Cpp2IL: run with invariant globalization (.NET aborts without libicu on fresh WSL/Linux); don't cache .NET start failures as unreadable games, retry old cached ones; CLAUDE.md/PLAYBOOK: STAGE bounds note

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VmL5PrKqxEyNSQdgkQPbUD

CLAUDE.md

@@ -6,7 +6,6 @@ FramePort ports Meta Quest standalone APKs to the **Valve Steam Frame** (SteamOS
 install over SSH (agent) → Steam shortcut → headless launch test + log triage`.
 
 Read `docs/PLAYBOOK.md` (symptom → fix) before debugging a game, and `docs/FRAME_RUNTIME.md` for runtime facts.
-Detailed device findings per game/issue: docs/DEVICE_NOTES.md (read before debugging a game).
 
 ## Layout
 - `src/frameport/` — Python package. `pipeline.py` is the API the CLI (`cli.py`) and GUI (`ui/`, Flet 1.0) share.
@@ -124,9 +123,8 @@ Detailed device findings per game/issue: docs/DEVICE_NOTES.md (read before debug
     `ft.AnimatedSwitcher` (`app._show_view`): a new route gets a new wrapper (150 ms fade), a same-route redraw swaps
     the wrapper's content (no animation; persistent views just remount); the wordmark's portal (`wordmark().data`)
     pulses once when frame_state turns "connected"; both off with setting `ui.reduce_motion` (Settings → Appearance
-    "Reduce motion", `app.reduce_motion`). Settings has a fixed index column (`settings.SECTIONS` order: most users'
-    needs first (Updates, which also holds game recipe + install-link updates, Installing, Library folders,
-    Appearance), niche ones later (Install links, Tools, This PC), Remove FramePort last): entries scroll the section column via `scroll_to(scroll_key=…)` (sections wrapped
+    "Reduce motion", `app.reduce_motion`). Settings has a fixed index column (`settings.SECTIONS` order, Appearance
+    first, Remove FramePort last): entries scroll the section column via `scroll_to(scroll_key=…)` (sections wrapped
     in Containers with `ft.ScrollKey`), the header stays; `app.settings_view.show_section(key)` (ui_smoke
     `settings-index`).
     Help hints: wording for non-obvious terms lives in `ui/help.py` (`HELP`); show it with `C.help_icon(key)` or the
@@ -140,7 +138,6 @@ Detailed device findings per game/issue: docs/DEVICE_NOTES.md (read before debug
     uploads are interruptible (Cancel checked per MiB) and resumable (big files via SFTP `.part` append, small files
     streamed in tar batches; the agent counts files already in `incoming/`). Multi-select in the Library queues
     installs after asking every needed question up front. Failures end in one pop-up (Resume / Uninstall / log).
-  - Library folders (GitHub discussion #351): `core/folders.py` (no Flet) owns setting `scan.roots` (remember/add/remove/status/rescan_roots; the origin-based fallback only while the setting was never set, so removing every folder doesn't guess them back), Settings → Library folders (`settings.library_folders`, status read via run_bg), CLI `frameport folders [--add/--remove/--json]` + `frameport rescan`. Scans relink moved games (`pipeline.ScanReport`: a library game found elsewhere whose own files are gone and the copy is the same build (Quest: source_sha256, else versionName; Rift: same program path + size from the fingerprint, matched by game id or, renamed, by program) → only paths change (`relink_quest`/`_relink_rift`), user fields/builds/installs stay; another version → Scan a folder… takes it via `replace_apk(found=)`/`replace_rift_game`, Rescan only reports it; the old copy still there → kept). `add_game` no longer overwrites a user recipe (refreshes `suggested` only). Linux apps aren't scanned. PC installs of a moved Rift game (Steam shortcut path) untested.
   - Other drives (GitHub #90, agent v63): anchors stay in ~/Applications/quest-frame, a game's files may live in
     `<mount>/FramePort/<pkg>` (`deployment.json` base). Agent `drives` (/proc/mounts, /run/media + Steam library
     drives; vfat/exfat/ntfs/read-only refused), prepare*/finalize_linux `dest` (unmounted = error, never a fallback;
@@ -244,14 +241,6 @@ Rick and Morty runs on the Frame via its catalog recipe (OpenVR, no Revive),
     flask icon (SCIENCE_OUTLINED) so they aren't confused with Play.
   - `uninstall.py` + `frameport uninstall-app` + Settings: removes the data dir (after an optional key backup zip),
     PC Steam shortcuts, the WSL Revive copy, and via agent `purge` FramePort's games/files on the Frame.
-  - Save backups (discussion #352, agent v95; docs/FRAME_RUNTIME.md "Save backups"): agent `_backup_saves`/
-    `_restore_saves '<json>'` stream a tar.gz of `lepton-data/internal/<pkg>` + `external/Android/data/<pkg>` (caches,
-    IL2CPP/shader caches, FrameBridge files, videos/OBBs, files >64 MiB left out; manifest `frameport-saves.json` last)
-    over the exec channel, file work in `podman unshare` (`_saves_ns`), launch lock held, refused while running;
-    restore = untrusted input (staged + checked first), rollback copy `<base>/saves-before-restore.tar.gz` (undo =
-    `rollback: true`). PC `install/saves.py` (`<data>/save-backups/<pkg>/<ts>.tar.gz` + `.json`, keep `saves.keep`
-    = 10), GUI `ui/views/saves_dialog.py` (game menu section "Saves", Frame page "Back up all saves", uninstall's
-    "back up before deleting"), CLI `frameport saves backup|list|restore|undo`.
   - `patches/` — **the unit of modularity**. `base.py` (Patch interface, registry), `overport.py` (overport CLI patch ids,
     discovered dynamically via `overport patches`), `frame/*.py` (one module per Frame fix), `settings.py` (FrameBridge
     adapter keys + device files as patches). Add a patch = add a module that calls `register(...)`.
@@ -360,7 +349,45 @@ Rick and Morty runs on the Frame via its catalog recipe (OpenVR, no Revive),
   `a32_bridge_on` turned the bridge on once in every 32-bit recipe, user ones too, unless the catalog's frame_remove
   names it).
   Analysis `extra.headset` (ANALYSIS_VERSION 15): gearvr / go / quest → "Gear VR" / "Oculus Go" platform + Steam tag.
-  Catalog: `headset:` field; com.fallen.affected, net.mobilemischief.spunkydungeon, com.ccpgames.gunjack (works, 2026-10-12). Per-game a32 findings (AFFECTED, Spunky Dungeon, Gunjack's signature check `fp_a32_signature.txt`, synthetic Gear VR input, Quest builds `fp_a32_headset.txt` / `quest_touch`, recenter, debugging aids `A32_BREAK` / `A32_STRACE` / `A32_PERFMAP`, translator profiling): docs/DEVICE_NOTES.md#a32-bridge-games-lessons-debugging-aids-profiling.
+  Catalog: `headset:` field; com.fallen.affected, net.mobilemischief.spunkydungeon, com.ccpgames.gunjack (works, 2026-10-12). Learned: Unity 2019 contexts
+  have no EGLConfig (EGL_KHR_no_config_context: the VrApi bridge takes the window's or an RGBA8 ES3 config); Unity's
+  floor origin = vrapi_SetTrackingSpace(1) (the VrApi bridge now honours LOCAL_FLOOR/STAGE); mapped GL buffers are
+  per buffer object (a per-target guest copy leaked ~10 MB/s and garbled vertices); the guest runtime's own scudo
+  names its maps `[anon:scudo:*]` below 4 GiB (watch them for guest leaks). The Go controller = the right Frame
+  controller (stick = touchpad touch, sideways > 0.6 or press = click). Gunjack (CCP, UE 4.10 NativeActivity, Gear VR,
+  2026-10-10): needed the native_app_glue imports (ALooper/AInputQueue/AConfiguration/AAsset*, imports.txt), an arm64
+  libvrapi.so for Java's System.loadLibrary("vrapi") and MOUNTED under OVP_HEADLESS_TEST; it then loads its map and
+  quit on purpose: AndroidMain compares AndroidThunkCpp_GetSignature() with an obfuscated copy. **Works since
+  2026-10-11 (owner-verified in the headset):** GameActivity.AndroidThunkJava_GetSignature() = Base64.DEFAULT(SHA-1(
+  signing certificate DER)) (jadx); `a32_bridge.original_signature` computes it from the original APK's
+  META-INF/*.RSA|DSA|EC, `convert()` stores it as `assets/fp_a32_signature.txt` for libUE4.so games, the bridge loads
+  it at activity creation (native_activity.c) and jni.c answers Call*Method on the method ID of
+  `AndroidThunkJava_GetSignature()Ljava/lang/String;` with it. After loading, Unreal leaves VR mode and enters it again on
+  the same GL context; a second OpenXR session there aborted in vrclient (CSharedSemaphoreLinux::WaitFromGPU from the GL
+  binding's PreBeginFrame, also with OVP_HEADLESS_TEST) → the VrApi bridge keeps a running GLES session across
+  LeaveVrMode and reuses it for an EnterVrMode with the same context (upstream-patches/runtime.cpp.patch).
+  Debugging aids added: A32_BREAK=<guest addr>[,..] (stack of the first hits; guest libs load at fixed addresses, e.g.
+  libUE4 0xf25d5000), A32_STRACE in bridge mode = path/exit calls to logcat, activity lifecycle + LeaveVrMode caller
+  logs. Lepton's logcat mirror often dies for these games: read `podman exec <container> logcat` instead. Gunjack input
+  (2026-10-11): it imports no vrapi input functions and reads the Gear VR touchpad/back as AInputEvents from its
+  AInputQueue (native_app_glue), so dispatchKeyEvent never reached it (no control at all) → input.c queues synthetic
+  events there (ALooper_poll* return the queue's ident while one waits; AInputQueue_getEvent/finishEvent and the
+  AInputEvent/AKeyEvent/AMotionEvent getters are hand-written "!" imports that know them; touch positions scaled to the
+  window size). Same mapping as AFFECTED: trigger = hold touchpad, A = tap, right stick = swipe, B = back; for NativeActivity games the stick's up/down = swipe forward/back (touchpad X: Gunjack's OnFlick = reload at ~0°, special weapon at ~180°). Not yet
+  headset-verified. Quest builds on the bridge (2026-10-13, Sports Scramble = a 32-bit Santa Cruz build,
+  UE 4.21 + OVRPlugin on VrApi 1.21): manifest requires `android.hardware.vr.headtracking` version 1
+  (`detect.requires_6dof`, headset "quest", ANALYSIS_VERSION 16) → convert writes `assets/fp_a32_headset.txt`
+  = "quest" → vrapi.c `quest_touch` (read in vrapi_Initialize via the activity's AssetManager; A32_TOUCH=1/0
+  overrides) passes the 64-bit bridge's Touch controllers through (enumerate/caps/state/tracking/haptics, struct
+  tails per VrApi minor) and starts no synthetic input. It also needed AAsset_getBuffer (guest copy, freed in
+  AAsset_close), AKeyEvent_getFlags and the other AConfiguration getters. Headset (owner, 2026-10-13): plays,
+  both controllers work. Recenter (holding the Frame's menu button) turned VrApi games ~90-120 degrees aside: the bridge's app space is LOCAL + the start yaw and the runtime moves LOCAL to the head → the bridge now takes the origin from the head again on XR_TYPE_EVENT_DATA_REFERENCE_SPACE_CHANGE_PENDING (LOCAL) and on vrapi_RecenterPose (owner-verified with Gunjack, 2026-10-13). Next: the other 32-bit catalog games (Journey of the Gods, Shadow Point: still "unsupported" until
+  tested), translator speed. Profiled on the Frame
+  (2026-10-12, `A32_PERFMAP` + perf): FPCR switches are negligible (8 of 86k samples); the cost was the run loop
+  (a mutex + hash-chain walk on every dispatch, a contended counter, inline-lookup slots never refilled: Gunjack
+  ~45 % of its CPU) and `jit_invalidate` scanning every block on each Mono `cacheflush` (72 % of Spunky Dungeon's
+  main thread). Now lock-free lookups, ltab refill, per-thread flags, per-page block lists: Gunjack's dispatcher
+  23.6 % -> 1.6 %, CPU in the same phase about -55 %, still 72 fps.
 - `scripts/` — `package.py` (flet build/pack), `eval_heuristics.py` (score heuristics), `ui_smoke.py` (GUI screenshots).
 - `docs/` — PLAYBOOK, FRAME_RUNTIME, ARCHITECTURE, INSTALL (end users), parity reports (offline + device).
 
@@ -448,10 +475,9 @@ Repo is on an NTFS drive (`core.fileMode=false`); line endings are LF (`.gitattr
   XR_KHR_composition_layer_equirect2/cylinder, XR_FB_composition_layer_image_layout (flip emulated by Vulkan blit).
 - `xrConvertTimespecTimeToTimeKHR`/`xrConvertTimeToTimespecTimeKHR` return FUNCTION_UNSUPPORTED → adapter emulates
   (offset = predictedDisplayTime − period − CLOCK_MONOTONIC, sampled in xrWaitFrame).
-- No XR_FB_display_refresh_rate (`xrGetDisplayRefreshRateFB` -7), yet OVRPort's dispatcher offers it and answered 0 Hz
-  → FrameBridge always answers with the measured rate (1/predictedDisplayPeriod, else 72). PreyVR (#306, idTech 4:
-  `USERCMD_MSEC = 1000 / GetRefresh()`) had 0 ms tics: async thread spinning, `com_frameTime` stuck at 0, menu black.
-- Guardian STAGE bounds report 1×1 m (scene emulation uses ≥1.5 m).
+- Guardian STAGE bounds report 1×1 m (scene emulation uses ≥1.5 m). OVRPlugin treats that rect as a configured
+  boundary but can't outline it ("ovrpBoundary_Outer is not supported"): Demeter's guardian check indexed an empty
+  array → with `scene_emul` the app's STAGE `xrGetReferenceSpaceBoundsRect` returns XR_SPACE_BOUNDS_UNAVAILABLE.
 - GL goes through **Zink** (Mesa GL on Vulkan). Mesa GLSL is strict: `#pragma` before `#extension` fails, implicit
   int/float conversions fail (enable `GL_EXT_shader_implicit_conversions`), num_views=2 shaders on single-view FBOs
   give GL_INVALID_OPERATION. Some GLES games hit `zink: DEVICE LOST` (Unity MSAA RTT; Sniper Elite VR even without).
@@ -520,14 +546,28 @@ Launch tests ignore log files older than the launch (stale Proton/game logs used
 (`\\wsl$` is unreliable), so PC mode copies Revive to `%LOCALAPPDATA%\FramePort`.
 FramePort never bypasses Oculus entitlement checks (Platform SDK games: flagged, PC mode with the Oculus app only).
 
-**Upload speed:** home Wi-Fi caps uploads at ~11-18 MB/s whatever the SSH method; the Frame's hotspot (`wlanap`) ~83-97 MB/s; `Frame.fast_link()` (installer `transfer_link`, uploads ≥64 MiB) prefers usb0 > wlanap when the host key matches. → docs/DEVICE_NOTES.md#upload-speed
+**Upload speed (measured 2026-09-29):** via the home router (PC Wi-Fi → router → Frame wlan0) only 15-18 MB/s, the
+same for paramiko, OpenSSH and 4 parallel streams, so the network path is the limit, not the SSH code. Direct to the
+Frame's hotspot (`wlanap` 10.35.78.1; the owner's PC has Valve's USB Wi-Fi dongle on it) 83 MB/s OpenSSH / 97 MB/s
+paramiko; reading dumps from D: via WSL drvfs is then the cap (~82 MB/s). `Frame.fast_link()` (installer
+`transfer_link`, uploads ≥64 MiB) uses usb0 > wlanap when reachable **and** the host key matches the paired Frame.
 **Platform SDK detection** must include delay imports (`PEInfo.delay_imports`), modular Unreal's
 `*-OnlineSubsystemOculus-*.dll` and Ready At Dawn's `pnsovr.dll`: Robo Recall, Lies Beneath and Lone Echo I/II all use
 it; without the Oculus app they crash with 0xc06d007e (triage `delayload-missing`) — not fixable legitimately.
 GUI: Frame → Installed → folder icon = file browser (agent `list_files`, flags files missing vs the install
 manifest); Settings → About shows the bundled agent version and the Frame's.
 
-**Revive under Proton arm64:** Revive's Detours hooks don't take effect (Wine's kernelbase is ARM64EC); a system32 `LibOVRRT64_1.dll` symlink gets past -3001 to -3021 = ovrError_LibSignCheck (Oculus-signed runtime required; not bypassed). → docs/DEVICE_NOTES.md#revive-under-proton-arm64-lone-echo
+**Revive under Proton arm64 (Lone Echo, 2026-09-29):** Revive's Detours hooks (LoadLibraryW/ExW, OpenEventW, the
+signature check) don't take effect: Wine's kernelbase is ARM64EC. The LibOVR shim in the game then does a plain
+`LoadLibrary("LibOVRRT64_1.dll")` search (exe dir, cwd, system32, windows, PATH — no registry, `OculusBase` or
+`LIBOVR_DLL_DIR` used by this build) → `Failed to initialize Oculus API (-3001)` (= Lies Beneath's "Unable to load
+LibOVRRT DLL"). A symlink `pfx/drive_c/windows/system32/LibOVRRT64_1.dll -> <base>/revive/LibReviveXR64.dll` (Wine
+maps a symlink to the already-loaded module) gets past it to **-3021 = ovrError_LibSignCheck**: the shim only accepts
+an Oculus-signed runtime. Next step (not done): make the runtime check pass without Detours, e.g. an injected helper
+that patches the game's import table (IAT) for LoadLibrary*/WinVerifyTrust, or a prefix-level override. This is
+runtime interop (what Revive does), not the Platform SDK licence check (which FramePort never touches).
+Uninstall (Quest, saves kept) used to leave `deployment.json` → still "installed"; fixed (agent v16).
+
 **Discovery/network:** Developer-Mode SteamOS devices announce `_steamos-devkit._tcp` (TXT `login=steamos`) — use it;
 they don't publish `_ssh._tcp`. The Frame has several links: `wlan0` (home Wi-Fi), `wlanap` = its own hotspot at
 10.35.78.1/24 (a PC can join it directly), `usb0` = USB gadget network 10.86.200.233/29 (up when cabled to a PC).
@@ -541,7 +581,23 @@ stopping Steam kills them → always run that work via `systemd-run --user` (the
 **overport:** always `--version=latest`; `--workspace` holds runtimes and **per-package keystores (password
 "password", alias "key") — never lose them**: updates must be signed with the same key or saves are lost on reinstall.
 Output is deterministic (same input + runtime → same bytes), which is what makes parity testing possible.
-**OVRPort 1.2.5 (2026-10-01):** `patch` rejects unknown/duplicate args, unknown ids and an empty `--patches=`; it adds `libovrplatformcompat.so` itself (`frame.ovrplatformcompat` then skips). New patches `patch_ac_nexus_no_appsw_72/_90` (AC Nexus build 207706 only; `_90` = catalog default; STRICT patches only from a catalog recipe where `applies()` holds), `patch_disable_meta_xr_audio_telemetry`, `patch_vrapi_openxr` (OVRPort's VrApi translator fails on the Frame → keep `frame.vrapi_bridge`). The owner prefers OVRPort's fixes over ours where they work as well. `frameport install <pkg> --apk <file>` installs a test build. → docs/DEVICE_NOTES.md#ovrport-125
+**OVRPort 1.2.5 (2026-10-01, the fork's first release; CLI-only):** same commands (`patches [--json]`, `patch`, `help`,
+`install`), but `patch` rejects unknown/duplicate args, unknown patch ids and an empty `--patches=`
+(`tools/overport.patch` refuses empty lists). After patching it adds `libovrplatformcompat.so` itself when the platform
+loader lacks `ovrMessageType_ToString` (our `frame.ovrplatformcompat` then skips: same library). New patches (all off;
+`patches/overport.py`): `patch_ac_nexus_no_appsw_72/_90` (AC Nexus build 207706 only, exclusive),
+`patch_disable_meta_xr_audio_telemetry` (x86_64 emulators: hidden), `patch_vrapi_openxr` = OVRPort's VrApi adapter =
+the **unpatched** upstream of our `frame.vrapi_bridge` (`native/vrapi` unchanged since our 5e7df52), only usable with an
+experimental CLI built with `-PwithVrApi=true` (stable jars list it but fail). The owner prefers OVRPort's fixes over
+ours where they work as well (less to maintain): compare in the headset before switching a default.
+`frameport install <pkg> --apk <file>` installs a specific (test) build signed with the game's key.
+Headset results (2026-10-02, `PATCHED/_test-ovrport-1.2.5/TESTING.md`): OVRPort's own VrApi translator fails on the
+Frame (Climb 2: requests VkFormat 37 → crash; POTW: no GLES path, missing `vrapi_GetTextureSwapChainHandle`) → keep
+`frame.vrapi_bridge`; those two changes are upstream candidates. 1.2.5 builds (its platform compat, new permissions)
+work. AC Nexus: `patch_ac_nexus_no_appsw_90` is the catalog default (owner preferred 90 Hz); `STRICT` patches are only
+taken from a catalog recipe where `applies()` holds (the AC Nexus ones need build MAIN.450412.207706.final, else the
+whole overport run fails).
+
 **Patching gotchas:**
 - UnityPy re-serialization breaks scene loading → patch QualitySettings ints in place.
 - LIEF's DT_NEEDED injection shifts segments; our `elf.add_needed` appends a new PT_LOAD (reuses PT_NOTE, else moves the
@@ -553,64 +609,439 @@ Output is deterministic (same input + runtime → same bytes), which is what mak
 - VrApi-direct engines (CryEngine Climb 2, POTW) need the VrApi bridge; the bridge drops whole frames on unknown layer
   types (→ black screen with audio).
 
-**Steam Frame controller models:** adapter setting `controller_models` (`native/adapter/render_model.c`, emulates XR_FB_render_model) + agent `install_controller_models` (Frame's SteamVR models → glb at finalize); no catalog game uses runtime models; Valve's models are never committed or copied off the Frame. → docs/DEVICE_NOTES.md#steam-frame-controller-models
+**Steam Frame controller models (2026-09-30, not yet seen in a game):** adapter setting `controller_models`
+(`native/adapter/render_model.c`) emulates XR_FB_render_model and serves `files/framebridge/controller_{left,right}.glb`;
+agent v20 (`install_controller_models`, command `controller_models`) converts the Frame's SteamVR render models
+(folder name matching "frame" + left/right, OBJ+PNG, `openxr_grip` component → grip space) at finalize/set_settings.
+Valve's models are never committed or copied off the Frame. Only games that use Meta's runtime controller models
+benefit (manifest `RENDER_MODEL` permission/feature → suggested); **none of the 34 catalog games do** (they ship their
+own meshes: that would need per-game asset replacement). Model discovery and conversion
+checked on the device 2026-09-30: `/opt/steamvr/drivers/frame_controller/resources/rendermodels/frame_controller_{left,right}`
+(component OBJs in model space = the whole `<name>.obj`, one `_color.png` 2048² near-black, `openxr_grip` rotates about
+X only; hidden-by-default components like `status` are skipped) → ~2 MB glb each, ~1 s. Not yet seen in a game (none
+of the installed builds has the new adapter, and none requests runtime models), so whether Meta's SDK attaches runtime models at the grip pose is unverified.
 **overport's dispatcher (`libopenxr_loader.so`) only forwards functions in its own table** (`overportOXR: Unknown
 proc addr: …`), so adapter emulations of functions it doesn't know are unreachable. For XR_FB_render_model,
 `native/xrshim` fills the gap: OVRPlugin's `dlopen("libopenxr_loader.so")` string is rewritten to the shim (see
 native/README). Verified on the device with Toy Master (2026-09-30): `extension shim: xrLoadRenderModelFB -> FrameBridge`.
 Toy Master doesn't request a model after that (it uses its own), so the glb loading path is only unit-tested.
 
-**Crash backtraces:** Lepton writes tombstones only to `lepton-logcats/steamlaunch-<appid>/logcat-crash.log` (launch tests return `crash_log`). Fossilize loads into every app (userdebug guest) → `frame.vk_sanitize` (`native/vkshim`); overport's dispatcher aborts on swapchains > 4096 px → `frame.swapchain_limit`; cylinder layers → quad strips (`cylinder_strips`). Drawing equirect layers ourselves and a focus debounce were tried and removed: don't retry without a new approach. → docs/DEVICE_NOTES.md#crash-backtraces-fossilize-swapchain-limit-cylinder-and-equirect-layers
-**360° layers / 4XVR:** the Frame's Android runtime composites only quad + projection layers (quads always above projection layers). Per-game adapter settings (off by default): `equirect_emul` (GLES), `equirect_flip/face/res/fps/stereo`, `stable_local`, `focus_hold` (default on), `aim_pitch/aim_yaw/aim_forward`, `refresh_rate`, `layer_debug`; agent `link_media` / `app_media_dirs` put sent files into a player's own folder. → docs/DEVICE_NOTES.md#360-layers--4xvr
-**Companion apps / intents:** a second APK can run inside a game's Lepton container, but Lepton turns every `android.intent.action.VIEW` with data into `steam://openurl` → "open in external player" hand-offs can't work; Lepton installs exactly one `*.apk` per app folder. → docs/DEVICE_NOTES.md#companion-apps--intents-stremio--4xvr
-**Text input:** Lepton's Android has no IME and VR apps run headless (no focused window); `lepton-show-flatscreen` keeps VR and gives focus + Steam's keyboard (`device.text_input_window`); `frame.unity_text_input` patches Unity's TMP_InputField/InputField at Cpp2IL offsets; agent `_keyboard` = uinput "Type on Frame". `pm install` of a second APK corrupts the main app (`cmd_real package install` skips the hook). → docs/DEVICE_NOTES.md#text-input-stremio-vr
-**User reports #4-#10:** shortcuts go to the signed-in account (agent `library_users`), `launch` errors `NOT_IN_LIBRARY`; shared Cpp2IL run (`unity_text_input.Il2cppReturnPatch`) for `frame.unity_runtime_msaa_off` and `frame.unity_multipass`; VR4 → catalog `use_alt`. **Catalog changes reach existing games**: recipes store `catalog_rev`, `library._follow_catalog` re-derives non-user recipes. → docs/DEVICE_NOTES.md#user-reports-2026-10-04-issues-4-10
-**Round 2 of reports / headset rounds 2-3 (2026-10-04):** vkshim `vk_shader_fix` (VR4); `Il2cppReturnPatch.field_loads` (I Am Cat); builds record `recipe_fp` (changed recipe/revised patch → "Update on Frame"); `Frame.relocate`; adapter `profile_remap` (Touch Plus/Pro); `sync_guard` (Myst); `focus_hold` tuning; ovrpshim for Unity 2017 (Accounting+); Steam library to every account, `shortcuts_lost` / `add_devkit_entry`; no clipboard service → `frame.sdl_clipboard`, `frame.godot_clipboard`; 2D apps keep non-VR patches (`needs_vr = False`); `frame/local.py` (FramePort on the Frame); after every app update `library._follow_catalog` re-derives non-user recipes once (`recipes.app_version`, `library.REFRESH_ON_UPDATE`). Analysis fields added later: **bump `analysis/detect.ANALYSIS_VERSION`** (re-analysis at GUI start + `pipeline.refresh_analyses`; `analysis_failed`). Roblox and BONELAB crash (unsupported). → docs/DEVICE_NOTES.md#round-2-of-reports-headset-rounds-2-3-2026-10-04
-**Round 4:** XR_KHR_android_surface_swapchain is listed but unsupported → adapter `surface_emul` (default on, `native/adapter/surface_swapchain.c`); save folders without u/g+rwx → launch.sh `fix_perms`; Lucky's Tale OOM (no fix); `perf` works as steamos (gdb blocked); QuestCraft JRE, WiiCompiled import by hand (Lepton has no document picker). → docs/DEVICE_NOTES.md#round-4-2026-10-04-surface-swapchains-save-folder-permissions
-**Steam library failures (GitHub #21/#30/#41/#42):** on some Frames Steam never loads FramePort's shortcuts.vdf entries (Play → AppError_9) → fallback: register through Steam's devkit interface (`devkit-1 … create-shortcut`, `~/devkit-game/<id>/`; `devkit_appid`, `devkit_appid_from_log`, `devkit_unregister`, `copy_grid_art`; ids: letter first, letters/digits/_ only); `collect_diag` adds `steam_library`. Cause still unknown. → docs/DEVICE_NOTES.md#steam-library-failures-and-the-devkit-fallback-github-21304142
-**Exit game (GitHub #36):** `Apps.TerminateApp` (Steam CEF devtools on 127.0.0.1:8080) closes games; launch.sh ends the game when its parent reaper is gone (`upgrade_launchers` adds it). → docs/DEVICE_NOTES.md#exit-game-github-36
-**SteamVR dashboard at game start:** launch.sh's `_dashboard_worker` hides the dashboard via `SteamClient.OpenVR.VROverlay` (agent `steam_js`) from the first FrameBridge `new layer:` line (120 s, ≤10 times, stops after `toggle_dashboard_action`); log `<base>/dashboard.log`, opt out `FRAMEPORT_KEEP_DASHBOARD=1`. → docs/DEVICE_NOTES.md#steamvr-dashboard-at-game-start
-**Space warp / ITR2:** OVRPort's dispatcher offers XR_FB_space_warp itself (`patch_disable_space_warp` doesn't reach UE5) → FrameBridge `hide_space_warp` (per game, off; suggested for UE5 + OVRPlugin). `equirect_emul` switches itself off on Vulkan. → docs/DEVICE_NOTES.md#space-warp--itr2
-**PR #34 (Lucas-Mathieu):** `native/adapter/audio_metadata.h` keeps Meta XR Audio Wwise metadata alive (Batman: Arkham Shadow 1.4.1 smoke-bomb crash). Outside PRs: review source, rebuild `artifacts/` ourselves, merge locally. → docs/DEVICE_NOTES.md#pr-34-meta-xr-audio-metadata-batman
-**Heuristics eval (2026-10-04):** 19/44 recipes exact (superseded by the 2026-10-15 numbers under Heuristics). → docs/DEVICE_NOTES.md#heuristics-eval-2026-10-04
+**Crash backtraces (2026-09-30):** Lepton writes tombstones only to `lepton-logcats/steamlaunch-<appid>/logcat-crash.log` (after "Dumping logcat"), not launch.log; agent v23 launch tests wait for it and return `crash_log`, triage gets it via `triage(..., crash=)` (not pid-filtered: tombstones come from crash_dump's pid). The guest is `userdebug` (`ro.debuggable=1`), so Lepton's Fossilize layer loads into every app whatever the APK's debuggable flag; it has no off switch. Fossilize crashed Deadpool VR on uninitialized attachment-reference pNexts (several, in FVulkanRenderPass and the render-target layout) → `frame.vk_sanitize` = `native/vkshim` (engine's `dlopen("libvulkan.so")` string → `libfp_vk.so`, wraps vkCreateRenderPass2/KHR, drops unreadable/wrong-sType pNexts; verified: game runs). overport's dispatcher aborts on swapchains > 4096 px (`cmp wN,#4096` in xrCreateSwapchain) → `frame.swapchain_limit` (verified with 4XVR, 7680×3840 accepted by the runtime). Both are default-on (parity classifies their rewrites as
+"expected"; library migration `quest_binary_fixes_v2`). The adapter shows cylinder layers (4XVR's movie screen) as ~15° quad strips (`cylinder_strips`, setting
+`cylinder_strips`); the runtime composites them at full resolution. Equirect (360°) layers are dropped: drawing
+them ourselves (GLES renderer in xrEndFrame: stutter, never showed 4XVR's VR video; Vulkan renderer: hung the
+Frame's GPU in AC Nexus; reading the newest *released* image broke 4XVR's theatre) was removed again on the owner's
+request — don't retry without a new approach. Converted layers must count as "swapped" or the original layer list
+is submitted (runtime returns -2 for every frame). A focus debounce (hiding the Frame's brief
+FOCUSED→VISIBLE→SYNCHRONIZED dips, which make 4XVR recenter) was also removed: AC Nexus stayed black with it (it
+hid 521 ms focus changes at start). The new approach (below) is per-game, off the app's render thread, GLES-only.
+
+**360° layers / 4XVR (2026-09-30):** the Frame's Android SteamVR runtime (`/opt/steamvr/bin/androidarm64/vrclient.so`,
+mounted in Lepton as `/data/steamvr/runtime`) only composites quad + projection layers (cube/cylinder/equirect(2)
+are enum names only) — nothing to unlock. Per-game adapter settings (off by default, hooks installed only when on):
+`equirect_emul` (GLES only: a worker thread with a shared EGL context converts each 360° image to a cube map when it
+changes and draws one adapter projection layer from it for every frame with exactly that frame's views (the app's own
+projection views, else xrLocateViews at displayTime); xrEndFrame waits ≤6 ms for the worker's CPU submit, never the
+GPU. Learned in the headset: quads can't be a background (the Frame draws quad layers above all projection layers
+whatever the order: hid 4XVR's balcony/controllers), and the Frame doesn't reproject a projection layer from its own
+pose (images drawn only after head turns, or ahead from xrWaitFrame and sometimes late, wobbled);
+`equirect_flip/face/res/fps/stereo`), `stable_local`, `focus_hold` (only after 3 s FOCUSED, dips <600 ms),
+`aim_pitch/aim_yaw/aim_forward`, `refresh_rate`, `layer_debug` (diagnostics); focus_hold is default-on since 2026-10-05. 4XVR re-creates LOCAL spaces every 2–4 s
+(menu recentring suspect); its theatres are baked 7680×3840 equirect2 images (`assets/100.png` …). Test 360° videos
+(NASA, public domain) are in the Frame's ~/Videos; copies in `~/Downloads/frameport-360`. 4XVR's "Internal Storage"
+lists its own `/sdcard/4XPlayer`, not Movies: agent v25 `link_media` hard-links sent files into an app's own top-level
+folder (`app_media_dirs`), `frameport frame send --app <pkg>`, GUI game page "Add videos" (players) / "Add videos &
+files…". A 4XVR webm stereo swapchain was refused with XR_ERROR_LIMIT_REACHED (-10) → right eye grey; our projection
+swapchain was halved (1536/eye) in case memory is the limit (unverified). Frame data snapshot
+(SteamVR runtimes, Lepton scripts, logs; never commit Valve binaries): `~/frameport-research/frame-data-2026-09-30/`.
+Not yet verified in the headset.
+
+**Companion apps / intents (2026-10-03, tested with Stremio + 4XVR):** a second APK can be installed into a running
+Lepton container (`podman exec -i lepton-steamlaunch-<appid> pm install -g -S <size> < apk`) and runs there, VR
+included (4XVR in Stremio's flatscreen container: FrameBridge 72 fps, settings via LEPTON_ENV_FRAMEBRIDGE_CONFIG). But
+Lepton's services.jar (`ActivityStarter.execute`) intercepts **every** `android.intent.action.VIEW` with data (any
+scheme, explicit component or not, no property to disable): it writes `steam://openurl/<uri>` to `/lepton/steam.pipe`
+(= the host Steam client's `~/.steam/steam.pipe`) and starts nothing. So "open in external player" hand-offs (Stremio
+→ 4XVR) can't work inside Lepton; don't retry without Valve changing it. Lepton installs exactly one `*.apk` per app
+folder (two break `get_apk_path`).
+**Text input (2026-10-03, verified in the headset with Stremio VR):** Lepton's Android has no IME (`ime list` empty)
+and runs VR apps headless (`lepton.headless=true`): no Android window has input focus (`dumpsys input` FocusedWindows
+empty), so neither `input text`, a USB keyboard nor Steam's keyboard reach the app. `lepton-show-flatscreen` on a VR
+app keeps VR working (FrameBridge 72 fps) and gives the window focus; Steam's on-screen keyboard then opens for text
+fields. Unity's TMP_InputField on non-Quest Android waits for the system keyboard (`TouchScreenKeyboardShouldBeUsed`)
+and deselects a frame later unless `isKeyboardUsingEvents` (Android: `InPlaceEditing() && m_HideSoftKeyboard`);
+uGUI InputField's LateUpdate keeps the field when `InPlaceEditing()`. Patch `frame.unity_text_input` rewrites them
+(`mov w0,#0|#1; ret`) at Cpp2IL's **Offset** (= file offset; RVA differs by 0x4000 in Stremio's lib), Cpp2IL
+2022.1 pre-release (Unity 6 / metadata v31; Il2CppDumper can't), cached per libil2cpp sha. `/dev/uinput` has an ACL
+for steamos (Steam Input) → agent v33 `_keyboard` uinput keyboard ("Type on Frame") reaches everything with focus.
+Installing a second APK into a container with `pm install` re-runs Lepton's post-install hook on the **main** app
+(`lepton.active_app_id`; moves its files to /data/steam_app) and corrupts it on the next start (fix: touch the APK →
+re-bake); `cmd_real package install` skips the hook.
+**User reports (2026-10-04, issues #4-#10):** Steam shortcuts go to the signed-in account (`loginusers.vdf`
+MostRecent) else every account (agent v35 `library_users`; it used to refuse with >1 account → Play gave Steam's "Game
+configuration unavailable"); `launch` uses the shortcut's own appid and errors `NOT_IN_LIBRARY`, the app then adds it
+and plays. Unity IL2CPP fixes share one Cpp2IL run (`unity_text_input.Il2cppReturnPatch`, `ALL_TARGETS`, cache keyed by
+global-metadata.dat): `frame.unity_runtime_msaa_off` (OVRManager raises MSAA to 4x at runtime: "Switching to the
+recommended level" → Lucky's Tale restarted the headset; `OVRDisplay.get_recommendedMSAALevel` → 0) and
+`frame.unity_multipass` (Oculus XR Plugin multiview → MultiPass via `OculusSettings.GetStereoRenderingMode`; I Am Cat's
+right eye grey). Both checked against Toy Master's Cpp2IL output, not yet in a headset. VR4 quits itself (System.exit
+after the intro movie) → catalog `use_alt`. **Catalog changes reach existing games** without hardcoded migrations:
+recipes store `catalog_rev` (= `CatalogEntry.rev()`), `library._follow_catalog` re-derives non-user recipes whose entry
+changed; a maintained entry beats the user's shared copy when its `updated`/verified date is later (`catalog._newer`).
+**Round 2 of reports (2026-10-04):** VR4's campaign hang = one fragment shader reading an uninitialized loop counter
+(reporter's capture): vkshim `vk_shader_fix` setting (`<size>:<sha256>:<offset>:<words>`, from the recipe's `adapter:`;
+matched by size + SHA-256, words inserted into a copy) — on the device the module is fixed at load ("fixed shader
+module (6488 -> 6512 bytes)"); campaign itself not yet seen in a headset by us. Text settings (kind "str") stay out of
+the Game settings dialog (saving it dropped them). I Am Cat: `GetStereoRenderingMode` is inlined (no call sites) →
+`Il2cppReturnPatch.field_loads` rewrites the field read in `OculusLoader.Initialize` (Cpp2IL gives the field offset,
+`field:<name>`); verified with Toy Master: eye swapchains array=1 ×2 instead of array=2. Builds record `recipe_fp`
+(`patches/base.recipe_fingerprint`, `Patch.revision`): a changed recipe or revised patch shows "Update on Frame".
+Remembered Frames are found again after an address change (`Frame.relocate`: scan, same SSH host key, before
+login). Packaged apps show artwork by file path (`thumbs.use_file_paths`, #16). Diagnostics: this boot's kernel log.
+Device tests of requested games (2026-10-04, headless): I Am Cat, Myst 3.3.0, BattleGlide, Blade & Sorcery: Nomad
+start (RUNNING, frames). Roblox: SIGSEGV in je_free from libroblox.so ~3 s in (likely its anti-tamper vs the re-signed
+APK). BONELAB (Unity 2021.3 Vulkan, OVRPlugin 1.94): SIGSEGV with pc == fault addr in vkCreateInstance, called from
+libSLZQuestNative.so's Vulkan hooks into an unmapped (unloaded) library right after OVRPlugin's pre-init
+xrDestroyInstance; pinning openxr/vrclient libraries (RTLD_NODELETE) did NOT help — find the unloaded library with the
+linker's dlopen/dlclose logging next. Accounting+ (Unity 2017.4 built-in Oculus, libOVRPlugin + libvrapi): Unity
+never starts VR on the Frame (no OVRPlugin/OpenXR lines; runs as a 2D app), which is why its "controller setup"
+screen can't be passed — Unity 2017's Oculus device check, not the controller profiles. Cpp2IL can't read Unity 2017.
+The Frame's Android runtime (vrclient.so) knows oculus/touch_controller but not Meta's Touch Plus/Pro profiles
+(OVRPlugin suggests those too, routinely) → adapter `profile_remap`.
+Headset round 2 (2026-10-04): the Frame drops focus often (ms to 7 s; only some are presence/standby) → games pause
+or recentre (B&S Player.OnVRPresence → Teleport, BattleGlide/Unreal pauses); focus_hold now 1 s focused / 1 s max dip
+(longer must still pause). Myst crash = vrclient xrSyncActions race after FOCUSED → `sync_guard` (confirmed); its
+object glitches: app space warp suspected (FB_space_warp is advertised and used) → recipe `patch_disable_space_warp`.
+I Am Cat multipass: poses/times consistent, but every frame is submitted after the next xrWaitFrame (one period late;
+Zink + doubled draws) and the game clamps its physics step to 10 ms → judder while still; testing scale 0.8. Roblox's
+newest crash is on Fossilize's recording thread → vk_sanitize extended to own-engine libs (engine "Other").
+Accounting+: unity_oculus_check + native/ovrpshim (libfp_ovrp.so waits via ovrp_WaitToBeginFrame before Unity
+2017's ovrp_Update2) → VR in the headset at ~72 fps (2026-10-04), but stuck at "press any button" although input
+reaches its OVRInput cleanly (probe: both Touch connected 0x63, individual buttons, input focus 1) → works with issues.
+"outside of frame bounds" warnings stay (~2/frame) and are harmless.
+Steam library (GitHub #4/#21/#27, agent v38): shortcuts go to every Steam account (signed-in first; MostRecent isn't
+always the account on the Frame); stop_steam also waits for Steam's helpers; after the restart the agent re-reads
+shortcuts.vdf and writes once more if Steam put its old copy back (`shortcuts_lost`); lost again (agent v89): Steam
+ignores FramePort's entries on that Frame, so `add_devkit_entry` adds the devkit entry instead (`added` gets `via:
+devkit`) and only reports an error if that fails too. 0.6.3's Play
+auto-repair (`_add_then_play`) crashed (its job got a Job, not a reporter). Uploads resume on a transient OSError.
+Lepton's Android 11 has no clipboard service (134 services; checked with `podman exec … service check clipboard`):
+SDL/LÖVE apps crashed at start → `frame.sdl_clipboard` (`apk/dex.py`: in-place dex edit, nops one invoke, fixes
+the header checksum/signature; verified with LÖVE for Android 11.5, GitHub #24 Dramatic Shape). Godot 4.2-4.4 (Kotlin `as ClipboardManager`,
+GitHub #134 EndoparasiticVR) → `frame.godot_clipboard` (nops the `Intrinsics.checkNotNull` before that check-cast; Godot's
+clipboard methods return at once; analysis `godot_clipboard`, ANALYSIS_VERSION 10; checked on real godot-lib/templates
+4.2.2-4.4.1, not on the device; 4.1 and 4.5+ don't throw). 2D apps (vr_kind none)
+keep every suggested patch that isn't about VR (`needs_vr = False`), not a fixed list. FramePort on the Frame:
+`frame/local.py` (127.0.0.1, own key authorized; "This Frame (experimental)"; app data in
+~/.local/share/frameport-app because ~/.local/share/frameport is the agent's) and Steam library changes wait while
+Desktop Mode is open. Verified on the device 2026-10-04 (install + launch test from the Frame). Library updates on the
+Frame run one at a time (agent v40 flock): two quick uninstalls used to bring a removed shortcut back (Roblox).
+Headset round 3 (owner's verdicts, 2026-10-04): Blade & Sorcery works — its freezes were the headset's wear sensor
+flickering off while worn (vrserver.txt "HMD off/on" 0.5-2 s) → per-game `focus_hold_ms=2500` (only this game reacts;
+not a default). BattleGlide works (focus_hold). Myst works with issues (object glitches; space warp ruled out, its
+recipe keeps it on). I Am Cat works with issues (judder; scale 0.8 no help). Roblox unsupported (je_free in
+libroblox, also with the Vulkan shim). Installs skip the Steam restart when the shortcut is unchanged and wait while a
+game runs (agent v37). New default fixes in FramePort's code reach games already in a library: after every app update
+`library._follow_catalog` re-derives each non-user recipe once (setting `recipes.app_version`; tests switch it off via
+`library.REFRESH_ON_UPDATE`). Analysis fields added later: **bump `analysis/detect.ANALYSIS_VERSION`** (stored as `analysis.extra.analysis_version`); older entries whose APK is still there are analysed again at the GUI's start (background thread, not a job: ~8 s per 900 MB APK) and before a build (`pipeline.refresh_analyses`, GitHub #104); only `analysis`/`suggested` change, user recipes stay; an unreadable APK gets `analysis_failed` = the version (not retried until the next bump). Troubleshooting techniques: docs/PLAYBOOK.md "Debugging techniques". Unity `boot.config` "vulkan" substring mislabels GLES games as Vulkan
+(I Am Cat ran GLES); OVRPlugin's "Unavailable OpenXR extension: XR_FB_scene" is routine (no longer triaged).
+**Round 4 (2026-10-04):** XR_KHR_android_surface_swapchain is listed by the Frame's runtime but returns
+FUNCTION_UNSUPPORTED → adapter `surface_emul` (default on, `native/adapter/surface_swapchain.c`): an ordinary runtime
+swapchain is returned, the game gets a Surface from a SurfaceTexture on a worker thread (own EGL context, JavaVM from
+XrInstanceCreateInfoAndroidKHR), frames are read back (glReadPixels) and uploaded in xrEndFrame (Vulkan: own command
+buffer + fence per panel, never waits; GLES: glTexSubImage2D). I Am Monkey's intro works (owner-confirmed). SUPERHOT
+(Quest) quit at start: its cloud save folder was mode 1700 and Lepton's app writes through the folder's group →
+launch.sh `fix_perms` adds u+rwx,g+rwx (agent v41). Lucky's Tale: Unity's Loading.PreloadManager thread grows the
+native heap ~1 GB/s until the OOM killer (Frame freezes); no fix. `perf` works as steamos (paranoid 2; ptrace_scope 1
+blocks gdb/eu-stack/debuggerd) — see PLAYBOOK "Debugging techniques". QuestCraft downloads its JRE at first run into
+`files/runtimes/JRE` (Pojlib Installer); on the Frame it was missing (unpacked by hand, unverified). WiiCompiled: its launcher shows
+(lepton-show-flatscreen) but imports .wcgame files through Android's document picker (OPEN_DOCUMENT), which Lepton
+lacks (ActivityNotFoundException) → imported by hand: libmain.so + game.json → internal files/game/<profile>,
+DATA/ → external files/WiiCompiledOpenXRVR/DATA, MOD/ → .../RetroRewind6 (decompiled with jadx). Lepton has no
+picker at all: a FramePort fix would be an injected picker activity. Generated cover/banner art used to suppress the
+Steam placeholder set (no Steam art at all) → fixed in artwork/steam.py.
+**Steam library failures (GitHub #21/#30):** on some Frames Steam never loads FramePort's shortcuts.vdf entries (same SteamOS build and arm64 beta client as the dev Frame; IDs correct; file written before Steam starts): Play → console_log `GameAction [AppID <id>] … RequestingLicense → UpdatingAppInfo → LaunchApp failed with AppError_9` (= "Game configuration unavailable", Steam treats the id as a store app). Cause unknown; agent v42/43 diagnostics: `launch` returns `steam` (started / error + code / silent from console_log), `collect_diag` adds `steam_library` (real Steam dir, beta, Steam start vs vdf write time, entries per account, devkit games) + `steam-console.txt` (incl. Steam's `logs/shortcuts.previous.txt` if present; steamclient.so has "LoadShortcuts: rejecting attempt to load shortcuts: invalid account ID"). **Fallback (agent v43):** when Play gets AppError_9 the agent registers the game through Steam's devkit interface (what Valve's Devkit Management Tool does, MIT: `devkit-1 steam://devkit-1/<~/.steam/steam.token>/create-shortcut?response=<file>&gameid=<id>&directory=~/devkit-game` written to ~/.steam/steam.pipe; answer file / `.error`; `~/devkit-game/<id>/launch.sh` = link to the game's launch.sh, `<id>-argv.json` ["launch.sh"] (relative to the folder), `<id>-settings.json` {steam_play 0, compat_tool ""}). Steam adds it live (no restart), picks its own appid (read back from shortcuts.vdf by DevkitGameID), shows it as a normal non-Steam game named "Devkit Game: <id>" (OpenVR 0, but VR works: owner-verified 2026-10-04), art copied to grid/<appid>*. Ids: letter first, then letters/digits/_ only (spaces, '-', leading digit → "missing/invalid arguments"). Later Plays use the devkit entry; uninstall (`devkit_unregister`, `delete-shortcut` live) and purge remove it. Verified on the dev Frame: register/launch/unregister; the AppError_9 trigger itself only in unit tests. GitHub #42 (two Steam accounts, neither MostRecent): Steam rewrote the active account's shortcuts.vdf without FramePort's entries right after starting, and added the devkit entry live without saving it, so `devkit_appid` (vdf only) failed ("Steam added the devkit entry but didn't save it"); agent v55 `devkit_appid_from_log` reads Steam's `sanitize shortcut app id "~/devkit-game/<id>/launch.sh": replacing 0 with N` console line. GitHub #41 (one account): same Steam behaviour, and every install restarts Steam, which forgets the never-saved devkit entry. Agent v56: the log fallback reads only the current session's console_log.txt; Play re-registers a devkit entry that gets AppError_9; art updates also write the devkit entry's grid art (`copy_grid_art`). Open: why some Frames' Steam never loads or saves shortcuts.vdf (single account too).
+**Exit game (GitHub #36, 2026-10-04):** `Apps.TerminateApp` (what Exit game calls; reachable for tests through Steam's CEF devtools on 127.0.0.1:8080, SharedJSContext, `Runtime.evaluate` — a stdlib websocket client is enough) closed both a normal shortcut and a devkit entry on the dev Frame within 1-3 s. SIGTERM to Steam's `reaper` alone left launch.sh + Lepton (setsid) + the container running (an earlier headset launch ran on for 87 min); SIGTERM to launch.sh cleans up in ~4 s. Agent v44: launch.sh's 2 s loop ends the game when its parent (the reaper) is gone; `upgrade_launchers` (from ensure_host_fixes) adds that to existing launchers in place. Which in-headset exit path fails is still unknown. Screenshots on the Frame: all under SteamVR's appid 250820 (`760/remote/250820/screenshots`, screenshots.vdf has creation time, no game).
+**SteamVR dashboard at game start (2026-10-04):** the dashboard (Resume game / controller / VR options) was open whenever a FramePort game started (also over Lepton's 2D launcher). Steam's UI exposes `SteamClient.OpenVR.VROverlay.{IsDashboardVisible,HideDashboard,ShowDashboard}` (CEF devtools, `steam_js` in the agent). Agent v44: launch.sh starts `_dashboard_worker` (waits for FrameBridge's first `pacing:` line in launch.log, then hides a visible dashboard for 25 s, at most 3 times; log `<base>/dashboard.log`; opt out with env FRAMEPORT_KEEP_DASHBOARD=1). Verified on the dev Frame (dashboard shown → 4XVR launched via Steam → hidden ~5 s after the first frames); not yet seen in the headset. **Headset (ITR2, 2026-10-05): too late** — Steam shows its frame menu (`valve.steam.gamepadui.frame.menu`, vrwebhelper_systemui.txt `[PooledPopups] Showing`) ~0.3 s after the game's first submitted frame (FrameBridge `new layer:`), but the first `pacing:` summary comes ~8 s later; the owner had pressed Resume (`[HideDashboard] return_to_game`) before the worker looked. Agent v52: watches from the first `new layer:` line (incremental log reads, 0.5 s polls, 30 s window). Agent v59: watches 120 s and hides up to 10 times (the menu came back after 30 s in the owner's sessions). Agent v53: stops for good once the player opens the dashboard with the controller (`toggle_dashboard_action` in vrwebhelper_systemui.txt since the worker started): v52 closed it 60 ms after each press, and the game, paused for it, stayed paused.
+**Space warp / ITR2 (2026-10-04):** Into The Radius 2 (UE5, `libUnreal.so` + OVRPlugin, Vulkan) uses Application SpaceWarp (extra swapchains `376x376 format=97` motion vectors + `format=129` depth); #35 reports flickering textures. OVRPort's `patch_disable_space_warp` has no effect on UE5, and hiding XR_FB_space_warp in FrameBridge's enumerate doesn't reach the game either: **OVRPort's dispatcher offers/enables XR_FB_space_warp itself**. FrameBridge `hide_space_warp` (per game, off) hides it and strips `XrCompositionLayerSpaceWarpInfoFB` (1000171000) from the projection views (log `hide_space_warp: removed space warp info`); the game still renders its MV swapchains. Test build installed on the dev Frame; flicker not yet checked in a headset. Heuristic: UE5 + OVRPlugin shows it as an option (off). `equirect_emul` is suggested for Unreal games whose graphics API isn't detected ("GLES or unknown"); on Vulkan it switches itself off (Myst/Riven/ITR2): harmless, but Unreal Vulkan detection is a known gap.
+**PR #34 (merged 2026-10-04, Lucas-Mathieu):** `native/adapter/audio_metadata.h` patches Meta XR Audio Wwise (only build ID e1619e7f…, Batman: Arkham Shadow 1.4.1) so queued audio metadata isn't freed while the current audio frame references it (smoke-bomb crash). Verified headless: installs ("metadata reclamation follows …"), 72 fps; we added a once-per-second scan limit. Outside PRs: review source, rebuild `artifacts/` ourselves, merge locally (contributor's commit kept), push main.
+**Heuristics eval (2026-10-04):** `scripts/eval_heuristics.py "<VR CyberDeck Portable>"` → 19/44 recipes exact, 322/352 fields (most diffs: `frame.unity_text_input` suggested where older catalog recipes lack it; the rest are runtime-only findings: use_alt, vk_shader_fix, focus_hold, sync_guard, multipass). `PATCHED/` copies aren't scored (already converted).
 **Power (0.9, agent v47):** sidebar bar below the Frame card: Sleep / Restart / Shut down, each confirmed (`app.frame_power`, a running game asks again). logind answers CanSuspend/CanReboot/CanPowerOff = "challenge" for an SSH session but "yes" inside a user unit, so agent `power` runs `systemctl suspend|reboot|poweroff` from a transient `systemd-run --user --on-active=3` timer (the command answers first). Restart verified on the device (back in ~84 s, new boot id).
-**Proton default:** the newest **stable** ARM64 Proton (`pick_proton`; owner's headset A/B); `pcvr.proton_tool` dropdown (Experimental = alias `proton-experimental`), `ensure_proton`, `proton_alternative_worth_trying`. → docs/DEVICE_NOTES.md#proton-default-stable-vs-experimental
-**USB cable link:** `usb0` is a USB NCM gadget (Developer Mode only); Frame 10.86.200.233, PC **10.86.200.234** (`frame/usb.py`); ~37 MB/s; `scripts/usb_autotest.py`, `frameport frame usb-check`; discovery prefers USB > hotspot > network (`discovery.dedupe`). → docs/DEVICE_NOTES.md#usb-cable-link
+**Proton default (agent v51, owner's choice 2026-10-05):** the newest **stable** ARM64 Proton is the default for PC VR games (`pick_proton`: asked-for name/alias, else newest installed stable, else any stable). Agent v49-50 defaulted to Experimental; the owner's headset A/B with Rick and Morty (Experimental 69 % reprojected frames, stable felt much smoother) reverted it. The game page's Customize shows `pcvr.proton_tool` as a dropdown (Stable (default) / Experimental = alias `proton-experimental`); `ensure_proton` installs a chosen one (it asks once more for the runtime Steam only names after Proton is installed; Experimental installed unattended on the device in 53 s). A PC VR launch test that fails on stable suggests Experimental (`pipeline.PROTON_TOOL`, `proton_alternative_worth_trying`, button "Try Proton Experimental and reinstall"). Remaining Rick and Morty stutter on head turns = the game rendering below the refresh rate (reprojection), not Proton.
+**USB cable link (verified 2026-10-05, cabled to the dev PC):** `usb0` is a USB **NCM** gadget (configfs g1: `ncm.usb0` + `ffs.adb`, Valve 28de:2460) set up by `usb-ncm-gadget@usb0.service`, which only runs with `ConditionPathExists=|/etc/systemd/system/adbd.service.d/steamos-devkit-enabled` = **Developer Mode only**. `usb-ncm-dnsmasq@usb0` serves DHCP with fixed `dhcp-host` entries: Frame 10.86.200.233, PC **10.86.200.234** (`frame/usb.py` FRAME_USB_IP/PC_USB_IP). Windows 11 binds its built-in "UsbNcm Host Device" (no driver); WSL mirrored sees eth 10.86.200.234. USB is high-speed (USB 2.0): upload 36.9 MB/s vs 11.3 MB/s home Wi-Fi. Frame→PC over the cable worked without a firewall change. `scripts/usb_autotest.py` (Windows via powershell.exe from WSL), `frameport frame usb-check`. Wizard "Set up with a USB cable" (`PairingServer(host=PC_USB_IP)`; the real bootstrap ran end to end over USB). Discovery dedupes by SSH host key and prefers USB > Frame hotspot > network (`discovery.dedupe`); a lost address is re-found by key (`Frame.relocate`, tested with a dead saved address).
 **Catalog updates without a release (2026-10-05):** apps fetch `catalog/games/*.yaml` from GitHub `main` (`recommend/catalog.refresh_remote`: one API call `git/trees/main?recursive=1` + raw.githubusercontent downloads of changed blobs, cached as `catalog-gh-<sha>.yaml`, every 6 h; GUI at start + Settings → Data "Check now"; CLI background thread + `frameport catalog-update`). `catalog.load()` only reads the cache. A remote entry is skipped (`unusable_reason`) when it names a patch/adapter key this app doesn't register, has a field `CatalogEntry` doesn't know, or `min_app` > this version: add `min_app` (or rely on new patch ids) when a config needs an unreleased FramePort. Remote beats bundled unless the bundled entry has a later updated/verified date; the user's own entries still win as before. Off: setting `catalog.auto_update`, env FRAMEPORT_NO_CATALOG_UPDATE; FRAMEPORT_CATALOG_URL still overrides the source. So: **pushing a catalog change to main reaches users within 6 h** (their recipes follow via catalog_rev → Update on Frame).
-**Start activity / QuestCraft / ITR2 pop-in:** `frame.start_activity` (analysis `extra.vr_activity`, `axml.set_start_activity`; OVRPort gives every MAIN activity LAUNCHER, so take the VR activity from the original APK); Unreal reads user config from **internal** storage; Lepton passes `LEPTON_ENV_<NAME>` to the app as `<NAME>` (QuestCraft `LIBGL_NOERROR`); vkshim `vk_query_slots` left off. → docs/DEVICE_NOTES.md#start-activity--questcraft--itr2-pop-in
-**Vulkan validation / ITR2 solved:** bundle Khronos' `libVkLayer_khronos_validation.so` into a test APK + vkshim `vk_validation=1` (logcat tag VALIDATION); `vk_spec_fixes=1` drops ITR2's invalid depth resolve; VALVE_rpo removed its fog (catalog `lepton_env: VK_INSTANCE_LAYERS`). Agent `not_started` waits 30 s for "Boot complete!". → docs/DEVICE_NOTES.md#vulkan-validation--itr2-solved
-**GitHub #38/#39:** SteamVR rejects image rects past their swapchain (-25) → FrameBridge `rect_clamp` (default on), triage `swapchain-rect-invalid`; The Room VR MSAA crash in libgallium. → docs/DEVICE_NOTES.md#github-3839-powerwash-simulator-the-room-vr
-**Headset round 2026-10-05:** FrameBridge `pose_consistency` (I Am Cat judder), xrshim `haptic_fix` (Lucky's Tale), **`focus_hold` on by default with 5 s** (wear-sensor dips, `logs/eyetracking.txt`), `unity_no_overlay_copy` (The Room VR), ovrpshim frame wait for Unity 2019 (`UnityOculusCheck.legacy_loop`), `frame.ovr_trace` (opt-in, `native/ovrtrace`, logcat `fp_ovrtrace`). → docs/DEVICE_NOTES.md#headset-round-2026-10-05-evening
-**Unity built-in VR input:** probe builds `FRAMEPORT_INPUT_PROBE=1`; ovrpshim adds a `GetMouseButtonDown` icall click (Accounting+); libunity 2019 only polls Touch when the device model starts with "Oculus" → `unity_oculus_check` revision 4 `oculus_model_checks` (BattleSisters); `haptic_fix` suggested for every game with libOVRPlugin.so. → docs/DEVICE_NOTES.md#unity-built-in-vr-input-accounting-battlesisters
-**Vader Immortal (GitHub #49):** stuck on its loading card and leaked GPU mappings (solved below: `gl_error_clear`); diagnostics FrameBridge `layer_debug`, `strip_color_bias`, `frame_balance`, `snapshot=N` (`snapshot_gl.c`: saves the submitted left-eye image as `files/fb_snap_*.ppm`). → docs/DEVICE_NOTES.md#vader-immortal-headless-investigation
-**SteamVR overlay apps:** host OpenVR overlays composite over Lepton games; detection `analysis/vroverlay.py`, patch `pcvr.vr_overlay`, Linux fields `vr_overlay`/`vr_overlay_autostart`, agent `register_vr_overlay`/`unregister_vr_overlay`/`launch_vr_overlay`; SteamVR on the Frame reads only `binary_path_linux_arm`; FramePort's own autostart (`ensure_overlay_service`, `frameport-vr-overlays.service`). See also docs/FRAME_RUNTIME.md "Overlay apps". → docs/DEVICE_NOTES.md#steamvr-overlay-apps
-**Vader's leak solved / AC Nexus flips:** stale GL errors broke SteamVR's GL interop → adapter `gl_error_clear` (GLES, catalog for Vader ep1-3); read `xrclient_<pkg>.txt` in Steam's logs for runtime errors; the runtime caps swapchains per session (~15) → flip emulation in place; adapter `flip_dump`. → docs/DEVICE_NOTES.md#vaders-leak-solved--ac-nexus-flips
-**Unreal's self-restart:** UE 4.21+ restarts itself after the first shader precompile and Lepton ends the container → launch.sh RESTART_BLOCK starts Lepton once more (`upgrade_launchers`; `FRAMEPORT_NO_RESTART=1` off). → docs/DEVICE_NOTES.md#unreals-self-restart
-**xrWaitFrame runs ahead:** the runtime sometimes returns a display time <1 refresh after the last submit and rejects the second submission (`VRCompositorError_AlreadySubmitted`) → the VrApi bridge re-waits (`pacing 2s:` counters). → docs/DEVICE_NOTES.md#xrwaitframe-runs-ahead-journey-of-the-gods
-**Lepton's logcat mirror dies** (EOF, read failure, or silent) → launch.sh `_logcat_keeper` reads `podman exec <container> logcat` itself into launch.log (log `<base>/logcat-keeper.log`). → docs/DEVICE_NOTES.md#leptons-logcat-mirror-dies
-**Double launch:** launch.sh takes `flock` on `<base>/.launch.lock` (fd 9); a second launch exits 0 and logs to `<base>/launch-dup.log` (`upgrade_launchers` adds it). → docs/DEVICE_NOTES.md#double-launch
-**Issue triage round 2026-10-06:** FrameBridge turns haptic amplitude 0 into xrStopHapticFeedback, per-game `haptic_scale`; Lambda1VR → `frame.tbxr_vendor`; Jurassic World → `frame.vrapi_stub`; Metro Awakening / Pinball FX → `hide_space_warp`; `frame.ovr_trace` can't trace Unity games; the VrApi bridge's 30 s head-pose deadline ends headless VR mode. → docs/DEVICE_NOTES.md#issue-triage-round-2026-10-06
-**Lepton storage:** each app's /sdcard has `Movies`/`Download`/`Documents` symlinked to the Frame's `~/Videos`/`~/Downloads`/`~/Documents` (agent `storage_targets`); the media index never works; Lepton grants all runtime permissions. → docs/DEVICE_NOTES.md#lepton-storage
-**SteamVR per-app settings:** `native/vrsettings` = `fp_vrsettings.exe` sets `steam.app.<appid>` `preferredRefreshRate` / `motionSmoothingOverride` live; `pcvr.steamvr_tuning` (default on, PC only). → docs/DEVICE_NOTES.md#steamvr-per-app-settings
-**Language packs:** `frame.langpacks` (opt-in, `native/langpack`, `elf.hide_exports`, logcat tag `fp_langpack`) serves `<tag>.lang` files; Unreal needs the pack's Metadata = the game's version (`with_metadata`, `FRAMEPORT_LANGPACK_META`) and the `/storage/emulated/0/...` path spelling; `FRAMEPORT_LANGPACK_SKIP`. → docs/DEVICE_NOTES.md#language-packs
-**Cube swapchains:** the runtime refuses `faceCount=6` → FrameBridge `cube_standin` (default on, GLES only, `native/adapter/cube_standin.c`). → docs/DEVICE_NOTES.md#cube-swapchains
-**Hardware video decoding:** `native/hevc` OMX plugin (`OMX.frameport.{avc,hevc,vp9}.decoder`), installed once per Frame (`ensure_video_codec`, agent `video_codec_status`/`install_video_codec`/`video_codec_switch`); **bump `revision` in native/hevc/build.py with every artifact change**; per game `frame.hw_video_decode` (analysis `media_codec`), Settings `video.hw_decode`, `FRAMEPORT_NO_HW_VIDEO=1`; Batman migration `batman_video_patches` + `surface_native`. → docs/DEVICE_NOTES.md#hardware-video-decoding
-**Vulkan shader dump:** adapter `vk_shader_dump=1` (`native/vkshim/shader_dump.h`) writes SPIR-V modules + `index.txt` to `files/fp_vk_shaders/`; `collect_diag` returns the newest session's modules (`shader_dumps`); triage `gpu-hang`, `triage.graphics_api`. → docs/DEVICE_NOTES.md#vulkan-shader-dump
-**Unreal OBB check (#159):** `frame.unreal_skip_obb_check` (analysis `unreal_verify_obb`) turns off Epic's OBB CRC pass; triage `unreal-obb-check-stuck`. → docs/DEVICE_NOTES.md#unreal-obb-check
-**Issue round 2026-10-12:** Lepton breaks on unquoted paths with spaces → launchers give Lepton a `~/.local/share/frameport/lepton-paths/<pkg>` link (`app_dir_lines`/`set_app_dir`/`launcher_base`); `frame.eos_keychain_loop`, `frame.unity_tls_key_pool` (`libfp_tkeys.so`, `elf.rename_imports`), `frame.vermillion_scene_canvas`; `tools/cpp2il.py` falls back to Cpp2IL's dev build for metadata v107; Linux `desktop_icon`; `scripts/upload_bench.py`. → docs/DEVICE_NOTES.md#issue-round-2026-10-12
-**OpenSSH uploads (#324/#242):** `native_upload.quote` escapes only backslash and `"`, Win32 local paths go as `C:/…`; `Frame.auth` records the login that worked (app_key / user_key from `ssh.extra_keys`, `frame ssh-keys`, agent, password); strict IdentitiesOnly first, relaxed retry. → docs/DEVICE_NOTES.md#openssh-uploads
-**Meta user id (#182):** OVRPort's platform loader makes up a new user id every start → `frame.ovr_stable_user` (default on) returns a stable per-game, per-user id. → docs/DEVICE_NOTES.md#meta-user-id
-**Vivox API 31 (#101):** newer Vivox calls Android 12 AudioManager methods → `frame.vivox_audio_route` (analysis `vivox_api31`, `Dex.return_early`). → docs/DEVICE_NOTES.md#vivox-api-31
-**Steam Input gamepad for 2D apps (#162):** opt-in `device.steam_gamepad` (deployment `steam_gamepad` → launcher `GAMEPAD_LINE` → `PODMAN_WRAPPER` / `podman_run_args` bind-mount Steam's virtual pads). → docs/DEVICE_NOTES.md#steam-input-gamepad-for-2d-apps
-**Multiview programs on flat framebuffers (#77):** Mesa drops num_views=2 draws on single-view FBOs → `frame.gl_multiview_fbo` (`native/glmv` = `libfpglmv.so`, analysis `gl_multiview_libs`); headset-verified with Doom3Quest. → docs/DEVICE_NOTES.md#multiview-programs-on-flat-framebuffers-doom3quest
-**BlazeRush (#57):** `frame.blazerush` (1.0.349 only), GL shim `gl_int_attribs` / `gl_highp_markers`, saved VrApi FOV (`files/framebridge-vrapi-fov.txt`), `device.config_sync` (catalog `config_sync`); launch tests treat an end after the headless deadline as a pass (triage `headless_end`). → docs/DEVICE_NOTES.md#blazerush
-**Session triage:** real play sessions are triaged too: agent `last_play` / `session_log` (`<anchor>/plays.log`), `pipeline.sessions_due` / `triage_session` = `validate/session.analyze` (incl. `space-warp-used`, `gpu-hang`, `slow-frames`, `focus-dips`) → library `last_session` → game page "Last session"; `apply_suggestions_live`; CLI `frameport session <pkg> [--apply]`; pac_hints stays triage-only. → docs/DEVICE_NOTES.md#session-triage
+**Start activity / QuestCraft / ITR2 pop-in (2026-10-05):** WiiCompiled's VR part (`QuestActivity`, SDL, process `:game`) stays behind Lepton's flat window when the launcher is shown (`device.text_input_window`). `frame.start_activity` (opt-in; analysis `extra.vr_activity` = the original APK's activity with Meta's VR category when it isn't the launcher) gives that activity's filter LAUNCHER and every other LAUNCHER becomes INFO, per element (`axml.set_start_activity`); Lepton's own `apk-info-extractor --print-activity-name` (on the Frame under Lepton/liblepton/apk_extractor) then answers QuestActivity. **OVRPort gives every MAIN activity LAUNCHER + VR categories**, so the VR activity must come from the original APK's analysis, not the converted manifest. Lepton has no activity override (`APP_ACTIVITY` is reset when app_metadata.sh is sourced). QuestCraft reaches Minecraft 1.21.5 (Fabric, Vivecraft, Sodium; LTW "Large Thin Wrapper" GL 3.0 on the Frame's Zink) and stops at `OpenGL error 1282` in `WindowFramebuffer` createTexture (Minecraft's crash report in `files/instances/1.21.5/crash-reports/`, Pojlib's `files/latestlog.txt`); the vrclient SIGSEGV / "pthread_mutex_lock called on a destroyed mutex" afterwards is only the shutdown (Unity's render thread still in vrclient while the instance is destroyed). ITR2 "models popping in and out" in game: Unreal reads user config from **internal** storage (`lepton-data/internal/<pkg>/files/UnrealGame/<Project>/<Project>/Saved/Config/Android/Engine.ini`, not external); `r.AllowOcclusionQueries=0` there broke its menus (removed again). Vulkan shim `vk_query_slots` (two slots per occlusion query) never saw ITR2 create an occlusion query pool, and the run with it crashed (Unreal RenderThread SIGSEGV, caught by sentry-native: no tombstone; the backtrace is in `cache/sentry/*/.sentry-native/*.run/*.envelope` with module offsets) - left off. Next suspect: Unreal 5 mobile HZB occlusion reading depth stored with Valve's FDM injection layer; test = launcher `VK_INSTANCE_LAYERS=''` (Lepton then loads neither VALVE_rpo nor VALVE_fdm_injection, Fossilize still). QuestCraft: LTW overrides glGetError and returns 0 with `LIBGL_NOERROR` set; Lepton passes `LEPTON_ENV_<NAME>` to the app as `<NAME>`, so catalog `lepton_env: {LEPTON_ENV_LIBGL_NOERROR: '1'}` gets Minecraft past the GL error 1282; then black picture (see the catalog entry). FrameBridge logs `new layer` once per layer type per process and projection views only for the first frames, so a second session in the same process (Vivecraft after Unity) needs `layer_debug=1`.
+**Vulkan validation / ITR2 solved (2026-10-05):** Khronos' validation layer can't come from Lepton (its layer dir is in the read-only guest image; the Linux copies on the Frame are glibc) and a global `debug.vulkan.layers` property (via the LEPTON_GFXRECON_FP_PROPS trick) kills the container at boot. Working recipe: bundle `libVkLayer_khronos_validation.so` (Khronos android-binaries release, arm64-v8a, stored uncompressed) into a test APK re-signed with the game's key (`apk.sign.sign`), install with `frameport install <pkg> --apk`, and set the Vulkan shim's `vk_validation=1` (it adds the layer at vkCreateInstance; findings under the logcat tag VALIDATION in launch.log, each message ID capped at 10). ITR2's flicker + windows behind models = Unreal's Qualcomm shader-resolve subpasses with a depth resolve of a single-sampled depth attachment (VUID-04908/-03179); `vk_spec_fixes=1` drops that resolve (its TRANSFER_DST half never applies to ITR2: the main depth is transient). Valve's VALVE_rpo layer removed ITR2's fog (catalog `lepton_env: VK_INSTANCE_LAYERS: VK_LAYER_VALVE_fdm_injection`). `r.ViewDistanceScale=2` in the internal Saved/Config/Android/Engine.ini only exists on the owner's Frame (the catalog can't write internal storage yet). Launch tests: Lepton prints a transient "is not a running context" on the first start after an APK change (agent v54 `not_started` waits 30 s for "Boot complete!").
+**GitHub #38/#39 (2026-10-05):** PowerWash Simulator stuck at "Waiting.." on a reporter's Frame = Unity sized the right-eye image rect past its swapchain (rect 268+1656 on a 1920-wide swapchain; the runtime's recommended size differs per Frame) and SteamVR rejected every frame (`xrEndFrame failed -25`, XR_ERROR_SWAPCHAIN_RECT_INVALID), after which the game stopped calling xrEndFrame. FrameBridge `rect_clamp` (default on; sizes noted in xrCreateSwapchain; clamped layers count as swapped) keeps projection/quad rects inside their swapchain; triage `swapchain-rect-invalid`. Not reproducible on the dev Frame with `scale` (Unity's eye sizing isn't just the recommended width); no regression there (72 fps). The adapter's revision was NOT bumped (that would mark every installed game outdated): affected users rebuild. The Room VR (#38) = Unity's render thread SIGSEGV in libgallium_dri.so ~30 ms after the game recreates its eye swapchain with samples=4 (FrameBridge retries samples=1); the game's own code turns MSAA on (not OVRManager); candidate fix: hide GL_EXT_multisampled_render_to_texture (GL shim) - needs the APK to test. The launch test passed both (render thread dead / no frames): triage gap.
+**Headset round 2026-10-05 (evening):** I Am Cat's judder = repeated xrLocateViews of one display time returning
+slightly different poses → FrameBridge `pose_consistency` (owner-verified, works). Lucky's Tale freeze on touching a
+save slot = OVRPort's OpenXR dispatcher converting XR_FB_haptic_amplitude_envelope with ns read as s (GitHub #9) →
+xrshim `haptic_fix` (owner-verified); its remaining short pauses were the wear sensor ("HMD off/on" 0.5-1 s in
+`logs/eyetracking.txt`, not vrserver.txt) → **`focus_hold` is on by default with 5 s** (owner's choice; C defaults
+too). The Room VR works (`unity_no_overlay_copy`). BattleSisters (Unity 2019.4 built-in VR, no libOculusXRPlugin.so)
+flooded "outside of frame bounds" ~2400/s and hung the GPU (kernel hangcheck, zink DEVICE LOST) → the ovrpshim frame
+wait now also applies to Unity 2019 without the Oculus XR Plugin (`UnityOculusCheck.legacy_loop`). Vader Immortal
+(UE4, stuck on the loading image after the intro, GitHub #49): VRP repacks carry a Frida gadget (`libfrda.so`,
+config `hijack_responses`), but OVRPort's `patch_clean_up_frida` removes its loadLibrary call, so it never runs on
+the Frame; `frame.ovr_trace` (opt-in, `native/ovrtrace`: 1138 exported ovr_* stubs → real loader functions, logcat
+tag `fp_ovrtrace`: calls, PopMessage answers, unanswered requests every 10 s) is the next diagnostic.
+**Unity built-in VR input (2026-10-05):** probe builds (`FRAMEPORT_INPUT_PROBE=1 frameport build …`; it logs
+trigger/grip crossings too) showed OVRPlugin returns the full Touch state for every controller mask (also Go masks);
+presses reach the games' OVRInput. Accounting+ (Il2CppDumper v6.7.46 reads its Unity 2017 metadata v24, run on Windows)
+passes stance selection (NewtonVR grip/trigger) but its motion warning waits for `Input.GetMouseButtonDown(0/1)`,
+which Lepton never delivers (no focused Android window) → ovrpshim registers its own
+`UnityEngine.Input::GetMouseButtonDown(System.Int32)` icall (il2cpp_add_internal_call, after Unity's: resolve first)
+that adds a click in the frame a Touch trigger or A/B/X/Y is newly pressed (`unity_oculus_check` revision 3).
+BattleSisters (Unity 2019 InputSystem/XR InputDevices via `VrHandInput`): libunity's Oculus module (OVRPlugin
+function table: a global pointer at 0x16b57c0 in this build, slots filled by name, e.g. +0x160 GetControllerState,
++0x168 State2, +0xe8 GetNodePresent) only reports controllers when `strncmp(deviceModel, "Oculus", 6) == 0` (next to
+the Go check `deviceModel == "Oculus Pacific"`); Lepton's model is "Valve Lepton" → Go/unknown → only Go masks polled,
+buttons dead. `unity_oculus_check` revision 4 (`oculus_model_checks`, Unity 2019 only) turns the 17 compares' length
+into 0 (`orr w2, wzr, #6` → `mov w2, #0` after the adrp/add of the "Oculus" literal; the string stays: it is also
+Unity's VR device name). Device result: libunity now polls `ovrp_GetControllerState(0x3)` (Touch); owner-confirmed
+2026-10-06: buttons work. Its first controller vibration then hit OVRPort's haptic-envelope bug (11 GB, OOM kill) →
+`haptic_fix` is now suggested for every game with libOVRPlugin.so (settings detect), BattleSisters works. Ruled out before: ProductName, GetNodePresent, the device-model string itself, exports.
+Accounting+ works (owner, 2026-10-06).
+**Vader Immortal (UE4, GitHub #49, 2026-10-06, headless):** stuck after the intro on an in-game image (the splash
+quad ends ~6 s in; then the game's own projection frames, 72 fps, balanced xrBeginFrame/xrEndFrame). Not the Platform
+SDK (`frame.ovr_trace`: only user + entitlement, both answered) and not the repack's Frida gadget (OVRPort's
+`patch_clean_up_frida` removes its loadLibrary). It **leaks ~430 GPU mappings (/dev/dri/renderD128) and ~20 MB a
+second** (6.5 GB + swap after 5 min, then 26 fps): page-fault stacks (perf -e page-faults, offsets resolved with the
+process maps + vrclient.so's own symbols; its text segment is at file offset + 0x4000) end in SteamVR's runtime:
+`xrBeginFrame → CSxrCompositorOpenVR::BeginFrame → SubmitExplicitTimingData → CVRCompositorSharedTextures::
+BeginGPUTimingCommandBuffer` and `xrEndFrame → CVRCompositorClient::SubmitWithArrayIndexAndTime`. Ruled out: the
+layer color scale/bias + image layout structs (FrameBridge `strip_color_bias` 1/2, diagnostic), Valve's Vulkan
+layers (VK_INSTANCE_LAYERS=""), array swapchains in general (Lucky's Tale/I Am Cat flat). Kernel tracepoints aren't
+allowed for steamos. FrameBridge: `layer_debug` logs xrDestroySwapchain and per-5 s xrBeginFrame/xrEndFrame counts;
+`frame_balance` (ends an open frame before the next begin) exists but Vader never leaves one open. Next (built,
+not yet run: the Frame slept): `layer_debug` also counts xrAcquire/Wait/ReleaseSwapchainImage per 5 s (hooked only
+with layer_debug, after the other conditional hooks) to see whether Vader skips a wait or release: it doesn't (361/361/361 per 5 s).
+FrameBridge `snapshot=N` (`snapshot_gl.c`, GLES): every N s the left-eye image the game submits is read back on its
+own context and saved as `files/fb_snap_0-7.ppm` (quarter size) — headless launches show a black headset view, this
+shows what the game draws. Vader: Lucasfilm logo (an OBB mp4: video works), then its loading card (portrait + segmented
+bar) that never advances; the async loader thread sleeps and OBB reads stop (~168 MB of a 2.7 GB pak).
+**SteamVR overlay apps (agent v75, 2026-10-10):** host OpenVR overlays (VRApplication_Overlay) are composited over Lepton (Quest) games on the Frame (probe checker seen over 4XVR in the headset view, `native/vroverlay_probe`); Windows ones register through Proton's vrclient too (Temporal Reality's Windows build created its overlays; fpsVR never reaches OpenVR under Proton). Detection `analysis/vroverlay.py` (bundled `.vrmanifest` with `is_dashboard_overlay`, else OpenVR + IVROverlay + self-registration markers, engine Other; Rift fingerprint `RIFT_ANALYSIS`), patch `pcvr.vr_overlay` (param autostart), Linux entry fields `vr_overlay`/`vr_overlay_autostart` (game page switch); agent `register_vr_overlay`/`unregister_vr_overlay`/`launch_vr_overlay` (IVRApplications via ctypes, live; manifest `<anchor>/frameport-overlay.vrmanifest`, the app's own key, binary = launch.sh). **SteamVR on the Frame reads only `binary_path_linux_arm`** (binary_path_linux alone is skipped). Overlay apps: no launch test, no Linux Steam-parent watchdog (`FRAMEPORT_OVERLAY`), not a "running game". A Steam overlay-app shortcut and a game shortcut run together. SteamVR's SetApplicationAutoLaunch didn't persist on the dev Frame (the watch never started by itself) → **agent v76: FramePort's own autostart**: the deployment's `overlay.autostart` is the source of truth; `ensure_host_fixes` (`ensure_overlay_service`) keeps the user service `frameport-vr-overlays.service` (`_vr_overlay_watch`, 5 s polls of the known vrserver's /proc stat) only while an overlay app has autostart on (register/unregister, uninstall, purge and the kill switch `~/.local/share/frameport/vr-overlays.disabled` / `FRAMEPORT_NO_OVERLAY_AUTOSTART` update it); a new vrserver (pid + start time, kept in `~/.cache/frameport-vr-overlays.json` across agent updates) → child `_vr_overlay_round`: wait for IVRApplications, 15 s grace, `launch_vr_overlay` for apps not running (folder process or GetApplicationProcessId); log `~/.local/share/frameport/vr-overlays.log`. Dev Frame: adopted the running vrserver, skipped the already running watch; a start after a real SteamVR start/boot is not yet seen. Details: docs/FRAME_RUNTIME.md "Overlay apps".
+**Vader's leak solved / AC Nexus flips (2026-10-14):** Vader Immortal leaves GL errors pending on its context; SteamVR's GL interop (`openxr_graphics_gl_openvr.cpp`, `xrclient_<pkg>.txt` in Steam's logs: `SXR_GL_CHECK: error:0x502 ... glGenTextures`) takes the stale error as its own failure once, and from then on `CVRCompositorSharedTextures::BeginCommandBuffer` allocates a command buffer every frame (perf page-fault stacks; ~430 renderD128 mappings + 22 MB/s). Adapter `gl_error_clear` (GLES, catalog on for Vader ep1-3) clears them before xrCreateSwapchain/xrBeginFrame/xrEndFrame: flat memory, no SXR_GL_CHECK (headless). The per-game `xrclient_<pkg>.txt` logs are worth reading for runtime errors. The Frame's runtime caps swapchains per session (XR_ERROR_LIMIT_REACHED from ~15; AC Nexus asks for more): flip emulation now turns quads upright in place (scratch VkImage, once per acquire; transfer usage added to single-layer colour swapchains) instead of a shadow swapchain per quad, which ran into the cap (#138). Headless sessions don't draw AC Nexus's panels (adapter `flip_dump` saves before/after images of flipped quads, for headset runs).
+**Mixed reality: scanned rooms (agent v92, 2026-10-16, branch mr-scene; docs/mr/):** Quest MR games read the room
+through Meta's scene APIs; the Frame offers none, and Valve's chaperone is no room (2D outline raised to 2.43 m, often
+the default 1 m circle -> the Android runtime's STAGE rect falls back to 1x1 m; XRService's plane detection is
+horizontal-only, its persistent map sparse ORB, its XRIPC single-client; cameras are XRService's alone,
+IVRTrackedCamera gives no frames). **The passthrough's RoomView 3D depth mesh is readable** (docs/mr/PHASE0.md:
+IVRBlockQueue_005 `/xrservice/roomview3d/meshData|meshLayout`, metadata through the C++ `IVRPaths_002` on the block
+handle, `meshIsUpToDate` on the queue handle; 132x128 fan, ~30/s; raw->standing moves during a session -> convert
+with the final one), so FramePort scans rooms itself: agent `room_capture` (Background/Overlay OpenVR app, prompts =
+artifacts/roomscan/*.png via IVROverlay_028 slots 1/3/20/22/35/43/44/63, `scripts/mr/render_prompts.py`) -> `.fprs`
+dump -> `fp_roomscan` (native/roomscan, freestanding, offline) -> `room.txt` + `room-mesh.bin`
+(docs/mr/ROOM_FORMAT.md; outline = positive shoelace in x-z, wall inward normal (-dz, dx)) in
+`~/.local/share/frameport/rooms/<universe>/`; launch.sh copies it next to settings.conf (`_room_sync`, games with
+`scene_emul`); FrameBridge (`scene_room.c/scene_meta.c/scene_anchors.c`) serves N walls, volumes (BOUNDED_3D),
+planes, GLOBAL_MESH (XR_META_spatial_entity_mesh), XR_META discovery/persistence (newer Meta SDKs and MRUK), anchors
+saved in `files/framebridge-anchors.txt`; all through xrshim (OVRPort's dispatcher drops unknown META calls).
+`scene_emul` is now suggested for every USE_SCENE/USE_ANCHOR_API game (migration `scene_emul_all`; NOPE and Pinball
+FX had none). PC: Frame page "Room" card, `frameport frame room scan|status|from-boundary|import|export|build|show`.
+Real data (owner's room, 2026-10-16): floor at 0, table surfaces, orthogonal walls found; the ceiling needs "look up".
+**Unreal's self-restart (agent v90, 2026-10-13):** UE 4.21+ restarts the app once after its first-run shader
+precompile ("optimizing" screen; `r.ProgramBinaryCache.RestartAndroidAfterPrecompile`): it starts its own LAUNCHER
+activity and calls System.exit(0); Lepton ends the container with the first process (the restarted one with it).
+Skipping `AndroidThunkJava_RestartApplication` or the cvar = 0 (accepted via UE4CommandLine.txt `-ini:`) left Sports
+Scramble on that level for good. launch.sh (RESTART_BLOCK, `upgrade_launchers` adds it) starts Lepton once more when
+`_restart_requested` sees the app's own LAUNCHER start (system log, uid >= 10000) <= 5 s before its exit; first run
+kept as `launch-before-restart.log`; `FRAMEPORT_NO_RESTART=1` off. Owner-verified with Sports Scramble's first start (2026-10-13).
+**xrWaitFrame runs ahead (Journey of the Gods, 2026-10-14, owner-verified):** with real frames (headset on) the
+Frame's runtime sometimes returns from xrWaitFrame at once with a display time less than one refresh after the frame
+just submitted, and then rejects the second submission for that refresh (`VRCompositorError_AlreadySubmitted` in
+Steam's `logs/xrclient_<pkg>.txt`; FrameBridge pacing above the display rate). VrApi games that render faster than
+the display ran ahead (~120 submits/s at 90 Hz) and the scene slid and snapped back. The VrApi bridge re-waits when
+the new display time is under half a period after the last submitted one (`pacing 2s:` counters). Headless runs only
+submit empty frames and never show it. Lepton's logcat mirror also missed the whole verifying session (launch.log =
+Lepton's own lines only): the keeper now catches a silent mirror too (agent v91).
+**Lepton's logcat mirror dies (agent v67, 2026-10-09; v91 2026-10-14):** Lepton's mirror (`podman exec -it <container> logcat -v threadtime,color`) fails three ways: `logcat: Unexpected EOF!` right after the game starts, `Logcat read failure`, or running and writing nothing at all (Lepton 3.0.5: seen twice on 2026-10-14, once in the owner's session, once headless). launch.sh's `_logcat_keeper` reads `podman exec <container> logcat -v threadtime -T <epoch>` itself into launch.log after a failure line or 20 s without a logcat line (from the launcher's start when the mirror never wrote, else from just before its last line), restarts it from where it ended (≤5), stops it when Lepton's coloured lines come back, sets the container's log buffer to 16 MiB (`logcat -G`), and logs every decision to `<base>/logcat-keeper.log`. Checked on the dev Frame: a mirror killed mid-game (hand-over without a gap) and a silent mirror (the whole session recovered).
+**Double launch (agent v57, 2026-10-06):** a second Play while Lepton still boots (~10 s with nothing to see) made
+the second Lepton stop the first one's container ("Waiting for steamlaunch-<appid> (PID …) to exit", exit 137
+"(starting)", "Clearing baked app data due to early exit") and both died (Vader, BattleSisters). launch.sh now takes
+`flock` on `<base>/.launch.lock` (fd 9, inherited by Lepton; the watchdog and dashboard helpers close it with
+`9>&-`); a second launch exits 0 and logs to `<base>/launch-dup.log`. `upgrade_launchers` adds it to existing
+launchers. Verified on the device (second launch during boot: ignored, the first kept running). Vader on its loading
+card ignores input too (owner pressed/held every button: presses reach the runtime, the card never changes).
+**Issue triage round (2026-10-06, owner's headset):** vibration in OVRPlugin games = 2 s vibrations updated per frame and
+stopped with amplitude 0; FrameBridge turns amplitude 0 into xrStopHapticFeedback (else each buzz ran 2 s), haptic_fix
+uses the envelope RMS (was its peak), per-game `haptic_scale` → Creed/The Boys/Jurassic World fine. Lambda1VR (TBXR):
+loader named by Build.MANUFACTURER (`frame.tbxr_vendor`), no graphics extension enabled (FrameBridge adds
+XR_KHR_opengl_es_enable + asks for the requirements on -50), always multisampled render-to-texture (GL shim gives
+single-sampled stand-ins when GL_EXT_multisampled_render_to_texture is hidden) + its xash/ data → works. Jurassic World:
+`frame.vrapi_stub`. Metro Awakening: contributor's vkshim fixes + hide_space_warp + no VALVE_rpo (jumping polygons like
+ITR2). Pinball FX VR: hide_space_warp (stutters). Eleven: a Meta online request fails after platform init → needs Meta
+services. Star Wars Tales: top half black + freeze after loading; ruled out: asset-file paks (never requested), Valve
+foveation (off: no change), GL errors (MESA_DEBUG=1: none), EGL_BAD_ACCESS once in OVRPlugin init (harmless); the game's
+eye image reads back black. BlazeRush: VrApi bridge exports + ovr*_ToString stubs + avatar stub get it to the menu room
+at 72 fps, full input reaches it (diagnostics `input 5s`: Touch type only, sticks 1.0, buttons, poses 0x8f), but the room
+draws no controllers and ignores input; avatar loader forced to its "Failed" path (no logged-in user) changed nothing.
+`frame.ovr_trace` can't trace Unity games (P/Invoke dlsym; nothing imports ovr_*). Headless: the VrApi bridge's 30 s
+head-pose deadline ends VR mode without a worn headset (not a game bug).
+**Lepton storage (2026-09-30):** each app's /sdcard (= /storage/emulated/0 → `<base>/lepton-data/external`) has `Movies`/`Download`/`Documents` symlinked to the Frame's `~/Videos`/`~/Downloads`/`~/Documents` (liblepton/mounting.sh, only if they exist at start); agent v24 `storage_targets` reads that mapping. Android's MediaProvider canonicalises paths to /home/steamos/... and rejects every file ("doesn't appear under [/system/media...]"), `sm list-volumes` is empty: the media index never works, apps must browse folders. Lepton installs with `adb install -g` (runtime permissions granted, MANAGE_EXTERNAL_STORAGE too). Files: `install/files.py`, `frameport frame send|storage`, GUI Files tab (formerly Frame → Send files).
+**SteamVR per-app settings (2026-09-30):** editing steamvr.vrsettings while SteamVR runs is lost; the web API (127.0.0.1:27062 /app/setsettings) needs `x-steamvr-secret`. `native/vrsettings` = `fp_vrsettings.exe` (freestanding, OpenVR `FnTable:IVRSettings_003` as a Utility app, loads SteamVR's bin/win64/openvr_api.dll) sets them live and SteamVR persists them: section `steam.app.<shortcut appid>`, keys `preferredRefreshRate` (float) and `motionSmoothingOverride` (0 global, 1 on, 2 off, 3 always). Steam Link (vrlink) lists the Frame's rates 72/80/90/96/108/120/144 in vrserver.txt and follows the per-app preference ("host preferred N Hz"; whether the key is honoured is unverified in-headset yet). Judder metric: vrcompositor.txt session summary dropped + "Timed out. N total" (Stormland: 0 dropped but 313 timeouts in 2 min); fpsVR (`%LOCALAPPDATA%\fpsVR\*.json`, 0.1 ms histograms) gives p99 CPU/GPU ms. `pcvr.steamvr_tuning` (default on, PC only) applies on Play: highest rate whose budget ≥ p99×1.05, at least one step down, smoothing on.
+
+**Language packs (merged from PR #20, 2026-10-04):** overport's `libovrplatformloader.so` is a dispatcher that `dlopen`s Meta's own loader (`libovrplatformloader_meta.so` / `_meta_q1.so`, also `libpxrplatformloader.so`) and keeps its own message queue; `ovr_LanguagePack_GetCurrent/SetCurrent` are 8-byte `return 0` stubs in it, `ovr_AssetFile_GetList` forwards to Meta's loader. `frame.langpacks` (opt-in, `native/langpack`) serves `<tag>.lang` files from the game's data; `elf.hide_exports` marks the loader's exports STB_LOCAL (bionic and glibc only match GLOBAL/WEAK; verified for glibc, bionic's `is_symbol_global_and_defined` is from memory). `libfp_langpack.so` is built here (`python native/build.py --only langpack`) and committed. Owner-verified 2026-10-04: Deadpool VR with only `en.lang` and the patch on plays English dialogue and runs normally (headless launch tests show 2-6 fps while it loads: not a regression sign). A dispatcher answer that arrives after we answered the timed-out GetList is dropped (one answer per request); games already in a library get `lang_packs` filled after an app update (`library._refresh_data_fields`). The library logs to logcat under the tag `fp_langpack` (dirs looked in, packs found, every language-pack call), so it shows up in the game's `launch.log`; an `ovr_AssetFile_GetList` the dispatcher leaves unanswered for 1.5 s is answered with our packs alone. Deadpool VR (Unreal) accepts a pack only when its `Metadata` equals the game's own version string (`ULanguagePacksSubsystem` compares it with `%s.%s.%s.%s.%s` built from the build info, e.g. `1.0.40.356975.Quest` = versionName; found by disassembling `libUE4.so`): the patch writes the APK's versionName into the library (`@FPMETA@` slot, `with_metadata`), `FRAMEPORT_LANGPACK_META` overrides it. Deadpool VR (2026-10-04, headset): German became selectable with that Metadata, but dialogue stayed silent (even English once reported as a pack) while the path was spelled `/sdcard/Android/obb/<pkg>/x.lang`; with the `/storage/emulated/0/Android/obb/<pkg>/x.lang` spelling (Unreal's own, now listed first in `scan_dirs`) German dialogue plays. `FRAMEPORT_LANGPACK_SKIP=<tags>` or a file `fp_langpack_skip` in the obb folder leaves packs out of the list (experiments).
+
+**Cube swapchains (GitHub #107, 2026-10-09):** the Frame's runtime refuses `faceCount=6` swapchains (-2,
+XR_ERROR_RUNTIME_FAILURE); OVRPlugin ignores that ("CreateSwapchain for eye 0: 0x0, 0 stages") and crashes in
+ovrp_EndFrame4 (memset). FrameBridge `cube_standin` (default on, `native/adapter/cube_standin.c`) serves a refused cube
+swapchain as one GL cube-map texture in the app's context (GLES only) and drops its layers. Verified headless with
+Budget Cuts Ultimate (2048² sRGB, 12 mips; runs on at ~70 fps); what the cube layer showed is simply missing.
+**Hardware video decoding (PR #96, PR #128 by Lucas-Mathieu, adapted 2026-10-10, agent v71):** `native/hevc` = one
+OMX plugin `OMX.frameport.{avc,hevc,vp9}.decoder` (FFmpeg v4l2m2m on Iris /dev/video-dec0, FFmpeg software decoders as
+fallback inside the component, Vulkan copy for big native surfaces). The connection installs it once per Frame
+(`ensure_video_codec` → agent `video_codec_status`/`install_video_codec`: `~/.local/share/frameport/video-codec/versions/
+<manifest sha>` + `current` symlink). A Frame keeps the same or a newer `revision` (no flip-flop between PCs) → **bump
+`revision` in native/hevc/build.py with every artifact change**; a failed install isn't retried during the connection.
+Per game: only launchers of games whose recipe has `frame.hw_video_decode` (install stage, no APK change; suggested
+from analysis `media_codec`, ANALYSIS_VERSION 8; deployment.json `hw_video_decode`) get the codec line → the Podman
+wrapper (native/hevc/podman.py) mounts the plugin into that container (merged media_codecs.xml in
+$XDG_RUNTIME_DIR/frameport-video). Off for every game: Settings → Installing (library `video.hw_decode` → agent
+`video_codec_switch` = video-codec/disabled); one game: `FRAMEPORT_NO_HW_VIDEO=1 %command%`. `upgrade_launchers`
+converts agent ≤70 launchers (Batman's `<base>/frameport-codec` → keeps the line, folder then removed). Batman: catalog
++ migration `batman_video_patches` (`frame.hw_video_decode` + hidden adapter setting `surface_native`). Iris: 8K
+refused (ENOMEM) while any other decoder session is open; SteamVR's vrlinkrunthread holds one ~12 s at game start →
+refused opens retry until 20 s after the plugin loaded (else 2 s), then software; VP9 7680x3840 never returned a
+picture → VP9 ≤4096x2304; hidden VP9 frames come back as empty capture buffers (bytesused 0, no LAST):
+FFmpeg's wrapper ended the EOS drain at the first one (two-pass VP9 lost its last ~25 frames) → build.py requeues
+them (codec revision 8; drain ends at LAST, or 1 s after a skipped empty buffer; dev Frame 2026-10-10: 600/600 =
+OMX.google.vp9 Y hashes). Rebuilds are deterministic (ext4 + NTFS path
+with spaces, two NDK copies → same; rev 8 141de01f…; PR #128's own sources → its 27a2d749…). Not yet run on the device.
+**Vulkan shader dump (GitHub #140, 2026-10-10):** adapter `vk_shader_dump=1` (Vulkan shim, `native/vkshim/shader_dump.h`;
+applies where vk_sanitize can: Unreal/Other arm64) writes each distinct SPIR-V module once to
+`files/fp_vk_shaders/<size>_<sha256>.spv` (tmp + rename) and one `index.txt` line per vkCreateShaderModule (`<seq> <ms>
+<unix ms> <name> new|known|again|failed`, O_APPEND) to find the module behind a GPU hang. Agent v72 `collect_diag`
+returns `shaders` (newest modules of fp_vk_shaders + fp_spirv, ≤4 MB each, base64) → bundle
+`games/<pkg>/target/shaders/`. Triage `gpu-hang` suggests both dumps; `triage.graphics_api` (FrameBridge's
+xrCreateSwapchain formats: <0x1000 Vulkan, else GL) keeps only the session's API's (`API_ONLY`). Host-tested only.
+Agent v74: a reporter's hang came ~10 s after the last new module, so the culprit wasn't among the newest written →
+with an index naming modules, `shader_dumps` sends every module of the index's **newest session** (after the last
+`# start`), deduplicated, last used first, each ≤4 MB, ≤30 MB in all (`session` = how many it names) + that session's
+index lines; no index (fp_spirv) = the old newest-by-mtime 4 MB. One JSON line (~40 MB base64) over the SSH channel
+is read whole by `Frame.agent` (fine at that size); `_Writer.fit` drops the least recently used modules last, after
+cutting logs, to stay under the 24 MB zip limit.
+**Unreal OBB check (GitHub #159, 2026-10-10):** Epic's DownloaderActivity checks OBB name+size (OBBData), then with `bVerifyOBBOnStartUp=true` CRCs the whole OBB; its screens are invisible in Lepton (stuck at `Displayed …/.DownloaderActivity`, triage `unreal-obb-check-stuck`) → `frame.unreal_skip_obb_check` (analysis `unreal_verify_obb`, ANALYSIS_VERSION 11) flips the manifest boolean (`axml.set_meta_data_bool`); skips only the CRC pass. Host-tested only.
+**Issue round 2026-10-12 (agent v83):** Lepton pastes STEAM_COMPAT_DATA_PATH unquoted into `sh -c "ln -s …/internal/<pkg>
+/data/data/<pkg>"` (mounting.sh): a game on a card named "Steam Frame 512g" got no internal storage (no saves/prefs;
+Beyond Sandbox's EOS then looped `createKeychain→resetKeychain` forever, 1.85 GB log). Quest launchers with an unsafe
+path now `ln -sfn <base> ~/.local/share/frameport/lepton-paths/<pkg>` at every start and give Lepton that path
+(`app_dir_lines`/`set_app_dir`/`launcher_base`; upgrade_launchers converts; deployment.json keeps the real base).
+Verified on the device with a spaced copy of Stremio (old: the `ln` error; new: /data/data link, shared_prefs
+writable). `frame.eos_keychain_loop` (opt-in, triage `eos-keychain-loop`) returns from EOSSDK.resetKeychain. Wander
+0.3570 (Unity 6.5, Firebase, Gecko) ran out of bionic's 128 pthread keys → `frame.unity_tls_key_pool` (Klownicle's
+approach, #198: libunity's 4 key imports renamed `fp_tkey_*` via `elf.rename_imports`, `libfp_tkeys.so` pools
+destructor-less keys behind one real key); device: past Firestore, 72 fps. Cpp2IL releases can't read metadata v107
+(Unity 6.5) → `tools/cpp2il.py` falls back to the development CI build (nightly.link) on that error. Vermillion's canvas
+is an OVROverlay quad (drawn above the hand) → `frame.vermillion_scene_canvas` (PaintableMesh getters → false;
+installed build checked, 72 fps headless; headset not yet). Linux apps: `desktop_icon` switch, a deleted desktop copy
+stays deleted (#212). Findings: OLAR (#201) RHIThread null deref in libUnreal (`ldr x8,[x19,#792]`, x19=0) not fixed by
+hide_space_warp / vk_hide_fdm / no Valve layers; FNAF HW (#135) "freeze" = first-start GL program-binary-cache compile
+on Zink (threads busy in zink/disk cache), not a hang; VR4 (#199) reporter's patch.203 OBB truncated. Upload benchmark
+(`scripts/upload_bench.py`, #242): home Wi-Fi caps every method at ~11 MB/s; paramiko uses ~3x OpenSSH's CPU; Windows
+OpenSSH refuses FramePort's key file (ACL "bad permissions") until its permissions are tightened.
+**OpenSSH uploads (2026-10-15, #324/#242):** sftp escapes `* ? [` inside double quotes itself (and undoes it for
+put's destination), so `native_upload.quote` escapes only `\\`/`"`; Win32 sftp turns every local backslash into `/`
+(escapes too) → local paths go as `C:/…`. Logins: `Frame.auth` = the attempt that worked (app_key / user_key = a key
+file from Settings → Installing → SSH keys, library `ssh.extra_keys`, CLI `frame ssh-keys` / agent / password).
+OpenSSH strict (FramePort + Settings keys, IdentitiesOnly) unless auth was "agent"; a refused strict login retries
+relaxed (+ private copies of ~/.ssh/id_{rsa,dsa,ecdsa,ed25519}: OpenSSH skips its defaults once any -i is given, + the
+agent); `-v` key lines go into the error. FramePort doesn't add its key to the Frame for this. Windows-tested.
+**Meta user id (GitHub #182, 2026-10-11):** OVRPort's platform loader (runtimes 3.4.3-23204ea and -aa54c3f) answers
+`ovr_GetLoggedInUserID` (and two other callers) without a Meta account with a made-up id from a helper (`stp; mov x29,
+sp; bl random; …; mov/movk x9 = 0x53444835ec580000 (6e18); add x0, x8, x9; ldp; ret`), kept only in memory → a new id
+every start; Walkabout Mini Golf files saves under `Profiles/Oculus/<id>/` and lost all progress. `frame.ovr_stable_user`
+(default_on, detect = the game has libovrplatformloader.so) rewrites the helper to `mov x0, <6e18 + 32 bits of
+sha256(package, keystore)>; ret`: stable per game and per user (keystores are personal), so online games never see two
+FramePort users as one. Found in every PATCHED build checked. Host-tested only; upstream candidate.
+**Vivox API 31 (GitHub #101, 2026-10-09):** newer Vivox builds (Green Hell VR) call Android 12 AudioManager
+communication-device methods from `com.vivox.sdk.AudioChangeListener` with no SDK check → NoSuchMethodError on Lepton's
+Android 11. `frame.vivox_audio_route` (analysis `vivox_api31`, ANALYSIS_VERSION 4) makes every such method return at
+once (`Dex.return_early`: return-void / `const/4 v0,0; return v0`; nopping the invoke would leave a move-result the
+verifier rejects). Older Vivox (Eleven Table Tennis, BattleSisters) lacks that code and isn't matched. Verified
+headless: Vivox initialises, 150 s at ~65-70 fps.
+**Steam Input gamepad for 2D apps (GitHub #162, agent v72, 2026-10-10):** Lepton's Android only has the Wayland seat's `wayland_touch/keyboard/pointer`. Steam makes its virtual pad (uinput, `/devices/virtual/input`, 28de:11ff, "Microsoft X-Box 360 pad N", ACL for steamos) only while the Frame's controllers are on (controller.txt "Steam Controller reserving XInput slot 0"; gone when they sleep), also with no game running; steamos-manager's 28de:0000 keys device isn't a pad (no BTN_SOUTH). Lepton's container root (system_server too) = steamos (`keep-id:uid=0`), so a bind-mounted `/dev/input/eventN` opens. Opt-in `device.steam_gamepad` (vr_kind none; suggested for `android.hardware.gamepad`/`LEANBACK_LAUNCHER`, analysis `gamepad`, ANALYSIS_VERSION 9): deployment.json `steam_gamepad` → launcher `GAMEPAD_LINE` (after the codec line: exports FRAMEPORT_GAMEPAD + LEPTON_ENV_SDL_GAMECONTROLLER_ALLOW_STEAM_VIRTUAL_GAMEPAD, puts `agent/bin` first on PATH) → `PODMAN_WRAPPER` (written by ensure_host_fixes; non-`run` calls go straight on; `run` imports the agent's `podman_run_args`; hands on to the next Podman after its own PATH entry with itself removed from PATH, so it chains to the codec wrapper either way round) adds the pads + `Vendor_28de_Product_<pid>.kl` (Xbox 360 layout). Verified headless with a uinput stand-in pad (Stremio's container: EventHub `classes=0x80000141`, our key layout, KeyEvent BUTTON_A dispatched); with Steam's real pad and a game: not yet. Pads made after the start aren't seen until the next one.
+**Multiview programs on flat framebuffers (GitHub #77, Doom3Quest, 2026-10-09, prototype):** Mesa enforces OVR_multiview's
+"program num_views == draw framebuffer views" rule (`draw_validate.c`, the draw is dropped silently); Qualcomm doesn't.
+Doom3Quest compiles every VS with `layout(num_views=2) in;` and draws its HUD/PDA into 2D-texture FBOs → black. Opt-in
+`frame.gl_multiview_fbo` (analysis `gl_multiview_libs`, ANALYSIS_VERSION 6; own-engine GLES only): `native/glmv` =
+`libfpglmv.so` (12 chars = "libGLESv3.so": libdoom3.so's one `.rodata` dlopen string is rewritten in place, its qgl*
+table comes from dlsym on that handle; also first DT_NEEDED for its direct gl*/egl* imports). Such draws use a lazily
+built single-view twin (view 0, uniforms copied per draw); eglMakeCurrent resets the per-thread cache. Host-tested only
+(rewriter on all 19 Doom3Quest shaders + glmv.c against a stand-in GL, `tests/test_gl_multiview_fbo.py`); the host's
+Mesa 23.2 llvmpipe has no OVR_multiview. Headset-verified by Xandrix1987 (2026-10-09: HUD/PDA shown, no fps drop) -> in the Doom3Quest catalog recipe.
+**BlazeRush (GitHub #57, Klownicle's verified guide, 2026-10-10; FramePort's version headless-tested only):**
+`frame.blazerush` (1.0.349 only: exec-segment SHA + every word checked, offsets from PT_LOAD) NOPs the avatar-readiness
+wait (0x4b2dbc), RETs the avatar renderer (0x4b2adc), renames `cache/shader_cache` → `cache/br_shader_v1`. GL shim
+(now also exports glShaderSource/glLinkProgram/glProgramBinary/glDeleteProgram/glDraw*: pass-through unless a setting
+is on) `gl_int_attribs` (integer inputs fed via glVertexAttribPointer re-set with glVertexAttribIPointer per draw,
+reflection cached per EGL context + program, dropped on link/binary/delete) and `gl_highp_markers` (vertex shaders with
+every '|' marker: mediump→highp except on in/out/uniform lines); host test `tests/test_blazerush.py` with a stand-in
+GL. FOV: the game reads VrApi props 7/8 right after vrapi_Initialize (no session; the Frame has no
+XR_EPIC_view_configuration_fov) → the bridge saves the live FOV (also located before tracking, headless: 118.87×120.04
+on the dev Frame) in `files/framebridge-vrapi-fov.txt` and answers with it at the next start (log `FOV properties: …
+(saved by an earlier session)`). `device.config_sync` (catalog field `config_sync`, agent v78): user_config.xml
+r_3dwidth/height, r_width/height from the runtime eye size (FrameBridge logs `runtime recommended eye size`) × scale,
+written at finalize, set_settings and by launch.sh before Lepton starts (`_config_sync`). Headless runs at scale 1.7
+end in `zink: DEVICE LOST` right after the bridge's 30 s no-tracking deadline tears the session down (gpu fault at the
+teardown; not at scale 1.0): a headless-only artifact, the headset never hits that deadline. Launch tests count an exit/crash after
+such a line as a pass (triage.yaml `headless_end`, finding `headless-end`; GitHub #57 "Failed to launch" on install).
+**Session triage (agent v70, 2026-10-09):** launch tests never reach FOCUSED, so real play sessions are triaged
+too. list_installed gives each game `last_play` {start, end, test} from `<anchor>/plays.log` (launch tests write a
+`test <unix>` line first → test sessions are only marked); `session_log` returns the newest session's launch.log
+(`<base>/session.log`, ≤4 MB: head + tail + FrameBridge/crash lines between) + that session's logcat-crash.log +
+`journalctl -k` GPU lines ("kernel: …"). The GUI's connection refresh (`app._check_sessions` → `pipeline.sessions_due`,
+background thread; sessions >7 days old are skipped) runs `pipeline.triage_session` = `validate/session.analyze`
+(triage.yaml signatures incl. `space-warp-used` (info, `question:`, never auto-applied), `gpu-hang` (`report: true`)
++ computed `slow-frames` (pacing windows vs the nearest refresh rate) and `focus-dips` (FrameBridge always logs
+`focus: lost` / `focus: back after N ms`, session_fixes.c)) → library `last_session` / `last_session_checked` → game
+page "Last session" callout (Try this fix / Rebuild with this fix / Yes-No question / Report / Dismiss). Suggestions may
+be values (`adapter.scale=0.85`, `triage.split_suggestion`); adapter-only fixes are pushed live (`apply_suggestions_live`
+→ agent set_settings, like the Game settings dialog). CLI `frameport session <pkg> [--apply]`. PC VR (Proton) launchers
+log no session end, so they aren't triaged yet. pac_hints stays triage-only: a survey of all 68 dump APKs found unpaired
+PAC hints in 21 libraries of 18 games (OpenSSL's 38/40 in most UE4 libUE4.so and libEOSSDK.so, UE5 libUnreal.so ~400
+vs +2-3, libass, libopencv, …), most of them games that work, so default-on would rewrite many working builds.
 **Unresolved (as of 2026-09-28):** Arcsmith (right-eye distortion) and Time Stall (both eyes) — swap, tracking, Valve
 layers, depth, pacing ruled out. Sniper Elite VR (DEVICE LOST), Espire 1 (Mesa GL upload crash), HITMAN 3 (freedreno
 crash): use PC versions.
 
-**Install links / FrameDrop button protocol:** `deeplink.py` parses framedrop://, frameport:// and https install links (strict URL rules, manifest ≤256 KiB, downloads into `<data>/downloads/`), `pipeline.add_from_link`, `views/link_dialog.py`, CLI `frameport open-link`; `urlhandler.py` registers a script (bundles can't take URL arguments), `<data>/links/*.link` + `gui.alive` heartbeat; Settings → Install links (`links.framedrop`/`links.frameport`); `ui/dropped.py`, `pipeline.add_windows_exe`, `device.display_mode`; demo link `deeplink.DEMO_MANIFEST`. → docs/DEVICE_NOTES.md#install-links--framedrop-button-protocol
-**Install link updates:** manifest `version` → library `link.version`; `pipeline.check_link_updates` (GUI start, 6 h, setting `links.check_updates` = Settings → Updates → Games) marks `link_update` → Library bar / game page → `link_dialog.update_from_link`; CLI `frameport link-updates`; the demo link is never checked. → docs/DEVICE_NOTES.md#install-links--framedrop-button-protocol
+**Install links / FrameDrop button protocol (2026-10-07, not yet clicked end to end from a browser):** FrameDrop
+(framedropvr.com, a closed-source Windows sideloader) defines "Install with FrameDrop" buttons:
+`https://framedropvr.com/install?manifest=<url>|url=<file>` → that page opens `framedrop://install?…` (1.6 s, else its
+home page); manifest `{"schema":"framedrop.install/v1","name","files":[{"url","sha256"}]}` (name = Steam title; .apk
+or Linux .zip). `deeplink.py` (no Flet) parses framedrop://, frameport:// and the pasted https link, enforces its
+rules (https; http only on loopback; no credentials; no LAN/loopback/link-local IPs, also after DNS and redirects; URL
+ends in a file name), caps manifests at 256 KiB, ignores non-hex sha256 (FrameDrop's own example has a placeholder),
+downloads into `<data>/downloads/<slug>-<hash>/` (OBBs → `obb/` next to the APK, `.part` removed on cancel/mismatch);
+`pipeline.add_from_link` routes APK / Linux / exe and sets `title` + `title_locked` + `link` (a bare file link keeps
+FramePort's title). GUI: `views/link_dialog.py` (always asks first), Add games → "Install from a link…", CLI
+`frameport open-link [--yes --no-install --gui]`. **A `flet build` bundle can't take a URL argument** (the Flutter
+host treats any argv as a developer page URL), so `urlhandler.py` registers a script, not FramePort.exe: Windows
+HKCU `Software\Classes\{framedrop,frameport}` → hidden PowerShell `frameport-link-handler.ps1`; WSL (source runs)
+the same keys → `wsl.exe -d <distro> -e sh frameport-link-handler.sh`; Linux `frameport-links.desktop` +
+`xdg-mime`; macOS unsupported (Apple Events, paste instead). The script drops the link into `<data>/links/*.link`
+and starts FramePort unless `<data>/gui.alive` is < 10 s old (`gui.starting` stops double starts); the GUI's
+`_watch_links` thread touches the heartbeat and opens links (newest window session). Settings → Install links: one
+switch per scheme (`links.framedrop`, `links.frameport`, default on); a scheme another program owns (FrameDrop) is
+only taken with "Use FramePort for these links" (`register([s], force=True)`); off removes only FramePort's own
+registration (`MARK` in the command). Never registered with FRAMEPORT_HOME/FRAMEPORT_NO_LINK_HANDLER (tests,
+screenshots). Same round: files dropped on the Library (`ui/dropped.py`, bundles only like the Files tab), "Add a
+Windows program (.exe)…" (`pipeline.add_windows_exe`: exe in Downloads/home/drive root copied alone into
+`<data>/windows-apps/<slug>/`), patch `device.display_mode` (Automatic / VR / Flat window → `InstallContext.display`,
+`installer.show_window`). FramePort-only manifest extension `"frameport": {"description", "icon"}` (bad values ignored; icon: same URL rules,
+≤2 MiB, Pillow-checked, ≥32 px, saved as PNG in `<data>/downloads/icons/`, shown in the question by asset URL, then
+`sources.apply_custom(pkg, "icon")` unless `.picked` exists; description fills `details.description` only when
+empty). Bare file links get a title guessed from the file name (`title_from_filename`: version/arch dropped, package
+names → last part). Windows test of 0.12.1.dev191 (2026-10-07): a button click opened the dialog; but a click right
+after closing FramePort did nothing (the closed window's heartbeat was < 10 s old) → the handler scripts now wait
+up to 4 s for the link file to be taken before trusting the heartbeat, the window's CLOSE event / atexit delete
+`gui.alive`, and the Windows command runs under `conhost.exe --headless` (plain `-WindowStyle Hidden` flashed a
+console). Screens: `scripts/ui_smoke.py --links --fake-frame --game <pkg>` (tall pages: `--viewport
+1280x7000`; Flutter's popup menu ignores Escape).
+Demo link: the homepage's example button = `deeplink.DEMO_MANIFEST` (https://frameport.app/demo/cool-game.json, published
+from site/public/demo/); every form (https button page, frameport://, framedrop://, pasted) → `InstallRequest.demo`,
+no network (fetch_manifest returns `demo_manifest()`, download refuses), `link_dialog.show_demo` (Install =
+`easter.demo_install`: Cool Game's cover out of the portal; eggs off → "Nice, it works!"), CLI just says so.
 
 ## Releases, CI, GitHub
 Maintainer-only notes (accounts, credentials, key locations) live in the git-ignored `CLAUDE.local.md`.

artifacts/SHA256SUMS

@@ -1,6 +1,6 @@
 1a4dce5c4a6d0dfc5f20e55ac29e70c73cc2cc124c21ca6a7e1b316e6afb1c79  ./arm64-v8a/libVkLayer_fdm_darken.so
 5becb96ee86fbda0ce98c0e0fd064f8ba092314aceaa400e3dcc785705dc3c23  ./arm64-v8a/libVkLayer_fp_shaderfix.so
-222727ddabf7eaee08c92e86c64f02edc6639667e9041ab2629032b885c9ae3a  ./arm64-v8a/liba32bridge.so
+fbc3b0238462d976d234fee6740db92b873c85d6bb22a6b01428e64e9058ed83  ./arm64-v8a/liba32bridge.so
 c9c3da5cac224c38e2210b781bd12b7f97e02bd6b0ebb0ef85543e4ea4b76671  ./arm64-v8a/liba32rt.so
 18d8d917e83a6d87008f41908eb478dff635e798844e125abd1e8a5cf31805e2  ./arm64-v8a/liba32stub.so
 d6337034fb0bdcca7ef9b7063d85b7586b8508b63b435959e8fffaba0691091c  ./arm64-v8a/libfp_langpack.so
@@ -8,16 +8,16 @@ d6337034fb0bdcca7ef9b7063d85b7586b8508b63b435959e8fffaba0691091c  ./arm64-v8a/li
 321da502e0f8f46f0880aad39fe6b84bdef88f925164568814cf704a1b31a577  ./arm64-v8a/libfp_ovrp.so
 40defdaddcda53bd2649eb48076fae1622bfc2bfc88e9e03c94fc8b45af2a4f2  ./arm64-v8a/libfp_ovrtrace.so
 0167c2fde5dfde62897f9d85afc4fc8e97784e988b5b8df6cea8c407240b3424  ./arm64-v8a/libfp_tkeys.so
-468b97ee3c36481d939a87425b15880c7a801d16732350e1e2832b385d63f20a  ./arm64-v8a/libfp_vk.so
+e8c0965c188665a4e565e4a3af983ef1866d1cf9225665cc90d8df286bc96ef3  ./arm64-v8a/libfp_vk.so
 383054f8b3b41dde76d062c71856cd3163655e50009c08454bc1793f393ead65  ./arm64-v8a/libfpg.so
-4a13a33e112c9e4e3c5ff4337ed6e988a9e5b3602f48d654df148ef5fafbf426  ./arm64-v8a/libfpglmv.so
-36400eae4ba3807bcfcd54463daa217347032b07218792faa448d8cbbd086a0e  ./arm64-v8a/libframe_xrshim.so
+5432674a59d02f411cd853a5dc57e3fa547d1ac518f25bf433fc54c43677177a  ./arm64-v8a/libfpglmv.so
+8a8f6b1da8952cb3933a5b53558424a5fc56043b2527a16bb6dd62a00d2de01a  ./arm64-v8a/libframe_xrshim.so
 19ba5ed3c4b780f5ae46251f6958f552acfc5f13c8bb39f995579593fa8990c6  ./arm64-v8a/libglshim.so
-b1ec76d3c93862ef2e5dcffab44b4b45cdbd791df3c6870350a04be44a0e0137  ./arm64-v8a/libopenxr_loader_generic.so
+c9e286ff25984992954c1d80eb1fc3530643421d859d20c8c1fd07ce1d584372  ./arm64-v8a/libopenxr_loader_generic.so
 1feaeafad467c4cafdf2b018a4d84b0bee200c3f711697b4ce97e66a3ba256ca  ./arm64-v8a/libovrplatformcompat.so
 a4ed80ae45ca90758239f152ea5a2e8c127d491e1e697ea5680db6fd7f72db07  ./arm64-v8a/libvrapi.so
 a4ed80ae45ca90758239f152ea5a2e8c127d491e1e697ea5680db6fd7f72db07  ./arm64-v8a/libvrapi_foveation.so
-b35a45e3e4948352a5433553420848eb7a8837afbe114edb1e95979872e25426  ./armeabi-v7a/libopenxr_loader_generic.so
+ba2dc70263bc3cca82a313805c5b4890452b1f740570bc7b65320a825a4012d2  ./armeabi-v7a/libopenxr_loader_generic.so
 1871eae093432d277da4bc751bf5f3269dfcf11f9168260b0c3caadb0dedb19d  ./dex/oculusos-stubs.dex
 b634ab5640e258563c536e658cad87080553df6f34f62269a21d554844e58bfe  ./hevc/COPYING.FFmpeg
 141de01f0d40b97d4f9a720db5ab8ea442f6aa35db5272048899292884994a1c  ./hevc/libstagefrighthw.so
@@ -27,6 +27,25 @@ b634ab5640e258563c536e658cad87080553df6f34f62269a21d554844e58bfe  ./hevc/COPYING
 6cda3076a8c09b31bb1f90da614ea89e7ee194589626eeac613e522849604e47  ./licenses/LuaJIT.txt
 1aa733117cf57ccff7cf23f0425dbfd73b0332a3ef1c905ceeca0ccd0449c4e0  ./linux-arm64/XR_APILAYER_FRAMEPORT_timefix.json
 28c2430a02bbd8902c5bfb9562c6fd0e318654f9e05c095bfeb94b0450ab1b07  ./linux-arm64/libxr_frameport_timefix.so
+63af0050054ad3705b17a0b00ce0c076ba1af0b73abd673ba6c588f64b4591cd  ./linux-arm64-bin/fp_roomscan
 b10b3a5c10c3339fc63fd9f6cb4d01ea29be11a863d0ebad1389ea69fd471940  ./linux-arm64-bin/fp_venc
+00c2dead0fd7497929833467f0e55699d57d26be1b85dce35402993852f7b111  ./roomscan/ceiling.png
+c1962de31ed2810d31c760cf9ee63316ac2b8c9528ccbcd9299ebf5ba39b2995  ./roomscan/done.png
+0dfaea4c68979b0a45a9fef06fdf1a92468ffc8f46f80a3a014fce1d805972d5  ./roomscan/failed.png
+1147391822be3f1aa5351374b8fd9ec85f8b5ce40e3cb9f3146d778e6fbc652a  ./roomscan/floor.png
+eb3c8b55a9dbafa030797ca9f06a22c3ee3bbef96cb7adea26d433ebad43d43f  ./roomscan/look_00.png
+6ba965ff6d22a469c558f2a68229bd2ff48fc28badb95889ca245310d1dd3e96  ./roomscan/look_01.png
+0a11cec25ebc76fe11d505d1f2ec162c9b4a6754393065800e73b1f81e2d94c8  ./roomscan/look_02.png
+fa5a4c94d20af56797b9fcc111148767847a6633ade9217cab373de232efad90  ./roomscan/look_03.png
+e80fa493e380fba39084be2ee62859adcff4e39aa66566abee10a4d6339c52e9  ./roomscan/look_04.png
+133617f0d8d1e69c37408aac80033f71856b592b62e3b780cc12b446bd974680  ./roomscan/look_05.png
+d5dd296ff23641c6973c57ac139147e99c7b783316ab60537adb2155dd196880  ./roomscan/look_06.png
+c08570aa78f966ae937b2e21d0bad887c5352fbca56aa579a2a7ef8541fb96ad  ./roomscan/look_07.png
+3767e7db5fb6babc872fa62c42604f749c65936717d332101745b201cd450cd5  ./roomscan/look_08.png
+2924dc65e5c497545340209edc16060e12e1834d11af6871d1c1baa50b7b2562  ./roomscan/look_09.png
+cd0150dfc10b2aea39403c74eff72fd05fb0111178ef39b4c98657a6d16d105e  ./roomscan/look_10.png
+011355e412f73ade3896e9037490e607c4365d0cf8ceb807d236bf68b414d3ed  ./roomscan/look_11.png
+1b8b47ffb47568d540921f065b5958eeb44a6489498d58e0f33f5d1f535154e2  ./roomscan/look_12.png
+926c7bc6a103adee5b9bf938f5d4e39095ab77fd6270b5301be3b0428edd9ae6  ./roomscan/start.png
 c2c70f4af1a5c3e6089dff1130161dd417f8044f99ec639eeecf1083930aab16  ./win-x64/fp_oculushmd.exe
 60ebc5fea05b8945082e2ca8b9f2eb74616012a26eb50133af273dff0fcddc42  ./win-x64/fp_vrsettings.exe

catalog/games/ScaredBySquares.Game.yaml

@@ -1,19 +0,0 @@
-package: ScaredBySquares.Game
-title: Scared By Squares
-status: unknown
-notes: 'Showed black and dropped back to the home environment while the game kept running (sound only, GitHub 323).
-  Fixed in FramePort 1.2.1 and checked on the Frame without the headset (the game runs at 72 fps and SteamVR keeps it
-  as the running game); not yet confirmed in the headset. Rebuild and reinstall the game after updating FramePort.'
-details: 'The game (Unreal 4.27, OpenXR) creates two controller actions named "turn" (an action mapping and an axis
-  mapping called Turn). The Frame''s runtime accepts the duplicate, then fails to load the input manifest it builds
-  from the actions ("SetXrInputConfig failed. Failed to load manifest") and treats the game as closed. FrameBridge''s
-  action_dedup (on by default) creates the second one as "turn_2".'
-tested_version: '2'
-engine: Unreal
-xr: OpenXR
-frame:
-- frame.hw_video_decode
-- frame.unreal_skip_obb_check
-updated: '2026-10-16'
-min_app: 1.2.1
-source_hint: Scared By Squares

catalog/games/com.RealitiesIO.puzzlingPlaces.yaml

@@ -1,25 +0,0 @@
-package: com.RealitiesIO.puzzlingPlaces
-title: Puzzling Places
-status: issues
-notes: Works fine, but pointers dont show well on main menu, easy to work around.
-tested_version: '2.14'
-engine: Unreal
-xr: OpenXR
-overport_extra:
-- patch_disable_space_warp
-alt_overport:
-- patch_remove_unreal_force_quit
-frame:
-- frame.unreal_skip_obb_check
-- frame.unreal_ovrp_entrypoints
-- frame.hw_video_decode
-adapter:
-  equirect_emul: 1
-  haptic_fix: 1
-verified:
-  date: '2026-10-16'
-  known_good_sha256: 8d9bb64b0af4c34269fffb64c5ef7515d6ba4715f5234f95517975b8e2b56c00
-  app: 1.2.0
-  overport_cli: 1.2.5
-  issue: 359
-source_hint: Puzzling Places

catalog/games/com.SDI.TWD.yaml

@@ -1,22 +0,0 @@
-package: com.SDI.TWD
-title: 'The Walking Dead: Saints & Sinners'
-status: works
-tested_version: Shipping / 2024.01.19 / build 400355 - STAGECH1
-engine: Unreal
-xr: VrApi
-alt_overport:
-- patch_remove_unreal_force_quit
-frame:
-- frame.ovr_microphone
-- frame.hw_video_decode
-adapter:
-  haptic_fix: 1
-verified:
-  date: '2026-10-17'
-  known_good_sha256: 4b172a5abba0901c75278fb55b867f344120c658c26ae07c8558d90e0c38cec3
-  app: 1.2.0
-  overport_cli: 1.2.5
-  frame_build: '20261007.6125817'
-  agent: 91
-  issue: 376
-source_hint: The Walking Dead- Saints & Sinners

catalog/games/com.VertigoGames.The7thGuestVR.yaml

@@ -1,27 +0,0 @@
-package: com.VertigoGames.The7thGuestVR
-title: The 7th Guest VR
-status: issues
-notes: Runs and is playable. Foveated rendering (fixed and eye-tracked) sits offset toward the bottom right, and
-  changing the foveated region size has no visible effect.
-tested_version: 1.1.3.12072
-engine: Unreal
-xr: OpenXR
-alt_overport:
-- patch_remove_unreal_force_quit
-frame:
-- frame.unreal_skip_obb_check
-- frame.hw_video_decode
-adapter:
-  haptic_fix: 1
-  scale: 2.0
-foveation: fixed
-foveation_radius: 0.1
-verified:
-  date: '2026-10-16'
-  known_good_sha256: 11a1208888adedf4aa48a672b2af5535f0e8f11e5bb1ce0a28bafe5d272bb672
-  app: 1.2.0
-  overport_cli: 1.2.5
-  frame_build: '20261007.6125817'
-  agent: 91
-  issue: 363
-source_hint: Guest

catalog/games/com.fasttravelgames.lollipop.yaml

@@ -1,26 +0,0 @@
-package: com.fasttravelgames.lollipop
-title: 'Vampire: The Masquerade - Justice'
-status: issues
-notes: Game runs fine and playable, on loading there's a random sphere in the middle of the sceen. Also control
-  input images are missing so you get text like press <img>wmr.Rstick...
-tested_version: 1.00.1653
-engine: Unreal
-xr: OpenXR
-alt_overport:
-- patch_remove_unreal_force_quit
-frame:
-- frame.bhaptics_permission
-- frame.hw_video_decode
-adapter:
-  haptic_fix: 1
-  scale: 2.0
-foveation: tracked
-verified:
-  date: '2026-10-17'
-  known_good_sha256: 5669f8e9c52e4fa00a3bbce79d323c7f521e098b08dacaf330db0083c7993dee
-  app: 1.2.0
-  overport_cli: 1.2.5
-  frame_build: '20261007.6125817'
-  agent: 91
-  issue: 377
-source_hint: vampire

catalog/games/com.fgovr.quest.yaml

@@ -1,16 +0,0 @@
-package: com.fgovr.quest
-title: FGO VR
-status: issues
-notes: Audio stuttering and popping sounds
-tested_version: 0.2.0-fgo-resolution
-engine: Other
-xr: OpenXR
-adapter:
-  scale: 1.2
-verified:
-  date: '2026-10-17'
-  known_good_sha256: e26a0755297961e5131fe4bd404cbd956e18aef01bed71a79114805f6d805032
-  app: 1.2.1.dev433
-  overport_cli: 1.2.5
-  issue: 364
-source_hint: com.fgovr.quest

catalog/games/com.gritGames.Nope.yaml

@@ -5,8 +5,10 @@ source_hint: NOPE CHALLENGE
 engine: Unreal
 xr: OpenXR
 status: works
-notes: Meta XR Audio telemetry patch + nodebug. MR "Reality Breach" mode unavailable.
-details: The MR 'Reality Breach' mode needs passthrough; standard VR mode used.
+notes: "Meta XR Audio telemetry patch + nodebug. MR mode: needs a scanned room."
+details: The MR 'Reality Breach' mode needs passthrough and a room; standard VR mode was verified.
+adapter:
+  scene_emul: 1
 alt_overport:
 - patch_remove_unreal_force_quit
 frame:

catalog/games/com.ilmxlab.tales.yaml

@@ -4,8 +4,6 @@ status: works
 notes: >-
   Headset tested for GitHub issue 61: full view, loading into gameplay, both eyes, controller input and sound
   work with the splash bypass and multiview depth-size fix. Keep the main OBB and all three content/sound-bank PAKs.
-  GitHub issue 369 (headset, Lepton 3.0.5): the GPU hang at a later loading screen is fixed by zink_shader_fix;
-  played ~28 min at 72 fps.
 details: Unreal Engine 4 (GLES) by ILMxLAB, like Vader Immortal, but a different engine build - it has none of Vader's
   Quest-only branches (no GetQuestShaderPrecompilePercent or RPOC key map; it precompiles shaders through Unreal's
   own pipeline cache), so frame.unreal_quest_precompile/_keymap don't apply. Its seasons and Wwise banks are Meta
@@ -19,10 +17,6 @@ details: Unreal Engine 4 (GLES) by ILMxLAB, like Vader Immortal, but a different
   frame.unreal_multiview_depth refreshes both cached dimensions from the current eye render size; multiview and
   multisampling remain enabled. The two engine fixes check exported symbols, function sizes and instruction bytes
   before changing one instruction each; unrecognized engine builds are left unchanged.
-  A fragment shader (module 16800_8dbab031..., as Zink compiles it) reads 12 int loop counters/accumulators before
-  setting them and hangs the GPU (kernel hangcheck) at a loading screen, the same bug as Vader Immortal's lightspeed
-  shaders; the Vulkan layer under Zink inserts stores of 0 (frame.zink_shader_fix, zink_shader_fix). Captured with
-  Lepton 3.0.5, so a Frame update that changes Zink's output stops it matching (the layer logs that).
 tested_version: 1.1.9+734762.cl.439699
 engine: Unreal
 xr: VrApi
@@ -33,12 +27,10 @@ frame:
 - frame.unreal_thumb_touch
 - frame.unreal_splash_bypass
 - frame.unreal_multiview_depth
-- frame.zink_shader_fix
 adapter:
   pose_time_fix: 1
-  zink_shader_fix: 16800:8dbab031be7975e23452e333fe63afe44d5c8f4fd2b096aa21ed300426747757:4008:0x0003003e,219,102,0x0003003e,229,102,0x0003003e,235,102,0x0003003e,241,102,0x0003003e,302,102,0x0003003e,312,102,0x0003003e,318,102,0x0003003e,324,102,0x0003003e,369,102,0x0003003e,379,102,0x0003003e,385,102,0x0003003e,391,102
 verified:
-  issue: 369
-updated: '2026-10-17'
+  issue: 61
+updated: '2026-10-12'
 min_app: 1.0.4
 source_hint: Star Wars- Tales from the Galaxys Edge

catalog/games/com.orbusvr.OrbusVRCommunity.yaml

@@ -1,26 +0,0 @@
-package: com.orbusvr.OrbusVRCommunity
-title: OrbusVR
-status: works
-tested_version: '31.01'
-engine: Unity
-xr: VrApi
-frame:
-- frame.unity_oculus_check
-- frame.unity_text_input
-- frame.unity_runtime_msaa_off
-- frame.hw_video_decode
-- frame.unity_gl_shim
-device:
-- device.text_input_window
-adapter:
-  haptic_fix: 1
-  pose_time_fix: 1
-verified:
-  date: '2026-10-16'
-  known_good_sha256: fe569ffe52ca73f2384162ce80769f05f7cf177edbf26d8e429ca0e9b4aa27e8
-  app: 1.2.0
-  overport_cli: 1.2.5
-  frame_build: '20261015.6141207'
-  agent: 91
-  issue: 378
-source_hint: OrbusVR

catalog/games/com.schellgames.ieytd2.yaml

@@ -1,27 +0,0 @@
-package: com.schellgames.ieytd2
-title: I Expect You To Die 2
-status: works
-notes: loaded up and played 5 minutes looks fine.
-tested_version: 1.0.1.171177 (ReleaseCandidate_1.0.1_QuestStore)
-engine: Unity
-xr: VrApi
-frame:
-- frame.unity_no_msaa
-- frame.unity_oculus_check
-- frame.unity_text_input
-- frame.unity_runtime_msaa_off
-- frame.unity_gl_shim
-device:
-- device.text_input_window
-adapter:
-  haptic_fix: 1
-  scale: 2.0
-verified:
-  date: '2026-10-16'
-  known_good_sha256: fc626ec62e49e19210a188d90f94c370e956d0de729cbd04cbe8866430d77730
-  app: 1.2.0
-  overport_cli: 1.2.5
-  frame_build: '20261015.6141207'
-  agent: 91
-  issue: 358
-source_hint: Expect

catalog/games/com.zenstudios.PFXVRQuest.yaml

@@ -1,13 +1,14 @@
 package: com.zenstudios.PFXVRQuest
 title: Pinball FX VR
 status: issues
-notes: Plays; mixed reality mode not working yet. Space warp off (fewer stutters).
+notes: "Plays; space warp off (fewer stutters). MR mode: needs a scanned room."
 tested_version: '1.9'
 engine: Unreal
 xr: OpenXR
 alt_overport:
 - patch_remove_unreal_force_quit
 adapter:
+  scene_emul: 1
   equirect_emul: 1
   hide_space_warp: 1
 verified:

catalog/games/org.godotengine.endoparasitic_vr.yaml

@@ -1,19 +0,0 @@
-package: org.godotengine.endoparasitic_vr
-title: EndoparasiticVR
-status: works
-tested_version: '1.3'
-engine: Other
-xr: OpenXR
-frame:
-- frame.godot_clipboard
-adapter:
-  equirect_emul: 1
-verified:
-  date: '2026-10-17'
-  known_good_sha256: 89ed0e940c0285b1284a22d8eb5b35966dda79dd57a602c475be3cf1b758fa35
-  app: 1.2.0
-  overport_cli: 1.2.5
-  frame_build: '20261007.6125817'
-  agent: 91
-  issue: 375
-source_hint: Endoparasitic

catalog/triage.yaml

@@ -6,6 +6,16 @@
 # with diagnostics. Launch tests and real play sessions (agent session_log, `frameport session`) are both matched.
 # Sources: every failure we hit porting 34 games to the Steam Frame (see docs/PLAYBOOK.md).
 signatures:
+  - id: mr-no-room
+    pattern: 'FrameBridge[^\r\n]*scene: (?:capture requested -> (?:guardian box|using guardian room)|room from guardian|room [^\r\n]*(?:from guardian|configured/default size|box))'
+    severity: info
+    diagnosis: 'The game is using a simple fallback room. Scan your room for mixed reality, or use Frame > Room > Use my play area for walls without furniture. A recorded scan can be imported until headset capture is available.'
+    suggest: []
+  - id: mr-discovery-unsupported
+    pattern: '(?:Unknown proc addr:\s*xrDiscoverSpacesMETA|(?:MRUK[^\r\n]*)?NoRoomsFound)'
+    severity: warning
+    diagnosis: 'The game cannot discover a Meta room. Enable room layout (adapter.scene_emul), rebuild and reinstall for the updated extension shim, then save a room under Frame > Room.'
+    suggest: [adapter.scene_emul]
   - id: meta-asset-status-error
     pattern: 'Asset status error\s+\(code 100\)'
     severity: error
@@ -21,27 +31,6 @@ signatures:
       which the Frame doesn't have; games that depend on it (often online games) quit or stay offline. FramePort
       doesn't get around such checks.
     suggest: []
-  - id: meta-request-failed
-    # Unity's Oculus.Platform wrapper logs this when a Meta platform call gets no usable answer: OVRPort's platform
-    # library answers some calls without Meta's services (request id 0), so the game's callback never runs and it
-    # can wait forever (e.g. Thief Simulator, Eleven, Spectre; GitHub #346, #360, #368).
-    pattern: 'An unknown error occurred\. Request failed\.[\s\S]{0,400}?Oculus\.Platform\.Request'
-    severity: warning
-    diagnosis: A Meta platform request made by the game failed (it needs Meta's online services, which the Frame
-      doesn't have). If the game then stays on a loading screen or doesn't go on, it is waiting for that answer;
-      some games have a per-game fix that skips the call. A problem report with diagnostics shows which call it is.
-    suggest: []
-    report: true
-  - id: meta-system-activities
-    # The game ships its own (renamed) copy of Meta's platform loader instead of going through OVRPort's, which
-    # tries to open Meta's system activities (Horizon OS) and aborts when Android can't start them (Breachers, #357).
-    pattern: 'DisplayErrorAndExit: Failed to launch SystemActivities'
-    severity: fatal
-    diagnosis: The game's own Meta platform library tried to open Meta's system screens (Horizon OS), which the
-      Frame doesn't have, and quit on purpose. Games built this way are usually online games that depend on Meta's
-      services; FramePort can't provide those.
-    suggest: []
-    supersedes: [native-crash]
   - id: lua-lightuserdata-pointer
     pattern: 'bad light userdata pointer'
     severity: fatal
@@ -82,13 +71,6 @@ signatures:
     severity: fatal
     diagnosis: 32-bit-only APK (e.g. a Gear VR or Oculus Go game). The Steam Frame has no 32-bit ARM support; FramePort's 32-bit bridge translates the game (experimental).
     suggest: [frame.a32_bridge]
-  - id: a32-jit-overflow
-    pattern: 'a32: block at 0x[0-9a-f]+ overflowed the code buffer'
-    severity: fatal
-    diagnosis: The 32-bit bridge's translator stopped the game on a long run of instructions it hands to its
-      interpreter, for example OpenSSL's ARMv8 SHA-1 code in Pinball FX2 VR. Fixed in newer FramePort versions;
-      update FramePort and rebuild the game ("Update on Frame").
-    suggest: [frame.a32_bridge]
   - id: android-too-new
     pattern: '(NoClassDefFoundError|ClassNotFoundException|NoSuchMethodError)\b.*(Landroid/window/|android\.window\.|(storeStoreFence|loadLoadFence)\(\)V in class Ljava/lang/invoke/VarHandle)'
     severity: fatal
@@ -99,13 +81,6 @@ signatures:
     severity: fatal
     diagnosis: This app is a website, not a game, and it can't open on the Frame. It is a Trusted Web Activity that opens Meta's browser (com.oculus.browser), which the Frame doesn't have; open the website (TWALauncherActivity's "Using URL" line) in a browser instead.
     suggest: []
-  - id: gvr-not-supported
-    # GitHub #335 (Blade Runner: Revelations, Daydream, Unity 2017.4): Unity's "Google VR Error [Daydream]", the GVR
-    # library's Java side missing on the 32-bit bridge, or a bind to Daydream's VrCore service
-    pattern: 'Google VR Error \[(Daydream|Cardboard)\]|Google VR had a fatal issue while loading|class com/google/vr/sdk/base/CardboardViewNativeImpl not found|act=com\.google\.vr\.vrcore\.\S+ pkg=com\.google\.vr\.vrcore'
-    severity: fatal
-    diagnosis: This is a Google Daydream / Cardboard VR build (Google VR SDK), and its VR can't reach the Frame's headset. Daydream needs Google's VR services (VrCore) and Cardboard draws for a phone in a viewer; FramePort has no translation for either, so the game runs as a flat window at best, usually without working controls. An Oculus build of the same game (Meta Quest, Oculus Go or Gear VR) goes through FramePort's normal path.
-    suggest: []
   - id: unity-render-crash
     pattern: 'CRASH\s*:.*#\d+\s+pc [0-9a-f]+\s+\S*libgallium_dri\.so'
     severity: fatal
@@ -142,17 +117,12 @@ signatures:
   - id: swapchain-rect-invalid
     pattern: 'xrEndFrame failed -25\b'
     severity: fatal
-    diagnosis: The runtime rejects the game's frames, so it stops drawing (for example stuck at a "Waiting" box). An image rect reaches a few pixels past its swapchain on some Frames (FrameBridge from FramePort 0.11.0 clamps the rects), or is empty (0x0, for example BattleTalent's first frames right after Unity switches its MSAA level; a newer FrameBridge shows the whole swapchain image instead), so rebuild and reinstall the game.
+    diagnosis: The runtime rejects the game's frames, so it stops drawing (for example stuck at a "Waiting" box). An image rect reaches a few pixels past its swapchain on some Frames; FrameBridge from FramePort 0.11.0 clamps the rects, so rebuild and reinstall the game.
     suggest: [frame.adapter]
   - id: cylinder-menu-layers-rejected
     pattern: 'xrEndFrame failed -16\b'
-    severity: info
-    # PreyVR (GitHub #306): one rejected frame at the start of every session (its space isn't locatable yet); the black
-    # menu there had another cause (a 0 Hz refresh rate stopped the game clock), so this alone is no error
-    diagnosis: The runtime rejected a frame's layers once (XR_ERROR_LAYER_INVALID). At the start of a session that is
-      harmless. If it repeats every frame the picture stays black; FrameBridge shows a curved (cylinder) screen drawn
-      to each eye separately (for example the Doom3Quest / PreyVR menu) as one set of flat strips for both eyes to stay
-      within the runtime's layer limit, so rebuild and reinstall the game with the current FrameBridge.
+    severity: error
+    diagnosis: The game draws a curved (cylinder) screen to each eye separately (for example the Doom3Quest / PreyVR menu). The Frame's runtime has no cylinder layers, so FrameBridge shows each as flat quad strips; a per-eye pair makes too many quad layers for one frame and the runtime rejects the whole frame (XR_ERROR_LAYER_INVALID), leaving the menu black while the game runs. FrameBridge from this build shows the left eye's strips to both eyes to halve the count; rebuild and reinstall the game to try it.
     suggest: [frame.adapter]
   - id: missing-ovr-symbol
     pattern: '(UnsatisfiedLinkError|cannot locate symbol) .*"?(ovr_[A-Za-z0-9_]+|ovr[A-Z][A-Za-z0-9]*_ToString)'
@@ -213,8 +183,7 @@ signatures:
     suggest: [adapter.vk_shader_dump, adapter.zink_shader_dump]
     report: true
   - id: space-warp-used
-    # space warp's motion vectors (97 = R16G16B16A16_SFLOAT); its depth (129) is also what eye depth layers use (#323)
-    pattern: 'xrCreateSwapchain \d+x\d+ format=97 '
+    pattern: 'xrCreateSwapchain \d+x\d+ format=(97|129) '
     unless: 'per-game: hide_space_warp=1'
     severity: info
     diagnosis: The game uses Meta's space warp (it renders half of its frames plus motion vectors, and the runtime makes
@@ -222,13 +191,6 @@ signatures:
       Metro Awakening). Turning it off makes the game render every frame itself.
     question: Did textures flicker, jump or smear while you moved?
     suggest: [adapter.hide_space_warp]
-  - id: duplicate-action-renamed
-    pattern: 'action_dedup: action .* already exists in its set'
-    severity: info
-    diagnosis: The game creates two controller actions with the same name (for example an Unreal action and axis both
-      called Turn). The Frame's runtime then can't load the game's controller setup and drops the game back to the home
-      environment while it keeps running. FramePort renamed the second one, so this is handled.
-    suggest: []
   - id: unity-runtime-msaa
     pattern: 'recommended MSAA level is [248]\. Switching to the recommended level'
     severity: info
@@ -291,16 +253,6 @@ signatures:
     severity: error
     diagnosis: The screen stays black because the game submits a layer the VrApi bridge can't show. Whole frames with that VrApi layer type are dropped.
     suggest: []
-  - id: unreal-reserve-refused
-    # GitHub #349: Unreal's out-of-memory handler dereferences its not yet created log while libUnreal.so's static
-    # constructors run (System.loadLibrary), after the Binned3 allocator's up-front reservation failed
-    pattern: '(?s)fault addr 0x10\b(?:(?!Fatal signal).){0,8000}?#00 pc [0-9a-f]+\s+\S*lib(?:Unreal|UE4)\.so(?:(?!Fatal signal).){0,8000}?soinfo17call_constructors'
-    severity: fatal
-    diagnosis: The game crashed while Unreal was still loading, before its first frame. Its memory allocator (Binned3)
-      reserves tens of gigabytes of address space at once, which Quest allows and the Frame's kernel refuses in one
-      piece (for example Transformers Beyond Reality). Rebuild with the reservation marked as not committed.
-    suggest: [frame.unreal_noreserve]
-    supersedes: [native-crash]
   - id: graphics-requirements-missing
     pattern: '(XR_ERROR_GRAPHICS_REQUIREMENTS_CALL_MISSING|Failed to create XR session: -50\b|xrCreateSession[^\n]*-50\b)'
     severity: fatal
@@ -377,13 +329,6 @@ signatures:
     diagnosis: 'The Frame''s Vulkan driver crashed on a call from Unreal. Unreal 5 passes things Quest''s driver ignores: a depth resolve in a subpass without a depth attachment (handled by the Vulkan shim), and image barriers and views for a missing image when it expects fragment density maps (foveation) from the headset (for example Metro Awakening).'
     suggest: [frame.vk_sanitize, adapter.vk_spec_fixes, adapter.vk_hide_fdm]
     supersedes: [native-crash]
-  - id: quest-foveation-image-missing
-    pattern: 'foveationImage = 0x0, width = 0, height = 0'
-    unless: 'hide_fb_foveation: filtering dispatcher extensions'
-    severity: info
-    question: Did the Vulkan game stop on its first frames?
-    diagnosis: OVRPlugin enabled Quest Vulkan foveation but received no density image. For a first-frame failure, compare with Quest foveation suppressed. This message alone does not prove the crash cause; a null Unreal graphics pipeline can also follow an earlier fatal error.
-    suggest: [adapter.hide_fb_foveation]
   - id: unreal-fdm-missing
     pattern: 'vk shim: left out \d+ image barrier\(s\) without an image \(first: layout \d+ -> 1000218000'
     unless: 'vk shim: fragment density map extensions hidden'
@@ -412,13 +357,6 @@ signatures:
     diagnosis: The game crashed creating a very large image (over 4096 px, for example in video players). OVRPort's OpenXR dispatcher aborts on such swapchains.
     suggest: [frame.swapchain_limit]
     supersedes: [native-crash]
-  - id: cortopia-org-id-wait
-    # Meta's C# wrapper logs this when the native call returned request id 0 (no callback ever follows); Cortopia's
-    # start-up awaits it forever (GitHub #360)
-    pattern: 'An unknown error occurred\. Request failed\.[\s\S]{0,600}?Cortopia\.Scripts\.Platform\.Meta'
-    severity: error
-    diagnosis: The game waits forever on its loading screen for an answer from Meta's platform (an org-scoped user id, used as its analytics id) that OVRPort's platform library doesn't give. The patch makes the game skip that one request, as it does without Wi-Fi.
-    suggest: [frame.cortopia_org_id]
   - id: ovr-microphone-crash
     pattern: 'ovr_Microphone_GetOutputBufferMaxSize\+'
     severity: fatal
@@ -432,22 +370,10 @@ signatures:
     suggest: [frame.slz_vulkan_hooks]
     supersedes: [java-crash, native-crash]
   - id: vivox-api31
-    pattern: 'NoSuchMethodError: No virtual method \w*CommunicationDevice\w*\(.*Landroid/media/AudioManager[^\n]*(?:\n[^\n]*\sat [^\n]*){0,12}?\n[^\n]*\sat com\.vivox\.'
+    pattern: 'NoSuchMethodError: No virtual method \w*CommunicationDevice\w*\(.*Landroid/media/AudioManager'
     severity: fatal
     diagnosis: The game's Vivox voice-chat SDK calls Android 12 audio-routing methods (AudioManager communication devices) without checking the Android version; Lepton runs Android 11, so the app crashes (for example Green Hell VR). The patch makes Vivox's audio-route check return early (voice chat keeps the default route).
     suggest: [frame.vivox_audio_route]
-    supersedes: [java-crash, audio-api31]
-  - id: photon-voice-api31
-    pattern: 'NoSuchMethodError: No virtual method \w*CommunicationDevice\w*\(.*Landroid/media/AudioManager[^\n]*(?:\n[^\n]*\sat [^\n]*){0,12}?\n[^\n]*\sat com\.exitgames\.photon\.'
-    severity: fatal
-    diagnosis: The game's Photon Voice microphone plugin calls Android 12 audio-routing methods (AudioManager communication devices) without checking the Android version; Lepton runs Android 11, so the app crashes when voice chat starts (for example Table Troopers at the tutorial). The patch makes Photon's audio-device pick return early (the microphone keeps the default route).
-    suggest: [frame.photon_voice_audio_route]
-    supersedes: [java-crash, audio-api31]
-  - id: audio-api31
-    pattern: 'NoSuchMethodError: No virtual method \w*CommunicationDevice\w*\(.*Landroid/media/AudioManager'
-    severity: fatal
-    diagnosis: Code in the game (often a voice-chat SDK) calls Android 12 audio-routing methods (AudioManager communication devices) without checking the Android version; Lepton runs Android 11, so the app crashes. FramePort has fixes for Vivox and Photon Voice; this one comes from another library, so please report it with the log.
-    report: true
     supersedes: [java-crash]
   - id: lepton-data-link-failed
     pattern: "ln: cannot create symbolic link from '[^']*' to '/data/data/|Couldn't create directory for SharedPreferences file /data/user/0/"
@@ -455,24 +381,6 @@ signatures:
     diagnosis: The game has no internal storage (saves, settings) inside Lepton. Usually its folder's path has a space (a microSD card named for example "Steam Frame 512g"), which Lepton's own scripts can't handle; FramePort's launcher (agent 83 and newer) gives Lepton a path without spaces. Connect FramePort once so the launcher is updated, then start the game again.
     report: true
     supersedes: [java-crash, native-crash]
-  - id: gms-android12-call
-    pattern: 'No virtual method permitUnsafeIntentLaunch\(\)'
-    severity: fatal
-    diagnosis: Google Play services' code in the game called an Android 12 method (the game was built for Android 12 and newer, so its version checks were built in as "always true") and Lepton runs Android 11; the game crashes on its GoogleApiHandler thread at start (for example Titan Isles). The patch makes those checks answer "no" again; Play services themselves aren't on the Frame, so sign-in and other Google features stay off.
-    suggest: [frame.gms_platform_version]
-    supersedes: [java-crash]
-  - id: usb-midi-watcher
-    pattern: 'UsbManager\.getDeviceList\(\)'' on a null object reference|at jp\.kshoji\.driver\.midi\.device\.MidiDeviceConnectionWatcher\$MidiDeviceConnectionWatchThread\.checkConnectedDevices'
-    severity: fatal
-    diagnosis: The app's USB MIDI driver (kshoji's, used by Unity MIDI plugins, for example PianoVision) asked Android's USB service for MIDI devices; the Frame's Android has no USB service, so the app crashed. The patch stops that poll; USB MIDI devices can't reach the app on the Frame anyway.
-    suggest: [frame.usb_midi_watcher]
-    supersedes: [java-crash]
-  - id: unity-appui-vibrator
-    pattern: 'NoClassDefFoundError: Failed resolution of: Landroid/os/VibratorManager;'
-    severity: fatal
-    diagnosis: The game's start activity uses Android 12's VibratorManager (Unity's App UI package, for example PianoVision) and Lepton runs Android 11, so it quits before the game starts. The patch starts the activity without a vibrator; its UI haptic feedback then does nothing.
-    suggest: [frame.unity_appui_vibrator]
-    supersedes: [java-crash]
   - id: bhaptics-permission-prompt
     pattern: 'GrantPermissionsActivity: Permission grant result .*permission=android\.permission\.BLUETOOTH_CONNECT'
     severity: error

docs/DEVICE_NOTES.md

@@ -1,641 +0,0 @@
-# Device notes
-
-Detailed device findings per game and issue, moved verbatim from CLAUDE.md (which keeps a one-line pointer
-with the key fact and the patch/setting names for each). Read the matching section before debugging a game;
-general runtime facts are in docs/FRAME_RUNTIME.md and symptom → fix rows in docs/PLAYBOOK.md.
-
-## a32 bridge: games, lessons, debugging aids, profiling
-
-Learned: Unity 2019 contexts
-have no EGLConfig (EGL_KHR_no_config_context: the VrApi bridge takes the window's or an RGBA8 ES3 config); Unity's
-floor origin = vrapi_SetTrackingSpace(1) (the VrApi bridge now honours LOCAL_FLOOR/STAGE); mapped GL buffers are
-per buffer object (a per-target guest copy leaked ~10 MB/s and garbled vertices); the guest runtime's own scudo
-names its maps `[anon:scudo:*]` below 4 GiB (watch them for guest leaks). The Go controller = the right Frame
-controller (stick = touchpad touch, sideways > 0.6 or press = click). Gunjack (CCP, UE 4.10 NativeActivity, Gear VR,
-2026-10-10): needed the native_app_glue imports (ALooper/AInputQueue/AConfiguration/AAsset*, imports.txt), an arm64
-libvrapi.so for Java's System.loadLibrary("vrapi") and MOUNTED under OVP_HEADLESS_TEST; it then loads its map and
-quit on purpose: AndroidMain compares AndroidThunkCpp_GetSignature() with an obfuscated copy. **Works since
-2026-10-11 (owner-verified in the headset):** GameActivity.AndroidThunkJava_GetSignature() = Base64.DEFAULT(SHA-1(
-signing certificate DER)) (jadx); `a32_bridge.original_signature` computes it from the original APK's
-META-INF/*.RSA|DSA|EC, `convert()` stores it as `assets/fp_a32_signature.txt` for libUE4.so games, the bridge loads
-it at activity creation (native_activity.c) and jni.c answers Call*Method on the method ID of
-`AndroidThunkJava_GetSignature()Ljava/lang/String;` with it. After loading, Unreal leaves VR mode and enters it again on
-the same GL context; a second OpenXR session there aborted in vrclient (CSharedSemaphoreLinux::WaitFromGPU from the GL
-binding's PreBeginFrame, also with OVP_HEADLESS_TEST) → the VrApi bridge keeps a running GLES session across
-LeaveVrMode and reuses it for an EnterVrMode with the same context (upstream-patches/runtime.cpp.patch).
-Debugging aids added: A32_BREAK=<guest addr>[,..] (stack of the first hits; guest libs load at fixed addresses, e.g.
-libUE4 0xf25d5000), A32_STRACE in bridge mode = path/exit calls to logcat, activity lifecycle + LeaveVrMode caller
-logs. Lepton's logcat mirror often dies for these games: read `podman exec <container> logcat` instead. Gunjack input
-(2026-10-11): it imports no vrapi input functions and reads the Gear VR touchpad/back as AInputEvents from its
-AInputQueue (native_app_glue), so dispatchKeyEvent never reached it (no control at all) → input.c queues synthetic
-events there (ALooper_poll* return the queue's ident while one waits; AInputQueue_getEvent/finishEvent and the
-AInputEvent/AKeyEvent/AMotionEvent getters are hand-written "!" imports that know them; touch positions scaled to the
-window size). Same mapping as AFFECTED: trigger = hold touchpad, A = tap, right stick = swipe, B = back; for NativeActivity games the stick's up/down = swipe forward/back (touchpad X: Gunjack's OnFlick = reload at ~0°, special weapon at ~180°). Not yet
-headset-verified. Quest builds on the bridge (2026-10-13, Sports Scramble = a 32-bit Santa Cruz build,
-UE 4.21 + OVRPlugin on VrApi 1.21): manifest requires `android.hardware.vr.headtracking` version 1
-(`detect.requires_6dof`, headset "quest", ANALYSIS_VERSION 16) → convert writes `assets/fp_a32_headset.txt`
-= "quest" → vrapi.c `quest_touch` (read in vrapi_Initialize via the activity's AssetManager; A32_TOUCH=1/0
-overrides) passes the 64-bit bridge's Touch controllers through (enumerate/caps/state/tracking/haptics, struct
-tails per VrApi minor) and starts no synthetic input. It also needed AAsset_getBuffer (guest copy, freed in
-AAsset_close), AKeyEvent_getFlags and the other AConfiguration getters. Headset (owner, 2026-10-13): plays,
-both controllers work. Recenter (holding the Frame's menu button) turned VrApi games ~90-120 degrees aside: the bridge's app space is LOCAL + the start yaw and the runtime moves LOCAL to the head → the bridge now takes the origin from the head again on XR_TYPE_EVENT_DATA_REFERENCE_SPACE_CHANGE_PENDING (LOCAL) and on vrapi_RecenterPose (owner-verified with Gunjack, 2026-10-13). Next: the other 32-bit catalog games (Journey of the Gods, Shadow Point: still "unsupported" until
-tested), translator speed. Profiled on the Frame
-(2026-10-12, `A32_PERFMAP` + perf): FPCR switches are negligible (8 of 86k samples); the cost was the run loop
-(a mutex + hash-chain walk on every dispatch, a contended counter, inline-lookup slots never refilled: Gunjack
-~45 % of its CPU) and `jit_invalidate` scanning every block on each Mono `cacheflush` (72 % of Spunky Dungeon's
-main thread). Now lock-free lookups, ltab refill, per-thread flags, per-page block lists: Gunjack's dispatcher
-23.6 % -> 1.6 %, CPU in the same phase about -55 %, still 72 fps.
-
-## Upload speed
-
-**Upload speed (measured 2026-09-29):** via the home router (PC Wi-Fi → router → Frame wlan0) only 15-18 MB/s, the
-same for paramiko, OpenSSH and 4 parallel streams, so the network path is the limit, not the SSH code. Direct to the
-Frame's hotspot (`wlanap` 10.35.78.1; the owner's PC has Valve's USB Wi-Fi dongle on it) 83 MB/s OpenSSH / 97 MB/s
-paramiko; reading dumps from D: via WSL drvfs is then the cap (~82 MB/s). `Frame.fast_link()` (installer
-`transfer_link`, uploads ≥64 MiB) uses usb0 > wlanap when reachable **and** the host key matches the paired Frame.
-
-## Revive under Proton arm64 (Lone Echo)
-
-**Revive under Proton arm64 (Lone Echo, 2026-09-29):** Revive's Detours hooks (LoadLibraryW/ExW, OpenEventW, the
-signature check) don't take effect: Wine's kernelbase is ARM64EC. The LibOVR shim in the game then does a plain
-`LoadLibrary("LibOVRRT64_1.dll")` search (exe dir, cwd, system32, windows, PATH — no registry, `OculusBase` or
-`LIBOVR_DLL_DIR` used by this build) → `Failed to initialize Oculus API (-3001)` (= Lies Beneath's "Unable to load
-LibOVRRT DLL"). A symlink `pfx/drive_c/windows/system32/LibOVRRT64_1.dll -> <base>/revive/LibReviveXR64.dll` (Wine
-maps a symlink to the already-loaded module) gets past it to **-3021 = ovrError_LibSignCheck**: the shim only accepts
-an Oculus-signed runtime. Next step (not done): make the runtime check pass without Detours, e.g. an injected helper
-that patches the game's import table (IAT) for LoadLibrary*/WinVerifyTrust, or a prefix-level override. This is
-runtime interop (what Revive does), not the Platform SDK licence check (which FramePort never touches).
-Uninstall (Quest, saves kept) used to leave `deployment.json` → still "installed"; fixed (agent v16).
-
-
-## OVRPort 1.2.5
-
-**OVRPort 1.2.5 (2026-10-01, the fork's first release; CLI-only):** same commands (`patches [--json]`, `patch`, `help`,
-`install`), but `patch` rejects unknown/duplicate args, unknown patch ids and an empty `--patches=`
-(`tools/overport.patch` refuses empty lists). After patching it adds `libovrplatformcompat.so` itself when the platform
-loader lacks `ovrMessageType_ToString` (our `frame.ovrplatformcompat` then skips: same library). New patches (all off;
-`patches/overport.py`): `patch_ac_nexus_no_appsw_72/_90` (AC Nexus build 207706 only, exclusive),
-`patch_disable_meta_xr_audio_telemetry` (x86_64 emulators: hidden), `patch_vrapi_openxr` = OVRPort's VrApi adapter =
-the **unpatched** upstream of our `frame.vrapi_bridge` (`native/vrapi` unchanged since our 5e7df52), only usable with an
-experimental CLI built with `-PwithVrApi=true` (stable jars list it but fail). The owner prefers OVRPort's fixes over
-ours where they work as well (less to maintain): compare in the headset before switching a default.
-`frameport install <pkg> --apk <file>` installs a specific (test) build signed with the game's key.
-Headset results (2026-10-02, `PATCHED/_test-ovrport-1.2.5/TESTING.md`): OVRPort's own VrApi translator fails on the
-Frame (Climb 2: requests VkFormat 37 → crash; POTW: no GLES path, missing `vrapi_GetTextureSwapChainHandle`) → keep
-`frame.vrapi_bridge`; those two changes are upstream candidates. 1.2.5 builds (its platform compat, new permissions)
-work. AC Nexus: `patch_ac_nexus_no_appsw_90` is the catalog default (owner preferred 90 Hz); `STRICT` patches are only
-taken from a catalog recipe where `applies()` holds (the AC Nexus ones need build MAIN.450412.207706.final, else the
-whole overport run fails).
-
-
-## Steam Frame controller models
-
-**Steam Frame controller models (2026-09-30, not yet seen in a game):** adapter setting `controller_models`
-(`native/adapter/render_model.c`) emulates XR_FB_render_model and serves `files/framebridge/controller_{left,right}.glb`;
-agent v20 (`install_controller_models`, command `controller_models`) converts the Frame's SteamVR render models
-(folder name matching "frame" + left/right, OBJ+PNG, `openxr_grip` component → grip space) at finalize/set_settings.
-Valve's models are never committed or copied off the Frame. Only games that use Meta's runtime controller models
-benefit (manifest `RENDER_MODEL` permission/feature → suggested); **none of the 34 catalog games do** (they ship their
-own meshes: that would need per-game asset replacement). Model discovery and conversion
-checked on the device 2026-09-30: `/opt/steamvr/drivers/frame_controller/resources/rendermodels/frame_controller_{left,right}`
-(component OBJs in model space = the whole `<name>.obj`, one `_color.png` 2048² near-black, `openxr_grip` rotates about
-X only; hidden-by-default components like `status` are skipped) → ~2 MB glb each, ~1 s. Not yet seen in a game (none
-of the installed builds has the new adapter, and none requests runtime models), so whether Meta's SDK attaches runtime models at the grip pose is unverified.
-
-## Crash backtraces, Fossilize, swapchain limit, cylinder and equirect layers
-
-**Crash backtraces (2026-09-30):** Lepton writes tombstones only to `lepton-logcats/steamlaunch-<appid>/logcat-crash.log` (after "Dumping logcat"), not launch.log; agent v23 launch tests wait for it and return `crash_log`, triage gets it via `triage(..., crash=)` (not pid-filtered: tombstones come from crash_dump's pid). The guest is `userdebug` (`ro.debuggable=1`), so Lepton's Fossilize layer loads into every app whatever the APK's debuggable flag; it has no off switch. Fossilize crashed Deadpool VR on uninitialized attachment-reference pNexts (several, in FVulkanRenderPass and the render-target layout) → `frame.vk_sanitize` = `native/vkshim` (engine's `dlopen("libvulkan.so")` string → `libfp_vk.so`, wraps vkCreateRenderPass2/KHR, drops unreadable/wrong-sType pNexts; verified: game runs). overport's dispatcher aborts on swapchains > 4096 px (`cmp wN,#4096` in xrCreateSwapchain) → `frame.swapchain_limit` (verified with 4XVR, 7680×3840 accepted by the runtime). Both are default-on (parity classifies their rewrites as
-"expected"; library migration `quest_binary_fixes_v2`). The adapter shows cylinder layers (4XVR's movie screen) as ~15° quad strips (`cylinder_strips`, setting
-`cylinder_strips`); the runtime composites them at full resolution. Equirect (360°) layers are dropped: drawing
-them ourselves (GLES renderer in xrEndFrame: stutter, never showed 4XVR's VR video; Vulkan renderer: hung the
-Frame's GPU in AC Nexus; reading the newest *released* image broke 4XVR's theatre) was removed again on the owner's
-request — don't retry without a new approach. Converted layers must count as "swapped" or the original layer list
-is submitted (runtime returns -2 for every frame). A focus debounce (hiding the Frame's brief
-FOCUSED→VISIBLE→SYNCHRONIZED dips, which make 4XVR recenter) was also removed: AC Nexus stayed black with it (it
-hid 521 ms focus changes at start). The new approach (below) is per-game, off the app's render thread, GLES-only.
-
-
-## 360° layers / 4XVR
-
-**360° layers / 4XVR (2026-09-30):** the Frame's Android SteamVR runtime (`/opt/steamvr/bin/androidarm64/vrclient.so`,
-mounted in Lepton as `/data/steamvr/runtime`) only composites quad + projection layers (cube/cylinder/equirect(2)
-are enum names only) — nothing to unlock. Per-game adapter settings (off by default, hooks installed only when on):
-`equirect_emul` (GLES only: a worker thread with a shared EGL context converts each 360° image to a cube map when it
-changes and draws one adapter projection layer from it for every frame with exactly that frame's views (the app's own
-projection views, else xrLocateViews at displayTime); xrEndFrame waits ≤6 ms for the worker's CPU submit, never the
-GPU. Learned in the headset: quads can't be a background (the Frame draws quad layers above all projection layers
-whatever the order: hid 4XVR's balcony/controllers), and the Frame doesn't reproject a projection layer from its own
-pose (images drawn only after head turns, or ahead from xrWaitFrame and sometimes late, wobbled);
-`equirect_flip/face/res/fps/stereo`), `stable_local`, `focus_hold` (only after 3 s FOCUSED, dips <600 ms),
-`aim_pitch/aim_yaw/aim_forward`, `refresh_rate`, `layer_debug` (diagnostics); focus_hold is default-on since 2026-10-05. 4XVR re-creates LOCAL spaces every 2–4 s
-(menu recentring suspect); its theatres are baked 7680×3840 equirect2 images (`assets/100.png` …). Test 360° videos
-(NASA, public domain) are in the Frame's ~/Videos; copies in `~/Downloads/frameport-360`. 4XVR's "Internal Storage"
-lists its own `/sdcard/4XPlayer`, not Movies: agent v25 `link_media` hard-links sent files into an app's own top-level
-folder (`app_media_dirs`), `frameport frame send --app <pkg>`, GUI game page "Add videos" (players) / "Add videos &
-files…". A 4XVR webm stereo swapchain was refused with XR_ERROR_LIMIT_REACHED (-10) → right eye grey; our projection
-swapchain was halved (1536/eye) in case memory is the limit (unverified). Frame data snapshot
-(SteamVR runtimes, Lepton scripts, logs; never commit Valve binaries): `~/frameport-research/frame-data-2026-09-30/`.
-Not yet verified in the headset.
-
-
-## Companion apps / intents (Stremio + 4XVR)
-
-**Companion apps / intents (2026-10-03, tested with Stremio + 4XVR):** a second APK can be installed into a running
-Lepton container (`podman exec -i lepton-steamlaunch-<appid> pm install -g -S <size> < apk`) and runs there, VR
-included (4XVR in Stremio's flatscreen container: FrameBridge 72 fps, settings via LEPTON_ENV_FRAMEBRIDGE_CONFIG). But
-Lepton's services.jar (`ActivityStarter.execute`) intercepts **every** `android.intent.action.VIEW` with data (any
-scheme, explicit component or not, no property to disable): it writes `steam://openurl/<uri>` to `/lepton/steam.pipe`
-(= the host Steam client's `~/.steam/steam.pipe`) and starts nothing. So "open in external player" hand-offs (Stremio
-→ 4XVR) can't work inside Lepton; don't retry without Valve changing it. Lepton installs exactly one `*.apk` per app
-folder (two break `get_apk_path`).
-
-## Text input (Stremio VR)
-
-**Text input (2026-10-03, verified in the headset with Stremio VR):** Lepton's Android has no IME (`ime list` empty)
-and runs VR apps headless (`lepton.headless=true`): no Android window has input focus (`dumpsys input` FocusedWindows
-empty), so neither `input text`, a USB keyboard nor Steam's keyboard reach the app. `lepton-show-flatscreen` on a VR
-app keeps VR working (FrameBridge 72 fps) and gives the window focus; Steam's on-screen keyboard then opens for text
-fields. Unity's TMP_InputField on non-Quest Android waits for the system keyboard (`TouchScreenKeyboardShouldBeUsed`)
-and deselects a frame later unless `isKeyboardUsingEvents` (Android: `InPlaceEditing() && m_HideSoftKeyboard`);
-uGUI InputField's LateUpdate keeps the field when `InPlaceEditing()`. Patch `frame.unity_text_input` rewrites them
-(`mov w0,#0|#1; ret`) at Cpp2IL's **Offset** (= file offset; RVA differs by 0x4000 in Stremio's lib), Cpp2IL
-2022.1 pre-release (Unity 6 / metadata v31; Il2CppDumper can't), cached per libil2cpp sha. `/dev/uinput` has an ACL
-for steamos (Steam Input) → agent v33 `_keyboard` uinput keyboard ("Type on Frame") reaches everything with focus.
-Installing a second APK into a container with `pm install` re-runs Lepton's post-install hook on the **main** app
-(`lepton.active_app_id`; moves its files to /data/steam_app) and corrupts it on the next start (fix: touch the APK →
-re-bake); `cmd_real package install` skips the hook.
-
-## User reports 2026-10-04 (issues #4-#10)
-
-**User reports (2026-10-04, issues #4-#10):** Steam shortcuts go to the signed-in account (`loginusers.vdf`
-MostRecent) else every account (agent v35 `library_users`; it used to refuse with >1 account → Play gave Steam's "Game
-configuration unavailable"); `launch` uses the shortcut's own appid and errors `NOT_IN_LIBRARY`, the app then adds it
-and plays. Unity IL2CPP fixes share one Cpp2IL run (`unity_text_input.Il2cppReturnPatch`, `ALL_TARGETS`, cache keyed by
-global-metadata.dat): `frame.unity_runtime_msaa_off` (OVRManager raises MSAA to 4x at runtime: "Switching to the
-recommended level" → Lucky's Tale restarted the headset; `OVRDisplay.get_recommendedMSAALevel` → 0) and
-`frame.unity_multipass` (Oculus XR Plugin multiview → MultiPass via `OculusSettings.GetStereoRenderingMode`; I Am Cat's
-right eye grey). Both checked against Toy Master's Cpp2IL output, not yet in a headset. VR4 quits itself (System.exit
-after the intro movie) → catalog `use_alt`. **Catalog changes reach existing games** without hardcoded migrations:
-recipes store `catalog_rev` (= `CatalogEntry.rev()`), `library._follow_catalog` re-derives non-user recipes whose entry
-changed; a maintained entry beats the user's shared copy when its `updated`/verified date is later (`catalog._newer`).
-
-## Round 2 of reports, headset rounds 2-3 (2026-10-04)
-
-**Round 2 of reports (2026-10-04):** VR4's campaign hang = one fragment shader reading an uninitialized loop counter
-(reporter's capture): vkshim `vk_shader_fix` setting (`<size>:<sha256>:<offset>:<words>`, from the recipe's `adapter:`;
-matched by size + SHA-256, words inserted into a copy) — on the device the module is fixed at load ("fixed shader
-module (6488 -> 6512 bytes)"); campaign itself not yet seen in a headset by us. Text settings (kind "str") stay out of
-the Game settings dialog (saving it dropped them). I Am Cat: `GetStereoRenderingMode` is inlined (no call sites) →
-`Il2cppReturnPatch.field_loads` rewrites the field read in `OculusLoader.Initialize` (Cpp2IL gives the field offset,
-`field:<name>`); verified with Toy Master: eye swapchains array=1 ×2 instead of array=2. Builds record `recipe_fp`
-(`patches/base.recipe_fingerprint`, `Patch.revision`): a changed recipe or revised patch shows "Update on Frame".
-Remembered Frames are found again after an address change (`Frame.relocate`: scan, same SSH host key, before
-login). Packaged apps show artwork by file path (`thumbs.use_file_paths`, #16). Diagnostics: this boot's kernel log.
-Device tests of requested games (2026-10-04, headless): I Am Cat, Myst 3.3.0, BattleGlide, Blade & Sorcery: Nomad
-start (RUNNING, frames). Roblox: SIGSEGV in je_free from libroblox.so ~3 s in (likely its anti-tamper vs the re-signed
-APK). BONELAB (Unity 2021.3 Vulkan, OVRPlugin 1.94): SIGSEGV with pc == fault addr in vkCreateInstance, called from
-libSLZQuestNative.so's Vulkan hooks into an unmapped (unloaded) library right after OVRPlugin's pre-init
-xrDestroyInstance; pinning openxr/vrclient libraries (RTLD_NODELETE) did NOT help — find the unloaded library with the
-linker's dlopen/dlclose logging next. Accounting+ (Unity 2017.4 built-in Oculus, libOVRPlugin + libvrapi): Unity
-never starts VR on the Frame (no OVRPlugin/OpenXR lines; runs as a 2D app), which is why its "controller setup"
-screen can't be passed — Unity 2017's Oculus device check, not the controller profiles. Cpp2IL can't read Unity 2017.
-The Frame's Android runtime (vrclient.so) knows oculus/touch_controller but not Meta's Touch Plus/Pro profiles
-(OVRPlugin suggests those too, routinely) → adapter `profile_remap`.
-Headset round 2 (2026-10-04): the Frame drops focus often (ms to 7 s; only some are presence/standby) → games pause
-or recentre (B&S Player.OnVRPresence → Teleport, BattleGlide/Unreal pauses); focus_hold now 1 s focused / 1 s max dip
-(longer must still pause). Myst crash = vrclient xrSyncActions race after FOCUSED → `sync_guard` (confirmed); its
-object glitches: app space warp suspected (FB_space_warp is advertised and used) → recipe `patch_disable_space_warp`.
-I Am Cat multipass: poses/times consistent, but every frame is submitted after the next xrWaitFrame (one period late;
-Zink + doubled draws) and the game clamps its physics step to 10 ms → judder while still; testing scale 0.8. Roblox's
-newest crash is on Fossilize's recording thread → vk_sanitize extended to own-engine libs (engine "Other").
-Accounting+: unity_oculus_check + native/ovrpshim (libfp_ovrp.so waits via ovrp_WaitToBeginFrame before Unity
-2017's ovrp_Update2) → VR in the headset at ~72 fps (2026-10-04), but stuck at "press any button" although input
-reaches its OVRInput cleanly (probe: both Touch connected 0x63, individual buttons, input focus 1) → works with issues.
-"outside of frame bounds" warnings stay (~2/frame) and are harmless.
-Steam library (GitHub #4/#21/#27, agent v38): shortcuts go to every Steam account (signed-in first; MostRecent isn't
-always the account on the Frame); stop_steam also waits for Steam's helpers; after the restart the agent re-reads
-shortcuts.vdf and writes once more if Steam put its old copy back (`shortcuts_lost`); lost again (agent v89): Steam
-ignores FramePort's entries on that Frame, so `add_devkit_entry` adds the devkit entry instead (`added` gets `via:
-devkit`) and only reports an error if that fails too. 0.6.3's Play
-auto-repair (`_add_then_play`) crashed (its job got a Job, not a reporter). Uploads resume on a transient OSError.
-Lepton's Android 11 has no clipboard service (134 services; checked with `podman exec … service check clipboard`):
-SDL/LÖVE apps crashed at start → `frame.sdl_clipboard` (`apk/dex.py`: in-place dex edit, nops one invoke, fixes
-the header checksum/signature; verified with LÖVE for Android 11.5, GitHub #24 Dramatic Shape). Godot 4.2-4.4 (Kotlin `as ClipboardManager`,
-GitHub #134 EndoparasiticVR) → `frame.godot_clipboard` (nops the `Intrinsics.checkNotNull` before that check-cast; Godot's
-clipboard methods return at once; analysis `godot_clipboard`, ANALYSIS_VERSION 10; checked on real godot-lib/templates
-4.2.2-4.4.1, not on the device; 4.1 and 4.5+ don't throw). 2D apps (vr_kind none)
-keep every suggested patch that isn't about VR (`needs_vr = False`), not a fixed list. FramePort on the Frame:
-`frame/local.py` (127.0.0.1, own key authorized; "This Frame (experimental)"; app data in
-~/.local/share/frameport-app because ~/.local/share/frameport is the agent's) and Steam library changes wait while
-Desktop Mode is open. Verified on the device 2026-10-04 (install + launch test from the Frame). Library updates on the
-Frame run one at a time (agent v40 flock): two quick uninstalls used to bring a removed shortcut back (Roblox).
-Headset round 3 (owner's verdicts, 2026-10-04): Blade & Sorcery works — its freezes were the headset's wear sensor
-flickering off while worn (vrserver.txt "HMD off/on" 0.5-2 s) → per-game `focus_hold_ms=2500` (only this game reacts;
-not a default). BattleGlide works (focus_hold). Myst works with issues (object glitches; space warp ruled out, its
-recipe keeps it on). I Am Cat works with issues (judder; scale 0.8 no help). Roblox unsupported (je_free in
-libroblox, also with the Vulkan shim). Installs skip the Steam restart when the shortcut is unchanged and wait while a
-game runs (agent v37). New default fixes in FramePort's code reach games already in a library: after every app update
-`library._follow_catalog` re-derives each non-user recipe once (setting `recipes.app_version`; tests switch it off via
-`library.REFRESH_ON_UPDATE`). Analysis fields added later: **bump `analysis/detect.ANALYSIS_VERSION`** (stored as `analysis.extra.analysis_version`); older entries whose APK is still there are analysed again at the GUI's start (background thread, not a job: ~8 s per 900 MB APK) and before a build (`pipeline.refresh_analyses`, GitHub #104); only `analysis`/`suggested` change, user recipes stay; an unreadable APK gets `analysis_failed` = the version (not retried until the next bump). Troubleshooting techniques: docs/PLAYBOOK.md "Debugging techniques". Unity `boot.config` "vulkan" substring mislabels GLES games as Vulkan
-(I Am Cat ran GLES); OVRPlugin's "Unavailable OpenXR extension: XR_FB_scene" is routine (no longer triaged).
-
-## Round 4 (2026-10-04): surface swapchains, save-folder permissions
-
-**Round 4 (2026-10-04):** XR_KHR_android_surface_swapchain is listed by the Frame's runtime but returns
-FUNCTION_UNSUPPORTED → adapter `surface_emul` (default on, `native/adapter/surface_swapchain.c`): an ordinary runtime
-swapchain is returned, the game gets a Surface from a SurfaceTexture on a worker thread (own EGL context, JavaVM from
-XrInstanceCreateInfoAndroidKHR), frames are read back (glReadPixels) and uploaded in xrEndFrame (Vulkan: own command
-buffer + fence per panel, never waits; GLES: glTexSubImage2D). I Am Monkey's intro works (owner-confirmed). SUPERHOT
-(Quest) quit at start: its cloud save folder was mode 1700 and Lepton's app writes through the folder's group →
-launch.sh `fix_perms` adds u+rwx,g+rwx (agent v41). Lucky's Tale: Unity's Loading.PreloadManager thread grows the
-native heap ~1 GB/s until the OOM killer (Frame freezes); no fix. `perf` works as steamos (paranoid 2; ptrace_scope 1
-blocks gdb/eu-stack/debuggerd) — see PLAYBOOK "Debugging techniques". QuestCraft downloads its JRE at first run into
-`files/runtimes/JRE` (Pojlib Installer); on the Frame it was missing (unpacked by hand, unverified). WiiCompiled: its launcher shows
-(lepton-show-flatscreen) but imports .wcgame files through Android's document picker (OPEN_DOCUMENT), which Lepton
-lacks (ActivityNotFoundException) → imported by hand: libmain.so + game.json → internal files/game/<profile>,
-DATA/ → external files/WiiCompiledOpenXRVR/DATA, MOD/ → .../RetroRewind6 (decompiled with jadx). Lepton has no
-picker at all: a FramePort fix would be an injected picker activity. Generated cover/banner art used to suppress the
-Steam placeholder set (no Steam art at all) → fixed in artwork/steam.py.
-
-## Steam library failures and the devkit fallback (GitHub #21/#30/#41/#42)
-
-**Steam library failures (GitHub #21/#30):** on some Frames Steam never loads FramePort's shortcuts.vdf entries (same SteamOS build and arm64 beta client as the dev Frame; IDs correct; file written before Steam starts): Play → console_log `GameAction [AppID <id>] … RequestingLicense → UpdatingAppInfo → LaunchApp failed with AppError_9` (= "Game configuration unavailable", Steam treats the id as a store app). Cause unknown; agent v42/43 diagnostics: `launch` returns `steam` (started / error + code / silent from console_log), `collect_diag` adds `steam_library` (real Steam dir, beta, Steam start vs vdf write time, entries per account, devkit games) + `steam-console.txt` (incl. Steam's `logs/shortcuts.previous.txt` if present; steamclient.so has "LoadShortcuts: rejecting attempt to load shortcuts: invalid account ID"). **Fallback (agent v43):** when Play gets AppError_9 the agent registers the game through Steam's devkit interface (what Valve's Devkit Management Tool does, MIT: `devkit-1 steam://devkit-1/<~/.steam/steam.token>/create-shortcut?response=<file>&gameid=<id>&directory=~/devkit-game` written to ~/.steam/steam.pipe; answer file / `.error`; `~/devkit-game/<id>/launch.sh` = link to the game's launch.sh, `<id>-argv.json` ["launch.sh"] (relative to the folder), `<id>-settings.json` {steam_play 0, compat_tool ""}). Steam adds it live (no restart), picks its own appid (read back from shortcuts.vdf by DevkitGameID), shows it as a normal non-Steam game named "Devkit Game: <id>" (OpenVR 0, but VR works: owner-verified 2026-10-04), art copied to grid/<appid>*. Ids: letter first, then letters/digits/_ only (spaces, '-', leading digit → "missing/invalid arguments"). Later Plays use the devkit entry; uninstall (`devkit_unregister`, `delete-shortcut` live) and purge remove it. Verified on the dev Frame: register/launch/unregister; the AppError_9 trigger itself only in unit tests. GitHub #42 (two Steam accounts, neither MostRecent): Steam rewrote the active account's shortcuts.vdf without FramePort's entries right after starting, and added the devkit entry live without saving it, so `devkit_appid` (vdf only) failed ("Steam added the devkit entry but didn't save it"); agent v55 `devkit_appid_from_log` reads Steam's `sanitize shortcut app id "~/devkit-game/<id>/launch.sh": replacing 0 with N` console line. GitHub #41 (one account): same Steam behaviour, and every install restarts Steam, which forgets the never-saved devkit entry. Agent v56: the log fallback reads only the current session's console_log.txt; Play re-registers a devkit entry that gets AppError_9; art updates also write the devkit entry's grid art (`copy_grid_art`). Open: why some Frames' Steam never loads or saves shortcuts.vdf (single account too).
-
-## Exit game (GitHub #36)
-
-**Exit game (GitHub #36, 2026-10-04):** `Apps.TerminateApp` (what Exit game calls; reachable for tests through Steam's CEF devtools on 127.0.0.1:8080, SharedJSContext, `Runtime.evaluate` — a stdlib websocket client is enough) closed both a normal shortcut and a devkit entry on the dev Frame within 1-3 s. SIGTERM to Steam's `reaper` alone left launch.sh + Lepton (setsid) + the container running (an earlier headset launch ran on for 87 min); SIGTERM to launch.sh cleans up in ~4 s. Agent v44: launch.sh's 2 s loop ends the game when its parent (the reaper) is gone; `upgrade_launchers` (from ensure_host_fixes) adds that to existing launchers in place. Which in-headset exit path fails is still unknown. Screenshots on the Frame: all under SteamVR's appid 250820 (`760/remote/250820/screenshots`, screenshots.vdf has creation time, no game).
-
-## SteamVR dashboard at game start
-
-**SteamVR dashboard at game start (2026-10-04):** the dashboard (Resume game / controller / VR options) was open whenever a FramePort game started (also over Lepton's 2D launcher). Steam's UI exposes `SteamClient.OpenVR.VROverlay.{IsDashboardVisible,HideDashboard,ShowDashboard}` (CEF devtools, `steam_js` in the agent). Agent v44: launch.sh starts `_dashboard_worker` (waits for FrameBridge's first `pacing:` line in launch.log, then hides a visible dashboard for 25 s, at most 3 times; log `<base>/dashboard.log`; opt out with env FRAMEPORT_KEEP_DASHBOARD=1). Verified on the dev Frame (dashboard shown → 4XVR launched via Steam → hidden ~5 s after the first frames); not yet seen in the headset. **Headset (ITR2, 2026-10-05): too late** — Steam shows its frame menu (`valve.steam.gamepadui.frame.menu`, vrwebhelper_systemui.txt `[PooledPopups] Showing`) ~0.3 s after the game's first submitted frame (FrameBridge `new layer:`), but the first `pacing:` summary comes ~8 s later; the owner had pressed Resume (`[HideDashboard] return_to_game`) before the worker looked. Agent v52: watches from the first `new layer:` line (incremental log reads, 0.5 s polls, 30 s window). Agent v59: watches 120 s and hides up to 10 times (the menu came back after 30 s in the owner's sessions). Agent v53: stops for good once the player opens the dashboard with the controller (`toggle_dashboard_action` in vrwebhelper_systemui.txt since the worker started): v52 closed it 60 ms after each press, and the game, paused for it, stayed paused.
-
-## Space warp / ITR2
-
-**Space warp / ITR2 (2026-10-04):** Into The Radius 2 (UE5, `libUnreal.so` + OVRPlugin, Vulkan) uses Application SpaceWarp (extra swapchains `376x376 format=97` motion vectors + `format=129` depth); #35 reports flickering textures. OVRPort's `patch_disable_space_warp` has no effect on UE5, and hiding XR_FB_space_warp in FrameBridge's enumerate doesn't reach the game either: **OVRPort's dispatcher offers/enables XR_FB_space_warp itself**. FrameBridge `hide_space_warp` (per game, off) hides it and strips `XrCompositionLayerSpaceWarpInfoFB` (1000171000) from the projection views (log `hide_space_warp: removed space warp info`); the game still renders its MV swapchains. Test build installed on the dev Frame; flicker not yet checked in a headset. Heuristic: UE5 + OVRPlugin shows it as an option (off). `equirect_emul` is suggested for Unreal games whose graphics API isn't detected ("GLES or unknown"); on Vulkan it switches itself off (Myst/Riven/ITR2): harmless, but Unreal Vulkan detection is a known gap.
-
-## PR #34: Meta XR Audio metadata (Batman)
-
-**PR #34 (merged 2026-10-04, Lucas-Mathieu):** `native/adapter/audio_metadata.h` patches Meta XR Audio Wwise (only build ID e1619e7f…, Batman: Arkham Shadow 1.4.1) so queued audio metadata isn't freed while the current audio frame references it (smoke-bomb crash). Verified headless: installs ("metadata reclamation follows …"), 72 fps; we added a once-per-second scan limit. Outside PRs: review source, rebuild `artifacts/` ourselves, merge locally (contributor's commit kept), push main.
-
-## Heuristics eval (2026-10-04)
-
-**Heuristics eval (2026-10-04):** `scripts/eval_heuristics.py "<VR CyberDeck Portable>"` → 19/44 recipes exact, 322/352 fields (most diffs: `frame.unity_text_input` suggested where older catalog recipes lack it; the rest are runtime-only findings: use_alt, vk_shader_fix, focus_hold, sync_guard, multipass). `PATCHED/` copies aren't scored (already converted).
-
-## Proton default (stable vs Experimental)
-
-**Proton default (agent v51, owner's choice 2026-10-05):** the newest **stable** ARM64 Proton is the default for PC VR games (`pick_proton`: asked-for name/alias, else newest installed stable, else any stable). Agent v49-50 defaulted to Experimental; the owner's headset A/B with Rick and Morty (Experimental 69 % reprojected frames, stable felt much smoother) reverted it. The game page's Customize shows `pcvr.proton_tool` as a dropdown (Stable (default) / Experimental = alias `proton-experimental`); `ensure_proton` installs a chosen one (it asks once more for the runtime Steam only names after Proton is installed; Experimental installed unattended on the device in 53 s). A PC VR launch test that fails on stable suggests Experimental (`pipeline.PROTON_TOOL`, `proton_alternative_worth_trying`, button "Try Proton Experimental and reinstall"). Remaining Rick and Morty stutter on head turns = the game rendering below the refresh rate (reprojection), not Proton.
-
-## USB cable link
-
-**USB cable link (verified 2026-10-05, cabled to the dev PC):** `usb0` is a USB **NCM** gadget (configfs g1: `ncm.usb0` + `ffs.adb`, Valve 28de:2460) set up by `usb-ncm-gadget@usb0.service`, which only runs with `ConditionPathExists=|/etc/systemd/system/adbd.service.d/steamos-devkit-enabled` = **Developer Mode only**. `usb-ncm-dnsmasq@usb0` serves DHCP with fixed `dhcp-host` entries: Frame 10.86.200.233, PC **10.86.200.234** (`frame/usb.py` FRAME_USB_IP/PC_USB_IP). Windows 11 binds its built-in "UsbNcm Host Device" (no driver); WSL mirrored sees eth 10.86.200.234. USB is high-speed (USB 2.0): upload 36.9 MB/s vs 11.3 MB/s home Wi-Fi. Frame→PC over the cable worked without a firewall change. `scripts/usb_autotest.py` (Windows via powershell.exe from WSL), `frameport frame usb-check`. Wizard "Set up with a USB cable" (`PairingServer(host=PC_USB_IP)`; the real bootstrap ran end to end over USB). Discovery dedupes by SSH host key and prefers USB > Frame hotspot > network (`discovery.dedupe`); a lost address is re-found by key (`Frame.relocate`, tested with a dead saved address).
-
-## Start activity / QuestCraft / ITR2 pop-in
-
-**Start activity / QuestCraft / ITR2 pop-in (2026-10-05):** WiiCompiled's VR part (`QuestActivity`, SDL, process `:game`) stays behind Lepton's flat window when the launcher is shown (`device.text_input_window`). `frame.start_activity` (opt-in; analysis `extra.vr_activity` = the original APK's activity with Meta's VR category when it isn't the launcher) gives that activity's filter LAUNCHER and every other LAUNCHER becomes INFO, per element (`axml.set_start_activity`); Lepton's own `apk-info-extractor --print-activity-name` (on the Frame under Lepton/liblepton/apk_extractor) then answers QuestActivity. **OVRPort gives every MAIN activity LAUNCHER + VR categories**, so the VR activity must come from the original APK's analysis, not the converted manifest. Lepton has no activity override (`APP_ACTIVITY` is reset when app_metadata.sh is sourced). QuestCraft reaches Minecraft 1.21.5 (Fabric, Vivecraft, Sodium; LTW "Large Thin Wrapper" GL 3.0 on the Frame's Zink) and stops at `OpenGL error 1282` in `WindowFramebuffer` createTexture (Minecraft's crash report in `files/instances/1.21.5/crash-reports/`, Pojlib's `files/latestlog.txt`); the vrclient SIGSEGV / "pthread_mutex_lock called on a destroyed mutex" afterwards is only the shutdown (Unity's render thread still in vrclient while the instance is destroyed). ITR2 "models popping in and out" in game: Unreal reads user config from **internal** storage (`lepton-data/internal/<pkg>/files/UnrealGame/<Project>/<Project>/Saved/Config/Android/Engine.ini`, not external); `r.AllowOcclusionQueries=0` there broke its menus (removed again). Vulkan shim `vk_query_slots` (two slots per occlusion query) never saw ITR2 create an occlusion query pool, and the run with it crashed (Unreal RenderThread SIGSEGV, caught by sentry-native: no tombstone; the backtrace is in `cache/sentry/*/.sentry-native/*.run/*.envelope` with module offsets) - left off. Next suspect: Unreal 5 mobile HZB occlusion reading depth stored with Valve's FDM injection layer; test = launcher `VK_INSTANCE_LAYERS=''` (Lepton then loads neither VALVE_rpo nor VALVE_fdm_injection, Fossilize still). QuestCraft: LTW overrides glGetError and returns 0 with `LIBGL_NOERROR` set; Lepton passes `LEPTON_ENV_<NAME>` to the app as `<NAME>`, so catalog `lepton_env: {LEPTON_ENV_LIBGL_NOERROR: '1'}` gets Minecraft past the GL error 1282; then black picture (see the catalog entry). FrameBridge logs `new layer` once per layer type per process and projection views only for the first frames, so a second session in the same process (Vivecraft after Unity) needs `layer_debug=1`.
-
-## Vulkan validation / ITR2 solved
-
-**Vulkan validation / ITR2 solved (2026-10-05):** Khronos' validation layer can't come from Lepton (its layer dir is in the read-only guest image; the Linux copies on the Frame are glibc) and a global `debug.vulkan.layers` property (via the LEPTON_GFXRECON_FP_PROPS trick) kills the container at boot. Working recipe: bundle `libVkLayer_khronos_validation.so` (Khronos android-binaries release, arm64-v8a, stored uncompressed) into a test APK re-signed with the game's key (`apk.sign.sign`), install with `frameport install <pkg> --apk`, and set the Vulkan shim's `vk_validation=1` (it adds the layer at vkCreateInstance; findings under the logcat tag VALIDATION in launch.log, each message ID capped at 10). ITR2's flicker + windows behind models = Unreal's Qualcomm shader-resolve subpasses with a depth resolve of a single-sampled depth attachment (VUID-04908/-03179); `vk_spec_fixes=1` drops that resolve (its TRANSFER_DST half never applies to ITR2: the main depth is transient). Valve's VALVE_rpo layer removed ITR2's fog (catalog `lepton_env: VK_INSTANCE_LAYERS: VK_LAYER_VALVE_fdm_injection`). `r.ViewDistanceScale=2` in the internal Saved/Config/Android/Engine.ini only exists on the owner's Frame (the catalog can't write internal storage yet). Launch tests: Lepton prints a transient "is not a running context" on the first start after an APK change (agent v54 `not_started` waits 30 s for "Boot complete!").
-
-## GitHub #38/#39: PowerWash Simulator, The Room VR
-
-**GitHub #38/#39 (2026-10-05):** PowerWash Simulator stuck at "Waiting.." on a reporter's Frame = Unity sized the right-eye image rect past its swapchain (rect 268+1656 on a 1920-wide swapchain; the runtime's recommended size differs per Frame) and SteamVR rejected every frame (`xrEndFrame failed -25`, XR_ERROR_SWAPCHAIN_RECT_INVALID), after which the game stopped calling xrEndFrame. FrameBridge `rect_clamp` (default on; sizes noted in xrCreateSwapchain; clamped layers count as swapped) keeps projection/quad rects inside their swapchain; triage `swapchain-rect-invalid`. Not reproducible on the dev Frame with `scale` (Unity's eye sizing isn't just the recommended width); no regression there (72 fps). The adapter's revision was NOT bumped (that would mark every installed game outdated): affected users rebuild. The Room VR (#38) = Unity's render thread SIGSEGV in libgallium_dri.so ~30 ms after the game recreates its eye swapchain with samples=4 (FrameBridge retries samples=1); the game's own code turns MSAA on (not OVRManager); candidate fix: hide GL_EXT_multisampled_render_to_texture (GL shim) - needs the APK to test. The launch test passed both (render thread dead / no frames): triage gap.
-
-## Headset round 2026-10-05 (evening)
-
-**Headset round 2026-10-05 (evening):** I Am Cat's judder = repeated xrLocateViews of one display time returning
-slightly different poses → FrameBridge `pose_consistency` (owner-verified, works). Lucky's Tale freeze on touching a
-save slot = OVRPort's OpenXR dispatcher converting XR_FB_haptic_amplitude_envelope with ns read as s (GitHub #9) →
-xrshim `haptic_fix` (owner-verified); its remaining short pauses were the wear sensor ("HMD off/on" 0.5-1 s in
-`logs/eyetracking.txt`, not vrserver.txt) → **`focus_hold` is on by default with 5 s** (owner's choice; C defaults
-too). The Room VR works (`unity_no_overlay_copy`). BattleSisters (Unity 2019.4 built-in VR, no libOculusXRPlugin.so)
-flooded "outside of frame bounds" ~2400/s and hung the GPU (kernel hangcheck, zink DEVICE LOST) → the ovrpshim frame
-wait now also applies to Unity 2019 without the Oculus XR Plugin (`UnityOculusCheck.legacy_loop`). Vader Immortal
-(UE4, stuck on the loading image after the intro, GitHub #49): VRP repacks carry a Frida gadget (`libfrda.so`,
-config `hijack_responses`), but OVRPort's `patch_clean_up_frida` removes its loadLibrary call, so it never runs on
-the Frame; `frame.ovr_trace` (opt-in, `native/ovrtrace`: 1138 exported ovr_* stubs → real loader functions, logcat
-tag `fp_ovrtrace`: calls, PopMessage answers, unanswered requests every 10 s) is the next diagnostic.
-
-## Unity built-in VR input (Accounting+, BattleSisters)
-
-**Unity built-in VR input (2026-10-05):** probe builds (`FRAMEPORT_INPUT_PROBE=1 frameport build …`; it logs
-trigger/grip crossings too) showed OVRPlugin returns the full Touch state for every controller mask (also Go masks);
-presses reach the games' OVRInput. Accounting+ (Il2CppDumper v6.7.46 reads its Unity 2017 metadata v24, run on Windows)
-passes stance selection (NewtonVR grip/trigger) but its motion warning waits for `Input.GetMouseButtonDown(0/1)`,
-which Lepton never delivers (no focused Android window) → ovrpshim registers its own
-`UnityEngine.Input::GetMouseButtonDown(System.Int32)` icall (il2cpp_add_internal_call, after Unity's: resolve first)
-that adds a click in the frame a Touch trigger or A/B/X/Y is newly pressed (`unity_oculus_check` revision 3).
-BattleSisters (Unity 2019 InputSystem/XR InputDevices via `VrHandInput`): libunity's Oculus module (OVRPlugin
-function table: a global pointer at 0x16b57c0 in this build, slots filled by name, e.g. +0x160 GetControllerState,
-+0x168 State2, +0xe8 GetNodePresent) only reports controllers when `strncmp(deviceModel, "Oculus", 6) == 0` (next to
-the Go check `deviceModel == "Oculus Pacific"`); Lepton's model is "Valve Lepton" → Go/unknown → only Go masks polled,
-buttons dead. `unity_oculus_check` revision 4 (`oculus_model_checks`, Unity 2019 only) turns the 17 compares' length
-into 0 (`orr w2, wzr, #6` → `mov w2, #0` after the adrp/add of the "Oculus" literal; the string stays: it is also
-Unity's VR device name). Device result: libunity now polls `ovrp_GetControllerState(0x3)` (Touch); owner-confirmed
-2026-10-06: buttons work. Its first controller vibration then hit OVRPort's haptic-envelope bug (11 GB, OOM kill) →
-`haptic_fix` is now suggested for every game with libOVRPlugin.so (settings detect), BattleSisters works. Ruled out before: ProductName, GetNodePresent, the device-model string itself, exports.
-Accounting+ works (owner, 2026-10-06).
-
-## Vader Immortal (headless investigation)
-
-**Vader Immortal (UE4, GitHub #49, 2026-10-06, headless):** stuck after the intro on an in-game image (the splash
-quad ends ~6 s in; then the game's own projection frames, 72 fps, balanced xrBeginFrame/xrEndFrame). Not the Platform
-SDK (`frame.ovr_trace`: only user + entitlement, both answered) and not the repack's Frida gadget (OVRPort's
-`patch_clean_up_frida` removes its loadLibrary). It **leaks ~430 GPU mappings (/dev/dri/renderD128) and ~20 MB a
-second** (6.5 GB + swap after 5 min, then 26 fps): page-fault stacks (perf -e page-faults, offsets resolved with the
-process maps + vrclient.so's own symbols; its text segment is at file offset + 0x4000) end in SteamVR's runtime:
-`xrBeginFrame → CSxrCompositorOpenVR::BeginFrame → SubmitExplicitTimingData → CVRCompositorSharedTextures::
-BeginGPUTimingCommandBuffer` and `xrEndFrame → CVRCompositorClient::SubmitWithArrayIndexAndTime`. Ruled out: the
-layer color scale/bias + image layout structs (FrameBridge `strip_color_bias` 1/2, diagnostic), Valve's Vulkan
-layers (VK_INSTANCE_LAYERS=""), array swapchains in general (Lucky's Tale/I Am Cat flat). Kernel tracepoints aren't
-allowed for steamos. FrameBridge: `layer_debug` logs xrDestroySwapchain and per-5 s xrBeginFrame/xrEndFrame counts;
-`frame_balance` (ends an open frame before the next begin) exists but Vader never leaves one open. Next (built,
-not yet run: the Frame slept): `layer_debug` also counts xrAcquire/Wait/ReleaseSwapchainImage per 5 s (hooked only
-with layer_debug, after the other conditional hooks) to see whether Vader skips a wait or release: it doesn't (361/361/361 per 5 s).
-FrameBridge `snapshot=N` (`snapshot_gl.c`, GLES): every N s the left-eye image the game submits is read back on its
-own context and saved as `files/fb_snap_0-7.ppm` (quarter size) — headless launches show a black headset view, this
-shows what the game draws. Vader: Lucasfilm logo (an OBB mp4: video works), then its loading card (portrait + segmented
-bar) that never advances; the async loader thread sleeps and OBB reads stop (~168 MB of a 2.7 GB pak).
-
-## SteamVR overlay apps
-
-**SteamVR overlay apps (agent v75, 2026-10-10):** host OpenVR overlays (VRApplication_Overlay) are composited over Lepton (Quest) games on the Frame (probe checker seen over 4XVR in the headset view, `native/vroverlay_probe`); Windows ones register through Proton's vrclient too (Temporal Reality's Windows build created its overlays; fpsVR never reaches OpenVR under Proton). Detection `analysis/vroverlay.py` (bundled `.vrmanifest` with `is_dashboard_overlay`, else OpenVR + IVROverlay + self-registration markers, engine Other; Rift fingerprint `RIFT_ANALYSIS`), patch `pcvr.vr_overlay` (param autostart), Linux entry fields `vr_overlay`/`vr_overlay_autostart` (game page switch); agent `register_vr_overlay`/`unregister_vr_overlay`/`launch_vr_overlay` (IVRApplications via ctypes, live; manifest `<anchor>/frameport-overlay.vrmanifest`, the app's own key, binary = launch.sh). **SteamVR on the Frame reads only `binary_path_linux_arm`** (binary_path_linux alone is skipped). Overlay apps: no launch test, no Linux Steam-parent watchdog (`FRAMEPORT_OVERLAY`), not a "running game". A Steam overlay-app shortcut and a game shortcut run together. SteamVR's SetApplicationAutoLaunch didn't persist on the dev Frame (the watch never started by itself) → **agent v76: FramePort's own autostart**: the deployment's `overlay.autostart` is the source of truth; `ensure_host_fixes` (`ensure_overlay_service`) keeps the user service `frameport-vr-overlays.service` (`_vr_overlay_watch`, 5 s polls of the known vrserver's /proc stat) only while an overlay app has autostart on (register/unregister, uninstall, purge and the kill switch `~/.local/share/frameport/vr-overlays.disabled` / `FRAMEPORT_NO_OVERLAY_AUTOSTART` update it); a new vrserver (pid + start time, kept in `~/.cache/frameport-vr-overlays.json` across agent updates) → child `_vr_overlay_round`: wait for IVRApplications, 15 s grace, `launch_vr_overlay` for apps not running (folder process or GetApplicationProcessId); log `~/.local/share/frameport/vr-overlays.log`. Dev Frame: adopted the running vrserver, skipped the already running watch; a start after a real SteamVR start/boot is not yet seen. Details: docs/FRAME_RUNTIME.md "Overlay apps".
-
-## Vader's leak solved / AC Nexus flips
-
-**Vader's leak solved / AC Nexus flips (2026-10-14):** Vader Immortal leaves GL errors pending on its context; SteamVR's GL interop (`openxr_graphics_gl_openvr.cpp`, `xrclient_<pkg>.txt` in Steam's logs: `SXR_GL_CHECK: error:0x502 ... glGenTextures`) takes the stale error as its own failure once, and from then on `CVRCompositorSharedTextures::BeginCommandBuffer` allocates a command buffer every frame (perf page-fault stacks; ~430 renderD128 mappings + 22 MB/s). Adapter `gl_error_clear` (GLES, catalog on for Vader ep1-3) clears them before xrCreateSwapchain/xrBeginFrame/xrEndFrame: flat memory, no SXR_GL_CHECK (headless). The per-game `xrclient_<pkg>.txt` logs are worth reading for runtime errors. The Frame's runtime caps swapchains per session (XR_ERROR_LIMIT_REACHED from ~15; AC Nexus asks for more): flip emulation now turns quads upright in place (scratch VkImage, once per acquire; transfer usage added to single-layer colour swapchains) instead of a shadow swapchain per quad, which ran into the cap (#138). Headless sessions don't draw AC Nexus's panels (adapter `flip_dump` saves before/after images of flipped quads, for headset runs).
-
-## Unreal's self-restart
-
-**Unreal's self-restart (agent v90, 2026-10-13):** UE 4.21+ restarts the app once after its first-run shader
-precompile ("optimizing" screen; `r.ProgramBinaryCache.RestartAndroidAfterPrecompile`): it starts its own LAUNCHER
-activity and calls System.exit(0); Lepton ends the container with the first process (the restarted one with it).
-Skipping `AndroidThunkJava_RestartApplication` or the cvar = 0 (accepted via UE4CommandLine.txt `-ini:`) left Sports
-Scramble on that level for good. launch.sh (RESTART_BLOCK, `upgrade_launchers` adds it) starts Lepton once more when
-`_restart_requested` sees the app's own LAUNCHER start (system log, uid >= 10000) <= 5 s before its exit; first run
-kept as `launch-before-restart.log`; `FRAMEPORT_NO_RESTART=1` off. Owner-verified with Sports Scramble's first start (2026-10-13).
-
-## xrWaitFrame runs ahead (Journey of the Gods)
-
-**xrWaitFrame runs ahead (Journey of the Gods, 2026-10-14, owner-verified):** with real frames (headset on) the
-Frame's runtime sometimes returns from xrWaitFrame at once with a display time less than one refresh after the frame
-just submitted, and then rejects the second submission for that refresh (`VRCompositorError_AlreadySubmitted` in
-Steam's `logs/xrclient_<pkg>.txt`; FrameBridge pacing above the display rate). VrApi games that render faster than
-the display ran ahead (~120 submits/s at 90 Hz) and the scene slid and snapped back. The VrApi bridge re-waits when
-the new display time is under half a period after the last submitted one (`pacing 2s:` counters). Headless runs only
-submit empty frames and never show it. Lepton's logcat mirror also missed the whole verifying session (launch.log =
-Lepton's own lines only): the keeper now catches a silent mirror too (agent v91).
-
-## Lepton's logcat mirror dies
-
-**Lepton's logcat mirror dies (agent v67, 2026-10-09; v91 2026-10-14):** Lepton's mirror (`podman exec -it <container> logcat -v threadtime,color`) fails three ways: `logcat: Unexpected EOF!` right after the game starts, `Logcat read failure`, or running and writing nothing at all (Lepton 3.0.5: seen twice on 2026-10-14, once in the owner's session, once headless). launch.sh's `_logcat_keeper` reads `podman exec <container> logcat -v threadtime -T <epoch>` itself into launch.log after a failure line or 20 s without a logcat line (from the launcher's start when the mirror never wrote, else from just before its last line), restarts it from where it ended (≤5), stops it when Lepton's coloured lines come back, sets the container's log buffer to 16 MiB (`logcat -G`), and logs every decision to `<base>/logcat-keeper.log`. Checked on the dev Frame: a mirror killed mid-game (hand-over without a gap) and a silent mirror (the whole session recovered).
-
-## Double launch
-
-**Double launch (agent v57, 2026-10-06):** a second Play while Lepton still boots (~10 s with nothing to see) made
-the second Lepton stop the first one's container ("Waiting for steamlaunch-<appid> (PID …) to exit", exit 137
-"(starting)", "Clearing baked app data due to early exit") and both died (Vader, BattleSisters). launch.sh now takes
-`flock` on `<base>/.launch.lock` (fd 9, inherited by Lepton; the watchdog and dashboard helpers close it with
-`9>&-`); a second launch exits 0 and logs to `<base>/launch-dup.log`. `upgrade_launchers` adds it to existing
-launchers. Verified on the device (second launch during boot: ignored, the first kept running). Vader on its loading
-card ignores input too (owner pressed/held every button: presses reach the runtime, the card never changes).
-
-## Issue triage round (2026-10-06)
-
-**Issue triage round (2026-10-06, owner's headset):** vibration in OVRPlugin games = 2 s vibrations updated per frame and
-stopped with amplitude 0; FrameBridge turns amplitude 0 into xrStopHapticFeedback (else each buzz ran 2 s), haptic_fix
-uses the envelope RMS (was its peak), per-game `haptic_scale` → Creed/The Boys/Jurassic World fine. Lambda1VR (TBXR):
-loader named by Build.MANUFACTURER (`frame.tbxr_vendor`), no graphics extension enabled (FrameBridge adds
-XR_KHR_opengl_es_enable + asks for the requirements on -50), always multisampled render-to-texture (GL shim gives
-single-sampled stand-ins when GL_EXT_multisampled_render_to_texture is hidden) + its xash/ data → works. Jurassic World:
-`frame.vrapi_stub`. Metro Awakening: contributor's vkshim fixes + hide_space_warp + no VALVE_rpo (jumping polygons like
-ITR2). Pinball FX VR: hide_space_warp (stutters). Eleven: a Meta online request fails after platform init → needs Meta
-services. Star Wars Tales: top half black + freeze after loading; ruled out: asset-file paks (never requested), Valve
-foveation (off: no change), GL errors (MESA_DEBUG=1: none), EGL_BAD_ACCESS once in OVRPlugin init (harmless); the game's
-eye image reads back black. BlazeRush: VrApi bridge exports + ovr*_ToString stubs + avatar stub get it to the menu room
-at 72 fps, full input reaches it (diagnostics `input 5s`: Touch type only, sticks 1.0, buttons, poses 0x8f), but the room
-draws no controllers and ignores input; avatar loader forced to its "Failed" path (no logged-in user) changed nothing.
-`frame.ovr_trace` can't trace Unity games (P/Invoke dlsym; nothing imports ovr_*). Headless: the VrApi bridge's 30 s
-head-pose deadline ends VR mode without a worn headset (not a game bug).
-
-## Lepton storage
-
-**Lepton storage (2026-09-30):** each app's /sdcard (= /storage/emulated/0 → `<base>/lepton-data/external`) has `Movies`/`Download`/`Documents` symlinked to the Frame's `~/Videos`/`~/Downloads`/`~/Documents` (liblepton/mounting.sh, only if they exist at start); agent v24 `storage_targets` reads that mapping. Android's MediaProvider canonicalises paths to /home/steamos/... and rejects every file ("doesn't appear under [/system/media...]"), `sm list-volumes` is empty: the media index never works, apps must browse folders. Lepton installs with `adb install -g` (runtime permissions granted, MANAGE_EXTERNAL_STORAGE too). Files: `install/files.py`, `frameport frame send|storage`, GUI Files tab (formerly Frame → Send files).
-
-## SteamVR per-app settings
-
-**SteamVR per-app settings (2026-09-30):** editing steamvr.vrsettings while SteamVR runs is lost; the web API (127.0.0.1:27062 /app/setsettings) needs `x-steamvr-secret`. `native/vrsettings` = `fp_vrsettings.exe` (freestanding, OpenVR `FnTable:IVRSettings_003` as a Utility app, loads SteamVR's bin/win64/openvr_api.dll) sets them live and SteamVR persists them: section `steam.app.<shortcut appid>`, keys `preferredRefreshRate` (float) and `motionSmoothingOverride` (0 global, 1 on, 2 off, 3 always). Steam Link (vrlink) lists the Frame's rates 72/80/90/96/108/120/144 in vrserver.txt and follows the per-app preference ("host preferred N Hz"; whether the key is honoured is unverified in-headset yet). Judder metric: vrcompositor.txt session summary dropped + "Timed out. N total" (Stormland: 0 dropped but 313 timeouts in 2 min); fpsVR (`%LOCALAPPDATA%\fpsVR\*.json`, 0.1 ms histograms) gives p99 CPU/GPU ms. `pcvr.steamvr_tuning` (default on, PC only) applies on Play: highest rate whose budget ≥ p99×1.05, at least one step down, smoothing on.
-
-
-## Language packs
-
-**Language packs (merged from PR #20, 2026-10-04):** overport's `libovrplatformloader.so` is a dispatcher that `dlopen`s Meta's own loader (`libovrplatformloader_meta.so` / `_meta_q1.so`, also `libpxrplatformloader.so`) and keeps its own message queue; `ovr_LanguagePack_GetCurrent/SetCurrent` are 8-byte `return 0` stubs in it, `ovr_AssetFile_GetList` forwards to Meta's loader. `frame.langpacks` (opt-in, `native/langpack`) serves `<tag>.lang` files from the game's data; `elf.hide_exports` marks the loader's exports STB_LOCAL (bionic and glibc only match GLOBAL/WEAK; verified for glibc, bionic's `is_symbol_global_and_defined` is from memory). `libfp_langpack.so` is built here (`python native/build.py --only langpack`) and committed. Owner-verified 2026-10-04: Deadpool VR with only `en.lang` and the patch on plays English dialogue and runs normally (headless launch tests show 2-6 fps while it loads: not a regression sign). A dispatcher answer that arrives after we answered the timed-out GetList is dropped (one answer per request); games already in a library get `lang_packs` filled after an app update (`library._refresh_data_fields`). The library logs to logcat under the tag `fp_langpack` (dirs looked in, packs found, every language-pack call), so it shows up in the game's `launch.log`; an `ovr_AssetFile_GetList` the dispatcher leaves unanswered for 1.5 s is answered with our packs alone. Deadpool VR (Unreal) accepts a pack only when its `Metadata` equals the game's own version string (`ULanguagePacksSubsystem` compares it with `%s.%s.%s.%s.%s` built from the build info, e.g. `1.0.40.356975.Quest` = versionName; found by disassembling `libUE4.so`): the patch writes the APK's versionName into the library (`@FPMETA@` slot, `with_metadata`), `FRAMEPORT_LANGPACK_META` overrides it. Deadpool VR (2026-10-04, headset): German became selectable with that Metadata, but dialogue stayed silent (even English once reported as a pack) while the path was spelled `/sdcard/Android/obb/<pkg>/x.lang`; with the `/storage/emulated/0/Android/obb/<pkg>/x.lang` spelling (Unreal's own, now listed first in `scan_dirs`) German dialogue plays. `FRAMEPORT_LANGPACK_SKIP=<tags>` or a file `fp_langpack_skip` in the obb folder leaves packs out of the list (experiments).
-
-
-## Cube swapchains
-
-**Cube swapchains (GitHub #107, 2026-10-09):** the Frame's runtime refuses `faceCount=6` swapchains (-2,
-XR_ERROR_RUNTIME_FAILURE); OVRPlugin ignores that ("CreateSwapchain for eye 0: 0x0, 0 stages") and crashes in
-ovrp_EndFrame4 (memset). FrameBridge `cube_standin` (default on, `native/adapter/cube_standin.c`) serves a refused cube
-swapchain as one GL cube-map texture in the app's context (GLES only) and drops its layers. Verified headless with
-Budget Cuts Ultimate (2048² sRGB, 12 mips; runs on at ~70 fps); what the cube layer showed is simply missing.
-
-## Hardware video decoding
-
-**Hardware video decoding (PR #96, PR #128 by Lucas-Mathieu, adapted 2026-10-10, agent v71):** `native/hevc` = one
-OMX plugin `OMX.frameport.{avc,hevc,vp9}.decoder` (FFmpeg v4l2m2m on Iris /dev/video-dec0, FFmpeg software decoders as
-fallback inside the component, Vulkan copy for big native surfaces). The connection installs it once per Frame
-(`ensure_video_codec` → agent `video_codec_status`/`install_video_codec`: `~/.local/share/frameport/video-codec/versions/
-<manifest sha>` + `current` symlink). A Frame keeps the same or a newer `revision` (no flip-flop between PCs) → **bump
-`revision` in native/hevc/build.py with every artifact change**; a failed install isn't retried during the connection.
-Per game: only launchers of games whose recipe has `frame.hw_video_decode` (install stage, no APK change; suggested
-from analysis `media_codec`, ANALYSIS_VERSION 8; deployment.json `hw_video_decode`) get the codec line → the Podman
-wrapper (native/hevc/podman.py) mounts the plugin into that container (merged media_codecs.xml in
-$XDG_RUNTIME_DIR/frameport-video). Off for every game: Settings → Installing (library `video.hw_decode` → agent
-`video_codec_switch` = video-codec/disabled); one game: `FRAMEPORT_NO_HW_VIDEO=1 %command%`. `upgrade_launchers`
-converts agent ≤70 launchers (Batman's `<base>/frameport-codec` → keeps the line, folder then removed). Batman: catalog
-+ migration `batman_video_patches` (`frame.hw_video_decode` + hidden adapter setting `surface_native`). Iris: 8K
-refused (ENOMEM) while any other decoder session is open; SteamVR's vrlinkrunthread holds one ~12 s at game start →
-refused opens retry until 20 s after the plugin loaded (else 2 s), then software; VP9 7680x3840 never returned a
-picture → VP9 ≤4096x2304; hidden VP9 frames come back as empty capture buffers (bytesused 0, no LAST):
-FFmpeg's wrapper ended the EOS drain at the first one (two-pass VP9 lost its last ~25 frames) → build.py requeues
-them (codec revision 8; drain ends at LAST, or 1 s after a skipped empty buffer; dev Frame 2026-10-10: 600/600 =
-OMX.google.vp9 Y hashes). Rebuilds are deterministic (ext4 + NTFS path
-with spaces, two NDK copies → same; rev 8 141de01f…; PR #128's own sources → its 27a2d749…). Not yet run on the device.
-
-## Vulkan shader dump
-
-**Vulkan shader dump (GitHub #140, 2026-10-10):** adapter `vk_shader_dump=1` (Vulkan shim, `native/vkshim/shader_dump.h`;
-applies where vk_sanitize can: Unreal/Other arm64) writes each distinct SPIR-V module once to
-`files/fp_vk_shaders/<size>_<sha256>.spv` (tmp + rename) and one `index.txt` line per vkCreateShaderModule (`<seq> <ms>
-<unix ms> <name> new|known|again|failed`, O_APPEND) to find the module behind a GPU hang. Agent v72 `collect_diag`
-returns `shaders` (newest modules of fp_vk_shaders + fp_spirv, ≤4 MB each, base64) → bundle
-`games/<pkg>/target/shaders/`. Triage `gpu-hang` suggests both dumps; `triage.graphics_api` (FrameBridge's
-xrCreateSwapchain formats: <0x1000 Vulkan, else GL) keeps only the session's API's (`API_ONLY`). Host-tested only.
-Agent v74: a reporter's hang came ~10 s after the last new module, so the culprit wasn't among the newest written →
-with an index naming modules, `shader_dumps` sends every module of the index's **newest session** (after the last
-`# start`), deduplicated, last used first, each ≤4 MB, ≤30 MB in all (`session` = how many it names) + that session's
-index lines; no index (fp_spirv) = the old newest-by-mtime 4 MB. One JSON line (~40 MB base64) over the SSH channel
-is read whole by `Frame.agent` (fine at that size); `_Writer.fit` drops the least recently used modules last, after
-cutting logs, to stay under the 24 MB zip limit.
-
-## Unreal OBB check
-
-**Unreal OBB check (GitHub #159, 2026-10-10):** Epic's DownloaderActivity checks OBB name+size (OBBData), then with `bVerifyOBBOnStartUp=true` CRCs the whole OBB; its screens are invisible in Lepton (stuck at `Displayed …/.DownloaderActivity`, triage `unreal-obb-check-stuck`) → `frame.unreal_skip_obb_check` (analysis `unreal_verify_obb`, ANALYSIS_VERSION 11) flips the manifest boolean (`axml.set_meta_data_bool`); skips only the CRC pass. Host-tested only.
-
-## Issue round 2026-10-12
-
-**Issue round 2026-10-12 (agent v83):** Lepton pastes STEAM_COMPAT_DATA_PATH unquoted into `sh -c "ln -s …/internal/<pkg>
-/data/data/<pkg>"` (mounting.sh): a game on a card named "Steam Frame 512g" got no internal storage (no saves/prefs;
-Beyond Sandbox's EOS then looped `createKeychain→resetKeychain` forever, 1.85 GB log). Quest launchers with an unsafe
-path now `ln -sfn <base> ~/.local/share/frameport/lepton-paths/<pkg>` at every start and give Lepton that path
-(`app_dir_lines`/`set_app_dir`/`launcher_base`; upgrade_launchers converts; deployment.json keeps the real base).
-Verified on the device with a spaced copy of Stremio (old: the `ln` error; new: /data/data link, shared_prefs
-writable). `frame.eos_keychain_loop` (opt-in, triage `eos-keychain-loop`) returns from EOSSDK.resetKeychain. Wander
-0.3570 (Unity 6.5, Firebase, Gecko) ran out of bionic's 128 pthread keys → `frame.unity_tls_key_pool` (Klownicle's
-approach, #198: libunity's 4 key imports renamed `fp_tkey_*` via `elf.rename_imports`, `libfp_tkeys.so` pools
-destructor-less keys behind one real key); device: past Firestore, 72 fps. Cpp2IL releases can't read metadata v107
-(Unity 6.5) → `tools/cpp2il.py` falls back to the development CI build (nightly.link) on that error, and since #293 on any release failure (BattleTalent, Unity 2021.3: the release dies exit 134 in CsFileUtils.GetTypeName after making the folders, no .cs; `il2cpp._run` = non-zero exit or no .cs is unreadable; never with FRAMEPORT_CPP2IL; caches holding "every class missing" are re-run). Vermillion's canvas
-is an OVROverlay quad (drawn above the hand) → `frame.vermillion_scene_canvas` (PaintableMesh getters → false;
-installed build checked, 72 fps headless; headset not yet). Linux apps: `desktop_icon` switch, a deleted desktop copy
-stays deleted (#212). Findings: OLAR (#201) RHIThread null deref in libUnreal (`ldr x8,[x19,#792]`, x19=0) not fixed by
-hide_space_warp / vk_hide_fdm / no Valve layers; FNAF HW (#135) "freeze" = first-start GL program-binary-cache compile
-on Zink (threads busy in zink/disk cache), not a hang; VR4 (#199) reporter's patch.203 OBB truncated. Upload benchmark
-(`scripts/upload_bench.py`, #242): home Wi-Fi caps every method at ~11 MB/s; paramiko uses ~3x OpenSSH's CPU; Windows
-OpenSSH refuses FramePort's key file (ACL "bad permissions") until its permissions are tightened.
-
-## OpenSSH uploads
-
-**OpenSSH uploads (2026-10-15, #324/#242):** sftp escapes `* ? [` inside double quotes itself (and undoes it for
-put's destination), so `native_upload.quote` escapes only `\\`/`"`; Win32 sftp turns every local backslash into `/`
-(escapes too) → local paths go as `C:/…`. Logins: `Frame.auth` = the attempt that worked (app_key / user_key = a key
-file from Settings → Installing → SSH keys, library `ssh.extra_keys`, CLI `frame ssh-keys` / agent / password).
-OpenSSH strict (FramePort + Settings keys, IdentitiesOnly) unless auth was "agent"; a refused strict login retries
-relaxed (+ private copies of ~/.ssh/id_{rsa,dsa,ecdsa,ed25519}: OpenSSH skips its defaults once any -i is given, + the
-agent); `-v` key lines go into the error. FramePort doesn't add its key to the Frame for this. Windows-tested.
-
-## Meta user id
-
-**Meta user id (GitHub #182, 2026-10-11):** OVRPort's platform loader (runtimes 3.4.3-23204ea and -aa54c3f) answers
-`ovr_GetLoggedInUserID` (and two other callers) without a Meta account with a made-up id from a helper (`stp; mov x29,
-sp; bl random; …; mov/movk x9 = 0x53444835ec580000 (6e18); add x0, x8, x9; ldp; ret`), kept only in memory → a new id
-every start; Walkabout Mini Golf files saves under `Profiles/Oculus/<id>/` and lost all progress. `frame.ovr_stable_user`
-(default_on, detect = the game has libovrplatformloader.so) rewrites the helper to `mov x0, <6e18 + 32 bits of
-sha256(package, keystore)>; ret`: stable per game and per user (keystores are personal), so online games never see two
-FramePort users as one. Found in every PATCHED build checked. Host-tested only; upstream candidate.
-
-## Vivox API 31
-
-**Vivox API 31 (GitHub #101, 2026-10-09):** newer Vivox builds (Green Hell VR) call Android 12 AudioManager
-communication-device methods from `com.vivox.sdk.AudioChangeListener` with no SDK check → NoSuchMethodError on Lepton's
-Android 11. `frame.vivox_audio_route` (analysis `vivox_api31`, ANALYSIS_VERSION 4) makes every such method return at
-once (`Dex.return_early`: return-void / `const/4 v0,0; return v0`; nopping the invoke would leave a move-result the
-verifier rejects). Older Vivox (Eleven Table Tennis, BattleSisters) lacks that code and isn't matched. Verified
-headless: Vivox initialises, 150 s at ~65-70 fps.
-Photon Voice does the same (GitHub #362 Table Troopers, #325): `com.exitgames.photon.audioinaec.AudioInAEC.
-updateAudioDevice` (void; only caller of getAvailableCommunicationDevices/setCommunicationDevice, reached from the mic
-thread `AudioInAEC$1.run` via access$000; no SDK_INT check left) → sibling patch `frame.photon_voice_audio_route`
-(analysis `photon_voice_api31`, ANALYSIS_VERSION 21; shares `vivox_audio_route.patch_class`; Vivox's id, title and
-output unchanged, no revision bump). Triage: `vivox-api31` / `photon-voice-api31` now need the SDK's class in the
-stack; any other `*CommunicationDevice*` NoSuchMethodError = `audio-api31` (report). Host-tested on the real dex only.
-
-## Steam Input gamepad for 2D apps
-
-**Steam Input gamepad for 2D apps (GitHub #162, agent v72, 2026-10-10):** Lepton's Android only has the Wayland seat's `wayland_touch/keyboard/pointer`. Steam makes its virtual pad (uinput, `/devices/virtual/input`, 28de:11ff, "Microsoft X-Box 360 pad N", ACL for steamos) only while the Frame's controllers are on (controller.txt "Steam Controller reserving XInput slot 0"; gone when they sleep), also with no game running; steamos-manager's 28de:0000 keys device isn't a pad (no BTN_SOUTH). Lepton's container root (system_server too) = steamos (`keep-id:uid=0`), so a bind-mounted `/dev/input/eventN` opens. Opt-in `device.steam_gamepad` (vr_kind none; suggested for `android.hardware.gamepad`/`LEANBACK_LAUNCHER`, analysis `gamepad`, ANALYSIS_VERSION 9): deployment.json `steam_gamepad` → launcher `GAMEPAD_LINE` (after the codec line: exports FRAMEPORT_GAMEPAD + LEPTON_ENV_SDL_GAMECONTROLLER_ALLOW_STEAM_VIRTUAL_GAMEPAD, puts `agent/bin` first on PATH) → `PODMAN_WRAPPER` (written by ensure_host_fixes; non-`run` calls go straight on; `run` imports the agent's `podman_run_args`; hands on to the next Podman after its own PATH entry with itself removed from PATH, so it chains to the codec wrapper either way round) adds the pads + `Vendor_28de_Product_<pid>.kl` (Xbox 360 layout). Verified headless with a uinput stand-in pad (Stremio's container: EventHub `classes=0x80000141`, our key layout, KeyEvent BUTTON_A dispatched); with Steam's real pad and a game: not yet. Pads made after the start aren't seen until the next one.
-
-## Multiview programs on flat framebuffers (Doom3Quest)
-
-**Multiview programs on flat framebuffers (GitHub #77, Doom3Quest, 2026-10-09, prototype):** Mesa enforces OVR_multiview's
-"program num_views == draw framebuffer views" rule (`draw_validate.c`, the draw is dropped silently); Qualcomm doesn't.
-Doom3Quest compiles every VS with `layout(num_views=2) in;` and draws its HUD/PDA into 2D-texture FBOs → black. Opt-in
-`frame.gl_multiview_fbo` (analysis `gl_multiview_libs`, ANALYSIS_VERSION 6; own-engine GLES only): `native/glmv` =
-`libfpglmv.so` (12 chars = "libGLESv3.so": libdoom3.so's one `.rodata` dlopen string is rewritten in place, its qgl*
-table comes from dlsym on that handle; also first DT_NEEDED for its direct gl*/egl* imports). Such draws use a lazily
-built single-view twin (view 0, uniforms copied per draw); eglMakeCurrent resets the per-thread cache. Host-tested only
-(rewriter on all 19 Doom3Quest shaders + glmv.c against a stand-in GL, `tests/test_gl_multiview_fbo.py`); the host's
-Mesa 23.2 llvmpipe has no OVR_multiview. Headset-verified by Xandrix1987 (2026-10-09: HUD/PDA shown, no fps drop) -> in the Doom3Quest catalog recipe.
-
-## BlazeRush
-
-**BlazeRush (GitHub #57, Klownicle's verified guide, 2026-10-10; FramePort's version headless-tested only):**
-`frame.blazerush` (1.0.349 only: exec-segment SHA + every word checked, offsets from PT_LOAD) NOPs the avatar-readiness
-wait (0x4b2dbc), RETs the avatar renderer (0x4b2adc), renames `cache/shader_cache` → `cache/br_shader_v1`. GL shim
-(now also exports glShaderSource/glLinkProgram/glProgramBinary/glDeleteProgram/glDraw*: pass-through unless a setting
-is on) `gl_int_attribs` (integer inputs fed via glVertexAttribPointer re-set with glVertexAttribIPointer per draw,
-reflection cached per EGL context + program, dropped on link/binary/delete) and `gl_highp_markers` (vertex shaders with
-every '|' marker: mediump→highp except on in/out/uniform lines); host test `tests/test_blazerush.py` with a stand-in
-GL. FOV: the game reads VrApi props 7/8 right after vrapi_Initialize (no session; the Frame has no
-XR_EPIC_view_configuration_fov) → the bridge saves the live FOV (also located before tracking, headless: 118.87×120.04
-on the dev Frame) in `files/framebridge-vrapi-fov.txt` and answers with it at the next start (log `FOV properties: …
-(saved by an earlier session)`). `device.config_sync` (catalog field `config_sync`, agent v78): user_config.xml
-r_3dwidth/height, r_width/height from the runtime eye size (FrameBridge logs `runtime recommended eye size`) × scale,
-written at finalize, set_settings and by launch.sh before Lepton starts (`_config_sync`). Headless runs at scale 1.7
-end in `zink: DEVICE LOST` right after the bridge's 30 s no-tracking deadline tears the session down (gpu fault at the
-teardown; not at scale 1.0): a headless-only artifact, the headset never hits that deadline. Launch tests count an exit/crash after
-such a line as a pass (triage.yaml `headless_end`, finding `headless-end`; GitHub #57 "Failed to launch" on install).
-
-## Session triage
-
-**Session triage (agent v70, 2026-10-09):** launch tests never reach FOCUSED, so real play sessions are triaged
-too. list_installed gives each game `last_play` {start, end, test} from `<anchor>/plays.log` (launch tests write a
-`test <unix>` line first → test sessions are only marked); `session_log` returns the newest session's launch.log
-(`<base>/session.log`, ≤4 MB: head + tail + FrameBridge/crash lines between) + that session's logcat-crash.log +
-`journalctl -k` GPU lines ("kernel: …"). The GUI's connection refresh (`app._check_sessions` → `pipeline.sessions_due`,
-background thread; sessions >7 days old are skipped) runs `pipeline.triage_session` = `validate/session.analyze`
-(triage.yaml signatures incl. `space-warp-used` (info, `question:`, never auto-applied), `gpu-hang` (`report: true`)
-+ computed `slow-frames` (pacing windows vs the nearest refresh rate) and `focus-dips` (FrameBridge always logs
-`focus: lost` / `focus: back after N ms`, session_fixes.c)) → library `last_session` / `last_session_checked` → game
-page "Last session" callout (Try this fix / Rebuild with this fix / Yes-No question / Report / Dismiss). Suggestions may
-be values (`adapter.scale=0.85`, `triage.split_suggestion`); adapter-only fixes are pushed live (`apply_suggestions_live`
-→ agent set_settings, like the Game settings dialog). CLI `frameport session <pkg> [--apply]`. PC VR (Proton) launchers
-log no session end, so they aren't triaged yet. pac_hints stays triage-only: a survey of all 68 dump APKs found unpaired
-PAC hints in 21 libraries of 18 games (OpenSSL's 38/40 in most UE4 libUE4.so and libEOSSDK.so, UE5 libUnreal.so ~400
-vs +2-3, libass, libopencv, …), most of them games that work, so default-on would rewrite many working builds.
-
-## Install links / FrameDrop button protocol
-
-**Install links / FrameDrop button protocol (2026-10-07, not yet clicked end to end from a browser):** FrameDrop
-(framedropvr.com, a closed-source Windows sideloader) defines "Install with FrameDrop" buttons:
-`https://framedropvr.com/install?manifest=<url>|url=<file>` → that page opens `framedrop://install?…` (1.6 s, else its
-home page); manifest `{"schema":"framedrop.install/v1","name","files":[{"url","sha256"}]}` (name = Steam title; .apk
-or Linux .zip). `deeplink.py` (no Flet) parses framedrop://, frameport:// and the pasted https link, enforces its
-rules (https; http only on loopback; no credentials; no LAN/loopback/link-local IPs, also after DNS and redirects; URL
-ends in a file name), caps manifests at 256 KiB, ignores non-hex sha256 (FrameDrop's own example has a placeholder),
-downloads into `<data>/downloads/<slug>-<hash>/` (OBBs → `obb/` next to the APK, `.part` removed on cancel/mismatch);
-`pipeline.add_from_link` routes APK / Linux / exe and sets `title` + `title_locked` + `link` (a bare file link keeps
-FramePort's title). GUI: `views/link_dialog.py` (always asks first), Add games → "Install from a link…", CLI
-`frameport open-link [--yes --no-install --gui]`. **A `flet build` bundle can't take a URL argument** (the Flutter
-host treats any argv as a developer page URL), so `urlhandler.py` registers a script, not FramePort.exe: Windows
-HKCU `Software\Classes\{framedrop,frameport}` → hidden PowerShell `frameport-link-handler.ps1`; WSL (source runs)
-the same keys → `wsl.exe -d <distro> -e sh frameport-link-handler.sh`; Linux `frameport-links.desktop` +
-`xdg-mime`; macOS unsupported (Apple Events, paste instead). The script drops the link into `<data>/links/*.link`
-and starts FramePort unless `<data>/gui.alive` is < 10 s old (`gui.starting` stops double starts); the GUI's
-`_watch_links` thread touches the heartbeat and opens links (newest window session). Settings → Install links: one
-switch per scheme (`links.framedrop`, `links.frameport`, default on); a scheme another program owns (FrameDrop) is
-only taken with "Use FramePort for these links" (`register([s], force=True)`); off removes only FramePort's own
-registration (`MARK` in the command). Never registered with FRAMEPORT_HOME/FRAMEPORT_NO_LINK_HANDLER (tests,
-screenshots). Same round: files dropped on the Library (`ui/dropped.py`, bundles only like the Files tab), "Add a
-Windows program (.exe)…" (`pipeline.add_windows_exe`: exe in Downloads/home/drive root copied alone into
-`<data>/windows-apps/<slug>/`), patch `device.display_mode` (Automatic / VR / Flat window → `InstallContext.display`,
-`installer.show_window`). FramePort-only manifest extension `"frameport": {"description", "icon"}` (bad values ignored; icon: same URL rules,
-≤2 MiB, Pillow-checked, ≥32 px, saved as PNG in `<data>/downloads/icons/`, shown in the question by asset URL, then
-`sources.apply_custom(pkg, "icon")` unless `.picked` exists; description fills `details.description` only when
-empty). Bare file links get a title guessed from the file name (`title_from_filename`: version/arch dropped, package
-names → last part). Windows test of 0.12.1.dev191 (2026-10-07): a button click opened the dialog; but a click right
-after closing FramePort did nothing (the closed window's heartbeat was < 10 s old) → the handler scripts now wait
-up to 4 s for the link file to be taken before trusting the heartbeat, the window's CLOSE event / atexit delete
-`gui.alive`, and the Windows command runs under `conhost.exe --headless` (plain `-WindowStyle Hidden` flashed a
-console). Screens: `scripts/ui_smoke.py --links --fake-frame --game <pkg>` (tall pages: `--viewport
-1280x7000`; Flutter's popup menu ignores Escape).
-Demo link: the homepage's example button = `deeplink.DEMO_MANIFEST` (https://frameport.app/demo/cool-game.json, published
-from site/public/demo/); every form (https button page, frameport://, framedrop://, pasted) → `InstallRequest.demo`,
-no network (fetch_manifest returns `demo_manifest()`, download refuses), `link_dialog.show_demo` (Install =
-`easter.demo_install`: Cool Game's cover out of the portal; eggs off → "Nice, it works!"), CLI just says so.
-Link updates (2026-10-17): manifest `version` (top level, or `frameport.version`, which wins; ≤64 chars) is stored in
-the entry's `link` record (+ `direct`); `pipeline.check_link_updates` (GUI start via `app._check_link_updates`, every
-6 h: setting `links.last_update_check`, off with `links.check_updates`) re-fetches web manifests that named a version
-(`deeplink.can_check_updates`: not bare file links, local manifests or the demo) and sets/clears `link_update`
-{version, checked}; versions compare with `deeplink.compare_versions` (numbers, then release > suffix). UI: Library
-`link_bar` + game page callout → `link_dialog.update_from_link` (fetch again, one confirmation, `download_and_install`
-per game; add_from_link clears the offer and keeps a name the user gave). CLI `frameport link-updates [--install]`.
-

docs/FAQ.md

@@ -26,25 +26,6 @@ Games/                                  ← scan this folder (Add games → Scan
 Not sure of the package name? It's in the OBB file names (`main.<version>.<package name>.obb`), and the game's page
 shows it under **Details**.
 
-## I moved my games to another folder or drive. How do I update the library?
-
-Scan the new folder (**Add games → Scan a folder…**, or **Settings → Library folders → Add folder…**). A game whose
-files are gone from their old place and that FramePort finds again in the new folder keeps its library entry: only
-where its files are changes. Its name, tags, artwork, your own recipe and what's installed on the Frame stay; you don't
-have to remove it from the library first. **Rescan folders** in the Library does the same for every library folder.
-
-- **Removing a folder:** **Settings → Library folders** lists every folder FramePort scans, with how many library games
-  come from it and whether it's there now (a folder on an unplugged drive shows as not found). The bin icon stops
-  scanning a folder; its games stay in the library. `frameport folders [--add DIR] [--remove DIR]` does the same on the
-  command line, `frameport rescan` rescans.
-- **Another version in the new folder** (a different APK or game build): **Scan a folder…** on that folder takes it, as
-  **Update with a newer APK…** would (name, tags, art and your own recipe stay). **Rescan folders** leaves such games
-  alone and says so; use the game's **Update with a newer APK…** / **…version…** to switch.
-- **Two copies** (the old folder is still there): the library keeps the copy it has. To use the other one, delete or
-  rename the old copy and rescan.
-- PC VR games are recognised by their folder name, or a renamed folder by its program file. Linux apps aren't part of
-  folder scans: add the moved app again with **Add a Linux app…** (it keeps its name, art and switches).
-
 ## Can I scan SideQuest backups or AXRB downloads directly?
 
 Yes. Scan the folder as it is; FramePort finds the APK and its OBB files in both layouts:
@@ -197,19 +178,6 @@ draw more than the battery delivers, especially at lower charge, and the Frame t
 
 Saves stay on the Frame when you update or reinstall a game.
 
-## Can I back up a game's saves?
-
-Yes. Steam doesn't sync Quest games' saves, so FramePort copies them to your PC: the game's menu (**…** on its page) →
-**Saves** → **Back up saves**, or **Back up all saves** on the Steam Frame page (Installed games). Close the game
-first. A backup holds the game's own storage (`/data/data/<package>` and `/sdcard/Android/data/<package>`), without
-caches, shader caches and large downloaded content (videos, OBBs, files over 64 MB); the job says when something was
-left out. FramePort keeps the 10 newest backups per game (Settings → Data). They're in FramePort's data folder under
-`save-backups/<package>/` (**Open backups folder** in the game's menu).
-
-**Restore saves…** puts one back: it replaces the game's saves on the Frame. The Frame keeps a copy of the saves it
-had, so **Undo last restore** in the same window takes you back. When you uninstall a game and tick *Also delete its
-saves*, FramePort backs them up first. Command line: `frameport saves backup|list|restore|undo <game>`.
-
 ## A game with mods crashes
 
 How to tell: play once without mods and custom content. If it then works, a mod is the cause; the diagnostics zip

docs/FRAME_RUNTIME.md

@@ -60,31 +60,29 @@
   `launch.sh` at the new folder and only then deletes the old copy; on the same filesystem it renames instead.
   Moving a game whose Lepton data holds absolute paths, or a PC VR prefix, is not yet verified on the device.
 
-## Save backups (Quest games, agent v95, discussion #352)
-- A Lepton game's saves are two folders of `<base>/lepton-data`: `internal/<pkg>` (= `/data/data/<pkg>`:
-  `shared_prefs/`, `files/`, `databases/`; Unreal's `files/UE4Game|UnrealGame/.../Saved` often lives here) and
-  `external/Android/data/<pkg>` (= `/sdcard/Android/data/<pkg>`: Unity's `files/`, Unreal's external `Saved`). On the
-  dev Frame (2026-10-16) every file in them belongs to `steamos` (Lepton's `keep-id:uid=0`: the container's root and
-  app = steamos), mostly mode 600/660 in 700/771/775/2771 folders; Lepton's links (`Android/obb/<pkg>`, `Movies`,
-  `Download`, `Documents`) sit outside these two folders.
-- Agent `_backup_saves '<json>'` streams a tar.gz of both (members `internal/…`, `external/…`, PAX, numeric owners and
-  modes; last member `frameport-saves.json` = manifest with size + sha256 per file and what was left out) on the SSH
-  exec channel's stdout, the result JSON on stderr. Left out: folders named cache/code_cache/no_backup/il2cpp/
-  UnityShaderCache/(Vulkan)ProgramBinaryCache/GPUCache/… at any depth, Unreal `Saved/Logs|Crashes`, FrameBridge's
-  `fb_snap_*`/`framebridge*` files, `.obb/.apk/.foz/.mp4/.mkv/.webm/.mov`, symlinks and special files, and files over
-  64 MiB (big downloaded content; e.g. BattleTalent's `files/Video`). More than 4 GiB of saves is refused.
-- `_restore_saves '<json>'` reads the archive from stdin and treats it as untrusted: only regular files and folders
-  under `internal/`/`external/` (no `..`, absolute paths, links, devices, duplicates), ≤1 GiB per file / 8 GiB in all,
-  each file's sha256 must match the manifest, the manifest's package must be the game. Everything is staged in
-  `<base>/.saves-restore-*` first, a path that would pass through a link on the Frame is refused, then the current
-  saves are written to `<base>/saves-before-restore.tar.gz` (one copy; `rollback: true` restores it and keeps the
-  replaced saves as the new copy) and each file is renamed into place. Existing files keep their owner and mode, new
-  ones get their folder's owner and the backup's mode (at least u+rw); save files the backup doesn't have are removed
-  (left-out files stay). A failure while swapping puts the rollback copy back.
-- Both run their file work in `podman unshare` (the agent re-runs itself as `_saves_ns <op>` with stdio inherited) so
-  files owned by mapped ids are readable and keep their ids, take the game's launch lock (`<base>/.launch.lock`, a
-  Play meanwhile is ignored as a double launch) and refuse while its container runs. `saves_info` sizes a backup and
-  reports the rollback copy, `saves_rollback_delete` removes it.
+## Room data
+
+- SteamVR on the Frame has no Meta scene/anchor extensions. Its chaperone supplies only a 2D outline raised to
+  2.43 m, without furniture, ceiling or a room mesh. Valve's default boundary is a 20-point circle of roughly 1 m
+  radius; FramePort refuses to treat it as a room.
+- FrameBridge's `scene_emul=1` serves saved room data, with a guardian box when no room is available. OVRPort's
+  loader only dispatches functions in its own table: newer Meta entry points go through FramePort's extension shim.
+  MRUK uses discovery (`xrDiscoverSpacesMETA`, older versions `xrQuerySpacesFB`) and requests Space Setup when
+  discovery returns no rooms. Volumes hang below their top-face anchor in Meta's coordinate convention.
+- Room files use STAGE coordinates (metres, +Y up, floor y=0, -Z forward). The format contract is
+  [mr/ROOM_FORMAT.md](mr/ROOM_FORMAT.md). On the Frame: `~/.local/share/frameport/rooms/<universe>/room.txt`,
+  optional `room-mesh.bin` and `scan.log`; `rooms/current` points to the most recently saved room.
+- A room belongs to its chaperone universe. The agent reads the last universe switch from `vrserver.txt`, falling
+  back to the newest universe in `~/.config/openvr/config/chaperone_info.vrchap`; dummy 424242 means none.
+  A matching room is selected first, else `current`; the app reports `aligned: false` after a universe change.
+- Quest launchers copy that room beside `settings.conf` before Lepton starts; FrameBridge reads
+  `dirname($FRAMEBRIDGE_CONFIG)/room.txt`. Stale copies are removed if no room exists or emulation is disabled.
+  Each game's persistent anchors stay in `/sdcard/Android/data/<pkg>/files/framebridge-anchors.txt`.
+- Frame → Room and `frameport frame room` manage rooms. `from-boundary` creates walls without furniture;
+  `import` / `export` transfer room files; `show` writes an SVG preview; `build <dump.fprs>` syncs the bundled
+  `fp_roomscan` by SHA-256 and runs it on the Frame with `--offline`. Headset capture (`room_capture`) deliberately
+  returns "not implemented yet" pending the RoomView device spike. The scanner consumes recorded RoomView meshes
+  from `/xrservice/roomview3d/meshData` + `/meshLayout` (`IVRBlockQueue_005`); it does not capture them itself.
 
 ## OpenXR runtime (as seen by games through overport's loader)
 - Instance extensions present include KHR_android_create_instance (must be enabled; the adapter adds it),
@@ -106,8 +104,6 @@
 - Swapchain formats: GLES `GL_SRGB8_ALPHA8` (35907) / `GL_SRGB8` (35905) only, samples = 1. Vulkan: 43 (R8G8B8A8_SRGB)
   and 50, not 37/44 (UNORM).
 - Environment blend: ALPHA_BLEND available (grayscale passthrough cameras).
-- XR_FB_composition_layer_alpha_blend and XR_KHR_composition_layer_color_scale_bias are not the runtime's (OVRPort's
-  dispatcher lists alpha_blend): their structs are ignored, so FrameBridge emulates inverse alpha (`alpha_blend_emul`).
 - Reference spaces: STAGE bounds are reported as 1×1 m.
 - Display 72 Hz by default in tests. Head pose is only tracked while the headset is worn; otherwise flags 0x3 and
   the session stays below FOCUSED.

docs/GAMES.md

@@ -51,7 +51,6 @@ Generated from [catalog/games](../catalog/games) by `scripts/compat_list.py`.
 | Drunkn Bar Fight 2 - Early Access | Quest | ✅ Works |  |
 | Eleven Table Tennis | Quest | ✅ Works |  |
 | Eleven: Table Tennis VR | PC VR | ✅ Works |  |
-| EndoparasiticVR | Quest | ✅ Works |  |
 | Espire 2 | Quest | ✅ Works |  |
 | Eye of the Temple | Quest | ✅ Works |  |
 | FrenzyVR | Quest | ✅ Works |  |
@@ -66,7 +65,6 @@ Generated from [catalog/games](../catalog/games) by `scripts/compat_list.py`.
 | H.U.N.T | Quest | ✅ Works |  |
 | I Am Cat | Quest | ✅ Works |  |
 | I Am Monkey | Quest | ✅ Works |  |
-| I Expect You To Die 2 | Quest | ✅ Works |  |
 | IEYTD3 | Quest | ✅ Works |  |
 | In Death: Unchained | Quest | ✅ Works |  |
 | Into The Radius 2 | Quest | ✅ Works |  |
@@ -98,7 +96,6 @@ Generated from [catalog/games](../catalog/games) by `scripts/compat_list.py`.
 | NOPE CHALLENGE | Quest | ✅ Works |  |
 | Ocean Rift | Quest | ✅ Works |  |
 | Operation Wolf Returns: First Mission VR | Quest | ✅ Works |  |
-| OrbusVR | Quest | ✅ Works |  |
 | palazzo_santacruz | Quest | ✅ Works |  |
 | Path of the Warrior | Quest | ✅ Works |  |
 | Pistol Whip | Quest | ✅ Works |  |
@@ -142,7 +139,6 @@ Generated from [catalog/games](../catalog/games) by `scripts/compat_list.py`.
 | The Last Clockwinder | Quest | ✅ Works |  |
 | The Room VR | Quest | ✅ Works |  |
 | The Tale of Onogoro | Quest | ✅ Works |  |
-| The Walking Dead: Saints & Sinners | Quest | ✅ Works |  |
 | Time Crisis II VR (Test) | Quest | ✅ Works |  |
 | Time Crisis VR (Experimental) | Quest | ✅ Works |  |
 | Totally Baseball | Quest | ✅ Works |  |
@@ -171,7 +167,6 @@ Generated from [catalog/games](../catalog/games) by `scripts/compat_list.py`.
 | End Space | Quest | ⚠️ Works with issues | Controls stop responding after the first mission loads. |
 | Exploding Kittens VR | Quest | ⚠️ Works with issues | Requires online for most modes. |
 | ExploreVR | Quest | ⚠️ Works with issues | The 3D world warps and shifts with head movement (wrong perspective). |
-| FGO VR | Quest | ⚠️ Works with issues | Audio stuttering and popping sounds |
 | Fisherman | Quest | ⚠️ Works with issues | Loading screens have corruption, but everything works otherwise. |
 | Homeworld: Vast Reaches | Quest | ⚠️ Works with issues | The game starts but after selecting to start a new game it seems to crash. |
 | Lawn Mowing Simulator VR | Quest | ⚠️ Works with issues | Left eye textures flicker only when mowing in specific areas. |
@@ -181,7 +176,6 @@ Generated from [catalog/games](../catalog/games) by `scripts/compat_list.py`.
 | Phantom: Covert Ops | Quest | ⚠️ Works with issues | DLC/store button crashes (no Meta store). |
 | Pinball FX VR | Quest | ⚠️ Works with issues | Plays; mixed reality mode not working yet. |
 | Plezy | Quest | ⚠️ Works with issues | Some videos play with strong artifacts and wrong colours; the cause is unknown, possibly hardware video decoding. |
-| Puzzling Places | Quest | ⚠️ Works with issues | Works fine, but pointers dont show well on main menu, easy to work around. |
 | Quantum Void | Quest | ⚠️ Works with issues | no hands |
 | Ragnarock | Quest | ⚠️ Works with issues |  |
 | Real VR Fishing | Quest | ⚠️ Works with issues | Seems to be almost 100% functional with meta permissions enabled. |
@@ -189,11 +183,9 @@ Generated from [catalog/games](../catalog/games) by `scripts/compat_list.py`.
 | SmartTube | Quest | ⚠️ Works with issues | Android's home screen shows for a few seconds while the app starts (normal for flat Android apps; longest on the first start after an install). |
 | Spunky Dungeon | Quest | ⚠️ Works with issues | Gear VR / Oculus Go game (32-bit only), runs through FramePort's 32-bit bridge (experimental). |
 | Swarm 2 | Quest | ⚠️ Works with issues | MSAA creates visible seams around edge geometry and also the skybox edge |
-| The 7th Guest VR | Quest | ⚠️ Works with issues | Runs and is playable. |
 | The Light Brigade | Quest | ⚠️ Works with issues | Judder in weapons |
 | The Thrill Of The Fight | Quest | ⚠️ Works with issues | Right eye doesn't draw the opponent or the referee. |
 | Time Stall | Quest | ⚠️ Works with issues | Both eyes distort during movement (unresolved). |
-| Vampire: The Masquerade - Justice | Quest | ⚠️ Works with issues | Game runs fine and playable, on loading there's a random sphere in the middle of the sceen. |
 | WiiCompiled VR | Quest | ⚠️ Works with issues | To add a game: in FramePort's Files tab, upload your .wcgame file to this game's storage, folder Android/data/org.wiicompiled.quest/files/WiiCompiledOpenXRVR… |
 | Deadly Delivery | Quest | ❌ Doesn't run | Quits after Meta's entitlement check fails: it needs Meta's online services. |
 | Espire 1: VR Operative (Quest Edition) | Quest | ❌ Doesn't run | Mesa GL driver crash during texture upload. |

docs/INSTALL.md

@@ -167,7 +167,6 @@ FramePort downloads it, checks it, restarts and keeps your games and settings. *
 - Settings → **Updates** turns the check off or turns on **Install updates automatically**.
 - **Recipes** (the tested patches and settings for each game) update by themselves. A game whose recipe changed shows
   **Update on Frame**.
-- **Moved your games?** Scan the new folder (or **Rescan folders**): games found there whose old files are gone keep their library entry, name, artwork, tags and settings, and only their location changes. **Settings → Library folders** lists the folders FramePort scans; remove the old one there (the games stay). See the [FAQ](FAQ.md#i-moved-my-games-to-another-folder-or-drive-how-do-i-update-the-library).
 - **A newer version of a game:** right-click it (or use **…** on its page) → **Update with a newer APK…** (Quest and
   Android games) or **Update with a newer version…** (Linux apps: the new AppImage, archive or folder; PC VR games:
   the new game folder). Its name, artwork, tags and your settings stay. Then click **Update on Frame** (or **on this
@@ -221,14 +220,6 @@ The **Files** tab copies files between your PC and the Frame: videos, documents,
   `/sdcard/Download`, `/sdcard/Documents`).
 - **Game storage** holds each game's own files. A game's menu → **Add videos and files…** opens it.
 
-## Backing up saves
-
-Steam doesn't sync Quest games' saves. A game's menu (**…** on its page) → **Saves** → **Back up saves** copies them
-to your PC (close the game first); **Back up all saves** on the Steam Frame page does every installed Quest game.
-**Restore saves…** puts a backup back on the Frame and keeps a copy of the replaced saves there (**Undo last
-restore**). Backups live in FramePort's data folder under `save-backups/`; the 10 newest per game are kept (Settings →
-Data). Caches and large downloaded content stay out. More in the [FAQ](FAQ.md#can-i-back-up-a-games-saves).
-
 ## Share a recipe or report a problem
 
 - **Share working recipe…** (in the game's menu) opens a GitHub issue with the game's recipe filled in. Accepted
@@ -267,7 +258,6 @@ option. The main ones:
 | Command | What it does |
 |---|---|
 | `scan <folder>` / `list` / `show <game>` | add games, list the library, show a game's patches |
-| `folders [--add <folder>] [--remove <folder>]` / `rescan` | list the library folders, add or remove one (its games stay); scan them again for new and moved games |
 | `add-linux <path> [--exe <program>]` | add a Linux app (AppImage, folder or archive) |
 | `new-version <game> <path>` | point a game at its newer version (APK, Linux app file/folder, PC VR game folder) |
 | `recipe <game> --enable/--disable <patch>` | change a game's patches (`patches` lists them all) |
@@ -275,7 +265,6 @@ option. The main ones:
 | `frame discover` / `frame connect` / `frame info` | find, connect to and describe the Frame |
 | `frame send <files> --dest videos` / `frame storage` / `frame cleanup` | copy files to the Frame, list where they can go, free space |
 | `frame drives` / `frame move <game> --to <drive>` / `install --dest <drive>` | list the Frame's drives, move a game, install to a drive |
-| `saves backup <game>\|--all` / `saves list <game>` / `saves restore <game> [n]` / `saves undo <game>` | back up Quest games' saves to this PC, restore one, undo the last restore |
 | `tools status` / `tools install` | the tools FramePort downloads |
 | `open-link "<link>"` | install from an install button's address or a download link (`--yes`, `--no-install`) |
 | `diag report <game>` / `share-recipe <game>` | report a problem / share a working recipe |

docs/INSTALL_BUTTON.md

@@ -45,7 +45,6 @@ The manifest:
 {
   "schema": "framedrop.install/v1",
   "name": "My Game",
-  "version": "1.4.2",
   "files": [{ "url": "https://example.com/my-game.apk", "sha256": "<64 hex digits>" }],
   "frameport": { "description": "One sentence about the game.", "icon": "https://example.com/icon.png" }
 }
@@ -55,13 +54,6 @@ The manifest:
 against it. The `frameport` object is optional; its icon and description are shown in the
 install question. Only public `https://` addresses are accepted.
 
-`version` is optional (it can also go inside the `frameport` object) and makes updates possible: FramePort remembers
-the manifest's address and version, fetches the manifest again at start (at most every 6 hours) and, when its
-`version` is newer, offers to download and install the update (Library bar and the game's page; CLI
-`frameport link-updates [--install]`). Keep the manifest at the same address and raise `version` with every build.
-Versions compare number by number (`1.10` > `1.9`), and a suffix sorts before the plain release (`1.2.0-beta2` <
-`1.2.0`). Bare file links (`?url=…`) and manifests without a version are never checked.
-
 To build a link from Python: `frameport.deeplink.make_link(manifest_url="https://…/my-game.json")`.
 
 ## On a website

docs/PATCHES.md

@@ -2,7 +2,7 @@
 
 # Patches
 
-Every patch and game setting FramePort knows: 179 entries in 5 groups. A game's recipe is its chosen patches and settings; tested games get theirs from the catalog ([GAMES.md](GAMES.md)), and other games get the patches FramePort suggests from its analysis. You change them on the game page under Customize.
+Every patch and game setting FramePort knows: 169 entries in 5 groups. A game's recipe is its chosen patches and settings; tested games get theirs from the catalog ([GAMES.md](GAMES.md)), and other games get the patches FramePort suggests from its analysis. You change them on the game page under Customize.
 
 Each entry says what the patch does, whether it changes the APK or only the install, when FramePort suggests it, its options, the catalog games whose recipe names it and the launch-test signatures that suggest it. Patches that are on by default are on for every game, so the catalog rarely names them.
 
@@ -11,8 +11,8 @@ Link to an entry with its id, dots replaced by dashes: `PATCHES.md#frame-unity_t
 ## Groups
 
 - [Patches from OVRPort](#group-overport) (25)
-- [Steam Frame patches](#group-frame) (61)
-- [Game settings](#group-adapter) (72)
+- [Steam Frame patches](#group-frame) (55)
+- [Game settings](#group-adapter) (68)
 - [Files and settings on the Frame](#group-device) (8)
 - [PC VR (Proton and Revive)](#group-pcvr) (13)
 
@@ -27,7 +27,7 @@ Link to an entry with its id, dots replaced by dashes: `PATCHES.md#frame-unity_t
 | [Copy OVRPlugin if VrApi is present](#patch_copy_ovrplugin_vrapi) | `patch_copy_ovrplugin_vrapi` | Patches from OVRPort | default |
 | [Disable controller tracking offset](#patch_disable_controller_offset) | `patch_disable_controller_offset` | Patches from OVRPort |  |
 | [Disable Meta XR Audio telemetry](#patch_disable_meta_xr_audio_telemetry) | `patch_disable_meta_xr_audio_telemetry` | Patches from OVRPort |  |
-| [Disable application space warp if used](#patch_disable_space_warp) | `patch_disable_space_warp` | Patches from OVRPort | 4 |
+| [Disable application space warp if used](#patch_disable_space_warp) | `patch_disable_space_warp` | Patches from OVRPort | 3 |
 | [Fix minimal Android SDK](#patch_fix_min_android_sdk) | `patch_fix_min_android_sdk` | Patches from OVRPort | default |
 | [Fix UE4 crash with Unity stub](#patch_fix_unreal_crash) | `patch_fix_unreal_crash` | Patches from OVRPort | default |
 | [Force enable passthrough](#patch_force_passthrough) | `patch_force_passthrough` | Patches from OVRPort | 3 |
@@ -39,7 +39,7 @@ Link to an entry with its id, dots replaced by dashes: `PATCHES.md#frame-unity_t
 | [Patch Oculus detection for Unity](#patch_oculus_unity) | `patch_oculus_unity` | Patches from OVRPort | default |
 | [Patch Oculus detection for Unreal](#patch_oculus_unreal) | `patch_oculus_unreal` | Patches from OVRPort | default |
 | [Remove localized app names](#patch_remove_localized_names) | `patch_remove_localized_names` | Patches from OVRPort | default |
-| [Remove Unreal's ForceQuit](#patch_remove_unreal_force_quit) | `patch_remove_unreal_force_quit` | Patches from OVRPort | 45 |
+| [Remove Unreal's ForceQuit](#patch_remove_unreal_force_quit) | `patch_remove_unreal_force_quit` | Patches from OVRPort | 41 |
 | [Remove uses-library](#patch_remove_uses_library) | `patch_remove_uses_library` | Patches from OVRPort | default |
 | [Remove VrApi library](#patch_remove_vrapi) | `patch_remove_vrapi` | Patches from OVRPort |  |
 | [Replace application label and icon](#patch_replace_icon_label) | `patch_replace_icon_label` | Patches from OVRPort | default |
@@ -50,15 +50,13 @@ Link to an entry with its id, dots replaced by dashes: `PATCHES.md#frame-unity_t
 | [Content files from the game's data](#frame-asset_files) | `frame.asset_files` | Steam Frame patches | 2 |
 | [Asset-file service bypass](#frame-asset_files_stub) | `frame.asset_files_stub` | Steam Frame patches |  |
 | [Skip Meta avatars](#frame-avatar_stub) | `frame.avatar_stub` | Steam Frame patches | 1 |
-| [bHaptics: skip the Bluetooth permission request](#frame-bhaptics_permission) | `frame.bhaptics_permission` | Steam Frame patches | 6 |
+| [bHaptics: skip the Bluetooth permission request](#frame-bhaptics_permission) | `frame.bhaptics_permission` | Steam Frame patches | 5 |
 | [BlazeRush: controllers without Meta avatars, own shader cache](#frame-blazerush) | `frame.blazerush` | Steam Frame patches | 1 |
-| [Cortopia games: don't wait for Meta's org-scoped id](#frame-cortopia_org_id) | `frame.cortopia_org_id` | Steam Frame patches |  |
 | [Epic Online Services: stop the keychain retry loop](#frame-eos_keychain_loop) | `frame.eos_keychain_loop` | Steam Frame patches |  |
 | [OpenGL ES: multiview shaders on flat panels (HUD, menus)](#frame-gl_multiview_fbo) | `frame.gl_multiview_fbo` | Steam Frame patches | 1 |
 | [GL shim (Mesa GLSL compatibility)](#frame-gl_shim) | `frame.gl_shim` | Steam Frame patches | 2 |
-| [Play services: Android 11 version checks](#frame-gms_platform_version) | `frame.gms_platform_version` | Steam Frame patches |  |
-| [Godot apps: start without a clipboard service](#frame-godot_clipboard) | `frame.godot_clipboard` | Steam Frame patches | 1 |
-| [Hardware video decoding (H.264, HEVC, VP9)](#frame-hw_video_decode) | `frame.hw_video_decode` | Steam Frame patches | 29 |
+| [Godot apps: start without a clipboard service](#frame-godot_clipboard) | `frame.godot_clipboard` | Steam Frame patches |  |
+| [Hardware video decoding (H.264, HEVC, VP9)](#frame-hw_video_decode) | `frame.hw_video_decode` | Steam Frame patches | 23 |
 | [Language packs from the game's files](#frame-langpacks) | `frame.langpacks` | Steam Frame patches |  |
 | [Launcher category (INFO → LAUNCHER)](#frame-launcher) | `frame.launcher` | Steam Frame patches | default |
 | [GL wrapper: OpenGL ES depth formats (Minecraft)](#frame-ltw_depth) | `frame.ltw_depth` | Steam Frame patches | default |
@@ -67,55 +65,49 @@ Link to an entry with its id, dots replaced by dashes: `PATCHES.md#frame-unity_t
 | [Meta XR Audio: skip Quest telemetry class](#frame-metaxr_telemetry) | `frame.metaxr_telemetry` | Steam Frame patches | default |
 | [Clear android:debuggable](#frame-nodebug) | `frame.nodebug` | Steam Frame patches | 3 |
 | [Oculus OS telemetry class stubs](#frame-oculusos) | `frame.oculusos` | Steam Frame patches | 17 |
-| [Fix crash when the game prepares the microphone](#frame-ovr_microphone) | `frame.ovr_microphone` | Steam Frame patches | 1 |
+| [Fix crash when the game prepares the microphone](#frame-ovr_microphone) | `frame.ovr_microphone` | Steam Frame patches |  |
 | [Keep the same Meta user between starts](#frame-ovr_stable_user) | `frame.ovr_stable_user` | Steam Frame patches | default |
 | [Trace Meta platform requests (diagnostics)](#frame-ovr_trace) | `frame.ovr_trace` | Steam Frame patches |  |
 | [Platform compat (ovrMessageType_ToString)](#frame-ovrplatformcompat) | `frame.ovrplatformcompat` | Steam Frame patches | default |
 | [Stub missing Meta platform functions](#frame-ovrstubs) | `frame.ovrstubs` | Steam Frame patches | default |
 | [Unpaired pointer-authentication checks](#frame-pac_hints) | `frame.pac_hints` | Steam Frame patches | 1 |
-| [Photon Voice: skip Android 12 audio routing](#frame-photon_voice_audio_route) | `frame.photon_voice_audio_route` | Steam Frame patches |  |
 | [SDL apps: start without a clipboard service](#frame-sdl_clipboard) | `frame.sdl_clipboard` | Steam Frame patches | 5 |
 | [Stress Level Zero: let Unity start Vulkan itself](#frame-slz_vulkan_hooks) | `frame.slz_vulkan_hooks` | Steam Frame patches | 1 |
 | [Start straight in VR (skip the 2D launcher)](#frame-start_activity) | `frame.start_activity` | Steam Frame patches |  |
 | [Allow swapchains larger than 4096 px](#frame-swapchain_limit) | `frame.swapchain_limit` | Steam Frame patches | default |
 | [Team Beef ports: treat the Frame as a Meta headset](#frame-tbxr_vendor) | `frame.tbxr_vendor` | Steam Frame patches | 1 |
-| [Unity App UI: no Android 12 vibrator](#frame-unity_appui_vibrator) | `frame.unity_appui_vibrator` | Steam Frame patches |  |
-| [GL shim for Unity (no multisampled render-to-texture)](#frame-unity_gl_shim) | `frame.unity_gl_shim` | Steam Frame patches | 25 |
+| [GL shim for Unity (no multisampled render-to-texture)](#frame-unity_gl_shim) | `frame.unity_gl_shim` | Steam Frame patches | 23 |
 | [Unity: render each eye separately (no multiview)](#frame-unity_multipass) | `frame.unity_multipass` | Steam Frame patches | 1 |
-| [Unity: disable MSAA](#frame-unity_no_msaa) | `frame.unity_no_msaa` | Steam Frame patches | 10 |
+| [Unity: disable MSAA](#frame-unity_no_msaa) | `frame.unity_no_msaa` | Steam Frame patches | 9 |
 | [Unity: skip OVROverlay layers (fades, splash screens)](#frame-unity_no_overlay_copy) | `frame.unity_no_overlay_copy` | Steam Frame patches | 2 |
-| [Unity: start VR without Meta's system apps](#frame-unity_oculus_check) | `frame.unity_oculus_check` | Steam Frame patches | 14 |
-| [Unity: keep MSAA off at runtime (OVRManager)](#frame-unity_runtime_msaa_off) | `frame.unity_runtime_msaa_off` | Steam Frame patches | 30 |
-| [Make Unity text fields work](#frame-unity_text_input) | `frame.unity_text_input` | Steam Frame patches | 109 |
+| [Unity: start VR without Meta's system apps](#frame-unity_oculus_check) | `frame.unity_oculus_check` | Steam Frame patches | 12 |
+| [Unity: keep MSAA off at runtime (OVRManager)](#frame-unity_runtime_msaa_off) | `frame.unity_runtime_msaa_off` | Steam Frame patches | 28 |
+| [Make Unity text fields work](#frame-unity_text_input) | `frame.unity_text_input` | Steam Frame patches | 107 |
 | [Unity: share thread keys (games that run out of them)](#frame-unity_tls_key_pool) | `frame.unity_tls_key_pool` | Steam Frame patches | 1 |
 | [Unity: headset always counts as worn](#frame-unity_user_presence) | `frame.unity_user_presence` | Steam Frame patches | 1 |
 | [GL shim for Unreal (no multisampled render-to-texture)](#frame-unreal_gl_shim) | `frame.unreal_gl_shim` | Steam Frame patches | 1 |
 | [Unreal: match multiview depth to the eye size](#frame-unreal_multiview_depth) | `frame.unreal_multiview_depth` | Steam Frame patches | 1 |
-| [Unreal: reserve memory like on Quest](#frame-unreal_noreserve) | `frame.unreal_noreserve` | Steam Frame patches |  |
-| [Unreal: stand-ins for OVRPlugin functions OVRPort lacks](#frame-unreal_ovrp_entrypoints) | `frame.unreal_ovrp_entrypoints` | Steam Frame patches | 3 |
+| [Unreal: stand-ins for OVRPlugin functions OVRPort lacks](#frame-unreal_ovrp_entrypoints) | `frame.unreal_ovrp_entrypoints` | Steam Frame patches | 2 |
 | [Unreal: Quest controller bindings (RPOC key map)](#frame-unreal_quest_keymap) | `frame.unreal_quest_keymap` | Steam Frame patches | 3 |
 | [Unreal: don't wait for the Quest shader precompile](#frame-unreal_quest_precompile) | `frame.unreal_quest_precompile` | Steam Frame patches | 3 |
-| [Unreal: start without the OBB check](#frame-unreal_skip_obb_check) | `frame.unreal_skip_obb_check` | Steam Frame patches | 9 |
+| [Unreal: start without the OBB check](#frame-unreal_skip_obb_check) | `frame.unreal_skip_obb_check` | Steam Frame patches | 6 |
 | [Unreal: skip the OBB delivery check](#frame-unreal_skip_obb_delivery) | `frame.unreal_skip_obb_delivery` | Steam Frame patches | 1 |
 | [Unreal: bypass the stalled loading splash](#frame-unreal_splash_bypass) | `frame.unreal_splash_bypass` | Steam Frame patches | 1 |
 | [Unreal: thumb follows the capacitive touches](#frame-unreal_thumb_touch) | `frame.unreal_thumb_touch` | Steam Frame patches | 7 |
-| [USB MIDI: don't poll for USB devices](#frame-usb_midi_watcher) | `frame.usb_midi_watcher` | Steam Frame patches |  |
 | [Vermillion: paint canvases in the scene](#frame-vermillion_scene_canvas) | `frame.vermillion_scene_canvas` | Steam Frame patches | 1 |
 | [Vivox voice chat: skip Android 12 audio routing](#frame-vivox_audio_route) | `frame.vivox_audio_route` | Steam Frame patches | 2 |
 | [Vulkan: drop invalid render-pass pointers](#frame-vk_sanitize) | `frame.vk_sanitize` | Steam Frame patches | default · 1 |
 | [VrApi → OpenXR bridge](#frame-vrapi_bridge) | `frame.vrapi_bridge` | Steam Frame patches | 4 |
 | [Quiet Meta's VrApi loader (OpenXR games)](#frame-vrapi_stub) | `frame.vrapi_stub` | Steam Frame patches | 2 |
-| [OpenGL ES: shader fixes (Vulkan layer under Zink)](#frame-zink_shader_fix) | `frame.zink_shader_fix` | Steam Frame patches | 2 |
-| [Unique controller action names](#adapter-action_dedup) | `adapter.action_dedup` | Game settings |  |
+| [OpenGL ES: shader fixes (Vulkan layer under Zink)](#frame-zink_shader_fix) | `frame.zink_shader_fix` | Steam Frame patches | 1 |
 | [Pointer start](#adapter-aim_forward) | `adapter.aim_forward` | Game settings |  |
 | [Pointer angle](#adapter-aim_pitch) | `adapter.aim_pitch` | Game settings |  |
 | [Pointer turn](#adapter-aim_yaw) | `adapter.aim_yaw` | Game settings |  |
-| [Fix inside-out mixed reality](#adapter-alpha_blend_emul) | `adapter.alpha_blend_emul` | Game settings |  |
 | [Use controllers](#adapter-controller_fix) | `adapter.controller_fix` | Game settings | 1 |
 | [Show Steam Frame controllers](#adapter-controller_models) | `adapter.controller_models` | Game settings | 6 |
 | [Stand in for cube layers](#adapter-cube_standin) | `adapter.cube_standin` | Game settings |  |
 | [Show curved menus and screens](#adapter-cylinder_strips) | `adapter.cylinder_strips` | Game settings |  |
-| [Show 360° backgrounds and videos](#adapter-equirect_emul) | `adapter.equirect_emul` | Game settings | 7 |
+| [Show 360° backgrounds and videos](#adapter-equirect_emul) | `adapter.equirect_emul` | Game settings | 5 |
 | [360° detail](#adapter-equirect_face) | `adapter.equirect_face` | Game settings |  |
 | [360° picture orientation](#adapter-equirect_flip) | `adapter.equirect_flip` | Game settings |  |
 | [360° video frame rate limit](#adapter-equirect_fps) | `adapter.equirect_fps` | Game settings |  |
@@ -135,9 +127,8 @@ Link to an entry with its id, dots replaced by dashes: `PATCHES.md#frame-unity_t
 | [GL shim: high-precision vertex shaders](#adapter-gl_highp_markers) | `adapter.gl_highp_markers` | Game settings | 1 |
 | [GL shim: integer vertex inputs](#adapter-gl_int_attribs) | `adapter.gl_int_attribs` | Game settings | 1 |
 | [Flat panel diagnostics (log)](#adapter-gl_mv_debug) | `adapter.gl_mv_debug` | Game settings |  |
-| [Fix freezes when controllers vibrate](#adapter-haptic_fix) | `adapter.haptic_fix` | Game settings | 94 |
+| [Fix freezes when controllers vibrate](#adapter-haptic_fix) | `adapter.haptic_fix` | Game settings | 88 |
 | [Vibration strength](#adapter-haptic_scale) | `adapter.haptic_scale` | Game settings |  |
-| [Turn off Quest Vulkan foveation](#adapter-hide_fb_foveation) | `adapter.hide_fb_foveation` | Game settings |  |
 | [Turn off space warp](#adapter-hide_space_warp) | `adapter.hide_space_warp` | Game settings | 5 |
 | [Controller input diagnostics (log)](#adapter-input_diag) | `adapter.input_diag` | Game settings |  |
 | [Extra diagnostics (log)](#adapter-layer_debug) | `adapter.layer_debug` | Game settings |  |
@@ -148,16 +139,16 @@ Link to an entry with its id, dots replaced by dashes: `PATCHES.md#frame-unity_t
 | [See your room](#adapter-passthrough_emul) | `adapter.passthrough_emul` | Game settings |  |
 | [Steadier head tracking](#adapter-pose_consistency) | `adapter.pose_consistency` | Game settings | 2 |
 | [Pose timing diagnostics (log)](#adapter-pose_debug) | `adapter.pose_debug` | Game settings |  |
-| [Fix hands lagging behind controllers](#adapter-pose_time_fix) | `adapter.pose_time_fix` | Game settings | 15 |
+| [Fix hands lagging behind controllers](#adapter-pose_time_fix) | `adapter.pose_time_fix` | Game settings | 14 |
 | [Treat newer Quest controllers as Touch](#adapter-profile_remap) | `adapter.profile_remap` | Game settings |  |
 | [Animate fingers from touch](#adapter-proximity_emul) | `adapter.proximity_emul` | Game settings |  |
 | [Keep pictures in bounds](#adapter-rect_clamp) | `adapter.rect_clamp` | Game settings |  |
 | [Refresh rate](#adapter-refresh_rate) | `adapter.refresh_rate` | Game settings | 3 |
 | [Wait for the game's GPU](#adapter-release_wait) | `adapter.release_wait` | Game settings |  |
 | [Re-create play space](#adapter-respace_kick) | `adapter.respace_kick` | Game settings |  |
-| [Sharpness](#adapter-scale) | `adapter.scale` | Game settings | 8 |
+| [Sharpness](#adapter-scale) | `adapter.scale` | Game settings | 4 |
 | [Room depth](#adapter-scene_depth) | `adapter.scene_depth` | Game settings |  |
-| [Pretend room layout](#adapter-scene_emul) | `adapter.scene_emul` | Game settings | 11 |
+| [Use room layout](#adapter-scene_emul) | `adapter.scene_emul` | Game settings | 13 |
 | [Room height](#adapter-scene_height) | `adapter.scene_height` | Game settings |  |
 | [Room width](#adapter-scene_width) | `adapter.scene_width` | Game settings |  |
 | [Eye-image snapshots (diagnostics)](#adapter-snapshot) | `adapter.snapshot` | Game settings |  |
@@ -170,22 +161,21 @@ Link to an entry with its id, dots replaced by dashes: `PATCHES.md#frame-unity_t
 | [Retry refused picture formats](#adapter-swapchain_fix) | `adapter.swapchain_fix` | Game settings |  |
 | [Steady controller input after focus](#adapter-sync_guard) | `adapter.sync_guard` | Game settings | 3 |
 | [Hide Vulkan foveation](#adapter-vk_hide_fdm) | `adapter.vk_hide_fdm` | Game settings | 1 |
-| [Vulkan pipeline failures (log)](#adapter-vk_pipeline_log) | `adapter.vk_pipeline_log` | Game settings |  |
 | [Stop objects popping in and out](#adapter-vk_query_slots) | `adapter.vk_query_slots` | Game settings |  |
 | [Vulkan shader dump (diagnostics)](#adapter-vk_shader_dump) | `adapter.vk_shader_dump` | Game settings |  |
 | [Vulkan shader fixes](#adapter-vk_shader_fix) | `adapter.vk_shader_fix` | Game settings | 1 |
 | [Fix depth flicker (Unreal Vulkan)](#adapter-vk_spec_fixes) | `adapter.vk_spec_fixes` | Game settings | 2 |
 | [Vulkan error checks (log)](#adapter-vk_validation) | `adapter.vk_validation` | Game settings |  |
 | [OpenGL ES shader dump (diagnostics)](#adapter-zink_shader_dump) | `adapter.zink_shader_dump` | Game settings |  |
-| [OpenGL ES shader fixes](#adapter-zink_shader_fix) | `adapter.zink_shader_fix` | Game settings | 2 |
+| [OpenGL ES shader fixes](#adapter-zink_shader_fix) | `adapter.zink_shader_fix` | Game settings | 1 |
 | [Keep the game's saved resolution in step](#device-config_sync) | `device.config_sync` | Files and settings on the Frame | 1 |
 | [Show as VR or as a flat window](#device-display_mode) | `device.display_mode` | Files and settings on the Frame |  |
 | [Settings files for the game](#device-files) | `device.files` | Files and settings on the Frame | 3 |
-| [Foveated rendering (Valve)](#device-foveation) | `device.foveation` | Files and settings on the Frame | 5 |
+| [Foveated rendering (Valve)](#device-foveation) | `device.foveation` | Files and settings on the Frame | 3 |
 | [Hide Android's navigation bar](#device-hide_navbar) | `device.hide_navbar` | Files and settings on the Frame |  |
 | [Extra Lepton settings](#device-lepton_env) | `device.lepton_env` | Files and settings on the Frame | 3 |
 | [Controllers as a gamepad (Steam Input)](#device-steam_gamepad) | `device.steam_gamepad` | Files and settings on the Frame |  |
-| [Show the app's Android window (for typing)](#device-text_input_window) | `device.text_input_window` | Files and settings on the Frame | 112 |
+| [Show the app's Android window (for typing)](#device-text_input_window) | `device.text_input_window` | Files and settings on the Frame | 110 |
 | [Launch options (SteamVR or OpenXR)](#pcvr-launch_args) | `pcvr.launch_args` | PC VR (Proton and Revive) | 2 |
 | [Provide the Oculus runtime from Revive (Frame)](#pcvr-libovr_redirect) | `pcvr.libovr_redirect` | PC VR (Proton and Revive) |  |
 | [No Unreal crash reporter](#pcvr-no_crash_reporter) | `pcvr.no_crash_reporter` | PC VR (Proton and Revive) |  |
@@ -294,7 +284,7 @@ Turns off Meta's frame-rate trick, which causes glitches or hangs outside Quest
 - **Changes:** Changes the APK (during the OVRPort conversion).
 - **Suggested (on):** Very heavy game (… GiB) using OVRPlugin: application space warp causes artifacts/hangs off-Quest.
 - **Offered (off):** Enable if the game shows warping artifacts or hangs (uses OVRPlugin space warp).
-- **Catalog games (4):** Asgard's Wrath 2, Batman: Arkham Shadow, Marvel's Deadpool VR, Puzzling Places.
+- **Catalog games (3):** Asgard's Wrath 2, Batman: Arkham Shadow, Marvel's Deadpool VR.
 - **Source:** [patches/overport.py](../src/frameport/patches/overport.py)
 
 > For heavy games that use application space warp: it causes artifacts or hangs on non-Quest runtimes (for example Asgard's Wrath 2, Batman: Arkham Shadow).
@@ -430,7 +420,7 @@ Stops some Unreal games from closing themselves right after starting.
 - `patch_remove_unreal_force_quit`
 - **Changes:** Changes the APK (during the OVRPort conversion).
 - **Offered (off):** Built as the alternate APK for Unreal games (use it if the game quits itself).
-- **Catalog games (45):** Asgard's Wrath 2, BARTENDER VR SIMULATOR, Breathedge VR, Carve Snowboarding, Creed, Dance Central, Espire 1: VR Operative (Quest Edition), Espire 2 and 37 more.
+- **Catalog games (41):** Asgard's Wrath 2, BARTENDER VR SIMULATOR, Breathedge VR, Carve Snowboarding, Creed, Dance Central, Espire 1: VR Operative (Quest Edition), Espire 2 and 33 more.
 - **Suggested by launch-test signatures:**
   - `force-quit` (error): The game quit itself right after starting.
 - **Source:** [patches/overport.py](../src/frameport/patches/overport.py)
@@ -507,7 +497,6 @@ Runs a 32-bit game (Gear VR, Oculus Go, early Quest) on the Frame, which only ru
 - **Suggested (on):** 32-bit-only game: the Frame can't run 32-bit ARM code, the bridge translates it.
 - **Catalog games (6):** AFFECTED: The Manor, Gunjack, Journey of the Gods, Shadow Point, Sports Scramble (Santa Cruz), Spunky Dungeon.
 - **Suggested by launch-test signatures:**
-  - `a32-jit-overflow` (fatal): The 32-bit bridge's translator stopped the game on a long run of instructions it hands to its interpreter, for example OpenSSL's ARMv8 SHA-1 code in Pinball FX2 VR.
   - `no-arm64` (fatal): 32-bit-only APK (e.g. a Gear VR or Oculus Go game).
 - **Source:** [patches/frame/a32_bridge.py](../src/frameport/patches/frame/a32_bridge.py)
 
@@ -522,7 +511,7 @@ FramePort's layer between the game and the Steam Frame: fills in what the Frame
 - **Suggested (on):** Required for every OpenXR/overport build on the Frame.
 - **Suggested by launch-test signatures:**
   - `cube-swapchain-refused` (fatal): The game asked for a cube-map swapchain (for example an OVROverlay skybox or loading cube), which the Frame's runtime doesn't have.
-  - `cylinder-menu-layers-rejected` (info): The runtime rejected a frame's layers once (XR_ERROR_LAYER_INVALID).
+  - `cylinder-menu-layers-rejected` (error): The game draws a curved (cylinder) screen to each eye separately (for example the Doom3Quest / PreyVR menu).
   - `graphics-requirements-missing` (fatal): The game can't start VR on the Frame; rebuild it with the current FramePort.
   - `swapchain-rect-invalid` (fatal): The runtime rejects the game's frames, so it stops drawing (for example stuck at a "Waiting" box).
   - `time-conversion` (warning): The Frame's runtime lacks timespec time conversion; the current adapter build emulates it.
@@ -576,7 +565,7 @@ Stops bHaptics from asking for a Bluetooth permission the Frame doesn't have (th
 - `frame.bhaptics_permission` · also for 2D apps
 - **Changes:** Changes the APK (a rebuild and reinstall apply it).
 - **Suggested (on):** bHaptics asks for an Android 12 Bluetooth permission at start; the permission screen interrupts the game on the Frame.
-- **Catalog games (6):** Quantum Void, Ragnarock, Smash Drums, Tea For God, Vampire: The Masquerade - Justice, Vendetta Forever.
+- **Catalog games (5):** Quantum Void, Ragnarock, Smash Drums, Tea For God, Vendetta Forever.
 - **Suggested by launch-test signatures:**
   - `bhaptics-permission-prompt` (error): The game asked for Android 12's Bluetooth permission (bHaptics' vest SDK, for example Yupitergrad).
 - **Source:** [patches/frame/bhaptics_permission.py](../src/frameport/patches/frame/bhaptics_permission.py)
@@ -596,19 +585,6 @@ Makes BlazeRush's menus and controllers work without Meta's avatars, and lets it
 
 > BlazeRush 1.0.349 only (Klownicle's guide, GitHub #57). Its menus wait for Meta's avatar, which never comes on the Frame, before they create the game's own controllers: the second menu ignored all input. Two instructions in libtargemapp.so skip that wait and the avatar mesh drawing; the game's shader cache gets a new folder name (cache/br_shader_v1), so programs compiled before the GL shim's shader fixes aren't reused. Only this exact build is changed (code fingerprint and every instruction checked); anything else is left as it is.
 
-### <a id="frame-cortopia_org_id"></a>Cortopia games: don't wait for Meta's org-scoped id
-
-Gets Cortopia games (for example Escaping Wonderland) past their loading screen.
-
-- `frame.cortopia_org_id`
-- **Changes:** Changes the APK (a rebuild and reinstall apply it).
-- **Suggested (on):** Cortopia's Meta platform start-up waits for an org-scoped user id that OVRPort's platform library never answers (stuck loading screen).
-- **Suggested by launch-test signatures:**
-  - `cortopia-org-id-wait` (error): The game waits forever on its loading screen for an answer from Meta's platform (an org-scoped user id, used as its analytics id) that OVRPort's platform library doesn't give.
-- **Source:** [patches/frame/cortopia_org_id.py](../src/frameport/patches/frame/cortopia_org_id.py)
-
-> Cortopia Studios' games (e.g. Escaping Wonderland) ask Meta's platform for an org-scoped user id at start when on Wi-Fi, only to use it as their analytics id. OVRPort's platform library doesn't answer that request ("An unknown error occurred. Request failed."), so the game waits forever on its loading screen. Makes the game take its own offline path for that one request (the analytics id stays empty); the licence check and the logged-in user before it are unchanged. Found with Cpp2IL in libil2cpp.so.
-
 ### <a id="frame-eos_keychain_loop"></a>Epic Online Services: stop the keychain retry loop
 
 Stops Epic Online Services from retrying its login keychain forever (the game would never finish starting).
@@ -649,19 +625,6 @@ Corrects graphics code the Frame's drivers reject (black screen with sound).
 
 > Loads libglshim.so ahead of libEGL in every engine library that fetches GL through eglGetProcAddress. Fixes Quest-only leniency that Mesa/Zink rejects: #pragma before #extension, implicit int/float conversions (enables GL_EXT_shader_implicit_conversions), and multiview shaders used on single-view framebuffers (hides GL_OVR_multiview; gl_hide_multiview=0 turns that off). Logs every failed shader with its source lines (logcat tag GLShim). Symptom: black screen with working audio in a GLES game.
 
-### <a id="frame-gms_platform_version"></a>Play services: Android 11 version checks
-
-Lets games with Google Play services code start on the Frame (they'd crash at start on an Android 12 call).
-
-- `frame.gms_platform_version` · also for 2D apps
-- **Changes:** Changes the APK (a rebuild and reinstall apply it).
-- **Suggested (on):** Google Play services' Android 12 checks were built in as 'always true'; on Lepton (Android 11) the game would crash at start.
-- **Suggested by launch-test signatures:**
-  - `gms-android12-call` (fatal): Google Play services' code in the game called an Android 12 method (the game was built for Android 12 and newer, so its version checks were built in as "always true") and Lepton runs Android 11; the game crashes on its GoogleApiHandler thread at start (for example Titan Isles).
-- **Source:** [patches/frame/gms_platform_version.py](../src/frameport/patches/frame/gms_platform_version.py)
-
-> Google Play services' libraries in games built for Android 12+ only (for example Titan Isles) had their Android 12 checks folded into 'always true' when the game was built; on Lepton's Android 11 they then call an Android 12 method and the game crashes at start (FATAL EXCEPTION: GoogleApiHandler). Those checks answer 'no' again (an in-place edit of classes.dex).
-
 ### <a id="frame-godot_clipboard"></a>Godot apps: start without a clipboard service
 
 Lets Godot games start on the Frame (they'd crash looking for a clipboard).
@@ -669,7 +632,6 @@ Lets Godot games start on the Frame (they'd crash looking for a clipboard).
 - `frame.godot_clipboard` · also for 2D apps
 - **Changes:** Changes the APK (a rebuild and reinstall apply it).
 - **Suggested (on):** Godot 4 app: it crashes at start in Lepton, which has no clipboard service.
-- **Catalog games (1):** EndoparasiticVR.
 - **Suggested by launch-test signatures:**
   - `godot-no-clipboard` (fatal): The app crashed at start because the Frame's Android has no clipboard.
 - **Source:** [patches/frame/godot_clipboard.py](../src/frameport/patches/frame/godot_clipboard.py)
@@ -683,7 +645,7 @@ Plays the game's videos on the Frame's video hardware, so 4K and 8K video runs s
 - `frame.hw_video_decode` · also for 2D apps
 - **Changes:** Install only: written on the Frame when the game is installed; the APK isn't changed.
 - **Suggested (on):** The game plays video through Android's decoders (MediaCodec, ExoPlayer or VLC): decode it on the Frame's hardware.
-- **Catalog games (29):** 4XVR Video Player, AugmentedEmpire, Batman: Arkham Shadow, Battlemarked, Breathedge VR, Dance Central, Exploding Kittens VR, Eye of the Temple and 21 more.
+- **Catalog games (23):** 4XVR Video Player, AugmentedEmpire, Batman: Arkham Shadow, Battlemarked, Breathedge VR, Dance Central, Exploding Kittens VR, Eye of the Temple and 15 more.
 - **Source:** [patches/frame/hw_video_decode.py](../src/frameport/patches/frame/hw_video_decode.py)
 
 > Decodes the game's videos on the Frame's hardware video decoder instead of Android's software decoders, which stutter or fall behind with 4K/8K video (for example video players, Batman: Arkham Shadow's cutscenes). Adds FramePort's codec plugin (OMX.frameport.avc/hevc/vp9.decoder) to this game's container only; the APK isn't changed. When the hardware is busy (for example Steam's own hardware video decoding is on) the video is decoded in software as before.
@@ -801,7 +763,6 @@ Stops a crash a few seconds after the logo in games with voice chat.
 - `frame.ovr_microphone`
 - **Changes:** Changes the APK (a rebuild and reinstall apply it).
 - **Suggested (on):** The game uses Meta's microphone API (ovr_Microphone_GetOutputBufferMaxSize), which crashes in OVRPort's library before the microphone is started.
-- **Catalog games (1):** The Walking Dead: Saints & Sinners.
 - **Suggested by launch-test signatures:**
   - `ovr-microphone-crash` (fatal): The game crashed while setting up the microphone (for example Unreal's Oculus voice chat a few seconds after the logo).
 - **Source:** [patches/frame/ovr_microphone.py](../src/frameport/patches/frame/ovr_microphone.py)
@@ -870,19 +831,6 @@ Stops a crash on the Frame's processor in games whose code the Quest runs more l
 
 > Some engines contain assembly (for example OpenSSL's) that checks a return-address signature it never made. The Quest's CPU ignores those checks, the Steam Frame's enforces them: the game crashes with SIGILL as soon as it uses that code, for example on its first network connection (Star Wars Pinball VR). In a library with unpaired checks, the signing and checking instructions become no-ops.
 
-### <a id="frame-photon_voice_audio_route"></a>Photon Voice: skip Android 12 audio routing
-
-Stops games with Photon Voice chat from crashing on the Frame when voice chat starts (an Android 12 audio call).
-
-- `frame.photon_voice_audio_route` · also for 2D apps
-- **Changes:** Changes the APK (a rebuild and reinstall apply it).
-- **Suggested (on):** Photon Voice calls Android 12 audio methods, which Lepton (Android 11) lacks, and crashes when voice chat starts.
-- **Suggested by launch-test signatures:**
-  - `photon-voice-api31` (fatal): The game's Photon Voice microphone plugin calls Android 12 audio-routing methods (AudioManager communication devices) without checking the Android version; Lepton runs Android 11, so the app crashes when voice chat starts (for example Table Troopers at the tutorial).
-- **Source:** [patches/frame/photon_voice_audio_route.py](../src/frameport/patches/frame/photon_voice_audio_route.py)
-
-> Photon Voice's microphone plugin (for example Table Troopers) picks the audio device with Android 12 methods (AudioManager communication devices) without checking the Android version; Lepton runs Android 11, so the game crashes with a NoSuchMethodError when voice chat starts. That method returns at once instead (an in-place edit of classes.dex); the microphone keeps Android's default audio route.
-
 ### <a id="frame-sdl_clipboard"></a>SDL apps: start without a clipboard service
 
 Lets SDL and LÖVE games start on the Frame (they'd crash looking for a clipboard).
@@ -949,19 +897,6 @@ Lets Team Beef ports (for example Lambda1VR) start on the Frame.
 
 > Team Beef's ports (for example Lambda1VR, RTCWQuest) load an OpenXR library named after the headset maker and pick their VR setup by maker; for "valve" they stop at start (libopenxr_loader_valve.so not found) or take the Pico path. Adds that library and lets them take the Meta path. Keeps GL4ES in charge of its desktop OpenGL draw calls so animated models don't turn into stretched triangles.
 
-### <a id="frame-unity_appui_vibrator"></a>Unity App UI: no Android 12 vibrator
-
-Lets games built with Unity's App UI start on the Frame (they'd quit at once on an Android 12 vibrator call).
-
-- `frame.unity_appui_vibrator` · also for 2D apps
-- **Changes:** Changes the APK (a rebuild and reinstall apply it).
-- **Suggested (on):** Unity App UI's activity uses Android 12's VibratorManager at start, which Lepton (Android 11) lacks: the game would quit at once.
-- **Suggested by launch-test signatures:**
-  - `unity-appui-vibrator` (fatal): The game's start activity uses Android 12's VibratorManager (Unity's App UI package, for example PianoVision) and Lepton runs Android 11, so it quits before the game starts.
-- **Source:** [patches/frame/unity_appui_vibrator.py](../src/frameport/patches/frame/unity_appui_vibrator.py)
-
-> The activity of Unity's App UI package (for example PianoVision) gets the vibrator through Android 12's VibratorManager without checking the Android version; on Lepton's Android 11 the game quits at start with a NoClassDefFoundError. The activity then starts without a vibrator and its UI haptic feedback does nothing (an in-place edit of classes.dex).
-
 ### <a id="frame-unity_gl_shim"></a>GL shim for Unity (no multisampled render-to-texture)
 
 Stops a gray or frozen screen in Unity games that turn on anti-aliasing while running (for example The Room VR).
@@ -969,7 +904,7 @@ Stops a gray or frozen screen in Unity games that turn on anti-aliasing while ru
 - `frame.unity_gl_shim`
 - **Changes:** Changes the APK (a rebuild and reinstall apply it).
 - **Suggested (on):** Unity GLES game that may switch to MSAA at runtime: hide multisampled render-to-texture, which crashes the Frame's GL driver (for example The Room VR).
-- **Catalog games (25):** Audica, BattleSisters, Beat Saber, COMPOUND, Cosmodread, Down the Rabbit Hole, Drunkn Bar Fight, End Space and 17 more.
+- **Catalog games (23):** Audica, BattleSisters, Beat Saber, COMPOUND, Cosmodread, Down the Rabbit Hole, Drunkn Bar Fight, End Space and 15 more.
 - **Suggested by launch-test signatures:**
   - `unreal-msrtt-crash` (fatal): The game's graphics crashed a few seconds after start.
 - **Source:** [patches/frame/vrapi_bridge.py](../src/frameport/patches/frame/vrapi_bridge.py)
@@ -996,7 +931,7 @@ Turns off a smoothing setting that crashes some older Unity games on the Frame.
 - **Changes:** Changes the APK (a rebuild and reinstall apply it).
 - **Suggested (on):** Legacy VrApi Unity game on GLES with MSAA (… quality levels): multisampled render-to-texture hangs the Frame's GL driver (for example Sniper Elite VR).
 - **Offered (off):** GLES Unity game with MSAA on (… quality levels); enable if it hangs the GPU ('zink: DEVICE LOST').
-- **Catalog games (10):** Audica, BattleSisters, Eye of the Temple, I Expect You To Die 2, IEYTD3, Jurassic World Aftermath Collection, Mini Motor Racing X, Sniper Elite VR and 2 more.
+- **Catalog games (9):** Audica, BattleSisters, Eye of the Temple, IEYTD3, Jurassic World Aftermath Collection, Mini Motor Racing X, Sniper Elite VR, SUPERHOT VR and 1 more.
 - **Suggested by launch-test signatures:**
   - `zink-device-lost` (fatal): The GPU hung, so the game froze or closed.
 - **Source:** [patches/frame/unity_no_msaa.py](../src/frameport/patches/frame/unity_no_msaa.py)
@@ -1024,7 +959,7 @@ Lets older Unity games start VR without Meta's system apps (they'd stay on a 2D
 - `frame.unity_oculus_check` · revision 5
 - **Changes:** Changes the APK (a rebuild and reinstall apply it).
 - **Suggested (on):** Unity with built-in Oculus support: it checks for Meta's system apps before starting VR, else it runs as a 2D app (for example Accounting+, BattleSisters).
-- **Catalog games (14):** Accounting+, Audica, BattleSisters, Cosmodread, End Space, Eye of the Temple, I Expect You To Die 2, Jurassic World Aftermath Collection and 6 more.
+- **Catalog games (12):** Accounting+, Audica, BattleSisters, Cosmodread, End Space, Eye of the Temple, Jurassic World Aftermath Collection, Mini Motor Racing X and 4 more.
 - **Suggested by launch-test signatures:**
   - `unity-vr-device-none` (fatal): Unity didn't start VR, so the game runs as a hidden 2D app.
 - **Source:** [patches/frame/unity_oculus_check.py](../src/frameport/patches/frame/unity_oculus_check.py)
@@ -1038,7 +973,7 @@ Keeps a smoothing setting off that the game turns on itself and that can freeze
 - `frame.unity_runtime_msaa_off` · revision 2
 - **Changes:** Changes the APK (a rebuild and reinstall apply it).
 - **Suggested (on):** GLES Unity game whose OVRManager turns 4x MSAA on at runtime: multisampled render-to-texture can hang the Frame's GPU.
-- **Catalog games (30):** Audica, BattleSisters, Beat Saber, COMPOUND, Cosmodread, Down the Rabbit Hole, Drunkn Bar Fight, End Space and 22 more.
+- **Catalog games (28):** Audica, BattleSisters, Beat Saber, COMPOUND, Cosmodread, Down the Rabbit Hole, Drunkn Bar Fight, End Space and 20 more.
 - **Suggested by launch-test signatures:**
   - `unity-render-crash` (fatal): The game's graphics crashed, so the picture freezes or stays gray.
   - `unity-runtime-msaa` (info): The game turns MSAA on at runtime, which can hang the Frame's GPU.
@@ -1054,7 +989,7 @@ Lets you type into this app's text fields on the Frame (they'd close at once).
 - `frame.unity_text_input` · also for 2D apps
 - **Changes:** Changes the APK (a rebuild and reinstall apply it).
 - **Suggested (on):** Unity app with text fields (…): they close at once on the Frame because it has no system keyboard.
-- **Catalog games (109):** AgeOfJoy, AllInOneSports, Ancient_Dungeon, Arcsmith, Arkio, Assassin's Creed Nexus, Attack on Titan VR: Unbreakable, Audica and 101 more.
+- **Catalog games (107):** AgeOfJoy, AllInOneSports, Ancient_Dungeon, Arcsmith, Arkio, Assassin's Creed Nexus, Attack on Titan VR: Unbreakable, Audica and 99 more.
 - **Source:** [patches/frame/unity_text_input.py](../src/frameport/patches/frame/unity_text_input.py)
 
 > Unity's TMP_InputField / InputField wait for Android's on-screen keyboard and close themselves a frame later when there is none (Lepton has no on-screen keyboard; Meta's system keyboard does this on a Quest), so a selected text field only flashes a caret. Rewrites TouchScreenKeyboardShouldBeUsed -&gt; false and isKeyboardUsingEvents (TMP) / InPlaceEditing (uGUI) -&gt; true in libil2cpp.so, found per game with Cpp2IL (downloaded on first use), so fields stay selected and take key presses: Steam's keyboard (with "Show the app window") or Type on Frame from the PC.
@@ -1114,19 +1049,6 @@ Shows the full environment when its upper part is clipped but menu panels look c
 
 > Some UE4 games keep the initial Android window size for their stereo depth buffer, clipping the upper part of the environment while menu panels look correct. Refreshes the cached depth dimensions from the current eye render target before allocation. Preserves multiview and multisampling. Verified in Tales from the Galaxy's Edge 1.1.9; changes one branch only when the function size and surrounding code match.
 
-### <a id="frame-unreal_noreserve"></a>Unreal: reserve memory like on Quest
-
-Lets the game load: it reserves more memory at start than the Frame grants in one piece and crashed before its first frame (for example Transformers Beyond Reality).
-
-- `frame.unreal_noreserve` · also for 2D apps
-- **Changes:** Changes the APK (a rebuild and reinstall apply it).
-- **Suggested (on):** Unreal's Binned3 allocator reserves more memory at start than the Frame's kernel allows in one piece; without this the game crashes while it loads.
-- **Suggested by launch-test signatures:**
-  - `unreal-reserve-refused` (fatal): The game crashed while Unreal was still loading, before its first frame.
-- **Source:** [patches/frame/unreal_noreserve.py](../src/frameport/patches/frame/unreal_noreserve.py)
-
-> Unreal reserves its memory ranges on Android with ordinary read/write mappings. Games built with Unreal's Binned3 allocator reserve tens of gigabytes at once while the engine loads (76 GiB in Transformers Beyond Reality); Quest allows that, the Frame's kernel refuses mappings larger than its memory, and the game crashes before its first frame (SIGSEGV at fault addr 0x10 in libUnreal.so, inside System.loadLibrary). This marks those mappings MAP_NORESERVE, as Quest effectively treats them: memory is still only used when the game touches it.
-
 ### <a id="frame-unreal_ovrp_entrypoints"></a>Unreal: stand-ins for OVRPlugin functions OVRPort lacks
 
 Lets older Unreal games start VR on the Frame (for example Star Wars Pinball VR).
@@ -1134,7 +1056,7 @@ Lets older Unreal games start VR on the Frame (for example Star Wars Pinball VR)
 - `frame.unreal_ovrp_entrypoints`
 - **Changes:** Changes the APK (a rebuild and reinstall apply it).
 - **Suggested (on):** Unreal looks up OVRPlugin function(s) OVRPort's OVRPlugin lacks: ……. Without them Unreal starts no VR.
-- **Catalog games (3):** Ghostbusters: Rise of the Ghost Lord, Puzzling Places, Star Wars Pinball VR.
+- **Catalog games (2):** Ghostbusters: Rise of the Ghost Lord, Star Wars Pinball VR.
 - **Source:** [patches/frame/unreal_ovrp.py](../src/frameport/patches/frame/unreal_ovrp.py)
 
 > Unreal's Oculus module looks up every OVRPlugin function it was built against and starts no VR when one is missing; OVRPort's OpenXR OVRPlugin lacks some old ones (for example ovrp_GetPTWNear, which Unreal 4.25 builds like Star Wars Pinball VR look up). The game then never starts an OpenXR session and crashes a few seconds in. Adds a generated library to libOVRPlugin.so with a stand-in for each missing function that reports failure (ovrpFailure), so Unreal's Oculus support starts. The functions OVRPort has are untouched.
@@ -1170,7 +1092,7 @@ Starts Unreal games without re-checking their data file (they'd seem to hang on
 - `frame.unreal_skip_obb_check` · also for 2D apps
 - **Changes:** Changes the APK (a rebuild and reinstall apply it).
 - **Suggested (on):** Unreal checks the OBB's contents before starting (bVerifyOBBOnStartUp); on the Frame a failed or slow check can't be seen and the game seems to hang.
-- **Catalog games (9):** Dance Central, Kill It With Fire VR, Lost Recipes, MacacoVR, Maestro, Puzzling Places, Ragnarock, Scared By Squares and 1 more.
+- **Catalog games (6):** Dance Central, Kill It With Fire VR, Lost Recipes, MacacoVR, Maestro, Ragnarock.
 - **Suggested by launch-test signatures:**
   - `unreal-obb-check-stuck` (fatal): The game stays on Unreal's OBB check screen (DownloaderActivity), which the Frame doesn't show, and never starts VR (for example Contractors, GitHub #159).
 - **Source:** [patches/frame/unreal_obb_check.py](../src/frameport/patches/frame/unreal_obb_check.py)
@@ -1217,19 +1139,6 @@ Makes the hands' thumbs follow what your thumb touches (they always pointed up:
 
 > Unreal 4's Oculus input sets the ThumbUp axis (games animate the hand's thumb with it) from Meta's near-touch sensing, which the Frame never reports: the thumb always points up. Uses the touches instead (left X/Y/stick/thumb rest, right A/B/stick/thumb rest). Changes three instructions in OculusInput::SendControllerEvents, only where the code matches exactly (UE4 Oculus games of one engine generation, for example Vader Immortal, Robo Recall). Found by Klownicle (GitHub #49).
 
-### <a id="frame-usb_midi_watcher"></a>USB MIDI: don't poll for USB devices
-
-Lets apps with a USB MIDI driver start on the Frame (they'd crash looking for USB devices); USB MIDI devices aren't available there.
-
-- `frame.usb_midi_watcher` · also for 2D apps
-- **Changes:** Changes the APK (a rebuild and reinstall apply it).
-- **Suggested (on):** kshoji's USB MIDI driver polls Android's USB service, which the Frame's Android lacks: the app would crash a few seconds after start.
-- **Suggested by launch-test signatures:**
-  - `usb-midi-watcher` (fatal): The app's USB MIDI driver (kshoji's, used by Unity MIDI plugins, for example PianoVision) asked Android's USB service for MIDI devices; the Frame's Android has no USB service, so the app crashed.
-- **Source:** [patches/frame/usb_midi_watcher.py](../src/frameport/patches/frame/usb_midi_watcher.py)
-
-> kshoji's USB MIDI driver (Unity MIDI plugins, for example PianoVision) polls Android's USB service for MIDI devices; the Frame's Android has no USB service, so the app crashes a few seconds after start (NullPointerException on MidiDeviceConnectionWatchThread). The poll returns at once instead, so no USB MIDI device is ever found (an in-place edit of classes.dex).
-
 ### <a id="frame-vermillion_scene_canvas"></a>Vermillion: paint canvases in the scene
 
 Keeps the hand and brush visible over Vermillion's painting canvas (the canvas is drawn in the scene instead of as a layer in front).
@@ -1310,7 +1219,7 @@ Repairs shaders that hang the graphics chip at certain effects, from the game's
 - `frame.zink_shader_fix`
 - **Changes:** Changes the APK (a rebuild and reinstall apply it).
 - **Suggested:** not automatically; set on the game page (Customize), by a recipe or after a launch test.
-- **Catalog games (2):** Star Wars: Tales from the Galaxy's Edge, Vader Immortal: Episode I.
+- **Catalog games (1):** Vader Immortal: Episode I.
 - **Source:** [patches/frame/zink_shader_fix.py](../src/frameport/patches/frame/zink_shader_fix.py)
 
 > Loads FramePort's shader-fix Vulkan layer into an OpenGL ES game. On the Frame, OpenGL ES runs on Zink (Mesa's GL on Vulkan); the layer sits between Zink and the driver and inserts the words of the adapter setting zink_shader_fix into the SPIR-V modules whose size and SHA-256 match (every other module is untouched), for example stores that set loop counters and accumulators a shader reads before writing, which hang the GPU (Vader Immortal's lightspeed jump; found by Klownicle, GitHub #49). Does nothing without zink_shader_fix (or zink_shader_dump) in the recipe. The layer adds itself to Android's Vulkan debug layer list for the game's process only.
@@ -1319,20 +1228,6 @@ Repairs shaders that hang the graphics chip at certain effects, from the game's
 
 Settings of FrameBridge, FramePort's OpenXR layer inside every converted Quest game. Most can be changed on the Frame later without a rebuild (game page → Game settings).
 
-### <a id="adapter-action_dedup"></a>Unique controller action names
-
-Stops games from dropping back to the home environment at start because two of their controller actions share a name (for example Scared By Squares). Leave it on.
-
-- `adapter.action_dedup`
-- **Changes:** Game setting: stored in the build and on the Frame (settings.conf); can be changed without a rebuild.
-- **Suggested:** not automatically; set on the game page (Customize), by a recipe or after a launch test.
-- **Options:**
-  - Value: int, default `1`.
-  - Game settings → Troubleshooting → "Unique controller action names" (advanced).
-- **Source:** [patches/settings.py](../src/frameport/patches/settings.py)
-
-> Gives a controller action whose name already exists in its action set a free name ("turn" -&gt; "turn_2"). The Frame's runtime accepts duplicate names but then can't load the game's input manifest and treats the game as closed: black, then the home environment while the game keeps running with sound (for example Scared By Squares, whose Unreal project has an action and an axis both called Turn; GitHub #323).
-
 ### <a id="adapter-aim_forward"></a>Pointer start
 
 Moves where the pointer starts, forward or back.
@@ -1375,20 +1270,6 @@ Turns the pointer left or right.
 
 > Turns the controllers' pointing ray left (+) or right (−).
 
-### <a id="adapter-alpha_blend_emul"></a>Fix inside-out mixed reality
-
-For games that show your room on their objects and darkness where your room should be.
-
-- `adapter.alpha_blend_emul`
-- **Changes:** Game setting: stored in the build and on the Frame (settings.conf); can be changed without a rebuild.
-- **Suggested:** not automatically; set on the game page (Customize), by a recipe or after a launch test.
-- **Options:**
-  - Value: int, default `1`.
-  - Game settings → Mixed reality → "Fix inside-out mixed reality" (advanced); shown while `adapter.passthrough_emul` is on.
-- **Source:** [patches/settings.py](../src/frameport/patches/settings.py)
-
-> With emulated passthrough, honours the eye layer's XR_FB_composition_layer_alpha_blend, which the Frame's runtime ignores: Unreal games keep inverted alpha and ask for inverse blending, so the room showed where the game drew and black where it should show the room (for example Star Wars: Beyond Victory). The alpha is inverted in the game's image before it is composited (Vulkan).
-
 ### <a id="adapter-controller_fix"></a>Use controllers
 
 Turn off only for games you play with your hands instead of controllers.
@@ -1459,7 +1340,7 @@ Video players' virtual theaters and 360° videos would otherwise stay black.
 - **Options:**
   - Value: int, default `0`.
   - Game settings → 360° pictures and video → "Show 360° backgrounds and videos".
-- **Catalog games (7):** 4XVR Video Player, EndoparasiticVR, Into The Radius 2, Pinball FX VR, Puzzling Places, Riven, Tea For God.
+- **Catalog games (5):** 4XVR Video Player, Into The Radius 2, Pinball FX VR, Riven, Tea For God.
 - **Suggested by launch-test signatures:**
   - `equirect-layers-dropped` (warning): The game's 360° pictures (for example a video player's theater or 360° videos) are missing because the Frame's runtime can't show equirect layers.
 - **Source:** [patches/settings.py](../src/frameport/patches/settings.py)
@@ -1740,7 +1621,7 @@ Logs details when flat panels stay black. No effect on the game.
   - Game settings → Troubleshooting → "Flat panel diagnostics (log)" (advanced).
 - **Source:** [patches/settings.py](../src/frameport/patches/settings.py)
 
-> Diagnostics for frame.gl_multiview_fbo: checks for GL errors after every single-view draw of a multiview shader and logs counters every 5 seconds (tag GLMV in launch.log). 2 (frameport settings) also checks every draw and logs the draw state, failed texture uploads and shader compiles and, for idTech 4 engines, the game clock.
+> Diagnostics for frame.gl_multiview_fbo: checks for GL errors after every single-view draw of a multiview shader and logs counters every 5 seconds (tag GLMV in launch.log).
 
 ### <a id="adapter-haptic_fix"></a>Fix freezes when controllers vibrate
 
@@ -1752,7 +1633,7 @@ For games that freeze the Frame when a controller vibrates (for example Lucky's
 - **Options:**
   - Value: int, default `0`.
   - Game settings → Controllers → "Fix freezes when controllers vibrate" (advanced).
-- **Catalog games (94):** AgeOfJoy, Ancient_Dungeon, Attack on Titan VR: Unbreakable, Audica, AugmentedEmpire, Battlemarked, BattleSisters, Beat Saber and 86 more.
+- **Catalog games (88):** AgeOfJoy, Ancient_Dungeon, Attack on Titan VR: Unbreakable, Audica, AugmentedEmpire, Battlemarked, BattleSisters, Beat Saber and 80 more.
 - **Source:** [patches/settings.py](../src/frameport/patches/settings.py)
 
 > Routes OVRPlugin through FramePort's extension shim, which turns Meta's amplitude-envelope vibrations into plain ones: OVRPort's loader reads their nanosecond duration as seconds and allocates gigabytes, freezing the Frame when the game vibrates a controller (for example Lucky's Tale's save slots, GitHub #9). Needs a rebuild.
@@ -1771,22 +1652,6 @@ Turn it down if controller vibrations are too strong.
 
 > Scales every controller vibration the game asks for (0-1): plain vibrations, Meta's amplitude envelopes and PCM buffers. For games whose vibrations feel much stronger than on a Quest.
 
-### <a id="adapter-hide_fb_foveation"></a>Turn off Quest Vulkan foveation
-
-Diagnostic for Vulkan games that fail on their first frames with missing Quest foveation images.
-
-- `adapter.hide_fb_foveation`
-- **Changes:** Game setting: stored in the build and on the Frame (settings.conf); can be changed without a rebuild.
-- **Suggested:** not automatically; set on the game page (Customize), by a recipe or after a launch test.
-- **Options:**
-  - Value: int, default `0`.
-  - Game settings → Troubleshooting → "Turn off Quest Vulkan foveation" (advanced).
-- **Suggested by launch-test signatures:**
-  - `quest-foveation-image-missing` (info): OVRPlugin enabled Quest Vulkan foveation but received no density image.
-- **Source:** [patches/settings.py](../src/frameport/patches/settings.py)
-
-> Hides Quest FB foveation extensions from the game and OVRPort, removes Vulkan foveation image/create chains, and refuses foveation profile updates. Diagnostic for first-frame failures with missing density images (for example Transformers Beyond Reality: Redux). Device verification pending; does not disable Valve foveation.
-
 ### <a id="adapter-hide_space_warp"></a>Turn off space warp
 
 For games whose picture flickers or smears (for example Into The Radius 2).
@@ -1946,7 +1811,7 @@ For games whose hands trail the controllers when you move them (for example Batt
 - **Options:**
   - Value: int, default `0`.
   - Game settings → Controllers → "Fix hands lagging behind controllers" (advanced).
-- **Catalog games (15):** Battlemarked, BattleSisters, Beat Saber, Dance Central, Dungeons of Eternity, Mini Motor Racing X, OrbusVR, Phantom: Covert Ops and 7 more.
+- **Catalog games (14):** Battlemarked, BattleSisters, Beat Saber, Dance Central, Dungeons of Eternity, Mini Motor Racing X, Phantom: Covert Ops, Quantum Void and 6 more.
 - **Source:** [patches/settings.py](../src/frameport/patches/settings.py)
 
 > Poses a game asks for at a CLOCK_MONOTONIC time, or more than 0.5 s before the frame's display time, are located at the same moment in the runtime's time (or now). Meta's OVRPlugin passes the monotonic clock on as the OpenXR time, which on the Frame runs seconds behind the runtime's clock, so its "now" poses (Unity's physics step, controller poses) came from the past: hands trailing the controllers (for example BattleSisters, Sniper Elite VR).
@@ -1963,7 +1828,7 @@ For apps that only know Quest 3/Pro controllers: without it they get no buttons.
   - Game settings → Controllers → "Treat newer Quest controllers as Touch" (advanced).
 - **Source:** [patches/settings.py](../src/frameport/patches/settings.py)
 
-> Apps that suggest controller bindings only for Meta's newer profiles (Touch Plus, Touch Pro), which the Frame's runtime rejects (XR_ERROR_PATH_UNSUPPORTED), get the same bindings as oculus/touch_controller instead (components Touch lacks are dropped), and the runtime's answer for each hand is reported to them as their own profile (Unity's OpenXR input only connects controllers of a profile it knows). Meta's detached-controller paths (XR_META_detached_controllers, which the Frame lacks) are left out of the app's actions and bindings: one such path made Unity attach no controller input at all. Without it such apps get no controller input.
+> Apps that suggest controller bindings only for Meta's newer profiles (Touch Plus, Touch Pro), which the Frame's runtime rejects (XR_ERROR_PATH_UNSUPPORTED), get the same bindings as oculus/touch_controller instead (components Touch lacks are dropped). Without it such apps get no controller input.
 
 ### <a id="adapter-proximity_emul"></a>Animate fingers from touch
 
@@ -1981,7 +1846,7 @@ For games whose hands' thumbs never move when you touch the buttons or thumbstic
 
 ### <a id="adapter-rect_clamp"></a>Keep pictures in bounds
 
-Stops games from hanging when their eye picture is a little too big or empty (for example PowerWash Simulator). Leave it on.
+Stops games from hanging when their eye picture is a little too big (for example PowerWash Simulator). Leave it on.
 
 - `adapter.rect_clamp`
 - **Changes:** Game setting: stored in the build and on the Frame (settings.conf); can be changed without a rebuild.
@@ -1991,7 +1856,7 @@ Stops games from hanging when their eye picture is a little too big or empty (fo
   - Game settings → Troubleshooting → "Keep pictures in bounds" (advanced).
 - **Source:** [patches/settings.py](../src/frameport/patches/settings.py)
 
-> Keeps every submitted image rect inside its swapchain. Unity can size the eye area a few pixels past the image on some Frames; SteamVR then rejects every frame (xrEndFrame -25, XR_ERROR_SWAPCHAIN_RECT_INVALID) and the game stops drawing (for example PowerWash Simulator stuck at "Waiting"). An empty rect (0x0, e.g. BattleTalent's first frames, GitHub #293) is rejected the same way and becomes the whole swapchain image.
+> Keeps every submitted image rect inside its swapchain. Unity can size the eye area a few pixels past the image on some Frames; SteamVR then rejects every frame (xrEndFrame -25, XR_ERROR_SWAPCHAIN_RECT_INVALID) and the game stops drawing (for example PowerWash Simulator stuck at "Waiting").
 
 ### <a id="adapter-refresh_rate"></a>Refresh rate
 
@@ -2006,7 +1871,7 @@ How often the picture updates. Higher is smoother if the game can keep up.
 - **Catalog games (3):** Does it Stack?, Majora's Mask VR, Vacation Simulator.
 - **Source:** [patches/settings.py](../src/frameport/patches/settings.py)
 
-> Display refresh rate for this game (72, 80, 90, 96, 108, 120 or 144; 0 = the game's choice). Applied through SteamVR before the game starts. A video's frame rate that divides the refresh rate plays smoothest (for example 30 fps at 90 Hz, 24 fps at 72 Hz).
+> Display refresh rate for this game (72, 80, 90, 96, 108, 120 or 144; 0 = the game's choice). A video's frame rate that divides the refresh rate plays smoothest (for example 30 fps at 90 Hz, 24 fps at 72 Hz).
 
 ### <a id="adapter-release_wait"></a>Wait for the game's GPU
 
@@ -2046,7 +1911,7 @@ Higher looks sharper but needs more power; lower runs smoother. 1.0× is the gam
 - **Options:**
   - Value: float, default `1.0` (always written).
   - Game settings → Picture → "Sharpness": slider 0.5–2 in steps of 0.1.
-- **Catalog games (8):** 4XVR Video Player, BlazeRush, cubism, FGO VR, I Expect You To Die 2, The 7th Guest VR, Vampire: The Masquerade - Justice, Walkabout Mini Golf.
+- **Catalog games (4):** 4XVR Video Player, BlazeRush, cubism, Walkabout Mini Golf.
 - **Source:** [patches/settings.py](../src/frameport/patches/settings.py)
 
 > Multiplies the recommended eye-buffer width and height (0.5–2.0). 1.5 ≈ 2.25× pixels.
@@ -2065,23 +1930,23 @@ Higher looks sharper but needs more power; lower runs smoother. 1.0× is the gam
 
 > Override the guardian depth (0 = use guardian, min 1.5 m).
 
-### <a id="adapter-scene_emul"></a>Pretend room layout
+### <a id="adapter-scene_emul"></a>Use room layout
 
-Mixed-reality games that build their level from your room get a simple room with walls.
+Scene games get your saved room. Without one, they get a simple room from the play area.
 
 - `adapter.scene_emul`
 - **Changes:** Game setting: stored in the build and on the Frame (settings.conf); can be changed without a rebuild.
-- **Suggested (on), value `1`:** Mixed-reality game that builds its level from the room model: emulate a guardian-sized room (for example Demeter).
-- **Suggested (on), value `1`:** The game asks Meta's system for your room layout (scene), which the Frame doesn't have: emulate a room from the play area (for example VR HOT's room setup).
+- **Suggested (on), value `1`:** The game uses Meta's scene or spatial anchor APIs: serve the saved room on the Frame, or a simple play-area room until one is scanned.
 - **Options:**
   - Value: int, default `0`.
-  - Game settings → Mixed reality → "Pretend room layout".
-- **Catalog games (11):** Arkio, AugmentedEmpire, Battlemarked, Demeo, Demeter, Ghostbusters: Rise of the Ghost Lord, Neko Atsume Purrfect, Ocean Rift and 3 more.
+  - Game settings → Mixed reality → "Use room layout".
+- **Catalog games (13):** Arkio, AugmentedEmpire, Battlemarked, Demeo, Demeter, Ghostbusters: Rise of the Ghost Lord, Neko Atsume Purrfect, NOPE CHALLENGE and 5 more.
 - **Suggested by launch-test signatures:**
+  - `mr-discovery-unsupported` (warning): The game cannot discover a Meta room.
   - `scene-missing` (warning): The game wants Meta's room data (scene API), which the Frame lacks.
 - **Source:** [patches/settings.py](../src/frameport/patches/settings.py)
 
-> Fake XR_FB_scene/spatial entities: a guardian-sized room with floor, ceiling and four walls, for mixed-reality games that build their level from the room (for example Demeter).
+> Serve Meta scene and spatial entity APIs from the saved room (walls, furniture and mesh). Without a saved room, use a simple play-area box (for example Demeter).
 
 ### <a id="adapter-scene_height"></a>Room height
 
@@ -2262,20 +2127,6 @@ For Unreal Engine 5 games that crash on the Frame (for example Metro Awakening).
 
 > Vulkan shim (frame.vk_sanitize): the game doesn't see VK_EXT_fragment_density_map(2). Unreal Engine 5 turns on fragment-density-map foveation when the driver offers it and expects the density map from the headset, which the Frame doesn't provide: image views and barriers for a missing image, then a crash in the Frame's Vulkan driver (for example Metro Awakening). Valve's own foveation layer isn't affected.
 
-### <a id="adapter-vk_pipeline_log"></a>Vulkan pipeline failures (log)
-
-Logs graphics pipelines the Frame's driver refuses. No effect on the game.
-
-- `adapter.vk_pipeline_log`
-- **Changes:** Game setting: stored in the build and on the Frame (settings.conf); can be changed without a rebuild.
-- **Suggested:** not automatically; set on the game page (Customize), by a recipe or after a launch test.
-- **Options:**
-  - Value: int, default `0`.
-  - Game settings → Troubleshooting → "Vulkan pipeline failures (log)" (advanced).
-- **Source:** [patches/settings.py](../src/frameport/patches/settings.py)
-
-> Vulkan shim (frame.vk_sanitize): logs every failing graphics/compute pipeline creation with its shader stages (named like the vk_shader_dump files), structure types and any sampler Y'CbCr conversion involved, to find the pipeline behind Unreal's "Shader compilation failures are Fatal." No effect on the game.
-
 ### <a id="adapter-vk_query_slots"></a>Stop objects popping in and out
 
 For Vulkan games whose models flicker or vanish while you look at them (for example Into The Radius 2). Needs a rebuild.
@@ -2379,7 +2230,7 @@ Repairs OpenGL ES shaders that hang the graphics chip, from the game's recipe.
 - **Options:**
   - Value: str, default empty.
   - Not in the Game settings dialog (set by a recipe or the CLI).
-- **Catalog games (2):** Star Wars: Tales from the Galaxy's Edge, Vader Immortal: Episode I.
+- **Catalog games (1):** Vader Immortal: Episode I.
 - **Source:** [patches/settings.py](../src/frameport/patches/settings.py)
 
 > Shader-fix Vulkan layer (frame.zink_shader_fix) for OpenGL ES games, whose GLSL the Frame's GL driver (Zink) turns into SPIR-V: modules matching size + SHA-256 get words inserted at a byte offset, for example stores that set loop counters and accumulators a shader reads before writing (Vader Immortal's lightspeed jump hung the GPU; found by Klownicle, GitHub #49). Same format as vk_shader_fix. Comes from a game's recipe; the driver's output can change with a Frame update, then the fix no longer matches (logged).
@@ -2437,7 +2288,7 @@ Render less detail outside your gaze; adjust the full-resolution area or darken
   - `mode`: str, default empty — tracked, fixed or off (empty = Valve's default)
   - `radius`: float, default `0.0`, 0–0.45 — Full-resolution radius; 0 keeps the current runtime default
   - `test`: bool, default `False` — Darken lower-resolution regions (diagnostic)
-- **Catalog games (5):** Ocean Rift, Quantum Void, Tea For God, The 7th Guest VR, Vampire: The Masquerade - Justice.
+- **Catalog games (3):** Ocean Rift, Quantum Void, Tea For God.
 - **Source:** [patches/settings.py](../src/frameport/patches/settings.py)
 
 > Reduces shading away from the full-resolution area, following each eye's gaze. Default area size keeps the runtime's current profile unchanged. Custom radius is a fraction of the shorter eye-image dimension; the transition ends at twice that radius. Larger areas retain more detail but save less GPU work. Fixed stops the area following your eyes. The optional test darkens actual coarse-shaded fragments; rebuild/reinstall to toggle it. Tested on RE4, Deadpool and Asgard's Wrath 2. The Climb 2 gets a version-guarded private bridge at 1.0 scale; Batman gets its hash-verified allocation fix (unsupported OVRPlugin versions are refused). Other games may need additional fixes; turn this off if artifacts appear.
@@ -2484,7 +2335,7 @@ Lets typing reach this app from Steam's on-screen keyboard or your PC's keyboard
 - `device.text_input_window`
 - **Changes:** Install only: written on the Frame when the game is installed; the APK isn't changed.
 - **Suggested (on):** App with text fields: key presses only reach a shown Android window.
-- **Catalog games (112):** AFFECTED: The Manor, AgeOfJoy, AllInOneSports, Ancient_Dungeon, Arcsmith, Arkio, Assassin's Creed Nexus, Attack on Titan VR: Unbreakable and 104 more.
+- **Catalog games (110):** AFFECTED: The Manor, AgeOfJoy, AllInOneSports, Ancient_Dungeon, Arcsmith, Arkio, Assassin's Creed Nexus, Attack on Titan VR: Unbreakable and 102 more.
 - **Source:** [patches/settings.py](../src/frameport/patches/settings.py)
 
 > Lepton runs VR apps headless: their Android window is never shown, so it never gets keyboard focus and no key press (Steam's on-screen keyboard, a USB/Bluetooth keyboard, Type on Frame) reaches the app's text fields. With Lepton's lepton-show-flatscreen marker the window is shown (behind the VR view, which keeps working) and Steam's keyboard opens for a selected text field. Steam lists the shown window as "Gamescope" (the Frame's compositor). Pairs with "Make Unity text fields work without a system keyboard".

docs/PLAYBOOK.md

@@ -21,14 +21,11 @@ version is `catalog/triage.yaml` (used by `frameport test` / the Job screen); ke
 | A launch test suggests a patch (for example triage `sdl-no-clipboard` → `frame.sdl_clipboard`) but the game page doesn't show it / lists it as not applicable; or a game added long ago lacks warnings newer ones get (Android version, web wrapper, missing OBB) (GitHub #104, Dramatic Shape) | the library entry was analyzed by an older FramePort: the analysis field the patch reads (`sdl_java`, `min_sdk`, `web_wrapper`, `expects_obb`, …) is missing, so `applies()` is false | entries whose `analysis.extra.analysis_version` is below `detect.ANALYSIS_VERSION` are analyzed again at the GUI's start (background) and before a build (`pipeline.refresh_analyses`); by hand: game menu → "Analyze again", then Update on Frame. An unreadable APK is marked `analysis_failed` (retried after the next version bump). Adding an analysis field: bump `ANALYSIS_VERSION` |
 | FDM layer loads but diagnostic logging reports `fdm_injection_CreateInstance: skipped` | Layer loading alone does not enable injection on the tested SteamOS 0.4.5 build; a skipped helper instance alone also does not establish game-wide inactivity | Opt-in `device.foveation` mode `tracked`: loads Valve's layer and sets `FDM_DEBUG=enable`. Batman probe reached foveated render passes with changing per-eye offsets. Validate graphics and matched gameplay GPU time; do not enable globally. Use `debug` only for brief diagnostics, preserving existing flags; never benchmark with debug spam. See FRAME_RUNTIME.md. |
 | One eye (usually the right) shimmers or jitters in the 3D view while menus and panels look steady; pacing is clean (GitHub #69, e.g. RTCWQuest, Moss) | Valve's eye-tracked foveation layer (`VALVE_fdm_injection`) moves its low-density regions with each eye's gaze, and the right eye's gaze filter restarts often (`CEyePoseUKF R: Large dt … Bootstrapped` in `~/.local/share/Steam/logs/eyetracking.txt`) | Customize → "Eye-tracked foveation (Valve)" (`device.foveation`): **Fixed** (`FDM_DEBUG=disable_offsets`; verify injection remains active on the installed runtime) or **Off** (`VK_INSTANCE_LAYERS=""`); catalog field `foveation:` |
-| With `device.foveation` Eye-tracked/Fixed, the sharp area looks right but everything around it is black with scattered coloured blocks (menus on quads too); pacing fine (GitHub #303, Medieval Dynasty; Vampire Survivors reported the same) | Unity's Oculus XR plugin asks for SUBSAMPLED eye images (`XR_META_vulkan_swapchain_create_info`, `VK_IMAGE_CREATE_SUBSAMPLED_BIT_EXT`); under Valve's FDM their coarse areas stay in the compact subsampled layout, which the compositor reads as an ordinary image. `foveation_fix=1` only dropped the `XrSwapchainCreateInfoFoveationFB` nodes and passed the META node on. With `foveation_fix=0` + `foveation_storage_fix=1` the adapter logs `foveation_storage_fix: shared allocation SUBSAMPLED cleared` for the eye swapchains | `device.foveation` (tracked/fixed) now also sets `foveation_storage_fix=1`, which clears SUBSAMPLED whatever `foveation_fix` is (generic version of Batman's OVRPlugin allocation fix). Rebuild + reinstall (new adapter). Headless-checked only (72 fps, bit cleared); picture needs the headset |
 | A Unity OpenXR game closes right after the OpenXR instance is created: `F VrApiLoader: vrapi_SetPropertyInt was called before vrapi_Initialize()!`, SIGABRT on UnityMain (GitHub #62, Jurassic World Aftermath) | the APK still ships Meta's VrApi loader; OVRPlugin (1.89, on OpenXR) calls it without starting VrApi and Meta's loader aborts. The VrApi bridge can't replace it (39 of the loader's 114 functions: OVRPlugin wouldn't link) | `frame.vrapi_stub` (same exports, each returns 0); triage `vrapi-before-init` |
 | A VrApi game exits at once: `UnsatisfiedLinkError … dlopen failed: cannot locate symbol "vrapi_PollEvent"` (GitHub #57, BlazeRush) | the engine imports a VrApi function the VrApi bridge didn't implement | the bridge has `vrapi_PollEvent`, `RecenterPose`, `SetDisplayRefreshRate`, `GetSystemPropertyFloatArray` (rebuild the game); the static check "VrApi functions resolvable" names any other missing one; triage `vrapi-symbol-missing` |
 | A Team Beef port (Lambda1VR, RTCWQuest, …) exits at once: `UnsatisfiedLinkError: dlopen failed: library "libopenxr_loader_valve.so" not found` (GitHub #59) | TBXR loads `openxr_loader_<Build.MANUFACTURER>` (Lepton: valve) and takes the Meta path only when `strstr(OPENXR_HMD, "meta")` matches, else Pico's | `frame.tbxr_vendor` (empty `libopenxr_loader_valve.so` + the "meta" literal → "alve"). Game data (`xash/`, …) goes to /sdcard: upload it with the Files tab to the game's storage. Black eyes with `TBXR: Incomplete frame buffer object: GL_FRAMEBUFFER_INCOMPLETE_MULTISAMPLE`: TBXR always uses multisampled render-to-texture (even `--msaa 1`); `frame.tbxr_vendor` links the GL shim, which hands it single-sampled versions (log `GL shim: multisampled render-to-texture … drawn single-sampled`) |
 | A Quest game renders, then logs `Entitlement check failed` / `ovrPlatformInitialize_NotEntitled` (often with retries) and quits, e.g. `SIG: 9` after `[Photon] Disconnected` (GitHub #322, Deadly Delivery) | The game's Meta licence check (entitlement) needs Meta's online login, which the Frame doesn't have; online-only games quit (triage `meta-entitlement`) | None: FramePort doesn't get around entitlement checks. Offline games that log it and play on are fine |
 | Black screen after VR starts; `Asset status error  (code 100)` in `DLC_Manager:AssetStatusCallback` (GitHub #203, e.g. PixelRipped 1995) | Meta asset-file status fails after entitlement succeeds; the log does not identify the native call or asset ID | Try `frame.asset_files_stub` (opt-in, triage-only): native/langpack answers GetList with an empty successful list and StatusById with installed status, an empty path and the requested ID. No DLC files are supplied; download requests retain their existing behavior. Disable with `FRAMEPORT_ASSET_FILES_STUB=0`. Host-tested only; whether this fixes startup needs a game/device test |
-| A Unity Quest game stays on a loading screen or doesn't go on; `An unknown error occurred. Request failed.` from `Oculus.Platform.Request`1:OnComplete` (GitHub #346 Eleven, #360 Spectre, #368 Thief Simulator; triage `meta-request-failed`) | A Meta platform call the game waits for got no usable answer: OVRPort's platform library answers some calls without Meta's services (request id 0) and Meta's Unity wrapper drops the callback | Find the call in the stack (the game's own coroutine after `OnComplete`); a per-game fix that skips it when it isn't needed to play (e.g. an analytics id request). Calls the game needs online stay unsupported |
-| Game aborts at start: `OVRPlatform-Loader: DisplayErrorAndExit: Failed to launch SystemActivities` after an `ActivityNotFoundException` stack (GitHub #357 Breachers; triage `meta-system-activities`) | The game ships its own renamed copy of Meta's platform loader (e.g. `libovr_custom.so`), which bypasses OVRPort's dispatcher and tries to open Meta's system activities (Horizon OS) | None in general: such games are online games built on Meta's services. Serving OVRPort's dispatcher under that name is possible but unlikely to make them playable |
 | Missing sound or extra content in a game whose OBB folder has separate `*.pak` files (GitHub #61, Star Wars: Tales from the Galaxy's Edge: seasons + Wwise banks) | the game asks Meta's platform for these asset files (`ovr_AssetFile_GetList` / `DownloadById`); OVRPort's loader doesn't list them | copy every content/sound-bank PAK and use `frame.asset_files` (native/langpack lists the data's `*.pak` as installed `default` assets, IAP `free`, and answers DownloadById at once with the path; off: env FRAMEPORT_ASSET_FILES=0). Tales also needs the splash and depth-size fixes below |
 | A SideQuest backup has `apk/` and a sibling `obb/` with content/sound-bank PAKs, but the Frame only has the main OBB (GitHub #61, Tales from the Galaxy's Edge) | older scans treated that layout as loose expansion files and selected only the named OBBs; the asset-file patch then found no PAKs | the scanner chooses the OBB folder by version first, then keeps the whole sibling data folder when all its expansion files are selected for this APK; app updates repair affected library entries and refresh asset/language-pack detection. Reinstall to copy the missing files, or scan the backup again first. Folders with other packages or unselected OBB versions still send only the selected OBBs |
 | Tales from the Galaxy's Edge stops during map loading (GitHub #61): game thread in `FlushRenderingCommands` / `UEngine::LoadMap`, render thread in `FSplash::RenderFrame_RenderThread` / `ovrp_WaitToBeginFrame` / SteamVR `WaitFrame` | the separate Oculus loading splash waits for an unbegun frame while map travel waits for rendering | `frame.unreal_splash_bypass`: returns from the splash renderer, with a checked symbol, size and prologue. The last image stays visible during loading; the normal renderer and menu layers continue. Headset test with the depth-size fix: gameplay, both eyes, controller input and sound work |
@@ -48,7 +45,6 @@ version is `catalog/triage.yaml` (used by `frameport test` / the Job screen); ke
 | Launch test "failed" although the game runs in the headset: frames paced, then `OVRPortVrApi: EnterVrMode: no tracked head pose before deadline`, then a crash (e.g. `zink: DEVICE LOST` + SIGSEGV in a `gdrv` thread) (GitHub #57, BlazeRush) | the VrApi bridge ends the VR session after 30 s without head tracking, which only happens without a worn headset; the game's renderer then crashes while tearing down | none needed: launch tests (`triage(..., headless=True)`) treat an exit or crash after a `headless_end` line (catalog/triage.yaml) as a pass when frames were paced before it (info finding `headless-end`); play sessions ignore it. Add new such markers to `headless_end` |
 | Launch test EXITED, launch.log has `Target app (<pkg>) did not start` and no `Start proc …:<pkg>` (GitHub #179) | Lepton occasionally doesn't start the app on the first start after an APK change; Android's `WebViewLoader-: System.exit` at boot is not the game (triage `app-not-started`) | start it again |
 | A game keeps no progress between starts although it saves (its storage gets a new `Profiles/Oculus/<id>/`-style folder per start; Walkabout Mini Golf, GitHub #182) | OVRPort's platform loader answers `ovr_GetLoggedInUserID` with a made-up id (6e18 + `random()`), new at every start; games file saves under the user id | `frame.ovr_stable_user` (default for games with the platform library): a fixed id per game and keystore. Old progress: copy the newest old profile into the new id's folder |
-| A Cortopia game (Escaping Wonderland, GitHub #360) stays on its loading screen (frames paced); launch.log: `E Unity: An unknown error occurred. Request failed.` with `OculusPlatformExtension:ToUniTask` / `Cortopia.Scripts.Platform.Meta.<Initialize>d__13` | after the licence check and the logged-in user, the game asks for `Users.GetOrgScopedID` when on Wi-Fi (its analytics id); OVRPort's `ovr_User_GetOrgScopedID` returns request id 0, Meta's C# wrapper logs that line and never calls back, so the awaited start-up never finishes | `frame.cortopia_org_id` (suggested from the analysis, triage `cortopia-org-id-wait`): the `b.ne` after `cmp w0, #2` on `get_internetReachability` in `<Initialize>d__13.MoveNext` -> `b` (Cpp2IL), the game's own no-Wi-Fi path; the same "Request failed." line in another game = another request OVRPort doesn't implement |
 | A Unity app's text field shows a caret for a moment and loses focus; no keyboard appears (for example Stremio VR login) | Unity's TMP_InputField/InputField wait for Android's on-screen keyboard and close themselves without one (Lepton has none); headless VR apps also have no focused Android window, so no key press reaches them | `frame.unity_text_input` (Cpp2IL finds `TouchScreenKeyboardShouldBeUsed`/`isKeyboardUsingEvents`, rewritten to false/true) + `device.text_input_window` (lepton-show-flatscreen: Steam's keyboard and Type on Frame work) |
 | FramePort's games disappear after Steam restarts, especially after a devkit registration (GitHub #263) | Steam saves `Shortcuts` / `AppName` with capital letters; older FramePort reads them case-sensitively and writes a second shortcut map that Steam ignores | agent v86 reads and updates keys case-insensitively, keeping Steam's spelling, appids and tags; update FramePort and add the missing games to the library again |
 | Play gives Steam's "Game configuration unavailable"; Steam's console_log: `GameAction [AppID <id>] … RequestingLicense → UpdatingAppInfo → LaunchApp failed with AppError_9` | this Frame's Steam never loaded FramePort's shortcuts.vdf entry (it treats the id as a store app); see the casing fix above, other causes remain unconfirmed (GitHub #21/#30) | automatic since agent v43: Play registers the game through Steam's devkit interface ("Devkit Game: …", `devkit_register`) and starts that; uninstall removes it. Agent v58: a devkit entry Steam forgot after a restart is added again live on Play (no NOT_IN_LIBRARY → no Steam restart), and installs/art updates of devkit games only copy art (no Steam restart, GitHub #41) |
@@ -84,7 +80,6 @@ version is `catalog/triage.yaml` (used by `frameport test` / the Job screen); ke
 | Unreal game still stays on `DownloaderActivity` with CRC checking off (`bVerifyOBBOnStartUp=false`) and a fully uploaded matching OBB (GitHub #283, Into The Radius) | The separate Java `expansionFilesDelivered()` name and size gate can reject an OBB through Android external storage in Lepton; disabling CRC does not bypass it | Try `frame.unreal_skip_obb_delivery` (opt-in, experimental, triage-only). It returns true from known Unreal/package delivery predicates in every dex, preserving normal downloader success and main init. Analysis `unreal_obb_delivery` (version 16) controls applicability. The native engine still needs complete, matching, readable OBB data; unverified on a device |
 | `INSTALL_FAILED_NO_MATCHING_ABIS` | 32-bit-only APK (Gear VR / Go / early Quest); Frame has no AArch32 | `frame.a32_bridge` (suggested for every 32-bit-only APK, experimental): the a32 translator runs the game's 32-bit libraries inside the 64-bit app (native/a32translator/bridge) |
 | a32 bridge faults at a low Thumb PC while loading a library, with the same unrelocated pointer in `.init_array` (e.g. Journey of the Gods: `0x1259e9` in OVRPlugin) | The guest loader ignored the older `DT_ANDROID_RELR` / `DT_ANDROID_RELRSZ` tags, leaving relative pointers at their link addresses | Fixed in the guest loader: both Android and standard RELR tags use the existing RELR decoder. Rebuild the a32 runtime and APK; host regression tests cover both tag families, but game startup still needs a Frame run |
-| 32-bit game on the bridge quits right after its loading screen with `a32: block at 0x… overflowed the code buffer` (exit 127; Pinball FX2 VR, GitHub #342: OpenSSL's `sha1_block_data_order_armv8`, ~60 SHA-1 crypto instructions in a row, reached from `RAND_poll`) | Every instruction the JIT hands to the interpreter needs an exit stub; the translator only ended a block at 96 instructions or half its code buffer, so a dense run of such instructions overflowed the 64-entry stub table and `fatal()` ended the process | Fixed in the translator (jit.c `STUB_RESERVE`: a block ends while 8 stubs are left); rebuild the game. Find the code with the logged address minus the library's load address (`a32rt: loaded …`) and `A32_BREAK=<addr>` for its caller; `tests/programs/sha1ce.c` covers it |
 | 32-bit game on the bridge: framerate falls over minutes, purple/garbled geometry, then `Could not allocate memory: System out of memory!` (Spunky Dungeon) | The bridge's guest copies of mapped GL buffers were tracked per buffer target: a second buffer mapped on the same target lost the first one's copy (never written back: garbage vertices; never freed: ~10 MB/s until the guest's 4 GiB were full) | Fixed in the bridge (gl.c: mappings per buffer object). Check: the guest's `[anon:scudo:*]` maps below 4 GiB in /proc/<pid>/maps must stay flat |
 | 32-bit game on the bridge loads, leaves VR and its engine threads end, no crash, no finish() (Gunjack) | The game checks its own APK signature (UE4 `AndroidThunkJava_GetSignature` = Base64 of the signing certificate's SHA-1, compared in AndroidMain): every FramePort build is re-signed | `frame.a32_bridge` stores the original APK's value in `assets/fp_a32_signature.txt` (Unreal games) and the bridge answers the guest's call with it (log `AndroidThunkJava_GetSignature: original signature returned`). Find other such checks with `A32_BREAK` on the game's exit path (vrapi_LeaveVrMode logs its caller) |
 | 32-bit NativeActivity game on the bridge ignores every controller (Gunjack, UE 4.10 Gear VR: no vrapi input functions, it reads the Gear VR touchpad/back button as Android input events from its AInputQueue) | The bridge sent its controller events through `Activity.dispatchKeyEvent`, which a NativeActivity never passes to native code | input.c puts synthetic touchpad (motion, touchscreen source) and back-key events in front of the game's AInputQueue: `ALooper_pollAll/pollOnce` return the queue's ident while one waits, `AInputQueue_getEvent` hands it out, the AInputEvent/AKeyEvent/AMotionEvent imports answer for it. Right trigger = hold the touchpad, A = tap, right stick = swipe (up/down = swipe forward/back along the touchpad's X axis: Gunjack's `OnFlick` takes flick angles <45°/>315° as reload, 135-225° as special weapon), B/left menu = back (log `controllers: the game reads its AInputQueue`) |
@@ -92,7 +87,6 @@ version is `catalog/triage.yaml` (used by `frameport test` / the Job screen); ke
 | 32-bit Unity game on the bridge: player stands in the floor (Spunky Dungeon) | Unity's floor-level tracking origin: `vrapi_SetTrackingSpace(1)` (LOCAL_FLOOR) was ignored | The VrApi bridge puts the origin on the STAGE floor for LOCAL_FLOOR/STAGE |
 | Crash at start: `NoClassDefFoundError: … Landroid/window/OnBackInvokedCallback;` or `NoSuchMethodError: No static method storeStoreFence()V in class Ljava/lang/invoke/VarHandle;` (GitHub #71/#72, triage `android-too-new`) | The APK needs Android 13+ (minSdk 33 or more; those were 34) and calls its classes at start; Lepton's Android is 11 (API 30). OVRPort lowers minSdk to 29, so it installs anyway. minSdk ≤ 32 (Quest's Android 12L) is fine: 16 working catalog games declare 32 | None (analysis `extra.min_sdk` > 32 → a warning on the game page/CLI and in the recipe notes; never unsupported from the manifest alone, the launch test's triage decides). Waits for Valve to update Lepton's Android |
 | Nothing opens; `TWALauncherActivity: Using URL from Manifest (https://…)`, `Creating TwaLauncher for com.oculus.browser`, `NameNotFoundException: com.oculus.browser` (GitHub #86 Mahjong Table VR, triage `web-wrapper`) | The APK is a Trusted Web Activity (Bubblewrap / Meta's PWA packaging): a website that opens in Meta's browser, which Lepton doesn't have | None: open the URL in a browser. Analysis `extra.web_wrapper` (manifest meta-data `android.support.customtabs.trusted.DEFAULT_URL`, resolved through resources.arsc, or androidbrowserhelper's LauncherActivity) → a warning with the URL (not unsupported: the manifest alone never decides) |
-| A flat window, no VR and no way to interact; `Google VR Error [Daydream]: Google VR had a fatal issue while loading`, `class com/google/vr/sdk/base/CardboardViewNativeImpl not found` (32-bit bridge), `Unable to start service Intent { act=com.google.vr.vrcore.… }` (GitHub #335 Blade Runner: Revelations, triage `gvr-not-supported`) | A Google Daydream / Cardboard build: Google's VR SDK (GVR, `libgvr.so`) or the Cardboard SDK. Daydream needs Google's VrCore service, Cardboard draws a distorted side-by-side image for a phone screen; neither reaches OpenXR, the Frame's only way into the headset | None: get the game's Oculus build (Quest, Go or Gear VR), which goes through the normal path. Analysis `extra.google_vr` (`daydream`/`cardboard`: manifest categories `com.google.intent.category.DAYDREAM`/`CARDBOARD`, `enableVrMode="com.google.vr.vrcore/…"`, `libgvr.so`/Cardboard SDK libraries, GVR Java classes, Unity `vr-device-list`; not `libgvraudio.so`, which Quest games ship too) → a warning on the game page/CLI and in the recipe notes, only when the APK has no Oculus support; never unsupported from the manifest alone. A GVR → OpenXR shim (like the VrApi bridge) is possible in principle but not built |
 | `UnsatisfiedLinkError` / `cannot locate symbol "ovr_…"` | overport's platform loader lacks Meta platform functions | `frame.ovrstubs` (automatic, generated stubs) |
 | missing `ovrMessageType_ToString` | same, but the game needs a real string | `frame.ovrplatformcompat` (automatic) |
 | The game stays in its built-in language or waits at start although its OBB / files hold language packs (`<tag>.lang`, for example `de.lang`) | overport's platform loader answers `ovr_LanguagePack_GetCurrent/SetCurrent` with request id 0, so the game never gets the pack's path | `frame.langpacks` (opt-in, experimental, shown for games whose data has `*.lang`; `native/langpack`, build it with `python native/build.py --only langpack`). Default pack: the one the game applies, else env `FRAMEPORT_LANGPACK=<tag>`, else the only pack; search path override `FRAMEPORT_LANGPACK_DIRS`. Unreal games (Deadpool VR) gray out a pack whose asset `Metadata` differs from the game's version string: the patch writes the APK's versionName as Metadata (env `FRAMEPORT_LANGPACK_META` overrides) and reports the pack under the `/storage/emulated/0/Android/obb/<pkg>/` spelling of its path; with `/sdcard/…` the text switched but the dialogue stayed silent (verified in the headset with Deadpool VR) |
@@ -117,14 +111,11 @@ version is `catalog/triage.yaml` (used by `frameport test` / the Job screen); ke
 | Menu/screen jumps to where you look (for example 4XVR) | the app re-creates LOCAL spaces (4XVR: every 2–4 s) and the Frame places them at the current head yaw, or the app recenters after the Frame's brief focus dips | turn on `adapter.layer_debug`, check `that LOCAL space sits at … deg` vs `focus_hold: hid a … ms focus dip`; patches: `adapter.stable_local` (new LOCAL spaces line up with the first) / `adapter.focus_hold` (on by default: hides dips up to `focus_hold_ms` once the game has been focused for a second; never at start-up: a global debounce broke AC Nexus) |
 | Pointer misses menu items | the Frame's aim pose differs from Touch's | `adapter.layer_debug` logs `aim in grip … pitch/yaw`; correct with `aim_pitch`/`aim_yaw`/`aim_forward` (`frameport settings`, no rebuild) |
 | Video stutters although fps is steady | video frame rate doesn't divide the refresh rate (30 fps at 72 Hz) | `adapter.refresh_rate` (for example 90 for 30 fps, 72 for 24 fps); `layer_debug` logs the offered rates and the app's own requests |
-| A saved 90 Hz refresh setting still launches at 72 Hz (for example Jurassic World Aftermath); FrameBridge reads `refresh_rate=90` but logs result `-1000101000` | The Frame's OpenXR runtime only enumerates its current rate and rejects requests for another mode (`XR_ERROR_DISPLAY_REFRESH_RATE_UNSUPPORTED_FB`) | Agent v92 applies `adapter.refresh_rate` to SteamVR's per-game `preferredRefreshRate` through IVRSettings, on save/install and before Lepton starts (existing launchers upgrade on connection). `0` clears the override; unavailable SteamVR is retried at launch. Device-tested: Aftermath selected 90 Hz and sustained 90.2 fps |
 | PC VR game judders/stutters although the GPU keeps up; vrcompositor.txt "Timed out. N total" high or frames dropped | the game misses the headset's refresh (for example 96 Hz = 10.4 ms; Stormland's slow frames take 10.7 ms) | `pcvr.steamvr_tuning` (default on): next Play sets SteamVR per-app `preferredRefreshRate` + `motionSmoothingOverride` via `fp_vrsettings.exe` |
 | Quest app keeps recentering / snapping the view when you turn your head; log shows session state 5→4→3→4→5 within a second | the Frame briefly takes focus; the app recenters on focus changes | adapter `focus_hold` (on by default; an earlier global debounce made AC Nexus stay black and was removed) |
 | Video player / app finds no local videos; MediaProvider "Requested path /home/steamos/... doesn't appear under ..." | Lepton's /sdcard is a symlink to a host path, so Android's media index rejects every file | upload in the Files tab (Videos = /sdcard/Movies) and browse folders in the app |
 | Batman: Arkham Shadow closes during smoke-bomb effects; later input-tree corruption | Meta XR Audio Wwise deletes queued metadata still referenced by the current audio frame, then writes through the stale pointer | FrameBridge automatically retires metadata after current-frame references disappear, for the verified AArch64 SDK build only; see [AUDIO_METADATA.md](AUDIO_METADATA.md) |
 | Game stays on a loading or "Waiting" box although it reached FOCUSED; log `FrameBridge: xrEndFrame failed -25` then no more `pacing:` lines (for example PowerWash Simulator on some Frames, GitHub #39) | The eye image rect ends a few pixels past its swapchain (Unity rounds the swapchain width, the runtime's recommended size differs per Frame); SteamVR rejects every frame with XR_ERROR_SWAPCHAIN_RECT_INVALID | FrameBridge clamps every projection/quad image rect to its swapchain (`rect_clamp`, default on since 0.11.0; log `rect_clamp: view N image rect clamped`): rebuild + reinstall the game |
-| Black from the start, `projection view 0: ... rect=0,0 0x0` then `xrEndFrame failed -25` twice and OVRPlugin "Unable to submit Oculus frame" (BattleTalent, GitHub #293; right after Unity's "Switching to the recommended level" MSAA line) | The game submits its first projection views with an empty image rect; SteamVR rejects them and OVRPlugin gives up submitting | `rect_clamp` replaces an empty rect with the whole swapchain image (log `rect_clamp: view N empty image rect -> full swapchain WxH`): rebuild + reinstall. Check the build output for a WARN from the Unity IL2CPP fixes (`frame.unity_runtime_msaa_off` etc. "code not found in this game"): turned on, they may still change nothing |
-| Black flash, then the SteamVR home environment while the game keeps running (sound plays); vrserver.txt `[OpenXR] SetXrInputConfig failed. Failed to load manifest provided by SetXrInputConfig`, then the app "has exited" and reconnects as `VRApplication_OpenXRInstance`; headless launch tests pace at 10 fps (for example Scared By Squares, GitHub #323) | Two controller actions in one action set share a name (Unreal: an action mapping and an axis mapping both called "Turn"). The Frame's runtime accepts the duplicate but can't load the input manifest it builds and drops the app as a scene app | FrameBridge gives the later duplicate a free name (`action_dedup`, default on; log `action_dedup: action "turn" ("Turn") already exists in its set: created as "turn_2"`): rebuild + reinstall the game. `input_diag=1` logs every action set and action the game creates |
 | Unity game (OVRPlugin, GLES or Vulkan) crashes ~10 s in: `FrameBridge: xrCreateSwapchain … faces=6 … result=-2`, OVRPlugin `CreateSwapchain for eye 0: 0x0, 0 stages`, then render-thread SIGSEGV in memset ← libOVRPlugin ← `ovrp_EndFrame4` (libgallium/ANR follow; for example Budget Cuts Ultimate, GitHub #107); triage `cube-swapchain-refused` | The game shows a cube-map layer (OVROverlay cubemap); the Frame's runtime has no cube layers and refuses cube swapchains (XR_ERROR_RUNTIME_FAILURE); OVRPlugin doesn't check and writes into the image list it never got | FrameBridge `cube_standin` (default on): a refused cube swapchain is served as a GL cube map in the game's context or a device-local Vulkan cube image transitioned to COLOR_ATTACHMENT_OPTIMAL, and its layers are dropped (log `cube_standin: runtime refused …`): rebuild + reinstall. Vulkan path covers UNDERDOGS (GitHub #296); host-tested, headset verification pending |
 | Game (Unity, GLES) freezes, `zink: DEVICE LOST` | multisampled render-to-texture hangs the GPU | `frame.unity_no_msaa`; if it persists: unfixable → PC version |
 | Unreal GLES game crashes ~3 s after start: `Fatal signal 11 … fault addr 0x10000 in tid … (RHIThread)`, `#01 … libgallium_dri.so` (GitHub #83 Star Wars Pinball VR, triage `unreal-msrtt-crash`) | Unreal's mobile MSAA renders through multisampled render-to-texture; Zink's `find_rp_state` then indexes `rendering_state_cache[6]` one past its end (sample count ≥ 32) and calls a junk hash function (0x10000). Mesa bug (no bounds check) | `frame.unreal_gl_shim` (GL shim with `gl_hide_msrtt`, multiview kept for Unreal: Unreal 4.25 only enables multiview with GL_OVR_multiview, GL_OVR_multiview2 **and** GL_OVR_multiview_multisampled_render_to_texture, so the shim keeps the last one visible for Unreal and maps glFramebufferTextureMultisampleMultiviewOVR to the single-sampled glFramebufferTextureMultiviewOVR; log `multiview multisampled render-to-texture (N samples) drawn single-sampled`) |
@@ -145,17 +136,11 @@ version is `catalog/triage.yaml` (used by `frameport test` / the Job screen); ke
 | SDL / LÖVE app crashes at start: `NullPointerException … ClipboardManager.addPrimaryClipChangedListener` in `SDLClipboardHandler.<init>` (for example Dramatic Shape) | Lepton's Android has no clipboard service (`service check clipboard`: not found) | `frame.sdl_clipboard` (that call → nops in classes.dex, in place, `apk/dex.py`); reproduced and verified with LÖVE for Android 11.5 |
 | Godot 4 app crashes at start: `java.lang.NullPointerException: null cannot be cast to non-null type android.content.ClipboardManager` at `org.godotengine.godot.Godot.<init>` (Godot 4.3/4.4; 4.2 when the clipboard is first used, in `Godot$mClipboard$2.invoke`) (for example EndoparasiticVR, GitHub #134); triage `godot-no-clipboard` | Lepton's Android has no clipboard service and Godot's Kotlin code casts it with a non-null `as ClipboardManager` (`Intrinsics.checkNotNull` before the check-cast). Godot 4.1 (Java) and 4.5+ (`as?`) don't throw | `frame.godot_clipboard` (suggested by analysis `godot_clipboard`): that checkNotNull call → nops in classes.dex (check-cast accepts null), and Godot's getClipboard/hasClipboard/setClipboard return at once ("" / false / nothing; `Dex.return_early`), in place; matched exactly, other dex files untouched. Checked against the Maven godot-lib 4.2.2/4.3.0/4.4.1 and the 4.3/4.4.1 release export templates (D8 re-reads the result); not yet run on the device |
 | Game crashes at start: `java.lang.NoSuchMethodError: No virtual method getAvailableCommunicationDevices()… in class Landroid/media/AudioManager` at `com.vivox.sdk.AudioChangeListener.checkAudioRouteAndApplyChanges` (for example Green Hell VR, GitHub #101); triage `vivox-api31` | Newer Vivox (voice chat) builds call Android 12 audio-routing methods without a version check; Lepton is Android 11. Older Vivox builds (Eleven Table Tennis, BattleSisters) don't have that code | `frame.vivox_audio_route` (suggested by analysis `vivox_api31`): every AudioChangeListener method that calls one of them returns at once (`Dex.return_early`: return-void / `const/4 v0, 0; return v0`, in place); voice chat keeps the default audio route |
-| Game crashes when voice chat starts (Table Troopers: at the tutorial's start): `java.lang.NoSuchMethodError: No virtual method getAvailableCommunicationDevices()… in class Landroid/media/AudioManager` at `com.exitgames.photon.audioinaec.AudioInAEC.updateAudioDevice` ← `AudioInAEC$1.run` (GitHub #362/#325); triage `photon-voice-api31` (the same error from another library: `audio-api31`, report it) | Photon Voice's Android microphone plugin picks the audio device with Android 12 methods (getAvailableCommunicationDevices / setCommunicationDevice) and has no version check (it logs "Start: SDK >= 31, using BroadcastReceiver" on every Android); Lepton is Android 11. `frame.vivox_audio_route` only edits Vivox's class, so it can't help here | `frame.photon_voice_audio_route` (suggested by analysis `photon_voice_api31`): AudioInAEC.updateAudioDevice (void, the only caller) returns at once (`Dex.return_early`, in place); the microphone thread goes on (communication mode, echo canceller, AudioRecord) on the default route. Checked against Table Troopers' classes.dex; not yet run on the device |
 | A game on a microSD card or another drive doesn't start, loses its saves or loops at start; launch.log has `ln: cannot create symbolic link from 'Frame' to '/data/data/<pkg>'` or `Couldn't create directory for SharedPreferences file /data/user/0/<pkg>/…` (GitHub #213/#214/#215/#221: a card named "Steam Frame 512g"); triage `lepton-data-link-failed` | Valve's Lepton pastes `STEAM_COMPAT_DATA_PATH` unquoted into `sh -c "ln -s …/internal/<pkg> /data/data/<pkg>"` (liblepton mounting.sh) and APK paths into unquoted substitutions, so a path with a space never gets the app's internal storage | agent v83: the Quest launcher links the game folder to `~/.local/share/frameport/lepton-paths/<pkg>` at every start and gives Lepton that path (`app_dir_lines`); `upgrade_launchers` converts existing launchers at the next connection; deployment.json keeps the real path |
 | Start never finishes, 100 % CPU, launch.log of gigabytes repeating `EOSSDK.createKeychain` / `resetKeychain` (Beyond Sandbox, GitHub #214); triage `eos-keychain-loop` | Epic Online Services' Java keychain can't write its SharedPreferences and resets/creates without end (seen when the app had no internal storage, row above) | fix the storage first; `frame.eos_keychain_loop` (opt-in, offered by triage; analysis `eos_keychain`) makes `EOSSDK.resetKeychain` return at once (`Dex.return_early`) |
-| Game quits ~20 s after start (Titan Isles, GitHub #310); launch.log has `FATAL EXCEPTION: GoogleApiHandler` `java.lang.NoSuchMethodError: No virtual method permitUnsafeIntentLaunch()` at `com.google.android.gms.common.internal.zzp` (play-services-basement); triage `gms-android12-call` | Not the missing Play services: the APK was built for minSdk 32, so R8 folded Play services' `PlatformVersion.isAtLeastS()`/`isAtLeastSv2()` to `return true`; OVRPort lowers minSdk, the folded checks stay, and Lepton (Android 11) lacks the Android 12 method | `frame.gms_platform_version` (suggested by analysis `gms_folded_sdk_checks`): those constant checks return false again (in-place dex edit) |
-| App quits a few seconds after OpenXR starts (PianoVision, GitHub #297, after `frame.unity_appui_vibrator`); launch.log has `FATAL EXCEPTION: MidiDeviceConnectionWatchThread` `NullPointerException: … UsbManager.getDeviceList()' on a null object reference` at `jp.kshoji.driver.midi.device.MidiDeviceConnectionWatcher$MidiDeviceConnectionWatchThread.checkConnectedDevices`; triage `usb-midi-watcher` | Lepton's Android has no USB service (`getSystemService("usb")` is null); kshoji's USB MIDI driver polls it | `frame.usb_midi_watcher` (suggested by analysis `usb_midi_watcher`): the poll returns at once; no USB MIDI on the Frame |
-| Unity app quits ~1 s after start, before any OpenXR line (PianoVision, GitHub #297); launch.log has `FATAL EXCEPTION: main` `java.lang.NoClassDefFoundError: Failed resolution of: Landroid/os/VibratorManager;` at `com.unity3d.player.appui.AppUIGameActivity.onCreate`; triage `unity-appui-vibrator` | Unity's App UI package (its own GameActivity) gets the vibrator through Android 12's VibratorManager without a version check; Lepton runs Android 11 | `frame.unity_appui_vibrator` (suggested by analysis `unity_appui_vibrator`): that sequence leaves the vibrator null and the activity's vibrate methods return at once (in-place dex edit) |
 | Unity game freezes on its loading screen ~10-15 s in (Yupitergrad, GitHub #235); launch.log has `GrantPermissionsActivity: Permission grant result … permission=android.permission.BLUETOOTH_CONNECT`, then OVRPlugin `SetupDisplayObjects(): Unable to find EGLConfig for configId 0` and no more frames; triage `bhaptics-permission-prompt` | bHaptics' vest SDK (`com.bhaptics.commons.PermissionUtils.requestBluetoothPermission`) asks for Android 12's BLUETOOTH_CONNECT; on Lepton's Android 11 it can't be granted at install, so Android's permission screen takes the foreground for a moment, the game pauses/resumes and OVRPlugin's GLES compositor stops drawing | `frame.bhaptics_permission` (suggested by analysis `bhaptics_permission`): the request returns at once (`Dex.return_early`) |
 | Unity game aborts at start: `Abort message: 'cannot create thread specific key for __cxa_get_globals()'` (SIGABRT in a library such as `libFirebaseCppApp-*.so`, for example Wander 0.3570, GitHub #198); triage `pthread-keys-exhausted` | Bionic allows 128 pthread keys per process; Unity 6 takes ~40 (most without a destructor), large native libraries (Gecko `libxul.so`, Firebase, avatar SDKs) and the Frame's own libraries (Mesa/Zink, FrameBridge, OVRPort, Valve's Vulkan layers) take the rest | `frame.unity_tls_key_pool` (opt-in; suggested for Unity 6 with Firebase C++ or Gecko): libunity.so's `pthread_key_*`/`pthread_get/setspecific` imports are renamed to `fp_tkey_*` (`elf.rename_imports`, versions set global) and `libfp_tkeys.so` (`native/tlskeys`) is added to its DT_NEEDED; destructor-less keys become slots behind one real key (logs `fp_tkeys: pooling Unity's thread keys`). Approach by Klownicle (#198) |
 | Controllers do nothing (for example stuck on a setup screen); log: `xrSuggestInteractionProfileBindings … XR_ERROR_PATH_UNSUPPORTED` | the game only suggests bindings for Meta's newer profiles (Touch Plus / Touch Pro); the Frame's Android runtime knows `oculus/touch_controller`, not those | adapter `profile_remap` (default on): the bindings are suggested again for Touch (log: `controller profile … -> oculus/touch_controller`) |
-| Controllers "don't sync": virtual hands/controllers lie on the floor below you, no buttons (Unity OpenXR games that only suggest Touch Plus/Pro, e.g. Hotel Infinity #327); log with `input_diag=1`: only `meta/touch_controller_plus` (or Pro) suggested, `controller profile … -> oculus/touch_controller` | the runtime then reports `oculus/touch_controller` for each hand, a profile the game never suggested: Unity's OpenXR input creates no device for it | adapter `profile_remap` (default on) reports the game's own profile for such hands (log: `profile_remap: /user/hand/left reported as meta/touch_controller_plus`) |
-| Controllers "don't sync": hands on the floor below you, no buttons, in a Unity OpenXR game with Meta's OpenXR features (e.g. Spatial Zombies #328); log: `xrCreateAction: XR_ERROR_PATH_UNSUPPORTED` (input_diag: `xrCreateAction -> XR_ERROR_PATH_UNSUPPORTED (thumbstick)`), then `xrGetCurrentInteractionProfile: XR_ERROR_ACTIONSET_NOT_ATTACHED` | Meta's "Detached … Controller" devices add `/user/detached_controller_meta/left|right` to Unity's merged actions; the Frame has no XR_META_detached_controllers, the action fails and Unity attaches no action set (OVRPlugin's input goes with it) | adapter `profile_remap` (default on) leaves those paths out of actions and bindings (log: `profile_remap: action thumbstick without 2 detached-controller path(s)`) |
 | Some buttons do nothing or the wrong thing (for example a Quest game's X/Y on the Frame's left controller) | the game binds only Quest Touch and SteamVR maps Touch onto the Frame controllers with its own remap (Touch left X/Y land on the d-pad, right X and Y repeat B), or the runtime rejected a profile or an input call | turn on adapter `input_diag` (diagnostics, off by default; `frameport settings <pkg> input_diag=1`) and look for `input_diag:` lines: `bindings: <profile> accepted` or `unsupported: interaction profile <profile> -> <result>` with the rejected paths, `bindings: /user/hand/<hand> uses <profile>`, `unsupported: function <name>`, `unsupported: xrCreateAction -> <result> (<action>)` |
 | Unity game hangs or the whole Frame restarts (for example in a menu); log: `The current MSAA level is 0, but the recommended MSAA level is 4. Switching to the recommended level.` (for example Lucky's Tale) | Meta's OVRManager (`useRecommendedMSAALevel`) turns 4x MSAA on at runtime, past QualitySettings; multisampled render-to-texture on GLES/Zink hangs the GPU | `frame.unity_runtime_msaa_off` (Cpp2IL: `OVRDisplay.get_recommendedMSAALevel` → 0) |
 | Unity game: one eye shows only effects or gray, the other is fine (for example I Am Cat, Oculus XR Plugin on GLES) | the game's single-pass multiview rendering goes wrong for array slice 1 (the adapter submits both slices correctly) | `frame.unity_multipass` (Cpp2IL: `OculusSettings.GetStereoRenderingMode` → MultiPass); `swap_eyes=1` tells whether the game or the adapter is at fault |
@@ -186,14 +171,16 @@ version is `catalog/triage.yaml` (used by `frameport test` / the Job screen); ke
 | Black screen, audio works, log `Unsupported VrApi layer type N` | bridge drops frames containing that layer | extend the bridge (cylinder=3 is converted to a quad already) |
 | Only some draws visible (for example controllers) + `glGetError 0x502` | multiview shaders used on single-view FBOs | GL shim `gl_hide_multiview=1` (default) |
 | Own GLES engine (OpenXR, not VrApi): eye view fine, but HUD / menu / PDA panels black (for example Doom3Quest, GitHub #77; no error in the log) | every shader declares `layout(num_views=2) in;`, also the ones drawn into the engine's single-layer offscreen framebuffers (2D textures/renderbuffers); OVR_multiview makes such draws INVALID_OPERATION and Mesa drops them (`draw_validate.c`), Quest's driver doesn't | `frame.gl_multiview_fbo` (opt-in, experimental: `libfpglmv.so` interposes GLES and draws those cases with a single-view twin of the program; logs `GLMV: twin built: program N -> M`, per-5-s `single-view draws` counters; `gl_mv_debug=1` adds glGetError checks; triage `gl-multiview-twin-failed`). Alternative: the game's own fix (two-layer multiview pool, Xandrix's patch in #77) |
-| Team Beef idTech 4 port (PreyVR, GitHub #306): main menu black except the mouse cursor, loading screen fine, 72 fps, no GL error; one game thread at 100 % CPU | the game clock runs 1000 / refresh ms per tic (`USERCMD_MSEC`, from xrGetDisplayRefreshRateFB). The Frame's runtime lacks XR_FB_display_refresh_rate and OVRPort's dispatcher answered 0 Hz: 0 ms tics, the async thread spins (millions of tics/s) and `com_frameTime` stays 0, so the menu GUI stays at its first animation step (everything hidden) | FrameBridge (default, no setting) answers xrGetDisplayRefreshRateFB with the measured rate (1 / predictedDisplayPeriod, else 72 Hz); log `refresh rate: runtime reported 0.0 Hz (result -7), reporting 72.0 Hz`. Found with `gl_mv_debug=2` (`frameport settings <pkg> gl_mv_debug=2`, needs `frame.gl_multiview_fbo`): only 2 draws per frame (backdrop + cursor) and `trace clocks: com_frameTime=0` |
 | Upside-down image in a GL bridge game | GL images start at the bottom row | fixed in the bridge (swap angleUp/Down for GL chains) |
 | UI panels upside down (AC Nexus) | XrCompositionLayerImageLayoutFB VERTICAL_FLIP unsupported | adapter `flip_emul=1` (default); rotating quads makes them vanish |
 | Passthrough black (BAM) | XR_FB_passthrough missing | adapter `passthrough_emul=1` (default) + `patch_force_passthrough` for MR-only games |
-| Mixed reality inside out: the room shows on the game's objects, black where the room should be (Unreal, for example Star Wars: Beyond Victory, GitHub #329) | Unreal keeps 1 - coverage in the scene alpha and OVRPlugin chains XrCompositionLayerAlphaBlendFB (colour factors ONE_MINUS_SRC_ALPHA / SRC_ALPHA, `layer_debug` shows `n=1000041001(3,2/3,2)`) to the eye layer; the Frame's runtime ignores it | adapter `alpha_blend_emul=1` (default, Vulkan): inverts the alpha of the eye images in place while passthrough is emulated; logs `alpha_blend: inverting the alpha of swapchain=…` |
 | Quest Touch controllers (or none) shown in a game that uses Meta's runtime controller models | XR_FB_render_model missing on the Frame | adapter `controller_models=1`: the agent converts the Frame's SteamVR controller models to glb at install, the adapter serves them. Games with their own controller meshes aren't affected (none of the 34 catalog games use runtime models) |
 | `overportOXR: Unknown proc addr: xr…` for a function the adapter emulates | overport's dispatcher only forwards functions in its own table | route the plugin's lookups through `native/xrshim` (done for XR_FB_render_model when `controller_models=1`) |
-| MR game stuck waiting for room data (Demeter) | no Meta scene API | adapter `scene_emul=1` (+ `frame.meta_permissions`) |
+| MR game stuck waiting for room data (e.g. Demeter) | No Meta scene API | `adapter.scene_emul=1` (+ `frame.meta_permissions`); Frame → Room → Use my play area, or import a scanned room |
+| Unity MR game rejects every room / its "use guardian" fallback does nothing; `ovrpBoundary_Outer is not supported`, `IndexOutOfRangeException` in a guardian check (e.g. Demeter's `RemoveObjectNotInGuardian`) | OVRPlugin calls the Frame's 1x1 m STAGE rect a configured boundary but can't give its outline | `adapter.scene_emul=1`: FrameBridge then answers the app's STAGE `xrGetReferenceSpaceBoundsRect` with `XR_SPACE_BOUNDS_UNAVAILABLE` (log `scene: STAGE bounds hidden`). Demeter also needs a floor of at least 2.5 x 2.5 m, as on a Quest |
+| Build says `Unity text fields: not fixed: Cpp2IL couldn't start on this PC` (older versions: `Cpp2IL couldn't read this game's code: at Cpp2IL.Program.Main`) | .NET aborts without libicu (fresh WSL/Linux) | FramePort runs Cpp2IL with `DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=1`; such failures aren't cached, so the next build retries |
+| MR uses an empty/simple room; FrameBridge `scene: capture requested -> guardian box` / `using guardian room`, `room from guardian`, or fallback box dimensions (`mr-no-room`) | No saved room, so FrameBridge uses its guardian box | Save a room in Frame → Room. A real SteamVR boundary supplies walls; Valve's default circle is refused. Import a scanner-built room for furniture/mesh; headset capture is not implemented yet |
+| `Unknown proc addr: xrDiscoverSpacesMETA` or MRUK `NoRoomsFound` (`mr-discovery-unsupported`) | Scene discovery is unavailable or no room was discovered | Enable `adapter.scene_emul`, rebuild/reinstall to get the updated extension shim, then save a room. All games declaring USE_SCENE or USE_ANCHOR_API now get this suggestion |
 | Hand-tracking game janky (Silhouette) | Frame synthesizes hands from controllers | `controller_fix=0` passes hands through; not really fixable |
 | Eye distortion while moving (Arcsmith, Time Stall) | unknown (not eye swap, tracking, Valve layers, depth or pacing) | unresolved |
 | The Climb 666.0: hand outlines ripple in both eyes while menus and gameplay work (GitHub #238) | Unknown. Sessions paced around 72 fps, controller tracking reported valid, and SteamVR motion smoothing was already off; these checks do not establish the cause | Unresolved after wearer comparisons on 2026-10-12: disabling Valve's Vulkan layers, setting `r_AntialiasingMode = 1`, and setting `r_AntialiasingMode = 0` with `r_MotionBlur = 0` each gave the same or worse result. These were config comparisons; runtime cvar values were not verified. Restored the playable configuration (`r_vr_foveated = 0` with the default Vulkan layers), retaining the startup/rendering crash fixes above. Do not keep the unsuccessful experimental settings as a fix |
@@ -204,8 +191,6 @@ version is `catalog/triage.yaml` (used by `frameport test` / the Job screen); ke
 | Unity game crashes or hangs right as Vulkan starts, after `SLZ Graphics plugin loading!` and OVRPlugin's pre-init `xrDestroyInstance`: SIGSEGV with pc 0 (or pc == fault address in an unloaded library), x16/x23 in `libSLZQuestNative.so` (BONELAB 1.2974) | Stress Level Zero's graphics plugin hooks Unity's Vulkan start-up (IUnityGraphicsVulkanV2 interception: vkCreateInstance/vkCreateDevice) and vkCreateSampler; its vkCreateInstance wrapper calls an invalid pointer on the Frame | `frame.slz_vulkan_hooks` (its two registrations become no-ops; Unity starts Vulkan itself; ~35 s of shader prewarming without its pipeline cache) |
 | Unity game shows a picture but the player body is frozen: no head tracking, the controllers stay on the model, no buttons, although OpenXR input works (BONELAB 1.2068, Oculus XR Plugin) | OVRPlugin reports the headset as not worn (`ovrp_GetUserPresent2` → 0) a few seconds after start, and the game's rig only follows a present user (Marrow `XRHMD.IsUserPresent` = Unity's HMD `UserPresence`) | `frame.unity_user_presence` (the Oculus XR Plugin's lookup → `libfp_ovrp.so`, reports present; log `user presence: OVRPlugin 0 …`) |
 | Unreal 5 game crashes at its first render pass, backtrace `vulkan.freedreno.so` ← `libVkLayer_fossilize.so` ← `libfp_vk.so (create_render_pass2)` (Metro Awakening) | a subpass without a depth attachment names a depth/stencil resolve attachment; the Frame's Turnip reads the missing depth attachment (NULL) | the Vulkan shim drops that resolve (always, FramePort after 0.11.0; log `dropped the depth resolve of subpass N (no depth attachment)`); triage `unreal-vulkan-driver-crash` |
-| Unreal game crashes before its first frame: SIGSEGV `fault addr 0x10` on the main thread, backtrace all `libUnreal.so` above the linker's `soinfo::call_constructors` (inside `System.loadLibrary`), right after `Parsing commandline` (GitHub #349, Transformers Beyond Reality) | The game is built with Unreal's Binned3 allocator, which reserves its whole range while the library loads: one `mmap(NULL, 76 GiB, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS)`. Quest grants it; the Frame's kernel (heuristic overcommit, mode 0) refuses a writable private mapping larger than RAM + swap, and Unreal's out-of-memory handler ("Ran out of memory allocating ...") dereferences its not-yet-created log | `frame.unreal_noreserve` (suggested from analysis `unreal_binned3`): every such anonymous read/write mmap in the engine library gets `MAP_NORESERVE` (one instruction each: `mov w3, #0x22` → `#0x4022`); triage `unreal-reserve-refused`. Found by disassembling the crash pc (the OOM handler; its UTF-16 format string) and the caller's `mov x0, #0x1300000000` |
-| Unreal Vulkan game fails on its first frames and OVRPlugin reports `foveationImage = 0x0, width = 0, height = 0` (for example Transformers Beyond Reality: Redux, #349) | Quest FB foveation remains advertised by OVRPort's dispatcher despite `foveation_fix=1`. This is a hypothesis for the failure, not a confirmed cause: Redux's alternate no-ForceQuit build dereferences a null graphics-pipeline-state object during Vulkan pipeline binding, not a density image | Diagnostic `adapter.hide_fb_foveation=1` (off by default, Vulkan): filters the dispatcher and runtime extension lists/instance requests, removes foveation create/image chains and refuses profile creation/updates. Rebuild with the adapter **and xrshim** artifacts, then compare first-frame survival and Unreal's original fatal log. Does not disable Valve FDM injection. Device verification pending |
 | Unreal 5 game crashes in `vulkan.freedreno.so` called straight from `libUnreal.so` right after its swapchains, or a few seconds into the first frames (Metro Awakening) | Unreal turns on fragment-density-map foveation because Turnip offers VK_EXT_fragment_density_map, then records barriers (to `FRAGMENT_DENSITY_MAP_OPTIMAL`) and image views (2D array R8G8) for a density map the Frame never provides (VK_NULL_HANDLE); Turnip dereferences it | adapter `vk_hide_fdm=1` (the game doesn't see the extension) + `vk_spec_fixes=1` (leaves out null-image barriers, refuses null-image views); triage `unreal-fdm-missing`. Found by disassembling the driver at the crash pc: the struct offsets (0x58 = VkSubpassDescription2, 0x48/0x60 = image barriers, viewType/format in registers) name the call |
 | Own-engine game crashes in `je_free` from its own library on the first frames (Roblox) | the game frees memory it doesn't own; not the Vulkan shim or the format fallback | unsupported |
 

docs/mr/PHASE0.md

@@ -0,0 +1,49 @@
+# Phase 0: reading Valve's RoomView 3D mesh (dev Frame, SteamOS 0.4.5 build 20261007, 2026-10-16)
+
+Result: **a third-party OpenVR client can read the passthrough depth mesh, and it carries enough of the room for
+a scan** (floor, table-height surfaces, orthogonal walls; the ceiling only weakly).
+
+## Access
+- Background OpenVR app (`VR_InitInternal2(..., VRApplication_Background)`, never starts SteamVR) through
+  `/opt/steamvr/bin/linuxarm64/libopenvr_api.so`.
+- `FnTable:IVRBlockQueue_005`: `Connect("/xrservice/roomview3d/meshData")` and `.../meshLayout` work (created by
+  Valve's cv driver; no exclusivity seen next to the compositor's own reader). Read with
+  `WaitAndAcquireReadOnlyBlock(queue, &block, &buffer, EBlockQueueReadType_New, timeout_ms)` + `ReleaseReadOnlyBlock`.
+- Metadata through the C++ interface `IVRPaths_002` (vtable slot 0 `ReadPathBatch(root, PathRead_t*, n)`, slot 2
+  `StringToHandle(&handle, path)`; `FnTable:IVRPaths_001` doesn't exist), root = the **block** handle, except
+  `/meshData/meshIsUpToDate` which is a property of the **queue** handle:
+
+| path | tag | meaning |
+|---|---|---|
+| `/meshLayout/layoutId` | 3 (u64) | id of the index layout (static while the mesh resolution stays) |
+| `/meshLayout/vertexCount` | 2 (i32) | 16896 = 132 x 128 |
+| `/meshLayout/indexCount` | 2 | 99822 (u32 triangle indices into the grid, row width 132) |
+| `/meshData/meshId` | 3 | frame counter (~30 per second while passthrough runs) |
+| `/meshData/layoutId` | 3 | matches the layout block |
+| `/meshData/elementCount` | 2 | floats in the data block (vertexCount x 3) |
+| `/meshData/rawFromMeshPose` | 20 (HmdMatrix34) | mesh -> SteamVR raw tracking space |
+| `/meshData/posePredictionBaseTime` | 7 (f64) | seconds (system uptime clock) |
+| `/meshData/meshIsUpToDate` (queue) | 4 (bool) | false in standby / headset off |
+
+- STAGE (= standing universe) = `IVRSystem_023` vtable slot 13 `GetRawZeroPoseToStandingAbsoluteTrackingPose()` x
+  rawFromMeshPose. Check: the mesh origin is 6.7 cm from `GetDeviceToAbsoluteTrackingPose(Standing)`'s head
+  position in every frame (camera vs head centre). **The raw->standing transform changes during a session** (its
+  height went 1.60 -> 1.07 m while recording: Valve's floor estimate) -> capture raw poses and convert all frames
+  with the transform at the end of the capture.
+
+## The mesh
+- A fixed fan of view directions, +Z forward, rows top->bottom (row 0 = up in the image, -Y), ~126 deg across the
+  corners (corner directions ~(+-0.67, +-0.66, 0.34)); one depth per grid point. Not head-locked in world terms:
+  its pose is the passthrough camera pose at capture.
+- Range: reliable ~0.3-4 m; far values are inpainted (up to ~10 m) -> drop > 4 m. Strongly smoothed (soft edges,
+  small objects lost); locally planar: plane-fit residual of 12x12 patches median 5-17 mm.
+- First frames after tracking starts can have NaN poses -> skip non-finite frames.
+- Fused normals (60 s of looking around, ~3 frames/s used): floor clearly at y ~= 0, a table-height surface at
+  0.7 m, a lower one at 0.5 m; vertical surfaces in two orientation clusters ~85 deg apart (orthogonal walls), wall
+  offsets readable; ceiling: few down-facing points (people rarely look straight up; prompt for it).
+- Data rate: 16896 x 12 B vertices + 99822 x 4 B indices per frame (the dump repeats the indices per frame).
+
+## Consequences for the design
+- Capture = stdlib Python on the Frame (ctypes), as above; the C scanner works offline on the dump.
+- Scanner input quality: smooth, noisy at depth discontinuities; walls/floor via normals + RANSAC are robust;
+  furniture only as coarse boxes; ceiling needs a guided "look up" step, else the default height.

docs/mr/ROOM_FORMAT.md

@@ -0,0 +1,82 @@
+# FramePort room files (mixed reality)
+
+Quest MR games read a room model (floor, ceiling, walls, furniture, a global mesh) through Meta's scene APIs. The
+Steam Frame has no such data for apps (see docs/FRAME_RUNTIME.md "Room data"), so FramePort scans the room itself
+(`fp_roomscan`) and FrameBridge (`native/adapter/scene_emu.c`) serves it to games. This file is the contract between
+the scanner, the Frame agent, the PC app and FrameBridge.
+
+## Coordinates
+- Everything is in **STAGE space** = SteamVR's standing universe = OpenXR `XR_REFERENCE_SPACE_TYPE_STAGE`:
+  metres, right-handed, +Y up, floor at y = 0, -Z = the universe's forward.
+- A room belongs to one chaperone universe (`universe` line). The Frame sometimes starts a new universe without
+  relocalizing; then the stored room may be misaligned (the agent reports `aligned: false`, nothing breaks).
+
+## room.txt (UTF-8 text, one record per line, `#` starts a comment, fields separated by spaces)
+```
+frameport-room 1                    # magic + format version (required, first line)
+universe <decimal u64>              # chaperone universe id the room was scanned in (0 = unknown)
+source scan|boundary|box|manual     # how it was made
+time <unix seconds>
+room <uuid>                         # the room anchor
+floor <uuid> <y>                    # floor height (normally 0)
+ceiling <uuid> <y>                  # ceiling height
+outline <n> x0 z0 x1 z1 ... x(n-1) z(n-1)
+                                    # floor polygon, n >= 3, not closed, POSITIVE signed area:
+                                    # sum(x[i]*z[i+1] - x[i+1]*z[i]) > 0 (turning from +X towards +Z; seen from
+                                    # above with -Z forward that is clockwise). Readers reverse a negative outline.
+wall <uuid> x0 z0 x1 z1 <y0> <y1> [LABEL]
+                                    # one wall face from (x0,z0) to (x1,z1), bottom y0, top y1.
+                                    # Its normal points INTO the room: walls follow the outline's order, and the
+                                    # inward normal is (-dz, dx)/|d| for d = (x1-x0, z1-z0).
+                                    # LABEL (optional, default WALL_FACE): INVISIBLE_WALL_FACE for an edge the
+                                    # scanner closed without seeing a wall (open side of a room, doorway gap).
+volume <uuid> <LABEL> cx cz top_y yaw_deg w d h
+                                    # furniture box: top-face centre (cx, top_y, cz), yaw about +Y in degrees
+                                    # (0 = local X along world X), width w along local X, depth d along the
+                                    # horizontal local axis perpendicular to it, height h downwards from the top
+plane <uuid> <LABEL> px py pz qx qy qz qw w h
+                                    # extra 2D plane (DOOR_FRAME, WINDOW_FRAME, WALL_ART, ...): pose of its centre,
+                                    # Meta convention (bounds in local XY, local +Z = the plane's normal)
+mesh <uuid> <file name> <vertex count> <index count>
+                                    # global mesh sidecar in the same folder (GLOBAL_MESH entity)
+```
+- `<uuid>` = 32 lowercase hex digits (no dashes). New ones per scan; FrameBridge uses them as the XrUuidEXT bytes.
+- Labels are Meta's semantic label strings: FLOOR, CEILING, WALL_FACE, INVISIBLE_WALL_FACE, TABLE, COUCH, BED,
+  STORAGE, SCREEN, LAMP, PLANT, DOOR_FRAME, WINDOW_FRAME, WALL_ART, OTHER, GLOBAL_MESH.
+- Readers ignore unknown record types (forward compatibility) and reject a file whose first line isn't
+  `frameport-room <version>` with a version they know. Missing ceiling -> 2.5 m above the floor. Missing walls ->
+  walls from the outline edges. Missing outline -> the bounding rectangle of the walls.
+
+### How FrameBridge maps records to Meta entities (scene_emu.c)
+- ROOM: ROOM_LAYOUT (floor, ceiling, walls in file order) + SPACE_CONTAINER (every other entity) + LOCATABLE/STORABLE.
+- floor/ceiling: pose at the outline centroid at height y; local +Z = +Y (floor) / -Y (ceiling);
+  BOUNDED_2D = the outline's bounding rect in local XY; BOUNDARY_2D = the outline polygon in local XY.
+- wall: pose at the segment midpoint, height (y0+y1)/2; local +X along the wall (x0,z0)->(x1,z1), local +Y up,
+  local +Z = inward normal; BOUNDED_2D = length x (y1-y0) centred.
+- volume: pose at the top-face centre, rotation = yaw about +Y then local +Z pointing up (+Y); BOUNDED_3D offset
+  (-w/2, -d/2, -h), extent (w, d, h) (Meta: volumes hang below their anchor); BOUNDED_2D = the top face (w x d).
+- plane: pose as given; BOUNDED_2D = w x h centred.
+- mesh: entity at the identity pose labelled GLOBAL_MESH with TRIANGLE_MESH (XR_META_spatial_entity_mesh).
+
+## room-mesh.bin (little-endian)
+```
+char[4] "FPRM", u32 version = 1, u32 vertex_count, u32 index_count,
+float32 xyz[vertex_count], u32 indices[index_count]   (triangles; counter-clockwise seen from the room's inside)
+```
+Coordinates in STAGE space. Kept below 200k triangles (decimated).
+
+## Where the files live
+- Frame: `~/.local/share/frameport/rooms/<universe>/room.txt` + `room-mesh.bin` (+ `scan.log`).
+  `~/.local/share/frameport/rooms/current` = symlink to the newest room's folder.
+- Per game: launch.sh copies the current universe's room (else `current`) to `<app_dir>/room.txt` (+ mesh) before
+  Lepton starts, next to `settings.conf`; FrameBridge reads `dirname($FRAMEBRIDGE_CONFIG)/room.txt`. No room ->
+  the old guardian box.
+- A game's own saved anchors: `/sdcard/Android/data/<pkg>/files/framebridge-anchors.txt`
+  (`anchor <uuid> px py pz qx qy qz qw` per line, STAGE space), written by FrameBridge on save/erase.
+
+## Scan dumps (*.fprs) — recorded RoomView 3D meshes, input of `fp_roomscan --offline`
+```
+char[4] "FPRS", u32 version = 1, then frames until EOF:
+  f64 time_s, float32 pose[7] (px py pz qx qy qz qw: mesh -> STAGE), u32 vertex_count, u32 index_count,
+  float32 xyz[vertex_count] (mesh space), u32 indices[index_count]
+```

docs/mr/emul.md

@@ -0,0 +1,216 @@
+# Scene emulation stream
+
+Implemented against `ROOM_FORMAT.md` without changing the contract, patch revisions, agent version or analysis version.
+No Frame access or external downloads were used. Headset behavior still needs maintainer verification.
+
+## Implementation
+
+- `scene_emu.c` owns entities, component APIs, pose transforms, bounded query snapshots and the event queue.
+  `scene_room.c` parses room files and meshes; `scene_meta.c` implements META discovery and batch persistence;
+  `scene_anchors.c` implements per-game saved anchors. All are included by the adapter, with no new dependencies.
+- At session creation, read `dirname(FRAMEBRIDGE_CONFIG)/room.txt`. Invalid magic/version, unusable geometry or
+  absent files retain the original guardian box, settings and seven deterministic UUIDs. Unknown records are
+  ignored; malformed records are logged and skipped. Missing ceiling, outline and walls follow the contract.
+- Floor/ceiling use the polygon area centroid and real local-XY polygons. Walls retain file order, with local +X
+  along their segment, +Y up and +Z inward. Furniture poses use yaw then +Z up; volume bounds extend downwards.
+  The room container includes every other room-file entity, excluding independently created application anchors.
+- Geometry exposes BOUNDED_2D, BOUNDED_3D, semantic labels and TRIANGLE_MESH as appropriate. OpenXR has no separate
+  `BOUNDARY_2D` component enum: `xrGetSpaceBoundary2DFB` belongs to BOUNDED_2D. Labels preserve comma-separated strings.
+  All variable-sized outputs support count-only and insufficient-capacity calls, including independent mesh arrays.
+- Limits: 2,048 entities including application anchors, 1,024 outline points, 255 label bytes, 64 KiB record lines,
+  one global mesh, 600,000 vertices/indices (200,000 triangles) and 16 MiB mesh payload. Sidecar filenames cannot
+  escape the config directory. Magic, version, counts, exact byte size, finite coordinates and indices are checked.
+- FB queries and META discovery snapshot results under the mutation lock, before queuing available/complete events.
+  META component/UUID filters intersect; unrecognized filters impose no restriction. FB max-result limits are honored.
+  There are 64 retained query snapshots and 63 queued events; calls that cannot fit their events return
+  `XR_ERROR_LIMIT_REACHED`. Geometry readers share the mutation lock with persistence.
+- Application anchors use kernel randomness (`getrandom`, then `/dev/urandom`), never index-derived UUIDs.
+  Saved poses are in STAGE space. FB/META saves write a private temporary file, flush/fsync, then rename to
+  `/sdcard/Android/data/<package>/files/framebridge-anchors.txt`. A process suffix such as `:game` is stripped.
+  Erase removes application anchors from disk and the discoverable in-memory set. Failed writes report failure
+  through completion events and restore memory. Room-file entities remain owned by the scan: save/erase are no-ops
+  for those entities. Storage is local; there is no cloud synchronization.
+- A new session reloads the room and saved anchors. Fake handles fit both adapter ABIs and include a session
+  generation; erased/stale fake spaces are never passed to SteamVR. Session generations wrap after 256 sessions.
+- Capture completes immediately and logs exactly `scene: capture requested -> scanned room` for a usable room file,
+  or `scene: capture requested -> guardian box` for the fallback. The former covers all file sources, including manual
+  and boundary files. The load summary preserves the actual `source` and `universe`.
+
+The cached `openxr-f2448a8797` headers already contain discovery, persistence and mesh declarations and enum values.
+No local structure/enum substitutes were necessary. Both META extensions are added to the existing conditional
+extension advertisement/instance filtering. Their system capability structures report support when emulation is active.
+Passthrough and unrelated adapter settings are unchanged.
+
+## Routing and integration
+
+All of the following use `scene_emulation` through **both** the adapter's normal `xrGetInstanceProcAddr` and
+`framebridge_extension_proc`, reached through xrshim's existing name-agnostic lookup:
+
+```
+xrQuerySpacesFB                         xrRetrieveSpaceQueryResultsFB
+xrGetSpaceUuidFB                        xrEnumerateSpaceSupportedComponentsFB
+xrSetSpaceComponentStatusFB             xrGetSpaceComponentStatusFB
+xrGetSpaceContainerFB                   xrGetSpaceRoomLayoutFB
+xrGetSpaceBoundingBox2DFB               xrGetSpaceBoundingBox3DFB
+xrGetSpaceBoundary2DFB                  xrGetSpaceSemanticLabelsFB
+xrRequestSceneCaptureFB                xrCreateSpatialAnchorFB
+xrSaveSpaceFB                          xrEraseSpaceFB
+xrGetSpaceTriangleMeshMETA              xrDiscoverSpacesMETA
+xrRetrieveSpaceDiscoveryResultsMETA     xrSaveSpacesMETA
+xrEraseSpacesMETA
+```
+
+The shim additionally routes `xrPollEvent`, `xrGetSystemProperties`, `xrLocateSpace`, `xrLocateSpaces`,
+`xrLocateSpacesKHR` and `xrDestroySpace` to the adapter while scene emulation is active. Other shim names continue to
+OVRPort, preserving existing haptics/render-model handling. The real shim is host-tested against a dispatcher that
+refuses every scene function; every emulated scene lookup succeeds and an actual discovery/retrieve round trip runs.
+
+**Plumb-stream requirement:** ensure `scene_emul=1` also installs xrshim and rewrites OVRPlugin's loader string to it.
+The pre-existing adapter patch only did this for other shim settings. These files are outside this stream's ownership.
+Delivery of room files before Lepton starts and detection of universe misalignment also belong to plumb. FrameBridge
+serves the supplied coordinates; it does not silently transform a room belonging to another universe.
+
+No contract changes are needed. Whether each MRUK version accepts a room without further permissions, how it chooses
+volume versus mesh geometry, and whether its visible placement matches the scan need headset tests. The existing
+single-active-session architecture is retained; simultaneous independent sessions are not implemented.
+
+## Offline verification
+
+- 25 host tests passed, compiling the actual emulation and shim. Coverage includes malformed records, unknown
+  records, mesh corruption/path/cap checks, derived geometry, 300 walls, poses/normals, all buffer sizing idioms,
+  discovery event order/filters/backpressure, UUID query/discovery of saved anchors, new sessions/processes,
+  FB/META save/erase and atomic-write failure rollback.
+- ASan/UBSan: scanned room, generated walls and box cases passed. LeakSanitizer was disabled because this sandbox
+  prohibits ptrace; its default exit failed with that environmental limitation.
+- `python native/build.py --only adapter,xrshim` succeeded from cached tools. Two final builds were byte-identical,
+  including `SHA256SUMS`. The shim was rebuilt and is byte-identical to its previous artifact (the routing lives in
+  the adapter). Artifact content changes are the two adapter binaries and two checksum lines.
+- Full pytest was attempted: **1,771 passed, 40 skipped, 11 failed, 16 errors**. All 27 failing/erroring tests create
+  local HTTP sockets, which the sandbox prohibits (`PermissionError: [Errno 1] Operation not permitted`). They are
+  in `test_deeplink`, `test_devkit`, `test_install_links_extra`, `test_livestream`, `test_setup_url` and `test_ui_state`.
+  With exactly those 27 tests deselected, and the additional real-shim test included: **1,772 passed, 40 skipped,
+  27 deselected**. An unrestricted maintainer run of the whole suite is still required.
+- The worktree had no usable venv. Verification reused the existing local dependencies through an ignored venv
+  `.pth`, with `PYTHONPATH="$PWD/src"`, `UV_CACHE_DIR=/tmp/frameport-uv-cache`, `UV_OFFLINE=true` and
+  `uv run --no-sync pytest`. No dependencies were downloaded. The build cache was made a local directory with
+  symlinks to cached tools/headers so generated shader files stayed inside this writable worktree.
+
+Adapter SHA-256:
+
+```
+arm64-v8a:   a90c8d58904857bc198a48fd7a411b7807f68f14fa58fd268c57e2c2ca87e389
+armeabi-v7a: 92daecaf5b86e1857ee8a61b76598e5645f8b427e5f373067c1f87bf8ff99d07
+```
+
+## Maintainer device tests
+
+These commands are a handoff, not commands run by this agent. Use an isolated populated `FRAMEPORT_HOME`, cached
+build tools, a paired Frame and legally obtained game sources. Stop games before changing their files. Back up the
+existing recipe, APK, room files and saved anchors first. Integrate plumb before testing normal room delivery.
+
+On the PC, from the integrated checkout (replace `frame.local` if necessary):
+
+```sh
+export FRAMEPORT_HOME="$PWD/.home"
+export FRAMEPORT_NO_UPDATE_CHECK=1 FRAMEPORT_NO_CATALOG_UPDATE=1
+FRAME=steamos@frame.local
+PKG=com.Novelab.Demeter
+uv run frameport recipe "$PKG" --set scene_emul=1
+uv run frameport install "$PKG" --frame "$FRAME" --force
+uv run frameport test "$PKG" --frame "$FRAME" --seconds 45
+ssh "$FRAME"
+```
+
+In that Frame shell, find the deployment's actual base (also supports a game moved to another drive):
+
+```sh
+PKG=com.Novelab.Demeter
+BASE=$(python3 -c 'import json,os,sys; p=os.path.expanduser("~/Applications/quest-frame/"+sys.argv[1]+"/deployment.json"); print(json.load(open(p)).get("base",os.path.dirname(p)))' "$PKG")
+grep -E 'scene:|extension shim:.*(Spaces|TriangleMesh|BoundingBox3D|PollEvent)' "$BASE/launch.log"
+```
+
+With a current scan delivered beside `settings.conf`, expect:
+
+```
+scene: room from scan file (N walls, M volumes, P planes, K mesh triangles, universe U)
+scene: capture requested -> scanned room
+```
+
+The capture line appears only if the game requests capture. A source made from a boundary/manual file names that
+source in the summary. The shim logs each requested function, for example
+`extension shim: xrDiscoverSpacesMETA -> FrameBridge`. There must be no `Unknown proc addr` for a scene function
+that the game obtains through the shim. Repeat the rebuild/install/headset check for `com.gritGames.Nope` and
+`com.zenstudios.PFXVRQuest` with `scene_emul=1`; these exercise newer MRUK discovery/persistence paths.
+
+Wear the headset and launch from Steam. Enter each game's MR mode and request room setup if offered. Verify the
+floor polygon, every wall, ceiling and furniture match the scan; tables sit below their top-face anchors; doors and
+windows have the correct orientation. Headless startup alone cannot prove tracking or visual placement.
+
+Fallback/undo test, while stopped: preserve `$BASE/room.txt` and `$BASE/room-mesh.bin` under a separate backup
+folder, then disable plumb's room delivery for this run or move the source room out of `rooms/current` as well.
+Without that precaution launch.sh will restore the file. Launch again; expect the original box summary and
+`scene: capture requested -> guardian box`. Test `scene_width=3 scene_depth=4 scene_height=2.7` with the existing
+`frameport settings` command and expect `scene: room 3.00 x 4.00 x 2.70 m`. Restore the saved files, recipe/settings
+and normal room delivery afterward. Do not delete a real game's saved anchors to test the fallback.
+
+### Android persistence probe (independent of a game's UI)
+
+This probe uses the **real scene code with the fake runtime from the host harness**. It checks Android storage,
+process-name handling and both persistence APIs; the headset tests above check the real SteamVR integration.
+The following cross-compilation command was verified offline:
+
+```sh
+native/.cache/ndk-27.2.12479018/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android29-clang \
+  -std=gnu11 -O2 -Wall -Wextra -Werror -Wno-unused-function \
+  -I native/.cache/openxr-f2448a8797 -I native/adapter tests/native/scene_emu_test.c \
+  -lm -o /tmp/frameport-scene-test-android
+scp /tmp/frameport-scene-test-android "$FRAME":/tmp/
+```
+
+Keep a freshly installed game running so its Lepton container exists, then run in the Frame shell:
+
+```sh
+APPID=$(python3 -c 'import json,os,sys; print(json.load(open(os.path.expanduser("~/Applications/quest-frame/"+sys.argv[1]+"/deployment.json")))["appid"])' "$PKG")
+CONTAINER=lepton-steamlaunch-$APPID
+podman cp /tmp/frameport-scene-test-android "$CONTAINER":/data/local/tmp/frameport-scene-test
+podman exec "$CONTAINER" test ! -e /sdcard/Android/data/org.frameport.scenetest
+# Continue only if that test succeeds: use a fresh test-only package directory.
+podman exec "$CONTAINER" mkdir -p /sdcard/Android/data/org.frameport.scenetest/files /data/local/tmp/frameport-scene-probe
+for mode in save reload erase-failure reload erase empty; do
+  podman exec "$CONTAINER" sh -c "FRAMEBRIDGE_CONFIG=/data/local/tmp/frameport-scene-probe/settings.conf exec -a org.frameport.scenetest /data/local/tmp/frameport-scene-test $mode" || break
+done
+podman exec "$CONTAINER" wc -l /sdcard/Android/data/org.frameport.scenetest/files/framebridge-anchors.txt
+```
+
+Every invocation must exit 0 without `FAIL`; logs show `anchors saved`, `loaded 2 saved anchors`, a deliberate
+`anchor write failed` during `erase-failure` (then the following reload still finds two), and `anchors erased`.
+The final file has zero lines. `save` also recreates a session internally, while separate invocations validate
+new-process reload. Undo, before stopping this container:
+
+```sh
+podman exec "$CONTAINER" rm -rf /sdcard/Android/data/org.frameport.scenetest /data/local/tmp/frameport-scene-probe
+podman exec "$CONTAINER" rm -f /data/local/tmp/frameport-scene-test
+rm -f /tmp/frameport-scene-test-android
+```
+
+Remove the PC's temporary probe binary too. Restore backed-up game files/settings and install the previous APK if
+rolling the feature back. No probe command changes real application anchors.
+
+## Commit handoff under the sandbox
+
+This worktree's real Git metadata is on a read-only mount. Commits therefore live on `mr/emul` in
+`/tmp/frameport-mr-emul.git`, with a portable bundle at `/tmp/frameport-mr-emul.bundle`. The actual worktree contains
+all final source/artifact edits but its original branch metadata cannot be advanced here. No local instruction,
+app-data or credential files were staged. The base is `4bf48d3`.
+
+After reviewing the worktree and verifying it contains exactly these changes, the maintainer can import the commits
+and align the existing worktree index without discarding its files:
+
+```sh
+git bundle verify /tmp/frameport-mr-emul.bundle
+git fetch /tmp/frameport-mr-emul.bundle mr/emul
+git log --oneline 4bf48d3..FETCH_HEAD
+git reset --mixed FETCH_HEAD
+```
+
+Run the unrestricted whole suite before merging. The bundle preserves the ordered implementation/test/build commits.

docs/mr/plumb.md

@@ -0,0 +1,171 @@
+# Room plumbing stream
+
+Implemented on `mr/plumb`; no Frame access or device verification. The shared `ROOM_FORMAT.md`, agent version,
+analysis version and patch revisions were left unchanged. No native binaries belong to this stream.
+
+## What changed
+
+- `frameport.mr.room`: room/entity dataclasses, v1 text and binary-mesh validation, canonical serialization,
+  missing ceiling/wall/outline defaults, clockwise outline/wall repair, summaries and top-down SVG previews.
+  Mesh counts, indices, finite coordinates, UUIDs and sidecar basenames are checked before import.
+- Standalone stdlib agent room commands live in one marked block. Rooms are staged under
+  `~/.local/share/frameport/rooms/<universe>/`; a `current` symlink selects the latest saved room. Uploads validate
+  before replacing a room. Deleting the current room selects the newest remaining room.
+- `room_status` returns `rooms`, current `universe`, selected `room`, `room_text`, `aligned`, `default_circle`
+  (null when no usable boundary exists) and `scanner_installed`. Summaries include wall/plane counts, furniture
+  counts by label, floor area and ceiling height. Status text lets the UI preview a room without another transfer.
+- Universe detection takes the last matching vrserver log line, then the newest chaperone record if no log match
+  exists. Dummy universe 424242 means unknown. Boundary conversion chains collision quads' bottom edges and refuses
+  the default 20-point, roughly 1 m circle. Boundary ceilings default to 2.5 m; SteamVR's 2.43 m wall extrusion
+  does not measure the real ceiling.
+- Finalize records `scene_room` from adapter settings. A marked `_room_sync` launcher line follows the existing
+  config-sync pattern, before Lepton starts. Launcher upgrades also handle old recipes listing
+  `adapter.scene_emul`. Matching universe wins over `current`; absent rooms remove stale sidecars. Live setting
+  changes update the launcher and clear copies when disabled. Non-scene launchers keep their existing layout.
+- PC room helpers implement status/import/export/delete/boundary/build/show/capture. Scanner upload reuses the
+  SHA-256 helper extracted from live view; `fp_venc` retains its soft-failure behavior. Import uploads canonical
+  text. Export checks mesh counts; build uploads FPRS dumps, runs the scanner and cleans its staging directory.
+- CLI: `frameport frame room status|from-boundary|import|export|delete|build|show`, with `--frame` on each command.
+  `show --output <path.svg>` writes a preview (default below `FRAMEPORT_HOME/rooms`). Build accepts `--universe`.
+- Frame page Room card: checklist, asset-URL preview, boundary/delete/capture actions, refresh and recoverable errors.
+  SSH and preview writes run in a background worker; state is cached per connection. Scene-game pages link to Room
+  setup when the connected Frame has no room. `ui_smoke.py --fake-frame` supplies local room-command answers.
+- Every USE_SCENE/USE_ANCHOR_API game gets the scene-emulation suggestion. Migration `scene_emul_all` enables it once
+  in automatic recipes, preserving user recipes. NOPE and Pinball FX keep their other recipe fields and now request
+  scene emulation. Triage explains guardian fallback and missing discovery; patch docs and translation template
+  were regenerated.
+
+## Integration questions and limits
+
+1. Headset capture is intentionally unfinished: `room_capture` returns `{"error":"not implemented yet"}`. The
+   `capture_roomview(seconds, out_path)` hook documents the pending RoomView queue work. The GUI explains this and
+   offers the boundary path. Do not present the capture button as a completed scan workflow yet.
+2. This branch has no `fp_roomscan` artifact; merge the scan stream before using `frame room build`. The exact scanner
+   invocation is `fp_roomscan --offline <dump> --out <temporary directory> --universe U --json`. Stdout must contain
+   one JSON value, stderr is saved as `scan.log`, and output must include a valid `room.txt` with the requested U.
+3. Merge the emulation/shim stream before expecting games to use saved rooms, meshes or new Meta entry points.
+   Runtime log spelling is owned there; triage accepts both existing `using guardian room`/dimension logs and the
+   brief's `guardian box`/`room from guardian` messages. Reconcile new success logs at integration.
+4. Confirm the chaperone JSON path, exact universe-switch logs and whether collision quads are already in STAGE on
+   the device. This implementation follows the brief's path and coordinate contract; it does not apply a second
+   standing-origin transform. A universe match alone cannot detect Valve changing an origin without changing its ID.
+5. Agent and desktop perform independent validation because the deployed agent cannot import the desktop package.
+   The desktop canonicalizes outlines and fills defaults; the agent preserves scanner output and validates it.
+   The format contract needed no changes.
+6. Rooms are shared across games; per-game saved anchors are not deleted or rewritten by these commands. Replacing
+   a room creates new entity UUIDs, so a game may need its own room-setup reset. No automatic game reset was added.
+
+## Offline validation
+
+All commands used `FRAMEPORT_HOME` in this worktree (tests use temporary isolated homes), an existing dependency
+venv and offline/no-sync uv settings. No dependencies or native toolchains were downloaded.
+
+- Room, PC/CLI, UI, heuristics, migration, MR triage and translation checks passed: 63 tests. The related
+  agent/launcher/screenshots/codec/gamepad regression group passed 170 tests. The final deployment/configuration
+  regression check passed 48 tests, including all four recipe/settings precedence cases.
+- Ruff over changed Python files and `scripts/patch_docs.py --check` passed. The UI detector reported no findings.
+  `scripts/i18n_extract.py` regenerated `src/frameport/locales/template.json`.
+- `pytest -m games`: 3 skipped (no game dumps). Dev/holdout evaluation used only the checked-in demo analysis
+  snapshot, 21 catalog matches: dev dated 9/17 exact, F1 81.1%; holdout dated 1/4 exact, F1 73.3%. These are limited
+  fixture results, not a new score for the owner's complete collection; the evaluator exits 1 for recipe differences.
+- Final full suite: **1790 passed, 40 skipped, 11 failed, 16 errors** in 87.35 s. All 27 failures/errors are
+  `PermissionError: [Errno 1] Operation not permitted` when existing tests create sockets. The whole-suite green
+  requirement cannot be met in this sandbox; rerun `uv run pytest -q` on a host permitting loopback sockets.
+  Browser UI smoke also requires a loopback server, so it
+  was not run. New UI tests construct the real Flet controls and exercise deferred preview/error/cache states.
+
+## Exact device checks (maintainer only)
+
+Run these after integrating emul + scan. Substitute the paired Frame address below; keep the current worktree's
+`FRAMEPORT_HOME=.home` and use explicit `--frame` so the test does not open another app data directory. The source
+connection syncs the agent by digest even without a version bump, unless the Frame has a newer agent version.
+The maintainer must perform integration version bumps before testing against a newer installed agent.
+
+```sh
+export FRAME='steamos@<frame>'
+export PKG='com.gritGames.Nope'  # repeat with com.zenstudios.PFXVRQuest and a known scene game
+uv run frameport frame info --frame "$FRAME"
+uv run frameport frame room status --frame "$FRAME" > .home/mr-status.json
+# Back up ALL rooms on the Frame before destructive checks; use an unused backup name.
+ssh "$FRAME" 'test ! -e ~/.local/share/frameport/rooms.before-mr-test && { test ! -d ~/.local/share/frameport/rooms || cp -a ~/.local/share/frameport/rooms ~/.local/share/frameport/rooms.before-mr-test; }'
+```
+
+1. Inspect status: no room gives `room: null`, `aligned: false`. With Valve's default circle, `default_circle: true`;
+   `uv run frameport frame room from-boundary --frame "$FRAME"` must fail with the default-circle explanation.
+   Set a real play area in SteamVR, repeat `from-boundary`: expect source `boundary`, one wall per boundary edge,
+   correct floor area and `aligned: true`. Open Frame → Room: visible preview, warning for the unscanned room,
+   aligned row ready; the capture button should show the friendly unavailable message without crashing.
+2. Exercise import/export and preview with a manual fixture in the current universe:
+
+```sh
+uv run frameport frame room status --frame "$FRAME" > .home/mr-status.json
+uv run python - <<'PY'
+import json
+from pathlib import Path
+from frameport.mr.room import Mesh, Volume, box_room, dumps, write_mesh
+p = Path('.home/mr-check'); p.mkdir(parents=True, exist_ok=True)
+r = box_room(4, 3, 2.5)
+r.source = 'manual'
+r.universe = json.loads(Path('.home/mr-status.json').read_text())['universe']
+r.volumes.append(Volume('a'*32, 'TABLE', .5, 0, .8, 20, 1.2, .7, .8))
+r.mesh = Mesh(vertices=[(-2, 0, -1.5), (2, 0, -1.5), (2, 0, 1.5)], indices=[0, 1, 2])
+(p/'room.txt').write_text(dumps(r))
+(p/'room-mesh.bin').write_bytes(write_mesh(r.mesh))
+PY
+uv run frameport frame room import .home/mr-check/room.txt --frame "$FRAME"
+uv run frameport frame room export .home/mr-export --frame "$FRAME"
+uv run frameport frame room show --output .home/mr-check/preview.svg --frame "$FRAME"
+cmp .home/mr-check/room-mesh.bin .home/mr-export/room-mesh.bin
+```
+
+   Expect four walls, one TABLE, area 12 m² and height 2.5 m. The preview must label TABLE and the game must show it
+   hanging below its top-face anchor. Check the corresponding universe folder and `rooms/current` on the Frame.
+3. Use a recorded dump from the same standing universe (do not invent one). Copy it to `.home/mr-check/scan.fprs`,
+   then run the command below. Expect the scanner JSON under `report`, source `scan`, aligned room data, `scan.log`
+   on the Frame and an installed executable. Run twice: an unchanged scanner must not upload again.
+
+```sh
+uv run frameport frame room build .home/mr-check/scan.fprs --frame "$FRAME"
+uv run frameport frame room status --frame "$FRAME"
+```
+
+   If the recording is from another universe, pass its original `--universe <id>`; do not relabel its coordinates.
+4. Prepare the game's source and its existing backed-up signing key in the isolated test library, then force a
+   rebuild/reinstall after integration: `uv run frameport install "$PKG" --frame "$FRAME" --force --apk-only`.
+   Repeat for both catalog games. In each deployment, expect `scene_room: true`. Run `frame info` twice to upgrade
+   old launchers and check one marker only:
+
+```sh
+uv run frameport frame info --frame "$FRAME"
+uv run frameport frame info --frame "$FRAME"
+ssh "$FRAME" "grep -c '# frameport-room-sync' ~/Applications/quest-frame/$PKG/launch.sh"
+uv run frameport settings "$PKG" scene_emul=1 --frame "$FRAME"
+```
+
+   Expected marker count: 1. Start the game with Steam's Play button in the headset, enter its MR mode, then inspect
+   `<deployment.base>/room-sync.log`: JSON has the selected universe and alignment. The two room files must be
+   beside `<deployment.base>/settings.conf`. FrameBridge must load that room; `xrDiscoverSpacesMETA` must resolve
+   through the extension shim, with no `Unknown proc addr`/MRUK `NoRoomsFound`. Exact new native success log strings
+   should be taken from the emul stream. Verify walls/table placement physically; never infer alignment from FPS.
+5. Exit the game. Switch `scene_emul=0` using Game settings (or the settings command above with 0): marker and game
+   sidecars disappear. Switch it back to 1: one marker returns. Delete the room and launch again: stale copies are
+   removed and existing FrameBridge guardian fallback logs trigger informational `mr-no-room` triage.
+6. To check a universe mismatch, back up/export the room, change its `universe` record to another valid ID and import
+   it, then delete the original universe's room with `frame room delete --universe <original-id>`. Status must select
+   `current` but report `aligned: false`; the Room card warns. Restore the original file before playing physically.
+   The dummy universe 424242 should report current universe 0 rather than claim alignment.
+
+## Undo device checks
+
+Close all games. Restore the backed-up store (or remove only the fixture universes if there was no previous store):
+
+```sh
+ssh "$FRAME" 'if test -d ~/.local/share/frameport/rooms.before-mr-test; then rm -rf ~/.local/share/frameport/rooms; mv ~/.local/share/frameport/rooms.before-mr-test ~/.local/share/frameport/rooms; fi'
+```
+
+Set each tested game's `scene_emul` back to its recorded original value. To remove a test room without a backup:
+`uv run frameport frame room delete --universe <fixture-universe> --frame "$FRAME"`. Start a scene game once to
+refresh/remove its copies. The scanner can be removed with
+`ssh "$FRAME" 'rm -f ~/.local/share/frameport/bin/fp_roomscan'`; the next build reinstalls it. Game saves and
+`framebridge-anchors.txt` are untouched. Restore the previous app/agent/native artifacts through the maintainer's
+normal integration rollback if testing the combined native implementation fails.

docs/mr/scan.md

@@ -0,0 +1,338 @@
+# Offline room scanner (scan stream)
+
+`fp_roomscan` converts recorded FPRS v1 meshes to the [room contract](ROOM_FORMAT.md), including the optional
+wall label adopted from upstream commit `8cb2783`:
+`room.txt` and `room-mesh.bin`. It does not capture RoomView queues, contact a headset, install rooms, or modify
+the current-room symlink. Scanner work changes `native/roomscan/`, its build target and artifact/checksum,
+`scripts/mr/synth_scan.py`, `tests/test_roomscan.py`, and this note. The upstream contract commit also brings its
+existing prompt assets and renderer unchanged. No runtime, agent, patch, or analysis versions were bumped.
+
+## Build and run
+
+Use the cached NDK; no downloads are needed for this target:
+
+```sh
+python native/build.py --only roomscan
+```
+
+The result is `artifacts/linux-arm64-bin/fp_roomscan`, a static aarch64 Linux ELF with its own `_start`, raw Linux
+syscalls, and no interpreter, dynamic section, libc, libm, UAPI headers, generated tables, or new dependencies.
+`platform.h` is the reconstruction code's entire I/O/allocation boundary. The same five C sources compile on the
+host:
+
+```sh
+cc -std=c11 -O2 -Wall -Wextra -Werror -ffp-contract=off -fno-math-errno -DFP_HOSTED native/roomscan/*.c -o /tmp/fp_roomscan
+python scripts/mr/synth_scan.py /tmp/room.fprs
+/tmp/fp_roomscan --offline /tmp/room.fprs --out /tmp/scanned-room --universe 0 --json
+```
+
+The output directory's parent must exist; the scanner creates the final directory if needed. It always prints
+exactly one JSON summary, whether `--json` is supplied or omitted. Success exits 0, errors exit 2 with
+`{"ok":false,"error":"..."}`. `--help` prints usage and exits 0. Successful summaries contain:
+
+```json
+{"ok":true,"frames":30,"skipped_frames":0,"far_vertices":0,"discontinuity_triangles":0,
+ "walls":4,"detected_walls":4,"volumes":2,"floor_y":-0.0023,
+ "ceiling_y":2.5992,"coverage_percent":100.0,"hint_used":false,"triangles":70997,
+ "accepted_triangles":118804,"rejected_triangles":704,"warnings":[],
+ "timings_ms":{"read":0,"fusion":0,"model":0,"mesh":0,"total":0}}
+```
+
+The example above illustrates the schema; actual counts and timings depend on the input. Heights are absolute
+STAGE coordinates. `frames` includes skipped frames; `skipped_frames`, `far_vertices`, and
+`discontinuity_triangles` count input exclusions once, not once per pass. `walls` counts output polygon
+edges including synthesized edges; `detected_walls` counts fitted physical planes. Coverage means the percentage
+of the output perimeter supported by observed wall planes, **not camera coverage of all room surfaces**. Timings
+include parsing, fusion, structural/furniture modelling, mesh generation, and total time including output.
+
+All frame headers, timestamps/vertices/poses, approximately unit quaternions, counts, indices and EOF boundaries
+are checked before publication. A non-finite timestamp/pose/vertex or invalid tracking quaternion skips the entire
+frame after consuming and structurally validating its record, with a count and warning. A bad frame never erases
+usable frames elsewhere in the dump. Vertices outside the camera-relative range (default 4 m) and every triangle
+touching them are discarded. Triangles with a camera-depth jump over `--depth-jump + --depth-ratio * nearest_depth`
+are rejected before fusion; this complements long-edge and grazing rejection. Frame counts are capped at
+1 million vertices / 3 million indices;
+oversized records fail rather than allocating from untrusted counts. A header-only dump or one without usable
+triangles fails. Empty frames may accompany useful frames. Structural corruption (truncation, unsupported header,
+bad counts or indices) remains fatal, preserves any existing output byte for byte and creates no output directory.
+UUIDs come from `getrandom`, fresh per scan; mesh geometry is repeatable.
+
+Both complete files are written to exclusive, randomly named temporary files, then individually renamed, with
+the mesh first and `room.txt` last. A write failure removes the temporary files. These are atomic **file**
+replacements, not a two-file filesystem transaction: the installer should scan into a fresh staging directory
+and publish that directory/symlink after success. Do not run concurrent writers into the same output directory.
+There is no fsync-based power-loss durability promise. Neither scan nor build writes application data outside
+the worktree's `FRAMEPORT_HOME`; fixtures and test output use temporary directories.
+
+## Reconstruction
+
+1. The first streaming pass validates every frame, rotates its mesh by the supplied quaternion, and translates
+   it into STAGE. It rejects degenerate triangles, excessively long edges, out-of-range points, and grazing
+   surfaces. Winding is corrected toward the observing camera. A deterministic bounded reservoir of 32,768
+   accepted triangle centroids determines median position and padded bounds. No frames are retained across reads.
+2. The second pass rasterizes accepted triangles at 0.75 voxel spacing. Per-cell surfels average positions and
+   inward normals, weighted by area and squared incidence. A capped accumulated weight lets later views correct
+   earlier ones. The grid is sized from the sample bounds and capped at 8 x 8 x 4 metres about the data median.
+   Unobserved cells have zero weight. This implementation uses a bounded dense backing array for the sparse
+   observations, rather than a hash table; the 4.2-million-cell hard cap bounds all later work. Complete regular
+   fans are recognized from their index topology, without hardcoding a camera resolution. Their normals come from
+   12 x 12 neighbourhood covariance plane fits, rejecting patches above `--patch-residual` RMS; irregular meshes
+   retain triangle normals. Each cell counts contributing frames once and needs `--min-views` evidence, capped at
+   ten percent of usable frames (rounded down, at least one) for brief captures. This suppresses transient stereo
+   geometry without requiring a short scan to see each surface five times.
+3. Horizontal normal/height histograms select the dominant floor within the STAGE floor band and a ceiling above
+   the minimum ceiling height. Missing floor uses STAGE y=0 with a warning; missing ceiling uses floor plus
+   `--ceiling-default`, warning exactly `ceiling not seen`. A ceiling must also have at least 15% as many supported
+   cells as all upward-facing horizontal surfaces, so a few isolated down-facing patches do not invent a ceiling.
+4. RANSAC fits near-vertical planes using distance and normal agreement, then refines them by position covariance.
+   Minimum height, span, and area reject furniture faces. Wall directions within the snap tolerance of the
+   dominant wall's orthogonal directions are snapped, with offsets refitted. Directed wall segments are connected
+   by nearest endpoints and adjacent line intersections. This preserves the L-shaped fixture's re-entrant corner.
+   Parallel same-facing planes within 25 cm / approximately 14° merge, suppressing duplicate softened faces.
+   Planes below 20% of the strongest original plane's area are discarded. When at least 65% of candidate wall area
+   supports an orthogonal family, directions outside 12° of that family are discarded (`--snap-degrees 0` disables
+   this orthogonal consensus filter). Large gaps close along observed endpoints. Ambiguous endpoints with three
+   or four planes can use inward half-plane intersections; concave rooms retain segment ordering. Otherwise a
+   warned observed-bounds rectangle is used. Polygon checks reject crossing edges. The output follows the contract's positive
+   shoelace ordering in (x,z), with left-facing inward normals.
+5. Furniture tops are clustered separately from vertical faces, within supported horizontal height bands. A
+   softened edge connecting a tabletop to a wall can no longer absorb the whole room into one box. Top boxes use
+   a minimum-area horizontal orientation search and the median surface height; vertical screen candidates use
+   face-direction harmonics / PCA. Bounds trim the outer 2% to suppress stereo halos. Top boxes extend down to the
+   floor (the footprint and lower extent remain geometric estimates). Weak/sparse top patches are discarded.
+   Labels follow height, area, long-side (with two voxels of measurement tolerance),
+   thinness and near-wall rules, in order BED, COUCH, TABLE, SCREEN, STORAGE, OTHER. Only volumes are emitted;
+   optional table plane records are not required. Floor/ceiling/wall surfaces are excluded before clustering.
+6. Surfel splats form an incidence/area-weighted signed distance field within three voxels of each surface. The
+   sign is positive in observed free room space. Marching cubes traces zero crossings on cube faces, resolving
+   ambiguous faces from their centre sign. It fans closed contours and orients triangles toward the positive
+   gradient. Unknown corners suppress extraction rather than bridging unobserved space. If necessary, extraction
+   is repeated on a coarser lattice (strides 2–4) until at most 200,000 triangles remain, with a decimation warning;
+   excess beyond that fails. Vertices are unshared triangle vertices, so at most 600,000 vertices. Structural
+   planes are semantic anchors, not substituted for the observed global mesh.
+
+Peak allocation stays below 260 MiB, including maximum frame buffers, the grid, model worklists and mesh buffers
+(the latter phases do not retain frame buffers). Default synthetic scenes use a much smaller grid. Thresholds
+are CLI options below or named constants next to their algorithms. No room-specific coordinates or dimensions are
+used; on-device quality and speed still need validation.
+
+## Tuning
+
+Distances are metres, areas m², volumes m³. `--universe` accepts the full unsigned 64-bit range; 0 means unknown.
+
+| Option | Default | Accepted range / meaning |
+| --- | ---: | --- |
+| `--voxel` | 0.05 | 0.04–0.20, spatial resolution; lower values cost more memory/work |
+| `--ceiling-default` | 2.5 | 1.8–3.8, height above floor when ceiling is unseen |
+| `--truncation` | 3 | 1–5, TSDF band in voxel units |
+| `--max-edge` | 0.6 | 0.05–1.5, reject longer triangle edges |
+| `--grazing` | 0.12 | 0.01–0.9, minimum absolute camera/normal cosine |
+| `--range` | 4 | 1–10, maximum camera-relative vertex distance; >4 m opts back into inpainted depth |
+| `--depth-jump` | 0.25 | 0.02–1, absolute part of a triangle's maximum depth discontinuity |
+| `--depth-ratio` | 0.12 | 0–0.5, additional fraction of nearest vertex depth |
+| `--min-views` | 5 | 1–16, temporal support target; brief scans cap it as described above |
+| `--patch-residual` | 0.03 | 0.005–0.1, maximum RMS residual of a regular-fan normal patch |
+| `--plane-distance` | 0.045 | 0.01–0.15, point-to-plane inlier tolerance |
+| `--min-plane-area` | 0.45 | 0.1–4, minimum occupied plane area estimate |
+| `--wall-height` | 1.5 | 0.5–3, minimum observed vertical wall span |
+| `--snap-degrees` | 5 | 0–15, orthogonal snap tolerance |
+| `--floor-band` | 0.35 | 0.05–1, floor search distance from STAGE y=0 |
+| `--ceiling-min` | 1.8 | 1.5–3, minimum absolute ceiling y |
+| `--min-volume` | 0.05 | 0.005–1, reject smaller furniture boxes |
+| `--cluster-gap` | 0.10 | 0.04–0.20, voxel neighbourhood gap (rounded up to cells) |
+| `--gap` | 0.65 | 0.1–1.5, maximum adjacent-wall endpoint extrapolation |
+| `--horizontal` | 0.85 | 0.6–0.99, minimum floor/ceiling/top normal cosine |
+
+Additional constants in `model.c` include RANSAC trials, normal agreement, wall span, furniture margins,
+label height/area thresholds, box trimming and circle recognition. Fusion sampling/weight limits are in
+`fusion.c`; mesh splat radii/decimation limits in `mesh.c`; hard resource limits in `scan.h`.
+
+`--hint outline.txt` accepts one `x z` point per line, decimal/scientific notation, optional `#` comments, either
+winding, at most 96 points / 8 KiB. At least eight points with radial coefficient of variation below 5% count as
+the default circle and are ignored. A non-circular hint is used only when walls are incomplete **and every
+observed wall has a compatible hint edge** within `--gap`. Complete scans are never constrained to chaperone.
+Incompatible inset play boundaries are ignored with a warning. Hint-completed edges retain synthesized status.
+
+## Limits for integration
+
+- Synthesized wall records now append `INVISIBLE_WALL_FACE` as their optional eighth field. Observed walls omit
+  the label and default to `WALL_FACE`; comments are no longer used to carry semantics. This matches upstream's
+  authorized contract change exactly; adapters need that same contract revision.
+- A private RoomView recording was used for offline robustness work. It, its derived geometry, and its results
+  stay outside committed files. Synthetic fixtures independently exercise the input characteristics. They are
+  regressions, not proof
+  of headset accuracy. Furniture labels are geometric heuristics; adjacent/touching objects can merge, occluded
+  objects may split, top-only clusters have inferred depth, and thin fragments can be screen candidates. Nearby
+  parallel walls and small wall jogs can merge under coarse depth uncertainty. Large disconnected coplanar wall segments are
+  currently fitted together; complicated rooms can fall back to a warned rectangle.
+- Cropped or sparse captures can produce an incomplete mesh and synthesized outline. Surfaces are not filled
+  through unseen regions. Furniture is not an accessibility/safety boundary. Rooms beyond the grid cap are
+  cropped with a warning. Default-circle recognition may also ignore an intentionally circular boundary.
+- Output paths are fixed by the contract. The plumbing stream should stage a new directory and switch `current`
+  after scanner success, preserving the previous room for rollback. Assign the recording's actual universe id;
+  this standalone scanner cannot query SteamVR or validate universe alignment.
+
+## Offline validation
+
+`tests/test_roomscan.py` builds with the host compiler (skips only if none exists). Its 41 tests cover the noisy
+4 x 3 x 2.6 m room with table/couch, six-wall L, moving and rotated/translated mesh poses, ceiling fallback, a single
+frame, missing walls, circular/matching hints, correct UUIDs/wire layout, interior mesh winding, triangle budget,
+repeatable mesh bytes with fresh UUIDs, truncated/corrupt dumps, invalid counts/indices/poses and invalid CLI values.
+The test module takes about fourteen seconds including synthetic rendering and compilation (under the 60 s budget).
+New cases cover non-finite frames before/after usable frames, per-vertex far rejection, depth jumps below the edge
+limit, weak ceiling evidence, wall labels and a complete camera-fan scan. The deterministic stdlib renderer now
+defaults to a 132 x 128 full index fan (99,822 indices), +Z forward / -Y image up, with poses mapping to STAGE.
+It adds separable depth smoothing, spatially correlated noise, far inpainting, two initial NaN poses, 3 Hz timestamps
+and head-height drift from 0.9 to 1.7 m. `--profile legacy` retains the smaller 110° x 76° test cone. New CLI controls
+are `--profile`, `--invalid-start`, `--smoothing` and optional resolution overrides. Use `--invalid-start 0` for a
+usable one-frame fixture; default RoomView warm-up frames otherwise have no valid tracking.
+
+```sh
+UV_OFFLINE=1 UV_CACHE_DIR=/tmp/frameport-uv-cache uv run pytest -q tests/test_roomscan.py
+UV_OFFLINE=1 UV_CACHE_DIR=/tmp/frameport-uv-cache uv run ruff check scripts/mr/synth_scan.py tests/test_roomscan.py
+```
+
+The synthetic camera fan passes AddressSanitizer + UndefinedBehaviorSanitizer. Two consecutive final native builds
+produce identical SHA-256 `0d88e5adfa1a21da7e0cfec2698a835d7767961e15c0b41c84235fa24ae1e751` (54,248 bytes),
+matching `artifacts/SHA256SUMS`. ELF inspection confirms aarch64, little-endian, no PT_INTERP / PT_DYNAMIC, and no
+embedded local build paths.
+
+The required full `uv run pytest -q` run completed with **1,788 passed, 40 skipped, 11 failed, 16 errors** in 79 s.
+All 27 failures/errors are the sandbox's `PermissionError: [Errno 1] Operation not permitted` on socket creation
+in existing HTTP/pairing/live-stream tests (`test_deeplink`, `test_devkit`, `test_install_links_extra`,
+`test_livestream`, `test_setup_url`, `test_ui_state`). This environment forbids sockets, including loopback.
+The unchanged baseline had the identical 27 failures/errors before the scanner tests were added (1,747 passed).
+Consequently the whole-suite-pass requirement cannot be satisfied here; rerun it outside that restriction at
+integration. No tests were changed/skipped to hide the restriction and no network/device access was attempted.
+No patch/settings/catalog/triage files were touched, so the conditional patch documentation regeneration is
+unnecessary.
+
+## Ten-minute capture budget (synthetic benchmark)
+
+The scanner is streaming and single-threaded. On an Intel Core i7-14700K host, a **synthetic-only** 1,800-frame
+132 x 128 dump (1,083,751,208 bytes, equivalent to ten minutes at 3 Hz) took **7.41 s elapsed / 7.08 s CPU**, with
+**27,208 KiB maximum RSS** at the default voxel size. The file repeats a 30-view synthetic sweep, including its
+warm-up frames; it tests parsing/fusion throughput rather than 1,800 independent viewpoints. Geometry-dependent
+model/mesh work and storage caches affect timing. No private recording or derived room data is in that benchmark.
+
+Reproduce with bounded copies rather than loading a gigabyte into Python:
+
+```sh
+python scripts/mr/synth_scan.py /tmp/roomview.fprs
+python - <<'PY'
+import shutil
+with open('/tmp/roomview.fprs', 'rb') as source, open('/tmp/roomscan-1800.fprs', 'wb') as out:
+    out.write(source.read(8))
+    for repeat in range(60):
+        source.seek(8)
+        shutil.copyfileobj(source, out, 1024 * 1024)
+PY
+/usr/bin/time -v /tmp/fp_roomscan --offline /tmp/roomscan-1800.fprs --out /tmp/roomscan-benchmark --json
+```
+
+For the Frame's Cortex-A720/X4-class cores, budgeting **3–5 times the host CPU time plus storage** gives roughly
+**23–38 s** for this workload, leaving headroom under the requested ~60 s. This is an estimate, not an ARM
+measurement or an 8-core speedup claim. Worst-case allocations are bounded below 260 MiB independently of frame
+count (48-byte cells, 4.2-million-cell cap, bounded frame buffers/worklists), below both the original 300 MB and
+follow-up 600 MB limits. A maximum-sized complex room can add model/mesh work beyond this small synthetic sweep.
+The maintainer must time a ten-minute real capture on the Frame and check CPU time, wall time and RSS before
+claiming the target is achieved on-device. Hardware square root instructions replace iterative division; neither
+build links libm. The build and host command both require `-fno-math-errno` for that intrinsic.
+
+## Exact device checks (maintainer only; none executed by this stream)
+
+1. On the development PC, build, then render the canonical fixtures:
+
+   ```sh
+   python native/build.py --only roomscan
+   python scripts/mr/synth_scan.py /tmp/box.fprs
+   python scripts/mr/synth_scan.py /tmp/l.fprs --shape l
+   python scripts/mr/synth_scan.py /tmp/down.fprs --no-ceiling
+   python scripts/mr/synth_scan.py /tmp/one.fprs --frames 1 --invalid-start 0
+   scp artifacts/linux-arm64-bin/fp_roomscan /tmp/box.fprs /tmp/l.fprs /tmp/down.fprs /tmp/one.fprs steamos@<FRAME>:~/Downloads/
+   ```
+
+2. In a terminal **on the Frame**, use an isolated directory; no game or current room is changed:
+
+   ```sh
+   mkdir -p "$HOME/.local/share/frameport/roomscan-test"
+   cd "$HOME/.local/share/frameport/roomscan-test"
+   cp "$HOME/Downloads/fp_roomscan" ./fp_roomscan
+   chmod 700 ./fp_roomscan
+   ./fp_roomscan --help
+   ./fp_roomscan --offline "$HOME/Downloads/box.fprs" --out box --universe 0 --json > box.json
+   cat box.json
+   ./fp_roomscan --offline "$HOME/Downloads/l.fprs" --out l --json > l.json
+   ./fp_roomscan --offline "$HOME/Downloads/down.fprs" --out down --ceiling-default 2.7 --json > down.json
+   ./fp_roomscan --offline "$HOME/Downloads/one.fprs" --out one --json > one.json
+   ```
+
+   Expected JSON: box has `ok:true`, `walls:4`, `detected_walls:4`, `volumes:2`, floor within 5 cm of 0,
+   ceiling within 5 cm of 2.6, coverage 100; the only expected box warnings concern skipped warm-up frames and
+   out-of-range vertices. `box/room.txt` includes TABLE and COUCH volume records.
+   L has six walls and the concave corner near (0,0), rather than a rectangle. Down includes exactly the warning
+   string `ceiling not seen` (other warnings are expected), with ceiling minus floor 2.7. One includes
+   `few frames; scan more viewpoints`. Every mesh should have at most 200,000 triangles. JSON is the scanner log;
+   there are no expected stderr status lines.
+
+3. Verify sidecars, wall labels and the corrupt-input exit status on the Frame:
+
+   ```sh
+   python3 - <<'PY'
+   import json, pathlib, struct
+   for name in ('box', 'l', 'down', 'one'):
+       report = json.loads(pathlib.Path(name + '.json').read_text())
+       data = pathlib.Path(name, 'room-mesh.bin').read_bytes()
+       magic, version, nv, ni = struct.unpack_from('<4sIII', data)
+       assert report['ok'] and magic == b'FPRM' and version == 1
+       assert ni % 3 == 0 and 0 < ni // 3 <= 200000
+       assert len(data) == 16 + nv * 12 + ni * 4
+       for line in pathlib.Path(name, 'room.txt').read_text().splitlines():
+           if line.startswith('wall '):
+               fields = line.split()
+               assert len(fields) in (8, 9)
+               if len(fields) == 9:
+                   assert fields[-1] == 'INVISIBLE_WALL_FACE'
+       print(name, nv, ni // 3, report['warnings'])
+   pathlib.Path('broken.fprs').write_bytes(b'FPRS\x01\0\0\0\0')
+   PY
+   ./fp_roomscan --offline broken.fprs --out broken --json
+   echo "$?"
+   test ! -e broken/room.txt
+   test ! -e broken/room-mesh.bin
+   ```
+
+   Expected: `{"ok":false,"error":"truncated frame header"}`, exit status 2, no `broken` outputs.
+
+4. Record actual RoomView dumps with the maintainer's recorder (FPRS v1, mesh-to-STAGE poses, stable universe).
+   Copy the recording to `~/Downloads/capture.fprs`. Look around slowly for about a minute, including floor,
+   ceiling, every wall, and furniture from several directions. With the **recorded universe id** assigned below:
+
+   ```sh
+   scan_universe=0  # replace 0 with the recorder's actual decimal universe id
+   /usr/bin/time -v ./fp_roomscan --offline "$HOME/Downloads/capture.fprs" --out real --universe "$scan_universe" --json > real.json 2> real-timing.log
+   cat real.json real-timing.log
+   cat real/room.txt
+   ```
+
+   Measure wall offsets/yaws, ceiling and table top physically and compare to the records (target 5 cm / 2°).
+   Check resident memory below 300 MB, sensible coverage/warnings, tabletop labels and no false wall/furniture
+   blobs from smeared edges. Repeat with `--max-edge 0.35 --grazing 0.2` into `real-stricter` if edges smear;
+   try `--voxel 0.08 --plane-distance 0.07` into `real-coarser` if depth is noisy. Keep both JSON logs and raw
+   dumps **outside git** for threshold calibration. These are proposed tuning probes, not established device fixes.
+
+5. Repeat the synthetic 1,800-frame benchmark from the preceding section on the Frame, using the same command
+   and `/usr/bin/time -v`. Then test a ten-minute independent real capture. Target: about 60 s elapsed or less,
+   less than 600 MB RSS, successful JSON and bounded mesh size. Record CPU time as well as wall time so storage
+   overhead is visible. With difficult stereo edges compare `--min-views 8 --patch-residual 0.02` in a fresh output
+   directory; short captures cap view support automatically. Include the JSON's exclusion counters in triage;
+   skipped frames may occur anywhere in the capture. Keep all personal results outside git.
+
+6. After merging plumbing/emulation, publish this staged room through that stream's room-install path and try
+   Demeter, then an MRUK discovery/mesh game. Check room loading, furniture alignment, and warning/fallback
+   behaviour in-headset; the scanner alone cannot verify the Meta API path. Do not replace `rooms/current` by hand
+   during these standalone checks.
+
+Undo standalone checks: remove only the isolated `~/.local/share/frameport/roomscan-test` directory and the five
+test files copied to `~/Downloads` (plus `capture.fprs` if no longer needed). No Steam settings, games, agent,
+room universe folder, or current-room symlink were changed by these steps.

native/a32translator/src/jit.c

@@ -32,12 +32,6 @@ extern void jit_exit(void);
 #define HASH_BITS 18
 #define LTAB_BITS 18
 #define MAX_INSNS 96
-/* stubs one more instruction (up to 3: a helper or side exit, a conditional skip, its fall-through exit) and the
- * block's final exit may still need; a block ends before fewer than this are left of MAX_STUBS. Without it, runs of
- * helper-translated instructions (each needs a stub) overflowed the table: OpenSSL's sha1_block_data_order_armv8
- * (~60 SHA1 crypto instructions in a row, Pinball FX2 VR, GitHub #342) killed the game (fatal "overflowed the code
- * buffer"). */
-#define STUB_RESERVE 8
 
 static uint32_t *cache, *cache_cur, *cache_end;
 static jit_block *htab[1u << HASH_BITS];
@@ -1387,8 +1381,7 @@ static jit_block *translate(uint32_t pc, int thumb, uint32_t it, int *fault, int
         x->it = it_after;
         if (x->ended || b->overflow) break;
         /* a fused VCMP needs its VMRS in the same block (x->next is set, so it is within MAX_INSNS) */
-        if ((!x->skip_vmrs && (n + 1 >= MAX_INSNS || (size_t)(b->p - b->start) > (CACHE_MARGIN / 4) / 2 ||
-                               x->nstubs > MAX_STUBS - STUB_RESERVE)) ||
+        if ((!x->skip_vmrs && (n + 1 >= MAX_INSNS || (size_t)(b->p - b->start) > (CACHE_MARGIN / 4) / 2)) ||
             !(len = nlen ? nlen : decode_guest(cur, thumb, x->it, &in))) {
             jx_exit_direct(x, cur, thumb, x->it);
             break;

native/a32translator/tests/programs/sha1ce.c

@@ -1,108 +0,0 @@
-/* The ARMv8 crypto instructions (SHA1C/P/M/H/SU0/SU1), which the JIT translates through the interpreter (one exit
- * stub each): dense() = 72 of them in a row, as dense as OpenSSL's sha1_block_data_order_armv8, whose block
- * overflowed the JIT's stub table (fatal "overflowed the code buffer"; GitHub #342, Pinball FX2 VR); then a fully
- * unrolled SHA-1 checked against known digests. Built with -march=armv8-a -mfpu=crypto-neon-fp-armv8. */
-#include <arm_neon.h>
-#include <stdio.h>
-#include <string.h>
-
-#define K0 0x5A827999u
-#define K1 0x6ED9EBA1u
-#define K2 0x8F1BBCDCu
-#define K3 0xCA62C1D6u
-
-/* 4 rounds: e1 = sha1h(a), abcd = sha1{c,p,m}(abcd, e0, w + k); then the message schedule */
-#define R(op, k, e_in, e_out, w) do { \
-        e_out = vsha1h_u32(vgetq_lane_u32(abcd, 0)); \
-        abcd = op(abcd, e_in, vaddq_u32(w, vdupq_n_u32(k))); \
-    } while (0)
-#define SCHED(w0, w1, w2, w3) (w0 = vsha1su1q_u32(vsha1su0q_u32(w0, w1, w2), w3))
-
-static void block(uint32_t st[5], const uint8_t *p)
-{
-    uint32x4_t abcd = vld1q_u32(st), abcd0 = abcd;
-    uint32_t e0 = st[4], e1, e00 = e0;
-    uint32x4_t w0 = vreinterpretq_u32_u8(vrev32q_u8(vld1q_u8(p)));
-    uint32x4_t w1 = vreinterpretq_u32_u8(vrev32q_u8(vld1q_u8(p + 16)));
-    uint32x4_t w2 = vreinterpretq_u32_u8(vrev32q_u8(vld1q_u8(p + 32)));
-    uint32x4_t w3 = vreinterpretq_u32_u8(vrev32q_u8(vld1q_u8(p + 48)));
-    R(vsha1cq_u32, K0, e0, e1, w0); SCHED(w0, w1, w2, w3);
-    R(vsha1cq_u32, K0, e1, e0, w1); SCHED(w1, w2, w3, w0);
-    R(vsha1cq_u32, K0, e0, e1, w2); SCHED(w2, w3, w0, w1);
-    R(vsha1cq_u32, K0, e1, e0, w3); SCHED(w3, w0, w1, w2);
-    R(vsha1cq_u32, K0, e0, e1, w0); SCHED(w0, w1, w2, w3);
-    R(vsha1pq_u32, K1, e1, e0, w1); SCHED(w1, w2, w3, w0);
-    R(vsha1pq_u32, K1, e0, e1, w2); SCHED(w2, w3, w0, w1);
-    R(vsha1pq_u32, K1, e1, e0, w3); SCHED(w3, w0, w1, w2);
-    R(vsha1pq_u32, K1, e0, e1, w0); SCHED(w0, w1, w2, w3);
-    R(vsha1pq_u32, K1, e1, e0, w1); SCHED(w1, w2, w3, w0);
-    R(vsha1mq_u32, K2, e0, e1, w2); SCHED(w2, w3, w0, w1);
-    R(vsha1mq_u32, K2, e1, e0, w3); SCHED(w3, w0, w1, w2);
-    R(vsha1mq_u32, K2, e0, e1, w0); SCHED(w0, w1, w2, w3);
-    R(vsha1mq_u32, K2, e1, e0, w1); SCHED(w1, w2, w3, w0);
-    R(vsha1mq_u32, K2, e0, e1, w2); SCHED(w2, w3, w0, w1);
-    R(vsha1pq_u32, K3, e1, e0, w3); SCHED(w3, w0, w1, w2);
-    R(vsha1pq_u32, K3, e0, e1, w0);
-    R(vsha1pq_u32, K3, e1, e0, w1);
-    R(vsha1pq_u32, K3, e0, e1, w2);
-    R(vsha1pq_u32, K3, e1, e0, w3);
-    vst1q_u32(st, vaddq_u32(abcd, abcd0));
-    st[4] = e0 + e00;
-}
-
-static void sha1(const char *msg, uint8_t out[20])
-{
-    uint32_t st[5] = {0x67452301u, 0xEFCDAB89u, 0x98BADCFEu, 0x10325476u, 0xC3D2E1F0u};
-    uint8_t buf[128] = {0};
-    size_t n = strlen(msg), blocks = (n + 9 + 63) / 64;
-    memcpy(buf, msg, n);
-    buf[n] = 0x80;
-    unsigned long long bits = (unsigned long long)n * 8;
-    for (int k = 0; k < 8; k++) buf[blocks * 64 - 1 - k] = (uint8_t)(bits >> (8 * k));
-    for (size_t b = 0; b < blocks; b++) block(st, buf + 64 * b);
-    for (int k = 0; k < 20; k++) out[k] = (uint8_t)(st[k / 4] >> (24 - 8 * (k % 4)));
-}
-
-/* 72 crypto instructions with nothing between them: denser than the compiler's code above, as dense as OpenSSL's
- * hand-written rounds */
-__attribute__((noinline)) static void dense(uint32_t v[12])
-{
-    __asm__ volatile("vld1.32 {d0-d3}, [%0]!\n\t"
-                     "vld1.32 {d4-d5}, [%0]\n\t"
-                     ".rept 24\n\t"
-                     "sha1c.32 q0, q1, q2\n\t"
-                     "sha1h.32 q1, q0\n\t"
-                     "sha1su0.32 q2, q0, q1\n\t"
-                     ".endr\n\t"
-                     "vst1.32 {d4-d5}, [%0]\n\t"
-                     "sub %0, %0, #32\n\t"
-                     "vst1.32 {d0-d3}, [%0]"
-                     : "+r"(v)
-                     :
-                     : "memory", "d0", "d1", "d2", "d3", "d4", "d5");
-}
-
-int main(void)
-{
-    uint32_t v[12];
-    for (int k = 0; k < 12; k++) v[k] = 0x9e3779b9u * (k + 1);
-    for (int r = 0; r < 3; r++) dense(v);
-    printf("dense:");
-    for (int k = 0; k < 12; k++) printf(" %08x", v[k]);
-    printf("\n");
-
-    static const char *const msgs[] = {"", "abc", "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq"};
-    static const char *const want[] = {"da39a3ee5e6b4b0d3255bfef95601890afd80709",
-                                       "a9993e364706816aba3e25717850c26c9cd0d89d",
-                                       "84983e441c3bd26ebaae4aa1f95129e5e54670f1"};
-    int bad = 0;
-    for (int m = 0; m < 3; m++) {
-        uint8_t d[20];
-        char hex[41];
-        sha1(msgs[m], d);
-        for (int k = 0; k < 20; k++) sprintf(hex + 2 * k, "%02x", d[k]);
-        printf("sha1(\"%s\") = %s %s\n", msgs[m], hex, strcmp(hex, want[m]) ? "WRONG" : "ok");
-        bad |= strcmp(hex, want[m]) != 0;
-    }
-    return bad;
-}

native/a32translator/tests/run_programs.py

@@ -31,9 +31,7 @@ PROGRAMS = {  # name -> (source, variants, args)
     "jitguest": ("jitguest.c", ["arm", "thumb"], []),
     "exec": ("exec.c", ["arm", "thumb"], []),
     "bench": ("bench.c", ["arm", "thumb"], []),
-    "sha1ce": ("sha1ce.c", ["arm", "thumb"], []),
 }
-EXTRA_FLAGS = {"sha1ce.c": ["-march=armv8-a", "-mfpu=crypto-neon-fp-armv8"]}  # ARMv8 crypto instructions
 JIT_ONLY = {"bench"}  # far too slow for the interpreter under emulation
 
 
@@ -44,7 +42,7 @@ def build(name, src, variant):
         return out
     BUILD.mkdir(parents=True, exist_ok=True)
     cc = NDK_BIN / ("armv7a-linux-androideabi29-clang++" if src.endswith(".cpp") else "armv7a-linux-androideabi29-clang")
-    cmd = [str(cc), *VARIANTS[variant], "-mfpu=neon-vfpv4", *EXTRA_FLAGS.get(src, []), "-static", "-g", str(srcp), "-lm", "-o", str(out)]
+    cmd = [str(cc), *VARIANTS[variant], "-mfpu=neon-vfpv4", "-static", "-g", str(srcp), "-lm", "-o", str(out)]
     if src.endswith(".cpp"):
         cmd += ["-static-libstdc++", "-std=c++17"]
     subprocess.run(cmd, check=True)

native/adapter/action_names.h

@@ -1,35 +0,0 @@
-// SPDX-License-Identifier: GPL-3.0-only
-// action_dedup (session_fixes.c, GitHub #323): a free name for a controller action whose name or localized name is
-// already used in its action set. No OpenXR types, so the host tests can compile it.
-#pragma once
-#include <stdio.h>
-#include <string.h>
-
-static size_t action_name_len(const char *s, size_t max) {  // strnlen (not in plain C11)
-    size_t n = 0;
-    while (n < max && s[n]) ++n;
-    return n;
-}
-
-// taken(ctx, name, localized): 1 when `name` or `localized` is already used in the set.
-typedef int (*action_name_taken_fn)(void *ctx, const char *name, const char *localized);
-
-// Writes "<name>_N" / "<localized> N" (N = 2..99, the first pair not taken; cut to fit name_size/localized_size
-// including the terminator) and returns 1; 0 when the original names are free or no free pair exists.
-static int action_unique_names(const char *name, const char *localized, action_name_taken_fn taken, void *ctx,
-                               char *out_name, size_t name_size, char *out_localized, size_t localized_size) {
-    if (!taken(ctx, name, localized) || name_size < 8 || localized_size < 8) return 0;
-    for (int n = 2; n < 100; ++n) {
-        char suffix[8], lsuffix[8];
-        snprintf(suffix, sizeof(suffix), "_%d", n);
-        snprintf(lsuffix, sizeof(lsuffix), " %d", n);
-        size_t keep = action_name_len(name, name_size - 1);
-        if (keep + strlen(suffix) > name_size - 1) keep = name_size - 1 - strlen(suffix);
-        snprintf(out_name, name_size, "%.*s%s", (int)keep, name, suffix);
-        size_t lkeep = action_name_len(localized, localized_size - 1);
-        if (lkeep + strlen(lsuffix) > localized_size - 1) lkeep = localized_size - 1 - strlen(lsuffix);
-        snprintf(out_localized, localized_size, "%.*s%s", (int)lkeep, localized, lsuffix);
-        if (!taken(ctx, out_name, out_localized)) return 1;
-    }
-    return 0;
-}

native/adapter/alpha_blend.frag

@@ -1,5 +0,0 @@
-#version 450
-// alpha_blend_vk.c: with blending (one minus destination alpha, zero) and only alpha written, the image's alpha
-// becomes 1 - alpha.
-layout(location=0) out vec4 outputColor;
-void main(){outputColor=vec4(0,0,0,1);}

native/adapter/alpha_blend.vert

@@ -1,3 +0,0 @@
-#version 450
-// A triangle that covers the whole viewport (alpha_blend_vk.c).
-void main(){vec2 p=vec2((gl_VertexIndex<<1)&2,gl_VertexIndex&2);gl_Position=vec4(p*2-1,0,1);}

native/adapter/alpha_blend_spv.h

@@ -1,42 +0,0 @@
-// Generated from alpha_blend.vert and alpha_blend.frag.
-static const uint32_t alpha_blend_vert_spv[] = {
-    0x07230203,0x00010000,0x000d000a,0x0000002c,0x00000000,0x00020011,0x00000001,0x0006000b,
-    0x00000001,0x4c534c47,0x6474732e,0x3035342e,0x00000000,0x0003000e,0x00000000,0x00000001,
-    0x0007000f,0x00000000,0x00000004,0x6e69616d,0x00000000,0x0000000c,0x0000001d,0x00040047,
-    0x0000000c,0x0000000b,0x0000002a,0x00050048,0x0000001b,0x00000000,0x0000000b,0x00000000,
-    0x00050048,0x0000001b,0x00000001,0x0000000b,0x00000001,0x00050048,0x0000001b,0x00000002,
-    0x0000000b,0x00000003,0x00050048,0x0000001b,0x00000003,0x0000000b,0x00000004,0x00030047,
-    0x0000001b,0x00000002,0x00020013,0x00000002,0x00030021,0x00000003,0x00000002,0x00030016,
-    0x00000006,0x00000020,0x00040017,0x00000007,0x00000006,0x00000002,0x00040015,0x0000000a,
-    0x00000020,0x00000001,0x00040020,0x0000000b,0x00000001,0x0000000a,0x0004003b,0x0000000b,
-    0x0000000c,0x00000001,0x0004002b,0x0000000a,0x0000000e,0x00000001,0x0004002b,0x0000000a,
-    0x00000010,0x00000002,0x00040017,0x00000017,0x00000006,0x00000004,0x00040015,0x00000018,
-    0x00000020,0x00000000,0x0004002b,0x00000018,0x00000019,0x00000001,0x0004001c,0x0000001a,
-    0x00000006,0x00000019,0x0006001e,0x0000001b,0x00000017,0x00000006,0x0000001a,0x0000001a,
-    0x00040020,0x0000001c,0x00000003,0x0000001b,0x0004003b,0x0000001c,0x0000001d,0x00000003,
-    0x0004002b,0x0000000a,0x0000001e,0x00000000,0x0004002b,0x00000006,0x00000020,0x40000000,
-    0x0004002b,0x00000006,0x00000022,0x3f800000,0x0004002b,0x00000006,0x00000025,0x00000000,
-    0x00040020,0x00000029,0x00000003,0x00000017,0x0005002c,0x00000007,0x0000002b,0x00000022,
-    0x00000022,0x00050036,0x00000002,0x00000004,0x00000000,0x00000003,0x000200f8,0x00000005,
-    0x0004003d,0x0000000a,0x0000000d,0x0000000c,0x000500c4,0x0000000a,0x0000000f,0x0000000d,
-    0x0000000e,0x000500c7,0x0000000a,0x00000011,0x0000000f,0x00000010,0x0004006f,0x00000006,
-    0x00000012,0x00000011,0x000500c7,0x0000000a,0x00000014,0x0000000d,0x00000010,0x0004006f,
-    0x00000006,0x00000015,0x00000014,0x00050050,0x00000007,0x00000016,0x00000012,0x00000015,
-    0x0005008e,0x00000007,0x00000021,0x00000016,0x00000020,0x00050083,0x00000007,0x00000024,
-    0x00000021,0x0000002b,0x00050051,0x00000006,0x00000026,0x00000024,0x00000000,0x00050051,
-    0x00000006,0x00000027,0x00000024,0x00000001,0x00070050,0x00000017,0x00000028,0x00000026,
-    0x00000027,0x00000025,0x00000022,0x00050041,0x00000029,0x0000002a,0x0000001d,0x0000001e,
-    0x0003003e,0x0000002a,0x00000028,0x000100fd,0x00010038,
-};
-static const uint32_t alpha_blend_frag_spv[] = {
-    0x07230203,0x00010000,0x000d000a,0x0000000d,0x00000000,0x00020011,0x00000001,0x0006000b,
-    0x00000001,0x4c534c47,0x6474732e,0x3035342e,0x00000000,0x0003000e,0x00000000,0x00000001,
-    0x0006000f,0x00000004,0x00000004,0x6e69616d,0x00000000,0x00000009,0x00030010,0x00000004,
-    0x00000007,0x00040047,0x00000009,0x0000001e,0x00000000,0x00020013,0x00000002,0x00030021,
-    0x00000003,0x00000002,0x00030016,0x00000006,0x00000020,0x00040017,0x00000007,0x00000006,
-    0x00000004,0x00040020,0x00000008,0x00000003,0x00000007,0x0004003b,0x00000008,0x00000009,
-    0x00000003,0x0004002b,0x00000006,0x0000000a,0x00000000,0x0004002b,0x00000006,0x0000000b,
-    0x3f800000,0x0007002c,0x00000007,0x0000000c,0x0000000a,0x0000000a,0x0000000a,0x0000000b,
-    0x00050036,0x00000002,0x00000004,0x00000000,0x00000003,0x000200f8,0x00000005,0x0003003e,
-    0x00000009,0x0000000c,0x000100fd,0x00010038,
-};

native/adapter/alpha_blend_vk.c

@@ -1,301 +0,0 @@
-// SPDX-License-Identifier: GPL-3.0-only
-// Included by frame_adapter.c after flip_vk.c. XR_FB_composition_layer_alpha_blend for emulated passthrough
-// (setting alpha_blend_emul, Vulkan sessions).
-//
-// Passthrough is emulated by compositing the game's projection layer over the Frame's cameras with its texture alpha
-// (ALPHA_BLEND environment). Unreal's mobile renderer keeps 1 - coverage in the scene alpha (0 where it drew, 1 where
-// it drew nothing), and Meta's OVRPlugin compensates with an XrCompositionLayerAlphaBlendFB on the eye layer
-// (source colour factor ONE_MINUS_SRC_ALPHA, destination SRC_ALPHA). The Frame's runtime ignores that struct, so the
-// cameras showed through the scene and the empty background stayed black (GitHub #329, Star Wars: Beyond Victory).
-// Blending src * (1 - a) + dst * a is the same as the runtime's standard blend with alpha 1 - a, so the alpha of the
-// layer's image rectangles is inverted in place, once per acquired image, by a tiny render pass (blend: one minus
-// destination alpha, zero; only alpha written) before the frame goes to the runtime. Our work is queued on the app's
-// queue ahead of the runtime's xrEndFrame submission; command buffers come from a ring and are only waited for when
-// reused, several frames later.
-#include "alpha_blend_spv.h"
-
-#define AB_RING 4
-#define AB_TARGETS 32
-
-static struct {
-    VkDevice device;  // the session's device these objects belong to
-    int state;        // 0 = not set up, 1 = ready, -1 = failed
-    VkFormat format;  // the pipeline's colour format
-    PFN_vkCreateShaderModule CreateShaderModule;
-    PFN_vkDestroyShaderModule DestroyShaderModule;
-    PFN_vkCreatePipelineLayout CreatePipelineLayout;
-    PFN_vkCreateRenderPass CreateRenderPass;
-    PFN_vkDestroyRenderPass DestroyRenderPass;
-    PFN_vkCreateGraphicsPipelines CreateGraphicsPipelines;
-    PFN_vkDestroyPipeline DestroyPipeline;
-    PFN_vkCreateImageView CreateImageView;
-    PFN_vkDestroyImageView DestroyImageView;
-    PFN_vkCreateFramebuffer CreateFramebuffer;
-    PFN_vkDestroyFramebuffer DestroyFramebuffer;
-    PFN_vkCmdBeginRenderPass CmdBeginRenderPass;
-    PFN_vkCmdEndRenderPass CmdEndRenderPass;
-    PFN_vkCmdBindPipeline CmdBindPipeline;
-    PFN_vkCmdSetViewport CmdSetViewport;
-    PFN_vkCmdSetScissor CmdSetScissor;
-    PFN_vkCmdDraw CmdDraw;
-    VkShaderModule vs, fs;
-    VkPipelineLayout layout;
-    VkRenderPass pass;
-    VkPipeline pipeline;
-    VkCommandBuffer cmd[AB_RING];
-    VkFence fence[AB_RING];
-    int pending[AB_RING], next;
-    struct { XrSwapchain swapchain; VkImage image; uint32_t layer, w, h; VkImageView view; VkFramebuffer fb; } targets[AB_TARGETS];
-} ab;
-
-static int ab_functions(void) {
-#define AB_DEV(name) ab.name = (PFN_vk##name)vk.GetDeviceProcAddr(vk.device, "vk" #name); if (!ab.name) return 0;
-    AB_DEV(CreateShaderModule) AB_DEV(DestroyShaderModule) AB_DEV(CreatePipelineLayout) AB_DEV(CreateRenderPass)
-    AB_DEV(DestroyRenderPass) AB_DEV(CreateGraphicsPipelines) AB_DEV(DestroyPipeline) AB_DEV(CreateImageView)
-    AB_DEV(DestroyImageView) AB_DEV(CreateFramebuffer) AB_DEV(DestroyFramebuffer) AB_DEV(CmdBeginRenderPass)
-    AB_DEV(CmdEndRenderPass) AB_DEV(CmdBindPipeline) AB_DEV(CmdSetViewport) AB_DEV(CmdSetScissor) AB_DEV(CmdDraw)
-#undef AB_DEV
-    return 1;
-}
-
-// Command buffers, fences and shaders: once per session device.
-static int ab_ready(void) {
-    if (ab.device != vk.device) {  // a new session (the old device's objects went with it)
-        memset(&ab, 0, sizeof(ab));
-        ab.device = vk.device;
-    }
-    if (ab.state) return ab.state > 0;
-    ab.state = -1;
-    if (!vk_ready() || !ab_functions()) return 0;
-    VkCommandBufferAllocateInfo alloc = {VK_STRUCTURE_TYPE_COMMAND_BUFFER_ALLOCATE_INFO, NULL, vk.pool,
-                                         VK_COMMAND_BUFFER_LEVEL_PRIMARY, AB_RING};
-    if (vk.AllocateCommandBuffers(vk.device, &alloc, ab.cmd) != VK_SUCCESS) return 0;
-    for (int i = 0; i < AB_RING; ++i) {
-        VkFenceCreateInfo fence = {VK_STRUCTURE_TYPE_FENCE_CREATE_INFO, NULL, 0};
-        if (vk.CreateFence(vk.device, &fence, NULL, &ab.fence[i]) != VK_SUCCESS) return 0;
-    }
-    VkShaderModuleCreateInfo vs = {VK_STRUCTURE_TYPE_SHADER_MODULE_CREATE_INFO, NULL, 0, sizeof(alpha_blend_vert_spv),
-                                   alpha_blend_vert_spv};
-    VkShaderModuleCreateInfo fs = {VK_STRUCTURE_TYPE_SHADER_MODULE_CREATE_INFO, NULL, 0, sizeof(alpha_blend_frag_spv),
-                                   alpha_blend_frag_spv};
-    if (ab.CreateShaderModule(vk.device, &vs, NULL, &ab.vs) != VK_SUCCESS ||
-        ab.CreateShaderModule(vk.device, &fs, NULL, &ab.fs) != VK_SUCCESS) return 0;
-    VkPipelineLayoutCreateInfo layout = {VK_STRUCTURE_TYPE_PIPELINE_LAYOUT_CREATE_INFO, NULL, 0, 0, NULL, 0, NULL};
-    if (ab.CreatePipelineLayout(vk.device, &layout, NULL, &ab.layout) != VK_SUCCESS) return 0;
-    ab.state = 1;
-    return 1;
-}
-
-// Render pass + pipeline for one colour format (the eye swapchains': rebuilt only if it changes).
-static int ab_pipeline(VkFormat format) {
-    if (ab.pipeline && ab.format == format) return 1;
-    if (ab.pipeline) { ab.DestroyPipeline(vk.device, ab.pipeline, NULL); ab.pipeline = VK_NULL_HANDLE; }
-    if (ab.pass) { ab.DestroyRenderPass(vk.device, ab.pass, NULL); ab.pass = VK_NULL_HANDLE; }
-    VkAttachmentDescription color = {0, format, VK_SAMPLE_COUNT_1_BIT, VK_ATTACHMENT_LOAD_OP_LOAD,
-                                     VK_ATTACHMENT_STORE_OP_STORE, VK_ATTACHMENT_LOAD_OP_DONT_CARE,
-                                     VK_ATTACHMENT_STORE_OP_DONT_CARE, VK_IMAGE_LAYOUT_COLOR_ATTACHMENT_OPTIMAL,
-                                     VK_IMAGE_LAYOUT_COLOR_ATTACHMENT_OPTIMAL};
-    VkAttachmentReference ref = {0, VK_IMAGE_LAYOUT_COLOR_ATTACHMENT_OPTIMAL};
-    VkSubpassDescription subpass = {0, VK_PIPELINE_BIND_POINT_GRAPHICS, 0, NULL, 1, &ref, NULL, NULL, 0, NULL};
-    VkSubpassDependency deps[2] = {
-        // the app's rendering into the image (any stage) before our read-modify-write
-        {VK_SUBPASS_EXTERNAL, 0, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT, VK_PIPELINE_STAGE_COLOR_ATTACHMENT_OUTPUT_BIT,
-         VK_ACCESS_MEMORY_WRITE_BIT, VK_ACCESS_COLOR_ATTACHMENT_READ_BIT | VK_ACCESS_COLOR_ATTACHMENT_WRITE_BIT, 0},
-        // and ours before whatever the runtime does with it next
-        {0, VK_SUBPASS_EXTERNAL, VK_PIPELINE_STAGE_COLOR_ATTACHMENT_OUTPUT_BIT, VK_PIPELINE_STAGE_ALL_COMMANDS_BIT,
-         VK_ACCESS_COLOR_ATTACHMENT_WRITE_BIT, VK_ACCESS_MEMORY_READ_BIT | VK_ACCESS_MEMORY_WRITE_BIT, 0},
-    };
-    VkRenderPassCreateInfo rp = {VK_STRUCTURE_TYPE_RENDER_PASS_CREATE_INFO, NULL, 0, 1, &color, 1, &subpass, 2, deps};
-    if (ab.CreateRenderPass(vk.device, &rp, NULL, &ab.pass) != VK_SUCCESS) { ab.pass = VK_NULL_HANDLE; return 0; }
-    VkPipelineShaderStageCreateInfo stages[2] = {
-        {VK_STRUCTURE_TYPE_PIPELINE_SHADER_STAGE_CREATE_INFO, NULL, 0, VK_SHADER_STAGE_VERTEX_BIT, ab.vs, "main", NULL},
-        {VK_STRUCTURE_TYPE_PIPELINE_SHADER_STAGE_CREATE_INFO, NULL, 0, VK_SHADER_STAGE_FRAGMENT_BIT, ab.fs, "main", NULL},
-    };
-    VkPipelineVertexInputStateCreateInfo input = {VK_STRUCTURE_TYPE_PIPELINE_VERTEX_INPUT_STATE_CREATE_INFO};
-    VkPipelineInputAssemblyStateCreateInfo assembly = {VK_STRUCTURE_TYPE_PIPELINE_INPUT_ASSEMBLY_STATE_CREATE_INFO, NULL,
-                                                       0, VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST, VK_FALSE};
-    VkPipelineViewportStateCreateInfo viewport = {VK_STRUCTURE_TYPE_PIPELINE_VIEWPORT_STATE_CREATE_INFO, NULL, 0, 1, NULL,
-                                                  1, NULL};
-    VkPipelineRasterizationStateCreateInfo raster = {VK_STRUCTURE_TYPE_PIPELINE_RASTERIZATION_STATE_CREATE_INFO};
-    raster.polygonMode = VK_POLYGON_MODE_FILL;
-    raster.cullMode = VK_CULL_MODE_NONE;
-    raster.lineWidth = 1.0f;
-    VkPipelineMultisampleStateCreateInfo multisample = {VK_STRUCTURE_TYPE_PIPELINE_MULTISAMPLE_STATE_CREATE_INFO};
-    multisample.rasterizationSamples = VK_SAMPLE_COUNT_1_BIT;
-    VkPipelineColorBlendAttachmentState blend = {VK_TRUE, VK_BLEND_FACTOR_ZERO, VK_BLEND_FACTOR_ONE, VK_BLEND_OP_ADD,
-                                                 VK_BLEND_FACTOR_ONE_MINUS_DST_ALPHA, VK_BLEND_FACTOR_ZERO,
-                                                 VK_BLEND_OP_ADD, VK_COLOR_COMPONENT_A_BIT};
-    VkPipelineColorBlendStateCreateInfo blending = {VK_STRUCTURE_TYPE_PIPELINE_COLOR_BLEND_STATE_CREATE_INFO};
-    blending.attachmentCount = 1;
-    blending.pAttachments = &blend;
-    VkDynamicState dynamic_states[2] = {VK_DYNAMIC_STATE_VIEWPORT, VK_DYNAMIC_STATE_SCISSOR};
-    VkPipelineDynamicStateCreateInfo dynamic = {VK_STRUCTURE_TYPE_PIPELINE_DYNAMIC_STATE_CREATE_INFO, NULL, 0, 2,
-                                                dynamic_states};
-    VkGraphicsPipelineCreateInfo pipeline = {VK_STRUCTURE_TYPE_GRAPHICS_PIPELINE_CREATE_INFO};
-    pipeline.stageCount = 2;
-    pipeline.pStages = stages;
-    pipeline.pVertexInputState = &input;
-    pipeline.pInputAssemblyState = &assembly;
-    pipeline.pViewportState = &viewport;
-    pipeline.pRasterizationState = &raster;
-    pipeline.pMultisampleState = &multisample;
-    pipeline.pColorBlendState = &blending;
-    pipeline.pDynamicState = &dynamic;
-    pipeline.layout = ab.layout;
-    pipeline.renderPass = ab.pass;
-    if (ab.CreateGraphicsPipelines(vk.device, VK_NULL_HANDLE, 1, &pipeline, NULL, &ab.pipeline) != VK_SUCCESS) {
-        ab.pipeline = VK_NULL_HANDLE;
-        return 0;
-    }
-    ab.format = format;
-    // framebuffers were made for the old render pass (compatible only with the same format): drop them
-    for (int i = 0; i < AB_TARGETS; ++i)
-        if (ab.targets[i].fb) {
-            ab.DestroyFramebuffer(vk.device, ab.targets[i].fb, NULL);
-            ab.DestroyImageView(vk.device, ab.targets[i].view, NULL);
-            memset(&ab.targets[i], 0, sizeof(ab.targets[i]));
-        }
-    LOG("alpha_blend: Vulkan alpha inversion ready (format %d)", (int)format);
-    return 1;
-}
-
-static void ab_wait_all(void) {
-    for (int i = 0; i < AB_RING; ++i)
-        if (ab.pending[i]) {
-            vk.WaitForFences(vk.device, 1, &ab.fence[i], VK_TRUE, 1000000000ull);
-            vk.ResetFences(vk.device, 1, &ab.fence[i]);
-            ab.pending[i] = 0;
-        }
-}
-
-// The view + framebuffer of one array layer of a swapchain image.
-static VkFramebuffer ab_target(XrSwapchain swapchain, VkImage image, uint32_t layer, VkFormat format, uint32_t w, uint32_t h) {
-    int free_slot = -1;
-    for (int i = 0; i < AB_TARGETS; ++i) {
-        if (ab.targets[i].fb && ab.targets[i].image == image && ab.targets[i].layer == layer &&
-            ab.targets[i].swapchain == swapchain) return ab.targets[i].fb;
-        if (!ab.targets[i].fb && free_slot < 0) free_slot = i;
-    }
-    if (free_slot < 0) return VK_NULL_HANDLE;
-    VkImageViewCreateInfo vi = {VK_STRUCTURE_TYPE_IMAGE_VIEW_CREATE_INFO, NULL, 0, image, VK_IMAGE_VIEW_TYPE_2D, format,
-                                {VK_COMPONENT_SWIZZLE_IDENTITY, VK_COMPONENT_SWIZZLE_IDENTITY,
-                                 VK_COMPONENT_SWIZZLE_IDENTITY, VK_COMPONENT_SWIZZLE_IDENTITY},
-                                {VK_IMAGE_ASPECT_COLOR_BIT, 0, 1, layer, 1}};
-    VkImageView view;
-    if (ab.CreateImageView(vk.device, &vi, NULL, &view) != VK_SUCCESS) return VK_NULL_HANDLE;
-    VkFramebufferCreateInfo fi = {VK_STRUCTURE_TYPE_FRAMEBUFFER_CREATE_INFO, NULL, 0, ab.pass, 1, &view, w, h, 1};
-    VkFramebuffer fb;
-    if (ab.CreateFramebuffer(vk.device, &fi, NULL, &fb) != VK_SUCCESS) {
-        ab.DestroyImageView(vk.device, view, NULL);
-        return VK_NULL_HANDLE;
-    }
-    ab.targets[free_slot].swapchain = swapchain;
-    ab.targets[free_slot].image = image;
-    ab.targets[free_slot].layer = layer;
-    ab.targets[free_slot].w = w;
-    ab.targets[free_slot].h = h;
-    ab.targets[free_slot].view = view;
-    ab.targets[free_slot].fb = fb;
-    return fb;
-}
-
-// xrDestroySwapchain (before the runtime's): our views and framebuffers of its images go first.
-static void ab_on_destroy(XrSwapchain swapchain) {
-    if (ab.state <= 0 || ab.device != vk.device) return;
-    int any = 0;
-    for (int i = 0; i < AB_TARGETS; ++i) any |= ab.targets[i].fb && ab.targets[i].swapchain == swapchain;
-    if (!any) return;
-    ab_wait_all();
-    for (int i = 0; i < AB_TARGETS; ++i)
-        if (ab.targets[i].fb && ab.targets[i].swapchain == swapchain) {
-            ab.DestroyFramebuffer(vk.device, ab.targets[i].fb, NULL);
-            ab.DestroyImageView(vk.device, ab.targets[i].view, NULL);
-            memset(&ab.targets[i], 0, sizeof(ab.targets[i]));
-        }
-}
-
-// Inverts the alpha of one projection view's rectangle in the image the app last acquired from its swapchain
-// (Vulkan; once per acquire). Returns 1 when done or already done for this image, 0 when it couldn't be done.
-static int ab_invert_view(const XrSwapchainSubImage *sub) {
-    if (!vk.device) return 0;  // not a Vulkan session
-    int ok = 0;
-    pthread_mutex_lock(&flip_lock);
-    tracked_swapchain *t = find_tracked(sub->swapchain, 0);
-    uint32_t index = t ? t->last_acquired : 0, layer = sub->imageArrayIndex;
-    XrRect2Di rect = sub->imageRect;
-    if (!t || !t->image_count || index >= t->image_count || layer >= 32 || rect.extent.width <= 0 ||
-        rect.extent.height <= 0 || t->info.sampleCount > 1 ||
-        !(t->info.usageFlags & XR_SWAPCHAIN_USAGE_COLOR_ATTACHMENT_BIT))
-        goto done;
-    if (t->alpha_inverted[index] & (1u << layer)) { ok = 1; goto done; }  // a static frame submitted again
-    if (!ab_ready() || !ab_pipeline((VkFormat)t->info.format)) goto done;
-    VkFramebuffer fb = ab_target(sub->swapchain, t->images[index], layer, (VkFormat)t->info.format, t->info.width,
-                                 t->info.height);
-    if (!fb) goto done;
-    int slot = ab.next;
-    if (ab.pending[slot]) {  // submitted AB_RING calls ago: normally long finished
-        if (vk.WaitForFences(vk.device, 1, &ab.fence[slot], VK_TRUE, 100000000ull) != VK_SUCCESS) goto done;
-        vk.ResetFences(vk.device, 1, &ab.fence[slot]);
-        ab.pending[slot] = 0;
-    }
-    VkCommandBuffer cmd = ab.cmd[slot];
-    VkCommandBufferBeginInfo begin = {VK_STRUCTURE_TYPE_COMMAND_BUFFER_BEGIN_INFO, NULL,
-                                      VK_COMMAND_BUFFER_USAGE_ONE_TIME_SUBMIT_BIT, NULL};
-    vk.ResetCommandBuffer(cmd, 0);
-    vk.BeginCommandBuffer(cmd, &begin);
-    VkRect2D area = {{rect.offset.x, rect.offset.y}, {(uint32_t)rect.extent.width, (uint32_t)rect.extent.height}};
-    VkRenderPassBeginInfo rb = {VK_STRUCTURE_TYPE_RENDER_PASS_BEGIN_INFO, NULL, ab.pass, fb, area, 0, NULL};
-    ab.CmdBeginRenderPass(cmd, &rb, VK_SUBPASS_CONTENTS_INLINE);
-    ab.CmdBindPipeline(cmd, VK_PIPELINE_BIND_POINT_GRAPHICS, ab.pipeline);
-    VkViewport vp = {(float)rect.offset.x, (float)rect.offset.y, (float)rect.extent.width, (float)rect.extent.height,
-                     0.0f, 1.0f};
-    ab.CmdSetViewport(cmd, 0, 1, &vp);
-    ab.CmdSetScissor(cmd, 0, 1, &area);
-    ab.CmdDraw(cmd, 3, 1, 0, 0);
-    ab.CmdEndRenderPass(cmd);
-    vk.EndCommandBuffer(cmd);
-    VkSubmitInfo submit = {VK_STRUCTURE_TYPE_SUBMIT_INFO, NULL, 0, NULL, NULL, 1, &cmd, 0, NULL};
-    if (vk.QueueSubmit(vk.queue, 1, &submit, ab.fence[slot]) != VK_SUCCESS) goto done;
-    ab.pending[slot] = 1;
-    ab.next = (slot + 1) % AB_RING;
-    t->alpha_inverted[index] |= 1u << layer;
-    ok = 1;
-    static int logged;
-    if (!logged++)
-        LOG("alpha_blend: inverting the alpha of swapchain=%p (rect %dx%d at %d,%d, layer %u) for passthrough",
-            (void *)(uintptr_t)sub->swapchain, rect.extent.width, rect.extent.height, rect.offset.x, rect.offset.y, layer);
-done:
-    pthread_mutex_unlock(&flip_lock);
-    return ok;
-}
-
-// xrEndFrame, emulated passthrough: what the projection layer's XrCompositionLayerAlphaBlendFB asks for, done with
-// the runtime's standard blend. 0 = nothing to do (no such struct, or factors that can't be expressed), 1 = straight
-// alpha (inverted when asked), 2 = premultiplied colour (alpha inverted when asked).
-static int alpha_blend_apply(const XrCompositionLayerProjection *p) {
-    const XrCompositionLayerAlphaBlendFB *f = NULL;
-    for (const XrBaseInStructure *n = (const XrBaseInStructure *)p->next; n; n = n->next)
-        if (n->type == XR_TYPE_COMPOSITION_LAYER_ALPHA_BLEND_FB) f = (const XrCompositionLayerAlphaBlendFB *)n;
-    if (!f) return 0;
-    int src = f->srcFactorColor, dst = f->dstFactorColor;
-    int straight = src == XR_BLEND_FACTOR_SRC_ALPHA_FB, premultiplied = src == XR_BLEND_FACTOR_ONE_FB,
-        inverse = src == XR_BLEND_FACTOR_ONE_MINUS_SRC_ALPHA_FB;
-    static int logged;
-    if (!logged++)
-        LOG("alpha_blend: projection layer asks for colour %d/%d alpha %d/%d (src/dst factors)", src, dst,
-            f->srcFactorAlpha, f->dstFactorAlpha);
-    if ((straight || premultiplied) && dst == XR_BLEND_FACTOR_ONE_MINUS_SRC_ALPHA_FB) return straight ? 1 : 2;
-    if (!(inverse || premultiplied) || dst != XR_BLEND_FACTOR_SRC_ALPHA_FB) {
-        static int warned;
-        if (!warned++) LOG("alpha_blend: these factors can't be emulated, the layer is blended normally");
-        return 0;
-    }
-    int done = 1;  // src * (1 - a) + dst * a: the standard blend with the alpha inverted
-    for (uint32_t v = 0; v < p->viewCount && v < 2; ++v) done &= ab_invert_view(&p->views[v].subImage);
-    if (!done) {
-        static int warned;
-        if (!warned++) LOG("alpha_blend: inverse alpha asked for, but the image couldn't be changed (not Vulkan?)");
-        return 0;
-    }
-    return inverse ? 1 : 2;
-}

native/adapter/detached_controllers.c

@@ -1,78 +0,0 @@
-// SPDX-License-Identifier: GPL-3.0-only
-// Included by session_fixes.c: Meta's detached controllers (XR_META_detached_controllers: a controller put down while
-// hand tracking runs) on a runtime without that extension. Uses profile_remap, runtime_has_detached_controllers,
-// active_instance, lookup and LOG.
-//
-// Meta's Unity OpenXR features add "Detached ... Controller" devices for /user/detached_controller_meta/left|right.
-// Unity merges same-named actions of every enabled device into one action, so the first action with such a subaction
-// path (e.g. "thumbstick") fails with XR_ERROR_PATH_UNSUPPORTED on the Frame's runtime, Unity attaches no action set
-// at all and neither Unity nor OVRPlugin get controller input: hands lying at the play-space origin on the floor, no
-// buttons (Spatial Zombies, GitHub #328). With profile_remap on and the runtime lacking the extension, these paths are
-// left out of the game's actions and suggested bindings, and xrGetCurrentInteractionProfile answers "no profile"
-// for them (a detached controller that never shows up) instead of XR_ERROR_PATH_UNSUPPORTED.
-
-#define DETACHED_PREFIX "/user/detached_controller_meta/"
-
-static int detached_filter_on(void) { return profile_remap && !runtime_has_detached_controllers && active_instance; }
-
-// 1 if `path` is a detached controller's top-level path or one of its input/output paths
-static int detached_path(XrPath path) {
-    PFN_xrPathToString to_string = (PFN_xrPathToString)lookup(active_instance, "xrPathToString");
-    char name[XR_MAX_PATH_LENGTH];
-    uint32_t size = 0;
-    return path && to_string && XR_SUCCEEDED(to_string(active_instance, path, sizeof(name), &size, name)) &&
-           !strncmp(name, DETACHED_PREFIX, strlen(DETACHED_PREFIX));
-}
-
-// xrCreateAction: `info` without the detached subaction paths, in *copy (paths in `kept`, room for all of them).
-// Returns `info` itself when there is nothing to leave out.
-static const XrActionCreateInfo *detached_strip_action(const XrActionCreateInfo *info, XrActionCreateInfo *copy,
-                                                       XrPath *kept) {
-    if (!info || !info->countSubactionPaths || !info->subactionPaths || !kept || !detached_filter_on()) return info;
-    uint32_t n = 0;
-    for (uint32_t i = 0; i < info->countSubactionPaths; ++i)
-        if (!detached_path(info->subactionPaths[i])) kept[n++] = info->subactionPaths[i];
-    if (n == info->countSubactionPaths) return info;
-    *copy = *info;
-    copy->countSubactionPaths = n;
-    copy->subactionPaths = kept;
-    static int logged;
-    if (logged++ < 3)
-        LOG("profile_remap: action %s without %u detached-controller path(s) (the runtime has no "
-            "XR_META_detached_controllers)", info->actionName, info->countSubactionPaths - n);
-    return copy;
-}
-
-// xrSuggestInteractionProfileBindings: `suggested` without bindings of detached controllers, in *copy (bindings in
-// `kept`, room for all of them). Returns `suggested` itself when there is nothing to leave out.
-static const XrInteractionProfileSuggestedBinding *detached_strip_bindings(
-        const XrInteractionProfileSuggestedBinding *suggested, XrInteractionProfileSuggestedBinding *copy,
-        XrActionSuggestedBinding *kept) {
-    if (!suggested || !suggested->countSuggestedBindings || !suggested->suggestedBindings || !kept ||
-        !detached_filter_on())
-        return suggested;
-    uint32_t n = 0;
-    for (uint32_t i = 0; i < suggested->countSuggestedBindings; ++i)
-        if (!detached_path(suggested->suggestedBindings[i].binding)) kept[n++] = suggested->suggestedBindings[i];
-    if (n == suggested->countSuggestedBindings) return suggested;
-    *copy = *suggested;
-    copy->countSuggestedBindings = n;
-    copy->suggestedBindings = kept;
-    static int logged;
-    if (logged++ < 8) {
-        PFN_xrPathToString to_string = (PFN_xrPathToString)lookup(active_instance, "xrPathToString");
-        char profile[XR_MAX_PATH_LENGTH] = "?";
-        uint32_t size = 0;
-        if (to_string) to_string(active_instance, suggested->interactionProfile, sizeof(profile), &size, profile);
-        LOG("profile_remap: %s bindings without %u detached-controller path(s)", profile,
-            suggested->countSuggestedBindings - n);
-    }
-    return copy;
-}
-
-// xrGetCurrentInteractionProfile: a detached controller's path the runtime doesn't know has no profile.
-static XrResult detached_current_profile(XrPath user, XrInteractionProfileState *state, XrResult result) {
-    if (result != XR_ERROR_PATH_UNSUPPORTED || !state || !detached_filter_on() || !detached_path(user)) return result;
-    state->interactionProfile = XR_NULL_PATH;
-    return XR_SUCCESS;
-}

native/adapter/flip_vk.c

@@ -74,7 +74,6 @@ typedef struct {
     // submitted again without a new acquire: flipping them again would undo it)
     struct { XrRect2Di rect; uint32_t layer; } flipped[MAX_IMAGES][4];
     uint32_t flipped_count[MAX_IMAGES];
-    uint32_t alpha_inverted[MAX_IMAGES];  // alpha_blend_vk.c: array layers whose alpha was inverted since the acquire
     int dumped;  // flip_dump saved this swapchain's quad
     int logged;  // its first in-place flip was logged
 } tracked_swapchain;
@@ -137,7 +136,6 @@ static void flip_on_acquire(XrSwapchain handle, uint32_t index) {
     if (t) {
         t->last_acquired = index;
         if (index < MAX_IMAGES) t->flipped_count[index] = 0;  // new content: upside down again
-        if (index < MAX_IMAGES) t->alpha_inverted[index] = 0;
         if(t->acquired_count<MAX_IMAGES)t->acquired[t->acquired_count++]=index;
     }
     pthread_mutex_unlock(&flip_lock);

native/adapter/foveation_storage.h

@@ -34,35 +34,3 @@ static int fb_foveation_storage(XrSwapchainCreateInfo *info, FbStorageNode nodes
     }
     return p ? -1 : 0;
 }
-
-// Strip FB nodes behind known Vulkan allocation nodes without changing const app memory.
-// An unknown prefix may be retained only when its entire tail is free of FB create info.
-static int fb_hide_swapchain_foveation(XrSwapchainCreateInfo *info, FbStorageNode nodes[16]) {
-    const XrBaseInStructure *p = info->next;
-    unsigned n = 0;
-    int removed = 0;
-    unsigned visited = 0;
-    while (p) {
-        if (++visited > 256) return -1;
-        if (p->type == XR_TYPE_SWAPCHAIN_CREATE_INFO_FOVEATION_FB) {
-            removed = 1;
-            p = p->next;
-            continue;
-        }
-        if (p->type != XR_TYPE_VULKAN_SWAPCHAIN_CREATE_INFO_META || n == 16) {
-            for (const XrBaseInStructure *tail = p; tail; tail = tail->next) {
-                if (++visited > 256 || tail->type == XR_TYPE_SWAPCHAIN_CREATE_INFO_FOVEATION_FB) return -1;
-            }
-            break;
-        }
-        nodes[n].vk = *(const FbVulkanSwapchainCreateInfo *)p;
-        // Foveation-only subsampled allocations are invalid without FB foveation.
-        nodes[n].vk.additionalCreateFlags &= ~0x4000u;
-        if (n) nodes[n - 1].base.next = &nodes[n].base;
-        ++n;
-        p = p->next;
-    }
-    if (n) nodes[n - 1].base.next = p;
-    info->next = n ? &nodes[0] : (const void *)p;
-    return removed;
-}

native/adapter/frame_adapter.c

@@ -15,8 +15,6 @@
 //  * drops requested instance extensions the runtime lacks (e.g. XR_FB_passthrough);
 //  * retries rejected swapchains with 1 sample / a supported format (swapchain_fix, overport #71);
 //  * drops composition layers that reference swapchains that failed to create (layer_fix);
-//  * answers xrGetDisplayRefreshRateFB with the measured display rate when the runtime lacks it or reports 0 Hz
-//    (session_fixes.c);
 //  * serves cube swapchains the runtime refuses as GL/Vulkan cube maps and drops their layers (cube_standin, cube_standin.c);
 //  * optionally requests mutable-format swapchain images (mutable_fix, off by default);
 //  * optionally swaps left/right images of stereo projection layers (swap_eyes, off by default);
@@ -93,13 +91,10 @@ static void surf_on_destroy(XrSwapchain handle);
 
 static float scale = 1.0f;
 static int foveation_fix = 1;
-static int foveation_storage_fix; // ordinary (not SUBSAMPLED) swapchain storage; on with device.foveation
+static int foveation_storage_fix; // opt-in ordinary shared storage for native Vulkan foveation
 static int foveation_eye; // experimental profile upgrade; does not inject Vulkan gaze offsets
 static int foveation_eye_enabled, foveation_eye_supported;
 #include "foveation_storage.h"
-#include "hide_fb_foveation.h"
-static int hide_fb_foveation;
-static int hide_fb_foveation_vulkan;
 // hide XR_FB_space_warp: games then render every frame themselves (UE5 Application SpaceWarp flickered on the Frame,
 // e.g. Into The Radius 2; OVRPort's patch_disable_space_warp doesn't reach UE5's OpenXR plugin)
 static int hide_space_warp = 0;
@@ -118,10 +113,6 @@ static void snap_on_enumerate(XrSwapchain handle, uint32_t count, const XrSwapch
 static void snap_on_acquire(XrSwapchain handle, uint32_t index);
 static void snap_end_frame(const XrFrameEndInfo *info);
 static int frame_balance = 0;  // end a still-open frame before the next xrBeginFrame
-// diagnostics (headless launch tests, GitHub #323): report shouldRender=TRUE from xrWaitFrame. Without a worn headset the
-// session never becomes VISIBLE, the runtime answers shouldRender=FALSE and engines that honour it (Unreal's OpenXR
-// plugin) submit no layers at all, so a headless run never exercises the game's real frame submission.
-static int force_render = 0;
 static int frame_begins, frame_discarded, frame_ends, frame_balanced;  // per pacing period (layer_debug)
 static int frame_open;
 static int sc_acquires, sc_waits, sc_releases, sc_wait_fails;  // per pacing period (layer_debug)  // drop XrCompositionLayerColorScaleBiasKHR (the runtime's color pass)
@@ -129,7 +120,6 @@ static int controller_fix = 1;
 static int swapchain_fix = 1;
 static int cube_standin = 1;  // cube swapchains the runtime refuses: served by the adapter (cube_standin.c)
 static int rect_clamp = 1;
-static int action_dedup = 1;  // rename duplicate action names in a set (session_fixes.c; GitHub #323)
 static int pose_consistency = 0;  // repeat xrLocateViews queries for one display time get the same poses (GitHub #8)  // clamp submitted image rects to their swapchain (SteamVR rejects a 1 px overrun)
 static int pose_time_fix;   // poses asked for at CLOCK_MONOTONIC "now" or far in the past: at XrTime "now" (pose_time.c)
 static int pose_debug;      // diagnostics: requested pose times vs the predicted display time (pose_time.c)
@@ -137,7 +127,6 @@ static int layer_fix = 1;
 static int mutable_fix = 0;
 static int swap_eyes = 0;
 static int passthrough_emul = 1;
-static int alpha_blend_emul = 1;  // alpha_blend_vk.c: honour XR_FB_composition_layer_alpha_blend with passthrough
 static int respace_kick = 0;
 static int strip_depth = 0;
 static int flip_quads = 0;
@@ -158,7 +147,6 @@ static int sync_guard;       // xrSyncActions one at a time with xrPollEvent, pa
 static int profile_remap = 1; // Meta's newer controller profiles (rejected by the Frame) -> oculus/touch_controller
 static int proximity_emul;   // finger proximity from capacitive touch: 1 thumb, 2 thumb + index (session_fixes.c)
 static int runtime_has_proximity;  // the runtime has XR_FB_touch_controller_proximity itself
-static int runtime_has_detached_controllers;  // the runtime has XR_META_detached_controllers (detached_controllers.c)
 static int layer_debug;      // diagnostics: layers, swapchains, session states, spaces, aim/grip, refresh rates
 static int input_diag;       // diagnostics: controller profiles, bindings, missing functions, failing input calls
 static int stable_local;     // keep every LOCAL space the app creates on the session-start origin
@@ -186,12 +174,10 @@ static void read_settings(const char *path) {
         if (sscanf(line, "foveation_fix=%f", &value) == 1) foveation_fix = value != 0;
         if (sscanf(line, "foveation_storage_fix=%f", &value) == 1) foveation_storage_fix = value != 0;
         if (sscanf(line, "foveation_eye=%f", &value) == 1) foveation_eye = value != 0;
-        if (sscanf(line, "hide_fb_foveation=%f", &value) == 1) hide_fb_foveation = value != 0;
         if (sscanf(line, "hide_space_warp=%f", &value) == 1) hide_space_warp = value != 0;
         if (sscanf(line, "strip_color_bias=%f", &value) == 1) strip_color_bias = (int)value;
         if (sscanf(line, "fade_quad=%f", &value) == 1) fade_quad = value > 0 ? (int)value : 0;
         if (sscanf(line, "frame_balance=%f", &value) == 1) frame_balance = value != 0;
-        if (sscanf(line, "force_render=%f", &value) == 1) force_render = value != 0;
         if (sscanf(line, "snapshot=%f", &value) == 1) snapshot = value > 0 ? (int)value : 0;
         if (sscanf(line, "flip_dump=%f", &value) == 1) flip_dump = value > 0 ? (int)value : 0;
         if (sscanf(line, "gl_error_clear=%f", &value) == 1) gl_error_clear = value != 0;
@@ -199,7 +185,6 @@ static void read_settings(const char *path) {
         if (sscanf(line, "swapchain_fix=%f", &value) == 1) swapchain_fix = value != 0;
         if (sscanf(line, "cube_standin=%f", &value) == 1) cube_standin = value != 0;
         if (sscanf(line, "rect_clamp=%f", &value) == 1) rect_clamp = value != 0;
-        if (sscanf(line, "action_dedup=%f", &value) == 1) action_dedup = value != 0;
         if (sscanf(line, "pose_consistency=%f", &value) == 1) pose_consistency = value != 0;
         if (sscanf(line, "pose_debug=%f", &value) == 1) pose_debug = value != 0;
         if (sscanf(line, "pose_time_fix=%f", &value) == 1) pose_time_fix = value != 0;
@@ -207,7 +192,6 @@ static void read_settings(const char *path) {
         if (sscanf(line, "mutable_fix=%f", &value) == 1) mutable_fix = value != 0;
         if (sscanf(line, "swap_eyes=%f", &value) == 1) swap_eyes = value != 0;
         if (sscanf(line, "passthrough_emul=%f", &value) == 1) passthrough_emul = value != 0;
-        if (sscanf(line, "alpha_blend_emul=%f", &value) == 1) alpha_blend_emul = value != 0;
         if (sscanf(line, "respace_kick=%f", &value) == 1) respace_kick = value != 0;
         if (sscanf(line, "strip_depth=%f", &value) == 1) strip_depth = value != 0;
         if (sscanf(line, "flip_quads=%f", &value) == 1) flip_quads = value != 0;
@@ -288,13 +272,11 @@ static void initialize(void) {
     if (input_diag) LOG("per-game: input_diag=1 (controller-input diagnostics)");
     if (proximity_emul) LOG("per-game: proximity_emul=%d (finger proximity from capacitive touch: %s)", proximity_emul,
                             proximity_emul > 1 ? "thumb + index" : "thumb");
-    if (hide_fb_foveation) LOG("per-game: hide_fb_foveation=1 (Quest Vulkan foveation suppressed)");
     if (hide_space_warp) LOG("per-game: hide_space_warp=1 (XR_FB_space_warp hidden, space warp info removed)");
     if (strip_color_bias) LOG("per-game: strip_color_bias=%d (layer color scale/bias removed)", strip_color_bias);
     if (fade_quad) LOG("per-game: fade_quad=%d (colour-scale fades drawn as a black quad%s)", fade_quad,
                        fade_quad > 1 ? "; the layer's own scale removed" : "");
     if (frame_balance) LOG("per-game: frame_balance=1 (an open frame is ended before the next one begins)");
-    if (force_render) LOG("per-game: force_render=1 (xrWaitFrame reports shouldRender=TRUE; diagnostics)");
     if (eye_debug || release_wait) LOG("per-game: eye_debug=%d release_wait=%d log_file=%s", eye_debug, release_wait,
                                        log_file ? path : "none");
     if (controller_models && *process && !strchr(process, '/')) render_model_init(process);
@@ -325,7 +307,6 @@ XRAPI_ATTR XrResult XRAPI_CALL xrCreateInstance(const XrInstanceCreateInfo *info
     if (!fn) return XR_ERROR_INITIALIZATION_FAILED;
     if (!info) return XR_ERROR_VALIDATION_FAILURE;
 
-    hide_fb_foveation_vulkan = hide_fb_foveation && fb_instance_uses_vulkan(info);
     int chained = 0, enabled = 0;
     for (const XrBaseInStructure *p = (const XrBaseInStructure *)info->next; p; p = p->next)
         if (p->type == XR_TYPE_INSTANCE_CREATE_INFO_ANDROID_KHR) {
@@ -361,18 +342,15 @@ XRAPI_ATTR XrResult XRAPI_CALL xrCreateInstance(const XrInstanceCreateInfo *info
         int supported = !available;  // if we could not enumerate, pass everything through
         for (uint32_t j = 0; available && j < available_count && !supported; ++j)
             supported = !strcmp(available[j].extensionName, ext);
-        if (hide_fb_foveation_vulkan && fb_is_foveation_extension(ext)) {
-            LOG("hide_fb_foveation: %s not enabled", ext);
-            continue;
-        }
         if (hide_space_warp && !strcmp(ext, "XR_FB_space_warp")) {
             LOG("hide_space_warp: XR_FB_space_warp not enabled");
             continue;
         }
         if (supported) names[kept++] = ext;
         else if (scene_emul && is_scene_extension(ext)) {
-            if (!emulate_scene) LOG("emulating Meta scene/spatial-entity extensions from the guardian bounds");
+            if (!emulate_scene) LOG("emulating Meta scene/spatial-entity extensions from room file or guardian bounds");
             emulate_scene = 1;
+            if (!strcmp(ext, "XR_META_spatial_entity_mesh")) scene_app_mesh = 1;
         } else if (controller_models && render_models_available && !strcmp(ext, XR_FB_RENDER_MODEL_EXTENSION_NAME)) {
             emulate_render_model = 1;
             LOG("emulating XR_FB_render_model with Steam Frame controller models");
@@ -405,7 +383,7 @@ XRAPI_ATTR XrResult XRAPI_CALL xrCreateInstance(const XrInstanceCreateInfo *info
         if (!requested && offered) { names[kept++] = "XR_FB_display_refresh_rate"; LOG("added XR_FB_display_refresh_rate (refresh_rate)"); }
     }
     foveation_eye_enabled = 0;
-    if (foveation_eye && !foveation_fix && !hide_fb_foveation_vulkan) {
+    if (foveation_eye && !foveation_fix) {
         int fb = 0, config = 0, offered = 0;
         for (uint32_t i = 0; i < kept; ++i) {
             fb |= !strcmp(names[i], "XR_FB_foveation");
@@ -421,7 +399,7 @@ XRAPI_ATTR XrResult XRAPI_CALL xrCreateInstance(const XrInstanceCreateInfo *info
     }
     // Adapter-owned video outputs need an explicit full-rate profile even when
     // the shared injection layer enables foveation for application swapchains.
-    if (surface_emul && !hide_fb_foveation_vulkan) {
+    if (surface_emul) {
         const char *video_extensions[] = {"XR_FB_foveation", "XR_FB_foveation_configuration",
             "XR_FB_swapchain_update_state"};
         for (unsigned e = 0; e < 3; ++e) {
@@ -445,8 +423,6 @@ XRAPI_ATTR XrResult XRAPI_CALL xrCreateInstance(const XrInstanceCreateInfo *info
     for (uint32_t j = 0; available && j < available_count; ++j)
         if (!strcmp(available[j].extensionName, "XR_FB_composition_layer_image_layout")) runtime_has_image_layout = 1;
         else if (!strcmp(available[j].extensionName, "XR_FB_touch_controller_proximity")) runtime_has_proximity = 1;
-        else if (!strcmp(available[j].extensionName, "XR_META_detached_controllers"))
-            runtime_has_detached_controllers = 1;
     // Layer types are only valid if their extension ends up enabled; some apps submit them regardless.
     int has_equirect = 0, has_equirect2 = 0, has_cylinder = 0, has_cube = 0;
     for (uint32_t i = 0; i < kept; ++i) {
@@ -562,18 +538,9 @@ static int swapchain_size(XrSwapchain handle, uint32_t *w, uint32_t *h) {
     return found;
 }
 
-// Clamp `r` to a w x h image; returns whether it changed (2 = it was empty and now covers the whole image).
+// Clamp `r` to a w x h image; returns whether it changed.
 static int clamp_rect(XrRect2Di *r, uint32_t w, uint32_t h) {
     XrRect2Di c = *r;
-    // An empty rect (BattleTalent's first frames after Unity switched its MSAA level: 0,0 0x0, GitHub #293) is
-    // rejected the same way, and the game stops submitting after two rejections: show the whole image instead.
-    if (c.extent.width <= 0 || c.extent.height <= 0) {
-        if (!w || !h || w > INT32_MAX || h > INT32_MAX) return 0;
-        r->offset.x = r->offset.y = 0;
-        r->extent.width = (int32_t)w;
-        r->extent.height = (int32_t)h;
-        return 2;
-    }
     if (c.offset.x < 0) { c.extent.width += c.offset.x; c.offset.x = 0; }
     if (c.offset.y < 0) { c.extent.height += c.offset.y; c.offset.y = 0; }
     if ((uint32_t)c.offset.x >= w || (uint32_t)c.offset.y >= h) return 0;  // nothing sensible to keep: leave it
@@ -596,7 +563,6 @@ static void flip_on_create_swapchain(XrSwapchain handle, const XrSwapchainCreate
 static int flip_wants_transfer(const XrSwapchainCreateInfo *info);
 static void clear_gl_errors(const char *where);
 static void flip_on_destroy(XrSwapchain handle);
-static void ab_on_destroy(XrSwapchain handle);
 static void emul_on_create_swapchain(XrSwapchain handle, const XrSwapchainCreateInfo *info);
 static void emul_on_destroy_swapchain(XrSwapchain handle);
 static int emul_virtual_create(XrSession session, const XrSwapchainCreateInfo *info, XrSwapchain *out);
@@ -619,7 +585,6 @@ static int known_swapchain(XrSwapchain handle) {
 
 XRAPI_ATTR XrResult XRAPI_CALL xrCreateFoveationProfileFB(XrSession session,
         const XrFoveationProfileCreateInfoFB *info, XrFoveationProfileFB *profile) {
-    if (hide_fb_foveation_vulkan) return XR_ERROR_FEATURE_UNSUPPORTED;
     PFN_xrCreateFoveationProfileFB fn = (PFN_xrCreateFoveationProfileFB)lookup(active_instance, "xrCreateFoveationProfileFB");
     if (!fn) return XR_ERROR_FUNCTION_UNSUPPORTED;
     if (!info) return XR_ERROR_VALIDATION_FAILURE;
@@ -645,7 +610,6 @@ XRAPI_ATTR XrResult XRAPI_CALL xrCreateFoveationProfileFB(XrSession session,
 }
 
 XRAPI_ATTR XrResult XRAPI_CALL xrGetFoveationEyeTrackedStateMETA(XrSession session, XrFoveationEyeTrackedStateMETA *state) {
-    if (hide_fb_foveation_vulkan) return XR_ERROR_FEATURE_UNSUPPORTED;
     PFN_xrGetFoveationEyeTrackedStateMETA fn = (PFN_xrGetFoveationEyeTrackedStateMETA)lookup(active_instance, "xrGetFoveationEyeTrackedStateMETA");
     if (!fn) return XR_ERROR_FUNCTION_UNSUPPORTED;
     XrResult result = fn(session, state);
@@ -663,18 +627,11 @@ XRAPI_ATTR XrResult XRAPI_CALL xrCreateSwapchain(XrSession session, const XrSwap
     if (!info) return XR_ERROR_VALIDATION_FAILURE;
     XrSwapchainCreateInfo fixed = *info;
     FbStorageNode storage_nodes[16];
-    // Also with foveation_fix: Valve's injected FDM (device.foveation) stores a SUBSAMPLED image's coarse bins
-    // unscaled, and the compositor reads them as garbage around the sharp area (GitHub #303, Medieval Dynasty).
-    if (!hide_fb_foveation_vulkan && foveation_storage_fix) {
+    if (!foveation_fix && foveation_storage_fix) {
         int changed = fb_foveation_storage(&fixed, storage_nodes);
         LOG("foveation_storage_fix: shared allocation %s", changed > 0 ? "SUBSAMPLED cleared" :
             changed < 0 ? "unchanged (unsupported chain prefix)" : "already ordinary or no META node");
     }
-    if (hide_fb_foveation_vulkan) {
-        int stripped = fb_hide_swapchain_foveation(&fixed, storage_nodes);
-        if (stripped < 0) return XR_ERROR_VALIDATION_FAILURE;
-        if (stripped) LOG("hide_fb_foveation: removed swapchain foveation create info");
-    }
     if (foveation_fix) {
         // Drop leading foveation structs; the chain is const so only a prefix can be skipped.
         const XrBaseInStructure *p = (const XrBaseInStructure *)fixed.next;
@@ -747,7 +704,6 @@ XRAPI_ATTR XrResult XRAPI_CALL xrDestroySwapchain(XrSwapchain swapchain) {
     surf_scene_destroy(swapchain);
     forget_swapchain(swapchain);
     surf_on_destroy(swapchain);
-    ab_on_destroy(swapchain);
     flip_on_destroy(swapchain);
     emul_on_destroy_swapchain(swapchain);
     snap_on_destroy(swapchain);
@@ -920,6 +876,11 @@ XRAPI_ATTR XrResult XRAPI_CALL xrGetSystemProperties(XrInstance instance, XrSyst
                 ((XrSystemPassthroughPropertiesFB *)p)->supportsPassthrough = XR_TRUE;
             if (p->type == XR_TYPE_SYSTEM_SPATIAL_ENTITY_PROPERTIES_FB && emulate_scene)
                 ((XrSystemSpatialEntityPropertiesFB *)p)->supportsSpatialEntity = XR_TRUE;
+            // META scene capability chains used by current MRUK.
+            if (p->type == XR_TYPE_SYSTEM_SPACE_DISCOVERY_PROPERTIES_META && emulate_scene)
+                ((XrSystemSpaceDiscoveryPropertiesMETA *)p)->supportsSpaceDiscovery = XR_TRUE;
+            if (p->type == XR_TYPE_SYSTEM_SPACE_PERSISTENCE_PROPERTIES_META && emulate_scene)
+                ((XrSystemSpacePersistencePropertiesMETA *)p)->supportsSpacePersistence = XR_TRUE;
             if (p->type == XR_TYPE_SYSTEM_PASSTHROUGH_PROPERTIES2_FB)
                 ((XrSystemPassthroughProperties2FB *)p)->capabilities = XR_PASSTHROUGH_CAPABILITY_BIT_FB;
             if (p->type == XR_TYPE_SYSTEM_RENDER_MODEL_PROPERTIES_FB && emulate_render_model)
@@ -929,7 +890,6 @@ XRAPI_ATTR XrResult XRAPI_CALL xrGetSystemProperties(XrInstance instance, XrSyst
 }
 
 #include "flip_vk.c"
-#include "alpha_blend_vk.c"
 #include "pose_time.c"
 
 // XR_KHR_convert_timespec_time for runtimes that lack it (Frame): XrTime is derived from the monotonic clock
@@ -967,7 +927,10 @@ XRAPI_ATTR XrResult XRAPI_CALL xrLocateSpace(XrSpace space, XrSpace baseSpace, X
     pose_time_note("xrLocateSpace", (uint64_t)(uintptr_t)space, (uint64_t)(uintptr_t)baseSpace, time);
     if (emulate_scene && location) {
         XrPosef pose; XrSpaceLocationFlags flags;
-        if (locate_fake(space, baseSpace, time, &pose, &flags)) {
+        pthread_mutex_lock(&scene_lock);
+        int fake = locate_fake(space, baseSpace, time, &pose, &flags);
+        pthread_mutex_unlock(&scene_lock);
+        if (fake) {
             location->pose = pose;
             location->locationFlags = flags;
             return XR_SUCCESS;
@@ -989,8 +952,8 @@ static XrResult locate_spaces_common(const char *name, XrSession session, const
     if (info) pose_time_note(name, info->spaceCount ? (uint64_t)(uintptr_t)info->spaces[0] : 0,
                              (uint64_t)(uintptr_t)info->baseSpace, info->time);
     if (emulate_scene && info && locations) {
-        any_fake = fake_space_index(info->baseSpace) >= 0;
-        for (uint32_t i = 0; i < info->spaceCount && !any_fake; ++i) any_fake = fake_space_index(info->spaces[i]) >= 0;
+        any_fake = is_fake_space(info->baseSpace);
+        for (uint32_t i = 0; i < info->spaceCount && !any_fake; ++i) any_fake = is_fake_space(info->spaces[i]);
     }
     if (!any_fake) {
         PFN_xrLocateSpaces fn = (PFN_xrLocateSpaces)lookup(active_instance, name);
@@ -1013,7 +976,12 @@ static XRAPI_ATTR XrResult XRAPI_CALL emu_locate_spaces_khr(XrSession session, c
 }
 
 XRAPI_ATTR XrResult XRAPI_CALL xrDestroySpace(XrSpace space) {
-    if (fake_space_index(space) >= 0) return XR_SUCCESS;  // entity spaces live for the whole session
+    if (is_fake_space(space)) {
+        pthread_mutex_lock(&scene_lock);
+        int valid = fake_space_index(space) >= 0;
+        pthread_mutex_unlock(&scene_lock);
+        return valid ? XR_SUCCESS : XR_ERROR_HANDLE_INVALID;  // entity spaces live for the whole session
+    }
     PFN_xrDestroySpace fn = (PFN_xrDestroySpace)lookup(active_instance, "xrDestroySpace");
     return fn ? fn(space) : XR_ERROR_FUNCTION_UNSUPPORTED;
 }
@@ -1269,15 +1237,12 @@ XRAPI_ATTR XrResult XRAPI_CALL xrApplyHapticFeedback(XrSession session, const Xr
     return result;
 }
 
-#include "hide_foveation_images.h"
-
 XRAPI_ATTR XrResult XRAPI_CALL xrEnumerateSwapchainImages(XrSwapchain swapchain, uint32_t capacity, uint32_t *count,
         XrSwapchainImageBaseHeader *images) {
     PFN_xrEnumerateSwapchainImages fn = (PFN_xrEnumerateSwapchainImages)lookup(active_instance, "xrEnumerateSwapchainImages");
     if (!fn) return XR_ERROR_FUNCTION_UNSUPPORTED;
     if (is_standin(swapchain)) return standin_enumerate(swapchain, capacity, count, images);
     XrResult result = equirect_emul && emul_is_virtual(swapchain) ? emul_virtual_enumerate(swapchain, capacity, count, images)
-                                                                  : hide_fb_foveation_vulkan ? fb_hide_foveation_images(fn, swapchain, capacity, count, images)
                                                                   : fn(swapchain, capacity, count, images);
     if (XR_SUCCEEDED(result) && images && capacity && count) {
         flip_on_enumerate_images(swapchain, *count, images);
@@ -1463,16 +1428,6 @@ XRAPI_ATTR XrResult XRAPI_CALL xrWaitFrame(XrSession session, const XrFrameWaitI
         pose_time_display(state->predictedDisplayTime);
         pose_time_note_offset((long long)(state->predictedDisplayTime - mono));
         if (layer_debug) debug_aim_vs_grip(state->predictedDisplayTime);
-        // shouldRender changes (a few): a game that submits no layers while the runtime says not to render shows
-        // nothing, e.g. Unreal's OpenXR plugin in a headless launch test
-        static int last_should_render = -1, should_render_logged;
-        if ((int)state->shouldRender != last_should_render && should_render_logged < 12) {
-            ++should_render_logged;
-            LOG("xrWaitFrame: shouldRender=%d period=%.2f ms%s", (int)state->shouldRender,
-                state->predictedDisplayPeriod / 1e6, force_render && !state->shouldRender ? " (force_render: reported as 1)" : "");
-        }
-        last_should_render = (int)state->shouldRender;
-        if (force_render) state->shouldRender = XR_TRUE;
     }
     return result;
 }
@@ -1689,14 +1644,8 @@ XRAPI_ATTR XrResult XRAPI_CALL xrEndFrame(XrSession session, const XrFrameEndInf
                                          q->radius, q->subImage.imageRect.offset.x, q->subImage.imageRect.offset.y,
                                          q->subImage.imageRect.extent.width, q->subImage.imageRect.extent.height);
             }
-            for (const XrBaseInStructure *n = (const XrBaseInStructure *)l->next; n && used < sizeof(now) - 48; n = n->next) {
+            for (const XrBaseInStructure *n = (const XrBaseInStructure *)l->next; n && used < sizeof(now) - 32; n = n->next)
                 used += (size_t)snprintf(now + used, sizeof(now) - used, " n=%d", n->type);
-                if (n->type == XR_TYPE_COMPOSITION_LAYER_ALPHA_BLEND_FB) {  // src/dst factors: colour, then alpha
-                    const XrCompositionLayerAlphaBlendFB *ab = (const XrCompositionLayerAlphaBlendFB *)n;
-                    used += (size_t)snprintf(now + used, sizeof(now) - used, "(%d,%d/%d,%d)", ab->srcFactorColor,
-                                             ab->dstFactorColor, ab->srcFactorAlpha, ab->dstFactorAlpha);
-                }
-            }
             used += (size_t)snprintf(now + used, sizeof(now) - used, "]");
         }
         if (strcmp(now, last)) {
@@ -1824,10 +1773,6 @@ XRAPI_ATTR XrResult XRAPI_CALL xrEndFrame(XrSession session, const XrFrameEndInf
             projections[count] = *(const XrCompositionLayerProjection *)layer;
             projections[count].layerFlags |= XR_COMPOSITION_LAYER_BLEND_TEXTURE_SOURCE_ALPHA_BIT |
                                              XR_COMPOSITION_LAYER_UNPREMULTIPLIED_ALPHA_BIT;
-            // the game's XR_FB_composition_layer_alpha_blend factors (ignored by the Frame's runtime), e.g. Unreal's
-            // inverted scene alpha: the camera showed where the game drew and black where it didn't (GitHub #329)
-            if (alpha_blend_emul && alpha_blend_apply(&projections[count]) == 2)
-                projections[count].layerFlags &= ~(XrCompositionLayerFlags)XR_COMPOSITION_LAYER_UNPREMULTIPLIED_ALPHA_BIT;
             layer = (const XrCompositionLayerBaseHeader *)&projections[count];
         }
         if (strip_depth && layer->type == XR_TYPE_COMPOSITION_LAYER_PROJECTION &&
@@ -1947,14 +1892,9 @@ XRAPI_ATTR XrResult XRAPI_CALL xrEndFrame(XrSession session, const XrFrameEndInf
                     if (layer != (const XrCompositionLayerBaseHeader *)&projections[count]) projections[count] = *cur;
                     if (projections[count].views != views[count])
                         for (uint32_t v = 0; v < cur->viewCount; ++v) views[count][v] = cur->views[v];
-                    for (uint32_t v = 0; v < cur->viewCount; ++v) {
-                        int how = swapchain_size(views[count][v].subImage.swapchain, &w, &h)
-                                      ? clamp_rect(&views[count][v].subImage.imageRect, w, h) : 0;
-                        if (how == 2) {
-                            static int logged_empty;
-                            if (logged_empty++ < 3)
-                                LOG("rect_clamp: view %u empty image rect -> full swapchain %ux%u", v, w, h);
-                        } else if (how) {
+                    for (uint32_t v = 0; v < cur->viewCount; ++v)
+                        if (swapchain_size(views[count][v].subImage.swapchain, &w, &h) &&
+                            clamp_rect(&views[count][v].subImage.imageRect, w, h)) {
                             static int logged;
                             if (logged++ < 3)
                                 LOG("rect_clamp: view %u image rect clamped to %dx%d at %d,%d (swapchain %ux%u)", v,
@@ -1963,7 +1903,6 @@ XRAPI_ATTR XrResult XRAPI_CALL xrEndFrame(XrSession session, const XrFrameEndInf
                                     views[count][v].subImage.imageRect.offset.x,
                                     views[count][v].subImage.imageRect.offset.y, w, h);
                         }
-                    }
                     projections[count].views = views[count];
                     layer = (const XrCompositionLayerBaseHeader *)&projections[count];
                     ++swapped;
@@ -1971,17 +1910,13 @@ XRAPI_ATTR XrResult XRAPI_CALL xrEndFrame(XrSession session, const XrFrameEndInf
             } else if (layer->type == XR_TYPE_COMPOSITION_LAYER_QUAD) {
                 const XrCompositionLayerQuad *q = (const XrCompositionLayerQuad *)layer;
                 XrRect2Di r = q->subImage.imageRect;
-                int how = swapchain_size(q->subImage.swapchain, &w, &h) ? clamp_rect(&r, w, h) : 0;
-                if (how) {
+                if (swapchain_size(q->subImage.swapchain, &w, &h) && clamp_rect(&r, w, h)) {
                     if (layer != (const XrCompositionLayerBaseHeader *)&quads[count]) quads[count] = *q;
                     quads[count].subImage.imageRect = r;
                     layer = (const XrCompositionLayerBaseHeader *)&quads[count];
                     ++swapped;
-                    static int logged, logged_empty;
-                    if (how == 2 && logged_empty++ < 3)
-                        LOG("rect_clamp: quad empty image rect -> full swapchain %ux%u", w, h);
-                    else if (how == 1 && !logged++)
-                        LOG("rect_clamp: quad image rect clamped (swapchain %ux%u)", w, h);
+                    static int logged;
+                    if (!logged++) LOG("rect_clamp: quad image rect clamped (swapchain %ux%u)", w, h);
                 }
             }
         }
@@ -2083,7 +2018,7 @@ XRAPI_ATTR XrResult XRAPI_CALL xrGetCurrentInteractionProfile(XrSession session,
     PFN_xrGetCurrentInteractionProfile fn =
         (PFN_xrGetCurrentInteractionProfile)lookup(active_instance, "xrGetCurrentInteractionProfile");
     if (!fn) return XR_ERROR_FUNCTION_UNSUPPORTED;
-    XrResult result = detached_current_profile(user, state, fn(session, user, state));
+    XrResult result = fn(session, user, state);
     if (input_diag && XR_SUCCEEDED(result) && state) input_diag_current_profile(user, state->interactionProfile);
     if (layer_debug && active_instance) {  // which device each hand has, as the runtime reports it
         PFN_xrPathToString str = (PFN_xrPathToString)lookup(active_instance, "xrPathToString");
@@ -2097,7 +2032,16 @@ XRAPI_ATTR XrResult XRAPI_CALL xrGetCurrentInteractionProfile(XrSession session,
         static int logged;
         if (logged++ < 40) LOG("layer_debug: interaction profile of %s: %s (result %d)", who, what, result);
     }
-    if (XR_SUCCEEDED(result) && state) current_profile_fix(user, state);
+    if (!controller_fix || XR_FAILED(result) || !state || !state->interactionProfile || !active_instance)
+        return result;
+    PFN_xrPathToString to_string = (PFN_xrPathToString)lookup(active_instance, "xrPathToString");
+    PFN_xrStringToPath to_path = (PFN_xrStringToPath)lookup(active_instance, "xrStringToPath");
+    char name[XR_MAX_PATH_LENGTH];
+    uint32_t size = 0;
+    if (to_string && to_path &&
+        XR_SUCCEEDED(to_string(active_instance, state->interactionProfile, sizeof(name), &size, name)) &&
+        (strstr(name, "/valve/") || strstr(name, "/khr/generic_controller")))
+        to_path(active_instance, "/interaction_profiles/oculus/touch_controller", &state->interactionProfile);
     return result;
 }
 
@@ -2107,7 +2051,7 @@ XRAPI_ATTR XrResult XRAPI_CALL xrEnumerateInstanceExtensionProperties(const char
         XR_NULL_HANDLE, "xrEnumerateInstanceExtensionProperties");
     if (!fn) return XR_ERROR_INITIALIZATION_FAILED;
     if (!count) return XR_ERROR_VALIDATION_FAILURE;
-    if ((!foveation_fix && !hide_fb_foveation && !hide_space_warp && !passthrough_emul && !scene_emul && !controller_models) || layer)
+    if ((!foveation_fix && !hide_space_warp && !passthrough_emul && !scene_emul && !controller_models) || layer)
         return fn(layer, capacity, count, properties);
 
     uint32_t total = 0;
@@ -2123,7 +2067,6 @@ XRAPI_ATTR XrResult XRAPI_CALL xrEnumerateInstanceExtensionProperties(const char
     for (uint32_t i = 0; i < total; ++i) {
         if (!strcmp(all[i].extensionName, "XR_FB_passthrough")) runtime_has_fb_passthrough = 1;
         if (!strcmp(all[i].extensionName, XR_FB_RENDER_MODEL_EXTENSION_NAME)) runtime_has_render_model = 1;
-        if (hide_fb_foveation && fb_is_foveation_extension(all[i].extensionName)) continue;
         if (foveation_fix && strstr(all[i].extensionName, "foveation")) continue;
         if (hide_space_warp && !strcmp(all[i].extensionName, "XR_FB_space_warp")) continue;
         if (properties && kept < capacity) properties[kept] = all[i];
@@ -2163,29 +2106,9 @@ XRAPI_ATTR XrResult XRAPI_CALL xrEnumerateApiLayerProperties(uint32_t capacity,
     return fn ? fn(capacity, count, properties) : XR_ERROR_INITIALIZATION_FAILED;
 }
 
-static XRAPI_ATTR int XRAPI_CALL framebridge_hide_fb_foveation(void) {
-    pthread_once(&init_once, initialize);
-    return hide_fb_foveation;
-}
-
-static XRAPI_ATTR XrResult XRAPI_CALL fb_hide_update_swapchain(XrSwapchain swapchain, const XrSwapchainStateBaseHeaderFB *state) {
-    if (state && state->type == XR_TYPE_SWAPCHAIN_STATE_FOVEATION_FB) {
-        LOG("hide_fb_foveation: refused foveation profile update");
-        return XR_ERROR_FEATURE_UNSUPPORTED;
-    }
-    PFN_xrUpdateSwapchainFB fn = (PFN_xrUpdateSwapchainFB)lookup(active_instance, "xrUpdateSwapchainFB");
-    return fn ? fn(swapchain, state) : XR_ERROR_FUNCTION_UNSUPPORTED;
-}
-
 // For native/xrshim: emulated functions that overport's dispatcher doesn't know (it never asks us for them).
 __attribute__((visibility("default"))) PFN_xrVoidFunction framebridge_extension_proc(const char *name) {
     pthread_once(&init_once, initialize);
-    if (name && !strcmp(name, "framebridge_hide_fb_foveation"))
-        return (PFN_xrVoidFunction)framebridge_hide_fb_foveation;
-    if (hide_fb_foveation_vulkan && name) {
-        if (!strcmp(name, "xrCreateFoveationProfileFB")) return (PFN_xrVoidFunction)xrCreateFoveationProfileFB;
-        if (!strcmp(name, "xrUpdateSwapchainFB")) return (PFN_xrVoidFunction)fb_hide_update_swapchain;
-    }
     if (name && !foveation_fix && (foveation_storage_fix || foveation_eye)) {
         if (!strcmp(name, "xrCreateFoveationProfileFB")) return (PFN_xrVoidFunction)xrCreateFoveationProfileFB;
         if (!strcmp(name, "xrGetFoveationEyeTrackedStateMETA")) return (PFN_xrVoidFunction)xrGetFoveationEyeTrackedStateMETA;
@@ -2200,6 +2123,19 @@ __attribute__((visibility("default"))) PFN_xrVoidFunction framebridge_extension_
         NATIVE_PROC(xrCreateVulkanInstanceKHR)
 #undef NATIVE_PROC
     }
+    // The shim bypasses OVRPort's fixed dispatch table for all scene calls, including consumers of fake spaces.
+    if (name && emulate_scene) {
+        PFN_xrVoidFunction scene = scene_emulation(name);
+        if (scene) return scene;
+#define SCENE_PROC(fn) if (!strcmp(name, #fn)) return (PFN_xrVoidFunction)fn;
+        SCENE_PROC(xrPollEvent)
+        SCENE_PROC(xrGetSystemProperties)
+        SCENE_PROC(xrLocateSpace)
+        SCENE_PROC(xrLocateSpaces)
+        SCENE_PROC(xrDestroySpace)
+#undef SCENE_PROC
+        if (!strcmp(name, "xrLocateSpacesKHR")) return (PFN_xrVoidFunction)emu_locate_spaces_khr;
+    }
     return name ? render_model_emulation(name) : NULL;
 }
 
@@ -2226,10 +2162,6 @@ XRAPI_ATTR XrResult XRAPI_CALL xrGetInstanceProcAddr(XrInstance instance, const
     if (!emulated) emulated = render_model_emulation(name);
     if (!emulated && emulate_scene && !strcmp(name, "xrLocateSpacesKHR")) emulated = (PFN_xrVoidFunction)emu_locate_spaces_khr;
     if (emulated) { *function = emulated; return XR_SUCCESS; }
-    if (hide_fb_foveation_vulkan && !strcmp(name, "xrUpdateSwapchainFB")) {
-        *function = (PFN_xrVoidFunction)fb_hide_update_swapchain;
-        return XR_SUCCESS;
-    }
     HOOK(xrGetSystemProperties)
     HOOK(xrApplyHapticFeedback)
     HOOK(xrCreateReferenceSpace)
@@ -2272,9 +2204,6 @@ XRAPI_ATTR XrResult XRAPI_CALL xrGetInstanceProcAddr(XrInstance instance, const
     if (layer_debug || refresh_rate > 0) {
         HOOK_AS(xrRequestDisplayRefreshRateFB, hook_request_refresh_rate)
     }
-    // The Frame's runtime has no XR_FB_display_refresh_rate, but OVRPort's dispatcher offers it to the game and answers
-    // 0 Hz without it: the measured rate instead (the runtime's own answer when it has one).
-    if (instance != XR_NULL_HANDLE) HOOK_AS(xrGetDisplayRefreshRateFB, hook_get_refresh_rate)
     if (surface_emul) HOOK_AS(xrCreateSwapchainAndroidSurfaceKHR, hook_xrCreateSwapchainAndroidSurfaceKHR)
     if (eye_debug || release_wait) HOOK_AS(xrReleaseSwapchainImage, eye_hook_xrReleaseSwapchainImage)
     if (layer_debug || cube_standin) {  // counters + cube stand-ins; every other wait/release hook above takes precedence
@@ -2297,7 +2226,7 @@ XRAPI_ATTR XrResult XRAPI_CALL xrGetInstanceProcAddr(XrInstance instance, const
     if (layer_debug) HOOK_AS(xrGetActionStateBoolean, hook_xrGetActionStateBoolean)
     if (layer_debug || aim_correction_on() || profile_remap || input_diag || proximity_emul)
         HOOK_AS(xrSuggestInteractionProfileBindings, hook_xrSuggestInteractionProfileBindings)
-    if (action_dedup || proximity_emul || profile_remap || input_diag) HOOK_AS(xrCreateAction, hook_xrCreateAction)
+    if (proximity_emul) HOOK_AS(xrCreateAction, hook_xrCreateAction)
     if (layer_debug || aim_correction_on()) {
         HOOK_AS(xrCreateActionSpace, hook_xrCreateActionSpace)
     }

native/adapter/hide_fb_foveation.h

@@ -1,54 +0,0 @@
-// SPDX-License-Identifier: GPL-3.0-only
-// Shared by the adapter and its shim above OVRPort's synthetic extension list.
-static int fb_is_foveation_extension(const char *name) {
-    return !strcmp(name, "XR_FB_foveation_vulkan") || !strcmp(name, "XR_FB_foveation") ||
-        !strcmp(name, "XR_FB_foveation_configuration") || !strcmp(name, "XR_META_foveation_eye_tracked");
-}
-
-static int fb_instance_uses_vulkan(const XrInstanceCreateInfo *info) {
-    for (uint32_t i = 0; info && i < info->enabledExtensionCount; ++i)
-        if (!strcmp(info->enabledExtensionNames[i], "XR_KHR_vulkan_enable") ||
-            !strcmp(info->enabledExtensionNames[i], "XR_KHR_vulkan_enable2")) return 1;
-    return 0;
-}
-
-static inline XrResult fb_hide_enumerate(PFN_xrEnumerateInstanceExtensionProperties fn, const char *layer,
-        uint32_t capacity, uint32_t *count, XrExtensionProperties *properties) {
-    if (!count || (capacity && !properties)) return XR_ERROR_VALIDATION_FAILURE;
-    uint32_t total = 0;
-    XrResult r = fn(layer, 0, &total, NULL);
-    if (XR_FAILED(r)) return r;
-    XrExtensionProperties *all = calloc(total ? total : 1, sizeof(*all));
-    if (!all) return XR_ERROR_OUT_OF_MEMORY;
-    for (uint32_t i = 0; i < total; ++i) all[i].type = XR_TYPE_EXTENSION_PROPERTIES;
-    r = fn(layer, total, &total, all);
-    if (XR_SUCCEEDED(r)) {
-        uint32_t kept = 0;
-        for (uint32_t i = 0; i < total; ++i) {
-            if (fb_is_foveation_extension(all[i].extensionName)) continue;
-            if (kept < capacity) properties[kept] = all[i];
-            ++kept;
-        }
-        *count = kept;
-        if (capacity && capacity < kept) r = XR_ERROR_SIZE_INSUFFICIENT;
-    }
-    free(all);
-    return r;
-}
-
-static inline XrResult fb_hide_create_instance(PFN_xrCreateInstance fn, const XrInstanceCreateInfo *info,
-        XrInstance *instance) {
-    if (!info) return XR_ERROR_VALIDATION_FAILURE;
-    if (!fb_instance_uses_vulkan(info)) return fn(info, instance);
-    const char **names = calloc(info->enabledExtensionCount ? info->enabledExtensionCount : 1, sizeof(*names));
-    if (!names) return XR_ERROR_OUT_OF_MEMORY;
-    XrInstanceCreateInfo fixed = *info;
-    fixed.enabledExtensionCount = 0;
-    fixed.enabledExtensionNames = names;
-    for (uint32_t i = 0; i < info->enabledExtensionCount; ++i)
-        if (!fb_is_foveation_extension(info->enabledExtensionNames[i]))
-            names[fixed.enabledExtensionCount++] = info->enabledExtensionNames[i];
-    XrResult r = fn(&fixed, instance);
-    free(names);
-    return r;
-}

native/adapter/hide_foveation_images.h

@@ -1,32 +0,0 @@
-// SPDX-License-Identifier: GPL-3.0-only
-// Output chains are writable. Unlink FB nodes during enumeration and restore every
-// app-owned link on both success and failure; preserve unrelated output structures.
-static XrResult fb_hide_foveation_images(PFN_xrEnumerateSwapchainImages fn, XrSwapchain swapchain,
-        uint32_t capacity, uint32_t *count, XrSwapchainImageBaseHeader *images) {
-    if (!images || !capacity || images->type != XR_TYPE_SWAPCHAIN_IMAGE_VULKAN_KHR)
-        return fn(swapchain, capacity, count, images);
-    XrSwapchainImageVulkanKHR *vk_images = (void *)images;
-    size_t total = 0;
-    for (uint32_t i = 0; i < capacity; ++i)
-        for (XrBaseOutStructure *p = vk_images[i].next; p; p = p->next)
-            total += p->type == XR_TYPE_SWAPCHAIN_IMAGE_FOVEATION_VULKAN_FB;
-    struct FbImageLink { XrBaseOutStructure *parent, *node; };
-    struct FbImageLink *links = calloc(total ? total : 1, sizeof(*links));
-    if (!links) return XR_ERROR_OUT_OF_MEMORY;
-    size_t n = 0;
-    for (uint32_t i = 0; i < capacity; ++i) {
-        XrBaseOutStructure *parent = (void *)&vk_images[i];
-        while (parent->next) {
-            XrBaseOutStructure *p = parent->next;
-            if (p->type == XR_TYPE_SWAPCHAIN_IMAGE_FOVEATION_VULKAN_FB) {
-                links[n++] = (struct FbImageLink){parent, p};
-                parent->next = p->next;
-            } else parent = p;
-        }
-    }
-    XrResult result = fn(swapchain, capacity, count, images);
-    while (n) { --n; links[n].parent->next = links[n].node; }
-    free(links);
-    if (total) LOG("hide_fb_foveation: removed %zu Vulkan foveation image node(s)", total);
-    return result;
-}

native/adapter/input_diag.c

@@ -107,6 +107,8 @@ static const char *diag_perf_detail(XrPerfSettingsDomainEXT domain, XrPerfSettin
 }
 DIAG_CHECKED(xrStringToPath, (XrInstance instance, const char *path, XrPath *out), (instance, path, out),
              diag_name_detail(path))
+DIAG_CHECKED(xrCreateAction, (XrActionSet set, const XrActionCreateInfo *info, XrAction *action), (set, info, action),
+             diag_name_detail(info ? info->actionName : NULL))
 DIAG_CHECKED(xrAttachSessionActionSets, (XrSession session, const XrSessionActionSetsAttachInfo *info),
              (session, info), NULL)
 DIAG_CHECKED(xrPerfSettingsSetPerformanceLevelEXT,
@@ -114,46 +116,11 @@ DIAG_CHECKED(xrPerfSettingsSetPerformanceLevelEXT,
              (session, domain, level), diag_perf_detail(domain, level))
 #undef DIAG_CHECKED
 
-// Every action set and action the game creates, with its localized name: SteamVR turns them into an input manifest and
-// drops a game whose manifest it can't load ("SetXrInputConfig failed. Failed to load manifest" in vrserver.txt; the
-// app then counts as exited: home environment while the game keeps running, GitHub #323). Bytes outside printable
-// ASCII and the JSON specials " and \ are written as \xNN.
-static const char *diag_escaped(const char *in, char *out, size_t size) {
-    size_t used = 0;
-    for (const unsigned char *c = (const unsigned char *)(in ? in : "(null)"); *c && used + 5 < size; ++c) {
-        int special = *c < 0x20 || *c > 0x7e || *c == '"' || *c == '\\';
-        used += (size_t)(special ? snprintf(out + used, size - used, "\\x%02x", *c)
-                                 : snprintf(out + used, size - used, "%c", *c));
-    }
-    out[used] = 0;
-    return out;
-}
-static XRAPI_ATTR XrResult XRAPI_CALL diag_xrCreateActionSet(XrInstance instance, const XrActionSetCreateInfo *info,
-        XrActionSet *set) {
-    PFN_xrCreateActionSet fn = (PFN_xrCreateActionSet)lookup(instance, "xrCreateActionSet");
-    if (!fn) return XR_ERROR_FUNCTION_UNSUPPORTED;
-    XrResult result = fn(instance, info, set);
-    char a[XR_MAX_ACTION_SET_NAME_SIZE * 4 + 8], b[XR_MAX_LOCALIZED_ACTION_SET_NAME_SIZE * 4 + 8];
-    if (info)
-        LOG("input_diag: action set \"%s\" (\"%s\") priority %u -> %d", diag_escaped(info->actionSetName, a, sizeof(a)),
-            diag_escaped(info->localizedActionSetName, b, sizeof(b)), info->priority, (int)result);
-    return result;
-}
-// Called by session_fixes.c's hook_xrCreateAction (hooked whenever input_diag is on), with the names it created.
-static void diag_log_action(const XrActionCreateInfo *info, XrResult result) {
-    char a[XR_MAX_ACTION_NAME_SIZE * 4 + 8], b[XR_MAX_LOCALIZED_ACTION_NAME_SIZE * 4 + 8];
-    if (info)
-        LOG("input_diag: action \"%s\" (\"%s\") type %d, %u subaction path(s) -> %d",
-            diag_escaped(info->actionName, a, sizeof(a)), diag_escaped(info->localizedActionName, b, sizeof(b)),
-            (int)info->actionType, info->countSubactionPaths, (int)result);
-    if (XR_FAILED(result)) diag_call_failed("xrCreateAction", result, diag_name_detail(info ? info->actionName : NULL));
-}
-
 // xrGetInstanceProcAddr: our wrapper for `name`, NULL if it isn't one of ours.
 static PFN_xrVoidFunction input_diag_hook(const char *name) {
 #define DIAG(fn) if (!strcmp(name, #fn)) return (PFN_xrVoidFunction)diag_##fn;
     DIAG(xrStringToPath)
-    DIAG(xrCreateActionSet)
+    DIAG(xrCreateAction)
     DIAG(xrAttachSessionActionSets)
     DIAG(xrPerfSettingsSetPerformanceLevelEXT)
 #undef DIAG

native/adapter/profile_report.c

@@ -1,38 +0,0 @@
-// SPDX-License-Identifier: GPL-3.0-only
-// Included by session_fixes.c (after TOUCH_PROFILE and app_suggested_touch): what xrGetCurrentInteractionProfile
-// tells the game about each hand. Uses controller_fix, profile_remap, active_instance, lookup and LOG.
-//  * controller_fix: SteamVR's own profiles (valve/..., khr/generic_controller) are reported as oculus/touch_controller,
-//    the profile Quest games have bindings for.
-//  * profile_remap: when the game suggested bindings only for one of Meta's newer profiles (Touch Plus/Pro) and
-//    hook_xrSuggestInteractionProfileBindings suggested them again for Touch, the runtime reports
-//    oculus/touch_controller, a profile the game never suggested. Unity's OpenXR plugin creates its input devices by
-//    the reported profile, finds none for Touch and leaves the controllers unconnected: hands lying at the play-space
-//    origin on the floor, no buttons (e.g. Hotel Infinity, GitHub #327). Such a hand is reported with the game's own
-//    profile instead (the last one remapped: the Touch bindings the runtime uses are that profile's).
-
-static char remapped_profile[XR_MAX_PATH_LENGTH];  // set by hook_xrSuggestInteractionProfileBindings
-
-static void current_profile_fix(XrPath user, XrInteractionProfileState *state) {
-    if ((!controller_fix && !profile_remap) || !state->interactionProfile || !active_instance) return;
-    PFN_xrPathToString to_string = (PFN_xrPathToString)lookup(active_instance, "xrPathToString");
-    PFN_xrStringToPath to_path = (PFN_xrStringToPath)lookup(active_instance, "xrStringToPath");
-    char name[XR_MAX_PATH_LENGTH];
-    uint32_t size = 0;
-    if (!to_string || !to_path ||
-        XR_FAILED(to_string(active_instance, state->interactionProfile, sizeof(name), &size, name)))
-        return;
-    int touch = !strcmp(name, TOUCH_PROFILE);
-    if (controller_fix && (strstr(name, "/valve/") || strstr(name, "/khr/generic_controller")) &&
-        XR_SUCCEEDED(to_path(active_instance, TOUCH_PROFILE, &state->interactionProfile)))
-        touch = 1;
-    if (!touch || !profile_remap || !*remapped_profile || app_suggested_touch ||
-        XR_FAILED(to_path(active_instance, remapped_profile, &state->interactionProfile)))
-        return;
-    static int logged;
-    if (logged++ < 4) {
-        char who[XR_MAX_PATH_LENGTH] = "?";
-        to_string(active_instance, user, sizeof(who), &size, who);
-        LOG("profile_remap: %s reported as %s (the app's profile) instead of oculus/touch_controller", who,
-            remapped_profile + strlen("/interaction_profiles/"));
-    }
-}

native/adapter/refresh_rate.h

@@ -1,15 +0,0 @@
-// SPDX-License-Identifier: GPL-3.0-only
-// Display refresh rate for xrGetDisplayRefreshRateFB when the runtime doesn't give one (session_fixes.c). Pure, so the
-// host test (tests/fixtures/src/refresh_rate_test.c) can check it.
-#pragma once
-#include <stdint.h>
-
-// The rate the frame timing shows (1 / predictedDisplayPeriod of the last xrWaitFrame, whole Hz), else the
-// refresh_rate setting, else 72 Hz (the Frame's rate for Android apps).
-static inline float fb_refresh_rate(int64_t display_period_ns, float setting) {
-    if (display_period_ns > 0) {
-        double hz = 1e9 / (double)display_period_ns;
-        if (hz >= 30.0 && hz <= 240.0) return (float)(int)(hz + 0.5);
-    }
-    return setting > 0 ? setting : 72.0f;
-}

native/adapter/scene_anchors.c

@@ -0,0 +1,115 @@
+// SPDX-License-Identifier: GPL-3.0-only
+// Included by scene_emu.c. Persist only application anchors; scanned entities remain owned by the room file.
+#include <sys/random.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#ifndef SCENE_EXTERNAL_ROOT
+#define SCENE_EXTERNAL_ROOT "/sdcard/Android/data"
+#endif
+
+static int anchor_path(char *path, size_t size) {
+    char process[256] = {0};
+    FILE *f = fopen("/proc/self/cmdline", "r");
+    if (!f) return 0;
+    size_t n = fread(process, 1, sizeof(process)-1, f);
+    fclose(f);
+    if (!n) return 0;
+    char *colon = strchr(process, ':');
+    if (colon) *colon = 0;
+    // Only package-like process names: never let a command line become a path traversal.
+    if (!strchr(process, '.') || !strcmp(process, ".") || !strcmp(process, "..")) return 0;
+    for (const char *p = process; *p; ++p)
+        if (!((*p >= 'a' && *p <= 'z') || (*p >= 'A' && *p <= 'Z') || (*p >= '0' && *p <= '9') || *p == '.' || *p == '_')) return 0;
+    int len = snprintf(path, size, "%s/%s/files/framebridge-anchors.txt", SCENE_EXTERNAL_ROOT, process);
+    return len > 0 && (size_t)len < size;
+}
+static int anchor_uuid(XrUuidEXT *u) {
+    size_t have = 0;
+    while (have < sizeof(u->data)) {
+        ssize_t n = getrandom(u->data + have, sizeof(u->data) - have, 0);
+        if (n < 0 && errno == EINTR) continue;
+        if (n <= 0) break;
+        have += (size_t)n;
+    }
+    if (have < sizeof(u->data)) {
+        FILE *f = fopen("/dev/urandom", "rb");
+        if (!f) return 0;
+        have = fread(u->data, 1, sizeof(u->data), f);
+        fclose(f);
+        if (have != sizeof(u->data)) return 0;
+    }
+    u->data[6] = (uint8_t)((u->data[6] & 15) | 0x40);
+    u->data[8] = (uint8_t)((u->data[8] & 63) | 0x80);
+    for (int i = 0; i < entity_count; ++i) if (uuid_equal(u, &entities[i].uuid)) return 0;
+    return 1;
+}
+static int write_anchors(void) {
+    char path[4096], tmp[4128];
+    if (!anchor_path(path, sizeof(path))) return 0;
+    snprintf(tmp, sizeof(tmp), "%s.tmp-XXXXXX", path);
+    int fd = mkstemp(tmp);
+    if (fd < 0) return 0;
+    FILE *f = fdopen(fd, "w");
+    if (!f) { close(fd); unlink(tmp); return 0; }
+    int ok = 1;
+    for (int i = 0; i < entity_count; ++i) {
+        const scene_entity *e = &entities[i];
+        if (!e->is_anchor || !e->saved || e->erased) continue;
+        char uuid[33];
+        for (int k = 0; k < 16; ++k) snprintf(uuid + k*2, 3, "%02x", e->uuid.data[k]);
+        const XrPosef p = e->pose_in_stage;
+        if (fprintf(f, "anchor %s %.9g %.9g %.9g %.9g %.9g %.9g %.9g\n", uuid,
+                    p.position.x, p.position.y, p.position.z, p.orientation.x, p.orientation.y, p.orientation.z, p.orientation.w) < 0) ok = 0;
+    }
+    if (fflush(f) || fsync(fd)) ok = 0;
+    if (fclose(f)) ok = 0;
+    if (ok && rename(tmp, path)) ok = 0;
+    if (!ok) { LOG("scene: anchor write failed (%d)", errno); unlink(tmp); }
+    return ok;
+}
+static void load_anchors(void) {
+    char path[4096];
+    if (!anchor_path(path, sizeof(path))) return;
+    FILE *f = fopen(path, "r");
+    if (!f) return;
+    char line[1024], *t[10];
+    unsigned loaded = 0;
+    while (fgets(line, sizeof(line), f)) {
+        if (!strchr(line, '\n') && !feof(f)) { int c; while ((c=fgetc(f)) != EOF && c != '\n') {} continue; }
+        XrUuidEXT uuid; float v[7];
+        int n = room_tokens(line, t, 10);
+        if (n != 9 || strcmp(t[0], "anchor") || !room_uuid(t[1], &uuid) || !room_values(t, 2, 7, v)) continue;
+        float norm = sqrtf(v[3]*v[3]+v[4]*v[4]+v[5]*v[5]+v[6]*v[6]);
+        if (norm < 0.0001f) continue;
+        int duplicate = 0;
+        for (int i = 0; i < entity_count; ++i) duplicate |= uuid_equal(&uuid, &entities[i].uuid);
+        if (duplicate) continue;
+        int i = add_entity((XrPosef){{v[3]/norm,v[4]/norm,v[5]/norm,v[6]/norm},{v[0],v[1],v[2]}}, NULL, 0, 0, 0, 1);
+        if (i < 0) break;
+        entities[i].uuid = uuid; entities[i].saved = 1; ++loaded;
+    }
+    fclose(f);
+    LOG("scene: loaded %u saved anchors", loaded);
+}
+// Batch writes are atomic both on disk and in memory. Failure never silently destroys the old anchor set.
+static XrResult persist_spaces(uint32_t count, const XrSpace *spaces, uint32_t uuid_count, const XrUuidEXT *uuids, int erase) {
+    unsigned char selected[MAX_ENTITIES] = {0}, old_saved[MAX_ENTITIES], old_erased[MAX_ENTITIES];
+    for (uint32_t k = 0; k < count; ++k) {
+        int i = fake_space_index(spaces[k]);
+        if (i < 0) return XR_ERROR_HANDLE_INVALID;
+        if (entities[i].is_anchor) selected[i] = 1;
+    }
+    if (erase) for (int i = 0; i < entity_count; ++i)
+        if (entities[i].is_anchor && !entities[i].erased && uuid_matches(uuid_count, uuids, &entities[i])) selected[i] = 1;
+    int changed = 0;
+    for (int i = 0; i < entity_count; ++i) {
+        old_saved[i] = (unsigned char)entities[i].saved; old_erased[i] = (unsigned char)entities[i].erased;
+        if (selected[i]) { entities[i].saved = !erase; entities[i].erased = erase; changed = 1; }
+    }
+    if (changed && !write_anchors()) {
+        for (int i = 0; i < entity_count; ++i) { entities[i].saved = old_saved[i]; entities[i].erased = old_erased[i]; }
+        return XR_ERROR_RUNTIME_FAILURE;
+    }
+    if (changed) LOG("scene: anchors %s", erase ? "erased" : "saved");
+    return XR_SUCCESS;
+}

native/adapter/scene_emu.c

@@ -1,16 +1,18 @@
 // SPDX-License-Identifier: GPL-3.0-only
 // Included by frame_adapter.c. Emulates Meta's scene / spatial-entity extensions (XR_FB_spatial_entity,
 // _query, _storage, _container, XR_FB_scene, XR_FB_scene_capture) for mixed-reality apps on runtimes that
-// lack them (Steam Frame). The "room" is a box built from the runtime's STAGE bounds (the guardian /
-// chaperone rectangle): floor, ceiling and four walls, reported as one room anchor with a layout.
+// lack them (Steam Frame). Room files use STAGE coordinates; absent/invalid files retain the guardian box.
 // Entity spaces are fake handles; every function that consumes a space is intercepted for them.
 
 static float scene_min_size = 1.5f;  // smallest room edge if the guardian is tiny or unavailable
 static int emulate_scene;            // app requested the scene extensions and the runtime lacks them
+static int scene_app_mesh;           // app enabled XR_META_spatial_entity_mesh: only then is the global mesh an entity
+                                     // (an older SDK's scene loader fails on an anchor it can't place)
 
 static const char *const scene_extensions[] = {
     "XR_FB_spatial_entity", "XR_FB_spatial_entity_query", "XR_FB_spatial_entity_storage",
     "XR_FB_spatial_entity_container", "XR_FB_scene", "XR_FB_scene_capture",
+    "XR_META_spatial_entity_mesh", "XR_META_spatial_entity_discovery", "XR_META_spatial_entity_persistence",
 };
 #define SCENE_EXTENSION_COUNT (sizeof(scene_extensions) / sizeof(scene_extensions[0]))
 
@@ -42,38 +44,58 @@ static XrPosef pose_inv(XrPosef a) {
 
 // ---------------------------------------------------------------- entities
 enum { ENT_ROOM, ENT_FLOOR, ENT_CEILING, ENT_WALL0, ENT_WALL1, ENT_WALL2, ENT_WALL3, ENT_FIXED_COUNT };
-#define MAX_ENTITIES 64
+#define MAX_ENTITIES 2048
+#define MAX_OUTLINE 1024
 
 typedef struct {
     XrSpace handle;       // fake handle given to the app
     XrUuidEXT uuid;
     XrPosef pose_in_stage;
-    const char *label;    // semantic label, NULL if none
+    char label[256];      // comma-separated Meta semantic labels
     XrRect2Df bounds;     // 2D bounds in the entity's local XY plane
-    int has_bounds, is_room, is_anchor;
+    XrRect3DfFB bounds3;
+    XrVector2f *boundary;
+    uint32_t boundary_count;
+    XrVector3f *vertices;
+    uint32_t *indices, vertex_count, index_count;
+    int has_bounds, has_bounds3, is_room, is_anchor, is_wall, erased, saved;
 } scene_entity;
 
 static pthread_mutex_t scene_lock = PTHREAD_MUTEX_INITIALIZER;
 static scene_entity entities[MAX_ENTITIES];
-static int entity_count;
+static int entity_count, room_entity_count, wall_count, room_from_file;
+static char room_source[32];
+static uint64_t room_universe;
 static XrSpace scene_stage = XR_NULL_HANDLE;  // real STAGE space used to anchor everything
 static XrSession scene_session = XR_NULL_HANDLE;
 static uint64_t next_request = 0x5ce0000001ull;
 
-#define FAKE_SPACE_TAG 0x5ce0000000000000ull
+// Fit the tag in uintptr_t as the adapter is also built for AArch32. Session generations prevent stale
+// handles from aliasing new room entities when an engine recreates its session in the same process.
+#if UINTPTR_MAX > 0xffffffffu
+#define FAKE_SPACE_TAG ((uintptr_t)0x5ce0000000000000ull)
+#define FAKE_SPACE_MASK ((uintptr_t)0xfff0000000000000ull)
+#else
+#define FAKE_SPACE_TAG ((uintptr_t)0x5ce00000u)
+#define FAKE_SPACE_MASK ((uintptr_t)0xfff00000u)
+#endif
+static unsigned scene_generation;
+
+static int is_fake_space(XrSpace space) { return ((uintptr_t)space & FAKE_SPACE_MASK) == FAKE_SPACE_TAG; }
 static int fake_space_index(XrSpace space) {
-    uint64_t v = (uint64_t)(uintptr_t)space;
-    if ((v & 0xfff0000000000000ull) != FAKE_SPACE_TAG) return -1;
-    int i = (int)(v & 0xffff);
-    return i < entity_count ? i : -1;
+    uintptr_t v = (uintptr_t)space;
+    if ((v & FAKE_SPACE_MASK) != FAKE_SPACE_TAG || ((v >> 12) & 255) != scene_generation) return -1;
+    int i = (int)(v & 4095);
+    return i < entity_count && !entities[i].erased ? i : -1;
 }
-static XrSpace fake_space(int index) { return (XrSpace)(uintptr_t)(FAKE_SPACE_TAG | (uint64_t)index); }
+static XrSpace fake_space(int index) { return (XrSpace)(FAKE_SPACE_TAG | ((uintptr_t)scene_generation << 12) | (uintptr_t)index); }
 
 static XrUuidEXT make_uuid(int index) {
     XrUuidEXT u;
     for (int i = 0; i < XR_UUID_SIZE_EXT; ++i) u.data[i] = (uint8_t)(0x5c ^ (i * 37) ^ (index * 101));
     u.data[6] = (uint8_t)((u.data[6] & 0x0f) | 0x40);  // version 4 style
     u.data[15] = (uint8_t)index;
+    u.data[14] ^= (uint8_t)((unsigned)index >> 8);
     return u;
 }
 static int uuid_equal(const XrUuidEXT *a, const XrUuidEXT *b) { return !memcmp(a->data, b->data, XR_UUID_SIZE_EXT); }
@@ -86,7 +108,7 @@ static int add_entity(XrPosef pose, const char *label, float w, float h, int is_
     e->handle = fake_space(i);
     e->uuid = make_uuid(i);
     e->pose_in_stage = pose;
-    e->label = label;
+    if (label) snprintf(e->label, sizeof(e->label), "%s", label);
     e->has_bounds = w > 0 && h > 0;
     e->bounds = (XrRect2Df){{-w / 2, -h / 2}, {w, h}};
     e->is_room = is_room;
@@ -94,9 +116,23 @@ static int add_entity(XrPosef pose, const char *label, float w, float h, int is_
     return i;
 }
 
+static void reset_room(void) {
+    for (int i = 0; i < entity_count; ++i) {
+        free(entities[i].boundary);
+        free(entities[i].vertices);
+        free(entities[i].indices);
+    }
+    memset(entities, 0, sizeof(entities));
+    entity_count = room_entity_count = wall_count = room_from_file = 0;
+    room_universe = 0;
+}
+
+#include "scene_room.c"
+
 // Build the room once the session exists: guardian rectangle -> floor/ceiling/walls.
 static void build_room(void) {
     if (entity_count) return;
+    if (load_room_file()) return;
     float width = 0, depth = 0;
     PFN_xrGetReferenceSpaceBoundsRect bounds_fn =
         (PFN_xrGetReferenceSpaceBoundsRect)lookup(active_instance, "xrGetReferenceSpaceBoundsRect");
@@ -117,10 +153,14 @@ static void build_room(void) {
     add_entity((XrPosef){{0, 0, 0, 1}, {0, 0, 0}}, NULL, 0, 0, 1, 0);                         // ENT_ROOM
     add_entity((XrPosef){{-s, 0, 0, s}, {0, 0, 0}}, "FLOOR", width, depth, 0, 0);             // +Z (normal) -> +Y
     add_entity((XrPosef){{s, 0, 0, s}, {0, h, 0}}, "CEILING", width, depth, 0, 0);            // +Z -> -Y
+    // Walls in loop order around the floor, as Meta's ROOM_LAYOUT lists them (Demeter walks them as an outline).
     add_entity((XrPosef){{0, 0, 0, 1}, {0, h / 2, -depth / 2}}, "WALL_FACE", width, h, 0, 0); // faces +Z
+    add_entity((XrPosef){{0, -s, 0, s}, {width / 2, h / 2, 0}}, "WALL_FACE", depth, h, 0, 0); // faces -X
     add_entity((XrPosef){{0, 1, 0, 0}, {0, h / 2, depth / 2}}, "WALL_FACE", width, h, 0, 0);  // faces -Z
     add_entity((XrPosef){{0, s, 0, s}, {-width / 2, h / 2, 0}}, "WALL_FACE", depth, h, 0, 0); // faces +X
-    add_entity((XrPosef){{0, -s, 0, s}, {width / 2, h / 2, 0}}, "WALL_FACE", depth, h, 0, 0); // faces -X
+    wall_count = 4;
+    room_entity_count = entity_count;
+    for (int i = ENT_WALL0; i < entity_count; ++i) entities[i].is_wall = 1;
 }
 
 // Supported components per entity.
@@ -128,12 +168,17 @@ static int entity_components(const scene_entity *e, XrSpaceComponentTypeFB *out)
     int n = 0;
     out[n++] = XR_SPACE_COMPONENT_TYPE_LOCATABLE_FB;
     out[n++] = XR_SPACE_COMPONENT_TYPE_STORABLE_FB;
+    out[n++] = XR_SPACE_COMPONENT_TYPE_SHARABLE_FB;  // Meta's runtime lists it; nothing is shared from here
     if (e->is_room) {
         out[n++] = XR_SPACE_COMPONENT_TYPE_ROOM_LAYOUT_FB;
         out[n++] = XR_SPACE_COMPONENT_TYPE_SPACE_CONTAINER_FB;
     } else if (!e->is_anchor) {
-        out[n++] = XR_SPACE_COMPONENT_TYPE_BOUNDED_2D_FB;
-        out[n++] = XR_SPACE_COMPONENT_TYPE_SEMANTIC_LABELS_FB;
+        if (e->has_bounds) {
+            out[n++] = XR_SPACE_COMPONENT_TYPE_BOUNDED_2D_FB;
+        }
+        if (e->has_bounds3) out[n++] = XR_SPACE_COMPONENT_TYPE_BOUNDED_3D_FB;
+        if (e->vertex_count) out[n++] = XR_SPACE_COMPONENT_TYPE_TRIANGLE_MESH_META;
+        if (e->label[0]) out[n++] = XR_SPACE_COMPONENT_TYPE_SEMANTIC_LABELS_FB;
     }
     return n;
 }
@@ -148,6 +193,7 @@ static int entity_has_component(const scene_entity *e, XrSpaceComponentTypeFB ty
 #define MAX_EVENTS 64
 static XrEventDataBuffer scene_events[MAX_EVENTS];
 static int event_head, event_tail;
+static int event_free(void) { return (event_head - event_tail - 1 + MAX_EVENTS) % MAX_EVENTS; }
 static void push_event(const void *event, size_t size) {
     if ((event_tail + 1) % MAX_EVENTS == event_head) return;
     memset(&scene_events[event_tail], 0, sizeof(XrEventDataBuffer));
@@ -171,6 +217,7 @@ static int stage_pose(XrSpace space, XrTime time, XrPosef *pose, XrSpaceLocation
                  XR_SPACE_LOCATION_ORIENTATION_TRACKED_BIT | XR_SPACE_LOCATION_POSITION_TRACKED_BIT;
         return 1;
     }
+    if (is_fake_space(space)) return 0;  // erased or from a prior session: never pass a fake handle to SteamVR
     PFN_xrLocateSpace locate = (PFN_xrLocateSpace)lookup(active_instance, "xrLocateSpace");
     if (!locate || !scene_stage) return 0;
     XrSpaceLocation loc = {XR_TYPE_SPACE_LOCATION, NULL, 0, {{0, 0, 0, 1}, {0, 0, 0}}};
@@ -181,7 +228,7 @@ static int stage_pose(XrSpace space, XrTime time, XrPosef *pose, XrSpaceLocation
 }
 // Locate `space` in `base` when either is fake. Returns 0 if neither is fake (caller forwards).
 static int locate_fake(XrSpace space, XrSpace base, XrTime time, XrPosef *pose, XrSpaceLocationFlags *flags) {
-    if (fake_space_index(space) < 0 && fake_space_index(base) < 0) return 0;
+    if (!is_fake_space(space) && !is_fake_space(base)) return 0;
     XrPosef s, b;
     XrSpaceLocationFlags fs = 0, fb = 0;
     if (!stage_pose(space, time, &s, &fs) || !stage_pose(base, time, &b, &fb)) {
@@ -195,99 +242,96 @@ static int locate_fake(XrSpace space, XrSpace base, XrTime time, XrPosef *pose,
 }
 
 // ---------------------------------------------------------------- emulated entry points
-static XRAPI_ATTR XrResult XRAPI_CALL emu_query_spaces(XrSession session, const XrSpaceQueryInfoBaseHeaderFB *info,
-                                                       XrAsyncRequestIdFB *request) {
-    if (!info || !request) return XR_ERROR_VALIDATION_FAILURE;
-    pthread_mutex_lock(&scene_lock);
-    scene_session = session;
-    build_room();
-    *request = next_request++;
-    XrEventDataSpaceQueryResultsAvailableFB avail = {XR_TYPE_EVENT_DATA_SPACE_QUERY_RESULTS_AVAILABLE_FB, NULL, *request};
-    XrEventDataSpaceQueryCompleteFB done = {XR_TYPE_EVENT_DATA_SPACE_QUERY_COMPLETE_FB, NULL, *request, XR_SUCCESS};
-    push_event(&avail, sizeof(avail));
-    push_event(&done, sizeof(done));
-    pthread_mutex_unlock(&scene_lock);
-    return XR_SUCCESS;
-}
-
-// Query filters are kept per request so retrieve can apply them.
+// Results are snapshotted before their available event is queued, so callers on another thread cannot
+// observe a half-stored filter. A bounded request history supports the count/data calls independently.
+#define MAX_QUERIES 64
 typedef struct {
     XrAsyncRequestIdFB id;
-    int has_component;
-    XrSpaceComponentTypeFB component;
-    uint32_t uuid_count;
-    XrUuidEXT uuids[64];
-} query_filter;
-static query_filter filters[16];
-static int filter_next;
-
-static void store_filter(XrAsyncRequestIdFB id, const XrSpaceQueryInfoFB *q) {
-    query_filter *f = &filters[filter_next++ % 16];
-    memset(f, 0, sizeof(*f));
-    f->id = id;
-    const XrSpaceFilterInfoBaseHeaderFB *flt = q->filter;
-    if (flt && flt->type == XR_TYPE_SPACE_COMPONENT_FILTER_INFO_FB) {
-        f->has_component = 1;
-        f->component = ((const XrSpaceComponentFilterInfoFB *)flt)->componentType;
-    } else if (flt && flt->type == XR_TYPE_SPACE_UUID_FILTER_INFO_FB) {
-        const XrSpaceUuidFilterInfoFB *u = (const XrSpaceUuidFilterInfoFB *)flt;
-        f->uuid_count = u->uuidCount < 64 ? u->uuidCount : 64;
-        for (uint32_t i = 0; i < f->uuid_count; ++i) f->uuids[i] = u->uuids[i];
-    }
+    uint32_t count;
+    XrSpaceQueryResultFB *results;
+} scene_query;
+static scene_query queries[MAX_QUERIES];
+static unsigned query_next;
+static scene_query *new_query(void) {
+    scene_query *q = &queries[query_next % MAX_QUERIES];
+    XrSpaceQueryResultFB *results = malloc((size_t)entity_count * sizeof(*results));
+    if (!results) return NULL;
+    ++query_next;
+    free(q->results);
+    *q = (scene_query){next_request++, 0, results};
+    return q;
 }
-
-static XRAPI_ATTR XrResult XRAPI_CALL emu_query_spaces_filtered(XrSession session, const XrSpaceQueryInfoBaseHeaderFB *info,
-                                                                XrAsyncRequestIdFB *request) {
-    XrResult r = emu_query_spaces(session, info, request);
-    if (XR_SUCCEEDED(r) && info->type == XR_TYPE_SPACE_QUERY_INFO_FB) {
-        pthread_mutex_lock(&scene_lock);
-        store_filter(*request, (const XrSpaceQueryInfoFB *)info);
-        const XrSpaceQueryInfoFB *q = (const XrSpaceQueryInfoFB *)info;
-        LOG("scene: query request=%llu filter=%d", (unsigned long long)*request, q->filter ? q->filter->type : 0);
-        pthread_mutex_unlock(&scene_lock);
-    }
-    return r;
+static scene_query *find_query(XrAsyncRequestIdFB id) {
+    for (int i = 0; i < MAX_QUERIES; ++i) if (queries[i].id == id) return &queries[i];
+    return NULL;
 }
+static int uuid_matches(uint32_t n, const XrUuidEXT *uuids, const scene_entity *e) {
+    for (uint32_t i = 0; i < n; ++i) if (uuid_equal(&uuids[i], &e->uuid)) return 1;
+    return 0;
+}
+#include "scene_anchors.c"
 
-static int filter_matches(const query_filter *f, const scene_entity *e) {
+static int fb_filter_matches(const XrSpaceFilterInfoBaseHeaderFB *f, const scene_entity *e) {
     if (!f) return 1;
-    if (f->has_component) return entity_has_component(e, f->component);
-    if (f->uuid_count) {
-        for (uint32_t i = 0; i < f->uuid_count; ++i) if (uuid_equal(&f->uuids[i], &e->uuid)) return 1;
-        return 0;
+    if (f->type == XR_TYPE_SPACE_COMPONENT_FILTER_INFO_FB)
+        return entity_has_component(e, ((const XrSpaceComponentFilterInfoFB *)f)->componentType);
+    if (f->type == XR_TYPE_SPACE_UUID_FILTER_INFO_FB) {
+        const XrSpaceUuidFilterInfoFB *u = (const XrSpaceUuidFilterInfoFB *)f;
+        return u->uuids && uuid_matches(u->uuidCount, u->uuids, e);
     }
     return 1;
 }
-
+static XRAPI_ATTR XrResult XRAPI_CALL emu_query_spaces_filtered(XrSession session, const XrSpaceQueryInfoBaseHeaderFB *info,
+                                                                XrAsyncRequestIdFB *request) {
+    if (!info || !request || info->type != XR_TYPE_SPACE_QUERY_INFO_FB) return XR_ERROR_VALIDATION_FAILURE;
+    const XrSpaceQueryInfoFB *info_fb = (const XrSpaceQueryInfoFB *)info;
+    pthread_mutex_lock(&scene_lock);
+    scene_session = session;
+    build_room();
+    if (event_free() < 2) { pthread_mutex_unlock(&scene_lock); return XR_ERROR_LIMIT_REACHED; }
+    scene_query *q = new_query();
+    if (!q) { pthread_mutex_unlock(&scene_lock); return XR_ERROR_OUT_OF_MEMORY; }
+    for (int i = 0; i < entity_count && q->count < info_fb->maxResultCount; ++i) {
+        scene_entity *e = &entities[i];
+        if (!e->erased && fb_filter_matches(info_fb->filter, e))
+            q->results[q->count++] = (XrSpaceQueryResultFB){e->handle, e->uuid};
+    }
+    *request = q->id;
+    XrEventDataSpaceQueryResultsAvailableFB avail = {XR_TYPE_EVENT_DATA_SPACE_QUERY_RESULTS_AVAILABLE_FB, NULL, *request};
+    XrEventDataSpaceQueryCompleteFB done = {XR_TYPE_EVENT_DATA_SPACE_QUERY_COMPLETE_FB, NULL, *request, XR_SUCCESS};
+    push_event(&avail, sizeof(avail)); push_event(&done, sizeof(done));
+    LOG("scene: query request=%llu results=%u", (unsigned long long)*request, q->count);
+    pthread_mutex_unlock(&scene_lock);
+    return XR_SUCCESS;
+}
 static XRAPI_ATTR XrResult XRAPI_CALL emu_retrieve_results(XrSession session, XrAsyncRequestIdFB request,
                                                            XrSpaceQueryResultsFB *results) {
     (void)session;
     if (!results) return XR_ERROR_VALIDATION_FAILURE;
     pthread_mutex_lock(&scene_lock);
-    const query_filter *f = NULL;
-    for (int i = 0; i < 16; ++i) if (filters[i].id == request) f = &filters[i];
-    uint32_t n = 0;
-    for (int i = 0; i < entity_count; ++i) {
-        if (!filter_matches(f, &entities[i])) continue;
-        if (results->resultCapacityInput && n < results->resultCapacityInput && results->results) {
-            results->results[n].space = entities[i].handle;
-            results->results[n].uuid = entities[i].uuid;
+    scene_query *q = find_query(request);
+    XrResult r = XR_SUCCESS;
+    if (!q) r = XR_ERROR_VALIDATION_FAILURE;
+    else {
+        results->resultCountOutput = q->count;
+        if (results->resultCapacityInput && results->resultCapacityInput < q->count) r = XR_ERROR_SIZE_INSUFFICIENT;
+        else if (results->resultCapacityInput) {
+            if (!results->results) r = XR_ERROR_VALIDATION_FAILURE;
+            else memcpy(results->results, q->results, q->count * sizeof(*q->results));
         }
-        ++n;
     }
-    results->resultCountOutput = n;
     pthread_mutex_unlock(&scene_lock);
-    return (results->resultCapacityInput && results->resultCapacityInput < n) ? XR_ERROR_SIZE_INSUFFICIENT : XR_SUCCESS;
+    return r;
 }
 
-static XRAPI_ATTR XrResult XRAPI_CALL emu_get_uuid(XrSpace space, XrUuidEXT *uuid) {
+static XRAPI_ATTR XrResult XRAPI_CALL scene_get_uuid(XrSpace space, XrUuidEXT *uuid) {
     int i = fake_space_index(space);
     if (i < 0 || !uuid) return XR_ERROR_HANDLE_INVALID;
     *uuid = entities[i].uuid;
     return XR_SUCCESS;
 }
 
-static XRAPI_ATTR XrResult XRAPI_CALL emu_enumerate_components(XrSpace space, uint32_t capacity, uint32_t *count,
+static XRAPI_ATTR XrResult XRAPI_CALL scene_enumerate_components(XrSpace space, uint32_t capacity, uint32_t *count,
                                                                XrSpaceComponentTypeFB *types) {
     int i = fake_space_index(space);
     if (i < 0 || !count) return XR_ERROR_HANDLE_INVALID;
@@ -296,16 +340,33 @@ static XRAPI_ATTR XrResult XRAPI_CALL emu_enumerate_components(XrSpace space, ui
     *count = (uint32_t)n;
     if (!capacity) return XR_SUCCESS;
     if (capacity < (uint32_t)n) return XR_ERROR_SIZE_INSUFFICIENT;
+    if (!types) return XR_ERROR_VALIDATION_FAILURE;
     for (int k = 0; k < n; ++k) types[k] = list[k];
     return XR_SUCCESS;
 }
 
+// Which entity refused which component (the first ones only): an app's scene loader gives up on the whole room over
+// one of these, and OVRPlugin's own error line doesn't name the component (Demeter, 2026-10-16).
+static void log_refused_component(const char *op, int i, XrSpaceComponentTypeFB type) {
+    static int logged;
+    if (logged >= 20) return;
+    ++logged;
+    const scene_entity *e = &entities[i];
+    LOG("scene: %s component %d refused on %s (entity %d)", op, (int)type,
+        e->is_room ? "room" : e->is_anchor ? "app anchor" : e->label[0] ? e->label : "unlabelled", i);
+}
+
 static XRAPI_ATTR XrResult XRAPI_CALL emu_set_component_status(XrSpace space, const XrSpaceComponentStatusSetInfoFB *info,
                                                                XrAsyncRequestIdFB *request) {
-    int i = fake_space_index(space);
-    if (i < 0 || !info || !request) return XR_ERROR_HANDLE_INVALID;
-    if (!entity_has_component(&entities[i], info->componentType)) return XR_ERROR_SPACE_COMPONENT_NOT_SUPPORTED_FB;
     pthread_mutex_lock(&scene_lock);
+    int i = fake_space_index(space);
+    if (i < 0 || !info || !request) { pthread_mutex_unlock(&scene_lock); return XR_ERROR_HANDLE_INVALID; }
+    if (!entity_has_component(&entities[i], info->componentType)) {
+        log_refused_component("set", i, info->componentType);
+        pthread_mutex_unlock(&scene_lock);
+        return XR_ERROR_SPACE_COMPONENT_NOT_SUPPORTED_FB;
+    }
+    if (!event_free()) { pthread_mutex_unlock(&scene_lock); return XR_ERROR_LIMIT_REACHED; }
     *request = next_request++;
     XrEventDataSpaceSetStatusCompleteFB e = {XR_TYPE_EVENT_DATA_SPACE_SET_STATUS_COMPLETE_FB, NULL, *request, XR_SUCCESS,
                                              space, entities[i].uuid, info->componentType, info->enabled};
@@ -314,44 +375,49 @@ static XRAPI_ATTR XrResult XRAPI_CALL emu_set_component_status(XrSpace space, co
     return XR_SUCCESS;
 }
 
-static XRAPI_ATTR XrResult XRAPI_CALL emu_get_component_status(XrSpace space, XrSpaceComponentTypeFB type,
+static XRAPI_ATTR XrResult XRAPI_CALL scene_get_component_status(XrSpace space, XrSpaceComponentTypeFB type,
                                                                XrSpaceComponentStatusFB *status) {
     int i = fake_space_index(space);
     if (i < 0 || !status) return XR_ERROR_HANDLE_INVALID;
-    if (!entity_has_component(&entities[i], type)) return XR_ERROR_SPACE_COMPONENT_NOT_SUPPORTED_FB;
+    if (!entity_has_component(&entities[i], type)) {
+        log_refused_component("get", i, type);
+        return XR_ERROR_SPACE_COMPONENT_NOT_SUPPORTED_FB;
+    }
     status->enabled = XR_TRUE;
     status->changePending = XR_FALSE;
     return XR_SUCCESS;
 }
 
-static XRAPI_ATTR XrResult XRAPI_CALL emu_get_container(XrSession session, XrSpace space, XrSpaceContainerFB *container) {
+static XRAPI_ATTR XrResult XRAPI_CALL scene_get_container(XrSession session, XrSpace space, XrSpaceContainerFB *container) {
     (void)session;
     int i = fake_space_index(space);
     if (i < 0 || !container) return XR_ERROR_HANDLE_INVALID;
     if (!entities[i].is_room) return XR_ERROR_SPACE_COMPONENT_NOT_ENABLED_FB;
-    uint32_t n = ENT_FIXED_COUNT - 1;  // everything except the room itself
+    uint32_t n = room_entity_count - 1;  // everything except the room itself
     container->uuidCountOutput = n;
     if (!container->uuidCapacityInput) return XR_SUCCESS;
     if (container->uuidCapacityInput < n) return XR_ERROR_SIZE_INSUFFICIENT;
+    if (!container->uuids) return XR_ERROR_VALIDATION_FAILURE;
     for (uint32_t k = 0; k < n; ++k) container->uuids[k] = entities[ENT_FLOOR + k].uuid;
     return XR_SUCCESS;
 }
 
-static XRAPI_ATTR XrResult XRAPI_CALL emu_get_room_layout(XrSession session, XrSpace space, XrRoomLayoutFB *layout) {
+static XRAPI_ATTR XrResult XRAPI_CALL scene_get_room_layout(XrSession session, XrSpace space, XrRoomLayoutFB *layout) {
     (void)session;
     int i = fake_space_index(space);
     if (i < 0 || !layout) return XR_ERROR_HANDLE_INVALID;
     if (!entities[i].is_room) return XR_ERROR_SPACE_COMPONENT_NOT_ENABLED_FB;
     layout->floorUuid = entities[ENT_FLOOR].uuid;
     layout->ceilingUuid = entities[ENT_CEILING].uuid;
-    layout->wallUuidCountOutput = 4;
+    layout->wallUuidCountOutput = (uint32_t)wall_count;
     if (!layout->wallUuidCapacityInput) return XR_SUCCESS;
-    if (layout->wallUuidCapacityInput < 4) return XR_ERROR_SIZE_INSUFFICIENT;
-    for (int k = 0; k < 4; ++k) layout->wallUuids[k] = entities[ENT_WALL0 + k].uuid;
+    if (layout->wallUuidCapacityInput < (uint32_t)wall_count) return XR_ERROR_SIZE_INSUFFICIENT;
+    if (!layout->wallUuids) return XR_ERROR_VALIDATION_FAILURE;
+    for (int k = 0; k < wall_count; ++k) layout->wallUuids[k] = entities[ENT_WALL0 + k].uuid;
     return XR_SUCCESS;
 }
 
-static XRAPI_ATTR XrResult XRAPI_CALL emu_get_bounding_box_2d(XrSession session, XrSpace space, XrRect2Df *rect) {
+static XRAPI_ATTR XrResult XRAPI_CALL scene_get_bounding_box_2d(XrSession session, XrSpace space, XrRect2Df *rect) {
     (void)session;
     int i = fake_space_index(space);
     if (i < 0 || !rect) return XR_ERROR_HANDLE_INVALID;
@@ -360,19 +426,29 @@ static XRAPI_ATTR XrResult XRAPI_CALL emu_get_bounding_box_2d(XrSession session,
     return XR_SUCCESS;
 }
 
-static XRAPI_ATTR XrResult XRAPI_CALL emu_get_bounding_box_3d(XrSession session, XrSpace space, XrRect3DfFB *box) {
-    (void)session; (void)space; (void)box;
-    return XR_ERROR_SPACE_COMPONENT_NOT_ENABLED_FB;
+static XRAPI_ATTR XrResult XRAPI_CALL scene_get_bounding_box_3d(XrSession session, XrSpace space, XrRect3DfFB *box) {
+    (void)session;
+    int i = fake_space_index(space);
+    if (i < 0 || !box) return XR_ERROR_HANDLE_INVALID;
+    if (!entities[i].has_bounds3) return XR_ERROR_SPACE_COMPONENT_NOT_ENABLED_FB;
+    *box = entities[i].bounds3;
+    return XR_SUCCESS;
 }
 
-static XRAPI_ATTR XrResult XRAPI_CALL emu_get_boundary_2d(XrSession session, XrSpace space, XrBoundary2DFB *boundary) {
+static XRAPI_ATTR XrResult XRAPI_CALL scene_get_boundary_2d(XrSession session, XrSpace space, XrBoundary2DFB *boundary) {
     (void)session;
     int i = fake_space_index(space);
     if (i < 0 || !boundary) return XR_ERROR_HANDLE_INVALID;
     if (!entities[i].has_bounds) return XR_ERROR_SPACE_COMPONENT_NOT_ENABLED_FB;
-    boundary->vertexCountOutput = 4;
+    uint32_t n = entities[i].boundary_count ? entities[i].boundary_count : 4;
+    boundary->vertexCountOutput = n;
     if (!boundary->vertexCapacityInput) return XR_SUCCESS;
-    if (boundary->vertexCapacityInput < 4) return XR_ERROR_SIZE_INSUFFICIENT;
+    if (boundary->vertexCapacityInput < n) return XR_ERROR_SIZE_INSUFFICIENT;
+    if (!boundary->vertices) return XR_ERROR_VALIDATION_FAILURE;
+    if (entities[i].boundary_count) {
+        memcpy(boundary->vertices, entities[i].boundary, n * sizeof(*boundary->vertices));
+        return XR_SUCCESS;
+    }
     const XrRect2Df b = entities[i].bounds;
     boundary->vertices[0] = (XrVector2f){b.offset.x, b.offset.y};
     boundary->vertices[1] = (XrVector2f){b.offset.x + b.extent.width, b.offset.y};
@@ -381,16 +457,76 @@ static XRAPI_ATTR XrResult XRAPI_CALL emu_get_boundary_2d(XrSession session, XrS
     return XR_SUCCESS;
 }
 
-static XRAPI_ATTR XrResult XRAPI_CALL emu_get_semantic_labels(XrSession session, XrSpace space, XrSemanticLabelsFB *labels) {
+static XRAPI_ATTR XrResult XRAPI_CALL scene_get_triangle_mesh(XrSpace space, const XrSpaceTriangleMeshGetInfoMETA *info,
+                                                          XrSpaceTriangleMeshMETA *mesh) {
+    (void)info;
+    int i = fake_space_index(space);
+    if (i < 0 || !mesh) return XR_ERROR_HANDLE_INVALID;
+    const scene_entity *e = &entities[i];
+    if (!e->vertex_count) return XR_ERROR_SPACE_COMPONENT_NOT_ENABLED_FB;
+    mesh->vertexCountOutput = e->vertex_count;
+    mesh->indexCountOutput = e->index_count;
+    if ((mesh->vertexCapacityInput && mesh->vertexCapacityInput < e->vertex_count) ||
+        (mesh->indexCapacityInput && mesh->indexCapacityInput < e->index_count)) return XR_ERROR_SIZE_INSUFFICIENT;
+    if ((mesh->vertexCapacityInput && !mesh->vertices) || (mesh->indexCapacityInput && !mesh->indices))
+        return XR_ERROR_VALIDATION_FAILURE;
+    if (mesh->vertexCapacityInput) memcpy(mesh->vertices, e->vertices, e->vertex_count * sizeof(*e->vertices));
+    if (mesh->indexCapacityInput) memcpy(mesh->indices, e->indices, e->index_count * sizeof(*e->indices));
+    return XR_SUCCESS;
+}
+
+// Labels as Meta's runtime hands them to an app (XR_FB_scene): an app that sends no XrSemanticLabelsSupportInfoFB
+// knows only the first label set; one that does gets "OTHER" for labels missing from its recognizedLabels, WALL_FACE
+// for invisible walls unless it accepts them, and DESK for TABLE unless it accepts that migration. Older Meta SDKs
+// (Demeter, 2026-10-16) rejected a whole scanned room over one INVISIBLE_WALL_FACE and kept asking for Space Setup.
+static const char *const scene_legacy_labels = "DESK,COUCH,FLOOR,CEILING,WALL_FACE,DOOR_FRAME,WINDOW_FRAME,OTHER";
+
+static int label_listed(const char *list, const char *label, size_t len) {
+    for (const char *p = list; p && *p;) {
+        const char *end = strchr(p, ',');
+        size_t n = end ? (size_t)(end - p) : strlen(p);
+        if (n == len && !strncmp(p, label, len)) return 1;
+        p = end ? end + 1 : NULL;
+    }
+    return 0;
+}
+
+static void scene_app_labels(const char *label, const XrSemanticLabelsFB *labels, char *out, size_t size) {
+    const XrSemanticLabelsSupportInfoFB *support = NULL;
+    for (const XrBaseInStructure *n = labels->next; n; n = n->next)
+        if (n->type == XR_TYPE_SEMANTIC_LABELS_SUPPORT_INFO_FB) support = (const XrSemanticLabelsSupportInfoFB *)n;
+    const char *known = support ? support->recognizedLabels : scene_legacy_labels;
+    XrSemanticLabelsSupportFlagsFB flags = support ? support->flags : 0;
+    out[0] = 0;
+    for (const char *p = label; *p;) {
+        const char *end = strchr(p, ',');
+        size_t len = end ? (size_t)(end - p) : strlen(p);
+        char one[64];
+        snprintf(one, sizeof(one), "%.*s", (int)len, p);
+        if (!strcmp(one, "INVISIBLE_WALL_FACE") && !(flags & XR_SEMANTIC_LABELS_SUPPORT_ACCEPT_INVISIBLE_WALL_FACE_BIT_FB))
+            snprintf(one, sizeof(one), "WALL_FACE");
+        if (!strcmp(one, "TABLE") && !(flags & XR_SEMANTIC_LABELS_SUPPORT_ACCEPT_DESK_TO_TABLE_MIGRATION_BIT_FB))
+            snprintf(one, sizeof(one), "DESK");
+        if (known && *known && !label_listed(known, one, strlen(one))) snprintf(one, sizeof(one), "OTHER");
+        if (!label_listed(out, one, strlen(one)))
+            snprintf(out + strlen(out), size - strlen(out), "%s%s", out[0] ? "," : "", one);
+        p = end ? end + 1 : p + len;
+    }
+}
+
+static XRAPI_ATTR XrResult XRAPI_CALL scene_get_semantic_labels(XrSession session, XrSpace space, XrSemanticLabelsFB *labels) {
     (void)session;
     int i = fake_space_index(space);
     if (i < 0 || !labels) return XR_ERROR_HANDLE_INVALID;
-    if (!entities[i].label) return XR_ERROR_SPACE_COMPONENT_NOT_ENABLED_FB;
-    uint32_t n = (uint32_t)strlen(entities[i].label) + 1;
+    if (!entities[i].label[0]) return XR_ERROR_SPACE_COMPONENT_NOT_ENABLED_FB;
+    char text[sizeof(entities[0].label)];
+    scene_app_labels(entities[i].label, labels, text, sizeof(text));
+    uint32_t n = (uint32_t)strlen(text) + 1;
     labels->bufferCountOutput = n;
     if (!labels->bufferCapacityInput) return XR_SUCCESS;
     if (labels->bufferCapacityInput < n) return XR_ERROR_SIZE_INSUFFICIENT;
-    memcpy(labels->buffer, entities[i].label, n);
+    if (!labels->buffer) return XR_ERROR_VALIDATION_FAILURE;
+    memcpy(labels->buffer, text, n);
     return XR_SUCCESS;
 }
 
@@ -401,11 +537,12 @@ static XRAPI_ATTR XrResult XRAPI_CALL emu_request_scene_capture(XrSession sessio
     pthread_mutex_lock(&scene_lock);
     scene_session = session;
     build_room();
+    if (!event_free()) { pthread_mutex_unlock(&scene_lock); return XR_ERROR_LIMIT_REACHED; }
     *request = next_request++;
     XrEventDataSceneCaptureCompleteFB e = {XR_TYPE_EVENT_DATA_SCENE_CAPTURE_COMPLETE_FB, NULL, *request, XR_SUCCESS};
     push_event(&e, sizeof(e));
+    LOG("scene: capture requested -> %s", room_from_file ? "scanned room" : "guardian box");
     pthread_mutex_unlock(&scene_lock);
-    LOG("scene: capture requested -> using guardian room");
     return XR_SUCCESS;
 }
 
@@ -417,9 +554,16 @@ static XRAPI_ATTR XrResult XRAPI_CALL emu_create_anchor(XrSession session, const
     build_room();
     XrPosef base = {{0, 0, 0, 1}, {0, 0, 0}};
     XrSpaceLocationFlags flags = 0;
-    stage_pose(info->space, info->time, &base, &flags);
+    if (event_free() < 1) { pthread_mutex_unlock(&scene_lock); return XR_ERROR_LIMIT_REACHED; }
+    if (!stage_pose(info->space, info->time, &base, &flags) ||
+        !(flags & XR_SPACE_LOCATION_POSITION_VALID_BIT) || !(flags & XR_SPACE_LOCATION_ORIENTATION_VALID_BIT)) {
+        pthread_mutex_unlock(&scene_lock); return XR_ERROR_POSE_INVALID;
+    }
+    XrUuidEXT uuid;
+    if (!anchor_uuid(&uuid)) { pthread_mutex_unlock(&scene_lock); return XR_ERROR_RUNTIME_FAILURE; }
     int i = add_entity(pose_mul(base, info->poseInSpace), NULL, 0, 0, 0, 1);
     *request = next_request++;
+    if (i >= 0) entities[i].uuid = uuid;
     XrEventDataSpatialAnchorCreateCompleteFB e = {XR_TYPE_EVENT_DATA_SPATIAL_ANCHOR_CREATE_COMPLETE_FB, NULL, *request,
         i >= 0 ? XR_SUCCESS : XR_ERROR_LIMIT_REACHED, i >= 0 ? entities[i].handle : XR_NULL_HANDLE,
         i >= 0 ? entities[i].uuid : (XrUuidEXT){{0}}};
@@ -431,28 +575,113 @@ static XRAPI_ATTR XrResult XRAPI_CALL emu_create_anchor(XrSession session, const
 static XRAPI_ATTR XrResult XRAPI_CALL emu_save_space(XrSession session, const XrSpaceSaveInfoFB *info, XrAsyncRequestIdFB *request) {
     (void)session;
     if (!info || !request) return XR_ERROR_VALIDATION_FAILURE;
-    int i = fake_space_index(info->space);
     pthread_mutex_lock(&scene_lock);
+    int i = fake_space_index(info->space);
+    if (i < 0) { pthread_mutex_unlock(&scene_lock); return XR_ERROR_HANDLE_INVALID; }
+    if (!event_free()) { pthread_mutex_unlock(&scene_lock); return XR_ERROR_LIMIT_REACHED; }
+    XrResult r = persist_spaces(1, &info->space, 0, NULL, 0);
     *request = next_request++;
-    XrEventDataSpaceSaveCompleteFB e = {XR_TYPE_EVENT_DATA_SPACE_SAVE_COMPLETE_FB, NULL, *request, XR_SUCCESS, info->space,
-                                        i >= 0 ? entities[i].uuid : (XrUuidEXT){{0}}, info->location};
+    XrEventDataSpaceSaveCompleteFB e = {XR_TYPE_EVENT_DATA_SPACE_SAVE_COMPLETE_FB, NULL, *request, r, info->space,
+                                        entities[i].uuid, info->location};
+    push_event(&e, sizeof(e));
+    pthread_mutex_unlock(&scene_lock);
+    return XR_SUCCESS;
+}
+static XRAPI_ATTR XrResult XRAPI_CALL emu_erase_space(XrSession session, const XrSpaceEraseInfoFB *info, XrAsyncRequestIdFB *request) {
+    (void)session;
+    if (!info || !request) return XR_ERROR_VALIDATION_FAILURE;
+    pthread_mutex_lock(&scene_lock);
+    int i = fake_space_index(info->space);
+    if (i < 0) { pthread_mutex_unlock(&scene_lock); return XR_ERROR_HANDLE_INVALID; }
+    if (!event_free()) { pthread_mutex_unlock(&scene_lock); return XR_ERROR_LIMIT_REACHED; }
+    XrResult r = persist_spaces(1, &info->space, 0, NULL, 1);
+    *request = next_request++;
+    XrEventDataSpaceEraseCompleteFB e = {XR_TYPE_EVENT_DATA_SPACE_ERASE_COMPLETE_FB, NULL, *request, r, info->space,
+                                         entities[i].uuid, info->location};
     push_event(&e, sizeof(e));
     pthread_mutex_unlock(&scene_lock);
     return XR_SUCCESS;
 }
 
-static XRAPI_ATTR XrResult XRAPI_CALL emu_erase_space(XrSession session, const XrSpaceEraseInfoFB *info, XrAsyncRequestIdFB *request) {
-    (void)session;
-    if (!info || !request) return XR_ERROR_VALIDATION_FAILURE;
-    int i = fake_space_index(info->space);
+// Reads share the mutation lock: engine worker threads may retrieve geometry while anchors are saved.
+static XRAPI_ATTR XrResult XRAPI_CALL emu_get_uuid(XrSpace space, XrUuidEXT *uuid) {
     pthread_mutex_lock(&scene_lock);
-    *request = next_request++;
-    XrEventDataSpaceEraseCompleteFB e = {XR_TYPE_EVENT_DATA_SPACE_ERASE_COMPLETE_FB, NULL, *request, XR_SUCCESS, info->space,
-                                         i >= 0 ? entities[i].uuid : (XrUuidEXT){{0}}, info->location};
-    push_event(&e, sizeof(e));
+    XrResult r = scene_get_uuid(space, uuid);
     pthread_mutex_unlock(&scene_lock);
-    return XR_SUCCESS;
+    return r;
 }
+static XRAPI_ATTR XrResult XRAPI_CALL emu_enumerate_components(XrSpace space, uint32_t capacity, uint32_t *count, XrSpaceComponentTypeFB *types) {
+    pthread_mutex_lock(&scene_lock);
+    XrResult r = scene_enumerate_components(space, capacity, count, types);
+    pthread_mutex_unlock(&scene_lock);
+    return r;
+}
+static XRAPI_ATTR XrResult XRAPI_CALL emu_get_component_status(XrSpace space, XrSpaceComponentTypeFB type, XrSpaceComponentStatusFB *status) {
+    pthread_mutex_lock(&scene_lock);
+    XrResult r = scene_get_component_status(space, type, status);
+    pthread_mutex_unlock(&scene_lock);
+    return r;
+}
+static XRAPI_ATTR XrResult XRAPI_CALL emu_get_container(XrSession session, XrSpace space, XrSpaceContainerFB *container) {
+    pthread_mutex_lock(&scene_lock);
+    XrResult r = scene_get_container(session, space, container);
+    pthread_mutex_unlock(&scene_lock);
+    return r;
+}
+static XRAPI_ATTR XrResult XRAPI_CALL emu_get_room_layout(XrSession session, XrSpace space, XrRoomLayoutFB *layout) {
+    pthread_mutex_lock(&scene_lock);
+    XrResult r = scene_get_room_layout(session, space, layout);
+    pthread_mutex_unlock(&scene_lock);
+    return r;
+}
+static XRAPI_ATTR XrResult XRAPI_CALL emu_get_bounding_box_2d(XrSession session, XrSpace space, XrRect2Df *rect) {
+    pthread_mutex_lock(&scene_lock);
+    XrResult r = scene_get_bounding_box_2d(session, space, rect);
+    pthread_mutex_unlock(&scene_lock);
+    return r;
+}
+static XRAPI_ATTR XrResult XRAPI_CALL emu_get_bounding_box_3d(XrSession session, XrSpace space, XrRect3DfFB *box) {
+    pthread_mutex_lock(&scene_lock);
+    XrResult r = scene_get_bounding_box_3d(session, space, box);
+    pthread_mutex_unlock(&scene_lock);
+    return r;
+}
+static XRAPI_ATTR XrResult XRAPI_CALL emu_get_boundary_2d(XrSession session, XrSpace space, XrBoundary2DFB *boundary) {
+    pthread_mutex_lock(&scene_lock);
+    XrResult r = scene_get_boundary_2d(session, space, boundary);
+    pthread_mutex_unlock(&scene_lock);
+    return r;
+}
+static XRAPI_ATTR XrResult XRAPI_CALL emu_get_triangle_mesh(XrSpace space, const XrSpaceTriangleMeshGetInfoMETA *info, XrSpaceTriangleMeshMETA *mesh) {
+    pthread_mutex_lock(&scene_lock);
+    XrResult r = scene_get_triangle_mesh(space, info, mesh);
+    pthread_mutex_unlock(&scene_lock);
+    return r;
+}
+static XRAPI_ATTR XrResult XRAPI_CALL emu_get_semantic_labels(XrSession session, XrSpace space, XrSemanticLabelsFB *labels) {
+    pthread_mutex_lock(&scene_lock);
+    XrResult r = scene_get_semantic_labels(session, space, labels);
+    pthread_mutex_unlock(&scene_lock);
+    return r;
+}
+
+// The app's STAGE bounds: the Frame reports a 1x1 m rect but OVRPlugin can't give its outline ("ovrpBoundary_Outer
+// is not supported"), so Unity games that trust a configured boundary index an empty array (Demeter's
+// RemoveObjectNotInGuardian). With an emulated room there is no play area for the app; build_room asks the runtime.
+static XRAPI_ATTR XrResult XRAPI_CALL emu_stage_bounds(XrSession session, XrReferenceSpaceType type, XrExtent2Df *bounds) {
+    if (type == XR_REFERENCE_SPACE_TYPE_STAGE) {
+        if (!bounds) return XR_ERROR_VALIDATION_FAILURE;
+        static int logged;
+        if (!logged++) LOG("scene: STAGE bounds hidden from the app (no play-area outline on this runtime)");
+        *bounds = (XrExtent2Df){0, 0};
+        return XR_SPACE_BOUNDS_UNAVAILABLE;
+    }
+    PFN_xrGetReferenceSpaceBoundsRect fn =
+        (PFN_xrGetReferenceSpaceBoundsRect)lookup(active_instance, "xrGetReferenceSpaceBoundsRect");
+    return fn ? fn(session, type, bounds) : XR_ERROR_FUNCTION_UNSUPPORTED;
+}
+
+#include "scene_meta.c"
 
 static PFN_xrVoidFunction scene_emulation(const char *name) {
     if (!emulate_scene) return NULL;
@@ -468,11 +697,17 @@ static PFN_xrVoidFunction scene_emulation(const char *name) {
         {"xrGetSpaceBoundingBox2DFB", (PFN_xrVoidFunction)emu_get_bounding_box_2d},
         {"xrGetSpaceBoundingBox3DFB", (PFN_xrVoidFunction)emu_get_bounding_box_3d},
         {"xrGetSpaceBoundary2DFB", (PFN_xrVoidFunction)emu_get_boundary_2d},
+        {"xrGetSpaceTriangleMeshMETA", (PFN_xrVoidFunction)emu_get_triangle_mesh},
         {"xrGetSpaceSemanticLabelsFB", (PFN_xrVoidFunction)emu_get_semantic_labels},
         {"xrRequestSceneCaptureFB", (PFN_xrVoidFunction)emu_request_scene_capture},
         {"xrCreateSpatialAnchorFB", (PFN_xrVoidFunction)emu_create_anchor},
         {"xrSaveSpaceFB", (PFN_xrVoidFunction)emu_save_space},
         {"xrEraseSpaceFB", (PFN_xrVoidFunction)emu_erase_space},
+        {"xrDiscoverSpacesMETA", (PFN_xrVoidFunction)emu_discover_spaces},
+        {"xrRetrieveSpaceDiscoveryResultsMETA", (PFN_xrVoidFunction)emu_retrieve_discovery},
+        {"xrSaveSpacesMETA", (PFN_xrVoidFunction)emu_save_spaces},
+        {"xrEraseSpacesMETA", (PFN_xrVoidFunction)emu_erase_spaces},
+        {"xrGetReferenceSpaceBoundsRect", (PFN_xrVoidFunction)emu_stage_bounds},
     };
     for (size_t i = 0; i < sizeof(table) / sizeof(table[0]); ++i)
         if (!strcmp(name, table[i].name)) return table[i].fn;
@@ -485,6 +720,16 @@ static void scene_on_create_session(XrSession session) {
     PFN_xrCreateReferenceSpace create = (PFN_xrCreateReferenceSpace)lookup(active_instance, "xrCreateReferenceSpace");
     XrReferenceSpaceCreateInfo ci = {XR_TYPE_REFERENCE_SPACE_CREATE_INFO, NULL, XR_REFERENCE_SPACE_TYPE_STAGE,
                                      {{0, 0, 0, 1}, {0, 0, 0}}};
+    pthread_mutex_lock(&scene_lock);
+    reset_room();
+    scene_generation = (scene_generation + 1) & 255;
+    event_head = event_tail = 0;
+    for (int i = 0; i < MAX_QUERIES; ++i) { free(queries[i].results); memset(&queries[i], 0, sizeof(queries[i])); }
+    query_next = 0;
     scene_session = session;
+    scene_stage = XR_NULL_HANDLE;
     if (create && XR_SUCCEEDED(create(session, &ci, &scene_stage))) LOG("scene: emulation active (anchored to STAGE)");
+    build_room();
+    load_anchors();
+    pthread_mutex_unlock(&scene_lock);
 }

native/adapter/scene_meta.c

@@ -0,0 +1,84 @@
+// SPDX-License-Identifier: GPL-3.0-only
+// Included by scene_emu.c, using the cached OpenXR registry declarations (no private ABI copies).
+static int meta_filter_matches(const XrSpaceDiscoveryInfoMETA *info, const scene_entity *e) {
+    for (uint32_t k = 0; k < info->filterCount; ++k) {
+        const XrSpaceFilterBaseHeaderMETA *f = info->filters[k];
+        if (!f) continue;
+        if (f->type == XR_TYPE_SPACE_FILTER_COMPONENT_META &&
+            !entity_has_component(e, ((const XrSpaceFilterComponentMETA *)f)->componentType)) return 0;
+        if (f->type == XR_TYPE_SPACE_FILTER_UUID_META) {
+            const XrSpaceFilterUuidMETA *u = (const XrSpaceFilterUuidMETA *)f;
+            if (!u->uuids || !uuid_matches(u->uuidCount, u->uuids, e)) return 0;
+        }
+    }
+    return 1;
+}
+static XRAPI_ATTR XrResult XRAPI_CALL emu_discover_spaces(XrSession session, const XrSpaceDiscoveryInfoMETA *info,
+                                                         XrAsyncRequestIdFB *request) {
+    if (!info || !request || (info->filterCount && !info->filters)) return XR_ERROR_VALIDATION_FAILURE;
+    pthread_mutex_lock(&scene_lock);
+    scene_session = session;
+    build_room();
+    if (event_free() < 2) { pthread_mutex_unlock(&scene_lock); return XR_ERROR_LIMIT_REACHED; }
+    scene_query *q = new_query();
+    if (!q) { pthread_mutex_unlock(&scene_lock); return XR_ERROR_OUT_OF_MEMORY; }
+    for (int i = 0; i < entity_count; ++i) {
+        scene_entity *e = &entities[i];
+        if (!e->erased && meta_filter_matches(info, e))
+            q->results[q->count++] = (XrSpaceQueryResultFB){e->handle, e->uuid};
+    }
+    *request = q->id;
+    XrEventDataSpaceDiscoveryResultsAvailableMETA avail = {XR_TYPE_EVENT_DATA_SPACE_DISCOVERY_RESULTS_AVAILABLE_META, NULL, *request};
+    XrEventDataSpaceDiscoveryCompleteMETA done = {XR_TYPE_EVENT_DATA_SPACE_DISCOVERY_COMPLETE_META, NULL, *request, XR_SUCCESS};
+    push_event(&avail, sizeof(avail)); push_event(&done, sizeof(done));
+    LOG("scene: discovery request=%llu results=%u", (unsigned long long)*request, q->count);
+    pthread_mutex_unlock(&scene_lock);
+    return XR_SUCCESS;
+}
+static XRAPI_ATTR XrResult XRAPI_CALL emu_retrieve_discovery(XrSession session, XrAsyncRequestIdFB request,
+                                                           XrSpaceDiscoveryResultsMETA *results) {
+    (void)session;
+    if (!results) return XR_ERROR_VALIDATION_FAILURE;
+    pthread_mutex_lock(&scene_lock);
+    scene_query *q = find_query(request);
+    XrResult r = XR_SUCCESS;
+    if (!q) r = XR_ERROR_VALIDATION_FAILURE;
+    else {
+        results->resultCountOutput = q->count;
+        if (results->resultCapacityInput && results->resultCapacityInput < q->count) r = XR_ERROR_SIZE_INSUFFICIENT;
+        else if (results->resultCapacityInput) {
+            if (!results->results) r = XR_ERROR_VALIDATION_FAILURE;
+            else for (uint32_t i = 0; i < q->count; ++i)
+                results->results[i] = (XrSpaceDiscoveryResultMETA){q->results[i].space, q->results[i].uuid};
+        }
+    }
+    pthread_mutex_unlock(&scene_lock);
+    return r;
+}
+static XRAPI_ATTR XrResult XRAPI_CALL emu_save_spaces(XrSession session, const XrSpacesSaveInfoMETA *info,
+                                                     XrAsyncRequestIdFB *request) {
+    (void)session;
+    if (!info || !request || !info->spaceCount || !info->spaces) return XR_ERROR_VALIDATION_FAILURE;
+    pthread_mutex_lock(&scene_lock);
+    if (!event_free()) { pthread_mutex_unlock(&scene_lock); return XR_ERROR_LIMIT_REACHED; }
+    XrResult r = persist_spaces(info->spaceCount, info->spaces, 0, NULL, 0);
+    *request = next_request++;
+    XrEventDataSpacesSaveResultMETA done = {XR_TYPE_EVENT_DATA_SPACES_SAVE_RESULT_META, NULL, *request, r};
+    push_event(&done, sizeof(done));
+    pthread_mutex_unlock(&scene_lock);
+    return XR_SUCCESS;
+}
+static XRAPI_ATTR XrResult XRAPI_CALL emu_erase_spaces(XrSession session, const XrSpacesEraseInfoMETA *info,
+                                                      XrAsyncRequestIdFB *request) {
+    (void)session;
+    if (!info || !request || (info->spaceCount && !info->spaces) || (info->uuidCount && !info->uuids))
+        return XR_ERROR_VALIDATION_FAILURE;
+    pthread_mutex_lock(&scene_lock);
+    if (!event_free()) { pthread_mutex_unlock(&scene_lock); return XR_ERROR_LIMIT_REACHED; }
+    XrResult r = persist_spaces(info->spaceCount, info->spaces, info->uuidCount, info->uuids, 1);
+    *request = next_request++;
+    XrEventDataSpacesEraseResultMETA done = {XR_TYPE_EVENT_DATA_SPACES_ERASE_RESULT_META, NULL, *request, r};
+    push_event(&done, sizeof(done));
+    pthread_mutex_unlock(&scene_lock);
+    return XR_SUCCESS;
+}

native/adapter/scene_room.c

@@ -0,0 +1,268 @@
+// SPDX-License-Identifier: GPL-3.0-only
+// Included by scene_emu.c. Bounded parsing keeps corrupt scan files from exhausting an Android game.
+#include <errno.h>
+#include <stdint.h>
+
+static int room_uuid(const char *s, XrUuidEXT *u) {
+    if (strlen(s) != 32) return 0;
+    for (int i = 0; i < 16; ++i) {
+        unsigned n = 0;
+        for (int k = 0; k < 2; ++k) {
+            char c = s[i * 2 + k];
+            if (c >= '0' && c <= '9') n = n * 16 + (unsigned)(c - '0');
+            else if (c >= 'a' && c <= 'f') n = n * 16 + (unsigned)(c - 'a' + 10);
+            else return 0;
+        }
+        u->data[i] = (uint8_t)n;
+    }
+    return 1;
+}
+static int room_float(const char *s, float *v) {
+    char *end;
+    errno = 0;
+    *v = strtof(s, &end);
+    return *s && !*end && !errno && isfinite(*v) && fabsf(*v) <= 100000;
+}
+static int room_uint(const char *s, uint64_t *v) {
+    char *end;
+    if (*s < '0' || *s > '9') return 0;
+    errno = 0;
+    *v = strtoull(s, &end, 10);
+    return !*end && !errno;
+}
+static int room_tokens(char *s, char **t, int cap) {
+    char *comment = strchr(s, '#');
+    if (comment) *comment = 0;
+    int n = 0;
+    char *save;
+    for (char *p = strtok_r(s, " \t\r\n", &save); p; p = strtok_r(NULL, " \t\r\n", &save)) {
+        if (n == cap) return -1;
+        t[n++] = p;
+    }
+    return n;
+}
+static int room_values(char **t, int start, int count, float *v) {
+    for (int i = 0; i < count; ++i) if (!room_float(t[start + i], &v[i])) return 0;
+    return 1;
+}
+static int room_path(char *out, size_t size, const char *name) {
+    const char *config = getenv("FRAMEBRIDGE_CONFIG");
+    if (!config || !*config || strchr(name, '/') || strchr(name, '\\') || !strcmp(name, "..")) return 0;
+    const char *slash = strrchr(config, '/');
+    int n = slash ? snprintf(out, size, "%.*s/%s", (int)(slash - config), config, name)
+                  : snprintf(out, size, "%s", name);
+    return n >= 0 && (size_t)n < size;
+}
+static uint32_t room_u32(const unsigned char *p) {
+    return (uint32_t)p[0] | (uint32_t)p[1] << 8 | (uint32_t)p[2] << 16 | (uint32_t)p[3] << 24;
+}
+static int room_mesh(scene_entity *e, const char *name, uint64_t nv, uint64_t ni) {
+    // At most 200k triangles and 16 MiB of payload; validate every index before publishing the mesh.
+    if (!nv || nv > 600000 || !ni || ni > 600000 || ni % 3 || nv * 12 + ni * 4 > 16 * 1024 * 1024) return 0;
+    char path[4096];
+    if (!room_path(path, sizeof(path), name)) return 0;
+    FILE *f = fopen(path, "rb");
+    if (!f) return 0;
+    unsigned char header[16], word[4];
+    int ok = fread(header, 1, 16, f) == 16 && !memcmp(header, "FPRM", 4) && room_u32(header + 4) == 1 &&
+             room_u32(header + 8) == nv && room_u32(header + 12) == ni;
+    XrVector3f *verts = ok ? malloc((size_t)nv * sizeof(*verts)) : NULL;
+    uint32_t *indices = ok ? malloc((size_t)ni * sizeof(*indices)) : NULL;
+    ok = ok && verts && indices;
+    for (uint64_t i = 0; ok && i < nv; ++i) {
+        float xyz[3];
+        for (int k = 0; ok && k < 3; ++k) {
+            ok = fread(word, 1, 4, f) == 4;
+            uint32_t bits = ok ? room_u32(word) : 0;
+            memcpy(&xyz[k], &bits, 4);
+            ok = ok && isfinite(xyz[k]) && fabsf(xyz[k]) <= 100000;
+        }
+        if (ok) verts[i] = (XrVector3f){xyz[0], xyz[1], xyz[2]};
+    }
+    for (uint64_t i = 0; ok && i < ni; ++i) {
+        ok = fread(word, 1, 4, f) == 4;
+        indices[i] = ok ? room_u32(word) : 0;
+        ok = ok && indices[i] < nv;
+    }
+    ok = ok && fgetc(f) == EOF && !ferror(f);
+    fclose(f);
+    if (!ok) { free(verts); free(indices); return 0; }
+    e->vertices = verts; e->indices = indices;
+    e->vertex_count = (uint32_t)nv; e->index_count = (uint32_t)ni;
+    return 1;
+}
+static int room_set_uuid(int i, XrUuidEXT uuid) {
+    for (int k = 0; k < entity_count; ++k)
+        if (k != i && uuid_equal(&entities[k].uuid, &uuid)) return 0;
+    entities[i].uuid = uuid;
+    return 1;
+}
+static int room_wall(XrUuidEXT uuid, const float *v, const char *label) {
+    float dx = v[2] - v[0], dz = v[3] - v[1], length = hypotf(dx, dz);
+    if (length < 0.001f || v[5] <= v[4]) return 0;
+    float angle = atan2f(-dz, dx) / 2;
+    int i = add_entity((XrPosef){{0, sinf(angle), 0, cosf(angle)},
+                       {(v[0] + v[2]) / 2, (v[4] + v[5]) / 2, (v[1] + v[3]) / 2}},
+                       label, length, v[5] - v[4], 0, 0);
+    if (i < 0) return 0;
+    if (!room_set_uuid(i, uuid)) { --entity_count; return 0; }
+    entities[i].is_wall = 1;
+    return 1;
+}
+static int room_outline(scene_entity *e, const XrVector2f *points, int n, float cx, float cz, int ceiling) {
+    e->boundary = malloc((size_t)n * sizeof(*e->boundary));
+    if (!e->boundary) return 0;
+    e->boundary_count = (uint32_t)n;
+    float xmin = INFINITY, ymin = INFINITY, xmax = -INFINITY, ymax = -INFINITY;
+    for (int i = 0; i < n; ++i) {
+        XrVector2f p = {points[i].x - cx, (points[i].y - cz) * (ceiling ? 1 : -1)};
+        e->boundary[i] = p;
+        xmin = fminf(xmin, p.x); xmax = fmaxf(xmax, p.x);
+        ymin = fminf(ymin, p.y); ymax = fmaxf(ymax, p.y);
+    }
+    e->has_bounds = 1;
+    e->bounds = (XrRect2Df){{xmin, ymin}, {xmax - xmin, ymax - ymin}};
+    return 1;
+}
+static int load_room_file(void) {
+    char path[4096];
+    if (!room_path(path, sizeof(path), "room.txt")) return 0;
+    FILE *f = fopen(path, "r");
+    if (!f) return 0;
+    // Long enough for a 1024-point outline. Reject whole overlong lines, never interpret their tails.
+    char *line = malloc(65536);
+    char **t = malloc((2 * MAX_OUTLINE + 4) * sizeof(*t));
+    if (!line || !t) { free(line); free(t); fclose(f); return 0; }
+    int ok = fgets(line, 65536, f) != NULL;
+    int n = ok ? room_tokens(line, t, 2 * MAX_OUTLINE + 4) : 0;
+    if (n != 2 || strcmp(t[0], "frameport-room") || strcmp(t[1], "1")) {
+        LOG("scene: bad room magic/version -> guardian box");
+        free(line); free(t); fclose(f); return 0;
+    }
+    const float s = 0.70710678f;
+    add_entity((XrPosef){{0, 0, 0, 1}, {0, 0, 0}}, NULL, 0, 0, 1, 0);
+    add_entity((XrPosef){{-s, 0, 0, s}, {0, 0, 0}}, "FLOOR", 0, 0, 0, 0);
+    add_entity((XrPosef){{s, 0, 0, s}, {0, 2.5f, 0}}, "CEILING", 0, 0, 0, 0);
+    XrVector2f outline[MAX_OUTLINE];
+    int outline_n = 0, ceiling_set = 0, volumes = 0, planes = 0, triangles = 0;
+    unsigned lineno = 1;
+    snprintf(room_source, sizeof(room_source), "manual");
+    while (fgets(line, 65536, f)) {
+        ++lineno;
+        if (!strchr(line, '\n') && !feof(f)) {
+            int c; while ((c = fgetc(f)) != EOF && c != '\n') {}
+            LOG("scene: bad room line %u (too long)", lineno); continue;
+        }
+        n = room_tokens(line, t, 2 * MAX_OUTLINE + 4);
+        if (!n) continue;
+        ok = n > 0;
+        float v[10]; XrUuidEXT uuid; uint64_t a, b;
+        if (n < 0) ok = 0;
+        else if (!strcmp(t[0], "source")) {
+            ok = n == 2 && (!strcmp(t[1], "scan") || !strcmp(t[1], "boundary") || !strcmp(t[1], "box") || !strcmp(t[1], "manual"));
+            if (ok) snprintf(room_source, sizeof(room_source), "%s", t[1]);
+        } else if (!strcmp(t[0], "universe")) {
+            ok = n == 2 && room_uint(t[1], &a);
+            if (ok) room_universe = a;
+        } else if (!strcmp(t[0], "room") || !strcmp(t[0], "floor") || !strcmp(t[0], "ceiling")) {
+            int i = !strcmp(t[0], "room") ? ENT_ROOM : !strcmp(t[0], "floor") ? ENT_FLOOR : ENT_CEILING;
+            ok = n == (i == ENT_ROOM ? 2 : 3) && room_uuid(t[1], &uuid) &&
+                 (i == ENT_ROOM || room_float(t[2], v)) && room_set_uuid(i, uuid);
+            if (ok && i != ENT_ROOM) entities[i].pose_in_stage.position.y = v[0];
+            if (ok && i == ENT_CEILING) ceiling_set = 1;
+        } else if (!strcmp(t[0], "outline")) {
+            ok = n >= 2 && room_uint(t[1], &a) && a >= 3 && a <= MAX_OUTLINE && n == 2 + 2 * (int)a;
+            XrVector2f parsed[MAX_OUTLINE];
+            for (uint64_t k = 0; ok && k < a; ++k) ok = room_float(t[2 + k * 2], &parsed[k].x) && room_float(t[3 + k * 2], &parsed[k].y);
+            if (ok) { memcpy(outline, parsed, (size_t)a * sizeof(*outline)); outline_n = (int)a; }
+        } else if (!strcmp(t[0], "wall")) {
+            // optional 8th field: WALL_FACE (default) or INVISIBLE_WALL_FACE for an edge the scanner closed itself
+            const char *label = n == 9 ? t[8] : "WALL_FACE";
+            ok = (n == 8 || (n == 9 && (!strcmp(label, "WALL_FACE") || !strcmp(label, "INVISIBLE_WALL_FACE")))) &&
+                 room_uuid(t[1], &uuid) && room_values(t, 2, 6, v) && room_wall(uuid, v, label);
+        } else if (!strcmp(t[0], "volume") || !strcmp(t[0], "plane")) {
+            int volume = !strcmp(t[0], "volume");
+            ok = n == (volume ? 10 : 12) && room_uuid(t[1], &uuid) && strlen(t[2]) < sizeof(entities[0].label) && room_values(t, 3, volume ? 7 : 9, v);
+            XrPosef pose = {{0, 0, 0, 1}, {0, 0, 0}};
+            float w = 0, h = 0;
+            if (ok && volume) {
+                float yaw = v[3] * 0.00872664626f;
+                pose = (XrPosef){quat_mul((XrQuaternionf){0, sinf(yaw), 0, cosf(yaw)}, (XrQuaternionf){-s, 0, 0, s}), {v[0], v[2], v[1]}};
+                w = v[4]; h = v[5]; ok = v[6] > 0;
+            } else if (ok) {
+                float norm = sqrtf(v[3]*v[3]+v[4]*v[4]+v[5]*v[5]+v[6]*v[6]);
+                ok = norm > 0.0001f;
+                if (ok) pose = (XrPosef){{v[3]/norm,v[4]/norm,v[5]/norm,v[6]/norm}, {v[0],v[1],v[2]}};
+                w = v[7]; h = v[8];
+            }
+            int i = ok && w > 0 && h > 0 ? add_entity(pose, t[2], w, h, 0, 0) : -1;
+            ok = i >= 0;
+            if (ok && !room_set_uuid(i, uuid)) { --entity_count; ok = 0; }
+            if (ok && volume) {
+                entities[i].has_bounds3 = 1;
+                entities[i].bounds3 = (XrRect3DfFB){{-w/2, -h/2, -v[6]}, {w, h, v[6]}};
+                ++volumes;
+            } else if (ok) ++planes;
+        } else if (!strcmp(t[0], "mesh")) {
+            if (!scene_app_mesh) continue;  // the app didn't enable XR_META_spatial_entity_mesh
+            ok = n == 5 && room_uuid(t[1], &uuid) && room_uint(t[3], &a) && room_uint(t[4], &b) && !triangles;
+            int i = ok ? add_entity((XrPosef){{0,0,0,1},{0,0,0}}, "GLOBAL_MESH", 0, 0, 0, 0) : -1;
+            ok = i >= 0 && room_set_uuid(i, uuid) && room_mesh(&entities[i], t[2], a, b);
+            if (ok) triangles = (int)b / 3;
+            else if (i >= 0) --entity_count;
+        }
+        if (!ok) LOG("scene: bad room line %u (skipped)", lineno);
+    }
+    ok = !ferror(f);
+    free(line); free(t); fclose(f);
+    // Layout walls must be contiguous and in file order, regardless of where other records occurred.
+    for (int i = ENT_WALL0; i < entity_count; ++i) if (entities[i].is_wall) {
+        scene_entity wall = entities[i];
+        memmove(&entities[ENT_WALL0 + wall_count + 1], &entities[ENT_WALL0 + wall_count],
+                (size_t)(i - ENT_WALL0 - wall_count) * sizeof(wall));
+        entities[ENT_WALL0 + wall_count++] = wall;
+    }
+    if (!outline_n && wall_count) {
+        float xmin = INFINITY, zmin = INFINITY, xmax = -INFINITY, zmax = -INFINITY;
+        for (int i = ENT_WALL0; i < ENT_WALL0 + wall_count; ++i) {
+            scene_entity *e = &entities[i];
+            XrVector3f d = quat_rotate(e->pose_in_stage.orientation, (XrVector3f){e->bounds.extent.width/2,0,0});
+            xmin = fminf(xmin, e->pose_in_stage.position.x - fabsf(d.x)); xmax = fmaxf(xmax, e->pose_in_stage.position.x + fabsf(d.x));
+            zmin = fminf(zmin, e->pose_in_stage.position.z - fabsf(d.z)); zmax = fmaxf(zmax, e->pose_in_stage.position.z + fabsf(d.z));
+        }
+        outline[0]=(XrVector2f){xmin,zmin}; outline[1]=(XrVector2f){xmax,zmin};
+        outline[2]=(XrVector2f){xmax,zmax}; outline[3]=(XrVector2f){xmin,zmax}; outline_n=4;
+    }
+    double area = 0, cx = 0, cz = 0;
+    for (int i = 0; i < outline_n; ++i) {
+        XrVector2f a = outline[i], b = outline[(i+1)%outline_n];
+        double cross = (double)a.x*b.y-(double)b.x*a.y;
+        area += cross; cx += (a.x+b.x)*cross; cz += (a.y+b.y)*cross;
+    }
+    if (!ok || outline_n < 3 || fabs(area) < 0.00001) { reset_room(); return 0; }
+    cx /= 3*area; cz /= 3*area;
+    if (!ceiling_set) entities[ENT_CEILING].pose_in_stage.position.y = entities[ENT_FLOOR].pose_in_stage.position.y + 2.5f;
+    for (int i = ENT_FLOOR; i <= ENT_CEILING; ++i) {
+        entities[i].pose_in_stage.position.x = (float)cx; entities[i].pose_in_stage.position.z = (float)cz;
+        if (!room_outline(&entities[i], outline, outline_n, (float)cx, (float)cz, i == ENT_CEILING)) { reset_room(); return 0; }
+    }
+    if (!wall_count) for (int i = 0; i < outline_n; ++i) {
+        XrVector2f a = outline[i], b = outline[(i+1)%outline_n];
+        float v[] = {a.x,a.y,b.x,b.y,entities[ENT_FLOOR].pose_in_stage.position.y,entities[ENT_CEILING].pose_in_stage.position.y};
+        if (!room_wall(make_uuid(entity_count), v, "WALL_FACE")) { reset_room(); return 0; }
+        ++wall_count;
+    }
+    // Move generated walls ahead of furniture as well.
+    if (wall_count && !entities[ENT_WALL0].is_wall) {
+        scene_entity *walls = malloc((size_t)wall_count * sizeof(*walls));
+        if (!walls) { reset_room(); return 0; }
+        memcpy(walls, &entities[entity_count-wall_count], (size_t)wall_count*sizeof(*walls));
+        memmove(&entities[ENT_WALL0+wall_count], &entities[ENT_WALL0], (size_t)(entity_count-wall_count-ENT_WALL0)*sizeof(*walls));
+        memcpy(&entities[ENT_WALL0], walls, (size_t)wall_count*sizeof(*walls)); free(walls);
+    }
+    for (int i = 0; i < entity_count; ++i) entities[i].handle = fake_space(i);
+    room_entity_count = entity_count; room_from_file = 1;
+    LOG("scene: room from %s file (%d walls, %d volumes, %d planes, %d mesh triangles, universe %llu)",
+        room_source, wall_count, volumes, planes, triangles, (unsigned long long)room_universe);
+    return 1;
+}

native/adapter/session_fixes.c

@@ -9,7 +9,6 @@
 //  * aim_pitch / aim_yaw / aim_forward: correct the aim pose of controllers (pointer rays) by a fixed offset;
 //  * refresh_rate: display refresh rate requested at session start (and instead of the app's own requests).
 #include "layer_math.h"
-#include "refresh_rate.h"
 
 static void emul_on_begin_session(const XrSessionBeginInfo *info);  // layer_emul_gl.c
 
@@ -297,8 +296,6 @@ static const char *const TOUCH_LEFT[] = {"input/x/click", "input/x/touch", "inpu
 static const char *const TOUCH_RIGHT[] = {"input/a/click", "input/a/touch", "input/b/click", "input/b/touch",
     "input/system/click"};
 static int app_suggested_touch;
-#include "profile_report.c"  // remapped_profile, current_profile_fix (xrGetCurrentInteractionProfile)
-#include "detached_controllers.c"  // detached controllers' paths on a runtime without them
 
 static int in_list(const char *s, const char *const *list, size_t n) {
     for (size_t i = 0; i < n; ++i)
@@ -331,70 +328,12 @@ static int touch_has(const char *path) {
 // rest touched; index (proximity_emul=2) = trigger touched. Only when the runtime lacks the extension itself.
 static XrAction thumb_proximity_action, trigger_proximity_action;
 
-// ---------------------------------------------------------------- duplicate action names (action_dedup)
-// OpenXR requires action names and localized names to be unique within an action set (XR_ERROR_NAME_DUPLICATED), but
-// the Frame's runtime accepts duplicates and then can't load the input manifest it builds from them: vrserver logs
-// "SetXrInputConfig failed. Failed to load manifest", drops the app's connection and treats it as exited, so the
-// headset goes back to the home environment while the game keeps running with sound (GitHub #323, Scared By Squares:
-// Unreal's OpenXR plugin creates "turn" twice, from an action mapping and an axis mapping of the same name). The
-// game only uses the handles, so a later duplicate is created under a free name ("turn_2", "Turn 2").
-#include "action_names.h"
-#define DEDUP_MAX 512
-static struct { XrActionSet set; char name[XR_MAX_ACTION_NAME_SIZE]; char localized[XR_MAX_LOCALIZED_ACTION_NAME_SIZE]; }
-    dedup_seen[DEDUP_MAX];
-static int dedup_count;
-static pthread_mutex_t dedup_lock = PTHREAD_MUTEX_INITIALIZER;
-
-static int dedup_taken(void *ctx, const char *name, const char *localized) {  // caller holds dedup_lock
-    XrActionSet set = *(XrActionSet *)ctx;
-    for (int i = 0; i < dedup_count; ++i)
-        if (dedup_seen[i].set == set && (!strcmp(dedup_seen[i].name, name) || !strcmp(dedup_seen[i].localized, localized)))
-            return 1;
-    return 0;
-}
-
-// Fills `out` (a copy of `info`) with free names when `info`'s are taken in `set`; 1 if it did.
-static int dedup_rename(XrActionSet set, const XrActionCreateInfo *info, XrActionCreateInfo *out,
-                        char name[XR_MAX_ACTION_NAME_SIZE], char localized[XR_MAX_LOCALIZED_ACTION_NAME_SIZE]) {
-    if (!action_unique_names(info->actionName, info->localizedActionName, dedup_taken, &set, name,
-                             XR_MAX_ACTION_NAME_SIZE, localized, XR_MAX_LOCALIZED_ACTION_NAME_SIZE))
-        return 0;
-    *out = *info;
-    memcpy(out->actionName, name, XR_MAX_ACTION_NAME_SIZE);
-    memcpy(out->localizedActionName, localized, XR_MAX_LOCALIZED_ACTION_NAME_SIZE);
-    return 1;
-}
-
-static void dedup_note(XrActionSet set, const XrActionCreateInfo *info) {  // caller holds dedup_lock
-    if (dedup_count >= DEDUP_MAX) return;
-    dedup_seen[dedup_count].set = set;
-    snprintf(dedup_seen[dedup_count].name, XR_MAX_ACTION_NAME_SIZE, "%s", info->actionName);
-    snprintf(dedup_seen[dedup_count].localized, XR_MAX_LOCALIZED_ACTION_NAME_SIZE, "%s", info->localizedActionName);
-    ++dedup_count;
-}
-
 static XRAPI_ATTR XrResult XRAPI_CALL hook_xrCreateAction(XrActionSet set, const XrActionCreateInfo *info,
         XrAction *action) {
     PFN_xrCreateAction fn = (PFN_xrCreateAction)lookup(active_instance, "xrCreateAction");
     if (!fn) return XR_ERROR_FUNCTION_UNSUPPORTED;
-    XrActionCreateInfo copy, renamed;
-    XrPath *kept = info && info->countSubactionPaths ? calloc(info->countSubactionPaths, sizeof(*kept)) : NULL;
-    const XrActionCreateInfo *use = detached_strip_action(info, &copy, kept);
-    char name[XR_MAX_ACTION_NAME_SIZE], localized[XR_MAX_LOCALIZED_ACTION_NAME_SIZE];
-    if (action_dedup && info) pthread_mutex_lock(&dedup_lock);
-    if (action_dedup && info && dedup_rename(set, use, &renamed, name, localized)) {
-        LOG("action_dedup: action \"%s\" (\"%s\") already exists in its set: created as \"%s\" (\"%s\")",
-            info->actionName, info->localizedActionName, name, localized);
-        use = &renamed;
-    }
-    XrResult r = fn(set, use, action);
-    if (action_dedup && info) {
-        if (XR_SUCCEEDED(r)) dedup_note(set, use);
-        pthread_mutex_unlock(&dedup_lock);
-    }
-    if (input_diag) diag_log_action(use, r);  // this hook replaces input_diag's wrapper of xrCreateAction
-    free(kept);
-    if (proximity_emul && XR_SUCCEEDED(r) && info && action) {  // OVRPlugin's action names
+    XrResult r = fn(set, info, action);
+    if (XR_SUCCEEDED(r) && info && action) {  // OVRPlugin's action names
         if (!strcmp(info->actionName, "hand_thumb_proximity")) thumb_proximity_action = *action;
         else if (!strcmp(info->actionName, "hand_trigger_proximity")) trigger_proximity_action = *action;
         else return r;
@@ -490,26 +429,11 @@ static XrResult remap_to_touch(XrInstance instance, PFN_xrSuggestInteractionProf
     return r;
 }
 
-static XrResult suggest_bindings(XrInstance instance, PFN_xrSuggestInteractionProfileBindings fn,
-                                 const XrInteractionProfileSuggestedBinding *suggested);
-
 static XRAPI_ATTR XrResult XRAPI_CALL hook_xrSuggestInteractionProfileBindings(XrInstance instance,
         const XrInteractionProfileSuggestedBinding *suggested) {
     PFN_xrSuggestInteractionProfileBindings fn =
         (PFN_xrSuggestInteractionProfileBindings)lookup(instance, "xrSuggestInteractionProfileBindings");
     if (!fn) return XR_ERROR_FUNCTION_UNSUPPORTED;
-    XrInteractionProfileSuggestedBinding copy;
-    XrActionSuggestedBinding *kept = suggested && suggested->countSuggestedBindings
-        ? calloc(suggested->countSuggestedBindings, sizeof(*kept)) : NULL;
-    const XrInteractionProfileSuggestedBinding *use = detached_strip_bindings(suggested, &copy, kept);
-    // a profile with only detached-controller bindings: nothing the runtime could bind
-    XrResult r = use != suggested && !use->countSuggestedBindings ? XR_SUCCESS : suggest_bindings(instance, fn, use);
-    free(kept);
-    return r;
-}
-
-static XrResult suggest_bindings(XrInstance instance, PFN_xrSuggestInteractionProfileBindings fn,
-                                 const XrInteractionProfileSuggestedBinding *suggested) {
     PFN_xrPathToString to_string = (PFN_xrPathToString)lookup(instance, "xrPathToString");
     if (suggested && to_string && (layer_debug || aim_correction_on()))
         for (uint32_t i = 0; i < suggested->countSuggestedBindings; ++i) {
@@ -532,7 +456,6 @@ static XrResult suggest_bindings(XrInstance instance, PFN_xrSuggestInteractionPr
     }
     if (r != XR_ERROR_PATH_UNSUPPORTED || app_suggested_touch || !IN(profile, NEWER_TOUCH)) return r;
     XrResult remapped = remap_to_touch(instance, fn, to_string, suggested, profile);
-    if (XR_SUCCEEDED(remapped)) snprintf(remapped_profile, sizeof(remapped_profile), "%s", profile);
     return XR_SUCCEEDED(remapped) ? XR_SUCCESS : r;
 }
 
@@ -629,26 +552,6 @@ static XRAPI_ATTR XrResult XRAPI_CALL hook_request_refresh_rate(XrSession sessio
     return XR_FAILED(result) && refresh_rate > 0 ? XR_SUCCESS : result;
 }
 
-// Always on: the Frame's runtime has no XR_FB_display_refresh_rate; OVRPort's dispatcher still offers the extension and
-// its xrGetDisplayRefreshRateFB then answers 0 Hz. idTech 4 VR ports (Team Beef's Doom3Quest engine: PreyVR, GitHub
-// #306) run their game clock at 1000 / refresh ms per tic: with 0 Hz the tic length is 0, the async thread spins and
-// the frame/GUI time never advances (main menu stuck at its first animation step: black, only the cursor). A rate the
-// runtime doesn't give is replaced by the one the frame timing shows (refresh_rate.h).
-static XRAPI_ATTR XrResult XRAPI_CALL hook_get_refresh_rate(XrSession session, float *rate) {
-    if (!rate) return XR_ERROR_VALIDATION_FAILURE;
-    PFN_xrGetDisplayRefreshRateFB fn = (PFN_xrGetDisplayRefreshRateFB)lookup(active_instance, "xrGetDisplayRefreshRateFB");
-    XrResult result = fn ? fn(session, rate) : XR_ERROR_FUNCTION_UNSUPPORTED;
-    if ((XR_SUCCEEDED(result) && *rate > 0.0f) || result == XR_ERROR_HANDLE_INVALID) return result;
-    float runtime = XR_SUCCEEDED(result) ? *rate : 0.0f;
-    *rate = fb_refresh_rate((int64_t)last_display_period, refresh_rate);
-    static int logs;
-    if (logs < 4) {
-        ++logs;
-        LOG("refresh rate: runtime reported %.1f Hz (result %d), reporting %.1f Hz", runtime, result, *rate);
-    }
-    return XR_SUCCESS;
-}
-
 static XRAPI_ATTR XrResult XRAPI_CALL hook_xrBeginSession(XrSession session, const XrSessionBeginInfo *info) {
     PFN_xrBeginSession fn = (PFN_xrBeginSession)lookup(active_instance, "xrBeginSession");
     if (!fn) return XR_ERROR_FUNCTION_UNSUPPORTED;

native/adapter/snapshot_gl.c

@@ -1,6 +1,6 @@
 // FramePort FrameBridge: eye-image snapshots for headless diagnostics (setting snapshot=<seconds>, GLES games only).
 // Every <seconds>, at xrEndFrame, the left-eye image the game just submitted (projection layer, view 0: its swapchain
-// image and array layer; without a projection layer the first quad/cylinder layer's) is read back on the game's own GL context and written at a quarter of its size as
+// image and array layer) is read back on the game's own GL context and written at a quarter of its size as
 // /sdcard/Android/data/<package>/files/fb_snap_<n>.ppm (n = 0-7, the oldest is overwritten). Nobody wears the headset
 // in a launch test, so the headset view stays black: this shows what the game itself draws (e.g. which screen it is
 // stuck on). The game's framebuffer, pack-buffer and pack-alignment bindings are restored afterwards.
@@ -118,27 +118,18 @@ static void snap_end_frame(const XrFrameEndInfo *info) {
     int64_t t = (int64_t)now.tv_sec * 1000000000ll + now.tv_nsec;
     if (t < next_ns) return;
     next_ns = t + (int64_t)snapshot * 1000000000ll;
-    // The projection layer's left eye; a frame without one (e.g. a menu shown only as a quad or cylinder layer) gives
-    // its first quad/cylinder layer's image instead.
-    const XrSwapchainSubImage *sub = NULL;
-    int type = 0;
-    for (uint32_t i = 0; i < info->layerCount && !sub; ++i)
+    const XrCompositionLayerProjection *proj = NULL;
+    for (uint32_t i = 0; i < info->layerCount && !proj; ++i)
         if (info->layers[i] && info->layers[i]->type == XR_TYPE_COMPOSITION_LAYER_PROJECTION &&
             ((const XrCompositionLayerProjection *)info->layers[i])->viewCount)
-            sub = &((const XrCompositionLayerProjection *)info->layers[i])->views[0].subImage, type = info->layers[i]->type;
-    for (uint32_t i = 0; i < info->layerCount && !sub; ++i) {
-        const XrCompositionLayerBaseHeader *layer = info->layers[i];
-        if (layer && layer->type == XR_TYPE_COMPOSITION_LAYER_QUAD)
-            sub = &((const XrCompositionLayerQuad *)layer)->subImage, type = layer->type;
-        else if (layer && layer->type == XR_TYPE_COMPOSITION_LAYER_CYLINDER_KHR)
-            sub = &((const XrCompositionLayerCylinderKHR *)layer)->subImage, type = layer->type;
-    }
-    if (!sub || !snap_load_gl()) return;
+            proj = (const XrCompositionLayerProjection *)info->layers[i];
+    if (!proj || !snap_load_gl()) return;
     if (!s_eglGetCurrentContext()) {
         static int logged;
         if (!logged++) LOG("snapshot: no GL context current in xrEndFrame, no snapshot");
         return;
     }
+    const XrSwapchainSubImage *sub = &proj->views[0].subImage;
     pthread_mutex_lock(&snap_lock);
     int i = snap_find(sub->swapchain, 0);
     GLuint tex = 0;
@@ -176,21 +167,6 @@ static void snap_end_frame(const XrFrameEndInfo *info) {
     s_glDeleteFramebuffers(1, &fb);
     while (s_glGetError() != GL_NO_ERROR) {}  // our calls must not leave errors for the game to find
     if (rgba) {
-        // brightness of the submitted area: tells a black image from a drawn one without fetching the file
-        uint64_t sum = 0, n = 0;
-        unsigned max = 0;
-        const XrRect2Di *r = &sub->imageRect;
-        for (int32_t y = r->offset.y; y < r->offset.y + r->extent.height; y += 4)
-            for (int32_t x = r->offset.x; x < r->offset.x + r->extent.width; x += 4) {
-                if (x < 0 || y < 0 || (uint32_t)x >= w || (uint32_t)y >= h) continue;
-                const unsigned char *p = rgba + ((size_t)y * w + (size_t)x) * 4;
-                unsigned v = p[0] > p[1] ? (p[0] > p[2] ? p[0] : p[2]) : (p[1] > p[2] ? p[1] : p[2]);
-                sum += v, ++n;
-                if (v > max) max = v;
-            }
-        LOG("snapshot: layer type=%d image %u array=%u rect=%d,%d %dx%d of %ux%u: mean %.1f max %u",
-            type, tex, sub->imageArrayIndex, r->offset.x, r->offset.y, r->extent.width, r->extent.height, w, h,
-            n ? (double)sum / (double)n : 0.0, max);
         snap_write(rgba, w, h, taken++ % 8);
         free(rgba);
     }

native/build.py

@@ -136,20 +136,18 @@ def build_adapter(tc: Path):
     src = HERE / "adapter"
     shader_tools = tc.parents[3] / "shader-tools" / tc.name
     suffix = ".exe" if os.name == "nt" else ""
-    for header, shaders in (("surface_composite", ("vert", "frag")), ("alpha_blend", ("vert", "frag"))):
-        names = " and ".join(f"{header}.{stage}" for stage in shaders)
-        sections = [f"// Generated from {names}.\n"]
-        for stage in shaders:
-            binary = CACHE / f"{header}_{stage}.spv"
-            run([shader_tools / ("glslc" + suffix), "--target-env=vulkan1.0", "-O",
-                 src / f"{header}.{stage}", "-o", binary])
-            run([shader_tools / ("spirv-val" + suffix), "--target-env", "vulkan1.0", binary])
-            data = binary.read_bytes()
-            words = struct.unpack(f"<{len(data)//4}I", data)
-            sections.append(f"static const uint32_t {header}_{stage}_spv[] = {{\n" +
-                            "\n".join("    " + ",".join(f"0x{v:08x}" for v in words[i:i+8]) + ","
-                                      for i in range(0, len(words), 8)) + "\n};\n")
-        (src / f"{header}_spv.h").write_text("".join(sections), encoding="utf-8")
+    sections = ["// Generated from surface_composite.vert and surface_composite.frag.\n"]
+    for stage in ("vert", "frag"):
+        binary = CACHE / f"surface_composite_{stage}.spv"
+        run([shader_tools / ("glslc" + suffix), "--target-env=vulkan1.0", "-O",
+             src / f"surface_composite.{stage}", "-o", binary])
+        run([shader_tools / ("spirv-val" + suffix), "--target-env", "vulkan1.0", binary])
+        data = binary.read_bytes()
+        words = struct.unpack(f"<{len(data)//4}I", data)
+        sections.append(f"static const uint32_t surface_composite_{stage}_spv[] = {{\n" +
+                        "\n".join("    " + ",".join(f"0x{v:08x}" for v in words[i:i+8]) + ","
+                                  for i in range(0, len(words), 8)) + "\n};\n")
+    (src / "surface_composite_spv.h").write_text("".join(sections), encoding="utf-8")
     run([sys.executable, src / "gen_forwarders.py"])
     inc = openxr_include("adapter")
     common = ["-shared", "-fPIC", "-O2", "-Wall", "-Wextra", "-Werror", "-Wno-gnu-conditional-omitted-operand",
@@ -201,6 +199,18 @@ def build_venc(tc: Path):
          f"-ffile-prefix-map={HERE}=native", "fp_venc.c", "convert.c", "sys.c", "-o", out / "fp_venc"], cwd=src)
 
 
+def build_roomscan(tc: Path):
+    """Offline room reconstruction (Linux aarch64). No libc, headers, generated tables or fetched dependencies."""
+    src = HERE / "roomscan"
+    out = ART / "linux-arm64-bin"
+    out.mkdir(parents=True, exist_ok=True)
+    run([tc / "bin/clang", "--target=aarch64-linux-gnu", "-ffreestanding", "-nostdlib", "-nostdlibinc", "-static",
+         "-fno-stack-protector", "-fno-builtin", "-ffp-contract=off", "-fno-math-errno", "-O2", "-Wall", "-Wextra", "-Werror",
+         "-fuse-ld=lld", "-Wl,--build-id=none", "-Wl,-z,max-page-size=65536", "-e", "_start",
+         f"-ffile-prefix-map={HERE}=native", "main.c", "fusion.c", "model.c", "mesh.c", "platform.c",
+         "-o", out / "fp_roomscan"], cwd=src)
+
+
 OCULUSHMD_IMPORTS = ("CreateEventW", "CreateJobObjectW", "AssignProcessToJobObject", "QueryInformationJobObject",
                      "CreateProcessW", "ResumeThread", "WaitForSingleObject", "GetExitCodeProcess", "CloseHandle",
                      "Sleep", "GetCommandLineW", "GetLastError", "GetStdHandle", "WriteFile", "ExitProcess")
@@ -440,7 +450,7 @@ def write_sums():
 
 def main():
     ap = argparse.ArgumentParser()
-    ap.add_argument("--only", default="adapter,bridge,compat,langpack,glshim,eglfmt,glmv,ovrtrace,dex,xrlayer,oculushmd,xrshim,vkshim,zinkfix,foveation,ovrpshim,tlskeys,luajit,vrsettings,venc,a32")
+    ap.add_argument("--only", default="adapter,bridge,compat,langpack,glshim,eglfmt,glmv,ovrtrace,dex,xrlayer,oculushmd,xrshim,vkshim,zinkfix,foveation,ovrpshim,tlskeys,luajit,vrsettings,venc,roomscan,a32")
     ap.add_argument("--ndk")
     args = ap.parse_args()
     parts = set(args.only.split(","))
@@ -456,9 +466,10 @@ def main():
              "ovrpshim": lambda: build_ovrpshim(tc), "tlskeys": lambda: build_tlskeys(tc),
              "luajit": lambda: build_luajit(tc),
              "vrsettings": lambda: build_vrsettings(tc), "venc": lambda: build_venc(tc),
+             "roomscan": lambda: build_roomscan(tc),
              "vroverlay_probe": lambda: build_vroverlay_probe(tc), "a32": lambda: build_a32(tc)}
     for name in ("adapter", "bridge", "compat", "langpack", "glshim", "eglfmt", "glmv", "ovrtrace", "xrshim", "vkshim", "zinkfix", "foveation", "ovrpshim", "tlskeys", "luajit", "dex", "xrlayer", "oculushmd", "vrsettings", "venc",
-                 "vroverlay_probe", "a32"):
+                 "roomscan", "vroverlay_probe", "a32"):
         if name in parts:
             log(f"build {name}")
             steps[name]()

native/glmv/glmv.c

@@ -16,8 +16,7 @@
 // block bindings and default-block uniform values (copied before every such draw), then the original is bound again.
 //
 // Logcat tag GLMV. Setting gl_mv_debug=1 (libframe_settings.so / framebridge.conf / FRAMEBRIDGE_CONFIG, as the GL
-// shim): glGetError after every twin draw, and per-5-s counters. gl_mv_debug=2 (trace) also checks every draw and
-// logs the state of the first draws of each 5 s window, failed texture uploads/copies and shader compiles.
+// shim): glGetError after every twin draw, and per-5-s counters.
 #define _GNU_SOURCE
 #include <EGL/egl.h>
 #include <GLES3/gl32.h>
@@ -112,27 +111,7 @@
     X(void, UniformMatrix2x4fv, (GLint, GLsizei, GLboolean, const GLfloat *)) \
     X(void, UniformMatrix4x2fv, (GLint, GLsizei, GLboolean, const GLfloat *)) \
     X(void, UniformMatrix3x4fv, (GLint, GLsizei, GLboolean, const GLfloat *)) \
-    X(void, UniformMatrix4x3fv, (GLint, GLsizei, GLboolean, const GLfloat *)) \
-    TRACE_LIST(X)
-
-// gl_mv_debug=2 (trace): the draw state and texture/shader calls behind black output
-#define TRACE_LIST(X) \
-    X(GLboolean, IsEnabled, (GLenum)) \
-    X(void, GetBooleanv, (GLenum, GLboolean *)) \
-    X(GLenum, CheckFramebufferStatus, (GLenum)) \
-    X(void, GetTexLevelParameteriv, (GLenum, GLint, GLenum, GLint *)) \
-    X(void, GetTexParameteriv, (GLenum, GLenum, GLint *)) \
-    X(void, Clear, (GLbitfield)) \
-    X(void, Viewport, (GLint, GLint, GLsizei, GLsizei)) \
-    X(void, TexImage2D, (GLenum, GLint, GLint, GLsizei, GLsizei, GLint, GLenum, GLenum, const void *)) \
-    X(void, TexSubImage2D, (GLenum, GLint, GLint, GLint, GLsizei, GLsizei, GLenum, GLenum, const void *)) \
-    X(void, CompressedTexImage2D, (GLenum, GLint, GLenum, GLsizei, GLsizei, GLint, GLsizei, const void *)) \
-    X(void, TexStorage2D, (GLenum, GLsizei, GLenum, GLsizei, GLsizei)) \
-    X(void, CopyTexImage2D, (GLenum, GLint, GLenum, GLint, GLint, GLsizei, GLsizei, GLint)) \
-    X(void, CopyTexSubImage2D, (GLenum, GLint, GLint, GLint, GLint, GLint, GLsizei, GLsizei)) \
-    X(void, GenerateMipmap, (GLenum)) \
-    X(void, BindTexture, (GLenum, GLuint)) \
-    X(void, TexParameteri, (GLenum, GLenum, GLint))
+    X(void, UniformMatrix4x3fv, (GLint, GLsizei, GLboolean, const GLfloat *))
 
 #define DECL(ret, name, args) static ret(*r_##name) args;
 REAL_LIST(DECL)
@@ -536,147 +515,6 @@ static void stats(void) {
     twin_draws = mv_draws = uniform_sets = 0;
 }
 
-// ---------------------------------------------------------------- trace (gl_mv_debug=2, diagnostics)
-// Every draw is checked with glGetError (this also consumes errors the game would read), counted per draw
-// framebuffer, and the first draws of every 5 s window are logged with the state that decides whether they write
-// anything: framebuffer status and views, program, viewport/scissor, colour/depth/stencil/blend state and the texture
-// on the active unit. Texture uploads, copies and shader compiles that fail are logged too.
-#define TRACE_DETAIL 12  // detailed draws per window
-#define TRACE_WINDOWS 40  // windows with detail
-#define NTFB 16
-struct tfb { GLint fb; unsigned long draws, errors, clears; };
-static int trace_detail, trace_windows;
-static unsigned long trace_draws, trace_errors, trace_clears;
-static GLenum trace_first_error;
-static struct tfb tfb[NTFB];
-static struct timespec trace_last;
-static pthread_mutex_t trace_lock = PTHREAD_MUTEX_INITIALIZER;
-
-static struct tfb *tfb_slot(GLint fb) {
-    for (int i = 0; i < NTFB; ++i)
-        if (tfb[i].fb == fb && (tfb[i].draws || tfb[i].clears)) return &tfb[i];
-    for (int i = 0; i < NTFB; ++i)
-        if (!tfb[i].draws && !tfb[i].clears) { tfb[i].fb = fb; return &tfb[i]; }
-    return NULL;
-}
-
-static void trace_window(void) {  // under trace_lock
-    struct timespec now;
-    clock_gettime(CLOCK_MONOTONIC, &now);
-    if (!trace_last.tv_sec) trace_last = now;
-    if (now.tv_sec - trace_last.tv_sec < 5) return;
-    trace_last = now;
-    char buf[700];
-    int n = 0;
-    for (int i = 0; i < NTFB && n < (int)sizeof(buf) - 60; ++i)
-        if (tfb[i].draws || tfb[i].clears)
-            n += snprintf(buf + n, sizeof(buf) - n, " fb%d:d%lu/e%lu/c%lu", tfb[i].fb, tfb[i].draws, tfb[i].errors,
-                          tfb[i].clears);
-    LOG("trace 5s: %lu draws, %lu with a GL error (first 0x%x), %lu clears;%s", trace_draws, trace_errors,
-        trace_first_error, trace_clears, n ? buf : " none");
-    {  // idTech 4 engines (Doom3Quest, PreyVR) export their clocks; GUI animations run on com_frameTime, so one that
-       // stands still leaves menus at their first step (PreyVR, GitHub #306: 0 Hz refresh rate -> 0 ms per tic)
-        static int *frame_time, *tic_number, *frame_number, looked;
-        if (!looked) {
-            looked = 1;
-            frame_time = dlsym(RTLD_DEFAULT, "com_frameTime");
-            tic_number = dlsym(RTLD_DEFAULT, "com_ticNumber");
-            frame_number = dlsym(RTLD_DEFAULT, "com_frameNumber");
-        }
-        if (frame_time && tic_number && frame_number)
-            LOG("trace clocks: com_frameTime=%d com_ticNumber=%d com_frameNumber=%d", *frame_time, *tic_number,
-                *frame_number);
-    }
-    memset(tfb, 0, sizeof(tfb));
-    trace_draws = trace_errors = trace_clears = 0;
-    trace_first_error = 0;
-    if (trace_windows < TRACE_WINDOWS) {
-        ++trace_windows;
-        trace_detail = 0;
-    }
-}
-
-static void trace_state(const char *what, GLenum mode, GLsizei count, GLenum err) {
-    GLint fb = 0, prog = 0, vp[4] = {0}, sc[4] = {0}, unit = 0, tex = 0, dfunc = 0, bsrc = 0, bdst = 0, bsrca = 0,
-          bdsta = 0, cullmode = 0;
-    GLboolean cmask[4] = {0}, dmask = 0;
-    r_GetIntegerv(GL_DRAW_FRAMEBUFFER_BINDING, &fb);
-    r_GetIntegerv(GL_CURRENT_PROGRAM, &prog);
-    r_GetIntegerv(GL_VIEWPORT, vp);
-    r_GetIntegerv(GL_SCISSOR_BOX, sc);
-    r_GetIntegerv(GL_ACTIVE_TEXTURE, &unit);
-    r_GetIntegerv(GL_DEPTH_FUNC, &dfunc);
-    r_GetIntegerv(GL_BLEND_SRC_RGB, &bsrc);
-    r_GetIntegerv(GL_BLEND_DST_RGB, &bdst);
-    r_GetIntegerv(GL_BLEND_SRC_ALPHA, &bsrca);
-    r_GetIntegerv(GL_BLEND_DST_ALPHA, &bdsta);
-    r_GetIntegerv(GL_CULL_FACE_MODE, &cullmode);
-    r_GetBooleanv(GL_COLOR_WRITEMASK, cmask);
-    r_GetBooleanv(GL_DEPTH_WRITEMASK, &dmask);
-    GLenum status = r_CheckFramebufferStatus(GL_DRAW_FRAMEBUFFER);
-    GLint linked = 0;
-    if (prog) r_GetProgramiv((GLuint)prog, GL_LINK_STATUS, &linked);
-    struct prog *p = prog ? find_prog((GLuint)prog, 0) : NULL;
-    r_GetIntegerv(GL_TEXTURE_BINDING_2D, &tex);  // (on the active unit)
-    GLint tw = 0, th = 0, tfmt = 0, minf = 0, maxl = 0, imm = 0;
-    if (tex) {
-        r_GetTexLevelParameteriv(GL_TEXTURE_2D, 0, GL_TEXTURE_WIDTH, &tw);
-        r_GetTexLevelParameteriv(GL_TEXTURE_2D, 0, GL_TEXTURE_HEIGHT, &th);
-        r_GetTexLevelParameteriv(GL_TEXTURE_2D, 0, GL_TEXTURE_INTERNAL_FORMAT, &tfmt);
-        r_GetTexParameteriv(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, &minf);
-        r_GetTexParameteriv(GL_TEXTURE_2D, GL_TEXTURE_MAX_LEVEL, &maxl);
-        r_GetTexParameteriv(GL_TEXTURE_2D, GL_TEXTURE_IMMUTABLE_LEVELS, &imm);
-    }
-    r_GetError();  // (the queries above must not count as the game's)
-    LOG("trace %s(mode=0x%x n=%d) err=0x%x fb=%d status=0x%x views=%d prog=%d linked=%d mv=%d vp=%d,%d %dx%d "
-        "scissor=%d %d,%d %dx%d cmask=%d%d%d%d blend=%d 0x%x/0x%x,0x%x/0x%x depth=%d f=0x%x w=%d stencil=%d cull=%d "
-        "0x%x unit=0x%x tex2d=%d %dx%d fmt=0x%x min=0x%x maxl=%d imm=%d",
-        what, mode, count, err, fb, status, draw_fb_views(), prog, linked, p ? p->multiview : -1, vp[0], vp[1], vp[2],
-        vp[3], r_IsEnabled(GL_SCISSOR_TEST), sc[0], sc[1], sc[2], sc[3], cmask[0], cmask[1], cmask[2], cmask[3],
-        r_IsEnabled(GL_BLEND), bsrc, bdst, bsrca, bdsta, r_IsEnabled(GL_DEPTH_TEST), dfunc, dmask,
-        r_IsEnabled(GL_STENCIL_TEST), r_IsEnabled(GL_CULL_FACE), cullmode, unit, tex, tw, th, tfmt, minf, maxl, imm);
-}
-
-static void trace_before(void) {
-    if (debug >= 2) r_GetError();
-}
-
-static void trace_after(const char *what, GLenum mode, GLsizei count) {
-    if (debug < 2) return;
-    GLenum err = r_GetError();
-    GLint fb = 0;
-    r_GetIntegerv(GL_DRAW_FRAMEBUFFER_BINDING, &fb);
-    int detail;
-    pthread_mutex_lock(&trace_lock);
-    ++trace_draws;
-    if (err) {
-        ++trace_errors;
-        if (!trace_first_error) trace_first_error = err;
-    }
-    struct tfb *e = tfb_slot(fb);
-    if (e) {
-        ++e->draws;
-        if (err) ++e->errors;
-    }
-    detail = trace_windows < TRACE_WINDOWS && trace_detail < TRACE_DETAIL;
-    if (detail) ++trace_detail;
-    trace_window();
-    pthread_mutex_unlock(&trace_lock);
-    if (detail) trace_state(what, mode, count, err);
-}
-
-static int trace_logs;
-#define TRACE_CALL(fmt, ...)                                                     \
-    do {                                                                         \
-        if (debug >= 2) {                                                        \
-            GLenum e_ = r_GetError();                                            \
-            if ((e_ || trace_logs < 40) && trace_logs < 400) {                   \
-                ++trace_logs;                                                    \
-                LOG("trace " fmt " err=0x%x", __VA_ARGS__, e_);                  \
-            }                                                                    \
-        }                                                                        \
-    } while (0)
-
 // Before a draw: bind the twin when the program is multiview and the framebuffer has no views. 1 = twin bound.
 static int begin_draw(void) {
     struct prog *p = cur_prog;
@@ -720,14 +558,6 @@ EXPORT void glLinkProgram(GLuint program) {
     INIT();
     note_program(program);
     r_LinkProgram(program);
-    if (debug >= 2) {
-        GLint ok = 0;
-        r_GetProgramiv(program, GL_LINK_STATUS, &ok);
-        char log[700] = {0};
-        r_GetProgramInfoLog(program, sizeof(log) - 1, NULL, log);
-        struct prog *p = find_prog(program, 0);
-        LOG("trace glLinkProgram(%u) ok=%d multiview=%d log: %s", program, ok, p ? p->multiview : -1, log);
-    }
 }
 
 EXPORT void glDeleteProgram(GLuint program) {
@@ -796,143 +626,43 @@ static void w_ftmsmv(GLenum target, GLenum attachment, GLuint texture, GLint lev
 #define DRAW(name, call)                \
     INIT();                             \
     if (!r_##name) return;              \
-    trace_before();                     \
     if (begin_draw()) {                 \
         r_##name call;                  \
         end_draw("gl" #name);           \
     } else {                            \
         r_##name call;                  \
-    }                                   \
-    trace_after("gl" #name, call_mode, call_count);
+    }
 
-EXPORT void glDrawArrays(GLenum mode, GLint first, GLsizei count) {
-    GLenum call_mode = mode; GLsizei call_count = count;
-    DRAW(DrawArrays, (mode, first, count))
-}
+EXPORT void glDrawArrays(GLenum mode, GLint first, GLsizei count) { DRAW(DrawArrays, (mode, first, count)) }
 EXPORT void glDrawElements(GLenum mode, GLsizei count, GLenum type, const void *indices) {
-    GLenum call_mode = mode; GLsizei call_count = count;
     DRAW(DrawElements, (mode, count, type, indices))
 }
 EXPORT void glDrawArraysInstanced(GLenum mode, GLint first, GLsizei count, GLsizei instances) {
-    GLenum call_mode = mode; GLsizei call_count = count;
     DRAW(DrawArraysInstanced, (mode, first, count, instances))
 }
 EXPORT void glDrawElementsInstanced(GLenum mode, GLsizei count, GLenum type, const void *indices, GLsizei instances) {
-    GLenum call_mode = mode; GLsizei call_count = count;
     DRAW(DrawElementsInstanced, (mode, count, type, indices, instances))
 }
 EXPORT void glDrawRangeElements(GLenum mode, GLuint start, GLuint end, GLsizei count, GLenum type,
                                 const void *indices) {
-    GLenum call_mode = mode; GLsizei call_count = count;
     DRAW(DrawRangeElements, (mode, start, end, count, type, indices))
 }
-EXPORT void glDrawArraysIndirect(GLenum mode, const void *indirect) {
-    GLenum call_mode = mode; GLsizei call_count = -1;
-    DRAW(DrawArraysIndirect, (mode, indirect))
-}
+EXPORT void glDrawArraysIndirect(GLenum mode, const void *indirect) { DRAW(DrawArraysIndirect, (mode, indirect)) }
 EXPORT void glDrawElementsIndirect(GLenum mode, GLenum type, const void *indirect) {
-    GLenum call_mode = mode; GLsizei call_count = -1;
     DRAW(DrawElementsIndirect, (mode, type, indirect))
 }
 EXPORT void glDrawElementsBaseVertex(GLenum mode, GLsizei count, GLenum type, const void *indices, GLint base) {
-    GLenum call_mode = mode; GLsizei call_count = count;
     DRAW(DrawElementsBaseVertex, (mode, count, type, indices, base))
 }
 EXPORT void glDrawRangeElementsBaseVertex(GLenum mode, GLuint start, GLuint end, GLsizei count, GLenum type,
                                           const void *indices, GLint base) {
-    GLenum call_mode = mode; GLsizei call_count = count;
     DRAW(DrawRangeElementsBaseVertex, (mode, start, end, count, type, indices, base))
 }
 EXPORT void glDrawElementsInstancedBaseVertex(GLenum mode, GLsizei count, GLenum type, const void *indices,
                                               GLsizei instances, GLint base) {
-    GLenum call_mode = mode; GLsizei call_count = count;
     DRAW(DrawElementsInstancedBaseVertex, (mode, count, type, indices, instances, base))
 }
 
-// ---------------------------------------------------------------- traced calls (pass-through unless gl_mv_debug=2)
-EXPORT void glClear(GLbitfield mask) {
-    INIT();
-    if (debug >= 2) r_GetError();
-    r_Clear(mask);
-    if (debug >= 2) {
-        GLenum err = r_GetError();
-        GLint fb = 0;
-        r_GetIntegerv(GL_DRAW_FRAMEBUFFER_BINDING, &fb);
-        pthread_mutex_lock(&trace_lock);
-        ++trace_clears;
-        struct tfb *e = tfb_slot(fb);
-        if (e) ++e->clears;
-        pthread_mutex_unlock(&trace_lock);
-        if (err) LOG("trace glClear(0x%x) fb=%d err=0x%x", mask, fb, err);
-    }
-}
-EXPORT void glTexImage2D(GLenum t, GLint l, GLint ifmt, GLsizei w, GLsizei h, GLint b, GLenum f, GLenum ty,
-                         const void *px) {
-    INIT();
-    if (debug >= 2) r_GetError();
-    r_TexImage2D(t, l, ifmt, w, h, b, f, ty, px);
-    GLint tex = 0;
-    if (debug >= 2) r_GetIntegerv(GL_TEXTURE_BINDING_2D, &tex);
-    TRACE_CALL("glTexImage2D(target=0x%x tex=%d level=%d ifmt=0x%x %dx%d fmt=0x%x type=0x%x data=%d)", t, tex, l, ifmt,
-               w, h, f, ty, px != NULL);
-}
-EXPORT void glTexSubImage2D(GLenum t, GLint l, GLint x, GLint y, GLsizei w, GLsizei h, GLenum f, GLenum ty,
-                            const void *px) {
-    INIT();
-    if (debug >= 2) r_GetError();
-    r_TexSubImage2D(t, l, x, y, w, h, f, ty, px);
-    TRACE_CALL("glTexSubImage2D(target=0x%x level=%d %d,%d %dx%d fmt=0x%x type=0x%x)", t, l, x, y, w, h, f, ty);
-}
-EXPORT void glCompressedTexImage2D(GLenum t, GLint l, GLenum ifmt, GLsizei w, GLsizei h, GLint b, GLsizei size,
-                                   const void *data) {
-    INIT();
-    if (debug >= 2) r_GetError();
-    r_CompressedTexImage2D(t, l, ifmt, w, h, b, size, data);
-    TRACE_CALL("glCompressedTexImage2D(target=0x%x level=%d ifmt=0x%x %dx%d size=%d)", t, l, ifmt, w, h, size);
-}
-EXPORT void glTexStorage2D(GLenum t, GLsizei levels, GLenum ifmt, GLsizei w, GLsizei h) {
-    INIT();
-    if (debug >= 2) r_GetError();
-    r_TexStorage2D(t, levels, ifmt, w, h);
-    TRACE_CALL("glTexStorage2D(target=0x%x levels=%d ifmt=0x%x %dx%d)", t, levels, ifmt, w, h);
-}
-EXPORT void glCopyTexImage2D(GLenum t, GLint l, GLenum ifmt, GLint x, GLint y, GLsizei w, GLsizei h, GLint b) {
-    INIT();
-    if (debug >= 2) r_GetError();
-    r_CopyTexImage2D(t, l, ifmt, x, y, w, h, b);
-    GLint rfb = 0;
-    if (debug >= 2) r_GetIntegerv(GL_READ_FRAMEBUFFER_BINDING, &rfb);
-    TRACE_CALL("glCopyTexImage2D(target=0x%x level=%d ifmt=0x%x %d,%d %dx%d read fb=%d)", t, l, ifmt, x, y, w, h, rfb);
-}
-EXPORT void glCopyTexSubImage2D(GLenum t, GLint l, GLint xo, GLint yo, GLint x, GLint y, GLsizei w, GLsizei h) {
-    INIT();
-    if (debug >= 2) r_GetError();
-    r_CopyTexSubImage2D(t, l, xo, yo, x, y, w, h);
-    GLint rfb = 0;
-    if (debug >= 2) r_GetIntegerv(GL_READ_FRAMEBUFFER_BINDING, &rfb);
-    TRACE_CALL("glCopyTexSubImage2D(target=0x%x level=%d %d,%d from %d,%d %dx%d read fb=%d)", t, l, xo, yo, x, y, w, h,
-               rfb);
-}
-EXPORT void glGenerateMipmap(GLenum t) {
-    INIT();
-    if (debug >= 2) r_GetError();
-    r_GenerateMipmap(t);
-    TRACE_CALL("glGenerateMipmap(target=0x%x)", t);
-}
-EXPORT void glCompileShader(GLuint sh) {
-    INIT();
-    r_CompileShader(sh);
-    if (debug < 2) return;
-    GLint ok = 0;
-    r_GetShaderiv(sh, GL_COMPILE_STATUS, &ok);
-    char log[700] = {0};
-    r_GetShaderInfoLog(sh, sizeof(log) - 1, NULL, log);
-    if (!ok || (log[0] && trace_logs < 400)) {
-        ++trace_logs;
-        LOG("trace glCompileShader(%u) ok=%d log: %s", sh, ok, log);
-    }
-}
-
 // A context made current on this thread (engines with a render thread move theirs between threads, e.g. Doom3Quest's
 // GLimp_ActivateContext): what this thread knew about the bound program and framebuffer may be another context's.
 EXPORT EGLBoolean eglMakeCurrent(EGLDisplay dpy, EGLSurface draw, EGLSurface read, EGLContext ctx) {
@@ -968,8 +698,7 @@ EXPORT __eglMustCastToProperFunctionPointerType eglGetProcAddress(const char *na
     OWN(glFramebufferTexture) OWN(glDrawBuffers) OWN(glDrawArrays) OWN(glDrawElements) OWN(glDrawArraysInstanced)
     OWN(glDrawElementsInstanced) OWN(glDrawRangeElements) OWN(glDrawArraysIndirect) OWN(glDrawElementsIndirect)
     OWN(glDrawElementsBaseVertex) OWN(glDrawRangeElementsBaseVertex) OWN(glDrawElementsInstancedBaseVertex)
-    OWN(eglMakeCurrent) OWN(glClear) OWN(glTexImage2D) OWN(glTexSubImage2D) OWN(glCompressedTexImage2D)
-    OWN(glTexStorage2D) OWN(glCopyTexImage2D) OWN(glCopyTexSubImage2D) OWN(glGenerateMipmap) OWN(glCompileShader)
+    OWN(eglMakeCurrent)
 #undef OWN
     return fn;
 }

native/roomscan/fusion.c

@@ -0,0 +1,325 @@
+/* SPDX-License-Identifier: GPL-3.0-only */
+#include "scan.h"
+
+#define MIN_TRIANGLE_TWICE_AREA 1e-8f
+#define MIN_RANGE .1f
+#define MAX_COORDINATE 10000.f
+#define QUATERNION_NORM_TOLERANCE .1f
+#define SAMPLE_SPACING_VOXELS .75f
+#define MAX_SURFEL_WEIGHT 10.f
+#define FEW_FRAMES 8
+#define MAX_GRID_XZ 8.f
+#define MAX_GRID_Y 4.f
+#define GRID_PADDING_VOXELS 5.f
+#define NORMAL_PATCH_SIZE 12
+#define MIN_PATCH_POINTS 24
+
+float root(float x)
+{
+    if (x <= 0) return 0;
+    /* -fno-math-errno makes this one hardware sqrt, with no libc/libm symbol on either build. */
+    return __builtin_sqrtf(x);
+}
+Vec unit(Vec p) { float n = root(dot(p,p)); return n > 1e-12f ? mul(p,1/n) : vec(0,0,0); }
+int flo(float x) { int i = (int)x; return x < (float)i ? i-1 : i; }
+float sine(float x)
+{
+    while (x > PI) x -= 2*PI;
+    while (x < -PI) x += 2*PI;
+    if (x > PI/2) x = PI-x;
+    if (x < -PI/2) x = -PI-x;
+    float q = x*x;
+    return x*(1-q/6+q*q/120-q*q*q/5040+q*q*q*q/362880);
+}
+float cosine(float x) { return sine(x+PI/2); }
+float angle(float y, float x)
+{
+    /* atan approximation, maximum error < .012 degrees. */
+    float a = mn(ab(x),ab(y)) / mx(mx(ab(x),ab(y)),1e-20f), q = a*a;
+    float r = a*(.999866f+q*(-.3302995f+q*(.180141f+q*(-.085133f+q*.0208351f))));
+    if (ab(y) > ab(x)) r = PI/2-r;
+    if (x < 0) r = PI-r;
+    return y < 0 ? -r : r;
+}
+int same(const char *a, const char *b)
+{
+    while (*a && *a == *b) a++,b++;
+    return *a == *b;
+}
+u32 random_next(Scan *s) { s->rng ^= s->rng<<13; s->rng ^= s->rng>>17; s->rng ^= s->rng<<5; return s->rng; }
+void warn(Scan *s, const char *m)
+{
+    for (int i = 0; i < s->nwarnings; i++) if (same(s->warnings[i],m)) return;
+    if (s->nwarnings < 24) s->warnings[s->nwarnings++] = m;
+}
+static u32 u32le(const u8 *p) { return (u32)p[0]|(u32)p[1]<<8|(u32)p[2]<<16|(u32)p[3]<<24; }
+static float f32le(const u8 *p) { union { u32 u; float f; } v = {u32le(p)}; return v.f; }
+/* 1 = complete, 0 = clean EOF, -1 = I/O error or partial record. */
+static int exact(int fd, void *p, usize n)
+{
+    usize done = 0;
+    while (done < n) {
+        long r = io_read(fd,(u8 *)p+done,n-done);
+        if (r < 0 || (!r && done)) return -1;
+        if (!r) return 0;
+        done += (usize)r;
+    }
+    return 1;
+}
+Vec grid_point(Scan *s, int x, int y, int z)
+{
+    return add(s->origin,vec(x*s->opt.voxel,y*s->opt.voxel,z*s->opt.voxel));
+}
+int cell_index(Scan *s, Vec p)
+{
+    Vec q = mul(sub(p,s->origin),1/s->opt.voxel);
+    int x = flo(q.x+.5f), y = flo(q.y+.5f), z = flo(q.z+.5f);
+    if (x < 0 || y < 0 || z < 0 || x >= s->nx || y >= s->ny || z >= s->nz) return -1;
+    return (y*s->nz+z)*s->nx+x;
+}
+static void sample(Scan *s, Vec p, Vec n, float w)
+{
+    int i = cell_index(s,p);
+    if (i < 0) { s->clipped++; return; }
+    Cell *c = &s->cells[i];
+    /* Cap repeated views' influence without throwing away later measurements. */
+    float scale = c->weight > MAX_SURFEL_WEIGHT ? MAX_SURFEL_WEIGHT/c->weight : 1;
+    c->p = add(mul(c->p,scale),mul(p,w));
+    c->n = add(mul(c->n,scale),mul(n,w));
+    c->weight = c->weight*scale+w;
+    if(c->last_frame!=s->fuse_frame) { c->last_frame=s->fuse_frame;c->views++; }
+}
+static void triangle(Scan *s, Vec a, Vec b, Vec c, Vec eye, Vec patch_normal, int fuse)
+{
+    Vec abv = sub(b,a), ac = sub(c,a), bc = sub(c,b);
+    float longest = root(mx(dot(abv,abv),mx(dot(ac,ac),dot(bc,bc))));
+    Vec p = mul(add(a,add(b,c)),1.f/3), n = cross(abv,ac);
+    float twice_area = root(dot(n,n));
+    Vec view = sub(eye,p);
+    float distance = root(dot(view,view));
+    if (twice_area < MIN_TRIANGLE_TWICE_AREA || longest > s->opt.max_edge || distance > s->opt.range || distance < MIN_RANGE) {
+        if (!fuse) s->rejected++;
+        return;
+    }
+    n = mul(n,1/twice_area);
+    if(dot(patch_normal,patch_normal)>.5f) n=patch_normal;
+    float facing = dot(n,view)/distance;
+    if (ab(facing) < s->opt.grazing) { if (!fuse) s->rejected++; return; }
+    if (facing < 0) n = mul(n,-1);
+    if (!fuse) {
+        s->accepted++;
+        s->seen++;
+        int slot = s->seen <= MAX_SAMPLES ? (int)s->seen-1 : (int)(random_next(s)%s->seen);
+        if (slot < MAX_SAMPLES) s->samples[slot] = p;
+        s->nsamples = (int)mn((float)s->seen,MAX_SAMPLES);
+    } else {
+        int steps = (int)(longest/(s->opt.voxel*SAMPLE_SPACING_VOXELS))+1;
+        float weight = twice_area*facing*facing / ((steps+1)*(steps+2)*.5f);
+        for (int j = 0; j <= steps; j++) for (int k = 0; k <= steps-j; k++) {
+            Vec q = add(a,add(mul(abv,(float)j/steps),mul(ac,(float)k/steps)));
+            sample(s,q,n,weight);
+        }
+    }
+}
+static Vec patch_normal(Vec *points, float *depths, int width, int x0, int y0, int x1, int y1,
+                        float tolerance)
+{
+    Vec mean=vec(0,0,0);int count=0;
+    /* Shift before accumulating the covariance: room positions can be large relative to patch residuals. */
+    Vec origin=points[y0*width+x0];
+    for(int y=y0;y<y1;y++) for(int x=x0;x<x1;x++) if(depths[y*width+x]>0) {
+        mean=add(mean,sub(points[y*width+x],origin));count++;
+    }
+    if(count<MIN_PATCH_POINTS) return vec(0,0,0);
+    mean=mul(mean,1.f/count);
+    float cov[3][3]={{0}},basis[3][3]={{1,0,0},{0,1,0},{0,0,1}};
+    for(int y=y0;y<y1;y++) for(int x=x0;x<x1;x++) if(depths[y*width+x]>0) {
+        Vec p=sub(sub(points[y*width+x],origin),mean);float a[3]={p.x,p.y,p.z};
+        for(int i=0;i<3;i++) for(int j=0;j<3;j++) cov[i][j]+=a[i]*a[j];
+    }
+    for(int sweep=0;sweep<8;sweep++) {
+        int p=0,q=1;
+        if(ab(cov[0][2])>ab(cov[p][q])) { p=0;q=2; }
+        if(ab(cov[1][2])>ab(cov[p][q])) { p=1;q=2; }
+        if(ab(cov[p][q])<1e-10f) break;
+        float phi=.5f*angle(2*cov[p][q],cov[q][q]-cov[p][p]),co=cosine(phi),si=sine(phi);
+        float aa=cov[p][p],bb=cov[q][q],abv=cov[p][q];
+        for(int k=0;k<3;k++) if(k!=p && k!=q) {
+            float a=cov[k][p],b=cov[k][q];
+            cov[k][p]=cov[p][k]=co*a-si*b;cov[k][q]=cov[q][k]=si*a+co*b;
+        }
+        cov[p][p]=co*co*aa-2*si*co*abv+si*si*bb;
+        cov[q][q]=si*si*aa+2*si*co*abv+co*co*bb;cov[p][q]=cov[q][p]=0;
+        for(int k=0;k<3;k++) {
+            float a=basis[k][p],b=basis[k][q];basis[k][p]=co*a-si*b;basis[k][q]=si*a+co*b;
+        }
+    }
+    int least=0;
+    for(int i=1;i<3;i++) if(cov[i][i]<cov[least][least]) least=i;
+    if(cov[least][least]/count>tolerance*tolerance) return vec(0,0,0);
+    return unit(vec(basis[0][least],basis[1][least],basis[2][least]));
+}
+static int grid_normals(Scan *s, Vec *points, float *depths, Vec *normals, u32 nv, u32 ni, const u8 *indices)
+{
+    if(ni<6 || u32le(indices)!=0 || u32le(indices+8)!=1) return 0;
+    u32 width=u32le(indices+4);
+    if(width<3 || width>nv || nv%width || ni!=6*(width-1)*(nv/width-1)) return 0;
+    /* Only a complete regular fan uses patch normals. Other meshes retain ordinary triangle normals. */
+    u32 at=0;
+    for(u32 row=0;row+1<nv/width;row++) for(u32 col=0;col+1<width;col++) {
+        u32 a=row*width+col,expected[6]={a,a+width,a+1,a+1,a+width,a+width+1};
+        for(int k=0;k<6;k++) if(u32le(indices+4*at++)!=expected[k]) return 0;
+    }
+    int height=(int)(nv/width);
+    for(int y=0;y<height;y+=NORMAL_PATCH_SIZE) for(int x=0;x<(int)width;x+=NORMAL_PATCH_SIZE) {
+        int x1=(int)mn(x+NORMAL_PATCH_SIZE,(float)width),y1=(int)mn(y+NORMAL_PATCH_SIZE,height);
+        Vec n=patch_normal(points,depths,(int)width,x,y,x1,y1,s->opt.patch_residual);
+        for(int yy=y;yy<y1;yy++) for(int xx=x;xx<x1;xx++) normals[yy*width+xx]=n;
+    }
+    return 1;
+}
+const char *read_dump(Scan *s, int fuse)
+{
+    int fd = io_open(s->opt.input,0);
+    if (fd < 0) return "cannot open scan dump";
+    u8 header[44];
+    const char *error = 0;
+    Vec *vertices = 0,*normals=0;
+    float *depths = 0;
+    u8 *indices = 0;
+    usize vs = 0, is = 0, ds = 0;
+    if (exact(fd,header,8) != 1 || header[0]!='F' || header[1]!='P' || header[2]!='R' || header[3]!='S' ||
+        u32le(header+4) != 1) { error = "invalid FPRS header"; goto done; }
+    unsigned frames = 0;
+    for (;;) {
+        int r = exact(fd,header,44);
+        if (r == 0) break;
+        if (r < 0) { error = "truncated frame header"; break; }
+        /* Tracking can start before poses are available. Consume the entire bounded record before skipping,
+         * so one NaN cannot hide a truncated payload or desynchronize the next frame. */
+        int invalid=(u32le(header+4)&0x7ff00000u) == 0x7ff00000u;
+        float pose[7];
+        for (int i = 0; i < 7; i++) {
+            pose[i] = f32le(header+8+i*4);
+            if (!finite(pose[i]) || ab(pose[i]) > MAX_COORDINATE) invalid=1;
+        }
+        float norm = 0;
+        for (int i = 3; i < 7; i++) norm += pose[i]*pose[i];
+        if (!finite(norm) || ab(norm-1) > QUATERNION_NORM_TOLERANCE) invalid=1;
+        if(!invalid) for (int i = 3; i < 7; i++) pose[i] /= root(norm);
+        u32 nv = u32le(header+36), ni = u32le(header+40);
+        if (nv > MAX_FRAME_VERTICES || ni > MAX_FRAME_INDICES || ni%3 || (!nv && ni)) {
+            error = "invalid frame counts"; break;
+        }
+        usize needv = (usize)nv*12, needi = (usize)ni*4;
+        if (needv > vs) {
+            io_free(vertices,vs);io_free(normals,vs);vs=needv;vertices=io_alloc(vs);normals=io_alloc(vs);
+        }
+        if (needi > is) { io_free(indices,is); is=needi; indices=io_alloc(is); }
+        if((usize)nv*4>ds) { io_free(depths,ds);ds=(usize)nv*4;depths=io_alloc(ds); }
+        if ((nv && (!vertices || !depths || !normals)) || (ni && !indices)) { error = "frame allocation failed"; break; }
+        if ((needv && exact(fd,vertices,needv)!=1) || (needi && exact(fd,indices,needi)!=1)) {
+            error = "truncated frame data"; break;
+        }
+        Vec eye = vec(pose[0],pose[1],pose[2]), q = vec(pose[3],pose[4],pose[5]);
+        u64 far=0;
+        for (u32 i = 0; i < nv; i++) {
+            u8 *p = (u8 *)&vertices[i];
+            Vec v = vec(f32le(p),f32le(p+4),f32le(p+8));
+            if (!finite(v.x) || !finite(v.y) || !finite(v.z) ||
+                ab(v.x)>MAX_COORDINATE || ab(v.y)>MAX_COORDINATE || ab(v.z)>MAX_COORDINATE) {
+                invalid=1;break;
+            }
+            depths[i]=root(dot(v,v));
+            if(depths[i]>s->opt.range || depths[i]<MIN_RANGE) { depths[i]=-1;far++;continue; }
+            Vec t = mul(cross(q,v),2);
+            vertices[i] = add(eye,add(v,add(mul(t,pose[6]),cross(q,t))));
+        }
+        int regular=!invalid && grid_normals(s,vertices,depths,normals,nv,ni,indices);
+        /* Structural errors are fatal even in a frame whose tracking/depth is unusable. */
+        s->fuse_frame=frames+1;
+        for (u32 i = 0; i < ni; i+=3) {
+            u32 a=u32le(indices+4*i), b=u32le(indices+4*(i+1)), c=u32le(indices+4*(i+2));
+            if (a>=nv || b>=nv || c>=nv) { error = "index outside vertex array"; break; }
+            if(invalid) continue;
+            if(depths[a]<0 || depths[b]<0 || depths[c]<0) { if(!fuse) s->rejected++;continue; }
+            float near=mn(depths[a],mn(depths[b],depths[c])),far_depth=mx(depths[a],mx(depths[b],depths[c]));
+            if(far_depth-near>s->opt.depth_jump+s->opt.depth_ratio*near) {
+                if(!fuse) { s->rejected++;s->discontinuities++; }continue;
+            }
+            Vec normal=regular ? normals[a] : vec(0,0,0);
+            if(regular && dot(normal,normal)<.5f) { if(!fuse) s->rejected++;continue; }
+            triangle(s,vertices[a],vertices[b],vertices[c],eye,normal,fuse);
+        }
+        if (error) break;
+        if(!fuse) { if(invalid) s->skipped_frames++;else s->far_vertices+=far; }
+        frames++;
+    }
+    if (!error && !frames) error = "scan contains no frames";
+    if (!error && !fuse) s->frames = frames;
+done:
+    io_free(vertices,vs);
+    io_free(normals,vs);
+    io_free(indices,is);
+    io_free(depths,ds);
+    io_close(fd);
+    return error;
+}
+static float median(Scan *s, int axis)
+{
+    /* In-place quickselect on the bounded reservoir; no dump-sized allocations. */
+    int lo=0, hi=s->nsamples-1, mid=s->nsamples/2;
+    while (lo < hi) {
+        float pivot = ((float *)&s->samples[(lo+hi)/2])[axis];
+        int i=lo,j=hi;
+        while (i<=j) {
+            while (((float *)&s->samples[i])[axis] < pivot) i++;
+            while (((float *)&s->samples[j])[axis] > pivot) j--;
+            if (i<=j) { Vec t=s->samples[i]; s->samples[i++]=s->samples[j]; s->samples[j--]=t; }
+        }
+        if (mid<=j) hi=j;
+        else if (mid>=i) lo=i;
+        else break;
+    }
+    return ((float *)&s->samples[mid])[axis];
+}
+const char *init_grid(Scan *s)
+{
+    if (!s->nsamples) return "scan contains no usable triangles";
+    float x=median(s,0), y=median(s,1), z=median(s,2), v=s->opt.voxel;
+    Vec low=s->samples[0],high=low;
+    for(int i=1;i<s->nsamples;i++) {
+        Vec p=s->samples[i];
+        low=vec(mn(low.x,p.x),mn(low.y,p.y),mn(low.z,p.z));
+        high=vec(mx(high.x,p.x),mx(high.y,p.y),mx(high.z,p.z));
+    }
+    float pad=v*mx(GRID_PADDING_VOXELS,s->opt.truncation+2);
+    low=sub(low,vec(pad,pad,pad));high=add(high,vec(pad,pad,pad));
+    s->origin=vec(mx(flo(low.x/v)*v,flo((x-MAX_GRID_XZ/2)/v)*v),
+                  mx(flo(low.y/v)*v,flo((y-MAX_GRID_Y/2)/v)*v),
+                  mx(flo(low.z/v)*v,flo((z-MAX_GRID_XZ/2)/v)*v));
+    s->nx=(int)mn(-flo(-(high.x-s->origin.x)/v)+1,(int)(MAX_GRID_XZ/v)+1);
+    s->ny=(int)mn(-flo(-(high.y-s->origin.y)/v)+1,(int)(MAX_GRID_Y/v)+1);
+    s->nz=(int)mn(-flo(-(high.z-s->origin.z)/v)+1,(int)(MAX_GRID_XZ/v)+1);
+    usize count = (usize)s->nx*s->ny*s->nz;
+    if (count > MAX_CELLS) return "voxel grid exceeds memory budget; increase --voxel";
+    s->count = (int)count;
+    s->cells = io_alloc(count*sizeof(Cell));
+    return s->cells ? 0 : "grid allocation failed";
+}
+void finish_fusion(Scan *s)
+{
+    /* A short look-around cannot expose each surface in many frames. Cap the target at ten percent of usable
+     * views (at least one); long recordings still require repeated evidence rather than transient depth. */
+    unsigned required=(unsigned)mn(s->opt.min_views,mx(1,(s->frames-s->skipped_frames)/10.f));
+    for (int i=0; i<s->count; i++) {
+        Cell *c=&s->cells[i];
+        if(c->views<required) { c->weight=0;continue; }
+        if (c->weight) { c->p=mul(c->p,1/c->weight); c->n=unit(c->n); }
+    }
+    if (s->clipped) warn(s,"scan clipped to 8 x 8 x 4 metre grid");
+    if (s->frames < FEW_FRAMES) warn(s,"few frames; scan more viewpoints");
+    if(s->skipped_frames) warn(s,"non-finite or invalid frames skipped");
+    if(s->far_vertices) warn(s,"out-of-range depth vertices skipped");
+    if (s->accepted < s->rejected) warn(s,"many triangles rejected; check depth quality");
+}

native/roomscan/main.c

@@ -0,0 +1,227 @@
+/* SPDX-License-Identifier: GPL-3.0-only */
+#include "scan.h"
+
+typedef struct { char data[65536]; usize n; int ok; } Text;
+static void text(Text *t, const char *p)
+{
+    while(*p) {
+        if(t->n>=sizeof(t->data)) { t->ok=0;return; }
+        t->data[t->n++]=*p++;
+    }
+}
+static void integer(Text *t, u64 value)
+{
+    char rev[24];int n=0;
+    do { rev[n++]=(char)('0'+value%10);value/=10; } while(value);
+    while(n) { char a[2]={rev[--n],0};text(t,a); }
+}
+static void decimal(Text *t, float value)
+{
+    if(value<0) { text(t,"-");value=-value; }
+    u64 scaled=(u64)(value*10000.f+.5f);
+    integer(t,scaled/10000);text(t,".");
+    u64 fraction=scaled%10000;
+    if(fraction<1000) text(t,"0");
+    if(fraction<100) text(t,"0");
+    if(fraction<10) text(t,"0");
+    integer(t,fraction);
+}
+static void space_number(Text *t, float n) { text(t," ");decimal(t,n); }
+static int uuid(Text *t)
+{
+    u8 bytes[16];if(!io_random(bytes,sizeof(bytes))) return 0;
+    bytes[6]=(bytes[6]&15)|64;bytes[8]=(bytes[8]&63)|128;
+    const char *hex="0123456789abcdef";
+    for(int i=0;i<16;i++) { char pair[3]={hex[bytes[i]>>4],hex[bytes[i]&15],0};text(t,pair); }
+    return 1;
+}
+static int record(Text *t, const char *name)
+{
+    text(t,name);text(t," ");return uuid(t);
+}
+static int path(char *out, const char *dir, const char *name)
+{
+    usize n=0;
+    while(*dir) { if(n>=3900) return 0;out[n++]=*dir++; }
+    if(n && out[n-1]!='/') out[n++]='/';
+    while(*name) { if(n>=4095) return 0;out[n++]=*name++; }
+    out[n]=0;return 1;
+}
+static void le32(u8 *out,u32 v) { for(int i=0;i<4;i++) out[i]=(u8)(v>>(8*i)); }
+static const char *write_files(Scan *s)
+{
+    Text t={.ok=1};text(&t,"frameport-room 1\nuniverse ");integer(&t,s->opt.universe);
+    text(&t,"\nsource scan\ntime ");integer(&t,(u64)(io_time(0)/1000000000));text(&t,"\n");
+    if(!record(&t,"room")) return "getrandom failed";
+    text(&t,"\n");if(!record(&t,"floor")) return "getrandom failed";
+    space_number(&t,s->floor);text(&t,"\n");if(!record(&t,"ceiling")) return "getrandom failed";
+    space_number(&t,s->ceiling);text(&t,"\noutline ");integer(&t,(u64)s->noutline);
+    for(int i=0;i<s->noutline;i++) { space_number(&t,s->outline[i].x);space_number(&t,s->outline[i].z); }
+    text(&t,"\n");
+    for(int i=0;i<s->noutline;i++) {
+        Pt a=s->outline[i],b=s->outline[(i+1)%s->noutline];
+        if(!record(&t,"wall")) return "getrandom failed";
+        space_number(&t,a.x);space_number(&t,a.z);space_number(&t,b.x);space_number(&t,b.z);
+        space_number(&t,s->floor);space_number(&t,s->ceiling);
+        if(s->invisible[i]) text(&t," INVISIBLE_WALL_FACE");
+        text(&t,"\n");
+    }
+    for(int i=0;i<s->nvolumes;i++) {
+        Volume *v=&s->volumes[i];
+        if(!record(&t,"volume")) return "getrandom failed";
+        text(&t," ");text(&t,v->label);space_number(&t,v->p.x);space_number(&t,v->p.z);
+        space_number(&t,v->p.y);space_number(&t,v->yaw);space_number(&t,v->w);space_number(&t,v->d);space_number(&t,v->h);
+        text(&t,"\n");
+    }
+    if(!record(&t,"mesh")) return "getrandom failed";
+    text(&t," room-mesh.bin ");integer(&t,(u64)s->nv);text(&t," ");integer(&t,(u64)s->ni);text(&t,"\n");
+    if(!t.ok) return "room text exceeds output budget";
+    Text rname={.ok=1},mname={.ok=1};
+    text(&rname,"room.txt.");text(&mname,"room-mesh.bin.");
+    if(!uuid(&rname) || !uuid(&mname)) return "getrandom failed";
+    text(&rname,".tmp");text(&mname,".tmp");rname.data[rname.n]=0;mname.data[mname.n]=0;
+    char room[4096],mesh[4096],rtmp[4096],mtmp[4096];
+    if(!path(room,s->opt.out,"room.txt") || !path(mesh,s->opt.out,"room-mesh.bin") ||
+       !path(rtmp,s->opt.out,rname.data) || !path(mtmp,s->opt.out,mname.data)) return "output path too long";
+    if(!io_mkdir(s->opt.out)) return "cannot create output directory";
+    int fd=io_open(rtmp,1),ok;
+    if(fd<0) return "cannot open room temporary file";
+    ok=io_write(fd,t.data,t.n);if(io_close(fd)) ok=0;
+    if(!ok) { io_remove(rtmp);return "cannot write room temporary file"; }
+    fd=io_open(mtmp,1);
+    if(fd<0) { io_remove(rtmp);return "cannot open mesh temporary file"; }
+    u8 header[16]={'F','P','R','M'};le32(header+4,1);le32(header+8,(u32)s->nv);le32(header+12,(u32)s->ni);
+    ok=io_write(fd,header,16);
+    /* Both supported targets are little-endian IEEE float32; parser always decodes explicitly. */
+    ok=ok && io_write(fd,s->vertices,(usize)s->nv*sizeof(Vec));
+    ok=ok && io_write(fd,s->indices,(usize)s->ni*sizeof(u32));
+    if(io_close(fd)) ok=0;
+    if(!ok) { io_remove(rtmp);io_remove(mtmp);return "cannot write mesh temporary file"; }
+    if(io_rename(mtmp,mesh)) { io_remove(rtmp);io_remove(mtmp);return "cannot publish mesh"; }
+    if(io_rename(rtmp,room)) { io_remove(rtmp);return "cannot publish room"; }
+    return 0;
+}
+static int error_json(const char *error)
+{
+    Text t={.ok=1};text(&t,"{\"ok\":false,\"error\":\"");text(&t,error);text(&t,"\"}\n");
+    io_write(1,t.data,t.n);return 2;
+}
+static int parse_float(const char *p,float *out)
+{
+    int digits=0;float n=0,scale=1;
+    while(*p>='0' && *p<='9') { n=n*10+*p++-'0';digits++;if(n>10000) return 0; }
+    if(*p=='.') { p++;while(*p>='0' && *p<='9') { scale*=.1f;n+=(*p++-'0')*scale;digits++; } }
+    if(!digits || *p || !finite(n)) return 0;
+    *out=n;return 1;
+}
+static int parse_universe(const char *p,u64 *out)
+{
+    u64 n=0;if(!*p) return 0;
+    for(;*p;p++) {
+        if(*p<'0' || *p>'9') return 0;
+        unsigned digit=(unsigned)(*p-'0');
+        if(n>(~(u64)0-digit)/10) return 0;
+        n=n*10+digit;
+    }
+    *out=n;return 1;
+}
+static const char *options(Options *o,int argc,char **argv)
+{
+    *o=(Options){.voxel=.05f,.ceiling_default=2.5f,.truncation=3,.max_edge=.6f,.grazing=.12f,.range=4.f,
+        .depth_jump=.25f,.depth_ratio=.12f,.min_views=5,.patch_residual=.03f,
+        .plane_distance=.045f,.min_plane_area=.45f,.wall_height=1.5f,.snap_degrees=5,.floor_band=.35f,
+        .ceiling_min=1.8f,.min_volume=.05f,.cluster_gap=.10f,.gap=.65f,.horizontal=.85f};
+    for(int i=1;i<argc;i++) {
+        const char *arg=argv[i];
+        if(same(arg,"--json")) continue;
+        if(i+1==argc) return "option requires a value";
+        const char *value=argv[++i];
+        if(same(arg,"--offline")) o->input=value;
+        else if(same(arg,"--out")) o->out=value;
+        else if(same(arg,"--hint")) o->hint=value;
+        else if(same(arg,"--universe")) { if(!parse_universe(value,&o->universe)) return "invalid universe"; }
+        else {
+            float *dest=0,low=0,high=100;
+            if(same(arg,"--voxel")) { dest=&o->voxel;low=.04f;high=.2f; }
+            else if(same(arg,"--ceiling-default")) { dest=&o->ceiling_default;low=1.8f;high=3.8f; }
+            else if(same(arg,"--truncation")) { dest=&o->truncation;low=1;high=5; }
+            else if(same(arg,"--max-edge")) { dest=&o->max_edge;low=.05f;high=1.5f; }
+            else if(same(arg,"--grazing")) { dest=&o->grazing;low=.01f;high=.9f; }
+            else if(same(arg,"--range")) { dest=&o->range;low=1;high=10; }
+            else if(same(arg,"--depth-jump")) { dest=&o->depth_jump;low=.02f;high=1; }
+            else if(same(arg,"--depth-ratio")) { dest=&o->depth_ratio;high=.5f; }
+            else if(same(arg,"--min-views")) { dest=&o->min_views;low=1;high=16; }
+            else if(same(arg,"--patch-residual")) { dest=&o->patch_residual;low=.005f;high=.1f; }
+            else if(same(arg,"--plane-distance")) { dest=&o->plane_distance;low=.01f;high=.15f; }
+            else if(same(arg,"--min-plane-area")) { dest=&o->min_plane_area;low=.1f;high=4; }
+            else if(same(arg,"--wall-height")) { dest=&o->wall_height;low=.5f;high=3; }
+            else if(same(arg,"--snap-degrees")) { dest=&o->snap_degrees;high=15; }
+            else if(same(arg,"--floor-band")) { dest=&o->floor_band;low=.05f;high=1; }
+            else if(same(arg,"--ceiling-min")) { dest=&o->ceiling_min;low=1.5f;high=3; }
+            else if(same(arg,"--min-volume")) { dest=&o->min_volume;low=.005f;high=1; }
+            else if(same(arg,"--cluster-gap")) { dest=&o->cluster_gap;low=.04f;high=.2f; }
+            else if(same(arg,"--gap")) { dest=&o->gap;low=.1f;high=1.5f; }
+            else if(same(arg,"--horizontal")) { dest=&o->horizontal;low=.6f;high=.99f; }
+            else return "unknown option";
+            if(!parse_float(value,dest) || *dest<low || *dest>high) return "option outside supported range";
+        }
+    }
+    return o->input && o->out ? 0 : "required: --offline dump.fprs --out directory";
+}
+static void duration(Text *t,i64 a,i64 b) { decimal(t,(float)(b-a)/1000000); }
+static void summary(Scan *s)
+{
+    Text t={.ok=1};text(&t,"{\"ok\":true,\"frames\":");integer(&t,s->frames);
+    text(&t,",\"skipped_frames\":");integer(&t,s->skipped_frames);
+    text(&t,",\"far_vertices\":");integer(&t,s->far_vertices);
+    text(&t,",\"discontinuity_triangles\":");integer(&t,s->discontinuities);
+    text(&t,",\"walls\":");integer(&t,(u64)s->noutline);
+    text(&t,",\"detected_walls\":");integer(&t,(u64)s->nplanes);
+    text(&t,",\"volumes\":");integer(&t,(u64)s->nvolumes);
+    text(&t,",\"floor_y\":");decimal(&t,s->floor);text(&t,",\"ceiling_y\":");decimal(&t,s->ceiling);
+    text(&t,",\"coverage_percent\":");decimal(&t,s->coverage);
+    text(&t,",\"hint_used\":");text(&t,s->hint_used ? "true" : "false");
+    text(&t,",\"triangles\":");integer(&t,(u64)s->ni/3);
+    text(&t,",\"accepted_triangles\":");integer(&t,s->accepted);
+    text(&t,",\"rejected_triangles\":");integer(&t,s->rejected);
+    text(&t,",\"warnings\":[");
+    for(int i=0;i<s->nwarnings;i++) { if(i) text(&t,",");text(&t,"\"");text(&t,s->warnings[i]);text(&t,"\""); }
+    text(&t,"],\"timings_ms\":{\"read\":");duration(&t,s->t0,s->tread);
+    text(&t,",\"fusion\":");duration(&t,s->tread,s->tfuse);
+    text(&t,",\"model\":");duration(&t,s->tfuse,s->tmodel);
+    text(&t,",\"mesh\":");duration(&t,s->tmodel,s->tmesh);
+    text(&t,",\"total\":");duration(&t,s->t0,io_time(1));text(&t,"}}\n");io_write(1,t.data,t.n);
+}
+int main(int argc,char **argv)
+{
+    if(argc==2 && same(argv[1],"--help")) {
+        const char usage[]="fp_roomscan --offline dump.fprs --out directory [--universe N] [--voxel 0.05]\n"
+            "  [--ceiling-default 2.5] [--hint outline.txt] [--json]\n"
+            "Tuning: --truncation --max-edge --grazing --range --depth-jump --depth-ratio --plane-distance --min-plane-area\n"
+            "  --min-views --patch-residual --wall-height --snap-degrees --floor-band --ceiling-min\n"
+            "  --min-volume --cluster-gap --gap --horizontal\n"
+            "Always prints one JSON summary; errors exit 2. See docs/mr/scan.md for units and ranges.\n";
+        io_write(1,usage,sizeof(usage)-1);return 0;
+    }
+    Scan *s=io_alloc(sizeof(Scan));
+    if(!s) return error_json("scan allocation failed");
+    s->rng=0x714ce3u;s->t0=io_time(1);
+    const char *error=options(&s->opt,argc,argv);
+    if(!error) error=read_dump(s,0);
+    s->tread=io_time(1);
+    if(!error) error=init_grid(s);
+    if(!error) error=read_dump(s,1);
+    if(!error) finish_fusion(s);
+    s->tfuse=io_time(1);
+    if(!error) error=make_model(s);
+    s->tmodel=io_time(1);
+    if(!error) error=make_mesh(s);
+    s->tmesh=io_time(1);
+    if(!error) error=write_files(s);
+    int result=0;
+    if(error) result=error_json(error);else summary(s);
+    io_free(s->cells,(usize)s->count*sizeof(Cell));
+    io_free(s->vertices,(usize)MAX_MESH_VERTICES*sizeof(Vec));
+    io_free(s->indices,(usize)MAX_TRIANGLES*3*sizeof(u32));
+    io_free(s,sizeof(Scan));return result;
+}

native/roomscan/mesh.c

@@ -0,0 +1,112 @@
+/* SPDX-License-Identifier: GPL-3.0-only */
+#include "scan.h"
+
+#define TANGENT_RADIUS_SQUARED 2.25f
+#define TANGENT_WEIGHT_RADIUS_SQUARED 2.5f
+#define MAX_EXTRACTION_STRIDE 4
+/* Marching cubes without a 256-case table: trace the zero contour on the six faces, then fan each closed loop.
+ * Ambiguous faces choose their diagonal from the face centre. Adjacent cubes therefore make the same choice. */
+static const int corners[8][3]={{0,0,0},{1,0,0},{1,0,1},{0,0,1},{0,1,0},{1,1,0},{1,1,1},{0,1,1}};
+static const int edges[12][2]={{0,1},{1,2},{2,3},{3,0},{4,5},{5,6},{6,7},{7,4},{0,4},{1,5},{2,6},{3,7}};
+static const int faces[6][4]={{0,1,2,3},{4,5,6,7},{0,9,4,8},{1,10,5,9},{2,11,6,10},{3,8,7,11}};
+
+static void tsdf(Scan *s)
+{
+    float v=s->opt.voxel,trunc=v*s->opt.truncation;
+    int radius=(int)s->opt.truncation+2;
+    for (int i=0;i<s->count;i++) {
+        Cell *c=&s->cells[i];
+        if (!c->weight) continue;
+        int x=i%s->nx,z=(i/s->nx)%s->nz,y=i/(s->nx*s->nz);
+        for (int dy=-radius;dy<=radius;dy++) for (int dz=-radius;dz<=radius;dz++) for (int dx=-radius;dx<=radius;dx++) {
+            int xx=x+dx,yy=y+dy,zz=z+dz;
+            if (xx<0 || yy<0 || zz<0 || xx>=s->nx || yy>=s->ny || zz>=s->nz) continue;
+            Vec delta=sub(grid_point(s,xx,yy,zz),c->p);
+            float d=dot(delta,c->n),tangent=dot(delta,delta)-d*d;
+            if (ab(d)>trunc || tangent>v*v*TANGENT_RADIUS_SQUARED) continue;
+            Cell *dest=&s->cells[(yy*s->nz+zz)*s->nx+xx];
+            float w=(1-tangent/(v*v*TANGENT_WEIGHT_RADIUS_SQUARED))*mn(c->weight/(v*v),1.f);
+            dest->sdf+=d*w;dest->sw+=w;
+        }
+    }
+    for (int i=0;i<s->count;i++) if(s->cells[i].sw) s->cells[i].sdf/=s->cells[i].sw;
+}
+static void connect(int links[12][2], int a, int b)
+{
+    if(links[a][0]<0) links[a][0]=b;else links[a][1]=b;
+    if(links[b][0]<0) links[b][0]=a;else links[b][1]=a;
+}
+static int cube(Scan *s, int x, int y, int z, int stride)
+{
+    float f[8];Vec p[8],normal=vec(0,0,0);
+    for(int k=0;k<8;k++) {
+        int xx=x+corners[k][0]*stride,yy=y+corners[k][1]*stride,zz=z+corners[k][2]*stride;
+        Cell *c=&s->cells[(yy*s->nz+zz)*s->nx+xx];
+        if (c->sw<=0) return 1; /* Unknown space never creates an invented surface. */
+        f[k]=c->sdf;p[k]=grid_point(s,xx,yy,zz);
+    }
+    Vec cuts[12];int crossing[12],links[12][2],visited[12]={0};
+    for(int e=0;e<12;e++) {
+        int a=edges[e][0],b=edges[e][1];
+        crossing[e]=(f[a]<0)!=(f[b]<0);links[e][0]=links[e][1]=-1;
+        if(crossing[e]) cuts[e]=add(p[a],mul(sub(p[b],p[a]),f[a]/(f[a]-f[b])));
+    }
+    /* Gradient points to positive TSDF: toward the observed free room, including furniture's exterior. */
+    normal.x=f[1]+f[2]+f[5]+f[6]-f[0]-f[3]-f[4]-f[7];
+    normal.y=f[4]+f[5]+f[6]+f[7]-f[0]-f[1]-f[2]-f[3];
+    normal.z=f[2]+f[3]+f[6]+f[7]-f[0]-f[1]-f[4]-f[5];
+    for(int face=0;face<6;face++) {
+        int hit[4],n=0;float centre=0;
+        for(int j=0;j<4;j++) {
+            int e=faces[face][j];
+            if(crossing[e]) hit[n++]=e;
+            centre+=f[edges[e][0]]+f[edges[e][1]];
+        }
+        if(n==2) connect(links,hit[0],hit[1]);
+        else if(n==4) {
+            /* The shared first edge's first corner fixes the phase on this face. */
+            int first=edges[hit[0]][0],second=edges[hit[0]][1];
+            int common=(edges[hit[1]][0]==second || edges[hit[1]][1]==second) ? second : first;
+            if((centre<0)==(f[common]<0)) {
+                connect(links,hit[0],hit[3]);connect(links,hit[1],hit[2]);
+            } else { connect(links,hit[0],hit[1]);connect(links,hit[2],hit[3]); }
+        }
+    }
+    for(int e=0;e<12;e++) if(crossing[e] && !visited[e]) {
+        int loop[12],n=0,prev=-1,cur=e;
+        while(cur>=0 && !visited[cur] && n<12) {
+            visited[cur]=1;loop[n++]=cur;
+            int next=links[cur][0]==prev ? links[cur][1] : links[cur][0];prev=cur;cur=next;
+        }
+        if(cur!=e) continue;
+        for(int k=1;k+1<n;k++) {
+            Vec a=cuts[loop[0]],b=cuts[loop[k]],c=cuts[loop[k+1]];
+            Vec norm=cross(sub(b,a),sub(c,a));
+            if(dot(norm,norm)<1e-14f) continue;
+            if(s->ni/3>=MAX_TRIANGLES) return 0;
+            if(dot(norm,normal)<0) { Vec t=b;b=c;c=t; }
+            s->vertices[s->nv]=a;s->vertices[s->nv+1]=b;s->vertices[s->nv+2]=c;
+            for(int j=0;j<3;j++) s->indices[s->ni++]=(u32)s->nv++;
+        }
+    }
+    return 1;
+}
+const char *make_mesh(Scan *s)
+{
+    s->vertices=io_alloc((usize)MAX_MESH_VERTICES*sizeof(Vec));
+    s->indices=io_alloc((usize)MAX_TRIANGLES*3*sizeof(u32));
+    if(!s->vertices || !s->indices) return "mesh allocation failed";
+    tsdf(s);
+    for(int stride=1;stride<=MAX_EXTRACTION_STRIDE;stride++) {
+        s->nv=s->ni=0;int ok=1;
+        for(int y=0;y+stride<s->ny && ok;y+=stride)
+            for(int z=0;z+stride<s->nz && ok;z+=stride)
+                for(int x=0;x+stride<s->nx && ok;x+=stride) ok=cube(s,x,y,z,stride);
+        if(ok) {
+            if(stride>1) warn(s,"mesh decimated by coarsening extraction grid");
+            if(!s->ni) warn(s,"no mesh surface; scan denser views");
+            return 0;
+        }
+    }
+    return "mesh exceeds triangle budget";
+}

native/roomscan/model.c

@@ -0,0 +1,672 @@
+/* SPDX-License-Identifier: GPL-3.0-only */
+#include "scan.h"
+
+#define RANSAC_TRIALS 96
+#define NORMAL_AGREEMENT .90f
+#define MIN_WALL_SPAN .60f
+#define FURNITURE_MARGIN .12f
+#define NEAR_WALL .35f
+#define MIN_TOP_AREA .25f
+#define BOX_TRIM .02f
+#define VERTICAL_NORMAL_Y .35f
+#define BOX_SIDE_NORMAL_Y .30f
+#define BOX_EDGE_STRENGTH .40f
+#define MIN_CLUSTER_SURFELS 12
+#define MIN_BOX_EDGE_VOTES 12
+#define MIN_OUTLINE_EXTENT 1.f
+#define MIN_OUTLINE_TWICE_AREA .5f
+#define FLOOR_INFER_DISTANCE .3f
+#define TABLE_MIN_HEIGHT .55f
+#define TABLE_MAX_HEIGHT 1.1f
+#define COUCH_MIN_HEIGHT .35f
+#define COUCH_MAX_HEIGHT .9f
+#define COUCH_MIN_LENGTH 1.4f
+#define BED_MIN_HEIGHT .3f
+#define BED_MAX_HEIGHT .8f
+#define BED_MIN_AREA 2.f
+#define STORAGE_MIN_HEIGHT 1.1f
+#define SCREEN_MAX_DEPTH .22f
+#define SCREEN_MIN_WIDTH .4f
+#define SCREEN_MAX_WIDTH 2.f
+#define DEFAULT_CIRCLE_MIN_POINTS 8
+#define DEFAULT_CIRCLE_RADIAL_CV .05f
+#define LOW_COVERAGE_PERCENT 80.f
+#define WALL_MERGE_DISTANCE .25f
+#define WALL_MERGE_COSINE .97f
+#define RELATIVE_WALL_AREA .20f
+#define DOMINANT_WALL_TOLERANCE 12.f
+#define ORTHOGONAL_SUPPORT_FRACTION .65f
+#define CEILING_MIN_AREA .08f    /* m^2 of fused down-facing cells at one height (fused surfaces are sparse: the
+                                  * owner's floor was 0.7 m^2 of cells, the ceiling 0.11 m^2 after a 2 s look up) */
+#define CEILING_MIN_HEIGHT 2.0f  /* m above the floor: lower ones are shelves, door frames, table undersides */
+#define CEILING_MAX_HEIGHT 4.0f
+#define BOX_AXIS_COS .96f        /* walls within ~16 deg of the two room axes (smeared depth tilted a real
+                                  * wall 12 deg in the owner's scan) */
+#define BOX_SNAP .5f             /* m: a rectangle side snaps to a detected wall this close */
+#define BOX_LOW_SHARE .02f       /* surfaces beyond the 2nd/98th percentile along an axis are outliers */
+#define WALL_BAND_TOP 2.4f       /* m above the floor: walls are fitted below this (and below the ceiling) */
+#define MIN_FURNITURE_TOP .25f
+#define WALL_FURNITURE_CLEARANCE .15f
+#define MIN_TOP_DENSITY .30f
+
+static void consolidate_walls(Scan *s)
+{
+    if(!s->nplanes) return;
+    Plane result[MAX_PLANES]={0};int count=0;
+    float largest=0;
+    for(int i=0;i<s->nplanes;i++) {
+        Plane p=s->planes[i];int merge=-1;
+        largest=mx(largest,p.area);
+        for(int j=0;j<count;j++) if(dot(p.n,result[j].n)>WALL_MERGE_COSINE &&
+            ab(p.d-result[j].d)<WALL_MERGE_DISTANCE) { merge=j;break; }
+        if(merge<0) result[count++]=p;
+        else {
+            Plane *r=&result[merge];
+            r->area+=p.area;r->bottom=mn(r->bottom,p.bottom);r->top=mx(r->top,p.top);
+            r->lo=mn(r->lo,p.lo);r->hi=mx(r->hi,p.hi);
+        }
+    }
+    float base=angle(result[0].n.z,result[0].n.x),aligned=0,total=0;
+    for(int i=0;i<count;i++) {
+        Plane *p=&result[i];float a=angle(p->n.z,p->n.x)-base;
+        float delta=ab(a-flo(a/(PI/2)+.5f)*(PI/2));
+        total+=p->area;
+        if(delta<DOMINANT_WALL_TOLERANCE*PI/180) aligned+=p->area;
+    }
+    int orthogonal=aligned>total*ORTHOGONAL_SUPPORT_FRACTION && s->opt.snap_degrees>0;
+    s->nplanes=0;
+    for(int i=0;i<count;i++) {
+        Plane p=result[i];float a=angle(p.n.z,p.n.x)-base;
+        float delta=ab(a-flo(a/(PI/2)+.5f)*(PI/2));
+        if(p.area<largest*RELATIVE_WALL_AREA) continue;
+        if(orthogonal && delta>DOMINANT_WALL_TOLERANCE*PI/180) continue;
+        s->planes[s->nplanes++]=p;
+    }
+}
+
+static float plane_height(Scan *s, int ceiling, int *found)
+{
+    float hist[512]={0}, step=s->opt.voxel*.5f;
+    int bins=(int)(4/step)+2;
+    if (bins>512) bins=512;
+    for (int i=0;i<s->count;i++) {
+        Cell *c=&s->cells[i];
+        if (!c->weight || (ceiling ? c->n.y > -s->opt.horizontal : c->n.y < s->opt.horizontal)) continue;
+        if (ceiling ? c->p.y<s->opt.ceiling_min : ab(c->p.y)>s->opt.floor_band) continue;
+        int b=flo((c->p.y-s->origin.y)/step);
+        if (b>=0 && b<bins) hist[b]+=1;
+    }
+    int best=0;
+    float score=0;
+    for (int b=1;b<bins-1;b++) {
+        float h=hist[b-1]+hist[b]+hist[b+1];
+        if (h>score) { score=h; best=b; }
+    }
+    float y=s->origin.y+(best+.5f)*step, total=0, sum=0,upward=0;
+    for (int i=0;i<s->count;i++) {
+        Cell *c=&s->cells[i];
+        if(c->weight && c->n.y>s->opt.horizontal) upward++;
+        if (!c->weight || ab(c->p.y-y)>s->opt.plane_distance) continue;
+        if (ceiling ? c->n.y > -s->opt.horizontal : c->n.y < s->opt.horizontal) continue;
+        total++; sum+=c->p.y;
+    }
+    *found=(ceiling || score* s->opt.voxel*s->opt.voxel >= s->opt.min_plane_area) && total>0;
+    /* A ceiling is judged on its own area and height, not against the floor: players glance up for a second and look
+     * at the floor all the time, so a share-of-upward-surfaces rule rejected every real ceiling (owner's scans,
+     * 2026-10-16: down-facing surfaces at ~2.9 m in both recordings, "ceiling not seen"). */
+    (void)upward;
+    if(ceiling && (total*s->opt.voxel*s->opt.voxel<CEILING_MIN_AREA || y-s->floor<CEILING_MIN_HEIGHT ||
+                   y-s->floor>CEILING_MAX_HEIGHT)) *found=0;
+    return *found ? sum/total : (ceiling ? s->floor+s->opt.ceiling_default : 0);
+}
+static int on_plane(Scan *s, Cell *c, Plane *p)
+{
+    return ab(dot(c->p,p->n)-p->d)<s->opt.plane_distance && dot(c->n,p->n)>NORMAL_AGREEMENT;
+}
+static void refine(Scan *s, int *ids, int n, Plane *p)
+{
+    Vec avg=vec(0,0,0), normal=vec(0,0,0);
+    float count=0;
+    for (int i=0;i<n;i++) {
+        Cell *c=&s->cells[ids[i]];
+        if (!c->mark && on_plane(s,c,p)) { avg=add(avg,c->p); normal=add(normal,c->n); count++; }
+    }
+    if (!count) return;
+    avg=mul(avg,1/count);
+    /* Fit positions, rather than averaging noisy per-triangle normals. */
+    float xx=0,zz=0,xz=0;
+    for (int i=0;i<n;i++) {
+        Cell *c=&s->cells[ids[i]];
+        if (!c->mark && on_plane(s,c,p)) {
+            float x=c->p.x-avg.x,z=c->p.z-avg.z;
+            xx+=x*x; zz+=z*z; xz+=x*z;
+        }
+    }
+    float yaw=.5f*angle(2*xz,xx-zz);
+    Vec nn=vec(-sine(yaw),0,cosine(yaw));
+    if (dot(nn,normal)<0) nn=mul(nn,-1);
+    p->n=nn; p->d=dot(nn,avg);
+    p->lo=1e10f; p->hi=-1e10f; p->bottom=1e10f; p->top=-1e10f;
+    count=0;
+    for (int i=0;i<n;i++) {
+        Cell *c=&s->cells[ids[i]];
+        if (!c->mark && on_plane(s,c,p)) {
+            float t=c->p.x*p->n.z-c->p.z*p->n.x;
+            p->lo=mn(p->lo,t); p->hi=mx(p->hi,t);
+            p->bottom=mn(p->bottom,c->p.y); p->top=mx(p->top,c->p.y); count++;
+        }
+    }
+    p->area=count*s->opt.voxel*s->opt.voxel;
+}
+static void walls(Scan *s, int *ids, int n)
+{
+    /* Walls are fitted in a fixed band above the floor whatever the ceiling: Valve's smoothed depth bends where wall
+     * meets ceiling, and with a detected 2.9 m ceiling that band confused the fit (owner's scan, 2026-10-16). */
+    float top=mn(s->ceiling,s->floor+WALL_BAND_TOP)-FURNITURE_MARGIN;
+    for (int i=0;i<n;i++) {
+        Cell *c=&s->cells[ids[i]];
+        c->mark=ab(c->n.y)>VERTICAL_NORMAL_Y || c->p.y<s->floor+FURNITURE_MARGIN || c->p.y>top;
+    }
+    for (int attempt=0;attempt<MAX_PLANES*2 && s->nplanes<MAX_PLANES;attempt++) {
+        Plane best={0}; int best_count=0;
+        for (int trial=0;trial<RANSAC_TRIALS;trial++) {
+            Cell *seed=&s->cells[ids[random_next(s)%(unsigned)n]];
+            if (seed->mark) continue;
+            Plane p={0}; p.n=unit(vec(seed->n.x,0,seed->n.z)); p.d=dot(seed->p,p.n);
+            int count=0;
+            for (int j=0;j<n;j++) {
+                Cell *c=&s->cells[ids[j]];
+                if (!c->mark && on_plane(s,c,&p)) count++;
+            }
+            if (count>best_count) { best_count=count; best=p; }
+        }
+        if (best_count*s->opt.voxel*s->opt.voxel<s->opt.min_plane_area) break;
+        refine(s,ids,n,&best);
+        /* Height separates large furniture faces from room walls. */
+        int wall=best.area>=s->opt.min_plane_area && best.top-best.bottom>=s->opt.wall_height &&
+                 best.hi-best.lo>=MIN_WALL_SPAN;
+        for (int j=0;j<n;j++) {
+            Cell *c=&s->cells[ids[j]];
+            if (!c->mark && on_plane(s,c,&best)) c->mark=wall ? 2 : 3;
+        }
+        if (wall) s->planes[s->nplanes++]=best;
+        /* Rejected candidates are consumed too, ensuring bounded progress. */
+    }
+    if (s->nplanes==MAX_PLANES) warn(s,"wall limit reached");
+    if (s->nplanes) {
+        float base=angle(s->planes[0].n.z,s->planes[0].n.x);
+        for (int k=0;k<s->nplanes;k++) {
+            Plane *p=&s->planes[k];
+            float a=angle(p->n.z,p->n.x), diff=a-base;
+            int quarter=flo(diff/(PI/2)+.5f);
+            float target=base+quarter*(PI/2);
+            if (ab(a-target)<s->opt.snap_degrees*PI/180) {
+                Vec nn=vec(cosine(target),0,sine(target));
+                float sum=0,count=0,lo=1e10f,hi=-1e10f;
+                for (int j=0;j<n;j++) {
+                    Cell *c=&s->cells[ids[j]];
+                    if (on_plane(s,c,p)) {
+                        sum+=dot(c->p,nn); count++;
+                        float t=c->p.x*nn.z-c->p.z*nn.x;
+                        lo=mn(lo,t); hi=mx(hi,t);
+                    }
+                }
+                if (count) { p->n=nn; p->d=sum/count; p->lo=lo; p->hi=hi; }
+            }
+        }
+    }
+    consolidate_walls(s);
+}
+static Pt endpoint(Plane *p, int end)
+{
+    float t=end ? p->hi : p->lo;
+    return (Pt){p->n.x*p->d+p->n.z*t,p->n.z*p->d-p->n.x*t};
+}
+static float distance2(Pt a, Pt b) { float x=a.x-b.x,z=a.z-b.z; return x*x+z*z; }
+static int intersect(Plane *a, Plane *b, Pt *p)
+{
+    float det=a->n.x*b->n.z-a->n.z*b->n.x;
+    if (ab(det)<.1f) return 0;
+    p->x=(a->d*b->n.z-a->n.z*b->d)/det;
+    p->z=(a->n.x*b->d-a->d*b->n.x)/det;
+    return 1;
+}
+static void push_outline(Scan *s, Pt p, int invisible)
+{
+    if (s->noutline && distance2(s->outline[s->noutline-1],p)<.0001f) return;
+    if (s->noutline<MAX_OUTLINE) {
+        s->outline[s->noutline]=p;
+        s->invisible[s->noutline++]=invisible;
+    }
+}
+static void rectangle(Scan *s, int *ids, int n)
+{
+    float x0=1e10f,x1=-1e10f,z0=1e10f,z1=-1e10f;
+    for (int i=0;i<n;i++) {
+        Vec p=s->cells[ids[i]].p;
+        x0=mn(x0,p.x);x1=mx(x1,p.x);z0=mn(z0,p.z);z1=mx(z1,p.z);
+    }
+    if (x1-x0<MIN_OUTLINE_EXTENT) { float m=(x0+x1)*.5f; x0=m-MIN_OUTLINE_EXTENT/2; x1=m+MIN_OUTLINE_EXTENT/2; }
+    if (z1-z0<MIN_OUTLINE_EXTENT) { float m=(z0+z1)*.5f; z0=m-MIN_OUTLINE_EXTENT/2; z1=m+MIN_OUTLINE_EXTENT/2; }
+    push_outline(s,(Pt){x0,z0},1);push_outline(s,(Pt){x1,z0},1);
+    push_outline(s,(Pt){x1,z1},1);push_outline(s,(Pt){x0,z1},1);
+    warn(s,"incomplete walls; synthesized outline");
+}
+static int segment_cross(Pt a, Pt b, Pt c, Pt d)
+{
+    float p=(b.x-a.x)*(c.z-a.z)-(b.z-a.z)*(c.x-a.x);
+    float q=(b.x-a.x)*(d.z-a.z)-(b.z-a.z)*(d.x-a.x);
+    float r=(d.x-c.x)*(a.z-c.z)-(d.z-c.z)*(a.x-c.x);
+    float t=(d.x-c.x)*(b.z-c.z)-(d.z-c.z)*(b.x-c.x);
+    return p*q<-.000001f && r*t<-.000001f;
+}
+static int valid_polygon(Scan *s)
+{
+    float area=0;
+    for (int i=0;i<s->noutline;i++) {
+        Pt a=s->outline[i], b=s->outline[(i+1)%s->noutline];
+        area+=a.x*b.z-b.x*a.z;
+        for (int j=i+2;j<s->noutline;j++) {
+            if ((j+1)%s->noutline==i) continue;
+            if (segment_cross(a,b,s->outline[j],s->outline[(j+1)%s->noutline])) return 0;
+        }
+    }
+    return s->noutline>=3 && area>MIN_OUTLINE_TWICE_AREA;
+}
+static int convex_fallback(Scan *s)
+{
+    if(s->nplanes<3 || s->nplanes>4) return 0;
+    /* A concave multi-wall room must use directed segments. A small set of enclosure planes can instead be
+     * clipped as inward half-planes when smeared endpoints prevent reliable corner ordering. */
+    Pt a[MAX_OUTLINE],b[MAX_OUTLINE];float x0=1e10f,x1=-1e10f,z0=1e10f,z1=-1e10f;
+    for(int i=0;i<s->nplanes;i++) for(int end=0;end<2;end++) {
+        Pt p=endpoint(&s->planes[i],end);x0=mn(x0,p.x);x1=mx(x1,p.x);z0=mn(z0,p.z);z1=mx(z1,p.z);
+    }
+    int n=4;a[0]=(Pt){x0,z0};a[1]=(Pt){x1,z0};a[2]=(Pt){x1,z1};a[3]=(Pt){x0,z1};
+    for(int i=0;i<s->nplanes;i++) {
+        Plane *p=&s->planes[i];int count=0;
+        for(int j=0;j<n;j++) {
+            Pt u=a[j],v=a[(j+1)%n];float du=p->n.x*u.x+p->n.z*u.z-p->d,dv=p->n.x*v.x+p->n.z*v.z-p->d;
+            if(du>=0) b[count++]=u;
+            if((du>=0)!=(dv>=0)) {
+                float t=du/(du-dv);b[count++]=(Pt){u.x+t*(v.x-u.x),u.z+t*(v.z-u.z)};
+            }
+        }
+        if(count<3 || count>=MAX_OUTLINE) return 0;
+        n=count;memcpy(a,b,(usize)n*sizeof(Pt));
+    }
+    s->noutline=n;
+    for(int j=0;j<n;j++) {
+        s->outline[j]=a[j];s->invisible[j]=1;Pt v=a[(j+1)%n];
+        for(int i=0;i<s->nplanes;i++) {
+            Plane *p=&s->planes[i];
+            if(ab(p->n.x*a[j].x+p->n.z*a[j].z-p->d)<s->opt.plane_distance &&
+               ab(p->n.x*v.x+p->n.z*v.z-p->d)<s->opt.plane_distance) s->invisible[j]=0;
+        }
+    }
+    if(!valid_polygon(s)) { s->noutline=0;return 0; }
+    warn(s,"wall endpoints uncertain; using plane intersections");return 1;
+}
+/* Value below which `share` of the projections fall (2 cm bins over +-8 m around the data). */
+static float projection_percentile(Scan *s, int *ids, int n, Pt axis, float share)
+{
+    static u32 hist[800];
+    memset(hist,0,sizeof(hist));
+    for (int i=0;i<n;i++) {
+        Vec p=s->cells[ids[i]].p;
+        int b=(int)((p.x*axis.x+p.z*axis.z+8)/.02f);
+        if (b>=0 && b<800) hist[b]++;
+    }
+    u64 total=0,run=0;
+    for (int b=0;b<800;b++) total+=hist[b];
+    for (int b=0;b<800;b++) { run+=hist[b]; if (run>=share*total) return b*.02f-8+.01f; }
+    return 8;
+}
+/* Most rooms are rectangles. When every detected wall runs along one of two perpendicular axes (2-4 walls), the
+ * outline is that rectangle: its sides at the 2nd/98th percentile of the surfaces along each axis, each snapped to a
+ * detected wall when one lies within BOX_SNAP. Directed wall chaining made a skewed quadrilateral of the owner's
+ * room from three smeared walls (2026-10-16). L-shaped rooms have more walls and keep the chaining below. */
+static int orthogonal_box(Scan *s, int *ids, int n)
+{
+    if (s->nplanes<2 || s->nplanes>4) return 0;
+    Vec u=s->planes[0].n; float len=root(u.x*u.x+u.z*u.z);
+    if (len<.5f) return 0;
+    Pt axis[2]={{u.x/len,u.z/len},{-u.z/len,u.x/len}};
+    float side[2][2]; int wall[2][2]={{0,0},{0,0}}, snapped=0;
+    for (int k=0;k<2;k++) {
+        side[k][0]=projection_percentile(s,ids,n,axis[k],BOX_LOW_SHARE);
+        side[k][1]=projection_percentile(s,ids,n,axis[k],1-BOX_LOW_SHARE);
+    }
+    for (int i=0;i<s->nplanes;i++) {
+        Plane *p=&s->planes[i];
+        float c0=p->n.x*axis[0].x+p->n.z*axis[0].z, c1=p->n.x*axis[1].x+p->n.z*axis[1].z;
+        int k=ab(c0)>=BOX_AXIS_COS ? 0 : ab(c1)>=BOX_AXIS_COS ? 1 : -1;
+        if (k<0) return 0;  // a wall off both axes: not a rectangle
+        float offset=p->d*(k ? c1 : c0)/ab(k ? c1 : c0);
+        int end=ab(offset-side[k][0])<ab(offset-side[k][1]) ? 0 : 1;
+        if (ab(offset-side[k][end])<BOX_SNAP) { side[k][end]=offset; snapped+=!wall[k][end]; wall[k][end]=1; }
+    }
+    if (snapped<2 || side[0][1]-side[0][0]<MIN_OUTLINE_EXTENT || side[1][1]-side[1][0]<MIN_OUTLINE_EXTENT) return 0;
+    /* corners (s,t) -> world x = a0.x s + a1.x t, z = a0.z s + a1.z t; edge flags = whether its side is a wall */
+    int order[4][2]={{0,0},{1,0},{1,1},{0,1}}, edge[4][2]={{1,0},{0,1},{1,1},{0,0}};  // edge k lies on side[a][e]
+    float twice=0;
+    Pt c[4];
+    for (int j=0;j<4;j++) {
+        float a=side[0][order[j][0]], b=side[1][order[j][1]];
+        c[j]=(Pt){axis[0].x*a+axis[1].x*b, axis[0].z*a+axis[1].z*b};
+    }
+    for (int j=0;j<4;j++) twice+=c[j].x*c[(j+1)%4].z-c[(j+1)%4].x*c[j].z;
+    s->noutline=0;
+    if (twice>0) for (int j=0;j<4;j++) push_outline(s,c[j],!wall[edge[j][0]][edge[j][1]]);
+    else for (int j=0;j<4;j++) {  // reversed: corner 0,3,2,1; edge from corner k to k-1 is the old edge k-1
+        int k=(4-j)%4, e=(k+3)%4;
+        push_outline(s,c[k],!wall[edge[e][0]][edge[e][1]]);
+    }
+    if (!valid_polygon(s)) { s->noutline=0; return 0; }
+    if (snapped<4) warn(s,"gaps closed with invisible walls");
+    return 1;
+}
+static void outline(Scan *s, int *ids, int n)
+{
+    if (orthogonal_box(s,ids,n)) return;
+    if (s->nplanes<3) { rectangle(s,ids,n); return; }
+    int order[MAX_PLANES]={0};
+    s->planes[0].used=1;
+    for (int k=1;k<s->nplanes;k++) {
+        Pt end=endpoint(&s->planes[order[k-1]],1);
+        float best=1e10f; int which=-1;
+        for (int j=0;j<s->nplanes;j++) if (!s->planes[j].used) {
+            float d=distance2(end,endpoint(&s->planes[j],0));
+            if (d<best) { best=d;which=j; }
+        }
+        order[k]=which;s->planes[which].used=1;
+    }
+    Pt starts[MAX_PLANES], ends[MAX_PLANES];
+    for (int k=0;k<s->nplanes;k++) {
+        Plane *p=&s->planes[order[k]], *next=&s->planes[order[(k+1)%s->nplanes]];
+        ends[k]=endpoint(p,1); starts[(k+1)%s->nplanes]=endpoint(next,0);
+        Pt corner;
+        if (intersect(p,next,&corner) && distance2(corner,ends[k])<s->opt.gap*s->opt.gap &&
+            distance2(corner,starts[(k+1)%s->nplanes])<s->opt.gap*s->opt.gap)
+            ends[k]=starts[(k+1)%s->nplanes]=corner;
+    }
+    for (int k=0;k<s->nplanes;k++) {
+        push_outline(s,starts[k],0);
+        if (distance2(ends[k],starts[(k+1)%s->nplanes])>.0001f) {
+            push_outline(s,ends[k],1);warn(s,"gaps closed with invisible walls");
+        }
+    }
+    if (!valid_polygon(s)) {
+        s->noutline=0;
+        if(!convex_fallback(s)) { rectangle(s,ids,n);warn(s,"wall ordering ambiguous"); }
+    }
+}
+static float wall_distance(Scan *s, Vec p)
+{
+    float best=1e10f;
+    for (int i=0;i<s->nplanes;i++) best=mn(best,ab(dot(s->planes[i].n,p)-s->planes[i].d));
+    return best;
+}
+static void trimmed_bounds(Scan *s, int *queue, int n, Vec axis, float *lo, float *hi)
+{
+    int hist[512]={0};float start=*lo,range=*hi-start;
+    if(range<.001f) return;
+    for(int i=0;i<n;i++) {
+        float value=dot(s->cells[queue[i]].p,axis);
+        int bin=(int)clamp((value-start)/range*511,0,511);hist[bin]++;
+    }
+    int count=0,target=(int)(n*BOX_TRIM);
+    for(int b=0;b<512;b++) { count+=hist[b];if(count>target) { *lo=start+range*b/511;break; } }
+    count=0;
+    for(int b=511;b>=0;b--) { count+=hist[b];if(count>target) { *hi=start+range*(b+1)/511;break; } }
+}
+static float top_height(Scan *s, int *queue, int n, float low, float high)
+{
+    int histogram[512]={0},bins=(int)mn((high-low)/(s->opt.voxel*.25f)+2,512);
+    float step=s->opt.voxel*.25f;
+    for(int i=0;i<n;i++) {
+        int bin=flo((s->cells[queue[i]].p.y-low)/step);
+        if(bin>=0 && bin<bins) histogram[bin]++;
+    }
+    int count=0;
+    for(int bin=0;bin<bins;bin++) {
+        count+=histogram[bin];
+        /* The median resists a softened lip without selecting one of several noisy sub-peaks as a new top. */
+        if(count>=n/2) return low+(bin+.5f)*step;
+    }
+    return (low+high)*.5f;
+}
+static void furniture(Scan *s, int *ids, int n, int *queue)
+{
+    /* Tops remain separable when a softened sofa/table edge blends into its neighbouring wall. Vertical-only
+     * components are considered separately for screens; they cannot turn a whole wall into an OTHER volume. */
+    for(int mode=0;mode<2;mode++) {
+    float histogram[256]={0},levels[32];int nlevels=0;
+    if(!mode) {
+        for(int j=0;j<n;j++) {
+            Cell *c=&s->cells[ids[j]];
+            if(c->n.y>s->opt.horizontal && c->p.y>s->floor+MIN_FURNITURE_TOP &&
+               c->p.y<s->ceiling-FURNITURE_MARGIN && wall_distance(s,c->p)>WALL_FURNITURE_CLEARANCE) {
+                int bin=flo((c->p.y-s->floor)/s->opt.voxel);
+                if(bin>=0 && bin<256) histogram[bin]++;
+            }
+        }
+        for(int k=0;k<32;k++) {
+            int best=0;float score=0;
+            for(int bin=1;bin<255;bin++) {
+                float count=histogram[bin-1]+histogram[bin]+histogram[bin+1];
+                if(count>score) { score=count;best=bin; }
+            }
+            if(score*s->opt.voxel*s->opt.voxel<MIN_TOP_AREA) break;
+            levels[nlevels++]=s->floor+(best+.5f)*s->opt.voxel;
+            int radius=(int)(s->opt.plane_distance*2/s->opt.voxel)+1;
+            for(int bin=best-radius;bin<=best+radius;bin++) if(bin>=0 && bin<256) histogram[bin]=0;
+        }
+    }
+    for (int j=0;j<n;j++) {
+        Cell *c=&s->cells[ids[j]];
+        int normal=mode ? ab(c->n.y)<BOX_SIDE_NORMAL_Y : c->n.y>s->opt.horizontal;
+        c->mark=(normal && c->p.y>s->floor+MIN_FURNITURE_TOP && c->p.y<s->ceiling-FURNITURE_MARGIN &&
+                 wall_distance(s,c->p)>WALL_FURNITURE_CLEARANCE) ? 1 : 0;
+        if(c->mark && !mode) {
+            c->mark=0;float best=s->opt.plane_distance*2;
+            for(int k=0;k<nlevels;k++) if(ab(c->p.y-levels[k])<best) {
+                best=ab(c->p.y-levels[k]);c->mark=k+1;
+            }
+        }
+    }
+    int radius=(int)(s->opt.cluster_gap/s->opt.voxel)+1;
+    for (int j=0;j<n;j++) {
+        int seed=ids[j];
+        if (s->cells[seed].mark<=0) continue;
+        int group=s->cells[seed].mark;
+        int head=0,tail=1;queue[0]=seed;s->cells[seed].mark=-1;
+        while (head<tail) {
+            int id=queue[head++],x=id%s->nx,z=(id/s->nx)%s->nz,y=id/(s->nx*s->nz);
+            for (int dy=-radius;dy<=radius;dy++) for (int dz=-radius;dz<=radius;dz++) for (int dx=-radius;dx<=radius;dx++) {
+                if (dx*dx+dy*dy+dz*dz>radius*radius) continue;
+                int xx=x+dx,yy=y+dy,zz=z+dz;
+                if (xx<0 || yy<0 || zz<0 || xx>=s->nx || yy>=s->ny || zz>=s->nz) continue;
+                int next=(yy*s->nz+zz)*s->nx+xx;
+                Cell *c=&s->cells[next];
+                if (c->mark==group) { c->mark=-1;queue[tail++]=next; }
+            }
+        }
+        if (tail<MIN_CLUSTER_SURFELS) continue;
+        Vec avg=vec(0,0,0);float top=-1e10f,bottom=1e10f;
+        for (int k=0;k<tail;k++) {
+            Vec p=s->cells[queue[k]].p;avg=add(avg,p);top=mx(top,p.y);bottom=mn(bottom,p.y);
+        }
+        avg=mul(avg,1.f/tail);
+        float xx=0,zz=0,xz=0,edge_x=0,edge_y=0,edge_count=0;
+        for (int k=0;k<tail;k++) {
+            Cell *c=&s->cells[queue[k]];
+            Vec p=sub(c->p,avg);xx+=p.x*p.x;zz+=p.z*p.z;xz+=p.x*p.z;
+            if(ab(c->n.y)<BOX_SIDE_NORMAL_Y) {
+                Vec norm=unit(vec(c->n.x,0,c->n.z));
+                float co2=norm.x*norm.x-norm.z*norm.z,si2=2*norm.x*norm.z;
+                edge_x+=co2*co2-si2*si2;edge_y+=2*co2*si2;edge_count++;
+            }
+        }
+        float yaw=.5f*angle(2*xz,xx-zz);
+        /* Opposing faces and perpendicular edges vote for the same fourth harmonic. Unlike PCA, this is not
+         * biased by one side being more visible. Non-box objects fall back to position covariance. */
+        if(edge_count>MIN_BOX_EDGE_VOTES && root(edge_x*edge_x+edge_y*edge_y)>edge_count*BOX_EDGE_STRENGTH)
+            yaw=.25f*angle(edge_y,edge_x);
+        if(!mode) {
+            float smallest=1e10f;
+            for(int degree=0;degree<90;degree++) {
+                float a=degree*PI/180,co=cosine(a),si=sine(a),u0=1e10f,u1=-1e10f,v0=1e10f,v1=-1e10f;
+                for(int k=0;k<tail;k++) {
+                    Vec p=s->cells[queue[k]].p;float u=p.x*co+p.z*si,v=-p.x*si+p.z*co;
+                    u0=mn(u0,u);u1=mx(u1,u);v0=mn(v0,v);v1=mx(v1,v);
+                }
+                float area=(u1-u0)*(v1-v0);
+                if(area<smallest) { smallest=area;yaw=a; }
+            }
+        }
+        float co=cosine(yaw),si=sine(yaw);
+        float u0=1e10f,u1=-1e10f,v0=1e10f,v1=-1e10f,top_count=0;
+        for (int k=0;k<tail;k++) {
+            Cell *c=&s->cells[queue[k]];Vec p=sub(c->p,avg);
+            float u=p.x*co+p.z*si,v=-p.x*si+p.z*co;
+            u0=mn(u0,u);u1=mx(u1,u);v0=mn(v0,v);v1=mx(v1,v);
+            if (c->n.y>s->opt.horizontal && c->p.y>top-s->opt.plane_distance*2) top_count++;
+        }
+        /* Stereo discontinuities leave a low-density halo even after long-edge rejection. Trim the outer
+         * two percent before measuring boxes; otherwise a table can become wide enough to look like a couch. */
+        float up=dot(avg,vec(co,0,si)),vp=dot(avg,vec(-si,0,co));
+        u0+=up;u1+=up;v0+=vp;v1+=vp;
+        trimmed_bounds(s,queue,tail,vec(co,0,si),&u0,&u1);
+        trimmed_bounds(s,queue,tail,vec(-si,0,co),&v0,&v1);
+        u0-=up;u1-=up;v0-=vp;v1-=vp;
+        trimmed_bounds(s,queue,tail,vec(0,1,0),&bottom,&top);
+        if(!mode) top=top_height(s,queue,tail,bottom,top);
+        float w=u1-u0,d=v1-v0,h=top-(bottom<s->floor+FLOOR_INFER_DISTANCE ? s->floor : mn(bottom,s->floor+FURNITURE_MARGIN));
+        if(d>w) { float t=w;w=d;d=t;yaw+=PI/2; }
+        while(yaw>PI/2) yaw-=PI;
+        if(!mode) h=top-s->floor;
+        if (w*d*h<s->opt.min_volume) continue;
+        float height=top-s->floor,area=w*d,top_area=(mode ? top_count : tail)*s->opt.voxel*s->opt.voxel;
+        if(!mode && (top_area<MIN_TOP_AREA || top_area<area*MIN_TOP_DENSITY)) continue;
+        const char *label="OTHER";
+        if (height>=BED_MIN_HEIGHT && height<=BED_MAX_HEIGHT && area>=BED_MIN_AREA) label="BED";
+        else if (height>=COUCH_MIN_HEIGHT && height<=COUCH_MAX_HEIGHT && mx(w,d)+2*s->opt.voxel>=COUCH_MIN_LENGTH) label="COUCH";
+        else if (height>=TABLE_MIN_HEIGHT && height<=TABLE_MAX_HEIGHT && top_area>=MIN_TOP_AREA) label="TABLE";
+        else if (mn(w,d)<SCREEN_MAX_DEPTH && mx(w,d)>=SCREEN_MIN_WIDTH && mx(w,d)<=SCREEN_MAX_WIDTH &&
+                 wall_distance(s,avg)<NEAR_WALL) label="SCREEN";
+        else if (h>=STORAGE_MIN_HEIGHT && wall_distance(s,avg)<NEAR_WALL) label="STORAGE";
+        if(mode && !same(label,"SCREEN")) continue;
+        if(!mode && same(label,"OTHER") && height>TABLE_MAX_HEIGHT) continue;
+        if (s->nvolumes>=MAX_VOLUMES) { warn(s,"furniture limit reached");break; }
+        Vec centre=vec(avg.x+co*(u0+u1)*.5f-si*(v0+v1)*.5f,top,
+                       avg.z+si*(u0+u1)*.5f+co*(v0+v1)*.5f);
+        /* ROOM_FORMAT yaw is an active right-handed rotation about +Y. */
+        s->volumes[s->nvolumes++]=(Volume){centre,-yaw*180/PI,w,d,h,label};
+    }
+    }
+}
+
+/* A hint is a fallback for missing walls, never a constraint on observed geometry. */
+static const char *hint(Scan *s);
+const char *make_model(Scan *s)
+{
+    int found;
+    s->floor=plane_height(s,0,&found);
+    if (!found) warn(s,"floor not seen; using STAGE floor");
+    s->ceiling=plane_height(s,1,&found);
+    if (!found) warn(s,"ceiling not seen");
+    usize bytes=(usize)s->count*sizeof(int);
+    int *ids=io_alloc(bytes),*queue=io_alloc(bytes);
+    if (!ids || !queue) { io_free(ids,bytes);io_free(queue,bytes);return "model allocation failed"; }
+    int n=0;
+    for (int i=0;i<s->count;i++) if (s->cells[i].weight) ids[n++]=i;
+    if (!n) { io_free(ids,bytes);io_free(queue,bytes);return "no surfaces in reconstruction bounds"; }
+    walls(s,ids,n);outline(s,ids,n);
+    const char *error=hint(s);
+    if (!error) furniture(s,ids,n,queue);
+    float perimeter=0,observed=0;
+    for (int i=0;i<s->noutline;i++) {
+        float d=root(distance2(s->outline[i],s->outline[(i+1)%s->noutline]));perimeter+=d;
+        if (!s->invisible[i]) observed+=d;
+    }
+    s->coverage=perimeter ? 100*observed/perimeter : 0;
+    if (s->coverage<LOW_COVERAGE_PERCENT) warn(s,"low wall coverage; scan all walls");
+    io_free(ids,bytes);io_free(queue,bytes);
+    return error;
+}
+
+static int number(char **cursor, float *value)
+{
+    char *p=*cursor;while (*p==' ' || *p=='\t' || *p=='\r') p++;
+    int sign=1,digits=0;if (*p=='-' || *p=='+') { if (*p=='-') sign=-1;p++; }
+    float v=0,scale=1;
+    while (*p>='0' && *p<='9') { v=v*10+*p++-'0';digits++;if(v>10000) return 0; }
+    if (*p=='.') { p++;while (*p>='0' && *p<='9') { scale*=.1f;v+=(*p++-'0')*scale;digits++; } }
+    if(*p=='e' || *p=='E') {
+        p++;int exponent=0,negative=0,edigits=0;
+        if(*p=='-' || *p=='+') { negative=*p=='-';p++; }
+        while(*p>='0' && *p<='9') { exponent=exponent*10+*p++-'0';edigits++;if(exponent>38) return 0; }
+        if(!edigits) return 0;
+        while(exponent--) v=negative ? v*.1f : v*10;
+    }
+    if (!digits || !finite(v) || v>10000) return 0;
+    *value=sign*v;*cursor=p;return 1;
+}
+static const char *hint(Scan *s)
+{
+    if (!s->opt.hint) return 0;
+    int fd=io_open(s->opt.hint,0);
+    if (fd<0) return "cannot open outline hint";
+    char data[8192];usize size=0;
+    for (;;) {
+        long r=io_read(fd,data+size,sizeof(data)-1-size);
+        if (r<0 || (r>0 && size+(usize)r==sizeof(data)-1)) { io_close(fd);return "outline hint too large or unreadable"; }
+        if (!r) break;
+        size+=(usize)r;
+    }
+    io_close(fd);data[size]=0;
+    Pt pts[MAX_OUTLINE];int n=0;char *p=data;
+    while (*p) {
+        while (*p==' ' || *p=='\t' || *p=='\r' || *p=='\n') p++;
+        if (!*p) break;
+        if (*p=='#') { while (*p && *p!='\n') p++;continue; }
+        if (n==MAX_OUTLINE || !number(&p,&pts[n].x) || !number(&p,&pts[n].z)) return "invalid outline hint";
+        n++;while (*p==' ' || *p=='\t' || *p=='\r') p++;
+        if (*p && *p!='\n' && *p!='#') return "invalid outline hint";
+        if (*p=='#') while (*p && *p!='\n') p++;
+    }
+    if (n<3) return "outline hint needs at least three points";
+    Pt centre={0};for (int i=0;i<n;i++) { centre.x+=pts[i].x/n;centre.z+=pts[i].z/n; }
+    float mean=0,variance=0;
+    for (int i=0;i<n;i++) mean+=root(distance2(pts[i],centre))/n;
+    for (int i=0;i<n;i++) { float r=root(distance2(pts[i],centre))-mean;variance+=r*r/n; }
+    if (n>=DEFAULT_CIRCLE_MIN_POINTS && root(variance)<mean*DEFAULT_CIRCLE_RADIAL_CV) {
+        warn(s,"default circle hint ignored");return 0;
+    }
+    int missing=0;for(int i=0;i<s->noutline;i++) missing+=s->invisible[i];
+    if (!missing) return 0;
+    Pt saved[MAX_OUTLINE];int inv[MAX_OUTLINE],old=s->noutline;
+    memcpy(saved,s->outline,sizeof(saved));memcpy(inv,s->invisible,sizeof(inv));
+    float area=0;for(int i=0;i<n;i++) area+=pts[i].x*pts[(i+1)%n].z-pts[(i+1)%n].x*pts[i].z;
+    s->noutline=n;
+    for(int i=0;i<n;i++) { s->outline[i]=pts[area>0 ? i : n-1-i];s->invisible[i]=1; }
+    if (!valid_polygon(s)) {
+        memcpy(s->outline,saved,sizeof(saved));memcpy(s->invisible,inv,sizeof(inv));s->noutline=old;
+        return "invalid outline hint polygon";
+    }
+    /* Only use a hint compatible with every observed wall. Chaperone can be an inset play area. */
+    for(int i=0;i<s->nplanes;i++) {
+        Plane *w=&s->planes[i];int match=0;
+        for(int k=0;k<n;k++) {
+            Pt a=s->outline[k],b=s->outline[(k+1)%n];
+            if(ab(a.x*w->n.x+a.z*w->n.z-w->d)<s->opt.gap &&
+               ab(b.x*w->n.x+b.z*w->n.z-w->d)<s->opt.gap) { match=1;s->invisible[k]=0; }
+        }
+        if (!match) {
+            memcpy(s->outline,saved,sizeof(saved));memcpy(s->invisible,inv,sizeof(inv));s->noutline=old;
+            warn(s,"hint disagrees with observed walls; ignored");return 0;
+        }
+    }
+    s->hint_used=1;warn(s,"incomplete walls closed using outline hint");return 0;
+}

native/roomscan/platform.c

@@ -0,0 +1,145 @@
+/* SPDX-License-Identifier: GPL-3.0-only */
+#include "platform.h"
+
+#ifdef FP_HOSTED
+#define _DEFAULT_SOURCE 1
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <sys/mman.h>
+#include <sys/random.h>
+#include <sys/stat.h>
+#include <time.h>
+#include <unistd.h>
+
+int io_open(const char *p, int w) { return open(p, w ? O_WRONLY|O_CREAT|O_EXCL|O_NOFOLLOW : O_RDONLY, 0600); }
+long io_read(int fd, void *p, usize n)
+{
+    long r;
+    do r = read(fd, p, n); while (r < 0 && errno == EINTR);
+    return r;
+}
+static long put(int fd, const void *p, usize n)
+{
+    long r;
+    do r = write(fd, p, n); while (r < 0 && errno == EINTR);
+    return r;
+}
+int io_close(int fd) { return close(fd); }
+int io_rename(const char *a, const char *b) { return rename(a, b); }
+void io_remove(const char *p) { unlink(p); }
+int io_mkdir(const char *p) { return mkdir(p, 0700) == 0 || errno == EEXIST; }
+void *io_alloc(usize n)
+{
+    void *p = mmap(0, n, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
+    return p == MAP_FAILED ? 0 : p;
+}
+void io_free(void *p, usize n) { if (p) munmap(p, n); }
+int io_random(void *p, usize n)
+{
+    usize done = 0;
+    while (done < n) {
+        long r = getrandom((u8 *)p + done, n - done, 0);
+        if (r < 0 && errno == EINTR) continue;
+        if (r <= 0) return 0;
+        done += (usize)r;
+    }
+    return 1;
+}
+i64 io_time(int mono)
+{
+    struct timespec t;
+    if (clock_gettime(mono ? CLOCK_MONOTONIC : CLOCK_REALTIME, &t)) return 0;
+    return (i64)t.tv_sec * 1000000000 + t.tv_nsec;
+}
+#else
+/* asm-generic Linux syscall numbers: this target has no libc or UAPI dependency. */
+static long call(long n, long a, long b, long c, long d, long e, long f)
+{
+    register long x8 __asm__("x8") = n;
+    register long x0 __asm__("x0") = a;
+    register long x1 __asm__("x1") = b;
+    register long x2 __asm__("x2") = c;
+    register long x3 __asm__("x3") = d;
+    register long x4 __asm__("x4") = e;
+    register long x5 __asm__("x5") = f;
+    __asm__ volatile("svc #0" : "+r"(x0) : "r"(x8), "r"(x1), "r"(x2), "r"(x3), "r"(x4), "r"(x5) : "memory", "cc");
+    return x0;
+}
+int io_open(const char *p, int w) { return (int)call(56, -100, (long)p, w ? 1|64|128|131072 : 0, 0600, 0, 0); }
+long io_read(int fd, void *p, usize n)
+{
+    long r;
+    do r = call(63, fd, (long)p, (long)n, 0, 0, 0); while (r == -4);
+    return r;
+}
+static long put(int fd, const void *p, usize n)
+{
+    long r;
+    do r = call(64, fd, (long)p, (long)n, 0, 0, 0); while (r == -4);
+    return r;
+}
+int io_close(int fd) { return (int)call(57, fd, 0, 0, 0, 0, 0); }
+int io_rename(const char *a, const char *b) { return (int)call(38, -100, (long)a, -100, (long)b, 0, 0); }
+void io_remove(const char *p) { call(35, -100, (long)p, 0, 0, 0, 0); }
+int io_mkdir(const char *p)
+{
+    long r = call(34, -100, (long)p, 0700, 0, 0, 0);
+    return r == 0 || r == -17;
+}
+void *io_alloc(usize n)
+{
+    long p = call(222, 0, (long)n, 3, 0x22, -1, 0);
+    return (unsigned long)p > (unsigned long)-4096 ? 0 : (void *)p;
+}
+void io_free(void *p, usize n) { if (p) call(215, (long)p, (long)n, 0, 0, 0, 0); }
+int io_random(void *p, usize n)
+{
+    usize done = 0;
+    while (done < n) {
+        long r = call(278, (long)((u8 *)p + done), (long)(n - done), 0, 0, 0, 0);
+        if (r == -4) continue;
+        if (r <= 0) return 0;
+        done += (usize)r;
+    }
+    return 1;
+}
+i64 io_time(int mono)
+{
+    struct { long sec, ns; } t = {0, 0};
+    call(113, mono ? 1 : 0, (long)&t, 0, 0, 0, 0);
+    return (i64)t.sec * 1000000000 + t.ns;
+}
+void *memcpy(void *d, const void *s, usize n)
+{
+    u8 *a = d;
+    const u8 *b = s;
+    while (n--) *a++ = *b++;
+    return d;
+}
+void *memset(void *d, int c, usize n)
+{
+    u8 *a = d;
+    while (n--) *a++ = (u8)c;
+    return d;
+}
+extern int main(int argc, char **argv);
+__attribute__((used, noreturn)) void start_c(long *sp)
+{
+    int code = main((int)sp[0], (char **)(sp + 1));
+    for (;;) call(94, code, 0, 0, 0, 0, 0);
+}
+__asm__(".text\n.global _start\n.type _start,%function\n_start:\n"
+        "mov x29,#0\nmov x30,#0\nmov x0,sp\nbl start_c\nbrk #0\n");
+#endif
+
+int io_write(int fd, const void *p, usize n)
+{
+    while (n) {
+        long r = put(fd, p, n);
+        if (r <= 0) return 0;
+        p = (const u8 *)p + r;
+        n -= (usize)r;
+    }
+    return 1;
+}

native/roomscan/platform.h

@@ -0,0 +1,25 @@
+/* SPDX-License-Identifier: GPL-3.0-only */
+#ifndef FP_ROOMSCAN_PLATFORM_H
+#define FP_ROOMSCAN_PLATFORM_H
+
+/* The reconstruction sources use only this boundary, on Linux and in hosted tests. */
+typedef __SIZE_TYPE__ usize;
+typedef unsigned char u8;
+typedef unsigned int u32;
+typedef unsigned long long u64;
+typedef long long i64;
+int io_open(const char *path, int write);
+long io_read(int fd, void *data, usize size);
+int io_write(int fd, const void *data, usize size);
+int io_close(int fd);
+int io_rename(const char *old, const char *new);
+void io_remove(const char *path);
+int io_mkdir(const char *path);
+void *io_alloc(usize size);
+void io_free(void *data, usize size);
+int io_random(void *data, usize size);
+i64 io_time(int monotonic);
+void *memcpy(void *dst, const void *src, usize size);
+void *memset(void *dst, int value, usize size);
+
+#endif

native/roomscan/scan.h

@@ -0,0 +1,93 @@
+/* SPDX-License-Identifier: GPL-3.0-only */
+#ifndef FP_ROOMSCAN_H
+#define FP_ROOMSCAN_H
+#include "platform.h"
+
+/* Resource limits are independent of dump length. Two passes avoid retaining frames. */
+#define MAX_FRAME_VERTICES 1000000u
+#define MAX_FRAME_INDICES 3000000u
+#define MAX_CELLS 4200000u
+#define MAX_SAMPLES 32768
+#define MAX_PLANES 32
+#define MAX_OUTLINE 96
+#define MAX_VOLUMES 128
+#define MAX_TRIANGLES 200000
+#define MAX_MESH_VERTICES 600000
+#define PI 3.14159265358979323846f
+
+typedef struct { float x, y, z; } Vec;
+typedef struct { float x, z; } Pt;
+typedef struct {
+    Vec p, n;
+    float weight, sdf, sw;
+    int mark;
+    unsigned views, last_frame;
+} Cell;
+typedef struct {
+    Vec n;
+    float d, lo, hi, bottom, top, area;
+    int used;
+} Plane;
+typedef struct { Vec p; float yaw, w, d, h; const char *label; } Volume;
+typedef struct {
+    const char *input, *out, *hint;
+    u64 universe;
+    float voxel, ceiling_default, truncation, max_edge, grazing, range, depth_jump, depth_ratio, min_views;
+    float patch_residual;
+    float plane_distance, min_plane_area, wall_height, snap_degrees;
+    float floor_band, ceiling_min, min_volume, cluster_gap, gap, horizontal;
+} Options;
+typedef struct {
+    Options opt;
+    Cell *cells;
+    int nx, ny, nz, count;
+    Vec origin;
+    Vec samples[MAX_SAMPLES];
+    int nsamples;
+    u64 seen, accepted, rejected, clipped, far_vertices, discontinuities;
+    unsigned frames, skipped_frames, fuse_frame;
+    Plane planes[MAX_PLANES];
+    int nplanes;
+    Pt outline[MAX_OUTLINE];
+    int invisible[MAX_OUTLINE], noutline;
+    Volume volumes[MAX_VOLUMES];
+    int nvolumes;
+    float floor, ceiling, coverage;
+    const char *warnings[24];
+    int nwarnings, hint_used;
+    u32 rng;
+    Vec *vertices;
+    u32 *indices;
+    int nv, ni;
+    i64 t0, tread, tfuse, tmodel, tmesh;
+} Scan;
+
+static inline float ab(float x) { return x < 0 ? -x : x; }
+static inline float mn(float a, float b) { return a < b ? a : b; }
+static inline float mx(float a, float b) { return a > b ? a : b; }
+static inline float clamp(float x, float a, float b) { return mn(mx(x, a), b); }
+static inline Vec vec(float x, float y, float z) { return (Vec){x,y,z}; }
+static inline Vec add(Vec a, Vec b) { return vec(a.x+b.x,a.y+b.y,a.z+b.z); }
+static inline Vec sub(Vec a, Vec b) { return vec(a.x-b.x,a.y-b.y,a.z-b.z); }
+static inline Vec mul(Vec a, float b) { return vec(a.x*b,a.y*b,a.z*b); }
+static inline float dot(Vec a, Vec b) { return a.x*b.x+a.y*b.y+a.z*b.z; }
+static inline Vec cross(Vec a, Vec b) { return vec(a.y*b.z-a.z*b.y,a.z*b.x-a.x*b.z,a.x*b.y-a.y*b.x); }
+static inline int finite(float x) { return x == x && ab(x) < 1e20f; }
+float root(float x);
+float sine(float x);
+float cosine(float x);
+float angle(float y, float x);
+Vec unit(Vec p);
+int flo(float x);
+u32 random_next(Scan *s);
+void warn(Scan *s, const char *message);
+int cell_index(Scan *s, Vec p);
+Vec grid_point(Scan *s, int x, int y, int z);
+const char *read_dump(Scan *s, int fuse);
+const char *init_grid(Scan *s);
+void finish_fusion(Scan *s);
+const char *make_model(Scan *s);
+const char *make_mesh(Scan *s);
+int same(const char *a, const char *b);
+
+#endif

native/vkshim/pipeline_log.h

@@ -1,207 +0,0 @@
-// SPDX-License-Identifier: GPL-3.0-only
-// Pipeline log for the Vulkan shim (adapter setting vk_pipeline_log=1, diagnostics; GitHub #349): when
-// vkCreateGraphicsPipelines / vkCreateComputePipelines fail (a result other than VK_SUCCESS, or a NULL pipeline), the
-// create infos are logged: per pipeline its flags, layout, render pass/subpass, the pNext structure types, sample count
-// and vertex formats, and per stage its stage bit, shader module (as the vk_shader_dump file name <size>_<sha256>.spv,
-// remembered at vkCreateShaderModule), entry point and pNext types. Sampler Y'CbCr conversions are followed through
-// samplers, descriptor set layouts (immutable samplers) and pipeline layouts, so a failing pipeline says whether it
-// samples through one ("ycbcr"). Conversions and samplers using one are logged when created.
-// Unreal treats a NULL pipeline as "Shader compilation failures are Fatal." (PipelineStateCache.cpp) without saying
-// why; this names the pipeline. Needs LOG(...), sha256() and readable() before inclusion (vkshim.c; the host test in
-// tests/test_vk_pipeline_log.py provides its own).
-#pragma once
-#include <inttypes.h>
-#include <pthread.h>
-#include <stdint.h>
-#include <stdio.h>
-#include <string.h>
-#include <vulkan/vulkan.h>
-
-#define PL_MODULES 16384  // shader modules remembered (a power of two)
-#define PL_SET 4096       // handles per kind that involve a Y'CbCr conversion (a power of two)
-static int pl_on;         // vk_pipeline_log
-static pthread_mutex_t pl_lock = PTHREAD_MUTEX_INITIALIZER;
-static struct { uint64_t handle; uint32_t size; uint8_t sha[32]; } pl_modules[PL_MODULES];
-enum { PL_CONV, PL_SAMPLER, PL_SET_LAYOUT, PL_LAYOUT, PL_KINDS };
-static uint64_t pl_sets[PL_KINDS][PL_SET];  // 0 = empty
-static unsigned pl_created, pl_failed, pl_logged_ycbcr;
-
-static unsigned pl_hash(uint64_t h, unsigned mask) { return (unsigned)((h * 0x9E3779B97F4A7C15ull) >> 40) & mask; }
-
-static void pl_module_add(VkShaderModule module, const uint32_t *code, size_t size) {
-    uint64_t h = (uint64_t)module;
-    if (!h || !code) return;
-    uint8_t digest[32];
-    sha256((const uint8_t *)code, size, digest);
-    pthread_mutex_lock(&pl_lock);
-    for (unsigned i = pl_hash(h, PL_MODULES - 1), n = 0; n < PL_MODULES; i = (i + 1) & (PL_MODULES - 1), n++) {
-        if (pl_modules[i].handle && pl_modules[i].handle != h) continue;
-        pl_modules[i].handle = h;  // a handle reused after vkDestroyShaderModule is simply overwritten
-        pl_modules[i].size = (uint32_t)size;
-        memcpy(pl_modules[i].sha, digest, 32);
-        break;
-    }
-    pthread_mutex_unlock(&pl_lock);
-}
-
-// "<size>_<sha256>.spv" of a module, else "unknown(0x...)" / "none"
-static void pl_module_name(VkShaderModule module, char *out, size_t cap) {
-    uint64_t h = (uint64_t)module;
-    if (!h) { snprintf(out, cap, "none"); return; }
-    snprintf(out, cap, "unknown(0x%" PRIx64 ")", h);
-    pthread_mutex_lock(&pl_lock);
-    for (unsigned i = pl_hash(h, PL_MODULES - 1), n = 0; n < PL_MODULES && pl_modules[i].handle;
-         i = (i + 1) & (PL_MODULES - 1), n++) {
-        if (pl_modules[i].handle != h) continue;
-        int len = snprintf(out, cap, "%u_", pl_modules[i].size);
-        for (int b = 0; b < 32 && len > 0 && (size_t)len < cap; b++)
-            len += snprintf(out + len, cap - (size_t)len, "%02x", pl_modules[i].sha[b]);
-        if (len > 0 && (size_t)len < cap) snprintf(out + len, cap - (size_t)len, ".spv");
-        break;
-    }
-    pthread_mutex_unlock(&pl_lock);
-}
-
-static void pl_set_add(int kind, uint64_t h) {
-    if (!h) return;
-    pthread_mutex_lock(&pl_lock);
-    for (unsigned i = pl_hash(h, PL_SET - 1), n = 0; n < PL_SET; i = (i + 1) & (PL_SET - 1), n++)
-        if (!pl_sets[kind][i] || pl_sets[kind][i] == h) { pl_sets[kind][i] = h; break; }
-    pthread_mutex_unlock(&pl_lock);
-}
-
-static int pl_set_has(int kind, uint64_t h) {
-    if (!h) return 0;
-    int found = 0;
-    pthread_mutex_lock(&pl_lock);
-    for (unsigned i = pl_hash(h, PL_SET - 1), n = 0; n < PL_SET && pl_sets[kind][i]; i = (i + 1) & (PL_SET - 1), n++)
-        if (pl_sets[kind][i] == h) { found = 1; break; }
-    pthread_mutex_unlock(&pl_lock);
-    return found;
-}
-
-// The sTypes of a pNext chain, e.g. " 1000053000,1000044002" (at most 8; "!" marks an unreadable link)
-static void pl_chain(const void *next, char *out, size_t cap) {
-    size_t len = 0;
-    out[0] = 0;
-    for (int n = 0; next && n < 8 && len + 16 < cap; n++) {
-        if (!readable(next, sizeof(VkBaseInStructure))) { snprintf(out + len, cap - len, "%s!", n ? "," : " "); return; }
-        const VkBaseInStructure *b = next;
-        len += (size_t)snprintf(out + len, cap - len, "%s%u", n ? "," : " ", (unsigned)b->sType);
-        next = b->pNext;
-    }
-}
-
-// A Y'CbCr conversion in a sampler's pNext chain (VkSamplerYcbcrConversionInfo), else 0
-static uint64_t pl_sampler_conversion(const VkSamplerCreateInfo *ci) {
-    for (const VkBaseInStructure *b = ci ? ci->pNext : NULL; b; b = b->pNext) {
-        if (!readable(b, sizeof *b)) return 0;
-        if (b->sType == VK_STRUCTURE_TYPE_SAMPLER_YCBCR_CONVERSION_INFO)
-            return (uint64_t)((const VkSamplerYcbcrConversionInfo *)b)->conversion;
-    }
-    return 0;
-}
-
-static void pl_conversion_created(const VkSamplerYcbcrConversionCreateInfo *ci, VkResult r, VkSamplerYcbcrConversion c) {
-    uint64_t external = 0;
-    for (const VkBaseInStructure *b = ci ? ci->pNext : NULL; b; b = b->pNext) {
-        if (!readable(b, sizeof *b)) break;
-        if (b->sType == 1000129005 /* VK_STRUCTURE_TYPE_EXTERNAL_FORMAT_ANDROID */)
-            external = ((const struct { VkStructureType s; const void *n; uint64_t f; } *)(const void *)b)->f;
-    }
-    if (r == VK_SUCCESS) pl_set_add(PL_CONV, (uint64_t)c);
-    if (pl_logged_ycbcr++ < 20 && ci)
-        LOG("vk shim: vkCreateSamplerYcbcrConversion format %d externalFormat 0x%" PRIx64 " model %d range %d "
-            "chroma offsets %d/%d filter %d explicit %u: %d -> 0x%" PRIx64, ci->format, external, ci->ycbcrModel,
-            ci->ycbcrRange, ci->xChromaOffset, ci->yChromaOffset, ci->chromaFilter, ci->forceExplicitReconstruction, r,
-            r == VK_SUCCESS ? (uint64_t)c : 0);
-}
-
-static void pl_sampler_created(const VkSamplerCreateInfo *ci, VkResult r, VkSampler s) {
-    uint64_t conv = pl_sampler_conversion(ci);
-    if (!conv) return;
-    if (r == VK_SUCCESS) pl_set_add(PL_SAMPLER, (uint64_t)s);
-    if (pl_logged_ycbcr++ < 20)
-        LOG("vk shim: vkCreateSampler with Y'CbCr conversion 0x%" PRIx64 "%s: %d", conv,
-            pl_set_has(PL_CONV, conv) ? "" : " (not created through the shim)", r);
-}
-
-static void pl_set_layout_created(const VkDescriptorSetLayoutCreateInfo *ci, VkResult r, VkDescriptorSetLayout l) {
-    if (r != VK_SUCCESS || !ci || !ci->pBindings) return;
-    for (uint32_t i = 0; i < ci->bindingCount; i++) {
-        const VkDescriptorSetLayoutBinding *b = &ci->pBindings[i];
-        if (!b->pImmutableSamplers) continue;
-        for (uint32_t j = 0; j < b->descriptorCount; j++)
-            if (pl_set_has(PL_SAMPLER, (uint64_t)b->pImmutableSamplers[j])) {
-                pl_set_add(PL_SET_LAYOUT, (uint64_t)l);
-                return;
-            }
-    }
-}
-
-static void pl_layout_created(const VkPipelineLayoutCreateInfo *ci, VkResult r, VkPipelineLayout l) {
-    if (r != VK_SUCCESS || !ci || !ci->pSetLayouts) return;
-    for (uint32_t i = 0; i < ci->setLayoutCount; i++)
-        if (pl_set_has(PL_SET_LAYOUT, (uint64_t)ci->pSetLayouts[i])) { pl_set_add(PL_LAYOUT, (uint64_t)l); return; }
-}
-
-static void pl_stage(int index, const VkPipelineShaderStageCreateInfo *s) {
-    char module[96], chain[128];
-    pl_module_name(s->module, module, sizeof module);
-    pl_chain(s->pNext, chain, sizeof chain);
-    LOG("vk shim:   [%d] stage 0x%x module %s entry %s flags 0x%x specialization %u pNext%s", index, s->stage, module,
-        s->pName && readable(s->pName, 1) ? s->pName : "?", s->flags,
-        s->pSpecializationInfo ? s->pSpecializationInfo->mapEntryCount : 0, chain[0] ? chain : " -");
-}
-
-// Called after vkCreateGraphicsPipelines; logs only failures (and a running count now and then)
-static void pl_graphics(uint32_t count, const VkGraphicsPipelineCreateInfo *ci, const VkPipeline *out, VkResult r) {
-    int bad = r != VK_SUCCESS;
-    for (uint32_t i = 0; !bad && out && i < count; i++) bad = !out[i];
-    pthread_mutex_lock(&pl_lock);
-    unsigned created = bad ? pl_created : (pl_created += count), failed = bad ? ++pl_failed : pl_failed;
-    pthread_mutex_unlock(&pl_lock);
-    if (!bad) {
-        if (created == count || created / 500 != (created - count) / 500)
-            LOG("vk shim: %u pipeline(s) created so far, %u failed call(s)", created, failed);
-        return;
-    }
-    if (failed > 50) return;
-    LOG("vk shim: vkCreateGraphicsPipelines failed: %d (%u pipeline(s); failure %u)", r, count, failed);
-    for (uint32_t i = 0; ci && i < count && i < 8; i++) {
-        const VkGraphicsPipelineCreateInfo *p = &ci[i];
-        char chain[128], formats[160] = "";
-        pl_chain(p->pNext, chain, sizeof chain);
-        const VkPipelineVertexInputStateCreateInfo *vi = p->pVertexInputState;
-        size_t len = 0;
-        for (uint32_t a = 0; vi && vi->pVertexAttributeDescriptions && a < vi->vertexAttributeDescriptionCount &&
-                             len + 12 < sizeof formats; a++)
-            len += (size_t)snprintf(formats + len, sizeof formats - len, "%s%d", a ? "," : "",
-                                    vi->pVertexAttributeDescriptions[a].format);
-        LOG("vk shim: pipeline %u: %s flags 0x%x layout 0x%" PRIx64 "%s renderPass 0x%" PRIx64 " subpass %u samples %d "
-            "colour attachments %u vertex formats [%s] pNext%s", i, out && out[i] ? "ok" : "NULL", p->flags,
-            (uint64_t)p->layout, pl_set_has(PL_LAYOUT, (uint64_t)p->layout) ? " (ycbcr)" : "", (uint64_t)p->renderPass,
-            p->subpass, p->pMultisampleState ? (int)p->pMultisampleState->rasterizationSamples : 0,
-            p->pColorBlendState ? p->pColorBlendState->attachmentCount : 0, formats, chain[0] ? chain : " -");
-        for (uint32_t s = 0; p->pStages && s < p->stageCount && s < 6; s++) pl_stage((int)s, &p->pStages[s]);
-    }
-}
-
-static void pl_compute(uint32_t count, const VkComputePipelineCreateInfo *ci, const VkPipeline *out, VkResult r) {
-    int bad = r != VK_SUCCESS;
-    for (uint32_t i = 0; !bad && out && i < count; i++) bad = !out[i];
-    if (!bad) return;
-    pthread_mutex_lock(&pl_lock);
-    unsigned failed = ++pl_failed;
-    pthread_mutex_unlock(&pl_lock);
-    if (failed > 50) return;
-    LOG("vk shim: vkCreateComputePipelines failed: %d (%u pipeline(s); failure %u)", r, count, failed);
-    for (uint32_t i = 0; ci && i < count && i < 8; i++) {
-        char chain[128];
-        pl_chain(ci[i].pNext, chain, sizeof chain);
-        LOG("vk shim: pipeline %u: %s flags 0x%x layout 0x%" PRIx64 "%s pNext%s", i, out && out[i] ? "ok" : "NULL",
-            ci[i].flags, (uint64_t)ci[i].layout, pl_set_has(PL_LAYOUT, (uint64_t)ci[i].layout) ? " (ycbcr)" : "",
-            chain[0] ? chain : " -");
-        pl_stage(0, &ci[i].stage);
-    }
-}

native/vkshim/vkshim.c

@@ -18,8 +18,6 @@
 // Shader dump (vk_shader_dump=1, diagnostics): every distinct module the game creates is written once to the app's
 // files/fp_vk_shaders/ with an index of every creation (order, time), to find the shader behind a GPU hang
 // (shader_dump.h).
-// Pipeline log (vk_pipeline_log=1, diagnostics): failing vkCreateGraphicsPipelines/vkCreateComputePipelines calls are
-// logged with their stages' modules (vk_shader_dump names) and any sampler Y'CbCr conversion involved (pipeline_log.h).
 //
 // Query slots (adapter setting vk_query_slots=2, per game): with multiview, Vulkan counts a query that runs in a
 // multiview render pass as one query per view (N consecutive indices). Mesa's drivers (the Frame's Turnip) write a
@@ -105,7 +103,6 @@ static int spec_fixes;       // vk_spec_fixes: make two Unreal habits valid Vulk
 static int validation;       // vk_validation: add Khronos' validation layer (bundled in the APK) to the instance
 static int hide_fdm;         // vk_hide_fdm: the game doesn't see VK_EXT_fragment_density_map(2)
 static int want_dump;        // vk_shader_dump: write the game's SPIR-V modules to files/fp_vk_shaders/
-static int want_pipeline_log;  // vk_pipeline_log: log failing pipeline creations (pipeline_log.h)
 static char app_files[400];  // /sdcard/Android/data/<package>/files
 
 static void read_settings(const char *path) {
@@ -118,7 +115,6 @@ static void read_settings(const char *path) {
         if (!strncmp(line, "vk_hide_fdm=", 12)) hide_fdm = atoi(line + 12) != 0;
         if (!strncmp(line, "vk_spec_fixes=", 14)) spec_fixes = atoi(line + 14) != 0;
         if (!strncmp(line, "vk_shader_dump=", 15)) want_dump = atoi(line + 15) != 0;
-        if (!strncmp(line, "vk_pipeline_log=", 16)) want_pipeline_log = atoi(line + 16) != 0;
         if (!strncmp(line, "vk_query_slots=", 15)) {
             int v = atoi(line + 15);
             query_slots = v == 1 ? 2 : v >= 2 && v <= 4 ? v : 1;  // 1 = on (the settings dialog's switch) = 2 slots
@@ -159,10 +155,8 @@ static void read_all_settings(void) {
     if (env && *env) read_settings(env);
 }
 
-static int readable(const void *p, size_t n);
 #include "sha256.h"  // only run for modules whose size matches a fix, or every module with vk_shader_dump
 #include "shader_dump.h"
-#include "pipeline_log.h"
 
 // The fixed copy of `code` (caller frees) and its size, or NULL when no fix matches.
 static uint32_t *fixed_shader(const uint32_t *code, size_t size, size_t *out_size) {
@@ -190,10 +184,6 @@ static void init(void) {
     if (validation) LOG("vk shim: adding %s to the instance", VALIDATION_LAYER);
     if (hide_fdm) LOG("vk shim: fragment density map extensions hidden from the game");
     if (want_dump && !dump_init(app_files)) LOG("vk shim: shader dump not possible (no package name or files dir)");
-    if (want_pipeline_log) {
-        pl_on = 1;
-        LOG("vk shim: logging failed pipeline creations and sampler Y'CbCr conversions");
-    }
     if (spec_fixes) LOG("vk shim: Vulkan spec fixes on (depth images can be cleared, no depth resolve in shader-resolve "
                         "subpasses)");
     real_vk = dlopen("libvulkan.so", RTLD_NOW | RTLD_LOCAL);
@@ -411,15 +401,12 @@ static VkRenderPassCreateInfo2 clean_create_info(Arena *a, const VkRenderPassCre
 
 #define MAX_DEVICES 8
 enum { FN_RP2, FN_RP2KHR, FN_CSM, FN_CIMG, FN_CQP, FN_DQP, FN_BQ, FN_EQ, FN_CRQP, FN_RQP, FN_RQPEXT, FN_GQPR, FN_CCQPR,
-      FN_PB, FN_PB2, FN_PB2KHR, FN_EDEP, FN_CDEV, FN_CIV, FN_CGP, FN_CCP, FN_CSAMP, FN_CDSL, FN_CPL, FN_CYC, FN_CYCKHR,
-      FN_COUNT };
+      FN_PB, FN_PB2, FN_PB2KHR, FN_EDEP, FN_CDEV, FN_CIV, FN_COUNT };
 static const char *const FN_NAMES[FN_COUNT] = {
     "vkCreateRenderPass2", "vkCreateRenderPass2KHR", "vkCreateShaderModule", "vkCreateImage", "vkCreateQueryPool", "vkDestroyQueryPool",
     "vkCmdBeginQuery", "vkCmdEndQuery", "vkCmdResetQueryPool", "vkResetQueryPool", "vkResetQueryPoolEXT",
     "vkGetQueryPoolResults", "vkCmdCopyQueryPoolResults", "vkCmdPipelineBarrier", "vkCmdPipelineBarrier2",
-    "vkCmdPipelineBarrier2KHR", "vkEnumerateDeviceExtensionProperties", "vkCreateDevice", "vkCreateImageView",
-    "vkCreateGraphicsPipelines", "vkCreateComputePipelines", "vkCreateSampler", "vkCreateDescriptorSetLayout",
-    "vkCreatePipelineLayout", "vkCreateSamplerYcbcrConversion", "vkCreateSamplerYcbcrConversionKHR"};
+    "vkCmdPipelineBarrier2KHR", "vkEnumerateDeviceExtensionProperties", "vkCreateDevice", "vkCreateImageView"};
 static struct { VkDevice device; PFN_vkVoidFunction fn[FN_COUNT]; } devices[MAX_DEVICES];
 static PFN_vkCreateRenderPass2 fallback_rp2khr;  // from vkGetInstanceProcAddr
 static pthread_mutex_t dev_lock = PTHREAD_MUTEX_INITIALIZER;
@@ -481,19 +468,11 @@ EXPORT VKAPI_ATTR VkResult VKAPI_CALL vkCreateShaderModule(VkDevice device, cons
     if (dump_on && ci) dump_module(ci->pCode, ci->codeSize);  // the game's own module, before any fix
     size_t size = 0;
     uint32_t *code = nfixes && ci && ci->pCode ? fixed_shader(ci->pCode, ci->codeSize, &size) : NULL;
-    if (!code) {
-        VkResult r = real(device, ci, alloc, module);
-        if (pl_on && ci && module) {
-            if (r == VK_SUCCESS) pl_module_add(*module, ci->pCode, ci->codeSize);
-            else LOG("vk shim: vkCreateShaderModule failed: %d (%zu bytes)", r, ci->codeSize);
-        }
-        return r;
-    }
+    if (!code) return real(device, ci, alloc, module);
     VkShaderModuleCreateInfo copy = *ci;  // the caller's create info and code stay untouched
     copy.codeSize = size;
     copy.pCode = code;
     VkResult r = real(device, &copy, alloc, module);
-    if (pl_on && module && r == VK_SUCCESS) pl_module_add(*module, ci->pCode, ci->codeSize);  // named as the game's
     free(code);
     if (fixes_applied++ < 20) LOG("vk shim: fixed shader module (%zu -> %zu bytes): %d", ci->codeSize, size, r);
     return r;
@@ -866,72 +845,6 @@ static VKAPI_ATTR void VKAPI_CALL cmd_pipeline_barrier2_khr(VkCommandBuffer cb,
     pipeline_barrier2(cb, info, FN_PB2KHR);
 }
 
-// ---------------------------------------------------------------- pipeline log (vk_pipeline_log, diagnostics)
-
-static VKAPI_ATTR VkResult VKAPI_CALL create_graphics_pipelines(VkDevice device, VkPipelineCache cache, uint32_t count,
-                                                               const VkGraphicsPipelineCreateInfo *ci,
-                                                               const VkAllocationCallbacks *alloc, VkPipeline *out) {
-    PFN_vkCreateGraphicsPipelines real = (PFN_vkCreateGraphicsPipelines)any_fn(device, FN_CGP);
-    if (!real) return VK_ERROR_INITIALIZATION_FAILED;
-    VkResult r = real(device, cache, count, ci, alloc, out);
-    pl_graphics(count, ci, out, r);
-    return r;
-}
-
-static VKAPI_ATTR VkResult VKAPI_CALL create_compute_pipelines(VkDevice device, VkPipelineCache cache, uint32_t count,
-                                                              const VkComputePipelineCreateInfo *ci,
-                                                              const VkAllocationCallbacks *alloc, VkPipeline *out) {
-    PFN_vkCreateComputePipelines real = (PFN_vkCreateComputePipelines)any_fn(device, FN_CCP);
-    if (!real) return VK_ERROR_INITIALIZATION_FAILED;
-    VkResult r = real(device, cache, count, ci, alloc, out);
-    pl_compute(count, ci, out, r);
-    return r;
-}
-
-static VKAPI_ATTR VkResult VKAPI_CALL create_sampler(VkDevice device, const VkSamplerCreateInfo *ci,
-                                                    const VkAllocationCallbacks *alloc, VkSampler *sampler) {
-    PFN_vkCreateSampler real = (PFN_vkCreateSampler)any_fn(device, FN_CSAMP);
-    if (!real) return VK_ERROR_INITIALIZATION_FAILED;
-    VkResult r = real(device, ci, alloc, sampler);
-    pl_sampler_created(ci, r, sampler ? *sampler : VK_NULL_HANDLE);
-    return r;
-}
-
-static VKAPI_ATTR VkResult VKAPI_CALL create_set_layout(VkDevice device, const VkDescriptorSetLayoutCreateInfo *ci,
-                                                       const VkAllocationCallbacks *alloc, VkDescriptorSetLayout *l) {
-    PFN_vkCreateDescriptorSetLayout real = (PFN_vkCreateDescriptorSetLayout)any_fn(device, FN_CDSL);
-    if (!real) return VK_ERROR_INITIALIZATION_FAILED;
-    VkResult r = real(device, ci, alloc, l);
-    pl_set_layout_created(ci, r, l ? *l : VK_NULL_HANDLE);
-    return r;
-}
-
-static VKAPI_ATTR VkResult VKAPI_CALL create_pipeline_layout(VkDevice device, const VkPipelineLayoutCreateInfo *ci,
-                                                            const VkAllocationCallbacks *alloc, VkPipelineLayout *l) {
-    PFN_vkCreatePipelineLayout real = (PFN_vkCreatePipelineLayout)any_fn(device, FN_CPL);
-    if (!real) return VK_ERROR_INITIALIZATION_FAILED;
-    VkResult r = real(device, ci, alloc, l);
-    pl_layout_created(ci, r, l ? *l : VK_NULL_HANDLE);
-    return r;
-}
-
-static VkResult create_conversion(VkDevice device, const VkSamplerYcbcrConversionCreateInfo *ci,
-                                  const VkAllocationCallbacks *alloc, VkSamplerYcbcrConversion *c, int which) {
-    PFN_vkCreateSamplerYcbcrConversion real = (PFN_vkCreateSamplerYcbcrConversion)any_fn(device, which);
-    if (!real) return VK_ERROR_INITIALIZATION_FAILED;
-    VkResult r = real(device, ci, alloc, c);
-    pl_conversion_created(ci, r, c ? *c : VK_NULL_HANDLE);
-    return r;
-}
-static VKAPI_ATTR VkResult VKAPI_CALL create_conversion_core(VkDevice d, const VkSamplerYcbcrConversionCreateInfo *ci,
-                                                            const VkAllocationCallbacks *a, VkSamplerYcbcrConversion *c) {
-    return create_conversion(d, ci, a, c, FN_CYC);
-}
-static VKAPI_ATTR VkResult VKAPI_CALL create_conversion_khr(VkDevice d, const VkSamplerYcbcrConversionCreateInfo *ci,
-                                                           const VkAllocationCallbacks *a, VkSamplerYcbcrConversion *c) {
-    return create_conversion(d, ci, a, c, FN_CYCKHR);
-}
-
 static int wrapped_index(const char *name) {
     for (int i = 0; i < FN_COUNT; i++)
         if (!strcmp(name, FN_NAMES[i])) return i;
@@ -942,7 +855,7 @@ static PFN_vkVoidFunction wrap(const char *name) {
     switch (wrapped_index(name)) {
     case FN_RP2: return (PFN_vkVoidFunction)vkCreateRenderPass2;
     case FN_RP2KHR: return (PFN_vkVoidFunction)create_render_pass2_khr;
-    case FN_CSM: return nfixes || dump_on || pl_on ? (PFN_vkVoidFunction)vkCreateShaderModule : NULL;  // else no detour
+    case FN_CSM: return nfixes || dump_on ? (PFN_vkVoidFunction)vkCreateShaderModule : NULL;  // else no detour
     case FN_CIMG: return spec_fixes ? (PFN_vkVoidFunction)create_image : NULL;
     case FN_PB: return spec_fixes ? (PFN_vkVoidFunction)cmd_pipeline_barrier : NULL;
     case FN_PB2: return spec_fixes ? (PFN_vkVoidFunction)cmd_pipeline_barrier2 : NULL;
@@ -950,13 +863,6 @@ static PFN_vkVoidFunction wrap(const char *name) {
     case FN_EDEP: return hide_fdm ? (PFN_vkVoidFunction)vkEnumerateDeviceExtensionProperties : NULL;
     case FN_CDEV: return hide_fdm || spec_fixes ? (PFN_vkVoidFunction)vkCreateDevice : NULL;
     case FN_CIV: return spec_fixes ? (PFN_vkVoidFunction)create_image_view : NULL;
-    case FN_CGP: return pl_on ? (PFN_vkVoidFunction)create_graphics_pipelines : NULL;
-    case FN_CCP: return pl_on ? (PFN_vkVoidFunction)create_compute_pipelines : NULL;
-    case FN_CSAMP: return pl_on ? (PFN_vkVoidFunction)create_sampler : NULL;
-    case FN_CDSL: return pl_on ? (PFN_vkVoidFunction)create_set_layout : NULL;
-    case FN_CPL: return pl_on ? (PFN_vkVoidFunction)create_pipeline_layout : NULL;
-    case FN_CYC: return pl_on ? (PFN_vkVoidFunction)create_conversion_core : NULL;
-    case FN_CYCKHR: return pl_on ? (PFN_vkVoidFunction)create_conversion_khr : NULL;
     default: break;
     }
     if (query_slots < 2) return NULL;  // no query remapping: no detours

native/xrshim/xrshim.c

@@ -7,6 +7,8 @@
 // Meta's OVRPlugin finds xrGetInstanceProcAddr with dlopen("libopenxr_loader.so") + dlsym, so FramePort points that
 // string in libOVRPlugin.so at this library instead (patches/frame/adapter.py). Names the adapter emulates are served
 // by the adapter (framebridge_extension_proc); everything else goes to overport's xrGetInstanceProcAddr unchanged.
+// The adapter also routes scene discovery/persistence/mesh and the core locate/event functions that consume
+// emulated spaces. Keep this name-agnostic: another fixed table here would repeat the dispatcher's limitation.
 //
 // Haptics (GitHub #9, found by Klownicle in Lucky's Tale): overport's dispatcher converts an
 // XrHapticAmplitudeEnvelopeVibrationFB with its nanosecond duration taken as seconds, so one vibration allocates an
@@ -22,8 +24,6 @@
 #include <math.h>
 #include <stddef.h>
 #include <string.h>
-#include <stdlib.h>
-#include "../adapter/hide_fb_foveation.h"
 
 #define TAG "FrameBridge"
 #define EXPORT __attribute__((visibility("default")))
@@ -47,42 +47,14 @@ static void resolve_overport(void) {
 static PFN_xrVoidFunction adapter_proc(const char *name) {
     static PFN_extension_proc fn;
     if (!fn) {
-        // Normally loaded by OVRPort; only the global settings query may load it early.
+        // Loaded by overport's dispatcher once an instance exists; NOLOAD so the shim never loads it by itself.
         void *h = dlopen("libopenxr_loader_generic.so", RTLD_NOW | RTLD_NOLOAD);
-        // Global enumeration can be answered entirely by the dispatcher. Load the
-        // adapter for its settings query even before an OpenXR instance exists.
-        if (!h && !strcmp(name, "framebridge_hide_fb_foveation"))
-            h = dlopen("libopenxr_loader_generic.so", RTLD_NOW | RTLD_LOCAL);
         if (h) fn = (PFN_extension_proc)dlsym(h, "framebridge_extension_proc");
         if (!fn) return NULL;
     }
     return fn(name);
 }
 
-// OVRPort advertises FB extensions itself, above the runtime adapter. Filter the
-// synthetic list too, including when the dispatcher never enumerates the runtime.
-static int hide_fb_enabled(void) {
-    typedef int (*Query)(void);
-    Query query = (Query)adapter_proc("framebridge_hide_fb_foveation");
-    return query && query();
-}
-static PFN_xrEnumerateInstanceExtensionProperties dispatcher_enumerate;
-static PFN_xrCreateInstance dispatcher_create;
-static XrResult XRAPI_CALL enumerate_extensions(const char *layer, uint32_t capacity,
-        uint32_t *count, XrExtensionProperties *properties) {
-    uint32_t ignored = 0;
-    XrResult r = dispatcher_enumerate(layer, 0, &ignored, NULL);
-    if (XR_FAILED(r)) return r;
-    if (!hide_fb_enabled()) return dispatcher_enumerate(layer, capacity, count, properties);
-    __android_log_print(ANDROID_LOG_INFO, TAG, "hide_fb_foveation: filtering dispatcher extensions");
-    return fb_hide_enumerate(dispatcher_enumerate, layer, capacity, count, properties);
-}
-static XrResult XRAPI_CALL create_instance(const XrInstanceCreateInfo *info, XrInstance *instance) {
-    if (!hide_fb_enabled() || !fb_instance_uses_vulkan(info)) return dispatcher_create(info, instance);
-    __android_log_print(ANDROID_LOG_INFO, TAG, "hide_fb_foveation: filtering dispatcher instance extensions");
-    return fb_hide_create_instance(dispatcher_create, info, instance);
-}
-
 static PFN_xrApplyHapticFeedback overport_haptics;
 static int haptics_logged;
 
@@ -126,20 +98,6 @@ static XRAPI_ATTR XrResult XRAPI_CALL apply_haptic_feedback(XrSession session, c
 EXPORT XRAPI_ATTR XrResult XRAPI_CALL xrGetInstanceProcAddr(XrInstance instance, const char *name,
                                                             PFN_xrVoidFunction *function) {
     pthread_once(&once, resolve_overport);
-    if (name && function && overport_gipa &&
-        (!strcmp(name, "xrEnumerateInstanceExtensionProperties") || !strcmp(name, "xrCreateInstance"))) {
-        PFN_xrVoidFunction real = NULL;
-        XrResult r = overport_gipa(instance, name, &real);
-        if (XR_FAILED(r) || !real) return r;
-        if (!strcmp(name, "xrCreateInstance")) {
-            dispatcher_create = (PFN_xrCreateInstance)real;
-            *function = (PFN_xrVoidFunction)create_instance;
-        } else {
-            dispatcher_enumerate = (PFN_xrEnumerateInstanceExtensionProperties)real;
-            *function = (PFN_xrVoidFunction)enumerate_extensions;
-        }
-        return XR_SUCCESS;
-    }
     if (name && function && instance != XR_NULL_HANDLE && overport_gipa && !strcmp(name, "xrApplyHapticFeedback")) {
         PFN_xrVoidFunction real = NULL;
         XrResult r = overport_gipa(instance, name, &real);

scripts/mr/render_prompts.py

@@ -0,0 +1,105 @@
+"""Render the in-headset room-scan prompts (SteamVR overlay images) into artifacts/roomscan/.
+
+The Frame has no imaging library, so the agent shows pre-rendered PNGs through IVROverlay while it records the
+passthrough depth mesh (agent `room_capture`). One image per state; "look around" comes in 13 variants (0-12 of 12
+directions seen) so the progress ring can advance without drawing on the Frame. Colours = the Portal theme.
+
+    uv run python scripts/mr/render_prompts.py [--check]
+"""
+from __future__ import annotations
+
+import argparse
+import hashlib
+import io
+import sys
+from pathlib import Path
+
+from PIL import Image, ImageDraw, ImageFont
+
+ROOT = Path(__file__).resolve().parents[2]
+OUT = ROOT / "artifacts" / "roomscan"
+W, H = 1024, 400
+BG, SURFACE, TEXT, TEXT_2 = (13, 14, 18, 235), (29, 31, 39, 255), (236, 238, 243, 255), (167, 172, 186, 255)
+ACCENT, SECONDARY, OK = (255, 138, 31, 255), (58, 168, 255, 255), (74, 222, 128, 255)
+DIRECTIONS = 12
+
+PROMPTS = {
+    "start": ("Turn on passthrough", "The scan runs while you can see your room:\n"
+              "open the quick access menu and switch passthrough on."),
+    "ceiling": ("Look up at the ceiling", "Hold it for a few seconds,\n"
+                "then look back down and keep turning."),
+    "floor": ("Look down at the floor", "Hold it for a few seconds,\nthen keep turning."),
+    "done": ("Room scanned", "You can take the headset off or start a mixed reality game."),
+    "failed": ("Scan stopped", "The headset's cameras sent no room view.\nStart the scan again from FramePort."),
+}
+
+
+def font(size: int, bold: bool = False) -> ImageFont.FreeTypeFont:
+    for name in ("DejaVuSans-Bold.ttf" if bold else "DejaVuSans.ttf",):
+        for base in ("/usr/share/fonts/truetype/dejavu", "C:/Windows/Fonts", "/Library/Fonts"):
+            p = Path(base) / name
+            if p.is_file():
+                return ImageFont.truetype(str(p), size)
+    return ImageFont.load_default(size=size)
+
+
+def panel(title: str, body: str, seen: int | None = None, accent=ACCENT) -> Image.Image:
+    img = Image.new("RGBA", (W, H), (0, 0, 0, 0))
+    d = ImageDraw.Draw(img)
+    d.rounded_rectangle((4, 4, W - 4, H - 4), radius=48, fill=BG, outline=SURFACE, width=4)
+    d.rounded_rectangle((4, 4, 20, H - 4), radius=8, fill=accent)  # portal edge
+    x = 64
+    if seen is not None:  # progress ring: one segment per 30 degree direction seen
+        cx, cy, r = 150, H // 2, 92
+        for i in range(DIRECTIONS):
+            a0 = -90 + i * 360 / DIRECTIONS + 3
+            d.arc((cx - r, cy - r, cx + r, cy + r), a0, a0 + 360 / DIRECTIONS - 6,
+                  fill=(SECONDARY if i < seen else SURFACE), width=26)
+        d.text((cx, cy), f"{seen}/{DIRECTIONS}", font=font(44, True), fill=TEXT, anchor="mm")
+        x = 290
+    d.text((x, 108), title, font=font(54, True), fill=TEXT, anchor="lm")
+    y = 180
+    for line in body.split("\n"):
+        d.text((x, y), line, font=font(32), fill=TEXT_2, anchor="lm")
+        y += 48
+    return img
+
+
+def images() -> dict[str, bytes]:
+    out = {}
+    for key, (title, body) in PROMPTS.items():
+        out[key] = panel(title, body, accent=OK if key == "done" else ACCENT)
+    for n in range(DIRECTIONS + 1):
+        out[f"look_{n:02d}"] = panel("Look around the room", "Turn slowly until the ring is full:\n"
+                                     "every wall and your furniture.", seen=n, accent=SECONDARY)
+    data = {}
+    for key, img in out.items():
+        buf = io.BytesIO()
+        img.save(buf, "PNG", optimize=True)
+        data[f"{key}.png"] = buf.getvalue()
+    return data
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--check", action="store_true", help="fail if artifacts/roomscan is out of date")
+    args = ap.parse_args()
+    data = images()
+    if args.check:
+        stale = [n for n, b in data.items() if not (OUT / n).is_file() or (OUT / n).read_bytes() != b]
+        if stale:
+            print("out of date:", ", ".join(stale))
+            return 1
+        return 0
+    OUT.mkdir(parents=True, exist_ok=True)
+    for name, b in data.items():
+        p = OUT / name
+        if not p.is_file() or p.read_bytes() != b:
+            p.write_bytes(b)
+    print(f"{len(data)} prompts in {OUT.relative_to(ROOT)} "
+          f"({sum(map(len, data.values())) // 1024} KiB, {hashlib.sha256(b''.join(data.values())).hexdigest()[:12]})")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/mr/synth_scan.py

@@ -0,0 +1,218 @@
+#!/usr/bin/env python3
+"""Render deterministic, noisy head-centred depth meshes into the FPRS v1 contract (stdlib only)."""
+from __future__ import annotations
+
+import argparse
+import math
+import random
+import struct
+from pathlib import Path
+
+BOX_OUTLINE = [(-2, -1.5), (2, -1.5), (2, 1.5), (-2, 1.5)]
+L_OUTLINE = [(-2, -2), (2, -2), (2, 0), (0, 0), (0, 2), (-2, 2)]
+TABLE = ((-.6, 0, -.25), (1.2, .75, .7))
+COUCH = ((.6, 0, .95), (1.6, .65, .65))
+ROOMVIEW_WIDTH, ROOMVIEW_HEIGHT = 132, 128
+ROOMVIEW_NEAR, ROOMVIEW_FAR = .3, 4.0
+
+
+def fan(width, height, roomview):
+    """RoomView camera axes are +Z forward / -Y image up; poses convert them to STAGE."""
+    sx, sy = (1.96, 1.94) if roomview else (math.tan(math.radians(55)), math.tan(math.radians(38)))
+    for row in range(height):
+        for col in range(width):
+            x = (2 * col / (width - 1) - 1) * sx
+            y = (2 * row / (height - 1) - 1) * sy
+            if not roomview:
+                y = -y
+            length = math.sqrt(x * x + y * y + 1)
+            yield x / length, y / length, (1 if roomview else -1) / length
+
+
+def smooth_depths(values, width, height, radius=3):
+    """Separable box smoothing models soft stereo boundaries, without a NumPy/scipy dependency."""
+    result = list(values)
+    for vertical in (False, True):
+        source, result = result, [0.0] * len(values)
+        lines, length, step = (width, height, width) if vertical else (height, width, 1)
+        for line in range(lines):
+            start = line if vertical else line * width
+            prefix = [0.0]
+            for i in range(length):
+                prefix.append(prefix[-1] + source[start + i * step])
+            for i in range(length):
+                lo, hi = max(0, i - radius), min(length, i + radius + 1)
+                result[start + i * step] = (prefix[hi] - prefix[lo]) / (hi - lo)
+    return result
+
+
+def inside(x, z, polygon):
+    odd = False
+    for (ax, az), (bx, bz) in zip(polygon, polygon[1:] + polygon[:1], strict=False):
+        if (az > z) != (bz > z) and x < (bx - ax) * (z - az) / (bz - az) + ax:
+            odd = not odd
+    return odd
+
+
+def rotate(v, q):
+    x, y, z = v
+    qx, qy, qz, qw = q
+    tx, ty, tz = 2 * (qy * z - qz * y), 2 * (qz * x - qx * z), 2 * (qx * y - qy * x)
+    return (x + qw * tx + qy * tz - qz * ty,
+            y + qw * ty + qz * tx - qx * tz,
+            z + qw * tz + qx * ty - qy * tx)
+
+
+def cast(eye, direction, polygon, ceiling, furniture, missing_wall):
+    ex, ey, ez = eye
+    dx, dy, dz = direction
+    nearest = 5.0
+    hit = False
+    for height in (0, ceiling):
+        if abs(dy) > 1e-8:
+            t = (height - ey) / dy
+            if .3 < t < nearest and inside(ex + t * dx, ez + t * dz, polygon):
+                nearest, hit = t, True
+    for index, ((ax, az), (bx, bz)) in enumerate(zip(polygon, polygon[1:] + polygon[:1], strict=False)):
+        if index == missing_wall:
+            continue
+        sx, sz = bx - ax, bz - az
+        det = dx * sz - dz * sx
+        if abs(det) < 1e-8:
+            continue
+        t = ((ax - ex) * sz - (az - ez) * sx) / det
+        u = ((ax - ex) * dz - (az - ez) * dx) / det
+        if .3 < t < nearest and 0 <= u <= 1 and 0 <= ey + t * dy <= ceiling:
+            nearest, hit = t, True
+    for (cx, bottom, cz), (width, height, depth) in furniture:
+        near, far = -1e20, 1e20
+        for pos, ray, lo, hi in zip(eye, direction,
+                                    (cx - width / 2, bottom, cz - depth / 2),
+                                    (cx + width / 2, bottom + height, cz + depth / 2), strict=False):
+            if abs(ray) < 1e-8:
+                if not lo <= pos <= hi:
+                    far = -1e20
+                    break
+            else:
+                a, b = (lo - pos) / ray, (hi - pos) / ray
+                near, far = max(near, min(a, b)), min(far, max(a, b))
+        if .3 < near < nearest and near <= far:
+            nearest, hit = near, True
+    return nearest if hit else None
+
+
+def render(path: Path, *, shape="box", frames=30, width=None, height=None, noise=.004,
+           holes=.025, smear=.012, floor_bias=.008, no_ceiling=False, seed=7,
+           yaw=0.0, offset=(0.0, 0.0, 0.0), missing_wall=-1, objects=True, profile="roomview",
+           invalid_start=None, smoothing=3):
+    """Each frame has its own moving pose; no ground-truth room data is put in the dump."""
+    rng = random.Random(seed)
+    roomview = profile == "roomview"
+    width = width or (ROOMVIEW_WIDTH if roomview else 56)
+    height = height or (ROOMVIEW_HEIGHT if roomview else 40)
+    invalid_start = (2 if roomview else 0) if invalid_start is None else invalid_start
+    polygon = BOX_OUTLINE if shape == "box" else L_OUTLINE
+    ceiling = 2.6
+    furniture = [TABLE, COUCH] if objects and shape == "box" else []
+    rotation = (0, math.sin(yaw / 2), 0, math.cos(yaw / 2))
+    rays = list(fan(width, height, roomview))
+    with path.open("wb") as out:
+        out.write(struct.pack("<4sI", b"FPRS", 1))
+        for frame in range(frames):
+            heading = 2 * math.pi * frame / max(frames, 1)
+            pitch = -.85 if no_ceiling else (-.60, 0, .70)[frame % 3]
+            if roomview and no_ceiling:
+                pitch = -1.2
+            # The L's two arms need viewpoints on both sides of the re-entrant corner.
+            centre = (-.65, -.65) if shape == "l" else (0, 0)
+            eye = (centre[0] + .35 * math.cos(heading), 1.6 + .04 * math.sin(heading * 2),
+                   centre[1] + .35 * math.sin(heading))
+            if roomview:
+                eye = eye[0], 1.3 + .4 * math.sin(heading), eye[2]
+            sy, cy = math.sin(heading / 2), math.cos(heading / 2)
+            sp, cp = math.sin(pitch / 2), math.cos(pitch / 2)
+            q = (cy * sp, sy * cp, -sy * sp, cy * cp)
+            if roomview:
+                q = q[3], q[2], -q[1], -q[0]  # head rotation composed with camera's 180 degree X rotation
+            depths = [cast(eye, rotate(ray, q), polygon, ceiling, furniture, missing_wall) for ray in rays]
+            if roomview:
+                # Smooth both valid depth and inpainted far pixels. Low-frequency noise survives the filter,
+                # while isolated high-frequency speckle is small, as in a stereo patch fit.
+                coarse_width = (width + 11) // 12
+                coarse = [rng.gauss(0, .012) for _ in range(coarse_width * ((height + 11) // 12))]
+                depths = [(depth if depth is not None else 8 + rng.random() * 2)
+                          + coarse[(i // width // 12) * coarse_width + (i % width // 12)]
+                          for i, depth in enumerate(depths)]
+                depths = smooth_depths(depths, width, height, smoothing)
+            vertices, valid = [], []
+            for index, (ray, depth) in enumerate(zip(rays, depths, strict=False)):
+                keep = depth is not None and rng.random() >= holes
+                valid.append(keep or roomview)
+                if roomview and not keep:
+                    depth = 8 + rng.random() * 2
+                if depth is None:
+                    depth = 0
+                else:
+                    # Stereo edges blend two depths, producing stretched grazing triangles.
+                    other = depths[index + 1] if (index + 1) % width and index + 1 < len(depths) else depth
+                    if other is not None and abs(other - depth) > .3 and rng.random() < smear:
+                        depth = (depth + other) / 2
+                    world_ray = rotate(ray, q)
+                    if eye[1] + depth * world_ray[1] < .15:
+                        depth += floor_bias * rng.random()
+                    depth += rng.gauss(0, noise)
+                vertices.extend(c * depth for c in ray)
+            indices = []
+            for row in range(height - 1):
+                for col in range(width - 1):
+                    a = row * width + col
+                    for triangle in ((a, a + width, a + 1), (a + 1, a + width, a + width + 1)):
+                        if all(valid[i] for i in triangle):
+                            indices.extend(triangle)
+            # Compose the global room transform with each independent mesh -> room pose.
+            pose_eye = tuple(a + b for a, b in zip(rotate(eye, rotation), offset, strict=False))
+            ax, ay, az, aw = rotation
+            bx, by, bz, bw = q
+            pose_q = (aw * bx + ax * bw + ay * bz - az * by,
+                      aw * by - ax * bz + ay * bw + az * bx,
+                      aw * bz + ax * by - ay * bx + az * bw,
+                      aw * bw - ax * bx - ay * by - az * bz)
+            if frame < invalid_start:
+                pose_eye = (float("nan"),) * 3
+            out.write(struct.pack("<d7fII", frame / (3 if roomview else 15),
+                                  *pose_eye, *pose_q, len(rays), len(indices)))
+            out.write(struct.pack(f"<{len(vertices)}f", *vertices))
+            out.write(struct.pack(f"<{len(indices)}I", *indices))
+
+
+def main():
+    ap = argparse.ArgumentParser(description=__doc__)
+    ap.add_argument("out", type=Path)
+    ap.add_argument("--shape", choices=("box", "l"), default="box")
+    ap.add_argument("--frames", type=int, default=30)
+    ap.add_argument("--profile", choices=("roomview", "legacy"), default="roomview")
+    ap.add_argument("--width", type=int)
+    ap.add_argument("--height", type=int)
+    ap.add_argument("--invalid-start", type=int, help="untracked initial frames (RoomView default: 2)")
+    ap.add_argument("--smoothing", type=int, default=3, help="RoomView depth filter radius in pixels")
+    ap.add_argument("--noise", type=float, default=.004)
+    ap.add_argument("--holes", type=float, default=.025)
+    ap.add_argument("--smear", type=float, default=.012)
+    ap.add_argument("--floor-bias", type=float, default=.008)
+    ap.add_argument("--no-ceiling", action="store_true")
+    ap.add_argument("--no-objects", action="store_true")
+    ap.add_argument("--missing-wall", type=int, default=-1)
+    ap.add_argument("--yaw", type=float, default=0, help="global room yaw in degrees")
+    ap.add_argument("--seed", type=int, default=7)
+    args = ap.parse_args()
+    if args.frames < 1 or (args.width is not None and args.width < 3) or (args.height is not None and args.height < 3):
+        ap.error("positive frame count and a grid of at least 3 x 3 required")
+    render(args.out, shape=args.shape, frames=args.frames, width=args.width, height=args.height,
+           noise=args.noise, holes=args.holes, smear=args.smear, floor_bias=args.floor_bias,
+           no_ceiling=args.no_ceiling, seed=args.seed, yaw=math.radians(args.yaw),
+           missing_wall=args.missing_wall, objects=not args.no_objects, profile=args.profile,
+           invalid_start=args.invalid_start, smoothing=args.smoothing)
+
+
+if __name__ == "__main__":
+    main()

scripts/showcase/fakes.py

@@ -135,9 +135,6 @@ class FakeFS:
             return {"shots": shots, "total": len(shots), "games": list(games.values())}
         if command == "take_screenshot":  # the Screenshots tab's button: a new shot of the running game
             return self.take_screenshot()
-        if command == "saves_info":  # Restore saves…: what the Frame has now, and the copy from the last restore
-            return {"package": args.get("package"), "files": 14, "bytes": 2_310_000, "skipped": [],
-                    "running": False, "version": "1.0", "rollback": {"size": 812_000, "time": time.time() - 86400}}
         raise RuntimeError(f"fake Frame: {command} not available")
 
     @property
@@ -601,28 +598,6 @@ def scan_job(app, folder: str, entries: list[dict], pace: float = 1.0):
     return app.submit(f"Scan {folder.rstrip('/').rsplit('/', 1)[-1]}", run, None, "scan")
 
 
-def fake_save_backups(pkg: str) -> None:
-    """Two pretend save backups of `pkg` on this PC (yesterday's and last week's), for the Restore saves… dialog."""
-    import io
-    import json
-    import tarfile
-
-    from frameport.install import saves
-
-    d = saves.backups_dir(pkg)
-    d.mkdir(parents=True, exist_ok=True)
-    for days, n, size in ((1, 14, 2_300_000), (7, 11, 1_900_000)):
-        created = time.time() - days * 86400
-        path = d / time.strftime("%Y%m%d-%H%M%S.tar.gz", time.localtime(created))
-        manifest = {"format": 1, "package": pkg, "created": created, "version": "1.0",
-                    "files": [{"path": f"external/files/save{i}.dat", "size": size // n} for i in range(n)]}
-        raw = json.dumps(manifest).encode()
-        with tarfile.open(path, "w:gz") as tar:
-            ti = tarfile.TarInfo(saves.MANIFEST)
-            ti.size = len(raw)
-            tar.addfile(ti, io.BytesIO(raw))
-
-
 def attach_fake_frame(app: FramePortApp, monitor_session=None) -> None:
     """Connect `app` to a FakeTarget (the shared monitor stream, used by the Monitor tab and the Frame card, too)."""
     app.monitor_hub.session_factory = monitor_session or FakeMonitorSession

scripts/ui_smoke.py

@@ -27,7 +27,6 @@ from showcase.fakes import (  # noqa: E402,F401
     add_fake_linux_apps,
     attach_fake_frame,
     fake_live_stream,
-    fake_save_backups,
     install_fakes,
     open_monitor_details,
     open_type_tab,
@@ -141,7 +140,6 @@ def main() -> int:
              ("tools", lambda a: a.go("settings")),
              # the index on the left: "This PC" scrolls the page there
              ("settings-index", lambda a: a.page.run_task(a.settings_view.show_section, "pc")),
-             ("settings-folders", lambda a: a.page.run_task(a.settings_view.show_section, "folders")),
              ("settings-installing", lambda a: a.page.run_task(a.settings_view.show_section, "installing"))]
     if game:
         steps.insert(1, ("game", lambda a: a.open_game(game)))
@@ -155,9 +153,6 @@ def main() -> int:
         if args.fake_frame:  # GitHub #90: the Move to… dialog (drives load in the background)
             steps.append(("move-dialog", lambda a: (a.page.pop_dialog(), a.move_game(game))))
             steps.append(("uninstall-dialog", lambda a: (a.page.pop_dialog(), a.uninstall(game))))
-            # discussion #352: pick a save backup (two pretend ones) to restore, "Undo last restore" from the Frame
-            steps.append(("restore-saves-dialog", lambda a: (a.page.pop_dialog(), fake_save_backups(game),
-                                                             a.restore_saves(game))))
         # last: the menus stay open over whatever comes next (the page's "…" menu, then the right-click menu)
         steps.append(("game-menu", lambda a: (a.show_activity(False), a.open_game_menu(game))))
         steps.append(("library-menu", lambda a: (a.show_activity(False), a.navigate(0), time.sleep(3),
@@ -326,14 +321,6 @@ def main() -> int:
                  ("links-settings", lambda a: (a.page.pop_dialog(), a.go("settings")))]
         if game:
             steps.append(("links-display-mode", lambda a: a.open_game(game, advanced=True)))
-            # a newer version offered by the game's install link: the Library bar, the game page, the question
-            library.upsert_game(game, link={"source": fake.source, "name": "Example Game", "version": "1.3.0"},
-                                link_update={"version": "1.4.0", "checked": time.time()})
-            newer = deeplink.Manifest("Example Game", fake.files, fake.source, version="1.4.0")
-            steps += [("links-update-library", lambda a: a.navigate(0)),
-                      ("links-update-game", lambda a: a.open_game(game)),
-                      ("links-update-confirm", lambda a: link_dialog._confirm_updates(
-                          a, [(game, "1.3.0", newer, None)], []))]
         def add_menu_open(page):
             page.mouse.click(1194, 94)  # Add games (1280-wide viewport)
             time.sleep(2)
@@ -541,6 +528,27 @@ def main() -> int:
             app = FramePortApp(page)
             if args.fake_frame:
                 attach_fake_frame(app)
+                # The Room card uses local fixtures too; --fake-frame never contacts a headset.
+                from frameport.mr.room import box_room, dumps, summary
+                room = box_room(4, 3)
+                room.source, room.universe = "scan", 7
+                room_answer = dict(rooms=[], universe=7, room=dict(universe=7, source="scan", summary=summary(room)),
+                                   room_text=dumps(room), aligned=True, default_circle=False, scanner_installed=True)
+                original_agent = app.target.frame.agent
+                def room_agent(command, **kwargs):
+                    if command == "room_capture":
+                        return {"error": "not implemented yet"}
+                    if command == "room_delete":
+                        room_answer.update(room=None, room_text=None, aligned=False)
+                    if command == "room_from_boundary":
+                        room.source = "boundary"
+                        room_answer.update(room=dict(universe=7, source="boundary", summary=summary(room)),
+                                           room_text=dumps(room), aligned=True)
+                    if command.startswith("room_"):
+                        return dict(room_answer)
+                    return original_agent(command, **kwargs)
+                app.target.frame.agent = room_agent
+
         except Exception:  # noqa: BLE001
             ERRORS.append("startup: " + traceback.format_exc())
             return

site/public/demo/cool-game.json

@@ -1,7 +1,6 @@
 {
   "schema": "framedrop.install/v1",
   "name": "Cool Game",
-  "version": "1.0.0",
   "frameport": {
     "description": "A placeholder game for the example \"Install with FramePort\" button. FramePort recognises this link and shows a demo: nothing is downloaded or installed.",
     "icon": "https://frameport.app/demo/cool-game.svg"

site/src/data/patches.json

@@ -1,9 +1,4 @@
 {
- "adapter.action_dedup": {
-  "anchor": "adapter-action_dedup",
-  "title": "Unique controller action names",
-  "group": "Game settings"
- },
  "adapter.aim_forward": {
   "anchor": "adapter-aim_forward",
   "title": "Pointer start",
@@ -19,11 +14,6 @@
   "title": "Pointer turn",
   "group": "Game settings"
  },
- "adapter.alpha_blend_emul": {
-  "anchor": "adapter-alpha_blend_emul",
-  "title": "Fix inside-out mixed reality",
-  "group": "Game settings"
- },
  "adapter.controller_fix": {
   "anchor": "adapter-controller_fix",
   "title": "Use controllers",
@@ -154,11 +144,6 @@
   "title": "Vibration strength",
   "group": "Game settings"
  },
- "adapter.hide_fb_foveation": {
-  "anchor": "adapter-hide_fb_foveation",
-  "title": "Turn off Quest Vulkan foveation",
-  "group": "Game settings"
- },
  "adapter.hide_space_warp": {
   "anchor": "adapter-hide_space_warp",
   "title": "Turn off space warp",
@@ -256,7 +241,7 @@
  },
  "adapter.scene_emul": {
   "anchor": "adapter-scene_emul",
-  "title": "Pretend room layout",
+  "title": "Use room layout",
   "group": "Game settings"
  },
  "adapter.scene_height": {
@@ -319,11 +304,6 @@
   "title": "Hide Vulkan foveation",
   "group": "Game settings"
  },
- "adapter.vk_pipeline_log": {
-  "anchor": "adapter-vk_pipeline_log",
-  "title": "Vulkan pipeline failures (log)",
-  "group": "Game settings"
- },
  "adapter.vk_query_slots": {
   "anchor": "adapter-vk_query_slots",
   "title": "Stop objects popping in and out",
@@ -434,11 +414,6 @@
   "title": "BlazeRush: controllers without Meta avatars, own shader cache",
   "group": "Steam Frame patches"
  },
- "frame.cortopia_org_id": {
-  "anchor": "frame-cortopia_org_id",
-  "title": "Cortopia games: don't wait for Meta's org-scoped id",
-  "group": "Steam Frame patches"
- },
  "frame.eos_keychain_loop": {
   "anchor": "frame-eos_keychain_loop",
   "title": "Epic Online Services: stop the keychain retry loop",
@@ -454,11 +429,6 @@
   "title": "GL shim (Mesa GLSL compatibility)",
   "group": "Steam Frame patches"
  },
- "frame.gms_platform_version": {
-  "anchor": "frame-gms_platform_version",
-  "title": "Play services: Android 11 version checks",
-  "group": "Steam Frame patches"
- },
  "frame.godot_clipboard": {
   "anchor": "frame-godot_clipboard",
   "title": "Godot apps: start without a clipboard service",
@@ -539,11 +509,6 @@
   "title": "Unpaired pointer-authentication checks",
   "group": "Steam Frame patches"
  },
- "frame.photon_voice_audio_route": {
-  "anchor": "frame-photon_voice_audio_route",
-  "title": "Photon Voice: skip Android 12 audio routing",
-  "group": "Steam Frame patches"
- },
  "frame.sdl_clipboard": {
   "anchor": "frame-sdl_clipboard",
   "title": "SDL apps: start without a clipboard service",
@@ -569,11 +534,6 @@
   "title": "Team Beef ports: treat the Frame as a Meta headset",
   "group": "Steam Frame patches"
  },
- "frame.unity_appui_vibrator": {
-  "anchor": "frame-unity_appui_vibrator",
-  "title": "Unity App UI: no Android 12 vibrator",
-  "group": "Steam Frame patches"
- },
  "frame.unity_gl_shim": {
   "anchor": "frame-unity_gl_shim",
   "title": "GL shim for Unity (no multisampled render-to-texture)",
@@ -629,11 +589,6 @@
   "title": "Unreal: match multiview depth to the eye size",
   "group": "Steam Frame patches"
  },
- "frame.unreal_noreserve": {
-  "anchor": "frame-unreal_noreserve",
-  "title": "Unreal: reserve memory like on Quest",
-  "group": "Steam Frame patches"
- },
  "frame.unreal_ovrp_entrypoints": {
   "anchor": "frame-unreal_ovrp_entrypoints",
   "title": "Unreal: stand-ins for OVRPlugin functions OVRPort lacks",
@@ -669,11 +624,6 @@
   "title": "Unreal: thumb follows the capacitive touches",
   "group": "Steam Frame patches"
  },
- "frame.usb_midi_watcher": {
-  "anchor": "frame-usb_midi_watcher",
-  "title": "USB MIDI: don't poll for USB devices",
-  "group": "Steam Frame patches"
- },
  "frame.vermillion_scene_canvas": {
   "anchor": "frame-vermillion_scene_canvas",
   "title": "Vermillion: paint canvases in the scene",

src/frameport/_version.py

@@ -1,2 +1,2 @@
 # The FramePort version: the single source (pyproject reads it via hatch; CI checks a release tag matches it).
-__version__ = "1.2.1"
+__version__ = "1.2.0"

src/frameport/analysis/detect.py

@@ -43,18 +43,7 @@ IL2CPP_METADATA = "assets/bin/Data/Managed/Metadata/global-metadata.dat"
 # 17: headset (the Meta headset a VR app was made for: Gear VR / Go games run through frame.a32_bridge) (2026-10)
 # 18: headset "quest" also for 32-bit apps that require 6DoF head tracking (Santa Cruz builds, e.g. Sports
 #     Scramble: Touch controllers on the a32 bridge) (2026-10)
-# 19: unreal_obb_delivery also for obfuscated DownloaderActivity predicates (GitHub #159) (2026-10)
-# 20: google_vr (Google Daydream / Cardboard builds: GVR or Cardboard SDK, no path to the Frame's headset,
-#     GitHub #335) (2026-10)
-# 21: photon_voice_api31 (Photon Voice's AudioInAEC calls Android 12 AudioManager methods:
-#     frame.photon_voice_audio_route, GitHub #362/#325); cortopia_org_id (Cortopia's Meta start-up waits for
-#     Users.GetOrgScopedID: frame.cortopia_org_id, GitHub #360); unity_appui_vibrator (Unity App UI's activity uses
-#     Android 12's VibratorManager: frame.unity_appui_vibrator, GitHub #297); gms_folded_sdk_checks (Play services'
-#     Android 12 checks folded to true by R8: frame.gms_platform_version, GitHub #310); usb_midi_watcher (kshoji's
-#     USB MIDI driver polls the missing USB service: frame.usb_midi_watcher, GitHub #297) (2026-10)
-# 22: unreal_binned3 (Unreal built with FMallocBinned3 reserves tens of GiB at load: frame.unreal_noreserve,
-#     GitHub #349) (2026-10)
-ANALYSIS_VERSION = 22
+ANALYSIS_VERSION = 19
 
 
 # Android versions by API level (for messages); the Frame's Lepton container runs Android 11 (API 30)
@@ -98,13 +87,6 @@ def cryengine_project(data: bytes) -> bool:
 UE_VERIFY_OBB_KEY = ".GameActivity.bVerifyOBBOnStartUp"
 
 
-def unreal_binned3(engine: bytes) -> bool:
-    """Unreal built with FMallocBinned3 as its allocator (its own messages and source path are compiled in; other
-    builds only name its console variables). It reserves its whole range while the library loads (GitHub #349)."""
-    return (b"/HAL/MallocBinned3.cpp\0" in engine
-            or "FMallocBinned3 Attempt to free".encode("utf-16-le") in engine)
-
-
 def unreal_verify_obb(meta: dict) -> bool:
     """Unreal's DownloaderActivity checks every OBB entry's CRC at the first start (a full read; on a mismatch it waits
     on an error screen). Only a real boolean counts: GameActivity reads it with Bundle.getBoolean."""
@@ -215,32 +197,6 @@ def vr_kind(libs: set[str], manifest_strings: list[str]) -> str:
     return "none"
 
 
-# Google VR (Daydream / Cardboard): the manifest categories of a Daydream / Cardboard app, Daydream's VR service
-# (android:enableVrMode="com.google.vr.vrcore/..."), the GVR SDK's library and the Cardboard SDK's
-# (github.com/googlevr/cardboard), and the GVR SDK's Java classes. Not libgvraudio.so / Unity's
-# libaudioplugingvrunity.so: Google's spatial audio, which Quest games ship too (e.g. Shadow Point).
-DAYDREAM_CATEGORY = "com.google.intent.category.DAYDREAM"
-CARDBOARD_CATEGORY = "com.google.intent.category.CARDBOARD"
-GOOGLE_VR_LIBS = {"libgvr.so", "libcardboard_api.so", "libGfxPluginCardboard.so"}
-GVR_DEX_MARKERS = (b"Lcom/google/vr/ndk/base/GvrLayout;", b"Lcom/google/vr/sdk/base/GvrView;",
-                   b"Lcom/google/vr/sdk/base/GvrActivity;", b"Lcom/google/cardboard/sdk/")
-
-
-def google_vr(libs: set[str], cats: set[str], manifest_strings: list[str], gvr_java: bool = False,
-              boot: str = "") -> str:
-    """A Google VR app: "daydream" (Daydream: needs Google's VR services, VrCore), "cardboard" (Cardboard: draws
-    both eyes side by side with lens distortion onto a phone screen) or "" (neither). Neither has a path to the
-    Frame's headset: a Lepton app only reaches it through OpenXR (VrApi / OVRPlugin games are translated to it).
-    `boot` = Unity's boot.config (vr-device-list=, where Unity builds list their VR devices)."""
-    devices = next((ln.split("=", 1)[1].lower() for ln in boot.splitlines() if ln.startswith("vr-device-list=")), "")
-    if (DAYDREAM_CATEGORY in cats or any(s.startswith("com.google.vr.vrcore") for s in manifest_strings)
-            or "daydream" in devices):
-        return "daydream"
-    if CARDBOARD_CATEGORY in cats or "cardboard" in devices or libs & GOOGLE_VR_LIBS or gvr_java:
-        return "cardboard"
-    return ""
-
-
 # Kotlin's message for a failed non-null cast to ClipboardManager (Godot 4.2-4.4; 4.1 is Java, 4.5+ uses `as?`)
 GODOT_CLIPBOARD_CAST = b"null cannot be cast to non-null type android.content.ClipboardManager"
 
@@ -286,21 +242,6 @@ def analyze(path: Path, deep: bool = True, data_bytes: int | None = None) -> Ana
         godot_clipboard = any(b"Lorg/godotengine/godot/Godot;" in d and GODOT_CLIPBOARD_CAST in d for d in dexes)
         # Vivox voice chat calling Android 12 audio-routing methods: crashes in Lepton (Android 11)
         vivox_api31 = any(b"Lcom/vivox/sdk/AudioChangeListener;" in d and b"CommunicationDevice" in d for d in dexes)
-        # Photon Voice's microphone plugin does the same (frame.photon_voice_audio_route, GitHub #362)
-        photon_voice_api31 = any(b"Lcom/exitgames/photon/audioinaec/AudioInAEC;" in d and b"CommunicationDevice" in d
-                                 for d in dexes)
-        # Unity App UI's activity gets Android 12's VibratorManager in onCreate: crashes in Lepton (Android 11)
-        unity_appui_vibrator = any(b"Lcom/unity3d/player/appui/" in d and b"Landroid/os/VibratorManager;" in d
-                                   and b"vibrator_manager" in d for d in dexes)
-        # kshoji's USB MIDI driver polls Android's USB service, which Lepton lacks (frame.usb_midi_watcher)
-        usb_midi_watcher = any(b"Ljp/kshoji/driver/midi/device/MidiDeviceConnectionWatcher"
-                               b"$MidiDeviceConnectionWatchThread;"
-                               in d for d in dexes)
-        # Play services' PlatformVersion.isAtLeastS() & co. folded to `return true` (minSdk 31+ builds): crash on
-        # Android 11 (frame.gms_platform_version)
-        from ..patches.frame.gms_platform_version import has_folded_checks
-
-        gms_folded_sdk_checks = has_folded_checks(dexes)
         # Epic Online Services' keychain (it can retry without end when it can't write: frame.eos_keychain_loop)
         eos_keychain = any(b"Lcom/epicgames/mobile/eossdk/EOSSDK;" in d and b"resetKeychain" in d for d in dexes)
         # bHaptics asks for an Android 12 permission; the prompt interrupts the game (frame.bhaptics_permission)
@@ -308,8 +249,6 @@ def analyze(path: Path, deep: bool = True, data_bytes: int | None = None) -> Ana
                                   for d in dexes)
         # video through Android's decoders (frame.hw_video_decode): Java MediaCodec, ExoPlayer/Media3, or libVLC
         media_codec = any(m in d for d in dexes for m in MEDIA_CODEC_MARKERS) or "libvlc.so" in libs
-        # Google VR's Java side (GvrLayout / GvrView, the Cardboard SDK): a Daydream / Cardboard app (google_vr)
-        gvr_java = any(m in d for d in dexes for m in GVR_DEX_MARKERS)
         from ..patches.frame.unreal_obb_check import has_delivery_check
 
         # Includes obfuscated DownloaderActivity predicates; CRC verification is a separate manifest switch.
@@ -433,25 +372,15 @@ def analyze(path: Path, deep: bool = True, data_bytes: int | None = None) -> Ana
             "xr_layer_exts": sorted(layer_exts),  # composition-layer extensions the game's own libraries request
             "vr_kind": vr_kind(libset, manifest_strings),
             "headset": headset(meta, abis, vr_kind(libset, manifest_strings), requires_6dof(manifest)),
-            # a Google Daydream / Cardboard build (GVR / Cardboard SDK): no path to the Frame's headset (GitHub #335)
-            "google_vr": google_vr(libset, cats, manifest_strings, gvr_java, boot),
             # the base of a split APK set (Play "app bundle" installs): the code/libraries live in split APKs
             "split_apk": bool({"isSplitRequired", "requiredSplitTypes"} & set(manifest_strings)),
             # Unity (IL2CPP) text fields: they close at once on the Frame (frame.unity_text_input)
             "text_fields": unity_text_fields(il2cpp_meta) if il2cpp_meta else [],
             # Meta's OVRManager raises MSAA at runtime (frame.unity_runtime_msaa_off); Oculus XR Plugin (multiview)
             "ovr_runtime_msaa": bool(il2cpp_meta) and b"\0useRecommendedMSAALevel\0" in il2cpp_meta,
-            # Cortopia's Meta platform start-up awaits an org-scoped user id OVRPort never answers
-            # (frame.cortopia_org_id, GitHub #360)
-            "cortopia_org_id": bool(il2cpp_meta) and b"\0Cortopia.Scripts.Platform.Meta\0" in il2cpp_meta
-            and b"\0GetOrgScopedID\0" in il2cpp_meta,
             "sdl_java": sdl_java,
             "godot_clipboard": godot_clipboard,
             "vivox_api31": vivox_api31,
-            "photon_voice_api31": photon_voice_api31,
-            "unity_appui_vibrator": unity_appui_vibrator,
-            "gms_folded_sdk_checks": gms_folded_sdk_checks,
-            "usb_midi_watcher": usb_midi_watcher,
             "eos_keychain": eos_keychain,
             "bhaptics_permission": bhaptics_permission,
             "media_codec": media_codec,
@@ -481,10 +410,6 @@ def analyze(path: Path, deep: bool = True, data_bytes: int | None = None) -> Ana
             # Unreal CRC-checks the OBB before the game starts (frame.unreal_skip_obb_check, GitHub #159)
             "unreal_verify_obb": unreal_verify_obb(meta),
             "unreal_obb_delivery": unreal_obb_delivery,
-            # Unreal's Binned3 allocator reserves more address space than the Frame's kernel grants in one writable
-            # mapping (frame.unreal_noreserve, GitHub #349)
-            "unreal_binned3": (unreal_binned3(lib_bytes.get(engine_lib.rsplit("/", 1)[1], b""))
-                               if engine_lib else False),
             # Unreal's Oculus module needs every OVRPlugin function it looks up (frame.unreal_ovrp_entrypoints)
             "unreal_ovrp_lookups": (ovrp_lookups(lib_bytes.get(engine_lib.rsplit("/", 1)[1], b""))
                                     if engine_lib and "libOVRPlugin.so" in libset else []),

src/frameport/analysis/elf.py

@@ -20,23 +20,6 @@ def _elf(data: bytes) -> ELFFile:
     return ELFFile(io.BytesIO(data))
 
 
-def dynsym_section(elf: ELFFile):
-    """The dynamic symbol table, found by section type: some shipped libraries have a scrambled section name table
-    (GitHub #349: Transformers Beyond Reality's libOVRPlugin.so calls .dynsym "text"), types and links are intact."""
-    sec = elf.get_section_by_name(".dynsym")
-    if isinstance(sec, SymbolTableSection) and sec["sh_type"] == "SHT_DYNSYM":
-        return sec
-    return next((s for s in elf.iter_sections() if s["sh_type"] == "SHT_DYNSYM"), None)
-
-
-def dynstr_section(elf: ELFFile, dynsym=None):
-    """The string table of the dynamic symbols (dynsym's sh_link; by name as a fallback)."""
-    dynsym = dynsym if dynsym is not None else dynsym_section(elf)
-    if dynsym is not None and 0 < dynsym["sh_link"] < elf.num_sections():
-        return elf.get_section(dynsym["sh_link"])
-    return elf.get_section_by_name(".dynstr")
-
-
 def needed(data: bytes) -> list[str]:
     elf = _elf(data)
     for sec in elf.iter_sections():
@@ -65,7 +48,7 @@ def dyn_symbols(data: bytes, defined: bool) -> set[str]:
 @lru_cache(maxsize=256)
 def _dyn_symbols_cached(data: bytes, defined: bool) -> frozenset[str]:
     elf = _elf(data)
-    sec = dynsym_section(elf)
+    sec = elf.get_section_by_name(".dynsym")
     out = set()
     if isinstance(sec, SymbolTableSection):
         for sym in sec.iter_symbols():
@@ -86,8 +69,7 @@ def find_symbols(data: bytes, names) -> dict[str, tuple[int, int]]:
     if not is_elf(data) or data[4] != 2 or data[5] != 1:
         return {}
     elf = _elf(data)
-    dynsym = dynsym_section(elf)
-    dynstr = dynstr_section(elf, dynsym)
+    dynsym, dynstr = elf.get_section_by_name(".dynsym"), elf.get_section_by_name(".dynstr")
     if dynsym is None or dynstr is None:
         return {}
     sym_off, sym_size = dynsym["sh_offset"], dynsym["sh_size"]
@@ -165,7 +147,7 @@ def hide_exports(data: bytes, names) -> tuple[bytes, list[str]]:
     (native/langpack) still finds the original address. Returns (data, names actually hidden); ELF64 only."""
     if not is_elf(data) or not is_64bit(data) or data[5] != 1:
         return data, []
-    sec = dynsym_section(_elf(data))
+    sec = _elf(data).get_section_by_name(".dynsym")
     if not isinstance(sec, SymbolTableSection):
         return data, []
     wanted = set(names)
@@ -189,7 +171,7 @@ def redirect_exports(data: bytes, names) -> tuple[bytes, list[str]]:
     """
     if not is_elf(data) or not is_64bit(data) or data[5] != 1:
         return data, []
-    sec = dynsym_section(_elf(data))
+    sec = _elf(data).get_section_by_name(".dynsym")
     if not isinstance(sec, SymbolTableSection):
         return data, []
     wanted = set(names)
@@ -219,11 +201,10 @@ def rename_imports(data: bytes, renames: dict[str, str]) -> tuple[bytes, list[st
         if len(new) > len(old):
             raise ValueError(f"{new} is longer than {old}")
     elf = _elf(data)
-    dynsym = dynsym_section(elf)
-    dynstr = dynstr_section(elf, dynsym)
+    dynsym, dynstr = elf.get_section_by_name(".dynsym"), elf.get_section_by_name(".dynstr")
     if not isinstance(dynsym, SymbolTableSection) or dynstr is None:
         return data, []
-    versym = next((s for s in elf.iter_sections() if s["sh_type"] == "SHT_GNU_versym"), None)
+    versym = elf.get_section_by_name(".gnu.version")
     str_off = dynstr["sh_offset"]
     targets, refs = {}, {}  # dynsym index -> st_name of an import to rename; st_name -> referencing dynsym indices
     for i, sym in enumerate(dynsym.iter_symbols()):
@@ -395,23 +376,24 @@ def add_needed(data: bytes, library: str) -> bytes:
         write_ph(i, p)
 
     # section headers: point .dynamic / .dynstr at the new copies (for tools; the loader uses program headers)
-    # Found by type and link, not by name: some shipped libraries have a scrambled section name table (GitHub #349,
-    # Transformers Beyond Reality's libOVRPlugin.so names .dynamic "dding"), whose types and links are still right.
     if shoff and shnum:
-        SHT_DYNAMIC = 6
+        shstrndx = eh[13]
         def sh(i):
             return list(struct.unpack_from(sh_fmt, buf, shoff + i * shentsize))
-        headers = [sh(i) for i in range(shnum)]  # sh_name, sh_type, sh_flags, sh_addr, sh_offset, sh_size, sh_link
-        dyn_secs = [i for i, h in enumerate(headers) if h[1] == SHT_DYNAMIC]
-        str_secs = {headers[i][6] for i in dyn_secs if 0 < headers[i][6] < shnum}
-        str_secs |= {i for i, h in enumerate(headers) if h[3] == strtab_va and h[3]}  # .dynstr by address
-        for i in dyn_secs:
-            h = headers[i]
-            h[3], h[4], h[5] = va_start + dyn_off, file_end + dyn_off, len(dyn_bytes)
-            struct.pack_into(sh_fmt, buf, shoff + i * shentsize, *h)
-        for i in str_secs - set(dyn_secs):
-            h = headers[i]
-            h[3], h[4], h[5] = va_start + str_off, file_end + str_off, len(new_str)
+        names_hdr = sh(shstrndx)
+        names_off = names_hdr[4]
+        def sec_name(h):
+            end = buf.index(b"\0", names_off + h[0])
+            return bytes(buf[names_off + h[0]:end]).decode()
+        for i in range(shnum):
+            h = sh(i)
+            n = sec_name(h)
+            if n == ".dynstr":
+                h[3], h[4], h[5] = va_start + str_off, file_end + str_off, len(new_str)
+            elif n == ".dynamic":
+                h[3], h[4], h[5] = va_start + dyn_off, file_end + dyn_off, len(dyn_bytes)
+            else:
+                continue
             struct.pack_into(sh_fmt, buf, shoff + i * shentsize, *h)
     result = bytes(buf)
     got = needed(result)

src/frameport/analysis/il2cpp.py

@@ -46,7 +46,14 @@ def _last_error(output: str) -> str:
     """The exception line of Cpp2IL's output (its stack trace isn't useful to a user)."""
     lines = [ln.strip() for ln in output.splitlines() if ln.strip()]
     msg = next((ln for ln in reversed(lines) if "Exception" in ln and not ln.startswith("at ")), None)
-    return (msg or (lines[-1] if lines else "no output"))[:300]
+    msg = msg or next((ln for ln in reversed(lines) if not ln.startswith("at ")), None)
+    return (msg or "no output")[:300]
+
+
+def _runtime_failure(error: str) -> bool:
+    """.NET itself stopped before Cpp2IL read anything ("Process terminated", e.g. no libicu on the PC): not a fact
+    about the game, so it isn't cached. Older FramePort versions cached it as the stack line it ends with."""
+    return "Process terminated" in error or error.endswith("at Cpp2IL.Program.Main(System.String[])")
 
 
 def _plain_version(version: str) -> str:
@@ -68,22 +75,21 @@ def find_methods(lib: bytes, metadata: bytes, unity_version: str, wanted: dict[s
     cache_file = _cache_file(lib, metadata)
     from ..tools import cpp2il as tool
 
-    # a caller's own Cpp2IL or the user's FRAMEPORT_CPP2IL override: never swapped for another build
-    explicit = cpp2il is not None or bool(os.environ.get("FRAMEPORT_CPP2IL"))
-    nightly = False  # Cpp2IL's development build: reads metadata (Unity 6.5+) and games the release crashes on
+    nightly = False  # Cpp2IL's development build: for metadata newer than its release reads (Unity 6.5+)
     try:
         cached = json.loads(cache_file.read_text())
-        if cached.get("error"):  # Cpp2IL couldn't read this build: don't run it again per patch
-            if explicit or cached.get("nightly"):
+        if cached.get("error") and _runtime_failure(cached["error"]):
+            pass  # the PC's .NET failed last time, not the game: run again
+        elif cached.get("error"):  # Cpp2IL can't read this build (e.g. an old Unity): don't run it again per patch
+            if cpp2il is not None or cached.get("nightly") or not tool.unsupported_metadata(cached["error"]):
                 raise RuntimeError(cached["error"])
             nightly = True  # only the release couldn't: the development build gets one try
-        elif _poisoned(cached, wanted):
-            pass  # an older FramePort took a Cpp2IL crash for "no such classes": run it again
         elif all(cls in cached.get("classes", {}) or cls in cached.get("missing", []) for cls in wanted):
             return {cls: {m: tuple(v) for m, v in cached["classes"][cls].items() if m in names}
                     for cls, names in wanted.items() if cls in cached.get("classes", {})}
     except (OSError, ValueError, KeyError):
         pass
+    explicit = cpp2il is not None
     exe = cpp2il or (tool.ensure_nightly() if nightly else tool.ensure())
     while True:
         try:
@@ -91,7 +97,9 @@ def find_methods(lib: bytes, metadata: bytes, unity_version: str, wanted: dict[s
             break
         except _Unreadable as exc:
             error = "Cpp2IL couldn't read this game's code: " + str(exc)
-            if not explicit and not nightly:  # e.g. BattleTalent (Unity 2021.3): the release crashes, nightly reads it
+            if _runtime_failure(error):
+                raise RuntimeError("Cpp2IL couldn't start on this PC: " + str(exc)) from None
+            if not explicit and not nightly and tool.unsupported_metadata(error):
                 nightly, exe = True, tool.ensure_nightly()
                 continue
             cache_file.parent.mkdir(parents=True, exist_ok=True)
@@ -103,14 +111,8 @@ def find_methods(lib: bytes, metadata: bytes, unity_version: str, wanted: dict[s
     return out
 
 
-def _poisoned(cached: dict, wanted: dict) -> bool:
-    """A cache entry written when Cpp2IL crashed after making its folders (GitHub #293): no class found at all and
-    every wanted one recorded missing. A real game always has some of them (UnityEngine's QualitySettings)."""
-    return not cached.get("classes") and bool(wanted) and all(c in cached.get("missing", []) for c in wanted)
-
-
 class _Unreadable(Exception):
-    """Cpp2IL failed or wrote no class files; the message is its last exception line."""
+    """Cpp2IL wrote no output; the message is its last exception line."""
 
 
 def _run(cpp2il: Path, lib: bytes, metadata: bytes, unity_version: str, wanted: dict[str, list[str]],
@@ -124,12 +126,13 @@ def _run(cpp2il: Path, lib: bytes, metadata: bytes, unity_version: str, wanted:
                                "--force-unity-version", _plain_version(unity_version),
                                "--use-processor", "attributeinjector", "--output-as", "diffable-cs",
                                "--output-to", str(t / "out")], capture_output=True, text=True, errors="replace",
-                              timeout=timeout, cwd=tmp)
+                              timeout=timeout, cwd=tmp,
+                              # .NET aborts at start without libicu (fresh WSL/Linux installs); Cpp2IL needs no
+                              # culture data
+                              env={**os.environ, "DOTNET_SYSTEM_GLOBALIZATION_INVARIANT": "1"})
         root = t / "out" / "DiffableCs"
-        # a crash after Cpp2IL made the folder tree (exit 134, no .cs files: GitHub #293) isn't "no such classes"
-        if proc.returncode != 0 or not root.is_dir() or next(root.rglob("*.cs"), None) is None:
-            error = _last_error(proc.stdout + proc.stderr)
-            raise _Unreadable(error if proc.returncode == 0 else f"{error} (exit code {proc.returncode})")
+        if not root.is_dir():
+            raise _Unreadable(_last_error(proc.stdout + proc.stderr))
         out, missing = {}, []
         for cls, names in wanted.items():
             f = root / cls