FrameBridge layer_debug: count xrAcquire/Wait/ReleaseSwapchainImage per 5 s (Vader Immortal's per-frame leak in SteamVR's runtime; hooked only with layer_debug, after the other wait/release hooks)

Unity 2019 built-in Oculus input on Lepton (BattleSisters, GitHub #48 ): libunity only reports controllers when the device model starts with "Oculus"; Lepton's Android is "Valve Lepton", so Unity polled only Go-style controllers and the game's buttons never arrived. unity_oculus_check revision 4 gives those strncmp calls length 0 (in place); on the device libunity now polls the Touch controllers
FrameBridge diagnostics from Vader Immortal (GitHub #49 ): layer_debug logs xrDestroySwapchain and per-5 s xrBeginFrame/xrEndFrame counts; strip_color_bias (drop XR_KHR_composition_layer_color_scale_bias, 2 = the layer's whole extension chain) and frame_balance (end an open frame before the next begin), both opt-in. Vader leaks ~430 GPU mappings a second inside SteamVR's runtime (GPU timing command buffers per frame); none of these stop it
2026-10-06 10:00:36 +02:00 · 2026-10-06 01:23:58 -04:00 · 2026-10-06 01:19:47 -04:00 · 2026-10-06 01:07:11 -04:00 · 2026-10-06 00:21:37 -04:00 · 2026-10-06 00:18:20 -04:00
71 changed files with 4524 additions and 231 deletions
@@ -26,7 +26,15 @@ Read `docs/PLAYBOOK.md` (symptom → fix) before debugging a game, and `docs/FRA
    launch.sh logs `start/end <unix>` to `<anchor>/plays.log` (upgrade_launchers adds it; Proton launchers exec → start
    only) and shots are matched by time; thumbnails cached in `<data>/screenshots-cache/<frame>/`, shown by asset URL;
    delete leaves screenshots.vdf alone (Steam rewrites it at exit); game menu → "Screenshots" = `go("screenshots",
-    pkg)`); settings; welcome; activity panel). Files, Screenshots and the Library share right-click menus
+    pkg)`); live view (`views/live.py` + `install/livestream.py`: the Frame's built-in SteamVR "headset view" webcam
+    (`steamvr-v4l2cam.service` → v4l2loopback "SteamVR" /dev/video99, see docs/FRAME_RUNTIME.md) + the default
+    output's pulse monitor (sound) → ffmpeg/x264 + AAC (qualities scale down only; "full" = SteamVR's size) →
+    fragmented MP4 on an SSH exec channel's stdout (the script stops ffmpeg on stdin EOF) → relay on 127.0.0.1 (keeps
+    init + fragments since the last keyframe of the *video* track for late viewers) → player page
+    `install/live_player.py` (MSE; starts muted as browsers require, "Sound on" button; 0.3 s cushion, catches up at
+    1.1x, seeks only when >2 s behind: seeking to the very edge starved it) opened
+    in the user's default browser: Flet can't show video outside `flet build` bundles; the stream outlives the tab and
+    stops on disconnect/window close); settings; welcome; activity panel). Files, Screenshots and the Library share right-click menus
    (one `ft.ContextMenu` per view, filled on right-click; on one of several selected items they act on the whole
    selection, `C.menu_targets`) and click-and-drag multi-select (`C.DragSelect`: pan start/end on the area + item
    hover events, which Flutter also sends with the button held; Flet can't report item positions, so no rubber band).
@@ -405,7 +413,7 @@ GPU. Learned in the headset: quads can't be a background (the Frame draws quad l
 whatever the order: hid 4XVR's balcony/controllers), and the Frame doesn't reproject a projection layer from its own
 pose (images drawn only after head turns, or ahead from xrWaitFrame and sometimes late, wobbled);
 `equirect_flip/face/res/fps/stereo`), `stable_local`, `focus_hold` (only after 3 s FOCUSED, dips <600 ms),
-`aim_pitch/aim_yaw/aim_forward`, `refresh_rate`, `layer_debug` (diagnostics). 4XVR re-creates LOCAL spaces every 2–4 s
+`aim_pitch/aim_yaw/aim_forward`, `refresh_rate`, `layer_debug` (diagnostics); focus_hold is default-on since 2026-10-05. 4XVR re-creates LOCAL spaces every 2–4 s
 (menu recentring suspect); its theatres are baked 7680×3840 equirect2 images (`assets/100.png` …). Test 360° videos
 (NASA, public domain) are in the Frame's ~/Videos; copies in `~/Downloads/frameport-360`. 4XVR's "Internal Storage"
 lists its own `/sdcard/4XPlayer`, not Movies: agent v25 `link_media` hard-links sent files into an app's own top-level
@@ -514,16 +522,61 @@ lacks (ActivityNotFoundException) → imported by hand: libmain.so + game.json
 DATA/ → external files/WiiCompiledOpenXRVR/DATA, MOD/ → .../RetroRewind6 (decompiled with jadx). Lepton has no
 picker at all: a FramePort fix would be an injected picker activity. Generated cover/banner art used to suppress the
 Steam placeholder set (no Steam art at all) → fixed in artwork/steam.py.
-**Steam library failures (GitHub #21/#30):** on some Frames Steam never loads FramePort's shortcuts.vdf entries (same SteamOS build and arm64 beta client as the dev Frame; IDs correct; file written before Steam starts): Play → console_log `GameAction [AppID <id>] … RequestingLicense → UpdatingAppInfo → LaunchApp failed with AppError_9` (= "Game configuration unavailable", Steam treats the id as a store app). Cause unknown; agent v42/43 diagnostics: `launch` returns `steam` (started / error + code / silent from console_log), `collect_diag` adds `steam_library` (real Steam dir, beta, Steam start vs vdf write time, entries per account, devkit games) + `steam-console.txt` (incl. Steam's `logs/shortcuts.previous.txt` if present; steamclient.so has "LoadShortcuts: rejecting attempt to load shortcuts: invalid account ID"). **Fallback (agent v43):** when Play gets AppError_9 the agent registers the game through Steam's devkit interface (what Valve's Devkit Management Tool does, MIT: `devkit-1 steam://devkit-1/<~/.steam/steam.token>/create-shortcut?response=<file>&gameid=<id>&directory=~/devkit-game` written to ~/.steam/steam.pipe; answer file / `.error`; `~/devkit-game/<id>/launch.sh` = link to the game's launch.sh, `<id>-argv.json` ["launch.sh"] (relative to the folder), `<id>-settings.json` {steam_play 0, compat_tool ""}). Steam adds it live (no restart), picks its own appid (read back from shortcuts.vdf by DevkitGameID), shows it as a normal non-Steam game named "Devkit Game: <id>" (OpenVR 0, but VR works: owner-verified 2026-10-04), art copied to grid/<appid>*. Ids: letter first, then letters/digits/_ only (spaces, '-', leading digit → "missing/invalid arguments"). Later Plays use the devkit entry; uninstall (`devkit_unregister`, `delete-shortcut` live) and purge remove it. Verified on the dev Frame: register/launch/unregister; the AppError_9 trigger itself only in unit tests.
+**Steam library failures (GitHub #21/#30):** on some Frames Steam never loads FramePort's shortcuts.vdf entries (same SteamOS build and arm64 beta client as the dev Frame; IDs correct; file written before Steam starts): Play → console_log `GameAction [AppID <id>] … RequestingLicense → UpdatingAppInfo → LaunchApp failed with AppError_9` (= "Game configuration unavailable", Steam treats the id as a store app). Cause unknown; agent v42/43 diagnostics: `launch` returns `steam` (started / error + code / silent from console_log), `collect_diag` adds `steam_library` (real Steam dir, beta, Steam start vs vdf write time, entries per account, devkit games) + `steam-console.txt` (incl. Steam's `logs/shortcuts.previous.txt` if present; steamclient.so has "LoadShortcuts: rejecting attempt to load shortcuts: invalid account ID"). **Fallback (agent v43):** when Play gets AppError_9 the agent registers the game through Steam's devkit interface (what Valve's Devkit Management Tool does, MIT: `devkit-1 steam://devkit-1/<~/.steam/steam.token>/create-shortcut?response=<file>&gameid=<id>&directory=~/devkit-game` written to ~/.steam/steam.pipe; answer file / `.error`; `~/devkit-game/<id>/launch.sh` = link to the game's launch.sh, `<id>-argv.json` ["launch.sh"] (relative to the folder), `<id>-settings.json` {steam_play 0, compat_tool ""}). Steam adds it live (no restart), picks its own appid (read back from shortcuts.vdf by DevkitGameID), shows it as a normal non-Steam game named "Devkit Game: <id>" (OpenVR 0, but VR works: owner-verified 2026-10-04), art copied to grid/<appid>*. Ids: letter first, then letters/digits/_ only (spaces, '-', leading digit → "missing/invalid arguments"). Later Plays use the devkit entry; uninstall (`devkit_unregister`, `delete-shortcut` live) and purge remove it. Verified on the dev Frame: register/launch/unregister; the AppError_9 trigger itself only in unit tests. GitHub #42 (two Steam accounts, neither MostRecent): Steam rewrote the active account's shortcuts.vdf without FramePort's entries right after starting, and added the devkit entry live without saving it, so `devkit_appid` (vdf only) failed ("Steam added the devkit entry but didn't save it"); agent v55 `devkit_appid_from_log` reads Steam's `sanitize shortcut app id "~/devkit-game/<id>/launch.sh": replacing 0 with N` console line. GitHub #41 (one account): same Steam behaviour, and every install restarts Steam, which forgets the never-saved devkit entry. Agent v56: the log fallback reads only the current session's console_log.txt; Play re-registers a devkit entry that gets AppError_9; art updates also write the devkit entry's grid art (`copy_grid_art`). Open: why some Frames' Steam never loads or saves shortcuts.vdf (single account too).
 **Exit game (GitHub #36, 2026-10-04):** `Apps.TerminateApp` (what Exit game calls; reachable for tests through Steam's CEF devtools on 127.0.0.1:8080, SharedJSContext, `Runtime.evaluate` — a stdlib websocket client is enough) closed both a normal shortcut and a devkit entry on the dev Frame within 1-3 s. SIGTERM to Steam's `reaper` alone left launch.sh + Lepton (setsid) + the container running (an earlier headset launch ran on for 87 min); SIGTERM to launch.sh cleans up in ~4 s. Agent v44: launch.sh's 2 s loop ends the game when its parent (the reaper) is gone; `upgrade_launchers` (from ensure_host_fixes) adds that to existing launchers in place. Which in-headset exit path fails is still unknown. Screenshots on the Frame: all under SteamVR's appid 250820 (`760/remote/250820/screenshots`, screenshots.vdf has creation time, no game).
 **SteamVR dashboard at game start (2026-10-04):** the dashboard (Resume game / controller / VR options) was open whenever a FramePort game started (also over Lepton's 2D launcher). Steam's UI exposes `SteamClient.OpenVR.VROverlay.{IsDashboardVisible,HideDashboard,ShowDashboard}` (CEF devtools, `steam_js` in the agent). Agent v44: launch.sh starts `_dashboard_worker` (waits for FrameBridge's first `pacing:` line in launch.log, then hides a visible dashboard for 25 s, at most 3 times; log `<base>/dashboard.log`; opt out with env FRAMEPORT_KEEP_DASHBOARD=1). Verified on the dev Frame (dashboard shown → 4XVR launched via Steam → hidden ~5 s after the first frames); not yet seen in the headset. **Headset (ITR2, 2026-10-05): too late** — Steam shows its frame menu (`valve.steam.gamepadui.frame.menu`, vrwebhelper_systemui.txt `[PooledPopups] Showing`) ~0.3 s after the game's first submitted frame (FrameBridge `new layer:`), but the first `pacing:` summary comes ~8 s later; the owner had pressed Resume (`[HideDashboard] return_to_game`) before the worker looked. Agent v52: watches from the first `new layer:` line (incremental log reads, 0.5 s polls, 30 s window). Agent v53: stops for good once the player opens the dashboard with the controller (`toggle_dashboard_action` in vrwebhelper_systemui.txt since the worker started): v52 closed it 60 ms after each press, and the game, paused for it, stayed paused.
 **Space warp / ITR2 (2026-10-04):** Into The Radius 2 (UE5, `libUnreal.so` + OVRPlugin, Vulkan) uses Application SpaceWarp (extra swapchains `376x376 format=97` motion vectors + `format=129` depth); #35 reports flickering textures. OVRPort's `patch_disable_space_warp` has no effect on UE5, and hiding XR_FB_space_warp in FrameBridge's enumerate doesn't reach the game either: **OVRPort's dispatcher offers/enables XR_FB_space_warp itself**. FrameBridge `hide_space_warp` (per game, off) hides it and strips `XrCompositionLayerSpaceWarpInfoFB` (1000171000) from the projection views (log `hide_space_warp: removed space warp info`); the game still renders its MV swapchains. Test build installed on the dev Frame; flicker not yet checked in a headset. Heuristic: UE5 + OVRPlugin shows it as an option (off). `equirect_emul` is suggested for Unreal games whose graphics API isn't detected ("GLES or unknown"); on Vulkan it switches itself off (Myst/Riven/ITR2): harmless, but Unreal Vulkan detection is a known gap.
 **PR #34 (merged 2026-10-04, Lucas-Mathieu):** `native/adapter/audio_metadata.h` patches Meta XR Audio Wwise (only build ID e1619e7f…, Batman: Arkham Shadow 1.4.1) so queued audio metadata isn't freed while the current audio frame references it (smoke-bomb crash). Verified headless: installs ("metadata reclamation follows …"), 72 fps; we added a once-per-second scan limit. Outside PRs: review source, rebuild `artifacts/` ourselves, merge locally (contributor's commit kept), push main.
 **Heuristics eval (2026-10-04):** `scripts/eval_heuristics.py "<VR CyberDeck Portable>"` → 19/44 recipes exact, 322/352 fields (most diffs: `frame.unity_text_input` suggested where older catalog recipes lack it; the rest are runtime-only findings: use_alt, vk_shader_fix, focus_hold, sync_guard, multipass). `PATCHED/` copies aren't scored (already converted).
-**Power (0.9, agent v47):** sidebar bar above the Frame card: Sleep / Restart / Shut down, each confirmed (`app.frame_power`, a running game asks again). logind answers CanSuspend/CanReboot/CanPowerOff = "challenge" for an SSH session but "yes" inside a user unit, so agent `power` runs `systemctl suspend|reboot|poweroff` from a transient `systemd-run --user --on-active=3` timer (the command answers first). Restart verified on the device (back in ~84 s, new boot id).
+**Power (0.9, agent v47):** sidebar bar below the Frame card: Sleep / Restart / Shut down, each confirmed (`app.frame_power`, a running game asks again). logind answers CanSuspend/CanReboot/CanPowerOff = "challenge" for an SSH session but "yes" inside a user unit, so agent `power` runs `systemctl suspend|reboot|poweroff` from a transient `systemd-run --user --on-active=3` timer (the command answers first). Restart verified on the device (back in ~84 s, new boot id).
 **Proton default (agent v51, owner's choice 2026-10-05):** the newest **stable** ARM64 Proton is the default for PC VR games (`pick_proton`: asked-for name/alias, else newest installed stable, else any stable). Agent v49-50 defaulted to Experimental; the owner's headset A/B with Rick and Morty (Experimental 69 % reprojected frames, stable felt much smoother) reverted it. The game page's Customize shows `pcvr.proton_tool` as a dropdown (Stable (default) / Experimental = alias `proton-experimental`); `ensure_proton` installs a chosen one (it asks once more for the runtime Steam only names after Proton is installed; Experimental installed unattended on the device in 53 s). A PC VR launch test that fails on stable suggests Experimental (`pipeline.PROTON_TOOL`, `proton_alternative_worth_trying`, button "Try Proton Experimental and reinstall"). Remaining Rick and Morty stutter on head turns = the game rendering below the refresh rate (reprojection), not Proton.
 **USB cable link (verified 2026-10-05, cabled to the dev PC):** `usb0` is a USB **NCM** gadget (configfs g1: `ncm.usb0` + `ffs.adb`, Valve 28de:2460) set up by `usb-ncm-gadget@usb0.service`, which only runs with `ConditionPathExists=|/etc/systemd/system/adbd.service.d/steamos-devkit-enabled` = **Developer Mode only**. `usb-ncm-dnsmasq@usb0` serves DHCP with fixed `dhcp-host` entries: Frame 10.86.200.233, PC **10.86.200.234** (`frame/usb.py` FRAME_USB_IP/PC_USB_IP). Windows 11 binds its built-in "UsbNcm Host Device" (no driver); WSL mirrored sees eth 10.86.200.234. USB is high-speed (USB 2.0): upload 36.9 MB/s vs 11.3 MB/s home Wi-Fi. Frame→PC over the cable worked without a firewall change. `scripts/usb_autotest.py` (Windows via powershell.exe from WSL), `frameport frame usb-check`. Wizard "Set up with a USB cable" (`PairingServer(host=PC_USB_IP)`; the real bootstrap ran end to end over USB). Discovery dedupes by SSH host key and prefers USB > Frame hotspot > network (`discovery.dedupe`); a lost address is re-found by key (`Frame.relocate`, tested with a dead saved address).
 **Catalog updates without a release (2026-10-05):** apps fetch `catalog/games/*.yaml` from GitHub `main` (`recommend/catalog.refresh_remote`: one API call `git/trees/main?recursive=1` + raw.githubusercontent downloads of changed blobs, cached as `catalog-gh-<sha>.yaml`, every 6 h; GUI at start + Settings → Data "Check now"; CLI background thread + `frameport catalog-update`). `catalog.load()` only reads the cache. A remote entry is skipped (`unusable_reason`) when it names a patch/adapter key this app doesn't register, has a field `CatalogEntry` doesn't know, or `min_app` > this version: add `min_app` (or rely on new patch ids) when a config needs an unreleased FramePort. Remote beats bundled unless the bundled entry has a later updated/verified date; the user's own entries still win as before. Off: setting `catalog.auto_update`, env FRAMEPORT_NO_CATALOG_UPDATE; FRAMEPORT_CATALOG_URL still overrides the source. So: **pushing a catalog change to main reaches users within 6 h** (their recipes follow via catalog_rev → Update on Frame).
+**Start activity / QuestCraft / ITR2 pop-in (2026-10-05):** WiiCompiled's VR part (`QuestActivity`, SDL, process `:game`) stays behind Lepton's flat window when the launcher is shown (`device.text_input_window`). `frame.start_activity` (opt-in; analysis `extra.vr_activity` = the original APK's activity with Meta's VR category when it isn't the launcher) gives that activity's filter LAUNCHER and every other LAUNCHER becomes INFO, per element (`axml.set_start_activity`); Lepton's own `apk-info-extractor --print-activity-name` (on the Frame under Lepton/liblepton/apk_extractor) then answers QuestActivity. **OVRPort gives every MAIN activity LAUNCHER + VR categories**, so the VR activity must come from the original APK's analysis, not the converted manifest. Lepton has no activity override (`APP_ACTIVITY` is reset when app_metadata.sh is sourced). QuestCraft reaches Minecraft 1.21.5 (Fabric, Vivecraft, Sodium; LTW "Large Thin Wrapper" GL 3.0 on the Frame's Zink) and stops at `OpenGL error 1282` in `WindowFramebuffer` createTexture (Minecraft's crash report in `files/instances/1.21.5/crash-reports/`, Pojlib's `files/latestlog.txt`); the vrclient SIGSEGV / "pthread_mutex_lock called on a destroyed mutex" afterwards is only the shutdown (Unity's render thread still in vrclient while the instance is destroyed). ITR2 "models popping in and out" in game: Unreal reads user config from **internal** storage (`lepton-data/internal/<pkg>/files/UnrealGame/<Project>/<Project>/Saved/Config/Android/Engine.ini`, not external); `r.AllowOcclusionQueries=0` there broke its menus (removed again). Vulkan shim `vk_query_slots` (two slots per occlusion query) never saw ITR2 create an occlusion query pool, and the run with it crashed (Unreal RenderThread SIGSEGV, caught by sentry-native: no tombstone; the backtrace is in `cache/sentry/*/.sentry-native/*.run/*.envelope` with module offsets) - left off. Next suspect: Unreal 5 mobile HZB occlusion reading depth stored with Valve's FDM injection layer; test = launcher `VK_INSTANCE_LAYERS=''` (Lepton then loads neither VALVE_rpo nor VALVE_fdm_injection, Fossilize still). QuestCraft: LTW overrides glGetError and returns 0 with `LIBGL_NOERROR` set; Lepton passes `LEPTON_ENV_<NAME>` to the app as `<NAME>`, so catalog `lepton_env: {LEPTON_ENV_LIBGL_NOERROR: '1'}` gets Minecraft past the GL error 1282; then black picture (see the catalog entry). FrameBridge logs `new layer` once per layer type per process and projection views only for the first frames, so a second session in the same process (Vivecraft after Unity) needs `layer_debug=1`.
+**Vulkan validation / ITR2 solved (2026-10-05):** Khronos' validation layer can't come from Lepton (its layer dir is in the read-only guest image; the Linux copies on the Frame are glibc) and a global `debug.vulkan.layers` property (via the LEPTON_GFXRECON_FP_PROPS trick) kills the container at boot. Working recipe: bundle `libVkLayer_khronos_validation.so` (Khronos android-binaries release, arm64-v8a, stored uncompressed) into a test APK re-signed with the game's key (`apk.sign.sign`), install with `frameport install <pkg> --apk`, and set the Vulkan shim's `vk_validation=1` (it adds the layer at vkCreateInstance; findings under the logcat tag VALIDATION in launch.log, each message ID capped at 10). ITR2's flicker + windows behind models = Unreal's Qualcomm shader-resolve subpasses with a depth resolve of a single-sampled depth attachment (VUID-04908/-03179); `vk_spec_fixes=1` drops that resolve (its TRANSFER_DST half never applies to ITR2: the main depth is transient). Valve's VALVE_rpo layer removed ITR2's fog (catalog `lepton_env: VK_INSTANCE_LAYERS: VK_LAYER_VALVE_fdm_injection`). `r.ViewDistanceScale=2` in the internal Saved/Config/Android/Engine.ini only exists on the owner's Frame (the catalog can't write internal storage yet). Launch tests: Lepton prints a transient "is not a running context" on the first start after an APK change (agent v54 `not_started` waits 30 s for "Boot complete!").
+**GitHub #38/#39 (2026-10-05):** PowerWash Simulator stuck at "Waiting.." on a reporter's Frame = Unity sized the right-eye image rect past its swapchain (rect 268+1656 on a 1920-wide swapchain; the runtime's recommended size differs per Frame) and SteamVR rejected every frame (`xrEndFrame failed -25`, XR_ERROR_SWAPCHAIN_RECT_INVALID), after which the game stopped calling xrEndFrame. FrameBridge `rect_clamp` (default on; sizes noted in xrCreateSwapchain; clamped layers count as swapped) keeps projection/quad rects inside their swapchain; triage `swapchain-rect-invalid`. Not reproducible on the dev Frame with `scale` (Unity's eye sizing isn't just the recommended width); no regression there (72 fps). The adapter's revision was NOT bumped (that would mark every installed game outdated): affected users rebuild. The Room VR (#38) = Unity's render thread SIGSEGV in libgallium_dri.so ~30 ms after the game recreates its eye swapchain with samples=4 (FrameBridge retries samples=1); the game's own code turns MSAA on (not OVRManager); candidate fix: hide GL_EXT_multisampled_render_to_texture (GL shim) - needs the APK to test. The launch test passed both (render thread dead / no frames): triage gap.
+**Headset round 2026-10-05 (evening):** I Am Cat's judder = repeated xrLocateViews of one display time returning
+slightly different poses → FrameBridge `pose_consistency` (owner-verified, works). Lucky's Tale freeze on touching a
+save slot = OVRPort's OpenXR dispatcher converting XR_FB_haptic_amplitude_envelope with ns read as s (GitHub #9) →
+xrshim `haptic_fix` (owner-verified); its remaining short pauses were the wear sensor ("HMD off/on" 0.5-1 s in
+`logs/eyetracking.txt`, not vrserver.txt) → **`focus_hold` is on by default with 5 s** (owner's choice; C defaults
+too). The Room VR works (`unity_no_overlay_copy`). BattleSisters (Unity 2019.4 built-in VR, no libOculusXRPlugin.so)
+flooded "outside of frame bounds" ~2400/s and hung the GPU (kernel hangcheck, zink DEVICE LOST) → the ovrpshim frame
+wait now also applies to Unity 2019 without the Oculus XR Plugin (`UnityOculusCheck.legacy_loop`). Vader Immortal
+(UE4, stuck on the loading image after the intro, GitHub #49): VRP repacks carry a Frida gadget (`libfrda.so`,
+config `hijack_responses`), but OVRPort's `patch_clean_up_frida` removes its loadLibrary call, so it never runs on
+the Frame; `frame.ovr_trace` (opt-in, `native/ovrtrace`: 1138 exported ovr_* stubs → real loader functions, logcat
+tag `fp_ovrtrace`: calls, PopMessage answers, unanswered requests every 10 s) is the next diagnostic.
+**Unity built-in VR input (2026-10-05):** probe builds (`FRAMEPORT_INPUT_PROBE=1 frameport build …`; it logs
+trigger/grip crossings too) showed OVRPlugin returns the full Touch state for every controller mask (also Go masks);
+presses reach the games' OVRInput. Accounting+ (Il2CppDumper v6.7.46 reads its Unity 2017 metadata v24, run on Windows)
+passes stance selection (NewtonVR grip/trigger) but its motion warning waits for `Input.GetMouseButtonDown(0/1)`,
+which Lepton never delivers (no focused Android window) → ovrpshim registers its own
+`UnityEngine.Input::GetMouseButtonDown(System.Int32)` icall (il2cpp_add_internal_call, after Unity's: resolve first)
+that adds a click in the frame a Touch trigger or A/B/X/Y is newly pressed (`unity_oculus_check` revision 3).
+BattleSisters (Unity 2019 InputSystem/XR InputDevices via `VrHandInput`): libunity's Oculus module (OVRPlugin
+function table: a global pointer at 0x16b57c0 in this build, slots filled by name, e.g. +0x160 GetControllerState,
+0x168 State2, +0xe8 GetNodePresent) only reports controllers when `strncmp(deviceModel, "Oculus", 6) == 0` (next to
+the Go check `deviceModel == "Oculus Pacific"`); Lepton's model is "Valve Lepton" → Go/unknown → only Go masks polled,
+buttons dead. `unity_oculus_check` revision 4 (`oculus_model_checks`, Unity 2019 only) turns the 17 compares' length
+into 0 (`orr w2, wzr, #6` → `mov w2, #0` after the adrp/add of the "Oculus" literal; the string stays: it is also
+Unity's VR device name). Device result: libunity now polls `ovrp_GetControllerState(0x3)` (Touch); buttons in the
+headset not yet confirmed. Ruled out before: ProductName, GetNodePresent, the device-model string itself, exports.
+Accounting+ works (owner, 2026-10-06).
+**Vader Immortal (UE4, GitHub #49, 2026-10-06, headless):** stuck after the intro on an in-game image (the splash
+quad ends ~6 s in; then the game's own projection frames, 72 fps, balanced xrBeginFrame/xrEndFrame). Not the Platform
+SDK (`frame.ovr_trace`: only user + entitlement, both answered) and not the repack's Frida gadget (OVRPort's
+`patch_clean_up_frida` removes its loadLibrary). It **leaks ~430 GPU mappings (/dev/dri/renderD128) and ~20 MB a
+second** (6.5 GB + swap after 5 min, then 26 fps): page-fault stacks (perf -e page-faults, offsets resolved with the
+process maps + vrclient.so's own symbols; its text segment is at file offset + 0x4000) end in SteamVR's runtime:
+`xrBeginFrame → CSxrCompositorOpenVR::BeginFrame → SubmitExplicitTimingData → CVRCompositorSharedTextures::
+BeginGPUTimingCommandBuffer` and `xrEndFrame → CVRCompositorClient::SubmitWithArrayIndexAndTime`. Ruled out: the
+layer color scale/bias + image layout structs (FrameBridge `strip_color_bias` 1/2, diagnostic), Valve's Vulkan
+layers (VK_INSTANCE_LAYERS=""), array swapchains in general (Lucky's Tale/I Am Cat flat). Kernel tracepoints aren't
+allowed for steamos. FrameBridge: `layer_debug` logs xrDestroySwapchain and per-5 s xrBeginFrame/xrEndFrame counts;
+`frame_balance` (ends an open frame before the next begin) exists but Vader never leaves one open. Next (built,
+not yet run: the Frame slept): `layer_debug` also counts xrAcquire/Wait/ReleaseSwapchainImage per 5 s (hooked only
+with layer_debug, after the other conditional hooks) to see whether Vader skips a wait or release.
 **Lepton storage (2026-09-30):** each app's /sdcard (= /storage/emulated/0 → `<base>/lepton-data/external`) has `Movies`/`Download`/`Documents` symlinked to the Frame's `~/Videos`/`~/Downloads`/`~/Documents` (liblepton/mounting.sh, only if they exist at start); agent v24 `storage_targets` reads that mapping. Android's MediaProvider canonicalises paths to /home/steamos/... and rejects every file ("doesn't appear under [/system/media...]"), `sm list-volumes` is empty: the media index never works, apps must browse folders. Lepton installs with `adb install -g` (runtime permissions granted, MANAGE_EXTERNAL_STORAGE too). Files: `install/files.py`, `frameport frame send|storage`, GUI Files tab (formerly Frame → Send files).
 **SteamVR per-app settings (2026-09-30):** editing steamvr.vrsettings while SteamVR runs is lost; the web API (127.0.0.1:27062 /app/setsettings) needs `x-steamvr-secret`. `native/vrsettings` = `fp_vrsettings.exe` (freestanding, OpenVR `FnTable:IVRSettings_003` as a Utility app, loads SteamVR's bin/win64/openvr_api.dll) sets them live and SteamVR persists them: section `steam.app.<shortcut appid>`, keys `preferredRefreshRate` (float) and `motionSmoothingOverride` (0 global, 1 on, 2 off, 3 always). Steam Link (vrlink) lists the Frame's rates 72/80/90/96/108/120/144 in vrserver.txt and follows the per-app preference ("host preferred N Hz"; whether the key is honoured is unverified in-headset yet). Judder metric: vrcompositor.txt session summary dropped + "Timed out. N total" (Stormland: 0 dropped but 313 timeouts in 2 min); fpsVR (`%LOCALAPPDATA%\fpsVR\*.json`, 0.1 ms histograms) gives p99 CPU/GPU ms. `pcvr.steamvr_tuning` (default on, PC only) applies on Play: highest rate whose budget ≥ p99×1.05, at least one step down, smoothing on.

@@ -32,6 +32,7 @@ Install games that target the Meta Quest, Android, or general PCVR onto your **V
  shortcut; they run natively on SteamOS.
 - **Screenshots tab:** the screenshots you took in the headset, sorted by game (matched by play time) and day;
  view them and download them to your computer.
+- **Live view tab:** watch what the headset shows, with sound, in a browser window on your computer.
 - **Self-updating** releases, redacted diagnostics, one-click problem reports and working-config sharing.

 ## Quick start
@@ -78,6 +79,14 @@ your computer.

 ![Screenshot viewer](docs/images/screenshot-viewer.png)

+## Live view
+
+The **Live view** tab streams what the headset shows, with its sound, to your computer: click **Start live view** and
+it opens in your default web browser (full screen with a double-click; click **Sound on** to hear it, as browsers start
+videos muted). Pick 360p to 1080p, or the headset view's full size. The picture comes from SteamVR's built-in headset
+view on the Frame and is encoded there while you watch (about one CPU core), so stop it when you're done. It's black
+while the headset sleeps.
+
 ## Compatibility

 If a game has already been tested with FramePort, it will automatically use the optimal game config. Otherwise, FramePort
@@ -36,7 +36,7 @@ import time
 import zlib
 from types import SimpleNamespace

-AGENT_VERSION = 53
+AGENT_VERSION = 56
 HOME = os.path.expanduser("~")
 STEAM = os.path.join(HOME, ".local/share/Steam")
 ANCHORS = os.path.join(HOME, "Applications/quest-frame")
@@ -1135,7 +1135,16 @@ def remove_from_library(user, remove, result):

 def update_library(user, packages, result, shortcuts=True):
    """Add/update installed games' shortcuts + grid art in one Steam account (Steam is closed; shortcuts=False: only
-    the grid art of shortcuts that are already right, while Steam runs)."""
+    the grid art of shortcuts that are already right, while Steam runs). A game's devkit entry (the Play fallback)
+    gets the same art: on Frames where Steam ignores shortcuts.vdf it is the one in the library (GitHub #41)."""
+    for pkg in packages:
+        gameid = devkit_gameid(pkg)
+        appid = devkit_appid(gameid) if gameid else None
+        if appid:
+            try:
+                copy_grid_art(pkg, appid, [user])
+            except OSError as exc:
+                result.setdefault("errors", []).append(f"{pkg}: devkit art: {exc}")
    vdf = os.path.join(STEAM, "userdata", user, "config/shortcuts.vdf")
    grid = os.path.join(os.path.dirname(vdf), "grid")
    os.makedirs(grid, exist_ok=True)
@@ -1278,7 +1287,28 @@ def devkit_appid(gameid):
        for v in (root.get("shortcuts") or {}).values():
            if isinstance(v, dict) and v.get("DevkitGameID") == gameid and v.get("appid"):
                return v["appid"] & 0xFFFFFFFF
-    return None
+    return devkit_appid_from_log(gameid)
+
+
+def devkit_appid_from_log(gameid):
+    """The appid Steam picked for a devkit game, from its console log ('sanitize shortcut app id "<dir>/<id>/launch.sh":
+    replacing 0 with N'). Steam adds the entry live but may never save it (GitHub #41/#42), so the log of the running
+    Steam session is the fallback (console_log.previous.txt is the session before, whose live entries are gone). The
+    newest line wins."""
+    exe = os.path.join(DEVKIT_GAMES, gameid, "launch.sh")
+    pat = re.compile(r'sanitize shortcut app id "' + re.escape(exe) + r'": replacing \d+ with (\d+)')
+    found = None
+    for name in ("console_log.txt",):  # this Steam session only: entries added live are gone after a restart
+        try:
+            with open(os.path.join(STEAM, "logs", name), errors="replace") as f:
+                for line in f:
+                    if "sanitize shortcut app id" in line:
+                        m = pat.search(line)
+                        if m:
+                            found = int(m.group(1)) & 0xFFFFFFFF
+        except OSError:
+            continue
+    return found


 def devkit_register(pkg):
@@ -1320,8 +1350,14 @@ def devkit_register(pkg):
        time.sleep(0.5)
    if not appid:
        raise AgentError("Steam added the devkit entry but didn't save it")
+    copy_grid_art(pkg, appid)
+    return appid
+
+
+def copy_grid_art(pkg, appid, users=None):
+    """The game's Steam art (portrait, landscape, hero, logo) as grid/<appid>* in every (or the given) account."""
    anchor = os.path.join(ANCHORS, pkg)
-    for user in steam_users():
+    for user in users if users is not None else steam_users():
        grid = os.path.join(STEAM, "userdata", user, "config/grid")
        os.makedirs(grid, exist_ok=True)
        for kind, suffix in (("portrait", "p"), ("landscape", ""), ("hero", "_hero"), ("logo", "_logo")):
@@ -1331,7 +1367,6 @@ def devkit_register(pkg):
                    if re.match(rf"^{appid}{re.escape(suffix)}\.", os.path.basename(old)):
                        os.remove(old)
                shutil.copy(img, os.path.join(grid, f"{appid}{suffix}{os.path.splitext(img)[1]}"))
-    return appid


 def devkit_unregister(pkg, steam_running=True):
@@ -1383,8 +1418,9 @@ def cmd_launch(args):
        raise AgentError(f"{NOT_IN_LIBRARY}: {dep.get('title') or pkg}")
    steam = steam_launch(appid, args.get("wait", 10))
    out = {"package": pkg, "gameid": steam_gameid(appid), "title": dep.get("title"), "via": via, "steam": steam}
-    if via == "shortcut" and steam["result"] == "error" and steam.get("code") == 9 and args.get("fallback", True):
-        # Steam doesn't know the shortcut at all (it tried to license a store app with that id): devkit entry
+    if steam["result"] == "error" and steam.get("code") == 9 and args.get("fallback", True):
+        # Steam doesn't know the shortcut at all (it tried to license a store app with that id): devkit entry. A devkit
+        # entry Steam never saved is gone after a Steam restart (every install restarts it, GitHub #41): add it again
        try:
            appid = devkit_register(pkg)
        except AgentError as exc:
@@ -3058,7 +3094,7 @@ def cmd_launch_test(args):
        if "Exited!" in text:
            state = "EXITED"
            break
-        if "Early-exit" in text or "is not a running context" in text:
+        if "Early-exit" in text or not_started(text, time.time() - start):
            state = "NEVER_STARTED"
            break
    elapsed = round(time.time() - start)
@@ -3699,6 +3735,14 @@ def dashboard_worker(log, parent, wait_start=240, window=30, poll=0.5, ui_log=No
        time.sleep(poll)


+def not_started(text, waited, grace=30):
+    """Lepton's container didn't come up: "is not a running context" with no "Boot complete!" after it for `grace`
+    seconds. The first start after an APK change prints that message while it waits for the boot and then boots
+    normally (installing the new APK): agent 53 and older stopped those starts after a few seconds."""
+    i = text.rfind("is not a running context")
+    return i >= 0 and "Boot complete!" not in text[i:] and waited >= grace
+
+
 COMMANDS = {n[4:]: f for n, f in globals().items() if n.startswith("cmd_")}


@@ -1,12 +1,14 @@
 48a3ecad77ec0f3215b29070e994590eb9579e04d3c88a47f37f306f9aeb01d9  ./arm64-v8a/libfp_langpack.so
-a5b03bb7ae5d953d7ded2bf117b0a19c57fae604f16f54310847f8e89593dde6  ./arm64-v8a/libfp_ovrp.so
-6d2b9f8cea2f2cf33b8ff30d29a2f3d9c4d55549260a867168a24e44abada021  ./arm64-v8a/libfp_vk.so
-8e00552d1ab90f82749db3caad4f773351fa8a28edcc5ea5cbd1b31c434ff32a  ./arm64-v8a/libframe_xrshim.so
-3dfcb0f2bec47857bcecc7261c58e076d872d4649718c40850f29e10c75477dd  ./arm64-v8a/libglshim.so
-3e05bb8561c7fd8787b3120739b3ce66c68badb5b00571bd50ae7e6c1f159274  ./arm64-v8a/libopenxr_loader_generic.so
+4724254982fa854de2134b15b936cfbd6bd244d51e5d72d5b51b85c60ef67321  ./arm64-v8a/libfp_ovrp.so
+40defdaddcda53bd2649eb48076fae1622bfc2bfc88e9e03c94fc8b45af2a4f2  ./arm64-v8a/libfp_ovrtrace.so
+b5949e9e90e4c51e2733b9f6cd3c857a447552ac7291aec340407c27b034b600  ./arm64-v8a/libfp_vk.so
+383054f8b3b41dde76d062c71856cd3163655e50009c08454bc1793f393ead65  ./arm64-v8a/libfpg.so
+424d8e5cb15608ad627f9415df4c4665efd9358fed3447a5d3765279dc652f6b  ./arm64-v8a/libframe_xrshim.so
+3bfd1261688ed766c0adb9172f44dd7d41cc6459f26205ce3069f536a52e4ab9  ./arm64-v8a/libglshim.so
+abf3533b9d02dc2e10d4849e99d850c2f232b039cc5c8761050bf7e129227c69  ./arm64-v8a/libopenxr_loader_generic.so
 1feaeafad467c4cafdf2b018a4d84b0bee200c3f711697b4ce97e66a3ba256ca  ./arm64-v8a/libovrplatformcompat.so
 32525cd0a9ee3d9993d8871cd6905bdcf22cde4f4ba28f5db6434ce7d6554758  ./arm64-v8a/libvrapi.so
-33bf52994b8024e139af20d6915bc76a0c7341ce9b5bd136a3002236168bcbd1  ./armeabi-v7a/libopenxr_loader_generic.so
+bdfa906442edd83fc272efe6481e7c99260a0304578788bdcdb739afebb7efcf  ./armeabi-v7a/libopenxr_loader_generic.so
 1871eae093432d277da4bc751bf5f3269dfcf11f9168260b0c3caadb0dedb19d  ./dex/oculusos-stubs.dex
 1aa733117cf57ccff7cf23f0425dbfd73b0332a3ef1c905ceeca0ccd0449c4e0  ./linux-arm64/XR_APILAYER_FRAMEPORT_timefix.json
 28c2430a02bbd8902c5bfb9562c6fd0e318654f9e05c095bfeb94b0450ab1b07  ./linux-arm64/libxr_frameport_timefix.so
@@ -0,0 +1,21 @@
+package: com.Aldin.WotW
+title: 'Waltz of the Wizard: Extended Edition'
+status: works
+notes: From what I tested, it just works. My only complaint is that the haptics go pretty crazy. But I don't remember
+  what it was like when I played it in my Quest. So it could be fine. 100% playable.
+tested_version: 5.0.8.1578
+engine: Unity
+xr: OpenXR
+frame:
+- frame.unity_text_input
+device:
+- device.text_input_window
+verified:
+  date: '2026-10-05'
+  known_good_sha256: 522cfebf954e1cab6054798479b0b32c5ba9e38cca83dd98db2ac0f7e3c0802a
+  app: 0.9.1
+  overport_cli: 1.2.5
+  frame_build: '20260922.6101926'
+  agent: 48
+  issue: 44
+source_hint: WotW
@@ -1,13 +1,21 @@
 package: com.CMGames.IntoTheRadius2
 title: Into The Radius 2
-status: issues
-notes: Space warp is turned off (no flickering textures in the headset); the headset's brief focus losses are hidden
-  (focus_hold, up to 2.5 s) because the game pauses on each. Loading a save can take over a minute.
+status: works
+notes: Plays well (owner-verified 2026-10-05). Space warp is off, the headset's brief focus losses are hidden
+  (focus_hold, up to 2.5 s), only Valve's foveation layer is loaded (its render-pass optimizer removed the fog) and
+  an invalid depth resolve in Unreal's render passes is dropped (vk_spec_fixes; it made models flicker and windows
+  show behind them). Needs FramePort 0.10.0 or newer. Loading a save can take over a minute.
 details: Unreal Engine 5 game that uses Meta's Application SpaceWarp (extra motion-vector and depth swapchains). OVRPort's
  patch_disable_space_warp doesn't reach Unreal Engine 5, so FrameBridge's hide_space_warp hides XR_FB_space_warp and
  removes the space warp info from the eye images. Working config shared in GitHub issue 35. In the headset
  (2026-10-05) the Frame dropped focus for 0.4 s and 1.0 s within ten seconds and Unreal paused each time; loading a save
-  shows no frames for 40-80 s while the game's Sentry SDK (debug mode) logs its breadcrumbs.
+  shows no frames for 40-80 s while the game's Sentry SDK (debug mode) logs its breadcrumbs. Valve's VALVE_rpo
+  (render-pass optimizer) Vulkan layer removes the game's fog (owner-verified 2026-10-05; with only VALVE_fdm_injection
+  loaded the fog renders), which also hid the distance culling; ruled out for the remaining pop-in - Vulkan occlusion
+  query slots, Valve's FDM layer. The cause, found with Khronos' validation layer (vk_validation) - Unreal's render
+  passes use Qualcomm's shader resolve (VK_SUBPASS_DESCRIPTION_SHADER_RESOLVE_BIT_QCOM) together with a depth resolve
+  of a single-sampled depth attachment (VUID-VkSubpassDescription2-flags-04908, -03179), harmless on Quest's driver,
+  wrong depth on the Frame's Mesa; the Vulkan shim's vk_spec_fixes drops that resolve.
 tested_version: 1.2.4
 engine: Unreal
 xr: OpenXR
@@ -18,8 +26,11 @@ adapter:
  hide_space_warp: 1
  focus_hold: 1
  focus_hold_ms: 2500
+  vk_spec_fixes: 1
+lepton_env:
+  VK_INSTANCE_LAYERS: VK_LAYER_VALVE_fdm_injection
 verified:
-  date: '2026-10-04'
+  date: '2026-10-05'
  issue: 35
-updated: '2026-10-05'
+min_app: 0.10.0
 source_hint: Into The Radius 2
@@ -0,0 +1,25 @@
+package: com.FireproofStudios.TheRoomVR
+title: The Room VR
+status: works
+notes: Plays normally (it used to stay on a grey screen).
+details: Unity 2018.4 with built-in Oculus support. It started VR only with frame.unity_oculus_check, then Unity's
+  render thread crashed in the GL driver (Zink) when OVROverlay copied a 4x4 fade texture into its overlay layer;
+  frame.unity_no_overlay_copy skips that copy (the fade still works). frame.unity_runtime_msaa_off keeps the eye buffer
+  at one sample (also GitHub issue 38).
+tested_version: '1.02'
+engine: Unity
+xr: VrApi
+frame:
+- frame.unity_no_msaa
+- frame.unity_oculus_check
+- frame.unity_text_input
+- frame.unity_runtime_msaa_off
+- frame.unity_no_overlay_copy
+device:
+- device.text_input_window
+verified:
+  date: '2026-10-05'
+  issue: 38
+updated: '2026-10-05'
+min_app: 0.11.0
+source_hint: The Room VR
@@ -1,13 +1,14 @@
 package: com.NewFolderGames.IAmCat
 title: I Am Cat
-status: issues
-notes: The view vibrates slightly, even when holding still.
+status: works
+notes: Steady view with pose_consistency (the judder is gone).
 details: Unity 2022.3 with the Oculus XR Plugin falls back to GLES (Zink) on the Frame, where its single-pass
  (multiview) rendering drew the right eye wrong (GitHub issue 8); frame.unity_multipass renders each eye in its own
  pass (OculusSettings.GetStereoRenderingMode + its inlined read in OculusLoader.Initialize). Poses and frame times
  are consistent, but every frame reaches the runtime one display period late (two passes on Zink) and the game
-  clamps its physics step to 10 ms, so the view judders; scale 0.8 didn't change it. Possible next steps are fixing the
-  multiview path instead or the game's fixed timestep.
+  clamps its physics step to 10 ms. The judder came from the game locating its views about three times per frame and
+  getting slightly different poses each time; FrameBridge pose_consistency returns the same views for repeated
+  queries of one display time (proposed in GitHub issue 8). The grey right eye on the loading screen is still open.
 tested_version: 1.4.0.0
 engine: Unity
 xr: OpenXR
@@ -16,8 +17,11 @@ frame:
 - frame.unity_multipass
 device:
 - device.text_input_window
+adapter:
+  pose_consistency: 1
 verified:
-  date: '2026-10-03'
+  date: '2026-10-05'
  issue: 8
-updated: '2026-10-04'
+updated: '2026-10-05'
+min_app: 0.11.0
 source_hint: I Am Cat
@@ -0,0 +1,17 @@
+package: com.camouflaj.salmon
+title: Marvel's Iron Man VR
+status: works
+tested_version: 0.1.0-250068
+engine: Unity
+xr: OpenXR
+frame:
+- frame.unity_text_input
+device:
+- device.text_input_window
+verified:
+  date: '2026-10-05'
+  known_good_sha256: 41e0ab90f622afd50accb0b6e2553520d30a6cc82e5ab4cbb2341b48f7316a71
+  app: 0.9.1
+  overport_cli: 1.2.5
+  issue: 47
+source_hint: Marvel's Iron Man VR
@@ -1,17 +1,18 @@
 package: com.crowscrowscrows.AccountingPlus
 title: Accounting+
-status: issues
-notes: Starts in VR, but doesn't get past its "press any button" screen.
+status: works
+notes: Plays normally, including the "press any button" screen after choosing to sit or stand.
 details: Unity 2017.4 built-in Oculus support. frame.unity_oculus_check gets VR started (Meta's system-app check and
-  the frame wait its legacy loop never makes, libfp_ovrp.so), ~72 fps. Controller input reaches the game's OVRInput
-  cleanly (both Touch controllers connected, individual button bits, input focus 1 while focused) but the screen
-  doesn't continue; Cpp2IL can't read this Unity version to see what it waits for.
+  the frame wait its legacy loop never makes, libfp_ovrp.so), ~72 fps. The motion warning after the stance selection
+  waits for a mouse click (Input.GetMouseButtonDown), which a Quest delivers for the controller press and Lepton never
+  does; the same library now counts a newly pressed trigger or A/B/X/Y as that click.
 tested_version: 1.24.35
 engine: Unity
 xr: VrApi
 frame:
 - frame.unity_oculus_check
 verified:
-  date: '2026-10-04'
-updated: '2026-10-04'
+  date: '2026-10-06'
+updated: '2026-10-06'
+min_app: 0.11.0
 source_hint: Accounting+
@@ -1,11 +1,12 @@
 package: com.playful.LuckysTale
 title: Lucky's Tale
-status: issues
-notes: Runs out of memory within a few minutes and freezes the Frame until the game is killed.
-details: Unity's asset loading thread (Loading.PreloadManager) grows the game's native heap by about 1 GB/s
-  shortly after start (10+ GB plus all swap, then the kernel kills it; perf page-fault profile, 2026-10-04). The text
-  window and the MSAA patch aren't the cause (same with the window off); the OBB is byte-identical to the original.
-  The earlier "headset restarted in a menu" reports (GitHub issue 9) were most likely this. No fix yet.
+status: works
+notes: Plays normally; touching a save slot no longer freezes the Frame (haptic_fix).
+details: Touching a save slot vibrates the controller through XR_FB_haptic_amplitude_envelope; OVRPort's OpenXR
+  loader converts that envelope with the duration in nanoseconds read as seconds and allocates an enormous buffer, so
+  the Frame ran out of memory and froze (found by the GitHub issue 9 reporter). FrameBridge's extension shim turns the
+  envelope into a plain vibration before OVRPort's loader sees it (haptic_fix). Brief pauses came from the headset's
+  wear sensor flickering, now hidden by focus_hold (on by default).
 tested_version: 1.0.55
 engine: Unity
 xr: VrApi
@@ -14,8 +15,11 @@ frame:
 - frame.unity_runtime_msaa_off
 device:
 - device.text_input_window
+adapter:
+  haptic_fix: 1
 verified:
-  date: '2026-10-03'
+  date: '2026-10-05'
  issue: 9
-updated: '2026-10-04'
+updated: '2026-10-05'
+min_app: 0.11.0
 source_hint: Luckys Tale
@@ -1,13 +1,18 @@
 package: com.qcxr.qcxr
 title: QuestCraft
-status: issues
-notes: The launcher runs, but Minecraft crashes while starting its graphics (OpenGL error 1282).
+status: works
+notes: Minecraft runs in VR (Vivecraft, about 72 fps; drops while worlds load). Needs FramePort 0.10.0 or newer for
+  the picture (older versions show black). On first start QuestCraft downloads its Java runtime, which didn't unpack on
+  the Frame once (see details).
 details: QuestCraft downloads its Java runtime (JRE.zip from QuestCraft's GitHub releases) into files/runtimes/JRE
-  on first start; on the Frame that step left nothing behind ("libjvm.so not found"). With the runtime unpacked there
-  by hand, Java, Fabric and the mods load and Minecraft 1.21.5 starts initializing, then its first texture fails with
-  OpenGL error 1282 in QuestCraft's GL-to-GLES layer on Zink. Leads (2026-10-04) - Android's libEGL ran out of
-  eglGetProcAddress slots for desktop GL functions; LWJGL and JNA natives in the APK don't match the newer files
-  QuestCraft downloads.
+  on first start; on the Frame that step once left nothing behind ("libjvm.so not found"; unpacked by hand). Two
+  Frame fixes, both owner-verified 2026-10-05. (1) Minecraft 1.21.5 checks GL errors strictly and aborted with
+  "OpenGL error 1282", an error the Frame's Mesa (Zink) reports where Quest's driver doesn't; QuestCraft's GL-to-GLES
+  layer (LTW) ignores GL errors when LIBGL_NOERROR is set, which Lepton passes from LEPTON_ENV_LIBGL_NOERROR. (2) LTW
+  passes desktop GL_DEPTH_COMPONENT32 through, which Mesa rejects, so every framebuffer was incomplete and the picture
+  black; frame.ltw_depth (automatic for APKs with libltw.so) loads GLES through a shim that asks for
+  GL_DEPTH_COMPONENT32F. Left over, harmless so far - Mesa still reports about 4 GL_INVALID_OPERATION per frame
+  ("in glthread", so the call is unknown; mesa_glthread=false would name it).
 tested_version: 6.0.0-RC4
 engine: Unity
 xr: OpenXR
@@ -15,7 +20,9 @@ frame:
 - frame.unity_text_input
 device:
 - device.text_input_window
+lepton_env:
+  LEPTON_ENV_LIBGL_NOERROR: '1'
 verified:
-  date: '2026-10-04'
-updated: '2026-10-04'
+  date: '2026-10-05'
+updated: '2026-10-05'
 source_hint: QuestCraft
@@ -0,0 +1,20 @@
+package: com.resolutiongames.abvriop.santacruz
+title: palazzo_santacruz
+status: works
+notes: Played a few levels. Passthrough also works.
+tested_version: 3.7.6.10866-release
+engine: Unity
+xr: OpenXR
+frame:
+- frame.unity_text_input
+device:
+- device.text_input_window
+verified:
+  date: '2026-10-05'
+  known_good_sha256: 394214a68297c1e5b019dc4f65b145e7bd0e98604205616364e0c151c1afd894
+  app: 0.9.1
+  overport_cli: 1.2.5
+  frame_build: '20260922.6101926'
+  agent: 48
+  issue: 46
+source_hint: abvriop
@@ -3,13 +3,18 @@ title: WiiCompiled VR
 status: issues
 notes: 'To add a game: in FramePort''s Files tab, upload your .wcgame file to this game''s storage, folder
  Android/data/org.wiicompiled.quest/files/WiiCompiledOpenXRVR/Import, then open WiiCompiled (it imports the newest
-  file there; one at a time). The right eye jitters during races.'
+  file there; one at a time). Once your game is imported, turn on "Start straight in VR" (and off "Show the app''s
+  Android window") and update it on the Frame: it then opens in VR without the flat launcher window, which otherwise
+  stays in view (turn it off again to import another game). The right eye jitters during races.'
 details: A native Mario Kart Wii recompilation (needs your own disc as .wcgame files built by the WiiCompiled
  launcher on a computer). Lepton's Android has no document picker, so the launcher's "Import from computer" and
  "select disc image" buttons fail (ActivityNotFoundException for OPEN_DOCUMENT); its Import folder is read when the
  launcher opens instead. The game's libmain.so has its own OpenXR loader and talks to the Frame's runtime directly
  (FrameBridge isn't in its path); the right-eye jitter in races comes from its stereo replay of the race view, so it
-  needs a fix in WiiCompiled itself. The launcher is a flat Android window (shown with lepton-show-flatscreen).
+  needs a fix in WiiCompiled itself. The launcher is a flat Android window (shown with lepton-show-flatscreen) that
+  stays in view after it starts the VR part (QuestActivity, process :game); frame.start_activity makes QuestActivity
+  the start activity (owner-verified 2026-10-05, opens straight in VR), but it skips the launcher's import step, so it
+  stays off by default.
 tested_version: 0.4.0-quest
 engine: Other
 xr: OpenXR
@@ -20,5 +25,5 @@ device:
 - device.text_input_window
 verified:
  date: '2026-10-04'
-updated: '2026-10-04'
+updated: '2026-10-05'
 source_hint: WiiCompiled
@@ -13,6 +13,16 @@ signatures:
    severity: fatal
    diagnosis: 32-bit-only APK. The Steam Frame has no AArch32; this cannot run. Use the PC (Rift) version via Revive.
    suggest: []
+  - id: unity-render-crash
+    pattern: 'CRASH\s*:.*#\d+\s+pc [0-9a-f]+\s+\S*libgallium_dri\.so'
+    severity: fatal
+    diagnosis: Unity's render thread crashed inside the Frame's GL driver (Mesa/Zink); the picture freezes or stays grey. Known triggers - an OVROverlay copy (try "Unity - skip OVROverlay layers", e.g. The Room VR), MSAA switched on at runtime, a GPU hang (zink DEVICE LOST).
+    suggest: [frame.unity_no_overlay_copy, frame.unity_runtime_msaa_off]
+  - id: swapchain-rect-invalid
+    pattern: 'xrEndFrame failed -25\b'
+    severity: fatal
+    diagnosis: The runtime rejects the game's frames because an image rect reaches past its swapchain (by a few pixels on some Frames); the game stops drawing (e.g. stuck at a "Waiting" box). FrameBridge from FramePort 0.11.0 clamps the rects - rebuild and reinstall the game.
+    suggest: [frame.adapter]
  - id: missing-ovr-symbol
    pattern: '(UnsatisfiedLinkError|cannot locate symbol) .*"?(ovr_[A-Za-z0-9_]+|ovrMessageType_ToString)'
    severity: fatal
@@ -106,6 +106,29 @@
 - SSH: `sshd` must be enabled (`sudo systemctl enable --now sshd`), which needs a user password (`passwd`).
 - mDNS: avahi-daemon runs by default; hostname `frame` → `frame.local`.

+## Video of the headset view (surveyed 2026-10-05; used by the Live view tab)
+- `steamvr-v4l2cam.service` (user unit, part of gamescope-session.target, `Restart=always`) runs SteamVR's
+  `/opt/steamvr/bin/linuxarm64/v4l2cam --output=99`: it reads the compositor's "Headset View" (IVRHeadsetView) and
+  writes it to a v4l2loopback webcam named **"SteamVR"** (`/dev/video99`, 1920x1080 RGB24, advertised 30 fps, frames
+  arrive at the display rate). Nothing on the Frame reads it by default; idle it costs nothing, read ~0.2 core.
+  It shows what the wearer sees (SteamVR home, Steam's panels; a game's layers are expected but not yet seen in it).
+  Black and ~1 fps (one frame per ~1.0 s) while the headset sleeps (standby): a 30 fps stream then repeats each
+  frame in bursts, which looks like a stall in a player. Its size follows SteamVR's headset view (v4l2cam has no size
+  option), so the live view only scales down (360p/480p/720p/1080p) or sends it as is ("full").
+- Sound: `pactl get-default-sink` (`alsa_loopback_device.stereo.alsa_output.platform-sound.HiFi__Speaker__sink`) and its
+  `.monitor` source carry what the headset plays; the Frame's ffmpeg has the `pulse` input and `aac`. Timestamps: pulse
+  uses the wall clock, v4l2 CLOCK_MONOTONIC → `-ts mono2abs` on the v4l2 input. Don't force
+  `-use_wallclock_as_timestamps` on the pulse input: it stamped bursts of AAC packets with one time.
+- Steam's own game recording / Remote Play / broadcast capture the **gamescope** PipeWire node (`CDesktopCapturePipeWire:
+  ... node path: gamescope`): with gamescope's `--backend openvr` that's only the flat Steam UI, not VR. Steam's arm64
+  `libvideo.so` encodes with x264 (vaapi/nvenc paths don't apply). No cast/spectator feature for the Frame's own VR view
+  exists in Steam's UI; the SteamVR web server (27062) has no mirror route.
+- Encoding: the Qualcomm encoder (`/dev/video23` qcom-iris-encoder, V4L2 M2M) doesn't work with the stock tools (ffmpeg
+  `h264_v4l2m2m` hangs, gst `v4l2h264enc` not-negotiated). ffmpeg + libx264 works: FramePort's live view
+  (`install/livestream.py`: `fps=30` before the scale, ultrafast/zerolatency, 3 threads, nice 10, fragmented MP4 on
+  stdout, + AAC 128k) measured 0.34 core at 720p / 0.56 at 1080p with a quiet picture (video only); expect ~1-1.4
+  cores with a busy scene.
+
 ## Text input

 - Lepton's Android has no on-screen keyboard (IME) and VR apps run headless, so no Android window has keyboard focus
@@ -7,6 +7,7 @@ Generated from [catalog/games](../catalog/games) by `scripts/compat_list.py`.
 | Game | Platform | Status | Notes |
 |---|---|---|---|
 | 4XVR Video Player | Quest | ✅ Works |  |
+| Accounting+ | Quest | ✅ Works |  |
 | AllInOneSports | Quest | ✅ Works |  |
 | Asgard's Wrath 2 | Quest | ✅ Works |  |
 | BAM | Quest | ✅ Works |  |
@@ -23,19 +24,25 @@ Generated from [catalog/games](../catalog/games) by `scripts/compat_list.py`.
 | Espire 2 | Quest | ✅ Works |  |
 | Genotype | Quest | ✅ Works |  |
 | H.U.N.T | Quest | ✅ Works |  |
+| I Am Cat | Quest | ✅ Works |  |
 | I Am Monkey | Quest | ✅ Works |  |
 | In Death: Unchained | Quest | ✅ Works |  |
+| Into The Radius 2 | Quest | ✅ Works |  |
 | Job Simulator | Quest | ✅ Works |  |
 | Keep Talking and Nobody Explodes | Quest | ✅ Works |  |
 | LEGO® Bricktales | Quest | ✅ Works |  |
+| Lucky's Tale | Quest | ✅ Works |  |
 | Marvel's Deadpool VR | Quest | ✅ Works |  |
+| Marvel's Iron Man VR | Quest | ✅ Works |  |
 | Medieval Dynasty New Settlement | Quest | ✅ Works |  |
 | Mobile Suit Gundam: Silver Phantom | Quest | ✅ Works |  |
 | Nano | Quest | ✅ Works |  |
 | NEX Player | Quest | ✅ Works |  |
 | NOPE CHALLENGE | Quest | ✅ Works |  |
+| palazzo_santacruz | Quest | ✅ Works |  |
 | Path of the Warrior | Quest | ✅ Works |  |
 | PowerWash Simulator VR | Quest | ✅ Works |  |
+| QuestCraft | Quest | ✅ Works |  |
 | Rick and Morty: Virtual Rick-ality | PC VR | ✅ Works |  |
 | Riven | Quest | ✅ Works |  |
 | Robo Recall | Quest | ✅ Works |  |
@@ -44,21 +51,19 @@ Generated from [catalog/games](../catalog/games) by `scripts/compat_list.py`.
 | Stremio | Quest | ✅ Works |  |
 | SUPERHOT VR | PC VR | ✅ Works |  |
 | SUPERHOT VR | Quest | ✅ Works |  |
+| TetrisEffect | Quest | ✅ Works |  |
 | The Climb 2 | Quest | ✅ Works |  |
+| The Room VR | Quest | ✅ Works |  |
 | Toy Master | Quest | ✅ Works |  |
 | Under Cover | Quest | ✅ Works |  |
 | VR4 | Quest | ✅ Works |  |
 | Wallace & Gromit in The Grand Getaway | Quest | ✅ Works |  |
+| Waltz of the Wizard: Extended Edition | Quest | ✅ Works |  |
 | Wander | Quest | ✅ Works |  |
-| Accounting+ | Quest | ⚠️ Works with issues | Starts in VR, but doesn't get past its "press any button" screen. |
 | Arcsmith | Quest | ⚠️ Works with issues | Right eye distorts during movement (unresolved; swap, tracking, Valve layers, depth and pacing ruled out). |
 | Assassin's Creed Nexus | Quest | ⚠️ Works with issues | Some launch warning text is still upside down; the rest of the UI is fixed by flip emulation. |
-| I Am Cat | Quest | ⚠️ Works with issues | The view vibrates slightly, even when holding still. |
-| Into The Radius 2 | Quest | ⚠️ Works with issues | Space warp is turned off (no flickering textures in the headset); the headset's brief focus losses are hidden (focus_hold, up to 2.5 s) because the game paus… |
-| Lucky's Tale | Quest | ⚠️ Works with issues | Runs out of memory within a few minutes and freezes the Frame until the game is killed. |
 | Myst | Quest | ⚠️ Works with issues | Minor graphical glitches on some objects. |
 | Phantom: Covert Ops | Quest | ⚠️ Works with issues | DLC/store button crashes (no Meta store). |
-| QuestCraft | Quest | ⚠️ Works with issues | The launcher runs, but Minecraft crashes while starting its graphics (OpenGL error 1282). |
 | Silhouette | Quest | ⚠️ Works with issues | Hand-tracking game; the Frame synthesizes hands from controllers, so it is janky. |
 | Time Stall | Quest | ⚠️ Works with issues | Both eyes distort during movement (unresolved). |
 | WiiCompiled VR | Quest | ⚠️ Works with issues | To add a game: in FramePort's Files tab, upload your .wcgame file to this game's storage, folder Android/data/org.wiicompiled.quest/files/WiiCompiledOpenXRVR… |
@@ -56,8 +56,11 @@ version is `catalog/triage.yaml` (used by `frameport test` / the Job screen); ke
 | Quest app keeps recentering / snapping the view when you turn your head; log shows session state 5→4→3→4→5 within a second | the Frame briefly takes focus; the app recenters on focus changes | unfixed: hiding the dips (debounce) made AC Nexus stay black, so it was removed |
 | Video player / app finds no local videos; MediaProvider "Requested path /home/steamos/... doesn't appear under ..." | Lepton's /sdcard is a symlink to a host path, so Android's media index rejects every file | upload in the Files tab (Videos = /sdcard/Movies) and browse folders in the app |
 | Batman: Arkham Shadow closes during smoke-bomb effects; later input-tree corruption | Meta XR Audio Wwise deletes queued metadata still referenced by the current audio frame, then writes through the stale pointer | FrameBridge automatically retires metadata after current-frame references disappear, for the verified AArch64 SDK build only; see [AUDIO_METADATA.md](AUDIO_METADATA.md) |
+| Game stays on a loading or "Waiting" box although it reached FOCUSED; log `FrameBridge: xrEndFrame failed -25` then no more `pacing:` lines (e.g. PowerWash Simulator on some Frames, GitHub #39) | The eye image rect ends a few pixels past its swapchain (Unity rounds the swapchain width, the runtime's recommended size differs per Frame); SteamVR rejects every frame with XR_ERROR_SWAPCHAIN_RECT_INVALID | FrameBridge clamps every projection/quad image rect to its swapchain (`rect_clamp`, default on since 0.11.0; log `rect_clamp: view N image rect clamped`): rebuild + reinstall the game |
 | Game (Unity, GLES) freezes, `zink: DEVICE LOST` | multisampled render-to-texture hangs the GPU | `frame.unity_no_msaa`; if it persists: unfixable → PC version |
 | Only the Android home screen shows; the log has Unity's VR device as `None` (e.g. Accounting+, Unity 2017) | Unity 2017–2018 built-in Oculus support starts VR only when `com.oculus.systemactivities` is installed; Lepton has no Meta system apps, so Unity falls back to non-VR | `frame.unity_oculus_check`: that package name in libunity.so → `android`, plus `native/ovrpshim` (libfp_ovrp.so): Unity 2017's legacy frame loop (`ovrp_Update2`/`ovrp_BeginFrame`) never calls `ovrp_WaitToBeginFrame`, so without the shim no `xrWaitFrame` happens, `CompositorOpenXR::Update … outside of frame bounds` floods the log and the dashboard freezes. With it: log `ovrp frame loop shim: waited for frame N`, ~71 fps. Accounting+ then stops at "press any button" although its OVRInput gets clean input (`INPUT_PROBE` in the patch logs connected controllers/buttons/input focus per call) — unresolved |
+| Black flat window, then a GPU hang: kernel `hangcheck detected gpu lockup` (offending task the game), `zink: DEVICE LOST`, Unity render-thread crash; `outside of frame bounds` thousands of times a second (e.g. BattleSisters, Unity 2019.4) | Unity 2019 on its built-in VR (no `libOculusXRPlugin.so`) uses the same legacy frame loop as Unity 2017: no `xrWaitFrame`, the render thread floods the GPU | `frame.unity_oculus_check` adds the ovrpshim frame wait for these too (revision 2) |
+| Unreal game stuck on a loading image after the intro, frames keep coming (72 fps), no crash (e.g. Vader Immortal) | suspect: a Meta Platform SDK request no message ever answers | diagnostics: `frame.ovr_trace` (opt-in) logs every `ovr_*` call, the answers `ovr_PopMessage` returns and every 10 s the unanswered requests (`fp_ovrtrace` in launch.log). Never fake an entitlement answer |
 | Own-engine game crashes in `libVkLayer_fossilize.so` (Fossilize's recording thread, e.g. Roblox) | same as Deadpool VR: uninitialised pointers in what Fossilize records | `frame.vk_sanitize` now also covers own-engine libraries that load `libvulkan.so` by name |
 | Crash right after the game gets focus, in `vrclient.so … UpdateActionStateInternal` / `sxr_xrSyncActions` (e.g. Myst) | a race in the Frame runtime's input code on the first sync after focus (not every launch) | adapter `sync_guard` (input syncs one at a time with event polling, paused 250 ms after FOCUSED) |
 | View jumps sideways / game pauses or freezes for a moment every few seconds (e.g. Blade & Sorcery, BattleGlide) | the Frame drops focus for ~0.5 s (FOCUSED→VISIBLE→SYNCHRONIZED); games pause or re-align the player (`OnVRPresence … Teleport`) | adapter `focus_hold` |
@@ -86,7 +89,7 @@ version is `catalog/triage.yaml` (used by `frameport test` / the Job screen); ke
 | Eye distortion while moving (Arcsmith, Time Stall) | unknown (not eye swap, tracking, Valve layers, depth or pacing) | unresolved |
 | One eye grey / only effects (I Am Cat, Unity Oculus XR Plugin on GLES) | the game's multiview pass draws array slice 1 wrong on Zink | `frame.unity_multipass` (also rewrites the getter's inlined read in `OculusLoader.Initialize`; check for two `array=1` eye swapchains) |
 | View vibrates even when holding still after `frame.unity_multipass` (I Am Cat) | poses/times are consistent, but two passes on Zink make every frame one period late, and the game clamps its physics step to 10 ms | not fixed (scale 0.8 didn't help); next ideas: fix multiview instead, or the game's fixed timestep |
-| Game freezes / pauses for 1-2 s now and then, no flicker; only some games (Blade & Sorcery) | the headset's wear sensor flickers off while worn (SteamVR vrserver.txt `HMD off, stopping eye tracking` … `HMD on`), the Frame turns it into a focus loss and Quest games that pause on focus loss pause | adapter `focus_hold=1` + `focus_hold_ms=2500` per game; native games don't react, so it's per game |
+| Game freezes / pauses for 0.5-2 s now and then, no flicker (e.g. Blade & Sorcery, Lucky's Tale) | the headset's wear sensor flickers off while worn (`logs/eyetracking.txt` `HMD off, stopping eye tracking` … `HMD on`), the Frame turns it into a focus loss and Quest games that pause on focus loss pause | adapter `focus_hold` (on by default since 2026-10-05, dips up to `focus_hold_ms` = 5000 ms are hidden; longer ones still pause) |
 | Minor glitches on some objects (Myst, Unreal Vulkan) | unknown; not application space warp (turning it off changed nothing and ran worse) | unresolved |
 | Graphics crash in vkCreateInstance with pc == fault address, from the game's own Vulkan hooks (BONELAB `libSLZQuestNative`) | a pointer into memory freed with OVRPlugin's pre-init OpenXR instance; not the runtime (vrclient.so) or Fossilize being unloaded (keeping both loaded with RTLD_NODELETE didn't help) | unresolved |
 | Own-engine game crashes in `je_free` from its own library on the first frames (Roblox) | the game frees memory it doesn't own; not the Vulkan shim or the format fallback | unsupported |
@@ -28,21 +28,6 @@ xrAttachSessionActionSets:
    .globl fwd_xrAttachSessionActionSets
    .hidden fwd_xrAttachSessionActionSets
 fwd_xrAttachSessionActionSets:
-    .quad frame_unsupported
-    .text
-    .p2align 2
-    .globl xrBeginFrame
-    .type xrBeginFrame, %function
-xrBeginFrame:
-    adrp x16, fwd_xrBeginFrame
-    ldr x16, [x16, :lo12:fwd_xrBeginFrame]
-    br x16
-    .size xrBeginFrame, .-xrBeginFrame
-    .data
-    .p2align 3
-    .globl fwd_xrBeginFrame
-    .hidden fwd_xrBeginFrame
-fwd_xrBeginFrame:
    .quad frame_unsupported
    .text
    .p2align 2
@@ -403,21 +388,6 @@ xrPathToString:
    .globl fwd_xrPathToString
    .hidden fwd_xrPathToString
 fwd_xrPathToString:
-    .quad frame_unsupported
-    .text
-    .p2align 2
-    .globl xrReleaseSwapchainImage
-    .type xrReleaseSwapchainImage, %function
-xrReleaseSwapchainImage:
-    adrp x16, fwd_xrReleaseSwapchainImage
-    ldr x16, [x16, :lo12:fwd_xrReleaseSwapchainImage]
-    br x16
-    .size xrReleaseSwapchainImage, .-xrReleaseSwapchainImage
-    .data
-    .p2align 3
-    .globl fwd_xrReleaseSwapchainImage
-    .hidden fwd_xrReleaseSwapchainImage
-fwd_xrReleaseSwapchainImage:
    .quad frame_unsupported
    .text
    .p2align 2
@@ -523,20 +493,5 @@ xrSyncActions:
    .globl fwd_xrSyncActions
    .hidden fwd_xrSyncActions
 fwd_xrSyncActions:
-    .quad frame_unsupported
-    .text
-    .p2align 2
-    .globl xrWaitSwapchainImage
-    .type xrWaitSwapchainImage, %function
-xrWaitSwapchainImage:
-    adrp x16, fwd_xrWaitSwapchainImage
-    ldr x16, [x16, :lo12:fwd_xrWaitSwapchainImage]
-    br x16
-    .size xrWaitSwapchainImage, .-xrWaitSwapchainImage
-    .data
-    .p2align 3
-    .globl fwd_xrWaitSwapchainImage
-    .hidden fwd_xrWaitSwapchainImage
-fwd_xrWaitSwapchainImage:
    .quad frame_unsupported
    .section .note.GNU-stack,"",%progbits
@@ -1,7 +1,6 @@
 // Generated from overport 3.4.3 libopenxr_loader_generic.so exports minus hooked functions.
 FORWARD(xrApplyHapticFeedback)
 FORWARD(xrAttachSessionActionSets)
-FORWARD(xrBeginFrame)
 FORWARD(xrBeginSession)
 FORWARD(xrCreateAction)
 FORWARD(xrCreateActionSet)
@@ -26,7 +25,6 @@ FORWARD(xrGetReferenceSpaceBoundsRect)
 FORWARD(xrGetSystem)
 FORWARD(xrGetViewConfigurationProperties)
 FORWARD(xrPathToString)
-FORWARD(xrReleaseSwapchainImage)
 FORWARD(xrRequestExitSession)
 FORWARD(xrResultToString)
 FORWARD(xrStopHapticFeedback)
@@ -34,4 +32,3 @@ FORWARD(xrStringToPath)
 FORWARD(xrStructureTypeToString)
 FORWARD(xrSuggestInteractionProfileBindings)
 FORWARD(xrSyncActions)
-FORWARD(xrWaitSwapchainImage)
@@ -34,23 +34,6 @@ xrAttachSessionActionSets:
    .globl fwd_xrAttachSessionActionSets
    .hidden fwd_xrAttachSessionActionSets
 fwd_xrAttachSessionActionSets:
-    .word frame_unsupported
-    .text
-    .p2align 2
-    .globl xrBeginFrame
-    .type xrBeginFrame, %function
-xrBeginFrame:
-    ldr ip, 1f
-2:  add ip, pc, ip
-    ldr ip, [ip]
-    bx ip
-1:  .word fwd_xrBeginFrame - (2b + 8)
-    .size xrBeginFrame, .-xrBeginFrame
-    .data
-    .p2align 2
-    .globl fwd_xrBeginFrame
-    .hidden fwd_xrBeginFrame
-fwd_xrBeginFrame:
    .word frame_unsupported
    .text
    .p2align 2
@@ -459,23 +442,6 @@ xrPathToString:
    .globl fwd_xrPathToString
    .hidden fwd_xrPathToString
 fwd_xrPathToString:
-    .word frame_unsupported
-    .text
-    .p2align 2
-    .globl xrReleaseSwapchainImage
-    .type xrReleaseSwapchainImage, %function
-xrReleaseSwapchainImage:
-    ldr ip, 1f
-2:  add ip, pc, ip
-    ldr ip, [ip]
-    bx ip
-1:  .word fwd_xrReleaseSwapchainImage - (2b + 8)
-    .size xrReleaseSwapchainImage, .-xrReleaseSwapchainImage
-    .data
-    .p2align 2
-    .globl fwd_xrReleaseSwapchainImage
-    .hidden fwd_xrReleaseSwapchainImage
-fwd_xrReleaseSwapchainImage:
    .word frame_unsupported
    .text
    .p2align 2
@@ -595,22 +561,5 @@ xrSyncActions:
    .globl fwd_xrSyncActions
    .hidden fwd_xrSyncActions
 fwd_xrSyncActions:
-    .word frame_unsupported
-    .text
-    .p2align 2
-    .globl xrWaitSwapchainImage
-    .type xrWaitSwapchainImage, %function
-xrWaitSwapchainImage:
-    ldr ip, 1f
-2:  add ip, pc, ip
-    ldr ip, [ip]
-    bx ip
-1:  .word fwd_xrWaitSwapchainImage - (2b + 8)
-    .size xrWaitSwapchainImage, .-xrWaitSwapchainImage
-    .data
-    .p2align 2
-    .globl fwd_xrWaitSwapchainImage
-    .hidden fwd_xrWaitSwapchainImage
-fwd_xrWaitSwapchainImage:
    .word frame_unsupported
    .section .note.GNU-stack,"",%progbits
@@ -86,8 +86,15 @@ static int foveation_fix = 1;
 // hide XR_FB_space_warp: games then render every frame themselves (UE5 Application SpaceWarp flickered on the Frame,
 // e.g. Into The Radius 2; OVRPort's patch_disable_space_warp doesn't reach UE5's OpenXR plugin)
 static int hide_space_warp = 0;
+static int strip_color_bias = 0;
+static int frame_balance = 0;  // end a still-open frame before the next xrBeginFrame
+static int frame_begins, frame_discarded, frame_ends, frame_balanced;  // per pacing period (layer_debug)
+static int frame_open;
+static int sc_acquires, sc_waits, sc_releases, sc_wait_fails;  // per pacing period (layer_debug)  // drop XrCompositionLayerColorScaleBiasKHR (the runtime's color pass)
 static int controller_fix = 1;
 static int swapchain_fix = 1;
+static int rect_clamp = 1;
+static int pose_consistency = 0;  // repeat xrLocateViews queries for one display time get the same poses (GitHub #8)  // clamp submitted image rects to their swapchain (SteamVR rejects a 1 px overrun)
 static int layer_fix = 1;
 static int mutable_fix = 0;
 static int swap_eyes = 0;
@@ -112,8 +119,8 @@ static int sync_guard;       // xrSyncActions one at a time with xrPollEvent, pa
 static int profile_remap = 1; // Meta's newer controller profiles (rejected by the Frame) -> oculus/touch_controller
 static int layer_debug;      // diagnostics: layers, swapchains, session states, spaces, aim/grip, refresh rates
 static int stable_local;     // keep every LOCAL space the app creates on the session-start origin
-static int focus_hold;       // hide brief focus dips once the session has been focused for a while
-static float focus_hold_ms = 1000;  // longest focus dip focus_hold hides
+static int focus_hold = 1;   // hide brief focus dips once the session has been focused for a while
+static float focus_hold_ms = 5000;  // longest focus dip focus_hold hides
 static float aim_pitch, aim_yaw, aim_forward;  // aim pose correction (degrees, degrees, metres)
 static float refresh_rate;   // requested display refresh rate (Hz), 0 = the app's choice
 static int equirect_emul;    // show 360 layers as cube faces (GLES)
@@ -134,8 +141,12 @@ static void read_settings(const char *path) {
        if (sscanf(line, "scale=%f", &value) == 1 && value >= 0.5f && value <= 2.0f) scale = value;
        if (sscanf(line, "foveation_fix=%f", &value) == 1) foveation_fix = value != 0;
        if (sscanf(line, "hide_space_warp=%f", &value) == 1) hide_space_warp = value != 0;
+        if (sscanf(line, "strip_color_bias=%f", &value) == 1) strip_color_bias = (int)value;
+        if (sscanf(line, "frame_balance=%f", &value) == 1) frame_balance = value != 0;
        if (sscanf(line, "controller_fix=%f", &value) == 1) controller_fix = value != 0;
        if (sscanf(line, "swapchain_fix=%f", &value) == 1) swapchain_fix = value != 0;
+        if (sscanf(line, "rect_clamp=%f", &value) == 1) rect_clamp = value != 0;
+        if (sscanf(line, "pose_consistency=%f", &value) == 1) pose_consistency = value != 0;
        if (sscanf(line, "layer_fix=%f", &value) == 1) layer_fix = value != 0;
        if (sscanf(line, "mutable_fix=%f", &value) == 1) mutable_fix = value != 0;
        if (sscanf(line, "swap_eyes=%f", &value) == 1) swap_eyes = value != 0;
@@ -210,6 +221,8 @@ static void initialize(void) {
        log_file = fopen(path, "a");
    }
    if (hide_space_warp) LOG("per-game: hide_space_warp=1 (XR_FB_space_warp hidden, space warp info removed)");
+    if (strip_color_bias) LOG("per-game: strip_color_bias=%d (layer color scale/bias removed)", strip_color_bias);
+    if (frame_balance) LOG("per-game: frame_balance=1 (an open frame is ended before the next one begins)");
    if (eye_debug || release_wait) LOG("per-game: eye_debug=%d release_wait=%d log_file=%s", eye_debug, release_wait,
                                       log_file ? path : "none");
    if (controller_models && *process && !strchr(process, '/')) render_model_init(process);
@@ -390,6 +403,45 @@ static void remember_swapchain(XrSwapchain handle) {
    pthread_mutex_unlock(&swapchains_lock);
 }

+// Swapchain sizes, to keep submitted image rects inside them (rect_clamp).
+#define MAX_SIZES 256
+static struct { XrSwapchain handle; uint32_t w, h; } sizes[MAX_SIZES];
+static pthread_mutex_t sizes_lock = PTHREAD_MUTEX_INITIALIZER;
+
+static void note_swapchain_size(XrSwapchain handle, uint32_t w, uint32_t h) {
+    pthread_mutex_lock(&sizes_lock);
+    int slot = -1;
+    for (int i = 0; i < MAX_SIZES; ++i) {
+        if (sizes[i].handle == handle) { slot = i; break; }
+        if (slot < 0 && sizes[i].handle == XR_NULL_HANDLE) slot = i;
+    }
+    if (slot >= 0) { sizes[slot].handle = handle; sizes[slot].w = w; sizes[slot].h = h; }
+    pthread_mutex_unlock(&sizes_lock);
+}
+
+static int swapchain_size(XrSwapchain handle, uint32_t *w, uint32_t *h) {
+    int found = 0;
+    pthread_mutex_lock(&sizes_lock);
+    for (int i = 0; i < MAX_SIZES && !found; ++i)
+        if (sizes[i].handle == handle && handle != XR_NULL_HANDLE) { *w = sizes[i].w; *h = sizes[i].h; found = 1; }
+    pthread_mutex_unlock(&sizes_lock);
+    return found;
+}
+
+// Clamp `r` to a w x h image; returns whether it changed.
+static int clamp_rect(XrRect2Di *r, uint32_t w, uint32_t h) {
+    XrRect2Di c = *r;
+    if (c.offset.x < 0) { c.extent.width += c.offset.x; c.offset.x = 0; }
+    if (c.offset.y < 0) { c.extent.height += c.offset.y; c.offset.y = 0; }
+    if ((uint32_t)c.offset.x >= w || (uint32_t)c.offset.y >= h) return 0;  // nothing sensible to keep: leave it
+    if ((int64_t)c.offset.x + c.extent.width > (int64_t)w) c.extent.width = (int32_t)(w - (uint32_t)c.offset.x);
+    if ((int64_t)c.offset.y + c.extent.height > (int64_t)h) c.extent.height = (int32_t)(h - (uint32_t)c.offset.y);
+    if (c.extent.width <= 0 || c.extent.height <= 0) return 0;
+    int changed = memcmp(&c, r, sizeof c) != 0;
+    *r = c;
+    return changed;
+}
+
 static void forget_swapchain(XrSwapchain handle) {
    pthread_mutex_lock(&swapchains_lock);
    for (size_t i = 0; i < swapchain_count; ++i)
@@ -439,6 +491,7 @@ XRAPI_ATTR XrResult XRAPI_CALL xrCreateSwapchain(XrSession session, const XrSwap
        (unsigned long long)fixed.usageFlags, (unsigned long long)fixed.createFlags, result);
    if (XR_SUCCEEDED(result)) {
        remember_swapchain(*swapchain);
+        note_swapchain_size(*swapchain, fixed.width, fixed.height);
        flip_on_create_swapchain(*swapchain, &fixed);
        emul_on_create_swapchain(*swapchain, &fixed);
        return result;
@@ -461,6 +514,7 @@ XRAPI_ATTR XrResult XRAPI_CALL xrCreateSwapchain(XrSession session, const XrSwap
    }
    if (XR_SUCCEEDED(result)) {
        remember_swapchain(*swapchain);
+        note_swapchain_size(*swapchain, fixed.width, fixed.height);
        flip_on_create_swapchain(*swapchain, &fixed);
        emul_on_create_swapchain(*swapchain, &fixed);
    }
@@ -470,6 +524,10 @@ XRAPI_ATTR XrResult XRAPI_CALL xrCreateSwapchain(XrSession session, const XrSwap
 XRAPI_ATTR XrResult XRAPI_CALL xrDestroySwapchain(XrSwapchain swapchain) {
    PFN_xrDestroySwapchain fn = (PFN_xrDestroySwapchain)lookup(active_instance, "xrDestroySwapchain");
    if (!fn) return XR_ERROR_FUNCTION_UNSUPPORTED;
+    if (layer_debug) {
+        static int logged;
+        if (logged++ < 200) LOG("layer_debug: xrDestroySwapchain %p", (void *)swapchain);
+    }
    forget_swapchain(swapchain);
    surf_on_destroy(swapchain);
    flip_on_destroy(swapchain);
@@ -755,6 +813,23 @@ XRAPI_ATTR XrResult XRAPI_CALL xrEnumerateSwapchainImages(XrSwapchain swapchain,
    return result;
 }

+// counted for layer_debug (an app that skips the wait or release keeps runtime resources alive)
+XRAPI_ATTR XrResult XRAPI_CALL xrWaitSwapchainImage(XrSwapchain swapchain, const XrSwapchainImageWaitInfo *info) {
+    PFN_xrWaitSwapchainImage fn = (PFN_xrWaitSwapchainImage)lookup(active_instance, "xrWaitSwapchainImage");
+    if (!fn) return XR_ERROR_FUNCTION_UNSUPPORTED;
+    XrResult result = fn(swapchain, info);
+    __atomic_add_fetch(&sc_waits, 1, __ATOMIC_RELAXED);
+    if (result != XR_SUCCESS) __atomic_add_fetch(&sc_wait_fails, 1, __ATOMIC_RELAXED);
+    return result;
+}
+
+XRAPI_ATTR XrResult XRAPI_CALL xrReleaseSwapchainImage(XrSwapchain swapchain, const XrSwapchainImageReleaseInfo *info) {
+    PFN_xrReleaseSwapchainImage fn = (PFN_xrReleaseSwapchainImage)lookup(active_instance, "xrReleaseSwapchainImage");
+    if (!fn) return XR_ERROR_FUNCTION_UNSUPPORTED;
+    __atomic_add_fetch(&sc_releases, 1, __ATOMIC_RELAXED);
+    return fn(swapchain, info);
+}
+
 XRAPI_ATTR XrResult XRAPI_CALL xrAcquireSwapchainImage(XrSwapchain swapchain, const XrSwapchainImageAcquireInfo *info,
        uint32_t *index) {
    PFN_xrAcquireSwapchainImage fn = (PFN_xrAcquireSwapchainImage)lookup(active_instance, "xrAcquireSwapchainImage");
@@ -766,6 +841,7 @@ XRAPI_ATTR XrResult XRAPI_CALL xrAcquireSwapchainImage(XrSwapchain swapchain, co
        return XR_SUCCESS;
    }
    XrResult result = fn(swapchain, info, index);
+    __atomic_add_fetch(&sc_acquires, 1, __ATOMIC_RELAXED);
    if (XR_SUCCEEDED(result) && index) { flip_on_acquire(swapchain, *index); emul_on_acquire(swapchain, *index); }
    return result;
 }
@@ -869,11 +945,69 @@ XRAPI_ATTR XrResult XRAPI_CALL xrWaitFrame(XrSession session, const XrFrameWaitI
    return result;
 }

+// pose_consistency (GitHub #8, proposed by Klownicle for I Am Cat): the game asks xrLocateViews ~3 times per frame
+// for the same display time and got slightly different poses each time (tenths of a degree), so parts of its pipeline
+// rendered with different heads: judder. The first fully tracked answer for (session, space, view configuration,
+// display time) is kept and repeated; a new display time, another space or a failed/untracked answer is never cached.
+#define POSE_CACHE 8
+static struct {
+    XrSession session; XrSpace space; XrViewConfigurationType config; XrTime time;
+    XrViewStateFlags flags; uint32_t count; XrPosef pose[2]; XrFovf fov[2];
+} pose_cache[POSE_CACHE];
+static int pose_cache_next, pose_cache_hits;
+static pthread_mutex_t pose_cache_lock = PTHREAD_MUTEX_INITIALIZER;
+#define POSE_TRACKED (XR_VIEW_STATE_ORIENTATION_VALID_BIT | XR_VIEW_STATE_POSITION_VALID_BIT | \
+                      XR_VIEW_STATE_ORIENTATION_TRACKED_BIT | XR_VIEW_STATE_POSITION_TRACKED_BIT)
+
+static int pose_cache_lookup(XrSession session, const XrViewLocateInfo *info, XrViewState *state, uint32_t capacity,
+                             uint32_t *count, XrView *views) {
+    int hit = 0;
+    pthread_mutex_lock(&pose_cache_lock);
+    for (int i = 0; i < POSE_CACHE && !hit; ++i) {
+        if (pose_cache[i].session != session || pose_cache[i].space != info->space ||
+            pose_cache[i].config != info->viewConfigurationType || pose_cache[i].time != info->displayTime ||
+            !pose_cache[i].count || capacity < pose_cache[i].count)
+            continue;
+        state->viewStateFlags = pose_cache[i].flags;
+        *count = pose_cache[i].count;
+        for (uint32_t v = 0; v < pose_cache[i].count; ++v) {  // only the values: the caller's type/next stay
+            views[v].pose = pose_cache[i].pose[v];
+            views[v].fov = pose_cache[i].fov[v];
+        }
+        hit = 1;
+    }
+    if (hit && pose_cache_hits++ == 0) LOG("pose_consistency: repeated query answered with the frame's first poses");
+    pthread_mutex_unlock(&pose_cache_lock);
+    return hit;
+}
+
+static void pose_cache_store(XrSession session, const XrViewLocateInfo *info, const XrViewState *state,
+                             uint32_t count, const XrView *views) {
+    if (count == 0 || count > 2 || (state->viewStateFlags & POSE_TRACKED) != POSE_TRACKED) return;
+    pthread_mutex_lock(&pose_cache_lock);
+    int slot = pose_cache_next;
+    pose_cache_next = (pose_cache_next + 1) % POSE_CACHE;
+    pose_cache[slot].session = session;
+    pose_cache[slot].space = info->space;
+    pose_cache[slot].config = info->viewConfigurationType;
+    pose_cache[slot].time = info->displayTime;
+    pose_cache[slot].flags = state->viewStateFlags;
+    pose_cache[slot].count = count;
+    for (uint32_t v = 0; v < count; ++v) {
+        pose_cache[slot].pose[v] = views[v].pose;
+        pose_cache[slot].fov[v] = views[v].fov;
+    }
+    pthread_mutex_unlock(&pose_cache_lock);
+}
+
 XRAPI_ATTR XrResult XRAPI_CALL xrLocateViews(XrSession session, const XrViewLocateInfo *info, XrViewState *state,
        uint32_t capacity, uint32_t *count, XrView *views) {
    PFN_xrLocateViews fn = (PFN_xrLocateViews)lookup(active_instance, "xrLocateViews");
    if (!fn) return XR_ERROR_FUNCTION_UNSUPPORTED;
+    int cacheable = pose_consistency && info && state && count && views && capacity > 0;
+    if (cacheable && pose_cache_lookup(session, info, state, capacity, count, views)) return XR_SUCCESS;
    XrResult result = fn(session, info, state, capacity, count, views);
+    if (cacheable && result == XR_SUCCESS) pose_cache_store(session, info, state, *count, views);
    if (equirect_emul && XR_SUCCEEDED(result) && info && count && views && state &&
        (state->viewStateFlags & XR_VIEW_STATE_ORIENTATION_VALID_BIT))
        emul_on_locate_views(info->space, info->displayTime, *count < capacity ? *count : capacity, views);
@@ -916,9 +1050,39 @@ XRAPI_ATTR XrResult XRAPI_CALL xrLocateViews(XrSession session, const XrViewLoca
    return result;
 }

+// xrBeginFrame: counted for layer_debug. A game that begins a new frame while the previous one is still open
+// (never ended) makes the runtime discard it; the Frame's runtime then never recycles that frame's GPU timing
+// command buffer (Vader Immortal: ~430 GPU mappings / 20 MB a second). frame_balance ends the open frame first,
+// with no layers, as the runtime expects.
+static XrTime last_begin_display_time;
+XRAPI_ATTR XrResult XRAPI_CALL xrBeginFrame(XrSession session, const XrFrameBeginInfo *info) {
+    PFN_xrBeginFrame fn = (PFN_xrBeginFrame)lookup(active_instance, "xrBeginFrame");
+    if (!fn) return XR_ERROR_FUNCTION_UNSUPPORTED;
+    if (frame_open && frame_balance) {
+        PFN_xrEndFrame end = (PFN_xrEndFrame)lookup(active_instance, "xrEndFrame");
+        XrFrameEndInfo empty = {XR_TYPE_FRAME_END_INFO, NULL, last_begin_display_time ? last_begin_display_time
+                                                                                        : last_predicted_time,
+                                XR_ENVIRONMENT_BLEND_MODE_OPAQUE, 0, NULL};
+        XrResult r = end ? end(session, &empty) : XR_ERROR_FUNCTION_UNSUPPORTED;
+        static int logged;
+        if (logged++ < 3) LOG("frame_balance: ended an open frame before xrBeginFrame (result %d)", r);
+        __atomic_add_fetch(&frame_balanced, 1, __ATOMIC_RELAXED);
+    }
+    XrResult result = fn(session, info);
+    __atomic_add_fetch(&frame_begins, 1, __ATOMIC_RELAXED);
+    if (result == XR_FRAME_DISCARDED) __atomic_add_fetch(&frame_discarded, 1, __ATOMIC_RELAXED);
+    if (XR_SUCCEEDED(result)) {
+        frame_open = 1;
+        last_begin_display_time = last_predicted_time;
+    }
+    return result;
+}
+
 XRAPI_ATTR XrResult XRAPI_CALL xrEndFrame(XrSession session, const XrFrameEndInfo *info) {
    PFN_xrEndFrame fn = (PFN_xrEndFrame)lookup(active_instance, "xrEndFrame");
    if (!fn) return XR_ERROR_FUNCTION_UNSUPPORTED;
+    frame_open = 0;
+    __atomic_add_fetch(&frame_ends, 1, __ATOMIC_RELAXED);
    if (eye_debug) eye_debug_end_frame(session, info);
    {   // frame pacing statistics every ~5 s: fps and submitted-vs-predicted display time
        static struct timespec start;
@@ -935,6 +1099,18 @@ XRAPI_ATTR XrResult XRAPI_CALL xrEndFrame(XrSession session, const XrFrameEndInf
        if (elapsed >= 5.0) {
            LOG("pacing: %.1f fps, displayTime vs predicted: avg %.2f ms, max %.2f ms", frames / elapsed,
                drift_sum / (double)frames / 1e6, drift_max / 1e6);
+            if (layer_debug)
+                LOG("layer_debug: swapchain images: %d acquired, %d waited (%d not ok), %d released",
+                    __atomic_exchange_n(&sc_acquires, 0, __ATOMIC_RELAXED),
+                    __atomic_exchange_n(&sc_waits, 0, __ATOMIC_RELAXED),
+                    __atomic_exchange_n(&sc_wait_fails, 0, __ATOMIC_RELAXED),
+                    __atomic_exchange_n(&sc_releases, 0, __ATOMIC_RELAXED));
+            if (layer_debug)
+                LOG("layer_debug: frames: %d xrBeginFrame (%d discarded), %d xrEndFrame, %d balanced",
+                    __atomic_exchange_n(&frame_begins, 0, __ATOMIC_RELAXED),
+                    __atomic_exchange_n(&frame_discarded, 0, __ATOMIC_RELAXED),
+                    __atomic_exchange_n(&frame_ends, 0, __ATOMIC_RELAXED),
+                    __atomic_exchange_n(&frame_balanced, 0, __ATOMIC_RELAXED));
            if (layer_debug)
                LOG("layer_debug: input: %d xrSyncActions (%d ok, last %d), %d bool reads, %d pressed",
                    __atomic_exchange_n(&input_syncs, 0, __ATOMIC_RELAXED),
@@ -1068,6 +1244,48 @@ XRAPI_ATTR XrResult XRAPI_CALL xrEndFrame(XrSession session, const XrFrameEndInf
            if (!logged++) LOG("strip_depth: removed depth info from projection layer");
            ++swapped;
        }
+        {
+            // XR_KHR_composition_layer_color_scale_bias (1000034000) on the layer itself: logged when its values
+            // change (layer_debug); with strip_color_bias the runtime never gets it (Vader Immortal: the Frame's
+            // runtime allocates GPU memory for it every frame and never frees it)
+            const XrBaseInStructure *head = (const XrBaseInStructure *)layer->next;
+            const XrCompositionLayerColorScaleBiasKHR *cb = NULL;
+            for (const XrBaseInStructure *n = head; n; n = n->next)
+                if (n->type == XR_TYPE_COMPOSITION_LAYER_COLOR_SCALE_BIAS_KHR) cb = (const XrCompositionLayerColorScaleBiasKHR *)n;
+            if (cb && layer_debug) {
+                static float last[8] = {-1};
+                float now[8] = {cb->colorScale.r, cb->colorScale.g, cb->colorScale.b, cb->colorScale.a,
+                                cb->colorBias.r, cb->colorBias.g, cb->colorBias.b, cb->colorBias.a};
+                static int logged;
+                if (memcmp(now, last, sizeof(now)) && logged++ < 100) {
+                    LOG("layer_debug: layer type=%d color scale %.2f %.2f %.2f %.2f bias %.2f %.2f %.2f %.2f", layer->type,
+                        now[0], now[1], now[2], now[3], now[4], now[5], now[6], now[7]);
+                    memcpy(last, now, sizeof(now));
+                }
+            }
+            if (cb && strip_color_bias && (layer->type == XR_TYPE_COMPOSITION_LAYER_PROJECTION ||
+                                           layer->type == XR_TYPE_COMPOSITION_LAYER_QUAD)) {
+                const XrBaseInStructure *rest = head;  // skip leading color structs; one further down drops the chain
+                while (rest && rest->type == XR_TYPE_COMPOSITION_LAYER_COLOR_SCALE_BIAS_KHR) rest = rest->next;
+                for (const XrBaseInStructure *n = rest; n; n = n->next)
+                    if (n->type == XR_TYPE_COMPOSITION_LAYER_COLOR_SCALE_BIAS_KHR) rest = NULL;
+                if (strip_color_bias > 1) rest = NULL;  // 2: the layer's whole extension chain (diagnostics)
+                if (layer->type == XR_TYPE_COMPOSITION_LAYER_PROJECTION) {
+                    if (layer != (const XrCompositionLayerBaseHeader *)&projections[count])
+                        projections[count] = *(const XrCompositionLayerProjection *)layer;
+                    projections[count].next = rest;
+                    layer = (const XrCompositionLayerBaseHeader *)&projections[count];
+                } else {
+                    if (layer != (const XrCompositionLayerBaseHeader *)&quads[count])
+                        quads[count] = *(const XrCompositionLayerQuad *)layer;
+                    quads[count].next = rest;
+                    layer = (const XrCompositionLayerBaseHeader *)&quads[count];
+                }
+                static int logged;
+                if (!logged++) LOG("strip_color_bias: removed the color scale/bias from a layer");
+                ++swapped;
+            }
+        }
        if (hide_space_warp && layer->type == XR_TYPE_COMPOSITION_LAYER_PROJECTION &&
            ((const XrCompositionLayerProjection *)layer)->viewCount == 2) {
            // The game may still attach XrCompositionLayerSpaceWarpInfoFB (1000171000) to its views: OVRPort's
@@ -1110,6 +1328,51 @@ XRAPI_ATTR XrResult XRAPI_CALL xrEndFrame(XrSession session, const XrFrameEndInf
            layer = (const XrCompositionLayerBaseHeader *)&projections[count];
            ++swapped;
        }
+        if (rect_clamp) {
+            // Keep every image rect inside its swapchain: Unity/OVRPlugin can size the eye area a few pixels past
+            // the image on some Frames (PowerWash Simulator: rect 268+1656 on a 1920 wide swapchain) and SteamVR
+            // then rejects every frame with XR_ERROR_SWAPCHAIN_RECT_INVALID (-25) (GitHub #39).
+            uint32_t w, h;
+            if (layer->type == XR_TYPE_COMPOSITION_LAYER_PROJECTION &&
+                ((const XrCompositionLayerProjection *)layer)->viewCount <= 2) {
+                const XrCompositionLayerProjection *cur = (const XrCompositionLayerProjection *)layer;
+                int over = 0;
+                for (uint32_t v = 0; v < cur->viewCount; ++v) {
+                    XrRect2Di r = cur->views[v].subImage.imageRect;
+                    if (swapchain_size(cur->views[v].subImage.swapchain, &w, &h) && clamp_rect(&r, w, h)) over = 1;
+                }
+                if (over) {
+                    if (layer != (const XrCompositionLayerBaseHeader *)&projections[count]) projections[count] = *cur;
+                    if (projections[count].views != views[count])
+                        for (uint32_t v = 0; v < cur->viewCount; ++v) views[count][v] = cur->views[v];
+                    for (uint32_t v = 0; v < cur->viewCount; ++v)
+                        if (swapchain_size(views[count][v].subImage.swapchain, &w, &h) &&
+                            clamp_rect(&views[count][v].subImage.imageRect, w, h)) {
+                            static int logged;
+                            if (logged++ < 3)
+                                LOG("rect_clamp: view %u image rect clamped to %dx%d at %d,%d (swapchain %ux%u)", v,
+                                    views[count][v].subImage.imageRect.extent.width,
+                                    views[count][v].subImage.imageRect.extent.height,
+                                    views[count][v].subImage.imageRect.offset.x,
+                                    views[count][v].subImage.imageRect.offset.y, w, h);
+                        }
+                    projections[count].views = views[count];
+                    layer = (const XrCompositionLayerBaseHeader *)&projections[count];
+                    ++swapped;
+                }
+            } else if (layer->type == XR_TYPE_COMPOSITION_LAYER_QUAD) {
+                const XrCompositionLayerQuad *q = (const XrCompositionLayerQuad *)layer;
+                XrRect2Di r = q->subImage.imageRect;
+                if (swapchain_size(q->subImage.swapchain, &w, &h) && clamp_rect(&r, w, h)) {
+                    if (layer != (const XrCompositionLayerBaseHeader *)&quads[count]) quads[count] = *q;
+                    quads[count].subImage.imageRect = r;
+                    layer = (const XrCompositionLayerBaseHeader *)&quads[count];
+                    ++swapped;
+                    static int logged;
+                    if (!logged++) LOG("rect_clamp: quad image rect clamped (swapchain %ux%u)", w, h);
+                }
+            }
+        }
        kept[count++] = layer;
    }
    XrFrameEndInfo fixed = *info;
@@ -1316,6 +1579,7 @@ XRAPI_ATTR XrResult XRAPI_CALL xrGetInstanceProcAddr(XrInstance instance, const
    HOOK(xrCreateSwapchain)
    HOOK(xrDestroySwapchain)
    HOOK(xrEndFrame)
+    HOOK(xrBeginFrame)
    HOOK(xrLocateHandJointsEXT)
    HOOK(xrGetCurrentInteractionProfile)
    HOOK(xrEnumerateInstanceExtensionProperties)
@@ -1332,6 +1596,10 @@ XRAPI_ATTR XrResult XRAPI_CALL xrGetInstanceProcAddr(XrInstance instance, const
    }
    if (surface_emul) HOOK_AS(xrCreateSwapchainAndroidSurfaceKHR, hook_xrCreateSwapchainAndroidSurfaceKHR)
    if (eye_debug || release_wait) HOOK_AS(xrReleaseSwapchainImage, eye_hook_xrReleaseSwapchainImage)
+    if (layer_debug) {  // counters only; every other wait/release hook above takes precedence
+        HOOK(xrWaitSwapchainImage)
+        HOOK(xrReleaseSwapchainImage)
+    }
    if (sync_guard || layer_debug) HOOK_AS(xrSyncActions, hook_xrSyncActions)
    if (layer_debug) HOOK_AS(xrGetActionStateBoolean, hook_xrGetActionStateBoolean)
    if (layer_debug || aim_correction_on() || profile_remap)
@@ -140,7 +140,7 @@ static XRAPI_ATTR XrResult XRAPI_CALL hook_xrGetActionStateBoolean(XrSession ses
 // ---------------------------------------------------------------- focus_hold
 #define FOCUS_HOLD_MIN_FOCUSED_NS 1000000000ll  // only after this long in FOCUSED (start-up transitions untouched;
                                                // 3 s let a 27 ms dip through in Blade & Sorcery)
-// dips longer than focus_hold_ms (setting, default 1000) are delivered (late, in order): taking the headset off or the
+// dips longer than focus_hold_ms (setting, default 5000) are delivered (late, in order): taking the headset off or the
 // system menu must still pause the game. A longer limit is for headsets whose wear sensor flickers ("HMD off" for
 // 0.5-2 s while worn; Blade & Sorcery pauses on each)
 #define FOCUS_HOLD_MAX_DIP_NS ((int64_t)(focus_hold_ms * 1000000.0f))
@@ -10,7 +10,7 @@ timefix OpenXR layer for Proton games (linux-arm64, glibc; the NDK's clang build
 OculusHMDConnected helper for Rift games under Proton (win-x64 PE; the NDK's clang + lld-link, no Windows SDK), and
 rewrites artifacts/SHA256SUMS. Run `frameport parity` afterwards to see which games change.

-    python native/build.py [--only adapter,bridge,compat,langpack,glshim,dex,xrlayer,oculushmd,xrshim,vkshim,ovrpshim,vrsettings] [--ndk PATH]
+    python native/build.py [--only adapter,bridge,compat,langpack,glshim,eglfmt,ovrtrace,dex,xrlayer,oculushmd,xrshim,vkshim,ovrpshim,vrsettings] [--ndk PATH]
 """
 from __future__ import annotations

@@ -239,6 +239,24 @@ def build_glshim(tc: Path):
         "-Wl,-z,max-page-size=16384", "glshim.c", "-ldl", "-llog", "-o", ART / "arm64-v8a/libglshim.so"], cwd=src)


+def build_eglfmt(tc: Path):
+    """Depth-format shim (see glshim/eglfmt.c) that GL-to-GLES wrappers (QuestCraft's LTW) load in place of libEGL.so.
+    Named libfpg.so: no longer than "libEGL.so", whose dlopen string in the wrapper is rewritten in place. Linked to
+    libEGL so a dlsym on its handle still finds every EGL function."""
+    src = HERE / "glshim"
+    run([exe(tc, "aarch64-linux-android29-clang"), "-shared", "-fPIC", "-O2", "-Wall", "-Wextra", "-Werror",
+         "-fvisibility=hidden", "-Wl,-soname,libfpg.so", "-Wl,-z,max-page-size=16384", "eglfmt.c",
+         "-Wl,--no-as-needed", "-lEGL", "-Wl,--as-needed", "-ldl", "-llog", "-o", ART / "arm64-v8a/libfpg.so"], cwd=src)
+
+
+def build_ovrtrace(tc: Path):
+    """Meta Platform SDK tracer (see ovrtrace/ovrtrace.c): diagnostics, the game's engine library loads it first."""
+    src = HERE / "ovrtrace"
+    run([exe(tc, "aarch64-linux-android29-clang"), "-shared", "-fPIC", "-O2", "-Wall", "-Wextra", "-Werror",
+         "-Wl,-soname,libfp_ovrtrace.so", "-Wl,-z,max-page-size=16384", "ovrtrace.c", "-ldl", "-llog",
+         "-o", ART / "arm64-v8a/libfp_ovrtrace.so"], cwd=src)
+
+
 def build_xrshim(tc: Path):
    """FrameBridge extension shim (see xrshim/xrshim.c): DT_NEEDED-injected in front of overport's libopenxr_loader.so."""
    src = HERE / "xrshim"
@@ -308,7 +326,7 @@ def write_sums():

 def main():
    ap = argparse.ArgumentParser()
-    ap.add_argument("--only", default="adapter,bridge,compat,langpack,glshim,dex,xrlayer,oculushmd,xrshim,vkshim,ovrpshim,vrsettings")
+    ap.add_argument("--only", default="adapter,bridge,compat,langpack,glshim,eglfmt,ovrtrace,dex,xrlayer,oculushmd,xrshim,vkshim,ovrpshim,vrsettings")
    ap.add_argument("--ndk")
    args = ap.parse_args()
    parts = set(args.only.split(","))
@@ -317,11 +335,11 @@ def main():
    tc = clang_dir(ndk(args.ndk)) if parts - {"dex"} else None
    steps = {"adapter": lambda: build_adapter(tc), "bridge": lambda: build_bridge(tc), "compat": lambda: build_compat(tc),
             "langpack": lambda: build_langpack(tc),
-             "glshim": lambda: build_glshim(tc), "xrshim": lambda: build_xrshim(tc), "dex": build_dex, "xrlayer": lambda: build_xrlayer(tc),
+             "glshim": lambda: build_glshim(tc), "eglfmt": lambda: build_eglfmt(tc), "ovrtrace": lambda: build_ovrtrace(tc), "xrshim": lambda: build_xrshim(tc), "dex": build_dex, "xrlayer": lambda: build_xrlayer(tc),
             "oculushmd": lambda: build_oculushmd(tc), "vkshim": lambda: build_vkshim(tc),
             "ovrpshim": lambda: build_ovrpshim(tc),
             "vrsettings": lambda: build_vrsettings(tc)}
-    for name in ("adapter", "bridge", "compat", "langpack", "glshim", "xrshim", "vkshim", "ovrpshim", "dex", "xrlayer", "oculushmd", "vrsettings"):
+    for name in ("adapter", "bridge", "compat", "langpack", "glshim", "eglfmt", "ovrtrace", "xrshim", "vkshim", "ovrpshim", "dex", "xrlayer", "oculushmd", "vrsettings"):
        if name in parts:
            log(f"build {name}")
            steps[name]()
@@ -0,0 +1,97 @@
+// SPDX-License-Identifier: GPL-3.0-only
+// FramePort depth-format shim for GL-to-GLES wrappers (QuestCraft's LTW): desktop OpenGL's sized depth format
+// GL_DEPTH_COMPONENT32 doesn't exist in OpenGL ES. Qualcomm's Quest driver accepts it anyway; the Frame's Mesa (Zink)
+// rejects it (GL_INVALID_OPERATION in glTexImage2D), so Minecraft's depth textures never exist, every framebuffer that
+// uses them is incomplete and the picture stays black. LTW resolves every GLES function through eglGetProcAddress from
+// a libEGL it dlopens itself; FramePort points that dlopen string at this library (patches/frame/ltw_depth.py), which
+// hands back wrappers for the texture/renderbuffer allocation functions and the real functions for everything else:
+//   GL_DEPTH_COMPONENT32 -> GL_DEPTH_COMPONENT32F (GL_DEPTH_COMPONENT24 when pixel data comes as GL_UNSIGNED_INT),
+//   unsized GL_DEPTH_COMPONENT with GL_FLOAT data -> GL_DEPTH_COMPONENT32F.
+#define _GNU_SOURCE
+#include <EGL/egl.h>
+#include <GLES3/gl32.h>
+#include <android/log.h>
+#include <dlfcn.h>
+#include <pthread.h>
+#include <string.h>
+
+#define LOG(...) __android_log_print(ANDROID_LOG_INFO, "FrameBridge", __VA_ARGS__)
+#define EXPORT __attribute__((visibility("default")))
+#ifndef GL_DEPTH_COMPONENT32
+#define GL_DEPTH_COMPONENT32 0x81A7
+#endif
+
+typedef __eglMustCastToProperFunctionPointerType FnPtr;
+static FnPtr (*real_gpa)(const char *);
+static pthread_once_t once = PTHREAD_ONCE_INIT;
+static int logged;
+
+static void init(void) {
+    void *egl = dlopen("libEGL.so", RTLD_NOW | RTLD_LOCAL);
+    real_gpa = egl ? (FnPtr (*)(const char *))dlsym(egl, "eglGetProcAddress") : NULL;
+    LOG("depth format shim: libEGL.so %s", real_gpa ? "OK" : "MISSING");
+}
+
+// the ES internal format for a desktop depth request (`type` = the pixel data type, 0 when there is none)
+static GLint fix(GLint internal, GLenum type, const char *fn) {
+    GLint out = internal;
+    if (internal == GL_DEPTH_COMPONENT32) out = type == GL_UNSIGNED_INT ? GL_DEPTH_COMPONENT24 : GL_DEPTH_COMPONENT32F;
+    else if (internal == GL_DEPTH_COMPONENT && type == GL_FLOAT) out = GL_DEPTH_COMPONENT32F;
+    if (out != internal && logged < 8) {
+        logged++;
+        LOG("depth format shim: %s 0x%x -> 0x%x", fn, internal, out);
+    }
+    return out;
+}
+
+static PFNGLTEXIMAGE2DPROC r_ti2;
+static PFNGLTEXIMAGE3DPROC r_ti3;
+static PFNGLTEXSTORAGE2DPROC r_ts2;
+static PFNGLTEXSTORAGE3DPROC r_ts3;
+static PFNGLTEXSTORAGE2DMULTISAMPLEPROC r_ts2ms;
+static PFNGLTEXSTORAGE3DMULTISAMPLEPROC r_ts3ms;
+static PFNGLRENDERBUFFERSTORAGEPROC r_rbs;
+static PFNGLRENDERBUFFERSTORAGEMULTISAMPLEPROC r_rbsms;
+
+static void GL_APIENTRY w_ti2(GLenum t, GLint l, GLint i, GLsizei w, GLsizei h, GLint b, GLenum f, GLenum ty, const void *d) {
+    r_ti2(t, l, fix(i, ty, "glTexImage2D"), w, h, b, f, ty, d);
+}
+static void GL_APIENTRY w_ti3(GLenum t, GLint l, GLint i, GLsizei w, GLsizei h, GLsizei dp, GLint b, GLenum f, GLenum ty,
+                              const void *d) {
+    r_ti3(t, l, fix(i, ty, "glTexImage3D"), w, h, dp, b, f, ty, d);
+}
+static void GL_APIENTRY w_ts2(GLenum t, GLsizei l, GLenum i, GLsizei w, GLsizei h) {
+    r_ts2(t, l, (GLenum)fix((GLint)i, 0, "glTexStorage2D"), w, h);
+}
+static void GL_APIENTRY w_ts3(GLenum t, GLsizei l, GLenum i, GLsizei w, GLsizei h, GLsizei d) {
+    r_ts3(t, l, (GLenum)fix((GLint)i, 0, "glTexStorage3D"), w, h, d);
+}
+static void GL_APIENTRY w_ts2ms(GLenum t, GLsizei s, GLenum i, GLsizei w, GLsizei h, GLboolean fl) {
+    r_ts2ms(t, s, (GLenum)fix((GLint)i, 0, "glTexStorage2DMultisample"), w, h, fl);
+}
+static void GL_APIENTRY w_ts3ms(GLenum t, GLsizei s, GLenum i, GLsizei w, GLsizei h, GLsizei d, GLboolean fl) {
+    r_ts3ms(t, s, (GLenum)fix((GLint)i, 0, "glTexStorage3DMultisample"), w, h, d, fl);
+}
+static void GL_APIENTRY w_rbs(GLenum t, GLenum i, GLsizei w, GLsizei h) {
+    r_rbs(t, (GLenum)fix((GLint)i, 0, "glRenderbufferStorage"), w, h);
+}
+static void GL_APIENTRY w_rbsms(GLenum t, GLsizei s, GLenum i, GLsizei w, GLsizei h) {
+    r_rbsms(t, s, (GLenum)fix((GLint)i, 0, "glRenderbufferStorageMultisample"), w, h);
+}
+
+EXPORT FnPtr eglGetProcAddress(const char *name) {
+    pthread_once(&once, init);
+    FnPtr fn = real_gpa && name ? real_gpa(name) : NULL;
+    if (!fn) return fn;
+#define WRAP(sym, real, w) if (!strcmp(name, sym)) { real = (void *)fn; return (FnPtr)w; }
+    WRAP("glTexImage2D", r_ti2, w_ti2)
+    WRAP("glTexImage3D", r_ti3, w_ti3)
+    WRAP("glTexStorage2D", r_ts2, w_ts2)
+    WRAP("glTexStorage3D", r_ts3, w_ts3)
+    WRAP("glTexStorage2DMultisample", r_ts2ms, w_ts2ms)
+    WRAP("glTexStorage3DMultisample", r_ts3ms, w_ts3ms)
+    WRAP("glRenderbufferStorage", r_rbs, w_rbs)
+    WRAP("glRenderbufferStorageMultisample", r_rbsms, w_rbsms)
+#undef WRAP
+    return fn;
+}
@@ -13,9 +13,14 @@

 #define LOG(...) __android_log_print(ANDROID_LOG_INFO, "GLShim", __VA_ARGS__)

-static const char *const hidden[] = {
+static const char *const hidden_multiview[] = {
    "GL_OVR_multiview", "GL_OVR_multiview2", "GL_OVR_multiview_multisampled_render_to_texture",
+};
+// multisampled render-to-texture: Unity renders a runtime MSAA eye buffer through it, which crashes Zink (SIGSEGV in
+// libgallium_dri.so, e.g. The Room VR); hidden, Unity uses an ordinary MSAA renderbuffer + resolve
+static const char *const hidden_msrtt[] = {
    "GL_EXT_multisampled_render_to_texture", "GL_EXT_multisampled_render_to_texture2",
+    "GL_OVR_multiview_multisampled_render_to_texture",
 };

 static void *gles;
@@ -25,23 +30,47 @@ static void (*real_glGetIntegerv)(GLenum, GLint *);
 static __eglMustCastToProperFunctionPointerType (*real_eglGetProcAddress)(const char *);
 static pthread_once_t once = PTHREAD_ONCE_INIT;

-static int hide_multiview = 1;
+static int hide_multiview = -1;  // -1: not set (Unity keeps multiview, everything else hides it)
+static int hide_msrtt = 1;

-static void read_conf(void) {
-    char pkg[256] = {0}, path[512];
-    FILE *f = fopen("/proc/self/cmdline", "r");
+static void read_conf_file(const char *path) {
+    FILE *f = fopen(path, "r");
    if (!f) return;
-    size_t n = fread(pkg, 1, sizeof(pkg) - 1, f);
+    char line[256];
+    while (fgets(line, sizeof(line), f)) {
+        if (!strncmp(line, "gl_hide_multiview=", 18)) hide_multiview = atoi(line + 18);
+        if (!strncmp(line, "gl_hide_msrtt=", 14)) hide_msrtt = atoi(line + 14);
+    }
    fclose(f);
-    pkg[n] = 0;
+}
+
+// The same settings sources as FrameBridge, later ones winning: the build's libframe_settings.so (next to this
+// library), the game's framebridge.conf, then FRAMEBRIDGE_CONFIG (Lepton's per-game settings.conf).
+static void read_conf(void) {
+    Dl_info info;
+    char path[600];
+    if (dladdr((void *)read_conf, &info) && info.dli_fname) {
+        const char *slash = strrchr(info.dli_fname, '/');
+        if (slash && slash - info.dli_fname < 500) {
+            snprintf(path, sizeof(path), "%.*s/libframe_settings.so", (int)(slash - info.dli_fname), info.dli_fname);
+            read_conf_file(path);
+        }
+    }
+    char pkg[256] = {0};
+    FILE *f = fopen("/proc/self/cmdline", "r");
+    if (f) {
+        size_t n = fread(pkg, 1, sizeof(pkg) - 1, f);
+        fclose(f);
+        pkg[n] = 0;
+    }
    char *colon = strchr(pkg, ':');
    if (colon) *colon = 0;
-    snprintf(path, sizeof(path), "/sdcard/Android/data/%s/files/framebridge.conf", pkg);
-    if (!(f = fopen(path, "r"))) return;
-    char line[128];
-    while (fgets(line, sizeof(line), f))
-        if (!strncmp(line, "gl_hide_multiview=", 18)) hide_multiview = atoi(line + 18);
-    fclose(f);
+    if (*pkg && !strchr(pkg, '/')) {
+        snprintf(path, sizeof(path), "/sdcard/Android/data/%s/files/framebridge.conf", pkg);
+        read_conf_file(path);
+    }
+    const char *env = getenv("FRAMEBRIDGE_CONFIG");
+    if (env && *env) read_conf_file(env);
 }

 // Logging wrappers for the framebuffer calls engines use for eye buffers.
@@ -306,13 +335,21 @@ static void init(void) {
    real_glGetStringi = gles ? dlsym(gles, "glGetStringi") : NULL;
    real_glGetIntegerv = gles ? dlsym(gles, "glGetIntegerv") : NULL;
    real_eglGetProcAddress = egl ? dlsym(egl, "eglGetProcAddress") : NULL;
-    LOG("GL shim active: hide_multiview=%d", hide_multiview);
+    if (hide_multiview < 0) {  // Unity renders multiview itself and only needs MSRTT hidden
+        void *unity = dlopen("libunity.so", RTLD_NOW | RTLD_NOLOAD);
+        hide_multiview = unity ? 0 : 1;
+        if (unity) dlclose(unity);
+    }
+    LOG("GL shim active: hide_multiview=%d hide_msrtt=%d", hide_multiview, hide_msrtt);
 }

 static int is_hidden(const char *name) {
-    if (!hide_multiview) return 0;
-    for (size_t i = 0; i < sizeof(hidden) / sizeof(hidden[0]); ++i)
-        if (!strcmp(name, hidden[i])) return 1;
+    if (hide_multiview)
+        for (size_t i = 0; i < sizeof(hidden_multiview) / sizeof(hidden_multiview[0]); ++i)
+            if (!strcmp(name, hidden_multiview[i])) return 1;
+    if (hide_msrtt)
+        for (size_t i = 0; i < sizeof(hidden_msrtt) / sizeof(hidden_msrtt[0]); ++i)
+            if (!strcmp(name, hidden_msrtt[i])) return 1;
    return 0;
 }

@@ -38,6 +38,8 @@ static void init(void) {

 #define STEP_RENDER (-1)  // ovrpStep_Render

+static void mouse_click_frame(void);  // below: controller presses as Unity mouse clicks
+
 EXPORT int fpov_Update2(int step, int frame_index, double prediction_seconds) {
    pthread_once(&once, init);
    static int last_waited = -1, logged;
@@ -45,6 +47,7 @@ EXPORT int fpov_Update2(int step, int frame_index, double prediction_seconds) {
        last_waited = frame_index;
        int r = real_wait(frame_index);
        if (logged++ < 3) LOG("ovrp frame loop shim: waited for frame %d: %d", frame_index, r);
+        mouse_click_frame();
    }
    return real_update2 ? real_update2(step, frame_index, prediction_seconds) : -1000;  // ovrpFailure
 }
@@ -116,7 +119,7 @@ static void note_state(const char *which, unsigned int mask, const State *s) {
    while (i < 8 && masks[i].seen && masks[i].mask != mask) i++;
    if (i == 8) return;
    if (!masks[i].seen || masks[i].buttons != s->words[1] || masks[i].connected != s->words[0]) {
-        if (changes++ < 120)
+        if (changes++ < 400)
            LOG("ovrp input: %s(mask 0x%x): connected 0x%x buttons 0x%x touches 0x%x%s", which, mask, s->words[0],
                s->words[1], s->words[2], masks[i].seen ? "" : " (first call with this mask)");
        masks[i].seen = 1;
@@ -140,6 +143,22 @@ EXPORT int fpov_GetControllerState4(unsigned int mask, State *state) {
    pthread_once(&input_once, input_init);
    int r = real_state4 ? real_state4(mask, state) : -1000;
    if (state) {
+        // ovrpControllerState4 continues with 4 floats after the 4 masks: L/R IndexTrigger, L/R HandTrigger. OVRInput
+        // turns them into the trigger/grip buttons at 0.5; log each time one crosses it (per requested mask)
+        const float *axis = (const float *)((const char *)state + 16);
+        static struct { unsigned int mask, bits; } seen[8];
+        static int axis_logs;
+        unsigned int bits = 0;
+        for (int k = 0; k < 4; ++k) bits |= (axis[k] >= 0.5f) << k;
+        int i = 0;
+        while (i < 8 && seen[i].mask && seen[i].mask != mask) i++;
+        if (i < 8 && (!seen[i].mask || seen[i].bits != bits)) {
+            if (seen[i].mask && axis_logs++ < 200)
+                LOG("ovrp input: State4(mask 0x%x) triggers L %.2f R %.2f grips L %.2f R %.2f", mask, axis[0], axis[1],
+                    axis[2], axis[3]);
+            seen[i].mask = mask;
+            seen[i].bits = bits;
+        }
        note_state("State4", mask, state);
        state->words[1] = unstick(state->words[1]);
    }
@@ -193,3 +212,84 @@ EXPORT int fpov_GetAppHasInputFocus(int *has_focus) {
    if (has_focus) *has_focus = 1;
    return 0;  // ovrpSuccess
 }
+
+// ---------------------------------------------------------------- controller presses as mouse clicks
+// Unity 2017-2019 games made for Go/Gear VR-era input wait for Input.GetMouseButtonDown(0/1), which a Quest delivers
+// for the controller's primary press (Accounting+'s "press any button" motion warning checks only that). Lepton runs
+// VR apps without a focused Android window, so no touch/mouse event ever arrives. IL2CPP looks engine functions up by
+// name (il2cpp_resolve_icall) on first use: this registers a replacement for UnityEngine.Input::GetMouseButtonDown
+// that returns Unity's answer, or true in the frame a Touch trigger (>= 0.5) or A/B/X/Y is newly pressed.
+#define MOUSE_ICALL "UnityEngine.Input::GetMouseButtonDown(System.Int32)"
+typedef void (*PFN_AddICall)(const char *name, const void *fn);
+typedef const void *(*PFN_ResolveICall)(const char *name);
+typedef int (*PFN_MouseDown)(int button);
+static PFN_MouseDown real_mouse_down;
+static volatile int click_now;  // set for the frame in which a press began
+
+static int fp_mouse_down(int button) {
+    int real = real_mouse_down ? real_mouse_down(button) : 0;
+    return real || ((button == 0 || button == 1) && click_now);
+}
+
+static void mouse_install(void) {
+    static int tries;
+    if (real_mouse_down || tries > 600) return;  // ~10 s of frames
+    tries++;
+    PFN_AddICall add = (PFN_AddICall)dlsym(RTLD_DEFAULT, "il2cpp_add_internal_call");
+    PFN_ResolveICall resolve = (PFN_ResolveICall)dlsym(RTLD_DEFAULT, "il2cpp_resolve_icall");
+    if (!add || !resolve) {
+        void *il2cpp = dlopen("libil2cpp.so", RTLD_NOW | RTLD_NOLOAD);
+        if (il2cpp) {
+            add = (PFN_AddICall)dlsym(il2cpp, "il2cpp_add_internal_call");
+            resolve = (PFN_ResolveICall)dlsym(il2cpp, "il2cpp_resolve_icall");
+        }
+    }
+    if (!add || !resolve) return;
+    const void *current = resolve(MOUSE_ICALL);
+    if (!current) return;  // Unity hasn't registered its own yet: try again next frame
+    real_mouse_down = (PFN_MouseDown)current;
+    add(MOUSE_ICALL, (const void *)fp_mouse_down);
+    LOG("controller presses count as mouse clicks (%s %s)", MOUSE_ICALL,
+        resolve(MOUSE_ICALL) == (const void *)fp_mouse_down ? "replaced" : "NOT replaced");
+}
+
+static void mouse_click_frame(void) {
+    mouse_install();
+    pthread_once(&input_once, input_init);
+    static int was_pressed;
+    unsigned char raw[512] __attribute__((aligned(16))) = {0};  // ovrpControllerState4 (+ room for newer layouts)
+    int pressed = 0;
+    if (real_state4 && real_state4(0x3, (State *)raw) >= 0) {
+        const unsigned int *w = (const unsigned int *)raw;
+        const float *axis = (const float *)(raw + 16);  // L/R IndexTrigger, L/R HandTrigger
+        pressed = (w[1] & 0x303u) != 0 || axis[0] >= 0.5f || axis[1] >= 0.5f;  // A, B, X, Y or a trigger
+    }
+    click_now = pressed && !was_pressed;
+    was_pressed = pressed;
+}
+
+// ---------------------------------------------------------------- hand nodes
+// Unity's built-in Oculus XR input creates its left/right controller devices (InputDevices.GetDeviceAtXRNode, the
+// Touch buttons and triggers games read through CommonUsages) for the hand nodes OVRPlugin reports as present
+// (ovrp_GetNodePresent). Logged per node; a hand node whose Touch controller is connected counts as present.
+typedef int (*PFN_NodePresent)(int node);
+#define NODE_HAND_LEFT 3
+#define NODE_HAND_RIGHT 4
+
+EXPORT int fpov_GetNodePresent(int node) {
+    static PFN_NodePresent real;
+    static int logged[16];
+    pthread_once(&input_once, input_init);
+    if (!real) {
+        void *ovrp = dlopen("libOVRPlugin.so", RTLD_NOW | RTLD_NOLOAD);
+        if (ovrp) real = (PFN_NodePresent)dlsym(ovrp, "ovrp_GetNodePresent");
+    }
+    int present = real ? real(node) : 0, answer = present;
+    if (!present && (node == NODE_HAND_LEFT || node == NODE_HAND_RIGHT) && real_connected)
+        answer = (real_connected() & (node == NODE_HAND_LEFT ? 0x1u : 0x2u)) != 0;  // LTouch / RTouch
+    if (node >= 0 && node < 16 && logged[node] != (answer ? 2 : 1)) {
+        logged[node] = answer ? 2 : 1;
+        LOG("ovrp node %d present: OVRPlugin %d -> Unity %d", node, present, answer);
+    }
+    return answer;
+}
@@ -0,0 +1,203 @@
+// SPDX-License-Identifier: GPL-3.0-only
+// FramePort Meta Platform SDK tracer (diagnostics, patch frame.ovr_trace): logs the game's ovr_* calls and the
+// messages that answer them, to find a request that never gets an answer (a game waiting forever, e.g. Vader
+// Immortal after its intro). Nothing is answered or changed here: every call goes to the real function.
+//
+// Wiring: this library is the first DT_NEEDED of the game's engine library, so the engine's ovr_* imports resolve to
+// the exports below. Each export is a tiny assembly stub that saves the argument registers (x0-x8, d0-d7), asks
+// trace_before() for the real function (dlsym on the platform loader's handle, which also finds the language-pack
+// library's functions when frame.langpacks is on), calls it with the original registers, then reports the result to
+// trace_after(). Signatures don't matter (functions with more than 8 integer arguments would; the Platform SDK has
+// none). Logcat tag fp_ovrtrace.
+//
+// What is logged: the first calls of every function (argument 0 and the result), every message ovr_PopMessage
+// returns (type, request id, error flag), and every 10 s the request ids no message has answered yet with the
+// function that made them ("request" = a function whose name says it starts one: the result is kept when it looks
+// like a request id and the function isn't an accessor).
+#define _GNU_SOURCE
+#include <android/log.h>
+#include <dlfcn.h>
+#include <pthread.h>
+#include <stdint.h>
+#include <string.h>
+#include <time.h>
+
+#define TAG "fp_ovrtrace"
+#define LOG(...) __android_log_print(ANDROID_LOG_INFO, TAG, __VA_ARGS__)
+
+static const char *const NAMES[] = {
+#define N(name) #name,
+#include "names.inc"
+#undef N
+};
+#define COUNT (sizeof(NAMES) / sizeof(NAMES[0]))
+
+static void *real_fn[COUNT];
+static int calls[COUNT];
+static int is_pop[COUNT], is_request[COUNT];
+static void *loader;
+static pthread_once_t once = PTHREAD_ONCE_INIT;
+static pthread_mutex_t lock = PTHREAD_MUTEX_INITIALIZER;
+
+typedef uint32_t (*get_type_t)(const void *);
+typedef uint64_t (*get_id_t)(const void *);
+typedef _Bool (*is_error_t)(const void *);
+static get_type_t msg_type;
+static get_id_t msg_id;
+static is_error_t msg_error;
+
+#define PENDING 256
+static struct { uint64_t id; int fn; double t; } pending[PENDING];
+static double last_report;
+
+static double now(void) {
+    struct timespec ts;
+    clock_gettime(CLOCK_MONOTONIC, &ts);
+    return ts.tv_sec + ts.tv_nsec * 1e-9;
+}
+
+// accessors read data out of handles; everything else that returns a 64-bit id starts a request
+static int looks_like_request(const char *n) {
+    static const char *const accessors[] = {"ovr_Message_", "Array_", "_Get", "_Is", "_Has", "_Create", "_Destroy",
+                                            "_Set", "_Free", "ovr_PopMessage", "ovr_Platform", "ovr_GetLoggedInUser",
+                                            "ovr_Error_", "Options_", "ovr_Voip_", "ovr_Net_", "ovr_Microphone_"};
+    for (size_t i = 0; i < sizeof(accessors) / sizeof(accessors[0]); ++i)
+        if (strstr(n, accessors[i])) return 0;
+    return 1;
+}
+
+static void init(void) {
+    loader = dlopen("libovrplatformloader.so", RTLD_NOW | RTLD_NOLOAD);
+    if (!loader) loader = dlopen("libovrplatformloader.so", RTLD_NOW);
+    for (size_t i = 0; i < COUNT; ++i) {
+        is_pop[i] = !strcmp(NAMES[i], "ovr_PopMessage");
+        is_request[i] = looks_like_request(NAMES[i]);
+        // "requests" whose names start with Get (e.g. ovr_User_GetLoggedInUser): Area_GetX with an upper-case X
+        const char *u = strchr(NAMES[i] + 4, '_');
+        if (u && !strncmp(u, "_Get", 4) && strncmp(NAMES[i], "ovr_Message_", 12) && !strstr(NAMES[i], "Array_"))
+            is_request[i] = 2;  // maybe: kept only when the result looks like a request id
+    }
+    if (loader) {
+        msg_type = (get_type_t)dlsym(loader, "ovr_Message_GetType");
+        msg_id = (get_id_t)dlsym(loader, "ovr_Message_GetRequestID");
+        msg_error = (is_error_t)dlsym(loader, "ovr_Message_IsError");
+    }
+    LOG("tracer active: %zu functions, platform loader %s", COUNT, loader ? "OK" : "MISSING");
+    last_report = now();
+}
+
+void *fp_trace_before(uint64_t idx, uint64_t arg0) __attribute__((visibility("hidden")));
+void *fp_trace_before(uint64_t idx, uint64_t arg0) {
+    pthread_once(&once, init);
+    if (idx >= COUNT) return NULL;
+    if (!real_fn[idx] && loader) real_fn[idx] = dlsym(loader, NAMES[idx]);
+    int n = __atomic_add_fetch(&calls[idx], 1, __ATOMIC_RELAXED);
+    if (n <= 3 && !is_pop[idx]) LOG("call %s(0x%llx)%s", NAMES[idx], (unsigned long long)arg0,
+                                    real_fn[idx] ? "" : " - not in the loader: returns 0");
+    return real_fn[idx];
+}
+
+static void report_pending(double t) {
+    int shown = 0;
+    for (int i = 0; i < PENDING; ++i) {
+        if (!pending[i].id) continue;
+        if (shown++ < 12)
+            LOG("unanswered after %.0f s: request %llu from %s", t - pending[i].t, (unsigned long long)pending[i].id,
+                NAMES[pending[i].fn]);
+    }
+    if (shown) LOG("%d request(s) without an answer", shown);
+}
+
+uint64_t fp_trace_after(uint64_t idx, uint64_t ret) __attribute__((visibility("hidden")));
+uint64_t fp_trace_after(uint64_t idx, uint64_t ret) {
+    if (idx >= COUNT) return ret;
+    double t = now();
+    pthread_mutex_lock(&lock);
+    if (is_pop[idx]) {
+        if (ret && msg_type && msg_id) {
+            const void *m = (const void *)(uintptr_t)ret;
+            uint64_t id = msg_id(m);
+            int answered = -1;
+            for (int i = 0; i < PENDING; ++i)
+                if (pending[i].id && pending[i].id == id) { answered = pending[i].fn; pending[i].id = 0; break; }
+            LOG("message type=0x%08x request=%llu error=%d%s%s", msg_type(m), (unsigned long long)id,
+                msg_error ? msg_error(m) : -1, answered >= 0 ? " answers " : "", answered >= 0 ? NAMES[answered] : "");
+        }
+    } else {
+        int n = calls[idx];
+        if (n <= 3) LOG("  %s -> 0x%llx", NAMES[idx], (unsigned long long)ret);
+        // request ids are small positive counters; pointers (handles) are large
+        if (is_request[idx] && ret && ret < (1ull << 40)) {
+            for (int i = 0; i < PENDING; ++i)
+                if (!pending[i].id) { pending[i].id = ret; pending[i].fn = (int)idx; pending[i].t = t; break; }
+            if (n <= 20) LOG("request %llu <- %s", (unsigned long long)ret, NAMES[idx]);
+        }
+    }
+    if (t - last_report >= 10.0) {
+        last_report = t;
+        report_pending(t);
+    }
+    pthread_mutex_unlock(&lock);
+    return ret;
+}
+
+// The shared stub: x16 = function index. Saves the argument registers, gets the real function, calls it with them,
+// reports the result. x8 (indirect result) and d0-d7 (float/HFA arguments) are preserved, x0/x1/d0-d3 returned.
+__asm__(
+    ".text\n"
+    ".p2align 2\n"
+    "fp_trace_common:\n"
+    "  stp x29, x30, [sp, #-224]!\n"
+    "  mov x29, sp\n"
+    "  stp x0, x1, [sp, #16]\n"
+    "  stp x2, x3, [sp, #32]\n"
+    "  stp x4, x5, [sp, #48]\n"
+    "  stp x6, x7, [sp, #64]\n"
+    "  stp d0, d1, [sp, #80]\n"
+    "  stp d2, d3, [sp, #96]\n"
+    "  stp d4, d5, [sp, #112]\n"
+    "  stp d6, d7, [sp, #128]\n"
+    "  stp x8, x16, [sp, #144]\n"
+    "  mov x0, x16\n"
+    "  ldr x1, [sp, #16]\n"
+    "  bl fp_trace_before\n"
+    "  str x0, [sp, #160]\n"
+    "  ldp x0, x1, [sp, #16]\n"
+    "  ldp x2, x3, [sp, #32]\n"
+    "  ldp x4, x5, [sp, #48]\n"
+    "  ldp x6, x7, [sp, #64]\n"
+    "  ldp d0, d1, [sp, #80]\n"
+    "  ldp d2, d3, [sp, #96]\n"
+    "  ldp d4, d5, [sp, #112]\n"
+    "  ldp d6, d7, [sp, #128]\n"
+    "  ldr x8, [sp, #144]\n"
+    "  ldr x17, [sp, #160]\n"
+    "  cbz x17, 1f\n"
+    "  blr x17\n"
+    "  b 2f\n"
+    "1:\n"
+    "  mov x0, #0\n"
+    "  mov x1, #0\n"
+    "  movi d0, #0\n"
+    "2:\n"
+    "  stp x0, x1, [sp, #16]\n"
+    "  stp d0, d1, [sp, #80]\n"
+    "  stp d2, d3, [sp, #96]\n"
+    "  ldr x0, [sp, #152]\n"
+    "  ldr x1, [sp, #16]\n"
+    "  bl fp_trace_after\n"
+    "  ldp x0, x1, [sp, #16]\n"
+    "  ldp d0, d1, [sp, #80]\n"
+    "  ldp d2, d3, [sp, #96]\n"
+    "  ldp x29, x30, [sp], #224\n"
+    "  ret\n");
+
+// one exported stub per name: x16 = its index
+#define STR2(x) #x
+#define STR(x) STR2(x)
+static const int dummy_index_base __attribute__((unused)) = 0;
+#define N(name)                                                    \
+    __asm__(".text\n.p2align 2\n.globl " #name "\n.type " #name ", %function\n" #name ":\n" \
+            "  mov x16, #" STR(__COUNTER__) "\n  b fp_trace_common\n");
+#include "names.inc"
+#undef N
@@ -13,6 +13,21 @@
 // copied with extra words inserted at a byte offset, e.g. stores that initialize locals a shader reads before writing
 // (an undefined loop counter hung the GPU in VR4's campaign). Every other module passes through unchanged.
 // Format: vk_shader_fix=<size>:<sha256 hex>:<byte offset>:<word>,<word>,...[;<next fix>]
+//
+// Query slots (adapter setting vk_query_slots=2, per game): with multiview, Vulkan counts a query that runs in a
+// multiview render pass as one query per view (N consecutive indices). Mesa's drivers (the Frame's Turnip) write a
+// zero result into the extra views' slots; Meta's Quest driver doesn't. Engines that allocate one slot per query
+// (Into The Radius 2, Unreal 5) then have the next object's occlusion query overwritten with "0 samples" and cull it:
+// models pop in and out. With the setting, occlusion pools get N slots per query; query i uses slot N*i, so the extra
+// views land in N*i+1.., and results are read from slot N*i only (view 0's count; Turnip counts every view there).
+//
+// Spec fixes (vk_spec_fixes=1, per game; found with the validation layer in Into The Radius 2, Unreal 5):
+//  * depth/stencil images created without VK_IMAGE_USAGE_TRANSFER_DST_BIT are cleared with vkCmdClearDepthStencilImage
+//    (VUID-vkCmdClearDepthStencilImage-pRanges-02659); Mesa's Turnip picks the image's compression from its usage, so
+//    the flag is added at vkCreateImage.
+//  * subpasses with Qualcomm's shader resolve (VK_SUBPASS_DESCRIPTION_SHADER_RESOLVE_BIT_QCOM) also name a depth
+//    resolve attachment for a single-sampled depth attachment (VUID-VkSubpassDescription2-flags-04908, -03179): the
+//    resolve is dropped (there is nothing to resolve from one sample).
 #define _GNU_SOURCE
 #include <vulkan/vulkan.h>
 #include <android/log.h>
@@ -74,12 +89,23 @@ static void parse_fixes(char *v) {
    }
 }

+static int query_slots = 1;  // vk_query_slots: slots per occlusion query (1 = untouched)
+static int spec_fixes;       // vk_spec_fixes: make two Unreal habits valid Vulkan (depth clears, depth resolves)
+#define VALIDATION_LAYER "VK_LAYER_KHRONOS_validation"
+static int validation;       // vk_validation: add Khronos' validation layer (bundled in the APK) to the instance
+
 static void read_settings(const char *path) {
    FILE *f = fopen(path, "r");
    if (!f) return;
    char line[4096];
    while (fgets(line, sizeof line, f)) {
        line[strcspn(line, "\r\n")] = 0;
+        if (!strncmp(line, "vk_validation=", 14)) validation = atoi(line + 14) != 0;
+        if (!strncmp(line, "vk_spec_fixes=", 14)) spec_fixes = atoi(line + 14) != 0;
+        if (!strncmp(line, "vk_query_slots=", 15)) {
+            int v = atoi(line + 15);
+            query_slots = v == 1 ? 2 : v >= 2 && v <= 4 ? v : 1;  // 1 = on (the settings dialog's switch) = 2 slots
+        }
        if (!strncmp(line, "vk_shader_fix=", 14)) {
            nfixes = 0;  // later sources override earlier ones (as for the adapter's settings)
            parse_fixes(line + 14);
@@ -182,6 +208,10 @@ static uint32_t *fixed_shader(const uint32_t *code, size_t size, size_t *out_siz
 static void init(void) {
    read_all_settings();
    if (nfixes) LOG("vk shim: %d shader fix(es) configured", nfixes);
+    if (query_slots > 1) LOG("vk shim: %d slots per occlusion query", query_slots);
+    if (validation) LOG("vk shim: adding %s to the instance", VALIDATION_LAYER);
+    if (spec_fixes) LOG("vk shim: Vulkan spec fixes on (depth images can be cleared, no depth resolve in shader-resolve "
+                        "subpasses)");
    real_vk = dlopen("libvulkan.so", RTLD_NOW | RTLD_LOCAL);
    if (real_vk) {
        real_gipa = (PFN_vkGetInstanceProcAddr)dlsym(real_vk, "vkGetInstanceProcAddr");
@@ -318,6 +348,8 @@ static const void *clean_chain(Arena *a, const void *head, int *fixes) {
    return first;
 }

+static int resolves_logged;
+
 static VkRenderPassCreateInfo2 clean_create_info(Arena *a, const VkRenderPassCreateInfo2 *ci, int *fixes) {
    VkRenderPassCreateInfo2 out = *ci;
    out.pNext = clean_chain(a, ci->pNext, fixes);
@@ -342,6 +374,27 @@ static VkRenderPassCreateInfo2 clean_create_info(Arena *a, const VkRenderPassCre
            out.pSubpasses = sp;
        }
    }
+    if (spec_fixes && out.pSubpasses) {
+        VkSubpassDescription2 *sp = (VkSubpassDescription2 *)out.pSubpasses;
+        for (uint32_t i = 0; i < ci->subpassCount; i++) {
+            if (!(sp[i].flags & 0x8 /* VK_SUBPASS_DESCRIPTION_SHADER_RESOLVE_BIT_QCOM */) || !sp[i].pDepthStencilAttachment)
+                continue;
+            uint32_t att = sp[i].pDepthStencilAttachment->attachment;
+            if (att == VK_ATTACHMENT_UNUSED || att >= ci->attachmentCount || !ci->pAttachments ||
+                ci->pAttachments[att].samples != VK_SAMPLE_COUNT_1_BIT)
+                continue;
+            for (VkBaseOutStructure *n = (VkBaseOutStructure *)sp[i].pNext; n; n = n->pNext) {
+                if (n->sType != VK_STRUCTURE_TYPE_SUBPASS_DESCRIPTION_DEPTH_STENCIL_RESOLVE) continue;
+                VkSubpassDescriptionDepthStencilResolve *r = (void *)n;
+                if (r->pDepthStencilResolveAttachment &&
+                    r->pDepthStencilResolveAttachment->attachment != VK_ATTACHMENT_UNUSED) {
+                    r->pDepthStencilResolveAttachment = NULL;
+                    (*fixes)++;
+                    if (resolves_logged++ < 5) LOG("vk shim: dropped the depth resolve of shader-resolve subpass %u", i);
+                }
+            }
+        }
+    }
    if (ci->pDependencies && ci->dependencyCount) {
        VkSubpassDependency2 *dep = arena_dup(a, ci->pDependencies, sizeof *dep * ci->dependencyCount);
        if (dep) {
@@ -356,8 +409,11 @@ static VkRenderPassCreateInfo2 clean_create_info(Arena *a, const VkRenderPassCre
 // ---------------------------------------------------------------- entry points

 #define MAX_DEVICES 8
-enum { FN_RP2, FN_RP2KHR, FN_CSM, FN_COUNT };
-static const char *const FN_NAMES[FN_COUNT] = {"vkCreateRenderPass2", "vkCreateRenderPass2KHR", "vkCreateShaderModule"};
+enum { FN_RP2, FN_RP2KHR, FN_CSM, FN_CIMG, FN_CQP, FN_DQP, FN_BQ, FN_EQ, FN_CRQP, FN_RQP, FN_RQPEXT, FN_GQPR, FN_CCQPR, FN_COUNT };
+static const char *const FN_NAMES[FN_COUNT] = {
+    "vkCreateRenderPass2", "vkCreateRenderPass2KHR", "vkCreateShaderModule", "vkCreateImage", "vkCreateQueryPool", "vkDestroyQueryPool",
+    "vkCmdBeginQuery", "vkCmdEndQuery", "vkCmdResetQueryPool", "vkResetQueryPool", "vkResetQueryPoolEXT",
+    "vkGetQueryPoolResults", "vkCmdCopyQueryPoolResults"};
 static struct { VkDevice device; PFN_vkVoidFunction fn[FN_COUNT]; } devices[MAX_DEVICES];
 static PFN_vkCreateRenderPass2 fallback_rp2khr;  // from vkGetInstanceProcAddr
 static pthread_mutex_t dev_lock = PTHREAD_MUTEX_INITIALIZER;
@@ -428,6 +484,223 @@ EXPORT VKAPI_ATTR VkResult VKAPI_CALL vkCreateShaderModule(VkDevice device, cons
    return r;
 }

+// ---------------------------------------------------------------- query slots
+
+// Command buffer functions carry no VkDevice: their next implementation is the one the (single) game device got.
+static PFN_vkVoidFunction cmd_fn[FN_COUNT];
+static PFN_vkVoidFunction any_fn(VkDevice device, int which) {
+    PFN_vkVoidFunction fn = device ? device_fn(device, which) : NULL;
+    if (!fn) fn = cmd_fn[which];
+    if (!fn && real_vk) fn = (PFN_vkVoidFunction)dlsym(real_vk, FN_NAMES[which]);
+    return fn;
+}
+
+#define MAX_POOLS 4096
+static uint64_t occlusion_pools[MAX_POOLS];  // open addressing; 0 = empty, 1 = deleted
+static pthread_mutex_t pool_lock = PTHREAD_MUTEX_INITIALIZER;
+static int pools_logged;
+
+static unsigned pool_hash(uint64_t h) { return (unsigned)((h * 0x9E3779B97F4A7C15ull) >> 52) % MAX_POOLS; }
+
+static void pool_add(VkQueryPool pool) {
+    uint64_t h = (uint64_t)pool;
+    pthread_mutex_lock(&pool_lock);
+    for (unsigned i = pool_hash(h), n = 0; n < MAX_POOLS; i = (i + 1) % MAX_POOLS, n++)
+        if (occlusion_pools[i] <= 1) { occlusion_pools[i] = h; break; }
+    pthread_mutex_unlock(&pool_lock);
+}
+
+static int pool_slot(VkQueryPool pool, int remove) {
+    uint64_t h = (uint64_t)pool;
+    if (h <= 1) return 0;
+    int found = 0;
+    pthread_mutex_lock(&pool_lock);
+    for (unsigned i = pool_hash(h), n = 0; n < MAX_POOLS && occlusion_pools[i]; i = (i + 1) % MAX_POOLS, n++)
+        if (occlusion_pools[i] == h) {
+            found = 1;
+            if (remove) occlusion_pools[i] = 1;
+            break;
+        }
+    pthread_mutex_unlock(&pool_lock);
+    return found;
+}
+
+// the remapped first query of `pool` (unchanged for pools that aren't remapped)
+static uint32_t q(VkQueryPool pool, uint32_t query) { return pool_slot(pool, 0) ? query * (uint32_t)query_slots : query; }
+
+static VKAPI_ATTR VkResult VKAPI_CALL create_query_pool(VkDevice device, const VkQueryPoolCreateInfo *ci,
+                                                       const VkAllocationCallbacks *alloc, VkQueryPool *pool) {
+    PFN_vkCreateQueryPool real = (PFN_vkCreateQueryPool)any_fn(device, FN_CQP);
+    if (!real) return VK_ERROR_INITIALIZATION_FAILED;
+    if (!ci || ci->queryType != VK_QUERY_TYPE_OCCLUSION || query_slots < 2) return real(device, ci, alloc, pool);
+    VkQueryPoolCreateInfo copy = *ci;
+    copy.queryCount = ci->queryCount * (uint32_t)query_slots;
+    VkResult r = real(device, &copy, alloc, pool);
+    if (r == VK_SUCCESS) {
+        pool_add(*pool);
+        if (pools_logged++ < 5)
+            LOG("vk shim: occlusion query pool %u -> %u slots", ci->queryCount, copy.queryCount);
+    }
+    return r;
+}
+
+static VKAPI_ATTR void VKAPI_CALL destroy_query_pool(VkDevice device, VkQueryPool pool, const VkAllocationCallbacks *alloc) {
+    PFN_vkDestroyQueryPool real = (PFN_vkDestroyQueryPool)any_fn(device, FN_DQP);
+    pool_slot(pool, 1);
+    if (real) real(device, pool, alloc);
+}
+
+static VKAPI_ATTR void VKAPI_CALL cmd_begin_query(VkCommandBuffer cb, VkQueryPool pool, uint32_t query,
+                                                 VkQueryControlFlags flags) {
+    PFN_vkCmdBeginQuery real = (PFN_vkCmdBeginQuery)any_fn(NULL, FN_BQ);
+    if (real) real(cb, pool, q(pool, query), flags);
+}
+
+static VKAPI_ATTR void VKAPI_CALL cmd_end_query(VkCommandBuffer cb, VkQueryPool pool, uint32_t query) {
+    PFN_vkCmdEndQuery real = (PFN_vkCmdEndQuery)any_fn(NULL, FN_EQ);
+    if (real) real(cb, pool, q(pool, query));
+}
+
+static uint32_t span(VkQueryPool pool, uint32_t count) { return pool_slot(pool, 0) ? count * (uint32_t)query_slots : count; }
+
+static VKAPI_ATTR void VKAPI_CALL cmd_reset_query_pool(VkCommandBuffer cb, VkQueryPool pool, uint32_t first, uint32_t count) {
+    PFN_vkCmdResetQueryPool real = (PFN_vkCmdResetQueryPool)any_fn(NULL, FN_CRQP);
+    if (real) real(cb, pool, q(pool, first), span(pool, count));
+}
+
+static void reset_query_pool(VkDevice device, VkQueryPool pool, uint32_t first, uint32_t count, int ext) {
+    PFN_vkResetQueryPool real = (PFN_vkResetQueryPool)any_fn(device, ext ? FN_RQPEXT : FN_RQP);
+    if (real) real(device, pool, q(pool, first), span(pool, count));
+}
+static VKAPI_ATTR void VKAPI_CALL host_reset_query_pool(VkDevice d, VkQueryPool p, uint32_t f, uint32_t c) { reset_query_pool(d, p, f, c, 0); }
+static VKAPI_ATTR void VKAPI_CALL host_reset_query_pool_ext(VkDevice d, VkQueryPool p, uint32_t f, uint32_t c) { reset_query_pool(d, p, f, c, 1); }
+
+// Results come from slot N*i of each query, one query at a time: the extra slots are only written in multiview passes,
+// so reading them (with VK_QUERY_RESULT_WAIT_BIT) could wait forever.
+static VKAPI_ATTR VkResult VKAPI_CALL get_query_pool_results(VkDevice device, VkQueryPool pool, uint32_t first, uint32_t count,
+                                                            size_t size, void *data, VkDeviceSize stride,
+                                                            VkQueryResultFlags flags) {
+    PFN_vkGetQueryPoolResults real = (PFN_vkGetQueryPoolResults)any_fn(device, FN_GQPR);
+    if (!real) return VK_ERROR_INITIALIZATION_FAILED;
+    if (!pool_slot(pool, 0) || !count) return real(device, pool, first, count, size, data, stride, flags);
+    VkResult result = VK_SUCCESS;
+    for (uint32_t i = 0; i < count; i++) {
+        size_t offset = (size_t)(i * stride);
+        if (offset >= size) break;
+        VkResult r = real(device, pool, (first + i) * (uint32_t)query_slots, 1, size - offset, (uint8_t *)data + offset,
+                          stride, flags);
+        if (r < 0) return r;
+        if (r == VK_NOT_READY) result = VK_NOT_READY;
+    }
+    return result;
+}
+
+static VKAPI_ATTR void VKAPI_CALL cmd_copy_query_pool_results(VkCommandBuffer cb, VkQueryPool pool, uint32_t first,
+                                                             uint32_t count, VkBuffer buffer, VkDeviceSize offset,
+                                                             VkDeviceSize stride, VkQueryResultFlags flags) {
+    PFN_vkCmdCopyQueryPoolResults real = (PFN_vkCmdCopyQueryPoolResults)any_fn(NULL, FN_CCQPR);
+    if (!real) return;
+    if (!pool_slot(pool, 0)) { real(cb, pool, first, count, buffer, offset, stride, flags); return; }
+    for (uint32_t i = 0; i < count; i++)
+        real(cb, pool, (first + i) * (uint32_t)query_slots, 1, buffer, offset + i * stride, stride, flags);
+}
+
+// ---------------------------------------------------------------- spec fixes: depth images
+
+static int is_depth_format(VkFormat f) {
+    return f == VK_FORMAT_D16_UNORM || f == VK_FORMAT_X8_D24_UNORM_PACK32 || f == VK_FORMAT_D32_SFLOAT ||
+           f == VK_FORMAT_S8_UINT || f == VK_FORMAT_D16_UNORM_S8_UINT || f == VK_FORMAT_D24_UNORM_S8_UINT ||
+           f == VK_FORMAT_D32_SFLOAT_S8_UINT;
+}
+static int images_logged;
+
+static VKAPI_ATTR VkResult VKAPI_CALL create_image(VkDevice device, const VkImageCreateInfo *ci,
+                                                  const VkAllocationCallbacks *alloc, VkImage *image) {
+    PFN_vkCreateImage real = (PFN_vkCreateImage)any_fn(device, FN_CIMG);
+    if (!real) return VK_ERROR_INITIALIZATION_FAILED;
+    if (!spec_fixes || !ci || !is_depth_format(ci->format) || !(ci->usage & VK_IMAGE_USAGE_DEPTH_STENCIL_ATTACHMENT_BIT) ||
+        (ci->usage & (VK_IMAGE_USAGE_TRANSFER_DST_BIT | VK_IMAGE_USAGE_TRANSIENT_ATTACHMENT_BIT)))  // transient: no
+        return real(device, ci, alloc, image);
+    VkImageCreateInfo copy = *ci;
+    copy.usage |= VK_IMAGE_USAGE_TRANSFER_DST_BIT;
+    VkResult r = real(device, &copy, alloc, image);
+    if (images_logged++ < 5) LOG("vk shim: depth image %ux%u format %d can be cleared now: %d", ci->extent.width,
+                                 ci->extent.height, ci->format, r);
+    if (r != VK_SUCCESS) r = real(device, ci, alloc, image);  // the flag isn't allowed here: as the game asked
+    return r;
+}
+
+EXPORT VKAPI_ATTR VkResult VKAPI_CALL vkCreateImage(VkDevice d, const VkImageCreateInfo *ci, const VkAllocationCallbacks *a,
+                                                    VkImage *img) {
+    pthread_once(&once, init);
+    return create_image(d, ci, a, img);
+}
+
+// ---------------------------------------------------------------- validation (diagnostics)
+
+static PFN_vkCreateInstance real_ci;
+
+static VKAPI_ATTR VkResult VKAPI_CALL create_instance(const VkInstanceCreateInfo *ci, const VkAllocationCallbacks *a,
+                                                    VkInstance *inst) {
+    if (!real_ci && real_vk) real_ci = (PFN_vkCreateInstance)dlsym(real_vk, "vkCreateInstance");
+    if (!real_ci) return VK_ERROR_INITIALIZATION_FAILED;
+    if (!validation || !ci) return real_ci(ci, a, inst);
+    for (uint32_t i = 0; i < ci->enabledLayerCount; i++)
+        if (!strcmp(ci->ppEnabledLayerNames[i], VALIDATION_LAYER)) return real_ci(ci, a, inst);
+    const char **names = malloc(sizeof(char *) * (ci->enabledLayerCount + 1));
+    if (!names) return real_ci(ci, a, inst);
+    for (uint32_t i = 0; i < ci->enabledLayerCount; i++) names[i] = ci->ppEnabledLayerNames[i];
+    names[ci->enabledLayerCount] = VALIDATION_LAYER;
+    VkInstanceCreateInfo copy = *ci;
+    copy.enabledLayerCount = ci->enabledLayerCount + 1;
+    copy.ppEnabledLayerNames = names;
+    VkResult r = real_ci(&copy, a, inst);
+    LOG("vk shim: vkCreateInstance with %s: %d", VALIDATION_LAYER, r);
+    if (r == VK_ERROR_LAYER_NOT_PRESENT) r = real_ci(ci, a, inst);  // not bundled: start without it
+    free(names);
+    return r;
+}
+
+EXPORT VKAPI_ATTR VkResult VKAPI_CALL vkCreateInstance(const VkInstanceCreateInfo *ci, const VkAllocationCallbacks *a,
+                                                       VkInstance *inst) {
+    pthread_once(&once, init);
+    return create_instance(ci, a, inst);
+}
+
+// The same entry points for engines that dlsym them from the shim instead of asking vkGet*ProcAddr
+EXPORT VKAPI_ATTR VkResult VKAPI_CALL vkCreateQueryPool(VkDevice d, const VkQueryPoolCreateInfo *ci,
+                                                        const VkAllocationCallbacks *a, VkQueryPool *p) {
+    pthread_once(&once, init);
+    return create_query_pool(d, ci, a, p);
+}
+EXPORT VKAPI_ATTR void VKAPI_CALL vkDestroyQueryPool(VkDevice d, VkQueryPool p, const VkAllocationCallbacks *a) {
+    pthread_once(&once, init);
+    destroy_query_pool(d, p, a);
+}
+EXPORT VKAPI_ATTR void VKAPI_CALL vkCmdBeginQuery(VkCommandBuffer cb, VkQueryPool p, uint32_t i, VkQueryControlFlags f) {
+    pthread_once(&once, init);
+    cmd_begin_query(cb, p, i, f);
+}
+EXPORT VKAPI_ATTR void VKAPI_CALL vkCmdEndQuery(VkCommandBuffer cb, VkQueryPool p, uint32_t i) {
+    pthread_once(&once, init);
+    cmd_end_query(cb, p, i);
+}
+EXPORT VKAPI_ATTR void VKAPI_CALL vkCmdResetQueryPool(VkCommandBuffer cb, VkQueryPool p, uint32_t f, uint32_t c) {
+    pthread_once(&once, init);
+    cmd_reset_query_pool(cb, p, f, c);
+}
+EXPORT VKAPI_ATTR VkResult VKAPI_CALL vkGetQueryPoolResults(VkDevice d, VkQueryPool p, uint32_t f, uint32_t c, size_t s,
+                                                            void *data, VkDeviceSize st, VkQueryResultFlags fl) {
+    pthread_once(&once, init);
+    return get_query_pool_results(d, p, f, c, s, data, st, fl);
+}
+EXPORT VKAPI_ATTR void VKAPI_CALL vkCmdCopyQueryPoolResults(VkCommandBuffer cb, VkQueryPool p, uint32_t f, uint32_t c,
+                                                           VkBuffer b, VkDeviceSize o, VkDeviceSize st,
+                                                           VkQueryResultFlags fl) {
+    pthread_once(&once, init);
+    cmd_copy_query_pool_results(cb, p, f, c, b, o, st, fl);
+}
+
 static int wrapped_index(const char *name) {
    for (int i = 0; i < FN_COUNT; i++)
        if (!strcmp(name, FN_NAMES[i])) return i;
@@ -439,6 +712,20 @@ static PFN_vkVoidFunction wrap(const char *name) {
    case FN_RP2: return (PFN_vkVoidFunction)vkCreateRenderPass2;
    case FN_RP2KHR: return (PFN_vkVoidFunction)create_render_pass2_khr;
    case FN_CSM: return nfixes ? (PFN_vkVoidFunction)vkCreateShaderModule : NULL;  // nothing to fix: no detour
+    case FN_CIMG: return spec_fixes ? (PFN_vkVoidFunction)create_image : NULL;
+    default: break;
+    }
+    if (query_slots < 2) return NULL;  // no query remapping: no detours
+    switch (wrapped_index(name)) {
+    case FN_CQP: return (PFN_vkVoidFunction)create_query_pool;
+    case FN_DQP: return (PFN_vkVoidFunction)destroy_query_pool;
+    case FN_BQ: return (PFN_vkVoidFunction)cmd_begin_query;
+    case FN_EQ: return (PFN_vkVoidFunction)cmd_end_query;
+    case FN_CRQP: return (PFN_vkVoidFunction)cmd_reset_query_pool;
+    case FN_RQP: return (PFN_vkVoidFunction)host_reset_query_pool;
+    case FN_RQPEXT: return (PFN_vkVoidFunction)host_reset_query_pool_ext;
+    case FN_GQPR: return (PFN_vkVoidFunction)get_query_pool_results;
+    case FN_CCQPR: return (PFN_vkVoidFunction)cmd_copy_query_pool_results;
    default: return NULL;
    }
 }
@@ -460,6 +747,7 @@ EXPORT VKAPI_ATTR PFN_vkVoidFunction VKAPI_CALL vkGetDeviceProcAddr(VkDevice dev
        devices[slot].device = device;
        devices[slot].fn[which] = fn;
    }
+    cmd_fn[which] = fn;
    pthread_mutex_unlock(&dev_lock);
    return w;
 }
@@ -469,9 +757,12 @@ EXPORT VKAPI_ATTR PFN_vkVoidFunction VKAPI_CALL vkGetInstanceProcAddr(VkInstance
    if (!real_gipa || !name) return NULL;
    if (!strcmp(name, "vkGetDeviceProcAddr")) return (PFN_vkVoidFunction)vkGetDeviceProcAddr;
    if (!strcmp(name, "vkGetInstanceProcAddr")) return (PFN_vkVoidFunction)vkGetInstanceProcAddr;
+    if (!strcmp(name, "vkCreateInstance") && validation) return (PFN_vkVoidFunction)vkCreateInstance;
    PFN_vkVoidFunction fn = real_gipa(instance, name);
    PFN_vkVoidFunction w = fn ? wrap(name) : NULL;
    if (!w) return fn;
    if (!strcmp(name, "vkCreateRenderPass2KHR")) fallback_rp2khr = (PFN_vkCreateRenderPass2)fn;
+    int which = wrapped_index(name);
+    if (which >= FN_CQP && !cmd_fn[which]) cmd_fn[which] = fn;
    return w;
 }
@@ -7,11 +7,18 @@
 // Meta's OVRPlugin finds xrGetInstanceProcAddr with dlopen("libopenxr_loader.so") + dlsym, so FramePort points that
 // string in libOVRPlugin.so at this library instead (patches/frame/adapter.py). Names the adapter emulates are served
 // by the adapter (framebridge_extension_proc); everything else goes to overport's xrGetInstanceProcAddr unchanged.
+//
+// Haptics (GitHub #9, found by Klownicle in Lucky's Tale): overport's dispatcher converts an
+// XrHapticAmplitudeEnvelopeVibrationFB with its nanosecond duration taken as seconds, so one vibration allocates an
+// enormous sample buffer and the Frame runs out of memory and freezes. The shim hands OVRPlugin its own
+// xrApplyHapticFeedback, which turns such an envelope into a plain XrHapticVibration (same duration, its peak
+// amplitude) before the dispatcher sees it. Everything else passes through unchanged.
 #include <openxr/openxr.h>
 #include <android/log.h>
 #include <dlfcn.h>
 #include <pthread.h>
 #include <stddef.h>
+#include <string.h>

 #define TAG "FrameBridge"
 #define EXPORT __attribute__((visibility("default")))
@@ -40,9 +47,38 @@ static PFN_xrVoidFunction adapter_proc(const char *name) {
    return fn(name);
 }

+static PFN_xrApplyHapticFeedback overport_haptics;
+static int haptics_logged;
+
+static XRAPI_ATTR XrResult XRAPI_CALL apply_haptic_feedback(XrSession session, const XrHapticActionInfo *info,
+                                                           const XrHapticBaseHeader *feedback) {
+    if (feedback && feedback->type == XR_TYPE_HAPTIC_AMPLITUDE_ENVELOPE_VIBRATION_FB) {
+        const XrHapticAmplitudeEnvelopeVibrationFB *env = (const XrHapticAmplitudeEnvelopeVibrationFB *)feedback;
+        float peak = 0.0f;
+        for (uint32_t i = 0; env->amplitudes && i < env->amplitudeCount; ++i)
+            if (env->amplitudes[i] > peak) peak = env->amplitudes[i];
+        XrHapticVibration plain = {XR_TYPE_HAPTIC_VIBRATION, NULL, env->duration, XR_FREQUENCY_UNSPECIFIED,
+                                   peak > 1.0f ? 1.0f : peak};
+        if (haptics_logged++ < 3)
+            __android_log_print(ANDROID_LOG_INFO, TAG, "extension shim: haptic envelope (%u samples, %lld ns) -> "
+                                "vibration %.2f", env->amplitudeCount, (long long)env->duration, plain.amplitude);
+        return overport_haptics(session, info, (const XrHapticBaseHeader *)&plain);
+    }
+    return overport_haptics(session, info, feedback);
+}
+
 EXPORT XRAPI_ATTR XrResult XRAPI_CALL xrGetInstanceProcAddr(XrInstance instance, const char *name,
                                                            PFN_xrVoidFunction *function) {
    pthread_once(&once, resolve_overport);
+    if (name && function && instance != XR_NULL_HANDLE && overport_gipa && !strcmp(name, "xrApplyHapticFeedback")) {
+        PFN_xrVoidFunction real = NULL;
+        XrResult r = overport_gipa(instance, name, &real);
+        if (XR_SUCCEEDED(r) && real) {
+            overport_haptics = (PFN_xrApplyHapticFeedback)real;
+            *function = (PFN_xrVoidFunction)apply_haptic_feedback;
+        }
+        return r;
+    }
    if (name && function && instance != XR_NULL_HANDLE) {
        PFN_xrVoidFunction emulated = adapter_proc(name);
        if (emulated) {
@@ -302,7 +302,7 @@ def main() -> int:
    game = args.game or (library.games()[0]["package"] if library.games() else None)
    steps = [("library", lambda a: a.navigate(0)), ("frame", lambda a: a.navigate(1)),
             ("files", lambda a: a.go("files")), ("screenshots", lambda a: a.go("screenshots")),
-             ("tools", lambda a: a.go("settings"))]
+             ("live", lambda a: a.go("live")), ("tools", lambda a: a.go("settings"))]
    if game:
        steps.insert(1, ("game", lambda a: a.open_game(game)))
        steps.insert(2, ("game-customize", lambda a: a.open_game(game, advanced=True)))
@@ -1,2 +1,2 @@
 # The FramePort version: the single source (pyproject reads it via hatch; CI checks a release tag matches it).
-__version__ = "0.9.1"
+__version__ = "0.11.0"
@@ -202,6 +202,8 @@ def analyze(path: Path, deep: bool = True, data_bytes: int | None = None) -> Ana
            "oculus_xr_plugin": bool(il2cpp_meta) and b"\0m_StereoRenderingModeAndroid\0" in il2cpp_meta,
            # Unity's built-in Oculus support checks for Meta's system apps before VR (frame.unity_oculus_check)
            "unity_oculus_check": b"\0com.oculus.systemactivities\0" in lib_bytes.get("libunity.so", b""),
+            # a 2D launcher activity that starts a separate VR activity (frame.start_activity)
+            "vr_activity": axml.vr_activity(manifest),
            "unity_version": unity_version(ggm, lib_bytes.get("libunity.so")) if engine == "Unity" else None,
        },
    )
@@ -18,6 +18,10 @@ TYPE_INT_BOOLEAN = 0x12
 ANDROID_NS = "http://schemas.android.com/apk/res/android"
 LAUNCHER = "android.intent.category.LAUNCHER"
 INFO = "android.intent.category.INFO"
+MAIN = "android.intent.action.MAIN"
+DEFAULT = "android.intent.category.DEFAULT"
+VR_CATEGORY = "com.oculus.intent.category.VR"
+COMPONENTS = ("activity", "activity-alias", "service", "receiver", "provider")


@dataclass
@@ -226,6 +230,81 @@ def fix_launcher(manifest: bytes) -> bytes | None:
    return x.bytes() if x.retarget("category", info, launcher) else None


+def component_filters(manifest: bytes) -> list[tuple[str, str, list[tuple[str, int, int]]]]:
+    """[(element, component name, [(element, attr offset, string index)])] for each component's intent-filter
+    children (action/category), in file order. Children follow their component's start element, so the last
+    component seen owns them."""
+    x = Axml(manifest)
+    names = x.strings()
+    out: list = []
+    for el in x.elements():
+        if el.name in COMPONENTS:
+            out.append((el.name, x.attr_str(el, "name") or "", []))
+        elif el.name in ("action", "category") and out:
+            for a in el.attrs:
+                if a.name < len(names) and names[a.name] == "name":
+                    idx = a.raw if a.raw < len(names) else a.value
+                    out[-1][2].append((el.name, a.offset, idx))
+    return out
+
+
+def vr_activity(manifest: bytes) -> str | None:
+    """The activity with Meta's VR category when it isn't the launcher activity (a 2D launcher that starts the VR
+    part, e.g. WiiCompiled's LauncherActivity -> QuestActivity)."""
+    x = Axml(manifest)
+    names = x.strings()
+    vr = launcher = None
+    for el, name, items in component_filters(manifest):
+        cats = {names[i] for kind, _, i in items if kind == "category" and i < len(names)}
+        if el == "activity" and VR_CATEGORY in cats:
+            vr = vr or name
+        if LAUNCHER in cats:
+            launcher = launcher or name
+    return vr if vr and vr != launcher else None
+
+
+def set_start_activity(manifest: bytes, activity: str) -> bytes | None:
+    """Make `activity` the one Lepton starts: its MAIN intent-filter gets category LAUNCHER (in place of its VR or
+    DEFAULT category), every other component's LAUNCHER category becomes INFO. Only those attribute values change
+    (per element, not every use of the string). None when `activity` has no MAIN filter or already is the only
+    launcher."""
+    filters = component_filters(manifest)
+    x = Axml(manifest)
+    names = x.strings()
+    short = activity.rsplit(".", 1)[-1]
+    target = next((f for f in filters if f[0] in ("activity", "activity-alias")
+                   and (f[1] == activity or f[1].rsplit(".", 1)[-1] == short)), None)
+    if target is None or not any(k == "action" and names[i] == MAIN for k, _, i in target[2] if i < len(names)):
+        return None
+    cats = [(off, names[i]) for k, off, i in target[2] if k == "category" and i < len(names)]
+    others = [off for f in filters if f is not target for k, off, i in f[2]
+              if k == "category" and i < len(names) and names[i] == LAUNCHER]
+    if any(c == LAUNCHER for _, c in cats) and not others:
+        return None
+    pick = next((off for off, c in cats if c == VR_CATEGORY), None) or next(
+        (off for off, c in cats if c == DEFAULT), None) or next((off for off, c in cats if c != LAUNCHER), None)
+    if pick is None and not any(c == LAUNCHER for _, c in cats):
+        return None
+
+    def index(s: str) -> int:
+        i = x.index(s)
+        return i if i is not None else x.append_string(s)
+    launcher, info = index(LAUNCHER), index(INFO)
+    # append_string rebuilds the pool: offsets of attribute records move by the same amount for all of them
+    shift = len(x.data) - len(manifest)
+    for off in others:
+        _set_string_attr(x, off + shift, info)
+    if pick is not None and not any(c == LAUNCHER for _, c in cats):
+        _set_string_attr(x, pick + shift, launcher)
+    return x.bytes()
+
+
+def _set_string_attr(x: Axml, offset: int, index: int) -> None:
+    struct.pack_into("<I", x.data, offset + 8, index)
+    if x.data[offset + 15] == TYPE_STRING:
+        struct.pack_into("<I", x.data, offset + 16, index)
+
+
 def set_bool_attr(manifest: bytes, element: str, attr: str, value: bool) -> bytes | None:
    x = Axml(manifest)
    return x.bytes() if x.set_bool(element, attr, value) else None
@@ -22,17 +22,40 @@ def _path() -> Path:
    return user_data_dir() / "library.json"


+_updating = threading.local()  # set while load() runs the migrations/catalog step (see load)
+
+
 def load() -> dict:
    with _lock:
        try:
            data = json.loads(_path().read_text(encoding="utf-8"))
        except (OSError, ValueError):
            return {"games": {}, "settings": {}}
-        if _migrate(data) | _follow_catalog(data):
+        # The catalog step loads the catalog, whose first load reads a setting: that nested load() must not run the
+        # step again (GitHub #58: ~140 nested loads and a 30 s blank window, or a crash at start-up)
+        if getattr(_updating, "active", False):
+            return data
+        _updating.active = True
+        try:
+            changed = _migrate(data) | _follow_catalog(data)
+        finally:
+            _updating.active = False
+        if changed:
            save(data)
        return data


+def peek_setting(key: str, default=None):
+    """A setting as stored, without migrations or the catalog step (for code that load() itself runs)."""
+    with _lock:
+        try:
+            data = json.loads(_path().read_text(encoding="utf-8"))
+        except (OSError, ValueError):
+            return default
+    settings = data.get("settings") if isinstance(data, dict) else None
+    return settings.get(key, default) if isinstance(settings, dict) else default
+
+
@contextmanager
 def edit() -> Iterator[dict]:
    """A read-modify-write of the whole library as one step: `with edit() as data: ...` (saved on exit)."""
@@ -62,8 +85,22 @@ def _follow_catalog(data: dict) -> bool:
            continue
        if app_updated and isinstance(a, dict):
            changed |= _refresh_data_fields(g, a)
-        if not isinstance(r, dict) or not isinstance(a, dict) or r.get("source") == "user":
+        if not isinstance(r, dict) or not isinstance(a, dict):
            continue
+        if r.get("source") == "user":
+            # the user's own recipe isn't replaced, but a changed catalog entry is offered on the game page (GitHub
+            # #10: a VR4 fix never reached a recipe whose Game settings had been saved once)
+            entry = catalog.lookup(pkg)
+            offer = entry.rev() if entry is not None and r.get("catalog_rev") not in (None, entry.rev()) else None
+            if g.get("catalog_update") != offer:
+                if offer:
+                    g["catalog_update"] = offer
+                else:
+                    g.pop("catalog_update", None)
+                changed = True
+            continue
+        if g.pop("catalog_update", None) is not None:  # no longer the user's recipe (reset): nothing to offer
+            changed = True
        entry = catalog.lookup(pkg)
        if not app_updated and (entry is None or r.get("catalog_rev") == entry.rev()):
            continue
@@ -0,0 +1,138 @@
+# ruff: noqa: E501  (the embedded page's JavaScript)
+"""The Live view player page (served by livestream.py). A Python string rather than an .html file: the
+PyInstaller fallback bundle only carries data files it is told about."""
+
+PLAYER_HTML = r"""<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>FramePort Live view</title>
+<style>
+  :root { --bg: #0e1013; --text: #e8eaed; --muted: #9aa0a6; --accent: #66b3ff; --panel: rgba(20, 22, 26, .82); }
+  html, body { margin: 0; height: 100%; background: var(--bg); color: var(--text);
+               font: 14px/1.4 system-ui, -apple-system, "Segoe UI", sans-serif; overflow: hidden; }
+  video { position: fixed; inset: 0; width: 100%; height: 100%; object-fit: contain; background: #000; }
+  #bar { position: fixed; left: 12px; right: 12px; bottom: 12px; display: flex; gap: 12px; align-items: center;
+         padding: 8px 12px; border-radius: 10px; background: var(--panel); transition: opacity .3s; }
+  body.idle #bar { opacity: 0; }
+  #dot { width: 9px; height: 9px; border-radius: 50%; background: var(--muted); flex: none; }
+  #dot.live { background: #3ddc84; } #dot.err { background: #ff6b6b; }
+  #msg { flex: 1; min-width: 0; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+  #info { color: var(--muted); font-variant-numeric: tabular-nums; }
+  button { background: transparent; color: var(--text); border: 1px solid #3c4043; border-radius: 6px;
+           padding: 4px 10px; font: inherit; cursor: pointer; }
+  button:hover { border-color: var(--accent); }
+</style>
+</head>
+<body>
+<video id="v" muted autoplay playsinline disablepictureinpicture></video>
+<div id="bar">
+  <span id="dot"></span><span id="msg">Connecting to the Frame…</span><span id="info"></span>
+  <button id="snd" hidden title="Browsers start videos muted: click to hear the Frame">Sound on</button>
+  <button id="fs" title="Full screen (or double-click the picture)">Full screen</button>
+</div>
+<script>
+"use strict";
+const video = document.getElementById("v"), dot = document.getElementById("dot");
+const msg = document.getElementById("msg"), info = document.getElementById("info");
+const CUSHION = 0.3, CATCH_UP = 0.7, FAR_BEHIND = 2.0, KEEP = 10;  // seconds behind the newest data
+let session = 0, frames = 0, lastFrames = 0, size = "";
+
+function say(text, state) { msg.textContent = text; dot.className = state || ""; }
+const sleep = ms => new Promise(r => setTimeout(r, ms));
+
+async function status() {
+  try { const r = await fetch("status", {cache: "no-store"}); return await r.json(); }
+  catch (e) { return null; }
+}
+
+async function run() {
+  const id = ++session;
+  let st = await status();
+  while (id === session && (!st || !st.ready)) {
+    if (st && st.ended) { say("Stopped: " + st.ended + " — start it again in FramePort.", "err"); return; }
+    if (!st) { say("FramePort isn't streaming any more. Start Live view in FramePort.", "err"); return; }
+    say("Waiting for the first picture from the Frame…");
+    await sleep(500); st = await status();
+  }
+  const type = 'video/mp4; codecs="' + (st.codec || "avc1.640028") + '"';
+  const MS = window.ManagedMediaSource || window.MediaSource;
+  if (!MS || !MS.isTypeSupported(type)) { say("This browser can't play H.264 video (" + type + "). Copy this page's address into another browser.", "err"); return; }
+  size = st.width ? st.width + "×" + st.height : "";
+  snd.hidden = !st.audio;
+  const ms = new MS();
+  video.disableRemotePlayback = true;
+  video.src = URL.createObjectURL(ms);
+  await new Promise(r => ms.addEventListener("sourceopen", r, {once: true}));
+  const sb = ms.addSourceBuffer(type);
+  sb.mode = "segments";
+  const pending = [];
+  const pump = () => {
+    if (sb.updating || !pending.length || ms.readyState !== "open") return;
+    try { sb.appendBuffer(pending.shift()); } catch (e) { trim(true); }
+  };
+  const trim = (force) => {
+    if (sb.updating || !sb.buffered.length) return;
+    const start = sb.buffered.start(0), cut = video.currentTime - (force ? 1 : KEEP);
+    if (cut > start) { try { sb.remove(start, cut); } catch (e) {} }
+  };
+  sb.addEventListener("updateend", () => {
+    if (sb.buffered.length) {
+      const end = sb.buffered.end(sb.buffered.length - 1);
+      const lag = end - video.currentTime;
+      if (lag > FAR_BEHIND || video.currentTime < sb.buffered.start(0)) video.currentTime = Math.max(end - CUSHION, 0);
+      else video.playbackRate = lag > CATCH_UP ? 1.1 : lag < CUSHION ? 1.0 : video.playbackRate;
+      if (video.paused) video.play().catch(() => {});
+    }
+    pump();
+  });
+  try {
+    const resp = await fetch("stream.mp4", {cache: "no-store"});
+    if (!resp.ok) throw new Error(await resp.text());
+    say("Live from the Frame", "live");
+    const reader = resp.body.getReader();
+    let n = 0;
+    while (id === session) {
+      const {value, done} = await reader.read();
+      if (done) break;
+      pending.push(value); frames++;
+      if (++n % 60 === 0) trim(false);
+      pump();
+    }
+  } catch (e) {
+    say("Connection lost (" + e.message + "), reconnecting…", "err");
+  }
+  if (id !== session) return;
+  await sleep(1000);
+  const again = await status();
+  if (again && again.ended) { say("Stopped: " + again.ended + " — start it again in FramePort.", "err"); return; }
+  run();
+}
+
+setInterval(() => {
+  const chunks = frames - lastFrames; lastFrames = frames;
+  info.textContent = [size, chunks ? "receiving" : ""].filter(Boolean).join(" · ");
+}, 1000);
+document.addEventListener("visibilitychange", () => { if (!document.hidden) run(); });
+const toggleFs = () => document.fullscreenElement ? document.exitFullscreen() : document.documentElement.requestFullscreen();
+document.getElementById("fs").onclick = toggleFs;
+const snd = document.getElementById("snd");
+let wantSound = false;  // the choice survives reconnects (each one makes a new MediaSource)
+snd.onclick = () => {
+  wantSound = !wantSound; video.muted = !wantSound;
+  snd.textContent = wantSound ? "Mute" : "Sound on";
+  if (wantSound) video.play().catch(() => {});
+};
+video.addEventListener("loadedmetadata", () => { video.muted = !wantSound; });
+video.ondblclick = toggleFs;
+let idle;
+document.addEventListener("mousemove", () => {
+  document.body.classList.remove("idle"); clearTimeout(idle);
+  idle = setTimeout(() => document.body.classList.add("idle"), 2500);
+});
+run();
+</script>
+</body>
+</html>
+"""
@@ -0,0 +1,508 @@
+"""Live view: what the Frame shows, played in a browser window on this PC (the GUI's Live view tab).
+
+The Frame sends fragmented MP4 (H.264) on the stdout of one SSH command (`source_command`); a small HTTP server on
+127.0.0.1 relays it to a player page (`live_player.py`: Media Source Extensions, no plugin). Flet has no video control
+outside packaged builds, so the picture is shown in the browser, which also decodes it in hardware.
+
+The relay keeps the init segment (ftyp + moov) and the fragments since the last keyframe, so a viewer that opens later
+starts at a keyframe. No image bytes ever go through Flet.
+"""
+from __future__ import annotations
+
+import json
+import queue
+import struct
+import threading
+import time
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+SAMPLE_NON_SYNC = 0x10000  # ISO/IEC 14496-12 sample_is_non_sync_sample
+CLIENT_QUEUE = 240  # fragments a slow viewer may lag behind before it's dropped (it reconnects at a keyframe)
+
+
+# ------------------------------------------------------------------------------------------------ MP4 parsing
+def iter_boxes(data: bytes, start: int = 0, end: int | None = None):
+    """(type, payload start, box end) of each complete box in data[start:end]."""
+    end = len(data) if end is None else end
+    pos = start
+    while pos + 8 <= end:
+        size, kind = struct.unpack_from(">I4s", data, pos)
+        header = 8
+        if size == 1:
+            if pos + 16 > end:
+                return
+            size = struct.unpack_from(">Q", data, pos + 8)[0]
+            header = 16
+        elif size == 0:
+            size = end - pos
+        if size < header or pos + size > end:
+            return
+        yield kind.decode("latin-1"), pos + header, pos + size
+        pos += size
+
+
+def _child(data: bytes, start: int, end: int, kind: str):
+    for k, s, e in iter_boxes(data, start, end):
+        if k == kind:
+            return s, e
+    return None
+
+
+def fragment_is_keyframe(moof: bytes, track_id: int | None = None) -> bool:
+    """Whether a movie fragment starts with a sync sample in the given track (default: its first track): trun's
+    first-sample flags, else its per-sample flags, else tfhd's default flags. Unknown or no such track → False: a
+    viewer then waits for the next fragment that is one."""
+    top = _child(moof, 0, len(moof), "moof")
+    if not top:
+        return False
+    for kind, s, e in iter_boxes(moof, *top):
+        if kind != "traf":
+            continue
+        default_flags = None
+        tfhd = _child(moof, s, e, "tfhd")
+        if tfhd:
+            p = tfhd[0]
+            flags = int.from_bytes(moof[p + 1:p + 4], "big")
+            if track_id is not None and struct.unpack_from(">I", moof, p + 4)[0] != track_id:
+                continue
+            p += 8  # version/flags + track_ID
+            for bit, size in ((0x1, 8), (0x2, 4), (0x8, 4), (0x10, 4)):
+                if flags & bit:
+                    p += size
+            if flags & 0x20 and p + 4 <= tfhd[1]:
+                default_flags = struct.unpack_from(">I", moof, p)[0]
+        trun = _child(moof, s, e, "trun")
+        if not trun:
+            continue
+        p = trun[0]
+        flags = int.from_bytes(moof[p + 1:p + 4], "big")
+        count = struct.unpack_from(">I", moof, p + 4)[0]
+        p += 8
+        if flags & 0x1:
+            p += 4  # data_offset
+        if flags & 0x4:
+            return not struct.unpack_from(">I", moof, p)[0] & SAMPLE_NON_SYNC
+        if count and flags & 0x400:
+            if flags & 0x100:
+                p += 4
+            if flags & 0x200:
+                p += 4
+            return not struct.unpack_from(">I", moof, p)[0] & SAMPLE_NON_SYNC
+        if default_flags is not None:
+            return not default_flags & SAMPLE_NON_SYNC
+        return False
+    return False
+
+
+def codec_string(init: bytes) -> str | None:
+    """The MSE codecs parameter from the init segment: `avc1.PPCCLL` (from avcC), plus `mp4a.40.2` when it has an AAC
+    track (ffmpeg's aac encoder writes AAC-LC)."""
+    i = init.find(b"avcC")
+    if i < 0 or i + 8 > len(init):
+        return None
+    profile, compat, level = init[i + 5], init[i + 6], init[i + 7]
+    out = f"avc1.{profile:02x}{compat:02x}{level:02x}"
+    if b"mp4a" in init:
+        out += ", mp4a.40.2"
+    return out
+
+
+def video_track_id(init: bytes) -> int | None:
+    """track_ID of the init segment's video track (its trak's hdlr is 'vide')."""
+    moov = _child(init, 0, len(init), "moov")
+    if not moov:
+        return None
+    for kind, s, e in iter_boxes(init, *moov):
+        if kind != "trak":
+            continue
+        tkhd, mdia = _child(init, s, e, "tkhd"), _child(init, s, e, "mdia")
+        hdlr = mdia and _child(init, *mdia, "hdlr")
+        if tkhd and hdlr and init[hdlr[0] + 8:hdlr[0] + 12] == b"vide":
+            version = init[tkhd[0]]
+            return struct.unpack_from(">I", init, tkhd[0] + (20 if version == 1 else 12))[0]
+    return None
+
+
+def video_size(init: bytes) -> tuple[int, int] | None:
+    """Width and height from the init segment's avc1 sample entry."""
+    i = init.find(b"avc1")
+    if i < 0 or i + 4 + 28 > len(init):
+        return None
+    p = i + 4 + 24  # sample entry: 6 reserved + 2 data ref index + 16 pre_defined/reserved
+    return struct.unpack_from(">HH", init, p)
+
+
+class Mp4Splitter:
+    """Cuts a byte stream into the init segment and movie fragments (moof + mdat), whatever the read sizes."""
+
+    def __init__(self):
+        self.buf = bytearray()
+        self.init = bytearray()
+        self.have_init = False
+        self._moof: bytes | None = None
+
+    def feed(self, data: bytes) -> list[tuple[str, bytes]]:
+        """[("init", bytes) | ("fragment", bytes)] completed by this data."""
+        self.buf += data
+        out = []
+        while True:
+            if len(self.buf) < 8:
+                break
+            size, kind = struct.unpack_from(">I4s", self.buf, 0)
+            header = 8
+            if size == 1:
+                if len(self.buf) < 16:
+                    break
+                size = struct.unpack_from(">Q", self.buf, 8)[0]
+                header = 16
+            if size < header:
+                raise ValueError(f"bad MP4 box size {size}")
+            if len(self.buf) < size:
+                break
+            box = bytes(self.buf[:size])
+            del self.buf[:size]
+            kind = kind.decode("latin-1")
+            if not self.have_init:
+                self.init += box
+                if kind == "moov":
+                    self.have_init = True
+                    out.append(("init", bytes(self.init)))
+            elif kind == "moof":
+                self._moof = box
+            elif kind == "mdat" and self._moof is not None:
+                out.append(("fragment", self._moof + box))
+                self._moof = None
+            # other top-level boxes (styp, sidx, free) carry nothing a viewer needs
+        return out
+
+
+# ------------------------------------------------------------------------------------------------ relay
+def _end(q: queue.Queue) -> None:
+    """Tell a viewer's sender the stream is over: drop what it hasn't sent yet, then the end marker (None)."""
+    try:
+        while True:
+            q.get_nowait()
+    except queue.Empty:
+        pass
+    try:
+        q.put_nowait(None)
+    except queue.Full:
+        pass
+
+
+class Relay:
+    """Fan-out of one MP4 stream to any number of HTTP viewers."""
+
+    def __init__(self):
+        self._lock = threading.Lock()
+        self.init: bytes | None = None
+        self.video_track: int | None = None
+        self.gop: list[bytes] = []  # fragments since the last keyframe fragment (incl.)
+        self.clients: list[queue.Queue] = []
+        self.frames = 0
+        self.bytes = 0
+        self.started = time.time()
+        self.ended: str | None = None  # why the source stopped
+        self._splitter = Mp4Splitter()
+
+    def feed(self, data: bytes) -> None:
+        for kind, chunk in self._splitter.feed(data):
+            with self._lock:
+                self.bytes += len(chunk)
+                if kind == "init":
+                    self.init = chunk
+                    self.video_track = video_track_id(chunk)
+                    continue
+                self.frames += 1
+                if fragment_is_keyframe(chunk, self.video_track):
+                    self.gop = [chunk]
+                elif self.gop:
+                    self.gop.append(chunk)
+                for q in list(self.clients):
+                    try:
+                        q.put_nowait(chunk)
+                    except queue.Full:  # too slow: drop it, its page reconnects (never block: we hold the lock)
+                        self.clients.remove(q)
+                        _end(q)
+
+    def finish(self, reason: str) -> None:
+        with self._lock:
+            self.ended = reason
+            for q in self.clients:
+                _end(q)
+            self.clients.clear()
+
+    def subscribe(self) -> tuple[bytes | None, list[bytes], queue.Queue]:
+        q: queue.Queue = queue.Queue(CLIENT_QUEUE)
+        with self._lock:
+            self.clients.append(q)
+            return self.init, list(self.gop), q
+
+    def unsubscribe(self, q: queue.Queue) -> None:
+        with self._lock:
+            if q in self.clients:
+                self.clients.remove(q)
+
+    def status(self) -> dict:
+        with self._lock:
+            init = self.init
+            out = {"ready": init is not None, "ended": self.ended, "viewers": len(self.clients),
+                   "fragments": self.frames, "bytes": self.bytes, "seconds": round(time.time() - self.started, 1)}
+        if init:
+            out["codec"] = codec_string(init)
+            out["audio"] = b"mp4a" in init
+            size = video_size(init)
+            if size:
+                out["width"], out["height"] = size
+        return out
+
+
+def player_html() -> bytes:
+    from .live_player import PLAYER_HTML
+
+    return PLAYER_HTML.encode("utf-8")
+
+
+class _Handler(BaseHTTPRequestHandler):
+    server: _Server
+    protocol_version = "HTTP/1.1"
+
+    def log_message(self, fmt, *args):  # quiet
+        pass
+
+    def _send(self, code: int, body: bytes, ctype: str) -> None:
+        self.send_response(code)
+        self.send_header("Content-Type", ctype)
+        self.send_header("Content-Length", str(len(body)))
+        self.send_header("Cache-Control", "no-store")
+        self.end_headers()
+        self.wfile.write(body)
+
+    def do_GET(self):  # noqa: N802
+        path = self.path.split("?", 1)[0]
+        live = self.server.live
+        if path in ("/", "/index.html"):
+            self._send(200, player_html(), "text/html; charset=utf-8")
+        elif path == "/status":
+            self._send(200, json.dumps(live.relay.status()).encode(), "application/json")
+        elif path == "/stream.mp4":
+            self._stream(live.relay)
+        else:
+            self._send(404, b"not found", "text/plain")
+
+    def _stream(self, relay: Relay) -> None:
+        if relay.ended:
+            self._send(503, relay.ended.encode(), "text/plain")
+            return
+        init, gop, q = relay.subscribe()
+        try:
+            deadline = time.time() + 30
+            while init is None:  # the source hasn't sent its init segment yet
+                if relay.ended or time.time() > deadline:
+                    self._send(503, (relay.ended or "no picture yet").encode(), "text/plain")
+                    return
+                time.sleep(0.1)
+                relay.unsubscribe(q)
+                init, gop, q = relay.subscribe()
+            self.send_response(200)
+            self.send_header("Content-Type", "video/mp4")
+            self.send_header("Cache-Control", "no-store")
+            self.send_header("Transfer-Encoding", "chunked")
+            self.end_headers()
+            self._chunk(init)
+            for f in gop:
+                self._chunk(f)
+            while True:
+                try:
+                    f = q.get(timeout=5)
+                except queue.Empty:
+                    if relay.ended:
+                        break
+                    continue
+                if f is None:
+                    break
+                self._chunk(f)
+            self.wfile.write(b"0\r\n\r\n")
+        except (BrokenPipeError, ConnectionResetError, ConnectionAbortedError, OSError):
+            pass
+        finally:
+            relay.unsubscribe(q)
+
+    def _chunk(self, data: bytes) -> None:
+        self.wfile.write(f"{len(data):x}\r\n".encode() + data + b"\r\n")
+        self.wfile.flush()
+
+
+class _Server(ThreadingHTTPServer):
+    daemon_threads = True
+    allow_reuse_address = True
+    live: LiveStream
+
+
+# ------------------------------------------------------------------------------------------------ the Frame's side
+# SteamVR on the Frame runs `steamvr-v4l2cam.service` (Valve's v4l2cam): it copies the compositor's "headset view"
+# (what the wearer sees: games, SteamVR home, Steam's panels) into a v4l2loopback webcam named "SteamVR"
+# (/dev/video99, 1920x1080 RGB24, frames at the display rate). It costs nothing until someone reads it. Steam's own
+# recording/Remote Play capture gamescope instead (only the flat Steam UI in VR) and encode with x264 as well; the
+# Frame's Qualcomm encoder (qcom-iris) doesn't work with the stock ffmpeg/GStreamer. So: read the headset view, drop
+# to 30 fps before scaling, x264 at low priority, fragmented MP4 on stdout. Black while the headset sleeps.
+DEVICE_NAME = "SteamVR"
+# The headset view's size comes from SteamVR (1920x1080 on SteamOS 0.3.0; v4l2cam follows it, it has no size option),
+# so qualities are heights the picture is scaled *down* to (never up: a 2K/4K setting would only add bytes); "full"
+# sends it at its own size, whatever SteamVR makes it.
+QUALITY = {  # max height (None = the headset view's own), bitrate
+    "360p": (360, "1M"),
+    "480p": (480, "1500k"),
+    "720p": (720, "3M"),
+    "1080p": (1080, "6M"),
+    "full": (None, "10M"),
+}
+DEFAULT_QUALITY = "720p"
+FPS = 30
+# Clocks: pulse stamps audio with the wall clock, v4l2 with CLOCK_MONOTONIC → `-ts mono2abs` puts the picture on the
+# wall clock too. (Forcing -use_wallclock_as_timestamps on the pulse input gave bursts of AAC packets one shared time,
+# a broken audio timeline.) aresample=async=1 keeps the sound continuous across hiccups.
+AUDIO_BITRATE = "128k"  # AAC of the Frame's default output's monitor = what the headset plays (Lepton/Proton games)
+ENCODER_THREADS = 3  # leaves the game most of the CPU
+
+
+def source_command(quality: str = DEFAULT_QUALITY, fps: int = FPS) -> str:
+    """Shell script for the Frame: finds the headset-view device, streams fMP4 (H.264, + AAC sound of the
+    default output when there is one) to stdout and stops when the SSH channel closes (stdin reaches EOF).
+    Exit 3 = no headset view device (SteamVR not running)."""
+    h, rate = QUALITY.get(quality, QUALITY[DEFAULT_QUALITY])
+    # width -2 keeps the aspect ratio (even, as yuv420p needs); full size only drops an odd last row/column
+    scale = (",crop=trunc(iw/2)*2:trunc(ih/2)*2" if h is None
+             else f",scale=-2:'min({h},ih)':flags=fast_bilinear")
+    return f"""dev=
+for d in /sys/class/video4linux/video*; do
+  [ "$(cat "$d/name" 2>/dev/null)" = "{DEVICE_NAME}" ] && dev=/dev/${{d##*/}} && break
+done
+if [ -z "$dev" ]; then echo "no SteamVR headset view device: is SteamVR running?" >&2; exit 3; fi
+exec 3<&0
+export XDG_RUNTIME_DIR=${{XDG_RUNTIME_DIR:-/run/user/$(id -u)}}  # (an SSH session may lack it: PipeWire's socket)
+audio=(-an)
+sink=$(pactl get-default-sink 2>/dev/null)
+if [ -n "$sink" ]; then
+  audio=(-thread_queue_size 1024 -f pulse -fragment_size 3840 -i "$sink.monitor"
+         -map 0:v -map 1:a -af aresample=async=1 -c:a aac -b:a {AUDIO_BITRATE} -ac 2 -ar 48000)
+fi
+nice -n 10 ffmpeg -nostdin -hide_banner -loglevel error \\
+  -thread_queue_size 64 -ts mono2abs -f v4l2 -input_format rgb24 -i "$dev" "${{audio[@]}}" \\
+  -vf "fps={fps}{scale},format=yuv420p" -c:v libx264 -preset ultrafast -tune zerolatency -threads {ENCODER_THREADS} \\
+  -g {fps} -b:v {rate} -maxrate {rate} -bufsize {rate} \\
+  -f mp4 -movflags empty_moov+default_base_moof -frag_duration 100000 - &
+pid=$!
+( cat <&3 >/dev/null; kill $pid 2>/dev/null ) >/dev/null 2>&1 &  # (a background job's own stdin is /dev/null)
+wait $pid
+"""
+
+
+class FrameSource:
+    """The stdout of `source_command` on the Frame, on its own SSH channel of the existing connection."""
+
+    def __init__(self, frame, quality: str):
+        self.frame = frame
+        self.quality = quality
+        self.chan = None
+
+    def open(self):
+        transport = self.frame.client.get_transport()
+        if transport is None or not transport.is_active():
+            raise ConnectionError("not connected to the Frame")
+        self.chan = transport.open_session()
+        from ..frame.connection import sh_quote
+
+        self.chan.exec_command("bash -c " + sh_quote(source_command(self.quality)))
+        return self
+
+    def read(self, n: int) -> bytes:
+        data = self.chan.recv(n)
+        if not data:
+            err = b""
+            while self.chan.recv_stderr_ready():
+                err += self.chan.recv_stderr(4096)
+            if err.strip():
+                raise RuntimeError(err.decode("utf-8", "replace").strip().splitlines()[-1])
+        return data
+
+    def close(self) -> None:
+        if self.chan is not None:
+            try:
+                self.chan.shutdown_write()  # EOF on the script's stdin: it stops ffmpeg
+            finally:
+                self.chan.close()
+
+
+def start(frame, quality: str = DEFAULT_QUALITY) -> LiveStream:
+    """Start streaming the Frame's headset view; open `.url` in a browser to watch."""
+    src = FrameSource(frame, quality)
+    return LiveStream(src.open, src.close).start()
+
+
+class LiveStream:
+    """One live view: the source command on the Frame + the local relay server.
+
+    `open_source()` returns a file-like object with `read(n)`; it's the stdout of a command on the Frame (or, in tests,
+    a local process). `stop()` ends both.
+    """
+
+    def __init__(self, open_source, close_source=None, host: str = "127.0.0.1", port: int = 0):
+        self._open_source = open_source
+        self._close_source = close_source
+        self.relay = Relay()
+        self.server = _Server((host, port), _Handler)
+        self.server.live = self
+        self._threads: list[threading.Thread] = []
+        self._stop = threading.Event()
+        self.on_end = None  # callback(reason) when the source stops by itself
+
+    @property
+    def url(self) -> str:
+        host, port = self.server.server_address[:2]
+        return f"http://{host}:{port}/"
+
+    def start(self) -> LiveStream:
+        t1 = threading.Thread(target=self.server.serve_forever, name="live-http", daemon=True)
+        t2 = threading.Thread(target=self._pump, name="live-source", daemon=True)
+        self._threads = [t1, t2]
+        t1.start()
+        t2.start()
+        return self
+
+    def _pump(self) -> None:
+        reason = "stopped"
+        try:
+            src = self._open_source()
+            while not self._stop.is_set():
+                data = src.read(65536)
+                if not data:
+                    reason = "the Frame stopped sending a picture"
+                    break
+                self.relay.feed(data)
+        except Exception as exc:  # noqa: BLE001
+            from ..errors import explain
+
+            reason = explain(exc)
+        if self._stop.is_set():
+            reason = "stopped"
+        self.relay.finish(reason)
+        if not self._stop.is_set() and self.on_end:
+            self.on_end(reason)
+
+    @property
+    def running(self) -> bool:
+        return not self._stop.is_set() and self.relay.ended is None
+
+    def stop(self) -> None:
+        if self._stop.is_set():
+            return
+        self._stop.set()
+        if self._close_source:
+            try:
+                self._close_source()
+            except Exception:  # noqa: BLE001
+                pass
+        self.relay.finish("stopped")
+        self.server.shutdown()
+        self.server.server_close()
@@ -38,6 +38,7 @@
 "108 Hz": "",
 "120 Hz": "",
 "144 Hz": "",
+ "360p (lightest)": "",
 "360° (equirect) layers, e.g. a video player's virtual theatre or 360° videos (e.g. 4XVR), which the Frame's runtime lacks, are drawn by a background thread into a layer behind the game's own picture: the 360° image is converted only when it changes (a theatre once, a 360° video once per video frame) and the view is drawn for each frame's head pose. GLES games only; without it these layers are missing (black).": "",
 "360° 3D": "",
 "360° detail": "",
@@ -46,6 +47,7 @@
 "360° sharpness": "",
 "360° video frame rate limit": "",
 "72 Hz": "",
+ "720p (recommended)": "",
 "80 Hz": "",
 "90 Hz": "",
 "920 × 430": "",
@@ -58,6 +60,7 @@
 "A Meta Quest game (APK). It's rebuilt for the Frame and runs in Lepton, Valve's Android container.": "",
 "A native Linux program built for arm64 (aarch64), like the Frame's own CPU. It's installed unchanged and runs directly on SteamOS (no Android container, no Proton), started from the Frame's Steam library. VR apps use the Frame's OpenXR runtime.": "",
 "A new FramePort version is ready to install": "",
+ "A newer known-good config for this game is available (you changed this game's settings, so it wasn't applied by itself).": "",
 "A recipe is the list of patches FramePort applies to a game before installing it. Known-good recipes were tested on a Frame; the others are suggested from the game's engine and VR API. Hover a patch for why it's there.": "",
 "A VR app made for another Android headset. OpenXR apps are translated like Quest games; apps built on a headset maker's own SDK (Pico, HTC Wave) can't run on the Frame.": "",
 "A Windows game without VR, added with \"Add one game folder…\". On the Frame, Proton runs it as a window (like Steam's own Windows games); it's in the Frame's Steam library.": "",
@@ -182,6 +185,7 @@
 "Choose PNG, JPEG or WebP images. Steam fills any missing shape from the ones you choose; FramePort never replaces your images automatically.": "",
 "Choose…": "",
 "Chosen by you.": "",
+ "Clamp image rects": "",
 "Clean up Frida leftovers in smali": "",
 "Cleans up graphics data that crashes some Unreal games on the Frame.": "",
 "Clear": "",
@@ -232,6 +236,7 @@
 "Couldn't read the file list: {exc}": "",
 "Couldn't read the Frame's folders: {exc}": "",
 "Couldn't read {path}: {exc}": "",
+ "Couldn't start the live view: {exc}": "",
 "Couldn't use {choice}: {exc}": "",
 "Cover": "",
 "Create": "",
@@ -261,6 +266,7 @@
 "Details": "",
 "Dev builds let you test fixes before they're released. They're less tested than releases and may have bugs. You get the next release as a normal update (you have {version}).": "",
 "Developer Mode (on the Frame: Settings → System → Developer) lets FramePort find the Frame on your network and connect to it over SSH. The first-time setup command turns it on for you.": "",
+ "Diagnostics: the Vulkan shim (frame.vk_sanitize) adds Khronos' validation layer to the game's instance; its findings go to launch.log. The layer library (libVkLayer_khronos_validation.so) must be in the APK.": "",
 "Didn't finish ({value}): {error}": "",
 "Disable application space warp if used": "",
 "Disable controller tracking offset": "",
@@ -300,6 +306,7 @@
 "Download…": "",
 "Draws each eye separately; try it when one eye shows a grey or broken picture.": "",
 "Drop invalid layers": "",
+ "Drop layer color fades": "",
 "Drop layers whose swapchain failed or whose extension isn't enabled.": "",
 "Drop to upload": "",
 "Drops Quest-only shared library requirements.": "",
@@ -338,11 +345,14 @@
 "Find automatically": "",
 "firewalld is active. Allow the setup port until the next restart with: sudo firewall-cmd --add-port={port}/tcp": "",
 "First-time setup": "",
+ "Fix depth flicker (Unreal Vulkan)": "",
+ "Fix freezes when controllers vibrate": "",
 "Fix launcher icon entry": "",
 "Fix minimal Android SDK": "",
 "Fix UE4 crash with Unity stub": "",
 "Fix upside-down menus": "",
 "Fixes graphics code that the Frame's drivers reject (black screen with sound).": "",
+ "Fixes the black picture in Minecraft launchers (e.g. QuestCraft): uses depth formats the Frame's graphics driver accepts.": "",
 "Flat": "",
 "focus_hold hides focus dips up to this long (100-5000). Longer for a headset whose wear sensor flickers (\"HMD off\" for 0.5-2 s while worn, e.g. Blade & Sorcery pausing); taking the headset off or the system menu pauses the game only after this long.": "",
 "Folder": "",
@@ -353,13 +363,18 @@
 "Folder with VR games (Android APKs or PC VR games)": "",
 "For apps that only know Quest 3/Pro controllers: without it they get no buttons.": "",
 "For games that crash right after you return to them (e.g. after the Steam menu).": "",
+ "For games that freeze the Frame when a controller vibrates (e.g. Lucky's Tale). Needs a rebuild.": "",
+ "For games that judder or shimmer while you hold your head still (e.g. I Am Cat).": "",
 "For games that pause or recenter when the headset briefly loses focus.": "",
 "For games that show the headset's own controllers. Takes effect after a reinstall.": "",
 "For games whose menus or screens jump to wherever you look.": "",
 "For heavy games that use application space warp: it causes artifacts or hangs on non-Quest runtimes (e.g. Asgard's Wrath 2, Batman: Arkham Shadow).": "",
 "For mixed-reality-only games. On the Frame, passthrough is emulated by the FrameBridge adapter (greyscale cameras).": "",
 "For one eye looking wrong (e.g. a jittering right eye): logs each eye's submitted pose against a fresh one, the eye-to-eye relation and when each eye's image was released, also into framebridge.log in the game's storage (some games stop Android's log early). No effect on the game.": "",
+ "For troubleshooting: records the game's requests to Meta's platform services and which ones never get an answer.": "",
 "For Unreal games that close themselves right after starting (e.g. Phantom: Covert Ops). Also disables the in-game Quit.": "",
+ "For Unreal games whose models flicker or show through walls and windows on the Frame (e.g. Into The Radius 2). Needs a rebuild.": "",
+ "For Vulkan games whose models flicker or vanish while you look at them (e.g. Into The Radius 2). Needs a rebuild.": "",
 "Force enable passthrough": "",
 "Found": "",
 "Frame agent": "",
@@ -399,6 +414,7 @@
 "Freed {value:.1f} GiB on the Frame": "",
 "From the tested recipe for this game": "",
 "From the {src}": "",
+ "Full (headset view size)": "",
 "Full launch log": "",
 "Game": "",
 "Game arguments (select SteamVR / OpenXR)": "",
@@ -423,8 +439,12 @@
 "GiB": "",
 "Gives older Quest games a newer version of Meta's VR plugin that can be converted.": "",
 "GL shim (Mesa GLSL compatibility)": "",
+ "GL shim for Unity (no multisampled render-to-texture)": "",
+ "GL shim only: hide GL_EXT_multisampled_render_to_texture(2) (Zink crashes rendering Unity's runtime MSAA eye buffer through it, e.g. The Room VR).": "",
 "GL shim only: hide GL_OVR_multiview so all passes use single-view shaders. For GLES games whose multiview shaders fail on single-view render targets (e.g. Path of the Warrior).": "",
+ "GL shim: hide multisampled render-to-texture": "",
 "GL shim: hide multiview": "",
+ "GL wrapper: OpenGL ES depth formats (Minecraft)": "",
 "Go to my library": "",
 "Go to System and turn on \"Enable Developer Mode\". A Developer page appears in Settings; nothing else changes, your games and data stay as they are.": "",
 "Graphics": "",
@@ -434,7 +454,7 @@
 "Hide Quest foveation": "",
 "Hides Android's back/home/recents buttons, which cover the app's own buttons.": "",
 "Hides Quest foveation extensions the Frame runtime lacks.": "",
- "Hides the Frame's brief focus dips (up to a second) once the game has been focused for a second. For games that recentre or pause every time focus returns.": "",
+ "Hides the Frame's brief focus dips (up to focus_hold_ms) once the game has been focused for a second. On by default: the Frame's wear sensor flickers \"HMD off\" for 0.5-2 s while worn, and many games pause or recentre every time (e.g. Blade & Sorcery, Lucky's Tale).": "",
 "Hides XR_FB_space_warp, so the game renders every frame itself instead of half of them plus motion vectors (Application SpaceWarp). For games whose picture flickers or smears on the Frame (e.g. Unreal Engine 5 games such as Into The Radius 2).": "",
 "High": "",
 "Higher is sharper but needs more power.": "",
@@ -499,6 +519,7 @@
 "Keep game saves on the Frame": "",
 "Keep menus in place": "",
 "Keeps a smoothing setting off that the game turns on itself and that can freeze the Frame.": "",
+ "Keeps every submitted image rect inside its swapchain. Unity can size the eye area a few pixels past the image on some Frames; SteamVR then rejects every frame (xrEndFrame -25, XR_ERROR_SWAPCHAIN_RECT_INVALID) and the game stops drawing (e.g. PowerWash Simulator stuck at \"Waiting\").": "",
 "Keeps one label so the title is stable.": "",
 "Keeps one name for the game, so it shows the same everywhere.": "",
 "Keyboard connected to {label}.": "",
@@ -541,12 +562,16 @@
 "Linux": "",
 "Linux app (arm64)": "",
 "Linux VR app · OpenXR": "",
+ "Live": "",
+ "Live view": "",
 "Loading…": "",
 "Loads FramePort's OpenXR layer under Proton on the Frame. The Frame's SteamVR runtime only accepts OpenXR 1.0 apps, but Proton's VR helper asks for 1.1, so without the layer VR never starts (the game shows as a flat window, or Revive fails with 'Unable to load LibOVRRT DLL'); the layer retries as 1.0. It also emulates xrConvertTimespecTimeToTimeKHR if a runtime refuses it. Ignored on this PC.": "",
 "Loads libglshim.so ahead of libEGL in every engine library that fetches GL through eglGetProcAddress. Fixes Quest-only leniency that Mesa/Zink rejects: #pragma before #extension, implicit int/float conversions (enables GL_EXT_shader_implicit_conversions), and multiview shaders used on single-view framebuffers (hides GL_OVR_multiview; gl_hide_multiview=0 turns that off). Logs every failed shader with its source lines (logcat tag GLShim). Symptom: black screen with working audio in a GLES game.": "",
+ "Loads the GL shim into a Unity GLES game and hides GL_EXT_multisampled_render_to_texture (and the multiview variant). Some Unity games switch their eye buffer to 4x MSAA at runtime; the Frame only gives single-sampled swapchains, Unity then renders through multisampled render-to-texture and Mesa/Zink crashes (SIGSEGV in libgallium_dri.so on the render thread: grey or frozen screen, e.g. The Room VR). Hidden, Unity uses an ordinary MSAA buffer and resolves it. Unity's multiview stays on (gl_hide_multiview defaults to 0 here).": "",
 "Locations": "",
 "Logo": "",
 "Logs details for debugging: composition layers and swapchains, focus changes, play-space creation, pointer vs grip poses, refresh rates. No effect on the game.": "",
+ "Logs every Meta Platform SDK request the game makes (user, entitlement, cloud saves, ...) and the messages that answer them, and every 10 s the requests that never got an answer (logcat tag fp_ovrtrace, in launch.log). For games that wait forever on a loading screen (e.g. Vader Immortal after its intro). Changes nothing: every call goes to the real function.": "",
 "Longer for headsets that briefly think they're off your head.": "",
 "Looking for Frames on your network…": "",
 "Looking for the Frame on a USB cable (Developer Mode on, USB-C port connected to this computer).": "",
@@ -569,8 +594,10 @@
 "Menus and screens": "",
 "Meta Quest": "",
 "Meta XR Audio: skip Quest telemetry class": "",
- "Meta's OVRManager switches Unity to the headset's recommended MSAA level (4x) while the game runs, whatever its quality settings say (log: \"Switching to the recommended level\"). Multisampled render-to-texture on GLES can hang the Frame's GPU, up to a restart of the whole headset (e.g. Lucky's Tale in a menu). Rewrites OVRDisplay.recommendedMSAALevel -> 0 in libil2cpp.so (found with Cpp2IL), so MSAA stays off.": "",
+ "Meta's OVRManager switches Unity to the headset's recommended MSAA level (4x) while the game runs, whatever its quality settings say (log: \"Switching to the recommended level\"). Multisampled render-to-texture on GLES can hang the Frame's GPU, up to a restart of the whole headset (e.g. Lucky's Tale in a menu) or a crash of its GL driver (e.g. The Room VR, whose own code sets 4x). Rewrites OVRDisplay.recommendedMSAALevel -> 0 and makes QualitySettings.antiAliasing's setter do nothing in libil2cpp.so (found with Cpp2IL), so MSAA stays off.": "",
+ "Meta's OVROverlay copies a texture into its own compositor layer every frame. For some games (e.g. The Room VR's screen fade, a 4x4 overlay) that copy crashes the Frame's GL driver: SIGSEGV in libgallium_dri.so on Unity's render thread right after a tiny xrCreateSwapchain, grey or frozen screen. Rewrites OVROverlay.PopulateLayer -> false in libil2cpp.so (found with Cpp2IL): overlays are skipped (fades become instant cuts, overlay splash screens don't show). Only for games with this crash: menus drawn as overlays would disappear too.": "",
 "MiB": "",
+ "Minecraft asks for desktop OpenGL's GL_DEPTH_COMPONENT32 depth textures. Some builds of LTW, the OpenGL-to-OpenGL ES wrapper in Minecraft launchers such as QuestCraft, pass that on unchanged; Quest's driver accepts it, the Frame's Mesa rejects it (GL_INVALID_OPERATION in glTexImage2D), so the depth buffer never exists and the picture stays black. LTW then loads OpenGL ES through a small shim that asks for GL_DEPTH_COMPONENT32F (or 24-bit) instead.": "",
 "Mirrored": "",
 "Mixed reality": "",
 "Mixed-reality games that build their level from your room get a simple room with walls.": "",
@@ -586,6 +613,7 @@
 "Needs Windows (or WSL on Windows)": "",
 "Neutralises Meta XR Audio's Quest-only calls (Unity/Wwise).": "",
 "never": "",
+ "New config applied: use Update on Frame to install it": "",
 "New folder": "",
 "New folder…": "",
 "New Frame? Run one command on it and FramePort does the rest. Did this once already? Your Frame appears under step 2.": "",
@@ -606,6 +634,7 @@
 "No release notes.": "",
 "No screenshots yet": "",
 "No Unreal crash reporter": "",
+ "no viewer open": "",
 "No Wi-Fi needed: for networks that block the setup, and faster game uploads": "",
 "No: a 2D app": "",
 "None": "",
@@ -619,6 +648,7 @@
 "Not offered by Steam on this Frame yet": "",
 "Not recommended: breaks games that load VrApi through OVRPlugin.": "",
 "Not set up": "",
+ "Not streaming": "",
 "Not verified on many games yet: try it if the game doesn't work without it.": "",
 "Notes (what you checked, known issues)": "",
 "Nothing found. Try a shorter or different name.": "",
@@ -652,8 +682,10 @@
 "Open": "",
 "Open game": "",
 "Open GitHub issue": "",
+ "Open viewer": "",
 "OpenGL ES games run on the Frame through Zink (OpenGL on top of Vulkan), which is stricter than Quest drivers. Vulkan games run natively.": "",
 "Opens a prefilled GitHub issue with this game's recipe, so it can join the built-in catalog (no account token needed; you review and submit it on GitHub). No game files or personal data are sent.": "",
+ "Opens the app straight in VR, skipping its flat launcher screen (turn off to use the launcher, e.g. to import new content).": "",
 "Opens this player's storage on the Frame (Files tab): upload videos into the folder it lists": "",
 "OpenXR runtime": "",
 "OR": "",
@@ -725,6 +757,7 @@
 "Put the Frame to sleep": "",
 "Put the Frame to sleep?": "",
 "Puts settings files next to the game on the Frame (e.g. to turn off an unsupported effect).": "",
+ "Quality": "",
 "Quest": "",
 "Quest games (Lepton)": "",
 "Quest ✓": "",
@@ -776,6 +809,7 @@
 "Removes Meta's old VR library when the game doesn't need it.": "",
 "Removes OVRPort's controller pose offset if controllers look misplaced.": "",
 "Removes requirements for Quest-only system parts.": "",
+ "Removes the color scale/bias (XR_KHR_composition_layer_color_scale_bias) from the game's layers, so the runtime doesn't apply it. The Frame's runtime allocates GPU memory for it every frame without freeing it, e.g. Vader Immortal leaked ~20 MB/s on its loading screen. Fades done this way no longer show.": "",
 "Removes the game from the Frame. Saves are kept, so a reinstall picks up where you left off.": "",
 "Removes the previous version kept after each reinstall and any leftover uploads. Games and saves aren't touched.": "",
 "Removes {title} from this PC's Steam library (Steam restarts once). The game folder isn't touched.": "",
@@ -783,6 +817,7 @@
 "Rename": "",
 "Rename {name}": "",
 "Rename…": "",
+ "Repeat xrLocateViews queries for the same display time get the first, fully tracked answer again. Games that ask several times per frame got slightly different poses and rendered parts of the frame with different heads: judder (e.g. I Am Cat; proposed by Klownicle, GitHub #8).": "",
 "Replace application label and icon": "",
 "Replaces libvrapi.so with a VrApi→OpenXR bridge (Android-XR-Bridge/OVRPort fork, GPL-3.0, patched for the Frame: GLES sessions, cylinder→quad layers, sRGB format fallback, 30 s VR-mode deadline, emulated time conversion). Needed when the engine calls VrApi itself instead of through OVRPlugin (e.g. The Climb 2, Path of the Warrior); OVRPort cannot translate those.": "",
 "Report a problem": "",
@@ -812,6 +847,7 @@
 "Room height": "",
 "Room width": "",
 "Rotate quads 180°": "",
+ "Routes OVRPlugin through FramePort's extension shim, which turns Meta's amplitude-envelope vibrations into plain ones: OVRPort's loader reads their nanosecond duration as seconds and allocates gigabytes, freezing the Frame when the game vibrates a controller (e.g. Lucky's Tale's save slots, GitHub #9). Needs a rebuild.": "",
 "Runs directly — no Revive needed": "",
 "Runs natively on SteamOS, started from the Frame's Steam library": "",
 "Runs Oculus PC games on OpenXR": "",
@@ -891,6 +927,7 @@
 "Skips a Quest-only reporting step in Meta's audio library that crashes some games.": "",
 "Skips Meta XR Audio's telemetry under x86_64 ARM translation (emulators). Not needed on the Frame, which runs games natively.": "",
 "Sleep": "",
+ "Some apps open a flat Android launcher that then starts a separate VR activity (e.g. WiiCompiled). Shown with Lepton's flat window, that window stays in view after the VR part starts. This makes the VR activity the one Lepton starts (its LAUNCHER category), so the app opens in VR with no flat window. Everything only the launcher does (choosing or importing content) is skipped: turn it off for a run when you need the launcher, and turn off \"Show the app's Android window\".": "",
 "Some engines leave the pNext of unused Vulkan attachment references uninitialized. The Frame's driver never reads it, but Lepton always loads Steam's Fossilize shader-cache layer, which follows it and crashes on the first frame (SIGSEGV in libVkLayer_fossilize.so from FVulkanRenderPass, e.g. Deadpool VR). Loads Vulkan through a small shim that keeps valid pointers and drops only unreadable ones or ones pointing at the wrong structure type.": "",
 "Some game folders are already set up for SteamVR: a Revive copy (LibRevive64.dll) next to the game, started by a small loader DLL (e.g. xinput1_3.dll) that Windows loads from the game's folder. Then FramePort starts the game program directly — like double-clicking it — instead of through its own Revive (two Revives conflict; e.g. the Oculus Platform check then fails). On the Frame, Wine is told to use those loader DLLs from the game folder instead of its own.": "",
 "Some games need a second build with different OVRPort patches (for some Unreal games: one with Unreal's ForceQuit removed). Turn this on to install that build instead.": "",
@@ -900,16 +937,21 @@
 "Source": "",
 "square, 256 × 256": "",
 "Standard for every game": "",
+ "Start live view": "",
+ "Start straight in VR (skip the 2D launcher)": "",
 "Starting SteamVR and {title} — put your headset on": "",
+ "Starting the stream on the Frame…": "",
 "Starting {title} on the Frame — put the headset on": "",
 "Starting {title}, but SteamVR isn't running — it may open as a flat window. Start SteamVR and relaunch.": "",
 "Starting…": "",
+ "Starts a video stream on the Frame and opens it in your browser.": "",
 "Starts the game on the Frame while nobody is wearing it and reads the log: did it start, create a VR session and render frames. It can't check what you'd see: tracking only runs with the headset on.": "",
 "Starts the game through Steam on this PC (SteamVR + Revive)": "",
 "Starts the game through the Frame's Steam — put the headset on": "",
 "Starts the game with options, e.g. to choose SteamVR or OpenXR.": "",
 "Starts the game with the launcher that came with your copy.": "",
 "Status": "",
+ "Steadier head tracking": "",
 "Steady controller input after focus": "",
 "Steam": "",
 "Steam for Windows not found": "",
@@ -920,6 +962,11 @@
 "steamos@frame.local or an IP address": "",
 "SteamVR": "",
 "Stereo (3D) 360° layers: 0 = as the game sends them, 2 = flat (the left image to both eyes).": "",
+ "Stop": "",
+ "Stop objects popping in and out": "",
+ "Stopped: {why}": "",
+ "Stops a grey or frozen screen in Unity games that turn on anti-aliasing while running (e.g. The Room VR).": "",
+ "Stops a grey screen crash in some Unity games by skipping their overlay layers (e.g. The Room VR's screen fades).": "",
 "Stops Meta's audio library from reporting to Meta (only matters on PC emulators).": "",
 "Stops some Unreal games from closing themselves right after starting.": "",
 "Stops strict debugging checks that make some games quit.": "",
@@ -952,6 +999,7 @@
 "The copy on your Frame differs from what FramePort would install now (the recipe or your game files changed). Update to install the new build; saves are kept.": "",
 "The CPU types the game ships code for. The Frame runs only 64-bit ARM (arm64-v8a); 32-bit-only games can't run on it.": "",
 "The download didn't finish. Check your internet connection.": "",
+ "The first picture takes a few seconds.": "",
 "The Frame can't show curved panels; this shows them as gently bent strips.": "",
 "The Frame goes to sleep in a few seconds. Wake it with its power button.": "",
 "The Frame goes to sleep now.": "",
@@ -974,8 +1022,10 @@
 "the game didn't pass its checks (see the list above)": "",
 "the installed game (APK and its data)": "",
 "The launch settings changed since it was installed: update the Steam shortcut": "",
+ "The live view can start once FramePort is connected to the Frame.": "",
 "the log of the last start": "",
 "The PC VR counterpart of OVRPort's 'Patch Oculus detection for Unreal'. Unreal's Oculus plugin only starts when the Oculus service announces a headset (the Windows event 'OculusHMDConnected'); without it the game runs as a flat window. On the Frame the launcher runs the game through FramePort's small helper (fp_oculushmd.exe) that provides that event while the game runs, instead of relying only on Revive's hook of the check. Ignored on this PC (the Oculus app or Revive handle it there).": "",
+ "The picture opens in your default web browser, where it plays smoothly and can go full screen. It shows the headset's view with its sound (click Sound on in the player) whatever is running: Steam's menus, SteamVR or a game; while the headset sleeps the picture is black and updates about once a second. Streaming costs the Frame a little performance; stop it when you're done.": "",
 "the previous version, kept for one rollback": "",
 "The repack's own Revive · runs the game directly": "",
 "The small helper program FramePort runs on the Frame (installs, launch tests, Steam entries). It comes with this app and is replaced on the Frame automatically whenever it differs.": "",
@@ -1006,6 +1056,7 @@
 "Today": "",
 "Tools": "",
 "Tools are up to date": "",
+ "Trace Meta platform requests (diagnostics)": "",
 "Translator for games built on Meta's oldest VR interface.": "",
 "transparent PNG": "",
 "Treat newer Quest controllers as Touch": "",
@@ -1044,12 +1095,13 @@
 "Uninstall. ": "",
 "Uninstalled {title}": "",
 "Uninstalled {title} and deleted its files on this PC ({size})": "",
- "Unity 2017: start VR without Meta's system apps": "",
- "Unity's older built-in Oculus support (Unity 2017–2018) only starts VR when Android has Meta's com.oculus.systemactivities package; without it the game runs as a hidden 2D app (you see the Android home screen, e.g. Accounting+). Points that package name in libunity.so at \"android\", which always exists, and adds the frame wait its legacy frame loop never makes (libfp_ovrp.so calls ovrp_WaitToBeginFrame before ovrp_Update2; without it no frame starts and the dashboard freezes).": "",
+ "Unity's built-in Oculus support (Unity 2017–2019) only starts VR when Android has Meta's com.oculus.systemactivities package; without it the game runs as a 2D app (the Android home screen or a black window, e.g. Accounting+, BattleSisters). Points that package name in libunity.so at \"android\", which always exists. Games on Unity's built-in VR (2017–2018, and 2019 without the Oculus XR Plugin) also get the frame wait their legacy frame loop never makes (libfp_ovrp.so calls ovrp_WaitToBeginFrame before ovrp_Update2; without it no frame starts, the dashboard freezes or the GPU hangs). The shim also counts a newly pressed trigger or A/B/X/Y as a mouse click (Input.GetMouseButtonDown), which Go-era screens wait for (e.g. Accounting+'s motion warning) and which Lepton never delivers.": "",
 "Unity's TMP_InputField / InputField wait for Android's on-screen keyboard and close themselves a frame later when there is none (Lepton has no on-screen keyboard; Meta's system keyboard does this on a Quest), so a selected text field only flashes a caret. Rewrites TouchScreenKeyboardShouldBeUsed -> false and isKeyboardUsingEvents (TMP) / InPlaceEditing (uGUI) -> true in libil2cpp.so, found per game with Cpp2IL (downloaded on first use), so fields stay selected and take key presses: Steam's keyboard (with \"Show the app window\") or Type on Frame from the PC.": "",
 "Unity: disable MSAA": "",
 "Unity: keep MSAA off at runtime (OVRManager)": "",
 "Unity: render each eye separately (no multiview)": "",
+ "Unity: skip OVROverlay layers (fades, splash screens)": "",
+ "Unity: start VR without Meta's system apps": "",
 "Unknown date": "",
 "Unreal builds of Meta XR Audio abort ('ClassNotFoundException com.oculus.os.AnalyticsEvent') on non-Quest devices. Patches that one JNI FindClass call so the library continues (e.g. NOPE Challenge).": "",
 "Unreal games start CrashReportClient when they crash, which leaves a crash dialog instead of simply closing. This passes -nocrashreports to the game and, on the Frame, renames the game's copy of CrashReportClient.exe so it can't start (your game files on this PC aren't changed).": "",
@@ -1085,6 +1137,7 @@
 "Upside down and mirrored": "",
 "Use controllers": "",
 "Use tags to group and filter your library": "",
+ "Use the new config": "",
 "Use the repack's launcher (bundled Revive)": "",
 "Use this computer's keyboard on the Frame": "",
 "Use this program": "",
@@ -1104,11 +1157,15 @@
 "Videos, documents, mods and saves on your Steam Frame": "",
 "View": "",
 "View screenshot": "",
+ "Viewer address on this PC: {url}": "",
 "VR (OpenXR)": "",
 "VrApi → OpenXR adapter (OVRPort)": "",
 "VrApi → OpenXR bridge": "",
 "Vulkan shader fixes": "",
+ "Vulkan shim (frame.vk_sanitize): makes two Unreal habits valid Vulkan - depth images get VK_IMAGE_USAGE_TRANSFER_DST_BIT (they are cleared with vkCmdClearDepthStencilImage) and Qualcomm shader-resolve subpasses lose an invalid depth resolve. Found with the validation layer in Into The Radius 2 (flickering models, windows behind models).": "",
+ "Vulkan shim (frame.vk_sanitize): on gives every occlusion query room for both eyes. In multiview passes the Frame's driver writes a zero result for the second eye into the next query, so engines that count on one slot cull visible objects (models popping in and out, e.g. Into The Radius 2). 0 = off, 1 = on (2 slots).": "",
 "Vulkan shim (frame.vk_sanitize): SPIR-V modules matching size + SHA-256 get words inserted at a byte offset, e.g. stores that initialize locals a shader reads before writing (an undefined loop counter hung the GPU in VR4's campaign). Format: <size>:<sha256>:<byte offset>:<word>,<word>,...; several separated by ';'. Comes from a game's recipe.": "",
+ "Vulkan shim: validation layer": "",
 "Vulkan: drop invalid render-pass pointers": "",
 "v{remote} (updates on the next action)": "",
 "Wait for the game's GPU before showing an image": "",
@@ -1118,6 +1175,7 @@
 "Waiting for the Frame": "",
 "Waiting for your Frame": "",
 "Waiting for your Frame… (code {code})": "",
+ "Watch what the headset shows, in a window on this PC": "",
 "Welcome to FramePort": "",
 "What FramePort will do": "",
 "What happens? (optional: you can also write it on GitHub)": "",
@@ -1237,7 +1295,12 @@
  "",
  ""
 ],
+ "{n} viewer": [
+  "",
+  ""
+ ],
 "{on} on your Frame": "",
+ "{rate}/s": "",
 "{remaining} more after this": "",
 "{title} couldn't be added to the Frame's Steam library: {why}": "",
 "{title} failed: {error}": "",
@@ -68,7 +68,8 @@ def needs_xrshim(recipe_patches: dict) -> bool:
    """Adapter features whose functions OVRPort's dispatcher doesn't forward (it only knows a fixed table)."""
    from ..settings import adapter_settings

-    return bool(adapter_settings(recipe_patches).get("controller_models"))
+    s = adapter_settings(recipe_patches)
+    return bool(s.get("controller_models") or s.get("haptic_fix"))


 def add_xrshim(ctx: ApkContext) -> bool:
@@ -0,0 +1,54 @@
+"""Depth formats for LTW, the GL-to-GLES wrapper of Minecraft launchers (QuestCraft): native/glshim/eglfmt.c."""
+from __future__ import annotations
+
+from ...analysis import elf
+from ..base import ApkContext, Patch, Suggestion, register
+from . import artifact
+
+LTW = "libltw.so"
+EGL = "libEGL.so"
+SHIM = "libfpg.so"  # not longer than "libEGL.so": LTW's dlopen string is rewritten in place (.rodata only)
+
+
+class LtwDepthFormats(Patch):
+    id = "frame.ltw_depth"
+    needs_vr = False
+    title = "GL wrapper: OpenGL ES depth formats (Minecraft)"
+    description = ("Minecraft asks for desktop OpenGL's GL_DEPTH_COMPONENT32 depth textures. Some builds of LTW, the "
+                   "OpenGL-to-OpenGL ES wrapper in Minecraft launchers such as QuestCraft, pass that on unchanged; "
+                   "Quest's driver accepts it, the Frame's Mesa rejects it (GL_INVALID_OPERATION in glTexImage2D), so "
+                   "the depth buffer never exists and the picture stays black. LTW then loads OpenGL ES through a "
+                   "small shim that asks for GL_DEPTH_COMPONENT32F (or 24-bit) instead.")
+    order = 74
+    default_on = True
+
+    def applies(self, a):
+        return LTW in a.libs
+
+    def detect(self, a):
+        if self.applies(a):
+            return Suggestion(True, "Ships LTW (Minecraft's OpenGL-to-OpenGL ES wrapper): Minecraft's 32-bit depth "
+                                    "textures need the OpenGL ES format on the Frame (e.g. QuestCraft).")
+        return None
+
+    def apply(self, ctx: ApkContext) -> bool:
+        ws = ctx.ws
+        if ws.abi != "arm64-v8a" or not ws.has(ws.lib(LTW)):
+            return False
+        data, count = elf.replace_rodata_string(ws.read_lib(LTW), EGL, SHIM)
+        if not count:
+            return False
+        ws.put(ws.lib(LTW), data)
+        ws.put(ws.lib(SHIM), artifact(ws.abi, SHIM))
+        ctx.notes.append(f"{LTW} loads OpenGL ES through {SHIM}")
+        return True
+
+    def validate(self, ctx: ApkContext):
+        ws = ctx.ws
+        if not ws.has(ws.lib(LTW)):
+            return []
+        uses = b"\0" + SHIM.encode() + b"\0" in ws.read_lib(LTW)
+        return [("LTW loads the depth-format shim", uses and ws.has(ws.lib(SHIM)), SHIM)]
+
+
+register(LtwDepthFormats)
@@ -2,7 +2,7 @@
 from __future__ import annotations

 from ...apk import axml
-from ..base import ApkContext, Patch, Suggestion, register
+from ..base import ApkContext, Param, Patch, Suggestion, register

 MANIFEST = "AndroidManifest.xml"

@@ -96,6 +96,54 @@ class MetaPermissions(Patch):
        return bool(fixed)


+class StartActivity(Patch):
+    id = "frame.start_activity"
+    needs_vr = False
+    title = "Start straight in VR (skip the 2D launcher)"
+    description = ("Some apps open a flat Android launcher that then starts a separate VR activity (e.g. WiiCompiled). "
+                   "Shown with Lepton's flat window, that window stays in view after the VR part starts. This makes "
+                   "the VR activity the one Lepton starts (its LAUNCHER category), so the app opens in VR with no "
+                   "flat window. Everything only the launcher does (choosing or importing content) is skipped: turn "
+                   "it off for a run when you need the launcher, and turn off \"Show the app's Android window\".")
+    order = 22
+    params = [Param("activity", "str", "", "Activity to start (empty: the app's VR activity)")]
+
+    def applies(self, a):
+        return bool((a.extra or {}).get("vr_activity"))
+
+    def detect(self, a):
+        vr = (a.extra or {}).get("vr_activity")
+        if not vr:
+            return None
+        return Suggestion(False, f"The app opens a 2D launcher; its VR part is {vr.rsplit('.', 1)[-1]}. Turn on to "
+                                 "start that directly once the app is set up.")
+
+    def apply(self, ctx: ApkContext) -> bool:
+        manifest = ctx.ws.read(MANIFEST)
+        # the original APK's VR activity (analysis): after OVRPort's conversion every MAIN activity has the VR
+        # category, so the converted manifest no longer tells them apart
+        activity = ((ctx.params or {}).get("activity") or (ctx.analysis.extra or {}).get("vr_activity")
+                    or axml.vr_activity(manifest))
+        if not activity:
+            ctx.notes.append("no VR activity found")
+            return False
+        fixed = axml.set_start_activity(manifest, activity)
+        if fixed:
+            ctx.ws.put(MANIFEST, fixed)
+            ctx.notes.append(f"starts {activity}")
+        return bool(fixed)
+
+    def validate(self, ctx):
+        manifest = ctx.ws.read(MANIFEST)
+        names = axml.Axml(manifest).strings()
+        starts = [n for el, n, items in axml.component_filters(manifest) if el in ("activity", "activity-alias")
+                  and any(k == "category" and names[i] == axml.LAUNCHER for k, _, i in items)]
+        wanted = (ctx.params or {}).get("activity") or (ctx.analysis.extra or {}).get("vr_activity") or ""
+        ok = len(starts) == 1 and wanted.rsplit(".", 1)[-1] == starts[0].rsplit(".", 1)[-1]
+        return [("Only the VR activity is a launcher", ok, ", ".join(starts))]
+
+
 register(Launcher)
 register(NoDebuggable)
 register(MetaPermissions)
+register(StartActivity)
@@ -0,0 +1,65 @@
+"""Meta Platform SDK tracer (diagnostics): logs the game's ovr_* calls and their answers (native/ovrtrace)."""
+from __future__ import annotations
+
+from ...analysis import elf
+from ..base import ApkContext, Patch, register
+from . import artifact
+
+LIB = "libfp_ovrtrace.so"
+SKIP = ("libovrplatformloader", "libfp_", "libframe", "libopenxr", "libOVRPlugin", "libvrapi", "libc++")
+
+
+def ovr_importers(ws) -> list[str]:
+    """The game's libraries that call Meta Platform SDK functions (ovr_* imports)."""
+    out = []
+    for lib in ws.libs():
+        if lib.startswith(SKIP):
+            continue
+        data = ws.read_lib(lib)
+        if elf.is_elf(data) and any(s.startswith("ovr_") for s in elf.dyn_symbols(data, False)):
+            out.append(lib)
+    return out
+
+
+class OvrTrace(Patch):
+    id = "frame.ovr_trace"
+    title = "Trace Meta platform requests (diagnostics)"
+    description = ("Logs every Meta Platform SDK request the game makes (user, entitlement, cloud saves, ...) and the "
+                   "messages that answer them, and every 10 s the requests that never got an answer (logcat tag "
+                   "fp_ovrtrace, in launch.log). For games that wait forever on a loading screen (e.g. Vader "
+                   "Immortal after its intro). Changes nothing: every call goes to the real function.")
+    order = 95
+    needs_vr = False
+    experimental = True
+
+    def applies(self, a):
+        return "arm64-v8a" in a.abis and "libovrplatformloader.so" in a.libs
+
+    def detect(self, a):
+        return None  # diagnostics only, on request
+
+    def apply(self, ctx: ApkContext) -> bool:
+        ws = ctx.ws
+        if ws.abi != "arm64-v8a":
+            return False
+        libs = ovr_importers(ws)
+        for lib in libs:
+            data = ws.read_lib(lib)
+            if LIB not in elf.needed(data):
+                ws.put(ws.lib(lib), elf.add_needed(data, LIB))
+        if libs:
+            ws.put(ws.lib(LIB), artifact(ws.abi, LIB))
+            ctx.notes.append(f"Meta platform calls traced in {', '.join(libs)}")
+        return bool(libs)
+
+    def validate(self, ctx: ApkContext):
+        ws = ctx.ws
+        traced = []
+        for lib in ws.libs():
+            data = b"" if lib.startswith(SKIP) else ws.read_lib(lib)
+            if elf.is_elf(data) and LIB in elf.needed(data):
+                traced.append(lib)
+        return [("Platform tracer loaded", bool(traced) and ws.has(ws.lib(LIB)), ", ".join(traced))] if traced else []
+
+
+register(OvrTrace)
@@ -5,6 +5,8 @@ Android home screen, e.g. Accounting+, Unity 2017.4). The package name in libuni
 installed): a same-length, in-place string edit; everything else about the check stays as it is."""
 from __future__ import annotations

+import os
+
 from ...analysis import elf
 from ..base import ApkContext, Patch, Suggestion, register
 from . import artifact
@@ -14,38 +16,95 @@ ALWAYS_THERE = "android"
 # Unity's legacy frame loop never calls ovrp_WaitToBeginFrame: its ovrp_Update2 lookup goes to native/ovrpshim
 SHIM = "libfp_ovrp.so"
 UPDATE, SHIM_UPDATE = "ovrp_Update2", "fpov_Update2"
+# Unity creates its XR controller devices for the hand nodes OVRPlugin reports present (logged/fixed by the shim)
+NODE, SHIM_NODE = "ovrp_GetNodePresent", "fpov_GetNodePresent"
 # input diagnostics (off): the C# P/Invoke names in libil2cpp.so pointed at the shim's wrappers, which log what they
 # return, report input focus as true and release buttons held > 2 s. Accounting+ still didn't pass "press any button"
 # with them (input reached the game cleanly), so they stay off; switch on to investigate another game.
-INPUT_PROBE = False
+INPUT_PROBE = os.environ.get("FRAMEPORT_INPUT_PROBE") == "1"  # diagnostic builds only
 INPUT_CALLS = ("ovrp_GetConnectedControllers", "ovrp_GetControllerState4", "ovrp_GetControllerState2",
               "ovrp_GetAppHasInputFocus")
 UNITY_INPUT_CALLS = ("ovrp_GetControllerState", "ovrp_GetControllerState2")


+ORR_W2_6 = 0x321F07E2  # orr w2, wzr, #6   (strncmp length 6)
+MOV_W2_0 = 0x52800002  # mov w2, #0        (strncmp length 0: always equal)
+
+
+def oculus_model_checks(data: bytes) -> tuple[bytes, int]:
+    """Unity's built-in Oculus input only reports controllers on a device whose model starts with "Oculus"
+    (strncmp(SystemInfo.deviceModel, "Oculus", 6), next to its Oculus Go check "Oculus Pacific"). Lepton's Android is
+    "Valve Lepton", so BattleSisters got no controller buttons. Every such compare (the literal loaded with adrp/add
+    right before `orr w2, wzr, #6`) gets length 0, so any device but the Go counts as an Oculus one. The "Oculus"
+    string itself stays: Unity also uses it as its VR device name."""
+    import struct
+
+    literal = data.find(b"\0Oculus\0") + 1
+    if literal <= 0:
+        return data, 0
+    buf, count = bytearray(data), 0
+    end = len(data) - len(data) % 4
+    for at in range(0, end, 4):
+        if struct.unpack_from("<I", data, at)[0] != ORR_W2_6:
+            continue
+        # look back for `adrp xA, page` + `add x1, xA, #off` that computes the literal's address
+        for back in range(4, 16, 4):
+            add = struct.unpack_from("<I", data, at - back)[0] if at >= back else 0
+            if add & 0xFFC00000 != 0x91000000 or add & 0x1F != 1:  # add x1, xN, #imm (no shift)
+                continue
+            rn, imm12 = (add >> 5) & 0x1F, (add >> 10) & 0xFFF
+            adrp_at = at - back - 4
+            adrp = struct.unpack_from("<I", data, adrp_at)[0] if adrp_at >= 0 else 0
+            if adrp & 0x9F000000 != 0x90000000 or adrp & 0x1F != rn:
+                continue
+            imm = ((adrp >> 5) & 0x7FFFF) << 2 | (adrp >> 29) & 3
+            if imm & (1 << 20):
+                imm -= 1 << 21
+            if (adrp_at & ~0xFFF) + (imm << 12) + imm12 == literal:
+                struct.pack_into("<I", buf, at, MOV_W2_0)
+                count += 1
+            break
+    return bytes(buf), count
+
+
 class UnityOculusCheck(Patch):
    id = "frame.unity_oculus_check"
-    title = "Unity 2017: start VR without Meta's system apps"
-    description = ("Unity's older built-in Oculus support (Unity 2017–2018) only starts VR when Android has Meta's "
-                   "com.oculus.systemactivities package; without it the game runs as a hidden 2D app (you see the "
-                   "Android home screen, e.g. Accounting+). Points that package name in libunity.so at \"android\", "
-                   "which always exists, and adds the frame wait its legacy frame loop never makes (libfp_ovrp.so "
-                   "calls ovrp_WaitToBeginFrame before ovrp_Update2; without it no frame starts and the dashboard "
-                   "freezes).")
+    title = "Unity: start VR without Meta's system apps"
+    description = ("Unity's built-in Oculus support (Unity 2017–2019) only starts VR when Android has Meta's "
+                   "com.oculus.systemactivities package; without it the game runs as a 2D app (the Android home "
+                   "screen or a black window, e.g. Accounting+, BattleSisters). Points that package name in "
+                   "libunity.so at \"android\", which always exists. Games on Unity's built-in VR (2017–2018, and 2019 "
+                   "without the Oculus XR Plugin) also get the frame wait their legacy frame loop never makes "
+                   "(libfp_ovrp.so calls ovrp_WaitToBeginFrame before ovrp_Update2; without it no frame starts, the "
+                   "dashboard freezes or the GPU hangs). The shim also counts a newly pressed trigger or A/B/X/Y as a "
+                   "mouse click (Input.GetMouseButtonDown), which Go-era screens wait for (e.g. Accounting+'s motion "
+                   "warning) and which Lepton never delivers.")
    order = 45
+    # 2: frame wait also for Unity 2019 without the Oculus XR Plugin; 3: controller presses as mouse clicks
+    # (ovrpshim); 4: Unity 2019's Oculus device-model checks (Touch controllers on Lepton)
+    revision = 4
+
+    @staticmethod
+    def _major(a) -> int:
+        return int(str((a.extra or {}).get("unity_version") or "0").split(".")[0] or 0)
+
+    @classmethod
+    def legacy_loop(cls, a) -> bool:
+        """Unity's built-in Oculus VR drives OVRPlugin without waiting for frames: Unity 2017-2018, and 2019 games
+        without the Oculus XR Plugin (BattleSisters flooded "outside of frame bounds" and hung the GPU). With
+        libOculusXRPlugin.so (XR Plugin Management, e.g. Lucky's Tale) the plugin waits itself."""
+        major = cls._major(a)
+        return 0 < major < 2019 or (major == 2019 and "libOculusXRPlugin.so" not in a.libs)

    def applies(self, a):
-        x = a.extra or {}
-        major = int(str(x.get("unity_version") or "0").split(".")[0] or 0)
-        # Unity 2019+ games run without it (e.g. Lucky's Tale 2019.4): their builds stay as they are
-        return a.engine == "Unity" and "libOVRPlugin.so" in a.libs and bool(x.get("unity_oculus_check")) \
-            and 0 < major < 2019
+        # any Unity with built-in Oculus support whose libunity.so has the check (BattleSisters, Unity 2019.4, stayed
+        # a 2D app without it); Lucky's Tale (2019.4) runs either way
+        return a.engine == "Unity" and "libOVRPlugin.so" in a.libs and bool((a.extra or {}).get("unity_oculus_check"))

    def detect(self, a):
        if self.applies(a):
-            return Suggestion(True, "Older Unity with built-in Oculus support: it checks for Meta's system apps "
-                                    "before starting VR, and its frame loop never waits for the next frame "
-                                    "(e.g. Accounting+).")
+            return Suggestion(True, "Unity with built-in Oculus support: it checks for Meta's system apps before "
+                                    "starting VR, else it runs as a 2D app (e.g. Accounting+, BattleSisters).")
        return None

    def apply(self, ctx: ApkContext) -> bool:
@@ -56,7 +115,15 @@ class UnityOculusCheck(Patch):
        data, count = elf.replace_rodata_string(ws.read(name), PACKAGE, ALWAYS_THERE)
        if not count:
            return False
-        data, loops = elf.replace_rodata_string(data, UPDATE, SHIM_UPDATE)
+        data, loops = elf.replace_rodata_string(data, UPDATE, SHIM_UPDATE) if self.legacy_loop(ctx.analysis) \
+            else (data, 0)
+        if loops and self._major(ctx.analysis) >= 2019:  # Accounting+ (2017) reads OVRInput: works without
+            data, models = oculus_model_checks(data)
+            if models:
+                ctx.notes.append(f"libunity.so: {models} Oculus device-model checks accept Lepton's model")
+            data, nodes = elf.replace_rodata_string(data, NODE, SHIM_NODE)
+            if nodes:
+                ctx.notes.append(f"libunity.so: {NODE} -> {SHIM_NODE}")
        plugin = ws.lib("libOVRPlugin.so")
        if loops and ws.abi == "arm64-v8a" and ws.has(plugin):
            ovrp = ws.read(plugin)
@@ -23,11 +23,16 @@ class UnityRuntimeMsaa(Il2cppReturnPatch):
    description = ("Meta's OVRManager switches Unity to the headset's recommended MSAA level (4x) while the game runs, "
                   "whatever its quality settings say (log: \"Switching to the recommended level\"). Multisampled "
                   "render-to-texture on GLES can hang the Frame's GPU, up to a restart of the whole headset (e.g. "
-                   "Lucky's Tale in a menu). Rewrites OVRDisplay.recommendedMSAALevel -> 0 in libil2cpp.so (found with "
-                   "Cpp2IL), so MSAA stays off.")
+                   "Lucky's Tale in a menu) or a crash of its GL driver (e.g. The Room VR, whose own code sets 4x). "
+                   "Rewrites OVRDisplay.recommendedMSAALevel -> 0 and makes QualitySettings.antiAliasing's setter do "
+                   "nothing in libil2cpp.so (found with Cpp2IL), so MSAA stays off.")
    order = 47
    targets = {"Oculus.VR/OVRDisplay.cs": {"get_recommendedMSAALevel": RET_ZERO},
-               "Assembly-CSharp/OVRDisplay.cs": {"get_recommendedMSAALevel": RET_ZERO}}  # older Oculus Integration
+               "Assembly-CSharp/OVRDisplay.cs": {"get_recommendedMSAALevel": RET_ZERO},  # older Oculus Integration
+               # the game's own code can raise MSAA too (The Room VR: QualitySettingsManager.SetMSAA with its
+               # platform's default 4): Unity's setter does nothing, the quality settings' 0 stays
+               "UnityEngine.CoreModule/UnityEngine/QualitySettings.cs": {"set_antiAliasing": RET_ZERO}}
+    revision = 2  # 0.11.0: also QualitySettings.set_antiAliasing (the game's own runtime MSAA crashed Zink)
    check_name = "Unity MSAA"

    def applies(self, a):
@@ -65,5 +70,27 @@ class UnityMultiPass(Il2cppReturnPatch):
        return None  # only for a game that shows the symptom (catalog recipe or the user's choice)


+class UnityNoOverlayCopy(Il2cppReturnPatch):
+    id = "frame.unity_no_overlay_copy"
+    title = "Unity: skip OVROverlay layers (fades, splash screens)"
+    description = ("Meta's OVROverlay copies a texture into its own compositor layer every frame. For some games "
+                   "(e.g. The Room VR's screen fade, a 4x4 overlay) that copy crashes the Frame's GL driver: SIGSEGV "
+                   "in libgallium_dri.so on Unity's render thread right after a tiny xrCreateSwapchain, grey or frozen "
+                   "screen. Rewrites OVROverlay.PopulateLayer -> false in libil2cpp.so (found with Cpp2IL): overlays "
+                   "are skipped (fades become instant cuts, overlay splash screens don't show). Only for games with "
+                   "this crash: menus drawn as overlays would disappear too.")
+    order = 49
+    targets = {"Oculus.VR/OVROverlay.cs": {"PopulateLayer": RET_ZERO},
+               "Assembly-CSharp/OVROverlay.cs": {"PopulateLayer": RET_ZERO}}  # older Oculus Integration
+    check_name = "Unity overlays"
+
+    def applies(self, a):
+        return a.engine == "Unity" and "libil2cpp.so" in a.libs and not a.only_32bit and "GLES" in a.graphics
+
+    def detect(self, a):
+        return None  # only for a game that shows the crash (catalog recipe or the user's choice)
+
+
 register(UnityRuntimeMsaa)
 register(UnityMultiPass)
+register(UnityNoOverlayCopy)
@@ -84,5 +84,29 @@ class GlShim(Patch):
        return True


+class UnityGlShim(GlShim):
+    id = "frame.unity_gl_shim"
+    title = "GL shim for Unity (no multisampled render-to-texture)"
+    description = (
+        "Loads the GL shim into a Unity GLES game and hides GL_EXT_multisampled_render_to_texture (and the multiview "
+        "variant). Some Unity games switch their eye buffer to 4x MSAA at runtime; the Frame only gives single-sampled "
+        "swapchains, Unity then renders through multisampled render-to-texture and Mesa/Zink crashes (SIGSEGV in "
+        "libgallium_dri.so on the render thread: grey or frozen screen, e.g. The Room VR). Hidden, Unity uses an "
+        "ordinary MSAA buffer and resolves it. Unity's multiview stays on (gl_hide_multiview defaults to 0 here).")
+    order = 62
+    requires = ()
+    experimental = False
+
+    def detect(self, a):
+        if self.applies(a) and ((a.extra or {}).get("ovr_runtime_msaa") or a.unity_msaa_levels):
+            return Suggestion(True, "Unity GLES game that may switch to MSAA at runtime: hide multisampled "
+                                    "render-to-texture, which crashes the Frame's GL driver (e.g. The Room VR).")
+        return None
+
+    def applies(self, a):
+        return a.engine == "Unity" and "GLES" in a.graphics and "arm64-v8a" in a.abis
+
+
 register(VrApiBridge)
 register(GlShim)
+register(UnityGlShim)
@@ -16,6 +16,10 @@ SETTINGS = [
    ("scale", "float", 1.0, "Resolution scale",
     "Multiplies the recommended eye-buffer width and height (0.5–2.0). 1.5 ≈ 2.25× pixels."),
    ("foveation_fix", "int", 1, "Hide Quest foveation", "Hides Quest foveation extensions the Frame runtime lacks."),
+    ("strip_color_bias", "int", 0, "Drop layer color fades",
+     "Removes the color scale/bias (XR_KHR_composition_layer_color_scale_bias) from the game's layers, so the runtime "
+     "doesn't apply it. The Frame's runtime allocates GPU memory for it every frame without freeing it, e.g. Vader "
+     "Immortal leaked ~20 MB/s on its loading screen. Fades done this way no longer show."),
    ("hide_space_warp", "int", 0, "Turn off space warp",
     "Hides XR_FB_space_warp, so the game renders every frame itself instead of half of them plus motion vectors "
     "(Application SpaceWarp). For games whose picture flickers or smears on the Frame (e.g. Unreal Engine 5 games "
@@ -61,10 +65,11 @@ SETTINGS = [
    ("stable_local", "int", 0, "Keep the play space still",
     "Every 'local' play space the game creates lines up with the one at the start. For games whose menus or screens "
     "jump to where you look on the Frame."),
-    ("focus_hold", "int", 0, "Ignore brief focus dips",
-     "Hides the Frame's brief focus dips (up to a second) once the game has been focused for a second. For "
-     "games that recentre or pause every time focus returns."),
-    ("focus_hold_ms", "float", 1000.0, "Longest focus dip to ignore (ms)",
+    ("focus_hold", "int", 1, "Ignore brief focus dips",
+     "Hides the Frame's brief focus dips (up to focus_hold_ms) once the game has been focused for a second. On by "
+     "default: the Frame's wear sensor flickers \"HMD off\" for 0.5-2 s while worn, and many games pause or recentre "
+     "every time (e.g. Blade & Sorcery, Lucky's Tale)."),
+    ("focus_hold_ms", "float", 5000.0, "Longest focus dip to ignore (ms)",
     "focus_hold hides focus dips up to this long (100-5000). Longer for a headset whose wear sensor flickers "
     "(\"HMD off\" for 0.5-2 s while worn, e.g. Blade & Sorcery pausing); taking the headset off or the system menu "
     "pauses the game only after this long."),
@@ -108,6 +113,18 @@ SETTINGS = [
     "Override the guardian width (0 = use guardian, min 1.5 m)."),
    ("scene_depth", "float", 0.0, "Emulated room depth (m)",
     "Override the guardian depth (0 = use guardian, min 1.5 m)."),
+    ("pose_consistency", "int", 0, "Consistent head poses per frame",
+     "Repeat xrLocateViews queries for the same display time get the first, fully tracked answer again. Games that "
+     "ask several times per frame got slightly different poses and rendered parts of the frame with different heads: "
+     "judder (e.g. I Am Cat; proposed by Klownicle, GitHub #8)."),
+    ("haptic_fix", "int", 0, "Fix controller vibration freezes",
+     "Routes OVRPlugin through FramePort's extension shim, which turns Meta's amplitude-envelope vibrations into "
+     "plain ones: OVRPort's loader reads their nanosecond duration as seconds and allocates gigabytes, freezing the "
+     "Frame when the game vibrates a controller (e.g. Lucky's Tale's save slots, GitHub #9). Needs a rebuild."),
+    ("rect_clamp", "int", 1, "Clamp image rects",
+     "Keeps every submitted image rect inside its swapchain. Unity can size the eye area a few pixels past the image "
+     "on some Frames; SteamVR then rejects every frame (xrEndFrame -25, XR_ERROR_SWAPCHAIN_RECT_INVALID) and the game "
+     "stops drawing (e.g. PowerWash Simulator stuck at \"Waiting\")."),
    ("swap_eyes", "int", 0, "Swap eyes", "Swap left/right views (diagnostic)."),
    ("strip_depth", "int", 0, "Strip depth layers", "Remove XR_KHR_composition_layer_depth chains (diagnostic)."),
    ("mutable_fix", "int", 0, "Mutable swapchain fix", "Experimental Vulkan mutable-format workaround."),
@@ -119,14 +136,30 @@ SETTINGS = [
     "e.g. stores that initialize locals a shader reads before writing (an undefined loop counter hung the GPU in "
     "VR4's campaign). Format: <size>:<sha256>:<byte offset>:<word>,<word>,...; several separated by ';'. Comes from "
     "a game's recipe."),
+    ("vk_query_slots", "int", 0, "Vulkan shim: slots per occlusion query",
+     "Vulkan shim (frame.vk_sanitize): on gives every occlusion query room for both eyes. In multiview passes the "
+     "Frame's driver writes a zero result for the second eye into the next query, so engines that count on one slot "
+     "cull visible objects (models popping in and out, e.g. Into The Radius 2). 0 = off, 1 = on (2 slots)."),
+    ("vk_spec_fixes", "int", 0, "Vulkan shim: depth spec fixes",
+     "Vulkan shim (frame.vk_sanitize): makes two Unreal habits valid Vulkan - depth images get "
+     "VK_IMAGE_USAGE_TRANSFER_DST_BIT (they are cleared with vkCmdClearDepthStencilImage) and Qualcomm shader-resolve "
+     "subpasses lose an invalid depth resolve. Found with the validation layer in Into The Radius 2 (flickering "
+     "models, windows behind models)."),
+    ("vk_validation", "int", 0, "Vulkan shim: validation layer",
+     "Diagnostics: the Vulkan shim (frame.vk_sanitize) adds Khronos' validation layer to the game's instance; its "
+     "findings go to launch.log. The layer library (libVkLayer_khronos_validation.so) must be in the APK."),
+    ("gl_hide_msrtt", "int", 1, "GL shim: hide multisampled render-to-texture",
+     "GL shim only: hide GL_EXT_multisampled_render_to_texture(2) (Zink crashes rendering Unity's runtime MSAA eye "
+     "buffer through it, e.g. The Room VR)."),
    ("gl_hide_multiview", "int", 1, "GL shim: hide multiview",
     "GL shim only: hide GL_OVR_multiview so all passes use single-view shaders. For GLES games whose multiview "
     "shaders fail on single-view render targets (e.g. Path of the Warrior)."),
 ]


-# settings that need a new build, not only new settings files: the Vulkan shim learned vk_shader_fix in 0.6.4
-REVISIONS = {"vk_shader_fix": 2}
+# settings that need a new build, not only new settings files: the Vulkan shim learned vk_shader_fix in 0.6.4 and
+# vk_query_slots and vk_spec_fixes in 0.10.0
+REVISIONS = {"vk_shader_fix": 2, "vk_query_slots": 3, "vk_spec_fixes": 2, "haptic_fix": 2, "pose_consistency": 2}

 # How the "Game settings" dialog shows each setting to non-technical users: group, level (common settings are always
 # shown; advanced ones only under "Show advanced settings"), a plain label and one-line help, the control, and the
@@ -147,6 +180,21 @@ UI: dict[str, dict] = {
    "focus_hold_ms": dict(group="screens", level="advanced", label="Ignore focus dips up to", depends="focus_hold",
                          help="Longer for headsets that briefly think they're off your head.",
                          control=("slider", 500.0, 3000.0, 100.0, "{:.0f} ms")),
+    "pose_consistency": dict(group="picture", level="advanced", label="Steadier head tracking",
+                             help="For games that judder or shimmer while you hold your head still (e.g. I Am Cat).",
+                             control=("switch",)),
+    "haptic_fix": dict(group="controllers", level="advanced", label="Fix freezes when controllers vibrate",
+                       help="For games that freeze the Frame when a controller vibrates (e.g. Lucky's Tale). Needs a "
+                            "rebuild.",
+                       control=("switch",)),
+    "vk_spec_fixes": dict(group="troubleshooting", level="advanced", label="Fix depth flicker (Unreal Vulkan)",
+                          help="For Unreal games whose models flicker or show through walls and windows on the Frame "
+                               "(e.g. Into The Radius 2). Needs a rebuild.",
+                          control=("switch",)),
+    "vk_query_slots": dict(group="troubleshooting", level="advanced", label="Stop objects popping in and out",
+                           help="For Vulkan games whose models flicker or vanish while you look at them (e.g. Into "
+                                "The Radius 2). Needs a rebuild.",
+                           control=("switch",)),
    "sync_guard": dict(group="troubleshooting", level="advanced", label="Steady controller input after focus",
                       help="For games that crash right after you return to them (e.g. after the Steam menu).",
                       control=("switch",)),
@@ -211,7 +259,7 @@ UI: dict[str, dict] = {
                            control=("choice", [(0, "As the game sends it"), (2, "Flat")])),
    **{key: dict(group="troubleshooting", level="advanced", control=("switch",)) for key in (
        "foveation_fix", "hide_space_warp", "swapchain_fix", "layer_fix", "gl_hide_multiview", "mutable_fix",
-        "flip_quads", "swap_eyes",
+        "flip_quads", "swap_eyes", "vk_validation", "rect_clamp", "gl_hide_msrtt", "strip_color_bias",
        "strip_depth", "respace_kick", "layer_debug", "eye_debug", "release_wait")},
 }

@@ -266,7 +314,12 @@ class AdapterSetting(Patch):
            "mutable_fix": ap.is_vulkan,
            "swapchain_fix": ap.is_gles,
            "gl_hide_multiview": lambda a: a.direct_vrapi and ap.is_gles(a),
+            "gl_hide_msrtt": ap.is_gles,
            "vk_shader_fix": lambda a: a.engine == "Unreal",  # read by the Vulkan shim, which only Unreal games get
+            "vk_query_slots": lambda a: a.engine == "Unreal" and ap.is_vulkan(a),
+            "vk_validation": lambda a: a.engine == "Unreal",
+            "haptic_fix": lambda a: "libOVRPlugin.so" in a.libs,
+            "vk_spec_fixes": lambda a: a.engine == "Unreal" and ap.is_vulkan(a),
            "controller_models": ap.may_use_render_models,
            **{k: ap.is_gles for k in ("equirect_emul", "equirect_face", "equirect_res", "equirect_flip",
                                       "equirect_fps", "equirect_stereo")},
@@ -38,12 +38,22 @@ SUMMARIES = {
    "frame.adapter": "FramePort's translator between the game and the Steam Frame: fills in what the Frame lacks "
                     "(controllers, room, passthrough). Needed for every converted game.",
    "frame.launcher": "Makes the game start from the Frame's Steam library.",
+    "frame.start_activity": "Opens the app straight in VR, skipping its flat launcher screen (turn off to use the "
+                            "launcher, e.g. to import new content).",
+    "frame.ltw_depth": "Fixes the black picture in Minecraft launchers (e.g. QuestCraft): uses depth formats the "
+                       "Frame's graphics driver accepts.",
+    "frame.unity_gl_shim": "Stops a grey or frozen screen in Unity games that turn on anti-aliasing while running "
+                           "(e.g. The Room VR).",
+    "frame.unity_no_overlay_copy": "Stops a grey screen crash in some Unity games by skipping their overlay "
+                                   "layers (e.g. The Room VR's screen fades).",
    "frame.nodebug": "Stops strict debugging checks that make some games quit.",
    "frame.meta_permissions": "Declares Meta's permissions some mixed-reality games ask for, so they don't stop.",
    "frame.ovrplatformcompat": "Adds a small piece of Meta's platform library that some games need to start.",
    "frame.ovrstubs": "Provides stand-ins for Meta store functions the game expects, so it doesn't crash at start.",
    "frame.langpacks": "Lets the game find language files (like de.lang) that are already in its data, instead of "
                       "waiting for a download that never comes.",
+    "frame.ovr_trace": "For troubleshooting: records the game's requests to Meta's platform services and which ones "
+                       "never get an answer.",
    "frame.unity_no_msaa": "Turns off a smoothing setting that crashes some older Unity games on the Frame.",
    "frame.unity_runtime_msaa_off": "Keeps a smoothing setting off that the game turns on itself and that can freeze "
                                    "the Frame.",
@@ -403,6 +403,23 @@ def reset_recipe(package: str) -> Recipe:
    return recipe


+def apply_catalog_update(package: str) -> Recipe:
+    """Take the newer catalog recipe for a game whose recipe the user edited (the game page's "newer known-good
+    config" offer): derived again from the catalog, keeping the user's FrameBridge settings the catalog doesn't set."""
+    entry = library.game(package)
+    old = library.recipe_from_dict(entry["recipe"])
+    recipe = engine.suggest(library.analysis_from_dict(entry["analysis"]))
+    for pid, params in old.patches.items():
+        if pid.startswith("adapter.") and pid not in recipe.patches:
+            recipe.patches[pid] = params
+            if pid in old.reasons:
+                recipe.reasons[pid] = old.reasons[pid]
+    set_recipe(package, recipe)
+    with library.edit() as data:
+        data["games"].get(package, {}).pop("catalog_update", None)
+    return recipe
+
+
 def prepare_rift(package: str, reporter: Reporter) -> dict:
    """Rift games aren't rebuilt: check the folder still matches the analysis and make sure Revive is available."""
    from .build import sha256
@@ -119,7 +119,8 @@ def remote_enabled() -> bool:
    if os.environ.get("FRAMEPORT_NO_CATALOG_UPDATE"):
        return False
    try:
-        return bool(library.setting("catalog.auto_update", True))
+        # never library.setting(): load() refreshes recipes from the catalog, which would load the catalog again
+        return bool(library.peek_setting("catalog.auto_update", True))
    except Exception:  # noqa: BLE001 - no library yet
        return True

@@ -32,6 +32,7 @@ NAV = [("library", tr("Library"), ft.Icons.GRID_VIEW_ROUNDED),
       ("frame", tr("Steam Frame"), ft.Icons.VIEW_IN_AR_ROUNDED),
       ("files", tr("Files"), ft.Icons.FOLDER_OPEN_ROUNDED),
       ("screenshots", tr("Screenshots"), ft.Icons.PHOTO_LIBRARY_OUTLINED),
+       ("live", tr("Live view"), ft.Icons.CAST_ROUNDED),
       ("settings", tr("Settings"), ft.Icons.TUNE_ROUNDED)]
 POLL_SECONDS = 30

@@ -70,12 +71,14 @@ class FramePortApp:
        self.library_view = None  # created once (views/library.LibraryView), re-mounted on every visit
        self.files_view = None  # likewise (views/files.FilesView): keeps the location/folder between visits
        self.screenshots_view = None  # likewise (views/screenshots.ScreenshotsView): keeps the game filter
+        self.live_view = None  # likewise (views/live.LiveView): owns the running stream, which outlives the tab
        self.exe_queue: list[str] = []  # games whose executable the user should confirm (after a scan)
        self._failures: list[Job] = []  # failed installs/tests, shown together when the queue is done
        self.jobs = jobs_module.shared()  # one queue per process, shared by every window session
        self.jobs.subscribe(self._on_job)
        self._handled_jobs: set[int] = set()  # finished jobs this session has reacted to (pop-ups, refreshes)
-        page.on_close = lambda e: self.jobs.unsubscribe(self._on_job)  # session gone: stop drawing into it
+        page.on_close = lambda e: (self.jobs.unsubscribe(self._on_job),  # session gone: stop drawing into it
+                                   self.stop_live())  # and stop a live view (it would keep the Frame encoding)
        from .updater import Updater

        self.updater = Updater(self)  # new FramePort releases (sidebar card, Library bar, one-click update)
@@ -114,8 +117,8 @@ class FramePortApp:
            ft.Container(expand=True),
            self.updater.card,
            self.activity_card,
-            self.power_row,
            self.conn_card,
+            self.power_row,  # under the Frame card (owner's choice)
        ], spacing=T.S2), width=T.px(236), bgcolor=T.SIDEBAR, padding=T.S4,
            border=ft.Border(right=ft.BorderSide(1, T.BORDER)))
        page.add(ft.Row([sidebar, self.body, self.activity.root], expand=True, spacing=0,
@@ -349,6 +352,12 @@ class FramePortApp:
                if self.screenshots_view is None:
                    self.screenshots_view = ScreenshotsView(self)
                view = self.screenshots_view.mount(*self.route[1:])
+            elif kind == "live":
+                from .views.live import LiveView
+
+                if self.live_view is None:
+                    self.live_view = LiveView(self)
+                view = self.live_view.mount()
            elif kind == "settings":
                view = SettingsView(self).build()
            else:
@@ -378,9 +387,16 @@ class FramePortApp:
        elif self.route[0] == "screenshots" and (self.screenshots_view is None or self.screenshots_view.root is None
                                                 or self.frame_state != "connected"):
            self.render()
+        elif self.route[0] == "live" and (self.live_view is None or self.live_view.root is None
+                                          or self.frame_state != "connected"):
+            self.render()
        else:
            self._refresh_sidebar()

+    def stop_live(self) -> None:
+        if self.live_view is not None:
+            self.live_view.stop()
+
    def open_game(self, package: str, advanced: bool = False, show_all: bool = False) -> None:
        self.go("game", package, advanced, show_all)

@@ -1826,6 +1842,7 @@ class FramePortApp:
            work()

    def disconnect(self):
+        self.stop_live()
        if self.target:
            try:
                self.target.close()
@@ -53,6 +53,7 @@ def save_to_recipe(package: str, values: dict) -> None:
    """Adapter patches = the settings that differ from their defaults (BASE_SETTINGS are written anyway)."""
    g = library.game(package)
    r = library.recipe_from_dict(g["recipe"])
+    before = {pid: dict(v or {}) for pid, v in r.patches.items() if pid.startswith("adapter.")}
    for key in SPECS:
        pid = f"adapter.{key}"
        v = _num(key, values.get(key, default(key)))
@@ -63,6 +64,9 @@ def save_to_recipe(package: str, values: dict) -> None:
            if (r.patches.get(pid) or {}).get("value") != v:
                r.reasons[pid] = tr("Set by you.")
            r.patches[pid] = {"value": v}
+    after = {pid: dict(v or {}) for pid, v in r.patches.items() if pid.startswith("adapter.")}
+    if after == before:  # saved without a change: the recipe keeps following FramePort's catalog (GitHub #10)
+        return
    r.source = "user"
    pipeline.set_recipe(package, r)

@@ -252,6 +252,18 @@ class GameView:
                    C.ghost(tr("Not now"), on_click=dismiss),
                ], spacing=T.S2, run_spacing=T.S2, wrap=True),
            ], spacing=T.S2), "info", ft.Icons.VOLUNTEER_ACTIVISM_OUTLINED))
+        if g.get("catalog_update") and recipe.source == "user":
+            def take_update(e):
+                from ... import pipeline
+
+                pipeline.apply_catalog_update(pkg)
+                self.app.toast(tr("New config applied: use Update on Frame to install it"))
+                self.app.render()
+            out.append(C.callout(ft.Row([
+                C.body(tr("A newer known-good config for this game is available (you changed this game's settings, "
+                          "so it wasn't applied by itself)."), T.TEXT, expand=True),
+                C.secondary(tr("Use the new config"), ft.Icons.AUTO_FIX_HIGH_OUTLINED, take_update)],
+                vertical_alignment=ft.CrossAxisAlignment.CENTER), "info", ft.Icons.NEW_RELEASES_OUTLINED))
        if g.get("steam_art_stale") and installed:
            out.append(C.callout(ft.Row([
                C.body(tr("The Frame's Steam library still shows the old artwork."), T.TEXT, expand=True),
@@ -0,0 +1,176 @@
+"""Live view: watch what the Frame shows, in a browser window on this PC.
+
+Flet can't play video outside packaged builds, so this tab only starts and stops the stream (install/livestream.py)
+and opens the player page in the user's browser. Persistent: the stream keeps running while other tabs are open; the
+status line is refreshed once a second while the tab is shown (properties only, no new controls).
+"""
+from __future__ import annotations
+
+import threading
+import time
+from typing import TYPE_CHECKING
+
+import flet as ft
+
+from ...errors import explain
+from ...i18n import tr, tr_n
+from .. import components as C
+from .. import theme as T
+from .files_dialog import human
+
+if TYPE_CHECKING:
+    from ..app import FramePortApp
+
+QUALITIES = [("360p", tr("360p (lightest)")), ("480p", "480p"), ("720p", tr("720p (recommended)")),
+             ("1080p", "1080p"), ("full", tr("Full (headset view size)"))]
+
+
+def status_text(st: dict) -> str:
+    """One line for the relay's status (livestream.Relay.status)."""
+    if st.get("ended"):
+        return tr("Stopped: {why}").format(why=st["ended"])
+    if not st.get("ready"):
+        return tr("Starting the stream on the Frame…")
+    parts = [tr("Live")]
+    if st.get("width"):
+        parts.append(f"{st['width']}×{st['height']}")
+    secs = max(st.get("seconds") or 0, 1)
+    parts.append(tr("{rate}/s").format(rate=human(int((st.get("bytes") or 0) / secs))))
+    n = st.get("viewers") or 0
+    parts.append(tr("no viewer open") if not n else tr_n("{n} viewer", "{n} viewers", n))
+    return " · ".join(parts)
+
+
+def default_quality() -> str:
+    from ...install.livestream import DEFAULT_QUALITY
+
+    return DEFAULT_QUALITY
+
+
+class LiveView:
+    def __init__(self, app: FramePortApp):
+        self.app = app
+        self.live = None  # install.livestream.LiveStream while streaming
+        self.quality = default_quality()
+        self._busy = False
+        self._ticker: threading.Thread | None = None
+        self.root = None
+        self.dot = C.dot(T.TEXT_3, 10)
+        self.state = C.body(tr("Not streaming"), T.TEXT, weight=ft.FontWeight.W_500)
+        self.detail = C.meta("")
+        self.quality_dd = ft.Dropdown(label=tr("Quality"), value=self.quality, width=T.px(260), dense=True,
+                                      options=[ft.DropdownOption(key=k, text=t) for k, t in QUALITIES],
+                                      on_select=self._set_quality)
+        self.start_btn = C.primary(tr("Start live view"), ft.Icons.PLAY_ARROW_ROUNDED, self._start, big=True)
+        self.open_btn = C.secondary(tr("Open viewer"), ft.Icons.OPEN_IN_NEW_ROUNDED, self._open)
+        self.stop_btn = C.ghost(tr("Stop"), ft.Icons.STOP_ROUNDED, self._stop_click)
+        self.url = C.meta("", selectable=True)
+
+    # ---------------------------------------------------------------- building
+    def mount(self) -> ft.Control:
+        app = self.app
+        heading, sub = tr("Live view"), tr("Watch what the headset shows, in a window on this PC")
+        if not (app.target and app.frame_state == "connected"):
+            return ft.Column([
+                app.top_bar(heading, sub),
+                C.empty_state(ft.Icons.CAST_ROUNDED, tr("Connect your Frame first"),
+                              tr("The live view can start once FramePort is connected to the Frame."),
+                              C.primary(tr("Connect"), ft.Icons.LINK_ROUNDED, lambda e: app.go("frame")))], expand=True)
+        if self.root is None:
+            self.root = ft.Column([
+                app.top_bar(heading, sub),
+                C.card(ft.Column([
+                    ft.Row([self.dot, self.state], spacing=T.S2,
+                           vertical_alignment=ft.CrossAxisAlignment.CENTER),
+                    self.detail,
+                    ft.Container(height=T.S2),
+                    ft.Row([self.start_btn, self.open_btn, self.stop_btn, self.quality_dd],  # (no expand child: wraps)
+                           spacing=T.S3, wrap=True, vertical_alignment=ft.CrossAxisAlignment.CENTER),
+                    self.url,
+                ], spacing=T.S2)),
+                C.callout(tr("The picture opens in your default web browser, where it plays smoothly and can go "
+                             "full screen. It shows the headset's view with its sound "
+                             "(click Sound on in the player) whatever is running: Steam's menus, SteamVR or a game; "
+                             "while the headset sleeps the picture is black and updates about once a second. "
+                             "Streaming costs the Frame a little performance; "
+                             "stop it when you're done.")),
+            ], spacing=T.S4, horizontal_alignment=ft.CrossAxisAlignment.STRETCH)
+        self._refresh(update=False)
+        self._ensure_ticker()
+        return self.root
+
+    def _refresh(self, update: bool = True) -> None:
+        live = self.live
+        running = bool(live and live.running)
+        if live is None:
+            self.dot.bgcolor, self.state.value = T.TEXT_3, tr("Not streaming")
+            self.detail.value = tr("Starts a video stream on the Frame and opens it in your browser.")
+        else:
+            st = live.relay.status()
+            ok = running and st.get("ready")
+            self.dot.bgcolor = T.OK if ok else T.ERROR if st.get("ended") else T.WARN
+            self.state.value = status_text(st)
+            self.detail.value = "" if ok or st.get("ended") else tr("The first picture takes a few seconds.")
+        self.start_btn.visible = not running
+        self.start_btn.disabled = self._busy
+        self.open_btn.visible = self.stop_btn.visible = running
+        self.quality_dd.disabled = running or self._busy
+        self.url.value = (tr("Viewer address on this PC: {url}").format(url=live.url) if running else "")
+        self.url.visible = running
+        if update:
+            C.update(self.dot, self.state, self.detail, self.start_btn, self.open_btn, self.stop_btn,
+                     self.quality_dd, self.url)
+
+    def _ensure_ticker(self) -> None:
+        if self._ticker and self._ticker.is_alive():
+            return
+
+        def tick():
+            while self.app.route[:1] == ("live",):
+                self._refresh()
+                time.sleep(1)
+
+        self._ticker = threading.Thread(target=tick, name="live-status", daemon=True)
+        self._ticker.start()
+
+    # ---------------------------------------------------------------- actions
+    def _set_quality(self, e) -> None:
+        self.quality = e.control.value or default_quality()
+
+    def _start(self, e=None) -> None:
+        if self._busy or (self.live and self.live.running):
+            return
+        self._busy = True
+        self._refresh()
+        self.app.run_bg(self._start_bg)
+
+    def _start_bg(self) -> None:
+        from ...install import livestream
+
+        try:
+            if self.live:
+                self.live.stop()
+            self.live = livestream.start(self.app.target.frame, quality=self.quality)
+            self.live.on_end = lambda why: self._refresh()
+        except Exception as exc:  # noqa: BLE001
+            self.live = None
+            self.app.toast(tr("Couldn't start the live view: {exc}").format(exc=explain(exc)), error=True)
+        finally:
+            self._busy = False
+        self._refresh()
+        if self.live:
+            self._open()
+
+    def _open(self, e=None) -> None:
+        if self.live and self.live.running:
+            self.app.open_url(self.live.url)
+
+    def _stop_click(self, e=None) -> None:
+        self.app.run_bg(self.stop)
+
+    def stop(self) -> None:
+        """Stop streaming (also called when the Frame disconnects or the app closes)."""
+        live, self.live = self.live, None
+        if live:
+            live.stop()
+        self._refresh()
@@ -109,4 +109,36 @@ def triage(log: str, state: str = "UNKNOWN", package: str | None = None, crash:
    fps = re.findall(r"pacing: ([0-9.]+) fps", text)
    if fps:
        res.fps = float(fps[-1])
+    stopped = frames_stopped(lines)
+    if stopped and state == "RUNNING" and not any(f.severity == "fatal" for f in res.findings):
+        res.findings.append(Finding(
+            "frames-stopped", "fatal",
+            f"The game stopped sending frames {stopped:.0f} s before the test ended although its process kept "
+            "running (a crashed or stuck render thread: a frozen picture in the headset).", [],
+            "last FrameBridge pacing line"))
    return res
+
+
+LOGCAT_TIME = re.compile(r"^\d\d-\d\d (\d\d):(\d\d):(\d\d)\.(\d{3})")
+
+
+def frames_stopped(lines: list[str], gap: float = 20.0) -> float | None:
+    """Seconds between FrameBridge's last pacing line and the end of the log when that is over `gap` (the frame loop
+    died while the process lived on, e.g. The Room VR's render thread crash, PowerWash Simulator's rejected frames)."""
+    def secs(line):
+        m = LOGCAT_TIME.match(line)
+        return int(m[1]) * 3600 + int(m[2]) * 60 + int(m[3]) + int(m[4]) / 1000 if m else None
+    last_pacing = last = None
+    for ln in lines:  # logcat lines aren't strictly in time order: the latest time counts, not the last line
+        t = secs(ln)
+        if t is None:
+            continue
+        if last is not None and t < last - 43200:  # past midnight
+            t += 86400
+        last = t if last is None else max(last, t)
+        if "FrameBridge: pacing:" in ln:
+            last_pacing = t
+    if last_pacing is None or last is None:
+        return None
+    delta = last - last_pacing
+    return delta if delta > gap else None
@@ -1305,3 +1305,61 @@ def test_proton_defaults_to_stable(monkeypatch, tmp_path):
    assert a.pick_proton([exp, stable])["name"] == "proton_11-arm64"  # whatever the order
    assert a.pick_proton([stable, exp], "proton-experimental")["name"] == "proton-experimental-arm64"  # by alias
    assert a.pick_proton([exp])["name"] == "proton-experimental-arm64"  # only Experimental offered
+
+
+def test_launch_test_waits_for_a_first_boot(monkeypatch, tmp_path):
+    """The first start after an APK change: Lepton says "is not a running context" while it waits, then boots."""
+    a = load_agent(monkeypatch, tmp_path)
+    first = "Waiting for boot...\nERROR: 'steamlaunch-1' is not a running context, use 'lepton ps'\n"
+    assert not a.not_started(first, 5)  # still within the grace period
+    assert a.not_started(first, 31)  # no boot: the container really failed
+    assert not a.not_started(first + "Boot complete!\nInstalling game.apk...\n", 120)
+    assert not a.not_started("Boot complete!\n", 120)
+
+
+def test_devkit_appid_from_steams_console_log(monkeypatch, tmp_path):
+    """GitHub #42: Steam added the devkit entry live but never saved shortcuts.vdf; its console log names the appid."""
+    a = load_agent(monkeypatch, tmp_path)
+    logs = Path(a.STEAM) / "logs"
+    logs.mkdir(parents=True, exist_ok=True)
+    exe = f"{a.DEVKIT_GAMES}/I_Am_Cat/launch.sh"
+    why = "reason: k_unAppIdInvalid"
+    (logs / "console_log.txt").write_text(
+        f'[2026-10-05 14:45:37] sanitize shortcut app id "{exe}": replacing 0 with 3849978641, {why}\n'
+        f'[2026-10-05 14:45:38] sanitize shortcut app id "{a.DEVKIT_GAMES}/Other/launch.sh": replacing 0 with 5\n'
+        f'[2026-10-05 15:29:14] sanitize shortcut app id "{exe}": replacing 0 with 3849978642, {why}\n')
+    assert a.devkit_appid("I_Am_Cat") == 3849978642  # nothing in shortcuts.vdf: the newest log line
+    assert a.devkit_appid("Missing") is None
+
+
+def test_devkit_appid_ignores_the_previous_steam_session(monkeypatch, tmp_path):
+    """Live devkit entries die with Steam (GitHub #41): an appid from console_log.previous.txt is stale."""
+    a = load_agent(monkeypatch, tmp_path)
+    logs = Path(a.STEAM) / "logs"
+    logs.mkdir(parents=True, exist_ok=True)
+    exe = f"{a.DEVKIT_GAMES}/Batman/launch.sh"
+    (logs / "console_log.previous.txt").write_text(f'sanitize shortcut app id "{exe}": replacing 0 with 77, x\n')
+    (logs / "console_log.txt").write_text("Steam started\n")
+    assert a.devkit_appid("Batman") is None
+
+
+def test_launch_registers_a_lost_devkit_entry_again(monkeypatch, tmp_path):
+    """After a Steam restart Steam forgot the (never saved) devkit entry: Play gets AppError_9 and registers it
+    again."""
+    a = load_agent(monkeypatch, tmp_path)
+    monkeypatch.setattr(a, "check_pkg", lambda p: p)
+    monkeypatch.setattr(a, "deployment", lambda p: {"appid": 111, "title": "Batman"})
+    monkeypatch.setattr(a, "run", lambda *x, **k: subprocess.CompletedProcess([], 0, "", ""))
+    monkeypatch.setattr(a, "devkit_gameid", lambda p: "Batman")
+    monkeypatch.setattr(a, "devkit_appid", lambda g: 222)  # the stale entry from before the restart
+    registered = []
+    monkeypatch.setattr(a, "devkit_register", lambda p: registered.append(p) or 333)
+    launches = []
+
+    def launch(appid, wait=10):
+        launches.append(appid)
+        return {"result": "error", "code": 9} if appid == 222 else {"result": "started"}
+    monkeypatch.setattr(a, "steam_launch", launch)
+    out = a.cmd_launch({"package": "com.camouflaj.manta"})
+    assert registered == ["com.camouflaj.manta"] and launches == [222, 333]
+    assert out["via"] == "devkit" and out["steam"]["result"] == "started"
@@ -39,3 +39,40 @@ def test_edits_compose(quest_manifest):
    m, _ = axml.define_meta_permissions(m)
    assert axml.categories(m) == {axml.LAUNCHER}
    assert axml.Axml(m).get_bool("application", "debuggable") is False
+
+
+def _two_activity_manifest():
+    """WiiCompiled's shape: a 2D LauncherActivity (MAIN+LAUNCHER) and a QuestActivity (MAIN+VR+DEFAULT)."""
+    from conftest import build_axml
+
+    def activity(name, cats):
+        out = [("start", "activity", [("name", "str", name)]), ("start", "intent-filter", []),
+               ("start", "action", [("name", "str", "android.intent.action.MAIN")]), ("end", "action")]
+        for c in cats:
+            out += [("start", "category", [("name", "str", c)]), ("end", "category")]
+        return out + [("end", "intent-filter"), ("end", "activity")]
+    return build_axml([("start", "manifest", [("package", "str", "org.x.game")]), ("start", "application", []),
+                       *activity("org.x.game.launcher.LauncherActivity", [axml.LAUNCHER]),
+                       *activity("org.x.game.QuestActivity", [axml.VR_CATEGORY, axml.DEFAULT]),
+                       ("end", "application"), ("end", "manifest")])
+
+
+def _filters(manifest):
+    x = axml.Axml(manifest)
+    names = x.strings()
+    return {n.rsplit(".", 1)[-1]: sorted(names[i] for k, _, i in items if k == "category")
+            for _, n, items in axml.component_filters(manifest)}
+
+
+def test_start_activity_moves_launcher_to_the_vr_activity():
+    m = _two_activity_manifest()
+    assert axml.vr_activity(m) == "org.x.game.QuestActivity"
+    fixed = axml.set_start_activity(m, "QuestActivity")
+    assert _filters(fixed) == {"LauncherActivity": [axml.INFO],
+                               "QuestActivity": sorted([axml.LAUNCHER, axml.DEFAULT])}
+    assert axml.vr_activity(fixed) is None  # the VR activity is the launcher now
+    assert axml.set_start_activity(fixed, "QuestActivity") is None  # nothing left to do
+    assert axml.set_start_activity(m, "NoSuchActivity") is None
+    # only those two attribute values changed: the rest parses as before
+    assert axml.Axml(fixed).attr_str(next(e for e in axml.Axml(fixed).elements() if e.name == "manifest"),
+                                     "package") == "org.x.game"
@@ -71,3 +71,26 @@ def test_turned_off(github, monkeypatch):
    assert catalog.refresh_remote(force=True) == 0
    assert "com.x.good" not in catalog.load(refresh=True)
    assert json.dumps(catalog.remote_status())  # still reports (never checked)
+
+
+def test_library_load_with_a_cold_catalog_does_not_recurse(monkeypatch):
+    """GitHub #58: library.load() refreshes recipes from the catalog; the catalog's first load read a setting through
+    library.load(), which refreshed recipes again before the catalog was cached (~140 nested loads, blank window or a
+    crash at start-up)."""
+    from frameport.core import library
+
+    monkeypatch.delenv("FRAMEPORT_NO_CATALOG_UPDATE", raising=False)  # remote_enabled() must read the setting
+    monkeypatch.setattr(library, "REFRESH_ON_UPDATE", True)
+    library.save({"games": {"com.x.mine": {"recipe": {"source": "user", "patches": {}}, "analysis": {"package": "x"}}},
+                  "settings": {"catalog.auto_update": False}})
+    catalog._cache = None
+    loads = []
+    real = library.load
+
+    def counting():
+        loads.append(1)
+        assert len(loads) < 10, "library.load() recursed"
+        return real()
+    monkeypatch.setattr(library, "load", counting)
+    library.load()
+    assert catalog.remote_enabled() is False and len(loads) <= 2
@@ -0,0 +1,247 @@
+"""Live view: the fragmented-MP4 relay (box splitting, keyframe detection, late viewers), the player page, and the
+Frame-side script (device lookup, stops when the SSH channel closes)."""
+import io
+import shutil
+import struct
+import subprocess
+import time
+import urllib.request
+
+import pytest
+
+from frameport.install import livestream as L
+
+
+def box(kind: str, payload: bytes) -> bytes:
+    return struct.pack(">I4s", 8 + len(payload), kind.encode()) + payload
+
+
+def full(kind: str, flags: int, payload: bytes) -> bytes:
+    return box(kind, struct.pack(">I", flags) + payload)  # version 0
+
+
+def init_segment(w=1280, h=720) -> bytes:
+    # avc1 sample entry: 6 reserved + 2 data ref + 16 pre_defined/reserved, then width/height; avcC: version,
+    # profile 0x42, compat 0xc0, level 0x1f
+    avcc = box("avcC", bytes([1, 0x42, 0xC0, 0x1F]) + b"\0" * 4)
+    avc1 = box("avc1", b"\0" * 24 + struct.pack(">HH", w, h) + b"\0" * 50 + avcc)
+    return box("ftyp", b"isom\0\0\0\0") + box("moov", box("trak", avc1))
+
+
+def fragment(key: bool, how: str = "first", seq: int = 0) -> bytes:
+    flags = 0 if key else L.SAMPLE_NON_SYNC
+    if how == "first":  # trun first_sample_flags (what ffmpeg writes)
+        trun = full("trun", 0x1 | 0x4, struct.pack(">IiI", 2, 0, flags))
+        tfhd = full("tfhd", 0, struct.pack(">I", 1))
+    elif how == "sample":  # per-sample flags
+        trun = full("trun", 0x400, struct.pack(">II", 1, flags))
+        tfhd = full("tfhd", 0, struct.pack(">I", 1))
+    else:  # tfhd default flags
+        trun = full("trun", 0, struct.pack(">I", 1))
+        tfhd = full("tfhd", 0x20, struct.pack(">II", 1, flags))
+    return box("moof", box("mfhd", struct.pack(">II", 0, seq)) + box("traf", tfhd + trun)) + \
+        box("mdat", bytes([seq % 256]) * 32)
+
+
+@pytest.mark.parametrize("how", ["first", "sample", "default"])
+def test_keyframe_detection(how):
+    assert L.fragment_is_keyframe(fragment(True, how))
+    assert not L.fragment_is_keyframe(fragment(False, how))
+
+
+def test_keyframe_unknown_is_not_key():
+    assert not L.fragment_is_keyframe(box("moof", box("mfhd", b"\0" * 8)))
+    assert not L.fragment_is_keyframe(b"junk")
+
+
+def test_codec_and_size():
+    init = init_segment(1920, 1080)
+    assert L.codec_string(init) == "avc1.42c01f"
+    assert L.video_size(init) == (1920, 1080)
+    assert L.codec_string(b"nothing") is None
+
+
+def test_splitter_any_read_size():
+    stream = init_segment() + fragment(True, seq=1) + fragment(False, seq=2) + box("free", b"x")
+    for step in (1, 7, 64, len(stream)):
+        sp, out = L.Mp4Splitter(), []
+        for i in range(0, len(stream), step):
+            out += sp.feed(stream[i:i + step])
+        assert [k for k, _ in out] == ["init", "fragment", "fragment"]
+        assert out[0][1] == init_segment()
+        assert out[1][1] == fragment(True, seq=1)
+
+
+def test_splitter_rejects_garbage():
+    with pytest.raises(ValueError):
+        L.Mp4Splitter().feed(struct.pack(">I4s", 3, b"bad!"))
+
+
+def test_relay_late_viewer_starts_at_keyframe():
+    r = L.Relay()
+    r.feed(init_segment() + fragment(True, seq=1) + fragment(False, seq=2) + fragment(True, seq=3)
+           + fragment(False, seq=4))
+    init, gop, q = r.subscribe()
+    assert init == init_segment()
+    assert gop == [fragment(True, seq=3), fragment(False, seq=4)]
+    r.feed(fragment(False, seq=5))
+    assert q.get_nowait() == fragment(False, seq=5)
+    st = r.status()
+    assert st["ready"] and st["codec"] == "avc1.42c01f" and st["width"] == 1280 and st["viewers"] == 1
+    r.finish("gone")
+    assert q.get_nowait() is None and r.status()["ended"] == "gone"
+
+
+def test_relay_drops_slow_viewer(monkeypatch):
+    monkeypatch.setattr(L, "CLIENT_QUEUE", 2)
+    r = L.Relay()
+    r.feed(init_segment())
+    _, _, q = r.subscribe()
+    for i in range(3):
+        r.feed(fragment(True, seq=i))
+    assert r.status()["viewers"] == 0  # dropped; its page reconnects at a keyframe
+
+
+class _Source:
+    """A byte stream fed at the pace a test chooses."""
+
+    def __init__(self, data: bytes):
+        self.f = io.BytesIO(data)
+
+    def read(self, n):
+        time.sleep(0.01)
+        return self.f.read(min(n, 200))
+
+
+def test_server_serves_page_status_and_stream():
+    data = init_segment() + b"".join(fragment(i % 3 == 0, seq=i) for i in range(6))
+    live = L.LiveStream(lambda: _Source(data)).start()
+    try:
+        page = urllib.request.urlopen(live.url, timeout=5).read()
+        assert b"MediaSource" in page and b"stream.mp4" in page
+        deadline = time.time() + 5
+        while live.relay.ended is None and time.time() < deadline:
+            time.sleep(0.05)
+        import json
+
+        st = json.loads(urllib.request.urlopen(live.url + "status", timeout=5).read())
+        assert st["ready"] and st["fragments"] == 6 and st["ended"]
+        with pytest.raises(urllib.error.HTTPError):  # source over: no stream to join (503 isn't hung)
+            urllib.request.urlopen(live.url + "stream.mp4", timeout=5).read()
+    finally:
+        live.stop()
+    assert not live.running
+
+
+def test_stream_endpoint_sends_init_then_gop():
+    gate = []
+
+    class Slow:
+        def __init__(self):
+            self.parts = [init_segment(), fragment(True, seq=1), fragment(False, seq=2)]
+
+        def read(self, n):
+            if self.parts:
+                return self.parts.pop(0)
+            while not gate:
+                time.sleep(0.02)
+            return b""
+
+    live = L.LiveStream(Slow).start()
+    try:
+        deadline = time.time() + 5
+        while live.relay.status()["fragments"] < 2 and time.time() < deadline:
+            time.sleep(0.02)
+        resp = urllib.request.urlopen(live.url + "stream.mp4", timeout=5)
+        assert resp.headers["Content-Type"] == "video/mp4"
+        gate.append(1)
+        body = resp.read()
+        assert body == init_segment() + fragment(True, seq=1) + fragment(False, seq=2)
+    finally:
+        live.stop()
+
+
+def test_source_command_scales_down_only():
+    c720 = L.source_command("720p")
+    assert "scale=-2:'min(720,ih)'" in c720 and "fps=30" in c720 and '"SteamVR"' in c720
+    assert c720.index("fps=30") < c720.index("scale=")  # drop frames before the expensive scale
+    for q, (h, _) in L.QUALITY.items():
+        assert ("scale=" in L.source_command(q)) == (h is not None)
+    assert L.source_command("bogus") == L.source_command(L.DEFAULT_QUALITY)
+
+
+@pytest.mark.skipif(not shutil.which("bash"), reason="needs bash")
+def test_source_command_without_device_exits_3(tmp_path):
+    script = L.source_command().replace("/sys/class/video4linux", str(tmp_path))
+    p = subprocess.run(["bash", "-c", script], capture_output=True, text=True, timeout=10, stdin=subprocess.DEVNULL)
+    assert p.returncode == 3 and "SteamVR" in p.stderr
+
+
+@pytest.mark.skipif(not shutil.which("bash"), reason="needs bash")
+def test_source_command_stops_when_stdin_closes(tmp_path):
+    """The SSH channel closing = EOF on stdin: the encoder must stop (it would keep the Frame busy)."""
+    dev = tmp_path / "video99"
+    dev.mkdir()
+    (dev / "name").write_text("SteamVR\n")
+    bindir = tmp_path / "bin"
+    bindir.mkdir()
+    fake = bindir / "ffmpeg"
+    fake.write_text("#!/bin/sh\nexec sleep 30\n")
+    fake.chmod(0o755)
+    script = L.source_command().replace("/sys/class/video4linux", str(tmp_path))
+    p = subprocess.Popen(["bash", "-c", script], stdin=subprocess.PIPE, stdout=subprocess.PIPE,
+                         env={"PATH": f"{bindir}:/usr/bin:/bin"})
+    time.sleep(0.5)
+    assert p.poll() is None  # streaming
+    p.stdin.close()
+    assert p.wait(timeout=5) is not None
+
+
+def trak(track_id: int, handler: bytes, entry: bytes) -> bytes:
+    tkhd = full("tkhd", 3, b"\0" * 8 + struct.pack(">I", track_id) + b"\0" * 68)
+    hdlr = full("hdlr", 0, b"\0" * 4 + handler + b"\0" * 13)
+    return box("trak", tkhd + box("mdia", hdlr + box("minf", box("stbl", box("stsd", entry)))))
+
+
+def av_init() -> bytes:
+    avc1 = box("avc1", b"\0" * 24 + struct.pack(">HH", 1280, 720) + b"\0" * 50
+               + box("avcC", bytes([1, 0x42, 0xC0, 0x1F]) + b"\0" * 4))
+    return box("ftyp", b"isom\0\0\0\0") + box("moov", trak(2, b"soun", box("mp4a", b"\0" * 28))
+                                                 + trak(1, b"vide", avc1))
+
+
+def av_fragment(video_key: bool, seq: int) -> bytes:
+    """Audio traf first (all sync samples), then the video traf."""
+    def traf(tid, flags):
+        return box("traf", full("tfhd", 0, struct.pack(">I", tid)) + full("trun", 0x4, struct.pack(">II", 1, flags)))
+    return box("moof", box("mfhd", struct.pack(">II", 0, seq)) + traf(2, 0)
+               + traf(1, 0 if video_key else L.SAMPLE_NON_SYNC)) + box("mdat", b"x" * 8)
+
+
+def test_audio_track_codecs_and_video_track():
+    init = av_init()
+    assert L.codec_string(init) == "avc1.42c01f, mp4a.40.2"
+    assert L.video_track_id(init) == 1
+    assert L.video_track_id(init_segment()) is None  # (the minimal helper has no tkhd/hdlr)
+
+
+def test_keyframe_looks_at_video_track_only():
+    assert not L.fragment_is_keyframe(av_fragment(False, 1), 1)  # the audio traf's sync sample doesn't count
+    assert L.fragment_is_keyframe(av_fragment(True, 1), 1)
+    assert not L.fragment_is_keyframe(av_fragment(True, 1), 7)  # no such track
+
+
+def test_relay_with_audio():
+    r = L.Relay()
+    r.feed(av_init() + av_fragment(True, 1) + av_fragment(False, 2) + av_fragment(False, 3))
+    _, gop, _ = r.subscribe()
+    assert len(gop) == 3  # the non-key fragments with audio didn't restart the group
+    st = r.status()
+    assert st["audio"] and st["codec"].endswith("mp4a.40.2")
+
+
+def test_source_command_captures_default_output():
+    cmd = L.source_command()
+    assert "pactl get-default-sink" in cmd and "$sink.monitor" in cmd and "-c:a aac" in cmd
+    assert "-ts mono2abs" in cmd and "-use_wallclock_as_timestamps" not in cmd  # both on pulse's wall clock
+    assert "aresample=async=1" in cmd
@@ -0,0 +1,42 @@
+"""Meta Platform SDK tracer (native/ovrtrace + patch frame.ovr_trace)."""
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+from frameport.analysis import elf
+from frameport.core.models import Analysis
+from frameport.patches import base
+from frameport.patches.frame import ovr_trace
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def _names():
+    return re.findall(r"^N\((ovr_\w+)\)$", (ROOT / "native/ovrtrace/names.inc").read_text(), re.M)
+
+
+def test_artifact_exports_every_traced_name():
+    names = _names()
+    assert len(names) == len(set(names)) > 1000
+    lib = (ROOT / "artifacts/arm64-v8a" / ovr_trace.LIB).read_bytes()
+    exported = elf.dyn_symbols(lib, True)
+    assert set(names) <= exported
+    assert "ovr_PopMessage" in names and "ovr_Message_GetRequestID" in names
+
+
+def _a(abis, libs):
+    return Analysis(package="x", version="1.0", label="X", abis=abis, engine="Unreal", xr="VrApi", graphics="GLES",
+                    direct_vrapi=False, libs=libs, launcher_activity=None, has_info_category=True, meta_permissions=[],
+                    uses_glad_gl=False, unity_msaa_levels=0, oculus_os_classes=False, is_overport_output=False,
+                    debuggable=False, extra={})
+
+
+def test_applies_only_to_arm64_games_with_the_platform_loader():
+    base.load_all()
+    p = base.REGISTRY["frame.ovr_trace"]
+    assert p.applies(_a(["arm64-v8a"], ["libUE4.so", "libovrplatformloader.so"]))
+    assert not p.applies(_a(["arm64-v8a"], ["libUE4.so"]))
+    assert not p.applies(_a(["armeabi-v7a"], ["libovrplatformloader.so"]))
+    assert p.detect(_a(["arm64-v8a"], ["libovrplatformloader.so"])) is None
+    assert p.experimental and not p.default_on
@@ -484,3 +484,29 @@ def test_stand_ins_count_only_when_the_loader_links_them(monkeypatch):
    assert detect.missing_ovr_symbols(libs) == {"ovr_Room_GetNextRoomArrayPage"}
    linked[b"loader"] = ["libovrstubs.so"]
    assert detect.missing_ovr_symbols(libs) == set()
+
+
+def test_start_activity_after_overport_conversion(tmp_path):
+    """OVRPort gives every MAIN activity LAUNCHER + VR categories (WiiCompiled: LauncherActivity and QuestActivity),
+    so the VR activity must come from the original APK's analysis; only it may stay a launcher."""
+    from conftest import build_axml
+
+    from frameport.apk import axml
+
+    def activity(name):
+        out = [("start", "activity", [("name", "str", name)]), ("start", "intent-filter", []),
+               ("start", "action", [("name", "str", axml.MAIN)]), ("end", "action")]
+        for c in (axml.LAUNCHER, axml.VR_CATEGORY):
+            out += [("start", "category", [("name", "str", c)]), ("end", "category")]
+        return out + [("end", "intent-filter"), ("end", "activity")]
+    manifest = build_axml([("start", "manifest", [("package", "str", "org.x.game")]),
+                           *activity("org.x.game.launcher.LauncherActivity"), *activity("org.x.game.QuestActivity"),
+                           ("end", "manifest")])
+    assert axml.vr_activity(manifest) is None  # can't be told apart any more
+    a = _analysis()
+    a.extra = {**(a.extra or {}), "vr_activity": "org.x.game.QuestActivity"}
+    patch = base.get("frame.start_activity")
+    with ApkWorkspace(_apk(tmp_path, manifest)) as ws:
+        ctx = base.ApkContext(ws, a, {}, Reporter(), {"frame.start_activity": {}})
+        assert patch.apply(ctx)
+        assert patch.validate(ctx) == [("Only the VR activity is a launcher", True, "org.x.game.QuestActivity")]
@@ -75,3 +75,25 @@ def test_rejected_controller_profile_is_information_only():
    f = {x.id: x for x in triage(log, "RUNNING", "com.example.game").findings}
    assert f["controller-profile-rejected"].severity == "info"
    assert triage(log, "RUNNING", "com.example.game").verdict == "pass"
+
+
+def test_swapchain_rect_invalid_is_recognised():
+    """GitHub #39: SteamVR rejected PowerWash Simulator's frames (rect a few px past the swapchain)."""
+    from frameport.validate import triage
+
+    log = "10-05 08:13:02.100  1149  1312 I FrameBridge: xrEndFrame failed -25\n"
+    assert "swapchain-rect-invalid" in [f.id for f in triage.triage(log).findings]
+
+
+def test_frames_stopped_and_unity_render_crash():
+    """The Room VR passed its launch test although Unity's render thread had crashed in libgallium (GitHub #38)."""
+    from frameport.validate import triage
+
+    log = ("10-05 23:16:30.000  1  2 I FrameBridge: pacing: 59.0 fps\n"
+           "10-05 23:16:33.137  1  3 E CRASH   : \t#01  pc 0000000000c3fe18  /vendor/lib64/libgallium_dri.so ()\n"
+           "10-05 23:16:59.000  1  4 I OvrAudio: ovrAudio_Enable\n")
+    r = triage.triage(log, "RUNNING")
+    assert [f.id for f in r.findings] == ["unity-render-crash"] and r.verdict == "fail"
+    alone = triage.triage(log.replace("libgallium_dri", "libother"), "RUNNING")
+    assert "frames-stopped" in [f.id for f in alone.findings]
+    assert triage.frames_stopped(["10-05 23:16:30.000 x FrameBridge: pacing: 72 fps", "10-05 23:16:40.000 y"]) is None
@@ -143,7 +143,7 @@ def test_packaged_app_shows_artwork_by_file_path(tmp_path, monkeypatch):
        thumbs.use_file_paths(False)


-def test_unity_oculus_check_only_for_old_unity_with_the_check():
+def test_unity_oculus_check_for_unity_with_the_check():
    base.load_all()
    p = base.get("frame.unity_oculus_check")
    old = _analysis(libs=["libunity.so", "libOVRPlugin.so"],
@@ -151,7 +151,15 @@ def test_unity_oculus_check_only_for_old_unity_with_the_check():
    assert p.applies(old) and p.detect(old).recommended
    new = _analysis(libs=["libunity.so", "libOVRPlugin.so"],
                    extra={"unity_version": "2019.4.35f1", "unity_oculus_check": True})
-    assert not p.applies(new) and p.detect(new) is None  # 2019+ runs without it: builds stay byte-identical
+    # 2019 too (BattleSisters, Unity 2019.4, stayed a 2D app without it)
+    assert p.applies(new) and p.detect(new).recommended
+    # the frame-wait shim: Unity's built-in VR loop (2017-2018, 2019 without the Oculus XR Plugin), not XR Plugin games
+    assert p.legacy_loop(old) and p.legacy_loop(new)
+    assert not p.legacy_loop(_analysis(libs=["libunity.so", "libOVRPlugin.so", "libOculusXRPlugin.so"],
+                                       extra={"unity_version": "2019.4.35f1"}))
+    assert not p.legacy_loop(_analysis(libs=["libunity.so"], extra={"unity_version": "2022.3.19f1"}))
+    none = _analysis(libs=["libunity.so", "libOVRPlugin.so"], extra={"unity_version": "2019.4.35f1"})
+    assert not p.applies(none) and p.detect(none) is None  # no check in libunity.so: nothing to change
    log = "10-04 15:08:01.000  1213  1235 I Unity   : [NewtonVR] Critical Error: Oculus / SteamVR not setup properly"
    assert "frame.unity_oculus_check" in {s for f in triage(log, "RUNNING", None).findings for s in f.suggest}

@@ -242,3 +250,44 @@ def test_scan_finds_games_in_download_manager_layouts(tmp_path, monkeypatch):
    found = {g.apk.name: g for g in quest_dump.scan(root)}
    assert set(found) == {"stray.app.apk", "com.a.game.apk", "com.b.game.apk"}
    assert found["com.a.game.apk"].data_dir == root / "Manager/Game A v1/com.a.game"
+
+
+def test_user_recipes_get_a_catalog_update_offer(tmp_path, monkeypatch):
+    """GitHub #10: a recipe whose Game settings were saved once ("user") never followed a catalog fix again; now
+    the game is flagged, and taking the offer re-derives it keeping the user's own FrameBridge settings."""
+    from frameport import pipeline
+    from frameport.core import library
+    from frameport.recommend import catalog
+
+    monkeypatch.setattr(library, "_path", lambda: tmp_path / "library.json")
+    entry = catalog.CatalogEntry(package="com.x.vr4", title="VR4", adapter={"vk_shader_fix": "1:2:3:4"})
+    monkeypatch.setattr(catalog, "lookup", lambda pkg: entry if pkg == "com.x.vr4" else None)
+    an = {"package": "com.x.vr4", "engine": "Unreal", "libs": ["libUE4.so"], "abis": ["arm64-v8a"]}
+    recipe = {"package": "com.x.vr4", "patches": {"adapter.scale": {"value": 0.9}}, "source": "user",
+              "catalog_rev": "old"}
+    (tmp_path / "library.json").write_text(__import__("json").dumps(
+        {"games": {"com.x.vr4": {"package": "com.x.vr4", "analysis": an, "recipe": recipe}}, "settings": {}}))
+    assert library.game("com.x.vr4")["catalog_update"] == entry.rev()
+    pipeline.apply_catalog_update("com.x.vr4")
+    g = library.game("com.x.vr4")
+    assert "catalog_update" not in g and g["recipe"]["patches"]["adapter.scale"] == {"value": 0.9}
+    assert g["recipe"].get("source") != "user" and "adapter.vk_shader_fix" in g["recipe"]["patches"]
+
+
+
+def test_oculus_model_checks_accept_any_device_but_the_go():
+    import struct
+
+    from frameport.patches.frame import unity_oculus_check as C
+
+    # .text: adrp x1, page(0x1000); add x1, x1, #0x10; orr w2, wzr, #6; bl ...  -> strncmp(model, "Oculus", 6)
+    code = struct.pack("<4I", 0xB0000001, 0x91004021, C.ORR_W2_6, 0x94000000)
+    other = struct.pack("<4I", 0xB0000001, 0x91008021, C.ORR_W2_6, 0x94000000)  # a different string: untouched
+    data = bytearray(0x2000)
+    data[0:16], data[16:32] = code, other
+    data[0x100F:0x1017] = b"\0Oculus\0"  # the literal at 0x1010
+    data[0x1020:0x1028] = b"OculusX\0"
+    out, n = C.oculus_model_checks(bytes(data))
+    assert n == 1
+    assert struct.unpack_from("<I", out, 8)[0] == C.MOV_W2_0 and struct.unpack_from("<I", out, 24)[0] == C.ORR_W2_6
+    assert out[0x1010:0x1016] == b"Oculus"  # the string itself stays (Unity's VR device name)
Author	SHA1	Message	Date
spoopyghosty0	f12f4aec4c	FrameBridge layer_debug: count xrAcquire/Wait/ReleaseSwapchainImage per 5 s (Vader Immortal's per-frame leak in SteamVR's runtime; hooked only with layer_debug, after the other wait/release hooks)	2026-10-06 01:23:58 -04:00
spoopyghosty0	8d95592f53	Unity 2019 built-in Oculus input on Lepton (BattleSisters, GitHub #48 ): libunity only reports controllers when the device model starts with "Oculus"; Lepton's Android is "Valve Lepton", so Unity polled only Go-style controllers and the game's buttons never arrived. unity_oculus_check revision 4 gives those strncmp calls length 0 (in place); on the device libunity now polls the Touch controllers	2026-10-06 01:19:47 -04:00
spoopyghosty0	44d23f778d	FrameBridge diagnostics from Vader Immortal (GitHub #49 ): layer_debug logs xrDestroySwapchain and per-5 s xrBeginFrame/xrEndFrame counts; strip_color_bias (drop XR_KHR_composition_layer_color_scale_bias, 2 = the layer's whole extension chain) and frame_balance (end an open frame before the next begin), both opt-in. Vader leaks ~430 GPU mappings a second inside SteamVR's runtime (GPU timing command buffers per frame); none of these stop it	2026-10-06 01:07:11 -04:00
spoopyghosty0	7a40e47e67	FramePort 0.11.0	2026-10-06 00:21:37 -04:00
spoopyghosty0	9401b7fc87	Accounting+ works (owner-verified 2026-10-06: the motion warning continues with the click emulation); catalog entry needs FramePort 0.10.1	2026-10-06 00:18:20 -04:00
spoopyghosty0	e510ea88f0	ovrpshim: log ovrp_GetNodePresent for Unity's built-in XR input and report a hand node present while its Touch controller is connected (BattleSisters: Unity's XR controller devices, which its buttons are read from, never appeared)	2026-10-06 00:17:25 -04:00
spoopyghosty0	4c2b6c9dee	Start-up recursion (GitHub #58 ): library.load() refreshes recipes from the catalog, and the catalog's first load read its auto-update setting through library.load(), which refreshed recipes again before the catalog was cached (~140 nested loads: a long blank window, or a crash in the Windows bundle). The setting is read as stored (library.peek_setting) and the catalog step can't re-enter itself	2026-10-06 00:17:14 -04:00
spoopyghosty0	cb689c576a	ovrpshim: Touch trigger or A/B/X/Y presses count as Unity mouse clicks (GetMouseButtonDown icall replaced): Accounting+'s motion warning waits for a click Lepton never delivers; input probe logs trigger/grip values	2026-10-06 00:06:18 -04:00
spoopyghosty0	bd2e1a8410	unity_oculus_check revision 3: Unity's built-in Oculus input creates Touch controllers only on device model 'Oculus Quest'; Lepton's Android is 'Valve Lepton', so the compared string is repointed in place (BattleSisters: hands tracked, buttons dead although OVRPlugin reported every press)	2026-10-05 23:39:53 -04:00
spoopyghosty0	608fac9d68	unity_oculus_check: the input probe can be switched on for a diagnostic build (FRAMEPORT_INPUT_PROBE=1)	2026-10-05 23:18:14 -04:00
spoopyghosty0	919c0e291e	focus_hold on by default with 5 s (the Frame's wear sensor flickers "HMD off" for 0.5-2 s while worn and Quest games pause each time; Lucky's Tale); Unity 2019 games on the built-in VR loop (no Oculus XR Plugin) get the ovrpshim frame wait (BattleSisters flooded 'outside of frame bounds' and hung the GPU); frame.ovr_trace: opt-in Meta Platform SDK request tracer (native/ovrtrace) for games stuck waiting (Vader Immortal, GitHub #49 ); catalog: I Am Cat pose_consistency, Lucky's Tale haptic_fix, The Room VR (all owner-verified)	2026-10-05 22:02:06 -04:00
spoopyghosty0	23f4192cfd	Game page offers a newer catalog config for recipes the user edited (GitHub #10 : a saved Game settings dialog stopped catalog fixes; saving without a change no longer marks the recipe as the user's); launch tests fail when frames stop while the process lives on (frames-stopped) and on Unity render-thread crashes in the GL driver (unity-render-crash)	2026-10-05 21:03:02 -04:00
spoopyghosty0	3391a981b8	Unity fixes from the 2026-10-05 headset round: unity_runtime_msaa_off also no-ops QualitySettings.set_antiAliasing; frame.unity_no_overlay_copy (The Room VR: OVROverlay's fade copy crashed Zink; works now); unity_oculus_check also for Unity 2019 without the frame-wait shim (BattleSisters starts VR; then a GPU lockup); frame.unity_gl_shim + gl_hide_msrtt (GL shim reads every settings source); xrshim converts haptic amplitude envelopes before OVRPort's dispatcher (haptic_fix; GitHub #9 , found by Klownicle); FrameBridge pose_consistency (GitHub #8 , proposed by Klownicle)	2026-10-05 20:55:36 -04:00
spoopyghosty0	271ce56d08	README: Live view	2026-10-05 20:05:07 -04:00
spoopyghosty0	0e47ce8f1a	Live view: sound, 360p-1080p + full-size qualities, smoother catch-up - Sound: the default output's pulse monitor (what the headset plays) as AAC in the same fMP4; the player starts muted (browser autoplay rules) with a Sound on button. Video timestamps go to the wall clock (-ts mono2abs) instead of forcing it on the pulse input, which gave bursts of AAC packets one shared timestamp; aresample=async=1 keeps the sound continuous. - Late viewers start at a keyframe of the video track (audio samples are all sync). - Qualities 360p/480p/720p/1080p scale down only; 'full' sends SteamVR's headset view at its own size (1920x1080 today; v4l2cam has no size option, so 2K/4K would only upscale). - Player keeps a 0.3 s cushion and catches up at 1.1x; it seeks only when >2 s behind (seeking to the very edge starved playback).	2026-10-05 20:05:06 -04:00
spoopyghosty0	ad924669d3	Live view tab: stream the Frame's headset view to a browser window on the PC Source: SteamVR's built-in v4l2cam headset view (steamvr-v4l2cam.service -> v4l2loopback 'SteamVR'), encoded with x264 on the Frame (fps=30 before scaling, nice 10, 3 threads) as fragmented MP4 over an SSH exec channel; ffmpeg stops when the channel closes. A relay on 127.0.0.1 keeps the init segment and the fragments since the last keyframe for late viewers and serves an MSE player page, opened in the default browser (Flet can't show video outside flet build bundles). Verified on the dev Frame: 30 fps in Edge, ~0.1 s behind the newest frame, 0.34 core at 720p with a quiet picture.	2026-10-05 20:05:06 -04:00
spoopyghosty0	311277ae40	FrameBridge rect_clamp (default on): keep submitted image rects inside their swapchain; SteamVR rejected every frame of a Unity game whose eye rect ran 4 px past it (GitHub #39 , PowerWash Simulator stuck at 'Waiting'); triage swapchain-rect-invalid, PLAYBOOK row	2026-10-05 19:17:36 -04:00
spoopyghosty0	bad59bfb5b	Steam library fallback (agent v56, GitHub #41 ): Play re-registers a devkit entry Steam forgot after a restart, the console-log appid comes from the current Steam session only, and art updates also reach the devkit entry	2026-10-05 18:57:25 -04:00
spoopyghosty0	9b57c4753f	Game list: Waltz of the Wizard (merged working config)	2026-10-05 18:51:06 -04:00
spoopyghosty0	1301e60be1	Play's devkit fallback finds the entry's appid in Steam's console log when Steam doesn't save shortcuts.vdf (agent v55; GitHub #42 : every game showed 'Game configuration unavailable')	2026-10-05 18:50:23 -04:00
spoopyghosty0	069a74f97e	Merge pull request #55 from spoopyghosty0/catalog/issue-44 catalog: com.Aldin.WotW	2026-10-05 18:48:23 -04:00
github-actions[bot]	683ae5bcf6	catalog: com.Aldin.WotW (from #44 )	2026-10-05 22:47:43 +00:00
spoopyghosty0	af904c62e6	FramePort 0.10.0	2026-10-05 18:46:18 -04:00
spoopyghosty0	f2d93af973	Game list: Tetris Effect, Iron Man VR, palazzo_santacruz (merged working configs)	2026-10-05 18:44:29 -04:00
spoopyghosty0	59fb47a827	Into The Radius 2 works: catalog vk_spec_fixes (the invalid depth resolve made models flicker and windows show behind them; found with the validation layer), status works, min_app 0.9.2; notes on Vulkan validation on the Frame	2026-10-05 18:43:39 -04:00
spoopyghosty0	9e169e069b	Merge pull request #52 from spoopyghosty0/catalog/issue-46 catalog: com.resolutiongames.abvriop.santacruz	2026-10-05 18:40:13 -04:00
spoopyghosty0	eed6e4aaed	Merge pull request #53 from spoopyghosty0/catalog/issue-47 catalog: com.camouflaj.salmon	2026-10-05 18:40:05 -04:00
spoopyghosty0	9829ee1666	Merge pull request #54 from spoopyghosty0/catalog/issue-45 catalog: com.enhanceexperience.tetriseffect	2026-10-05 18:39:56 -04:00
spoopyghosty0	13069db28a	Vulkan shim vk_spec_fixes (per game): depth images get TRANSFER_DST (not transient ones), Qualcomm shader-resolve subpasses lose their invalid depth resolve; found with the validation layer in Into The Radius 2	2026-10-05 18:19:11 -04:00
spoopyghosty0	7058105056	Launch tests wait for a first boot after an APK change (agent v54: Lepton's transient 'is not a running context' stopped them); Vulkan shim vk_validation (diagnostics: adds Khronos' validation layer, bundled in a test APK, to the game's instance; a global debug.vulkan.layers property kills Lepton's container)	2026-10-05 17:59:03 -04:00
github-actions[bot]	3929ff0a8b	catalog: com.camouflaj.salmon (from #47 )	2026-10-05 21:57:46 +00:00
github-actions[bot]	4910440f56	catalog: com.resolutiongames.abvriop.santacruz (from #46 )	2026-10-05 21:57:44 +00:00
spoopyghosty0	bda9045be6	Into The Radius 2: load only Valve's foveation layer (VALVE_rpo removed the game's fog; owner-verified), notes on the remaining pop-in	2026-10-05 17:32:58 -04:00
spoopyghosty0	a7890d46de	QuestCraft works: catalog status works (owner-verified 2026-10-05; LIBGL_NOERROR + frame.ltw_depth)	2026-10-05 17:31:35 -04:00
spoopyghosty0	50ab3eb341	frame.ltw_depth: Minecraft launchers' LTW (QuestCraft) loads OpenGL ES through libfpg.so (native/glshim/eglfmt.c), which turns desktop GL_DEPTH_COMPONENT32 into OpenGL ES depth formats; the Frame's Mesa rejected it, so the depth textures never existed and every framebuffer was incomplete (black picture)	2026-10-05 17:22:52 -04:00
spoopyghosty0	4313b52792	QuestCraft: LIBGL_NOERROR for LTW (Lepton env) gets Minecraft past its GL error 1282 at start (the picture is black next, under investigation); notes on ITR2's popping tests (vk_query_slots and Valve's FDM layer ruled out)	2026-10-05 17:09:33 -04:00
spoopyghosty0	4f9ecf4801	WiiCompiled: notes on "Start straight in VR" (owner-verified: opens in VR without the launcher window; off by default because it skips the launcher's import)	2026-10-05 16:46:12 -04:00
spoopyghosty0	9a5efa28f5	Translation template for the vk_query_slots texts	2026-10-05 16:38:30 -04:00
spoopyghosty0	cf900cd9d4	vk_query_slots: in the Game settings dialog (switch, Troubleshooting; Unreal Vulkan games), 1 = on; fix the settings-dialog test and the translation template	2026-10-05 16:37:10 -04:00
spoopyghosty0	ef21b33ca2	Vulkan shim: vk_query_slots (per game) gives occlusion queries one slot per eye; in multiview passes the Frame's Mesa driver writes the second eye's zero result into the next query, culling visible objects (Into The Radius 2's popping models; not yet confirmed in a headset). Sidebar: Sleep / Restart / Shut down below the Frame card	2026-10-05 16:30:07 -04:00
spoopyghosty0	799f1bd9f1	frame.start_activity (opt-in): start an app's VR activity directly instead of its 2D launcher (WiiCompiled's flat window stayed in view after the VR part started); per-element manifest edit, VR activity from the original APK's analysis (OVRPort gives every MAIN activity LAUNCHER + VR); notes on QuestCraft (Minecraft stops at GL error 1282) and ITR2 pop-in	2026-10-05 16:20:31 -04:00