Merge restore-cut-vtvs: the cut vehicles, and the reference to go with them

Started as a question about eleven vehicles and seven maps missing from
our resource file. They were in a community 4.11 build; verifying that
file as a strict superset and promoting it brought them back, and most of
what follows came out of having to prove things about the file rather
than guess.

  * The cut VTVs restored, and the content pipeline (RPL4TOOL -b) made to
    work in this tree for the first time.
  * The front end fits 800x600, uses dropdowns, and no longer paints
    Windows grey over its own green.
  * VTV-PRESETS.html: 38 vehicles, loadouts and six-preset tables decoded
    by resource id, tabbed by hull.
  * TRACKS.html: all 18 tracks. Nine now show the setup console's own
    maps, recovered rather than reconstructed; the other nine are the
    course traced through their gates.
  * The airlock archive tracked whole, so those promotions stay
    checkable, plus the console's track, vehicle and pod art.

Two corrections worth carrying: the vehicles were cut BY 4.11 rather than
never shipped - ALPHA_1/REL410 is a cockpit of the ALPHA wing and its
RPL4.RES is the retail file - and the top-down projection was mirrored,
which the console's picture of Brewer's Bane caught.

.gitignore

@@ -45,6 +45,15 @@ rpl4.log
 # on somebody's desk.
 mfd_layout.cfg
 
+# The pilot's callsign, remembered between sessions. Whoever is sitting
+# at this machine, which is not the repo's business.
+pilot.cfg
+
+# Generated by stamp-version.ps1 as RP_L4's pre-build step. The patch
+# number in it IS this repository's commit count, so a committed copy
+# would be stale the moment it was committed.
+/RP_L4/rpl4build.h
+
 # Build-output static libs that land in lib/ (the two committed dependency
 # libs, OpenAL32.lib and libsndfile-1.lib, stay tracked).
 /lib/Munga_L4.lib
@@ -75,3 +84,10 @@ assets/**/last.spl
 
 # packaged releases (attached to Gitea releases, not tracked)
 RedPlanet-*.zip
+
+# Crash dumps sent in by testers. Read them with cdb against the matching
+# Release\rpl4opt.pdb - the PE timestamp in the dump says which build, and
+# the symbols only mean anything if it matches. They are not ours to keep
+# in the history: a minidump carries process memory and the sender's own
+# file paths.
+/Crashdmp/

BUILD.md

@@ -50,10 +50,57 @@ The solution is [WinTesla.sln](WinTesla.sln) with four v143 projects:
 Build order is resolved by `ProjectReference` (RP_L4 and RPL4TOOL both reference
 Munga_L4).
 
+**Versioning:** the patch number *is* the repository's commit count, so a
+build always names the commit it came from and there is no question about
+which changes a given binary contains.
+[stamp-version.ps1](stamp-version.ps1) runs as RP_L4's pre-build step and
+writes the generated, uncommitted `RP_L4\rpl4build.h`:
+
+```
+#define RP412_VERSION       "4.12.96"
+#define RP412_VERSION_LONG  "4.12.96 (a1b2c3d)"
+```
+
+The game logs the long form on its first line. A trailing `+` on the hash
+means the tree had uncommitted changes to tracked files when it was built —
+useful when a test machine reports something a clean build cannot reproduce.
+Only the `4.12` product line is set by hand, at the top of the script.
+
+**Test builds expire.** `$expireDays` at the top of the same script is the
+shelf life in days (currently **14**, counted from the day it was *built*,
+not the day the code was written — rebuilding an old commit gives a usable
+binary rather than one born stale). An expired build says so in a dialog,
+names its version and expiry date, points at the releases page, and exits
+without running. It stops a tester spending an afternoon on something that
+was fixed a week ago.
+
+> ⚠️ **Set `$expireDays = 0` for a real release.** A shipped build that
+> expires is a catastrophe, and that one line is what decides it.
+
+`RP412NOEXPIRY=1` waives the check when an old build has to be run on
+purpose, and says so in the log so a waived build is never mistaken for a
+current one. It is deliberately **not** listed in `environ.ini` — a bypass
+every tester can see is a bypass every tester will use. Negative
+`$expireDays` backdates the expiry, which is how the refusal gets tested
+without touching the machine's clock.
+
+The header is deliberately not committed: the commit that recorded a
+hardcoded number would itself change the count, so the file would be stale
+the moment it landed. It is rewritten only when the stamp actually changes,
+so ordinary rebuilds do not recompile `RPL4.CPP` for nothing. Building
+outside a git checkout stamps `4.12.x (no repository)` rather than inventing
+a number that would sort against real ones.
+
 **Packaging:** [pack-dist.ps1](pack-dist.ps1) assembles a runnable game into
-`dist\` (exe + PDB, game data, OpenAL/libsndfile runtimes, desktop
+`dist\` (exe + PDB, game data, OpenAL/libsndfile runtimes, launch scripts,
-`environ.ini`, `start-windowed.bat`, README). Pass `-Zip` to also produce
+HANDBOOK.html, README). It deliberately does **not** write `environ.ini` —
-`dist\RedPlanet412-prototype.zip` for handing to someone else.
+the exe carries that template and writes it on first run
+([RP_L4/RPL4ENVIRON.cpp](RP_L4/RPL4ENVIRON.cpp)), so a tester can drop a new
+build over an old folder without losing their settings. Pass `-Zip` to also produce
+`RedPlanet-<version>.zip` for handing to someone else. It reads the version
+from `rpl4build.h` rather than asking git again, so the package and the
+binary inside it cannot disagree, and it warns if the build it is packing
+came from a modified tree.
 
 ## 3. VS2022 migration notes (what changed and why)
 

MUNGA/APP.cpp

@@ -649,8 +649,23 @@ Time endIntercom = Now();
 	//
 	if (GetApplicationState() == RunningMission)
 	{
-		secondsRemainingInGame =
+		//
-			currentMission->GetGameLength() - (Now() - gameStarted);
+		// Ask the console first: it owns the clock that actually ends the
+		// race, so this is the countdown the buzzer will agree with. Its
+		// own reckoning is the fallback for everything with no console of
+		// its own - see gMissionClockHook in APPMGR.h.
+		//
+		Scalar console_remaining;
+		if (gMissionClockHook != NULL &&
+			(*gMissionClockHook)(&console_remaining))
+		{
+			secondsRemainingInGame = console_remaining;
+		}
+		else
+		{
+			secondsRemainingInGame =
+				currentMission->GetGameLength() - (Now() - gameStarted);
+		}
 	}
 	routePacketFinished = False;
 
@@ -1125,6 +1140,12 @@ void
 	Check(this);
 	Check(egg_notation_file);
 
+	//
+	// Forget every peer's clock offset: the hosts in the next race are not
+	// the hosts in the last one, and a HostID gets reused.
+	//
+	NetClock_Reset();
+
 	//
 	//--------------------------------------------------------------------------
 	// Create mission from egg notation file

MUNGA/APPMGR.cpp

@@ -15,6 +15,9 @@ Logical gConsoleMarshalsLaunch = False;
 // losing the console mid-mission ends it (lobby-member races)
 Logical gConsoleLossEndsMission = False;
 
+// the console's countdown, when a console is marshalling (see APPMGR.h)
+Logical (*gMissionClockHook)(Scalar *seconds_remaining) = NULL;
+
 ApplicationManager* ApplicationManager::CurrentAppManager = NULL;
 
 ApplicationManager::ApplicationManager(HINSTANCE hInstance, HWND hWnd, Scalar frame_rate) : Node(ApplicationManagerClassID), runningApplications(this)

MUNGA/APPMGR.h

@@ -20,6 +20,28 @@ extern Logical gConsoleMarshalsLaunch;
 // console to return, exactly as always.
 extern Logical gConsoleLossEndsMission;
 
+//
+// The console's own countdown, when there is a console to ask.
+//
+// A mission ends when the console says so, but secondsRemainingInGame was
+// computed here from the engine clock and its own idea of when the race
+// started - a different clock, from a different epoch, than the one that
+// actually fires the buzzer. The two agree to within a frame or so, which
+// is why nobody noticed, but they are not the same number: the cockpit
+// clock could read 0:00 with the race still running, and the camera
+// directors' "last 30 seconds" behaviour switched on the engine's reading
+// rather than on the real remaining time.
+//
+// Set by the console when it is marshalling; NULL restores the engine's
+// own reckoning, which is what the arcade -net pods, lobby members and
+// mission review all use (none of them run a console locally, and their
+// clock is anchored by the console's RunMission arriving anyway).
+//
+// Returns False when it has no answer yet - the window between the
+// application reaching RunningMission and the console noticing.
+//
+extern Logical (*gMissionClockHook)(Scalar *seconds_remaining);
+
 class ApplicationManager : public Node
 {
 public:

MUNGA/AUDIO.cpp

@@ -94,8 +94,16 @@ void
 	}
 	headEntitySocket.Add(entity);
 
-   alDistanceModel(AL_LINEAR_DISTANCE);
+   // FIDELITY (docs/SOUND.md F3/F10): the engine computes the AUTHORED distance
-   alDopplerFactor(0.3f);
+   // attenuation curve (AUDIO.INI amplitude_rolloff knee/exponent ->
+   // AudioLocation::distanceVolumeScale) and the AUTHORED doppler-cents model
+   // (doppler_range=600 / speed_of_sound=250) on every spatial update.  Disable
+   // OpenAL's own models so they cannot double-apply or fight them:
+   // AL_LINEAR_DISTANCE faded distant audio to zero on a straight line where the
+   // authored curve still sits near 44% at the clip edge, and AL doppler ran at
+   // the wrong constants with a sign-inverted velocity feed.
+   alDistanceModel(AL_NONE);
+   alDopplerFactor(0.0f);
 
 	#if 0
 	//

MUNGA/ENTITY.cpp

@@ -377,8 +377,28 @@ void
 	//------------------------------------------------------------------------
 	// Step through each block until there are no more remaining, and send the
 	// update out the the simulation indicated by the subsystemID
+	//
+	// This is the only point on the receive path that knows WHOSE update
+	// this is - the records themselves carry a timestamp but not an owner -
+	// so the sender is published here for the net clock to align against.
+	// Every record in the message, and the damage zones nested inside them,
+	// came from the same machine in the same frame.
 	//------------------------------------------------------------------------
 	//
+	//
+	// Only for an entity somebody else owns. Our own clock needs no
+	// aligning, and an update we somehow handed ourselves would otherwise
+	// drag lastUpdate back by a frame for no reason.
+	//
+	Check(application);
+	Check(application->GetHostManager());
+	Logical remote_owner =
+		GetOwnerID() != application->GetHostManager()->GetLocalHostID();
+	if (remote_owner)
+	{
+		NetClock_BeginUpdate(GetOwnerID());
+	}
+
 	while (stream.GetBytesRemaining())
 	{
 		Simulation::UpdateRecord *update =
@@ -389,6 +409,11 @@ void
 		simulation->ReadUpdateRecord(update);
 		stream.AdvancePointer(update->recordLength);
 	}
+
+	if (remote_owner)
+	{
+		NetClock_EndUpdate();
+	}
 	Check_Fpu();
 }
 

MUNGA/GAUGREND.cpp

@@ -21,6 +21,31 @@
 	BitTrace Gauge_Renderer("Gauge Renderer");
 #endif
 
+//
+// How long a single background pass may spend drawing gauges, in
+// milliseconds. RP412GAUGESLICE tunes it; 0 restores the original
+// behaviour of exactly one gauge per pass.
+//
+static long
+	GaugeSliceMs()
+{
+	static long
+		slice = -1L;
+
+	if (slice < 0L)
+	{
+		const char
+			*setting = getenv("RP412GAUGESLICE");
+
+		slice = (setting != NULL) ? atol(setting) : 2L;
+		if (slice < 0L)
+		{
+			slice = 0L;
+		}
+	}
+	return slice;
+}
+
 //#######################################################################
 // Miscellaneous utilities
 //#######################################################################
@@ -3683,7 +3708,27 @@ Logical
 
 	case background:
       {
-         result = ProcessOneActiveGauge();
+         //-----------------------------------------------------------
+         // Draw gauges until the slice is spent, rather than exactly
+         // one per pass.
+         //
+         // The background loop is only guaranteed a single pass per
+         // frame; it gets more only while time remains before the
+         // frame is due. On a busy map the 3D foreground eats the
+         // whole budget, so a cycle of ninety-odd gauges takes
+         // ninety-odd frames to come round and the displays sit
+         // frozen for seconds. Working to a slice makes the refresh
+         // rate depend on elapsed time instead of on how much spare
+         // frame there happened to be.
+         //-----------------------------------------------------------
+         Time slice_end = Now();
+         slice_end += GaugeSliceMs();
+
+         do
+         {
+            result = ProcessOneActiveGauge();
+         }
+         while (result && taskMode == background && Now() < slice_end);
 		   break;
       }
 

MUNGA/SIMULATE.cpp

@@ -264,6 +264,109 @@ Simulation::SharedData
 // Model support
 //
 
+//~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+//
+//##########################################################################
+// Net clock - see SIMULATE.h for why the sender's timestamp is estimated
+// rather than used as it stands.
+//##########################################################################
+
+namespace
+{
+	enum
+	{
+		netClockMaxPeers = 16,
+
+		// Samples per rolling minimum. A peer sends one record per
+		// simulation per frame, so at eight vehicles and 60 fps this is
+		// well under a second - fast enough to follow a route change,
+		// long enough that the minimum means something.
+		netClockWindow = 128,
+
+		// The furthest back we will believe a timestamp. Beyond this the
+		// packet is stale or the estimate is wrong, and extrapolating a
+		// vehicle half a second forward does more harm than the lag we
+		// are correcting.
+		netClockMaxLagTicks = 500
+	};
+
+	struct PeerClock
+	{
+		HostID	host;
+		Logical	inUse;
+		Logical	settled;
+		long	offsetTicks;		// our clock - their clock
+		long	windowMinTicks;
+		int		windowCount;
+	};
+
+	PeerClock	gPeerClocks[netClockMaxPeers];
+	HostID		gUpdateSender = 0;
+	Logical		gUpdateSenderValid = False;
+
+	Logical NetClockEnabled()
+	{
+		static int enabled = -1;
+		if (enabled < 0)
+		{
+			const char *setting = getenv("RP412NETCLOCK");
+			enabled = (setting != NULL && atoi(setting) == 0) ? 0 : 1;
+			if (!enabled)
+			{
+				DEBUG_STREAM << "NetClock: disabled by RP412NETCLOCK=0 - "
+					<< "replicants dead-reckon from arrival time\n" << std::flush;
+			}
+		}
+		return enabled ? True : False;
+	}
+
+	PeerClock *FindPeer(HostID host)
+	{
+		PeerClock *free_slot = NULL;
+		for (int i = 0; i < netClockMaxPeers; ++i)
+		{
+			if (gPeerClocks[i].inUse)
+			{
+				if (gPeerClocks[i].host == host)
+				{
+					return &gPeerClocks[i];
+				}
+			}
+			else if (free_slot == NULL)
+			{
+				free_slot = &gPeerClocks[i];
+			}
+		}
+		if (free_slot != NULL)
+		{
+			free_slot->inUse = True;
+			free_slot->host = host;
+			free_slot->settled = False;
+			free_slot->offsetTicks = 0;
+			free_slot->windowMinTicks = 0;
+			free_slot->windowCount = 0;
+		}
+		return free_slot;
+	}
+}
+
+void NetClock_BeginUpdate(HostID sender)
+{
+	gUpdateSender = sender;
+	gUpdateSenderValid = True;
+}
+
+void NetClock_EndUpdate()
+{
+	gUpdateSenderValid = False;
+}
+
+void NetClock_Reset()
+{
+	memset(gPeerClocks, 0, sizeof(gPeerClocks));
+	gUpdateSenderValid = False;
+}
+
 //~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 //
 void
@@ -272,7 +375,84 @@ void
 	Check(this);
 	Check_Pointer(message);
 
-	lastUpdate = Now();     // HACK - should be based upon message->timeStamp
+	//
+	//------------------------------------------------------------------
+	// When this update arrived is not when it was taken. Put lastUpdate
+	// at the sender's sampling moment, expressed in our clock, so the
+	// dead reckoner extrapolates over the network latency instead of
+	// starting from scratch once it has already elapsed.
+	//------------------------------------------------------------------
+	//
+	long now_ticks = Now().ticks;
+	long local_ticks = now_ticks;
+
+	PeerClock *peer = gUpdateSenderValid && NetClockEnabled()
+		? FindPeer(gUpdateSender) : NULL;
+	if (peer != NULL)
+	{
+		//
+		// sample = trueOffset + oneWayLatency, so the running minimum
+		// converges on the offset from above.
+		//
+		long sample = now_ticks - message->timeStamp.ticks;
+
+		if (!peer->settled)
+		{
+			peer->settled = True;
+			peer->offsetTicks = sample;
+			peer->windowMinTicks = sample;
+			peer->windowCount = 0;
+			DEBUG_STREAM << "NetClock: host " << peer->host
+				<< " first sample, offset " << sample << " ms\n" << std::flush;
+		}
+		else
+		{
+			if (sample < peer->windowMinTicks)
+			{
+				peer->windowMinTicks = sample;
+			}
+			if (sample < peer->offsetTicks)
+			{
+				peer->offsetTicks = sample;		// a shorter path: believe it now
+			}
+			if (++peer->windowCount >= netClockWindow)
+			{
+				//
+				// Close the window: adopt its minimum even if it is
+				// LARGER than the running estimate, which is how the
+				// figure follows clock drift and a route that got
+				// slower rather than staying pinned to one old packet.
+				//
+				long moved = peer->windowMinTicks - peer->offsetTicks;
+				if (moved > 50 || moved < -50)
+				{
+					DEBUG_STREAM << "NetClock: host " << peer->host
+						<< " offset " << peer->offsetTicks << " -> "
+						<< peer->windowMinTicks << " ms\n" << std::flush;
+				}
+				peer->offsetTicks = peer->windowMinTicks;
+				peer->windowMinTicks = sample;
+				peer->windowCount = 0;
+			}
+		}
+
+		local_ticks = message->timeStamp.ticks + peer->offsetTicks;
+
+		//
+		// Never ahead of our own clock, and never further back than we
+		// are willing to extrapolate.
+		//
+		if (local_ticks > now_ticks)
+		{
+			local_ticks = now_ticks;
+		}
+		else if (now_ticks - local_ticks > netClockMaxLagTicks)
+		{
+			local_ticks = now_ticks - netClockMaxLagTicks;
+		}
+	}
+
+	lastUpdate.ticks = local_ticks;
 	SetSimulationState(message->simulationState);
 	Check_Fpu();
 }

MUNGA/SIMULATE.h

@@ -4,6 +4,41 @@
 #include "receiver.h"
 #include "time.h"
 #include "resource.h"
+#include "hostid.h"
+
+//##########################################################################
+//###########################    Net clock    ##############################
+//##########################################################################
+//
+// Aligning a peer's clock with ours, so a replicant is dead-reckoned from
+// when its update was SENT rather than when it happened to arrive.
+//
+// Every update record carries the sender's own timestamp. The receiver
+// used to throw it away and stamp lastUpdate with its own Now() - the
+// original code says so: "HACK - should be based upon message->timeStamp".
+// The dead reckoner then extrapolates over (lastPerformance - lastUpdate),
+// so starting that clock at ARRIVAL rather than at SEND leaves every
+// remote vehicle exactly one network latency behind where it should be.
+// On the 1 ms arcade LAN that was invisible. Over Steam Datagram Relay it
+// is a constant 50-150 ms of positional lag - a bias, not jitter.
+//
+// The timestamp cannot be used raw: two machines' clocks share no epoch,
+// both being QueryPerformanceCounter since their own boot. So we estimate
+// the offset per peer. Each arriving record gives
+//
+//     sample = ourNow - theirStamp = trueOffset + oneWayLatency
+//
+// and since latency is never negative, the SMALLEST sample seen is the
+// closest to the true offset. Taking a minimum over a short rolling
+// window tracks crystal drift and re-adapts when the route changes,
+// instead of being pinned forever by one lucky packet.
+//
+// RP412NETCLOCK=0 turns the whole thing off and restores the arrival-time
+// behaviour, so a test machine can A/B it without a rebuild.
+//
+void NetClock_BeginUpdate(HostID sender);	// around one message's records
+void NetClock_EndUpdate();
+void NetClock_Reset();						// forget every peer (new mission)
 
 class Simulation__SharedData;
 class Simulation__IndexData;

MUNGA_L4/L4AUDEFX.cpp

@@ -0,0 +1,177 @@
+//###########################################################################
+//
+//	L4AUDEFX.cpp -- OpenAL EFX bridge (docs/SOUND.md, findings F9 and F11).
+//	See L4AUDEFX.h for the fidelity rationale.
+//
+//###########################################################################
+#include "mungal4.h"
+#pragma hdrstop
+
+#include "l4audefx.h"
+#include "openal/alc.h"
+#include "openal/efx.h"
+
+#ifndef AL_EFFECT_EAXREVERB
+#define AL_EFFECT_EAXREVERB 0x8000	// newer efx.h constant; OpenAL Soft supports it
+#endif
+
+namespace
+{
+	bool s_available = false;
+	ALuint s_reverbSlot = 0;
+	ALuint s_reverbEffect = 0;
+	ALuint s_scratchFilter = 0;
+
+	LPALGENEFFECTS               p_alGenEffects = 0;
+	LPALEFFECTI                  p_alEffecti = 0;
+	LPALEFFECTF                  p_alEffectf = 0;
+	LPALGENAUXILIARYEFFECTSLOTS  p_alGenAuxiliaryEffectSlots = 0;
+	LPALAUXILIARYEFFECTSLOTI     p_alAuxiliaryEffectSloti = 0;
+	LPALAUXILIARYEFFECTSLOTF     p_alAuxiliaryEffectSlotf = 0;
+	LPALGENFILTERS               p_alGenFilters = 0;
+	LPALFILTERI                  p_alFilteri = 0;
+	LPALFILTERF                  p_alFilterf = 0;
+}
+
+bool EFX_Available()
+{
+	return s_available;
+}
+
+bool EFX_Initialize(float global_reverb_scale)
+{
+	ALCcontext *context = alcGetCurrentContext();
+	if (context == 0)
+	{
+		return false;
+	}
+	ALCdevice *device = alcGetContextsDevice(context);
+	if (device == 0 || !alcIsExtensionPresent(device, "ALC_EXT_EFX"))
+	{
+		Tell("L4AUDEFX: ALC_EXT_EFX not present - filters and reverb inert\n");
+		return false;
+	}
+
+	p_alGenEffects              = (LPALGENEFFECTS)alGetProcAddress("alGenEffects");
+	p_alEffecti                 = (LPALEFFECTI)alGetProcAddress("alEffecti");
+	p_alEffectf                 = (LPALEFFECTF)alGetProcAddress("alEffectf");
+	p_alGenAuxiliaryEffectSlots = (LPALGENAUXILIARYEFFECTSLOTS)alGetProcAddress("alGenAuxiliaryEffectSlots");
+	p_alAuxiliaryEffectSloti    = (LPALAUXILIARYEFFECTSLOTI)alGetProcAddress("alAuxiliaryEffectSloti");
+	p_alAuxiliaryEffectSlotf    = (LPALAUXILIARYEFFECTSLOTF)alGetProcAddress("alAuxiliaryEffectSlotf");
+	p_alGenFilters              = (LPALGENFILTERS)alGetProcAddress("alGenFilters");
+	p_alFilteri                 = (LPALFILTERI)alGetProcAddress("alFilteri");
+	p_alFilterf                 = (LPALFILTERF)alGetProcAddress("alFilterf");
+
+	if (!p_alGenEffects || !p_alEffecti || !p_alEffectf
+		|| !p_alGenAuxiliaryEffectSlots || !p_alAuxiliaryEffectSloti || !p_alAuxiliaryEffectSlotf
+		|| !p_alGenFilters || !p_alFilteri || !p_alFilterf)
+	{
+		Tell("L4AUDEFX: EFX entry points missing - filters and reverb inert\n");
+		return false;
+	}
+
+	alGetError();
+	p_alGenAuxiliaryEffectSlots(1, &s_reverbSlot);
+	p_alGenEffects(1, &s_reverbEffect);
+	if (alGetError() != AL_NO_ERROR)
+	{
+		return false;
+	}
+
+	//
+	// EAXReverb where available (OpenAL Soft: yes), plain reverb otherwise.
+	//
+	p_alEffecti(s_reverbEffect, AL_EFFECT_TYPE, AL_EFFECT_EAXREVERB);
+	if (alGetError() != AL_NO_ERROR)
+	{
+		p_alEffecti(s_reverbEffect, AL_EFFECT_TYPE, AL_EFFECT_REVERB);
+	}
+	p_alAuxiliaryEffectSloti(s_reverbSlot, AL_EFFECTSLOT_EFFECT, (ALint)s_reverbEffect);
+
+	//
+	// The authentic wet level: the original sent CC91 = global_reverb_scale on
+	// every 3D channel, so one global slot gain reproduces the same uniform
+	// send.  RP authors 0.35 (AUDIO.INI); BT used 0.3.
+	//
+	p_alAuxiliaryEffectSlotf(s_reverbSlot, AL_EFFECTSLOT_GAIN,
+		(global_reverb_scale < 0.0f) ? 0.0f :
+		(global_reverb_scale > 1.0f) ? 1.0f : global_reverb_scale);
+
+	//
+	// LOWPASS only, deliberately.  A bandpass would have been convenient -- one
+	// direct filter carrying both the authored brightness model and a bass trim
+	// -- but the OpenAL this game ships (Creative's, via oalinst.exe; renderer
+	// reports "Generic Software") implements ONLY AL_FILTER_LOWPASS.  It rejects
+	// both HIGHPASS and BANDPASS, verified on the build machine.  Asking for one
+	// leaves an error pending, which the check below would read as total EFX
+	// failure and silently take the reverb down with it.
+	//
+	p_alGenFilters(1, &s_scratchFilter);
+	p_alFilteri(s_scratchFilter, AL_FILTER_TYPE, AL_FILTER_LOWPASS);
+
+	if (alGetError() != AL_NO_ERROR)
+	{
+		//
+		// No usable direct filter.  The reverb slot above is independent of it,
+		// so keep the bridge alive and just make the filter path a no-op rather
+		// than losing F11 as well.
+		//
+		s_scratchFilter = 0;
+		Tell("L4AUDEFX: no lowpass filter available - brightness path inert\n");
+	}
+
+	s_available = (alGetError() == AL_NO_ERROR);
+	Tell("L4AUDEFX: " << (s_available ? "ready" : "failed")
+		<< " (reverb slot gain " << global_reverb_scale << ")\n");
+	return s_available;
+}
+
+void EFX_SetSourceLowpassGainHF(ALuint source, float gainhf)
+{
+	if (!s_available || s_scratchFilter == 0)
+	{
+		return;
+	}
+	if (gainhf < 0.001f) gainhf = 0.001f;
+	if (gainhf > 1.0f)   gainhf = 1.0f;
+
+	//
+	// Nothing to do at unity -- detach rather than attach a filter that would
+	// only cost mixing work to achieve nothing.
+	//
+	if (gainhf >= 0.999f)
+	{
+		alSourcei(source, AL_DIRECT_FILTER, AL_FILTER_NULL);
+		alGetError();
+		return;
+	}
+
+	//
+	// Filter parameters are COPIED at attach time, so one scratch filter object
+	// serves every source -- no per-source filter allocation is needed.
+	//
+	p_alFilterf(s_scratchFilter, AL_LOWPASS_GAIN, 1.0f);
+	p_alFilterf(s_scratchFilter, AL_LOWPASS_GAINHF, gainhf);
+	alSourcei(source, AL_DIRECT_FILTER, (ALint)s_scratchFilter);
+	alGetError();
+}
+
+void EFX_AttachReverbSend(ALuint source)
+{
+	if (!s_available)
+	{
+		return;
+	}
+	alSource3i(source, AL_AUXILIARY_SEND_FILTER, (ALint)s_reverbSlot, 0, AL_FILTER_NULL);
+}
+
+void EFX_ClearSourceEffects(ALuint source)
+{
+	if (!s_available)
+	{
+		return;
+	}
+	alSourcei(source, AL_DIRECT_FILTER, AL_FILTER_NULL);
+	alSource3i(source, AL_AUXILIARY_SEND_FILTER, AL_EFFECTSLOT_NULL, 0, AL_FILTER_NULL);
+	alGetError();								// swallow any property complaint
+}

MUNGA_L4/L4AUDEFX.h

@@ -0,0 +1,73 @@
+#pragma once
+//###########################################################################
+//
+//	L4AUDEFX.h -- OpenAL EFX bridge for the authored filter/reverb chains
+//	(docs/SOUND.md, findings F9 and F11).
+//
+//	The original drove the AWE32's initial-filter-cutoff NRPN (21) every frame
+//	-- brightness x the distance high-frequency rolloff -- and sent CC91 reverb
+//	on the 3D channels (global_reverb_scale=0.35 in RP's AUDIO.INI) while
+//	keeping the cockpit DirectPatch channels dry.  The OpenAL port computed
+//	both and applied neither: GetHighFreqCutoffScale() had no callers at all
+//	and every CC91 send site sat inside a comment block, so RP played
+//	spectrally full-bright at every distance and bone-dry everywhere.
+//
+//	This bridge reproduces both through OpenAL Soft's EFX extension: one
+//	EAXReverb auxiliary slot plus a scratch AL_FILTER_LOWPASS whose parameters
+//	are copied at attach time.  Without ALC_EXT_EFX it stays inert and every
+//	entry point below is a no-op, so the game still runs on a bare OpenAL.
+//
+//###########################################################################
+
+#include "openal/al.h"
+
+//
+// Load the EFX entry points, create the reverb slot (gain = the authored
+// global_reverb_scale) and the scratch lowpass.  Call once, with the AL
+// context current.  Returns false (and stays inert) without ALC_EXT_EFX.
+//
+bool EFX_Initialize(float global_reverb_scale);
+
+bool EFX_Available();
+
+//
+// Per-frame direct-path filter: gainhf is the linear high-frequency gain at the
+// EFX 5 kHz reference, carrying the authored brightness x distance model.
+// Callers map the AWE cutoff through EFX_CutoffScaleToGainHF below.
+//
+// At unity the filter is detached rather than attached at no-op settings.
+//
+// NOTE: this is a LOWPASS and can only ever be one.  The OpenAL this game ships
+// (Creative's) implements no other filter type -- see L4AUDEFX.cpp -- so the
+// bass trim could not ride here as a bandpass GAINLF and lives in the resource
+// loader instead (RPApplyBassTrim, L4AUDRES.cpp).
+//
+void EFX_SetSourceLowpassGainHF(ALuint source, float gainhf);
+
+//
+// AWE NRPN 21 curve -> EFX gainhf.  cutoff_scale is [0,1] of the 100-8000 Hz
+// span; approximated as the attenuation of a 2-pole lowpass at the 5 kHz
+// reference.  Curve shape is approximate, endpoints exact.
+//
+inline float EFX_CutoffScaleToGainHF(float cutoff_scale)
+{
+	if (cutoff_scale < 0.0f) cutoff_scale = 0.0f;
+	if (cutoff_scale > 1.0f) cutoff_scale = 1.0f;
+	float cutoff_hz = 100.0f + cutoff_scale * 7900.0f;
+	float g = (cutoff_hz / 5000.0f) * (cutoff_hz / 5000.0f);
+	return (g > 1.0f) ? 1.0f : ((g < 0.001f) ? 0.001f : g);
+}
+
+//
+// Wet-exterior routing: attach the source's auxiliary send to the reverb slot
+// (Dynamic3D / Static3D).  Direct cockpit sources stay dry.
+//
+void EFX_AttachReverbSend(ALuint source);
+
+//
+// Drop both the direct-path filter and the reverb send.  Required when a source
+// is recycled through the pool: without it a dry cockpit sound can inherit the
+// wet send of the 3D source that used the name before it, and a full-bright
+// source can inherit a distant source's lowpass.
+//
+void EFX_ClearSourceEffects(ALuint source);

MUNGA_L4/L4AUDIO.cpp

@@ -2,6 +2,7 @@
 #pragma hdrstop
 
 #include "l4audio.h"
+#include "l4audefx.h"
 #include "l4audlvl.h"
 #include "l4app.h"
 #include "l4audrnd.h"
@@ -9,6 +10,49 @@
 #include "..\munga\player.h"
 #include "..\rp\vtv.h"
 
+//
+// FIDELITY (docs/SOUND.md): the AWE32 played each patch at the requested MIDI
+// note relative to the sample root (60).  RP's authored 4.10 content predates
+// NoteAudioControlID -- its AudioControlID enum stops at AttackTimeAudioControlID
+// -- so every source runs at DEFAULT_NOTE and this factor is 1.0 today.  It is
+// applied anyway so the pitch path is complete if authored notes ever appear,
+// and to keep the shared MUNGA engine in step with the BT tree.
+//
+static inline float RPNotePitchFactor(int note_value)
+{
+	return (float)pow(2.0, ((double)note_value - 60.0) / 12.0);
+}
+
+//
+// FIDELITY (docs/SOUND.md F12): the authored DirectPatchSource `position=`
+// enum picked a SOUND CARD (front pair for Front/FrontLeft/FrontRight, rear
+// pair for Rear/RearLeft/RearRight) and a MIDI pan (CC10 centre/left/right).
+// The port read audioPosition from the stream and then discarded it -- every
+// cockpit sound played dead centre because SetupPatch pins each source
+// AL_SOURCE_RELATIVE at the origin.
+//
+// Sources are listener-relative and no AL_ORIENTATION is ever set, so OpenAL's
+// default listener frame applies: facing -Z with +Y up.  Front is therefore
+// -Z, rear +Z, left -X, right +X; the corner values combine both at equal
+// weight.  RP's own content only ever authors Front (28 sites) and Rear (13),
+// but the corners are mapped for completeness since the enum allows them.
+//
+static void RPGetDirectPatchPosition(DirectPatchPosition p, float *x, float *z)
+{
+	const float diag = 0.7071068f;		// unit vector split across both axes
+
+	switch (p)
+	{
+	case FrontDirectPatchPosition:		*x =  0.0f; *z = -1.0f; break;
+	case RearDirectPatchPosition:		*x =  0.0f; *z =  1.0f; break;
+	case FrontLeftDirectPatchPosition:	*x = -diag; *z = -diag; break;
+	case FrontRightDirectPatchPosition:	*x =  diag; *z = -diag; break;
+	case RearLeftDirectPatchPosition:	*x = -diag; *z =  diag; break;
+	case RearRightDirectPatchPosition:	*x =  diag; *z =  diag; break;
+	default:							*x =  0.0f; *z =  0.0f; break;
+	}
+}
+
 //#############################################################################
 //#######################    L4AudioSpatialization    #########################
 //#############################################################################
@@ -658,6 +702,19 @@ L4AudioSource::L4AudioSource(
 	AudioSource(stream, entity)
 {
 	channelSet.count = GetAudioVoiceCount();
+
+	//
+	// sources[] was left uninitialized here, and RequestAudioChannels decides
+	// whether a slot already holds a source by asking alIsSource about it.
+	// Garbage that happened to match a live name meant silently sharing another
+	// source -- a real hazard now that the pool recycles small integer names.
+	// 0 is never a valid AL name.
+	//
+	for (int i = 0; i < (int)(sizeof(channelSet.sources) / sizeof(channelSet.sources[0])); i++)
+	{
+		channelSet.sources[i] = 0;
+	}
+
 	L4AudioSourceX();
 }
 
@@ -923,6 +980,22 @@ void
 	patch_resource->SetDistance(GetDistanceToSource());
 	patch_resource->SetupPatch(channelSet);
 
+	//
+	// FIDELITY (docs/SOUND.md F12): place the source per the authored position
+	// enum.  SetupPatch has just pinned it AL_SOURCE_RELATIVE at the origin, so
+	// this must run after it.  With AL_NONE as the distance model the unit
+	// radius costs no attenuation -- it only supplies direction.
+	//
+	{
+		float pos_x, pos_z;
+
+		RPGetDirectPatchPosition(audioPosition, &pos_x, &pos_z);
+		for (int i = 0; i < channelSet.count; i++)
+		{
+			alSource3f(channelSet.sources[i], AL_POSITION, pos_x, 0.0f, pos_z);
+		}
+	}
+
 	//
 	// Set the channel to default control values
 	//
@@ -1039,6 +1112,8 @@ void
 	// Apply filter scale
 	//--------------------------------------------------------------------------
 	//
+	float direct_gainhf = 1.0f;
+
 	if (UseSourceBrightnessScale())
 	{
 		const MIDINRPNValue 	filter_resolution = 2;// HACK - should come from audio.ini
@@ -1058,6 +1133,32 @@ void
 		{
 			lastMIDIFilterCutoff = midi_filter_cutoff;
 		}
+
+		//
+		// FIDELITY (docs/SOUND.md F9): this block previously computed the AWE
+		// initial-filter-cutoff (NRPN 21) and then only updated its own
+		// bookkeeping member -- the cutoff was never applied to anything, so
+		// authored brightness (ctl 5) was inert.  Route it through EFX instead.
+		// Direct sources take brightness alone; the distance rolloff belongs to
+		// the 3D paths.
+		//
+		direct_gainhf = EFX_CutoffScaleToGainHF(
+			(float)midi_filter_cutoff / (float)MIDI_MAX_CONTROL_VALUE
+		);
+	}
+
+	//
+	// Applied OUTSIDE the brightness gate: a source that does not use brightness
+	// still has to be told, because the same call carries the player's bass trim.
+	// At unity on both axes it detaches the filter, so this costs nothing in the
+	// default configuration.
+	//
+	if (EFX_Available())
+	{
+		for (int i = 0; i < channelSet.count; i++)
+		{
+			EFX_SetSourceLowpassGainHF(channelSet.sources[i], direct_gainhf);
+		}
 	}
 
 	//
@@ -1069,17 +1170,24 @@ void
 	const MIDIValue 	volume_resolution = 2; // HACK - should come from audio.ini
 
 	volume_scale = CalculateSourceVolumeScale();
-	L4AudioLocation *audio_location = Cast_Object(L4AudioLocation*, GetAudioLocation());
+
-	Check(application);
+	//
-	L4AudioRenderer *audio_renderer =
+	// FIDELITY (docs/SOUND.md F4): the original ended its volume path in MIDI
-		Cast_Object(L4AudioRenderer*, application->GetAudioRenderer());
+	// CC7, whose GM/SoundFont curve is concave -- amplitude ~ (v/127)^2.  Writing
-	Check(audio_renderer);
+	// volume_scale linearly to AL_GAIN played every intermediate level about
-	AudioHead *audio_head = audio_renderer->GetAudioHead();
+	// +6 dB hot at mid-scale and compressed the authored dynamic range.
-	Check(audio_head);
+	//
+	// AL_MAX_DISTANCE is no longer written here: the distance model is AL_NONE
+	// (see MUNGA/AUDIO.cpp) so it has no effect, and DirectPatch is the
+	// non-positional cockpit path which never took distance attenuation anyway.
+	//
+	const float direct_note_pitch = RPNotePitchFactor((int)GetCurrentNoteValue());
+	PatchResource *direct_patch = Cast_Object(PatchResource*, GetAudioResource());
 	for (int i=0; i < channelSet.count; i++)
 	{
-		alSourcef(channelSet.sources[i],AL_MAX_DISTANCE,audio_location->getMaxDistance(audio_head));
+		alSourcef(channelSet.sources[i], AL_GAIN,
-      alSourcef(channelSet.sources[i], AL_GAIN, volume_scale);
+			volume_scale * volume_scale * direct_patch->GetZoneBassGain(i));
+		alSourcef(channelSet.sources[i], AL_PITCH, (float)relativePitch * direct_note_pitch);
 	}
 }
 
@@ -1206,6 +1314,17 @@ void
 	patch_resource->SetDistance(GetDistanceToSource());
 	patch_resource->SetupPatch(channelSet);
 
+	//
+	// FIDELITY (docs/SOUND.md F11): wet exterior.  The original sent CC91 =
+	// global_reverb_scale on all four channels of a 3D source and CC91 = 0 on
+	// the cockpit DirectPatch channels -- a deliberate outside/inside contrast
+	// that the port lost when every send site was commented out.
+	//
+	for (int i = 0; i < channelSet.count; i++)
+	{
+		EFX_AttachReverbSend(channelSet.sources[i]);
+	}
+
 	/*patch_resource->SetDistance(GetDistanceToSource());
 	for (i = 0; i < AudioChannelSetSize; i++)
 	{
@@ -1405,15 +1524,71 @@ void
 
 	pitch_offset = CalculateSourcePitchOffset();
 
+	//
+	// FIDELITY (docs/SOUND.md F10): add the AUTHORED doppler.  AUDIO.INI's
+	// doppler_range=600 / speed_of_sound=250 are computed into
+	// AudioLocation::dopplerCents on every spatial update, and the original
+	// applied it on this dynamic path only -- static and direct sources stayed
+	// doppler-free.  GetDopplerCents() previously had no callers at all.
+	//
+	pitch_offset += GetAudioLocation()->GetDopplerCents();
+
 	double relativePitch = pow(2.0,pitch_offset/1200.0);
 	Clamp(relativePitch,0.5,2.0);
 
+	//
+	// FIDELITY (docs/SOUND.md): relativePitch was computed here and never
+	// applied -- there was no AL_PITCH call anywhere in the tree, so the whole
+	// authored pitch chain (pitch_mix_offset / PitchAudioControlID, authored 97
+	// times across RP's sequences) was inert along with doppler.
+	//
+	// AL_VELOCITY is still written for bookkeeping but is now inert: doppler
+	// factor is 0 (see MUNGA/AUDIO.cpp) because this feed is sign-inverted
+	// relative to the AL_POSITION frame and never subtracted head velocity.
+	// AL_MAX_DISTANCE is dropped -- the distance model is AL_NONE and the
+	// authored curve is applied in CalculateSourceVolumeScale instead.
+	//
+	//
+	// FIDELITY (docs/SOUND.md F9): the AUTHORED high-frequency rolloff.  The
+	// original drove the AWE filter cutoff on this path from
+	// highFreqCutoffScale x brightnessScale, ungated, on all four quadrant
+	// channels -- every moving 3D sound got duller with distance.  AUDIO.INI
+	// still computes highFreqCutoffScale each frame (rolloff 2.0, knee 60,
+	// scale 0.005) and GetHighFreqCutoffScale() previously had zero callers.
+	//
+	float dynamic_gainhf = 1.0f;
+
+	if (EFX_Available())
+	{
+		PatchResource *filter_patch =
+			Cast_Object(PatchResource*, GetAudioResource());
+		Check(filter_patch);
+
+		Scalar filter_scale =
+			GetAudioLocation()->GetHighFreqCutoffScale() *
+			CalculateSourceBrightnessScale();
+		Scalar max_cutoff = (Scalar)filter_patch->GetMaxMIDIFilterCutoff();
+		Scalar midi_cutoff = filter_scale * max_cutoff;
+
+		dynamic_gainhf = EFX_CutoffScaleToGainHF(
+			(float)(midi_cutoff / (Scalar)MIDI_MAX_CONTROL_VALUE)
+		);
+	}
+
+	const float dynamic_note_pitch = RPNotePitchFactor((int)GetCurrentNoteValue());
+	PatchResource *dynamic_patch = Cast_Object(PatchResource*, GetAudioResource());
 	for (int i=0; i < channelSet.count; i++)
 	{
 		alSource3f(channelSet.sources[i],AL_POSITION,pos.x,pos.y,pos.z);
-		alSourcef(channelSet.sources[i], AL_GAIN, volume_scale);
+		alSourcef(channelSet.sources[i], AL_GAIN,
+			volume_scale * volume_scale * dynamic_patch->GetZoneBassGain(i));
+		alSourcef(channelSet.sources[i], AL_PITCH, (float)relativePitch * dynamic_note_pitch);
 		alSource3f(channelSet.sources[i],AL_VELOCITY,-relative_velocity.x,-relative_velocity.y,-relative_velocity.z);
-		alSourcef(channelSet.sources[i],AL_MAX_DISTANCE,audio_location->getMaxDistance(audio_head));
+
+		if (EFX_Available())
+		{
+			EFX_SetSourceLowpassGainHF(channelSet.sources[i], dynamic_gainhf);
+		}
 	}
 
 }
@@ -1430,24 +1605,27 @@ AudioControlValue
 	//
 	// Call inherited method to calculate volume scale
 	//
-	Scalar 
+	Scalar
 		volume_scale = L4AudioSource::CalculateSourceVolumeScale();
-	return volume_scale;
-	
-	//
-	// Update the spatial model that will result in the value
-	// for distance related volume attenuation
-	//
-	/*Check(application);
-	Check(application->GetAudioRenderer());
-	UpdateSpatialModel(application->GetAudioRenderer()->GetAudioHead());
 
 	//
-	// Apply distance attenuation to the volume scale
+	// FIDELITY (docs/SOUND.md F3): apply the AUTHORED distance attenuation.
-	//	
+	// AUDIO.INI's knee/rolloff curve (amplitude_rolloff=2.0, knee=60,
+	// distance_scale=0.003, clipping_radius=550) is computed into
+	// distanceVolumeScale on every spatial update; this multiply was commented
+	// out behind an early return and AL_LINEAR_DISTANCE substituted, which faded
+	// distant audio on a straight line to zero instead of the authored
+	// 1/(1+(k(d-knee))^2).  Restoring it also un-blinds the volume-based
+	// transient cull, the AudioWeighting voice-steal, and the CalculateMix
+	// ducking chain, all of which key off this value and were treating far
+	// sources as full-presence.
+	//
+	// The spatial model is already refreshed each Execute, so the
+	// UpdateSpatialModel call the original comment carried is not needed here.
+	//
 	Check(GetAudioLocation());
 	volume_scale *= GetAudioLocation()->GetDistanceVolumeScale();
-	return volume_scale;*/
+	return volume_scale;
 }
 
 //#############################################################################
@@ -1468,6 +1646,26 @@ Static3DPatchSource::Static3DPatchSource(
 	MemoryStream_Read(stream, &useInternalSpatialization);
 }
 
+//
+//#############################################################################
+//#############################################################################
+//
+AudioControlValue
+	Static3DPatchSource::CalculateSourceVolumeScale()
+{
+	Check(this);
+
+	//
+	// FIDELITY (docs/SOUND.md F3): same authored distance attenuation as the
+	// dynamic path.  The spatial model computes distanceVolumeScale on every
+	// execute; without this multiply statics were left to AL_LINEAR_DISTANCE.
+	//
+	Scalar volume_scale = L4AudioSource::CalculateSourceVolumeScale();
+	Check(GetAudioLocation());
+	volume_scale *= GetAudioLocation()->GetDistanceVolumeScale();
+	return volume_scale;
+}
+
 Logical	Static3DPatchSource::IsAudioSourceClipped(AudioHead *audio_head)
 {
 	if (AudioSource::IsAudioSourceClipped(audio_head) || l4_application->GetMissionPlayer()->GetPlayerVehicle()->GetSimulationState() == VTV::BurningState)
@@ -1694,6 +1892,16 @@ void
 	Check(patch_resource);
 	patch_resource->SetDistance(GetDistanceToSource());
 	patch_resource->SetupPatch(channelSet);
+
+	//
+	// FIDELITY (docs/SOUND.md F11): statics are exterior sources too, so they
+	// take the same wet send as the dynamic path.
+	//
+	for (int i = 0; i < channelSet.count; i++)
+	{
+		EFX_AttachReverbSend(channelSet.sources[i]);
+	}
+
 	/*for (i = 0; i < AudioChannelSetSize; i++)
 	{
 		if ((channel = channelSet.GetNth(i)) != NULL)
@@ -1909,12 +2117,6 @@ void
 
 	Scalar volume_scale = CalculateSourceVolumeScale();
 	L4AudioLocation *audio_location = Cast_Object(L4AudioLocation*, GetAudioLocation());
-	Check(application);
-	L4AudioRenderer *audio_renderer =
-		Cast_Object(L4AudioRenderer*, application->GetAudioRenderer());
-	Check(audio_renderer);
-	AudioHead *audio_head = audio_renderer->GetAudioHead();
-	Check(audio_head);
 
 	Scalar pitch_offset;
 
@@ -1933,12 +2135,47 @@ void
 	   relative_position = audio_location->GetVectorToSource();
    }
 
+	//
+	// FIDELITY (docs/SOUND.md F4 + pitch): squared CC7 volume law, and the
+	// authored pitch chain applied -- see the DirectPatch/Dynamic3D paths.  The
+	// original left static sources doppler-free, so no doppler term here.
+	// AL_MAX_DISTANCE dropped with the AL_NONE distance model; the authored
+	// curve is applied in CalculateSourceVolumeScale.
+	//
 	//Static models have their position freely available as relative positions and stand still
+	//
+	// FIDELITY (docs/SOUND.md F9): statics took brightness alone in the
+	// original -- no distance term on this path.
+	//
+	float static_gainhf = 1.0f;
+
+	if (EFX_Available() && UseSourceBrightnessScale())
+	{
+		PatchResource *filter_patch =
+			Cast_Object(PatchResource*, GetAudioResource());
+		Check(filter_patch);
+
+		Scalar midi_cutoff =
+			CalculateSourceBrightnessScale() *
+			(Scalar)filter_patch->GetMaxMIDIFilterCutoff();
+
+		static_gainhf = EFX_CutoffScaleToGainHF(
+			(float)(midi_cutoff / (Scalar)MIDI_MAX_CONTROL_VALUE)
+		);
+	}
+
+	const float static_note_pitch = RPNotePitchFactor((int)GetCurrentNoteValue());
 	for (int i=0; i < channelSet.count; i++)
 	{
-      alSourcef(channelSet.sources[i], AL_GAIN, volume_scale);
+      alSourcef(channelSet.sources[i], AL_GAIN,
+			volume_scale * volume_scale * patch_resource->GetZoneBassGain(i));
+		alSourcef(channelSet.sources[i], AL_PITCH, (float)relativePitch * static_note_pitch);
 		alSource3f(channelSet.sources[i],AL_POSITION,relative_position.x,relative_position.y,relative_position.z);
-		alSourcef(channelSet.sources[i],AL_MAX_DISTANCE,audio_location->getMaxDistance(audio_head));
+
+		if (EFX_Available())
+		{
+			EFX_SetSourceLowpassGainHF(channelSet.sources[i], static_gainhf);
+		}
 	}
 
 	//

MUNGA_L4/L4AUDIO.h

@@ -541,6 +541,13 @@ public:
 
 	virtual Logical	IsAudioSourceClipped(AudioHead *audio_head);
 
+//~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+// Mix levels
+//
+public:
+  AudioControlValue
+  	CalculateSourceVolumeScale();
+
 //~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 // SetPosition
 //

MUNGA_L4/L4AUDLVL.cpp

@@ -128,8 +128,25 @@ void
 //	#endif
    SAMPLEINFO info;
 
+	//
+	// Ask this patch for no more zones than it has.
+	//
+	// sourceSet.count was fixed when the audio source was built, from
+	// whichever level of detail was selected at the time. SetDistance
+	// re-picks the level of detail by distance immediately before this
+	// runs (see Static3DPatchSource::StartImplementation), and a
+	// further-away patch can have fewer zones than the one the source was
+	// sized for - so the count outruns this patch's zone list, and the
+	// zones past the end come back as "no such zone".
+	//
+	int zone_count = PRESET_getNumSamples(bankID,patchID);
+	if (zone_count > sourceSet.count)
+	{
+		zone_count = sourceSet.count;
+	}
+
 	//Attach buffers
-	for (int i=0; i < sourceSet.count; i++)
+	for (int i=0; i < zone_count; i++)
 	{
 		info = PRESET_getSampleInfo(bankID,patchID,i);
 		if (info.bufferIndex >= 0)
@@ -310,3 +327,19 @@ MIDINRPNValue
 	Check(patch_level_of_detail);
 	return patch_level_of_detail->GetMaxMIDIFilterCutoff();
 }
+
+//
+//#############################################################################
+//#############################################################################
+//
+float
+	PatchResource::GetZoneBassGain(int zone_index)
+{
+	Check(this);
+
+	PatchLevelOfDetail *patch_level_of_detail =
+		Cast_Object(PatchLevelOfDetail*, GetAudioLevelOfDetail());
+
+	Check(patch_level_of_detail);
+	return patch_level_of_detail->GetZoneBassGain(zone_index);
+}

MUNGA_L4/L4AUDLVL.h

@@ -37,6 +37,12 @@ struct PRESETINFO
 
 extern PRESETINFO allPresets[2][100];
 
+//
+// Defined in L4AUDRES.cpp; declared here rather than including that header so
+// the level-of-detail and resource headers stay independent of each other.
+//
+float RPBufferBassGain(int buffer_index);
+
 bool PRESET_isImplemented(int bank, int preset);
 int PRESET_getNumSamples(int bank, int preset);
 SAMPLEINFO PRESET_getSampleInfo(int bank, int preset, int sampleInd);
@@ -69,6 +75,14 @@ public:
 		GetVoiceCount()
 			{return PRESET_getNumSamples(bankID,patchID);}
 
+	//
+	// Gain this zone takes from the Home/End bass trim, 1.0 when untouched.
+	//
+	float
+		GetZoneBassGain(int zone_index)
+			{return RPBufferBassGain(
+				PRESET_getSampleInfo(bankID,patchID,zone_index).bufferIndex);}
+
 	//
 	//-----------------------------------------------------------------------
 	// BuildFromPage
@@ -163,6 +177,12 @@ public:
 	void
 		SetupPatch(SourceSet sourceSet);
 
+	//
+	// Gain this zone takes from the Home/End bass trim, 1.0 when untouched.
+	//
+	float
+		GetZoneBassGain(int zone_index);
+
 	MIDINRPNValue
 		GetMaxMIDIFilterCutoff();
 };

MUNGA_L4/L4AUDRES.cpp

@@ -18,6 +18,130 @@
 ALuint *g_buffers;
 int g_numBuffers;
 
+//~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Bass trim ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+//
+// RP412AUDIOBASS, 0.0..1.0, default 1.0 (the mix exactly as authored), stepped
+// live by the Home/End keys.
+//
+// The arcade pod ran the game at unity and did its volume and tone shaping in
+// hardware -- an external amplifier and a 3-way crossover.  A desktop player has
+// neither, so the low band needs a control in software.  This is the crossover's
+// low trim; the master volume (L4AUDRND.cpp) is the amplifier's.
+//
+// It cannot be an EFX filter: the OpenAL this game ships implements only
+// AL_FILTER_LOWPASS, so there is no low shelf or bandpass to lean on, and the
+// one direct filter a source gets is already carrying the authored brightness
+// model.  So the trim is a GAIN, applied per zone in the mix.
+//
+// That works because of HOW the low end is built.  RP's soundbanks carry their
+// weight in discrete deep layer zones whose per-zone tuning bakes out to a very
+// low playback rate -- 13 zones sit below 8 kHz, between 3.4 and 5.2 octaves
+// below their recorded pitch, against 81% of the set at 22 kHz and up.  A zone's
+// baked rate is therefore a reliable proxy for which band it occupies, so
+// attenuating the low-rate zones is a genuine low-band trim rather than a blunt
+// overall cut.
+//
+// Ramp: untouched at or above 22050 Hz, full trim at or below 5512 Hz, log
+// interpolated between, so nothing steps abruptly at a threshold.  Each buffer's
+// DEPTH is fixed at load; the trim itself is read at mix time, which is what
+// lets the keys move it while sounds are playing.
+//
+static const ALsizei kBassTrimFullRate = 5512;		// at/below: full trim
+static const ALsizei kBassTrimNoneRate = 22050;		// at/above: untouched
+static const char    kBassTrimFile[]   = "bass.cfg";
+static const float   kBassTrimStep     = 0.05f;
+
+static float *g_bufferBassDepth = NULL;				// one per loaded buffer
+static float  g_bassTrim = 1.0f;
+
+//
+// How much of the trim a buffer at this rate takes: 0 = untouched, 1 = fully.
+//
+static float
+	RPBassDepthForRate(ALsizei rate)
+{
+	if (rate >= kBassTrimNoneRate)		return 0.0f;
+	if (rate <= kBassTrimFullRate)		return 1.0f;
+
+	const float span = (float)log((double)kBassTrimNoneRate / (double)kBassTrimFullRate);
+
+	return (float)log((double)kBassTrimNoneRate / (double)rate) / span;
+}
+
+void
+	RPBassTrimInitialize()
+{
+	g_bassTrim = 1.0f;
+
+	if (const char *setting = getenv("RP412AUDIOBASS"))
+	{
+		float value = (float)atof(setting);
+
+		if (value >= 0.0f && value <= 1.0f)
+		{
+			g_bassTrim = value;
+		}
+	}
+
+	//
+	// Whatever the player last set with the keys wins, exactly as the master
+	// volume behaves -- environ.ini only decides where an untouched machine
+	// starts out.
+	//
+	if (FILE *cfg = fopen(kBassTrimFile, "rt"))
+	{
+		float value = -1.0f;
+
+		if (fscanf(cfg, "%f", &value) == 1 && value >= 0.0f && value <= 1.0f)
+		{
+			g_bassTrim = value;
+		}
+		fclose(cfg);
+	}
+
+	Tell("Audio bass trim " << (int)(g_bassTrim * 100.0f + 0.5f) << "%\n");
+}
+
+void
+	RPBassTrimStep(int direction)
+{
+	g_bassTrim += (direction > 0) ? kBassTrimStep : -kBassTrimStep;
+
+	if (g_bassTrim < 0.0f) g_bassTrim = 0.0f;
+	if (g_bassTrim > 1.0f) g_bassTrim = 1.0f;
+
+	g_bassTrim = (float)((int)(g_bassTrim / kBassTrimStep + 0.5f)) * kBassTrimStep;
+
+	if (FILE *cfg = fopen(kBassTrimFile, "wt"))
+	{
+		fprintf(cfg, "%.2f\n", g_bassTrim);
+		fclose(cfg);
+	}
+
+	Tell("Audio bass trim " << (int)(g_bassTrim * 100.0f + 0.5f) << "%\n");
+}
+
+float
+	RPBassTrim()
+{
+	return g_bassTrim;
+}
+
+//
+// The gain a zone takes at the current trim.  1.0 whenever the player has not
+// touched it, so the default costs one multiply by one.
+//
+float
+	RPBufferBassGain(int buffer_index)
+{
+	if (g_bassTrim >= 0.999f || g_bufferBassDepth == NULL
+		|| buffer_index < 0 || buffer_index >= g_numBuffers)
+	{
+		return 1.0f;
+	}
+	return 1.0f - (1.0f - g_bassTrim) * g_bufferBassDepth[buffer_index];
+}
+
 //#############################################################################
 //#######################    AudioObjectStream    #############################
 //#############################################################################
@@ -566,6 +690,18 @@ void
 			g_buffers = NULL;
 			g_numBuffers = 0;
 		}
+		else
+		{
+			//
+			// Parallel to g_buffers: how much of the bass trim each zone takes.
+			//
+			RPBassTrimInitialize();
+			g_bufferBassDepth = new float[g_numBuffers];
+			for (int b = 0; b < g_numBuffers; b++)
+			{
+				g_bufferBassDepth[b] = 0.0f;
+			}
+		}
 	}
 
 	int bufferInd = 0;
@@ -647,6 +783,15 @@ void
                sf_read_raw(file,data,size);
 					sf_close(file);
 
+					//
+					// Record which band this zone sits in, for the Home/End bass
+					// trim.  Fixed per buffer; the trim itself is read at mix time.
+					//
+					if (g_bufferBassDepth != NULL)
+					{
+						g_bufferBassDepth[bufferInd] = RPBassDepthForRate(alSampleRate);
+					}
+
 					//Feed the buffer
 					alBufferData(g_buffers[bufferInd],format,data,size,alSampleRate);
 					PRESET_setBufferIndex(i,j,k,bufferInd);
@@ -726,6 +871,16 @@ void
 
 ALuint AL_getBuffer(int index)
 {
+	//
+	// 0 is AL_NONE - "no buffer" - which alSourcei accepts and which detaches
+	// the source rather than crashing. An index that is out of range means a
+	// zone that does not exist, and the only thing an unchecked lookup here
+	// can do about it is read whatever lies past the array.
+	//
+	if (g_buffers == NULL || index < 0 || index >= g_numBuffers)
+	{
+		return 0;
+	}
 	return g_buffers[index];
 }
 

MUNGA_L4/L4AUDRES.h

@@ -9,6 +9,16 @@ ALuint AL_getBuffer(int index);
 extern ALuint *g_buffers;
 extern int g_numBuffers;
 
+//
+// RP412AUDIOBASS low-band trim, stepped live by the Home/End keys.  Applied as
+// a per-zone gain in the mix; see the comment block in L4AUDRES.cpp for why it
+// lives here and not in EFX.
+//
+void  RPBassTrimInitialize();
+void  RPBassTrimStep(int direction);
+float RPBassTrim();
+float RPBufferBassGain(int buffer_index);
+
 
 //class AudioHardware;
 

MUNGA_L4/L4AUDRND.cpp

@@ -2,9 +2,20 @@
 #pragma hdrstop
 
 #include "l4audrnd.h"
+#include "l4audefx.h"
 #include "..\munga\notation.h"
 #include "openal/alc.h"
 
+#include <stdio.h>
+
+//
+// Master volume limits, shared by the startup load and the PgUp/PgDn step.
+// The file sits beside the exe with the other runtime state.
+//
+static const char  kAudioVolumeFile[] = "volume.cfg";
+static const float kAudioVolumeStep   = 0.05f;
+static const float kAudioVolumeMax    = 2.0f;
+
 //
 //#############################################################################
 // L4AudioRenderer
@@ -379,6 +390,66 @@ void
 	{
 		ALCcontext *context = alcCreateContext(device,NULL);
 		alcMakeContextCurrent(context);
+
+		//
+		// FIDELITY (docs/SOUND.md F9/F11): bring up the EFX bridge that carries
+		// the authored brightness/distance lowpass and the wet-exterior reverb
+		// send.  Needs the context current, and the reverb gain has already been
+		// read from AUDIO.INI into the head above.  Inert without ALC_EXT_EFX.
+		//
+		EFX_Initialize(audio_head->GetGlobalReverbScale());
+
+		//
+		// Master volume.  There was no listener gain at all before -- the mix
+		// always ran at unity -- so restoring the authored dynamics gave players
+		// no way to pull the whole thing down.  This lives in environ.ini rather
+		// than AUDIO.INI deliberately: AUDIO.INI is byte-identical to the file
+		// that shipped in 1995 and is worth keeping that way.
+		//
+		// Default is 1.0, i.e. exactly the previous behaviour -- the knob only
+		// does something when someone asks for it.
+		//
+		{
+			float master_volume = 1.0f;
+
+			if (const char *setting = getenv("RP412AUDIOVOLUME"))
+			{
+				float value = (float)atof(setting);
+
+				if (value >= 0.0f && value <= kAudioVolumeMax)
+				{
+					master_volume = value;
+				}
+			}
+
+			//
+			// Whatever the player last set with the volume keys wins over the
+			// environ.ini figure: the keys are the amplifier knob, and a knob
+			// stays where it was left.  environ.ini sets where it starts on a
+			// machine that has never been touched.
+			//
+			if (FILE *cfg = fopen(kAudioVolumeFile, "rt"))
+			{
+				float value = -1.0f;
+
+				if (fscanf(cfg, "%f", &value) == 1
+					&& value >= 0.0f && value <= kAudioVolumeMax)
+				{
+					master_volume = value;
+				}
+				fclose(cfg);
+			}
+
+			gRPMasterVolume = master_volume;
+			alListenerf(AL_GAIN, master_volume);
+			Tell("Audio master volume " << (int)(master_volume * 100.0f + 0.5f) << "%\n");
+		}
+
+		//
+		// The bass trim is not set here: it is a per-zone gain owned by the
+		// resource manager (L4AUDRES.cpp), which needs the buffers to exist
+		// first.  PreloadResources initialises it below.
+		//
 	}
 
 	//
@@ -1257,6 +1328,190 @@ Logical
 	return resources_available;
 }
 
+//~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Master volume ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+//
+// The pod ran at unity and left volume to an external amplifier, so the game
+// never had a level control.  Standing in for that amplifier means the player
+// needs to reach it while playing, not only through environ.ini -- hence the
+// PgUp/PgDn binding in L4Application::KeyCommandMessageHandler.
+//
+// Page keys specifically: they produce no typed character, so they cannot
+// collide with any of the engine's character-keyed commands the way '+'/'-'
+// would, they are bound to nothing in any RP layout, and they exist on
+// tenkeyless keyboards.
+//
+float gRPMasterVolume = 1.0f;
+
+void
+	RPAudioMasterVolumeStep(int direction)
+{
+	gRPMasterVolume += (direction > 0) ? kAudioVolumeStep : -kAudioVolumeStep;
+
+	if (gRPMasterVolume < 0.0f)				gRPMasterVolume = 0.0f;
+	if (gRPMasterVolume > kAudioVolumeMax)	gRPMasterVolume = kAudioVolumeMax;
+
+	//
+	// Snap to the step grid so repeated presses cannot drift on float error and
+	// land somewhere that never reads back as a round number.
+	//
+	gRPMasterVolume =
+		(float)((int)(gRPMasterVolume / kAudioVolumeStep + 0.5f)) * kAudioVolumeStep;
+
+	alListenerf(AL_GAIN, gRPMasterVolume);
+
+	//
+	// Persist immediately.  A pod operator setting the level expects it to still
+	// be there after the cabinet is power-cycled, and there is no settings UI to
+	// hang it off.
+	//
+	if (FILE *cfg = fopen(kAudioVolumeFile, "wt"))
+	{
+		fprintf(cfg, "%.2f\n", gRPMasterVolume);
+		fclose(cfg);
+	}
+
+	Tell("Audio master volume " << (int)(gRPMasterVolume * 100.0f + 0.5f) << "%\n");
+}
+
+//~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ OpenAL source pool ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+//
+// Sources are expensive to create and destroy and are a HARD per-context
+// resource (this driver grants 256 mono).  Generating one per sound event and
+// deleting it on release burns through that ceiling during busy play even
+// though steady-state demand is modest, which shows up as sounds silently
+// failing to start.  Generate once, recycle forever.
+//
+// The cap sits below the driver grant with a reserve, so growth stops on our
+// terms rather than on an alGenSources failure.  Growth also stops by itself if
+// a driver offers fewer sources than the cap -- a failed generate simply ends
+// growth and the pool recycles what it already has.
+//
+static const int kAudioPoolMax = 512;			// free-list array size
+static const int kAudioPoolCap = 240;			// grow no further than this
+
+static ALuint gAudioPoolFree[kAudioPoolMax];
+static int    gAudioPoolFreeCount = 0;			// entries parked in gAudioPoolFree
+static int    gAudioPoolTotal     = 0;			// sources ever generated (<= cap)
+static long   gAudioPoolReuses    = 0;			// diagnostics
+
+int  RPAudioPoolSize()   { return gAudioPoolTotal; }
+int  RPAudioPoolFree()   { return gAudioPoolFreeCount; }
+long RPAudioPoolReuses() { return gAudioPoolReuses; }
+
+//
+// Reset a source to a neutral state so nothing carries across owners.
+//
+static void
+	RPAudioScrubSource(ALuint src)
+{
+	ALint state = AL_STOPPED;
+
+	alGetSourcei(src, AL_SOURCE_STATE, &state);
+	if (state == AL_PLAYING || state == AL_PAUSED)
+	{
+		alSourceStop(src);
+	}
+
+	alSourcei(src, AL_BUFFER, 0);				// detach (nothing is queued here)
+	alSourcei(src, AL_LOOPING, AL_FALSE);		// or the next owner inherits a loop
+	alSourcef(src, AL_GAIN, 1.0f);
+	alSourcef(src, AL_PITCH, 1.0f);
+	alSourcei(src, AL_SOURCE_RELATIVE, AL_FALSE);
+	alSource3f(src, AL_POSITION, 0.0f, 0.0f, 0.0f);
+	alSource3f(src, AL_VELOCITY, 0.0f, 0.0f, 0.0f);
+
+	//
+	// Drop the EFX state too.  Without this a recycled name can carry a 3D
+	// source's reverb send into a dry cockpit sound, or a distant source's
+	// lowpass into a close one.
+	//
+	EFX_ClearSourceEffects(src);
+
+	alGetError();								// swallow any property complaint
+}
+
+//
+// Hand out a source: recycle first, generate only while under the cap.
+// False means genuinely out, and the caller retries after the steal loop runs.
+//
+Logical
+	RPAudioPoolAcquire(ALuint *out)
+{
+	Check_Pointer(out);
+
+	while (gAudioPoolFreeCount > 0)
+	{
+		ALuint src = gAudioPoolFree[--gAudioPoolFreeCount];
+
+		if (alIsSource(src))					// a context reset invalidates names
+		{
+			++gAudioPoolReuses;
+			*out = src;
+			return True;
+		}
+		--gAudioPoolTotal;						// stale name: forget it
+	}
+
+	if (gAudioPoolTotal >= kAudioPoolCap)
+	{
+		return False;
+	}
+
+	ALuint src = 0;
+
+	alGetError();
+	alGenSources(1, &src);
+	if (alGetError() != AL_NO_ERROR || !alIsSource(src))
+	{
+		return False;							// driver said no before our cap
+	}
+
+	++gAudioPoolTotal;
+
+	#if DEBUG_LEVEL>0
+	{
+		//
+		// One line per high-water band, so a log shows how close real play gets
+		// to the ceiling without spamming.
+		//
+		static int s_notified = 0;
+
+		if (gAudioPoolTotal >= s_notified + 25)
+		{
+			s_notified = gAudioPoolTotal;
+			Tell("Audio source pool high-water: " << gAudioPoolTotal
+				<< " of " << kAudioPoolCap << "\n");
+		}
+	}
+	#endif
+
+	*out = src;
+	return True;
+}
+
+//
+// Take a source back.  Scrubbed and parked, never deleted.
+//
+void
+	RPAudioPoolRelease(ALuint src)
+{
+	if (!alIsSource(src))
+	{
+		return;
+	}
+
+	RPAudioScrubSource(src);
+
+	if (gAudioPoolFreeCount < kAudioPoolMax)
+	{
+		gAudioPoolFree[gAudioPoolFreeCount++] = src;
+		return;
+	}
+
+	alDeleteSources(1, &src);					// unreachable: cap < array size
+	--gAudioPoolTotal;
+}
+
 //
 //#############################################################################
 // RequestAudioChannels
@@ -1271,30 +1526,54 @@ Logical
 	Check(this);
 	Check(source_request);
 
-	//Do we have enough?
+	//
+	// SOURCE POOLING (docs/SOUND.md).  This used to alGenSources per sound
+	// event, with ReleaseSourceSet alDeleteSources'ing on release -- so play
+	// activity CHURNED through OpenAL's per-context source limit (the driver
+	// grants 256 mono here).  Recovering the soundbanks took the voice count
+	// per sound from about 1.1 zones to about 2.6, roughly doubling that churn.
+	//
+	// The BT tree measured this exact problem: raising the budget was NOT the
+	// fix, recycling was, and it was a net CPU win besides.  Sources are now
+	// generated once and handed back to a free list, so steady-state play costs
+	// no allocation at all.
+	//
 	int requested = source_request->count;
 
-	bool failed = true;
+	if (requested > (int)(sizeof(source_request->sources) / sizeof(source_request->sources[0])))
-
+	{
-	alGetError();
+		requested = (int)(sizeof(source_request->sources) / sizeof(source_request->sources[0]));
+		source_request->count = requested;
+	}
 
 	for (int i = 0; i < requested; i++)
 	{
-		if (!alIsSource(source_request->sources[i]))
+		if (source_request->sources[i] != 0 && alIsSource(source_request->sources[i]))
 		{
-			alGenSources(1, source_request->sources + i);
+			continue;							// slot already holds a live source
 		}
-	}
-		
-	ALenum error = alGetError();
-	if (error == AL_NO_ERROR)
-	{
-		failed = false;
-	}
 
-	if (failed)
+		ALuint src = 0;
-	{
+
-		return False;
+		if (!RPAudioPoolAcquire(&src))
+		{
+			//
+			// Out of sources.  Hand back everything acquired on THIS attempt so a
+			// failed request cannot strand voices -- the renderer's steal loop
+			// will free some and retry.
+			//
+			for (int j = 0; j < i; j++)
+			{
+				if (source_request->sources[j] != 0)
+				{
+					RPAudioPoolRelease(source_request->sources[j]);
+					source_request->sources[j] = 0;
+				}
+			}
+			return False;
+		}
+
+		source_request->sources[i] = src;
 	}
 
 	return True;
@@ -1375,23 +1654,27 @@ Logical
 
 void L4AudioRenderer::ReleaseSourceSet(SourceSet &sourceSet)
 {
+	//
+	// SOURCE POOLING (docs/SOUND.md): park each source on the free list rather
+	// than destroying it.  RPAudioPoolRelease stops it, detaches its buffer and
+	// scrubs the state -- including the EFX filter and reverb send -- so the
+	// next owner starts clean.
+	//
+	// The bulk alDeleteSources(count, sources) this replaces was also a leak
+	// waiting to happen: per the AL spec it is ATOMIC, so ONE invalid name in
+	// the array (an empty slot of a partial set, or the old -1 sentinel on a
+	// double release) meant NOTHING was deleted and the whole set leaked.
+	// Slots are parked at 0, which is never a valid AL name -- unlike -1, which
+	// alIsSource would be asked about as 0xFFFFFFFF.
+	//
 	for (int i = 0; i < sourceSet.count; i++)
 	{
-		ALenum state;
+		if (sourceSet.sources[i] != 0)
-		alGetSourcei(sourceSet.sources[i], AL_SOURCE_STATE, &state);
-
-		if (state == AL_PLAYING)
 		{
-			alSourceStop(sourceSet.sources[i]);
+			RPAudioPoolRelease(sourceSet.sources[i]);
+			sourceSet.sources[i] = 0;
 		}
 	}
-
-	alDeleteSources(sourceSet.count, sourceSet.sources);
-	
-	for (int i = 0; i < sourceSet.count; i++)
-	{
-		sourceSet.sources[i] = -1;
-	}
 }
 
 //~~~~~~~~~~~~~~~~~~~~~~ L4AudioRenderer profile bits ~~~~~~~~~~~~~~~~~~~~~~~~~

MUNGA_L4/L4AUDRND.h

@@ -6,6 +6,14 @@
 #include "l4audres.h"
 #include "openal/al.h"
 
+//
+// Master volume, standing in for the amplifier the cabinets had.  Stepped by
+// PgUp/PgDn (L4APP.cpp) and persisted to volume.cfg; see L4AUDRND.cpp.
+//
+extern float gRPMasterVolume;
+
+void RPAudioMasterVolumeStep(int direction);
+
 
 //~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ L4AudioRenderer ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

MUNGA_L4/L4CTRL.cpp

@@ -6,6 +6,8 @@
 #include "l4ctrl.h"
 #include "l4keybd.h"
 #include "l4app.h"
+#include "l4audrnd.h"			// RPAudioMasterVolumeStep, for the PgUp/PgDn keys
+#include "l4audres.h"			// RPBassTrimStep, for the Home/End keys
 #include "l4dinput.h"
 #include "..\munga\appmgr.h"
 #include "dxutils.h"
@@ -1513,6 +1515,78 @@ void
 	// Update the PC keyboard mapping group
 	//-------------------------------------------------------------------------
 	//
+	//
+	//-------------------------------------------------------------------------
+	// Master volume, PgUp louder / PgDn quieter.
+	//
+	// The cabinets ran the game at unity and left level to an external
+	// amplifier and crossover; without that hardware the player has to be able
+	// to reach the volume while playing.
+	//
+	// POLLED, not taken off the key message below, and that is deliberate.  The
+	// pump below only ever consumes WM_KEYUP / WM_SYSKEYUP / WM_CHAR from the
+	// front of the queue, and the front-end runs message loops of its own, so
+	// key messages are raced for and routinely lost -- measured here at roughly
+	// two of every six presses arriving.  That is survivable for a one-shot like
+	// the abort chord; it is not survivable for a control you tap repeatedly to
+	// find a level.  Reading the key state directly costs nothing and cannot be
+	// dropped.
+	//
+	// Page keys because they produce no typed character, so they cannot collide
+	// with the character-keyed commands the pump feeds, nothing else in RP binds
+	// them, and they exist on tenkeyless keyboards.
+	//
+	// The foreground check keeps an alt-tabbed game from eating the volume keys
+	// of whatever the player switched to.
+	//-------------------------------------------------------------------------
+	//
+	// Home/End do the same for the bass trim - the crossover's low band to
+	// PgUp/PgDn's amplifier.
+	//
+	{
+		static int volume_up_held = 0;
+		static int volume_down_held = 0;
+		static int bass_up_held = 0;
+		static int bass_down_held = 0;
+
+		int focused = 0;
+
+		if (HWND foreground = GetForegroundWindow())
+		{
+			DWORD foreground_process = 0;
+
+			GetWindowThreadProcessId(foreground, &foreground_process);
+			focused = (foreground_process == GetCurrentProcessId());
+		}
+
+		const int up = focused && (GetAsyncKeyState(VK_PRIOR) & 0x8000) != 0;
+		const int down = focused && (GetAsyncKeyState(VK_NEXT) & 0x8000) != 0;
+		const int bass_up = focused && (GetAsyncKeyState(VK_HOME) & 0x8000) != 0;
+		const int bass_down = focused && (GetAsyncKeyState(VK_END) & 0x8000) != 0;
+
+		if (up && !volume_up_held)
+		{
+			RPAudioMasterVolumeStep(+1);
+		}
+		if (down && !volume_down_held)
+		{
+			RPAudioMasterVolumeStep(-1);
+		}
+		if (bass_up && !bass_up_held)
+		{
+			RPBassTrimStep(+1);
+		}
+		if (bass_down && !bass_down_held)
+		{
+			RPBassTrimStep(-1);
+		}
+
+		volume_up_held = up;
+		volume_down_held = down;
+		bass_up_held = bass_up;
+		bass_down_held = bass_down;
+	}
+
 	if (flags.keyboardExists)
 	{
 		//RB 1/20/07

MUNGA_L4/L4JOY.h

@@ -0,0 +1,85 @@
+//===========================================================================//
+// File:    l4joy.h                                                          //
+// Project: MUNGA           Brick: generic joystick reader                   //
+// Contents: DirectInput 8 sticks, HOTAS throttles and pedals                //
+//---------------------------------------------------------------------------//
+// Copyright (C) 1994-1995, Virtual World Entertainment, Inc.                //
+//                      PROPRIETARY AND CONFIDENTIAL                         //
+//===========================================================================//
+
+#pragma once
+
+//########################################################################
+//
+// L4JOY - the generic-joystick reader.
+//
+// PadRIO reads XInput, which covers Xbox-class pads and nothing else.
+// This layer adds every OTHER game device Windows knows - flight sticks,
+// HOTAS throttles, twist grips, rudder pedals, wheels - through
+// DirectInput 8, the standard generic-HID game API. It exposes up to
+// joyMaxDevices attached devices as normalized state blocks; the PadRIO
+// poll maps them onto the pod's control channels through the joydev /
+// joyaxis / joybutton / joyhat rows of bindings.txt (L4PADBINDINGS.h),
+// the same binding machinery the pad and keyboard already use.
+//
+// XInput-class devices are EXCLUDED here, or they would double-feed
+// through both APIs and every input would count twice. A DirectInput
+// device whose VID/PID also appears in a RawInput device path containing
+// the "IG_" marker is an XInput device - the documented detection that
+// does not drag in WMI.
+//
+// This is distinct from the legacy L4DINPUT.cpp DIJoystick, the 1995-era
+// single-device `Joystick` engine interface reachable only through the
+// old L4CONTROLS=DIJOYSTICK profile. That path is untouched.
+//
+// RP412JOYCONFIG=1 runs the interactive setup wizard at boot: it asks
+// the player to move each control, works out which device and axis moved
+// and which way, and writes the joystick section of bindings.txt.
+// RP412JOYLOG=1 logs device attach/detach.
+//
+// Ported from BT411, whose glass cockpit needed the same thing.
+//
+//########################################################################
+
+enum
+{
+	joyMaxDevices  = 4,
+	joyAxisCount   = 8,		// X Y Z RX RY RZ SL0 SL1 (DIJOYSTATE2 order)
+	joyButtonCount = 32,	// buttons exposed to bindings (DI carries 128)
+	joyHatCount    = 4
+};
+
+struct RPJoyDeviceState
+{
+	int			attached;
+	float		axis[joyAxisCount];		// normalized -1..1, raw: deadzones
+										// are the binding layer's business
+	unsigned	buttons;				// bit n = button n held
+	int			hat[joyHatCount];		// POV in centidegrees, -1 = centered
+	char		name[64];				// product name ("T.16000M", ...)
+};
+
+//
+// Lifecycle. Init is lazy-safe (Poll calls it) and returns the attached
+// non-XInput device count. Re-enumeration for hot-plug happens inside
+// Poll on a ~3 s cadence whenever nothing is attached.
+//
+int  RPJoyInit(void);
+void RPJoyShutdown(void);
+void RPJoyPoll(void);
+
+int  RPJoyDeviceCount(void);
+const RPJoyDeviceState *RPJoyDevice(int index);	// NULL out of range/detached
+
+//
+// Case-insensitive product-name substring match to a device index, -1 for
+// no match. This is what a named joydev slot resolves through.
+//
+int  RPJoyFindDevice(const char *name_substring);
+
+//
+// The RP412JOYCONFIG capture wizard (console UI; called from RPL4.CPP
+// before the front end). Returns 0 if it wrote a config, non-zero on
+// abort or no device.
+//
+int  RPJoyConfigWizard(void);

MUNGA_L4/L4PADBINDINGS.cpp

@@ -2,6 +2,7 @@
 #pragma hdrstop
 
 #include "l4padbindings.h"
+#include "l4joy.h"		// joyButtonCount / joyHatCount, the parse limits
 
 #include <XInput.h>
 #include <stdio.h>
@@ -79,6 +80,20 @@ namespace
 		{ "Throttle", BindAxisThrottle },
 		{ "LeftPedal", BindAxisLeftPedal }, { "RightPedal", BindAxisRightPedal },
 		{ "JoystickY", BindAxisJoystickY }, { "JoystickX", BindAxisJoystickX },
+		{ "Pedals", BindAxisPedals },
+	};
+
+	// DirectInput's axis order, which is what the joy* rows name
+	const NameValue kJoyAxisNames[] =
+	{
+		{ "X", BindJoyAxisX }, { "Y", BindJoyAxisY }, { "Z", BindJoyAxisZ },
+		{ "RX", BindJoyAxisRX }, { "RY", BindJoyAxisRY }, { "RZ", BindJoyAxisRZ },
+		{ "SL0", BindJoyAxisSL0 }, { "SL1", BindJoyAxisSL1 },
+	};
+
+	const NameValue kJoyHatNames[] =
+	{
+		{ "up", 0 }, { "right", 1 }, { "down", 2 }, { "left", 3 },
 	};
 
 	Logical NameEquals(const char *a, const char *b)
@@ -185,10 +200,83 @@ namespace
 	}
 
 	//---------------------------------------------------------------
-	// One line of the profile grammar
+	// Shared tail of the two axis-source rows: [invert] [deadzone <d>]
+	// [rate <n>], in any order.
 	//---------------------------------------------------------------
-	Logical ParseLine(char *tokens[], int token_count, PadBindingProfile *profile)
+	Logical ParseAxisOptions(
+		char *tokens[], int token_count, int first,
+		Logical *invert, Scalar *deadzone, Scalar *rate)
 	{
+		for (int i = first; i < token_count; ++i)
+		{
+			if (NameEquals(tokens[i], "invert"))
+			{
+				*invert = True;
+			}
+			else if (NameEquals(tokens[i], "deadzone") && i + 1 < token_count)
+			{
+				if (!ParseNumber(tokens[++i], deadzone))
+				{
+					return False;
+				}
+			}
+			else if (NameEquals(tokens[i], "rate") && i + 1 < token_count)
+			{
+				if (!ParseNumber(tokens[++i], rate))
+				{
+					return False;
+				}
+			}
+			else
+			{
+				return False;
+			}
+		}
+		return True;
+	}
+
+	//---------------------------------------------------------------
+	// One line of the profile grammar. joy_slot carries the joydev
+	// state forward from line to line - joy rows attach to the slot
+	// most recently declared.
+	//---------------------------------------------------------------
+	Logical ParseLine(
+		char *tokens[], int token_count, PadBindingProfile *profile,
+		int *joy_slot)
+	{
+		//
+		// joydev is the one row that can be two tokens long ("joydev 1"),
+		// so it is answered before the four-token floor below.
+		//
+		if (NameEquals(tokens[0], "joydev") && token_count >= 2)
+		{
+			int slot = -1;
+			if (sscanf(tokens[1], "%d", &slot) != 1 ||
+				slot < 0 || slot >= BindJoyDeviceSlots)
+			{
+				return False;
+			}
+			*joy_slot = slot;
+			//
+			// The rest of the line is a product-name substring, rejoined
+			// with single spaces ("Saitek Pro Flight" is four tokens).
+			//
+			profile->joyDeviceMatch[slot][0] = '\0';
+			for (int i = 2; i < token_count; ++i)
+			{
+				if (i > 2)
+				{
+					strncat(profile->joyDeviceMatch[slot], " ",
+						sizeof(profile->joyDeviceMatch[slot]) -
+							strlen(profile->joyDeviceMatch[slot]) - 1);
+				}
+				strncat(profile->joyDeviceMatch[slot], tokens[i],
+					sizeof(profile->joyDeviceMatch[slot]) -
+						strlen(profile->joyDeviceMatch[slot]) - 1);
+			}
+			return True;
+		}
+
 		if (token_count < 4)
 		{
 			return False;
@@ -271,31 +359,75 @@ namespace
 			memset(binding, 0, sizeof(*binding));
 			binding->source = source;
 			binding->axis = axis;
-			for (int i = 4; i < token_count; ++i)
+			return ParseAxisOptions(tokens, token_count, 4,
+				&binding->invert, &binding->deadzone, &binding->rate);
+		}
+
+		//---------------------------------------------------------------
+		// Generic joystick rows, all attaching to the current joydev slot
+		//---------------------------------------------------------------
+		if (NameEquals(tokens[0], "joyaxis") && NameEquals(tokens[2], "axis"))
+		{
+			int source = LookupTable(kJoyAxisNames,
+				sizeof(kJoyAxisNames) / sizeof(kJoyAxisNames[0]), tokens[1]);
+			int axis = LookupTable(kRioAxisNames,
+				sizeof(kRioAxisNames) / sizeof(kRioAxisNames[0]), tokens[3]);
+			if (source < 0 || axis < 0 ||
+				profile->joyAxisCount >= PadBindingProfile::maxJoyAxes)
 			{
-				if (NameEquals(tokens[i], "invert"))
+				return False;
-				{
-					binding->invert = True;
-				}
-				else if (NameEquals(tokens[i], "deadzone") && i + 1 < token_count)
-				{
-					if (!ParseNumber(tokens[++i], &binding->deadzone))
-					{
-						return False;
-					}
-				}
-				else if (NameEquals(tokens[i], "rate") && i + 1 < token_count)
-				{
-					if (!ParseNumber(tokens[++i], &binding->rate))
-					{
-						return False;
-					}
-				}
-				else
-				{
-					return False;
-				}
 			}
+			PadJoyAxisBinding *binding = &profile->joyAxes[profile->joyAxisCount++];
+			memset(binding, 0, sizeof(*binding));
+			binding->device = *joy_slot;
+			binding->source = source;
+			binding->axis = axis;
+			return ParseAxisOptions(tokens, token_count, 4,
+				&binding->invert, &binding->deadzone, &binding->rate);
+		}
+
+		if (NameEquals(tokens[0], "joybutton") && NameEquals(tokens[2], "button"))
+		{
+			int button = -1;
+			int address;
+			if (sscanf(tokens[1], "%d", &button) != 1 ||
+				button < 0 || button >= joyButtonCount ||
+				!ParseAddress(tokens[3], &address) ||
+				profile->joyButtonCount >= PadBindingProfile::maxJoyButtons)
+			{
+				return False;
+			}
+			Logical toggle = (token_count > 4 && NameEquals(tokens[4], "toggle"));
+			PadJoyButtonBinding *binding =
+				&profile->joyButtons[profile->joyButtonCount++];
+			memset(binding, 0, sizeof(*binding));
+			binding->device = *joy_slot;
+			binding->button = button;
+			binding->address = address;
+			binding->toggle = toggle;
+			return True;
+		}
+
+		if (NameEquals(tokens[0], "joyhat") && token_count >= 5 &&
+			NameEquals(tokens[3], "button"))
+		{
+			int hat = -1;
+			int direction = LookupTable(kJoyHatNames,
+				sizeof(kJoyHatNames) / sizeof(kJoyHatNames[0]), tokens[2]);
+			int address;
+			if (sscanf(tokens[1], "%d", &hat) != 1 ||
+				hat < 0 || hat >= joyHatCount || direction < 0 ||
+				!ParseAddress(tokens[4], &address) ||
+				profile->joyHatCount >= PadBindingProfile::maxJoyHats)
+			{
+				return False;
+			}
+			PadJoyHatBinding *binding = &profile->joyHats[profile->joyHatCount++];
+			memset(binding, 0, sizeof(*binding));
+			binding->device = *joy_slot;
+			binding->hat = hat;
+			binding->direction = direction;
+			binding->address = address;
 			return True;
 		}
 
@@ -320,10 +452,17 @@ namespace
 "#   key <name>      axis <axis> rate <n-per-second>\n"
 "#   pad <button>    button <addr> [toggle]\n"
 "#   padaxis <src>   axis <axis> [invert] [deadzone <d>] [rate <n-per-second>]\n"
+"#   joydev <slot>   [product-name substring]\n"
+"#   joyaxis <src>   axis <axis> [invert] [deadzone <d>] [rate <n-per-second>]\n"
+"#   joybutton <n>   button <addr> [toggle]\n"
+"#   joyhat <n> <up|down|left|right> button <addr>\n"
 "#\n"
 "# <addr>    RIO input address: lamp buttons 0x00-0x47, internal keypad\n"
 "#           0x50-0x5F, external keypad 0x60-0x6F (hex or decimal).\n"
 "# <axis>    Throttle | LeftPedal | RightPedal | JoystickY | JoystickX\n"
+"#           | Pedals - a signed axis that works the pedal PAIR, positive\n"
+"#           for the right pedal and negative for the left, so one rudder\n"
+"#           bar or twist grip drives both.\n"
 "# <name>    Keys name: A-Z, D0-D9 (digit row), F1-F12, NumPad0-NumPad9,\n"
 "#           Up, Down, Left, Right, Space, Enter, PageUp, PageDown,\n"
 "#           OemMinus, Oemplus, Oemcomma, OemPeriod, ...\n"
@@ -336,6 +475,31 @@ namespace
 "# back on release; 'rate' walks the axis by <n> per second and the\n"
 "# position sticks (the throttle). Every lamp button is also clickable\n"
 "# on the on-screen cockpit, so unbound addresses are never stranded.\n"
+"#\n"
+"# ---- Flight sticks, HOTAS throttles and rudder pedals --------------\n"
+"#\n"
+"# EASIEST: run joyconfig.bat once. It asks you to move each control,\n"
+"# works out which device and axis you moved and which way round it\n"
+"# reads, and writes the joy* rows below a marker line at the end of\n"
+"# this file. Everything you have written yourself is kept. Xbox-class\n"
+"# pads need none of this - they are the pad* rows above.\n"
+"#\n"
+"# By hand: joydev picks the device for the rows that follow it - a\n"
+"# name substring binds that product, a bare slot number binds the Nth\n"
+"# stick Windows lists. <src> for joyaxis is the DirectInput axis name,\n"
+"# X Y Z RX RY RZ SL0 SL1: a twist grip is usually RZ and a HOTAS\n"
+"# throttle usually Z or SL0. A joyaxis on Throttle with no 'rate' is\n"
+"# treated as a real lever and OWNS the channel - its full travel is\n"
+"# the full throttle range, rather than nudging the position the way a\n"
+"# spring-centred pad stick has to.\n"
+"#\n"
+"#   joydev 0 T.16000M\n"
+"#   joyaxis X  axis JoystickX invert deadzone 0.08\n"
+"#   joyaxis Y  axis JoystickY invert deadzone 0.08\n"
+"#   joyaxis RZ axis Pedals deadzone 0.08\n"
+"#   joyaxis SL0 axis Throttle deadzone 0\n"
+"#   joybutton 0 button 0x40\n"
+"#   joyhat 0 up button 0x42\n"
 "\n"
 "# ---- Flight: number pad + modifiers -------------------------------\n"
 "# The whole letter board stays free for the MFD banks; flight lives\n"
@@ -499,6 +663,7 @@ void
 	char line[256];
 	int line_number = 0;
 	int error_count = 0;
+	int joy_slot = 0;		// joy rows before any joydev belong to slot 0
 	const char *cursor = source;
 	while (*cursor != '\0')
 	{
@@ -523,7 +688,7 @@ void
 		{
 			continue;
 		}
-		if (!ParseLine(tokens, token_count, profile))
+		if (!ParseLine(tokens, token_count, profile, &joy_slot))
 		{
 			++error_count;
 			DEBUG_STREAM << "PadBindings: " << kBindingsFileName << " line "
@@ -542,4 +707,10 @@ void
 		<< profile->padAxisCount << " pad axes"
 		<< (error_count ? " (with rejected lines)" : "")
 		<< "\n" << std::flush;
+	if (profile->joyAxisCount || profile->joyButtonCount || profile->joyHatCount)
+	{
+		DEBUG_STREAM << "PadBindings: joystick - " << profile->joyAxisCount
+			<< " axes, " << profile->joyButtonCount << " buttons, "
+			<< profile->joyHatCount << " hat directions\n" << std::flush;
+	}
 }

MUNGA_L4/L4PADBINDINGS.h

@@ -18,12 +18,25 @@
 //   key <name>      axis <axis> deflect <n> | rate <n>
 //   pad <button>    button <addr> [toggle]
 //   padaxis <src>   axis <axis> [invert] [deadzone <d>] [rate <n>]
+//   joydev <slot>   [product-name substring...]
+//   joyaxis <src>   axis <axis> [invert] [deadzone <d>] [rate <n>]
+//   joybutton <n>   button <addr> [toggle]
+//   joyhat <n> <up|down|left|right> button <addr>
 //
 // <addr> is a RIO input address: lamp buttons 0x00-0x47, internal
 // keypad 0x50-0x5F, external keypad 0x60-0x6F. Loaded from
 // bindings.txt beside the exe; written there (self-documenting, with
 // the full default profile) on first run. Bad lines are logged and
 // skipped, good lines always win.
+//
+// The joy* rows drive generic DirectInput devices - flight sticks,
+// HOTAS throttles, twist grips, rudder pedals (L4JOY.h). They attach to
+// the most recent joydev slot, or slot 0 if no joydev came first. A slot
+// naming a product substring binds THAT device; a bare slot binds the
+// Nth attached non-XInput device. Source names follow the DirectInput
+// layout - X Y Z RX RY RZ SL0 SL1 - where a twist grip is usually RZ
+// and a HOTAS throttle usually Z or SL0. RP412JOYCONFIG=1 writes these
+// rows for you by asking the player to move each control.
 //########################################################################
 
 enum PadBindRioAxis
@@ -33,6 +46,14 @@ enum PadBindRioAxis
 	BindAxisRightPedal,
 	BindAxisJoystickY,
 	BindAxisJoystickX,
+	//
+	// A signed composite, not a channel the pod has: positive presses
+	// the right pedal, negative the left. One physical control - a
+	// rudder bar, a twist grip, a stick axis - works the pedal pair the
+	// way a foot never could, one or the other and never both. It
+	// decomposes into the real pair when the poll applies it.
+	//
+	BindAxisPedals,
 	BindAxisCount
 };
 
@@ -89,6 +110,54 @@ struct PadPadAxisBinding
 	Scalar	rate;			// 0 = direct position, >0 = speed integrate
 };
 
+//
+// Generic joystick (DirectInput - L4JOY.h). device is a joydev SLOT,
+// resolved to a live device at poll time by the slot's name substring or
+// by its ordinal, so unplugging and replugging does not rewrite the file.
+//
+enum { BindJoyDeviceSlots = 4 };
+
+enum PadBindJoyAxis
+{
+	BindJoyAxisX = 0,
+	BindJoyAxisY,
+	BindJoyAxisZ,
+	BindJoyAxisRX,
+	BindJoyAxisRY,
+	BindJoyAxisRZ,
+	BindJoyAxisSL0,
+	BindJoyAxisSL1,
+	BindJoyAxisCount
+};
+
+struct PadJoyAxisBinding
+{
+	int		device;			// joydev slot
+	int		source;			// PadBindJoyAxis
+	int		axis;			// PadBindRioAxis
+	Logical	invert;
+	Scalar	deadzone;		// normalized 0..1
+	Scalar	rate;			// 0 = direct position, >0 = speed integrate
+};
+
+struct PadJoyButtonBinding
+{
+	int		device;			// joydev slot
+	int		button;			// 0-31
+	int		address;
+	Logical	toggle;
+	Logical	wasDown;
+	Logical	latched;
+};
+
+struct PadJoyHatBinding
+{
+	int		device;			// joydev slot
+	int		hat;			// 0-3
+	int		direction;		// 0 up, 1 right, 2 down, 3 left
+	int		address;
+};
+
 struct PadBindingProfile
 {
 	enum
@@ -96,7 +165,10 @@ struct PadBindingProfile
 		maxKeyButtons	= 128,
 		maxKeyAxes		= 32,
 		maxPadButtons	= 32,
-		maxPadAxes		= 16
+		maxPadAxes		= 16,
+		maxJoyAxes		= 24,
+		maxJoyButtons	= 48,
+		maxJoyHats		= 16
 	};
 
 	PadKeyButtonBinding		keyButtons[maxKeyButtons];
@@ -107,6 +179,15 @@ struct PadBindingProfile
 	int						padButtonCount;
 	PadPadAxisBinding		padAxes[maxPadAxes];
 	int						padAxisCount;
+
+	PadJoyAxisBinding		joyAxes[maxJoyAxes];
+	int						joyAxisCount;
+	PadJoyButtonBinding		joyButtons[maxJoyButtons];
+	int						joyButtonCount;
+	PadJoyHatBinding		joyHats[maxJoyHats];
+	int						joyHatCount;
+	// "" = take the slot's ordinal attached device
+	char					joyDeviceMatch[BindJoyDeviceSlots][64];
 };
 
 // Load bindings.txt from the working directory into the profile,

MUNGA_L4/L4PADRIO.cpp

@@ -3,6 +3,7 @@
 
 #include "l4padrio.h"
 #include "l4keylight.h"
+#include "l4joy.h"
 
 #include <XInput.h>
 #pragma comment(lib, "xinput9_1_0.lib")
@@ -41,6 +42,51 @@ namespace
 		return (GetAsyncKeyState(virtual_key) & 0x8000) != 0;
 	}
 
+	//
+	// A generic stick axis is already normalized -1..1, so the deadzone
+	// is a plain cut about centre with the remainder rescaled - press
+	// just past the edge and you get just past zero, not a step.
+	//
+	Scalar JoyAxisValue(Scalar raw, Scalar deadzone)
+	{
+		if (deadzone <= 0.0f)
+		{
+			return raw;
+		}
+		if (raw > -deadzone && raw < deadzone)
+		{
+			return (Scalar) 0;
+		}
+		Scalar value = (raw > 0.0f)
+			? (raw - deadzone) / (1.0f - deadzone)
+			: (raw + deadzone) / (1.0f - deadzone);
+		if (value > 1.0f)	value = 1.0f;
+		if (value < -1.0f)	value = -1.0f;
+		return value;
+	}
+
+	//
+	// A POV hat reports centidegrees clockwise from up, or -1 centered.
+	// The 45-degree window each way is what makes the diagonals press
+	// both of their neighbours, which is how a four-way hat is read.
+	//
+	Logical JoyHatHeld(int centidegrees, int direction)
+	{
+		if (centidegrees < 0)
+		{
+			return False;
+		}
+		int degrees = (centidegrees / 100) % 360;
+		switch (direction)
+		{
+		case 0:	return (degrees >= 315 || degrees <= 45) ? True : False;
+		case 1:	return (degrees >= 45 && degrees <= 135) ? True : False;
+		case 2:	return (degrees >= 135 && degrees <= 225) ? True : False;
+		case 3:	return (degrees >= 225 && degrees <= 315) ? True : False;
+		}
+		return False;
+	}
+
 	void KeyLightLog(const char *line)
 	{
 		DEBUG_STREAM << line << "\n" << std::flush;
@@ -166,6 +212,29 @@ PadRIO::PadRIO()
 	activeInstance = this;
 
 	DEBUG_STREAM << "PadRIO: virtual RIO active (XInput pad + keyboard)\n" << std::flush;
+
+	//
+	// Only open DirectInput when the profile actually asks for it. A
+	// player on keyboard and pad should not pay for an enumeration of
+	// every HID on the machine, and joyconfig.bat is what writes the
+	// rows that turn this on.
+	//
+	if (profile.joyAxisCount > 0 || profile.joyButtonCount > 0 ||
+		profile.joyHatCount > 0)
+	{
+		int found = RPJoyInit();
+		DEBUG_STREAM << "PadRIO: joystick bindings present, " << found
+			<< " generic device(s) attached\n" << std::flush;
+		for (int d = 0; d < found; ++d)
+		{
+			const RPJoyDeviceState *state = RPJoyDevice(d);
+			if (state != NULL)
+			{
+				DEBUG_STREAM << "PadRIO:   [" << d << "] " << state->name
+					<< "\n" << std::flush;
+			}
+		}
+	}
 }
 
 PadRIO::~PadRIO()
@@ -244,6 +313,11 @@ void
 		profile.padButtons[i].latched = False;
 		profile.padButtons[i].wasDown = False;
 	}
+	for (int i = 0; i < profile.joyButtonCount; ++i)
+	{
+		profile.joyButtons[i].latched = False;
+		profile.joyButtons[i].wasDown = False;
+	}
 }
 
 void
@@ -391,6 +465,81 @@ void
 			}
 		}
 	}
+	//---------------------------------------------------------------
+	// Generic joysticks. The slots are resolved every poll rather than
+	// cached, so a stick unplugged mid-race simply stops answering and
+	// one plugged back in picks up where it left off.
+	//---------------------------------------------------------------
+	int joyDevice[BindJoyDeviceSlots];
+	Logical joyLive = False;
+	for (int slot = 0; slot < BindJoyDeviceSlots; ++slot)
+	{
+		joyDevice[slot] = -1;
+	}
+	if (profile.joyAxisCount > 0 || profile.joyButtonCount > 0 ||
+		profile.joyHatCount > 0)
+	{
+		RPJoyPoll();
+		for (int slot = 0; slot < BindJoyDeviceSlots; ++slot)
+		{
+			joyDevice[slot] = (profile.joyDeviceMatch[slot][0] != '\0')
+				? RPJoyFindDevice(profile.joyDeviceMatch[slot])
+				: ((RPJoyDevice(slot) != NULL) ? slot : -1);
+			if (joyDevice[slot] >= 0)
+			{
+				joyLive = True;
+			}
+		}
+	}
+
+	for (int i = 0; i < profile.joyButtonCount; ++i)
+	{
+		PadJoyButtonBinding *binding = &profile.joyButtons[i];
+		const RPJoyDeviceState *state =
+			(binding->device >= 0 && binding->device < BindJoyDeviceSlots)
+				? RPJoyDevice(joyDevice[binding->device]) : NULL;
+		Logical down = (state != NULL) &&
+			(state->buttons & (1u << binding->button)) != 0;
+		if (binding->toggle && down && !binding->wasDown)
+		{
+			binding->latched = !binding->latched;
+		}
+		binding->wasDown = down;
+
+		if (binding->toggle ? binding->latched : down)
+		{
+			if (binding->address < buttonUnits)
+			{
+				desired[binding->address] = 1;
+			}
+			else if (binding->address >= 0x50 &&
+				binding->address < 0x50 + keypadUnits)
+			{
+				keypadDesired[binding->address - 0x50] = 1;
+			}
+		}
+	}
+	for (int i = 0; i < profile.joyHatCount; ++i)
+	{
+		const PadJoyHatBinding *binding = &profile.joyHats[i];
+		const RPJoyDeviceState *state =
+			(binding->device >= 0 && binding->device < BindJoyDeviceSlots)
+				? RPJoyDevice(joyDevice[binding->device]) : NULL;
+		if (state != NULL &&
+			JoyHatHeld(state->hat[binding->hat], binding->direction))
+		{
+			if (binding->address < buttonUnits)
+			{
+				desired[binding->address] = 1;
+			}
+			else if (binding->address >= 0x50 &&
+				binding->address < 0x50 + keypadUnits)
+			{
+				keypadDesired[binding->address - 0x50] = 1;
+			}
+		}
+	}
+
 	for (int i = 0; i < buttonUnits; ++i)
 	{
 		if (screenButton[i])
@@ -502,6 +651,68 @@ void
 		}
 	}
 
+	//---------------------------------------------------------------
+	// Joystick axes. A physical throttle lever is the one source that
+	// does not add into the pile: it has an absolute position, so its
+	// full travel IS the channel and it takes ownership rather than
+	// nudging an accumulator that a spring-centred pad stick has to.
+	//---------------------------------------------------------------
+	Logical throttleLever = False;
+	Scalar throttleLeverValue = (Scalar) 0;
+
+	if (joyLive)
+	{
+		for (int i = 0; i < profile.joyAxisCount; ++i)
+		{
+			const PadJoyAxisBinding *binding = &profile.joyAxes[i];
+			if (binding->device < 0 || binding->device >= BindJoyDeviceSlots)
+			{
+				continue;
+			}
+			const RPJoyDeviceState *state = RPJoyDevice(joyDevice[binding->device]);
+			if (state == NULL)
+			{
+				continue;
+			}
+			Scalar raw = (Scalar) state->axis[binding->source];
+			if (binding->invert)
+			{
+				raw = -raw;
+			}
+			if (binding->axis == BindAxisThrottle && binding->rate == 0.0f)
+			{
+				// -1..1 of lever travel onto the 0..1 the pod runs on
+				throttleLeverValue = (raw + 1.0f) * 0.5f;
+				throttleLever = True;
+				continue;
+			}
+			Scalar value = JoyAxisValue(raw, binding->deadzone);
+			if (binding->rate > 0.0f)
+			{
+				rate[binding->axis] += value * binding->rate;
+			}
+			else
+			{
+				deflect[binding->axis] += value;
+			}
+		}
+	}
+
+	//
+	// The composite pedal axis becomes the pair the pod actually has.
+	// One signed source presses one pedal or the other, never both,
+	// which is what a rudder bar or a twist grip does.
+	//
+	Scalar pedals = deflect[BindAxisPedals];
+	if (pedals > 0.0f)
+	{
+		deflect[BindAxisRightPedal] += pedals;
+	}
+	else if (pedals < 0.0f)
+	{
+		deflect[BindAxisLeftPedal] += -pedals;
+	}
+
 	throttleAccum = Clamp01(throttleAccum + rate[BindAxisThrottle] * delta_t);
 
 	Scalar x = deflect[BindAxisJoystickX];
@@ -511,7 +722,9 @@ void
 	if (y > 1.0f)	y = 1.0f;
 	if (y < -1.0f)	y = -1.0f;
 
-	Throttle   = Clamp01(throttleAccum + deflect[BindAxisThrottle]);
+	Throttle   = throttleLever
+		? Clamp01(throttleLeverValue)
+		: Clamp01(throttleAccum + deflect[BindAxisThrottle]);
 	LeftPedal  = Clamp01(deflect[BindAxisLeftPedal]);
 	RightPedal = Clamp01(deflect[BindAxisRightPedal]);
 	// The profile encodes the pod's stick sign convention; L4PADFLIP

MUNGA_L4/L4VB16.cpp

@@ -3828,6 +3828,13 @@ static LRESULT CALLBACK
 //~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 static WNDPROC gCockpitBaseProc = NULL;
 
+//
+// Which window we subclassed, so the destructor can put its own proc
+// back. The shell is the GAME window: it outlives the cockpit and
+// carries the console screen from one race to the next.
+//
+static HWND gCockpitShellWindow = NULL;
+
 static LRESULT CALLBACK
 	CockpitShellProc(HWND hwnd, UINT message, WPARAM wParam, LPARAM lParam)
 {
@@ -4358,6 +4365,15 @@ SVGA16::SVGA16(
 	// Split-view mode: decide before BuildWindows so the packed gauge
 	// windows can stay hidden.
 	//------------------------------------------------------------------
+	//
+	// Before anything else: the constructor calls Update() below, and
+	// both of these are read in there. mDisplayToUpdate was only being
+	// set at the END of the constructor, so that first pass indexed the
+	// display arrays with whatever was on the stack.
+	//
+	mDisplayToUpdate = 0;
+	mDisplaysCopiedThisPass = 0;
+
 	splitViews = False;
 	cockpitViewscreen = NULL;
 	Logical explodedViews = False;
@@ -4679,9 +4695,25 @@ SVGA16::SVGA16(
 			GetClientRect(cockpit, &inner);
 			LayoutCockpit(inner.right, inner.bottom);
 
-			// catch maximise / restore / drag-resize and re-fit
+			//
-			gCockpitBaseProc = (WNDPROC) SetWindowLongPtrA(
+			// Catch maximise / restore / drag-resize and re-fit - ONCE.
-				cockpit, GWLP_WNDPROC, (LONG_PTR) CockpitShellProc);
+			//
+			// The destructor puts the original proc back, so ordinarily
+			// this window is unsubclassed by the time a second race
+			// builds a new cockpit. The guard is for the case where it
+			// was not: subclassing an already-subclassed window makes
+			// SetWindowLongPtr hand back CockpitShellProc itself as the
+			// "original", and the proc below then chains to itself on
+			// every single message until the stack runs out. That is a
+			// stack overflow a few frames into the second race, with no
+			// hint of a cause in the log.
+			//
+			if (gCockpitShellWindow != cockpit)
+			{
+				gCockpitBaseProc = (WNDPROC) SetWindowLongPtrA(
+					cockpit, GWLP_WNDPROC, (LONG_PTR) CockpitShellProc);
+				gCockpitShellWindow = cockpit;
+			}
 
 			//
 			// Sticky placement for the shell. Position AND size: nothing
@@ -4917,6 +4949,30 @@ SVGA16::~SVGA16()
 		cockpitViewscreen = NULL;
 	}
 
+	//
+	// Give the game window its own proc back, and stop answering for a
+	// cockpit that is about to stop existing.
+	//
+	// The window survives us - it is the one that shows the console
+	// screen between races - so both of these outlived their subject.
+	// The subclass was the worse of the two: the next race re-subclassed
+	// the same window and CockpitShellProc ended up chained to itself.
+	// activeCockpit was the quieter one, left pointing at this object
+	// after it was freed, ready for the next WM_SIZE to lay out a
+	// cockpit that had already gone.
+	//
+	if (gCockpitShellWindow != NULL)
+	{
+		SetWindowLongPtrA(
+			gCockpitShellWindow, GWLP_WNDPROC, (LONG_PTR) gCockpitBaseProc);
+		gCockpitShellWindow = NULL;
+		gCockpitBaseProc = NULL;
+	}
+	if (activeCockpit == this)
+	{
+		activeCockpit = NULL;
+	}
+
 	Check_Fpu();
 }
 
@@ -4997,12 +5053,16 @@ Logical SVGA16::Update(Logical forceAll)
 	GaugeRenderer *renderer = application->GetGaugeRenderer();
 	if (!valid || renderer == NULL)
 	{
+		mDisplaysCopiedThisPass = 0;
 		CLEAR_SCREEN_COPY();
 		return False;		// Do no more!
 	}
 
-	if (++mDisplayToUpdate >= NUMGAUGEWINDOWS)
+	// one display per call; the rotation steps at the end of the function
+	if (mDisplayToUpdate >= NUMGAUGEWINDOWS)
+	{
 		mDisplayToUpdate = 0;
+	}
 
 	//Top MFD's
 	L4GraphicsPort *UL = static_cast<L4GraphicsPort*>(renderer->GetGraphicsPort("auxUL2"));
@@ -5045,7 +5105,10 @@ Logical SVGA16::Update(Logical forceAll)
 			lrMask |= (lrMask << 16);
 		} else
 		{
-			//No MFDs to draw, break out early
+			//No MFDs to draw, break out early. The sweep counter resets
+			//too: leaving it part-used would keep the renderer in its
+			//copy phase, and it never draws another gauge while there.
+			mDisplaysCopiedThisPass = 0;
 			return False;
 		}
 	} else
@@ -5057,7 +5120,8 @@ Logical SVGA16::Update(Logical forceAll)
 			secPalette = &((SVGA16 *) secPort->graphicsDisplay)->palette[secPort->paletteID];
 		} else
 		{
-			//No secondary, skip
+			//No secondary, skip - and end the sweep, as above.
+			mDisplaysCopiedThisPass = 0;
 			return False;
 		}
 	}
@@ -5227,7 +5291,80 @@ Logical SVGA16::Update(Logical forceAll)
 //	if (end.ticks - start.ticks > 100)
 //		end = start;
 
-	return False;			// True == 'more to do'
+	//
+	//------------------------------------------------------------------
+	// Step the rotation, and say "more to do" until every display has
+	// had its turn.
+	//
+	// This used to return False unconditionally, which told the gauge
+	// renderer its copy phase was over after a SINGLE display. A full
+	// gauge sweep - one gauge per background pass, so as many passes as
+	// there are active gauges - therefore refreshed one display, and the
+	// map, one of three, came round only every third sweep.
+	//
+	// That is invisible with frame time to spare, because the background
+	// loop keeps running until the frame budget is used up and gets
+	// through several sweeps. On a big map the 3D foreground eats the
+	// whole budget, the loop drops to the one pass per frame it is
+	// guaranteed, and the map goes seconds between refreshes - which is
+	// what the field reports describe, on exactly those maps. A death
+	// makes the renderer skip every static object, the budget frees up,
+	// and the backlog drains at once: the display appears to come back
+	// to life, which is the tell that led here.
+	//------------------------------------------------------------------
+	//
+	mDisplayToUpdate++;
+	if (mDisplayToUpdate >= NUMGAUGEWINDOWS)
+	{
+		mDisplayToUpdate = 0;
+	}
+
+	if (++mDisplaysCopiedThisPass < NUMGAUGEWINDOWS)
+	{
+		return True;			// call again - there are displays waiting
+	}
+	mDisplaysCopiedThisPass = 0;
+
+	//
+	// RP412GAUGEDIAG=1 reports how often the displays are actually being
+	// refreshed. Pixel-watching from outside cannot tell a display that
+	// is not refreshing from one whose picture simply is not changing,
+	// and that ambiguity is exactly what makes "my map froze" hard to
+	// pin down. This counts the real thing.
+	//
+	{
+		static int diagnostics = -1;
+		if (diagnostics < 0)
+		{
+			const char *setting = getenv("RP412GAUGEDIAG");
+			diagnostics = (setting != NULL && atoi(setting) != 0) ? 1 : 0;
+		}
+		if (diagnostics)
+		{
+			static unsigned long window_start = 0;
+			static int sweeps = 0;
+			unsigned long now = GetTickCount();
+			++sweeps;
+			if (window_start == 0)
+			{
+				window_start = now;
+			}
+			else if (now - window_start >= 2000)
+			{
+				// tenths, by hand: whole sweeps per second rounds the
+				// interesting cases - a starved pipeline managing two
+				// thirds of a sweep a second reads as a flat "0/s".
+				int tenths = sweeps * 10000 / (int)(now - window_start);
+				DEBUG_STREAM << "GaugeDiag: " << sweeps << " display sweep(s) in "
+					<< (now - window_start) << " ms ("
+					<< (tenths / 10) << '.' << (tenths % 10) << "/s, "
+					<< NUMGAUGEWINDOWS << " displays each)\n" << std::flush;
+				window_start = now;
+				sweeps = 0;
+			}
+		}
+	}
+	return False;				// the sweep is complete
 }
 
 

MUNGA_L4/L4VB16.h

@@ -293,6 +293,17 @@ private:
 
    int mDisplayToUpdate;
 
+	//------------------------------------------------------------------
+	// How many displays this copy pass has refreshed.
+	//
+	// The gauge renderer's copy phase ends the moment Update() reports it
+	// has finished, and Update() reported that after ONE display - so a
+	// whole gauge sweep refreshed a single display, and the map, one of
+	// three, came round only every third sweep. Counting them out means
+	// one sweep refreshes all of them.
+	//------------------------------------------------------------------
+	int mDisplaysCopiedThisPass;
+
 	//------------------------------------------------------------------
 	// Split-view mode (L4MFDSPLIT=1): the five channel-packed MFDs and
 	// the rotated map render as their own desktop windows; the packed

MUNGA_L4/L4VIDEO.cpp

@@ -17,6 +17,10 @@
 #include "..\munga\nttmgr.h"
 #include "..\munga\app.h"
 #include "l4particles.h"
+#include "l4padrio.h"			// PadRIO::IsActive, for the per-frame lamp sweep
+#include "..\munga\gaugrend.h"
+#include "..\munga\lamp.h"
+#include "..\munga\mode.h"
 #include "DXUtils.h"
 
 using namespace std;
@@ -5983,11 +5987,84 @@ void
 //~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 // Execute Method, performs the rendering of one frame
 //
+//
+//===========================================================================
+// RPSweepCockpitLamps
+//
+// Push the cockpit lamp STATE once per frame, instead of once per gauge
+// cycle.
+//
+// The on-screen vRIO buttons light themselves from PadRIO::GetLampState,
+// and they redraw with their MFD strip. What FILLS that store is
+// LampManager::Update -> AssertNewLampValue -> SetLamp, and that rides
+// the gauge renderer's FOREGROUND turn - which comes round only once per
+// full gauge cycle. On a busy map the cycle takes the best part of a
+// second, so the lit buttons froze and any flash stalled while the 3D
+// view, a separate per-frame render, stayed perfectly smooth. BT411 saw
+// the same thing on its glass surround and fixed it the same way.
+//
+// It is cheap: a sweep over the lamps, no raster, and AssertNewLampValue
+// already drops anything that has not changed - so this pushes no extra
+// traffic, it only stops changes arriving late.
+//
+// Only when a PadRIO is active, i.e. cockpit-less play. With real serial
+// hardware selected the pod keeps its authentic bandwidth-paced cadence,
+// untouched. RP412LAMPSWEEP=0 restores the once-per-cycle behaviour.
+//===========================================================================
+//
+static void
+	RPSweepCockpitLamps()
+{
+	static int
+		enabled = -1;
+
+	if (enabled < 0)
+	{
+		const char
+			*setting = getenv("RP412LAMPSWEEP");
+
+		enabled = (setting != NULL && setting[0] == '0') ? 0 : 1;
+	}
+	if (!enabled || !PadRIO::IsActive() || application == NULL)
+	{
+		return;
+	}
+
+	//
+	// Only while a mission is actually running. This is called from the
+	// top of the frame, ahead of the state switch below, so it would
+	// otherwise fire while the mission is still being built and the
+	// gauges do not exist yet.
+	//
+	if (application->GetApplicationState() != Application::RunningMission)
+	{
+		return;
+	}
+
+	GaugeRenderer
+		*renderer = application->GetGaugeRenderer();
+	ModeManager
+		*modes = application->GetModeManager();
+
+	if (renderer != NULL && modes != NULL)
+	{
+		LampManager
+			*lamps = renderer->GetLampManager();
+
+		if (lamps != NULL)
+		{
+			lamps->Update(modes->GetModeMask());
+		}
+	}
+}
+
 void DPLRenderer::ExecuteImplementation(RendererComplexity, RendererOrigin::InterestingEntityIterator* all_iterator)
 {
 	Component *component;
 	HRESULT hr;
 
+	RPSweepCockpitLamps();		// keep the lit buttons tracking the sim (see above)
+
 	// timing variables
    __int64 ticks = HiResNowTicks();
 #ifdef LOGFRAMERATE

MUNGA_L4/Munga_L4.vcxproj

@@ -227,6 +227,7 @@
     <ClCompile Include="..\MUNGA\WRHOUS.cpp" />
     <ClCompile Include=".\DXUtils.cpp" />
     <ClCompile Include=".\L4APP.cpp" />
+    <ClCompile Include=".\L4AUDEFX.cpp" />
     <ClCompile Include=".\L4AUDHDW.cpp" />
     <ClCompile Include=".\L4AUDIO.cpp" />
     <ClCompile Include=".\L4AUDLVL.cpp" />
@@ -263,6 +264,7 @@
       <ConformanceMode>true</ConformanceMode>
     </ClCompile>
     <ClCompile Include=".\L4PADBINDINGS.cpp" />
+    <ClCompile Include=".\L4JOY.cpp" />
     <ClCompile Include=".\L4PADRIO.cpp" />
     <ClCompile Include=".\L4PCSPAK.cpp" />
     <ClCompile Include=".\L4PLASMA.cpp" />
@@ -431,6 +433,7 @@
     <ClInclude Include="..\MUNGA\WRHOUS.h" />
     <ClInclude Include=".\DXUtils.h" />
     <ClInclude Include=".\L4APP.H" />
+    <ClInclude Include=".\L4AUDEFX.h" />
     <ClInclude Include=".\L4AUDHDW.h" />
     <ClInclude Include=".\L4AUDIO.h" />
     <ClInclude Include=".\L4AUDLVL.h" />
@@ -454,6 +457,7 @@
     <ClInclude Include=".\L4NETTRANSPORT.h" />
     <ClInclude Include=".\L4KEYLIGHT.h" />
     <ClInclude Include=".\L4PADBINDINGS.h" />
+    <ClInclude Include=".\L4JOY.h" />
     <ClInclude Include=".\L4STEAMTRANSPORT.h" />
     <ClInclude Include=".\L4PARTICLES.h" />
     <ClInclude Include=".\L4MFDVIEW.h" />

MUNGA_L4/Munga_L4.vcxproj.filters

@@ -486,6 +486,9 @@
     <ClCompile Include=".\L4AUDHDW.cpp">
       <Filter>Source Files\MUNGA_L4</Filter>
     </ClCompile>
+    <ClCompile Include=".\L4AUDEFX.cpp">
+      <Filter>Source Files\MUNGA_L4</Filter>
+    </ClCompile>
     <ClCompile Include=".\L4AUDIO.cpp">
       <Filter>Source Files\MUNGA_L4</Filter>
     </ClCompile>
@@ -1058,6 +1061,9 @@
     <ClInclude Include=".\L4APP.H">
       <Filter>Header Files\MUNGA_L4</Filter>
     </ClInclude>
+    <ClInclude Include=".\L4AUDEFX.h">
+      <Filter>Header Files\MUNGA_L4</Filter>
+    </ClInclude>
     <ClInclude Include=".\L4AUDHDW.h">
       <Filter>Header Files\MUNGA_L4</Filter>
     </ClInclude>

MUNGA_L4/WTPresets.cpp

@@ -32,6 +32,13 @@ SAMPLEINFO PRESET_getSampleInfo(int bank, int preset, int sampleInd)
 	default.file = "";
 	default.implemented = false;
 	default.loop = SampleLoop::LoopAtWill;
+	//
+	// -1 = no buffer. Every caller tests bufferIndex >= 0 before using it as
+	// an index, and this one field was being left as whatever was on the
+	// stack - so "this zone does not exist" read as a real buffer whenever
+	// the garbage happened to be positive, and indexed g_buffers with it.
+	//
+	default.bufferIndex = -1;
 
 	if (sampleInd < 0 || sampleInd >= allPresets[bank-1][preset].sampleNum)
 	{

README.md

@@ -75,6 +75,18 @@ Winners Circle camera is framed off the award stand itself rather than
 off whoever is standing on it, so the shot is the same one for every
 player at every head count.
 
+[v4.12.7](https://gitea.mysticmachines.com/VWE/RP412/releases/tag/v4.12.7)
+is about sticks. Anything that is not an Xbox-class pad — a flight stick,
+a HOTAS throttle, a twist grip, rudder pedals, a wheel — comes in through
+DirectInput rather than XInput, and the game could not see any of it.
+Now it can, and `joyconfig.bat` sets it up: the wizard asks you to move
+each control in turn, works out which device and axis answered and which
+way round it reads, and writes the joystick rows of `bindings.txt`,
+leaving anything you have edited yourself alone. A twist grip or rudder
+bar drives both pedals through one signed `Pedals` axis, and a real
+throttle lever owns its channel outright rather than nudging a position
+the way a spring-centred stick has to. Ported from the sibling BT411.
+
 ## Playing
 
 Grab the release zip (or run `pack-dist.ps1` on a build). Single player:
@@ -84,9 +96,13 @@ team/position columns and its own track list). Steam multiplayer: see
 [docs/STEAM-3-MACHINE-TEST.md](docs/STEAM-3-MACHINE-TEST.md) (until RP412
 has its own AppID it runs under Spacewar, 480).
 
-The two config files beside the exe are self-documenting: **environ.ini**
+The config files beside the exe are self-documenting and none of them
-(every engine option, commented) and **bindings.txt** (every key, pad
+ship: the game writes each one the first time it needs it and then leaves
-button, and axis; written with the full default layout on first run).
+it alone, so a new build dropped over an existing folder keeps every
+setting. **environ.ini** is every engine option, commented; **bindings.txt**
+every key, pad button and axis; **pilot.cfg** your callsign and loadout;
+**mfd_layout.cfg** where you dragged the windows. Delete any of them to
+start that part over with the current defaults.
 Default controls: numpad flies (8/2/4/6 stick, 7/9 pedals, 0 trigger),
 Shift/Ctrl throttle, Alt reverse, arrows look, Space fires, letter rows
 are the MFD button banks as printed on the panel. **Alt+Q** aborts a

RP_L4/RPL4.CPP

@@ -22,12 +22,15 @@
 
 #include "rpl4pb.h"
 #include "rpl4fe.h"
+#include "rpl4environ.h"
 #include "rpl4console.h"
 #include "rpl4lobby.h"
 #include "..\munga_l4\l4steamtransport.h"
 #include "..\munga_l4\l4splr.h"
 #include "..\munga_l4\l4mfdview.h"		// RPWindowLayout_*
+#include "..\munga_l4\l4joy.h"			// RPJoyConfigWizard
 #include "rpl4ver.h"
+#include "rpl4build.h"		// generated: RP412_VERSION / RP412_VERSION_LONG
 #include "..\munga\resver.h"
 #include "..\munga\resource.h"
 // added for game status drawing support
@@ -39,6 +42,7 @@
 #include <strsafe.h>
 #include <direct.h>
 #include <shellapi.h>
+#include <time.h>			// the test-build expiry check
 
 #define SPOOL_SIZE 0x600000
 
@@ -148,6 +152,15 @@ int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine
 
 	SetUnhandledExceptionFilter(RPL4CrashDumpFilter);
 
+   //
+   // Which build this is, before anything else can fail. The patch number
+   // is this repository's commit count and the hash beside it names the
+   // commit, so a log from a test machine says exactly where it came from.
+   // A trailing '+' means the tree had uncommitted changes when it was
+   // built. See stamp-version.ps1.
+   //
+   DEBUG_STREAM << "Red Planet " << RP412_VERSION_LONG << std::endl << std::flush;
+
    // load up our environment variables
    //controls
    if(getenv("L4CONTROLS") == NULL)
@@ -162,32 +175,105 @@ int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine
 	   putenv("TARGETFPS=60");
    if(getenv("MAXPARTICLES") == NULL)
 	   putenv("MAXPARTICLES=8192");
-   FILE *file;
+   //
-   char line[1024];
+   // environ.ini: written on first run and read here. The exe owns the
-   if (fopen_s(&file, "environ.ini", "r") == 0)
+   // template rather than the packaging script laying one down on every
+   // unzip, so a tester can drop a new build over an old folder and keep
+   // their settings. See rpl4environ.h.
+   //
+   RPL4Environ_Load();
+
+   //
+   //-------------------------------------------------------------------------
+   // Test builds have a shelf life.
+   //
+   // A tester still racing a fortnight-old binary reports things that were
+   // fixed a week ago, and the afternoon spent chasing them is gone. So the
+   // build says plainly that it is out of date and stops, rather than
+   // running on and being quietly wrong about what it is.
+   //
+   // This is a nudge, not a lock: the date comes from the machine's own
+   // clock, so anyone determined can wind it back, and RP412NOEXPIRY=1 is
+   // there for us when an old build has to be run on purpose. It is
+   // deliberately not listed in environ.ini - a bypass every tester can see
+   // is a bypass every tester will use, and then the build never goes stale
+   // for the one person it was meant to stop.
+   //
+   // $expireDays in stamp-version.ps1 is what sets this, and 0 turns it off
+   // for a real release.
+   //-------------------------------------------------------------------------
+   //
+#if RP412_EXPIRES
    {
-      while (!feof(file))
+      const char *no_expiry = getenv("RP412NOEXPIRY");
+      Logical overridden = (no_expiry != NULL && atoi(no_expiry) != 0);
+
+      __time64_t raw_now = _time64(NULL);
+      struct tm today;
+      if (!overridden && _localtime64_s(&today, &raw_now) == 0)
       {
-         if (fgets(line, sizeof(line), file))
+         int now_stamp =
+            (today.tm_year + 1900) * 10000 + (today.tm_mon + 1) * 100 + today.tm_mday;
+         int expiry_stamp =
+            RP412_EXPIRY_YEAR * 10000 + RP412_EXPIRY_MONTH * 100 + RP412_EXPIRY_DAY;
+
+         if (now_stamp > expiry_stamp)
          {
-            for (int i = strlen(line); i >= 0; i--)
+            DEBUG_STREAM << "Build expired on " << RP412_EXPIRY_TEXT
-               if (line[i] == '\n' || line[i] == '\r')
+               << " - refusing to run\n" << std::flush;
-                  line[i] = 0;
+
-            // the file is self-documenting: skip comments, blanks,
+            char notice[512];
-            // and anything that is not KEY=VALUE
+            sprintf(notice,
-            char *setting = line;
+               "This Red Planet test build has expired.\n\n"
-            while (*setting == ' ' || *setting == '\t')
+               "  Build    %s\n"
-               ++setting;
+               "  Expired  %s\n\n"
-            if (*setting == '\0' || *setting == '#' || *setting == ';' ||
+               "Test builds are good for a fortnight so that nobody spends an "
-                strchr(setting, '=') == NULL)
+               "afternoon chasing something that was fixed a week ago.\n\n"
-               continue;
+               "Ask for the current one.",
-            putenv(setting);
+               RP412_VERSION_LONG, RP412_EXPIRY_TEXT);
+            MessageBoxA(NULL, notice, "Red Planet - test build expired",
+               MB_OK | MB_ICONWARNING | MB_SETFOREGROUND);
+            return 1;
+         }
+
+         //
+         // The last few days get a line in the log, so somebody reading a
+         // report can see the build was nearly out rather than wondering.
+         //
+         struct tm expiry_day;
+         memset(&expiry_day, 0, sizeof(expiry_day));
+         expiry_day.tm_year = RP412_EXPIRY_YEAR - 1900;
+         expiry_day.tm_mon  = RP412_EXPIRY_MONTH - 1;
+         expiry_day.tm_mday = RP412_EXPIRY_DAY;
+         //
+         // The END of the expiry day, because that is the rule the check
+         // above enforces - the build is good for all of that date and
+         // refuses the morning after. Anchoring at midday instead would
+         // report one day fewer than the build actually has left.
+         //
+         expiry_day.tm_hour = 23;
+         expiry_day.tm_min  = 59;
+         expiry_day.tm_sec  = 59;
+         expiry_day.tm_isdst = -1;
+         __time64_t expiry_time = _mktime64(&expiry_day);
+         if (expiry_time != (__time64_t) -1)
+         {
+            int days_left = (int)((expiry_time - raw_now) / (24 * 60 * 60));
+            if (days_left <= 3)
+            {
+               DEBUG_STREAM << "Build expires " << RP412_EXPIRY_TEXT << " ("
+                  << days_left << " day(s) left)\n" << std::flush;
+            }
          }
       }
-      fclose(file);
+      else if (overridden)
+      {
+         DEBUG_STREAM << "Build expiry (" << RP412_EXPIRY_TEXT
+            << ") waived by RP412NOEXPIRY\n" << std::flush;
+      }
    }
+#endif
 
-   DEBUG_STREAM << "Red Planet 4.12.6" << std::endl << std::flush;
    DEBUG_STREAM << "L4CONTROLS=" << getenv("L4CONTROLS") << std::endl << std::flush;
 
 #ifdef RP412_STEAM
@@ -279,6 +365,28 @@ int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine
 		RPWindowLayout_Load();
 	}
 
+	//
+	//-------------------------------------------------------------------------
+	// RP412JOYCONFIG=1 (joyconfig.bat): the joystick setup wizard, before
+	// anything else claims the screen. It asks the player to move each
+	// control on their stick, HOTAS or pedals and writes the joy* rows of
+	// bindings.txt, then falls through into the game so they can try them
+	// straight away.
+	//
+	// One shot: the variable is cleared from this process so a rebuilt
+	// PadRIO later in the session cannot run the wizard a second time.
+	//-------------------------------------------------------------------------
+	//
+	{
+		const char *joyconfig = getenv("RP412JOYCONFIG");
+		if (joyconfig != NULL && *joyconfig != '\0' && atoi(joyconfig) != 0)
+		{
+			RPJoyConfigWizard();
+			SetEnvironmentVariableA("RP412JOYCONFIG", NULL);
+			_putenv("RP412JOYCONFIG=");
+		}
+	}
+
 #if !_DEBUG
 	// Arcade pods have no mouse - but desktop/windowed play needs the
 	// cursor for the on-screen cockpit buttons, so hide it only when

RP_L4/RPL4CONSOLE.cpp

@@ -352,6 +352,55 @@ namespace
 		gPhase = PhaseStopped;
 	}
 
+	//---------------------------------------------------------------
+	// The countdown the engine shows, taken from the clock that will
+	// actually end the race (gMissionClockHook - see APPMGR.h).
+	//
+	// Called on the game thread, reading two volatile LONGs the console
+	// thread writes with InterlockedExchange. Aligned 32-bit reads, and
+	// a torn value could only mistime the cockpit clock by one tick of
+	// a countdown nobody reads to the millisecond - not worth a lock on
+	// the frame path.
+	//---------------------------------------------------------------
+	Logical MissionClock(Scalar *seconds_remaining)
+	{
+		//
+		// Only answer for the race this console is actually marshalling.
+		// Nothing ever uninstalls the hook, so a player who hosts a race
+		// and then joins somebody else's lobby still has it wired up -
+		// and in that race the console is a bystander whose gLengthMs and
+		// gRunStartTick belong to the previous mission entirely.
+		//
+		if (gWatchedApp == NULL || gWatchedApp != application)
+		{
+			return False;
+		}
+		if (!gMissionRunning)
+		{
+			return False;		// not started, or already stopped
+		}
+		LONG length_ms = gLengthMs;
+		if (length_ms <= 0)
+		{
+			return False;		// endless: nothing to count down
+		}
+
+		// DWORD subtraction, so a GetTickCount wrap costs nothing
+		LONG elapsed_ms = (LONG)(GetTickCount() - (DWORD) gRunStartTick);
+		LONG left_ms = length_ms - elapsed_ms;
+		if (left_ms < 0)
+		{
+			//
+			// The console polls at 250 ms, so the clock reaches zero
+			// slightly before the stop is dispatched. Hold at zero
+			// rather than showing negative time in the cockpit.
+			//
+			left_ms = 0;
+		}
+		*seconds_remaining = (Scalar) left_ms / 1000.0f;
+		return True;
+	}
+
 	//---------------------------------------------------------------
 	// The game-thread tick: state reporting + engine-safe execution
 	//---------------------------------------------------------------
@@ -522,6 +571,10 @@ namespace
 		// game-thread execution point
 		gPerFrameHook = &ConsoleTick;
 
+		// the cockpit clock now counts down the same clock that will stop
+		// the race, rather than the engine's own reckoning of it
+		gMissionClockHook = &MissionClock;
+
 		// results intake from the RP layer
 		gConsoleScoreSink = &CollectFinalScore;
 

RP_L4/RPL4ENVIRON.cpp

@@ -0,0 +1,569 @@
+#include "rpl4.h"
+#pragma hdrstop
+
+#include "rpl4environ.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+//########################################################################
+// environ.ini - see rpl4environ.h for why the exe owns this rather than
+// the packaging script.
+//########################################################################
+
+namespace
+{
+	const char kEnvironFileName[] = "environ.ini";
+
+	//-------------------------------------------------------------------
+	// The shipped configuration, verbatim. Lifted out of pack-dist.ps1
+	// so there is one source of truth and the exe alone can produce a
+	// working install.
+	//-------------------------------------------------------------------
+	const char kEnvironTemplate[] =
+"# ============================================================================\n"
+"#  environ.ini - Red Planet 4.12 configuration\n"
+"# ============================================================================\n"
+"#  One KEY=VALUE per line, read at game start. Lines starting with # or ;\n"
+"#  are comments; anything without an = is ignored. Delete a line (or\n"
+"#  comment it out) to fall back to the built-in default.\n"
+"#\n"
+"#  Input bindings live in bindings.txt beside the exe (written with the\n"
+"#  full documented layout on first run; delete it to restore defaults).\n"
+"#\n"
+"#  Your callsign and loadout are remembered in pilot.cfg beside the exe.\n"
+"#  Set them on the setup screen once and they come back every session,\n"
+"#  however you left - launching, joining a lobby, or quitting. Delete\n"
+"#  that file to start over.\n"
+"\n"
+"# ---- Core (the shipped configuration) --------------------------------------\n"
+"\n"
+"# Control stack: tokens separated by ; or , processed left to right.\n"
+"#   PAD            the virtual RIO (XInput controller + keyboard,\n"
+"#                  rebindable via bindings.txt)\n"
+"#   RIO            real serial cockpit hardware on COM1\n"
+"#   RIO:COMn       same, on another port (RIO:COM3, ...)\n"
+"#   KEYBOARD       the engine keyboard handler\n"
+"#   MOUSE, JOYSTICK, FLIGHTSTICKPRO, THRUSTMASTER, DIJOYSTICK\n"
+"#                  legacy pointer/joystick drivers (untested here)\n"
+"# Unset falls back to KEYBOARD alone.\n"
+"L4CONTROLS=PAD;KEYBOARD\n"
+"\n"
+"# Renderer bring-up argument. Only its presence is checked (the DPL\n"
+"# resolution parsing it once fed is gone) and the game refuses to start\n"
+"# without it - any non-empty value works. Leave as shipped.\n"
+"DPLARG=1\n"
+"\n"
+"# DPL (renderer/scene) configuration file, searched beside the exe.\n"
+"# Any notation file name; RPDPL.INI is the one that ships.\n"
+"L4DPLCFG=RPDPL.INI\n"
+"\n"
+"# Gauge (MFD/instrument) canvas. Must name a page of GAUGE\\L4GAUGE.INI:\n"
+"#   640x480x8 | 640x480x16 | 800x600x16\n"
+"# Unset disables the gauge renderer (and with it all MFDs).\n"
+"L4GAUGE=640x480x16\n"
+"\n"
+"# Plasma display.\n"
+"#   SCREEN         render the pod's plasma glass in-window (currently\n"
+"#                  parked off-layout)\n"
+"#   COM1, COM2...  drive real plasma glass on that serial port\n"
+"#                  (9600 baud, N81)\n"
+"# Unset = no plasma display.\n"
+"L4PLASMA=SCREEN\n"
+"\n"
+"# 0 = classic separate gauge windows; 1 = the single-window glass\n"
+"# cockpit (all seven displays composed on a locked 1920x1080 canvas\n"
+"# around the viewscreen); 2 = exploded diagnostic view (each display\n"
+"# in its own native-resolution desktop window - MFDs 640x480, map\n"
+"# 480x640 - decoded exactly as the pod's VDB split them, no downscale).\n"
+"L4MFDSPLIT=1\n"
+"\n"
+"# The game window - and in the exploded view (L4MFDSPLIT=2) each display\n"
+"# window - is placed fresh every launch, so moving one somewhere useful\n"
+"# never survived the menu-race-menu loop. This remembers where you put\n"
+"# them, in mfd_layout.cfg beside this file:\n"
+"#   off / 0 / unset   computed placement only, no file (default)\n"
+"#   load              put the windows back where they were saved\n"
+"#   save              the same, and re-save on every finished drag\n"
+"# The game window gets its size back too, so you can size the cockpit to\n"
+"# suit your monitor once and keep it. The display windows get position\n"
+"# only: their size follows their content and their button banks, so an\n"
+"# old one is never restored over them. Arrange everything once with\n"
+"# save, then leave it on load.\n"
+"#\n"
+"# The plasma display window takes part too, under \"Plasma Display\".\n"
+"#\n"
+"# Each line in mfd_layout.cfg reads <title>=<x>,<y>,<w>,<h>, and you can\n"
+"# append ,noframe to take that window's title bar and border off - a\n"
+"# cockpit that fills the monitor edge to edge without -fit taking the\n"
+"# whole screen. Put the window where you want it first: a bare window\n"
+"# has nothing to drag by. Delete the flag to get the frame back.\n"
+"#RP412MFDLAYOUT=off\n"
+"\n"
+"# Size of the six secondary displays in the glass cockpit, as a\n"
+"# percentage of their pod size. The pod bolted them down at one size;\n"
+"# on a big panel there is room to trade viewscreen for instrument, so\n"
+"# turn these up if you want to actually read the other displays while\n"
+"# you fly. 100 = as the pod had them. Range 25-200 (out-of-range and\n"
+"# unreadable values fall back to the group setting, then to 100).\n"
+"#\n"
+"# The scaling is applied in canvas units, before the cockpit is fitted\n"
+"# to your window, so a given number looks the same on every monitor.\n"
+"# The layout stays legal whatever you ask for - the panes are clamped\n"
+"# against their actual neighbours, shrinking uniformly so a display\n"
+"# never comes out stretched. They do overlap the viewscreen, exactly\n"
+"# as the pod's bezels did, but never each other.\n"
+"#\n"
+"# L4MFDSCALE sets all five green MFDs at once.\n"
+"L4MFDSCALE=100\n"
+"\n"
+"# ...and any single display can override it. Uncomment one to size it\n"
+"# on its own - useful if you only care about, say, the damage readout.\n"
+"#   UL upper left     UC upper center    UR upper right\n"
+"#   LL lower left     LR lower right\n"
+"#L4MFDSCALE_UL=100\n"
+"#L4MFDSCALE_UC=100\n"
+"#L4MFDSCALE_UR=100\n"
+"#L4MFDSCALE_LL=100\n"
+"#L4MFDSCALE_LR=100\n"
+"\n"
+"# The portrait radar/map, sized on its own (it already sits at 1.35x\n"
+"# the MFDs by default). It shares the canvas with whichever MFD is\n"
+"# above it, so at extreme settings one of the two gives way.\n"
+"L4RADARSCALE=100\n"
+"\n"
+"# Where the radar sits:\n"
+"#   CENTER    bottom centre, under the viewscreen, as the pod had it\n"
+"#             (default; BOTTOM and CENTRE mean the same)\n"
+"#   LEFT      bottom left corner      (or BOTTOMLEFT)\n"
+"#   RIGHT     bottom right corner     (or BOTTOMRIGHT)\n"
+"#   MIDLEFT   left edge, halfway up   (or LEFTCENTER / LEFTCENTRE)\n"
+"#   MIDRIGHT  right edge, halfway up  (or RIGHTCENTER / RIGHTCENTRE)\n"
+"# Anywhere but CENTER stops it blocking the middle of the road, which\n"
+"# is worth having on a wide screen.\n"
+"#\n"
+"# In a bottom corner it is one of three panes along the bottom, and the\n"
+"# lower MFD whose corner it takes slides inboard beside it. Halfway up\n"
+"# a side it leaves the bottom row entirely and sits between that side's\n"
+"# two MFDs - roomy on a tall radar, but if the MFDs on that side are\n"
+"# also scaled up, the radar is the one that gives way (it has to clear\n"
+"# both of them, and it grows from the middle in both directions).\n"
+"L4RADARPOS=CENTER\n"
+"\n"
+"# The Winners Circle: at the end of a race the finishers are stood on\n"
+"# the award platform in finishing order, with each pilot's callsign on\n"
+"# the plate beside their spot, and held there for a few seconds before\n"
+"# the results screen. 1 = show it, 0 = straight to the results.\n"
+"RP412PODIUM=1\n"
+"\n"
+"# The shot is framed for you, but these move the camera if you want it\n"
+"# somewhere else. Distances are in game units, measured from the middle\n"
+"# of the group of finishers.\n"
+"#   STANDOFF  how far out in front of the stand the camera sits\n"
+"#   HEIGHT    how far above the group\n"
+"#   AIM       height of the point it looks at, relative to the group -\n"
+"#             negative tilts down, positive tilts up\n"
+"#   ASPECT    the stand was composed for a 4:3 pod monitor, so the shot\n"
+"#             is cropped to that shape with black either side. 0 runs it\n"
+"#             full width instead.\n"
+"#   FADEIN    seconds to come up out of the black after the race fades\n"
+"#   CAM       0 watches from your own cockpit rather than off the stand\n"
+"#RP412PODIUMSTANDOFF=36\n"
+"#RP412PODIUMHEIGHT=12\n"
+"#RP412PODIUMAIM=2\n"
+"#RP412PODIUMASPECT=1.333\n"
+"#RP412PODIUMFADEIN=0.45\n"
+"#RP412PODIUMCAM=1\n"
+"\n"
+"# Override the game length the menu picked, in seconds. The shortest the\n"
+"# menu offers is 3:00, which is a long wait when what you are testing is\n"
+"# what happens at the buzzer. Unset = use the menu's choice.\n"
+"#RP412MISSIONSECONDS=20\n"
+"\n"
+"# Simulation/render frame rate, integer frames/second. The desktop\n"
+"# default is 60; the arcade pods shipped at 25.\n"
+"TARGETFPS=60\n"
+"\n"
+"# How long one background pass may spend drawing cockpit gauges, in\n"
+"# milliseconds. The gauges and the MFD/map displays are redrawn in the\n"
+"# time left over after the 3D view; on a big, busy map there is none\n"
+"# left, and at the original one-gauge-per-pass the map and the countdown\n"
+"# clock could sit frozen for seconds at a time - until something (a\n"
+"# death, say) lightened the 3D view enough for the backlog to drain.\n"
+"# Working to a slice ties the refresh rate to elapsed time instead. Set\n"
+"# 0 for the old behaviour; raise it to favour the displays over frame\n"
+"# rate.\n"
+"RP412GAUGESLICE=2\n"
+"\n"
+"# 1 = log how many times a second every cockpit display is actually\n"
+"# refreshed, to rpl4.log. Watching the screen cannot tell a display that\n"
+"# has stopped refreshing from one whose picture simply is not changing.\n"
+"#RP412GAUGEDIAG=1\n"
+"\n"
+"# 0 = light the on-screen cockpit buttons on the same slow cadence the\n"
+"# arcade pod's serial hardware used. The lamp state is filled once per\n"
+"# gauge cycle, so under the load described above the lit buttons froze\n"
+"# and flashing ones stalled while the 3D view stayed perfectly smooth.\n"
+"# On by default: the buttons are refreshed every frame instead. Ignored\n"
+"# when real RIO hardware is selected - the pod keeps its own cadence.\n"
+"#RP412LAMPSWEEP=0\n"
+"\n"
+"# 1 = Steam networking (lobbies, FakeIP mesh). Needs the Steam client\n"
+"# running and steam_appid.txt beside the exe; without them the game\n"
+"# logs the reason and falls back to plain TCP. 0 = TCP only.\n"
+"RP412STEAM=1\n"
+"\n"
+"# Line up each remote player's clock with ours, so their vehicle is\n"
+"# extrapolated from when its update was SENT rather than when it\n"
+"# arrived. Without it every remote pod sits one network latency behind\n"
+"# where it should be - invisible on the 1ms arcade LAN the engine was\n"
+"# written for, a constant 50-150ms of lag over the internet. 0 restores\n"
+"# the old arrival-time behaviour if you want to compare.\n"
+"#RP412NETCLOCK=0\n"
+"\n"
+"# ---- Optional ---------------------------------------------------------------\n"
+"\n"
+"# RGB keyboard lamp mirror (Windows Dynamic Lighting): keys bound to\n"
+"# lamp buttons glow with the panel, flash modes and all.\n"
+"# Unset or nonzero = on (the default); 0 = off.\n"
+"#RP412KEYLIGHT=0\n"
+"\n"
+"# The cabinets ran the game at unity and did all their volume and tone\n"
+"# shaping outside it, in an amplifier and a 3-way crossover. You almost\n"
+"# certainly have neither, so these two stand in for them. Both default\n"
+"# to leaving the mix exactly as the pod played it.\n"
+"\n"
+"# Master volume, 0.0 to 2.0, the amplifier's knob. 1.0 is unity. The\n"
+"# sound effects now carry the pitch, layering and dynamics the original\n"
+"# AWE32 soundbanks ask for, which is a good deal livelier than earlier\n"
+"# 4.12 builds - lower this if the whole thing sits too hot.\n"
+"#\n"
+"# PageUp and PageDown change it while you play, in steps of 0.05, and\n"
+"# whatever you leave it on is written to volume.cfg beside the exe and\n"
+"# used from then on - so this line only decides where a machine that has\n"
+"# never been touched starts out. Delete volume.cfg to come back here.\n"
+"#RP412AUDIOVOLUME=0.8\n"
+"\n"
+"# Bass trim, 0.0 to 1.0, the crossover's low band. 1.0 is the low end\n"
+"# exactly as authored. The soundbanks put real weight under collisions,\n"
+"# engines and explosions - deep layers earlier builds played at the\n"
+"# wrong rate, so they barely sounded at all. Lower this to pull that\n"
+"# back; it eases in below 22kHz of playback rate and reaches full cut\n"
+"# on the deepest layers, leaving the mid and top alone.\n"
+"#\n"
+"# Home and End change it while you play, in steps of 0.05, and what you\n"
+"# leave it on is written to bass.cfg beside the exe and used from then\n"
+"# on - so this line only decides where an untouched machine starts.\n"
+"# Delete bass.cfg to come back here.\n"
+"#RP412AUDIOBASS=0.7\n"
+"\n"
+"# Invert the stick on top of whatever bindings.txt produces:\n"
+"# X = invert X only, Y = invert Y only, XY = both (case-insensitive).\n"
+"#L4PADFLIP=XY\n"
+"\n"
+"# Anti-aliasing sample count, passed straight to Direct3D 9:\n"
+"# 0 = off, else 2..16 as the GPU supports (1 selects the driver's\n"
+"# \"nonmaskable\" mode; unsupported counts fail device creation).\n"
+"#MULTISAMPLE=0\n"
+"\n"
+"# Particle budget, integer. Default 8192.\n"
+"#MAXPARTICLES=8192\n"
+"\n"
+"# On-screen plasma glass (L4PLASMA=SCREEN only). SCALE = integer pixel\n"
+"# size 1..16, default 4 (out-of-range values are ignored). POS = window\n"
+"# top-left as X,Y screen coordinates; unset = auto, parked below the\n"
+"# main window.\n"
+"#L4PLASMASCALE=4\n"
+"#L4PLASMAPOS=0,0\n"
+"\n"
+"# Fixed random seed (repeatable runs): any unsigned integer.\n"
+"# Unset seeds from the clock.\n"
+"#RANDOM=12345\n"
+"\n"
+"# ---- LAN play without Steam -------------------------------------------------\n"
+"# Host a race over plain TCP: list the member pods' console channels\n"
+"# (members run: rpl4opt.exe -windowed -res 1920 1080 -net 1501).\n"
+"#   RP412HOSTPODS  comma-separated IP[:port] list, one entry per member\n"
+"#                  pod; port defaults to 1501 per entry\n"
+"#   RP412HOSTPORT  this machine's console port, integer > 0\n"
+"#                  (default 1501)\n"
+"#   RP412HOSTADDR  this machine's LAN IP as members can reach it\n"
+"#                  (default 127.0.0.1)\n"
+"#RP412HOSTPODS=192.168.1.20:1501,192.168.1.21:1501\n"
+"#RP412HOSTPORT=1501\n"
+"#RP412HOSTADDR=192.168.1.10\n"
+"\n"
+"# ---- Developer / testing ----------------------------------------------------\n"
+"\n"
+"# Nonzero arms the debug keys: Alt+W wireframe, Alt+V predator vision,\n"
+"# Alt+F frame dump, Alt+/ perf stats, Alt+E event-queue dump.\n"
+"# 0 or unset = off. (Alt+Q, the mission abort, is always live.)\n"
+"#RP412DEVKEYS=1\n"
+"\n"
+"# Console race-length override, integer seconds (short test races).\n"
+"# Values <= 0 are ignored.\n"
+"#L4CONSOLELEN=30\n"
+"\n"
+"# Nonzero = Steam transport loopback self-test at boot (logs PASS/FAIL).\n"
+"#RP412STEAMSELFTEST=1\n"
+"\n"
+"# ---- Arcade heritage (multi-monitor pods; not used on the desktop) ----------\n"
+"# PRIMGAUGE / SECGAUGE / MFDGAUGE / MFDGAUGE2 pin a display to a monitor\n"
+"# by adapter index (0, 1, 2...). SPANDISABLE: 0 = let the MFDs span one\n"
+"# wide surface, nonzero = separate windows (setting MFDGAUGE2 alone also\n"
+"# forces spanning off). L4EYES = \"x y z xrot yrot zrot [type]\" floats\n"
+"# for a detached camera; a type starting with r offsets it relative to\n"
+"# the pod. L4INTERCOM enables the crew intercom - only its presence\n"
+"# matters (traditionally COM2). NOMODES skips the mode/lamp programming;\n"
+"# presence alone triggers it, even NOMODES=0. LOGSIZE > 0 sizes the\n"
+"# trace log in dev builds compiled with tracing.\n"
+"#PRIMGAUGE=1\n"
+"#SECGAUGE=2\n"
+"#MFDGAUGE=3\n"
+"#MFDGAUGE2=4\n"
+"#SPANDISABLE=1\n"
+"#L4EYES=1\n"
+"#L4INTERCOM=COM2\n"
+"#NOMODES=1\n"
+"#LOGSIZE=1000000\n"
+		;
+
+	//-------------------------------------------------------------------
+	// Does the player's file mention this key at all - set, or commented
+	// out, or with whitespace in front of it?
+	//
+	// Deliberately generous: a key that is mentioned in ANY form is left
+	// alone. The alternative failure is worse than a missed notice, since
+	// environ.ini is applied line by line and a second copy of a key
+	// further down the file would silently override the player's own.
+	//-------------------------------------------------------------------
+	Logical FileMentionsKey(const char *text, const char *key, int key_length)
+	{
+		const char *cursor = text;
+		while ((cursor = strstr(cursor, key)) != NULL)
+		{
+			//
+			// Must be a whole key: preceded by start-of-line, whitespace
+			// or a comment mark, and followed by '='.
+			//
+			const char *after = cursor + key_length;
+			Logical starts_token =
+				(cursor == text) ||
+				(cursor[-1] == '\n') || (cursor[-1] == '\r') ||
+				(cursor[-1] == ' ')  || (cursor[-1] == '\t') ||
+				(cursor[-1] == '#')  || (cursor[-1] == ';');
+			if (starts_token)
+			{
+				const char *scan = after;
+				while (*scan == ' ' || *scan == '\t')
+				{
+					++scan;
+				}
+				if (*scan == '=')
+				{
+					return True;
+				}
+			}
+			cursor = after;
+		}
+		return False;
+	}
+
+	//-------------------------------------------------------------------
+	// Name every template key the player's file has never heard of. Not
+	// a fix - their file stays theirs - but it puts the reason for a
+	// missing feature in the log we already ask testers for.
+	//-------------------------------------------------------------------
+	void ReportUnmentionedKeys(const char *file_text)
+	{
+		char missing[1024];		// what gets printed
+		char seen[1024];		// the same keys as "KEY=", so the mention
+								// test above can dedupe against them
+		missing[0] = '\0';
+		seen[0] = '\0';
+		int count = 0;			// how many are missing
+		int listed = 0;			// how many fitted in the line
+
+		const char *cursor = kEnvironTemplate;
+		while (*cursor != '\0')
+		{
+			const char *line = cursor;
+			const char *end = strchr(line, '\n');
+			int length = (end != NULL) ? (int)(end - line) : (int) strlen(line);
+			cursor = (end != NULL) ? (end + 1) : (line + length);
+
+			//
+			// A template key line is "KEY=..." or "#KEY=..." - the
+			// commented ones are options that ship switched off, and a
+			// player who has never seen them wants to know they exist.
+			//
+			const char *scan = line;
+			int remaining = length;
+			if (remaining > 0 && *scan == '#')
+			{
+				++scan;
+				--remaining;
+			}
+			if (remaining <= 0 || !(isalpha((unsigned char) *scan) || *scan == '_'))
+			{
+				continue;
+			}
+			int key_length = 0;
+			while (key_length < remaining &&
+				(isalnum((unsigned char) scan[key_length]) || scan[key_length] == '_'))
+			{
+				++key_length;
+			}
+			if (key_length >= remaining || scan[key_length] != '=' || key_length > 60)
+			{
+				continue;
+			}
+
+			char key[64];
+			memcpy(key, scan, key_length);
+			key[key_length] = '\0';
+
+			if (FileMentionsKey(file_text, key, key_length))
+			{
+				continue;
+			}
+			//
+			// Templates list some keys twice (documented once, shown
+			// again in an example); do not name one twice.
+			//
+			if (FileMentionsKey(seen, key, key_length))
+			{
+				continue;
+			}
+			++count;
+			if (strlen(seen) + key_length + 3 < sizeof(seen))
+			{
+				strcat(seen, key);
+				strcat(seen, "=\n");
+			}
+			if (strlen(missing) + key_length + 3 < sizeof(missing))
+			{
+				if (missing[0] != '\0')
+				{
+					strcat(missing, ", ");
+				}
+				strcat(missing, key);
+				++listed;
+			}
+		}
+
+		if (count > 0)
+		{
+			//
+			// Say when the list is short of the count rather than letting
+			// a full buffer quietly shorten the answer.
+			//
+			DEBUG_STREAM << "Environ: " << kEnvironFileName << " does not mention "
+				<< count << " option(s) this build knows: " << missing;
+			if (listed < count)
+			{
+				DEBUG_STREAM << ", and " << (count - listed) << " more";
+			}
+			DEBUG_STREAM << "\nEnviron: they are at their built-in defaults - delete "
+				<< kEnvironFileName << " to get the documented file back\n"
+				<< std::flush;
+		}
+	}
+}
+
+void
+	RPL4Environ_Load()
+{
+	//
+	// First run: lay down the documented default. From here on the file
+	// belongs to whoever is sitting at this machine.
+	//
+	FILE *file = fopen(kEnvironFileName, "rb");
+	if (file == NULL)
+	{
+		FILE *out = fopen(kEnvironFileName, "wb");
+		if (out != NULL)
+		{
+			fwrite(kEnvironTemplate, 1, strlen(kEnvironTemplate), out);
+			fclose(out);
+			DEBUG_STREAM << "Environ: wrote default " << kEnvironFileName
+				<< "\n" << std::flush;
+		}
+		else
+		{
+			DEBUG_STREAM << "Environ: could not write " << kEnvironFileName
+				<< " - running on built-in defaults\n" << std::flush;
+		}
+		file = fopen(kEnvironFileName, "rb");
+	}
+	if (file == NULL)
+	{
+		return;
+	}
+
+	fseek(file, 0, SEEK_END);
+	long size = ftell(file);
+	fseek(file, 0, SEEK_SET);
+	if (size <= 0)
+	{
+		fclose(file);
+		return;
+	}
+	char *text = new char[size + 1];
+	size_t read = fread(text, 1, size, file);
+	text[read] = '\0';
+	fclose(file);
+
+	//
+	// One KEY=VALUE per line. Comments, blanks and anything without an
+	// '=' are skipped; everything else goes into the environment, which
+	// is why a line here beats a variable set in the shell.
+	//
+	int applied = 0;
+	char line[1024];
+	const char *cursor = text;
+	while (*cursor != '\0')
+	{
+		int length = 0;
+		while (cursor[length] != '\0' && cursor[length] != '\n' &&
+			length < (int) sizeof(line) - 1)
+		{
+			line[length] = cursor[length];
+			++length;
+		}
+		line[length] = '\0';
+		cursor += length;
+		while (*cursor == '\n' || *cursor == '\r')
+		{
+			++cursor;
+		}
+		for (int i = length - 1; i >= 0; --i)
+		{
+			if (line[i] == '\r' || line[i] == '\n')
+			{
+				line[i] = '\0';
+			}
+		}
+
+		char *setting = line;
+		while (*setting == ' ' || *setting == '\t')
+		{
+			++setting;
+		}
+		if (*setting == '\0' || *setting == '#' || *setting == ';' ||
+			strchr(setting, '=') == NULL)
+		{
+			continue;
+		}
+		putenv(setting);
+		++applied;
+	}
+
+	DEBUG_STREAM << "Environ: " << applied << " setting(s) from "
+		<< kEnvironFileName << "\n" << std::flush;
+
+	ReportUnmentionedKeys(text);
+
+	delete[] text;
+}

RP_L4/RPL4ENVIRON.h

@@ -0,0 +1,44 @@
+//===========================================================================//
+// File:    rpl4environ.h                                                    //
+// Project: MUNGA           Brick: Red Planet LBE Application                //
+// Contents: environ.ini - written on first run, then the player's           //
+//---------------------------------------------------------------------------//
+// Copyright (C) 1994-1995, Virtual World Entertainment, Inc.                //
+//                      PROPRIETARY AND CONFIDENTIAL                         //
+//===========================================================================//
+
+#pragma once
+
+#include "..\munga\style.h"
+
+//########################################################################
+//
+// environ.ini is the game's configuration: one KEY=VALUE per line, read
+// once at startup and pushed into the environment, so every option the
+// engine reads through getenv can be set from a file a player can open.
+//
+// The exe owns the template and writes it when the file is absent, the
+// same way bindings.txt works, rather than the packaging script laying
+// one down on every unzip. That is what lets a tester drop a new build
+// over an old folder and keep their settings: the file is theirs from
+// the moment it exists, and nothing overwrites it.
+//
+// It cannot simply be optional. Without it L4GAUGE is unset, which
+// disables the gauge renderer and takes every MFD with it, and
+// L4MFDSPLIT is unset, which is the packed-window arcade layout rather
+// than the glass cockpit. The shipped values are the desktop game; the
+// built-in getenv fallbacks are the 1995 pod.
+//
+// The cost of a file that is never overwritten is that a tester carrying
+// one across many builds stops being offered new options. Options added
+// later default to "behave as before", so nothing breaks - but it does
+// go unnoticed, so the load names any template key the player's file
+// does not mention. That line in rpl4.log is what turns "the podium does
+// not work" into "your environ.ini predates RP412PODIUM".
+//
+//########################################################################
+
+// Write environ.ini if it is not there, then read it into the
+// environment. Call once, before anything reads a setting.
+void
+	RPL4Environ_Load();

RP_L4/RPL4FE.cpp

@@ -33,6 +33,17 @@ namespace
 		{ "brewers",	"Brewer's Bane" },
 		{ "pain",		"Paingod's Passage" },
 		{ "headoff",	"Freezemoon's Freeway" },
+
+		// Maps that came with the promoted resource file. The console
+		// config brackets their names in dashes, which is how it marks
+		// the ones that are not original arcade tracks.
+		{ "arena",			"-- Arena (Small) --" },
+		{ "demoderb",		"-- Arena (Large) --" },
+		{ "donut",			"-- Donut --" },
+		{ "tourdemars",		"-- Tour De Mars --" },
+		{ "trough",			"-- Ares' Armpits --" },
+		{ "wiserguys",		"-- Wiserguy's --" },
+		{ "rpweekend2014",	"-- Zaxxis --" },
 	};
 
 	// Football excludes pain/headoff and adds the football build of
@@ -110,6 +121,23 @@ namespace
 		{ "spitter",	"Spitter" },
 		{ "puck",		"Armadillo" },
 		{ "dragon",		"Dragon" },
+
+		// Restored with the promoted resource file: cut from the .bld
+		// after 4.10 shipped, back now that RPL4.RES carries them again.
+		// Names from the console's own RPConfig.xml.
+		{ "dark",		"Blacker Puck" },
+		{ "blktrn",		"Black Tarantula" },
+		{ "neut",		"Neutrino" },
+
+		// Community variants that came with the same archive.
+		{ "blkrpuck",	"Blacker Armadillo" },
+		{ "blkrbroc",	"Blacker Broccoli" },
+		{ "blkrdragon",	"Blacker Dragon" },
+		{ "blkrlepton",	"Blacker Lepton" },
+		{ "blkrquark",	"Blacker Quark" },
+		{ "blkrspk",	"Blacker Speck" },
+		{ "blkrtran",	"Blacker Tarantula" },
+		{ "blkrwasp",	"Blacker Wasp" },
 	};
 
 	const CatalogEntry kColors[] =
@@ -214,6 +242,13 @@ namespace
 
 		HWND	menuWindow;
 		HWND	nameEdit;
+
+		// Every list group is a drop-down. They are owner-drawn so they
+		// keep the green-on-black panel look instead of arriving in
+		// system colours, and their labels are painted by PaintMenu.
+		HWND	combo[GroupCount];
+		RECT	comboLabel[GroupCount];
+
 		HFONT	textFont;
 		HFONT	titleFont;
 		HBRUSH	editBrush;
@@ -223,6 +258,9 @@ namespace
 	};
 
 	FEState *gFE = NULL;
+
+	// ItemName() reads this to answer with the right track list.
+	const int *gItemNameSelection = NULL;
 	int gLastMissionSeconds = 0;
 
 	// carried across races so cycling back to the menu keeps the
@@ -231,6 +269,241 @@ namespace
 	Logical	gHavePersist = False;
 	char	gLastPilotName[24] = "Pilot";
 
+	//---------------------------------------------------------------
+	// What the player set last time, in pilot.cfg beside bindings.txt:
+	// the callsign they typed and the loadout they picked.
+	//
+	// The loadout has always survived a race - gPersistSelection below
+	// is why the menu reopens the way you left it - but only for as
+	// long as the process lives. BT411 keeps the same things in
+	// fe_last.ini and had to, since it relaunches between missions;
+	// RP412 stayed in one process and so never needed a file. Closing
+	// the game was still a reset, which is what this fixes.
+	//
+	// KEY=VALUE like environ.ini, one line per group.
+	//---------------------------------------------------------------
+	const char kPilotFileName[] = "pilot.cfg";
+
+	//
+	// Stable file keys, independent of the on-screen headings - those
+	// carry spaces ("TIME OF DAY") and are free to be reworded.
+	//
+	struct GroupKey
+	{
+		int			group;
+		const char	*key;
+	};
+	const GroupKey kGroupKeys[] =
+	{
+		{ GroupScenario, "scenario" }, { GroupMap,      "track"    },
+		{ GroupVehicle,  "vehicle"  }, { GroupColor,    "color"    },
+		{ GroupBadge,    "badge"    }, { GroupTeam,     "team"     },
+		{ GroupPosition, "position" }, { GroupTime,     "time"     },
+		{ GroupWeather,  "weather"  }, { GroupLength,   "length"   },
+	};
+
+	//
+	// How many rows a group offers, so a stale or hand-edited index
+	// cannot select past the end of a list. The track list is the one
+	// that moves - football and the death race carry different maps -
+	// so it answers for whichever scenario is selected.
+	//
+	int GroupSize(int group, const int *selection)
+	{
+		switch (group)
+		{
+		case GroupScenario:	return FE_COUNT(kScenarios);
+		case GroupMap:
+			{
+				int count = 0;
+				ActiveMaps(selection, &count);
+				return count;
+			}
+		case GroupVehicle:	return FE_COUNT(kVehicles);
+		case GroupColor:	return FE_COUNT(kColors);
+		case GroupBadge:	return FE_COUNT(kBadges);
+		case GroupTeam:		return FE_COUNT(kTeams);
+		case GroupPosition:	return FE_COUNT(kPositions);
+		case GroupTime:		return FE_COUNT(kTimes);
+		case GroupWeather:	return FE_COUNT(kWeather);
+		case GroupLength:	return FE_COUNT(kLengths);
+		}
+		return 0;
+	}
+
+	//
+	// A callsign is quoted into frontend.egg, joined into a
+	// comma-separated list for the results screen, and published as
+	// Steam lobby member data. Anything that could end a token early
+	// therefore has to go - a comma alone would split one pilot into
+	// two on the score sheet. Applied to what is typed as well as to
+	// what is read back, so the file cannot hold what the game will
+	// not accept.
+	//
+	void SanitizeCallsign(char *name, int size)
+	{
+		char clean[64];
+		int out = 0;
+		for (int i = 0; name[i] != '\0' && out < (int) sizeof(clean) - 1; ++i)
+		{
+			unsigned char c = (unsigned char) name[i];
+			if (c < 32 || c > 126)		continue;	// controls, high bytes
+			if (c == ',' || c == '"')	continue;	// egg and CSV delimiters
+			if (c == '#' || c == ';')	continue;	// pilot.cfg comment marks
+			clean[out++] = (char) c;
+		}
+		clean[out] = '\0';
+
+		char *start = clean;
+		while (*start == ' ' || *start == '\t')
+		{
+			++start;
+		}
+		int end = (int) strlen(start);
+		while (end > 0 && (start[end - 1] == ' ' || start[end - 1] == '\t'))
+		{
+			start[--end] = '\0';
+		}
+
+		if (start[0] == '\0')
+		{
+			strcpy(start, "Pilot");
+		}
+		strncpy(name, start, size - 1);
+		name[size - 1] = '\0';
+	}
+
+	void SavePilotSettings(const char *name, const int *selection)
+	{
+		FILE *file = fopen(kPilotFileName, "wt");
+		if (file == NULL)
+		{
+			DEBUG_STREAM << "FrontEnd: could not write " << kPilotFileName
+				<< "\n" << std::flush;
+			return;
+		}
+		fputs("# RP412 pilot settings, written by the game on the way out of\n"
+			  "# the setup screen. Delete this file to start over.\n", file);
+		fprintf(file, "callsign=%s\n", name);
+		if (selection != NULL)
+		{
+			for (int i = 0; i < FE_COUNT(kGroupKeys); ++i)
+			{
+				fprintf(file, "%s=%d\n", kGroupKeys[i].key,
+					selection[kGroupKeys[i].group]);
+			}
+		}
+		fclose(file);
+		DEBUG_STREAM << "FrontEnd: saved callsign \"" << name << "\""
+			<< ((selection != NULL) ? " and loadout" : "")
+			<< " to " << kPilotFileName << "\n" << std::flush;
+	}
+
+	//
+	// Read once per run. Absent or unreadable simply leaves the
+	// built-in defaults in place - a missing file is a first run, not
+	// an error, and every value is range-checked so a hand-edited or
+	// out-of-date file cannot select past the end of a list.
+	//
+	void EnsurePilotSettingsLoaded()
+	{
+		static Logical loaded = False;
+		if (loaded)
+		{
+			return;
+		}
+		loaded = True;
+
+		FILE *file = fopen(kPilotFileName, "rt");
+		if (file == NULL)
+		{
+			return;
+		}
+
+		int selection[GroupCount];
+		memset(selection, 0, sizeof(selection));
+		selection[GroupLength] = 2;			// 5:00, as the menu defaults
+		Logical have_loadout = False;
+
+		char line[256];
+		while (fgets(line, sizeof(line), file) != NULL)
+		{
+			char *cursor = line;
+			while (*cursor == ' ' || *cursor == '\t')
+			{
+				++cursor;
+			}
+			if (*cursor == '#' || *cursor == ';')
+			{
+				continue;
+			}
+			char *equals = strchr(cursor, '=');
+			if (equals == NULL)
+			{
+				continue;
+			}
+			*equals = '\0';
+			char *key = cursor;
+			char *value = equals + 1;
+			while (*value == ' ' || *value == '\t')
+			{
+				++value;
+			}
+			char *newline = strpbrk(value, "\r\n");
+			if (newline != NULL)
+			{
+				*newline = '\0';
+			}
+
+			if (_stricmp(key, "callsign") == 0)
+			{
+				char candidate[24];
+				strncpy(candidate, value, sizeof(candidate) - 1);
+				candidate[sizeof(candidate) - 1] = '\0';
+				SanitizeCallsign(candidate, sizeof(candidate));
+				strcpy(gLastPilotName, candidate);
+				continue;
+			}
+			for (int i = 0; i < FE_COUNT(kGroupKeys); ++i)
+			{
+				if (_stricmp(key, kGroupKeys[i].key) != 0)
+				{
+					continue;
+				}
+				int index = atoi(value);
+				if (index >= 0 && index < GroupSize(kGroupKeys[i].group, selection))
+				{
+					selection[kGroupKeys[i].group] = index;
+					have_loadout = True;
+				}
+				break;
+			}
+		}
+		fclose(file);
+
+		//
+		// The track list belongs to the scenario, and the file is read in
+		// whatever order it was written, so re-check the track once the
+		// scenario is settled - the same clamp the menu applies when the
+		// scenario is switched by hand.
+		//
+		if (have_loadout)
+		{
+			int map_count = 0;
+			ActiveMaps(selection, &map_count);
+			if (selection[GroupMap] >= map_count)
+			{
+				selection[GroupMap] = 0;
+			}
+			memcpy(gPersistSelection, selection, sizeof(gPersistSelection));
+			gHavePersist = True;
+		}
+
+		DEBUG_STREAM << "FrontEnd: callsign \"" << gLastPilotName << "\""
+			<< (have_loadout ? " and loadout" : "")
+			<< " from " << kPilotFileName << "\n" << std::flush;
+	}
+
 	// [pilots]-order names of the last launched race (owner first),
 	// comma separated - the network console labels results with them
 	char	gLastPilotNamesCsv[256] = "";
@@ -349,69 +622,207 @@ namespace
 	//---------------------------------------------------------------
 	// Layout: three columns of lists + the launch button
 	//---------------------------------------------------------------
-	void AddGroupItems(
+
-		FEState *fe, int group, int count,
+	//---------------------------------------------------------------
-		int x, int *y, int row_h, int width)
+	// The groups that became drop-downs, in the order they are laid
+	// out. Scenario is deliberately NOT one of them: it decides what
+	// the others contain, so it stays visible as a pair of buttons.
+	//---------------------------------------------------------------
+	int ComboGroups(const int *selection, int *groups)
 	{
-		for (int i = 0; i < count; ++i)
+		int n = 0;
+		groups[n++] = GroupMap;
+		groups[n++] = GroupTime;
+		groups[n++] = GroupWeather;
+		groups[n++] = GroupLength;
+		groups[n++] = GroupVehicle;
+		if (IsFootball(selection))
 		{
-			FEItem *item = &fe->items[fe->itemCount++];
+			groups[n++] = GroupTeam;
-			item->group = group;
+			groups[n++] = GroupPosition;
-			item->index = i;
-			item->rect.left = x;
-			item->rect.top = *y;
-			item->rect.right = x + width;
-			item->rect.bottom = *y + row_h;
-			*y += row_h;
 		}
-		*y += row_h;		// gap below the group
+		else
+		{
+			groups[n++] = GroupColor;
+			groups[n++] = GroupBadge;
+		}
+		return n;
 	}
 
+	// The combo id is its group, so CBN_SELCHANGE says which list moved.
+	const int kComboIdBase = 100;
+
+	//---------------------------------------------------------------
+	// CBS_OWNERDRAWFIXED only hands us the item area: the frame around
+	// the closed box and its drop arrow are still drawn by the system,
+	// which lands a white/grey Windows control in the middle of a black
+	// panel. So the closed box is painted here instead - black field,
+	// dim green border, bright green text and arrow - and the control
+	// keeps doing everything else, including the list it drops.
+	//---------------------------------------------------------------
+	WNDPROC gComboProc = NULL;
+
+	LRESULT CALLBACK ComboSubclassProc(
+		HWND hwnd, UINT message, WPARAM wParam, LPARAM lParam)
+	{
+		if (message == WM_ERASEBKGND)
+		{
+			return 1;
+		}
+		if (message == WM_PAINT)
+		{
+			PAINTSTRUCT ps;
+			HDC dc = BeginPaint(hwnd, &ps);
+
+			RECT rc;
+			GetClientRect(hwnd, &rc);
+
+			HBRUSH field = CreateSolidBrush(kBlack);
+			FillRect(dc, &rc, field);
+			DeleteObject(field);
+
+			HBRUSH edge = CreateSolidBrush(kGreenDim);
+			FrameRect(dc, &rc, edge);
+			DeleteObject(edge);
+
+			int arrow_w = rc.bottom - rc.top;
+
+			char text[128];
+			text[0] = '\0';
+			int sel = (int) SendMessageA(hwnd, CB_GETCURSEL, 0, 0);
+			if (sel >= 0)
+			{
+				SendMessageA(hwnd, CB_GETLBTEXT, sel, (LPARAM) text);
+			}
+
+			HFONT font = (HFONT) SendMessageA(hwnd, WM_GETFONT, 0, 0);
+			HGDIOBJ old_font = (font != NULL) ? SelectObject(dc, font) : NULL;
+			SetBkMode(dc, TRANSPARENT);
+			SetTextColor(dc, kGreenBright);
+
+			RECT label = rc;
+			label.left += 6;
+			label.right -= arrow_w;
+			DrawTextA(dc, text, -1, &label,
+				DT_LEFT | DT_VCENTER | DT_SINGLELINE | DT_END_ELLIPSIS);
+
+			// the arrow, a plain triangle rather than a themed button
+			int cx = rc.right - arrow_w / 2;
+			int cy = (rc.top + rc.bottom) / 2;
+			int r = arrow_w / 6;
+			POINT tri[3];
+			tri[0].x = cx - r;		tri[0].y = cy - r / 2;
+			tri[1].x = cx + r;		tri[1].y = cy - r / 2;
+			tri[2].x = cx;			tri[2].y = cy + r;
+			HBRUSH tip = CreateSolidBrush(kGreenBright);
+			HGDIOBJ old_brush = SelectObject(dc, tip);
+			HGDIOBJ old_pen = SelectObject(dc, GetStockObject(NULL_PEN));
+			Polygon(dc, tri, 3);
+			SelectObject(dc, old_pen);
+			SelectObject(dc, old_brush);
+			DeleteObject(tip);
+
+			if (old_font != NULL)	SelectObject(dc, old_font);
+			EndPaint(hwnd, &ps);
+			return 0;
+		}
+		return CallWindowProcA(gComboProc, hwnd, message, wParam, lParam);
+	}
+
+	void DestroyCombos(FEState *fe)
+	{
+		for (int g = 0; g < GroupCount; ++g)
+		{
+			if (fe->combo[g] != NULL)
+			{
+				DestroyWindow(fe->combo[g]);
+				fe->combo[g] = NULL;
+			}
+		}
+	}
+
+	// defined below, next to the catalogs it reads
+	const char *ItemName(int group, int index);
+
 	void LayoutMenu(FEState *fe, int client_w, int client_h)
 	{
 		fe->itemCount = 0;
+		gItemNameSelection = fe->selection;
 
 		int row_h = client_h / 36;
 		if (row_h < 18)	row_h = 18;
 		if (row_h > 30)	row_h = 30;
 
-		int col_w = client_w / 5;
-		int col1 = client_w / 14;
-		int col2 = col1 + col_w + client_w / 28;
-		int col3 = col2 + col_w + client_w / 28;
 		int top = client_h / 7;
 
+		//---------------------------------------------------------------
+		// Every list is a drop-down, so the menu no longer grows with the
+		// content: eight controls instead of ninety-odd rows. Two columns
+		// of label-over-box, settings on the left and loadout on the right,
+		// with the scenario left as visible buttons because it decides what
+		// the other lists contain.
+		//---------------------------------------------------------------
+		int margin = client_w / 14;
+		int gap = client_w / 20;
+		int col_w = (client_w - 2 * margin - gap) / 2;
+		if (col_w < 1)	col_w = 1;
+		int col2 = margin + col_w + gap;
+
+		int block_h = row_h * 5 / 2;		// label, box, breathing room
+
+		// scenario: buttons, top of the left column
 		int y = top;
-		AddGroupItems(fe, GroupScenario, FE_COUNT(kScenarios), col1, &y, row_h, col_w);
+		fe->comboLabel[GroupScenario].left = margin;
-		int map_count;
+		fe->comboLabel[GroupScenario].right = margin + col_w;
-		ActiveMaps(fe->selection, &map_count);
+		fe->comboLabel[GroupScenario].top = y;
-		AddGroupItems(fe, GroupMap, map_count, col1, &y, row_h, col_w);
+		fe->comboLabel[GroupScenario].bottom = y + row_h;
-		AddGroupItems(fe, GroupTime, FE_COUNT(kTimes), col1, &y, row_h, col_w);
+		y += row_h;
-		AddGroupItems(fe, GroupWeather, FE_COUNT(kWeather), col1, &y, row_h, col_w);
+		for (int i = 0; i < FE_COUNT(kScenarios); ++i)
-		AddGroupItems(fe, GroupLength, FE_COUNT(kLengths), col1, &y, row_h, col_w);
-
-		y = top;
-		AddGroupItems(fe, GroupVehicle, FE_COUNT(kVehicles), col2, &y, row_h, col_w);
-
-		y = top + 2 * row_h;	// leave room for the name edit + header
-		if (IsFootball(fe->selection))
 		{
-			AddGroupItems(fe, GroupTeam, FE_COUNT(kTeams), col3, &y, row_h, col_w);
+			FEItem *item = &fe->items[fe->itemCount++];
-			AddGroupItems(fe, GroupPosition, FE_COUNT(kPositions), col3, &y, row_h, col_w);
+			item->group = GroupScenario;
+			item->index = i;
+			item->rect.left = margin + i * (col_w / 2);
+			item->rect.top = y;
+			item->rect.right = item->rect.left + col_w / 2 - row_h / 3;
+			item->rect.bottom = y + row_h;
 		}
-		else
+		y += row_h + row_h / 2;
+
+		int groups[GroupCount];
+		int group_count = ComboGroups(fe->selection, groups);
+
+		// left column takes the mission settings, right the loadout; the
+		// split is where the vehicle list starts. The pilot name heads
+		// the loadout column - it is who you are, so it reads before
+		// what you are driving.
+		int left_y = y;
+		int right_y = top;
+		int name_y = right_y;
+		right_y += block_h;
+		for (int g = 0; g < group_count; ++g)
 		{
-			AddGroupItems(fe, GroupColor, FE_COUNT(kColors), col3, &y, row_h, col_w);
+			int group = groups[g];
-			AddGroupItems(fe, GroupBadge, FE_COUNT(kBadges), col3, &y, row_h, col_w);
+			Logical left = (group == GroupMap || group == GroupTime ||
+				group == GroupWeather || group == GroupLength);
+			int x = left ? margin : col2;
+			int *slot = left ? &left_y : &right_y;
+
+			fe->comboLabel[group].left = x;
+			fe->comboLabel[group].right = x + col_w;
+			fe->comboLabel[group].top = *slot;
+			fe->comboLabel[group].bottom = *slot + row_h;
+			*slot += block_h;
 		}
 
+
 		// launch button
 		FEItem *launch = &fe->items[fe->itemCount++];
 		launch->group = GroupLaunch;
 		launch->index = 0;
-		launch->rect.left = col3;
+		launch->rect.left = col2;
 		launch->rect.top = client_h - 3 * row_h;
-		launch->rect.right = col3 + col_w;
+		launch->rect.right = col2 + col_w;
 		launch->rect.bottom = client_h - row_h;
 
 		// Steam lobby buttons, offered whenever environ.ini asked for Steam.
@@ -421,17 +832,17 @@ namespace
 			FEItem *host = &fe->items[fe->itemCount++];
 			host->group = GroupSteamHost;
 			host->index = 0;
-			host->rect.left = col3;
+			host->rect.left = col2;
 			host->rect.top = client_h - 6 * row_h;
-			host->rect.right = col3 + col_w;
+			host->rect.right = col2 + col_w;
 			host->rect.bottom = client_h - 5 * row_h;
 
 			FEItem *join = &fe->items[fe->itemCount++];
 			join->group = GroupSteamJoin;
 			join->index = 0;
-			join->rect.left = col3;
+			join->rect.left = col2;
 			join->rect.top = client_h - (9 * row_h) / 2;
-			join->rect.right = col3 + col_w;
+			join->rect.right = col2 + col_w;
 			join->rect.bottom = client_h - (7 * row_h) / 2;
 		}
 
@@ -447,16 +858,67 @@ namespace
 		FEItem *quit = &fe->items[fe->itemCount++];
 		quit->group = GroupExit;
 		quit->index = 0;
-		quit->rect.left = col1;
+		quit->rect.left = margin;
 		quit->rect.top = client_h - 2 * row_h;
-		quit->rect.right = col1 + col_w / 2;
+		quit->rect.right = margin + col_w / 2;
 		quit->rect.bottom = client_h - row_h;
 
-		// pilot name edit sits at the top of column 3
+		// pilot name, under the loadout column
+		fe->comboLabel[GroupLaunch].left = col2;		// reused: name label
+		fe->comboLabel[GroupLaunch].right = col2 + col_w;
+		fe->comboLabel[GroupLaunch].top = name_y;
+		fe->comboLabel[GroupLaunch].bottom = name_y + row_h;
 		if (fe->nameEdit != NULL)
 		{
-			MoveWindow(fe->nameEdit,
+			MoveWindow(fe->nameEdit, col2, name_y + row_h, col_w, row_h, TRUE);
-				col3, top - row_h / 4, col_w, row_h, TRUE);
+		}
+
+		//---------------------------------------------------------------
+		// The drop-downs themselves. Rebuilt rather than moved, because
+		// the scenario swaps two of them outright (team/position for
+		// colour/badge) and reshuffles the track list.
+		//---------------------------------------------------------------
+		DestroyCombos(fe);
+		for (int g = 0; g < group_count; ++g)
+		{
+			int group = groups[g];
+			const RECT &label = fe->comboLabel[group];
+			int count = GroupSize(group, fe->selection);
+
+			// The height given at creation is the DROPPED height - what the
+			// closed box shows is the item height - so ask for enough to
+			// show a dozen rows without a scrollbar where the list is short.
+			int drop_rows = (count < 12) ? count : 12;
+			HWND box = CreateWindowExA(
+				0, "COMBOBOX", "",
+				WS_CHILD | WS_VISIBLE | WS_VSCROLL |
+				CBS_DROPDOWNLIST | CBS_OWNERDRAWFIXED | CBS_HASSTRINGS,
+				label.left, label.top + row_h,
+				label.right - label.left, row_h + drop_rows * row_h,
+				fe->menuWindow, (HMENU)(INT_PTR)(kComboIdBase + group),
+				(HINSTANCE) GetWindowLongPtr(fe->menuWindow, GWLP_HINSTANCE), NULL);
+			if (box == NULL)
+			{
+				continue;
+			}
+			SendMessageA(box, WM_SETFONT, (WPARAM) fe->textFont, TRUE);
+			SendMessageA(box, CB_SETITEMHEIGHT, (WPARAM) -1, row_h);
+			SendMessageA(box, CB_SETITEMHEIGHT, 0, row_h);
+
+			// paint the closed box ourselves - see ComboSubclassProc
+			WNDPROC previous = (WNDPROC) SetWindowLongPtrA(
+				box, GWLP_WNDPROC, (LONG_PTR) ComboSubclassProc);
+			if (gComboProc == NULL)
+			{
+				gComboProc = previous;
+			}
+			for (int i = 0; i < count; ++i)
+			{
+				SendMessageA(box, CB_ADDSTRING, 0, (LPARAM) ItemName(group, i));
+			}
+			if (fe->selection[group] >= count)	fe->selection[group] = 0;
+			SendMessageA(box, CB_SETCURSEL, fe->selection[group], 0);
+			fe->combo[group] = box;
 		}
 	}
 
@@ -479,7 +941,6 @@ namespace
 	}
 
 	// the map rows need the active scenario's list
-	const int *gItemNameSelection = NULL;
 
 	const char *ItemName(int group, int index)
 	{
@@ -541,21 +1002,31 @@ namespace
 
 		SelectObject(mem, fe->textFont);
 
-		// group headers (drawn above each group's first item)
+		// Labels: one above each drop-down, one above the scenario
-		int previous_group = -1;
+		// buttons, one above the pilot name box. The drop-downs draw
+		// themselves (WM_DRAWITEM), so all that is left here is their
+		// captions.
+		SetTextColor(mem, kGreenBright);
+		for (int g = 0; g < GroupCount; ++g)
+		{
+			Logical labelled = (g == GroupScenario) || (fe->combo[g] != NULL);
+			if (!labelled && g != GroupLaunch)
+			{
+				continue;
+			}
+			RECT label = fe->comboLabel[g];
+			if (label.right <= label.left)
+			{
+				continue;
+			}
+			const char *caption = (g == GroupLaunch) ? "PILOT NAME" : GroupTitle(g);
+			DrawTextA(mem, caption, -1, &label,
+				DT_LEFT | DT_VCENTER | DT_SINGLELINE);
+		}
+
 		for (int i = 0; i < fe->itemCount; ++i)
 		{
 			const FEItem *item = &fe->items[i];
-			if (item->group != previous_group && item->group < GroupLaunch)
-			{
-				previous_group = item->group;
-				RECT header = item->rect;
-				header.top -= (item->rect.bottom - item->rect.top);
-				header.bottom = item->rect.top;
-				SetTextColor(mem, kGreenBright);
-				DrawTextA(mem, GroupTitle(item->group), -1, &header,
-					DT_LEFT | DT_VCENTER | DT_SINGLELINE);
-			}
 
 			Logical selected =
 				(item->group >= GroupLaunch) ||
@@ -613,26 +1084,14 @@ namespace
 			}
 			RECT text = row;
 			text.left += 6;
+			// On a narrow window the longest names (Screaming Broccoli,
+			// Blacker Tarantula) outrun their column. Ellipsis rather than
+			// a glyph sliced down the middle.
 			DrawTextA(mem, ItemName(item->group, item->index), -1, &text,
-				DT_LEFT | DT_VCENTER | DT_SINGLELINE);
+				DT_LEFT | DT_VCENTER | DT_SINGLELINE | DT_END_ELLIPSIS);
 		}
 
-		// pilot-name header
+		// (the pilot-name caption is drawn with the other labels above)
-		if (fe->nameEdit != NULL)
-		{
-			RECT edit_rect;
-			GetWindowRect(fe->nameEdit, &edit_rect);
-			POINT corner = { edit_rect.left, edit_rect.top };
-			ScreenToClient(fe->menuWindow, &corner);
-			RECT header;
-			header.left = corner.x;
-			header.right = corner.x + 300;
-			header.bottom = corner.y;
-			header.top = corner.y - 26;
-			SetTextColor(mem, kGreenBright);
-			DrawTextA(mem, "PILOT NAME", -1, &header,
-				DT_LEFT | DT_VCENTER | DT_SINGLELINE);
-		}
 
 		BitBlt(hdc, 0, 0, client.right, client.bottom, mem, 0, 0, SRCCOPY);
 
@@ -719,6 +1178,65 @@ namespace
 			}
 			break;
 
+		case WM_COMMAND:
+			if (fe != NULL && HIWORD(wParam) == CBN_SELCHANGE)
+			{
+				int group = LOWORD(wParam) - kComboIdBase;
+				if (group >= 0 && group < GroupCount && fe->combo[group] != NULL)
+				{
+					int pick = (int) SendMessageA(fe->combo[group], CB_GETCURSEL, 0, 0);
+					if (pick >= 0)
+					{
+						fe->selection[group] = pick;
+					}
+					// the closed box is ours to redraw now
+					InvalidateRect(fe->combo[group], NULL, FALSE);
+					InvalidateRect(fe->menuWindow, NULL, FALSE);
+					return 0;
+				}
+			}
+			break;
+
+		//
+		// The drop-downs are owner-drawn so they read as part of the
+		// panel rather than as system widgets: green on black, and the
+		// highlight inverted rather than tinted.
+		//
+		case WM_DRAWITEM:
+			if (fe != NULL)
+			{
+				DRAWITEMSTRUCT *di = (DRAWITEMSTRUCT *) lParam;
+				if (di->CtlType == ODT_COMBOBOX && (int) di->itemID >= 0)
+				{
+					Logical hot =
+						((di->itemState & (ODS_SELECTED | ODS_COMBOBOXEDIT)) == ODS_SELECTED);
+					HBRUSH back = CreateSolidBrush(hot ? kGreenDim : kBlack);
+					FillRect(di->hDC, &di->rcItem, back);
+					DeleteObject(back);
+
+					char text[128];
+					text[0] = '\0';
+					SendMessageA(di->hwndItem, CB_GETLBTEXT, di->itemID, (LPARAM) text);
+					RECT label = di->rcItem;
+					label.left += 6;
+					SetBkMode(di->hDC, TRANSPARENT);
+					SetTextColor(di->hDC, hot ? kBlack : kGreenBright);
+					DrawTextA(di->hDC, text, -1, &label,
+						DT_LEFT | DT_VCENTER | DT_SINGLELINE | DT_END_ELLIPSIS);
+					return TRUE;
+				}
+			}
+			break;
+
+		case WM_CTLCOLORLISTBOX:
+			if (fe != NULL)
+			{
+				SetTextColor((HDC) wParam, kGreenBright);
+				SetBkColor((HDC) wParam, kBlack);
+				return (LRESULT) fe->editBrush;
+			}
+			break;
+
 		case WM_CTLCOLOREDIT:
 			if (fe != NULL)
 			{
@@ -1219,6 +1737,10 @@ Logical
 {
 	gLastLaunchMode = FELaunchSingle;
 
+	// before the lobby branch below: a member rejoining a room publishes
+	// the callsign as member data without the menu ever opening
+	EnsurePilotSettingsLoaded();
+
 	//---------------------------------------------------------------
 	// Coming back from a race while still in a lobby: straight to
 	// the room (the lobby outlives races - single binary payoff)
@@ -1244,10 +1766,19 @@ Logical
 		// LobbyRoomLeft: fall through to the setup menu
 	}
 
+	// NOTE: the vehicle catalog below is hand-written while RPL4.RES is
+	// built elsewhere, so the two can drift - this menu offered 'blkspk'
+	// for a while before any vehicle resource backed it. Validating here
+	// does NOT work: the front end runs before the resource file is
+	// opened, so GetResourceFile() has nothing to search yet. If this is
+	// worth guarding, do it offline against the built RPL4.RES (see
+	// tools/resbuild) rather than at menu time.
+
 	for (;;)
 	{
 		FEState fe;
 		memset(&fe, 0, sizeof(fe));
+		EnsurePilotSettingsLoaded();
 		strcpy(fe.pilotName, gLastPilotName);
 		if (gHavePersist)
 		{
@@ -1346,20 +1877,41 @@ Logical
 		}
 
 		//---------------------------------------------------------------
-		// Harvest the loadout whichever way we leave the menu - the
+		// Harvest the callsign whichever way we leave the menu, INCLUDING
-		// lobby publishes it as member data, launches build from it
+		// a close: typing a name and then quitting is how somebody sets it
+		// for next time, and losing it there would be the one case that
+		// makes the whole thing feel unreliable. The loadout still only
+		// persists on a real exit - it is picked, not typed, and the menu
+		// reopens with it visible anyway.
 		//---------------------------------------------------------------
-		if (!fe.closed)
+		if (fe.nameEdit != NULL)
 		{
+			fe.pilotName[0] = '\0';
 			GetWindowTextA(fe.nameEdit, fe.pilotName, sizeof(fe.pilotName) - 1);
-			if (fe.pilotName[0] == '\0')
+			SanitizeCallsign(fe.pilotName, sizeof(fe.pilotName));
-			{
-				strcpy(fe.pilotName, "Pilot");
-			}
-			strcpy(gLastPilotName, fe.pilotName);
-			memcpy(gPersistSelection, fe.selection, sizeof(gPersistSelection));
-			gHavePersist = True;
 		}
+		else
+		{
+			strcpy(fe.pilotName, gLastPilotName);
+		}
+
+		strcpy(gLastPilotName, fe.pilotName);
+		memcpy(gPersistSelection, fe.selection, sizeof(gPersistSelection));
+		gHavePersist = True;
+
+		//
+		// Written on the way out however the player leaves - launching,
+		// stepping into a lobby, or quitting. BT411 saves only on a
+		// launch, which loses a callsign typed by somebody who then
+		// changed their mind, and that is the one moment this feature
+		// exists for.
+		//
+		// Unconditionally, rather than only when something changed: the
+		// file is a few hundred bytes, and writing it every time means a
+		// value that was hand-edited out of range comes back corrected
+		// instead of being quietly re-rejected on every launch forever.
+		//
+		SavePilotSettings(gLastPilotName, gPersistSelection);
 
 		Logical launched = fe.launched;
 		Logical closed = fe.closed;
@@ -1825,6 +2377,10 @@ Logical
 		return False;
 	}
 
+	// this screen labels a row with the pilot's own callsign, and in the
+	// -egg and lobby paths it can be the first screen of the session
+	EnsurePilotSettingsLoaded();
+
 	ResultsState rs;
 	memset(&rs, 0, sizeof(rs));
 

RP_L4/RPL4MPPR.cpp

@@ -725,6 +725,13 @@ void
 			mode_manager->AddModeMask(previousPresetModeMask);
 		}
 		//-----------------------------------
+		// Move the lamps with the mappings.
+		// Doing it here rather than in the
+		// switch handler keeps the keyboard
+		// presets (1-6) in step as well.
+		//-----------------------------------
+		NotifyOfPresetChange(previousPresetNumber, preset_number);
+		//-----------------------------------
 		// Save the new preset number
 		//-----------------------------------
 		previousPresetNumber = preset_number;
@@ -733,6 +740,19 @@ void
 	Check_Fpu();
 }
 
+//~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+//
+void
+	L4VTVControlsMapper::NotifyOfPresetChange(
+		int /*old_preset*/,
+		int /*new_preset*/
+	)
+{
+	Check(this);
+	// The base mapper has no preset lamps to move.
+	Check_Fpu();
+}
+
 //#############################################################################
 //########################### ThrustmasterMapper ##############################
 //#############################################################################
@@ -1400,45 +1420,13 @@ void
 	if (message->dataContents > 0)
 	{
 		//-----------------------------------
-		// Choose a new preset
+		// Choose a new preset. PresetEnable
+		// ignores a repeat of the lit switch
+		// and moves the lamps itself.
 		//-----------------------------------
-		int
+		PresetEnable(
-			current_preset_number = (message->dataContents - 1)
+			(message->dataContents - 1) - LBE4ControlsManager::ButtonSecondary7
-				- LBE4ControlsManager::ButtonSecondary7;
+		);
-
-		if (previousPresetNumber != current_preset_number)
-		{
-			//-----------------------------------
-			// Set the old preset lamp to 'dim'
-			//-----------------------------------
-			if (previousPresetNumber >= 0)
-			{
-				Verify(previousPresetNumber < presetCount);
-
-				if (modeLamp[previousPresetNumber] != NULL)
-				{
-					Check(modeLamp[previousPresetNumber]);
-					modeLamp[previousPresetNumber]->SetState(L4Lamp::LampStateDim);
-				}
-			}
-			//-----------------------------------
-			// Set the new preset lamp to 'on'
-			//-----------------------------------
-			if (current_preset_number >= 0)
-			{
-				Verify(current_preset_number < presetCount);
-
-				if (modeLamp[current_preset_number] != NULL)
-				{
-					Check(modeLamp[current_preset_number]);
-					modeLamp[current_preset_number]->SetState(L4Lamp::LampStateOn);
-				}
-			}
-			//-----------------------------------
-			// Change presets
-			//-----------------------------------
-			PresetEnable(current_preset_number);
-		}
 	}
 	Check_Fpu();
 }
@@ -1655,6 +1643,44 @@ void
 	Check_Fpu();
 }
 
+//~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+// The six amber switches down the map's right flank. Called by PresetEnable,
+// so the lamps follow the mappings no matter what asked for the change.
+//
+void
+	VTVRIOMapper::NotifyOfPresetChange(int old_preset, int new_preset)
+{
+	Check(this);
+
+	//----------------------------------
+	// Set the old preset lamp to 'dim'
+	//----------------------------------
+	if (old_preset >= 0)
+	{
+		Verify(old_preset < presetCount);
+
+		if (presetLamp[old_preset] != NULL)
+		{
+			Check(presetLamp[old_preset]);
+			presetLamp[old_preset]->SetState(L4Lamp::LampStateDim);
+		}
+	}
+	//----------------------------------
+	// Set the new preset lamp to 'on'
+	//----------------------------------
+	if (new_preset >= 0)
+	{
+		Verify(new_preset < presetCount);
+
+		if (presetLamp[new_preset] != NULL)
+		{
+			Check(presetLamp[new_preset]);
+			presetLamp[new_preset]->SetState(L4Lamp::LampStateOn);
+		}
+	}
+	Check_Fpu();
+}
+
 //#############################################################################
 // Construction and Destruction Support
 //
@@ -1680,6 +1706,20 @@ VTVRIOMapper::VTVRIOMapper(
 	leftPedal = 0.0f;
 	rightPedal = 0.0f;
 
+	//------------------------------------------------
+	// There are no lamps until the mapping blocks
+	// below make them - and under NOMODES they never
+	// do, so the notify methods must see NULLs.
+	//------------------------------------------------
+	{
+		int
+			i;
+
+		for(i=0; i<configLampCount; ++i)	configLamp[i] = NULL;
+		for(i=0; i<modeLampCount; ++i)		modeLamp[i] = NULL;
+		for(i=0; i<presetCount; ++i)			presetLamp[i] = NULL;
+	}
+
 	Check(application);
 	LBE4ControlsManager
 		*controls =	Cast_Object(
@@ -1915,13 +1955,14 @@ VTVRIOMapper::VTVRIOMapper(
 				this
 			);
 
-			// These lamps are explicitly controlled by SelectPresetMessageHandler
+			// These lamps are explicitly controlled by NotifyOfPresetChange.
-			modeLamp[i] = CreateControlledLamp(button_number[i]);
+			// They are six, and they are NOT the four mode lamps above.
+			presetLamp[i] = CreateControlledLamp(button_number[i]);
 
-			if (modeLamp[i] != NULL)
+			if (presetLamp[i] != NULL)
 			{
-				Check(modeLamp[i]);
+				Check(presetLamp[i]);
-				modeLamp[i]->SetState(
+				presetLamp[i]->SetState(
 					(i==0)? L4Lamp::LampStateOn : L4Lamp::LampStateDim
 				);
 			}

RP_L4/RPL4MPPR.h

@@ -104,6 +104,12 @@ ModeMask
 //
 void
 	PresetEnable(int preset_number);
+
+// Announced by PresetEnable for EVERY preset change, whichever way it was
+// triggered - map-flank switch or keyboard. Platforms carrying preset
+// lamps move them here; the base mapper has none.
+virtual void
+	NotifyOfPresetChange(int old_preset, int new_preset);
 //~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 // Protected data
 //
@@ -250,6 +256,9 @@ public:
 	void
 		NotifyOfConfigurationModeChange(Logical new_state);
 
+	void
+		NotifyOfPresetChange(int old_preset, int new_preset);
+
 	void
 		SetPerformance(Performance performance)
 			{

RP_L4/RPL4PB.cpp

@@ -357,8 +357,20 @@ Logical
 	//
 	if (GetApplicationState() == RunningMission)
 	{
-		secondsRemainingInGame =
+		// same rule as Application::ExecuteForeground - the console's
-			currentMission->GetGameLength() - (Now() - gameStarted);
+		// countdown when there is one, our own reckoning otherwise. There
+		// is no console in mission review, so this takes the fallback.
+		Scalar console_remaining;
+		if (gMissionClockHook != NULL &&
+			(*gMissionClockHook)(&console_remaining))
+		{
+			secondsRemainingInGame = console_remaining;
+		}
+		else
+		{
+			secondsRemainingInGame =
+				currentMission->GetGameLength() - (Now() - gameStarted);
+		}
 	}
 
 	CLEAR_FOREGROUND_PROCESSING();

RP_L4/RP_L4.vcxproj

@@ -70,6 +70,15 @@
       <RandomizedBaseAddress>false</RandomizedBaseAddress>
       <GenerateDebugInformation>true</GenerateDebugInformation>
     </Link>
+    <!-- rpl4build.h is generated, not committed: the patch number is the
+         repository's commit count, so a hardcoded one would be stale the
+         moment it was committed. The script rewrites the header only when
+         the stamp actually changes, so this does not drag RPL4.CPP through
+         a recompile on every build. -->
+    <PreBuildEvent>
+      <Command>powershell -NoProfile -ExecutionPolicy Bypass -File "$(ProjectDir)..\stamp-version.ps1"</Command>
+      <Message>Stamping the build version from git</Message>
+    </PreBuildEvent>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)'=='Debug'">
     <ClCompile>
@@ -109,6 +118,7 @@
     <ClCompile Include=".\RPL4APP.cpp" />
     <ClCompile Include=".\RPL4CONSOLE.cpp" />
     <ClCompile Include=".\RPL4FE.cpp" />
+    <ClCompile Include=".\RPL4ENVIRON.cpp" />
     <ClCompile Include=".\RPL4LOBBY.cpp" />
     <ClCompile Include=".\RPL4ARND.cpp" />
     <ClCompile Include=".\RPL4GAUG.cpp" />
@@ -147,6 +157,7 @@
     <ClInclude Include=".\RPL4APP.h" />
     <ClInclude Include=".\RPL4CONSOLE.h" />
     <ClInclude Include=".\RPL4FE.h" />
+    <ClInclude Include=".\rpl4environ.h" />
     <ClInclude Include=".\RPL4LOBBY.h" />
     <ClInclude Include=".\RPL4ARND.h" />
     <ClInclude Include=".\RPL4GAUG.h" />