Fold release layers into first-party source on current main

.clang-format

@@ -4,3 +4,5 @@ ColumnLimit: 120
 PointerAlignment: Left
 AllowShortFunctionsOnASingleLine: Empty
 SortIncludes: Never  # include order is load-bearing in spliced TUs (runtime_ui.cpp)
+BreakStringLiterals: false  # a split literal is a token change; formatting must not make one
+SortUsingDeclarations: Never  # keep the pass layout-only (scripts/format_tokens.py)

.clang-format-ignore

@@ -0,0 +1,17 @@
+# Never formatted (scripts/format_sources.py NEVER, which this mirrors; a
+# tooling test keeps the two in step). clang-format 18 matches * within one
+# path segment, so each directory that holds C/C++ files is listed.
+runtime-recomp/RecompiledRSP/*
+runtime-recomp/guest/*
+runtime-recomp/third_party/dr_libs/*
+tests/fixtures/pattern-guard/PG006/negative/runtime-recomp/src/game/*
+tests/fixtures/pattern-guard/PG006/positive/patches/feature/native/*
+tests/fixtures/pattern-guard/PG009/negative/runtime-recomp/src/game/*
+tests/fixtures/pattern-guard/PG009/positive/runtime-recomp/src/game/*
+tests/fixtures/pattern-guard/PG010/negative/runtime-recomp/src/game/mods/*
+tests/fixtures/pattern-guard/PG010/negative/runtime-recomp/src/game/netplay/*
+tests/fixtures/pattern-guard/PG010/positive/runtime-recomp/src/game/netplay/*
+tests/fixtures/pattern-guard/PG011/negative/runtime-recomp/src/game/*
+tests/fixtures/pattern-guard/PG011/negative/runtime-recomp/src/game/generated/*
+tests/fixtures/pattern-guard/PG011/positive/runtime-recomp/build/generated/*
+tests/fixtures/pattern-guard/PG011/positive/runtime-recomp/src/game/*

.git-blame-ignore-revs

@@ -2,3 +2,5 @@
 #   git config blame.ignoreRevsFile .git-blame-ignore-revs
 # Apply ruff format, ruff --fix and shfmt to first-party scripts (A2)
 d6690f6da8690bdaf79ab898f10e5cee69f6ef07
+# Format first-party C/C++ and CMake (B9); proof: docs/fold-in/B9-format-proof.json
+52e7ae44835fb70ff4cbdb15145204ec4b73e0cb

.github/actions/prepare-dependencies/action.yml

@@ -2,16 +2,19 @@ name: Prepare reviewed dependencies
 description: Cache pinned source checkouts and verify them before every build
 inputs:
   profile:
-    description: Dependency set (host, ios, or android)
+    description: Dependency set (host, ios, android, or android-full for the whole runtime)
     default: host
+  decomp-symbols:
+    description: Check out decomp symbol tables; required automatically for host profiles
+    default: "false"
 runs:
   using: composite
   steps:
     - name: Restore dependency sources
       id: sources
       uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
-        key: sources-v2-${{ runner.os }}-${{ runner.arch }}-${{ inputs.profile }}-${{ hashFiles('dependencies.lock.json', 'patches/**', 'scripts/bootstrap_dependencies.py', 'scripts/apply_dependency_patches.py', '.github/actions/prepare-dependencies/action.yml') }}
+        key: sources-v2-${{ runner.os }}-${{ runner.arch }}-${{ inputs.profile }}-symbols-${{ inputs.decomp-symbols == 'true' || inputs.profile == 'host' }}-${{ hashFiles('dependencies.lock.json', 'patches/**', 'scripts/bootstrap_dependencies.py', 'scripts/apply_dependency_patches.py', '.github/actions/prepare-dependencies/action.yml') }}
         path: |
           extern/n64-modern-runtime
           extern/rt64
@@ -21,6 +24,7 @@ runs:
           extern/mbedtls
           extern/sdl3
           extern/sdl2
+          extern/dkr-decomp
     - name: Verify pinned sources and apply reviewed patches
       shell: bash
       env:
@@ -31,6 +35,7 @@ runs:
         host) dependencies=(n64-modern-runtime rt64 gekkonet monocypher libdatachannel mbedtls sdl3) ;;
         ios) dependencies=(rt64 sdl2) ;;
         android) dependencies=(n64-modern-runtime rt64 sdl2) ;;
+        android-full) dependencies=(n64-modern-runtime rt64 gekkonet monocypher libdatachannel mbedtls sdl2) ;;
         *)
           echo "Unknown dependency profile: $DEPENDENCY_PROFILE" >&2
           exit 1
@@ -42,6 +47,28 @@ runs:
         done
         "$PYTHON_EXECUTABLE" scripts/bootstrap_dependencies.py --shallow "${arguments[@]}"
         "$PYTHON_EXECUTABLE" scripts/apply_dependency_patches.py
+    # The guest symbol headers need the decomp's symbol tables only, not the
+    # 563 MB tree: a sparse, blob-filtered checkout of ver/symbols at the
+    # locked commit. dkr-decomp carries no reviewed patches.
+    - name: Check out the decomp symbol tables
+      if: inputs.decomp-symbols == 'true' || inputs.profile == 'host'
+      shell: bash
+      env:
+        PYTHON_EXECUTABLE: ${{ runner.os == 'Windows' && 'python' || 'python3' }}
+      run: |
+        read -r repository commit < <("$PYTHON_EXECUTABLE" -c "import json; e = next(d for d in json.load(open('dependencies.lock.json'))['dependencies'] if d['name'] == 'dkr-decomp'); print(e['repository'], e['commit'])")
+        if [[ ! -d extern/dkr-decomp/.git ]]; then
+          git init --quiet extern/dkr-decomp
+          git -C extern/dkr-decomp remote add origin "$repository"
+          git -C extern/dkr-decomp sparse-checkout set ver/symbols
+        fi
+        if [[ "$(git -C extern/dkr-decomp rev-parse --verify --quiet HEAD || true)" != "$commit" ]]; then
+          git -C extern/dkr-decomp fetch --quiet --depth 1 --filter=blob:none origin "$commit"
+          git -C extern/dkr-decomp checkout --quiet --detach "$commit"
+        fi
+        test "$(git -C extern/dkr-decomp rev-parse HEAD)" = "$commit"
+        test -f extern/dkr-decomp/ver/symbols/symbol_addrs.us.v77.txt
+        test -f extern/dkr-decomp/ver/symbols/symbol_addrs.us.v80.txt
     # Save before configuration: the cache contains reviewed source checkouts,
     # never build outputs, ROMs, generated retail code, or local game data.
     - name: Save verified dependency sources
@@ -58,3 +85,4 @@ runs:
           extern/mbedtls
           extern/sdl3
           extern/sdl2
+          extern/dkr-decomp

.github/workflows/build-android.yml

@@ -55,3 +55,56 @@ jobs:
             build/android-compile/compile_commands.json
             build/android-compile/device-objects.json
             build/android-compile/CMakeFiles/CMakeConfigureLog.yaml
+  # The folded runtime for Android: RT64 with the Android stage chain and the
+  # stage patches on top, and every first-party game TU (DKRPortGameCore),
+  # without ROM-derived payloads. Fold PR-2 merge blocker
+  # (docs/fold-in/open-items.md).
+  android-folded:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    defaults:
+      run:
+        shell: bash
+    env:
+      NDK: ndk/29.0.14206865
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: "3.12"
+      - uses: ./.github/actions/prepare-dependencies # zizmor: ignore[self-repository] -- actionlint 1.7.12 compatibility; checkout uses this workflow revision.
+        with:
+          profile: android-full
+          decomp-symbols: "true"
+      - name: Install exact device toolchain
+        run: |
+          if [[ ! -f "$ANDROID_HOME/$NDK/source.properties" ]]; then
+            "$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager" 'ndk;29.0.14206865'
+          fi
+      - name: Build the host file_to_c the Android renderer embeds shaders with
+        run: |
+          mkdir -p build/android-host-tools
+          c++ -std=c++17 -O2 -o build/android-host-tools/file_to_c extern/rt64/src/tools/file_to_c/file_to_c.cpp
+      - name: Configure the folded runtime (RT64 on, no generated payload)
+        run: |
+          cmake -S runtime-recomp -B build/android-folded -G Ninja \
+            -DCMAKE_TOOLCHAIN_FILE="$ANDROID_HOME/$NDK/build/cmake/android.toolchain.cmake" \
+            -DANDROID_ABI=arm64-v8a -DANDROID_PLATFORM=android-28 -DANDROID_STL=c++_shared \
+            -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=OFF -DCMAKE_EXPORT_COMPILE_COMMANDS=ON \
+            -DDKR_RUNTIME_BUILD_GENERATED=OFF -DDKR_RUNTIME_BUILD_RT64=ON \
+            -DDKR_ANDROID_SDL2_SOURCE="$GITHUB_WORKSPACE/extern/sdl2" \
+            -DDKR_HOST_FILE_TO_C="$GITHUB_WORKSPACE/build/android-host-tools/file_to_c"
+      - name: Build RT64, the staged dependency sources and the game TUs
+        run: cmake --build build/android-folded --parallel 4
+      - name: Preserve failure diagnostics
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: android-folded
+          retention-days: 7
+          if-no-files-found: ignore
+          path: |
+            build/android-folded/CMakeFiles/CMakeConfigureLog.yaml
+            build/android-folded/compile_commands.json

.github/workflows/build-windows.yml

@@ -122,3 +122,95 @@ jobs:
             build/host/CMakeFiles/CMakeOutput.log
             build/host/Testing/Temporary/LastTest.log
             build/host/Testing/Temporary/LastTestsFailed.log
+  # The folded tree under MSVC: the host-full-nogen preset builds RT64 with the
+  # stage chain and stage patches, and every first-party game TU
+  # (DKRPortGameCore), without ROM-derived payloads. Fold PR-2 merge blocker
+  # (docs/fold-in/open-items.md).
+  windows-full-nogen:
+    runs-on: windows-2022
+    timeout-minutes: 90
+    env:
+      SCCACHE_DIR: ${{ github.workspace }}/build/sccache
+      SCCACHE_CACHE_SIZE: 2G
+    defaults:
+      run:
+        shell: pwsh
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: "3.12"
+      # The configure runs guest_hooks.py, gen_guest_symbols.py and
+      # stage_magic_code_payload.py, which need tomllib.
+      - name: Require Python 3.11 or newer
+        run: python -c "import sys; assert sys.version_info >= (3, 11), sys.version"
+      - name: Prepare pinned runtime dependencies
+        uses: ./.github/actions/prepare-dependencies # zizmor: ignore[self-repository] -- actionlint 1.7.12 compatibility; checkout uses this workflow revision.
+        with:
+          decomp-symbols: "true"
+      - name: Install pinned compiler cache
+        uses: mozilla-actions/sccache-action@fd02668681acd5f960e1372061bee5e3e987195c # v0.0.11
+        with:
+          version: v0.18.0
+          disable_annotations: true
+      - name: Identify MSVC and SDK
+        id: compiler
+        run: |
+          $vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
+          $installation = & $vswhere -latest -products '*' -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath
+          if (!$installation) { throw 'Visual Studio C++ tools are missing' }
+          "VS_INSTALLATION=$installation" >> $env:GITHUB_ENV
+          & "$installation\Common7\Tools\Launch-VsDevShell.ps1" -Arch amd64 -HostArch amd64 -SkipAutomaticLocation
+          if (!$?) { throw 'Could not initialize the x64 MSVC environment' }
+          New-Item -ItemType Directory -Force build | Out-Null
+          $compiler = (Get-Command cl.exe).Source
+          @(
+            "MSVC: $((Get-Item $compiler).VersionInfo.FileVersion)"
+            "Compiler SHA256: $((Get-FileHash $compiler -Algorithm SHA256).Hash)"
+            "Windows SDK: $env:WindowsSDKVersion"
+            "sccache: 0.18.0"
+          ) | Set-Content build/compiler-toolchain.txt
+          $fingerprint = (Get-FileHash build/compiler-toolchain.txt -Algorithm SHA256).Hash.ToLowerInvariant()
+          "fingerprint=$fingerprint" >> $env:GITHUB_OUTPUT
+      - name: Restore compiler cache
+        id: objects
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: build/sccache
+          key: sccache-v1-windows-2022-full-nogen-${{ steps.compiler.outputs.fingerprint }}-${{ github.sha }}
+          restore-keys: sccache-v1-windows-2022-full-nogen-${{ steps.compiler.outputs.fingerprint }}-
+      - name: Configure (RT64 on, no generated payload)
+        working-directory: runtime-recomp
+        run: |
+          & "$env:VS_INSTALLATION\Common7\Tools\Launch-VsDevShell.ps1" -Arch amd64 -HostArch amd64 -SkipAutomaticLocation
+          if (!$?) { throw 'Could not initialize the x64 MSVC environment' }
+          sccache --zero-stats
+          cmake --preset host-full-nogen -DCMAKE_C_COMPILER=cl -DCMAKE_CXX_COMPILER=cl -DCMAKE_C_COMPILER_LAUNCHER=sccache -DCMAKE_CXX_COMPILER_LAUNCHER=sccache
+      - name: Build RT64, the staged dependency sources and the game TUs
+        working-directory: runtime-recomp
+        run: |
+          & "$env:VS_INSTALLATION\Common7\Tools\Launch-VsDevShell.ps1" -Arch amd64 -HostArch amd64 -SkipAutomaticLocation
+          if (!$?) { throw 'Could not initialize the x64 MSVC environment' }
+          cmake --build --preset host-full-nogen --parallel $env:NUMBER_OF_PROCESSORS
+      - name: Report compiler cache statistics
+        if: ${{ always() && steps.compiler.outcome == 'success' }}
+        run: sccache --stop-server
+      - name: Save compiler cache
+        if: ${{ success() && steps.objects.outputs.cache-hit != 'true' }}
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: build/sccache
+          key: ${{ steps.objects.outputs.cache-primary-key }}
+      - name: Preserve failure diagnostics
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: windows-full-nogen
+          retention-days: 7
+          if-no-files-found: ignore
+          path: |
+            build/compiler-toolchain.txt
+            build/host-full-nogen/CMakeFiles/CMakeConfigureLog.yaml
+            build/host-full-nogen/compile_commands.json

.github/workflows/fold-equivalence.yml

@@ -0,0 +1,30 @@
+name: Fold equivalence
+# The ROM-free subset of the fold gate's level 1: every first-party file the
+# shipped v1.0.11 binaries compile still holds its folded bytes (whitespace
+# aside). Levels 0-3 need ROM-derived payloads and run on the devops machine
+# (scripts/fold/run_equivalence.sh), whose signed fold-equivalence.json goes
+# on the PR. Required on the fold branch and fold-in-base only; retired with
+# scripts/fold/ after the first release from the folded tree.
+on:
+  push:
+    branches: [refactor/patch-fold-in]
+  pull_request:
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+jobs:
+  fold-equivalence:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: "3.12"
+      - name: First-party closure matches v1.0.11
+        run: python3 scripts/fold/equivalence.py closure --check

.github/workflows/release.yml

@@ -0,0 +1,50 @@
+name: Release gates
+# A release is an annotated tag Version<VERSION> on main (docs/RELEASING.md).
+# The builds need the maintainer's ROM-derived inputs, so they run locally
+# (scripts/release/build.py); this job runs every release gate that doesn't,
+# on the tagged commit, and fails the tag if one doesn't hold.
+on:
+  push:
+    tags: ["Version*"]
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+jobs:
+  release-gates:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: "3.12"
+      - name: Install verified lint tools
+        run: |
+          tool_dir="$RUNNER_TEMP/lint-tools"
+          python3 -m venv "$tool_dir"
+          "$tool_dir/bin/python" -m pip install --quiet \
+            --require-hashes --only-binary=:all: -r .github/lint-tools.txt
+          echo "$tool_dir/bin" >>"$GITHUB_PATH"
+      - name: The tag is Version<VERSION>
+        if: github.ref_type == 'tag'
+        env:
+          TAG: ${{ github.ref_name }}
+        run: python3 scripts/validate_release_metadata.py --tag "$TAG"
+      - name: Guard and tooling suites
+        run: python3 scripts/check.py --suite guard,tooling
+      - name: First-party closure (ROM-free fold check)
+        run: python3 scripts/fold/equivalence.py closure --check
+      - name: Formatting
+        run: python3 scripts/format_sources.py --check --local
+      # Fails while any check in scripts/release/required_checks.toml is
+      # pending (C5): no release is finalized from a tree that lacks a gate.
+      - name: Required release checks registry
+        run: python3 scripts/release/finalize.py --check-registry

.github/workflows/services-library-workflow.yml

@@ -0,0 +1,39 @@
+name: Service - library workflow
+on:
+  push:
+    branches: [main]
+    paths: ["services/library-workflow/**", "services/test-tools/**", ".github/workflows/services-library-workflow.yml"]
+  pull_request:
+    paths: ["services/library-workflow/**", "services/test-tools/**", ".github/workflows/services-library-workflow.yml"]
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+jobs:
+  # Stages the website/API update over services/library-workflow/baseline and
+  # runs its tests on the staged bundle (services/library-workflow/README.md).
+  library-workflow:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 24
+      - name: Stage tests
+        run: python3 -B services/library-workflow/tests/build_tests.py
+      - name: Stage the bundle
+        run: python3 -B services/library-workflow/build.py stage --output "$RUNNER_TEMP/stage"
+      - name: Workflow checks
+        run: node services/library-workflow/tests/run.cjs "$RUNNER_TEMP/stage"
+      - name: Cloudflare runtime checks (Miniflare)
+        run: |
+          npm ci --prefix services/test-tools --ignore-scripts
+          node services/library-workflow/tests/d1-runtime.cjs "$RUNNER_TEMP/stage" services/test-tools/node_modules/miniflare