wait for rumble before closing device

The compile slice advanced a fixed step per line of build output, so how
far it moved depended on how many lines the build printed. When aurora and
its dependencies are compiled locally (as on macOS) the bar reached its cap
long before the game itself was compiled. Read ninja's edge counter instead.

.github/workflows/build.yml

@@ -46,3 +46,67 @@ jobs:
 
       - name: Test
         run: dotnet test translator/Translator.sln -c Release --no-build --verbosity normal
+
+  platform_tests:
+    name: Host platform (${{ matrix.runner }})
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: [ubuntu-24.04, macos-14, macos-15-intel]
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Configure without graphics dependencies or game assets
+        run: >-
+          cmake -S runtime -B build-platform -G Ninja
+          -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++
+          -DMKW_BUILD_PRODUCTS=OFF -DMKW_PLATFORM_TESTS_ONLY=ON
+
+      - name: Build and run host-platform tests
+        run: |
+          cmake --build build-platform --parallel 3
+          ctest --test-dir build-platform --output-on-failure
+
+  macos_substrate:
+    name: macOS arm64 (configure + substrate tests)
+    runs-on: macos-14
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Test macOS app dependency packaging
+        shell: bash
+        run: bash Launcher/macos/test-publish-app.command
+
+      - name: Configure native runtime
+        shell: bash
+        run: |
+          test "$(uname -m)" = arm64
+          cmake -S runtime -B build-macos -G Ninja \
+            -DCMAKE_BUILD_TYPE=Release -DMKW_BUILD_PRODUCTS=OFF
+          grep -qx 'CMAKE_OSX_DEPLOYMENT_TARGET:STRING=12.0' \
+            build-macos/CMakeCache.txt
+
+      - name: Build macOS portability targets
+        shell: bash
+        run: |
+          cmake --build build-macos --target \
+            mkw_platform_paths_tests \
+            mkw_runtime_config_tests \
+            mkw_nand_save_tests \
+            mkw_nand_settings_tests \
+            mkw_sc_serial_tests \
+            mkw_input_expr_tests \
+            mkw_macos_native_compile \
+            mkw_macos_context_abi_tests \
+            mkw_macos_host_context_tests \
+            mkw_macos_guest_flat_memory_tests \
+            mkw_macos_external_audio_tests
+
+      - name: Test execution substrate
+        shell: bash
+        run: ctest --test-dir build-macos --output-on-failure

.github/workflows/package.yml

@@ -1,8 +1,8 @@
 name: Package installers
 
 # Builds the per-platform installer/setup tool (WiiCompiled-Setup.exe /
-# WiiCompiled-Setup-x86_64.AppImage) via Launcher/Build-Installer.ps1 and
-# Launcher/build-appimage.sh respectively - the same scripts a maintainer runs by hand today to
+# WiiCompiled-Setup-x86_64.AppImage / WiiCompiled-Setup.pkg) via the platform packaging scripts -
+# the same scripts a maintainer runs by hand today to
 # produce a GitHub Release asset. This does NOT build the actual translated game executable:
 # that step requires the end user's own Mario Kart Wii dump (Assets/main.dol, Assets/StaticR.rel),
 # which is proprietary and not present in this repository or in CI.
@@ -11,6 +11,11 @@ on:
     tags:
       - '*'
   workflow_dispatch:
+    inputs:
+      version:
+        description: Package version
+        required: true
+        type: string
 
 permissions:
   contents: read
@@ -90,14 +95,139 @@ jobs:
           if-no-files-found: error
           archive: false
 
+  macos-setup-package:
+    name: macOS (universal Setup.pkg)
+    runs-on: macos-14
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-dotnet@v6
+        with:
+          dotnet-version: '8.0.x'
+
+      - name: Verify Apple Silicon runner
+        shell: bash
+        run: |
+          test "$(uname -m)" = arm64
+          xcode-select -p
+
+      - name: Download pinned Nod tools
+        shell: bash
+        run: |
+          mkdir -p Launcher/artifacts/macos
+          nodtool_version=v2.0.0-alpha.10
+          nodtool_arm64_asset=nodtool-macos-arm64
+          nodtool_arm64_sha256=e23ca466999b720c55e6d29c9683fce8cc74451ba64ead2e543d50129f24528a
+          nodtool_x86_64_asset=nodtool-macos-x86_64
+          nodtool_x86_64_sha256=f68f504dc2b72694b468ca78b6a24142c7aa5c8800f77564297f4143682e6575
+          curl -fsSL --retry 3 \
+            "https://github.com/encounter/nod/releases/download/${nodtool_version}/${nodtool_arm64_asset}" \
+            -o Launcher/artifacts/macos/nodtool-arm64
+          curl -fsSL --retry 3 \
+            "https://github.com/encounter/nod/releases/download/${nodtool_version}/${nodtool_x86_64_asset}" \
+            -o Launcher/artifacts/macos/nodtool-x86_64
+          printf '%s  %s\n' "$nodtool_arm64_sha256" Launcher/artifacts/macos/nodtool-arm64 | shasum -a 256 -c -
+          printf '%s  %s\n' "$nodtool_x86_64_sha256" Launcher/artifacts/macos/nodtool-x86_64 | shasum -a 256 -c -
+          chmod +x Launcher/artifacts/macos/nodtool-arm64 Launcher/artifacts/macos/nodtool-x86_64
+
+      - name: Publish self-contained Translator tools
+        shell: bash
+        run: |
+          dotnet publish translator/src/Translator.Cli/Translator.Cli.csproj \
+            -c Release -r osx-arm64 --self-contained true \
+            -p:PublishSingleFile=true \
+            -o Launcher/artifacts/macos/translator-arm64
+          dotnet publish translator/src/Translator.Cli/Translator.Cli.csproj \
+            -c Release -r osx-x64 --self-contained true \
+            -p:PublishSingleFile=true \
+            -o Launcher/artifacts/macos/translator-x86_64
+
+      - name: Download pinned universal Ninja
+        shell: bash
+        run: |
+          ninja_version=1.13.2
+          ninja_sha256=c99048673aa765960a99cf10c6ddb9f1fad506099ff0a0e137ad8960a88f321b
+          curl -fsSL --retry 3 "https://github.com/ninja-build/ninja/releases/download/v${ninja_version}/ninja-mac.zip" -o ninja-mac.zip
+          printf '%s  %s\n' "$ninja_sha256" ninja-mac.zip | shasum -a 256 -c -
+          unzip -q ninja-mac.zip -d Launcher/artifacts/macos/ninja
+          chmod +x Launcher/artifacts/macos/ninja/ninja
+
+      - name: Download pinned portable CMake
+        shell: bash
+        run: |
+          cmake_version=4.4.3
+          archive="cmake-${cmake_version}-macos-universal.tar.gz"
+          base_url="https://github.com/Kitware/CMake/releases/download/v${cmake_version}"
+          expected_sha256=0c5d65251c14cc884bfa16bdbed3c263ce5bffe2e21c0d0d00962cb0610464fa
+          curl -fsSL --retry 3 "$base_url/$archive" -o "$archive"
+          printf '%s  %s\n' "$expected_sha256" "$archive" | shasum -a 256 -c -
+          tar -xzf "$archive"
+          mv "cmake-${cmake_version}-macos-universal/CMake.app/Contents" Launcher/artifacts/macos/cmake
+
+      - name: Build Setup.pkg
+        env:
+          PACKAGE_VERSION: ${{ inputs.version }}
+          TAG_VERSION: ${{ github.ref_name }}
+        shell: bash
+        run: |
+          package_version="$PACKAGE_VERSION"
+          if [[ -z "$package_version" ]]; then
+            if [[ "${TAG_VERSION:-}" =~ ^v?[0-9] ]]; then
+              package_version="${TAG_VERSION#v}"
+            elif [[ -f "Launcher/Directory.Build.props" ]]; then
+              package_version=$(grep -m1 '<Version>' Launcher/Directory.Build.props | sed -E 's/.*<Version>([^<]+)<\/Version>.*/\1/')
+            fi
+          fi
+          mkdir -p Launcher/dist
+          Launcher/macos/build-setup-pkg.command \
+            --nodtool-arm64 Launcher/artifacts/macos/nodtool-arm64 \
+            --nodtool-x86_64 Launcher/artifacts/macos/nodtool-x86_64 \
+            --translator-arm64 Launcher/artifacts/macos/translator-arm64/Translator.Cli \
+            --translator-x86_64 Launcher/artifacts/macos/translator-x86_64/Translator.Cli \
+            --cmake-root Launcher/artifacts/macos/cmake \
+            --ninja-arm64 Launcher/artifacts/macos/ninja/ninja \
+            --ninja-x86_64 Launcher/artifacts/macos/ninja/ninja \
+            --output Launcher/dist/WiiCompiled-Setup.pkg \
+            ${package_version:+--version "$package_version"}
+
+      - name: Verify package layout and architecture-specific tools
+        shell: bash
+        run: |
+          pkgutil --check-signature Launcher/dist/WiiCompiled-Setup.pkg || true
+          if pkgutil --payload-files Launcher/dist/WiiCompiled-Setup.pkg | \
+            grep -E '/(Assets|generated|PulsarPacks|WiiCompiled.app|RetroRewind.app)(/|$)'; then
+            echo "::error::Setup.pkg contains a forbidden payload"
+            exit 1
+          fi
+          expanded="$RUNNER_TEMP/wiicompiled-setup-expanded"
+          pkgutil --expand-full Launcher/dist/WiiCompiled-Setup.pkg "$expanded"
+          resources="$expanded/Payload/Applications/WiiCompiled Setup.app/Contents/Resources"
+          for arch in arm64 x86_64; do
+            for tool in nodtool Translator.Cli ninja; do
+              lipo "$resources/tools/$arch/$tool" -verify_arch "$arch"
+            done
+          done
+          lipo "$resources/tools/cmake/bin/cmake" -verify_arch arm64 x86_64
+          bash "$resources/setup.command" --help
+          /usr/bin/arch -x86_64 /bin/bash "$resources/setup.command" --help
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: WiiCompiled-Setup-macos-universal
+          path: Launcher/dist/WiiCompiled-Setup.pkg
+          if-no-files-found: error
+          archive: false
+
   # Publishes the packaged installers as a GitHub Release whenever a v* tag is pushed. Wheel Wizard
   # discovers updates from these releases, so the contract it relies on is enforced here: a full
-  # (non-prerelease) release whose tag is v<semver>, carrying an asset named exactly
-  # WiiCompiled-Setup.exe, produced by a setup host that reports that same version.
+  # (non-prerelease) release whose tag is v<semver>, carrying the expected platform assets,
+  # produced by setup hosts that report that same version.
   release:
     name: Publish GitHub Release
     if: startsWith(github.ref, 'refs/tags/v')
-    needs: [linux-appimage, windows-installer, recompilation]
+    needs: [linux-appimage, windows-installer, macos-setup-package, recompilation]
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -107,7 +237,7 @@ jobs:
           persist-credentials: false
 
       # Wheel Wizard runs the downloaded setup with --version and refuses it when the reported
-      # version differs from the release tag, so a tag that was pushed without bumping every pinned
+      # version differs from the release tag, so a tag that was pushed without bumping the pinned
       # version would ship an update nobody can install. Catch that before anything is published.
       - name: Verify the tag matches the pinned setup version
         env:
@@ -122,9 +252,7 @@ jobs:
               status=1
             fi
           }
-          check Launcher/WiiCompiled.Setup.Windows/Program.cs "public const string Version = \"$version\";"
-          check Launcher/WiiCompiled.Setup.Windows/WiiCompiled.Setup.Windows.csproj "<Version>$version</Version>"
-          check Launcher/Build-Installer.ps1 "ProductVersion = '$version'"
+          check Launcher/Directory.Build.props "<Version>$version</Version>"
           exit $status
 
       # The build jobs upload with `archive: false`, which stores each installer as a raw file
@@ -143,7 +271,7 @@ jobs:
           set -euo pipefail
           ls -lR artifacts
           assets=()
-          for name in WiiCompiled-Setup.exe WiiCompiled-Setup-x86_64.AppImage WiiCompiled-Setup-aarch64.AppImage; do
+          for name in WiiCompiled-Setup.exe WiiCompiled-Setup-x86_64.AppImage WiiCompiled-Setup-aarch64.AppImage WiiCompiled-Setup.pkg; do
             found="$(find artifacts -type f -name "$name" | head -n 1)"
             [ -n "$found" ] && [ -s "$found" ] || { echo "::error::missing release asset $name"; exit 1; }
             assets+=("$found")

.github/workflows/recomp-test.yml

@@ -45,6 +45,20 @@ jobs:
         shell: pwsh
         run: ./Launcher/Prepare-PortableTools.ps1
 
+      - name: Build and run Windows host-platform tests
+        shell: pwsh
+        run: |
+          $tools = Join-Path $PWD 'Launcher/artifacts/portable-tools'
+          $env:PATH = "$tools/llvm-mingw/bin;$tools/CMake/bin;$tools/Ninja;$env:PATH"
+          cmake -S runtime -B build-platform -G Ninja `
+            -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ `
+            -DMKW_BUILD_PRODUCTS=OFF -DMKW_PLATFORM_TESTS_ONLY=ON
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          cmake --build build-platform --parallel 3
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          ctest --test-dir build-platform --output-on-failure
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
       - name: Prepare pinned native dependencies
         shell: pwsh
         run: ./Launcher/Prepare-Dependencies.ps1

Launcher/Build-Installer.ps1

@@ -279,9 +279,12 @@ foreach ($required in @('ToolkitFingerprint','TranslationFingerprint','NativeToo
     if ([string]::IsNullOrWhiteSpace($identities.$required)) { throw "Payload identity output is missing $required." }
 }
 
+$productVersion = ((& $setupHost --version) -join '').Trim()
+if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($productVersion)) { throw 'The setup host did not report its version.' }
+
 $manifest = [ordered]@{
     SchemaVersion = 2
-    ProductVersion = '0.2.32'
+    ProductVersion = $productVersion
     ExpectedGameId = $pins.GameId
     ExpectedDolSha256 = $pins.DolSha256
     ExpectedRelSha256 = $pins.RelSha256

Launcher/Directory.Build.props

@@ -0,0 +1,7 @@
+<Project>
+  <PropertyGroup>
+    <!-- The one product version. Release tags must match it. -->
+    <Version>0.2.34</Version>
+    <IncludeSourceRevisionInInformationalVersion>false</IncludeSourceRevisionInInformationalVersion>
+  </PropertyGroup>
+</Project>

Launcher/LocalBuild.ps1

@@ -103,7 +103,7 @@ function Write-MkwBuildStep([string]$StepId, [string]$Message) {
 function Reset-LocalDirectory([string]$Path) {
     $full = [IO.Path]::GetFullPath($Path)
     $root = [IO.Path]::GetFullPath($Workspace).TrimEnd('\') + '\'
-    $installRoot = [IO.Path]::GetFullPath((Split-Path -Parent $Workspace)).TrimEnd('\') + '\'
+    $installRoot = [IO.Path]::GetFullPath((Split-Path -Parent $realWorkspace)).TrimEnd('\') + '\'
     # The caller-supplied output destinations are legitimate reset targets by
     # definition, wherever the caller placed them: a fresh install's operation
     # scratch lives beside the installation directory rather than inside it.
@@ -150,8 +150,16 @@ if ($Profile -eq 'both' -and [string]::IsNullOrWhiteSpace($BaseOutputDirectory))
 if ($Profile -ne 'both' -and -not [string]::IsNullOrWhiteSpace($BaseOutputDirectory)) {
     throw '-BaseOutputDirectory is valid only with -Profile both.'
 }
+$realWorkspace = $Workspace.TrimEnd('\')
+$Workspace = Get-MkwBuildSafePath $realWorkspace 'workspace' 'runtime\CMakeLists.txt'
+# A selected package inside the install may also name the same Code.pul through the real path.
+# Give it the workspace spelling before comparing it with the staged copy.
+if (-not [string]::IsNullOrWhiteSpace($RetroRewindPackageDirectory) -and
+    $RetroRewindPackageDirectory.StartsWith($realWorkspace + '\', [StringComparison]::OrdinalIgnoreCase)) {
+    $RetroRewindPackageDirectory = $Workspace + $RetroRewindPackageDirectory.Substring($realWorkspace.Length)
+}
 $translator = Join-Path $Toolkit 'Translator\Translator.Cli.exe'
-$toolchain = Get-MkwShellSafeToolchainRoot $Toolkit
+$toolchain = Get-MkwBuildSafePath $Toolkit 'toolchain' 'CMake\bin\cmake.exe'
 $cmake = Join-Path $toolchain 'CMake\bin\cmake.exe'
 $ninja = Join-Path $toolchain 'Ninja\ninja.exe'
 $toolchainBin = Join-Path $toolchain 'llvm-mingw\bin'

Launcher/NativeBuildFlags.ps1

@@ -40,41 +40,55 @@ function Get-MkwToolchainPath([string]$ToolchainRoot) {
     ) -join ';')
 }
 
-function Get-MkwShellSafeToolchainRoot([string]$ToolchainRoot) {
-    if ([string]::IsNullOrWhiteSpace($ToolchainRoot)) { throw 'A toolchain root is required.' }
-    $full = [IO.Path]::GetFullPath($ToolchainRoot)
+function Get-MkwBuildSafePath([string]$Path, [string]$Kind, [string]$MarkerFile) {
+    <#
+    The Windows native build passes workspace paths through CMake, Ninja response files and
+    clang, which do not all interpret quotes the same way. Keep those paths plain even when the
+    user's install directory contains an apostrophe, ampersand or other punctuation.
+    #>
+    if ([string]::IsNullOrWhiteSpace($Path)) { throw "A $Kind path is required." }
+    $full = [IO.Path]::GetFullPath($Path)
     # A drive root keeps its separator: "C:" is relative to the current directory on that drive.
     if ($full -ne [IO.Path]::GetPathRoot($full)) { $full = $full.TrimEnd('\') }
-    if ($full -notmatch '[()&^%!]') { return $full }
+    if ($full -cmatch '^[A-Za-z0-9 ._\\:-]+$') { return $full }
+
+    Assert-File (Join-Path $full $MarkerFile) "$Kind marker"
 
     $sha = [Security.Cryptography.SHA256]::Create()
     try {
         $bytes = $sha.ComputeHash([Text.Encoding]::UTF8.GetBytes($full.ToLowerInvariant()))
     } finally { $sha.Dispose() }
-    $linkName = 'toolchain-' + ((($bytes[0..7]) | ForEach-Object { $_.ToString('x2') }) -join '')
+    $linkName = "$Kind-" + ((($bytes[0..7]) | ForEach-Object { $_.ToString('x2') }) -join '')
 
     $failures = @()
     foreach ($base in @($env:ProgramData, $env:PUBLIC)) {
-        if ([string]::IsNullOrWhiteSpace($base) -or $base -match '[()&^%! ]') { continue }
+        if ([string]::IsNullOrWhiteSpace($base) -or $base -cnotmatch '^[A-Za-z0-9._\\:-]+$') { continue }
         $link = Join-Path (Join-Path $base 'WiiCompiled') $linkName
         try {
             [IO.Directory]::CreateDirectory((Split-Path -Parent $link)) | Out-Null
-            # The name already identifies the target, so an existing junction that still resolves is
-            # this one; only a broken leftover is replaced. Directory.Delete removes the reparse
-            # point itself, where Remove-Item -Recurse would delete the toolchain it points at.
-            if (-not (Test-Path -LiteralPath (Join-Path $link 'CMake\bin\cmake.exe') -PathType Leaf)) {
-                if (Test-Path -LiteralPath $link) { [IO.Directory]::Delete($link) }
+            $existing = Get-Item -LiteralPath $link -Force -ErrorAction SilentlyContinue
+            if ($null -ne $existing) {
+                # Never trust a directory just because it has the marker: it could point at a
+                # different installation. Nor may we remove a directory we did not create.
+                if ($existing.LinkType -ne 'Junction' -or
+                    @($existing.Target).Count -ne 1 -or
+                    -not [string]::Equals([IO.Path]::GetFullPath(@($existing.Target)[0]),
+                        $full, [StringComparison]::OrdinalIgnoreCase)) {
+                    throw "An existing path is not the expected junction: $link"
+                }
+            } else {
                 New-Item -ItemType Junction -Path $link -Target $full -ErrorAction Stop | Out-Null
             }
-            Write-Host "MKWCBUILD: Building through $link, because $full contains characters cmd.exe cannot parse"
+            Assert-File (Join-Path $link $MarkerFile) "$Kind junction marker"
+            Write-Host "MKWCBUILD: Building the $Kind through $link, because $full contains characters the native build cannot quote reliably"
             return $link
         } catch {
             $failures += "$link ($($_.Exception.Message))"
         }
     }
-    throw ("The toolchain path $full contains a character (one of ( ) & ^ % !) that the compiler " +
-        'cannot be invoked through, and no junction to it could be created: ' + ($failures -join '; ') +
-        '. Install to a path without those characters.')
+    throw ("The $Kind path $full cannot be passed safely to the native build, and no junction " +
+        'to it could be created: ' + ($failures -join '; ') + '. Install to a path of plain ' +
+        'letters, digits and spaces, or make a safe junction location available.')
 }
 
 function Get-MkwProjectPins([string]$ProjectFile) {

Launcher/Prepare-Dependencies.ps1

@@ -82,9 +82,9 @@ $packages = @(
         Pins = @(@{ File = $auroraExtern; Text = 'https://github.com/wolfpld/tracy/archive/a64b9a20294d59421a2f57aeca3c6383d8c48169.tar.gz' })
     },
     [pscustomobject]@{
-        Name = 'xxhash'; File = 'xxHash-0.8.3.tar.gz'
-        Uris = @('https://github.com/Cyan4973/xxHash/archive/refs/tags/v0.8.3.tar.gz')
-        Pins = @(@{ File = $auroraExtern; Text = 'https://github.com/Cyan4973/xxHash/archive/refs/tags/v0.8.3.tar.gz' })
+        Name = 'xxhash'; File = 'xxHash-0.8.4.tar.gz'
+        Uris = @('https://github.com/Cyan4973/xxHash/archive/refs/tags/v0.8.4.tar.gz')
+        Pins = @(@{ File = $auroraExtern; Text = 'https://github.com/Cyan4973/xxHash/archive/refs/tags/v0.8.4.tar.gz' })
     },
     [pscustomobject]@{
         Name = 'zlib'; File = 'zlib-1.3.2.tar.gz'

Launcher/Prepare-NativePrebuilt.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # Builds the redistributable precompiled aurora + third-party package for native Linux: aurora
-# (~43% of local build CPU time per Prepare-NativePrebuilt.ps1) and vendored Crypto++ are identical
+# (~43% of local build CPU time per Prepare-NativePrebuilt.ps1), Crypto++ and mbed TLS are identical
 # for every user under the pinned toolchain prepare-portable-tools.sh bundles, so this configures
 # runtime/ against that toolchain, builds just that closure, and harvests the archives plus a
 # generated CMake description into an output package - the Linux counterpart to
@@ -22,11 +22,17 @@ workspace=$(cd "$script_dir/.." && pwd)
 
 arch=""
 output_dir=""
+toolchain_dir=""
+ninja_bin=""
+cmake_bin=""
+llvm_dir=""
+sysroot=""
 stage_dir="$workspace/build/native-prebuilt-stage"
 keep_stage=0
 reuse_stage=0
 parallel=0
 print_fingerprint_only=0
+disconnected=0
 
 usage() {
     cat <<'EOF'
@@ -39,8 +45,7 @@ Usage: Prepare-NativePrebuilt.sh --arch {x86_64|aarch64} [options]
   --reuse-stage           Reuse an existing staging build directory (maintainer iteration aid: a
                           re-harvest does not recompile aurora from scratch)
   --parallel N            Ninja build parallelism (default: nproc)
-  --print-fingerprint-only  Print the four provenance inputs (compiler_sha256, flag_fingerprint,
-                          aurora_fingerprint, third_party_fingerprint) as "key=value" lines and
+  --print-fingerprint-only  Print the provenance inputs as "key=value" lines and
                           exit, without configuring/building/harvesting anything - lets a caller
                           (build-appimage.sh) decide whether an existing package is still current
                           without paying for a full aurora rebuild just to find out.
@@ -56,6 +61,12 @@ while [[ $# -gt 0 ]]; do
         --reuse-stage) reuse_stage=1; shift ;;
         --parallel) parallel=$2; shift 2 ;;
         --print-fingerprint-only) print_fingerprint_only=1; shift ;;
+        --toolchain-dir) toolchain_dir=$2; shift 2 ;;
+        --ninja-bin) ninja_bin=$2; shift 2 ;;
+        --cmake-bin) cmake_bin=$2; shift 2 ;;
+        --llvm-dir) llvm_dir=$2; shift 2 ;;
+        --sysroot) sysroot=$2; shift 2 ;;
+        --disconnected) disconnected=1; shift ;;
         -h|--help) usage; exit 0 ;;
         *) echo "Prepare-NativePrebuilt.sh: unknown argument: $1" >&2; exit 1 ;;
     esac
@@ -72,14 +83,22 @@ assert_dir() { [[ -d "$1" ]] || fail "$2 is missing: $1"; }
 sha256_of() { sha256sum "$1" | awk '{print $1}'; }
 normalize() { readlink -f "$1"; }
 
+# Environment check: Ensure the `SOURCE_DATE_EPOCH` value is not invalid
+# before trying to build anything (fail-fast)
+if [[ -n "${SOURCE_DATE_EPOCH:-}" ]] && ! python3 -c \
+    'import datetime, os; datetime.datetime.fromtimestamp(int(os.environ.get("SOURCE_DATE_EPOCH")), datetime.timezone.utc)'
+then
+    fail "SOURCE_DATE_EPOCH must be a valid UNIX timestamp"
+fi
+
 [[ -n "$output_dir" ]] || output_dir="$script_dir/artifacts/native-prebuilt-$arch"
 [[ "$stage_dir" = /* ]] || stage_dir="$workspace/$stage_dir"
 
-toolchain_dir="$script_dir/artifacts/portable-tools/toolchain-$arch"
-cc="$toolchain_dir/bin/clang"
-cxx="$toolchain_dir/bin/clang++"
-cmake_bin="$toolchain_dir/bin/cmake"
-ninja_bin="$toolchain_dir/bin/ninja"
+toolchain_dir="${toolchain_dir:-$script_dir/artifacts/portable-tools/toolchain-$arch}"
+cc="${llvm_dir:-$toolchain_dir}/bin/clang"
+cxx="${llvm_dir:-$toolchain_dir}/bin/clang++"
+cmake_bin="${cmake_bin:-$toolchain_dir/bin/cmake}"
+ninja_bin="${ninja_bin:-$toolchain_dir/bin/ninja}"
 runtime_source="$workspace/runtime"
 aurora_source="$workspace/aurora-main"
 
@@ -88,7 +107,7 @@ assert_file "$ninja_bin" "Portable Ninja"
 assert_file "$cc" "Portable C compiler"
 assert_file "$cxx" "Portable C++ compiler"
 assert_dir "$aurora_source" "aurora-main source tree"
-clang_binary=$(normalize "$toolchain_dir/bin/clang-22")
+clang_binary=$(normalize "${llvm_dir:-$toolchain_dir}/bin/clang-22")
 assert_file "$clang_binary" "Portable clang driver binary"
 
 (( parallel > 0 )) || parallel=$(nproc)
@@ -131,6 +150,8 @@ fixed_configure_flags=(
     -DCMAKE_DISABLE_FIND_PACKAGE_absl=ON
     -DCMAKE_DISABLE_FIND_PACKAGE_PNG=ON
     -DCMAKE_DISABLE_FIND_PACKAGE_Freetype=ON
+    -DUSE_STATIC_MBEDTLS_LIBRARY=ON
+    -DUSE_SHARED_MBEDTLS_LIBRARY=OFF
     # Freetype's own vendored CMakeLists.txt separately probes for system BZip2 (optional
     # bzip2-compressed-font support aurora-main never asked for) regardless of the Freetype
     # find_package disable above, since that only stops aurora's own outer find_package(Freetype)
@@ -141,6 +162,16 @@ fixed_configure_flags=(
     -DFT_DISABLE_BZIP2=ON
     -DCMAKE_POLICY_DEFAULT_CMP0168=NEW
 )
+if [[ "$disconnected" -eq 1 ]]; then
+    fixed_configure_flags+=(
+        -DFETCHCONTENT_FULLY_DISCONNECTED=ON
+    )
+fi
+if [[ -n "$sysroot" ]]; then
+    fixed_configure_flags+=(
+        -DCMAKE_SYSROOT="$sysroot"
+    )
+fi
 flag_fingerprint=$(printf '%s\n' "${fixed_configure_flags[@]}" | sha256sum | awk '{print $1}')
 
 # extern/ is excluded because the payload ships that tree separately (aurora-main/extern is bundled
@@ -148,19 +179,24 @@ flag_fingerprint=$(printf '%s\n' "${fixed_configure_flags[@]}" | sha256sum | awk
 aurora_fingerprint=$(fingerprint_tree "$aurora_source" extern build)
 [[ -n "$aurora_fingerprint" ]] || fail "The aurora source tree could not be fingerprinted: $aurora_source"
 
-# The harvested Crypto++ archive is consumed against this tree's headers, so it is fingerprinted
-# for the same reason as aurora above. No exclusions: unlike aurora's extern/, nothing under
-# runtime/third_party is shipped separately.
+# The harvested Crypto++ archive is consumed against this tree's headers, so it is fingerprinted.
 third_party_fingerprint=$(fingerprint_tree "$runtime_source/third_party")
 [[ -n "$third_party_fingerprint" ]] || fail "The vendored third-party tree could not be fingerprinted: $runtime_source/third_party"
+mbedtls_fingerprint=$(sha256_of "$runtime_source/cmake/MbedTLSPin.cmake")
 
-compiler_sha256=$(sha256_of "$clang_binary")
+compiler_sha256=$(sha256_of "$cc")
+cxx_sha256=$(sha256_of "$cxx")
+# Append the CXX SHA256 if it doesn't match the hash of CC
+if [[ "${cxx_sha256}" != "${compiler_sha256}" ]]; then
+    compiler_sha256="${compiler_sha256}:${cxx_sha256}"
+fi
 
 if [[ "$print_fingerprint_only" -eq 1 ]]; then
     printf 'compiler_sha256=%s\n' "$compiler_sha256"
     printf 'flag_fingerprint=%s\n' "$flag_fingerprint"
     printf 'aurora_fingerprint=%s\n' "$aurora_fingerprint"
     printf 'third_party_fingerprint=%s\n' "$third_party_fingerprint"
+    printf 'mbedtls_fingerprint=%s\n' "$mbedtls_fingerprint"
     exit 0
 fi
 
@@ -361,6 +397,21 @@ while IFS='|' read -r name type file linkerfile; do
         linker_file_to_reference["$linkerfile"]="@PKG@/$relative_linker"
     fi
 done < "$targets_txt"
+mbedtls_refs=()
+mbedtls_txt="$export_dir/mbedtls.txt"
+assert_file "$mbedtls_txt" "Mbed TLS export targets list"
+while IFS='|' read -r name linkerfile; do
+    [[ -n "$name" ]] || continue
+    linkerfile=$(normalize "$linkerfile")
+    ref=${linker_file_to_reference["$linkerfile"]:-}
+    [[ -n "$ref" ]] || fail "Mbed TLS archive was not harvested: $name ($linkerfile)"
+    mbedtls_refs+=("$ref")
+done < "$mbedtls_txt"
+[[ ${#mbedtls_refs[@]} -ge 3 ]] || fail "Expected at least three Mbed TLS archives, got ${#mbedtls_refs[@]}"
+mbedtls_source_dir=$(get_meta mbedtls_source_dir)
+assert_dir "$mbedtls_source_dir/include/mbedtls" "Mbed TLS headers"
+mkdir -p "$output_dir/include/mbedtls"
+cp -a "$mbedtls_source_dir/include/." "$output_dir/include/mbedtls/"
 # Unlike Windows (SDL/zlib/libpng ship as DLLs by default), everything here was forced static above
 # and Dawn's own Linux package (verified directly) ships libwebgpu_dawn.a, also static - so zero
 # shared imports is the expected, normal outcome, not a failure.
@@ -426,6 +477,9 @@ for item in "${link_items[@]}"; do
     if [[ "$item" = /* ]]; then item_abs=$(normalize "$item"); else item_abs=$(normalize "$stage_dir/$item"); fi
     ref=${linker_file_to_reference["$item_abs"]:-}
     if [[ -n "$ref" ]]; then
+        for mbedtls_ref in "${mbedtls_refs[@]}"; do
+            [[ "$ref" == "$mbedtls_ref" ]] && continue 2
+        done
         package_link_items+=("$ref")
         continue
     fi
@@ -505,6 +559,9 @@ generated_cmake="$output_dir/native_prebuilt.cmake"
     format_cmake_block MKW_NP_COMPILE_DEFINITIONS "${package_definitions[@]}"
     format_cmake_block MKW_NP_COMPILE_OPTIONS "${package_compile_options[@]}"
     format_cmake_block MKW_NP_LINK_LIBRARIES "${package_link_items[@]}"
+    format_cmake_block MKW_NP_MBEDTLS_LIBRARIES "${mbedtls_refs[@]}"
+    echo 'set(MKW_NP_MBEDTLS_INCLUDE_DIR "@PKG@/include/mbedtls")'
+    printf 'set(MKW_NP_MBEDTLS_FINGERPRINT "%s")\n' "$mbedtls_fingerprint"
     format_cmake_block MKW_NP_AURORA_TARGETS "aurora::gx" "aurora::pad" "aurora::si" "aurora::vi" "aurora::mtx"
     echo ""
     printf 'set(MKW_NP_DAWN_CONFIG_DIR "%s")\n' "$dawn_config_token"
@@ -540,12 +597,12 @@ harvested_count=${#linker_file_to_reference[@]}
 
 python3 - "$output_dir" "$compiler_sha256" "$compiler_version" "$flag_fingerprint" \
     "$dawn_version" "$dawn_runtime_sha256" "$aurora_fingerprint" "$third_party_fingerprint" \
-    "$sdl3_target" "$harvested_count" <<'PY'
+    "$sdl3_target" "$harvested_count" "$mbedtls_fingerprint" <<'PY'
 import hashlib, json, os, sys, datetime
 
 (output_dir, compiler_sha256, compiler_version, flag_fingerprint, dawn_version,
  dawn_runtime_sha256, aurora_fingerprint, third_party_fingerprint, sdl3_target,
- harvested_count) = sys.argv[1:]
+ harvested_count, mbedtls_fingerprint) = sys.argv[1:]
 
 contents = []
 for root, dirs, files in os.walk(output_dir):
@@ -560,9 +617,21 @@ for root, dirs, files in os.walk(output_dir):
         contents.append({"Path": rel, "Bytes": os.path.getsize(path), "Sha256": digest})
 contents.sort(key=lambda c: c["Path"])
 
+source_date_epoch = os.environ.get("SOURCE_DATE_EPOCH") or None
+utc = datetime.timezone.utc
+if source_date_epoch is not None:
+    built_utc = datetime.datetime.fromtimestamp(
+        int(source_date_epoch),
+        utc
+    )
+else:
+    built_utc = datetime.datetime.now(utc)
+
+built_utc = built_utc.strftime("%Y-%m-%dT%H:%M:%S.%f")[:-3] + "Z"
+
 provenance = {
     "SchemaVersion": 1,
-    "BuiltUtc": datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%S.%f")[:-3] + "Z",
+    "BuiltUtc": built_utc,
     "CompilerSha256": compiler_sha256,
     "CompilerVersion": compiler_version,
     "FlagFingerprint": flag_fingerprint,
@@ -570,6 +639,7 @@ provenance = {
     "DawnRuntimeSha256": dawn_runtime_sha256,
     "AuroraSourceFingerprint": aurora_fingerprint,
     "ThirdPartySourceFingerprint": third_party_fingerprint,
+    "MbedTlsFingerprint": mbedtls_fingerprint,
     "Sdl3Target": sdl3_target,
     "HarvestedLibraryCount": int(harvested_count),
     "Contents": contents,

Launcher/WiiCompiled.Setup.Common.Cli/WiiCompiled.Setup.Common.Cli.csproj

@@ -6,7 +6,6 @@
     <Nullable>enable</Nullable>
     <RootNamespace>WiiCompiled.Setup.Common.Cli</RootNamespace>
     <AssemblyName>WiiCompiled.Setup.Common.Cli</AssemblyName>
-    <Version>0.2.32</Version>
     <Authors>patchzy</Authors>
     <Product>WiiCompiled</Product>
     <Description>Packaging-time helper: resolves (downloading if needed) the nodtool binary bundled by build-appimage.sh and Build-Installer.ps1</Description>

Launcher/WiiCompiled.Setup.Common/WiiCompiled.Setup.Common.csproj

@@ -5,7 +5,6 @@
     <Nullable>enable</Nullable>
     <RootNamespace>WiiCompiled.Setup.Common</RootNamespace>
     <AssemblyName>WiiCompiled.Setup.Common</AssemblyName>
-    <Version>0.2.32</Version>
     <Authors>patchzy</Authors>
     <Product>WiiCompiled</Product>
     <Description>Shared nodtool/Retro-WFC-payload logic used by both the Windows and Linux installers</Description>

Launcher/WiiCompiled.Setup.Linux/InstallProgress.cs

@@ -184,18 +184,31 @@ internal sealed class BuildProgressWindow
         }
 
         // Anything else - a plain MKWCBUILD note, or raw tool output - stays a diagnostic and only
-        // feeds the heartbeat below.
+        // feeds the compile progress below.
         _reporter.Diagnostic(line);
-        // Compilation announces itself once and then emits thousands of compiler lines. Treat that
-        // output as a heartbeat so the slice keeps creeping forward, but only publish a progress
-        // line when the rounded percentage actually changes.
-        if (_fraction >= CompileFraction)
+        // Compilation announces itself once and then ninja prefixes every edge with [done/total].
+        // Follow that counter rather than counting lines: how many lines a build prints depends on
+        // whether aurora and its dependencies are prebuilt (AppImage) or compiled here (macOS), so a
+        // fixed per-line step reached the top long before the game itself compiled.
+        if (_fraction >= CompileFraction && TryParseNinjaProgress(line, out var done, out var total))
         {
-            _fraction = Math.Min(0.97, _fraction + 0.0015);
+            _fraction = Math.Max(_fraction, CompileFraction + (0.97 - CompileFraction) * done / total);
             Emit();
         }
     }
 
+    private static bool TryParseNinjaProgress(string line, out int done, out int total)
+    {
+        done = total = 0;
+        if (!line.StartsWith('[')) return false;
+        var close = line.IndexOf(']');
+        var slash = line.IndexOf('/');
+        return close > 0 && slash > 0 && slash < close
+            && int.TryParse(line.AsSpan(1, slash - 1), out done)
+            && int.TryParse(line.AsSpan(slash + 1, close - slash - 1), out total)
+            && total > 0 && done <= total;
+    }
+
     private void Emit()
     {
         var percent = Interpolate(_fraction);

Launcher/WiiCompiled.Setup.Linux/Models.cs

@@ -1,9 +1,13 @@
+using System.Reflection;
+
 namespace WiiCompiled.Setup.Linux;
 
 internal static class ProductInfo
 {
     public const string Name = "WiiCompiled";
-    public const string Version = "0.2.32";
+    public static readonly string Version =
+        typeof(ProductInfo).Assembly.GetCustomAttribute<AssemblyInformationalVersionAttribute>()!
+            .InformationalVersion;
 }
 
 /// <summary>One installed product's record inside install-state.json.</summary>

Launcher/WiiCompiled.Setup.Linux/Program.cs

@@ -127,19 +127,40 @@ internal static class Program
         string? retroWfcOfflineDir = null;
         if (downloadPayload)
         {
-            // Reused if a previous install already downloaded and it's still valid - matches
-            // Windows's own reuse-if-valid behavior instead of re-downloading on every install.
             var cacheDir = Path.Combine(workspace, "generated", "retro-wfc-payload");
-            reporter.Progress(InstallStages.Validate, "Preparing the Retro-WFC payload", 1);
+            reporter.Progress(InstallStages.Validate,
+                "Downloading the current Retro-WFC payload", 1);
             try
             {
-                RetroWfcPayload.ValidateStagedRetroWfcPayloadDirectory(cacheDir);
-            }
-            catch (InvalidDataException)
-            {
+                // A valid signature authenticates a payload, but does not prove it is the latest
+                // signed revision. Always ask the fixed endpoint for the current snapshot; the
+                // downloader verifies it before atomically replacing the cache.
                 await RetroWfcPayload.DownloadRetroWfcPayloadAsync(
                     RetroWfcPayload.CurrentRetroWfcPayloadUri, cacheDir, token);
             }
+            catch (Exception downloadFailure) when (!token.IsCancellationRequested &&
+                                                     downloadFailure is HttpRequestException or TimeoutException
+                                                         or IOException)
+            {
+                // Offline installs may continue with a previously authenticated snapshot. Do not
+                // use this path for a newly downloaded payload that failed signature validation:
+                // that must remain a hard failure instead of hiding possible endpoint tampering.
+                try
+                {
+                    RetroWfcPayload.ValidateStagedRetroWfcPayloadDirectory(cacheDir);
+                }
+                catch (Exception cacheFailure) when (cacheFailure is IOException or
+                                                     UnauthorizedAccessException or InvalidDataException)
+                {
+                    throw new InvalidOperationException(
+                        "The current Retro-WFC payload could not be downloaded and no valid cached " +
+                        $"payload is available ({cacheFailure.Message.TrimEnd('.')}).", downloadFailure);
+                }
+
+                reporter.Diagnostic(
+                    "The current Retro-WFC payload could not be downloaded; using the previously " +
+                    $"verified cached payload instead ({downloadFailure.Message.TrimEnd('.')}).");
+            }
             retroWfcOfflineDir = cacheDir;
         }
 

Launcher/WiiCompiled.Setup.Linux/WiiCompiled.Setup.Linux.csproj

@@ -6,7 +6,6 @@
     <Nullable>enable</Nullable>
     <AssemblyName>WiiCompiled.Setup.Linux</AssemblyName>
     <RootNamespace>WiiCompiled.Setup.Linux</RootNamespace>
-    <Version>0.2.32</Version>
     <Authors>patchzy</Authors>
     <Product>WiiCompiled</Product>
     <Description>Command-line installer and launcher for WiiCompiled on Linux</Description>

Launcher/WiiCompiled.Setup.Windows/ProductRepairService.cs

@@ -110,8 +110,7 @@ internal sealed class ProductRepairService
                     InputValidation.CurrentRetroWfcPayloadUri, payloadScratch, cancellationToken);
             }
             catch (Exception ex) when (!cancellationToken.IsCancellationRequested &&
-                                       ex is HttpRequestException or IOException or InvalidDataException
-                                           or InvalidOperationException or OperationCanceledException)
+                                       ex is HttpRequestException or TimeoutException or IOException)
             {
                 payloadSnapshot = RecoverInstalledRetroWfcPayload(toolkitFingerprint,
                     Path.Combine(scratchRoot, "retro-wfc-payload-recovered"), ex, cancellationToken);

Launcher/WiiCompiled.Setup.Windows/Program.cs

@@ -1,5 +1,6 @@
 namespace WiiCompiled.Setup.Windows;
 
+using System.Reflection;
 using System.Runtime.InteropServices;
 
 internal static class Program
@@ -121,7 +122,9 @@ internal static class PlatformChecks
 internal static class ProductInfo
 {
     public const string Name = "WiiCompiled";
-    public const string Version = "0.2.32";
+    public static readonly string Version =
+        typeof(ProductInfo).Assembly.GetCustomAttribute<AssemblyInformationalVersionAttribute>()!
+            .InformationalVersion;
 
     /// <summary>
     /// The setup executable is copied into the installation under this name. It is the launcher and

Launcher/WiiCompiled.Setup.Windows/WiiCompiled.Setup.Windows.csproj

@@ -7,7 +7,6 @@
     <AssemblyName>WiiCompiled.Setup</AssemblyName>
     <RootNamespace>WiiCompiled.Setup.Windows</RootNamespace>
     <ApplicationManifest>app.manifest</ApplicationManifest>
-    <Version>0.2.32</Version>
     <Authors>patchzy</Authors>
     <Product>WiiCompiled</Product>
     <Description>Command-line installer and launcher for WiiCompiled</Description>

Launcher/build-appimage.sh

@@ -128,9 +128,9 @@ cp -a "$workspace/Launcher/artifacts/portable-tools/toolchain-$appimagetool_arch
 
 # Precompiled aurora + third-party package (see Prepare-NativePrebuilt.sh) so a user's own
 # local-build.sh never has to compile aurora itself (~43% of local build CPU time). Re-harvesting
-# recompiles the whole aurora/Crypto++ closure with the toolchain above, so this is skipped unless
+# recompiles the aurora/Crypto++/mbed TLS closure with the toolchain above, so this is skipped unless
 # --print-fingerprint-only (a fast, build-free check) says the existing package no longer matches
-# the current compiler/flags/aurora/third_party sources.
+# the current compiler, flags, source trees or mbed TLS pin.
 native_prebuilt_dir="$workspace/Launcher/artifacts/native-prebuilt-$appimagetool_arch"
 echo "Checking whether the precompiled aurora + third-party package ($appimagetool_arch) is current..."
 current_fingerprint=$(bash "$script_dir/Prepare-NativePrebuilt.sh" --arch "$appimagetool_arch" --print-fingerprint-only)
@@ -148,6 +148,7 @@ fields = {
     "flag_fingerprint": "FlagFingerprint",
     "aurora_fingerprint": "AuroraSourceFingerprint",
     "third_party_fingerprint": "ThirdPartySourceFingerprint",
+    "mbedtls_fingerprint": "MbedTlsFingerprint",
 }
 print(1 if all(provenance.get(v) == current.get(k) for k, v in fields.items()) else 0)
 PY

Launcher/local-build-macos.command

@@ -22,7 +22,7 @@ Usage: local-build-macos.command --output-dir DIR [options]
   --retro-rewind-package-dir DIR  RetroRewind6 directory (required for Retro Rewind)
   --retro-wfc-offline-dir DIR     Directory containing binary/payload.RMCPD00.bin
   --skip-retro-wfc-payload        Build Retro Rewind without the shared Retro-WFC payload
-  --force-clean-build             Delete local generated and native-build-macos caches
+  --force-clean-build             Delete local generated and current-architecture native build caches
   --parallel N                    Pin translation and build parallelism
   --cmake PATH --ninja PATH       Override build tools
   --dotnet PATH                   Override dotnet
@@ -56,7 +56,9 @@ while (($#)); do
 done
 
 [[ $(uname -s) == Darwin ]] || fail 'this build script is for macOS only'
-[[ $(uname -m) == arm64 ]] || fail 'the current macOS product target is Apple Silicon only'
+macos_arch=$(uname -m)
+case "$macos_arch" in arm64|x86_64) ;; *) fail "unsupported macOS architecture: $macos_arch" ;; esac
+macos_deployment_target=12.0
 workspace=$(cd "$workspace" && pwd)
 [[ -n "$output_dir" ]] || fail '--output-dir is required'
 case "$profile" in base|retro-rewind|both) ;; *) fail '--profile must be base, retro-rewind, or both' ;; esac
@@ -73,7 +75,8 @@ for tool in "$cmake_bin" "$ninja_bin" clang clang++ shasum; do command -v "$tool
 
 project="$workspace/projects/mkwii/recomp.yml"; assets="$workspace/Assets"; generated="$workspace/generated"
 functions="$generated/functions"; metadata="$generated/base_translation_output.json"; manifest_dir="$workspace/build/base"
-manifest="$manifest_dir/mkwii_base_manifest.json"; shards="$generated/build_shards"; native_build="$workspace/native-build-macos"
+manifest="$manifest_dir/mkwii_base_manifest.json"; shards="$generated/build_shards"
+native_build="$workspace/native-build-macos-$macos_arch"
 assert_file "$project" 'translation project'
 if [[ -n "$game" ]]; then "$script_dir/macos/extract-disc.command" --game "$game" --assets-dir "$assets" --nodtool "$nodtool"; fi
 assert_file "$assets/main.dol" 'extracted main.dol'; assert_file "$assets/StaticR.rel" 'extracted StaticR.rel'
@@ -131,9 +134,11 @@ if (( builds_retro )); then args+=(--resolved-profile "$mod_out/resolved_dispatc
 step emit-build-shards 'Preparing native build shards'; translator "${args[@]}"
 
 step configure-native 'Configuring the native toolchain'
-"$cmake_bin" -S "$workspace/runtime" -B "$native_build" -G Ninja -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ -DCMAKE_MAKE_PROGRAM="$ninja_bin" -DMKW_TRANSLATED_COMPILE_JOBS="$translated_jobs"
+# Use Aurora's pinned SDL3 source on macOS.  A system SDL3 can be older than
+# Aurora's required API even when find_package() succeeds.
+"$cmake_bin" -S "$workspace/runtime" -B "$native_build" -G Ninja -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ -DCMAKE_MAKE_PROGRAM="$ninja_bin" -DCMAKE_OSX_ARCHITECTURES="$macos_arch" -DCMAKE_OSX_DEPLOYMENT_TARGET="$macos_deployment_target" -DMKW_TRANSLATED_COMPILE_JOBS="$translated_jobs" -DAURORA_SDL3_PROVIDER=vendor
 targets=(); [[ "$profile" != retro-rewind ]] && targets+=(WiiCompiled); [[ "$profile" != base ]] && targets+=(RetroRewind)
 step compile "Compiling ${targets[*]} locally"; "$cmake_bin" --build "$native_build" --target "${targets[@]}" --parallel "$global_jobs"
-if [[ "$profile" != retro-rewind ]]; then "$script_dir/macos/publish-app.command" --build-dir "$native_build" --product WiiCompiled --output-dir "${base_output_dir:-$output_dir}"; fi
-if (( builds_retro )); then "$script_dir/macos/publish-app.command" --build-dir "$native_build" --product RetroRewind --output-dir "$output_dir"; fi
+if [[ "$profile" != retro-rewind ]]; then "$script_dir/macos/publish-app.command" --build-dir "$native_build" --product WiiCompiled --output-dir "${base_output_dir:-$output_dir}" --architecture "$macos_arch" --minimum-system-version "$macos_deployment_target"; fi
+if (( builds_retro )); then "$script_dir/macos/publish-app.command" --build-dir "$native_build" --product RetroRewind --output-dir "$output_dir" --architecture "$macos_arch" --minimum-system-version "$macos_deployment_target"; fi
 printf 'MKWCBUILD:OUTPUT=%s\n' "$output_dir"

Launcher/macos/build-setup-pkg.command

@@ -9,45 +9,97 @@ fail() { printf 'build-setup-pkg.command: error: %s\n' "$*" >&2; exit 1; }
 copy_clean() { DITTONORSRC=1 ditto --norsrc --noqtn "$@"; }
 usage() {
     cat <<'EOF'
-Usage: build-setup-pkg.command --nodtool PATH --translator PATH --cmake-root DIR --ninja PATH --output PKG [options]
+Usage: build-setup-pkg.command --nodtool-arm64 PATH --nodtool-x86_64 PATH --translator-arm64 PATH --translator-x86_64 PATH --cmake-root DIR --ninja-arm64 PATH --ninja-x86_64 PATH --output PKG [options]
 
 Creates a game-code-free WiiCompiled Setup.pkg. The supplied tools must be
-maintainer-verified, redistributable macOS arm64 artifacts. The resulting pkg
-is unsigned unless --installer-identity is supplied; releases should sign and
-notarize it with a Developer ID Installer certificate.
+maintainer-verified, redistributable macOS artifacts for both arm64 and
+x86_64. The setup package selects native tools for its host while the game is
+compiled locally for that host architecture. CMake must be universal2. The
+resulting pkg is unsigned unless
+--installer-identity is supplied; releases should sign and notarize it with a
+Developer ID Installer certificate.
 
   --workspace DIR             Repository root (default: script's grandparent)
-  --version VERSION           Bundle/package version (default: 0.1.0)
+  --version VERSION           Bundle/package version (default: project version, or 0.1.0)
   --installer-identity NAME   Developer ID Installer identity for productbuild
 EOF
 }
 
 script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
-workspace=$(cd "$script_dir/../.." && pwd); nodtool=""; translator=""; cmake_root=""; ninja=""; output=""; version=0.1.0; identity=""
+workspace=$(cd "$script_dir/../.." && pwd); nodtool_arm64=""; nodtool_x86_64=""; translator_arm64=""; translator_x86_64=""; cmake_root=""; ninja_arm64=""; ninja_x86_64=""; output=""; version=0.1.0; identity=""
+version_supplied=false
 while (($#)); do
     case "$1" in
         --workspace) workspace=${2:-}; shift 2 ;;
-        --nodtool) nodtool=${2:-}; shift 2 ;;
-        --translator) translator=${2:-}; shift 2 ;;
+        --nodtool-arm64) nodtool_arm64=${2:-}; shift 2 ;;
+        --nodtool-x86_64) nodtool_x86_64=${2:-}; shift 2 ;;
+        --translator-arm64) translator_arm64=${2:-}; shift 2 ;;
+        --translator-x86_64) translator_x86_64=${2:-}; shift 2 ;;
         --cmake-root) cmake_root=${2:-}; shift 2 ;;
-        --ninja) ninja=${2:-}; shift 2 ;;
+        --ninja-arm64) ninja_arm64=${2:-}; shift 2 ;;
+        --ninja-x86_64) ninja_x86_64=${2:-}; shift 2 ;;
         --output) output=${2:-}; shift 2 ;;
-        --version) version=${2:-}; shift 2 ;;
+        --version) version=${2:-}; version_supplied=true; shift 2 ;;
         --installer-identity) identity=${2:-}; shift 2 ;;
         -h|--help) usage; exit 0 ;;
         *) fail "unknown option: $1" ;;
     esac
 done
 version=${version#v}
+if [[ "$version_supplied" == false ]]; then
+    local_csproj="$workspace/Launcher/Directory.Build.props"
+    if [[ -f "$local_csproj" ]]; then
+        detected=$(grep -m1 '<Version>' "$local_csproj" | sed -E 's/.*<Version>([^<]+)<\/Version>.*/\1/' || true)
+        if [[ -n "$detected" ]]; then
+            version="$detected"
+        fi
+    fi
+fi
 [[ "$version" =~ ^[0-9]+(\.[0-9]+){0,2}$ ]] || fail '--version must contain one to three period-separated integers'
 IFS=. read -r version_major version_minor version_patch <<< "$version"
 short_version="$version_major.${version_minor:-0}.${version_patch:-0}"
-for tool in pkgbuild productbuild ditto codesign; do command -v "$tool" >/dev/null || fail "required macOS tool unavailable: $tool"; done
-[[ -x "$nodtool" ]] || fail '--nodtool must name an executable'
-[[ -x "$translator" ]] || fail '--translator must name an executable'
+for tool in pkgbuild productbuild ditto codesign lipo; do command -v "$tool" >/dev/null || fail "required macOS tool unavailable: $tool"; done
+for tool_path in "$nodtool_arm64" "$nodtool_x86_64" "$translator_arm64" "$translator_x86_64" "$ninja_arm64" "$ninja_x86_64"; do [[ -x "$tool_path" ]] || fail 'each architecture-specific tool must name an executable'; done
 [[ -x "$cmake_root/bin/cmake" ]] || fail '--cmake-root must contain bin/cmake'
-[[ -x "$ninja" ]] || fail '--ninja must name an executable'
-"$nodtool" --version >/dev/null || fail '--nodtool did not run successfully'
+require_arch() {
+    local artifact=$1 arch=$2 label=$3
+    lipo "$artifact" -verify_arch "$arch" >/dev/null 2>&1 || fail "$label must contain a $arch slice: $artifact"
+}
+require_arch "$nodtool_arm64" arm64 '--nodtool-arm64'; require_arch "$nodtool_x86_64" x86_64 '--nodtool-x86_64'
+require_arch "$translator_arm64" arm64 '--translator-arm64'; require_arch "$translator_x86_64" x86_64 '--translator-x86_64'
+require_arch "$ninja_arm64" arm64 '--ninja-arm64'; require_arch "$ninja_x86_64" x86_64 '--ninja-x86_64'
+lipo "$cmake_root/bin/cmake" -verify_arch arm64 x86_64 >/dev/null 2>&1 || fail '--cmake-root/bin/cmake must be universal2'
+
+# Slice checks above prevent accidental cross-architecture packaging. Exercise
+# each supplied executable as well: an incorrectly bundled runtime can have a
+# valid Mach-O header but still fail before the setup app can use it. Apple
+# Silicon maintainers validate Intel tools through Rosetta when it is present.
+host_arch=$(uname -m)
+run_for_arch() {
+    local arch=$1 label=$2
+    shift 2
+    if [[ "$arch" == "$host_arch" ]]; then
+        "$@" >/dev/null || fail "$label did not run successfully"
+    elif [[ "$host_arch" == arm64 && "$arch" == x86_64 ]] && /usr/bin/arch -x86_64 /usr/bin/true >/dev/null 2>&1; then
+        /usr/bin/arch -x86_64 "$@" >/dev/null || fail "$label did not run successfully under Rosetta"
+    else
+        # Intel hosts cannot execute arm64 binaries. The slice remains checked
+        # above; CI or an Apple Silicon maintainer must execute that tool set.
+        printf 'build-setup-pkg.command: warning: unable to execute %s on %s; architecture slice was verified, but run it in %s CI before release\n' \
+            "$label" "$host_arch" "$arch" >&2
+    fi
+}
+for arch in arm64 x86_64; do
+    if [[ "$arch" == arm64 ]]; then
+        nodtool=$nodtool_arm64; translator=$translator_arm64; ninja=$ninja_arm64
+    else
+        nodtool=$nodtool_x86_64; translator=$translator_x86_64; ninja=$ninja_x86_64
+    fi
+    run_for_arch "$arch" "--nodtool-$arch" "$nodtool" --version
+    run_for_arch "$arch" "--translator-$arch" "$translator" --help
+    run_for_arch "$arch" "--ninja-$arch" "$ninja" --version
+done
+run_for_arch "$host_arch" '--cmake-root/bin/cmake' "$cmake_root/bin/cmake" --version
 workspace=$(cd "$workspace" && pwd); output=$(cd "$(dirname "$output")" && pwd)/$(basename "$output")
 stage=$(mktemp -d "${TMPDIR:-/tmp}/wiicompiled-pkg.XXXXXX")
 trap 'rm -rf "$stage"' EXIT
@@ -64,7 +116,7 @@ cat > "$app/Contents/Info.plist" <<EOF
 <key>CFBundlePackageType</key><string>APPL</string>
 <key>CFBundleShortVersionString</key><string>$short_version</string>
 <key>CFBundleVersion</key><string>$version</string>
-<key>LSMinimumSystemVersion</key><string>14.0</string>
+<key>LSMinimumSystemVersion</key><string>12.0</string>
 </dict></plist>
 EOF
 cat > "$app/Contents/MacOS/WiiCompiledSetup" <<'EOF'
@@ -103,11 +155,17 @@ copy_clean "$workspace/Launcher/local-build-macos.command" "$resources/workspace
 copy_clean "$workspace/Launcher/macos/extract-disc.command" "$resources/workspace/Launcher/macos/extract-disc.command"
 copy_clean "$workspace/Launcher/macos/publish-app.command" "$resources/workspace/Launcher/macos/publish-app.command"
 chmod +x "$resources/workspace/Launcher/local-build-macos.command" "$resources/workspace/Launcher/macos/"*.command
-mkdir -p "$resources/tools/cmake"
-copy_clean "$nodtool" "$resources/tools/nodtool"; chmod +x "$resources/tools/nodtool"
-copy_clean "$translator" "$resources/tools/Translator.Cli"; chmod +x "$resources/tools/Translator.Cli"
+# setup.command uses this marker to update source inputs in an existing user
+# workspace without replacing extracted game assets or Retro Rewind files.
+printf '%s\n' "$version" > "$resources/workspace/.bundle-version"
+mkdir -p "$resources/tools/cmake" "$resources/tools/arm64" "$resources/tools/x86_64"
+copy_clean "$nodtool_arm64" "$resources/tools/arm64/nodtool"; chmod +x "$resources/tools/arm64/nodtool"
+copy_clean "$nodtool_x86_64" "$resources/tools/x86_64/nodtool"; chmod +x "$resources/tools/x86_64/nodtool"
+copy_clean "$translator_arm64" "$resources/tools/arm64/Translator.Cli"; chmod +x "$resources/tools/arm64/Translator.Cli"
+copy_clean "$translator_x86_64" "$resources/tools/x86_64/Translator.Cli"; chmod +x "$resources/tools/x86_64/Translator.Cli"
 copy_clean "$cmake_root" "$resources/tools/cmake"
-copy_clean "$ninja" "$resources/tools/ninja"; chmod +x "$resources/tools/ninja"
+copy_clean "$ninja_arm64" "$resources/tools/arm64/ninja"; chmod +x "$resources/tools/arm64/ninja"
+copy_clean "$ninja_x86_64" "$resources/tools/x86_64/ninja"; chmod +x "$resources/tools/x86_64/ninja"
 copy_clean "$workspace/LICENSE" "$resources/LICENSE"
 copy_clean "$workspace/THIRD-PARTY-NOTICES.md" "$resources/THIRD-PARTY-NOTICES.md"
 codesign --force --deep --sign - "$app"

Launcher/macos/macos-x86_64-toolchain.cmake

@@ -0,0 +1,11 @@
+# Cross-compile a thin x86_64 macOS build from an Apple Silicon Mac.
+# Pass this file on the first configure with:
+#   -DCMAKE_TOOLCHAIN_FILE=/absolute/path/to/macos-x86_64-toolchain.cmake
+#
+# CMAKE_SYSTEM_PROCESSOR is deliberately declared here rather than inferred
+# from CMAKE_OSX_ARCHITECTURES, so target-aware CMake dependencies select their
+# x86_64 artifacts.
+set(CMAKE_SYSTEM_NAME Darwin)
+set(CMAKE_SYSTEM_PROCESSOR x86_64)
+set(CMAKE_OSX_ARCHITECTURES x86_64 CACHE STRING
+    "Target macOS architectures" FORCE)

Launcher/macos/publish-app.command

@@ -5,28 +5,36 @@ set -euo pipefail
 fail() { printf 'publish-app.command: error: %s\n' "$*" >&2; exit 1; }
 usage() {
     cat <<'EOF'
-Usage: publish-app.command --build-dir DIR --product {WiiCompiled|RetroRewind} --output-dir DIR
+Usage: publish-app.command --build-dir DIR --product {WiiCompiled|RetroRewind} --output-dir DIR [options]
 
 Copies a locally built product and its runtime assets into OUTPUT-DIR/<product>.app.
 It bundles non-system dylibs, rewrites their install names, and ad-hoc signs the
 result. This is suitable for local use; a release must replace ad-hoc signing
 with the project's Developer ID signing and notarization process.
+
+  --architecture {arm64|x86_64}       Required architecture of the compiled product (default: host)
+  --minimum-system-version VERSION    App bundle minimum macOS version (default: 12.0)
 EOF
 }
 
-build_dir=""; product=""; output_dir=""
+build_dir=""; product=""; output_dir=""; architecture=$(uname -m); minimum_system_version=12.0
 while (($#)); do
     case "$1" in
         --build-dir) build_dir=${2:-}; shift 2 ;;
         --product) product=${2:-}; shift 2 ;;
         --output-dir) output_dir=${2:-}; shift 2 ;;
+        --architecture) architecture=${2:-}; shift 2 ;;
+        --minimum-system-version) minimum_system_version=${2:-}; shift 2 ;;
         -h|--help) usage; exit 0 ;;
         *) fail "unknown option: $1" ;;
     esac
 done
 [[ "$product" == WiiCompiled || "$product" == RetroRewind ]] || fail '--product must be WiiCompiled or RetroRewind'
-for tool in codesign ditto install_name_tool otool; do command -v "$tool" >/dev/null || fail "required macOS tool is unavailable: $tool"; done
+[[ "$architecture" == arm64 || "$architecture" == x86_64 ]] || fail '--architecture must be arm64 or x86_64'
+[[ "$minimum_system_version" =~ ^[0-9]+(\.[0-9]+){1,2}$ ]] || fail '--minimum-system-version must contain two or three period-separated integers'
+for tool in codesign ditto install_name_tool lipo otool; do command -v "$tool" >/dev/null || fail "required macOS tool is unavailable: $tool"; done
 [[ -x "$build_dir/$product" ]] || fail "missing compiled product: $build_dir/$product"
+lipo "$build_dir/$product" -verify_arch "$architecture" || fail "compiled product is not $architecture: $build_dir/$product"
 for asset in dsp_coef.bin initial_pipeline_cache.db cacert.pem wii_bootstrap; do [[ -e "$build_dir/$asset" ]] || fail "missing runtime asset: $build_dir/$asset"; done
 
 app="$output_dir/$product.app"
@@ -47,7 +55,7 @@ cat > "$app/Contents/Info.plist" <<EOF
   <key>CFBundlePackageType</key><string>APPL</string>
   <key>CFBundleShortVersionString</key><string>0.1.0</string>
   <key>CFBundleVersion</key><string>1</string>
-  <key>LSMinimumSystemVersion</key><string>14.0</string>
+  <key>LSMinimumSystemVersion</key><string>$minimum_system_version</string>
   <key>NSHighResolutionCapable</key><true/>
 </dict></plist>
 EOF
@@ -57,25 +65,96 @@ for asset in dsp_coef.bin initial_pipeline_cache.db cacert.pem wii_bootstrap; do
     ln -s "../Resources/$asset" "$macos/$asset"
 done
 
-# Build a closure of Homebrew dylibs. System libraries remain system references.
-queue=("$macos/$product")
+# Expand each image's rpaths before inheriting them, so @loader_path stays
+# relative to the image that declared it rather than a descendant library.
+expanded_rpaths() {
+    local target=$1 rpath
+    while IFS= read -r rpath; do
+        case "$rpath" in
+            @loader_path/*) rpath="$(dirname "$target")/${rpath#@loader_path/}" ;;
+            @loader_path) rpath="$(dirname "$target")" ;;
+            @executable_path/*) rpath="$build_dir/${rpath#@executable_path/}" ;;
+            @executable_path) rpath="$build_dir" ;;
+        esac
+        printf '%s\n' "$rpath"
+    done < <(otool -l "$target" | awk '
+/LC_RPATH/ { rpath = 1; next }
+rpath && /^[[:space:]]*path / {
+    sub(/^[[:space:]]*path[[:space:]]+/, "");
+    sub(/[[:space:]]+\(offset[[:space:]]+[0-9]+\)$/, "");
+    print;
+    rpath = 0;
+}')
+}
+
+# Resolve a non-system dependency using the current image's rpaths followed
+# by the inherited loader stack, matching dyld's dependency-chain search.
+dependency_path() {
+    local current=$1 dependency=$2 search_rpaths=$3 rpath candidate
+    case "$dependency" in
+        /System/Library/*|/usr/lib/*)
+            return 1
+            ;;
+        /*)
+            [[ -f "$dependency" ]] && { printf '%s\n' "$dependency"; return 0; }
+            ;;
+        @loader_path/*)
+            candidate="$(dirname "$current")/${dependency#@loader_path/}"
+            [[ -f "$candidate" ]] && { printf '%s\n' "$candidate"; return 0; }
+            ;;
+        @executable_path/*)
+            candidate="$build_dir/${dependency#@executable_path/}"
+            [[ -f "$candidate" ]] && { printf '%s\n' "$candidate"; return 0; }
+            ;;
+        @rpath/*|*.dylib)
+            local subpath
+            if [[ "$dependency" == @rpath/* ]]; then
+                subpath="${dependency#@rpath/}"
+            else
+                subpath="$dependency"
+            fi
+            while IFS= read -r rpath; do
+                [[ -n "$rpath" ]] || continue
+                candidate="$rpath/$subpath"
+                [[ -f "$candidate" ]] && { printf '%s\n' "$candidate"; return 0; }
+            done <<< "$search_rpaths"
+            ;;
+    esac
+    return 1
+}
+
+# Build a closure of non-system dylibs. System libraries remain system
+# references, while every resolved dependency is copied beside the executable.
+queue=("$build_dir/$product")
+queue_rpaths=("")
 while ((${#queue[@]})); do
     current=${queue[0]}
+    inherited_rpaths=${queue_rpaths[0]}
     queue=("${queue[@]:1}")
+    queue_rpaths=("${queue_rpaths[@]:1}")
+    current_rpaths=$(expanded_rpaths "$current")
+    if [[ -n "$inherited_rpaths" ]]; then
+        current_rpaths="${current_rpaths}${current_rpaths:+$'\n'}$inherited_rpaths"
+    fi
+    self_id=$(otool -D "$current" 2>/dev/null | tail -n +2 | sed -nE 's/^[[:space:]]*(.*)[[:space:]]*$/\1/p' || true)
     while IFS= read -r dependency; do
-        [[ "$dependency" == /opt/homebrew/* || "$dependency" == /usr/local/* ]] || continue
-        [[ -f "$dependency" ]] || continue
-        name=$(basename "$dependency")
+        [[ -z "$dependency" ]] && continue
+        [[ -n "$self_id" && "$dependency" == "$self_id" ]] && continue
+        case "$dependency" in
+            /System/Library/*|/usr/lib/*) continue ;;
+        esac
+        dep_path=$(dependency_path "$current" "$dependency" "$current_rpaths") || fail "unresolved non-system dependency: '$dependency' needed by '$current'"
+        name=$(basename "$dep_path")
         if [[ ! -f "$frameworks/$name" ]]; then
-            ditto "$dependency" "$frameworks/$name"
+            ditto "$dep_path" "$frameworks/$name"
             install_name_tool -id "@rpath/$name" "$frameworks/$name"
-            queue+=("$frameworks/$name")
+            queue+=("$dep_path")
+            queue_rpaths+=("$current_rpaths")
         fi
-    done < <(otool -L "$current" | tail -n +2 | awk '{print $1}')
+    done < <(otool -L "$current" | tail -n +2 | sed -nE 's/^[[:space:]]*(.*)[[:space:]]+\(compatibility version .*/\1/p')
 done
 while IFS= read -r binary; do
     while IFS= read -r old; do
-        [[ "$old" == /opt/homebrew/* || "$old" == /usr/local/* ]] || continue
         name=$(basename "$old")
         [[ -f "$frameworks/$name" ]] || continue
         if [[ "$binary" == "$macos/$product" ]]; then
@@ -83,7 +162,7 @@ while IFS= read -r binary; do
         else
             install_name_tool -change "$old" "@loader_path/$name" "$binary"
         fi
-    done < <(otool -L "$binary" | tail -n +2 | awk '{print $1}')
+    done < <(otool -L "$binary" | tail -n +2 | sed -nE 's/^[[:space:]]*(.*)[[:space:]]+\(compatibility version .*/\1/p')
 done < <(find "$frameworks" -type f -print; printf '%s\n' "$macos/$product")
 
 find "$frameworks" -type f -exec codesign --force --sign - {} +

Launcher/macos/setup.command

@@ -5,10 +5,7 @@ set -euo pipefail
 
 resources=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 workspace_source="$resources/workspace"
-nodtool="$resources/tools/nodtool"
-translator="$resources/tools/Translator.Cli"
 cmake_bin="$resources/tools/cmake/bin/cmake"
-ninja_bin="$resources/tools/ninja"
 support_root="$HOME/Library/Application Support/WiiCompiled"
 workspace="$support_root/BuildWorkspace"
 products="$support_root/Products"
@@ -36,6 +33,13 @@ while (($#)); do
 done
 [[ "$install_location" == user || "$install_location" == applications ]] || fail '--install-location must be user or applications'
 
+host_arch=$(uname -m)
+case "$host_arch" in arm64|x86_64) ;; *) fail "unsupported macOS architecture: $host_arch" ;; esac
+host_tools="$resources/tools/$host_arch"
+nodtool="$host_tools/nodtool"
+translator="$host_tools/Translator.Cli"
+ninja_bin="$host_tools/ninja"
+
 if [[ -z "$game" ]]; then
     game=$(/usr/bin/osascript <<'APPLESCRIPT'
 set selectedFile to choose file with prompt "Choose your clean Mario Kart Wii PAL (RMCP01) disc image"
@@ -60,12 +64,37 @@ if ! /usr/bin/xcode-select -p >/dev/null 2>&1; then
     /usr/bin/xcode-select --install || true
     exit 1
 fi
+for tool in "$nodtool" "$translator" "$cmake_bin" "$ninja_bin"; do
+    /usr/bin/lipo "$tool" -verify_arch "$host_arch" >/dev/null 2>&1 || \
+        fail "the packaged $(basename "$tool") does not support $host_arch"
+done
 
 mkdir -p "$support_root" "$products"
-if [[ ! -d "$workspace/.git" && ! -f "$workspace/projects/mkwii/recomp.yml" ]]; then
+source_bundle_version="$workspace_source/.bundle-version"
+workspace_bundle_version="$workspace/.bundle-version"
+needs_workspace_refresh=0
+if [[ ! -f "$workspace/projects/mkwii/recomp.yml" ]]; then
+    needs_workspace_refresh=1
+elif [[ -f "$source_bundle_version" ]] && [[ ! -f "$workspace_bundle_version" || "$(<"$source_bundle_version")" != "$(<"$workspace_bundle_version")" ]]; then
+    needs_workspace_refresh=1
+fi
+
+if (( needs_workspace_refresh )); then
     printf 'Preparing the local build workspace...\n'
-    rm -rf "$workspace"
-    /usr/bin/ditto "$workspace_source" "$workspace"
+    if [[ ! -d "$workspace" ]]; then
+        /usr/bin/ditto "$workspace_source" "$workspace"
+    else
+        # Refresh only packaged source inputs. Assets and the staged Retro
+        # Rewind package belong to the user and stay in place.
+        for source in aurora-main projects runtime translator Launcher; do
+            rm -rf "$workspace/$source"
+            /usr/bin/ditto "$workspace_source/$source" "$workspace/$source"
+        done
+        /usr/bin/ditto "$source_bundle_version" "$workspace_bundle_version"
+        # A dependency provider can be cached in this directory, so make the
+        # refreshed sources configure from a clean native build tree.
+        rm -rf "$workspace/native-build-macos-arm64" "$workspace/native-build-macos-x86_64"
+    fi
 fi
 
 profile=base
@@ -77,26 +106,40 @@ if [[ -n "$retro_dir" ]]; then
     # verify its pinned signature before publishing it into the local cache.
     retro_wfc_dir="$support_root/RetroWfcPayload"
     retro_wfc_payload="$retro_wfc_dir/binary/payload.RMCPD00.bin"
-    if [[ -f "$retro_wfc_payload" ]] && ! "$translator" validate-retro-wfc-payload --directory "$retro_wfc_dir"; then
-        printf 'Discarding an invalid cached Retro-WFC payload...\n' >&2
-        rm -f "$retro_wfc_payload"
+    cached_payload_valid=0
+    if [[ -f "$retro_wfc_payload" ]]; then
+        if "$translator" validate-retro-wfc-payload --directory "$retro_wfc_dir"; then
+            cached_payload_valid=1
+        else
+            printf 'Discarding an invalid cached Retro-WFC payload...\n' >&2
+            rm -f "$retro_wfc_payload"
+        fi
     fi
-    if [[ ! -f "$retro_wfc_payload" ]]; then
-        printf 'Downloading the Retro-WFC payload needed for online play...\n'
-        mkdir -p "$retro_wfc_dir"
-        payload_stage=$(mktemp -d "$retro_wfc_dir/.payload-download.XXXXXX")
-        temporary_payload="$payload_stage/binary/payload.RMCPD00.bin"
-        mkdir -p "$(dirname "$temporary_payload")"
-        trap 'rm -rf "$payload_stage"' EXIT
-        /usr/bin/curl --fail --silent --show-error --connect-timeout 10 --max-time 30 \
-            --retry 1 --output "$temporary_payload" \
-            'https://rwfc.net/api/wfc/payload?g=RMCPD00' || fail 'could not download the Retro-WFC payload needed for online play'
+
+    # A signed cache may still be an older vulnerable revision, so always attempt to replace it
+    # with the current signed snapshot. A transport failure may fall back to the verified cache;
+    # a downloaded snapshot with an invalid signature remains a hard failure.
+    printf 'Downloading the current Retro-WFC payload needed for online play...\n'
+    mkdir -p "$retro_wfc_dir"
+    payload_stage=$(mktemp -d "$retro_wfc_dir/.payload-download.XXXXXX")
+    temporary_payload="$payload_stage/binary/payload.RMCPD00.bin"
+    mkdir -p "$(dirname "$temporary_payload")"
+    trap 'rm -rf "$payload_stage"' EXIT
+    if /usr/bin/curl --fail --silent --show-error --connect-timeout 10 --max-time 30 \
+        --retry 1 --output "$temporary_payload" \
+        'https://rwfc.net/api/wfc/payload?g=RMCPD00'; then
         "$translator" validate-retro-wfc-payload --directory "$payload_stage" || \
             fail 'downloaded Retro-WFC payload failed signature validation'
         mkdir -p "$retro_wfc_dir/binary"
         mv "$temporary_payload" "$retro_wfc_payload"
         rmdir "$payload_stage/binary" "$payload_stage"
         trap - EXIT
+    elif (( cached_payload_valid )); then
+        printf 'Could not download the current Retro-WFC payload; using the previously verified cached payload.\n' >&2
+        rm -rf "$payload_stage"
+        trap - EXIT
+    else
+        fail 'could not download the current Retro-WFC payload and no valid cached payload is available'
     fi
     build_args+=(--profile both --base-output-dir "$products" --retro-rewind-package-dir "$retro_dir" --retro-wfc-offline-dir "$retro_wfc_dir")
 fi

Launcher/macos/test-publish-app.command

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+# Exercise a real dyld dependency chain before and after app packaging.
+set -euo pipefail
+
+[[ $(uname -s) == Darwin ]] || { printf 'This test requires macOS.\n' >&2; exit 1; }
+script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+temp_root=$(cd "${TMPDIR:-/tmp}" && pwd)
+test_root=$(mktemp -d "$temp_root/wiicompiled-publish-test.XXXXXX")
+[[ "$test_root" == "$temp_root"/wiicompiled-publish-test.* ]] || exit 1
+trap 'rm -rf "$test_root"' EXIT
+
+build_dir="$test_root/build with spaces"
+output_dir="$test_root/output with spaces"
+mkdir -p "$build_dir/A/b" "$build_dir/A/c" "$build_dir/wii_bootstrap" "$output_dir"
+cat > "$test_root/c.c" <<'EOF'
+int value_c(void) { return 7; }
+EOF
+cat > "$test_root/b.c" <<'EOF'
+extern int value_c(void);
+int value_b(void) { return 2 * value_c(); }
+EOF
+cat > "$test_root/a.c" <<'EOF'
+extern int value_b(void);
+int value_a(void) { return 1 + value_b(); }
+EOF
+cat > "$test_root/main.c" <<'EOF'
+#include <stdio.h>
+extern int value_a(void);
+int main(void) { printf("%d\n", value_a()); return 0; }
+EOF
+
+clang -dynamiclib "$test_root/c.c" -o "$build_dir/A/c/libC.dylib" \
+    -Wl,-headerpad_max_install_names -Wl,-install_name,@rpath/libC.dylib
+clang -dynamiclib "$test_root/b.c" -o "$build_dir/A/b/libB.dylib" \
+    -L "$build_dir/A/c" -lC \
+    -Wl,-headerpad_max_install_names -Wl,-install_name,@rpath/libB.dylib
+clang -dynamiclib "$test_root/a.c" -o "$build_dir/A/libA.dylib" \
+    -L "$build_dir/A/b" -lB \
+    -Wl,-headerpad_max_install_names -Wl,-install_name,@rpath/libA.dylib \
+    -Wl,-rpath,@loader_path/b -Wl,-rpath,@loader_path/c
+clang "$test_root/main.c" -o "$build_dir/WiiCompiled" \
+    -L "$build_dir/A" -lA \
+    -Wl,-headerpad_max_install_names -Wl,-rpath,@executable_path/A
+
+# B has no rpaths: its C dependency must inherit A's loader-relative path.
+[[ $("$build_dir/WiiCompiled") == 15 ]]
+for asset in dsp_coef.bin initial_pipeline_cache.db cacert.pem; do
+    : > "$build_dir/$asset"
+done
+bash "$script_dir/publish-app.command" --build-dir "$build_dir" \
+    --product WiiCompiled --output-dir "$output_dir" --architecture "$(uname -m)"
+for name in libA.dylib libB.dylib libC.dylib; do
+    [[ -f "$output_dir/WiiCompiled.app/Contents/Frameworks/$name" ]]
+done
+
+# Remove access to the original paths and relocate the app before executing.
+mv "$build_dir" "$test_root/hidden build"
+mkdir "$test_root/relocated app"
+mv "$output_dir/WiiCompiled.app" "$test_root/relocated app/WiiCompiled.app"
+[[ $("$test_root/relocated app/WiiCompiled.app/Contents/MacOS/WiiCompiled") == 15 ]]
+printf 'publish-app dependency-chain test passed\n'

Launcher/prepare-portable-tools.sh

@@ -225,7 +225,7 @@ EOF
 # clang++ invocation above would not catch a broken CMAKE_ROOT (Modules/Templates) or a Ninja that
 # can't find the compiler.
 cat > "$test_dir/CMakeLists.txt" <<'EOF'
-cmake_minimum_required(VERSION 3.16)
+cmake_minimum_required(VERSION 3.25)
 project(test CXX)
 add_executable(test t.cpp)
 EOF

README.md

@@ -11,6 +11,7 @@
   <a href="#building-from-source"><img alt="PowerPC static recompilation" src="https://img.shields.io/badge/PowerPC-static%20recompilation-FF9F0A"></a>
   <a href="#retro-rewind"><img alt="Retro Rewind supported" src="https://img.shields.io/badge/Retro%20Rewind-supported-FF375F"></a>
   <a href="https://github.com/TeamWheelWizard/WheelWizard/releases"><img alt="Install with Wheel Wizard" src="https://img.shields.io/badge/install%20with-Wheel%20Wizard-8B5CF6"></a>
+  <a href="https://github.com/patchzyy/Wiicompiled/releases"><img alt="Total downloads" src="https://img.shields.io/github/downloads/patchzyy/Wiicompiled/total?color=00B8D9&amp;logo=github"></a>
   <a href="LICENSE"><img alt="License: GPLv3" src="https://img.shields.io/badge/license-GPLv3-2EA44F?logo=gnu&amp;logoColor=white"></a>
 </p>
 
@@ -52,12 +53,16 @@ Play at several times the console's resolution.
 **Music ducking.** 
 Start playing something else, Spotify, a YouTube video, and
 the game automatically mutes its own music until the other audio stops. Optional, if you'd
-rather it didn't. All audio that shows in your display media controls on your windows pc fall under this.
+rather it didn't. Windows uses system media controls and Linux uses MPRIS players.
+On macOS 14.2 or later, this detects other apps with active audio output and excludes
+the game's own audio. Apps that keep an output stream running silently can keep
+game music muted even when nothing is audible.
 
 **An in-game settings bar.** 
 Press **F10** while the game window has focus:
 - Internal resolution
 - FPS counter
+- MetalFX spatial upscaling on supported macOS GPUs
 - Controller assignment for all four ports
 - Full per-controller button mapping, including the bumpers
 - Dolphin-syntax input expressions and GCPadNew.ini import
@@ -96,8 +101,8 @@ Known limitations of the Wii Remote path:
 - GPU: GTX 1650 / RX 6400 / Arc A310 or higher
 - CPU: Intel Core i5-8400 / AMD Ryzen 5 2600 (4c/6c, ~3.5GHz+) or higher
 - About 20 GB of free disk space during installation (Final game size ~5 GB)
-- macOS 14 (Sonoma) or later on Apple Silicon
-- On macOS, Apple Xcode Command Line Tools (Setup opens Apple's installer when they are missing)
+- macOS 12 (Monterey) or later on Apple Silicon (`arm64`) or Intel (`x86_64-v3`); pre-Haswell Intel CPUs are unsupported
+- On macOS, a Metal-capable GPU and Apple Xcode Command Line Tools (Setup opens Apple's installer when they are missing)
 - A clean, unmodified **PAL `RMCP01`** disc image of Mario Kart Wii, dumped by you. ISO, GCM,
   GCZ, CISO, WBFS, WIA and RVZ are accepted.
 
@@ -118,6 +123,21 @@ image under Settings, turn on **WiiCompiled (beta)**, and hit install from the H
 Wheel Wizard downloads the setup tool from this repo and walks you through install, updates and
 launching. The backend itself is deliberately command-line only, Wheel Wizard is a wrapper around it.
 
+### macOS
+
+Download `WiiCompiled-Setup.pkg` from this repository's Releases page and open it. The universal
+package selects the appropriate bundled tools for the host architecture, supporting both Apple Silicon (`arm64`)
+and Intel (`x86_64`) Macs. It installs **WiiCompiled Setup** in Applications; open that app, choose
+your clean PAL `RMCP01` disc image, and select either the base game or Retro Rewind. For Retro Rewind, choose the `RetroRewind6` folder
+or its parent folder.
+
+Setup verifies and extracts the image locally, then translates and compiles the native app on your
+Mac. On a first run it may ask macOS to install Xcode Command Line Tools; complete Apple's installer,
+then open Setup again. When the build completes, Setup asks for administrator approval once to install
+`WiiCompiled.app` (and, if selected, `RetroRewind.app`) in `/Applications`.
+
+Setup opens Terminal while it works, so the extraction and build progress—and any error that needs
+reporting—remain visible.
 
 > [!CAUTION]
 > Only take builds from this repository's

THIRD-PARTY-NOTICES.md

@@ -132,7 +132,7 @@ trees themselves (fetched by `Launcher/Prepare-Dependencies.ps1`) so end-user bu
 | Abseil | LTS 20240722.0 | Apache-2.0 | <https://github.com/abseil/abseil-cpp> |
 | Dear ImGui | 1.91.9b-docking | MIT | <https://github.com/ocornut/imgui> |
 | {fmt} | 11.1.4 | MIT | <https://github.com/fmtlib/fmt> |
-| xxHash | 0.8.3 | BSD-2-Clause | <https://github.com/Cyan4973/xxHash> |
+| xxHash | 0.8.4 | BSD-2-Clause | <https://github.com/Cyan4973/xxHash> |
 | zlib | 1.3.2 | zlib | <https://github.com/madler/zlib> |
 | libpng | 1.6.58 | PNG Reference Library License v2 | <https://github.com/pnggroup/libpng> |
 | FreeType | 2.14.3 | **FreeType License (FTL)** - see below | <https://freetype.org/> |

aurora-main/CMakeLists.txt

@@ -2,6 +2,7 @@ cmake_minimum_required(VERSION 3.25)
 project(aurora LANGUAGES C CXX)
 if (APPLE)
     enable_language(OBJC)
+    enable_language(OBJCXX)
 endif()
 set(CMAKE_C_STANDARD 11)
 set(CMAKE_CXX_STANDARD 20)
@@ -83,3 +84,10 @@ if (CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR AND NOT CMAKE_CROSSCOMPIL
   enable_testing()
   add_subdirectory(tests)
 endif ()
+
+option(AURORA_BUILD_METALFX_PRESENTATION_TEST "Build the macOS MetalFX presentation test" OFF)
+if (AURORA_BUILD_METALFX_PRESENTATION_TEST AND APPLE AND AURORA_ENABLE_GX AND DAWN_ENABLE_METAL AND AURORA_METALFX_FRAMEWORK)
+    add_executable(metalfx_presentation_test tests/metalfx_interop/presentation_test.cpp)
+    target_include_directories(metalfx_presentation_test PRIVATE lib)
+    target_link_libraries(metalfx_presentation_test PRIVATE aurora::core aurora::gx aurora::vi dawn::webgpu_dawn)
+endif ()

aurora-main/cmake/AuroraDawnProvider.cmake

@@ -48,7 +48,7 @@ if (_aurora_dawn_provider STREQUAL "auto")
     set(_has_package TRUE)
   elseif (CMAKE_SYSTEM_NAME STREQUAL "Linux" AND CMAKE_SYSTEM_PROCESSOR MATCHES "^(x86_64|aarch64)$")
     set(_has_package TRUE)
-  elseif (APPLE AND CMAKE_SYSTEM_PROCESSOR MATCHES "^(arm64|x86_64)$")
+  elseif (APPLE AND (CMAKE_SYSTEM_PROCESSOR MATCHES "^(arm64|x86_64)$" OR CMAKE_OSX_ARCHITECTURES MATCHES "^(arm64|x86_64)$"))
     set(_has_package TRUE)
   endif ()
 
@@ -101,7 +101,7 @@ if (_aurora_dawn_provider STREQUAL "vendor")
     include(FetchContent)
     FetchContent_Declare(dawn
       URL "https://github.com/google/dawn/archive/refs/tags/${AURORA_DAWN_VERSION}.tar.gz"
-      DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+      DOWNLOAD_EXTRACT_TIMESTAMP FALSE
       EXCLUDE_FROM_ALL
     )
     FetchContent_MakeAvailable(dawn)
@@ -143,6 +143,10 @@ elseif (_aurora_dawn_provider STREQUAL "package")
   if (NOT AURORA_DAWN_PACKAGE_URL)
     string(TOLOWER "${CMAKE_SYSTEM_NAME}" _dawn_system)
     string(TOLOWER "${CMAKE_SYSTEM_PROCESSOR}" _dawn_arch)
+    if (APPLE AND CMAKE_OSX_ARCHITECTURES)
+      list(GET CMAKE_OSX_ARCHITECTURES 0 _dawn_osx_arch)
+      string(TOLOWER "${_dawn_osx_arch}" _dawn_arch)
+    endif ()
     if (_dawn_system STREQUAL "windows")
       if (_dawn_arch STREQUAL "x86_64")
         set(_dawn_arch "amd64")
@@ -194,7 +198,7 @@ elseif (_aurora_dawn_provider STREQUAL "package")
   FetchContent_Declare(dawn_prebuilt
     URL "${AURORA_DAWN_PACKAGE_URL}"
     ${_dawn_prebuilt_hash_argument}
-    DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+    DOWNLOAD_EXTRACT_TIMESTAMP FALSE
   )
   FetchContent_MakeAvailable(dawn_prebuilt)
 

aurora-main/cmake/AuroraLibUSB.cmake

@@ -7,7 +7,7 @@
 include(FetchContent)
 FetchContent_Declare(libusb
   URL "https://github.com/libusb/libusb/releases/download/v${AURORA_LIBUSB_VERSION}/libusb-${AURORA_LIBUSB_VERSION}.tar.bz2"
-  DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+  DOWNLOAD_EXTRACT_TIMESTAMP FALSE
 )
 # Upstream ships no CMakeLists.txt, so this only populates the source tree.
 FetchContent_MakeAvailable(libusb)

aurora-main/cmake/AuroraNodProvider.cmake

@@ -120,7 +120,7 @@ elseif (_aurora_nod_provider STREQUAL "package")
   include(FetchContent)
   FetchContent_Declare(nod_prebuilt
     URL "${AURORA_NOD_PACKAGE_URL}"
-    DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+    DOWNLOAD_EXTRACT_TIMESTAMP FALSE
     EXCLUDE_FROM_ALL
   )
   FetchContent_MakeAvailable(nod_prebuilt)

aurora-main/cmake/AuroraSDL3Patches.cmake

@@ -32,6 +32,52 @@ function(aurora_sdl3_apply_patches sdl_source_dir)
   if (NOT EXISTS "${_wii}")
     message(FATAL_ERROR "aurora: SDL3 source tree at ${sdl_source_dir} has no SDL_hidapi_wii.c")
   endif ()
+  set(_rumble "${sdl_source_dir}/src/joystick/hidapi/SDL_hidapi_rumble.c")
+  if (NOT EXISTS "${_rumble}")
+    message(FATAL_ERROR "aurora: SDL3 source tree at ${sdl_source_dir} has no SDL_hidapi_rumble.c")
+  endif ()
+  set(_hidapi "${sdl_source_dir}/src/joystick/hidapi/SDL_hidapijoystick.c")
+  if (NOT EXISTS "${_hidapi}")
+    message(FATAL_ERROR "aurora: SDL3 source tree at ${sdl_source_dir} has no SDL_hidapijoystick.c")
+  endif ()
+
+  # Backport of SDL 71f4af732 (drop once SDL includes it): rumble writes must not hold dev_lock.
+  _aurora_sdl3_replace("${_rumble}" "HIDAPI rumble writes no longer hold the device lock"
+[==[        if (request) {
+            SDL_LockMutex(request->device->dev_lock);
+            if (request->device->dev) {
+#ifdef DEBUG_RUMBLE
+                HIDAPI_DumpPacket("Rumble packet: size = %d", request->data, request->size);
+#endif
+                SDL_hid_write(request->device->dev, request->data, request->size);
+            }
+            SDL_UnlockMutex(request->device->dev_lock);
+]==]
+[==[        if (request) {
+            if (request->device->dev) {
+#ifdef DEBUG_RUMBLE
+                HIDAPI_DumpPacket("Rumble packet: size = %d", request->data, request->size);
+#endif
+                SDL_hid_write(request->device->dev, request->data, request->size);
+            }
+]==])
+
+  # Without the lock, closing the handle must wait for in-flight rumble writes.
+  _aurora_sdl3_replace("${_hidapi}" "HIDAPI device close waits for pending rumble"
+[==[    device->driver->FreeDevice(device);
+    device->driver = NULL;
+
+    SDL_LockMutex(device->dev_lock);
+]==]
+[==[    device->driver->FreeDevice(device);
+    device->driver = NULL;
+
+    while (SDL_GetAtomicInt(&device->rumble_pending) > 0) {
+        SDL_Delay(10);
+    }
+
+    SDL_LockMutex(device->dev_lock);
+]==])
 
   # Wii Remote: rebuild the joystick in place after an extension change.
   #

aurora-main/cmake/AuroraSDL3Provider.cmake

@@ -41,7 +41,10 @@ if (_aurora_sdl3_provider STREQUAL "auto")
     set(_aurora_sdl3_provider "package")
   else ()
     set(CMAKE_FIND_PACKAGE_TARGETS_GLOBAL ON)
-    find_package(SDL3 QUIET)
+    # Aurora uses APIs from the SDL version pinned by AURORA_SDL3_VERSION.
+    # Do not silently select an older system package and fail later while
+    # compiling its headers.
+    find_package(SDL3 ${AURORA_SDL3_VERSION} QUIET)
     set(CMAKE_FIND_PACKAGE_TARGETS_GLOBAL OFF)
     if (SDL3_FOUND)
       set(_aurora_sdl3_provider "system")
@@ -58,7 +61,7 @@ if (_aurora_sdl3_provider STREQUAL "system")
   message(STATUS "aurora: Using system SDL3 (provider=system)")
   if (NOT SDL3_FOUND)
     set(CMAKE_FIND_PACKAGE_TARGETS_GLOBAL ON)
-    find_package(SDL3 REQUIRED)
+    find_package(SDL3 ${AURORA_SDL3_VERSION} REQUIRED)
     set(CMAKE_FIND_PACKAGE_TARGETS_GLOBAL OFF)
   endif ()
   _aurora_sdl3_select_target()
@@ -92,7 +95,7 @@ elseif (_aurora_sdl3_provider STREQUAL "package")
   include(FetchContent)
   FetchContent_Declare(sdl3_prebuilt
     URL "${AURORA_SDL3_PACKAGE_URL}"
-    DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+    DOWNLOAD_EXTRACT_TIMESTAMP FALSE
   )
   FetchContent_MakeAvailable(sdl3_prebuilt)
 
@@ -145,7 +148,7 @@ elseif (_aurora_sdl3_provider STREQUAL "vendor")
     endif ()
     FetchContent_Declare(SDL
       URL "https://github.com/libsdl-org/SDL/releases/download/release-${AURORA_SDL3_VERSION}/SDL3-${AURORA_SDL3_VERSION}.tar.gz"
-      DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+      DOWNLOAD_EXTRACT_TIMESTAMP FALSE
       PATCH_COMMAND "${CMAKE_COMMAND}" -DSDL_SOURCE_DIR=<SOURCE_DIR> -P "${_aurora_sdl3_patches}"
       EXCLUDE_FROM_ALL
     )

aurora-main/cmake/aurora_core.cmake

@@ -34,6 +34,17 @@ if (AURORA_ENABLE_GX)
     target_compile_definitions(aurora_core PUBLIC AURORA_ENABLE_GX WEBGPU_DAWN)
     target_sources(aurora_core PRIVATE lib/webgpu/gpu.cpp lib/webgpu/gpu_cache.cpp lib/dawn/BackendBinding.cpp)
     target_link_libraries(aurora_core PRIVATE dawn::webgpu_dawn)
+    if (APPLE AND DAWN_ENABLE_METAL)
+        find_library(AURORA_METALFX_FRAMEWORK MetalFX)
+    endif ()
+    if (APPLE AND DAWN_ENABLE_METAL AND AURORA_METALFX_FRAMEWORK)
+        target_sources(aurora_core PRIVATE lib/webgpu/metalfx.mm)
+        set_source_files_properties(lib/webgpu/metalfx.mm PROPERTIES COMPILE_FLAGS -fobjc-arc)
+        target_link_options(aurora_core PUBLIC "LINKER:-weak_framework,MetalFX")
+        target_link_libraries(aurora_core PRIVATE "-framework IOSurface")
+    else ()
+        target_sources(aurora_core PRIVATE lib/webgpu/metalfx_stub.cpp)
+    endif ()
     if (DAWN_ENABLE_VULKAN)
         target_compile_definitions(aurora_core PRIVATE DAWN_ENABLE_BACKEND_VULKAN)
     endif ()
@@ -41,7 +52,9 @@ if (AURORA_ENABLE_GX)
         target_compile_definitions(aurora_core PRIVATE DAWN_ENABLE_BACKEND_METAL)
         target_sources(aurora_core PRIVATE lib/dawn/MetalBinding.mm)
         set_source_files_properties(lib/dawn/MetalBinding.mm PROPERTIES COMPILE_FLAGS -fobjc-arc)
-        target_link_options(aurora_core PUBLIC "LINKER:-weak_framework,Metal")
+        target_link_options(aurora_core PUBLIC
+            "LINKER:-weak_framework,Metal"
+            "LINKER:-U,_OBJC_CLASS_$_MTLLogStateDescriptor")
     endif ()
     if (DAWN_ENABLE_D3D11)
         target_compile_definitions(aurora_core PRIVATE DAWN_ENABLE_BACKEND_D3D11)

aurora-main/extern/CMakeLists.txt

@@ -16,10 +16,60 @@ function(aurora_find_package_global)
   set(CMAKE_FIND_PACKAGE_TARGETS_GLOBAL ${_PREV_FIND_PACKAGE_TARGETS_GLOBAL})
 endfunction()
 
+# A macOS build for another architecture must not discover Homebrew packages
+# built for its physical host. CMAKE_CROSSCOMPILING is not sufficient here:
+# Apple Clang can target another architecture through CMAKE_OSX_ARCHITECTURES
+# without CMake considering the configure a cross-build.
+set(_AURORA_EXCLUDE_HOST_HOMEBREW FALSE)
+if (APPLE AND CMAKE_OSX_ARCHITECTURES)
+  list(LENGTH CMAKE_OSX_ARCHITECTURES _AURORA_OSX_ARCH_COUNT)
+  if (_AURORA_OSX_ARCH_COUNT EQUAL 1)
+    list(GET CMAKE_OSX_ARCHITECTURES 0 _AURORA_TARGET_ARCH)
+    string(TOLOWER "${_AURORA_TARGET_ARCH}" _AURORA_TARGET_ARCH)
+    # hw.optional.arm64 identifies Apple Silicon even when CMake itself runs
+    # through Rosetta, where CMAKE_HOST_SYSTEM_PROCESSOR reports x86_64.
+    execute_process(
+      COMMAND /usr/sbin/sysctl -n hw.optional.arm64
+      RESULT_VARIABLE _AURORA_ARM64_PROBE_RESULT
+      OUTPUT_VARIABLE _AURORA_ARM64_PROBE
+      ERROR_QUIET
+      OUTPUT_STRIP_TRAILING_WHITESPACE)
+    if (_AURORA_ARM64_PROBE_RESULT EQUAL 0 AND _AURORA_ARM64_PROBE STREQUAL "1")
+      set(_AURORA_HOST_ARCH arm64)
+    else ()
+      execute_process(
+        COMMAND /usr/bin/uname -m
+        OUTPUT_VARIABLE _AURORA_HOST_ARCH
+        OUTPUT_STRIP_TRAILING_WHITESPACE)
+      string(TOLOWER "${_AURORA_HOST_ARCH}" _AURORA_HOST_ARCH)
+    endif ()
+    if (_AURORA_TARGET_ARCH STREQUAL "x86_64" AND _AURORA_HOST_ARCH MATCHES "^(arm64|aarch64)$")
+      list(APPEND CMAKE_IGNORE_PREFIX_PATH "/opt/homebrew")
+      set(_AURORA_EXCLUDE_HOST_HOMEBREW TRUE)
+    elseif (_AURORA_TARGET_ARCH MATCHES "^(arm64|aarch64)$" AND _AURORA_HOST_ARCH MATCHES "^(x86_64|amd64)$")
+      list(APPEND CMAKE_IGNORE_PREFIX_PATH "/usr/local")
+      set(_AURORA_EXCLUDE_HOST_HOMEBREW TRUE)
+    endif ()
+  endif ()
+endif ()
+
+if (_AURORA_EXCLUDE_HOST_HOMEBREW)
+  list(REMOVE_DUPLICATES CMAKE_IGNORE_PREFIX_PATH)
+  message(STATUS "aurora: cross-architecture macOS build; ignoring host Homebrew prefixes")
+endif ()
+
 if (AURORA_ENABLE_GX)
   include(${CMAKE_CURRENT_SOURCE_DIR}/../cmake/AuroraDawnProvider.cmake)
 endif ()
 
+# SDL's pkg-config probe can bypass CMake's prefix exclusion. macOS does not
+# need libusb for the supported SDL input paths, so keep that host-only library
+# out of a cross-architecture configure.
+if (_AURORA_EXCLUDE_HOST_HOMEBREW)
+  set(SDL_HIDAPI_LIBUSB OFF CACHE BOOL "" FORCE)
+  set(SDL_HIDAPI_LIBUSB_SHARED OFF CACHE BOOL "" FORCE)
+endif ()
+
 # Abseil is needed for core libraries. It normally comes via Dawn's vendor build.
 # Otherwise prefer a system package and only fetch it as a last resort.
 if (NOT TARGET absl::flat_hash_map OR NOT TARGET absl::btree)
@@ -38,7 +88,7 @@ else ()
   set(ABSL_PROPAGATE_CXX_STD ON)
   FetchContent_Declare(abseil-cpp
     URL https://github.com/abseil/abseil-cpp/archive/refs/tags/20240722.0.tar.gz
-    DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+    DOWNLOAD_EXTRACT_TIMESTAMP FALSE
     EXCLUDE_FROM_ALL
   )
   FetchContent_MakeAvailable(abseil-cpp)
@@ -52,10 +102,10 @@ include(${CMAKE_CURRENT_SOURCE_DIR}/../cmake/AuroraSDL3Provider.cmake)
 if (NOT TARGET xxhash)
   message(STATUS "aurora: Fetching xxhash")
   FetchContent_Declare(xxhash
-    URL https://github.com/Cyan4973/xxHash/archive/refs/tags/v0.8.3.tar.gz
-    URL_HASH SHA256=aae608dfe8213dfd05d909a57718ef82f30722c392344583d3f39050c7f29a80
-    SOURCE_SUBDIR cmake_unofficial
-    DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+    URL https://github.com/Cyan4973/xxHash/archive/refs/tags/v0.8.4.tar.gz
+    URL_HASH SHA256=5738270935e7c3d38a79b3adf7c9692566ce7895a25f67de43ad52ab504acd32
+    SOURCE_SUBDIR build/cmake
+    DOWNLOAD_EXTRACT_TIMESTAMP FALSE
     EXCLUDE_FROM_ALL
   )
   set(XXHASH_BUILD_XXHSUM OFF CACHE INTERNAL "Build the xxhsum binary")
@@ -78,7 +128,7 @@ if (NOT TARGET fmt)
   FetchContent_Declare(fmt
     URL https://github.com/fmtlib/fmt/archive/refs/tags/11.1.4.tar.gz
     URL_HASH SHA256=ac366b7b4c2e9f0dde63a59b3feb5ee59b67974b14ee5dc9ea8ad78aa2c1ee1e
-    DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+    DOWNLOAD_EXTRACT_TIMESTAMP FALSE
     EXCLUDE_FROM_ALL
   )
   FetchContent_MakeAvailable(fmt)
@@ -116,7 +166,7 @@ if (AURORA_ENABLE_GX)
       ZLIB
       URL https://github.com/madler/zlib/releases/download/v1.3.2/zlib-1.3.2.tar.gz
       URL_HASH SHA256=bb329a0a2cd0274d05519d61c667c062e06990d72e125ee2dfa8de64f0119d16
-      DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+      DOWNLOAD_EXTRACT_TIMESTAMP FALSE
       EXCLUDE_FROM_ALL
     )
     FetchContent_MakeAvailable(ZLIB)
@@ -152,7 +202,7 @@ if (AURORA_ENABLE_GX)
       PNG
       URL https://github.com/pnggroup/libpng/archive/refs/tags/v1.6.58.tar.gz
       URL_HASH SHA256=A9D4DF463D36A6E5F9C29BD6F4967312D17E996C1854F3511F833924EB1993CF
-      DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+      DOWNLOAD_EXTRACT_TIMESTAMP FALSE
       EXCLUDE_FROM_ALL
     )
     FetchContent_MakeAvailable(PNG)
@@ -176,7 +226,7 @@ if (AURORA_ENABLE_GX)
     FetchContent_Declare(Freetype
       URL https://files.twilitrealm.dev/freetype-2.14.3.tar.gz
       URL_HASH SHA256=e61b31ab26358b946e767ed7eb7f4bb2e507da1cfefeb7a8861ace7fd5c899a1
-      DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+      DOWNLOAD_EXTRACT_TIMESTAMP FALSE
       EXCLUDE_FROM_ALL
     )
     FetchContent_MakeAvailable(Freetype)
@@ -190,7 +240,7 @@ if (AURORA_ENABLE_GX)
     FetchContent_Declare(imgui
       URL https://github.com/ocornut/imgui/archive/refs/tags/v1.91.9b-docking.tar.gz
       URL_HASH SHA256=466fdef9b18de15f0bb6e288e3d00ffa3d82200ec458ce5e4f724a161d9528a5
-      DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+      DOWNLOAD_EXTRACT_TIMESTAMP FALSE
       EXCLUDE_FROM_ALL
     )
     FetchContent_MakeAvailable(imgui)
@@ -235,7 +285,7 @@ if (AURORA_ENABLE_GX)
     FetchContent_Declare(sqlite3
       URL https://sqlite.org/2026/sqlite-amalgamation-3510300.zip
       URL_HASH SHA256=acb1e6f5d832484bf6d32b681e858c38add8b2acdfd42ac5df24b8afb46552b4
-      DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+      DOWNLOAD_EXTRACT_TIMESTAMP FALSE
       EXCLUDE_FROM_ALL
     )
     FetchContent_MakeAvailable(sqlite3)
@@ -278,7 +328,7 @@ if (AURORA_ENABLE_GX)
       FetchContent_Declare(zstd
         URL https://github.com/facebook/zstd/releases/download/v1.5.7/zstd-1.5.7.tar.gz
         URL_HASH SHA256=eb33e51f49a15e023950cd7825ca74a4a2b43db8354825ac24fc1b7ee09e6fa3
-        DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+        DOWNLOAD_EXTRACT_TIMESTAMP FALSE
         SOURCE_SUBDIR build/cmake
         EXCLUDE_FROM_ALL
       )
@@ -299,7 +349,7 @@ if (NOT TARGET TracyClient)
           tracy
           URL https://github.com/wolfpld/tracy/archive/a64b9a20294d59421a2f57aeca3c6383d8c48169.tar.gz
           URL_HASH SHA256=24d342b5127d7f659dc3cf94f24347b348cc736f25b17a691fd7f69541937658
-          DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+          DOWNLOAD_EXTRACT_TIMESTAMP FALSE
           EXCLUDE_FROM_ALL
   )
   FetchContent_MakeAvailable(tracy)

aurora-main/include/aurora/aurora.h

@@ -170,6 +170,21 @@ void aurora_set_background_input(bool value);
 void aurora_set_display_mode(AuroraDisplayMode mode);
 AuroraDisplayMode aurora_get_display_mode();
 
+typedef enum {
+  AURORA_METALFX_DISABLED,
+  AURORA_METALFX_UNSUPPORTED,
+  AURORA_METALFX_NOT_UPSCALING,
+  AURORA_METALFX_ACTIVE,
+  AURORA_METALFX_ERROR,
+} AuroraMetalFXStatus;
+
+// Changes are consumed at the next sealed frame boundary. MetalFX only applies
+// when both source dimensions are smaller than the aspect-fitted output.
+void aurora_set_metalfx_spatial(bool enabled);
+bool aurora_get_metalfx_spatial();
+bool aurora_is_metalfx_spatial_supported();
+AuroraMetalFXStatus aurora_get_metalfx_status();
+
 AuroraBackend aurora_get_backend();
 const AuroraBackend* aurora_get_available_backends(size_t* count);
 

aurora-main/include/dolphin/gx/GXAurora.h

@@ -88,6 +88,7 @@ typedef enum _AuroraViewportPolicy {
   AURORA_VIEWPORT_FIT = 0,     // Preserve logical aspect in the content framebuffer
   AURORA_VIEWPORT_STRETCH = 1, // Match content framebuffer aspect to the native surface
   AURORA_VIEWPORT_NATIVE = 2,  // Use active framebuffer pixels directly
+  AURORA_VIEWPORT_16_9 = 3,    // Fixed 16:9 content with bars on other surfaces
 } AuroraViewportPolicy;
 
 /**

aurora-main/lib/aurora.cpp

@@ -7,6 +7,7 @@
 #include "gx/shader_info.hpp"
 #include "imgui.hpp"
 #include "webgpu/gpu.hpp"
+#include "webgpu/metalfx.hpp"
 #include <webgpu/webgpu_cpp.h>
 #endif
 
@@ -60,6 +61,9 @@ std::atomic<AuroraFrameWorkerWaitCallback> g_frameWorkerWaitCallback{nullptr};
 // deadlines derived from it, so the presenter cannot drift. Zero means present when ready.
 std::atomic<uint64_t> g_presentScheduleBaseNanos{0};
 std::atomic<uint64_t> g_presentScheduleIntervalNanos{0};
+std::atomic<bool> g_metalfxRequested{false};
+std::atomic<bool> g_metalfxSupported{false};
+std::atomic<AuroraMetalFXStatus> g_metalfxStatus{AURORA_METALFX_DISABLED};
 
 namespace {
 Module Log("aurora");
@@ -765,6 +769,9 @@ AuroraInfo initialize(int argc, char* argv[], const AuroraConfig& config) noexce
 #ifdef AURORA_ENABLE_GX
   gfx::initialize();
 
+  g_metalfxSupported.store(webgpu::metalfx::supported(g_device, webgpu::g_backendType));
+  g_metalfxStatus.store(AURORA_METALFX_DISABLED);
+
   imgui::create_context();
 #endif
   const auto size = window::get_window_size();
@@ -1187,12 +1194,114 @@ void stop_presenter() noexcept {
   g_presenterStarted.store(false, std::memory_order_release);
 }
 
+struct MetalFXSlot {
+  webgpu::metalfx::Size size{};
+  std::unique_ptr<webgpu::metalfx::SpatialScaler> scaler;
+  wgpu::BindGroup bindGroup;
+};
+std::array<MetalFXSlot, gx::MaxInterpolatedFrames + 1> g_metalfxSlots;
+size_t g_metalfxNextSlot = 0;
+webgpu::metalfx::SpatialScaler* g_metalfxPendingOutput = nullptr;
+bool g_metalfxFailed = false;
+
+void metalfx_failed(const std::string& reason) {
+  Log.warn("MetalFX spatial upscaling disabled: {}; using normal presentation", reason);
+  g_metalfxFailed = true;
+  g_metalfxStatus.store(AURORA_METALFX_ERROR);
+  g_metalfxPendingOutput = nullptr;
+  g_metalfxSlots = {};
+}
+
+wgpu::BindGroup upscale_presentation(wgpu::CommandEncoder& encoder,
+                                     const webgpu::PresentSource& source,
+                                     const webgpu::Viewport& viewport, bool enabled) {
+  if (!enabled) {
+    g_metalfxSlots = {};
+    g_metalfxFailed = false;
+    g_metalfxStatus.store(AURORA_METALFX_DISABLED);
+    return {};
+  }
+  if (!g_metalfxSupported.load()) {
+    g_metalfxStatus.store(AURORA_METALFX_UNSUPPORTED);
+    return {};
+  }
+  if (g_metalfxFailed) return {};
+  const webgpu::metalfx::Size size{
+      source.size.width, source.size.height,
+      static_cast<uint32_t>(viewport.width), static_cast<uint32_t>(viewport.height),
+      webgpu::g_graphicsConfig.surfaceConfiguration.format,
+  };
+  // The existing copy path samples perceptual values from unorm game images.
+  // Do not introduce implicit sRGB decoding or downscaling into MetalFX.
+  if (!size.inputWidth || !size.inputHeight || size.inputWidth >= size.outputWidth ||
+      size.inputHeight >= size.outputHeight ||
+      (source.format != wgpu::TextureFormat::RGBA8Unorm && source.format != wgpu::TextureFormat::BGRA8Unorm)) {
+    g_metalfxStatus.store(AURORA_METALFX_NOT_UPSCALING);
+    return {};
+  }
+  auto& slot = g_metalfxSlots[g_metalfxNextSlot++ % g_metalfxSlots.size()];
+  if (!slot.scaler || !(slot.size == size)) {
+    slot = {};
+    std::string error;
+    slot.scaler = webgpu::metalfx::create(g_instance, g_device, size, error);
+    if (!slot.scaler) {
+      if (error.empty()) g_metalfxStatus.store(AURORA_METALFX_NOT_UPSCALING);
+      else metalfx_failed(error);
+      return {};
+    }
+    slot.size = size;
+    wgpu::SamplerDescriptor samplerDescriptor{};
+    samplerDescriptor.magFilter = wgpu::FilterMode::Linear;
+    samplerDescriptor.minFilter = wgpu::FilterMode::Linear;
+    slot.bindGroup = webgpu::create_copy_bind_group(slot.scaler->output_view(),
+                                                   g_device.CreateSampler(&samplerDescriptor));
+    Log.info("MetalFX spatial slot: {}x{} -> {}x{}", size.inputWidth, size.inputHeight,
+             size.outputWidth, size.outputHeight);
+  }
+  if (!slot.scaler->begin_input()) {
+    metalfx_failed(slot.scaler->error());
+    return {};
+  }
+  const wgpu::RenderPassColorAttachment attachment{
+      .view = slot.scaler->input_view(),
+      .loadOp = wgpu::LoadOp::Clear,
+      .storeOp = wgpu::StoreOp::Store,
+  };
+  const wgpu::RenderPassDescriptor descriptor{
+      .label = "MetalFX input copy",
+      .colorAttachmentCount = 1,
+      .colorAttachments = &attachment,
+  };
+  auto pass = encoder.BeginRenderPass(&descriptor);
+  pass.SetPipeline(webgpu::g_CopyPipeline);
+  pass.SetBindGroup(0, source.bindGroup);
+  pass.SetViewport(0, 0, static_cast<float>(size.inputWidth), static_cast<float>(size.inputHeight), 0, 1);
+  pass.Draw(3);
+  pass.End();
+  // Submit the sealed scene and input copy before crossing to the native queue.
+  // The replacement encoder composites the upscaled image and ImGui normally.
+  auto buffer = encoder.Finish();
+  {
+    std::lock_guard submitLock(g_queueSubmitMutex);
+    g_queue.Submit(1, &buffer);
+  }
+  encoder = g_device.CreateCommandEncoder();
+  if (!slot.scaler->upscale()) {
+    metalfx_failed(slot.scaler->error());
+    return {};
+  }
+  g_metalfxPendingOutput = slot.scaler.get();
+  g_metalfxStatus.store(AURORA_METALFX_ACTIVE);
+  return slot.bindGroup;
+}
+
 // `presentSource` is latched in the seal prologue: by the time this encodes, the producer's next
 // gfx::begin_frame() may already have cleared the display-copy override.
-void encode_presentation_snapshot(const wgpu::CommandEncoder& encoder,
-                                  const webgpu::PresentSource& presentSource,
-                                  const PresentationImage& image,
-                                  bool includeImGui) {
+wgpu::BindGroup encode_presentation_snapshot(wgpu::CommandEncoder& encoder,
+                                              const webgpu::PresentSource& presentSource,
+                                              const PresentationImage& image,
+                                              bool includeImGui, bool metalfxEnabled,
+                                              const wgpu::BindGroup* cachedMetalFXOutput = nullptr) {
   ZoneScoped;
   auto viewport = webgpu::calculate_present_viewport(
       image.texture.size.width, image.texture.size.height, presentSource.size.width,
@@ -1203,6 +1312,13 @@ void encode_presentation_snapshot(const wgpu::CommandEncoder& encoder,
         image.texture.size.width, image.texture.size.height, presentAspect);
   }
   wgpu::BindGroup presentBindGroup = presentSource.bindGroup;
+  wgpu::BindGroup newMetalFXOutput;
+  if (cachedMetalFXOutput && *cachedMetalFXOutput) {
+    presentBindGroup = *cachedMetalFXOutput;
+  } else if (auto upscaled = upscale_presentation(encoder, presentSource, viewport, metalfxEnabled)) {
+    presentBindGroup = std::move(upscaled);
+    newMetalFXOutput = presentBindGroup;
+  }
   {
     const std::array attachments{
         wgpu::RenderPassColorAttachment{
@@ -1243,6 +1359,7 @@ void encode_presentation_snapshot(const wgpu::CommandEncoder& encoder,
     imgui::render(pass);
     pass.End();
   }
+  return newMetalFXOutput;
 }
 #endif
 
@@ -1251,6 +1368,13 @@ void shutdown() noexcept {
 #ifdef AURORA_ENABLE_GX
   stop_presenter();
   g_presentationImagePools = {};
+  g_metalfxSlots = {};
+  g_metalfxPendingOutput = nullptr;
+  g_metalfxNextSlot = 0;
+  g_metalfxFailed = false;
+  g_metalfxRequested.store(false);
+  g_metalfxSupported.store(false);
+  g_metalfxStatus.store(AURORA_METALFX_DISABLED);
   imgui::shutdown();
   gfx::shutdown();
   webgpu::shutdown();
@@ -1363,6 +1487,7 @@ struct SealedFrameContext {
   uint32_t logicalFrame = 0;
   bool interpolationActive = false;
   bool replayInterpolatedFrames = false;
+  bool metalfxEnabled = false;
 };
 
 // Phase 1: everything that touches producer-shared renderer state. Needs g_rendererGpuMutex and
@@ -1390,6 +1515,7 @@ void seal_frame_locked(gfx::SealedFrame& sealedFrame, SealedFrameContext& ctx) {
   ctx.snapshotWidth = (std::max)(windowSize.native_fb_width, 1u);
   ctx.snapshotHeight = (std::max)(windowSize.native_fb_height, 1u);
   ctx.logicalFrame = gfx::current_frame();
+  ctx.metalfxEnabled = g_metalfxRequested.load();
   // Latched before webgpu::clear_present_source_override() in the producer's
   // next gfx::begin_frame().
   ctx.presentSource = webgpu::current_present_source();
@@ -1437,10 +1563,14 @@ std::vector<PresentationJob> encode_sealed_frame(gfx::SealedFrame& sealedFrame,
   const wgpu::CommandBufferDescriptor cmdBufDescriptor{
       .label = "Presentation slot command buffer",
   };
-  const auto submitEncodedSlot = [&](wgpu::CommandEncoder& target) {
+  const auto submitEncodedSlot = [&](wgpu::CommandEncoder& target, bool releaseMetalFXOutput = true) {
     const auto buffer = target.Finish(&cmdBufDescriptor);
     std::lock_guard submitLock(g_queueSubmitMutex);
     g_queue.Submit(1, &buffer);
+    if (releaseMetalFXOutput && g_metalfxPendingOutput) {
+      if (!g_metalfxPendingOutput->end_output()) metalfx_failed(g_metalfxPendingOutput->error());
+      g_metalfxPendingOutput = nullptr;
+    }
   };
 
   if (ctx.replayInterpolatedFrames) {
@@ -1449,7 +1579,7 @@ std::vector<PresentationJob> encode_sealed_frame(gfx::SealedFrame& sealedFrame,
       gfx::render(sealedFrame, encoder, static_cast<int32_t>(interpolatedFrame), false);
       auto image =
           acquire_presentation_image(interpolatedFrame, ctx.snapshotWidth, ctx.snapshotHeight);
-      encode_presentation_snapshot(encoder, ctx.presentSource, *image, true);
+      encode_presentation_snapshot(encoder, ctx.presentSource, *image, true, ctx.metalfxEnabled);
       presentationJobs.push_back({
           .image = std::move(image),
           .logicalFrame = ctx.logicalFrame,
@@ -1467,12 +1597,18 @@ std::vector<PresentationJob> encode_sealed_frame(gfx::SealedFrame& sealedFrame,
   // The copy targets now hold this frame's resolves, so queue their readbacks on the same encoder;
   // completion is harvested in gfx::after_submit, never waited on here.
   gfx::efb_ram::encode_async_downloads(encoder);
+  wgpu::BindGroup duplicatedMetalFXOutput;
   if (!ctx.replayInterpolatedFrames) {
     for (uint32_t interpolatedFrame = 0; interpolatedFrame < ctx.interpolatedFrameCount;
          ++interpolatedFrame) {
       auto image =
           acquire_presentation_image(interpolatedFrame, ctx.snapshotWidth, ctx.snapshotHeight);
-      encode_presentation_snapshot(encoder, ctx.presentSource, *image, true);
+      const auto newMetalFXOutput = encode_presentation_snapshot(
+          encoder, ctx.presentSource, *image, true, ctx.metalfxEnabled,
+          duplicatedMetalFXOutput ? &duplicatedMetalFXOutput : nullptr);
+      if (!duplicatedMetalFXOutput && newMetalFXOutput) {
+        duplicatedMetalFXOutput = newMetalFXOutput;
+      }
       presentationJobs.push_back({
           .image = std::move(image),
           .logicalFrame = ctx.logicalFrame,
@@ -1480,13 +1616,14 @@ std::vector<PresentationJob> encode_sealed_frame(gfx::SealedFrame& sealedFrame,
           .interpolated = true,
           .duplicated = true,
       });
-      submitEncodedSlot(encoder);
+      submitEncodedSlot(encoder, false);
       encoder = g_device.CreateCommandEncoder(&encoderDescriptor);
     }
   }
   auto finalImage =
       acquire_presentation_image(ctx.interpolatedFrameCount, ctx.snapshotWidth, ctx.snapshotHeight);
-  encode_presentation_snapshot(encoder, ctx.presentSource, *finalImage, true);
+  encode_presentation_snapshot(encoder, ctx.presentSource, *finalImage, true, ctx.metalfxEnabled,
+                               duplicatedMetalFXOutput ? &duplicatedMetalFXOutput : nullptr);
   auto pendingFrameCapture = encode_frame_capture(encoder, ctx.presentSource);
   presentationJobs.push_back({
       .image = std::move(finalImage),
@@ -1962,3 +2099,7 @@ void aurora_set_background_input(bool value) {
 }
 void aurora_set_display_mode(AuroraDisplayMode mode) { aurora::window::set_display_mode(mode); }
 AuroraDisplayMode aurora_get_display_mode() { return aurora::window::get_display_mode(); }
+void aurora_set_metalfx_spatial(bool enabled) { aurora::g_metalfxRequested.store(enabled); }
+bool aurora_get_metalfx_spatial() { return aurora::g_metalfxRequested.load(); }
+bool aurora_is_metalfx_spatial_supported() { return aurora::g_metalfxSupported.load(); }
+AuroraMetalFXStatus aurora_get_metalfx_status() { return aurora::g_metalfxStatus.load(); }

aurora-main/lib/dolphin/gx/GXAurora.cpp

@@ -46,6 +46,7 @@ void AuroraSetViewportPolicy(AuroraViewportPolicy policy) {
   }
   g_gxState.viewportPolicy = policy;
   aurora::window::set_frame_buffer_aspect_fit(policy == AURORA_VIEWPORT_FIT);
+  aurora::window::set_force_aspect_16_9(policy == AURORA_VIEWPORT_16_9);
   aurora::window::set_present_surface_fill(policy == AURORA_VIEWPORT_STRETCH);
   if (changed) {
     // Reapply the guest viewport and scissor after a resize.

aurora-main/lib/dolphin/gx/GXDispList.cpp

@@ -66,7 +66,7 @@ void GXCallDisplayList(const void* data, u32 nbytes) {
 
   // Decode the display list immediately while its borrowed resources are valid.
   aurora::gx::fifo::drain();
-  aurora::gx::fifo::process(static_cast<const u8*>(data), nbytes, true);
+  aurora::gx::fifo::process_all(static_cast<const u8*>(data), nbytes, true);
 }
 
 void GXCallDisplayListLE(const void* data, u32 nbytes) {
@@ -84,6 +84,6 @@ void GXCallDisplayListLE(const void* data, u32 nbytes) {
   aurora::gx::fifo::drain();
 
   // Process the display list through the command processor (little-endian)
-  aurora::gx::fifo::process(static_cast<const u8*>(data), nbytes, false);
+  aurora::gx::fifo::process_all(static_cast<const u8*>(data), nbytes, false);
 }
 }

aurora-main/lib/dolphin/gx/GXFrameBuffer.cpp

@@ -520,11 +520,9 @@ void GXCopyTex(void* dest, GXBool clear) {
     clearState.clearAlpha = clear && alphaUpdate;
   }
   const auto copyFilter = combined_copy_filter_coefficients(g_gxState.copyFilterVFilter);
-  // Every GXCopyTex is observable texture data. Reusing a destination in this
-  // or the previous frame does not guarantee another redraw: menu thumbnail
-  // scratch targets can be reused and then retained. Depth copies have the
-  // same requirement. Only display presentation may skip unfinished draws.
-  const bool persistentCopy = true;
+  // Skip only recurring color copies so one-shot copies are never lost.
+  const bool producedConsecutively = handle.revision != 0 && currentFrame - handle.lastProducedFrame <= 1;
+  const bool persistentCopy = !aurora::gx::is_depth_format(texCopyFmt) && !producedConsecutively;
   aurora::gfx::resolve_pass(handle.handle, rect, clearState.clearColor, clearState.clearAlpha, clearState.clearDepth,
                             clearState.clearColorValue, aurora::gx::clear_depth_value(), resolveFmt,
                             &sourceRect.sampleRect, g_gxState.texCopyHalfScale, &copyFilter, forceOpaqueAlpha,

aurora-main/lib/dolphin/pad/pad.cpp

@@ -6,10 +6,10 @@
 #include <SDL3/SDL_mouse.h>
 #include <SDL3/SDL_joystick.h>
 
+#include <algorithm>
 #include <array>
 #include <atomic>
 #include <sys/stat.h>
-#include <ranges>
 
 namespace {
 constexpr int32_t k_mappingsFileVersion = 3;
@@ -354,7 +354,7 @@ BOOL PADInit() {
   }
   g_initialized = true;
 
-  std::ranges::for_each(g_keyboardBindings, [](auto& state) {
+  std::for_each(g_keyboardBindings.begin(), g_keyboardBindings.end(), [](auto& state) {
     state.m_buttonMapping = g_defaultKeys;
     state.m_axisMapping = g_defaultKeyAxis;
   });
@@ -399,19 +399,20 @@ const char* PADGetNameForControllerIndex(const u32 idx) {
 }
 
 void PADSetPortForIndex(const u32 idx, const u32 port) {
+  if (port >= PAD_MAX_CONTROLLERS) return;
   const auto* ctrl = __PADGetControllerForIndex(idx);
   if (ctrl == nullptr) {
     return;
   }
 
-  const int32_t oldPort = SDL_GetGamepadPlayerIndex(ctrl->m_controller);
+  const int32_t oldPort = aurora::input::player_index(ctrl->m_index);
   if (const auto* dest = aurora::input::get_controller_for_player(port); dest != nullptr && dest != ctrl) {
-    SDL_SetGamepadPlayerIndex(dest->m_controller, -1);
+    aurora::input::set_player_index(dest->m_index, -1);
   }
   if (oldPort >= 0 && oldPort != port) {
     aurora::input::persist_controller_for_player(oldPort, nullptr);
   }
-  SDL_SetGamepadPlayerIndex(ctrl->m_controller, static_cast<Sint32>(port));
+  aurora::input::set_player_index(ctrl->m_index, static_cast<Sint32>(port));
   aurora::input::persist_controller_for_player(port, ctrl);
 }
 
@@ -437,7 +438,7 @@ void PADClearPort(const u32 port) {
   if (ctrl == nullptr) {
     return;
   }
-  SDL_SetGamepadPlayerIndex(ctrl->m_controller, -1);
+  aurora::input::set_player_index(ctrl->m_index, -1);
 }
 
 // Secondary bindings live only in memory; the runtime re-applies them from its
@@ -646,8 +647,8 @@ static void EnsureMappingLoaded(aurora::input::GameController* controller) {
 
 static Sint16 _get_axis_value(const aurora::input::GameController* controller, //  NOLINT(*-reserved-identifier)
                               PADAxis axis) {
-  const auto iter =
-      std::ranges::find_if(controller->m_axisMapping, [axis](const auto& pair) { return pair.padAxis == axis; });
+  const auto iter = std::find_if(controller->m_axisMapping.begin(), controller->m_axisMapping.end(),
+                                 [axis](const auto& pair) { return pair.padAxis == axis; });
   if (iter == controller->m_axisMapping.end()) {
     return 0;
   }
@@ -737,8 +738,8 @@ u32 PADRead(PADStatus* status) {
 
     status[i].err = PAD_ERR_NONE;
     if (g_keyboardBindings[i].m_mappingsSet && SDL_GetKeyboardFocus() != nullptr) {
-      std::ranges::for_each(
-          g_keyboardBindings[i].m_buttonMapping, [&kbState, &numKeys, &i, &status](const PADKeyButtonBinding& mapping) {
+      std::for_each(g_keyboardBindings[i].m_buttonMapping.begin(), g_keyboardBindings[i].m_buttonMapping.end(),
+                    [&kbState, &numKeys, &i, &status](const PADKeyButtonBinding& mapping) {
             if (mapping.scancode > PAD_KEY_INVALID && mapping.scancode < numKeys && kbState[mapping.scancode]) {
               status[i].button |= mapping.padButton;
             } else if (is_mouse_scancode(mapping.scancode) && is_mouse_button_pressed(mapping.scancode)) {
@@ -845,8 +846,8 @@ u32 PADRead(PADStatus* status) {
 
       bool leftTriggerSet = false;
       bool rightTriggerSet = false;
-      std::ranges::for_each(controller->m_buttonMapping, [&controller, &i, &status, &leftTriggerSet,
-                                                          &rightTriggerSet](const auto& mapping) {
+      std::for_each(controller->m_buttonMapping.begin(), controller->m_buttonMapping.end(),
+                    [&controller, &i, &status, &leftTriggerSet, &rightTriggerSet](const auto& mapping) {
         if (is_native_binding_pressed(controller->m_controller, mapping.nativeButton)) {
           status[i].button |= mapping.padButton;
         }
@@ -859,8 +860,8 @@ u32 PADRead(PADStatus* status) {
         }
       });
 
-      std::ranges::for_each(controller->m_altButtonMapping, [&controller, &i, &status, &leftTriggerSet,
-                                                             &rightTriggerSet](const auto& mapping) {
+      std::for_each(controller->m_altButtonMapping.begin(), controller->m_altButtonMapping.end(),
+                    [&controller, &i, &status, &leftTriggerSet, &rightTriggerSet](const auto& mapping) {
         if (mapping.nativeButton == PAD_NATIVE_BUTTON_INVALID) {
           return;
         }
@@ -1189,8 +1190,8 @@ void PADSetButtonMapping(const u32 port, const PADButtonMapping mapping) {
     return;
   }
 
-  const auto iter = std::ranges::find_if(controller->m_buttonMapping,
-                                         [mapping](const auto& pair) { return mapping.padButton == pair.padButton; });
+  const auto iter = std::find_if(controller->m_buttonMapping.begin(), controller->m_buttonMapping.end(),
+                                 [mapping](const auto& pair) { return mapping.padButton == pair.padButton; });
   if (iter == controller->m_buttonMapping.end()) {
     return;
   }
@@ -1223,8 +1224,8 @@ void PADSetAltButtonMapping(const u32 port, const PADButtonMapping mapping) {
     return;
   }
 
-  const auto iter = std::ranges::find_if(controller->m_altButtonMapping,
-                                         [mapping](const auto& pair) { return mapping.padButton == pair.padButton; });
+  const auto iter = std::find_if(controller->m_altButtonMapping.begin(), controller->m_altButtonMapping.end(),
+                                 [mapping](const auto& pair) { return mapping.padButton == pair.padButton; });
   if (iter == controller->m_altButtonMapping.end()) {
     return;
   }
@@ -1250,8 +1251,8 @@ void PADSetAxisMapping(const u32 port, const PADAxisMapping mapping) {
     return;
   }
 
-  const auto iter = std::ranges::find_if(controller->m_axisMapping,
-                                         [mapping](const auto& pair) { return mapping.padAxis == pair.padAxis; });
+  const auto iter = std::find_if(controller->m_axisMapping.begin(), controller->m_axisMapping.end(),
+                                 [mapping](const auto& pair) { return mapping.padAxis == pair.padAxis; });
   if (iter == controller->m_axisMapping.end()) {
     return;
   }
@@ -1425,9 +1426,10 @@ static void load_keyboard_bindings() {
 
     if (mappingsSet) {
       const bool anyBound =
-          std::ranges::any_of(buttonMapping,
-                              [](const PADKeyButtonBinding& b) { return b.scancode != PAD_KEY_INVALID; }) ||
-          std::ranges::any_of(axisMapping, [](const PADKeyAxisBinding& b) { return b.scancode != PAD_KEY_INVALID; });
+          std::any_of(buttonMapping.begin(), buttonMapping.end(),
+                      [](const PADKeyButtonBinding& b) { return b.scancode != PAD_KEY_INVALID; }) ||
+          std::any_of(axisMapping.begin(), axisMapping.end(),
+                      [](const PADKeyAxisBinding& b) { return b.scancode != PAD_KEY_INVALID; });
       if (!anyBound) {
         mappingsSet = false;
       }
@@ -1467,7 +1469,10 @@ void __PADWriteDeadZones(SDL_IOStream* file, // NOLINT(*-reserved-identifier)
 void PADSerializeMappings() {
   const std::filesystem::path basePath = fs_path_from_string(aurora::g_config.userPath);
 
-  for (auto& controller : aurora::input::g_GameControllers | std::views::values) {
+  // Avoid std::views::values here: older Apple libc++ releases implement the
+  // C++20 ranges algorithms we use but not this adaptor.
+  for (auto& entry : aurora::input::g_GameControllers) {
+    auto& controller = entry.second;
     EnsureMappingLoaded(&controller);
     const auto filePath =
         basePath / fmt::format("{}_{:04X}_{:04X}.controller", aurora::input::controller_name(controller.m_index),
@@ -1569,8 +1574,8 @@ static constexpr std::array<std::pair<PADButton, std::string_view>, PAD_AXIS_COU
 
 const char* PADGetButtonName(const PADButton button) {
 
-  if (const auto iter =
-          std::ranges::find_if(skButtonNames, [&button](const auto& pair) { return button == pair.first; });
+  if (const auto iter = std::find_if(skButtonNames.begin(), skButtonNames.end(),
+                                     [&button](const auto& pair) { return button == pair.first; });
       iter != skButtonNames.end()) {
     return iter->second.data();
   }
@@ -1583,7 +1588,8 @@ const char* PADGetNativeButtonName(u32 button) {
 }
 
 const char* PADGetAxisName(const PADAxis axis) {
-  if (const auto it = std::ranges::find_if(skAxisNames, [&axis](const auto& pair) { return axis == pair.first; });
+  if (const auto it = std::find_if(skAxisNames.begin(), skAxisNames.end(),
+                                   [&axis](const auto& pair) { return axis == pair.first; });
       it != skAxisNames.end()) {
     return it->second.data();
   }
@@ -1592,7 +1598,8 @@ const char* PADGetAxisName(const PADAxis axis) {
 }
 
 const char* PADGetAxisDirectionLabel(const PADAxis axis) {
-  if (const auto it = std::ranges::find_if(skAxisDirLabels, [&axis](const auto& pair) { return axis == pair.first; });
+  if (const auto it = std::find_if(skAxisDirLabels.begin(), skAxisDirLabels.end(),
+                                   [&axis](const auto& pair) { return axis == pair.first; });
       it != skAxisDirLabels.end()) {
     return it->second.data();
   }

aurora-main/lib/gfx/common.cpp

@@ -23,7 +23,6 @@
 #include <memory>
 #include <mutex>
 #include <optional>
-#include <ranges>
 
 #include <absl/container/flat_hash_map.h>
 #include <magic_enum.hpp>
@@ -1259,11 +1258,6 @@ void split_staging_batch() {
         retained[i].assign(buffers[i]->data(), buffers[i]->data() + g_suspendedEfbBytes[i]);
     }
   }
-  // GXCopyTex can capture the ordinary EFB as well as an explicit offscreen
-  // target. Its command may arrive in the next batch, after this prefix has
-  // already been submitted. Preserve every prefix; target kind cannot tell
-  // us whether the guest will later retain these pixels in a texture.
-  for (auto& pass : g_renderPasses) pass.requireReadyPipelines = true;
   auto encoder = g_device.CreateCommandEncoder();
   end_batch(encoder);
   render(encoder);
@@ -1453,8 +1447,8 @@ static void render_impl(std::vector<RenderPass>& renderPasses, wgpu::CommandEnco
 
 #if defined(AURORA_GFX_DEBUG_GROUPS)
   if (finalize && !debugFrame.groups.empty()) {
-    for (auto& it : std::ranges::reverse_view(debugFrame.groups)) {
-      Log.warn("Debug group was not popped at end of frame: {}", it);
+    for (auto it = debugFrame.groups.rbegin(); it != debugFrame.groups.rend(); ++it) {
+      Log.warn("Debug group was not popped at end of frame: {}", *it);
     }
     debugFrame.groups.clear();
   }
@@ -1614,8 +1608,8 @@ bool bind_pipeline(PipelineRef ref, const wgpu::RenderPassEncoder& pass, Pipelin
   if (!skip_unready_pipelines()) {
     pipelineReady = wait_pipeline(ref, pipeline);
   } else if (requireReady) {
-    // Texture copies and capacity prefixes must retain complete draw results.
-    // A future display frame cannot repair a texture that already captured them.
+    // The pass resolves into a persistent texture (a one-shot bake such as MKW's minimap), so a
+    // skipped draw would never be re-issued. These run behind loads, not mid-race.
     pipelineReady = wait_pipeline_for_persistent_pass(ref, pipeline);
   } else {
     pipelineReady = try_pipeline(ref, pipeline);

aurora-main/lib/gfx/depth_peek.cpp

@@ -214,7 +214,8 @@ Params make_params(wgpu::Extent3D sourceSize, const FrameMapping& mapping) noexc
     return params;
   }
 
-  const bool stretch = mapping.viewportPolicy == AURORA_VIEWPORT_STRETCH;
+  const bool stretch = mapping.viewportPolicy == AURORA_VIEWPORT_STRETCH ||
+                       mapping.viewportPolicy == AURORA_VIEWPORT_16_9;
   const float scaleX = static_cast<float>(sourceSize.width) / static_cast<float>(logicalSize.x);
   const float scaleY = static_cast<float>(sourceSize.height) / static_cast<float>(logicalSize.y);
   const float scale = std::min(scaleX, scaleY);

aurora-main/lib/gfx/texture_replacement.cpp

@@ -553,7 +553,7 @@ void build_index() noexcept {
       continue;
     }
 
-    s_replacementIndex.try_emplace(*parsed, path);
+    s_replacementIndex.try_emplace(*parsed, ReplacementIndexEntry{path});
   }
 
   Log.info("Indexed {} texture replacements", s_replacementIndex.size());

aurora-main/lib/gx/fifo.cpp

@@ -82,19 +82,23 @@ void drain() {
   if (detail::sBufferSize == 0) {
     return;
   }
+  process_all(detail::sBufferData, detail::sBufferSize, true);
+  detail::sBufferSize = 0;
+}
+
+void process_all(const uint8_t* data, uint32_t size, bool bigEndian) {
   uint32_t consumed = 0;
   bool retried = false;
-  while (consumed < detail::sBufferSize) {
-    const auto count = process(detail::sBufferData + consumed, detail::sBufferSize - consumed, true);
+  while (consumed < size) {
+    const auto count = process(data + consumed, size - consumed, bigEndian);
     if (count == 0 && retried)
       throw gfx::StagingCapacityError("FIFO draw does not fit after capacity submission");
     consumed += count;
-    if (consumed == detail::sBufferSize) break;
+    if (consumed == size) break;
     // process returned with its renderer lock released. No recursive drain.
     gfx::split_staging_batch();
     retried = true;
   }
-  detail::sBufferSize = 0;
 }
 
 const uint8_t* get_buffer_data() { return detail::sBufferData; }

aurora-main/lib/gx/fifo.hpp

@@ -81,6 +81,10 @@ bool in_display_list();
 // Drain the internal FIFO buffer through the command processor
 void drain();
 
+// Decode a whole command stream, submitting the staging batch whenever a draw does not fit.
+// process() alone stops at that draw, so a caller that ignores its count drops the rest.
+void process_all(const uint8_t* data, uint32_t size, bool bigEndian);
+
 // Internal buffer inspection
 const uint8_t* get_buffer_data();
 uint32_t get_buffer_size();

aurora-main/lib/input.cpp

@@ -414,6 +414,29 @@ SDL_JoystickID add_controller(SDL_JoystickID which) noexcept {
     g_GameControllers[instance] = controller;
     ensure_player_index(g_GameControllers[instance]);
     apply_port_preferences();
+#if defined(SDL_PLATFORM_MACOS)
+    // First-use convenience only: never override a saved assignment or None.
+    if (g_portPreferences[0].state == PortPreferenceState::Unset) {
+      bool hasOtherPortPreference = false;
+      for (size_t port = 1; port < g_portPreferences.size(); ++port) {
+        if (g_portPreferences[port].state == PortPreferenceState::Controller &&
+            identity_match(g_portPreferences[port].identity, controller_identity(g_GameControllers[instance])) !=
+                IdentityMatch::None) {
+          hasOtherPortPreference = true;
+          break;
+        }
+      }
+      if (!hasOtherPortPreference) {
+        const auto* p0 = get_controller_for_player(0);
+        if (p0 == nullptr) {
+          assign_player_index(g_GameControllers[instance], 0);
+          persist_controller_for_player(0, &g_GameControllers[instance]);
+        } else if (p0 == &g_GameControllers[instance]) {
+          persist_controller_for_player(0, &g_GameControllers[instance]);
+        }
+      }
+    }
+#endif
     return instance;
   }
 

aurora-main/lib/system_info.cpp

@@ -235,7 +235,7 @@ std::string GetOSVersion() {
   constexpr auto name = "iOS";
 #elif TARGET_OS_TV
   constexpr auto name = "tvOS";
-#elif
+#else
   constexpr auto name = Unknown;
 #endif
 

aurora-main/lib/webgpu/gpu.cpp

@@ -642,6 +642,14 @@ bool initialize(AuroraBackend auroraBackend) {
         requiredLimits.maxDynamicStorageBuffersPerPipelineLayout, requiredLimits.maxStorageBuffersPerShaderStage,
         requiredLimits.minUniformBufferOffsetAlignment, requiredLimits.minStorageBufferOffsetAlignment);
     std::vector<wgpu::FeatureName> requiredFeatures;
+    // Optional native sharing for MetalFX. Devices without either feature keep
+    // the normal renderer; the upscaler checks the enabled pair at runtime.
+    if (backend == wgpu::BackendType::Metal &&
+        g_adapter.HasFeature(wgpu::FeatureName::SharedTextureMemoryIOSurface) &&
+        g_adapter.HasFeature(wgpu::FeatureName::SharedFenceMTLSharedEvent)) {
+      requiredFeatures.push_back(wgpu::FeatureName::SharedTextureMemoryIOSurface);
+      requiredFeatures.push_back(wgpu::FeatureName::SharedFenceMTLSharedEvent);
+    }
     bool implicitDeviceSynchronizationSupported = false;
     wgpu::SupportedFeatures supportedFeatures;
     g_adapter.GetFeatures(&supportedFeatures);

aurora-main/lib/webgpu/metalfx.hpp

@@ -0,0 +1,41 @@
+#pragma once
+
+#include <webgpu/webgpu_cpp.h>
+
+#include <memory>
+#include <string>
+
+namespace aurora::webgpu::metalfx {
+struct Size {
+  uint32_t inputWidth;
+  uint32_t inputHeight;
+  uint32_t outputWidth;
+  uint32_t outputHeight;
+  wgpu::TextureFormat format;
+
+  bool operator==(const Size&) const = default;
+};
+
+// All methods except supported() belong to the serialized frame encoder.
+// GPU ownership is explicit: begin_input -> submit input -> upscale ->
+// submit output consumption -> end_output. Neither texture may be used by
+// Dawn outside its access interval. Destruction retires in-flight resources.
+class SpatialScaler {
+public:
+  virtual ~SpatialScaler() = default;
+  virtual const wgpu::TextureView& input_view() const = 0;
+  virtual const wgpu::TextureView& output_view() const = 0;
+  virtual const wgpu::Texture& output_texture() const = 0;
+  virtual bool begin_input() = 0;
+  virtual bool upscale() = 0;
+  virtual bool end_output() = 0;
+  virtual const std::string& error() const = 0;
+};
+
+bool supported(const wgpu::Device& device, wgpu::BackendType backend);
+// A null result with no error means the bounded retirement pool is busy;
+// skip upscaling for this frame and retry at a later frame boundary.
+std::unique_ptr<SpatialScaler> create(const wgpu::Instance& instance,
+                                      const wgpu::Device& device, const Size& size,
+                                      std::string& error);
+} // namespace aurora::webgpu::metalfx

aurora-main/lib/webgpu/metalfx.mm

@@ -0,0 +1,326 @@
+#include "metalfx.hpp"
+
+#import <Foundation/Foundation.h>
+#import <IOSurface/IOSurface.h>
+#import <Metal/Metal.h>
+#import <MetalFX/MetalFX.h>
+
+#include <dawn/native/MetalBackend.h>
+
+#include <atomic>
+#include <string_view>
+
+namespace aurora::webgpu::metalfx {
+namespace {
+constexpr uint64_t kScheduleTimeoutNs = 1'000'000'000;
+// Four current slots plus at most four retiring slots during resize. A busy
+// GPU must not allow resize events to allocate unbounded full-resolution images.
+constexpr unsigned kMaxLiveResources = 8;
+std::atomic<unsigned> g_liveResources{0};
+
+struct SharedImage {
+  IOSurfaceRef surface = nullptr;
+  id<MTLTexture> metal;
+  wgpu::SharedTextureMemory memory;
+  wgpu::Texture texture;
+  wgpu::TextureView view;
+
+  ~SharedImage() { if (surface) CFRelease(surface); }
+
+  bool create(const wgpu::Device& device, id<MTLDevice> native, uint32_t width,
+              uint32_t height, wgpu::TextureFormat format, MTLTextureUsage nativeUsage,
+              wgpu::TextureUsage usage) {
+    const bool bgra = format == wgpu::TextureFormat::BGRA8Unorm;
+    const size_t rowBytes = IOSurfaceAlignProperty(kIOSurfaceBytesPerRow, size_t(width) * 4);
+    NSDictionary* properties = @{
+      (id)kIOSurfaceWidth: @(width), (id)kIOSurfaceHeight: @(height),
+      (id)kIOSurfaceBytesPerElement: @4, (id)kIOSurfaceBytesPerRow: @(rowBytes),
+      (id)kIOSurfaceAllocSize: @(rowBytes * height),
+      (id)kIOSurfacePixelFormat: @(bgra ? 0x42475241u : 0x52474241u)
+    };
+    surface = IOSurfaceCreate((__bridge CFDictionaryRef)properties);
+    if (!surface) return false;
+    auto descriptor = [MTLTextureDescriptor texture2DDescriptorWithPixelFormat:
+        bgra ? MTLPixelFormatBGRA8Unorm : MTLPixelFormatRGBA8Unorm
+        width:width height:height mipmapped:NO];
+    descriptor.storageMode = MTLStorageModeShared;
+    descriptor.usage = nativeUsage;
+    metal = [native newTextureWithDescriptor:descriptor iosurface:surface plane:0];
+    if (!metal) return false;
+
+    wgpu::SharedTextureMemoryIOSurfaceDescriptor io{};
+    io.ioSurface = surface;
+    io.allowStorageBinding = false;
+    wgpu::SharedTextureMemoryDescriptor importDescriptor{};
+    importDescriptor.nextInChain = &io;
+    memory = device.ImportSharedTextureMemory(&importDescriptor);
+    wgpu::SharedTextureMemoryProperties actual{};
+    if (!memory || memory.GetProperties(&actual) != wgpu::Status::Success ||
+        actual.format != format || actual.size.width != width || actual.size.height != height ||
+        (actual.usage & usage) != usage) return false;
+    wgpu::TextureDescriptor textureDescriptor{};
+    textureDescriptor.label = "MetalFX shared texture";
+    textureDescriptor.size = {width, height, 1};
+    textureDescriptor.format = format;
+    textureDescriptor.usage = usage;
+    texture = memory.CreateTexture(&textureDescriptor);
+    if (!texture) return false;
+    view = texture.CreateView();
+    return view != nullptr;
+  }
+};
+
+struct API_AVAILABLE(macos(13.0)) Resources {
+  SharedImage input, output;
+  id<MTLFXSpatialScaler> scaler;
+  id<MTLTexture> privateOutput;
+  id<MTLCommandQueue> nativeQueue;
+  id<MTLSharedEvent> event;
+  wgpu::SharedFence fence;
+  std::atomic<bool> failed{false};
+
+  Resources() { ++g_liveResources; }
+  ~Resources() { --g_liveResources; }
+};
+
+class API_AVAILABLE(macos(13.0)) MetalSpatialScaler final : public SpatialScaler {
+  wgpu::Instance m_instance;
+  wgpu::Queue m_queue;
+  std::shared_ptr<Resources> m_resources;
+  wgpu::SharedTextureMemoryEndAccessState m_outputReleased{};
+  wgpu::Future m_outputScheduled{};
+  uint64_t m_value = 0;
+  std::string m_error;
+
+  bool fail(const char* reason) {
+    m_error = reason;
+    m_resources->failed = true;
+    return false;
+  }
+
+  bool wait_scheduled(wgpu::Future future) {
+    return m_instance.WaitAny(future, kScheduleTimeoutNs) == wgpu::WaitStatus::Success ||
+           fail("Timed out scheduling MetalFX GPU work");
+  }
+
+  bool end_access(SharedImage& image, wgpu::SharedTextureMemoryEndAccessState& state,
+                  wgpu::Future& scheduled) {
+    wgpu::SharedTextureMemoryMetalEndAccessState metal{};
+    state.nextInChain = &metal;
+    const auto status = image.memory.EndAccess(image.texture, &state);
+    state.nextInChain = nullptr;
+    scheduled = metal.commandsScheduledFuture;
+    return status == wgpu::Status::Success || fail("MetalFX Dawn EndAccess failed");
+  }
+
+  bool begin_access(SharedImage& image, bool initialized, uint64_t value) {
+    wgpu::SharedTextureMemoryBeginAccessDescriptor access{};
+    access.initialized = initialized;
+    if (value) {
+      access.fenceCount = 1;
+      access.fences = &m_resources->fence;
+      access.signaledValueCount = 1;
+      access.signaledValues = &value;
+    }
+    return image.memory.BeginAccess(image.texture, &access) == wgpu::Status::Success ||
+           fail("MetalFX Dawn BeginAccess failed");
+  }
+
+  bool encode_waits(id<MTLCommandBuffer> commands,
+                    const wgpu::SharedTextureMemoryEndAccessState& state) {
+    for (size_t i = 0; i < state.fenceCount; ++i) {
+      wgpu::SharedFenceMTLSharedEventExportInfo metal{};
+      wgpu::SharedFenceExportInfo info{};
+      info.nextInChain = &metal;
+      state.fences[i].ExportInfo(&info);
+      if (info.type != wgpu::SharedFenceType::MTLSharedEvent || !metal.sharedEvent)
+        return fail("Dawn did not export a MetalFX shared-event dependency");
+      [commands encodeWaitForEvent:(__bridge id<MTLSharedEvent>)metal.sharedEvent
+                             value:state.signaledValues[i]];
+    }
+    return true;
+  }
+
+  void retain_until_dawn_done() {
+    // A resize/toggle can destroy this wrapper immediately. The last submitted
+    // Dawn consumer keeps the IOSurfaces/scaler alive independently of the cache.
+    m_queue.OnSubmittedWorkDone(wgpu::CallbackMode::AllowSpontaneous,
+        [resources = m_resources](wgpu::QueueWorkDoneStatus status, wgpu::StringView) {
+          if (status != wgpu::QueueWorkDoneStatus::Success) resources->failed = true;
+        });
+  }
+
+public:
+  MetalSpatialScaler(const wgpu::Instance& instance, const wgpu::Device& device,
+                      std::shared_ptr<Resources> resources)
+  : m_instance(instance), m_queue(device.GetQueue()), m_resources(std::move(resources)) {}
+
+  const wgpu::TextureView& input_view() const override { return m_resources->input.view; }
+  const wgpu::TextureView& output_view() const override { return m_resources->output.view; }
+  const wgpu::Texture& output_texture() const override { return m_resources->output.texture; }
+  const std::string& error() const override { return m_error; }
+
+  bool begin_input() override {
+    if (m_resources->failed) return fail("Previous MetalFX GPU work failed");
+    return begin_access(m_resources->input, m_value != 0, m_value);
+  }
+
+  bool upscale() override {
+    @autoreleasepool {
+      // Input has already been submitted. Retain it even if an export or native
+      // allocation fails and the caller immediately falls back to normal copy.
+      retain_until_dawn_done();
+      wgpu::SharedTextureMemoryEndAccessState inputReleased{};
+      wgpu::Future inputScheduled{};
+      if (!end_access(m_resources->input, inputReleased, inputScheduled) ||
+          !wait_scheduled(inputScheduled)) return false;
+      if (m_value && !wait_scheduled(m_outputScheduled)) return false;
+      id<MTLCommandBuffer> commands = [m_resources->nativeQueue commandBuffer];
+      if (!commands) return fail("Could not allocate a MetalFX command buffer");
+      commands.label = @"MetalFX spatial upscale and return to Dawn";
+      if (!encode_waits(commands, inputReleased) || !encode_waits(commands, m_outputReleased))
+        return false;
+      [m_resources->scaler encodeToCommandBuffer:commands];
+      id<MTLBlitCommandEncoder> blit = [commands blitCommandEncoder];
+      if (!blit) return fail("Could not allocate the MetalFX output blit");
+      [blit copyFromTexture:m_resources->privateOutput sourceSlice:0 sourceLevel:0
+          sourceOrigin:MTLOriginMake(0, 0, 0)
+          sourceSize:MTLSizeMake(m_resources->privateOutput.width, m_resources->privateOutput.height, 1)
+          toTexture:m_resources->output.metal destinationSlice:0 destinationLevel:0
+          destinationOrigin:MTLOriginMake(0, 0, 0)];
+      [blit endEncoding];
+      ++m_value;
+      [commands encodeSignalEvent:m_resources->event value:m_value];
+      const auto resources = m_resources;
+      [commands addCompletedHandler:^(id<MTLCommandBuffer> completed) {
+        if (completed.status == MTLCommandBufferStatusError) resources->failed = true;
+      }];
+      [commands commit];
+      // Scheduling is required to order independent Metal queues. Completion
+      // remains asynchronous; resource reuse is guarded by shared GPU events.
+      [commands waitUntilScheduled];
+      if (commands.status == MTLCommandBufferStatusError)
+        return fail("MetalFX command buffer failed");
+      return begin_access(m_resources->output, true, m_value);
+    }
+  }
+
+  bool end_output() override {
+    retain_until_dawn_done();
+    m_outputReleased = {};
+    return end_access(m_resources->output, m_outputReleased, m_outputScheduled);
+  }
+};
+
+// Allocation failures must be caught here rather than reaching Aurora's fatal
+// uncaptured-error callback. Scope callbacks own their strings even on timeout.
+bool pop_scope(const wgpu::Instance& instance, const wgpu::Device& device, std::string& error) {
+  auto message = std::make_shared<std::string>();
+  auto future = device.PopErrorScope(wgpu::CallbackMode::WaitAnyOnly,
+      [message](wgpu::PopErrorScopeStatus status, wgpu::ErrorType type, wgpu::StringView text) {
+        if (status != wgpu::PopErrorScopeStatus::Success || type != wgpu::ErrorType::NoError) {
+          const std::string_view detail{text};
+          *message = detail.empty() ? "MetalFX texture allocation failed" : std::string(detail);
+        }
+      });
+  if (instance.WaitAny(future, kScheduleTimeoutNs) != wgpu::WaitStatus::Success) {
+    error = "Timed out checking MetalFX texture allocation";
+    return false;
+  }
+  if (!message->empty()) { error = *message; return false; }
+  return true;
+}
+} // namespace
+
+bool supported(const wgpu::Device& device, wgpu::BackendType backend) {
+  if (@available(macOS 13.0, *)) {
+    if (!device || backend != wgpu::BackendType::Metal ||
+        !device.HasFeature(wgpu::FeatureName::SharedTextureMemoryIOSurface) ||
+        !device.HasFeature(wgpu::FeatureName::SharedFenceMTLSharedEvent)) return false;
+    auto native = dawn::native::metal::GetMTLDevice(device.Get());
+    return native && [MTLFXSpatialScalerDescriptor supportsDevice:native];
+  }
+  return false;
+}
+
+std::unique_ptr<SpatialScaler> create(const wgpu::Instance& instance,
+                                      const wgpu::Device& device, const Size& size,
+                                      std::string& error) {
+  error.clear();
+  if (@available(macOS 13.0, *)) {
+    @autoreleasepool {
+      if (!supported(device, wgpu::BackendType::Metal)) {
+        error = "MetalFX spatial scaling is unsupported";
+        return {};
+      }
+      wgpu::Limits limits{};
+      device.GetLimits(&limits);
+      if (!size.inputWidth || !size.inputHeight || size.inputWidth >= size.outputWidth ||
+          size.inputHeight >= size.outputHeight || size.outputWidth > limits.maxTextureDimension2D ||
+          size.outputHeight > limits.maxTextureDimension2D ||
+          (size.format != wgpu::TextureFormat::RGBA8Unorm && size.format != wgpu::TextureFormat::BGRA8Unorm)) {
+        error = "MetalFX requires smaller input dimensions and an RGBA8/BGRA8 unorm target";
+        return {};
+      }
+      if (g_liveResources.load() >= kMaxLiveResources) {
+        return {};
+      }
+      auto native = dawn::native::metal::GetMTLDevice(device.Get());
+      auto resources = std::make_shared<Resources>();
+      auto descriptor = [MTLFXSpatialScalerDescriptor new];
+      descriptor.inputWidth = size.inputWidth;
+      descriptor.inputHeight = size.inputHeight;
+      descriptor.outputWidth = size.outputWidth;
+      descriptor.outputHeight = size.outputHeight;
+      descriptor.colorTextureFormat = size.format == wgpu::TextureFormat::BGRA8Unorm
+          ? MTLPixelFormatBGRA8Unorm : MTLPixelFormatRGBA8Unorm;
+      descriptor.outputTextureFormat = descriptor.colorTextureFormat;
+      descriptor.colorProcessingMode = MTLFXSpatialScalerColorProcessingModePerceptual;
+      resources->scaler = [descriptor newSpatialScalerWithDevice:native];
+      resources->nativeQueue = [native newCommandQueue];
+      resources->event = [native newSharedEvent];
+      if (!resources->scaler || !resources->nativeQueue || !resources->event) {
+        error = "Could not create MetalFX spatial resources";
+        return {};
+      }
+      auto outputDescriptor = [MTLTextureDescriptor
+          texture2DDescriptorWithPixelFormat:descriptor.outputTextureFormat
+          width:size.outputWidth height:size.outputHeight mipmapped:NO];
+      outputDescriptor.storageMode = MTLStorageModePrivate;
+      outputDescriptor.usage = resources->scaler.outputTextureUsage;
+      resources->privateOutput = [native newTextureWithDescriptor:outputDescriptor];
+      if (!resources->privateOutput) { error = "Could not allocate MetalFX private output"; return {}; }
+
+      device.PushErrorScope(wgpu::ErrorFilter::Validation);
+      device.PushErrorScope(wgpu::ErrorFilter::OutOfMemory);
+      device.PushErrorScope(wgpu::ErrorFilter::Internal);
+      bool allocated = resources->input.create(device, native, size.inputWidth, size.inputHeight,
+          size.format, resources->scaler.colorTextureUsage, wgpu::TextureUsage::RenderAttachment);
+      allocated = allocated && resources->output.create(device, native, size.outputWidth, size.outputHeight,
+          size.format, MTLTextureUsageShaderRead, wgpu::TextureUsage::TextureBinding | wgpu::TextureUsage::CopySrc);
+      if (allocated) {
+        wgpu::SharedFenceMTLSharedEventDescriptor event{};
+        event.sharedEvent = (__bridge void*)resources->event;
+        wgpu::SharedFenceDescriptor fence{};
+        fence.nextInChain = &event;
+        resources->fence = device.ImportSharedFence(&fence);
+        allocated = resources->fence != nullptr;
+      }
+      for (int i = 0; i < 3; ++i) {
+        if (!pop_scope(instance, device, error)) allocated = false;
+      }
+      if (!allocated) {
+        if (error.empty()) error = "Could not import MetalFX IOSurface textures into Dawn";
+        return {};
+      }
+      resources->scaler.colorTexture = resources->input.metal;
+      resources->scaler.outputTexture = resources->privateOutput;
+      resources->scaler.inputContentWidth = size.inputWidth;
+      resources->scaler.inputContentHeight = size.inputHeight;
+      return std::make_unique<MetalSpatialScaler>(instance, device, std::move(resources));
+    }
+  }
+  error = "MetalFX requires macOS 13 or newer";
+  return {};
+}
+} // namespace aurora::webgpu::metalfx

aurora-main/lib/webgpu/metalfx_stub.cpp

@@ -0,0 +1,11 @@
+#include "metalfx.hpp"
+
+namespace aurora::webgpu::metalfx {
+bool supported(const wgpu::Device&, wgpu::BackendType) { return false; }
+
+std::unique_ptr<SpatialScaler> create(const wgpu::Instance&, const wgpu::Device&,
+                                      const Size&, std::string& error) {
+  error = "MetalFX is not available in this build";
+  return {};
+}
+} // namespace aurora::webgpu::metalfx

aurora-main/lib/window.cpp

@@ -46,6 +46,7 @@ SDL_Window* g_window;
 SDL_Renderer* g_renderer;
 float g_frameBufferScale = 0.f;
 bool g_frameBufferAspectFit = true;
+std::atomic_bool g_forceAspect169{false};
 bool g_presentSurfaceFill = false;
 int g_presentAspectWidth = 0;
 int g_presentAspectHeight = 0;
@@ -525,7 +526,20 @@ AuroraWindowSize get_window_size() {
   int fb_w = native_fb_w;
   int fb_h = native_fb_h;
   const auto [baseW, baseH] = vi::configured_fb_size();
-  if (g_frameBufferAspectFit && baseW > 0 && baseH > 0) {
+  if (g_forceAspect169.load(std::memory_order_acquire) && native_fb_w > 0 && native_fb_h > 0) {
+    if (g_frameBufferScale > 0.f && baseW > 0 && baseH > 0) {
+      const auto [scaledW, scaledH] =
+          scale_frame_buffer_to_aspect(static_cast<int>(baseW), static_cast<int>(baseH),
+                                       g_frameBufferScale, 16.f / 9.f);
+      fb_w = scaledW;
+      fb_h = scaledH;
+    } else {
+      fb_w = std::min(native_fb_w,
+                      std::max(1, static_cast<int>(std::lround(native_fb_h * (16.f / 9.f)))));
+      fb_h = std::min(native_fb_h,
+                      std::max(1, static_cast<int>(std::lround(native_fb_w * (9.f / 16.f)))));
+    }
+  } else if (g_frameBufferAspectFit && baseW > 0 && baseH > 0) {
     float renderScale = g_frameBufferScale > 0.f ? g_frameBufferScale : 1.f;
     if (g_frameBufferScale <= 0.f) {
       renderScale = std::min(static_cast<float>(native_fb_w) / static_cast<float>(baseW),
@@ -759,6 +773,14 @@ void set_frame_buffer_aspect_fit(bool fit) {
   request_frame_buffer_resize();
 }
 
+void set_force_aspect_16_9(bool force) {
+  if (g_forceAspect169.load(std::memory_order_relaxed) == force) {
+    return;
+  }
+  g_forceAspect169.store(force, std::memory_order_release);
+  request_frame_buffer_resize();
+}
+
 void set_present_surface_fill(bool fill) {
   g_presentSurfaceFill = fill;
 }
@@ -781,6 +803,10 @@ void unlock_present_aspect_ratio() {
 }
 
 bool get_present_aspect_ratio(float& aspect) noexcept {
+  if (g_forceAspect169.load(std::memory_order_acquire)) {
+    aspect = 16.f / 9.f;
+    return true;
+  }
   if (g_presentSurfaceFill && g_window != nullptr) {
     // Queried once per presentation snapshot; use the cached native client size
     // instead of re-entering SDL for a value the window procedure already knows.

aurora-main/lib/window.hpp

@@ -56,6 +56,7 @@ void sync_frame_buffer_size() noexcept;
 void request_frame_buffer_resize();
 void set_frame_buffer_scale(float scale);
 void set_frame_buffer_aspect_fit(bool fit);
+void set_force_aspect_16_9(bool force);
 void set_present_surface_fill(bool fill);
 void lock_present_aspect_ratio(int width, int height);
 void unlock_present_aspect_ratio();

aurora-main/tests/CMakeLists.txt

@@ -5,7 +5,7 @@ if (NOT TARGET gtest)
   FetchContent_Declare(googletest
     URL https://github.com/google/googletest/archive/refs/tags/v1.17.0.tar.gz
     URL_HASH SHA256=65fab701d9829d38cb77c14acdc431d2108bfdbf8979e40eb8ae567edf10b27c
-    DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+    DOWNLOAD_EXTRACT_TIMESTAMP FALSE
     EXCLUDE_FROM_ALL
   )
   FetchContent_MakeAvailable(googletest)

aurora-main/tests/gx_fifo_test.cpp

@@ -4267,7 +4267,7 @@ TEST_F(GXFifoTest, CopyTexColorFormatMarksResolvePersistent) {
   EXPECT_TRUE(records.front().persistentCopy);
 }
 
-TEST_F(GXFifoTest, RecurringColorCopyPreservesEveryResolve) {
+TEST_F(GXFifoTest, RecurringColorCopyKeepsLaterResolveSkippable) {
   std::array<u8, 152 * 114 * 4> image{};
   gxState().pixelFmt = GX_PF_RGBA6_Z24;
 
@@ -4281,7 +4281,7 @@ TEST_F(GXFifoTest, RecurringColorCopyPreservesEveryResolve) {
   const auto& records = aurora::gfx::testing::resolve_pass_records();
   ASSERT_EQ(records.size(), 2u);
   EXPECT_TRUE(records[0].persistentCopy);
-  EXPECT_TRUE(records[1].persistentCopy);
+  EXPECT_FALSE(records[1].persistentCopy);
 }
 
 TEST_F(GXFifoTest, ColorCopyAfterFrameGapRegainsPersistentProtection) {
@@ -4301,7 +4301,7 @@ TEST_F(GXFifoTest, ColorCopyAfterFrameGapRegainsPersistentProtection) {
   EXPECT_TRUE(records[1].persistentCopy);
 }
 
-TEST_F(GXFifoTest, CopyTexDepthFormatPreservesResolve) {
+TEST_F(GXFifoTest, CopyTexDepthFormatKeepsResolveSkippable) {
   std::array<u8, 4 * 4 * 4> image{};
   gxState().pixelFmt = GX_PF_RGBA6_Z24;
 
@@ -4311,7 +4311,7 @@ TEST_F(GXFifoTest, CopyTexDepthFormatPreservesResolve) {
 
   const auto& records = aurora::gfx::testing::resolve_pass_records();
   ASSERT_EQ(records.size(), 1u);
-  EXPECT_TRUE(records.front().persistentCopy);
+  EXPECT_FALSE(records.front().persistentCopy);
 }
 
 TEST_F(GXFifoTest, CopyDispResolveIsNotPersistent) {

aurora-main/tests/gx_test_common.hpp

@@ -50,6 +50,9 @@ void reset_uniform_allocations() noexcept;
 const std::vector<uint8_t>& uniform_allocation(size_t index) noexcept;
 void use_draw_command_tracking(bool enabled) noexcept;
 void use_real_vertex_format_helpers(bool enabled) noexcept;
+// Admit this many draws, then refuse one as if the staging batch were full.
+void refuse_staging_admission_after(uint32_t admissions) noexcept;
+void reset_staging_capacity() noexcept;
 } // namespace aurora::gfx::testing
 
 class GXFifoTest : public ::testing::Test {
@@ -65,6 +68,7 @@ protected:
     aurora::gfx::testing::reset_resolve_pass_records();
     aurora::gfx::testing::reset_vertex_push_record();
     aurora::gfx::testing::use_real_vertex_format_helpers(false);
+    aurora::gfx::testing::reset_staging_capacity();
   }
 
   // Copy the internal FIFO buffer contents and clear it

aurora-main/tests/gx_test_stubs.cpp

@@ -34,6 +34,9 @@ std::optional<aurora::gx::DrawData> s_lastGxDraw;
 bool s_trackDrawCommands = false;
 bool s_useRealVertexFormatHelpers = false;
 std::deque<std::vector<uint8_t>> s_uniformAllocations;
+std::optional<uint32_t> s_stagingAdmissionsBeforeRefusal;
+bool s_stagingRefused = false;
+uint64_t s_stagingSplitCount = 0;
 } // namespace
 
 // --- aurora::g_config ---
@@ -301,8 +304,23 @@ std::pair<ByteBuffer, Range> copy_uniform(Range source) {
 uint32_t align_uniform(uint32_t value) { return (value + 255u) & ~255u; }
 uint64_t staging_uniform_bytes(uint64_t value) { return staging_padded(value, 256); }
 uint64_t staging_storage_bytes(uint64_t value) { return staging_padded(value, 256); }
-bool staging_has_space(const StagingSizes&) { return true; }
-void split_staging_batch() { throw StagingCapacityError("Unexpected split in FIFO unit test"); }
+bool staging_has_space(const StagingSizes&) {
+  if (!s_stagingAdmissionsBeforeRefusal) return true;
+  if (*s_stagingAdmissionsBeforeRefusal > 0) {
+    --*s_stagingAdmissionsBeforeRefusal;
+    return true;
+  }
+  // Refuse once, as a full batch would; the split that follows makes room again.
+  s_stagingAdmissionsBeforeRefusal.reset();
+  s_stagingRefused = true;
+  return false;
+}
+void split_staging_batch() {
+  if (!s_stagingRefused) throw StagingCapacityError("Unexpected split in FIFO unit test");
+  s_stagingRefused = false;
+  ++s_stagingSplitCount;
+}
+uint64_t staging_split_count() noexcept { return s_stagingSplitCount; }
 
 Vec2<uint32_t> get_render_target_size() noexcept { return s_renderTargetSize; }
 Vec2<uint32_t> get_frame_buffer_size() noexcept { return s_renderTargetSize; }
@@ -345,6 +363,15 @@ void use_draw_command_tracking(bool enabled) noexcept {
 void use_real_vertex_format_helpers(bool enabled) noexcept {
   s_useRealVertexFormatHelpers = enabled;
 }
+void refuse_staging_admission_after(uint32_t admissions) noexcept {
+  s_stagingAdmissionsBeforeRefusal = admissions;
+  s_stagingRefused = false;
+}
+void reset_staging_capacity() noexcept {
+  s_stagingAdmissionsBeforeRefusal.reset();
+  s_stagingRefused = false;
+  s_stagingSplitCount = 0;
+}
 } // namespace aurora::gfx::testing
 
 // --- Pipeline/draw command stubs ---
@@ -525,6 +552,7 @@ std::optional<TextureHandle> find_replacement(const GXTexObj_&) noexcept { retur
 namespace aurora::window {
 AuroraWindowSize get_window_size() { return {640, 480, 640, 480, 640, 480, 1.0f}; }
 void set_frame_buffer_aspect_fit(bool) {}
+void set_force_aspect_16_9(bool) {}
 } // namespace aurora::window
 
 // --- WebGPU C API stubs (prevent linker errors from wgpu:: destructors) ---

aurora-main/tests/metalfx_interop/CMakeLists.txt

@@ -0,0 +1,28 @@
+cmake_minimum_required(VERSION 3.25)
+project(metalfx_interop LANGUAGES CXX)
+
+if(NOT APPLE)
+  message(FATAL_ERROR "The MetalFX interoperability probe requires macOS")
+endif()
+enable_language(OBJCXX)
+set(CMAKE_OBJCXX_STANDARD 20)
+set(CMAKE_OBJCXX_STANDARD_REQUIRED ON)
+set(CMAKE_OSX_DEPLOYMENT_TARGET 13.0)
+
+# Use the same Dawn package as Aurora; no separate download or renderer build.
+find_package(Threads REQUIRED)
+find_package(Dawn CONFIG REQUIRED)
+add_executable(metalfx_interop main.mm ../../lib/webgpu/metalfx.mm)
+target_include_directories(metalfx_interop PRIVATE ../../lib)
+target_compile_options(metalfx_interop PRIVATE -fobjc-arc -Wall -Wextra)
+target_link_libraries(metalfx_interop PRIVATE dawn::webgpu_dawn
+  "-framework MetalFX" "-framework Metal" "-framework IOSurface" "-framework Foundation")
+enable_testing()
+add_test(NAME metalfx_interop COMMAND metalfx_interop)
+set_tests_properties(metalfx_interop PROPERTIES SKIP_RETURN_CODE 77 TIMEOUT 60)
+
+add_executable(metalfx_stub_test stub_test.cpp ../../lib/webgpu/metalfx_stub.cpp)
+target_include_directories(metalfx_stub_test PRIVATE ../../lib)
+target_compile_features(metalfx_stub_test PRIVATE cxx_std_20)
+target_link_libraries(metalfx_stub_test PRIVATE dawn::webgpu_dawn)
+add_test(NAME metalfx_stub COMMAND metalfx_stub_test)

aurora-main/tests/metalfx_interop/README.md

@@ -0,0 +1,124 @@
+# MetalFX spatial upscaling: renderer integration and tests
+
+Aurora can now upscale the completed game image with MetalFX before aspect-fit
+presentation and ImGui composition. It is opt-in and requires macOS 13+, a
+supported Metal device, and Dawn IOSurface/shared-event support. Other backends
+and builds without the MetalFX SDK use a stub and the existing presentation path.
+The MetalFX framework is weak-linked; the game's deployment target is unchanged.
+
+## Trying the renderer integration
+
+Use F10 → Graphics → MetalFX spatial upscaling. Then use the existing
+Resolution control to render below the output viewport's size.
+Both source dimensions must be smaller than the output dimensions. Equal-size
+rendering, supersampling, and unsupported source formats bypass MetalFX. In
+particular, Auto (window size) generally offers no upscaling opportunity.
+
+The F10 toggle is saved in `Config.toml` as
+`video.metalfx_spatial_upscaling`. It uses these thread-safe Aurora entry points:
+
+- `aurora_set_metalfx_spatial(bool)` requests a change at the next sealed frame.
+- `aurora_get_metalfx_spatial()` returns the requested setting.
+- `aurora_is_metalfx_spatial_supported()` reports device/build support.
+- `aurora_get_metalfx_status()` distinguishes Disabled, Unsupported,
+  Not Upscaling, Active, and Error. A busy resize-retirement pool temporarily
+  bypasses upscaling and retries on a later frame. Other upscaler errors log a
+  reason and use normal presentation until a disabled frame resets the error.
+
+The game's HUD is part of the source image and is upscaled. ImGui/F10/FPS overlays
+are composed afterward at output resolution. Existing source-frame captures
+still capture the original source image. The interpolation snapshot call sites
+all use the same upscaling hook; game-specific interpolation remains untested.
+
+## GPU path and ownership
+
+1. Request Dawn's `SharedTextureMemoryIOSurface` and `SharedFenceMTLSharedEvent`
+   features when the Metal adapter supports both. Use that Dawn device's native
+   `MTLDevice`, not a separately selected default device.
+2. Cache MaxInterpolatedFrames + 1 upscaling slots with IOSurface-backed input and output textures,
+   a spatial scaler, a private MetalFX output, and shared-event dependencies.
+   Check texture formats, dimensions, usages, and device size limits on creation.
+3. Begin Dawn input access, copy the completed game image at its source size,
+   and submit the scene plus copy. End input access and wait for Dawn's
+   `commandsScheduledFuture` before submitting dependent native Metal work.
+4. On the native queue, wait for input rendering and any prior Dawn consumption
+   of the shared output. Encode MetalFX into its required **private** output
+   texture, then GPU-blit the result into the output IOSurface and signal an event.
+5. After native scheduling, begin Dawn output access with that event/value.
+   Composite the upscaled image into the existing content viewport, retaining
+   letterboxing, then draw ImGui. Submit and end output access. Reuse observes
+   both Dawn-to-Metal and Metal-to-Dawn event dependencies.
+6. GPU completion callbacks retain resources after a cache entry is replaced,
+   disabled, or shut down. At most eight resource sets may exist (four current
+   plus four retiring); rapid resizing cannot allocate an unbounded queue.
+
+CPU scheduling waits remain, but there are no CPU image transfers or per-frame
+GPU-completion waits in the upscaling path. There is one source-size GPU copy
+and one full-output GPU blit. Their cost must be measured before promising a
+performance gain. The input copy follows the existing perceptual/unorm sampling
+path. sRGB texture formats bypass MetalFX to avoid implicit color conversion.
+
+## Standalone GPU regression test
+
+The test builds the actual `lib/webgpu/metalfx.mm` implementation. Point
+`Dawn_DIR` at the package used by an existing Aurora build:
+
+```sh
+cmake -S aurora-main/tests/metalfx_interop -B build-metalfx-interop \
+  -DDawn_DIR="/absolute/path/to/dawn_prebuilt-src/lib/cmake/Dawn" \
+  -DCMAKE_BUILD_TYPE=Release
+cmake --build build-metalfx-interop
+MTL_DEBUG_LAYER=1 MTL_SHADER_VALIDATION=1 \
+  ctest --test-dir build-metalfx-interop --output-on-failure -V
+```
+
+The GPU test returns 77 (CTest **Skipped**) when no Metal adapter, required
+sharing features, or spatial scaler is available. A skip is not evidence of
+interoperability. Sandboxed processes may need GPU access. CTest imposes a
+60-second timeout. The separate stub test needs no GPU.
+
+Tested on Apple M3, macOS 26.5.1, using Aurora's existing Dawn package
+(`v20260603.191052`). Metal API and GPU validation were enabled:
+
+| Formats | Input | Output | Frames per format |
+| --- | --- | --- | --- |
+| RGBA8Unorm, BGRA8Unorm | 64 × 48 | 128 × 96 | 24 |
+| RGBA8Unorm, BGRA8Unorm | 320 × 180 | 480 × 270 | 24 |
+| RGBA8Unorm, BGRA8Unorm | 960 × 540 | 1920 × 1080 | 24 |
+
+All 144 frames and 2,304 interior pixel samples passed. Red changes per frame;
+green and blue distinguish left/right and top/bottom. All channels are checked
+within five 8-bit levels, catching stale images, orientation/channel mistakes,
+and missing output. Tests cover 1.5× and 2× scaling, padded readback rows, slot
+reuse, dropping wrappers before readback completion, invalid dimensions/sRGB
+formats, the eight-set allocation bound, and the unavailable-backend stub.
+
+Readback is only the test oracle and is absent from the game upscaling path.
+These samples do not measure reconstruction quality at edges or race performance.
+
+## Windowed presentation test
+
+This optional target exercises Aurora's actual frame submission and presentation
+with a synthetic source and an ImGui overlay. It requires no Wii game data and
+creates an automatically closing test window. Add the option to an existing
+from-source runtime build (the normal dependency/provider options still apply):
+
+```sh
+cmake -S runtime -B build-macos -DCMAKE_BUILD_TYPE=Release \
+  -DAURORA_BUILD_METALFX_PRESENTATION_TEST=ON
+cmake --build build-macos --target metalfx_presentation_test
+MTL_DEBUG_LAYER=1 MTL_SHADER_VALIDATION=1 \
+  ./build-macos/aurora-build/metalfx_presentation_test
+```
+
+On the same M3, all 84 frames passed with Metal API/GPU validation: disabled,
+enabled, window resize, 4:3/16:9 aspect changes, native-size bypass, disable, and
+re-enable. Assertions check renderer status and errors; this is not a pixel-level
+verification of the window image. The core build and macOS 12 deployment-target
+availability compilation also passed. Full Mario Kart gameplay, race performance,
+visual quality, Intel Macs, other Apple GPUs, older macOS runtime versions, and
+non-macOS full builds remain untested.
+
+References: [Apple MetalFX](https://developer.apple.com/documentation/metalfx),
+[spatial scaler requirements](https://developer.apple.com/documentation/metalfx/mtlfxspatialscaler),
+and the installed Dawn `MetalBackend.h` / `webgpu_cpp.h` APIs.

aurora-main/tests/metalfx_interop/main.mm

@@ -0,0 +1,269 @@
+#import <Foundation/Foundation.h>
+#import <IOSurface/IOSurface.h>
+#import <Metal/Metal.h>
+#include "webgpu/metalfx.hpp"
+
+#include <dawn/native/MetalBackend.h>
+#include <webgpu/webgpu_cpp.h>
+
+#include <array>
+#include <atomic>
+#include <cmath>
+#include <iostream>
+#include <memory>
+#include <stdexcept>
+#include <string_view>
+#include <vector>
+
+namespace {
+constexpr uint64_t kTimeoutNs = 10'000'000'000;
+constexpr unsigned kFrames = 24;
+std::atomic<unsigned> g_errors{0};
+
+void require(bool condition, const char* message) {
+  if (!condition) throw std::runtime_error(message);
+}
+
+void wait(const wgpu::Instance& instance, wgpu::Future future) {
+  require(instance.WaitAny(future, kTimeoutNs) == wgpu::WaitStatus::Success,
+          "Dawn operation timed out or failed");
+}
+
+void runCase(const wgpu::Instance& instance, const wgpu::Device& device,
+             bool bgra, uint32_t width, uint32_t height,
+             uint32_t outWidth, uint32_t outHeight) {
+  const auto format = bgra ? wgpu::TextureFormat::BGRA8Unorm : wgpu::TextureFormat::RGBA8Unorm;
+  using namespace aurora::webgpu::metalfx;
+  std::array<std::unique_ptr<SpatialScaler>, 3> slots;
+  for (auto& slot : slots) {
+    std::string error;
+    slot = create(instance, device, {width, height, outWidth, outHeight, format}, error);
+    if (!slot) {
+      throw std::runtime_error(error.empty()
+          ? "MetalFX resource pool was still busy retiring earlier slots"
+          : error);
+    }
+  }
+
+  // Asymmetric quadrants expose channel swaps, vertical flips, and stale frames.
+  wgpu::ShaderSourceWGSL source{};
+  source.code = R"(
+    @group(0) @binding(0) var<uniform> params: vec4f;
+    @vertex fn vs(@builtin(vertex_index) i: u32) -> @builtin(position) vec4f {
+      let p = array(vec2f(-1, -1), vec2f(3, -1), vec2f(-1, 3));
+      return vec4f(p[i], 0, 1);
+    }
+    @fragment fn fs(@builtin(position) p: vec4f) -> @location(0) vec4f {
+      return vec4f(params.x, select(0.2, 0.8, p.x >= params.y / 2),
+                   select(0.3, 0.7, p.y >= params.z / 2), 1);
+    }
+  )";
+  wgpu::ShaderModuleDescriptor shaderDescriptor{};
+  shaderDescriptor.nextInChain = &source;
+  auto shader = device.CreateShaderModule(&shaderDescriptor);
+  wgpu::ColorTargetState target{};
+  target.format = format;
+  wgpu::FragmentState fragment{};
+  fragment.module = shader;
+  fragment.entryPoint = "fs";
+  fragment.targetCount = 1;
+  fragment.targets = &target;
+  wgpu::RenderPipelineDescriptor pipelineDescriptor{};
+  pipelineDescriptor.vertex.module = shader;
+  pipelineDescriptor.vertex.entryPoint = "vs";
+  pipelineDescriptor.fragment = &fragment;
+  auto pipeline = device.CreateRenderPipeline(&pipelineDescriptor);
+  auto dawnQueue = device.GetQueue();
+  const uint32_t bytesPerRow = (outWidth * 4 + 255) & ~255u;
+  const uint64_t readbackSize = uint64_t(bytesPerRow) * outHeight;
+  std::vector<wgpu::Buffer> readbacks;
+
+  for (unsigned frame = 0; frame < kFrames; ++frame) {
+    auto& slot = slots[frame % slots.size()];
+    require(slot->begin_input(), "Production MetalFX begin_input failed");
+    const std::array<float, 4> params{0.2f + float(frame % 5) * 0.1f,
+                                     float(width), float(height), 0};
+    wgpu::BufferDescriptor uniformDescriptor{};
+    uniformDescriptor.size = sizeof(params);
+    uniformDescriptor.usage = wgpu::BufferUsage::Uniform | wgpu::BufferUsage::CopyDst;
+    auto uniform = device.CreateBuffer(&uniformDescriptor);
+    dawnQueue.WriteBuffer(uniform, 0, params.data(), sizeof(params));
+    wgpu::BindGroupEntry entry{};
+    entry.binding = 0;
+    entry.buffer = uniform;
+    entry.size = sizeof(params);
+    wgpu::BindGroupDescriptor bindDescriptor{};
+    bindDescriptor.layout = pipeline.GetBindGroupLayout(0);
+    bindDescriptor.entryCount = 1;
+    bindDescriptor.entries = &entry;
+    auto bindGroup = device.CreateBindGroup(&bindDescriptor);
+    auto encoder = device.CreateCommandEncoder();
+    wgpu::RenderPassColorAttachment attachment{};
+    attachment.view = slot->input_view();
+    attachment.loadOp = wgpu::LoadOp::Clear;
+    attachment.storeOp = wgpu::StoreOp::Store;
+    wgpu::RenderPassDescriptor passDescriptor{};
+    passDescriptor.colorAttachmentCount = 1;
+    passDescriptor.colorAttachments = &attachment;
+    auto pass = encoder.BeginRenderPass(&passDescriptor);
+    pass.SetPipeline(pipeline);
+    pass.SetBindGroup(0, bindGroup);
+    pass.Draw(3);
+    pass.End();
+    auto render = encoder.Finish();
+    dawnQueue.Submit(1, &render);
+    if (!slot->upscale()) throw std::runtime_error(slot->error());
+
+    wgpu::BufferDescriptor readbackDescriptor{};
+    readbackDescriptor.size = readbackSize;
+    readbackDescriptor.usage = wgpu::BufferUsage::CopyDst | wgpu::BufferUsage::MapRead;
+    auto readback = device.CreateBuffer(&readbackDescriptor);
+    encoder = device.CreateCommandEncoder();
+    wgpu::TexelCopyTextureInfo copySource{};
+    copySource.texture = slot->output_texture();
+    wgpu::TexelCopyBufferInfo destination{};
+    destination.buffer = readback;
+    destination.layout.bytesPerRow = bytesPerRow;
+    destination.layout.rowsPerImage = outHeight;
+    const wgpu::Extent3D extent{outWidth, outHeight, 1};
+    encoder.CopyTextureToBuffer(&copySource, &destination, &extent);
+    auto copy = encoder.Finish();
+    dawnQueue.Submit(1, &copy);
+    if (!slot->end_output()) throw std::runtime_error(slot->error());
+    readbacks.push_back(std::move(readback));
+  }
+
+  // Model toggle/resize immediately after submission, while either queue may
+  // still be consuming these textures. Production completion callbacks must
+  // keep the resources alive after the cache drops its wrappers.
+  slots = {};
+
+  // Readback is only the test oracle. No CPU image transfer or GPU completion
+  // wait occurs between Dawn rendering, MetalFX, and Dawn consumption above.
+  for (unsigned frame = 0; frame < kFrames; ++frame) {
+    bool mapped = false;
+    auto& readback = readbacks[frame];
+    wait(instance, readback.MapAsync(wgpu::MapMode::Read, 0, readbackSize,
+        wgpu::CallbackMode::WaitAnyOnly, [&mapped](wgpu::MapAsyncStatus status, wgpu::StringView) {
+          mapped = status == wgpu::MapAsyncStatus::Success;
+        }));
+    require(mapped, "Output readback mapping failed");
+    const auto* bytes = static_cast<const uint8_t*>(readback.GetConstMappedRange());
+    require(bytes != nullptr, "Output readback pointer is null");
+    for (unsigned y = 0; y < 4; ++y) {
+      for (unsigned x = 0; x < 4; ++x) {
+        const unsigned px = (2 * x + 1) * outWidth / 8;
+        const unsigned py = (2 * y + 1) * outHeight / 8;
+        const auto* pixel = bytes + py * bytesPerRow + px * 4;
+        const std::array<float, 4> expected{
+          0.2f + float(frame % 5) * 0.1f, x >= 2 ? 0.8f : 0.2f,
+          y >= 2 ? 0.7f : 0.3f, 1};
+        for (unsigned c = 0; c < 4; ++c) {
+          const unsigned channel = bgra && c != 1 && c != 3 ? 2 - c : c;
+          if (std::abs(int(pixel[channel]) - int(std::lround(expected[c] * 255))) > 5) {
+            std::cerr << "Pixel mismatch: frame=" << frame << " x=" << px << " y=" << py
+                      << " channel=" << c << " actual=" << int(pixel[channel])
+                      << " expected=" << std::lround(expected[c] * 255) << '\n';
+            throw std::runtime_error("MetalFX output failed image validation");
+          }
+        }
+      }
+    }
+    readback.Unmap();
+  }
+  require(g_errors.load() == 0, "Dawn reported validation errors or device loss");
+  std::cout << "PASS " << (bgra ? "BGRA8" : "RGBA8") << ' ' << width << 'x' << height
+            << " -> " << outWidth << 'x' << outHeight << ": " << kFrames
+            << " frames, 3 reused slots, 16 pixel samples/frame\n";
+}
+
+int run() {
+  const wgpu::InstanceFeatureName timedWait = wgpu::InstanceFeatureName::TimedWaitAny;
+  wgpu::InstanceDescriptor instanceDescriptor{};
+  instanceDescriptor.requiredFeatureCount = 1;
+  instanceDescriptor.requiredFeatures = &timedWait;
+  auto instance = wgpu::CreateInstance(&instanceDescriptor);
+  require(instance != nullptr, "Dawn instance creation failed");
+  wgpu::Adapter adapter;
+  wgpu::RequestAdapterOptions options{};
+  options.backendType = wgpu::BackendType::Metal;
+  wait(instance, instance.RequestAdapter(&options, wgpu::CallbackMode::WaitAnyOnly,
+      [&adapter](wgpu::RequestAdapterStatus status, wgpu::Adapter result, wgpu::StringView message) {
+        if (status == wgpu::RequestAdapterStatus::Success) adapter = std::move(result);
+        else std::cerr << "Adapter: " << std::string_view(message) << '\n';
+      }));
+  if (!adapter) { std::cout << "SKIP: no Dawn Metal adapter\n"; return 77; }
+  const std::array features{wgpu::FeatureName::SharedTextureMemoryIOSurface,
+                            wgpu::FeatureName::SharedFenceMTLSharedEvent};
+  for (auto feature : features) {
+    if (!adapter.HasFeature(feature)) {
+      std::cout << "SKIP: Dawn adapter lacks IOSurface/shared-event interoperability\n";
+      return 77;
+    }
+  }
+  wgpu::DeviceDescriptor descriptor{};
+  descriptor.requiredFeatureCount = features.size();
+  descriptor.requiredFeatures = features.data();
+  descriptor.SetUncapturedErrorCallback(
+      [](const wgpu::Device&, wgpu::ErrorType, wgpu::StringView message) {
+        ++g_errors;
+        std::cerr << "Dawn error: " << std::string_view(message) << '\n';
+      });
+  descriptor.SetDeviceLostCallback(wgpu::CallbackMode::AllowSpontaneous,
+      [](const wgpu::Device&, wgpu::DeviceLostReason reason, wgpu::StringView message) {
+        if (reason != wgpu::DeviceLostReason::Destroyed) {
+          ++g_errors;
+          std::cerr << "Device lost: " << std::string_view(message) << '\n';
+        }
+      });
+  wgpu::Device device;
+  wait(instance, adapter.RequestDevice(&descriptor, wgpu::CallbackMode::WaitAnyOnly,
+      [&device](wgpu::RequestDeviceStatus status, wgpu::Device result, wgpu::StringView message) {
+        if (status == wgpu::RequestDeviceStatus::Success) device = std::move(result);
+        else std::cerr << "Device: " << std::string_view(message) << '\n';
+      }));
+  require(device != nullptr, "Dawn device creation failed");
+  id<MTLDevice> native = dawn::native::metal::GetMTLDevice(device.Get());
+  require(native != nil, "Dawn native Metal device is unavailable");
+  std::cout << "GPU: " << native.name.UTF8String << '\n';
+  if (!aurora::webgpu::metalfx::supported(device, wgpu::BackendType::Metal)) {
+    std::cout << "SKIP: GPU does not support MetalFX spatial scaling\n";
+    return 77;
+  }
+  require(!aurora::webgpu::metalfx::supported(device, wgpu::BackendType::Vulkan),
+          "MetalFX must reject non-Metal backends");
+  std::string error;
+  require(!aurora::webgpu::metalfx::create(instance, device,
+              {128, 96, 128, 96, wgpu::TextureFormat::RGBA8Unorm}, error) && !error.empty(),
+          "MetalFX must reject equal-size input/output");
+  require(!aurora::webgpu::metalfx::create(instance, device,
+              {128, 96, 256, 192, wgpu::TextureFormat::RGBA8UnormSrgb}, error),
+          "MetalFX must reject implicit sRGB conversion");
+  {
+    using namespace aurora::webgpu::metalfx;
+    std::array<std::unique_ptr<SpatialScaler>, 8> resources;
+    for (auto& scaler : resources) {
+      scaler = create(instance, device, {64, 48, 128, 96, wgpu::TextureFormat::RGBA8Unorm}, error);
+      require(scaler != nullptr, "Could not fill the MetalFX resource pool");
+    }
+    require(!create(instance, device, {64, 48, 128, 96, wgpu::TextureFormat::RGBA8Unorm}, error)
+                && error.empty(), "A full retirement pool must defer allocation without a fatal error");
+  }
+  for (bool bgra : {false, true}) {
+    runCase(instance, device, bgra, 64, 48, 128, 96);
+    runCase(instance, device, bgra, 320, 180, 480, 270);
+    runCase(instance, device, bgra, 960, 540, 1920, 1080);
+  }
+  return 0;
+}
+} // namespace
+
+int main() {
+  @autoreleasepool {
+    try { return run(); }
+    catch (const std::exception& error) {
+      std::cerr << "FAIL: " << error.what() << '\n';
+      return 1;
+    }
+  }
+}

aurora-main/tests/metalfx_interop/presentation_test.cpp

@@ -0,0 +1,124 @@
+// Explicitly opted-in windowed test of Aurora's real frame/presentation path.
+// No Wii game data is needed; the source override supplies a synthetic image.
+#include <aurora/aurora.h>
+#include <imgui.h>
+#include <SDL3/SDL_timer.h>
+
+#include "webgpu/gpu.hpp"
+#include "window.hpp"
+
+#include <atomic>
+#include <chrono>
+#include <cstdio>
+#include <filesystem>
+#include <stdexcept>
+#include <string_view>
+#include <system_error>
+#include <vector>
+
+namespace {
+std::atomic<unsigned> g_errors{0};
+
+void log_message(AuroraLogLevel level, const char* module, const char* message, unsigned len) {
+  if (level >= LOG_ERROR) ++g_errors;
+  if (level >= LOG_WARNING || std::string_view(message, len).find("MetalFX") != std::string_view::npos)
+    std::fprintf(stderr, "[%s] %.*s\n", module, static_cast<int>(len), message);
+  if (level == LOG_FATAL) std::abort();
+}
+
+void require(bool value, const char* message) {
+  if (!value) throw std::runtime_error(message);
+}
+
+void draw_frames(uint32_t width, uint32_t height, AuroraMetalFXStatus expected) {
+  using namespace aurora::webgpu;
+  auto source = create_render_texture(width, height, false);
+  auto bindGroup = create_copy_bind_group(source);
+  std::vector<uint32_t> pixels(size_t(width) * height);
+  for (uint32_t y = 0; y < height; ++y) {
+    for (uint32_t x = 0; x < width; ++x) {
+      pixels[size_t(y) * width + x] = 0xff000000u | ((x / 16 % 2) ? 0x00bb55u : 0xbb5500u);
+    }
+  }
+  wgpu::TexelCopyTextureInfo target{};
+  target.texture = source.texture;
+  wgpu::TexelCopyBufferLayout layout{};
+  layout.bytesPerRow = width * 4;
+  layout.rowsPerImage = height;
+  g_queue.WriteTexture(&target, pixels.data(), pixels.size() * sizeof(uint32_t), &layout, &source.size);
+
+  unsigned rendered = 0;
+  unsigned matchingStatus = 0;
+  for (unsigned attempt = 0; attempt < 300 && rendered < 12; ++attempt) {
+    aurora_update();
+    if (!aurora_begin_frame()) { SDL_Delay(5); continue; }
+    set_present_source_override(bindGroup, source.texture, source.size, source.format);
+    ImGui::SetNextWindowPos(ImVec2(12, 12), ImGuiCond_Always);
+    ImGui::Begin("MetalFX presentation test", nullptr, ImGuiWindowFlags_AlwaysAutoResize);
+    ImGui::TextUnformatted("Output-resolution overlay after game upscaling");
+    ImGui::Text("Source: %u x %u", width, height);
+    ImGui::End();
+    aurora_end_frame();
+    aurora_wait_for_frame_worker();
+    const auto status = aurora_get_metalfx_status();
+    require(status != AURORA_METALFX_ERROR, "MetalFX reported a presentation error");
+    if (status == expected) ++matchingStatus;
+    ++rendered;
+  }
+  require(rendered == 12 && matchingStatus >= 9, "Presentation did not reach the expected MetalFX state");
+  require(g_errors.load() == 0, "Aurora reported an error");
+  std::printf("PASS presentation source=%ux%u status=%d frames=%u\n", width, height, expected, rendered);
+}
+} // namespace
+
+int main(int argc, char** argv) {
+  const auto cache = std::filesystem::temp_directory_path() /
+      ("aurora-metalfx-presentation-test-" + std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()));
+  std::filesystem::create_directories(cache);
+  const auto path = cache.string();
+  AuroraConfig config{};
+  config.appName = "MetalFX presentation test";
+  config.userPath = path.c_str();
+  config.cachePath = path.c_str();
+  config.resourcesPath = path.c_str();
+  config.desiredBackend = BACKEND_METAL;
+  config.windowWidth = 640;
+  config.windowHeight = 480;
+  config.msaa = 1;
+  config.maxTextureAnisotropy = 1;
+  config.logCallback = log_message;
+  config.logLevel = LOG_INFO;
+  aurora_initialize(argc, argv, &config);
+  int result = 0;
+  try {
+    if (!aurora_is_metalfx_spatial_supported()) {
+      std::puts("SKIP: MetalFX spatial scaling is unavailable");
+      result = 77;
+    } else {
+      aurora::window::lock_present_aspect_ratio(4, 3);
+      aurora_set_metalfx_spatial(false);
+      require(!aurora_get_metalfx_spatial(), "Disable request was not retained");
+      draw_frames(320, 240, AURORA_METALFX_DISABLED);
+      aurora_set_metalfx_spatial(true);
+      require(aurora_get_metalfx_spatial(), "Enable request was not retained");
+      draw_frames(320, 240, AURORA_METALFX_ACTIVE);
+      aurora::window::set_window_size(800, 500);
+      draw_frames(320, 240, AURORA_METALFX_ACTIVE);
+      aurora::window::lock_present_aspect_ratio(16, 9);
+      draw_frames(320, 240, AURORA_METALFX_ACTIVE);
+      const auto output = aurora::window::get_window_size();
+      draw_frames(output.native_fb_width, output.native_fb_height, AURORA_METALFX_NOT_UPSCALING);
+      aurora_set_metalfx_spatial(false);
+      draw_frames(320, 240, AURORA_METALFX_DISABLED);
+      aurora_set_metalfx_spatial(true);
+      draw_frames(320, 240, AURORA_METALFX_ACTIVE);
+    }
+  } catch (const std::exception& error) {
+    std::fprintf(stderr, "FAIL: %s\n", error.what());
+    result = 1;
+  }
+  aurora_shutdown();
+  std::error_code cleanupError;
+  std::filesystem::remove_all(cache, cleanupError);
+  return result;
+}

aurora-main/tests/metalfx_interop/stub_test.cpp

@@ -0,0 +1,9 @@
+#include "webgpu/metalfx.hpp"
+
+int main() {
+  using namespace aurora::webgpu::metalfx;
+  if (supported({}, wgpu::BackendType::Vulkan) || supported({}, wgpu::BackendType::Metal)) return 1;
+  std::string error;
+  if (create({}, {}, {640, 480, 1280, 960, wgpu::TextureFormat::RGBA8Unorm}, error)) return 1;
+  return error.empty() ? 1 : 0;
+}

aurora-main/tests/renderer_regression_test.cpp

@@ -88,6 +88,31 @@ TEST_F(GXFifoTest, SingleExpandedPrimitiveCannotMergeWithTriangles) {
   EXPECT_EQ(aurora::gfx::testing::last_pushed_indices(), (std::vector<u16>{0, 1, 2}));
 }
 
+TEST_F(GXFifoTest, DisplayListSubmitsStagingWhenADrawDoesNotFit) {
+  __GXSetDirtyState();
+  aurora::gx::fifo::clear_buffer();
+  g_gxState.lastVtxFmt = GX_VTXFMT0;
+  g_gxState.lastVtxSize = 1;
+  // admitted=1 refuses the middle draw; admitted=2 refuses the last, so only a replay of the refused draw pushes 0x33.
+  for (const u32 admitted : {1u, 2u}) for (const bool bigEndian : {true, false}) {
+    std::vector<u8> list;
+    for (const u8 fill : {0x11, 0x22, 0x33}) {
+      auto bytes = draw(GX_TRIANGLES, 3);
+      if (!bigEndian) std::swap(bytes[1], bytes[2]);
+      std::fill(bytes.begin() + 3, bytes.end(), fill);
+      list.insert(list.end(), bytes.begin(), bytes.end());
+    }
+    const auto splitsBefore = aurora::gfx::staging_split_count();
+    aurora::gfx::testing::refuse_staging_admission_after(admitted);
+    if (bigEndian) GXCallDisplayList(list.data(), static_cast<u32>(list.size()));
+    else GXCallDisplayListLE(list.data(), static_cast<u32>(list.size()));
+    EXPECT_EQ(aurora::gfx::staging_split_count() - splitsBefore, 1u)
+        << "admitted=" << admitted << " bigEndian=" << bigEndian;
+    EXPECT_EQ(aurora::gfx::testing::last_pushed_vertices(), (std::vector<u8>{0x33, 0x33, 0x33}))
+        << "admitted=" << admitted << " bigEndian=" << bigEndian;
+  }
+}
+
 TEST(StagingMapping, RetiredCallbacksCannotPublishAnotherBuffersReadiness) {
   using namespace aurora::gfx;
   StagingMapState state;

runtime/CMakeLists.txt

@@ -1,27 +1,71 @@
-cmake_minimum_required(VERSION 3.16)
+cmake_minimum_required(VERSION 3.25)
+
+# Dawn's pinned macOS artifacts target 12.0. Set the same floor before project()
+# initializes the Apple toolchain so direct developer CMake invocations cannot
+# accidentally inherit the running SDK's deployment version. This cache entry
+# is harmless on non-Apple platforms and remains overridable by a caller.
+if(NOT CMAKE_OSX_DEPLOYMENT_TARGET)
+    set(CMAKE_OSX_DEPLOYMENT_TARGET "12.0" CACHE STRING
+        "Minimum macOS version supported by WiiCompiled" FORCE)
+endif()
 project(mkw_recompiled)
 
 if(NOT CMAKE_CXX_COMPILER_ID MATCHES "^(Clang|AppleClang)$" OR NOT CMAKE_SIZEOF_VOID_P EQUAL 8)
     message(FATAL_ERROR "WiiCompiled requires a 64-bit Clang toolchain")
 endif()
 
+if(APPLE AND CMAKE_OSX_ARCHITECTURES)
+    list(LENGTH CMAKE_OSX_ARCHITECTURES MKW_OSX_ARCHITECTURE_COUNT)
+    if(MKW_OSX_ARCHITECTURE_COUNT GREATER 1)
+        message(FATAL_ERROR
+            "WiiCompiled supports one macOS architecture per build directory; "
+            "configure separate arm64 and x86_64 build directories")
+    endif()
+    list(GET CMAKE_OSX_ARCHITECTURES 0 _mkw_osx_arch)
+    set(CMAKE_SYSTEM_PROCESSOR "${_mkw_osx_arch}" CACHE STRING "Target processor architecture" FORCE)
+    set(CMAKE_SYSTEM_PROCESSOR "${_mkw_osx_arch}")
+endif()
+
 if(WIN32 AND MINGW AND CMAKE_SYSTEM_PROCESSOR MATCHES "^(AMD64|amd64|x86_64|X86_64)$")
     set(MKW_PLATFORM_WINDOWS TRUE)
-elseif(APPLE AND CMAKE_SYSTEM_PROCESSOR MATCHES "^(arm64|ARM64)$")
-    # The first native macOS target is Apple Silicon. Intel and universal
-    # binaries remain future compatibility work; do not silently claim them.
+elseif(APPLE AND CMAKE_SYSTEM_PROCESSOR MATCHES "^(AMD64|amd64|x86_64|X86_64|arm64|ARM64)$")
     set(MKW_PLATFORM_MACOS TRUE)
+    if(CMAKE_SYSTEM_PROCESSOR MATCHES "^(AMD64|amd64|x86_64|X86_64)$")
+        set(MKW_PLATFORM_MACOS_X86_64 TRUE)
+    else()
+        set(MKW_PLATFORM_MACOS_ARM64 TRUE)
+    endif()
 elseif(CMAKE_SYSTEM_NAME STREQUAL "Linux" AND CMAKE_SYSTEM_PROCESSOR MATCHES "^(AMD64|amd64|x86_64|X86_64|aarch64|arm64|ARM64)$")
     set(MKW_PLATFORM_LINUX TRUE)
 else()
     message(FATAL_ERROR
-        "WiiCompiled supports 64-bit LLVM-MinGW Clang on Windows, native Linux x86_64/aarch64, or Apple Clang on macOS arm64")
+        "WiiCompiled supports 64-bit LLVM-MinGW Clang on Windows, native Linux x86_64/aarch64, or Apple Clang on macOS x86_64/arm64")
 endif()
+
 if(NOT CMAKE_BUILD_TYPE STREQUAL "Release")
     message(FATAL_ERROR "WiiCompiled only supports Release builds")
 endif()
 
 option(MKW_BUILD_PRODUCTS "Build translated WiiCompiled product targets" ON)
+option(MKW_BUILD_PSQ_TESTS "Build focused PSQ ISA tests" OFF)
+set(MKW_X86_CPU_PROFILE "v3" CACHE STRING
+    "Minimum x86-64 CPU profile for translated products (v2 or v3)")
+set_property(CACHE MKW_X86_CPU_PROFILE PROPERTY STRINGS v2 v3)
+if(CMAKE_SYSTEM_PROCESSOR MATCHES "^(AMD64|amd64|x86_64|X86_64)$" AND
+   NOT MKW_X86_CPU_PROFILE MATCHES "^(v2|v3)$")
+    message(FATAL_ERROR "MKW_X86_CPU_PROFILE must be v2 or v3 (got '${MKW_X86_CPU_PROFILE}')")
+endif()
+
+option(MKW_PLATFORM_TESTS_ONLY "Build host-platform tests without graphics dependencies or game assets" OFF)
+include("${CMAKE_CURRENT_LIST_DIR}/cmake/HostLibraries.cmake")
+if(MKW_PLATFORM_TESTS_ONLY)
+    if(MKW_BUILD_PRODUCTS)
+        message(FATAL_ERROR "MKW_PLATFORM_TESTS_ONLY requires MKW_BUILD_PRODUCTS=OFF")
+    endif()
+    add_compile_definitions(NOMINMAX)
+    include("${CMAKE_CURRENT_LIST_DIR}/cmake/PlatformTests.cmake")
+    return()
+endif()
 
 # Preprocessor definitions that belong to this project's own code (the runtime,
 # the translated shards and the product glue) and to nothing else. They are
@@ -59,20 +103,6 @@ target_include_directories(mkw_pugixml PUBLIC third_party/pugixml)
 target_compile_features(mkw_pugixml PUBLIC cxx_std_17)
 set_target_properties(mkw_pugixml PROPERTIES UNITY_BUILD OFF)
 
-# Linux guest-fiber scheduling (runtime/src/host_context.cpp) needs a symmetric
-# stackful-coroutine primitive to stand in for Win32 Fibers. libco's co_switch() transfers
-# directly to any other created coroutine, matching SwitchToFiber's semantics exactly (unlike
-# asymmetric resume/yield coroutine libraries, which would need every call site restructured).
-# Vendored from upstream (higan-emu/libco @ e18e09d, 2019-10-16, ISC license; valgrind.h is
-# separately BSD-style licensed, see third_party/libco/LICENSE). Windows keeps native Fibers
-# and macOS uses the project's x18-safe AArch64 assembly backend, so this target is Linux-only.
-if(MKW_PLATFORM_LINUX)
-    add_library(mkw_libco STATIC third_party/libco/libco.c)
-    add_library(mkw::libco ALIAS mkw_libco)
-    target_include_directories(mkw_libco PUBLIC third_party/libco)
-    set_target_properties(mkw_libco PROPERTIES UNITY_BUILD OFF)
-endif()
-
 # Runtime configuration is real TOML, parsed by toml11 rather than a project-
 # specific line parser. Keep it header-only and vendored so disconnected release
 # builds have exactly the same parser as developer builds.
@@ -113,11 +143,10 @@ endif()
 # compiles cleanly for Android with nothing beyond a plain C toolchain (no perl/asm build-script
 # dependency the way OpenSSL's build has), matching how this project already prefers toolchain-
 # simple libraries (see Crypto++ above, similarly stripped of ASM/SIMD for portability).
-# Fetched at build time from a pinned upstream release tarball with a checked SHA-256, the same way
-# aurora-main's own dependencies (SDL, zlib, etc.) are pulled in - not committed as a vendored
-# source tree, so the repository ships the compiled dependency rather than ~280 tracked upstream
-# files. Bump MKW_MBEDTLS_VERSION/MKW_MBEDTLS_SHA256 together when updating; the hash comes from
-# upstream's own signed `mbedtls-<version>-sha256sum.txt` release asset.
+# The from-source build fetches a pinned upstream tarball with a checked SHA-256.
+# The Linux native prebuilt package instead ships its compiled archives and headers.
+# Bump both values in cmake/MbedTLSPin.cmake when updating; the hash comes from
+# upstream's signed `mbedtls-<version>-sha256sum.txt` release asset.
 #
 # The alias exists on every platform so the link lines in cmake/PublicProducts.cmake stay
 # platform-independent, but it is only populated where network_ssl.cpp actually compiles the mbed
@@ -128,20 +157,22 @@ endif()
 add_library(mkw_mbedtls INTERFACE)
 add_library(mkw::mbedtls ALIAS mkw_mbedtls)
 if(NOT MKW_PLATFORM_WINDOWS)
-    include(FetchContent)
-    set(MKW_MBEDTLS_VERSION "3.6.7")
-    set(MKW_MBEDTLS_SHA256 "a7e8bcbec0e6f761b4af24f25677626b35f762f68eef79c08677a363212d11f6")
-    FetchContent_Declare(mkw_mbedtls_upstream
-        URL "https://github.com/Mbed-TLS/mbedtls/releases/download/mbedtls-${MKW_MBEDTLS_VERSION}/mbedtls-${MKW_MBEDTLS_VERSION}.tar.bz2"
-        URL_HASH SHA256=${MKW_MBEDTLS_SHA256})
-    # Subproject mode already defaults ENABLE_TESTING off and skips codegen (GEN_FILES), but
-    # ENABLE_PROGRAMS defaults on and installation/package-config isn't wanted for a linked-in copy.
-    set(ENABLE_PROGRAMS OFF CACHE BOOL "" FORCE)
-    set(ENABLE_TESTING OFF CACHE BOOL "" FORCE)
-    set(MBEDTLS_FATAL_WARNINGS OFF CACHE BOOL "" FORCE)
-    set(DISABLE_PACKAGE_CONFIG_AND_INSTALL ON CACHE BOOL "" FORCE)
-    FetchContent_MakeAvailable(mkw_mbedtls_upstream)
-    target_link_libraries(mkw_mbedtls INTERFACE MbedTLS::mbedtls MbedTLS::mbedx509 MbedTLS::mbedcrypto)
+    include("${CMAKE_CURRENT_LIST_DIR}/cmake/MbedTLSPin.cmake")
+    if(NOT MKW_NATIVE_PREBUILT_DIR)
+        include(FetchContent)
+        FetchContent_Declare(mkw_mbedtls_upstream
+            URL "https://github.com/Mbed-TLS/mbedtls/releases/download/mbedtls-${MKW_MBEDTLS_VERSION}/mbedtls-${MKW_MBEDTLS_VERSION}.tar.bz2"
+            URL_HASH SHA256=${MKW_MBEDTLS_SHA256}
+            DOWNLOAD_EXTRACT_TIMESTAMP FALSE
+        )
+        # Subproject mode already disables testing and codegen; it still enables programs.
+        set(ENABLE_PROGRAMS OFF CACHE BOOL "" FORCE)
+        set(ENABLE_TESTING OFF CACHE BOOL "" FORCE)
+        set(MBEDTLS_FATAL_WARNINGS OFF CACHE BOOL "" FORCE)
+        set(DISABLE_PACKAGE_CONFIG_AND_INSTALL ON CACHE BOOL "" FORCE)
+        FetchContent_MakeAvailable(mkw_mbedtls_upstream)
+        target_link_libraries(mkw_mbedtls INTERFACE MbedTLS::mbedtls MbedTLS::mbedx509 MbedTLS::mbedcrypto)
+    endif()
 endif()
 
 set(MKW_TRANSLATED_COMPILE_JOBS 0 CACHE STRING
@@ -161,6 +192,18 @@ set(MKW_AURORA_DIR "${CMAKE_CURRENT_LIST_DIR}/../aurora-main")
 # Fast-math may erase them and change guest-visible integer conversions.
 set(MKW_TRANSLATED_PPC_FP_OPTIONS -fno-fast-math -ffp-contract=off)
 
+set(MKW_PPC_SEMANTIC_RUNTIME_SOURCES
+    "${CMAKE_CURRENT_LIST_DIR}/src/ppc_helpers.cpp"
+    "${CMAKE_CURRENT_LIST_DIR}/src/fpu_helpers.cpp"
+    "${CMAKE_CURRENT_LIST_DIR}/src/ppc_quantized.cpp")
+set_source_files_properties(${MKW_PPC_SEMANTIC_RUNTIME_SOURCES} PROPERTIES
+    SKIP_UNITY_BUILD_INCLUSION ON
+    SKIP_PRECOMPILE_HEADERS ON
+    COMPILE_OPTIONS "${MKW_TRANSLATED_PPC_FP_OPTIONS}")
+# Match the optimization policy of the translated callers as well as their FP policy.
+set_property(SOURCE "${CMAKE_CURRENT_LIST_DIR}/src/ppc_quantized.cpp" APPEND PROPERTY
+    COMPILE_OPTIONS -O2 -fno-slp-vectorize)
+
 # ----------------------------------------------------------------------
 # Third-party: aurora-main (provides SDL3 + GPU backends)
 # ----------------------------------------------------------------------
@@ -280,12 +323,14 @@ endif()
 file(GLOB_RECURSE SOURCES CONFIGURE_DEPENDS "src/*.cpp")
 if(MKW_PLATFORM_MACOS)
     list(REMOVE_ITEM SOURCES "${CMAKE_CURRENT_LIST_DIR}/src/guest_flat_memory.cpp")
-    # HostContext's Apple Silicon backend is implemented in a small assembly
-    # companion. It must be part of the product runtime as well as the
-    # standalone context test; otherwise the final executable is missing
-    # mkw_co_init/mkw_co_switch at link time.
-    enable_language(ASM)
-    list(APPEND SOURCES "${CMAKE_CURRENT_LIST_DIR}/src/platform/macos/co_switch.S")
+    if(MKW_PLATFORM_MACOS_ARM64)
+        # HostContext's Apple Silicon backend is implemented in a small assembly
+        # companion. It must be part of the product runtime as well as the
+        # standalone context test; otherwise the final executable is missing
+        # mkw_co_init/mkw_co_switch at link time.
+        enable_language(ASM)
+        list(APPEND SOURCES "${CMAKE_CURRENT_LIST_DIR}/src/platform/macos/co_switch.S")
+    endif()
 else()
     list(REMOVE_ITEM SOURCES "${CMAKE_CURRENT_LIST_DIR}/src/guest_flat_memory_macos.cpp")
 endif()
@@ -299,87 +344,7 @@ set(MKW_CPU_BASELINE_SOURCE "${CMAKE_CURRENT_LIST_DIR}/src/host_cpu_baseline.cpp
 list(REMOVE_ITEM SOURCES ${MKW_BASE_PRODUCT_SOURCE} ${MKW_RETRO_REWIND_PRODUCT_SOURCE}
      ${MKW_CPU_BASELINE_SOURCE} ${MKW_PLATFORM_SOURCE})
 
-# This deliberately small library contains host services that are safe to
-# validate before guest memory and fiber work makes a full runtime build viable.
-add_library(mkw_platform STATIC "${MKW_PLATFORM_SOURCE}")
-target_include_directories(mkw_platform PUBLIC "${CMAKE_CURRENT_LIST_DIR}/include")
-target_compile_features(mkw_platform PUBLIC cxx_std_17)
-set_target_properties(mkw_platform PROPERTIES UNITY_BUILD OFF)
-
-# Keep these independent from Aurora's BUILD_TESTING option: they validate the
-# project's host-platform contracts, not Aurora's third-party test suite.
-enable_testing()
-add_executable(mkw_platform_paths_tests "${CMAKE_CURRENT_LIST_DIR}/tests/platform_paths_tests.cpp")
-target_link_libraries(mkw_platform_paths_tests PRIVATE mkw_platform)
-target_compile_features(mkw_platform_paths_tests PRIVATE cxx_std_17)
-add_test(NAME mkw_platform_paths_tests COMMAND mkw_platform_paths_tests)
-
-add_executable(mkw_nand_save_tests "${CMAKE_CURRENT_LIST_DIR}/tests/nand_save_tests.cpp")
-target_include_directories(mkw_nand_save_tests PRIVATE "${CMAKE_CURRENT_LIST_DIR}/include")
-target_compile_features(mkw_nand_save_tests PRIVATE cxx_std_17)
-add_test(NAME mkw_nand_save_tests COMMAND mkw_nand_save_tests)
-
-add_executable(mkw_nand_settings_tests "${CMAKE_CURRENT_LIST_DIR}/tests/nand_settings_tests.cpp")
-find_package(Threads REQUIRED)
-target_link_libraries(mkw_nand_settings_tests PRIVATE Threads::Threads)
-target_include_directories(mkw_nand_settings_tests PRIVATE "${CMAKE_CURRENT_LIST_DIR}/include")
-target_compile_features(mkw_nand_settings_tests PRIVATE cxx_std_17)
-add_test(NAME mkw_nand_settings_tests COMMAND mkw_nand_settings_tests)
-
-add_executable(mkw_sc_serial_tests "${CMAKE_CURRENT_LIST_DIR}/tests/sc_serial_tests.cpp")
-target_include_directories(mkw_sc_serial_tests PRIVATE "${CMAKE_CURRENT_LIST_DIR}/include")
-target_compile_features(mkw_sc_serial_tests PRIVATE cxx_std_17)
-add_test(NAME mkw_sc_serial_tests COMMAND mkw_sc_serial_tests)
-
-# The input expression engine is self-contained, so it can be exercised without
-# linking the runtime or SDL.
-add_executable(mkw_input_expr_tests
-    "${CMAKE_CURRENT_LIST_DIR}/tests/test_expr.cpp"
-    "${CMAKE_CURRENT_LIST_DIR}/src/input_expr.cpp")
-target_include_directories(mkw_input_expr_tests PRIVATE "${CMAKE_CURRENT_LIST_DIR}/include")
-target_compile_features(mkw_input_expr_tests PRIVATE cxx_std_17)
-add_test(NAME mkw_input_expr_tests COMMAND mkw_input_expr_tests)
-
-# HostContext deliberately keeps the platform-specific context primitive out
-# of fiber_manager.cpp. Exercise the Linux libco handoff directly so future
-# refactors cannot silently remove its headers, implementation, or link edge.
-if(MKW_PLATFORM_LINUX)
-    add_executable(mkw_linux_host_context_tests
-        "${CMAKE_CURRENT_LIST_DIR}/tests/host_context_tests.cpp"
-        "${CMAKE_CURRENT_LIST_DIR}/src/host_context.cpp")
-    target_include_directories(mkw_linux_host_context_tests PRIVATE
-        "${CMAKE_CURRENT_LIST_DIR}/include"
-        "${CMAKE_CURRENT_LIST_DIR}/third_party/libco")
-    target_compile_features(mkw_linux_host_context_tests PRIVATE cxx_std_17)
-    target_link_libraries(mkw_linux_host_context_tests PRIVATE mkw::libco)
-    add_test(NAME mkw_linux_host_context_tests COMMAND mkw_linux_host_context_tests)
-endif()
-
-if(MKW_PLATFORM_MACOS)
-    # Exercise the Apple Silicon context ABI and the public host-memory
-    # contracts separately from translated products.
-    enable_language(ASM)
-    add_executable(mkw_macos_context_abi_tests
-        "${CMAKE_CURRENT_LIST_DIR}/tests/macos_context_abi_tests.cpp"
-        "${CMAKE_CURRENT_LIST_DIR}/src/platform/macos/co_switch.S")
-    target_compile_features(mkw_macos_context_abi_tests PRIVATE cxx_std_17)
-    add_test(NAME mkw_macos_context_abi_tests COMMAND mkw_macos_context_abi_tests)
-
-    add_executable(mkw_macos_host_context_tests
-        "${CMAKE_CURRENT_LIST_DIR}/tests/host_context_tests.cpp"
-        "${CMAKE_CURRENT_LIST_DIR}/src/host_context.cpp"
-        "${CMAKE_CURRENT_LIST_DIR}/src/platform/macos/co_switch.S")
-    target_include_directories(mkw_macos_host_context_tests PRIVATE "${CMAKE_CURRENT_LIST_DIR}/include")
-    target_compile_features(mkw_macos_host_context_tests PRIVATE cxx_std_17)
-    add_test(NAME mkw_macos_host_context_tests COMMAND mkw_macos_host_context_tests)
-
-    add_executable(mkw_macos_guest_flat_memory_tests
-        "${CMAKE_CURRENT_LIST_DIR}/tests/macos_guest_flat_memory_tests.cpp"
-        "${CMAKE_CURRENT_LIST_DIR}/src/guest_flat_memory_macos.cpp")
-    target_include_directories(mkw_macos_guest_flat_memory_tests PRIVATE "${CMAKE_CURRENT_LIST_DIR}/include")
-    target_compile_features(mkw_macos_guest_flat_memory_tests PRIVATE cxx_std_17)
-    add_test(NAME mkw_macos_guest_flat_memory_tests COMMAND mkw_macos_guest_flat_memory_tests)
-endif()
+include("${CMAKE_CURRENT_LIST_DIR}/cmake/PlatformTests.cmake")
 
 # The translator emits the complete, content-addressed source graph. Consuming
 # this one manifest keeps configure independent of the 28k generated function
@@ -427,7 +392,15 @@ else()
         target_compile_definitions(mkw_macos_native_compile PRIVATE SDL_MAIN_HANDLED TARGET_PC)
         target_link_libraries(mkw_macos_native_compile PRIVATE
             aurora::gx aurora::pad aurora::si aurora::vi aurora::mtx
-            mkw::pugixml mkw::toml11 mkw::cryptopp)
+            mkw::pugixml mkw::toml11 mkw::cryptopp mkw::mbedtls)
+        if(MKW_PLATFORM_MACOS_X86_64)
+            target_link_libraries(mkw_macos_native_compile PRIVATE mkw::libco)
+            target_compile_options(mkw_macos_native_compile PRIVATE
+                -march=x86-64-${MKW_X86_CPU_PROFILE})
+            if(MKW_X86_CPU_PROFILE STREQUAL "v2")
+                target_compile_definitions(mkw_macos_native_compile PRIVATE MKW_X86_CPU_PROFILE_V2=1)
+            endif()
+        endif()
         set_target_properties(mkw_macos_native_compile PROPERTIES UNITY_BUILD OFF)
     endif()
     add_custom_target(mkw_platform_paths_check DEPENDS mkw_platform)

runtime/cmake/HostLibraries.cmake

@@ -0,0 +1,29 @@
+# Shared by the product build and the dependency-free platform test configuration.
+get_filename_component(MKW_HOST_RUNTIME_DIR "${CMAKE_CURRENT_LIST_DIR}/.." ABSOLUTE)
+
+# POSIX guest-fiber scheduling (runtime/src/host_context.cpp) needs a symmetric
+# stackful-coroutine primitive to stand in for Win32 Fibers. libco's co_switch() transfers
+# directly to any other created coroutine, matching SwitchToFiber's semantics exactly (unlike
+# asymmetric resume/yield coroutine libraries, which would need every call site restructured).
+# Vendored from upstream (higan-emu/libco @ e18e09d, 2019-10-16, ISC license; valgrind.h is
+# separately BSD-style licensed, see third_party/libco/LICENSE). Windows keeps native Fibers;
+# Apple Silicon uses the project's x18-safe AArch64 assembly backend, while Intel macOS uses
+# libco's existing System V AMD64 backend.
+if(MKW_PLATFORM_LINUX OR MKW_PLATFORM_MACOS_X86_64)
+    add_library(mkw_libco STATIC "${MKW_HOST_RUNTIME_DIR}/third_party/libco/libco.c")
+    add_library(mkw::libco ALIAS mkw_libco)
+    target_include_directories(mkw_libco PUBLIC "${MKW_HOST_RUNTIME_DIR}/third_party/libco")
+    set_target_properties(mkw_libco PROPERTIES UNITY_BUILD OFF)
+endif()
+
+# This deliberately small library contains host services that are safe to
+# validate before guest memory and fiber work makes a full runtime build viable.
+add_library(mkw_platform STATIC "${MKW_HOST_RUNTIME_DIR}/src/platform/host_platform.cpp")
+target_include_directories(mkw_platform PUBLIC "${MKW_HOST_RUNTIME_DIR}/include")
+target_compile_features(mkw_platform PUBLIC cxx_std_17)
+set_target_properties(mkw_platform PROPERTIES UNITY_BUILD OFF)
+
+if(MKW_PLATFORM_WINDOWS)
+    target_compile_definitions(mkw_platform PRIVATE NOMINMAX)
+    target_link_libraries(mkw_platform PUBLIC shell32 ole32 uuid)
+endif()

runtime/cmake/MbedTLSPin.cmake

@@ -0,0 +1,4 @@
+# Keep the release and verified archive hash together. The Linux native prebuilt
+# fingerprint includes this file, so changing either value forces a new harvest.
+set(MKW_MBEDTLS_VERSION "3.6.7")
+set(MKW_MBEDTLS_SHA256 "a7e8bcbec0e6f761b4af24f25677626b35f762f68eef79c08677a363212d11f6")

runtime/cmake/NativePrebuilt.cmake

@@ -42,6 +42,28 @@ endfunction()
 mkw_np_resolve(_mkw_np_includes ${MKW_NP_INCLUDE_DIRECTORIES})
 mkw_np_resolve(_mkw_np_links ${MKW_NP_LINK_LIBRARIES})
 mkw_np_resolve(_mkw_np_dawn_config ${MKW_NP_DAWN_CONFIG_DIR})
+if(NOT MKW_PLATFORM_WINDOWS)
+    if(NOT MKW_NP_MBEDTLS_LIBRARIES OR NOT MKW_NP_MBEDTLS_INCLUDE_DIR)
+        message(FATAL_ERROR
+            "The Linux native prebuilt package has no Mbed TLS archives; regenerate it with Prepare-NativePrebuilt.sh")
+    endif()
+    file(SHA256 "${CMAKE_CURRENT_LIST_DIR}/MbedTLSPin.cmake" _mkw_np_current_mbedtls_fingerprint)
+    if(NOT MKW_NP_MBEDTLS_FINGERPRINT STREQUAL _mkw_np_current_mbedtls_fingerprint)
+        message(FATAL_ERROR "The native prebuilt Mbed TLS version differs from this workspace; regenerate the package")
+    endif()
+    mkw_np_resolve(_mkw_np_mbedtls_links ${MKW_NP_MBEDTLS_LIBRARIES})
+    mkw_np_resolve(_mkw_np_mbedtls_include ${MKW_NP_MBEDTLS_INCLUDE_DIR})
+    foreach(_archive IN LISTS _mkw_np_mbedtls_links)
+        if(NOT EXISTS "${_archive}")
+            message(FATAL_ERROR "The native prebuilt package is missing Mbed TLS archive: ${_archive}")
+        endif()
+    endforeach()
+    if(NOT IS_DIRECTORY "${_mkw_np_mbedtls_include}")
+        message(FATAL_ERROR "The native prebuilt package is missing Mbed TLS headers: ${_mkw_np_mbedtls_include}")
+    endif()
+    target_include_directories(mkw_mbedtls SYSTEM INTERFACE "${_mkw_np_mbedtls_include}")
+    target_link_libraries(mkw_mbedtls INTERFACE ${_mkw_np_mbedtls_links})
+endif()
 
 foreach(_dir IN LISTS _mkw_np_includes)
     if(NOT IS_DIRECTORY "${_dir}")

runtime/cmake/NativePrebuiltExport.cmake

@@ -77,6 +77,9 @@ target_compile_features(mkw_np_probe PRIVATE cxx_std_20)
 target_link_libraries(mkw_np_probe PRIVATE
     aurora::gx aurora::pad aurora::si aurora::vi aurora::mtx
     mkw::cryptopp)
+if(NOT MKW_PLATFORM_WINDOWS)
+    target_link_libraries(mkw_np_probe PRIVATE mkw::mbedtls)
+endif()
 
 get_filename_component(_mkw_np_aurora_dir "${MKW_AURORA_DIR}" ABSOLUTE)
 mkw_collect_buildsystem_targets("${_mkw_np_aurora_dir}" _mkw_np_all_targets)
@@ -84,6 +87,25 @@ mkw_collect_buildsystem_targets("${_mkw_np_aurora_dir}" _mkw_np_all_targets)
 # the scan above cannot see it; it is appended explicitly. The type and closure
 # checks below still apply to it.
 list(APPEND _mkw_np_all_targets "mkw_cryptopp")
+if(NOT MKW_PLATFORM_WINDOWS)
+    set(_mkw_np_mbedtls_targets mbedtls mbedx509 mbedcrypto)
+    # mbedcrypto links these third-party archives when upstream defines them.
+    # Keep dependencies after mbedcrypto for static linking on the consumer side.
+    foreach(_t everest p256m)
+        if(TARGET ${_t})
+            list(APPEND _mkw_np_mbedtls_targets ${_t})
+        endif()
+    endforeach()
+    list(APPEND _mkw_np_all_targets ${_mkw_np_mbedtls_targets})
+    # Keep the complete TLS archive set separate from aurora's aggregate link interface.
+    set(_mkw_np_mbedtls_lines "")
+    foreach(_t IN LISTS _mkw_np_mbedtls_targets)
+        string(APPEND _mkw_np_mbedtls_lines
+            "${_t}|$<TARGET_LINKER_FILE:${_t}>\n")
+    endforeach()
+    file(GENERATE OUTPUT "${MKW_NATIVE_PREBUILT_EXPORT_DIR}/mbedtls.txt"
+        CONTENT "${_mkw_np_mbedtls_lines}")
+endif()
 if(NOT _mkw_np_all_targets)
     message(FATAL_ERROR "No buildsystem targets were found under ${_mkw_np_aurora_dir}")
 endif()
@@ -136,6 +158,7 @@ string(REPLACE ";" "," _mkw_np_lib_targets_csv "${_mkw_np_lib_targets}")
 file(WRITE "${MKW_NATIVE_PREBUILT_EXPORT_DIR}/meta.txt"
     "aurora_dir=${_mkw_np_aurora_dir}\n"
     "runtime_dir=${CMAKE_CURRENT_SOURCE_DIR}\n"
+    "mbedtls_source_dir=${mkw_mbedtls_upstream_SOURCE_DIR}\n"
     "binary_dir=${CMAKE_BINARY_DIR}\n"
     "dawn_config_dir=${_mkw_np_dawn_config_dir}\n"
     "dawn_prebuilt_source_dir=${dawn_prebuilt_SOURCE_DIR}\n"

runtime/cmake/PlatformTests.cmake

@@ -0,0 +1,188 @@
+get_filename_component(MKW_TEST_RUNTIME_DIR "${CMAKE_CURRENT_LIST_DIR}/.." ABSOLUTE)
+
+# Keep these independent from Aurora's BUILD_TESTING option: they validate the
+# project's host-platform contracts, not Aurora's third-party test suite.
+enable_testing()
+if(MKW_BUILD_PSQ_TESTS)
+    add_executable(mkw_psq_helpers_tests
+        "${MKW_TEST_RUNTIME_DIR}/tests/psq_helpers_tests.cpp"
+        "${MKW_TEST_RUNTIME_DIR}/src/ppc_quantized.cpp")
+    target_include_directories(mkw_psq_helpers_tests PRIVATE
+        "${MKW_TEST_RUNTIME_DIR}/tests/psq_memory"
+        "${MKW_TEST_RUNTIME_DIR}/include/isa"
+        "${MKW_TEST_RUNTIME_DIR}/include")
+    target_compile_features(mkw_psq_helpers_tests PRIVATE cxx_std_17)
+    target_compile_options(mkw_psq_helpers_tests PRIVATE
+        -O2 -fno-fast-math -ffp-contract=off -fno-slp-vectorize)
+    if(CMAKE_SYSTEM_PROCESSOR MATCHES "^(AMD64|amd64|x86_64|X86_64)$")
+        target_compile_options(mkw_psq_helpers_tests PRIVATE
+            -march=x86-64-${MKW_X86_CPU_PROFILE})
+    endif()
+    set_target_properties(mkw_psq_helpers_tests PROPERTIES UNITY_BUILD OFF)
+    add_test(NAME mkw_psq_helpers_tests COMMAND mkw_psq_helpers_tests)
+    add_test(NAME mkw_psq_reserved_tests COMMAND "${CMAKE_COMMAND}"
+        "-DPSQ_TEST_EXECUTABLE=$<TARGET_FILE:mkw_psq_helpers_tests>"
+        -P "${MKW_TEST_RUNTIME_DIR}/tests/psq_reserved_tests.cmake")
+endif()
+
+add_executable(mkw_platform_paths_tests "${MKW_TEST_RUNTIME_DIR}/tests/platform_paths_tests.cpp")
+target_link_libraries(mkw_platform_paths_tests PRIVATE mkw_platform)
+target_compile_features(mkw_platform_paths_tests PRIVATE cxx_std_17)
+add_test(NAME mkw_platform_paths_tests COMMAND mkw_platform_paths_tests)
+
+add_executable(mkw_runtime_config_tests "${MKW_TEST_RUNTIME_DIR}/tests/runtime_config_tests.cpp")
+target_include_directories(mkw_runtime_config_tests PRIVATE
+    "${MKW_TEST_RUNTIME_DIR}/include"
+    "${MKW_TEST_RUNTIME_DIR}/third_party/toml11")
+target_compile_features(mkw_runtime_config_tests PRIVATE cxx_std_20)
+add_test(NAME mkw_runtime_config_tests COMMAND mkw_runtime_config_tests)
+
+add_executable(mkw_nand_save_tests "${MKW_TEST_RUNTIME_DIR}/tests/nand_save_tests.cpp")
+target_include_directories(mkw_nand_save_tests PRIVATE "${MKW_TEST_RUNTIME_DIR}/include")
+target_compile_features(mkw_nand_save_tests PRIVATE cxx_std_17)
+add_test(NAME mkw_nand_save_tests COMMAND mkw_nand_save_tests)
+
+add_executable(mkw_nand_settings_tests "${MKW_TEST_RUNTIME_DIR}/tests/nand_settings_tests.cpp")
+find_package(Threads REQUIRED)
+target_link_libraries(mkw_nand_settings_tests PRIVATE Threads::Threads)
+target_include_directories(mkw_nand_settings_tests PRIVATE "${MKW_TEST_RUNTIME_DIR}/include")
+target_compile_features(mkw_nand_settings_tests PRIVATE cxx_std_17)
+add_test(NAME mkw_nand_settings_tests COMMAND mkw_nand_settings_tests)
+
+add_executable(mkw_sc_serial_tests "${MKW_TEST_RUNTIME_DIR}/tests/sc_serial_tests.cpp")
+target_include_directories(mkw_sc_serial_tests PRIVATE "${MKW_TEST_RUNTIME_DIR}/include")
+target_compile_features(mkw_sc_serial_tests PRIVATE cxx_std_17)
+add_test(NAME mkw_sc_serial_tests COMMAND mkw_sc_serial_tests)
+
+# The input expression engine is self-contained, so it can be exercised without
+# linking the runtime or SDL.
+add_executable(mkw_input_expr_tests
+    "${MKW_TEST_RUNTIME_DIR}/tests/test_expr.cpp"
+    "${MKW_TEST_RUNTIME_DIR}/src/input_expr.cpp")
+target_include_directories(mkw_input_expr_tests PRIVATE "${MKW_TEST_RUNTIME_DIR}/include")
+target_compile_features(mkw_input_expr_tests PRIVATE cxx_std_17)
+add_test(NAME mkw_input_expr_tests COMMAND mkw_input_expr_tests)
+
+# HostContext deliberately keeps the platform-specific context primitive out
+# of fiber_manager.cpp. Exercise the Linux libco handoff directly so future
+# refactors cannot silently remove its headers, implementation, or link edge.
+if(MKW_PLATFORM_LINUX)
+    add_executable(mkw_linux_host_context_tests
+        "${MKW_TEST_RUNTIME_DIR}/tests/host_context_tests.cpp"
+        "${MKW_TEST_RUNTIME_DIR}/src/host_context.cpp")
+    target_include_directories(mkw_linux_host_context_tests PRIVATE
+        "${MKW_TEST_RUNTIME_DIR}/include"
+        "${MKW_TEST_RUNTIME_DIR}/third_party/libco")
+    target_compile_features(mkw_linux_host_context_tests PRIVATE cxx_std_17)
+    target_link_libraries(mkw_linux_host_context_tests PRIVATE mkw::libco)
+    add_test(NAME mkw_linux_host_context_tests COMMAND mkw_linux_host_context_tests)
+endif()
+
+if(MKW_PLATFORM_WINDOWS)
+    add_executable(mkw_windows_host_context_tests
+        "${MKW_TEST_RUNTIME_DIR}/tests/host_context_tests.cpp"
+        "${MKW_TEST_RUNTIME_DIR}/src/host_context.cpp")
+    target_include_directories(mkw_windows_host_context_tests PRIVATE "${MKW_TEST_RUNTIME_DIR}/include")
+    target_compile_features(mkw_windows_host_context_tests PRIVATE cxx_std_17)
+    add_test(NAME mkw_windows_host_context_tests COMMAND mkw_windows_host_context_tests)
+endif()
+
+if(CMAKE_SYSTEM_PROCESSOR MATCHES "^(AMD64|amd64|x86_64|X86_64)$")
+    # Probe at the base ISA, including OS support for AVX register state. Cross
+    # builds execute target code only through a configured emulator.
+    if(NOT CMAKE_CROSSCOMPILING OR CMAKE_CROSSCOMPILING_EMULATOR)
+        include(CheckCXXSourceRuns)
+        include(CMakePushCheckState)
+        cmake_push_check_state(RESET)
+        set(CMAKE_REQUIRED_FLAGS "-march=x86-64")
+        check_cxx_source_runs([=[
+            #include <cpuid.h>
+            int main() {
+                unsigned a, b, c, d;
+                if (__get_cpuid_max(0, nullptr) < 7 ||
+                    __get_cpuid_max(0x80000000u, nullptr) < 0x80000001u)
+                    return 1;
+                __cpuid_count(1, 0, a, b, c, d);
+                // v2 plus FMA, MOVBE, XSAVE, OSXSAVE, AVX and F16C.
+                const unsigned leaf1 = (1u << 0) | (1u << 9) | (1u << 12) |
+                    (1u << 13) | (1u << 19) | (1u << 20) | (1u << 22) |
+                    (1u << 23) | (1u << 26) | (1u << 27) | (1u << 28) | (1u << 29);
+                if ((c & leaf1) != leaf1) return 1;
+                __cpuid_count(7, 0, a, b, c, d);
+                const unsigned leaf7 = (1u << 3) | (1u << 5) | (1u << 8);
+                if ((b & leaf7) != leaf7) return 1;
+                __cpuid_count(0x80000001u, 0, a, b, c, d);
+                if ((c & 0x21u) != 0x21u) return 1; // LAHF-SAHF and LZCNT.
+                __asm__ __volatile__("xgetbv" : "=a"(a), "=d"(d) : "c"(0));
+                return (a & 0x6u) == 0x6u ? 0 : 1;
+            }
+        ]=] MKW_HOST_SUPPORTS_X86_V3)
+        cmake_pop_check_state()
+    endif()
+    # Compile the same oracle cases for both paths. The v2 binary proves the
+    # scalar fallback stays free of FMA; the v3 binary checks the existing
+    # vector intrinsic path against the same strict result.
+    foreach(profile IN ITEMS v2 v3)
+        add_executable(mkw_ppc_pair_fma_${profile}_tests
+            "${MKW_TEST_RUNTIME_DIR}/tests/ppc_pair_fma_tests.cpp")
+        target_include_directories(mkw_ppc_pair_fma_${profile}_tests PRIVATE
+            "${MKW_TEST_RUNTIME_DIR}/include")
+        target_compile_features(mkw_ppc_pair_fma_${profile}_tests PRIVATE cxx_std_17)
+        target_compile_options(mkw_ppc_pair_fma_${profile}_tests PRIVATE
+            -march=x86-64-${profile} -fno-fast-math -ffp-contract=off)
+        if((NOT CMAKE_CROSSCOMPILING OR CMAKE_CROSSCOMPILING_EMULATOR) AND
+           (profile STREQUAL "v2" OR MKW_HOST_SUPPORTS_X86_V3))
+            add_test(NAME mkw_ppc_pair_fma_${profile}_tests COMMAND mkw_ppc_pair_fma_${profile}_tests)
+        endif()
+    endforeach()
+
+    add_library(mkw_cpu_baseline_v2_compile OBJECT
+        "${MKW_TEST_RUNTIME_DIR}/src/host_cpu_baseline.cpp")
+    target_compile_features(mkw_cpu_baseline_v2_compile PRIVATE cxx_std_17)
+    target_compile_definitions(mkw_cpu_baseline_v2_compile PRIVATE MKW_X86_CPU_PROFILE_V2=1)
+    target_compile_options(mkw_cpu_baseline_v2_compile PRIVATE -march=x86-64-v2 -w)
+endif()
+
+if(MKW_PLATFORM_MACOS)
+    # Exercise the public host-memory contracts separately from translated products.
+    if(MKW_PLATFORM_MACOS_ARM64)
+        # Apple Silicon's context ABI is implemented by the local assembly backend.
+        enable_language(ASM)
+        add_executable(mkw_macos_context_abi_tests
+            "${MKW_TEST_RUNTIME_DIR}/tests/macos_context_abi_tests.cpp"
+            "${MKW_TEST_RUNTIME_DIR}/src/platform/macos/co_switch.S")
+        target_compile_features(mkw_macos_context_abi_tests PRIVATE cxx_std_17)
+        add_test(NAME mkw_macos_context_abi_tests COMMAND mkw_macos_context_abi_tests)
+
+        add_executable(mkw_macos_host_context_tests
+            "${MKW_TEST_RUNTIME_DIR}/tests/host_context_tests.cpp"
+            "${MKW_TEST_RUNTIME_DIR}/src/host_context.cpp"
+            "${MKW_TEST_RUNTIME_DIR}/src/platform/macos/co_switch.S")
+        target_include_directories(mkw_macos_host_context_tests PRIVATE "${MKW_TEST_RUNTIME_DIR}/include")
+    else()
+        # Intel macOS follows the same System V AMD64 libco path as Linux.
+        add_executable(mkw_macos_host_context_tests
+            "${MKW_TEST_RUNTIME_DIR}/tests/host_context_tests.cpp"
+            "${MKW_TEST_RUNTIME_DIR}/src/host_context.cpp")
+        target_include_directories(mkw_macos_host_context_tests PRIVATE
+            "${MKW_TEST_RUNTIME_DIR}/include"
+            "${MKW_TEST_RUNTIME_DIR}/third_party/libco")
+        target_link_libraries(mkw_macos_host_context_tests PRIVATE mkw::libco)
+    endif()
+    target_compile_features(mkw_macos_host_context_tests PRIVATE cxx_std_17)
+    add_test(NAME mkw_macos_host_context_tests COMMAND mkw_macos_host_context_tests)
+
+    add_executable(mkw_macos_guest_flat_memory_tests
+        "${MKW_TEST_RUNTIME_DIR}/tests/macos_guest_flat_memory_tests.cpp"
+        "${MKW_TEST_RUNTIME_DIR}/src/guest_flat_memory_macos.cpp")
+    target_include_directories(mkw_macos_guest_flat_memory_tests PRIVATE "${MKW_TEST_RUNTIME_DIR}/include")
+    target_compile_features(mkw_macos_guest_flat_memory_tests PRIVATE cxx_std_17)
+    add_test(NAME mkw_macos_guest_flat_memory_tests COMMAND mkw_macos_guest_flat_memory_tests)
+
+    add_executable(mkw_macos_external_audio_tests
+        "${MKW_TEST_RUNTIME_DIR}/tests/macos_external_audio_tests.cpp"
+        "${MKW_TEST_RUNTIME_DIR}/src/external_audio_macos.cpp")
+    target_include_directories(mkw_macos_external_audio_tests PRIVATE "${MKW_TEST_RUNTIME_DIR}/include")
+    target_compile_features(mkw_macos_external_audio_tests PRIVATE cxx_std_17)
+    add_test(NAME mkw_macos_external_audio_tests COMMAND mkw_macos_external_audio_tests)
+endif()

runtime/cmake/PublicProducts.cmake

@@ -1,4 +1,4 @@
-# Public WiiCompiled product graph.
+# Public WiiCompiled product graph.
 #
 # The translator owns the translated build graph. Mario Kart's profile-neutral
 # functions are compiled once into mkw_base_shared; only callers whose direct
@@ -28,6 +28,7 @@ list(REMOVE_DUPLICATES SOURCES)
 if(MKW_PLATFORM_MACOS)
     find_library(MKW_IOKIT_FRAMEWORK IOKit REQUIRED)
     find_library(MKW_COREFOUNDATION_FRAMEWORK CoreFoundation REQUIRED)
+    find_library(MKW_COREAUDIO_FRAMEWORK CoreAudio REQUIRED)
 endif()
 
 function(mkw_apply_common_compile_options target)
@@ -84,11 +85,22 @@ target_link_libraries(mkw_runtime_common PRIVATE
 target_link_libraries(mkw_runtime_common PRIVATE mkw_platform mkw::pugixml mkw::toml11 mkw::cryptopp mkw::mbedtls)
 if(MKW_PLATFORM_WINDOWS)
     target_link_libraries(mkw_runtime_common PRIVATE shell32 windowsapp)
-elseif(MKW_PLATFORM_LINUX)
+elseif(MKW_PLATFORM_LINUX OR MKW_PLATFORM_MACOS_X86_64)
     # ${CMAKE_DL_LIBS} for music_attenuation.cpp's dlopen of libdbus-1 (MPRIS
-    # media monitoring). Empty string on glibc >= 2.34 where dl* is in libc.
+    # media monitoring). Empty on platforms where dl* is already in libc/libSystem.
     target_link_libraries(mkw_runtime_common PRIVATE mkw::libco ${CMAKE_DL_LIBS})
 endif()
+
+if(MKW_PLATFORM_MACOS)
+    # CoreAudio framework is required for automatic music muting on macOS.
+    target_link_libraries(mkw_runtime_common PRIVATE "${MKW_COREAUDIO_FRAMEWORK}")
+    if(MKW_PLATFORM_MACOS_X86_64)
+        # libco is used by Intel macOS. Apple Silicon uses the local
+        # x18-safe assembly backend and therefore does not define mkw::libco.
+        target_link_libraries(mkw_runtime_common PRIVATE mkw::libco)
+    endif()
+endif()
+
 if(MKW_CPPWINRT_INCLUDE_DIR)
     if(NOT EXISTS "${MKW_CPPWINRT_INCLUDE_DIR}/winrt/base.h")
         message(FATAL_ERROR
@@ -118,29 +130,23 @@ foreach(source IN LISTS SOURCES)
     endif()
     set_source_files_properties("${source}" PROPERTIES UNITY_GROUP "${runtime_group}")
 endforeach()
-# These translation units implement guest-visible floating-point bit
-# semantics.  Keep them out of the fast-math runtime unity groups and apply
-# the same contraction/rounding policy as translated PPC shards.
-set(MKW_PPC_SEMANTIC_RUNTIME_SOURCES
-    "${MKW_RUNTIME_SOURCE_DIR}/src/ppc_helpers.cpp"
-    "${MKW_RUNTIME_SOURCE_DIR}/src/fpu_helpers.cpp")
-set_source_files_properties(${MKW_PPC_SEMANTIC_RUNTIME_SOURCES} PROPERTIES
-    SKIP_UNITY_BUILD_INCLUSION ON
-    SKIP_PRECOMPILE_HEADERS ON
-    COMPILE_OPTIONS "${MKW_TRANSLATED_PPC_FP_OPTIONS}")
+# PPC semantic sources are excluded from unity/PCH and configured in CMakeLists.txt.
 set_target_properties(mkw_runtime_common PROPERTIES UNITY_BUILD ON UNITY_BUILD_MODE GROUP)
 target_precompile_headers(mkw_runtime_common PRIVATE "${MKW_RUNTIME_SOURCE_DIR}/include/mkw_pch.h")
 mkw_apply_common_compile_options(mkw_runtime_common)
 
-# Host ISA guard. Windows and Linux x86_64 product targets use x86-64-v3, so
-# this object deliberately keeps the plain baseline ISA and checks the CPU
-# before any AVX2/FMA code can execute. AArch64 has no equivalent optional ISA
-# floor to probe: NEON/FMA are architectural requirements.
+# Host ISA guard deliberately keeps the plain baseline ISA and checks the
+# selected x86 profile before optional instructions can execute. AArch64 has
+# no equivalent optional ISA floor to probe: NEON/FMA are architectural
+# requirements.
 if(CMAKE_SYSTEM_PROCESSOR MATCHES "^(AMD64|amd64|x86_64|X86_64)$")
     add_library(mkw_cpu_baseline OBJECT "${MKW_CPU_BASELINE_SOURCE}")
     target_compile_features(mkw_cpu_baseline PRIVATE cxx_std_17)
     set_target_properties(mkw_cpu_baseline PROPERTIES UNITY_BUILD OFF)
     target_compile_options(mkw_cpu_baseline PRIVATE -w)
+    if(MKW_X86_CPU_PROFILE STREQUAL "v2")
+        target_compile_definitions(mkw_cpu_baseline PRIVATE MKW_X86_CPU_PROFILE_V2=1)
+    endif()
 endif()
 
 if(NOT MKW_BASE_COMMON_SHARDS)
@@ -205,7 +211,9 @@ function(mkw_configure_product target)
         aurora::gx aurora::pad aurora::si aurora::vi aurora::mtx)
     if(MKW_PLATFORM_MACOS)
         target_link_libraries(${target} PRIVATE
-            "${MKW_IOKIT_FRAMEWORK}" "${MKW_COREFOUNDATION_FRAMEWORK}")
+            "${MKW_IOKIT_FRAMEWORK}" "${MKW_COREFOUNDATION_FRAMEWORK}" "${MKW_COREAUDIO_FRAMEWORK}")
+        target_link_options(${target} PRIVATE
+            "LINKER:-U,_OBJC_CLASS_$_MTLLogStateDescriptor")
     endif()
     if(EXISTS "${MKW_AURORA_DIR}/cmake/AuroraCopyRuntimeDLLs.cmake")
         include("${MKW_AURORA_DIR}/cmake/AuroraCopyRuntimeDLLs.cmake")
@@ -226,7 +234,7 @@ function(mkw_configure_product target)
             dbghelp user32 winmm ws2_32 iphlpapi secur32 crypt32 windowsapp)
 
         set_target_properties(${target} PROPERTIES WIN32_EXECUTABLE TRUE)
-    elseif(MKW_PLATFORM_LINUX)
+    elseif(MKW_PLATFORM_LINUX OR MKW_PLATFORM_MACOS_X86_64)
         # mkw_runtime_common is an OBJECT library: WiiCompiled/RetroRewind only pull in its .o
         # files via $<TARGET_OBJECTS:>, which does not propagate mkw_runtime_common's own
         # target_link_libraries (object libraries don't carry usage requirements to a consumer
@@ -328,12 +336,12 @@ else()
     message(STATUS "RetroRewind target disabled (run translate-mod and emit-build-shards)")
 endif()
 
-# Windows and Linux x86_64 share the x86-64-v3 floor that the CPU baseline
-# object above checks. AArch64 builds are compiled locally for the host that
-# will run them, so both Linux and Apple Silicon use the compiler's native CPU
-# tuning rather than leaving target-specific performance on the table.
+# Windows, Linux and Intel macOS x86_64 use the selected profile. AArch64
+# builds are compiled locally for the host that will run them, so both Linux
+# and Apple Silicon use the compiler's native CPU tuning rather than leaving
+# target-specific performance on the table.
 if(CMAKE_SYSTEM_PROCESSOR MATCHES "^(AMD64|amd64|x86_64|X86_64)$")
-    set(MKW_BASELINE_ARCH_FLAG -march=x86-64-v3)
+    set(MKW_BASELINE_ARCH_FLAG -march=x86-64-${MKW_X86_CPU_PROFILE})
 elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "^(aarch64|arm64|ARM64)$")
     set(MKW_BASELINE_ARCH_FLAG -mcpu=native)
 else()
@@ -346,5 +354,8 @@ set(MKW_ALL_BUILD_TARGETS
 foreach(target IN LISTS MKW_ALL_BUILD_TARGETS)
     if(TARGET ${target} AND MKW_BASELINE_ARCH_FLAG)
         target_compile_options(${target} PRIVATE ${MKW_BASELINE_ARCH_FLAG})
+        if(MKW_X86_CPU_PROFILE STREQUAL "v2")
+            target_compile_definitions(${target} PRIVATE MKW_X86_CPU_PROFILE_V2=1)
+        endif()
     endif()
 endforeach()

runtime/include/aurora_events.h

@@ -16,7 +16,9 @@
 #endif
 
 extern "C" bool g_dynamicAspectRatioEnabled;
-void ConfigureMkwDynamicAspect(bool widescreen, uint32_t surfaceWidth, uint32_t surfaceHeight);
+void ConfigureMkwDynamicAspect(bool widescreen, bool forceAspect169, uint32_t surfaceWidth, uint32_t surfaceHeight);
+void SetMkwForceAspect169(bool enabled);
+bool MkwForceAspect169Requested();
 void UpdateMkwDynamicAspectSurface(uint32_t surfaceWidth, uint32_t surfaceHeight);
 // Arms the "keep EGG::Frustum's projection scale" flag on every screen that
 // renders to a fixed-size offscreen target. Cheap and idempotent; called from

runtime/include/external_audio_macos.h

@@ -0,0 +1,14 @@
+#pragma once
+
+namespace MusicAttenuation {
+
+struct MacOSAudioStatus {
+    bool available = false;
+    bool playing = false;
+};
+
+// Queries output activity without capturing audio. Requires Core Audio process
+// objects (macOS 14.2+); older systems return an unavailable sample.
+MacOSAudioStatus QueryMacOSExternalAudio() noexcept;
+
+} // namespace MusicAttenuation

runtime/include/host_context.h

@@ -3,11 +3,11 @@
 #include <cstddef>
 
 // HostContext is the deliberately small boundary between the guest scheduler
-// and the host's cooperative-context facility. Windows uses native Fibers and
-// Linux uses libco; macOS AArch64 uses the local assembly backend because it
-// must preserve Darwin's platform-reserved x18 register, which libco's AArch64
-// backend does not save. Its handles are only valid on the thread that
-// initialized the scheduler.
+// and the host's cooperative-context facility. Windows uses native Fibers;
+// Linux uses libco's host backend; Intel macOS uses its System V x86-64 backend. macOS AArch64 uses
+// the local assembly backend because it must preserve Darwin's platform-reserved
+// x18 register, which libco's AArch64 backend does not save. Its handles are
+// only valid on the thread that initialized the scheduler.
 namespace HostContext {
 
 using Handle = void*;

runtime/include/isa/ppc_isa_float.h

@@ -607,7 +607,18 @@ inline double PPC_PsMulNoNiInline(double lhs, double rhs)
 inline PpcPairVec PpcFmaddPairInline(PpcPairVec multiplicand, PpcPairVec multiplier, PpcPairVec addend)
 {
 #if defined(__x86_64__)
+#if defined(__FMA__)
     return _mm_fmadd_ps(multiplicand, multiplier, addend);
+#else
+    // x86-64-v2 has SSE4.2 but no FMA. Preserve the one rounding point per
+    // lane through the scalar C++ FMA rather than decomposing into mul+add.
+    const double a = PpcM128ToPsInline(multiplicand);
+    const double c = PpcM128ToPsInline(multiplier);
+    const double b = PpcM128ToPsInline(addend);
+    return PpcPsToM128Inline(PpcPackPairedInline(
+        PpcAccuratePsMaddLaneNoNiInline<false>(PpcGetPs0Inline(a), PpcGetPs0Inline(c), PpcGetPs0Inline(b)),
+        PpcAccuratePsMaddLaneNoNiInline<false>(PpcGetPs1Inline(a), PpcGetPs1Inline(c), PpcGetPs1Inline(b))));
+#endif
 #elif defined(__aarch64__)
     const PpcPairVec result = vfma_f32(addend, multiplicand, multiplier);
     if (PpcPairNanLaneBitsInline(result) != 0) [[unlikely]]
@@ -619,7 +630,16 @@ inline PpcPairVec PpcFmaddPairInline(PpcPairVec multiplicand, PpcPairVec multipl
 inline PpcPairVec PpcFmsubPairInline(PpcPairVec multiplicand, PpcPairVec multiplier, PpcPairVec subtractor)
 {
 #if defined(__x86_64__)
+#if defined(__FMA__)
     return _mm_fmsub_ps(multiplicand, multiplier, subtractor);
+#else
+    const double a = PpcM128ToPsInline(multiplicand);
+    const double c = PpcM128ToPsInline(multiplier);
+    const double b = PpcM128ToPsInline(subtractor);
+    return PpcPsToM128Inline(PpcPackPairedInline(
+        PpcAccuratePsMaddLaneNoNiInline<true>(PpcGetPs0Inline(a), PpcGetPs0Inline(c), PpcGetPs0Inline(b)),
+        PpcAccuratePsMaddLaneNoNiInline<true>(PpcGetPs1Inline(a), PpcGetPs1Inline(c), PpcGetPs1Inline(b))));
+#endif
 #elif defined(__aarch64__)
     const PpcPairVec result = vfma_f32(vneg_f32(subtractor), multiplicand, multiplier);
     if (PpcPairNanLaneBitsInline(result) != 0) [[unlikely]]

runtime/include/isa/ppc_isa_quantized.h

@@ -294,7 +294,7 @@ inline double PpcLoadPairPsqFloatFastInline(uint32_t addr)
         return PpcLoadPairPsqFloatFromHostInline(host);
     }
     return PpcBitCastToDoubleInline(
-        PpcLoadPairPsqFloatBitsPackedInline(MemoryInline::Read64Slow(addr)));
+        PpcLoadPairPsqFloatBitsPackedInline(Memory::Read64(addr)));
 }
 
 inline double PpcLoadSinglePsqFloatFastInline(uint32_t addr)
@@ -349,7 +349,7 @@ inline void PpcStorePairPsqFloatFastInline(uint32_t addr, double value)
         PpcStorePairPsqFloatToHostInline(host, value);
         return;
     }
-    MemoryInline::Write64Slow(
+    Memory::Write64(
         addr, PpcStorePairPsqFloatBitsPackedInline(PpcBitCastToU64Inline(value)));
 }
 
@@ -1385,37 +1385,13 @@ MKW_PPC_FORCE_INLINE void PPC_PsqStStackInline(uint32_t addr, double value)
 // Context-free PSQ entries for translated regions which own GQR state as an
 // ordinary native value. All architecturally valid quantization encodings are
 // handled directly; reserved encodings retain the generic helper's abort.
-template <uint32_t W, uint32_t I, bool Stack>
-MKW_PPC_NO_INLINE MKW_PPC_COLD inline double PPC_PsqLStateFallback(uint32_t gqr, uint32_t addr)
-{
-    static_assert(W <= 1u && I < 8u);
-    const uint32_t type = (gqr >> 16) & 0x7u;
-    const uint32_t scale = (gqr >> 24) & 0x3Fu;
-    if constexpr (W == 0u)
-    {
-        switch (type)
-        {
-        case 0u: return Stack ? PpcLoadPairPsqFloatStackInline(addr) : PpcLoadPairPsqFloatFastInline(addr);
-        case 4u: return Stack ? PpcLoadPairPsqIntegerStackInline<uint8_t>(addr, scale) : PpcLoadPairPsqIntegerFastInline<uint8_t>(addr, scale);
-        case 5u: return Stack ? PpcLoadPairPsqIntegerStackInline<uint16_t>(addr, scale) : PpcLoadPairPsqIntegerFastInline<uint16_t>(addr, scale);
-        case 6u: return Stack ? PpcLoadPairPsqIntegerStackInline<int8_t>(addr, scale) : PpcLoadPairPsqIntegerFastInline<int8_t>(addr, scale);
-        case 7u: return Stack ? PpcLoadPairPsqIntegerStackInline<int16_t>(addr, scale) : PpcLoadPairPsqIntegerFastInline<int16_t>(addr, scale);
-        default: std::abort();
-        }
-    }
-    else
-    {
-        switch (type)
-        {
-        case 0u: return Stack ? PpcLoadSinglePsqFloatStackInline(addr) : PpcLoadSinglePsqFloatFastInline(addr);
-        case 4u: return Stack ? PpcLoadSinglePsqQuantizedStackInline<uint8_t>(addr, scale) : PpcLoadSinglePsqQuantizedFastInline<uint8_t>(addr, scale);
-        case 5u: return Stack ? PpcLoadSinglePsqQuantizedStackInline<uint16_t>(addr, scale) : PpcLoadSinglePsqQuantizedFastInline<uint16_t>(addr, scale);
-        case 6u: return Stack ? PpcLoadSinglePsqQuantizedStackInline<int8_t>(addr, scale) : PpcLoadSinglePsqQuantizedFastInline<int8_t>(addr, scale);
-        case 7u: return Stack ? PpcLoadSinglePsqQuantizedStackInline<int16_t>(addr, scale) : PpcLoadSinglePsqQuantizedFastInline<int16_t>(addr, scale);
-        default: std::abort();
-        }
-    }
-}
+template <uint32_t W, bool Stack>
+MKW_PPC_NO_INLINE MKW_PPC_COLD double PPC_PsqLStateFallback(uint32_t gqr, uint32_t addr);
+
+extern template double PPC_PsqLStateFallback<0u, false>(uint32_t, uint32_t);
+extern template double PPC_PsqLStateFallback<0u, true>(uint32_t, uint32_t);
+extern template double PPC_PsqLStateFallback<1u, false>(uint32_t, uint32_t);
+extern template double PPC_PsqLStateFallback<1u, true>(uint32_t, uint32_t);
 
 // Keep the normal explicit-state path small and directly optimizable. Exact
 // unscaled encodings cover the SDK's common GQR setup; scaled and reserved
@@ -1442,41 +1418,17 @@ MKW_PPC_FORCE_INLINE double PPC_PsqLStateInline(uint32_t gqr, uint32_t addr)
         if constexpr (W == 0u) return Stack ? PpcLoadPairPsqIntegerStackInline<int16_t>(addr, 0u) : PpcLoadPairPsqIntegerFastInline<int16_t>(addr, 0u);
         else return Stack ? PpcLoadSinglePsqQuantizedStackInline<int16_t>(addr, 0u) : PpcLoadSinglePsqQuantizedFastInline<int16_t>(addr, 0u);
     default:
-        return PPC_PsqLStateFallback<W, I, Stack>(gqr, addr);
+        return PPC_PsqLStateFallback<W, Stack>(gqr, addr);
     }
 }
 
-template <uint32_t W, uint32_t I, bool Stack>
-MKW_PPC_NO_INLINE MKW_PPC_COLD inline void PPC_PsqStStateFallback(uint32_t gqr, uint32_t addr, double value)
-{
-    static_assert(W <= 1u && I < 8u);
-    const uint32_t type = gqr & 0x7u;
-    const uint32_t scale = (gqr >> 8) & 0x3Fu;
-    if constexpr (W == 0u)
-    {
-        switch (type)
-        {
-        case 0u: Stack ? PpcStorePairPsqFloatStackInline(addr, value) : PpcStorePairPsqFloatFastInline(addr, value); return;
-        case 4u: if constexpr (Stack) PpcStorePairPsqQuantizedStackInline<uint8_t>(addr, value, scale); else PpcStorePairPsqQuantizedFastInline<uint8_t>(addr, value, scale); return;
-        case 5u: if constexpr (Stack) PpcStorePairPsqQuantizedStackInline<uint16_t>(addr, value, scale); else PpcStorePairPsqQuantizedFastInline<uint16_t>(addr, value, scale); return;
-        case 6u: if constexpr (Stack) PpcStorePairPsqQuantizedStackInline<int8_t>(addr, value, scale); else PpcStorePairPsqQuantizedFastInline<int8_t>(addr, value, scale); return;
-        case 7u: if constexpr (Stack) PpcStorePairPsqQuantizedStackInline<int16_t>(addr, value, scale); else PpcStorePairPsqQuantizedFastInline<int16_t>(addr, value, scale); return;
-        default: std::abort();
-        }
-    }
-    else
-    {
-        switch (type)
-        {
-        case 0u: if constexpr (Stack) PpcStoreSinglePsqFloatStackInline(addr, value); else PpcStoreSinglePsqFloatFastInline(addr, value); return;
-        case 4u: if constexpr (Stack) PpcStoreSinglePsqQuantizedStackInline<uint8_t>(addr, value, scale); else PpcStoreSinglePsqQuantizedFastInline<uint8_t>(addr, value, scale); return;
-        case 5u: if constexpr (Stack) PpcStoreSinglePsqQuantizedStackInline<uint16_t>(addr, value, scale); else PpcStoreSinglePsqQuantizedFastInline<uint16_t>(addr, value, scale); return;
-        case 6u: if constexpr (Stack) PpcStoreSinglePsqQuantizedStackInline<int8_t>(addr, value, scale); else PpcStoreSinglePsqQuantizedFastInline<int8_t>(addr, value, scale); return;
-        case 7u: if constexpr (Stack) PpcStoreSinglePsqQuantizedStackInline<int16_t>(addr, value, scale); else PpcStoreSinglePsqQuantizedFastInline<int16_t>(addr, value, scale); return;
-        default: std::abort();
-        }
-    }
-}
+template <uint32_t W, bool Stack>
+MKW_PPC_NO_INLINE MKW_PPC_COLD void PPC_PsqStStateFallback(uint32_t gqr, uint32_t addr, double value);
+
+extern template void PPC_PsqStStateFallback<0u, false>(uint32_t, uint32_t, double);
+extern template void PPC_PsqStStateFallback<0u, true>(uint32_t, uint32_t, double);
+extern template void PPC_PsqStStateFallback<1u, false>(uint32_t, uint32_t, double);
+extern template void PPC_PsqStStateFallback<1u, true>(uint32_t, uint32_t, double);
 
 template <uint32_t W, uint32_t I, bool Stack>
 MKW_PPC_FORCE_INLINE void PPC_PsqStStateInline(uint32_t gqr, uint32_t addr, double value)
@@ -1505,11 +1457,18 @@ MKW_PPC_FORCE_INLINE void PPC_PsqStStateInline(uint32_t gqr, uint32_t addr, doub
         else { if constexpr (Stack) PpcStoreSinglePsqQuantizedStackInline<int16_t>(addr, value, 0u); else PpcStoreSinglePsqQuantizedFastInline<int16_t>(addr, value, 0u); }
         return;
     default:
-        PPC_PsqStStateFallback<W, I, Stack>(gqr, addr, value);
+        PPC_PsqStStateFallback<W, Stack>(gqr, addr, value);
         return;
     }
 }
 
+template <uint32_t W>
+MKW_PPC_NO_INLINE MKW_PPC_COLD double PPC_PsqLResolvedStateFallback(
+    uint32_t gqr, uint8_t* resolvedHost, uint32_t offset, uint32_t addr);
+
+extern template double PPC_PsqLResolvedStateFallback<0u>(uint32_t, uint8_t*, uint32_t, uint32_t);
+extern template double PPC_PsqLResolvedStateFallback<1u>(uint32_t, uint8_t*, uint32_t, uint32_t);
+
 template <uint32_t W, uint32_t I>
 MKW_PPC_FORCE_INLINE double PPC_PsqLResolvedStateInline(
     uint32_t gqr, uint8_t* resolvedHost, uint32_t offset, uint32_t addr)
@@ -1517,33 +1476,41 @@ MKW_PPC_FORCE_INLINE double PPC_PsqLResolvedStateInline(
     static_assert(W <= 1u && I < 8u);
     if (!resolvedHost) [[unlikely]] return PPC_PsqLStateInline<W, I, false>(gqr, addr);
     const uint32_t type = (gqr >> 16) & 0x7u;
-    const uint32_t scale = (gqr >> 24) & 0x3Fu;
+    if (type == 0u) {
+        if constexpr (W == 0u) return PpcLoadPairPsqFloatResolvedInline(resolvedHost, offset, addr);
+        else return PpcLoadSinglePsqFloatResolvedInline(resolvedHost, offset, addr);
+    }
     if constexpr (W == 0u)
     {
-        switch (type)
+        switch (gqr & 0x3F070000u)
         {
-        case 0u: return PpcLoadPairPsqFloatResolvedInline(resolvedHost, offset, addr);
-        case 4u: return PpcLoadPairPsqIntegerResolvedInline<uint8_t>(resolvedHost, offset, addr, scale);
-        case 5u: return PpcLoadPairPsqIntegerResolvedInline<uint16_t>(resolvedHost, offset, addr, scale);
-        case 6u: return PpcLoadPairPsqIntegerResolvedInline<int8_t>(resolvedHost, offset, addr, scale);
-        case 7u: return PpcLoadPairPsqIntegerResolvedInline<int16_t>(resolvedHost, offset, addr, scale);
-        default: std::abort();
+        case 0x00040000u: return PpcLoadPairPsqIntegerResolvedInline<uint8_t>(resolvedHost, offset, addr, 0u);
+        case 0x00050000u: return PpcLoadPairPsqIntegerResolvedInline<uint16_t>(resolvedHost, offset, addr, 0u);
+        case 0x00060000u: return PpcLoadPairPsqIntegerResolvedInline<int8_t>(resolvedHost, offset, addr, 0u);
+        case 0x00070000u: return PpcLoadPairPsqIntegerResolvedInline<int16_t>(resolvedHost, offset, addr, 0u);
+        default: return PPC_PsqLResolvedStateFallback<W>(gqr, resolvedHost, offset, addr);
         }
     }
     else
     {
-        switch (type)
+        switch (gqr & 0x3F070000u)
         {
-        case 0u: return PpcLoadSinglePsqFloatResolvedInline(resolvedHost, offset, addr);
-        case 4u: return PpcLoadSinglePsqQuantizedResolvedInline<uint8_t>(resolvedHost, offset, addr, scale);
-        case 5u: return PpcLoadSinglePsqQuantizedResolvedInline<uint16_t>(resolvedHost, offset, addr, scale);
-        case 6u: return PpcLoadSinglePsqQuantizedResolvedInline<int8_t>(resolvedHost, offset, addr, scale);
-        case 7u: return PpcLoadSinglePsqQuantizedResolvedInline<int16_t>(resolvedHost, offset, addr, scale);
-        default: std::abort();
+        case 0x00040000u: return PpcLoadSinglePsqQuantizedResolvedInline<uint8_t>(resolvedHost, offset, addr, 0u);
+        case 0x00050000u: return PpcLoadSinglePsqQuantizedResolvedInline<uint16_t>(resolvedHost, offset, addr, 0u);
+        case 0x00060000u: return PpcLoadSinglePsqQuantizedResolvedInline<int8_t>(resolvedHost, offset, addr, 0u);
+        case 0x00070000u: return PpcLoadSinglePsqQuantizedResolvedInline<int16_t>(resolvedHost, offset, addr, 0u);
+        default: return PPC_PsqLResolvedStateFallback<W>(gqr, resolvedHost, offset, addr);
         }
     }
 }
 
+template <uint32_t W>
+MKW_PPC_NO_INLINE MKW_PPC_COLD void PPC_PsqStResolvedStateFallback(
+    uint32_t gqr, uint8_t* resolvedHost, uint32_t offset, uint32_t addr, double value);
+
+extern template void PPC_PsqStResolvedStateFallback<0u>(uint32_t, uint8_t*, uint32_t, uint32_t, double);
+extern template void PPC_PsqStResolvedStateFallback<1u>(uint32_t, uint8_t*, uint32_t, uint32_t, double);
+
 template <uint32_t W, uint32_t I>
 MKW_PPC_FORCE_INLINE void PPC_PsqStResolvedStateInline(
     uint32_t gqr, uint8_t* resolvedHost, uint32_t offset, uint32_t addr, double value)
@@ -1555,29 +1522,32 @@ MKW_PPC_FORCE_INLINE void PPC_PsqStResolvedStateInline(
         return;
     }
     const uint32_t type = gqr & 0x7u;
-    const uint32_t scale = (gqr >> 8) & 0x3Fu;
+    if (type == 0u) {
+        if constexpr (W == 0u) PpcStorePairPsqFloatResolvedInline(resolvedHost, offset, addr, value);
+        else PpcStoreSinglePsqFloatResolvedInline(resolvedHost, offset, addr, value);
+        return;
+    }
     if constexpr (W == 0u)
     {
-        switch (type)
+        switch (gqr & 0x3F07u)
         {
-        case 0u: PpcStorePairPsqFloatResolvedInline(resolvedHost, offset, addr, value); return;
-        case 4u: PpcStorePairPsqQuantizedResolvedInline<uint8_t>(resolvedHost, offset, addr, value, scale); return;
-        case 5u: PpcStorePairPsqQuantizedResolvedInline<uint16_t>(resolvedHost, offset, addr, value, scale); return;
-        case 6u: PpcStorePairPsqQuantizedResolvedInline<int8_t>(resolvedHost, offset, addr, value, scale); return;
-        case 7u: PpcStorePairPsqQuantizedResolvedInline<int16_t>(resolvedHost, offset, addr, value, scale); return;
-        default: std::abort();
+        case 0x3D04u: PpcStorePairPsqU8Scale61ResolvedInline(resolvedHost, offset, addr, value); return;
+        case 4u: PpcStorePairPsqQuantizedResolvedInline<uint8_t>(resolvedHost, offset, addr, value, 0u); return;
+        case 5u: PpcStorePairPsqQuantizedResolvedInline<uint16_t>(resolvedHost, offset, addr, value, 0u); return;
+        case 6u: PpcStorePairPsqQuantizedResolvedInline<int8_t>(resolvedHost, offset, addr, value, 0u); return;
+        case 7u: PpcStorePairPsqQuantizedResolvedInline<int16_t>(resolvedHost, offset, addr, value, 0u); return;
+        default: PPC_PsqStResolvedStateFallback<W>(gqr, resolvedHost, offset, addr, value); return;
         }
     }
     else
     {
-        switch (type)
+        switch (gqr & 0x3F07u)
         {
-        case 0u: PpcStoreSinglePsqFloatResolvedInline(resolvedHost, offset, addr, value); return;
-        case 4u: PpcStoreSinglePsqQuantizedResolvedInline<uint8_t>(resolvedHost, offset, addr, value, scale); return;
-        case 5u: PpcStoreSinglePsqQuantizedResolvedInline<uint16_t>(resolvedHost, offset, addr, value, scale); return;
-        case 6u: PpcStoreSinglePsqQuantizedResolvedInline<int8_t>(resolvedHost, offset, addr, value, scale); return;
-        case 7u: PpcStoreSinglePsqQuantizedResolvedInline<int16_t>(resolvedHost, offset, addr, value, scale); return;
-        default: std::abort();
+        case 4u: PpcStoreSinglePsqQuantizedResolvedInline<uint8_t>(resolvedHost, offset, addr, value, 0u); return;
+        case 5u: PpcStoreSinglePsqQuantizedResolvedInline<uint16_t>(resolvedHost, offset, addr, value, 0u); return;
+        case 6u: PpcStoreSinglePsqQuantizedResolvedInline<int8_t>(resolvedHost, offset, addr, value, 0u); return;
+        case 7u: PpcStoreSinglePsqQuantizedResolvedInline<int16_t>(resolvedHost, offset, addr, value, 0u); return;
+        default: PPC_PsqStResolvedStateFallback<W>(gqr, resolvedHost, offset, addr, value); return;
         }
     }
 }

runtime/include/music_attenuation.h

@@ -5,7 +5,8 @@
 namespace MusicAttenuation {
 
 // Enables the optional external-media integration (Windows media sessions,
-// or MPRIS over D-Bus on Linux). The monitor is started lazily the first time
+// Core Audio output activity on macOS, or MPRIS over D-Bus on Linux).
+// The monitor is started lazily the first time
 // this is enabled.
 void SetEnabled(bool enabled) noexcept;
 void SetMusicVolume(float volume) noexcept;

runtime/include/runtime_config.h

@@ -33,6 +33,7 @@
 
 struct RuntimeUserConfig {
     std::optional<bool> widescreen;
+    std::optional<bool> forceAspect169;
     std::optional<int32_t> windowPosX;
     std::optional<int32_t> windowPosY;
     std::optional<uint32_t> windowWidth;
@@ -41,6 +42,7 @@ struct RuntimeUserConfig {
     std::optional<std::string> graphicsApi;
     std::optional<std::string> displayMode;
     std::optional<uint32_t> frameInterpolationFps;
+    std::optional<bool> metalFxSpatialUpscaling;
     std::optional<bool> skipUnreadyPipelines;
     std::optional<bool> disableCopyFilter;
     std::optional<bool> textureReplacements;
@@ -298,6 +300,7 @@ inline void EnsureConfigFile() {
               "# Set paths.dvd_root to an extracted Mario Kart Wii DATA directory.\n\n"
               "[video]\n"
               "widescreen = true\n"
+              "force_16_9 = false\n"
               "resolution_multiplier = 1.0\n"
               "frame_interpolation_fps = 0\n"
               "display_mode = \"windowed\"\n"
@@ -426,6 +429,7 @@ inline RuntimeUserConfig ParseConfigDocument(const toml::value& document) {
     }
 
     config.widescreen = FindConfigValue<bool>(document, "video", "widescreen");
+    config.forceAspect169 = FindConfigValue<bool>(document, "video", "force_16_9");
     config.windowPosX = FindConfigInt(document, "video", "window_x");
     config.windowPosY = FindConfigInt(document, "video", "window_y");
     if (auto value = FindConfigUint(document, "video", "window_width"); value && *value != 0) {
@@ -456,6 +460,8 @@ inline RuntimeUserConfig ParseConfigDocument(const toml::value& document) {
             config.frameInterpolationFps = migrated;
         }
     }
+    config.metalFxSpatialUpscaling =
+        FindConfigValue<bool>(document, "video", "metalfx_spatial_upscaling");
     config.skipUnreadyPipelines = FindConfigValue<bool>(document, "video", "skip_unready_pipelines");
     config.disableCopyFilter = FindConfigValue<bool>(document, "video", "disable_copy_filter");
     config.showFps = FindConfigValue<bool>(document, "video", "show_fps");
@@ -657,6 +663,11 @@ inline bool SetFrameInterpolationFps(uint32_t value) {
     return WriteSetting("video", "frame_interpolation_fps", std::to_string(value));
 }
 
+inline bool SetMetalFxSpatialUpscaling(bool value) {
+    Mutable().metalFxSpatialUpscaling = value;
+    return WriteSetting("video", "metalfx_spatial_upscaling", value ? "true" : "false");
+}
+
 inline bool SetDisplayMode(std::string value) {
     if (!IsSupportedDisplayMode(value)) {
         return false;
@@ -782,6 +793,15 @@ inline bool WidescreenEnabled(bool fallback = false) {
     return Get().widescreen.value_or(fallback);
 }
 
+inline bool ForceAspect169Enabled(bool fallback = false) {
+    return Get().forceAspect169.value_or(fallback);
+}
+
+inline bool SetForceAspect169(bool value) {
+    Mutable().forceAspect169 = value;
+    return WriteSetting("video", "force_16_9", value ? "true" : "false");
+}
+
 inline bool WindowPosition(int32_t& x, int32_t& y) {
     if (!Get().windowPosX || !Get().windowPosY) {
         return false;
@@ -803,6 +823,10 @@ inline float ResolutionMultiplier(float fallback = 1.0f) {
     return std::max(0.0f, Get().resolutionMultiplier.value_or(fallback));
 }
 
+inline bool MetalFxSpatialUpscaling(bool fallback = false) {
+    return Get().metalFxSpatialUpscaling.value_or(fallback);
+}
+
 inline float AudioVolume(float fallback = 1.0f) {
     return std::clamp(Get().audioVolume.value_or(fallback), 0.0f, 1.0f);
 }

runtime/include/wii_es_crypto.h

@@ -132,8 +132,9 @@ using CryptoEcdsa = CryptoPP::ECDSA<CryptoPP::EC2N, CryptoPP::SHA1>;
 
 inline CryptoEcdsa::PrivateKey MakePrivateKey(const uint8_t* key) {
     CryptoPP::DL_GroupParameters_EC<CryptoPP::EC2N> parameters(CryptoPP::ASN1::sect233r1());
-    const CryptoPP::Integer exponent(key, 30);
-    if (exponent <= CryptoPP::Integer::Zero() || exponent >= parameters.GetSubgroupOrder()) {
+    // Wii keys need not be canonical scalars; reduction preserves their public key.
+    const CryptoPP::Integer exponent = CryptoPP::Integer(key, 30) % parameters.GetSubgroupOrder();
+    if (exponent == CryptoPP::Integer::Zero()) {
         throw std::invalid_argument("Wii ES private key is outside the sect233r1 subgroup");
     }
 

runtime/src/controller_mapping_wizard.cpp

@@ -5,6 +5,7 @@
 #include <imgui.h>
 #include <SDL3/SDL_gamepad.h>
 #include <SDL3/SDL_joystick.h>
+#include <SDL3/SDL_platform.h>
 
 #include <algorithm>
 #include <array>
@@ -146,7 +147,7 @@ std::string BuildMappingString() {
             mapping += std::string(kSteps[i].mappingKey) + ":" + *g_wizard.bindings[i] + ",";
         }
     }
-    mapping += "platform:Windows,";
+    mapping += std::string("platform:") + SDL_GetPlatform() + ",";
     return mapping;
 }
 

runtime/src/dynamic_aspect.cpp

@@ -2,6 +2,7 @@
 #include "memory.h"
 
 #include <algorithm>
+#include <atomic>
 #include "aurora_events.h"
 #include "hle/gx/gx_dynamic_aspect.h"
 
@@ -14,6 +15,10 @@ extern "C" int g_gxFrameCount;
 namespace {
 
 bool g_widescreenConfigured = false;
+bool g_widescreenSetting = false;
+bool g_forceAspect169 = false;
+std::atomic_bool g_requestedForceAspect169{false};
+bool g_policyDirty = false;
 uint32_t g_lastEggWidth43 = 0;
 uint32_t g_lastEggWidth169 = 0;
 
@@ -167,21 +172,54 @@ void AssertMkwOffscreenScreenBypass() {
 }
 
 void UpdateMkwDynamicAspectSurface(uint32_t surfaceWidth, uint32_t surfaceHeight) {
-    if (!g_widescreenConfigured || surfaceWidth == 0 || surfaceHeight == 0) {
+    const bool requestedForceAspect169 = g_requestedForceAspect169.load(std::memory_order_acquire);
+    if (g_forceAspect169 != requestedForceAspect169) {
+        g_forceAspect169 = requestedForceAspect169;
+        g_widescreenConfigured = g_widescreenSetting || g_forceAspect169;
+        g_dynamicAspectRatioEnabled = g_widescreenConfigured;
+        g_policyDirty = true;
+    }
+    if (surfaceWidth == 0 || surfaceHeight == 0) {
         return;
     }
-    AuroraSetViewportPolicy(AURORA_VIEWPORT_STRETCH);
-    ApplyEggScreenRecords(surfaceWidth, surfaceHeight);
+    if (!g_widescreenConfigured) {
+        if (g_policyDirty) {
+            AuroraSetViewportPolicy(AURORA_VIEWPORT_FIT);
+            VILockAspectRatio(4, 3);
+            ApplyEggScreenRecords(surfaceWidth, surfaceHeight);
+            g_policyDirty = false;
+        }
+        return;
+    }
+    if (g_policyDirty) {
+        VIUnlockAspectRatio();
+        g_policyDirty = false;
+    }
+    AuroraSetViewportPolicy(g_forceAspect169 ? AURORA_VIEWPORT_16_9 : AURORA_VIEWPORT_STRETCH);
+    ApplyEggScreenRecords(g_forceAspect169 ? 16u : surfaceWidth,
+                          g_forceAspect169 ? 9u : surfaceHeight);
 }
 
-void ConfigureMkwDynamicAspect(bool widescreen, uint32_t surfaceWidth, uint32_t surfaceHeight) {
-    g_widescreenConfigured = widescreen;
-    g_dynamicAspectRatioEnabled = widescreen;
+void SetMkwForceAspect169(bool enabled) {
+    g_requestedForceAspect169.store(enabled, std::memory_order_release);
+}
+
+bool MkwForceAspect169Requested() {
+    return g_requestedForceAspect169.load(std::memory_order_acquire);
+}
+
+void ConfigureMkwDynamicAspect(bool widescreen, bool forceAspect169, uint32_t surfaceWidth, uint32_t surfaceHeight) {
+    g_widescreenSetting = widescreen;
+    g_widescreenConfigured = widescreen || forceAspect169;
+    g_forceAspect169 = forceAspect169;
+    g_requestedForceAspect169.store(forceAspect169, std::memory_order_relaxed);
+    g_dynamicAspectRatioEnabled = g_widescreenConfigured;
     g_lastEggWidth43 = 0;
     g_lastEggWidth169 = 0;
-    if (widescreen) {
+    if (g_widescreenConfigured) {
         VIUnlockAspectRatio();
-        ApplyEggScreenRecords(surfaceWidth, surfaceHeight);
+        ApplyEggScreenRecords(forceAspect169 ? 16u : surfaceWidth,
+                              forceAspect169 ? 9u : surfaceHeight);
         return;
     }
 

runtime/src/external_audio_macos.cpp

@@ -0,0 +1,87 @@
+#if defined(__APPLE__)
+
+#include "external_audio_macos.h"
+
+#include <CoreAudio/CoreAudio.h>
+#include <unistd.h>
+#include <vector>
+
+namespace MusicAttenuation {
+namespace {
+
+#if __MAC_OS_X_VERSION_MAX_ALLOWED >= 140200
+constexpr auto kProcessObjectList = kAudioHardwarePropertyProcessObjectList;
+constexpr auto kProcessPid = kAudioProcessPropertyPID;
+constexpr auto kProcessRunningOutput = kAudioProcessPropertyIsRunningOutput;
+#else
+// Public Core Audio selector ABI values, for SDKs predating process objects.
+// The runtime HasProperty check still determines whether the OS supports them.
+constexpr AudioObjectPropertySelector kProcessObjectList = 'prs#';
+constexpr AudioObjectPropertySelector kProcessPid = 'ppid';
+constexpr AudioObjectPropertySelector kProcessRunningOutput = 'piro';
+#endif
+
+template <typename T>
+bool ReadAudioProcessProperty(AudioObjectID object, AudioObjectPropertySelector selector,
+                              T& value) noexcept {
+    const AudioObjectPropertyAddress address{
+        selector, kAudioObjectPropertyScopeGlobal, kAudioObjectPropertyElementMain};
+    UInt32 size = sizeof(value);
+    return AudioObjectGetPropertyData(object, &address, 0, nullptr, &size, &value) == noErr &&
+           size == sizeof(value);
+}
+
+} // namespace
+
+MacOSAudioStatus QueryMacOSExternalAudio() noexcept {
+    const AudioObjectPropertyAddress address{
+        kProcessObjectList,
+        kAudioObjectPropertyScopeGlobal, kAudioObjectPropertyElementMain};
+    // Probe the property instead of raising the game's minimum macOS version.
+    if (!AudioObjectHasProperty(kAudioObjectSystemObject, &address)) {
+        return {};
+    }
+
+    // Processes may start between the size and data queries. Retry a changed
+    // list a bounded number of times; subsequent monitor polls also retry.
+    for (int attempt = 0; attempt < 3; ++attempt) {
+        UInt32 size = 0;
+        if (AudioObjectGetPropertyDataSize(kAudioObjectSystemObject, &address,
+                                          0, nullptr, &size) != noErr ||
+            size % sizeof(AudioObjectID) != 0) {
+            return {};
+        }
+        if (size == 0) {
+            return {true, false};
+        }
+        std::vector<AudioObjectID> processes(size / sizeof(AudioObjectID));
+        const auto result = AudioObjectGetPropertyData(kAudioObjectSystemObject, &address,
+                                                       0, nullptr, &size, processes.data());
+        if (result == kAudioHardwareBadPropertySizeError) {
+            continue;
+        }
+        if (result != noErr || size % sizeof(AudioObjectID) != 0 ||
+            size / sizeof(AudioObjectID) > processes.size()) {
+            return {};
+        }
+        const pid_t ownPid = getpid();
+        for (size_t index = 0; index < size / sizeof(AudioObjectID); ++index) {
+            pid_t pid = 0;
+            UInt32 runningOutput = 0;
+            // An exiting process may disappear mid-query. Never count an
+            // unknown PID or our own SDL output as external playback.
+            if (ReadAudioProcessProperty(processes[index], kProcessPid, pid) &&
+                pid > 0 && pid != ownPid &&
+                ReadAudioProcessProperty(processes[index], kProcessRunningOutput,
+                                         runningOutput) && runningOutput != 0) {
+                return {true, true};
+            }
+        }
+        return {true, false};
+    }
+    return {};
+}
+
+} // namespace MusicAttenuation
+
+#endif

runtime/src/guest_flat_memory_macos.cpp

@@ -2,79 +2,176 @@
 
 #include <mach/mach.h>
 #include <mach/mach_vm.h>
-#include <fcntl.h>
 #include <sys/mman.h>
 #include <unistd.h>
 
 #include <algorithm>
-#include <cstdio>
 #include <mutex>
 #include <stdexcept>
+#include <string>
 #include <vector>
 
 namespace GuestFlat {
 bool g_requiresCheckedAccess = false;
 namespace {
-struct Mapping { uint32_t base; uint64_t size; uint8_t* host; };
+
+struct Store {
+    Backing kind = Backing::Owned;
+    uint32_t owned = 0;
+    uint64_t size = 0;
+    uint8_t* host = nullptr;
+};
+
+struct Mapping {
+    uint32_t base = 0;
+    uint64_t size = 0;
+    uint8_t* host = nullptr;
+};
+
 std::mutex g_mutex;
+std::vector<Store> g_stores;
 std::vector<Mapping> g_mappings;
 std::vector<RegionRequest> g_layout;
 uint8_t* g_base = nullptr;
 bool g_active = false;
 
+inline uint64_t RoundUp(uint64_t value, uint64_t align) {
+    return (value + align - 1) & ~(align - 1);
+}
+
 uint64_t Offset(const RegionRequest& r) {
     if (r.backing == Backing::Mem1) return r.base & 0x1fffffffu;
     if (r.backing == Backing::Mem2) return (r.base & 0x1fffffffu) - 0x10000000u;
     return 0;
 }
+
 bool Same(const std::vector<RegionRequest>& a, const std::vector<RegionRequest>& b) {
     return a.size() == b.size() && std::equal(a.begin(), a.end(), b.begin(),
         [](const auto& x, const auto& y) { return x.base == y.base && x.size == y.size && x.backing == y.backing; });
 }
-int BackingFile(size_t size) {
-    char name[] = "/tmp/wiicompiled-guest-XXXXXX";
-    const int fd = mkstemp(name);
-    if (fd >= 0) { unlink(name); if (ftruncate(fd, static_cast<off_t>(size)) != 0) { close(fd); return -1; } }
-    return fd;
-}
+
 } // namespace
 
 bool IsActive() { return g_active; }
+
 void Initialize(const std::vector<RegionRequest>& regions) {
     std::lock_guard lock(g_mutex);
-    g_requiresCheckedAccess = static_cast<size_t>(getpagesize()) > kGuestPageSize;
-    if (g_active) { if (!Same(g_layout, regions)) throw std::runtime_error("flat guest layout cannot be remapped"); return; }
+    const uint64_t pageSize = static_cast<uint64_t>(getpagesize());
+    g_requiresCheckedAccess = pageSize > kGuestPageSize;
+    if (g_active) {
+        if (!Same(g_layout, regions))
+            throw std::runtime_error("flat guest layout cannot be remapped");
+        return;
+    }
+
+    for (size_t i = 0; i < regions.size(); ++i) {
+        const auto& r = regions[i];
+        if (r.size == 0) continue;
+        if (r.size > kGuestSpaceSize - r.base ||
+            r.base % pageSize != 0 || Offset(r) % pageSize != 0) {
+            throw std::runtime_error("invalid flat guest memory region");
+        }
+        const uint64_t end = static_cast<uint64_t>(r.base) + RoundUp(r.size, pageSize);
+        for (size_t j = 0; j < i; ++j) {
+            const auto& prior = regions[j];
+            if (prior.size == 0) continue;
+            const uint64_t priorEnd = static_cast<uint64_t>(prior.base) + RoundUp(prior.size, pageSize);
+            if (r.base < priorEnd && prior.base < end) {
+                throw std::runtime_error("overlapping flat guest memory regions");
+            }
+        }
+    }
+
     mach_vm_address_t address = kFixedFlatGuestBase;
-    if (mach_vm_allocate(mach_task_self(), &address, kGuestSpaceSize, VM_FLAGS_FIXED) != KERN_SUCCESS || address != kFixedFlatGuestBase)
+    if (mach_vm_allocate(mach_task_self(), &address, kGuestSpaceSize, VM_FLAGS_FIXED) != KERN_SUCCESS || address != kFixedFlatGuestBase) {
         throw std::runtime_error("unable to reserve fixed 4 GiB macOS guest address space");
+    }
     g_base = reinterpret_cast<uint8_t*>(address);
-    struct Store { Backing kind; uint32_t owned; uint64_t size; int fd; };
+
     std::vector<Store> stores;
-    for (const auto& r : regions) {
-        if (!r.size) continue;
-        const uint32_t owned = r.backing == Backing::Owned ? r.base : 0;
-        auto it = std::find_if(stores.begin(), stores.end(), [&](const Store& s) { return s.kind == r.backing && s.owned == owned; });
-        const uint64_t need = Offset(r) + r.size;
-        if (it == stores.end()) stores.push_back({r.backing, owned, need, -1}); else it->size = std::max(it->size, need);
+    try {
+        for (const auto& r : regions) {
+            if (!r.size) continue;
+            const uint32_t owned = r.backing == Backing::Owned ? r.base : 0;
+            auto it = std::find_if(stores.begin(), stores.end(), [&](const Store& s) {
+                return s.kind == r.backing && s.owned == owned;
+            });
+            const uint64_t need = RoundUp(Offset(r) + r.size, pageSize);
+            if (it == stores.end()) {
+                stores.push_back({r.backing, owned, need, nullptr});
+            } else {
+                it->size = std::max(it->size, need);
+            }
+        }
+
+        for (auto& s : stores) {
+            void* host = mmap(nullptr, static_cast<size_t>(s.size), PROT_READ | PROT_WRITE,
+                              MAP_PRIVATE | MAP_ANON, -1, 0);
+            if (host == MAP_FAILED) {
+                throw std::runtime_error("unable to allocate anonymous macOS guest backing store");
+            }
+            s.host = static_cast<uint8_t*>(host);
+        }
+
+        for (const auto& r : regions) {
+            if (!r.size) continue;
+            const uint32_t owned = r.backing == Backing::Owned ? r.base : 0;
+            const auto& s = *std::find_if(stores.begin(), stores.end(), [&](const Store& x) {
+                return x.kind == r.backing && x.owned == owned;
+            });
+            mach_vm_address_t target = reinterpret_cast<mach_vm_address_t>(g_base + r.base);
+            vm_prot_t cur = VM_PROT_NONE, max = VM_PROT_NONE;
+            const kern_return_t kr = mach_vm_remap(
+                mach_task_self(),
+                &target,
+                static_cast<mach_vm_size_t>(RoundUp(r.size, pageSize)),
+                0,
+                VM_FLAGS_FIXED | VM_FLAGS_OVERWRITE,
+                mach_task_self(),
+                reinterpret_cast<mach_vm_address_t>(s.host + Offset(r)),
+                FALSE,
+                &cur,
+                &max,
+                VM_INHERIT_NONE
+            );
+            if (kr != KERN_SUCCESS) {
+                throw std::runtime_error(std::string("mach_vm_remap guest alias failed: ") + mach_error_string(kr));
+            }
+            g_mappings.push_back({r.base, r.size, s.host + Offset(r)});
+        }
+
+        g_layout = regions;
+        g_stores = std::move(stores);
+        g_active = true;
+    } catch (...) {
+        for (auto& s : stores) {
+            if (s.host != nullptr) {
+                munmap(s.host, static_cast<size_t>(s.size));
+            }
+        }
+        mach_vm_deallocate(mach_task_self(), address, kGuestSpaceSize);
+        g_mappings.clear();
+        g_stores.clear();
+        g_layout.clear();
+        g_base = nullptr;
+        throw;
     }
-    for (auto& s : stores) { s.fd = BackingFile(s.size); if (s.fd < 0) throw std::runtime_error("unable to create macOS guest backing store"); }
-    for (const auto& r : regions) {
-        if (!r.size) continue;
-        const uint32_t owned = r.backing == Backing::Owned ? r.base : 0;
-        const auto& s = *std::find_if(stores.begin(), stores.end(), [&](const Store& x) { return x.kind == r.backing && x.owned == owned; });
-        auto* host = static_cast<uint8_t*>(mmap(nullptr, r.size, PROT_READ | PROT_WRITE, MAP_SHARED, s.fd, Offset(r)));
-        auto* guest = mmap(g_base + r.base, r.size, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_FIXED, s.fd, Offset(r));
-        if (host == MAP_FAILED || guest != g_base + r.base) throw std::runtime_error("unable to map macOS guest alias");
-        g_mappings.push_back({r.base, r.size, host});
-    }
-    for (auto& s : stores) close(s.fd);
-    g_layout = regions; g_active = true;
 }
-uint8_t* HostPointer(uint32_t a) { for (const auto& m : g_mappings) if (a >= m.base && uint64_t(a - m.base) < m.size) return m.host + (a - m.base); return nullptr; }
+
+uint8_t* HostPointer(uint32_t a) {
+    for (const auto& m : g_mappings) {
+        if (a >= m.base && uint64_t(a - m.base) < m.size) {
+            return m.host + (a - m.base);
+        }
+    }
+    return nullptr;
+}
+
 void ProtectDeferredRange(uint32_t, size_t) {}
 void UnprotectDeferredRange(uint32_t, size_t) {}
 void RegisterExecutableRange(uint32_t, uint32_t) {}
 FaultCounters Counters() { return {}; }
 void LogFaultSummary() noexcept {}
 bool HandleAccessViolation(void*, bool) noexcept { return false; }
+
 } // namespace GuestFlat

runtime/src/hle/input/kpad.cpp

@@ -1,4 +1,5 @@
 #include "hle_stubs.h"
+#include "input_bindings.h"
 #include "memory.h"
 #include "wii_remote_input.h"
 
@@ -203,6 +204,24 @@ void WriteUnifiedStatus(uint32_t addr, const WiiRemoteInput::KpadSample* sample)
     }
 }
 
+// Neutral sticks and no buttons while an overlay owns input; the remote stays connected.
+bool ReadSample(uint32_t chan, WiiRemoteInput::KpadSample& sample) {
+    if (!WiiRemoteInput::ReadKpadSample(chan, sample)) {
+        return false;
+    }
+    if (InputBindings::InputBlocked()) {
+        sample.hold = 0;
+        sample.clHold = 0;
+        sample.stick[0] = sample.stick[1] = 0.0f;
+        sample.clLStick[0] = sample.clLStick[1] = 0.0f;
+        sample.clRStick[0] = sample.clRStick[1] = 0.0f;
+        sample.clLStickRaw[0] = sample.clLStickRaw[1] = 0;
+        sample.clRStickRaw[0] = sample.clRStickRaw[1] = 0;
+        sample.clTriggerL = sample.clTriggerR = 0;
+    }
+    return true;
+}
+
 } // namespace
 
 // KPADRead: fills KPADStatus[0] for `chan` from the Bluetooth remote, returns the entry count.
@@ -212,7 +231,7 @@ extern "C" int32_t KPAD__Read_HLE(uint32_t chan, uint32_t statusPtr, uint32_t co
         return 0;
     }
     WiiRemoteInput::KpadSample sample;
-    const bool have = WiiRemoteInput::ReadKpadSample(chan, sample);
+    const bool have = ReadSample(chan, sample);
     try {
         return WriteStatus(chan, statusPtr, have ? &sample : nullptr);
     } catch (const Memory::AccessViolation&) {
@@ -234,7 +253,7 @@ extern "C" int32_t KPAD__GetUnifiedWpadStatus_HLE(uint32_t chan, uint32_t status
         return 0;
     }
     WiiRemoteInput::KpadSample sample;
-    const bool have = WiiRemoteInput::ReadKpadSample(chan, sample);
+    const bool have = ReadSample(chan, sample);
     try {
         const uint32_t entries = std::min(count, kMaxEntries);
         for (uint32_t i = 0; i < entries; ++i) {

runtime/src/hle/net/network_internal.h

@@ -242,7 +242,6 @@ void WritePollResults(uint32_t outAddress,
                       const std::vector<NetworkPollContract::CopiedDescriptor>& descriptors);
 
 // network_socket.cpp
-int32_t DeleteWiiSocket(uint32_t fd);
 void CleanupAllWiiSockets();
 sockaddr_in ReadWiiSockAddr(uint32_t addr);
 int32_t HandleIpTopIoctl(uint32_t cmd, uint32_t inBuf, uint32_t inLen, uint32_t outBuf,

runtime/src/hle/net/network_socket.cpp

@@ -467,7 +467,8 @@ int32_t HandleIpTopIoctlv(uint32_t cmd, const std::vector<IoVector>& in, const s
         const int ret = sendto(s->native, reinterpret_cast<const char*>(sendData), static_cast<int>(sendSize),
                                static_cast<int>(flags), destPtr, destLen);
         const int hostError = ret < 0 ? NativeLastError() : 0;
-        int32_t result = SocketResult(ret);
+        // Diagnostics may change the native error; use the send result captured above.
+        int32_t result = ret >= 0 ? SocketResult(ret) : SocketErrorResult(hostError);
         if (patchedWrite && ret == static_cast<int>(sendSize)) {
             result = static_cast<int32_t>(in[0].size);
         }

runtime/src/hle/net/network_ssl.cpp

@@ -54,6 +54,9 @@ constexpr int kMaxSslSessions = 4;
 struct SslSession {
     bool active = false;
     bool handshaked = false;
+    // A failed POSIX TLS write cannot be resumed with a new guest buffer.
+    // Keep the slot and socket ownership intact until explicit teardown.
+    bool failed = false;
     bool plaintextWfc = false;
     uint32_t socketFd = UINT32_MAX;
     NativeSocket native = kInvalidSocket;
@@ -761,6 +764,14 @@ static int32_t SslHandshakeImpl(SslSession& ssl) {
     return SSL_OK;
 }
 
+static int32_t FailSslWrite(SslSession& ssl) {
+    ssl.failed = true;
+    // Stop transport I/O without deleting the guest descriptor or freeing a
+    // session still referenced by the IOCTLV_NET_SSL_WRITE caller.
+    ::shutdown(ssl.native, SHUT_RDWR);
+    return SSL_ERR_FAILED;
+}
+
 static int32_t SslWrite(SslSession& ssl, const uint8_t* data, uint32_t size) {
     if (!data || size == 0) {
         return SSL_ERR_ZERO;
@@ -795,12 +806,11 @@ static int32_t SslWrite(SslSession& ssl, const uint8_t* data, uint32_t size) {
         }
         if (ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE) {
             if (std::chrono::steady_clock::now() >= writeDeadline) {
-                DeleteWiiSocket(ssl.socketFd);
-                return SSL_ERR_FAILED;
+                return FailSslWrite(ssl);
             }
             continue;
         }
-        return SSL_ERR_FAILED;
+        return FailSslWrite(ssl);
     }
     return static_cast<int32_t>(totalWritten);
 }
@@ -842,6 +852,9 @@ static int32_t SslRead(SslSession& ssl, uint8_t* out, uint32_t size) {
 // The handshake runs on every SSL read/write, so a failure repeats for as long
 // as the session lives; report only the first one.
 static int32_t SslHandshake(SslSession& ssl) {
+    if (ssl.failed) {
+        return SSL_ERR_FAILED;
+    }
     const int32_t result = SslHandshakeImpl(ssl);
     if (result != SSL_OK && !ssl.loggedHandshakeFail) {
         ssl.loggedHandshakeFail = true;
@@ -947,6 +960,11 @@ int32_t HandleSslIoctlv(uint32_t cmd, const std::vector<IoVector>& in, const std
             WriteSslReturn(in, SSL_ERR_ID);
             return 0;
         }
+        // Reject before NAS buffering can acknowledge data on a failed session.
+        if (g_sslSessions[sslId].failed) {
+            WriteSslReturn(in, SSL_ERR_FAILED);
+            return 0;
+        }
         if (out.size() < 2 || !out[1].address) {
             WriteSslReturn(in, SSL_ERR_FAILED);
             return 0;

runtime/src/hle/sc.cpp

@@ -9,6 +9,7 @@
 #include <cstring>
 #include "memory.h"
 #include "runtime_config.h"
+#include "aurora_events.h"
 #include "runtime_log.h"
 
 namespace {
@@ -52,7 +53,7 @@ PPC_NATIVE_OVERRIDE(801B0220, SCCheckStatus_HLE, uint32_t, (), ());
 // Returns: 0 = 4:3, 1 = 16:9
 extern "C" uint32_t SCGetAspectRatio_HLE()
 {
-    return RuntimeConfigFile::WidescreenEnabled(true) ? 1u : 0u;
+    return (RuntimeConfigFile::WidescreenEnabled(true) || MkwForceAspect169Requested()) ? 1u : 0u;
 }
 
 PPC_NATIVE_OVERRIDE(801B1BE4, SCGetAspectRatio_HLE, uint32_t, (), ());

runtime/src/host_context.cpp

@@ -14,7 +14,7 @@
 
 extern "C" void mkw_co_switch(void** targetSp, void** sourceSp);
 extern "C" void* mkw_co_init(void* stackTop, void (*entry)(void*), void* argument);
-#elif defined(__linux__)
+#elif defined(__linux__) || (defined(__APPLE__) && defined(__x86_64__))
 #include <libco.h>
 
 #include <cstdlib>
@@ -158,7 +158,7 @@ void Switch(Handle target)
     g_current = source;
 }
 
-#elif defined(__linux__)
+#elif defined(__linux__) || (defined(__APPLE__) && defined(__x86_64__))
 
 namespace {
 struct Context {

runtime/src/host_cpu_baseline.cpp

@@ -1,14 +1,12 @@
-// Host ISA guard. Every other product target builds with -march=x86-64-v3, so a pre-Haswell
-// Intel or pre-Excavator AMD machine would otherwise die on an illegal-instruction fault with no
+// Host ISA guard. Product targets build with an explicit x86-64-v2 or x86-64-v3 profile, so an
+// unsupported machine would otherwise die on an illegal-instruction fault with no
 // explanation. This TU alone skips that flag (own CMake object library, excluded from unity
 // build/PCH) and runs from a priority-101 C initializer, ahead of every C++ dynamic initializer
 // and thus the first AVX2 code that could execute. Keep it free of anything that could pull in
 // vectorized code: no iostreams, no std::string, no runtime-wide headers.
 //
-// x86-64-v3 is an x86-specific optional-feature baseline (AVX2/BMI2/FMA and friends are not
-// guaranteed present on every x86_64 chip); nothing here applies on AArch64, where ASIMD/NEON is
-// mandatory in the base architecture and PublicProducts.cmake never applies an -march=x86-64-v3
-// equivalent flag to begin with. That branch below is a no-op stub, not a port of this check.
+// x86-64-v2/v3 are x86-specific optional-feature baselines; nothing here applies on AArch64,
+// where ASIMD/NEON is mandatory in the base architecture.
 
 #if defined(__x86_64__)
 
@@ -58,27 +56,27 @@ struct CpuFeature {
     bool isOsXsave;
 };
 
-// Everything x86-64-v3 implies, which includes all of x86-64-v2. Spelled out so
-// the error message can name the exact instruction sets the machine lacks
-// rather than only "AVX2", which is merely the best known member of the set.
+// x86-64-v2 requirements. The v3-only extension below retains a useful
+// feature-by-feature diagnostic rather than reducing a failed v3 check to AVX2.
 constexpr CpuFeature kRequiredFeatures[] = {
     {"SSE3", 1, 0, 2, 0, false},
     {"SSSE3", 1, 0, 2, 9, false},
-    {"FMA", 1, 0, 2, 12, false},
     {"CMPXCHG16B", 1, 0, 2, 13, false},
     {"SSE4.1", 1, 0, 2, 19, false},
     {"SSE4.2", 1, 0, 2, 20, false},
-    {"MOVBE", 1, 0, 2, 22, false},
     {"POPCNT", 1, 0, 2, 23, false},
-    {"OSXSAVE", 1, 0, 2, 27, true},
-    {"AVX", 1, 0, 2, 28, false},
-    {"F16C", 1, 0, 2, 29, false},
-    {"BMI1", 7, 0, 1, 3, false},
-    {"AVX2", 7, 0, 1, 5, false},
-    {"BMI2", 7, 0, 1, 8, false},
     {"LAHF-SAHF", 0x80000001u, 0, 2, 0, false},
+};
+
+#if !defined(MKW_X86_CPU_PROFILE_V2)
+constexpr CpuFeature kV3RequiredFeatures[] = {
+    {"FMA", 1, 0, 2, 12, false}, {"MOVBE", 1, 0, 2, 22, false},
+    {"OSXSAVE", 1, 0, 2, 27, true}, {"AVX", 1, 0, 2, 28, false},
+    {"F16C", 1, 0, 2, 29, false}, {"BMI1", 7, 0, 1, 3, false},
+    {"AVX2", 7, 0, 1, 5, false}, {"BMI2", 7, 0, 1, 8, false},
     {"LZCNT", 0x80000001u, 0, 2, 5, false},
 };
+#endif
 
 // Fixed-capacity text accumulation: no allocation, no exceptions, nothing that
 // could route through code this file is trying to stay ahead of.
@@ -130,6 +128,27 @@ bool CollectMissingBaselineFeatures(TextBuffer& missing) {
         ok = false;
     }
 
+#if !defined(MKW_X86_CPU_PROFILE_V2)
+    for (const CpuFeature& feature : kV3RequiredFeatures) {
+        const bool leafAvailable = (feature.leaf & 0x80000000u) != 0
+                                       ? feature.leaf <= maxExtended
+                                       : feature.leaf <= maxBasic;
+        bool present = false;
+        if (leafAvailable) {
+            unsigned regs[4] = {0, 0, 0, 0};
+            HostCpuId(feature.leaf, feature.subleaf, regs);
+            present = (regs[feature.reg] & (1u << feature.bit)) != 0;
+        }
+        if (present) {
+            haveOsXsave = haveOsXsave || feature.isOsXsave;
+            continue;
+        }
+        if (!ok) missing.Append(", ");
+        missing.Append(feature.name);
+        ok = false;
+    }
+#endif
+
     // CPUID reporting AVX is not sufficient: the OS also has to have enabled
     // XMM and YMM state saving or every VEX-encoded instruction faults. This is
     // the same guard a compiler's own runtime feature dispatch applies.
@@ -175,13 +194,17 @@ void WriteStdErrEarly(const char* text) {
 
 [[noreturn]] void ReportUnsupportedCpu(const char* missing) {
     TextBuffer message;
-    message.Append(
-        "This build needs a processor that supports AVX2 and the rest of the "
-        "x86-64-v3 instruction set.\n\nMissing on this machine: ");
+#if defined(MKW_X86_CPU_PROFILE_V2)
+    message.Append("This build needs a processor that supports the x86-64-v2 instruction set.\n\nMissing on this machine: ");
+#else
+    message.Append("This build needs a processor that supports the x86-64-v3 instruction set.\n\nMissing on this machine: ");
+#endif
     message.Append(missing);
-    message.Append(
-        "\n\nx86-64-v3 covers Intel Core processors from Haswell (4th "
-        "generation, 2013) onward and AMD processors from Excavator (2015) onward.");
+#if defined(MKW_X86_CPU_PROFILE_V2)
+    message.Append("\n\nx86-64-v2 covers Intel Core processors from Nehalem (2008) onward and AMD processors from Jaguar (2013) onward.");
+#else
+    message.Append("\n\nx86-64-v3 covers Intel Core processors from Haswell (4th generation, 2013) onward and AMD processors from Excavator (2015) onward.");
+#endif
 
     // The tag matches RT_TAG_RUNTIME in runtime_log.h. It is spelled out here
     // because this translation unit must not include runtime-wide headers (see

runtime/src/main.cpp

@@ -44,10 +44,15 @@
 #include <signal.h>
 #if defined(__x86_64__)
 // Only the x86 POSIX fault path inspects ucontext_t to recover the page-fault
-// write bit. macOS deprecates ucontext and requires _XOPEN_SOURCE just to
-// include the header, while the arm64 handler does not use it at all.
+// write bit. macOS exposes the signal-handler context through sys/ucontext.h;
+// avoid ucontext.h itself because its deprecated user-context APIs require
+// _XOPEN_SOURCE. The arm64 handler does not inspect a host context at all.
+#if defined(__APPLE__)
+#include <sys/ucontext.h>
+#else
 #include <ucontext.h>
 #endif
+#endif
 #include <unistd.h>
 #endif
 
@@ -1128,7 +1133,11 @@ void PosixMemoryFaultHandler(int sig, siginfo_t* info, void* ucontextVoid) {
     // error code x86 pushes on a page fault records whether it was a write.
     if (ucontextVoid != nullptr) {
         auto* uc = static_cast<ucontext_t*>(ucontextVoid);
+#if defined(__APPLE__)
+        isWrite = uc->uc_mcontext != nullptr && (uc->uc_mcontext->__es.__err & 0x2) != 0;
+#else
         isWrite = (uc->uc_mcontext.gregs[REG_ERR] & 0x2) != 0;
+#endif
     }
 #endif
 
@@ -1354,7 +1363,8 @@ int RuntimeMain(int argc, char** argv) {
         auroraConfig.logCallback = &RuntimeAuroraLogCallback;
         auroraConfig.logLevel = LOG_DEBUG;
         const bool configWidescreen = RuntimeConfigFile::WidescreenEnabled(true);
-        auroraConfig.windowWidth = configWidescreen ? 854 : 640;
+        const bool forceAspect169 = RuntimeConfigFile::ForceAspect169Enabled();
+        auroraConfig.windowWidth = (configWidescreen || forceAspect169) ? 854 : 640;
         auroraConfig.windowHeight = 480;
         auroraConfig.windowWidth = RuntimeConfigFile::WindowWidth(auroraConfig.windowWidth);
         auroraConfig.windowHeight = RuntimeConfigFile::WindowHeight(auroraConfig.windowHeight);
@@ -1372,7 +1382,8 @@ int RuntimeMain(int argc, char** argv) {
         // No vsync knob: aurora always configures a non-blocking present mode.
         auroraConfig.desiredBackend = BACKEND_AUTO;
         const float resolutionMultiplier = RuntimeConfigFile::ResolutionMultiplier(1.0f);
-        ConfigureMkwDynamicAspect(configWidescreen, auroraConfig.windowWidth, auroraConfig.windowHeight);
+        ConfigureMkwDynamicAspect(configWidescreen, forceAspect169,
+                                  auroraConfig.windowWidth, auroraConfig.windowHeight);
         VISetFrameBufferScale(resolutionMultiplier);
         // One table for both directions. RuntimeConfigFile::IsSupportedGraphicsApi
         // whitelists exactly these config names, so an unrecognised value has
@@ -1439,14 +1450,15 @@ int RuntimeMain(int argc, char** argv) {
                                       auroraInfo.windowSize.native_fb_height);
         settings_overlay::InitializeRuntimeSettings();
         RT_LOG(RT_TAG_CONFIG) << "video.widescreen=" << (configWidescreen ? "true" : "false")
-                  << " SCGetAspectRatio=" << (configWidescreen ? 1 : 0)
+                  << " force_16_9=" << (forceAspect169 ? "true" : "false")
+                  << " SCGetAspectRatio=" << (configWidescreen || forceAspect169 ? 1 : 0)
                   << " resolutionMultiplier=" << resolutionMultiplier
                   << " window=" << auroraInfo.windowSize.width << "x" << auroraInfo.windowSize.height
                   << " native=" << auroraInfo.windowSize.native_fb_width << "x"
                   << auroraInfo.windowSize.native_fb_height
-                  << " viewportPolicy=" << (g_dynamicAspectRatioEnabled ? "stretch" : "fit")
+                  << " viewportPolicy=" << (forceAspect169 ? "16:9" : (configWidescreen ? "stretch" : "fit"))
                   << " presentAspect="
-                  << (g_dynamicAspectRatioEnabled ? "surface (dynamic EGG canvas)" : "4:3")
+                  << (forceAspect169 ? "16:9" : (configWidescreen ? "surface (dynamic EGG canvas)" : "4:3"))
                   << std::endl;
         g_auroraInitialized.store(true, std::memory_order_release);
 

runtime/src/music_attenuation.cpp

@@ -4,9 +4,9 @@
 
 #include <array>
 #include <atomic>
-#include <bit>
 #include <chrono>
 #include <cstdint>
+#include <cstring>
 #include <iostream>
 #include <mutex>
 #include <thread>
@@ -16,6 +16,8 @@
 #include <winrt/Windows.Foundation.h>
 #include <winrt/Windows.Foundation.Collections.h>
 #include <winrt/Windows.Media.Control.h>
+#elif defined(__APPLE__)
+#include "external_audio_macos.h"
 #elif defined(__linux__)
 #include <dlfcn.h>
 
@@ -52,6 +54,20 @@ std::array<float, kSoundPlayerCount> g_requestedSoundPlayerVolumes{};
 std::array<float, kSoundPlayerCount> g_lastAppliedSoundPlayerVolumes{};
 std::array<bool, kSoundPlayerCount> g_haveSoundPlayerVolumes{};
 
+uint32_t FloatBits(float value) noexcept {
+    static_assert(sizeof(float) == sizeof(uint32_t));
+    uint32_t bits = 0;
+    std::memcpy(&bits, &value, sizeof(bits));
+    return bits;
+}
+
+float BitsFloat(uint32_t bits) noexcept {
+    static_assert(sizeof(float) == sizeof(uint32_t));
+    float value = 0.0f;
+    std::memcpy(&value, &bits, sizeof(value));
+    return value;
+}
+
 float ClampSoundPlayerVolume(float volume) noexcept {
     // Match nw4r::snd::SoundPlayer::SetVolume at 0x800A35E0 exactly,
     // including its NaN behavior (unordered compares select the upper bound).
@@ -63,7 +79,7 @@ float ClampSoundPlayerVolume(float volume) noexcept {
 
 bool WriteGuestFloat(uint32_t address, float value) noexcept {
     try {
-        Memory::Write32(address, std::bit_cast<uint32_t>(value));
+        Memory::Write32(address, FloatBits(value));
         return true;
     } catch (const Memory::AccessViolation&) {
         return false;
@@ -75,7 +91,7 @@ bool ReadGuestFloat(uint32_t address, float& value) noexcept {
     if (!Memory::TryRead32(address, bits)) {
         return false;
     }
-    value = std::bit_cast<float>(bits);
+    value = BitsFloat(bits);
     return true;
 }
 
@@ -448,6 +464,19 @@ void MonitorLinuxMprisSessions() noexcept {
 }
 #endif
 
+#if defined(__APPLE__)
+void MonitorMacOSAudio() noexcept {
+    using namespace std::chrono_literals;
+    for (;;) {
+        const auto status = QueryMacOSExternalAudio();
+        g_externalMediaPlaying.store(status.playing, std::memory_order_release);
+        g_mediaControlAvailable.store(status.available, std::memory_order_release);
+        g_mediaControlInitializationComplete.store(true, std::memory_order_release);
+        std::this_thread::sleep_for(250ms);
+    }
+}
+#endif
+
 void StartMonitor() noexcept {
 #if defined(_WIN32)
     // The process owns this monitor for its remaining lifetime. Keeping it
@@ -456,6 +485,8 @@ void StartMonitor() noexcept {
 #elif defined(__linux__)
     // Detached so there is no shutdown ordering to manage against static audio state.
     std::thread(MonitorLinuxMprisSessions).detach();
+#elif defined(__APPLE__)
+    std::thread(MonitorMacOSAudio).detach();
 #else
     g_mediaControlAvailable.store(false, std::memory_order_release);
     g_mediaControlInitializationComplete.store(true, std::memory_order_release);
@@ -558,7 +589,7 @@ void SetSoundPlayerVolume(uint32_t soundPlayer, float requestedVolume) {
     }
     // Preserve the original function's access semantics. An invalid player is
     // a guest bug and must not be converted into a silent successful call.
-    Memory::Write32(soundPlayer + kSoundPlayerVolumeOffset, std::bit_cast<uint32_t>(applied));
+    Memory::Write32(soundPlayer + kSoundPlayerVolumeOffset, FloatBits(applied));
 }
 
 } // namespace MusicAttenuation

runtime/src/platform/host_platform.cpp

@@ -1,6 +1,7 @@
 #include "platform/host_platform.h"
 
 #include <cstdlib>
+#include <vector>
 
 #if defined(_WIN32)
 #ifndef WIN32_LEAN_AND_MEAN
@@ -46,6 +47,18 @@ std::optional<std::filesystem::path> ExecutableDirectory() noexcept {
     std::error_code ec;
     const auto resolved = std::filesystem::weakly_canonical(path, ec);
     return (ec ? std::filesystem::path(path) : resolved).parent_path();
+#elif defined(__linux__)
+    std::vector<char> buffer(256);
+    for (;;) {
+        const auto length = ::readlink("/proc/self/exe", buffer.data(), buffer.size());
+        if (length < 0) {
+            return std::nullopt;
+        }
+        if (static_cast<std::size_t>(length) < buffer.size()) {
+            return std::filesystem::path(std::string(buffer.data(), length)).parent_path();
+        }
+        buffer.resize(buffer.size() * 2);
+    }
 #else
     return std::nullopt;
 #endif

runtime/src/ppc_helpers.cpp

@@ -12,6 +12,7 @@
 #include <cmath>
 #include <cstdint>
 #include <cstdlib>
+#include <ctime>
 #include <stdexcept>
 #include <limits>
 
@@ -44,11 +45,48 @@ uint32_t g_reservationAddr = 0;
 bool g_hasReservation = false;
 const auto g_timeBaseStart = std::chrono::steady_clock::now();
 
+// Days from 1970-01-01 to the given civil date (Howard Hinnant's algorithm).
+constexpr int64_t DaysFromCivil(int64_t y, unsigned m, unsigned d)
+{
+    y -= m <= 2;
+    const int64_t era = (y >= 0 ? y : y - 399) / 400;
+    const unsigned yoe = static_cast<unsigned>(y - era * 400);
+    const unsigned doy = (153 * (m > 2 ? m - 3 : m + 9) + 2) / 5 + d - 1;
+    const unsigned doe = yoe * 365 + yoe / 4 - yoe / 100 + doy;
+    return era * 146097 + static_cast<int64_t>(doe) - 719468;
+}
+
+// The Wii RTC holds local time; the OS counts ticks from 2000-01-01.
+uint64_t InitialTimeBase()
+{
+    const std::time_t now = std::time(nullptr);
+    std::tm local{};
+#if defined(_WIN32)
+    if (localtime_s(&local, &now) != 0) {
+        return 0;
+    }
+#else
+    if (localtime_r(&now, &local) == nullptr) {
+        return 0;
+    }
+#endif
+    const int64_t days = DaysFromCivil(local.tm_year + 1900, static_cast<unsigned>(local.tm_mon + 1),
+                                       static_cast<unsigned>(local.tm_mday)) -
+                         DaysFromCivil(2000, 1, 1);
+    const int64_t seconds = days * 86400 + local.tm_hour * 3600 + local.tm_min * 60 + local.tm_sec;
+    if (seconds <= 0) {
+        return 0;
+    }
+    return static_cast<uint64_t>(seconds) * TimeBaseContract::kTicksPerSecond;
+}
+
+const uint64_t g_timeBaseOrigin = InitialTimeBase();
+
 uint64_t GetTimeBase() {
     const auto elapsed = std::chrono::steady_clock::now() - g_timeBaseStart;
     const auto nanoseconds =
         std::chrono::duration_cast<std::chrono::nanoseconds>(elapsed).count();
-    return TimeBaseContract::NanosecondsToTicks(static_cast<uint64_t>(nanoseconds));
+    return g_timeBaseOrigin + TimeBaseContract::NanosecondsToTicks(static_cast<uint64_t>(nanoseconds));
 }
 
 constexpr uint32_t kFpscrFx = 1u << 31;
@@ -833,8 +871,8 @@ extern "C" double PPC_PsqL(uint32_t addr, uint32_t w, uint32_t i)
     }
 
     const uint32_t gqr = cpu->gqr[i & 7];
-    return w == 0 ? PPC_PsqLStateFallback<0u, 0u, false>(gqr, addr)
-                  : PPC_PsqLStateFallback<1u, 0u, false>(gqr, addr);
+    return w == 0 ? PPC_PsqLStateFallback<0u, false>(gqr, addr)
+                  : PPC_PsqLStateFallback<1u, false>(gqr, addr);
 }
 
 extern "C" void PPC_PsqSt(uint32_t addr, double value, uint32_t w, uint32_t i)
@@ -848,11 +886,11 @@ extern "C" void PPC_PsqSt(uint32_t addr, double value, uint32_t w, uint32_t i)
     const uint32_t gqr = cpu->gqr[i & 7];
     if (w == 0)
     {
-        PPC_PsqStStateFallback<0u, 0u, false>(gqr, addr, value);
+        PPC_PsqStStateFallback<0u, false>(gqr, addr, value);
     }
     else
     {
-        PPC_PsqStStateFallback<1u, 0u, false>(gqr, addr, value);
+        PPC_PsqStStateFallback<1u, false>(gqr, addr, value);
     }
 }
 

runtime/src/ppc_quantized.cpp

@@ -0,0 +1,154 @@
+#include "isa/ppc_isa_quantized.h"
+
+#if defined(__FAST_MATH__) || __FINITE_MATH_ONLY__
+#error "PSQ helpers require strict PPC floating-point options"
+#endif
+
+template <uint32_t W, bool Stack>
+MKW_PPC_NO_INLINE MKW_PPC_COLD double PPC_PsqLStateFallback(uint32_t gqr, uint32_t addr)
+{
+    static_assert(W <= 1u);
+    const uint32_t type = (gqr >> 16) & 0x7u;
+    const uint32_t scale = (gqr >> 24) & 0x3Fu;
+    if constexpr (W == 0u)
+    {
+        switch (type)
+        {
+        case 0u: return Stack ? PpcLoadPairPsqFloatStackInline(addr) : PpcLoadPairPsqFloatFastInline(addr);
+        case 4u: return Stack ? PpcLoadPairPsqIntegerStackInline<uint8_t>(addr, scale) : PpcLoadPairPsqIntegerFastInline<uint8_t>(addr, scale);
+        case 5u: return Stack ? PpcLoadPairPsqIntegerStackInline<uint16_t>(addr, scale) : PpcLoadPairPsqIntegerFastInline<uint16_t>(addr, scale);
+        case 6u: return Stack ? PpcLoadPairPsqIntegerStackInline<int8_t>(addr, scale) : PpcLoadPairPsqIntegerFastInline<int8_t>(addr, scale);
+        case 7u: return Stack ? PpcLoadPairPsqIntegerStackInline<int16_t>(addr, scale) : PpcLoadPairPsqIntegerFastInline<int16_t>(addr, scale);
+        default: std::abort();
+        }
+    }
+    else
+    {
+        switch (type)
+        {
+        case 0u: return Stack ? PpcLoadSinglePsqFloatStackInline(addr) : PpcLoadSinglePsqFloatFastInline(addr);
+        case 4u: return Stack ? PpcLoadSinglePsqQuantizedStackInline<uint8_t>(addr, scale) : PpcLoadSinglePsqQuantizedFastInline<uint8_t>(addr, scale);
+        case 5u: return Stack ? PpcLoadSinglePsqQuantizedStackInline<uint16_t>(addr, scale) : PpcLoadSinglePsqQuantizedFastInline<uint16_t>(addr, scale);
+        case 6u: return Stack ? PpcLoadSinglePsqQuantizedStackInline<int8_t>(addr, scale) : PpcLoadSinglePsqQuantizedFastInline<int8_t>(addr, scale);
+        case 7u: return Stack ? PpcLoadSinglePsqQuantizedStackInline<int16_t>(addr, scale) : PpcLoadSinglePsqQuantizedFastInline<int16_t>(addr, scale);
+        default: std::abort();
+        }
+    }
+}
+
+template <uint32_t W, bool Stack>
+MKW_PPC_NO_INLINE MKW_PPC_COLD void PPC_PsqStStateFallback(uint32_t gqr, uint32_t addr, double value)
+{
+    static_assert(W <= 1u);
+    const uint32_t type = gqr & 0x7u;
+    const uint32_t scale = (gqr >> 8) & 0x3Fu;
+    if constexpr (W == 0u)
+    {
+        switch (type)
+        {
+        case 0u: Stack ? PpcStorePairPsqFloatStackInline(addr, value) : PpcStorePairPsqFloatFastInline(addr, value); return;
+        case 4u: if constexpr (Stack) PpcStorePairPsqQuantizedStackInline<uint8_t>(addr, value, scale); else PpcStorePairPsqQuantizedFastInline<uint8_t>(addr, value, scale); return;
+        case 5u: if constexpr (Stack) PpcStorePairPsqQuantizedStackInline<uint16_t>(addr, value, scale); else PpcStorePairPsqQuantizedFastInline<uint16_t>(addr, value, scale); return;
+        case 6u: if constexpr (Stack) PpcStorePairPsqQuantizedStackInline<int8_t>(addr, value, scale); else PpcStorePairPsqQuantizedFastInline<int8_t>(addr, value, scale); return;
+        case 7u: if constexpr (Stack) PpcStorePairPsqQuantizedStackInline<int16_t>(addr, value, scale); else PpcStorePairPsqQuantizedFastInline<int16_t>(addr, value, scale); return;
+        default: std::abort();
+        }
+    }
+    else
+    {
+        switch (type)
+        {
+        case 0u: if constexpr (Stack) PpcStoreSinglePsqFloatStackInline(addr, value); else PpcStoreSinglePsqFloatFastInline(addr, value); return;
+        case 4u: if constexpr (Stack) PpcStoreSinglePsqQuantizedStackInline<uint8_t>(addr, value, scale); else PpcStoreSinglePsqQuantizedFastInline<uint8_t>(addr, value, scale); return;
+        case 5u: if constexpr (Stack) PpcStoreSinglePsqQuantizedStackInline<uint16_t>(addr, value, scale); else PpcStoreSinglePsqQuantizedFastInline<uint16_t>(addr, value, scale); return;
+        case 6u: if constexpr (Stack) PpcStoreSinglePsqQuantizedStackInline<int8_t>(addr, value, scale); else PpcStoreSinglePsqQuantizedFastInline<int8_t>(addr, value, scale); return;
+        case 7u: if constexpr (Stack) PpcStoreSinglePsqQuantizedStackInline<int16_t>(addr, value, scale); else PpcStoreSinglePsqQuantizedFastInline<int16_t>(addr, value, scale); return;
+        default: std::abort();
+        }
+    }
+}
+
+template <uint32_t W>
+MKW_PPC_NO_INLINE MKW_PPC_COLD double PPC_PsqLResolvedStateFallback(
+    uint32_t gqr, uint8_t* resolvedHost, uint32_t offset, uint32_t addr)
+{
+    static_assert(W <= 1u);
+    if (!resolvedHost) [[unlikely]] return PPC_PsqLStateInline<W, 0u, false>(gqr, addr);
+    const uint32_t type = (gqr >> 16) & 0x7u;
+    const uint32_t scale = (gqr >> 24) & 0x3Fu;
+    if constexpr (W == 0u)
+    {
+        switch (type)
+        {
+        case 0u: return PpcLoadPairPsqFloatResolvedInline(resolvedHost, offset, addr);
+        case 4u: return PpcLoadPairPsqIntegerResolvedInline<uint8_t>(resolvedHost, offset, addr, scale);
+        case 5u: return PpcLoadPairPsqIntegerResolvedInline<uint16_t>(resolvedHost, offset, addr, scale);
+        case 6u: return PpcLoadPairPsqIntegerResolvedInline<int8_t>(resolvedHost, offset, addr, scale);
+        case 7u: return PpcLoadPairPsqIntegerResolvedInline<int16_t>(resolvedHost, offset, addr, scale);
+        default: std::abort();
+        }
+    }
+    else
+    {
+        switch (type)
+        {
+        case 0u: return PpcLoadSinglePsqFloatResolvedInline(resolvedHost, offset, addr);
+        case 4u: return PpcLoadSinglePsqQuantizedResolvedInline<uint8_t>(resolvedHost, offset, addr, scale);
+        case 5u: return PpcLoadSinglePsqQuantizedResolvedInline<uint16_t>(resolvedHost, offset, addr, scale);
+        case 6u: return PpcLoadSinglePsqQuantizedResolvedInline<int8_t>(resolvedHost, offset, addr, scale);
+        case 7u: return PpcLoadSinglePsqQuantizedResolvedInline<int16_t>(resolvedHost, offset, addr, scale);
+        default: std::abort();
+        }
+    }
+}
+
+template <uint32_t W>
+MKW_PPC_NO_INLINE MKW_PPC_COLD void PPC_PsqStResolvedStateFallback(
+    uint32_t gqr, uint8_t* resolvedHost, uint32_t offset, uint32_t addr, double value)
+{
+    static_assert(W <= 1u);
+    if (!resolvedHost) [[unlikely]]
+    {
+        PPC_PsqStStateInline<W, 0u, false>(gqr, addr, value);
+        return;
+    }
+    const uint32_t type = gqr & 0x7u;
+    const uint32_t scale = (gqr >> 8) & 0x3Fu;
+    if constexpr (W == 0u)
+    {
+        switch (type)
+        {
+        case 0u: PpcStorePairPsqFloatResolvedInline(resolvedHost, offset, addr, value); return;
+        case 4u: PpcStorePairPsqQuantizedResolvedInline<uint8_t>(resolvedHost, offset, addr, value, scale); return;
+        case 5u: PpcStorePairPsqQuantizedResolvedInline<uint16_t>(resolvedHost, offset, addr, value, scale); return;
+        case 6u: PpcStorePairPsqQuantizedResolvedInline<int8_t>(resolvedHost, offset, addr, value, scale); return;
+        case 7u: PpcStorePairPsqQuantizedResolvedInline<int16_t>(resolvedHost, offset, addr, value, scale); return;
+        default: std::abort();
+        }
+    }
+    else
+    {
+        switch (type)
+        {
+        case 0u: PpcStoreSinglePsqFloatResolvedInline(resolvedHost, offset, addr, value); return;
+        case 4u: PpcStoreSinglePsqQuantizedResolvedInline<uint8_t>(resolvedHost, offset, addr, value, scale); return;
+        case 5u: PpcStoreSinglePsqQuantizedResolvedInline<uint16_t>(resolvedHost, offset, addr, value, scale); return;
+        case 6u: PpcStoreSinglePsqQuantizedResolvedInline<int8_t>(resolvedHost, offset, addr, value, scale); return;
+        case 7u: PpcStoreSinglePsqQuantizedResolvedInline<int16_t>(resolvedHost, offset, addr, value, scale); return;
+        default: std::abort();
+        }
+    }
+}
+
+template double PPC_PsqLStateFallback<0u, false>(uint32_t, uint32_t);
+template void PPC_PsqStStateFallback<0u, false>(uint32_t, uint32_t, double);
+template double PPC_PsqLStateFallback<0u, true>(uint32_t, uint32_t);
+template void PPC_PsqStStateFallback<0u, true>(uint32_t, uint32_t, double);
+template double PPC_PsqLResolvedStateFallback<0u>(uint32_t, uint8_t*, uint32_t, uint32_t);
+template void PPC_PsqStResolvedStateFallback<0u>(uint32_t, uint8_t*, uint32_t, uint32_t, double);
+template double PPC_PsqLStateFallback<1u, false>(uint32_t, uint32_t);
+template void PPC_PsqStStateFallback<1u, false>(uint32_t, uint32_t, double);
+template double PPC_PsqLStateFallback<1u, true>(uint32_t, uint32_t);
+template void PPC_PsqStStateFallback<1u, true>(uint32_t, uint32_t, double);
+template double PPC_PsqLResolvedStateFallback<1u>(uint32_t, uint8_t*, uint32_t, uint32_t);
+template void PPC_PsqStResolvedStateFallback<1u>(uint32_t, uint8_t*, uint32_t, uint32_t, double);

runtime/src/settings_overlay.cpp

@@ -26,6 +26,7 @@
 #include <chrono>
 #include <cmath>
 #include <cstdint>
+#include <cstdio>
 #include <limits>
 #include <iostream>
 #include <string>
@@ -109,6 +110,10 @@ int g_displayMode = [] {
 bool g_skipUnreadyPipelines = RuntimeConfigFile::SkipUnreadyPipelines(true);
 bool g_disableCopyFilter = RuntimeConfigFile::DisableCopyFilter(true);
 bool g_showFps = RuntimeConfigFile::ShowFps(true);
+bool g_forceAspect169 = RuntimeConfigFile::ForceAspect169Enabled();
+#if defined(__APPLE__)
+bool g_metalFxSpatialUpscaling = RuntimeConfigFile::MetalFxSpatialUpscaling(false);
+#endif
 uint32_t g_disabledPostProcessingPaths = RuntimeConfigFile::DisabledPostProcessingPaths(0);
 std::array<int32_t, PAD_MAX_CONTROLLERS> g_configuredControllerIndices = [] {
     std::array<int32_t, PAD_MAX_CONTROLLERS> indices{};
@@ -161,6 +166,11 @@ uint64_t g_presentedFrame = 0;
 std::atomic_bool g_strapInputAccepted = false;
 std::atomic_uint64_t g_startupDismissFrame = UINT64_MAX;
 constexpr uint64_t kStrapTransitionCoverFrames = 60;
+std::atomic_bool g_bootShadersReady = false;
+bool g_bootShaderNotice = false;
+Clock::time_point g_bootShaderWaitStart{};
+constexpr uint32_t kBootShaderNoticeThreshold = 100;
+constexpr auto kBootShaderWaitLimit = std::chrono::minutes(3);
 
 constexpr std::array<ResolutionItem, 8> kResolutions = {{
     {"Auto (window size)", 0.0f}, {"Native (1x)", 1.0f}, {"1.5x", 1.5f}, {"2x", 2.0f},
@@ -991,13 +1001,24 @@ void DrawAudioSettings() {
         MusicAttenuation::SetEnabled(g_attenuateMusicWhenMediaPlays);
         RuntimeConfigFile::SetAttenuateMusicWhenMediaPlays(g_attenuateMusicWhenMediaPlays);
     }
+#if defined(__APPLE__)
+    if (ImGui::IsItemHovered()) {
+        ImGui::SetTooltip(
+            "Detects other apps with active audio output on macOS 14.2 or later. "
+            "Apps that keep an output stream running silently may keep game music muted.");
+    }
+#endif
     if (g_attenuateMusicWhenMediaPlays) {
         if (MusicAttenuation::IsExternalMediaPlaying()) {
             ImGui::TextDisabled("External media is playing; game music is muted.");
         } else if (!MusicAttenuation::IsMediaControlInitializationComplete()) {
-            ImGui::TextDisabled("Waiting for media controls...");
+            ImGui::TextDisabled("Checking external audio...");
         } else if (!MusicAttenuation::IsMediaControlAvailable()) {
+#if defined(__APPLE__)
+            ImGui::TextDisabled("External audio detection unavailable (requires macOS 14.2 or later).");
+#else
             ImGui::TextDisabled("Media controls are unavailable.");
+#endif
         } else {
             ImGui::TextDisabled("No external media is currently playing.");
         }
@@ -1006,6 +1027,12 @@ void DrawAudioSettings() {
 
 void DrawGraphicsSettings() {
     g_displayMode = static_cast<int>(aurora_get_display_mode());
+    if (ImGui::Checkbox("Force 16:9", &g_forceAspect169)) {
+        SetMkwForceAspect169(g_forceAspect169);
+        RuntimeConfigFile::SetForceAspect169(g_forceAspect169);
+    }
+    ImGui::TextDisabled("Keep a 16:9 image with black bars when the window has another shape.");
+    ImGui::Separator();
     struct EffectFlag {
         const char* label;
         uint32_t flag;
@@ -1080,6 +1107,36 @@ void DrawGraphicsSettings() {
     ImGui::PushTextWrapPos(ImGui::GetCursorPosX() + 380.0f);
     ImGui::TextDisabled("Frame interpolation is experimental, you might find visual artifacts");
     ImGui::PopTextWrapPos();
+#if defined(__APPLE__)
+    const bool metalFxSupported = aurora_is_metalfx_spatial_supported();
+    ImGui::BeginDisabled(!metalFxSupported);
+    if (ImGui::Checkbox("MetalFX spatial upscaling", &g_metalFxSpatialUpscaling)) {
+        aurora_set_metalfx_spatial(g_metalFxSpatialUpscaling);
+        RuntimeConfigFile::SetMetalFxSpatialUpscaling(g_metalFxSpatialUpscaling);
+    }
+    ImGui::EndDisabled();
+    switch (aurora_get_metalfx_status()) {
+    case AURORA_METALFX_ACTIVE:
+        ImGui::TextDisabled("Active: upscaling the game image before the overlay.");
+        break;
+    case AURORA_METALFX_NOT_UPSCALING:
+        ImGui::TextDisabled("Choose a lower internal resolution to use MetalFX.");
+        break;
+    case AURORA_METALFX_UNSUPPORTED:
+        ImGui::TextDisabled("Requires macOS 13+, Metal, and a MetalFX-capable GPU.");
+        break;
+    case AURORA_METALFX_ERROR:
+        ImGui::TextDisabled("Unavailable after a renderer error; toggle off and on to retry.");
+        break;
+    case AURORA_METALFX_DISABLED:
+        if (metalFxSupported) {
+            ImGui::TextDisabled("Render below output resolution for sharper lower-cost output.");
+        } else {
+            ImGui::TextDisabled("MetalFX spatial upscaling is unavailable on this device.");
+        }
+        break;
+    }
+#endif
     if (ImGui::Checkbox("Disable copy filter", &g_disableCopyFilter)) {
         aurora_set_disable_copy_filter(g_disableCopyFilter);
         RuntimeConfigFile::SetDisableCopyFilter(g_disableCopyFilter);
@@ -1186,12 +1243,36 @@ void DrawStartupScreen() {
         const float startY = std::max(0.0f, (viewport->Size.y - titleSize.y) * 0.5f);
         ImGui::SetCursorPos(ImVec2(titleX, startY));
         ImGui::TextUnformatted(kTitle);
+        if (g_bootShaderNotice && !g_bootShadersReady.load(std::memory_order_relaxed)) {
+            ImGui::SetWindowFontScale(0.9f);
+            char line[96];
+            std::snprintf(line, sizeof(line), "Compiling shaders, please hold on: %u remaining",
+                          aurora_get_queued_pipeline_count());
+            const float lineX = std::max(0.0f, (viewport->Size.x - ImGui::CalcTextSize(line).x) * 0.5f);
+            ImGui::SetCursorPos(ImVec2(lineX, startY + titleSize.y * 1.8f));
+            ImGui::TextUnformatted(line);
+        }
     }
     ImGui::End();
     ImGui::PopStyleVar();
     ImGui::PopStyleColor();
 }
 
+void UpdateBootShaderState() {
+    if (g_bootShadersReady.load(std::memory_order_relaxed)) {
+        return;
+    }
+    const auto now = Clock::now();
+    if (g_bootShaderWaitStart == Clock::time_point{}) {
+        g_bootShaderWaitStart = now;
+    }
+    const uint32_t queued = aurora_get_queued_pipeline_count();
+    g_bootShaderNotice |= queued > kBootShaderNoticeThreshold;
+    if (queued == 0 || now - g_bootShaderWaitStart > kBootShaderWaitLimit) {
+        g_bootShadersReady.store(true, std::memory_order_release);
+    }
+}
+
 void DrawExitPrompt() {
     constexpr const char* kTitle = "Exit";
     if (g_exitPromptOpen && !ImGui::IsPopupOpen(kTitle)) ImGui::OpenPopup(kTitle);
@@ -1341,7 +1422,7 @@ void PersistDisplayModeIfChanged() {
 
 void ApplyInputBlockState() {
     const bool blocked = controller_mapping_wizard::IsActive() || g_rebind.active ||
-                         g_exitPromptOpen || g_topBarVisible;
+                         g_exitPromptOpen || g_topBarVisible || StartupScreenVisible();
     PADBlockInput(blocked);
     InputBindings::SetInputBlocked(blocked);
 }
@@ -1360,6 +1441,9 @@ void InitializeRuntimeSettings() noexcept {
     MusicAttenuation::SetVoicesVolume(static_cast<float>(g_voicesVolumePercent) / 100.0f);
     MusicAttenuation::SetEnabled(g_attenuateMusicWhenMediaPlays);
     RuntimeGameGraphicsOptions::SetDisabledPostProcessingPaths(g_disabledPostProcessingPaths);
+#if defined(__APPLE__)
+    aurora_set_metalfx_spatial(g_metalFxSpatialUpscaling);
+#endif
     const uint32_t targetFps = kFrameInterpolationTargetFps[static_cast<size_t>(g_frameInterpolationMode)];
     LimitResolutionForFrameRate();
     aurora_set_frame_interpolation_fps(targetFps);
@@ -1369,6 +1453,9 @@ void InitializeRuntimeSettings() noexcept {
     aurora_set_skip_unready_pipelines(g_skipUnreadyPipelines);
     g_strapInputAccepted.store(false, std::memory_order_relaxed);
     g_startupDismissFrame.store(UINT64_MAX, std::memory_order_relaxed);
+    g_bootShadersReady.store(false, std::memory_order_relaxed);
+    g_bootShaderNotice = false;
+    g_bootShaderWaitStart = {};
     PADBlockInput(false);
     InputBindings::SetInputBlocked(false);
 }
@@ -1449,6 +1536,7 @@ void Draw() noexcept {
     ApplyConfiguredMappings();
     PersistDisplayModeIfChanged();
     UpdateCursorAutoHide();
+    UpdateBootShaderState();
     if (!StartupScreenVisible()) {
         DrawShaderCompilationStatus();
     }
@@ -1462,6 +1550,7 @@ void Draw() noexcept {
 
 bool StartupScreenVisible() noexcept {
     return !g_strapInputAccepted.load(std::memory_order_acquire) ||
+           !g_bootShadersReady.load(std::memory_order_acquire) ||
            g_presentedFrame < g_startupDismissFrame.load(std::memory_order_relaxed);
 }
 

runtime/tests/macos_external_audio_tests.cpp

@@ -0,0 +1,109 @@
+#include "external_audio_macos.h"
+
+#include <CoreAudio/CoreAudio.h>
+#include <unistd.h>
+#include <cstring>
+#include <iostream>
+#include <stdexcept>
+#include <vector>
+
+namespace {
+struct Process {
+    pid_t pid;
+    UInt32 output;
+    bool disappeared = false;
+};
+std::vector<Process> processes;
+bool supported = true;
+bool queryFailed = false;
+int sizeRaces = 0;
+
+void Require(bool condition, const char* message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+void Expect(bool available, bool playing, const char* message) {
+    const auto status = MusicAttenuation::QueryMacOSExternalAudio();
+    Require(status.available == available && status.playing == playing, message);
+}
+} // namespace
+
+// Fake only the Core Audio boundary so the production enumeration and process
+// filtering run unchanged, without depending on other apps on the test machine.
+// Use the public selector ABI values so these mocks also build with older SDKs.
+extern "C" Boolean AudioObjectHasProperty(AudioObjectID object,
+                                         const AudioObjectPropertyAddress* address) {
+    Require(object == kAudioObjectSystemObject &&
+            address->mSelector == 'prs#',
+            "Must query the system process list");
+    return supported;
+}
+
+extern "C" OSStatus AudioObjectGetPropertyDataSize(
+    AudioObjectID, const AudioObjectPropertyAddress*, UInt32, const void*, UInt32* size) {
+    if (queryFailed) return kAudioHardwareUnspecifiedError;
+    *size = static_cast<UInt32>(processes.size() * sizeof(AudioObjectID));
+    return noErr;
+}
+
+extern "C" OSStatus AudioObjectGetPropertyData(
+    AudioObjectID object, const AudioObjectPropertyAddress* address, UInt32,
+    const void*, UInt32* size, void* data) {
+    Require(address->mScope == kAudioObjectPropertyScopeGlobal, "Must use global scope");
+    if (object == kAudioObjectSystemObject) {
+        if (sizeRaces > 0) {
+            --sizeRaces;
+            return kAudioHardwareBadPropertySizeError;
+        }
+        for (size_t i = 0; i < processes.size(); ++i) {
+            static_cast<AudioObjectID*>(data)[i] = static_cast<AudioObjectID>(i + 100);
+        }
+        *size = static_cast<UInt32>(processes.size() * sizeof(AudioObjectID));
+        return noErr;
+    }
+    const auto& process = processes.at(object - 100);
+    if (process.disappeared) return kAudioHardwareBadObjectError;
+    if (address->mSelector == 'ppid') {
+        std::memcpy(data, &process.pid, sizeof(process.pid));
+        *size = sizeof(process.pid);
+    } else {
+        Require(address->mSelector == 'piro',
+                "Input-only activity must not count as playback");
+        Require(process.pid != getpid(), "Must exclude the game's own output");
+        std::memcpy(data, &process.output, sizeof(process.output));
+        *size = sizeof(process.output);
+    }
+    return noErr;
+}
+
+int main() {
+    supported = false;
+    Expect(false, false, "Older macOS must report unavailable");
+    supported = true;
+    Expect(true, false, "An empty process list is available but inactive");
+    processes = {{getpid(), 1}};
+    Expect(true, false, "Game audio alone must not trigger muting");
+    processes.push_back({getpid() + 1, 0});
+    Expect(true, false, "An idle or input-only app must not trigger muting");
+    processes.back().output = 1;
+    Expect(true, true, "External playback must trigger muting");
+    processes.back().output = 0;
+    Expect(true, false, "Stopping playback must restore music");
+    processes.back().output = 1;
+    processes.back().disappeared = true;
+    Expect(true, false, "Exiting apps must not leave music muted");
+    processes.push_back({getpid() + 2, 1});
+    Expect(true, true, "A disappearing app must not hide another active player");
+    sizeRaces = 1;
+    Expect(true, true, "A growing process list must be retried");
+    sizeRaces = 3;
+    Expect(false, false, "List retries must be bounded");
+    Expect(true, true, "Later polls must recover from list races");
+    queryFailed = true;
+    Expect(false, false, "Query failure must clear playing state");
+    queryFailed = false;
+    Expect(true, true, "Monitoring must recover from query failure");
+    processes = {{0, 1}};
+    Expect(true, false, "Unknown PIDs must not count as external playback");
+    std::cout << "macOS external audio tests passed\n";
+}

runtime/tests/ppc_pair_fma_tests.cpp

@@ -0,0 +1,58 @@
+#include "isa/ppc_isa_float.h"
+
+#include <cmath>
+#include <cstdint>
+#include <cstdio>
+
+namespace {
+
+bool SameBits(double lhs, double rhs)
+{
+    return PpcBitCastToU64Inline(lhs) == PpcBitCastToU64Inline(rhs);
+}
+
+bool CheckPair(double actual, float a0, float a1, float c0, float c1, float b0, float b1,
+               bool subtract, const char* operation)
+{
+    const float expected0 = subtract ? std::fma(a0, c0, -b0) : std::fma(a0, c0, b0);
+    const float expected1 = subtract ? std::fma(a1, c1, -b1) : std::fma(a1, c1, b1);
+    const double expected = PpcPackPairedInline(expected0, expected1);
+    if (SameBits(actual, expected)) {
+        return true;
+    }
+    std::fprintf(stderr, "%s produced the wrong paired lanes\n", operation);
+    return false;
+}
+
+bool CheckNegatedPair(double actual, float a0, float a1, float c0, float c1, float b0, float b1,
+                      bool subtract, const char* operation)
+{
+    const float expected0 = -std::fma(a0, c0, subtract ? -b0 : b0);
+    const float expected1 = -std::fma(a1, c1, subtract ? -b1 : b1);
+    const double expected = PpcPackPairedInline(expected0, expected1);
+    if (SameBits(actual, expected)) {
+        return true;
+    }
+    std::fprintf(stderr, "%s produced the wrong paired lanes\n", operation);
+    return false;
+}
+
+}  // namespace
+
+int main()
+{
+    const double a = PpcPackPairedInline(1.000000119f, -123.25f);
+    const double c = PpcPackPairedInline(33554431.0f, 0.0625f);
+    const double b = PpcPackPairedInline(-33554430.0f, 7.75f);
+
+    bool ok = true;
+    ok &= CheckPair(PPC_PsMaddNoNiInline(a, c, b), 1.000000119f, -123.25f,
+                    33554431.0f, 0.0625f, -33554430.0f, 7.75f, false, "ps_madd");
+    ok &= CheckPair(PPC_PsMsubNoNiInline(a, c, b), 1.000000119f, -123.25f,
+                    33554431.0f, 0.0625f, -33554430.0f, 7.75f, true, "ps_msub");
+    ok &= CheckNegatedPair(PPC_PsNmaddInline(a, c, b), 1.000000119f, -123.25f,
+                           33554431.0f, 0.0625f, -33554430.0f, 7.75f, false, "ps_nmadd");
+    ok &= CheckNegatedPair(PPC_PsNmsubNoNiInline(a, c, b), 1.000000119f, -123.25f,
+                           33554431.0f, 0.0625f, -33554430.0f, 7.75f, true, "ps_nmsub");
+    return ok ? 0 : 1;
+}