Docs: update screenshots and videos

FrameBridge (libopenxr_loader_generic.so, arm64-v8a + armeabi-v7a) rebuilt from the merged adapter sources: rect_clamp empty rects (#293), alpha_blend_emul (#329), foveation storage under Valve's FDM (#303), profile_remap profile report + detached-controller paths (#327/#328), action_dedup (#323), quad/cylinder snapshots, refresh-rate answer (#306), hide_fb_foveation (#349). The other targets rebuild to the committed bytes.

.gitignore

@@ -19,6 +19,8 @@ CLAUDE.local.md
 # outputs of `frameport report` / `parity` / ruff
 REPORT.md
 .ruff_cache/
+.eval-home/
+.eval-results/
 .claude/worktrees/
 
 # project page (site/)

CLAUDE.md

@@ -6,6 +6,7 @@ FramePort ports Meta Quest standalone APKs to the **Valve Steam Frame** (SteamOS
 install over SSH (agent) → Steam shortcut → headless launch test + log triage`.
 
 Read `docs/PLAYBOOK.md` (symptom → fix) before debugging a game, and `docs/FRAME_RUNTIME.md` for runtime facts.
+Detailed device findings per game/issue: docs/DEVICE_NOTES.md (read before debugging a game).
 
 ## Layout
 - `src/frameport/` — Python package. `pipeline.py` is the API the CLI (`cli.py`) and GUI (`ui/`, Flet 1.0) share.
@@ -123,8 +124,9 @@ Read `docs/PLAYBOOK.md` (symptom → fix) before debugging a game, and `docs/FRA
     `ft.AnimatedSwitcher` (`app._show_view`): a new route gets a new wrapper (150 ms fade), a same-route redraw swaps
     the wrapper's content (no animation; persistent views just remount); the wordmark's portal (`wordmark().data`)
     pulses once when frame_state turns "connected"; both off with setting `ui.reduce_motion` (Settings → Appearance
-    "Reduce motion", `app.reduce_motion`). Settings has a fixed index column (`settings.SECTIONS` order, Appearance
-    first, Remove FramePort last): entries scroll the section column via `scroll_to(scroll_key=…)` (sections wrapped
+    "Reduce motion", `app.reduce_motion`). Settings has a fixed index column (`settings.SECTIONS` order: most users'
+    needs first (Updates, which also holds game recipe + install-link updates, Installing, Library folders,
+    Appearance), niche ones later (Install links, Tools, This PC), Remove FramePort last): entries scroll the section column via `scroll_to(scroll_key=…)` (sections wrapped
     in Containers with `ft.ScrollKey`), the header stays; `app.settings_view.show_section(key)` (ui_smoke
     `settings-index`).
     Help hints: wording for non-obvious terms lives in `ui/help.py` (`HELP`); show it with `C.help_icon(key)` or the
@@ -138,6 +140,7 @@ Read `docs/PLAYBOOK.md` (symptom → fix) before debugging a game, and `docs/FRA
     uploads are interruptible (Cancel checked per MiB) and resumable (big files via SFTP `.part` append, small files
     streamed in tar batches; the agent counts files already in `incoming/`). Multi-select in the Library queues
     installs after asking every needed question up front. Failures end in one pop-up (Resume / Uninstall / log).
+  - Library folders (GitHub discussion #351): `core/folders.py` (no Flet) owns setting `scan.roots` (remember/add/remove/status/rescan_roots; the origin-based fallback only while the setting was never set, so removing every folder doesn't guess them back), Settings → Library folders (`settings.library_folders`, status read via run_bg), CLI `frameport folders [--add/--remove/--json]` + `frameport rescan`. Scans relink moved games (`pipeline.ScanReport`: a library game found elsewhere whose own files are gone and the copy is the same build (Quest: source_sha256, else versionName; Rift: same program path + size from the fingerprint, matched by game id or, renamed, by program) → only paths change (`relink_quest`/`_relink_rift`), user fields/builds/installs stay; another version → Scan a folder… takes it via `replace_apk(found=)`/`replace_rift_game`, Rescan only reports it; the old copy still there → kept). `add_game` no longer overwrites a user recipe (refreshes `suggested` only). Linux apps aren't scanned. PC installs of a moved Rift game (Steam shortcut path) untested.
   - Other drives (GitHub #90, agent v63): anchors stay in ~/Applications/quest-frame, a game's files may live in
     `<mount>/FramePort/<pkg>` (`deployment.json` base). Agent `drives` (/proc/mounts, /run/media + Steam library
     drives; vfat/exfat/ntfs/read-only refused), prepare*/finalize_linux `dest` (unmounted = error, never a fallback;
@@ -146,23 +149,6 @@ Read `docs/PLAYBOOK.md` (symptom → fix) before debugging a game, and `docs/FRA
     `launcher` field, else text swap), list_installed `drive`/`drive_missing` (install_state keeps such games
     "installed"). PC: `install/drives.py`, library setting `install.drive` (Frame page → Storage), game menu
     "Move to…" (job kind tool-frame), CLI `frame drives`/`frame move`/`install --dest`. Untested on the device.
-  - **Quest games on this PC via AXRB** (experimental, branch `worktree-pc-android-axrb`, docs/PC_ANDROID.md): the
-    "This PC" target (`PcReviveTarget`) installs APKs through `targets/pc_android.py` + `tools/axrb.py`. AXRB
-    (Android-XR-Bridge/AXRB, Windows: x86_64 Android 16 emulator + libndk_translation + its own OpenXR runtime →
-    `axrb-host-bridge.exe` → SteamVR) is downloaded only on first use (`AXRB-Setup-<v>.exe /S`, SHA256SUMS, per user
-    → `%LOCALAPPDATA%\Programs\axrb-launcher`), never bundled/modified (host code: AXRB Source-Available License).
-    Its runtime setup lives only in AXRB's Electron JS, so FramePort repeats it (pins read from the installed
-    `app.asar` `core/components.json`, AVD `axrb-managed-api36` port 5584, adb `-P 5038`, receipts `ready.json`/
-    `license-acceptance.json`, so AXRB's own launcher shares it). Spike 2026-10-10 (headless): **unconverted APKs
-    abort** (Meta platform loader) → PC build = OVRPort patches + `Patch.on_pc` APK fixes (`base.pc_selection`,
-    `build(pc=True)`, library `build_pc`, `pc_recipe_fingerprint`); Lucky's Tale ran a full OpenXR session in AXRB's
-    runtime; Pinball FX VR crashed in gfxstream vkAllocateMemory (AXRB's layer). SteamVR can't stand in for a headset
-    (null driver: no D3D11 adapter; vrlink without a Frame: no instance) → frames need the owner. Play = Steam
-    shortcut `powershell.exe -File %LOCALAPPDATA%\FramePort\axrb\fp-axrb-run.ps1 -Package …` → AXRB's
-    `run_windows_game.ps1`; all such shortcuts share Exe, so agent v71 `upsert/remove_shortcut(options_key=
-    "-Package <pkg> ")`. AXRB scripts start through WMI (`axrb.spawn_detached`): QEMU/adb inherit any handle, and
-    even /dev/null through WSL interop kept the call hanging; PowerShell 5.1 `*>>` logs are UTF-16 (`read_log`). Triage
-    `kind: axrb`. Full uninstall in AXRB deletes OBB + saves; a signature change needs one.
   - **PC VR repacks are pre-patched to run directly** (proven: Rick and Morty, Vader Immortal run when the exe is
     launched directly; Revive breaks them). So Rift games default to `as_is` = install the copy unchanged and launch
     the exe directly (`pcvr.xr_timefix` for the Frame OpenXR-1.1→1.0 fix, `pcvr.no_crash_reporter` for Unreal).
@@ -240,6 +226,13 @@ Rick and Morty runs on the Frame via its catalog recipe (OpenVR, no Revive),
     store matches and links then only update `auto_title`; a locked name gets no twin suffix); `sync_title` → Frame
     agent v77 `rename` (deployment.json title, same shortcut appid: upsert matches by Exe) + art + one Steam restart, PC
     `PcReviveTarget.rename`; an unreachable Frame → `steam_name_stale` (game page "Update name on Frame", next install).
+  - Newer versions (GitHub #161): game menu "Update with a newer APK…" (`pipeline.replace_apk`, outdated via
+    `build.source_version`) and, for Linux apps / PC VR games, "Update with a newer version…" (`replace_linux_app` /
+    `replace_rift_game` via `add_linux_app(replace=)` / `add_rift_game(replace=)`, CLI `frameport new-version`): the
+    entry keeps package, name, art, tags, switches, user recipe (a confirmed exe if the new folder has it); a new
+    `source_id` goes into the deployment's `recipe` dict at install (no agent change) → `C.source_replaced` = outdated
+    (Frame + `pc_outdated`); such an install re-sends same-size files changed after the last install (mtime/ctime,
+    `installer.changed_since`); the old Rift folder is in `replaced_dirs` (rescans skip it). Untested on the device.
   - `Recipe.as_is` = install unchanged (pre-patched libraries): `pipeline.prepare_as_is`; auto for APKs that already
     contain FrameBridge (`frame_patched`). For Rift it changes nothing (the dump is never modified; the Frame copy
     still gets launch fixes like the crash-reporter rename — `-nocrashreports` alone doesn't stop UE 4.23) — it does
@@ -251,6 +244,14 @@ Rick and Morty runs on the Frame via its catalog recipe (OpenVR, no Revive),
     flask icon (SCIENCE_OUTLINED) so they aren't confused with Play.
   - `uninstall.py` + `frameport uninstall-app` + Settings: removes the data dir (after an optional key backup zip),
     PC Steam shortcuts, the WSL Revive copy, and via agent `purge` FramePort's games/files on the Frame.
+  - Save backups (discussion #352, agent v95; docs/FRAME_RUNTIME.md "Save backups"): agent `_backup_saves`/
+    `_restore_saves '<json>'` stream a tar.gz of `lepton-data/internal/<pkg>` + `external/Android/data/<pkg>` (caches,
+    IL2CPP/shader caches, FrameBridge files, videos/OBBs, files >64 MiB left out; manifest `frameport-saves.json` last)
+    over the exec channel, file work in `podman unshare` (`_saves_ns`), launch lock held, refused while running;
+    restore = untrusted input (staged + checked first), rollback copy `<base>/saves-before-restore.tar.gz` (undo =
+    `rollback: true`). PC `install/saves.py` (`<data>/save-backups/<pkg>/<ts>.tar.gz` + `.json`, keep `saves.keep`
+    = 10), GUI `ui/views/saves_dialog.py` (game menu section "Saves", Frame page "Back up all saves", uninstall's
+    "back up before deleting"), CLI `frameport saves backup|list|restore|undo`.
   - `patches/` — **the unit of modularity**. `base.py` (Patch interface, registry), `overport.py` (overport CLI patch ids,
     discovered dynamically via `overport patches`), `frame/*.py` (one module per Frame fix), `settings.py` (FrameBridge
     adapter keys + device files as patches). Add a patch = add a module that calls `register(...)`.
@@ -284,6 +285,15 @@ Rick and Morty runs on the Frame via its catalog recipe (OpenVR, no Revive),
     `working-config.yml` issue → maintainer label `catalog-accepted` (a plain issue needs `working-config` added by
     hand) → `catalog-from-issue.yml` workflow (`scripts/catalog_from_issue.py` validates) opens a catalog PR. App log:
     `core/applog.py` (`<data>/logs/app.log`, finished GUI jobs in `<data>/logs/jobs/`).
+  - Announcements (2026-10-15, announcements/README.md; app only, the owner dropped the site pop-up): source of
+    truth `announcements/current.md` on `main` (front matter id/title/date + optional image/image_alt/button+url/
+    expires/active, Markdown body; ships `active: false`). `announcements.py` (no Flet; raw GitHub via
+    `cache.cached_text`, 6 h) + `ui/announcer.py` (pop-up 20 s after start / every 6 h when no dialog is open and not
+    on welcome; `C.dialog` with the portal edge, image downloaded + Pillow-checked into `<data>/announcements/`, shown
+    by asset URL). Shown only if the user was around before `date` (setting `announce.since`, set once at the GUI's
+    first start: 0 when `USED_BEFORE` settings exist, else now), once: any close (X, outside click, Escape, button)
+    stores the id (`announce.dismissed`, last 50). New announcement = new id; same id = typo fix.
+    `FRAMEPORT_NO_ANNOUNCEMENTS`; `ui_smoke.py --announcement` renders it.
   - Self-update (docs/ARCHITECTURE.md "Self-update", docs/INSTALL.md "Updating"): `_version.py` = the only version
     (`frameport.__version__`; pyproject reads it via hatch `dynamic`; app log, diagnostics, User-Agent, Settings use
     it — never `importlib.metadata`, bundles have no dist-info). `updates.py` (no Flet): `check()` = GitHub
@@ -350,45 +360,7 @@ Rick and Morty runs on the Frame via its catalog recipe (OpenVR, no Revive),
   `a32_bridge_on` turned the bridge on once in every 32-bit recipe, user ones too, unless the catalog's frame_remove
   names it).
   Analysis `extra.headset` (ANALYSIS_VERSION 15): gearvr / go / quest → "Gear VR" / "Oculus Go" platform + Steam tag.
-  Catalog: `headset:` field; com.fallen.affected, net.mobilemischief.spunkydungeon, com.ccpgames.gunjack (works, 2026-10-12). Learned: Unity 2019 contexts
-  have no EGLConfig (EGL_KHR_no_config_context: the VrApi bridge takes the window's or an RGBA8 ES3 config); Unity's
-  floor origin = vrapi_SetTrackingSpace(1) (the VrApi bridge now honours LOCAL_FLOOR/STAGE); mapped GL buffers are
-  per buffer object (a per-target guest copy leaked ~10 MB/s and garbled vertices); the guest runtime's own scudo
-  names its maps `[anon:scudo:*]` below 4 GiB (watch them for guest leaks). The Go controller = the right Frame
-  controller (stick = touchpad touch, sideways > 0.6 or press = click). Gunjack (CCP, UE 4.10 NativeActivity, Gear VR,
-  2026-10-10): needed the native_app_glue imports (ALooper/AInputQueue/AConfiguration/AAsset*, imports.txt), an arm64
-  libvrapi.so for Java's System.loadLibrary("vrapi") and MOUNTED under OVP_HEADLESS_TEST; it then loads its map and
-  quit on purpose: AndroidMain compares AndroidThunkCpp_GetSignature() with an obfuscated copy. **Works since
-  2026-10-11 (owner-verified in the headset):** GameActivity.AndroidThunkJava_GetSignature() = Base64.DEFAULT(SHA-1(
-  signing certificate DER)) (jadx); `a32_bridge.original_signature` computes it from the original APK's
-  META-INF/*.RSA|DSA|EC, `convert()` stores it as `assets/fp_a32_signature.txt` for libUE4.so games, the bridge loads
-  it at activity creation (native_activity.c) and jni.c answers Call*Method on the method ID of
-  `AndroidThunkJava_GetSignature()Ljava/lang/String;` with it. After loading, Unreal leaves VR mode and enters it again on
-  the same GL context; a second OpenXR session there aborted in vrclient (CSharedSemaphoreLinux::WaitFromGPU from the GL
-  binding's PreBeginFrame, also with OVP_HEADLESS_TEST) → the VrApi bridge keeps a running GLES session across
-  LeaveVrMode and reuses it for an EnterVrMode with the same context (upstream-patches/runtime.cpp.patch).
-  Debugging aids added: A32_BREAK=<guest addr>[,..] (stack of the first hits; guest libs load at fixed addresses, e.g.
-  libUE4 0xf25d5000), A32_STRACE in bridge mode = path/exit calls to logcat, activity lifecycle + LeaveVrMode caller
-  logs. Lepton's logcat mirror often dies for these games: read `podman exec <container> logcat` instead. Gunjack input
-  (2026-10-11): it imports no vrapi input functions and reads the Gear VR touchpad/back as AInputEvents from its
-  AInputQueue (native_app_glue), so dispatchKeyEvent never reached it (no control at all) → input.c queues synthetic
-  events there (ALooper_poll* return the queue's ident while one waits; AInputQueue_getEvent/finishEvent and the
-  AInputEvent/AKeyEvent/AMotionEvent getters are hand-written "!" imports that know them; touch positions scaled to the
-  window size). Same mapping as AFFECTED: trigger = hold touchpad, A = tap, right stick = swipe, B = back; for NativeActivity games the stick's up/down = swipe forward/back (touchpad X: Gunjack's OnFlick = reload at ~0°, special weapon at ~180°). Not yet
-  headset-verified. Quest builds on the bridge (2026-10-13, Sports Scramble = a 32-bit Santa Cruz build,
-  UE 4.21 + OVRPlugin on VrApi 1.21): manifest requires `android.hardware.vr.headtracking` version 1
-  (`detect.requires_6dof`, headset "quest", ANALYSIS_VERSION 16) → convert writes `assets/fp_a32_headset.txt`
-  = "quest" → vrapi.c `quest_touch` (read in vrapi_Initialize via the activity's AssetManager; A32_TOUCH=1/0
-  overrides) passes the 64-bit bridge's Touch controllers through (enumerate/caps/state/tracking/haptics, struct
-  tails per VrApi minor) and starts no synthetic input. It also needed AAsset_getBuffer (guest copy, freed in
-  AAsset_close), AKeyEvent_getFlags and the other AConfiguration getters. Headset (owner, 2026-10-13): plays,
-  both controllers work. Recenter (holding the Frame's menu button) turned VrApi games ~90-120 degrees aside: the bridge's app space is LOCAL + the start yaw and the runtime moves LOCAL to the head → the bridge now takes the origin from the head again on XR_TYPE_EVENT_DATA_REFERENCE_SPACE_CHANGE_PENDING (LOCAL) and on vrapi_RecenterPose (owner-verified with Gunjack, 2026-10-13). Next: the other 32-bit catalog games (Journey of the Gods, Shadow Point: still "unsupported" until
-  tested), translator speed. Profiled on the Frame
-  (2026-10-12, `A32_PERFMAP` + perf): FPCR switches are negligible (8 of 86k samples); the cost was the run loop
-  (a mutex + hash-chain walk on every dispatch, a contended counter, inline-lookup slots never refilled: Gunjack
-  ~45 % of its CPU) and `jit_invalidate` scanning every block on each Mono `cacheflush` (72 % of Spunky Dungeon's
-  main thread). Now lock-free lookups, ltab refill, per-thread flags, per-page block lists: Gunjack's dispatcher
-  23.6 % -> 1.6 %, CPU in the same phase about -55 %, still 72 fps.
+  Catalog: `headset:` field; com.fallen.affected, net.mobilemischief.spunkydungeon, com.ccpgames.gunjack (works, 2026-10-12). Per-game a32 findings (AFFECTED, Spunky Dungeon, Gunjack's signature check `fp_a32_signature.txt`, synthetic Gear VR input, Quest builds `fp_a32_headset.txt` / `quest_touch`, recenter, debugging aids `A32_BREAK` / `A32_STRACE` / `A32_PERFMAP`, translator profiling): docs/DEVICE_NOTES.md#a32-bridge-games-lessons-debugging-aids-profiling.
 - `scripts/` — `package.py` (flet build/pack), `eval_heuristics.py` (score heuristics), `ui_smoke.py` (GUI screenshots).
 - `docs/` — PLAYBOOK, FRAME_RUNTIME, ARCHITECTURE, INSTALL (end users), parity reports (offline + device).
 
@@ -476,6 +448,9 @@ Repo is on an NTFS drive (`core.fileMode=false`); line endings are LF (`.gitattr
   XR_KHR_composition_layer_equirect2/cylinder, XR_FB_composition_layer_image_layout (flip emulated by Vulkan blit).
 - `xrConvertTimespecTimeToTimeKHR`/`xrConvertTimeToTimespecTimeKHR` return FUNCTION_UNSUPPORTED → adapter emulates
   (offset = predictedDisplayTime − period − CLOCK_MONOTONIC, sampled in xrWaitFrame).
+- No XR_FB_display_refresh_rate (`xrGetDisplayRefreshRateFB` -7), yet OVRPort's dispatcher offers it and answered 0 Hz
+  → FrameBridge always answers with the measured rate (1/predictedDisplayPeriod, else 72). PreyVR (#306, idTech 4:
+  `USERCMD_MSEC = 1000 / GetRefresh()`) had 0 ms tics: async thread spinning, `com_frameTime` stuck at 0, menu black.
 - Guardian STAGE bounds report 1×1 m (scene emulation uses ≥1.5 m).
 - GL goes through **Zink** (Mesa GL on Vulkan). Mesa GLSL is strict: `#pragma` before `#extension` fails, implicit
   int/float conversions fail (enable `GL_EXT_shader_implicit_conversions`), num_views=2 shaders on single-view FBOs
@@ -545,28 +520,14 @@ Launch tests ignore log files older than the launch (stale Proton/game logs used
 (`\\wsl$` is unreliable), so PC mode copies Revive to `%LOCALAPPDATA%\FramePort`.
 FramePort never bypasses Oculus entitlement checks (Platform SDK games: flagged, PC mode with the Oculus app only).
 
-**Upload speed (measured 2026-09-29):** via the home router (PC Wi-Fi → router → Frame wlan0) only 15-18 MB/s, the
-same for paramiko, OpenSSH and 4 parallel streams, so the network path is the limit, not the SSH code. Direct to the
-Frame's hotspot (`wlanap` 10.35.78.1; the owner's PC has Valve's USB Wi-Fi dongle on it) 83 MB/s OpenSSH / 97 MB/s
-paramiko; reading dumps from D: via WSL drvfs is then the cap (~82 MB/s). `Frame.fast_link()` (installer
-`transfer_link`, uploads ≥64 MiB) uses usb0 > wlanap when reachable **and** the host key matches the paired Frame.
+**Upload speed:** home Wi-Fi caps uploads at ~11-18 MB/s whatever the SSH method; the Frame's hotspot (`wlanap`) ~83-97 MB/s; `Frame.fast_link()` (installer `transfer_link`, uploads ≥64 MiB) prefers usb0 > wlanap when the host key matches. → docs/DEVICE_NOTES.md#upload-speed
 **Platform SDK detection** must include delay imports (`PEInfo.delay_imports`), modular Unreal's
 `*-OnlineSubsystemOculus-*.dll` and Ready At Dawn's `pnsovr.dll`: Robo Recall, Lies Beneath and Lone Echo I/II all use
 it; without the Oculus app they crash with 0xc06d007e (triage `delayload-missing`) — not fixable legitimately.
 GUI: Frame → Installed → folder icon = file browser (agent `list_files`, flags files missing vs the install
 manifest); Settings → About shows the bundled agent version and the Frame's.
 
-**Revive under Proton arm64 (Lone Echo, 2026-09-29):** Revive's Detours hooks (LoadLibraryW/ExW, OpenEventW, the
-signature check) don't take effect: Wine's kernelbase is ARM64EC. The LibOVR shim in the game then does a plain
-`LoadLibrary("LibOVRRT64_1.dll")` search (exe dir, cwd, system32, windows, PATH — no registry, `OculusBase` or
-`LIBOVR_DLL_DIR` used by this build) → `Failed to initialize Oculus API (-3001)` (= Lies Beneath's "Unable to load
-LibOVRRT DLL"). A symlink `pfx/drive_c/windows/system32/LibOVRRT64_1.dll -> <base>/revive/LibReviveXR64.dll` (Wine
-maps a symlink to the already-loaded module) gets past it to **-3021 = ovrError_LibSignCheck**: the shim only accepts
-an Oculus-signed runtime. Next step (not done): make the runtime check pass without Detours, e.g. an injected helper
-that patches the game's import table (IAT) for LoadLibrary*/WinVerifyTrust, or a prefix-level override. This is
-runtime interop (what Revive does), not the Platform SDK licence check (which FramePort never touches).
-Uninstall (Quest, saves kept) used to leave `deployment.json` → still "installed"; fixed (agent v16).
-
+**Revive under Proton arm64:** Revive's Detours hooks don't take effect (Wine's kernelbase is ARM64EC); a system32 `LibOVRRT64_1.dll` symlink gets past -3001 to -3021 = ovrError_LibSignCheck (Oculus-signed runtime required; not bypassed). → docs/DEVICE_NOTES.md#revive-under-proton-arm64-lone-echo
 **Discovery/network:** Developer-Mode SteamOS devices announce `_steamos-devkit._tcp` (TXT `login=steamos`) — use it;
 they don't publish `_ssh._tcp`. The Frame has several links: `wlan0` (home Wi-Fi), `wlanap` = its own hotspot at
 10.35.78.1/24 (a PC can join it directly), `usb0` = USB gadget network 10.86.200.233/29 (up when cabled to a PC).
@@ -580,23 +541,7 @@ stopping Steam kills them → always run that work via `systemd-run --user` (the
 **overport:** always `--version=latest`; `--workspace` holds runtimes and **per-package keystores (password
 "password", alias "key") — never lose them**: updates must be signed with the same key or saves are lost on reinstall.
 Output is deterministic (same input + runtime → same bytes), which is what makes parity testing possible.
-**OVRPort 1.2.5 (2026-10-01, the fork's first release; CLI-only):** same commands (`patches [--json]`, `patch`, `help`,
-`install`), but `patch` rejects unknown/duplicate args, unknown patch ids and an empty `--patches=`
-(`tools/overport.patch` refuses empty lists). After patching it adds `libovrplatformcompat.so` itself when the platform
-loader lacks `ovrMessageType_ToString` (our `frame.ovrplatformcompat` then skips: same library). New patches (all off;
-`patches/overport.py`): `patch_ac_nexus_no_appsw_72/_90` (AC Nexus build 207706 only, exclusive),
-`patch_disable_meta_xr_audio_telemetry` (x86_64 emulators: hidden), `patch_vrapi_openxr` = OVRPort's VrApi adapter =
-the **unpatched** upstream of our `frame.vrapi_bridge` (`native/vrapi` unchanged since our 5e7df52), only usable with an
-experimental CLI built with `-PwithVrApi=true` (stable jars list it but fail). The owner prefers OVRPort's fixes over
-ours where they work as well (less to maintain): compare in the headset before switching a default.
-`frameport install <pkg> --apk <file>` installs a specific (test) build signed with the game's key.
-Headset results (2026-10-02, `PATCHED/_test-ovrport-1.2.5/TESTING.md`): OVRPort's own VrApi translator fails on the
-Frame (Climb 2: requests VkFormat 37 → crash; POTW: no GLES path, missing `vrapi_GetTextureSwapChainHandle`) → keep
-`frame.vrapi_bridge`; those two changes are upstream candidates. 1.2.5 builds (its platform compat, new permissions)
-work. AC Nexus: `patch_ac_nexus_no_appsw_90` is the catalog default (owner preferred 90 Hz); `STRICT` patches are only
-taken from a catalog recipe where `applies()` holds (the AC Nexus ones need build MAIN.450412.207706.final, else the
-whole overport run fails).
-
+**OVRPort 1.2.5 (2026-10-01):** `patch` rejects unknown/duplicate args, unknown ids and an empty `--patches=`; it adds `libovrplatformcompat.so` itself (`frame.ovrplatformcompat` then skips). New patches `patch_ac_nexus_no_appsw_72/_90` (AC Nexus build 207706 only; `_90` = catalog default; STRICT patches only from a catalog recipe where `applies()` holds), `patch_disable_meta_xr_audio_telemetry`, `patch_vrapi_openxr` (OVRPort's VrApi translator fails on the Frame → keep `frame.vrapi_bridge`). The owner prefers OVRPort's fixes over ours where they work as well. `frameport install <pkg> --apk <file>` installs a test build. → docs/DEVICE_NOTES.md#ovrport-125
 **Patching gotchas:**
 - UnityPy re-serialization breaks scene loading → patch QualitySettings ints in place.
 - LIEF's DT_NEEDED injection shifts segments; our `elf.add_needed` appends a new PT_LOAD (reuses PT_NOTE, else moves the
@@ -608,414 +553,64 @@ whole overport run fails).
 - VrApi-direct engines (CryEngine Climb 2, POTW) need the VrApi bridge; the bridge drops whole frames on unknown layer
   types (→ black screen with audio).
 
-**Steam Frame controller models (2026-09-30, not yet seen in a game):** adapter setting `controller_models`
-(`native/adapter/render_model.c`) emulates XR_FB_render_model and serves `files/framebridge/controller_{left,right}.glb`;
-agent v20 (`install_controller_models`, command `controller_models`) converts the Frame's SteamVR render models
-(folder name matching "frame" + left/right, OBJ+PNG, `openxr_grip` component → grip space) at finalize/set_settings.
-Valve's models are never committed or copied off the Frame. Only games that use Meta's runtime controller models
-benefit (manifest `RENDER_MODEL` permission/feature → suggested); **none of the 34 catalog games do** (they ship their
-own meshes: that would need per-game asset replacement). Model discovery and conversion
-checked on the device 2026-09-30: `/opt/steamvr/drivers/frame_controller/resources/rendermodels/frame_controller_{left,right}`
-(component OBJs in model space = the whole `<name>.obj`, one `_color.png` 2048² near-black, `openxr_grip` rotates about
-X only; hidden-by-default components like `status` are skipped) → ~2 MB glb each, ~1 s. Not yet seen in a game (none
-of the installed builds has the new adapter, and none requests runtime models), so whether Meta's SDK attaches runtime models at the grip pose is unverified.
+**Steam Frame controller models:** adapter setting `controller_models` (`native/adapter/render_model.c`, emulates XR_FB_render_model) + agent `install_controller_models` (Frame's SteamVR models → glb at finalize); no catalog game uses runtime models; Valve's models are never committed or copied off the Frame. → docs/DEVICE_NOTES.md#steam-frame-controller-models
 **overport's dispatcher (`libopenxr_loader.so`) only forwards functions in its own table** (`overportOXR: Unknown
 proc addr: …`), so adapter emulations of functions it doesn't know are unreachable. For XR_FB_render_model,
 `native/xrshim` fills the gap: OVRPlugin's `dlopen("libopenxr_loader.so")` string is rewritten to the shim (see
 native/README). Verified on the device with Toy Master (2026-09-30): `extension shim: xrLoadRenderModelFB -> FrameBridge`.
 Toy Master doesn't request a model after that (it uses its own), so the glb loading path is only unit-tested.
 
-**Crash backtraces (2026-09-30):** Lepton writes tombstones only to `lepton-logcats/steamlaunch-<appid>/logcat-crash.log` (after "Dumping logcat"), not launch.log; agent v23 launch tests wait for it and return `crash_log`, triage gets it via `triage(..., crash=)` (not pid-filtered: tombstones come from crash_dump's pid). The guest is `userdebug` (`ro.debuggable=1`), so Lepton's Fossilize layer loads into every app whatever the APK's debuggable flag; it has no off switch. Fossilize crashed Deadpool VR on uninitialized attachment-reference pNexts (several, in FVulkanRenderPass and the render-target layout) → `frame.vk_sanitize` = `native/vkshim` (engine's `dlopen("libvulkan.so")` string → `libfp_vk.so`, wraps vkCreateRenderPass2/KHR, drops unreadable/wrong-sType pNexts; verified: game runs). overport's dispatcher aborts on swapchains > 4096 px (`cmp wN,#4096` in xrCreateSwapchain) → `frame.swapchain_limit` (verified with 4XVR, 7680×3840 accepted by the runtime). Both are default-on (parity classifies their rewrites as
-"expected"; library migration `quest_binary_fixes_v2`). The adapter shows cylinder layers (4XVR's movie screen) as ~15° quad strips (`cylinder_strips`, setting
-`cylinder_strips`); the runtime composites them at full resolution. Equirect (360°) layers are dropped: drawing
-them ourselves (GLES renderer in xrEndFrame: stutter, never showed 4XVR's VR video; Vulkan renderer: hung the
-Frame's GPU in AC Nexus; reading the newest *released* image broke 4XVR's theatre) was removed again on the owner's
-request — don't retry without a new approach. Converted layers must count as "swapped" or the original layer list
-is submitted (runtime returns -2 for every frame). A focus debounce (hiding the Frame's brief
-FOCUSED→VISIBLE→SYNCHRONIZED dips, which make 4XVR recenter) was also removed: AC Nexus stayed black with it (it
-hid 521 ms focus changes at start). The new approach (below) is per-game, off the app's render thread, GLES-only.
-
-**360° layers / 4XVR (2026-09-30):** the Frame's Android SteamVR runtime (`/opt/steamvr/bin/androidarm64/vrclient.so`,
-mounted in Lepton as `/data/steamvr/runtime`) only composites quad + projection layers (cube/cylinder/equirect(2)
-are enum names only) — nothing to unlock. Per-game adapter settings (off by default, hooks installed only when on):
-`equirect_emul` (GLES only: a worker thread with a shared EGL context converts each 360° image to a cube map when it
-changes and draws one adapter projection layer from it for every frame with exactly that frame's views (the app's own
-projection views, else xrLocateViews at displayTime); xrEndFrame waits ≤6 ms for the worker's CPU submit, never the
-GPU. Learned in the headset: quads can't be a background (the Frame draws quad layers above all projection layers
-whatever the order: hid 4XVR's balcony/controllers), and the Frame doesn't reproject a projection layer from its own
-pose (images drawn only after head turns, or ahead from xrWaitFrame and sometimes late, wobbled);
-`equirect_flip/face/res/fps/stereo`), `stable_local`, `focus_hold` (only after 3 s FOCUSED, dips <600 ms),
-`aim_pitch/aim_yaw/aim_forward`, `refresh_rate`, `layer_debug` (diagnostics); focus_hold is default-on since 2026-10-05. 4XVR re-creates LOCAL spaces every 2–4 s
-(menu recentring suspect); its theatres are baked 7680×3840 equirect2 images (`assets/100.png` …). Test 360° videos
-(NASA, public domain) are in the Frame's ~/Videos; copies in `~/Downloads/frameport-360`. 4XVR's "Internal Storage"
-lists its own `/sdcard/4XPlayer`, not Movies: agent v25 `link_media` hard-links sent files into an app's own top-level
-folder (`app_media_dirs`), `frameport frame send --app <pkg>`, GUI game page "Add videos" (players) / "Add videos &
-files…". A 4XVR webm stereo swapchain was refused with XR_ERROR_LIMIT_REACHED (-10) → right eye grey; our projection
-swapchain was halved (1536/eye) in case memory is the limit (unverified). Frame data snapshot
-(SteamVR runtimes, Lepton scripts, logs; never commit Valve binaries): `~/frameport-research/frame-data-2026-09-30/`.
-Not yet verified in the headset.
-
-**Companion apps / intents (2026-10-03, tested with Stremio + 4XVR):** a second APK can be installed into a running
-Lepton container (`podman exec -i lepton-steamlaunch-<appid> pm install -g -S <size> < apk`) and runs there, VR
-included (4XVR in Stremio's flatscreen container: FrameBridge 72 fps, settings via LEPTON_ENV_FRAMEBRIDGE_CONFIG). But
-Lepton's services.jar (`ActivityStarter.execute`) intercepts **every** `android.intent.action.VIEW` with data (any
-scheme, explicit component or not, no property to disable): it writes `steam://openurl/<uri>` to `/lepton/steam.pipe`
-(= the host Steam client's `~/.steam/steam.pipe`) and starts nothing. So "open in external player" hand-offs (Stremio
-→ 4XVR) can't work inside Lepton; don't retry without Valve changing it. Lepton installs exactly one `*.apk` per app
-folder (two break `get_apk_path`).
-**Text input (2026-10-03, verified in the headset with Stremio VR):** Lepton's Android has no IME (`ime list` empty)
-and runs VR apps headless (`lepton.headless=true`): no Android window has input focus (`dumpsys input` FocusedWindows
-empty), so neither `input text`, a USB keyboard nor Steam's keyboard reach the app. `lepton-show-flatscreen` on a VR
-app keeps VR working (FrameBridge 72 fps) and gives the window focus; Steam's on-screen keyboard then opens for text
-fields. Unity's TMP_InputField on non-Quest Android waits for the system keyboard (`TouchScreenKeyboardShouldBeUsed`)
-and deselects a frame later unless `isKeyboardUsingEvents` (Android: `InPlaceEditing() && m_HideSoftKeyboard`);
-uGUI InputField's LateUpdate keeps the field when `InPlaceEditing()`. Patch `frame.unity_text_input` rewrites them
-(`mov w0,#0|#1; ret`) at Cpp2IL's **Offset** (= file offset; RVA differs by 0x4000 in Stremio's lib), Cpp2IL
-2022.1 pre-release (Unity 6 / metadata v31; Il2CppDumper can't), cached per libil2cpp sha. `/dev/uinput` has an ACL
-for steamos (Steam Input) → agent v33 `_keyboard` uinput keyboard ("Type on Frame") reaches everything with focus.
-Installing a second APK into a container with `pm install` re-runs Lepton's post-install hook on the **main** app
-(`lepton.active_app_id`; moves its files to /data/steam_app) and corrupts it on the next start (fix: touch the APK →
-re-bake); `cmd_real package install` skips the hook.
-**User reports (2026-10-04, issues #4-#10):** Steam shortcuts go to the signed-in account (`loginusers.vdf`
-MostRecent) else every account (agent v35 `library_users`; it used to refuse with >1 account → Play gave Steam's "Game
-configuration unavailable"); `launch` uses the shortcut's own appid and errors `NOT_IN_LIBRARY`, the app then adds it
-and plays. Unity IL2CPP fixes share one Cpp2IL run (`unity_text_input.Il2cppReturnPatch`, `ALL_TARGETS`, cache keyed by
-global-metadata.dat): `frame.unity_runtime_msaa_off` (OVRManager raises MSAA to 4x at runtime: "Switching to the
-recommended level" → Lucky's Tale restarted the headset; `OVRDisplay.get_recommendedMSAALevel` → 0) and
-`frame.unity_multipass` (Oculus XR Plugin multiview → MultiPass via `OculusSettings.GetStereoRenderingMode`; I Am Cat's
-right eye grey). Both checked against Toy Master's Cpp2IL output, not yet in a headset. VR4 quits itself (System.exit
-after the intro movie) → catalog `use_alt`. **Catalog changes reach existing games** without hardcoded migrations:
-recipes store `catalog_rev` (= `CatalogEntry.rev()`), `library._follow_catalog` re-derives non-user recipes whose entry
-changed; a maintained entry beats the user's shared copy when its `updated`/verified date is later (`catalog._newer`).
-**Round 2 of reports (2026-10-04):** VR4's campaign hang = one fragment shader reading an uninitialized loop counter
-(reporter's capture): vkshim `vk_shader_fix` setting (`<size>:<sha256>:<offset>:<words>`, from the recipe's `adapter:`;
-matched by size + SHA-256, words inserted into a copy) — on the device the module is fixed at load ("fixed shader
-module (6488 -> 6512 bytes)"); campaign itself not yet seen in a headset by us. Text settings (kind "str") stay out of
-the Game settings dialog (saving it dropped them). I Am Cat: `GetStereoRenderingMode` is inlined (no call sites) →
-`Il2cppReturnPatch.field_loads` rewrites the field read in `OculusLoader.Initialize` (Cpp2IL gives the field offset,
-`field:<name>`); verified with Toy Master: eye swapchains array=1 ×2 instead of array=2. Builds record `recipe_fp`
-(`patches/base.recipe_fingerprint`, `Patch.revision`): a changed recipe or revised patch shows "Update on Frame".
-Remembered Frames are found again after an address change (`Frame.relocate`: scan, same SSH host key, before
-login). Packaged apps show artwork by file path (`thumbs.use_file_paths`, #16). Diagnostics: this boot's kernel log.
-Device tests of requested games (2026-10-04, headless): I Am Cat, Myst 3.3.0, BattleGlide, Blade & Sorcery: Nomad
-start (RUNNING, frames). Roblox: SIGSEGV in je_free from libroblox.so ~3 s in (likely its anti-tamper vs the re-signed
-APK). BONELAB (Unity 2021.3 Vulkan, OVRPlugin 1.94): SIGSEGV with pc == fault addr in vkCreateInstance, called from
-libSLZQuestNative.so's Vulkan hooks into an unmapped (unloaded) library right after OVRPlugin's pre-init
-xrDestroyInstance; pinning openxr/vrclient libraries (RTLD_NODELETE) did NOT help — find the unloaded library with the
-linker's dlopen/dlclose logging next. Accounting+ (Unity 2017.4 built-in Oculus, libOVRPlugin + libvrapi): Unity
-never starts VR on the Frame (no OVRPlugin/OpenXR lines; runs as a 2D app), which is why its "controller setup"
-screen can't be passed — Unity 2017's Oculus device check, not the controller profiles. Cpp2IL can't read Unity 2017.
-The Frame's Android runtime (vrclient.so) knows oculus/touch_controller but not Meta's Touch Plus/Pro profiles
-(OVRPlugin suggests those too, routinely) → adapter `profile_remap`.
-Headset round 2 (2026-10-04): the Frame drops focus often (ms to 7 s; only some are presence/standby) → games pause
-or recentre (B&S Player.OnVRPresence → Teleport, BattleGlide/Unreal pauses); focus_hold now 1 s focused / 1 s max dip
-(longer must still pause). Myst crash = vrclient xrSyncActions race after FOCUSED → `sync_guard` (confirmed); its
-object glitches: app space warp suspected (FB_space_warp is advertised and used) → recipe `patch_disable_space_warp`.
-I Am Cat multipass: poses/times consistent, but every frame is submitted after the next xrWaitFrame (one period late;
-Zink + doubled draws) and the game clamps its physics step to 10 ms → judder while still; testing scale 0.8. Roblox's
-newest crash is on Fossilize's recording thread → vk_sanitize extended to own-engine libs (engine "Other").
-Accounting+: unity_oculus_check + native/ovrpshim (libfp_ovrp.so waits via ovrp_WaitToBeginFrame before Unity
-2017's ovrp_Update2) → VR in the headset at ~72 fps (2026-10-04), but stuck at "press any button" although input
-reaches its OVRInput cleanly (probe: both Touch connected 0x63, individual buttons, input focus 1) → works with issues.
-"outside of frame bounds" warnings stay (~2/frame) and are harmless.
-Steam library (GitHub #4/#21/#27, agent v38): shortcuts go to every Steam account (signed-in first; MostRecent isn't
-always the account on the Frame); stop_steam also waits for Steam's helpers; after the restart the agent re-reads
-shortcuts.vdf and writes once more if Steam put its old copy back (`shortcuts_lost`); lost again (agent v89): Steam
-ignores FramePort's entries on that Frame, so `add_devkit_entry` adds the devkit entry instead (`added` gets `via:
-devkit`) and only reports an error if that fails too. 0.6.3's Play
-auto-repair (`_add_then_play`) crashed (its job got a Job, not a reporter). Uploads resume on a transient OSError.
-Lepton's Android 11 has no clipboard service (134 services; checked with `podman exec … service check clipboard`):
-SDL/LÖVE apps crashed at start → `frame.sdl_clipboard` (`apk/dex.py`: in-place dex edit, nops one invoke, fixes
-the header checksum/signature; verified with LÖVE for Android 11.5, GitHub #24 Dramatic Shape). Godot 4.2-4.4 (Kotlin `as ClipboardManager`,
-GitHub #134 EndoparasiticVR) → `frame.godot_clipboard` (nops the `Intrinsics.checkNotNull` before that check-cast; Godot's
-clipboard methods return at once; analysis `godot_clipboard`, ANALYSIS_VERSION 10; checked on real godot-lib/templates
-4.2.2-4.4.1, not on the device; 4.1 and 4.5+ don't throw). 2D apps (vr_kind none)
-keep every suggested patch that isn't about VR (`needs_vr = False`), not a fixed list. FramePort on the Frame:
-`frame/local.py` (127.0.0.1, own key authorized; "This Frame (experimental)"; app data in
-~/.local/share/frameport-app because ~/.local/share/frameport is the agent's) and Steam library changes wait while
-Desktop Mode is open. Verified on the device 2026-10-04 (install + launch test from the Frame). Library updates on the
-Frame run one at a time (agent v40 flock): two quick uninstalls used to bring a removed shortcut back (Roblox).
-Headset round 3 (owner's verdicts, 2026-10-04): Blade & Sorcery works — its freezes were the headset's wear sensor
-flickering off while worn (vrserver.txt "HMD off/on" 0.5-2 s) → per-game `focus_hold_ms=2500` (only this game reacts;
-not a default). BattleGlide works (focus_hold). Myst works with issues (object glitches; space warp ruled out, its
-recipe keeps it on). I Am Cat works with issues (judder; scale 0.8 no help). Roblox unsupported (je_free in
-libroblox, also with the Vulkan shim). Installs skip the Steam restart when the shortcut is unchanged and wait while a
-game runs (agent v37). New default fixes in FramePort's code reach games already in a library: after every app update
-`library._follow_catalog` re-derives each non-user recipe once (setting `recipes.app_version`; tests switch it off via
-`library.REFRESH_ON_UPDATE`). Analysis fields added later: **bump `analysis/detect.ANALYSIS_VERSION`** (stored as `analysis.extra.analysis_version`); older entries whose APK is still there are analysed again at the GUI's start (background thread, not a job: ~8 s per 900 MB APK) and before a build (`pipeline.refresh_analyses`, GitHub #104); only `analysis`/`suggested` change, user recipes stay; an unreadable APK gets `analysis_failed` = the version (not retried until the next bump). Troubleshooting techniques: docs/PLAYBOOK.md "Debugging techniques". Unity `boot.config` "vulkan" substring mislabels GLES games as Vulkan
-(I Am Cat ran GLES); OVRPlugin's "Unavailable OpenXR extension: XR_FB_scene" is routine (no longer triaged).
-**Round 4 (2026-10-04):** XR_KHR_android_surface_swapchain is listed by the Frame's runtime but returns
-FUNCTION_UNSUPPORTED → adapter `surface_emul` (default on, `native/adapter/surface_swapchain.c`): an ordinary runtime
-swapchain is returned, the game gets a Surface from a SurfaceTexture on a worker thread (own EGL context, JavaVM from
-XrInstanceCreateInfoAndroidKHR), frames are read back (glReadPixels) and uploaded in xrEndFrame (Vulkan: own command
-buffer + fence per panel, never waits; GLES: glTexSubImage2D). I Am Monkey's intro works (owner-confirmed). SUPERHOT
-(Quest) quit at start: its cloud save folder was mode 1700 and Lepton's app writes through the folder's group →
-launch.sh `fix_perms` adds u+rwx,g+rwx (agent v41). Lucky's Tale: Unity's Loading.PreloadManager thread grows the
-native heap ~1 GB/s until the OOM killer (Frame freezes); no fix. `perf` works as steamos (paranoid 2; ptrace_scope 1
-blocks gdb/eu-stack/debuggerd) — see PLAYBOOK "Debugging techniques". QuestCraft downloads its JRE at first run into
-`files/runtimes/JRE` (Pojlib Installer); on the Frame it was missing (unpacked by hand, unverified). WiiCompiled: its launcher shows
-(lepton-show-flatscreen) but imports .wcgame files through Android's document picker (OPEN_DOCUMENT), which Lepton
-lacks (ActivityNotFoundException) → imported by hand: libmain.so + game.json → internal files/game/<profile>,
-DATA/ → external files/WiiCompiledOpenXRVR/DATA, MOD/ → .../RetroRewind6 (decompiled with jadx). Lepton has no
-picker at all: a FramePort fix would be an injected picker activity. Generated cover/banner art used to suppress the
-Steam placeholder set (no Steam art at all) → fixed in artwork/steam.py.
-**Steam library failures (GitHub #21/#30):** on some Frames Steam never loads FramePort's shortcuts.vdf entries (same SteamOS build and arm64 beta client as the dev Frame; IDs correct; file written before Steam starts): Play → console_log `GameAction [AppID <id>] … RequestingLicense → UpdatingAppInfo → LaunchApp failed with AppError_9` (= "Game configuration unavailable", Steam treats the id as a store app). Cause unknown; agent v42/43 diagnostics: `launch` returns `steam` (started / error + code / silent from console_log), `collect_diag` adds `steam_library` (real Steam dir, beta, Steam start vs vdf write time, entries per account, devkit games) + `steam-console.txt` (incl. Steam's `logs/shortcuts.previous.txt` if present; steamclient.so has "LoadShortcuts: rejecting attempt to load shortcuts: invalid account ID"). **Fallback (agent v43):** when Play gets AppError_9 the agent registers the game through Steam's devkit interface (what Valve's Devkit Management Tool does, MIT: `devkit-1 steam://devkit-1/<~/.steam/steam.token>/create-shortcut?response=<file>&gameid=<id>&directory=~/devkit-game` written to ~/.steam/steam.pipe; answer file / `.error`; `~/devkit-game/<id>/launch.sh` = link to the game's launch.sh, `<id>-argv.json` ["launch.sh"] (relative to the folder), `<id>-settings.json` {steam_play 0, compat_tool ""}). Steam adds it live (no restart), picks its own appid (read back from shortcuts.vdf by DevkitGameID), shows it as a normal non-Steam game named "Devkit Game: <id>" (OpenVR 0, but VR works: owner-verified 2026-10-04), art copied to grid/<appid>*. Ids: letter first, then letters/digits/_ only (spaces, '-', leading digit → "missing/invalid arguments"). Later Plays use the devkit entry; uninstall (`devkit_unregister`, `delete-shortcut` live) and purge remove it. Verified on the dev Frame: register/launch/unregister; the AppError_9 trigger itself only in unit tests. GitHub #42 (two Steam accounts, neither MostRecent): Steam rewrote the active account's shortcuts.vdf without FramePort's entries right after starting, and added the devkit entry live without saving it, so `devkit_appid` (vdf only) failed ("Steam added the devkit entry but didn't save it"); agent v55 `devkit_appid_from_log` reads Steam's `sanitize shortcut app id "~/devkit-game/<id>/launch.sh": replacing 0 with N` console line. GitHub #41 (one account): same Steam behaviour, and every install restarts Steam, which forgets the never-saved devkit entry. Agent v56: the log fallback reads only the current session's console_log.txt; Play re-registers a devkit entry that gets AppError_9; art updates also write the devkit entry's grid art (`copy_grid_art`). Open: why some Frames' Steam never loads or saves shortcuts.vdf (single account too).
-**Exit game (GitHub #36, 2026-10-04):** `Apps.TerminateApp` (what Exit game calls; reachable for tests through Steam's CEF devtools on 127.0.0.1:8080, SharedJSContext, `Runtime.evaluate` — a stdlib websocket client is enough) closed both a normal shortcut and a devkit entry on the dev Frame within 1-3 s. SIGTERM to Steam's `reaper` alone left launch.sh + Lepton (setsid) + the container running (an earlier headset launch ran on for 87 min); SIGTERM to launch.sh cleans up in ~4 s. Agent v44: launch.sh's 2 s loop ends the game when its parent (the reaper) is gone; `upgrade_launchers` (from ensure_host_fixes) adds that to existing launchers in place. Which in-headset exit path fails is still unknown. Screenshots on the Frame: all under SteamVR's appid 250820 (`760/remote/250820/screenshots`, screenshots.vdf has creation time, no game).
-**SteamVR dashboard at game start (2026-10-04):** the dashboard (Resume game / controller / VR options) was open whenever a FramePort game started (also over Lepton's 2D launcher). Steam's UI exposes `SteamClient.OpenVR.VROverlay.{IsDashboardVisible,HideDashboard,ShowDashboard}` (CEF devtools, `steam_js` in the agent). Agent v44: launch.sh starts `_dashboard_worker` (waits for FrameBridge's first `pacing:` line in launch.log, then hides a visible dashboard for 25 s, at most 3 times; log `<base>/dashboard.log`; opt out with env FRAMEPORT_KEEP_DASHBOARD=1). Verified on the dev Frame (dashboard shown → 4XVR launched via Steam → hidden ~5 s after the first frames); not yet seen in the headset. **Headset (ITR2, 2026-10-05): too late** — Steam shows its frame menu (`valve.steam.gamepadui.frame.menu`, vrwebhelper_systemui.txt `[PooledPopups] Showing`) ~0.3 s after the game's first submitted frame (FrameBridge `new layer:`), but the first `pacing:` summary comes ~8 s later; the owner had pressed Resume (`[HideDashboard] return_to_game`) before the worker looked. Agent v52: watches from the first `new layer:` line (incremental log reads, 0.5 s polls, 30 s window). Agent v59: watches 120 s and hides up to 10 times (the menu came back after 30 s in the owner's sessions). Agent v53: stops for good once the player opens the dashboard with the controller (`toggle_dashboard_action` in vrwebhelper_systemui.txt since the worker started): v52 closed it 60 ms after each press, and the game, paused for it, stayed paused.
-**Space warp / ITR2 (2026-10-04):** Into The Radius 2 (UE5, `libUnreal.so` + OVRPlugin, Vulkan) uses Application SpaceWarp (extra swapchains `376x376 format=97` motion vectors + `format=129` depth); #35 reports flickering textures. OVRPort's `patch_disable_space_warp` has no effect on UE5, and hiding XR_FB_space_warp in FrameBridge's enumerate doesn't reach the game either: **OVRPort's dispatcher offers/enables XR_FB_space_warp itself**. FrameBridge `hide_space_warp` (per game, off) hides it and strips `XrCompositionLayerSpaceWarpInfoFB` (1000171000) from the projection views (log `hide_space_warp: removed space warp info`); the game still renders its MV swapchains. Test build installed on the dev Frame; flicker not yet checked in a headset. Heuristic: UE5 + OVRPlugin shows it as an option (off). `equirect_emul` is suggested for Unreal games whose graphics API isn't detected ("GLES or unknown"); on Vulkan it switches itself off (Myst/Riven/ITR2): harmless, but Unreal Vulkan detection is a known gap.
-**PR #34 (merged 2026-10-04, Lucas-Mathieu):** `native/adapter/audio_metadata.h` patches Meta XR Audio Wwise (only build ID e1619e7f…, Batman: Arkham Shadow 1.4.1) so queued audio metadata isn't freed while the current audio frame references it (smoke-bomb crash). Verified headless: installs ("metadata reclamation follows …"), 72 fps; we added a once-per-second scan limit. Outside PRs: review source, rebuild `artifacts/` ourselves, merge locally (contributor's commit kept), push main.
-**Heuristics eval (2026-10-04):** `scripts/eval_heuristics.py "<VR CyberDeck Portable>"` → 19/44 recipes exact, 322/352 fields (most diffs: `frame.unity_text_input` suggested where older catalog recipes lack it; the rest are runtime-only findings: use_alt, vk_shader_fix, focus_hold, sync_guard, multipass). `PATCHED/` copies aren't scored (already converted).
+**Crash backtraces:** Lepton writes tombstones only to `lepton-logcats/steamlaunch-<appid>/logcat-crash.log` (launch tests return `crash_log`). Fossilize loads into every app (userdebug guest) → `frame.vk_sanitize` (`native/vkshim`); overport's dispatcher aborts on swapchains > 4096 px → `frame.swapchain_limit`; cylinder layers → quad strips (`cylinder_strips`). Drawing equirect layers ourselves and a focus debounce were tried and removed: don't retry without a new approach. → docs/DEVICE_NOTES.md#crash-backtraces-fossilize-swapchain-limit-cylinder-and-equirect-layers
+**360° layers / 4XVR:** the Frame's Android runtime composites only quad + projection layers (quads always above projection layers). Per-game adapter settings (off by default): `equirect_emul` (GLES), `equirect_flip/face/res/fps/stereo`, `stable_local`, `focus_hold` (default on), `aim_pitch/aim_yaw/aim_forward`, `refresh_rate`, `layer_debug`; agent `link_media` / `app_media_dirs` put sent files into a player's own folder. → docs/DEVICE_NOTES.md#360-layers--4xvr
+**Companion apps / intents:** a second APK can run inside a game's Lepton container, but Lepton turns every `android.intent.action.VIEW` with data into `steam://openurl` → "open in external player" hand-offs can't work; Lepton installs exactly one `*.apk` per app folder. → docs/DEVICE_NOTES.md#companion-apps--intents-stremio--4xvr
+**Text input:** Lepton's Android has no IME and VR apps run headless (no focused window); `lepton-show-flatscreen` keeps VR and gives focus + Steam's keyboard (`device.text_input_window`); `frame.unity_text_input` patches Unity's TMP_InputField/InputField at Cpp2IL offsets; agent `_keyboard` = uinput "Type on Frame". `pm install` of a second APK corrupts the main app (`cmd_real package install` skips the hook). → docs/DEVICE_NOTES.md#text-input-stremio-vr
+**User reports #4-#10:** shortcuts go to the signed-in account (agent `library_users`), `launch` errors `NOT_IN_LIBRARY`; shared Cpp2IL run (`unity_text_input.Il2cppReturnPatch`) for `frame.unity_runtime_msaa_off` and `frame.unity_multipass`; VR4 → catalog `use_alt`. **Catalog changes reach existing games**: recipes store `catalog_rev`, `library._follow_catalog` re-derives non-user recipes. → docs/DEVICE_NOTES.md#user-reports-2026-10-04-issues-4-10
+**Round 2 of reports / headset rounds 2-3 (2026-10-04):** vkshim `vk_shader_fix` (VR4); `Il2cppReturnPatch.field_loads` (I Am Cat); builds record `recipe_fp` (changed recipe/revised patch → "Update on Frame"); `Frame.relocate`; adapter `profile_remap` (Touch Plus/Pro); `sync_guard` (Myst); `focus_hold` tuning; ovrpshim for Unity 2017 (Accounting+); Steam library to every account, `shortcuts_lost` / `add_devkit_entry`; no clipboard service → `frame.sdl_clipboard`, `frame.godot_clipboard`; 2D apps keep non-VR patches (`needs_vr = False`); `frame/local.py` (FramePort on the Frame); after every app update `library._follow_catalog` re-derives non-user recipes once (`recipes.app_version`, `library.REFRESH_ON_UPDATE`). Analysis fields added later: **bump `analysis/detect.ANALYSIS_VERSION`** (re-analysis at GUI start + `pipeline.refresh_analyses`; `analysis_failed`). Roblox and BONELAB crash (unsupported). → docs/DEVICE_NOTES.md#round-2-of-reports-headset-rounds-2-3-2026-10-04
+**Round 4:** XR_KHR_android_surface_swapchain is listed but unsupported → adapter `surface_emul` (default on, `native/adapter/surface_swapchain.c`); save folders without u/g+rwx → launch.sh `fix_perms`; Lucky's Tale OOM (no fix); `perf` works as steamos (gdb blocked); QuestCraft JRE, WiiCompiled import by hand (Lepton has no document picker). → docs/DEVICE_NOTES.md#round-4-2026-10-04-surface-swapchains-save-folder-permissions
+**Steam library failures (GitHub #21/#30/#41/#42):** on some Frames Steam never loads FramePort's shortcuts.vdf entries (Play → AppError_9) → fallback: register through Steam's devkit interface (`devkit-1 … create-shortcut`, `~/devkit-game/<id>/`; `devkit_appid`, `devkit_appid_from_log`, `devkit_unregister`, `copy_grid_art`; ids: letter first, letters/digits/_ only); `collect_diag` adds `steam_library`. Cause still unknown. → docs/DEVICE_NOTES.md#steam-library-failures-and-the-devkit-fallback-github-21304142
+**Exit game (GitHub #36):** `Apps.TerminateApp` (Steam CEF devtools on 127.0.0.1:8080) closes games; launch.sh ends the game when its parent reaper is gone (`upgrade_launchers` adds it). → docs/DEVICE_NOTES.md#exit-game-github-36
+**SteamVR dashboard at game start:** launch.sh's `_dashboard_worker` hides the dashboard via `SteamClient.OpenVR.VROverlay` (agent `steam_js`) from the first FrameBridge `new layer:` line (120 s, ≤10 times, stops after `toggle_dashboard_action`); log `<base>/dashboard.log`, opt out `FRAMEPORT_KEEP_DASHBOARD=1`. → docs/DEVICE_NOTES.md#steamvr-dashboard-at-game-start
+**Space warp / ITR2:** OVRPort's dispatcher offers XR_FB_space_warp itself (`patch_disable_space_warp` doesn't reach UE5) → FrameBridge `hide_space_warp` (per game, off; suggested for UE5 + OVRPlugin). `equirect_emul` switches itself off on Vulkan. → docs/DEVICE_NOTES.md#space-warp--itr2
+**PR #34 (Lucas-Mathieu):** `native/adapter/audio_metadata.h` keeps Meta XR Audio Wwise metadata alive (Batman: Arkham Shadow 1.4.1 smoke-bomb crash). Outside PRs: review source, rebuild `artifacts/` ourselves, merge locally. → docs/DEVICE_NOTES.md#pr-34-meta-xr-audio-metadata-batman
+**Heuristics eval (2026-10-04):** 19/44 recipes exact (superseded by the 2026-10-15 numbers under Heuristics). → docs/DEVICE_NOTES.md#heuristics-eval-2026-10-04
 **Power (0.9, agent v47):** sidebar bar below the Frame card: Sleep / Restart / Shut down, each confirmed (`app.frame_power`, a running game asks again). logind answers CanSuspend/CanReboot/CanPowerOff = "challenge" for an SSH session but "yes" inside a user unit, so agent `power` runs `systemctl suspend|reboot|poweroff` from a transient `systemd-run --user --on-active=3` timer (the command answers first). Restart verified on the device (back in ~84 s, new boot id).
-**Proton default (agent v51, owner's choice 2026-10-05):** the newest **stable** ARM64 Proton is the default for PC VR games (`pick_proton`: asked-for name/alias, else newest installed stable, else any stable). Agent v49-50 defaulted to Experimental; the owner's headset A/B with Rick and Morty (Experimental 69 % reprojected frames, stable felt much smoother) reverted it. The game page's Customize shows `pcvr.proton_tool` as a dropdown (Stable (default) / Experimental = alias `proton-experimental`); `ensure_proton` installs a chosen one (it asks once more for the runtime Steam only names after Proton is installed; Experimental installed unattended on the device in 53 s). A PC VR launch test that fails on stable suggests Experimental (`pipeline.PROTON_TOOL`, `proton_alternative_worth_trying`, button "Try Proton Experimental and reinstall"). Remaining Rick and Morty stutter on head turns = the game rendering below the refresh rate (reprojection), not Proton.
-**USB cable link (verified 2026-10-05, cabled to the dev PC):** `usb0` is a USB **NCM** gadget (configfs g1: `ncm.usb0` + `ffs.adb`, Valve 28de:2460) set up by `usb-ncm-gadget@usb0.service`, which only runs with `ConditionPathExists=|/etc/systemd/system/adbd.service.d/steamos-devkit-enabled` = **Developer Mode only**. `usb-ncm-dnsmasq@usb0` serves DHCP with fixed `dhcp-host` entries: Frame 10.86.200.233, PC **10.86.200.234** (`frame/usb.py` FRAME_USB_IP/PC_USB_IP). Windows 11 binds its built-in "UsbNcm Host Device" (no driver); WSL mirrored sees eth 10.86.200.234. USB is high-speed (USB 2.0): upload 36.9 MB/s vs 11.3 MB/s home Wi-Fi. Frame→PC over the cable worked without a firewall change. `scripts/usb_autotest.py` (Windows via powershell.exe from WSL), `frameport frame usb-check`. Wizard "Set up with a USB cable" (`PairingServer(host=PC_USB_IP)`; the real bootstrap ran end to end over USB). Discovery dedupes by SSH host key and prefers USB > Frame hotspot > network (`discovery.dedupe`); a lost address is re-found by key (`Frame.relocate`, tested with a dead saved address).
+**Proton default:** the newest **stable** ARM64 Proton (`pick_proton`; owner's headset A/B); `pcvr.proton_tool` dropdown (Experimental = alias `proton-experimental`), `ensure_proton`, `proton_alternative_worth_trying`. → docs/DEVICE_NOTES.md#proton-default-stable-vs-experimental
+**USB cable link:** `usb0` is a USB NCM gadget (Developer Mode only); Frame 10.86.200.233, PC **10.86.200.234** (`frame/usb.py`); ~37 MB/s; `scripts/usb_autotest.py`, `frameport frame usb-check`; discovery prefers USB > hotspot > network (`discovery.dedupe`). → docs/DEVICE_NOTES.md#usb-cable-link
 **Catalog updates without a release (2026-10-05):** apps fetch `catalog/games/*.yaml` from GitHub `main` (`recommend/catalog.refresh_remote`: one API call `git/trees/main?recursive=1` + raw.githubusercontent downloads of changed blobs, cached as `catalog-gh-<sha>.yaml`, every 6 h; GUI at start + Settings → Data "Check now"; CLI background thread + `frameport catalog-update`). `catalog.load()` only reads the cache. A remote entry is skipped (`unusable_reason`) when it names a patch/adapter key this app doesn't register, has a field `CatalogEntry` doesn't know, or `min_app` > this version: add `min_app` (or rely on new patch ids) when a config needs an unreleased FramePort. Remote beats bundled unless the bundled entry has a later updated/verified date; the user's own entries still win as before. Off: setting `catalog.auto_update`, env FRAMEPORT_NO_CATALOG_UPDATE; FRAMEPORT_CATALOG_URL still overrides the source. So: **pushing a catalog change to main reaches users within 6 h** (their recipes follow via catalog_rev → Update on Frame).
-**Start activity / QuestCraft / ITR2 pop-in (2026-10-05):** WiiCompiled's VR part (`QuestActivity`, SDL, process `:game`) stays behind Lepton's flat window when the launcher is shown (`device.text_input_window`). `frame.start_activity` (opt-in; analysis `extra.vr_activity` = the original APK's activity with Meta's VR category when it isn't the launcher) gives that activity's filter LAUNCHER and every other LAUNCHER becomes INFO, per element (`axml.set_start_activity`); Lepton's own `apk-info-extractor --print-activity-name` (on the Frame under Lepton/liblepton/apk_extractor) then answers QuestActivity. **OVRPort gives every MAIN activity LAUNCHER + VR categories**, so the VR activity must come from the original APK's analysis, not the converted manifest. Lepton has no activity override (`APP_ACTIVITY` is reset when app_metadata.sh is sourced). QuestCraft reaches Minecraft 1.21.5 (Fabric, Vivecraft, Sodium; LTW "Large Thin Wrapper" GL 3.0 on the Frame's Zink) and stops at `OpenGL error 1282` in `WindowFramebuffer` createTexture (Minecraft's crash report in `files/instances/1.21.5/crash-reports/`, Pojlib's `files/latestlog.txt`); the vrclient SIGSEGV / "pthread_mutex_lock called on a destroyed mutex" afterwards is only the shutdown (Unity's render thread still in vrclient while the instance is destroyed). ITR2 "models popping in and out" in game: Unreal reads user config from **internal** storage (`lepton-data/internal/<pkg>/files/UnrealGame/<Project>/<Project>/Saved/Config/Android/Engine.ini`, not external); `r.AllowOcclusionQueries=0` there broke its menus (removed again). Vulkan shim `vk_query_slots` (two slots per occlusion query) never saw ITR2 create an occlusion query pool, and the run with it crashed (Unreal RenderThread SIGSEGV, caught by sentry-native: no tombstone; the backtrace is in `cache/sentry/*/.sentry-native/*.run/*.envelope` with module offsets) - left off. Next suspect: Unreal 5 mobile HZB occlusion reading depth stored with Valve's FDM injection layer; test = launcher `VK_INSTANCE_LAYERS=''` (Lepton then loads neither VALVE_rpo nor VALVE_fdm_injection, Fossilize still). QuestCraft: LTW overrides glGetError and returns 0 with `LIBGL_NOERROR` set; Lepton passes `LEPTON_ENV_<NAME>` to the app as `<NAME>`, so catalog `lepton_env: {LEPTON_ENV_LIBGL_NOERROR: '1'}` gets Minecraft past the GL error 1282; then black picture (see the catalog entry). FrameBridge logs `new layer` once per layer type per process and projection views only for the first frames, so a second session in the same process (Vivecraft after Unity) needs `layer_debug=1`.
-**Vulkan validation / ITR2 solved (2026-10-05):** Khronos' validation layer can't come from Lepton (its layer dir is in the read-only guest image; the Linux copies on the Frame are glibc) and a global `debug.vulkan.layers` property (via the LEPTON_GFXRECON_FP_PROPS trick) kills the container at boot. Working recipe: bundle `libVkLayer_khronos_validation.so` (Khronos android-binaries release, arm64-v8a, stored uncompressed) into a test APK re-signed with the game's key (`apk.sign.sign`), install with `frameport install <pkg> --apk`, and set the Vulkan shim's `vk_validation=1` (it adds the layer at vkCreateInstance; findings under the logcat tag VALIDATION in launch.log, each message ID capped at 10). ITR2's flicker + windows behind models = Unreal's Qualcomm shader-resolve subpasses with a depth resolve of a single-sampled depth attachment (VUID-04908/-03179); `vk_spec_fixes=1` drops that resolve (its TRANSFER_DST half never applies to ITR2: the main depth is transient). Valve's VALVE_rpo layer removed ITR2's fog (catalog `lepton_env: VK_INSTANCE_LAYERS: VK_LAYER_VALVE_fdm_injection`). `r.ViewDistanceScale=2` in the internal Saved/Config/Android/Engine.ini only exists on the owner's Frame (the catalog can't write internal storage yet). Launch tests: Lepton prints a transient "is not a running context" on the first start after an APK change (agent v54 `not_started` waits 30 s for "Boot complete!").
-**GitHub #38/#39 (2026-10-05):** PowerWash Simulator stuck at "Waiting.." on a reporter's Frame = Unity sized the right-eye image rect past its swapchain (rect 268+1656 on a 1920-wide swapchain; the runtime's recommended size differs per Frame) and SteamVR rejected every frame (`xrEndFrame failed -25`, XR_ERROR_SWAPCHAIN_RECT_INVALID), after which the game stopped calling xrEndFrame. FrameBridge `rect_clamp` (default on; sizes noted in xrCreateSwapchain; clamped layers count as swapped) keeps projection/quad rects inside their swapchain; triage `swapchain-rect-invalid`. Not reproducible on the dev Frame with `scale` (Unity's eye sizing isn't just the recommended width); no regression there (72 fps). The adapter's revision was NOT bumped (that would mark every installed game outdated): affected users rebuild. The Room VR (#38) = Unity's render thread SIGSEGV in libgallium_dri.so ~30 ms after the game recreates its eye swapchain with samples=4 (FrameBridge retries samples=1); the game's own code turns MSAA on (not OVRManager); candidate fix: hide GL_EXT_multisampled_render_to_texture (GL shim) - needs the APK to test. The launch test passed both (render thread dead / no frames): triage gap.
-**Headset round 2026-10-05 (evening):** I Am Cat's judder = repeated xrLocateViews of one display time returning
-slightly different poses → FrameBridge `pose_consistency` (owner-verified, works). Lucky's Tale freeze on touching a
-save slot = OVRPort's OpenXR dispatcher converting XR_FB_haptic_amplitude_envelope with ns read as s (GitHub #9) →
-xrshim `haptic_fix` (owner-verified); its remaining short pauses were the wear sensor ("HMD off/on" 0.5-1 s in
-`logs/eyetracking.txt`, not vrserver.txt) → **`focus_hold` is on by default with 5 s** (owner's choice; C defaults
-too). The Room VR works (`unity_no_overlay_copy`). BattleSisters (Unity 2019.4 built-in VR, no libOculusXRPlugin.so)
-flooded "outside of frame bounds" ~2400/s and hung the GPU (kernel hangcheck, zink DEVICE LOST) → the ovrpshim frame
-wait now also applies to Unity 2019 without the Oculus XR Plugin (`UnityOculusCheck.legacy_loop`). Vader Immortal
-(UE4, stuck on the loading image after the intro, GitHub #49): VRP repacks carry a Frida gadget (`libfrda.so`,
-config `hijack_responses`), but OVRPort's `patch_clean_up_frida` removes its loadLibrary call, so it never runs on
-the Frame; `frame.ovr_trace` (opt-in, `native/ovrtrace`: 1138 exported ovr_* stubs → real loader functions, logcat
-tag `fp_ovrtrace`: calls, PopMessage answers, unanswered requests every 10 s) is the next diagnostic.
-**Unity built-in VR input (2026-10-05):** probe builds (`FRAMEPORT_INPUT_PROBE=1 frameport build …`; it logs
-trigger/grip crossings too) showed OVRPlugin returns the full Touch state for every controller mask (also Go masks);
-presses reach the games' OVRInput. Accounting+ (Il2CppDumper v6.7.46 reads its Unity 2017 metadata v24, run on Windows)
-passes stance selection (NewtonVR grip/trigger) but its motion warning waits for `Input.GetMouseButtonDown(0/1)`,
-which Lepton never delivers (no focused Android window) → ovrpshim registers its own
-`UnityEngine.Input::GetMouseButtonDown(System.Int32)` icall (il2cpp_add_internal_call, after Unity's: resolve first)
-that adds a click in the frame a Touch trigger or A/B/X/Y is newly pressed (`unity_oculus_check` revision 3).
-BattleSisters (Unity 2019 InputSystem/XR InputDevices via `VrHandInput`): libunity's Oculus module (OVRPlugin
-function table: a global pointer at 0x16b57c0 in this build, slots filled by name, e.g. +0x160 GetControllerState,
-+0x168 State2, +0xe8 GetNodePresent) only reports controllers when `strncmp(deviceModel, "Oculus", 6) == 0` (next to
-the Go check `deviceModel == "Oculus Pacific"`); Lepton's model is "Valve Lepton" → Go/unknown → only Go masks polled,
-buttons dead. `unity_oculus_check` revision 4 (`oculus_model_checks`, Unity 2019 only) turns the 17 compares' length
-into 0 (`orr w2, wzr, #6` → `mov w2, #0` after the adrp/add of the "Oculus" literal; the string stays: it is also
-Unity's VR device name). Device result: libunity now polls `ovrp_GetControllerState(0x3)` (Touch); owner-confirmed
-2026-10-06: buttons work. Its first controller vibration then hit OVRPort's haptic-envelope bug (11 GB, OOM kill) →
-`haptic_fix` is now suggested for every game with libOVRPlugin.so (settings detect), BattleSisters works. Ruled out before: ProductName, GetNodePresent, the device-model string itself, exports.
-Accounting+ works (owner, 2026-10-06).
-**Vader Immortal (UE4, GitHub #49, 2026-10-06, headless):** stuck after the intro on an in-game image (the splash
-quad ends ~6 s in; then the game's own projection frames, 72 fps, balanced xrBeginFrame/xrEndFrame). Not the Platform
-SDK (`frame.ovr_trace`: only user + entitlement, both answered) and not the repack's Frida gadget (OVRPort's
-`patch_clean_up_frida` removes its loadLibrary). It **leaks ~430 GPU mappings (/dev/dri/renderD128) and ~20 MB a
-second** (6.5 GB + swap after 5 min, then 26 fps): page-fault stacks (perf -e page-faults, offsets resolved with the
-process maps + vrclient.so's own symbols; its text segment is at file offset + 0x4000) end in SteamVR's runtime:
-`xrBeginFrame → CSxrCompositorOpenVR::BeginFrame → SubmitExplicitTimingData → CVRCompositorSharedTextures::
-BeginGPUTimingCommandBuffer` and `xrEndFrame → CVRCompositorClient::SubmitWithArrayIndexAndTime`. Ruled out: the
-layer color scale/bias + image layout structs (FrameBridge `strip_color_bias` 1/2, diagnostic), Valve's Vulkan
-layers (VK_INSTANCE_LAYERS=""), array swapchains in general (Lucky's Tale/I Am Cat flat). Kernel tracepoints aren't
-allowed for steamos. FrameBridge: `layer_debug` logs xrDestroySwapchain and per-5 s xrBeginFrame/xrEndFrame counts;
-`frame_balance` (ends an open frame before the next begin) exists but Vader never leaves one open. Next (built,
-not yet run: the Frame slept): `layer_debug` also counts xrAcquire/Wait/ReleaseSwapchainImage per 5 s (hooked only
-with layer_debug, after the other conditional hooks) to see whether Vader skips a wait or release: it doesn't (361/361/361 per 5 s).
-FrameBridge `snapshot=N` (`snapshot_gl.c`, GLES): every N s the left-eye image the game submits is read back on its
-own context and saved as `files/fb_snap_0-7.ppm` (quarter size) — headless launches show a black headset view, this
-shows what the game draws. Vader: Lucasfilm logo (an OBB mp4: video works), then its loading card (portrait + segmented
-bar) that never advances; the async loader thread sleeps and OBB reads stop (~168 MB of a 2.7 GB pak).
-**SteamVR overlay apps (agent v75, 2026-10-10):** host OpenVR overlays (VRApplication_Overlay) are composited over Lepton (Quest) games on the Frame (probe checker seen over 4XVR in the headset view, `native/vroverlay_probe`); Windows ones register through Proton's vrclient too (Temporal Reality's Windows build created its overlays; fpsVR never reaches OpenVR under Proton). Detection `analysis/vroverlay.py` (bundled `.vrmanifest` with `is_dashboard_overlay`, else OpenVR + IVROverlay + self-registration markers, engine Other; Rift fingerprint `RIFT_ANALYSIS`), patch `pcvr.vr_overlay` (param autostart), Linux entry fields `vr_overlay`/`vr_overlay_autostart` (game page switch); agent `register_vr_overlay`/`unregister_vr_overlay`/`launch_vr_overlay` (IVRApplications via ctypes, live; manifest `<anchor>/frameport-overlay.vrmanifest`, the app's own key, binary = launch.sh). **SteamVR on the Frame reads only `binary_path_linux_arm`** (binary_path_linux alone is skipped). Overlay apps: no launch test, no Linux Steam-parent watchdog (`FRAMEPORT_OVERLAY`), not a "running game". A Steam overlay-app shortcut and a game shortcut run together. SteamVR's SetApplicationAutoLaunch didn't persist on the dev Frame (the watch never started by itself) → **agent v76: FramePort's own autostart**: the deployment's `overlay.autostart` is the source of truth; `ensure_host_fixes` (`ensure_overlay_service`) keeps the user service `frameport-vr-overlays.service` (`_vr_overlay_watch`, 5 s polls of the known vrserver's /proc stat) only while an overlay app has autostart on (register/unregister, uninstall, purge and the kill switch `~/.local/share/frameport/vr-overlays.disabled` / `FRAMEPORT_NO_OVERLAY_AUTOSTART` update it); a new vrserver (pid + start time, kept in `~/.cache/frameport-vr-overlays.json` across agent updates) → child `_vr_overlay_round`: wait for IVRApplications, 15 s grace, `launch_vr_overlay` for apps not running (folder process or GetApplicationProcessId); log `~/.local/share/frameport/vr-overlays.log`. Dev Frame: adopted the running vrserver, skipped the already running watch; a start after a real SteamVR start/boot is not yet seen. Details: docs/FRAME_RUNTIME.md "Overlay apps".
-**Vader's leak solved / AC Nexus flips (2026-10-14):** Vader Immortal leaves GL errors pending on its context; SteamVR's GL interop (`openxr_graphics_gl_openvr.cpp`, `xrclient_<pkg>.txt` in Steam's logs: `SXR_GL_CHECK: error:0x502 ... glGenTextures`) takes the stale error as its own failure once, and from then on `CVRCompositorSharedTextures::BeginCommandBuffer` allocates a command buffer every frame (perf page-fault stacks; ~430 renderD128 mappings + 22 MB/s). Adapter `gl_error_clear` (GLES, catalog on for Vader ep1-3) clears them before xrCreateSwapchain/xrBeginFrame/xrEndFrame: flat memory, no SXR_GL_CHECK (headless). The per-game `xrclient_<pkg>.txt` logs are worth reading for runtime errors. The Frame's runtime caps swapchains per session (XR_ERROR_LIMIT_REACHED from ~15; AC Nexus asks for more): flip emulation now turns quads upright in place (scratch VkImage, once per acquire; transfer usage added to single-layer colour swapchains) instead of a shadow swapchain per quad, which ran into the cap (#138). Headless sessions don't draw AC Nexus's panels (adapter `flip_dump` saves before/after images of flipped quads, for headset runs).
-**Unreal's self-restart (agent v90, 2026-10-13):** UE 4.21+ restarts the app once after its first-run shader
-precompile ("optimizing" screen; `r.ProgramBinaryCache.RestartAndroidAfterPrecompile`): it starts its own LAUNCHER
-activity and calls System.exit(0); Lepton ends the container with the first process (the restarted one with it).
-Skipping `AndroidThunkJava_RestartApplication` or the cvar = 0 (accepted via UE4CommandLine.txt `-ini:`) left Sports
-Scramble on that level for good. launch.sh (RESTART_BLOCK, `upgrade_launchers` adds it) starts Lepton once more when
-`_restart_requested` sees the app's own LAUNCHER start (system log, uid >= 10000) <= 5 s before its exit; first run
-kept as `launch-before-restart.log`; `FRAMEPORT_NO_RESTART=1` off. Owner-verified with Sports Scramble's first start (2026-10-13).
-**xrWaitFrame runs ahead (Journey of the Gods, 2026-10-14, owner-verified):** with real frames (headset on) the
-Frame's runtime sometimes returns from xrWaitFrame at once with a display time less than one refresh after the frame
-just submitted, and then rejects the second submission for that refresh (`VRCompositorError_AlreadySubmitted` in
-Steam's `logs/xrclient_<pkg>.txt`; FrameBridge pacing above the display rate). VrApi games that render faster than
-the display ran ahead (~120 submits/s at 90 Hz) and the scene slid and snapped back. The VrApi bridge re-waits when
-the new display time is under half a period after the last submitted one (`pacing 2s:` counters). Headless runs only
-submit empty frames and never show it. Lepton's logcat mirror also missed the whole verifying session (launch.log =
-Lepton's own lines only): the keeper now catches a silent mirror too (agent v91).
-**Lepton's logcat mirror dies (agent v67, 2026-10-09; v91 2026-10-14):** Lepton's mirror (`podman exec -it <container> logcat -v threadtime,color`) fails three ways: `logcat: Unexpected EOF!` right after the game starts, `Logcat read failure`, or running and writing nothing at all (Lepton 3.0.5: seen twice on 2026-10-14, once in the owner's session, once headless). launch.sh's `_logcat_keeper` reads `podman exec <container> logcat -v threadtime -T <epoch>` itself into launch.log after a failure line or 20 s without a logcat line (from the launcher's start when the mirror never wrote, else from just before its last line), restarts it from where it ended (≤5), stops it when Lepton's coloured lines come back, sets the container's log buffer to 16 MiB (`logcat -G`), and logs every decision to `<base>/logcat-keeper.log`. Checked on the dev Frame: a mirror killed mid-game (hand-over without a gap) and a silent mirror (the whole session recovered).
-**Double launch (agent v57, 2026-10-06):** a second Play while Lepton still boots (~10 s with nothing to see) made
-the second Lepton stop the first one's container ("Waiting for steamlaunch-<appid> (PID …) to exit", exit 137
-"(starting)", "Clearing baked app data due to early exit") and both died (Vader, BattleSisters). launch.sh now takes
-`flock` on `<base>/.launch.lock` (fd 9, inherited by Lepton; the watchdog and dashboard helpers close it with
-`9>&-`); a second launch exits 0 and logs to `<base>/launch-dup.log`. `upgrade_launchers` adds it to existing
-launchers. Verified on the device (second launch during boot: ignored, the first kept running). Vader on its loading
-card ignores input too (owner pressed/held every button: presses reach the runtime, the card never changes).
-**Issue triage round (2026-10-06, owner's headset):** vibration in OVRPlugin games = 2 s vibrations updated per frame and
-stopped with amplitude 0; FrameBridge turns amplitude 0 into xrStopHapticFeedback (else each buzz ran 2 s), haptic_fix
-uses the envelope RMS (was its peak), per-game `haptic_scale` → Creed/The Boys/Jurassic World fine. Lambda1VR (TBXR):
-loader named by Build.MANUFACTURER (`frame.tbxr_vendor`), no graphics extension enabled (FrameBridge adds
-XR_KHR_opengl_es_enable + asks for the requirements on -50), always multisampled render-to-texture (GL shim gives
-single-sampled stand-ins when GL_EXT_multisampled_render_to_texture is hidden) + its xash/ data → works. Jurassic World:
-`frame.vrapi_stub`. Metro Awakening: contributor's vkshim fixes + hide_space_warp + no VALVE_rpo (jumping polygons like
-ITR2). Pinball FX VR: hide_space_warp (stutters). Eleven: a Meta online request fails after platform init → needs Meta
-services. Star Wars Tales: top half black + freeze after loading; ruled out: asset-file paks (never requested), Valve
-foveation (off: no change), GL errors (MESA_DEBUG=1: none), EGL_BAD_ACCESS once in OVRPlugin init (harmless); the game's
-eye image reads back black. BlazeRush: VrApi bridge exports + ovr*_ToString stubs + avatar stub get it to the menu room
-at 72 fps, full input reaches it (diagnostics `input 5s`: Touch type only, sticks 1.0, buttons, poses 0x8f), but the room
-draws no controllers and ignores input; avatar loader forced to its "Failed" path (no logged-in user) changed nothing.
-`frame.ovr_trace` can't trace Unity games (P/Invoke dlsym; nothing imports ovr_*). Headless: the VrApi bridge's 30 s
-head-pose deadline ends VR mode without a worn headset (not a game bug).
-**Lepton storage (2026-09-30):** each app's /sdcard (= /storage/emulated/0 → `<base>/lepton-data/external`) has `Movies`/`Download`/`Documents` symlinked to the Frame's `~/Videos`/`~/Downloads`/`~/Documents` (liblepton/mounting.sh, only if they exist at start); agent v24 `storage_targets` reads that mapping. Android's MediaProvider canonicalises paths to /home/steamos/... and rejects every file ("doesn't appear under [/system/media...]"), `sm list-volumes` is empty: the media index never works, apps must browse folders. Lepton installs with `adb install -g` (runtime permissions granted, MANAGE_EXTERNAL_STORAGE too). Files: `install/files.py`, `frameport frame send|storage`, GUI Files tab (formerly Frame → Send files).
-**SteamVR per-app settings (2026-09-30):** editing steamvr.vrsettings while SteamVR runs is lost; the web API (127.0.0.1:27062 /app/setsettings) needs `x-steamvr-secret`. `native/vrsettings` = `fp_vrsettings.exe` (freestanding, OpenVR `FnTable:IVRSettings_003` as a Utility app, loads SteamVR's bin/win64/openvr_api.dll) sets them live and SteamVR persists them: section `steam.app.<shortcut appid>`, keys `preferredRefreshRate` (float) and `motionSmoothingOverride` (0 global, 1 on, 2 off, 3 always). Steam Link (vrlink) lists the Frame's rates 72/80/90/96/108/120/144 in vrserver.txt and follows the per-app preference ("host preferred N Hz"; whether the key is honoured is unverified in-headset yet). Judder metric: vrcompositor.txt session summary dropped + "Timed out. N total" (Stormland: 0 dropped but 313 timeouts in 2 min); fpsVR (`%LOCALAPPDATA%\fpsVR\*.json`, 0.1 ms histograms) gives p99 CPU/GPU ms. `pcvr.steamvr_tuning` (default on, PC only) applies on Play: highest rate whose budget ≥ p99×1.05, at least one step down, smoothing on.
-
-**Language packs (merged from PR #20, 2026-10-04):** overport's `libovrplatformloader.so` is a dispatcher that `dlopen`s Meta's own loader (`libovrplatformloader_meta.so` / `_meta_q1.so`, also `libpxrplatformloader.so`) and keeps its own message queue; `ovr_LanguagePack_GetCurrent/SetCurrent` are 8-byte `return 0` stubs in it, `ovr_AssetFile_GetList` forwards to Meta's loader. `frame.langpacks` (opt-in, `native/langpack`) serves `<tag>.lang` files from the game's data; `elf.hide_exports` marks the loader's exports STB_LOCAL (bionic and glibc only match GLOBAL/WEAK; verified for glibc, bionic's `is_symbol_global_and_defined` is from memory). `libfp_langpack.so` is built here (`python native/build.py --only langpack`) and committed. Owner-verified 2026-10-04: Deadpool VR with only `en.lang` and the patch on plays English dialogue and runs normally (headless launch tests show 2-6 fps while it loads: not a regression sign). A dispatcher answer that arrives after we answered the timed-out GetList is dropped (one answer per request); games already in a library get `lang_packs` filled after an app update (`library._refresh_data_fields`). The library logs to logcat under the tag `fp_langpack` (dirs looked in, packs found, every language-pack call), so it shows up in the game's `launch.log`; an `ovr_AssetFile_GetList` the dispatcher leaves unanswered for 1.5 s is answered with our packs alone. Deadpool VR (Unreal) accepts a pack only when its `Metadata` equals the game's own version string (`ULanguagePacksSubsystem` compares it with `%s.%s.%s.%s.%s` built from the build info, e.g. `1.0.40.356975.Quest` = versionName; found by disassembling `libUE4.so`): the patch writes the APK's versionName into the library (`@FPMETA@` slot, `with_metadata`), `FRAMEPORT_LANGPACK_META` overrides it. Deadpool VR (2026-10-04, headset): German became selectable with that Metadata, but dialogue stayed silent (even English once reported as a pack) while the path was spelled `/sdcard/Android/obb/<pkg>/x.lang`; with the `/storage/emulated/0/Android/obb/<pkg>/x.lang` spelling (Unreal's own, now listed first in `scan_dirs`) German dialogue plays. `FRAMEPORT_LANGPACK_SKIP=<tags>` or a file `fp_langpack_skip` in the obb folder leaves packs out of the list (experiments).
-
-**Cube swapchains (GitHub #107, 2026-10-09):** the Frame's runtime refuses `faceCount=6` swapchains (-2,
-XR_ERROR_RUNTIME_FAILURE); OVRPlugin ignores that ("CreateSwapchain for eye 0: 0x0, 0 stages") and crashes in
-ovrp_EndFrame4 (memset). FrameBridge `cube_standin` (default on, `native/adapter/cube_standin.c`) serves a refused cube
-swapchain as one GL cube-map texture in the app's context (GLES only) and drops its layers. Verified headless with
-Budget Cuts Ultimate (2048² sRGB, 12 mips; runs on at ~70 fps); what the cube layer showed is simply missing.
-**Hardware video decoding (PR #96, PR #128 by Lucas-Mathieu, adapted 2026-10-10, agent v71):** `native/hevc` = one
-OMX plugin `OMX.frameport.{avc,hevc,vp9}.decoder` (FFmpeg v4l2m2m on Iris /dev/video-dec0, FFmpeg software decoders as
-fallback inside the component, Vulkan copy for big native surfaces). The connection installs it once per Frame
-(`ensure_video_codec` → agent `video_codec_status`/`install_video_codec`: `~/.local/share/frameport/video-codec/versions/
-<manifest sha>` + `current` symlink). A Frame keeps the same or a newer `revision` (no flip-flop between PCs) → **bump
-`revision` in native/hevc/build.py with every artifact change**; a failed install isn't retried during the connection.
-Per game: only launchers of games whose recipe has `frame.hw_video_decode` (install stage, no APK change; suggested
-from analysis `media_codec`, ANALYSIS_VERSION 8; deployment.json `hw_video_decode`) get the codec line → the Podman
-wrapper (native/hevc/podman.py) mounts the plugin into that container (merged media_codecs.xml in
-$XDG_RUNTIME_DIR/frameport-video). Off for every game: Settings → Installing (library `video.hw_decode` → agent
-`video_codec_switch` = video-codec/disabled); one game: `FRAMEPORT_NO_HW_VIDEO=1 %command%`. `upgrade_launchers`
-converts agent ≤70 launchers (Batman's `<base>/frameport-codec` → keeps the line, folder then removed). Batman: catalog
-+ migration `batman_video_patches` (`frame.hw_video_decode` + hidden adapter setting `surface_native`). Iris: 8K
-refused (ENOMEM) while any other decoder session is open; SteamVR's vrlinkrunthread holds one ~12 s at game start →
-refused opens retry until 20 s after the plugin loaded (else 2 s), then software; VP9 7680x3840 never returned a
-picture → VP9 ≤4096x2304; hidden VP9 frames come back as empty capture buffers (bytesused 0, no LAST):
-FFmpeg's wrapper ended the EOS drain at the first one (two-pass VP9 lost its last ~25 frames) → build.py requeues
-them (codec revision 8; drain ends at LAST, or 1 s after a skipped empty buffer; dev Frame 2026-10-10: 600/600 =
-OMX.google.vp9 Y hashes). Rebuilds are deterministic (ext4 + NTFS path
-with spaces, two NDK copies → same; rev 8 141de01f…; PR #128's own sources → its 27a2d749…). Not yet run on the device.
-**Vulkan shader dump (GitHub #140, 2026-10-10):** adapter `vk_shader_dump=1` (Vulkan shim, `native/vkshim/shader_dump.h`;
-applies where vk_sanitize can: Unreal/Other arm64) writes each distinct SPIR-V module once to
-`files/fp_vk_shaders/<size>_<sha256>.spv` (tmp + rename) and one `index.txt` line per vkCreateShaderModule (`<seq> <ms>
-<unix ms> <name> new|known|again|failed`, O_APPEND) to find the module behind a GPU hang. Agent v72 `collect_diag`
-returns `shaders` (newest modules of fp_vk_shaders + fp_spirv, ≤4 MB each, base64) → bundle
-`games/<pkg>/target/shaders/`. Triage `gpu-hang` suggests both dumps; `triage.graphics_api` (FrameBridge's
-xrCreateSwapchain formats: <0x1000 Vulkan, else GL) keeps only the session's API's (`API_ONLY`). Host-tested only.
-Agent v74: a reporter's hang came ~10 s after the last new module, so the culprit wasn't among the newest written →
-with an index naming modules, `shader_dumps` sends every module of the index's **newest session** (after the last
-`# start`), deduplicated, last used first, each ≤4 MB, ≤30 MB in all (`session` = how many it names) + that session's
-index lines; no index (fp_spirv) = the old newest-by-mtime 4 MB. One JSON line (~40 MB base64) over the SSH channel
-is read whole by `Frame.agent` (fine at that size); `_Writer.fit` drops the least recently used modules last, after
-cutting logs, to stay under the 24 MB zip limit.
-**Unreal OBB check (GitHub #159, 2026-10-10):** Epic's DownloaderActivity checks OBB name+size (OBBData), then with `bVerifyOBBOnStartUp=true` CRCs the whole OBB; its screens are invisible in Lepton (stuck at `Displayed …/.DownloaderActivity`, triage `unreal-obb-check-stuck`) → `frame.unreal_skip_obb_check` (analysis `unreal_verify_obb`, ANALYSIS_VERSION 11) flips the manifest boolean (`axml.set_meta_data_bool`); skips only the CRC pass. Host-tested only.
-**Issue round 2026-10-12 (agent v83):** Lepton pastes STEAM_COMPAT_DATA_PATH unquoted into `sh -c "ln -s …/internal/<pkg>
-/data/data/<pkg>"` (mounting.sh): a game on a card named "Steam Frame 512g" got no internal storage (no saves/prefs;
-Beyond Sandbox's EOS then looped `createKeychain→resetKeychain` forever, 1.85 GB log). Quest launchers with an unsafe
-path now `ln -sfn <base> ~/.local/share/frameport/lepton-paths/<pkg>` at every start and give Lepton that path
-(`app_dir_lines`/`set_app_dir`/`launcher_base`; upgrade_launchers converts; deployment.json keeps the real base).
-Verified on the device with a spaced copy of Stremio (old: the `ln` error; new: /data/data link, shared_prefs
-writable). `frame.eos_keychain_loop` (opt-in, triage `eos-keychain-loop`) returns from EOSSDK.resetKeychain. Wander
-0.3570 (Unity 6.5, Firebase, Gecko) ran out of bionic's 128 pthread keys → `frame.unity_tls_key_pool` (Klownicle's
-approach, #198: libunity's 4 key imports renamed `fp_tkey_*` via `elf.rename_imports`, `libfp_tkeys.so` pools
-destructor-less keys behind one real key); device: past Firestore, 72 fps. Cpp2IL releases can't read metadata v107
-(Unity 6.5) → `tools/cpp2il.py` falls back to the development CI build (nightly.link) on that error. Vermillion's canvas
-is an OVROverlay quad (drawn above the hand) → `frame.vermillion_scene_canvas` (PaintableMesh getters → false;
-installed build checked, 72 fps headless; headset not yet). Linux apps: `desktop_icon` switch, a deleted desktop copy
-stays deleted (#212). Findings: OLAR (#201) RHIThread null deref in libUnreal (`ldr x8,[x19,#792]`, x19=0) not fixed by
-hide_space_warp / vk_hide_fdm / no Valve layers; FNAF HW (#135) "freeze" = first-start GL program-binary-cache compile
-on Zink (threads busy in zink/disk cache), not a hang; VR4 (#199) reporter's patch.203 OBB truncated. Upload benchmark
-(`scripts/upload_bench.py`, #242): home Wi-Fi caps every method at ~11 MB/s; paramiko uses ~3x OpenSSH's CPU; Windows
-OpenSSH refuses FramePort's key file (ACL "bad permissions") until its permissions are tightened.
-**Meta user id (GitHub #182, 2026-10-11):** OVRPort's platform loader (runtimes 3.4.3-23204ea and -aa54c3f) answers
-`ovr_GetLoggedInUserID` (and two other callers) without a Meta account with a made-up id from a helper (`stp; mov x29,
-sp; bl random; …; mov/movk x9 = 0x53444835ec580000 (6e18); add x0, x8, x9; ldp; ret`), kept only in memory → a new id
-every start; Walkabout Mini Golf files saves under `Profiles/Oculus/<id>/` and lost all progress. `frame.ovr_stable_user`
-(default_on, detect = the game has libovrplatformloader.so) rewrites the helper to `mov x0, <6e18 + 32 bits of
-sha256(package, keystore)>; ret`: stable per game and per user (keystores are personal), so online games never see two
-FramePort users as one. Found in every PATCHED build checked. Host-tested only; upstream candidate.
-**Vivox API 31 (GitHub #101, 2026-10-09):** newer Vivox builds (Green Hell VR) call Android 12 AudioManager
-communication-device methods from `com.vivox.sdk.AudioChangeListener` with no SDK check → NoSuchMethodError on Lepton's
-Android 11. `frame.vivox_audio_route` (analysis `vivox_api31`, ANALYSIS_VERSION 4) makes every such method return at
-once (`Dex.return_early`: return-void / `const/4 v0,0; return v0`; nopping the invoke would leave a move-result the
-verifier rejects). Older Vivox (Eleven Table Tennis, BattleSisters) lacks that code and isn't matched. Verified
-headless: Vivox initialises, 150 s at ~65-70 fps.
-**Steam Input gamepad for 2D apps (GitHub #162, agent v72, 2026-10-10):** Lepton's Android only has the Wayland seat's `wayland_touch/keyboard/pointer`. Steam makes its virtual pad (uinput, `/devices/virtual/input`, 28de:11ff, "Microsoft X-Box 360 pad N", ACL for steamos) only while the Frame's controllers are on (controller.txt "Steam Controller reserving XInput slot 0"; gone when they sleep), also with no game running; steamos-manager's 28de:0000 keys device isn't a pad (no BTN_SOUTH). Lepton's container root (system_server too) = steamos (`keep-id:uid=0`), so a bind-mounted `/dev/input/eventN` opens. Opt-in `device.steam_gamepad` (vr_kind none; suggested for `android.hardware.gamepad`/`LEANBACK_LAUNCHER`, analysis `gamepad`, ANALYSIS_VERSION 9): deployment.json `steam_gamepad` → launcher `GAMEPAD_LINE` (after the codec line: exports FRAMEPORT_GAMEPAD + LEPTON_ENV_SDL_GAMECONTROLLER_ALLOW_STEAM_VIRTUAL_GAMEPAD, puts `agent/bin` first on PATH) → `PODMAN_WRAPPER` (written by ensure_host_fixes; non-`run` calls go straight on; `run` imports the agent's `podman_run_args`; hands on to the next Podman after its own PATH entry with itself removed from PATH, so it chains to the codec wrapper either way round) adds the pads + `Vendor_28de_Product_<pid>.kl` (Xbox 360 layout). Verified headless with a uinput stand-in pad (Stremio's container: EventHub `classes=0x80000141`, our key layout, KeyEvent BUTTON_A dispatched); with Steam's real pad and a game: not yet. Pads made after the start aren't seen until the next one.
-**Multiview programs on flat framebuffers (GitHub #77, Doom3Quest, 2026-10-09, prototype):** Mesa enforces OVR_multiview's
-"program num_views == draw framebuffer views" rule (`draw_validate.c`, the draw is dropped silently); Qualcomm doesn't.
-Doom3Quest compiles every VS with `layout(num_views=2) in;` and draws its HUD/PDA into 2D-texture FBOs → black. Opt-in
-`frame.gl_multiview_fbo` (analysis `gl_multiview_libs`, ANALYSIS_VERSION 6; own-engine GLES only): `native/glmv` =
-`libfpglmv.so` (12 chars = "libGLESv3.so": libdoom3.so's one `.rodata` dlopen string is rewritten in place, its qgl*
-table comes from dlsym on that handle; also first DT_NEEDED for its direct gl*/egl* imports). Such draws use a lazily
-built single-view twin (view 0, uniforms copied per draw); eglMakeCurrent resets the per-thread cache. Host-tested only
-(rewriter on all 19 Doom3Quest shaders + glmv.c against a stand-in GL, `tests/test_gl_multiview_fbo.py`); the host's
-Mesa 23.2 llvmpipe has no OVR_multiview. Headset-verified by Xandrix1987 (2026-10-09: HUD/PDA shown, no fps drop) -> in the Doom3Quest catalog recipe.
-**BlazeRush (GitHub #57, Klownicle's verified guide, 2026-10-10; FramePort's version headless-tested only):**
-`frame.blazerush` (1.0.349 only: exec-segment SHA + every word checked, offsets from PT_LOAD) NOPs the avatar-readiness
-wait (0x4b2dbc), RETs the avatar renderer (0x4b2adc), renames `cache/shader_cache` → `cache/br_shader_v1`. GL shim
-(now also exports glShaderSource/glLinkProgram/glProgramBinary/glDeleteProgram/glDraw*: pass-through unless a setting
-is on) `gl_int_attribs` (integer inputs fed via glVertexAttribPointer re-set with glVertexAttribIPointer per draw,
-reflection cached per EGL context + program, dropped on link/binary/delete) and `gl_highp_markers` (vertex shaders with
-every '|' marker: mediump→highp except on in/out/uniform lines); host test `tests/test_blazerush.py` with a stand-in
-GL. FOV: the game reads VrApi props 7/8 right after vrapi_Initialize (no session; the Frame has no
-XR_EPIC_view_configuration_fov) → the bridge saves the live FOV (also located before tracking, headless: 118.87×120.04
-on the dev Frame) in `files/framebridge-vrapi-fov.txt` and answers with it at the next start (log `FOV properties: …
-(saved by an earlier session)`). `device.config_sync` (catalog field `config_sync`, agent v78): user_config.xml
-r_3dwidth/height, r_width/height from the runtime eye size (FrameBridge logs `runtime recommended eye size`) × scale,
-written at finalize, set_settings and by launch.sh before Lepton starts (`_config_sync`). Headless runs at scale 1.7
-end in `zink: DEVICE LOST` right after the bridge's 30 s no-tracking deadline tears the session down (gpu fault at the
-teardown; not at scale 1.0): a headless-only artifact, the headset never hits that deadline. Launch tests count an exit/crash after
-such a line as a pass (triage.yaml `headless_end`, finding `headless-end`; GitHub #57 "Failed to launch" on install).
-**Session triage (agent v70, 2026-10-09):** launch tests never reach FOCUSED, so real play sessions are triaged
-too. list_installed gives each game `last_play` {start, end, test} from `<anchor>/plays.log` (launch tests write a
-`test <unix>` line first → test sessions are only marked); `session_log` returns the newest session's launch.log
-(`<base>/session.log`, ≤4 MB: head + tail + FrameBridge/crash lines between) + that session's logcat-crash.log +
-`journalctl -k` GPU lines ("kernel: …"). The GUI's connection refresh (`app._check_sessions` → `pipeline.sessions_due`,
-background thread; sessions >7 days old are skipped) runs `pipeline.triage_session` = `validate/session.analyze`
-(triage.yaml signatures incl. `space-warp-used` (info, `question:`, never auto-applied), `gpu-hang` (`report: true`)
-+ computed `slow-frames` (pacing windows vs the nearest refresh rate) and `focus-dips` (FrameBridge always logs
-`focus: lost` / `focus: back after N ms`, session_fixes.c)) → library `last_session` / `last_session_checked` → game
-page "Last session" callout (Try this fix / Rebuild with this fix / Yes-No question / Report / Dismiss). Suggestions may
-be values (`adapter.scale=0.85`, `triage.split_suggestion`); adapter-only fixes are pushed live (`apply_suggestions_live`
-→ agent set_settings, like the Game settings dialog). CLI `frameport session <pkg> [--apply]`. PC VR (Proton) launchers
-log no session end, so they aren't triaged yet. pac_hints stays triage-only: a survey of all 68 dump APKs found unpaired
-PAC hints in 21 libraries of 18 games (OpenSSL's 38/40 in most UE4 libUE4.so and libEOSSDK.so, UE5 libUnreal.so ~400
-vs +2-3, libass, libopencv, …), most of them games that work, so default-on would rewrite many working builds.
+**Start activity / QuestCraft / ITR2 pop-in:** `frame.start_activity` (analysis `extra.vr_activity`, `axml.set_start_activity`; OVRPort gives every MAIN activity LAUNCHER, so take the VR activity from the original APK); Unreal reads user config from **internal** storage; Lepton passes `LEPTON_ENV_<NAME>` to the app as `<NAME>` (QuestCraft `LIBGL_NOERROR`); vkshim `vk_query_slots` left off. → docs/DEVICE_NOTES.md#start-activity--questcraft--itr2-pop-in
+**Vulkan validation / ITR2 solved:** bundle Khronos' `libVkLayer_khronos_validation.so` into a test APK + vkshim `vk_validation=1` (logcat tag VALIDATION); `vk_spec_fixes=1` drops ITR2's invalid depth resolve; VALVE_rpo removed its fog (catalog `lepton_env: VK_INSTANCE_LAYERS`). Agent `not_started` waits 30 s for "Boot complete!". → docs/DEVICE_NOTES.md#vulkan-validation--itr2-solved
+**GitHub #38/#39:** SteamVR rejects image rects past their swapchain (-25) → FrameBridge `rect_clamp` (default on), triage `swapchain-rect-invalid`; The Room VR MSAA crash in libgallium. → docs/DEVICE_NOTES.md#github-3839-powerwash-simulator-the-room-vr
+**Headset round 2026-10-05:** FrameBridge `pose_consistency` (I Am Cat judder), xrshim `haptic_fix` (Lucky's Tale), **`focus_hold` on by default with 5 s** (wear-sensor dips, `logs/eyetracking.txt`), `unity_no_overlay_copy` (The Room VR), ovrpshim frame wait for Unity 2019 (`UnityOculusCheck.legacy_loop`), `frame.ovr_trace` (opt-in, `native/ovrtrace`, logcat `fp_ovrtrace`). → docs/DEVICE_NOTES.md#headset-round-2026-10-05-evening
+**Unity built-in VR input:** probe builds `FRAMEPORT_INPUT_PROBE=1`; ovrpshim adds a `GetMouseButtonDown` icall click (Accounting+); libunity 2019 only polls Touch when the device model starts with "Oculus" → `unity_oculus_check` revision 4 `oculus_model_checks` (BattleSisters); `haptic_fix` suggested for every game with libOVRPlugin.so. → docs/DEVICE_NOTES.md#unity-built-in-vr-input-accounting-battlesisters
+**Vader Immortal (GitHub #49):** stuck on its loading card and leaked GPU mappings (solved below: `gl_error_clear`); diagnostics FrameBridge `layer_debug`, `strip_color_bias`, `frame_balance`, `snapshot=N` (`snapshot_gl.c`: saves the submitted left-eye image as `files/fb_snap_*.ppm`). → docs/DEVICE_NOTES.md#vader-immortal-headless-investigation
+**SteamVR overlay apps:** host OpenVR overlays composite over Lepton games; detection `analysis/vroverlay.py`, patch `pcvr.vr_overlay`, Linux fields `vr_overlay`/`vr_overlay_autostart`, agent `register_vr_overlay`/`unregister_vr_overlay`/`launch_vr_overlay`; SteamVR on the Frame reads only `binary_path_linux_arm`; FramePort's own autostart (`ensure_overlay_service`, `frameport-vr-overlays.service`). See also docs/FRAME_RUNTIME.md "Overlay apps". → docs/DEVICE_NOTES.md#steamvr-overlay-apps
+**Vader's leak solved / AC Nexus flips:** stale GL errors broke SteamVR's GL interop → adapter `gl_error_clear` (GLES, catalog for Vader ep1-3); read `xrclient_<pkg>.txt` in Steam's logs for runtime errors; the runtime caps swapchains per session (~15) → flip emulation in place; adapter `flip_dump`. → docs/DEVICE_NOTES.md#vaders-leak-solved--ac-nexus-flips
+**Unreal's self-restart:** UE 4.21+ restarts itself after the first shader precompile and Lepton ends the container → launch.sh RESTART_BLOCK starts Lepton once more (`upgrade_launchers`; `FRAMEPORT_NO_RESTART=1` off). → docs/DEVICE_NOTES.md#unreals-self-restart
+**xrWaitFrame runs ahead:** the runtime sometimes returns a display time <1 refresh after the last submit and rejects the second submission (`VRCompositorError_AlreadySubmitted`) → the VrApi bridge re-waits (`pacing 2s:` counters). → docs/DEVICE_NOTES.md#xrwaitframe-runs-ahead-journey-of-the-gods
+**Lepton's logcat mirror dies** (EOF, read failure, or silent) → launch.sh `_logcat_keeper` reads `podman exec <container> logcat` itself into launch.log (log `<base>/logcat-keeper.log`). → docs/DEVICE_NOTES.md#leptons-logcat-mirror-dies
+**Double launch:** launch.sh takes `flock` on `<base>/.launch.lock` (fd 9); a second launch exits 0 and logs to `<base>/launch-dup.log` (`upgrade_launchers` adds it). → docs/DEVICE_NOTES.md#double-launch
+**Issue triage round 2026-10-06:** FrameBridge turns haptic amplitude 0 into xrStopHapticFeedback, per-game `haptic_scale`; Lambda1VR → `frame.tbxr_vendor`; Jurassic World → `frame.vrapi_stub`; Metro Awakening / Pinball FX → `hide_space_warp`; `frame.ovr_trace` can't trace Unity games; the VrApi bridge's 30 s head-pose deadline ends headless VR mode. → docs/DEVICE_NOTES.md#issue-triage-round-2026-10-06
+**Lepton storage:** each app's /sdcard has `Movies`/`Download`/`Documents` symlinked to the Frame's `~/Videos`/`~/Downloads`/`~/Documents` (agent `storage_targets`); the media index never works; Lepton grants all runtime permissions. → docs/DEVICE_NOTES.md#lepton-storage
+**SteamVR per-app settings:** `native/vrsettings` = `fp_vrsettings.exe` sets `steam.app.<appid>` `preferredRefreshRate` / `motionSmoothingOverride` live; `pcvr.steamvr_tuning` (default on, PC only). → docs/DEVICE_NOTES.md#steamvr-per-app-settings
+**Language packs:** `frame.langpacks` (opt-in, `native/langpack`, `elf.hide_exports`, logcat tag `fp_langpack`) serves `<tag>.lang` files; Unreal needs the pack's Metadata = the game's version (`with_metadata`, `FRAMEPORT_LANGPACK_META`) and the `/storage/emulated/0/...` path spelling; `FRAMEPORT_LANGPACK_SKIP`. → docs/DEVICE_NOTES.md#language-packs
+**Cube swapchains:** the runtime refuses `faceCount=6` → FrameBridge `cube_standin` (default on, GLES only, `native/adapter/cube_standin.c`). → docs/DEVICE_NOTES.md#cube-swapchains
+**Hardware video decoding:** `native/hevc` OMX plugin (`OMX.frameport.{avc,hevc,vp9}.decoder`), installed once per Frame (`ensure_video_codec`, agent `video_codec_status`/`install_video_codec`/`video_codec_switch`); **bump `revision` in native/hevc/build.py with every artifact change**; per game `frame.hw_video_decode` (analysis `media_codec`), Settings `video.hw_decode`, `FRAMEPORT_NO_HW_VIDEO=1`; Batman migration `batman_video_patches` + `surface_native`. → docs/DEVICE_NOTES.md#hardware-video-decoding
+**Vulkan shader dump:** adapter `vk_shader_dump=1` (`native/vkshim/shader_dump.h`) writes SPIR-V modules + `index.txt` to `files/fp_vk_shaders/`; `collect_diag` returns the newest session's modules (`shader_dumps`); triage `gpu-hang`, `triage.graphics_api`. → docs/DEVICE_NOTES.md#vulkan-shader-dump
+**Unreal OBB check (#159):** `frame.unreal_skip_obb_check` (analysis `unreal_verify_obb`) turns off Epic's OBB CRC pass; triage `unreal-obb-check-stuck`. → docs/DEVICE_NOTES.md#unreal-obb-check
+**Issue round 2026-10-12:** Lepton breaks on unquoted paths with spaces → launchers give Lepton a `~/.local/share/frameport/lepton-paths/<pkg>` link (`app_dir_lines`/`set_app_dir`/`launcher_base`); `frame.eos_keychain_loop`, `frame.unity_tls_key_pool` (`libfp_tkeys.so`, `elf.rename_imports`), `frame.vermillion_scene_canvas`; `tools/cpp2il.py` falls back to Cpp2IL's dev build for metadata v107; Linux `desktop_icon`; `scripts/upload_bench.py`. → docs/DEVICE_NOTES.md#issue-round-2026-10-12
+**OpenSSH uploads (#324/#242):** `native_upload.quote` escapes only backslash and `"`, Win32 local paths go as `C:/…`; `Frame.auth` records the login that worked (app_key / user_key from `ssh.extra_keys`, `frame ssh-keys`, agent, password); strict IdentitiesOnly first, relaxed retry. → docs/DEVICE_NOTES.md#openssh-uploads
+**Meta user id (#182):** OVRPort's platform loader makes up a new user id every start → `frame.ovr_stable_user` (default on) returns a stable per-game, per-user id. → docs/DEVICE_NOTES.md#meta-user-id
+**Vivox API 31 (#101):** newer Vivox calls Android 12 AudioManager methods → `frame.vivox_audio_route` (analysis `vivox_api31`, `Dex.return_early`). → docs/DEVICE_NOTES.md#vivox-api-31
+**Steam Input gamepad for 2D apps (#162):** opt-in `device.steam_gamepad` (deployment `steam_gamepad` → launcher `GAMEPAD_LINE` → `PODMAN_WRAPPER` / `podman_run_args` bind-mount Steam's virtual pads). → docs/DEVICE_NOTES.md#steam-input-gamepad-for-2d-apps
+**Multiview programs on flat framebuffers (#77):** Mesa drops num_views=2 draws on single-view FBOs → `frame.gl_multiview_fbo` (`native/glmv` = `libfpglmv.so`, analysis `gl_multiview_libs`); headset-verified with Doom3Quest. → docs/DEVICE_NOTES.md#multiview-programs-on-flat-framebuffers-doom3quest
+**BlazeRush (#57):** `frame.blazerush` (1.0.349 only), GL shim `gl_int_attribs` / `gl_highp_markers`, saved VrApi FOV (`files/framebridge-vrapi-fov.txt`), `device.config_sync` (catalog `config_sync`); launch tests treat an end after the headless deadline as a pass (triage `headless_end`). → docs/DEVICE_NOTES.md#blazerush
+**Session triage:** real play sessions are triaged too: agent `last_play` / `session_log` (`<anchor>/plays.log`), `pipeline.sessions_due` / `triage_session` = `validate/session.analyze` (incl. `space-warp-used`, `gpu-hang`, `slow-frames`, `focus-dips`) → library `last_session` → game page "Last session"; `apply_suggestions_live`; CLI `frameport session <pkg> [--apply]`; pac_hints stays triage-only. → docs/DEVICE_NOTES.md#session-triage
 **Unresolved (as of 2026-09-28):** Arcsmith (right-eye distortion) and Time Stall (both eyes) — swap, tracking, Valve
 layers, depth, pacing ruled out. Sniper Elite VR (DEVICE LOST), Espire 1 (Mesa GL upload crash), HITMAN 3 (freedreno
 crash): use PC versions.
 
-**Install links / FrameDrop button protocol (2026-10-07, not yet clicked end to end from a browser):** FrameDrop
-(framedropvr.com, a closed-source Windows sideloader) defines "Install with FrameDrop" buttons:
-`https://framedropvr.com/install?manifest=<url>|url=<file>` → that page opens `framedrop://install?…` (1.6 s, else its
-home page); manifest `{"schema":"framedrop.install/v1","name","files":[{"url","sha256"}]}` (name = Steam title; .apk
-or Linux .zip). `deeplink.py` (no Flet) parses framedrop://, frameport:// and the pasted https link, enforces its
-rules (https; http only on loopback; no credentials; no LAN/loopback/link-local IPs, also after DNS and redirects; URL
-ends in a file name), caps manifests at 256 KiB, ignores non-hex sha256 (FrameDrop's own example has a placeholder),
-downloads into `<data>/downloads/<slug>-<hash>/` (OBBs → `obb/` next to the APK, `.part` removed on cancel/mismatch);
-`pipeline.add_from_link` routes APK / Linux / exe and sets `title` + `title_locked` + `link` (a bare file link keeps
-FramePort's title). GUI: `views/link_dialog.py` (always asks first), Add games → "Install from a link…", CLI
-`frameport open-link [--yes --no-install --gui]`. **A `flet build` bundle can't take a URL argument** (the Flutter
-host treats any argv as a developer page URL), so `urlhandler.py` registers a script, not FramePort.exe: Windows
-HKCU `Software\Classes\{framedrop,frameport}` → hidden PowerShell `frameport-link-handler.ps1`; WSL (source runs)
-the same keys → `wsl.exe -d <distro> -e sh frameport-link-handler.sh`; Linux `frameport-links.desktop` +
-`xdg-mime`; macOS unsupported (Apple Events, paste instead). The script drops the link into `<data>/links/*.link`
-and starts FramePort unless `<data>/gui.alive` is < 10 s old (`gui.starting` stops double starts); the GUI's
-`_watch_links` thread touches the heartbeat and opens links (newest window session). Settings → Install links: one
-switch per scheme (`links.framedrop`, `links.frameport`, default on); a scheme another program owns (FrameDrop) is
-only taken with "Use FramePort for these links" (`register([s], force=True)`); off removes only FramePort's own
-registration (`MARK` in the command). Never registered with FRAMEPORT_HOME/FRAMEPORT_NO_LINK_HANDLER (tests,
-screenshots). Same round: files dropped on the Library (`ui/dropped.py`, bundles only like the Files tab), "Add a
-Windows program (.exe)…" (`pipeline.add_windows_exe`: exe in Downloads/home/drive root copied alone into
-`<data>/windows-apps/<slug>/`), patch `device.display_mode` (Automatic / VR / Flat window → `InstallContext.display`,
-`installer.show_window`). FramePort-only manifest extension `"frameport": {"description", "icon"}` (bad values ignored; icon: same URL rules,
-≤2 MiB, Pillow-checked, ≥32 px, saved as PNG in `<data>/downloads/icons/`, shown in the question by asset URL, then
-`sources.apply_custom(pkg, "icon")` unless `.picked` exists; description fills `details.description` only when
-empty). Bare file links get a title guessed from the file name (`title_from_filename`: version/arch dropped, package
-names → last part). Windows test of 0.12.1.dev191 (2026-10-07): a button click opened the dialog; but a click right
-after closing FramePort did nothing (the closed window's heartbeat was < 10 s old) → the handler scripts now wait
-up to 4 s for the link file to be taken before trusting the heartbeat, the window's CLOSE event / atexit delete
-`gui.alive`, and the Windows command runs under `conhost.exe --headless` (plain `-WindowStyle Hidden` flashed a
-console). Screens: `scripts/ui_smoke.py --links --fake-frame --game <pkg>` (tall pages: `--viewport
-1280x7000`; Flutter's popup menu ignores Escape).
-Demo link: the homepage's example button = `deeplink.DEMO_MANIFEST` (https://frameport.app/demo/cool-game.json, published
-from site/public/demo/); every form (https button page, frameport://, framedrop://, pasted) → `InstallRequest.demo`,
-no network (fetch_manifest returns `demo_manifest()`, download refuses), `link_dialog.show_demo` (Install =
-`easter.demo_install`: Cool Game's cover out of the portal; eggs off → "Nice, it works!"), CLI just says so.
+**Install links / FrameDrop button protocol:** `deeplink.py` parses framedrop://, frameport:// and https install links (strict URL rules, manifest ≤256 KiB, downloads into `<data>/downloads/`), `pipeline.add_from_link`, `views/link_dialog.py`, CLI `frameport open-link`; `urlhandler.py` registers a script (bundles can't take URL arguments), `<data>/links/*.link` + `gui.alive` heartbeat; Settings → Install links (`links.framedrop`/`links.frameport`); `ui/dropped.py`, `pipeline.add_windows_exe`, `device.display_mode`; demo link `deeplink.DEMO_MANIFEST`. → docs/DEVICE_NOTES.md#install-links--framedrop-button-protocol
+**Install link updates:** manifest `version` → library `link.version`; `pipeline.check_link_updates` (GUI start, 6 h, setting `links.check_updates` = Settings → Updates → Games) marks `link_update` → Library bar / game page → `link_dialog.update_from_link`; CLI `frameport link-updates`; the demo link is never checked. → docs/DEVICE_NOTES.md#install-links--framedrop-button-protocol
 
 ## Releases, CI, GitHub
 Maintainer-only notes (accounts, credentials, key locations) live in the git-ignored `CLAUDE.local.md`.
@@ -1072,6 +667,13 @@ GitHub identity + credentials are maintainer-local (`CLAUDE.local.md`): check `g
 GitHub write. **The owner approves before posting, labelling or closing anything.** Reply style: "I"/neutral, never
 we/our/us; never mention agent version numbers or internal tool versions; show the owner every draft in full with a
 short recap of the thread so far; read **all** comments on a thread first (a later one often has the zip or the answer).
+- **Every triage also sweeps for unanswered comments**, not just new threads: open AND recently closed issues, PRs
+  (incl. merged/closed ones) and discussions (top-level comments and their replies) whose latest comment isn't the
+  maintainer's, plus earlier user comments a later maintainer reply skipped. Users often ask follow-ups after a fix or
+  after closing (#294: two questions after the reporter closed it; #249: a Q&A discussion with no reply for days;
+  #161/#110: requests posted after the close). Quick check: `gh issue list --state all --search "updated:>=<date>"
+  --json number,comments --jq '.[] | select(.comments[-1].author.login != "spoopyghosty0")'`; discussions via GraphQL
+  (`discussions(orderBy:UPDATED_AT)` with `comments{replies}`).
 - **Issue templates & labels** (`.github/ISSUE_TEMPLATE/`): `[Game report]` → `game-compatibility` (a game that
   doesn't work right); `[Working recipe]` (`working-config.yml`) → `working-config` (a headset-verified config to add);
   `[App]` → `bug` (FramePort itself). Mislabel/relabel to match.
@@ -1117,9 +719,15 @@ MR-only (PASSTHROUGH required + BOUNDARYLESS_APP) → force_passthrough, + USE_S
 hand tracking required → controller_fix=0; OVRPlugin + ≥20 GiB → disable_space_warp; Unreal ≤4.21 or Unreal Meta XR
 Audio → nodebug; Oculus-OS class referenced by the Unreal audio build or ≥2 Meta libs → oculusos; legacy-VrApi Unity
 GLES with MSAA → unity_no_msaa; CryEngine → user.cfg r_variable_rate_shading=0; direct VrApi → bridge (+GL shim for
-GLAD/GLES); Unreal → alternate no-ForceQuit build. Score changes with
-`python scripts/eval_heuristics.py "<dumps>"` (catalog off vs verified recipes; currently 33/34 exact — Phantom's
-"use the no-ForceQuit build" is only detectable at runtime via triage). Add a rule → re-run the eval + `pytest -m games`.
+GLAD/GLES); Unreal → alternate no-ForceQuit build. Scoring (docs/HEURISTICS_EVAL.md, 2026-10-15): analyse the dumps
+once (`scripts/heuristics_snapshot.py <out.json> "<VR CyberDeck Portable>" "<PATCHED>"`, ~30 min, keep out of git),
+then `scripts/eval_heuristics.py --snapshot <out.json> --split dev|holdout|all [--fit-report]` (catalog-only truth,
+per-patch precision/recall, a fixed 20% holdout to catch rules fitted to one game). Read the **dated** score: an
+"extra" on an entry verified before the patch existed is a catalog gap, and adapter/device picks are inherited by
+catalog recipes anyway. 2026-10-15: strict 5/65 exact, F1 73.8%; dated 39/65, F1 88.6%; remaining misses are
+one-game runtime fixes. Don't key a rule on one game's code fingerprint (an Unreal splash/depth "detect" matching
+only Star Wars Tales + FNAF HW was rejected: it would also have bumped ANALYSIS_VERSION for every user). Add a rule →
+re-run dev + holdout + `pytest -m games`.
 
 ## Frame operations
 - Find/connect: `frameport frame discover` / `frame info` (the remembered Frame is in `<user data>/frames.json`).

README.md

@@ -111,8 +111,7 @@ Out of date? [Report a problem](https://github.com/spoopyghosty0/frameport/issue
 Most of the work is done by these projects:
 [OVRPort](https://github.com/Android-XR-Bridge/OVRPort) (Quest → OpenXR, originally
 [ovrport/app](https://github.com/ovrport/app)) · Valve Lepton, Proton and SteamVR ·
-[Revive](https://github.com/LibreVR/Revive) · [AXRB](https://github.com/Android-XR-Bridge/AXRB) (Quest games on a PC,
-experimental) · Mesa (Zink) · [Khronos OpenXR SDK](https://github.com/KhronosGroup/OpenXR-SDK)
+[Revive](https://github.com/LibreVR/Revive) · Mesa (Zink) · [Khronos OpenXR SDK](https://github.com/KhronosGroup/OpenXR-SDK)
 · Eclipse Temurin, Android apksigner and NDK · [Flet](https://flet.dev) · OculusDB and Steam store data.
 What FramePort adds: [Architecture](docs/ARCHITECTURE.md).
 

THIRD_PARTY_NOTICES.md

@@ -25,8 +25,6 @@ FramePort's own native code (the FrameBridge adapter, GL/Vulkan/OpenXR shims, th
 | Eclipse Temurin JRE | api.adoptium.net | GPL-2.0 with Classpath Exception |
 | apksigner (Android build-tools) | dl.google.com Android repository | Apache-2.0 |
 | Revive (portable copy, only if Revive isn't installed) | github.com/LibreVR/Revive releases | GPL-3.0 |
-| AXRB / Android XR Bridge (official installer, only when a Quest game is installed on this PC; run unmodified) | github.com/Android-XR-Bridge/AXRB releases | mixed: launcher GPL-3.0-or-later, host/clock code AXRB Source-Available License 1.0, other parts MIT (AXRB's `LICENSE`) |
-| Android Emulator, platform-tools, build-tools, Android 16 system image (pinned by AXRB) | dl.google.com Android repository | Android SDK License |
 
 Valve's Lepton, Proton and SteamVR, and Meta's software, are used on your devices as installed by Steam / Meta;
 FramePort doesn't distribute them.

agent/frameport_agent.py

@@ -8,6 +8,7 @@ Commands: info, prepare, finalize, shortcuts, shortcut_status, launch_test, stop
           install_lepton, list_installed, proton_status, install_proton, prepare_pcvr, finalize_pcvr,
           controller_models, list_screenshots, delete_screenshots (and more: see the cmd_* functions).
 Streaming: python3 frameport_agent.py _keyboard   (a virtual keyboard: JSON lines on stdin, see keyboard_session)
+           python3 frameport_agent.py _backup_saves|_restore_saves '<json>'  (save backups: tar.gz on stdout/stdin)
 
 Install layout (one Lepton container per game; same as the manual installs from 2026-09):
     ~/Applications/quest-frame/<pkg>/            anchor: launch.sh, deployment.json, artwork/ (always internal storage)
@@ -44,7 +45,7 @@ try:
 except ImportError:  # Windows: pc_revive loads this file for its VDF code only (GitHub #131)
     fcntl = None
 
-AGENT_VERSION = 92  # v92: upsert/remove_shortcut options_key (the PC's Quest games share powershell.exe as Exe)
+AGENT_VERSION = 96
 HOME = os.path.expanduser("~")
 STEAM = os.path.join(HOME, ".local/share/Steam")
 ANCHORS = os.path.join(HOME, "Applications/quest-frame")
@@ -982,14 +983,8 @@ def vdf_encode(obj):
     return bytes(out) + bytes([TYPE_END])
 
 
-def _shortcut_matches(v, exe, options_key=None):
-    """A shortcut is the game's when its Exe matches; with options_key (games sharing one Exe, e.g. Quest games on a
-    PC all start powershell.exe) its LaunchOptions must also contain that key."""
-    return isinstance(v, dict) and v.get("Exe") == exe and (not options_key or options_key in v.get("LaunchOptions", ""))
-
-
 def upsert_shortcut(vdf_path, exe, title, start_dir, icon="", tag="Quest on Frame", launch_options="", tags=None,
-                    openvr=True, write=True, options_key=None):
+                    openvr=True, write=True):
     """Add/update a non-Steam shortcut (matched by Exe, so its appid never changes). `tags` (genres, the user's tags)
     are merged with tags already on the shortcut, so ones set in Steam are kept. write=False: change nothing, return
     (appid, whether shortcuts.vdf would change)."""
@@ -1003,7 +998,7 @@ def upsert_shortcut(vdf_path, exe, title, start_dir, icon="", tag="Quest on Fram
     def game_of(options):  # the game's program in the injector's arguments (its flags may change)
         found = re.findall(r'"([^"]+\.exe)"|(\S+\.exe)', options or "", re.IGNORECASE)
         return (found[-1][0] or found[-1][1]).lower() if found else (options or "")
-    entry = next((v for v in shortcuts.values() if _shortcut_matches(v, exe, options_key)
+    entry = next((v for v in shortcuts.values() if isinstance(v, dict) and v.get("Exe") == exe
                   and (not shared or game_of(v.get("LaunchOptions", "")) == game_of(launch_options))), None)
     ident = entry["appid"] if entry else shortcut_appid(exe, title)
     if entry is None:
@@ -1098,12 +1093,12 @@ def grid_files(grid, appid):
         return []
 
 
-def remove_shortcut(vdf_path, exe, options_key=None):
+def remove_shortcut(vdf_path, exe):
     if not os.path.exists(vdf_path):
         return False
     root = vdf_decode(open(vdf_path, "rb").read())
     sc = root.get("shortcuts", {})
-    keep = [v for v in sc.values() if not _shortcut_matches(v, exe, options_key)]
+    keep = [v for v in sc.values() if not (isinstance(v, dict) and v.get("Exe") == exe)]
     if len(keep) == len(sc):
         return False
     root["shortcuts"] = {str(i): v for i, v in enumerate(keep)}
@@ -2444,6 +2439,9 @@ class SteamVRApps:
     """IVRApplications of the running SteamVR, through its libopenvr_api.so (ctypes) as a utility app (never starts
     SteamVR). `None` from open() = SteamVR isn't running."""
 
+    interface = b"FnTable:IVRApplications_007"
+    table_size = 31
+
     @classmethod
     def open(cls):
         import ctypes
@@ -2462,13 +2460,13 @@ class SteamVRApps:
         vr.VR_InitInternal2(ctypes.byref(err), VR_APP_UTILITY, None)
         if err.value:
             return None
-        ptr = vr.VR_GetGenericInterface(b"FnTable:IVRApplications_007", ctypes.byref(err))
+        ptr = vr.VR_GetGenericInterface(cls.interface, ctypes.byref(err))
         if not ptr:
             vr.VR_ShutdownInternal()
             return None
         self = cls()
         self.vr, self.ct = vr, ctypes
-        self.table = (ctypes.c_void_p * 31).from_address(ptr)
+        self.table = (ctypes.c_void_p * cls.table_size).from_address(ptr)
         return self
 
     def fn(self, name, restype, *argtypes):
@@ -3193,8 +3191,6 @@ def upgrade_launchers():
                 new = new.replace("\nfix_perms\n", "\n" + cloud + "\nfix_perms\n", 1)
             new = set_codec_line(new, wants_hw_video(os.path.dirname(path)))
             new = set_gamepad_line(new, wants_gamepad(os.path.dirname(path)))
-            new = set_config_sync_line(new, os.path.basename(os.path.dirname(path)),
-                                       wants_config_sync(os.path.dirname(path)))
             pkg = os.path.basename(os.path.dirname(path))
             base = launcher_base(new, pkg)
             if base:  # games on a drive whose path has a space reach Lepton through a link (agent v83)
@@ -3230,6 +3226,11 @@ def upgrade_launchers():
                 new = new.replace("\n    trap - EXIT INT TERM\n", f"\n    trap - EXIT INT TERM\n    {end}\n", 1)
             elif "\nexec " in new:  # Proton launcher: exec replaces the shell, so only the start is logged
                 new = new.replace("\nexec ", f"\n{start}\nexec ", 1)
+        if "export LEPTON_ENV_FRAMEBRIDGE_CONFIG=" in new:
+            # Normalize startup helpers after restoring the play log, so the first upgrade has the final order.
+            pkg = os.path.basename(os.path.dirname(path))
+            new = set_config_sync_line(new, pkg, wants_config_sync(os.path.dirname(path)))
+            new = set_refresh_rate_line(new, pkg)
         if new == text:
             continue
         tmp = path + ".tmp"
@@ -3617,6 +3618,7 @@ def write_launcher(anchor, base, pkg, title, appid, lepton, env, hw_video=False,
                             plays_start=plays_lines(anchor)[0],
                             plays_end=plays_lines(anchor)[1], restart=restart_block(pkg, lepton))
     text = set_config_sync_line(text, pkg, config_sync)
+    text = set_refresh_rate_line(text, pkg)
     path = os.path.join(anchor, "launch.sh")
     with open(path + ".tmp", "w") as f:
         f.write(text)
@@ -3809,6 +3811,89 @@ def cmd_config_sync(args):
     return sync_game_config(pkg, dep)
 
 
+# SteamVR's OpenXR runtime only enumerates its current rate and rejects requests for any other rate. Select the
+# mode through the host's per-app setting before Lepton starts; the APK's refresh_rate setting alone cannot do it.
+class SteamVRSettings(SteamVRApps):
+    interface = b"FnTable:IVRSettings_003"
+    table_size = 11
+
+    def refresh_rate(self, appid, rate):
+        ct = self.ct
+        section, key = f"steam.app.{int(appid)}".encode(), b"preferredRefreshRate"
+        err = ct.c_int(0)
+        if rate > 0:
+            ct.CFUNCTYPE(None, ct.c_char_p, ct.c_char_p, ct.c_float, ct.POINTER(ct.c_int))(
+                self.table[3])(section, key, rate, ct.byref(err))  # SetFloat
+        else:
+            ct.CFUNCTYPE(None, ct.c_char_p, ct.c_char_p, ct.POINTER(ct.c_int))(
+                self.table[10])(section, key, ct.byref(err))  # RemoveKeyInSection: restore the game's choice
+        if err.value:
+            name = ct.CFUNCTYPE(ct.c_char_p, ct.c_int)(self.table[0])(err.value)
+            raise AgentError((name or b"SteamVR settings error").decode())
+
+
+REFRESH_RATE_MARKER = ".frameport-refresh-rate"
+
+
+def sync_refresh_rate(pkg, dep, check_running=True):
+    """Apply a saved Quest refresh rate to SteamVR. Retry from launch.sh when SteamVR wasn't available on save."""
+    if not dep or dep.get("kind", "quest") != "quest" or not dep.get("appid"):
+        return None
+    marker = os.path.join(dep["base"], REFRESH_RATE_MARKER)
+    rate = None
+    try:
+        for line in open(os.path.join(dep["base"], "settings.conf")):
+            key, _, value = line.strip().partition("=")
+            if key == "refresh_rate":
+                rate = float(value)
+    except (OSError, ValueError):
+        return {"skipped": "refresh rate settings missing or invalid"}
+    if rate is None and not os.path.exists(marker):
+        return None  # don't touch manually configured SteamVR preferences for games with no FramePort override
+    rate = rate or 0.0
+    if not (rate == 0 or 60 <= rate <= 144):
+        return {"skipped": "invalid refresh rate"}
+    if check_running and container_running(dep["appid"]):
+        return {"skipped": "the game is running (applied at its next start)"}
+    vr = None
+    try:
+        vr = SteamVRSettings.open()
+        if vr is None:
+            return {"skipped": "SteamVR unavailable (applied at the next start)"}
+        vr.refresh_rate(dep["appid"], rate)
+        if rate > 0:
+            with open(marker, "w") as f:
+                f.write(str(rate))
+        elif os.path.exists(marker):
+            os.remove(marker)
+        return {"refresh_rate": rate, "app_key": f"steam.app.{dep['appid']}"}
+    except (OSError, AgentError) as exc:
+        return {"skipped": str(exc)}
+    finally:
+        if vr is not None:
+            vr.close()
+
+
+def set_refresh_rate_line(text, pkg):
+    text = "".join(line for line in text.splitlines(True) if " _refresh_rate " not in line)
+    if "\nsetsid " not in text:
+        return text
+    agent = shlex.quote(os.path.abspath(__file__))
+    line = (f'timeout 10s python3 {agent} _refresh_rate {shlex.quote(pkg)} '
+            '>"$app_dir/refresh-rate.log" 2>&1 9>&- || true')
+    # Run before the wrappers, which are kept immediately ahead of child=''. Also stay ahead of the play log
+    # and config-sync steps so repairing those doesn't move this line on the next upgrade.
+    for anchor in ("\n" + VIDEO_CODEC_LINE + "\n", "\n" + GAMEPAD_LINE + "\n", "\nchild=''\n", "\nsetsid "):
+        if anchor in text:
+            return text.replace(anchor, f"\n{line}{anchor}", 1)
+    return text
+
+
+def refresh_rate_worker(pkg):
+    pkg = check_pkg(pkg)
+    print(json.dumps(sync_refresh_rate(pkg, deployment(pkg), check_running=False)))
+
+
 def cmd_video_codec_status(args):
     """The shared codec installed on this Frame ({digest, revision}, {} if none or damaged) and whether FramePort's
     setting switched it off for every game ("disabled")."""
@@ -4117,7 +4202,7 @@ def configure_install(args, prep, moved):
     synced = sync_game_config(pkg, dep)
     write_deployment(pkg, dep)
     return {"ok": True, "base": base, "appid": appid, "moved_data_files": moved, "controller_models": models,
-            "config_sync": synced, "deployment": deployment_summary(dep)}
+            "config_sync": synced, "deployment": deployment_summary(dep), "refresh_rate": sync_refresh_rate(pkg, dep)}
 
 
 # --------------------------------------------------------------- Steam Frame controller models (XR_FB_render_model)
@@ -5399,7 +5484,8 @@ def cmd_set_settings(args):
                     else int(number)
         dep["configuration_fp"] = hashlib.sha256(json.dumps(applied, sort_keys=True).encode()).hexdigest()[:32]
         write_deployment(pkg, dep)
-    return {"settings": current, "controller_models": models, "config_sync": synced}
+    return {"settings": current, "controller_models": models, "config_sync": synced,
+            "refresh_rate": sync_refresh_rate(pkg, dep)}
 
 
 TITLE_MAX = 128
@@ -7912,6 +7998,588 @@ def monitor_session(stdin, stdout, monitor=None, sleep=time.sleep, max_ticks=Non
     return 0
 
 
+# ------------------------------------------------------------------------------------------ save backups (#352)
+# Steam doesn't sync Quest games' saves: the PC app backs them up and restores them. The game's two storage roots (its
+# internal /data/data/<pkg> folder and its /sdcard/Android/data/<pkg> folder) go into one tar.gz streamed over the SSH
+# exec channel: `_backup_saves '<json>'` = archive on stdout, one result JSON line on stderr; `_restore_saves '<json>'`
+# = archive on stdin, one result JSON line on stdout. Both refuse while the game runs and hold its launch lock. Files
+# Lepton's containers own are read and written in podman's user namespace (`podman unshare`, where the steamos user
+# owns every mapped id). Caches, shader/program binaries, IL2CPP copies, FrameBridge's own files, videos/OBBs and
+# anything over SAVES_MAX_FILE stay out; the manifest (last member) lists files, sizes, sha256 and what was left out.
+SAVES_MANIFEST = "frameport-saves.json"
+SAVES_ROLLBACK = "saves-before-restore.tar.gz"
+SAVES_FORMAT = 1
+SAVES_MAX_FILE = 64 << 20          # larger files are left out of a backup (the manifest's "skipped", reason "size")
+SAVES_MAX_TOTAL = 4 << 30          # a bigger backup is refused (that's game content, not saves)
+SAVES_RESTORE_MAX_FILE = 1 << 30   # restore (untrusted input): one member at most this big ...
+SAVES_RESTORE_MAX_TOTAL = 8 << 30  # ... all of them together at most this big
+SAVES_RESTORE_MAX_MEMBERS = 200000
+SAVES_MANIFEST_MAX = 32 << 20
+# folder names (any depth, case-insensitive) that only hold what a game rebuilds by itself (Android's own backup
+# leaves out cache/code_cache/no_backup too)
+SAVES_SKIP_DIRS = {"cache", "code_cache", "code cache", "no_backup", "il2cpp", "unityshadercache", "gpucache",
+                   "shadercache", "grshadercache", "dawncache", "dawngraphitecache", "dawnwebgpucache",
+                   "programbinarycache", "vulkanprogrambinarycache", "pipelinecaches", "fp_vk_shaders", "fp_spirv",
+                   "cachestorage", "scriptcache"}
+SAVES_SKIP_UNDER_SAVED = {"logs", "crashes"}  # Unreal's Saved/Logs and Saved/Crashes
+SAVES_SKIP_EXT = (".obb", ".apk", ".foz", ".mp4", ".m4v", ".mkv", ".webm", ".mov")
+SAVES_SKIP_PREFIX = ("fb_snap_", "framebridge")  # FrameBridge's snapshots, config and state (FramePort writes them)
+
+
+def saves_roots(base, pkg):
+    """{"internal": .../internal/<pkg> (= /data/data/<pkg>), "external": .../external/Android/data/<pkg>}."""
+    data = os.path.join(base, "lepton-data")
+    return {"internal": os.path.join(data, "internal", pkg),
+            "external": os.path.join(data, "external", "Android", "data", pkg)}
+
+
+def _saves_skip_dir(rel_parts, name):
+    low = name.lower()
+    if low in SAVES_SKIP_DIRS:
+        return True
+    return low in SAVES_SKIP_UNDER_SAVED and bool(rel_parts) and rel_parts[-1].lower() == "saved"
+
+
+def _saves_skip_file(name):
+    low = name.lower()
+    return low.endswith(SAVES_SKIP_EXT) or low.startswith(SAVES_SKIP_PREFIX)
+
+
+def collect_saves(roots, max_file=SAVES_MAX_FILE):
+    """What a backup holds: {"dirs": [(arc, path, stat)], "files": [(arc, path, stat)], "skipped": [{path, size,
+    reason}]}, sorted. Symlinks (Lepton's links), devices and pipes are never followed or included."""
+    import stat as st_
+
+    out = {"dirs": [], "files": [], "skipped": []}
+    for key in sorted(roots):
+        root = roots[key]
+        try:
+            rst = os.lstat(root)
+        except OSError:
+            continue
+        if not st_.S_ISDIR(rst.st_mode):
+            out["skipped"].append({"path": key, "size": 0, "reason": "not a folder"})
+            continue
+        out["dirs"].append((key, root, rst))
+        for cur, dirs, files in os.walk(root, topdown=True, followlinks=False):
+            rel = os.path.relpath(cur, root)
+            parts = [] if rel == "." else rel.split(os.sep)
+            keep = []
+            for d in sorted(dirs):
+                p = os.path.join(cur, d)
+                arc = "/".join([key, *parts, d])
+                try:
+                    s = os.lstat(p)
+                except OSError:
+                    continue
+                if st_.S_ISLNK(s.st_mode):
+                    out["skipped"].append({"path": arc, "size": 0, "reason": "link"})
+                elif _saves_skip_dir(parts, d):
+                    out["skipped"].append({"path": arc + "/", "size": 0, "reason": "cache"})
+                else:
+                    keep.append(d)
+                    out["dirs"].append((arc, p, s))
+            dirs[:] = keep
+            for f in sorted(files):
+                p = os.path.join(cur, f)
+                arc = "/".join([key, *parts, f])
+                try:
+                    s = os.lstat(p)
+                except OSError:
+                    continue
+                if not st_.S_ISREG(s.st_mode):
+                    out["skipped"].append({"path": arc, "size": 0,
+                                           "reason": "link" if st_.S_ISLNK(s.st_mode) else "special"})
+                elif _saves_skip_file(f):
+                    out["skipped"].append({"path": arc, "size": s.st_size, "reason": "not a save"})
+                elif s.st_size > max_file:
+                    out["skipped"].append({"path": arc, "size": s.st_size, "reason": "size"})
+                elif not os.access(p, os.R_OK):
+                    out["skipped"].append({"path": arc, "size": s.st_size, "reason": "unreadable"})
+                else:
+                    out["files"].append((arc, p, s))
+    return out
+
+
+class _HashingReader:
+    """A file read for the archive, hashed on the way (tarfile reads exactly the member's size)."""
+
+    def __init__(self, f):
+        self.f, self.h = f, hashlib.sha256()
+
+    def read(self, n=-1):
+        data = self.f.read(n)
+        self.h.update(data)
+        return data
+
+
+def _saves_tarinfo(arc, s, is_dir):
+    import tarfile
+
+    ti = tarfile.TarInfo(arc)
+    ti.type = tarfile.DIRTYPE if is_dir else tarfile.REGTYPE
+    ti.mode = s.st_mode & 0o7777
+    ti.uid, ti.gid = s.st_uid, s.st_gid
+    ti.uname = ti.gname = ""
+    ti.mtime = int(s.st_mtime)
+    ti.size = 0 if is_dir else s.st_size
+    return ti
+
+
+def _dep_version(dep):
+    """The installed build's game version (deployments record the APK's version as source_version)."""
+    return str((dep or {}).get("version") or (dep or {}).get("source_version") or "")
+
+
+def write_saves_tar(out, pkg, roots, dep=None, max_file=SAVES_MAX_FILE, max_total=SAVES_MAX_TOTAL):
+    """Stream the game's saves as tar.gz to `out` (a binary file object). Returns the manifest (also the archive's
+    last member, frameport-saves.json)."""
+    import gzip
+    import io
+    import tarfile
+
+    found = collect_saves(roots, max_file)
+    total = sum(s.st_size for _a, _p, s in found["files"])
+    if total > max_total:
+        raise AgentError(f"{pkg}'s saves are {total / 2**30:.1f} GiB, more than the {max_total / 2**30:.0f} GiB a "
+                         f"save backup takes (that's game content, not saves)")
+    manifest = {"format": SAVES_FORMAT, "package": pkg, "title": (dep or {}).get("title") or pkg,
+                "version": _dep_version(dep), "created": time.time(), "agent": AGENT_VERSION,
+                "roots": sorted(roots), "max_file": max_file, "files": [], "dirs": [], "skipped": found["skipped"]}
+    gz = gzip.GzipFile(fileobj=out, mode="wb", compresslevel=6)
+    with tarfile.open(fileobj=gz, mode="w|", format=tarfile.PAX_FORMAT) as tar:
+        for arc, _p, s in found["dirs"]:
+            tar.addfile(_saves_tarinfo(arc, s, True))
+            manifest["dirs"].append({"path": arc, "mode": s.st_mode & 0o7777, "uid": s.st_uid, "gid": s.st_gid})
+        for arc, p, s in found["files"]:
+            with open(p, "rb") as f:
+                reader = _HashingReader(f)
+                tar.addfile(_saves_tarinfo(arc, s, False), reader)
+            manifest["files"].append({"path": arc, "size": s.st_size, "sha256": reader.h.hexdigest(),
+                                      "mode": s.st_mode & 0o7777, "uid": s.st_uid, "gid": s.st_gid,
+                                      "mtime": int(s.st_mtime)})
+        raw = json.dumps(manifest, indent=1).encode()
+        ti = tarfile.TarInfo(SAVES_MANIFEST)
+        ti.size, ti.mtime, ti.mode = len(raw), int(manifest["created"]), 0o644
+        tar.addfile(ti, io.BytesIO(raw))
+    gz.close()
+    return manifest
+
+
+def saves_summary(manifest):
+    return {"package": manifest.get("package"), "files": len(manifest.get("files") or []),
+            "bytes": sum(int(f.get("size") or 0) for f in manifest.get("files") or []),
+            "skipped": [s for s in manifest.get("skipped") or [] if s.get("reason") in ("size", "unreadable")],
+            "created": manifest.get("created"), "version": manifest.get("version")}
+
+
+def _saves_member_name(name):
+    """A member's path as parts, or None when it isn't confined to internal/ or external/ (absolute, '..', NUL,
+    backslashes, overlong)."""
+    if not isinstance(name, str) or not name or "\0" in name or "\\" in name or name.startswith("/"):
+        return None
+    parts = [p for p in name.split("/") if p not in ("", ".")]
+    if not parts or parts[0] not in ("internal", "external") or ".." in parts:
+        return None
+    if len(name) > 4096 or any(len(p) > 255 for p in parts):
+        return None
+    return parts
+
+
+def stage_saves_archive(inp, staging, max_file=SAVES_RESTORE_MAX_FILE, max_total=SAVES_RESTORE_MAX_TOTAL,
+                        max_members=SAVES_RESTORE_MAX_MEMBERS):
+    """Read an untrusted save archive from `inp` into `staging` (flat numbered files, never the members' names).
+    Returns (entries {parts tuple: {kind, mode, mtime, staged, size, sha256}}, manifest). Refuses links, devices, paths
+    outside the two roots, duplicates, oversize members and files that don't match the manifest."""
+    import tarfile
+
+    entries, manifest, total, count = {}, None, 0, 0
+    try:
+        tar = tarfile.open(fileobj=inp, mode="r|gz")
+    except (tarfile.TarError, OSError, EOFError) as exc:
+        raise AgentError(f"not a save backup (unreadable archive: {exc})") from None
+    try:
+        for m in tar:
+            count += 1
+            if count > max_members:
+                raise AgentError("the backup has too many files")
+            if m.name == SAVES_MANIFEST:
+                if not m.isreg() or m.size > SAVES_MANIFEST_MAX or manifest is not None:
+                    raise AgentError("the backup's manifest is invalid")
+                try:
+                    manifest = json.loads(tar.extractfile(m).read().decode("utf-8"))
+                except ValueError:
+                    raise AgentError("the backup's manifest is invalid") from None
+                continue
+            parts = _saves_member_name(m.name)
+            if parts is None:
+                raise AgentError(f"the backup has a file outside the game's save folders: {m.name[:200]!r}")
+            key = tuple(parts)
+            if key in entries:
+                raise AgentError(f"the backup has {m.name[:200]!r} twice")
+            if m.isdir():
+                entries[key] = {"kind": "dir", "mode": m.mode & 0o7777, "mtime": int(m.mtime or 0)}
+                continue
+            if not m.isreg():
+                raise AgentError(f"the backup has a link or special file: {m.name[:200]!r}")
+            if len(parts) < 2:
+                raise AgentError(f"the backup has a file in place of a save folder: {m.name[:200]!r}")
+            if m.size > max_file:
+                raise AgentError(f"{m.name[:200]!r} in the backup is too big ({m.size} bytes)")
+            total += m.size
+            if total > max_total:
+                raise AgentError("the backup is too big to restore")
+            staged = os.path.join(staging, f"{len(entries):08d}")
+            src = tar.extractfile(m)
+            h = hashlib.sha256()
+            with open(staged, "wb") as f:
+                left = m.size
+                while left:
+                    chunk = src.read(min(left, 1 << 20))
+                    if not chunk:
+                        raise AgentError("the backup is cut off")
+                    h.update(chunk)
+                    f.write(chunk)
+                    left -= len(chunk)
+            entries[key] = {"kind": "file", "mode": m.mode & 0o7777, "mtime": int(m.mtime or 0), "staged": staged,
+                            "size": m.size, "sha256": h.hexdigest()}
+    except (tarfile.TarError, EOFError, zlib.error, OSError) as exc:
+        raise AgentError(f"the backup is damaged or cut off ({exc})") from None
+    finally:
+        try:
+            tar.close()
+        except Exception:  # noqa: BLE001
+            pass
+    if not isinstance(manifest, dict) or manifest.get("format") != SAVES_FORMAT:
+        raise AgentError("not a FramePort save backup (no manifest)")
+    listed = {}
+    for f in manifest.get("files") or []:
+        parts = _saves_member_name(str((f or {}).get("path", "")))
+        if parts is not None:
+            listed[tuple(parts)] = f
+    for key, e in entries.items():
+        if e["kind"] != "file":
+            continue
+        f = listed.get(key)
+        if not f or f.get("sha256") != e["sha256"] or f.get("size") != e["size"]:
+            raise AgentError(f"the backup is damaged: {'/'.join(key)[:200]} doesn't match its manifest")
+    return entries, manifest
+
+
+def _saves_dest(roots, parts):
+    return os.path.join(roots[parts[0]], *parts[1:])
+
+
+def check_saves_destinations(roots, entries):
+    """No restored path may pass through or replace a link, or swap a file for a folder (Lepton keeps links in a
+    game's storage: writing through one would land outside it)."""
+    import stat as st_
+
+    for key, e in entries.items():
+        for i in range(1, len(key) + 1):
+            sub = key[:i]
+            path = _saves_dest(roots, sub)
+            try:
+                s = os.lstat(path)
+            except FileNotFoundError:
+                break  # the rest gets created
+            if st_.S_ISLNK(s.st_mode):
+                raise AgentError(f"won't restore through the link {'/'.join(sub)}")
+            want_dir = i < len(key) or e["kind"] == "dir"
+            if want_dir and not st_.S_ISDIR(s.st_mode):
+                raise AgentError(f"{'/'.join(sub)} is a file on the Frame but a folder in the backup")
+            if not want_dir and not st_.S_ISREG(s.st_mode):
+                raise AgentError(f"{'/'.join(sub)} is a folder on the Frame but a file in the backup")
+
+
+def _saves_parent_stat(path):
+    """stat of path's nearest existing folder."""
+    p = path
+    while True:
+        try:
+            return os.stat(p)
+        except OSError:
+            parent = os.path.dirname(p)
+            if parent == p:
+                raise
+            p = parent
+
+
+def _saves_chown(path, uid, gid):
+    try:
+        s = os.lstat(path)
+        if (s.st_uid, s.st_gid) != (uid, gid):
+            os.chown(path, uid, gid)
+    except OSError:
+        pass  # (outside podman's namespace only our own ids can be set)
+
+
+def _saves_mkdir(path, mode=None):
+    """Create a missing folder (and its parents) owned like its parent folder; mode None = the parent's mode."""
+    if os.path.isdir(path):
+        return
+    parent = os.path.dirname(path)
+    _saves_mkdir(parent)
+    ps = os.stat(parent)
+    os.mkdir(path)
+    os.chmod(path, ((ps.st_mode if mode is None else mode) & 0o2777) | 0o700)
+    _saves_chown(path, ps.st_uid, ps.st_gid)
+
+
+def apply_staged_saves(roots, entries, manifest):
+    """Put staged files in place: existing files keep their owner and mode, new ones get their folder's owner and the
+    backup's mode (at least u+rw); each file is swapped in with one rename. Save files the backup doesn't have go
+    (the same rules as a backup decide what's a save; files too big for the backup stay). Returns counts."""
+    import stat as st_
+
+    restored = removed = 0
+    for key in sorted((k for k, e in entries.items() if e["kind"] == "dir"), key=len):
+        _saves_mkdir(_saves_dest(roots, key), entries[key]["mode"])
+    for root in roots.values():
+        _saves_mkdir(root)
+    for key, e in sorted(entries.items()):
+        if e["kind"] != "file":
+            continue
+        dest = _saves_dest(roots, key)
+        _saves_mkdir(os.path.dirname(dest))
+        try:
+            s = os.lstat(dest)
+            uid, gid, mode = s.st_uid, s.st_gid, st_.S_IMODE(s.st_mode)
+        except FileNotFoundError:
+            ps = _saves_parent_stat(os.path.dirname(dest))
+            uid, gid, mode = ps.st_uid, ps.st_gid, (e["mode"] & 0o777) | 0o600
+        staged = e["staged"]
+        os.chmod(staged, mode)
+        _saves_chown(staged, uid, gid)
+        if e.get("mtime"):
+            os.utime(staged, (e["mtime"], e["mtime"]))
+        os.replace(staged, dest)
+        restored += 1
+    keep = {"/".join(k) for k, e in entries.items() if e["kind"] == "file"}
+    max_file = manifest.get("max_file")
+    current = collect_saves(roots, max_file if isinstance(max_file, int) and max_file > 0 else SAVES_MAX_FILE)
+    for arc, path, _s in current["files"]:
+        if arc not in keep:
+            try:
+                os.remove(path)
+                removed += 1
+            except OSError:
+                pass
+    return {"restored": restored, "removed": removed}
+
+
+def saves_context(args):
+    """(pkg, dep, roots) of an installed Quest game (its roots are real folders, or missing)."""
+    pkg = check_pkg(args.get("package"))
+    dep = deployment(pkg)
+    if not dep:
+        raise AgentError(f"{pkg} is not installed")
+    if dep.get("kind") in ("pcvr", "linux"):
+        raise AgentError("save backups are for Quest (Android) games only")
+    base = dep["base"]
+    if not os.path.isdir(os.path.join(base, "lepton-app")) and not os.path.isdir(os.path.join(base, "lepton-data")):
+        raise AgentError(f"{pkg}'s files are missing at {base} (storage not mounted?)")
+    roots = saves_roots(base, pkg)
+    data = os.path.realpath(os.path.join(base, "lepton-data"))
+    for r in roots.values():
+        if os.path.islink(r) or (os.path.lexists(r) and not _inside(os.path.realpath(r), data)):
+            raise AgentError(f"{r} is a link: refusing")
+    return pkg, dep, roots
+
+
+class _SavesLock:
+    """The game's launch lock (launch.sh holds it while the game runs): a backup or restore never overlaps a play
+    session, and a Play meanwhile is ignored like a double launch."""
+
+    def __init__(self, dep):
+        self.path, self.fd = os.path.join(dep["base"], ".launch.lock"), None
+
+    def __enter__(self):
+        if fcntl is None:
+            return self
+        self.fd = os.open(self.path, os.O_RDWR | os.O_CREAT, 0o644)
+        try:
+            fcntl.flock(self.fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+        except OSError:
+            os.close(self.fd)
+            self.fd = None
+            raise AgentError("the game is running") from None
+        return self
+
+    def __exit__(self, *exc):
+        if self.fd is not None:
+            os.close(self.fd)
+            self.fd = None
+
+
+def saves_running(dep):
+    return bool(dep.get("appid")) and container_running(dep["appid"])
+
+
+def _saves_in_namespace(op, args):
+    """Run op again inside podman's user namespace (stdio inherited); None = run it in this process."""
+    owner = as_owner()
+    if not owner or os.environ.get("FRAMEPORT_SAVES_NS") == "1":
+        return None
+    env = dict(os.environ, FRAMEPORT_SAVES_NS="1")
+    return subprocess.run(owner + [sys.executable or "python3", os.path.abspath(__file__), "_saves_ns", op,
+                                   json.dumps(args)], env=env).returncode
+
+
+def saves_backup_session(args, out, err):
+    """`_backup_saves`: the archive on `out`, one JSON line (ok + summary, or error) on `err`; exit 0 = complete."""
+    def emit(obj):
+        err.write(json.dumps(obj) + "\n")
+        err.flush()
+
+    def here():
+        pkg, dep, roots = saves_context(args)
+        manifest = write_saves_tar(out, pkg, roots, dep, int(args.get("max_file") or SAVES_MAX_FILE),
+                                   int(args.get("max_total") or SAVES_MAX_TOTAL))
+        out.flush()
+        emit({"ok": True, "result": saves_summary(manifest)})
+        return 0
+    try:
+        return _saves_run("backup", args, here)
+    except AgentError as exc:
+        emit({"ok": False, "error": str(exc)})
+        return 1
+    except Exception as exc:  # noqa: BLE001
+        emit({"ok": False, "error": f"{type(exc).__name__}: {exc}"})
+        return 1
+
+
+def saves_restore_session(args, inp, out):
+    """`_restore_saves`: the archive on `inp` (or the rollback copy with args.rollback), one JSON line on `out`."""
+    def emit(obj):
+        out.write(json.dumps(obj) + "\n")
+        out.flush()
+
+    def here():
+        emit({"ok": True, "result": restore_saves(args, inp)})
+        return 0
+    try:
+        return _saves_run("restore", args, here)
+    except AgentError as exc:
+        emit({"ok": False, "error": str(exc)})
+        return 1
+    except Exception as exc:  # noqa: BLE001
+        emit({"ok": False, "error": f"{type(exc).__name__}: {exc}"})
+        return 1
+
+
+def _saves_run(op, args, here):
+    """Outside podman's namespace: check the game, take its launch lock, then run `op` in the namespace (stdio
+    inherited). Inside it (FRAMEPORT_SAVES_NS=1), or without podman (tests): run `here` in this process."""
+    if os.environ.get("FRAMEPORT_SAVES_NS") == "1":
+        return here()
+    _pkg, dep, _roots = saves_context(args)
+    if saves_running(dep):
+        raise AgentError("the game is running")
+    with _SavesLock(dep):
+        code = _saves_in_namespace(op, args)
+        return here() if code is None else code
+
+
+def restore_saves(args, inp):
+    """Stage (and check) the whole archive first, keep the current saves as <base>/saves-before-restore.tar.gz (one
+    copy), then swap the files in. A failure while swapping puts the rollback copy back. args.rollback restores that
+    copy instead of `inp` (the current saves become the new rollback copy: undo of the undo)."""
+    pkg, dep, roots = saves_context(args)
+    base = dep["base"]
+    rollback = os.path.join(base, SAVES_ROLLBACK)
+    staging = tempfile.mkdtemp(prefix=".saves-restore-", dir=base)
+    limits = (SAVES_RESTORE_MAX_FILE, SAVES_RESTORE_MAX_TOTAL, SAVES_RESTORE_MAX_MEMBERS)
+    try:
+        if args.get("rollback"):
+            if not os.path.isfile(rollback):
+                raise AgentError("there's no copy of the saves from before the last restore")
+            with open(rollback, "rb") as f:
+                entries, manifest = stage_saves_archive(f, staging, *limits)
+        else:
+            entries, manifest = stage_saves_archive(inp, staging, *limits)
+        if manifest.get("package") != pkg:
+            raise AgentError(f"this backup is of {manifest.get('package')}, not {pkg}")
+        check_saves_destinations(roots, entries)
+        tmp = rollback + ".tmp"
+        with open(tmp, "wb") as f:
+            write_saves_tar(f, pkg, roots, dep, SAVES_MAX_FILE, 1 << 62)
+        os.replace(tmp, rollback)
+        try:
+            counts = apply_staged_saves(roots, entries, manifest)
+        except Exception as exc:  # noqa: BLE001
+            undo = os.path.join(staging, "undo")
+            os.mkdir(undo)
+            try:
+                with open(rollback, "rb") as f:
+                    back, back_manifest = stage_saves_archive(f, undo)
+                apply_staged_saves(roots, back, back_manifest)
+                state = "the saves from before were put back"
+            except Exception as again:  # noqa: BLE001
+                state = f"putting the saves from before back failed too ({again}); they're in {rollback}"
+            raise AgentError(f"restoring failed ({exc}); {state}") from exc
+        return {**counts, "package": pkg, "rollback": rollback, "rollback_size": os.path.getsize(rollback),
+                "backup_created": manifest.get("created"), "backup_version": manifest.get("version")}
+    finally:
+        shutil.rmtree(staging, ignore_errors=True)
+
+
+def _saves_info(found):
+    return {"files": len(found["files"]), "bytes": sum(s.st_size for _a, _p, s in found["files"]),
+            "skipped": [s for s in found["skipped"] if s["reason"] in ("size", "unreadable")]}
+
+
+def cmd_saves_info(args):
+    """What a save backup of the game would hold now (files, bytes, large files left out), whether the game runs, and
+    the rollback copy of the last restore."""
+    pkg, dep, roots = saves_context(args)
+    max_file = int(args.get("max_file") or SAVES_MAX_FILE)
+    owner = as_owner()
+    if owner:  # the app's files may belong to mapped ids: count them in podman's namespace
+        p = run(owner + [sys.executable or "python3", os.path.abspath(__file__), "_saves_ns", "info",
+                         json.dumps(args)], env=dict(os.environ, FRAMEPORT_SAVES_NS="1"))
+        try:
+            info = json.loads(p.stdout.strip().splitlines()[-1])
+        except (ValueError, IndexError):
+            raise AgentError(f"couldn't read {pkg}'s saves: {p.stderr.strip()[-300:]}") from None
+    else:
+        info = _saves_info(collect_saves(roots, max_file))
+    rollback = os.path.join(dep["base"], SAVES_ROLLBACK)
+    info.update(package=pkg, running=saves_running(dep), version=_dep_version(dep),
+                rollback={"size": os.path.getsize(rollback), "time": os.path.getmtime(rollback)}
+                if os.path.isfile(rollback) else None)
+    return info
+
+
+def cmd_saves_rollback_delete(args):
+    """Remove the copy of the saves from before the last restore."""
+    _pkg, dep, _roots = saves_context(args)
+    path = os.path.join(dep["base"], SAVES_ROLLBACK)
+    if os.path.isfile(path):
+        os.remove(path)
+        return {"removed": True}
+    return {"removed": False}
+
+
+def saves_ns_main(op, raw):
+    """`_saves_ns <op> '<json>'`: the part of a save command that runs inside `podman unshare`."""
+    os.environ["FRAMEPORT_SAVES_NS"] = "1"
+    args = json.loads(raw)
+    if op == "backup":
+        return saves_backup_session(args, sys.stdout.buffer, sys.stderr)
+    if op == "restore":
+        return saves_restore_session(args, sys.stdin.buffer, sys.stdout)
+    if op == "info":
+        try:
+            _pkg, _dep, roots = saves_context(args)
+            print(json.dumps(_saves_info(collect_saves(roots, int(args.get("max_file") or SAVES_MAX_FILE)))))
+            return 0
+        except AgentError as exc:
+            print(str(exc), file=sys.stderr)
+            return 1
+    return 2
+
+
 COMMANDS = {n[4:]: f for n, f in globals().items() if n.startswith("cmd_")}
 
 
@@ -7924,6 +8592,12 @@ def main():
     if len(sys.argv) >= 2 and sys.argv[1] == "_vr_overlay_round":
         print(json.dumps(overlay_autostart_round()), flush=True)
         return
+    if len(sys.argv) >= 3 and sys.argv[1] == "_backup_saves":
+        return saves_backup_session(json.loads(sys.argv[2]), sys.stdout.buffer, sys.stderr)
+    if len(sys.argv) >= 3 and sys.argv[1] == "_restore_saves":
+        return saves_restore_session(json.loads(sys.argv[2]), sys.stdin.buffer, sys.stdout)
+    if len(sys.argv) >= 4 and sys.argv[1] == "_saves_ns":
+        return saves_ns_main(sys.argv[2], sys.argv[3])
     if len(sys.argv) >= 2 and sys.argv[1] == "_monitor":
         return monitor_session(sys.stdin, sys.stdout)
     if len(sys.argv) >= 3 and sys.argv[1] == "_shortcuts_worker":
@@ -7952,6 +8626,9 @@ def main():
     if len(sys.argv) >= 3 and sys.argv[1] == "_config_sync":
         config_sync_worker(sys.argv[2])
         return 0
+    if len(sys.argv) >= 3 and sys.argv[1] == "_refresh_rate":
+        refresh_rate_worker(sys.argv[2])
+        return 0
     if len(sys.argv) >= 3 and sys.argv[1] == "_tools_worker":
         tools_worker(sys.argv[2])
         return 0

announcements/README.md

@@ -0,0 +1,40 @@
+# Announcements
+
+`current.md` is the one announcement FramePort shows as a pop-up in the app. Edit it on `main`: the app reads it
+from GitHub `main` (raw.githubusercontent.com) at most every 6 hours, so a push reaches everyone without a release.
+
+## Who sees it
+
+- **Only people who already used FramePort before the announcement's `date`.** A new install never shows one, and
+  nor does an announcement published before FramePort was installed.
+- **Once.** Closing it in any way (the X, a click outside it, Escape, or its button) dismisses it for good. The app
+  remembers dismissals in its settings (`announce.dismissed`).
+- **A new announcement = a new `id`.** Fixing a typo with the same `id` doesn't show it again to anyone who closed it.
+  A new `id` shows to everyone who used FramePort before its `date`, whether they closed the earlier one or not.
+
+## The file
+
+```markdown
+---
+active: true                    # false = nothing is shown (the fields are still checked)
+id: meetup-2026-11             # letters, digits, . _ -  — change it for every new announcement
+title: Steam Frame meetup on Discord  # required
+date: 2026-11-02T18:00:00Z      # required: when it was published (UTC; a bare date = midnight UTC)
+image: announcements/meetup.png # optional: a file in this folder, or an https URL (PNG, JPEG, WebP, GIF; ≤ 5 MiB)
+image_alt: The meetup poster    # optional: what the picture shows (screen readers)
+button: Join the meetup         # optional: an action button, with url
+url: https://example.com/meetup
+expires: 2026-11-30             # optional: not shown after this day (UTC, inclusive)
+---
+The body, in Markdown: **bold**, *italic*, `code`, [links](https://frameport.app/), lists, headings.
+```
+
+The body is Markdown (no HTML). A `date` in the future works as a schedule: nobody sees it before then.
+
+Images look best at about 2:1 (e.g. 1200×600). The pop-up is 600 px wide and shows between 140 and 320 px of the
+picture's height.
+
+`pytest tests/test_announcements.py` checks this file, so a broken announcement fails CI instead of silently showing
+nothing.
+
+To turn announcements off for testing: `FRAMEPORT_NO_ANNOUNCEMENTS=1`.

announcements/current.md

@@ -0,0 +1,16 @@
+---
+# The announcement FramePort shows once (announcements/README.md). Switched off: set active: true.
+active: false
+id: example-2026-10
+title: Example announcement
+date: 2026-10-15T12:00:00Z
+# image: announcements/example.png
+# image_alt: What the picture shows
+# button: Read more
+# url: https://frameport.app/changelog/
+# expires: 2026-11-30
+---
+This is where the text goes, in **Markdown**: *emphasis*, `code`, [links](https://frameport.app/) and lists.
+
+- Keep it short: one or two paragraphs.
+- Change `id` for every new announcement.

artifacts/SHA256SUMS

@@ -1,24 +1,23 @@
 1a4dce5c4a6d0dfc5f20e55ac29e70c73cc2cc124c21ca6a7e1b316e6afb1c79  ./arm64-v8a/libVkLayer_fdm_darken.so
 5becb96ee86fbda0ce98c0e0fd064f8ba092314aceaa400e3dcc785705dc3c23  ./arm64-v8a/libVkLayer_fp_shaderfix.so
-fbc3b0238462d976d234fee6740db92b873c85d6bb22a6b01428e64e9058ed83  ./arm64-v8a/liba32bridge.so
+222727ddabf7eaee08c92e86c64f02edc6639667e9041ab2629032b885c9ae3a  ./arm64-v8a/liba32bridge.so
 c9c3da5cac224c38e2210b781bd12b7f97e02bd6b0ebb0ef85543e4ea4b76671  ./arm64-v8a/liba32rt.so
 18d8d917e83a6d87008f41908eb478dff635e798844e125abd1e8a5cf31805e2  ./arm64-v8a/liba32stub.so
 d6337034fb0bdcca7ef9b7063d85b7586b8508b63b435959e8fffaba0691091c  ./arm64-v8a/libfp_langpack.so
 69102b128e00fa1809489a7308e09c1505f563bf7091bbdd3fe5a58e4cc96c2c  ./arm64-v8a/libfp_luajit.so
-e2465e8960b4dd591d303e30c9d80b8a7c7c7eeff53736419c7105a697725732  ./arm64-v8a/libfp_ovrp.so
+321da502e0f8f46f0880aad39fe6b84bdef88f925164568814cf704a1b31a577  ./arm64-v8a/libfp_ovrp.so
 40defdaddcda53bd2649eb48076fae1622bfc2bfc88e9e03c94fc8b45af2a4f2  ./arm64-v8a/libfp_ovrtrace.so
 0167c2fde5dfde62897f9d85afc4fc8e97784e988b5b8df6cea8c407240b3424  ./arm64-v8a/libfp_tkeys.so
-e8c0965c188665a4e565e4a3af983ef1866d1cf9225665cc90d8df286bc96ef3  ./arm64-v8a/libfp_vk.so
-7fa29014eed2881ee0d7ac486434de9c5fe46710e640b15f697030ad052acfc4  ./arm64-v8a/libfp_vkext.so
+468b97ee3c36481d939a87425b15880c7a801d16732350e1e2832b385d63f20a  ./arm64-v8a/libfp_vk.so
 383054f8b3b41dde76d062c71856cd3163655e50009c08454bc1793f393ead65  ./arm64-v8a/libfpg.so
-5432674a59d02f411cd853a5dc57e3fa547d1ac518f25bf433fc54c43677177a  ./arm64-v8a/libfpglmv.so
-8a8f6b1da8952cb3933a5b53558424a5fc56043b2527a16bb6dd62a00d2de01a  ./arm64-v8a/libframe_xrshim.so
-227626fcd96ea31a5c4fbd006e971b40f9b5a1e10d1bb30456f0a2792fa2c9e2  ./arm64-v8a/libglshim.so
-34ae4e6757adf83942d179a098ae91b4da187fead17e02a3a65dd6507daf2073  ./arm64-v8a/libopenxr_loader_generic.so
+4a13a33e112c9e4e3c5ff4337ed6e988a9e5b3602f48d654df148ef5fafbf426  ./arm64-v8a/libfpglmv.so
+36400eae4ba3807bcfcd54463daa217347032b07218792faa448d8cbbd086a0e  ./arm64-v8a/libframe_xrshim.so
+19ba5ed3c4b780f5ae46251f6958f552acfc5f13c8bb39f995579593fa8990c6  ./arm64-v8a/libglshim.so
+b1ec76d3c93862ef2e5dcffab44b4b45cdbd791df3c6870350a04be44a0e0137  ./arm64-v8a/libopenxr_loader_generic.so
 1feaeafad467c4cafdf2b018a4d84b0bee200c3f711697b4ce97e66a3ba256ca  ./arm64-v8a/libovrplatformcompat.so
-f7f8349b0d3e9a29305b4d2aa1eb3ec6b394feff4d3e2ea07b8a65f6df1d15f9  ./arm64-v8a/libvrapi.so
-71b3df219f331bcb42a483550e35371475b1aa886762ddcf5d0d739d74c51ead  ./arm64-v8a/libvrapi_foveation.so
-c7dea9e3435f36e281341121a9e43102f008cc08bba08191c21bac14912e6b87  ./armeabi-v7a/libopenxr_loader_generic.so
+a4ed80ae45ca90758239f152ea5a2e8c127d491e1e697ea5680db6fd7f72db07  ./arm64-v8a/libvrapi.so
+a4ed80ae45ca90758239f152ea5a2e8c127d491e1e697ea5680db6fd7f72db07  ./arm64-v8a/libvrapi_foveation.so
+b35a45e3e4948352a5433553420848eb7a8837afbe114edb1e95979872e25426  ./armeabi-v7a/libopenxr_loader_generic.so
 1871eae093432d277da4bc751bf5f3269dfcf11f9168260b0c3caadb0dedb19d  ./dex/oculusos-stubs.dex
 b634ab5640e258563c536e658cad87080553df6f34f62269a21d554844e58bfe  ./hevc/COPYING.FFmpeg
 141de01f0d40b97d4f9a720db5ab8ea442f6aa35db5272048899292884994a1c  ./hevc/libstagefrighthw.so

bootstrap/bootstrap.sh

@@ -34,7 +34,11 @@ say "Letting FramePort log in"
 key=$(curl -fsS "$PC_URL/key?code=$PAIR_CODE")
 [[ "$key" == ssh-ed25519\ * ]] || { echo "Couldn't reach FramePort at $PC_URL. Is it still open?"; exit 1; }
 mkdir -p ~/.ssh && chmod 700 ~/.ssh && touch ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys
-grep -qxF "$key" ~/.ssh/authorized_keys || echo "$key" >> ~/.ssh/authorized_keys
+# a file without a final newline would glue our key onto its last line, where sshd never matches it (GitHub #242)
+grep -qxF "$key" ~/.ssh/authorized_keys || {
+  [ -n "$(tail -c1 ~/.ssh/authorized_keys)" ] && echo >> ~/.ssh/authorized_keys
+  echo "$key" >> ~/.ssh/authorized_keys
+}
 
 say "Setting up Lepton's containers"
 # rootless podman leaks one kernel keyring per container start; ~200 game launches would exhaust the quota

catalog/games/ScaredBySquares.Game.yaml

@@ -0,0 +1,19 @@
+package: ScaredBySquares.Game
+title: Scared By Squares
+status: unknown
+notes: 'Showed black and dropped back to the home environment while the game kept running (sound only, GitHub 323).
+  Fixed in FramePort 1.2.1 and checked on the Frame without the headset (the game runs at 72 fps and SteamVR keeps it
+  as the running game); not yet confirmed in the headset. Rebuild and reinstall the game after updating FramePort.'
+details: 'The game (Unreal 4.27, OpenXR) creates two controller actions named "turn" (an action mapping and an axis
+  mapping called Turn). The Frame''s runtime accepts the duplicate, then fails to load the input manifest it builds
+  from the actions ("SetXrInputConfig failed. Failed to load manifest") and treats the game as closed. FrameBridge''s
+  action_dedup (on by default) creates the second one as "turn_2".'
+tested_version: '2'
+engine: Unreal
+xr: OpenXR
+frame:
+- frame.hw_video_decode
+- frame.unreal_skip_obb_check
+updated: '2026-10-16'
+min_app: 1.2.1
+source_hint: Scared By Squares

catalog/games/com.Astrea.Gundam.yaml

@@ -7,8 +7,14 @@ xr: OpenXR
 status: works
 notes: Uses Meta XR Audio via FMOD (not covered by patch_meta_xr_audio); if audio is missing, that is the likely
   cause.
+  frame.unity_text_input and device.text_input_window added from detection (not headset-verified).
+frame:
+- frame.unity_text_input
+device:
+- device.text_input_window
 verified:
   date: '2026-09-28'
   overport_cli: 1.2.3
   overport_runtime: 3.4.3-23204ea
   known_good_sha256: 63fff470777f2753d55ad50f8355573ced8fa48bcaee0f5e6a0c10369f951a38
+updated: '2026-10-15'

catalog/games/com.BithellGames.Arcsmith.yaml

@@ -6,9 +6,15 @@ engine: Unity
 xr: VrApi
 status: issues
 notes: Right eye distorts during movement (unresolved; swap, tracking, Valve layers, depth and pacing ruled out).
+  frame.unity_text_input and device.text_input_window added from detection (not headset-verified).
 details: Legacy VrApi via OVRPlugin; overport swaps in an OpenXR OVRPlugin. Do not remove VrApi.
+frame:
+- frame.unity_text_input
+device:
+- device.text_input_window
 verified:
   date: '2026-09-28'
   overport_cli: 1.2.3
   overport_runtime: 3.4.3-23204ea
   known_good_sha256: 192ff250f5fbec38b9c4e898f0b8408edc25901f46bb4b227f7ca60bbd9f0bba
+updated: '2026-10-15'

catalog/games/com.BolverkGames.GenotypeGame.yaml

@@ -6,9 +6,15 @@ engine: Unity
 xr: OpenXR
 status: works
 notes: Needed the GLES/sRGB swapchain fallback.
+  frame.unity_text_input and device.text_input_window added from detection (not headset-verified).
 details: Also available as a native PC SteamVR title.
+frame:
+- frame.unity_text_input
+device:
+- device.text_input_window
 verified:
   date: '2026-09-28'
   overport_cli: 1.2.3
   overport_runtime: 3.4.3-23204ea
   known_good_sha256: 158f7c4f5e8558029dc8cc5e8dcb4e67e846b261bf34e3e448fee7f657c74597
+updated: '2026-10-15'

catalog/games/com.CreaTeam.Sclerosis.yaml

@@ -0,0 +1,20 @@
+package: com.CreaTeam.Sclerosis
+title: Sclerosis
+status: works
+notes: Copy the "Amnesia The Dark Descent" folder from a Windows/Proton install to "FramePort/com.CreaTeam.Sclerosis/lepton-data/external".
+  Default hand positions are rather askew and should be amended via VR Controller Mappings in Steam itself. FOV
+  warping effects are EXTREMELY disorienting in VR, beware. Otherwise seems to work without issue.
+tested_version: 1.10.7
+engine: Unity
+xr: OpenXR
+frame:
+- frame.unity_text_input
+device:
+- device.text_input_window
+verified:
+  date: '2026-10-16'
+  known_good_sha256: e17421ad9894f5e57fb9b1b8110544715166756ef924b5a86831f6f20e70a6d5
+  app: 1.2.0
+  overport_cli: 1.2.5
+  issue: 339
+source_hint: Sclerosis_v1.10.7

catalog/games/com.Curve.LawnMowingSimulatorVR.yaml

@@ -0,0 +1,24 @@
+package: com.Curve.LawnMowingSimulatorVR
+title: Lawn Mowing Simulator VR
+status: issues
+notes: Left eye textures flicker only when mowing in specific areas.
+tested_version: 1.0.50
+engine: Unity
+xr: OpenXR
+frame:
+- frame.unity_text_input
+device:
+- device.text_input_window
+adapter:
+  haptic_fix: 1
+  pose_consistency: 1
+  hide_space_warp: 1
+verified:
+  date: '2026-10-16'
+  known_good_sha256: 2653e9b1dfbd11d607b5dd17b9c07ab19d9e98e1004ef9b14cb52867b5f959dc
+  app: 1.2.0
+  overport_cli: 1.2.5
+  frame_build: '20261015.6141207'
+  agent: 91
+  issue: 344
+source_hint: com.Curve.LawnMowingSimulatorVR

catalog/games/com.FlatHeadStudio.DeadlyDelivery.yaml

@@ -0,0 +1,10 @@
+package: com.FlatHeadStudio.DeadlyDelivery
+title: Deadly Delivery
+status: unsupported
+notes: "Quits after Meta's entitlement check fails: it needs Meta's online services."
+tested_version: 1.0.30
+engine: Unity
+xr: OpenXR
+verified:
+  date: '2026-10-15'
+  issue: 322

catalog/games/com.FuturLab.PowerWashSimulator.yaml

@@ -6,8 +6,14 @@ engine: Unity
 xr: OpenXR
 status: works
 notes: Recommended pilot title.
+  frame.unity_text_input and device.text_input_window added from detection (not headset-verified).
+frame:
+- frame.unity_text_input
+device:
+- device.text_input_window
 verified:
   date: '2026-09-28'
   overport_cli: 1.2.3
   overport_runtime: 3.4.3-23204ea
   known_good_sha256: 2300f628ce04c1da60b52fed18335d6a31b88cc88313fd6d2c0e1a8e7785126f
+updated: '2026-10-15'

catalog/games/com.HypetrainDigitalLtd.Breathedge.yaml

@@ -0,0 +1,22 @@
+package: com.HypetrainDigitalLtd.Breathedge
+title: Breathedge VR
+status: works
+notes: Loading fade is broken and only shows a small square but the game works!
+tested_version: 1.0.7
+engine: Unreal
+xr: VrApi
+alt_overport:
+- patch_remove_unreal_force_quit
+frame:
+- frame.hw_video_decode
+adapter:
+  haptic_fix: 1
+verified:
+  date: '2026-10-16'
+  known_good_sha256: 4975a32fbf36b4d417142a944bf7d771c18a184dc0320b5937ac2c67bd013575
+  app: 1.2.0
+  overport_cli: 1.2.5
+  frame_build: '20261015.6141207'
+  agent: 91
+  issue: 347
+source_hint: Breathadge

catalog/games/com.JustAddWater.SniperEliteVR_EN.yaml

@@ -5,9 +5,14 @@ source_hint: 'Sniper Elite VR- Winter Warrior'
 engine: Unity
 xr: OpenXR
 status: works
-notes: ''
+notes: frame.unity_text_input and device.text_input_window added from detection (not headset-verified).
+frame:
+- frame.unity_text_input
+device:
+- device.text_input_window
 verified:
   date: '2026-09-28'
   overport_cli: 1.2.3
   overport_runtime: 3.4.3-23204ea
   known_good_sha256: 6b8170da5826b9a35326a20967a0e5a242d46fb569a0a3c669e1cbd368102dd3
+updated: '2026-10-15'

catalog/games/com.Miragesoft.RealVrFishingQ.yaml

@@ -0,0 +1,28 @@
+package: com.Miragesoft.RealVrFishingQ
+title: Real VR Fishing
+status: issues
+notes: Seems to be almost 100% functional with meta permissions enabled.  In the new Mixed Reality mode, the room
+  scan doesn't seem to do anything and I can't seem to manually place anything either.
+tested_version: '3.06096'
+engine: Unity
+xr: OpenXR
+frame:
+- frame.vivox_audio_route
+- frame.unity_text_input
+- frame.oculusos
+- frame.meta_permissions
+device:
+- device.text_input_window
+adapter:
+  haptic_fix: 1
+  scene_emul: 1
+  controller_models: 1
+verified:
+  date: '2026-10-16'
+  known_good_sha256: 8b17dd26ef0486618ec006f9d948a60dabea4d7763bbe6061db07ee8aad27c76
+  app: 1.2.0
+  overport_cli: 1.2.5
+  frame_build: '20261007.6125817'
+  agent: 91
+  issue: 333
+source_hint: Real VR Fishing

catalog/games/com.Novelab.Demeter.yaml

@@ -6,11 +6,14 @@ engine: Unity
 xr: OpenXR
 status: works
 notes: Passthrough + Meta scene/room emulated from the Steam guardian (scene_emul=1).
+  frame.unity_text_input and device.text_input_window added from detection (not headset-verified).
 details: Mixed-reality-only; builds its level from the room model, which the adapter emulates from the Steam guardian.
 overport_extra:
 - patch_force_passthrough
 adapter:
   scene_emul: 1
+device:
+- device.text_input_window
 verified:
   date: '2026-09-28'
   overport_cli: 1.2.3
@@ -18,3 +21,5 @@ verified:
   known_good_sha256: 9f900fc86fbb2663abe83c82ab79cc72bbf1f93fea54f7583fd274dd07e3d09c
 frame:
 - frame.meta_permissions
+- frame.unity_text_input
+updated: '2026-10-15'

catalog/games/com.RealitiesIO.puzzlingPlaces.yaml

@@ -0,0 +1,25 @@
+package: com.RealitiesIO.puzzlingPlaces
+title: Puzzling Places
+status: issues
+notes: Works fine, but pointers dont show well on main menu, easy to work around.
+tested_version: '2.14'
+engine: Unreal
+xr: OpenXR
+overport_extra:
+- patch_disable_space_warp
+alt_overport:
+- patch_remove_unreal_force_quit
+frame:
+- frame.unreal_skip_obb_check
+- frame.unreal_ovrp_entrypoints
+- frame.hw_video_decode
+adapter:
+  equirect_emul: 1
+  haptic_fix: 1
+verified:
+  date: '2026-10-16'
+  known_good_sha256: 8d9bb64b0af4c34269fffb64c5ef7515d6ba4715f5234f95517975b8e2b56c00
+  app: 1.2.0
+  overport_cli: 1.2.5
+  issue: 359
+source_hint: Puzzling Places

catalog/games/com.SDI.TWD.yaml

@@ -0,0 +1,22 @@
+package: com.SDI.TWD
+title: 'The Walking Dead: Saints & Sinners'
+status: works
+tested_version: Shipping / 2024.01.19 / build 400355 - STAGECH1
+engine: Unreal
+xr: VrApi
+alt_overport:
+- patch_remove_unreal_force_quit
+frame:
+- frame.ovr_microphone
+- frame.hw_video_decode
+adapter:
+  haptic_fix: 1
+verified:
+  date: '2026-10-17'
+  known_good_sha256: 4b172a5abba0901c75278fb55b867f344120c658c26ae07c8558d90e0c38cec3
+  app: 1.2.0
+  overport_cli: 1.2.5
+  frame_build: '20261007.6125817'
+  agent: 91
+  issue: 376
+source_hint: The Walking Dead- Saints & Sinners

catalog/games/com.SchellGames.LostRecipes.yaml

@@ -0,0 +1,22 @@
+package: com.SchellGames.LostRecipes
+title: Lost Recipes
+status: works
+tested_version: 1.0.1+273175
+engine: Unreal
+xr: VrApi
+alt_overport:
+- patch_remove_unreal_force_quit
+frame:
+- frame.unreal_skip_obb_check
+- frame.hw_video_decode
+adapter:
+  haptic_fix: 1
+verified:
+  date: '2026-10-16'
+  known_good_sha256: f071a1deea3e3b6dce0c3a923127f540a48b88532106536c1838f496e9d3e6c9
+  app: 1.2.0
+  overport_cli: 1.2.5
+  frame_build: '20261015.6141207'
+  agent: 91
+  issue: 340
+source_hint: Lost Recipes

catalog/games/com.TeamPanoptes.SilhouetteVR.yaml

@@ -6,12 +6,18 @@ engine: Unity
 xr: OpenXR
 status: issues
 notes: Hand-tracking game; the Frame synthesizes hands from controllers, so it is janky.
+  frame.unity_text_input and device.text_input_window added from detection (not headset-verified).
 details: Hand-tracking-only game; Steam Frame has no optical hand tracking. Built with controller_fix=0 so hand
   data passes through if the runtime ever provides it.
 adapter:
   controller_fix: 0
+frame:
+- frame.unity_text_input
+device:
+- device.text_input_window
 verified:
   date: '2026-09-28'
   overport_cli: 1.2.3
   overport_runtime: 3.4.3-23204ea
   known_good_sha256: a19b80db0c300d422cbba35a4924ab59211b39bcb6485e200d310e3e1372ddb7
+updated: '2026-10-15'

catalog/games/com.UNIVRS.Freedom.yaml

@@ -1,22 +1,24 @@
 package: com.UNIVRS.Freedom
-title: Freedom
-status: issues
-notes: Volume can't be changed in the game.
+title: 'Attack on Titan VR: Unbreakable'
+status: works
+notes: Keep the extra files that come with the APK and OBB next to the OBB (they hold the audio). Cutscenes are
+  detached from the head but still viewable.
 tested_version: 1.0.2950
 engine: Unity
 xr: OpenXR
 frame:
 - frame.unity_text_input
+- frame.asset_files
 device:
 - device.text_input_window
 adapter:
   haptic_fix: 1
 verified:
-  date: '2026-10-10'
-  known_good_sha256: 24662272c4cbe5dc7c4f3c803bdb9dead9661ac3d59bf80cca2e260256acc4bc
-  app: 0.12.0
+  date: '2026-10-16'
+  known_good_sha256: 1b3ced1a24b3b708f66aba6aa879863b667c0e502ef153d8a8cfa03e529d21fd
+  app: 1.2.0
   overport_cli: 1.2.5
-  frame_build: '20261007.6125817'
-  agent: 59
-  issue: 132
-source_hint: AOT VR
+  frame_build: '20261015.6141207'
+  agent: 91
+  issue: 337
+source_hint: Aot

catalog/games/com.Ubisoft.ACNexusVR.yaml

@@ -7,10 +7,15 @@ xr: OpenXR
 status: works
 notes: FrameBridge turns its upside-down UI panels upright (flip emulation, in place since FramePort 1.2.0). Ubisoft
   login may not work.
+  frame.unity_text_input and device.text_input_window added from detection (not headset-verified).
 details: Ubisoft online login may not work. Data folder holds raw assets (start0..2, .climb, bundles), not .obb
   files; install to obb as-is.
 overport_extra:
 - patch_ac_nexus_no_appsw_90
+frame:
+- frame.unity_text_input
+device:
+- device.text_input_window
 verified:
   date: '2026-09-28'
   overport_cli: 1.2.3
@@ -18,5 +23,5 @@ verified:
   known_good_sha256: 89644a12bf8df956fa3d3a9a40540ba9e1fb62f63494714a05c9f05984383ac8
   no_appsw_90: '2026-10-02, OVRPort 1.2.5 (owner: 90 Hz felt better than 72 Hz; same known issues)'
   flip_in_place: '2026-10-14, owner in the headset: launch warnings and tutorial pop-ups upright (GitHub #138)'
-updated: '2026-10-14'
+updated: '2026-10-15'
 min_app: 1.2.0

catalog/games/com.VertigoGames.The7thGuestVR.yaml

@@ -0,0 +1,27 @@
+package: com.VertigoGames.The7thGuestVR
+title: The 7th Guest VR
+status: issues
+notes: Runs and is playable. Foveated rendering (fixed and eye-tracked) sits offset toward the bottom right, and
+  changing the foveated region size has no visible effect.
+tested_version: 1.1.3.12072
+engine: Unreal
+xr: OpenXR
+alt_overport:
+- patch_remove_unreal_force_quit
+frame:
+- frame.unreal_skip_obb_check
+- frame.hw_video_decode
+adapter:
+  haptic_fix: 1
+  scale: 2.0
+foveation: fixed
+foveation_radius: 0.1
+verified:
+  date: '2026-10-16'
+  known_good_sha256: 11a1208888adedf4aa48a672b2af5535f0e8f11e5bb1ce0a28bafe5d272bb672
+  app: 1.2.0
+  overport_cli: 1.2.5
+  frame_build: '20261007.6125817'
+  agent: 91
+  issue: 363
+source_hint: Guest

catalog/games/com.asg.clockworkdev.yaml

@@ -1,5 +1,5 @@
 package: com.asg.clockworkdev
-title: Clockwork
+title: The Last Clockwinder
 status: works
 tested_version: '1.29'
 engine: Unity

catalog/games/com.camouflaj.manta.yaml

@@ -2,6 +2,7 @@ package: com.camouflaj.manta
 title: 'Batman: Arkham Shadow'
 status: works
 notes: Large data set (~27 GiB) incl. all language packs.
+  frame.unity_text_input and device.text_input_window added from detection (not headset-verified).
 details: 'Uses Meta XR Audio (Wwise), handled by patch_meta_xr_audio. Cutscenes are 8K HEVC panoramas: frame.hw_video_decode
   decodes them on the Frame''s hardware, adapter.surface_native shows them in stereo (PRs #96, #128). Includes all
   language packs (~28 GB). sync_guard (to test, GitHub #102) - a reporter''s game quit to Steam''s waiting screen
@@ -13,15 +14,18 @@ overport_extra:
 - patch_disable_space_warp
 frame:
 - frame.hw_video_decode
+- frame.unity_text_input
 adapter:
   sync_guard: 1
   surface_native: 1
   fade_quad: 1
+device:
+- device.text_input_window
 verified:
   date: '2026-09-28'
   overport_cli: 1.2.3
   overport_runtime: 3.4.3-23204ea
   known_good_sha256: 796d1cab08f614d72c50d9702974c719c0908f5de91183cfe02d1fd5eb09551a
-updated: '2026-10-13'
+updated: '2026-10-15'
 min_app: 1.1.0
 source_hint: Batman- Arkham Shadow

catalog/games/com.com.spectralgames.Medieval.yaml

@@ -6,9 +6,15 @@ engine: Unity
 xr: OpenXR
 status: works
 notes: Co-op unavailable.
+  frame.unity_text_input and device.text_input_window added from detection (not headset-verified).
 details: 'Release notes: for DLC use an older version. Co-op likely unavailable.'
+frame:
+- frame.unity_text_input
+device:
+- device.text_input_window
 verified:
   date: '2026-09-28'
   overport_cli: 1.2.3
   overport_runtime: 3.4.3-23204ea
   known_good_sha256: 06428a6328a49b3ca769e070dd0d2bb55c2122c8fba5d07a69b1b206a532c212
+updated: '2026-10-15'

catalog/games/com.crytek.climb.yaml

@@ -0,0 +1,21 @@
+package: com.crytek.climb
+title: The Climb
+status: works
+tested_version: '666.0'
+engine: CryEngine
+xr: VrApi
+frame:
+- frame.vrapi_bridge
+device_files:
+  user.cfg: 'r_vr_foveated = 0
+
+    '
+verified:
+  date: '2026-10-16'
+  known_good_sha256: 3899967dd6d3ee0ce3409e94d543405c779e9c282ead29536abe93b3531ca285
+  app: 1.2.0
+  overport_cli: 1.2.5
+  frame_build: '20261015.6141207'
+  agent: 91
+  issue: 341
+source_hint: TheClimb

catalog/games/com.fasttravelgames.lollipop.yaml

@@ -0,0 +1,26 @@
+package: com.fasttravelgames.lollipop
+title: 'Vampire: The Masquerade - Justice'
+status: issues
+notes: Game runs fine and playable, on loading there's a random sphere in the middle of the sceen. Also control
+  input images are missing so you get text like press <img>wmr.Rstick...
+tested_version: 1.00.1653
+engine: Unreal
+xr: OpenXR
+alt_overport:
+- patch_remove_unreal_force_quit
+frame:
+- frame.bhaptics_permission
+- frame.hw_video_decode
+adapter:
+  haptic_fix: 1
+  scale: 2.0
+foveation: tracked
+verified:
+  date: '2026-10-17'
+  known_good_sha256: 5669f8e9c52e4fa00a3bbce79d323c7f521e098b08dacaf330db0083c7993dee
+  app: 1.2.0
+  overport_cli: 1.2.5
+  frame_build: '20261007.6125817'
+  agent: 91
+  issue: 377
+source_hint: vampire

catalog/games/com.fasttravelgames.mascot.yaml

@@ -0,0 +1,22 @@
+package: com.fasttravelgames.mascot
+title: 'Cities: VR'
+status: works
+notes: Loading screen Cities VR Logo doesn't load right.
+tested_version: 1.00.502
+engine: Unity
+xr: OpenXR
+frame:
+- frame.unity_text_input
+device:
+- device.text_input_window
+adapter:
+  haptic_fix: 1
+verified:
+  date: '2026-10-16'
+  known_good_sha256: 5537e4e9333a04eda8c1b2f96cdc9572c1bbed52a9d3af42269ba442ce9ba801
+  app: 1.2.0
+  overport_cli: 1.2.5
+  frame_build: '20261015.6141207'
+  agent: 91
+  issue: 345
+source_hint: CitiesSkylines

catalog/games/com.fgovr.quest.yaml

@@ -0,0 +1,16 @@
+package: com.fgovr.quest
+title: FGO VR
+status: issues
+notes: Audio stuttering and popping sounds
+tested_version: 0.2.0-fgo-resolution
+engine: Other
+xr: OpenXR
+adapter:
+  scale: 1.2
+verified:
+  date: '2026-10-17'
+  known_good_sha256: e26a0755297961e5131fe4bd404cbd956e18aef01bed71a79114805f6d805032
+  app: 1.2.1.dev433
+  overport_cli: 1.2.5
+  issue: 364
+source_hint: com.fgovr.quest

catalog/games/com.iillusions.bamgame.yaml

@@ -6,11 +6,17 @@ engine: Unity
 xr: OpenXR
 status: works
 notes: Passthrough emulated with the Frame cameras (greyscale).
+  frame.unity_text_input and device.text_input_window added from detection (not headset-verified).
 details: Mixed-reality-only title; relies on passthrough (emulated).
 overport_extra:
 - patch_force_passthrough
+frame:
+- frame.unity_text_input
+device:
+- device.text_input_window
 verified:
   date: '2026-09-28'
   overport_cli: 1.2.3
   overport_runtime: 3.4.3-23204ea
   known_good_sha256: 65ca3a8f46cc9acfd268949418f9adeecb0cf9f59d11591ba95fe2ba9ea966d8
+updated: '2026-10-15'

catalog/games/com.ilmxlab.tales.yaml

@@ -4,6 +4,8 @@ status: works
 notes: >-
   Headset tested for GitHub issue 61: full view, loading into gameplay, both eyes, controller input and sound
   work with the splash bypass and multiview depth-size fix. Keep the main OBB and all three content/sound-bank PAKs.
+  GitHub issue 369 (headset, Lepton 3.0.5): the GPU hang at a later loading screen is fixed by zink_shader_fix;
+  played ~28 min at 72 fps.
 details: Unreal Engine 4 (GLES) by ILMxLAB, like Vader Immortal, but a different engine build - it has none of Vader's
   Quest-only branches (no GetQuestShaderPrecompilePercent or RPOC key map; it precompiles shaders through Unreal's
   own pipeline cache), so frame.unreal_quest_precompile/_keymap don't apply. Its seasons and Wwise banks are Meta
@@ -17,6 +19,10 @@ details: Unreal Engine 4 (GLES) by ILMxLAB, like Vader Immortal, but a different
   frame.unreal_multiview_depth refreshes both cached dimensions from the current eye render size; multiview and
   multisampling remain enabled. The two engine fixes check exported symbols, function sizes and instruction bytes
   before changing one instruction each; unrecognized engine builds are left unchanged.
+  A fragment shader (module 16800_8dbab031..., as Zink compiles it) reads 12 int loop counters/accumulators before
+  setting them and hangs the GPU (kernel hangcheck) at a loading screen, the same bug as Vader Immortal's lightspeed
+  shaders; the Vulkan layer under Zink inserts stores of 0 (frame.zink_shader_fix, zink_shader_fix). Captured with
+  Lepton 3.0.5, so a Frame update that changes Zink's output stops it matching (the layer logs that).
 tested_version: 1.1.9+734762.cl.439699
 engine: Unreal
 xr: VrApi
@@ -27,10 +33,12 @@ frame:
 - frame.unreal_thumb_touch
 - frame.unreal_splash_bypass
 - frame.unreal_multiview_depth
+- frame.zink_shader_fix
 adapter:
   pose_time_fix: 1
+  zink_shader_fix: 16800:8dbab031be7975e23452e333fe63afe44d5c8f4fd2b096aa21ed300426747757:4008:0x0003003e,219,102,0x0003003e,229,102,0x0003003e,235,102,0x0003003e,241,102,0x0003003e,302,102,0x0003003e,312,102,0x0003003e,318,102,0x0003003e,324,102,0x0003003e,369,102,0x0003003e,379,102,0x0003003e,385,102,0x0003003e,391,102
 verified:
-  issue: 61
-updated: '2026-10-12'
+  issue: 369
+updated: '2026-10-17'
 min_app: 1.0.4
 source_hint: Star Wars- Tales from the Galaxys Edge

catalog/games/com.nexxr.nexplayer.yaml

@@ -2,10 +2,17 @@ package: com.nexxr.nexplayer
 title: NEX Player
 status: works
 notes: 'Confirmed in the headset by the owner (2026-10-01): 72 fps, local 2D/360/3D videos play (it browses /sdcard/Movies
-  itself). USB-drive browsing can''t work in Lepton.'
+  itself). USB-drive browsing can''t work in Lepton. Typing (frame.unity_text_input + device.text_input_window,
+  owner in the headset 2026-10-15): SteamVR''s keyboard button works and typed text reaches the fields; the keyboard
+  doesn''t open by itself when a field is selected.'
 tested_version: 1.3.1.0
+frame:
+- frame.unity_text_input
+device:
+- device.text_input_window
 engine: Unity
 xr: OpenXR
 verified:
   date: '2026-10-01'
 source_hint: NEX - NEXt-Gen Video Player
+updated: '2026-10-15'

catalog/games/com.orbusvr.OrbusVRCommunity.yaml

@@ -0,0 +1,26 @@
+package: com.orbusvr.OrbusVRCommunity
+title: OrbusVR
+status: works
+tested_version: '31.01'
+engine: Unity
+xr: VrApi
+frame:
+- frame.unity_oculus_check
+- frame.unity_text_input
+- frame.unity_runtime_msaa_off
+- frame.hw_video_decode
+- frame.unity_gl_shim
+device:
+- device.text_input_window
+adapter:
+  haptic_fix: 1
+  pose_time_fix: 1
+verified:
+  date: '2026-10-16'
+  known_good_sha256: fe569ffe52ca73f2384162ce80769f05f7cf177edbf26d8e429ca0e9b4aa27e8
+  app: 1.2.0
+  overport_cli: 1.2.5
+  frame_build: '20261015.6141207'
+  agent: 91
+  issue: 378
+source_hint: OrbusVR

catalog/games/com.s3d.ExplodingKittensVR.TestRelease.yaml

@@ -0,0 +1,22 @@
+package: com.s3d.ExplodingKittensVR.TestRelease
+title: Exploding Kittens VR
+status: issues
+notes: Requires online for most modes. Practice lobby does work though.
+tested_version: 1.4.25779
+engine: Unreal
+xr: OpenXR
+alt_overport:
+- patch_remove_unreal_force_quit
+frame:
+- frame.hw_video_decode
+adapter:
+  haptic_fix: 1
+verified:
+  date: '2026-10-16'
+  known_good_sha256: 4b0a2348a5553851dcec820835e02c93a1a64927a30533d554943a9b81b3baa0
+  app: 1.2.0
+  overport_cli: 1.2.5
+  frame_build: '20261015.6141207'
+  agent: 91
+  issue: 343
+source_hint: com.s3d.ExplodingKittensVR.TestRelease

catalog/games/com.schellgames.ieytd2.yaml

@@ -0,0 +1,27 @@
+package: com.schellgames.ieytd2
+title: I Expect You To Die 2
+status: works
+notes: loaded up and played 5 minutes looks fine.
+tested_version: 1.0.1.171177 (ReleaseCandidate_1.0.1_QuestStore)
+engine: Unity
+xr: VrApi
+frame:
+- frame.unity_no_msaa
+- frame.unity_oculus_check
+- frame.unity_text_input
+- frame.unity_runtime_msaa_off
+- frame.unity_gl_shim
+device:
+- device.text_input_window
+adapter:
+  haptic_fix: 1
+  scale: 2.0
+verified:
+  date: '2026-10-16'
+  known_good_sha256: fc626ec62e49e19210a188d90f94c370e956d0de729cbd04cbe8866430d77730
+  app: 1.2.0
+  overport_cli: 1.2.5
+  frame_build: '20261015.6141207'
+  agent: 91
+  issue: 358
+source_hint: Expect

catalog/games/com.sigtrapgames.undercover.yaml

@@ -6,8 +6,14 @@ engine: Unity
 xr: OpenXR
 status: works
 notes: Layers with failed swapchains are dropped by the adapter.
+  frame.unity_text_input and device.text_input_window added from detection (not headset-verified).
+frame:
+- frame.unity_text_input
+device:
+- device.text_input_window
 verified:
   date: '2026-09-28'
   overport_cli: 1.2.3
   overport_runtime: 3.4.3-23204ea
   known_good_sha256: c3f8cba1c22762231b6a6fbd881668db859d83224884ebeae0c1a3ba716f298c
+updated: '2026-10-15'

catalog/games/com.thunderful.legobricktales.yaml

@@ -6,9 +6,15 @@ engine: Unity
 xr: OpenXR
 status: works
 notes: Use VR mode.
+  frame.unity_text_input and device.text_input_window added from detection (not headset-verified).
 details: Has VR and MR modes; use VR mode (passthrough not forced).
+frame:
+- frame.unity_text_input
+device:
+- device.text_input_window
 verified:
   date: '2026-09-28'
   overport_cli: 1.2.3
   overport_runtime: 3.4.3-23204ea
   known_good_sha256: 5ba09a2bc0046c8cb587272ab81e8d32739334fef523b10ab26531a733d54f12
+updated: '2026-10-15'

catalog/games/jp.co.hit_point.vneko.yaml

@@ -0,0 +1,24 @@
+package: jp.co.hit_point.vneko
+title: Neko Atsume Purrfect
+status: works
+tested_version: 2.3.0
+engine: Unity
+xr: OpenXR
+frame:
+- frame.unity_text_input
+- frame.oculusos
+device:
+- device.text_input_window
+adapter:
+  controller_models: 1
+  haptic_fix: 1
+  scene_emul: 1
+verified:
+  date: '2026-10-16'
+  known_good_sha256: da0196efa495d6ea7b34be2cea5b279acf23489134bb1dd1acef7cf54aa57da6
+  app: 1.2.0
+  overport_cli: 1.2.5
+  frame_build: '20261015.6141207'
+  agent: 91
+  issue: 338
+source_hint: jp.co.hit_point.vneko

catalog/games/org.crisiszone.vr.yaml

@@ -0,0 +1,18 @@
+package: org.crisiszone.vr
+title: Crisis Zone VR
+status: works
+notes: Played the beginning of the first mission without issues.
+tested_version: 0.1.4
+engine: Other
+xr: OpenXR
+frame:
+- frame.sdl_clipboard
+verified:
+  date: '2026-10-15'
+  known_good_sha256: 747d1e6613ae443ef03e509b509e4ec89039eec1aecf3689643db4057e53266a
+  app: 1.2.1.dev433
+  overport_cli: 1.2.5
+  frame_build: '20261007.6125817'
+  agent: 91
+  issue: 331
+source_hint: CrisisZoneVR-v0.1.4-quest3

catalog/games/org.godotengine.endoparasitic_vr.yaml

@@ -0,0 +1,19 @@
+package: org.godotengine.endoparasitic_vr
+title: EndoparasiticVR
+status: works
+tested_version: '1.3'
+engine: Other
+xr: OpenXR
+frame:
+- frame.godot_clipboard
+adapter:
+  equirect_emul: 1
+verified:
+  date: '2026-10-17'
+  known_good_sha256: 89ed0e940c0285b1284a22d8eb5b35966dda79dd57a602c475be3cf1b758fa35
+  app: 1.2.0
+  overport_cli: 1.2.5
+  frame_build: '20261007.6125817'
+  agent: 91
+  issue: 375
+source_hint: Endoparasitic

catalog/games/org.smarttube.stable.yaml

@@ -0,0 +1,18 @@
+package: org.smarttube.stable
+title: SmartTube
+status: issues
+notes: Android's home screen shows for a few seconds while the app starts (normal for flat Android apps; longest on the
+  first start after an install). Froze once in the reporter's session.
+tested_version: '32.56'
+engine: Other
+xr: '?'
+as_is: true
+frame:
+- frame.hw_video_decode
+verified:
+  date: '2026-10-16'
+  known_good_sha256: cc53f1aedac52ea0d4e77803acd580e32e7e5179adc96b55db7267b63a16c864
+  app: 1.2.0
+  overport_cli: 1.2.5
+  issue: 350
+source_hint: SmartTube_stable_arm64-v8a

catalog/games/studio.NewFolderGames.ToyMaster.yaml

@@ -5,9 +5,14 @@ source_hint: Toy Master
 engine: Unity
 xr: OpenXR
 status: works
-notes: ''
+notes: frame.unity_text_input and device.text_input_window added from detection (not headset-verified).
+frame:
+- frame.unity_text_input
+device:
+- device.text_input_window
 verified:
   date: '2026-09-28'
   overport_cli: 1.2.3
   overport_runtime: 3.4.3-23204ea
   known_good_sha256: e951595c67b6e448f3fb4afd07e6b83e98e589094bb3b73374cfb28aa01e96ee
+updated: '2026-10-15'

catalog/games/us.lighthaus.nanocellx.yaml

@@ -7,6 +7,9 @@ xr: OpenXR
 status: works
 notes: Needs Oculus OS telemetry class stubs and the no-ForceQuit build (the normal build quits right after
   starting).
+  frame.unity_text_input and device.text_input_window added from detection (not headset-verified).
+device:
+- device.text_input_window
 verified:
   date: '2026-10-02'  # owner-confirmed with the no-ForceQuit build
   overport_cli: 1.2.3
@@ -14,6 +17,8 @@ verified:
   known_good_sha256: 31469d50b8ee292597291db7cc3bc3eca8e851f533cd92bba0d64214893580cc
 frame:
 - frame.oculusos
+- frame.unity_text_input
 alt_overport:
 - patch_remove_unreal_force_quit
 use_alt: true
+updated: '2026-10-15'

catalog/games/xyz.TheAviary.Vermillion.yaml

@@ -1,9 +1,9 @@
 package: xyz.TheAviary.Vermillion
 title: Vermillion
-status: issues
-notes: Runs. The canvas used to hide the hand and brush while painting (the Frame draws the game's canvas layer in
-  front of everything); the recipe makes the game draw canvases in the scene instead (fix found by Klownicle, GitHub
-  #200). Not yet confirmed in the headset with this patch.
+status: works
+notes: "The canvas used to hide the hand and brush while painting (the Frame draws the game's canvas layer in front
+  of everything); the recipe makes the game draw canvases in the scene instead (fix found by Klownicle, GitHub #200).
+  Confirmed in the headset by Klownicle."
 tested_version: 1.7.2
 engine: Unity
 xr: OpenXR
@@ -16,10 +16,10 @@ adapter:
   haptic_fix: 1
   scene_emul: 1
 verified:
-  date: '2026-10-11'
+  date: '2026-10-15'
   app: 1.0.1
   frame_build: '20261007.6125817'
   agent: 79
   issue: 200
-updated: '2026-10-12'
+updated: '2026-10-15'
 source_hint: Vermillion - VR Painting

catalog/games/xyz.muware.hunt.vr.yaml

@@ -5,9 +5,14 @@ source_hint: H.U.N.T
 engine: Unity
 xr: OpenXR
 status: works
-notes: ''
+notes: frame.unity_text_input and device.text_input_window added from detection (not headset-verified).
+frame:
+- frame.unity_text_input
+device:
+- device.text_input_window
 verified:
   date: '2026-09-28'
   overport_cli: 1.2.3
   overport_runtime: 3.4.3-23204ea
   known_good_sha256: c35373d0f7c870ade148e3259abcc74098b6bc89fe2c2f3a2e55168df642e391
+updated: '2026-10-15'

catalog/triage.yaml

@@ -11,6 +11,37 @@ signatures:
     severity: error
     diagnosis: A DLC manager reports a Meta asset-file status error after VR starts (e.g. PixelRipped 1995). The asset-file check failed; the log does not identify the native call or asset ID. Try the experimental asset-file bypass (empty list, installed status with no file path); this does not supply DLC and has not been verified in the game.
     suggest: [frame.asset_files_stub]
+  - id: meta-entitlement
+    # Quest games (the pcvr oculus-entitlement signature covers Rift games). Only explicit failure results: a bare
+    # ovr_PlatformInitialize error isn't matched. `error`, not fatal: offline games may log it and play on; an online
+    # game that then quits (e.g. Deadly Delivery, GitHub #322) fails the test through its exit.
+    pattern: '(?i)entitlement check failed|\bnot entitled to (use|play)|ovrPlatformInitialize_(NotEntitled|UnableToVerify|FileInvalid|SignatureInvalid)'
+    severity: error
+    diagnosis: The game's Meta licence check (entitlement) failed. It needs Meta's online login and licence check,
+      which the Frame doesn't have; games that depend on it (often online games) quit or stay offline. FramePort
+      doesn't get around such checks.
+    suggest: []
+  - id: meta-request-failed
+    # Unity's Oculus.Platform wrapper logs this when a Meta platform call gets no usable answer: OVRPort's platform
+    # library answers some calls without Meta's services (request id 0), so the game's callback never runs and it
+    # can wait forever (e.g. Thief Simulator, Eleven, Spectre; GitHub #346, #360, #368).
+    pattern: 'An unknown error occurred\. Request failed\.[\s\S]{0,400}?Oculus\.Platform\.Request'
+    severity: warning
+    diagnosis: A Meta platform request made by the game failed (it needs Meta's online services, which the Frame
+      doesn't have). If the game then stays on a loading screen or doesn't go on, it is waiting for that answer;
+      some games have a per-game fix that skips the call. A problem report with diagnostics shows which call it is.
+    suggest: []
+    report: true
+  - id: meta-system-activities
+    # The game ships its own (renamed) copy of Meta's platform loader instead of going through OVRPort's, which
+    # tries to open Meta's system activities (Horizon OS) and aborts when Android can't start them (Breachers, #357).
+    pattern: 'DisplayErrorAndExit: Failed to launch SystemActivities'
+    severity: fatal
+    diagnosis: The game's own Meta platform library tried to open Meta's system screens (Horizon OS), which the
+      Frame doesn't have, and quit on purpose. Games built this way are usually online games that depend on Meta's
+      services; FramePort can't provide those.
+    suggest: []
+    supersedes: [native-crash]
   - id: lua-lightuserdata-pointer
     pattern: 'bad light userdata pointer'
     severity: fatal
@@ -51,6 +82,13 @@ signatures:
     severity: fatal
     diagnosis: 32-bit-only APK (e.g. a Gear VR or Oculus Go game). The Steam Frame has no 32-bit ARM support; FramePort's 32-bit bridge translates the game (experimental).
     suggest: [frame.a32_bridge]
+  - id: a32-jit-overflow
+    pattern: 'a32: block at 0x[0-9a-f]+ overflowed the code buffer'
+    severity: fatal
+    diagnosis: The 32-bit bridge's translator stopped the game on a long run of instructions it hands to its
+      interpreter, for example OpenSSL's ARMv8 SHA-1 code in Pinball FX2 VR. Fixed in newer FramePort versions;
+      update FramePort and rebuild the game ("Update on Frame").
+    suggest: [frame.a32_bridge]
   - id: android-too-new
     pattern: '(NoClassDefFoundError|ClassNotFoundException|NoSuchMethodError)\b.*(Landroid/window/|android\.window\.|(storeStoreFence|loadLoadFence)\(\)V in class Ljava/lang/invoke/VarHandle)'
     severity: fatal
@@ -61,6 +99,13 @@ signatures:
     severity: fatal
     diagnosis: This app is a website, not a game, and it can't open on the Frame. It is a Trusted Web Activity that opens Meta's browser (com.oculus.browser), which the Frame doesn't have; open the website (TWALauncherActivity's "Using URL" line) in a browser instead.
     suggest: []
+  - id: gvr-not-supported
+    # GitHub #335 (Blade Runner: Revelations, Daydream, Unity 2017.4): Unity's "Google VR Error [Daydream]", the GVR
+    # library's Java side missing on the 32-bit bridge, or a bind to Daydream's VrCore service
+    pattern: 'Google VR Error \[(Daydream|Cardboard)\]|Google VR had a fatal issue while loading|class com/google/vr/sdk/base/CardboardViewNativeImpl not found|act=com\.google\.vr\.vrcore\.\S+ pkg=com\.google\.vr\.vrcore'
+    severity: fatal
+    diagnosis: This is a Google Daydream / Cardboard VR build (Google VR SDK), and its VR can't reach the Frame's headset. Daydream needs Google's VR services (VrCore) and Cardboard draws for a phone in a viewer; FramePort has no translation for either, so the game runs as a flat window at best, usually without working controls. An Oculus build of the same game (Meta Quest, Oculus Go or Gear VR) goes through FramePort's normal path.
+    suggest: []
   - id: unity-render-crash
     pattern: 'CRASH\s*:.*#\d+\s+pc [0-9a-f]+\s+\S*libgallium_dri\.so'
     severity: fatal
@@ -97,12 +142,17 @@ signatures:
   - id: swapchain-rect-invalid
     pattern: 'xrEndFrame failed -25\b'
     severity: fatal
-    diagnosis: The runtime rejects the game's frames, so it stops drawing (for example stuck at a "Waiting" box). An image rect reaches a few pixels past its swapchain on some Frames; FrameBridge from FramePort 0.11.0 clamps the rects, so rebuild and reinstall the game.
+    diagnosis: The runtime rejects the game's frames, so it stops drawing (for example stuck at a "Waiting" box). An image rect reaches a few pixels past its swapchain on some Frames (FrameBridge from FramePort 0.11.0 clamps the rects), or is empty (0x0, for example BattleTalent's first frames right after Unity switches its MSAA level; a newer FrameBridge shows the whole swapchain image instead), so rebuild and reinstall the game.
     suggest: [frame.adapter]
   - id: cylinder-menu-layers-rejected
     pattern: 'xrEndFrame failed -16\b'
-    severity: error
-    diagnosis: The game draws a curved (cylinder) screen to each eye separately (for example the Doom3Quest / PreyVR menu). The Frame's runtime has no cylinder layers, so FrameBridge shows each as flat quad strips; a per-eye pair makes too many quad layers for one frame and the runtime rejects the whole frame (XR_ERROR_LAYER_INVALID), leaving the menu black while the game runs. FrameBridge from this build shows the left eye's strips to both eyes to halve the count; rebuild and reinstall the game to try it.
+    severity: info
+    # PreyVR (GitHub #306): one rejected frame at the start of every session (its space isn't locatable yet); the black
+    # menu there had another cause (a 0 Hz refresh rate stopped the game clock), so this alone is no error
+    diagnosis: The runtime rejected a frame's layers once (XR_ERROR_LAYER_INVALID). At the start of a session that is
+      harmless. If it repeats every frame the picture stays black; FrameBridge shows a curved (cylinder) screen drawn
+      to each eye separately (for example the Doom3Quest / PreyVR menu) as one set of flat strips for both eyes to stay
+      within the runtime's layer limit, so rebuild and reinstall the game with the current FrameBridge.
     suggest: [frame.adapter]
   - id: missing-ovr-symbol
     pattern: '(UnsatisfiedLinkError|cannot locate symbol) .*"?(ovr_[A-Za-z0-9_]+|ovr[A-Z][A-Za-z0-9]*_ToString)'
@@ -163,7 +213,8 @@ signatures:
     suggest: [adapter.vk_shader_dump, adapter.zink_shader_dump]
     report: true
   - id: space-warp-used
-    pattern: 'xrCreateSwapchain \d+x\d+ format=(97|129) '
+    # space warp's motion vectors (97 = R16G16B16A16_SFLOAT); its depth (129) is also what eye depth layers use (#323)
+    pattern: 'xrCreateSwapchain \d+x\d+ format=97 '
     unless: 'per-game: hide_space_warp=1'
     severity: info
     diagnosis: The game uses Meta's space warp (it renders half of its frames plus motion vectors, and the runtime makes
@@ -171,6 +222,13 @@ signatures:
       Metro Awakening). Turning it off makes the game render every frame itself.
     question: Did textures flicker, jump or smear while you moved?
     suggest: [adapter.hide_space_warp]
+  - id: duplicate-action-renamed
+    pattern: 'action_dedup: action .* already exists in its set'
+    severity: info
+    diagnosis: The game creates two controller actions with the same name (for example an Unreal action and axis both
+      called Turn). The Frame's runtime then can't load the game's controller setup and drops the game back to the home
+      environment while it keeps running. FramePort renamed the second one, so this is handled.
+    suggest: []
   - id: unity-runtime-msaa
     pattern: 'recommended MSAA level is [248]\. Switching to the recommended level'
     severity: info
@@ -233,6 +291,16 @@ signatures:
     severity: error
     diagnosis: The screen stays black because the game submits a layer the VrApi bridge can't show. Whole frames with that VrApi layer type are dropped.
     suggest: []
+  - id: unreal-reserve-refused
+    # GitHub #349: Unreal's out-of-memory handler dereferences its not yet created log while libUnreal.so's static
+    # constructors run (System.loadLibrary), after the Binned3 allocator's up-front reservation failed
+    pattern: '(?s)fault addr 0x10\b(?:(?!Fatal signal).){0,8000}?#00 pc [0-9a-f]+\s+\S*lib(?:Unreal|UE4)\.so(?:(?!Fatal signal).){0,8000}?soinfo17call_constructors'
+    severity: fatal
+    diagnosis: The game crashed while Unreal was still loading, before its first frame. Its memory allocator (Binned3)
+      reserves tens of gigabytes of address space at once, which Quest allows and the Frame's kernel refuses in one
+      piece (for example Transformers Beyond Reality). Rebuild with the reservation marked as not committed.
+    suggest: [frame.unreal_noreserve]
+    supersedes: [native-crash]
   - id: graphics-requirements-missing
     pattern: '(XR_ERROR_GRAPHICS_REQUIREMENTS_CALL_MISSING|Failed to create XR session: -50\b|xrCreateSession[^\n]*-50\b)'
     severity: fatal
@@ -309,6 +377,13 @@ signatures:
     diagnosis: 'The Frame''s Vulkan driver crashed on a call from Unreal. Unreal 5 passes things Quest''s driver ignores: a depth resolve in a subpass without a depth attachment (handled by the Vulkan shim), and image barriers and views for a missing image when it expects fragment density maps (foveation) from the headset (for example Metro Awakening).'
     suggest: [frame.vk_sanitize, adapter.vk_spec_fixes, adapter.vk_hide_fdm]
     supersedes: [native-crash]
+  - id: quest-foveation-image-missing
+    pattern: 'foveationImage = 0x0, width = 0, height = 0'
+    unless: 'hide_fb_foveation: filtering dispatcher extensions'
+    severity: info
+    question: Did the Vulkan game stop on its first frames?
+    diagnosis: OVRPlugin enabled Quest Vulkan foveation but received no density image. For a first-frame failure, compare with Quest foveation suppressed. This message alone does not prove the crash cause; a null Unreal graphics pipeline can also follow an earlier fatal error.
+    suggest: [adapter.hide_fb_foveation]
   - id: unreal-fdm-missing
     pattern: 'vk shim: left out \d+ image barrier\(s\) without an image \(first: layout \d+ -> 1000218000'
     unless: 'vk shim: fragment density map extensions hidden'
@@ -337,6 +412,13 @@ signatures:
     diagnosis: The game crashed creating a very large image (over 4096 px, for example in video players). OVRPort's OpenXR dispatcher aborts on such swapchains.
     suggest: [frame.swapchain_limit]
     supersedes: [native-crash]
+  - id: cortopia-org-id-wait
+    # Meta's C# wrapper logs this when the native call returned request id 0 (no callback ever follows); Cortopia's
+    # start-up awaits it forever (GitHub #360)
+    pattern: 'An unknown error occurred\. Request failed\.[\s\S]{0,600}?Cortopia\.Scripts\.Platform\.Meta'
+    severity: error
+    diagnosis: The game waits forever on its loading screen for an answer from Meta's platform (an org-scoped user id, used as its analytics id) that OVRPort's platform library doesn't give. The patch makes the game skip that one request, as it does without Wi-Fi.
+    suggest: [frame.cortopia_org_id]
   - id: ovr-microphone-crash
     pattern: 'ovr_Microphone_GetOutputBufferMaxSize\+'
     severity: fatal
@@ -350,10 +432,22 @@ signatures:
     suggest: [frame.slz_vulkan_hooks]
     supersedes: [java-crash, native-crash]
   - id: vivox-api31
-    pattern: 'NoSuchMethodError: No virtual method \w*CommunicationDevice\w*\(.*Landroid/media/AudioManager'
+    pattern: 'NoSuchMethodError: No virtual method \w*CommunicationDevice\w*\(.*Landroid/media/AudioManager[^\n]*(?:\n[^\n]*\sat [^\n]*){0,12}?\n[^\n]*\sat com\.vivox\.'
     severity: fatal
     diagnosis: The game's Vivox voice-chat SDK calls Android 12 audio-routing methods (AudioManager communication devices) without checking the Android version; Lepton runs Android 11, so the app crashes (for example Green Hell VR). The patch makes Vivox's audio-route check return early (voice chat keeps the default route).
     suggest: [frame.vivox_audio_route]
+    supersedes: [java-crash, audio-api31]
+  - id: photon-voice-api31
+    pattern: 'NoSuchMethodError: No virtual method \w*CommunicationDevice\w*\(.*Landroid/media/AudioManager[^\n]*(?:\n[^\n]*\sat [^\n]*){0,12}?\n[^\n]*\sat com\.exitgames\.photon\.'
+    severity: fatal
+    diagnosis: The game's Photon Voice microphone plugin calls Android 12 audio-routing methods (AudioManager communication devices) without checking the Android version; Lepton runs Android 11, so the app crashes when voice chat starts (for example Table Troopers at the tutorial). The patch makes Photon's audio-device pick return early (the microphone keeps the default route).
+    suggest: [frame.photon_voice_audio_route]
+    supersedes: [java-crash, audio-api31]
+  - id: audio-api31
+    pattern: 'NoSuchMethodError: No virtual method \w*CommunicationDevice\w*\(.*Landroid/media/AudioManager'
+    severity: fatal
+    diagnosis: Code in the game (often a voice-chat SDK) calls Android 12 audio-routing methods (AudioManager communication devices) without checking the Android version; Lepton runs Android 11, so the app crashes. FramePort has fixes for Vivox and Photon Voice; this one comes from another library, so please report it with the log.
+    report: true
     supersedes: [java-crash]
   - id: lepton-data-link-failed
     pattern: "ln: cannot create symbolic link from '[^']*' to '/data/data/|Couldn't create directory for SharedPreferences file /data/user/0/"
@@ -361,6 +455,24 @@ signatures:
     diagnosis: The game has no internal storage (saves, settings) inside Lepton. Usually its folder's path has a space (a microSD card named for example "Steam Frame 512g"), which Lepton's own scripts can't handle; FramePort's launcher (agent 83 and newer) gives Lepton a path without spaces. Connect FramePort once so the launcher is updated, then start the game again.
     report: true
     supersedes: [java-crash, native-crash]
+  - id: gms-android12-call
+    pattern: 'No virtual method permitUnsafeIntentLaunch\(\)'
+    severity: fatal
+    diagnosis: Google Play services' code in the game called an Android 12 method (the game was built for Android 12 and newer, so its version checks were built in as "always true") and Lepton runs Android 11; the game crashes on its GoogleApiHandler thread at start (for example Titan Isles). The patch makes those checks answer "no" again; Play services themselves aren't on the Frame, so sign-in and other Google features stay off.
+    suggest: [frame.gms_platform_version]
+    supersedes: [java-crash]
+  - id: usb-midi-watcher
+    pattern: 'UsbManager\.getDeviceList\(\)'' on a null object reference|at jp\.kshoji\.driver\.midi\.device\.MidiDeviceConnectionWatcher\$MidiDeviceConnectionWatchThread\.checkConnectedDevices'
+    severity: fatal
+    diagnosis: The app's USB MIDI driver (kshoji's, used by Unity MIDI plugins, for example PianoVision) asked Android's USB service for MIDI devices; the Frame's Android has no USB service, so the app crashed. The patch stops that poll; USB MIDI devices can't reach the app on the Frame anyway.
+    suggest: [frame.usb_midi_watcher]
+    supersedes: [java-crash]
+  - id: unity-appui-vibrator
+    pattern: 'NoClassDefFoundError: Failed resolution of: Landroid/os/VibratorManager;'
+    severity: fatal
+    diagnosis: The game's start activity uses Android 12's VibratorManager (Unity's App UI package, for example PianoVision) and Lepton runs Android 11, so it quits before the game starts. The patch starts the activity without a vibrator; its UI haptic feedback then does nothing.
+    suggest: [frame.unity_appui_vibrator]
+    supersedes: [java-crash]
   - id: bhaptics-permission-prompt
     pattern: 'GrantPermissionsActivity: Permission grant result .*permission=android\.permission\.BLUETOOTH_CONNECT'
     severity: error
@@ -570,132 +682,6 @@ signatures:
       the video was decoded in software instead, which is slow for 4K/8K. Turn off hardware video decoding in Steam's
       settings, restart Steam, then start the game again.
     suggest: []
-  # ---- Quest games on this PC (AXRB, docs/PC_ANDROID.md): AXRB's host.err/session.json + guest log
-  - id: axrb-no-headset
-    kind: axrb
-    pattern: 'failed to find D3D11 adapter requested by OpenXR runtime|xrCreateInstance failed: XR_ERROR_RUNTIME_FAILURE'
-    severity: fatal
-    diagnosis: The PC's OpenXR runtime (SteamVR) has no headset to show the game on, so AXRB's bridge couldn't open its VR session. Connect the headset (Steam Link / cable) and let SteamVR show it before starting the game.
-    suggest: []
-  - id: axrb-host-not-ready
-    kind: axrb
-    pattern: 'Host pose server did not become ready|Host failed to start'
-    severity: fatal
-    diagnosis: AXRB's Windows bridge (axrb-host-bridge.exe) didn't start, so the game was never launched. Its reason is in host.err (diagnostics); a missing headset is the usual one.
-    suggest: []
-    report: true
-  - id: axrb-gfxstream-crash
-    kind: axrb
-    pattern: 'vulkan\.ranchu\.so \(gfxstream::vk::'
-    severity: fatal
-    diagnosis: The game crashed inside the Android emulator's Vulkan driver (gfxstream), reached through AXRB's runtime layer (e.g. Pinball FX VR at its first Vulkan allocations). That's AXRB's GPU path, not FramePort's build - report it to AXRB with the diagnostics.
-    suggest: []
-    report: true
-  - id: axrb-translation-crash
-    kind: axrb
-    pattern: 'libndk_translation\.so \(berberis::|DEBUG\s*:.*#00 pc \S+\s+/system/lib64/libndk_translation\.so'
-    severity: fatal
-    diagnosis: The game crashed in Android's ARM translation (libndk_translation), which runs Quest games' arm64 code on the PC's x86 CPU (known for some Unity games, AXRB issue #9). Nothing to patch in the game; AXRB plans another translator.
-    suggest: []
-  # AXRB's direct mode (axrb-direct.exe, no emulator): direct.log lines are "<s> <tid> E/<tag>: ..." from the runner
-  # and "E/<tag>(<tid>): ..." from the game's Android log; direct.out has AppProcess's AXRB_AOSP_* lines
-  - id: axrb-direct-incomplete
-    kind: axrb
-    pattern: 'Direct mode installation is incomplete|Direct mode is missing |AXRB Direct is incomplete|Preparing the AOSP application failed'
-    severity: fatal
-    diagnosis: AXRB's direct mode is missing part of itself or of its Android system root, so the game was never started. Reinstall AXRB-Emulatorless (or rebuild the local build FRAMEPORT_AXRB_DIRECT_DIR points at), then `frameport pc install-axrb --backend direct` sets the system root up again.
-    suggest: []
-  - id: axrb-direct-no-vulkan
-    kind: axrb
-    pattern: 'vulkan-1\.dll is not installed|E/vulkan: \S+ is not available on the host'
-    severity: fatal
-    diagnosis: AXRB's direct mode found no usable Vulkan driver on this PC (or the driver lacks a function the game calls). Install the graphics card's current driver.
-    suggest: []
-  - id: axrb-direct-no-gles
-    kind: axrb
-    pattern: 'eglInitialize\b.*(?:fail|0x3008)|Failed to initiali[sz]e EGL|Unable to initiali[sz]e (?:EGL|the OpenGL)|EGL_BAD_DISPLAY|Unable to retrieve the default EGL display'
-    # Unreal Vulkan builds probe EGL at start too (eglInitialize -> EGL_BAD_DISPLAY in direct mode), then create
-    # their Vulkan device: only a session without one is a GLES game (Deadpool VR, 2026-10-15)
-    # ... and one that died first on something AXRB's direct mode lacks (a dialog window, a framework call) never
-    # got that far: that is the blocker, not EGL (Of Lies and Rain, NOPE CHALLENGE, 2026-10-16)
-    unless: '(?m)I/vulkan: vkCreateDevice\(.*\) = 0$|UnsupportedOperationException: addToDisplayAsUser|^AXRB_SERVICE_UNIMPLEMENTED '
-    severity: fatal
-    diagnosis: The game draws with OpenGL ES, and AXRB's direct mode only has a Vulkan renderer. Install it for AXRB's emulator instead (the "AXRB mode on this PC" option, pc.axrb_backend backend=emulator, or `frameport install <game> --to pc --axrb-backend emulator`).
-    suggest: []
-  - id: axrb-direct-no-native-window
-    kind: axrb
-    pattern: '(?m)^AXRB_AOSP_HOST_SURFACES 0'
-    unless: 'APP_CMD_INIT_WINDOW|AXRB_AOSP_TAKEN_SURFACE|AXRB\.Space|session state='
-    severity: warning
-    diagnosis: The game's activity got no window in AXRB's direct mode. NativeActivity games (CryEngine, other own engines) take their surface with Window.takeSurface, which AXRB's direct mode doesn't serve yet (it only hands SurfaceViews one), so they wait for APP_CMD_INIT_WINDOW forever and never start VR (The Climb 2 stopped after "Loading plug-in CryHTTP"). That's AXRB's side; AXRB's emulator may run the game.
-    suggest: []
-    report: true
-  - id: axrb-direct-vulkan-extensions
-    kind: axrb
-    pattern: 'Renderer initialization[\s\S]{0,600}?CrySystem initialization failed'
-    unless: 'fp_vkext: listing'
-    severity: fatal
-    diagnosis: CryEngine found its Vulkan device without extensions every Quest has (VK_EXT_fragment_density_map, Android's external memory) and gave up before creating it; the PC's graphics driver doesn't have them. "Vulkan - list Android's external-memory extensions (this PC)" lists them for the game in builds for this PC, and AXRB leaves them out again when the device is created.
-    suggest: [frame.vk_android_extensions]
-  - id: axrb-direct-unhandled-instruction
-    kind: axrb
-    pattern: 'fatal signal 4 \(SIGILL\)|unhandled synchronous signal 4 '
-    severity: fatal
-    diagnosis: AXRB's direct mode met an arm64 instruction its translator can't run (Dynarmic, or Digitalis when chosen) and the game stopped. That's AXRB's side - report it to AXRB with the diagnostics (direct.log has the instruction's address); the other translator (pc.axrb_backend translator=digitalis / dynarmic) or AXRB's emulator may get further.
-    suggest: []
-    report: true
-  - id: axrb-direct-guest-crash
-    kind: axrb
-    pattern: 'E/cpu: thread \d+ \(.*\): fatal signal (?:5|6|7|11) '
-    severity: fatal
-    diagnosis: The game's own arm64 code crashed in AXRB's direct mode (a SIGSEGV/SIGBUS/SIGABRT, or the SIGTRAP Unity raises on a fatal error; direct.log has the backtrace by library). Often a missing Android service or a translation bug rather than the game; try the other translator (pc.axrb_backend translator=digitalis) or AXRB's emulator, and report it to AXRB with the diagnostics.
-    suggest: []
-    report: true
-  - id: axrb-direct-host-fault
-    kind: axrb
-    pattern: 'E/host-fault: |E/fatal: '
-    severity: fatal
-    diagnosis: axrb-direct.exe itself crashed (its translator or Linux/Binder layer, not the game). That's AXRB's side - report it to AXRB with the diagnostics.
-    suggest: []
-    report: true
-  - id: axrb-direct-dialog-window
-    kind: axrb
-    pattern: 'UnsupportedOperationException: addToDisplayAsUser'
-    severity: fatal
-    diagnosis: The game opened a second Android window (a Dialog, for example Unreal's message box or a Unity plugin's dialog) and AXRB's direct mode can only show the game's own activity, so the game stopped ("Adding window failed"). Seen with Medieval Dynasty, Under Cover and Of Lies and Rain. That's AXRB's side; AXRB's emulator shows dialogs, so `--axrb-backend emulator` may get further (Vulkan games there go through gfxstream).
-    suggest: []
-    report: true
-  - id: axrb-direct-unimplemented-service
-    kind: axrb
-    pattern: '(?m)^AXRB_SERVICE_UNIMPLEMENTED \S+'
-    severity: error
-    diagnosis: The game (or a library in it, often Google Play services) called an Android framework service function AXRB's direct mode doesn't implement yet (the line names it, e.g. IActivityManager.getMyMemoryState for NOPE CHALLENGE); the call throws, and an uncaught one ends the game. That's AXRB's side - report it to AXRB with the diagnostics; AXRB's emulator has the full framework.
-    suggest: []
-    report: true
-  - id: axrb-direct-java-crash
-    kind: axrb
-    pattern: 'E/app: the application crashed|FATAL EXCEPTION: |Runtime aborting|JNI DETECTED ERROR IN APPLICATION'
-    severity: fatal
-    diagnosis: The game's Java side (or Android's ART runtime under it) ended with an uncaught exception or an abort in AXRB's direct mode. direct.log / direct.err have the stack; a framework service AXRB's direct mode doesn't provide yet (Meta/Play services, account, DRM) is the usual cause.
-    suggest: []
-  - id: axrb-direct-missing-function
-    kind: axrb
-    pattern: 'guest called unknown host function|unimplemented JNI function|call to unregistered host function'
-    severity: error
-    diagnosis: The game called an Android/JNI function AXRB's direct mode doesn't implement yet; it may fail right after. Report it to AXRB with the diagnostics.
-    suggest: []
-  - id: axrb-direct-unsupported-syscall
-    kind: axrb
-    pattern: 'W/syscall: unimplemented syscall|W/binder: unsupported (?:command|ioctl|object type)|execve\(.*\) refused: one process image only'
-    severity: warning
-    diagnosis: The game asked for a Linux system call or Binder feature (or a second process) AXRB's direct mode doesn't provide. Often harmless; when the game then fails, it's the first thing to report to AXRB.
-    suggest: []
-  - id: axrb-direct-slow-stop
-    kind: axrb
-    pattern: 'the game did not close within 25 seconds'
-    severity: info
-    diagnosis: The game didn't finish its activity shutdown when the session ended, so AXRB stopped it; anything it hadn't saved yet may be lost.
-    suggest: []
 # Launch tests run without a worn headset. Some parts give up on tracking after a while and end the VR session; what
 # the game does after that (often a crash in the GPU driver while its renderer tears down) never happens in the
 # headset. In a launch test that already had paced frames before such a line, a later exit or crash still passes,
@@ -704,13 +690,6 @@ headless_end:
   - label: the VrApi bridge's 30 s tracking deadline
     pattern: 'EnterVrMode: no tracked head pose before deadline'
 milestones:  # progress markers, in order; the furthest one reached is reported
-  - {id: axrb-host, kind: axrb, pattern: 'AXRB TCP: listening', label: AXRB bridge started}
-  - {id: axrb-direct-art, kind: axrb, pattern: '(?m)^AXRB_AOSP_BOOTSTRAP', label: Android runtime (ART) started (direct mode)}
-  - {id: axrb-direct-activity, kind: axrb, pattern: '(?m)^AXRB_AOSP_ACTIVITY_CREATED ', label: Game activity created (direct mode)}
-  - {id: axrb-runtime, kind: axrb, pattern: 'AXRB\.PoseClient|Got runtime: package: com\.axrb\.openxrruntime', label: AXRB's OpenXR runtime loaded}
-  - {id: axrb-instance, kind: axrb, pattern: 'xrCreateInstance\(\) succeeded|LoaderInstance::CreateInstance succeeded', label: OpenXR instance created}
-  - {id: axrb-direct-vulkan, kind: axrb, pattern: '(?m)I/vulkan: vkCreateDevice\(.*\) = 0$', label: Vulkan device created on the PC's GPU (direct mode)}
-  - {id: axrb-frames, kind: axrb, pattern: 'AXRB\.Perf end-frame', label: Submitting frames}
   - {id: pcvr-launch, kind: pcvr, pattern: 'FramePort: launching|Launched injector with', label: Launcher started}
   - {id: pcvr-oculus-hmd, kind: pcvr, pattern: 'FramePort oculushmd: OculusHMDConnected event ready', label: Oculus headset event provided}
   - {id: pcvr-inject, kind: pcvr, pattern: 'Succesfully injected|Successfully injected', label: Revive injected into the game}

docs/DEVICE_NOTES.md

@@ -0,0 +1,641 @@
+# Device notes
+
+Detailed device findings per game and issue, moved verbatim from CLAUDE.md (which keeps a one-line pointer
+with the key fact and the patch/setting names for each). Read the matching section before debugging a game;
+general runtime facts are in docs/FRAME_RUNTIME.md and symptom → fix rows in docs/PLAYBOOK.md.
+
+## a32 bridge: games, lessons, debugging aids, profiling
+
+Learned: Unity 2019 contexts
+have no EGLConfig (EGL_KHR_no_config_context: the VrApi bridge takes the window's or an RGBA8 ES3 config); Unity's
+floor origin = vrapi_SetTrackingSpace(1) (the VrApi bridge now honours LOCAL_FLOOR/STAGE); mapped GL buffers are
+per buffer object (a per-target guest copy leaked ~10 MB/s and garbled vertices); the guest runtime's own scudo
+names its maps `[anon:scudo:*]` below 4 GiB (watch them for guest leaks). The Go controller = the right Frame
+controller (stick = touchpad touch, sideways > 0.6 or press = click). Gunjack (CCP, UE 4.10 NativeActivity, Gear VR,
+2026-10-10): needed the native_app_glue imports (ALooper/AInputQueue/AConfiguration/AAsset*, imports.txt), an arm64
+libvrapi.so for Java's System.loadLibrary("vrapi") and MOUNTED under OVP_HEADLESS_TEST; it then loads its map and
+quit on purpose: AndroidMain compares AndroidThunkCpp_GetSignature() with an obfuscated copy. **Works since
+2026-10-11 (owner-verified in the headset):** GameActivity.AndroidThunkJava_GetSignature() = Base64.DEFAULT(SHA-1(
+signing certificate DER)) (jadx); `a32_bridge.original_signature` computes it from the original APK's
+META-INF/*.RSA|DSA|EC, `convert()` stores it as `assets/fp_a32_signature.txt` for libUE4.so games, the bridge loads
+it at activity creation (native_activity.c) and jni.c answers Call*Method on the method ID of
+`AndroidThunkJava_GetSignature()Ljava/lang/String;` with it. After loading, Unreal leaves VR mode and enters it again on
+the same GL context; a second OpenXR session there aborted in vrclient (CSharedSemaphoreLinux::WaitFromGPU from the GL
+binding's PreBeginFrame, also with OVP_HEADLESS_TEST) → the VrApi bridge keeps a running GLES session across
+LeaveVrMode and reuses it for an EnterVrMode with the same context (upstream-patches/runtime.cpp.patch).
+Debugging aids added: A32_BREAK=<guest addr>[,..] (stack of the first hits; guest libs load at fixed addresses, e.g.
+libUE4 0xf25d5000), A32_STRACE in bridge mode = path/exit calls to logcat, activity lifecycle + LeaveVrMode caller
+logs. Lepton's logcat mirror often dies for these games: read `podman exec <container> logcat` instead. Gunjack input
+(2026-10-11): it imports no vrapi input functions and reads the Gear VR touchpad/back as AInputEvents from its
+AInputQueue (native_app_glue), so dispatchKeyEvent never reached it (no control at all) → input.c queues synthetic
+events there (ALooper_poll* return the queue's ident while one waits; AInputQueue_getEvent/finishEvent and the
+AInputEvent/AKeyEvent/AMotionEvent getters are hand-written "!" imports that know them; touch positions scaled to the
+window size). Same mapping as AFFECTED: trigger = hold touchpad, A = tap, right stick = swipe, B = back; for NativeActivity games the stick's up/down = swipe forward/back (touchpad X: Gunjack's OnFlick = reload at ~0°, special weapon at ~180°). Not yet
+headset-verified. Quest builds on the bridge (2026-10-13, Sports Scramble = a 32-bit Santa Cruz build,
+UE 4.21 + OVRPlugin on VrApi 1.21): manifest requires `android.hardware.vr.headtracking` version 1
+(`detect.requires_6dof`, headset "quest", ANALYSIS_VERSION 16) → convert writes `assets/fp_a32_headset.txt`
+= "quest" → vrapi.c `quest_touch` (read in vrapi_Initialize via the activity's AssetManager; A32_TOUCH=1/0
+overrides) passes the 64-bit bridge's Touch controllers through (enumerate/caps/state/tracking/haptics, struct
+tails per VrApi minor) and starts no synthetic input. It also needed AAsset_getBuffer (guest copy, freed in
+AAsset_close), AKeyEvent_getFlags and the other AConfiguration getters. Headset (owner, 2026-10-13): plays,
+both controllers work. Recenter (holding the Frame's menu button) turned VrApi games ~90-120 degrees aside: the bridge's app space is LOCAL + the start yaw and the runtime moves LOCAL to the head → the bridge now takes the origin from the head again on XR_TYPE_EVENT_DATA_REFERENCE_SPACE_CHANGE_PENDING (LOCAL) and on vrapi_RecenterPose (owner-verified with Gunjack, 2026-10-13). Next: the other 32-bit catalog games (Journey of the Gods, Shadow Point: still "unsupported" until
+tested), translator speed. Profiled on the Frame
+(2026-10-12, `A32_PERFMAP` + perf): FPCR switches are negligible (8 of 86k samples); the cost was the run loop
+(a mutex + hash-chain walk on every dispatch, a contended counter, inline-lookup slots never refilled: Gunjack
+~45 % of its CPU) and `jit_invalidate` scanning every block on each Mono `cacheflush` (72 % of Spunky Dungeon's
+main thread). Now lock-free lookups, ltab refill, per-thread flags, per-page block lists: Gunjack's dispatcher
+23.6 % -> 1.6 %, CPU in the same phase about -55 %, still 72 fps.
+
+## Upload speed
+
+**Upload speed (measured 2026-09-29):** via the home router (PC Wi-Fi → router → Frame wlan0) only 15-18 MB/s, the
+same for paramiko, OpenSSH and 4 parallel streams, so the network path is the limit, not the SSH code. Direct to the
+Frame's hotspot (`wlanap` 10.35.78.1; the owner's PC has Valve's USB Wi-Fi dongle on it) 83 MB/s OpenSSH / 97 MB/s
+paramiko; reading dumps from D: via WSL drvfs is then the cap (~82 MB/s). `Frame.fast_link()` (installer
+`transfer_link`, uploads ≥64 MiB) uses usb0 > wlanap when reachable **and** the host key matches the paired Frame.
+
+## Revive under Proton arm64 (Lone Echo)
+
+**Revive under Proton arm64 (Lone Echo, 2026-09-29):** Revive's Detours hooks (LoadLibraryW/ExW, OpenEventW, the
+signature check) don't take effect: Wine's kernelbase is ARM64EC. The LibOVR shim in the game then does a plain
+`LoadLibrary("LibOVRRT64_1.dll")` search (exe dir, cwd, system32, windows, PATH — no registry, `OculusBase` or
+`LIBOVR_DLL_DIR` used by this build) → `Failed to initialize Oculus API (-3001)` (= Lies Beneath's "Unable to load
+LibOVRRT DLL"). A symlink `pfx/drive_c/windows/system32/LibOVRRT64_1.dll -> <base>/revive/LibReviveXR64.dll` (Wine
+maps a symlink to the already-loaded module) gets past it to **-3021 = ovrError_LibSignCheck**: the shim only accepts
+an Oculus-signed runtime. Next step (not done): make the runtime check pass without Detours, e.g. an injected helper
+that patches the game's import table (IAT) for LoadLibrary*/WinVerifyTrust, or a prefix-level override. This is
+runtime interop (what Revive does), not the Platform SDK licence check (which FramePort never touches).
+Uninstall (Quest, saves kept) used to leave `deployment.json` → still "installed"; fixed (agent v16).
+
+
+## OVRPort 1.2.5
+
+**OVRPort 1.2.5 (2026-10-01, the fork's first release; CLI-only):** same commands (`patches [--json]`, `patch`, `help`,
+`install`), but `patch` rejects unknown/duplicate args, unknown patch ids and an empty `--patches=`
+(`tools/overport.patch` refuses empty lists). After patching it adds `libovrplatformcompat.so` itself when the platform
+loader lacks `ovrMessageType_ToString` (our `frame.ovrplatformcompat` then skips: same library). New patches (all off;
+`patches/overport.py`): `patch_ac_nexus_no_appsw_72/_90` (AC Nexus build 207706 only, exclusive),
+`patch_disable_meta_xr_audio_telemetry` (x86_64 emulators: hidden), `patch_vrapi_openxr` = OVRPort's VrApi adapter =
+the **unpatched** upstream of our `frame.vrapi_bridge` (`native/vrapi` unchanged since our 5e7df52), only usable with an
+experimental CLI built with `-PwithVrApi=true` (stable jars list it but fail). The owner prefers OVRPort's fixes over
+ours where they work as well (less to maintain): compare in the headset before switching a default.
+`frameport install <pkg> --apk <file>` installs a specific (test) build signed with the game's key.
+Headset results (2026-10-02, `PATCHED/_test-ovrport-1.2.5/TESTING.md`): OVRPort's own VrApi translator fails on the
+Frame (Climb 2: requests VkFormat 37 → crash; POTW: no GLES path, missing `vrapi_GetTextureSwapChainHandle`) → keep
+`frame.vrapi_bridge`; those two changes are upstream candidates. 1.2.5 builds (its platform compat, new permissions)
+work. AC Nexus: `patch_ac_nexus_no_appsw_90` is the catalog default (owner preferred 90 Hz); `STRICT` patches are only
+taken from a catalog recipe where `applies()` holds (the AC Nexus ones need build MAIN.450412.207706.final, else the
+whole overport run fails).
+
+
+## Steam Frame controller models
+
+**Steam Frame controller models (2026-09-30, not yet seen in a game):** adapter setting `controller_models`
+(`native/adapter/render_model.c`) emulates XR_FB_render_model and serves `files/framebridge/controller_{left,right}.glb`;
+agent v20 (`install_controller_models`, command `controller_models`) converts the Frame's SteamVR render models
+(folder name matching "frame" + left/right, OBJ+PNG, `openxr_grip` component → grip space) at finalize/set_settings.
+Valve's models are never committed or copied off the Frame. Only games that use Meta's runtime controller models
+benefit (manifest `RENDER_MODEL` permission/feature → suggested); **none of the 34 catalog games do** (they ship their
+own meshes: that would need per-game asset replacement). Model discovery and conversion
+checked on the device 2026-09-30: `/opt/steamvr/drivers/frame_controller/resources/rendermodels/frame_controller_{left,right}`
+(component OBJs in model space = the whole `<name>.obj`, one `_color.png` 2048² near-black, `openxr_grip` rotates about
+X only; hidden-by-default components like `status` are skipped) → ~2 MB glb each, ~1 s. Not yet seen in a game (none
+of the installed builds has the new adapter, and none requests runtime models), so whether Meta's SDK attaches runtime models at the grip pose is unverified.
+
+## Crash backtraces, Fossilize, swapchain limit, cylinder and equirect layers
+
+**Crash backtraces (2026-09-30):** Lepton writes tombstones only to `lepton-logcats/steamlaunch-<appid>/logcat-crash.log` (after "Dumping logcat"), not launch.log; agent v23 launch tests wait for it and return `crash_log`, triage gets it via `triage(..., crash=)` (not pid-filtered: tombstones come from crash_dump's pid). The guest is `userdebug` (`ro.debuggable=1`), so Lepton's Fossilize layer loads into every app whatever the APK's debuggable flag; it has no off switch. Fossilize crashed Deadpool VR on uninitialized attachment-reference pNexts (several, in FVulkanRenderPass and the render-target layout) → `frame.vk_sanitize` = `native/vkshim` (engine's `dlopen("libvulkan.so")` string → `libfp_vk.so`, wraps vkCreateRenderPass2/KHR, drops unreadable/wrong-sType pNexts; verified: game runs). overport's dispatcher aborts on swapchains > 4096 px (`cmp wN,#4096` in xrCreateSwapchain) → `frame.swapchain_limit` (verified with 4XVR, 7680×3840 accepted by the runtime). Both are default-on (parity classifies their rewrites as
+"expected"; library migration `quest_binary_fixes_v2`). The adapter shows cylinder layers (4XVR's movie screen) as ~15° quad strips (`cylinder_strips`, setting
+`cylinder_strips`); the runtime composites them at full resolution. Equirect (360°) layers are dropped: drawing
+them ourselves (GLES renderer in xrEndFrame: stutter, never showed 4XVR's VR video; Vulkan renderer: hung the
+Frame's GPU in AC Nexus; reading the newest *released* image broke 4XVR's theatre) was removed again on the owner's
+request — don't retry without a new approach. Converted layers must count as "swapped" or the original layer list
+is submitted (runtime returns -2 for every frame). A focus debounce (hiding the Frame's brief
+FOCUSED→VISIBLE→SYNCHRONIZED dips, which make 4XVR recenter) was also removed: AC Nexus stayed black with it (it
+hid 521 ms focus changes at start). The new approach (below) is per-game, off the app's render thread, GLES-only.
+
+
+## 360° layers / 4XVR
+
+**360° layers / 4XVR (2026-09-30):** the Frame's Android SteamVR runtime (`/opt/steamvr/bin/androidarm64/vrclient.so`,
+mounted in Lepton as `/data/steamvr/runtime`) only composites quad + projection layers (cube/cylinder/equirect(2)
+are enum names only) — nothing to unlock. Per-game adapter settings (off by default, hooks installed only when on):
+`equirect_emul` (GLES only: a worker thread with a shared EGL context converts each 360° image to a cube map when it
+changes and draws one adapter projection layer from it for every frame with exactly that frame's views (the app's own
+projection views, else xrLocateViews at displayTime); xrEndFrame waits ≤6 ms for the worker's CPU submit, never the
+GPU. Learned in the headset: quads can't be a background (the Frame draws quad layers above all projection layers
+whatever the order: hid 4XVR's balcony/controllers), and the Frame doesn't reproject a projection layer from its own
+pose (images drawn only after head turns, or ahead from xrWaitFrame and sometimes late, wobbled);
+`equirect_flip/face/res/fps/stereo`), `stable_local`, `focus_hold` (only after 3 s FOCUSED, dips <600 ms),
+`aim_pitch/aim_yaw/aim_forward`, `refresh_rate`, `layer_debug` (diagnostics); focus_hold is default-on since 2026-10-05. 4XVR re-creates LOCAL spaces every 2–4 s
+(menu recentring suspect); its theatres are baked 7680×3840 equirect2 images (`assets/100.png` …). Test 360° videos
+(NASA, public domain) are in the Frame's ~/Videos; copies in `~/Downloads/frameport-360`. 4XVR's "Internal Storage"
+lists its own `/sdcard/4XPlayer`, not Movies: agent v25 `link_media` hard-links sent files into an app's own top-level
+folder (`app_media_dirs`), `frameport frame send --app <pkg>`, GUI game page "Add videos" (players) / "Add videos &
+files…". A 4XVR webm stereo swapchain was refused with XR_ERROR_LIMIT_REACHED (-10) → right eye grey; our projection
+swapchain was halved (1536/eye) in case memory is the limit (unverified). Frame data snapshot
+(SteamVR runtimes, Lepton scripts, logs; never commit Valve binaries): `~/frameport-research/frame-data-2026-09-30/`.
+Not yet verified in the headset.
+
+
+## Companion apps / intents (Stremio + 4XVR)
+
+**Companion apps / intents (2026-10-03, tested with Stremio + 4XVR):** a second APK can be installed into a running
+Lepton container (`podman exec -i lepton-steamlaunch-<appid> pm install -g -S <size> < apk`) and runs there, VR
+included (4XVR in Stremio's flatscreen container: FrameBridge 72 fps, settings via LEPTON_ENV_FRAMEBRIDGE_CONFIG). But
+Lepton's services.jar (`ActivityStarter.execute`) intercepts **every** `android.intent.action.VIEW` with data (any
+scheme, explicit component or not, no property to disable): it writes `steam://openurl/<uri>` to `/lepton/steam.pipe`
+(= the host Steam client's `~/.steam/steam.pipe`) and starts nothing. So "open in external player" hand-offs (Stremio
+→ 4XVR) can't work inside Lepton; don't retry without Valve changing it. Lepton installs exactly one `*.apk` per app
+folder (two break `get_apk_path`).
+
+## Text input (Stremio VR)
+
+**Text input (2026-10-03, verified in the headset with Stremio VR):** Lepton's Android has no IME (`ime list` empty)
+and runs VR apps headless (`lepton.headless=true`): no Android window has input focus (`dumpsys input` FocusedWindows
+empty), so neither `input text`, a USB keyboard nor Steam's keyboard reach the app. `lepton-show-flatscreen` on a VR
+app keeps VR working (FrameBridge 72 fps) and gives the window focus; Steam's on-screen keyboard then opens for text
+fields. Unity's TMP_InputField on non-Quest Android waits for the system keyboard (`TouchScreenKeyboardShouldBeUsed`)
+and deselects a frame later unless `isKeyboardUsingEvents` (Android: `InPlaceEditing() && m_HideSoftKeyboard`);
+uGUI InputField's LateUpdate keeps the field when `InPlaceEditing()`. Patch `frame.unity_text_input` rewrites them
+(`mov w0,#0|#1; ret`) at Cpp2IL's **Offset** (= file offset; RVA differs by 0x4000 in Stremio's lib), Cpp2IL
+2022.1 pre-release (Unity 6 / metadata v31; Il2CppDumper can't), cached per libil2cpp sha. `/dev/uinput` has an ACL
+for steamos (Steam Input) → agent v33 `_keyboard` uinput keyboard ("Type on Frame") reaches everything with focus.
+Installing a second APK into a container with `pm install` re-runs Lepton's post-install hook on the **main** app
+(`lepton.active_app_id`; moves its files to /data/steam_app) and corrupts it on the next start (fix: touch the APK →
+re-bake); `cmd_real package install` skips the hook.
+
+## User reports 2026-10-04 (issues #4-#10)
+
+**User reports (2026-10-04, issues #4-#10):** Steam shortcuts go to the signed-in account (`loginusers.vdf`
+MostRecent) else every account (agent v35 `library_users`; it used to refuse with >1 account → Play gave Steam's "Game
+configuration unavailable"); `launch` uses the shortcut's own appid and errors `NOT_IN_LIBRARY`, the app then adds it
+and plays. Unity IL2CPP fixes share one Cpp2IL run (`unity_text_input.Il2cppReturnPatch`, `ALL_TARGETS`, cache keyed by
+global-metadata.dat): `frame.unity_runtime_msaa_off` (OVRManager raises MSAA to 4x at runtime: "Switching to the
+recommended level" → Lucky's Tale restarted the headset; `OVRDisplay.get_recommendedMSAALevel` → 0) and
+`frame.unity_multipass` (Oculus XR Plugin multiview → MultiPass via `OculusSettings.GetStereoRenderingMode`; I Am Cat's
+right eye grey). Both checked against Toy Master's Cpp2IL output, not yet in a headset. VR4 quits itself (System.exit
+after the intro movie) → catalog `use_alt`. **Catalog changes reach existing games** without hardcoded migrations:
+recipes store `catalog_rev` (= `CatalogEntry.rev()`), `library._follow_catalog` re-derives non-user recipes whose entry
+changed; a maintained entry beats the user's shared copy when its `updated`/verified date is later (`catalog._newer`).
+
+## Round 2 of reports, headset rounds 2-3 (2026-10-04)
+
+**Round 2 of reports (2026-10-04):** VR4's campaign hang = one fragment shader reading an uninitialized loop counter
+(reporter's capture): vkshim `vk_shader_fix` setting (`<size>:<sha256>:<offset>:<words>`, from the recipe's `adapter:`;
+matched by size + SHA-256, words inserted into a copy) — on the device the module is fixed at load ("fixed shader
+module (6488 -> 6512 bytes)"); campaign itself not yet seen in a headset by us. Text settings (kind "str") stay out of
+the Game settings dialog (saving it dropped them). I Am Cat: `GetStereoRenderingMode` is inlined (no call sites) →
+`Il2cppReturnPatch.field_loads` rewrites the field read in `OculusLoader.Initialize` (Cpp2IL gives the field offset,
+`field:<name>`); verified with Toy Master: eye swapchains array=1 ×2 instead of array=2. Builds record `recipe_fp`
+(`patches/base.recipe_fingerprint`, `Patch.revision`): a changed recipe or revised patch shows "Update on Frame".
+Remembered Frames are found again after an address change (`Frame.relocate`: scan, same SSH host key, before
+login). Packaged apps show artwork by file path (`thumbs.use_file_paths`, #16). Diagnostics: this boot's kernel log.
+Device tests of requested games (2026-10-04, headless): I Am Cat, Myst 3.3.0, BattleGlide, Blade & Sorcery: Nomad
+start (RUNNING, frames). Roblox: SIGSEGV in je_free from libroblox.so ~3 s in (likely its anti-tamper vs the re-signed
+APK). BONELAB (Unity 2021.3 Vulkan, OVRPlugin 1.94): SIGSEGV with pc == fault addr in vkCreateInstance, called from
+libSLZQuestNative.so's Vulkan hooks into an unmapped (unloaded) library right after OVRPlugin's pre-init
+xrDestroyInstance; pinning openxr/vrclient libraries (RTLD_NODELETE) did NOT help — find the unloaded library with the
+linker's dlopen/dlclose logging next. Accounting+ (Unity 2017.4 built-in Oculus, libOVRPlugin + libvrapi): Unity
+never starts VR on the Frame (no OVRPlugin/OpenXR lines; runs as a 2D app), which is why its "controller setup"
+screen can't be passed — Unity 2017's Oculus device check, not the controller profiles. Cpp2IL can't read Unity 2017.
+The Frame's Android runtime (vrclient.so) knows oculus/touch_controller but not Meta's Touch Plus/Pro profiles
+(OVRPlugin suggests those too, routinely) → adapter `profile_remap`.
+Headset round 2 (2026-10-04): the Frame drops focus often (ms to 7 s; only some are presence/standby) → games pause
+or recentre (B&S Player.OnVRPresence → Teleport, BattleGlide/Unreal pauses); focus_hold now 1 s focused / 1 s max dip
+(longer must still pause). Myst crash = vrclient xrSyncActions race after FOCUSED → `sync_guard` (confirmed); its
+object glitches: app space warp suspected (FB_space_warp is advertised and used) → recipe `patch_disable_space_warp`.
+I Am Cat multipass: poses/times consistent, but every frame is submitted after the next xrWaitFrame (one period late;
+Zink + doubled draws) and the game clamps its physics step to 10 ms → judder while still; testing scale 0.8. Roblox's
+newest crash is on Fossilize's recording thread → vk_sanitize extended to own-engine libs (engine "Other").
+Accounting+: unity_oculus_check + native/ovrpshim (libfp_ovrp.so waits via ovrp_WaitToBeginFrame before Unity
+2017's ovrp_Update2) → VR in the headset at ~72 fps (2026-10-04), but stuck at "press any button" although input
+reaches its OVRInput cleanly (probe: both Touch connected 0x63, individual buttons, input focus 1) → works with issues.
+"outside of frame bounds" warnings stay (~2/frame) and are harmless.
+Steam library (GitHub #4/#21/#27, agent v38): shortcuts go to every Steam account (signed-in first; MostRecent isn't
+always the account on the Frame); stop_steam also waits for Steam's helpers; after the restart the agent re-reads
+shortcuts.vdf and writes once more if Steam put its old copy back (`shortcuts_lost`); lost again (agent v89): Steam
+ignores FramePort's entries on that Frame, so `add_devkit_entry` adds the devkit entry instead (`added` gets `via:
+devkit`) and only reports an error if that fails too. 0.6.3's Play
+auto-repair (`_add_then_play`) crashed (its job got a Job, not a reporter). Uploads resume on a transient OSError.
+Lepton's Android 11 has no clipboard service (134 services; checked with `podman exec … service check clipboard`):
+SDL/LÖVE apps crashed at start → `frame.sdl_clipboard` (`apk/dex.py`: in-place dex edit, nops one invoke, fixes
+the header checksum/signature; verified with LÖVE for Android 11.5, GitHub #24 Dramatic Shape). Godot 4.2-4.4 (Kotlin `as ClipboardManager`,
+GitHub #134 EndoparasiticVR) → `frame.godot_clipboard` (nops the `Intrinsics.checkNotNull` before that check-cast; Godot's
+clipboard methods return at once; analysis `godot_clipboard`, ANALYSIS_VERSION 10; checked on real godot-lib/templates
+4.2.2-4.4.1, not on the device; 4.1 and 4.5+ don't throw). 2D apps (vr_kind none)
+keep every suggested patch that isn't about VR (`needs_vr = False`), not a fixed list. FramePort on the Frame:
+`frame/local.py` (127.0.0.1, own key authorized; "This Frame (experimental)"; app data in
+~/.local/share/frameport-app because ~/.local/share/frameport is the agent's) and Steam library changes wait while
+Desktop Mode is open. Verified on the device 2026-10-04 (install + launch test from the Frame). Library updates on the
+Frame run one at a time (agent v40 flock): two quick uninstalls used to bring a removed shortcut back (Roblox).
+Headset round 3 (owner's verdicts, 2026-10-04): Blade & Sorcery works — its freezes were the headset's wear sensor
+flickering off while worn (vrserver.txt "HMD off/on" 0.5-2 s) → per-game `focus_hold_ms=2500` (only this game reacts;
+not a default). BattleGlide works (focus_hold). Myst works with issues (object glitches; space warp ruled out, its
+recipe keeps it on). I Am Cat works with issues (judder; scale 0.8 no help). Roblox unsupported (je_free in
+libroblox, also with the Vulkan shim). Installs skip the Steam restart when the shortcut is unchanged and wait while a
+game runs (agent v37). New default fixes in FramePort's code reach games already in a library: after every app update
+`library._follow_catalog` re-derives each non-user recipe once (setting `recipes.app_version`; tests switch it off via
+`library.REFRESH_ON_UPDATE`). Analysis fields added later: **bump `analysis/detect.ANALYSIS_VERSION`** (stored as `analysis.extra.analysis_version`); older entries whose APK is still there are analysed again at the GUI's start (background thread, not a job: ~8 s per 900 MB APK) and before a build (`pipeline.refresh_analyses`, GitHub #104); only `analysis`/`suggested` change, user recipes stay; an unreadable APK gets `analysis_failed` = the version (not retried until the next bump). Troubleshooting techniques: docs/PLAYBOOK.md "Debugging techniques". Unity `boot.config` "vulkan" substring mislabels GLES games as Vulkan
+(I Am Cat ran GLES); OVRPlugin's "Unavailable OpenXR extension: XR_FB_scene" is routine (no longer triaged).
+
+## Round 4 (2026-10-04): surface swapchains, save-folder permissions
+
+**Round 4 (2026-10-04):** XR_KHR_android_surface_swapchain is listed by the Frame's runtime but returns
+FUNCTION_UNSUPPORTED → adapter `surface_emul` (default on, `native/adapter/surface_swapchain.c`): an ordinary runtime
+swapchain is returned, the game gets a Surface from a SurfaceTexture on a worker thread (own EGL context, JavaVM from
+XrInstanceCreateInfoAndroidKHR), frames are read back (glReadPixels) and uploaded in xrEndFrame (Vulkan: own command
+buffer + fence per panel, never waits; GLES: glTexSubImage2D). I Am Monkey's intro works (owner-confirmed). SUPERHOT
+(Quest) quit at start: its cloud save folder was mode 1700 and Lepton's app writes through the folder's group →
+launch.sh `fix_perms` adds u+rwx,g+rwx (agent v41). Lucky's Tale: Unity's Loading.PreloadManager thread grows the
+native heap ~1 GB/s until the OOM killer (Frame freezes); no fix. `perf` works as steamos (paranoid 2; ptrace_scope 1
+blocks gdb/eu-stack/debuggerd) — see PLAYBOOK "Debugging techniques". QuestCraft downloads its JRE at first run into
+`files/runtimes/JRE` (Pojlib Installer); on the Frame it was missing (unpacked by hand, unverified). WiiCompiled: its launcher shows
+(lepton-show-flatscreen) but imports .wcgame files through Android's document picker (OPEN_DOCUMENT), which Lepton
+lacks (ActivityNotFoundException) → imported by hand: libmain.so + game.json → internal files/game/<profile>,
+DATA/ → external files/WiiCompiledOpenXRVR/DATA, MOD/ → .../RetroRewind6 (decompiled with jadx). Lepton has no
+picker at all: a FramePort fix would be an injected picker activity. Generated cover/banner art used to suppress the
+Steam placeholder set (no Steam art at all) → fixed in artwork/steam.py.
+
+## Steam library failures and the devkit fallback (GitHub #21/#30/#41/#42)
+
+**Steam library failures (GitHub #21/#30):** on some Frames Steam never loads FramePort's shortcuts.vdf entries (same SteamOS build and arm64 beta client as the dev Frame; IDs correct; file written before Steam starts): Play → console_log `GameAction [AppID <id>] … RequestingLicense → UpdatingAppInfo → LaunchApp failed with AppError_9` (= "Game configuration unavailable", Steam treats the id as a store app). Cause unknown; agent v42/43 diagnostics: `launch` returns `steam` (started / error + code / silent from console_log), `collect_diag` adds `steam_library` (real Steam dir, beta, Steam start vs vdf write time, entries per account, devkit games) + `steam-console.txt` (incl. Steam's `logs/shortcuts.previous.txt` if present; steamclient.so has "LoadShortcuts: rejecting attempt to load shortcuts: invalid account ID"). **Fallback (agent v43):** when Play gets AppError_9 the agent registers the game through Steam's devkit interface (what Valve's Devkit Management Tool does, MIT: `devkit-1 steam://devkit-1/<~/.steam/steam.token>/create-shortcut?response=<file>&gameid=<id>&directory=~/devkit-game` written to ~/.steam/steam.pipe; answer file / `.error`; `~/devkit-game/<id>/launch.sh` = link to the game's launch.sh, `<id>-argv.json` ["launch.sh"] (relative to the folder), `<id>-settings.json` {steam_play 0, compat_tool ""}). Steam adds it live (no restart), picks its own appid (read back from shortcuts.vdf by DevkitGameID), shows it as a normal non-Steam game named "Devkit Game: <id>" (OpenVR 0, but VR works: owner-verified 2026-10-04), art copied to grid/<appid>*. Ids: letter first, then letters/digits/_ only (spaces, '-', leading digit → "missing/invalid arguments"). Later Plays use the devkit entry; uninstall (`devkit_unregister`, `delete-shortcut` live) and purge remove it. Verified on the dev Frame: register/launch/unregister; the AppError_9 trigger itself only in unit tests. GitHub #42 (two Steam accounts, neither MostRecent): Steam rewrote the active account's shortcuts.vdf without FramePort's entries right after starting, and added the devkit entry live without saving it, so `devkit_appid` (vdf only) failed ("Steam added the devkit entry but didn't save it"); agent v55 `devkit_appid_from_log` reads Steam's `sanitize shortcut app id "~/devkit-game/<id>/launch.sh": replacing 0 with N` console line. GitHub #41 (one account): same Steam behaviour, and every install restarts Steam, which forgets the never-saved devkit entry. Agent v56: the log fallback reads only the current session's console_log.txt; Play re-registers a devkit entry that gets AppError_9; art updates also write the devkit entry's grid art (`copy_grid_art`). Open: why some Frames' Steam never loads or saves shortcuts.vdf (single account too).
+
+## Exit game (GitHub #36)
+
+**Exit game (GitHub #36, 2026-10-04):** `Apps.TerminateApp` (what Exit game calls; reachable for tests through Steam's CEF devtools on 127.0.0.1:8080, SharedJSContext, `Runtime.evaluate` — a stdlib websocket client is enough) closed both a normal shortcut and a devkit entry on the dev Frame within 1-3 s. SIGTERM to Steam's `reaper` alone left launch.sh + Lepton (setsid) + the container running (an earlier headset launch ran on for 87 min); SIGTERM to launch.sh cleans up in ~4 s. Agent v44: launch.sh's 2 s loop ends the game when its parent (the reaper) is gone; `upgrade_launchers` (from ensure_host_fixes) adds that to existing launchers in place. Which in-headset exit path fails is still unknown. Screenshots on the Frame: all under SteamVR's appid 250820 (`760/remote/250820/screenshots`, screenshots.vdf has creation time, no game).
+
+## SteamVR dashboard at game start
+
+**SteamVR dashboard at game start (2026-10-04):** the dashboard (Resume game / controller / VR options) was open whenever a FramePort game started (also over Lepton's 2D launcher). Steam's UI exposes `SteamClient.OpenVR.VROverlay.{IsDashboardVisible,HideDashboard,ShowDashboard}` (CEF devtools, `steam_js` in the agent). Agent v44: launch.sh starts `_dashboard_worker` (waits for FrameBridge's first `pacing:` line in launch.log, then hides a visible dashboard for 25 s, at most 3 times; log `<base>/dashboard.log`; opt out with env FRAMEPORT_KEEP_DASHBOARD=1). Verified on the dev Frame (dashboard shown → 4XVR launched via Steam → hidden ~5 s after the first frames); not yet seen in the headset. **Headset (ITR2, 2026-10-05): too late** — Steam shows its frame menu (`valve.steam.gamepadui.frame.menu`, vrwebhelper_systemui.txt `[PooledPopups] Showing`) ~0.3 s after the game's first submitted frame (FrameBridge `new layer:`), but the first `pacing:` summary comes ~8 s later; the owner had pressed Resume (`[HideDashboard] return_to_game`) before the worker looked. Agent v52: watches from the first `new layer:` line (incremental log reads, 0.5 s polls, 30 s window). Agent v59: watches 120 s and hides up to 10 times (the menu came back after 30 s in the owner's sessions). Agent v53: stops for good once the player opens the dashboard with the controller (`toggle_dashboard_action` in vrwebhelper_systemui.txt since the worker started): v52 closed it 60 ms after each press, and the game, paused for it, stayed paused.
+
+## Space warp / ITR2
+
+**Space warp / ITR2 (2026-10-04):** Into The Radius 2 (UE5, `libUnreal.so` + OVRPlugin, Vulkan) uses Application SpaceWarp (extra swapchains `376x376 format=97` motion vectors + `format=129` depth); #35 reports flickering textures. OVRPort's `patch_disable_space_warp` has no effect on UE5, and hiding XR_FB_space_warp in FrameBridge's enumerate doesn't reach the game either: **OVRPort's dispatcher offers/enables XR_FB_space_warp itself**. FrameBridge `hide_space_warp` (per game, off) hides it and strips `XrCompositionLayerSpaceWarpInfoFB` (1000171000) from the projection views (log `hide_space_warp: removed space warp info`); the game still renders its MV swapchains. Test build installed on the dev Frame; flicker not yet checked in a headset. Heuristic: UE5 + OVRPlugin shows it as an option (off). `equirect_emul` is suggested for Unreal games whose graphics API isn't detected ("GLES or unknown"); on Vulkan it switches itself off (Myst/Riven/ITR2): harmless, but Unreal Vulkan detection is a known gap.
+
+## PR #34: Meta XR Audio metadata (Batman)
+
+**PR #34 (merged 2026-10-04, Lucas-Mathieu):** `native/adapter/audio_metadata.h` patches Meta XR Audio Wwise (only build ID e1619e7f…, Batman: Arkham Shadow 1.4.1) so queued audio metadata isn't freed while the current audio frame references it (smoke-bomb crash). Verified headless: installs ("metadata reclamation follows …"), 72 fps; we added a once-per-second scan limit. Outside PRs: review source, rebuild `artifacts/` ourselves, merge locally (contributor's commit kept), push main.
+
+## Heuristics eval (2026-10-04)
+
+**Heuristics eval (2026-10-04):** `scripts/eval_heuristics.py "<VR CyberDeck Portable>"` → 19/44 recipes exact, 322/352 fields (most diffs: `frame.unity_text_input` suggested where older catalog recipes lack it; the rest are runtime-only findings: use_alt, vk_shader_fix, focus_hold, sync_guard, multipass). `PATCHED/` copies aren't scored (already converted).
+
+## Proton default (stable vs Experimental)
+
+**Proton default (agent v51, owner's choice 2026-10-05):** the newest **stable** ARM64 Proton is the default for PC VR games (`pick_proton`: asked-for name/alias, else newest installed stable, else any stable). Agent v49-50 defaulted to Experimental; the owner's headset A/B with Rick and Morty (Experimental 69 % reprojected frames, stable felt much smoother) reverted it. The game page's Customize shows `pcvr.proton_tool` as a dropdown (Stable (default) / Experimental = alias `proton-experimental`); `ensure_proton` installs a chosen one (it asks once more for the runtime Steam only names after Proton is installed; Experimental installed unattended on the device in 53 s). A PC VR launch test that fails on stable suggests Experimental (`pipeline.PROTON_TOOL`, `proton_alternative_worth_trying`, button "Try Proton Experimental and reinstall"). Remaining Rick and Morty stutter on head turns = the game rendering below the refresh rate (reprojection), not Proton.
+
+## USB cable link
+
+**USB cable link (verified 2026-10-05, cabled to the dev PC):** `usb0` is a USB **NCM** gadget (configfs g1: `ncm.usb0` + `ffs.adb`, Valve 28de:2460) set up by `usb-ncm-gadget@usb0.service`, which only runs with `ConditionPathExists=|/etc/systemd/system/adbd.service.d/steamos-devkit-enabled` = **Developer Mode only**. `usb-ncm-dnsmasq@usb0` serves DHCP with fixed `dhcp-host` entries: Frame 10.86.200.233, PC **10.86.200.234** (`frame/usb.py` FRAME_USB_IP/PC_USB_IP). Windows 11 binds its built-in "UsbNcm Host Device" (no driver); WSL mirrored sees eth 10.86.200.234. USB is high-speed (USB 2.0): upload 36.9 MB/s vs 11.3 MB/s home Wi-Fi. Frame→PC over the cable worked without a firewall change. `scripts/usb_autotest.py` (Windows via powershell.exe from WSL), `frameport frame usb-check`. Wizard "Set up with a USB cable" (`PairingServer(host=PC_USB_IP)`; the real bootstrap ran end to end over USB). Discovery dedupes by SSH host key and prefers USB > Frame hotspot > network (`discovery.dedupe`); a lost address is re-found by key (`Frame.relocate`, tested with a dead saved address).
+
+## Start activity / QuestCraft / ITR2 pop-in
+
+**Start activity / QuestCraft / ITR2 pop-in (2026-10-05):** WiiCompiled's VR part (`QuestActivity`, SDL, process `:game`) stays behind Lepton's flat window when the launcher is shown (`device.text_input_window`). `frame.start_activity` (opt-in; analysis `extra.vr_activity` = the original APK's activity with Meta's VR category when it isn't the launcher) gives that activity's filter LAUNCHER and every other LAUNCHER becomes INFO, per element (`axml.set_start_activity`); Lepton's own `apk-info-extractor --print-activity-name` (on the Frame under Lepton/liblepton/apk_extractor) then answers QuestActivity. **OVRPort gives every MAIN activity LAUNCHER + VR categories**, so the VR activity must come from the original APK's analysis, not the converted manifest. Lepton has no activity override (`APP_ACTIVITY` is reset when app_metadata.sh is sourced). QuestCraft reaches Minecraft 1.21.5 (Fabric, Vivecraft, Sodium; LTW "Large Thin Wrapper" GL 3.0 on the Frame's Zink) and stops at `OpenGL error 1282` in `WindowFramebuffer` createTexture (Minecraft's crash report in `files/instances/1.21.5/crash-reports/`, Pojlib's `files/latestlog.txt`); the vrclient SIGSEGV / "pthread_mutex_lock called on a destroyed mutex" afterwards is only the shutdown (Unity's render thread still in vrclient while the instance is destroyed). ITR2 "models popping in and out" in game: Unreal reads user config from **internal** storage (`lepton-data/internal/<pkg>/files/UnrealGame/<Project>/<Project>/Saved/Config/Android/Engine.ini`, not external); `r.AllowOcclusionQueries=0` there broke its menus (removed again). Vulkan shim `vk_query_slots` (two slots per occlusion query) never saw ITR2 create an occlusion query pool, and the run with it crashed (Unreal RenderThread SIGSEGV, caught by sentry-native: no tombstone; the backtrace is in `cache/sentry/*/.sentry-native/*.run/*.envelope` with module offsets) - left off. Next suspect: Unreal 5 mobile HZB occlusion reading depth stored with Valve's FDM injection layer; test = launcher `VK_INSTANCE_LAYERS=''` (Lepton then loads neither VALVE_rpo nor VALVE_fdm_injection, Fossilize still). QuestCraft: LTW overrides glGetError and returns 0 with `LIBGL_NOERROR` set; Lepton passes `LEPTON_ENV_<NAME>` to the app as `<NAME>`, so catalog `lepton_env: {LEPTON_ENV_LIBGL_NOERROR: '1'}` gets Minecraft past the GL error 1282; then black picture (see the catalog entry). FrameBridge logs `new layer` once per layer type per process and projection views only for the first frames, so a second session in the same process (Vivecraft after Unity) needs `layer_debug=1`.
+
+## Vulkan validation / ITR2 solved
+
+**Vulkan validation / ITR2 solved (2026-10-05):** Khronos' validation layer can't come from Lepton (its layer dir is in the read-only guest image; the Linux copies on the Frame are glibc) and a global `debug.vulkan.layers` property (via the LEPTON_GFXRECON_FP_PROPS trick) kills the container at boot. Working recipe: bundle `libVkLayer_khronos_validation.so` (Khronos android-binaries release, arm64-v8a, stored uncompressed) into a test APK re-signed with the game's key (`apk.sign.sign`), install with `frameport install <pkg> --apk`, and set the Vulkan shim's `vk_validation=1` (it adds the layer at vkCreateInstance; findings under the logcat tag VALIDATION in launch.log, each message ID capped at 10). ITR2's flicker + windows behind models = Unreal's Qualcomm shader-resolve subpasses with a depth resolve of a single-sampled depth attachment (VUID-04908/-03179); `vk_spec_fixes=1` drops that resolve (its TRANSFER_DST half never applies to ITR2: the main depth is transient). Valve's VALVE_rpo layer removed ITR2's fog (catalog `lepton_env: VK_INSTANCE_LAYERS: VK_LAYER_VALVE_fdm_injection`). `r.ViewDistanceScale=2` in the internal Saved/Config/Android/Engine.ini only exists on the owner's Frame (the catalog can't write internal storage yet). Launch tests: Lepton prints a transient "is not a running context" on the first start after an APK change (agent v54 `not_started` waits 30 s for "Boot complete!").
+
+## GitHub #38/#39: PowerWash Simulator, The Room VR
+
+**GitHub #38/#39 (2026-10-05):** PowerWash Simulator stuck at "Waiting.." on a reporter's Frame = Unity sized the right-eye image rect past its swapchain (rect 268+1656 on a 1920-wide swapchain; the runtime's recommended size differs per Frame) and SteamVR rejected every frame (`xrEndFrame failed -25`, XR_ERROR_SWAPCHAIN_RECT_INVALID), after which the game stopped calling xrEndFrame. FrameBridge `rect_clamp` (default on; sizes noted in xrCreateSwapchain; clamped layers count as swapped) keeps projection/quad rects inside their swapchain; triage `swapchain-rect-invalid`. Not reproducible on the dev Frame with `scale` (Unity's eye sizing isn't just the recommended width); no regression there (72 fps). The adapter's revision was NOT bumped (that would mark every installed game outdated): affected users rebuild. The Room VR (#38) = Unity's render thread SIGSEGV in libgallium_dri.so ~30 ms after the game recreates its eye swapchain with samples=4 (FrameBridge retries samples=1); the game's own code turns MSAA on (not OVRManager); candidate fix: hide GL_EXT_multisampled_render_to_texture (GL shim) - needs the APK to test. The launch test passed both (render thread dead / no frames): triage gap.
+
+## Headset round 2026-10-05 (evening)
+
+**Headset round 2026-10-05 (evening):** I Am Cat's judder = repeated xrLocateViews of one display time returning
+slightly different poses → FrameBridge `pose_consistency` (owner-verified, works). Lucky's Tale freeze on touching a
+save slot = OVRPort's OpenXR dispatcher converting XR_FB_haptic_amplitude_envelope with ns read as s (GitHub #9) →
+xrshim `haptic_fix` (owner-verified); its remaining short pauses were the wear sensor ("HMD off/on" 0.5-1 s in
+`logs/eyetracking.txt`, not vrserver.txt) → **`focus_hold` is on by default with 5 s** (owner's choice; C defaults
+too). The Room VR works (`unity_no_overlay_copy`). BattleSisters (Unity 2019.4 built-in VR, no libOculusXRPlugin.so)
+flooded "outside of frame bounds" ~2400/s and hung the GPU (kernel hangcheck, zink DEVICE LOST) → the ovrpshim frame
+wait now also applies to Unity 2019 without the Oculus XR Plugin (`UnityOculusCheck.legacy_loop`). Vader Immortal
+(UE4, stuck on the loading image after the intro, GitHub #49): VRP repacks carry a Frida gadget (`libfrda.so`,
+config `hijack_responses`), but OVRPort's `patch_clean_up_frida` removes its loadLibrary call, so it never runs on
+the Frame; `frame.ovr_trace` (opt-in, `native/ovrtrace`: 1138 exported ovr_* stubs → real loader functions, logcat
+tag `fp_ovrtrace`: calls, PopMessage answers, unanswered requests every 10 s) is the next diagnostic.
+
+## Unity built-in VR input (Accounting+, BattleSisters)
+
+**Unity built-in VR input (2026-10-05):** probe builds (`FRAMEPORT_INPUT_PROBE=1 frameport build …`; it logs
+trigger/grip crossings too) showed OVRPlugin returns the full Touch state for every controller mask (also Go masks);
+presses reach the games' OVRInput. Accounting+ (Il2CppDumper v6.7.46 reads its Unity 2017 metadata v24, run on Windows)
+passes stance selection (NewtonVR grip/trigger) but its motion warning waits for `Input.GetMouseButtonDown(0/1)`,
+which Lepton never delivers (no focused Android window) → ovrpshim registers its own
+`UnityEngine.Input::GetMouseButtonDown(System.Int32)` icall (il2cpp_add_internal_call, after Unity's: resolve first)
+that adds a click in the frame a Touch trigger or A/B/X/Y is newly pressed (`unity_oculus_check` revision 3).
+BattleSisters (Unity 2019 InputSystem/XR InputDevices via `VrHandInput`): libunity's Oculus module (OVRPlugin
+function table: a global pointer at 0x16b57c0 in this build, slots filled by name, e.g. +0x160 GetControllerState,
++0x168 State2, +0xe8 GetNodePresent) only reports controllers when `strncmp(deviceModel, "Oculus", 6) == 0` (next to
+the Go check `deviceModel == "Oculus Pacific"`); Lepton's model is "Valve Lepton" → Go/unknown → only Go masks polled,
+buttons dead. `unity_oculus_check` revision 4 (`oculus_model_checks`, Unity 2019 only) turns the 17 compares' length
+into 0 (`orr w2, wzr, #6` → `mov w2, #0` after the adrp/add of the "Oculus" literal; the string stays: it is also
+Unity's VR device name). Device result: libunity now polls `ovrp_GetControllerState(0x3)` (Touch); owner-confirmed
+2026-10-06: buttons work. Its first controller vibration then hit OVRPort's haptic-envelope bug (11 GB, OOM kill) →
+`haptic_fix` is now suggested for every game with libOVRPlugin.so (settings detect), BattleSisters works. Ruled out before: ProductName, GetNodePresent, the device-model string itself, exports.
+Accounting+ works (owner, 2026-10-06).
+
+## Vader Immortal (headless investigation)
+
+**Vader Immortal (UE4, GitHub #49, 2026-10-06, headless):** stuck after the intro on an in-game image (the splash
+quad ends ~6 s in; then the game's own projection frames, 72 fps, balanced xrBeginFrame/xrEndFrame). Not the Platform
+SDK (`frame.ovr_trace`: only user + entitlement, both answered) and not the repack's Frida gadget (OVRPort's
+`patch_clean_up_frida` removes its loadLibrary). It **leaks ~430 GPU mappings (/dev/dri/renderD128) and ~20 MB a
+second** (6.5 GB + swap after 5 min, then 26 fps): page-fault stacks (perf -e page-faults, offsets resolved with the
+process maps + vrclient.so's own symbols; its text segment is at file offset + 0x4000) end in SteamVR's runtime:
+`xrBeginFrame → CSxrCompositorOpenVR::BeginFrame → SubmitExplicitTimingData → CVRCompositorSharedTextures::
+BeginGPUTimingCommandBuffer` and `xrEndFrame → CVRCompositorClient::SubmitWithArrayIndexAndTime`. Ruled out: the
+layer color scale/bias + image layout structs (FrameBridge `strip_color_bias` 1/2, diagnostic), Valve's Vulkan
+layers (VK_INSTANCE_LAYERS=""), array swapchains in general (Lucky's Tale/I Am Cat flat). Kernel tracepoints aren't
+allowed for steamos. FrameBridge: `layer_debug` logs xrDestroySwapchain and per-5 s xrBeginFrame/xrEndFrame counts;
+`frame_balance` (ends an open frame before the next begin) exists but Vader never leaves one open. Next (built,
+not yet run: the Frame slept): `layer_debug` also counts xrAcquire/Wait/ReleaseSwapchainImage per 5 s (hooked only
+with layer_debug, after the other conditional hooks) to see whether Vader skips a wait or release: it doesn't (361/361/361 per 5 s).
+FrameBridge `snapshot=N` (`snapshot_gl.c`, GLES): every N s the left-eye image the game submits is read back on its
+own context and saved as `files/fb_snap_0-7.ppm` (quarter size) — headless launches show a black headset view, this
+shows what the game draws. Vader: Lucasfilm logo (an OBB mp4: video works), then its loading card (portrait + segmented
+bar) that never advances; the async loader thread sleeps and OBB reads stop (~168 MB of a 2.7 GB pak).
+
+## SteamVR overlay apps
+
+**SteamVR overlay apps (agent v75, 2026-10-10):** host OpenVR overlays (VRApplication_Overlay) are composited over Lepton (Quest) games on the Frame (probe checker seen over 4XVR in the headset view, `native/vroverlay_probe`); Windows ones register through Proton's vrclient too (Temporal Reality's Windows build created its overlays; fpsVR never reaches OpenVR under Proton). Detection `analysis/vroverlay.py` (bundled `.vrmanifest` with `is_dashboard_overlay`, else OpenVR + IVROverlay + self-registration markers, engine Other; Rift fingerprint `RIFT_ANALYSIS`), patch `pcvr.vr_overlay` (param autostart), Linux entry fields `vr_overlay`/`vr_overlay_autostart` (game page switch); agent `register_vr_overlay`/`unregister_vr_overlay`/`launch_vr_overlay` (IVRApplications via ctypes, live; manifest `<anchor>/frameport-overlay.vrmanifest`, the app's own key, binary = launch.sh). **SteamVR on the Frame reads only `binary_path_linux_arm`** (binary_path_linux alone is skipped). Overlay apps: no launch test, no Linux Steam-parent watchdog (`FRAMEPORT_OVERLAY`), not a "running game". A Steam overlay-app shortcut and a game shortcut run together. SteamVR's SetApplicationAutoLaunch didn't persist on the dev Frame (the watch never started by itself) → **agent v76: FramePort's own autostart**: the deployment's `overlay.autostart` is the source of truth; `ensure_host_fixes` (`ensure_overlay_service`) keeps the user service `frameport-vr-overlays.service` (`_vr_overlay_watch`, 5 s polls of the known vrserver's /proc stat) only while an overlay app has autostart on (register/unregister, uninstall, purge and the kill switch `~/.local/share/frameport/vr-overlays.disabled` / `FRAMEPORT_NO_OVERLAY_AUTOSTART` update it); a new vrserver (pid + start time, kept in `~/.cache/frameport-vr-overlays.json` across agent updates) → child `_vr_overlay_round`: wait for IVRApplications, 15 s grace, `launch_vr_overlay` for apps not running (folder process or GetApplicationProcessId); log `~/.local/share/frameport/vr-overlays.log`. Dev Frame: adopted the running vrserver, skipped the already running watch; a start after a real SteamVR start/boot is not yet seen. Details: docs/FRAME_RUNTIME.md "Overlay apps".
+
+## Vader's leak solved / AC Nexus flips
+
+**Vader's leak solved / AC Nexus flips (2026-10-14):** Vader Immortal leaves GL errors pending on its context; SteamVR's GL interop (`openxr_graphics_gl_openvr.cpp`, `xrclient_<pkg>.txt` in Steam's logs: `SXR_GL_CHECK: error:0x502 ... glGenTextures`) takes the stale error as its own failure once, and from then on `CVRCompositorSharedTextures::BeginCommandBuffer` allocates a command buffer every frame (perf page-fault stacks; ~430 renderD128 mappings + 22 MB/s). Adapter `gl_error_clear` (GLES, catalog on for Vader ep1-3) clears them before xrCreateSwapchain/xrBeginFrame/xrEndFrame: flat memory, no SXR_GL_CHECK (headless). The per-game `xrclient_<pkg>.txt` logs are worth reading for runtime errors. The Frame's runtime caps swapchains per session (XR_ERROR_LIMIT_REACHED from ~15; AC Nexus asks for more): flip emulation now turns quads upright in place (scratch VkImage, once per acquire; transfer usage added to single-layer colour swapchains) instead of a shadow swapchain per quad, which ran into the cap (#138). Headless sessions don't draw AC Nexus's panels (adapter `flip_dump` saves before/after images of flipped quads, for headset runs).
+
+## Unreal's self-restart
+
+**Unreal's self-restart (agent v90, 2026-10-13):** UE 4.21+ restarts the app once after its first-run shader
+precompile ("optimizing" screen; `r.ProgramBinaryCache.RestartAndroidAfterPrecompile`): it starts its own LAUNCHER
+activity and calls System.exit(0); Lepton ends the container with the first process (the restarted one with it).
+Skipping `AndroidThunkJava_RestartApplication` or the cvar = 0 (accepted via UE4CommandLine.txt `-ini:`) left Sports
+Scramble on that level for good. launch.sh (RESTART_BLOCK, `upgrade_launchers` adds it) starts Lepton once more when
+`_restart_requested` sees the app's own LAUNCHER start (system log, uid >= 10000) <= 5 s before its exit; first run
+kept as `launch-before-restart.log`; `FRAMEPORT_NO_RESTART=1` off. Owner-verified with Sports Scramble's first start (2026-10-13).
+
+## xrWaitFrame runs ahead (Journey of the Gods)
+
+**xrWaitFrame runs ahead (Journey of the Gods, 2026-10-14, owner-verified):** with real frames (headset on) the
+Frame's runtime sometimes returns from xrWaitFrame at once with a display time less than one refresh after the frame
+just submitted, and then rejects the second submission for that refresh (`VRCompositorError_AlreadySubmitted` in
+Steam's `logs/xrclient_<pkg>.txt`; FrameBridge pacing above the display rate). VrApi games that render faster than
+the display ran ahead (~120 submits/s at 90 Hz) and the scene slid and snapped back. The VrApi bridge re-waits when
+the new display time is under half a period after the last submitted one (`pacing 2s:` counters). Headless runs only
+submit empty frames and never show it. Lepton's logcat mirror also missed the whole verifying session (launch.log =
+Lepton's own lines only): the keeper now catches a silent mirror too (agent v91).
+
+## Lepton's logcat mirror dies
+
+**Lepton's logcat mirror dies (agent v67, 2026-10-09; v91 2026-10-14):** Lepton's mirror (`podman exec -it <container> logcat -v threadtime,color`) fails three ways: `logcat: Unexpected EOF!` right after the game starts, `Logcat read failure`, or running and writing nothing at all (Lepton 3.0.5: seen twice on 2026-10-14, once in the owner's session, once headless). launch.sh's `_logcat_keeper` reads `podman exec <container> logcat -v threadtime -T <epoch>` itself into launch.log after a failure line or 20 s without a logcat line (from the launcher's start when the mirror never wrote, else from just before its last line), restarts it from where it ended (≤5), stops it when Lepton's coloured lines come back, sets the container's log buffer to 16 MiB (`logcat -G`), and logs every decision to `<base>/logcat-keeper.log`. Checked on the dev Frame: a mirror killed mid-game (hand-over without a gap) and a silent mirror (the whole session recovered).
+
+## Double launch
+
+**Double launch (agent v57, 2026-10-06):** a second Play while Lepton still boots (~10 s with nothing to see) made
+the second Lepton stop the first one's container ("Waiting for steamlaunch-<appid> (PID …) to exit", exit 137
+"(starting)", "Clearing baked app data due to early exit") and both died (Vader, BattleSisters). launch.sh now takes
+`flock` on `<base>/.launch.lock` (fd 9, inherited by Lepton; the watchdog and dashboard helpers close it with
+`9>&-`); a second launch exits 0 and logs to `<base>/launch-dup.log`. `upgrade_launchers` adds it to existing
+launchers. Verified on the device (second launch during boot: ignored, the first kept running). Vader on its loading
+card ignores input too (owner pressed/held every button: presses reach the runtime, the card never changes).
+
+## Issue triage round (2026-10-06)
+
+**Issue triage round (2026-10-06, owner's headset):** vibration in OVRPlugin games = 2 s vibrations updated per frame and
+stopped with amplitude 0; FrameBridge turns amplitude 0 into xrStopHapticFeedback (else each buzz ran 2 s), haptic_fix
+uses the envelope RMS (was its peak), per-game `haptic_scale` → Creed/The Boys/Jurassic World fine. Lambda1VR (TBXR):
+loader named by Build.MANUFACTURER (`frame.tbxr_vendor`), no graphics extension enabled (FrameBridge adds
+XR_KHR_opengl_es_enable + asks for the requirements on -50), always multisampled render-to-texture (GL shim gives
+single-sampled stand-ins when GL_EXT_multisampled_render_to_texture is hidden) + its xash/ data → works. Jurassic World:
+`frame.vrapi_stub`. Metro Awakening: contributor's vkshim fixes + hide_space_warp + no VALVE_rpo (jumping polygons like
+ITR2). Pinball FX VR: hide_space_warp (stutters). Eleven: a Meta online request fails after platform init → needs Meta
+services. Star Wars Tales: top half black + freeze after loading; ruled out: asset-file paks (never requested), Valve
+foveation (off: no change), GL errors (MESA_DEBUG=1: none), EGL_BAD_ACCESS once in OVRPlugin init (harmless); the game's
+eye image reads back black. BlazeRush: VrApi bridge exports + ovr*_ToString stubs + avatar stub get it to the menu room
+at 72 fps, full input reaches it (diagnostics `input 5s`: Touch type only, sticks 1.0, buttons, poses 0x8f), but the room
+draws no controllers and ignores input; avatar loader forced to its "Failed" path (no logged-in user) changed nothing.
+`frame.ovr_trace` can't trace Unity games (P/Invoke dlsym; nothing imports ovr_*). Headless: the VrApi bridge's 30 s
+head-pose deadline ends VR mode without a worn headset (not a game bug).
+
+## Lepton storage
+
+**Lepton storage (2026-09-30):** each app's /sdcard (= /storage/emulated/0 → `<base>/lepton-data/external`) has `Movies`/`Download`/`Documents` symlinked to the Frame's `~/Videos`/`~/Downloads`/`~/Documents` (liblepton/mounting.sh, only if they exist at start); agent v24 `storage_targets` reads that mapping. Android's MediaProvider canonicalises paths to /home/steamos/... and rejects every file ("doesn't appear under [/system/media...]"), `sm list-volumes` is empty: the media index never works, apps must browse folders. Lepton installs with `adb install -g` (runtime permissions granted, MANAGE_EXTERNAL_STORAGE too). Files: `install/files.py`, `frameport frame send|storage`, GUI Files tab (formerly Frame → Send files).
+
+## SteamVR per-app settings
+
+**SteamVR per-app settings (2026-09-30):** editing steamvr.vrsettings while SteamVR runs is lost; the web API (127.0.0.1:27062 /app/setsettings) needs `x-steamvr-secret`. `native/vrsettings` = `fp_vrsettings.exe` (freestanding, OpenVR `FnTable:IVRSettings_003` as a Utility app, loads SteamVR's bin/win64/openvr_api.dll) sets them live and SteamVR persists them: section `steam.app.<shortcut appid>`, keys `preferredRefreshRate` (float) and `motionSmoothingOverride` (0 global, 1 on, 2 off, 3 always). Steam Link (vrlink) lists the Frame's rates 72/80/90/96/108/120/144 in vrserver.txt and follows the per-app preference ("host preferred N Hz"; whether the key is honoured is unverified in-headset yet). Judder metric: vrcompositor.txt session summary dropped + "Timed out. N total" (Stormland: 0 dropped but 313 timeouts in 2 min); fpsVR (`%LOCALAPPDATA%\fpsVR\*.json`, 0.1 ms histograms) gives p99 CPU/GPU ms. `pcvr.steamvr_tuning` (default on, PC only) applies on Play: highest rate whose budget ≥ p99×1.05, at least one step down, smoothing on.
+
+
+## Language packs
+
+**Language packs (merged from PR #20, 2026-10-04):** overport's `libovrplatformloader.so` is a dispatcher that `dlopen`s Meta's own loader (`libovrplatformloader_meta.so` / `_meta_q1.so`, also `libpxrplatformloader.so`) and keeps its own message queue; `ovr_LanguagePack_GetCurrent/SetCurrent` are 8-byte `return 0` stubs in it, `ovr_AssetFile_GetList` forwards to Meta's loader. `frame.langpacks` (opt-in, `native/langpack`) serves `<tag>.lang` files from the game's data; `elf.hide_exports` marks the loader's exports STB_LOCAL (bionic and glibc only match GLOBAL/WEAK; verified for glibc, bionic's `is_symbol_global_and_defined` is from memory). `libfp_langpack.so` is built here (`python native/build.py --only langpack`) and committed. Owner-verified 2026-10-04: Deadpool VR with only `en.lang` and the patch on plays English dialogue and runs normally (headless launch tests show 2-6 fps while it loads: not a regression sign). A dispatcher answer that arrives after we answered the timed-out GetList is dropped (one answer per request); games already in a library get `lang_packs` filled after an app update (`library._refresh_data_fields`). The library logs to logcat under the tag `fp_langpack` (dirs looked in, packs found, every language-pack call), so it shows up in the game's `launch.log`; an `ovr_AssetFile_GetList` the dispatcher leaves unanswered for 1.5 s is answered with our packs alone. Deadpool VR (Unreal) accepts a pack only when its `Metadata` equals the game's own version string (`ULanguagePacksSubsystem` compares it with `%s.%s.%s.%s.%s` built from the build info, e.g. `1.0.40.356975.Quest` = versionName; found by disassembling `libUE4.so`): the patch writes the APK's versionName into the library (`@FPMETA@` slot, `with_metadata`), `FRAMEPORT_LANGPACK_META` overrides it. Deadpool VR (2026-10-04, headset): German became selectable with that Metadata, but dialogue stayed silent (even English once reported as a pack) while the path was spelled `/sdcard/Android/obb/<pkg>/x.lang`; with the `/storage/emulated/0/Android/obb/<pkg>/x.lang` spelling (Unreal's own, now listed first in `scan_dirs`) German dialogue plays. `FRAMEPORT_LANGPACK_SKIP=<tags>` or a file `fp_langpack_skip` in the obb folder leaves packs out of the list (experiments).
+
+
+## Cube swapchains
+
+**Cube swapchains (GitHub #107, 2026-10-09):** the Frame's runtime refuses `faceCount=6` swapchains (-2,
+XR_ERROR_RUNTIME_FAILURE); OVRPlugin ignores that ("CreateSwapchain for eye 0: 0x0, 0 stages") and crashes in
+ovrp_EndFrame4 (memset). FrameBridge `cube_standin` (default on, `native/adapter/cube_standin.c`) serves a refused cube
+swapchain as one GL cube-map texture in the app's context (GLES only) and drops its layers. Verified headless with
+Budget Cuts Ultimate (2048² sRGB, 12 mips; runs on at ~70 fps); what the cube layer showed is simply missing.
+
+## Hardware video decoding
+
+**Hardware video decoding (PR #96, PR #128 by Lucas-Mathieu, adapted 2026-10-10, agent v71):** `native/hevc` = one
+OMX plugin `OMX.frameport.{avc,hevc,vp9}.decoder` (FFmpeg v4l2m2m on Iris /dev/video-dec0, FFmpeg software decoders as
+fallback inside the component, Vulkan copy for big native surfaces). The connection installs it once per Frame
+(`ensure_video_codec` → agent `video_codec_status`/`install_video_codec`: `~/.local/share/frameport/video-codec/versions/
+<manifest sha>` + `current` symlink). A Frame keeps the same or a newer `revision` (no flip-flop between PCs) → **bump
+`revision` in native/hevc/build.py with every artifact change**; a failed install isn't retried during the connection.
+Per game: only launchers of games whose recipe has `frame.hw_video_decode` (install stage, no APK change; suggested
+from analysis `media_codec`, ANALYSIS_VERSION 8; deployment.json `hw_video_decode`) get the codec line → the Podman
+wrapper (native/hevc/podman.py) mounts the plugin into that container (merged media_codecs.xml in
+$XDG_RUNTIME_DIR/frameport-video). Off for every game: Settings → Installing (library `video.hw_decode` → agent
+`video_codec_switch` = video-codec/disabled); one game: `FRAMEPORT_NO_HW_VIDEO=1 %command%`. `upgrade_launchers`
+converts agent ≤70 launchers (Batman's `<base>/frameport-codec` → keeps the line, folder then removed). Batman: catalog
++ migration `batman_video_patches` (`frame.hw_video_decode` + hidden adapter setting `surface_native`). Iris: 8K
+refused (ENOMEM) while any other decoder session is open; SteamVR's vrlinkrunthread holds one ~12 s at game start →
+refused opens retry until 20 s after the plugin loaded (else 2 s), then software; VP9 7680x3840 never returned a
+picture → VP9 ≤4096x2304; hidden VP9 frames come back as empty capture buffers (bytesused 0, no LAST):
+FFmpeg's wrapper ended the EOS drain at the first one (two-pass VP9 lost its last ~25 frames) → build.py requeues
+them (codec revision 8; drain ends at LAST, or 1 s after a skipped empty buffer; dev Frame 2026-10-10: 600/600 =
+OMX.google.vp9 Y hashes). Rebuilds are deterministic (ext4 + NTFS path
+with spaces, two NDK copies → same; rev 8 141de01f…; PR #128's own sources → its 27a2d749…). Not yet run on the device.
+
+## Vulkan shader dump
+
+**Vulkan shader dump (GitHub #140, 2026-10-10):** adapter `vk_shader_dump=1` (Vulkan shim, `native/vkshim/shader_dump.h`;
+applies where vk_sanitize can: Unreal/Other arm64) writes each distinct SPIR-V module once to
+`files/fp_vk_shaders/<size>_<sha256>.spv` (tmp + rename) and one `index.txt` line per vkCreateShaderModule (`<seq> <ms>
+<unix ms> <name> new|known|again|failed`, O_APPEND) to find the module behind a GPU hang. Agent v72 `collect_diag`
+returns `shaders` (newest modules of fp_vk_shaders + fp_spirv, ≤4 MB each, base64) → bundle
+`games/<pkg>/target/shaders/`. Triage `gpu-hang` suggests both dumps; `triage.graphics_api` (FrameBridge's
+xrCreateSwapchain formats: <0x1000 Vulkan, else GL) keeps only the session's API's (`API_ONLY`). Host-tested only.
+Agent v74: a reporter's hang came ~10 s after the last new module, so the culprit wasn't among the newest written →
+with an index naming modules, `shader_dumps` sends every module of the index's **newest session** (after the last
+`# start`), deduplicated, last used first, each ≤4 MB, ≤30 MB in all (`session` = how many it names) + that session's
+index lines; no index (fp_spirv) = the old newest-by-mtime 4 MB. One JSON line (~40 MB base64) over the SSH channel
+is read whole by `Frame.agent` (fine at that size); `_Writer.fit` drops the least recently used modules last, after
+cutting logs, to stay under the 24 MB zip limit.
+
+## Unreal OBB check
+
+**Unreal OBB check (GitHub #159, 2026-10-10):** Epic's DownloaderActivity checks OBB name+size (OBBData), then with `bVerifyOBBOnStartUp=true` CRCs the whole OBB; its screens are invisible in Lepton (stuck at `Displayed …/.DownloaderActivity`, triage `unreal-obb-check-stuck`) → `frame.unreal_skip_obb_check` (analysis `unreal_verify_obb`, ANALYSIS_VERSION 11) flips the manifest boolean (`axml.set_meta_data_bool`); skips only the CRC pass. Host-tested only.
+
+## Issue round 2026-10-12
+
+**Issue round 2026-10-12 (agent v83):** Lepton pastes STEAM_COMPAT_DATA_PATH unquoted into `sh -c "ln -s …/internal/<pkg>
+/data/data/<pkg>"` (mounting.sh): a game on a card named "Steam Frame 512g" got no internal storage (no saves/prefs;
+Beyond Sandbox's EOS then looped `createKeychain→resetKeychain` forever, 1.85 GB log). Quest launchers with an unsafe
+path now `ln -sfn <base> ~/.local/share/frameport/lepton-paths/<pkg>` at every start and give Lepton that path
+(`app_dir_lines`/`set_app_dir`/`launcher_base`; upgrade_launchers converts; deployment.json keeps the real base).
+Verified on the device with a spaced copy of Stremio (old: the `ln` error; new: /data/data link, shared_prefs
+writable). `frame.eos_keychain_loop` (opt-in, triage `eos-keychain-loop`) returns from EOSSDK.resetKeychain. Wander
+0.3570 (Unity 6.5, Firebase, Gecko) ran out of bionic's 128 pthread keys → `frame.unity_tls_key_pool` (Klownicle's
+approach, #198: libunity's 4 key imports renamed `fp_tkey_*` via `elf.rename_imports`, `libfp_tkeys.so` pools
+destructor-less keys behind one real key); device: past Firestore, 72 fps. Cpp2IL releases can't read metadata v107
+(Unity 6.5) → `tools/cpp2il.py` falls back to the development CI build (nightly.link) on that error, and since #293 on any release failure (BattleTalent, Unity 2021.3: the release dies exit 134 in CsFileUtils.GetTypeName after making the folders, no .cs; `il2cpp._run` = non-zero exit or no .cs is unreadable; never with FRAMEPORT_CPP2IL; caches holding "every class missing" are re-run). Vermillion's canvas
+is an OVROverlay quad (drawn above the hand) → `frame.vermillion_scene_canvas` (PaintableMesh getters → false;
+installed build checked, 72 fps headless; headset not yet). Linux apps: `desktop_icon` switch, a deleted desktop copy
+stays deleted (#212). Findings: OLAR (#201) RHIThread null deref in libUnreal (`ldr x8,[x19,#792]`, x19=0) not fixed by
+hide_space_warp / vk_hide_fdm / no Valve layers; FNAF HW (#135) "freeze" = first-start GL program-binary-cache compile
+on Zink (threads busy in zink/disk cache), not a hang; VR4 (#199) reporter's patch.203 OBB truncated. Upload benchmark
+(`scripts/upload_bench.py`, #242): home Wi-Fi caps every method at ~11 MB/s; paramiko uses ~3x OpenSSH's CPU; Windows
+OpenSSH refuses FramePort's key file (ACL "bad permissions") until its permissions are tightened.
+
+## OpenSSH uploads
+
+**OpenSSH uploads (2026-10-15, #324/#242):** sftp escapes `* ? [` inside double quotes itself (and undoes it for
+put's destination), so `native_upload.quote` escapes only `\\`/`"`; Win32 sftp turns every local backslash into `/`
+(escapes too) → local paths go as `C:/…`. Logins: `Frame.auth` = the attempt that worked (app_key / user_key = a key
+file from Settings → Installing → SSH keys, library `ssh.extra_keys`, CLI `frame ssh-keys` / agent / password).
+OpenSSH strict (FramePort + Settings keys, IdentitiesOnly) unless auth was "agent"; a refused strict login retries
+relaxed (+ private copies of ~/.ssh/id_{rsa,dsa,ecdsa,ed25519}: OpenSSH skips its defaults once any -i is given, + the
+agent); `-v` key lines go into the error. FramePort doesn't add its key to the Frame for this. Windows-tested.
+
+## Meta user id
+
+**Meta user id (GitHub #182, 2026-10-11):** OVRPort's platform loader (runtimes 3.4.3-23204ea and -aa54c3f) answers
+`ovr_GetLoggedInUserID` (and two other callers) without a Meta account with a made-up id from a helper (`stp; mov x29,
+sp; bl random; …; mov/movk x9 = 0x53444835ec580000 (6e18); add x0, x8, x9; ldp; ret`), kept only in memory → a new id
+every start; Walkabout Mini Golf files saves under `Profiles/Oculus/<id>/` and lost all progress. `frame.ovr_stable_user`
+(default_on, detect = the game has libovrplatformloader.so) rewrites the helper to `mov x0, <6e18 + 32 bits of
+sha256(package, keystore)>; ret`: stable per game and per user (keystores are personal), so online games never see two
+FramePort users as one. Found in every PATCHED build checked. Host-tested only; upstream candidate.
+
+## Vivox API 31
+
+**Vivox API 31 (GitHub #101, 2026-10-09):** newer Vivox builds (Green Hell VR) call Android 12 AudioManager
+communication-device methods from `com.vivox.sdk.AudioChangeListener` with no SDK check → NoSuchMethodError on Lepton's
+Android 11. `frame.vivox_audio_route` (analysis `vivox_api31`, ANALYSIS_VERSION 4) makes every such method return at
+once (`Dex.return_early`: return-void / `const/4 v0,0; return v0`; nopping the invoke would leave a move-result the
+verifier rejects). Older Vivox (Eleven Table Tennis, BattleSisters) lacks that code and isn't matched. Verified
+headless: Vivox initialises, 150 s at ~65-70 fps.
+Photon Voice does the same (GitHub #362 Table Troopers, #325): `com.exitgames.photon.audioinaec.AudioInAEC.
+updateAudioDevice` (void; only caller of getAvailableCommunicationDevices/setCommunicationDevice, reached from the mic
+thread `AudioInAEC$1.run` via access$000; no SDK_INT check left) → sibling patch `frame.photon_voice_audio_route`
+(analysis `photon_voice_api31`, ANALYSIS_VERSION 21; shares `vivox_audio_route.patch_class`; Vivox's id, title and
+output unchanged, no revision bump). Triage: `vivox-api31` / `photon-voice-api31` now need the SDK's class in the
+stack; any other `*CommunicationDevice*` NoSuchMethodError = `audio-api31` (report). Host-tested on the real dex only.
+
+## Steam Input gamepad for 2D apps
+
+**Steam Input gamepad for 2D apps (GitHub #162, agent v72, 2026-10-10):** Lepton's Android only has the Wayland seat's `wayland_touch/keyboard/pointer`. Steam makes its virtual pad (uinput, `/devices/virtual/input`, 28de:11ff, "Microsoft X-Box 360 pad N", ACL for steamos) only while the Frame's controllers are on (controller.txt "Steam Controller reserving XInput slot 0"; gone when they sleep), also with no game running; steamos-manager's 28de:0000 keys device isn't a pad (no BTN_SOUTH). Lepton's container root (system_server too) = steamos (`keep-id:uid=0`), so a bind-mounted `/dev/input/eventN` opens. Opt-in `device.steam_gamepad` (vr_kind none; suggested for `android.hardware.gamepad`/`LEANBACK_LAUNCHER`, analysis `gamepad`, ANALYSIS_VERSION 9): deployment.json `steam_gamepad` → launcher `GAMEPAD_LINE` (after the codec line: exports FRAMEPORT_GAMEPAD + LEPTON_ENV_SDL_GAMECONTROLLER_ALLOW_STEAM_VIRTUAL_GAMEPAD, puts `agent/bin` first on PATH) → `PODMAN_WRAPPER` (written by ensure_host_fixes; non-`run` calls go straight on; `run` imports the agent's `podman_run_args`; hands on to the next Podman after its own PATH entry with itself removed from PATH, so it chains to the codec wrapper either way round) adds the pads + `Vendor_28de_Product_<pid>.kl` (Xbox 360 layout). Verified headless with a uinput stand-in pad (Stremio's container: EventHub `classes=0x80000141`, our key layout, KeyEvent BUTTON_A dispatched); with Steam's real pad and a game: not yet. Pads made after the start aren't seen until the next one.
+
+## Multiview programs on flat framebuffers (Doom3Quest)
+
+**Multiview programs on flat framebuffers (GitHub #77, Doom3Quest, 2026-10-09, prototype):** Mesa enforces OVR_multiview's
+"program num_views == draw framebuffer views" rule (`draw_validate.c`, the draw is dropped silently); Qualcomm doesn't.
+Doom3Quest compiles every VS with `layout(num_views=2) in;` and draws its HUD/PDA into 2D-texture FBOs → black. Opt-in
+`frame.gl_multiview_fbo` (analysis `gl_multiview_libs`, ANALYSIS_VERSION 6; own-engine GLES only): `native/glmv` =
+`libfpglmv.so` (12 chars = "libGLESv3.so": libdoom3.so's one `.rodata` dlopen string is rewritten in place, its qgl*
+table comes from dlsym on that handle; also first DT_NEEDED for its direct gl*/egl* imports). Such draws use a lazily
+built single-view twin (view 0, uniforms copied per draw); eglMakeCurrent resets the per-thread cache. Host-tested only
+(rewriter on all 19 Doom3Quest shaders + glmv.c against a stand-in GL, `tests/test_gl_multiview_fbo.py`); the host's
+Mesa 23.2 llvmpipe has no OVR_multiview. Headset-verified by Xandrix1987 (2026-10-09: HUD/PDA shown, no fps drop) -> in the Doom3Quest catalog recipe.
+
+## BlazeRush
+
+**BlazeRush (GitHub #57, Klownicle's verified guide, 2026-10-10; FramePort's version headless-tested only):**
+`frame.blazerush` (1.0.349 only: exec-segment SHA + every word checked, offsets from PT_LOAD) NOPs the avatar-readiness
+wait (0x4b2dbc), RETs the avatar renderer (0x4b2adc), renames `cache/shader_cache` → `cache/br_shader_v1`. GL shim
+(now also exports glShaderSource/glLinkProgram/glProgramBinary/glDeleteProgram/glDraw*: pass-through unless a setting
+is on) `gl_int_attribs` (integer inputs fed via glVertexAttribPointer re-set with glVertexAttribIPointer per draw,
+reflection cached per EGL context + program, dropped on link/binary/delete) and `gl_highp_markers` (vertex shaders with
+every '|' marker: mediump→highp except on in/out/uniform lines); host test `tests/test_blazerush.py` with a stand-in
+GL. FOV: the game reads VrApi props 7/8 right after vrapi_Initialize (no session; the Frame has no
+XR_EPIC_view_configuration_fov) → the bridge saves the live FOV (also located before tracking, headless: 118.87×120.04
+on the dev Frame) in `files/framebridge-vrapi-fov.txt` and answers with it at the next start (log `FOV properties: …
+(saved by an earlier session)`). `device.config_sync` (catalog field `config_sync`, agent v78): user_config.xml
+r_3dwidth/height, r_width/height from the runtime eye size (FrameBridge logs `runtime recommended eye size`) × scale,
+written at finalize, set_settings and by launch.sh before Lepton starts (`_config_sync`). Headless runs at scale 1.7
+end in `zink: DEVICE LOST` right after the bridge's 30 s no-tracking deadline tears the session down (gpu fault at the
+teardown; not at scale 1.0): a headless-only artifact, the headset never hits that deadline. Launch tests count an exit/crash after
+such a line as a pass (triage.yaml `headless_end`, finding `headless-end`; GitHub #57 "Failed to launch" on install).
+
+## Session triage
+
+**Session triage (agent v70, 2026-10-09):** launch tests never reach FOCUSED, so real play sessions are triaged
+too. list_installed gives each game `last_play` {start, end, test} from `<anchor>/plays.log` (launch tests write a
+`test <unix>` line first → test sessions are only marked); `session_log` returns the newest session's launch.log
+(`<base>/session.log`, ≤4 MB: head + tail + FrameBridge/crash lines between) + that session's logcat-crash.log +
+`journalctl -k` GPU lines ("kernel: …"). The GUI's connection refresh (`app._check_sessions` → `pipeline.sessions_due`,
+background thread; sessions >7 days old are skipped) runs `pipeline.triage_session` = `validate/session.analyze`
+(triage.yaml signatures incl. `space-warp-used` (info, `question:`, never auto-applied), `gpu-hang` (`report: true`)
++ computed `slow-frames` (pacing windows vs the nearest refresh rate) and `focus-dips` (FrameBridge always logs
+`focus: lost` / `focus: back after N ms`, session_fixes.c)) → library `last_session` / `last_session_checked` → game
+page "Last session" callout (Try this fix / Rebuild with this fix / Yes-No question / Report / Dismiss). Suggestions may
+be values (`adapter.scale=0.85`, `triage.split_suggestion`); adapter-only fixes are pushed live (`apply_suggestions_live`
+→ agent set_settings, like the Game settings dialog). CLI `frameport session <pkg> [--apply]`. PC VR (Proton) launchers
+log no session end, so they aren't triaged yet. pac_hints stays triage-only: a survey of all 68 dump APKs found unpaired
+PAC hints in 21 libraries of 18 games (OpenSSL's 38/40 in most UE4 libUE4.so and libEOSSDK.so, UE5 libUnreal.so ~400
+vs +2-3, libass, libopencv, …), most of them games that work, so default-on would rewrite many working builds.
+
+## Install links / FrameDrop button protocol
+
+**Install links / FrameDrop button protocol (2026-10-07, not yet clicked end to end from a browser):** FrameDrop
+(framedropvr.com, a closed-source Windows sideloader) defines "Install with FrameDrop" buttons:
+`https://framedropvr.com/install?manifest=<url>|url=<file>` → that page opens `framedrop://install?…` (1.6 s, else its
+home page); manifest `{"schema":"framedrop.install/v1","name","files":[{"url","sha256"}]}` (name = Steam title; .apk
+or Linux .zip). `deeplink.py` (no Flet) parses framedrop://, frameport:// and the pasted https link, enforces its
+rules (https; http only on loopback; no credentials; no LAN/loopback/link-local IPs, also after DNS and redirects; URL
+ends in a file name), caps manifests at 256 KiB, ignores non-hex sha256 (FrameDrop's own example has a placeholder),
+downloads into `<data>/downloads/<slug>-<hash>/` (OBBs → `obb/` next to the APK, `.part` removed on cancel/mismatch);
+`pipeline.add_from_link` routes APK / Linux / exe and sets `title` + `title_locked` + `link` (a bare file link keeps
+FramePort's title). GUI: `views/link_dialog.py` (always asks first), Add games → "Install from a link…", CLI
+`frameport open-link [--yes --no-install --gui]`. **A `flet build` bundle can't take a URL argument** (the Flutter
+host treats any argv as a developer page URL), so `urlhandler.py` registers a script, not FramePort.exe: Windows
+HKCU `Software\Classes\{framedrop,frameport}` → hidden PowerShell `frameport-link-handler.ps1`; WSL (source runs)
+the same keys → `wsl.exe -d <distro> -e sh frameport-link-handler.sh`; Linux `frameport-links.desktop` +
+`xdg-mime`; macOS unsupported (Apple Events, paste instead). The script drops the link into `<data>/links/*.link`
+and starts FramePort unless `<data>/gui.alive` is < 10 s old (`gui.starting` stops double starts); the GUI's
+`_watch_links` thread touches the heartbeat and opens links (newest window session). Settings → Install links: one
+switch per scheme (`links.framedrop`, `links.frameport`, default on); a scheme another program owns (FrameDrop) is
+only taken with "Use FramePort for these links" (`register([s], force=True)`); off removes only FramePort's own
+registration (`MARK` in the command). Never registered with FRAMEPORT_HOME/FRAMEPORT_NO_LINK_HANDLER (tests,
+screenshots). Same round: files dropped on the Library (`ui/dropped.py`, bundles only like the Files tab), "Add a
+Windows program (.exe)…" (`pipeline.add_windows_exe`: exe in Downloads/home/drive root copied alone into
+`<data>/windows-apps/<slug>/`), patch `device.display_mode` (Automatic / VR / Flat window → `InstallContext.display`,
+`installer.show_window`). FramePort-only manifest extension `"frameport": {"description", "icon"}` (bad values ignored; icon: same URL rules,
+≤2 MiB, Pillow-checked, ≥32 px, saved as PNG in `<data>/downloads/icons/`, shown in the question by asset URL, then
+`sources.apply_custom(pkg, "icon")` unless `.picked` exists; description fills `details.description` only when
+empty). Bare file links get a title guessed from the file name (`title_from_filename`: version/arch dropped, package
+names → last part). Windows test of 0.12.1.dev191 (2026-10-07): a button click opened the dialog; but a click right
+after closing FramePort did nothing (the closed window's heartbeat was < 10 s old) → the handler scripts now wait
+up to 4 s for the link file to be taken before trusting the heartbeat, the window's CLOSE event / atexit delete
+`gui.alive`, and the Windows command runs under `conhost.exe --headless` (plain `-WindowStyle Hidden` flashed a
+console). Screens: `scripts/ui_smoke.py --links --fake-frame --game <pkg>` (tall pages: `--viewport
+1280x7000`; Flutter's popup menu ignores Escape).
+Demo link: the homepage's example button = `deeplink.DEMO_MANIFEST` (https://frameport.app/demo/cool-game.json, published
+from site/public/demo/); every form (https button page, frameport://, framedrop://, pasted) → `InstallRequest.demo`,
+no network (fetch_manifest returns `demo_manifest()`, download refuses), `link_dialog.show_demo` (Install =
+`easter.demo_install`: Cool Game's cover out of the portal; eggs off → "Nice, it works!"), CLI just says so.
+Link updates (2026-10-17): manifest `version` (top level, or `frameport.version`, which wins; ≤64 chars) is stored in
+the entry's `link` record (+ `direct`); `pipeline.check_link_updates` (GUI start via `app._check_link_updates`, every
+6 h: setting `links.last_update_check`, off with `links.check_updates`) re-fetches web manifests that named a version
+(`deeplink.can_check_updates`: not bare file links, local manifests or the demo) and sets/clears `link_update`
+{version, checked}; versions compare with `deeplink.compare_versions` (numbers, then release > suffix). UI: Library
+`link_bar` + game page callout → `link_dialog.update_from_link` (fetch again, one confirmation, `download_and_install`
+per game; add_from_link clears the offer and keeps a name the user gave). CLI `frameport link-updates [--install]`.
+

docs/FAQ.md

@@ -26,6 +26,25 @@ Games/                                  ← scan this folder (Add games → Scan
 Not sure of the package name? It's in the OBB file names (`main.<version>.<package name>.obb`), and the game's page
 shows it under **Details**.
 
+## I moved my games to another folder or drive. How do I update the library?
+
+Scan the new folder (**Add games → Scan a folder…**, or **Settings → Library folders → Add folder…**). A game whose
+files are gone from their old place and that FramePort finds again in the new folder keeps its library entry: only
+where its files are changes. Its name, tags, artwork, your own recipe and what's installed on the Frame stay; you don't
+have to remove it from the library first. **Rescan folders** in the Library does the same for every library folder.
+
+- **Removing a folder:** **Settings → Library folders** lists every folder FramePort scans, with how many library games
+  come from it and whether it's there now (a folder on an unplugged drive shows as not found). The bin icon stops
+  scanning a folder; its games stay in the library. `frameport folders [--add DIR] [--remove DIR]` does the same on the
+  command line, `frameport rescan` rescans.
+- **Another version in the new folder** (a different APK or game build): **Scan a folder…** on that folder takes it, as
+  **Update with a newer APK…** would (name, tags, art and your own recipe stay). **Rescan folders** leaves such games
+  alone and says so; use the game's **Update with a newer APK…** / **…version…** to switch.
+- **Two copies** (the old folder is still there): the library keeps the copy it has. To use the other one, delete or
+  rename the old copy and rescan.
+- PC VR games are recognised by their folder name, or a renamed folder by its program file. Linux apps aren't part of
+  folder scans: add the moved app again with **Add a Linux app…** (it keeps its name, art and switches).
+
 ## Can I scan SideQuest backups or AXRB downloads directly?
 
 Yes. Scan the folder as it is; FramePort finds the APK and its OBB files in both layouts:
@@ -178,6 +197,19 @@ draw more than the battery delivers, especially at lower charge, and the Frame t
 
 Saves stay on the Frame when you update or reinstall a game.
 
+## Can I back up a game's saves?
+
+Yes. Steam doesn't sync Quest games' saves, so FramePort copies them to your PC: the game's menu (**…** on its page) →
+**Saves** → **Back up saves**, or **Back up all saves** on the Steam Frame page (Installed games). Close the game
+first. A backup holds the game's own storage (`/data/data/<package>` and `/sdcard/Android/data/<package>`), without
+caches, shader caches and large downloaded content (videos, OBBs, files over 64 MB); the job says when something was
+left out. FramePort keeps the 10 newest backups per game (Settings → Data). They're in FramePort's data folder under
+`save-backups/<package>/` (**Open backups folder** in the game's menu).
+
+**Restore saves…** puts one back: it replaces the game's saves on the Frame. The Frame keeps a copy of the saves it
+had, so **Undo last restore** in the same window takes you back. When you uninstall a game and tick *Also delete its
+saves*, FramePort backs them up first. Command line: `frameport saves backup|list|restore|undo <game>`.
+
 ## A game with mods crashes
 
 How to tell: play once without mods and custom content. If it then works, a mod is the cause; the diagnostics zip

docs/FRAME_RUNTIME.md

@@ -60,6 +60,32 @@
   `launch.sh` at the new folder and only then deletes the old copy; on the same filesystem it renames instead.
   Moving a game whose Lepton data holds absolute paths, or a PC VR prefix, is not yet verified on the device.
 
+## Save backups (Quest games, agent v95, discussion #352)
+- A Lepton game's saves are two folders of `<base>/lepton-data`: `internal/<pkg>` (= `/data/data/<pkg>`:
+  `shared_prefs/`, `files/`, `databases/`; Unreal's `files/UE4Game|UnrealGame/.../Saved` often lives here) and
+  `external/Android/data/<pkg>` (= `/sdcard/Android/data/<pkg>`: Unity's `files/`, Unreal's external `Saved`). On the
+  dev Frame (2026-10-16) every file in them belongs to `steamos` (Lepton's `keep-id:uid=0`: the container's root and
+  app = steamos), mostly mode 600/660 in 700/771/775/2771 folders; Lepton's links (`Android/obb/<pkg>`, `Movies`,
+  `Download`, `Documents`) sit outside these two folders.
+- Agent `_backup_saves '<json>'` streams a tar.gz of both (members `internal/…`, `external/…`, PAX, numeric owners and
+  modes; last member `frameport-saves.json` = manifest with size + sha256 per file and what was left out) on the SSH
+  exec channel's stdout, the result JSON on stderr. Left out: folders named cache/code_cache/no_backup/il2cpp/
+  UnityShaderCache/(Vulkan)ProgramBinaryCache/GPUCache/… at any depth, Unreal `Saved/Logs|Crashes`, FrameBridge's
+  `fb_snap_*`/`framebridge*` files, `.obb/.apk/.foz/.mp4/.mkv/.webm/.mov`, symlinks and special files, and files over
+  64 MiB (big downloaded content; e.g. BattleTalent's `files/Video`). More than 4 GiB of saves is refused.
+- `_restore_saves '<json>'` reads the archive from stdin and treats it as untrusted: only regular files and folders
+  under `internal/`/`external/` (no `..`, absolute paths, links, devices, duplicates), ≤1 GiB per file / 8 GiB in all,
+  each file's sha256 must match the manifest, the manifest's package must be the game. Everything is staged in
+  `<base>/.saves-restore-*` first, a path that would pass through a link on the Frame is refused, then the current
+  saves are written to `<base>/saves-before-restore.tar.gz` (one copy; `rollback: true` restores it and keeps the
+  replaced saves as the new copy) and each file is renamed into place. Existing files keep their owner and mode, new
+  ones get their folder's owner and the backup's mode (at least u+rw); save files the backup doesn't have are removed
+  (left-out files stay). A failure while swapping puts the rollback copy back.
+- Both run their file work in `podman unshare` (the agent re-runs itself as `_saves_ns <op>` with stdio inherited) so
+  files owned by mapped ids are readable and keep their ids, take the game's launch lock (`<base>/.launch.lock`, a
+  Play meanwhile is ignored as a double launch) and refuse while its container runs. `saves_info` sizes a backup and
+  reports the rollback copy, `saves_rollback_delete` removes it.
+
 ## OpenXR runtime (as seen by games through overport's loader)
 - Instance extensions present include KHR_android_create_instance (must be enabled; the adapter adds it),
   KHR_vulkan_enable(2), KHR_opengl_es_enable, KHR_composition_layer_depth, FB_display_refresh_rate, EXT_hand_tracking
@@ -80,6 +106,8 @@
 - Swapchain formats: GLES `GL_SRGB8_ALPHA8` (35907) / `GL_SRGB8` (35905) only, samples = 1. Vulkan: 43 (R8G8B8A8_SRGB)
   and 50, not 37/44 (UNORM).
 - Environment blend: ALPHA_BLEND available (grayscale passthrough cameras).
+- XR_FB_composition_layer_alpha_blend and XR_KHR_composition_layer_color_scale_bias are not the runtime's (OVRPort's
+  dispatcher lists alpha_blend): their structs are ignored, so FrameBridge emulates inverse alpha (`alpha_blend_emul`).
 - Reference spaces: STAGE bounds are reported as 1×1 m.
 - Display 72 Hz by default in tests. Head pose is only tracked while the headset is worn; otherwise flags 0x3 and
   the session stays below FOCUSED.

docs/GAMES.md

@@ -13,11 +13,14 @@ Generated from [catalog/games](../catalog/games) by `scripts/compat_list.py`.
 | Arkio | Quest | ✅ Works |  |
 | Asgard's Wrath 2 | Quest | ✅ Works |  |
 | Assassin's Creed Nexus | Quest | ✅ Works |  |
+| Attack on Titan VR: Unbreakable | Quest | ✅ Works |  |
 | Audica | Quest | ✅ Works |  |
+| AugmentedEmpire | Quest | ✅ Works |  |
 | BAM | Quest | ✅ Works |  |
 | BARTENDER VR SIMULATOR | Quest | ✅ Works |  |
 | Batman: Arkham Shadow | Quest | ✅ Works |  |
 | BattleGlide | Quest | ✅ Works |  |
+| Battlemarked | Quest | ✅ Works |  |
 | BattleSisters | Quest | ✅ Works |  |
 | Beat Saber | Quest | ✅ Works |  |
 | Beat Saber | Quest | ✅ Works |  |
@@ -27,16 +30,19 @@ Generated from [catalog/games](../catalog/games) by `scripts/compat_list.py`.
 | BlazeRush | Quest | ✅ Works |  |
 | BodyCombat | Quest | ✅ Works |  |
 | BONELAB | Quest | ✅ Works |  |
+| Breathedge VR | Quest | ✅ Works |  |
 | Carve Snowboarding | Quest | ✅ Works |  |
 | Caves | Quest | ✅ Works |  |
-| Clockwork | Quest | ✅ Works |  |
+| Cities: VR | Quest | ✅ Works |  |
 | COMPOUND | Quest | ✅ Works |  |
 | Cook-Out | Quest | ✅ Works |  |
 | Cosmodread | Quest | ✅ Works |  |
 | Creed | Quest | ✅ Works |  |
+| Crisis Zone VR | Quest | ✅ Works |  |
 | cubism | Quest | ✅ Works |  |
 | Dance Central | Quest | ✅ Works |  |
 | Deep Cuts | Quest | ✅ Works |  |
+| Demeo | Quest | ✅ Works |  |
 | Demeter | Quest | ✅ Works |  |
 | Dinosaur Island | Quest | ✅ Works |  |
 | Doom3Quest | Quest | ✅ Works |  |
@@ -45,11 +51,14 @@ Generated from [catalog/games](../catalog/games) by `scripts/compat_list.py`.
 | Drunkn Bar Fight 2 - Early Access | Quest | ✅ Works |  |
 | Eleven Table Tennis | Quest | ✅ Works |  |
 | Eleven: Table Tennis VR | PC VR | ✅ Works |  |
+| EndoparasiticVR | Quest | ✅ Works |  |
 | Espire 2 | Quest | ✅ Works |  |
+| Eye of the Temple | Quest | ✅ Works |  |
 | FrenzyVR | Quest | ✅ Works |  |
 | Fruit Ninja | Quest | ✅ Works |  |
 | Fruit Salon | Quest | ✅ Works |  |
 | Genotype | Quest | ✅ Works |  |
+| Ghost Town | Quest | ✅ Works |  |
 | Ghostbusters: Rise of the Ghost Lord | Quest | ✅ Works |  |
 | GORN2 | Quest | ✅ Works |  |
 | Gravity Lab | Quest | ✅ Works |  |
@@ -57,29 +66,39 @@ Generated from [catalog/games](../catalog/games) by `scripts/compat_list.py`.
 | H.U.N.T | Quest | ✅ Works |  |
 | I Am Cat | Quest | ✅ Works |  |
 | I Am Monkey | Quest | ✅ Works |  |
+| I Expect You To Die 2 | Quest | ✅ Works |  |
 | IEYTD3 | Quest | ✅ Works |  |
 | In Death: Unchained | Quest | ✅ Works |  |
 | Into The Radius 2 | Quest | ✅ Works |  |
 | Job Simulator | Quest | ✅ Works |  |
+| Journey of the Gods | Quest | ✅ Works |  |
 | Jurassic World Aftermath Collection | Quest | ✅ Works |  |
 | Keep Talking and Nobody Explodes | Quest | ✅ Works |  |
 | Kill It With Fire VR | Quest | ✅ Works |  |
 | Ladder | Quest | ✅ Works |  |
 | Lambda1VR | Quest | ✅ Works |  |
 | LEGO® Bricktales | Quest | ✅ Works |  |
+| Lost Recipes | Quest | ✅ Works |  |
 | Lucky's Tale | Quest | ✅ Works |  |
+| Maestro | Quest | ✅ Works |  |
 | Marvel's Deadpool VR | Quest | ✅ Works |  |
 | Marvel's Iron Man VR | Quest | ✅ Works |  |
 | Max Mustard | Quest | ✅ Works |  |
 | Medieval Dynasty New Settlement | Quest | ✅ Works |  |
 | Metro Awakening | Quest | ✅ Works |  |
+| Mini Motor Racing X | Quest | ✅ Works |  |
 | Mobile Suit Gundam: Silver Phantom | Quest | ✅ Works |  |
+| Moss | Quest | ✅ Works |  |
 | Moss: Book II | Quest | ✅ Works |  |
 | Munkr Funkr (The Legacy Days) | Quest | ✅ Works |  |
 | Nano | Quest | ✅ Works |  |
+| Neko Atsume Purrfect | Quest | ✅ Works |  |
 | NEX Player | Quest | ✅ Works |  |
 | NFL PRO ERA II | Quest | ✅ Works |  |
 | NOPE CHALLENGE | Quest | ✅ Works |  |
+| Ocean Rift | Quest | ✅ Works |  |
+| Operation Wolf Returns: First Mission VR | Quest | ✅ Works |  |
+| OrbusVR | Quest | ✅ Works |  |
 | palazzo_santacruz | Quest | ✅ Works |  |
 | Path of the Warrior | Quest | ✅ Works |  |
 | Pistol Whip | Quest | ✅ Works |  |
@@ -97,9 +116,12 @@ Generated from [catalog/games](../catalog/games) by `scripts/compat_list.py`.
 | Riven | Quest | ✅ Works |  |
 | Robo Recall | Quest | ✅ Works |  |
 | RUINSMAGUS | Quest | ✅ Works |  |
+| Sclerosis | Quest | ✅ Works |  |
+| Shadow Point | Quest | ✅ Works |  |
 | Shoot The Zombirds VR | Quest | ✅ Works |  |
 | Shores of Loci | Quest | ✅ Works |  |
 | SilentSlayer | Quest | ✅ Works |  |
+| Smash Drums | Quest | ✅ Works |  |
 | Sniper Elite VR | Quest | ✅ Works |  |
 | Sniper Elite VR: Winter Warrior | Quest | ✅ Works |  |
 | Space Pirate Trainer Quest | Quest | ✅ Works |  |
@@ -112,11 +134,15 @@ Generated from [catalog/games](../catalog/games) by `scripts/compat_list.py`.
 | SUPERHOT VR | Quest | ✅ Works |  |
 | SynthRiders | Quest | ✅ Works |  |
 | Taskmaster | Quest | ✅ Works |  |
+| Tea For God | Quest | ✅ Works |  |
 | TetrisEffect | Quest | ✅ Works |  |
 | The Boys VR | Quest | ✅ Works |  |
+| The Climb | Quest | ✅ Works |  |
 | The Climb 2 | Quest | ✅ Works |  |
+| The Last Clockwinder | Quest | ✅ Works |  |
 | The Room VR | Quest | ✅ Works |  |
 | The Tale of Onogoro | Quest | ✅ Works |  |
+| The Walking Dead: Saints & Sinners | Quest | ✅ Works |  |
 | Time Crisis II VR (Test) | Quest | ✅ Works |  |
 | Time Crisis VR (Experimental) | Quest | ✅ Works |  |
 | Totally Baseball | Quest | ✅ Works |  |
@@ -128,6 +154,8 @@ Generated from [catalog/games](../catalog/games) by `scripts/compat_list.py`.
 | Vader Immortal: Episode II | Quest | ✅ Works |  |
 | Vader Immortal: Episode III | Quest | ✅ Works |  |
 | Vampire Survivors | Quest | ✅ Works |  |
+| Vendetta Forever | Quest | ✅ Works |  |
+| Vermillion | Quest | ✅ Works |  |
 | VR HOT Quest | Quest | ✅ Works |  |
 | VR4 | Quest | ✅ Works |  |
 | Walkabout Mini Golf | Quest | ✅ Works |  |
@@ -141,26 +169,34 @@ Generated from [catalog/games](../catalog/games) by `scripts/compat_list.py`.
 | Does it Stack? | Quest | ⚠️ Works with issues | Mixed reality mode does not work (works on Demeo), everything else seems to be OK |
 | Dungeons of Eternity | Quest | ⚠️ Works with issues | It can not connect to servers |
 | End Space | Quest | ⚠️ Works with issues | Controls stop responding after the first mission loads. |
+| Exploding Kittens VR | Quest | ⚠️ Works with issues | Requires online for most modes. |
 | ExploreVR | Quest | ⚠️ Works with issues | The 3D world warps and shifts with head movement (wrong perspective). |
+| FGO VR | Quest | ⚠️ Works with issues | Audio stuttering and popping sounds |
 | Fisherman | Quest | ⚠️ Works with issues | Loading screens have corruption, but everything works otherwise. |
-| Freedom | Quest | ⚠️ Works with issues | Volume can't be changed in the game. |
+| Homeworld: Vast Reaches | Quest | ⚠️ Works with issues | The game starts but after selecting to start a new game it seems to crash. |
+| Lawn Mowing Simulator VR | Quest | ⚠️ Works with issues | Left eye textures flicker only when mowing in specific areas. |
 | MacacoVR | Quest | ⚠️ Works with issues | 2d loading screens are glitchy, otherwise main gameplay is fine |
 | Majora's Mask VR | Quest | ⚠️ Works with issues | Audio on the file select screen sounds crunchy. |
 | Myst | Quest | ⚠️ Works with issues | Minor graphical glitches on some objects. |
 | Phantom: Covert Ops | Quest | ⚠️ Works with issues | DLC/store button crashes (no Meta store). |
 | Pinball FX VR | Quest | ⚠️ Works with issues | Plays; mixed reality mode not working yet. |
 | Plezy | Quest | ⚠️ Works with issues | Some videos play with strong artifacts and wrong colours; the cause is unknown, possibly hardware video decoding. |
+| Puzzling Places | Quest | ⚠️ Works with issues | Works fine, but pointers dont show well on main menu, easy to work around. |
+| Quantum Void | Quest | ⚠️ Works with issues | no hands |
+| Ragnarock | Quest | ⚠️ Works with issues |  |
+| Real VR Fishing | Quest | ⚠️ Works with issues | Seems to be almost 100% functional with meta permissions enabled. |
 | Silhouette | Quest | ⚠️ Works with issues | Hand-tracking game; the Frame synthesizes hands from controllers, so it is janky. |
+| SmartTube | Quest | ⚠️ Works with issues | Android's home screen shows for a few seconds while the app starts (normal for flat Android apps; longest on the first start after an install). |
 | Spunky Dungeon | Quest | ⚠️ Works with issues | Gear VR / Oculus Go game (32-bit only), runs through FramePort's 32-bit bridge (experimental). |
 | Swarm 2 | Quest | ⚠️ Works with issues | MSAA creates visible seams around edge geometry and also the skybox edge |
+| The 7th Guest VR | Quest | ⚠️ Works with issues | Runs and is playable. |
 | The Light Brigade | Quest | ⚠️ Works with issues | Judder in weapons |
 | The Thrill Of The Fight | Quest | ⚠️ Works with issues | Right eye doesn't draw the opponent or the referee. |
 | Time Stall | Quest | ⚠️ Works with issues | Both eyes distort during movement (unresolved). |
-| Vermillion | Quest | ⚠️ Works with issues | Runs. |
+| Vampire: The Masquerade - Justice | Quest | ⚠️ Works with issues | Game runs fine and playable, on loading there's a random sphere in the middle of the sceen. |
 | WiiCompiled VR | Quest | ⚠️ Works with issues | To add a game: in FramePort's Files tab, upload your .wcgame file to this game's storage, folder Android/data/org.wiicompiled.quest/files/WiiCompiledOpenXRVR… |
+| Deadly Delivery | Quest | ❌ Doesn't run | Quits after Meta's entitlement check fails: it needs Meta's online services. |
 | Espire 1: VR Operative (Quest Edition) | Quest | ❌ Doesn't run | Mesa GL driver crash during texture upload. |
 | GOLF+ | Quest | ❌ Doesn't run | Black screen. |
 | HITMAN 3 VR: Reloaded | Quest | ❌ Doesn't run | Vulkan driver crash (freedreno), even without Valve layers. |
-| Journey of the Gods | Quest | ❌ Doesn't run | 32-bit only; the Frame has no AArch32. |
 | Roblox | Quest | ❌ Doesn't run | Crashes on its first VR frame on the Frame. |
-| Shadow Point | Quest | ❌ Doesn't run | 32-bit only; the Frame has no AArch32. |

docs/HEURISTICS_EVAL.md

@@ -0,0 +1,83 @@
+# Evaluating patch heuristics
+
+`scripts/eval_heuristics.py` compares `engine.suggest(analysis, use_catalog=False)` with the bundled
+`catalog/games/*.yaml` entries. It does not merge personal or remote catalog recipes into the benchmark.
+It supports the original dumps command, or a precomputed `scripts/heuristics_snapshot.py` snapshot:
+
+```sh
+.venv/bin/python scripts/eval_heuristics.py '<dumps folder>' --verbose
+.venv/bin/python scripts/eval_heuristics.py --snapshot analyses.json --split all --json baseline.json
+.venv/bin/python scripts/eval_heuristics.py --snapshot analyses.json --fit-report --out fit-report.md
+```
+
+Use a scratch `FRAMEPORT_HOME`, `FRAMEPORT_NO_CATALOG_UPDATE=1`, and an empty `FRAMEPORT_WINDOWS_DATA` for offline
+measurement. Snapshot mode reads no APKs or game data. Each snapshot read copies the source to a temporary file,
+then parses the copy, retrying incomplete JSON. To compare multiple splits against an actively growing snapshot,
+freeze one valid copy first and use that file for every run.
+
+The default split is `dev`. `split_packages({package: analysis_engine})` sorts packages by SHA-256 within Unity,
+Unreal, and Other strata, then holds out the nearest 20% (half rounded up). Pass only packages with both an analysis
+and a catalog entry. The same input set always yields the same split regardless of iteration order; adding packages
+can move the cutoff. Very small strata can have no holdout. Unsupported entries participate in splitting.
+
+## What is scored
+
+Ground truth contains catalog choices and patch registry defaults, with no inherited heuristic adapter settings.
+Default expectations are determined per analysis, using each default patch's own detection in the same way as the
+engine's initial heuristic pass. Thus a conditional default that is not detected (e.g. LTW on a game without LTW)
+is not expected. Explicit catalog `overport_remove` and `frame_remove` entries remove expected defaults. An absent
+expected default is represented as `remove:<patch id>`; enabled defaults do not inflate patch scores.
+
+Opt-in overport/frame/device/PC VR IDs, default removals, adapter values, device-file names, foveation parameters,
+and alternate-build patch IDs are compared. Alternate-build identities use `alt:<patch id>` so choosing one in a
+fallback is distinct from choosing it in the primary build. Device-file content is not compared. Adapter values
+must match: a wrong value contributes both an FP and an FN for `adapter.<key>`. Patch precision, recall and F1 are
+micro-averaged across games; an empty denominator is reported as zero. Exact-game accuracy also compares the
+unsupported status flag. Fields report matching games, including empty-field matches.
+
+`RUNTIME_ONLY` lists choices excluded from the headline: `use_alt`, selected runtime adapter settings, Lepton
+environment variables, and config-sync settings. They have their own exact, field and patch metrics. Catalog
+entries with status `unsupported` are excluded from both headline and runtime supported-game metrics, and have
+separate metrics and per-game diffs. Converted analyses are included and marked. JSON contains all metrics per
+engine, all game signatures, split assignments, and missing/extra decisions.
+
+## Dated score: catalog gaps vs. detection errors
+
+The strict score treats the catalog as complete, but older entries were verified before many patches existed, and
+a catalog recipe inherits every heuristic adapter setting and device patch (except `device.text_input_window`)
+without listing them (`engine.suggest`), so the verified build had those. The dated score (`headline_dated`, printed
+under "Dated") sets aside, on both sides:
+
+- patches first committed after the entry's `verified.date` (the verifier couldn't have chosen them), and
+- inherited adapter/device picks (`inherited_decisions`).
+
+What remains are real disagreements: an extra on an entry verified after the patch existed, or a catalog choice
+the heuristics don't make. Gaps are counted per patch ("Catalog gaps by patch"). The dated score needs the intro
+date cache that `--fit-report` writes; without it only inherited picks are set aside.
+
+Before tuning a rule to remove an "extra", check which kind it is: a gap on an old entry is a candidate for the
+catalog (fit report), not a detection error. Before adding a patch to a working entry, weigh its benefit (does it
+fix something the game hits?) against a rebuild prompt for everyone who installed it; adapter settings never need
+adding (inherited). Results 2026-10-15: strict 5/65 exact, F1 73.8%; dated 39/65, F1 88.6% (dev 90.5%, holdout
+79.5%). Remaining misses are one-game fixes found at runtime (e.g. Vader's gl_error_clear, BlazeRush's GL settings).
+
+An evaluation writes JSON even when its headline has differences, then exits 1 for compatibility with the original
+script. It exits 0 when exact, or after producing a fit report.
+
+## New patch fit
+
+The fit report covers all catalog entries, independently of `--split`. Candidates come from the final heuristic
+recipe, preserving platform, flat-app, dependency, and 32-bit normalization rules. A candidate must also be opt-in,
+applicable and recommended by its own `detect()`. Entries already listing or explicitly removing the patch are
+excluded; a listed adapter key is excluded regardless of its value. This report proposes additions, not value edits.
+
+Each candidate includes its reason, experimental/strict flags, first local git introduction date, catalog entry
+date (`verified.date`; `updated` only without one, since it also moves for unrelated edits), and whether the
+patch is newer. Unknown dates are marked unknown. Warnings
+come from the full catalog recipe plus that one candidate; they may include pre-existing conflicts. Missing-analysis
+entries appear as metadata-only rows. Intro dates, including unknown results, are cached in
+`patch-intro-dates.json` beside the snapshot (or dumps folder); subsequent runs only query uncached patch IDs.
+
+`tests/test_eval_heuristics.py` uses synthetic data. The opt-in real-dump test in `tests/test_games.py` ratchets the
+supported all-split exact ratio and patch F1 against measured, rounded-down baseline constants. Machine-local
+`.eval-home/` and `.eval-results/` scratch outputs are ignored by git.

docs/INSTALL.md

@@ -167,6 +167,11 @@ FramePort downloads it, checks it, restarts and keeps your games and settings. *
 - Settings → **Updates** turns the check off or turns on **Install updates automatically**.
 - **Recipes** (the tested patches and settings for each game) update by themselves. A game whose recipe changed shows
   **Update on Frame**.
+- **Moved your games?** Scan the new folder (or **Rescan folders**): games found there whose old files are gone keep their library entry, name, artwork, tags and settings, and only their location changes. **Settings → Library folders** lists the folders FramePort scans; remove the old one there (the games stay). See the [FAQ](FAQ.md#i-moved-my-games-to-another-folder-or-drive-how-do-i-update-the-library).
+- **A newer version of a game:** right-click it (or use **…** on its page) → **Update with a newer APK…** (Quest and
+  Android games) or **Update with a newer version…** (Linux apps: the new AppImage, archive or folder; PC VR games:
+  the new game folder). Its name, artwork, tags and your settings stay. Then click **Update on Frame** (or **on this
+  PC**).
 - **Dev builds:** if you're asked to test a change before its release, use Settings → Updates → **Install the latest
   dev build…**. The next release then arrives as a normal update.
 
@@ -216,6 +221,14 @@ The **Files** tab copies files between your PC and the Frame: videos, documents,
   `/sdcard/Download`, `/sdcard/Documents`).
 - **Game storage** holds each game's own files. A game's menu → **Add videos and files…** opens it.
 
+## Backing up saves
+
+Steam doesn't sync Quest games' saves. A game's menu (**…** on its page) → **Saves** → **Back up saves** copies them
+to your PC (close the game first); **Back up all saves** on the Steam Frame page does every installed Quest game.
+**Restore saves…** puts a backup back on the Frame and keeps a copy of the replaced saves there (**Undo last
+restore**). Backups live in FramePort's data folder under `save-backups/`; the 10 newest per game are kept (Settings →
+Data). Caches and large downloaded content stay out. More in the [FAQ](FAQ.md#can-i-back-up-a-games-saves).
+
 ## Share a recipe or report a problem
 
 - **Share working recipe…** (in the game's menu) opens a GitHub issue with the game's recipe filled in. Accepted
@@ -254,12 +267,15 @@ option. The main ones:
 | Command | What it does |
 |---|---|
 | `scan <folder>` / `list` / `show <game>` | add games, list the library, show a game's patches |
+| `folders [--add <folder>] [--remove <folder>]` / `rescan` | list the library folders, add or remove one (its games stay); scan them again for new and moved games |
 | `add-linux <path> [--exe <program>]` | add a Linux app (AppImage, folder or archive) |
+| `new-version <game> <path>` | point a game at its newer version (APK, Linux app file/folder, PC VR game folder) |
 | `recipe <game> --enable/--disable <patch>` | change a game's patches (`patches` lists them all) |
 | `build <game>` / `install <game>` / `test <game>` | build, install on the Frame (`--to pc` for this PC), launch test |
 | `frame discover` / `frame connect` / `frame info` | find, connect to and describe the Frame |
 | `frame send <files> --dest videos` / `frame storage` / `frame cleanup` | copy files to the Frame, list where they can go, free space |
 | `frame drives` / `frame move <game> --to <drive>` / `install --dest <drive>` | list the Frame's drives, move a game, install to a drive |
+| `saves backup <game>\|--all` / `saves list <game>` / `saves restore <game> [n]` / `saves undo <game>` | back up Quest games' saves to this PC, restore one, undo the last restore |
 | `tools status` / `tools install` | the tools FramePort downloads |
 | `open-link "<link>"` | install from an install button's address or a download link (`--yes`, `--no-install`) |
 | `diag report <game>` / `share-recipe <game>` | report a problem / share a working recipe |

docs/INSTALL_BUTTON.md

@@ -45,6 +45,7 @@ The manifest:
 {
   "schema": "framedrop.install/v1",
   "name": "My Game",
+  "version": "1.4.2",
   "files": [{ "url": "https://example.com/my-game.apk", "sha256": "<64 hex digits>" }],
   "frameport": { "description": "One sentence about the game.", "icon": "https://example.com/icon.png" }
 }
@@ -54,6 +55,13 @@ The manifest:
 against it. The `frameport` object is optional; its icon and description are shown in the
 install question. Only public `https://` addresses are accepted.
 
+`version` is optional (it can also go inside the `frameport` object) and makes updates possible: FramePort remembers
+the manifest's address and version, fetches the manifest again at start (at most every 6 hours) and, when its
+`version` is newer, offers to download and install the update (Library bar and the game's page; CLI
+`frameport link-updates [--install]`). Keep the manifest at the same address and raise `version` with every build.
+Versions compare number by number (`1.10` > `1.9`), and a suffix sorts before the plain release (`1.2.0-beta2` <
+`1.2.0`). Bare file links (`?url=…`) and manifests without a version are never checked.
+
 To build a link from Python: `frameport.deeplink.make_link(manifest_url="https://…/my-game.json")`.
 
 ## On a website

docs/PC_ANDROID.md

@@ -1,470 +0,0 @@
-# Quest games on this PC (AXRB)
-
-FramePort's PC target ("This PC") already runs Oculus Rift games through Revive. For Quest/Android games it uses
-**AXRB** (Android XR Bridge, github.com/Android-XR-Bridge/AXRB): an Android 16 emulator (x86_64 Google APIs image,
-WHPX) that runs arm64 games through Android's ARM translation (`libndk_translation`), with AXRB's own OpenXR runtime
-inside Android and a Windows host process (`axrb-host-bridge.exe`) that opens a real OpenXR session on the PC's
-runtime (SteamVR, Virtual Desktop, ...). FramePort only drives it: it downloads AXRB's official release when a user
-first installs a Quest game on the PC, never bundles or modifies it (AXRB's host/clock code is under the AXRB
-Source-Available License 1.0, which allows running it and interoperating through its public interfaces).
-
-Status: **experimental**. AXRB is young (v1.0.4, 2026-10-06) and many games still fail in it; Steam Frame
-controllers don't work in AXRB yet (AXRB issue #20).
-
-## Two backends: the emulator (1.0.4) and direct mode (2.x, "AXRB-Emulatorless")
-
-AXRB's main branch (2026-10-15, launcher 2.0.0) became **AXRB-Emulatorless**: a separate program (own installer,
-app id `org.axrb.emulatorless`, `%LOCALAPPDATA%\Programs\axrb-emulatorless-launcher`, runtime
-`%LOCALAPPDATA%\AXRB-Emulatorless Runtime`, profile `%APPDATA%\AXRB-Emulatorless`) whose **direct mode** runs the
-game without an emulator: `axrb-direct.exe` translates the game's arm64 code (Dynarmic JIT; Digitalis optional) and
-runs the real AOSP ART + framework from Google's Android 16 arm64 system image, with its own Linux syscall/Binder
-layer; Vulkan goes to the Windows driver, frames and tracking through the same `axrb-host-bridge.exe`. **Vulkan only:**
-its EGL is a stub, there is no GLES renderer. Both programs can be installed side by side; FramePort keeps one
-`axrb.Install` record per backend (`backend`, `version`, app folder, AXRB's root = `resources\runtime`, runtime
-folder) and picks per game:
-
-- **Choice** (`targets/pc_android.choose_backend`): `--axrb-backend direct|emulator` on `frameport install --to pc`,
-  else the recipe's `pc.axrb_backend` (device category, `on_pc`: part of the PC build's selection, no-op on the
-  Frame), else **direct for `graphics` Vulkan, emulator for GLES / unknown**. Unreal games never declare
-  `android.hardware.vulkan`; since analysis version 20 their manifest meta-data
-  `com.epicgames.{ue4,unreal}.GameActivity.bSupportsVulkan` = true makes them "Vulkan (Unreal bSupportsVulkan)"
-  (UE 4.25+ Quest builds, e.g. Deadpool VR, Pinball FX VR, Myst; false or missing = GLES: Espire 1, Vader Immortal). `deployment.json` records `backend`
-  and the launcher `flags`; installs from before have none (= emulator). Switching leaves the other backend's copy
-  and saves alone.
-- **Per-game options** (`pc.axrb_backend` params → `run_direct_game.ps1` switches): `translator` (`dynarmic` =
-  AXRB's default, `digitalis`), `precompose` (`-PrecomposeProjectionLayers`, also for the emulator's
-  `run_windows_game.ps1`; also taken from AXRB's own `core/game-compatibility.json` profile for the game, e.g. The
-  Climb 2), `legacy_oculus_driver` / `quest_identity` / `controllers_only` (for unconverted store APKs with older
-  Oculus loaders; off by default and never taken from AXRB's profiles: FramePort always hands AXRB an OVRPort build;
-  `controllers_only` only works with the legacy driver, as `prepare_art_session.py` requires).
-- **Install/upgrade** (`tools/axrb.install`): `releases/latest` when it has the backend's installer
-  (`AXRB-Setup-*.exe` / `AXRB-Emulatorless-Setup-*.exe`, SHA256SUMS checked, `/S`), else the known-good release
-  (`KNOWN_GOOD = {"emulator": "1.0.4"}`, `releases/tags/v1.0.4`). An install older than the known-good one is
-  upgraded on use; `frameport pc install-axrb --backend … --update` upgrades to the release on offer. No 2.x release
-  is published yet: **`FRAMEPORT_AXRB_DIRECT_DIR`** names a local build (AXRB's source tree after
-  `scripts\build\build_direct.ps1` + the host build, its `out\direct`, or a folder laid out like the installed
-  `resources\runtime`): it needs the files of AXRB's `core/direct-runtime-files.cjs` (`out\direct\axrb-direct.exe`,
-  `art\axrb-bootstrap.dex`, `art\lib64\*`, `guest\lib64\*`, `guest\axrb-systemdriver.apk`) plus
-  `scripts\run\run_direct_game.ps1`, `scripts\run\stop_game.ps1`, `scripts\paths.ps1`,
-  `direct\tools\make_sysroot.py`, `direct\tools\prepare_art_session.py`, `out\host\bin\Release\axrb-host-bridge.exe`
-  (+ `openxr_loader.dll`, `out\gpu\Release` for the GPU-share layer) and ideally `tools\python` (else Python from
-  PATH). A local build is set up but never replaced. `FRAMEPORT_AXRB_DIRECT_RUNTIME` overrides the runtime folder
-  (default: the launcher's `library.json` `settings.managedDirectory`, else `%LOCALAPPDATA%\AXRB-Emulatorless Runtime`).
-- **Direct setup** (`axrb.setup_direct`, what `core/direct.mjs ensureDirectSystem` does): the pinned image
-  (`arm64-v8a-36_r02.zip`, 810,736,863 bytes, SHA-1 `62ad6714…`; values read from the installed `core/direct.mjs`,
-  only `dl.google.com`) into its own empty folder, AXRB's `make_sysroot.py <zip> <runtime>\direct\sysroot.new --art`
-  with AXRB's embedded Python, receipt `.axrb-sysroot.json` `{"digest","format"}`, rename to `sysroot`, archive
-  deleted; `license-acceptance.json` like AXRB's DirectSetup. Ready = receipt matches + the key files exist and
-  aren't empty + AXRB's direct files complete. Requirements: ≥ 6 GB RAM, `vulkan-1.dll` (no hypervisor, no GPU
-  vendor gate).
-- **Direct install** (no adb): the PC build is copied to `%LOCALAPPDATA%\FramePort\axrb\games\<pkg>\<pkg>.apk`
-  (FramePort removes its converted copies after an install; `FRAMEPORT_AXRB_LAUNCHER_DIR` moves FramePort's `axrb`
-  folder, for isolated `FRAMEPORT_HOME` runs), the launch activity comes from the APK's manifest
-  (`axml.launcher_activity`, `pkg/fully.qualified.Class`), the data files become AXRB's content list `assets.txt`
-  (`Android/obb/<pkg>/<file>\t<Windows path>`, read-only mounts of the files where they are; WSL-only folders, which
-  Windows reads only through `\\wsl$`, are copied next to the APK). AXRB's `prepare_art_session.py` turns every
-  content file into one `--mount-ro` argument of `axrb-direct.exe` (with the path resolved: junctions and 8.3 names
-  don't shorten it), and Batman's 90 files from a long dump folder made a 32,876-character command line (Windows'
-  limit is 32,767: "The filename or extension is too long"). A list over 25,000 characters therefore goes through
-  hard links in `games\<pkg>\content` (no extra space; only on the drive FramePort's folder is on), else the install
-  stops with a clear message. App data and saves: `<runtime>\direct\data\data\<pkg>` and
-  `direct\sdcard\Android\data\<pkg>`.
-- **Play**: Steam shortcut → `%LOCALAPPDATA%\FramePort\axrb\fp-axrb-direct.ps1 -Package … -Activity … [flags]` →
-  sets `AXRB_DATA_HOME=<runtime>\output` (as AXRB's launcher does) → AXRB's `run_direct_game.ps1 -Apk -Package
-  -Activity -GameName -Executable <root>\out\direct\axrb-direct.exe -DataDirectory <runtime>\direct -Sysroot
-  <runtime>\direct\sysroot [-AssetList] -Translator …`. Exit 4 = host lost.
-- **Launch test**: watches `direct.out` for `AXRB_AOSP_ACTIVITY_CREATED` / `AXRB_AOSP_LIFECYCLE` (5 min for ART's
-  interpreted first start), runs, then stops through AXRB's `stop_game.ps1 -ParentPid` (closes the bridge window;
-  the run script lets the game pause/stop/save). Logs `<runtime>\output\logs\game\{direct.out, direct.err,
-  direct.log, host.err, host.log, session.json}` (diagnostics: `axrb/direct/*`); triage signatures
-  `axrb-direct-*` and milestones ART started → activity created → OpenXR → Vulkan device (`catalog/triage.yaml`).
-
-**Tested end to end with a local build** (2026-10-15, AXRB `windows-android16` @ 59626ac built on the dev PC,
-`FRAMEPORT_AXRB_DIRECT_DIR` = its staged `runtime\`, the staged sysroot reached through a junction
-`<FRAMEPORT_AXRB_DIRECT_RUNTIME>\direct\sysroot`; Monado's simulated HMD, see below): scan → PC build → direct
-install → `frameport test --to pc --sim --axrb-backend direct` → launcher → AXRB's run script → bridge + runner →
-milestones → AXRB's Stop. Still untested: the 2.x NSIS installer (no release yet), `setup_direct`'s download +
-`make_sysroot.py` path, the upgrade of an installed 1.0.x, AXRB's launcher seeing FramePort-set-up runtimes.
-
-### Direct-mode results (2026-10-15, Monado simulated HMD at 72 Hz, Dynarmic, no headset)
-
-PC build = the catalog recipe's PC selection (OVRPort's patches + `on_pc` fixes + FrameBridge with `focus_hold=0`),
-no `pc.axrb_backend` options. "fps" = AXRB.Perf `end-frame` (game) / `host-fresh-submit` (bridge → Monado), the
-median of the last summaries. What is drawn was judged from Monado's window and AXRB's layer captures.
-
-| Game (engine, graphics) | Reached | fps | Picture | Blocker / notes |
-|---|---|---|---|---|
-| Batman: Arkham Shadow 1.4.1-350961 (Unity, Vulkan; 90 content files, 27 GB) | menu (SELECT REGION) in ~25 s | 63.7 / 62.9 | stereo menu over the Batcave scene, both eyes correct | none; needed the content-list fix (command line overflow) and hard links; stop clean (activities stopped) |
-| PowerWash Simulator VR 2.5.0 (Unity 2020.3, Vulkan) | in game: the garage hub (~3-4 min; at 90 s still its loading logo) | 70.5 / 69.8 | garage in both eyes, both hands drawn at the simulated controllers | none; Meta multiplayer callbacks throw NullReferenceExceptions (no Meta services, harmless so far) |
-| LEGO Bricktales 2.1 (Unity, Vulkan, URP) | scene `Diorama_Hub_Startup` loaded (~3 min) | 72 / 72 | intro text panel ("You want to free the simulation? Follow the white rabbit.") on black, both eyes | stop slow: the game didn't finish its activity shutdown in 25 s (`axrb-direct-slow-stop`); Meta achievements fail (no Meta services, harmless) |
-| Toy Master 1.1.2 (Unity 2022.3, **GLES**) | activity created, then crash in 18 s | - | - | not a Vulkan game: "Vulkan (Unity boot.config)" came from the Oculus plugin's `xr-vulkan-*` keys; Unity: "Unable to retrieve the default EGL display!" + SIGTRAP. Automatic choice now sends such games to the emulator |
-| Marvel's Deadpool VR 1.0.40 (UE 4.27, Vulkan; `frame.vk_sanitize` in the build) | first-run LANGUAGE menu (~3 min; at 90 s still loading at 1-2 fps) | 64 (FrameBridge pacing) | game-drawn stereo menu, both eyes | none; AXRB transcodes ASTC to BC on the GPU; stop slow (`axrb-direct-slow-stop`) |
-| Pinball FX VR 1.9 (UE 5.3, Vulkan, 7 GB OBB) | 3D lobby with the Terms & Conditions panel (~4 min) | ~60 (FrameBridge pacing) | arcade hall + panel in both eyes | none of the emulator's blockers (gfxstream `vkAllocateMemory` SIGSEGV, and Refract's FRSQRTE SIGILL / ASTC layout probe / promoted extension names) showed up in direct mode (no SIGILL under Dynarmic, no ASTC or device-loss failure; AXRB stores ASTC as BC); OVRPlugin's xrPerfSettingsSetPerformanceLevelEXT unsupported (harmless) |
-| Myst 3.3.0 (UE 5.3, Vulkan) | loading screen (book), then its starfield intro | 72 | stereo, both eyes | a white splash quad at first (texture not shown yet), then normal |
-| Metro Awakening 1.0-916944 (UE 5.2, Vulkan) | splash art, then the USER DATA COLLECTION consent screen with the laser pointer | 72 | stereo, both eyes | stop slow (`axrb-direct-slow-stop`) |
-
-Unreal Vulkan games: before analysis version 20 every Unreal game was "GLES or unknown" (Unreal never declares
-`android.hardware.vulkan`), so the automatic choice sent them to the emulator; now `GameActivity.bSupportsVulkan`
-picks direct mode (Myst and Metro above were installed without `--axrb-backend`). Unreal probes EGL before it
-creates its Vulkan device, which tripped `axrb-direct-no-gles`; the signature now needs no Vulkan device. None of
-the four needed a recipe change for the PC.
-
-Integration bugs found and fixed on the way: AXRB's trap message never reached FramePort's log; the content list
-overflowed the command line (Batman); Unity's EGL failure and SIGTRAP weren't triaged; long sessions lost their
-start-up milestones; the boot.config Vulkan label picked direct mode for GLES games. Open, AXRB's side: the content
-list should reach `axrb-direct.exe` as a file (FramePort's hard links only work when the data is on the drive of
-FramePort's folder; drafted as an upstream issue). Needs a headset: picture and latency through SteamVR, sound,
-controllers (the simulated ones hold still), Batman beyond its region menu.
-
-### VrApi-direct games (2026-10-16, direct mode, Monado simulated HMD, Dynarmic, no headset)
-
-Games whose engine calls VrApi itself (no OVRPlugin), so OVRPort can't translate them: they need a `libvrapi.so`
-that translates VrApi to OpenXR. Two candidates: FramePort's `frame.vrapi_bridge` (OVRPort's translator + FramePort's
-changes) and OVRPort's own `patch_vrapi_openxr` (the unpatched translator; only in experimental CLI builds made with
-`-PwithVrApi=true`, e.g. the `OVRPort-CLI-1.2.5-experimental-5e7df52.jar` AXRB's v1.0.0/1.0.1 releases attached;
-AXRB's own profile for The Climb 2 uses it with `-PrecomposeProjectionLayers`). Only converted copies of both games
-were at hand, so the comparison swapped the one file (OVRPort's = the v1.2.5 build from the 2026-10-02 Frame tests).
-
-| Game (engine, graphics) | VrApi route | Reached | fps | Picture | Blocker / notes |
-|---|---|---|---|---|---|
-| The Climb 2 2.2 (CryEngine, Vulkan VrApi) | FramePort's bridge | first-start menu (gender/skin selection) in ~60 s | 69.8 / 69.8 | menu, both hands and controllers, both eyes (AXRB layer captures + Monado's window) | needs AXRB's HostWindow fix (below, AXRB's side) + `frame.vk_android_extensions`; crash only during AXRB's stop (forgiven by triage); no `-PrecomposeProjectionLayers` needed |
-| The Climb 2 2.2 | OVRPort's translator | the same menu | 70.2 / 70.2 | identical | same blockers; passes AXRB's AHB device-extension request through unchanged (worked only because `libfp_vkext.so` lists AHB) |
-| Path of the Warrior (own engine, **GLES** VrApi) | - | not run | - | - | GLES: direct mode can't run it; the emulator (1.0.4) had a copy signed with another key installed by another test, so it wasn't replaced. OVRPort's translator can't run it anywhere (no GLES path: `cannot locate symbol "vrapi_GetTextureSwapChainHandle"`, Frame test 2026-10-02); FramePort's bridge has one |
-
-**Default for PC builds: FramePort's bridge** (`frame.vrapi_bridge`, now `on_pc = True`; recipes keep it as they
-are, nothing to switch). Both translators give the same picture and frame rate in direct mode, but OVRPort's needs
-an unpublished experimental CLI (stable jars list `patch_vrapi_openxr` but fail), has no GLES path (POTW, every GLES
-VrApi game on the emulator) and lacks the device-extension filter; FramePort's is the same code the Frame builds
-use, so one recipe serves both.
-
-Blockers found on the way (in order):
-1. **No window for NativeActivity** (AXRB's side, drafted upstream): CryEngine's `EngineActivity` takes its surface
-   with `Window.takeSurface`; direct mode's `HostWindow.attach` only bridges SurfaceViews (`AXRB_AOSP_HOST_SURFACES
-   0`), so `APP_CMD_INIT_WINDOW` never comes and the game waits after `Loading plug-in CryHTTP` (triage
-   `axrb-direct-no-native-window`). A ~40-line HostWindow patch (`mTakeSurfaceCallback` → `registerSurface` +
-   `surfaceCreated/Changed`, bootstrap dex rebuilt with AXRB's `build_art_bootstrap.py` into a test copy of the
-   local build) fixed it. Likely the same for every NativeActivity engine.
-2. **Quest Vulkan device extensions**: CryEngine checks its list before vkCreateDevice and gave up
-   (`CrySystem initialization failed!`): AXRB's runtime asks for `VK_ANDROID_external_memory_android_hardware_buffer`
-   also in direct mode, and the game requires `VK_EXT_fragment_density_map` (NVIDIA's Windows driver has neither).
-   The bridge now leaves runtime extensions no device offers out; `frame.vk_android_extensions` lists the missing
-   Quest ones to the renderer (AXRB drops them at vkCreateDevice). Triage `axrb-direct-vulkan-extensions`.
-3. **Simulator only**: Monado's head lacks POSITION_TRACKED, so AXRB's host never made its LOCAL origin and the
-   bridge never got a tracked head (empty frames, `initial recenter: head flags=0x0`) → `--sim` sets AXRB's
-   `AXRB_TEST_SYNTHETIC_HMD=2`.
-4. The analysis called The Climb 2 "GLES or unknown" (no manifest declaration) → analysis 20: engines importing
-   `vrapi_CreateSystemVulkan` are "Vulkan (VrApi Vulkan system)", so it goes to direct mode automatically.
-
-Debugging aid: `FRAMEPORT_AXRB_TEST_ENV="AXRB_DIRECT_TRACE=syscall,vulkan;AXRB_CAPTURE_FIRST_SEQUENCE=4500"` passes
-variables to a launch test's AXRB processes (`AXRB_DIRECT_DUMP` only works in AXRB's own VM mode, not with ART).
-Needs a headset: the picture through SteamVR, controllers past the first menu (the simulated ones hold still),
-climbing, sound; and a released AXRB-Emulatorless with the window fix.
-
-### Library sweep 2026-10-16
-
-Every other Quest game of the owner's library that `pipeline.pc_installable` accepts and whose APK still exists,
-installed with `frameport install <pkg> --to pc --no-library` (automatic backend, isolated `FRAMEPORT_HOME`, catalog
-recipe or heuristics, no per-game changes) and tested with `frameport test <pkg> --to pc --sim --seconds 150` (240 for
-Unreal) under Monado's simulated HMD at 72 Hz. Direct mode = the local AXRB build of 59626ac **with the HostWindow
-patch** (above; upstream had no newer commit or 2.x release on 2026-10-16); emulator = AXRB 1.0.4 with this branch's
-`adb install -g`, `projection_only=2` and qwerty-head fixes. "fps" = game submits / bridge to Monado (AXRB.Perf
-medians); "Picture" = Monado's window (both eyes) at the end of the run, plus AXRB's layer captures. Not run: the
-three 32-bit-only games (Sports Scramble, Shadow Point, Journey of the Gods: AXRB has no AArch32, and the PC build
-drops the 32-bit bridge), and the emulator games after NEX Player (disk, see the end).
-
-| Game (engine) | Backend | Reached | fps | Picture | Blocker / notes |
-|---|---|---|---|---|---|
-| Arcsmith 1.128 (Unity) | direct | frames | 59 / 51.7 | in game: the workshop, both hands with tools, both eyes | none |
-| QuestCraft 6.0.0-RC4 (Unity) | direct | frames | 65.1 / 63.6 | launcher room, QuestCraft EULA panel, laser pointers | none (Minecraft itself is behind its Continue button) |
-| BattleGlide 0.4.1 (UE) | direct | frames | 62.2 / 54.8 | title screen (START), both hands | none |
-| In Death: Unchained 1.8.0 (UE) | direct | frames | 64.1 / 56.9 | sky + PRIVACY UPDATE panel | none |
-| The Boys VR 1.1.0 (Unity) | direct | frames | 62.4 / 59.9 | ANALYTICS DISCLAIMER panel over a lit floor, laser | slow stop |
-| Creed: Rise to Glory CE (UE) | direct | frames | 60.6 / 55.5 | IMPORTANT SAFETY INFORMATION panel, both hands, laser | none |
-| Wallace & Gromit: The Grand Getaway 1.0.34 (UE) | direct | frames | 61.5 / 53.5 | space scene (nebula, planets), both gloved hands | none |
-| VR4 2.3 (UE) | direct | frames | 71.9 / 72 | title scene: church interior, "resident evil 4" logo, both hands | none (slow stop) |
-| Demeter 1.1.0 (Unity, MR) | direct | frames, FrameBridge scene emulation active | 62.3 / 57.3 | "PERMISSION REQUIRED ... access to your spatial data" panel, controllers | AXRB's direct mode grants only 8 allow-listed permissions (`HostPackageManager.permission`): `com.oculus.permission.USE_SCENE` stays denied although the build declares it (`frame.meta_permissions`). AXRB's side |
-| Green Hell VR 2.5.2 (Unity) | direct | frames | 11.8 / 11.7 | loading screen at "50%" after 180 s | slow load |
-| TRIANGLE STRATEGY 1.0 (UE) | direct | frames | 44.6 / 40.2 | both controllers with a "Control Guide" label, rest black at 280 s | still loading? |
-| Riven 1.9.0 (UE) | direct | frames | 29.8 / 25.2 | white splash quad (AXRB captures), black window at 274 s | still loading (as Myst's white splash) |
-| Espire 2 1.7.13 (UE) | direct | frames | 72 / 71.8 | white splash quad low in both eyes at 289 s | splash texture never shown |
-| Carve Snowboarding 1.09 (UE) | direct | frames | 64.5 / 59.3 | both hands, rest black at 270 s | scene never appears; not diagnosed |
-| Asgard's Wrath 2 12.1 (UE, 33 GB) | direct | frames | 30.6 / 21.9 | black at 287 s | still loading |
-| Assassin's Creed Nexus 207706 (Unity) | direct | frames | 42.6 / 42.6 | black at 180 s (captures too) | loading or no visible layer yet |
-| BARTENDER VR SIMULATOR 1.9.2.7 (UE) | direct | frames (in a second process) | 62.7 / 53.6 | black for 260 s (window + captures all 0) | not diagnosed (no Unreal log lines in direct.log) |
-| Vermillion 1.7.2 (Unity) | direct | frames, OVRManager focused | 63.8 / 60.3 | black with its brush loading icon | stays there (Vuplex 3D WebView starts, then nothing) |
-| H.U.N.T 0.1.2 (Unity OpenXR) | direct | session created, no frame in 200 s | - | bridge splash | never submits a frame; not diagnosed |
-| WiiCompiled VR 0.4.0 | direct | 2D launcher activity, no OpenXR | - | bridge splash | its launcher imports games through a document picker; the VR part is a second activity |
-| Medieval Dynasty New Settlement 2.4 (Unity) | direct | OpenXR FOCUSED, exit(1) at 30 s | - | - | **opens an Android Dialog** (right after "initOculus Java!"); direct mode can't add a second window (`UnsupportedOperationException: addToDisplayAsUser`, "Adding window failed"). Triage `axrb-direct-dialog-window` |
-| Under Cover 1.1.3r2 (Unity) | direct | Vulkan device, exit(1) at 33 s | - | - | the same Dialog |
-| Of Lies and Rain 1.1.0 (UE) | direct | vkCreateInstance, exit(1) at 32 s | - | - | Unreal's `MessageBox01` (an error box before its Vulkan device; its text is lost with the window) |
-| NOPE CHALLENGE 1.0.964 (UE) | direct | ART, crash at 15 s | - | - | Google Play services call `IActivityManager.getMyMemoryState`: `AXRB_SERVICE_UNIMPLEMENTED` -> uncaught exception. Triage `axrb-direct-unimplemented-service` |
-| BAM 1.2 (Unity) | direct (manifest declares Vulkan) | activity, crash at 33 s | - | - | runs GLES: "Unable to retrieve the default EGL display!"; the manifest's Vulkan feature doesn't say which API Unity picks first. Emulator run not reached |
-| Mobile Suit Gundam: Silver Phantom 1.1.58 (Unity) | direct | install refused | - | - | 257 content files with ~80-character names don't fit axrb-direct.exe's command line even through hard links (the guest paths alone are too long); needs AXRB to read the list from a file or mount the folder. Emulator run not reached |
-| Silhouette 1.3.0 (Unity) | emulator | frames | 30.2 / 30.1 | title menu (Play / Options / Quit), both eyes | none headless |
-| Yupitergrad 2.6.1 (Unity) | emulator | frames | 13.8 / 14 | splash ("Loading...") in both eyes | still loading at 174 s |
-| 4XVR Video Player 2.0.22 | emulator | frames | 34.9 / 32.2 | black | gfxstream rejects its GL every frame: `glEnable(GL_FRAMEBUFFER_SRGB_EXT)`, a `glTexParameteri` value, vertex attribute index >= `CODEC_MAX_VERTEX_ATTRIBUTES` |
-| NEX Player 1.3.1 (Unity) | emulator | frames | 9.3 / 9.3 | black | not diagnosed |
-| Lambda1VR 1.7.3 (Team Beef) | emulator | Java crash at start | - | - | `libopenxr_loader_google.so not found`: TBXR ports load `openxr_loader_<Build.MANUFACTURER>`; `frame.tbxr_vendor` handles "valve" and isn't in PC builds; AXRB's Android says "google" (a PC variant: add that library and match "google" in the maker checks) |
-
-Summary (31 games run): **8 reach a menu or the game in both eyes** in direct mode (Arcsmith in game; QuestCraft,
-BattleGlide, In Death, The Boys, Creed, Wallace & Gromit, VR4 at their first menu/panel) and 1 in the emulator
-(Silhouette); Demeter shows its own "permission required" panel; 12 submit frames but were still loading or black at
-the end of the run (big Unreal games at 30-45 fps while loading under Dynarmic); 9 never submit a frame. The most
-common blockers, all on AXRB's side:
-1. **No second window in direct mode** (3 games: Medieval Dynasty, Under Cover, Of Lies and Rain): any Android
-   Dialog ends the game. Upstream candidate together with the permission allow-list (Demeter's `USE_SCENE`) and the
-   unimplemented framework calls (Play services' `getMyMemoryState`, NOPE).
-2. **Long or loading-heavy starts**: under Dynarmic the large Unreal games need more than 4-5 minutes to their first
-   picture (Riven, Asgard's Wrath 2, TRIANGLE STRATEGY, Espire 2's white splash); a longer `--seconds` would show more.
-3. **The content list on the command line** (Gundam): a list file or folder mounts in `axrb-direct.exe` would fix it
-   for good (drafted upstream).
-4. GLES-in-direct-mode mislabels: a Unity manifest that declares Vulkan can still run GLES (BAM).
-
-FramePort changes from the sweep: triage `axrb-direct-dialog-window` and `axrb-direct-unimplemented-service`
-(`axrb-direct-no-gles` no longer blames Unreal's EGL probe when one of those ended the game first); the
-command-line message suggests the emulator; and **direct-mode uninstalls and reinstalls remove the libraries AXRB's
-`prepare_art_session.py` extracts per APK** into `<runtime>\direct\installed\<identity>`, which AXRB never deletes
-(5 GB after 25 games; `pc_android.staged_libraries` computes AXRB's identity: the APK's Windows path + every
-`lib/arm64-v8a` entry's name, CRC and size; unit-tested, not yet seen on a real uninstall).
-
-The emulator half stopped after NEX Player: the WSL disk and C: filled up (other jobs; C: 14 GB free, below the 60
-GB the sweep keeps), so the remaining emulator games were not run: The Room VR, Pixel Ripped 1995, Time Stall, Five
-Nights at Freddy's: HW, Star Wars Pinball VR, I Am Cat, Vader Immortal 1-3, Genotype, Phantom: Covert Ops, Sniper Elite
-VR (+ Winter Warrior), Robo Recall, Budget Cuts Ultimate, Espire 1, BodyCombat, Star Wars: Tales from the Galaxy's
-Edge, HITMAN 3, Jurassic World Aftermath, Nano, Wander, Stremio, Eleven Table Tennis, BlazeRush, plus BAM and Gundam
-in the emulator.
-
-## Spike results (2026-10-10, Windows 11 26200, i7-14700K, RTX 4080 SUPER, 64 GB; headless)
-
-| Step | Result |
-|---|---|
-| AXRB install | `AXRB-Setup-<v>.exe /S` (electron-builder one-click NSIS, per user, no UAC) → `%LOCALAPPDATA%\Programs\axrb-launcher`, 462 MB. Release assets: Setup exe + `SHA256SUMS-<v>-setup.txt` + source zip (no portable zip since 1.0.4). |
-| Runtime setup | Not scriptable through AXRB (it lives in the Electron launcher's JS), so FramePort reproduces it: 4 pinned `dl.google.com` zips from AXRB's `core/components.json` (emulator 36.5.11, platform-tools r37.0.1, build-tools 36.1, `sys-img/google_apis/x86_64-36_r07`), hash-checked, into `%LOCALAPPDATA%\AXRB Runtime\sdk`, AVD `axrb-managed-api36` written as AXRB writes it, `ready.json` / `license-acceptance.json` receipts so AXRB's own launcher sees the same runtime as set up. 2.4 GB download, ~3 min on a fast line; 26 GB on disk after one 7 GB game. |
-| Emulator boot | AXRB's `scripts\emulator\windows_android_emulator.ps1 -Action Start` (headless QEMU, AXRB clock adapter + GPU layer). First cold boot ~6 min (TSC-corrected clock cold-boots every time). ABIs `x86_64,arm64-v8a`. QEMU (`Start-Process`) and the adb server inherit the caller's handles: a pipe, a file through WSL interop, even `/dev/null` through interop (its relay stays open) all left the FramePort call hanging after the script had ended → FramePort starts AXRB scripts through WMI (`Win32_Process.Create`, hidden, nothing inherited), polls the PID and reads an `FP_EXIT <code>` line from the log. Windows PowerShell 5.1's `*>>` writes UTF-16. |
-| AXRB runtime | `adb install --no-incremental --force-queryable -r axrb-openxr-runtime-debug.apk` (0.3 s); found by the OpenXR loader through the system runtime broker. |
-| Data | `adb push` of OBB/pak files: 25-35 MB/s (7.2 GB Pinball FX VR in 5.5 min). A full uninstall (or a signature change: `INSTALL_FAILED_UPDATE_INCOMPATIBLE`) deletes the OBB folder and the saves → FramePort's stable per-game keys matter here too. |
-| **Original APK** (Pinball FX VR) | No launcher activity (Meta's VR category only), started explicitly: **SIGABRT 0.3 s after loading Meta's `libovrplatformloader.so`**. Unconverted Quest APKs don't run. |
-| **OVRPort-only build** (Lucky's Tale, Unity 2019 GLES) | OVRPort's loader → AXRB runtime → instance + session, frames submitted (2 s each without a host: the image send times out), no crash in 40 s. |
-| **OVRPort-only build** (Pinball FX VR, UE5 Vulkan) | OVRPlugin pre-init OK (AXRB reports "Oculus 67.522.0"), then exits (ForceQuit) / with the no-ForceQuit build SIGSEGV in `gfxstream vkAllocateMemory` called from AXRB's runtime Vulkan layer. Not decided headless (no host attached, see below). |
-| Host bridge | Needs an OpenXR runtime with a D3D11 adapter. Headless options all failed: SteamVR's null driver (`failed to find D3D11 adapter requested by OpenXR runtime`), `vrlink` without a headset (`xrCreateInstance` -2), Meta XR Simulator (binary download needs a Meta developer login). → frames-to-SteamVR need a real headset. |
-
-**Build decision: FramePort hands AXRB an OVRPort-only build** (the recipe's OVRPort patches, no Steam Frame fixes,
-signed with the game's FramePort key). The original APK crashes; FramePort's Frame fixes (FrameBridge adapter, Lepton
-and Frame-runtime workarounds) target the Frame. The recipe's alternate (no-ForceQuit) build is used when the recipe
-says so. (Since 2026-10-15 the PC build also carries the runtime-independent APK fixes and FrameBridge, see below.)
-
-## Which patches reach the build for this PC
-
-One recipe serves both builds; `patches/base.pc_selection(patches, analysis)` picks the PC part (used by
-`build.build(pc=True)`, `pipeline.pc_recipe_fingerprint`, the PC deployment record and `ui/components.pc_outdated`).
-`docs/PATCHES.md` marks each kept patch "also in builds for this PC (AXRB)".
-
-- **All of OVRPort's patches** (category `overport`).
-- **APK fixes that don't depend on Lepton or the Frame's runtime** (`Patch.on_pc = True`): they fix the game's own
-  code or its Meta libraries, which misbehave the same way in AXRB's Android (no Meta services, not a Quest device
-  model, no Horizon app): `frame.ovrplatformcompat`, `frame.ovrstubs`, `frame.swapchain_limit` (OVRPort's
-  dispatcher), `frame.ovr_stable_user`, `frame.unreal_ovrp_entrypoints`, `frame.avatar_stub`, `frame.vrapi_stub`,
-  `frame.metaxr_telemetry`, `frame.oculusos`, `frame.ovr_microphone`, `frame.langpacks`, `frame.asset_files`,
-  `frame.asset_files_stub`, `frame.ovr_trace`, `frame.blazerush`, `frame.unity_oculus_check` (with its ovrpshim),
-  `frame.unity_text_input`, `frame.unreal_quest_precompile`, `frame.unreal_quest_keymap`,
-  `frame.unreal_thumb_touch`, `frame.unreal_skip_obb_check`, `frame.unreal_skip_obb_delivery`, `frame.nodebug`,
-  `frame.meta_permissions`, `frame.launcher`, and `frame.vrapi_bridge` (VrApi → OpenXR through OVRPort's loader,
-  so AXRB's runtime; seen working in direct mode with The Climb 2, see "VrApi-direct games" below; the bridge
-  doesn't need the GL shim, but GLES games keep `frame.gl_shim` for gfxstream, see "GLES games in the emulator").
-- **Experimental on the PC, for GLES games in the emulator**: `frame.gl_shim` (only with a GLES analysis,
-  `Patch.pc_keeps`; Vulkan VrApi games never get it), `frame.unity_multipass` (also added by `pc_detect`), and the
-  GLES FrameBridge defaults `scale` ≤ 0.5, `scale_max=1`, `projection_only=1`.
-- **Experimental on the PC** (`on_pc = "experimental"`, kept but not yet seen working in AXRB): `frame.vk_sanitize`
-  (the Vulkan shim; gfxstream / the host driver instead of Lepton's Fossilize), `frame.unity_tls_key_pool`,
-  `frame.eos_keychain_loop`.
-- **PC-only APK fix** `frame.vk_android_extensions` (`pc_detect`: direct-VrApi games whose engine creates VrApi's
-  Vulkan system, analysis `graphics` "Vulkan (VrApi Vulkan system)"): the renderer's
-  `vkEnumerateDeviceExtensionProperties` import goes to `libfp_vkext.so`, which also lists the Quest device
-  extensions the PC's driver lacks (VK_EXT_fragment_density_map, Android external memory); AXRB's vkCreateDevice
-  leaves them out again.
-- **FrameBridge** (`frame.adapter`) with its settings in `lib/<abi>/libframe_settings.so`: it wraps OVRPort's loader
-  the same way in AXRB (scale, haptic_fix, pose_time_fix, rect_clamp, profile_remap, ...). Left out
-  (`settings.PC_DENY`): `sync_guard` (a race in the Frame's vrclient.so), `focus_hold` / `focus_hold_ms` (the
-  Frame's flickering wear sensor; FrameBridge's built-in default is on, so the PC build writes `focus_hold=0`,
-  `settings.PC_VALUES`), `controller_models` (models the agent converts from the Frame's SteamVR at install) and the
-  settings only the GL shim / Zink shader layer read (`gl_*`, `zink_*`). `controller_fix` stays: it is the game's
-  choice (0 = hand tracking) and its Touch mapping of `/valve/` and generic profiles is runtime-independent.
-  FrameBridge finds `libframe_settings.so` next to its own path (dladdr); on the Frame the agent also passes the
-  settings as files, in AXRB the library is the only source, so the PC build turns `extractNativeLibs` on
-  (`build.extract_native_libs`; apps with `extractNativeLibs="false"` would map their libraries from base.apk).
-  Without OVRPort (a 32-bit recipe) the PC build drops FrameBridge: there is no loader to wrap.
-- **PC-only:** OVRPort's `patch_disable_meta_xr_audio_telemetry` (for x86_64 ARM translation, which AXRB is) is
-  never in a Steam Frame recipe (`applies()` is False); `pc_selection` adds it, given the analysis, to games with
-  Meta XR Audio (`Patch.pc_detect`; AXRB's own profile turns it on for North Star).
-- **Off on the PC:** Lepton/Android 11 workarounds (clipboard, Vivox audio route, start activity, ...), the Zink/Mesa
-  GL shims and shader layer, pac_hints/luajit, hardware video decoding, every `device.*` option, the 32-bit bridge.
-- TODO: `device.files` (files written into the game's storage at install) could be reproduced with `adb push` in
-  `targets/pc_android.py`.
-
-### FramePort end to end (same day, headless, this branch)
-
-`frameport install com.playful.LuckysTale --to pc --no-library` (isolated `FRAMEPORT_HOME`): PC build (19 patches:
-OVRPort's + `frame.ovrplatformcompat`/`frame.ovrstubs`/`frame.swapchain_limit`; static checks pass without the
-FrameBridge check) → AXRB found, requirements met → emulator → AXRB runtime → `adb install` → 3.7 GB OBB in ~95 s
-(39 MB/s) → `deployment.json` + launcher script. `frameport test com.playful.LuckysTale --to pc`: launcher → AXRB run
-script → host bridge → triage `axrb-no-headset` (expected without a headset). The Steam shortcut write (needs a Steam
-restart) is unit-tested only.
-
-## How FramePort drives AXRB
-
-- `tools/axrb.py`: find (env `FRAMEPORT_AXRB_DIR` > installed AXRB) / install (Setup exe, SHA256SUMS checked, `/S`) /
-  runtime setup (above) / requirements (WHPX via AXRB's `check_windows.ps1`, ≥ 12 GB RAM, x64).
-- Environment for every AXRB script (the installed build sets none of it itself): `AXRB_DATA_HOME=<Runtime>\output`,
-  `ANDROID_AVD_HOME=<Runtime>\avd`, `ANDROID_USER_HOME=<Runtime>\android`, `ANDROID_HOME`/`ANDROID_SDK_ROOT=<Runtime>\sdk`,
-  `ANDROID_ADB_SERVER_PORT=5038`, `ADB_USB_LEGACY=1`, `ADB_LOCAL_TRANSPORT_MAX_PORT=5683`, AXRB's embedded Python
-  (`resources\runtime\tools\python`) first on PATH; arguments `-Sdk <Runtime>\sdk -Avd axrb-managed-api36 -Port 5584`.
-- Install: start the emulator if needed (and stop it again if FramePort started it), install the AXRB runtime APK,
-  `adb install -r` the build, push OBB/data to `/sdcard/Android/obb|data/<pkg>/`, record `<data>/pc/<pkg>/deployment.json`
-  (`kind: "android"`).
-- Play: a Steam shortcut runs FramePort's small launcher script (`%LOCALAPPDATA%\FramePort\axrb\fp-axrb-run.ps1`),
-  which sets the environment above and calls AXRB's `scripts\run\run_windows_game.ps1` (boots the emulator when
-  needed and then owns it, registers a SteamVR app identity, starts the host bridge, `am start`, waits; exit codes
-  0 ok, 1 error, 3 game lost, 4 host lost; `logs\game\session.json`, `host.err`).
-- Logs for diagnostics: `<Runtime>\output\logs\game\{host.log,host.err,session.json,guest.log}`,
-  `logs\emulator\emulator.std{out,err}.log`.
-
-## Headset results (2026-10-10, Steam Frame streaming to the PC through Steam Link / vrlink, 96 Hz)
-
-AXRB's bridge opened a SteamVR session on the Frame each time (session state up to FOCUSED, both hands active), started
-through FramePort's launcher with the emulator booted by AXRB's run script (~1 min), and shut down cleanly.
-
-- **Lucky's Tale (Unity, GLES): black.** GLES games go through AXRB's raw image path (eye readback → TCP), sized
-  by SteamVR's recommended resolution: 3412×3412 per eye at the owner's 250 % supersampling = 93 MB per frame,
-  ~10 s per frame; at a lowered resolution 2644×2644 = 56 MB, 6.6 s per frame (~8.5 MB/s). AXRB's zero-copy GPU
-  path covers Vulkan games only. The ~8.5 MB/s was the transport, not the readback: see "GLES games in the
-  emulator" below (adb reverse: ~100 MB/s, half-size eyes, multipass: Lucky's Tale draws at 30 fps).
-- **Pinball FX VR (UE5, Vulkan): crash 4 s after start**, the same gfxstream `vkAllocateMemory` SIGSEGV from AXRB's
-  runtime layer as headless (so not a headless artefact). AXRB's side.
-
-Not reached: sound, controllers. Next candidates: a Vulkan game AXRB reports playable (Deadpool VR, Batman: Arkham
-Shadow); an AXRB issue for the Pinball crash.
-
-## GLES games in the emulator (2026-10-16, headless under Monado's simulated HMD)
-
-AXRB 1.0.4's emulator is the only backend with GLES (direct mode's EGL is a stub). A GLES frame is read back with
-`glReadPixels` on the game's thread inside `xrEndFrame` (`runtime/src/frame_transport.cpp`), sent as raw RGBA to the
-host (two eyes per frame) and uploaded there; `xrEndFrame` returns only after the send. Measured with
-`AXRB.Perf eye-readback` / `image-send` (guest log) and `host-image-arrival` (host.err):
-
-| Eye size (per eye) | Bytes/frame | Route | Send | Frame rate |
-|---|---|---|---|---|
-| 896×1007 (Monado's recommendation) | 7.2 MB | default: TCP to 10.0.2.2 (QEMU user-mode network) | 850-950 ms | 1.1 fps |
-| 448×504 (`scale=0.5`) | 1.8 MB | default | 200-230 ms | 4.4 fps |
-| 896×1008 | 7.2 MB | **adb reverse** (`debug.axrb.image_transport=adb`) | 87 ms (~83 MB/s) | 9.4 fps |
-| 640×720 (`scale=0.7`) | 3.7 MB | adb reverse | 38 ms (~96 MB/s) | 17.6 fps |
-| 448×512 (`scale=0.5`) | 1.8 MB | adb reverse | 14.5 ms (~125 MB/s) | 30.5-30.8 fps |
-
-The readback itself is 1-3 ms. The default route caps at ~8 MB/s (the same rate as in the headset run above); AXRB's
-adb reverse route (AXRB sets up `adb reverse tcp:38491` anyway) is 10-15x faster. For SteamVR's resolutions the math
-stays hard: 2016² per eye = 32.5 MB/frame (~3 fps), at half size 8.1 MB (~10 fps); the owner's 2644² at half size
-14 MB (~6 fps). Lowering SteamVR's resolution for the game is what helps further (AXRB has a minimum-extent setting,
-`AXRB_MIN_EYE_EXTENT`, but no maximum).
-
-What FramePort does for GLES games on this PC (all in the PC build / launcher, nothing on the Frame changes):
-- FramePort's launcher (`fp-axrb-run.ps1`) starts Android itself when it isn't running (AXRB's Start action, as the run
-  script would; the run script then gets `-OwnsEmulator` and shuts it down), sets `debug.axrb.image_transport=adb`
-  (`FRAMEPORT_AXRB_IMAGE_TRANSPORT=default` leaves AXRB's choice) and `debug.wm.disable_deprecated_target_sdk_dialog=1`.
-- `pc_selection` with a GLES analysis: FrameBridge `scale` at most 0.5 (FrameBridge's minimum), `scale_max=1` (the
-  maximum eye size reported is the scaled one too), `projection_only=2`: AXRB's emulator refuses every GLES frame with
-  more than one layer (`xrEndFrame` -2), so FrameBridge submits the projection layer alone after drawing the quad
-  layers that follow it into its eye images (`native/adapter/quad_compose_gl.c`, on the game's GL context, per eye at
-  the eye's view and FOV, blending by the quad's flags); `projection_only=1` only drops them.
-- Game installs use `adb install -g` (runtime permissions granted, as Lepton does on the Frame): Android's permission
-  dialog over the game's activity pauses Unity for good (BattleSisters asks for the microphone in its menu).
-- The VrApi bridge copies the game's eye textures into the OpenXR images with `glBlitFramebuffer` when the context
-  has no `glCopyImageSubData` (the emulator's GLES translator is "OpenGL ES 3.1" without `GL_EXT_copy_image`; its stub
-  only logs `libEGL: called unimplemented OpenGL ES API`, so every eye reached the runtime black).
-- `frame.unity_multipass` (experimental on the PC, `pc_detect` for Unity GLES + Oculus XR Plugin): gfxstream lists
-  `GL_OVR_multiview2` but its encoder finds a multiview framebuffer incomplete and drops every draw
-  (`GL2Encoder.cpp:s_glDrawElements … GL error 0x506 checkFramebufferCompleteness`): both eyes black.
-- `frame.gl_shim` (experimental on the PC, GLES only, `Patch.pc_keeps`): gfxstream has no
-  `GL_EXT_disjoint_timer_query`; the shim lists it and hands out stand-ins ("available, 0 ns") so GLAD engines that
-  call the timer queries unconditionally don't jump to NULL. Its multiview hiding also suits gfxstream.
-- FrameBridge settings without a rebuild: `frameport settings <pkg> --to pc key=value` writes
-  `/sdcard/Android/data/<pkg>/files/framebridge.conf` (emulator: adb push, Android started for it if needed; direct
-  mode: the file in AXRB's runtime folder); an empty value removes a key.
-
-Per game (AXRB 1.0.4 emulator, Monado simulated HMD at 72 Hz, FramePort's PC build; Windows 11, RTX 4080 SUPER):
-
-| Game | Build / settings | Furthest | Frame rate / time | Blocker |
-|---|---|---|---|---|
-| Lucky's Tale 1.0.55 (Unity 2019.4 + Oculus XR Plugin, GLES) | PC build + `frame.unity_multipass`, `scale=0.5`, adb route | **title scene drawn in both eyes** (Monado window captured) | 30.5-30.8 fps, image-send 14.5 ms | none headless; needs the headset (picture through SteamVR at its resolution, controllers) |
-| Accounting+ 1.24.35 (Unity 2017.4 built-in Oculus, GLES) | PC build (`frame.unity_oculus_check`), `projection_only`, old-SDK dialog off | **stance selection screen drawn in both eyes** | 10 fps, image-send 82 ms: its OVRPlugin makes 896×1024 eye buffers whatever FrameBridge's scale/max say | its quads (OVROverlay) were dropped by `projection_only=1` (AXRB rejects every multi-layer GLES frame with -2); rebuilt with `projection_only=2` (2026-10-16, qwerty head): same screen at 9.9 fps, no regression (its controller pointers are missing there because qwerty's controllers are inactive); eye size only shrinks with the PC runtime's resolution |
-| Path of the Warrior 21.11.10 (VrApi-direct GLES, own engine; from the `PATCHED/` copy) | VrApi bridge (blit copies) + GL shim (timer-query stand-ins), `scale=0.5`, `projection_only=2`, `--sim` with Monado's qwerty head | **its first screen drawn in both eyes**: the "Please ensure that your Oculus Touch Controllers are properly connected" panel (a VrApi cylinder → quad, drawn into the projection) | 38 fps, image-send ~15 ms | the simulator's controllers: Monado's qwerty builder (needed for a tracked head here, see `--sim` notes) has WMR controllers, which AXRB's bindings don't cover. Found on the way: (1) the simulated head: no tracked pose, `EnterVrMode` gave up after 30 s; (2) every frame -2 (projection + the cylinder quad); (3) black eyes: no `glCopyImageSubData` in the emulator's GLES. Before the stand-ins: SIGSEGV at pc 0 in `EgHalGrTimestampQueryGL` (NULL `glad_glGenQueriesEXT`). Needs a headset: controllers past this screen, gameplay |
-| BattleSisters 1.2.4 (Unity 2019.4 built-in VR, GLES) | PC build (ovrpshim frame loop), `scale=0.5`, installed with `-g`, `--sim` with Monado's qwerty head | **main menu drawn in both eyes** (Continue / New game / Level select hub / Last Bastion / Settings) | 31 fps for 90 s, no stall | none headless. The "hang after 3 frames" was Android's permission dialog: a few seconds into its menu the game asks for a runtime permission (microphone), `GrantPermissionsActivity` became the resumed activity over the game, Unity paused (AAudio pause, no Update2/WaitToBeginFrame/BeginFrame/EndFrame in progress per `ovrp_trace`) and nobody can answer it; not the ovrpshim frame wait and not AXRB's pacing. Fixed by installing with `adb install -g` (as Lepton does). Needs a headset: controllers, gameplay |
-
-`--sim` notes: AXRB 1.0.4's emulator host only reads `AXRB_TEST_SYNTHETIC_HMD=1` (direct mode's `=2` is newer) and
-applies it only to a head *without* valid flags; Monado's simulated head is valid but not tracked, so the host never
-sets its LOCAL origin and VrApi games never get a tracked head. For games on the emulator backend `frameport test
---sim` therefore runs Monado's **qwerty** builder (`SIMULATED_ENABLE=0`, `QWERTY_ENABLE=1`: its head reports
-POSITION_TRACKED; host.err `AXRB OpenXR: LOCAL origin in tracking world=(0.000 1.600 0.000)`). Its controllers are
-WMR ones, which AXRB's suggested bindings (Touch/Index/Vive) don't cover: no hands. `FRAMEPORT_PC_XR_SIM_HEAD=simulated`
-keeps the simulated head (and its ml2 controllers), `=tracked` forces qwerty. Monado's `remote` builder (tracked head +
-Index controllers) would cover both but listens on 0.0.0.0:4242 (a firewall prompt), so it isn't used. FrameBridge's
-`ovrp_trace=1` (ovrpshim, Unity 2017-2019 legacy frame loop) logs every 5 s how many Update2/WaitToBeginFrame/
-BeginFrame/EndFrame calls went through and which one is in progress (thread, frame, how long): where a stalled game
-waits. AXRB's opt-in host capture (`AXRB_CAPTURE_PREFIX`) only starts at sequence 2000 in 1.0.4 (hard-coded;
-`AXRB_CAPTURE_FIRST_SEQUENCE` isn't read), which GLES games at 10-30 fps don't reach in a test: use the Monado
-window captures and FrameBridge `snapshot=N`. AXRB's guest log only keeps warnings plus AXRB's own tags: read
-`adb logcat -d` for FrameBridge/OVRPlugin lines. `debuggerd -b <pid>` works from `adb shell` (stacks).
-
-## Open (needs the owner + a headset)
-
-- A game in the headset through SteamVR (picture, audio, controllers; Steam Frame controllers: AXRB #20).
-- Pinball FX VR's Vulkan crash with the host attached happens in the emulator only; in direct mode it reaches its lobby
-  headless. Needs the headset: picture/latency through SteamVR, controllers, a table played.
-- Play from the PC's Steam library (shortcut → launcher script → AXRB).
-
-## Testing without a headset (Monado's simulated HMD, 2026-10-15)
-
-AXRB's host bridge needs an OpenXR session with a D3D11 binding, which SteamVR doesn't give without a headset. For
-unattended tests FramePort can run the bridge against **Monado for Windows** with Monado's simulated HMD instead,
-without changing the system's OpenXR runtime or touching SteamVR:
-
-- **Monado build:** an official CI artifact of `monado/monado` (gitlab.freedesktop.org, project 2685), job `windows`
-  of a `main` pipeline (there is no Windows release asset; the job's `install/` folder is the portable runtime:
-  `bin\monado-service.exe`, `bin\openxr_monado.dll`, `openxr_monado.json`, SDL2/Vulkan loader DLLs). Tested build:
-  pipeline 1766968, job 112793105, commit 8b259763f (`v25.1.0-917-g8b259763f`). Unpacked by hand into
-  `%LOCALAPPDATA%\FramePort-dev\monado\install` (or `FRAMEPORT_MONADO_DIR`): no installer, no UAC, no registry. Its
-  `share\steamvr-monado` (a SteamVR driver) is never registered.
-- **Selection per process only:** the OpenXR loader's `XR_RUNTIME_JSON=<monado>\openxr_monado.json`. HKLM's
-  `ActiveRuntime` stays SteamVR. AXRB's run script registers an app identity with SteamVR whenever HKLM names SteamVR
-  (an OpenVR utility client, which starts SteamVR), so under the simulator FramePort's launcher call answers that one
-  `python steamvr_app_identity.py` call "failed" (the script only warns).
-- **Service settings** (`tools/xr_sim.SERVICE_ENV`): `SIMULATED_ENABLE=1` (the simulated builder; the Windows build
-  only has the qwerty/remote/simulated builders, so no real device is probed), `SIMULATED_LEFT/RIGHT=ml2` (the only
-  simulated controllers whose bindings cover the Vive wand profile: AXRB suggests Touch/Index/Vive, so with `simple`
-  or `wmr` its hands stay inactive), `XRT_COMPOSITOR_DEFAULT_FRAMERATE=72`. Headless variant: `XRT_COMPOSITOR_NULL=1`
-  + `XRT_COMPOSITOR_NULL_FPS=72` (no window, nothing to capture).
-- **D3D11 + adapter:** Monado's D3D11 client compositor works (timeline semaphores); it renders on the discrete GPU
-  (Vulkan device 0, RTX 4080 SUPER here; `XRT_COMPOSITOR_FORCE_GPU_INDEX` would change it) and asks D3D11 clients for
-  that adapter's LUID, which DXGI finds.
-- **Results:** a minimal D3D11 client (`native/xrsimprobe/xr_sim_probe.cpp`, built with VS Build Tools against the
-  Khronos `openxr_loader_windows` 1.1.63 release) went IDLE → READY → SYNCHRONIZED → VISIBLE → FOCUSED in 0.01 s
-  and submitted 72 frames/s until it asked to exit. AXRB's host bridge (`--serve-openxr 38490 0 <title>`, no
-  emulator) reached `D3D11 graphics binding ready`, session state 5 (FOCUSED), `AXRB TCP: listening on
-  0.0.0.0:38490`, both controllers active with valid poses, `host-end-frame: rate=72.0/s`, its splash in both eyes.
-  No game was run yet.
-- **Seeing what is drawn:** the windowed compositor ("Monado (Windowed)", 1264×681, both eyes side by side without
-  distortion) can be saved with `native/xrsimprobe/xr_sim_capture.cpp` (`PrintWindow`, works behind other windows;
-  `xr_sim.capture(path)`), and `--sim` also sets AXRB's own opt-in `AXRB_CAPTURE_PREFIX` (4 PPM readbacks of the
-  submitted layers, 5 s apart, from frame 300) into `<data>/logs/xr-sim/`. A launch test that reached RUNNING saves
-  Monado's window there too, just before it stops the game (`<time>-<pkg>-headset.bmp`, `pc_android.sim_capture`),
-  and every AXRB launch test reports the frame rate from AXRB's `AXRB.Perf` summaries (game submits / bridge). Monado itself has no screenshot function;
-  `XRT_WINDOW_PEEK` and `XRT_DEBUG_GUI` exist but only show windows.
-- **Use:** `frameport test <pkg> --to pc --sim` (or `FRAMEPORT_PC_XR_SIM=1`): starts `monado-service.exe` hidden
-  (WMI, like AXRB's scripts; ready when its pipe `\\.\pipe\<%TEMP%>\monado_comp_ipc` exists), passes the environment to
-  the AXRB launch (`pc_android.launch_test(extra_env=…)`, default `xr_sim.active_env()`), stops the service afterwards
-  (an already running Monado is used and left running). Service log: `<data>/logs/xr-sim-service.log`.
-- **Head per backend:** when every game tested is on AXRB's emulator backend, the service runs Monado's qwerty builder
-  instead of the simulated one (a tracked head; AXRB 1.0.4's emulator host has no synthetic head for Monado's
-  untracked one, see the GLES section's `--sim` notes); its controllers stay inactive in AXRB.
-  `FRAMEPORT_PC_XR_SIM_HEAD=tracked|simulated` overrides the choice. An already running Monado is used as it is.
-- **Limits:** the simulated head wobbles slowly and the controllers hold still with no buttons pressed, so it proves
-  startup, frame submission and what is drawn, not gameplay; the windowed compositor opens a visible window on the
-  desktop; frame pacing is Monado's, not a headset's.

docs/PLAYBOOK.md

@@ -21,10 +21,14 @@ version is `catalog/triage.yaml` (used by `frameport test` / the Job screen); ke
 | A launch test suggests a patch (for example triage `sdl-no-clipboard` → `frame.sdl_clipboard`) but the game page doesn't show it / lists it as not applicable; or a game added long ago lacks warnings newer ones get (Android version, web wrapper, missing OBB) (GitHub #104, Dramatic Shape) | the library entry was analyzed by an older FramePort: the analysis field the patch reads (`sdl_java`, `min_sdk`, `web_wrapper`, `expects_obb`, …) is missing, so `applies()` is false | entries whose `analysis.extra.analysis_version` is below `detect.ANALYSIS_VERSION` are analyzed again at the GUI's start (background) and before a build (`pipeline.refresh_analyses`); by hand: game menu → "Analyze again", then Update on Frame. An unreadable APK is marked `analysis_failed` (retried after the next version bump). Adding an analysis field: bump `ANALYSIS_VERSION` |
 | FDM layer loads but diagnostic logging reports `fdm_injection_CreateInstance: skipped` | Layer loading alone does not enable injection on the tested SteamOS 0.4.5 build; a skipped helper instance alone also does not establish game-wide inactivity | Opt-in `device.foveation` mode `tracked`: loads Valve's layer and sets `FDM_DEBUG=enable`. Batman probe reached foveated render passes with changing per-eye offsets. Validate graphics and matched gameplay GPU time; do not enable globally. Use `debug` only for brief diagnostics, preserving existing flags; never benchmark with debug spam. See FRAME_RUNTIME.md. |
 | One eye (usually the right) shimmers or jitters in the 3D view while menus and panels look steady; pacing is clean (GitHub #69, e.g. RTCWQuest, Moss) | Valve's eye-tracked foveation layer (`VALVE_fdm_injection`) moves its low-density regions with each eye's gaze, and the right eye's gaze filter restarts often (`CEyePoseUKF R: Large dt … Bootstrapped` in `~/.local/share/Steam/logs/eyetracking.txt`) | Customize → "Eye-tracked foveation (Valve)" (`device.foveation`): **Fixed** (`FDM_DEBUG=disable_offsets`; verify injection remains active on the installed runtime) or **Off** (`VK_INSTANCE_LAYERS=""`); catalog field `foveation:` |
+| With `device.foveation` Eye-tracked/Fixed, the sharp area looks right but everything around it is black with scattered coloured blocks (menus on quads too); pacing fine (GitHub #303, Medieval Dynasty; Vampire Survivors reported the same) | Unity's Oculus XR plugin asks for SUBSAMPLED eye images (`XR_META_vulkan_swapchain_create_info`, `VK_IMAGE_CREATE_SUBSAMPLED_BIT_EXT`); under Valve's FDM their coarse areas stay in the compact subsampled layout, which the compositor reads as an ordinary image. `foveation_fix=1` only dropped the `XrSwapchainCreateInfoFoveationFB` nodes and passed the META node on. With `foveation_fix=0` + `foveation_storage_fix=1` the adapter logs `foveation_storage_fix: shared allocation SUBSAMPLED cleared` for the eye swapchains | `device.foveation` (tracked/fixed) now also sets `foveation_storage_fix=1`, which clears SUBSAMPLED whatever `foveation_fix` is (generic version of Batman's OVRPlugin allocation fix). Rebuild + reinstall (new adapter). Headless-checked only (72 fps, bit cleared); picture needs the headset |
 | A Unity OpenXR game closes right after the OpenXR instance is created: `F VrApiLoader: vrapi_SetPropertyInt was called before vrapi_Initialize()!`, SIGABRT on UnityMain (GitHub #62, Jurassic World Aftermath) | the APK still ships Meta's VrApi loader; OVRPlugin (1.89, on OpenXR) calls it without starting VrApi and Meta's loader aborts. The VrApi bridge can't replace it (39 of the loader's 114 functions: OVRPlugin wouldn't link) | `frame.vrapi_stub` (same exports, each returns 0); triage `vrapi-before-init` |
 | A VrApi game exits at once: `UnsatisfiedLinkError … dlopen failed: cannot locate symbol "vrapi_PollEvent"` (GitHub #57, BlazeRush) | the engine imports a VrApi function the VrApi bridge didn't implement | the bridge has `vrapi_PollEvent`, `RecenterPose`, `SetDisplayRefreshRate`, `GetSystemPropertyFloatArray` (rebuild the game); the static check "VrApi functions resolvable" names any other missing one; triage `vrapi-symbol-missing` |
 | A Team Beef port (Lambda1VR, RTCWQuest, …) exits at once: `UnsatisfiedLinkError: dlopen failed: library "libopenxr_loader_valve.so" not found` (GitHub #59) | TBXR loads `openxr_loader_<Build.MANUFACTURER>` (Lepton: valve) and takes the Meta path only when `strstr(OPENXR_HMD, "meta")` matches, else Pico's | `frame.tbxr_vendor` (empty `libopenxr_loader_valve.so` + the "meta" literal → "alve"). Game data (`xash/`, …) goes to /sdcard: upload it with the Files tab to the game's storage. Black eyes with `TBXR: Incomplete frame buffer object: GL_FRAMEBUFFER_INCOMPLETE_MULTISAMPLE`: TBXR always uses multisampled render-to-texture (even `--msaa 1`); `frame.tbxr_vendor` links the GL shim, which hands it single-sampled versions (log `GL shim: multisampled render-to-texture … drawn single-sampled`) |
+| A Quest game renders, then logs `Entitlement check failed` / `ovrPlatformInitialize_NotEntitled` (often with retries) and quits, e.g. `SIG: 9` after `[Photon] Disconnected` (GitHub #322, Deadly Delivery) | The game's Meta licence check (entitlement) needs Meta's online login, which the Frame doesn't have; online-only games quit (triage `meta-entitlement`) | None: FramePort doesn't get around entitlement checks. Offline games that log it and play on are fine |
 | Black screen after VR starts; `Asset status error  (code 100)` in `DLC_Manager:AssetStatusCallback` (GitHub #203, e.g. PixelRipped 1995) | Meta asset-file status fails after entitlement succeeds; the log does not identify the native call or asset ID | Try `frame.asset_files_stub` (opt-in, triage-only): native/langpack answers GetList with an empty successful list and StatusById with installed status, an empty path and the requested ID. No DLC files are supplied; download requests retain their existing behavior. Disable with `FRAMEPORT_ASSET_FILES_STUB=0`. Host-tested only; whether this fixes startup needs a game/device test |
+| A Unity Quest game stays on a loading screen or doesn't go on; `An unknown error occurred. Request failed.` from `Oculus.Platform.Request`1:OnComplete` (GitHub #346 Eleven, #360 Spectre, #368 Thief Simulator; triage `meta-request-failed`) | A Meta platform call the game waits for got no usable answer: OVRPort's platform library answers some calls without Meta's services (request id 0) and Meta's Unity wrapper drops the callback | Find the call in the stack (the game's own coroutine after `OnComplete`); a per-game fix that skips it when it isn't needed to play (e.g. an analytics id request). Calls the game needs online stay unsupported |
+| Game aborts at start: `OVRPlatform-Loader: DisplayErrorAndExit: Failed to launch SystemActivities` after an `ActivityNotFoundException` stack (GitHub #357 Breachers; triage `meta-system-activities`) | The game ships its own renamed copy of Meta's platform loader (e.g. `libovr_custom.so`), which bypasses OVRPort's dispatcher and tries to open Meta's system activities (Horizon OS) | None in general: such games are online games built on Meta's services. Serving OVRPort's dispatcher under that name is possible but unlikely to make them playable |
 | Missing sound or extra content in a game whose OBB folder has separate `*.pak` files (GitHub #61, Star Wars: Tales from the Galaxy's Edge: seasons + Wwise banks) | the game asks Meta's platform for these asset files (`ovr_AssetFile_GetList` / `DownloadById`); OVRPort's loader doesn't list them | copy every content/sound-bank PAK and use `frame.asset_files` (native/langpack lists the data's `*.pak` as installed `default` assets, IAP `free`, and answers DownloadById at once with the path; off: env FRAMEPORT_ASSET_FILES=0). Tales also needs the splash and depth-size fixes below |
 | A SideQuest backup has `apk/` and a sibling `obb/` with content/sound-bank PAKs, but the Frame only has the main OBB (GitHub #61, Tales from the Galaxy's Edge) | older scans treated that layout as loose expansion files and selected only the named OBBs; the asset-file patch then found no PAKs | the scanner chooses the OBB folder by version first, then keeps the whole sibling data folder when all its expansion files are selected for this APK; app updates repair affected library entries and refresh asset/language-pack detection. Reinstall to copy the missing files, or scan the backup again first. Folders with other packages or unselected OBB versions still send only the selected OBBs |
 | Tales from the Galaxy's Edge stops during map loading (GitHub #61): game thread in `FlushRenderingCommands` / `UEngine::LoadMap`, render thread in `FSplash::RenderFrame_RenderThread` / `ovrp_WaitToBeginFrame` / SteamVR `WaitFrame` | the separate Oculus loading splash waits for an unbegun frame while map travel waits for rendering | `frame.unreal_splash_bypass`: returns from the splash renderer, with a checked symbol, size and prologue. The last image stays visible during loading; the normal renderer and menu layers continue. Headset test with the depth-size fix: gameplay, both eyes, controller input and sound work |
@@ -44,6 +48,7 @@ version is `catalog/triage.yaml` (used by `frameport test` / the Job screen); ke
 | Launch test "failed" although the game runs in the headset: frames paced, then `OVRPortVrApi: EnterVrMode: no tracked head pose before deadline`, then a crash (e.g. `zink: DEVICE LOST` + SIGSEGV in a `gdrv` thread) (GitHub #57, BlazeRush) | the VrApi bridge ends the VR session after 30 s without head tracking, which only happens without a worn headset; the game's renderer then crashes while tearing down | none needed: launch tests (`triage(..., headless=True)`) treat an exit or crash after a `headless_end` line (catalog/triage.yaml) as a pass when frames were paced before it (info finding `headless-end`); play sessions ignore it. Add new such markers to `headless_end` |
 | Launch test EXITED, launch.log has `Target app (<pkg>) did not start` and no `Start proc …:<pkg>` (GitHub #179) | Lepton occasionally doesn't start the app on the first start after an APK change; Android's `WebViewLoader-: System.exit` at boot is not the game (triage `app-not-started`) | start it again |
 | A game keeps no progress between starts although it saves (its storage gets a new `Profiles/Oculus/<id>/`-style folder per start; Walkabout Mini Golf, GitHub #182) | OVRPort's platform loader answers `ovr_GetLoggedInUserID` with a made-up id (6e18 + `random()`), new at every start; games file saves under the user id | `frame.ovr_stable_user` (default for games with the platform library): a fixed id per game and keystore. Old progress: copy the newest old profile into the new id's folder |
+| A Cortopia game (Escaping Wonderland, GitHub #360) stays on its loading screen (frames paced); launch.log: `E Unity: An unknown error occurred. Request failed.` with `OculusPlatformExtension:ToUniTask` / `Cortopia.Scripts.Platform.Meta.<Initialize>d__13` | after the licence check and the logged-in user, the game asks for `Users.GetOrgScopedID` when on Wi-Fi (its analytics id); OVRPort's `ovr_User_GetOrgScopedID` returns request id 0, Meta's C# wrapper logs that line and never calls back, so the awaited start-up never finishes | `frame.cortopia_org_id` (suggested from the analysis, triage `cortopia-org-id-wait`): the `b.ne` after `cmp w0, #2` on `get_internetReachability` in `<Initialize>d__13.MoveNext` -> `b` (Cpp2IL), the game's own no-Wi-Fi path; the same "Request failed." line in another game = another request OVRPort doesn't implement |
 | A Unity app's text field shows a caret for a moment and loses focus; no keyboard appears (for example Stremio VR login) | Unity's TMP_InputField/InputField wait for Android's on-screen keyboard and close themselves without one (Lepton has none); headless VR apps also have no focused Android window, so no key press reaches them | `frame.unity_text_input` (Cpp2IL finds `TouchScreenKeyboardShouldBeUsed`/`isKeyboardUsingEvents`, rewritten to false/true) + `device.text_input_window` (lepton-show-flatscreen: Steam's keyboard and Type on Frame work) |
 | FramePort's games disappear after Steam restarts, especially after a devkit registration (GitHub #263) | Steam saves `Shortcuts` / `AppName` with capital letters; older FramePort reads them case-sensitively and writes a second shortcut map that Steam ignores | agent v86 reads and updates keys case-insensitively, keeping Steam's spelling, appids and tags; update FramePort and add the missing games to the library again |
 | Play gives Steam's "Game configuration unavailable"; Steam's console_log: `GameAction [AppID <id>] … RequestingLicense → UpdatingAppInfo → LaunchApp failed with AppError_9` | this Frame's Steam never loaded FramePort's shortcuts.vdf entry (it treats the id as a store app); see the casing fix above, other causes remain unconfirmed (GitHub #21/#30) | automatic since agent v43: Play registers the game through Steam's devkit interface ("Devkit Game: …", `devkit_register`) and starts that; uninstall removes it. Agent v58: a devkit entry Steam forgot after a restart is added again live on Play (no NOT_IN_LIBRARY → no Steam restart), and installs/art updates of devkit games only copy art (no Steam restart, GitHub #41) |
@@ -62,6 +67,8 @@ version is `catalog/triage.yaml` (used by `frameport test` / the Job screen); ke
 | Un-cracked Oculus PC VR game: "Initializing OVR session" then exits / signature check on the runtime | Revive's hooks don't install on Proton-arm64; the Oculus shim rejects the unsigned Revive runtime | Not runnable on the Frame without the repack's crack extracted (not done by FramePort); use the PC version |
 | PC VR game: `Failed to initialize Oculus API (-3001)` / `Unable to load LibOVRRT DLL` | Revive's LoadLibrary hook doesn't work under Proton arm64 (ARM64EC kernelbase); the game's LibOVR shim finds no runtime DLL | Symlink `LibOVRRT64_1.dll` → Revive's DLL in the prefix's system32 (manual so far) → then -3021 (runtime signature check; open) |
 | Uploads to the Frame are slow | The link, storage or transfer backend can limit throughput | Check the job's "Transfer link"; try the Frame's hotspot or USB cable. Large install files prefer system OpenSSH SFTP, retaining paired-host checks and `.part` resume; unavailable or failed native uploads fall back to Paramiko. The log names the backend. Settings → Installing → Parallel uploads accepts 1–8 (default 3; saved preferences are preserved). More is not always faster. Measure the production path with `scripts/upload_bench.py --methods app-files-3 --check-resume` (three repetitions, checksum verification) |
+| Log: `OpenSSH SFTP failed (255): … Permission denied (publickey,password)`, then Paramiko | OpenSSH offered keys the Frame doesn't authorize (GitHub #242) | The log lists the keys OpenSSH offered (`Offering public key`) and its warnings. A connection that logged in with the PC's own keys/agent makes OpenSSH use them too (copies of `~/.ssh/id_*` + the agent); a refused FramePort key is retried that way once. A Frame that accepts only another key file: Settings → Installing → SSH keys (CLI `frameport frame ssh-keys --add <file>`); passphrase keys go through the SSH agent |
+| Log: `OpenSSH SFTP failed (1): stat C://…/[…: No such file or directory` | sftp got glob escapes inside its quotes (GitHub #324, fixed): `[` in a local folder name | Update FramePort; the native_upload `quote()` passes only `\\` and `\"` escapes, Windows paths with `/` |
 | PC VR game exits right away: `Unhandled Exception: 0xc06d007e` (after `FOnlineSubsystemOculus::InitWithWindowsPlatform`) | Delay-loaded `LibOVRPlatform64_1.dll` (Oculus Platform SDK, installed with the Oculus app) is missing | None on the Frame (entitlement check; FramePort doesn't replace it). PC mode with the Oculus app |
 | Unity PC VR game (Oculus + SteamVR build: `OVRPlugin.dll` and `openvr_api.dll` in `<Name>_Data/Plugins`) opens a window and quits after ~20 s; no VR Vulkan instance after the game's DXVK device in launch.log; Unity log (`unity log … Player.log`, agent v67): `OpenVR failed initialization` / `Initialization of device … failed` | Unity's built-in VR tries its SDKs in list order (Oculus first) unless `-vrmode` picks one; a catalog recipe verified with another build of the game (for example SUPERHOT VR's OpenXR build, GitHub #105) used to drop the build's own arguments | `pcvr.launch_args` = `-vrmode OpenVR` (detected for such builds; kept when the catalog's `xr` differs from the build's). A game's Electron launcher next to it (SHVR.exe) is ranked below the game |
 | Unreal PC VR game opens the crash reporter instead of closing | UE starts CrashReportClient.exe on a crash | `pcvr.no_crash_reporter` (default for Unreal Rift games): `-nocrashreports` + CrashReportClient.exe renamed `.disabled` in the Frame copy |
@@ -77,6 +84,7 @@ version is `catalog/triage.yaml` (used by `frameport test` / the Job screen); ke
 | Unreal game still stays on `DownloaderActivity` with CRC checking off (`bVerifyOBBOnStartUp=false`) and a fully uploaded matching OBB (GitHub #283, Into The Radius) | The separate Java `expansionFilesDelivered()` name and size gate can reject an OBB through Android external storage in Lepton; disabling CRC does not bypass it | Try `frame.unreal_skip_obb_delivery` (opt-in, experimental, triage-only). It returns true from known Unreal/package delivery predicates in every dex, preserving normal downloader success and main init. Analysis `unreal_obb_delivery` (version 16) controls applicability. The native engine still needs complete, matching, readable OBB data; unverified on a device |
 | `INSTALL_FAILED_NO_MATCHING_ABIS` | 32-bit-only APK (Gear VR / Go / early Quest); Frame has no AArch32 | `frame.a32_bridge` (suggested for every 32-bit-only APK, experimental): the a32 translator runs the game's 32-bit libraries inside the 64-bit app (native/a32translator/bridge) |
 | a32 bridge faults at a low Thumb PC while loading a library, with the same unrelocated pointer in `.init_array` (e.g. Journey of the Gods: `0x1259e9` in OVRPlugin) | The guest loader ignored the older `DT_ANDROID_RELR` / `DT_ANDROID_RELRSZ` tags, leaving relative pointers at their link addresses | Fixed in the guest loader: both Android and standard RELR tags use the existing RELR decoder. Rebuild the a32 runtime and APK; host regression tests cover both tag families, but game startup still needs a Frame run |
+| 32-bit game on the bridge quits right after its loading screen with `a32: block at 0x… overflowed the code buffer` (exit 127; Pinball FX2 VR, GitHub #342: OpenSSL's `sha1_block_data_order_armv8`, ~60 SHA-1 crypto instructions in a row, reached from `RAND_poll`) | Every instruction the JIT hands to the interpreter needs an exit stub; the translator only ended a block at 96 instructions or half its code buffer, so a dense run of such instructions overflowed the 64-entry stub table and `fatal()` ended the process | Fixed in the translator (jit.c `STUB_RESERVE`: a block ends while 8 stubs are left); rebuild the game. Find the code with the logged address minus the library's load address (`a32rt: loaded …`) and `A32_BREAK=<addr>` for its caller; `tests/programs/sha1ce.c` covers it |
 | 32-bit game on the bridge: framerate falls over minutes, purple/garbled geometry, then `Could not allocate memory: System out of memory!` (Spunky Dungeon) | The bridge's guest copies of mapped GL buffers were tracked per buffer target: a second buffer mapped on the same target lost the first one's copy (never written back: garbage vertices; never freed: ~10 MB/s until the guest's 4 GiB were full) | Fixed in the bridge (gl.c: mappings per buffer object). Check: the guest's `[anon:scudo:*]` maps below 4 GiB in /proc/<pid>/maps must stay flat |
 | 32-bit game on the bridge loads, leaves VR and its engine threads end, no crash, no finish() (Gunjack) | The game checks its own APK signature (UE4 `AndroidThunkJava_GetSignature` = Base64 of the signing certificate's SHA-1, compared in AndroidMain): every FramePort build is re-signed | `frame.a32_bridge` stores the original APK's value in `assets/fp_a32_signature.txt` (Unreal games) and the bridge answers the guest's call with it (log `AndroidThunkJava_GetSignature: original signature returned`). Find other such checks with `A32_BREAK` on the game's exit path (vrapi_LeaveVrMode logs its caller) |
 | 32-bit NativeActivity game on the bridge ignores every controller (Gunjack, UE 4.10 Gear VR: no vrapi input functions, it reads the Gear VR touchpad/back button as Android input events from its AInputQueue) | The bridge sent its controller events through `Activity.dispatchKeyEvent`, which a NativeActivity never passes to native code | input.c puts synthetic touchpad (motion, touchscreen source) and back-key events in front of the game's AInputQueue: `ALooper_pollAll/pollOnce` return the queue's ident while one waits, `AInputQueue_getEvent` hands it out, the AInputEvent/AKeyEvent/AMotionEvent imports answer for it. Right trigger = hold the touchpad, A = tap, right stick = swipe (up/down = swipe forward/back along the touchpad's X axis: Gunjack's `OnFlick` takes flick angles <45°/>315° as reload, 135-225° as special weapon), B/left menu = back (log `controllers: the game reads its AInputQueue`) |
@@ -84,6 +92,7 @@ version is `catalog/triage.yaml` (used by `frameport test` / the Job screen); ke
 | 32-bit Unity game on the bridge: player stands in the floor (Spunky Dungeon) | Unity's floor-level tracking origin: `vrapi_SetTrackingSpace(1)` (LOCAL_FLOOR) was ignored | The VrApi bridge puts the origin on the STAGE floor for LOCAL_FLOOR/STAGE |
 | Crash at start: `NoClassDefFoundError: … Landroid/window/OnBackInvokedCallback;` or `NoSuchMethodError: No static method storeStoreFence()V in class Ljava/lang/invoke/VarHandle;` (GitHub #71/#72, triage `android-too-new`) | The APK needs Android 13+ (minSdk 33 or more; those were 34) and calls its classes at start; Lepton's Android is 11 (API 30). OVRPort lowers minSdk to 29, so it installs anyway. minSdk ≤ 32 (Quest's Android 12L) is fine: 16 working catalog games declare 32 | None (analysis `extra.min_sdk` > 32 → a warning on the game page/CLI and in the recipe notes; never unsupported from the manifest alone, the launch test's triage decides). Waits for Valve to update Lepton's Android |
 | Nothing opens; `TWALauncherActivity: Using URL from Manifest (https://…)`, `Creating TwaLauncher for com.oculus.browser`, `NameNotFoundException: com.oculus.browser` (GitHub #86 Mahjong Table VR, triage `web-wrapper`) | The APK is a Trusted Web Activity (Bubblewrap / Meta's PWA packaging): a website that opens in Meta's browser, which Lepton doesn't have | None: open the URL in a browser. Analysis `extra.web_wrapper` (manifest meta-data `android.support.customtabs.trusted.DEFAULT_URL`, resolved through resources.arsc, or androidbrowserhelper's LauncherActivity) → a warning with the URL (not unsupported: the manifest alone never decides) |
+| A flat window, no VR and no way to interact; `Google VR Error [Daydream]: Google VR had a fatal issue while loading`, `class com/google/vr/sdk/base/CardboardViewNativeImpl not found` (32-bit bridge), `Unable to start service Intent { act=com.google.vr.vrcore.… }` (GitHub #335 Blade Runner: Revelations, triage `gvr-not-supported`) | A Google Daydream / Cardboard build: Google's VR SDK (GVR, `libgvr.so`) or the Cardboard SDK. Daydream needs Google's VrCore service, Cardboard draws a distorted side-by-side image for a phone screen; neither reaches OpenXR, the Frame's only way into the headset | None: get the game's Oculus build (Quest, Go or Gear VR), which goes through the normal path. Analysis `extra.google_vr` (`daydream`/`cardboard`: manifest categories `com.google.intent.category.DAYDREAM`/`CARDBOARD`, `enableVrMode="com.google.vr.vrcore/…"`, `libgvr.so`/Cardboard SDK libraries, GVR Java classes, Unity `vr-device-list`; not `libgvraudio.so`, which Quest games ship too) → a warning on the game page/CLI and in the recipe notes, only when the APK has no Oculus support; never unsupported from the manifest alone. A GVR → OpenXR shim (like the VrApi bridge) is possible in principle but not built |
 | `UnsatisfiedLinkError` / `cannot locate symbol "ovr_…"` | overport's platform loader lacks Meta platform functions | `frame.ovrstubs` (automatic, generated stubs) |
 | missing `ovrMessageType_ToString` | same, but the game needs a real string | `frame.ovrplatformcompat` (automatic) |
 | The game stays in its built-in language or waits at start although its OBB / files hold language packs (`<tag>.lang`, for example `de.lang`) | overport's platform loader answers `ovr_LanguagePack_GetCurrent/SetCurrent` with request id 0, so the game never gets the pack's path | `frame.langpacks` (opt-in, experimental, shown for games whose data has `*.lang`; `native/langpack`, build it with `python native/build.py --only langpack`). Default pack: the one the game applies, else env `FRAMEPORT_LANGPACK=<tag>`, else the only pack; search path override `FRAMEPORT_LANGPACK_DIRS`. Unreal games (Deadpool VR) gray out a pack whose asset `Metadata` differs from the game's version string: the patch writes the APK's versionName as Metadata (env `FRAMEPORT_LANGPACK_META` overrides) and reports the pack under the `/storage/emulated/0/Android/obb/<pkg>/` spelling of its path; with `/sdcard/…` the text switched but the dialogue stayed silent (verified in the headset with Deadpool VR) |
@@ -108,11 +117,14 @@ version is `catalog/triage.yaml` (used by `frameport test` / the Job screen); ke
 | Menu/screen jumps to where you look (for example 4XVR) | the app re-creates LOCAL spaces (4XVR: every 2–4 s) and the Frame places them at the current head yaw, or the app recenters after the Frame's brief focus dips | turn on `adapter.layer_debug`, check `that LOCAL space sits at … deg` vs `focus_hold: hid a … ms focus dip`; patches: `adapter.stable_local` (new LOCAL spaces line up with the first) / `adapter.focus_hold` (on by default: hides dips up to `focus_hold_ms` once the game has been focused for a second; never at start-up: a global debounce broke AC Nexus) |
 | Pointer misses menu items | the Frame's aim pose differs from Touch's | `adapter.layer_debug` logs `aim in grip … pitch/yaw`; correct with `aim_pitch`/`aim_yaw`/`aim_forward` (`frameport settings`, no rebuild) |
 | Video stutters although fps is steady | video frame rate doesn't divide the refresh rate (30 fps at 72 Hz) | `adapter.refresh_rate` (for example 90 for 30 fps, 72 for 24 fps); `layer_debug` logs the offered rates and the app's own requests |
+| A saved 90 Hz refresh setting still launches at 72 Hz (for example Jurassic World Aftermath); FrameBridge reads `refresh_rate=90` but logs result `-1000101000` | The Frame's OpenXR runtime only enumerates its current rate and rejects requests for another mode (`XR_ERROR_DISPLAY_REFRESH_RATE_UNSUPPORTED_FB`) | Agent v92 applies `adapter.refresh_rate` to SteamVR's per-game `preferredRefreshRate` through IVRSettings, on save/install and before Lepton starts (existing launchers upgrade on connection). `0` clears the override; unavailable SteamVR is retried at launch. Device-tested: Aftermath selected 90 Hz and sustained 90.2 fps |
 | PC VR game judders/stutters although the GPU keeps up; vrcompositor.txt "Timed out. N total" high or frames dropped | the game misses the headset's refresh (for example 96 Hz = 10.4 ms; Stormland's slow frames take 10.7 ms) | `pcvr.steamvr_tuning` (default on): next Play sets SteamVR per-app `preferredRefreshRate` + `motionSmoothingOverride` via `fp_vrsettings.exe` |
 | Quest app keeps recentering / snapping the view when you turn your head; log shows session state 5→4→3→4→5 within a second | the Frame briefly takes focus; the app recenters on focus changes | adapter `focus_hold` (on by default; an earlier global debounce made AC Nexus stay black and was removed) |
 | Video player / app finds no local videos; MediaProvider "Requested path /home/steamos/... doesn't appear under ..." | Lepton's /sdcard is a symlink to a host path, so Android's media index rejects every file | upload in the Files tab (Videos = /sdcard/Movies) and browse folders in the app |
 | Batman: Arkham Shadow closes during smoke-bomb effects; later input-tree corruption | Meta XR Audio Wwise deletes queued metadata still referenced by the current audio frame, then writes through the stale pointer | FrameBridge automatically retires metadata after current-frame references disappear, for the verified AArch64 SDK build only; see [AUDIO_METADATA.md](AUDIO_METADATA.md) |
 | Game stays on a loading or "Waiting" box although it reached FOCUSED; log `FrameBridge: xrEndFrame failed -25` then no more `pacing:` lines (for example PowerWash Simulator on some Frames, GitHub #39) | The eye image rect ends a few pixels past its swapchain (Unity rounds the swapchain width, the runtime's recommended size differs per Frame); SteamVR rejects every frame with XR_ERROR_SWAPCHAIN_RECT_INVALID | FrameBridge clamps every projection/quad image rect to its swapchain (`rect_clamp`, default on since 0.11.0; log `rect_clamp: view N image rect clamped`): rebuild + reinstall the game |
+| Black from the start, `projection view 0: ... rect=0,0 0x0` then `xrEndFrame failed -25` twice and OVRPlugin "Unable to submit Oculus frame" (BattleTalent, GitHub #293; right after Unity's "Switching to the recommended level" MSAA line) | The game submits its first projection views with an empty image rect; SteamVR rejects them and OVRPlugin gives up submitting | `rect_clamp` replaces an empty rect with the whole swapchain image (log `rect_clamp: view N empty image rect -> full swapchain WxH`): rebuild + reinstall. Check the build output for a WARN from the Unity IL2CPP fixes (`frame.unity_runtime_msaa_off` etc. "code not found in this game"): turned on, they may still change nothing |
+| Black flash, then the SteamVR home environment while the game keeps running (sound plays); vrserver.txt `[OpenXR] SetXrInputConfig failed. Failed to load manifest provided by SetXrInputConfig`, then the app "has exited" and reconnects as `VRApplication_OpenXRInstance`; headless launch tests pace at 10 fps (for example Scared By Squares, GitHub #323) | Two controller actions in one action set share a name (Unreal: an action mapping and an axis mapping both called "Turn"). The Frame's runtime accepts the duplicate but can't load the input manifest it builds and drops the app as a scene app | FrameBridge gives the later duplicate a free name (`action_dedup`, default on; log `action_dedup: action "turn" ("Turn") already exists in its set: created as "turn_2"`): rebuild + reinstall the game. `input_diag=1` logs every action set and action the game creates |
 | Unity game (OVRPlugin, GLES or Vulkan) crashes ~10 s in: `FrameBridge: xrCreateSwapchain … faces=6 … result=-2`, OVRPlugin `CreateSwapchain for eye 0: 0x0, 0 stages`, then render-thread SIGSEGV in memset ← libOVRPlugin ← `ovrp_EndFrame4` (libgallium/ANR follow; for example Budget Cuts Ultimate, GitHub #107); triage `cube-swapchain-refused` | The game shows a cube-map layer (OVROverlay cubemap); the Frame's runtime has no cube layers and refuses cube swapchains (XR_ERROR_RUNTIME_FAILURE); OVRPlugin doesn't check and writes into the image list it never got | FrameBridge `cube_standin` (default on): a refused cube swapchain is served as a GL cube map in the game's context or a device-local Vulkan cube image transitioned to COLOR_ATTACHMENT_OPTIMAL, and its layers are dropped (log `cube_standin: runtime refused …`): rebuild + reinstall. Vulkan path covers UNDERDOGS (GitHub #296); host-tested, headset verification pending |
 | Game (Unity, GLES) freezes, `zink: DEVICE LOST` | multisampled render-to-texture hangs the GPU | `frame.unity_no_msaa`; if it persists: unfixable → PC version |
 | Unreal GLES game crashes ~3 s after start: `Fatal signal 11 … fault addr 0x10000 in tid … (RHIThread)`, `#01 … libgallium_dri.so` (GitHub #83 Star Wars Pinball VR, triage `unreal-msrtt-crash`) | Unreal's mobile MSAA renders through multisampled render-to-texture; Zink's `find_rp_state` then indexes `rendering_state_cache[6]` one past its end (sample count ≥ 32) and calls a junk hash function (0x10000). Mesa bug (no bounds check) | `frame.unreal_gl_shim` (GL shim with `gl_hide_msrtt`, multiview kept for Unreal: Unreal 4.25 only enables multiview with GL_OVR_multiview, GL_OVR_multiview2 **and** GL_OVR_multiview_multisampled_render_to_texture, so the shim keeps the last one visible for Unreal and maps glFramebufferTextureMultisampleMultiviewOVR to the single-sampled glFramebufferTextureMultiviewOVR; log `multiview multisampled render-to-texture (N samples) drawn single-sampled`) |
@@ -133,11 +145,17 @@ version is `catalog/triage.yaml` (used by `frameport test` / the Job screen); ke
 | SDL / LÖVE app crashes at start: `NullPointerException … ClipboardManager.addPrimaryClipChangedListener` in `SDLClipboardHandler.<init>` (for example Dramatic Shape) | Lepton's Android has no clipboard service (`service check clipboard`: not found) | `frame.sdl_clipboard` (that call → nops in classes.dex, in place, `apk/dex.py`); reproduced and verified with LÖVE for Android 11.5 |
 | Godot 4 app crashes at start: `java.lang.NullPointerException: null cannot be cast to non-null type android.content.ClipboardManager` at `org.godotengine.godot.Godot.<init>` (Godot 4.3/4.4; 4.2 when the clipboard is first used, in `Godot$mClipboard$2.invoke`) (for example EndoparasiticVR, GitHub #134); triage `godot-no-clipboard` | Lepton's Android has no clipboard service and Godot's Kotlin code casts it with a non-null `as ClipboardManager` (`Intrinsics.checkNotNull` before the check-cast). Godot 4.1 (Java) and 4.5+ (`as?`) don't throw | `frame.godot_clipboard` (suggested by analysis `godot_clipboard`): that checkNotNull call → nops in classes.dex (check-cast accepts null), and Godot's getClipboard/hasClipboard/setClipboard return at once ("" / false / nothing; `Dex.return_early`), in place; matched exactly, other dex files untouched. Checked against the Maven godot-lib 4.2.2/4.3.0/4.4.1 and the 4.3/4.4.1 release export templates (D8 re-reads the result); not yet run on the device |
 | Game crashes at start: `java.lang.NoSuchMethodError: No virtual method getAvailableCommunicationDevices()… in class Landroid/media/AudioManager` at `com.vivox.sdk.AudioChangeListener.checkAudioRouteAndApplyChanges` (for example Green Hell VR, GitHub #101); triage `vivox-api31` | Newer Vivox (voice chat) builds call Android 12 audio-routing methods without a version check; Lepton is Android 11. Older Vivox builds (Eleven Table Tennis, BattleSisters) don't have that code | `frame.vivox_audio_route` (suggested by analysis `vivox_api31`): every AudioChangeListener method that calls one of them returns at once (`Dex.return_early`: return-void / `const/4 v0, 0; return v0`, in place); voice chat keeps the default audio route |
+| Game crashes when voice chat starts (Table Troopers: at the tutorial's start): `java.lang.NoSuchMethodError: No virtual method getAvailableCommunicationDevices()… in class Landroid/media/AudioManager` at `com.exitgames.photon.audioinaec.AudioInAEC.updateAudioDevice` ← `AudioInAEC$1.run` (GitHub #362/#325); triage `photon-voice-api31` (the same error from another library: `audio-api31`, report it) | Photon Voice's Android microphone plugin picks the audio device with Android 12 methods (getAvailableCommunicationDevices / setCommunicationDevice) and has no version check (it logs "Start: SDK >= 31, using BroadcastReceiver" on every Android); Lepton is Android 11. `frame.vivox_audio_route` only edits Vivox's class, so it can't help here | `frame.photon_voice_audio_route` (suggested by analysis `photon_voice_api31`): AudioInAEC.updateAudioDevice (void, the only caller) returns at once (`Dex.return_early`, in place); the microphone thread goes on (communication mode, echo canceller, AudioRecord) on the default route. Checked against Table Troopers' classes.dex; not yet run on the device |
 | A game on a microSD card or another drive doesn't start, loses its saves or loops at start; launch.log has `ln: cannot create symbolic link from 'Frame' to '/data/data/<pkg>'` or `Couldn't create directory for SharedPreferences file /data/user/0/<pkg>/…` (GitHub #213/#214/#215/#221: a card named "Steam Frame 512g"); triage `lepton-data-link-failed` | Valve's Lepton pastes `STEAM_COMPAT_DATA_PATH` unquoted into `sh -c "ln -s …/internal/<pkg> /data/data/<pkg>"` (liblepton mounting.sh) and APK paths into unquoted substitutions, so a path with a space never gets the app's internal storage | agent v83: the Quest launcher links the game folder to `~/.local/share/frameport/lepton-paths/<pkg>` at every start and gives Lepton that path (`app_dir_lines`); `upgrade_launchers` converts existing launchers at the next connection; deployment.json keeps the real path |
 | Start never finishes, 100 % CPU, launch.log of gigabytes repeating `EOSSDK.createKeychain` / `resetKeychain` (Beyond Sandbox, GitHub #214); triage `eos-keychain-loop` | Epic Online Services' Java keychain can't write its SharedPreferences and resets/creates without end (seen when the app had no internal storage, row above) | fix the storage first; `frame.eos_keychain_loop` (opt-in, offered by triage; analysis `eos_keychain`) makes `EOSSDK.resetKeychain` return at once (`Dex.return_early`) |
+| Game quits ~20 s after start (Titan Isles, GitHub #310); launch.log has `FATAL EXCEPTION: GoogleApiHandler` `java.lang.NoSuchMethodError: No virtual method permitUnsafeIntentLaunch()` at `com.google.android.gms.common.internal.zzp` (play-services-basement); triage `gms-android12-call` | Not the missing Play services: the APK was built for minSdk 32, so R8 folded Play services' `PlatformVersion.isAtLeastS()`/`isAtLeastSv2()` to `return true`; OVRPort lowers minSdk, the folded checks stay, and Lepton (Android 11) lacks the Android 12 method | `frame.gms_platform_version` (suggested by analysis `gms_folded_sdk_checks`): those constant checks return false again (in-place dex edit) |
+| App quits a few seconds after OpenXR starts (PianoVision, GitHub #297, after `frame.unity_appui_vibrator`); launch.log has `FATAL EXCEPTION: MidiDeviceConnectionWatchThread` `NullPointerException: … UsbManager.getDeviceList()' on a null object reference` at `jp.kshoji.driver.midi.device.MidiDeviceConnectionWatcher$MidiDeviceConnectionWatchThread.checkConnectedDevices`; triage `usb-midi-watcher` | Lepton's Android has no USB service (`getSystemService("usb")` is null); kshoji's USB MIDI driver polls it | `frame.usb_midi_watcher` (suggested by analysis `usb_midi_watcher`): the poll returns at once; no USB MIDI on the Frame |
+| Unity app quits ~1 s after start, before any OpenXR line (PianoVision, GitHub #297); launch.log has `FATAL EXCEPTION: main` `java.lang.NoClassDefFoundError: Failed resolution of: Landroid/os/VibratorManager;` at `com.unity3d.player.appui.AppUIGameActivity.onCreate`; triage `unity-appui-vibrator` | Unity's App UI package (its own GameActivity) gets the vibrator through Android 12's VibratorManager without a version check; Lepton runs Android 11 | `frame.unity_appui_vibrator` (suggested by analysis `unity_appui_vibrator`): that sequence leaves the vibrator null and the activity's vibrate methods return at once (in-place dex edit) |
 | Unity game freezes on its loading screen ~10-15 s in (Yupitergrad, GitHub #235); launch.log has `GrantPermissionsActivity: Permission grant result … permission=android.permission.BLUETOOTH_CONNECT`, then OVRPlugin `SetupDisplayObjects(): Unable to find EGLConfig for configId 0` and no more frames; triage `bhaptics-permission-prompt` | bHaptics' vest SDK (`com.bhaptics.commons.PermissionUtils.requestBluetoothPermission`) asks for Android 12's BLUETOOTH_CONNECT; on Lepton's Android 11 it can't be granted at install, so Android's permission screen takes the foreground for a moment, the game pauses/resumes and OVRPlugin's GLES compositor stops drawing | `frame.bhaptics_permission` (suggested by analysis `bhaptics_permission`): the request returns at once (`Dex.return_early`) |
 | Unity game aborts at start: `Abort message: 'cannot create thread specific key for __cxa_get_globals()'` (SIGABRT in a library such as `libFirebaseCppApp-*.so`, for example Wander 0.3570, GitHub #198); triage `pthread-keys-exhausted` | Bionic allows 128 pthread keys per process; Unity 6 takes ~40 (most without a destructor), large native libraries (Gecko `libxul.so`, Firebase, avatar SDKs) and the Frame's own libraries (Mesa/Zink, FrameBridge, OVRPort, Valve's Vulkan layers) take the rest | `frame.unity_tls_key_pool` (opt-in; suggested for Unity 6 with Firebase C++ or Gecko): libunity.so's `pthread_key_*`/`pthread_get/setspecific` imports are renamed to `fp_tkey_*` (`elf.rename_imports`, versions set global) and `libfp_tkeys.so` (`native/tlskeys`) is added to its DT_NEEDED; destructor-less keys become slots behind one real key (logs `fp_tkeys: pooling Unity's thread keys`). Approach by Klownicle (#198) |
 | Controllers do nothing (for example stuck on a setup screen); log: `xrSuggestInteractionProfileBindings … XR_ERROR_PATH_UNSUPPORTED` | the game only suggests bindings for Meta's newer profiles (Touch Plus / Touch Pro); the Frame's Android runtime knows `oculus/touch_controller`, not those | adapter `profile_remap` (default on): the bindings are suggested again for Touch (log: `controller profile … -> oculus/touch_controller`) |
+| Controllers "don't sync": virtual hands/controllers lie on the floor below you, no buttons (Unity OpenXR games that only suggest Touch Plus/Pro, e.g. Hotel Infinity #327); log with `input_diag=1`: only `meta/touch_controller_plus` (or Pro) suggested, `controller profile … -> oculus/touch_controller` | the runtime then reports `oculus/touch_controller` for each hand, a profile the game never suggested: Unity's OpenXR input creates no device for it | adapter `profile_remap` (default on) reports the game's own profile for such hands (log: `profile_remap: /user/hand/left reported as meta/touch_controller_plus`) |
+| Controllers "don't sync": hands on the floor below you, no buttons, in a Unity OpenXR game with Meta's OpenXR features (e.g. Spatial Zombies #328); log: `xrCreateAction: XR_ERROR_PATH_UNSUPPORTED` (input_diag: `xrCreateAction -> XR_ERROR_PATH_UNSUPPORTED (thumbstick)`), then `xrGetCurrentInteractionProfile: XR_ERROR_ACTIONSET_NOT_ATTACHED` | Meta's "Detached … Controller" devices add `/user/detached_controller_meta/left|right` to Unity's merged actions; the Frame has no XR_META_detached_controllers, the action fails and Unity attaches no action set (OVRPlugin's input goes with it) | adapter `profile_remap` (default on) leaves those paths out of actions and bindings (log: `profile_remap: action thumbstick without 2 detached-controller path(s)`) |
 | Some buttons do nothing or the wrong thing (for example a Quest game's X/Y on the Frame's left controller) | the game binds only Quest Touch and SteamVR maps Touch onto the Frame controllers with its own remap (Touch left X/Y land on the d-pad, right X and Y repeat B), or the runtime rejected a profile or an input call | turn on adapter `input_diag` (diagnostics, off by default; `frameport settings <pkg> input_diag=1`) and look for `input_diag:` lines: `bindings: <profile> accepted` or `unsupported: interaction profile <profile> -> <result>` with the rejected paths, `bindings: /user/hand/<hand> uses <profile>`, `unsupported: function <name>`, `unsupported: xrCreateAction -> <result> (<action>)` |
 | Unity game hangs or the whole Frame restarts (for example in a menu); log: `The current MSAA level is 0, but the recommended MSAA level is 4. Switching to the recommended level.` (for example Lucky's Tale) | Meta's OVRManager (`useRecommendedMSAALevel`) turns 4x MSAA on at runtime, past QualitySettings; multisampled render-to-texture on GLES/Zink hangs the GPU | `frame.unity_runtime_msaa_off` (Cpp2IL: `OVRDisplay.get_recommendedMSAALevel` → 0) |
 | Unity game: one eye shows only effects or gray, the other is fine (for example I Am Cat, Oculus XR Plugin on GLES) | the game's single-pass multiview rendering goes wrong for array slice 1 (the adapter submits both slices correctly) | `frame.unity_multipass` (Cpp2IL: `OculusSettings.GetStereoRenderingMode` → MultiPass); `swap_eyes=1` tells whether the game or the adapter is at fault |
@@ -168,9 +186,11 @@ version is `catalog/triage.yaml` (used by `frameport test` / the Job screen); ke
 | Black screen, audio works, log `Unsupported VrApi layer type N` | bridge drops frames containing that layer | extend the bridge (cylinder=3 is converted to a quad already) |
 | Only some draws visible (for example controllers) + `glGetError 0x502` | multiview shaders used on single-view FBOs | GL shim `gl_hide_multiview=1` (default) |
 | Own GLES engine (OpenXR, not VrApi): eye view fine, but HUD / menu / PDA panels black (for example Doom3Quest, GitHub #77; no error in the log) | every shader declares `layout(num_views=2) in;`, also the ones drawn into the engine's single-layer offscreen framebuffers (2D textures/renderbuffers); OVR_multiview makes such draws INVALID_OPERATION and Mesa drops them (`draw_validate.c`), Quest's driver doesn't | `frame.gl_multiview_fbo` (opt-in, experimental: `libfpglmv.so` interposes GLES and draws those cases with a single-view twin of the program; logs `GLMV: twin built: program N -> M`, per-5-s `single-view draws` counters; `gl_mv_debug=1` adds glGetError checks; triage `gl-multiview-twin-failed`). Alternative: the game's own fix (two-layer multiview pool, Xandrix's patch in #77) |
+| Team Beef idTech 4 port (PreyVR, GitHub #306): main menu black except the mouse cursor, loading screen fine, 72 fps, no GL error; one game thread at 100 % CPU | the game clock runs 1000 / refresh ms per tic (`USERCMD_MSEC`, from xrGetDisplayRefreshRateFB). The Frame's runtime lacks XR_FB_display_refresh_rate and OVRPort's dispatcher answered 0 Hz: 0 ms tics, the async thread spins (millions of tics/s) and `com_frameTime` stays 0, so the menu GUI stays at its first animation step (everything hidden) | FrameBridge (default, no setting) answers xrGetDisplayRefreshRateFB with the measured rate (1 / predictedDisplayPeriod, else 72 Hz); log `refresh rate: runtime reported 0.0 Hz (result -7), reporting 72.0 Hz`. Found with `gl_mv_debug=2` (`frameport settings <pkg> gl_mv_debug=2`, needs `frame.gl_multiview_fbo`): only 2 draws per frame (backdrop + cursor) and `trace clocks: com_frameTime=0` |
 | Upside-down image in a GL bridge game | GL images start at the bottom row | fixed in the bridge (swap angleUp/Down for GL chains) |
 | UI panels upside down (AC Nexus) | XrCompositionLayerImageLayoutFB VERTICAL_FLIP unsupported | adapter `flip_emul=1` (default); rotating quads makes them vanish |
 | Passthrough black (BAM) | XR_FB_passthrough missing | adapter `passthrough_emul=1` (default) + `patch_force_passthrough` for MR-only games |
+| Mixed reality inside out: the room shows on the game's objects, black where the room should be (Unreal, for example Star Wars: Beyond Victory, GitHub #329) | Unreal keeps 1 - coverage in the scene alpha and OVRPlugin chains XrCompositionLayerAlphaBlendFB (colour factors ONE_MINUS_SRC_ALPHA / SRC_ALPHA, `layer_debug` shows `n=1000041001(3,2/3,2)`) to the eye layer; the Frame's runtime ignores it | adapter `alpha_blend_emul=1` (default, Vulkan): inverts the alpha of the eye images in place while passthrough is emulated; logs `alpha_blend: inverting the alpha of swapchain=…` |
 | Quest Touch controllers (or none) shown in a game that uses Meta's runtime controller models | XR_FB_render_model missing on the Frame | adapter `controller_models=1`: the agent converts the Frame's SteamVR controller models to glb at install, the adapter serves them. Games with their own controller meshes aren't affected (none of the 34 catalog games use runtime models) |
 | `overportOXR: Unknown proc addr: xr…` for a function the adapter emulates | overport's dispatcher only forwards functions in its own table | route the plugin's lookups through `native/xrshim` (done for XR_FB_render_model when `controller_models=1`) |
 | MR game stuck waiting for room data (Demeter) | no Meta scene API | adapter `scene_emul=1` (+ `frame.meta_permissions`) |
@@ -184,6 +204,8 @@ version is `catalog/triage.yaml` (used by `frameport test` / the Job screen); ke
 | Unity game crashes or hangs right as Vulkan starts, after `SLZ Graphics plugin loading!` and OVRPlugin's pre-init `xrDestroyInstance`: SIGSEGV with pc 0 (or pc == fault address in an unloaded library), x16/x23 in `libSLZQuestNative.so` (BONELAB 1.2974) | Stress Level Zero's graphics plugin hooks Unity's Vulkan start-up (IUnityGraphicsVulkanV2 interception: vkCreateInstance/vkCreateDevice) and vkCreateSampler; its vkCreateInstance wrapper calls an invalid pointer on the Frame | `frame.slz_vulkan_hooks` (its two registrations become no-ops; Unity starts Vulkan itself; ~35 s of shader prewarming without its pipeline cache) |
 | Unity game shows a picture but the player body is frozen: no head tracking, the controllers stay on the model, no buttons, although OpenXR input works (BONELAB 1.2068, Oculus XR Plugin) | OVRPlugin reports the headset as not worn (`ovrp_GetUserPresent2` → 0) a few seconds after start, and the game's rig only follows a present user (Marrow `XRHMD.IsUserPresent` = Unity's HMD `UserPresence`) | `frame.unity_user_presence` (the Oculus XR Plugin's lookup → `libfp_ovrp.so`, reports present; log `user presence: OVRPlugin 0 …`) |
 | Unreal 5 game crashes at its first render pass, backtrace `vulkan.freedreno.so` ← `libVkLayer_fossilize.so` ← `libfp_vk.so (create_render_pass2)` (Metro Awakening) | a subpass without a depth attachment names a depth/stencil resolve attachment; the Frame's Turnip reads the missing depth attachment (NULL) | the Vulkan shim drops that resolve (always, FramePort after 0.11.0; log `dropped the depth resolve of subpass N (no depth attachment)`); triage `unreal-vulkan-driver-crash` |
+| Unreal game crashes before its first frame: SIGSEGV `fault addr 0x10` on the main thread, backtrace all `libUnreal.so` above the linker's `soinfo::call_constructors` (inside `System.loadLibrary`), right after `Parsing commandline` (GitHub #349, Transformers Beyond Reality) | The game is built with Unreal's Binned3 allocator, which reserves its whole range while the library loads: one `mmap(NULL, 76 GiB, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS)`. Quest grants it; the Frame's kernel (heuristic overcommit, mode 0) refuses a writable private mapping larger than RAM + swap, and Unreal's out-of-memory handler ("Ran out of memory allocating ...") dereferences its not-yet-created log | `frame.unreal_noreserve` (suggested from analysis `unreal_binned3`): every such anonymous read/write mmap in the engine library gets `MAP_NORESERVE` (one instruction each: `mov w3, #0x22` → `#0x4022`); triage `unreal-reserve-refused`. Found by disassembling the crash pc (the OOM handler; its UTF-16 format string) and the caller's `mov x0, #0x1300000000` |
+| Unreal Vulkan game fails on its first frames and OVRPlugin reports `foveationImage = 0x0, width = 0, height = 0` (for example Transformers Beyond Reality: Redux, #349) | Quest FB foveation remains advertised by OVRPort's dispatcher despite `foveation_fix=1`. This is a hypothesis for the failure, not a confirmed cause: Redux's alternate no-ForceQuit build dereferences a null graphics-pipeline-state object during Vulkan pipeline binding, not a density image | Diagnostic `adapter.hide_fb_foveation=1` (off by default, Vulkan): filters the dispatcher and runtime extension lists/instance requests, removes foveation create/image chains and refuses profile creation/updates. Rebuild with the adapter **and xrshim** artifacts, then compare first-frame survival and Unreal's original fatal log. Does not disable Valve FDM injection. Device verification pending |
 | Unreal 5 game crashes in `vulkan.freedreno.so` called straight from `libUnreal.so` right after its swapchains, or a few seconds into the first frames (Metro Awakening) | Unreal turns on fragment-density-map foveation because Turnip offers VK_EXT_fragment_density_map, then records barriers (to `FRAGMENT_DENSITY_MAP_OPTIMAL`) and image views (2D array R8G8) for a density map the Frame never provides (VK_NULL_HANDLE); Turnip dereferences it | adapter `vk_hide_fdm=1` (the game doesn't see the extension) + `vk_spec_fixes=1` (leaves out null-image barriers, refuses null-image views); triage `unreal-fdm-missing`. Found by disassembling the driver at the crash pc: the struct offsets (0x58 = VkSubpassDescription2, 0x48/0x60 = image barriers, viewType/format in registers) name the call |
 | Own-engine game crashes in `je_free` from its own library on the first frames (Roblox) | the game frees memory it doesn't own; not the Vulkan shim or the format fallback | unsupported |
 
@@ -267,28 +289,3 @@ Scan a folder with Rift game dumps (Windows game folders) like Quest dumps; they
 | Proton game hangs at start in a headless/SSH launch; log `no driver could be loaded` / `explorer process failed to start` | no display session (DISPLAY/GAMESCOPE_WAYLAND_DISPLAY) | the Proton launch.sh takes them from the running Steam (built in) |
 | Unreal game starts (window created) then `CrashReportClient` runs | the game crashed under Proton; often no VR runtime reached it (Revive off) | keep `pcvr.revive` on (repacks' bundled LibRevive64.dll isn't loaded by itself); read the game log + crash summary in the launch log |
 | `VK_ERROR_DEVICE_LOST` under DXVK | freedreno GPU hang | `pcvr.proton_log` to capture; PC mode |
-
-## Quest games on this PC (AXRB, `docs/PC_ANDROID.md`)
-
-| Symptom | Cause | Fix |
-|---|---|---|
-| Unconverted Quest APK in AXRB: no launcher activity, SIGABRT ~0.3 s after `libovrplatformloader.so` loads | Meta's platform loader aborts outside a Quest | FramePort always gives AXRB its OVRPort build (the PC build: OVRPort + `on_pc` APK fixes, no Steam Frame fixes) |
-| `axrb-no-headset`: host.err `failed to find D3D11 adapter requested by OpenXR runtime` / `xrCreateInstance failed: XR_ERROR_RUNTIME_FAILURE` | SteamVR has no headset (null driver: no D3D11 adapter; vrlink with no Frame connected: no instance) | connect the headset and let SteamVR show it first; for unattended tests use Monado's simulated headset: `frameport test <pkg> --to pc --sim` (docs/PC_ANDROID.md "Testing without a headset") |
-| Testing a PC (AXRB) game without a headset: need a D3D11 OpenXR session, but SteamVR must stay untouched | SteamVR without a headset gives no D3D11 adapter / no instance | `--sim` (or `FRAMEPORT_PC_XR_SIM=1`): portable Monado for Windows, simulated HMD + `ml2` controllers, selected per process with `XR_RUNTIME_JSON` (the system runtime stays SteamVR); AXRB's SteamVR app registration is skipped; frames in `<data>/logs/xr-sim/` (AXRB_CAPTURE_PREFIX), Monado's window via `xr_sim.capture()`. Service log `<data>/logs/xr-sim-service.log` |
-| `axrb-gfxstream-crash`: SIGSEGV in `vulkan.ranchu.so (gfxstream::vk::ResourceTracker::on_vkAllocateMemory)` from `libVkLayer_AXRB_runtime.so` (Pinball FX VR, UE5 Vulkan, headless) | the emulator's Vulkan path through AXRB's runtime layer | report to AXRB with diagnostics (`axrb/*` logs); recheck with the host attached |
-| `axrb-translation-crash`: crash in `libndk_translation.so (berberis::…)` | Android's ARM translation (AXRB issue #9, some Unity games) | nothing to patch; wait for AXRB's other translator |
-| Reinstall fails `INSTALL_FAILED_UPDATE_INCOMPATIBLE`, or the game data must be copied again | a copy signed with another key was installed in AXRB (e.g. by AXRB's own launcher); a full uninstall deletes the OBB folder and saves | uninstall it in AXRB first; FramePort keeps one key per game, so its own updates keep data |
-| A FramePort call that runs an AXRB script never returns although the script ended (emulator already up) | QEMU (`Start-Process`) and the adb server inherit the caller's handles; through WSL interop even a file or /dev/null keeps the relay open | `axrb.spawn_detached` starts the script through WMI (`Win32_Process.Create`, nothing inherited) and polls its PID; exit code from the log's `FP_EXIT` line |
-| Which AXRB runs a game? (`deployment.json` `backend`) | AXRB 2.x (AXRB-Emulatorless) has a direct mode (`axrb-direct.exe`, no emulator) that only renders Vulkan; 1.0.4 is the emulator | automatic: direct for `graphics` Vulkan, emulator for GLES/unknown; `pc.axrb_backend` (backend / translator / precompose / legacy-driver options) or `frameport install <pkg> --to pc --axrb-backend direct\|emulator`; a switch leaves the other backend's copy and saves where they are |
-| `axrb-direct-no-gles`: direct.log `eglInitialize … EGL_BAD_DISPLAY` / `Unable to initialize EGL` / Unity's `Unable to retrieve the default EGL display!` | the game draws with OpenGL ES; direct mode's EGL is a stub (no GLES renderer). Not reported once a Vulkan device exists (Unreal Vulkan builds probe EGL first) | install it for the emulator (`pc.axrb_backend` backend=emulator); automatic choice already does this when the analysis says GLES |
-| `axrb-direct-incomplete`: `Direct mode installation is incomplete` / `Direct mode is missing …` / `Preparing the AOSP application failed` | a direct-mode file of AXRB is missing, or the sysroot (`<runtime>\direct\sysroot`, receipt `.axrb-sysroot.json` digest + format) isn't complete | reinstall AXRB-Emulatorless or rebuild the local build (`FRAMEPORT_AXRB_DIRECT_DIR`), then `frameport pc install-axrb --backend direct` (re-runs AXRB's `make_sysroot.py --art`) |
-| `axrb-direct-no-vulkan`: `vulkan-1.dll is not installed: the guest has no GPU` | no Windows Vulkan loader/driver | install the GPU's current driver |
-| `axrb-direct-unhandled-instruction`: `fatal signal 4 (SIGILL)` in direct.log | Dynarmic (or Digitalis) can't execute an arm64 instruction | report to AXRB with diagnostics (`axrb/direct/*`); try `pc.axrb_backend` translator=digitalis (or dynarmic) or the emulator |
-| `axrb-direct-guest-crash` (`E/cpu: thread … fatal signal 11/7/6/5`), `axrb-direct-host-fault` (`E/host-fault:` / `E/fatal:` = axrb-direct.exe itself), `axrb-direct-java-crash` (`FATAL EXCEPTION`, `Runtime aborting`) | a crash under direct mode's translator/ART; usually a missing Android service (Meta/Play/account/DRM), a translation bug or an unsupported syscall/Binder call (`axrb-direct-unsupported-syscall`, warning) | the other translator or the emulator; report to AXRB with the backtrace in direct.log |
-| `axrb-direct-no-native-window`: `AXRB_AOSP_HOST_SURFACES 0`, then nothing (The Climb 2: last line `Loading plug-in CryHTTP`, the main thread busy-polls its looper) | NativeActivity games take their surface with `Window.takeSurface`; AXRB's direct mode (`HostWindow.attach`) only bridges SurfaceViews, so `APP_CMD_INIT_WINDOW` never comes | AXRB's side (drafted upstream issue + a ~40-line HostWindow patch, tested); FramePort can't fix it in the APK. With the patched bootstrap the game gets its window (`AXRB_AOSP_TAKEN_SURFACE`) |
-| `axrb-direct-vulkan-extensions`: CryEngine `Renderer initialization` → `CrySystem initialization failed!` with no vkCreateDevice (The Climb 2, direct mode) | the PC's driver lacks Quest-only device extensions (VK_EXT_fragment_density_map is the one Climb 2 requires; Android external memory too); AXRB's runtime also asks for AHB in direct mode | `frame.vk_android_extensions` (PC builds only, added automatically for direct-VrApi Vulkan games): the renderer's `vkEnumerateDeviceExtensionProperties` import → `libfp_vkext.so`, which lists them; AXRB drops them again at vkCreateDevice. The VrApi bridge leaves runtime extensions no device has out of `vrapi_GetDeviceExtensionsVulkan` |
-| AXRB under Monado's simulator: VrApi games only submit empty frames; bridge `initial recenter: head flags=0x0`, `EnterVrMode: no tracked head pose before deadline` | Monado's simulated head lacks POSITION_TRACKED, so AXRB's host never sets up its LOCAL origin (`local_origin_flags` 0) and every pose in LOCAL has flags 0 | `--sim` sets AXRB's test-only `AXRB_TEST_SYNTHETIC_HMD=2` (fixed standing head + valid LOCAL; direct mode's host only: AXRB 1.0.4's emulator host only knows `=1`, which it ignores for a valid head) and, for games on the emulator backend, runs Monado's qwerty head instead (POSITION_TRACKED, the host sets LOCAL: `AXRB OpenXR: LOCAL origin in tracking world=(0.000 1.600 0.000)`; its WMR controllers stay inactive in AXRB, `FRAMEPORT_PC_XR_SIM_HEAD=simulated` keeps the simulated head); real headsets need neither |
-| AXRB emulator, GLES VrApi game (Path of the Warrior): frames submitted but both eyes pure black (FrameBridge `snapshot` of the eye images: all 0), guest log `libEGL: called unimplemented OpenGL ES API` about once a second | the emulator's GLES translator ("OpenGL ES 3.1") has no `glCopyImageSubData`: the VrApi bridge's copy of the game's eye texture into the OpenXR image did nothing | the bridge copies with `glBlitFramebuffer` when the context lacks ES 3.2 / `GL_EXT_copy_image` (log `GLES eye copies: glBlitFramebuffer, no glCopyImageSubData (OpenGL ES 3.1 …)`) |
-| AXRB emulator, GLES game with menus/messages as quad layers (VrApi cylinders, OVROverlay): `xrEndFrame failed: -2` on every frame, or with `projection_only=1` the menus missing | AXRB 1.0.4's emulator refuses GLES frames with more than one layer | FrameBridge `projection_only=2` (the PC default for GLES): the quads after the projection layer are drawn into its eye images on the game's GL context, then the projection layer goes alone (log `projection_only=2: 1 quad layer(s) drawn into the main picture`) |
-| A direct-mode launch test ran its full time but ends in `axrb-direct-guest-crash` | the game crashed during AXRB's own stop (after `AXRB_AOSP_ACTIVITIES_STOPPED`; The Climb 2 after `ovr_Shutdown finished`) | triage turns it into the info finding `axrb-direct-crash-at-stop`; the verdict passes |
-| Direct-mode launch test: "NEVER_STARTED" although AXRB's bridge ran | direct.out never printed `AXRB_AOSP_ACTIVITY_CREATED`/`AXRB_AOSP_LIFECYCLE` (ART's first start is interpreted, `-Xint`: slow); the run script stops when the bridge loses its headset | check host.err (`axrb-no-headset`), direct.out/err; the test waits 5 min for the activity and stops through AXRB's `stop_game.ps1` (closes the bridge window, the game pauses and saves) |

native/README.md

@@ -13,13 +13,12 @@ embeds debug paths (`-g`) and the dex depends on the d8 version, so those differ
 |---|---|---|
 | `luajit/` | `arm64-v8a/libfp_luajit.so` | Pinned upstream LuaJIT with full-width lightuserdata (`frame.luajit_pointers`). Only the verified old Lua engine's shared public functions become imports; the original xLua API 105 bindings, LuaSocket helpers and `luaopen_perflib` remain in the game. No game library is bundled. Build: `python native/build.py --only luajit`; source revision + archive SHA-256 in `luajit/build.py`, MIT notices in `luajit/COPYRIGHT` and `artifacts/licenses/LuaJIT.txt`. `runtime.c` checks GC64 and the retained `xlua_gl` global-reference offset. `smoke.c` compares a real low-address allocation with the original library's own native static pointer; the unmodified library fails only the high-address case, the patched one round-trips both exactly. Startup verified on Frame; gameplay unverified. |
 | `adapter/` | `{arm64-v8a,armeabi-v7a}/libopenxr_loader_generic.so` | **FrameBridge**: replaces overport's generic loader (which is renamed `libopenxr_loader_original.so`) and fixes Steam Frame runtime gaps. Hooks xrCreateInstance, swapchains, xrEndFrame, spaces, xrPollEvent, … everything else is forwarded by `gen_forwarders.py`-generated tail calls. `scene_emu.c` = Meta scene/spatial-entity emulation; `flip_vk.c` = Vulkan blit for VERTICAL_FLIP quads. `session_fixes.c` = per-game session fixes, all off by default and hooked only when on (`layer_debug` diagnostics, `stable_local`, `focus_hold`, aim correction `aim_pitch/aim_yaw/aim_forward`, `refresh_rate`, `proximity_emul` = finger proximity (XR_FB_touch_controller_proximity, which the Frame lacks) from the capacitive touch inputs: OVRPlugin's `hand_thumb_proximity`/`hand_trigger_proximity` actions get extra Touch bindings); `input_diag.c` = controller-input diagnostics (setting `input_diag`, off by default and hooked only when on; logs suggested interaction profiles and the runtime's answers, each hand's current profile, functions the runtime lacks and failing input/haptics/perf calls, each line once; tested on the host by `tests/test_input_diag.py`); `layer_emul_gl.c` = `equirect_emul` (GLES sessions only): 360° equirect/equirect2 layers become one adapter projection layer, drawn by a worker thread with its own EGL context shared with the app's: each 360° image is converted to a cube map only when it changes, and the view is redrawn only after a 4° head turn (GL/EGL resolved with dlopen, so Vulkan games never load them); `layer_math.h` = their pose/face math, tested on the host by `tests/test_layer_emul.py`. `render_model.c` = XR_FB_render_model emulation (setting `controller_models`, off by default): serves `files/framebridge/controller_{left,right}.glb`, which the agent converts on the Frame from SteamVR's own Frame controller render models (never shipped by FramePort); tested on the host by `tests/test_render_model.py`. Settings: `libframe_settings.so` in the APK + `settings.conf`/`framebridge.conf` on the Frame. |
-| `vrapi-bridge/` | `arm64-v8a/libvrapi.so` | VrApi → OpenXR bridge from [Android-XR-Bridge/OVRPort](https://github.com/Android-XR-Bridge/OVRPort) `native/vrapi` at 5e7df52 (GPL-3.0, `LICENSE.upstream`; unchanged upstream as of OVRPort v1.2.5, which ships the unpatched code as its opt-in `patch_vrapi_openxr` in experimental CLI builds), with our changes in `upstream-patches/`: GLES sessions + GL texture swapchains, cylinder→quad layers, GL vertical flip, UNORM↔sRGB format twins, 30 s VR-mode deadline, VALID-only recenter, loading-icon layers skipped, runtime device extensions no Vulkan device offers left out of `vrapi_GetDeviceExtensionsVulkan` (AXRB's runtime asks for AHB also in its direct mode; not in `upstream-patches/` yet), `vrapi_PollEvent`/`RecenterPose`/`SetDisplayRefreshRate`/`GetSystemPropertyFloatArray` (BlazeRush imports them, GitHub #57), legacy compositor debug/volume frame flags accepted, full-rate Vulkan foveation images allocated as density attachments (The Climb, GitHub #238), diagnostics behind `-DOVP_GL_DIAG`. `upstream-patches/` reproduces these sources from the fork's `native/vrapi` (checked 2026-10-06 against its latest commit); upstream PRs Android-XR-Bridge/OVRPort#3-#8, tracked in GitHub #75. |
+| `vrapi-bridge/` | `arm64-v8a/libvrapi.so` | VrApi → OpenXR bridge from [Android-XR-Bridge/OVRPort](https://github.com/Android-XR-Bridge/OVRPort) `native/vrapi` at 5e7df52 (GPL-3.0, `LICENSE.upstream`; unchanged upstream as of OVRPort v1.2.5, which ships the unpatched code as its opt-in `patch_vrapi_openxr` in experimental CLI builds), with our changes in `upstream-patches/`: GLES sessions + GL texture swapchains, cylinder→quad layers, GL vertical flip, UNORM↔sRGB format twins, 30 s VR-mode deadline, VALID-only recenter, loading-icon layers skipped, `vrapi_PollEvent`/`RecenterPose`/`SetDisplayRefreshRate`/`GetSystemPropertyFloatArray` (BlazeRush imports them, GitHub #57), legacy compositor debug/volume frame flags accepted, full-rate Vulkan foveation images allocated as density attachments (The Climb, GitHub #238), diagnostics behind `-DOVP_GL_DIAG`. `upstream-patches/` reproduces these sources from the fork's `native/vrapi` (checked 2026-10-06 against its latest commit); upstream PRs Android-XR-Bridge/OVRPort#3-#8, tracked in GitHub #75. |
 | `platformcompat/` | `arm64-v8a/libovrplatformcompat.so` | Real `ovrMessageType_ToString` (same fork, `native/platform`). |
 | `langpack/` | `arm64-v8a/libfp_langpack.so` | Language packs for the Meta Platform SDK (patch `frame.langpacks`, opt-in). overport's platform loader is a dispatcher in front of Meta's own loader and answers `ovr_LanguagePack_GetCurrent/SetCurrent` with `return 0` (no reply ever). This library becomes the loader's first DT_NEEDED; the loader's own exports of the 31 functions it defines are made STB_LOCAL in `.dynsym` (`elf.hide_exports`, nothing moves), so symbol lookups reach the library first. It serves `<tag>.lang` files found in the game's OBB / app files (`$FRAMEPORT_LANGPACK_DIRS` overrides the search path) through `ovr_LanguagePack_*`, `ovr_AssetFile_GetList` (the loader's list + the packs) and `ovr_AssetFile_StatusById`; its own message queue is merged into `ovr_PopMessage`, and every handle that is not ours (an address-range check) goes to the loader's original function, whose address is read at run time from the loader's in-memory `.dynsym`. With patch `frame.asset_files` (marker byte `@FPASSETS@`, or env `FRAMEPORT_ASSET_FILES=1`) it also lists the data's `*.pak` content files as installed `default` asset files and answers `ovr_AssetFile_DownloadById` for them at once (a completed `DownloadUpdate`, then the result with the path). Host-tested against a stand-in loader (`tests/test_langpack.py`, plain `cc`, no NDK); the bionic/headset side is unverified. |
 | `glshim/` | `arm64-v8a/libglshim.so` | Mesa GLSL compatibility for GLAD engines (hooks eglGetProcAddress): comments out `#pragma` before `#extension`, enables `GL_EXT_shader_implicit_conversions`, hides GL_OVR_multiview (`gl_hide_multiview`, default 1) and logs failed shaders. `-DGLSHIM_TRACE` adds per-FBO draw/error tracing. |
 | `glmv/` | `arm64-v8a/libfpglmv.so` | Single-view draws of OVR_multiview programs (patch `frame.gl_multiview_fbo`, opt-in, GitHub #77). Mesa enforces OVR_multiview's rule that a draw's program declares as many views as the draw framebuffer has; engines that compile every shader with `num_views=2` and also draw into ordinary 2D framebuffers (Doom3Quest's HUD/PDA pool) lose those draws. The engine library gets it as first DT_NEEDED (direct `gl*` imports) and its `dlopen("libGLESv3.so")` string is rewritten to `libfpglmv.so` (same length; its `qgl*` dlsym table); linked `--no-as-needed` to libGLESv3 so dlsym on its handle finds everything it doesn't wrap. It records stage sources at glLinkProgram, caches the draw framebuffer's color-attachment view count per bind, and when a multiview program draws into a 0-view framebuffer it binds a lazily built twin (`glmv_rewrite.h`: num_views layout blanked, `gl_ViewID_OVR` -> `(0u)`; attribute locations + uniform block bindings copied, default-block uniforms copied before every such draw with a shadow to skip unchanged ones), draws, rebinds the original. Logcat tag `GLMV`; `gl_mv_debug=1`. The rewriter is host-tested on Doom3Quest's 19 shaders (`tests/test_gl_multiview_fbo.py`); untested on the device. |
 | `tlskeys/` | `arm64-v8a/libfp_tkeys.so` | Thread-key pool for Unity (patch `frame.unity_tls_key_pool`, opt-in, GitHub #198; approach and the first helper by Klownicle). Bionic allows 128 pthread keys per process; Unity 6 plus large native libraries (Firebase, Gecko) and the Frame's own libraries use them up (Wander: `cannot create thread specific key for __cxa_get_globals()`). libunity.so's four key imports are renamed to `fp_tkey_create/_delete/_get/_set` (`elf.rename_imports`, same `.dynstr` bytes, versions set global) and this library is added to its DT_NEEDED: keys without a destructor become slots (512, generation-tagged, `0x40000000 + slot`) in a per-thread table under one real key; keys with a destructor and all other libraries keep real keys. Lock-free get/set. Logs `fp_tkeys: pooling Unity's thread keys` once (tag FrameBridge). Host-tested (rename); not yet run on the device. |
-| `vkext/` | `arm64-v8a/libfp_vkext.so` | Quest Vulkan device extensions for builds for this PC (patch `frame.vk_android_extensions`, never on the Frame). AXRB's direct mode gives the game the Windows driver's device, which lacks `VK_EXT_fragment_density_map` and Android's external memory; CryEngine (The Climb 2) refuses to create its device without them. The renderer's `vkEnumerateDeviceExtensionProperties` import is renamed to `fpEnumerateDeviceExtensionProperties` (same length, `elf.rename_imports`) and this library added to its DT_NEEDED: it lists the real extensions plus the missing ones; AXRB's vkCreateDevice leaves those out again. Logs `fp_vkext: listing …` (tag FrameBridge). Seen working in direct mode (2026-10-16, headless). |
 | `zinkfix/` | `arm64-v8a/libVkLayer_fp_shaderfix.so` | Shader-fix Vulkan layer `VK_LAYER_FP_shader_fix` for OpenGL ES games (patch `frame.zink_shader_fix`): sits between Zink (Mesa's GL on Vulkan) and the driver and inserts the words of `zink_shader_fix` (same format as the Vulkan shim's `vk_shader_fix`: size + SHA-256 match) into SPIR-V modules; `zink_shader_dump=1` writes every distinct module to `files/fp_spirv/`. The engine library loads it first (DT_NEEDED); its constructor puts the layer in front of Android's GraphicsEnv debug layer list (private Android 11 `getDebugLayers`/`setDebugLayers`, found through libvulkan.so's dependencies) before EGL starts, so the loader picks it up from the app's lib dir. Exports only the enumeration functions and `VK_LAYER_FP_shader_fixGet*ProcAddr` (never plain `vk*` entry points). Vader Immortal's lightspeed shaders (Klownicle, GitHub #49). |
 | `xrlayer/` | `linux-arm64/libxr_frameport_timefix.so` + `XR_APILAYER_FRAMEPORT_timefix.json` | OpenXR API layer for Windows PC VR games under Proton on the Frame (glibc aarch64, built freestanding with the NDK's clang), on by default (patch `pcvr.xr_timefix`). Retries `xrCreateInstance` as an OpenXR 1.0 app when the runtime rejects 1.1 (the Frame's SteamVR runtime does, and Proton 11's VR helper asks for 1.1). Also emulates `xrConvertTimespecTimeToTimeKHR`/`xrConvertTimeToTimespecTimeKHR` if the runtime refuses them (the Frame's Android runtime does; its Linux runtime, used by Proton, supports them as of 2026-09-29 — so this part is only a fallback; Proton's wineopenxr needs them for `XR_KHR_win32_convert_performance_counter_time`, which Revive requires) with the adapter's xrWaitFrame-calibrated offset, and drops the extension from xrCreateInstance if the runtime rejects it. Enabled per game by the Proton launch.sh (`XR_API_LAYER_PATH`, `XR_ENABLE_API_LAYERS`). `tests/test_xrlayer.py` builds it for x86_64 and drives it via ctypes. |
 | `oculushmd/` | `win-x64/fp_oculushmd.exe` | PC VR counterpart of overport's `patch_oculus_unreal` (patch `pcvr.oculus_unreal`, default for Unreal Rift games on the Frame). Unreal's OculusHMD and LibOVR's `ovr_Detect` only start when the Windows named event `OculusHMDConnected` exists and is signalled (the Oculus service creates it). `fp_oculushmd.exe <command line>` creates it (manual reset, signalled), runs the command (Revive's injector) in a job object and keeps the event until every process in the job — the game and its children — has exited (fallback without job support: 3 minutes); returns the command's exit code and logs `FramePort oculushmd: …` to stderr (launch.log). Freestanding Windows x64 console exe (no CRT, no Windows SDK): the NDK's clang + `lld-link /Brepro` with a kernel32 import library generated by `llvm-dlltool`, so it's byte-reproducible. Tested on Windows from WSL with a build whose event name is `-DEVENT_NAME=L"…"` (the Oculus service owns the real event on a PC with the Oculus app). |

native/a32translator/src/jit.c

@@ -32,6 +32,12 @@ extern void jit_exit(void);
 #define HASH_BITS 18
 #define LTAB_BITS 18
 #define MAX_INSNS 96
+/* stubs one more instruction (up to 3: a helper or side exit, a conditional skip, its fall-through exit) and the
+ * block's final exit may still need; a block ends before fewer than this are left of MAX_STUBS. Without it, runs of
+ * helper-translated instructions (each needs a stub) overflowed the table: OpenSSL's sha1_block_data_order_armv8
+ * (~60 SHA1 crypto instructions in a row, Pinball FX2 VR, GitHub #342) killed the game (fatal "overflowed the code
+ * buffer"). */
+#define STUB_RESERVE 8
 
 static uint32_t *cache, *cache_cur, *cache_end;
 static jit_block *htab[1u << HASH_BITS];
@@ -1381,7 +1387,8 @@ static jit_block *translate(uint32_t pc, int thumb, uint32_t it, int *fault, int
         x->it = it_after;
         if (x->ended || b->overflow) break;
         /* a fused VCMP needs its VMRS in the same block (x->next is set, so it is within MAX_INSNS) */
-        if ((!x->skip_vmrs && (n + 1 >= MAX_INSNS || (size_t)(b->p - b->start) > (CACHE_MARGIN / 4) / 2)) ||
+        if ((!x->skip_vmrs && (n + 1 >= MAX_INSNS || (size_t)(b->p - b->start) > (CACHE_MARGIN / 4) / 2 ||
+                               x->nstubs > MAX_STUBS - STUB_RESERVE)) ||
             !(len = nlen ? nlen : decode_guest(cur, thumb, x->it, &in))) {
             jx_exit_direct(x, cur, thumb, x->it);
             break;

native/a32translator/tests/programs/sha1ce.c

@@ -0,0 +1,108 @@
+/* The ARMv8 crypto instructions (SHA1C/P/M/H/SU0/SU1), which the JIT translates through the interpreter (one exit
+ * stub each): dense() = 72 of them in a row, as dense as OpenSSL's sha1_block_data_order_armv8, whose block
+ * overflowed the JIT's stub table (fatal "overflowed the code buffer"; GitHub #342, Pinball FX2 VR); then a fully
+ * unrolled SHA-1 checked against known digests. Built with -march=armv8-a -mfpu=crypto-neon-fp-armv8. */
+#include <arm_neon.h>
+#include <stdio.h>
+#include <string.h>
+
+#define K0 0x5A827999u
+#define K1 0x6ED9EBA1u
+#define K2 0x8F1BBCDCu
+#define K3 0xCA62C1D6u
+
+/* 4 rounds: e1 = sha1h(a), abcd = sha1{c,p,m}(abcd, e0, w + k); then the message schedule */
+#define R(op, k, e_in, e_out, w) do { \
+        e_out = vsha1h_u32(vgetq_lane_u32(abcd, 0)); \
+        abcd = op(abcd, e_in, vaddq_u32(w, vdupq_n_u32(k))); \
+    } while (0)
+#define SCHED(w0, w1, w2, w3) (w0 = vsha1su1q_u32(vsha1su0q_u32(w0, w1, w2), w3))
+
+static void block(uint32_t st[5], const uint8_t *p)
+{
+    uint32x4_t abcd = vld1q_u32(st), abcd0 = abcd;
+    uint32_t e0 = st[4], e1, e00 = e0;
+    uint32x4_t w0 = vreinterpretq_u32_u8(vrev32q_u8(vld1q_u8(p)));
+    uint32x4_t w1 = vreinterpretq_u32_u8(vrev32q_u8(vld1q_u8(p + 16)));
+    uint32x4_t w2 = vreinterpretq_u32_u8(vrev32q_u8(vld1q_u8(p + 32)));
+    uint32x4_t w3 = vreinterpretq_u32_u8(vrev32q_u8(vld1q_u8(p + 48)));
+    R(vsha1cq_u32, K0, e0, e1, w0); SCHED(w0, w1, w2, w3);
+    R(vsha1cq_u32, K0, e1, e0, w1); SCHED(w1, w2, w3, w0);
+    R(vsha1cq_u32, K0, e0, e1, w2); SCHED(w2, w3, w0, w1);
+    R(vsha1cq_u32, K0, e1, e0, w3); SCHED(w3, w0, w1, w2);
+    R(vsha1cq_u32, K0, e0, e1, w0); SCHED(w0, w1, w2, w3);
+    R(vsha1pq_u32, K1, e1, e0, w1); SCHED(w1, w2, w3, w0);
+    R(vsha1pq_u32, K1, e0, e1, w2); SCHED(w2, w3, w0, w1);
+    R(vsha1pq_u32, K1, e1, e0, w3); SCHED(w3, w0, w1, w2);
+    R(vsha1pq_u32, K1, e0, e1, w0); SCHED(w0, w1, w2, w3);
+    R(vsha1pq_u32, K1, e1, e0, w1); SCHED(w1, w2, w3, w0);
+    R(vsha1mq_u32, K2, e0, e1, w2); SCHED(w2, w3, w0, w1);
+    R(vsha1mq_u32, K2, e1, e0, w3); SCHED(w3, w0, w1, w2);
+    R(vsha1mq_u32, K2, e0, e1, w0); SCHED(w0, w1, w2, w3);
+    R(vsha1mq_u32, K2, e1, e0, w1); SCHED(w1, w2, w3, w0);
+    R(vsha1mq_u32, K2, e0, e1, w2); SCHED(w2, w3, w0, w1);
+    R(vsha1pq_u32, K3, e1, e0, w3); SCHED(w3, w0, w1, w2);
+    R(vsha1pq_u32, K3, e0, e1, w0);
+    R(vsha1pq_u32, K3, e1, e0, w1);
+    R(vsha1pq_u32, K3, e0, e1, w2);
+    R(vsha1pq_u32, K3, e1, e0, w3);
+    vst1q_u32(st, vaddq_u32(abcd, abcd0));
+    st[4] = e0 + e00;
+}
+
+static void sha1(const char *msg, uint8_t out[20])
+{
+    uint32_t st[5] = {0x67452301u, 0xEFCDAB89u, 0x98BADCFEu, 0x10325476u, 0xC3D2E1F0u};
+    uint8_t buf[128] = {0};
+    size_t n = strlen(msg), blocks = (n + 9 + 63) / 64;
+    memcpy(buf, msg, n);
+    buf[n] = 0x80;
+    unsigned long long bits = (unsigned long long)n * 8;
+    for (int k = 0; k < 8; k++) buf[blocks * 64 - 1 - k] = (uint8_t)(bits >> (8 * k));
+    for (size_t b = 0; b < blocks; b++) block(st, buf + 64 * b);
+    for (int k = 0; k < 20; k++) out[k] = (uint8_t)(st[k / 4] >> (24 - 8 * (k % 4)));
+}
+
+/* 72 crypto instructions with nothing between them: denser than the compiler's code above, as dense as OpenSSL's
+ * hand-written rounds */
+__attribute__((noinline)) static void dense(uint32_t v[12])
+{
+    __asm__ volatile("vld1.32 {d0-d3}, [%0]!\n\t"
+                     "vld1.32 {d4-d5}, [%0]\n\t"
+                     ".rept 24\n\t"
+                     "sha1c.32 q0, q1, q2\n\t"
+                     "sha1h.32 q1, q0\n\t"
+                     "sha1su0.32 q2, q0, q1\n\t"
+                     ".endr\n\t"
+                     "vst1.32 {d4-d5}, [%0]\n\t"
+                     "sub %0, %0, #32\n\t"
+                     "vst1.32 {d0-d3}, [%0]"
+                     : "+r"(v)
+                     :
+                     : "memory", "d0", "d1", "d2", "d3", "d4", "d5");
+}
+
+int main(void)
+{
+    uint32_t v[12];
+    for (int k = 0; k < 12; k++) v[k] = 0x9e3779b9u * (k + 1);
+    for (int r = 0; r < 3; r++) dense(v);
+    printf("dense:");
+    for (int k = 0; k < 12; k++) printf(" %08x", v[k]);
+    printf("\n");
+
+    static const char *const msgs[] = {"", "abc", "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq"};
+    static const char *const want[] = {"da39a3ee5e6b4b0d3255bfef95601890afd80709",
+                                       "a9993e364706816aba3e25717850c26c9cd0d89d",
+                                       "84983e441c3bd26ebaae4aa1f95129e5e54670f1"};
+    int bad = 0;
+    for (int m = 0; m < 3; m++) {
+        uint8_t d[20];
+        char hex[41];
+        sha1(msgs[m], d);
+        for (int k = 0; k < 20; k++) sprintf(hex + 2 * k, "%02x", d[k]);
+        printf("sha1(\"%s\") = %s %s\n", msgs[m], hex, strcmp(hex, want[m]) ? "WRONG" : "ok");
+        bad |= strcmp(hex, want[m]) != 0;
+    }
+    return bad;
+}

native/a32translator/tests/run_programs.py

@@ -31,7 +31,9 @@ PROGRAMS = {  # name -> (source, variants, args)
     "jitguest": ("jitguest.c", ["arm", "thumb"], []),
     "exec": ("exec.c", ["arm", "thumb"], []),
     "bench": ("bench.c", ["arm", "thumb"], []),
+    "sha1ce": ("sha1ce.c", ["arm", "thumb"], []),
 }
+EXTRA_FLAGS = {"sha1ce.c": ["-march=armv8-a", "-mfpu=crypto-neon-fp-armv8"]}  # ARMv8 crypto instructions
 JIT_ONLY = {"bench"}  # far too slow for the interpreter under emulation
 
 
@@ -42,7 +44,7 @@ def build(name, src, variant):
         return out
     BUILD.mkdir(parents=True, exist_ok=True)
     cc = NDK_BIN / ("armv7a-linux-androideabi29-clang++" if src.endswith(".cpp") else "armv7a-linux-androideabi29-clang")
-    cmd = [str(cc), *VARIANTS[variant], "-mfpu=neon-vfpv4", "-static", "-g", str(srcp), "-lm", "-o", str(out)]
+    cmd = [str(cc), *VARIANTS[variant], "-mfpu=neon-vfpv4", *EXTRA_FLAGS.get(src, []), "-static", "-g", str(srcp), "-lm", "-o", str(out)]
     if src.endswith(".cpp"):
         cmd += ["-static-libstdc++", "-std=c++17"]
     subprocess.run(cmd, check=True)

native/adapter/action_names.h

@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: GPL-3.0-only
+// action_dedup (session_fixes.c, GitHub #323): a free name for a controller action whose name or localized name is
+// already used in its action set. No OpenXR types, so the host tests can compile it.
+#pragma once
+#include <stdio.h>
+#include <string.h>
+
+static size_t action_name_len(const char *s, size_t max) {  // strnlen (not in plain C11)
+    size_t n = 0;
+    while (n < max && s[n]) ++n;
+    return n;
+}
+
+// taken(ctx, name, localized): 1 when `name` or `localized` is already used in the set.
+typedef int (*action_name_taken_fn)(void *ctx, const char *name, const char *localized);
+
+// Writes "<name>_N" / "<localized> N" (N = 2..99, the first pair not taken; cut to fit name_size/localized_size
+// including the terminator) and returns 1; 0 when the original names are free or no free pair exists.
+static int action_unique_names(const char *name, const char *localized, action_name_taken_fn taken, void *ctx,
+                               char *out_name, size_t name_size, char *out_localized, size_t localized_size) {
+    if (!taken(ctx, name, localized) || name_size < 8 || localized_size < 8) return 0;
+    for (int n = 2; n < 100; ++n) {
+        char suffix[8], lsuffix[8];
+        snprintf(suffix, sizeof(suffix), "_%d", n);
+        snprintf(lsuffix, sizeof(lsuffix), " %d", n);
+        size_t keep = action_name_len(name, name_size - 1);
+        if (keep + strlen(suffix) > name_size - 1) keep = name_size - 1 - strlen(suffix);
+        snprintf(out_name, name_size, "%.*s%s", (int)keep, name, suffix);
+        size_t lkeep = action_name_len(localized, localized_size - 1);
+        if (lkeep + strlen(lsuffix) > localized_size - 1) lkeep = localized_size - 1 - strlen(lsuffix);
+        snprintf(out_localized, localized_size, "%.*s%s", (int)lkeep, localized, lsuffix);
+        if (!taken(ctx, out_name, out_localized)) return 1;
+    }
+    return 0;
+}

native/adapter/alpha_blend.frag

@@ -0,0 +1,5 @@
+#version 450
+// alpha_blend_vk.c: with blending (one minus destination alpha, zero) and only alpha written, the image's alpha
+// becomes 1 - alpha.
+layout(location=0) out vec4 outputColor;
+void main(){outputColor=vec4(0,0,0,1);}

native/adapter/alpha_blend.vert

@@ -0,0 +1,3 @@
+#version 450
+// A triangle that covers the whole viewport (alpha_blend_vk.c).
+void main(){vec2 p=vec2((gl_VertexIndex<<1)&2,gl_VertexIndex&2);gl_Position=vec4(p*2-1,0,1);}

native/adapter/alpha_blend_spv.h

@@ -0,0 +1,42 @@
+// Generated from alpha_blend.vert and alpha_blend.frag.
+static const uint32_t alpha_blend_vert_spv[] = {
+    0x07230203,0x00010000,0x000d000a,0x0000002c,0x00000000,0x00020011,0x00000001,0x0006000b,
+    0x00000001,0x4c534c47,0x6474732e,0x3035342e,0x00000000,0x0003000e,0x00000000,0x00000001,
+    0x0007000f,0x00000000,0x00000004,0x6e69616d,0x00000000,0x0000000c,0x0000001d,0x00040047,
+    0x0000000c,0x0000000b,0x0000002a,0x00050048,0x0000001b,0x00000000,0x0000000b,0x00000000,
+    0x00050048,0x0000001b,0x00000001,0x0000000b,0x00000001,0x00050048,0x0000001b,0x00000002,
+    0x0000000b,0x00000003,0x00050048,0x0000001b,0x00000003,0x0000000b,0x00000004,0x00030047,
+    0x0000001b,0x00000002,0x00020013,0x00000002,0x00030021,0x00000003,0x00000002,0x00030016,
+    0x00000006,0x00000020,0x00040017,0x00000007,0x00000006,0x00000002,0x00040015,0x0000000a,
+    0x00000020,0x00000001,0x00040020,0x0000000b,0x00000001,0x0000000a,0x0004003b,0x0000000b,
+    0x0000000c,0x00000001,0x0004002b,0x0000000a,0x0000000e,0x00000001,0x0004002b,0x0000000a,
+    0x00000010,0x00000002,0x00040017,0x00000017,0x00000006,0x00000004,0x00040015,0x00000018,
+    0x00000020,0x00000000,0x0004002b,0x00000018,0x00000019,0x00000001,0x0004001c,0x0000001a,
+    0x00000006,0x00000019,0x0006001e,0x0000001b,0x00000017,0x00000006,0x0000001a,0x0000001a,
+    0x00040020,0x0000001c,0x00000003,0x0000001b,0x0004003b,0x0000001c,0x0000001d,0x00000003,
+    0x0004002b,0x0000000a,0x0000001e,0x00000000,0x0004002b,0x00000006,0x00000020,0x40000000,
+    0x0004002b,0x00000006,0x00000022,0x3f800000,0x0004002b,0x00000006,0x00000025,0x00000000,
+    0x00040020,0x00000029,0x00000003,0x00000017,0x0005002c,0x00000007,0x0000002b,0x00000022,
+    0x00000022,0x00050036,0x00000002,0x00000004,0x00000000,0x00000003,0x000200f8,0x00000005,
+    0x0004003d,0x0000000a,0x0000000d,0x0000000c,0x000500c4,0x0000000a,0x0000000f,0x0000000d,
+    0x0000000e,0x000500c7,0x0000000a,0x00000011,0x0000000f,0x00000010,0x0004006f,0x00000006,
+    0x00000012,0x00000011,0x000500c7,0x0000000a,0x00000014,0x0000000d,0x00000010,0x0004006f,
+    0x00000006,0x00000015,0x00000014,0x00050050,0x00000007,0x00000016,0x00000012,0x00000015,
+    0x0005008e,0x00000007,0x00000021,0x00000016,0x00000020,0x00050083,0x00000007,0x00000024,
+    0x00000021,0x0000002b,0x00050051,0x00000006,0x00000026,0x00000024,0x00000000,0x00050051,
+    0x00000006,0x00000027,0x00000024,0x00000001,0x00070050,0x00000017,0x00000028,0x00000026,
+    0x00000027,0x00000025,0x00000022,0x00050041,0x00000029,0x0000002a,0x0000001d,0x0000001e,
+    0x0003003e,0x0000002a,0x00000028,0x000100fd,0x00010038,
+};
+static const uint32_t alpha_blend_frag_spv[] = {
+    0x07230203,0x00010000,0x000d000a,0x0000000d,0x00000000,0x00020011,0x00000001,0x0006000b,
+    0x00000001,0x4c534c47,0x6474732e,0x3035342e,0x00000000,0x0003000e,0x00000000,0x00000001,
+    0x0006000f,0x00000004,0x00000004,0x6e69616d,0x00000000,0x00000009,0x00030010,0x00000004,
+    0x00000007,0x00040047,0x00000009,0x0000001e,0x00000000,0x00020013,0x00000002,0x00030021,
+    0x00000003,0x00000002,0x00030016,0x00000006,0x00000020,0x00040017,0x00000007,0x00000006,
+    0x00000004,0x00040020,0x00000008,0x00000003,0x00000007,0x0004003b,0x00000008,0x00000009,
+    0x00000003,0x0004002b,0x00000006,0x0000000a,0x00000000,0x0004002b,0x00000006,0x0000000b,
+    0x3f800000,0x0007002c,0x00000007,0x0000000c,0x0000000a,0x0000000a,0x0000000a,0x0000000b,
+    0x00050036,0x00000002,0x00000004,0x00000000,0x00000003,0x000200f8,0x00000005,0x0003003e,
+    0x00000009,0x0000000c,0x000100fd,0x00010038,
+};

native/adapter/alpha_blend_vk.c

@@ -0,0 +1,301 @@
+// SPDX-License-Identifier: GPL-3.0-only
+// Included by frame_adapter.c after flip_vk.c. XR_FB_composition_layer_alpha_blend for emulated passthrough
+// (setting alpha_blend_emul, Vulkan sessions).
+//
+// Passthrough is emulated by compositing the game's projection layer over the Frame's cameras with its texture alpha
+// (ALPHA_BLEND environment). Unreal's mobile renderer keeps 1 - coverage in the scene alpha (0 where it drew, 1 where
+// it drew nothing), and Meta's OVRPlugin compensates with an XrCompositionLayerAlphaBlendFB on the eye layer
+// (source colour factor ONE_MINUS_SRC_ALPHA, destination SRC_ALPHA). The Frame's runtime ignores that struct, so the
+// cameras showed through the scene and the empty background stayed black (GitHub #329, Star Wars: Beyond Victory).
+// Blending src * (1 - a) + dst * a is the same as the runtime's standard blend with alpha 1 - a, so the alpha of the
+// layer's image rectangles is inverted in place, once per acquired image, by a tiny render pass (blend: one minus
+// destination alpha, zero; only alpha written) before the frame goes to the runtime. Our work is queued on the app's
+// queue ahead of the runtime's xrEndFrame submission; command buffers come from a ring and are only waited for when
+// reused, several frames later.
+#include "alpha_blend_spv.h"
+
+#define AB_RING 4
+#define AB_TARGETS 32
+
+static struct {
+    VkDevice device;  // the session's device these objects belong to
+    int state;        // 0 = not set up, 1 = ready, -1 = failed
+    VkFormat format;  // the pipeline's colour format
+    PFN_vkCreateShaderModule CreateShaderModule;
+    PFN_vkDestroyShaderModule DestroyShaderModule;
+    PFN_vkCreatePipelineLayout CreatePipelineLayout;
+    PFN_vkCreateRenderPass CreateRenderPass;
+    PFN_vkDestroyRenderPass DestroyRenderPass;
+    PFN_vkCreateGraphicsPipelines CreateGraphicsPipelines;
+    PFN_vkDestroyPipeline DestroyPipeline;
+    PFN_vkCreateImageView CreateImageView;
+    PFN_vkDestroyImageView DestroyImageView;
+    PFN_vkCreateFramebuffer CreateFramebuffer;
+    PFN_vkDestroyFramebuffer DestroyFramebuffer;
+    PFN_vkCmdBeginRenderPass CmdBeginRenderPass;
+    PFN_vkCmdEndRenderPass CmdEndRenderPass;
+    PFN_vkCmdBindPipeline CmdBindPipeline;
+    PFN_vkCmdSetViewport CmdSetViewport;
+    PFN_vkCmdSetScissor CmdSetScissor;
+    PFN_vkCmdDraw CmdDraw;
+    VkShaderModule vs, fs;
+    VkPipelineLayout layout;
+    VkRenderPass pass;
+    VkPipeline pipeline;
+    VkCommandBuffer cmd[AB_RING];
+    VkFence fence[AB_RING];
+    int pending[AB_RING], next;
+    struct { XrSwapchain swapchain; VkImage image; uint32_t layer, w, h; VkImageView view; VkFramebuffer fb; } targets[AB_TARGETS];
+} ab;
+
+static int ab_functions(void) {
+#define AB_DEV(name) ab.name = (PFN_vk##name)vk.GetDeviceProcAddr(vk.device, "vk" #name); if (!ab.name) return 0;
+    AB_DEV(CreateShaderModule) AB_DEV(DestroyShaderModule) AB_DEV(CreatePipelineLayout) AB_DEV(CreateRenderPass)
+    AB_DEV(DestroyRenderPass) AB_DEV(CreateGraphicsPipelines) AB_DEV(DestroyPipeline) AB_DEV(CreateImageView)
+    AB_DEV(DestroyImageView) AB_DEV(CreateFramebuffer) AB_DEV(DestroyFramebuffer) AB_DEV(CmdBeginRenderPass)
+    AB_DEV(CmdEndRenderPass) AB_DEV(CmdBindPipeline) AB_DEV(CmdSetViewport) AB_DEV(CmdSetScissor) AB_DEV(CmdDraw)
+#undef AB_DEV
+    return 1;
+}
+
+// Command buffers, fences and shaders: once per session device.
+static int ab_ready(void) {
+    if (ab.device != vk.device) {  // a new session (the old device's objects went with it)
+        memset(&ab, 0, sizeof(ab));
+        ab.device = vk.device;
+    }
+    if (ab.state) return ab.state > 0;
+    ab.state = -1;
+    if (!vk_ready() || !ab_functions()) return 0;
+    VkCommandBufferAllocateInfo alloc = {VK_STRUCTURE_TYPE_COMMAND_BUFFER_ALLOCATE_INFO, NULL, vk.pool,
+                                         VK_COMMAND_BUFFER_LEVEL_PRIMARY, AB_RING};
+    if (vk.AllocateCommandBuffers(vk.device, &alloc, ab.cmd) != VK_SUCCESS) return 0;
+    for (int i = 0; i < AB_RING; ++i) {
+        VkFenceCreateInfo fence = {VK_STRUCTURE_TYPE_FENCE_CREATE_INFO, NULL, 0};
+        if (vk.CreateFence(vk.device, &fence, NULL, &ab.fence[i]) != VK_SUCCESS) return 0;
+    }
+    VkShaderModuleCreateInfo vs = {VK_STRUCTURE_TYPE_SHADER_MODULE_CREATE_INFO, NULL, 0, sizeof(alpha_blend_vert_spv),
+                                   alpha_blend_vert_spv};
+    VkShaderModuleCreateInfo fs = {VK_STRUCTURE_TYPE_SHADER_MODULE_CREATE_INFO, NULL, 0, sizeof(alpha_blend_frag_spv),
+                                   alpha_blend_frag_spv};
+    if (ab.CreateShaderModule(vk.device, &vs, NULL, &ab.vs) != VK_SUCCESS ||
+        ab.CreateShaderModule(vk.device, &fs, NULL, &ab.fs) != VK_SUCCESS) return 0;
+    VkPipelineLayoutCreateInfo layout = {VK_STRUCTURE_TYPE_PIPELINE_LAYOUT_CREATE_INFO, NULL, 0, 0, NULL, 0, NULL};
+    if (ab.CreatePipelineLayout(vk.device, &layout, NULL, &ab.layout) != VK_SUCCESS) return 0;
+    ab.state = 1;
+    return 1;
+}
+
+// Render pass + pipeline for one colour format (the eye swapchains': rebuilt only if it changes).
+static int ab_pipeline(VkFormat format) {
+    if (ab.pipeline && ab.format == format) return 1;
+    if (ab.pipeline) { ab.DestroyPipeline(vk.device, ab.pipeline, NULL); ab.pipeline = VK_NULL_HANDLE; }
+    if (ab.pass) { ab.DestroyRenderPass(vk.device, ab.pass, NULL); ab.pass = VK_NULL_HANDLE; }
+    VkAttachmentDescription color = {0, format, VK_SAMPLE_COUNT_1_BIT, VK_ATTACHMENT_LOAD_OP_LOAD,
+                                     VK_ATTACHMENT_STORE_OP_STORE, VK_ATTACHMENT_LOAD_OP_DONT_CARE,
+                                     VK_ATTACHMENT_STORE_OP_DONT_CARE, VK_IMAGE_LAYOUT_COLOR_ATTACHMENT_OPTIMAL,
+                                     VK_IMAGE_LAYOUT_COLOR_ATTACHMENT_OPTIMAL};
+    VkAttachmentReference ref = {0, VK_IMAGE_LAYOUT_COLOR_ATTACHMENT_OPTIMAL};
+    VkSubpassDescription subpass = {0, VK_PIPELINE_BIND_POINT_GRAPHICS, 0, NULL, 1, &ref, NULL, NULL, 0, NULL};
+    VkSubpassDependency deps[2] = {
+        // the app's rendering into the image (any stage) before our read-modify-write
+        {VK_SUBPASS_EXTERNAL, 0, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_PIPELINE_STAGE_COLOR_ATTACHMENT_OUTPUT_BIT,
+         VK_ACCESS_MEMORY_WRITE_BIT, VK_ACCESS_COLOR_ATTACHMENT_READ_BIT | VK_ACCESS_COLOR_ATTACHMENT_WRITE_BIT, 0},
+        // and ours before whatever the runtime does with it next
+        {0, VK_SUBPASS_EXTERNAL, VK_PIPELINE_STAGE_COLOR_ATTACHMENT_OUTPUT_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT,
+         VK_ACCESS_COLOR_ATTACHMENT_WRITE_BIT, VK_ACCESS_MEMORY_READ_BIT | VK_ACCESS_MEMORY_WRITE_BIT, 0},
+    };
+    VkRenderPassCreateInfo rp = {VK_STRUCTURE_TYPE_RENDER_PASS_CREATE_INFO, NULL, 0, 1, &color, 1, &subpass, 2, deps};
+    if (ab.CreateRenderPass(vk.device, &rp, NULL, &ab.pass) != VK_SUCCESS) { ab.pass = VK_NULL_HANDLE; return 0; }
+    VkPipelineShaderStageCreateInfo stages[2] = {
+        {VK_STRUCTURE_TYPE_PIPELINE_SHADER_STAGE_CREATE_INFO, NULL, 0, VK_SHADER_STAGE_VERTEX_BIT, ab.vs, "main", NULL},
+        {VK_STRUCTURE_TYPE_PIPELINE_SHADER_STAGE_CREATE_INFO, NULL, 0, VK_SHADER_STAGE_FRAGMENT_BIT, ab.fs, "main", NULL},
+    };
+    VkPipelineVertexInputStateCreateInfo input = {VK_STRUCTURE_TYPE_PIPELINE_VERTEX_INPUT_STATE_CREATE_INFO};
+    VkPipelineInputAssemblyStateCreateInfo assembly = {VK_STRUCTURE_TYPE_PIPELINE_INPUT_ASSEMBLY_STATE_CREATE_INFO, NULL,
+                                                       0, VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST, VK_FALSE};
+    VkPipelineViewportStateCreateInfo viewport = {VK_STRUCTURE_TYPE_PIPELINE_VIEWPORT_STATE_CREATE_INFO, NULL, 0, 1, NULL,
+                                                  1, NULL};
+    VkPipelineRasterizationStateCreateInfo raster = {VK_STRUCTURE_TYPE_PIPELINE_RASTERIZATION_STATE_CREATE_INFO};
+    raster.polygonMode = VK_POLYGON_MODE_FILL;
+    raster.cullMode = VK_CULL_MODE_NONE;
+    raster.lineWidth = 1.0f;
+    VkPipelineMultisampleStateCreateInfo multisample = {VK_STRUCTURE_TYPE_PIPELINE_MULTISAMPLE_STATE_CREATE_INFO};
+    multisample.rasterizationSamples = VK_SAMPLE_COUNT_1_BIT;
+    VkPipelineColorBlendAttachmentState blend = {VK_TRUE, VK_BLEND_FACTOR_ZERO, VK_BLEND_FACTOR_ONE, VK_BLEND_OP_ADD,
+                                                 VK_BLEND_FACTOR_ONE_MINUS_DST_ALPHA, VK_BLEND_FACTOR_ZERO,
+                                                 VK_BLEND_OP_ADD, VK_COLOR_COMPONENT_A_BIT};
+    VkPipelineColorBlendStateCreateInfo blending = {VK_STRUCTURE_TYPE_PIPELINE_COLOR_BLEND_STATE_CREATE_INFO};
+    blending.attachmentCount = 1;
+    blending.pAttachments = &blend;
+    VkDynamicState dynamic_states[2] = {VK_DYNAMIC_STATE_VIEWPORT, VK_DYNAMIC_STATE_SCISSOR};
+    VkPipelineDynamicStateCreateInfo dynamic = {VK_STRUCTURE_TYPE_PIPELINE_DYNAMIC_STATE_CREATE_INFO, NULL, 0, 2,
+                                                dynamic_states};
+    VkGraphicsPipelineCreateInfo pipeline = {VK_STRUCTURE_TYPE_GRAPHICS_PIPELINE_CREATE_INFO};
+    pipeline.stageCount = 2;
+    pipeline.pStages = stages;
+    pipeline.pVertexInputState = &input;
+    pipeline.pInputAssemblyState = &assembly;
+    pipeline.pViewportState = &viewport;
+    pipeline.pRasterizationState = &raster;
+    pipeline.pMultisampleState = &multisample;
+    pipeline.pColorBlendState = &blending;
+    pipeline.pDynamicState = &dynamic;
+    pipeline.layout = ab.layout;
+    pipeline.renderPass = ab.pass;
+    if (ab.CreateGraphicsPipelines(vk.device, VK_NULL_HANDLE, 1, &pipeline, NULL, &ab.pipeline) != VK_SUCCESS) {
+        ab.pipeline = VK_NULL_HANDLE;
+        return 0;
+    }
+    ab.format = format;
+    // framebuffers were made for the old render pass (compatible only with the same format): drop them
+    for (int i = 0; i < AB_TARGETS; ++i)
+        if (ab.targets[i].fb) {
+            ab.DestroyFramebuffer(vk.device, ab.targets[i].fb, NULL);
+            ab.DestroyImageView(vk.device, ab.targets[i].view, NULL);
+            memset(&ab.targets[i], 0, sizeof(ab.targets[i]));
+        }
+    LOG("alpha_blend: Vulkan alpha inversion ready (format %d)", (int)format);
+    return 1;
+}
+
+static void ab_wait_all(void) {
+    for (int i = 0; i < AB_RING; ++i)
+        if (ab.pending[i]) {
+            vk.WaitForFences(vk.device, 1, &ab.fence[i], VK_TRUE, 1000000000ull);
+            vk.ResetFences(vk.device, 1, &ab.fence[i]);
+            ab.pending[i] = 0;
+        }
+}
+
+// The view + framebuffer of one array layer of a swapchain image.
+static VkFramebuffer ab_target(XrSwapchain swapchain, VkImage image, uint32_t layer, VkFormat format, uint32_t w, uint32_t h) {
+    int free_slot = -1;
+    for (int i = 0; i < AB_TARGETS; ++i) {
+        if (ab.targets[i].fb && ab.targets[i].image == image && ab.targets[i].layer == layer &&
+            ab.targets[i].swapchain == swapchain) return ab.targets[i].fb;
+        if (!ab.targets[i].fb && free_slot < 0) free_slot = i;
+    }
+    if (free_slot < 0) return VK_NULL_HANDLE;
+    VkImageViewCreateInfo vi = {VK_STRUCTURE_TYPE_IMAGE_VIEW_CREATE_INFO, NULL, 0, image, VK_IMAGE_VIEW_TYPE_2D, format,
+                                {VK_COMPONENT_SWIZZLE_IDENTITY, VK_COMPONENT_SWIZZLE_IDENTITY,
+                                 VK_COMPONENT_SWIZZLE_IDENTITY, VK_COMPONENT_SWIZZLE_IDENTITY},
+                                {VK_IMAGE_ASPECT_COLOR_BIT, 0, 1, layer, 1}};
+    VkImageView view;
+    if (ab.CreateImageView(vk.device, &vi, NULL, &view) != VK_SUCCESS) return VK_NULL_HANDLE;
+    VkFramebufferCreateInfo fi = {VK_STRUCTURE_TYPE_FRAMEBUFFER_CREATE_INFO, NULL, 0, ab.pass, 1, &view, w, h, 1};
+    VkFramebuffer fb;
+    if (ab.CreateFramebuffer(vk.device, &fi, NULL, &fb) != VK_SUCCESS) {
+        ab.DestroyImageView(vk.device, view, NULL);
+        return VK_NULL_HANDLE;
+    }
+    ab.targets[free_slot].swapchain = swapchain;
+    ab.targets[free_slot].image = image;
+    ab.targets[free_slot].layer = layer;
+    ab.targets[free_slot].w = w;
+    ab.targets[free_slot].h = h;
+    ab.targets[free_slot].view = view;
+    ab.targets[free_slot].fb = fb;
+    return fb;
+}
+
+// xrDestroySwapchain (before the runtime's): our views and framebuffers of its images go first.
+static void ab_on_destroy(XrSwapchain swapchain) {
+    if (ab.state <= 0 || ab.device != vk.device) return;
+    int any = 0;
+    for (int i = 0; i < AB_TARGETS; ++i) any |= ab.targets[i].fb && ab.targets[i].swapchain == swapchain;
+    if (!any) return;
+    ab_wait_all();
+    for (int i = 0; i < AB_TARGETS; ++i)
+        if (ab.targets[i].fb && ab.targets[i].swapchain == swapchain) {
+            ab.DestroyFramebuffer(vk.device, ab.targets[i].fb, NULL);
+            ab.DestroyImageView(vk.device, ab.targets[i].view, NULL);
+            memset(&ab.targets[i], 0, sizeof(ab.targets[i]));
+        }
+}
+
+// Inverts the alpha of one projection view's rectangle in the image the app last acquired from its swapchain
+// (Vulkan; once per acquire). Returns 1 when done or already done for this image, 0 when it couldn't be done.
+static int ab_invert_view(const XrSwapchainSubImage *sub) {
+    if (!vk.device) return 0;  // not a Vulkan session
+    int ok = 0;
+    pthread_mutex_lock(&flip_lock);
+    tracked_swapchain *t = find_tracked(sub->swapchain, 0);
+    uint32_t index = t ? t->last_acquired : 0, layer = sub->imageArrayIndex;
+    XrRect2Di rect = sub->imageRect;
+    if (!t || !t->image_count || index >= t->image_count || layer >= 32 || rect.extent.width <= 0 ||
+        rect.extent.height <= 0 || t->info.sampleCount > 1 ||
+        !(t->info.usageFlags & XR_SWAPCHAIN_USAGE_COLOR_ATTACHMENT_BIT))
+        goto done;
+    if (t->alpha_inverted[index] & (1u << layer)) { ok = 1; goto done; }  // a static frame submitted again
+    if (!ab_ready() || !ab_pipeline((VkFormat)t->info.format)) goto done;
+    VkFramebuffer fb = ab_target(sub->swapchain, t->images[index], layer, (VkFormat)t->info.format, t->info.width,
+                                 t->info.height);
+    if (!fb) goto done;
+    int slot = ab.next;
+    if (ab.pending[slot]) {  // submitted AB_RING calls ago: normally long finished
+        if (vk.WaitForFences(vk.device, 1, &ab.fence[slot], VK_TRUE, 100000000ull) != VK_SUCCESS) goto done;
+        vk.ResetFences(vk.device, 1, &ab.fence[slot]);
+        ab.pending[slot] = 0;
+    }
+    VkCommandBuffer cmd = ab.cmd[slot];
+    VkCommandBufferBeginInfo begin = {VK_STRUCTURE_TYPE_COMMAND_BUFFER_BEGIN_INFO, NULL,
+                                      VK_COMMAND_BUFFER_USAGE_ONE_TIME_SUBMIT_BIT, NULL};
+    vk.ResetCommandBuffer(cmd, 0);
+    vk.BeginCommandBuffer(cmd, &begin);
+    VkRect2D area = {{rect.offset.x, rect.offset.y}, {(uint32_t)rect.extent.width, (uint32_t)rect.extent.height}};
+    VkRenderPassBeginInfo rb = {VK_STRUCTURE_TYPE_RENDER_PASS_BEGIN_INFO, NULL, ab.pass, fb, area, 0, NULL};
+    ab.CmdBeginRenderPass(cmd, &rb, VK_SUBPASS_CONTENTS_INLINE);
+    ab.CmdBindPipeline(cmd, VK_PIPELINE_BIND_POINT_GRAPHICS, ab.pipeline);
+    VkViewport vp = {(float)rect.offset.x, (float)rect.offset.y, (float)rect.extent.width, (float)rect.extent.height,
+                     0.0f, 1.0f};
+    ab.CmdSetViewport(cmd, 0, 1, &vp);
+    ab.CmdSetScissor(cmd, 0, 1, &area);
+    ab.CmdDraw(cmd, 3, 1, 0, 0);
+    ab.CmdEndRenderPass(cmd);
+    vk.EndCommandBuffer(cmd);
+    VkSubmitInfo submit = {VK_STRUCTURE_TYPE_SUBMIT_INFO, NULL, 0, NULL, NULL, 1, &cmd, 0, NULL};
+    if (vk.QueueSubmit(vk.queue, 1, &submit, ab.fence[slot]) != VK_SUCCESS) goto done;
+    ab.pending[slot] = 1;
+    ab.next = (slot + 1) % AB_RING;
+    t->alpha_inverted[index] |= 1u << layer;
+    ok = 1;
+    static int logged;
+    if (!logged++)
+        LOG("alpha_blend: inverting the alpha of swapchain=%p (rect %dx%d at %d,%d, layer %u) for passthrough",
+            (void *)(uintptr_t)sub->swapchain, rect.extent.width, rect.extent.height, rect.offset.x, rect.offset.y, layer);
+done:
+    pthread_mutex_unlock(&flip_lock);
+    return ok;
+}
+
+// xrEndFrame, emulated passthrough: what the projection layer's XrCompositionLayerAlphaBlendFB asks for, done with
+// the runtime's standard blend. 0 = nothing to do (no such struct, or factors that can't be expressed), 1 = straight
+// alpha (inverted when asked), 2 = premultiplied colour (alpha inverted when asked).
+static int alpha_blend_apply(const XrCompositionLayerProjection *p) {
+    const XrCompositionLayerAlphaBlendFB *f = NULL;
+    for (const XrBaseInStructure *n = (const XrBaseInStructure *)p->next; n; n = n->next)
+        if (n->type == XR_TYPE_COMPOSITION_LAYER_ALPHA_BLEND_FB) f = (const XrCompositionLayerAlphaBlendFB *)n;
+    if (!f) return 0;
+    int src = f->srcFactorColor, dst = f->dstFactorColor;
+    int straight = src == XR_BLEND_FACTOR_SRC_ALPHA_FB, premultiplied = src == XR_BLEND_FACTOR_ONE_FB,
+        inverse = src == XR_BLEND_FACTOR_ONE_MINUS_SRC_ALPHA_FB;
+    static int logged;
+    if (!logged++)
+        LOG("alpha_blend: projection layer asks for colour %d/%d alpha %d/%d (src/dst factors)", src, dst,
+            f->srcFactorAlpha, f->dstFactorAlpha);
+    if ((straight || premultiplied) && dst == XR_BLEND_FACTOR_ONE_MINUS_SRC_ALPHA_FB) return straight ? 1 : 2;
+    if (!(inverse || premultiplied) || dst != XR_BLEND_FACTOR_SRC_ALPHA_FB) {
+        static int warned;
+        if (!warned++) LOG("alpha_blend: these factors can't be emulated, the layer is blended normally");
+        return 0;
+    }
+    int done = 1;  // src * (1 - a) + dst * a: the standard blend with the alpha inverted
+    for (uint32_t v = 0; v < p->viewCount && v < 2; ++v) done &= ab_invert_view(&p->views[v].subImage);
+    if (!done) {
+        static int warned;
+        if (!warned++) LOG("alpha_blend: inverse alpha asked for, but the image couldn't be changed (not Vulkan?)");
+        return 0;
+    }
+    return inverse ? 1 : 2;
+}

native/adapter/detached_controllers.c

@@ -0,0 +1,78 @@
+// SPDX-License-Identifier: GPL-3.0-only
+// Included by session_fixes.c: Meta's detached controllers (XR_META_detached_controllers: a controller put down while
+// hand tracking runs) on a runtime without that extension. Uses profile_remap, runtime_has_detached_controllers,
+// active_instance, lookup and LOG.
+//
+// Meta's Unity OpenXR features add "Detached ... Controller" devices for /user/detached_controller_meta/left|right.
+// Unity merges same-named actions of every enabled device into one action, so the first action with such a subaction
+// path (e.g. "thumbstick") fails with XR_ERROR_PATH_UNSUPPORTED on the Frame's runtime, Unity attaches no action set
+// at all and neither Unity nor OVRPlugin get controller input: hands lying at the play-space origin on the floor, no
+// buttons (Spatial Zombies, GitHub #328). With profile_remap on and the runtime lacking the extension, these paths are
+// left out of the game's actions and suggested bindings, and xrGetCurrentInteractionProfile answers "no profile"
+// for them (a detached controller that never shows up) instead of XR_ERROR_PATH_UNSUPPORTED.
+
+#define DETACHED_PREFIX "/user/detached_controller_meta/"
+
+static int detached_filter_on(void) { return profile_remap && !runtime_has_detached_controllers && active_instance; }
+
+// 1 if `path` is a detached controller's top-level path or one of its input/output paths
+static int detached_path(XrPath path) {
+    PFN_xrPathToString to_string = (PFN_xrPathToString)lookup(active_instance, "xrPathToString");
+    char name[XR_MAX_PATH_LENGTH];
+    uint32_t size = 0;
+    return path && to_string && XR_SUCCEEDED(to_string(active_instance, path, sizeof(name), &size, name)) &&
+           !strncmp(name, DETACHED_PREFIX, strlen(DETACHED_PREFIX));
+}
+
+// xrCreateAction: `info` without the detached subaction paths, in *copy (paths in `kept`, room for all of them).
+// Returns `info` itself when there is nothing to leave out.
+static const XrActionCreateInfo *detached_strip_action(const XrActionCreateInfo *info, XrActionCreateInfo *copy,
+                                                       XrPath *kept) {
+    if (!info || !info->countSubactionPaths || !info->subactionPaths || !kept || !detached_filter_on()) return info;
+    uint32_t n = 0;
+    for (uint32_t i = 0; i < info->countSubactionPaths; ++i)
+        if (!detached_path(info->subactionPaths[i])) kept[n++] = info->subactionPaths[i];
+    if (n == info->countSubactionPaths) return info;
+    *copy = *info;
+    copy->countSubactionPaths = n;
+    copy->subactionPaths = kept;
+    static int logged;
+    if (logged++ < 3)
+        LOG("profile_remap: action %s without %u detached-controller path(s) (the runtime has no "
+            "XR_META_detached_controllers)", info->actionName, info->countSubactionPaths - n);
+    return copy;
+}
+
+// xrSuggestInteractionProfileBindings: `suggested` without bindings of detached controllers, in *copy (bindings in
+// `kept`, room for all of them). Returns `suggested` itself when there is nothing to leave out.
+static const XrInteractionProfileSuggestedBinding *detached_strip_bindings(
+        const XrInteractionProfileSuggestedBinding *suggested, XrInteractionProfileSuggestedBinding *copy,
+        XrActionSuggestedBinding *kept) {
+    if (!suggested || !suggested->countSuggestedBindings || !suggested->suggestedBindings || !kept ||
+        !detached_filter_on())
+        return suggested;
+    uint32_t n = 0;
+    for (uint32_t i = 0; i < suggested->countSuggestedBindings; ++i)
+        if (!detached_path(suggested->suggestedBindings[i].binding)) kept[n++] = suggested->suggestedBindings[i];
+    if (n == suggested->countSuggestedBindings) return suggested;
+    *copy = *suggested;
+    copy->countSuggestedBindings = n;
+    copy->suggestedBindings = kept;
+    static int logged;
+    if (logged++ < 8) {
+        PFN_xrPathToString to_string = (PFN_xrPathToString)lookup(active_instance, "xrPathToString");
+        char profile[XR_MAX_PATH_LENGTH] = "?";
+        uint32_t size = 0;
+        if (to_string) to_string(active_instance, suggested->interactionProfile, sizeof(profile), &size, profile);
+        LOG("profile_remap: %s bindings without %u detached-controller path(s)", profile,
+            suggested->countSuggestedBindings - n);
+    }
+    return copy;
+}
+
+// xrGetCurrentInteractionProfile: a detached controller's path the runtime doesn't know has no profile.
+static XrResult detached_current_profile(XrPath user, XrInteractionProfileState *state, XrResult result) {
+    if (result != XR_ERROR_PATH_UNSUPPORTED || !state || !detached_filter_on() || !detached_path(user)) return result;
+    state->interactionProfile = XR_NULL_PATH;
+    return XR_SUCCESS;
+}

native/adapter/flip_vk.c

@@ -74,6 +74,7 @@ typedef struct {
     // submitted again without a new acquire: flipping them again would undo it)
     struct { XrRect2Di rect; uint32_t layer; } flipped[MAX_IMAGES][4];
     uint32_t flipped_count[MAX_IMAGES];
+    uint32_t alpha_inverted[MAX_IMAGES];  // alpha_blend_vk.c: array layers whose alpha was inverted since the acquire
     int dumped;  // flip_dump saved this swapchain's quad
     int logged;  // its first in-place flip was logged
 } tracked_swapchain;
@@ -136,6 +137,7 @@ static void flip_on_acquire(XrSwapchain handle, uint32_t index) {
     if (t) {
         t->last_acquired = index;
         if (index < MAX_IMAGES) t->flipped_count[index] = 0;  // new content: upside down again
+        if (index < MAX_IMAGES) t->alpha_inverted[index] = 0;
         if(t->acquired_count<MAX_IMAGES)t->acquired[t->acquired_count++]=index;
     }
     pthread_mutex_unlock(&flip_lock);

native/adapter/foveation_storage.h

@@ -34,3 +34,35 @@ static int fb_foveation_storage(XrSwapchainCreateInfo *info, FbStorageNode nodes
     }
     return p ? -1 : 0;
 }
+
+// Strip FB nodes behind known Vulkan allocation nodes without changing const app memory.
+// An unknown prefix may be retained only when its entire tail is free of FB create info.
+static int fb_hide_swapchain_foveation(XrSwapchainCreateInfo *info, FbStorageNode nodes[16]) {
+    const XrBaseInStructure *p = info->next;
+    unsigned n = 0;
+    int removed = 0;
+    unsigned visited = 0;
+    while (p) {
+        if (++visited > 256) return -1;
+        if (p->type == XR_TYPE_SWAPCHAIN_CREATE_INFO_FOVEATION_FB) {
+            removed = 1;
+            p = p->next;
+            continue;
+        }
+        if (p->type != XR_TYPE_VULKAN_SWAPCHAIN_CREATE_INFO_META || n == 16) {
+            for (const XrBaseInStructure *tail = p; tail; tail = tail->next) {
+                if (++visited > 256 || tail->type == XR_TYPE_SWAPCHAIN_CREATE_INFO_FOVEATION_FB) return -1;
+            }
+            break;
+        }
+        nodes[n].vk = *(const FbVulkanSwapchainCreateInfo *)p;
+        // Foveation-only subsampled allocations are invalid without FB foveation.
+        nodes[n].vk.additionalCreateFlags &= ~0x4000u;
+        if (n) nodes[n - 1].base.next = &nodes[n].base;
+        ++n;
+        p = p->next;
+    }
+    if (n) nodes[n - 1].base.next = p;
+    info->next = n ? &nodes[0] : (const void *)p;
+    return removed;
+}

native/adapter/frame_adapter.c

@@ -15,6 +15,8 @@
 //  * drops requested instance extensions the runtime lacks (e.g. XR_FB_passthrough);
 //  * retries rejected swapchains with 1 sample / a supported format (swapchain_fix, overport #71);
 //  * drops composition layers that reference swapchains that failed to create (layer_fix);
+//  * answers xrGetDisplayRefreshRateFB with the measured display rate when the runtime lacks it or reports 0 Hz
+//    (session_fixes.c);
 //  * serves cube swapchains the runtime refuses as GL/Vulkan cube maps and drops their layers (cube_standin, cube_standin.c);
 //  * optionally requests mutable-format swapchain images (mutable_fix, off by default);
 //  * optionally swaps left/right images of stereo projection layers (swap_eyes, off by default);
@@ -91,22 +93,16 @@ static void surf_on_destroy(XrSwapchain handle);
 
 static float scale = 1.0f;
 static int foveation_fix = 1;
-static int foveation_storage_fix; // opt-in ordinary shared storage for native Vulkan foveation
+static int foveation_storage_fix; // ordinary (not SUBSAMPLED) swapchain storage; on with device.foveation
 static int foveation_eye; // experimental profile upgrade; does not inject Vulkan gaze offsets
 static int foveation_eye_enabled, foveation_eye_supported;
 #include "foveation_storage.h"
+#include "hide_fb_foveation.h"
+static int hide_fb_foveation;
+static int hide_fb_foveation_vulkan;
 // hide XR_FB_space_warp: games then render every frame themselves (UE5 Application SpaceWarp flickered on the Frame,
 // e.g. Into The Radius 2; OVRPort's patch_disable_space_warp doesn't reach UE5's OpenXR plugin)
 static int hide_space_warp = 0;
-// projection_only: frames with a projection layer and more layers submit the projection layer alone (AXRB 1.0.4's
-// emulator rejects every multi-layer GLES frame with -2: its GLES path has no layer batches; Accounting+'s OVROverlay
-// quads made almost every frame fail). The other layers (menus, overlays drawn as quads) are not shown; with
-// projection_only=2 (GLES) the quads after the projection layer are drawn into its eye images first (quad_compose_gl.c).
-static int projection_only = 0;
-// scale_max: the maximum eye size reported is the scaled recommended one too (games that size their eye buffers from
-// the maximum or scale the recommendation up: Accounting+'s Unity 2017 OVRPlugin made 896x1024 from a 448x504
-// recommendation). For AXRB's emulator, where every eye pixel is copied.
-static int scale_max = 0;
 static int strip_color_bias = 0;
 // fade_quad.c: draw colour-scale fades (fade to black) as a black quad over the picture; 2 = also remove the scale
 static int fade_quad = 0;
@@ -122,6 +118,10 @@ static void snap_on_enumerate(XrSwapchain handle, uint32_t count, const XrSwapch
 static void snap_on_acquire(XrSwapchain handle, uint32_t index);
 static void snap_end_frame(const XrFrameEndInfo *info);
 static int frame_balance = 0;  // end a still-open frame before the next xrBeginFrame
+// diagnostics (headless launch tests, GitHub #323): report shouldRender=TRUE from xrWaitFrame. Without a worn headset the
+// session never becomes VISIBLE, the runtime answers shouldRender=FALSE and engines that honour it (Unreal's OpenXR
+// plugin) submit no layers at all, so a headless run never exercises the game's real frame submission.
+static int force_render = 0;
 static int frame_begins, frame_discarded, frame_ends, frame_balanced;  // per pacing period (layer_debug)
 static int frame_open;
 static int sc_acquires, sc_waits, sc_releases, sc_wait_fails;  // per pacing period (layer_debug)  // drop XrCompositionLayerColorScaleBiasKHR (the runtime's color pass)
@@ -129,6 +129,7 @@ static int controller_fix = 1;
 static int swapchain_fix = 1;
 static int cube_standin = 1;  // cube swapchains the runtime refuses: served by the adapter (cube_standin.c)
 static int rect_clamp = 1;
+static int action_dedup = 1;  // rename duplicate action names in a set (session_fixes.c; GitHub #323)
 static int pose_consistency = 0;  // repeat xrLocateViews queries for one display time get the same poses (GitHub #8)  // clamp submitted image rects to their swapchain (SteamVR rejects a 1 px overrun)
 static int pose_time_fix;   // poses asked for at CLOCK_MONOTONIC "now" or far in the past: at XrTime "now" (pose_time.c)
 static int pose_debug;      // diagnostics: requested pose times vs the predicted display time (pose_time.c)
@@ -136,6 +137,7 @@ static int layer_fix = 1;
 static int mutable_fix = 0;
 static int swap_eyes = 0;
 static int passthrough_emul = 1;
+static int alpha_blend_emul = 1;  // alpha_blend_vk.c: honour XR_FB_composition_layer_alpha_blend with passthrough
 static int respace_kick = 0;
 static int strip_depth = 0;
 static int flip_quads = 0;
@@ -156,6 +158,7 @@ static int sync_guard;       // xrSyncActions one at a time with xrPollEvent, pa
 static int profile_remap = 1; // Meta's newer controller profiles (rejected by the Frame) -> oculus/touch_controller
 static int proximity_emul;   // finger proximity from capacitive touch: 1 thumb, 2 thumb + index (session_fixes.c)
 static int runtime_has_proximity;  // the runtime has XR_FB_touch_controller_proximity itself
+static int runtime_has_detached_controllers;  // the runtime has XR_META_detached_controllers (detached_controllers.c)
 static int layer_debug;      // diagnostics: layers, swapchains, session states, spaces, aim/grip, refresh rates
 static int input_diag;       // diagnostics: controller profiles, bindings, missing functions, failing input calls
 static int stable_local;     // keep every LOCAL space the app creates on the session-start origin
@@ -183,12 +186,12 @@ static void read_settings(const char *path) {
         if (sscanf(line, "foveation_fix=%f", &value) == 1) foveation_fix = value != 0;
         if (sscanf(line, "foveation_storage_fix=%f", &value) == 1) foveation_storage_fix = value != 0;
         if (sscanf(line, "foveation_eye=%f", &value) == 1) foveation_eye = value != 0;
+        if (sscanf(line, "hide_fb_foveation=%f", &value) == 1) hide_fb_foveation = value != 0;
         if (sscanf(line, "hide_space_warp=%f", &value) == 1) hide_space_warp = value != 0;
-        if (sscanf(line, "projection_only=%f", &value) == 1) projection_only = value >= 2 ? 2 : value != 0;
-        if (sscanf(line, "scale_max=%f", &value) == 1) scale_max = value != 0;
         if (sscanf(line, "strip_color_bias=%f", &value) == 1) strip_color_bias = (int)value;
         if (sscanf(line, "fade_quad=%f", &value) == 1) fade_quad = value > 0 ? (int)value : 0;
         if (sscanf(line, "frame_balance=%f", &value) == 1) frame_balance = value != 0;
+        if (sscanf(line, "force_render=%f", &value) == 1) force_render = value != 0;
         if (sscanf(line, "snapshot=%f", &value) == 1) snapshot = value > 0 ? (int)value : 0;
         if (sscanf(line, "flip_dump=%f", &value) == 1) flip_dump = value > 0 ? (int)value : 0;
         if (sscanf(line, "gl_error_clear=%f", &value) == 1) gl_error_clear = value != 0;
@@ -196,6 +199,7 @@ static void read_settings(const char *path) {
         if (sscanf(line, "swapchain_fix=%f", &value) == 1) swapchain_fix = value != 0;
         if (sscanf(line, "cube_standin=%f", &value) == 1) cube_standin = value != 0;
         if (sscanf(line, "rect_clamp=%f", &value) == 1) rect_clamp = value != 0;
+        if (sscanf(line, "action_dedup=%f", &value) == 1) action_dedup = value != 0;
         if (sscanf(line, "pose_consistency=%f", &value) == 1) pose_consistency = value != 0;
         if (sscanf(line, "pose_debug=%f", &value) == 1) pose_debug = value != 0;
         if (sscanf(line, "pose_time_fix=%f", &value) == 1) pose_time_fix = value != 0;
@@ -203,6 +207,7 @@ static void read_settings(const char *path) {
         if (sscanf(line, "mutable_fix=%f", &value) == 1) mutable_fix = value != 0;
         if (sscanf(line, "swap_eyes=%f", &value) == 1) swap_eyes = value != 0;
         if (sscanf(line, "passthrough_emul=%f", &value) == 1) passthrough_emul = value != 0;
+        if (sscanf(line, "alpha_blend_emul=%f", &value) == 1) alpha_blend_emul = value != 0;
         if (sscanf(line, "respace_kick=%f", &value) == 1) respace_kick = value != 0;
         if (sscanf(line, "strip_depth=%f", &value) == 1) strip_depth = value != 0;
         if (sscanf(line, "flip_quads=%f", &value) == 1) flip_quads = value != 0;
@@ -283,14 +288,13 @@ static void initialize(void) {
     if (input_diag) LOG("per-game: input_diag=1 (controller-input diagnostics)");
     if (proximity_emul) LOG("per-game: proximity_emul=%d (finger proximity from capacitive touch: %s)", proximity_emul,
                             proximity_emul > 1 ? "thumb + index" : "thumb");
+    if (hide_fb_foveation) LOG("per-game: hide_fb_foveation=1 (Quest Vulkan foveation suppressed)");
     if (hide_space_warp) LOG("per-game: hide_space_warp=1 (XR_FB_space_warp hidden, space warp info removed)");
-    if (projection_only)
-        LOG("per-game: projection_only=%d (frames with more layers submit the projection layer alone%s)", projection_only,
-            projection_only == 2 ? ", quads drawn into it" : "");
     if (strip_color_bias) LOG("per-game: strip_color_bias=%d (layer color scale/bias removed)", strip_color_bias);
     if (fade_quad) LOG("per-game: fade_quad=%d (colour-scale fades drawn as a black quad%s)", fade_quad,
                        fade_quad > 1 ? "; the layer's own scale removed" : "");
     if (frame_balance) LOG("per-game: frame_balance=1 (an open frame is ended before the next one begins)");
+    if (force_render) LOG("per-game: force_render=1 (xrWaitFrame reports shouldRender=TRUE; diagnostics)");
     if (eye_debug || release_wait) LOG("per-game: eye_debug=%d release_wait=%d log_file=%s", eye_debug, release_wait,
                                        log_file ? path : "none");
     if (controller_models && *process && !strchr(process, '/')) render_model_init(process);
@@ -321,6 +325,7 @@ XRAPI_ATTR XrResult XRAPI_CALL xrCreateInstance(const XrInstanceCreateInfo *info
     if (!fn) return XR_ERROR_INITIALIZATION_FAILED;
     if (!info) return XR_ERROR_VALIDATION_FAILURE;
 
+    hide_fb_foveation_vulkan = hide_fb_foveation && fb_instance_uses_vulkan(info);
     int chained = 0, enabled = 0;
     for (const XrBaseInStructure *p = (const XrBaseInStructure *)info->next; p; p = p->next)
         if (p->type == XR_TYPE_INSTANCE_CREATE_INFO_ANDROID_KHR) {
@@ -356,6 +361,10 @@ XRAPI_ATTR XrResult XRAPI_CALL xrCreateInstance(const XrInstanceCreateInfo *info
         int supported = !available;  // if we could not enumerate, pass everything through
         for (uint32_t j = 0; available && j < available_count && !supported; ++j)
             supported = !strcmp(available[j].extensionName, ext);
+        if (hide_fb_foveation_vulkan && fb_is_foveation_extension(ext)) {
+            LOG("hide_fb_foveation: %s not enabled", ext);
+            continue;
+        }
         if (hide_space_warp && !strcmp(ext, "XR_FB_space_warp")) {
             LOG("hide_space_warp: XR_FB_space_warp not enabled");
             continue;
@@ -396,7 +405,7 @@ XRAPI_ATTR XrResult XRAPI_CALL xrCreateInstance(const XrInstanceCreateInfo *info
         if (!requested && offered) { names[kept++] = "XR_FB_display_refresh_rate"; LOG("added XR_FB_display_refresh_rate (refresh_rate)"); }
     }
     foveation_eye_enabled = 0;
-    if (foveation_eye && !foveation_fix) {
+    if (foveation_eye && !foveation_fix && !hide_fb_foveation_vulkan) {
         int fb = 0, config = 0, offered = 0;
         for (uint32_t i = 0; i < kept; ++i) {
             fb |= !strcmp(names[i], "XR_FB_foveation");
@@ -412,7 +421,7 @@ XRAPI_ATTR XrResult XRAPI_CALL xrCreateInstance(const XrInstanceCreateInfo *info
     }
     // Adapter-owned video outputs need an explicit full-rate profile even when
     // the shared injection layer enables foveation for application swapchains.
-    if (surface_emul) {
+    if (surface_emul && !hide_fb_foveation_vulkan) {
         const char *video_extensions[] = {"XR_FB_foveation", "XR_FB_foveation_configuration",
             "XR_FB_swapchain_update_state"};
         for (unsigned e = 0; e < 3; ++e) {
@@ -436,6 +445,8 @@ XRAPI_ATTR XrResult XRAPI_CALL xrCreateInstance(const XrInstanceCreateInfo *info
     for (uint32_t j = 0; available && j < available_count; ++j)
         if (!strcmp(available[j].extensionName, "XR_FB_composition_layer_image_layout")) runtime_has_image_layout = 1;
         else if (!strcmp(available[j].extensionName, "XR_FB_touch_controller_proximity")) runtime_has_proximity = 1;
+        else if (!strcmp(available[j].extensionName, "XR_META_detached_controllers"))
+            runtime_has_detached_controllers = 1;
     // Layer types are only valid if their extension ends up enabled; some apps submit them regardless.
     int has_equirect = 0, has_equirect2 = 0, has_cylinder = 0, has_cube = 0;
     for (uint32_t i = 0; i < kept; ++i) {
@@ -473,12 +484,7 @@ XRAPI_ATTR XrResult XRAPI_CALL xrEnumerateViewConfigurationViews(XrInstance inst
             if (h > views[i].maxImageRectHeight) h = views[i].maxImageRectHeight;
             views[i].recommendedImageRectWidth = w ? w : 1;
             views[i].recommendedImageRectHeight = h ? h : 1;
-            if (scale_max && scale < 1.0f) {
-                views[i].maxImageRectWidth = views[i].recommendedImageRectWidth;
-                views[i].maxImageRectHeight = views[i].recommendedImageRectHeight;
-            }
-            LOG("view %u recommended %ux%u%s", i, views[i].recommendedImageRectWidth, views[i].recommendedImageRectHeight,
-                scale_max && scale < 1.0f ? " (also the maximum)" : "");
+            LOG("view %u recommended %ux%u", i, views[i].recommendedImageRectWidth, views[i].recommendedImageRectHeight);
         }
     }
     return result;
@@ -556,9 +562,18 @@ static int swapchain_size(XrSwapchain handle, uint32_t *w, uint32_t *h) {
     return found;
 }
 
-// Clamp `r` to a w x h image; returns whether it changed.
+// Clamp `r` to a w x h image; returns whether it changed (2 = it was empty and now covers the whole image).
 static int clamp_rect(XrRect2Di *r, uint32_t w, uint32_t h) {
     XrRect2Di c = *r;
+    // An empty rect (BattleTalent's first frames after Unity switched its MSAA level: 0,0 0x0, GitHub #293) is
+    // rejected the same way, and the game stops submitting after two rejections: show the whole image instead.
+    if (c.extent.width <= 0 || c.extent.height <= 0) {
+        if (!w || !h || w > INT32_MAX || h > INT32_MAX) return 0;
+        r->offset.x = r->offset.y = 0;
+        r->extent.width = (int32_t)w;
+        r->extent.height = (int32_t)h;
+        return 2;
+    }
     if (c.offset.x < 0) { c.extent.width += c.offset.x; c.offset.x = 0; }
     if (c.offset.y < 0) { c.extent.height += c.offset.y; c.offset.y = 0; }
     if ((uint32_t)c.offset.x >= w || (uint32_t)c.offset.y >= h) return 0;  // nothing sensible to keep: leave it
@@ -581,6 +596,7 @@ static void flip_on_create_swapchain(XrSwapchain handle, const XrSwapchainCreate
 static int flip_wants_transfer(const XrSwapchainCreateInfo *info);
 static void clear_gl_errors(const char *where);
 static void flip_on_destroy(XrSwapchain handle);
+static void ab_on_destroy(XrSwapchain handle);
 static void emul_on_create_swapchain(XrSwapchain handle, const XrSwapchainCreateInfo *info);
 static void emul_on_destroy_swapchain(XrSwapchain handle);
 static int emul_virtual_create(XrSession session, const XrSwapchainCreateInfo *info, XrSwapchain *out);
@@ -603,6 +619,7 @@ static int known_swapchain(XrSwapchain handle) {
 
 XRAPI_ATTR XrResult XRAPI_CALL xrCreateFoveationProfileFB(XrSession session,
         const XrFoveationProfileCreateInfoFB *info, XrFoveationProfileFB *profile) {
+    if (hide_fb_foveation_vulkan) return XR_ERROR_FEATURE_UNSUPPORTED;
     PFN_xrCreateFoveationProfileFB fn = (PFN_xrCreateFoveationProfileFB)lookup(active_instance, "xrCreateFoveationProfileFB");
     if (!fn) return XR_ERROR_FUNCTION_UNSUPPORTED;
     if (!info) return XR_ERROR_VALIDATION_FAILURE;
@@ -628,6 +645,7 @@ XRAPI_ATTR XrResult XRAPI_CALL xrCreateFoveationProfileFB(XrSession session,
 }
 
 XRAPI_ATTR XrResult XRAPI_CALL xrGetFoveationEyeTrackedStateMETA(XrSession session, XrFoveationEyeTrackedStateMETA *state) {
+    if (hide_fb_foveation_vulkan) return XR_ERROR_FEATURE_UNSUPPORTED;
     PFN_xrGetFoveationEyeTrackedStateMETA fn = (PFN_xrGetFoveationEyeTrackedStateMETA)lookup(active_instance, "xrGetFoveationEyeTrackedStateMETA");
     if (!fn) return XR_ERROR_FUNCTION_UNSUPPORTED;
     XrResult result = fn(session, state);
@@ -645,11 +663,18 @@ XRAPI_ATTR XrResult XRAPI_CALL xrCreateSwapchain(XrSession session, const XrSwap
     if (!info) return XR_ERROR_VALIDATION_FAILURE;
     XrSwapchainCreateInfo fixed = *info;
     FbStorageNode storage_nodes[16];
-    if (!foveation_fix && foveation_storage_fix) {
+    // Also with foveation_fix: Valve's injected FDM (device.foveation) stores a SUBSAMPLED image's coarse bins
+    // unscaled, and the compositor reads them as garbage around the sharp area (GitHub #303, Medieval Dynasty).
+    if (!hide_fb_foveation_vulkan && foveation_storage_fix) {
         int changed = fb_foveation_storage(&fixed, storage_nodes);
         LOG("foveation_storage_fix: shared allocation %s", changed > 0 ? "SUBSAMPLED cleared" :
             changed < 0 ? "unchanged (unsupported chain prefix)" : "already ordinary or no META node");
     }
+    if (hide_fb_foveation_vulkan) {
+        int stripped = fb_hide_swapchain_foveation(&fixed, storage_nodes);
+        if (stripped < 0) return XR_ERROR_VALIDATION_FAILURE;
+        if (stripped) LOG("hide_fb_foveation: removed swapchain foveation create info");
+    }
     if (foveation_fix) {
         // Drop leading foveation structs; the chain is const so only a prefix can be skipped.
         const XrBaseInStructure *p = (const XrBaseInStructure *)fixed.next;
@@ -722,6 +747,7 @@ XRAPI_ATTR XrResult XRAPI_CALL xrDestroySwapchain(XrSwapchain swapchain) {
     surf_scene_destroy(swapchain);
     forget_swapchain(swapchain);
     surf_on_destroy(swapchain);
+    ab_on_destroy(swapchain);
     flip_on_destroy(swapchain);
     emul_on_destroy_swapchain(swapchain);
     snap_on_destroy(swapchain);
@@ -903,6 +929,7 @@ XRAPI_ATTR XrResult XRAPI_CALL xrGetSystemProperties(XrInstance instance, XrSyst
 }
 
 #include "flip_vk.c"
+#include "alpha_blend_vk.c"
 #include "pose_time.c"
 
 // XR_KHR_convert_timespec_time for runtimes that lack it (Frame): XrTime is derived from the monotonic clock
@@ -996,7 +1023,6 @@ XRAPI_ATTR XrResult XRAPI_CALL xrDestroySpace(XrSpace space) {
 #include "layer_emul_gl.c"
 #include "cube_standin.c"
 #include "snapshot_gl.c"
-#include "quad_compose_gl.c"
 #include "surface_swapchain.c"
 #include "fade_quad.c"
 
@@ -1243,12 +1269,15 @@ XRAPI_ATTR XrResult XRAPI_CALL xrApplyHapticFeedback(XrSession session, const Xr
     return result;
 }
 
+#include "hide_foveation_images.h"
+
 XRAPI_ATTR XrResult XRAPI_CALL xrEnumerateSwapchainImages(XrSwapchain swapchain, uint32_t capacity, uint32_t *count,
         XrSwapchainImageBaseHeader *images) {
     PFN_xrEnumerateSwapchainImages fn = (PFN_xrEnumerateSwapchainImages)lookup(active_instance, "xrEnumerateSwapchainImages");
     if (!fn) return XR_ERROR_FUNCTION_UNSUPPORTED;
     if (is_standin(swapchain)) return standin_enumerate(swapchain, capacity, count, images);
     XrResult result = equirect_emul && emul_is_virtual(swapchain) ? emul_virtual_enumerate(swapchain, capacity, count, images)
+                                                                  : hide_fb_foveation_vulkan ? fb_hide_foveation_images(fn, swapchain, capacity, count, images)
                                                                   : fn(swapchain, capacity, count, images);
     if (XR_SUCCEEDED(result) && images && capacity && count) {
         flip_on_enumerate_images(swapchain, *count, images);
@@ -1434,6 +1463,16 @@ XRAPI_ATTR XrResult XRAPI_CALL xrWaitFrame(XrSession session, const XrFrameWaitI
         pose_time_display(state->predictedDisplayTime);
         pose_time_note_offset((long long)(state->predictedDisplayTime - mono));
         if (layer_debug) debug_aim_vs_grip(state->predictedDisplayTime);
+        // shouldRender changes (a few): a game that submits no layers while the runtime says not to render shows
+        // nothing, e.g. Unreal's OpenXR plugin in a headless launch test
+        static int last_should_render = -1, should_render_logged;
+        if ((int)state->shouldRender != last_should_render && should_render_logged < 12) {
+            ++should_render_logged;
+            LOG("xrWaitFrame: shouldRender=%d period=%.2f ms%s", (int)state->shouldRender,
+                state->predictedDisplayPeriod / 1e6, force_render && !state->shouldRender ? " (force_render: reported as 1)" : "");
+        }
+        last_should_render = (int)state->shouldRender;
+        if (force_render) state->shouldRender = XR_TRUE;
     }
     return result;
 }
@@ -1627,21 +1666,6 @@ XRAPI_ATTR XrResult XRAPI_CALL xrEndFrame(XrSession session, const XrFrameEndInf
             frames = 0; drift_sum = drift_max = 0;
         }
     }
-    XrFrameEndInfo single;
-    if (projection_only && info && info->layerCount > 1 && info->layers) {
-        for (uint32_t i = 0; i < info->layerCount; ++i) {
-            const XrCompositionLayerBaseHeader *l = info->layers[i];
-            if (!l || l->type != XR_TYPE_COMPOSITION_LAYER_PROJECTION) continue;
-            static int logged;
-            if (!logged++) LOG("projection_only: %u layers -> the projection layer alone", info->layerCount);
-            qc_compose(info, i);
-            single = *info;
-            single.layerCount = 1;
-            single.layers = &info->layers[i];
-            info = &single;
-            break;
-        }
-    }
     if ((!layer_fix && !swap_eyes && !emulate_passthrough && !flip_quads && !flip_emul && !strip_depth && !fade_quad) || !info || !info->layerCount ||
         info->layerCount > 64)
         return fn(session, info);
@@ -1665,8 +1689,14 @@ XRAPI_ATTR XrResult XRAPI_CALL xrEndFrame(XrSession session, const XrFrameEndInf
                                          q->radius, q->subImage.imageRect.offset.x, q->subImage.imageRect.offset.y,
                                          q->subImage.imageRect.extent.width, q->subImage.imageRect.extent.height);
             }
-            for (const XrBaseInStructure *n = (const XrBaseInStructure *)l->next; n && used < sizeof(now) - 32; n = n->next)
+            for (const XrBaseInStructure *n = (const XrBaseInStructure *)l->next; n && used < sizeof(now) - 48; n = n->next) {
                 used += (size_t)snprintf(now + used, sizeof(now) - used, " n=%d", n->type);
+                if (n->type == XR_TYPE_COMPOSITION_LAYER_ALPHA_BLEND_FB) {  // src/dst factors: colour, then alpha
+                    const XrCompositionLayerAlphaBlendFB *ab = (const XrCompositionLayerAlphaBlendFB *)n;
+                    used += (size_t)snprintf(now + used, sizeof(now) - used, "(%d,%d/%d,%d)", ab->srcFactorColor,
+                                             ab->dstFactorColor, ab->srcFactorAlpha, ab->dstFactorAlpha);
+                }
+            }
             used += (size_t)snprintf(now + used, sizeof(now) - used, "]");
         }
         if (strcmp(now, last)) {
@@ -1794,6 +1824,10 @@ XRAPI_ATTR XrResult XRAPI_CALL xrEndFrame(XrSession session, const XrFrameEndInf
             projections[count] = *(const XrCompositionLayerProjection *)layer;
             projections[count].layerFlags |= XR_COMPOSITION_LAYER_BLEND_TEXTURE_SOURCE_ALPHA_BIT |
                                              XR_COMPOSITION_LAYER_UNPREMULTIPLIED_ALPHA_BIT;
+            // the game's XR_FB_composition_layer_alpha_blend factors (ignored by the Frame's runtime), e.g. Unreal's
+            // inverted scene alpha: the camera showed where the game drew and black where it didn't (GitHub #329)
+            if (alpha_blend_emul && alpha_blend_apply(&projections[count]) == 2)
+                projections[count].layerFlags &= ~(XrCompositionLayerFlags)XR_COMPOSITION_LAYER_UNPREMULTIPLIED_ALPHA_BIT;
             layer = (const XrCompositionLayerBaseHeader *)&projections[count];
         }
         if (strip_depth && layer->type == XR_TYPE_COMPOSITION_LAYER_PROJECTION &&
@@ -1913,9 +1947,14 @@ XRAPI_ATTR XrResult XRAPI_CALL xrEndFrame(XrSession session, const XrFrameEndInf
                     if (layer != (const XrCompositionLayerBaseHeader *)&projections[count]) projections[count] = *cur;
                     if (projections[count].views != views[count])
                         for (uint32_t v = 0; v < cur->viewCount; ++v) views[count][v] = cur->views[v];
-                    for (uint32_t v = 0; v < cur->viewCount; ++v)
-                        if (swapchain_size(views[count][v].subImage.swapchain, &w, &h) &&
-                            clamp_rect(&views[count][v].subImage.imageRect, w, h)) {
+                    for (uint32_t v = 0; v < cur->viewCount; ++v) {
+                        int how = swapchain_size(views[count][v].subImage.swapchain, &w, &h)
+                                      ? clamp_rect(&views[count][v].subImage.imageRect, w, h) : 0;
+                        if (how == 2) {
+                            static int logged_empty;
+                            if (logged_empty++ < 3)
+                                LOG("rect_clamp: view %u empty image rect -> full swapchain %ux%u", v, w, h);
+                        } else if (how) {
                             static int logged;
                             if (logged++ < 3)
                                 LOG("rect_clamp: view %u image rect clamped to %dx%d at %d,%d (swapchain %ux%u)", v,
@@ -1924,6 +1963,7 @@ XRAPI_ATTR XrResult XRAPI_CALL xrEndFrame(XrSession session, const XrFrameEndInf
                                     views[count][v].subImage.imageRect.offset.x,
                                     views[count][v].subImage.imageRect.offset.y, w, h);
                         }
+                    }
                     projections[count].views = views[count];
                     layer = (const XrCompositionLayerBaseHeader *)&projections[count];
                     ++swapped;
@@ -1931,13 +1971,17 @@ XRAPI_ATTR XrResult XRAPI_CALL xrEndFrame(XrSession session, const XrFrameEndInf
             } else if (layer->type == XR_TYPE_COMPOSITION_LAYER_QUAD) {
                 const XrCompositionLayerQuad *q = (const XrCompositionLayerQuad *)layer;
                 XrRect2Di r = q->subImage.imageRect;
-                if (swapchain_size(q->subImage.swapchain, &w, &h) && clamp_rect(&r, w, h)) {
+                int how = swapchain_size(q->subImage.swapchain, &w, &h) ? clamp_rect(&r, w, h) : 0;
+                if (how) {
                     if (layer != (const XrCompositionLayerBaseHeader *)&quads[count]) quads[count] = *q;
                     quads[count].subImage.imageRect = r;
                     layer = (const XrCompositionLayerBaseHeader *)&quads[count];
                     ++swapped;
-                    static int logged;
-                    if (!logged++) LOG("rect_clamp: quad image rect clamped (swapchain %ux%u)", w, h);
+                    static int logged, logged_empty;
+                    if (how == 2 && logged_empty++ < 3)
+                        LOG("rect_clamp: quad empty image rect -> full swapchain %ux%u", w, h);
+                    else if (how == 1 && !logged++)
+                        LOG("rect_clamp: quad image rect clamped (swapchain %ux%u)", w, h);
                 }
             }
         }
@@ -2039,7 +2083,7 @@ XRAPI_ATTR XrResult XRAPI_CALL xrGetCurrentInteractionProfile(XrSession session,
     PFN_xrGetCurrentInteractionProfile fn =
         (PFN_xrGetCurrentInteractionProfile)lookup(active_instance, "xrGetCurrentInteractionProfile");
     if (!fn) return XR_ERROR_FUNCTION_UNSUPPORTED;
-    XrResult result = fn(session, user, state);
+    XrResult result = detached_current_profile(user, state, fn(session, user, state));
     if (input_diag && XR_SUCCEEDED(result) && state) input_diag_current_profile(user, state->interactionProfile);
     if (layer_debug && active_instance) {  // which device each hand has, as the runtime reports it
         PFN_xrPathToString str = (PFN_xrPathToString)lookup(active_instance, "xrPathToString");
@@ -2053,16 +2097,7 @@ XRAPI_ATTR XrResult XRAPI_CALL xrGetCurrentInteractionProfile(XrSession session,
         static int logged;
         if (logged++ < 40) LOG("layer_debug: interaction profile of %s: %s (result %d)", who, what, result);
     }
-    if (!controller_fix || XR_FAILED(result) || !state || !state->interactionProfile || !active_instance)
-        return result;
-    PFN_xrPathToString to_string = (PFN_xrPathToString)lookup(active_instance, "xrPathToString");
-    PFN_xrStringToPath to_path = (PFN_xrStringToPath)lookup(active_instance, "xrStringToPath");
-    char name[XR_MAX_PATH_LENGTH];
-    uint32_t size = 0;
-    if (to_string && to_path &&
-        XR_SUCCEEDED(to_string(active_instance, state->interactionProfile, sizeof(name), &size, name)) &&
-        (strstr(name, "/valve/") || strstr(name, "/khr/generic_controller")))
-        to_path(active_instance, "/interaction_profiles/oculus/touch_controller", &state->interactionProfile);
+    if (XR_SUCCEEDED(result) && state) current_profile_fix(user, state);
     return result;
 }
 
@@ -2072,7 +2107,7 @@ XRAPI_ATTR XrResult XRAPI_CALL xrEnumerateInstanceExtensionProperties(const char
         XR_NULL_HANDLE, "xrEnumerateInstanceExtensionProperties");
     if (!fn) return XR_ERROR_INITIALIZATION_FAILED;
     if (!count) return XR_ERROR_VALIDATION_FAILURE;
-    if ((!foveation_fix && !hide_space_warp && !passthrough_emul && !scene_emul && !controller_models) || layer)
+    if ((!foveation_fix && !hide_fb_foveation && !hide_space_warp && !passthrough_emul && !scene_emul && !controller_models) || layer)
         return fn(layer, capacity, count, properties);
 
     uint32_t total = 0;
@@ -2088,6 +2123,7 @@ XRAPI_ATTR XrResult XRAPI_CALL xrEnumerateInstanceExtensionProperties(const char
     for (uint32_t i = 0; i < total; ++i) {
         if (!strcmp(all[i].extensionName, "XR_FB_passthrough")) runtime_has_fb_passthrough = 1;
         if (!strcmp(all[i].extensionName, XR_FB_RENDER_MODEL_EXTENSION_NAME)) runtime_has_render_model = 1;
+        if (hide_fb_foveation && fb_is_foveation_extension(all[i].extensionName)) continue;
         if (foveation_fix && strstr(all[i].extensionName, "foveation")) continue;
         if (hide_space_warp && !strcmp(all[i].extensionName, "XR_FB_space_warp")) continue;
         if (properties && kept < capacity) properties[kept] = all[i];
@@ -2127,9 +2163,29 @@ XRAPI_ATTR XrResult XRAPI_CALL xrEnumerateApiLayerProperties(uint32_t capacity,
     return fn ? fn(capacity, count, properties) : XR_ERROR_INITIALIZATION_FAILED;
 }
 
+static XRAPI_ATTR int XRAPI_CALL framebridge_hide_fb_foveation(void) {
+    pthread_once(&init_once, initialize);
+    return hide_fb_foveation;
+}
+
+static XRAPI_ATTR XrResult XRAPI_CALL fb_hide_update_swapchain(XrSwapchain swapchain, const XrSwapchainStateBaseHeaderFB *state) {
+    if (state && state->type == XR_TYPE_SWAPCHAIN_STATE_FOVEATION_FB) {
+        LOG("hide_fb_foveation: refused foveation profile update");
+        return XR_ERROR_FEATURE_UNSUPPORTED;
+    }
+    PFN_xrUpdateSwapchainFB fn = (PFN_xrUpdateSwapchainFB)lookup(active_instance, "xrUpdateSwapchainFB");
+    return fn ? fn(swapchain, state) : XR_ERROR_FUNCTION_UNSUPPORTED;
+}
+
 // For native/xrshim: emulated functions that overport's dispatcher doesn't know (it never asks us for them).
 __attribute__((visibility("default"))) PFN_xrVoidFunction framebridge_extension_proc(const char *name) {
     pthread_once(&init_once, initialize);
+    if (name && !strcmp(name, "framebridge_hide_fb_foveation"))
+        return (PFN_xrVoidFunction)framebridge_hide_fb_foveation;
+    if (hide_fb_foveation_vulkan && name) {
+        if (!strcmp(name, "xrCreateFoveationProfileFB")) return (PFN_xrVoidFunction)xrCreateFoveationProfileFB;
+        if (!strcmp(name, "xrUpdateSwapchainFB")) return (PFN_xrVoidFunction)fb_hide_update_swapchain;
+    }
     if (name && !foveation_fix && (foveation_storage_fix || foveation_eye)) {
         if (!strcmp(name, "xrCreateFoveationProfileFB")) return (PFN_xrVoidFunction)xrCreateFoveationProfileFB;
         if (!strcmp(name, "xrGetFoveationEyeTrackedStateMETA")) return (PFN_xrVoidFunction)xrGetFoveationEyeTrackedStateMETA;
@@ -2170,6 +2226,10 @@ XRAPI_ATTR XrResult XRAPI_CALL xrGetInstanceProcAddr(XrInstance instance, const
     if (!emulated) emulated = render_model_emulation(name);
     if (!emulated && emulate_scene && !strcmp(name, "xrLocateSpacesKHR")) emulated = (PFN_xrVoidFunction)emu_locate_spaces_khr;
     if (emulated) { *function = emulated; return XR_SUCCESS; }
+    if (hide_fb_foveation_vulkan && !strcmp(name, "xrUpdateSwapchainFB")) {
+        *function = (PFN_xrVoidFunction)fb_hide_update_swapchain;
+        return XR_SUCCESS;
+    }
     HOOK(xrGetSystemProperties)
     HOOK(xrApplyHapticFeedback)
     HOOK(xrCreateReferenceSpace)
@@ -2212,6 +2272,9 @@ XRAPI_ATTR XrResult XRAPI_CALL xrGetInstanceProcAddr(XrInstance instance, const
     if (layer_debug || refresh_rate > 0) {
         HOOK_AS(xrRequestDisplayRefreshRateFB, hook_request_refresh_rate)
     }
+    // The Frame's runtime has no XR_FB_display_refresh_rate, but OVRPort's dispatcher offers it to the game and answers
+    // 0 Hz without it: the measured rate instead (the runtime's own answer when it has one).
+    if (instance != XR_NULL_HANDLE) HOOK_AS(xrGetDisplayRefreshRateFB, hook_get_refresh_rate)
     if (surface_emul) HOOK_AS(xrCreateSwapchainAndroidSurfaceKHR, hook_xrCreateSwapchainAndroidSurfaceKHR)
     if (eye_debug || release_wait) HOOK_AS(xrReleaseSwapchainImage, eye_hook_xrReleaseSwapchainImage)
     if (layer_debug || cube_standin) {  // counters + cube stand-ins; every other wait/release hook above takes precedence
@@ -2234,7 +2297,7 @@ XRAPI_ATTR XrResult XRAPI_CALL xrGetInstanceProcAddr(XrInstance instance, const
     if (layer_debug) HOOK_AS(xrGetActionStateBoolean, hook_xrGetActionStateBoolean)
     if (layer_debug || aim_correction_on() || profile_remap || input_diag || proximity_emul)
         HOOK_AS(xrSuggestInteractionProfileBindings, hook_xrSuggestInteractionProfileBindings)
-    if (proximity_emul) HOOK_AS(xrCreateAction, hook_xrCreateAction)
+    if (action_dedup || proximity_emul || profile_remap || input_diag) HOOK_AS(xrCreateAction, hook_xrCreateAction)
     if (layer_debug || aim_correction_on()) {
         HOOK_AS(xrCreateActionSpace, hook_xrCreateActionSpace)
     }

native/adapter/hide_fb_foveation.h

@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: GPL-3.0-only
+// Shared by the adapter and its shim above OVRPort's synthetic extension list.
+static int fb_is_foveation_extension(const char *name) {
+    return !strcmp(name, "XR_FB_foveation_vulkan") || !strcmp(name, "XR_FB_foveation") ||
+        !strcmp(name, "XR_FB_foveation_configuration") || !strcmp(name, "XR_META_foveation_eye_tracked");
+}
+
+static int fb_instance_uses_vulkan(const XrInstanceCreateInfo *info) {
+    for (uint32_t i = 0; info && i < info->enabledExtensionCount; ++i)
+        if (!strcmp(info->enabledExtensionNames[i], "XR_KHR_vulkan_enable") ||
+            !strcmp(info->enabledExtensionNames[i], "XR_KHR_vulkan_enable2")) return 1;
+    return 0;
+}
+
+static inline XrResult fb_hide_enumerate(PFN_xrEnumerateInstanceExtensionProperties fn, const char *layer,
+        uint32_t capacity, uint32_t *count, XrExtensionProperties *properties) {
+    if (!count || (capacity && !properties)) return XR_ERROR_VALIDATION_FAILURE;
+    uint32_t total = 0;
+    XrResult r = fn(layer, 0, &total, NULL);
+    if (XR_FAILED(r)) return r;
+    XrExtensionProperties *all = calloc(total ? total : 1, sizeof(*all));
+    if (!all) return XR_ERROR_OUT_OF_MEMORY;
+    for (uint32_t i = 0; i < total; ++i) all[i].type = XR_TYPE_EXTENSION_PROPERTIES;
+    r = fn(layer, total, &total, all);
+    if (XR_SUCCEEDED(r)) {
+        uint32_t kept = 0;
+        for (uint32_t i = 0; i < total; ++i) {
+            if (fb_is_foveation_extension(all[i].extensionName)) continue;
+            if (kept < capacity) properties[kept] = all[i];
+            ++kept;
+        }
+        *count = kept;
+        if (capacity && capacity < kept) r = XR_ERROR_SIZE_INSUFFICIENT;
+    }
+    free(all);
+    return r;
+}
+
+static inline XrResult fb_hide_create_instance(PFN_xrCreateInstance fn, const XrInstanceCreateInfo *info,
+        XrInstance *instance) {
+    if (!info) return XR_ERROR_VALIDATION_FAILURE;
+    if (!fb_instance_uses_vulkan(info)) return fn(info, instance);
+    const char **names = calloc(info->enabledExtensionCount ? info->enabledExtensionCount : 1, sizeof(*names));
+    if (!names) return XR_ERROR_OUT_OF_MEMORY;
+    XrInstanceCreateInfo fixed = *info;
+    fixed.enabledExtensionCount = 0;
+    fixed.enabledExtensionNames = names;
+    for (uint32_t i = 0; i < info->enabledExtensionCount; ++i)
+        if (!fb_is_foveation_extension(info->enabledExtensionNames[i]))
+            names[fixed.enabledExtensionCount++] = info->enabledExtensionNames[i];
+    XrResult r = fn(&fixed, instance);
+    free(names);
+    return r;
+}

native/adapter/hide_foveation_images.h

@@ -0,0 +1,32 @@
+// SPDX-License-Identifier: GPL-3.0-only
+// Output chains are writable. Unlink FB nodes during enumeration and restore every
+// app-owned link on both success and failure; preserve unrelated output structures.
+static XrResult fb_hide_foveation_images(PFN_xrEnumerateSwapchainImages fn, XrSwapchain swapchain,
+        uint32_t capacity, uint32_t *count, XrSwapchainImageBaseHeader *images) {
+    if (!images || !capacity || images->type != XR_TYPE_SWAPCHAIN_IMAGE_VULKAN_KHR)
+        return fn(swapchain, capacity, count, images);
+    XrSwapchainImageVulkanKHR *vk_images = (void *)images;
+    size_t total = 0;
+    for (uint32_t i = 0; i < capacity; ++i)
+        for (XrBaseOutStructure *p = vk_images[i].next; p; p = p->next)
+            total += p->type == XR_TYPE_SWAPCHAIN_IMAGE_FOVEATION_VULKAN_FB;
+    struct FbImageLink { XrBaseOutStructure *parent, *node; };
+    struct FbImageLink *links = calloc(total ? total : 1, sizeof(*links));
+    if (!links) return XR_ERROR_OUT_OF_MEMORY;
+    size_t n = 0;
+    for (uint32_t i = 0; i < capacity; ++i) {
+        XrBaseOutStructure *parent = (void *)&vk_images[i];
+        while (parent->next) {
+            XrBaseOutStructure *p = parent->next;
+            if (p->type == XR_TYPE_SWAPCHAIN_IMAGE_FOVEATION_VULKAN_FB) {
+                links[n++] = (struct FbImageLink){parent, p};
+                parent->next = p->next;
+            } else parent = p;
+        }
+    }
+    XrResult result = fn(swapchain, capacity, count, images);
+    while (n) { --n; links[n].parent->next = links[n].node; }
+    free(links);
+    if (total) LOG("hide_fb_foveation: removed %zu Vulkan foveation image node(s)", total);
+    return result;
+}

native/adapter/input_diag.c

@@ -107,8 +107,6 @@ static const char *diag_perf_detail(XrPerfSettingsDomainEXT domain, XrPerfSettin
 }
 DIAG_CHECKED(xrStringToPath, (XrInstance instance, const char *path, XrPath *out), (instance, path, out),
              diag_name_detail(path))
-DIAG_CHECKED(xrCreateAction, (XrActionSet set, const XrActionCreateInfo *info, XrAction *action), (set, info, action),
-             diag_name_detail(info ? info->actionName : NULL))
 DIAG_CHECKED(xrAttachSessionActionSets, (XrSession session, const XrSessionActionSetsAttachInfo *info),
              (session, info), NULL)
 DIAG_CHECKED(xrPerfSettingsSetPerformanceLevelEXT,
@@ -116,11 +114,46 @@ DIAG_CHECKED(xrPerfSettingsSetPerformanceLevelEXT,
              (session, domain, level), diag_perf_detail(domain, level))
 #undef DIAG_CHECKED
 
+// Every action set and action the game creates, with its localized name: SteamVR turns them into an input manifest and
+// drops a game whose manifest it can't load ("SetXrInputConfig failed. Failed to load manifest" in vrserver.txt; the
+// app then counts as exited: home environment while the game keeps running, GitHub #323). Bytes outside printable
+// ASCII and the JSON specials " and \ are written as \xNN.
+static const char *diag_escaped(const char *in, char *out, size_t size) {
+    size_t used = 0;
+    for (const unsigned char *c = (const unsigned char *)(in ? in : "(null)"); *c && used + 5 < size; ++c) {
+        int special = *c < 0x20 || *c > 0x7e || *c == '"' || *c == '\\';
+        used += (size_t)(special ? snprintf(out + used, size - used, "\\x%02x", *c)
+                                 : snprintf(out + used, size - used, "%c", *c));
+    }
+    out[used] = 0;
+    return out;
+}
+static XRAPI_ATTR XrResult XRAPI_CALL diag_xrCreateActionSet(XrInstance instance, const XrActionSetCreateInfo *info,
+        XrActionSet *set) {
+    PFN_xrCreateActionSet fn = (PFN_xrCreateActionSet)lookup(instance, "xrCreateActionSet");
+    if (!fn) return XR_ERROR_FUNCTION_UNSUPPORTED;
+    XrResult result = fn(instance, info, set);
+    char a[XR_MAX_ACTION_SET_NAME_SIZE * 4 + 8], b[XR_MAX_LOCALIZED_ACTION_SET_NAME_SIZE * 4 + 8];
+    if (info)
+        LOG("input_diag: action set \"%s\" (\"%s\") priority %u -> %d", diag_escaped(info->actionSetName, a, sizeof(a)),
+            diag_escaped(info->localizedActionSetName, b, sizeof(b)), info->priority, (int)result);
+    return result;
+}
+// Called by session_fixes.c's hook_xrCreateAction (hooked whenever input_diag is on), with the names it created.
+static void diag_log_action(const XrActionCreateInfo *info, XrResult result) {
+    char a[XR_MAX_ACTION_NAME_SIZE * 4 + 8], b[XR_MAX_LOCALIZED_ACTION_NAME_SIZE * 4 + 8];
+    if (info)
+        LOG("input_diag: action \"%s\" (\"%s\") type %d, %u subaction path(s) -> %d",
+            diag_escaped(info->actionName, a, sizeof(a)), diag_escaped(info->localizedActionName, b, sizeof(b)),
+            (int)info->actionType, info->countSubactionPaths, (int)result);
+    if (XR_FAILED(result)) diag_call_failed("xrCreateAction", result, diag_name_detail(info ? info->actionName : NULL));
+}
+
 // xrGetInstanceProcAddr: our wrapper for `name`, NULL if it isn't one of ours.
 static PFN_xrVoidFunction input_diag_hook(const char *name) {
 #define DIAG(fn) if (!strcmp(name, #fn)) return (PFN_xrVoidFunction)diag_##fn;
     DIAG(xrStringToPath)
-    DIAG(xrCreateAction)
+    DIAG(xrCreateActionSet)
     DIAG(xrAttachSessionActionSets)
     DIAG(xrPerfSettingsSetPerformanceLevelEXT)
 #undef DIAG

native/adapter/layer_math.h

@@ -126,23 +126,4 @@ static inline int lm_face_visible(int face, XrVector3f forward, float cos_limit)
 // Cosine of the angle between the face's centre direction and `forward` (unit): sort key, larger = closer to view.
 static inline float lm_face_score(int face, XrVector3f forward) { return lm_dot(lm_face_dir(face, 0, 0), forward); }
 
-// Clip-space corners of a quad layer seen from one eye (projection_only=2 draws quads into the projection image):
-// `quad` = the quad's pose in the projection layer's space, `size` its extent in metres, `eye` + `fov` the view's
-// pose and angles in that space. out[0..3] = bottom-left, bottom-right, top-left, top-right (a triangle strip),
-// each x, y, z, w with w = depth in front of the eye (GL then interpolates the texture coordinates
-// perspective-correctly and clips what lies behind the eye); z = 0 (no depth test).
-static inline void lm_quad_clip(XrPosef quad, XrExtent2Df size, XrPosef eye, XrFovf fov, float out[4][4]) {
-    const float tl = tanf(fov.angleLeft), tr = tanf(fov.angleRight), tu = tanf(fov.angleUp), td = tanf(fov.angleDown);
-    const XrPosef to_eye = lm_pose_mul(lm_pose_inv(eye), quad);
-    for (int i = 0; i < 4; ++i) {
-        XrVector3f c = {(i & 1 ? 0.5f : -0.5f) * size.width, (i & 2 ? 0.5f : -0.5f) * size.height, 0};
-        XrVector3f r = lm_rotate(to_eye.orientation, c);
-        float x = r.x + to_eye.position.x, y = r.y + to_eye.position.y, z = r.z + to_eye.position.z;
-        out[i][0] = (2 * x + (tr + tl) * z) / (tr - tl);
-        out[i][1] = (2 * y + (tu + td) * z) / (tu - td);
-        out[i][2] = 0;
-        out[i][3] = -z;
-    }
-}
-
 #endif

native/adapter/profile_report.c

@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: GPL-3.0-only
+// Included by session_fixes.c (after TOUCH_PROFILE and app_suggested_touch): what xrGetCurrentInteractionProfile
+// tells the game about each hand. Uses controller_fix, profile_remap, active_instance, lookup and LOG.
+//  * controller_fix: SteamVR's own profiles (valve/..., khr/generic_controller) are reported as oculus/touch_controller,
+//    the profile Quest games have bindings for.
+//  * profile_remap: when the game suggested bindings only for one of Meta's newer profiles (Touch Plus/Pro) and
+//    hook_xrSuggestInteractionProfileBindings suggested them again for Touch, the runtime reports
+//    oculus/touch_controller, a profile the game never suggested. Unity's OpenXR plugin creates its input devices by
+//    the reported profile, finds none for Touch and leaves the controllers unconnected: hands lying at the play-space
+//    origin on the floor, no buttons (e.g. Hotel Infinity, GitHub #327). Such a hand is reported with the game's own
+//    profile instead (the last one remapped: the Touch bindings the runtime uses are that profile's).
+
+static char remapped_profile[XR_MAX_PATH_LENGTH];  // set by hook_xrSuggestInteractionProfileBindings
+
+static void current_profile_fix(XrPath user, XrInteractionProfileState *state) {
+    if ((!controller_fix && !profile_remap) || !state->interactionProfile || !active_instance) return;
+    PFN_xrPathToString to_string = (PFN_xrPathToString)lookup(active_instance, "xrPathToString");
+    PFN_xrStringToPath to_path = (PFN_xrStringToPath)lookup(active_instance, "xrStringToPath");
+    char name[XR_MAX_PATH_LENGTH];
+    uint32_t size = 0;
+    if (!to_string || !to_path ||
+        XR_FAILED(to_string(active_instance, state->interactionProfile, sizeof(name), &size, name)))
+        return;
+    int touch = !strcmp(name, TOUCH_PROFILE);
+    if (controller_fix && (strstr(name, "/valve/") || strstr(name, "/khr/generic_controller")) &&
+        XR_SUCCEEDED(to_path(active_instance, TOUCH_PROFILE, &state->interactionProfile)))
+        touch = 1;
+    if (!touch || !profile_remap || !*remapped_profile || app_suggested_touch ||
+        XR_FAILED(to_path(active_instance, remapped_profile, &state->interactionProfile)))
+        return;
+    static int logged;
+    if (logged++ < 4) {
+        char who[XR_MAX_PATH_LENGTH] = "?";
+        to_string(active_instance, user, sizeof(who), &size, who);
+        LOG("profile_remap: %s reported as %s (the app's profile) instead of oculus/touch_controller", who,
+            remapped_profile + strlen("/interaction_profiles/"));
+    }
+}

native/adapter/quad_compose_gl.c

@@ -1,252 +0,0 @@
-// SPDX-License-Identifier: GPL-3.0-only
-// Included by frame_adapter.c after snapshot_gl.c (whose swapchain image tracking it uses). projection_only=2 (GLES
-// sessions only): before a frame with a projection layer and more layers is reduced to the projection layer alone,
-// the quad layers submitted after the projection layer are drawn into its eye images, so menus and overlays drawn as
-// quads still show. For runtimes that refuse multi-layer GLES frames (AXRB 1.0.4's emulator: -2 for every one;
-// Path of the Warrior's menus are a VrApi cylinder the VrApi bridge turns into a quad, Accounting+ uses OVROverlay
-// quads).
-//  * Drawn on the game's thread, in xrEndFrame, on its current GL context (the one the runtime reads the images back
-//    from), with the eye image the game just released as the target: one textured quad per eye and quad layer, at
-//    the eye's view and FOV (lm_quad_clip). No depth test: a quad is drawn over the scene (as a compositor does).
-//  * Blending follows the quad's flags: XR_COMPOSITION_LAYER_BLEND_TEXTURE_SOURCE_ALPHA_BIT blends (premultiplied, or
-//    straight alpha with UNPREMULTIPLIED_ALPHA_BIT), else the quad is opaque. Array quad swapchains are skipped.
-//  * Every GL state it touches is restored and its errors are cleared. A failure (shader, framebuffer) is logged once
-//    and turns the drawing off for the process; the frame still goes out as the projection layer alone.
-#define QC_GL_FUNCS(X) X(glCreateShader) X(glShaderSource) X(glCompileShader) X(glGetShaderiv) X(glGetShaderInfoLog) \
-    X(glCreateProgram) X(glAttachShader) X(glLinkProgram) X(glGetProgramiv) X(glDeleteShader) X(glUseProgram) \
-    X(glGetUniformLocation) X(glUniform4fv) X(glUniform1i) X(glUniform1f) X(glGenVertexArrays) X(glBindVertexArray) \
-    X(glGenFramebuffers) X(glBindFramebuffer) X(glFramebufferTexture2D) X(glFramebufferTextureLayer) \
-    X(glCheckFramebufferStatus) X(glViewport) X(glGetIntegerv) X(glGetBooleanv) X(glIsEnabled) X(glEnable) \
-    X(glDisable) X(glBlendFuncSeparate) X(glBlendEquationSeparate) X(glColorMask) X(glActiveTexture) \
-    X(glBindTexture) X(glGenSamplers) X(glSamplerParameteri) X(glBindSampler) X(glDrawArrays) X(glGetError)
-#define QC_DECLARE(fn) static __typeof__(&fn) q_##fn;
-QC_GL_FUNCS(QC_DECLARE)
-#undef QC_DECLARE
-
-static int qc_state;  // 0 untried, 1 ok, -1 off for this process
-static EGLContext qc_context;  // the context the objects below belong to (VAOs and FBOs aren't shared)
-static GLuint qc_program, qc_vao, qc_fb, qc_sampler;
-static GLint qc_u_v, qc_u_tex, qc_u_opaque;
-
-static const char *QC_VS =
-    "#version 300 es\n"
-    "uniform vec4 u_v[8];\n"  // 0-3 clip-space corners (BL, BR, TL, TR), 4-7 their texture coordinates
-    "out vec2 v_uv;\n"
-    "void main() { gl_Position = u_v[gl_VertexID]; v_uv = u_v[4 + gl_VertexID].xy; }\n";
-static const char *QC_FS =
-    "#version 300 es\n"
-    "precision mediump float;\n"
-    "uniform sampler2D u_tex;\n"
-    "uniform float u_opaque;\n"
-    "in vec2 v_uv;\n"
-    "out vec4 o_color;\n"
-    "void main() { vec4 c = texture(u_tex, v_uv); o_color = vec4(c.rgb, max(c.a, u_opaque)); }\n";
-
-static void qc_off(const char *why) {
-    qc_state = -1;
-    LOG("projection_only=2: %s, quad layers are dropped instead of drawn into the main picture", why);
-}
-
-static GLuint qc_shader(GLenum type, const char *src) {
-    GLuint s = q_glCreateShader(type);
-    q_glShaderSource(s, 1, &src, NULL);
-    q_glCompileShader(s);
-    GLint ok = 0;
-    q_glGetShaderiv(s, GL_COMPILE_STATUS, &ok);
-    if (!ok) {
-        char log[256] = {0};
-        q_glGetShaderInfoLog(s, sizeof(log) - 1, NULL, log);
-        LOG("projection_only=2: shader: %s", log);
-        q_glDeleteShader(s);
-        return 0;
-    }
-    return s;
-}
-
-// GL entry points + this context's objects. 1 = ready.
-static int qc_setup(void) {
-    if (qc_state < 0) return 0;
-    if (!qc_state) {
-        if (!snap_load_gl()) { qc_off("OpenGL ES not available"); return 0; }
-        void *gles = dlopen("libGLESv3.so", RTLD_NOW | RTLD_LOCAL);
-        int ok = gles != NULL;
-#define QC_RESOLVE(fn) ok &= gles && (q_##fn = (__typeof__(q_##fn))dlsym(gles, #fn)) != NULL;
-        QC_GL_FUNCS(QC_RESOLVE)
-#undef QC_RESOLVE
-        if (!ok) { qc_off("GL functions missing"); return 0; }
-        qc_state = 1;
-    }
-    EGLContext ctx = s_eglGetCurrentContext();
-    if (!ctx) return 0;
-    if (ctx == qc_context && qc_program) return 1;
-    // a new context (or the first): build the program and objects there (the old ones belonged to another context)
-    GLint old_program = 0;
-    q_glGetIntegerv(GL_CURRENT_PROGRAM, &old_program);
-    GLuint vs = qc_shader(GL_VERTEX_SHADER, QC_VS), fs = qc_shader(GL_FRAGMENT_SHADER, QC_FS);
-    GLuint program = 0;
-    if (vs && fs) {
-        program = q_glCreateProgram();
-        q_glAttachShader(program, vs);
-        q_glAttachShader(program, fs);
-        q_glLinkProgram(program);
-        GLint linked = 0;
-        q_glGetProgramiv(program, GL_LINK_STATUS, &linked);
-        if (!linked) program = 0;
-    }
-    if (vs) q_glDeleteShader(vs);
-    if (fs) q_glDeleteShader(fs);
-    if (!program) { while (q_glGetError() != GL_NO_ERROR) {} qc_off("shader program failed"); return 0; }
-    qc_program = program;
-    qc_u_v = q_glGetUniformLocation(program, "u_v");
-    qc_u_tex = q_glGetUniformLocation(program, "u_tex");
-    qc_u_opaque = q_glGetUniformLocation(program, "u_opaque");
-    q_glGenVertexArrays(1, &qc_vao);
-    q_glGenFramebuffers(1, &qc_fb);
-    q_glGenSamplers(1, &qc_sampler);
-    q_glSamplerParameteri(qc_sampler, GL_TEXTURE_MIN_FILTER, GL_LINEAR);  // no mipmaps needed (and none required)
-    q_glSamplerParameteri(qc_sampler, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
-    q_glSamplerParameteri(qc_sampler, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE);
-    q_glSamplerParameteri(qc_sampler, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE);
-    q_glUseProgram((GLuint)old_program);
-    qc_context = ctx;
-    return 1;
-}
-
-// The GL texture (and size) of the image the game last acquired (= just released) from a swapchain; 0 if unknown.
-static GLuint qc_image(XrSwapchain handle, uint32_t *w, uint32_t *h, uint32_t *array_size) {
-    GLuint tex = 0;
-    pthread_mutex_lock(&snap_lock);
-    int i = snap_find(handle, 0);
-    if (i >= 0 && snap_chains[i].count && snap_chains[i].last_acquired < snap_chains[i].count) {
-        tex = snap_chains[i].images[snap_chains[i].last_acquired];
-        *w = snap_chains[i].width, *h = snap_chains[i].height, *array_size = snap_chains[i].array_size;
-    }
-    pthread_mutex_unlock(&snap_lock);
-    return tex;
-}
-
-static void qc_compose(const XrFrameEndInfo *info, uint32_t proj_index) {
-    if (projection_only != 2 || !info || !info->layers) return;
-    const XrCompositionLayerProjection *proj = (const XrCompositionLayerProjection *)info->layers[proj_index];
-    if (!proj || proj->viewCount < 2 || !proj->views) return;
-    uint32_t quads = 0;
-    for (uint32_t i = proj_index + 1; i < info->layerCount; ++i)
-        if (info->layers[i] && info->layers[i]->type == XR_TYPE_COMPOSITION_LAYER_QUAD) ++quads;
-    if (!quads || !qc_setup()) return;
-
-    // the game's state we change
-    GLint draw_fb, viewport[4], program, vao, active_tex, tex2d, sampler, src_rgb, dst_rgb, src_a, dst_a, eq_rgb, eq_a;
-    GLboolean color_mask[4];
-    const GLenum caps[] = {GL_BLEND, GL_DEPTH_TEST, GL_STENCIL_TEST, GL_SCISSOR_TEST, GL_CULL_FACE,
-                           GL_SAMPLE_ALPHA_TO_COVERAGE, GL_RASTERIZER_DISCARD};
-    GLboolean cap_on[sizeof(caps) / sizeof(caps[0])];
-    q_glGetIntegerv(GL_DRAW_FRAMEBUFFER_BINDING, &draw_fb);
-    q_glGetIntegerv(GL_VIEWPORT, viewport);
-    q_glGetIntegerv(GL_CURRENT_PROGRAM, &program);
-    q_glGetIntegerv(GL_VERTEX_ARRAY_BINDING, &vao);
-    q_glGetIntegerv(GL_ACTIVE_TEXTURE, &active_tex);
-    q_glActiveTexture(GL_TEXTURE0);
-    q_glGetIntegerv(GL_TEXTURE_BINDING_2D, &tex2d);
-    q_glGetIntegerv(GL_SAMPLER_BINDING, &sampler);
-    q_glGetIntegerv(GL_BLEND_SRC_RGB, &src_rgb);
-    q_glGetIntegerv(GL_BLEND_DST_RGB, &dst_rgb);
-    q_glGetIntegerv(GL_BLEND_SRC_ALPHA, &src_a);
-    q_glGetIntegerv(GL_BLEND_DST_ALPHA, &dst_a);
-    q_glGetIntegerv(GL_BLEND_EQUATION_RGB, &eq_rgb);
-    q_glGetIntegerv(GL_BLEND_EQUATION_ALPHA, &eq_a);
-    q_glGetBooleanv(GL_COLOR_WRITEMASK, color_mask);
-    for (size_t c = 0; c < sizeof(caps) / sizeof(caps[0]); ++c) {
-        cap_on[c] = q_glIsEnabled(caps[c]);
-        q_glDisable(caps[c]);
-    }
-    q_glColorMask(GL_TRUE, GL_TRUE, GL_TRUE, GL_TRUE);
-    q_glBlendEquationSeparate(GL_FUNC_ADD, GL_FUNC_ADD);
-    q_glUseProgram(qc_program);
-    q_glBindVertexArray(qc_vao);
-    q_glBindSampler(0, qc_sampler);
-    q_glUniform1i(qc_u_tex, 0);
-    q_glBindFramebuffer(GL_DRAW_FRAMEBUFFER, qc_fb);
-
-    PFN_xrLocateSpace locate = (PFN_xrLocateSpace)lookup(active_instance, "xrLocateSpace");
-    int drawn = 0;
-    for (uint32_t eye = 0; eye < 2; ++eye) {
-        const XrCompositionLayerProjectionView *view = &proj->views[eye];
-        uint32_t tw = 0, th = 0, tarray = 1;
-        GLuint target = qc_image(view->subImage.swapchain, &tw, &th, &tarray);
-        if (!target) continue;
-        if (tarray > 1)
-            q_glFramebufferTextureLayer(GL_DRAW_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, target, 0,
-                                        (GLint)view->subImage.imageArrayIndex);
-        else
-            q_glFramebufferTexture2D(GL_DRAW_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, target, 0);
-        if (q_glCheckFramebufferStatus(GL_DRAW_FRAMEBUFFER) != GL_FRAMEBUFFER_COMPLETE) {
-            qc_off("eye image not drawable (framebuffer incomplete)");
-            break;
-        }
-        const XrRect2Di *r = &view->subImage.imageRect;
-        q_glViewport(r->offset.x, r->offset.y, r->extent.width, r->extent.height);
-        for (uint32_t i = proj_index + 1; i < info->layerCount; ++i) {
-            const XrCompositionLayerQuad *q = (const XrCompositionLayerQuad *)info->layers[i];
-            if (!q || q->type != XR_TYPE_COMPOSITION_LAYER_QUAD) continue;
-            if (q->eyeVisibility == XR_EYE_VISIBILITY_LEFT && eye != 0) continue;
-            if (q->eyeVisibility == XR_EYE_VISIBILITY_RIGHT && eye != 1) continue;
-            uint32_t sw = 0, sh = 0, sarray = 1;
-            GLuint source = qc_image(q->subImage.swapchain, &sw, &sh, &sarray);
-            if (!source || sarray > 1 || !sw || !sh) continue;
-            XrPosef pose = q->pose;  // the quad in the projection layer's space
-            if (q->space != proj->space) {
-                XrSpaceLocation loc = {XR_TYPE_SPACE_LOCATION};
-                if (!locate || XR_FAILED(locate(q->space, proj->space, info->displayTime, &loc))) continue;
-                pose = lm_pose_mul(loc.pose, q->pose);
-            }
-            float v[8][4];
-            lm_quad_clip(pose, q->size, view->pose, view->fov, v);
-            const XrRect2Di *s = &q->subImage.imageRect;
-            float u0 = (float)s->offset.x / sw, u1 = (float)(s->offset.x + s->extent.width) / sw;
-            float v0 = (float)s->offset.y / sh, v1 = (float)(s->offset.y + s->extent.height) / sh;
-            for (int k = 0; k < 4; ++k) {
-                v[4 + k][0] = k & 1 ? u1 : u0;
-                v[4 + k][1] = k & 2 ? v1 : v0;  // GL textures: v grows upwards, the quad's top is +Y
-                v[4 + k][2] = v[4 + k][3] = 0;
-            }
-            q_glUniform4fv(qc_u_v, 8, &v[0][0]);
-            const int blend = (q->layerFlags & XR_COMPOSITION_LAYER_BLEND_TEXTURE_SOURCE_ALPHA_BIT) != 0;
-            q_glUniform1f(qc_u_opaque, blend ? 0.0f : 1.0f);
-            if (blend) {
-                q_glEnable(GL_BLEND);
-                if (q->layerFlags & XR_COMPOSITION_LAYER_UNPREMULTIPLIED_ALPHA_BIT)
-                    q_glBlendFuncSeparate(GL_SRC_ALPHA, GL_ONE_MINUS_SRC_ALPHA, GL_ONE, GL_ONE_MINUS_SRC_ALPHA);
-                else
-                    q_glBlendFuncSeparate(GL_ONE, GL_ONE_MINUS_SRC_ALPHA, GL_ONE, GL_ONE_MINUS_SRC_ALPHA);
-            } else {
-                q_glDisable(GL_BLEND);
-            }
-            q_glBindTexture(GL_TEXTURE_2D, source);
-            q_glDrawArrays(GL_TRIANGLE_STRIP, 0, 4);
-            ++drawn;
-        }
-    }
-
-    // the game's state back
-    q_glFramebufferTexture2D(GL_DRAW_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, 0, 0);
-    q_glBindFramebuffer(GL_DRAW_FRAMEBUFFER, (GLuint)draw_fb);
-    q_glViewport(viewport[0], viewport[1], viewport[2], viewport[3]);
-    q_glBindTexture(GL_TEXTURE_2D, (GLuint)tex2d);
-    q_glBindSampler(0, (GLuint)sampler);
-    q_glActiveTexture((GLenum)active_tex);
-    q_glBindVertexArray((GLuint)vao);
-    q_glUseProgram((GLuint)program);
-    q_glBlendFuncSeparate((GLenum)src_rgb, (GLenum)dst_rgb, (GLenum)src_a, (GLenum)dst_a);
-    q_glBlendEquationSeparate((GLenum)eq_rgb, (GLenum)eq_a);
-    q_glColorMask(color_mask[0], color_mask[1], color_mask[2], color_mask[3]);
-    for (size_t c = 0; c < sizeof(caps) / sizeof(caps[0]); ++c)
-        if (cap_on[c]) q_glEnable(caps[c]); else q_glDisable(caps[c]);
-    GLenum err, first = GL_NO_ERROR;
-    while ((err = q_glGetError()) != GL_NO_ERROR) if (first == GL_NO_ERROR) first = err;
-    static int logged;
-    if (drawn && !logged++) LOG("projection_only=2: %u quad layer(s) drawn into the main picture", quads);
-    if (first != GL_NO_ERROR) {
-        static int errors;
-        if (errors++ < 3) LOG("projection_only=2: GL error 0x%x while drawing quads", first);
-    }
-}

native/adapter/refresh_rate.h

@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: GPL-3.0-only
+// Display refresh rate for xrGetDisplayRefreshRateFB when the runtime doesn't give one (session_fixes.c). Pure, so the
+// host test (tests/fixtures/src/refresh_rate_test.c) can check it.
+#pragma once
+#include <stdint.h>
+
+// The rate the frame timing shows (1 / predictedDisplayPeriod of the last xrWaitFrame, whole Hz), else the
+// refresh_rate setting, else 72 Hz (the Frame's rate for Android apps).
+static inline float fb_refresh_rate(int64_t display_period_ns, float setting) {
+    if (display_period_ns > 0) {
+        double hz = 1e9 / (double)display_period_ns;
+        if (hz >= 30.0 && hz <= 240.0) return (float)(int)(hz + 0.5);
+    }
+    return setting > 0 ? setting : 72.0f;
+}

native/adapter/session_fixes.c

@@ -9,6 +9,7 @@
 //  * aim_pitch / aim_yaw / aim_forward: correct the aim pose of controllers (pointer rays) by a fixed offset;
 //  * refresh_rate: display refresh rate requested at session start (and instead of the app's own requests).
 #include "layer_math.h"
+#include "refresh_rate.h"
 
 static void emul_on_begin_session(const XrSessionBeginInfo *info);  // layer_emul_gl.c
 
@@ -296,6 +297,8 @@ static const char *const TOUCH_LEFT[] = {"input/x/click", "input/x/touch", "inpu
 static const char *const TOUCH_RIGHT[] = {"input/a/click", "input/a/touch", "input/b/click", "input/b/touch",
     "input/system/click"};
 static int app_suggested_touch;
+#include "profile_report.c"  // remapped_profile, current_profile_fix (xrGetCurrentInteractionProfile)
+#include "detached_controllers.c"  // detached controllers' paths on a runtime without them
 
 static int in_list(const char *s, const char *const *list, size_t n) {
     for (size_t i = 0; i < n; ++i)
@@ -328,12 +331,70 @@ static int touch_has(const char *path) {
 // rest touched; index (proximity_emul=2) = trigger touched. Only when the runtime lacks the extension itself.
 static XrAction thumb_proximity_action, trigger_proximity_action;
 
+// ---------------------------------------------------------------- duplicate action names (action_dedup)
+// OpenXR requires action names and localized names to be unique within an action set (XR_ERROR_NAME_DUPLICATED), but
+// the Frame's runtime accepts duplicates and then can't load the input manifest it builds from them: vrserver logs
+// "SetXrInputConfig failed. Failed to load manifest", drops the app's connection and treats it as exited, so the
+// headset goes back to the home environment while the game keeps running with sound (GitHub #323, Scared By Squares:
+// Unreal's OpenXR plugin creates "turn" twice, from an action mapping and an axis mapping of the same name). The
+// game only uses the handles, so a later duplicate is created under a free name ("turn_2", "Turn 2").
+#include "action_names.h"
+#define DEDUP_MAX 512
+static struct { XrActionSet set; char name[XR_MAX_ACTION_NAME_SIZE]; char localized[XR_MAX_LOCALIZED_ACTION_NAME_SIZE]; }
+    dedup_seen[DEDUP_MAX];
+static int dedup_count;
+static pthread_mutex_t dedup_lock = PTHREAD_MUTEX_INITIALIZER;
+
+static int dedup_taken(void *ctx, const char *name, const char *localized) {  // caller holds dedup_lock
+    XrActionSet set = *(XrActionSet *)ctx;
+    for (int i = 0; i < dedup_count; ++i)
+        if (dedup_seen[i].set == set && (!strcmp(dedup_seen[i].name, name) || !strcmp(dedup_seen[i].localized, localized)))
+            return 1;
+    return 0;
+}
+
+// Fills `out` (a copy of `info`) with free names when `info`'s are taken in `set`; 1 if it did.
+static int dedup_rename(XrActionSet set, const XrActionCreateInfo *info, XrActionCreateInfo *out,
+                        char name[XR_MAX_ACTION_NAME_SIZE], char localized[XR_MAX_LOCALIZED_ACTION_NAME_SIZE]) {
+    if (!action_unique_names(info->actionName, info->localizedActionName, dedup_taken, &set, name,
+                             XR_MAX_ACTION_NAME_SIZE, localized, XR_MAX_LOCALIZED_ACTION_NAME_SIZE))
+        return 0;
+    *out = *info;
+    memcpy(out->actionName, name, XR_MAX_ACTION_NAME_SIZE);
+    memcpy(out->localizedActionName, localized, XR_MAX_LOCALIZED_ACTION_NAME_SIZE);
+    return 1;
+}
+
+static void dedup_note(XrActionSet set, const XrActionCreateInfo *info) {  // caller holds dedup_lock
+    if (dedup_count >= DEDUP_MAX) return;
+    dedup_seen[dedup_count].set = set;
+    snprintf(dedup_seen[dedup_count].name, XR_MAX_ACTION_NAME_SIZE, "%s", info->actionName);
+    snprintf(dedup_seen[dedup_count].localized, XR_MAX_LOCALIZED_ACTION_NAME_SIZE, "%s", info->localizedActionName);
+    ++dedup_count;
+}
+
 static XRAPI_ATTR XrResult XRAPI_CALL hook_xrCreateAction(XrActionSet set, const XrActionCreateInfo *info,
         XrAction *action) {
     PFN_xrCreateAction fn = (PFN_xrCreateAction)lookup(active_instance, "xrCreateAction");
     if (!fn) return XR_ERROR_FUNCTION_UNSUPPORTED;
-    XrResult r = fn(set, info, action);
-    if (XR_SUCCEEDED(r) && info && action) {  // OVRPlugin's action names
+    XrActionCreateInfo copy, renamed;
+    XrPath *kept = info && info->countSubactionPaths ? calloc(info->countSubactionPaths, sizeof(*kept)) : NULL;
+    const XrActionCreateInfo *use = detached_strip_action(info, &copy, kept);
+    char name[XR_MAX_ACTION_NAME_SIZE], localized[XR_MAX_LOCALIZED_ACTION_NAME_SIZE];
+    if (action_dedup && info) pthread_mutex_lock(&dedup_lock);
+    if (action_dedup && info && dedup_rename(set, use, &renamed, name, localized)) {
+        LOG("action_dedup: action \"%s\" (\"%s\") already exists in its set: created as \"%s\" (\"%s\")",
+            info->actionName, info->localizedActionName, name, localized);
+        use = &renamed;
+    }
+    XrResult r = fn(set, use, action);
+    if (action_dedup && info) {
+        if (XR_SUCCEEDED(r)) dedup_note(set, use);
+        pthread_mutex_unlock(&dedup_lock);
+    }
+    if (input_diag) diag_log_action(use, r);  // this hook replaces input_diag's wrapper of xrCreateAction
+    free(kept);
+    if (proximity_emul && XR_SUCCEEDED(r) && info && action) {  // OVRPlugin's action names
         if (!strcmp(info->actionName, "hand_thumb_proximity")) thumb_proximity_action = *action;
         else if (!strcmp(info->actionName, "hand_trigger_proximity")) trigger_proximity_action = *action;
         else return r;
@@ -429,11 +490,26 @@ static XrResult remap_to_touch(XrInstance instance, PFN_xrSuggestInteractionProf
     return r;
 }
 
+static XrResult suggest_bindings(XrInstance instance, PFN_xrSuggestInteractionProfileBindings fn,
+                                 const XrInteractionProfileSuggestedBinding *suggested);
+
 static XRAPI_ATTR XrResult XRAPI_CALL hook_xrSuggestInteractionProfileBindings(XrInstance instance,
         const XrInteractionProfileSuggestedBinding *suggested) {
     PFN_xrSuggestInteractionProfileBindings fn =
         (PFN_xrSuggestInteractionProfileBindings)lookup(instance, "xrSuggestInteractionProfileBindings");
     if (!fn) return XR_ERROR_FUNCTION_UNSUPPORTED;
+    XrInteractionProfileSuggestedBinding copy;
+    XrActionSuggestedBinding *kept = suggested && suggested->countSuggestedBindings
+        ? calloc(suggested->countSuggestedBindings, sizeof(*kept)) : NULL;
+    const XrInteractionProfileSuggestedBinding *use = detached_strip_bindings(suggested, &copy, kept);
+    // a profile with only detached-controller bindings: nothing the runtime could bind
+    XrResult r = use != suggested && !use->countSuggestedBindings ? XR_SUCCESS : suggest_bindings(instance, fn, use);
+    free(kept);
+    return r;
+}
+
+static XrResult suggest_bindings(XrInstance instance, PFN_xrSuggestInteractionProfileBindings fn,
+                                 const XrInteractionProfileSuggestedBinding *suggested) {
     PFN_xrPathToString to_string = (PFN_xrPathToString)lookup(instance, "xrPathToString");
     if (suggested && to_string && (layer_debug || aim_correction_on()))
         for (uint32_t i = 0; i < suggested->countSuggestedBindings; ++i) {
@@ -456,6 +532,7 @@ static XRAPI_ATTR XrResult XRAPI_CALL hook_xrSuggestInteractionProfileBindings(X
     }
     if (r != XR_ERROR_PATH_UNSUPPORTED || app_suggested_touch || !IN(profile, NEWER_TOUCH)) return r;
     XrResult remapped = remap_to_touch(instance, fn, to_string, suggested, profile);
+    if (XR_SUCCEEDED(remapped)) snprintf(remapped_profile, sizeof(remapped_profile), "%s", profile);
     return XR_SUCCEEDED(remapped) ? XR_SUCCESS : r;
 }
 
@@ -552,6 +629,26 @@ static XRAPI_ATTR XrResult XRAPI_CALL hook_request_refresh_rate(XrSession sessio
     return XR_FAILED(result) && refresh_rate > 0 ? XR_SUCCESS : result;
 }
 
+// Always on: the Frame's runtime has no XR_FB_display_refresh_rate; OVRPort's dispatcher still offers the extension and
+// its xrGetDisplayRefreshRateFB then answers 0 Hz. idTech 4 VR ports (Team Beef's Doom3Quest engine: PreyVR, GitHub
+// #306) run their game clock at 1000 / refresh ms per tic: with 0 Hz the tic length is 0, the async thread spins and
+// the frame/GUI time never advances (main menu stuck at its first animation step: black, only the cursor). A rate the
+// runtime doesn't give is replaced by the one the frame timing shows (refresh_rate.h).
+static XRAPI_ATTR XrResult XRAPI_CALL hook_get_refresh_rate(XrSession session, float *rate) {
+    if (!rate) return XR_ERROR_VALIDATION_FAILURE;
+    PFN_xrGetDisplayRefreshRateFB fn = (PFN_xrGetDisplayRefreshRateFB)lookup(active_instance, "xrGetDisplayRefreshRateFB");
+    XrResult result = fn ? fn(session, rate) : XR_ERROR_FUNCTION_UNSUPPORTED;
+    if ((XR_SUCCEEDED(result) && *rate > 0.0f) || result == XR_ERROR_HANDLE_INVALID) return result;
+    float runtime = XR_SUCCEEDED(result) ? *rate : 0.0f;
+    *rate = fb_refresh_rate((int64_t)last_display_period, refresh_rate);
+    static int logs;
+    if (logs < 4) {
+        ++logs;
+        LOG("refresh rate: runtime reported %.1f Hz (result %d), reporting %.1f Hz", runtime, result, *rate);
+    }
+    return XR_SUCCESS;
+}
+
 static XRAPI_ATTR XrResult XRAPI_CALL hook_xrBeginSession(XrSession session, const XrSessionBeginInfo *info) {
     PFN_xrBeginSession fn = (PFN_xrBeginSession)lookup(active_instance, "xrBeginSession");
     if (!fn) return XR_ERROR_FUNCTION_UNSUPPORTED;

native/adapter/snapshot_gl.c

@@ -1,6 +1,6 @@
 // FramePort FrameBridge: eye-image snapshots for headless diagnostics (setting snapshot=<seconds>, GLES games only).
 // Every <seconds>, at xrEndFrame, the left-eye image the game just submitted (projection layer, view 0: its swapchain
-// image and array layer) is read back on the game's own GL context and written at a quarter of its size as
+// image and array layer; without a projection layer the first quad/cylinder layer's) is read back on the game's own GL context and written at a quarter of its size as
 // /sdcard/Android/data/<package>/files/fb_snap_<n>.ppm (n = 0-7, the oldest is overwritten). Nobody wears the headset
 // in a launch test, so the headset view stays black: this shows what the game itself draws (e.g. which screen it is
 // stuck on). The game's framebuffer, pack-buffer and pack-alignment bindings are restored afterwards.
@@ -17,9 +17,6 @@ SNAP_GL_FUNCS(SNAP_DECLARE)
 #undef SNAP_DECLARE
 static EGLContext (*s_eglGetCurrentContext)(void);
 
-// The swapchain image tracking also serves projection_only=2 (quad_compose_gl.c).
-#define snap_tracking() (snapshot || projection_only == 2)
-
 static struct {
     XrSwapchain handle;
     uint32_t width, height, array_size, count, last_acquired;
@@ -51,7 +48,7 @@ static int snap_find(XrSwapchain handle, int create) {
 }
 
 static void snap_on_create(XrSwapchain handle, const XrSwapchainCreateInfo *info) {
-    if (!snap_tracking() || !info) return;
+    if (!snapshot || !info) return;
     pthread_mutex_lock(&snap_lock);
     int i = snap_find(handle, 1);
     if (i >= 0) {
@@ -63,7 +60,7 @@ static void snap_on_create(XrSwapchain handle, const XrSwapchainCreateInfo *info
 }
 
 static void snap_on_destroy(XrSwapchain handle) {
-    if (!snap_tracking()) return;
+    if (!snapshot) return;
     pthread_mutex_lock(&snap_lock);
     int i = snap_find(handle, 0);
     if (i >= 0) snap_chains[i].handle = XR_NULL_HANDLE;
@@ -71,7 +68,7 @@ static void snap_on_destroy(XrSwapchain handle) {
 }
 
 static void snap_on_enumerate(XrSwapchain handle, uint32_t count, const XrSwapchainImageBaseHeader *images) {
-    if (!snap_tracking() || !images || !count || images->type != (XrStructureType)1000024002) return;  // OPENGL_ES_KHR
+    if (!snapshot || !images || !count || images->type != (XrStructureType)1000024002) return;  // OPENGL_ES_KHR
     pthread_mutex_lock(&snap_lock);
     int i = snap_find(handle, 1);
     if (i >= 0) {
@@ -84,7 +81,7 @@ static void snap_on_enumerate(XrSwapchain handle, uint32_t count, const XrSwapch
 }
 
 static void snap_on_acquire(XrSwapchain handle, uint32_t index) {
-    if (!snap_tracking()) return;
+    if (!snapshot) return;
     pthread_mutex_lock(&snap_lock);
     int i = snap_find(handle, 0);
     if (i >= 0) snap_chains[i].last_acquired = index;
@@ -121,18 +118,27 @@ static void snap_end_frame(const XrFrameEndInfo *info) {
     int64_t t = (int64_t)now.tv_sec * 1000000000ll + now.tv_nsec;
     if (t < next_ns) return;
     next_ns = t + (int64_t)snapshot * 1000000000ll;
-    const XrCompositionLayerProjection *proj = NULL;
-    for (uint32_t i = 0; i < info->layerCount && !proj; ++i)
+    // The projection layer's left eye; a frame without one (e.g. a menu shown only as a quad or cylinder layer) gives
+    // its first quad/cylinder layer's image instead.
+    const XrSwapchainSubImage *sub = NULL;
+    int type = 0;
+    for (uint32_t i = 0; i < info->layerCount && !sub; ++i)
         if (info->layers[i] && info->layers[i]->type == XR_TYPE_COMPOSITION_LAYER_PROJECTION &&
             ((const XrCompositionLayerProjection *)info->layers[i])->viewCount)
-            proj = (const XrCompositionLayerProjection *)info->layers[i];
-    if (!proj || !snap_load_gl()) return;
+            sub = &((const XrCompositionLayerProjection *)info->layers[i])->views[0].subImage, type = info->layers[i]->type;
+    for (uint32_t i = 0; i < info->layerCount && !sub; ++i) {
+        const XrCompositionLayerBaseHeader *layer = info->layers[i];
+        if (layer && layer->type == XR_TYPE_COMPOSITION_LAYER_QUAD)
+            sub = &((const XrCompositionLayerQuad *)layer)->subImage, type = layer->type;
+        else if (layer && layer->type == XR_TYPE_COMPOSITION_LAYER_CYLINDER_KHR)
+            sub = &((const XrCompositionLayerCylinderKHR *)layer)->subImage, type = layer->type;
+    }
+    if (!sub || !snap_load_gl()) return;
     if (!s_eglGetCurrentContext()) {
         static int logged;
         if (!logged++) LOG("snapshot: no GL context current in xrEndFrame, no snapshot");
         return;
     }
-    const XrSwapchainSubImage *sub = &proj->views[0].subImage;
     pthread_mutex_lock(&snap_lock);
     int i = snap_find(sub->swapchain, 0);
     GLuint tex = 0;
@@ -170,6 +176,21 @@ static void snap_end_frame(const XrFrameEndInfo *info) {
     s_glDeleteFramebuffers(1, &fb);
     while (s_glGetError() != GL_NO_ERROR) {}  // our calls must not leave errors for the game to find
     if (rgba) {
+        // brightness of the submitted area: tells a black image from a drawn one without fetching the file
+        uint64_t sum = 0, n = 0;
+        unsigned max = 0;
+        const XrRect2Di *r = &sub->imageRect;
+        for (int32_t y = r->offset.y; y < r->offset.y + r->extent.height; y += 4)
+            for (int32_t x = r->offset.x; x < r->offset.x + r->extent.width; x += 4) {
+                if (x < 0 || y < 0 || (uint32_t)x >= w || (uint32_t)y >= h) continue;
+                const unsigned char *p = rgba + ((size_t)y * w + (size_t)x) * 4;
+                unsigned v = p[0] > p[1] ? (p[0] > p[2] ? p[0] : p[2]) : (p[1] > p[2] ? p[1] : p[2]);
+                sum += v, ++n;
+                if (v > max) max = v;
+            }
+        LOG("snapshot: layer type=%d image %u array=%u rect=%d,%d %dx%d of %ux%u: mean %.1f max %u",
+            type, tex, sub->imageArrayIndex, r->offset.x, r->offset.y, r->extent.width, r->extent.height, w, h,
+            n ? (double)sum / (double)n : 0.0, max);
         snap_write(rgba, w, h, taken++ % 8);
         free(rgba);
     }