After a match the soft-return launcher was built from a fresh settings struct
that never carried the memcard paths or enabled flags. With nothing to inspect
the Save panel painted a placeholder block pattern on both cards, which read as
foreign save data even though the personal card files were untouched (the
netplay sandbox is unbound and personal cards reloaded before the launcher
opens).
- soft_return_lobby: seed memcard_path[] from the personal cards (settings.toml
path, else <memcard_dir>/cardN.mcd) and memcard_enabled[] like first boot.
- rematch writeback: fold ls.memcard_enabled/memcard_path back into the runtime
slot config and settings.toml, mirroring the first-boot exit path, so a card
toggled or browsed in from the rematch launcher reaches memcard_init_slots.
--memcard-dir keeps winning over paths.
- enabled flag is passed as -1 for disabled (0 means "unset -> on" to the
launcher) and read back as > 0, at both seed sites. Needs recomp-ui 028fa5c.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016HE3VRJ7nBVP1x7x2Yw2Ho
Matched Ape Escape retail SCPH1001 LLE builds identify 0661ce77 as the visible boot regression: parent 155e269b reaches game code, while 0661ce77 stalls near BIOS frame 375. Revert its four dependent follow-ups too; retain PR #326 readback bounds and PR #328 Vulkan aspect changes.
The row-by-row raster dispatcher amplifies an existing malformed DMA list into massive GL work. Keep the broader CPU/DMA arbitration experiment separate for compatibility testing. Document attribution, validation, and the temporarily restored interlace limitation.
Validation: full Ape target reaches title/menu and frame 11669 on retail LLE; OpenBIOS control reaches frame 3701. Eight focused tests pass; retained GL readback fixture passes 71 checks at both 1x and 4x after linking local SDL with iconv. Beads: beads-iisy; DMA follow-up: beads-eio.3.122.
queue_hello was fixed this way once, with a comment explaining why: a
name with a quote in it builds malformed JSON, the server drops the frame
whole, and the rename simply never happens. Its siblings were missed.
psx_lobby_create and psx_lobby_join interpolated the lobby name, the
PASSWORD, the display name, the game name and version, the bind address
and disc_fp straight into the frame. So a quote in a lobby name or a
password silently broke create/join, and a crafted value injected fields
into the client's own message -- which is the shape an edited client
would use deliberately.
Fix the class: every free-text value in an outbound frame now goes
through json_escape, at all seven remaining sites (list, create, join,
server_chat's game_name, seat_swap_answer, signal's lobby_id,
set_host_endpoint). JSON_ESC_CAP and a prototype are hoisted above the
first frame that needs them.
Two supporting changes:
- the create and join frame buffers grew (1536 -> 2304, 1024 -> 1536),
because escaping can double every value and a frame that no longer
fits is a create that silently fails.
- join now checks snprintf for truncation. create already did; join did
not, so an over-long frame was sent truncated and dropped whole.
match_caps needed nothing: language is already filtered to alnum/_/- and
session_bios to a two-value whitelist.
Compiles clean with -Wall -Wextra -Wformat=2, no new warnings against the
parent commit. Verified on the translation unit only -- no full runtime
build was run here.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V1dT6h1ZshMVUUVKTPxsCD
set_player_name only wrote the name locally, and the name reached the
server exactly once, in the hello sent at connect. So renaming left the
players-online list -- which is fed entirely by the server -- and the seat
table showing the old name until the next reconnect.
hello is the identity message, not a handshake: both clients now re-send it
when the name actually changes, through one builder that json-escapes both
fields (a name containing a quote used to build malformed JSON, which the
server drops whole, so the rename silently never happened). The server
applies it to the hub-wide row and, when the client is seated, to the seat
as well -- deduplicated within that room exactly as a join is, then
broadcast as lobby_update -- and hello_ok now reports the accepted name,
which differs from the requested one on a collision.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V1dT6h1ZshMVUUVKTPxsCD
- lobby_list rows carry allow_spectators / max_spectators / spectator_count
(browser shows "No" or "1/4"), and every lobby_list carries a players
array: everyone on the hub with country, room and a short connection tag
so a client can pick out its own row without publishing whole ids.
- Spectator latency: the round-trip table was keyed by seat and bounds-
checked against its size, so gallery seats (numbered from 64) were always
dropped. Seats now map to table cells, player seats first.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V1dT6h1ZshMVUUVKTPxsCD
- Host may sit in a spectator seat: session slot 0 stays the sim authority
with a muted pad and no port; slot->port map keeps players on the port of
their lobby seat (host first). Rematch path copies the same plan.
- Seat self-service on LAN (MOTK5 SEATMOVE / SWAPASK / SWAPANS / SWAPRES)
relayed by the host; online swap requests accept a gallery seat as target.
- Lobby chat ring + join/leave lines; country codes from the server.
- Keybinds: a key drives one input per player (binding S to Cross unbinds it
from Circle), and keybinds.ini is re-read after the rematch launcher too.
- LAN registry file anchored to the exe directory.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V1dT6h1ZshMVUUVKTPxsCD
psxrecomp's chat was already complete -- client, callbacks, and a host-relayed
LAN path snesrecomp does not have -- but nothing tested it. The SNES side got
this coverage when its chat was written; this brings psx level, against the
same properties, so the two cannot drift apart silently.
Covers what the ring actually promises: room order and both ends, local vs
peer vs system identity (decided by player id, not by who called send, because
the server echoes our own line back and that echo is the copy we keep),
monotonic seq, out-of-range reads refused, wrap-around dropping the OLDEST --
a chat that discards what was just said is worse than no chat -- empty lines
ignored, seq surviving a clear so a UI tracking "newest seen" does not skip
the first line of a new room, and an over-long line clipped to the field
rather than past it.
Links the REAL recomp_net and WS helpers rather than a wall of stubs: nothing
here reaches a socket, so fakes would buy nothing and could drift from what
the runtime links. Only psx_host_mono_ms is supplied, because it lives in the
runtime's own main TU.
Verified to discriminate: making the ring refuse new lines at capacity instead
of evicting the oldest fails two assertions.
ctest with -DPSX_NETPLAY=ON: 67/67 pass (2 disabled).
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DYwgPRbwbXz8FhpVzDM7tA
Seat 1 (P2) can bring its LOCAL slot-1 card to a match: it uploads the card
to the host at launch over the new recomp-net MEMCARD op, the host installs
it as the match's slot-2 card, and the usual card broadcast carries it to
everyone. The host's real slot-2 file is rebound to netplay/guest_card2.mcd
for the session and restored on shutdown; guests already sandbox both slots.
Lobby side: a per-seat memcard_offer on set_ready (has_card, share), a host
allow flag in match_caps, and guest_memcard_active settled ONCE by the host
at start and shipped with the launch, so a toggle racing the start cannot
split the room. LAN carries the same over MOTK5 UPDATE / MEMCARD / JOIN
tail / a trailing START line. PSX_NET_GUEST_MEMCARD=1 for CLI sessions;
a host waiting on a card that never comes stalls at a named phase
(mc_guest_wait), not a silent "ok".
Two latent guest-sandbox bugs fixed on the way: a disabled slot 2 had no
bound path, so a host blob carrying a card for it failed to import and the
guest stalled forever; and leaving the sandbox re-bound a disabled slot to
the sandbox file. Both slots are now bound in the sandbox and restored per
slot (memcard_rebind_path, which can also unbind).
Lobby chat: the client keeps a ring fed by the server's echo (op:chat);
LAN rooms relay through the host (MOTK5 CHATREQ guest->host, MOTK5 CHAT
host->everyone). Wired to the launcher's chat_send/chat_count/chat_get.
Also carries the spectator-seat work that was in the tree alongside this
(spectator seats in the lobby client, spectator_wire_slot in the launch).
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V1dT6h1ZshMVUUVKTPxsCD
Make a bare interpreted PC explainable from the session-long per_pc snapshot
alone. DirtyRamPcEntry gains occ_crc / occ_ok (the static overlay variant whose
code ranges span the PC, via a per-PC scan of the static-match cache, and
whether it validated at that moment) and last_ext_ra (gpr[31] at the most
recent external entry, i.e. the caller that reached this interior). Both are
stamped only on external entries -- arrivals from native dispatch, not interp
block chaining -- and emitted per row in dirty_ram_stats.per_pc as occ_crc,
occ_ok and ext_ra.
Reading the pair: occ_ok=1 is an interior gap inside live native code (an
alias seed fixes it); occ_ok=0 with a CRC means the spanning piece is resident
but CRC-missing, so it was compiled from another section's bytes or rewritten
at run time and no seed helps; 0 means nothing compiled spans the PC.
psx_overlay_resident_crc_at() records each static-match cache entry's code
span (lo_min/hi_max) so the scan is a range test; DLL-path titles fall back to
the loader's last residency hash. The debug-server reply buffer grows 32 -> 64
KiB for the wider rows; the tail reserve still cuts between rows.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
starvation_watchdog_check() sampled the clock before loading the heartbeat,
but the heartbeat is also stamped by the debug-server IO thread on every
send() chunk. A stamp landing between the two reads made last > now, the
uint64 subtraction wrapped past any threshold, and a healthy runtime exited
with code 2 (BoF3 2026-09-02: 402 us of real staleness tripped the 4 s
watchdog within ~2 min whenever the area poller was attached).
- Load the heartbeat first, decide through the new pure helper
starvation_watchdog_stale(), which refuses a negative gap by construction
(same shape as the frame_pacing_sleep_ms fix).
- Make s_last_heartbeat_us _Atomic with relaxed store/load.
- Tag the exit origin: "starvation_watchdog" on the trip, console_close /
console_ctrl_break / console_ctrl_c in the Win32 console handler, and
signal_sigint / signal_sigterm in the soft-exit handler. These all used
to reach psx_atexit_handler as atexit/unknown, indistinguishable from an
SDL window close.
- Add starvation_watchdog_test (ctest) pinning the decision function.
Verified on BoF3 build-dbg: 10 min soak with the poller polling at 1 s and
the watchdog enabled at its 4 s default, no dump, process alive; forced
trip with PSX_STARVATION_TIMEOUT_US=1000 fires and the run report reads
exit_origin "starvation_watchdog".
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Matthew Stanley