knock played. The
+    // spring let go for a moment each time, which can't be felt with the
+    // wheel straight, and is a click a second with it held round a corner
+    // (round 4 of the G29 test).
+    struct Centring
+    {
+        int said = -1;          // the level the wheel was last told; -1: none yet
+        bool reported = false;  // the device's first report has been answered
+        int sends = 0;          // how many times it was told, since the wheel opened
+
+        // Once a frame: the setting, and whether the device has reported
+        // anything yet. True: tell the wheel `percent` now.
+        bool Due(int percent, bool deviceReported)
+        {
+            percent = std::clamp(percent, 0, 100);
+            bool due = percent != said;
+            if (deviceReported && !reported)
+            {
+                reported = true;
+                due = true;  // SDL's driver has just cleared it
+            }
+            if (due)
+            {
+                said = percent;
+                sends++;
+            }
+            return due;
+        }
+    };
+
+    // Settings > Wheel > Centering Force as a spring effect's coefficient
+    // (how fast the force grows away from the middle, 0 to 0x7FFF) and its
+    // saturation (how far it grows, 0 to 0xFFFF), for a wheel whose force
+    // feedback takes a spring rather than an autocentre level.
+    inline uint16_t SpringLevel(int percent)
+    {
+        return uint16_t(std::clamp(percent, 0, 100) * 0x7FFF / 100);
+    }
+
+    inline uint16_t SpringSaturation(int percent)
+    {
+        return uint16_t(std::clamp(percent, 0, 100) * 0xFFFF / 100);
+    }
+}
diff --git a/runtime/kernel/vmem.cpp b/runtime/kernel/vmem.cpp
index ec1f7a4..e1a29f5 100644
--- a/runtime/kernel/vmem.cpp
+++ b/runtime/kernel/vmem.cpp
@@ -2,24 +2,51 @@
 #include "../stdafx.h"
 #include "vmem.h"
 
+#include <unistd.h>
+
 namespace vmem
 {
+    bool RemapAnon(void* host, size_t bytes)
+    {
+        return mmap(host, bytes, PROT_READ | PROT_WRITE, MAP_FIXED | MAP_ANON | MAP_PRIVATE, -1, 0) != MAP_FAILED;
+    }
+
+    void ResetHostRange(void* host, size_t bytes, size_t hostPage, RemapFn remap)
+    {
+        uint8_t* begin = static_cast<uint8_t*>(host);
+        uintptr_t lo = (uintptr_t(begin) + hostPage - 1) & ~uintptr_t(hostPage - 1);
+        uintptr_t hi = (uintptr_t(begin) + bytes) & ~uintptr_t(hostPage - 1);
+        if (lo >= hi)
+        {
+            memset(begin, 0, bytes);  // no whole host page inside
+            return;
+        }
+        uint8_t* wholeBegin = begin + (lo - uintptr_t(begin));
+        uint8_t* wholeEnd = begin + (hi - uintptr_t(begin));
+        memset(begin, 0, wholeBegin - begin);
+        if (!remap(wholeBegin, wholeEnd - wholeBegin))
+            memset(wholeBegin, 0, wholeEnd - wholeBegin);
+        memset(wholeEnd, 0, begin + bytes - wholeEnd);
+    }
+
     PageHeap::PageHeap(uint32_t base, uint32_t size, uint32_t pageSize)
-        : m_base(base), m_size(size), m_pageSize(pageSize), m_pages(size / pageSize)
+        : m_base(base), m_size(size), m_pageSize(pageSize), m_hostPage(size_t(sysconf(_SC_PAGESIZE))),
+          m_pages(size / pageSize)
     {
     }
 
-    // Returns pages to fresh zero-filled memory. Remapping is lazy and cheap
-    // even for hundreds of megabytes, unlike memset.
+    // Returns pages to fresh zero-filled memory (ResetHostRange: the whole
+    // host pages inside remapped, any partial ones at the ends cleared).
     void PageHeap::ResetHostPages(uint32_t firstPage, uint32_t count)
     {
         void* host = g_memory.Translate(m_base + firstPage * m_pageSize);
         size_t bytes = size_t(count) * m_pageSize;
         // Physical memory is a shared object mirrored at three windows:
         // remapping would break the aliasing, so zero it in place.
-        if (m_base >= 0xA0000000 ||
-            mmap(host, bytes, PROT_READ | PROT_WRITE, MAP_FIXED | MAP_ANON | MAP_PRIVATE, -1, 0) == MAP_FAILED)
+        if (m_base >= 0xA0000000)
             memset(host, 0, bytes);
+        else
+            ResetHostRange(host, bytes, m_hostPage, m_remap);
     }
 
     uint32_t PageHeap::Alloc(uint32_t size, uint32_t alignment, uint32_t type, uint32_t protect, bool topDown,
diff --git a/runtime/kernel/vmem.h b/runtime/kernel/vmem.h
index 56350f9..d541de1 100644
--- a/runtime/kernel/vmem.h
+++ b/runtime/kernel/vmem.h
@@ -8,6 +8,7 @@
 // keep a single window (as Unleashed Recompiled does) until the GPU needs
 // the others. Physical address = guest address & 0x1FFFFFFF.
 #pragma once
+#include <cstddef>
 #include <cstdint>
 #include <mutex>
 #include <vector>
@@ -40,6 +41,19 @@ namespace vmem
         uint32_t protect;
     };
 
+    // Remaps [host, host+bytes) to fresh zero-filled pages: whole host pages,
+    // an address and length aligned to them. False when it failed.
+    using RemapFn = bool (*)(void* host, size_t bytes);
+    bool RemapAnon(void* host, size_t bytes);  // mmap(MAP_FIXED | MAP_ANON | MAP_PRIVATE)
+    // Returns [host, host+bytes) to zero: the whole host pages (`hostPage`, a
+    // power of two) inside it remapped (lazy and cheap even for hundreds of
+    // megabytes; cleared in place if that fails), the partial head and tail
+    // cleared in place. Never a host page reaching outside the range: mmap
+    // rounds a MAP_FIXED length up to whole host pages, so on a 16 KB host
+    // remapping a 4 KB-page heap's range ending inside a host page zeroed the
+    // guest pages after it, possibly another allocation's.
+    void ResetHostRange(void* host, size_t bytes, size_t hostPage, RemapFn remap);
+
     class PageHeap
     {
     public:
@@ -67,6 +81,9 @@ namespace vmem
         // Not enforced on the host.
         uint32_t UsedPages();
         bool SetProtect(uint32_t addr, uint32_t size, uint32_t protect, uint32_t* oldProtect);
+        // Tests (vmem_host_pages_test): the host page size and remap that
+        // ResetHostPages uses instead of the host's own and RemapAnon.
+        void SetHostPagesForTest(size_t hostPage, RemapFn remap) { m_hostPage = hostPage; m_remap = remap; }
 
     private:
         enum : uint8_t { FREE = 0, RESERVED = 1, COMMITTED = 2 };
@@ -83,6 +100,8 @@ namespace vmem
         void ResetHostPages(uint32_t firstPage, uint32_t count);
 
         uint32_t m_base, m_size, m_pageSize;
+        size_t m_hostPage;
+        RemapFn m_remap = RemapAnon;
         std::vector<Page> m_pages;
         std::mutex m_mutex;
     };
diff --git a/runtime/kernel/write_watch.cpp b/runtime/kernel/write_watch.cpp
index 04c1e69..41cce55 100644
--- a/runtime/kernel/write_watch.cpp
+++ b/runtime/kernel/write_watch.cpp
@@ -53,7 +53,14 @@ namespace writewatch
         // at the next Rearm (submission boundary).
         std::vector<uint32_t> s_rearm;
         // NFSMW_LOG_GUARD=1: what each guest page was guarded for, logged on stalls.
+        // NFSMW_LOG_GUARD=<s> (more than 1): the stalls from s seconds after launch
+        // (the first 400 lines otherwise end in the menus; HFR M3).
         const bool s_logGuard = std::getenv("NFSMW_LOG_GUARD") != nullptr;
+        const auto s_logGuardFrom = std::chrono::steady_clock::now() + std::chrono::milliseconds(int64_t([] {
+            const char* v = std::getenv("NFSMW_LOG_GUARD");
+            const double s = v ? std::atof(v) : 0.0;
+            return s > 1.0 ? s * 1000.0 : 0.0;
+        }()));
         std::unique_ptr<std::atomic<const char*>[]> s_gpuTag;
         std::unique_ptr<std::atomic<uint32_t>[]> s_gpuRange[2];
         std::atomic<uint64_t> s_stalls{ 0 }, s_stallUs{ 0 }, s_faults{ 0 }, s_opened{ 0 };
@@ -147,15 +154,15 @@ namespace writewatch
         // page protected just for the GPU's use (vertex data) has no texture
         // to keep (every path that ends a watch marks all its guest pages).
         // Unsure cases mark the whole host page as before. In use with host
-        // pages of 2 to 32 guest pages: by default on Apple (iPad race:
-        // 13.9 -> 0 texture reloads a frame with the renderer's fusion
-        // toggles), only when set elsewhere; =0 turns it off (null arrays).
-#ifdef __APPLE__
-        constexpr bool kSubpagesByDefault = true;
-#else
-        constexpr bool kSubpagesByDefault = false;
-#endif
-        const bool s_watchSubpages = [] { const char* v = std::getenv("NFSMW_WATCH_SUBPAGES"); return v ? v[0] == '1' : kSubpagesByDefault; }();
+        // pages of 2 to 32 guest pages: by default wherever host pages are
+        // over 4 KB (Apple's 16 KB, iPad race: 13.9 -> 0 texture reloads a
+        // frame with the renderer's fusion toggles; a 16 KB Android device
+        // or Linux kernel alike), never on 4 KB hosts, where a host page is a
+        // guest page; =0 turns it off (null arrays), =1 on.
+        const bool s_watchSubpages = [] {
+            const char* v = std::getenv("NFSMW_WATCH_SUBPAGES");
+            return v ? v[0] == '1' : size_t(sysconf(_SC_PAGESIZE)) > (size_t(1) << kSubShift);
+        }();
         constexpr uint32_t kSnapSlots = 128, kSnapAge = 32;
         static_assert(kSnapSlots < 256, "s_snapOf holds a slot + 1 in a byte");
         // Under s_protectMutex: the slots (pending: the guest pages not
@@ -748,7 +755,7 @@ namespace writewatch
                 static std::atomic<uint32_t> logged{ 0 };
                 Dl_info dl{};
                 dladdr(t_faultPc, &dl);
-                if (logged++ < 400)
+                if (std::chrono::steady_clock::now() >= s_logGuardFrom && logged++ < 400)
                     fprintf(stderr, "[guard] stall %llu us (%s %08X): %s %08X+%X (submission %llu%s) in %s\n", (unsigned long long)us,
                         t_faultWrite ? "write" : "read", t_faultPhysical, s_gpuTag[sub].load(), s_gpuRange[0][sub].load(),
                         s_gpuRange[1][sub].load(), (unsigned long long)use, done ? "" : ", gave up", dl.dli_sname ? dl.dli_sname : "?");
diff --git a/runtime/main.cpp b/runtime/main.cpp
index ec0c989..cb6f693 100644
--- a/runtime/main.cpp
+++ b/runtime/main.cpp
@@ -17,6 +17,7 @@
 #include "cpu/guest_time.h"
 #include <video/presenter.h>
 #include <gpu/renderer.h>
+#include <game/hfr.h>
 #include <hid/input.h>
 #include <cpu/guest_thread.h>
 #include <cpu/host_cpu.h>
@@ -404,6 +405,7 @@ int main(int argc, char** argv)
     }
 #endif
     bool settingsLoaded = settings::Load();
+    hfr::Init();  // Smooth Motion, for this run
     // Which version ran last: a line in the log (so a bug report shows when a
     // problem began), the "What's new" note below, and this version recorded
     // as the last (user/version_check.h).
diff --git a/runtime/ui/settings_menu.cpp b/runtime/ui/settings_menu.cpp
index cab68a4..8657621 100644
--- a/runtime/ui/settings_menu.cpp
+++ b/runtime/ui/settings_menu.cpp
@@ -16,6 +16,7 @@
 #include <report/report.h>
 #include <user/settings.h>
 #include <hid/key_map.h>     // the Controls page: one row per control, two keys each
+#include <hid/wheel.h>       // the Wheel page: the device, its pedals and what they read
 #include <user/key_names.h>  // a key's name in the file, when SDL has none
 #include <video/frame_rate.h>
 #include <video/presenter.h>
@@ -52,6 +53,8 @@ namespace ui
         int s_slot = 0;              // 0: the row's first key, 1: its second
         constexpr const char* kPressAKey = "Press a key";
         constexpr const char* kNoKey = "none";
+        // The Wheel page's Calibrate row (CalibrateRow; hid/wheel.h runs it).
+        bool s_describedCal = false;  // the help line describes that row
 
         void EndWait()
         {
@@ -82,9 +85,15 @@ namespace ui
         }
 
         // iPhone and iPad: the Controls page only while a keyboard is
-        // connected (nothing to bind without one).
+        // connected (nothing to bind without one). The Wheel page, on every
+        // device, only while a wheel is plugged in: nothing on it means
+        // anything otherwise. Switching the wheel off doesn't take the page
+        // away with it (hid/wheel.h's Found against Playing), or the row
+        // that switched it off couldn't switch it back on.
         bool PageShown(Category c)
         {
+            if (c == Category::Wheel)
+                return hid::wheel::Found();
 #if defined(__APPLE__) && TARGET_OS_IOS
             if (c == Category::Controls)
                 return SDL_HasKeyboard();
@@ -209,6 +218,18 @@ namespace ui
                 LogChange(o, stored, settings::Set(o.id, next));
         }
 
+        // A row the menu shows: not hidden, and Smooth Motion only where the
+        // display can show it (video::HfrOffered) or while it's on (so it
+        // can be turned off from any screen).
+        bool Shown(const settings::Option& o)
+        {
+            if (o.hidden)
+                return false;
+            if (o.id == Id::SmoothMotion)
+                return video::HfrOffered() || settings::GetStoredValue(o.id) != 0.0 || settings::GetBool(o.id);
+            return true;
+        }
+
         float RowHeight()
         {
             return ImGui::GetFrameHeight() + 10.0f * Scale();
@@ -489,6 +510,70 @@ namespace ui
             return activated;
         }
 
+        // Settings > Wheel > Calibrate. The wheels we know say which axis
+        // each pedal is, and where the axes rest tells a pedal from the
+        // wheel itself (hid/wheel_map.h) - but three identical springs on a
+        // wheel we don't know can only be told apart by someone pressing
+        // them, and which way the wheel turns only by someone turning it.
+        //
+        // So: one step at a time, each showing what it has found and
+        // waiting for A to accept it. B gives up. The help line shows what
+        // every axis reads as it happens, so a wheel can be checked over
+        // without leaving the page.
+        using Step = hid::wheel::Step;
+
+        void CancelCalibrate()
+        {
+            if (hid::wheel::Calibrating())
+                hid::wheel::StopCalibrate();
+        }
+
+        // Every axis and what it reads now, for the help line.
+        std::string WheelReadings()
+        {
+            const hid::wheel::Assignment axes = hid::wheel::Axes();
+            const hid::wheel::Reading now = hid::wheel::Last();
+            std::string text = axes.steer < 0
+                ? "Steering: none"
+                : std::format("Steering axis {}{}: {:+.0f}%", axes.steer,
+                      settings::GetBool(Id::InvertSteering) ? " inverted" : "", double(now.steer) * 100.0);
+            struct Row { const char* name; int axis; float value; };
+            for (const Row& row : { Row{ "Throttle", axes.throttle, now.throttle }, Row{ "Brake", axes.brake, now.brake },
+                                    Row{ "Clutch", axes.clutch, now.clutch } })
+                text += row.axis < 0 ? std::format("   {}: none", row.name)
+                                     : std::format("   {} {}: {:.0f}%", row.name, row.axis, double(row.value) * 100.0);
+            return text;
+        }
+
+        void CalibrateRow(float valueWidth)
+        {
+            const bool calibrating = hid::wheel::Calibrating();
+            // While it runs, the value column counts the steps off: the
+            // names are too long for it, and the help line has them.
+            const std::string value = calibrating
+                ? std::format("{}/{}", size_t(hid::wheel::CalibratingStep()) + 1, hid::wheel::kStepCount)
+                : std::string("Start");
+            const bool activated = ActionRow("wheel-calibrate", "Calibrate", value.c_str(), valueWidth, s_describedCal);
+            if (!calibrating)
+            {
+                if (activated)
+                    hid::wheel::StartCalibrate();
+                return;
+            }
+            // The keyboard's and a controller's keys (the wheel's own go to
+            // Calibrate itself): A, Enter or a click keeps, right skips, left
+            // goes back; B or Esc stops, at the end of the menu's frame. The
+            // page owns these keys meanwhile (SettingsMenu), so the cursor stays
+            // here and A can't change another row on the way.
+            if (activated || ImGui::IsKeyPressed(ImGuiKey_GamepadFaceDown, false) || ImGui::IsKeyPressed(ImGuiKey_Enter, false) ||
+                ImGui::IsKeyPressed(ImGuiKey_KeypadEnter, false) || ImGui::IsKeyPressed(ImGuiKey_Space, false))
+                hid::wheel::KeepStep();
+            else if (ImGui::IsKeyPressed(ImGuiKey_GamepadDpadRight, false) || ImGui::IsKeyPressed(ImGuiKey_RightArrow, false))
+                hid::wheel::SkipStep();
+            else if (ImGui::IsKeyPressed(ImGuiKey_GamepadDpadLeft, false) || ImGui::IsKeyPressed(ImGuiKey_LeftArrow, false))
+                hid::wheel::BackStep();
+        }
+
         // A (or a click) saves the report.
         void BugReportRow(float valueWidth)
         {
@@ -620,6 +705,37 @@ namespace ui
                     ImGui::TextDisabled("%s", message.empty() ? " " : message.c_str());
                 return;
             }
+            if (s_describedCal)
+            {
+                if (hid::wheel::Calibrating())
+                {
+                    const hid::wheel::Step step = hid::wheel::CalibratingStep();
+                    const hid::wheel::Candidate c = hid::wheel::Watch();
+                    const char* name = hid::wheel::StepName(step);
+                    PushAccentText();
+                    if (!c.found)
+                        ImGui::TextWrapped("%zu of %zu, %s. %s%s", size_t(step) + 1, hid::wheel::kStepCount, name,
+                            hid::wheel::StepAsk(step), hid::wheel::StepIsButton(step) ? "." : ", then A to keep it.");
+                    else if (hid::wheel::StepIsButton(step))
+                        ImGui::TextWrapped("%s: button %d. A, or the same button again, keeps it; another button replaces it.",
+                            name, c.button);
+                    else
+                        ImGui::TextWrapped("%s: axis %d, %+d to %+d, %.0f%% of its travel. A keeps it.", name, c.axis, int(c.rest),
+                            int(c.full), double(c.moved) * 100.0);
+                    PopAccentText();
+                    ImGui::TextDisabled(hid::wheel::StepIsButton(step)
+                        ? "D-pad right skips, left goes back, down stops (keeping what's set). Esc stops too."
+                        : "D-pad right skips, left goes back; B, Esc or D-pad down stops (keeping what's set).");
+                }
+                else
+                    ImGui::TextWrapped("Teaches the game your wheel: both ends of its turn, each pedal, and a button for "
+                                       "every control, one at a time. A keeps what each step saw; the D-pad skips a step "
+                                       "or goes back. Only a wheel that comes out wrong needs this.");
+                ImGui::PushStyleColor(ImGuiCol_Text, ImGui::GetStyleColorVec4(ImGuiCol_TextDisabled));
+                ImGui::TextWrapped("%s", WheelReadings().c_str());
+                ImGui::PopStyleColor();
+                return;
+            }
             if (s_described == Id::Count)
             {
                 ImGui::TextDisabled(" ");
@@ -676,10 +792,28 @@ namespace ui
                 ImGui::TextUnformatted("Takes effect the next time the game starts.");
                 PopAccentText();
             }
+            else if (o.id == Id::SmoothMotion && settings::GetBool(o.id) && video::FrameRate() == 30)
+                ImGui::TextDisabled("Off while the game runs at 30 fps (Frame Rate).");
+            else if (o.id == Id::SmoothMotion && settings::GetBool(o.id) && !video::HfrOffered())
+                ImGui::TextDisabled("This screen shows 60 pictures a second: nothing to add here.");
             else if (o.apply == settings::Apply::Restart)
                 ImGui::TextDisabled("Changes take effect the next time the game starts.");
             else if (std::string note = o.id == Id::FrameRate ? video::AutoFrameRateNote() : std::string(); !note.empty())
                 ImGui::TextDisabled("%s", note.c_str());  // what Auto runs at now
+            // The wheel the page is about - and, for the two rows that need
+            // its motors, whether this system can drive them at all (on a Mac
+            // only the wheels SDL's own Logitech driver takes: hid/wheel.h).
+            else if (o.category == Category::Wheel)
+            {
+                const std::string name = hid::wheel::Name();
+                if ((o.id == Id::ForceFeedback || o.id == Id::CenteringForce) && !hid::wheel::HasForceFeedback())
+                    ImGui::TextDisabled("%s: this system can't drive its motors, so this does nothing. Steering, the pedals and "
+                                        "the buttons all work.", name.empty() ? "This wheel" : name.c_str());
+                else if (!name.empty())
+                    ImGui::TextDisabled("%s is connected.", name.c_str());
+                else
+                    ImGui::TextDisabled(" ");
+            }
             else
                 ImGui::TextDisabled(" ");
         }
@@ -731,7 +865,7 @@ namespace ui
             s_tabPending = true;
             s_focusFirstRow = true;
         }
-        if (!PageShown(s_category))  // the keyboard went away while on Controls
+        if (!PageShown(s_category))  // the keyboard, or the wheel, went away while on its page
         {
             s_category = Category::Input;
             s_tabPending = true;
@@ -747,8 +881,19 @@ namespace ui
         s_described = Id::Count;
         s_describedBugReport = false;
         s_describedUpdate = false;
+        s_describedCal = false;
         if (s_waiting != Id::Count && settings::Info(s_waiting).category != s_category)
             EndWait();
+        if (hid::wheel::Calibrating() && s_category != Category::Wheel)
+            CancelCalibrate();  // the page has gone (or the wheel has)
+        // While Calibrate runs, the keys that move around and pick rows are
+        // its own (CalibrateRow reads them; IsKeyPressed accepts any owner):
+        // the cursor stays on its row and A can't change another on the way.
+        if (hid::wheel::Calibrating())
+            for (ImGuiKey key : { ImGuiKey_GamepadDpadUp, ImGuiKey_GamepadDpadDown, ImGuiKey_GamepadDpadLeft, ImGuiKey_GamepadDpadRight,
+                     ImGuiKey_UpArrow, ImGuiKey_DownArrow, ImGuiKey_LeftArrow, ImGuiKey_RightArrow, ImGuiKey_GamepadFaceDown,
+                     ImGuiKey_Enter, ImGuiKey_KeypadEnter, ImGuiKey_Space })
+                ImGui::SetKeyOwner(key, ImHashStr("wheel-calibrate"));
         // For the B check at the end: B's nav cancel (in ImGui's NewFrame,
         // before this) takes the waiting row's focus, and KeyRow then ends
         // the wait before that check could see it.
@@ -799,11 +944,14 @@ namespace ui
                         valueWidth = 2 * KeyCellWidth() + KeyCellGap();
                     else
                         for (const auto& o : settings::Options())
-                            if (o.category == category && !o.hidden)
+                            if (o.category == category && Shown(o))
                                 valueWidth = std::max(valueWidth, ValueWidth(o));
                     if (category == Category::Advanced)
                         for (const char* text : { "Saving...", "Checking...", UpdateRowValue() })
                             valueWidth = std::max(valueWidth, ImGui::CalcTextSize(text).x);
+                    if (category == Category::Wheel)
+                        for (const char* text : { "Start", "17/17" })
+                            valueWidth = std::max(valueWidth, ImGui::CalcTextSize(text).x);
                     valueWidth += 2 * kSpaceM * s;
                     float arrow = ImGui::GetFrameHeight();
                     ImGui::PushStyleVar(ImGuiStyleVar_CellPadding, cellPadding);
@@ -819,11 +967,13 @@ namespace ui
                             }
                         else
                             for (const auto& o : settings::Options())
-                                if (o.category == category && !o.hidden)
+                                if (o.category == category && Shown(o))
                                 {
                                     OptionRow(o, valueWidth, focusFirst);
                                     focusFirst = false;
                                 }
+                        if (category == Category::Wheel)
+                            CalibrateRow(valueWidth);
                         if (category == Category::Advanced)
                         {
                             BugReportRow(valueWidth);
@@ -863,8 +1013,11 @@ namespace ui
         // Buttons (the help above runs to one, two or three lines).
         ButtonRowAtBottom();
         bool anyChanged = false;
+        // The Wheel page's pedal axes are hidden options, and Reset page
+        // does put them back, so they count as a change of the page.
+        const bool hiddenCounts = s_category == Category::Wheel;
         for (const auto& o : settings::Options())
-            if (o.category == s_category && !o.hidden && !settings::IsDefault(o.id))
+            if (o.category == s_category && (Shown(o) || (o.hidden && hiddenCounts)) && !settings::IsDefault(o.id))
                 anyChanged = true;
         ImGui::BeginDisabled(!anyChanged);
         if (ImGui::Button("Reset page"))
@@ -903,11 +1056,19 @@ namespace ui
             if (ImGui::Button("Reset"))
             {
                 for (const auto& o : settings::Options())
-                    if (o.category == s_category && !o.hidden)
+                    if (o.category == s_category && Shown(o))
                     {
                         double from = settings::GetStoredValue(o.id);
                         LogChange(o, from, settings::Reset(o.id));
                     }
+                // The pedals' axes are hidden options: the loop above
+                // leaves them, so the wheel puts them back itself.
+                if (s_category == Category::Wheel)
+                {
+                    CancelCalibrate();
+                    hid::wheel::ResetAxes();
+                    fprintf(stderr, "[settings] menu: calibrate: back to the device's own axes\n");
+                }
                 ImGui::CloseCurrentPopup();
             }
             ImGui::SameLine();
@@ -932,6 +1093,8 @@ namespace ui
         {
             if (wasWaiting)
                 EndWait();
+            else if (hid::wheel::Calibrating())
+                CancelCalibrate();  // wheel.cpp logs where it stopped
             else
                 CloseSettings();
         }
@@ -942,6 +1105,7 @@ namespace ui
     {
         s_opened = true;
         EndWait();  // a wait the menu was closed under is over
+        CancelCalibrate();  // ...and so is a step it was asking for
         s_takenKey = SDL_SCANCODE_UNKNOWN;
         s_slotRow = Id::Count;
         s_slot = 0;
diff --git a/runtime/ui/ui.cpp b/runtime/ui/ui.cpp
index 39a819a..1c71c49 100644
--- a/runtime/ui/ui.cpp
+++ b/runtime/ui/ui.cpp
@@ -3,6 +3,9 @@
 #include "ui.h"
 #include "cursor_idle.h"
 
+#include <hid/input.h>
+#include <hid/wheel.h>       // the settings chord and the menus from a steering wheel
+#include <hid/wheel_map.h>   // ...which buttons those are
 #include <kernel/xam.h>
 #include <report/report.h>
 #include <user/settings.h>
@@ -11,8 +14,10 @@
 #include <imgui.h>
 #include <imgui_impl_sdl3.h>
 #include <imgui_impl_vulkan.h>
+// FeedWheelNav: the input events the backend has queued this frame; on iOS also DragToScroll (the window under a
+// touch, its scroll and the active item).
+#include <imgui_internal.h>
 #if defined(__APPLE__) && TARGET_OS_IOS
-#include <imgui_internal.h>  // DragToScroll: the window under a touch, its scroll and the active item
 #include <platform/ios_ui.h>
 #endif
 #if defined(__APPLE__) && !TARGET_OS_IOS
@@ -122,6 +127,103 @@ namespace ui
         };
         std::unordered_map<SDL_JoystickID, Chord> s_chords;
 
+        // One of `which`'s two chord buttons went down or up. True when
+        // that opened or closed the menu, so the event is spent. A steering
+        // wheel comes through here too (it is a joystick, not a gamepad:
+        // hid/wheel.h), on the same state as a controller's.
+        bool ChordButton(SDL_JoystickID which, bool back, bool down)
+        {
+            Chord& chord = s_chords[which];
+            if (back)
+                chord.back = down;
+            else
+                chord.start = down;
+            if (!chord.back && !chord.start)
+                chord.fired = false;
+            if (s_modal)
+                return false;
+            if (chord.back && chord.start && !chord.fired)
+            {
+                chord.fired = true;
+                s_settingsOpen ? CloseSettings() : OpenSettings();
+                return true;
+            }
+            // In the menu, Start or Back alone closes it (and counts as the
+            // chord, so the other button of a Back + Start press can't reopen it).
+            if (down && s_settingsOpen && !chord.fired)
+            {
+                chord.fired = true;
+                CloseSettings();
+                return true;
+            }
+            return false;
+        }
+
+        // A steering wheel's buttons as the menus' navigation. ImGui takes
+        // gamepad keys only while its backend says a gamepad is there
+        // (ImGuiBackendFlags_HasGamepad), and the SDL3 backend clears that
+        // every frame it has no SDL gamepad open, which a wheel never is:
+        // with a wheel alone ImGui dropped every key it was fed (its NewFrame
+        // zeroes the gamepad keys without the flag). So while a wheel is
+        // plugged in the flag is set here, after the backend's frame, and
+        // each key is the wheel's OR the controller's (the backend's first
+        // gamepad, read from SDL as it reads it), every frame.
+        //
+        // The backend has already queued the controller's change for this
+        // frame, if there is one: that event is amended rather than followed
+        // by a second one for the same key, which ImGui's input trickling
+        // holds over to the next frame (a held wheel button beside an idle
+        // controller flickered, and presses were lost). Without a wheel this
+        // does nothing: the backend's behaviour is v0.1.7's.
+        void FeedWheelNav()
+        {
+            if (!hid::wheel::Found())
+                return;
+            using namespace hid::wheelmap::button;
+            struct Key { uint16_t bit; ImGuiKey key; SDL_GamepadButton pad; };
+            static const Key keys[] = {
+                { DpadUp, ImGuiKey_GamepadDpadUp, SDL_GAMEPAD_BUTTON_DPAD_UP },
+                { DpadDown, ImGuiKey_GamepadDpadDown, SDL_GAMEPAD_BUTTON_DPAD_DOWN },
+                { DpadLeft, ImGuiKey_GamepadDpadLeft, SDL_GAMEPAD_BUTTON_DPAD_LEFT },
+                { DpadRight, ImGuiKey_GamepadDpadRight, SDL_GAMEPAD_BUTTON_DPAD_RIGHT },
+                { A, ImGuiKey_GamepadFaceDown, SDL_GAMEPAD_BUTTON_SOUTH },
+                { B, ImGuiKey_GamepadFaceRight, SDL_GAMEPAD_BUTTON_EAST },
+                { X, ImGuiKey_GamepadFaceLeft, SDL_GAMEPAD_BUTTON_WEST },
+                { Y, ImGuiKey_GamepadFaceUp, SDL_GAMEPAD_BUTTON_NORTH },
+                { LeftShoulder, ImGuiKey_GamepadL1, SDL_GAMEPAD_BUTTON_LEFT_SHOULDER },
+                { RightShoulder, ImGuiKey_GamepadR1, SDL_GAMEPAD_BUTTON_RIGHT_SHOULDER },
+                { Start, ImGuiKey_GamepadStart, SDL_GAMEPAD_BUTTON_START },
+                { Back, ImGuiKey_GamepadBack, SDL_GAMEPAD_BUTTON_BACK },
+            };
+            ImGuiIO& io = ImGui::GetIO();
+            io.BackendFlags |= ImGuiBackendFlags_HasGamepad;
+            const uint16_t held = hid::wheel::HeldButtons();
+            SDL_Gamepad* pad = nullptr;
+            int count = 0;
+            if (SDL_JoystickID* ids = SDL_GetGamepads(&count))
+            {
+                if (count > 0)
+                    pad = SDL_GetGamepadFromID(ids[0]);  // the one the backend opened (its AutoFirst), or none
+                SDL_free(ids);
+            }
+            ImVector<ImGuiInputEvent>& queue = ImGui::GetCurrentContext()->InputEventsQueue;
+            for (const Key& k : keys)
+            {
+                const bool down = (held & k.bit) != 0 || (pad && SDL_GetGamepadButton(pad, k.pad));
+                ImGuiInputEvent* queued = nullptr;
+                for (ImGuiInputEvent& e : queue)
+                    if (e.Type == ImGuiInputEventType_Key && e.Key.Key == k.key)
+                        queued = &e;
+                if (queued)
+                {
+                    queued->Key.Down = down;
+                    queued->Key.AnalogValue = down ? 1.0f : 0.0f;
+                }
+                else
+                    io.AddKeyEvent(k.key, down);  // ImGui ignores it when the key is already so
+            }
+        }
+
         // A three-finger tap on a touchscreen (an iPhone's or iPad's, the
         // Steam Deck's) opens and closes the settings menu, as F1 does: the
         // fingers land within kTapLandNs of the first, all have lifted
@@ -682,32 +784,29 @@ namespace ui
         case SDL_EVENT_GAMEPAD_BUTTON_DOWN:
         case SDL_EVENT_GAMEPAD_BUTTON_UP:
         {
-            bool down = e.type == SDL_EVENT_GAMEPAD_BUTTON_DOWN;
-            Chord& chord = s_chords[e.gbutton.which];
-            if (e.gbutton.button == SDL_GAMEPAD_BUTTON_BACK)
-                chord.back = down;
-            else if (e.gbutton.button == SDL_GAMEPAD_BUTTON_START)
-                chord.start = down;
-            else
+            // Split screen: another player's Back + Start is the game's (our
+            // menu is player 1's, and blocks both while open).
+            if (hid::IsOtherPlayersPad(e.gbutton.which))
                 break;
-            if (!chord.back && !chord.start)
-                chord.fired = false;
-            if (s_modal)
+            if (e.gbutton.button != SDL_GAMEPAD_BUTTON_BACK && e.gbutton.button != SDL_GAMEPAD_BUTTON_START)
                 break;
-            if (chord.back && chord.start && !chord.fired)
-            {
-                chord.fired = true;
-                s_settingsOpen ? CloseSettings() : OpenSettings();
+            if (ChordButton(e.gbutton.which, e.gbutton.button == SDL_GAMEPAD_BUTTON_BACK,
+                    e.type == SDL_EVENT_GAMEPAD_BUTTON_DOWN))
                 return;
-            }
-            // In the menu, Start or Back alone closes it (and counts as the
-            // chord, so the other button of a Back + Start press can't reopen it).
-            if (down && s_settingsOpen && !chord.fired)
-            {
-                chord.fired = true;
-                CloseSettings();
+            break;
+        }
+        case SDL_EVENT_JOYSTICK_BUTTON_DOWN:
+        case SDL_EVENT_JOYSTICK_BUTTON_UP:
+        {
+            // A steering wheel's own Back and Start (hid/wheel.h). Every
+            // other joystick's buttons, and a gamepad's (which arrive as
+            // gamepad events as well), get nothing from ButtonFor.
+            const uint16_t bit = hid::wheel::ButtonFor(e.jbutton.which, e.jbutton.button);
+            if (bit != hid::wheelmap::button::Back && bit != hid::wheelmap::button::Start)
+                break;
+            if (ChordButton(e.jbutton.which, bit == hid::wheelmap::button::Back,
+                    e.type == SDL_EVENT_JOYSTICK_BUTTON_DOWN))
                 return;
-            }
             break;
         }
         case SDL_EVENT_GAMEPAD_ADDED:
@@ -715,6 +814,9 @@ namespace ui
             s_chords.erase(e.gdevice.which);
             forward = true;  // the backend re-opens its controllers
             break;
+        case SDL_EVENT_JOYSTICK_REMOVED:
+            s_chords.erase(e.jdevice.which);
+            break;
         case SDL_EVENT_FINGER_DOWN:
         case SDL_EVENT_FINGER_MOTION:
         case SDL_EVENT_FINGER_UP:
@@ -979,6 +1081,7 @@ namespace ui
             return false;
         ImGui_ImplVulkan_NewFrame();
         ImGui_ImplSDL3_NewFrame();
+        FeedWheelNav();  // after the backend's gamepads: a wheel's keys merged with the controller's
         // SDL gave the window's size and pixels; the UI is drawn into the
         // swapchain, which can be smaller (iOS's present scale) and, for a
         // moment, another shape (a view SDL turned portrait while it is
@@ -1103,6 +1206,10 @@ namespace ui
         if (!s_settingsOpen)
             return;
         s_settingsOpen = false;
+        // A wheel calibration under way ends with the menu (what it kept stays):
+        // while it runs the wheel's buttons are its own, chord included.
+        if (hid::wheel::Calibrating())
+            hid::wheel::StopCalibrate();
         UpdateCapture();
         ForgetUpdateDialog();
         ForgetQuitPrompt();
diff --git a/runtime/user/settings.cpp b/runtime/user/settings.cpp
index 3e11ae3..6de7595 100644
--- a/runtime/user/settings.cpp
+++ b/runtime/user/settings.cpp
@@ -120,6 +120,52 @@ namespace settings
             { kAnisotropyGame, "game", "Original" },
         };
 
+        // Settings > Wheel > Steering Range: the degrees of the wheel's
+        // turn that reach full lock, of the 900 a G29 and its family turn
+        // (hid/wheel_map.h). 0: all of it, whatever the wheel turns.
+        constexpr EnumEntry kSteeringRangeEntries[] = {
+            { 180, "180", "180" },
+            { 270, "270", "270" },
+            { 360, "360", "360" },
+            { 450, "450", "450" },
+            { 540, "540", "540" },
+            { 720, "720", "720" },
+            { 900, "900", "900" },
+            { 0, "all", "All" },
+        };
+
+        // One of the wheel's axes, as the device numbers them: what
+        // Settings > Wheel > Calibrate assigned. Hidden (the page's own row
+        // shows them, and shows them being pressed), and -1 by default:
+        // hid/wheel_map.h's Detect then works it out from the device.
+        constexpr Option WheelAxis(Id id, const char* key, const char* label, const char* env)
+        {
+            return { .id = id, .category = Category::Wheel, .type = Type::Int, .apply = Apply::Live, .hidden = true,
+                     .table = "wheel", .key = key, .label = label,
+                     .description = "Which of the wheel's axes this is, as the device numbers them. -1: from the device.",
+                     .env = env, .defaultValue = -1, .min = -1, .max = 31, .step = 1 };
+        }
+
+        // One end of a pedal's travel, as Settings > Wheel > Calibrate
+        // measured it (hidden). Equal ends: not measured.
+        constexpr Option WheelPoint(Id id, const char* key, const char* label, const char* env)
+        {
+            return { .id = id, .category = Category::Wheel, .type = Type::Int, .apply = Apply::Live, .hidden = true,
+                     .table = "wheel", .key = key, .label = label,
+                     .description = "What the pedal's axis reads there, as Calibrate measured it.",
+                     .env = env, .defaultValue = 0, .min = -32768, .max = 32767, .step = 1 };
+        }
+
+        // The joystick button Settings > Wheel > Calibrate gave a pad
+        // control (hidden). -1: none, and the wheel's model decides.
+        constexpr Option WheelButton(Id id, const char* key, const char* label, const char* env)
+        {
+            return { .id = id, .category = Category::Wheel, .type = Type::Int, .apply = Apply::Live, .hidden = true,
+                     .table = "wheel", .key = key, .label = label,
+                     .description = "Which of the wheel's buttons this control is, as Calibrate recorded it.",
+                     .env = env, .defaultValue = -1, .min = -1, .max = 255, .step = 1 };
+        }
+
         // A Controls row's key: the key (user/key_names.h, by its name
         // there) that drives one Xbox 360 control. Two per control, the
         // second named <key>_2 with the same label. No environment
@@ -161,6 +207,12 @@ namespace settings
               .table = "video", .key = "frame_rate", .label = "Frame Rate",
               .description = "Auto: 60, or 30 while the device is hot or can't hold 60. A steady 30 feels smoother than a shaky 60 (the Steam Frame's headset). The game keeps its speed.",
               .env = "NFSMW_FRAME_RATE", .defaultValue = 60, .entries = kFrameRateEntries },
+            // HFR (game/hfr.h): pictures between the 60 steps. At launch: the
+            // game's command buffers are sized for it when its device is made.
+            { .id = Id::SmoothMotion, .category = Category::Display, .type = Type::Bool, .apply = Apply::Restart,
+              .table = "video", .key = "smooth_motion", .label = "Smooth Motion",
+              .description = "Up to 120 fps on a 120 Hz screen (ProMotion): the game still runs at 60 steps a second, and a picture between each two is drawn from the poses either side. A little more delay and power. Heavy scenes drop to an even 60 for a while; off at 30 fps.",
+              .env = "NFSMW_HFR", .defaultValue = 0 },
             { .id = Id::PresentScale, .category = Category::Display, .type = Type::Enum, .apply = Apply::Live, .hidden = kPresentScaleHidden,
               .table = "video", .key = "present_scale", .label = "Screen Resolution",
               .description = "75%: the picture and these menus at 3/4 of the screen's resolution each way, scaled up by iOS: a little softer, a little less GPU work.",
@@ -238,8 +290,69 @@ namespace settings
               .env = "NFSMW_TRIGGER_DEADZONE", .defaultValue = 0.02, .min = 0, .max = 0.9, .step = 0.01, .unit = "%" },
             { .id = Id::Vibration, .category = Category::Input, .type = Type::Bool, .apply = Apply::Live,
               .table = "input", .key = "vibration", .label = "Vibration",
-              .description = "Controller rumble.",
+              .description = "Controller rumble, and the knocks a steering wheel's force feedback passes on (Settings > Wheel).",
               .env = "NFSMW_VIBRATION", .defaultValue = 1 },
+            // Wheel (Settings > Wheel; hid/wheel_map.h and hid/wheel.cpp
+            // read them). The page shows only while a wheel is connected.
+            { .id = Id::Wheel, .category = Category::Wheel, .type = Type::Bool, .apply = Apply::Live,
+              .table = "wheel", .key = "enabled", .label = "Steering Wheel",
+              .description = "Drive with a connected USB steering wheel. Off: the game ignores it and a controller or the keyboard plays, but it still works these menus.",
+              .env = "NFSMW_WHEEL", .defaultValue = 1 },
+            { .id = Id::SteeringRange, .category = Category::Wheel, .type = Type::Enum, .apply = Apply::Live,
+              .table = "wheel", .key = "steering_range", .label = "Steering Range",
+              .description = "How far you turn the wheel, lock to lock, for the car's full lock. 360 suits this game, which was made for a pad: half a turn each way. More is slower to steer; All uses the whole turn. The degrees assume a 900-degree wheel, as the G29 is.",
+              .env = "NFSMW_STEERING_RANGE", .defaultValue = 360, .min = 0, .max = 900, .entries = kSteeringRangeEntries },
+            { .id = Id::InvertSteering, .category = Category::Wheel, .type = Type::Bool, .apply = Apply::Live,
+              .table = "wheel", .key = "invert_steering", .label = "Invert Steering",
+              .description = "For a wheel whose axis runs the other way: turning left steers left again. Calibrate sets this for you.",
+              .env = "NFSMW_INVERT_STEERING", .defaultValue = 0 },
+            { .id = Id::SteeringDeadzone, .category = Category::Wheel, .type = Type::Float, .apply = Apply::Live,
+              .table = "wheel", .key = "steering_deadzone", .label = "Steering Deadzone",
+              .description = "How far the wheel turns before the game sees it. A wheel needs none; raise it only if the car pulls to one side.",
+              .env = "NFSMW_STEERING_DEADZONE", .defaultValue = 0, .min = 0, .max = 0.3, .step = 0.01, .unit = "%" },
+            { .id = Id::SteeringResponse, .category = Category::Wheel, .type = Type::Float, .apply = Apply::Live,
+              .table = "wheel", .key = "steering_response", .label = "Steering Response",
+              .description = "1.00 steers in step with the wheel, and suits most. Above 1.00 calms the centre for holding a straight, and sharpens the last of the turn. Below 1.00 makes the centre twitchy: at 0.50 the first tenth of the steering is within 2 degrees of straight.",
+              .env = "NFSMW_STEERING_RESPONSE", .defaultValue = 1.0, .min = 0.5, .max = 2.0, .step = 0.05 },
+            { .id = Id::ForceFeedback, .category = Category::Wheel, .type = Type::Int, .apply = Apply::Live,
+              .table = "wheel", .key = "force_feedback", .label = "Force Feedback",
+              .description = "How strongly the knocks the game asks for reach the wheel. Needs a wheel whose force feedback this system drives; Vibration (Input) turns it off too.",
+              .env = "NFSMW_FORCE_FEEDBACK", .defaultValue = 100, .min = 0, .max = 100, .step = 5, .unit = "%" },
+            { .id = Id::CenteringForce, .category = Category::Wheel, .type = Type::Int, .apply = Apply::Live,
+              .table = "wheel", .key = "centering_force", .label = "Centering Force",
+              .description = "How hard the wheel pulls back to straight ahead. A wheel with no spring of its own needs this; it needs force feedback too.",
+              .env = "NFSMW_WHEEL_CENTERING", .defaultValue = 50, .min = 0, .max = 100, .step = 5, .unit = "%" },
+            // The axes Settings > Wheel > Calibrate assigned, as the device
+            // numbers them; -1: work them out from the device itself
+            // (hid/wheel_map.h's Detect).
+            WheelAxis(Id::WheelSteerAxis, "steer_axis", "Steering Axis", "NFSMW_WHEEL_STEER_AXIS"),
+            WheelAxis(Id::WheelThrottleAxis, "throttle_axis", "Throttle Axis", "NFSMW_WHEEL_THROTTLE_AXIS"),
+            WheelAxis(Id::WheelBrakeAxis, "brake_axis", "Brake Axis", "NFSMW_WHEEL_BRAKE_AXIS"),
+            WheelAxis(Id::WheelClutchAxis, "clutch_axis", "Clutch Axis", "NFSMW_WHEEL_CLUTCH_AXIS"),
+            WheelPoint(Id::ThrottleRest, "throttle_rest", "Throttle at Rest", "NFSMW_WHEEL_THROTTLE_REST"),
+            WheelPoint(Id::ThrottleFull, "throttle_full", "Throttle Pressed", "NFSMW_WHEEL_THROTTLE_FULL"),
+            WheelPoint(Id::BrakeRest, "brake_rest", "Brake at Rest", "NFSMW_WHEEL_BRAKE_REST"),
+            WheelPoint(Id::BrakeFull, "brake_full", "Brake Pressed", "NFSMW_WHEEL_BRAKE_FULL"),
+            WheelPoint(Id::ClutchRest, "clutch_rest", "Clutch at Rest", "NFSMW_WHEEL_CLUTCH_REST"),
+            WheelPoint(Id::ClutchFull, "clutch_full", "Clutch Pressed", "NFSMW_WHEEL_CLUTCH_FULL"),
+            WheelPoint(Id::SteerLeft, "steer_left", "Steering Full Left", "NFSMW_WHEEL_STEER_LEFT"),
+            WheelPoint(Id::SteerRight, "steer_right", "Steering Full Right", "NFSMW_WHEEL_STEER_RIGHT"),
+            WheelButton(Id::ButtonA, "button_a", "A Button", "NFSMW_WHEEL_BUTTON_A"),
+            WheelButton(Id::ButtonB, "button_b", "B Button", "NFSMW_WHEEL_BUTTON_B"),
+            WheelButton(Id::ButtonX, "button_x", "X Button", "NFSMW_WHEEL_BUTTON_X"),
+            WheelButton(Id::ButtonY, "button_y", "Y Button", "NFSMW_WHEEL_BUTTON_Y"),
+            WheelButton(Id::ButtonLB, "button_lb", "LB Button", "NFSMW_WHEEL_BUTTON_LB"),
+            WheelButton(Id::ButtonRB, "button_rb", "RB Button", "NFSMW_WHEEL_BUTTON_RB"),
+            WheelButton(Id::ButtonBack, "button_back", "Back Button", "NFSMW_WHEEL_BUTTON_BACK"),
+            WheelButton(Id::ButtonStart, "button_start", "Start Button", "NFSMW_WHEEL_BUTTON_START"),
+            WheelButton(Id::ButtonLS, "button_ls", "Left Stick Click", "NFSMW_WHEEL_BUTTON_LS"),
+            WheelButton(Id::ButtonRS, "button_rs", "Right Stick Click", "NFSMW_WHEEL_BUTTON_RS"),
+            WheelButton(Id::ButtonShiftUp, "button_shift_up", "Shift Up", "NFSMW_WHEEL_BUTTON_SHIFT_UP"),
+            WheelButton(Id::ButtonShiftDown, "button_shift_down", "Shift Down", "NFSMW_WHEEL_BUTTON_SHIFT_DOWN"),
+            { .id = Id::WheelSettingsVersion, .category = Category::Wheel, .type = Type::Int, .apply = Apply::Live, .hidden = true,
+              .table = "wheel", .key = "settings_version", .label = "Wheel Settings Version",
+              .description = "Which steering these Wheel settings were made with: 0 before the game's own deadzone was stepped over, 1 since.",
+              .env = "NFSMW_WHEEL_SETTINGS_VERSION", .defaultValue = 0, .min = 0, .max = 1, .step = 1 },
             // Controls (Settings > Controls; hid/key_map.h reads them). The
             // defaults are v0.1.4's keys: the arrows steer as well as A
             // and D, and are the D-pad; O/L/K/; are the right stick.
@@ -1090,6 +1203,7 @@ namespace settings
         case Category::Audio: return "Audio";
         case Category::Input: return "Input";
         case Category::Controls: return "Controls";
+        case Category::Wheel: return "Wheel";
         case Category::Advanced: return "Advanced";
         default: return "";
         }
diff --git a/runtime/user/settings.h b/runtime/user/settings.h
index f8ea987..93f2786 100644
--- a/runtime/user/settings.h
+++ b/runtime/user/settings.h
@@ -43,6 +43,7 @@ namespace settings
         Fullscreen,
         VSync,
         FrameRate,
+        SmoothMotion,  // HFR (game/hfr.h): shown where the display can show it (video::HfrOffered)
         PresentScale,  // shown on iOS only
         AntiAliasing,
         Scaling,
@@ -63,6 +64,44 @@ namespace settings
         StickDeadzone,
         TriggerDeadzone,
         Vibration,
+        // Wheel (the [wheel] table): a USB steering wheel as the pad
+        // (hid/wheel_map.h). The page shows itself only while one is
+        // connected; the four axis options are hidden, and hold what
+        // Settings > Wheel > Calibrate assigned (-1: work it out from the
+        // device).
+        Wheel,
+        SteeringRange,
+        InvertSteering,
+        SteeringDeadzone,
+        SteeringResponse,
+        ForceFeedback,
+        CenteringForce,
+        WheelSteerAxis,     // hidden
+        WheelThrottleAxis,  // hidden
+        WheelBrakeAxis,     // hidden
+        WheelClutchAxis,    // hidden
+        // Each pedal's two ends, as Calibrate measured them: where it rests
+        // and where it reads fully pressed (hidden; equal values: not
+        // measured, and the wheel's model or its axis is used instead).
+        ThrottleRest, ThrottleFull,
+        BrakeRest, BrakeFull,
+        ClutchRest, ClutchFull,
+        // The wheel's own two ends, as Calibrate measured them at full lock
+        // each way (hidden; equal values: not measured). Between them they
+        // give the centre, how far it turns each way, and which way round
+        // it is.
+        SteerLeft, SteerRight,
+        // The joystick button Calibrate gave each pad control, in
+        // hid/wheel_map.h's Control order (hidden; -1: none of the
+        // player's doing, so the wheel's model decides).
+        ButtonA, ButtonB, ButtonX, ButtonY,
+        ButtonLB, ButtonRB, ButtonBack, ButtonStart,
+        ButtonLS, ButtonRS, ButtonShiftUp, ButtonShiftDown,
+        // Which steering this file's Wheel settings were made with (hidden):
+        // 0, builds before the game's own deadzone was stepped over (a file
+        // from them, or none yet); 1 since. hid/wheel.cpp brings a Steering
+        // Response set against that deadzone back to 1.00 once.
+        WheelSettingsVersion,
         // Controls (the [keys] table): the two keyboard keys that drive
         // each Xbox 360 control, as key codes (user/key_names.h); the
         // second of a pair is always the first's id + 1 (hid/key_map.h
@@ -101,7 +140,7 @@ namespace settings
     // Key: a key code of user/key_names.h (0: no key), saved by its name
     // there ("w", "left_shift", "none"); the menu takes it from a key press.
     enum class Type : uint8_t { Bool, Int, Float, Enum, Key };
-    enum class Category : uint8_t { Display, Graphics, Audio, Input, Controls, Advanced, Count };
+    enum class Category : uint8_t { Display, Graphics, Audio, Input, Wheel, Controls, Advanced, Count };
     enum class Apply : uint8_t { Live, Restart };
 
     // Values of the enum options (GetInt returns them).
diff --git a/runtime/video/hfr_schedule.h b/runtime/video/hfr_schedule.h
new file mode 100644
index 0000000..0f021d7
--- /dev/null
+++ b/runtime/video/hfr_schedule.h
@@ -0,0 +1,88 @@
+// SpeedBreaker runtime. GPL-3.0-or-later (see COPYING).
+//
+// HFR (game/hfr.h) on a Mac whose frames are shown at a set time after their
+// guest vblank (video/present_schedule.h): how much later than that time
+// both of a world step's pictures are shown, from the driver's reports.
+//
+// The in-between picture is shown half a vblank before the real one, so the
+// real one must be ready by its time for the two to stay evenly spaced. At
+// 60 fps 12.5 ms after the vblank leaves room (99.9% of frames ready by then
+// while driving); with two pictures a step a heavy scene (a cutscene with ten
+// cars) misses it: M2's first ProMotion run had 16.8% of its cutscene frames
+// ready later than 12.5 ms, and the late real pictures, shown when ready,
+// came out next to (or after) the following in-between one. So when
+// kLateToGrow of the last kWindow pictures shown at a time were reported more
+// than kLateNs late, both pictures of every step go a step of the panel's
+// 240 Hz timing grid later (at most kMaxExtraNs), and a step earlier again
+// once none has been late for `hold` (10 s at first, twice as long after each
+// earlier time that turned late again within kRecentNs, up to 160 s).
+// Header only: tests/hfr_schedule_test.cpp checks it.
+#pragma once
+#include <algorithm>
+#include <cstdint>
+#include <iterator>
+
+namespace video
+{
+    class HfrShowAdapt
+    {
+    public:
+        static constexpr int64_t kStepNs = 4'166'667;    // ProMotion's 240 Hz timing grid
+        static constexpr int64_t kMaxExtraNs = 4 * kStepNs;
+        static constexpr uint32_t kWindow = 120;           // 1 s of pictures at 120 a second
+        static constexpr uint32_t kLateToGrow = 3;
+        static constexpr int64_t kLateNs = 1'000'000;
+        static constexpr int64_t kFirstHoldNs = 10'000'000'000;
+        static constexpr int64_t kMaxHoldNs = 160'000'000'000;
+        static constexpr int64_t kRecentNs = 6'000'000'000;
+
+        // A picture shown at a time was reported shown `lateNs` after it (ns;
+        // below 0: before), at `now` (ns, any steady clock). True when
+        // ExtraNs changed.
+        bool Report(int64_t lateNs, int64_t now)
+        {
+            const bool late = lateNs > kLateNs;
+            if (m_count == kWindow)
+                m_late -= m_window[m_next];
+            else
+                m_count++;
+            m_window[m_next] = late;
+            m_late += late;
+            m_next = (m_next + 1) % kWindow;
+            if (late)
+                m_lastLate = now;
+            if (m_late >= kLateToGrow && m_extra < kMaxExtraNs)
+            {
+                if (m_lastShrink && now - m_lastShrink < kRecentNs)
+                    m_hold = std::min(m_hold * 2, kMaxHoldNs);
+                m_extra += kStepNs;
+                m_lastGrow = now;
+                Clear();
+                return true;
+            }
+            if (m_extra > 0 && now - std::max(m_lastLate, m_lastGrow) >= m_hold && now - m_lastShrink >= m_hold)
+            {
+                m_extra -= kStepNs;
+                m_lastShrink = now;
+                Clear();
+                return true;
+            }
+            return false;
+        }
+
+        int64_t ExtraNs() const { return m_extra; }
+        int64_t HoldNs() const { return m_hold; }
+
+    private:
+        void Clear()
+        {
+            std::fill(std::begin(m_window), std::end(m_window), false);
+            m_count = m_next = m_late = 0;
+        }
+
+        bool m_window[kWindow] = {};
+        uint32_t m_count = 0, m_next = 0, m_late = 0;
+        int64_t m_extra = 0, m_hold = kFirstHoldNs;
+        int64_t m_lastLate = 0, m_lastGrow = 0, m_lastShrink = 0;
+    };
+}
diff --git a/runtime/video/presenter.cpp b/runtime/video/presenter.cpp
index ea7535e..c2c06ff 100644
--- a/runtime/video/presenter.cpp
+++ b/runtime/video/presenter.cpp
@@ -10,8 +10,12 @@
 #include <gpu/renderer.h>
 #include <game/ultrawide.h>
 #include <game/movie_pacing.h>
+#include <game/cover_callers.h>
+#include <gpu/covers.h>
 #include "gpu_choice.h"
 #include "present_schedule.h"
+#include "hfr_schedule.h"
+#include <game/hfr.h>
 #include "swapchain_use.h"
 #include "picture_fit.h"
 #include "frame_rate.h"
@@ -42,6 +46,11 @@
 #include <SDL3/SDL_vulkan.h>
 
 #include <algorithm>
+#include <atomic>
+#include <chrono>
+#include <format>
+#include <iterator>
+#include <unordered_set>
 #include <condition_variable>
 #include <deque>
 #include <fstream>
@@ -147,6 +156,18 @@ namespace video
         // an earlier queue submission).
         VkImage s_pendingImage = VK_NULL_HANDLE;
         int64_t s_pendingVblank = 0;  // the guest vblank the frame followed
+        float s_pendingShift = 0.0f;  // shown that much of a vblank early (game/hfr.h: a step's own picture drawn between)
+        int64_t s_pendingTarget = 0;  // when to show it (game/hfr.h on a grid that isn't a multiple of 60 Hz; 0: the usual way)
+        // An in-between picture (game/hfr.h: drawn between two world steps,
+        // presented before the real picture of the later one) from the
+        // renderer, with its fraction of the step; shown before s_pending*.
+        VkImage s_betweenImage = VK_NULL_HANDLE;
+        uint32_t s_betweenWidth = 0, s_betweenHeight = 0, s_betweenAspectW = 0, s_betweenAspectH = 0;
+        int64_t s_betweenVblank = 0;  // the guest vblank before it
+        float s_betweenT = 0.0f;
+        int64_t s_betweenTarget = 0;
+        bool s_betweenNew = false;
+        std::atomic<uint64_t> s_betweenDropped{ 0 }, s_betweenShown{ 0 }, s_betweenPresented{ 0 };
         std::atomic<uint64_t> s_dropped{ 0 };  // frames replaced here before they were shown
         std::atomic<uint64_t> s_repeated{ 0 }, s_shown{ 0 };  // see PresentStats
         std::atomic<int64_t> s_guestVblank{ 0 };
@@ -295,6 +316,8 @@ namespace video
             int64_t presented;  // vkQueuePresentKHR (ns, steady clock)
             int64_t vblank;     // a new game frame: the guest vblank it followed; 0: a redraw
             int64_t ready;      // ready to present (= presented, but for a frame held for its refresh: VblankLock::PresentAt)
+            float between = 0;  // an in-between picture's fraction of the step (game/hfr.h; its vblank is 0)
+            int64_t desired = 0;  // macOS: the time it was asked to be shown at (0: when ready)
         };
         // Never destroyed: the waiter is detached and blocks on them, and
         // glibc's pthread_cond_destroy waits for blocked waiters, so an exit
@@ -318,6 +341,11 @@ namespace video
         // present completions at it, since when (ns, steady clock; 0: not).
         std::atomic<double> s_gridHz{ 0.0 };
         std::atomic<int64_t> s_gridFixedSince{ 0 };
+        // The grid check's fit, for HFR (HfrGrid): valid, period, a refresh.
+        std::atomic<bool> s_hfrGridValid{ false };
+        std::atomic<int64_t> s_hfrGridPeriodNs{ 0 }, s_hfrGridNs{ 0 };
+        // NFSMW_HFR_GRID_HZ=<hz>: a made-up grid at that rate (tests on any display).
+        const double s_hfrGridForcedHz = [] { const char* v = std::getenv("NFSMW_HFR_GRID_HZ"); return v ? std::atof(v) : 0.0; }();
 
         // macOS: a new frame may be shown a set time after the guest vblank
         // that released it (VK_GOOGLE_display_timing's desiredPresentTime,
@@ -353,7 +381,21 @@ namespace video
         };
         ScheduledPresent s_scheduled[64];
         uint32_t s_scheduledNext = 0;
+        // HFR (game/hfr.h): both pictures of a step later than the set time
+        // when the real ones aren't ready by it (video/hfr_schedule.h; under
+        // s_scheduleMutex). Active while in-between pictures are presented
+        // (until 1 s after the last one); the main thread's last asked-for time.
+        HfrShowAdapt s_hfrAdapt;
+        // NFSMW_HFR_SHOW_ADAPT=1 (DIAGNOSTIC): the adaptation on. Off: M2's
+        // run dm2 showed it backfires (later times keep more pictures queued
+        // than the swapchain has images: 80 pictures a second in a race that
+        // held 120 without it).
+        const bool s_hfrShowAdapt = [] { const char* v = std::getenv("NFSMW_HFR_SHOW_ADAPT"); return v && v[0] == '1'; }();
+        std::atomic<int64_t> s_hfrActiveUntil{ 0 };
+        int64_t s_hfrLastDesired = 0;
+        constexpr int64_t kHfrMinGapNs = 4'000'000;  // between two pictures asked for (order kept, never at once)
         float s_displayHz = 0.0f;  // the display mode's, for the log (main thread)
+        std::atomic<float> s_offeredHz{ 0.0f };  // the same, for HfrOffered (any thread)
 #endif
         // NFSMW_VBLANK_LOG's <file>.actual.csv: the driver's own on-screen
         // time per present (Metal's presentedTime, mach_absolute_time ns, 0:
@@ -410,6 +452,12 @@ namespace video
                         {
                             const bool shown = e.actualPresentTime != 0;
                             tripped |= s_schedule.Reported(shown, shown ? int64_t(e.actualPresentTime) + hostToSteady - p.desiredNs : 0);
+                            if (const int64_t now = NowNs(); s_hfrShowAdapt && shown && now < s_hfrActiveUntil.load(std::memory_order_relaxed))
+                                if (s_hfrAdapt.Report(int64_t(e.actualPresentTime) + hostToSteady - p.desiredNs, now))
+                                    fprintf(stderr, "[hfr] pictures shown %.2f ms after their vblank's time (+%.2f: %s; next earlier after %.0f s "
+                                                    "without a late one)\n", double(s_showAfterVblankNs + s_hfrAdapt.ExtraNs()) / 1e6,
+                                        double(s_hfrAdapt.ExtraNs()) / 1e6, "the real pictures weren't ready by their time" ,
+                                        double(s_hfrAdapt.HoldNs()) / 1e9);
                             p = {};
                             break;
                         }
@@ -470,6 +518,12 @@ namespace video
                 {
                     grid.Add(onScreen);
                     const bool fixed = grid.Estimate().valid;
+                    if (fixed)
+                    {
+                        s_hfrGridPeriodNs.store(int64_t(std::llround(grid.Estimate().periodNs)), std::memory_order_relaxed);
+                        s_hfrGridNs.store(grid.Estimate().gridNs, std::memory_order_relaxed);
+                    }
+                    s_hfrGridValid.store(fixed, std::memory_order_relaxed);
                     const int64_t since = s_gridFixedSince.load(std::memory_order_relaxed);
                     if (fixed != (since != 0))
                         s_gridFixedSince.store(fixed ? onScreen : 0, std::memory_order_relaxed);
@@ -477,13 +531,15 @@ namespace video
             }
             const RefreshEstimate& display = refresh.Estimate();
             if (s_timingLog)
-                fprintf(s_timingLog, "%llu,%lld,%lld,%lld,%d,%d,%.1f,%lld,%.0f,%lld,%d\n", (unsigned long long)t.id, (long long)t.vblank,
+                fprintf(s_timingLog, "%llu,%lld,%lld,%lld,%d,%d,%.1f,%lld,%.0f,%lld,%d,%.3f,%lld\n", (unsigned long long)t.id, (long long)t.vblank,
                     (long long)t.presented, (long long)onScreen, timed, display.valid, display.periodNs, (long long)display.gridNs,
-                    display.rmsNs, (long long)t.ready, display.multiple);
+                    display.rmsNs, (long long)t.ready, display.multiple, t.between, (long long)t.desired);
 #if defined(__APPLE__) && !TARGET_OS_IOS
             if (s_pastTiming)
                 ReadDriverReports(t);
 #endif
+            if (t.between != 0)
+                s_betweenShown++;
             if (!t.vblank)
                 return;
             s_shown++;
@@ -2100,6 +2156,158 @@ void main()
         }
 
         // After the frame's fence: RecordCompare's pictures saved and freed.
+        // NFSMW_LOG_COVERS=1 (gpu/covers.h): every presented picture, before
+        // the UI, scaled to 1/8 by a linear blit and read back a frame later
+        // (the slot's fence, waited for anyway), checked for a dark box with
+        // all four edges inside it, or a dark layer across it short of its
+        // top and bottom or its sides (FindInsetBox). Logged once per box (to 2%
+        // of the picture) and kind of picture (an in-between one or not), with
+        // the present's number and time; the lines are counted (PictureCoverHits).
+        struct CoverCheck
+        {
+            VkImage image = VK_NULL_HANDLE;
+            VkDeviceMemory imageMemory = VK_NULL_HANDLE;
+            VkBuffer buffer = VK_NULL_HANDLE;
+            VkDeviceMemory bufferMemory = VK_NULL_HANDLE;
+            void* mapped = nullptr;
+            uint32_t w = 0, h = 0;  // the scaled picture
+            uint32_t srcW = 0, srcH = 0;
+            bool pending = false;
+            uint64_t present = 0;
+            float between = 0.0f;
+            double seconds = 0.0;
+        };
+        CoverCheck s_coverChecks[FRAMES_IN_FLIGHT];
+        std::atomic<uint64_t> s_pictureCoverHits{ 0 };
+        constexpr uint32_t kCoverCheckDiv = 8;
+
+        void CoverCheckRecord(VkCommandBuffer cmd, VkImage dst, uint32_t slotIndex, float between)
+        {
+            static uint64_t presents = 0;
+            static const auto launch = std::chrono::steady_clock::now();
+            presents++;
+            CoverCheck& c = s_coverChecks[slotIndex];
+            if (!s_swapReadable)
+                return;
+            const uint32_t w = s_swapExtent.width / kCoverCheckDiv, h = s_swapExtent.height / kCoverCheckDiv;
+            if (w < 16 || h < 16)
+                return;
+            if (c.w != w || c.h != h)
+            {
+                vkDeviceWaitIdle(s_device);
+                if (c.buffer)
+                {
+                    vkUnmapMemory(s_device, c.bufferMemory);
+                    vkDestroyBuffer(s_device, c.buffer, nullptr);
+                    vkFreeMemory(s_device, c.bufferMemory, nullptr);
+                    vkDestroyImage(s_device, c.image, nullptr);
+                    vkFreeMemory(s_device, c.imageMemory, nullptr);
+                }
+                c = CoverCheck{};
+                c.w = w;
+                c.h = h;
+                VkImageCreateInfo ici{ VK_STRUCTURE_TYPE_IMAGE_CREATE_INFO };
+                ici.imageType = VK_IMAGE_TYPE_2D;
+                ici.format = s_swapFormat;
+                ici.extent = { w, h, 1 };
+                ici.mipLevels = ici.arrayLayers = 1;
+                ici.samples = VK_SAMPLE_COUNT_1_BIT;
+                ici.tiling = VK_IMAGE_TILING_OPTIMAL;
+                ici.usage = VK_IMAGE_USAGE_TRANSFER_DST_BIT | VK_IMAGE_USAGE_TRANSFER_SRC_BIT;
+                vkCreateImage(s_device, &ici, nullptr, &c.image);
+                VkMemoryRequirements req;
+                vkGetImageMemoryRequirements(s_device, c.image, &req);
+                VkMemoryAllocateInfo ai{ VK_STRUCTURE_TYPE_MEMORY_ALLOCATE_INFO };
+                ai.allocationSize = req.size;
+                ai.memoryTypeIndex = FindMemoryType(req.memoryTypeBits, VK_MEMORY_PROPERTY_DEVICE_LOCAL_BIT);
+                vkAllocateMemory(s_device, &ai, nullptr, &c.imageMemory);
+                vkBindImageMemory(s_device, c.image, c.imageMemory, 0);
+                VkBufferCreateInfo bci{ VK_STRUCTURE_TYPE_BUFFER_CREATE_INFO };
+                bci.size = VkDeviceSize(w) * h * 4;
+                bci.usage = VK_BUFFER_USAGE_TRANSFER_DST_BIT;
+                vkCreateBuffer(s_device, &bci, nullptr, &c.buffer);
+                vkGetBufferMemoryRequirements(s_device, c.buffer, &req);
+                ai.allocationSize = req.size;
+                ai.memoryTypeIndex = FindMemoryType(req.memoryTypeBits, VK_MEMORY_PROPERTY_HOST_VISIBLE_BIT | VK_MEMORY_PROPERTY_HOST_COHERENT_BIT);
+                vkAllocateMemory(s_device, &ai, nullptr, &c.bufferMemory);
+                vkBindBufferMemory(s_device, c.buffer, c.bufferMemory, 0);
+                vkMapMemory(s_device, c.bufferMemory, 0, VK_WHOLE_SIZE, 0, &c.mapped);
+            }
+            Barrier(cmd, dst, VK_IMAGE_LAYOUT_COLOR_ATTACHMENT_OPTIMAL, VK_IMAGE_LAYOUT_TRANSFER_SRC_OPTIMAL, VK_ACCESS_COLOR_ATTACHMENT_WRITE_BIT,
+                VK_ACCESS_TRANSFER_READ_BIT, VK_PIPELINE_STAGE_COLOR_ATTACHMENT_OUTPUT_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT);
+            Barrier(cmd, c.image, VK_IMAGE_LAYOUT_UNDEFINED, VK_IMAGE_LAYOUT_TRANSFER_DST_OPTIMAL, 0, VK_ACCESS_TRANSFER_WRITE_BIT,
+                VK_PIPELINE_STAGE_TOP_OF_PIPE_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT);
+            VkImageBlit blit{};
+            blit.srcSubresource = { VK_IMAGE_ASPECT_COLOR_BIT, 0, 0, 1 };
+            blit.srcOffsets[1] = { int32_t(s_swapExtent.width), int32_t(s_swapExtent.height), 1 };
+            blit.dstSubresource = { VK_IMAGE_ASPECT_COLOR_BIT, 0, 0, 1 };
+            blit.dstOffsets[1] = { int32_t(w), int32_t(h), 1 };
+            vkCmdBlitImage(cmd, dst, VK_IMAGE_LAYOUT_TRANSFER_SRC_OPTIMAL, c.image, VK_IMAGE_LAYOUT_TRANSFER_DST_OPTIMAL, 1, &blit, VK_FILTER_LINEAR);
+            Barrier(cmd, c.image, VK_IMAGE_LAYOUT_TRANSFER_DST_OPTIMAL, VK_IMAGE_LAYOUT_TRANSFER_SRC_OPTIMAL, VK_ACCESS_TRANSFER_WRITE_BIT,
+                VK_ACCESS_TRANSFER_READ_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT);
+            VkBufferImageCopy region{};
+            region.imageSubresource = { VK_IMAGE_ASPECT_COLOR_BIT, 0, 0, 1 };
+            region.imageExtent = { w, h, 1 };
+            vkCmdCopyImageToBuffer(cmd, c.image, VK_IMAGE_LAYOUT_TRANSFER_SRC_OPTIMAL, c.buffer, 1, &region);
+            VkBufferMemoryBarrier hostRead{ VK_STRUCTURE_TYPE_BUFFER_MEMORY_BARRIER };
+            hostRead.srcAccessMask = VK_ACCESS_TRANSFER_WRITE_BIT;
+            hostRead.dstAccessMask = VK_ACCESS_HOST_READ_BIT;
+            hostRead.srcQueueFamilyIndex = hostRead.dstQueueFamilyIndex = VK_QUEUE_FAMILY_IGNORED;
+            hostRead.buffer = c.buffer;
+            hostRead.size = VK_WHOLE_SIZE;
+            vkCmdPipelineBarrier(cmd, VK_PIPELINE_STAGE_TRANSFER_BIT, VK_PIPELINE_STAGE_HOST_BIT, 0, 0, nullptr, 1, &hostRead, 0, nullptr);
+            // Back to the pass's layout: the UI is drawn after it.
+            Barrier(cmd, dst, VK_IMAGE_LAYOUT_TRANSFER_SRC_OPTIMAL, VK_IMAGE_LAYOUT_COLOR_ATTACHMENT_OPTIMAL, VK_ACCESS_TRANSFER_READ_BIT,
+                VK_ACCESS_COLOR_ATTACHMENT_READ_BIT | VK_ACCESS_COLOR_ATTACHMENT_WRITE_BIT, VK_PIPELINE_STAGE_TRANSFER_BIT,
+                VK_PIPELINE_STAGE_COLOR_ATTACHMENT_OUTPUT_BIT);
+            c.pending = true;
+            c.srcW = s_swapExtent.width;
+            c.srcH = s_swapExtent.height;
+            c.present = presents;
+            c.between = between;
+            c.seconds = std::chrono::duration<double>(std::chrono::steady_clock::now() - launch).count();
+        }
+
+        // After the slot's fence.
+        void CoverCheckHarvest(uint32_t slotIndex)
+        {
+            CoverCheck& c = s_coverChecks[slotIndex];
+            if (!c.pending)
+                return;
+            c.pending = false;
+            const bool bgr = s_swapFormat == VK_FORMAT_B8G8R8A8_UNORM || s_swapFormat == VK_FORMAT_B8G8R8A8_SRGB;
+            static std::vector<uint8_t> luma;
+            luma.resize(size_t(c.w) * c.h);
+            const uint8_t* px = static_cast<const uint8_t*>(c.mapped);
+            for (size_t i = 0; i < luma.size(); i++)
+            {
+                const uint32_t r = px[i * 4 + (bgr ? 2 : 0)], g = px[i * 4 + 1], b = px[i * 4 + (bgr ? 0 : 2)];
+                luma[i] = uint8_t((2 * r + 5 * g + b) / 8);
+            }
+            const gpu::covers::Luma l{ luma.data(), int32_t(c.w), int32_t(c.h), int32_t(c.w) };
+            const gpu::covers::Box box = gpu::covers::FindInsetBox(l);
+            if (!box.found)
+                return;
+            // Once per box (2% of the picture) and kind of picture.
+            const auto q = [](int32_t v, uint32_t size) { return uint64_t(std::lround(double(v) / double(size) * 50.0)); };
+            const uint64_t key = (q(box.box.x0, c.w) << 24) | (q(box.box.y0, c.h) << 16) | (q(box.box.x1, c.w) << 8) | q(box.box.y1, c.h) |
+                (uint64_t(c.between != 0.0f) << 32) | (uint64_t(c.srcW) << 33) | (uint64_t(c.srcH) << 48) | (uint64_t(box.kind) << 62);
+            static std::unordered_set<uint64_t> logged;
+            if (logged.size() >= 256 || !logged.insert(key).second)
+                return;
+            s_pictureCoverHits.fetch_add(1, std::memory_order_relaxed);
+            const uint32_t d = kCoverCheckDiv;
+            auto ring = [](float r) { return r < 0.0f ? std::string("its edge") : std::format("{:.0f}%", r * 100.0f); };
+            fprintf(stderr,
+                "[covers] picture: %s at present %llu (%.2f s%s): [%d,%d)x[%d,%d) of %ux%u px (%.0f%% of it; short by left %d top %d "
+                "right %d bottom %d px), lit just outside it: left %s top %s right %s bottom %s\n",
+                gpu::covers::BoxKindName(box.kind), (unsigned long long)c.present, c.seconds,
+                c.between != 0.0f ? std::format(", an in-between picture at {:.3f}", c.between).c_str() : "", box.box.x0 * d, box.box.x1 * d,
+                box.box.y0 * d, box.box.y1 * d, c.srcW, c.srcH, box.share * 100.0f, box.box.x0 * d, box.box.y0 * d,
+                int32_t(c.srcW) - box.box.x1 * int32_t(d), int32_t(c.srcH) - box.box.y1 * int32_t(d), ring(box.ringLit[0]).c_str(),
+                ring(box.ringLit[1]).c_str(), ring(box.ringLit[2]).c_str(), ring(box.ringLit[3]).c_str());
+        }
+
         void SaveCompare(std::vector<CompareShot>& shots, int captureIndex)
         {
             const bool bgr = s_swapFormat == VK_FORMAT_B8G8R8A8_UNORM || s_swapFormat == VK_FORMAT_B8G8R8A8_SRGB;
@@ -2589,7 +2797,7 @@ void main()
             if (const char* path = std::getenv("NFSMW_VBLANK_LOG"))
                 if ((s_timingLog = fopen(path, "w")))
                 {
-                    fprintf(s_timingLog, "id,vblank,presented,on_screen,timed,fit_valid,period_ns,grid_ns,rms_ns,ready,multiple\n");
+                    fprintf(s_timingLog, "id,vblank,presented,on_screen,timed,fit_valid,period_ns,grid_ns,rms_ns,ready,multiple,between,desired\n");
 #if defined(__APPLE__) && !TARGET_OS_IOS
                     if (s_pastTiming && (s_actualLog = fopen((std::string(path) + ".actual.csv").c_str(), "w")))
                         fprintf(s_actualLog, "# steady_ns %lld uptime_raw_ns %llu\nid,actual_ns\n", (long long)NowNs(),
@@ -2712,6 +2920,7 @@ void main()
             const SDL_DisplayMode* mode = SDL_GetCurrentDisplayMode(SDL_GetDisplayForWindow(s_window));
 #if defined(__APPLE__) && !TARGET_OS_IOS
             s_displayHz = mode ? mode->refresh_rate : 0.0f;
+            s_offeredHz.store(s_displayHz, std::memory_order_relaxed);
             {
                 std::lock_guard lock(s_scheduleMutex);
                 s_schedule.SetDisplayHz(s_displayHz);
@@ -2741,6 +2950,11 @@ void main()
             s_pendingImage = VK_NULL_HANDLE;
             s_pendingNew = !s_pending.empty();
         }
+        if (s_betweenImage == image)
+        {
+            s_betweenImage = VK_NULL_HANDLE;
+            s_betweenNew = false;
+        }
         if (s_lastImage == image)
         {
             s_lastImage = VK_NULL_HANDLE;
@@ -3250,6 +3464,11 @@ void main()
             in.gridFixed = gridSince != 0;
             in.gridStableSec = gridSince ? double(NowNs() - gridSince) / 1e9 : 0.0;
             in.shownBefore = settings::RefreshNoticeShown(key);
+            {
+                double period = 0;
+                int64_t grid = 0;
+                in.hfrHandles = hfr::Enabled() && HfrGrid(period, grid);
+            }
             in.forced = forced;
             const bool frames = s_firstGameFrame != std::chrono::steady_clock::time_point{};
             in.sessionSec = frames ? std::chrono::duration<double>(now - s_firstGameFrame).count() : 0.0;
@@ -3408,9 +3627,26 @@ void main()
         uint32_t w = 0, h = 0, aspectW = 0, aspectH = 0;
         VkImage gpuImage = VK_NULL_HANDLE;
         int64_t frameVblank = 0;
+        float frameBetween = 0.0f;  // an in-between picture: its fraction of the step
+        float frameShift = 0.0f;    // a real picture shown that much of a vblank early (a step's own picture drawn between)
+        int64_t frameTarget = 0;    // when to show it (HFR on a grid that isn't a multiple of 60 Hz; 0: the usual way)
+        int64_t frameDesired = 0;   // macOS: when it is to be shown (0: when ready)
         {
             std::lock_guard lock(s_pendingMutex);
-            if (s_pendingNew)
+            if (s_betweenNew)
+            {
+                gpuImage = s_betweenImage;
+                s_betweenImage = VK_NULL_HANDLE;
+                w = s_betweenWidth;
+                h = s_betweenHeight;
+                aspectW = s_betweenAspectW;
+                aspectH = s_betweenAspectH;
+                s_betweenNew = false;
+                frameVblank = s_betweenVblank;
+                frameBetween = s_betweenT;
+                frameTarget = s_betweenTarget;
+            }
+            else if (s_pendingNew)
             {
                 pixels.swap(s_pending);
                 gpuImage = s_pendingImage;
@@ -3421,6 +3657,8 @@ void main()
                 aspectH = s_pendingAspectH;
                 s_pendingNew = false;
                 frameVblank = s_pendingVblank;
+                frameShift = s_pendingShift;
+                frameTarget = s_pendingTarget;
             }
         }
         const bool upload = !pixels.empty();
@@ -3490,6 +3728,8 @@ void main()
 
         Frame& f = s_frames[s_frameIndex];
         vkWaitForFences(s_device, 1, &f.inFlight, VK_TRUE, UINT64_MAX);
+        if (game::covers::Enabled())
+            CoverCheckHarvest(s_frameIndex);
         if (f.timed)
         {
             uint64_t ts[3];
@@ -3764,6 +4004,19 @@ void main()
                     s_context.cmdBeginRendering(cmd, &again);
                 }
             }
+            // NFSMW_LOG_COVERS=1: the picture as drawn, before the UI (the
+            // settings menu is a dark box of its own), checked for a dark box
+            // inside it (CoverCheckRecord, read back a frame later).
+            if (game::covers::Enabled() && haveSource)
+            {
+                s_context.cmdEndRendering(cmd);
+                CoverCheckRecord(cmd, dst, s_frameIndex, 0.0f);
+                VkRenderingAttachmentInfoKHR resume = color;
+                resume.loadOp = VK_ATTACHMENT_LOAD_OP_LOAD;
+                VkRenderingInfoKHR again = ri;
+                again.pColorAttachments = &resume;
+                s_context.cmdBeginRendering(cmd, &again);
+            }
             if (uiFrame)
                 ui::Draw(cmd);
             s_context.cmdEndRendering(cmd);
@@ -3936,9 +4189,29 @@ void main()
                     std::lock_guard lock(s_scheduleMutex);
                     wanted = s_schedule.Wanted(locked);
                     tripped = s_schedule.Tripped();
-                    if (wanted)
+                    if (frameTarget)
                     {
-                        const int64_t desired = frameVblank + s_showAfterVblankNs;
+                        // HFR on a grid (HfrGrid; on a Mac only made up, NFSMW_HFR_GRID_HZ): its refresh.
+                        frameDesired = frameTarget;
+                        s_scheduled[s_scheduledNext++ % std::size(s_scheduled)] = { presentTime.presentID, frameTarget, false };
+                        presentTime.desiredPresentTime = uint64_t(std::max<int64_t>(frameTarget - HostToSteadyNs(), 0));
+                    }
+                    else if (wanted)
+                    {
+                        // An in-between picture: its fraction of the vblank after its own.
+                        int64_t desired = frameVblank + s_showAfterVblankNs +
+                            int64_t(std::llround(double(frameBetween != 0.0f ? frameBetween : frameShift) * GuestVblank().PeriodNs()));
+                        // HFR: later while real pictures miss their time, and
+                        // never before (or with) the picture asked for last.
+                        const int64_t nowNs = NowNs();
+                        if (frameBetween != 0.0f)
+                            s_hfrActiveUntil.store(nowNs + 1'000'000'000, std::memory_order_relaxed);
+                        if (nowNs < s_hfrActiveUntil.load(std::memory_order_relaxed))
+                        {
+                            desired = std::max(desired + s_hfrAdapt.ExtraNs(), s_hfrLastDesired + kHfrMinGapNs);
+                            s_hfrLastDesired = desired;
+                        }
+                        frameDesired = desired;
                         s_scheduled[s_scheduledNext++ % std::size(s_scheduled)] = { presentTime.presentID, desired, false };
                         presentTime.desiredPresentTime = uint64_t(std::max<int64_t>(desired - HostToSteadyNs(), 0));
                     }
@@ -3974,7 +4247,18 @@ void main()
         // PresentAt; 0 everywhere else). Its GPU work is submitted; the queue
         // is free meanwhile.
         // (No hold of more than 100 ms: three vblanks are the most it gives.)
-        if (const int64_t at = frameVblank ? GuestVblank().PresentAt(frameVblank) : 0; at > ready && at - ready < 100'000'000)
+        int64_t at = frameVblank ? GuestVblank().PresentAt(frameVblank, frameBetween != 0.0f ? frameBetween : frameShift) : 0;
+        // HFR on a grid that isn't a multiple of 60 Hz: just after the refresh
+        // before the picture's own, so FIFO shows it on that one (a Mac shows
+        // it at its time instead: desiredPresentTime above).
+        if (frameTarget && !frameDesired)
+        {
+            double period = 0;
+            int64_t grid = 0;
+            if (HfrGrid(period, grid))
+                at = frameTarget - int64_t(std::llround(period)) + VblankLock::kHoldAfterRefreshNs;
+        }
+        if (at > ready && at - ready < 100'000'000)
         {
             queueLock.unlock();
             std::this_thread::sleep_until(std::chrono::steady_clock::time_point(std::chrono::nanoseconds(at)));
@@ -3986,10 +4270,18 @@ void main()
         if (s_presentTiming && (present == VK_SUCCESS || present == VK_SUBOPTIMAL_KHR))
         {
             std::lock_guard lock(s_timingMutex);
-            s_timings.push_back({ id, s_swapchainGeneration, presented, frameVblank, ready });
+            s_timings.push_back({ id, s_swapchainGeneration, presented, frameBetween != 0.0f ? 0 : frameVblank, ready, frameBetween, frameDesired });
             s_timingCv.notify_one();
         }
         s_lastPresent = std::chrono::steady_clock::now();
+        if (frameBetween != 0.0f)
+        {
+            // A line every 20 s of in-between pictures at 60 a second.
+            if (++s_betweenPresented % 1200 == 0)
+                fprintf(stderr, "[hfr] presenter: %llu in-between pictures presented, %llu seen on screen, %llu replaced before they were "
+                                "shown\n", (unsigned long long)s_betweenPresented.load(), (unsigned long long)s_betweenShown.load(),
+                    (unsigned long long)s_betweenDropped.load());
+        }
         if (!captures.empty())
         {
             CapturedFrame frame;
@@ -4040,8 +4332,25 @@ void main()
         return true;
     }
 
-    void SubmitFrontImage(VkImage image, uint32_t width, uint32_t height, uint32_t aspectWidth, uint32_t aspectHeight)
+    void SubmitFrontImage(VkImage image, uint32_t width, uint32_t height, uint32_t aspectWidth, uint32_t aspectHeight, float between,
+        float shift, int64_t target)
     {
+        if (between != 0.0f)
+        {
+            std::lock_guard lock(s_pendingMutex);
+            if (s_betweenNew)
+                s_betweenDropped++;
+            s_betweenImage = image;
+            s_betweenWidth = width;
+            s_betweenHeight = height;
+            s_betweenAspectW = aspectWidth;
+            s_betweenAspectH = aspectHeight;
+            s_betweenVblank = s_guestVblank.load(std::memory_order_relaxed);
+            s_betweenT = between;
+            s_betweenTarget = target;
+            s_betweenNew = true;
+            return;
+        }
         if (!s_window)
             return;
         std::lock_guard lock(s_pendingMutex);
@@ -4055,6 +4364,8 @@ void main()
         s_pendingAspectH = aspectHeight;
         s_pendingNew = true;
         s_pendingVblank = s_guestVblank.load(std::memory_order_relaxed);
+        s_pendingShift = shift;
+        s_pendingTarget = target;
     }
 
     void WaitGpuIdle()
@@ -4104,6 +4415,55 @@ void main()
         s_guestVblanks.fetch_add(1, std::memory_order_release);
     }
 
+    bool HfrGrid(double& periodNs, int64_t& gridNs)
+    {
+        if (GuestVblankDivider() != 1)
+            return false;
+        if (s_hfrGridForcedHz > 0)
+        {
+            periodNs = 1e9 / s_hfrGridForcedHz;
+            gridNs = 0;
+            return true;
+        }
+        if (!s_hfrGridValid.load(std::memory_order_relaxed) || s_gridHz.load(std::memory_order_relaxed) <= 0)
+            return false;
+        periodNs = double(s_hfrGridPeriodNs.load(std::memory_order_relaxed));
+        gridNs = s_hfrGridNs.load(std::memory_order_relaxed);
+        return periodNs > 0;
+    }
+
+    bool HfrOffered()
+    {
+#if defined(__APPLE__) && !TARGET_OS_IOS
+        // A 120 Hz screen (present_schedule.h's FastDisplay: ProMotion, or a
+        // 120 Hz monitor): a Mac draws in-between pictures nowhere else yet
+        // (HfrPicturesPerStep; no refresh grid on a Mac: a 144 Hz monitor
+        // shows the game at 60).
+        const float hz = s_offeredHz.load(std::memory_order_relaxed);
+        return s_displayTiming && hz >= PresentSchedule::kMinFastHz && hz <= PresentSchedule::kMaxFastHz;
+#else
+        return false;
+#endif
+    }
+
+    int HfrPicturesPerStep()
+    {
+        if (GuestVblankDivider() != 1 || s_hfrGridForcedHz > 0)
+            return 1;  // Frame Rate 30; a made-up grid (HfrGrid)
+        if (const int multiple = GuestVblank().HoldMultiple(); multiple >= 2)
+            return std::min(multiple, 4);
+#if defined(__APPLE__) && !TARGET_OS_IOS
+        if (s_displayTiming && s_showAfterVblankNs > 0)
+        {
+            const bool locked = GuestVblank().Locked();
+            std::lock_guard lock(s_scheduleMutex);
+            if (s_schedule.FastDisplay() && s_schedule.Wanted(locked))
+                return 2;
+        }
+#endif
+        return 1;
+    }
+
     uint64_t GuestVblanks()
     {
         return s_guestVblanks.load(std::memory_order_acquire);
@@ -4225,3 +4585,11 @@ void main()
         // may still be feeding its stream (SDL_Quit freed it under it).
     }
 }
+
+namespace video
+{
+    uint64_t PictureCoverHits()
+    {
+        return s_pictureCoverHits.load(std::memory_order_relaxed);
+    }
+}
diff --git a/runtime/video/presenter.h b/runtime/video/presenter.h
index 8521068..da9cb41 100644
--- a/runtime/video/presenter.h
+++ b/runtime/video/presenter.h
@@ -14,6 +14,10 @@
 
 namespace video
 {
+    // NFSMW_LOG_COVERS=1 (gpu/covers.h): the picture lines logged so far
+    // (each a new box or layer).
+    uint64_t PictureCoverHits();
+
     // Main thread only (macOS requires windows there). Returns false if no
     // window could be created; the game then runs headless.
     bool Initialize();
@@ -26,7 +30,38 @@ namespace video
     // written by a queue submission made before this call. `aspectWidth` x
     // `aspectHeight`: the frame's shape when the image is at another
     // resolution (internal resolution scaling; 0: the image's own).
-    void SubmitFrontImage(VkImage image, uint32_t width, uint32_t height, uint32_t aspectWidth = 0, uint32_t aspectHeight = 0);
+    // `between`: an in-between picture (game/hfr.h), its fraction of the world
+    // step; shown at that fraction of the guest vblank after the one before
+    // it, ahead of the real picture (0: a real picture).
+    // `shift`: a real picture to be shown that much of a vblank before its
+    // own time (game/hfr.h: a step drawn only between; below 0).
+    // `target`: when to show it (steady ns; game/hfr.h on a display whose
+    // rate isn't a whole multiple of 60 Hz: the refresh it was drawn for; 0:
+    // the usual way).
+    void SubmitFrontImage(VkImage image, uint32_t width, uint32_t height, uint32_t aspectWidth = 0, uint32_t aspectHeight = 0,
+        float between = 0.0f, float shift = 0.0f, int64_t target = 0);
+
+    // Any thread: a display at a rate that isn't a whole multiple of 60 Hz
+    // (90, 144, 165) whose presents land on a fixed refresh grid (the refresh
+    // notice's grid check: video/refresh_notice.h), where HFR draws a picture
+    // for each refresh (game/hfr.cpp): its refresh period and a refresh's
+    // time (steady ns). False elsewhere (no grid measured, a multiple of 60
+    // Hz, a Mac). NFSMW_HFR_GRID_HZ=<hz> makes up a grid at that rate on any
+    // display (tests).
+    bool HfrGrid(double& periodNs, int64_t& gridNs);
+
+    // Any thread: pictures the display can show evenly per guest vblank (a
+    // world step) now: the refreshes a vblank is when the vblank is locked
+    // to a display at a multiple of 60 Hz and new frames are held for their
+    // refresh (2 at 120 Hz, at most 4), 2 on a Mac whose frames are shown at
+    // their vblank's time on a 120 Hz display (video/present_schedule.h), else
+    // 1 (game/hfr.h draws no in-between pictures).
+    int HfrPicturesPerStep();
+    // Settings > Display > Smooth Motion is offered (the menu shows it): a
+    // Mac's 120 Hz screen whose pictures the presenter can time
+    // (VK_GOOGLE_display_timing, as ProMotion's). Not yet elsewhere: HFR is
+    // untested on real 90-240 Hz screens there (NFSMW_HFR=1 still turns it on).
+    bool HfrOffered();
 
     // Wait until the queue is idle (resource replacement).
     void WaitGpuIdle();
diff --git a/runtime/video/refresh_notice.h b/runtime/video/refresh_notice.h
index cde1c2e..46f2d12 100644
--- a/runtime/video/refresh_notice.h
+++ b/runtime/video/refresh_notice.h
@@ -71,6 +71,7 @@ namespace video
             double movieQuietSec = 1e9; // since the last movie frame (the XMV player's)
             double idleSec = 0;         // since the controls were last used
             bool uiBusy = false;        // a panel or the settings menu is open
+            bool hfrHandles = false;    // HFR (NFSMW_HFR=1) draws a picture for each of this grid's refreshes
         };
         enum class Verdict
         {
@@ -101,6 +102,8 @@ namespace video
                 return { Verdict::NotApplicable, "" };
             if (in.forced == 0)
                 return { Verdict::Never, "NFSMW_REFRESH_NOTICE=0" };
+            if (in.hfrHandles && in.forced != 1)
+                return { Verdict::Never, "HFR draws a picture for each refresh (NFSMW_HFR=1)" };
             if (in.platform == Platform::Excluded)
                 return { Verdict::Never, "not on this device (iOS, or a headset's compositor)" };
             if (in.shownBefore && in.forced != 1)
diff --git a/runtime/video/vblank_lock.cpp b/runtime/video/vblank_lock.cpp
index 3cc7b51..31b12bb 100644
--- a/runtime/video/vblank_lock.cpp
+++ b/runtime/video/vblank_lock.cpp
@@ -82,7 +82,7 @@ namespace video
         m_hold = on;
     }
 
-    int64_t VblankLock::PresentAt(int64_t vblank) const
+    int64_t VblankLock::PresentAt(int64_t vblank, float between) const
     {
         std::lock_guard lock(m_mutex);
         if (!m_locked || m_display.multiple < 2 || !m_hold || !vblank)
@@ -94,7 +94,7 @@ namespace video
         // more than half a refresh late.
         const double period = m_display.periodNs;
         const double k = std::floor(double(vblank - m_display.gridNs) / period);
-        const double target = double(m_display.gridNs) + (k + m_display.multiple + m_extra) * period;
+        const double target = double(m_display.gridNs) + (k + m_display.multiple + m_extra + std::round(double(between) * m_display.multiple)) * period;
         return int64_t(std::llround(target - period + double(kHoldAfterRefreshNs)));
     }
 
@@ -230,6 +230,12 @@ namespace video
         }
     }
 
+    int VblankLock::HoldMultiple() const
+    {
+        std::lock_guard lock(m_mutex);
+        return m_locked && m_hold && m_display.multiple >= 2 ? m_display.multiple : 1;
+    }
+
     bool VblankLock::Locked() const
     {
         std::lock_guard lock(m_mutex);
diff --git a/runtime/video/vblank_lock.h b/runtime/video/vblank_lock.h
index 0cc623e..de0c939 100644
--- a/runtime/video/vblank_lock.h
+++ b/runtime/video/vblank_lock.h
@@ -116,6 +116,9 @@ namespace video
         void Observe(int64_t vblank, int64_t presented, int64_t onScreen, int64_t ready = 0);
         Status GetStatus() const;
         bool Locked() const;
+        // Refreshes a vblank is while locked at a multiple of 60 Hz with new
+        // frames held for their refresh (PresentAt); 1 otherwise.
+        int HoldMultiple() const;
         double PeriodNs() const;  // the vblank period now (locked at a multiple: that many refreshes)
         // Main thread, before presenting a new game frame released by the
         // vblank that fired at `vblank`: not before the time returned (ns,
@@ -123,7 +126,12 @@ namespace video
         // refresh before the one the frame targets (the refresh `multiple`
         // after the last refresh before `vblank`, plus any lateness the lock
         // has accepted), so FIFO shows it on its target and no sooner.
-        int64_t PresentAt(int64_t vblank) const;
+        int64_t PresentAt(int64_t vblank) const { return PresentAt(vblank, 0.0f); }
+        // An in-between picture (game/hfr.h) presented after the vblank at
+        // `vblank` and before the next one's frame: `between` (its fraction of
+        // the step) of the vblank's refreshes after the target of a frame
+        // released by `vblank` (one refresh at 120 Hz for 0.5).
+        int64_t PresentAt(int64_t vblank, float between) const;
         // NFSMW_PRESENT_HOLD=0: frames are presented when ready at a multiple
         // too (the lock alone, for comparison).
         void SetHold(bool on);
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index 7923e4d..e3e3157 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -30,6 +30,14 @@ sb_test(depth_only_test ARGS ${RT}/gpu/renderer.cpp)
 # and the scaled resolve memory's layout (gpu/render_scale.h, header only);
 # renderer.cpp is read to check its scaled-memory shaders use it.
 sb_test(render_scale_test ARGS ${RT}/gpu/renderer.cpp)
+# Split screen's two views in one untiled target (gpu/split_views.h, header
+# only): each cut to its own rows at 1x, 1.5x, 2x, 3x and Vert+'s taller y
+# scales, meeting exactly; renderer.cpp is read to check it applies the rules.
+sb_test(split_views_test ARGS ${RT}/gpu/renderer.cpp)
+# Which controller is which player in split screen (hid/player_slots.h,
+# header only) and the game's split-screen test (game/split_screen.h);
+# input.cpp is read to check users 1-3 follow it.
+sb_test(player_slots_test ARGS ${RT}/hid/input.cpp)
 # The police vid-cam's side bars, the intro's black frames, the results
 # screen's backdrop and what fills the screen round them (gpu/edge_bars.h,
 # header only).
@@ -39,6 +47,15 @@ sb_test(edge_bars_test)
 # filled all round, at every screen shape; renderer.cpp is read to check it
 # asks for and applies the plans on both paths.
 sb_test(menu_borders_test ARGS ${RT}/gpu/renderer.cpp)
+# The fade to black before a load short of the screen's edges (the career
+# prologue's last race, v0.1.7 on a MacBook): stretched to them at every
+# screen shape (gpu/edge_bars.h's PlanLayer); renderer.cpp is read to check
+# it asks for and applies it on both paths.
+sb_test(fade_layers_test ARGS ${RT}/gpu/renderer.cpp)
+# NFSMW_LOG_COVERS (gpu/covers.h, header only): front-end quads and presented
+# pictures that leave a dark box, or a full-screen layer, short of the
+# picture's edges.
+sb_test(covers_test)
 # A saved pipeline cache from another GPU, driver or OS version, and the log
 # line that says so (gpu/pipeline_cache_header.h, header only).
 sb_test(pipeline_cache_header_test)
@@ -108,6 +125,11 @@ sb_test(present_schedule_test)
 # doesn't stop the game's sound (GitHub issue #20: the sound stopped for good,
 # then the game hung after the race), and a working one is followed as before.
 sb_test(audio_cadence_test)
+# EA SND's mixer never drops sounds for time on a host (apu/ea_cpu_budget.h,
+# header only; GitHub issue #35: one sound, usually the engine, much quieter
+# until the next gear change): EA's budget rule as a model, the policy, and
+# the generated code (ppc/) read to check the functions and offsets it names.
+sb_test(ea_cpu_budget_test ARGS ${ROOT}/ppc)
 # The present waiter uses a swapchain only while it is the current one, and
 # none is destroyed under such a use (video/swapchain_use.h, header only):
 # fake swapchains destroyed and made again under a waiting thread; presenter.cpp
@@ -132,6 +154,10 @@ sb_test(whole_vblanks_test)
 # The nitrous light trails' ring at the 360's 30 fps length (game/light_trails.h,
 # header only; GitHub issue #10).
 sb_test(light_trails_test)
+# SPIKE (v017-hfr-spike): the in-between picture's pose blending (game/hfr_blend.h, header only).
+sb_test(hfr_blend_test)
+sb_test(hfr_schedule_test)
+sb_test(hfr_grid_test)
 sb_test(guest_time_test SOURCES ${RT}/cpu/guest_time.cpp)
 # When the mouse cursor shows over the game (ui/cursor_idle.h, header only),
 # and how ui.cpp drives it.
@@ -206,6 +232,11 @@ sb_test(settings_keys_test SOURCES ${RT}/user/settings.cpp)
 target_include_directories(settings_keys_test SYSTEM PRIVATE ${ROOT}/tools/XenonRecomp/thirdparty/tomlplusplus/include)
 # The keyboard's controls and how held keys become a pad (hid/key_map.h), header only.
 sb_test(key_map_test)
+# A USB steering wheel as the pad (hid/wheel_map.h, header only): which
+# joystick is a wheel, which of its axes is the wheel and which are its
+# pedals, the steering curve, the pedals' travel, the buttons and paddles,
+# NFSMW_WHEEL_BUTTONS, and the force-feedback levels.
+sb_test(wheel_map_test)
 # Check for Updates' logic: versions, GitHub's JSON, curl's output and the
 # release notes (update/check.cpp, self-contained).
 sb_test(update_check_test SOURCES ${RT}/update/check.cpp)
@@ -233,6 +264,13 @@ sb_test(switch_tables_test ARGS ${ROOT}/config/switch_tables.toml ${ROOT}/config
 sb_test(write_watch_test SOURCES ${RT}/kernel/write_watch.cpp ${RT}/cpu/guest_time.cpp)
 target_include_directories(write_watch_test PRIVATE ${RT}/kernel ${RT}/thirdparty/o1heap ${ROOT}/ppc
     ${ROOT}/tools/XenonRecomp/XenonUtils ${ROOT}/tools/XenonRecomp/thirdparty/simde)
+# Released and decommitted guest pages back to zero on hosts with larger pages
+# (16 KB on Apple): only whole host pages remapped, so a 4 KB-page heap's
+# neighbouring allocation in the same host page survives (kernel/vmem.cpp; the
+# host page size injected, so 16 and 64 KB are checked on any host).
+sb_test(vmem_host_pages_test SOURCES ${RT}/kernel/vmem.cpp)
+target_include_directories(vmem_host_pages_test PRIVATE ${RT}/kernel ${RT}/thirdparty/o1heap ${ROOT}/ppc
+    ${ROOT}/tools/XenonRecomp/XenonUtils ${ROOT}/tools/XenonRecomp/thirdparty/simde)
 # The guest vblank lock's closed-loop simulation (a tool more than a test).
 add_executable(vblank_lock_sim ${CMAKE_CURRENT_SOURCE_DIR}/vblank_lock_sim.cpp ${RT}/video/refresh_fit.cpp ${RT}/video/vblank_lock.cpp)
 target_include_directories(vblank_lock_sim PRIVATE ${RT})
diff --git a/tests/covers_test.cpp b/tests/covers_test.cpp
new file mode 100644
index 0000000..571ad67
--- /dev/null
+++ b/tests/covers_test.cpp
@@ -0,0 +1,211 @@
+// Tests for gpu::covers (runtime/gpu/covers.h): the NFSMW_LOG_COVERS
+// detectors. ClassifyQuad on front-end quads as the renderer sees them (the
+// intro's black frames filled or fading in, fades past the screen's edges,
+// a layer two rows short, the HUD), FindInsetBox on scaled-down pictures (a
+// dark box with a lit border round it; a black picture, a letterboxed
+// movie, a dark scene, a box touching an edge), and planted thresholds that
+// must fail a case each. From the repo root:
+//   clang++ -std=c++20 -O2 -UNDEBUG -Iruntime tests/covers_test.cpp -o build/covers_test
+//   build/covers_test
+#include <cstdint>
+#include <cstdio>
+#include <vector>
+
+#include "gpu/covers.h"
+
+using namespace gpu::covers;
+
+static int failures = 0;
+#define CHECK(cond)                                                                  \
+    do                                                                               \
+    {                                                                                \
+        if (!(cond))                                                                 \
+        {                                                                            \
+            fprintf(stderr, "%s:%d: FAILED: %s\n", __FILE__, __LINE__, #cond);       \
+            failures++;                                                              \
+        }                                                                            \
+    } while (0)
+
+namespace
+{
+    const Rect kPicture{ 0, 0, 1280, 720 };
+
+    Quad MakeQuad(Rect host, uint32_t argb, float bx, float by)
+    {
+        Quad q;
+        q.host = host;
+        q.picture = kPicture;
+        q.band[0] = -bx;
+        q.band[1] = bx;
+        q.band[2] = -by;
+        q.band[3] = by;
+        for (uint32_t& c : q.argb)
+            c = argb;
+        return q;
+    }
+
+    // A luma picture: `fill` everywhere, `box` (if any) set to `inside`.
+    struct Picture
+    {
+        int32_t w, h;
+        std::vector<uint8_t> px;
+        Picture(int32_t w_, int32_t h_, uint8_t fill) : w(w_), h(h_), px(size_t(w_) * h_, fill) {}
+        void Fill(Rect r, uint8_t v)
+        {
+            for (int32_t y = r.y0; y < r.y1; y++)
+                for (int32_t x = r.x0; x < r.x1; x++)
+                    px[size_t(y) * w + x] = v;
+        }
+        Luma L() const { return { px.data(), w, h, w }; }
+    };
+
+    void QuadCases(int& failed, const Rule& rule)
+    {
+        auto expect = [&](const Quad& q, Kind k) {
+            if (ClassifyQuad(q, rule).kind != k)
+                failed++;
+        };
+        // The intro's black frame (x +-0.970, y +-0.939 of the band) at 16:9:
+        // a dark box all round, unless its fill took it (opaque).
+        Quad frame = MakeQuad({ 19, 22, 1261, 698 }, 0xFF000000u, 0.970f, 0.939f);
+        expect(frame, Kind::InsetBox);
+        frame.filledOutside = true;
+        expect(frame, Kind::None);
+        // Fading in below the fill's F0: the border shows (a dark box).
+        Quad fading = MakeQuad({ 19, 22, 1261, 698 }, 0x80000000u, 0.970f, 0.939f);
+        expect(fading, Kind::InsetBox);
+        // Too faint to see.
+        Quad faint = MakeQuad({ 19, 22, 1261, 698 }, 0x20000000u, 0.970f, 0.939f);
+        expect(faint, Kind::None);
+        // A fade to black widened past the screen's edges: nothing.
+        expect(MakeQuad({ -10, -10, 1290, 730 }, 0xFF000000u, 1.29f, 1.29f), Kind::None);
+        // The same fade one edge short (two rows at the top): dark, short.
+        expect(MakeQuad({ 0, 2, 1280, 720 }, 0xFF000000u, 1.29f, 1.29f), Kind::DarkShort);
+        // A grey dim authored past the 16:9 frame but left short: a layer.
+        expect(MakeQuad({ 0, 40, 1280, 680 }, 0x807F7F7Fu, 1.29f, 1.25f), Kind::LayerShort);
+        // A bright panel inside the band (a menu): nothing.
+        expect(MakeQuad({ 300, 200, 980, 520 }, 0xFFC0C0C0u, 0.5f, 0.4f), Kind::None);
+        // A small dark box (a dialog's shadow): not most of the picture.
+        expect(MakeQuad({ 400, 250, 880, 470 }, 0xFF000000u, 0.4f, 0.3f), Kind::None);
+        // Dark vertex colours that vary a lot (a gradient): not near-uniform.
+        Quad gradient = MakeQuad({ 19, 22, 1261, 698 }, 0xFF000000u, 0.970f, 0.939f);
+        gradient.argb[2] = gradient.argb[3] = 0xFF282828u;
+        expect(gradient, Kind::None);
+        // A bright vertex colour over a black texture: dark.
+        Quad art = MakeQuad({ 19, 22, 1261, 698 }, 0xFFFFFFFFu, 0.970f, 0.939f);
+        art.texel = 0xFF080808u;
+        expect(art, Kind::InsetBox);
+        // Opaque (blending off) ignores the vertex alpha.
+        Quad opaque = MakeQuad({ 19, 22, 1261, 698 }, 0x00000000u, 0.970f, 0.939f);
+        opaque.blended = false;
+        expect(opaque, Kind::InsetBox);
+    }
+
+    void PictureCases(int& failed, const BoxRule& rule)
+    {
+        auto expect = [&](const Picture& p, BoxKind kind) {
+            const Box b = FindInsetBox(p.L(), rule);
+            if (b.found != (kind != BoxKind::None) || b.kind != kind)
+                failed++;
+        };
+        // A black box in the middle of a lit picture.
+        Picture box(378, 237, 90);
+        box.Fill({ 40, 30, 338, 207 }, 0);
+        expect(box, BoxKind::Inset);
+        // A black picture: no box.
+        expect(Picture(378, 237, 0), BoxKind::None);
+        // A letterboxed movie: black bars top and bottom reach the sides.
+        Picture letterbox(378, 237, 90);
+        letterbox.Fill({ 0, 0, 378, 25 }, 0);
+        letterbox.Fill({ 0, 212, 378, 237 }, 0);
+        expect(letterbox, BoxKind::None);
+        // A dark scene with a lit centre: no box.
+        Picture night(378, 237, 4);
+        night.Fill({ 150, 90, 230, 150 }, 120);
+        expect(night, BoxKind::None);
+        // The report's (run r1, 3024x1898 / 8): the fade to black before the
+        // last prologue race, x +-1.121 and y +-0.972 of the band, under
+        // Vert+ (view scale y 0.8962) rows 15..222 of 237 black, the frozen
+        // scene lit above and below.
+        Picture band(378, 237, 90);
+        band.Fill({ 0, 15, 378, 222 }, 0);
+        expect(band, BoxKind::BandY);
+        // The same beside it (Hor+ at 21:9: x +-1.121 of the band, 0.744).
+        Picture pillar(428, 180, 90);
+        pillar.Fill({ 36, 0, 393, 180 }, 0);
+        expect(pillar, BoxKind::BandX);
+        // A band that reaches the bottom: the scene above only (a bar along
+        // an edge, not a layer short of both).
+        Picture bottom(378, 237, 90);
+        bottom.Fill({ 0, 15, 378, 237 }, 0);
+        expect(bottom, BoxKind::None);
+        // A small black box (a dialog): too little of the picture.
+        Picture small(378, 237, 90);
+        small.Fill({ 150, 90, 230, 150 }, 0);
+        expect(small, BoxKind::None);
+        // A box with the scene round it only on three sides (one edge on the
+        // picture's): not inside it.
+        Picture three(378, 237, 90);
+        three.Fill({ 40, 0, 338, 207 }, 0);
+        expect(three, BoxKind::None);
+    }
+}
+
+int main()
+{
+    int failed = 0;
+    QuadCases(failed, {});
+    CHECK(failed == 0);
+    failed = 0;
+    PictureCases(failed, {});
+    CHECK(failed == 0);
+
+    // Planted thresholds: each must fail at least one case.
+    {
+        Rule r;
+        r.visibleAlpha = 0x10;  // the faint frame counts
+        int f = 0;
+        QuadCases(f, r);
+        CHECK(f > 0);
+        r = {};
+        r.minShare = 0.1f;  // the dialog's shadow counts
+        f = 0;
+        QuadCases(f, r);
+        CHECK(f > 0);
+        r = {};
+        r.spread = 0x90;  // the gradient counts
+        f = 0;
+        QuadCases(f, r);
+        CHECK(f > 0);
+        r = {};
+        r.slack = 4;  // the two rows don't
+        f = 0;
+        QuadCases(f, r);
+        CHECK(f > 0);
+    }
+    {
+        BoxRule r;
+        r.ringLit = 0.0f;  // the box on the top edge counts (no border asked for, no margin)
+        r.margin = 0;
+        int f = 0;
+        PictureCases(f, r);
+        CHECK(f > 0);
+        r = {};
+        r.minShare = 0.05f;  // the dialog counts
+        f = 0;
+        PictureCases(f, r);
+        CHECK(f > 0);
+        r = {};
+        r.darkMax = 100;  // the lit picture counts as dark: the box grows to the edges, or the night scene's centre is one
+        f = 0;
+        PictureCases(f, r);
+        CHECK(f > 0);
+    }
+    if (failures)
+    {
+        fprintf(stderr, "covers_test: %d failure(s)\n", failures);
+        return 1;
+    }
+    printf("covers_test: all passed\n");
+    return 0;
+}
diff --git a/tests/ea_cpu_budget_test.cpp b/tests/ea_cpu_budget_test.cpp
new file mode 100644
index 0000000..6b92016
--- /dev/null
+++ b/tests/ea_cpu_budget_test.cpp
@@ -0,0 +1,206 @@
+// SpeedBreaker runtime. GPL-3.0-or-later (see COPYING).
+//
+// ea_cpu_budget_test <ppc dir>: EA SND's mixer never expels voices for time
+// on a host (apu/ea_cpu_budget.h; GitHub issue #35: one sound, usually the
+// engine, much quieter until the next gear change).
+//   1. EA's rule, as the model in the header computes it: a mix at its usual
+//      cost on a MacBook is far under budget; one block held up 14 ms or more
+//      (the mixer thread not run, as a busy or hot Mac does) puts the
+//      three-block average over it, and EA would expel voices; a budget of
+//      100% or more is never checked.
+//   2. The policy: voices are expelled only with NFSMW_EA_CPU_BUDGET=1.
+//   3. The generated code still matches what the header names (a different
+//      XEX or recompiler config must fail here, not silently in a game): the
+//      mixer thread runs the budget check each block; the check times the
+//      mixer with mftb, keeps the three-block average, and calls the
+//      over-budget step only when the budget is under 100% and the load is
+//      over it; the over-budget step picks a voice and expels it with
+//      (voice, 0) until it fits, returning to 0x826017C8 and 0x826017E4.
+// Build by hand: c++ -std=c++20 -O2 -I runtime tests/ea_cpu_budget_test.cpp -o /tmp/ea_cpu_budget_test
+#include <apu/ea_cpu_budget.h>
+
+#include <cstdio>
+#include <filesystem>
+#include <fstream>
+#include <map>
+#include <sstream>
+#include <string>
+#include <vector>
+
+namespace
+{
+    int s_failed = 0;
+
+    void Check(bool ok, const std::string& what)
+    {
+        if (!ok)
+        {
+            s_failed++;
+            fprintf(stderr, "FAIL: %s\n", what.c_str());
+        }
+    }
+
+    using namespace apu::ea_budget;
+
+    constexpr double Ticks(double ms) { return ms * kTicksPerMs; }
+
+    // Blocks of the mixer's own time (ms each) through EA's average, with
+    // `voicesMs` of voice costs: the most a block was over, in ms of a block.
+    double WorstOverMs(const std::vector<double>& blocksMs, double voicesMs)
+    {
+        Average average;
+        double worst = -1e9;
+        for (double ms : blocksMs)
+            worst = std::max(worst, ToMs(Over(average.Add(Ticks(ms)), Ticks(voicesMs))));
+        return worst;
+    }
+
+    void Rule()
+    {
+        // The budget: 90% of a 5.33 ms block, in EA's units (5.13 ms).
+        Check(Budget(90.0) > 15.35e6 && Budget(90.0) < 15.37e6, "the budget is 15.36 M (EA's units)");
+        Check(ToMs(Budget(90.0)) > 5.12 && ToMs(Budget(90.0)) < 5.14, "the budget is 5.13 ms of a block");
+        // A MacBook's usual mix: ~0.02-0.1 ms of the mixer's own time and
+        // ~0.5 ms of voices a block (the drag race): far under.
+        Check(WorstOverMs(std::vector<double>(600, 0.1), 0.6) < -4.0, "a usual mix is far under budget");
+        // One block held up 20 ms (measured: every SND9 voice expelled at
+        // once, the mix 6-7 dB quieter until the next gear change).
+        std::vector<double> held(300, 0.1);
+        held[150] = 20.0;
+        Check(WorstOverMs(held, 0.6) > 1.0, "one block held 20 ms puts EA over budget");
+        // 14 ms is enough; 13 ms isn't (the three-block average).
+        held[150] = 14.0;
+        Check(WorstOverMs(held, 0.6) > 0.0, "one block held 14 ms puts EA over budget");
+        held[150] = 13.0;
+        Check(WorstOverMs(held, 0.6) < 0.0, "one block held 13 ms doesn't");
+        // EA's average: three blocks, the oldest replaced.
+        Average a;
+        a.Add(3);
+        a.Add(6);
+        Check(a.Add(9) == 6.0 && a.Add(0) == 5.0 && a.Add(0) == 3.0 && a.Add(0) == 0.0, "the average is of the last three blocks");
+        // A budget of 100% or more is never checked.
+        Check(Over(Ticks(50), Ticks(50), 100.0) == 0.0, "a budget of 100% isn't checked");
+    }
+
+    void Policy()
+    {
+        static_assert(!Expels(nullptr));
+        Check(!Expels(nullptr), "no NFSMW_EA_CPU_BUDGET: nothing expelled for time");
+        Check(!Expels(""), "NFSMW_EA_CPU_BUDGET empty: nothing expelled");
+        Check(!Expels("0"), "NFSMW_EA_CPU_BUDGET=0: nothing expelled");
+        Check(!Expels("10"), "NFSMW_EA_CPU_BUDGET=10: nothing expelled");
+        Check(Expels("1"), "NFSMW_EA_CPU_BUDGET=1: EA's rule");
+    }
+
+    // The generated functions: name -> body (the PPC_FUNC_IMPL block).
+    std::map<std::string, std::string> LoadFunctions(const std::filesystem::path& ppc, const std::vector<std::string>& names)
+    {
+        std::map<std::string, std::string> found;
+        for (const auto& entry : std::filesystem::directory_iterator(ppc))
+        {
+            const std::string file = entry.path().filename().string();
+            if (file.rfind("ppc_recomp.", 0) != 0 || entry.path().extension() != ".cpp")
+                continue;
+            std::ifstream in(entry.path(), std::ios::binary);
+            std::stringstream ss;
+            ss << in.rdbuf();
+            const std::string text = ss.str();
+            for (const std::string& name : names)
+            {
+                const std::string head = "PPC_FUNC_IMPL(__imp__" + name + ") {";
+                const size_t at = text.find(head);
+                if (at == std::string::npos)
+                    continue;
+                const size_t end = text.find("\n}\n", at);
+                found[name] = text.substr(at, end == std::string::npos ? std::string::npos : end - at);
+            }
+        }
+        return found;
+    }
+
+    // `body` holds these lines in this order (each a substring of a line,
+    // later ones after earlier ones; other lines may come between).
+    bool InOrder(const std::string& body, const std::vector<std::string>& lines)
+    {
+        size_t at = 0;
+        for (const std::string& l : lines)
+        {
+            at = body.find(l, at);
+            if (at == std::string::npos)
+                return false;
+            at += l.size();
+        }
+        return true;
+    }
+
+    std::string Name(uint32_t address)
+    {
+        char s[32];
+        snprintf(s, sizeof(s), "sub_%08X", address);
+        return s;
+    }
+
+    std::string Call(uint32_t address)
+    {
+        char s[32];
+        snprintf(s, sizeof(s), "// bl 0x%08x", address);
+        return s;
+    }
+
+    void GeneratedCode(const std::filesystem::path& ppc)
+    {
+        const std::vector<std::string> names = { Name(kMixerThread), Name(kBudgetCheck), Name(kExpelOverBudget), Name(kPickVoice),
+            Name(kExpelVoice), Name(kTimebase) };
+        auto f = LoadFunctions(ppc, names);
+        const int before = s_failed;
+        for (const std::string& n : names)
+            Check(f.count(n) == 1, "ppc/ has " + n);
+        if (s_failed != before)
+            return;
+        // The timebase: mftb and nothing else.
+        Check(InOrder(f[Name(kTimebase)], { "// mftb r3", "// blr" }), "sub_825CFEB0 is mftb");
+        // The mixer thread runs the check on mixer + 68 each block, after the
+        // command buffer and before the voices.
+        Check(InOrder(f[Name(kMixerThread)], { "// bl 0x825cf588", "// addi r3,r31,68", Call(kBudgetCheck), "// bl 0x825d05d0" }),
+            "the mixer thread runs the budget check on mixer + 68 between the commands and the voices");
+        // The check: the time since the last stamp (mftb), the three-block
+        // average (x 1/3 at +12), then, only while the config's budget (+16)
+        // is under 100, the load against it, and the over-budget step with
+        // the difference.
+        Check(InOrder(f[Name(kBudgetCheck)], { Call(kTimebase), "// lwz r11,4(r31)", "// lwz r10,8(r31)", "// fmuls f8,f9,f13",
+                  "// stfs f8,0(r30)", Call(kTimebase), "// lfs f12,16(r11)", "// lfs f0,512(r10)", "// bge cr6,0x82601644",
+                  "// lwz r11,100(r11)", "// lfs f3,48(r10)", "// fsubs f1,f0,f12", "// ble cr6,0x82601644", Call(kExpelOverBudget) }),
+            "sub_82601528 averages mftb time and calls the over-budget step when over a budget under 100%");
+        // The over-budget step: pick, take its cost off, expel (voice, 0),
+        // until it fits; the return addresses the probes and the log rely on.
+        Check(InOrder(f[Name(kExpelOverBudget)], { "// fmr f31,f1", Call(kPickVoice), "ctx.lr = 0x826017C8;", "// li r4,0",
+                  "// lfs f13,48(r3)", Call(kExpelVoice), "ctx.lr = 0x826017E4;", "// bgt cr6,0x826017c0" }),
+            "sub_82601788 picks a voice and expels it with (voice, 0) until it fits");
+        // The pick: the lowest priority (+36) under 100 only.
+        Check(InOrder(f[Name(kPickVoice)], { "// lwz r7,100(r11)", "// lfs f0,36(r9)", "// lfs f0,512(r11)", "// blt cr6,0x82601774" }),
+            "sub_826016B8 picks the lowest-priority voice, only under 100");
+        // Expelling: state 2, costs cleared, the expel command queued.
+        Check(InOrder(f[Name(kExpelVoice)], { "// li r10,2", "// stb r10,64(r31)", "// stfs f0,48(r31)" }),
+            "sub_825D04B8(voice, 0) marks the voice expelled");
+    }
+}
+
+int main(int argc, char** argv)
+{
+    Rule();
+    Policy();
+    if (argc > 1)
+        GeneratedCode(argv[1]);
+    else
+    {
+        fprintf(stderr, "FAIL: usage: ea_cpu_budget_test <ppc dir>\n");
+        s_failed++;
+    }
+    if (s_failed)
+    {
+        fprintf(stderr, "%d check(s) failed\n", s_failed);
+        return 1;
+    }
+    printf("ea_cpu_budget_test: all checks passed\n");
+    return 0;
+}
diff --git a/tests/fade_layers_test.cpp b/tests/fade_layers_test.cpp
new file mode 100644
index 0000000..4e87c08
--- /dev/null
+++ b/tests/fade_layers_test.cpp
@@ -0,0 +1,393 @@
+// Tests for the fade to black before a load (gpu/edge_bars.h's PlanLayer,
+// and gpu/renderer.cpp using it), a report of a "black rectangle right
+// before the last intro race with Razor" (v0.1.7 on a 3024x1898 MacBook, the
+// career prologue's EndingNis03 fading out before the storyfmv_pin11 movie):
+// one flat front-end quad, FB000000 at its darkest, x +-1.121 and y +-0.972
+// of the 16:9 band, short of the screen's top and bottom (and of a wide
+// screen's sides), so the frozen scene showed above and below it for the
+// fade's ~1.5 s; the dim over the loading screen (B8000000, x +-1.104, y
+// -0.978..0.985) is the same shape. Both are now stretched to the screen's
+// edges, at every screen shape. From the repo root:
+//   clang++ -std=c++20 -O2 -UNDEBUG -Iruntime tests/fade_layers_test.cpp -o build/fade_layers_test
+//   build/fade_layers_test runtime/gpu/renderer.cpp
+// Planted faults: the match cases run again under deliberately wrong
+// thresholds (each must fail a case), the pixel oracle on the layer as drawn
+// before (it must fail), and the renderer checks on copies of renderer.cpp
+// with the wiring cut (each must fail).
+#include <gpu/edge_bars.h>
+
+#include <algorithm>
+#include <cmath>
+#include <cstdint>
+#include <cstdio>
+#include <cstring>
+#include <fstream>
+#include <sstream>
+#include <string>
+
+using namespace gpu::bars;
+
+static int g_failures = 0;
+static bool g_quiet = false;
+#define CHECK(cond, ...) do { if (!(cond)) { g_failures++; if (!g_quiet) { printf("  FAIL %s:%d: %s: ", __FILE__, __LINE__, #cond); printf(__VA_ARGS__); printf("\n"); } } } while (0)
+
+// The screen shapes (view scale x, y), as menu_borders_test's.
+struct Shape
+{
+    const char* name;
+    float sx, sy;
+};
+static const Shape kShapes[] = {
+    { "1280x720 (16:9)", 1.0f, 1.0f },
+    { "1280x800 (Deck)", 1.0f, 0.9f },
+    { "3024x1898 (MacBook Pro 14, the report's)", 1.0f, 0.896207f },
+    { "3024x1964 (its whole screen)", 1.0f, 0.866667f },
+    { "1200x800 (3:2)", 1.0f, 0.84375f },
+    { "1024x768 (4:3)", 1.0f, 0.75f },
+    { "2868x1320 (iPhone 18 Pro Max)", 0.818182f, 1.0f },
+    { "2560x1080 (21:9)", 0.75f, 1.0f },
+    { "3440x1440", 0.744186f, 1.0f },
+    { "2880x810 (32:9)", 0.5f, 1.0f },
+};
+
+// As logged (NFSMW_LOG_COVERS, runs r1/x3, 2026-10-20): the fade before the
+// pin11 movie and the loading screen's dim.
+constexpr float kFadeX = 1.121f, kFadeY = 0.972f;
+constexpr uint32_t kFade = 0xFB000000u;
+
+struct Quad
+{
+    Vertex v[4];
+};
+static Quad Rectangle(float bx0, float bx1, float by0, float by1, float sx, float sy, uint32_t argb)
+{
+    const float x0 = bx0 * sx, x1 = bx1 * sx, y0 = by0 * sy, y1 = by1 * sy;
+    return { { { x0, y0, argb }, { x1, y0, argb }, { x1, y1, argb }, { x0, y1, argb } } };
+}
+
+// ---- The shape ----
+
+static void Match(const char* what, const Quad& q, const Shape& s, bool want, const LayerRule& rule)
+{
+    const bool got = MatchLayer(q.v, s.sx, s.sy, rule);
+    CHECK(got == want, "%s at %s: %s, want %s", what, s.name, got ? "layer" : "none", want ? "layer" : "none");
+}
+
+static int LayerCases(const LayerRule& rule)
+{
+    const int before = g_failures;
+    for (const Shape& s : kShapes)
+    {
+        auto at = [&](float x0, float x1, float y0, float y1, uint32_t argb) { return Rectangle(x0, x1, y0, y1, s.sx, s.sy, argb); };
+        // Taken: short of the screen's top and bottom at every shape (and of
+        // its sides past 1.121 of the band: 21:9, 32:9, the iPhone).
+        Match("the fade before the pin11 movie", at(-kFadeX, kFadeX, -kFadeY, kFadeY, kFade), s, true, rule);
+        Match("the fade as it starts (alpha 08)", at(-kFadeX, kFadeX, -kFadeY, kFadeY, 0x08000000u), s, true, rule);
+        Match("the loading screen's dim", at(-1.104f, 1.104f, -0.978f, 0.985f, 0xB8000000u), s, true, rule);
+        Match("the fade, y flipped", at(-kFadeX, kFadeX, kFadeY, -kFadeY, kFade), s, true, rule);
+        Match("a grey layer of the fade's shape", at(-kFadeX, kFadeX, -kFadeY, kFadeY, 0x80404040u), s, true, rule);
+        Match("the Blacklist bio's panel fading in (the black frame rule's once opaque)", at(-0.976f, 0.976f, -0.985f, 0.985f, 0x11000000u), s,
+            true, rule);
+        // Left alone.
+        Match("the intro's black frame (x 0.970, y 0.939: the black frame rule's)", at(-0.970f, 0.970f, -0.939f, 0.939f, 0xFF000000u), s, false,
+            rule);
+        Match("the intro's other black frame (y 0.920)", at(-0.970f, 0.970f, -0.920f, 0.920f, 0xFE000000u), s, false, rule);
+        Match("a fade past the screen's edges (+-1.29 / +-1.40)", at(-1.29f / s.sx, 1.29f / s.sx, -1.40f / s.sy, 1.40f / s.sy, 0xFF000000u), s,
+            false, rule);
+        Match("vid cam dark overlay", at(-0.712f, 0.668f, -0.893f, 0.908f, 0x3C000000u), s, false, rule);
+        Match("cam dialog box", at(-0.578f, 0.586f, -0.167f, 0.569f, 0xFD000000u), s, false, rule);
+        Match("pause dim centre", at(-0.53f, 0.57f, -1.91f, 1.91f, 0xC8000000u), s, false, rule);
+        Match("a layer 0.93 of the band", at(-0.93f, 0.93f, -0.93f, 0.93f, kFade), s, false, rule);
+        Match("the fade off-centre by 0.03 in y", at(-kFadeX, kFadeX, -kFadeY + 0.03f, kFadeY + 0.03f, kFade), s, false, rule);
+        Quad grad = at(-kFadeX, kFadeX, -kFadeY, kFadeY, kFade);
+        grad.v[1].argb = grad.v[2].argb = 0x00000000u;  // the pause dim's side gradients: alpha varies
+        Match("a gradient of the fade's shape", grad, s, false, rule);
+        Quad bent = at(-kFadeX, kFadeX, -kFadeY, kFadeY, kFade);
+        bent.v[2].x -= 0.05f;
+        Match("a bent quad", bent, s, false, rule);
+    }
+    // A layer short of the screen's edge by less than the threshold: the
+    // whole band's height at 16:9 (+-1.0): nothing to stretch.
+    Match("a layer over the whole 16:9 frame at 16:9", Rectangle(-kFadeX, kFadeX, -1.0f, 1.0f, 1.0f, 1.0f, kFade), kShapes[0], false, rule);
+    return g_failures - before;
+}
+
+static void Planted(const char* what, const LayerRule& wrong)
+{
+    const int saved = g_failures;
+    g_quiet = true;
+    const int failed = LayerCases(wrong);
+    g_quiet = false;
+    g_failures = saved;
+    printf("planted %s: %d case(s) failed\n", what, failed);
+    CHECK(failed > 0, "planted %s passed every layer case", what);
+}
+
+// ---- The plan on the draw as the renderer sees it ----
+
+struct Matrix
+{
+    float c[8];
+};
+static Matrix FrontEndMatrix(float sx, float sy)
+{
+    return { { 0.69f * sx, 0.0f, 0.0f, 0.0f, 0.0f, 0.92f * sy, 0.0f, 0.0f } };
+}
+
+// The front end's posScale (renderer.cpp: 2 sx / w, 2 sy / h, 2 ox / w - 1,
+// 2 oy / h - 1): viewport s(640,-360) o(640,360) in the 1280x2048 target at
+// `scale` (1x or 2x: the host viewport is the target's size times it).
+static void FrontEndPs(float ps[4], float ox = 640.0f, float oy = 360.0f)
+{
+    ps[0] = 2.0f * 640.0f / 1280.0f;
+    ps[1] = 2.0f * -360.0f / 2048.0f;
+    ps[2] = 2.0f * ox / 1280.0f - 1.0f;
+    ps[3] = 2.0f * oy / 2048.0f - 1.0f;
+}
+
+// The fade's draw as logged: blend 07060706, t0 32x32 (the white texture).
+static Draw FadeDraw(const Matrix& m, float sx, float sy, const float ps[4], float hostW, float hostH)
+{
+    return Draw{ .prim = 13,
+        .count = 4,
+        .c = m.c,
+        .frontEndY = std::fabs(m.c[5]),
+        .scaleX = sx,
+        .scaleY = sy,
+        .frontEndShader = true,
+        .leftAlone = true,
+        .occlusion = false,
+        .vte = 0x43F,
+        .blend0 = 0x07060706,
+        .t0Sampled = true,
+        .t0Width = 32,
+        .t0Height = 32,
+        .t0Format = 20,
+        .posScale = { ps[0], ps[1], ps[2], ps[3] },
+        .hostW = hostW,
+        .hostH = hostH,
+        .scissor = { 0, 0, int32_t(hostW), int32_t(hostH) } };
+}
+
+static Plan Run(const Draw& d, const Quad& q, const Matrix& m, uint32_t vertexLimit = 4)
+{
+    uint32_t w[4][4];
+    for (int k = 0; k < 4; k++)
+    {
+        const float p[3] = { q.v[k].x / m.c[0], q.v[k].y / m.c[5], 0.0f };
+        std::memcpy(w[k], p, sizeof(p));
+        w[k][3] = q.v[k].argb;
+    }
+    return PlanLayer(d, [&](uint32_t k, uint32_t j, uint32_t& word) {
+        word = w[k & 3][j & 3];
+        return k < vertexLimit;
+    });
+}
+
+// Every host pixel of the screen (the target's top `screenH` rows) has its
+// centre inside the quad as `ps` draws its box: returns those outside.
+static int Outside(const Box& b, const float ps[4], float hostW, float hostH, float screenH)
+{
+    const float nx0 = b.x0 * ps[0] + ps[2], nx1 = b.x1 * ps[0] + ps[2], ny0 = b.y0 * ps[1] + ps[3], ny1 = b.y1 * ps[1] + ps[3];
+    const float lx = std::min(nx0, nx1), hx = std::max(nx0, nx1), ly = std::min(ny0, ny1), hy = std::max(ny0, ny1);
+    int outside = 0;
+    for (int32_t y = 0; y < int32_t(screenH); y++)
+        for (int32_t x = 0; x < int32_t(hostW); x++)
+        {
+            const float ndcX = (float(x) + 0.5f) / hostW * 2.0f - 1.0f, ndcY = (float(y) + 0.5f) / hostH * 2.0f - 1.0f;
+            outside += !(ndcX > lx && ndcX < hx && ndcY > ly && ndcY < hy);
+        }
+    return outside;
+}
+
+static void PlanTests()
+{
+    int stretched = 0;
+    for (const Shape& s : kShapes)
+        for (const int scale : { 1, 2 })
+            for (const bool half : { false, true })  // D3D's half-pixel centres
+            {
+                const Matrix m = FrontEndMatrix(s.sx, s.sy);
+                float ps[4];
+                FrontEndPs(ps, half ? 640.5f : 640.0f, half ? 360.5f : 360.0f);
+                const float hostW = 1280.0f * scale, hostH = 2048.0f * scale, screenH = 720.0f * scale;
+                const Draw d = FadeDraw(m, s.sx, s.sy, ps, hostW, hostH);
+                const Quad fade = Rectangle(-kFadeX, kFadeX, -kFadeY, kFadeY, s.sx, s.sy, kFade);
+                const Plan p = Run(d, fade, m);
+                CHECK(p.fill == Fill::Layer, "the fade at %s, %dx%s: not taken", s.name, scale, half ? " (half-pixel)" : "");
+                if (p.fill != Fill::Layer)
+                    continue;
+                CHECK(p.rectCount == 0 && p.argb == kFade, "the fade's plan at %s: %u rectangles, colour %08X", s.name, p.rectCount, p.argb);
+                // The oracle: as drawn before, the screen's top and bottom
+                // rows (and a wide screen's sides) are outside it; stretched,
+                // none.
+                const int before = Outside(p.box, ps, hostW, hostH, screenH), after = Outside(p.box, p.posScale, hostW, hostH, screenH);
+                CHECK(before > 0, "the fade as the game draws it covers %s's whole screen (the oracle sees nothing to fix)", s.name);
+                CHECK(after == 0, "the fade stretched at %s, %dx: %d host pixel(s) still outside it", s.name, scale, after);
+                stretched++;
+            }
+    printf("the fade stretched to the screen's edges: %d shape/scale/centre cases\n", stretched);
+    // The register checks refuse what isn't a flat front-end layer.
+    const Shape& mac = kShapes[2];
+    const Matrix m = FrontEndMatrix(mac.sx, mac.sy);
+    float ps[4];
+    FrontEndPs(ps);
+    const Quad fade = Rectangle(-kFadeX, kFadeX, -kFadeY, kFadeY, mac.sx, mac.sy, kFade);
+    struct Fault
+    {
+        const char* what;
+        void (*apply)(Draw&);
+    };
+    const Fault faults[] = {
+        { "over a picture (t0 1024x512: the results screen)", [](Draw& d) { d.t0Width = 1024; d.t0Height = 512; } },
+        { "widened by another rule", [](Draw& d) { d.leftAlone = false; } },
+        { "inside an occlusion query", [](Draw& d) { d.occlusion = true; } },
+        { "not the front-end shader", [](Draw& d) { d.frontEndShader = false; } },
+        { "two quads", [](Draw& d) { d.count = 8; } },
+        { "a triangle list", [](Draw& d) { d.prim = 4; } },
+        { "additive blending", [](Draw& d) { d.blend0 = 0x01060106; } },
+        { "no viewport transform", [](Draw& d) { d.vte = 0x400; } },
+    };
+    for (const Fault& f : faults)
+    {
+        Draw d = FadeDraw(m, mac.sx, mac.sy, ps, 1280.0f, 2048.0f);
+        f.apply(d);
+        CHECK(Run(d, fade, m).fill == Fill::None, "the fade %s taken", f.what);
+    }
+    Draw d = FadeDraw(m, mac.sx, mac.sy, ps, 1280.0f, 2048.0f);
+    CHECK(Run(d, fade, m, 3).fill == Fill::None, "a short vertex buffer taken");
+    // The black frame rule keeps its own (PlanFill first in the renderer):
+    // the intro's black frame is PlanFill's, and PlanLayer leaves it.
+    const Quad frame = Rectangle(-0.970f, 0.970f, -0.939f, 0.939f, mac.sx, mac.sy, 0xFF000000u);
+    CHECK(Run(d, frame, m).fill == Fill::None, "the intro's black frame taken for a layer");
+}
+
+// ---- gpu/renderer.cpp uses it ----
+
+static std::string Squash(const std::string& source)
+{
+    std::string code, r;
+    std::istringstream in(source);
+    for (std::string line; std::getline(in, line);)
+    {
+        size_t c = line.find("//");
+        code += (c == std::string::npos ? line : line.substr(0, c)) + "\n";
+    }
+    for (char c : code)
+        if (c != ' ' && c != '\n' && c != '\t')
+            r += c;
+    return r;
+}
+
+static size_t Count(const std::string& s, const std::string& what)
+{
+    size_t n = 0;
+    for (size_t at = s.find(what); at != std::string::npos; at = s.find(what, at + 1))
+        n++;
+    return n;
+}
+
+static int RendererChecks(const std::string& source, bool quiet)
+{
+    const int before = g_failures;
+    const bool was = g_quiet;
+    g_quiet = quiet;
+    const std::string all = Squash(source);
+    // planEdgeFills: the layer last, only when nothing earlier took the draw.
+    const size_t vignette = all.find("plan=gpu::bars::PlanVignette(draw,read,texel);");
+    const size_t layer = all.find("if(plan.fill==gpu::bars::Fill::None)plan=gpu::bars::PlanLayer(draw,read);");
+    const size_t ret = layer == std::string::npos ? layer : all.find("returnplan;", layer);
+    CHECK(vignette != std::string::npos && layer != std::string::npos && vignette < layer && ret != std::string::npos && ret - layer < 200,
+        "planEdgeFills asks PlanLayer after PlanVignette, for a draw nothing else took");
+    CHECK(Count(all, "barPlan=planEdgeFills(c,") == 2, "planEdgeFills asked on both paths: %zu", Count(all, "barPlan=planEdgeFills(c,"));
+    // Applied to the draw itself on both paths (wide or tall screens, 16:9),
+    // before its constants are pushed.
+    const std::string apply = "if(barPlan.fill==gpu::bars::Fill::Layer)memcpy(pc.posScale,barPlan.posScale,sizeof(pc.posScale));";
+    CHECK(Count(all, apply) == 2, "the layer's posScale applied on both paths: %zu", Count(all, apply));
+    const size_t lastApply = all.rfind(apply);
+    const size_t push = lastApply == std::string::npos ? lastApply : all.find("pushConstants(pc);", lastApply);
+    const size_t draw = lastApply == std::string::npos ? lastApply : all.find("vkCmdDraw", lastApply);
+    CHECK(push != std::string::npos && draw != std::string::npos && push < draw,
+        "the posScale is set before the draw's constants are pushed and it is drawn");
+    CHECK(all.find("staticconstboolbarFill=[]{constchar*v=std::getenv(\"NFSMW_BAR_FILL\");return!(v&&v[0]=='0');}();") != std::string::npos,
+        "NFSMW_BAR_FILL=0 still turns the edge fills off");
+    g_quiet = was;
+    return g_failures - before;
+}
+
+static void RendererTests(const char* path)
+{
+    std::ifstream f(path);
+    CHECK(f.good(), "cannot read %s", path);
+    if (!f.good())
+        return;
+    std::stringstream ss;
+    ss << f.rdbuf();
+    const std::string source = ss.str();
+    CHECK(RendererChecks(source, false) == 0, "renderer.cpp's layer wiring");
+    struct Cut
+    {
+        const char* what;
+        const char* from;
+        const char* to;
+    };
+    const Cut cuts[] = {
+        { "PlanLayer never asked", "plan = gpu::bars::PlanLayer(draw, read);", ";" },
+        { "PlanLayer's guarded call removed", "            if (plan.fill == gpu::bars::Fill::None)\n                plan = gpu::bars::PlanLayer(draw, read);\n", "" },
+        { "the 16:9 path doesn't apply it",
+            "                    if (barPlan.fill == gpu::bars::Fill::Layer)\n                        memcpy(pc.posScale, barPlan.posScale, sizeof(pc.posScale));\n", "" },
+        { "the wide/tall path doesn't apply it",
+            "                        if (barPlan.fill == gpu::bars::Fill::Layer)\n                            memcpy(pc.posScale, barPlan.posScale, sizeof(pc.posScale));\n", "" },
+    };
+    for (const Cut& c : cuts)
+    {
+        std::string copy = source;
+        const size_t at = copy.find(c.from);
+        CHECK(at != std::string::npos, "planted '%s': its text is not in renderer.cpp", c.what);
+        if (at == std::string::npos)
+            continue;
+        copy.replace(at, std::strlen(c.from), c.to);
+        const int saved = g_failures;
+        const int failed = RendererChecks(copy, true);
+        g_failures = saved;
+        printf("planted renderer '%s': %d check(s) failed\n", c.what, failed);
+        CHECK(failed > 0, "planted renderer '%s' passed every check", c.what);
+    }
+}
+
+int main(int argc, char** argv)
+{
+    CHECK(LayerCases({}) == 0, "the layer cases");
+    {
+        LayerRule r;
+        r.extentMin = 0.90f;  // the intro's black frames
+        Planted("extentMin 0.90", r);
+        r = {};
+        r.extentMin = 0.98f;  // the fade itself (y 0.972)
+        Planted("extentMin 0.98", r);
+        r = {};
+        r.centreMax = 0.05f;  // the off-centre layer
+        Planted("centreMax 0.05", r);
+        r = {};
+        r.shortMin = 0.05f;  // the fade's 0.028 short at 16:9
+        Planted("shortMin 0.05", r);
+        r = {};
+        r.shortMin = -0.5f;  // layers already past the edges
+        Planted("shortMin -0.5", r);
+        r = {};
+        r.cornerTolerance = 0.1f;  // the bent quad
+        Planted("cornerTolerance 0.1", r);
+    }
+    PlanTests();
+    if (argc > 1)
+        RendererTests(argv[1]);
+    else
+        printf("(no renderer.cpp given: its checks skipped)\n");
+    if (g_failures)
+    {
+        printf("fade_layers_test: %d failure(s)\n", g_failures);
+        return 1;
+    }
+    printf("fade_layers_test: all passed\n");
+    return 0;
+}
diff --git a/tests/hfr_blend_test.cpp b/tests/hfr_blend_test.cpp
new file mode 100644
index 0000000..a4017a4
--- /dev/null
+++ b/tests/hfr_blend_test.cpp
@@ -0,0 +1,209 @@
+// SpeedBreaker. GPL-3.0-or-later (see COPYING).
+//
+// SPIKE (v017-hfr-spike): game/hfr_blend.h, the in-between picture's pose
+// blending: world matrices (the cars' +816), view matrices (the cameras'),
+// and what counts as a cut. Build by hand:
+//   c++ -std=c++20 -O2 -I runtime tests/hfr_blend_test.cpp -o /tmp/hfr_blend_test && /tmp/hfr_blend_test
+#include <game/hfr_blend.h>
+
+#include <cassert>
+#include <cmath>
+#include <cstdio>
+
+namespace
+{
+    using namespace hfr::blend;
+    int s_failures = 0;
+    void Check(bool ok, const char* what)
+    {
+        if (!ok)
+        {
+            fprintf(stderr, "FAIL: %s\n", what);
+            s_failures++;
+        }
+    }
+    bool Near(float a, float b, float eps = 1e-4f) { return std::fabs(a - b) <= eps; }
+
+    // A world matrix: yaw about the up axis (y), a uniform scale, a position.
+    void WorldOf(float yawDeg, float scale, V3 pos, float m[16])
+    {
+        const float c = std::cos(yawDeg / 57.2957795f), s = std::sin(yawDeg / 57.2957795f);
+        const float rows[16] = { c * scale, 0, -s * scale, 0, 0, scale, 0, 0, s * scale, 0, c * scale, 0, pos.x, pos.y, pos.z, 1 };
+        memcpy(m, rows, sizeof(rows));
+    }
+    // A view matrix for a camera at `pos` with that yaw: R = the camera's axes (as a world matrix's rows, transposed back
+    // for the row-vector view convention v_cam = v R + t with t = -pos R).
+    void ViewOf(float yawDeg, V3 pos, float m[16])
+    {
+        float w[16];
+        WorldOf(yawDeg, 1.0f, { 0, 0, 0 }, w);
+        // R = transpose of the camera's orientation.
+        float r[9];
+        for (int i = 0; i < 3; i++)
+            for (int j = 0; j < 3; j++)
+                r[i * 3 + j] = w[j * 4 + i];
+        for (int i = 0; i < 3; i++)
+        {
+            for (int j = 0; j < 3; j++)
+                m[i * 4 + j] = r[i * 3 + j];
+            m[i * 4 + 3] = 0;
+        }
+        for (int j = 0; j < 3; j++)
+            m[12 + j] = -(pos.x * r[0 * 3 + j] + pos.y * r[1 * 3 + j] + pos.z * r[2 * 3 + j]);
+        m[15] = 1;
+    }
+    float Det(const float m[16])
+    {
+        return m[0] * (m[5] * m[10] - m[6] * m[9]) - m[1] * (m[4] * m[10] - m[6] * m[8]) + m[2] * (m[4] * m[9] - m[5] * m[8]);
+    }
+    bool Orthonormal(const float m[16], float scale = 1.0f)
+    {
+        for (int i = 0; i < 3; i++)
+            for (int j = 0; j < 3; j++)
+            {
+                const float d = Dot(Row(m, i), Row(m, j)) / (scale * scale);
+                if (!Near(d, i == j ? 1.0f : 0.0f, 1e-4f))
+                    return false;
+            }
+        return true;
+    }
+}
+
+int main()
+{
+    float a[16], b[16], out[16], want[16];
+
+    // The same pose blends to itself.
+    WorldOf(30, 1, { 10, 2, -5 }, a);
+    Check(World(a, a, 0.5f, out), "same pose blends");
+    for (int i = 0; i < 16; i++)
+        Check(Near(out[i], a[i]), "same pose unchanged");
+
+    // A move only: the midpoint, the axes unchanged.
+    WorldOf(30, 1, { 0, 0, 0 }, a);
+    WorldOf(30, 1, { 1.5f, 0, 0 }, b);  // 200 mph for one 1/60 s step
+    World(a, b, 0.5f, out);
+    Check(Near(out[12], 0.75f) && Near(out[13], 0) && Near(out[14], 0), "move: midpoint");
+    Check(Near(out[0], a[0]) && Near(out[10], a[10]), "move: axes kept");
+
+    // A turn of 6 degrees: halfway is 3 degrees, orthonormal, right-handed.
+    WorldOf(0, 1, { 0, 0, 0 }, a);
+    WorldOf(6, 1, { 0, 0, 0 }, b);
+    WorldOf(3, 1, { 0, 0, 0 }, want);
+    World(a, b, 0.5f, out);
+    for (int i = 0; i < 12; i++)
+        Check(Near(out[i], want[i], 2e-5f), "turn: halfway angle");
+    Check(Orthonormal(out), "turn: orthonormal");
+    Check(Det(out) > 0, "turn: handedness kept");
+    // A mirrored basis stays mirrored (no cross product).
+    WorldOf(0, 1, { 0, 0, 0 }, a);
+    WorldOf(6, 1, { 0, 0, 0 }, b);
+    for (int k = 0; k < 3; k++)
+        a[8 + k] = -a[8 + k], b[8 + k] = -b[8 + k];
+    World(a, b, 0.5f, out);
+    Check(Det(out) < 0, "mirrored: handedness kept");
+
+    // A compound turn (yaw and pitch about different axes): the rows' plain blend isn't orthogonal; the result must be.
+    {
+        auto yawPitch = [](float yawDeg, float pitchDeg, float m[16]) {
+            const float cy = std::cos(yawDeg / 57.2957795f), sy = std::sin(yawDeg / 57.2957795f);
+            const float cp = std::cos(pitchDeg / 57.2957795f), sp = std::sin(pitchDeg / 57.2957795f);
+            // rows of Ry * Rx
+            const float rows[16] = { cy, sy * sp, -sy * cp, 0, 0, cp, sp, 0, sy, -cy * sp, cy * cp, 0, 0, 0, 0, 1 };
+            memcpy(m, rows, sizeof(rows));
+        };
+        yawPitch(0, 0, a);
+        yawPitch(40, 35, b);
+        Check(World(a, b, 0.5f, out), "compound turn blends");
+        Check(Orthonormal(out), "compound turn: orthonormal");
+        Check(Det(out) > 0, "compound turn: handedness kept");
+    }
+
+    // A scaled model keeps its scale.
+    WorldOf(0, 2.5f, { 0, 0, 0 }, a);
+    WorldOf(10, 2.5f, { 0, 0, 0 }, b);
+    World(a, b, 0.5f, out);
+    Check(Orthonormal(out, 2.5f), "scale kept");
+
+    // A view matrix: the camera's position at the midpoint, its axes halfway.
+    ViewOf(0, { 0, 2, 0 }, a);
+    ViewOf(8, { 1.5f, 2, 0.5f }, b);
+    Check(View(a, b, 0.5f, out), "view blends");
+    const V3 p = ViewPosition(out), pa = ViewPosition(a);
+    Check(Near(pa.x, 0) && Near(pa.y, 2) && Near(pa.z, 0), "view position recovered");
+    Check(Near(p.x, 0.75f, 1e-4f) && Near(p.y, 2, 1e-4f) && Near(p.z, 0.25f, 1e-4f), "view: camera at the midpoint");
+    ViewOf(4, { 0.75f, 2, 0.25f }, want);
+    for (int i = 0; i < 16; i++)
+        Check(Near(out[i], want[i], 2e-4f), "view: the halfway camera");
+    Check(Orthonormal(out), "view: orthonormal");
+    // Blending the view matrices' translations directly (the naive way) is NOT the halfway camera when it turns.
+    float naive = 0.0f;
+    for (int i = 12; i < 15; i++)
+        naive = std::max(naive, std::fabs(0.5f * (a[i] + b[i]) - want[i]));
+    Check(naive > 1e-3f, "test sensitive: naive translation blend differs");
+
+    // A cutscene camera: 1.4 km from the origin, its R a little off orthonormal (rows' lengths and dot products off by
+    // ~3e-5, as a play-test's NIS cameras measured). The in-between camera sits halfway between the two
+    // real cameras' actual positions (p R + t = 0), and a car 9 m ahead lands halfway between where they show it.
+    {
+        const V3 posA = { 1338.07f, 391.85f, 104.75f }, posB = { 1338.88f, 391.64f, 104.77f };
+        auto skewed = [](float yawDeg, V3 pos, float m[16]) {
+            ViewOf(yawDeg, { 0, 0, 0 }, m);
+            for (int j = 0; j < 3; j++)
+            {
+                m[0 * 4 + j] *= 1.0f - 3e-5f;
+                m[1 * 4 + j] = m[1 * 4 + j] * (1.0f - 2e-5f) + 3e-5f * m[0 * 4 + j];
+                m[2 * 4 + j] = m[2 * 4 + j] * (1.0f - 4e-5f) - 2e-5f * m[1 * 4 + j];
+            }
+            for (int j = 0; j < 3; j++)  // t = -pos R: the camera actually at pos
+                m[12 + j] = -(pos.x * m[0 * 4 + j] + pos.y * m[1 * 4 + j] + pos.z * m[2 * 4 + j]);
+        };
+        skewed(10.0f, posA, a);
+        skewed(10.2f, posB, b);
+        const V3 ea = ViewPosition(a);
+        Check(Near(ea.x, posA.x, 2e-3f) && Near(ea.y, posA.y, 2e-3f) && Near(ea.z, posA.z, 2e-3f), "skewed view: actual position");
+        // -t R^T (the position before the fix) is centimetres off here: the test sees the bug.
+        const V3 t = Row(a, 3);
+        const V3 approx = { -Dot(t, Row(a, 0)), -Dot(t, Row(a, 1)), -Dot(t, Row(a, 2)) };
+        Check(Len(Sub(approx, posA)) > 0.02f, "test sensitive: -t R^T is centimetres off a skewed view");
+        Check(View(a, b, 0.5f, out), "skewed view blends");
+        const V3 mid = Lerp(posA, posB, 0.5f), pm = ViewPosition(out);
+        Check(Len(Sub(pm, mid)) < 3e-3f, "skewed view: the in-between camera halfway");
+        // A point 9 m ahead of the cameras, in each one's camera space: the in-between's halfway (to 1 mm).
+        const V3 car = { posA.x + 9.0f, posA.y, posA.z + 1.0f };
+        auto cam = [&](const float m[16]) {
+            V3 v{};
+            for (int j = 0; j < 3; j++)
+                (&v.x)[j] = car.x * m[j] + car.y * m[4 + j] + car.z * m[8 + j] + m[12 + j];
+            return v;
+        };
+        const V3 ca = cam(a), cb = cam(b), co = cam(out), cmid = Lerp(ca, cb, 0.5f);
+        Check(Len(Sub(co, cmid)) < 2e-3f, "skewed view: a nearby car halfway in camera space");
+    }
+
+    // Cuts: a jump or a sharp turn isn't one step's motion.
+    WorldOf(0, 1, { 0, 0, 0 }, a);
+    WorldOf(0, 1, { 1.5f, 0, 0 }, b);
+    Check(!WorldCut(a, b, 8, 45), "1.5 m is a step");
+    WorldOf(0, 1, { 20, 0, 0 }, b);
+    Check(WorldCut(a, b, 8, 45), "20 m is a cut");
+    WorldOf(90, 1, { 0, 0, 0 }, b);
+    Check(WorldCut(a, b, 8, 45), "90 degrees is a cut");
+    ViewOf(0, { 0, 0, 0 }, a);
+    ViewOf(0, { 0, 0, 30 }, b);
+    Check(ViewCut(a, b, 8, 30), "camera jump is a cut");
+    ViewOf(5, { 0, 0, 1 }, b);
+    Check(!ViewCut(a, b, 8, 30), "camera step is not a cut");
+    // A half turn can't be blended.
+    WorldOf(0, 1, { 0, 0, 0 }, a);
+    WorldOf(180, 1, { 0, 0, 0 }, b);
+    Check(!World(a, b, 0.5f, out), "half turn refused");
+
+    if (s_failures)
+    {
+        fprintf(stderr, "hfr_blend_test: %d failures\n", s_failures);
+        return 1;
+    }
+    printf("hfr_blend_test: all passed\n");
+    return 0;
+}
diff --git a/tests/hfr_grid_test.cpp b/tests/hfr_grid_test.cpp
new file mode 100644
index 0000000..9b0a2ef
--- /dev/null
+++ b/tests/hfr_grid_test.cpp
@@ -0,0 +1,91 @@
+// SpeedBreaker. GPL-3.0-or-later (see COPYING).
+//
+// game/hfr_grid.h: HFR's pictures per world step on a refresh grid that
+// isn't a whole multiple of 60 Hz.
+#include <game/hfr_grid.h>
+
+#include <cmath>
+#include <cstdio>
+
+namespace
+{
+    int s_failures = 0;
+    void Check(bool ok, const char* what)
+    {
+        if (!ok)
+        {
+            fprintf(stderr, "FAIL: %s\n", what);
+            s_failures++;
+        }
+    }
+    constexpr double kStep = 1e9 / 60.0;
+}
+
+int main()
+{
+    float f[4];
+    int64_t t[4];
+    // 90 Hz, steps over 2 s at any phase: 3 pictures every 2 steps, alternating
+    // 1 and 2, evenly 1/90 s apart, each step's last at or before its end.
+    for (double phase : { 0.0, 1e6, 3.3e6, 5.55e6, 9e6 })
+    {
+        const double period = 1e9 / 90.0;
+        int total = 0, ones = 0, twos = 0;
+        double last = -1;
+        bool even = true;
+        for (int k = 0; k < 120; k++)
+        {
+            const double from = 1e9 + k * kStep;
+            const int n = hfr::grid::Pictures(phase, period, kStep, from, f, t);
+            total += n;
+            ones += n == 1;
+            twos += n == 2;
+            for (int i = 0; i < n; i++)
+            {
+                if (last >= 0 && std::fabs(double(t[i]) - last - period) > 2.0)
+                    even = false;
+                last = double(t[i]);
+                Check(f[i] > 0.0f && f[i] <= 1.0f, "90 Hz: fraction in (0, 1]");
+                Check(double(t[i]) > from && double(t[i]) <= from + kStep + 1.0, "90 Hz: picture within its step");
+            }
+        }
+        Check(total == 180, "90 Hz: 3 pictures every 2 steps");
+        Check(ones == 60 && twos == 60, "90 Hz: 1 and 2 in turn");
+        Check(even, "90 Hz: every refresh, once");
+    }
+    // 144 Hz: 2.4 a step on average (2 or 3).
+    {
+        int total = 0;
+        for (int k = 0; k < 60; k++)
+        {
+            const int n = hfr::grid::Pictures(0.0, 1e9 / 144.0, kStep, 1e9 + k * kStep, f, t);
+            Check(n == 2 || n == 3, "144 Hz: 2 or 3 a step");
+            total += n;
+        }
+        Check(total == 144, "144 Hz: 144 pictures a second");
+    }
+    // 120 Hz aligned with the steps: 1/2 and 1 every step.
+    {
+        const int n = hfr::grid::Pictures(0.0, 1e9 / 120.0, kStep, 10 * kStep, f, t);
+        Check(n == 2 && std::fabs(f[0] - 0.5f) < 1e-4f && std::fabs(f[1] - 1.0f) < 1e-4f, "120 Hz aligned: 1/2, 1");
+    }
+    // A refresh exactly at `from` belongs to the last step.
+    {
+        const int n = hfr::grid::Pictures(0.0, 1e9 / 90.0, kStep, 0.0, f, t);
+        Check(n >= 1 && t[0] > 0, "a refresh at `from` is the last step's");
+    }
+    // Slower than the steps: some steps have none.
+    {
+        int none = 0;
+        for (int k = 0; k < 60; k++)
+            none += hfr::grid::Pictures(0.0, 1e9 / 50.0, kStep, 1e9 + k * kStep, f, t) == 0;
+        Check(none == 10, "50 Hz: 10 steps a second without a picture");
+    }
+    if (s_failures)
+    {
+        fprintf(stderr, "hfr_grid_test: %d failures\n", s_failures);
+        return 1;
+    }
+    printf("hfr_grid_test: all passed\n");
+    return 0;
+}
diff --git a/tests/hfr_schedule_test.cpp b/tests/hfr_schedule_test.cpp
new file mode 100644
index 0000000..2fd9bfb
--- /dev/null
+++ b/tests/hfr_schedule_test.cpp
@@ -0,0 +1,73 @@
+// SpeedBreaker. GPL-3.0-or-later (see COPYING).
+//
+// video/hfr_schedule.h: HFR's show time on a Mac (both pictures of a step a
+// panel step later while real pictures miss their time, earlier again after a
+// quiet spell, with backoff).
+#include <video/hfr_schedule.h>
+
+#include <cstdio>
+
+namespace
+{
+    int s_failures = 0;
+    void Check(bool ok, const char* what)
+    {
+        if (!ok)
+        {
+            fprintf(stderr, "FAIL: %s\n", what);
+            s_failures++;
+        }
+    }
+    constexpr int64_t kMs = 1'000'000, kS = 1'000'000'000;
+}
+
+int main()
+{
+    using video::HfrShowAdapt;
+    HfrShowAdapt a;
+    int64_t now = 100 * kS;
+    // On time: nothing changes.
+    for (int i = 0; i < 1000; i++)
+        Check(!a.Report(0, now += 8 * kMs), "on time: no change");
+    Check(a.ExtraNs() == 0, "on time: no extra");
+    // Two late ones in a window: still nothing; a third: a step later.
+    Check(!a.Report(3 * kMs, now += 8 * kMs), "1 late");
+    Check(!a.Report(3 * kMs, now += 8 * kMs), "2 late");
+    Check(a.Report(3 * kMs, now += 8 * kMs), "3 late: later");
+    Check(a.ExtraNs() == HfrShowAdapt::kStepNs, "a step later");
+    // Late by less than kLateNs isn't late.
+    for (int i = 0; i < 10; i++)
+        Check(!a.Report(HfrShowAdapt::kLateNs, now += 8 * kMs), "0.99 ms: not late");
+    // Late ones spread out more than a window apart don't add up.
+    int64_t lastLate = 0;
+    for (int k = 0; k < 5; k++)
+    {
+        Check(!a.Report(5 * kMs, now += 8 * kMs), "a lone late one");
+        lastLate = now;
+        for (int i = 0; i < 130; i++)
+            a.Report(0, now += 8 * kMs);
+    }
+    Check(a.ExtraNs() == HfrShowAdapt::kStepNs, "lone late ones: no change");
+    // 10 s without a late one: a step earlier.
+    bool changed = false;
+    while (!changed && now - lastLate < 20 * kS)
+        changed = a.Report(0, now += 8 * kMs);
+    Check(changed && a.ExtraNs() == 0, "quiet 10 s: earlier");
+    Check(now - lastLate >= 10 * kS && now - lastLate <= 10 * kS + 8 * kMs, "10 s after the last late one");
+    // Late again within 6 s of that: later, and the next earlier waits 20 s.
+    for (int i = 0; i < 3; i++)
+        a.Report(4 * kMs, now += 8 * kMs);
+    Check(a.ExtraNs() == HfrShowAdapt::kStepNs, "late again: later");
+    Check(a.HoldNs() == 20 * kS, "backoff doubled");
+    // Never more than kMaxExtraNs.
+    for (int i = 0; i < 100; i++)
+        a.Report(20 * kMs, now += 8 * kMs);
+    Check(a.ExtraNs() == HfrShowAdapt::kMaxExtraNs, "capped");
+    if (s_failures)
+    {
+        fprintf(stderr, "hfr_schedule_test: %d failures\n", s_failures);
+        return 1;
+    }
+    printf("hfr_schedule_test: all passed\n");
+    return 0;
+}
diff --git a/tests/player_slots_test.cpp b/tests/player_slots_test.cpp
new file mode 100644
index 0000000..cd84d14
--- /dev/null
+++ b/tests/player_slots_test.cpp
@@ -0,0 +1,161 @@
+// Tests for hid/player_slots.h (which controller is which player in split screen) and game/split_screen.h's decode
+// of the game's own split-screen test; hid/input.cpp is read (argv[1]) to check it keeps users 1-3 behind the rule.
+// Header only; from the repo root:
+//   clang++ -std=c++20 -O2 -Iruntime tests/player_slots_test.cpp -o build/player_slots_test &&
+//   build/player_slots_test runtime/hid/input.cpp
+#include <game/split_screen.h>
+#include <hid/player_slots.h>
+
+#include <cstdio>
+#include <fstream>
+#include <sstream>
+#include <string>
+
+static int g_failures = 0;
+#define CHECK(cond, ...) do { if (!(cond)) { g_failures++; printf("  FAIL %s:%d: %s: ", __FILE__, __LINE__, #cond); printf(__VA_ARGS__); printf("\n"); } } while (0)
+
+using hid::PlayerSlots;
+constexpr int64_t kMs = 1'000'000;
+constexpr uint16_t kStart = 0x0010, kA = 0x1000;  // XInput's START and A
+
+int main(int argc, char** argv)
+{
+    // The game's predicate: 2 players and the quick-race flag (Quick Race > Split Screen). Custom Race sets the flag
+    // with 1 player; the flags' other bits (0x400: the Custom/Split menus) don't count.
+    using namespace game::split_screen;
+    CHECK(Decode(2, 4) && Decode(2, 0x404) && Decode(2, 0xFFFFFFFF), "split screen");
+    CHECK(!Decode(1, 0x404) && !Decode(2, 0x400) && !Decode(2, 0) && !Decode(0, 4) && !Decode(3, 4), "not split screen");
+    CHECK(!PlausibleObject(0) && !PlausibleObject(0x82A2C686) && !PlausibleObject(0xFFFFFFF0) && !PlausibleObject(0x7F000000),
+        "no database: 0, misaligned, past guest memory");
+    CHECK(PlausibleObject(0x40001000) && PlausibleObject(0xA0100000) && PlausibleObject(0x00020000) && PlausibleObject(0x82A30000),
+        "heap, physical and image objects");
+
+    // Single player: no other pad is a player, however it's used.
+    {
+        PlayerSlots s;
+        CHECK(!s.NoteSplit(false, 0) && !s.Changed(), "starts in single player");
+        CHECK(s.NoteInput(11, kStart, false, 1 * kMs) == 0, "a second pad pressing START in single player is no player");
+        for (int u = 1; u < PlayerSlots::kUsers; u++)
+            CHECK(!s.Connected(u), "user %d not connected", u);
+    }
+
+    // Split screen: Player 2 presses START, Player 3's pad joins too; a phantom never does.
+    {
+        PlayerSlots s;
+        int64_t t = 0;
+        CHECK(s.NoteSplit(true, t) && s.Changed(), "split screen on at once");
+        CHECK(s.NoteSplit(true, t += 16 * kMs) && !s.Changed(), "and stays on");
+        CHECK(s.NoteInput(21, 0, false, t) == 0 && s.NoteInput(22, 0, false, t) == 0, "pads at rest are nobody yet");
+        for (int i = 0; i < 600; i++)
+            s.NoteInput(23, 0, false, t + i * 16 * kMs);  // a phantom (Steam Input's, a dongle's): never any input
+        CHECK(s.NoteInput(22, kStart, false, t += 16 * kMs) == 1, "the first pad used is user 1 (player 2)");
+        CHECK(s.Connected(1) && s.PadOf(1) == 22 && s.UserOf(22) == 1, "user 1 is pad 22");
+        // Arriving: idle for kArrivalNs (the game's PLUGGED flush, then a poll at rest), then the START that made it a
+        // player held kReplayNs even if the tap was shorter (the join takes START's release), then the pad itself.
+        CHECK(s.Arriving(1, t) && s.Arriving(1, t + PlayerSlots::kArrivalNs - 1), "arriving at first");
+        CHECK(!s.Arriving(1, t + PlayerSlots::kArrivalNs), "then itself");
+        CHECK(s.Shown(1, kStart, t) == 0 && s.Shown(1, kStart, t + PlayerSlots::kArrivalNs - 1) == 0, "nothing shown while arriving");
+        CHECK(s.Shown(1, 0, t + PlayerSlots::kArrivalNs) == kStart, "a 50 ms tap, already released: START replayed");
+        CHECK(s.Shown(1, kA, t + PlayerSlots::kArrivalNs + PlayerSlots::kReplayNs - 1) == (kStart | kA), "replayed with what's down now");
+        CHECK(s.Shown(1, 0, t + PlayerSlots::kArrivalNs + PlayerSlots::kReplayNs) == 0, "then released: the press is whole");
+        CHECK(s.Shown(1, kA, t + PlayerSlots::kArrivalNs + PlayerSlots::kReplayNs) == kA, "then the pad as it is");
+        CHECK(s.Shown(2, kA, t) == kA && s.Shown(0, kA, t) == kA, "no other user is touched");
+        CHECK(s.NoteInput(22, 0, false, t += 16 * kMs) == 1, "released: still user 1");
+        CHECK(s.NoteInput(21, kStart, false, t += 16 * kMs) == 2, "another pad used: user 2");
+        CHECK(s.UserOf(23) == 0 && !s.Connected(3), "the phantom is no player");
+        CHECK(s.UserOf(99) == 0 && s.PadOf(0) == 0 && !s.Connected(0), "user 0 is player 1's, never here");
+
+        // Player 2 unplugs mid-race: user 1 reads not connected, user 2 keeps its index (the game's ports don't move).
+        CHECK(!s.Missing(1) && !s.Missing(2) && !s.Missing(0), "nobody missing while every player has a pad");
+        CHECK(s.Remove(22) == 1, "removed: it was user 1");
+        CHECK(!s.Connected(1) && s.Connected(2) && s.PadOf(2) == 21, "user 1 gone, user 2 stays");
+        CHECK(s.Missing(1) && !s.Missing(2) && !s.Missing(3), "user 1 missing (the reconnect notice), only it");
+        CHECK(s.Remove(22) == 0, "a second removal is nothing");
+        // Plugged in again (a new SDL id): nobody until used, then its old user (the lowest free).
+        CHECK(s.NoteInput(24, 0, false, t += 16 * kMs) == 0, "back, at rest: nobody yet");
+        CHECK(s.Missing(1), "plugged in but not used yet: still missing");
+        CHECK(s.NoteInput(24, kStart, false, t += 16 * kMs) == 1, "used: user 1 again");
+        CHECK(!s.Missing(1), "a pad took user 1: not missing (the notice goes)");
+        CHECK(s.Arriving(1, t), "arriving again");
+        // A fourth pad takes the last user; a fifth gets none.
+        CHECK(s.NoteInput(25, kStart, false, t) == 3 && s.NoteInput(26, kStart, false, t) == 0, "users 1-3 only");
+        CHECK(s.Remove(26) == 0, "the fifth had none");
+
+        // The game's predicate flickers between screens: nothing changes within kLeaveNs (of its last frame).
+        CHECK(s.NoteSplit(true, t) && !s.Changed(), "still split screen this frame");
+        CHECK(s.NoteSplit(false, t += 16 * kMs) && !s.Changed(), "a frame without it: still split screen");
+        t -= 16 * kMs;
+        CHECK(s.NoteSplit(false, t + PlayerSlots::kLeaveNs - 1) && s.Connected(1), "just under kLeaveNs: still");
+        CHECK(s.NoteSplit(true, t + PlayerSlots::kLeaveNs) && !s.Changed() && s.Connected(1), "back on: nothing changed");
+        t += PlayerSlots::kLeaveNs;
+        // A player's pad gone just before split screen ends: missing until then, not after.
+        CHECK(s.Remove(25) == 3 && s.Missing(3), "user 3's pad gone: missing");
+        // Leaving: every user freed, and the pads forgotten.
+        CHECK(s.NoteSplit(false, t += 16 * kMs) && !s.Changed(), "off, waiting");
+        CHECK(!s.NoteSplit(false, t + PlayerSlots::kLeaveNs) && s.Changed(), "off after kLeaveNs");
+        for (int u = 1; u < PlayerSlots::kUsers; u++)
+            CHECK(!s.Connected(u) && !s.Missing(u), "user %d freed, not missing", u);
+        CHECK(s.NoteInput(24, kStart, false, t + PlayerSlots::kLeaveNs) == 0, "single player again: no player");
+        CHECK(s.Remove(24) == 0 && !s.Missing(1), "a pad going in single player is nobody missing");
+        // A new split screen: a pad must be used again (it may be another's now).
+        t += PlayerSlots::kLeaveNs;
+        CHECK(s.NoteSplit(true, t) && s.Changed(), "split screen again");
+        CHECK(s.NoteInput(21, 0, false, t) == 0, "pad 21 at rest: nobody");
+        CHECK(s.NoteInput(24, kStart, false, t) == 1, "pad 24, used before split screen came back, is user 1 once used now");
+    }
+
+    // A trigger pressed past half makes a player too, with no button to replay.
+    {
+        PlayerSlots s;
+        s.NoteSplit(true, 0);
+        CHECK(s.NoteInput(41, 0, true, 0) == 1, "RT past half: user 1");
+        CHECK(s.Shown(1, 0, PlayerSlots::kArrivalNs) == 0, "nothing replayed");
+    }
+
+    // Used before split screen began (pressing START at "Player 2 press START" is after it began, but a pad may have
+    // been held): it becomes a player at split screen's first frame with input.
+    {
+        PlayerSlots s;
+        CHECK(s.NoteInput(31, kStart, false, 0) == 0, "used in single player: no player");
+        s.NoteSplit(true, 16 * kMs);
+        CHECK(s.NoteInput(31, 0, false, 32 * kMs) == 1, "split screen: it was used, so it's user 1");
+    }
+
+    // input.cpp: users 1-3 answer from the per-user state only, rumble per user, the menu chord kept to player 1.
+    if (argc > 1)
+    {
+        std::ifstream f(argv[1]);
+        std::stringstream ss;
+        ss << f.rdbuf();
+        const std::string src = ss.str();
+        CHECK(!src.empty(), "read %s", argv[1]);
+        auto has = [&](const char* text) { return src.find(text) != std::string::npos; };
+        CHECK(has("s_slots.NoteSplit(said, now)"), "the mode from the game's predicate");
+        CHECK(has("game::split_screen::GameSaysSplit()"), "game/split_screen.h's predicate");
+        CHECK(has("if (!split && s_others.empty())\n            return;"), "single player: nothing more");
+        CHECK(has("if (s_slots.UserOf(ids[i]) != 0)\n                continue;"), "player 1 never takes another player's pad");
+        CHECK(has("if (user && s_slots.Arriving(user, now))\n                p = Pad{};"), "arriving players read idle");
+        CHECK(has("else if (user && !blocked)\n                p.buttons = s_slots.Shown(user, p.buttons, now);"), "then their press, not under a menu");
+        CHECK(has("ou.rumbleLow = ByteSwap(vibration->wLeftMotorSpeed);"), "rumble per user");
+        CHECK(has("return s_slots.UserOf(id) != 0;"), "IsOtherPlayersPad");
+        CHECK(has("if (s_slots.Split())\n                OpenOtherPad(e.gdevice.which);"), "a pad plugged in during split screen opens");
+        // Leaving split screen: the players were forgotten before their pads closed, so every user is reset explicitly
+        // (v018 build 262 left XInput user 1 connected, frozen, after split screen).
+        CHECK(has("CloseOtherPads(\"closed: split screen is over\");\n                {"), "users reset when split screen ends");
+        CHECK(has("s_users[u].connected = false;"), "each user read not connected");
+        CHECK(has("if (s_slots.Missing(u))\n                wanted |= 1u << u;"), "a missing player's notice");
+        CHECK(has("ui::Toast(text, 24.0 * 3600.0);") && has("ui::WithdrawToast(text);"), "shown until withdrawn");
+    }
+    else
+    {
+        printf("  (no input.cpp given: its use not checked)\n");
+    }
+
+    if (g_failures)
+    {
+        printf("player_slots_test: %d FAILED\n", g_failures);
+        return 1;
+    }
+    printf("player_slots_test: all passed\n");
+    return 0;
+}
diff --git a/tests/refresh_notice_test.cpp b/tests/refresh_notice_test.cpp
index 79480c5..ca599d2 100644
--- a/tests/refresh_notice_test.cpp
+++ b/tests/refresh_notice_test.cpp
@@ -121,6 +121,9 @@ namespace
             { "90 Hz, dismissed before", with(Ready(90, Platform::GameMode), [](auto& i) { i.shownBefore = true; }), Verdict::Never },
             { "90 Hz, NFSMW_REFRESH_NOTICE=0", with(Ready(90, Platform::GameMode), [](auto& i) { i.forced = 0; }), Verdict::Never },
             { "90 Hz, dismissed, NFSMW_REFRESH_NOTICE=1", with(Ready(90, Platform::GameMode), [](auto& i) { i.shownBefore = true; i.forced = 1; }), Verdict::Show },
+            // HFR (NFSMW_HFR=1) draws a picture for each refresh of the grid.
+            { "90 Hz, HFR draws a picture each refresh", with(Ready(90, Platform::GameMode), [](auto& i) { i.hfrHandles = true; }), Verdict::Never },
+            { "144 Hz, HFR, NFSMW_REFRESH_NOTICE=1", with(Ready(144, Platform::Desktop), [](auto& i) { i.hfrHandles = true; i.forced = 1; }), Verdict::Show },
             // The moment.
             { "the mode just changed", with(Ready(144, Platform::Desktop), [](auto& i) { i.modeStableSec = 1; }), Verdict::Wait },
             { "the grid just fitted", with(Ready(144, Platform::Desktop), [](auto& i) { i.gridStableSec = 2; }), Verdict::Wait },
diff --git a/tests/settings_keys_test.cpp b/tests/settings_keys_test.cpp
index 1964d2a..8b06078 100644
--- a/tests/settings_keys_test.cpp
+++ b/tests/settings_keys_test.cpp
@@ -93,7 +93,9 @@ int main()
         { Id::KeyLeftStickClick, "left_stick_click", "Left Stick Click", "z", "none" },
         { Id::KeyRightStickClick, "right_stick_click", "Right Stick Click", "c", "none" },
     };
-    size_t previous = size_t(Id::Vibration);
+    // The keys run from the end of the Wheel options (Input's own rows, then
+    // the wheel's, come before them) to the start of Advanced, unbroken.
+    size_t previous = size_t(Id::WheelSettingsVersion);
     for (const Default& d : defaults)
     {
         const Option& o = Info(d.id);
diff --git a/tests/split_views_test.cpp b/tests/split_views_test.cpp
new file mode 100644
index 0000000..5036f8c
--- /dev/null
+++ b/tests/split_views_test.cpp
@@ -0,0 +1,132 @@
+// Tests for gpu/split_views.h: split screen's two views in one untiled target. Each view's draws are cut to its own
+// guest rows, the cuts' host rectangles at every internal resolution (1x, 1.5x, 2x, 3x, and Vert+'s taller y scale on
+// screens narrower than 16:9, e.g. the MacBook Pro's 3024x1898) meet exactly, no host pixel belongs to both, and their
+// union is the frame; the split-screen rules against the old fallback; renderer.cpp is read (argv[1]) to check it
+// applies them. Header only; from the repo root:
+//   clang++ -std=c++20 -O2 -Iruntime tests/split_views_test.cpp -o build/split_views_test &&
+//   build/split_views_test runtime/gpu/renderer.cpp
+#include <gpu/render_scale.h>
+#include <gpu/split_views.h>
+
+#include <cstdio>
+#include <fstream>
+#include <sstream>
+#include <string>
+
+static int g_failures = 0;
+#define CHECK(cond, ...) do { if (!(cond)) { g_failures++; printf("  FAIL %s:%d: %s: ", __FILE__, __LINE__, #cond); printf(__VA_ARGS__); printf("\n"); } } while (0)
+
+using namespace gpu::split_views;
+
+// renderer.cpp's HostRect: guest edges to host edges (a negative edge is 0).
+struct HostSpan { int32_t lo, hi; };
+static HostSpan Host(const gpu::AxisScale& a, int32_t g0, int32_t g1)
+{
+    return { a.EdgeAt(g0), a.EdgeAt(g1) };
+}
+
+// The guest row (or column) whose pixel a host pixel samples for (render_scale.h's owner).
+static uint32_t Owner(const gpu::AxisScale& a, uint32_t h)
+{
+    return gpu::ScaleGlsl{}.sbOwner(h, a.num, a.den);
+}
+
+int main(int argc, char** argv)
+{
+    // The registers the game sets for split screen at 1280x720 (v018 split-screen scoping, NFSMW_LOG_TILES run B3):
+    // x 640 +- 640, player 1 y 180 +- 180, player 2 y 540 +- 180 (YSCALE negative: flipped), window offset 0 (tile 0).
+    for (bool d3d : { true, false })
+    {
+        GuestRect p1 = ViewportPixels(640.0f, 640.0f, 180.0f, 180.0f, 0.0f, 0.0f, d3d, 1280, 720);
+        GuestRect p2 = ViewportPixels(640.0f, 640.0f, 180.0f, 540.0f, 0.0f, 0.0f, d3d, 1280, 720);
+        CHECK(p1.x0 == 0 && p1.y0 == 0 && p1.x1 == 1280 && p1.y1 == 360, "d3d %d: player 1 (%d,%d)-(%d,%d)", d3d, p1.x0, p1.y0, p1.x1, p1.y1);
+        CHECK(p2.x0 == 0 && p2.y0 == 360 && p2.x1 == 1280 && p2.y1 == 720, "d3d %d: player 2 (%d,%d)-(%d,%d)", d3d, p2.x0, p2.y0, p2.x1, p2.y1);
+        // A later tile's window offset (-256 rows) moves the cut with the view (those draws are skipped untiled, but
+        // the rule is the host viewport's).
+        GuestRect t1 = ViewportPixels(640.0f, 640.0f, 180.0f, 540.0f, 0.0f, -256.0f, d3d, 1280, 720);
+        CHECK(t1.y0 == 104 && t1.y1 == 464, "d3d %d: tile 1 (%d,%d)", d3d, t1.y0, t1.y1);
+    }
+    // Clamped to the target (a guard band past it), and a viewport off the target cuts to nothing.
+    {
+        GuestRect big = ViewportPixels(700.0f, 640.0f, 400.0f, 360.0f, 0.0f, 0.0f, true, 1280, 720);
+        CHECK(big.x0 == 0 && big.y0 == 0 && big.x1 == 1280 && big.y1 == 720, "clamped (%d,%d)-(%d,%d)", big.x0, big.y0, big.x1, big.y1);
+        GuestRect off = ViewportPixels(100.0f, 2000.0f, 100.0f, 360.0f, 0.0f, 0.0f, true, 1280, 720);
+        CHECK(off.x0 == off.x1, "off the target: %d..%d", off.x0, off.x1);
+    }
+
+    // The two cuts' host rectangles at each scale: x by y, num/den (den 1 or 2, render_scale.h). Vert+ on a screen
+    // taller than 16:9 renders more host rows per guest row (AutoRenderScale scales y for narrow regions).
+    const gpu::AxisScale scales[][2] = {
+        { { 1, 1 }, { 1, 1 } }, { { 3, 2 }, { 3, 2 } }, { { 2, 1 }, { 2, 1 } }, { { 3, 1 }, { 3, 1 } },
+        { { 3, 2 }, { 2, 1 } }, { { 2, 1 }, { 3, 1 } }, { { 1, 1 }, { 3, 2 } }, { { 2, 1 }, { 5, 2 } },
+    };
+    int cases = 0;
+    for (auto& s : scales)
+    {
+        const gpu::AxisScale& sx = s[0];
+        const gpu::AxisScale& sy = s[1];
+        const HostSpan x = Host(sx, 0, 1280), y1 = Host(sy, 0, 360), y2 = Host(sy, 360, 720);
+        CHECK(x.lo == 0 && uint32_t(x.hi) == sx.Size(1280), "%u/%u: x %d..%d", sx.num, sx.den, x.lo, x.hi);
+        // They meet: player 1's last host row is right above player 2's first.
+        CHECK(y1.hi == y2.lo, "%u/%u: player 1 ends at host row %d, player 2 starts at %d", sy.num, sy.den, y1.hi, y2.lo);
+        // Together, the frame: the target's host rows (a 720-row target is ceil(720 num / den) host rows).
+        CHECK(y1.lo == 0 && uint32_t(y2.hi) == sy.Size(720), "%u/%u: rows %d..%d of %u", sy.num, sy.den, y1.lo, y2.hi, sy.Size(720));
+        // No host row of player 2's cut samples one of player 1's guest rows, nor the other way round.
+        bool own = true;
+        for (int32_t h = y1.lo; h < y1.hi; h++)
+            own = own && Owner(sy, uint32_t(h)) < 360;
+        for (int32_t h = y2.lo; h < y2.hi; h++)
+            own = own && Owner(sy, uint32_t(h)) >= 360;
+        CHECK(own, "%u/%u: a host row on the wrong side of the split", sy.num, sy.den);
+        // Each half is half the frame, to a host row (1.5x: 540 + 540; 2.5x: 900 + 900).
+        CHECK(y1.hi - y1.lo == y2.hi - y2.lo, "%u/%u: halves %d and %d host rows", sy.num, sy.den, y1.hi - y1.lo, y2.hi - y2.lo);
+        cases++;
+    }
+    CHECK(cases == 8, "%d scale cases", cases);
+
+    // The rules: outside split screen the old ones (NFSMW_UNTILED_AREA alone cuts; a fallback holds and is taken);
+    // in split screen every untiled draw is cut and no fallback is taken or held, on every platform.
+    CHECK(!CutOn(false, false) && CutOn(true, false), "outside split screen: as NFSMW_UNTILED_AREA says");
+    CHECK(CutOn(false, true) && CutOn(true, true), "split screen cuts where NFSMW_UNTILED_AREA is off (Linux, Windows) too");
+    CHECK(KeepsWholeArea(true, false) && !KeepsWholeArea(false, false), "outside split screen a fallback holds");
+    CHECK(!KeepsWholeArea(true, true), "split screen: an earlier fallback doesn't hold");
+    CHECK(FallsBack(false) && !FallsBack(true), "split screen restarts the pass instead of falling back");
+
+    // renderer.cpp applies them: UntiledScissor's cut and its math, the uncovered draw, both other fallbacks.
+    if (argc > 1)
+    {
+        std::ifstream f(argv[1]);
+        std::stringstream ss;
+        ss << f.rdbuf();
+        const std::string src = ss.str();
+        CHECK(!src.empty(), "read %s", argv[1]);
+        auto has = [&](const char* text) { return src.find(text) != std::string::npos; };
+        auto count = [&](const char* text) {
+            int n = 0;
+            for (size_t at = src.find(text); at != std::string::npos; at = src.find(text, at + 1))
+                n++;
+            return n;
+        };
+        CHECK(has("gpu::split_views::CutOn(UntiledAreaOn(), split)"), "UntiledScissor cuts in split screen");
+        CHECK(has("gpu::split_views::KeepsWholeArea(rt->wholeArea, split)"), "UntiledScissor's fallback rule");
+        CHECK(has("gpu::split_views::ViewportPixels(ax, ox, ay, oy, wx, wy, d3dCenter, w, h)"), "UntiledScissor's math is this header's");
+        CHECK(!has("auto edge = [](float v, int32_t hi)"), "no second copy of the edge rule in renderer.cpp");
+        CHECK(has("!Contains(s_passArea, HostRect(scale, x0, y0, x1, y1)) && !gpu::split_views::FallsBack(SplitFrame()))"),
+            "Draw: the uncovered cut draw restarts its pass in split screen");
+        CHECK(count("gpu::split_views::FallsBack(SplitFrame())") == 3, "the uncovered draw, the inexact union and the resolve past "
+            "the cuts each ask (%d)", count("gpu::split_views::FallsBack(SplitFrame())"));
+        CHECK(has("game::split_screen::GameSaysSplit()"), "the game's own predicate decides");
+    }
+    else
+    {
+        printf("  (no renderer.cpp given: its use not checked)\n");
+    }
+
+    if (g_failures)
+    {
+        printf("split_views_test: %d FAILED\n", g_failures);
+        return 1;
+    }
+    printf("split_views_test: all passed\n");
+    return 0;
+}
diff --git a/tests/vmem_host_pages_test.cpp b/tests/vmem_host_pages_test.cpp
new file mode 100644
index 0000000..371f6c7
--- /dev/null
+++ b/tests/vmem_host_pages_test.cpp
@@ -0,0 +1,297 @@
+// Tests for returning released or decommitted guest pages to zero
+// (runtime/kernel/vmem.cpp, PageHeap::ResetHostPages and ResetHostRange) on
+// hosts whose pages are larger than the heap's: 16 KB on every Apple-silicon
+// Mac, iPhone and iPad (and 16 KB Android), 64 KB on some Linux kernels,
+// against the 4 KB-page heaps (Virtual4K, the kernel pool). mmap(MAP_FIXED)
+// rounds its length up to whole host pages, so remapping a range that ends
+// inside a host page zeroes the guest pages after it, another allocation's.
+// Only the whole host pages inside the range may be remapped; the head and
+// tail are cleared in place.
+//
+// Runs on any host: the heaps' host page size is injected (the host's own,
+// 16 KB and 64 KB where they are a multiple of it), and each runs once with the
+// real mmap and once with a model of a kernel at that page size (it records
+// every remap, refuses an unaligned one as the kernel does, and rounds the
+// length up and zeroes it as the kernel does). From the repo root:
+//   clang++ -std=c++20 -O2 -pthread -Iruntime -Iruntime/kernel -Iruntime/thirdparty/o1heap -Ippc
+//     -Itools/XenonRecomp/XenonUtils -Itools/XenonRecomp/thirdparty/simde tests/vmem_host_pages_test.cpp
+//     runtime/kernel/vmem.cpp -o build/vmem_host_pages_test
+//   build/vmem_host_pages_test
+// Under a second.
+#include <stdafx.h>
+#include <kernel/vmem.h>
+
+#include <cstdio>
+#include <cstdlib>
+#include <sys/mman.h>
+#include <unistd.h>
+#include <vector>
+
+// What vmem.cpp needs of the runtime's memory: the base (memory.cpp is not
+// linked).
+Memory::Memory() {}
+Memory g_memory;
+
+static int g_failures = 0;
+#define CHECK(cond, ...) do { if (!(cond)) { g_failures++; printf("  FAIL %s:%d: %s: ", __FILE__, __LINE__, #cond); printf(__VA_ARGS__); printf("\n"); } } while (0)
+
+using namespace vmem;
+
+constexpr uint32_t kGuestPage = 0x1000;
+
+// The model kernel: page size s_modelPage, every call recorded.
+struct RemapCall { uintptr_t host; size_t bytes; };
+static size_t s_modelPage = 0;
+static std::vector<RemapCall> s_calls;
+static bool s_failRemap = false;  // the remap fails (ResetHostRange must clear in place)
+
+static bool ModelRemap(void* host, size_t bytes)
+{
+    s_calls.push_back({ uintptr_t(host), bytes });
+    if (s_failRemap || uintptr_t(host) % s_modelPage != 0)
+        return false;  // EINVAL: MAP_FIXED needs a page-aligned address
+    size_t rounded = (bytes + s_modelPage - 1) / s_modelPage * s_modelPage;
+    memset(host, 0, rounded);  // what the kernel's fresh zero pages amount to, whole pages
+    return true;
+}
+
+static bool RealRemap(void* host, size_t bytes)
+{
+    s_calls.push_back({ uintptr_t(host), bytes });
+    if (s_failRemap)
+        return false;
+    return RemapAnon(host, bytes);
+}
+
+static uint8_t* Host(uint32_t guest) { return static_cast<uint8_t*>(g_memory.Translate(guest)); }
+
+static void Fill(uint32_t guest, uint32_t bytes, uint8_t seed)
+{
+    for (uint32_t i = 0; i < bytes; i++)
+        Host(guest)[i] = uint8_t(seed + i * 7 + (i >> 12)) | 1;  // never 0
+}
+
+// The first offset whose byte isn't Fill's, or -1.
+static int64_t Differs(uint32_t guest, uint32_t bytes, uint8_t seed)
+{
+    for (uint32_t i = 0; i < bytes; i++)
+        if (Host(guest)[i] != (uint8_t(seed + i * 7 + (i >> 12)) | 1))
+            return i;
+    return -1;
+}
+
+static int64_t NonZero(uint32_t guest, uint32_t bytes)
+{
+    for (uint32_t i = 0; i < bytes; i++)
+        if (Host(guest)[i] != 0)
+            return i;
+    return -1;
+}
+
+// Every remap covered only whole host pages, and only inside [lo, hi).
+static void CheckCalls(const char* what, size_t hostPage, uint32_t lo, uint32_t hi)
+{
+    for (const RemapCall& c : s_calls)
+    {
+        CHECK(c.host % hostPage == 0 && c.bytes % hostPage == 0 && c.bytes != 0,
+            "%s: remap at host +%zx of %zx bytes isn't whole %zu KB host pages", what,
+            size_t(c.host - uintptr_t(g_memory.base)), c.bytes, hostPage / 1024);
+        CHECK(c.host >= uintptr_t(Host(lo)) && c.host + c.bytes <= uintptr_t(Host(hi)),
+            "%s: remap %zx+%zx outside the range %08X..%08X", what, size_t(c.host - uintptr_t(g_memory.base)),
+            c.bytes, lo, hi);
+    }
+}
+
+// One heap of 4 KB guest pages at a base aligned to every host page size
+// tried, with `hostPage` injected.
+static void RunHeap(size_t hostPage, RemapFn remap, const char* how)
+{
+    printf("host pages %zu KB, %s\n", hostPage / 1024, how);
+    constexpr uint32_t kBase = 0x00100000, kSize = 0x01000000;
+    const uint32_t hp = uint32_t(hostPage / kGuestPage);  // guest pages a host page
+
+    // 1. The reported case. A: one guest page at the start of a host page;
+    // B: the next allocation, adjacent, the rest of that host page and beyond.
+    // Releasing A must leave B intact.
+    {
+        PageHeap heap(kBase, kSize, kGuestPage);
+        heap.SetHostPagesForTest(hostPage, remap);
+        uint32_t a = heap.Alloc(kGuestPage, kGuestPage, X_MEM_RESERVE | X_MEM_COMMIT, 4, false);
+        uint32_t b = heap.Alloc((hp + 2) * kGuestPage, kGuestPage, X_MEM_RESERVE | X_MEM_COMMIT, 4, false);
+        CHECK(a == kBase && b == kBase + kGuestPage, "allocations at %08X, %08X", a, b);
+        Fill(a, kGuestPage, 0x11);
+        Fill(b, (hp + 2) * kGuestPage, 0x5A);
+        s_calls.clear();
+        uint32_t released = 0;
+        CHECK(heap.Release(a, &released) && released == kGuestPage, "release A: %X", released);
+        int64_t d = Differs(b, (hp + 2) * kGuestPage, 0x5A);
+        CHECK(d < 0, "release A (one 4 KB page): B, the next allocation, changed at +%llX (the remap zeroed it)",
+            (long long)d);
+        CHECK(NonZero(a, kGuestPage) < 0, "release A: A not zero at +%llX", (long long)NonZero(a, kGuestPage));
+        CheckCalls("release A", hostPage, a, a + kGuestPage);
+        if (hp > 1)
+            CHECK(s_calls.empty(), "release A: %zu remap(s) of a range smaller than a host page", s_calls.size());
+
+        // A new allocation in A's place is zero (and B still intact).
+        uint32_t a2 = heap.Alloc(kGuestPage, kGuestPage, X_MEM_RESERVE | X_MEM_COMMIT, 4, false);
+        CHECK(a2 == a && NonZero(a2, kGuestPage) < 0, "A again at %08X, not zero", a2);
+    }
+
+    // 2. Decommit the head of an allocation (aligned start, a length that
+    // isn't whole host pages): the rest of it stays committed and intact.
+    {
+        PageHeap heap(kBase, kSize, kGuestPage);
+        heap.SetHostPagesForTest(hostPage, remap);
+        uint32_t pages = 3 * hp + 3;
+        uint32_t c = heap.Alloc(pages * kGuestPage, kGuestPage, X_MEM_RESERVE | X_MEM_COMMIT, 4, false);
+        Fill(c, pages * kGuestPage, 0x23);
+        for (uint32_t n : { 1u, hp > 1 ? hp - 1 : 1u, hp + 1 })
+        {
+            Fill(c, pages * kGuestPage, 0x23);
+            s_calls.clear();
+            CHECK(heap.Decommit(c, n * kGuestPage), "decommit %u pages", n);
+            int64_t d = -1;  // Fill's pattern depends on the offset: compare at the original offsets
+            for (uint32_t i = n * kGuestPage; i < pages * kGuestPage && d < 0; i++)
+                if (Host(c)[i] != (uint8_t(0x23 + i * 7 + (i >> 12)) | 1))
+                    d = i;
+            CHECK(d < 0, "decommit the first %u page(s): the committed rest changed at +%llX", n, (long long)d);
+            CHECK(NonZero(c, n * kGuestPage) < 0, "decommit %u: not zero", n);
+            CheckCalls("decommit", hostPage, c, c + n * kGuestPage);
+            CHECK(heap.AllocFixed(c, n * kGuestPage, X_MEM_COMMIT, 4, nullptr), "recommit %u", n);
+        }
+    }
+
+    // 3. A range starting and ending inside host pages around whole ones:
+    // E | F (whole host pages inside, head and tail partial) | G. The whole
+    // pages are remapped (lazily zero, as before), the edges cleared in
+    // place, E and G intact.
+    {
+        PageHeap heap(kBase, kSize, kGuestPage);
+        heap.SetHostPagesForTest(hostPage, remap);
+        uint32_t fPages = hp > 1 ? 3 * hp - 2 : 1;  // from guest page 1 to the 3rd host page's last but one
+        uint32_t e = heap.Alloc(kGuestPage, kGuestPage, X_MEM_RESERVE | X_MEM_COMMIT, 4, false);
+        uint32_t f = heap.Alloc(fPages * kGuestPage, kGuestPage, X_MEM_RESERVE | X_MEM_COMMIT, 4, false);
+        uint32_t g = heap.Alloc(2 * hp * kGuestPage, kGuestPage, X_MEM_RESERVE | X_MEM_COMMIT, 4, false);
+        Fill(e, kGuestPage, 0x31);
+        Fill(f, fPages * kGuestPage, 0x47);
+        Fill(g, 2 * hp * kGuestPage, 0x69);
+        s_calls.clear();
+        CHECK(heap.Release(f, nullptr), "release F");
+        CHECK(Differs(e, kGuestPage, 0x31) < 0, "release F: E (before it) changed");
+        int64_t d = Differs(g, 2 * hp * kGuestPage, 0x69);
+        CHECK(d < 0, "release F: G (after it) changed at +%llX", (long long)d);
+        CHECK(NonZero(f, fPages * kGuestPage) < 0, "release F: F not zero at +%llX", (long long)NonZero(f, fPages * kGuestPage));
+        CheckCalls("release F", hostPage, f, f + fPages * kGuestPage);
+        if (hp > 1)
+        {
+            // F covers host pages 0 (from guest page 1), 1 (whole), 2 (all but its last guest page).
+            bool one = s_calls.size() == 1 && s_calls[0].host == uintptr_t(Host(kBase)) + hostPage
+                && s_calls[0].bytes == hostPage;
+            CHECK(one, "release F: expected one remap of the whole host page inside it, got %zu", s_calls.size());
+        }
+    }
+
+    // 4. A large release (many host pages, both ends partial) between two
+    // live allocations, then the remap failing: cleared in place.
+    for (bool fail : { false, true })
+    {
+        PageHeap heap(kBase, kSize, kGuestPage);
+        heap.SetHostPagesForTest(hostPage, remap);
+        uint32_t big = 64 * hp + 2;
+        uint32_t p = heap.Alloc(3 * kGuestPage, kGuestPage, X_MEM_RESERVE | X_MEM_COMMIT, 4, false);
+        uint32_t q = heap.Alloc(big * kGuestPage, kGuestPage, X_MEM_RESERVE | X_MEM_COMMIT, 4, false);
+        uint32_t r = heap.Alloc(5 * kGuestPage, kGuestPage, X_MEM_RESERVE | X_MEM_COMMIT, 4, false);
+        Fill(p, 3 * kGuestPage, 0x13);
+        Fill(q, big * kGuestPage, 0x77);
+        Fill(r, 5 * kGuestPage, 0x29);
+        s_calls.clear();
+        s_failRemap = fail;
+        CHECK(heap.Release(q, nullptr), "release Q");
+        s_failRemap = false;
+        CHECK(Differs(p, 3 * kGuestPage, 0x13) < 0, "release Q%s: P changed", fail ? " (remap failing)" : "");
+        CHECK(Differs(r, 5 * kGuestPage, 0x29) < 0, "release Q%s: R changed at +%llX", fail ? " (remap failing)" : "",
+            (long long)Differs(r, 5 * kGuestPage, 0x29));
+        CHECK(NonZero(q, big * kGuestPage) < 0, "release Q%s: Q not zero at +%llX", fail ? " (remap failing)" : "",
+            (long long)NonZero(q, big * kGuestPage));
+        CheckCalls("release Q", hostPage, q, q + big * kGuestPage);
+        CHECK(s_calls.size() == 1, "release Q: %zu remaps, expected 1 (the whole host pages inside)", s_calls.size());
+    }
+
+    // 5. Physical memory (0xA0000000 up, mirrored at three windows) is never
+    // remapped: cleared in place.
+    {
+        PageHeap heap(0xA0000000, kSize, kGuestPage);
+        heap.SetHostPagesForTest(hostPage, remap);
+        uint32_t x = heap.Alloc(8 * hp * kGuestPage, kGuestPage, X_MEM_RESERVE | X_MEM_COMMIT, 4, false);
+        uint32_t y = heap.Alloc(kGuestPage, kGuestPage, X_MEM_RESERVE | X_MEM_COMMIT, 4, false);
+        Fill(x, 8 * hp * kGuestPage, 0x3C);
+        Fill(y, kGuestPage, 0x4D);
+        s_calls.clear();
+        CHECK(heap.Release(x, nullptr), "release physical X");
+        CHECK(s_calls.empty(), "physical: %zu remap(s)", s_calls.size());
+        CHECK(NonZero(x, 8 * hp * kGuestPage) < 0, "physical X not zero");
+        CHECK(Differs(y, kGuestPage, 0x4D) < 0, "physical Y changed");
+    }
+}
+
+// ResetHostRange on its own: every split of a range of whole and partial host
+// pages remaps exactly the whole ones.
+static void RunSplits(size_t hostPage)
+{
+    uint8_t* area = Host(0x02000000);
+    const size_t span = 4 * hostPage;
+    for (size_t start = 0; start <= 2 * hostPage; start += kGuestPage)
+        for (size_t bytes = kGuestPage; start + bytes <= span; bytes += kGuestPage)
+        {
+            memset(area, 0xEE, span);
+            s_calls.clear();
+            ResetHostRange(area + start, bytes, hostPage, ModelRemap);
+            size_t lo = (start + hostPage - 1) / hostPage * hostPage, hi = (start + bytes) / hostPage * hostPage;
+            bool ok = true;
+            for (size_t i = 0; i < span && ok; i++)
+                ok = area[i] == ((i >= start && i < start + bytes) ? 0 : 0xEE);
+            bool calls = lo < hi ? s_calls.size() == 1 && s_calls[0].host == uintptr_t(area + lo) && s_calls[0].bytes == hi - lo
+                                 : s_calls.empty();
+            CHECK(ok && calls, "ResetHostRange(+%zx, %zx) on %zu KB pages: bytes %s, %zu remap(s)", start, bytes,
+                hostPage / 1024, ok ? "right" : "WRONG", s_calls.size());
+        }
+}
+
+int main()
+{
+    size_t real = size_t(sysconf(_SC_PAGESIZE));
+    // The guest's 4 GB, as memory.cpp reserves it, aligned to 64 KB.
+    size_t reserve = size_t(PPC_MEMORY_SIZE) + 0x10000;
+    void* reserved = mmap(nullptr, reserve, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON | MAP_NORESERVE, -1, 0);
+    if (reserved == MAP_FAILED)
+    {
+        perror("reserve guest memory");
+        return 1;
+    }
+    g_memory.base = reinterpret_cast<uint8_t*>((uintptr_t(reserved) + 0xFFFF) & ~uintptr_t(0xFFFF));
+    printf("this host's pages: %zu KB\n", real / 1024);
+
+    std::vector<size_t> sizes = { real };
+    for (size_t s : { size_t(0x4000), size_t(0x10000) })
+        if (s > real && s % real == 0)
+            sizes.push_back(s);
+    for (size_t hostPage : sizes)
+    {
+        s_modelPage = hostPage;
+        RunHeap(hostPage, ModelRemap, "a model kernel");
+        RunHeap(hostPage, RealRemap, "the real mmap");
+        RunSplits(hostPage);
+    }
+    // The heaps' own default: this host's page size and the real mmap.
+    {
+        PageHeap heap(0x00100000, 0x00100000, kGuestPage);
+        uint32_t a = heap.Alloc(kGuestPage, kGuestPage, X_MEM_RESERVE | X_MEM_COMMIT, 4, false);
+        uint32_t b = heap.Alloc(4 * kGuestPage, kGuestPage, X_MEM_RESERVE | X_MEM_COMMIT, 4, false);
+        Fill(b, 4 * kGuestPage, 0x5A);
+        heap.Release(a, nullptr);
+        CHECK(Differs(b, 4 * kGuestPage, 0x5A) < 0, "default heap: B changed after releasing A");
+    }
+
+    printf(g_failures ? "%d failure(s)\n" : "all passed\n", g_failures);
+    return g_failures ? 1 : 0;
+}
diff --git a/tests/wheel_map_test.cpp b/tests/wheel_map_test.cpp
new file mode 100644
index 0000000..8a4efc5
--- /dev/null
+++ b/tests/wheel_map_test.cpp
@@ -0,0 +1,880 @@
+// Tests for hid/wheel_map.h: a USB steering wheel as the Xbox 360 pad. Which joystick is a wheel,
+// which of its axes is the wheel and which are its pedals, the steering curve (range, deadzone and
+// response), a pedal from where it rests to as far as it is pressed, the buttons and the paddles,
+// NFSMW_WHEEL_BUTTONS, and the force-feedback levels. Header only; from the repo root:
+//   clang++ -std=c++20 -O2 -Iruntime tests/wheel_map_test.cpp -o build/wheel_map_test && build/wheel_map_test
+#include <hid/wheel_map.h>
+
+#include <array>
+#include <cmath>
+#include <cstdio>
+#include <initializer_list>
+#include <iterator>
+#include <random>
+#include <set>
+#include <string>
+#include <vector>
+
+static int g_failures = 0;
+#define CHECK(cond, ...) do { if (!(cond)) { g_failures++; printf("  FAIL %s:%d: %s: ", __FILE__, __LINE__, #cond); printf(__VA_ARGS__); printf("\n"); } } while (0)
+
+using namespace hid::wheelmap;
+
+// Steer works on the turn as a fraction of full lock; these cases are
+// written as raw axis readings, as the device gives them.
+static float SteerRaw(int16_t raw, int range, int full, float deadzone, float response)
+{
+    return Steer(float(raw) / float(kAxisMax), range, full, deadzone, response);
+}
+
+static bool Near(float a, float b, float slack = 0.001f)
+{
+    return std::fabs(a - b) <= slack;
+}
+
+// A G29's axes as they rest, measured on the hardware: the wheel centred on
+// axis 0, and its three pedals held at +32767 by their springs.
+static constexpr int16_t kG29Rest[] = { 0, 32767, 32767, 32767 };
+
+// Resolve takes a contiguous run of bools (std::vector<bool> is not one).
+template <size_t N>
+static std::array<bool, N> Held(std::initializer_list<int> which)
+{
+    std::array<bool, N> held{};
+    for (int b : which)
+        if (b >= 0 && size_t(b) < N)
+            held[size_t(b)] = true;
+    return held;
+}
+
+
+// Settings > Wheel > Calibrate, frame by frame: a wheel's axes, buttons and hat as SDL reads them, fed to the
+// Calibration as wheel.cpp feeds it. A G29 by default: the wheel on axis 0, the clutch 1, the throttle 2, the brake 3,
+// pedals resting at +32767; Cross (0) is A and Circle (2) is B.
+struct Rig
+{
+    Calibration cal;
+    std::vector<int16_t> axes{ 0, 32767, 32767, 32767 };
+    std::vector<bool> seen = std::vector<bool>(4, true);
+    std::array<bool, 25> buttons{};
+    uint8_t hat = hat::Centred;
+    int a = 0, b = 2;
+    Calibration::Event last = Calibration::Event::None;
+
+    void Start(int steerAxis = 0) { cal.Start(axes, seen, buttons, hat, steerAxis); }
+    Calibration::Event Frame()
+    {
+        last = cal.Update(axes, seen, buttons, hat, a, b);
+        return last;
+    }
+    // An axis moved to `to` over a few frames (each one a frame the calibration sees).
+    Calibration::Event Move(int axis, int to, int frames = 6)
+    {
+        const int from = axes[size_t(axis)];
+        Calibration::Event e = Calibration::Event::None;
+        for (int f = 1; f <= frames && e == Calibration::Event::None; f++)
+        {
+            axes[size_t(axis)] = int16_t(from + (to - from) * f / frames);
+            e = Frame();
+        }
+        return e;
+    }
+    Calibration::Event Down(int button) { buttons[size_t(button)] = true; return Frame(); }
+    Calibration::Event Up(int button) { buttons[size_t(button)] = false; return Frame(); }
+    Calibration::Event Tap(int button) { const auto e = Down(button); const auto f = Up(button); return e != Calibration::Event::None ? e : f; }
+    Calibration::Event Hat(uint8_t bits) { hat = bits; const auto e = Frame(); hat = hat::Centred; Frame(); return e; }
+};
+
+int main()
+{
+    // The table: one fallback, last, and every other model a wheel we name,
+    // with its own USB ids, an axis to steer with and buttons.
+    CHECK(kModelCount >= 2, "%zu models", kModelCount);
+    std::set<uint32_t> ids;
+    for (size_t i = 0; i < kModelCount; i++)
+    {
+        const Model& m = kModels[i];
+        const bool last = i == kModelCount - 1;
+        CHECK((m.vendor == 0 && m.product == 0) == last, "model %zu: only the last is the fallback", i);
+        CHECK(m.name != nullptr && m.axes.steer >= 0 && !m.buttons.empty(), "model %zu: named, steers, has buttons", i);
+        // Where its pedals rest: an end of the axis, or 0 for not known.
+        CHECK((m.pedalRest != m.pedalFull) == (m.vendor != 0),
+            "model %zu: the wheels we know give both ends of their pedals, the fallback neither", i);
+        if (m.pedalRest != m.pedalFull)
+            CHECK((m.pedalRest > 0) != (m.pedalFull > 0), "model %zu: its pedals run from one end of the axis to the other", i);
+        CHECK(m.fullTurnDegrees >= 0 && m.fullTurnDegrees <= 1080, "model %zu: %d degrees", i, m.fullTurnDegrees);
+        if (!last)
+            CHECK(ids.insert(uint32_t(m.vendor) << 16 | m.product).second, "model %zu: its own USB ids", i);
+        // A pedal is never the wheel's own axis, and no two roles share one.
+        const int axes[] = { m.axes.steer, m.axes.throttle, m.axes.brake, m.axes.clutch };
+        for (size_t a = 0; a < 4; a++)
+            for (size_t b = a + 1; b < 4; b++)
+                CHECK(axes[a] < 0 || axes[a] != axes[b], "model %zu: axis %d is one role", i, axes[a]);
+    }
+    // The G29 is the wheel this was written for, and the one its numbers
+    // were measured on: the wheel is axis 0, the pedals are throttle 2,
+    // brake 3 and clutch 1 (not the order they stand in), they rest at
+    // +32767, it turns 900 degrees, and its buttons are the Logitech set.
+    for (uint16_t product : { 0xC24F, 0xC260 })
+    {
+        const Model& g29 = ModelFor(0x046D, product);
+        CHECK(g29.vendor == 0x046D && g29.product == product, "the G29 (%04x) is known", product);
+        CHECK(g29.axes.steer == 0 && g29.axes.throttle == 2 && g29.axes.brake == 3 && g29.axes.clutch == 1,
+            "the G29's measured axes (%d, %d, %d, %d)", g29.axes.steer, g29.axes.throttle, g29.axes.brake, g29.axes.clutch);
+        CHECK(g29.pedalRest == kAxisMax && g29.pedalFull == -32768, "the G29's pedals run +32767 to -32768");
+        CHECK(g29.fullTurnDegrees == 900, "the G29 turns 900 degrees");
+        CHECK(g29.buttons.data() == kLogitechButtons, "the G29 has the Logitech buttons");
+    }
+    // The models SDL 3.4.16's own Logitech driver reads (SDL_hidapi_lg4ff.c: HandleState sends the wheel as
+    // axis 0 and each pedal byte, 255 resting, as byte * 257 - 32768 on the axis numbers below; OpenJoystick
+    // gives the G29, G27 and G25 four axes and the Driving Force GT and Pro three). On a Mac this is the
+    // layout these wheels arrive in, so a model has to match it: before any axis reports, its axes are used as
+    // they are, and Detect only keeps them if they rest where pedals do.
+    struct SdlLayout { uint16_t product; int axes, gas, brake, clutch; };
+    for (const SdlLayout& d : { SdlLayout{ 0xC24F, 4, 2, 3, 1 }, SdlLayout{ 0xC29B, 4, 2, 3, 1 }, SdlLayout{ 0xC299, 4, 2, 3, 1 },
+                                SdlLayout{ 0xC29A, 3, 1, 2, -1 }, SdlLayout{ 0xC298, 3, 1, 2, -1 } })
+    {
+        const Model& m = ModelFor(0x046D, d.product);
+        CHECK(&m != &Fallback(), "%04x is a wheel we know", d.product);
+        CHECK(m.axes.steer == 0 && m.axes.throttle == d.gas && m.axes.brake == d.brake && m.axes.clutch == d.clutch,
+            "%04x: the model's axes (%d, %d, %d, %d) are SDL's (0, %d, %d, %d)", d.product, m.axes.steer, m.axes.throttle,
+            m.axes.brake, m.axes.clutch, d.gas, d.brake, d.clutch);
+        CHECK(m.axes.throttle < d.axes && m.axes.brake < d.axes && m.axes.clutch < d.axes, "%04x: every pedal is on an axis it has", d.product);
+        std::vector<int16_t> rest(size_t(d.axes), int16_t(kAxisMax));
+        rest[0] = 0;
+        const Axes at = Detect(rest, m.axes);
+        CHECK(at.throttle == d.gas && at.brake == d.brake && at.clutch == d.clutch, "%04x at rest: throttle %d, brake %d, clutch %d",
+            d.product, at.throttle, at.brake, at.clutch);
+        CHECK(m.pedalRest == kAxisMax && m.pedalFull == -32768, "%04x: pedals rest at +32767 and floor at -32768, as SDL sends them", d.product);
+    }
+    CHECK(&ModelFor(0x046D, 0x0001) == &Fallback(), "another Logitech device is not a wheel we know");
+    CHECK(&ModelFor(0, 0) == &Fallback(), "no USB ids: the fallback");
+
+    // Which joystick is a wheel. SDL's own word, our table, or the name;
+    // but never something without an axis to steer with and a button.
+    CHECK(LooksLikeWheel(true, 0x1234, 0x5678, "Something", 4, 12), "SDL says it is a wheel");
+    CHECK(LooksLikeWheel(false, 0x046D, 0xC24F, "", 4, 25), "the G29 by its USB ids, unnamed");
+    CHECK(LooksLikeWheel(false, 0, 0, "Thrustmaster T300RS", 4, 13), "an unknown wheel by its name");
+    CHECK(LooksLikeWheel(false, 0, 0, "LOGITECH G923 Racing Wheel", 4, 13), "the name, whatever its case");
+    CHECK(!LooksLikeWheel(false, 0x045E, 0x028E, "Xbox 360 Controller", 6, 11), "a controller is not a wheel");
+    CHECK(!LooksLikeWheel(true, 0x046D, 0xC24F, "Logitech G29", 1, 1), "one axis: not a wheel, whatever it says");
+    CHECK(!LooksLikeWheel(true, 0x046D, 0xC24F, "Logitech G29", 4, 0), "no buttons: nor is this");
+
+    // Where the axes rest tells the wheel (centred) from the pedals (held at
+    // one end): a G29 comes out as its model says.
+    Axes axes = Detect(kG29Rest, ModelFor(0x046D, 0xC24F).axes);
+    CHECK(axes.steer == 0 && axes.throttle == 2 && axes.brake == 3 && axes.clutch == 1, "the G29's axes: %d %d %d %d",
+        axes.steer, axes.throttle, axes.brake, axes.clutch);
+
+    // A wheel we don't know, with the same resting places, still steers and
+    // brakes: the centred axis is the wheel, the rest are pedals in order.
+    axes = Detect(kG29Rest, Fallback().axes);
+    CHECK(axes.steer == 0 && axes.throttle == 1 && axes.brake == 2 && axes.clutch == 3, "an unknown wheel's axes");
+
+    // A model that names the wrong axes loses to where they rest: here the
+    // wheel is axis 2, which the model called a pedal. Its pedal layout
+    // can't hold, so it is dropped whole and the axes left over go to the
+    // pedals in the order the device reports them, rather than the throttle
+    // keeping the model's axis while the brake takes what is left.
+    constexpr int16_t kOddRest[] = { -32768, 32767, 0, 32767 };
+    axes = Detect(kOddRest, { 0, 1, 2, 3 });
+    CHECK(axes.steer == 2, "the centred axis is the wheel, not the one the model named: %d", axes.steer);
+    CHECK(axes.throttle == 0 && axes.brake == 1 && axes.clutch == 3, "the rest in the device's order: %d, %d, %d",
+        axes.throttle, axes.brake, axes.clutch);
+
+    // Two pedals and no clutch: nothing is invented for a role the model
+    // hasn't got, and a pedal is never the wheel's axis.
+    constexpr int16_t kTwoPedals[] = { 0, 32767, 32767 };
+    axes = Detect(kTwoPedals, { 0, 1, 2, -1 });
+    CHECK(axes.steer == 0 && axes.throttle == 1 && axes.brake == 2 && axes.clutch == -1, "a wheel with two pedals");
+    constexpr int16_t kOnePedal[] = { 0, 32767 };
+    axes = Detect(kOnePedal, Fallback().axes);
+    CHECK(axes.steer == 0 && axes.throttle == 1 && axes.brake == -1 && axes.clutch == -1, "a wheel with one pedal");
+
+    // A wheel held off centre as the game starts is still the wheel (half
+    // way is the line), and a pedal already pressed is still a pedal: here
+    // axis 1, which on a G29 is the clutch, is held to the floor while the
+    // other two rest, and every role still lands where the model says.
+    constexpr int16_t kOffCentreRest[] = { 12000, -32768, 32767, 32767 };
+    axes = Detect(kOffCentreRest, ModelFor(0x046D, 0xC24F).axes);
+    CHECK(axes.steer == 0 && axes.throttle == 2 && axes.brake == 3 && axes.clutch == 1,
+        "a wheel off centre, the clutch held down: %d, %d, %d, %d", axes.steer, axes.throttle, axes.brake, axes.clutch);
+
+    // Preferred axes that name one axis for two pedals (wheel.cpp passes a stored calibration in as
+    // `preferred`, and a calibration can go wrong) don't hold: no axis ever gets two roles.
+    axes = Detect(kG29Rest, { 0, 2, 2, 1 });
+    CHECK(axes.throttle != axes.brake && axes.throttle >= 0 && axes.brake >= 0,
+        "throttle and brake both named axis 2: they end up apart (%d, %d)", axes.throttle, axes.brake);
+    // ...whatever the device and whatever is preferred: every role on its own axis, the wheel never a pedal,
+    // and a wheel found whenever an axis rests centred. A fixed seed, so a failure repeats.
+    {
+        std::mt19937 rng(29);
+        auto pick = [&](int lo, int hi) { return std::uniform_int_distribution<int>(lo, hi)(rng); };
+        int bad = 0;
+        for (int trial = 0; trial < 50000 && bad < 3; trial++)
+        {
+            std::vector<int16_t> rest(size_t(pick(0, 8)));
+            bool centred = false;
+            for (int16_t& v : rest)
+            {
+                const int kind = pick(0, 3);
+                v = int16_t(kind == 0 ? pick(-32768, 32767) : kind == 1 ? pick(-3000, 3000) : kind == 2 ? 32767 : -32768);
+                centred = centred || RestsCentred(v);
+            }
+            const Axes pref = { pick(-1, 9), pick(-1, 9), pick(-1, 9), pick(-1, 9) };
+            const Axes got = Detect(rest, pref);
+            const int roles[] = { got.steer, got.throttle, got.brake, got.clutch };
+            bool ok = (got.steer >= 0) == centred;
+            for (int a = 0; a < 4; a++)
+            {
+                ok = ok && roles[a] >= -1 && roles[a] < int(rest.size());
+                for (int b = a + 1; b < 4; b++)
+                    ok = ok && (roles[a] < 0 || roles[a] != roles[b]);
+            }
+            if (!ok)
+            {
+                bad++;
+                CHECK(false, "Detect, %zu axes, preferred %d %d %d %d: %d %d %d %d", rest.size(), pref.steer, pref.throttle,
+                    pref.brake, pref.clutch, got.steer, got.throttle, got.brake, got.clutch);
+            }
+        }
+    }
+
+    // Steering. The whole turn, straight through: the ends and the middle.
+    CHECK(Near(SteerRaw(0, 0, 900, 0.0f, 1.0f), 0.0f), "centred is straight ahead");
+    CHECK(Near(SteerRaw(32767, 0, 900, 0.0f, 1.0f), 1.0f), "full right");
+    CHECK(Near(SteerRaw(-32768, 0, 900, 0.0f, 1.0f), -1.0f), "full left (the extra count clamps)");
+    CHECK(Near(SteerRaw(16384, 0, 900, 0.0f, 1.0f), 0.5f, 0.002f), "half way round");
+    // A range smaller than the wheel's turn reaches full lock sooner: 450 of
+    // a G29's 900 degrees means half a turn is already full lock.
+    CHECK(Near(SteerRaw(16384, 450, 900, 0.0f, 1.0f), 1.0f), "450 of 900: half the turn is full lock");
+    CHECK(Near(SteerRaw(8192, 450, 900, 0.0f, 1.0f), 0.5f, 0.002f), "...and a quarter of it is half lock");
+    CHECK(Near(SteerRaw(-16384, 450, 900, 0.0f, 1.0f), -1.0f), "the same the other way");
+    CHECK(Near(SteerRaw(32767, 450, 900, 0.0f, 1.0f), 1.0f), "past full lock is full lock");
+    // A range at or above the wheel's turn, or a wheel whose turn we don't
+    // know, uses the whole turn.
+    CHECK(Near(SteerRaw(16384, 900, 900, 0.0f, 1.0f), 0.5f, 0.002f), "900 of 900 is the whole turn");
+    CHECK(Near(SteerRaw(16384, 540, 0, 0.0f, 1.0f), 0.5f, 0.002f), "a wheel whose turn is unknown: the whole axis");
+    // The deadzone: nothing inside it, and what is outside still reaches
+    // full lock.
+    CHECK(Near(SteerRaw(3000, 0, 900, 0.1f, 1.0f), 0.0f), "inside the deadzone: straight ahead");
+    CHECK(Near(SteerRaw(-3000, 0, 900, 0.1f, 1.0f), 0.0f), "...either way");
+    CHECK(SteerRaw(4000, 0, 900, 0.1f, 1.0f) > 0.0f, "just outside it: steering");
+    CHECK(Near(SteerRaw(32767, 0, 900, 0.1f, 1.0f), 1.0f), "the deadzone doesn't cost full lock");
+    // Response: above 1 is gentler near the centre, below 1 sharper, and
+    // full lock stays full lock either way.
+    CHECK(SteerRaw(16384, 0, 900, 0.0f, 2.0f) < SteerRaw(16384, 0, 900, 0.0f, 1.0f), "response 2: gentler near the centre");
+    CHECK(SteerRaw(16384, 0, 900, 0.0f, 0.5f) > SteerRaw(16384, 0, 900, 0.0f, 1.0f), "response 0.5: sharper");
+    for (float response : { 0.5f, 1.0f, 2.0f })
+        CHECK(Near(SteerRaw(32767, 0, 900, 0.05f, response), 1.0f), "response %.1f still reaches full lock", double(response));
+    // Nothing a hand-edited settings.toml holds can send it out of range.
+    for (int raw : { -32768, -1, 0, 1, 32767 })
+        for (float deadzone : { -1.0f, 0.0f, 0.5f, 2.0f })
+            for (float response : { -1.0f, 0.0f, 1.0f, 3.0f })
+            {
+                const float v = SteerRaw(int16_t(raw), -5, 900, deadzone, response);
+                CHECK(v >= -1.0f && v <= 1.0f && v == v, "raw %d, deadzone %.1f, response %.1f: %f", raw, double(deadzone),
+                    double(response), double(v));
+            }
+
+    // A pedal is the span from where it rests to where it reads floored,
+    // measured at both ends. A G29's rest at +32767 and run to -32768.
+    Pedal pedal;
+    pedal.Start(32767, -32768);
+    CHECK(pedal.ready, "both ends given: it reads");
+    CHECK(Near(pedal.Value(32767), 0.0f), "a pedal at rest is up");
+    CHECK(Near(pedal.Value(0), 0.5f, 0.01f), "half way down");
+    CHECK(Near(pedal.Value(-32768), 1.0f), "on the floor");
+    // One wired the other way round works the same.
+    pedal.Start(-32768, 32767);
+    CHECK(Near(pedal.Value(-32768), 0.0f) && Near(pedal.Value(32767), 1.0f), "a pedal that runs the other way");
+    // Only movement towards the pressed end counts: the other way is a
+    // pedal on its way back up, which is not a pedal being pressed.
+    pedal.Start(0, 32767);
+    CHECK(Near(pedal.Value(0), 0.0f) && Near(pedal.Value(32767), 1.0f), "a pedal from the middle");
+    CHECK(Near(pedal.Value(-32768), 0.0f), "...and the other way is still up, not full");
+    // A pedal that stops short of the end of its axis still reads as
+    // floored, because the span says how far it really goes. (A G29's
+    // brake stops around -31740 when it is pressed hard.)
+    pedal.Start(32767, -31740);
+    CHECK(Near(pedal.Value(-31740), 1.0f), "a pedal that stops short still reaches the floor");
+    CHECK(Near(pedal.Value(-32768), 1.0f), "...and past it is still the floor");
+    CHECK(pedal.Value(0) > 0.4f && pedal.Value(0) < 0.6f, "half way is still half way");
+
+    // Two pedals sharing one axis, one taking it positive and the other
+    // negative: each reads its own half and ignores the other's. (Some
+    // wheels report a combined pedal axis this way.)
+    Pedal shareUp, shareDown;
+    shareUp.Start(0, 32767);
+    shareDown.Start(0, -32768);
+    CHECK(Near(shareUp.Value(32767), 1.0f) && Near(shareDown.Value(32767), 0.0f), "the positive half is one pedal's");
+    CHECK(Near(shareDown.Value(-32768), 1.0f) && Near(shareUp.Value(-32768), 0.0f), "the negative half is the other's");
+    CHECK(Near(shareUp.Value(0), 0.0f) && Near(shareDown.Value(0), 0.0f), "at rest, neither is pressed");
+    // At rest it is 0, not -0 (which the menu and the log printed as "-0%").
+    for (const Pedal& p : { shareUp, shareDown, pedal })
+        for (int raw : { -32768, -1, 0, 1, 32767 })
+            CHECK(!std::signbit(p.Value(int16_t(raw))), "no -0 at %d", raw);
+
+    // A pedal nobody has placed reads nothing, however far its axis is from
+    // zero: SDL reports an axis only when it moves, so an untouched pedal
+    // resting at +32767 would otherwise read as floored.
+    const Pedal untouched;
+    CHECK(!untouched.ready, "a fresh pedal knows nothing");
+    for (int raw : { -32768, 0, 32767 })
+        CHECK(untouched.Value(int16_t(raw)) == 0.0f, "an unplaced pedal reads nothing at %d", raw);
+    Pedal degenerate;
+    degenerate.Start(5000, 5000);
+    CHECK(!degenerate.ready && degenerate.Value(0) == 0.0f, "two ends the same is no span at all");
+
+    // An axis read the other way round (Invert Steering).
+    CHECK(Flip(0) == 0, "centred stays centred");
+    CHECK(Flip(32767) == -32767 && Flip(-32767) == 32767, "the ends swap");
+    CHECK(Flip(-32768) == kAxisMax, "the extra count clamps rather than wrapping to itself");
+    CHECK(Flip(Flip(12345)) == 12345, "twice is where it started");
+
+    // Whatever it reads, the answer is a fraction.
+    pedal.Start(32767, -32768);
+    for (int raw : { -32768, -1000, 0, 1000, 32767 })
+    {
+        const float v = pedal.Value(int16_t(raw));
+        CHECK(v >= 0.0f && v <= 1.0f, "pedal at %d: %f", raw, double(v));
+    }
+
+    // The wheel's own axis as two measured ends: the centre falls halfway
+    // between them, each side is measured against its own end, and which
+    // way round the wheel is needs nothing else said.
+    Steering wheel;
+    CHECK(!Steering{}.ready && Steering{}.left == -kAxisMax && Steering{}.right == kAxisMax, "a default Steering spans the axis, unmeasured");
+    wheel.Start(-32768, 32767);
+    CHECK(wheel.ready, "two ends given");
+    CHECK(Near(wheel.Fraction(0), 0.0f, 0.01f), "the middle is straight ahead");
+    CHECK(Near(wheel.Fraction(32767), 1.0f, 0.01f), "full right");
+    CHECK(Near(wheel.Fraction(-32768), -1.0f, 0.01f), "full left");
+    // A wheel whose axis runs the other way: the ends come out swapped, and
+    // that alone turns it round.
+    wheel.Start(32767, -32768);
+    CHECK(Near(wheel.Fraction(32767), -1.0f, 0.01f), "the positive end is full left on a backwards wheel");
+    CHECK(Near(wheel.Fraction(-32768), 1.0f, 0.01f), "...and the negative end is full right");
+    // A wheel that reaches neither end of its axis, and sits off centre:
+    // each side still reaches full lock.
+    wheel.Start(-20000, 10000);
+    CHECK(Near(wheel.Fraction(-20000), -1.0f, 0.01f) && Near(wheel.Fraction(10000), 1.0f, 0.01f), "a short, lopsided wheel");
+    CHECK(Near(wheel.Fraction(-5000), 0.0f, 0.01f), "its own centre is straight ahead");
+    CHECK(wheel.Fraction(32767) <= 1.0f && wheel.Fraction(-32768) >= -1.0f, "past its ends is still full lock");
+    // Two ends the same is no span: straight ahead, whatever it reads.
+    Steering flat;
+    flat.Start(1000, 1000);
+    CHECK(!flat.ready && Near(flat.Fraction(32767), 0.0f), "no span, no steering");
+
+    // The buttons the player assigns sit on top of the model's, and a
+    // button given to one control is taken off whatever else had it.
+    {
+        std::array<int, kControlCount> assigned{};
+        assigned.fill(-1);
+        assigned[size_t(Control::A)] = 7;  // A is the lever the model calls LB
+        const std::vector<Binding> mine = WithAssigned(kLogitechButtons, assigned);
+        CHECK(Resolve(Held<25>({ 7 }), hat::Centred, mine).buttons == button::A, "button 7 is now A");
+        CHECK(Resolve(Held<25>({ 0 }), hat::Centred, mine).buttons == 0, "...and the model's A no longer answers");
+        CHECK(Resolve(Held<25>({ 9 }), hat::Centred, mine).buttons == button::Start, "the rest of the model stands");
+        // Nothing assigned leaves the model exactly as it was.
+        assigned.fill(-1);
+        CHECK(WithAssigned(kLogitechButtons, assigned).size() == std::size(kLogitechButtons), "no assignments, no change");
+        // A paddle can be reassigned too, and keeps its own role.
+        assigned[size_t(Control::ShiftUp)] = 2;
+        const std::vector<Binding> shift = WithAssigned(kLogitechButtons, assigned);
+        CHECK(Resolve(Held<25>({ 2 }), hat::Centred, shift).rightY > 0, "button 2 now shifts up");
+        CHECK(Resolve(Held<25>({ 4 }), hat::Centred, shift).rightY == 0, "...and the model's paddle no longer does");
+    }
+
+    // ---- Calibrate (wheel_map.h's Calibration), as a player does it on a G29 ----
+    {
+        using Event = Calibration::Event;
+        Rig r;
+        r.Start();
+        CHECK(r.cal.Running() && r.cal.Current() == Step::SteerLeft, "it starts at the wheel's left end");
+        // Full left, then letting go (the wheel centres itself) before A: the end it reached is what is kept.
+        r.Move(0, -32768);
+        r.Move(0, 0);
+        CHECK(r.cal.Watch().found && r.cal.Watch().full == -32768, "full left is the end reached: %d", int(r.cal.Watch().full));
+        CHECK(r.Tap(0) == Event::Kept && r.cal.LastFound().axis == 0 && r.cal.LastFound().full == -32768 && r.cal.LastFound().rest == 0,
+            "kept: axis 0, from 0 to -32768 (not the centre it was let back to)");
+        // Full right begins with the wheel held at full left (A pressed while holding it): coming back to the centre
+        // is not the right end, so A does nothing yet...
+        r.axes[0] = -32768;
+        r.Frame();
+        r.Move(0, 0);
+        CHECK(!r.cal.Watch().found && r.Tap(0) == Event::None && r.cal.Current() == Step::SteerRight,
+            "back to the centre from full left is not full right");
+        // ...until it turns right.
+        r.Move(0, 32767);
+        CHECK(r.Tap(0) == Event::Kept && r.cal.LastFound().full == 32767, "full right: +32767");
+        r.Move(0, 0);
+        // The throttle, held while A keeps it.
+        r.Move(2, -32768);
+        CHECK(r.Tap(0) == Event::Kept && r.cal.LastFound().axis == 2 && r.cal.LastFound().rest == 32767 &&
+            r.cal.LastFound().full == -32768, "the throttle: axis 2, +32767 to -32768");
+        // The brake: the throttle is let up during this step (a full sweep of its axis) and then the brake pressed.
+        // The throttle's axis is measured from its own rest and only the other way, so its release counts for nothing.
+        r.Move(2, 32767);
+        CHECK(!r.cal.Watch().found, "letting the throttle up is not the brake");
+        r.Move(3, -32768);
+        CHECK(r.Tap(0) == Event::Kept && r.cal.LastFound().axis == 3, "the brake is axis 3, not the throttle's 2 (%d)",
+            r.cal.LastFound().axis);
+        // The clutch, the brake let up meanwhile; turning the wheel (its own axis) never counts for a pedal.
+        r.Move(3, 32767);
+        r.Move(0, -32768);
+        r.Move(0, 0);
+        CHECK(!r.cal.Watch().found, "the wheel's axis is never a pedal's");
+        r.Move(1, -20000);
+        CHECK(r.Tap(0) == Event::Kept && r.cal.LastFound().axis == 1 && r.cal.LastFound().full == -20000, "the clutch, half way: axis 1");
+        r.Move(1, 32767);
+        // A: Cross is still down from keeping the clutch... no, Tap let it go. Press Cross: it is the candidate; press it
+        // again and it is kept. Cross can be A.
+        CHECK(r.cal.Current() == Step::ButtonA, "the buttons follow");
+        CHECK(r.Tap(0) == Event::None && r.cal.Watch().button == 0, "Cross pressed for A: the candidate");
+        CHECK(r.Tap(0) == Event::Kept && r.cal.LastFound().button == 0, "Cross again: A is Cross");
+        // B: Circle pressed and let go, then A. Circle doesn't stop a button step, and the press is kept through its release.
+        CHECK(r.Tap(2) == Event::None && r.cal.Running() && r.cal.Watch().button == 2, "Circle for B: kept through its release, no stop");
+        CHECK(r.Tap(0) == Event::Kept && r.cal.LastFound().button == 2, "A keeps Circle as B");
+        // X: Square, another button replaces it, then that one again keeps it (on its press, so it is still held
+        // as the Y step begins).
+        r.Tap(1);
+        r.Tap(10);
+        CHECK(r.cal.Watch().button == 10, "another button replaces the candidate");
+        CHECK(r.Down(10) == Event::Kept && r.cal.LastFound().button == 10 && r.cal.Current() == Step::ButtonY,
+            "...and pressing it again keeps it");
+        // A button held as a step begins is not a press until it is let go and pressed again.
+        r.Frame();
+        CHECK(!r.cal.Watch().found, "a button held as the step begins is no press");
+        r.Up(10);
+        CHECK(!r.cal.Watch().found, "nor is letting it go");
+        r.Down(10);
+        CHECK(r.cal.Watch().button == 10, "pressed again, it is");
+        r.Up(10);
+        // The D-pad: right skips (nothing kept), left goes back, down stops.
+        CHECK(r.Hat(hat::Right) == Event::Skipped && r.cal.Current() == Step::ButtonLB, "D-pad right skips Y");
+        CHECK(r.Hat(hat::Left) == Event::Back && r.cal.Current() == Step::ButtonY, "D-pad left goes back to Y");
+        for (int i = 0; i < 20 && r.cal.Running(); i++)
+            r.Hat(hat::Right);
+        CHECK(!r.cal.Running(), "skipping past the last step ends it");
+    }
+    {
+        using Event = Calibration::Event;
+        // A wheel without a clutch (a Driving Force GT: three axes): the clutch step is skipped with the D-pad.
+        Rig r;
+        r.axes = { 0, 32767, 32767 };
+        r.seen = std::vector<bool>(3, true);
+        r.Start();
+        r.Move(0, -32768); r.Tap(0); r.Move(0, 32767); r.Tap(0); r.Move(0, 0);
+        r.Move(1, -32768); r.Tap(0); r.Move(1, 32767);
+        r.Move(2, -32768); r.Tap(0); r.Move(2, 32767);
+        CHECK(r.cal.Current() == Step::Clutch, "at the clutch");
+        CHECK(r.Tap(0) == Event::None, "A with no clutch pressed: nothing to keep");
+        CHECK(r.Hat(hat::Right) == Event::Skipped && r.cal.Current() == Step::ButtonA, "D-pad right skips the clutch");
+        // B stops an axis step; D-pad down stops a button step.
+        Rig s;
+        s.Start();
+        CHECK(s.Tap(2) == Event::Stopped && !s.cal.Running(), "B stops an axis step");
+        Rig t;
+        t.Start();
+        for (int i = 0; i < 5; i++)
+            t.Hat(hat::Right);
+        CHECK(t.cal.Current() == Step::ButtonA && t.Hat(hat::Down) == Event::Stopped, "D-pad down stops a button step");
+    }
+    {
+        using Event = Calibration::Event;
+        // Two pedals on one axis, one each way (a combined pedal axis resting in the middle): each finds its own half,
+        // and letting the first up is not the second.
+        Rig r;
+        r.axes = { 0, 0 };
+        r.seen = std::vector<bool>(2, true);
+        r.Start();
+        r.Move(0, -32768); r.Tap(0); r.Move(0, 32767); r.Tap(0); r.Move(0, 0);
+        r.Move(1, 32767);
+        CHECK(r.Tap(0) == Event::Kept && r.cal.LastFound().axis == 1 && r.cal.LastFound().rest == 0 && r.cal.LastFound().full == 32767,
+            "throttle: axis 1, 0 to +32767");
+        r.Move(1, 0);
+        CHECK(!r.cal.Watch().found, "the throttle back to the middle is not the brake");
+        r.Move(1, -32768);
+        CHECK(r.Tap(0) == Event::Kept && r.cal.LastFound().axis == 1 && r.cal.LastFound().rest == 0 &&
+            r.cal.LastFound().full == -32768, "brake: the same axis, 0 to -32768");
+    }
+    {
+        using Event = Calibration::Event;
+        // An axis the device hasn't reported reads 0, which says nothing: measured from SDL's first report of it
+        // (where it was before it moved), not from that 0.
+        Rig r;
+        r.axes = { 0, 0, 0, 0 };
+        r.seen = { true, false, false, false };
+        r.Start();
+        r.Move(0, -32768); r.Tap(0); r.Move(0, 32767); r.Tap(0); r.Move(0, 0);
+        r.cal.FirstValue(2, 32767);
+        r.seen[2] = true;
+        r.axes[2] = 32767;
+        r.Move(2, -32768);
+        CHECK(r.Tap(0) == Event::Kept && r.cal.LastFound().rest == 32767, "rest from the first report: %d", int(r.cal.LastFound().rest));
+        // Keep from the keyboard with nothing found: nothing happens, the step carries on.
+        CHECK(r.cal.Keep(r.axes) == Event::None && r.cal.Current() == Step::Brake, "A with nothing found: nothing");
+        // Jitter doesn't count: an axis has to go a third of its travel.
+        r.seen[3] = true;
+        r.cal.FirstValue(3, 32767);
+        r.axes[3] = 32767;
+        r.Move(3, 32767 - kCalibrateMoved + 100);
+        CHECK(!r.cal.Watch().found, "less than a third of the travel is not a press");
+    }
+
+    // Idle with a wheel (v0.1.7's refresh-rate notice waits for 3 s of idle controls): a wheel resting off its
+    // centre with a little jitter is idle, as a stick in its deadzone is; turning it, even slowly, is not.
+    {
+        WheelStill still;
+        int counted = 0;
+        for (int frame = 0; frame < 600; frame++)  // 10 s at rest, 11% off centre (a G29 opened at 3623), +-0.1% jitter
+            counted += still.Turned(0.11f + 0.001f * float((frame * 7) % 3 - 1));
+        CHECK(counted == 0, "a resting wheel off its centre is idle (counted %d times)", counted);
+        CHECK(still.Turned(0.2f), "a turn of 9%% of full lock is use");
+        int slow = 0;
+        for (int frame = 0; frame < 60; frame++)  // 0.5% of lock a frame: a slow turn
+            slow += still.Turned(0.2f + 0.005f * float(frame));
+        CHECK(slow >= 10, "a slow turn keeps counting as use (%d of 60 frames)", slow);
+        WheelStill fresh;
+        CHECK(!fresh.Turned(0.5f), "where it first is says nothing");
+    }
+
+    // Every control has a name and its own place in the order.
+    for (size_t i = 0; i < kControlCount; i++)
+        CHECK(kControls[i].name != nullptr && size_t(kControls[i].control) == i, "control %zu is itself", i);
+
+    // The buttons. A G29's, by position: Cross is A, Circle is B, Square is
+    // X, Triangle is Y; Share and Options are Back and Start.
+    auto press = [](std::initializer_list<int> which) {
+        return Resolve(Held<25>(which), hat::Centred, kLogitechButtons);
+    };
+    CHECK(press({ 0 }).buttons == button::A, "Cross is A");
+    CHECK(press({ 1 }).buttons == button::X, "Square is X");
+    CHECK(press({ 2 }).buttons == button::B, "Circle is B");
+    CHECK(press({ 3 }).buttons == button::Y, "Triangle is Y");
+    CHECK(press({ 8 }).buttons == button::Back, "Share is Back");
+    CHECK(press({ 9 }).buttons == button::Start, "Options is Start");
+    CHECK(press({ 8, 9 }).buttons == (button::Back | button::Start), "Share + Options is the settings chord");
+    CHECK(press({ 6 }).buttons == button::RightShoulder && press({ 7 }).buttons == button::LeftShoulder, "the levers are the shoulders");
+    CHECK(press({ 10 }).buttons == button::RightThumb && press({ 11 }).buttons == button::LeftThumb, "the stick clicks");
+    // The paddles shift gears, which the game does with the right stick;
+    // both at once is no change, as holding both keys of a pair is.
+    CHECK(press({ 4 }).rightY > 0 && press({ 4 }).buttons == 0, "the right paddle pushes the stick up");
+    CHECK(press({ 5 }).rightY < 0 && press({ 5 }).buttons == 0, "the left one pulls it down");
+    CHECK(press({ 4, 5 }).rightY == 0, "both paddles: no gear change");
+    CHECK(press({}).buttons == 0 && press({}).rightY == 0, "nothing held, nothing pressed");
+    // A button the wheel reports but nothing is bound to does nothing, and a
+    // binding for a button the wheel hasn't got is ignored rather than read
+    // off the end.
+    CHECK(press({ 20 }).buttons == 0, "an unbound button does nothing");
+    CHECK(Resolve(Held<2>({ 0, 1 }), hat::Centred, kLogitechButtons).buttons == (button::A | button::X),
+        "a wheel with two buttons: those two, and no reading past them");
+    // The hat is the D-pad, corners included.
+    const std::array<bool, 25> none{};
+    CHECK(Resolve(none, hat::Up, kLogitechButtons).buttons == button::DpadUp, "the hat is the D-pad");
+    CHECK(Resolve(none, uint8_t(hat::Left | hat::Down), kLogitechButtons).buttons == (button::DpadLeft | button::DpadDown),
+        "its corners too");
+
+    // NFSMW_WHEEL_BUTTONS: what it names changes, the rest of the model's
+    // bindings stay, NONE takes one out, and nonsense is reported without
+    // throwing the others away.
+    std::string error = "x";
+    std::vector<Binding> changed = ParseBindings("0=B,2=A", kLogitechButtons, error);
+    CHECK(error.empty(), "a line that reads: \"%s\"", error.c_str());
+    CHECK(Resolve(Held<25>({ 0 }), hat::Centred, changed).buttons == button::B, "button 0 is now B");
+    CHECK(Resolve(Held<25>({ 9 }), hat::Centred, changed).buttons == button::Start, "...and the model's Start is untouched");
+    changed = ParseBindings("9=NONE", kLogitechButtons, error);
+    CHECK(error.empty() && Resolve(Held<25>({ 9 }), hat::Centred, changed).buttons == 0, "NONE takes a button out");
+    changed = ParseBindings(" 4=START , nonsense , 5=WHAT ", kLogitechButtons, error);
+    CHECK(error == "nonsense", "the first item it can't read: \"%s\"", error.c_str());
+    CHECK(Resolve(Held<25>({ 4 }), hat::Centred, changed).buttons == button::Start, "the items that do read still count");
+    CHECK(ParseBindings("", kLogitechButtons, error).size() == std::size(kLogitechButtons) && error.empty(), "an empty list changes nothing");
+    // A button number past 255 is refused, however long (it used to overflow an int on the way: UBSan).
+    for (const char* text : { "256=A", "99999999999=A", "4294967296=A", "000000000000000000004=A" })
+    {
+        changed = ParseBindings(text, kLogitechButtons, error);
+        bool past = false;
+        for (const Binding& b : changed)
+            past = past || b.index < 0 || b.index > 255;
+        const bool leadingZeros = text[0] == '0';
+        CHECK(!past && (leadingZeros ? error.empty() : error == text), "\"%s\": refused (error \"%s\")", text, error.c_str());
+    }
+    CHECK(Resolve(Held<25>({ 4 }), hat::Centred, ParseBindings("000000000000000000004=A", kLogitechButtons, error)).buttons == button::A,
+        "leading zeros are still button 4");
+
+    // Every name is one of the pad's controls, and NameOf says which.
+    for (const auto& [name, binding] : kNames)
+        if (name != "NONE")
+            CHECK(NameOf(binding) == name, "%s names itself", std::string(name).c_str());
+
+    // Force feedback: the stronger motor the game asks for, at the share the
+    // setting allows, and nothing at all at 0.
+    CHECK(Near(RumbleStrength(65535, 0, 100), 1.0f), "a full rumble at 100%%");
+    CHECK(Near(RumbleStrength(0, 65535, 100), 1.0f), "either motor");
+    CHECK(Near(RumbleStrength(65535, 65535, 50), 0.5f), "half strength");
+    CHECK(Near(RumbleStrength(65535, 0, 0), 0.0f), "0%%: nothing");
+    CHECK(Near(RumbleStrength(0, 0, 100), 0.0f), "no request: nothing");
+    for (int percent : { -10, 0, 50, 100, 1000 })
+    {
+        const float v = RumbleStrength(40000, 20000, percent);
+        CHECK(v >= 0.0f && v <= 1.0f, "%d%%: %f", percent, double(v));
+        CHECK(SpringLevel(percent) <= 0x7FFF, "%d%%: the spring's coefficient fits", percent);
+    }
+    CHECK(SpringLevel(0) == 0 && SpringSaturation(0) == 0, "no centring force is no spring");
+    CHECK(SpringLevel(100) == 0x7FFF, "full centring force is the strongest spring");
+    CHECK(SpringLevel(50) > 0 && SpringLevel(50) < SpringLevel(100), "and half is in between");
+
+    // The game's own steering deadzone (round 2 of the G29 test: "I had to
+    // turn the wheel more than I should have to before the car would
+    // steer"). GameSteer is the game as measured in a race; a wheel's stick
+    // is stepped past it, so the car follows the wheel from the first step.
+    {
+        // hid/input.cpp's ToShort: the fraction a stick reaches the game as.
+        auto toShort = [](float v) { return int16_t(std::clamp(v * 32767.0f, -32768.0f, 32767.0f)); };
+        CHECK(GameStickUnits(0) == 0 && GameStickUnits(32767) == 1000 && GameStickUnits(-32768) == -1000,
+            "the guest's int: centre and both ends");
+        CHECK(GameStickUnits(6553) == 200 && GameStickUnits(6586) == 201 && GameStickUnits(-6586) == -201,
+            "and the steps either side of the deadzone's edge");
+        // What the race measured (the stick swept in 1% steps, the car's steering read back).
+        const float measured[][2] = { { 0.06f, 0.0f }, { 0.12f, 0.0f }, { 0.20f, 0.0f }, { 0.21f, 0.0125f }, { 0.25f, 0.0625f },
+            { 0.30f, 0.125f }, { 0.40f, 0.25f }, { 0.60f, 0.5f }, { 0.80f, 0.75f }, { 1.0f, 1.0f } };
+        for (const auto& [x, y] : measured)
+        {
+            CHECK(Near(GameSteer(toShort(x)), y, 0.0015f), "a pad's stick at %.2f steers %.4f (got %.4f)", double(x), double(y),
+                double(GameSteer(toShort(x))));
+            CHECK(Near(GameSteer(toShort(-x)), -y, 0.0015f), "and as far the other way at -%.2f", double(x));
+        }
+        // A wheel: the car steers as far as the wheel says, from the first step.
+        float before = -2.0f;
+        int worst = 0;
+        for (int i = -10000; i <= 10000; i++)
+        {
+            const float w = float(i) / 10000.0f;
+            const float y = GameSteer(toShort(StickPastGameDeadzone(w)));
+            CHECK(std::abs(y - w) <= 0.5f / float(kGameSteerSteps) + 1e-4f, "wheel %+.4f: the car steers %+.5f", double(w), double(y));
+            CHECK(y >= before, "wheel %+.4f: never less than a smaller turn's (%+.5f < %+.5f)", double(w), double(y), double(before));
+            CHECK((y == 0.0f) == (std::abs(w) * float(kGameSteerSteps) < 0.5f), "wheel %+.4f: straight only within half a step",
+                double(w));
+            before = y;
+            if (i > 0 && GameSteer(toShort(w)) == 0.0f)
+                worst = i;
+        }
+        CHECK(worst >= 2000 && worst <= 2010, "without it, a wheel steered nothing up to 20%% of its turn (to %d/10000)", worst);
+        CHECK(Near(GameSteer(toShort(StickPastGameDeadzone(0.15f))), 0.15f, 0.001f) && GameSteer(toShort(0.15f)) == 0.0f,
+            "15%% of the turn: the car turns, where a pad's stick at 15%% doesn't");
+        CHECK(StickPastGameDeadzone(0.0f) == 0.0f && toShort(StickPastGameDeadzone(1.0f)) == 32767 &&
+                toShort(StickPastGameDeadzone(-1.0f)) == -32768,
+            "straight is a centred stick; full lock is the stick's end");
+    }
+
+    // The centring force (round 4 of the G29 test: "a consistent click every
+    // second" with the wheel held round a corner, none with it straight).
+    // Builds up to 286 said the autocentre level again every second while no
+    // knock played, and SDL says it by letting the spring go and taking it up
+    // again. Now: once at the open, once at the device's first report, and
+    // on a change of the setting. Never on a timer.
+    {
+        const float frame = 1000.0f / 60.0f;
+        Centring c;
+        CHECK(c.Due(50, false) && c.said == 50, "the open says it");
+        CHECK(!c.Due(50, false), "and nothing more until something happens");
+        // The wheel held at 30% of its turn for 10 s: its axis reports every
+        // frame (deviceReported from the first), no knock plays, the setting
+        // stays at 50%.
+        int sends = 0;
+        for (int f = 0; f < 600; f++)
+            sends += c.Due(50, true);
+        CHECK(sends == 1, "10 s held off centre: said once (SDL's driver cleared it at the first report), not %d times", sends);
+        // The old rule over the same 10 s, for the record: once a second.
+        int old = 0;
+        float sinceSaid = 0.0f;
+        for (int f = 0; f < 600; f++)
+            if ((sinceSaid += frame) >= 1000.0f)
+            {
+                old++;
+                sinceSaid = 0.0f;
+            }
+        CHECK(old >= 9, "the old rule said it %d times in those 10 s", old);
+        CHECK(c.Due(70, true) && c.said == 70, "a change of the setting says it");
+        CHECK(!c.Due(70, true), "once");
+        CHECK(c.Due(-5, true) && c.said == 0 && !c.Due(0, true), "out of range is clamped, and said once");
+        CHECK(c.sends == 4, "four times in all: open, first report, two changes (%d)", c.sends);
+        Centring reopened;
+        CHECK(reopened.Due(0, true) && !reopened.Due(0, true), "a wheel opened after its first report: said once");
+    }
+
+    // Knocks (rounds 2 and 3 of the G29 test: "a click whenever feedback
+    // should occur", then the clicking back while driving). The game knocks
+    // with one frame of full rumble; the wheel must get a thump that lasts,
+    // never a restart, and never a jump in strength from one frame to the
+    // next: a rise takes kKnockAttackMs, a fall kKnockReleaseMs.
+    {
+        using Action = Knock::Action;
+        const float frame = 1000.0f / 60.0f;
+        // Every frame of a run: the rules every knock keeps.
+        struct Checked
+        {
+            Knock k;
+            int starts = 0, stops = 0, changes = 0;
+            float playedMs = 0.0f, peak = 0.0f;
+            void Frame(float target, float ms, const char* what, int f)
+            {
+                const bool was = k.playing;
+                const float before = k.level;
+                const Action a = k.Step(target, ms);
+                starts += a == Action::Start;
+                stops += a == Action::Stop;
+                changes += a == Action::Change;
+                CHECK(a != Action::Start || !was, "%s, frame %d: never started again while it plays", what, f);
+                CHECK(a != Action::Change || was, "%s, frame %d: a change only while it plays", what, f);
+                CHECK(k.level <= before + ms / float(kKnockAttackMs) + 1e-6f, "%s, frame %d: rises no faster than the attack", what, f);
+                CHECK(k.level >= before - ms / float(kKnockReleaseMs) - 1e-6f, "%s, frame %d: falls no faster than the release", what, f);
+                CHECK(k.playing == (k.level > 0.0f), "%s, frame %d: plays exactly while there is something to play", what, f);
+                if (k.playing)
+                    playedMs += ms;
+                peak = std::max(peak, k.level);
+            }
+        };
+
+        // One frame of 32767/32767 at Force Feedback 100% (0.5), as the game
+        // sends for a wall hit, then nothing.
+        Checked one;
+        for (int f = 0; f < 60; f++)
+            one.Frame(f == 1 ? RumbleStrength(32767, 32767, 100) : 0.0f, frame, "one knock", f);
+        CHECK(one.starts == 1 && one.stops == 1, "one frame of rumble is one knock (%d starts, %d stops)", one.starts, one.stops);
+        CHECK(Near(one.peak, 0.5f), "it comes in whole within a frame (attack %d ms): %f", kKnockAttackMs, double(one.peak));
+        CHECK(one.playedMs >= 0.5f * float(kKnockReleaseMs) - frame, "and it lasts: %.0f ms", double(one.playedMs));
+        CHECK(one.changes >= 3, "let go of in steps (%d), not dropped", one.changes);
+
+        // The game's own rumble from a drag race (the virtual G29's log, 86.08 to
+        // 86.75 s; one value a frame): a ramp down, two one-frame knocks, and
+        // the small values between.
+        static constexpr uint16_t kRecorded[][2] = { { 3160, 0 }, { 2883, 0 }, { 2624, 0 }, { 32767, 32767 }, { 2159, 0 },
+            { 1949, 0 }, { 1755, 0 }, { 1572, 0 }, { 1401, 0 }, { 1242, 0 }, { 774, 0 }, { 1011, 0 }, { 495, 0 }, { 756, 0 },
+            { 361, 0 }, { 640, 0 }, { 295, 0 }, { 575, 0 }, { 166, 0 }, { 469, 0 }, { 81, 0 }, { 46, 0 }, { 0, 0 }, { 311, 0 },
+            { 49151, 49151 }, { 223, 0 }, { 0, 0 }, { 136, 0 }, { 0, 0 }, { 133, 0 }, { 0, 0 }, { 113, 0 }, { 0, 0 }, { 96, 0 },
+            { 0, 0 }, { 79, 0 }, { 0, 0 }, { 64, 0 }, { 0, 0 }, { 8, 0 }, { 0, 0 }, { 0, 0 }, { 0, 0 }, { 0, 0 }, { 0, 0 },
+            { 0, 0 }, { 0, 0 }, { 0, 0 }, { 0, 0 }, { 0, 0 }, { 0, 0 }, { 0, 0 } };
+        for (int percent : { 100, 50 })
+        {
+            Checked r;
+            for (size_t f = 0; f < std::size(kRecorded); f++)
+                r.Frame(RumbleStrength(kRecorded[f][0], kRecorded[f][1], percent), frame, percent == 100 ? "drag 100%" : "drag 50%", int(f));
+            CHECK(r.starts >= 1 && r.starts == r.stops && !r.k.playing, "%d%%: %d starts, %d stops", percent, r.starts, r.stops);
+            CHECK(r.peak > 0.0f && r.peak <= 0.75f * float(percent) / 100.0f + 1e-6f, "%d%%: no stronger than the strongest knock (%f)",
+                percent, double(r.peak));
+        }
+
+        // Round 3's session, as the game plays it around the settings menu:
+        // scraping a wall (the game's rumble swinging 25-100% about three
+        // times a second, a frame of jitter on top), the menu opening (the
+        // game pauses: its rumble runs down to 0 and stays there), Force
+        // Feedback stepped from 100% to 45% and back to 50% while the menu is
+        // open, Vibration off and on, the menu closing, and the scrape again.
+        // The wheel's knock comes back exactly as it was, at the new
+        // strength: let go of when the game stops, started from nothing when
+        // it starts again, never restarted or jumped in between.
+        {
+            Checked m;
+            int percent = 100;
+            bool vibration = true;
+            int f = 0;
+            auto scrape = [&](int frames) {
+                for (int i = 0; i < frames; i++, f++)
+                {
+                    const double t = double(f) / 60.0;
+                    double v = 0.62 + 0.38 * std::sin(t * 2.0 * 3.14159265 * 3.0) + ((f % 3) == 0 ? 0.04 : -0.02);
+                    const uint16_t low = uint16_t(std::clamp(v, 0.0, 1.0) * 65535.0);
+                    m.Frame(vibration ? RumbleStrength(low, 0, percent) : 0.0f, frame, "menu run", f);
+                }
+            };
+            auto quiet = [&](int frames) {
+                for (int i = 0; i < frames; i++, f++)
+                    m.Frame(vibration ? RumbleStrength(0, 0, percent) : 0.0f, frame, "menu run", f);
+            };
+            scrape(180);
+            const float before = m.peak;
+            CHECK(m.starts == 1 && m.k.playing, "the scrape is one knock while it lasts (%d starts)", m.starts);
+            quiet(30);  // the menu opens; the game's rumble runs down
+            CHECK(!m.k.playing && m.stops == 1, "let go of while the game is paused");
+            for (int step = 0; step < 11; step++)  // Force Feedback 100% -> 45% under the menu
+            {
+                percent -= 5;
+                quiet(12);
+            }
+            percent = 50;
+            vibration = false;
+            quiet(20);
+            vibration = true;
+            quiet(20);
+            CHECK(m.starts == 1 && !m.k.playing, "nothing plays under the menu, whatever the settings do");
+            m.peak = 0.0f;
+            scrape(180);  // the menu closes; scraping again
+            CHECK(m.starts == 2 && m.k.playing, "the next scrape starts it again, from nothing");
+            CHECK(Near(m.peak, 0.5f * before, 0.01f), "at half the strength now (%f, was %f)", double(m.peak), double(before));
+            percent = 100;  // Force Feedback back up while it plays: a rise, at the attack
+            scrape(60);
+            CHECK(m.starts == 2, "a setting changed while it plays changes it in place");
+        }
+
+        // Nitrous (the G29 retest of build 287): the game asks for 3.5-4.4 s
+        // of rumble at 75-100%, which shook the rim the whole time. Past
+        // kKnockSustainMs it is a long rumble: eased, at the release, to
+        // kKnockSustainScale of it, and held there. A crash's knock (a few
+        // frames at full) is untouched, before and after.
+        {
+            Checked n;
+            float lateMax = 0.0f;
+            for (int f = 0; f < 240; f++)  // 4 s
+            {
+                const double t = double(f) / 60.0;
+                const uint16_t v = uint16_t((0.875 + 0.125 * std::sin(t * 2.0 * 3.14159265 * 2.0)) * 65535.0);
+                n.Frame(RumbleStrength(v, v, 100), frame, "nitrous", f);
+                if (f * frame > float(kKnockSustainMs + kKnockReleaseMs) + frame)
+                    lateMax = std::max(lateMax, n.k.level);
+            }
+            CHECK(n.starts == 1 && n.k.sustained, "nitrous is one long rumble (%d starts)", n.starts);
+            CHECK(n.peak > 0.75f, "it starts as a knock (%f)", double(n.peak));
+            CHECK(lateMax > 0.0f && lateMax <= kKnockSustainScale + 1e-6f, "then it is light: at most %.0f%% (%f)",
+                double(kKnockSustainScale) * 100.0, double(lateMax));
+            for (int f = 0; f < 30; f++)
+                n.Frame(0.0f, frame, "nitrous ends", f);
+            CHECK(!n.k.playing && !n.k.sustained && n.stops == 1, "let go of when it ends");
+
+            // A crash after it: a few frames of full rumble, as strong as ever.
+            Checked c;
+            for (int f = 0; f < 60; f++)
+                c.Frame(f >= 1 && f <= 6 ? 1.0f : 0.0f, frame, "crash", f);
+            Checked c2 = n;
+            c2.peak = 0.0f;
+            for (int f = 0; f < 60; f++)
+                c2.Frame(f >= 1 && f <= 6 ? 1.0f : 0.0f, frame, "crash after nitrous", f);
+            CHECK(Near(c.peak, 1.0f) && !c.k.sustained, "a crash knock is full strength (%f)", double(c.peak));
+            CHECK(Near(c2.peak, c.peak) && c2.starts == 2, "and the same after a long rumble (%f)", double(c2.peak));
+            CHECK(c.playedMs >= 6.0f * frame + float(kKnockReleaseMs) - frame, "and it lasts as before: %.0f ms", double(c.playedMs));
+        }
+
+        // A steady request is followed within a step, and holds still.
+        Knock s;
+        CHECK(s.Step(0.0f, frame) == Action::None && !s.playing, "nothing asked: nothing");
+        CHECK(s.Step(0.40f, frame) == Action::Start && Near(s.level, 0.40f), "a rumble starts it");
+        CHECK(s.Step(0.41f, frame) == Action::Change && Near(s.sent, 0.41f), "a stronger one is followed");
+        CHECK(s.Step(0.41f, frame) == Action::None, "the same: nothing to say");
+        CHECK(s.Step(1.0f, frame) == Action::Change && s.level < 1.0f, "a knock on top rises at the attack, in place");
+        CHECK(Knock::Magnitude(1.0f) == int16_t(std::lround(kKnockGain * 32767.0f)) && Knock::Magnitude(0.0f) == 0 &&
+                Knock::Magnitude(2.0f) == Knock::Magnitude(1.0f),
+            "a full rumble is kKnockGain of the sine's largest magnitude");
+        CHECK(std::abs(Knock::Magnitude(RumbleStrength(65535, 65535, 50)) * 2 - Knock::Magnitude(1.0f)) <= 1,
+            "Force Feedback 50%% is half the swing");
+    }
+
+    // Usable at compile time (constexpr), as hid/key_map.h's rules are.
+    static_assert([] { Pedal p; p.Start(32767, -32768); return p.Value(32767) == 0.0f && p.Value(-32768) == 1.0f; }(),
+        "constexpr pedal");
+    static_assert(Resolve(std::array<bool, 4>{ true, false, false, false }, hat::Up, kLogitechButtons).buttons ==
+        (button::A | button::DpadUp), "constexpr buttons");
+
+    printf("%s (%d failures)\n", g_failures ? "FAILED" : "passed", g_failures);
+    return g_failures ? 1 : 0;
+}
diff --git a/tests/write_watch_test.cpp b/tests/write_watch_test.cpp
index c1c77df..7525bd1 100644
--- a/tests/write_watch_test.cpp
+++ b/tests/write_watch_test.cpp
@@ -6,12 +6,13 @@
 //     -Itools/XenonRecomp/XenonUtils -Itools/XenonRecomp/thirdparty/simde tests/write_watch_test.cpp
 //     runtime/kernel/write_watch.cpp runtime/cpu/guest_time.cpp -o build/write_watch_test
 //   build/write_watch_test
-// Started without NFSMW_WATCH_SUBPAGES (whose default differs by platform),
-// it runs itself with it at 0 (a write fault marks every guest page of its
-// host page, as before) and at 1 (in use only where host pages are over 4 KB:
-// a 4 KB host, where a host page is a guest page, checks the old rule both
-// times); with it set, it runs once. Physical memory
-// is mapped as the runtime maps it (three windows of one shared object), and
+// Started without NFSMW_WATCH_SUBPAGES, it checks the default (in use where
+// host pages are over 4 KB, never on 4 KB hosts), then runs itself with it at
+// 0 (a write fault marks every guest page of its host page, as before) and at
+// 1 (in use only where host pages are over 4 KB: a 4 KB host, where a host
+// page is a guest page, checks the old rule both times); with it set, it runs
+// once. Physical memory is mapped as the runtime maps it (three windows of one
+// shared object), and
 // SIGSEGV and SIGBUS go to HandleFault as main.cpp sends them. Under a second.
 #include <stdafx.h>
 #include <kernel/write_watch.h>
@@ -717,9 +718,21 @@ int main(int, char** argv)
     writewatch::Initialize();
     if (std::getenv("NFSMW_WATCH_SUBPAGES"))
         return Run();
+    // Unset, it is in use exactly where a host page holds 2 to 32 guest pages
+    // (16 KB on Apple and some Android and Linux hosts), never on 4 KB ones.
+    int result = 0;
+    bool wanted = s_hostPage > kGuestPage && s_hostPage <= 32 * kGuestPage;
+    printf("host pages %zu KB, NFSMW_WATCH_SUBPAGES unset: %s by default\n", s_hostPage / 1024,
+        Stats().subpages ? "in use" : "not in use");
+    if (Stats().subpages != wanted)
+    {
+        printf("  FAIL: by default it should be %s on %zu KB host pages\n", wanted ? "in use" : "off", s_hostPage / 1024);
+        result = 1;
+    }
+    printf("\n");
+    fflush(stdout);
     // Off and on, each in a process of its own (the variable is read once, at
     // static initialization).
-    int result = 0;
     for (const char* value : { "0", "1" })
     {
         setenv("NFSMW_WATCH_SUBPAGES", value, 1);