mirror/psxrecomp

Fork 0

mirror of https://github.com/RetroPortingToolKit/psxrecomp synced 2026-10-25 18:05:12 -04:00

Files

T

Alex Vanderveen d4ea4ade1f fix crash path from bad splash screen bug, and optimize cross platform pacing + rollback

2026-08-14 02:25:59 -04:00

269 KiB

Raw Blame History

MotK rollback hookup checklist

Status: hooked (experimental) · branch feat/rollback-netplay · depends on lib/recomp-net @ feat/rollback

Today MotK / psxrecomp lobby netplay defaults to rollback: stage_local → poll_admit (invent within P) → guest frame → finish_frame. Missing remotes are invented (hold-last, MotK digital) only while wire_need ≤ highest_remote + P; outside that window admit stalls (BattleShip phase_lock). Gap=1 uses a short invent grace before hold-last (§23); gap≥2 uses the full §21 budget. Idle invent re-mismatched every held D-pad tick after commit (char-select episode storm). Seal gap-fill stays idle. Late wire goes through the input contract; rewinds open an RNetRbSession episode. Menu releases rewind (FMV soft-promote release-only only). Host Disable Rollback (or PSX_NET_MODE=delay) forces classic delay-sync try_admit.

0. Ground rules (do not skip)

Rule	Why
Keep delay-sync `RNetSession` working behind a flag	Lobby / ICE / save-xfer stay useful; Disable Rollback opts out
Predicted rows promote only via `hash_confirm` (or host protect)	Library invariant; NULL `hash_confirm_promote` = always rewind
Digests must be bit-identical across peers for the same sealed inputs	Otherwise every invent becomes an episode storm
Same game version + guest semantics	Prefer matching commits/deps. Per-peer PGO is OK (Settings → Optimize FMV Playback). Mixed trees/zlib still fork — size alone is not proof of match
Snapshots must restore at the exact sim tick requested	Ring load is the only rewind mechanism
Single-thread ownership of session + rings	Same as delay-sync

Env gate: PSX_NET_MODE=delay|rollback. Lobby default publishes match_caps.rollback=true; Disable Rollback publishes false. Auto D/P from RTT (P = 4 + D, see §22); optional Manual Input Delay / Prediction. Adaptive mid-match delay bumps are always on (no lobby disable).

1. In-memory snapshot ring (host)

Tasks

Add boot_state_save_buffer (or serialize-to-malloc) mirroring load-buffer
New module e.g. runtime/src/netplay_snap_ring.c:
- depth N (≥ RNET_RB_SEAL_MAX_SPAN = 128; start with 64 for soak)
- keyed by sim_tick
- ring_save(tick), ring_load(tick), ring_has(tick), drop oldest
Capture at a safe boundary — psx_netplay_poll_snap beside savestate_poll on slow + MotK IRQ fast/mid paths (interrupts.c); also flush pending snap in finish_frame (FMV mid-path used to skip it)
On load: psx_cycles_resync_after_restore / interrupts_resync_after_restore / cdrom_accelerate_after_savestate / psx_frontend_on_savestate_loaded / deferred psx_scheduler_resume_at via psx_netplay_rb_flush_resume
Resume safety: never longjmp from rb_pump under C++ vblank RAII — apply without resume, then flush_resume on BB-edge (poll_snap) or inside the admit wait loop (after present-body RAII destroyed)
Admit/resume split: try_admit never arms needs_advance while a resume is pending or while still in AwaitingBaseline
Baseline gate: send/enter Replay only after g_episode_snap_applied (peer BASELINE can arrive during SealInputs — must not skip restore)
Live snap rate-limit: every PSX_NET_SNAP_INTERVAL ticks (default 16, max 32); resim still snaps every tick. Ring uses raw boot_state (no zlib) — compress2 on RAM+VRAM+SPU was the live FPS tax; disk .pst still zlib. (Skipping VRAM on live snaps is unsafe for rewind.)
Snap PC must be psx_is_dispatchable — pick IRQ/BB-edge resume PC (not cpu->pc at present, often 0); defer save / abort episode instead of resume_at(0) → trap_crash
flush_resume only in Replay (after both baselines); SealInputs retransmits SEAL_ROWS; seal get_input_row invents hold-last so rows are is_valid (peer mask never completes on empty exports)
Live g_np.needs_advance must not bypass rb_try_admit during an episode (follower spun uncapped with zero finish_frame); arm load_tick at Replay entry so the post-flush_resume quantum is committed
Retransmit BASELINE while AwaitingBaseline (TURN drops one-shots); follower marks digest_a=READY once it has the peer digest; initiator waits for that ready-ACK before Replay (no solo resim)
Retransmit POST while Verify; admit stalls until peer POST / commit
load_tick tip slack (one snap_interval behind newest) so lagging peer still has the snap; follow refuse → SYNC initiator=0 NACK; initiator aborts SealInputs (plus 4s seal timeout)
SEAL_ROWS: stash if episode not open yet (same TURN/UDP reordering race as BASELINE below — the initiator's export_local_seals() burst can beat a delayed SYNC BEGIN through the relay); unstashed on begin_follower open, keyed by epoch (2026-08-01 scheduler asymmetry review gap-close).
BASELINE: stash if episode not open yet; burst rexmit on TURN; initiator ready-timeout → Replay (Verify still waits for peer POST)
Resume PC: reject low/vector junk (0xB0 etc.); prefer function entries; rewrite on load; 5s replay stall + 4s verify POST timeout → abort
Seal from load_tick (not only mismatch); hist then sealed SIO publish; sticky BB PC; skip CD accelerate + audio pump on resim; POST digest canonicalizes parked PC; POST diverge aborts episode (lobby stays)
Master digest folds CDROM controller FSM; per-tick resim audit logs dig/cd/sealed pads; idle_skip + auto_skip_fmv forced off under netplay; POST/baseline diverge → Live realign to matched load (or last commit)
Never apply baseline/realign snaps from mid-guest psx_netplay_pump (cycle watchdog) — only admit-wait / poll+immediate flush_resume; initiator waits for ready-ACK (no solo Replay); ready timeout → realign
Pin episode baseline snap (resim must not overwrite load_tick); realign loads the pin; audit logs core= vs cd=; skip CD boost + reset SPU CD FIFO on RB restore
Baseline/POST/hash_confirm agree on core digest only (cd= audit); CD-only forks were aborting good title/menu Start corrections

Storm calm: abort/storm cooldown + promote-sweep only (not after clean commit). Post-commit promote-only made char-select D-pad feel rejected (hist ok, sim not rolled). Live invent is hold-last (idle invent → hold mismatch every tick = episode storm). Seal gap-fill idle. Menu release soft-promote removed (forked sticky Up with hold-last); FMV settle still soft-promotes releases. Press/release → episode; held matching invent → no episode. Char-select “hang” with matched POST: digital button edges always rewind in rnet_input_contract (no hash_confirm promote for buttons). A tap used to be two episodes (press + release). Fixed in recomp-net: tip-extend (rnet_rb_extend_target / MotK psx_netplay_rb_tip_extend) + TipHold (rnet_rb_enter_tip_hold after POST match: Live continues, tip_runway quiet window, late release tip-extends without a second baseline) coalesce press+release into one episode. Tip-extend from TipHold/Verify clears the POST handshake; follower FOLLOW mirrors initiator rereplay; TipHold ignores stale rexmit POSTs. Tip-extend during Seal/AwaitingBaseline resigns+extends only (no rereplay) so the initiator cannot solo-Replay before ready GO. TipHold tip-extend stays TipHold (library); rereplay only if Live already invented past the prior tip. FOLLOW mirrors that gate. Tip-extend rereplay reloads the prior tip on both peers (not mismatch-1→pin fallback vs FOLLOW old_t). Tip-extend snap apply always arm_rereplay_after_load (hc_prime + sim=reload+1) — poll_snap used to apply without arming, leaving the TipHold Live tip clock and invent FRAME_COMMITs → false resim core diverge (matched sealed fin, stale peer invent). TipHold Live does not emit FRAME_COMMIT; tip-extend Replay drops in-flight invent commits until the peer's sealed resim matches. TipHold invent-cap (menu D-pad storm): Live stalls once sim > tip + tip_seal_slack (MotK forces slack 0). Stops invent racing ahead of the tip and tip-extend rereplays on every held edge. Quiet finalize counts tip_runway (MotK 24) pump frames at the invent cap when sim cannot reach the old tip_hold_until. Seal span cap (menu hang): peer-seal completion is a uint64 bitmask (RNET_RB_PEER_SEAL_MASK_BITS = 64). Tip-extend past seal_base+63 fails; TipHold used to begin_refused until runway then open ep N+1 alone → seal timeout. Fix: TipHold span-cap tip-hold-commits immediately and begin_rewind opens a fresh episode; FOLLOW yields TipHold on a new-epoch SYNC. Self-test: rollback_episode_test (extend to span=64 OK, span=65 fails). Stale POST after tip-extend: RB_POST carries target_tick; Verify ignores peer POSTs whose tip ≠ episode tip (tip-extend left POST@T in the queue while Verify@T+1 → false diverge / peer verify timeout). Self-test: test_rb_post_tip_filter + rb_wire_test tip binding. Post-TipHold choose_load_tick / follower frontier hard-cap at agreed_through — ignore hash_confirm above that watermark (Live invent + PC-cleared FRAME_COMMIT false-confirmed forked tip snaps).

`tip_seal_slack` (MotK 0 / library default 2) sets invent headroom past
tip + initial seal; `tip_runway` (MotK 24 / library default 12) caps
TipHold quiet + suggest slack;
**light tip**
(`RNET_RB_CORR_LIGHT_TIP`) skips ready-ACK RTT when load is at the
shared frontier and depth ≤ 8. Do **not** soft-promote releases.
**Resim depth (main-menu "back to title" hang):** `choose_load_tick`
always applied interval rounding + one-interval tip slack, so a mismatch
one tick after a commit (798) re-loaded 768 and every menu tap replayed
~30 ticks twice. Fixed with a **shared-frontier fast path**: ticks the
peer provably holds need no slack — (a) `hash_confirm` resolved_through
(both simmed, core digests matched → same interval snaps) and (b) the
last committed replay span (both peers resim-save a snap at every
replayed tick). Release-after-press now loads at commit target, ~2-tick
replay. Peer eviction still covered by follower NACK (abort, not hang).
Do **not** freeze `cdrom_advance` during Replay (FMV skip resim hung).
Promote wire into hist **before** `begin_rewind` seal.
FMV media + **digest-gated post-FMV lockstep**: no invent + refuse
begin/follow for at least MIN=180 ticks (~3s; was 90 — invent≠Cross
at +14 opened a `0x8006CDA0` tip storm); hold until hash_confirm
matched CONFIRM=16 contiguous ticks or MAX=300. On RELEASE: invent
stays off **UNLOCK_GRACE=64** more ticks (do not clamp until→sim) and
arm `promote_sweep` so sticky hold-last poison cannot invent at
unlock+1. Invent stays **hold-last** after unlock (idle invent
re-mismatches every held D-pad tick — char-select freeze class); a
`pub=ffbf wire=ffff` FIRST CORE at unlock is a normal press/release
mispredict and light tips handle it. Dense tip snaps during
media/lockstep/+32 after invent unlock.
MotK TipHold: `tip_runway=24`, invent slack **0** (Live stalls at tip)
so tip-extend rarely rereplays — menu D-pad coalesce without the
prior-tip reload FPS cliff.
Symmetric ready: follower ACK → initiator GO → both Replay.
**`flush_resume` releases `gpu_vblank_flush_present` reentrancy guard**
before longjmp (stuck `s_flushing_present` blocked all later presents /
`finish_frame` — MotK `0x8006CDA0` Replay hang). Mid-guest pump runs
`poll_replay_stall` (5s abort).
**Menu wait-loop resim (CD54↔CDA0):** do **not** arm deferred present on
flush_resume / do **not** re-finish `load_tick` (snap is already
post-present). Phantom fin@load before the latched VBlank IRQ put peers
on opposite ping-pong edges (`v0=1` vs countdown, ~5-cycle skew). First
arm is `load+1`; `hc` primed after load. Netplay flushes deferred present
**after** IRQ delivery when both are due (post-RFE digest). Also: do
**not** flush present on BB edges while `in_exception` (handler sees
IEc clear → old path `finish_frame` mid-BIOS before RFE restore;
soak irqctx `restored=0/reason=0`, sealed Cross resim forked
`v0=1` vs countdown / cyc±14).
**Returning-leaf flush_resume (`0x8006A9F8` → PC=0):** prefer IRQ/sticky/
`$ra` over bare function-entry snap PCs; `flush_resume` clears deferred
present + bb_defer nest; sentinel same-thread path must not publish
`pc=0` during top-level RB resume; scheduler recovers null-pc via `$ra`.

Abort cooldown from live sim (before realign rewinds the clock). Old path armed until from rewound tip → uncapped catch-up burned a short window in ms → char-select episode storms (STALE COOLDOWN). Failed episode: 24 ticks from live (48 on streak≥2; was 60/120). Begin SPAN CAP=24: deep post-abort catch-up is chunked (commit → next episode) instead of one Replay across the whole cooldown (soak depths 63→128 felt like "pushing further back"). §47: SPAN chunks stay under Replay ownership — Verify is a digest barrier between chunks; TipHold is not part of confirmed catch-up. Reconcile promotes wire for the whole abort window (promote-no-resim). Clean commit does not arm cooldown.
§47 Replay ownership contract (contiguous confirmed frontier): Replay owns forward progress until no further contiguous confirmed simulation is possible; must never wait on already-confirmed inputs. Local tip production continues during Replay (protocol peer). POST match → chain next SPAN or Final Verify→Live (no TipHold invent-cap mid catch-up). Long catch-up periodically presents live Replay VRAM.
§49/§73 WAN chain/GO/realign: ownership chain if frontier > tip+4 (PSX_RB_CHAIN_MIN_AHEAD; was tip+8 — §73 bisect); initiator keeps GO until peer POST; ready timeout RTT-scaled; INPUT resends from peer ACK when behind tip-redundancy. (§49b: do not clear remote tips on Live realign — tip=0 pcap freeze.)
§50 FMV tip-extend gate: do not tip-extend / FOLLOW-raise through FMV media or settle (same window as begin/follow refuse). TipHold + FMV → commit sealed tip; mid-FMV TipHold entry also commits. Stops host rereplay past guest ownership-final Live → ABANDON bfc03c04 core/CD fork.
§51 choose_load / Replay layers: (1) newest provably-safe snap — peer RESOLVED must not clamp below HC floor; (2) inclusive commit-tip span over %iv fallback; (3) ownership SPAN continue skip-snap (no reload); (4) catchup present ~150ms cadence, not every resim frame.
Present only at MotK wait CDA0: netplay gpu_vblank_flush_present skips while resume/check PC is 0x8006CD54 (leave pending until 0x8006CDA0) so sealed idle resim cannot digest opposite ping-pong edges (cyc±9 / v0 fork after mid-handler present fix).
Netplay CPU-authoritative VRAM — software raster owns guest VRAM (snaps/av=). OpenGL dual-raster keeps SW@1× authority + GL@Nx FBO present (g_gl_fbo_present=1); never glReadPixels. Vulkan netplay still uses a software window. baseline/POST agree on av= via dig_b / POST input_digest
Netplay GPU lock before snaps + late re-arm keeps GL present when OpenGL was requested (no teardown → black first match). Rematch clears the lock on lobby soft-return. Pure-software still builds SDL_Renderer when no GL context exists.
Netplay SW sim scale 1 — dual-raster keeps SW@1×; GL hr FBO uses launcher supersampling for present quality. SW-only netplay stays native scanout + upscale (no gr_render_display_hires).
§92 dual-raster present quality — GP0 fan-out SW+GL; restage FBO after snap; digests CRC CPU VRAM only
OpenGL resim hold-last V-flip — HOLD_DRAWABLE presents without re-applying PRESENT_VS V-flip (was one upside-down frame on Replay load until the next live CPU present).
§91 tip-extend / ownership Live asymmetry — honor peer OP_COMMIT while still TipHold/Replay (not only Verify); snap fallback if SNAP-STALE dropped extend_from; refuse tip-extend once peer committed this epoch (stops verify-timeout + peer pcap_freeze hang).
Mid-FMV tip load: cdrom_resync_deadlines_after_restore; do not wipe SPU CD FIFO while XA/FMV pending; FMV media includes cdrom_fmv_stream_pending (XA mode+reading) so invent-off arms before first MDEC colour decode; mdec_recently_active uses guest-cycle age (host s_frame_count lied under present-skip / Replay). RB frontend hook resets depth24 cutover when media is already live (avoid permanent cutover blank).
flush_resume releases present-flush reentrancy guard (no latched-VBlank re-arm — that phantom-finished load and forked menu wait resim). Symmetric ready GO. Live snaps stay on during media. Replay arms load+1 with present-after-IRQ on netplay BB edges.
Netplay depth24: present 1/4 vblanks; skip live FRAME_COMMIT (full-RAM CRC) + prime hash_confirm when media ends
MDEC SSE2 IDCT + 24bpp YCbCr row encode (Beetle-matching, bit-identical to scalar; self-check at mdec_init) — raises offline/netplay FMV on slow peers; remaining FMV FPS is mostly host CPU ceiling
MDEC snap last_color_age is guest-cycle relative (was host s_frame_count → false baseline aux trips with matched FIFO/SPU)
Diag: rb wire promote-no-resim / rewind-request — late wire into hist without resim (cooldown/FMV/sweep) vs real episode open / begin refused
Diag: rb live dig every 32 ticks + rb FIRST CORE DIVERGE (FRAME_COMMIT mismatch) with core partitions (cpu/clk/tim/ram/dirty) + av/cd — find when peers fork before the first doomed baseline abort
Baseline dig_c = ext = crc(aux, cd, spad, dma, sio) — gate before Replay; matched core/av/aux with divergent CD/bus (pin zlib skew) was doomed resim. Wire still dig_c; logs print ext= + raw cd=/aux=/spad=/dma=/sio=. Zero host last_sector_frame on CD snap wire. mid-Replay FRAME_COMMIT abort on core mismatch (no false POST); rb audit fin + abort dump parts + bus digests + cpu-split
SIO resim fork: sioP showed fsm-only forks with matched regs/pads/mc + bit-identical guest. Fixes: (1) sio_pace_walk no longer drops leftover cycles after a transition cap (peers batching advances differently left divergent shift/ack remainders); (2) reseat sio_trace_seq on snap load; (3) netplay sio= / baseline_ext fold only through fsm pace (exclude host-audit meta/byte_seq); (4) mid-Replay cycle-watchdog pump drains FRAME_COMMIT only — no reconcile/rb_pump. Logs: sioP=regs/pads/mc/pace/meta
Replay entry: hc_prime_after(load-1) drops live invent commits (false resim core diverge); first ready=1 baseline burst bypasses rate limit (initiator was ready-timeout while follower solo-Replayed)
Present-edge digests clear PC (FRAME_COMMIT / audit fin / POST) — parked cpu->pc=0 vs live BB + host-local sticky forked dig_cpu with matched RAM/clk; rb cpu-split logs gpr/hi_lo/cop0 vs raw_pc
Core digest folds GTE (was snap-only) — MFC2 can fork GPRs with matched RAM/clk/SIO; rb cpu-split adds gte= + rb gpr-dump on fin/abort/post so peers can diff which regs forked
Core digest = fold of part digests (one RAM CRC pass, not dual stream); core= values change vs older binaries — peers must match
Log rb binary path=… size=… at rollback start — peers must run the same bit-identical binary. Diags showed host build-release/ vs guest motk-0.1.0-linux-x64/ with pin zlib ~1.34M vs ~1.13M, matched baselines, then Replay GPR-only (ep1) / cpu+tim+ram (ep2 tick after a good Up)
FPS: raw in-memory snaps + default interval 8; resim audit skips AV/CD on arm (VRAM CRC only on fin / baseline / POST). Still open: strip CDROM/MDEC from MotK ring if match path allows (further RAM headroom — raw ring ≈ 3.5 MiB × depth)
MotK menu v0-only Replay fork: matched baseline + tick N (all GPRs), tick N+1 only r2 differs (host 1 / guest 0x5bd2) with sticky 0x8006CDA0 wait-loop, matched RAM/GTE/cycles. BIOS left v0=1 when same-thread GPR restore skipped (mode-1 PC heuristic miss) while peer restored the post-lw countdown. Fix: netplay auto PSX_SAME_THREAD_RESTORE=3 — same-TCB RFE/SYSCALL always restores (ChangeThread still skips). Diag: rb irqctx on fin/abort with restored/v0_exit/v0_saved. Do not canonicalize v0 in digests.
Netplay BB-edge present: after restore-3, idle sealed resim still forked cpu+ram in one tick — sdl_vblank_present/finish_frame ran nested from fire_vblank_edge mid-psx_cyc_step in the wait loop, so peers digested different instr points. Fix: under netplay, queue the GPU vblank callback and flush in psx_check_interrupts (BB edge); clear deferred pending on snap resync. Offline still presents immediately.
Card/save coexistence (BB-edge present hold): BB-edge finish_frame mid memcard busy-wait wedges Ape Escape's card-check scene (empty starfield) and the same class of titles. Hold gpu_vblank_flush_present while sio_hold_present_for_card() (SIO card FSM busy + progress, stale escape ~10 VB) and while a deferred cooperative ChangeThread is pending. Keep s_present_pending; MotK menu-wait drain still runs outside card/save traffic. Do not remove BB-edge commit — MotK sealed resim still needs it.
Menu wait resim phase (CD54↔CDA0): after present-guard fix, ep1 matched fin@load then forked fin@load+1 (r2=1 vs countdown, cyc±5). Cause: flush_resume armed deferred present for latched I_STAT → phantom finish_frame before latched VBlank IRQ. Fix: arm load+1 only; no latched re-arm; present-after-IRQ when delivery is due.
Mid-handler present flush: sealed Cross tip still forked fin@load+2 (v0=1 vs countdown, cyc±14) with matched pads/SIO/baseline; irqctx stuck at restored=0/reason=0. Cause: handler BB edges flushed deferred present while in_exception (IEc clear). Fix: skip present flush until outer delivery returns; gpu_vblank_flush_present also refuses in_exception.
CDA0-only present + abort span cap: after mid-handler fix, tip+1 idle sealed resim still forked cyc±9 on CD54↔CDA0; abort cooldown then opened 63–128-tick catch-up Replays. Present defers at CD54; abort cool 24/48; begin SPAN CAP 24 chunks catch-up.
Returning-leaf resume crash: after load+1 fix, Start-class episode resumed at 0x8006A9F8 (jr $ra leaf) with IEc=0 → top-level execution completed, PC=0 (cps: final_ra=0x8006CCA0). Fix: resume PC pick prefers IRQ/sticky/$ra; clear present+bb_defer on flush; no sentinel pc=0 while top_level_resume; scheduler null-pc recover.
Memory budget / thinner snap: optional strip CDROM/MDEC if MotK match path allows (further RAM headroom)
Standalone ring bookkeeping test: runtime/tests/test_netplay_snap_ring.c

Vtable: save_state / load_state → ring only (never disk slots).

2. Master state digest + frame-commit watermark

Tasks

Define MotK master digest (netplay_master_digest + CDROM partition)
After each committed sim tick, compute digest[tick] into a small ring
Exchange RNET_PKT_RB_FRAME_COMMIT via session send/take (queued)
Advance local resolved_through only when digests match through T
Implement psx_netplay_hash_confirm_through(tick)
Wire hash_confirm_promote in invent/contract + episode stick gates
Unit test: runtime/tests/test_netplay_hash_confirm.c

3. Input history + invent / prediction

Tasks

Per-slot input history ring (netplay_input_hist)
Local path: is_predicted = 0
Remote invent = hold-last (neutral if no prior); stall when ahead of remote tip by > P. Seal get_input_row gap-fill remains idle.
Late wire → rnet_input_contract_stick_replace_decide + hash_confirm_promote
Rewind → psx_netplay_rb_begin_rewind (episode)
get_input_row vtable → netplay_ih_get
PsxNetPad ↔ RNetRbFrame (incl. analog → SIO pad type; seal wire source); SIO from history / sealed rows
Unit test: runtime/tests/test_netplay_input_hist.c
Env: PSX_NET_MODE=delay|rollback → psx_netplay_rollback_mode()

4. Live frame loop (replace admit barrier when rollback on)

Tasks

Branch poll_admit on rollback (invent; episode admit while active)
Never call delay-sync try_admit wait for missing remotes in rollback mode
Still use RNetSession for pad tip transport + ICE
Keep load-barrier / save-xfer / soft-exit paths on delay-sync semantics
finish_frame requests snap; episode path uses psx_netplay_rb_finish_frame
Skip wall pacer while psx_netplay_is_resimulating()

5. Episode path (resim)

Tasks

Create RNetRbSession in psx_netplay_rb.c when mode=rollback
Fill RNetRollbackVTable (snap save/load, digest, hist get_input_row)
On rewind: load_tick = newest ring tick ≤ mismatch (refuse if ring empty)
g_np.local_slot / slot_count / delay set before rb_start (frozen into RNetRbConfig)
Peer seal apply ignores is_valid=0 rows (wrong-seat export must not complete)
Seal export/apply over RNET_PKT_RB_SEAL_ROWS (+ SYNC/BASELINE/POST/RESOLVED)
During resim: skip wall pacer; publish sealed SIO (not live invent)
After commit: rnet_rb_on_post_match + session sim clock to target+1
Soak: forced stick mismatch → one episode; digests match post-commit

6. Wire / transport mapping

Tasks

Session send/take for SYNC / SEAL_ROWS / BASELINE / POST / RESOLVED / FRAME_COMMIT
Delay-sync peers ignore opcodes 20–25 (session queues only when MotK drains)
Negotiation: match_caps.rollback + launch.rollback / PSX_NET_MODE

7. Determinism prerequisites (MotK-specific)

Tasks

Netplay clears mods (mod_runtime_clear_for_netplay / launcher hook; main skips mod_runtime_commit when net_cfg.enabled)
Same BIOS stem + disc identity on both peers (existing verify)

Audit non-deterministic host clocks in sim path — selfcheck-driven (was soak-driven). PSX_RB_SELFCHECK=1 (offline, single process, runtime/src/psx_selfcheck.c): every INTERVAL boundaries snap the machine at a savestate BB edge, record SPAN ticks of applied pad rows + full digest partitions, then rewind and resim the window twice from the same snap. Replay#1 vs replay#2 is the rollback invariant (both peers resim in an episode) → PASS/FAIL with per-part DIVERGE lines; live-vs-resim is reported as restore-drift (diagnostic; VBlank phase re-applied from snap). Verdict = warm #2vs#3 after ambient-prime. Fixes via selfcheck: VBlank-phase restore; overlay freeze; discard dirty/interp load-delay on restore; pin host frame; RECORD=resim host-skip profile; idle_skip off; turbo/FMV-skip gated; top-level resume; IRQ escape + check-cycle/poll-throttle clear; sticky text_diverged / kernel-bless / overlay validation memos cleared on RAM restore; span-end load via psx_selfcheck_flush_load after present-body RAII (BB fast-poll tails forked #2/#3 load sites); snap PC uses RB resume_pc_ok (reject 0xB0). MotK attract soak /tmp/selfcheck_spanend2.log: 316+ PASS / 0 FAIL through the classic win#70/#73/#118/#138/#139/#277/#279/#301 set. Re-verified after hold-last invent (/tmp/selfcheck_verify.log): win#70/#73/#118/#139 PASS, 157+ PASS / 0 FAIL and climbing. Post-FMV cutover soak (/tmp/selfcheck_fmvcut.log, INTERVAL=120 SPAN=48): 52 PASS / 0 FAIL through early attract/menu — confirms 954-class peer fork is invent≠wire, not offline resim non-determinism. Tune: PSX_RB_SELFCHECK_INTERVAL/SPAN/FAULT/PRIME. Mash: PSX_RB_SELFCHECK_MASH=1 (+ optional MASH_SEED / MASH_RATE) synthesizes fighter-style face/D-pad/shoulder spam on live boundaries so headless soaks stress invent edges / wait-loop resim without a controller. Rows are recorded and replayed. Stuck hash_confirm / doomed tip loads: a transient FIRST CORE (e.g. sim 201) left resolved_through stuck; once that tick aged out of the 128-slot dig ring, choose_load_tick fell through to tip-slack (912) while confirmed snaps were gone — baseline then aborted on cpu-only MotK wait-loop PC forks (CD54↔CDA0) despite matched ram/clk. Fix: netplay_hc_heal_stale_gap, refuse loads past the shared frontier, canonicalize wait-loop snap PC to CDA0. Agreed tip aged out of snap ring: after tip-hold commit, Live can advance ~900 ticks with matching FRAME_COMMITs (hc=1824) while agreed_through=919 falls below oldest — begin REFUSED forever (no confirmed snap), invent≠wire never resims, cores fork with matched clocks. Fix: heal_agreed_watermark_if_aged_out raises agreed to the highest hc-confirmed snap still in the ring (only when no agreed-era snap remains — TipHold false-confirm guard intact). rb live dig local is a breadcrumb (not peer match). BOOTSTRAP when tip-hold never ran: doomed early FMV abort left agreed invalid and hc stuck below ring oldest (live core forks block heal_stale_gap). Remote saw host P1 on the wire (pub=ffff wire=ffbf) but begin REFUSED forever — P2 corrections still opened on host. Fix: seed agreed to newest interval snap (BOOTSTRAP / HEAL-FORCE); choose_load/follow fall through when watermark < oldest. Post-HEAL resim CD54↔CDA0 (cyc±3 / −43): after agreed HEAL→944, identical baseline + pads still forked fin@945 — dig2 IRQ at CDA0 (cyc=…569, countdown v0) vs dig1 at CD54 (…572, v0=1); dig2 later matched dig1 on a warm retry. Cause: interrupts_resync zeroed cycles_since_vblank (not in snap/digest) while timers/LCF kept mid-frame phase; CDA0-only present treated latch pc==0 as presentable; Replay tip-apply from BB poll mutated CPU under live CPS. Fix: persist csv in BS_SEC_IRQ (12B), stop zeroing on resync, fold csv into clk digest, present only at CDA0 (sticky/last fallback), episode loads only via try_admit. Post-csv residual (clk/tim +9, double fin): after csv persist, sealed tip still aborted at resim 1202 with matched GPR/cpu/ram/av/SIO but irqctx cyc ±9; dig1 fin@1202 and fin@1203 shared identical dig/cyc (double finish_frame, no guest advance). Cause: sticky I_STAT kept delivery_needed so entry skipped present while post-IRQ flush also skipped on CD54 → deferred pending stacked across a full VBlank, then one CDA0 drain ran finish twice; sticky-unknown defer (latch cleared) worsened accumulation. Fix: attempt present at entry even when delivery is due (CDA0 gate no-ops CD54); coalesce s_present_pending to 1; sticky CDA0 with cleared latches allows coalesce present. Arm→first-present +2 VB on long Replay: post-HEAL short tips matched, but cold span-cap load (ep9 952→976) forked fin@953 — dig1 arm+2.03 VB vs dig2 arm+1.00 VB, pads matched. Cause: entry gpu_vblank_flush_present ran before s_last_interrupt_check_pc was updated, so MotK gate saw stale last==CD54 on every CDA0 edge and no-op'd; present only drained on post-IRQ at a CDA0 delivery. First post-arm VB taken at CD54 → full extra period. Fix: publish edge PC before entry flush; gate prefers compiled CDA0 pc over stale last. Non-det fin@946 CD54 vs CDA0 (resim storm): matched baseline + pads; dig1 alone flipped cores across warm retries — IRQ at CD54 (v0=1) vs present-before-IRQ at CDA0 (countdown). Fix: hold VBlank-only delivery at CD54 while deferred present is armed (deliver after CDA0 present); MotK gate requires explicit CDA0 edge (no sticky-only allow); flush_resume pins sticky to canonical CDA0. FMV1→FMV2 cutover stall: soak matched through FMV arm then guest collapsed (~5 ms) with TURN admit wait and no FMV settle — media stayed “live” (depth24) while MDEC idled. MotK present gate treated sticky wait PC as in_wait and blocked non-CDA0 edges (FMV/cutover). Fix: gate only CD54 edges (sticky only when latch cleared); depth24 1/4 present-skip and FRAME_COMMIT skip only while MDEC hot; rb FMV media heartbeat every 32. ±1 VB replay fork at MotK wait (abort@902): identical committed baseline 901 (e6a64d47) + idle pads still forked the first resim tick — abort cyc 509725487 vs 509160985 (Δ≈564480 = exactly one VBlank), wait countdown r21=0x704 vs 0x705, v0=5c88 vs 5c89. One peer delivered one extra VBlank during replay. Cause: the CD54 delivery-hold was gated on gpu_vblank_present_pending() — s_present_pending is host-only state (not in the snap), so peers entered replay with different hold behaviour. Fix: hold VBlank-only delivery at the CD54 edge in netplay unconditionally (edge PC + I_STAT are guest-deterministic; CDA0 delivers a few instructions later). The FIRST CORE @896 (pub=ffbf wire=ffff) preceding it was a normal press/release mispredict — ep1–2 committed fine; the storm was this replay fork. UNLOCK_GRACE stays 64.

**Residual Δ8-cycle replay fork (abort@940) — I-cache tags:** with the
unconditional CD54 hold in, the next soak forked far smaller: identical
baseline `f83f685b` / arm cyc `530611223` on both peers, fin@940 cyc
`531175713` vs `531175721` (Δ8), `v0=5c83` vs `5c86` — VBlank taken a
few wait-loop iterations apart, both at CDA0. Cause: the R3000A
I-cache fetch-cost tags (`g_psx_icache_tv`, `psx_icache.c`) are
host-persistent and were NOT in the snapshot — each peer replayed with
the cache its own live/retry timeline had built, so fetch-miss cycles
differed and IRQ delivery drifted. (Selfcheck/overlay replay already
shadow this state; RB didn't.) Fix: new `BS_SEC_ICACHE` snapshot
section (1024 tag words) written/applied by `boot_state.c` — warm
loads, retries, and the exchanged baseline blob all share the exact
fetch-timing state — and the tags are folded into the `clk` digest
partition so any cache asymmetry surfaces at compare time instead of
as a mid-resim abort. Section is optional on load (old blobs load
untouched); netplay peers are bit-identical builds anyway.

**Post-fix soak (2026-07-31): determinism CLEAN, storm is now pure
episode cost.** Full soak with BS_SEC_ICACHE: **zero aborts, zero
resim diverges** — 40+ consecutive episodes all committed first try.
But menu play ran 0.44–0.8x: every button press/release edge
(`pub=ffef/ffbf` vs `wire=ffff`, wire 1–2 ticks late) opens a paired
episode (baseline pin 3.6MB + seal/POST handshake + tip-hold).
The follow-up soak with `guest=`/`admit=` FPS split corrected the
first theory: the link was **direct LAN all along** (ICE selected
`typ host` candidates despite `force_turn=1` in the config banner)
and `admit` (network wait) is mostly <5 ms/f. The real costs:
(a) **guest CPU** — the MotK menu scene costs ~16.6 ms/f of guest
work under netplay (software GPU forced + idle_skip forced off),
i.e. zero headroom at 60fps, so every 2–4-tick resim burst drops
frames (guest hits 20–29 ms/f during storms; pre-menu boot ran
119 fps at guest 6–8 ms/f — it's the scene, not the engine);
(b) **mispredict frequency** — with delay=2 and both sims hovering
±1 tick apart (lead=0 admission), the wire for tick T routinely
seals 1–2 ticks late on every edge, and each episode further delays
input relay (self-sustaining storm). Next: raise input delay to 3–4
(margin for sim skew; kills most menu invents on LAN), and/or LAN
`PSX_NET_PREDICTION=0` (stall instead of invent — RTT≈0 makes it
free). Longer pole: shrink menu guest cost (hardware GPU needs a
deterministic VRAM snapshot path; sw rasterizer + full busy-wait
emulation is the ceiling), and drop baseline exchange/POST verify
from sealed-input-only episodes now that determinism is proven
(zero aborts across two full soaks).

**Stall-before-invent grace (implemented):** `np_try_admit_rollback`
invented hold-last on the FIRST miss of a remote wire row; the row
then landed 1–2 ticks later and the mispredicted edge opened an
episode. New `np_invent_grace_stall` (psx_netplay.c): before
inventing, stall the admit up to **PSX_RB_INVENT_GRACE_MS (default
30 ms)** from the first miss of that wire tick — the admit loop
pumps the session and waits on UDP at ~1 ms granularity. Adaptive
off: 45 consecutive expiries (peer genuinely lagging beyond the
budget, real WAN) disables the grace for 2 s so it never stacks a
per-tick stall on top of real latency. Host-side pacing only —
invented values are unchanged, guest determinism unaffected.
Set `PSX_RB_INVENT_GRACE_MS=0` to disable.
The first cut used 8 ms and failed: the follow-up soak showed the
lateness is **sim skew, not link latency** — ALL late edges were
on the peer running 1–2 ticks ahead (22×late-1, 5×late-2; the
other peer had zero), and 8 ms is less than one tick of skew, so
the grace expired on every edge, tripped adaptive-off, and the
storm returned ("stable for a few seconds then nonstop"). The
grace is really a **rate governor**: while the ahead peer stalls,
the behind peer keeps simulating and catches up, so a budget that
covers ~2 ticks keeps the sims aligned and, in steady state,
inputs arrive before the seal with no stall at all.
**Tick-period scaling (2026-07-31):** the first full-match soak
showed the fixed 30 ms budget being outrun in gameplay: the fight
scene runs 35–45 fps (guest 9–20 ms/f + admit), so a tick lasts
~25 ms and 2 ticks of skew is 50 ms — edges mispredicted again
(~40 episodes/match, "stormy" feel; lateness profile 27×late-0 /
12×late-1 on the ahead peer). The grace now measures the live
tick period (EMA over consecutive tracked wire ticks) and uses
`max(PSX_RB_INVENT_GRACE_MS, 2.5 × tick EMA)`, capped 100 ms, as
the effective budget, so it self-scales to whatever rate the sim
actually runs. At 60 fps the EMA path gives ~42 ms; at 40 fps
~62 ms. Adaptive-off (45 expiries → OFF 2 s) still guards real
WAN latency.
**Gap gate (2026-07-31, same day):** the scaled grace fixed the
storms (soak: zero episodes, zero aborts, deterministic match)
but serialized the sims: stalling on ANY missing row meant
neither peer ever ran ahead, so each admit waited out the other
peer's guest frame — the FPS logs showed each side's admit ms/f
mirroring the OTHER side's guest ms/f (8+12 vs 13+9, both
summing ~23 ms → 40–50 fps all match with no episodes at all).
Fix: the grace is only invoked when `wire >
highest_remote_wire + 1` — a 1-tick gap is the normal phase
offset of two pipelined sims and is invented through freely
(hold-last only mispredicts on real edges, and episodes are
cheap now that the agreed watermark tracks live). The stall —
the rate governor — engages only at >=2 ticks of genuine skew,
which was the storm condition it was built for.

**Timesync micro-throttle (2026-07-31, follow-up soak):** with
the gap gate, idle play held a clean 60 fps (admit ~0) — but
every input burst dropped fps to 34–48. Episode forensics: 29
episodes/side, 28/29 already on the light path, loads shallow
(2–9 ticks). The cost is the replay itself — a paired 2–9 tick
resim at ~13–16 ms guest/tick on BOTH peers per button edge —
and the episodes all came from the same source as ever: the
ahead peer running ~1 tick of phase ahead and inventing each
edge just before the real row landed (lateness 23xlate-0 /
6xlate-1, all on one side). New `np_timesync_throttle`
(psx_netplay.c), GGPO-style: advantage = wire_need − highest
received remote wire row, EMA'd once per tick; above +0.5 tick
the ahead peer shaves up to 3 ms per admitted tick until the
phase closes. Exactly one side sees positive advantage, so one
side paces down briefly and then rows arrive before the seal —
no invent, no episode. Capped at 3 ms/tick (worst case ~20%
pace, never lockstep); skipped during episodes; adaptive off
(engaged ~3 s straight → OFF 5 s) because WAN transit inflates
the advantage and can't be closed by pacing. `PSX_RB_TIMESYNC=0`
disables.
**Advantage metric was wrong (2026-08-01 soak) — replaced with
mispredict-driven pacing debt.** The soak showed BOTH peers
measuring ~+0.6 ticks of "advantage" (10/16 and 11/16): each
side samples wire_need at the start of its own tick while the
peer's newest row was sent at the start of *its* tick, so the
metric's natural operating point is ~+0.5, not 0. Both sides
throttled, neither could close it, both tripped the off-guard
(`advantage 17/16 not closing`), and the mispredicts continued
(33xlate-1, 43 episodes/side, fights at 0.54–0.7x). Rework: the
unambiguous "I am the ahead peer" signal is the mispredict
itself — only the ahead side reconciles real rows that arrived
AFTER it invented them. `np_timesync_note_late()` is called from
`np_rollback_reconcile_wire` on every predicted row whose real
row lands (matching or not, so held/idle rows feed the loop and
alignment happens before an edge); each event adds ~half a tick
of pacing debt (capped 2 ticks) and the admit path shaves it at
<=3 ms/tick. Steady state aligned = no invents = no debt = zero
cost. Adaptive off: debt continuously nonzero ~5 s (WAN transit
— every row late regardless of phase) → OFF 10 s.
Longer pole (documented, not built): one-sided
episodes — the follower's live state through a sealed-only span
is already the post-replay state (hc stores its per-tick
digests), so it could answer baseline/POST from stored data and
never rewind, halving system replay cost. Not attempted yet:
protocol-level change on freshly stabilized machinery.

**Two bugs found in a matched-pair soak (2026-08-01), both fixed:**
1. `note_late()` was called unconditionally on every predicted-row
   resolution, not gated on `pads_differ`. Under normal input-delay
   prediction EVERY invented row eventually resolves against a real
   wire row whether or not the guess was right — that's just how
   delay-based prediction works — so the debt signal was mostly
   noise. Moved the call after the `pads_differ` computation and
   gated on it; the busier peer's rewind-request count (28 vs 12
   across a matched pair) now cleanly identifies which side is
   actually mispredicting.
2. The off-guard used "debt continuously nonzero for 5s" → OFF.
   Soak evidence it was actively harmful: 24/36 episode commits and
   19/28 rewind-requests on the busier peer landed AFTER the
   off-guard fired mid-storm — an active mispredict burst legitimately
   keeps debt elevated (each edge tops it up before the last slice
   fully drains), that isn't pacing failing. Replaced with a streak
   counter: debt landing AT THE CAP with no room to have drained
   between hits, 12 times in a row, before disabling for 10s. This
   is the actual "pacing can't help, this is transit" signal.

**Depth24 (FMV) present path batched (2026-08-01):** FMV frames
showed guest cost roughly double the non-FMV baseline (15–22 ms/f
vs 7–13 ms/f) with admit cost a minor fraction — a local compute
cost, not a netplay one. `gpu_display_pixel_argb` was called once
per output pixel, and for `depth24` did 3 separate `gpu_vram_byte()`
calls each recomputing the row/wrap math fresh — 3x the per-pixel
work of the 16bpp path, as a function-call chain instead of a
straight-line loop. New `gpu_depth24_present_row()` (gpu.c) hoists
the per-row invariants (vy, base byte offset, how many pixels fall
inside the 2048-byte VRAM row before the black-fill tail) out of
the inner loop and inlines the byte extraction — same byte-order
shifts as `gpu_vram_byte` (no host-endianness assumption), same
output. Wired into both depth24 present call sites in `main.cpp`
(Vulkan CPU-readout path and the generic non-hires path); the
16bpp path is untouched.

**Unrelated build-system bug found while soaking:**
`runtime.cmake`'s `PSXRECOMP_RUNTIME_SOURCES` list was missing
`netplay_snap_ring.c`, `netplay_state_digest.c`,
`netplay_hash_confirm.c`, `netplay_input_hist.c`,
`psx_netplay_rb.c`, and `psx_selfcheck.c` — a stale local edit
unrelated to netplay work, likely from the `psxrecomp_add_game_runtime`
scaffolding added alongside it. Every rebuild in this session up to
this point silently linked STALE prebuilt `.o`s for those 6 units
from before the edit (their sources hadn't changed, so ninja never
flagged them) — nothing this session touched in those files, so no
correctness impact, but a fresh `cmake` reconfigure (e.g. after
editing `runtime.cmake` itself, or on a clean clone) would have
dropped rollback netplay from the link entirely. Restored the six
lines.

**Post-A/B soak (2026-08-01) — "never-ending storm" traced to a
round-start input-density burst, not a regression.** Full match
soak with the `pads_differ` gate + pegged-streak off-guard + batched
depth24 present: **zero core diverges, zero aborts**, both peers'
episode lists byte-identical (34 commits, ticks 159 and
1006..1400), full recovery to a sustained 60.0 fps for 450+ ticks
until voluntary disconnect (`sdl_window_close` / `peer_disconnect`,
not a stall). ICE selected `typ host` on both sides (confirmed LAN,
not TURN) so link latency is ruled out. All 34 episodes land in one
contiguous window starting the tick *right after* `FMV lockstep
RELEASE sim=939` hands control back to normal 2-tick-delay
prediction — i.e. the moment the round actually starts and both
controllers begin moving/attacking at once. Timesync debt during
that window stayed tiny (1–8 ms, cap is ~34 ms) and the pacer never
neared the cap, so this is not a phase-skew problem the pacer could
close faster — it is genuine simultaneous real input density from
two controllers exceeding what a 2-tick delay can predict, and it
self-resolves once the opening exchange calms down (~30 real
seconds at 40–70 fps here). Distinct from earlier storms: no
cascade, no divergence, no re-arming after it clears. Also
reconfirmed the pre-existing FMV admit cost: 11–15 ms/f *admit*
(network/lockstep wait) during FMV playback vs 6–11 ms/f guest
(render, post Fix B) — the FMV frame-rate ceiling is now the
lockstep admit wait, not GPU present cost. Next candidates, not yet
tried: (a) `PSX_NET_DELAY=3` to cut mispredict frequency in exactly
these high-density round-start windows (flagged 2026-07-31, never
soaked); (b) shrink FMV lockstep per-tick admit wait now that
render cost is off the table.

**Residual gameplay determinism fork (open, 1 hit / 4000 ticks):**
soak 2026-07-31 aborted once at sim=4034 (fight scene). Forensics:
identical baseline (epoch=40 load=4033 core=fc779568 both peers),
identical sealed pads (s0=ffff s1=ffbf), identical fin cycle count
(2277677049), and clk/tim/av/cd/dma/spad/sio/aux all matched —
only **cpu** (50d03880 vs 01ccbeaf) and **ram** (88a8e19f vs
58f7e8de) forked. So clocks, IRQ timing, icache, and devices were
bit-identical and the GPRs/RAM still diverged — a genuine
non-clock replay fork (GTE state? uninitialised read? resim-order
RAM write?). Needs a repro before digging; realign recovered it
in-band (cooldown, no cascade).

**Char-select storm = frozen agreed watermark (fixed):** with the
30 ms grace, menu D-pad was clean (6 late edges all soak, was 29)
— but char-select stormed with the peers' live digs IDENTICAL
through the whole window. Cause: after a tip-hold commit set
`g_agreed_valid`, the hard watermark only advanced at episode
commits; hundreds of hc-confirmed clean live ticks were ignored,
so every new edge reloaded from an ancient snap (soak:
`mismatch=2135 load=1361`) and SPAN CAP crawled 24 ticks per
episode while Live galloped ahead — permanently behind. Fix:
`advance_agreed_watermark_from_hc()` — outside episodes/TipHold/
pending loads, raise agreed to the newest hc-confirmed interval
snap in the ring (span_lo collapses to the new watermark); called
from `choose_load_tick` and the follower REFUSE gate (the follower
must advance too or the initiator's valid frontier loads get
NACKed). The historical false-confirm hazard behind the hard cap
(TipHold Live invent FRAME_COMMITs with cleared PCs) is
structurally gone — TipHold Live emits no FRAME_COMMITs and the
core digest folds full CPU split + csv + icache.       Edges now load
from ~one interval back and replay a handful of ticks (light
tips), like the main-menu path.

**Rematch black screen (fixed):** second lobby launch armed
invent-lockstep at `sim=0` with `FMV media … depth24=0 mdec=0 xa=0
fmv_pend=1 cd_reading=1 mode=e0 present_pend=1` and never printed
another FPS line. Cause: `rb_fmv_media_active` treated
`cdrom_fmv_stream_pending()` (`reading && mode&0x48`) as media —
MotK boot/LoadExe sets XA mode bits on ordinary CD reads, so
rematch locked invent before the first frame. Also soft-exit left
`s_present_pending` / flush reentrancy sticky (`gpu_init` does not
clear them). Fix: media = depth24 | mdec hysteresis | real XA
stream only; `present_session_reset` clears deferred present;
rb shutdown clears sticky BB PC + agreed watermark.

**Episode cost cut: redundant full-bus digests off the per-tick hot
path (2026-08-01).** `delay=3` and `delay=4` soaks showed the same
"chain of small, back-to-back episodes" storm shape as `delay=2` —
increasing the prediction buffer didn't help, so the fix target moved
from network/prediction tuning to what a replayed tick actually
*costs*. Found: `log_resim_tick_audit()`'s `"fin"` call (fired once
per replayed tick, i.e. every tick of every episode, not just the
last) unconditionally computed the *full* bus digest breakdown —
`netplay_core_digest_parts` (a full 2 MiB RDRAM CRC plus GPR/COP0/GTE/
clock/timer CRCs), a full 1 MiB VRAM CRC (`netplay_av_digest`), plus
CD-ROM/aux/scratchpad/DMA/SIO digests — purely to print it. Worse, on
the *last* tick of every episode, `enter_verify_at_tip()` then
recomputed core/aux/av **again**, independently, for the real POST
digest sent over the wire — so the commit tick paid for two full
sweeps back to back. For a storm with dozens of 3–5 tick episodes
this was megabytes of pure CRC32 work landing on exactly the ticks
already busy re-simulating, compounding guest ms/frame during the
exact window players felt as "stormy."
Fix (no protocol/behavior change, diagnostics only):
`log_resim_tick_audit()` now always takes the cheap path (register +
clock/timer + RAM core digest only, same as it already did for the
`"arm"` tag) for every replayed tick, `"fin"` included — the per-tick
line still shows core/sealed-pad state for triage, just not the full
breakdown. The full breakdown moved *into* `enter_verify_at_tip()`
itself, computed exactly once, from the exact `dig_cpu` used for the
real POST digest, and reused for both diagnostic prints (`rb post
parts`, `rb post sent`) and the wire send — eliminating the double
sweep on every commit. Net effect: full-bus digest cost drops from
"every replayed tick, twice on the last one" to "once per episode."
Also added a `replay=NN%%` field to the `PSX_NETPLAY_TIMING=1` `[FPS]`
line (`psx_netplay_rb_take_replay_ticks()`) so a soak can directly
confirm what fraction of the window was spent resimulating instead of
inferring it from episode density in the raw log. Considered a
`PSX_RB_VERBOSE_AUDIT` opt-out flag for the remaining once-per-episode
full audit print, but skipped it: at episode-count frequency (not
tick-count) the residual cost is already small, and every prior
determinism bug in this doc (I-cache tags, csv, the Δ8-cycle fork)
was found *from* this exact print, so defaulting it off risked
trading a small, now-rare cost for reduced forensics on the next one.
Not yet re-soaked; next step is confirming this shrinks the storm's
guest ms/f without changing episode count/shape.

**Re-soak (2026-08-01): confirmed genuine, self-clearing, input-density
storm — plus two follow-up ideas investigated, one landed, one
shelved.** `replay=NN%%` (new telemetry above) confirmed 50-60% of
simulated ticks were spent in Replay during bursts of rapid main-menu
D-pad taps, dropping to 0% between bursts — bursty and self-clearing,
not a runaway cascade (zero core diverges/aborts across two full
logs). Root-caused every rewind to a genuine Up/Down press/release
edge (`wire rewind-request ... pub=ffff wire=ffbf` etc.) — confirmed
as *inherent* to the current contract: `np_try_admit_rollback()`
invents via hold-last **immediately, with zero wait**, whenever the
local sim is ≤1 tick ahead of the remote's last-confirmed tip (the
normal steady-state operating point on a fast LAN) — raising
`delay`/`P` does not change this, since the code never even checks
for the real value before inventing at that gap. A discrete edge is
therefore always wrong under hold-last and always forces a rewind
per the "button deltas always rewind" contract, independent of
delay/prediction settings — investigated and shelved, not worth
testing further.
Also investigated **one-sided episodes** (let the follower answer
POST from already-recorded live history instead of doing a full
snapshot-load + replay, when its own simulation was never the one
that mispredicted). Found a real obstacle: the live per-tick history
ring (`s_part_ring` in `psx_netplay.c`) only refreshes VRAM/CD/aux
every 32 ticks (`np_emit_frame_commit`'s `crumb` gate) specifically
*to avoid* a permanent per-frame VRAM-CRC cost — so answering POST
correctly for an arbitrary mismatched tick from stored history would
need that data fresh every tick, trading a rare, bursty, ~50ms/f
spike for a permanent ~1-2ms/f tax on every frame of ordinary play.
Not a free win; shelved pending a cheaper way to get exact per-tick
VRAM state (e.g. dirty-region VRAM CRC instead of full-frame).
**What did land:** found `accept_peer_baseline()` unconditionally
`fprintf`+`fflush`(stderr) on *every* received baseline packet,
including every redundant copy of `RB_BASELINE_BURST=8` UDP
retransmits sent from up to ~9 call sites across an episode's
lifecycle — soak logs showed ~25 identical "rb peer baseline" lines
(2932 across 117 episodes in one log) for state that only actually
changes once per episode. Each `fflush` is a blocking syscall, firing
repeatedly right on the ticks already busy resimulating. Fixed:
the accepted state (`g_peer_baseline_ok`/digest/av/aux/ready) still
updates unconditionally on every copy (protocol behavior unchanged),
but the diagnostic print is now gated on the (epoch, load, dig_m,
dig_a, dig_b, dig_c) tuple actually changing since the last log —
pure I/O-volume reduction, zero effect on decision logic. Not yet
re-soaked.

**Engine-level digest cost (2026-08-01): Tier 1 landed, Tiers 2/3
planned.** The above cuts were all "stop doing expensive work more
often than needed" within the netplay layer. A separate axis is
"make the expensive work itself cheaper" at the engine level,
independent of rollback protocol logic — `netplay_av_digest()` CRCs
the full 1 MiB VRAM buffer and `netplay_core_digest_parts()` CRCs the
full 2 MiB RAM buffer from scratch every time either is called, with
no dirty-region shortcut. Three tiers identified, ordered by
risk/complexity:

**Tier 1 — faster CRC32 (landed).** `runtime/src/crc32.c` used the
textbook byte-at-a-time Sarwate table method: one table lookup per
byte, each depending on the previous byte's output CRC (a serial
dependency chain that stops the CPU overlapping consecutive steps).
Replaced with **slicing-by-8**: 8 of those serially-dependent steps
are restated as 8 *independent* table lookups (each depends only on
an input byte) XORed together, letting the CPU run them
out-of-order. Pure implementation swap — same polynomial, same
bytes in, bit-identical output — verified by fuzzing the new
implementation against the old one over 27k+ cases (exhaustive
small lengths 0-40 from 32 offsets × 2 starting-CRC values, 20k
random large buffers/offsets/starting-CRCs, 5k chained/incremental
folds matching how `netplay_state_digest.c` folds `core`/`aux`
together) before replacing it, since a subtle CRC bug here would be
exactly the class of silent-corruption bug this doc has spent months
chasing. Measured ~5x faster on both VRAM (1 MiB: 1.90ms → 0.38ms)
and RAM (2 MiB: 3.78ms → 0.76ms) sized buffers on the dev host. No
protocol/wire-format implication — the digest is an opaque
comparison value never compared across differently-built peers, and
both peers already have to run the identical binary.

**Tier 2 — dirty-region digest (tracking landed for snaps §96;
digest fold still planned).** Convert "CRC the whole buffer" into
"CRC only what changed since the last digest." **VRAM tracking is
in:** `gpu_vram_dirty.*` marks per-scanline dirtiness from
`gpu.c` (raster_pixel / GP0 A0) and `gpu_sw_renderer.c` (put_*/
fill/copy/transfer). Raw ring snaps already consume this (§96).
Next: `netplay_av_digest()` CRC only touched rows since the last
checkpoint (unblocker for one-sided episodes). **RAM is not a good
near-term target the same way**: guest stores happen from essentially
every recompiled `sw`/`sh`/`sb` site — thousands of call sites, not a
handful — so reliable RAM dirty-tracking means threading write-tracking
through the recompiler/interpreter store path. (Note:
`dirty_ram_interp.h`'s per-page bitmap is SMC detection — CLAUDE.md
Rule 18 — not a digest optimization.) **Risk:** a missed write site
silently produces a wrong digest. Shadow-verify:
`PSX_NET_VRAM_DIRTY_VERIFY=1`.

**Tier 3 — Merkle/hash-tree digest (planned, longer-horizon idea).**
Replace the flat CRC with fixed-size blocks (e.g. 4 KiB) each hashed,
plus a tree of hashes-of-hashes up to a root digest; a write
invalidates only its own block's hash and that hash's ancestors
(same underlying tracking problem as Tier 2, organized as a tree
instead of a flat bitmap). Beyond the performance win, this buys
**free divergence localization**: every forensic hunt in this doc
(I-cache tags, the Δ8-cycle fork, the open cpu/ram-forked-but-
everything-else-matched case) currently starts from "two 32-bit
CRCs disagree" and requires manually narrowing via partition
digests / sub-CRCs built up over sessions. A hash tree turns that
narrowing into an O(log N) walk from the two disagreeing roots down
to the differing leaf. Bigger lift than Tier 2; revisit after Tier 2
ships and its audit tooling exists to reuse.

FMV / depth24: defer rewind (promote wire only); follow NACKs; RB snap load uses light frontend hook (no FMV cutover/present thrash)
Multitap / N-slot: history + seal tables sized to slot_count

8. recomp-ui (branch `feat/rollback-netplay`)

Tasks

Host Lobby Settings: Disable Rollback (off by default → rollback on)
Manual Input Delay + Manual Input Prediction (P locked when rollback off)
Auto D (RB tiers / delay-sync pad) + auto P at Play from max peer RTT
Plumb launch.rollback / input_prediction + match_caps + net_cfg
Diag: stderr episode begin/commit/load; invent/promote/rewind counters on hist

9. Suggested implementation order

~~boot_state_save_buffer + snap ring~~
~~Master digest + FRAME_COMMIT~~
~~Invent + input contract~~
~~Episode resim wiring~~
~~Lobby flag + UI~~
~~Rate-limit live snaps (PSX_NET_SNAP_INTERVAL) + safe episode resume~~
~~Thinner snap / FMV policy~~ — interval 16, settle invent ok; §96 dirty-VRAM mirror + FMV media snap interval 4 (skip-VRAM still unsafe)
Dual-instance soak — prove Done-when items

10. File touch map

Area	Files
Snap ring	`boot_state.`, `netplay_snap_ring.`, `psx_netplay_rb.*`, `interrupts.c`
Digests	`netplay_hash_confirm.`, `netplay_state_digest.`, `psx_netplay.c`
Invent / contract	`netplay_input_hist.*`, `psx_netplay.c`
Episode	`psx_netplay_rb.*`, `lib/recomp-net` session RB send/take
Frame loop	`main.cpp` (`sdl_vblank_present` epilogue), `psx_netplay.c`
Caps / UI	`psx_lobby_client.*`, `recomp_launcher.h`, `launcher_imgui.cpp`, `main.cpp`

11. Done when

Two MotK instances with PSX_NET_MODE=rollback complete a match without admit-stall on one-frame remote loss
Forced remote digital correction opens episode(s); POST digests match (char-select L/R soak: 4 commits, live dig ok after). Tap = press+release = two episodes by input-contract (button deltas always rewind).
hash_confirm invent path shows promotes in diag without opening episodes when master hashes still agree (stick/analog path; not MotK digital buttons — contract always rewinds button deltas)
Delay-sync path (PSX_NET_MODE=delay) unchanged for lobby rematch / save xfer

Reference: lib/recomp-net/docs/rollback.md, include/recomp_net/rollback.h, include/recomp_net/input_contract.h, tests/rollback_episode_test.c.

12. Portable policy: size "wait before invent" budgets from RTT, not local tick cadence

Found on MotK (2026-08-01), but the mistake is generic to any rollback netcode with a "stall briefly, hoping the real remote row arrives, before falling back to prediction" grace mechanism — worth checking for on every future engine port before it ships. Written up here so it travels with the rollback playbook rather than staying MotK-specific tribal knowledge.

The mistake. MotK's np_invent_grace_stall() (runtime/src/psx_netplay.c) decides how long to block waiting for a genuinely-late remote row before giving up and hold-last-inventing it. Its budget was max(floor_ms, 2.5 × measured_local_tick_period), capped at 100ms — i.e. it used an EMA of how long this peer's own ticks have recently been taking as a proxy for "how patient should I be." That metric is the wrong one to feed a stall gate: local tick period gets longer precisely when the engine is already struggling (an active resim burst, a heavy scene, GC/OS jitter) — none of which has anything to do with how long the network actually needs. The result is a stall whose size floats up right when the system is already behind, adding pure idle wait on top of the very slowdown it's reacting to. Confirmed on a genuine direct-LAN connection (ICE selected typ host candidates both sides, sub-ms RTT by any reasonable estimate): the "grace" stall was measured landing at 70-90ms per occurrence — sized as if this were a lossy WAN link, not because the link needed it, but because the formula was reading the engine's own local distress as the loneliness of a lonely remote packet.

Why it partially masqueraded as "working as intended." Lowering the env-configured floor from 30ms to 5ms did measurably help (a same-scene soak comparison showed replay-time share dropping ~31%→~25% and total rewind episodes dropping ~113→~91 over an equal-length session) — so the mechanism isn't useless, and the fix isn't "delete it." But the improvement was partial and the storms remained intermittent rather than disappearing, because the 2.5× scaling term overrides a low floor the moment tick cadence degrades even slightly — exactly the condition a live storm creates. A fix that only tunes the floor constant will always leave this residual: the floor is not the part doing the damage during a burst, the scaling term is.

The general policy for the next engine. When a rollback implementation needs a "how long do I wait for a late remote row before I predict it" budget:

Size it from measured network RTT, not from local simulation cadence. Most rollback netcodes already track RTT for something else (auto delay/prediction tiering, connection-quality UI, etc.) — reuse that signal. A LAN connection with sub-ms RTT should get a budget in the low single-digit milliseconds; a WAN connection with 40ms RTT legitimately needs more. Local tick period answers "how is my engine doing", not "how is the link doing", and a wait-for-network gate should only ever ask the second question.
Audit every adaptive stall/pacing input for the feedback question: "If this stall makes my own performance worse, does that get fed back into a bigger version of the same stall?" Any signal derived from wall-clock frame/tick timing on the same host that is currently stalling is a candidate for this trap. It doesn't have to be obvious — here it was buried inside an otherwise-reasonable "scale grace to the observed tick rate so slow scenes don't false-positive" rationale that made sense in isolation but interacted badly with the stall's own side effect on that same tick rate.
Keep "wait for late data" (invent grace) and "close phase skew" (timesync pacing/advantage throttle — MotK's np_timesync_throttle) as separate mechanisms with separate inputs, even though both are "make the admit loop briefly wait." They answer different questions (is the data late vs. am I running ahead of my peer) and conflating their signals — e.g. letting both key off the same local-tick-cadence EMA — multiplies the risk of the feedback trap in (2) instead of isolating it to one place that's easy to reason about and cap.
Give the mechanism a real ceiling independent of any adaptive term, and log both the configured floor and the actual applied budget separately, so a soak can tell "the operator's floor setting" apart from "what the scaling term inflated it to" — this distinction is what made the MotK case diagnosable at all (see psxrecomp: rb invent grace N ms at startup vs. the per-stall budget computed in np_invent_grace_stall, which never prints and had to be reconstructed from the tick-period EMA logged by the neighboring np_timesync_throttle print).
Validate any fix by holding episode/rewind count and correctness (zero post core/aux diverge aborts) constant while comparing perceived latency/replay% — the goal is moving the budget's source signal, not just its magnitude; a naive floor-only tune (as done here first, for speed) is a legitimate stop-gap but should be labeled as partial, not as the fix, in whatever tracking doc records it.

Status for MotK itself: implemented (2026-08-01), not yet re-soaked.

Replace np_invent_grace_stall's 2.5 × local_tick_ema scaling term with a budget derived from measured session RTT, capped low. No existing live RTT signal existed anywhere in the netcode (checked RNetSessionStats, the ICE layer, and the lobby's one-shot pre-match LAN probe — none fit: the first two don't exist, the third measures a LAN-list endpoint that isn't necessarily this match's peer and doesn't update during play). Rather than add a wire-protocol change (new ping/pong message) or thread a value through the recomp-ui lobby UI (out of scope, and that submodule has its own in-flight uncommitted netplay-launch refactor — touching the same structs risked colliding with it), sourced RTT for free from data already being timestamped: enter_verify_at_tip() (psx_netplay_rb.c) already records g_verify_wait_ms when it sends this peer's POST, for the existing verify-timeout mechanism. Added g_rb_rtt_ema_ms, sampled at the point the peer's POST is accepted — now - g_verify_wait_ms when we sent ours first (the common case) is dominated by one-way transit of the peer's packet, not local compute, since both sides enter Verify around the same real-world moment (triggered by the same mismatch/rewind-request). EMA'd (3:1), sanity-bounded (samples over 2s discarded as stale/bogus), exposed via psx_netplay_rb_rtt_estimate_ms(), reset to 0 on session start/shutdown (rematch) alongside the rest of the per-session RB state. This piggybacks on an existing, already-occurring exchange — no new wire message, no protocol version concern. np_invent_grace_stall now sizes its budget as 1.5 × rtt once a sample exists (hard-capped at 60ms regardless of RTT), falling back to the old tick-cadence term (now 1.5 ticks / 40ms cap, down from 2.5 ticks / 100ms) only in the brief startup window before the first episode has round-tripped. The env-configured floor (PSX_RB_INVENT_GRACE_MS) default also dropped 30→8ms, since the soak showed 5ms already worked and the floor now matters far less than the (fixed) scaling term.
Log the applied per-stall budget directly, not just the configured floor: psxrecomp: rb invent grace budget=N ms (floor=F rtt=R tick_ema=T) slot=S wire=W, printed once per tracked wire tick (deduped so a multi-ms stall doesn't spam one line per retry).
Re-soak after RTT-sourced invent grace (2026-08-01): steady-state improved (replay% ~7% overall / ~3.6% quiet post-FMV; invent budgets 8–22 ms). Remaining cliffs were not invent-grace — they were the Verify POST-loss / tip-extend NACK storm in §13. Note: sampled "rtt" reads ~15–26 ms on direct LAN because the POST handshake wait includes peer Verify compute asymmetry, not pure UDP transit — still a better budget signal than local tick cadence, but not a true ping.

Touched: runtime/src/psx_netplay_rb.c (g_rb_rtt_ema_ms, sampling in the peer-POST-accepted path, psx_netplay_rb_rtt_estimate_ms(), reset in psx_netplay_rb_shutdown()), runtime/include/psx_netplay_rb.h (new declaration), runtime/src/psx_netplay.c (np_invent_grace_stall() budget formula + floor default + applied-budget log line). Builds clean, no new lints. np_timesync_throttle intentionally left untouched per policy point 3 above (separate mechanism, already has its own small fixed cap and adaptive-off).

13. Verify POST loss → unilateral tip-hold → tip-extend NACK storm (2026-08-01)

Symptoms (RTT-budget soak): long quiet stretches at 60 fps / replay≈0%, punctuated by cliffs (8.1 then 2.7 fps, admit=108–351 ms). Not invent- grace — budgets stayed at 22 ms (rtt=15).

Root cause (matched-pair logs at tip=1256 and tip=1437):

Both peers finish Replay and send identical POSTs.
Peer A receives B's POST first → enter_tip_hold → advances agreed_through to the tip → stops retransmitting its own POST (rexmit gate was phase==Verify && local_post && !peer_post_ok).
Peer B never got A's first POST (single UDP loss, even on direct LAN typ host) → sits in Verify until RB_VERIFY_TIMEOUT_MS (4s) → ABORT — verify timeout (peer POST missing) → realigns to last confirmed tip (e.g. 1425).
RB_RESOLVED that A sent on tip-hold was ignored for Verify exit — take_rb_resolved only called rnet_rb_set_peer_convergence.
A then opens tip-extend / fresh episodes with load= the unconfirmed tip (1437). B refuses: follow REFUSED … past frontier=1425 + NACK.
A's NACK handler was plain abort_episode — no watermark demotion, no cooldown — so A immediately reopened load=1437 → epochs 7..11 back-to-back NACK abort storm (the 2.7 fps cliff).

Fixes landed:

On enter_tip_hold, burst RB_POST_BURST (8) copies of local POST + RESOLVED before clear_post_handshake, so the lagging peer can still complete Verify after the winner leaves it.
On take_rb_resolved while stuck in Verify with a matching g_post_target, accept RESOLVED as the missing handshake half and enter_tip_hold (log: rb verify accept peer RESOLVED).
On peer follow-NACK: demote agreed_through below the refused load, drop a pin at/above that load, schedule_live_realign to a snap at the demoted tip, and arm_rewind_cooldown_ticks so tip-extend cannot immediately reopen the same unilateral tip.

Re-soak checks: no verify timeout (peer POST missing) on LAN; if one still appears, the lagging peer should show verify accept peer RESOLVED instead of a 4s hang; NACK lines should be followed by realign + cooldown, not begin epoch=N+1 with the same refused load= within milliseconds.

14. TipHold coalesce was pump-spin, not sim/wall time (2026-08-01)

Symptoms (full-match soak after §13): zero verify timeouts / NACKs / aborts, avg ~57 fps — but 351 rewind-requests / 350 fresh light episodes (~33 per 1k frames), avg replay% ~25%, and 0 tip-extends. Every press/release edge (gaps of 3–7 sim ticks) opened a new episode immediately after tip-hold committed.

Root cause: MotK uses tip_seal_slack = 0, so Live invent stalls at the sealed tip during TipHold. Finalize counted admit-pump iterations while sim >= tip. The admit loop spins with wait_recv(1), so "24 quiet frames" elapsed in a few milliseconds of wall time — long before the paired release edge arrived — then tip-hold committed and the next edge opened epoch N+1.

Fixes landed:

Replace pump-frame quiet counter with wall-clock g_tip_hold_quiet_t0_ms: finalize after runway frames at 60 Hz (runway * 1000 / 60 ms, clamped 80–500). Tip-extend resets the timer so an active coalesce keeps the episode open.
TipHold admit: still never invent past tip+slack, but do advance when every remote wire row is already present — so tip-hold is not a hard freeze for the whole coalesce window, and sim-time finalize (sim > tip_hold_until) can fire when confirmed inputs walk forward.

Re-soak checks: rb tip-extend epoch= / tip-extend FOLLOW should appear for press→release pairs; rewind-request count and avg replay% should drop vs the 351 / 25% baseline; tip-hold→commit gaps should be tens–hundreds of ms, not adjacent log lines.

15. Light-tip depth ceiling vs TipHold coalesce runway (2026-08-01)

Post-§14 soak (LAN, menu nav, delay=4): genuine improvement — avg 59.1 fps, avg replay% 17% (down from ~25%), 91 rewinds / 6799 frames (~13.4/1k, down from ~32.7/1k). But tip-extend fired only once in the whole soak: the presses in this soak were spaced ~800 ms apart on average (avg gap=47 ticks @ 60 Hz), wider than the 24-tick (~400 ms) TipHold coalesce window, so §14 rarely got a second edge to merge. The count/cost drop here is mostly attributable to Tier‑1 CRC + the RTT-sized invent-grace fix (§12), not coalescing — worth re-checking during dense-input gameplay (combo strings), not just menu nav, where coalescing should matter more.

Every remaining rewind-request carries a real pub vs wire bit diff (a genuine opponent input change), confirming these are not spurious — under a hold-last/idle-invent predictor a real remote button transition necessarily mispredicts. ICE also confirmed typ host on both sides (not relayed through the coturn TURN server despite force_turn=1 in the startup line, which only affects candidate gathering, not which candidate wins), with a genuine ~10–13 ms measured latency — this is real direct-LAN behavior, not a transport misconfiguration.

New finding — the two remaining depth knobs had drifted apart: RNET_RB_LIGHT_TIP_MAX_DEPTH (recomp-net/include/recomp_net/rollback.h) is a library-wide constant of 16 ticks: episodes at or under that depth skip the pre-Replay ready-ACK round trip (rnet_rb_is_light_tip_candidate). §14 widened MotK's TipHold coalesce runway (RB_MOTK_TIP_RUNWAY) to 24 so it could keep absorbing edges longer — but nothing widened the light-tip ceiling to match. Depth-bucketing every light= episode in the soak showed a perfectly clean split:

light=1 depths: 1,2,3 ... 16   (73 episodes, all <= 16)
light=0 depths: 17 (x5), 24 (x12)   (17 episodes, all > 16)

17 of 90 episodes (19%) in this soak grew past 16 ticks purely from coalescing/span-cap headroom and lost light-tip eligibility, paying an extra ready-ACK round trip on top of the POST-verify round trip both paths already pay — and these are also the deepest rewinds, i.e. already the most visually disruptive ones, now also getting the most expensive handshake.

Fix landed: made the light-tip depth ceiling a per-session config field instead of a single hardcoded constant, and set MotK's session to match its TipHold runway:

recomp-net: added RNetRbConfig.light_tip_max_depth (0 → library default RNET_RB_LIGHT_TIP_MAX_DEPTH, clamped to 32 like tip_runway). Added rnet_rb_get_light_tip_max_depth() and rnet_rb_is_light_tip_candidate_ex(load, target, resolved_through, max_depth) (explicit-ceiling sibling of the existing rnet_rb_is_light_tip_candidate, which now just calls _ex with the library default so existing callers/tests are unaffected). rnet_rb_recommend_light_tip and rnet_rb_begin_episode now read cfg.light_tip_max_depth from the session instead of the bare constant. New unit tests in rollback_episode_test.c cover: default resolves to the constant, _ex with an explicit wider ceiling accepts a depth the plain wrapper rejects, and a session created with light_tip_max_depth=24 correctly flags a depth-20 begin_episode as light (would not with the untouched default).
psx_netplay_rb.c: psx_netplay_rb_start() sets cfg.light_tip_max_depth = RB_MOTK_TIP_RUNWAY (24) so the two thresholds can't drift apart again. Both direct pre-flight call sites (initiator + follower begin_episode paths) switched from rnet_rb_is_light_tip_candidate to rnet_rb_is_light_tip_candidate_ex with rnet_rb_get_light_tip_max_depth(g_rb) so the precomputed flag matches what rnet_rb_begin_episode will compute internally.
recomp-net is a submodule (psxrecomp/lib/recomp-net, separate clone from the standalone recomp-net workspace repo on the same feat/rollback branch) — kept both copies of the touched files (include/recomp_net/rollback.h, src/rollback/rnet_rollback.c, tests/rollback_episode_test.c, docs/rollback.md) byte-identical.

Not changed (deliberately): did not just bump the library constant RNET_RB_LIGHT_TIP_MAX_DEPTH itself — it's shared across every recomp-net consumer, not just MotK, so widening it globally would be a cross-project policy change, not a MotK tuning knob. The per-session cfg field lets MotK opt in without affecting other hosts that still want the conservative 16-tick default.

Re-soak checks: light=0 should now only appear for episodes that hit SPAN CAP (depth > RB_MOTK_TIP_RUNWAY), not for every coalesced episode past depth 16; the light=1/light=0 split should track RB_MOTK_TIP_RUNWAY (24) instead of the old library default (16). Re-run a soak with denser input (active gameplay, not just menu nav) to see whether §14's coalescing actually engages more (tip-extend count > 1) once presses land closer together than the ~800 ms average seen here — that's the next real lever if rewind volume is still the complaint, since the per-episode cost items (Tier 1 CRC, RTT-sized invent grace, this light-tip alignment) are now largely exhausted. After that, Tier 2 (dirty-region digest, documented above) is the next compute-cost lever, and it disproportionately helps exactly the deep/full-verify episodes since they still walk the full 2 MiB RAM + 1 MiB VRAM CRC at Verify regardless of light/full status.

16. Follow-NACK realign fork + HC re-poison + asymmetric light-tip (2026-08-01)

Post-§15 soak (LAN, menu nav, delay=4): §15 worked — 44/44 episodes light=1 including depths 17 and 24; avg replay% 13% (down from 17%); ~8.9 rewinds/1k frames. Then a late cliff: host 4.0 fps admit=235 ms, peer 5.9 fps, ready timeout (initiator never sent GO), resim core diverge sim=3841, and peer follow NACK load=3856 / promote-no-resim reason=cooldown spam.

Root cause chain (matched-pair at tip=3840):

Both peers commit through 3840 (matched POST).
Peer HC-advances agreed 3840→3856 and opens epoch=59 load=3856.
Host still has frontier 3840 → follow REFUSED … past frontier=3840
- NACK. (The follow-up snap missing line from send_follow_nack is misleading — refuse reason was the frontier check.)
Peer's NACK handler demoted the watermark and always schedule_live_realign(demote), even though the refused load snap was never applied (still in SealInputs). That rewound ~25 ticks of good matched Live on only the peer → silent core fork at demote+1, while host kept running Live ahead.
Cooldown after that realign made late wire promote-no-resim — peer could not correct invents during catch-up.
Peer then immediately re-ran agreed ADVANCE 3840→3856 from stale HC (demote did not netplay_hc_prime_after / demote library resolved_through) — same poison, next episode.
Host's agreed stayed stuck at 3840 for ~229 ticks (peer digests no longer confirmed). Host finally opened SPAN CAP mismatch=4069 load=3840 target→3864 as light=1 and skipped ready-ACK without emitting GO.
Peer followed load=3840 but its resolved_through was 3856 → not light → waited for initiator GO → ready timeout after 4s (the admit cliff). Host aborted with resim core diverge sim=3841 while in Verify — leftover of the earlier Live fork.

Fixes landed:

NACK keep-live when snap never applied: capture g_episode_snap_applied before abort_episode; only schedule_live_realign(demote) when the refused load was actually applied. Otherwise log NACK keep-live and stay on the pre-episode Live tip (symmetric with the NACK-sender, who never left Live).
Demote + prime HC: on NACK, demote g_agreed_through / g_agreed_span_lo, call new rnet_rb_demote_resolved_through(g_rb, demote) (library watermark survives session_reset and set_peer_convergence only advances), and netplay_hc_prime_after(hc, demote) so live hash_confirm cannot immediately re-ADVANCE past the refused tip.
Light-tip still emits ready/GO: skip waiting for the RTT (the light-tip win) but still send_baseline_burst(1, …) so a peer that classified the same episode as non-light is not stranded until RB_READY_TIMEOUT_MS. Log line: light-tip skip wait … (still emitted ready/GO for asymmetric peer).
Unit test for rnet_rb_demote_resolved_through (advance / demote / no-op / survives session_reset). Synced into both the MotK submodule and the standalone recomp-net checkout.

Re-soak checks: after a follow REFUSED … past frontier / NACK, look for NACK keep-live (not an immediate realign to demote) when the initiator never applied the load snap; no immediate agreed ADVANCE demote→refused_load on the next pump; no ready timeout (initiator never sent GO) when one side light-skips; host and peer live digests at the same sim should stay matched after a NACK instead of forking for hundreds of ticks then SPAN-CAP from a stale frontier.

Post-§16 soak (LAN, menu nav, delay=4): §16 healthy — 0 aborts / NACKs / ready-timeouts / promote-no-resim; ~61 fps; replay% ~17%. UX still broken: dpad press/release felt like double inputs, tip-extend stayed at 0, and every tip-hold→commit pair was still adjacent (runway consumed as Live, not as wait-for-release).

Root cause (not fake mismatches — every rewind was a real edge):

Tip-hold Live-walked held digital. After a press episode POST-matched, tip-hold entered with invent_slack=0 and until = tip + 24. Admit advanced past invent-cap whenever remote wire was present — on a held dpad that walked ~24 Live frames with the button still down, then finalized via sim > tip_hold_until. MotK menus key-repeat on hold → ~24 extra navigations from one physical press. The release arrived after tip-hold already committed → second episode; coalesce never saw it (tip-extend=0).
Release episodes re-simulated several held frames (often 6–10) before the release tip — another held run after the tip-hold walk.
Ghost second release: after a real release commit, predicted hist ahead still showed the button held (pub=ffdf wire=ffff again a few dozen ticks later). Tip-hold enter/finalize also did not netplay_hc_prime_after(tip), so HC could re-agreed ADVANCE over invent-poisoned ticks (soak: release tip=1607 then agreed ADVANCE 1607→1632).

Fixes landed:

Tip-hold invent-cap stall while digital held: past tip+slack, admit advances only when every remote wire row is present and all pads (local + remote) are idle (buttons == 0xFFFF). Held → stall so wall-clock quiet / peek-ahead coalesce owns the runway.
HC prime on tip-hold enter + finalize: netplay_hc_prime_after(hc, tip) (+ set_peer_convergence) so invent-hold FRAME_COMMITs past the tip cannot immediately re-ADVANCE.
Scrub-ahead on digital release promote: rewrite predicted hist release_tick+1..sim to the released pad (rb scrub-ahead release).
Tip-hold coalesce-ahead: while tip-holding, peek wire tip+1..tip+runway (no predicted hist required); on first pad delta vs tip hist, promote the span and tip_extend (rb tip-hold coalesce-ahead). TipHold tip-extend now rereplays when mismatch_tick > old_target even if Live never left the tip (sim == old_target).
Getter psx_netplay_rb_tip_runway() for the host scan.

Re-soak checks: dpad tap should move the cursor once; look for tip-hold coalesce-ahead / tip-extend on press→release within the runway; scrub-ahead release after release promotes; no back-to-back ghost pub=held wire=ffff release episodes; no agreed ADVANCE tip→tip+N immediately after tip-hold enter/commit from stale HC; tip-hold→commit should often be non-adjacent when a release extends the tip.

18. POST-diverge tooling + post-realign cooldown (2026-08-01)

Post-§17 soak: coalesce worked (14 tip-extends, 15 coalesce-ahead, 6/23 tip-holds extended by up to 24 ticks). One new failure mode: at tip 9203 both peers POSTed different cores (8a460717 vs 138700d6), aborted, realigned to 9200 — then RB_ABORT_COOLDOWN_TICKS=24 made every subsequent real dpad edge promote-no-resim reason=cooldown, so the fork never self-corrected (live digs still mismatched at 9216/9248 until disconnect). Also: POST only compared tip digests, so there was no visibility into which earlier tick in the sealed span actually forked.

Fixes landed:

POST-DIVERGE diag dump (before abort_episode clears seals): for load..tip, print sealed buttons + hist overlay per seat, then local/peer FRAME_COMMIT cores from the HC ring, highlighting FIRST_MISMATCH when the fork is earlier than the POST tip. Grep: rb POST-DIVERGE. Both peers print the same shape — diff the two logs at the abort to see seal/FC asymmetry.
netplay_hc_peer_digest getter (symmetric with local_digest) for the FC scan; unit-tested in test_netplay_hash_confirm.
Skip rewind cooldown after a successful POST realign (RB_POST_REALIGN_COOLDOWN_TICKS=0 + clear_rewind_cooldown). Storm cooldown (streak >= 2) and "no realign tip" baseline cooldown are unchanged. Log: rb rewind cooldown cleared (...post...).

Re-soak checks: on the next post core/aux diverge, expect a POST-DIVERGE diag / seals / fc FIRST_MISMATCH block immediately before episode ABORT; after realign, expect rewind cooldown cleared (not cooldown until sim=…); subsequent real edges should open episodes again instead of promote-no-resim reason=cooldown. If FIRST_MISMATCH is earlier than POST tip, that tick is the next investigation target (sealed-pad asymmetry vs. sim nondeterminism).

19. Tip-extend invent-idle seal + POST storm cooldown (2026-08-01)

Post-§18 soak: tip-hold coalesce/tip-extend worked through a press→ release→press chain (epoch 21, tip 1416→1425), then POST diverged at 1425 (310e567b vs dd8432b2). Diag:

Host arm audit: s1=ff7f (LEFT — correct wire-promoted resign)
Host POST dump: t=1425 s1=ffffP/h=ff7f! (seal invent-idle vs hist LEFT)
Peer dump: s1=ffffP/h=ffffP (FOLLOW local seat never had the press in hist)
Prior ready timeout left streak=1; POST → streak=2 → storm cooldown (until sim=1474) → promote-no-resim while Live stayed forked at pin 1392 (baseline core mismatch storm)

Root cause:

Tip-hold invent-cap stalls Live at the tip, so FOLLOW's local hist lacks tip+1..edge even though the pad was already sampled into the delay ring at sim+delay. Seal get_input_row fell through to invent_idle → exported ffffP for the correction seat.
Initiator had correctly resigned from wire peek (ff7f), then apply_peer_seal_rows accepted the FOLLOW invent and overwrote it.
§18's POST_REALIGN_COOLDOWN=0 was skipped by the storm branch (streak >= 2); tip-hold commit did not clear the abort streak.

Fixes landed:

host_get_input_row / tip-extend prefresh: promote from rnet_session_peek(_remote)_input at wire_tick_from_sim before hist/invent; tip-extend (initiator + FOLLOW) prefreshes the correction + local seats over the new tip range.
rnet_rb_apply_peer_seal_rows: reject predicted peer rows that would clobber a non-predicted sealed row (still credit the mask).
POST realign never storm-cools when a realign tip exists (clears streak + RB_POST_REALIGN_COOLDOWN_TICKS); tip-hold finalize also clears g_bl_mismatch_streak.

Re-soak checks: tip-extend rereplay arm/fin should keep matching auth pads (s1=ff7f not ffffP); POST dump should not show ffffP/h=ff7f!; on POST diverge expect rewind cooldown cleared (...post...) even after a prior ready-timeout; no immediate baseline mismatch storm at the pin from promote-no-resim.

20. Skip presentation during resim ticks (2026-08-01)

Motivation: with §17-19 landed, soaks were spending a large fraction of wall-clock time in Replay (the [FPS] ... replay=NN% (n=…) line). Every resimulated vblank still ran the full GL/VK/SW present path (gl_renderer_present_vram / gl_renderer_sync_cpu FBO readback, vk_renderer_present_*, or the software SDL_UpdateTexture + SDL_RenderPresent path) even though none of that pixel work is visible — it gets fully overwritten by the next resimulated (or the final Live) frame. Host audio pump was already skipped during resim (see the existing !psx_netplay_is_resimulating() guard around sdl_audio_update in sdl_vblank_present_body); presentation had no equivalent guard.

Fix: added a psx_netplay_is_resimulating() early return in sdl_vblank_present_body() (runtime/src/main.cpp) immediately before the ---- Display from our VRAM ---- block, mirroring the existing audio-pump skip. This is presentation-only:

psx_netplay_finish_frame() (the digest/hash-confirm capture) and the ep.do_epilogue / ep.override / ep.skip_pace epilogue flags used by sdl_vblank_present() for netplay admit/pace are all latched before this point in the function, so admit/pace timing is unaffected.
gpu_depth24_present_hold_tick() and the widescreen-engage check (which must tick every vblank per their own comments) run before the new guard, so their bookkeeping is preserved.
Host-only presentation state (frame-blend prev_buf, disabled-frame- presented latch, present ring) simply doesn't advance on resim ticks — the same category of skip already used by the blank-display, catchup-budget, and turbo-loads early returns elsewhere in this function. Live's next real present after the episode settles still draws the final, correct frame.
Digest content is unaffected: host_state_digest() never reads GPU/ VRAM/framebuffer state (core+aux hashing is CPU/RAM/IRQ/timers/CD/SPU register state, not pixels), so skipping the pixel work cannot change what gets hashed or sent over the wire.

Debug and Release builds both compile clean after the change.

Re-soak checks: [FPS] line's replay=NN% should be unaffected (same resim ratio, since this doesn't change when resim happens, only whether it presents), but wall-clock game FPS during heavy-resim spans (chain-episoding, tip-hold storms) should improve since the GL readback/ present cost is no longer paid on non-terminal resim vblanks. No new divergence should appear — this change touches host presentation only, never digested/guest state.

21. Invent-grace ceiling scales with `input_delay` (2026-08-01)

Motivation: a soak sweep across PSX_NET_DELAY values (D=4 twice via the launcher's "default" and an explicit d=4, plus D=6) showed raising D did not reduce prediction — it made it worse. Normalized per 1000 sim ticks:

	D=4	D=6
`rb invent grace` events	127.7	232.0
`tip-hold coalesce-ahead`	18.9	73.0
`rb episode commit`	23.9	28.4
`rb wire rewind-request`	24.4	23.4

Invent (predict) frequency roughly doubled and coalesce-ahead nearly quadrupled from D=4→D=6, while the actual correction/rewind rate barely moved — the opposite of what a bigger delay buffer should buy.

Root cause: np_try_admit_rollback() computes wire = sim + D (rnet_wire_tick_from_sim) but the decision to invent vs. stall never used D at all. Any gap wire > highest_remote_wire + 1 immediately falls into np_invent_grace_stall(), whose patience budget was 1.5x measured RTT, hard-capped at 60ms regardless of D (40ms in the pre-RTT startup fallback). So choosing D=6 (100ms of nominal buffer) vs D=4 (66.8ms) never changed how long the sim was willing to wait for a late remote sample before predicting — the configured delay only changed which wire tick was being requested, not the patience for it. With this soak's RTTs already well under the 60ms ceiling (17-53ms), the ceiling — not the delay — was the binding constraint the whole time, so the extra D bought nothing but longer predicted runs to later reconcile (more invents, more coalescing to absorb them, same rewind rate).

Fix landed: np_invent_grace_stall()'s ceiling now scales with g_np.input_delay: rtt_ceiling = clamp(delay_ms/2, 60, 150) and fallback_ceiling = clamp(delay_ms/3, 40, 100), where delay_ms = input_delay_ticks * tick_ms (tick_ms from the live tick-period EMA, nominal 17ms fallback). D<=4 reproduces the old 60/40ms ceilings unchanged (floors preserve historical behavior); larger D now actually grants more real wall-clock patience before falling back to prediction, in proportion to the extra buffer the user asked for. The RTT-based scaling of the budget itself (1.5x RTT) is unchanged — only the ceiling moves. The rb invent grace budget log line now also prints delay_ms= so a soak can confirm the ceiling in effect.

Re-soak checks: re-run the same D=4 vs D=6 comparison; expect rb invent grace budget=...delay_ms=... to show a materially higher ceiling at D=6 than D=4, and expect invent-events/1k-ticks to no longer scale up with D (ideally trend down, since more genuinely-late packets should now clear within the wait instead of triggering a predict). D<=4 behavior should be bit-for-bit unchanged from prior soaks (floors match the old hard caps).

22. Delay-buffer admit + adaptive delay (2026-08-01)

Motivation: Soaks with manual D=4 / P=2 still saw frequent small resims. Expectation mismatch: raising D alone does not widen the sim-vs-remote phase gap that gates invent — both peers shift wire=sim+D together, so the gap stays ~0–1. The product goal is delay-sync-like operation at the delay edge (buffer filled, invent rare), with the prediction runway as insurance for spikes, freeze+refill when P is exhausted, and adaptive D growth when freezes persist.

Preserved (do not regress):

Gap gate: invent freely at gap ≤ 1 (stalling every miss serialized both sims to ~40–50 fps — §12).
Timesync micro-throttle remains the primary phase-lock tool.

Lobby / auto D/P (recomp-ui):

Measured RTT	Input Delay	Prediction (`P = 4 + D`)
0–20 ms	2	6
20–50 ms	2	6
50–80 ms	3	7
80–120 ms	4	8
120–160 ms	5	9
then steps up	…	`4+D`

Manual defaults: D=2, P=6. Prediction tooltip: keep prediction = 4 + delay. No UI to disable adaptive delay — with P=4+D freezes should be rare; when they happen, growing D is the intended response. Soak-only: PSX_RB_ADAPT_DELAY=0.

Runtime changes:

Timesync: skip note_late during active episode / tip-hold (resim cost ≠ transit latency). Pegged-streak off-guard raised 12→18. psx_netplay_timesync_on_episode_boundary() clears pegged streak on begin / tip-hold / abort (debt kept for post-episode pacing).
Admit telemetry: rb admit stats invent_gap1/gap2/gap3+ pcap_stalls/pcap_enters every ~5s; invent path buckets by gap.
P-cap freeze: wire > highest_remote + P logs rb pcap FREEZE enter/exit and counts freeze enters in a 5s window.
Adaptive delay (always on): host (local_slot==0) after ≥3 freeze enters in 5s, with 10s cooldown, calls rnet_session_request_delay_change(D+1) (max 16). P stays at the lobby-committed value. Guests apply via DELAY_SYNC.
recomp-net DELAY_SYNC: deferred apply queue (pending_delay, effective_tick); commit in rnet_session_advance / set_sim_tick when sim_tick >= effective_tick. New rnet_session_request_delay_change. Retransmit pending packets every 50ms while queued. MotK mirrors g_np.input_delay from rnet_session_committed_delay on admit / after live advance.

Re-soak checklist:

LAN with auto or manual D=2 / P=6: expect fewer invents than the old D=4/P=2 soak; gap1 invents dominate over gap2/gap3+.
Log lines: rb admit stats …, rare/absent rb pcap FREEZE enter.
Induced latency spike: freeze enter → after 3 enters, rb adaptive delay bump + both peers rb delay committed.
Timesync does not trip OFF 10s solely from tip-hold/resim load.
Fight scene: fps / episode density vs prior soak; no serialization regression (still inventing at gap≤1).

23. Short invent grace at gap=1 (2026-08-01)

Soak evidence (same session pair, TURN):

Setting	ep/1k ticks	host invent_gap1/1k	pcap freezes
D=2 P=6	~23	~260	0–1
D=4 P=8	~25	~297	0

Raising D/P did nothing — invents were ~99% gap1 (free path). Adaptive delay never armed (P=8 runway unused). Hitch source remains gap1 invent → edge mispredict → tip-hold/coalesce → resim.

Fix: ahead-only short invent grace when wire == highest_remote + 1:

Cap = max(8, min(16, RTT_ms)) (auto), or PSX_RB_GAP1_GRACE_MS (0 = old invent-free gap1).
Must stay << one peer guest frame so we do not revive the 2026-07-31 serialization (full stall on every miss → 40–50 fps).
Gap1 grace expiries do not feed the invent-grace adaptive-off streak (would trip constantly under normal phase stagger).
Gap≥2 keeps the full §21 budget unchanged.

Timesync: mispredict debt add ~0.75 tick (was 0.5); admit shave ≤4 ms/tick (was 3).

Telemetry: rb admit stats now includes gap1_grace= (times the short stall returned before invent).

Re-soak checks: compare to D=4/P=8 baseline (~25 ep/1k):

Expect gap1_grace rising and invent_gap1 / ep/1k falling.
Steady FPS must not collapse to ~40–50 with zero episodes (that would mean the short cap is too large / both peers serializing).
PSX_RB_GAP1_GRACE_MS=0 restores prior gap1 invent-free behavior.

24. Admit-hitch cleanup after gap1 grace (2026-08-01)

§23 soak: ep/1k ~25→14 and invent_gap1/1k ~297→188, but feel was still bad. FPS forensics: 17/53 host windows were admit-dominated hitch (admit 12–17 ms, replay=0%) — not resim. Causes:

Gap1 grace spun the admit loop (~10k stall returns / ~2k ticks) and often expired into invent anyway (stall tax without preventing predict). Cap was up to 16 ms on measured RTT.
TipHold coalesce-ahead reset the quiet timer on every edge (1825 resets) so Live stayed parked in tip-hold with high admit cost.

Fixes:

Gap1 auto cap → max(4, min(10, RTT/2)); count gap1_grace once per wire tick; after 10 consecutive expire→invent, OFF 1s (rb gap1 invent grace OFF 1s).
TipHold: 350 ms absolute wall cap from enter (rb tip-hold WALL CAP); pure TipHold coalesce extends tip_hold_until but does not reset quiet_t0 (rereplay still does); coalesce-ahead log rate-limited.

Re-soak: expect fewer admit-dominated replay=0% dips, lower gap1_grace counts (per-wire), occasional gap1 invent grace OFF, tip-hold WALL CAP when menus mash, ep/1k staying ≤§23 or better.

25. TipHold WALL vs quiet + gap1 shrink (2026-08-01)

§24 soak: admit-spin fixed (gap1_grace/1k 4550→278, coalesce 1825→32) but feel regressed: 27/27 tip-hold commits were WALL CAP 350ms (quiet never won — quiet need ~400ms > WALL 350ms), and gap1 invent-free OFF climbed invent_gap1/1k 188→360 and ep/1k 14→19. Hitching returned as replay-dominated.

Fixes:

TipHold: quiet max 180ms (can finish); THRASH CAP 150ms only when coalesce_n ≥ 3; SAFETY CAP 500ms last resort. Logs: tip-hold THRASH CAP / tip-hold SAFETY CAP.
Gap1: on expire→invent streak, SHRINK to 2ms for 1s (not invent-free). Log: rb gap1 invent grace SHRINK 2ms for 1000ms.

Re-soak: expect mostly quiet tip-hold commits (not WALL), occasional THRASH on mash, invent_gap1 not jumping when SHRINK fires, ep/1k ≤§23.

26. FMV lockstep was re-serializing WAN (2026-08-01)

Clue: PSX_RB_GAP1_INVENT=1 still stayed ~30 fps on CGNAT/TURN. Early menu with invent free-ran at ~60 fps / admit≈0; the cliff lined up with FMV rewind-defer ON and invent count 0 until invent_at (~4s of post-FMV MIN+UNLOCK delay-sync). Tip-hold/replay windows later recovered toward ~50 fps — so prediction can drive presentation; admit was still gated on confirmed tip.

Root causes:

lockstep_no_invent = media and g_fmv_lockstep_until (MIN 180 + UNLOCK_GRACE 64). Correct for depth24 Start/skip; fatal for WAN title menus (network paces every frame).
Default admit refused invent while remote_lead > 0 until TIP_STALE (~150ms+) — delay-sync unless ENV forced gap1 invent.
RUNWAY_EMPTY invent grace floored at 60ms ceiling → ~25ms tax/tick.

Fixes:

No-invent gate = media + settle (24 ticks) only. Digest lockstep still drives dense snaps / RELEASE logs, not admit.
Gap1 short-grace→invent is default ON (PSX_RB_GAP1_INVENT=0 for old cushion-wait).
Invent grace OFF after 15 expiries for 5s; RUNWAY ceiling floor 20 / cap 80 (was 60/150).

Re-soak (no ENV needed): FMV itself may still track packet rate (no invent during media — intentional). Post-FMV menus should invent within ~settle and climb toward 60 with rollbacks, not flat ~30. Look for gap1 invent ON, invent grace OFF 5s, settle log no invent through settle; then invent+resim §26.

27. Presentation continuity without resim storms (2026-08-01)

Problem: §26 unlocked invent/resim, but the eye still saw stalls — tip-hold parked Live at tip (invent_slack=0), gap1/RUNWAY grace taxed every miss, and deep RUNWAY_EMPTY invents (pred_depth 4–5) chained episodes. Telemetry showed high replay% while present starved.

Policy pivot: keep the display clock moving with shallow prediction; resim real edges; do not reintroduce delay-sync after invent commits.

Fixes:

TipHold seal slack → library default 2 (was FORCE0); quiet 80ms, thrash 100ms @ coalesce≥2, safety 250ms.
Gap1 invent grace default 0 (PSX_RB_GAP1_GRACE_MS override kept).
Invent depth cap: pred_depth ≥ 2 waits until tip stale (1× invent RTT, floor 40ms); RUNWAY invent grace hard-capped at 8ms.
FPS line: present_gap_p95=… ms max=… ms (primary soak metric).

Pass (WAN/TURN, post-settle): present_gap_p95 ≤ 33ms, invent mostly GAP1 with pred_depth ≤ 2, ep/1k moderate (not zero invents, not constant deep resim). FMV media may still be packet-paced (no invent).

28. Gap=1 phase-vs-starvation split — LAN resim storms (2026-08-01)

Problem: §27's gap1_grace=0 default fixed WAN 30fps delay-sync but regressed LAN. A 2-peer soak at D=2 P=6 (one peer via TURN relay, one direct host-host) showed ~310 gap1 invents / ~2400 frames, a first core diverge at sim=962, then a tip-hold commit storm (ep/1k≈15, present_gap_p95 spiking to 3.4s once). The invent geometry was perfectly stable the whole soak:

wire = sim+2, remote_tip = sim+1, remote_lead = 1, pred_depth = 1

That is not starvation — the confirmed remote tip is still one row ahead of sim, i.e. there is real work already in flight. It is a one-tick phase offset: this peer is consistently sampling wire a tick before the matching remote row lands. §27 treated every gap=1 miss identically (invent now), converting each phase tick into a mispredict → rewind-request → tip-hold episode.

Fix — Case A / Case B split at gap=1 (np_gap1_grace_cap_ms, np_tip_track_advance/np_tip_age_ms, gap1 branch of np_try_admit_rollback in psx_netplay.c):

Track the remote tip's own arrival cadence every admit tick (not just on miss): g_tip_arrival_ema_ms = EMA of ms between highest_remote_wire advances, np_tip_age_ms() = ms since the last advance.
Case A (healthy/advancing tip): remote_lead ≥ 1 and the tip advanced within the last 1.5× its own cadence. The newest row is probably already in flight — wait clamp(period − tip_age, 4, 10) ms before inventing, instead of 0. Logged as reason=GAP1_PHASE.
Case B (stale/starved tip): remote_lead ≤ 0, or the tip hasn't advanced in over 1.5× its cadence (or cadence unknown). Invent immediately — same as §27's default — so genuine WAN gaps stay responsive and this never turns back into cushion-wait.
PSX_RB_GAP1_GRACE_MS still forces the old flat cap (bypasses the Case A/B split entirely) for A/B testing or a manual operator override.

Telemetry: rb admit stats gained gap1_case_a=, gap1_case_b=, tip_ema= (the learned arrival cadence in ms). Expect on LAN: gap1_case_a rising, gap1_case_b/invent_gap1_legacy mostly flat, tip_ema settling near the true tick period (~16–17ms at 60fps), present_gap_p95 and ep/1k dropping back toward the pre-§27 LAN baseline (~60fps, near-zero episodes) without WAN regressing to 30fps.

Re-soak: LAN pass = few-to-no GAP1_LEGACY/RUNWAY_EMPTY invents once tip_ema converges, gap1_case_a dominant, ep/1k near 0, fps back near 60. WAN pass = unchanged from §27 (Case B fires immediately on a genuinely stale/negative-lead tip, so high-RTT links don't gain a hidden per-tick stall).

29. §28 Case A wait was the hitch — scheduler needs pacing, not waiting

(2026-08-01)

Problem: the very next LAN soak after §28 showed worse hitching. gap1_case_a/gap1_grace climbed to 1000/1000 (every gap=1 miss took the Case A wait), but only ~12% of those waits actually found the row — 88% expired into invent anyway (invent_gap1_legacy 883, GAP1_PHASE 314 logged). tip_ema (the learned tip-advance cadence) drifted from 15ms to 28-41ms over the match — 2-3x the true ~16ms tick period — because the wait itself delays the next admit, which delays the next tip-advance observation, which makes the next miss look "fresher" than it is (self-reinforcing feedback loop). Net effect: admit cost rose from ~6ms/f to ~8ms/f baseline, first core diverge moved earlier (sim 279 vs 962), ep/1k rose (16→27), and present_gap spiked to ~4 seconds during storm windows with fps dropping to single digits.

Root cause, reframed as a scheduler question, not an invent-policy question: both soaks showed the exact same fixed point regardless of gap1 policy:

wire = sim+D, remote_tip = sim+(D-1), remote_lead = D-1, pred_depth = 1

This is rock-stable, not jittery — the signature of a fixed ~1-tick network transit/scheduling cost consuming one of the two delay frames, combined with a self-reinforcing rate effect: because gap=1 has always resolved via immediate invent (never a wait), the peer that structurally gets there first never has to slow down, so it keeps racing exactly one tick ahead of the other's publish rate indefinitely. A per-miss wait cannot fix either half of this: it cannot change a fixed transit delay, and by delaying every admit uniformly it does not reintroduce any asymmetry between the peers — so both soaks converged to the same useless (or actively harmful) place.

Fix: the only mechanism in this codebase that is actually asymmetric-safe here is mispredict-driven np_timesync_note_late pacing (psx_netplay.c) — soak evidence already established that real mispredicts land almost entirely on one peer (the one racing ahead), so pacing that peer down a few ms/tick closes phase without both sides fighting each other or serializing. It was just too weak to matter: MotK's hold-last invent means most gap=1 misses never produce a mispredict (the invented value already matches), so genuine correction signals are rare, and the old debt sizing (add ~0.75 tick/mispredict, cap 2 ticks, shave <=4ms/tick) drained faster than it could accumulate enough to move a persistent D-1 phase.

Reverted §28's per-miss Case A wait. Gap=1 invents immediately again (§27 behavior) — zero added admit latency. The Case A/B classification is kept as pure diagnostics (GAP1_PHASE / GAP1_LEGACY reason, gap1_case_a/gap1_case_b counters) computed from the same tip-health signal, but nothing waits on it. PSX_RB_GAP1_GRACE_MS still forces the old flat-cap wait for A/B testing.
Strengthened timesync pacing (np_timesync_note_late, np_timesync_throttle): per-mispredict debt add raised from ~0.75 tick to ~1.25 ticks, cap raised from 2 ticks to 3 ticks, admit-side shave raised from <=4ms/tick to <=6ms/tick — so a small cluster of real mispredicts (e.g. one fight exchange) can actually walk a stuck D-1 phase back toward D within a handful of ticks instead of dozens. Adaptive-off guards (18 consecutive cap-hits → OFF 10s) are unchanged.

What to watch in the next soak: gap1_case_a/gap1_case_b should still climb (that's expected — LAN transit still eats ~1 tick most of the time) but admit ms/f and present_gap_p95 should drop back near pre-§27/§28 baselines since no wait is added; tip_ema should hold near the true tick period instead of drifting; and timesync pacing log lines / rb timesync OFF should show whether the stronger debt actually narrows remote_lead back toward D over a match, or whether the transit-delay theory needs D raised instead (next lever if pacing alone doesn't move it).

30. Phase-control soak instrumentation — no algorithm change (2026-08-01)

Context: Prior soak showed host (slot=0) opening ~91 rewind-requests against remote slot 1 while guest opened only ~29 against slot 0, with timesync pacing 72 vs 17. Hypothesis: the peer that starts ahead spends more time in rb_active/tip_holding, so np_timesync_note_late() suppresses the very debt that would slow it — a control-loop leak — rather than pure gameplay/transport asymmetry.

Change: telemetry only (psx_netplay.c). No pacing constants, grace, or invent-policy edits.

~1 Hz line (each peer, stderr):

psxrecomp: rb phase ctrl slot=N sim=… lead=… lead_avg=… lead_min=…
lead_max=… debt_ms=… debt_added=… mispredict=… note_late=…
suppressed_rb=… suppressed_off=… D=…

Field	Meaning
`lead` / `lead_avg/min/max`	`remote_lead` now + window over the last ~1s of admits
`debt_ms`	current timesync pacing debt (drains ≤6 ms/tick)
`debt_added`	cumulative ms of debt ever added (never resets)
`mispredict`	cumulative `pads_differ` resolves (true mispredicts)
`note_late`	cumulative `note_late` calls that actually added debt
`suppressed_rb`	cumulative `note_late` early-outs while `rb_active` or `tip_holding`
`suppressed_off`	cumulative early-outs while timesync adaptive-OFF window

Same counters also appear on the 5s rb admit stats line.

How to read host vs guest:

Supports control-loop instability: one peer consistently has higher lead/lead_avg, higher mispredict, and higher suppressed_rb (especially suppressed_rb rising with mispredict while note_late lags). That peer is losing correction signal during its own resim/tip-hold windows.
Points elsewhere (gameplay/transport): suppressed_rb rare or balanced, but mispredict still skewed — edges/content or path RTT dominate; do not change the suppress gate yet.
Secondary: suppressed_off climbing on one side means adaptive-OFF is also silencing pacing (different failure mode).

Do not tweak pacing constants from this soak until the hypothesis is confirmed or rejected from these four signals.

31. Protocol correctness track — distributed episode contract (2026-08-01)

Work split into two tracks (protocol correctness first, scheduler feel second) so remaining rollback storms can be attributed to scheduler policy rather than peers disagreeing about control flow. This section is the protocol track. All six items landed together; the RB_SYNC wire format gained an op code (the old initiator byte) and a flags byte (the old pad byte, so packet size is unchanged). Constants live in recomp_net/session.h (RNET_RB_SYNC_OP_*, RNET_RB_SYNC_FLAG_*, RNET_RB_ABORT_CLASS_*).

1. Episode identity — slot-partitioned epoch ids. Wire epoch = (counter << 3) | initiator_slot (RB_EPOCH_SLOT_BITS). Concurrent dual initiation can never collide on an id, and any epoch's initiator slot is derivable from the id alone (needed by the tie-break). g_epoch is now the counter, not the wire id; followers only raise their counter for log monotonicity.

2. Dual-initiation tie-break. Both peers opening episodes concurrently used to deadlock (each dropped the other's SYNC as "already active") or cross-wire baselines. Now, on receiving a competing BEGIN while initiating: the lower initiator slot wins. The loser yields quietly — abort_episode with class REALIGN, cooldown cleared (contention is not failure) — and falls through to follow the winner's episode. Yield only happens in SealInputs/AwaitingBaseline before the snap load mutated Live; deeper phases drop the SYNC and rely on abort propagation to clean up.

3. Abort propagation. Local aborts used to tear down silently; the peer kept sealing/verifying until its own skewed timeout. Every wire-visible abort now sends RB_SYNC op=ABORT (×3 burst, epoch-deduped on receive) with the cooldown class in the mismatch field and the sender's realign tick in the load field. The receiver mirrors teardown, realigns via the shared pick_realign_tip() policy (pin > episode load > agreed), and arms the same cooldown class.

4. Shared cooldown class. abort_episode_realign classifies BEFORE aborting (REALIGN / ABORT / STORM / NO_SNAP → 0/24/48/90 ticks via abort_class_cooldown_ticks) and stages the class into the wire notice, so both peers re-arm on the same schedule instead of deriving different cooldowns from different local evidence. The receiver also syncs its g_bl_mismatch_streak from the class (REALIGN clears; STORM forces ≥2). An ABORT for an episode we never joined still arms STORM/NO_SNAP classes so we don't immediately initiate into a peer that just declared a hard failure.

5. Shared frontier. Three parts: (a) follow-NACKs carry the follower's confirmed frontier (follower_frontier_hint(): agreed watermark, else mutually hash-confirmed tick) in the target field; the initiator demotes to min(load-1, peer_frontier) walked down to a real snap, so the reopened episode's load is provably followable instead of NACK-cycling. (b) finalize_tip_hold bursts RESOLVED (enter_tip_hold and commit already did) so a committed tip is never a local secret. (c) The follow REFUSE "past frontier" check treats the library's peer-advertised rnet_rb_resolved_through as a frontier floor — peers only advertise committed ticks, so a load at/below it is followable even when our own agreed/hc watermark lags from a lost packet.

6. Shared rereplay + light-tip decision. BEGIN/tip-extend SYNCs carry initiator-authoritative flags: FLAG_LIGHT_TIP (follower adopts verbatim; rnet_rb_begin_episode no longer auto-classifies when from_peer_notify, and rnet_rb_recommend_light_tip reports corr.flags only — this was the asymmetric baseline-burst seed) and FLAG_REREPLAY (tip-extend: follower mirrors the initiator's rereplay decision, OR'd with its own "Live invented past the prior tip" check, which can only add correction, never skip one).

Verified: MotK psx-runtime builds; all 11 recomp-net tests pass (rb_wire_test round-trips the op/flags byte and the ABORT shape; rollback_episode_test covers follower flag adoption). Standalone recomp-net repo synced with the same changes.

32. Scheduler-feel track kickoff — lead regulation (2026-08-01)

Protocol correctness (§31) landed clean: the rb-diag1/rb-diag2 re-soak had no NACK cycles, no REFUSED, no SPAN CAP, tie-breaks resolved deterministically, and ABORT propagated even when only one side locally detected the divergence. Remaining asymmetry is scheduler feel, not protocol disagreement. Fable's review flagged four items in priority order; this section covers the first (highest-leverage) one: lead regulation.

Observed asymmetry (rb-diag soak): host began ~3× as many rewind episodes as guest and owned almost all corrections against the guest's pad; pacing debt accumulated mostly on host (1428 ms vs 456 ms cumulative). The begin/mispredict ratio tracks almost 1:1 (host mispredict=124/begin=107, guest mispredict=50/begin=33) — rnet_input_contract_stick_replace_decide converts nearly every genuine mispredict into a rewind, so the real question is why one peer mispredicts 2.5× more than the other, not the contract's promote/rewind split.

Hypothesis: an over-prediction feedback loop. The peer that falls behind wall-clock (more Replay/TipHold work from owning more corrections) still has to keep pace with the wire tick rate, so it ends up predicting the remote pad further into the future before the real row lands; deeper predictions are mechanically more likely to be wrong; each wrong deep prediction becomes another correction it initiates, which costs more Replay/TipHold time — the same peer digs itself deeper. np_timesync_note_late already exists to brake exactly this (pacing debt shaved off at admit), but until now every mispredict added the same flat debt regardless of how deep the guess was, so a peer running way ahead and a peer running barely ahead got identical correction pressure.

Change 1 — proportional debt (psx_netplay.c): np_timesync_note_late now takes the mispredict's age (sim - t: how many ticks the wrong predicted row rode before the real one arrived and was caught). A row resolved right at the normal input-delay boundary (age ≈ D) is expected steady-state noise and gets the same flat debt as before — zero behavior change in the common case. A row that rode notably longer than D ticks means we were running unusually far ahead of the confirmed remote tip when we guessed it; extra debt scales +25% of the base add per tick past D, still capped by the existing 3-tick ceiling. This only activates additional braking specifically during the runaway-ahead pattern; it cannot make the aligned/steady-state case worse since extra_age is 0 there.

Change 2 — telemetry (psx_netplay.c phase-ctrl line): added mispredict_age_avg= / mispredict_age_max= (match-lifetime, like the other cumulative counters on that line) so the next soak can directly confirm or reject the causal hypothesis by comparing host vs guest average prediction age — instead of the begin/mispredict-count archaeology used to produce the numbers above. If the hypothesis holds, host's mispredict_age_avg should sit measurably above guest's, and both peers' ratio should compress with change 1 applied vs a soak with it reverted.

Deliberately not done yet: did not touch the tie-break weighting, the resim/tip-hold note_late suppression gate (already balanced — 17/17 suppressed_rb in the §31 re-soak, so that specific §30 hypothesis is closed), or the admit-side throttle shave rate. Per this project's own established practice (§29: a guessed pacing fix regressed and had to be reverted after a soak), only one bounded, reversible, provably-no-worse- in-steady-state change plus matching telemetry landed per cut — the next soak's mispredict_age_avg/lead_avg/debt_added decide whether to push further (e.g. widen the +25%/tick coefficient) or whether the asymmetry is gameplay-driven (who's the aggressor) rather than scheduler-driven.

Still open (scheduler-feel track, unchanged priority from fable's review):

Presentation cadence during Replay/TipHold — landed in §33 (hold-last present on wall-clock cadence during is_resimulating).
POST core/aux diverge (~0.8/1k ticks) — heal path (§31 ABORT propagation) already handles it gracefully; root cause is a separate emulation determinism gap (audit/cpu-split dumps already exist for that chase).
Gap1/grace — left as invent-immediate (§29's finding stands); revisit only after lead regulation is confirmed closing the gap, so grace changes aren't evaluated against a still-skewed baseline.

33. Hold-last present during resim (2026-08-01)

Problem: sdl_vblank_present_body early-returned on psx_netplay_is_resimulating() (AwaitingBaseline | Replay | Verify) and skipped every Swap. Admit still advanced uncapped, so replay% windows produced present_gap_p95 of 80–150ms — the metric tracked replay load because presents only resumed on Live ticks. Visually: frozen front buffer for the whole resim span, then a jump.

Fix (host presentation only — digests/wire unchanged):

GL sticky hold (gpu_gl_renderer.c): before each Live SwapWindow, hold_capture_drawable() copies the drawn backbuffer into a hold texture. When interpolation owns Swap, hold_capture_native_fbo() blits the display band from the VRAM/wide FBO instead. Mid-resim must not re-read s_hr_tex (it mutates during Replay). First NATIVE hold-present letterboxes then re-captures as DRAWABLE (soak-proven path).
gl_renderer_present_hold_last(): redraws the hold texture + Swap (swap interval already 0 under netplay — no vsync tax on resim throughput).
main.cpp resim branch: on a wall-clock period clamped to [8, 33] ms (≈ g_frame_period_ms), call hold-last + netplay_note_present(). Suspend GL interpolation for the episode (set_interpolation_suspended(1)) so the interp thread cannot fight hold-last SwapWindow (A/B: GL+interp buggy, GL without interp clean). Live restores FMV/game suspend policy. SW path re-presents with the last Live src/dst rects (not NULL,NULL on the full 640×512 texture — that produced the upper-left postage stamp). VK left as no-op hold (status quo skip) for this cut.
Epilogue still skips the frame pacer during resim — catch-up stays fast; only the present starvation is fixed.

Pass: post-settle high-replay% windows should show present_gap_p95 near the frame period (~16–33ms) instead of tracking episode wall time. Quiet Live tail unchanged. Re-soak GL+interp and SW; TipHold admit-stall gaps (§32) are a separate follow-up.

Post-§33 soak (rb-diag1/2, LAN, software GPU, menu nav): protocol healthy enough (tip-extend live, quiet present gaps ~18ms) but dpad taps felt doubled again. Audit arms showed fragmented digital pulses on the wire (e.g. ffbf @1044, idle, ffbf @1048–50, idle, ffbf @1055, tip-extend @1059) and tip-hold committing immediately between them. scrub-ahead logged 0 times; releases during tip-hold hit begin_refused=1 then quiet-commit dropped the edge.

Root causes:

TipHold quiet armed whenever sim >= invent_cap, including through 1-tick idle holes between controller bounce pulses (QUIET_MAX=80ms).
np_scrub_ahead_predicted no-op'd under TipHold (sim <= release_tick while coalesce promoted release at tip+N).
begin_refused while tip-holding (tip-extend fail / different seat) did not block quiet finalize — commit raced the unreabsorbed release.
1–2 tick idle holes published as real press/release/press edges; MotK menus edge-trigger → multiple navigations.

Fixes:

Digital release debounce removed (2026-08-03): 2-tick whole-word sticky merged intentional double-taps; Start sticky already removed (taunt double-pause is in-game). Snap-load continuity remains.
Scrub-ahead end bound = max(sim, tip+runway) during TipHold.
TipHold quiet only while pads idle and no pending wire delta tip+1..runway / block_quiet; held or pending resets the timer. Quiet window 100–150ms (was min 80 / max 80).
Thrash CAP suppressed while a wire edge is still pending (SAFETY still wins).
psx_netplay_rb_tip_hold_block_quiet from coalesce/begin_refused; different-seat tip-extend fail → tip-hold commit then fresh begin.

Re-soak checks: one physical dpad tap → one cursor move; look for scrub-ahead release during tip-hold coalesce; far fewer begin_refused=1 → immediate tip-hold commit pairs; tip-hold→commit dwell should often exceed ~100ms on calm edges.

35. TipHold SAFETY-while-held + hold-last on admit stall (2026-08-01)

Post-§34 soak: doubles improved (begin_refused=0, chatter pulses down) but 21/30 tip-holds hit SAFETY CAP 250ms, driving present_gap_p95≈240ms during menu play. Quiet almost never won: wire_pending_delta treated future presses (tip already idle) as pending, and SAFETY committed while digital still held → Live key-repeat after the stall. TipHold invent-cap stalls admit with no guest vblank, so §33 hold-last never ran.

Fixes:

SAFETY deferred while any pad held (log SAFETY deferred); commit only on quiet/thrash when idle, or ABSOLUTE 2000ms stuck-pad escape. sim > tip_hold_until also refuses commit while held.
Pending quiet-block = unabsorbed release only (tip held, wire delta ahead). Future press while tip idle no longer parks quiet. Stale block_quiet clears once idle + no pending release.
netplay_hold_last_present_tick() shared by resim present path and TipHold admit-spin (netplay_barrier_admit) so SAFETY/held waits keep Swap alive. Skip frame pacer while tip-holding.

Re-soak: expect mostly quiet tip-hold commits (not SAFETY); SAFETY deferred while holding then quiet after release; present_gap_p95 during menu not glued to 250ms; ABSOLUTE rare.

36. TipHold held = live pad, not frozen sim peek (2026-08-02)

Post-§35 soak: SAFETY deferred worked as coded — and every deferred episode then hit ABSOLUTE CAP 2000ms (held=1 pending=0, 6/6 both peers). Admit blew out (admit≈988ms/f, 1.0 fps). Cause: invent-cap freezes sim, stage_local latch freezes staged, and tip_hold_any_pad_held(sim) peeked that one immutable delay-ring row — a real controller release could never clear held, so quiet never armed and ABSOLUTE was guaranteed.

Fixes:

psx_netplay_stage_local always refreshes a live physical snapshot (even when latched). Admit spin captures while psx_netplay_rb_tip_holding() so live keeps updating.
psx_netplay_live_pad_buttons() + tip_hold_any_pad_held(tip): local uses live buttons; remote initially walked latest-ahead (revised in §37 to sealed tip only).
Invent-cap stall in try_admit still keys off wire/staged (do not invent-walk while the published tip pad is held — that was the key-repeat class). Only wall-clock finalize uses live.

Re-soak: SAFETY deferred then quiet/commit soon after release (not ~2s ABSOLUTE); ABSOLUTE only for truly stuck pads; menu fps not collapsing to ~1 on held tip-holds.

37. TipHold remote held = sealed tip only (2026-08-02)

Post-§36 soak: local live worked (SAFETY deferred → held=0 commit common) but 2–3 ABSOLUTE 2000ms remained with tip pads idle (s0=ffff s1=ffff, pending=0). Tip 1187 was asymmetric: slot0 quiet-committed immediately; slot1 deferred then ABSOLUTE while slot0 invent-raced (lead=-5, pcap FREEZE). Cause: §36 remote held walked tip..tip+runway and treated a post-tip press as held — reintroducing the §35 over-block, but only on the peer still tip-holding.

Fixes:

Remote held = sealed tip row only (same rule as pending-release: tip idle → not held for finalize). Future presses tip-extend / fresh episode after quiet.
SAFETY/ABSOLUTE logs include held_local= / held_remote= for soak attribution.

Re-soak: no ABSOLUTE on idle-tip + pending=0; quiet/SAFETY after local release; asymmetric tip-hold lead cliffs gone.

38. Post–tip-hold agreed holdoff + load clamp (2026-08-02)

Post-§37 soak: ABSOLUTE gone, but a follow-NACK resim storm hit after dense menu tip-holds. Tip 860: slot0 quiet-committed then agreed ADVANCE 860→864 and begin load=864; slot1 still tip-holding (SAFETY deferred held_local=1, frontier=860) → follow REFUSED past frontier → NACK → demote/cooldown → invent fork → baseline mismatch ABORT chain (mispredict=24, lead spikes to 75+).

Cause: HC ADVANCE after tip-hold commit races a peer that has not left tip-hold yet. Follower frontier stays at the sealed tip while initiator opens with load > tip.

Fixes:

300ms agreed ADVANCE holdoff after tip-hold commit (RB_MOTK_POST_TIP_HOLD_AGREED_HOLDOFF_MS) — covers peer SAFETY deferred (~250ms).
choose_load clamp to commit frontier only while holdoff is active (revised §39 — always-on ≤runway+4 was harmful).
begin DEFER during holdoff if load still above frontier (promote wire; no NACK-bait episode).

Re-soak: no follow REFUSED … past frontier right after tip-hold commit; no NACK demote storm; look for choose_load clamp / begin DEFER … tip-hold agreed holdoff only inside the holdoff window.

39. Gate choose_load clamp on holdoff only (2026-08-02)

Post-§38 soak: NACK storm gone, but hangs arrived sooner. After tip-hold 757, holdoff expired and HC ADVANCEd 757→784; the always-on ≤runway+4 clamp (gap=27) forced choose_load clamp 784→757 (holdoff=0) → SPAN CAP load=752 target=776 while mismatch=792 → tip-extend cliffs → peer tip-hold-committed while local tip-extended → verify timeout (peer POST missing) → realign to 752 with lead=47 / present_gap≈4s.

Fix:

choose_load clamp runs only when post_tip_hold_holdoff_active(); post-holdoff ADVANCE is left alone.
begin DEFER likewise holdoff-only (no runway+4 gate).

Re-soak: no choose_load clamp … holdoff=0; no SPAN CAP from clamping a healthy ADVANCE; holdoff may still log clamp/DEFER in the first ~300ms after tip-hold commit.

40. Advertise RESOLVED on ADVANCE + gate begin on peer frontier (2026-08-02)

Post-§39 soak: holdoff clamp gone, but NACK returned. Tip-hold 769 → slot0 HC ADVANCE 769→784 → begin load=784; slot1 frontier still 769 → follow REFUSED … past frontier → NACK → demote → cooldown → promote-no-resim → SPAN CAP → tip-extend ladder → POST/baseline desync.

Cause: agreed ADVANCE is local-only. RESOLVED was only burst on tip-hold/episode commit, so the follower's frontier = max(agreed, resolved_through) stayed at the tip while the initiator opened past it. Holdoff only covers the first ~300ms; after that the race is back.

Fixes:

Track g_peer_resolved_through from inbound RNET_RB_RESOLVED only (not local tip-hold set_peer_convergence, which would let the initiator self-authorize).
On HC ADVANCE / HEAL / BOOTSTRAP agreed raise: burst RESOLVED at the new watermark (advertise_agreed_resolved) so the follower's library resolved_through can accept the load.
choose_load clamp + begin DEFER when load > g_peer_resolved_through (logs: peer RESOLVED frontier / peer RESOLVED).
Drain RESOLVED before SYNC in psx_netplay_rb_pump so BEGIN in the same poll sees the updated frontier.

Re-soak: no immediate follow REFUSED … past frontier after tip-hold

ADVANCE; look for agreed ADVANCE paired with peer choose_load clamp … (peer RESOLVED frontier) until both sides exchange RESOLVED, then healthy begin at the shared watermark.

41. Bound peer-RESOLVED gate + no HEAL-FORCE advertise (2026-08-02)

Post-§40 soak (2/2): NACK storm gone, but slot=1 permanently begin DEFER … peer RESOLVED after HEAL-FORCE raised local agreed past a stuck g_peer_resolved_through (tip-hold tip). Peer never ADVANCEd (still tip-holding / forked HC), so inbound RESOLVED never rose — unbounded gate silently blocked every invent≠wire correction for the rest of the session. FPS stayed 60; Live desynced with no episode open.

Cause: §40 gated begin forever on peer RESOLVED with no timeout, and advertised unconfirmed HEAL-FORCE/BOOTSTRAP watermarks as if they were mutual.

Fixes:

500ms gate (RB_MOTK_PEER_RESOLVED_GATE_MS): after waiting, sticky-expire and force-open (peer RESOLVED stall force); NACK remains recoverable. Re-arm only when peer RESOLVED advances or a fresh HC-confirmed advertise raises past peer.
Heartbeat (RB_MOTK_PEER_RESOLVED_HB_MS=100): retransmit last confirmed RESOLVED while peer lags.
HEAL-FORCE / BOOTSTRAP do not advertise RESOLVED (unconfirmed).
Tip-hold enter/commit still track g_local_advertised_through for the heartbeat.

Re-soak: after HEAL-FORCE, expect at most ~500ms of begin DEFER … peer RESOLVED, then peer RESOLVED stall force and an episode open (or follow NACK→demote, not forever-DEFER). No unbounded frontier=<tip> DEFER ladder.

42. Mutual abort realign + tip-extend abandon + fork-storm guard (2026-08-02)

Post-§41 soak (3/3): DEFER deadlock gone, but a permanent core fork appeared. Sequence: both peers tip-hold and POST-match tip 986; slot0 absorbs a coalesce-ahead edge → tip-extend 986→996 → rereplay → Verify@996; slot1 meanwhile SAFETY-CAP commits at 986 and leaves the episode (its RESOLVED=986 arrives at slot0 but was ignored — below g_post_target). Slot0 sits in Verify until verify timeout (peer POST missing) and realigns to its pre-episode pin (944); slot1, receiving the ABORT after its commit, realigns to its own pick (986). The two Lives then run from different bases; every subsequent episode dies with baseline core mismatch local=… peer=… in an infinite abort→realign→ reopen loop (~40 cycles until disconnect).

Causes:

Tip-extend race: extension from a matched tip while the peer commits at the old tip can never verify — but we rode it into a 4-second verify timeout instead of abandoning.
Asymmetric realign: the wire OP_ABORT already carries the sender's realign tick (load field), but the receiver ignored it and realigned to its own local evidence — different ticks, permanent fork. Worse, a peer that had already committed and left the episode (epoch no longer active) skipped realign entirely.
No fork backstop: same-tick baseline-mismatch aborts repeated forever, rubber-banding Live on every reopen.

Fixes:

P2 — tip-extend abandon (g_tip_extend_from_tick): extension from TipHold/Verify records the matched tip it extended from. If peer RESOLVED lands in [from, post_target) while we sit in Verify at the extended tip, the peer committed at the old tip — abandon: set agreed=from (both cores matched there), prime HC, advertise, abort_episode with wire class REALIGN + realign_tick=from, realign Live to the nearest snap ≤ from, clear cooldown. The extension edge re-arrives as a fresh wire mismatch.
P1 — honor wire realign tick (honor_peer_abort_realign): on peer ABORT, prefer the sender's realign tick over the local pick. If we are ahead of it (unilateral tip-hold commit past it), demote agreed/resolved/HC to it and rewind — even when no episode snap was applied. Also honored when the abort's epoch matches g_last_commit_epoch (we committed and left before the ABORT arrived — exactly the soak case).
P4 — fork-storm guard (RB_FORK_STORM_LIMIT=4, RB_FORK_STORM_COOLDOWN_TICKS=600): ≥4 consecutive baseline-mismatch aborts realigning to the same tick → loud rb DESYNC — unrecoverable fork log, keep-live (no more rubber-band rewinds), STORM class on the wire, 600-tick cooldown. Any commit resets the streak. Backstop only — P1/P2 should prevent the fork from forming.

Re-soak: on a tip-extend race expect rb tip-extend ABANDON — peer RESOLVED=… (or rb peer abort realign honor … on the committed side) and both peers realigning to the SAME tick; no baseline core mismatch storm; the DESYNC — unrecoverable fork line should never appear.

Re-soak result (2026-08-02, 4/4): fork storm GONE. Two tip-extend races occurred (757→762 and 936→944-ish); both resolved cleanly via P1 — the committed side logged peer abort realign honor 720/912 … unilateral tip rolled back and both peers landed on the same tick. No baseline mismatch, no NACK, no DESYNC. Remaining cost: P2 ABANDON never fired — the SAFETY commit's RESOLVED burst arrived while the extender was still mid tip-extend rereplay (Replay phase, e.g. slot1 commit@757 landed during slot0's 758..762 resim), so apply_peer_resolved's Verify-phase check missed it and no further RESOLVED ever came. The extender rode the full 4s verify timeout (4000ms present-gap freeze) before P1 healed it.

§42b follow-up (SUPERSEDED by §42c — caused the soak-4 fork):

Extracted the abandon into maybe_abandon_tip_extend() and also call it from the Verify wait poll in psx_netplay_rb_pump with the stored g_peer_resolved_through — the check no longer depends on RESOLVED arriving while already in Verify. Expected effect: the 4s freeze becomes an immediate ABANDON on the first Verify poll.
Abandon commits at the peer's RESOLVED tick itself, not g_tip_extend_from_tick — with chained extends (744→751→754→757) from_tick is only the FIRST matched tip; the peer committed at the latest one, and its commit proves our POST there matched.

42c. OP_COMMIT wire signal — abandon keyed on commits only (2026-08-02)

Soak 4 (low-latency, auto D/P): §42b's abandon FALSE-FIRED and created the fork it was meant to prevent. Both peers were in epoch 24, extended 760→773, resimming IDENTICAL states (audit digests match tick-for-tick through 766) — a healthy episode that would have verified at 773. On the first Verify poll the abandon saw sticky g_peer_resolved_through=768 and treated it as "peer committed and left". But 768 was a stale §40 HC-ADVANCE watermark from earlier live play (interval-aligned, 96×8) — the peer never committed anything; it was mid-FOLLOW at tick 767. The abandon committed agreed=768 using our own resim snap (828285e2, never POSTed by anyone), aborted, and told the peer to realign to 768 — whose ring snap there was its PRE-rereplay live state (6cafabd5). Same tick, two states → baseline mismatch → fork storm at 992 → P4 DESYNC guard fired (mechanically correct) but the fork persisted to disconnect.

Two root errors in §42/§42b:

RESOLVED conflates two meanings — "HC watermark advanced" (§40 live-play interval confirms) and "I committed the episode and left" (SAFETY-commit burst). Only the latter justifies abandoning.
Tick equality ≠ state equality — a ring snap at tick T is only the mutual state if T's state was PROVEN mutual (POST pair matched / baseline digest-checked) and never overwritten by a later resim.

Fixes:

RNET_RB_SYNC_OP_COMMIT (=3) in recomp-net session.h: episode commit notice carrying (epoch, committed tick in the load field). Burst (×3) from finalize_tip_hold and commit_episode alongside RESOLVED. Receiver records g_peer_commit_epoch/tick and folds the tick into the RESOLVED watermark.
Abandon keys on OP_COMMIT only: same epoch, commit tick < post_target, and tick == g_tip_extend_from_tick (now updated on EVERY TipHold/Verify extend, so it names the tip the current rereplay reloaded from — the one snap provably preserved as the POST-matched state). Exact snap required; no walk-down. Checked on OP_COMMIT arrival and on every Verify wait poll (commit usually lands mid-rereplay). RESOLVED no longer triggers abandon at all.
Missing conditions fall back to verify timeout + §42 P1 honor, which soak 3 proved converges both peers at the sender's pin tick.

43. LAN micro-grace before gap-1 invent (2026-08-02)

Soak 4 scheduler audit: with rtt_raw 0–1ms the admit path still ran ~100% of admissions 1 tick ahead of the confirmed wire — invent_gap1=578/483, ALL case A ("tip healthy/advancing"), invent_runway_empty 4/0, tip_ema≈period. That is a sub-frame PHASE offset between the two peers' frame boundaries, not latency; D=2 covers the transit easily. §29's immediate-invent policy is correct for WAN (a fixed transit delay cannot be waited out) but on LAN the needed row is in flight and lands a few ms later; inventing instead cost slot0 96 mispredict correction episodes (vs 6 on slot1) — a large share of the session's episode churn.

Fix: in the §28 adaptive split (no PSX_RB_GAP1_GRACE_MS override), case A now takes a bounded micro-grace instead of cap=0 when either:

the link is provably fast (rtt_raw <= 12ms), or
the next tip is due imminently by cadence (tip_age + 6ms >= period — case A already bounds tip_age < 1.5×period).

Cap = rtt_raw/2 + 3ms, max 6ms. Expiry still invents (§29 behavior, worst-case 6ms tax), np_gap1_note_expire_invent unchanged, and the existing gap1_grace counter in rb admit stats shows how often the wait converted an invent into a real row.

Re-soak watch: invent_gap1 should collapse toward 0 on LAN with gap1_grace rising instead; mispredict counts should drop accordingly. On the tip-extend race expect rb tip-extend ABANDON — peer COMMIT (or the §42 P1 realign honor fallback) with both peers on the same tick and NO baseline core mismatch follow-up.

44. Real-delay consumption + scheduler extraction (2026-08-02)

Root cause behind §27–§29/§43's permanent remote_lead=D-1: the rollback admit consumed the wire at sim + D — the SAME row the local pad was sampled into on that very admit. Local input latency was zero and D was only a numbering offset, so by construction the peer's row for the consumption wire was still in flight on every tick: the steady state was pred_depth=1, hundreds of GAP1_PHASE invents per match, and the entire §21–§43 grace/pacing stack existed to manage a cushion that never existed. Notably, recomp-net's own LOCKSTEP path (rnet_session_try_admit) always did this correctly — "simulate wire T while sampling local input for wire T+D" with a primed neutral prefix — only MotK's rollback admit diverged.

§44 real delay (default ON, PSX_RB_ZERO_DELAY=1 restores legacy):

Consumption: guest tick T plays wire row T. All sim→wire mapping now goes through ONE helper, np_sched_wire_for_sim() (admit, seal promote, reconcile, tip-hold peeks, coalesce-ahead, pending-release walk — 8 former rnet_wire_tick_from_sim call sites).
Production: unchanged — rnet_session_prepare_local_tip samples the pad at admit(T) into wire T+D. A press costs D ticks of local latency and buys D ticks of transit budget; the peer's row for T arrives ~D·period − transit BEFORE it is needed. Healthy steady state: remote_lead ≈ D, pred_depth = 0, zero invents. The §21–§43 stack still exists but is now the RECOVERY path (lag spikes that actually drain the cushion), not the per-tick norm.
Startup / delay changes: the mutual-ready hard_resync + prime already fills wires [0..D) (each peer primes its own hold); prepare_local_tip (recomp-net, both copies) now back-fills EVERY missing wire in [sim..sim+D] instead of storing only the tip, so a mid-session DELAY_SYNC increase no longer leaves an unproduced gap the peer must invent across. Also unifies rollback with lockstep consumption (both wire=sim), removing a mapping discontinuity at FMV-lockstep ↔ rollback transitions.
cushion rebuilt (post-episode invent refusal until remote_lead >= D-1) now literally means the cushion is refilled — lead is measured against sim, so D-1 is "one in flight".

Auto D resolution (PSX_RB_AUTO_DELAY=0 disables): with a real cushion, D IS the latency/robustness tradeoff, so the host resolves it from the link: target = ceil(one_way/tick) + 1, clamped [2..16], trusted POST RTT only (>=4ms), 3 consecutive 5s evaluations must agree, 30s cooldown, and lowering additionally requires 30s freeze-free (a pcap freeze means prediction was needed at the CURRENT D). Proposed via the existing DELAY_SYNC path; the reactive §22 bump still covers untrusted-RTT freeze storms. LAN: rtt untrusted/low → D stays at the configured 2 (33ms latency, 33ms cushion).

Scheduler extraction: all admission POLICY moved to runtime/src/psx_netplay_sched.c + runtime/include/psx_netplay_sched.h (~850 lines out of psx_netplay.c): invent RTT synth, §21 grace, §27/§28/ §29/§43 gap1 policy, tip-arrival cadence, §29–§32 timesync pacing + phase-ctrl telemetry, pcap freeze + §22 adaptive bump, admit stats, §44 wire mapping + auto delay. psx_netplay.c keeps the MECHANICS (ring peeks, hist puts, tip-hold invent-cap, publish) and calls: np_sched_pre_admit (throttle/cushion/telemetry gate) → np_sched_on_remote_miss (stall vs invent decision) → np_sched_note_remote_hit / np_sched_post_admit; reconcile feeds np_sched_note_mispredict; episode boundaries call psx_netplay_timesync_on_episode_boundary (unchanged name, now a wrapper over np_sched_note_episode_boundary). State is bridged via np_sched_bind (pointers to session/D/P/local_slot) at netplay start. Everything in the file is host-side pacing — no guest-visible values, so determinism is unaffected by tuning it.

Re-soak watch: rb runway lines should show remote_lead ≈ D and pred_depth=0 in steady state; invent_gap1/gap1_case_a ≈ 0 (§43's micro-grace should almost never even arm); mispredict correction episodes near zero outside real lag spikes; local input latency D ticks (feel check: menu cursor). A/B against the old pipeline via PSX_RB_ZERO_DELAY=1 on BOTH peers (consumption mapping must match or the sims interpret wire rows D apart — instant desync).

45. Tip-hold race-ahead + cushion absurd-lead guard (2026-08-02)

Soak (post-§44): real-delay confirmed (wire=sim, auto D 2→3, steady pred_depth=0, no DESYNC/NACK), but a fight/menu exchange still felt like "long rewind that doesn't play forward." Logs:

Slot0 tip-hold at 5078 hit ABSOLUTE CAP 2000 ms (held_remote=1 on the sealed tip) while slot1 SAFETY-committed ~250 ms and kept Live.
Slot0 parked at invent-cap; peer tip raced to ~5379 → remote_lead≈280.
RNET_HISTORY_LENGTH=128 (~2.1 s) aged out the wires slot0 needed; post-commit invent RUNWAY_EMPTY across the gap, then SPAN CAP mismatch=5375 load=5072/5120 (visual snap-back ~250 ticks, chunked 24) with replay%=30–67%. Hold-last present (§33) made it look like rewind→freeze→jump, not corrected forward play.
Cushion rebuild cleared at lead=11 then lead=280 — treating a park cliff as a refilled cushion, then inventing into the aged gap.

Fixes:

RACE CAP — while SAFETY-deferred (digital held), if highest_remote_wire > tip + 24 (one tip runway), commit immediately. Peer tip that far ahead means they left TipHold; sitting for the rest of ABSOLUTE only ages the ring.
REMOTE-HELD wall 500 ms — when !held_local && held_remote (we released; sealed tip still shows peer pressed), Absolute escape is 500 ms instead of 2000 ms. Stuck local pad keeps the full 2000 ms wall. Coalesce/tip-extend still own the first SAFETY window.
Cushion absurd-lead guard — clear cushion_rebuild only when D-1 <= lead <= D+P. Leads above that log cushion KEEP (absurd lead=…) and keep invent refused so catch-up consumes real rows instead of inventing across a cliff.

Re-soak watch: no more ABSOLUTE CAP 2000 on held_remote-only while peer tip advances; expect RACE CAP / REMOTE-HELD CAP instead. No cushion rebuilt remote_lead=2xx. SPAN CAP / replay% spikes after tip-hold should collapse. Presentation still hold-last during resim (§33) — that is intentional; the goal here is to stop needing deep catch-up.

46. HC-silent promote for button mispredicts (2026-08-02)

Problem: MotK is digital — the portable input contract always rewinds when buttons differ, and only uses hash_confirm_promote for small stick deltas. Soak: loading-screen clicks produced rewind-request … pub=ffff wire=bfff → episode_open=1 even though the game wasn't reading pads (digests would match). Ungated menu soft-promote was tried earlier and forked RAM (sticky hold-last Up skipped a needed resim); that path stays off.

Fix: before the contract rewind path, if:

published buttons ≠ wire buttons,
the tick is completed (sim > t),
and netplay_hc_confirm_through(t) (both peers' FRAME_COMMIT digests matched through t),

then promote the wire into hist (scrub-ahead on release-only) and do not open an episode or feed timesync mispredict debt. Fail-closed: if digests did not match, behavior is unchanged (real press that affected state still resims). PSX_RB_HC_SILENT=0 disables.

Log: rb wire hc-silent-promote … (digests matched through t — hist only, no resim).

Re-soak watch: loading-screen / ignored-pad clicks should log hc-silent-promote with episode_open=0; menu/fight presses that change state still rewind-request. No new baseline forks from silent promote.

47. Replay ownership — contiguous confirmed catch-up (2026-08-02)

One-sentence scheduler invariant:

Replay owns the simulation until it has exhausted every contiguous confirmed tick; only then does control return to Live, and TipHold is entered only when the next tick cannot yet be confirmed.

Expanded:

Replay owns forward progress until no further confirmed simulation is possible.
Replay must never wait for information that is already confirmed.
Replay participates in the protocol exactly like Live — produces local confirmed tip rows while consuming remote confirmed rows (not an isolated repair loop).

Roles (non-overlapping)

Phase	Responsibility
Live	Predict only beyond the confirmed frontier
Replay	Consume all contiguous confirmed work as fast as possible
Verify	Digest/protocol sync between Replay SPAN chunks (barrier, not owner)
TipHold	Wait only for genuinely unavailable inputs

Not: Replay → Verify → TipHold → Replay as ordinary catch-up.

Contiguous frontier

from = replay_sim + 1

confirmed_frontier = greatest contiguous tick T such that every seat has a
                     confirmed (non-predicted) row for every tick from `from`
                     through T. If `from` is incomplete → frontier = replay_sim.

Example (replay_sim=99 → from=100):
  100 ✓  101 ✓  102 missing  103 ✓  104 ✓  → frontier = 101 (not 104)

Helpers: psx_netplay_rb_confirmed_frontier(from), psx_netplay_rb_confirmed_remaining(), psx_netplay_rb_ownership_step().

Ownership loop

While Replay is active (decision site: ownership_step + POST match):

If frontier > target and within RB_MAX_RESIM_SPAN of seal_base → tip-extend.
If chunk full but frontier > tip + 1 after Verify POST match → chain next SPAN episode immediately (no TipHold invent-cap / quiet wall). frontier == tip + 1 returns to Live (§48 — avoid 1-tick chain thrash).
If frontier <= tip after POST match → Final Verify → Live (enter_tip_hold + immediate finalize_tip_hold).

Verify remains the digest agreement point between chunks; Replay ownership continues across chunk boundaries until contiguous confirmed work is exhausted.

Tip refill + present cadence

Each Replay admit / resim finish_frame calls prepare_local_tip from the live physical pad (np_rb_produce_local_tip_for_sim).
Sim stays uncapped (pacer skipped during resim).
Remaining contiguous span ≤ 8: §33 hold-last present.
Longer catch-up: wall-clock period presents live Replay VRAM (rb catchup … present=live); otherwise skip present and keep draining.

Re-soak watch: mispredict → continuous rb arm/finish_frame / ownership extend|chain until frontier exhausted; no TipHold invent-cap mid confirmed catch-up; gap at T stops frontier at T−1; local tip advances during Replay; TipHold only when a remote row is actually missing.

48. Sticky invent Up → ownership-chain thrash (2026-08-02)

Problem: Post-FMV unlock, gap1 hold-last invent sticky D-pad (pub=ffef Up) vs wire release (ffff) opened a tip episode (~902). After Verify, both peers chained SPAN for frontier=tip+1, dual-initiated every chunk (tie-break WIN/YIELD), and agreed_span_lo=tip emptied the dense load span so the next begin walked back to %iv snaps (904→896) and re-replayed the Up stretch — menu ownership thrash / dual-init abort loop.

Fix:

Unlock-grace soft-promote: while psx_netplay_rb_fmv_unlock_grace_active() (RELEASE…dense_until), invent→release-only mispredicts promote+scrub hist without opening an episode (presses still rewind).
Ownership chain: chain only when frontier > tip + 1; only seat 0 calls begin_rewind (seat 1 commits tip watermark and waits FOLLOW SYNC); preserve agreed_span_lo from the prior episode load so choose_load keeps the dense committed span.

Re-soak watch: after FMV into menu, soft-promote … unlock-grace-release or no rewind-request pub=ffef; no tie-break YIELD / ownership chain tip=N frontier=N+1 storm; D-pad navigation stays single-step.

49. WAN ownership micro-chains + GO loss + realign tip cliff (2026-08-02)

WAN soak (FORCE_TURN / hotspot): FMV settle hang fixed (no invent-hold deadlock). Session played ~60 fps until ~sim 1231, then ownership chained SPAN every few ticks (epochs 16→64), guest ready timeout (no initiator GO) while host sat in Verify, dual realign to ~1264 with stale remote_tip≈1544 → WIRE_HOLE + cushion KEEP (absurd lead=279).

Fix:

Ownership chain floor frontier > tip + N (env PSX_RB_CHAIN_MIN_AHEAD; §49 shipped N=8; §73 lowers default to 4 after tip+8 tip-held every POST). Micro catch-ups below the floor stay Live / tip-hold.
Initiator GO rexmit until peer POST (TURN dropped the one-shot burst); ready timeout scales with RTT (4s…12s).
INPUT ACK resend when peer ack lags the tip-redundancy window.

§49b (same day): Live realign must not clear_remote_inputs. Full wipe → remote_tip=0 → mutual pcap FREEZE (wire≫P; neither advances). Selective invalidate also fails after ring wrap (only far tips remain). Pre-clear soak already recovered: peer post-realign production fills need while prepare_local_tip keeps emitting; §45 cushion refuses invent across holes until real rows land. API kept for hard_resync-style paths only.

Re-soak watch: no ready timeout (no initiator GO) under TURN; no ownership chain tip=N frontier=N+1..N+3 storms (floor is tip+4); after abort realign no pcap FREEZE … remote_tip=0 / remote tips cleared.

50. FMV tip-extend through lockstep → BIOS realign / CD fork (2026-08-02)

WAN soak (§49b binary): handshake + GO healthy; ~55–60 fps; death was a permanent core+CD fork after the second FMV (locked at tick 1136 ea3971ce vs fbb8c8aa, CD 7ac33b56 vs ac7c89e4). First fork was earlier:

Episode opens pre-FMV (begin epoch=8 mismatch=112 load=96).
FMV media/settle arms mid-Replay — begin/follow refuse new episodes, but tip-extend still raised the tip (116→122) and TipHold-rereplayed.
Guest ownership final tip=119 → Live; host tip-extends 119→122 with rereplay; guest follow REFUSED — FMV lockstep on the post-commit BEGIN.
Host tip-extend ABANDON realigns to snap pc=0xbfc03c04 (BIOS sticky); FIRST CORE DIVERGE sim=121; CD digests split and never fully heal.

Fix: Gate psx_netplay_rb_tip_extend and tip-extend FOLLOW on the same rb_in_fmv_lockstep_window() as begin/follow. TipHold + FMV → finalize_tip_hold (commit sealed tip). Replay + FMV → keep current target (no raise). Entering FMV while TipHolding also commits immediately.

Re-soak watch: no tip-extend … / tip-extend FOLLOW during FMV rewind-defer / settle; no tip-extend ABANDON → pc=0xbfc03c04 after first movie; no early FIRST CORE DIVERGE ~121; cores/CD stay matched through menu + second FMV.

51. choose_load vs Replay ownership vs present (2026-08-02)

Independent layers (do not fix load bugs by changing Replay behavior):

Layer 1  choose_load     Where do I start?
Layer 2  commit-tip snap Prefer newest safe snap that exists
Layer 3  Replay ownership How do I reach the frontier? (no restart)
Layer 4  Presentation    How does the player see it?
Layer 5  SPAN size       Last — only if depth still justifies it

Invariant (Layer 1): choose_load returns the newest snapshot both peers can prove is safe to replay from. Proof sources: commit/ADVANCE watermark, hash_confirm, peer RESOLVED. Peer RESOLVED must not lower the load below an HC-proven floor (soak: ADVANCE 1189→1248 then clamp→1189 → interval load=1184 → 65-tick SPAN storm / visual twitch).

Layer 2: Inclusive dense span [span_lo, through] so the commit tip itself is preferred over %iv fallback when span_lo == tip.

Layer 3: Ownership SPAN chain continues Replay at the verified tip with skip-snap (baseline from current state) — SPAN is bookkeeping, not a semantic restart (snap applied every chunk was the twitch).

Layer 4: Catchup live present gated at ~150 ms (not ~frame period).

Re-soak watch: after menu mispredict, choose_load near mismatch (depth ≲ iv); no clamp … peer RESOLVED that drops below hc_floor; chain logs ownership continue skip-snap; replay% / present flashes much lower; RB_MAX_RESIM_SPAN unchanged.

52. Seal rows had no rexmit → silent AwaitingBaseline deadlock (2026-08-02)

WAN soak (§51 binary): late-session 4s freeze. Host tip-extended 2598→2599 right after entering Replay (light tip), reached POST, then verify timeout → episode ABORT → both realign to 2576. Guest never entered Replay: baselines matched (9bf062ce both), ready=1, phase stuck at AwaitingBaseline with zero log output — the only silent early return in maybe_enter_replay's gate chain is !rnet_rb_all_peer_seal_rows_complete.

Root cause: export_local_seals() fired only on discrete events (begin / tip-extend / FOLLOW) with no retransmit. The guest's FOLLOW extension grew its sealed_span to include 2599, but the host's post-extend re-export carrying the slot-0 row for 2599 was a single unacknowledged UDP burst — one WAN drop (hotspot, RTT 72ms) parked the guest forever. Baseline and GO already had keepalive rexmit (§49); seals did not. The receive-side stash comment even assumed "the sender's normal chunk retransmit cadence re-delivers it" — that cadence never existed.

Fix:

Seal keepalive maybe_rexmit_seals() — rides maybe_send_baseline's call path, re-runs export_local_seals() on the RB_BASELINE_BURST_MS cadence until the peer's POST arrives (POST proves a complete seal table). Idempotent receive (rows OR into peer_seal_mask), ≤3 chunks per send.
Named stall diag — !all_peer_seal_rows_complete in maybe_enter_replay now logs once per episode after 500ms: rb waiting peer seal rows base=… span=… slotN=0.

Re-soak watch: no verify-timeout abort where the peer log shows matched baselines + ready but no rb replay; if rb waiting peer seal rows appears it should be followed by rb seal rexmit and a normal Replay entry, not an abort.

53. Live ADVANCE cadence + choose_load max floor (2026-08-02)

WAN soak (§52 binary): match-start countdown mispredict felt like a deep rewind into the intro. Logs:

host:  agreed HEAL 1069→2336 (hc=2347) → begin load=2336 mismatch=2461
guest: agreed HEAL 1069→2448 (hc=2460) → follow load=2336  (host BEGIN)

Depth 125 with snaps through 2448 and guest HC at the mismatch — Layer 1 violated again. Seal keepalive (§52) was healthy (seal rexmit → Replay).

Root cause:

advance_agreed_watermark_from_hc / aged HEAL only ran at begin/follow, so agreed froze at tip-hold commit 1069 for ~1400 Live ticks until the snap aged out (oldest=1440), then emergency HEAL jumped to each peer's local HC interval (asymmetric: 2336 vs 2448).
choose_load set shared = agreed and refused to raise via HC ("ADVANCE already promotes") — so initiator BEGIN locked both peers to the worse HEAL. Host HC itself lagged (~2347 vs guest ~2460) from invent-fork stalls in the 128-slot ring; peer RESOLVED from a Live-ADVANCE'd guest would have proven 2448, but raise-via-peer was not allowed.

Fix:

Live cadence — every psx_netplay_rb_pump: hc_heal_stale_gap + advance_agreed_watermark_from_hc (existing guards skip episodes / TipHold / post-tip-hold holdoff). Agreed tracks HC through countdown.
choose_load raise — outside tip-hold holdoff, shared = max(agreed, hc_interval_floor, peer_resolved).

§53b (same day — regression from first cut): Live pump also ran aged heal_agreed_watermark_if_aged_out, and raise used raw hc_floor. Soak:

choose_load raise 752→765 → follow NACK (frontier=752 unconfirmed tip)
HEAL-FORCE 752→816→880→944→1008 (hc stuck) → baseline core mismatch forever

HEAL-FORCE does not advertise; under a live HC stall it invented unconfirmed agreed tips every pump. Raw hc tip (765) is not mutual with follower's ADVANCE'd interval frontier (752).

Corrected:

Live pump: ADVANCE only — aged HEAL / HEAL-FORCE stay at begin/follow.
Raise / peer-RESOLVED clamp floor: HC-confirmed interval snaps only (hc_interval_floor), plus peer RESOLVED — never raw tip hc_floor.

Re-soak watch: periodic agreed ADVANCE … through Live; no Live HEAL-FORCE cascades; no choose_load raise …→ non-interval tip; no follow NACK on load just above agreed interval; no repeating baseline core mismatch after first menu edge. Countdown mispredict still loads near mismatch when peer RESOLVED / HC interval is current.

54. Silent permanent fork: cooldown-swallowed correction + no HC recovery (2026-08-02)

WAN soak (§53b binary): resim-purity abort at sim≈1363 (local pad edge sampled mid-resim on the guest corrupted the sealed tip) → episode ABORT → cooldown. At sim=1370 a completed-tick pad mispredict arrived during the cooldown window; reconcile's no_resim branch promoted the wire row into history and moved on. The live state had already simmed the wrong pad — both peers then ran ~1000 ticks at a smooth 60 fps with permanently diverged cores. No new pad mispredicts occurred, so no episode ever opened again; FIRST CORE DIVERGE was log-only.

Two gaps, two fixes (both in psx_netplay.c):

Deferred rewind for cooldown promotes. The no_resim (sweep / cooldown / fmv-lockstep) branch now records the earliest pads_differ && completed tick it promote-only'd (s_deferred_rw_{valid,tick,slot}). Once the window ends (!no_resim && !fmv_defer), reconcile either drops it — if hc_confirm_through(t) proves both peers matched after the tick anyway — or opens the episode the cooldown suppressed (rb deferred rewind t=… slot=…). Refusals retry next pump.
HC-fork recovery episode. np_check_core_diverge no longer stops at logging: if the hc_peek_mismatch fork persists ≥16 ticks (well before the 128-slot hc ring wraps and peek goes quiet) with no episode / TipHold / pending load / cooldown / FMV window, the slot-0 host (single-initiator, avoids dual-BEGIN collision) opens a recovery episode at the fork tick (rb hc-fork recovery begin t=…), correction seat = remote slot. Retries every 32 ticks while the fork persists; guest follows via the normal wire SYNC. choose_load starts it at the newest provably-safe snap (HC is confirmed through fork−1 by definition).

Fix 1 should catch the divergence at its source; fix 2 is the backstop for any fork that slips past pad-level reconciliation (invent races, purity bugs, CD timing).

Re-soak watch: after any episode ABORT + cooldown, a mispredict inside the window should be followed by rb deferred rewind … → normal Replay (or silence if HC confirmed through it); no repeat of the smooth-60fps silent fork — if cores split without a pad edge, expect rb hc-fork recovery begin within ~16 ticks and digests re-matching after the episode.

55. Resim purity + dead-timeline evidence + fork bisect (2026-08-02)

WAN soak (§54 binary): §54's hc-fork recovery healed two real silent forks (t=2627 after a seal-timeout abort, t=4049 after a tip-extend abandon) — matched baselines, clean replay, session continued. The session still died at sim≈4160 to a three-stage failure:

Purity leak (root): during the epoch=145 tip-extend chain the host armed tick 4179 with the guest seat unsealed — audit arm sim=4179 … s1=----. rnet_rb_extend_target zeroes remote-seat rows (peer SEAL_ROWS fill them later) and publish_sealed_sio silently falls back to live hist for any missing seat. The per-tick audit digest is CPU-only, so the RAM fork was invisible until the FRAME_COMMIT abort at 4180 (resim core diverge).
Dead-timeline evidence: both peers realigned to the matched 4160 snap, then the guest ran agreed ADVANCE 4160→4176 (hc=4179 live confirm) — hash confirms from the aborted timeline. Each peer re-simmed 4161..4176 with its own history → permanently diverged 4176 snaps (4ced9093 vs accdaaec) that choose_load kept certifying as provably safe.
Same-snap retry loop: four recovery episodes all loaded 4176, all died on baseline core mismatch, cooldowns escalated to the DESYNC storm-breaker, the fork tick aged out of the 128-slot hc ring, peek went quiet, and both sides ran silently forked at 60 fps until disconnect.

Fixes (one per stage):

Seal authority (lib rnet_rollback.c + runtime arm gate).
- rnet_rb_fill_local_row: remote seats now pre-seal from host history when the row is wire-confirmed (!is_predicted) — that is the owner's transmitted pad, byte-identical to what the owner seals, so it is authoritative without waiting for SEAL_ROWS. Predicted rows stay unsealed.
- rnet_rb_resign_slot_range: the peer-seal mask bit is only credited for wire-confirmed rows on remote seats — invented pads no longer count as authority (they used to satisfy all_peer_seal_rows_complete).
- New rnet_rb_seat_row_authoritative() + runtime rb_arm_rows_ready(): Replay may not arm a sealed-span tick until every seat's row is authoritative (local / peer-delivered / wire-confirmed). Stall sites: try_admit, the finish_frame chain-arm, and arm_rereplay_after_load (rb arm wait rows sim=… slot=…). Seal keepalive (§52) redelivers rows; RB_REPLAY_STALL_MS aborts a genuinely dead episode.
Realign evidence clamp (realign_invalidate_evidence, at realign queue AND apply): hash_confirm primed after the realign tick, agreed / peer-RESOLVED / local-advertised watermarks clamped to it, and ring snaps above it dropped (netplay_snap_ring_drop_after). Post-realign live FRAME_COMMITs then re-prove (or immediately re-flag) the timeline from the realign point instead of inheriting confirms for states that no longer exist. Log: rb realign evidence clamp tick=… (snaps_dropped=…).
Fork bisect cap (g_bl_fork_cap): a baseline core mismatch at load L proves the fork predates L. choose_load now forces the next load strictly below the failed one (rb fork cap, rb choose_load bisect load=…), refusing episodes when nothing provably safe remains below. Cleared on any verified commit or session reset.

Re-soak watch: no arm … s?=---- audits inside a sealed span (grep s0=----|s1=---- between rb replay and POST); occasional rb arm wait rows immediately healed by rb seal rexmit is fine; after any abort expect rb realign evidence clamp and NO agreed ADVANCE above the realign tick until fresh live confirms; if a baseline mismatch does occur, the next attempt should log choose_load bisect at a lower load instead of retrying the same snap 4×.

56. Scheduler equilibrium: cushion-rebuild exit, pipeline slack, scorecard (2026-08-02)

Post-§55 soak: correctness held (no baseline mismatches, no desync, one self-healed aux diverge) but the scheduler never reached its own contract. lead_avg sat at 0…−1 the whole session instead of ≈ D=2, invent_gap1 climbed continuously (~225 by session end), and cushion rebuilt fired at remote_lead=1 with D=2 — one tick short of full. The user-reported symptom is the consequence: episodes fire back-to-back because live play permanently runs at the edge of the cushion, so every arrival wobble becomes an invent → mispredict → episode.

Reordered roadmap (user, 2026-08-02): 1) scheduler equilibrium, 2) continuous replay ownership, 3) dense live snapshots, 4) jitter-driven adaptive D, 5) episode extension/reuse. This section is step 1's first slice: fix the one provable exit bug and instrument the pipeline so the remaining phase loss is measured, not guessed.

Changes:

Cushion-rebuild exit (np_sched_pre_admit). The old exit cleared at remote_lead >= D-1 — the rebuild "completed" one tick short and the next miss invented into the missing tick. Now: lead >= D clears immediately (rb cushion rebuilt FULL); lead == D-1 only clears after holding 400 ms (rb cushion rebuilt NEAR … held=…ms), giving the pipeline a real chance to top up while still never deadlocking a link that genuinely plateaus at D−1. Below D−1 the behavior is unchanged (wait; absurd-lead guard intact). Rebuild-window start is stamped at np_sched_note_episode_boundary.
Pipeline slack instrumentation (lib + sched). New rnet_session_remote_arrival_age_ms(s, slot, wire): every remote wire row gets a monotonic arrival stamp at store_remote_frame (first-wins, 128-deep, mirrors the ring); the scheduler samples, once per sim at pre-admit, how long the row for the consumption wire had been sitting there. That is the time-domain cushion the tick-domain remote_lead quantizes away: healthy ≈ D·16 ms − transit; ≈0 ms means rows arrive just-in-time and the cushion exists on paper only. Misses at need are counted via on_remote_miss (miss_need).
Equilibrium scorecard (~30 s cadence, both peers). rb scorecard dt=… ep=+N depth_avg=… gap1=+… tip_stale=+… miss_need=… lead avg/min/max slack avg/min/max n=… D=… cushion=… — per-window deltas (episode count from psx_netplay_rb_episode_count, replay depth from the new cumulative psx_netplay_rb_replay_ticks_total, which is independent of the FPS logger's take-and-reset counter). Scheduler changes should move ep/gap1; snapshot changes should move depth_avg — the two are now separable per soak window.

Re-soak watch: compare rb scorecard lines across the session and between peers. Expect cushion rebuilt FULL (or NEAR with held≈400ms) after episodes instead of instant lead=1 exits. The slack avg value is the key new datum: if it reads near zero while lead avg looks healthy, the produce →consume pipeline is consuming the whole cushion in phase (production or send timing), and that — not invent policy — is the next equilibrium fix; if slack is healthy but miss_need/gap1 still climb, the losses are arrival jitter and step 4 (jitter-driven adaptive D) moves up.

57. Arrival-driven adaptive D + transit-aware targets (2026-08-02)

§56 soak verdict: the scorecard closed the "where did the cushion go?" question. Slack was NOT near zero (24–36 ms of buffered arrival age), lead matched the equilibrium the delay budget permits once transport is counted (lead ≈ D−1−transit: predicted 0.6/2.1 for the two peers, measured 0.24/0.91), yet miss_need stayed at ~25% of ticks and episodes scaled with miss_need, not with scheduler instability. Conclusion: the scheduler converges to the equilibrium permitted by the current delay budget and the measured transport latency — the budget itself is what's short. D=4 minus 1 pipeline tick minus ~2.5 ticks of one-way transit leaves ~0.5 ticks of margin; every jitter excursion becomes a miss → invent → mispredict lottery. Correctness layer held throughout (§54 hc-fork recovery healed the early fork; two resim-diverge aborts realigned cleanly under the §55 evidence clamp; zero baseline mismatches / desyncs).

Roadmap consequence (user-confirmed): adaptive provisioning moves to the front — it reduces how OFTEN rollback happens; dense snapshots then reduce how MUCH each one costs; replay ownership the efficiency of the remainder.

Changes:

Auto-delay signal replaced: RTT → arrival stream (np_auto_delay_tick §57 rewrite). The POST RTT EMA measured 80 ms on the host and 12 ms on the guest for the same link — unusable. The controller now consumes exactly what the scheduler consumes, per 5 s eval window of LIVE ticks only (episode / tip-hold / |lead|≥32 samples excluded):
- miss_rate — rows absent at need (from on_remote_miss, once/wire);
- lateness — first-miss → arrival delta for misses we waited out (timer armed in note_miss, resolved in note_remote_hit, invalidated if the miss was invented instead; >2 s artifacts discarded);
- transit_est — EMA of D−1−lead_avg in 1/16-tick units, maintained on BOTH peers (drives local targets; host alone proposes DELAY_SYNC). Raise: miss_rate > 2% → D += ceil(late_avg/tick) (1..2/step), confirm on 2 evals (10 s). Lower: miss_rate < 0.2% AND ≥2 spare ticks of lead, confirm on 3 evals + 30 s cooldown + no pcap freeze in 30 s. Asymmetric on purpose: a raise costs only input latency, a miss costs determinism. Log: rb auto delay X → Y (arrival: miss=… late avg/max … lead_avg=… transit_est=…). The §22 reactive pcap-storm bump is unchanged.
Cushion-rebuild target is now the achievable lead (FULL unchanged at lead ≥ D; the D−1 NEAR exit is replaced by achievable = clamp(D−1−round(transit_est), 1, D−1) with the 400 ms hold → rb cushion rebuilt ACH …). §56's NEAR exit spent 12.6 s parked against a target the link physically cannot reach.
Scorecard gains transit_est=… so soak logs show the controller's view of the link next to the raw lead/slack numbers.

Re-soak watch: expect rb auto delay ON (§57 …) at session start and, on the WAN link, a stepped climb (4→5/6 within ~20 s of fight start) with each step logging its arrival evidence; after it settles, rb scorecard should show miss_need collapsing toward zero, gap1 deltas an order of magnitude down, ep=+N per window dropping toward low single digits, and lead avg rising to ≈ D−1−transit_est. cushion rebuilt ACH should replace the long NEAR holds. If miss_need stays high at D=6–7 with transit_est stable, the residue is loss/retransmit (wire holes), not provisioning — investigate rb wire hole lines before raising D further. Trade-off to feel for in play: each +1 D adds ~17 ms of local input latency; if the WAN session feels laggy but smooth, that's the controller working — step 3 (dense snapshots) then attacks replay cost so D can ride lower.

58. Dense tip snapshots + Start debounce in replay produce (2026-08-02)

§57 soak verdict (healthiest yet — committed): the arrival-driven controller worked with evidence on every move (5→6 at 153‰ miss / 11 ms lateness, later 6→5 at 0‰ sustained). Scorecard trend across windows: miss_need 198→150→32 (host) / 72→19→17 (guest), gap1 +116→+24 / +50→+8, episodes ~1–2 per 30 s (was 6–8), lead avg sitting on the achievable D−1−transit_est, cushion rebuilt ACH replacing the NEAR parks. One abort per side, zero baseline mismatch / desync. Two items remained: replay depth_avg 14–41 with pred_depth 1–2 (snap granularity dominates episode cost), and one user-visible bug — a Start press opened TWO overlapping pause menus (online only).

1. Start doubling (historical note): initially blamed on §47 replay produce bypassing §34 dig sticky. Later soaks + DuckStation/keyboard isolation showed post-match taunt double-pause is in-game MotK; sticky filters were removed (2026-08-03). Snap-load continuity (§79) still covers Replay tip_without_stage false edges.

2. Dense tip snapshots (PSX_NET_SNAP_DENSE, default 8, 0=off, max 24). Live path now saves EVERY tick; non-interval ticks are tracked in a sliding FIFO and evicted from the ring once they age past the window (pinned baseline / episode load / commit-span snaps are never dense-evicted), so interval history is untouched. Ring depth 64→80 to absorb the extra occupancy. Cost: one raw boot_state save per frame instead of per 16 — watch the [FPS] guest ms/f; PSX_NET_SNAP_DENSE=0 restores §57 behavior.

3. choose_load can now raise to the raw HC-proven tick when a local snap exists there (hc_dense= in the raise log). The §53b interval-only raise rule predates dense snaps; with both peers keeping the same window the snap is normally present on the follower too, and when it is not, follower NACK → demote already covers it (one extra round trip, rare). Together with the walk's existing HC-confirmed acceptance, a near-tip mispredict should now load at (or within a tick of) the mismatch.

Re-soak watch: rb snap ring ready … tip_dense=8; scorecard depth_avg should drop from 14–41 toward pred_depth + handshake span (single digits); watch [FPS] guest ms/f for the per-frame save tax (if Live drops below 60, set PSX_NET_SNAP_DENSE=4 or 0 and re-evaluate); occasional choose_load raise … hc_dense=… lines are the new path working — a burst of follower NACK/demotes right after them would mean the peer's dense window is out of phase and the raise should be narrowed. For the Start fix: pausing near resim activity should be single-menu; if a double recurs, enable the pad edge log and capture the row sequence.

Pad-trace (2026-08-02): for Start/menu doubles use PSX_RB_PAD_TRACE=1 (implies richer pipeline logging; keep PSX_RB_PAD_LOG=1 for classic pad-edge lines). Checkpoints: dev (capture card / raw SDL Start / fallback), stage (raw vs debounce / latch), live-only (SDL edges while sim latched), tip-produce, sio (apply_n + DUP). Automatic lines: VERDICT pulse (gap≤2), multipress (gap≤60), dup_sio, sample_vs_apply (stage↓ vs sio↓ at +D — not a bug), tip_without_stage. One deliberate Start → read the VERDICT.

Pad sticky removed (2026-08-03): Start sticky (8 ticks) and dig sticky (2 ticks) both removed. Taunt double-pause is in-game (DuckStation too); dig sticky was merging intentional double-taps across 1–2 tick idle holes.

Start cadence bisect (2026-08-02)

Do not raise debounce further until this answers where online first diverges from offline. Env PSX_START_BISECT=1 logs every sample:

start-bisect n=… mode=offline|online path=offline|cap|stage|tip|sio|spin
wall_ms=… sim=… sdl=… cap=… deb=… sio=… latch=… tip_hold=… resim=…

Stage 1: hold Start ~1s offline, then online (same pad). Compare sdl= streams. If they differ → scheduler/admit cadence. If identical → move downstream (cap → deb/stage → sio).

Stage 3 toggles (one at a time, rebuild not required — env only):

Env	Effect
`PSX_START_BISECT_NO_GC_UPDATE_IN_ADMIT=1`	Skip `SDL_GameControllerUpdate` in admit spin
`PSX_START_BISECT_NO_TIPHOLD_CAPTURE=1`	Only capture when latching a new tip (no TipHold live refresh)
`PSX_START_BISECT_NO_CATCHUP=1`	Force catch-up budget 0
`PSX_START_BISECT_NO_REPLAY_PRODUCE=1`	Skip §47 replay tip produce
`PSX_START_BISECT_SPIN=1`	Also log raw SDL on admit spins without capture (dense)

Strongest suspect: dense GameControllerUpdate + per-sim-tick capture while offline samples on the paced present loop.

Start consumer bisect (2026-08-02)

SDL soaks showed dirty Start offline and online (different pulse shapes). Next question is consumer equivalence: given a long hold, does MotK's SIO reader see the same Start timeline offline vs online?

Env PSX_START_CONSUMER=1 logs once per sim frame at SIO apply (offline sample_pad_into_sio, online host_publish / snap-load merge):

start-consumer n=… mode=offline|online sim=… slot=… start=0|1
edge=↓|↑|- buttons=…. wall_ms=… resim=0|1

Procedure: hold Start ~1s offline, then online (same pad, presser slot). Collapse start= into bitstrings. Cases:

Offline	Online	Meaning
solid `1…1`	`1…0…1`	online pipeline changes game-visible Start
`1…0…1`	`1…0…1`	consumers match → MotK pause/menu differs
solid `1…1`	solid `1…1`	yet double pause → pause invoked without input edge

Invariant: same logical button timeline ⇒ same Start timeline at SIO. Remaining differences then belong to MotK pause handling, not netplay.

59. Lobby RTT→D table bump + TURN floor + faster first raise (2026-08-02)

§58 soak: dense tip snaps worked; after auto-delay reached D=6 the scorecard hit ep=+0 windows. Early minute still invent-stormed because Play started at D=3 with force_turn=1 — lobby UDP RTT underestimates the TURN game path.

Changes: rollback RTT→D table +1..+2 per band (floor 3); forced-TURN floors D at 5; first auto-delay raise of a session confirms on 1 eval (~5 s).

60. Ownership-chain BEGIN stash + rexmit (FOLLOW deadlock) (2026-08-02)

§59 soak hang: early D=5 was healthy (ep=+1, depth_avg=10). Mid/late cascade (core diverge → tip-extend abandon → baseline mismatch) ended in:

host: sim=3320 stall=rb_baseline forever after begin epoch=72
guest: wait FOLLOW then Live-ahead → permanent pcap_freeze

Root cause: pump drains SYNC before POST. Initiator finishes Verify+POST, opens the next ownership-chain BEGIN, and sends it while the follower is still in Verify for the prior epoch. begin_follower hit if (rnet_rb_is_active) return; with no log — BEGIN dropped. BEGIN was fire-and-forget (unlike seal/baseline keepalive), so the follower parked on wait FOLLOW forever and the initiator sat in rb_baseline.

Fixes:

Stash peer BEGIN when a new-epoch BEGIN arrives while locally active (tip-extend same-epoch still absorbed in place). Log: rb BEGIN stashed ….
Apply stash when idle — at the follower's ownership-chain wait FOLLOW return, and at end of pump when !active. Log: rb BEGIN unstash ….
BEGIN rexmit from initiator while SealInputs/AwaitingBaseline and peer baseline not yet seen (rb BEGIN rexmit …), same cadence as seal/baseline keepalive.
Skip-snap follow at the ownership tip: follower may join a chain BEGIN at load == agreed_through without a ring snap (mirrors initiator skip-snap), instead of NACK → storm.

Re-soak watch: after ownership-chain lines, expect either immediate follow epoch=… or BEGIN stashed → BEGIN unstash → follow; initiator may log BEGIN rexmit on TURN. Must not see host rb_baseline + guest wait FOLLOW with no follow for >1–2 s. Residual mid-session core forks remain a separate correctness track.

61. Same-epoch BEGIN stash reopen + hc_dense peer clamp (2026-08-02)

§60 soak regression: FOLLOW deadlock was fixed, but sessions felt like “finish resim → immediately redo.” Guest log pattern:

follow epoch=16 (good)
while still active, host BEGIN rexmit for epoch 16 → stashed
ownership final → Live
BEGIN unstash epoch=16 → re-open the episode just committed
host already past that work → guest verify timeout → both realign and churn into the next epoch (FPS 3–11, long present_gap)

Also: host choose_load raised via hc_dense above peer RESOLVED (e.g. 1180 vs 1168) → follow REFUSED / NACK / demote storm.

Fixes:

Do not stash same-epoch BEGIN while active (keepalive rexmit only).
Refuse stash / unstash for g_last_commit_epoch.
Clear same-epoch stash on ownership final and every episode commit path (tip-hold, ownership tip commit, POST match).
hc_dense raise only if peer_resolved_through >= hc_floor (otherwise stay on interval floor / agreed / peer_resolved).

Re-soak watch: after ownership final / episode commit, must not see BEGIN unstash of that same epoch. hc_dense raises only when peer RESOLVED already covers the tip. Legitimate new-epoch BEGIN stashed → unstash still expected across ownership-chain handoffs.

62. NACK deep-demote WIRE_HOLE hang + peer NACK floor (2026-08-02)

§61 soak: stash fix held (zero BEGIN stashed/unstash), but the run ended in an asymmetric permanent hang:

Ownership continue skip-snap at load=10232 → baseline core mismatch (f795b460 vs a6e2e2a6) → fork cap 10232, both sides realign to the same snap (core=07993348).
Host bisects to load=10231, opens epoch 112 spanning back from live ≈10359.
Guest follow REFUSED … snap missing (ring newest ≈10364, oldest ≈10284 — 10231 evicted) → NACK with frontier=10352 (ahead of the load, so the existing "demote to peer frontier" clamp did nothing).
Host NACK realign demote=10230 live_was=10359 (~129 ticks, snaps_dropped=70). Remote wire rows 10231..10243 were already past the tip-window retransmit → permanent WIRE_HOLE need=10231 stall; guest ran ahead to 10376 then froze on pcap_freeze lead=-10.

Also confirmed: the mid-session "jumped back far" feel (epoch 65, ~21 ticks to the episode pin 7952 after resim core diverge sim=7973) is correct behavior — the fork lies inside the episode span, so rewinding to a later tip-extend snap would preserve the forked state. Not changed.

Fixes:

Peer NACK floor (g_peer_nack_floor): a NACK whose frontier is at or ahead of the refused load means the peer's ring evicted that tick. choose_load refuses any load ≤ floor (both fork-cap and plain paths); log choose_load refuse load=… ≤ peer NACK floor. Cleared with the fork cap on every verified commit / session reset.
Wire-hole guard on NACK realign: before rewinding Live to the demote tick, scan remote wire rows (demote, live]. A missing tick followed by a later present tick is a dead hole (retransmit window has moved on); realign instead to the first snap past the hole (rb NACK hole-guard realign_to=…). Watermarks still demote — only the Live rewind depth is capped.

Residual: with fork cap forcing load < 10232 and NACK floor forcing load > 10231, the bisect window can be empty — no episode opens and the fork persists (live continues, no hang). True mid-session fork healing below both snap rings needs full-state transfer — separate track. The skip-snap baseline mismatch that started the cascade (same realign snap, different skip-snap baselines) is also still open.

Re-soak watch: no minutes-long WIRE_HOLE / admit waiting stalls; on follow NACK expect peer NACK floor=… then either a followable reopen or choose_load refuse + cooldown; NACK realign lines now print demote=… realign=… and realign must stay above any logged wire hole.

§62 soak: protocol healthy (no WIRE_HOLE / stash reopen; scorecards ep≥0, D≈5–6, clean lobby exit). UX regression: dpad/Start felt doubled again. With PSX_RB_PAD_LOG=1, every menu episode re-applied SIO edges Live had already applied (DUP_SIO at the same slot+sim):

after ownership final tip=3533 → Live, Live walked 3536/3543/3548, then epoch 16 loaded 3533 and resim'd those edges;
Start↓ @5861 Live, invent hold-last Start↓ @5868 while auth was release → episode load=5856 → Start↓ @5861 again on resim;
scrub-ahead fired 0 times; catchup live-present (rem>8) could flash those resim edges on screen.

Root causes:

Ownership final called enter_tip_hold then immediate finalize_tip_hold → straight Live; next taps presented then got rewound by the following episode.
Resim catchup live-presented when remaining > 8 — tip episodes (~15–24 ticks) re-showed edge-trigger outcomes.
Scrub-ahead end bound outside TipHold was only sim, so invent poison past the tip was not cleared when a release promoted.
Host pad-edge trackers survived snap load (diag noise).

Fixes:

Ownership final → tip-hold only (quiet/coalesce/SAFETY own the commit). Log: ownership final … → tip-hold. Same for chain-begin failure fallback.
Hold-last present through rem≤24 (full tip SPAN); only deeper ownership-chain catch-up live-presents.
Scrub-ahead outside TipHold extends to sim+9 (pred depth) so release promote clears invent hold-last ahead of Live.
psx_netplay_on_rb_snap_loaded resets sio/invent/local pad-edge trackers from psx_frontend_on_rb_snap_loaded.

Re-soak watch: ownership final … → tip-hold then tip-hold through=… / quiet or coalesce commit (not immediate Live); scrub-ahead release should appear on digital releases; tip episodes should not log catchup … present=live unless rem>24; one physical Start/dpad → one menu action. Pad-log may still show resim SIO edges (correct for sim) — the feel test is presentation, not DUP_SIO count.

64. Catchup rem tip-cap + hc-fork persist not across episodes (2026-08-02)

§63 short soak: user saw two resims back-to-back and stopped.

hc-fork recovery begin t=1023 (post-FMV unlock, core diverge, no pad mispredict) → epoch 8 1008..1032 with catchup present=live rem=37.
Tip-hold @1032, coalesce tip-extend →1046, peer COMMIT @1032 → tip-extend ABANDON → realign 1032.
Immediate hc-fork recovery begin t=1033 (persisted 39 ticks) → epoch 16. Then ownership-chain skip-snap @1056 → baseline mismatch.

Confirmed in code:

psx_netplay_rb_confirmed_remaining returned frontier−sim, so tip SPAN episodes reported rem=37/47 whenever confirmed work ran past the tip — §63's rem≤24 hold-last never engaged.
np_try_hc_fork_recovery updated s_fork_first_sim / accumulated persist while the episode was still active, then the active guard only blocked the open. On tip-extend abandon → Live, persist was already satisfied → second recovery with zero Live gap.

Fixes:

Confirmed remaining capped by target−sim while an episode is active (catchup present keys off tip depth).
hc-fork recovery returns early on active/tip-hold/load before persist bookkeeping — persist only counts Live ticks.
psx_netplay_hc_fork_recovery_restart on tip-extend abandon (fresh first_sim + last_attempt) even though rewind cooldown clears.

Residual: post-FMV core fork itself and skip-snap baseline mismatch remain separate correctness tracks — this only stops the immediate double-resim feel and tip-episode live-present flash.

Re-soak watch: tip SPAN episodes should hold-last (catchup present=live only when tip rem>24, e.g. deep ownership catch-up); after tip-extend ABANDON expect hc-fork recovery restart then ≥16 Live ticks before another hc-fork recovery begin (not same-tick reopen).

65. Tip-hold SAFETY defer when peer wire past tip (2026-08-02)

§64 soak: protocol healthy (0 hc-fork begins, 0 WIRE_HOLE, clean exit, cores matched). Remaining quality hit: 4× tip-extend ABANDON on host.

Pattern (every case):

Both peers ownership-final → tip-hold at tip T.
Host coalesce tip-extends T→T+N and POSTs the extended tip.
Guest tip-hold SAFETY CAP 250 — commit through=T with remote_tip=T+7 (peer wire already past sealed tip) → OP_COMMIT at T.
Host tip-extend ABANDON — peer COMMIT … tick=T → realign.

Root cause: SAFETY defer only covered digital held. Race-ahead (remote_tip > tip+24) forces commit when the peer left TipHold entirely. A moderate ahead (remote_tip = tip+7) meant the initiator was still tip-extending — SAFETY should wait, not commit.

Fix: while remote_tip > tip and not yet race-margin, defer SAFETY / quiet / thrash / tip_hold_until commits (log SAFETY deferred (peer wire past tip) … wait tip-extend). Absolute / REMOTE-HELD / RACE walls still escape. Coalesce tip-extend FOLLOW then owns the edge.

Re-soak watch: far fewer tip-extend ABANDON; expect SAFETY deferred (peer wire past tip) then tip-extend FOLLOW / coalesce instead of guest SAFETY CAP while host extends. ABSOLUTE CAP with remote_tip > tip should stay rare.

66. TipHold tip-extend rereplay defer / coalesce batch (2026-08-02)

§65 soak: 0 tip-extend ABANDON; early-match feel still abrasive.

Confirmed (logs + code): fight-start ownership around sim 2449–2632:

ownership final → tip-hold at tip T.
Immediate tip-hold coalesce-ahead edge T+N.
TipHold need_rereplay because mismatch_tick > old_target (§17) → snap reload + short resim every 2–4 ticks.
Episode pin stuck at first load; FPS 54→10, admit 20–40 ms, replay 59–83%, then invent ahead → pcap FREEZE → deeper episode.

Root cause in psx_netplay_rb_tip_extend: TipHold always scheduled schedule_episode_rereplay on peek-ahead coalesce, defeating the MotK TipHold quiet window (docs: stay TipHold; rereplay only after Live invented past tip — and even then one batch, not per edge).

Fix: TipHold tip-extend (initiator + FOLLOW) raises tip + marks deferred rereplay (g_tip_hold_rereplay_pending / earliest g_tip_hold_rereplay_from); stays TipHold; does not snap immediately. Quiet / thrash / SAFETY / tip_hold_until / span-cap / seat-yield call tip_hold_try_finalize → one deferred rereplay flush then commit. Verify/Replay tip-extend still rereplays immediately. FMV TipHold commit drops pending without flush.

Re-soak watch: tip-extend rereplay DEFER / FOLLOW rereplay DEFER then a single tip-hold deferred rereplay flush from=… tip=…; far fewer tip-extend snap applied per fight-start burst; no 10 fps admit spike from per-edge rereplay cascade.

67. Yield must not flush deferred extension + audit digest cache (2026-08-02)

§66 soak: cascade fixed (DEFER→single flush works, 0 pcap FREEZE), but two new host failures, same root:

POST diverge epoch 16 @ tip 888 → realign 864 → hc-fork recovery.
tip-extend ABANDON epoch 24 (guest COMMIT 887 vs host POST 888).

Confirmed sequence (both): host tip-holds with a deferred extension (from=884→888 / 887→888). Guest sees a different-seat edge, yield-commits at the matched tip, opens a new epoch. The peer's new-epoch BEGIN hits the host's tip-hold yield FOLLOW new epoch path, which (§66) called tip_hold_try_finalize → flushed the rereplay instead of committing — kept the stale epoch alive → tie-break WIN … drop → host POSTs extended tip against a peer that already left → diverge/ABANDON.

Fixes:

finalize_tip_hold commit clamp: with a deferred extension pending, commit at the POST-matched from tip and drop the extension (log tip-hold commit clamp T→from). Never commit an unresimmed raised tip — that span still holds invent-predicted state.
Yield paths commit, don't flush: new-epoch FOLLOW yield and different-seat yield call finalize_tip_hold directly (clamped). The successor episode (load ≤ from) repairs the extension span. FMV TipHold commits also rely on the clamp (no silent pending drop). Wall paths (quiet/thrash/SAFETY/until/span-cap) keep flush-first tip_hold_try_finalize.
Resim audit digest cache (perf): log_resim_tick_audit computed a full core digest (2 MiB RAM CRC) twice per resim tick (arm+fin) — the admit=20–40 ms/f catchup hitch. arm(N) now reuses the cached fin(N−1) digest; invalidated on every snap apply / rereplay load.

Audit — remaining gaps (not fixed this pass):

schedule_episode_rereplay can reload a Live-saved snap above the agreed watermark (guest re-follow reloaded live snap 885 with invent state; matched by luck). Rereplay base should be ≤ last verified tip or a snap saved during this episode's resim.
POST-DIVERGE fc ring is mostly 00000000? inside episode spans (no FRAME_COMMIT cores during resim/tip-hold) — FIRST_MISMATCH cannot localize forks precisely when they matter most.
Per-tick host_save_state during resim (~0.2–0.6 ms each) is acceptable but stacks on deep spans; audit fin still pays one RAM CRC per tick.

Re-soak watch: on peer new-epoch BEGIN during deferred TipHold expect tip-hold commit clamp then a normal follow epoch=… (no tie-break WIN … drop of the peer BEGIN, no POST diverge at the extended tip); catchup windows should show admit well below 20 ms/f.

68. Tie-break YIELD after local snap apply (2026-08-02)

§67 soak hang: dual begin at tip 846 / mismatch 848 / load 836 —

Host slot0 → epoch 16, Guest slot1 → epoch 17.
Both snap-applied and waiting peer baseline.
Host: tie-break WIN … drop ×404 (never follows 17).
Guest: BEGIN stashed epoch=16 instead of YIELD — stay on 17 forever.
Both admit … stall=rb_baseline until disconnect (~16s).

Root cause: tie-break YIELD required handshake && !g_episode_snap_applied. After the local baseline snap load, the loser (higher initiator slot) fell through to stash while the winner kept dropping the competing BEGIN. Mutual baseline wait = hang.

Fix: YIELD for the full SealInputs / AwaitingBaseline handshake even when g_episode_snap_applied (log post-snap). Abort the local episode and fall through to follow the winner. WIN path unchanged; log rate-limited. Replay/Verify still refuse yield.

Re-soak watch: concurrent dual begin → loser logs tie-break YIELD … post-snap then follow epoch=<winner>; no multi-second stall=rb_baseline storm; WIN drops at most one line per epoch pair.

69. Stop double-fire tip-extend / RACE flush sandwich (2026-08-02)

§68 soak: no hang; resims felt like they double-fired.

Confirmed sandwich:

Ownership episode resim (e.g. 4400..4409).
ownership final → tip-hold → DEFER coalesce.
Guest RACE CAP flushed early at tip=4420 while host still deferred toward 4443 → guest mid-Replay then FOLLOW 4420→4443 rereplay=1 → second snap @4416.
Host flush then often ownership chain begin for leftover frontier (third hitch / skip-snap baseline fork).

Fixes:

Replay tip-extend = raise-only: initiator never sets need_rereplay in Replay; FOLLOW with REREPLAY while already Replay logs FOLLOW raise-only … no snap and only extends the tip.
RACE deferred while rereplay pending: do not flush on RACE until REMOTE-HELD/ABSOLUTE (log RACE deferred (rereplay pending)), giving peer tip-extends time to land so one flush covers the full coalesce.
Absorb confirmed frontier before flush: raise tip through confirmed_frontier (span-capped, SYNC if initiator) so the deferred rereplay spans the ownership-chain remainder in one pass.

Re-soak watch: at most one tip-extend snap applied per deferred flush; FOLLOW raise-only / RACE deferred (rereplay pending) / absorb frontier … before flush; far fewer back-to-back deferred rereplay flush → ownership chain begin pairs.

70. Race-pending wall + ownership skip-snap pin (2026-08-02)

§69 soak: flush:snap 1:1, 0 POST-DIVERGE / ABANDON / tie-break, but:

ABSOLUTE mega-flush: RACE deferred (rereplay pending) @~350ms waited until ABSOLUTE CAP 2000 → absorb frontier 2562→2607 (45-tick catchup, FPS ~11–13). Coalesce was stalled (coalesce_n=1); Live invent walked to sim=2610 while tip sat at 2562.
Ownership skip-snap baseline fork: both peers POSTed matching dig_m=9b2fd78e / core 342b04f6 at tip 2607, then ownership-chained. Guest wait-FOLLOW Live-invented past tip (pad edges @2610); skip-snap hashed drifted CPU (fc7641e6) while host still had POST state. Ring pin at 2607 was tip-hold invent (359bf24b on realign) — not the matched tip.

Fixes:

RB_MOTK_TIP_HOLD_RACE_PENDING_WALL_MS (400): RACE+deferred only waits this long, then RACE-flush (no ABSOLUTE park).
Absorb cap tip + RB_MAX_RESIM_SPAN (24): leftover frontier is ownership-chain after POST, not one mega rereplay.
pin_baseline_from_cpu(tip) in ownership_chain_next_span before session_reset — capture POST-matched state, refresh ring, drop invent snaps after tip. Keep pin (do not clear_baseline_pin).
Skip-snap restore: load pin (or refreshed ring), resync, set sim=tip+1, then baseline — never hash Live-drifted CPU after wait-FOLLOW.

Re-soak watch: RACE deferred logs cap 400 ms then RACE CAP (not ABSOLUTE CAP 2000 after a long park); absorb spans ≤24; ownership chain logs baseline pinned from CPU + skip-snap … pin restore; no baseline core mismatch at the flush tip after matching POST.

71. Post-FMV START NACK → promote-no-resim fork (2026-08-02)

Soak: Live digests matched through FMV (17/17 before sim=864). After settle @867 guest START↓ @880 → host begin epoch=8 load=880. Guest follow REFUSED … past frontier=843. Host NACK keep-live + cooldown promote-no-resim for START → cores diverge from sim=896 forever. Lockstep EXTEND streak=0 then MAX-release. Later hc-fork recovery bisect storm (1808→1792→1776→…) all die on baseline mismatch — felt like “resims during loading while hashes should match.” Hashes already forked.

Root:

choose_load / follow asymmetry: with agreed_valid, interval snaps above agreed_through were treated as mutual, so initiator opened load=880 while follow hard-NACKs load > frontier.
NACK keep-live when snap never applied but Live already past the refused load → invent/promote-no-resim forks the press.
hc-fork retried every 32 ticks into the bisect ladder.

Fixes:

choose_load: interval ticks above agreed_through require HC confirm or peer RESOLVED (same hard cap as follow).
NACK realign when live_sim > load even if snap was never applied (NACK realign (live past refused load)).
hc-fork backoff 256 ticks while baseline_fork_cap > 0.
Lockstep MAX unmatched: longer dense/promote_sweep window when RELEASE fires with streak below confirm.

Re-soak watch: post-FMV START opens load ≤ agreed/hc frontier (no past frontier=843 NACK on an interval tip); if NACK still happens with Live ahead, expect realign not keep-live; no rapid hc-fork recovery ladder of baseline mismatches during loading; live digs stay matched through title/menu when pads are idle.

72. Ownership skip-snap must defer resume (2026-08-02)

§70/§71 soak crash: guest (slot1) hard-exited right after ownership chain skip-snap:

skip-snap load=1976 pc=0x8006cda0 then replay … resume_pending=0 → execution completed, PC=0x00000000.
Host saw netplay_peer_disconnect mid-replay @1977.

Root: §70 pin-restore cleared g_pending_resume_valid. Normal snap apply arms resume-deferred + flush_resume longjmp into Replay; skip-snap replaced CPU state mid–wait-FOLLOW and continued the Live native stack, which returned PC=0.

Fix: after pin/ring restore, set g_pending_resume_pc / g_pending_resume_valid=1 (same as snap apply). flush_resume still waits for Replay phase.

Re-soak watch: ownership skip-snap logs resume deferred; next line in Replay is flush_resume pc=… (not execution completed); no peer disconnect at chain begin.

73. Ownership MIN_AHEAD tip-hold hang bisect (2026-08-02)

§72 soak felt “multiple hangs” near endgame (~tip 4146→4296) with matched digests (0 POST-DIVERGE / ABANDON / WIRE_HOLE / PC=0). Hitch was tip-hold park + deferred flush, not desync.

Code+log bisect (rb-diag1 host / rb-diag2 guest):

Gate	Observation
Entry	0 `ownership chain` lines all session; every POST → `ownership final … → tip-hold`
Ahead	Host endgame finals: ahead=5×8, ahead=4×1; guest: ahead=5×11. Never ahead≥9
Floor	`RB_OWNERSHIP_CHAIN_MIN_AHEAD=8` requires `frontier > tip+8` → tip+4/+5 always tip-hold
Counterfactual	`MIN_AHEAD=4` would chain 8/9 host and 11/11 guest endgame finals
Exit	Host: tip-hold → SAFETY → `REMOTE-HELD CAP 500` → absorb + `deferred rereplay flush` spans 4–21; guest often `ABSOLUTE CAP 2000` while `held_local=1`
Sticky held	`tip_hold_held_split` uses sealed tip buttons; §66 DEFER tip-extends onto press rows → `held_remote=1 pending=0` until wall

Causal chain for tip=4199: POST tip+4 → tip-hold → DEFER coalesce tip→4208 → REMOTE-HELD → absorb to 4216 → flush from=4199 (17 ticks) → POST → tip-hold again.

REMOTE-HELD/ABSOLUTE walls are working as designed after wrongly entering tip-hold on contiguous confirmed work. Shortening those walls without fixing entry would only trim parks; the structural bug is the §49 floor.

Fix: default RB_OWNERSHIP_CHAIN_MIN_AHEAD 8→4 so observed tip+5 frontiers Replay-own (skip-snap SPAN) instead of tip-hold. tip+4 still tip-holds. Env override unchanged. Do not patch REMOTE-HELD ms in this step.

Re-soak watch: endgame logs ownership chain tip=N frontier=N+5 (not ownership final → tip-hold on every POST); far fewer REMOTE-HELD CAP / deferred rereplay flush mega-spans; digests stay matched; no return of §49 frontier=N+1..N+3 epoch storms (raise floor via env if WAN regenerates them).

74. Chain-Replay hold-last hitch + stale-snap diagnostic (2026-08-02)

§73 soak: tip-hold loop gone (0 ownership final, 20 chains, 0 REMOTE-HELD storms), but the user still felt "stalls then skips ahead" during fight clusters. Bisect:

Hitch = blanket hold-last during chain Replay. Ownership chains fire every ~11–15 ticks in fights; each episode's target extends per wire arrival (ownership extend sim=N target T→T+1), so Replay treadmills at wire pace and confirmed_remaining stays ≤ 24 forever. In main.cpp, netplay_replay_catchup_should_live_present returns 0 for remaining ≤ 24 → hold-last for the whole episode → 135–212 ms frozen (present_gap max matches exactly), then the display snaps ~12 frames forward. replay% 33–76 during clusters; idle stretches clean 60 fps.
Endgame diverge @3167 = stale interval snap. Guest fin 3166 = 089b276e (== host arm 3167), then FOLLOW rereplay loaded snap tick=3166 → re-arm 3167 = f92756fb ≠ the state it just computed. The loaded snap forked the guest → POST diverge 497462cd vs 0cdb378f + host resim-diverge abort. Matches the open audit item (Live/invent snaps above watermark in schedule_episode_rereplay).

Fixes:

§74 display watermark (main.cpp): track the highest sim ever presented. During resim, frames above the watermark are new forward progress (treadmill chain) → present live every vblank; frames at/below keep §63 hold-last (edge-input re-show / DUP_SIO stays impossible). Watermark raised only on real presents; reset at netplay session start.
SNAP-STALE diagnostic (psx_netplay_rb.c, log-only): when a snap load targets the tick the audit-fin cache just recorded, compare the loaded state's core digest against the just-simulated digest; log rb SNAP-STALE tick=… snap_core=… fin_core=… on mismatch. This names the fork source at the moment it happens instead of 12 ticks later at POST. Fix for the snap-provenance bug itself is deferred until a soak captures SNAP-STALE with context (which snap-record path wrote it).

Re-soak watch: fight clusters keep present_gap max ≤ ~35 ms (no 135–212 ms holds); no DUP_SIO / re-shown menu edges after aborts (frames below watermark still held); any episode diverge is preceded by a SNAP-STALE line identifying the stale snap tick.

75. Tip-extend SNAP-STALE — keep-live + auth snap floor (2026-08-02)

§74 soak: SNAP-STALE fired and named the fork. Every mid-fight abort and the final DESYNC were preceded by tip-extend rereplay load=T where the ring snap at T ≠ the just-finished sealed fin core at T:

Guest SNAP-STALE	Follow-on
1953	host `ABORT resim core diverge sim=1954`
2034	host `ABORT … sim=2035`
4833 / 4843 / 4860	tip-hold flush → baseline `b1be9e12` vs `d72cde06` → DESYNC @4857

Seals matched; the ring held a Live/invent snap that tip-extend reloaded over correct sealed CPU state (or after Live re-poisoned a Replay slot).

Fixes:

g_auth_snap_through: raised when Replay successfully saves a snap (and on CPU pin). Live request_snap refuses tick ≤ auth so invent cannot overwrite sealed slots.
tip_extend_keep_live: if tip-extend rereplay asks for tick T and the live CPU still matches sealed fin at T (sim is T or T+1), refresh the ring from live and arm T+1 — log tip-extend KEEP-LIVE — never reload the ring.
SNAP-STALE fallback: if a tip-extend load still disagrees with fin, drop the poison slot and reload the episode pin (keep tip-extend arm); abort only when no fallback exists.

Re-soak watch: tip-extend KEEP-LIVE on FOLLOW extends; 0 SNAP-STALE (or only with immediate fallback load=); no resim-core ABORT / DESYNC from tip-extend poison; digests stay matched through fight clusters.

76. Verify raise-only + tip-hold entry pin (2026-08-02)

§75 soak: DESYNC gone, but stalls remained. KEEP-LIVE never fired (0). Every hitch was SNAP-STALE → fallback episode pin → 15–30 tick resim (fps 5–16, admit 40–160 ms). Root causes (not KEEP-LIVE):

Verify always need_rereplay=1 — tip-extend at the POST tip reloaded the prior tip (often invent-poisoned) instead of continuing into the new span. FOLLOW mirrored that. Replay already raise-only (§69); Verify did not.
Tip-hold flush reloaded a poison ring slot at from — tip-hold entry never froze the POST tip into pin/ring, so deferred flush fell through to SNAP-STALE → episode-pin fallback (deep hitch).

Fixes:

Verify tip-extend = raise-only (initiator + FOLLOW): leave Verify into Replay for old_tip+1..new_tip with no snap reload. Log Verify→Replay raise-only / FOLLOW Verify→Replay. Wire REREPLAY cleared for Verify/Replay FOLLOW.
pin_baseline_from_cpu(tip) on tip-hold entry — sealed POST tip into pin+ring+auth before Live invent walks.
Tip-hold flush prefers that pin when from == pin_tick; tip-extend apply loads pin buffer (not invent ring) for that tick. Resim span is the coalesce window only (~6–8 ticks), not episode-pin depth.

KEEP-LIVE remains as a belt-and-suspenders path; it is not the stall cure.

Re-soak watch: Verify→Replay raise-only / tip-hold flush load pin=; far fewer SNAP-STALE / fallback load=; tip-hold flush hitch ≤ coalesce span; fight clusters stay near 60 fps without pin-depth freezes.

77. Verify-time tip pin + SIO edge seed after snap (2026-08-02)

§76 soak: tip-hold flush used the pin (flush load pin= ×3) but every pin was still SNAP-STALE → episode-pin fallback → POST-DIVERGE. Cross↓ doublets without ↑ all sat on skip-snap / flush_resume (mushy P1 dash).

Bisect — pin≠fin:

audit fin sim=2257 dig=f4d9bd26
post sent / verify wait peer POST …
baseline pinned from CPU tick=2257   ← AFTER invent walk
tip-hold through=2257 invent_slack=2
… Live sim→2263 …
flush load pin=2257 → SNAP-STALE snap≠fin → fallback 2236

pin_baseline_from_cpu on tip-hold entry runs after Verify wait, when Live has already invented past the tip (sim=2258 on the next line). That overwrote the good finish_frame ring snap with invent state labeled as the tip. Flush then correctly detected pin≠audit-fin and fell back.

Bisect — Cross double↓: every host slot0 Cross↓ pair without ↑ had an ownership skip-snap / snap apply between them. psx_netplay_on_rb_snap_loaded reset edge trackers to 0xFFFF (all released); first republish of held Cross logged as a fresh press.

Fixes:

pin_baseline_from_cpu(done) at enter_verify_at_tip — freeze tip while CPU still matches sealed fin (before peer-POST wait / invent).
Tip-hold entry + ownership chain keep verify pin — do not re-pin from drifted Live CPU; log tip-hold keep verify pin / ownership chain keep verify pin.
Tip-extend load of verify pin: trust pin — no episode-pin SNAP-STALE fallback when the intentional sealed pin was the load source.
psx_netplay_on_rb_snap_loaded: seed sio/local/invent edge prev from sio_get_pad_buttons_slot (restored state), not 0xFFFF. Superseded by §79 for the local tip pipeline: prefer live/staged continuity + merge held bits into SIO (SIO-only seed still false-edged Start across skip-snap when snap SIO was idle).

Re-soak watch: baseline pinned / verify pin at POST tip before tip-hold through; tip-hold keep verify pin; flush pin without fallback load=; no Cross↓ doublet across skip-snap; tip-hold hitch ≈ coalesce span only.

78. Tip-hold flush = matched-prefix resim (no pin reload) (2026-08-02)

§77 soak: verify-time pin + keep-verify-pin landed, but the one trust verify pin flush forked immediately. Epoch 200: both peers fin-matched tip 3078 (7f4f24a4); host flushed load pin=3078 → SNAP-STALE snap=fd199e8c → trusted it; guest (§76 raise-only FOLLOW) never reloaded. Digests fork from 3082, POST diverge at 3093, then the recovery cascade (baseline mismatch → fork cap → NACK → 3 realigns, lead max 65, slack max 1.6 s).

Case law from three soaks:

Reloads are safe only when both peers load digest-identical state (episode baselines, ownership skip-snap — both verified).
One-sided reload forks: load(save(S)) re-derives device timing (cycles/IRQ/CD deadlines resync) ≠ live continuation of S. §76 made Verify/Replay FOLLOW raise-only, so every initiator-side flush reload is now asymmetric by construction.
The coalesce DEFER already names the first divergent row (mismatch=3084): Live's hold-last invent matched the seals for 3079..3083 — the host was still on the verified timeline through 3083 and never needed state at 3078.

Fixes:

g_tip_hold_rereplay_mismatch — earliest coalesce mismatch across deferred extends (initiator + FOLLOW mirror, min-tracked).
Flush resims from the matched prefix: schedule_episode_rereplay (first_bad) → walk-down lands on the §58 dense live snap at first_bad-1 (host's own live timeline == sealed timeline there). No pin reload, no asymmetric state acquisition. Log: flush from=… first_bad=… tip=….
Late-wire guard: before narrowing, verify every sealed remote row in (from, first_bad) equals the sealed row at from (hold-last assumption); lower first_bad on any difference/invalid row.
Trust-verify-pin reverted: SNAP-STALE on a tip-extend load always falls back to the peer-verified episode pin (logs src=pin|ring).
PIN-SKEW diag: pin_baseline_from_cpu digests the pin at save (canonical resume pc). PIN-SKEW when it differs from the audit fin at the same tick — separates pc-substitution digest drift from real load infidelity for the next soak.

Re-soak watch: flush logs first_bad ≈ coalesce edge; loads land at first_bad-1 (dense live snap), not the tip pin; no SNAP-STALE on flush loads; POST after flush matches (no epoch-200-style fork); PIN-SKEW presence/absence names the digest-delta layer.

79. TipHold dense snaps survive until flush (2026-08-02)

§78 soak: first_bad was correct (from=3216 first_bad=3224) but every flush still loaded the tip pin:

prefer=3223 → load=3216 (pin) → SNAP-STALE → fallback episode pin

KEEP-LIVE cannot help: at flush sim≈3232, audit stuck at tip, Live has walked past prefer — all three KEEP-LIVE gates fail (0 KEEP-LIVE in soak).

Cause: §58 dense tip window defaults to 8 ticks. TipHold Live invent/wire-walks 16–30 ticks before REMOTE-HELD flush; tip_dense_push evicts first_bad-1 before the flush can land there.

Fixes:

While TipHold: save every Live tick through the dense path (not only non-interval).
tip_dense_push TipHold retention: raise effective window to NP_DENSE_SNAP_MAX (24) and never drop snaps with tick > sealed tip (g_tip_hold_rereplay_from when deferred, else g_agreed_through). Matched-prefix candidates survive until flush.
Schedule log: has_prefer=0|1 so the next soak names landing.

Re-soak watch: rereplay load=N prefer=N has_prefer=1 with N=first_bad-1; no src=pin SNAP-STALE on tip-hold flush; resim span ≈ coalesce suffix only; no resim-core diverge from deep episode fallback.

80. Late-wire rereplay + tip-hold flush symmetry (2026-08-02)

§79 soak: dense prefer landing worked (load=4022 prefer=4022 has_prefer=1), then POST-DIVERGE / DESYNC.

Bisect:

Late wire below tip, raise-only ignore (root at 4012). Host began epoch 40 load=4000 target=4012, armed 4012 with s1=ffff, finished fin=fdd66fda. At sim=4013 wire arrived pub=ffff wire=fdff → tip_extend / ownership raise-only (§69/§76) — seals updated to fdff but CPU never resimmed 4012. Guest later full-followed target=4023 with sealed fdff → fin@4012=a7144f72. Matched tip 4014 was built on the wrong pad; tip-hold flush then amplified the fork.
Tip-hold flush local-only. Initiator flushed invent-snap rereplay; FOLLOW Verify/Replay forced need_rereplay=0 and logged FOLLOW raise-only / Verify→Replay (no snap). FIRST_MISMATCH@4023.

Fixes:

Replay/Verify tip-extend: need_rereplay=1 when the mismatch tick is already inside the simulated tip (mismatch < sim in Replay; mismatch <= old_target in Verify). Raise-only remains for pure tip raises past the tip. Reload prefer = mismatch (arm at the bad tick).
Same-target REREPLAY SYNC so FOLLOW hears late-wire repairs when the tip does not rise.
FOLLOW honors wire REREPLAY in Verify/Replay (and same-target tip-extend absorb). mismatch on the wire is prefer_plus for schedule_episode_rereplay.
Tip-hold park Live while deferred rereplay is pending (invent_slack=0 + admit stall tip_hold_deferred when sim > tip).
Tip-hold flush notifies FOLLOW with REREPLAY SYNC; when Live is still at the POST tip (parked=1) prefer_plus = from+1 (KEEP-LIVE), else matched-prefix first_bad as §78/§79.

Re-soak watch: tip-extend same-target rereplay / FOLLOW rereplay after wire rewind-request below tip; no arm with seals that later disagree with wire without a rereplay; tip-hold flush logs parked=1 and FOLLOW flush-rereplay / FOLLOW rereplay; no DESYNC after tip-hold coalesce.

81. Tip-hold hitch: DEFER-PEER flush + no double REREPLAY (2026-08-02)

§80 soak: correctness held (no DESYNC/POST-DIVERGE) but a visible hitch near the end: FPS 11.2, admit≈73 ms around sim 5012–5029.

Bisect:

ABSOLUTE 2000 ms wall. Tip-hold deferred at 5012, coalesce to 5023, SAFETY deferred on peer_past_tip while remote_tip=5029 (only +6 — never hit RACE_MARGIN 24). Sat until ABSOLUTE CAP, then absorb+flush.
Double FOLLOW rereplay. absorb_frontier sent REREPLAY with episode-original mismatch, then flush sent prefer_plus=first_bad — guest scheduled prefer 4990 then 5019 (mid-span snap thrash).
parked=0 always. §80 parked at raised tip, so Live walked with coalesce; flush invent-snap path every time.

Fixes:

DEFER-PEER: once g_tip_hold_rereplay_pending && peer_past_tip, only wait RACE_PENDING_WALL (400 ms) for more coalesce, then DEFER-PEER CAP flush — do not sit to ABSOLUTE 2000.
Absorb sends no SYNC — flush owns the single REREPLAY notify with correct prefer_plus / tip.
FOLLOW same-target REREPLAY SKIP when already tip-extend-repairing the same tip (both-peer CAP / residual dupes).
Park Live at from (psx_netplay_rb_tip_hold_rereplay_from), not the raised tip; flush treats tip audit as parked for KEEP-LIVE.

Re-soak watch: DEFER-PEER CAP 400 instead of ABSOLUTE CAP 2000 on deferred tip-holds with peer ahead; no back-to-back FOLLOW prefer_plus churn; flush parked=1 + KEEP-LIVE / prefer=from; no 11 fps admit cliffs from 2 s tip-hold walls.

79. Pad edge continuity across Replay/skip-snap (2026-08-02)

Invariant: Replay, skip-snap, and ownership transitions must preserve logical button state. They may never synthesize a fresh edge for a button that remained continuously held across the transition. Every tip/publish Start↓ should have a corresponding staged Start↓ (tip_without_stage is a contract break).

Soak (hold Start, no release → double pause): mid-Replay ownership continue skip-snap at sim 6082 between held samples. SDL and debounced Start stayed down (cap/deb=1), but §77 seeded edge prev from restored SIO (often idle under D / pre-press snap). Tip-produce then logged START↓ + tip_without_stage; stage/local logged a second START↓ at 6083 while the finger never moved.

§79 first fix (live-prefer): Continuity = live → staged → SIO; merge SIO; seed sticky/edges. Killed tip_without_stage. Residual: skip-snap with live=ff6f (SDL chatter hole) preferred raw live → cleared sticky → next SDL↓ was a fresh edge.

Fix (continuity, no debounce rewrite):

Sample = staged if valid, else live, else SIO.
Continuity = sample (no sticky rewrite).
Merge into local SIO: sio &= continuity (active-low).
Seed edge trackers from continuity; keep Start gesture "down" if held.

Instrument: skip-snap logs sdl= sample= seed= sio= merged=.

Re-soak: no tip_without_stage. Taunt double-pause is MotK game logic.

82. Tip-hold bare peer-ahead flush wall (2026-08-02)

Symptom: TipHold sat on ABSOLUTE 2000 ms when the remote was only a few ticks past tip (under RACE_MARGIN), hitching FPS.

Fix: bare peer_past_tip (no deferred rereplay) flushes after RACE_PENDING_WALL (400 ms) — PEER-AHEAD CAP. Far-ahead Absolute still clamps (DEFER-PEER / absurd lead).

83. Fork-cap realign + DESYNC streak + absurd invent catch-up (2026-08-02)

A: Raise g_bl_fork_cap before pick_realign_tip; never realign to a tip ≥ fork_cap; fallback snap below cap or keep-live; peer-abort honor clamps below fork_cap.

B: Fork DESYNC streak keys on fork_cap; peer-abort does not clear the streak while fork_cap is set.

C: np_sched_arm_absurd_invent_catchup() — brief invent through cushion rebuild when lead is absurd after a baseline-abort Live realign.

84. Post-FMV follow-NACK asymmetric realign (2026-08-03)

Symptom (Force TURN soak): live digs first diverge ~sim 768 after FMV exit; late "long rewind" at ~3056 is discovery of that early fork.

Bisect:

Post-FMV host begin load past guest frontier → follow REFUSED + NACK (frontier < load).
Host NACK path realigned Live locally but called abort_episode without staging g_abort_wire_realign_tick → OP_ABORT carried realign=0.
Guest never joined the refused epoch → idle ABORT only honored post-commit; honor_peer_abort_realign(0) no-op. Guest invents while host rewound → permanent fork. Cooldown also made late wire promote-no-resim.

Fixes:

NACK ABORT wire tip: stage RNET_RB_ABORT_CLASS_REALIGN + demote/realign tick before abort_episode (even on local keep-live so FOLLOW can converge).
Idle ABORT honor: always try honor_peer_abort_realign when the wire carries a tip (not only g_last_commit_epoch).
Live-ahead honor: if Live invent is past the wire tip and we never applied the episode snap, still schedule_live_realign (+ absurd catch-up when the gap is large).
Cooldown: NACK with a wire tip uses REALIGN class (0 ticks) instead of always arming RB_ABORT_COOLDOWN_TICKS promote-no-resim poison.

Re-soak watch: after follow REFUSED / NACK, both sides log mutual realign (NACK realign / peer abort realign live-ahead); no solo host rewind + guest invent; live digs stay matched past FMV; no early promote-no-resim reason=cooldown storm on the NACK window.

85. Ownership chain Replay treadmill (Force-TURN audio mute) (2026-08-03)

Symptom: Mid-match audio cut out (worse under OBS). Host/guest logs showed replay=80–100% for ~800 sim ticks with continuous ownership extend / ownership chain tip / tip-extend.

Bisect (rb-diag1/2):

Chain tips advanced +23 (one SPAN) every POST: 5799→5822→…→6580 (35 hops, 781 ticks). Frontier gap stayed tip+5..+8 the whole time (Force TURN D≈6–7 steady-state pipeline).
RB_OWNERSHIP_CHAIN_MIN_AHEAD=4 (§73) means frontier > tip+4 → always chain while the peer stays Live. §47 never "exhausts" confirmed work because the peer keeps confirming during our Replay.
Mid-episode ownership_step tip-extended at wire pace (§74 already named this) so each SPAN filled to 24 even when the begin target was only tip+6 — continuous resim → host audio pump skipped → silence.

Invariant refinement: Replay owns the contiguous confirmed backlog that existed at episode begin (frozen catch-up cap), for a bounded number of chain hops / tip advance. Wire that arrives during Replay is TipHold/Live's job after commit — not an unbounded Replay chase.

Fixes:

g_replay_catchup_cap: set to begin/follow target; ownership_step must not tip-extend past it.
Chain budget: default max 2 hops / 48 tip ticks from the first chain of a recovery (PSX_RB_CHAIN_MAX_HOPS / PSX_RB_CHAIN_MAX_TICKS). Over budget → ownership chain BUDGET … → tip-hold (both seats).
Clear budget on tip-hold / abort.

Re-soak watch: no 30+ hop chain runs; ownership chain BUDGET when the peer keeps confirming; ownership extend rare inside an episode; replay% spikes short (tens of ticks, not ~800); audio should survive OBS capture.

86. BUDGET→Live + min_ahead(D) + chain suppress (2026-08-03)

§85 soak: hop cap stopped the ~800-tick mute, but fights still hitch: BUDGET → tip-hold invent_slack → coalesce-ahead yield → guest begin → host tip-hold yield FOLLOW → short Replay → chain again (~every 12 tips).

Invariant: TipHold only when the next tick is unavailable. BUDGET with frontier > tip must not TipHold-park confirmed work.

Fixes:

A: ownership chain BUDGET → Live via immediate enter+finalize (no invent_slack park). Log: ownership Live … (chain budget) — no TipHold.
B: min_ahead = max(4, D) (env PSX_RB_CHAIN_MIN_AHEAD overrides). Force-TURN delay cushion is not catch-up backlog.
C: after BUDGET Live, suppress re-chain for +24 tips / 400 ms (PSX_RB_CHAIN_SUPPRESS_TICKS / _MS). Hits log ownership chain SUPPRESS … → Live for residual hitch diagnosis.

Re-soak watch: BUDGET → Live not → tip-hold; few/no tip-hold yield FOLLOW right after budget; SUPPRESS lines name leftover hitches; fight replay% short; digests matched.

87. Ownership tip-hold hang (zombie epoch follow) (2026-08-03)

§86 soak: with Force TURN D≈8–9, min_ahead=D made every POST frontier=tip+D land on tip-hold (never BUDGET/SUPPRESS/Live). Tip-hold invent_slack thrash returned, then both seats hung until lobby:

Guest tip-hold commit → begin epoch=17; host still tip-hold epoch=8, tip-extends then yield FOLLOW 17.
Guest tie-break YIELD 17→8 → follow epoch=8 load=1808 (already committed tip-hold epoch; load behind agreed tip=1852) → stuck rb_baseline.
Host aborts 17, Live invent ahead → pcap_freeze lead=-13 until peer disconnect.

Invariant: never reopen a committed tip-hold/ownership epoch; TipHold only when frontier <= tip (next tick unavailable). Delay cushion (tip < frontier <= tip+min_ahead) is Live, not invent park.

Fixes:

Zombie follow refuse: idle begin_follower rejects epoch == g_last_commit_epoch and load < g_agreed_through (log already committed (zombie epoch) / behind agreed tip).
ownership final: frontier > tip → Live (final confirmed ahead)
- suppress; tip-hold only when frontier <= tip.
B soften: min_ahead = max(4, D-1) so Force-TURN frontier≈tip+D still chains once instead of tip-hold every POST.

Re-soak watch: no follow of g_last_commit_epoch after tip-hold commit; ownership … → Live (confirmed ahead) when frontier>tip below chain threshold; min_ahead logs as D-1; no mutual rb_baseline / pcap_freeze hang.

88. Netplay CPU-authoritative VRAM + OpenGL present (2026-08-03)

Motivation: forcing a full software window when the user picked OpenGL was correct for determinism (FBO-auth + glReadPixels forked snaps) but a weak product compromise. Digests/snaps already CRC CPU VRAM; the missing piece was keeping GL for display without making the FBO guest authority.

Design (Option A):

Sim: gr_set_backend(SOFTWARE) under netplay — all GP0 draws / fills / copies / GPUREAD hit CPU VRAM (same as today’s forced-SW path).
Present: if an OpenGL context exists, leave it up with g_gl_fbo_present=0 so Live frames CPU-scanout → gl_renderer_present (same path as 24-bit FMV / PSX_GL_FORCE_CPU_PRESENT).
Never glReadPixels while psx_netplay_active() (ensure_cpu early-out).
Vulkan: still software window until the same present-only path exists.
Call psx_frontend_netplay_force_sw_gpu() before g_np.active=1 so a one-shot FBO→CPU sync can still run if a session started on FBO-auth GL.

Logs to expect:

netplay — OpenGL present + software raster (CPU-authoritative VRAM; no FBO readback)
netplay CPU-authoritative VRAM + OpenGL present (no FBO readback)
Not: netplay forced software GPU (GL/VK VRAM readback forks peers) with GL torn down.

Re-soak watch: OpenGL selected in launcher → GL window under netplay; matched av= / pin zlib across peers; no black first match; rematch keeps GL present after lobby soft-return.

89. Netplay sim scale 1 — decouple SSAA from CPU-auth (2026-08-03)

Motivation: hybrid CPU-auth + GL present still paid full SW supersampling cost when settings said 4× (gr_set_scale(4) + gr_render_display_hires). That is fill-rate CPU work, not GPU SSAA — mid-fight ~guest 20ms even with replay≈0%.

Design:

Layer	Netplay CPU-auth	Offline
Sim / snaps / `av=`	`gr_set_scale(1)` always	`g_video_scale` SSAA
Present	native scanout → GL/SDL upscale + filter	hires mirror when scale>1
Settings	`g_video_scale` kept; not synced from `gr_scale()`	unchanged

s_netplay_sim_native_scale + netplay_cpu_auth_gpu() gate present/tex sizing.
psx_frontend_netplay_force_sw_gpu / netplay startup force scale 1.
Launcher supersampling label notes "offline"; tooltip explains netplay 1× sim.
True ordered-grid SSAA remains offline-only (would need SW×N or FBO-auth).

Logs to expect:

netplay sim supersampling clamped to 1x (settings Nx kept for offline)
… (no FBO readback; sim scale 1) / … (CPU-authoritative VRAM; sim scale 1)

90. OpenGL hold-last drawable V-flip (2026-08-03)

Symptom: first hold-last frame during Replay (menu resim) upside-down; next live CPU→GL present corrects orientation.

Cause: hold_capture_drawable copies the already-presented backbuffer (screen-oriented). gl_renderer_present_hold_last redrew it through present_target_quad / PRESENT_VS, which always V-flips for PSX CPU/FBO bands → double flip.

Fix: present_target_quad(..., v_flip). HOLD_DRAWABLE passes v_flip=0 (swap UV v ends so the shader flip cancels). HOLD_NATIVE / VRAM / wide keep v_flip=1.

91. Tip-extend vs peer ownership Live → verify / pcap hang (2026-08-03)

Soak: mid-match ownership POST @T; guest ownership Live tip=T (frontier in delay cushion) while host TipHold tip-extends T→T+N, then verify wait peer POST @T+N → timeout; guest invents into pcap_freeze; later baseline ext (SPU/aux) abort cascade.

Root: ownership_on_post_match is local (frontier / min_ahead / hops). Peer Live emits OP_COMMIT @T; host abandon only ran in Verify and required an exact snap at g_tip_extend_from_tick — SNAP-STALE often drops that pin — so COMMIT was ignored and host sat 4s in verify.

Fix (maybe_abandon_tip_extend + tip-extend refuse):

Honor peer COMMIT in TipHold / Replay / Verify (TipHold → finalize clamp; Verify/Replay → abort+realign).
If exact snap missing, walk to nearest ring snap ≤ commit (or pin).
Refuse further tip_extend when peer already COMMIT'd this epoch at tick ≤ sealed tip; poll TipHold calls abandon before coalesce walls.

Re-soak watch: tip-extend ABANDON (TipHold) / tip-extend REFUSED … peer COMMIT instead of verify timeout + peer pcap_freeze; no dual lead=±12 park after ownership Live on one seat.

92. Dual-raster OpenGL present quality (2026-08-03)

Motivation: §88/§89 kept OpenGL for present but uploaded 1× CPU scanout and stretched — settings 4× SSAA never reached the hr FBO under netplay (GL GPU pipeline ready (internal scale 1x) while settings said 4×).

Design (dual raster):

GP0 → Software @ 1× → CPU VRAM → snaps / av= / GPUREAD (authority)
   └→ OpenGL @ N×   → hr FBO   → present_vram (cosmetics only)
         never glReadPixels / ensure_cpu under dual or netplay

Layer	Dual-raster (OpenGL)	SW-only netplay
Authority	SW writes every GP0 @ 1×	SW backend @ 1×
Present	`g_gl_fbo_present=1` @ `g_video_scale`	CPU scanout → SDL/GL upload
Snap load	`restage_vram` + `invalidate_present`	N/A (no FBO)
Digests	CRC CPU VRAM only	same

gl_renderer_set_cpu_auth_dual(1) — glb_draw_* / fill / copy write SW then GPU; s_gpu_dirty stays clear; ensure_cpu never readbacks.
glb_set_scale(N) already keeps sw_renderer_set_scale(1).
Depth24 / FMV still CPU present (gl_renderer_present).
Soft-return clears dual flag.

Logs to expect:

netplay — dual-raster (SW@1x CPU-auth + OpenGL present quality; …)
netplay GL present supersampling Nx (SW authority stays 1x)
GL GPU pipeline ready (dual-raster, internal scale Nx, …)
netplay dual-raster (SW@1x CPU-auth + OpenGL@Nx present; …) from force_sw_gpu

Re-soak watch: matched av= across peers; visible 4× GL quality in match; no black first present after tip load; rematch keeps dual after lobby soft-return.

93. FMV stability gates — refuse media episodes / resim storm / MAX DESYNC (2026-08-05)

Soak (rb-diag1/2 session 8): post-FMV resim from matched baseline 39655d1b diverged at sim 184 (~459 cycles) twice with identical abort digests; match-start episode load=736 died on baseline mdec/cd mismatch; FMV lockstep RELEASE with streak=0 / MAX unmatched then soft-desynced the rest of the fight. Broken main-menu assets after were consistent with mid-FMV VRAM realign churn.

FMV savestate completeness is not the bug — cross-peer determinism / policy is.

Fixes (§93 stability P0):

Media-range episode refuse: track g_fmv_media_lo/hi through each FMV bout. Begin/follow refuse when mismatch or chosen load sits in [lo, hi+SETTLE] (or DESYNC hold), even if Live tip already left media. psx_netplay_rb_fmv_episode_unsafe + hc-fork skip. Snap apply that lands mid-media aborts before Replay (episode load into FMV media) and raises fork_cap. No LIGHT_TIP into media-range loads.
Resim-diverge storm: second resim core diverge on the same sim → DESYNC keep-live + storm cooldown; no same-pin realign. First hit still raises fork_cap so the doomed load is not reused.
MAX unmatched RELEASE: if lockstep hits MAX with streak < CONFIRM, arm g_fmv_unmatched_desync + storm cooldown — invent/begin stay held until cores rematch CONFIRM ticks, invent-hold expires (~600 ticks / §94), netplay SAVE completes (§94), or session reset. Log rb DESYNC — FMV lockstep MAX unmatched.

Re-soak watch:

No begin epoch=… / follow into FMV media or settle; expect begin REFUSED … FMV media-range / episode load into FMV media.
No second ABORT — resim core diverge on the same sim; expect DESYNC — resim diverge storm instead of same-pin realign loop.
Post-FMV: either RELEASE … cores matched or DESYNC — MAX unmatched with invent held — never streak=0 + keep inventing through a fork.
Idle digs: core/cd match through title → vs → match start.
Menu after disconnect stays clean (no mid-FMV realign poison).

Still open (P1/P2): mid-session host state-transfer on storm; CD/MDEC cycle determinism for matched-baseline sim 184.

94. Netplay SAVE under FMV DESYNC invent-hold — tip-hole deadlock (2026-08-05)

Soak (rb-diag1): after FMV DESYNC — MAX unmatched at sim=1044 (streak=0, never rematched), fight ran wire-only (~60 fps, lead≈-1). Host Shift+F2 SAVE at sim=2598 completed (hashes match, skip transfer), then admit froze at sim=2608 stall=fmv_settle lead=-1 for 20s → admit stall timeout → lobby. Guest tip stuck at 2607. Save itself was fine; resume needed gap1 invent and could not get it.

Cause: g_fmv_unmatched_desync keeps lockstep_no_invent true forever when soft-fork digests never hit CONFIRM. Scheduler mis-tagged that stall as fmv_settle (media inactive). SAVE coord freezes both peers → tip hole → neither invents → mutual wait → watchdog.

Fixes (§94):

Stall tag: fmv_desync_hold when DESYNC invent-hold is the gate (psx_netplay_rb_fmv_desync_hold); keep fmv_media / fmv_settle.
Invent-hold expire: RB_FMV_DESYNC_INVENT_EXPIRE (600 ticks) after arm — clear invent-hold if rematch never comes. Log FMV DESYNC invent-hold cleared (invent-hold expired…).
Save complete clear: host/guest after SAVE hash-match or transfer done call psx_netplay_rb_clear_fmv_desync_hold("netplay save complete") so tip invent can refill immediately.

Re-soak watch: SAVE mid-fight after post-FMV DESYNC does not stall-timeout; expect invent-hold cleared (expire or save) and gap1 invent resumes. Stall lines should say fmv_desync_hold not fmv_settle while the hold is live.

95. Netplay LOAD — host hung `wait_confirm`, guest-only apply (2026-08-05)

Soak (rb-diag1/2 session 19): SAVE transfer OK. Host Shift+F1 LOAD hash-match → guest LOADED + waiting for host; host stuck load_applying+wait_confirm ~14s (never LOADED) → peer disconnect / desync (guest on .pst, host still live timeline).

Cause: LOAD_APPLYING used delay-sync rnet_session_try_admit (INPUT_CONFIRM). Rollback live does not confirm. Faster peer applies → LOAD_READY freezes admit → slower peer never gets confirm for the next tick → savestate_poll never runs.

Fixes (§95):

Rollback load-barrier admit: while LOAD_APPLYING + savestate_pending (and when exiting LOAD_READY after mutual sync), use tip + hold-last invent with no confirm (np_try_admit_load_barrier_rb). Always invent missing remotes — peer may already be frozen in LOAD_READY.
Clear DESYNC invent-hold at np_commit_load_sync (hard resync).

Re-soak watch: both peers log LOADED / applied, waiting… then peer ready, resuming lockstep. No host-only load_applying+wait_confirm stall after hash-match apply.

96. FMV snap cost — dirty VRAM mirror + media interval (2026-08-05)

Goal: keep invent/episode policy for FMV media (§50/§93) but make the rollback snap machinery cheaper while the movie runs.

What landed:

Per-scanline VRAM dirty tracking (gpu_vram_dirty.*) on every CPU-VRAM write path (gpu.c A0/raster + sw fill/copy/put/transfer). Gated: gpu_vram_dirty_set_tracking(1) only in psx_netplay_rb_start; off in shutdown. Offline / delay-sync: g_psx_vram_dirty_tracking==0 so mark_row is an inlined no-op (zero gameplay impact).
Incremental raw snap VRAM (boot_state_save_buffer_raw + tracking on): persistent 1 MiB mirror; only dirty scanlines are copied from live VRAM before emitting a still-complete BS_SEC_VRAM (loads stay independent / no delta chain). Offline raw/zlib saves keep full gr_vram_transfer_out.
FMV media snap interval (default 4, PSX_NET_FMV_SNAP_INTERVAL): during media, live snaps every N ticks. Settle + post-FMV lockstep remain every-tick dense (cutover near-tip load). Episodes into media still refused.
Telemetry: rb snap tele every 64 saves — last/avg ms, dirty_rows, incr%%. Bring-up verify: PSX_NET_VRAM_DIRTY_VERIFY=1 memcmp vs full transfer_out.

Not changed (still accept): no invent through media; SW@1× CPU-auth VRAM; soft-fork / DESYNC invent-hold after unmatched FMV.

Re-soak watch: during FMV media, rb snap tele shows incr=1 with dirty_rows ≪ 512 (typical depth24 band), lower avg ms than pre-change, and media snap cadence ~interval 4. Settle/lockstep still dense. Optional verify run once with PSX_NET_VRAM_DIRTY_VERIFY=1 (no VERIFY FAIL lines).

97. FMV media keyframe episodes — invent into media (2026-08-05)

Goal: abandon blanket “no invent / no episode into FMV media” (§93) by healing stream soft-forks the same way SAVE/LOAD heals state: host seals a raw snap keyframe at load_tick before Replay.

Default ON (PSX_NET_FMV_MEDIA_KF=0 restores §93 refuse + invent-off).

What landed:

Invent during live media when MEDIA_KF on (settle + DESYNC hold still block invent). Media snap interval defaults to 1 (every tick) so load_tick hits a ring snap.
Begin/follow into media-range allowed when a snap exists (initiator) or peer flags RNET_RB_SYNC_FLAG_MEDIA_KF (follower may lack the snap).
Host keyframe transfer (RNET_STATE_OP_RB_KF): probe CRC of raw snap → skip xfer on match; else chunked transfer. Both peers install into pin+ring (rb MEDIA-KF …). No LIGHT_TIP into media KF episodes.
Apply waits for g_media_kf_ready; prefers pin; skips episode load into FMV media abort for KF episodes.
Restore epilogue unchanged (cdrom_resync_*, depth24 cutover, XA FIFO).

Re-soak watch:

Mid-FMV: invent can fire; logs rb begin … media_kf=1 / MEDIA-KF probe / hash match or transfer start / installed.
No resim-diverge storm on first media episode; baseline digests match after KF.
PSX_NET_FMV_MEDIA_KF=0 restores prior refuse / invent-off behavior.

98. FMV admit/FPS — freeze D + timesync during media (2026-08-05)

Diag (post-§97): snaps were already cheap (rb snap tele avg≈0.7 ms, incr=1, dirty_rows≈128) but FMV sat ~43–55 fps. Ceiling was guest≈13–16 ms/f + admit≈4–8 ms/f (timesync debt + D ratcheted to 6–7 under invent-through-media). present_gap_p95≈80–100 ms was mostly the hardcoded present-1/4 skip (~67 ms+ between Swaps), not snap cost.

What landed:

No timesync debt during FMV media — np_timesync_note_late skips; np_timesync_throttle clears debt and never stalls admit while media.
Freeze adaptive D during media — both np_adapt_delay_on_pcap_enter and np_auto_delay_tick no-op while psx_netplay_rb_fmv_media_active().
No LAN gap1 micro-grace during media — invent immediately when the MEDIA_KF path allows invent (avoid admit wait for a peer that is also inventing through the movie).
Media snap interval default 2 with MEDIA_KF (was 1). Near-tip loads still work; halves snap tax vs every-tick. Override PSX_NET_FMV_SNAP_INTERVAL.
Present every 2nd depth24 vblank during hot MDEC (was every 4th). Override PSX_NET_FMV_PRESENT_DIV (1=every frame, 4=legacy).

Re-soak watch: during FMV media, admit= near ~0–2 ms/f (not 5–11), D stable (no mid-movie 6→7), present_gap_p95 roughly half of §97, rb snap tele cadence ~interval 2, sim FPS closer to guest ceiling.

101. Zombie-load follow NACK (session-136 seal hang) (2026-08-06)

Symptoms (session 136 soak): guest begin epoch=33 load=3184 while host already had agreed tip=3200 → host follow REFUSED … zombie load ×100 with no NACK → guest sat in SealInputs until RB_SEAL_TIMEOUT_MS (4s) → episode ABORT → hc-fork + ownership cascade; host FPS cliff 0.8 / admit≈1241 ms, present_gap max ~3–4 s.

Root cause: §87 zombie-load / zombie-epoch refuse returned silently. Other refuse paths (past frontier, missing snap, FMV) already armed follow NACK.

What landed:

NACK on zombie load / zombie epoch — follow_refuse_nack arms the same follow-NACK (frontier = follower_frontier_hint / agreed tip) so the initiator aborts Seal in ~1 RTT instead of 4s.
Rate-limited refuse log — one line per (epoch, load), then +N similar every 32; one NACK arm per unique refuse.
NACK peer-ahead fast path — when NACK frontier >= load, set g_peer_nack_floor, apply_peer_resolved(frontier), abort Seal, and keep-live when the snap was never applied (no demote-to-load-1 rewind of good Live).
Begin raise — after choose_load, if peer_resolved > load, raise to a mutual snap ≤ peer tip so we do not reopen a zombie load.

Re-soak watch: no seal timeout (peer missing snap / NACK lost) after zombie refuse; expect follow NACK … frontier= then NACK keep-live peer-ahead / begin raise load within tens of ms, not a multi-second present hitch.

102. Peer-ahead NACK → one light tip (no ownership cascade) (2026-08-06)

Symptoms (session 140 after §101): zombie refuse NACKed cleanly, but host still opened hc-fork → begin load=6640 target=6660 → ownership hops 32/40 → host 22 fps / replay 96% / present_gap max ~531 ms.

Root cause: keep-live left hc-fork recovery to open a deep SPAN; Replay ownership then chained to drain confirmed backlog.

What landed:

Drain RESOLVED before choose_load — avoid opening a zombie load when the peer tip is already queued on the socket.
psx_netplay_hc_fork_recovery_clear — peer-ahead NACK drops pending hc-fork bookkeeping so it cannot open a SPAN recovery.
Immediate light tip reopen — raise agreed to peer tip, arm g_peer_ahead_force_load, begin with target capped to load+4, force light-tip class.
No ownership chain — ownership_on_post_match exits that episode to Live (peer-ahead light → Live) instead of SPAN hops.

Re-soak watch: after zombie NACK expect peer-ahead light reopen / begin … light=1 / peer-ahead light → Live with no ownership chain tip= hops and no hc-fork recovery begin on that edge. Hitch should be a short light replay (depth ≤4), not a 96% window.

103. Past-frontier NACK deep demote → MEDIA-KF hang (2026-08-06)

Symptoms (session 142): post-FMV host begin epoch=16 load=816 light=1 media_kf=0; guest follow REFUSED … past frontier=763 + NACK; host NACK realign … demote=763 live_was=827 (dropped 63 snaps) → FIRST CORE DIVERGE @764 → begin … load=752 media_kf=1 (~3.7 MB transfer, stall=rb_baseline) → after KF tip=776 ownership hop begin REFUSED … FMV lockstep → tip-hold; host present_gap max ~3531 ms / ~15 fps, guest ~7.4 fps.

Root cause: past-frontier NACK treated a stale follower frontier like a shared rewind tip. Live demote across the FMV bout forked cores and forced a deep MEDIA-KF; re-armed settle then blocked the ownership catch-up hop.

What landed:

Deep keep-live — when snap was never applied and live − demote > RB_NACK_DEEP_REALIGN_MAX (8): no Live realign; soft-demote agreed to load-1 only; clamp peer_resolved to the follower frontier.
Sticky peer gate — g_past_frontier_sticky prevents GATE_MS force-open from reopening above that frontier until the follower advertises RESOLVED.
Ownership through settle — begin allows g_ownership_chain (and active MEDIA_KF) through FMV lockstep so post-KF SPAN catch-up is not tip-held.

Re-soak watch: after follow REFUSED … past frontier expect NACK keep-live deep frontier=… (not NACK realign … demote= far below live); no immediate MEDIA-KF transfer / stall=rb_baseline from that edge; if a MEDIA-KF still completes, ownership should log ownership chain tip= hops rather than ownership chain FAILED … tip-hold.

104. Fight ownership tax + guest invent (session 144) (2026-08-06)

Symptoms (session 144 after §103): no MEDIA-KF / deep demote / seal hang. Median 60 fps. Remaining cost was fight-phase: many short ownership final/BUDGET hops → replay windows 12–79% / present_gap max ~430 ms; guest invent ~5× host (GAP1_LEGACY case_b + RUNWAY_EMPTY); auto-delay 5→4 mid-fight; one ~3.1 s FMV present cliff (unchanged — not present_div).

What landed:

Ownership floor tip+6 — RB_OWNERSHIP_CHAIN_MIN_AHEAD 4→6 so tip+4/+5 delay cushion exits Live instead of SPAN. Suppress after budget 24→48 ticks / 400→800 ms.
Gap1 micro-grace for relay-LAN — RB_GAP1_LAN_RTT_MAX_MS 12→48 so force_input_relay RTT≈21–45 ms arms grace; cap 6→12 ms. Healthy-lead case_b also waits (not invent-now on tip cadence blips).
Runway grace — RB_INVENT_RUNWAY_GRACE_CAP_MS 8→12.
Auto-delay lower floor — never shrink below D=5 mid-match (RB_AUTO_DELAY_LOWER_FLOOR); tighter lower bar (miss<1‰ + lead≥3). Force-TURN floor 6 unchanged.
PIN-SKEW log rate-limit — one line per tick (cosmetic; no control change).

Left alone: FMV PSX_NET_FMV_PRESENT_DIV default 2 (3.1 s cliff is a single media stall, not 1/N cadence); HC-silent promote stay fail-closed on digest proof; §101–103 NACK paths untouched.

Re-soak watch: fewer ownership chain tip= / BUDGET lines during fight; guest admit stats invent_gap1 closer to host; gap1_grace counts rise; no delay committed 5 → 4; replay% spikes under button traffic smaller (aim <30% windows, present_gap max <200 ms outside FMV).

105. Invent≠delay raise + gap1 wait for tip invent (session 149) (2026-08-06)

Symptoms (session 149 after §104): felt regressive. Ownership begins dropped (good), but host invent exploded (invent_gap1=2285, all remote_lead=-1 / case_b), gap1_grace=0 (healthy-lead arm dead), lobby D=4 then auto-delay 4→5→6→7 on invent-as-miss (miss=993‰, late_n≈1, lead_avg≈-2). Ended in FMV DESYNC MAX unmatched.

Root cause: tip invent counted as auto-delay arrival miss → raising D added lag without stopping invent. §104 grace required lead≥D-1, which never holds on the invent path (lead=-1).

What landed:

Undo invent miss — invent clears the auto-delay miss sample (np_auto_delay_undo_invent_miss); scorecard miss-at-need still counts.
Raise needs lateness — auto-delay bump only when late_n>0 (waited-out arrival), not invent-only miss storms.
Gap1 grace for tip invent — on gap=1, if RTT≤48 ms or tip-due, always wait min(½RTT+base, 12ms) (no healthy-lead gate).
Session D floor 5 — rollback clamps lobby seed <5 → 5 at rnet_session_create and in np_sched_sync_delay_from_session.

Kept from §104: ownership min_ahead=6 / suppress 48/800; runway grace 12; PIN-SKEW rate-limit; auto-delay lower floor 5.

Re-soak watch: start log session delay floor … → 5 if lobby was 4; gap1_grace > 0 in admit stats; no auto delay 5 → 6/7 driven by miss≈1000‰ with late_n=0/1 and lead_avg<0; invent counts lower; D stable near 5–6 unless real lateness / pcap.

106. No-ICE MotK → SFU dial / clear ice_p2p refuse (session 151) (2026-08-06)

Symptoms (session 151): host (dist/motk, ICE build) started SFU (force_input_relay=1, peer 192.168.66.3:8777). Guest Desktop pack failed start -4 with hosted lobby requires ICE, but ICE is not available in this build while peer was already netplay…:8777 — SFU endpoint present, force_input_relay not applied / ICE required anyway.

Root cause: no-ICE guest + MotK room treated as hard ICE requirement even when a usable SFU peer (or equal host/guest relay advertise) was available. ice_p2p launch on no-ICE builds fell through to the same opaque -4.

What landed:

resolve_use_ice no-ICE — MotK + non-empty peer_hostport → LAN/SFU dial (log note); MotK/transport=1 with empty peer → clearer SFU/ICE error.
Launch ice_p2p without ICE — refuse with last_error=ice_required (do not leave launch_pending for a doomed start).
ae_np_fill_launch — infer force_input_relay=1 when host_endpoint==guest_endpoint (SFU advertise) even if caps bit omitted.

Re-soak watch: no-ICE guest on SFU MotK logs server input relay or no-ICE build — MotK room dialing peer … as LAN/SFU and connects; ice_p2p without ICE shows ice_required in lobby UI, not start -4; both sides share SFU when server picked transport=sfu.

107. Gap1 micro-grace on SFU/relay RTT (post-§105 soak) (2026-08-06)

Symptoms (post-§105 soak, ~18k ticks, SFU force_input_relay=1): resim health good (mispredict host 8 / guest 17, freeze=0, MEDIA-KF sealed, D ends 7 and moves on real late_n). Remaining cost: host tip invent storms in fight windows (GAP1_LEGACY ~550–600 at remote_lead=-1 while guest ~~0–5); 1277/1305 host invents had rtt>48. One auto-delay window miss=926‰ with lead_avg≈-0.9 at rtt~~75 (tip-park tax).

Root cause: §105 gap1 micro-grace only armed when rtt_raw≤48 (LAN gate) or tip-due. SFU/relay POST-RTT sat ~75–125 → lan=false → gap1_cap=0 → invent every gap=1 tick. §105 correctly stopped invent-as-miss from ratcheting D; it did not stop the invents.

What landed:

Always grace on gap=1 (non-FMV) — min(½RTT+base, cap) for tip invent.
Split caps — LAN / tip-due keep cap 12 ms; relay (rtt>48 and not tip-due) cap 20 ms so SFU gets a real wait without parking a full frame on a due tip.
FMV unchanged — §98 invent-immediate during media.

Re-soak watch: host invents/1k drop hard in fight windows (aim ≪70); gap1_grace rises vs invent_gap1; guest invent stays low; D still only raises on real lateness (late_n>0); no feel of extra stall on LAN (rtt≤48 path unchanged at cap 12).

108. Always SFU for online MotK/BPE lobbies (2026-08-06)

Problem: Online connectivity layered lobby SFU + waiting-room ICE path_report → optional ice_p2p + Coturn/Force TURN. Host/guest could disagree (session 151 no-ICE guest, stale caps bits, Force TURN meaning ICE-relay vs SFU). Too many signals for CGNAT reachability SFU already covers.

What landed:

Server — start_use_sfu always returns SFU (reason=always_sfu). No ice_p2p selection from path reports / caps.
Client resolve_use_ice — MotK room / force_input_relay → LAN dial to peer/SFU; match ICE not used online.
Launch — legacy transport=ice_p2p refused (sfu_required); path_report kept as telemetry only.
Force TURN — delay-floor hint only; does not change transport.
LAN/direct — unchanged (local UDP / host hub; no MotK SFU).

Re-soak watch: start logs use_sfu=true reason=always_sfu; both peers server input relay — LAN transport to …; no ice_p2p / ice_required on online MotK; no-ICE Desktop guests connect; Force TURN only affects D floor.

109. Post-FMV silent hc-fork → apply-only MEDIA_KF heal (2026-08-13)

Soak (TM4 Win↔CachyOS 2P session 26): digs matched through sim 2368 after FMV settle; FIRST CORE DIVERGE @2380 with no pad mispredict; host opened begin … load=2368 media_kf=0; both ABORT — resim core diverge @2380; then DESYNC — FMV lockstep MAX unmatched. Transport/admit stayed up — tip-snap SPAN cannot heal undigested / cross-OS forks once sealed Replay re-diverges.

Root cause: §54 hc-fork after settle used mutual tip snaps without a host keyframe. §26 unlocks invent/hc-fork after settle (24) while dense lockstep CONFIRM still runs to MIN=180 — so the doomed SPAN fires inside the confirm window. media_kf=0 because load was past the media/settle unsafe range.

What landed (§109):

psx_netplay_rb_request_post_fmv_heal_kf — hc-fork (and first post-FMV resim-diverge escalate) request an apply-only heal on the next begin.
Begin — when requested: arm MEDIA_KF, CAP target→load (no Replay span), wire RNET_RB_SYNC_FLAG_MEDIA_KF. Host transfers raw snap; both install pin and Verify at load.
choose_load / follow — treat post-FMV lockstep + DESYNC hold like media-range for MEDIA_KF mutual snaps / missing-snap OK.
hc-fork gate — allow through DESYNC invent-hold when MEDIA_KF can heal; still block live media + settle.
On heal Live/tip-hold — clear DESYNC invent-hold and RELEASE lockstep.
Pad-mispredict begins in the post-FMV window still SPAN (optionally with MEDIA_KF via rb_want_heal_kf); only silent-fork recovery is apply-only.
POST match → Live — ownership_on_post_match treats heal like peer-ahead light: no ownership SPAN hop (session 28: matched POST @826 then chain target=850 hung guest wait-FOLLOW → disconnect).

Re-soak watch (Win↔Linux 2P through title FMV):

After settle expect post-FMV heal KF requested then begin … media_kf=1 heal=1 / post-FMV heal KF CAP target …→load.
MEDIA-KF probe / hash match or transfer; post sent tip=<load>; FMV lockstep RELEASE (post-FMV heal KF …).
No ABORT — resim core diverge on that heal episode; no DESYNC — FMV lockstep MAX unmatched from the same cutover.
Linux↔Linux control still clean; 3P WIRE_HOLE is a separate bug class.

110. Post-FMV heal sticky + invent hold (session 3 loading hitch) (2026-08-13)

Soak (TM4 Win↔CachyOS session 3): §109 heal POST matched @2494 → Live → FMV lockstep RELEASE. Loading-screen hitch kept HC forked at 2495; absurd lead + invent catch-up; second hc-fork with heal=0 tip-SPAN → resim core diverge @2495 → storm DESYNC.

Cause: request_post_fmv_heal_kf gated on pre-RELEASE lockstep only. RELEASE dropped eligibility; invent free-ran through the soft fork.

What landed (§110):

Heal sticky (RB_FMV_HEAL_STICKY_TICKS=300) armed on heal Live/tip-hold — rb_post_fmv_heal_eligible stays true through sticky (and DESYNC / lockstep). Re-heal hc-fork keeps media_kf=1 heal=1.
Invent hold during sticky via lockstep_no_invent — no GAP1 invent catch-up until sticky expires or cores rematch CONFIRM.
Early sticky clear when post-RELEASE HC streak hits CONFIRM.

Re-soak watch: after heal expect heal sticky until sim=…; on hitch re-fork expect heal KF requested … sticky_until= then apply-only again — not begin … media_kf=0 heal=0 / resim storm. Digs rematch → heal sticky cleared (cores rematched…).

111. Post-FMV tip+1 ±1-cycle Win↔Linux (dirty entry poll) (2026-08-13)

Soak (MotK Win↔CachyOS after §110b verify heal): tip 870 matched (core=1d304d69, MEDIA-KF CRC match, resume pc=0x80076880, i_stat=00000001). Resim fin@871: Win cyc=492226568 vs Cachy 492226569 (±1); cpu/clk/tim/ram fork; hc-fork no pad mispredict.

Cause: post-FMV wait lives in a dirty-interp hole (not in static emit). Dirty entry used a host-only s_interp_entry_poll %% 64 stride to pump IRQs. Peers that drifted through FMV entered the wait with opposite phases while VBlank was already latched — one delivered immediately, the other after a few wait-loop instructions (exit_pc=0x800768C8, v0=1). Same class as the old CD54 hold gated on host s_present_pending.

What landed (§111):

Deliverable → poll every dirty entry (guest-deterministic). Keep the %%64 throttle only when no IRQ is deliverable.
dirty_ram_irq_ambient_resync_after_restore — reset entry-poll stride
- 4096-insn pump gap from psx_cycles_resync_after_restore.
Second MotK wait pair 0x800768C8 (hold A) ↔ 0x80076880 (canonical B) for IRQ hold / present gate / snap resume canonicalize.

Re-soak watch: through title FMV → settle → tip+1 must keep matched audit fin cyc (no ±1) and no FIRST CORE DIVERGE / heal-verify abort at the first post-settle frame. Linux↔Linux control still clean.

112. Post-snap LEGACY_SENTINEL tip+1 (loading screen) (2026-08-13)

Soak (MotK Win↔CachyOS after §111): matched through settle@1354 and live dig@1472; soft fork sim=1480. Tip 1479 matched (core=f9e21305, resume pc=0x800756e0, i_stat=00000001). Heal verify fin@1480 cyc Δ4; Win abort irqctx same_thr=0 reason=3 exit_pc=0 epc=80000048 at arm cycle (PSX_EXC_ESCAPE_LEGACY_SENTINEL).

Cause: interrupts_resync_after_restore zeros compiled/dirty resume latches. Sticky VBlank then delivered on the first post-flush_resume check with take_pc=0 → sentinel EPC / cross-thread restore, while a peer that latched the BB PC first took the real same-thread path.

What landed (§112):

psx_irq_arm_compiled_resume_pc — publish resume PC (+ last-check edge).
psx_scheduler_resume_at + RESUME_CURRENT dispatch arm before psx_dispatch.
Delivery fallback — if latches still 0 under top-level resume, use cpu->pc instead of the sentinel.

Re-soak watch: loading-screen tip+1 — no Win irqctx … reason=3 epc=80000048 on heal abort; fin cyc match; no FIRST CORE DIVERGE at the first post-settle loading frame.

113. Win↔UNIX post-FMV invent + ahead-tip pacing (2026-08-13)

Soak: after §111/§112 accuracy work, Win↔Cachy still showed chronic cadence skew through loading: Win phase ctrl lead≈+7..8 / debt_ms=0, Cachy GAP1_LEGACY / RUNWAY_EMPTY invents. Soft fork @1480 sat before dense_lockstep min=1510 while invent had already unlocked at settle@1354.

What landed (§113):

Invent hold through lockstep MIN — rb_in_fmv_lockstep_window now gates invent until g_fmv_lockstep_until (media_end+MIN), matching the gate comment that already said invent stays off through MIN. Stall tag fmv_lockstep after settle; settle log invent_hold= reports MIN.
Ahead-of-tip timesync — np_timesync_note_ahead_skew: when remote_lead < 0 for ~8 admits outside media/lockstep, add ~½-tick debt so the inventing seat paces before GAP1 (BattleShip cross-OS pattern).
Gap1 LAN grace cap 12→20 ms — more room for a mid-flight tip row on LAN Win↔UNIX before inventing.

Re-soak watch: RBE_CROSS_OS_PACING_DIAG=1 — through FMV→loading, stall=fmv_lockstep (not invent) until MIN; debt_ms rises on the ahead-of-tip seat; fewer GAP1_LEGACY / RUNWAY_EMPTY before tip+1. Accuracy (§112 arm) still required for matched fin cyc at tip+1.

114. Platform tip+1 apply-only heal + KF stream (2026-08-13)

Problem: matched-baseline tip+1 after post-FMV loading is Win↔Linux platform nondeterminism (cpu/clk/tim/ram diverge with matched dirty). Verify span past load always aborted; empty tip KF rematched tip and stormed.

What landed (§114):

Apply-only MEDIA_KF heal (target=load) — no tip+1 resim.
Heal Live → invent off + g_post_fmv_platform_nondet + initiator KF stream every 16 sim ticks (dense snaps).
Heal loop CAP → same keep-live stream instead of hard DESYNC abort.

Gap: stream always rewound to HC's stuck tip+1 fork (resolved+1), so choose_load re-pinned keep forever → loading-screen livelock (no DESYNC).

115. Platform KF stream escape / host-tip ride (2026-08-13)

Soak (MotK Win↔CachyOS after §114): FIRST CORE DIVERGE sim=1112, heal pin 1111 / pc=0x800768e8, then hundreds of §114 KF stream begin fork=1112 + heal KF CAP →1111 with invent off until rematch. No DESYNC; loading never advanced. HC peek_mismatch stays at tip+1 while resolved_through=keep.

What landed (§115):

Host-tip ride — when HC fork is the known platform tip+1 and sim > fork, stream begin_rewind(sim) so MEDIA-KF pins near host tip.
Accept on advance — heal Live/tip-hold with tip > keep primes HC past the soft fork, clears invent-hold/stream, sets g_platform_accepted_fork (hc-fork / begin refuse re-heal).
Stream CAP (RB_FMV_PLATFORM_KF_STREAM_LIMIT=6) — same stale fork without escape → force accept.

Re-soak watch: after first post-FMV tip+1 diverge, logs §115 KF stream ride host tip and/or §115 platform fork accepted; sim advances past keep; no endless snap applied tick=<keep>; loading completes.

269 KiB Raw Blame History Unescape Escape

MotK rollback hookup checklist

0. Ground rules (do not skip)

1. In-memory snapshot ring (host)

Tasks

2. Master state digest + frame-commit watermark

Tasks

3. Input history + invent / prediction

Tasks

4. Live frame loop (replace admit barrier when rollback on)

Tasks

5. Episode path (resim)

Tasks

6. Wire / transport mapping

Tasks

7. Determinism prerequisites (MotK-specific)

Tasks

8. recomp-ui (branch feat/rollback-netplay)

Tasks

9. Suggested implementation order

10. File touch map

11. Done when

12. Portable policy: size "wait before invent" budgets from RTT, not local tick cadence

13. Verify POST loss → unilateral tip-hold → tip-extend NACK storm (2026-08-01)

14. TipHold coalesce was pump-spin, not sim/wall time (2026-08-01)

15. Light-tip depth ceiling vs TipHold coalesce runway (2026-08-01)

16. Follow-NACK realign fork + HC re-poison + asymmetric light-tip (2026-08-01)

17. Tip-hold Live-walk held dpad → double menu inputs (2026-08-01)

18. POST-diverge tooling + post-realign cooldown (2026-08-01)

19. Tip-extend invent-idle seal + POST storm cooldown (2026-08-01)

20. Skip presentation during resim ticks (2026-08-01)

21. Invent-grace ceiling scales with input_delay (2026-08-01)

22. Delay-buffer admit + adaptive delay (2026-08-01)

23. Short invent grace at gap=1 (2026-08-01)

24. Admit-hitch cleanup after gap1 grace (2026-08-01)

25. TipHold WALL vs quiet + gap1 shrink (2026-08-01)

26. FMV lockstep was re-serializing WAN (2026-08-01)

27. Presentation continuity without resim storms (2026-08-01)

28. Gap=1 phase-vs-starvation split — LAN resim storms (2026-08-01)

29. §28 Case A wait was the hitch — scheduler needs pacing, not waiting

30. Phase-control soak instrumentation — no algorithm change (2026-08-01)

31. Protocol correctness track — distributed episode contract (2026-08-01)

32. Scheduler-feel track kickoff — lead regulation (2026-08-01)

33. Hold-last present during resim (2026-08-01)

34. Double menu inputs — tip-hold quiet + scrub + debounce (2026-08-01)

35. TipHold SAFETY-while-held + hold-last on admit stall (2026-08-01)

36. TipHold held = live pad, not frozen sim peek (2026-08-02)

37. TipHold remote held = sealed tip only (2026-08-02)

38. Post–tip-hold agreed holdoff + load clamp (2026-08-02)

39. Gate choose_load clamp on holdoff only (2026-08-02)

40. Advertise RESOLVED on ADVANCE + gate begin on peer frontier (2026-08-02)

41. Bound peer-RESOLVED gate + no HEAL-FORCE advertise (2026-08-02)

42. Mutual abort realign + tip-extend abandon + fork-storm guard (2026-08-02)

42c. OP_COMMIT wire signal — abandon keyed on commits only (2026-08-02)

43. LAN micro-grace before gap-1 invent (2026-08-02)

44. Real-delay consumption + scheduler extraction (2026-08-02)

45. Tip-hold race-ahead + cushion absurd-lead guard (2026-08-02)

46. HC-silent promote for button mispredicts (2026-08-02)

47. Replay ownership — contiguous confirmed catch-up (2026-08-02)

Roles (non-overlapping)

Contiguous frontier

Ownership loop

Tip refill + present cadence

48. Sticky invent Up → ownership-chain thrash (2026-08-02)

49. WAN ownership micro-chains + GO loss + realign tip cliff (2026-08-02)

50. FMV tip-extend through lockstep → BIOS realign / CD fork (2026-08-02)

51. choose_load vs Replay ownership vs present (2026-08-02)

52. Seal rows had no rexmit → silent AwaitingBaseline deadlock (2026-08-02)

53. Live ADVANCE cadence + choose_load max floor (2026-08-02)

54. Silent permanent fork: cooldown-swallowed correction + no HC recovery (2026-08-02)

55. Resim purity + dead-timeline evidence + fork bisect (2026-08-02)

56. Scheduler equilibrium: cushion-rebuild exit, pipeline slack, scorecard (2026-08-02)

57. Arrival-driven adaptive D + transit-aware targets (2026-08-02)

58. Dense tip snapshots + Start debounce in replay produce (2026-08-02)

Start cadence bisect (2026-08-02)

Start consumer bisect (2026-08-02)

59. Lobby RTT→D table bump + TURN floor + faster first raise (2026-08-02)

60. Ownership-chain BEGIN stash + rexmit (FOLLOW deadlock) (2026-08-02)

61. Same-epoch BEGIN stash reopen + hc_dense peer clamp (2026-08-02)

62. NACK deep-demote WIRE_HOLE hang + peer NACK floor (2026-08-02)

269 KiB

Raw Blame History

8. recomp-ui (branch `feat/rollback-netplay`)

21. Invent-grace ceiling scales with `input_delay` (2026-08-01)

95. Netplay LOAD — host hung `wait_confirm`, guest-only apply (2026-08-05)