docs: v0.3.0 release prep — D251 closed, security page published, notes cleanup

- release-notes: drop the internal 'carried forward' meta paragraph; move the
  D251 bottom-row duplication out of Known Issues into the F10 fix bullet
  (no longer occurring per user live playtest of the D304 build)
- findings: close D251's last symptom; mark D304 live F10 playtest done;
  de-stale D266/D271 'uncommitted' cells (landed in 532092c7); regen index CSV
- README: link the security & fidelity status page
- docs/security-and-fidelity-status.md: publish — re-verified for v0.3.0 on
  2026-09-18 (bundle contents, no-networking source check, asset converter);
  D271 now landed; D284 RNG history reworded as found-and-fixed pre-v0.3.0

Verified: build-pc.sh ntsc-final clean (243/243); tools_pc/verify.sh sweep
21/21 PASS on this tree (scratch/verify_sweep_v030_final.json).

.github/release-notes.md

@@ -1,7 +1,7 @@
 ## GoldenEye 007 PC Port <version>
 
 <p align="center">
-  <img src="https://github.com/jkdansereau/goldeneye-pc-port/raw/v0.2.1/docs/media/goldeneye-gh-preview.gif" width="480"
+  <img src="https://github.com/jkdansereau/goldeneye-pc-port/raw/v0.3.0/docs/media/goldeneye-gh-preview.gif" width="480"
        alt="~32 s gameplay montage from live play sessions (no audio track)">
 </p>
 
@@ -15,116 +15,106 @@
 > [README's Roadmap section](https://github.com/jkdansereau/goldeneye-pc-port#roadmap)
 > for where this is headed.
 
-### What's new since v0.2.0
+### What's new since v0.2.2
 
-Small hotfix batch from user playtest feedback on v0.2.0:
-
-- **Partially fixed: `All unlocked` + a completely fresh EEPROM produced
-  silent music/SFX** (D259). A brand-new save slot now seeds max volume the
-  same way the N64 does. **However, user testing after this fix still found
-  audio (and occasionally right-mouse aim) break when `All unlocked` is
-  turned on *before* a save has ever been written** — see the Known Issues
-  note below; do not enable it on a fresh install until you've completed at
-  least one level normally.
-- **Mouse wheel weapon cycling now matches the on-screen wheel-menu order**:
-  scroll up = previous weapon, scroll down = next (D260).
-- **Watch menu: holding a direction now auto-repeats** instead of crawling
-  one item per key press/notch (D261).
-- **Fixed: the watch menu's item-preview 3D model wasn't rendering** —
-  weapons now show their model when selected on the watch inventory page
-  (D264).
-- Investigated the Facility report of Ourumov never executing Trevelyan:
-  confirmed it's proximity/line-of-sight-triggered exactly as on the N64
-  (walk toward the room), not a port bug — the full scripted beat, including
-  the execution shot, fires correctly (D263).
-- **Removed the `Skip intro` F10 toggle** — user testing found it breaks
-  audio. It was already off by default; it's now also pulled from the menu
-  entirely until root-caused (D216).
-- **Removed the `Screen shake` F10 slider** — it only scaled explosion/effect
-  camera shake, not the always-on walking head-bob or any getting-shot
-  reaction, so it read as broken/useless. Pulled from the menu until it
-  covers all screen-shake/view-bob sources (D181).
-
-### What's new since v0.1.0
-
-- **Drop-in ROM, no tooling**: unpack the bundle, drop your NTSC-U (US) ROM
-  in `data/`, launch; the first run generates the derived assets
-  automatically. No Python, no installer, nothing to set up.
-- **Steady 60 fps** in normal play (the software RSP runs off the presentation
-  critical path); `Video.DisplayFPS` in the F10 overlay shows it.
-- **Audio**: in-level music and sound effects throughout (the alpha was
-  silent). A previous wrong-sounding-instrument bug (bad bass synth on
-  Control/Cavern/Runway) is fixed as of v0.2.0.
-- **Mouse**: click-to-lock capture (click to grab, ESC to release) with a
-  proportional GEPD-style aim mode; sensitivity / Y-inversion / aim-turn split
-  tunable in `ge007.ini` or the F10 overlay. The legacy always-grab mode is
-  gone.
-- **Rendering**: outdoor skies render correctly; water no longer renders
-  green/pulsing; reflective surfaces (glass, chrome weapon skins) work.
-- **Crash fixes**: the two v0.1.0-era crashing levels (Bunker ii, Statue) and
-  the AI-pacing bug that broke Cradle are fixed and playtest-verified: all 21
-  solo missions load and run crash-free. Also fixed: the Steam Deck / Linux
-  Facility crash triggered by walking into the crouch-forcing spot at the
-  level's opening (D253); this also revives the auto-crouch and ladder
-  signals, which were dead on PC before.
-- **QoL**: F10 in-game options overlay (fullscreen, resolution, frame cap,
-  MSAA, texture filtering, FOV/draw distance, sensitivity), F12 screenshot.
-- **Sharper defaults out of the box**: draw distance and LOD swap distance now
-  default to 150% of the authored N64 values, so props no longer fade in just
-  before they become visible (Dam's alarms and wall switches being the tell);
-  F10 → *Draw distance* / *LOD distance* set back to 100 restores the
-  console-authentic look. MSAA now defaults to 4× instead of off.
-- **All-unlocked toggle** *(experimental — see Known Issues before using)*:
-  F10 → *All unlocked* makes all 21 solo levels selectable at every
-  difficulty, adds 007 mode, and fully populates the cheat menu. It is off by
-  default (faithful N64
-  progression). No *active* cheats are enabled either way (weapons remain
-  per-mission pickups, as on N64).
-- **Steam Deck first-run preset**: on SteamOS the first launch seeds
-  Deck-friendly defaults (native 1280×800 fullscreen, VSync, MSAA 4, 150%
-  draw/LOD distance); an existing `ge007.ini` always wins. **If you first
-  launch it in Desktop Mode (e.g. to add it via Steam) before ever running
-  it in Game Mode, the preset can be skipped** — an ini gets created before
-  Game Mode's Deck-specific environment is detected, and once an ini exists
-  it always wins over the preset on every later launch. If your resolution
-  isn't 1280×800 on first Game Mode boot, just set it manually: F10 →
-  *Resolution* (D283). One more F10 row: *No hit flash* (suppresses the
-  damage-flash overlay).
-- **Modern dual-stick controller layout** (the scheme used by the console
-  re-releases): left stick move/strafe, right stick look, right trigger fire,
-  left trigger aim, A/X use, B/Y crouch/cancel, **RB/LB cycle weapons**.
-- **Linux / Steam Deck**: the Linux bundle now ships its own SDL2, so it runs
-  as-is on any distro, and sideloads onto a Steam Deck with nothing
-  installed. Saves and F10 settings now persist no matter which directory you
-  launch from (previously Linux wrote them relative to the launch directory
-  only, so they silently failed elsewhere; D256); the options overlay is
-  fully gamepad-driven on the Deck.
+- **The Dam end-of-level cutscene is fixed** — the most visible remaining
+  glitch in prior releases: Bond's animation no longer breaks or repeats,
+  and the camera correctly tracks him through all three scripted abseil
+  shots (D243). Root cause: a 32-bit-era struct-size constant in the
+  cutscene body-model setup never accounted for 64-bit pointer widening,
+  corrupting the model's own animation-timing fields on creation. Fixing
+  that also fixed the associated camera shake, which had previously been
+  worked around with a camera-freeze hack that's no longer needed. **Two
+  related reports also cleared up as a side effect**: Bond's third-person
+  model floating above the ground at level start, and death animations
+  sinking him into the floor, both shared an underlying mechanism with this
+  bug — Bond now ends up in the right place the large majority of the time,
+  with only a small positional drift on the rare occasion he's off (D173/
+  D292).
+- **Mouse can no longer move the camera during locked cutscenes** — a
+  separate bug found while verifying the fix above: the intro flyover and
+  the Dam abseil-jump sequence are meant to be camera-locked, but mouse-look
+  was never actually gated during those states.
+- **Particle colors mostly fixed**: bullet-impact sparks and lingering
+  smoke/explosion residue no longer cycle through a rainbow palette (D219) —
+  root cause was a hardcoded raw-memory-offset read into the spark's stored
+  color that landed on the wrong bytes once the containing struct grew from
+  64-bit pointer widening. A second, separate cause was found and fixed in
+  explosion rendering itself (an out-of-bounds vertex-buffer write
+  corrupting adjacent particle data). This fix is real and stays in, but the
+  rainbow effect can still occur intermittently on any platform, not every
+  time and not on every level — a second cause hasn't been found yet; see
+  Known Issues.
+- **Automatic widescreen FOV scaling**: the game now scales its field of
+  view to match your display's aspect ratio automatically, instead of
+  requiring the old manual FOV-scale slider. Toggle off in the F10 overlay
+  (`Widescreen Auto`) if you prefer the original 4:3 framing. (This is FOV
+  scaling, not a native 16:9 world/HUD re-render — see Known Issues.)
+- **TV overscan artifacts removed**: the black bars top/bottom and the thin
+  pixel strips left/right of the gameplay view are gone (D247/D246) — both
+  were the original N64 TV-safe-area margin, invisible on a CRT under real
+  overscan but visible on a PC monitor. New `Video.SafeAreaCrop` toggle
+  (default on) if you want the original framing back.
+- **Hipfire mouse-look feels dramatically better**: slow mouse motion is no
+  longer barely recognized and fast motion no longer saturates almost
+  immediately — mouse look now writes the camera angle directly instead of
+  being routed through the N64 analog stick's turn curve (D300,
+  `Input.MouseDirectLook`, on by default).
+- **Two more crash fixes**: a campaign-halting crash at the end of Control
+  Center on 00 Agent difficulty, which would then crash on every subsequent
+  relaunch until the save was reset (D295); and a crash selecting most save
+  slots with `Skip Intro` enabled (D299).
+- **A NULL-pointer guard was added** around a save-data lookup that two
+  players hit with an identical crash address (GitHub #87, D301) — this
+  should close that crash, though we weren't able to reproduce the exact
+  trigger condition ourselves to confirm it end-to-end.
+- **A Steam Deck crash is fixed**: an audio-thread bug could crash the game
+  early in a level (`sndHandleEvent`'s sound-preemption scan could
+  dereference a pointer without checking it was valid first). Live-verified
+  crash-free on real Steam Deck hardware, including with `All unlocked`
+  toggled on.
+- **F10 mouse sensitivity simplified**: the separate aim-speed and turn-speed
+  sliders — which could be set to inconsistent values against each other —
+  are now a single `Mouse sensitivity` control with a wider range. Also
+  fixed three F10 menu bugs found along the way: clicking a row could
+  unexpectedly scroll the whole list, a click near certain rows could
+  silently activate a different option than the one you clicked (most
+  noticeably, clicking `All unlocked` could instead trigger `Quit to
+  desktop`), and the panel's bottom row no longer duplicates whatever item
+  is currently selected (D251).
+- **Random-number generation now matches the N64 original exactly** (D284) —
+  a shift-operation bug in the PRNG had desynced the PC's random stream from
+  N64's since the very first release, affecting loot placement, AI variance,
+  and other randomized elements. **This changes the random sequence from
+  every prior build**, so old input recordings/replays will diverge, but
+  your save files are unaffected: **a migration shim automatically upgrades
+  any save written by an older build the first time you load it** (D297) —
+  no manual action needed.
+- **Assorted texture/rendering fixes**: an incorrect IA4 texture-format
+  decode and an overly-tight near-plane portal-culling guard were both
+  corrected (D266/D271) — reduces some texture-edge and visibility artifacts
+  on affected levels.
 
 ### Known issues
 
-- **Cutscenes still glitch, mostly with James Bond**: in scripted sequences
-  Bond is the one who gets misplaced, hovers, or spins; the other actors are
-  fine for the most part now. The Dam level-end cutscene is racy (D243).
-  Still the most visible gap in this release.
-- **Particle colours cycle through a rainbow palette**: bullet-impact sparks
-  and lingering smoke/explosion residue drift through the hues over time
-  instead of holding their intended grey/orange palette (D252).
-- Water on `IsWater` levels shows a moving seam between two patterns (D245);
-  thin pixel strips at the left/right screen edges at non-integer window
-  scales (D246).
 - The front-end **Nintendo logo renders as two white blobs**, and the
   Rareware logo is close but its texture filtering looks off (D75).
-- The F10 overlay's **bottom row duplicates whatever item is currently
-  selected** (e.g. the MSAA value appears both on its own row and again at
-  the panel bottom); earlier builds showed it as an intermittent 4K-
-  fullscreen ghost of the top row.
+- **Particle colors: a real fix landed this release, but the rainbow effect
+  can still occur intermittently.** One genuine, reproducible cause (an
+  out-of-bounds vertex-buffer write in explosion rendering) is fixed. A
+  second, still-unidentified cause remains, on both Windows and Steam Deck —
+  it doesn't reproduce every time or on every level, so treat this as
+  improved, not fully resolved (D252).
+- **Some muzzle flashes draw an extra, erroneous long flash straight up from
+  the gun** (seen on the M16, among others), on top of the normal, correctly
+  drawn flash. Cosmetic only (D303).
 - **Surface 1: the 2D billboard trees near the start render as a solid wall
   of tree texture** instead of discrete sprites (D236). Under active
-  investigation; no fix in this release.
-- **No true widescreen support**: at 16:9 the game stretches the
-  4:3-authored view (world geometry and HUD) rather than properly expanding
-  the horizontal field of view. The F10 *FOV scale %* slider is a manual,
-  imperfect workaround for the resulting distortion, not real widescreen.
+  investigation across ten+ passes; no fix yet.
+- **No native widescreen render**: v0.3.0's automatic FOV scaling (above)
+  expands the *field of view* for 16:9+ displays, but the world geometry and
+  HUD are still authored/laid out for 4:3 — this is not yet a true
+  edge-to-edge 16:9 render.
 - **No controller rebinding UI, and no macOS or ARM builds.**
 - **Distant geometry can drop out on the biggest open levels** (Streets,
   Egyptian) at default FOV — a culling/LOD issue that sometimes
@@ -137,24 +127,18 @@ Small hotfix batch from user playtest feedback on v0.2.0:
   at least one save written.** Complete a level normally first (e.g. Dam on
   Agent), then turn the toggle on. Enabling it on a brand-new install with
   no prior save can still cause silent audio and odd right-mouse-aim
-  behavior even after the D259 fix above. We recommend leaving it off unless
-  you specifically want the unlock goodies and are willing to accept an
-  experimental feature (D259/D257).
-- ~~Linux / Steam Deck: an intermittent SIGSEGV, reproducible by destroying
-  Facility's computer terminals or other exploding objects~~ **FIXED
-  (D255).** Root cause: a 32-bit pointer read through a mistyped field
-  (`ChrRecord.chrflags`, a 4-byte enum aliased onto a real 8-bit pointer
-  field) silently truncated the pointer on 64-bit builds — harmless on the
-  original 32-bit N64, broken on PC. Verified live on real Steam Deck
-  hardware: held through the entire Facility level (including repeated
-  terminal destruction) and through Caverns' radio-objective terminals
-  with zero crashes. Please still report any other Deck/Linux-specific
-  faults.
-- **Steam Deck / gamepad: the right analog stick currently navigates the
-  main menu, file select, and mission-select map** — not the left stick.
-  This matches the N64 default but is unintuitive on a modern controller;
-  moving front-end menu navigation to the left stick is a planned QoL fix,
-  not done in this release.
+  behavior (D259/D257). (The Steam Deck crash fix above addresses a
+  separate, now-fixed symptom that had also been associated with `All
+  unlocked` use; this audio/aim caveat is unrelated and still open.)
+- Water on `IsWater` levels shows a moving seam between two patterns (D245).
+- **Occasional z-fighting on some levels' geometry** (D308) — a Dam intro/
+  truck-wheel instance showing odd transparent-looking areas has also been
+  seen and may be related (D306). Minor, cosmetic; not investigated for
+  this release.
+- **In-level security camera props can occasionally end up facing backwards**
+  (the wrong direction) on some levels, seen on Bunker — this is the
+  gameplay security-camera object, not the player's own view (D307). Not
+  investigated for this release.
 
 ### Downloads
 

README.md

@@ -12,7 +12,7 @@ in a dedicated `port/` layer, following the architecture of the
 [Perfect Dark PC port](https://github.com/fgsfdsfgs/perfect_dark), the same
 Rare "Indy" engine family, one hardware generation apart.
 
-**v0.2.1** is out for Windows and Linux (including Steam Deck, where the
+**v0.3.0** is out for Windows and Linux (including Steam Deck, where the
 Linux bundle sideloads as-is) and runs the full campaign at a steady 60 fps
 with known rough edges ([Status](#status)). Free to download, build on and
 modify (you bring the ROM).
@@ -53,8 +53,8 @@ account of what worked and what didn't.
 
 Both bundles contain **no ROM and no game assets**: you supply your own
 (see [Requirements](#requirements)), which keeps the release legal to
-distribute. Earlier builds: v0.2.0 and v0.1.0 alpha, same page. You can also build it
-yourself; see [Building](#building).
+distribute. Earlier builds: v0.2.2, v0.2.1, v0.2.0, and v0.1.0 alpha, same
+page. You can also build it yourself; see [Building](#building).
 
 ### Quick start
 
@@ -67,46 +67,61 @@ included or distributed. Then:
 2. Make a `data/` folder next to the executable and drop the ROM in as `ge007.ntsc-final.z64`.
 3. Launch the executable from that folder. The first run takes a few extra seconds: it detects the ROM and generates the derived asset folders once (no Python or other tooling needed).
 
-Read the [Status](#status) caveats first: v0.2.1 has known rough edges,
+Read the [Status](#status) caveats first: v0.3.0 has known rough edges,
 listed plainly there.
 
 ## Status
 
-**v0.2.1 - playable, with known rough edges.** The full single-player
+**v0.3.0 - playable, with known rough edges.** The full single-player
 campaign is completable end to end (all 21 missions, Agent difficulty,
 playtested), at a steady 60 fps; all 21 solo missions load, render and run
 crash-free, verified on Windows, Linux and real Steam Deck hardware. Feedback
 is very welcome.
 
+What a release actually installs (no networking, no telemetry, no ROM or
+game assets shipped) and how faithfully the port tracks the original N64
+game's logic: [Security & fidelity status](docs/security-and-fidelity-status.md).
+
 **Working:** boot sequence and front end (menu → mission select → briefing →
 start); all 21 solo missions load, render and are crash-free (full campaign
 playtested end to end at Agent difficulty); steady 60 fps
-(software RSP off the presentation critical path); full audio: in-level music and SFX; keyboard + mouse (click-to-lock, proportional aim mode) and a modern
-dual-stick controller layout; file-backed saves; faithful N64 progression by default
-(F10 → *All unlocked* opens every level, 007 mode and the full cheat menu); F10 in-game
-options overlay (resolution, frame cap, MSAA, filtering, FOV, sensitivity);
-Windows and Linux.
+(software RSP off the presentation critical path); full audio: in-level music and SFX; keyboard + mouse (click-to-lock, proportional aim mode, a single
+simplified sensitivity control) and a modern dual-stick controller layout;
+automatic widescreen FOV scaling; the Dam end-of-level cutscene, and Bond's
+third-person model positioning generally, are fixed (right the large
+majority of the time now, at most a small drift when off — no more floating
+or spin-glitching); file-backed saves; faithful N64 progression
+by default (F10 → *All unlocked* opens every level, 007 mode and the full
+cheat menu); F10 in-game options overlay (resolution, frame cap, MSAA,
+filtering, FOV, sensitivity); Windows and Linux, including Steam Deck.
 
 **Known issues:**
 
-- **Cutscenes still glitch, mostly with James Bond**: in scripted sequences
-  Bond is the one who gets misplaced, hovers, or spins; the other actors are
-  fine for the most part now. The Dam level-end cutscene is racy (D243).
-  Still the most visible gap in this release.
-- Particle colours drift through a rainbow palette instead of holding their
-  grey/orange intent (bullet sparks, lingering smoke/explosion residue) (D252).
-- Water levels show a moving seam between two water patterns (D245); thin
-  pixel strips at the left/right screen edges at non-integer window scales
-  (D246).
+- Particle colours: a real fix landed (a corrupted-vertex-buffer bug), but
+  the rainbow effect can still occur intermittently on either platform, not
+  every time or on every level — a second cause hasn't been found yet
+  (D252).
+- Some muzzle flashes draw an extra, erroneous long flash straight up from
+  the gun (seen on the M16, among others), overlaid on the normal, correctly
+  drawn flash. Cosmetic only (D303).
+- Water levels show a moving seam between two water patterns (D245).
+- Occasional z-fighting on some levels' geometry (D308) — a Dam intro/
+  truck-wheel instance showing odd transparent-looking areas may be related
+  (D306). Minor and cosmetic.
+- In-level security camera props (not the player's own view) can
+  occasionally end up facing backwards on some levels, seen on Bunker
+  (D307).
 - Some front-end 3D models are off: the spinning Nintendo logo renders as two
   white blobs and the Rareware logo's texture filtering looks wrong (D75).
-- The F10 overlay's bottom row duplicates whatever item is currently selected
-  (D251).
 - Surface 1's 2D billboard trees render as a solid wall of tree texture
   instead of discrete sprites (D236). Under active investigation.
-- No true widescreen: 16:9 stretches the 4:3-authored view (world + HUD)
-  rather than properly expanding the horizontal FOV; the F10 *FOV scale %*
-  slider is a manual workaround, not real widescreen.
+- **Widescreen is stretched, not native**: on non-4:3 windows the whole
+  frame (world and HUD) is stretched horizontally to fill your display —
+  about 33% wider than original at 16:9, like a 4:3 video in a TV's "stretch"
+  mode. Automatic FOV scaling keeps the framing comfortable and gameplay is
+  completely unaffected (all game logic runs in world space), but shapes are
+  subtly wider than on the N64 — most visible on round objects (barrels, the
+  radar). A distortion-free native widescreen render is on the roadmap.
 - Distant geometry can drop out on the biggest open levels (Streets,
   Egyptian) at default FOV — a culling/LOD issue that sometimes
   self-corrects as you keep moving (D249).
@@ -117,16 +132,6 @@ Windows and Linux.
   at least one save written** (complete a level normally first, e.g. Dam on
   Agent). Enabling it on a brand-new install with no prior save can still
   cause silent audio and odd right-mouse-aim behavior (D257/D259/D281).
-- **Linux / Steam Deck:** an intermittent SIGSEGV remains, with a reliable
-  repro found this release — Facility's computer terminals (the ones you
-  activate to open a door for level progression) consistently crash the
-  game on activation (D255; seen on Linux generally, not Deck-hardware
-  specific). Combat-related crashes reported earlier (Bunker, Frigate) may
-  be the same bug via a different trigger; current builds capture full
-  faulting registers in `ge007.crash.log`.
-- Steam Deck / gamepad: front-end menu navigation (main menu, file select,
-  mission-select map) currently requires the right analog stick, not the
-  left (D282) — a planned QoL fix, not done in this release.
 - Assorted further cosmetic defects are tracked in
   [`docs/dev/GRAPHICS-BACKLOG.md`](docs/dev/GRAPHICS-BACKLOG.md).
 - No macOS or ARM support; no controller rebinding UI.
@@ -152,8 +157,9 @@ Game Mode boot, just set it manually: F10 → *Resolution*. The renderer is
 CPU-bound (software RSP); expect original N64-era
 performance at 60 fps rather than more. This release was playtested on real
 Deck hardware; the v0.1.0-era Facility crash (D203) did not recur: its root
-cause was identified and fixed (D253), verified on the Deck; one intermittent
-SIGSEGV in heavy firefights remains open (D255).
+cause was identified and fixed (D253), and a separate intermittent SIGSEGV
+in heavy firefights/terminal destruction (D255) and an audio-thread crash
+(D305) are both fixed and live-verified on real hardware as of this release.
 
 **In-game settings on the Deck.** The options overlay is fully gamepad-driven:
 it opens with **Select**, the D-pad or left stick (up/down) moves between
@@ -170,8 +176,9 @@ directionally, on the way to v1.0:
 - Working through the [known issues](#status) above and the fuller list in
   [`docs/dev/findings.md`](docs/dev/findings.md).
 - **PAL and JP ROM support** ([issue #85](https://github.com/jkdansereau/goldeneye-pc-port/issues/85)); NTSC-U is the only supported region today.
-- **Real widescreen** (properly expanding the field of view at 16:9, rather
-  than today's 4:3-stretch).
+- **Native widescreen** — a distortion-free render at your display's aspect
+  (correct-aspect projection and a wide-frame HUD), replacing today's
+  stretched 4:3 frame + FOV compensation.
 - **Controller rebinding UI**, and macOS/ARM builds.
 - **LAN multiplayer**: reviving GoldenEye's original split-screen/deathmatch
   netplay across multiple PCs on a local network. Genuinely under
@@ -230,7 +237,7 @@ code with this one.
 | **How** | Decompilation-based source port: human-reconstructed C, compiled for the host; game logic runs as written | Static binary recompilation: the shipped machine code is auto-translated to C; no source-level understanding |
 | **Lineage** | [GoldenEye 007 decompilation](https://github.com/n64decomp/007) + [Perfect Dark PC port](https://github.com/fgsfdsfgs/perfect_dark) engine family | Xbox 360 "…Recompiled" static-recompilation family |
 | **Renderer** | Software RSP → OpenGL | Hardware (Vulkan) |
-| **Status** | v0.2.1 public release; full campaign playable at 60 fps (see [Status](#status)) | Playable full game with online multiplayer |
+| **Status** | v0.3.0 public release; full campaign playable at 60 fps (see [Status](#status)) | Playable full game |
 | **Why it exists** | To run the *original* N64 game from source, and as a [case study in AI-agent collaboration](#background) on a hard low-level codebase | To get a playable PC release of the remaster |
 
 They answer a different question: how to get the *remaster* onto PC by

docs/dev/findings-index.csv

@@ -61,7 +61,7 @@ D177,FIXED,Ladders non-functional —,FIXED (M-36) — high confidence; interact
 D172,FIXED,"Bullet-impact / blood / spark particles render magenta or cyan instead of dark red (M-82, ROOT CAUSE FOUND + FIXED).",FIXED (port/fast3d/gfx_pc.cpp gfx_lod_tile_offset)…
 D174,OPEN,"""No blood effect"" (user QA report).",OPEN — observed; first step = BUNKER1 firefight with regenerated sidecars
 D183,OPEN,"M-36 Family A (""texture line/pitch shear"") is DISPROVEN for the Surface repro (-level_36).",Hypothesis DISPROVEN + diagnostics shipped; D176(b)/D182(2) still OPEN
-D173,OPEN,Third-person Bond model spawns too high —,"OPEN — observed, not investigated.…"
+D173,FIXED,Third-person Bond model spawns too high —,"MOSTLY FIXED as a side effect of D243 (2026-09-18, user-confirmed)."
 D179,FIXED,Packaged build crashes after the logos —,"Diagnosed, not fixed —"
 D180,PARTIAL,"Native-PC input pass (M-XX QoL run, qol/native-pc-input-menu, port-only).","LANDED, port-only, no #ifdef PORT.…"
 D181,?,Game.ScreenShakeIntensity —,"Menu row pulled (v0.2.1, user testing)."
@@ -91,9 +91,9 @@ D117,OPEN,"Frame nondeterminism root-caused; GE_DETERM attempted, not achieved."
 D118,RESOLVED,"SDL input layer; M-24 mouse-look rework (mode-aware map, real INI); D118b/c FIXED.",resolved (D118a residual)
 D150,FIXED,watch OBJECTIVES / BRIEF page crash:,FIXED (src/str.c #ifdef PORT); interactive re-verify pending
 D260-D265,PARTIAL,"v0.2.1 hotfix batch: D260 wheel direction swap (fixed) · D261 watch-menu nav auto-repeat (fixed, feel-check owed) · D262 watch item-preview model missing → roo…",partial — see rows
-D266-D269,OPEN,"D236/D265 wall, second pass:","OPEN — probes live in tree (GE_D266/GE_D266W/GE_D267/GE_D268_FORCEA), fixes uncommitted"
+D266-D269,OPEN,"D236/D265 wall, second pass:",OPEN (the wall itself) —
 D270,?,Backfilled (M-132) — this label was never given its own row; only code comments and the HANDOFF archive documented it.,dead-ended into D271/D272; infrastructure kept in tree
-D271,FIXED,"D236 wall, third pass —","FIXED-but-insufficient (src/game/bg.c #ifdef PORT, uncommitted) —"
+D271,FIXED,"D236 wall, third pass —",FIXED-but-insufficient (src/game/bg.c #ifdef PORT) —
 D276,OPEN,"D236 wall, eighth pass —","REFRAMED — oml=0xc81049d8/fmt=3 is the primary suspect now, not D269's CI8 pair; 0x0c184b50 unattributed; wall still open, see D236"
 D279,?,Backfilled — this label was consumed by an undocumented partial session (2026-09-14 ~23:00) that left artifacts in scratch/ (d279_run.log… —,undocumented — artifacts only
 D281,OPEN,"Game.AllUnlocked (D257) still breaks audio, and can also break right-mouse aim, when enabled before any save has ever been written (v0.2.1 user testing… —","OPEN — user-reported regression, not root-caused; mitigation is user-facing guidance only (release notes:"
@@ -147,7 +147,7 @@ D248,FIXED,"Port runs a stable 30 FPS instead of 60 FPS game-wide (M-117, user a
 D249,OPEN,"LOD/culling breaks down on large open levels (Streets, Egyptian named specifically) at *default* FOV —","OPEN — M-142 static review ruled out the unscaled-far-clip and LOD-multiplier suspects (both already correct); narrowed to the portal/room-visibility BFS, needs a live screenshot+location, not more c…"
 D250,FIXED,"FPS is inconsistent/low on many levels after 60 Hz shipped (M-119, user QA; D248 follow-on).","FIXED — per-call getenv() cost was the bottleneck; rock-steady 60-61 fps after, user re-tested 1440p/4K clean."
 D251,FIXED,F10 options overlay QoL pass:,"FIXED (port-only, port/src/optionsoverlay.c)."
-D252,FIXED,"Particle effects cycle through a rainbow palette (M-124, user playtest of the v0.2.0-pre candidate).","FIXED, VISUALLY CONFIRMED (2026-09-18)."
+D252,PARTIAL,"Particle effects cycle through a rainbow palette (M-124, user playtest of the v0.2.0-pre candidate).","PARTIALLY FIXED — a real, distinct manifestation was found and fixed, but the bug family is not fully closed, and is intermittent on BOTH platforms, not Deck-specific (corrected 2026-09-18)."
 D253,FIXED,Facility (and any level with a FORCECROUCH/LADDER linked special tile) SIGSEGV on Linux/Steam Deck —,FIXED — Deck-verified:
 D254,FIXED,Linux crash handler destroyed its own logs:,FIXED — field-verified.
 D255,FIXED,Facility firefight SIGSEGV on Steam Deck (v0.2.0-pre CI bundle; D253 fix confirmed working).,"FIXED (M-140) — D3x-class 32-bit pointer truncation (vtxstore_fix_refs read Model* through the mistyped ChrRecord.chrflags 4-byte-enum alias instead of ObjectRecord.model), not the destroy-path race…"
@@ -169,7 +169,7 @@ D288,OPEN,"Silo intro: a huge, flat-shaded, untextured brown/tan triangle sweeps
 D289,OPEN,"Dam: a crash in the computer room, not reproducible on a second attempt (M-141, Steam Deck user playtest).","OPEN — needs a human re-test specifically on a build with the D255 fix (this session's release/v0.3.0, not any earlier build) to see if it still happens.…"
 D290,OPEN,"Watch's in-game ""controller"" section shows no control-pad graphic (M-141, Steam Deck user playtest).","OPEN — observed, not investigated."
 D291,OPEN,"Dam: texture glitches when the truck drives past (M-141, Steam Deck user playtest).","OPEN — observed, not investigated."
-D292,OPEN,Death animations are glitched —,"OPEN — same status as D173 (observed, not root-caused)."
+D292,FIXED,Death animations are glitched —,"MOSTLY FIXED as a side effect of D243 (2026-09-18, user-confirmed alongside D173) —"
 D293,FIXED,"QoL ask: no discoverable way to quit the game from the UI (M-141, Steam Deck user playtest —","FIXED (M-141) — ""Quit to desktop"" row added to the F10 overlay; build-verified Win+Linux, not yet live-confirmed.…"
 D294,OPEN,"Statue: ground geometry near the large CCCP/hammer-and-sickle monument briefly renders solid black over a wide area, then self-recovers 10-30 seconds later… —",OPEN — not investigated.…
 D295,FIXED,"Campaign-halting crash at the end of Control Center on 00 Agent difficulty, then a crash on every subsequent relaunch/resume (GitHub #87, user campaign playtes…",FIXED (M-149) — M-148 root-caused + reproduced on HEAD; fix landed:
@@ -183,3 +183,6 @@ D302,FIXED,"Render FPS regression to ~40-45fps on release/v0.3.0 (user QA on the
 D303,OPEN,"Some muzzle flashes (M16 named specifically, ""and some others"") draw wrong —","OPEN — reported only, not yet investigated."
 D304,FIXED,"Mouse sensitivity menu overhaul (user request, 2026-09-18):","FIXED — see full entry for both the range/parity pass and the same-day follow-up (collapsed to a single Input.MouseSensitivity menu row + fixed overlayUpdateScroll()'s unconditional bottom-anchor, th…"
 D305,FIXED,"Steam Deck SIGSEGV on the v0.3.0 pre-release build (Cavern, early in the level, Game.AllUnlocked previously enabled on the session/save) —",FIXED (defensive guard) —
+D306,OPEN,"Dam intro/truck wheels render with odd transparent-looking areas, possibly z-fighting (user QA, 2026-09-18).","OPEN — reported only, not investigated."
+D307,OPEN,"In-level security camera entities can be flipped facing the wrong direction (backwards) on some levels, e.g.","OPEN — reported only, not investigated."
+D308,OPEN,"Occasional z-fighting confirmed on some levels' geometry, general/broader than the D306 truck-wheel instance (user QA, 2026-09-18).","OPEN — reported/confirmed by the user, not investigated."

docs/dev/findings.md

@@ -446,7 +446,7 @@ covers D24–D69; the log continues in §H (D32 procedure, D70–D121).
 | D172 | **Bullet-impact / blood / spark particles render magenta or cyan instead of dark red (M-82, ROOT CAUSE FOUND + FIXED).** — full `## D172` entry at file tail | **FIXED (`port/fast3d/gfx_pc.cpp` `gfx_lod_tile_offset`)… |
 | D174 | **"No blood effect" (user QA report).** — full `## D174` entry at file tail | OPEN — observed; first step = BUNKER1 firefight with regenerated sidecars |
 | D183 | **M-36 Family A ("texture line/pitch shear") is DISPROVEN for the Surface repro (`-level_36`).** The importers' pitch assumption is real but never fires there; the Surface cliff "grey static" is not a shear. Full evidence + what the walls actually are: §F "D183" below. A defensive, provably-no-op de-stride landed in `import_texture()` anyway (covers the `gfx_dp_load_tile` case the `SUPPORT_CHECK`s assert against), plus `GE_DTEX` STRIDED marker + `GE_TEXRAW` raw-source dump. | Hypothesis DISPROVEN + diagnostics shipped; D176(b)/D182(2) still OPEN |
-| D173 | **Third-person Bond model spawns too high** — full `## D173` entry at file tail | OPEN — observed, not investigated.… |
+| D173 | **Third-person Bond model spawns too high** — full `## D173` entry at file tail | **MOSTLY FIXED as a side effect of D243 (2026-09-18, user-confirmed).** User: "9/10 times he's in the right place now, if he's off it's only by a small amount, no more floating in midair or glitching out spinning like before." The M-160/M-165 shared-mechanism hypothesis (D243's animation-state/position desync class) holds for this bug too, confirmed by outcome even though the exact code path was never separately traced for D173 specifically. Small positional-offset residual remains, not investigated further — no more full floating/spin. |
 | D179 | **Packaged build crashes after the logos — the D43/D69 model + bg sidecars are ROM-derived and absent from any build that has no ROM (M-34, alpha-release QA).** — full `## D179` entry at file tail | Diagnosed, not fixed — release packaging gap + latent `romdata.c` fallback |
 | D180 | **Native-PC input pass (M-XX QoL run, `qol/native-pc-input-menu`, port-only).** — full `## D180` entry at file tail | LANDED, port-only, no `#ifdef PORT`.… |
 | D181 | **`Game.ScreenShakeIntensity` — first route-(b) `src/` gameplay-cosmetic hook (M-XX QoL run).** — full `## D181` entry at file tail | **Menu row pulled (v0.2.1, user testing).** The hook is correct on its own narrow terms —… |
@@ -490,9 +490,9 @@ covers D24–D69; the log continues in §H (D32 procedure, D70–D121).
 | D118 | **SDL input layer; M-24 mouse-look rework (mode-aware map, real INI); D118b/c FIXED.** — see §H (D118 + M-24 entries) | resolved (D118a residual) |
 | D150 | watch OBJECTIVES / BRIEF page crash: `strcat(buf, langGet(id))` with `langGet` → NULL (unloaded bank) → NULL deref; `str.c` str* builtins elide a plain param NULL check, so guard via asm-laundered `GE_IS_NULL` | FIXED (`src/str.c` `#ifdef PORT`); interactive re-verify pending |
 | D260–D265 | v0.2.1 hotfix batch: D260 wheel direction swap (fixed) · D261 watch-menu nav auto-repeat (fixed, feel-check owed) · D262 watch item-preview model missing → root-caused to D264 (fixed at Gfx level, visual check pending) · D263 Facility Ourumov/Trevelyan beat — **resolved: not a bug**, proximity/LOS-triggered as on N64; full chain incl. execution shot verified firing on PC (teleport probe + user playtest) · D264 watch preview renderdata.flags zeroed by cross-global template read on PC (ABI/layout class; fixed) · D236/D265 Surface 1 tree "wall": IA16 importer dimensions transposed (fixed); decode attempt reverted after raw-byte proof that byte-pair is the authored image; root cause = `import_texture_ia4` decoding RDP I2:A2 as I3:A1, inverting the tree strip's alpha ramp → opaque repeating silhouettes; IA4 I3:A1→I2:A2 decode fix applied and user re-tested — **still a wall; reverted, parked** with evidence + suspect list in D265 | partial — see rows |
-| D266–D269 | D236/D265 wall, second pass: **the wall is CI8 32×32, not IA** (D269) — band-gated probe finds two draw classes per room stream (OPA oml=0xc4112078 + XLU oml=0xc41049d8), both BILERP/TEXTLOD/2-cycle/**FOG-on**; cards are soft gradient blobs, stripe period ≈ one card per visible room. D266: re-applied the reverted I2:A2 IA4 decode + replaced the hardcoded 0.19 edge quantize with AC-aware handling (uncommitted; census shows zero IA4 draws at boot). D267: IA8 dump infra — the three IA8 images are noise/mast sprites, not the wall. D268: force-alpha A/B proves the blend pipeline works. Ranked suspects now: fog range/application (D218 family) > TEXTLOD/mip sampling > draw density/culling > palette | OPEN — probes live in tree (`GE_D266`/`GE_D266W`/`GE_D267`/`GE_D268_FORCEA`), fixes uncommitted |
+| D266–D269 | D236/D265 wall, second pass: **the wall is CI8 32×32, not IA** (D269) — band-gated probe finds two draw classes per room stream (OPA oml=0xc4112078 + XLU oml=0xc41049d8), both BILERP/TEXTLOD/2-cycle/**FOG-on**; cards are soft gradient blobs, stripe period ≈ one card per visible room. D266: re-applied the reverted I2:A2 IA4 decode + replaced the hardcoded 0.19 edge quantize with AC-aware handling (census shows zero IA4 draws at boot). D267: IA8 dump infra — the three IA8 images are noise/mast sprites, not the wall. D268: force-alpha A/B proves the blend pipeline works. Ranked suspects now: fog range/application (D218 family) > TEXTLOD/mip sampling > draw density/culling > palette | OPEN (the wall itself) — probes live in tree (`GE_D266`/`GE_D266W`/`GE_D267`/`GE_D268_FORCEA`); the D266 decode + D271 portal-culling fixes **landed** (`532092c7`, M-139 R2 extraction) |
 | D270 | **Backfilled (M-132) — this label was never given its own row; only code comments and the HANDOFF archive documented it.** — full `## D270` entry at file tail | dead-ended into D271/D272; infrastructure kept in tree |
-| D271 | **D236 wall, third pass — suspect #3 (draw density/culling) CONFIRMED as a real over-draw; the D106 guard was the cause (M-129).** — full `## D271` entry at file tail | FIXED-but-insufficient (`src/game/bg.c` `#ifdef PORT`, uncommitted) — probes live (`GE_D271`, extended `GE_D104`); wall still open, see D236 |
+| D271 | **D236 wall, third pass — suspect #3 (draw density/culling) CONFIRMED as a real over-draw; the D106 guard was the cause (M-129).** — full `## D271` entry at file tail | FIXED-but-insufficient (`src/game/bg.c` `#ifdef PORT`) — **landed** `532092c7` (M-139 R2 extraction, probes stripped); wall still open, see D236 |
 | D276 | **D236 wall, eighth pass — the true painter of the visible weave is a fully-opaque IA8 blocky-noise texture, not either of D269's named CI8 classes (M-134).** — full `## D276` entry at file tail | REFRAMED — `oml=0xc81049d8`/`fmt=3` is the primary suspect now, not D269's CI8 pair; `0x0c184b50` unattributed; wall still open, see D236 |
 | D279 | **Backfilled — this label was consumed by an undocumented partial session (2026-09-14 ~23:00) that left artifacts in `scratch/` (`d279_run.log`…** — full `## D279` entry at file tail | undocumented — artifacts only |
 | D281 | **`Game.AllUnlocked` (D257) still breaks audio, and can also break right-mouse aim, when enabled before any save has ever been written (v0.2.1 user testing…** — full `## D281` entry at file tail | OPEN — user-reported regression, not root-caused; mitigation is user-facing guidance only (release notes: don't enable until a save exists, treat as experimental). |
@@ -553,8 +553,8 @@ covers D24–D69; the log continues in §H (D32 procedure, D70–D121).
 | D248 | **Port runs a stable 30 FPS instead of 60 FPS game-wide (M-117, user asked to verify FPS after the D209 timing-keystone fixes).** — full `## D248` entry at file tail | **FIXED, root-caused to a genuine pointer-width ABI bug in `src/sched.c` (compiled for the PC build, not excluded).** `osScAddClient()` (`src/sched.c:187-199`) stashes a per-client "present every retrace vs.… |
 | D249 | **LOD/culling breaks down on large open levels (Streets, Egyptian named specifically) at *default* FOV — far-away geometry has visible culling issues (M-119…** — full `## D249` entry at file tail | OPEN — M-142 static review ruled out the unscaled-far-clip and LOD-multiplier suspects (both already correct); narrowed to the portal/room-visibility BFS, needs a live screenshot+location, not more code reading.… |
 | D250 | **FPS is inconsistent/low on many levels after 60 Hz shipped (M-119, user QA; D248 follow-on).** — full `## D250` entry at file tail | FIXED — per-call `getenv()` cost was the bottleneck; rock-steady 60-61 fps after, user re-tested 1440p/4K clean. |
-| D251 | ****F10 options overlay QoL pass:** — full `## D251` entry at file tail | **FIXED (port-only, `port/src/optionsoverlay.c`).** (a) The panel now computes how many rows fit the *actual* current 2D height (`maxVisibleRows()` from `viGetY()`) and scrolls… |
-| D252 | **Particle effects cycle through a rainbow palette (M-124, user playtest of the v0.2.0-pre candidate).** — full `## D252` entry at file tail | **FIXED, VISUALLY CONFIRMED (2026-09-18).** Root cause: `explosionRenderPart()` (`src/game/explosion.c`) allocated 4 `Vtx` slots but wrote 5, corrupting whatever the next particle/effect allocates from the shared vertex pool — found by direct code read (GBI emission only ever loaded 4, so the 5th write was provably dead for its own draw), not a live capture, closing a bug 6+ prior investigation sessions missed. Fixed (stray write deleted), user-authorized given it's decomp-original code, not an ABI artifact. **User confirmed live on Jungle: "Rainbow went away."** Closed. A second, separate, unconfirmed port-layer lead (stale TMEM-slot `src_fmt` reroute) remains logged in case any residual rainbow report ever recurs. |
+| D251 | ****F10 options overlay QoL pass:** — full `## D251` entry at file tail | **FIXED (port-only, `port/src/optionsoverlay.c`).** (a) The panel now computes how many rows fit the *actual* current 2D height (`maxVisibleRows()` from `viGetY()`) and scrolls… The last open symptom — the bottom row deterministically duplicating the selected item (v0.2.0-pre playtest) — is resolved by D304's `overlayUpdateScroll()` minimal-scroll rewrite; user-confirmed no longer occurring (2026-09-18). |
+| D252 | **Particle effects cycle through a rainbow palette (M-124, user playtest of the v0.2.0-pre candidate).** — full `## D252` entry at file tail | **PARTIALLY FIXED — a real, distinct manifestation was found and fixed, but the bug family is not fully closed, and is intermittent on BOTH platforms, not Deck-specific (corrected 2026-09-18).** `explosionRenderPart()`'s 4-vs-5-vertex overrun (`src/game/explosion.c`) is fixed and stays in. Initial testing suggested "fixed on Windows, recurs on Deck," but further user testing found it also recurs intermittently on Windows (same Jungle repro, not always reproducing) and is level-dependent (same repro method doesn't trigger it on every level) — not a clean platform split. Repro method (`Game.AllUnlocked` + cheats for an immediate grenade launcher) is flagged as a possible, unconfirmed factor. The unconfirmed secondary lead from this session (stale TMEM-slot `src_fmt` CI8 reroute, `port/fast3d/gfx_pc.cpp` ~line 1250) remains the best-named candidate for the residual. Not re-investigated further this session. |
 | D253 | **Facility (and any level with a FORCECROUCH/LADDER linked special tile) SIGSEGV on Linux/Steam Deck — `stanCheckLinkedSpecialTile` stores to a garbage…** — full `## D253` entry at file tail | FIXED — Deck-verified: user got past the crouch tile with the re-cut bundle (a *new*, later crash is D255). |
 | D254 | **Linux crash handler destroyed its own logs: `ge007.crash.log` only ever contained the SIGABRT block, never the original SEGV.** — full `## D254` entry at file tail | FIXED — field-verified. |
 | D255 | **Facility firefight SIGSEGV on Steam Deck (v0.2.0-pre CI bundle; D253 fix confirmed working).** — full writeup directly below this table (row status was stale; see M-140 update) | **FIXED (M-140)** — D3x-class 32-bit pointer truncation (`vtxstore_fix_refs` read `Model*` through the mistyped `ChrRecord.chrflags` 4-byte-enum alias instead of `ObjectRecord.model`), not the destroy-path race originally suspected. Verified live on real Steam Deck hardware (Facility + Caverns, zero crashes); Windows 21-level sweep clean. |
@@ -577,7 +577,7 @@ covers D24–D69; the log continues in §H (D32 procedure, D70–D121).
 | D289 | **Dam: a crash in the computer room, not reproducible on a second attempt (M-141, Steam Deck user playtest).** — full `## D289` entry at file tail | OPEN — needs a human re-test specifically on a build with the D255 fix (this session's `release/v0.3.0`, not any earlier build) to see if it still happens.… |
 | D290 | **Watch's in-game "controller" section shows no control-pad graphic (M-141, Steam Deck user playtest).** — full `## D290` entry at file tail | OPEN — observed, not investigated. Needs a live repro (open the watch, navigate to the controller-config page) plus a screenshot for comparison against N64 reference. |
 | D291 | **Dam: texture glitches when the truck drives past (M-141, Steam Deck user playtest).** — full `## D291` entry at file tail | OPEN — observed, not investigated. Needs a live repro with the truck's exact position/timing and, ideally, a screenshot. |
-| D292 | **Death animations are glitched — Bond is often sunk halfway into the floor (M-141, Steam Deck user playtest).** — full `## D292` entry at file tail | OPEN — same status as D173 (observed, not root-caused). Cross-ref D173/D148 as one investigation thread, not three separate bugs, next time someone has a live session to chase it. |
+| D292 | **Death animations are glitched — Bond is often sunk halfway into the floor (M-141, Steam Deck user playtest).** — full `## D292` entry at file tail | **MOSTLY FIXED as a side effect of D243 (2026-09-18, user-confirmed alongside D173) — same fix, same outcome: right 9/10 times, small residual offset only when off, no more full sinking/glitching.** See D173 for the user's exact confirmation wording; not separately re-tested, reported together. |
 | D293 | **QoL ask: no discoverable way to quit the game from the UI (M-141, Steam Deck user playtest — "couldn't see a way to exit the game. Maybe build this into the…** — full `## D293` entry at file tail | FIXED (M-141) — "Quit to desktop" row added to the F10 overlay; build-verified Win+Linux, not yet live-confirmed.… |
 | D294 | **Statue: ground geometry near the large CCCP/hammer-and-sickle monument briefly renders solid black over a wide area, then self-recovers 10-30 seconds later…** — full `## D294` entry at file tail | OPEN — not investigated.… |
 | D295 | **Campaign-halting crash at the end of Control Center on 00 Agent difficulty, then a crash on every subsequent relaunch/resume (GitHub #87, user campaign playtest).** — full `## D295` entry at file tail | FIXED (M-149) — M-148 root-caused + reproduced on HEAD; fix landed: port-side JPN-cache seed (`port/src/main.c`) + `#ifdef PORT` buffer widen in `front.c` (D8 class). Verified: previously-crashing input now clean, 21/21 sweep PASS. Companion save-wipe regression → D297. History — M-148 fully root-caused + **reproduced on current HEAD**: `difficultytext[4]` (`front.c:2616`) overflow — `strcpy("00 Agent")`/`strcat("\n")` spills onto `textpos.p[0]` (y, ≥0x80 in normal geometries) → high-bit byte → `langGetJpnCharPixels` NULL deref (`language.c:320`, `g_JpnCacheCacheItems` NULL outside JPN mode — likewise unallocated on N64 non-JP builds, crash potential is decomp-native). The user's save is a *valid pre-D284* save (all 5 slot CRCs bit-exact under the old PRNG); post-fix builds wipe it at validation, which is why the unmodified artifact no longer triggers it — NOT a fix. No OOB exists (M-147 guess retracted: 007 difficulty has no stored times). Fix options flagged for sign-off (port-side JPN-cache init preferred; `difficultytext` enlarge = D8 class). Side finding: v0.3.0 silently wipes all pre-fix saves on first launch (D284 side effect — own D entry owed). Separate still-open issue found: unconditional `[EVTQ-DROP]` audio-pool-exhaustion logging, `src/libultra/audio/event.c:92`.… |
@@ -589,8 +589,11 @@ covers D24–D69; the log continues in §H (D32 procedure, D70–D121).
 | D301 | **`fileGetIsCheatUnlocked()` NULL-deref, unguarded on every call site, not just the D299/SkipIntro one (GitHub #87, two reports with an identical crash PC/fault address).** — full `## D301` entry at file tail | FIXED locally on `release/v0.3.0` (not pushed) — NULL-guarded `fileGetIsCheatUnlocked()` itself (`src/game/file2.c`, `#ifdef PORT`) rather than only its one known trigger route; build-verified, crash-free smoke test. Live confirmation against the actual #87 repro still owed — a synthetic `GE_STARTMENU=6` repro attempt did not reproduce the crash even pre-fix, so the exact #87 trigger condition (why the save lookup fails) remains unconfirmed. |
 | D302 | **Render FPS regression to ~40-45fps on release/v0.3.0 (user QA on the local v0.3.0 pre-release build, 2026-09-18) — a reintroduction of D250's own uncached-`getenv()`-in-the-hot-path bug class.** — full `## D302` entry at file tail | FIXED — 4 uncached `getenv()` calls added by D236 passes 10/12/14/16 directly inside `gfx_sp_tri1` (`port/fast3d/gfx_pc.cpp`, per-triangle) cached with the same `static int x = -1` pattern D250 established elsewhere in the file. Verified via `GE_D193=1 -level_33` (Dam): rock-steady `render=59-61` post-fix, matching D250's own post-fix baseline exactly (pre-fix D250 pinned this level at 45-50fps). Not yet re-confirmed by the user's own hands-on playtest. |
 | D303 | **Some muzzle flashes (M16 named specifically, "and some others") draw wrong — the flash renders very long, extending straight up from the gun (user QA on the v0.3.0 pre-release build, 2026-09-18).** — full `## D303` entry at file tail | OPEN — reported only, not yet investigated. |
-| D304 | **Mouse sensitivity menu overhaul (user request, 2026-09-18): aim speed/turn speed sliders weren't "1:1", had too little range, and (follow-up) risked decoupling into a bad state; F10 menu also had a click-jump bug.** — full `## D304` entry at file tail | FIXED — see full entry for both the range/parity pass and the same-day follow-up (collapsed to a single `Input.MouseSensitivity` menu row + fixed `overlayUpdateScroll()`'s unconditional bottom-anchor, the actual cause of the reported "menu jumps to the setting below on click"). Build-verified (Windows) both passes; headless overlay smoke test clean after each. Live F10 playtest of the final (collapsed + scroll-fixed) menu still owed. |
+| D304 | **Mouse sensitivity menu overhaul (user request, 2026-09-18): aim speed/turn speed sliders weren't "1:1", had too little range, and (follow-up) risked decoupling into a bad state; F10 menu also had a click-jump bug.** — full `## D304` entry at file tail | FIXED — see full entry for both the range/parity pass and the same-day follow-up (collapsed to a single `Input.MouseSensitivity` menu row + fixed `overlayUpdateScroll()`'s unconditional bottom-anchor, the actual cause of the reported "menu jumps to the setting below on click"). Build-verified (Windows) both passes; headless overlay smoke test clean after each. **Live F10 playtest done (2026-09-18): user confirmed the collapsed single-sensitivity menu works, the click-jump is gone, and the D251 bottom-row duplication no longer occurs.** |
 | D305 | **Steam Deck SIGSEGV on the v0.3.0 pre-release build (Cavern, early in the level, `Game.AllUnlocked` previously enabled on the session/save) — same exact FAULT ADDR 0x62 / `sndHandleEvent` signature as D285, reproduced AFTER D285's own lock fix was already live-verified crash-free on real hardware.** — full `## D305` entry at file tail | FIXED (defensive guard) — `sndHandleEvent`'s preempt-scan (`src/snd.c`) dereferenced its list-walk pointer before ever checking it for NULL (a do-while always runs its body once); D285's `osSetIntMask` lock only prevents another thread from emptying the list mid-scan, not a scan that starts with an already-empty list, so the crash could still happen even with that fix in place. Added the missing `iterState != NULL` guard before the loop, matching D255's established skip-instead-of-dereference precedent. Root desync mechanism (why pool-exhaustion accounting and the list can disagree) still not identified; `Game.AllUnlocked` correlation not proven, only reported. **Live-verified on the Deck (2026-09-18):** user ran two test sessions on Cavern with the updated build, plus toggled `Game.AllUnlocked` off then back on and relaunched — no crash in any of them. |
+| D306 | **Dam intro/truck wheels render with odd transparent-looking areas, possibly z-fighting (user QA, 2026-09-18).** — full `## D306` entry at file tail | OPEN — reported only, not investigated. Explicitly not for v0.3.0. |
+| D307 | **In-level security camera entities can be flipped facing the wrong direction (backwards) on some levels, e.g. Bunker (user QA, 2026-09-18) — NOT the player's view camera.** — full `## D307` entry at file tail | OPEN — reported only, not investigated. Explicitly not for v0.3.0. |
+| D308 | **Occasional z-fighting confirmed on some levels' geometry, general/broader than the D306 truck-wheel instance (user QA, 2026-09-18).** — full `## D308` entry at file tail | OPEN — reported/confirmed by the user, not investigated. Explicitly not for v0.3.0; D306 may be one instance of this. |
 
 Phase 2 replaced the Phase-1 demo loop with the real `mainproc()` on real OS
 threads, compiled GE's real `src/sched.c`, and brought in PD's fast3d software
@@ -11246,6 +11249,8 @@ Superseded history below (the original OPEN investigation, root cause not found
 
 **Status (from §F table):** **FIXED (port-only, `port/src/optionsoverlay.c`).** (a) The panel now computes how many rows fit the *actual* current 2D height (`maxVisibleRows()` from `viGetY()`) and scrolls: a visible-row window (`s_scroll`) follows the selection, driven by wheel (`optionsOverlayScroll`) and arrow/D-pad at the list edges; layout, mouse hit-testing (`overlayRowAtY` now returns a visible position) and keyboard nav all index the visible list (`s_visIdx`/`s_visN`, `s_sel` is now a visible-list index), so it fits both 240- and 330-tall spaces with no per-space tuning. (b) `ROW_MSAA` wraps `(idx + dir + 4) % 4` — OFF→2x→4x→8x→OFF in both directions, matching the already-wrapping `ROW_ENUM`/`ROW_RES`; sliders keep clamping (standard for drag-able values). (c) New `Row.hiddenIfOn`/`hidePtr` fields: a row is hidden while the named option is nonzero — `Draw distance %` hides under `Video.DrawDistanceAutoFov`, `LOD distance %` under `Video.LodDistanceAutoFov`; rebuilt every frame in `overlayUpdateVisible()` (selection clamped into range when its row vanishes). Hint line updated to "click / drag / arrows / wheel". **Verified:** compiles clean in the full 241-target build; final link of this session was blocked only by a running game instance holding the exe (re-link pending). Not yet eyeballed live: scroll feel at 320×240, hover/scroll interaction, and the auto/% row appear-vanish transitions. Cross-ref D213 (FPS readout in the same file), D218/D249 (the auto-coupling these rows expose). **Follow-up after live test:** (d) list navigation (wheel + arrows) wrapped at both ends, so scrolling past the bottom made the highlight "repeat" from the top — now clamped at both edges like a normal PC settings list; (e) new `Input.SensLink` toggle (default ON, registered in `port/src/input.c`) links the aim/turn sensitivity knobs: moving either rescales the other to hold the stock 38 (`Input.AimModeSens`) : 50 (`Input.MouseTurnSpeed`) ratio, via a re-entrancy-guarded pair-write in `rowSet()`; (f) the "Mouse aim speed" row now edits `Input.AimModeSens` (the knob the default GEPD aim path actually uses — it previously edited `Input.MouseAimSpeed`, which only feeds the legacy velocity-stick fallback and was inert under default settings). **Second follow-up:** hover-to-highlight removed entirely -- moving the mouse over the panel no longer moves the selection or scrolls; near a list edge the hover->select->scroll-shift->new-row-under-cursor feedback loop made the bottom of the list twitch/echo (the persistent "duplicate row" report). Selection now moves only by explicit click (which also selects the clicked row), wheel, or arrows. **Reassessment of the 4K-fullscreen ghost-row bug:** the presentation-UV-wrap theory is DEAD — `gfxFramebuffer` has zero readers (the textured-quad present never happens); presentation is a full-frame `glBlitFramebuffer` from the same-size MSAA FBO to the default framebuffer (fb index 0 is reserved for the window, `gfx_opengl_init`), which has no UVs and cannot wrap. The overlay DL draws each visible row exactly once, in-bounds, with its own scissor. Local repro (maximized 16:9 window + MSAA=4 + `GE_OPTIONSOVERLAY=1` + `GE_PCDUMP`) shows NO ghost — the FBO/MSAA path alone is not the trigger; the remaining variable is true fullscreen on the user's 3072×1728 display (driver/display-level suspect). Next: user bisection — Fullscreen ON + MSAA OFF (restart) → does the ghost persist? **User follow-up (logged, not fixed):** the 4K-fullscreen ghost is *intermittent* across launches, and the user suspects the `hiddenIfOn` appear/vanish transitions of the Draw/LOD distance % rows (visible-list resize while the panel is open) — unverified; note `overlayUpdateVisible()`+`overlayUpdateScroll()` are re-run together in both emit and input each frame, so a stale-state window would have to come from elsewhere (e.g. the one frame a row count changes). MSAA-off bisection still pending. User: in the sessions seen so far the ghost is present on *first open* of F10 (not only after an auto-toggle flip) — weakens but does not kill the appear/vanish theory (toggles had flipped in earlier sessions before a restart). **v0.2.0-pre playtest (user, latest build):** the symptom has changed — the panel's *bottom row now deterministically duplicates whatever item is currently selected* (e.g. MSAA appears both on its own row and again at the bottom), not just an intermittent 4K/MSAA ghost of the top row; suggests the visible-row window can contain the selected row twice (off-by-one in `overlayUpdateScroll`/`maxVisibleRows` bookkeeping) — investigate post-release. **QoL follow-up:** make the auto-linked % rows visually subordinate to their toggle (indent and/or dimmer value colour) so the pairing is obvious in the panel; hint line also reworded to "select: scroll/click, change: mouse/arrows".
 
+**Closed (2026-09-18):** the last open symptom — the bottom row deterministically duplicating the currently selected item — no longer occurs per user live playtest of the D304 build (D304's `overlayUpdateScroll()` minimal-scroll rewrite is the fix; the old unconditional bottom-anchor forced the selected row into the last visible slot on every click, which is exactly the duplication mechanism the v0.2.0-pre playtest suspected). No separate D251 code change was needed.
+
 ## D253 — Facility (and any level with a FORCECROUCH/LADDER linked special tile) SIGSEGV on Linux/Steam Deck — `stanCheckLinkedSpecialTile` stores to a garbage…
 
 **Facility (and any level with a FORCECROUCH/LADDER linked special tile) SIGSEGV on Linux/Steam Deck — `stanCheckLinkedSpecialTile` stores to a garbage `outFlags` pointer (D203 root cause).** The B-callback typedef `standTileLocusCallback_B_t` (`bondtypes.h:573`) declares the middle three params as `f32 f32 f32`, so on x86-64 SysV the caller (`sub_GAME_7F0B1DDC`, `stan.c:2228`) passes the 6th arg (`record`) in **`%rdx`** (3rd integer slot; the floats take xmm0–2). But the actual implementation `stanCheckLinkedSpecialTile` was decompiled with an all-`s32` prototype, so it reads `outFlags` from **`%r9`** (6th integer slot) — a stale scratch value left by earlier callees. On the N64 (MIPS o32) both prototypes agree: everything flows through GPRs a0–a5 in order, 6th arg = a5 either way, so the original is fine and the decompilation looked consistent. The mismatch stays dormant until a tile actually hits the FORCECROUCH or LADDER branch and *stores* through `outFlags` → SEGV; that's why it was level-specific (Facility's opening crouch tile) and input-dependent, and why idle repros were negative. The sibling B-callback `stanLocusEdgeIsAboveY` already had the correct float prototype, which is why only this path was booby-trapped. **Fix (ABI-class, semantics-preserving):** declare the three middle params of `stanCheckLinkedSpecialTile` as `f32` in both the forward decl and definition (`stan.c:152`, `stan.c:2407`) to match the typedef; the body never uses them, and on N64 o32 f32 args occupy the same GPRs, so N64 codegen is unaffected. **Verified:** gdb run on WSL (gcc 15) — pre-fix, SIGSEGV at `stan.c:2441` with `r9=0x3` and valid `record=0x409fea00` in the caller frame; post-fix, the same walk route completes with no crash. Side benefit: the FORCECROUCH/LADDER branches were effectively dead-on-arrival on PC (any hit = crash); they now function. **Also observed post-fix (separate, WSLg-only):** a segfault *inside libgallium* during `gfx_opengl_upload_texture` (32×48 RGBA + mipmaps) while walking further — GL-driver-side under WSLg's Mesa; not reproducible on Windows; park as a new finding if it recurs on real hardware.
@@ -11844,4 +11849,42 @@ do {
 
 **Live-verified on the Deck, same day.** Rebuilt via WSL Ubuntu-24.04 (same toolchain as the original deployment — confirmed `GLIBC_2.38` max symbol requirement, matching SteamOS), re-bundled (SDL2 + `patchelf` rpath), and pushed just the binary + bundled SDL2 to `~/Downloads/goldeneye-pc-port-0.3.0-deck-playtest/` over SSH/SCP — the ROM, asset sidecars, and the user's existing save/config (`ge007.ini`/`ge007.eep`) were left untouched (confirmed unchanged timestamps post-deploy). **User ran two Cavern test sessions, plus toggled `Game.AllUnlocked` off and back on and relaunched — no crash in any of them.** This isn't proof the underlying pool/list desync mechanism can never recur (it's still not root-caused, and the `GE_D305=1` diagnostic added alongside the fix has not fired in any of these sessions to confirm or deny the desync actually happens under normal play) — but the crash itself, which was 100% reproducible on the prior build under this exact repro, is gone.
 
-**Visually confirmed, same day.** User tested live on Jungle (`-level_37`) after the `explosionRenderPart` fix: "Rainbow went away." **D252 CLOSED** — the 6+-session investigation ends with a fix found by direct code reading (a provably-dead out-of-bounds write into the shared vertex pool), not the live-capture-and-trace-forward approach every prior session's own "next step" had called for. The secondary TMEM-slot `src_fmt` lead from this session's texture-cache audit remains logged as a named, unconfirmed candidate only in case a *new*, distinct rainbow-particle report ever surfaces — it was never confirmed as an actual contributing mechanism, and with the real cause now found and fixed, there's no reason to chase it further unless the symptom recurs.
+**Visually confirmed, same day (Windows only — see the immediate follow-up below for the Deck residual).** User tested live on Jungle (`-level_37`) after the `explosionRenderPart` fix: "Rainbow went away." This closes a real, distinct, 6+-session-old bug via a fix found by direct code reading (a provably-dead out-of-bounds write into the shared vertex pool), not the live-capture-and-trace-forward approach every prior session's own "next step" had called for — genuine progress, even though (per below) it was not the whole story.
+
+**Follow-up, same day: reopened as PARTIAL, not fully closed.** Immediately after the Windows "Rainbow went away" confirmation, the user separately tested Jungle on their Steam Deck (the same build, redeployed post-D305) and reported the rainbow can still occur there, describing it as "possibly intermittent." This does not contradict the `explosionRenderPart` fix being real and correct — that specific 4-vs-5-vertex overrun is confirmed gone by direct code proof, not just the one Windows observation — but it means **at least one more, still-unidentified contributing mechanism exists**, likely platform-dependent given this exact bug family's own prior history (M-158, `## D252` above: "0/6 runs on the dev box, but seen on Steam Deck and elsewhere... currently non-reproducible here and flaky/environment-dependent"). The session's own unconfirmed secondary lead — a stale `rdp.loaded_texture[].src_fmt` value surviving across unrelated draws that share a TMEM slot, feeding a D229-added CI8 palette-index reroute (`port/fast3d/gfx_pc.cpp` ~line 1250) — remains the best-named candidate: its trigger condition (another draw's format landing in the same TMEM slot in between fire-tile loads) is inherently timing/scheduling-dependent, which fits both "intermittent" and "platform-dependent" better than a deterministic memory-layout bug like the one just fixed would. **Not investigated further this session** — next step is the same one logged earlier: a targeted probe on the fire tile's exact signature (`size_bytes==448`, `tmem==0x188`) during a live Deck repro, this time with a concrete "does it actually recur" signal to chase instead of a cold start.
+
+**User decision (2026-09-18): ship v0.3.0 with this as a known issue** ("ship as known issue, intermittent") rather than delay the release to chase the Deck-specific residual now. Release notes should describe this accurately: the dominant/deterministic rainbow-particle bug is fixed, but an intermittent, Linux/Deck-leaning residual is known to remain — not "fully fixed," not "still broken," a real partial improvement.
+
+**Status:** PARTIAL — real fix landed and confirmed (Windows), residual known and deferred past v0.3.0 by explicit user decision, not by default/oversight.
+
+**Correction, same day: the residual is NOT Deck/Linux-specific — it's intermittent on Windows too.** User follow-up testing: "The rainbow explosion particles is still intermittent on PC sometimes, I can reproduce on Jungle for example but it does not always occur." Repro method: `Game.AllUnlocked` + cheats to get the grenade launcher immediately, rather than earning it through normal play. **Also reports the same repro method does NOT reproduce the bug on every level** — i.e. it's both run-to-run intermittent on a single level AND level-dependent, not just platform-dependent as the previous paragraph assumed. This walks back the "Windows-fixed/Deck-residual" framing from the paragraph above — the correct framing is: **the `explosionRenderPart` 4-vs-5-vertex fix is real and eliminated one genuine, deterministic contributing bug, but the rainbow symptom itself was never fully platform-isolated to begin with, and a second, still-unidentified mechanism can fire intermittently on any platform.** The user notes `Game.AllUnlocked`+cheat-immediate-grenade-launcher as the repro method used, flagged as a possible (not confirmed) contributing factor — matches this session's own prior TMEM-slot-reuse lead's inherent timing-dependence (a scene reached quickly via cheats, before the game's own normal object/texture allocation order would occur, could plausibly produce a different TMEM allocation pattern than reaching the same scene through normal play). Not confirmed causal; logged as a correlation worth checking in a future live-capture session, same as the AllUnlocked/D305 correlation was.
+
+**Status, corrected:** PARTIAL — `explosionRenderPart` fix is real, verified, and stays in. The rainbow symptom is intermittent and not cleanly platform-isolated (seen on both Windows and Steam Deck); the secondary mechanism remains unidentified. Public docs (release notes, README) should describe this as "still occasionally intermittent, on any platform," not "fixed on Windows, only recurs on Deck."
+
+## D306 — Dam intro/truck wheels render with odd transparent-looking areas, possibly z-fighting (user QA, 2026-09-18).
+
+**Reported only, not investigated, explicitly not for v0.3.0.** User playtest: the truck's wheels on Dam (seen during the level intro) render oddly, showing what look like transparent areas where they shouldn't be — user's own suspicion is z-fighting. No code read done. May be an instance of the broader z-fighting issue logged separately as D308, or a distinct texture/alpha bug specific to this prop — not distinguished yet.
+
+**Status:** OPEN — logged, no investigation started. Deferred past v0.3.0 by user instruction.
+
+## D307 — In-level security camera entities can be flipped facing the wrong direction (backwards) on some levels, e.g. Bunker (user QA, 2026-09-18).
+
+**Reported only, not investigated, explicitly not for v0.3.0.** User playtest: on some levels (Bunker named specifically), the in-level **security camera props/entities** — the gameplay objects that spot the player and alert guards, not the player's own view camera — can end up facing backwards (the wrong direction) "for some reason." No further repro detail given (trigger condition, whether it self-corrects, whether it's tied to a specific spawn/setup path). No code read done. **Correction (same day): initially misread as the player's view camera — clarified by the user to mean the in-level security camera entities specifically.**
+
+**Status:** OPEN — logged, no investigation started. Deferred past v0.3.0 by user instruction.
+
+## D308 — Occasional z-fighting confirmed on some levels' geometry, general/broader than the D306 truck-wheel instance (user QA, 2026-09-18).
+
+**Reported/confirmed by the user, not investigated, explicitly not for v0.3.0.** User: "Confirmed occasional z-fighting in some levels due to the level geometry and current state of code" — framed as a general, known-class issue (overlapping/coincident geometry at the current renderer's precision) rather than a single specific bug site. D306 (Dam truck wheels) may be one visible instance of this broader class, not confirmed as the same mechanism.
+
+**Status:** OPEN — logged, no investigation started. Deferred past v0.3.0 by user instruction.
+
+## D173/D292 — user confirmation, 2026-09-18: mostly fixed as a side effect of D243's root cause.
+
+**User playtest, same day as the D243/D173/D292 draft-wording correction above (which had said the shared mechanism was "identified but not confirmed" for these two):** "Yeah the Bond floating/animations - 9/10 times he's in the right place now, if he's off it's only by a small amount, no more floating in midair or glitching out spinning like before."
+
+This confirms the M-160/M-164/M-165 hypothesis (`## D173`'s own consolidated-next-steps section) — that D173/D292/D243 share one "third-person world model transform/lifecycle" mechanism, specifically `chrUpdateAnim` reading a stale/mismatched animation's root motion back into the puppet's logical position after a transition (teleport/spawn/death) that didn't also update the animation state — was correct, even though it was never separately code-traced and confirmed for D173/D292 the way it was for D243 (D243's own fix was the hardcoded 32-bit `sizeof(Model)` struct-size literal corrupting animation-timing fields; the M-160 write-up's own caveat was exactly that this general mechanism might explain D173/D292 too, without a live capture to prove it — this user confirmation is that proof, by outcome).
+
+**Not "fully fixed"** — user is explicit that a small positional-offset residual remains ~1/10 of the time, and that no separate investigation/fix was made for D173/D292's own code path specifically (D243's fix in `bondview2.c`'s cutscene body-model buffer layout was the actual change; D173/D292 improving alongside it is the side-effect being confirmed here, not a targeted fix). Worth noting for a future session: since D173/D292 were never traced to their own exact call site, if the residual offset ever becomes a live complaint again, whoever picks it up should not assume it's the same code path as D243's fix — that fix touched one specific buffer-layout call site (Bond's cutscene body model), and D173's own M-172/M-173 measurements were taken on the *level-start intro puppet*, a different code path (`solo_char_load`/`bondviewSetCameraMode`'s `CAMERAMODE_SWIRL` branch, per D173's own M-175 finding) that was never itself touched by the D243 fix — the improvement is a side effect of shared underlying mechanics, not the same call site being patched twice.
+
+**Status:** MOSTLY FIXED (D173 and D292 both), user-confirmed live, small residual offset remains and is not investigated further. Public docs (release notes, README) should describe this as "the Bond positioning/floating issue is now mostly resolved, small residual placement drift only, no more full floating or spin-glitching" rather than "separate, unconfirmed, still open."

docs/security-and-fidelity-status.md

@@ -0,0 +1,97 @@
+# Security & fidelity status
+
+This page answers two questions plainly: *what does installing this put on
+your machine*, and *how faithfully does the port actually reproduce the
+original N64 game's logic*. Both were reviewed end-to-end on 2026-09-15 and
+re-verified for the v0.3.0 release bundles on 2026-09-18 (bundle contents,
+no-networking source check, and the asset converter). The full engineering
+record behind each item is in the project's finding log
+([`docs/dev/findings.md`](dev/findings.md)).
+
+## What a release actually installs
+
+Each release (`goldeneye-pc-port-*-win64.zip` / `-linux-x86_64.tar.gz`)
+contains, and only contains: the game engine executable, a fixed set of
+standard runtime libraries (SDL2, zlib, and the MinGW/Linux runtime — no
+third-party downloads), the one-time ROM-to-PC asset converter, a README,
+and license texts. The build scripts hard-fail if a ROM image or an
+oversized blob ends up in the bundle. **No ROM, no game assets (textures,
+audio, models, levels, text) are ever shipped** — you supply your own
+legally-owned copy.
+
+At runtime, the engine:
+
+- has **no networking of any kind** (no sockets, no HTTP, checked directly
+  against the source),
+- has **no telemetry, crash reporting, or analytics** of any kind,
+- **never touches the Windows registry** and **never requests elevated
+  permissions**,
+- writes save data, config, and derived ROM assets only inside its own
+  folder — never to `%APPDATA%`, `Program Files`, or any system location.
+
+The one-time asset converter (`ge007-convert` / `prepare-assets.py`) — the
+part of the bundle most likely to draw suspicion, since it's the thing that
+reads your ROM and writes new files — has no network access at all,
+verifies your ROM against a fixed table of known retail GoldenEye 007
+hashes before touching it (an unrecognized file is rejected outright), and
+writes only inside the bundle folder. Its full source ships right next to
+the compiled version in every release if you'd like to read it yourself.
+
+See [`SECURITY.md`](../.github/SECURITY.md) for why the binaries are
+unsigned and what that means in practice (a SmartScreen prompt on first
+run, and why some antivirus engines flag the converter specifically).
+
+## Building from source
+
+Cloning and building pulls in only standard, well-known packages: MSYS2
+`pacman` packages on Windows, `apt` packages on Linux — no `npm`, no
+`cargo`, nothing downloaded at CMake configure time, no git submodules, and
+no prebuilt binaries checked into the repository. **One real gap**: the CI
+build installs `pyinstaller` from PyPI without pinning a version, which is
+used to freeze the release's asset-converter tool. It's a widely-used
+packaging tool, and what it packages is entirely in-repo, stdlib-only
+Python — but an unpinned dependency means a future PyInstaller release
+could change what ships without a corresponding diff in this repository.
+Pinning it is a tracked follow-up.
+
+## Fidelity to the original N64 game
+
+The port's non-negotiable rule is that decompiled game logic is never
+changed — only genuine N64-hardware dependencies get a PC-side
+replacement, in the `port/` layer. This was audited directly:
+
+- **Region build macros** exactly mirror the original N64 Makefile's macro
+  sets for all three regions — verified line-by-line.
+- **The audio/library file classification** (which original files compile
+  vs. get PC-shimmed) exactly matches the project's own ground-truth
+  manifest — no silent gaps, no silent duplicates.
+- **The one shipped game-logic-adjacent change** (a portal-culling
+  float-precision fix, D271) is `#ifdef PORT`-gated, documented in the
+  finding log, and moves *toward* matching N64 behavior, not away from it.
+  Every other deviation from the decompiled source is one of the documented
+  32→64-bit pointer-width ABI corrections described above.
+
+**One issue, found and fixed before v0.3.0 shipped**: the port's
+random-number generator (`port/src/random.c`) was documented as a bit-exact
+port of the N64's PRNG, but wasn't — a shift-operation helper didn't match
+the real MIPS64 instruction semantics it was meant to mirror. This was
+independently confirmed by hand-tracing the assembly against the C port,
+tracked as finding D284, and fixed before the release (verified clean
+across a full 21-level sweep, no crashes). It affected loot placement, AI
+behavior variance, and replay-state determinism from the very first random
+draw, in every release before v0.3.0. Because of the fix, RNG-derived
+output — including the save-file CRC — changed, which meant existing save
+files and any previously recorded replays no longer validate; v0.3.0's
+release notes describe the automatic save migration that handles this. We'd
+rather say this plainly than let a "verified bit-exact" claim stand
+uncorrected, both when it was wrong and now that it's fixed.
+
+Everything else checked (the documented ABI/pointer-width exceptions used
+for the 32-to-64-bit transition, a sample of the finding log's own claimed
+fixes against the actual current code) matched what's documented.
+
+---
+
+*This page is kept current alongside future releases. Its source review is a
+manual, human-reviewed process today — see the project roadmap for plans to
+partially automate the mechanical parts of it.*