Merge upstream main (v0.2.31) into openxr-work

Brings in 25 upstream commits: Dolphin-compatible input expressions and
GCPadNew.ini import, NAND setting.txt console identity, empty-MKW-save
handling, rumble toggle, LLVM 22, and CI caching.

The only conflict was runtime/CMakeLists.txt, where both sides appended
test targets after mkw_platform_paths_tests. Both blocks are kept: the VR
first-person test alongside upstream's NAND save/settings, SC serial, and
input expression tests.

runtime_config.h and settings_overlay.cpp auto-merged; the VR settings
menu, recenter hotkey, and stereo/first-person init calls are intact
alongside upstream's InputBindings wiring.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

runtime/tests/nand_save_tests.cpp

@@ -0,0 +1,142 @@
+#include "nand_save_probe.h"
+
+#include <algorithm>
+#include <chrono>
+#include <iostream>
+#include <sstream>
+#include <stdexcept>
+
+#ifdef _WIN32
+#include <windows.h>
+#endif
+
+namespace fs = std::filesystem;
+using RuntimeNandSave::ReadAction;
+using RuntimeNandSave::Contents;
+
+static void Require(bool condition, const char* message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+static void Write(const fs::path& path, const std::string& bytes) {
+    fs::create_directories(path.parent_path());
+    std::ofstream output(path, std::ios::binary);
+    output.write(bytes.data(), bytes.size());
+    output.close();
+    Require(static_cast<bool>(output), "Fixture write failed");
+}
+
+static std::string Read(const fs::path& path) {
+    std::ifstream input(path, std::ios::binary);
+    Require(static_cast<bool>(input), "Fixture read failed");
+    return {std::istreambuf_iterator<char>(input), std::istreambuf_iterator<char>()};
+}
+
+// A disk error after zero-filled blocks must not look like a blank file's EOF.
+class FailingDisk : public std::streambuf {
+    int blocks;
+public:
+    explicit FailingDisk(int zeroBlocks) : blocks(zeroBlocks) {}
+    std::streamsize xsgetn(char* buffer, std::streamsize length) override {
+        if (blocks-- <= 0) throw std::runtime_error("injected read failure");
+        std::fill(buffer, buffer + length, '\0');
+        return length;
+    }
+};
+
+int main() {
+    const auto root = fs::temp_directory_path() / ("wiicomp-save-scenarios-" +
+        std::to_string(std::chrono::steady_clock::now().time_since_epoch().count()));
+    try {
+        const auto save = root / "title/00010004/524d4350/data/rksys.dat";
+        const auto shadow = fs::path(save.native() + fs::path(".nandsafe.tmp").native());
+        // Save inspection must leave unrelated NAND data alone. Settings
+        // initialization is covered separately by nand_settings_tests.
+        const auto settingsPath = root / "title/00000001/00000002/data/setting.txt";
+        const std::string identity(256, '\x5a');
+        Write(settingsPath, identity);
+        Require(RuntimeNandSave::CheckRead(save, 1) == ReadAction::Proceed, "Fresh profile follows normal missing-file handling");
+        Require(!fs::exists(save), "Probing fresh profile must not create a save");
+
+        // First launch interrupted before save initialization, including block
+        // boundaries and a full-sized synthetic zero-filled allocation.
+        for (const size_t size : {size_t(0), size_t(1), size_t(4095), size_t(4096), size_t(4097), size_t(3 * 1024 * 1024)}) {
+            const std::string bytes(size, '\0');
+            Write(save, bytes);
+            Require(RuntimeNandSave::CheckRead(save, 1) == ReadAction::Missing, "Blank save should be offered first-save recovery");
+            Require(Read(save) == bytes, "Blank-save detection must not modify the file");
+            for (int mode : {2, 3}) {
+                Require(RuntimeNandSave::CheckRead(save, mode) == ReadAction::Proceed, "Write opens must remain available for initialization");
+            }
+        }
+
+        // Existing saves, imported saves, partial/corrupt saves, and a zero
+        // prefix with data only in the final byte are all left to the game.
+        std::string existing(3 * 1024 * 1024, '\0');
+        existing.replace(0, 8, "RKSD0006");
+        existing[10000] = 42;
+        for (const std::string& bytes : {existing, std::string("RKSD"), std::string("damaged-header"),
+                 std::string(8192, '\0') + "x", std::string(8191, '\0') + "x"}) {
+            Write(save, bytes);
+            Require(RuntimeNandSave::CheckRead(save, 1) == ReadAction::Proceed, "Never hide a save containing any data");
+            Require(Read(save) == bytes, "Existing/partial save must be byte-identical after inspection");
+        }
+
+        // Interrupted replacement: retain a committed original regardless of
+        // whether the shadow is blank, partial, or contains a complete header.
+        Write(save, existing);
+        for (const std::string& bytes : {std::string(), std::string(4096, '\0'), std::string("RKSD"), existing}) {
+            Write(shadow, bytes);
+            Require(RuntimeNandSave::CheckRead(save, 1) == ReadAction::Proceed, "Committed original takes precedence over write shadow");
+            Require(Read(save) == existing && Read(shadow) == bytes, "Probe must preserve both sides of an interrupted write");
+        }
+        // No usable original: do not let missing-save recovery discard the
+        // only possible recovery source, and do not auto-promote that shadow.
+        for (const bool mainExists : {false, true}) {
+            fs::remove(save);
+            if (mainExists) Write(save, std::string(4096, '\0'));
+            Write(shadow, existing);
+            Require(RuntimeNandSave::CheckRead(save, 1) == ReadAction::RecoveryNeeded, "Preserve recovery candidate when original is missing or blank");
+            Require(Read(shadow) == existing, "Recovery candidate must remain unchanged");
+            Require(fs::exists(save) == mainExists, "Do not promote shadow automatically");
+        }
+        Write(shadow, std::string(4096, '\0'));
+        Require(RuntimeNandSave::CheckRead(save, 1) == ReadAction::Missing, "Two blank files may use first-save recovery");
+        fs::remove(shadow);
+
+        for (const char* name : {"rksys.dat.bak", "rksys.dat.backup", "rksys.dat2", "banner.bin", "setting.txt"}) {
+            const auto unrelated = save.parent_path() / name;
+            Write(unrelated, std::string(4096, '\0'));
+            Require(RuntimeNandSave::CheckRead(unrelated, 1) == ReadAction::Proceed, "Do not classify backups or unrelated files as missing saves");
+        }
+        for (int blocks : {0, 1, 2}) {
+            FailingDisk disk(blocks);
+            std::istream input(&disk);
+            Require(RuntimeNandSave::InspectStream(input) == Contents::Error, "Read failure must remain an error, including after zero-filled blocks");
+        }
+        std::istringstream badEof;
+        badEof.setstate(std::ios::badbit | std::ios::eofbit);
+        Require(RuntimeNandSave::InspectStream(badEof) == Contents::Error, "Badbit plus EOF must not imply a blank save");
+
+#ifdef _WIN32
+        Write(save, existing);
+        const HANDLE locked = CreateFileW(save.c_str(), GENERIC_READ, 0, nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, nullptr);
+        Require(locked != INVALID_HANDLE_VALUE, "Could not lock fixture");
+        const auto lockedResult = RuntimeNandSave::CheckRead(save, 1);
+        CloseHandle(locked);
+        Require(lockedResult == ReadAction::Error, "Sharing/access failure must not report a missing save");
+        Require(Read(save) == existing, "Locked save must survive inspection unchanged");
+        Require(SetFileAttributesW(save.c_str(), FILE_ATTRIBUTE_READONLY) != 0, "Set fixture read-only");
+        const auto readOnlyResult = RuntimeNandSave::CheckRead(save, 1);
+        SetFileAttributesW(save.c_str(), FILE_ATTRIBUTE_NORMAL);
+        Require(readOnlyResult == ReadAction::Proceed && Read(save) == existing, "Readable read-only save remains available");
+#endif
+        Require(Read(settingsPath) == identity, "Save inspection must not change NAND settings");
+        fs::remove_all(root);
+        std::cout << "NAND save startup, preservation, interrupted-write and I/O failure scenarios passed\n";
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << " (fixtures retained at " << root << ")\n";
+        return 1;
+    }
+}

runtime/tests/nand_settings_tests.cpp

@@ -0,0 +1,183 @@
+#include "nand_settings.h"
+
+#include <chrono>
+#include <iostream>
+#include <stdexcept>
+#include <thread>
+#include <vector>
+
+static void Require(bool condition, const char* message = "NAND settings check failed") {
+    if (!condition) {
+        throw std::runtime_error(message);
+    }
+}
+
+static std::string ReadBytes(const std::filesystem::path& path) {
+    std::ifstream input(path, std::ios::binary);
+    return {std::istreambuf_iterator<char>(input), std::istreambuf_iterator<char>()};
+}
+
+int main() {
+    const auto root = std::filesystem::temp_directory_path() /
+        ("wiicomp-nand-settings-" + std::to_string(
+            std::chrono::steady_clock::now().time_since_epoch().count()));
+    const auto path = root / "title/00000001/00000002/data/setting.txt";
+    try {
+        using namespace RuntimeNandSettings;
+        Require(GenerateSerial(1800000123) == "800000123", "Dolphin timestamp modulo");
+        Require(GenerateSerial(1000000001) == "000000001", "Dolphin leading zero padding");
+        Require(GenerateSerial(-1).empty(), "Invalid clock must not supply an identity");
+        // Golden bytes generated by Dolphin's unmodified SettingsHandler.cpp
+        // (upstream 2026-09-06), PAL boot fields and synthetic serial 000000001.
+        // Everything after this prefix is raw zero padding to 256 bytes.
+        const std::string goldenHex =
+            "bba6ac929a0bc96b7eed83d27f33a1e7e73d9b836d8b47c59ee23df6b275baab"
+            "bec9d9dead03cc7a3bdafee50c30ab9fb86194e119fe4ba19eff62d5ec3aacb3"
+            "b5c9d9e3977eac0943d7ff903120a49ef024eafe1cf77be79cf6229a823aabf0f0";
+        std::array<uint8_t, 256> golden{};
+        for (size_t i = 0; i < goldenHex.size() / 2; ++i) {
+            golden[i] = static_cast<uint8_t>(std::stoul(goldenHex.substr(i * 2, 2), nullptr, 16));
+        }
+        Require(EncodeNew("000000001") == golden, "Exact Dolphin writer golden fixture");
+        std::string error;
+        Require(!RuntimeNandSettings::Read(root));
+        Require(!std::filesystem::exists(root));
+        std::filesystem::create_directories(path.parent_path());
+        const auto scratchParent = root / "scratch-collisions";
+        std::filesystem::create_directories(scratchParent / ".setting-init-fixed-0");
+        const auto sentinel = scratchParent / ".setting-init-fixed-0" / "setting.txt";
+        { std::ofstream output(sentinel); output << "another launch owns this"; }
+        const auto occupiedFile = scratchParent / ".setting-init-fixed-1";
+        { std::ofstream output(occupiedFile); output << "leave this file alone"; }
+        std::error_code scratchError;
+        const auto claimed = CreateScratchDirectory(scratchParent, "fixed", scratchError);
+        Require(claimed && *claimed == scratchParent / ".setting-init-fixed-2" && !scratchError,
+                "Retry collisions with both existing directories and files");
+        Require(ReadBytes(sentinel) == "another launch owns this" &&
+                ReadBytes(occupiedFile) == "leave this file alone", "Never modify another launch's scratch data");
+        Require(!CreateScratchDirectory(occupiedFile / "not-a-directory", "fixed", scratchError) && scratchError,
+                "Real filesystem errors must fail rather than retry indefinitely");
+
+        // Force all claimants to use the same token; this deterministically
+        // exercises the collision path even when host clock precision is high.
+        std::array<std::optional<std::filesystem::path>, 16> claims;
+        std::vector<std::thread> claimants;
+        for (size_t i = 0; i < claims.size(); ++i) {
+            claimants.emplace_back([&, i] {
+                std::error_code ec;
+                claims[i] = CreateScratchDirectory(scratchParent, "shared", ec);
+            });
+        }
+        for (auto& claimant : claimants) claimant.join();
+        for (size_t i = 0; i < claims.size(); ++i) {
+            Require(claims[i].has_value(), "Every concurrent claimant must acquire a scratch directory");
+            for (size_t j = 0; j < i; ++j) {
+                Require(claims[i] != claims[j], "Concurrent claimants must own different scratch directories");
+            }
+        }
+        const std::string plain = "AREA=USA\r\n\nCODE=LU\r\nSERNO=987654321\r\nGAME=US\r\n";
+        std::array<uint8_t, 256> fixture{};
+        for (size_t i = 0; i < fixture.size(); ++i) {
+            const unsigned shift = i % 32;
+            const uint32_t key = shift == 0 ? 0x73B5DBFAu :
+                (0x73B5DBFAu << shift) | (0x73B5DBFAu >> (32 - shift));
+            fixture[i] = static_cast<uint8_t>(key) ^ (i < plain.size() ? plain[i] : 0);
+        }
+        {
+            std::ofstream output(path, std::ios::binary);
+            output.write(reinterpret_cast<const char*>(fixture.data()), fixture.size());
+        }
+        auto settings = RuntimeNandSettings::Read(root);
+        Require(settings && RuntimeNandSettings::HasIdentity(*settings));
+        Require(settings->at("SERNO") == "987654321" && settings->at("CODE") == "LU");
+        Require(settings->at("AREA") == "USA" && settings->at("GAME") == "US");
+        Require(Ensure(root, error, 1800000123), "Existing imported NAND must work");
+        std::array<uint8_t, 256> after{};
+        {
+            std::ifstream input(path, std::ios::binary);
+            input.read(reinterpret_cast<char*>(after.data()), after.size());
+        }
+        Require(after == fixture);
+        for (const auto serial : {"", "000000000", "1234567890", "123ABC789"}) {
+            (*settings)["SERNO"] = serial;
+            Require(!RuntimeNandSettings::HasIdentity(*settings));
+        }
+        (*settings)["SERNO"] = "012345678";
+        Require(RuntimeNandSettings::HasIdentity(*settings));
+        (*settings)["CODE"] = "TOOLONG";
+        Require(!RuntimeNandSettings::HasIdentity(*settings));
+        (*settings)["CODE"] = "LEH";
+        settings->erase("GAME");
+        Require(!RuntimeNandSettings::HasIdentity(*settings));
+        std::filesystem::resize_file(path, 128);
+        Require(!RuntimeNandSettings::Read(root));
+        const auto damaged = ReadBytes(path);
+        Require(!Ensure(root, error, 1800000123), "Do not replace a truncated identity");
+        Require(ReadBytes(path) == damaged, "Damaged file must remain untouched");
+
+        const auto fresh = root / "fresh";
+        Require(Ensure(fresh, error, 1800000123), "Missing setting.txt must initialize");
+        const auto generated = Read(fresh);
+        Require(generated && HasIdentity(*generated), "Generated file must be readable");
+        Require(generated->at("SERNO") == "800000123", "Persist Dolphin-generated serial");
+        Require(generated->at("CODE") == "LEH" && generated->at("AREA") == "EUR" &&
+                generated->at("GAME") == "EU", "PAL first-boot fields");
+        Require(generated->at("MODEL") == "RVL-001(EUR)" && generated->at("VIDEO") == "PAL" &&
+                generated->at("DVD") == "0" && generated->at("MPCH") == "0x7FFE",
+                "Complete Dolphin boot settings");
+        const auto firstBoot = ReadBytes(FilePath(fresh));
+        Require(firstBoot.size() == 256 && firstBoot.back() == 0, "Dolphin buffer size and raw zero padding");
+        Require(Ensure(fresh, error, 1900000999), "Second boot");
+        Require(ReadBytes(FilePath(fresh)) == firstBoot, "Second boot must not change any bytes");
+
+        const auto blocked = root / "blocked";
+        { std::ofstream output(blocked); output << "file obstructing NAND directory"; }
+        Require(!Ensure(blocked, error, 1800000123), "Write failure must not return an ephemeral identity");
+        Require(!Ensure(root / "bad-clock", error, -1), "Clock failure must not initialize");
+
+        const auto concurrent = root / "concurrent";
+        std::array<bool, 16> results{};
+        std::vector<std::thread> workers;
+        for (size_t i = 0; i < results.size(); ++i) {
+            workers.emplace_back([&, i] {
+                std::string detail;
+                results[i] = Ensure(concurrent, detail, 1800000001 + i);
+            });
+        }
+        for (auto& worker : workers) worker.join();
+        for (const bool result : results) Require(result, "Concurrent boot must read the persisted winner");
+        const auto winner = ReadBytes(FilePath(concurrent));
+        Require(Read(concurrent) && HasIdentity(*Read(concurrent)), "Concurrent boot must persist valid settings");
+        Require(Ensure(concurrent, error, 1900000999), "Boot after concurrent initialization");
+        Require(ReadBytes(FilePath(concurrent)) == winner, "Concurrent winner must remain stable");
+
+        // Independently decode as Nintendo does: stop at the first encoded NUL.
+        // Exercise serials that force Dolphin's extra-LF escaping, not only
+        // values that happen to work with a plain rotating-XOR encoder.
+        bool sawExtraLf = false;
+        for (int serial = 1; serial <= 10000; ++serial) {
+            const auto number = GenerateSerial(1000000000 + serial);
+            const auto encoded = EncodeNew(number);
+            Require(encoded.has_value(), "Serial encoding must fit");
+            std::string decoded;
+            for (size_t i = 0; i < encoded->size() && (*encoded)[i] != 0; ++i) {
+                const unsigned shift = i % 32;
+                const uint32_t key = shift == 0 ? 0x73B5DBFAu :
+                    (0x73B5DBFAu << shift) | (0x73B5DBFAu >> (32 - shift));
+                decoded += static_cast<char>((*encoded)[i] ^ static_cast<uint8_t>(key));
+            }
+            Require(decoded.find("SERNO=" + number + "\r\n") != std::string::npos &&
+                    decoded.find("GAME=EU\r\n") != std::string::npos,
+                    "Encoded NUL must not truncate settings");
+            sawExtraLf |= decoded.find("\r\n\n") != std::string::npos;
+        }
+        Require(sawExtraLf, "Exercise Dolphin LF escape path");
+        std::filesystem::remove_all(root);
+        std::cout << "NAND settings checks passed\n";
+        return 0;
+    } catch (const std::exception& error) {
+        std::filesystem::remove_all(root);
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}

runtime/tests/sc_serial_tests.cpp

@@ -0,0 +1,81 @@
+#include "sc_serial_contract.h"
+#include "nand_settings.h"
+
+#include <algorithm>
+#include <array>
+#include <iostream>
+#include <iomanip>
+#include <stdexcept>
+#include <string>
+
+static void Require(bool condition, const char* message) {
+    if (!condition) throw std::runtime_error(message);
+}
+
+static uint32_t ReadWord(const unsigned char* bytes) {
+    return (uint32_t(bytes[0]) << 24) | (uint32_t(bytes[1]) << 16) |
+           (uint32_t(bytes[2]) << 8) | uint32_t(bytes[3]);
+}
+
+int main(int argc, char** argv) {
+    try {
+        // Feed real generator + SC ABI outputs to the upstream bot decoder.
+        // Usage: mkw_sc_serial_tests --timestamp-vectors <unix-seconds> ...
+        if (argc > 1 && std::string(argv[1]) == "--timestamp-vectors") {
+            for (int i = 2; i < argc; ++i) {
+                const auto timestamp = std::stoll(argv[i]);
+                const auto serial = RuntimeNandSettings::GenerateSerial(static_cast<std::time_t>(timestamp));
+                std::array<unsigned char, 4> output{};
+                Require(RuntimeScSerial::Write(serial, 4,
+                    [](uint32_t address, size_t size) { return address == 4 && size == 4; },
+                    [&](uint32_t, uint32_t value) {
+                        for (unsigned j = 0; j < 4; ++j)
+                            output[j] = static_cast<unsigned char>(value >> (24 - 8 * j));
+                    }) == 1, "Generated serial must pass SC ABI");
+                std::cout << timestamp << '\t' << serial << "\tLEH"
+                          << std::setfill('0') << std::setw(9) << ReadWord(output.data()) << '\n';
+            }
+            return 0;
+        }
+        // Reproduce the reported csnums from the old string-writing override.
+        const unsigned char old7886[] = {'7', '8', '8', '6'};
+        const unsigned char old7618[] = {'7', '6', '1', '8'};
+        Require(ReadWord(old7886) == 926431286, "Reproduce shared LEH926431286");
+        Require(ReadWord(old7618) == 926298424, "Reproduce shared LEH926298424");
+
+        std::array<unsigned char, 16> memory;
+        size_t available = 4;
+        unsigned writes = 0;
+        const auto contains = [&](uint32_t address, size_t size) {
+            return address == 4 && size <= available;
+        };
+        const auto write32 = [&](uint32_t address, uint32_t value) {
+            ++writes;
+            for (unsigned i = 0; i < 4; ++i)
+                memory[address + i] = static_cast<unsigned char>(value >> (24 - 8 * i));
+        };
+        for (const auto& pair : {std::pair{"788600001", 788600001u}, {"788699999", 788699999u},
+                 {"761800001", 761800001u}, {"761899999", 761899999u},
+                 {"012345678", 12345678u}, {"000000001", 1u}, {"999999999", 999999999u}}) {
+            memory.fill(0xa5);
+            writes = 0;
+            Require(RuntimeScSerial::Write(pair.first, 4, contains, write32) == 1, "Accept an exactly four-byte output buffer");
+            Require(writes == 1 && ReadWord(memory.data() + 4) == pair.second, "Return full numeric serial, including digits after common prefix");
+            for (size_t i = 0; i < memory.size(); ++i)
+                if (i < 4 || i >= 8) Require(memory[i] == 0xa5, "Do not overwrite adjacent guest stack data");
+        }
+        for (const char* serial : {"", "1234567890", "7886x1234", "-12345678", "+12345678"}) {
+            writes = 0;
+            Require(RuntimeScSerial::Write(serial, 4, contains, write32) == 0 && writes == 0, "Reject malformed serial without a write");
+        }
+        writes = 0;
+        Require(RuntimeScSerial::Write("788600001", 0, contains, write32) == 0 && writes == 0, "Reject null output");
+        available = 3;
+        Require(RuntimeScSerial::Write("788600001", 4, contains, write32) == 0 && writes == 0, "Reject undersized output");
+        std::cout << "SC serial collision reproduction, numeric output and memory-boundary tests passed\n";
+        return 0;
+    } catch (const std::exception& error) {
+        std::cerr << error.what() << '\n';
+        return 1;
+    }
+}

runtime/tests/test_expr.cpp

@@ -0,0 +1,219 @@
+// Verifies the expression engine against Dolphin's documented semantics,
+// including the exact line from the user's GCPadNew.ini.
+
+#include "input_expr.h"
+
+#include <chrono>
+#include <cmath>
+#include <cstdio>
+#include <map>
+#include <string>
+#include <thread>
+
+static int g_failures = 0;
+static std::map<std::string, double> g_inputs;
+
+static InputExpr::InputSource Source() {
+    return [](const std::string& name) {
+        const auto it = g_inputs.find(name);
+        return it == g_inputs.end() ? 0.0 : it->second;
+    };
+}
+
+static void Check(bool ok, const std::string& what) {
+    if (!ok) {
+        std::printf("  FAIL: %s\n", what.c_str());
+        ++g_failures;
+    }
+}
+
+static InputExpr::Expression Compile(const std::string& text) {
+    InputExpr::Expression expr;
+    std::string error;
+    if (!InputExpr::Expression::Parse(text, expr, error)) {
+        std::printf("  FAIL: parse '%s': %s\n", text.c_str(), error.c_str());
+        ++g_failures;
+    }
+    return expr;
+}
+
+static bool Pressed(const InputExpr::Expression& e) {
+    return e.Evaluate(Source()) > InputExpr::kConditionThreshold;
+}
+
+static void Sleep(int ms) { std::this_thread::sleep_for(std::chrono::milliseconds(ms)); }
+
+int main() {
+    std::printf("Dolphin expression engine\n");
+
+    // Operators: & is min, | is max, ! is 1-x, matching Dolphin.
+    g_inputs["A"] = 1.0;
+    g_inputs["B"] = 0.0;
+    Check(Pressed(Compile("`A`")), "bare input");
+    Check(!Pressed(Compile("!`A`")), "not");
+    Check(!Pressed(Compile("`A` & `B`")), "and is min");
+    Check(Pressed(Compile("`A` | `B`")), "or is max");
+    Check(Pressed(Compile("`A` ^ `B`")), "xor");
+    Check(!Pressed(Compile("`A` ^ `A`")), "xor of equal inputs is false");
+
+    // Precedence: & binds tighter than |, so this is A | (B & A).
+    g_inputs["B"] = 0.0;
+    Check(Pressed(Compile("`A` | `B` & `A`")), "& binds tighter than |");
+
+    // Parens and numeric literals.
+    Check(Pressed(Compile("(`B` | 1)")), "literal");
+    Check(Pressed(Compile("min(1, `A`)")), "min");
+    Check(!Pressed(Compile("min(0, `A`)")), "min with zero");
+    Check(Pressed(Compile("if(`A`, 1, 0)")), "if");
+    Check(Pressed(Compile("clamp(5, 0, 1)")), "clamp");
+
+    // toggle flips on each rising edge and holds between them.
+    auto toggle = Compile("toggle(`T`)");
+    g_inputs["T"] = 0.0;
+    toggle.Evaluate(Source());
+    g_inputs["T"] = 1.0;
+    Check(Pressed(toggle), "toggle on after first press");
+    g_inputs["T"] = 0.0;
+    Check(Pressed(toggle), "toggle stays on after release");
+    g_inputs["T"] = 1.0;
+    Check(!Pressed(toggle), "toggle off on second press");
+
+    // hold requires the input to be down for the full duration.
+    auto hold = Compile("hold(`H`, 0.05)");
+    g_inputs["H"] = 1.0;
+    Check(!Pressed(hold), "hold not satisfied immediately");
+    Sleep(70);
+    Check(Pressed(hold), "hold satisfied after the interval");
+    g_inputs["H"] = 0.0;
+    Check(!Pressed(hold), "hold clears on release");
+
+    // pulse fires for the given duration after a rising edge.
+    auto pulse = Compile("pulse(`P`, 0.05)");
+    g_inputs["P"] = 0.0;
+    pulse.Evaluate(Source());
+    g_inputs["P"] = 1.0;
+    Check(Pressed(pulse), "pulse fires on rising edge");
+    Sleep(80);
+    Check(!Pressed(pulse), "pulse expires");
+
+    // The timing-window idiom seen in shared Dolphin configs.
+    auto window = Compile("!pulse(`W`, 0.05) & pulse(`W`, 0.15)");
+    g_inputs["W"] = 0.0;
+    window.Evaluate(Source());
+    g_inputs["W"] = 1.0;
+    Check(!Pressed(window), "window closed before its start");
+    Sleep(90);
+    Check(Pressed(window), "window open between the two pulses");
+    Sleep(90);
+    Check(!Pressed(window), "window closed after its end");
+
+    // timer ramps 0..1 and wraps, so a threshold turns it into a square wave.
+    auto timer = Compile("`X` & timer(0.1)");
+    g_inputs["X"] = 1.0;
+    int high = 0;
+    int low = 0;
+    for (int i = 0; i < 40; ++i) {
+        (Pressed(timer) ? high : low)++;
+        Sleep(5);
+    }
+    Check(high > 5 && low > 5, "timer alternates high and low");
+
+    // The exact D-Pad/Up line from the user's GCPadNew.ini.
+    auto dolphinLine = Compile("`Hat 0 N` | `Button 4` & timer(0.01)");
+    g_inputs["Hat 0 N"] = 0.0;
+    g_inputs["Button 4"] = 0.0;
+    Check(!Pressed(dolphinLine), "idle with nothing held");
+    g_inputs["Hat 0 N"] = 1.0;
+    Check(Pressed(dolphinLine), "hat alone presses");
+    g_inputs["Hat 0 N"] = 0.0;
+    g_inputs["Button 4"] = 1.0;
+    high = low = 0;
+    for (int i = 0; i < 60; ++i) {
+        (Pressed(dolphinLine) ? high : low)++;
+        Sleep(2);
+    }
+    Check(high > 5 && low > 5, "LB alternates via timer(0.01)");
+
+    // Regression tests for the CodeRabbit findings on PR #89.
+    g_inputs["A"] = 1.0;
+    // clamp with reversed bounds: std::clamp is UB when lo > hi.
+    Check(Compile("clamp(0.5, 1, 0)").Evaluate(Source()) == 0.5, "clamp tolerates reversed bounds");
+    // deadzone(v, 1) would divide by zero.
+    {
+        const double v = Compile("deadzone(`A`, 1)").Evaluate(Source());
+        Check(std::isfinite(v), "deadzone with dz=1 stays finite");
+    }
+    // timer with a zero or negative period would produce inf or NaN.
+    for (const char* text : {"timer(0)", "timer(-1)"}) {
+        const double v = Compile(text).Evaluate(Source());
+        Check(std::isfinite(v), std::string(text) + " stays finite");
+    }
+    // Any non-finite result is squashed before it can reach the uint8_t cast.
+    for (const char* text : {"sqrt(0 - 1)", "pow(10, 10000)", "tan(1.5707963267948966)"}) {
+        const double v = Compile(text).Evaluate(Source());
+        Check(std::isfinite(v), std::string(text) + " is sanitised at the boundary");
+    }
+
+    // tap count is user authored; negative, huge and non-finite must not reach
+    // the unsigned conversion.
+    for (const char* text : {"tap(`A`, 0.2, -1)", "tap(`A`, 0.2, 999999999)", "tap(`A`, 0.2, 0)"}) {
+        InputExpr::Expression e;
+        std::string err;
+        Check(InputExpr::Expression::Parse(text, e, err), std::string("parse ") + text);
+        const double v = e.Evaluate(Source());
+        Check(std::isfinite(v), std::string(text) + " evaluates without UB");
+    }
+
+    // Exponent notation is not part of the number syntax, matching Dolphin's
+    // lexer; it is rejected rather than silently misparsed.
+    {
+        InputExpr::Expression e;
+        std::string err;
+        Check(!InputExpr::Expression::Parse("tap(`A`, 0.2, 1e30)", e, err), "exponent notation rejected");
+    }
+
+    // A zero divisor must not skip the left subtree: stateful functions there
+    // still need their per-frame update.
+    {
+        auto divToggle = Compile("toggle(`D`) / `Z`");
+        g_inputs["Z"] = 0.0;
+        g_inputs["D"] = 0.0;
+        divToggle.Evaluate(Source());
+        g_inputs["D"] = 1.0;
+        divToggle.Evaluate(Source());   // rising edge seen even though rhs is 0
+        g_inputs["D"] = 0.0;
+        g_inputs["Z"] = 1.0;
+        Check(divToggle.Evaluate(Source()) > InputExpr::kConditionThreshold,
+              "toggle still latched while the divisor was zero");
+    }
+
+    // smooth with a zero rate divides 0 by 0; NaN must not stick in the node.
+    {
+        auto sm = Compile("smooth(`A`, 0)");
+        g_inputs["A"] = 1.0;
+        sm.Evaluate(Source());
+        Sleep(5);
+        Check(std::isfinite(sm.Evaluate(Source())), "smooth with a zero rate stays finite");
+    }
+
+    // Referenced inputs, used for diagnostics in the UI.
+    const auto refs = dolphinLine.ReferencedInputs();
+    Check(refs.size() == 2, "two referenced inputs");
+
+    // Errors are reported, not silently swallowed.
+    InputExpr::Expression bad;
+    std::string error;
+    Check(!InputExpr::Expression::Parse("`A` & ", bad, error), "trailing operator rejected");
+    Check(!InputExpr::Expression::Parse("nope(1)", bad, error), "unknown function rejected");
+    Check(!InputExpr::Expression::Parse("(`A`", bad, error), "missing paren rejected");
+    Check(!InputExpr::Expression::Parse("`A", bad, error), "unterminated backtick rejected");
+    Check(InputExpr::Expression::Parse("", bad, error) && bad.Empty(), "empty parses to empty");
+    Check(!InputExpr::Expression::Parse("hold(`A`)", bad, error), "wrong arg count rejected");
+
+    if (g_failures == 0) {
+        std::printf("all checks passed\n");
+        return 0;
+    }
+    std::printf("%d check(s) failed\n", g_failures);
+    return 1;
+}