build-ipa.yml

name: Build Madeira IPA (unsigned)

on:
  workflow_dispatch:
  # Paused while builds run on the owner's Mac (2026-10-13). To build on push
  # to main again, uncomment the three lines below.
  # push:
  #   branches: [main]
  #   paths: [".github/workflows/build-ipa.yml"]

# A push and a manual dispatch seconds apart used to start two parallel
# multi-hour macOS jobs on the same commit.
concurrency:
  group: build-ipa
  cancel-in-progress: true

jobs:
  build:
    # madeira-bcd: runs only in the owner's repository; a fork's run is skipped.
    if: github.repository == 'thebcd69/madeira-bcd'
    runs-on: macos-15
    # contents: write only so the token can see DRAFT releases, which is where
    # the Metal Shader Converter installer is kept (drafts are not public).
    # Nothing in this job creates, edits or pushes anything.
    permissions:
      contents: write
      actions: read
    timeout-minutes: 360
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      # ContentView.swift uses glassEffect(.regular, in:), which needs the
      # iOS 26 SDK. The runner defaults to Xcode 16.4 (iOS 18.5), so pick the
      # newest Xcode installed rather than whatever xcode-select points at.
      - name: Select newest Xcode
        shell: bash
        run: |
          echo "-- installed Xcodes --"
          ls -d /Applications/Xcode*.app 2>/dev/null || echo "(none beyond the default)"
          NEWEST=$(ls -d /Applications/Xcode*.app 2>/dev/null | sort -V | tail -1)
          if [ -n "$NEWEST" ]; then
            sudo xcode-select -s "$NEWEST/Contents/Developer"
            echo "::notice::selected $NEWEST"
          fi

      # madeira-bcd FORK-ONLY: one build-number sequence across GitHub Actions
      # and the owner's Mac (owner's decision 2026-10-13). This build's number is
      # in docs/local-build/BUILD-NUMBER: the Mac's run.sh, or a cloud session
      # before it dispatches this workflow, commits it as "Build N (...)".
      # GitHub's own run_number does not follow that sequence, so nothing below
      # uses it.
      - name: Build number
        id: bn
        shell: bash
        run: |
          n=$(grep -v '^#' docs/local-build/BUILD-NUMBER | tr -d '[:space:]')
          case "$n" in
            ''|*[!0-9]*) echo "::error::docs/local-build/BUILD-NUMBER holds no build number"; exit 1 ;;
          esac
          echo "n=$n" >> "$GITHUB_OUTPUT"
          echo "::notice::build $n (GitHub run #${{ github.run_number }})"

      - name: Toolchain versions
        run: |
          xcodebuild -version
          xcrun --sdk iphoneos --show-sdk-path
          xcrun --sdk iphoneos --show-sdk-version
          clang --version

      - name: Check generated settings catalog
        run: python3 tests/host/check-config-catalog.py

      # The preview still compiles every distinct input; identical checks share its successful result.
      - name: Check preview build cache correctness
        run: python3 tests/host/check-ui-preview-cache.py

      # madeira-bcd: the games' built-in recommended settings and where the app
      # applies them (GameRecommendations.swift; owner's decision 2026-10-09).
      - name: Check built-in recommended game settings
        run: python3 tests/host/check-game-recommendations.py --require-swift

      # BCD: the recommended settings online (recommended/recommendations.json, signed with
      # Ed25519; GameRecommendationsSource.swift): the built-in list equals the Swift literals it
      # replaced, signatures, allowed keys, versions, offline and a bad file keep the list in use.
      - name: Check online recommended settings
        run: python3 tests/host/check-remote-recommendations.py --require-swift

      # madeira-bcd: auto-tune (docs/AUTO-TUNE.md): off changes nothing; its hooks, rules,
      # fixtures, engine and app side.
      - name: Check auto-tune
        run: python3 tests/host/check-autotune.py --require-swift

      # GTA V Legacy's GPU reset at the first scene frame (tester logs 574-592, the owner's build 546 start): auto-tune
      # adds env.MADEIRA_DXMT_FAULT_INFO = 1, the one line the owner's build 547 start differed by, after that failure only.
      - name: Check GTA V Legacy GPU reset rule
        run: python3 tests/host/check-gta5l-gpu-reset.py

      # The Wine desktop's Start menu (BCDStartMenu.c, WineProcessBridge.m): an Explorer entry and a test program for each of
      # Direct3D 9, 10, 11 and 12, as shortcut files in the prefix's public Start Menu. The bytes are read back by a port
      # of Wine's own shell link loader, by an independent [MS-SHLLINK] reader and by Wine's winedump; the install writes
      # only when a file is missing or BCD's own and outdated, never over a person's file, and only in a desktop session.
      - name: Check the Start menu entries
        run: python3 tests/host/check-bcd-startmenu.py

      # BCD's system tests (tests/systests): the RAM test that stops before iOS would close the app (its loop is run against thousands of
      # made-up devices), the JIT pool, CPU, system info, VC++ and .NET, disk and network tests, one Windows program for x64 and one
      # for the 32-bit set. The program is built with llvm-mingw for both machines and compared with the tracked binaries.
      - name: Check the system tests
        run: python3 tests/host/check-systests.py

      # What those tests are told about the device and the engine (app/Madeira/BCDHostStatus.c, build/ntdll-unix/ios_host_status.h):
      # two small files in the prefix, only in the plain Windows desktop session; off, a session behaves as before.
      - name: Check the host status for the system tests
        run: python3 tests/host/check-host-status.py
      - name: Check the desktop session's guest-log mirror for the Start menu tests
        run: python3 tests/host/check-desktop-guest-log.py

      # BCD's Direct3D 9, 10, 11 and 12 test programs (tests/dxtests, madeira-d3d12/tests/windows/cube_window.c): shaders
      # (DXBC made offline from cube.hlsl), sources, window handling, the tracked binaries and where they ship.
      - name: Check the DirectX test programs
        run: python3 tests/host/check-dx-tests.py

      # BCD's graphics, sound, video and input test programs of round 602 (tests/dxtests, the "BCD Tests" Start menu folder): the
      # arithmetic of bcdstats.h run on the host against known answers, the two self-made clips (MP4 and ASF structure, decoded on a
      # Mac), the sources, the tracked 64-bit and 32-bit binaries rebuilt and compared, and where they ship.
      - name: Check the graphics, sound, video and input tests
        run: python3 tests/host/check-bcd-tests.py

      # 7-Zip in the Start menu (round 603): the pinned release of the project (SHA-256, licence text), the RAR code left out of the
      # object lists the build reads from 7-Zip's own makefiles, the two tracked programs (x86-64, imports a Wine session has, no RAR
      # code), the notices. BCD_CHECK_7ZIP_BUILD=1 builds both again and compares them with the tracked ones.
      - name: Check 7-Zip (pinned source, no RAR code, the tracked programs)
        run: python3 tests/host/check-7zip.py

      # BCD's runtime installer (bcd-runtimes/, round 603; the "BCD Runtimes" Start menu folder): SHA-256, deflate and ZIP against Python's
      # hashlib and zlib, the download rules (HTTPS, one host, redirects by hand), the table of runtimes, the PhysX install from NVIDIA's own
      # manifest and the DirectX cabinet reader run on fake disks and registries, the sources and the tracked program.
      - name: Check the runtime installer (downloads, checksums, XNA, PhysX, OpenAL, DirectX June 2010)
        env:
          MINGW: ${{ github.workspace }}/toolchains/llvm-mingw-20260421-ucrt-macos-universal/bin
        run: python3 tests/host/check-bcd-runtimes.py

      # Opt-in screen orientation lock for a game's session (BCDOrientation.swift): Settings › Graphics and a game's page
      # choose "follow the device" (the default, today's behaviour), landscape or a landscape side; the game's own choice wins.
      # The rule is run on the host, the UIKit part is type-checked against the iOS SDK, and off is shown to change nothing.
      - name: Check the screen orientation lock
        run: python3 tests/host/check-bcd-orientation.py

      # Experimental support for the foldable iPhone, iPhone Duo (BCDFoldable.swift): runs only on that model (iPhone19,4) with an
      # experimental switch on (off by default). The gate is run over 56 other model identifiers, the hooks are listed (one line each),
      # the default Resolution for its inner display and the scene-size tracker are run on the host, and the engine side is shown to
      # follow only (no orientation or geometry request, nothing paused or restarted). Nothing else in the app changes.
      - name: Check the foldable iPhone support
        run: python3 tests/host/check-bcd-foldable.py

      # A Done button on the keyboard where config lines and long text are typed (BCDKeyboardDone): every editor has one.
      - name: Check the keyboard's Done button
        run: python3 tests/host/check-bcd-keyboard-done.py

      # What the classic interface did for a person, kept in BCD's (parity audit, 2026-10-18):
      # its alerts reach BCD's interface, background downloads, the Downloads tab's buttons,
      # links, no classic-only place in messages, no "Madeira" in what a person reads.
      - name: Check parity with the classic interface
        run: python3 tests/host/check-parity.py --require-swift

      # madeira-bcd FORK-ONLY: Send logs to BCD (LogUpload*.swift, bcd-logs/worker): the
      # phone's scrub is tools/autotune-fixture.py's, the gzip is valid, the compressed copy
      # is deleted, automatic sending is opt-in and Wi-Fi only.
      - name: Check Send logs to BCD
        run: python3 tests/host/check-log-upload.py --require-swift

      # The performance trace (round 604; BCDPerfTrace*.swift): one line a second, an hour at most, the newest 20 kept, sent after a log's
      # last line when the player turned it on (or a guided debug run did), nothing at all while it is off, and tools/log-facts.py reading it.
      - name: Check the performance trace
        run: python3 tests/host/check-bcd-perftrace.py --require-swift

      # Help with a game (round 604; BCDHelpCore/BCDGameHelp/BCDReadinessCore.swift and their live sides): the guided debug run (nothing sent unless the
      # player taps Send, the trace and the detailed log asked for by the session only), game feedback through the existing Feedback intake, and the
      # launch check (a note on the game's page, from the import tables of its program files), with tools/pull-logs.py reading the feedback.
      - name: Check help with a game
        run: python3 tests/host/check-bcd-help.py --require-swift

      # Shareable control layouts (round 604; BCDControlShare*.swift): a custom layout as a small JSON file, a file added as a new layout after the
      # envelope and every control are checked (size, ranges, nesting, fresh ids, a name that replaces nothing).
      - name: Check shareable control layouts
        run: python3 tests/host/check-bcd-control-share.py --require-swift

      # The performance HUD (round 603: Off, four layouts and Custom; BCDHUD*.swift, BCDFrameRing.c): the layouts against the design, an
      # old overlay carried over unchanged, the frame arithmetic, placement from the window's size and safe area alone (a phone, 4:3,
      # a near-square window, a resize), the ring under the address, undefined-behaviour and thread sanitizers, the present-path
      # patch on the pinned DXMT, nothing alive while it is off, and no touch taken from the game.
      - name: Check the performance HUD
        run: python3 tests/host/check-bcd-hud.py --require-swift

      # The session summary line ([session], BCDSessionCore.swift), the marker of an open session and the one question after a
      # session that closed unexpectedly (BCDSessionRecorderLive.swift), and the readers of the line: tools/log-facts.py and
      # the scanner behind the replay.
      - name: Check the session summary and the question after an unexpected close
        run: python3 tests/host/check-bcd-session-record.py --require-swift

      # Screenshots from the in-game menu and Send Log (BCDScreenshotLive.swift, LogUpload.swift, the intake's POST /v1/shots,
      # tools/pull-logs.py): the game's own surface only, a memory guard, Photos add-only, the picture sent as it is and only when
      # chosen, as a small copy of 100 KB or less made apart from the kept one (BCDScreenshotShrink.swift, run on generated pictures),
      # the intake's 160 KB limit, and the pull tool saving it beside its log.
      - name: Check screenshots with Send Log
        run: python3 tests/host/check-bcd-screenshot.py --require-swift

      # madeira-bcd FORK-ONLY: Settings › Feedback (FeedbackUpload*.swift, BCDSettingsFeedback.swift,
      # the intake's POST /v1/feedback, tools/pull-logs.py --feedback): the intake's gate, endpoint
      # and fields, nothing personal in the body, the person's words untouched, the limits, the
      # section's place after Logs, and the pull tool never printing the key.
      - name: Check Settings › Feedback
        run: python3 tests/host/check-feedback.py --require-swift

      # A newer BCD, said at most once a day (BCDUpdateCheck.swift, BCDUpdateNotice.swift): the source's shape
      # as tools/update-altsource.py writes it, the build compare, the day key, one host with a size cap, the
      # alert only over the library with OK alone, env.MADEIRA_UPDATE_CHECK = 0.
      - name: Check the update notice
        run: python3 tests/host/check-update-check.py --require-swift

      # An install without the increased memory limit is told once per build and where a log is sent, never blocked
      # (MemoryRights.swift; the box over the library, Settings › Logs and a game's page).
      - name: Check the memory limit notice
        run: python3 tests/host/check-memory-rights-notice.py

      # The GDI handle table a 32-bit program can map: the Dock and the library's Desktop ask for the
      # section-backed table, games keep the default, bcd.cfg can turn it off, and ntdll says when a
      # 32-bit program meets a private table (ContentView.swift, build/ntdll-unix/virtual_ios.c).
      - name: Check the section-backed GDI table
        run: python3 tests/host/check-dock-gdi-section.py

      # BCD's in-game layer (BCDSession.swift and its views, BCDSessionLive.swift): the starting
      # screen, menu button, overlay, in-game menu and key bar in BCD's look, the classic engine
      # calls behind every function, nothing alive while closed, the preview build.
      - name: Check BCD's in-game layer
        run: python3 tests/host/check-bcd-session.py --require-swift --require-preview

      # BCD's store-neutral content engine (app/Madeira/BCDContent/, docs/GOG.md): plans, streamed
      # and checked chunks, the journal across a kill, pause and cancel, free space, Range resume,
      # host rotation, the queue (game sessions, one download at a time with Steam), memory.
      - name: Check the content engine
        run: python3 tests/host/check-content-engine.py --require-swift

      # GOG in BCD, milestone 1 (app/Madeira/BCDGOG/): sign-in without a token in any log, the
      # library and its pictures, builds and manifests into a plan, install into C:\GOG Games
      # end to end, the play task as a library entry. Synthetic replies only: GOG is never contacted.
      - name: Check GOG
        run: python3 tests/host/check-gog.py --require-swift

      # Epic Games in BCD, milestone 0 (app/Madeira/BCDEpic/): sign-in on Epic's own page, the owned
      # games and their pictures, the Keychain-only token rule, the masks on every [epic-*] log line,
      # the tokens sent to Epic's hosts only, the preview build. Synthetic replies only: Epic is never contacted.
      - name: Check Epic Games
        run: python3 tests/host/check-epic.py --require-swift --require-preview

      # BCD Host (bcd-host/): the helper that starts an Epic game signed in, inside Wine (milestone 2). Its
      # request reader under AddressSanitizer and a fuzz, the report's bounds; with llvm-mingw also the PE itself
      # (x86-64, GUI, relocatable, kernel32 only, no secret text). Without the toolchain only the host part runs.
      - name: Check BCD Host
        run: python3 tests/host/check-bcd-host.py

      # Epic's start arguments (the one-time code, the account's ID and name) are masked in the two places the runtime and
      # the bridge print a command line (build/bcd_epic_mask.h): both forms compiled and fuzzed, both call sites read.
      - name: Check Epic's masks
        run: python3 tests/host/check-epic-mask.py

      # madeira-bcd FORK-ONLY: the public alpha IPA is unsigned and carries nothing about the
      # owner (tools/make-alpha-ipa.py, owner 2026-10-17).
      - name: Check the alpha IPA tool
        run: python3 tests/host/check-alpha-ipa.py

      # BCD's interface, Settings › Accounts, JIT and BCD Dock (BCDAccounts/JIT/Dock.swift):
      # no engine type in the views, sign-out and the Dock reset only after a question, the
      # password never kept or logged, the JIT methods per iOS version, the preview build.
      - name: Check Settings › Accounts, JIT and BCD Dock
        run: python3 tests/host/check-bcd-settings-accounts.py --require-preview

      # madeira-bcd: the Dock's Reset removes what one-time installs put into the prefix,
      # and the installs run in a session of their own (DockReset.swift; 2026-10-12).
      - name: Check the Dock's one-time install reset
        run: python3 tests/host/check-dock-reset.py --require-swift

      # madeira-bcd (round 578): Valve's client service (Steam Client Service) is installed before a
      # custom-executable (CEG) Dock start, with Valve's own SteamService.exe, because the host's
      # in-session installer failed over RPC 1726 in 3 of 5 logged sessions (DockCEGService).
      - name: Check Valve's client service for a CEG Dock start
        run: python3 tests/host/check-dock-ceg-service.py --require-swift

      # madeira-bcd (round 591): the "Registry" values of a game's Steam install script, written before a Dock
      # start (env.MADEIRA_DOCK_SCRIPT_REGISTRY = 1; Fallout: New Vegas' launcher needs its Installed Path).
      - name: Check the Dock's install-script registry values
        run: python3 tests/host/check-dock-script-registry.py --require-swift

      # Every Play and download of BCD's interface goes the classic library's way (the same
      # launch function and checks for Steam via BCD Dock or directly, programs from Files and the
      # desktop; downloads that keep running in the background on iOS 26; nothing for Epic or GOG).
      - name: Check BCD's game starts and downloads
        run: python3 tests/host/check-bcd-launch.py --require-swift

      # Host checks that sat in tests/host without a workflow step until round 624. Every one passed in the committed tree with its
      # submodules at their pins and in the built tree, so their place here does not matter; none needs an environment variable
      # (wine/, FEX/, dxmt/, madeira-dock/ are at the repository root). Group 1 needs only the checkout (swiftc or cc where the check
      # compiles); group 2 are the checks whose test was brought up to date with the code in round 624.

      # ===== Group 1: 72 checks (check-jit-network opens loopback listeners only); none writes outside its temp folder; 0.1-14 s each under load =====

      # tools/update-altsource.py builds the AltStore source from a release (download and codesign are mocked)
      - name: Check altsource
        run: python3 tests/host/check-altsource.py

      # the iOS audio driver folds 5.1/7.1 layouts into the stereo bus (MADEIRA_AUDIO_DOWNMIX=0 restores the old mapping)
      - name: Check audio downmix
        run: python3 tests/host/check-audio-downmix.py

      # the 32-bit audio driver table keeps the 64-bit table's 37 slots and the render-scratch allocator keeps a guest ceiling.
      - name: Check audio wow64
        run: python3 tests/host/check-audio-wow64.py

      # bcd.cfg is found by native readers that run before the guest starts (early docs dir, HOME order)
      - name: Check cfg early docs
        run: python3 tests/host/check-cfg-early-docs.py

      # a library game's own cfg lines ($MADEIRA_CFG_GAME) win over bcd.cfg.
      - name: Check cfg game
        run: python3 tests/host/check-cfg-game.py

      # a pseudo-process child gets a desktop window like the session.
      - name: Check child desktop
        run: python3 tests/host/check-child-desktop.py

      # a pseudo-process child's emulator gets the child's own ntdll copy (JIT alias push)
      - name: Check child ntdll alias
        run: python3 tests/host/check-child-ntdll-alias.py

      # Chromium's out-of-memory exit names the failed request's size at NtTerminateProcess ([chromium-oom])
      - name: Check chromium oom exit
        run: python3 tests/host/check-chromium-oom-exit.py

      # unchanged ClipCursor requests notify no one (wineserver queue_ios.c)
      - name: Check clip dedupe
        run: python3 tests/host/check-clip-dedupe.py

      # a console's conhost.exe starts without a window (--headless)
      - name: Check console headless
        run: python3 tests/host/check-console-headless.py

      # touch-control layouts and built-in presets (Foundation-only Swift blocks compiled on the host)
      - name: Check control presets
        run: python3 tests/host/check-control-presets.py

      # SwapDeviceContextState patch and the opt-in source build of DXMT's 64-bit d3d11.dll.
      - name: Check d3d11 src
        run: python3 tests/host/check-d3d11-src.py

      # opt-in tiled resources of the D3D12 runtime (d3d12-tiled-resources = 1)
      - name: Check d3d12 tiled
        run: python3 tests/host/check-d3d12-tiled.py

      # round 624: the D3D12 methods that refuse a call say which ([madeira-d3d12] FAILED, log only), the unix ntdll's
      # log-only lines of the round stay where they belong, and the Wine server survives a refused master-socket bind
      - name: Check round 624 log lines
        run: |
          python3 tests/host/check-d3d12-fail-log.py
          python3 tests/host/check-round624-log-lines.py
          python3 tests/host/check-wineserver-bind-fallback.py
          python3 tests/host/check-gdi-table-child.py
          python3 tests/host/check-wow-unity-plain.py
          python3 tests/host/check-present-lum.py
          python3 tests/host/check-no-input-hint.py
          python3 tests/host/check-windowed-hint.py
          python3 tests/host/check-open-url.py
          python3 tests/host/check-win-text.py
          python3 tests/host/check-cluster-logs.py
          python3 tests/host/check-fex-fault-diag.py
          python3 tests/host/check-early-fault.py
          python3 tests/host/check-log-upload-guard.py
          python3 tests/host/check-jit-brk-trail.py
          python3 tests/host/check-ill-insn-diag.py
          python3 tests/host/check-installs-countdown.py
          python3 tests/host/check-kernelbase-optin.py
          python3 tests/host/check-fex-alias-capacity.py
          python3 tests/host/check-fex-ec-teardown-ctx.py
          python3 tests/host/check-fex-cpuid-classic.py
          python3 tests/host/check-fex-thread-init-nomem.py
          python3 tests/host/check-fex-exit-runaway.py
          python3 tests/host/check-fex-inval-null-thread.py
          python3 tests/host/check-fex-processorid.py
          python3 tests/host/check-fex-moffs-rip.py
          python3 tests/host/check-thread-sample-syscall.py
          python3 tests/host/check-usd-osversion.py
          python3 tests/host/check-thread-fault-isolate.py
          python3 tests/host/check-display-rate.py
          python3 tests/host/check-display-hz.py
          python3 tests/host/check-x64-nocopy-dataimp.py
          python3 tests/host/check-pe-module-name-safe.py
          python3 tests/host/check-diag-module-name.py
          python3 tests/host/check-ctx-null.py
          python3 tests/host/check-hint-storm.py
          python3 tests/host/check-fd-pollout-guard.py
          python3 tests/host/check-dock-install-skip.py
          python3 tests/host/check-godot-composition.py
          python3 tests/host/check-clr-death-diag.py
          python3 tests/host/check-crypt32-root-enum.py
          python3 tests/host/check-gpu-stall.py
          python3 tests/host/check-gpu-time-wow64.py
          python3 tests/host/check-noexec-who.py
          python3 tests/host/check-desktop-shell.py
          python3 tests/host/check-d9-texfmt.py
          python3 tests/host/check-d9-query-stuck.py
          python3 tests/host/check-d11-query-stuck.py
          python3 tests/host/check-soft-pool-decommit.py
          python3 tests/host/check-mem-burst.py

      # DXMT D3D9 upload ring stays bounded while a title loads without Present (ml1490)
      - name: Check d9 upload commit
        run: python3 tests/host/check-d9-upload-commit.py

      # tools/patch-wine-dns-trace.py names every getaddrinfo and bounds it on request.
      - name: Check dns trace
        run: python3 tests/host/check-dns-trace.py

      # Madeira Dock's transfer path through Wine's own prefix resolver.
      - name: Check dock path
        run: python3 tests/host/check-dock-path.py

      # Madeira Dock's report parser (whitelisted numeric fields only)
      - name: Check dock report
        run: python3 tests/host/check-dock-report.py

      # IDXGIFactory7 for DXMT's factory and the opt-in dxgi.dll source build.
      - name: Check dxgi factory7
        run: python3 tests/host/check-dxgi-factory7.py

      # every DXMT/airconv/winemetal patch script applies in the workflow's order and is idempotent.
      - name: Check dxmt patch chain
        run: python3 tests/host/check-dxmt-patch-chain.py

      # conhost.exe is refused in an ARM64EC session.
      - name: Check ec conhost
        run: python3 tests/host/check-ec-conhost.py

      # NtProtectVirtualMemory's [exec-req] path leaves the syscall callback.
      - name: Check execreq leave
        run: python3 tests/host/check-execreq-leave.py

      # FEX arena failure census: clipping, protection accounting, alignment, bounded output.
      - name: Check fex arena census
        run: python3 tests/host/check-fex-arena-census.py

      # tools/patch-fex-ios-callret-8mb.py against the pinned FEX tree.
      - name: Check fex callret 8mb
        run: python3 tests/host/check-fex-callret-8mb.py

      # D3D9 sampler anisotropy cap (getOrCreateSampler, ml1250)
      - name: Check filtering cap
        run: python3 tests/host/check-filtering-cap.py

      # a version query cannot use up the fixed-base window (GTA V launcher, RDR2)
      - name: Check fixed base guard
        run: python3 tests/host/check-fixed-base-guard.py

      # delayed release of 1-16 MB guest allocations (MADEIRA_FREE_DELAY_MS)
      - name: Check free delay
        run: python3 tests/host/check-free-delay.py

      # library front end: launch profiles, controller navigation, session exit report.
      - name: Check frontend
        run: python3 tests/host/check-frontend.py

      # snapshot transport and win32u gamepad query.
      - name: Check gamepad
        run: python3 tests/host/check-gamepad.py

      # a scalar guest store crossing the end of an anonymous alias is stored page by page (build 623)
      - name: Check gpr store straddle
        run: python3 tests/host/check-gpr-store-straddle.py

      # opt-in HID controller: descriptors and reports read back through Wine's own hid.dll code.
      - name: Check hidpad
        run: python3 tests/host/check-hidpad.py

      # a module loaded again at the base of its unloaded pool copy gets fresh .data/.bss.
      - name: Check image reload
        run: python3 tests/host/check-image-reload.py

      # unloaded-image translation retirement (MADEIRA_JIT_IMAGE_RETIRE)
      - name: Check image retire
        run: python3 tests/host/check-image-retire.py

      # the JIT-pool dump is opt-in (ios_jit_dump_enabled)
      - name: Check jit dump optin
        run: python3 tests/host/check-jit-dump-optin.py

      # every child gets the JIT pool's WINE_IOS_JIT_* variables (ios_env_with)
      - name: Check jit env
        run: python3 tests/host/check-jit-env.py

      # StikDebug and the iOS 26 built-in JIT helper: static integration checks.
      - name: Check jit method
        run: python3 tests/host/check-jit-method.py

      # LocalDevVPN loopback check and the JIT shortcut (JITNetwork.swift LoopbackProbe)
      # Opens listeners on 127.0.0.1 (ephemeral ports) only; nothing leaves the machine.
      - name: Check jit network
        run: python3 tests/host/check-jit-network.py

      # opt-in D3DKMT adapter, the [vkmt] trace and DXGI's UMD version patch.
      - name: Check kmt adapter
        run: python3 tests/host/check-kmt-adapter.py

      # in-process NSI network tables (nsi_network_ios.c)
      - name: Check nsi network
        run: python3 tests/host/check-nsi-network.py

      # NVAPI trace and display-name fallback patches.
      - name: Check nvapi trace
        run: python3 tests/host/check-nvapi-trace.py

      # controller output (DualSense output reports, XInput rumble) on its way to the physical pad.
      - name: Check pad output
        run: python3 tests/host/check-pad-output.py

      # a placement walk that found no gap is remembered (ios_ml1027_place)
      - name: Check place proof
        run: python3 tests/host/check-place-proof.py

      # the CPU power governor holds the average at its target (MADEIRA_POWER_GOV_MW)
      - name: Check power gov
        run: python3 tests/host/check-power-gov.py

      # Social Club layout 2 keeps room for RDR2's 8960 MB reserve (MADEIRA_RDR2_VA_HOLD)
      - name: Check rdr2 va hold
        run: python3 tests/host/check-rdr2-va-hold.py

      # the wineserver overwrites a link to a read-only file (fd_ios.c)
      - name: Check readonly link
        run: python3 tests/host/check-readonly-link.py

      # front end Settings: display rate, swap tier and sync engine (MadeiraConfig.set)
      - name: Check runtime settings
        run: python3 tests/host/check-runtime-settings.py

      # Social Club's Chromium: one CEF process, its libcef.dll copy and its glued pools.
      - name: Check sc cef gate
        run: python3 tests/host/check-sc-cef-gate.py

      # Social Club layout 2: the helper's commits into its large grants, in 256 MB steps.
      - name: Check sc grant growth
        run: python3 tests/host/check-sc-grant-growth.py

      # Social Club helper restarts and layout 2 (virtual_ios.c)
      - name: Check sc layout
        run: python3 tests/host/check-sc-layout.py

      # [sc-rph]: the browser CefApp hands out the renderer app's handler.
      - name: Check sc render handler
        run: python3 tests/host/check-sc-render-handler.py

      # D3D9 scene batching (ml1250)
      - name: Check scene batching
        run: python3 tests/host/check-scene-batching.py

      # a thread killed inside an uninterrupted section leaves it first (server_ios.c)
      - name: Check section abort
        run: python3 tests/host/check-section-abort.py

      # packed shader cache madeira_sc_pack.c (opt-in d3d12-shader-pack = 1)
      - name: Check shader pack
        run: python3 tests/host/check-shader-pack.py

      # guest-window band and small-map rule (ios_wow_band, ios_wow_map_allows_window)
      - name: Check small va band
        run: python3 tests/host/check-small-va-band.py

      # thread stack spill and the small-stack executables (MADEIRA_THREAD_STACK_SPILL, MADEIRA_SMALL_STACK_EXES)
      - name: Check stack spill
        run: python3 tests/host/check-stack-spill.py

      # the stale-pointer heal translates each copy for the process that uses it.
      - name: Check stale heal owner
        run: python3 tests/host/check-stale-heal-owner.py

      # Steam games in the library: installed/partial state from Steam's own manifests, Dock discovery.
      - name: Check steam games
        run: python3 tests/host/check-steam-games.py

      # Steam sign-in (SwiftSteam): licence headers, Keychain item stays local, no credential in logs; Swift checks.
      - name: Check steam signin native
        run: python3 tests/host/check-steam-signin-native.py

      # swapchain mode-switch diagnostics ([swap-diag], [swap-win], [main-stall]) only log.
      - name: Check swap diag
        run: python3 tests/host/check-swap-diag.py

      # a thread that cannot be created says why (Chromium OOM exit with size 0)
      - name: Check thread create failure
        run: python3 tests/host/check-thread-create-failure.py

      # touch ownership/arbitration logic (TouchGamepadState)
      - name: Check touch gamepad
        run: python3 tests/host/check-touch-gamepad.py

      # unix-library binder by caller bitness (load_builtin_unixlib)
      - name: Check unixlib binder
        run: python3 tests/host/check-unixlib-binder.py

      # env.MADEIRA_VCRT_ARM64_KEY, the volatile ARM64 Visual C++ redistributable marker (server_ios.c)
      - name: Check vcrt arm64 key
        run: python3 tests/host/check-vcrt-arm64-key.py

      # the virtual monitor's Win32 names (sysparams_ios.c)
      - name: Check vmon identity
        run: python3 tests/host/check-vmon-identity.py

      # the monitor's fault-safe reads against real protected/unmapped pages (Wine patch applied twice to a temp copy)
      - name: Check waiter read
        run: python3 tests/host/check-waiter-read.py

      # win32u allocation ceiling per pseudo-process (win32u_zero_bits)
      - name: Check win32u zero bits
        run: python3 tests/host/check-win32u-zero-bits.py

      # window coordinates with Wine's real rectangle and DPI functions (build 391)
      - name: Check window coordinates
        run: python3 tests/host/check-window-coordinates.py

      # the compositor callback and Wine's is_window_visible (build 391 regression)
      - name: Check window visibility
        run: python3 tests/host/check-window-visibility.py

      # Wine Mono's first-use download: pins match build/wine-mono/pin.sh, installer unpacks synthetic .tar.xz archives.
      - name: Check wine mono
        run: python3 tests/host/check-wine-mono.py

      # WoW64 thread contexts on the server side (I386_CONTEXT offsets, apply only for i386)
      - name: Check wow context
        run: python3 tests/host/check-wow-context.py

      # FEX WOW64 module keeps the CPU area current and honours RESET_STATE.
      - name: Check wow cpu area
        run: python3 tests/host/check-wow-cpu-area.py

      # WOW64 syscall parking in the code-buffer sweeper.
      - name: Check wow sweep
        run: python3 tests/host/check-wow-sweep.py

      # ADD/SUB off x18 take the destination-register trampoline.
      - name: Check x18 arith
        run: python3 tests/host/check-x18-arith.py

      # ===== Group 2: 20 checks whose test was brought up to date with the code in round 624 =====

      # tools/patch-wine-cpu-error-diag.py applies once to the committed user32/wow64 files ([msgbox-origin], [pf-xmmi64] log only).
      - name: Check cpu error diag
        run: python3 tests/host/check-cpu-error-diag.py

      # tools/patch-wine-rpc-np-diag.py: [rpc-np] logs a failed RPC named-pipe read, nothing else changes.
      - name: Check rpc np diag
        run: python3 tests/host/check-rpc-np-diag.py

      # Madeira Dock's app-side contract (pool policy, discovery, launch validation, transfer envelope, environment) compiled from production Swift.
      - name: Check dock contract
        run: python3 tests/host/check-dock-contract.py

      # Dock one-time installs: install-script plan, ledger, DirectX provided by BCD after a failure, batch text (production Swift under ASan).
      - name: Check dock installers
        run: python3 tests/host/check-dock-installers.py
      # Round 626 (A1 S12): a Dock start that runs the EA app's installer links msiexec into system32 for that session.
      - name: Check the EA app installer's Dock session
        run: python3 tests/host/check-dock-ea-installer.py
      # Round 626 (P S8): the Mach exception thread's diagnostics read through mach_vm_read_overwrite, never a plain load.
      - name: Check the Mach exception thread's checked reads
        run: python3 tests/host/check-mach-exc-safe-reads.py
      # Round 626 (U2 S10, Sable PVTSYM): every CoreHaptics call of the controller rumble is guarded; a stopped engine is rebuilt.
      - name: Check the rumble's CoreHaptics guard
        run: python3 tests/host/check-pad-output-haptics-guard.py

      # Ghost of Tsushima diagnostics switches in madeira_d3d12.c (skip-ps, dxil-dump, fence-strict, upload-guard, ...) stay off by default and sit behind g_sd_state.
      - name: Check got diagnostics
        run: python3 tests/host/check-got-diagnostics.py

      # HKLM\HARDWARE\DESCRIPTION registry mirror of FEX's CPUID answers and wineboot's BIOS/processor values (fuzzed under ASan/UBSan).
      - name: Check hw registry
        run: python3 tests/host/check-hw-registry.py

      # first-run setup: rules, pages, once-per-run decision, never over a session, Run setup again.
      - name: Check onboarding
        run: python3 tests/host/check-onboarding.py

      # pso-warm: pipeline cache warm-up in winemetal (op 10), copies and retains balanced, d3d12 side sends both lazy kinds.
      - name: Check pso warm
        run: python3 tests/host/check-pso-warm.py

      # replay-split: every D3D12 command kind has a named [perf] bucket, timers only behind the flag.
      - name: Check replay split
        run: python3 tests/host/check-replay-split.py

      # media packaging gate (tools/check-wine-media-dlls.py): WMVCORE/winegstreamer exports, imports, forwarders, delay imports.
      - name: Check wine media dlls
        run: python3 tests/host/check-wine-media-dlls.py

      # x64 classification, IAT slots and fault-safe guest-instruction diagnostics (ASan/UBSan, three negative controls).
      - name: Check guest instruction
        run: python3 tests/host/check-guest-instruction.py

      # D3D9 device lock and FEX split CAS: no split-lock rollback, strict split locks on for WOW64, 4x20000 XADD exact.
      - name: Check d3d9 splitlock
        run: python3 tests/host/check-d3d9-splitlock.py

      # MADEIRA_BAND_CENSUS: the 64 GB band census (layouts, 8960 MB fit, capped at 64 lines).
      - name: Check band census
        run: python3 tests/host/check-band-census.py

      # [bg-qos]: background helper processes leave the performance cores while a game presents.
      - name: Check bg qos
        run: python3 tests/host/check-bg-qos.py

      # always-on monitors stay off the game's cores (warmer sweep cadence, one [xp-names] line per native thread).
      - name: Check monitor cadence
        run: python3 tests/host/check-monitor-cadence.py

      # an unaligned ordered/exclusive/LSE access in the app's own code is emulated in place (GTA V launcher stlr).
      - name: Check native unaligned
        run: python3 tests/host/check-native-unaligned.py

      # wineserver request doorbell: no request lost through the bells alone (1.6 M requests, 8 clients; has a 5 s watchdog).
      # The only one here with a wall-clock watchdog (5 s per request); passed 3/3 including 6 copies at once on 12 vCPUs.
      - name: Check srv doorbell
        run: python3 tests/host/check-srv-doorbell.py

      # swap tier core: coverage modes, merged free extents, host-page copy-back, reserve-time backing, census.
      - name: Check swap coverage
        run: python3 tests/host/check-swap-coverage.py

      # aux-IAT heal: timeGetTime's QPC/QPF stubs healed to the process's ntdll copy through the RW view only.
      - name: Check aux iat heal
        run: python3 tests/host/check-aux-iat-heal.py

      # owned Steam library and downloads: protocol, manifests, decrypt/decompress, resumable install against three local HTTP servers (loopback only, ~25 s CPU).
      # Starts three HTTP servers on 127.0.0.1 itself (never contacts Steam); needs swiftc, cc and the openssl command; 47-84 s wall under load (about 25 s of CPU).
      - name: Check steam library
        run: python3 tests/host/check-steam-library.py

      # ===== Group 3: needs a host FFmpeg (built once, then cached) =====

      # Builds a host FFmpeg 7.1.1 from the tracked tarball on first use (1 m 46 s cold here, 7 s warm) into ~/.cache/madeira-host-ffmpeg/ (set
      # MADEIRA_HOST_FFMPEG to a prebuilt prefix to move it); then the production wg_parser under ASan/UBSan. Needs the diff of check-wg-parser.py.
      - name: Check wg-parser on libavformat (MP3/WAV/MP4)
        run: python3 tests/host/check-wg-parser.py


      # ===== Not in the workflow =====
      # check-fastsync.py          non-deterministic (a stochastic "control must stall" assertion fails under CPU load)
      # check-jit-pairing.py       runs cargo test: writes build/rppairing-ios/target into the repo, needs loopback sockets and crates.io
      # check-sc-ipc-rebind.py, check-sc-ipc-split.py, check-sc-render-loop.py, check-sc-runstate.py, check-sc-ui-close.py
      #                            assemble x86-64 with GNU as/ld/objcopy/nm and run x86-64 code: need an x86-64 host + GNU binutils (the arm64 runner cannot run them)
      # check-launcher-smc.py, check-fex-branch-history.py   need the Python unicorn module (not installed, no network); also need their diffs

      # BCD's interface is the app's interface (BCDLiveStore.swift, BCDLiveFrontEnd.swift;
      # docs/BCD-UI-ARCHITECTURE.md): the BCD choice and its one-time move, Play through the
      # classic library's function, the in-game flag, setup over it, the preview build.
      - name: Check BCD's interface in the app
        run: python3 tests/host/check-bcd-live.py --require-swift

      # BCD's game page (BCDGamePage.swift, docs/BCD-UI-ARCHITECTURE.md): its rules for every
      # state, the questions before what deletes or sends, the controller, cool running and
      # the preview build.
      - name: Check BCD's game page
        run: python3 tests/host/check-bcd-game-page.py --require-swift

      # BCD's Library tab and Add a game (BCDLibraryView.swift, BCDAddGame.swift): search, refresh,
      # the Steam sign-in card, how games get into drive_c, the kept filter and order, a program
      # of drive_c added with its name, Add every game, BCD's own screens in the app.
      - name: Check BCD's library and Add a game
        run: python3 tests/host/check-bcd-library.py --require-swift

      # The graphics API the library shows (Library.swift apiNames, the scanner's dynamicAPIs, and from 2026-10-24 folderAPIs:
      # Unity's UnityPlayer.dll, the Agility SDK's D3D12Core.dll and the DXIL DLLs beside a program whose imports name none).
      - name: Check the library's graphics API detection
        run: python3 tests/host/check-library-api.py

      # The EA app installer's MSI package (build 593, log 17:15:17): its first custom action ran in rundll32 and asked msiexec's
      # custom action server over a pipe; the server's first answer reached a running thread, no waiting thread could take it and BCD's
      # own Windows server dropped it (JunoInitializeSession 1603). env.MADEIRA_APC_BUSY_QUEUE = 1 keeps it on its thread: the real
      # server functions next to the original ones (off: byte for byte the same), the EA entry's line, auto-tune's rule and fixture.
      - name: Check an async I/O completion kept for a busy thread (EA app installer)
        run: python3 tests/host/check-apc-busy-queue.py

      # Control and Slay the Spire 2 (logs X49WBQ, GZFVM3): a crash in RtlRunOnceComplete's walk of an InitOnce's waiters, because a
      # NULL keyed-event handle was the first pseudo-process's global in a child. env.MADEIRA_KEYED_EVENT_PER_PROCESS = 1 gives each
      # child its own: the Wine fork's two calls, the header's table over every case (off: the session's handle), the child boot hook,
      # auto-tune's rule and its two fixtures.
      - name: Check a child process's own keyed event (Control, RunOnce)
        run: python3 tests/host/check-keyed-event-per-process.py

      # Messiah's "Launch Messiah.bat" (logs since build 614): the 64-bit cmd.exe found no reg.exe. Sessions link the i386 command-line
      # tools into the 64-bit system32 where the name is absent (env.MADEIRA_SYSTEM32_X86_TOOLS = 0 turns it off).
      - name: Check Windows' command-line tools in the 64-bit system32 (Messiah)
        run: python3 tests/host/check-system32-x86-tools.py

      # Gal*Gun 2 and Hello Neighbor (logs CWFP3N, B2B7BR, TAW359): OpenSSL 1.0.2's SHA-extension SHA-1 routine returns with a wrong stack
      # pointer after NETAPI32.DLL loads. env.MADEIRA_FEX_SHA = 0 tells such a game's guest the processor has no SHA extension: the app's
      # rewrite of FEX's host probe compiled and run over every value, FEX's reading of it, the list rows, auto-tune's rule and its fixtures.
      - name: Check the per-game SHA extension switch (Gal*Gun 2, Hello Neighbor)
        run: python3 tests/host/check-fex-sha-off.py

      # env.MADEIRA_ZERO_MITIGATION_POLICY (Glyphica: Typing Survival, ChakraCore's fail-fast over an unwritten CFG policy): the Wine fork's
      # kernelbase GetProcessMitigationPolicy compiled on the host and run over every value of the switch (off: untouched; 1: zeroed, 1 to 16
      # bytes), the game's list line (build 600), the list policy, auto-tune's rule and its fixture, the catalog.
      - name: Check Wine's zeroed mitigation policy (Glyphica, ChakraCore)
        run: python3 tests/host/check-zero-mitigation-policy.py

      # PC launchers in the Library (Battle.net, EA app: BCDLaunchers.swift, BCDLauncherDownload.swift, BCDLaunchersLive.swift) and
      # Wine Gecko for their installers (BCDGecko.swift): the installer addresses and hosts, the "installed" detection, the start
      # on its own (no explorer), the download served from a URLProtocol, Gecko's SHA-256 values against addons.c.
      # A game's session without BCD's fixed Steam identity (env.MADEIRA_STEAM_IDENTITY = none, WineProcessBridge.m): the bridge's
      # real block compiled and run in every case, the list policy, the catalog, the auto-tune rule for Rockstar's launcher from Epic.
      - name: Check the no-Steam-identity switch
        run: python3 tests/host/check-steam-identity.py

      - name: Check BCD's launchers and Wine Gecko
        run: python3 tests/host/check-bcd-launchers.py --require-swift

      # ajan32/ea-cef (2026-10-24): the EA app's Chromium (EADesktop.exe, CEF 109) in one process with its four 16 GB PartitionAlloc
      # pools in the four slots of layout 2's band, only with env.MADEIRA_EA_CEF = 1 (the EA launcher entry's lines): the five gated hook
      # lines in virtual_ios.c, the production routing compiled against a model of the band (restart, blocked slot, second browser),
      # the soft-grant loop against the original (switch off = the old grants), the spawn gate and the command line.
      - name: Check the EA app's Chromium
        run: python3 tests/host/check-ea-cef.py

      # BCD's menus (BCDMenu.swift): a game's menu on a long press or X (Play or Install, Game
      # page, Uninstall or Remove after a question), the Library's sort menu, the controller layer.
      - name: Check BCD's menus
        run: python3 tests/host/check-bcd-menu.py --require-swift

      # BCD's words: "license" in everything a person reads (identifiers and the credits' legal text stay).
      - name: Check BCD's spelling
        run: python3 tests/host/check-bcd-spelling.py

      # BCD's on-screen touch controls and their editor (BCDTouch*.swift): every control sends
      # the game what the classic one sent and takes the same touches, layouts convert byte for
      # byte, the overlay and the in-game menu show BCD's, the preview build.
      - name: Check BCD's touch controls
        run: python3 tests/host/check-bcd-touch.py --require-swift

      # The files BCD writes carry BCD's names (2026-10-18): bcd.cfg (madeira.cfg and the
      # madeira-<key>.txt files are never read; every device installs BCD fresh),
      # bcd-log.txt, bcd-library.json, bcd-art/, the controls' files, bcd-reset-backup/,
      # BCD-saves-<date>.zip; no source opens a file by an old name.
      - name: Check BCD's file names
        run: python3 tests/host/check-bcd-file-names.py --require-swift

      # The extra keys (round 603): the key bar over the game (Game › Key bar) and the second page of the bar over the
      # iOS keyboard (Fn): Alt+Tab, Alt+Enter, Win, F1-F12, Esc, Del and Ctrl/Alt/Shift latches, posted as every key is.
      - name: Check the extra keys
        run: python3 tests/host/check-bcd-extra-keys.py --require-swift

      # The in-game menu's items of round 604: Pause, Windows, Task Manager, magnifier, picture filter and flip, gestures help, the live log's
      # tools with Wine debug-channel presets, vibration, touch controls that hide and take a colour, the controller's way of opening the
      # menu, "Save these settings for this game", frame generation and the cooling cap. Every one is a menu choice; nothing changes
      # for a game whose player does none of them.
      - name: Check the BCD in-game menu items
        run: python3 tests/host/check-bcd-menu-items.py --require-swift
      # Turbo and macros (round 604): a held controller button repeats, a button plays a chain of presses, per game, off by default; nothing
      # exists (two static flags, no timer) until a game turns it on and is played.
      - name: Check turbo and macros
        run: python3 tests/host/check-bcd-turbo.py --require-swift

      # Players (round 604): press a button on a controller to make it Player 1 to 4, rumble for each player, the touch controls as a player; with
      # nothing chosen a controller takes the first free slot as before.
      - name: Check players
        run: python3 tests/host/check-bcd-players.py --require-swift

      # Radial menu (round 604): a button at the edge opens a ring of up to eight keys and actions round the thumb, per game, off by default;
      # no window exists until a game turns it on and is played.
      - name: Check radial menu
        run: python3 tests/host/check-bcd-radial.py --require-swift

      # Aim mode, touch gestures and the Apple Pencil as a mouse (round 604): what a finger or a Pencil on the game does beyond the pointer
      # setting, per game, off by default; with all three off MetalBackedView reads one static flag.
      - name: Check aim mode, touch gestures and the Apple Pencil
        run: python3 tests/host/check-bcd-touch-extras.py --require-swift

      # The gamepad model picker (round 604): what a game sees as player 1's controller (Xbox, DualSense, generic gamepad); it only names the
      # values env.MADEIRA_PAD_MODE always took, and offers no DualShock 4 while the wineserver has none.
      - name: Check the gamepad model picker
        run: python3 tests/host/check-bcd-padmodel.py --require-swift

      # Touch-control look (round 604): the colour of the on-screen buttons, what a press lights up in and the symbols on the face buttons;
      # BCD's own look is what a player who chooses nothing has, drawn as before.
      - name: Check touch-control look
        run: python3 tests/host/check-bcd-touch-look.py --require-swift

      # Gyro aim (round 603): turning the phone aims the game as the mouse or the right stick, per game, off by default; nothing runs
      # (no sensor, one static flag in the controller code) until a game turns it on and is played.
      - name: Check gyro aim
        run: python3 tests/host/check-bcd-gyro.py --require-swift

      # "Look like this GPU" (round 603): a game's gpu-card line names the graphics card it is told it has, the same in DXGI,
      # Direct3D 9 and Windows' own adapter; nothing changes for a game that picks none.
      - name: Check Look like this GPU
        run: python3 tests/host/check-gpu-cards.py --require-swift

      # BCD's interface: Settings (app/Madeira/BCDSettings*.swift): headers, no engine types in its
      # views, the preview build, the controller's walk, no old name on screen, the credits word
      # for word, every catalog key, and the classic settings kept reachable.
      - name: Check BCD's Settings
        run: python3 tests/host/check-bcd-settings.py

      # Games on a USB-C SSD (Settings > Storage > External SSD, C:\External; docs/EXTERNAL-STORAGE.md; based on
      # thebcd69/bcd-games#12 by Pardoxum). Opt-in by use: until a folder is chosen restore() is one UserDefaults read
      # and every hook in the library keeps its original test first (compiled against the original scanner on real
      # folders); then the reconnect without the picker, stale and damaged bookmarks, containment, and that no user
      # file is deleted or overwritten. Needs macOS Foundation and swift (bookmarks, links, real folders).
      - name: Check games on an external SSD (opt-in by use, reconnect, safety)
        run: python3 tests/host/check-external-storage.py --require-swift

      # The in-place External SSD folder-picker fix (app/Madeira/ExternalGamesPicker.swift): on an install
      # whose signed App ID differs from the bundle id, correct the picker's host identity (only, never the
      # whole app) so Open returns the real folder in place with no -Inbox copy; change nothing for installs
      # that already work. Gating, no-global-identity-change and the pure identity decision are pinned here.
      - name: Check the in-place External SSD folder-picker fix
        run: python3 tests/host/check-external-picker.py --require-swift

      # Every app source is in the Xcode project (build 623's first run: a new Swift file passed the typecheck but not the archive).
      - name: Check the app sources are in the Xcode project
        run: python3 tests/host/check-xcode-sources.py

      # BCD's controller hub (BCDControllerHub.swift, written clean-room from
      # docs/clean-room/controller-hub-spec.md): the mapping's sectors, keys, order, triggers and
      # default; element handlers only (GamepadInput keeps the profile's and its queue); state on
      # the main thread; the earlier third-party manager gone and named nowhere.
      - name: Check BCD's controller hub
        run: python3 tests/host/check-controller-hub.py --require-swift

      # --- UNVERIFIED: exact configure invocation for the wine fork's
      # iOS/arm64 cross target isn't documented anywhere in the repo.
      # This is a best guess and will likely need correcting once we see
      # the real error.
      - name: Install newer bison (macOS ships an ancient 2.3)
        run: |
          brew install bison
          echo "$(brew --prefix bison)/bin" >> "$GITHUB_PATH"

      - name: Install llvm (need lld/llvm-dlltool for aarch64-windows PE cross target)
        run: |
          brew install llvm lld
          echo "$(brew --prefix llvm)/bin" >> "$GITHUB_PATH"
          echo "$(brew --prefix lld)/bin" >> "$GITHUB_PATH"

      # 13m25s of a 21m37s run was spent rebuilding wine's host tools, every
      # time, for a submodule that does not move. Key the cache on the wine
      # revision so it rebuilds exactly when wine actually changes.
      - name: Wine submodule revision
        id: winerev
        shell: bash
        run: echo "sha=$(git -C wine rev-parse HEAD)" >> "$GITHUB_OUTPUT"

      # willfaust/wine madeira-lgpl e828644: dlls/ntdll/loader.c line 1342
      # #includes "arm64ec_x64_export_iat.c", which was never committed to the
      # fork. It sits under #ifdef __arm64ec__ -- the PE ntdll, which this
      # build does not compile (ntdll.dll is upstream's tracked binary) -- but
      # configure's makedep scans every include and stops at the missing file,
      # so no Makefile, no config.h, and nothing after it builds. Give makedep
      # an empty file; if the fork later commits the real one, this is a no-op.
      - name: Work around wine's uncommitted arm64ec_x64_export_iat.c
        shell: bash
        run: |
          F=wine/dlls/ntdll/arm64ec_x64_export_iat.c
          if [ -f "$F" ]; then
            echo "::notice::$F is present upstream now -- this step can go"
          else
            printf '/* placeholder: see build-ipa.yml; PE-side only, never compiled here */\n' > "$F"
            echo "::warning::$F missing from the wine fork -- empty placeholder written for makedep"
          fi
          # dlls/ntdll/unix/sync.c includes build/madeira_cfg.h BEFORE config.h,
          # on purpose (ml1122: Wine's headers ban strncpy by macro). makedep
          # treats that ordering as fatal, so configure never writes a
          # Makefile. Upstream builds from a long-configured tree and never
          # meets it. Make that one sanity check a warning.
          MD=wine/tools/makedep.c
          python3 - "$MD" <<'PYEOF'
          import sys
          p = sys.argv[1]
          s = open(p).read()
          old = 'fatal_error( "%s must be included before other headers\\n", file->name );'
          new = ('fprintf( stderr, "%s:%d: warning: %s must be included before other headers '
                 '(madeira-bcd CI: not fatal)\\n", input_file_name, input_line, file->name );')
          if new in s:
              print("makedep: already patched")
          elif s.count(old) == 1:
              open(p, "w").write(s.replace(old, new))
              print("makedep: config.h ordering check is now a warning")
          else:
              print("::error::makedep.c anchor not found -- wine moved, review this step")
              sys.exit(1)
          # The WoW64 series' wine (125hz pr/wow64-core) includes Madeira's
          # iOS shim headers (ios_fastsync.h, ios_srv_stats.h, ...) by bare
          # name; the iOS builds find them with -I build/ntdll-unix/shims,
          # makedep does not and stops configure. They are outside the tree
          # like a system header, so skip them the way makedep skips those.
          s = open(p).read()
          old = '    if (make->external) return NULL; /* ignore missing files in external libs */\n'
          new = old + ('    if (!strncmp( source->name, "ios_", 4 )) return NULL;  '
                       '/* madeira-bcd CI: build/ntdll-unix/shims */\n')
          if new in s:
              print("makedep: ios_* shims already skipped")
          elif s.count(old) == 1:
              open(p, "w").write(s.replace(old, new))
              print("makedep: missing ios_* shim headers are skipped")
          else:
              print("::error::makedep.c external-lib anchor not found -- wine moved, review this step")
              sys.exit(1)
          PYEOF

      - name: Restore native wine tools
        id: winenative
        uses: actions/cache/restore@v4
        with:
          path: wine/build-native
          key: wine-native-v1-${{ steps.winerev.outputs.sha }}

      - name: "Build native wine (for host-side tools: widl/wrc/wmc)"
        if: steps.winenative.outputs.cache-hit != 'true'
        run: |
          cd wine
          mkdir -p build-native
          cd build-native
          # LOCAL (x86_64 Mac): an x86_64 host's configure defaults to a 32-bit Wine,
          # which macOS cannot build ("gcc -m32 works... no"); arm64 hosts are 64-bit.
          W64=""; [ "$(uname -m)" = x86_64 ] && W64=--enable-win64
          ../configure $W64 > "$GITHUB_WORKSPACE/wine-native-configure.log" 2>&1 || true
          # Only the host tools and the generated headers are used from this
          # tree. A full host build also compiles the iOS-only unix sources
          # for macOS, and one failure there used to stop make before widl.
          N=$(sysctl -n hw.ncpu)
          { make -j"$N" __tools__ && make -j"$N" include; } > "$GITHUB_WORKSPACE/wine-native-make.log" 2>&1 \
            || make -k -j"$N" >> "$GITHUB_WORKSPACE/wine-native-make.log" 2>&1 || true

      # Saved only once the next step has confirmed widl actually exists, so a
      # half-built tree cannot be cached and then trusted on every later run.
      - name: Save native wine tools
        if: steps.winenative.outputs.cache-hit != 'true' && hashFiles('wine/build-native/tools/widl/widl') != ''
        uses: actions/cache/save@v4
        with:
          path: wine/build-native
          key: wine-native-v1-${{ steps.winerev.outputs.sha }}

      - name: Diagnose native wine tools build
        run: |
          echo "-- looking for widl (proof the native tools built) --"
          find wine/build-native/tools -maxdepth 2 -name "widl*" 2>&1 || echo "not found"
          if [ ! -x wine/build-native/tools/widl/widl ]; then
            echo "::error::native widl NOT built -- dumping tails"
            NCTAIL=$(tail -n 30 wine-native-configure.log 2>/dev/null | python3 -c "import sys; print('%0A'.join(sys.stdin.read().splitlines()))")
            echo "::error::native configure TAIL :: $NCTAIL"
            NMTAIL=$(tail -n 40 wine-native-make.log 2>/dev/null | python3 -c "import sys; print('%0A'.join(sys.stdin.read().splitlines()))")
            echo "::error::native make TAIL :: $NMTAIL"
          else
            echo "::notice::native widl built OK"
          fi

      - name: Configure wine (build-macos, cross)
        run: |
          cd wine
          mkdir -p build-macos
          cd build-macos
          ../configure --enable-win64 --disable-tests \
            CC="xcrun -sdk iphoneos clang -arch arm64 -miphoneos-version-min=17.0" \
            CROSSCC="xcrun -sdk iphoneos clang -arch arm64 -miphoneos-version-min=17.0" \
            --host=aarch64-apple-darwin --build=x86_64-apple-darwin \
            --with-wine-tools="$GITHUB_WORKSPACE/wine/build-native" \
            --without-freetype --without-fontconfig \
            --without-x --without-opengl --without-vulkan \
            --without-gnutls --without-pcsclite --without-usb \
            --without-v4l2 --without-gphoto --without-inotify \
            --without-sane --without-pulse --without-alsa --without-oss \
            --without-capi --without-cups --without-krb5 --without-ldap \
            --without-netapi --without-sdl --without-udev --without-unwind \
            > "$GITHUB_WORKSPACE/wine-configure.log" 2>&1 || true

      - name: Generate cross-tree headers and patch config.h for iOS SDK
        shell: bash
        run: |
          make -C wine/build-macos include -j"$(sysctl -n hw.ncpu)" > "$GITHUB_WORKSPACE/make-include.log" 2>&1 || true
          cp -n wine/build-native/include/*.h wine/build-macos/include/ 2>/dev/null || true
          CFG=wine/build-macos/include/config.h
          {
            echo ""
            echo "/* iOS SDK fixups appended by CI */"
            echo "#undef HAVE_GETATTRLIST"
            echo "#ifndef D_TAPE"
            echo "#define D_TAPE 1"
            echo "#endif"
            echo "#ifndef D_DISK"
            echo "#define D_DISK 2"
            echo "#endif"
            echo "#ifndef D_TTY"
            echo "#define D_TTY 3"
            echo "#endif"
            echo ""
            echo "/* Wine configure runs --without-gnutls here (the host has no"
            echo " * gnutls for the iOS sysroot), so config.h defines neither of"
            echo " * these. But dlls/bcrypt/gnutls.c is wrapped head-to-toe in"
            echo " * #ifdef HAVE_GNUTLS_CIPHER_INIT and dlls/secur32/schannel_gnutls.c"
            echo " * in #ifdef SONAME_LIBGNUTLS -- undefined, both compile to an"
            echo " * EMPTY object, __wine_unix_call_funcs is never emitted, and the"
            echo " * app link dies on _bcrypt_unix_call_funcs / _secur32_unix_call_funcs."
            echo " * We link toolchains/gnutls-ios statically and ios_gnutls_shim.h"
            echo " * rewrites dlopen/dlsym onto a static symtab, so the soname string"
            echo " * is only ever pattern-matched, never actually dlopen()ed. */"
            echo "#ifndef SONAME_LIBGNUTLS"
            echo "#define SONAME_LIBGNUTLS \"libgnutls.so.30\""
            echo "#endif"
            echo "#ifndef HAVE_GNUTLS_CIPHER_INIT"
            echo "#define HAVE_GNUTLS_CIPHER_INIT 1"
            echo "#endif"
          } >> "$CFG"
          if [ -f wine/build-macos/include/dwrite.h ]; then
            echo "::notice::dwrite.h present in cross tree"
          else
            echo "::error::dwrite.h STILL MISSING"
            LS=$(ls wine/build-native/include/ 2>&1 | head -40 | python3 -c "import sys; print('%0A'.join(sys.stdin.read().splitlines()))")
            echo "::error::native include dir :: $LS"
            T=$(tail -n 20 "$GITHUB_WORKSPACE/make-include.log" 2>/dev/null | python3 -c "import sys; print('%0A'.join(sys.stdin.read().splitlines()))")
            echo "::error::make include tail :: $T"
          fi

      - name: Diagnose wine build-macos state
        run: |
          echo "-- listing wine/build-macos (depth 2) --"
          find wine/build-macos -maxdepth 2 2>&1 | head -60 || echo "wine/build-macos missing entirely"
          if [ -f wine/build-macos/include/config.h ]; then
            echo "::notice::config.h EXISTS, $(wc -l < wine/build-macos/include/config.h) lines"
          else
            echo "::error::config.h MISSING at wine/build-macos/include/config.h -- configure did not actually produce it"
            LINES=$(wc -l < wine-configure.log 2>/dev/null || echo 0)
            echo "::error::wine-configure.log has $LINES lines total"
            HEAD=$(head -n 25 wine-configure.log 2>/dev/null | python3 -c "import sys; print('%0A'.join(sys.stdin.read().splitlines()))")
            echo "::error::configure HEAD :: $HEAD"
            TAIL=$(tail -n 40 wine-configure.log 2>/dev/null | python3 -c "import sys; print('%0A'.join(sys.stdin.read().splitlines()))")
            echo "::error::configure TAIL :: $TAIL"
          fi

      # The WMA decoder transform (build/ntdll-unix/winegstreamer_unixlib_ios.c) compiled against the configured Wine build tree: it needs
      # wine/build-macos/include/config.h and the widl headers of the step "Generate cross-tree headers ..." above (else SKIP-FAIL),
      # and builds its own host FFmpeg on first use (8 s once cached).
      - name: Check the WMA decoder transform
        run: python3 tests/host/check-wma-decoder.py

      - name: Clone freetype 2.13.3
        run: git clone --depth 1 --branch VER-2-13-3 https://github.com/freetype/freetype.git research/freetype

      - name: Build freetype-ios
        run: bash build/freetype-ios/build.sh

      # ntdll-unix compiles Wine's bcrypt/secur32/crypt32 unix sides against
      # toolchains/gnutls-ios, and without them the app link fails on
      # bcrypt_unix_call_funcs / secur32_unix_call_funcs. Nothing built that
      # prefix, so do it here: GMP -> nettle/hogweed -> GnuTLS, all static.
      - name: Restore GnuTLS iOS stack
        id: gnutlscache
        uses: actions/cache/restore@v4
        with:
          path: |
            toolchains/gnutls-ios
            build/gnutls-ios/obj
            build/gnutls-ios/src
          key: gnutls-ios-gmp6.3.0-nettle3.10.1-gnutls3.8.9-v1

      - name: Build GnuTLS stack for iOS
        if: steps.gnutlscache.outputs.cache-hit != 'true'
        run: bash build/gnutls-ios/build.sh

      - name: Verify GnuTLS iOS headers and libs
        shell: bash
        run: |
          set +e
          shopt -s nullglob
          LIBS=(toolchains/gnutls-ios/lib/*.a)
          echo "gnutls-ios libs: ${#LIBS[@]}"
          ls toolchains/gnutls-ios/include/gnutls/gnutls.h 2>&1
          if [ ! -f toolchains/gnutls-ios/include/gnutls/gnutls.h ]; then
            echo "::error::gnutls headers missing -- bcrypt/secur32 unixlibs will not link"
            exit 1
          fi

      - name: Save GnuTLS iOS stack
        if: steps.gnutlscache.outputs.cache-hit != 'true'
        uses: actions/cache/save@v4
        with:
          path: |
            toolchains/gnutls-ios
            build/gnutls-ios/obj
            build/gnutls-ios/src
          key: gnutls-ios-gmp6.3.0-nettle3.10.1-gnutls3.8.9-v1

      # Upstream's winegstreamer unix side (build/ntdll-unix) compiles against
      # toolchains/ffmpeg-ios, and the app target links the four archives from
      # app/Madeira/. The source tarball is tracked; cache the result.
      - name: Restore FFmpeg iOS
        id: ffmpegcache
        uses: actions/cache/restore@v4
        with:
          path: toolchains/ffmpeg-ios
          key: ffmpeg-ios-${{ hashFiles('build/ffmpeg/build.sh', 'build/ffmpeg/src/SHA256SUMS') }}

      - name: Build FFmpeg for iOS
        shell: bash
        run: |
          if [ "${{ steps.ffmpegcache.outputs.cache-hit }}" = "true" ]; then
            for lib in libavformat libavcodec libswresample libavutil; do
              cp toolchains/ffmpeg-ios/lib/$lib.a app/Madeira/$lib.a
            done
            echo "FFmpeg restored from cache"
          else
            bash build/ffmpeg/build.sh
          fi
          ls -la app/Madeira/libav*.a app/Madeira/libswresample.a

      - name: Save FFmpeg iOS
        if: steps.ffmpegcache.outputs.cache-hit != 'true'
        uses: actions/cache/save@v4
        with:
          path: toolchains/ffmpeg-ios
          key: ffmpeg-ios-${{ hashFiles('build/ffmpeg/build.sh', 'build/ffmpeg/src/SHA256SUMS') }}

      # A game's own *.log lines (errors, GPU / driver / display lines) in the
      # session log as [guest-log] -- the mirror this fork's wine had before the
      # build 222 switch (Ghost of Tsushima's "Failed to get GPU Driver Info").
      # Patches wine/dlls/ntdll/unix/file.c in place; the submodule pin and the
      # cache keys (wine revision) do not change. MADEIRA_GUEST_LOG=all|0.
      - name: Patch wine with the game text-log mirror
        run: |
          python3 tests/host/check-guest-log.py
          python3 tools/patch-wine-guest-log.py wine/dlls/ntdll/unix/file.c

      # madeira-bcd: the mirror keeps no line for the log-level tag "[DISPLAY]" alone. Rockstar's launcher.log
      # tags every non-error line that way, so its first 64 lines of start-up chatter used the whole budget
      # and the launcher's own error never reached the session log (19 of 20 GTA V / RDR2 logs, 2026-10-20).
      - name: Patch wine text-log mirror to ignore the [DISPLAY] log level
        run: |
          python3 tests/host/check-guest-log-tag.py
          python3 tools/patch-wine-guest-log-tag.py wine/dlls/ntdll/unix/file.c

      # madeira-bcd: RockstarService.exe's own text writes (any file name, every line, 60 lines of their own) in the
      # session log as [guest-log] svc: in the failing Rockstar Launcher runs of builds 574/576 ("Failed to connect to the
      # Rockstar Games Library Service") nothing the service itself wrote reached the log. Logging only.
      - name: Patch wine text-log mirror to mirror the Rockstar service's own files
        run: |
          python3 tests/host/check-guest-log-service.py
          python3 tools/patch-wine-guest-log-service.py wine/dlls/ntdll/unix/file.c

      # madeira-bcd: a Ren'Py game's own error files (traceback.txt, log.txt, errors.txt, stderr.txt) in the session log as
      # [guest-log]. Doki Doki Literature Club and Coming Out on Top (Python 2.7, three devices, builds 592-622) end with exit -1
      # right after pyexpat.pyd and nothing in the log says why; the reason can only be in those files. Logging only.
      - name: Patch wine text-log mirror to mirror a Ren'Py game's error files
        run: |
          python3 tests/host/check-guest-log-renpy.py
          python3 tools/patch-wine-guest-log-renpy.py wine/dlls/ntdll/unix/file.c

      # madeira-bcd (round 624, Blasphemous JPZBGJ): the managed stack trace under an exception line ("  at Foo.Bar () ...", Unity's
      # "(Filename: ...)") reaches the session log too: 12 frames after each exception line, 36 a process, inside the line budget.
      # The base mirror is already in the wine mirror's source, so this is a patch of its own. Logging only.
      - name: Patch wine text-log mirror to keep the stack trace under an exception line
        run: |
          python3 tests/host/check-guest-log-trace.py
          python3 tools/patch-wine-guest-log-trace.py wine/dlls/ntdll/unix/file.c

      # madeira-bcd (round 630, agent R): a launcher's own log names the player's accounts (Rockstar's launcher.log: "Steam user:",
      # "Saved profile for", "Signed in online to profile:", "Gamer:"); the mirror keeps such a line up to that word and drops the
      # name, so an uploaded log never holds it. Logging only.
      - name: Patch wine text-log mirror to drop account names
        run: |
          python3 tests/host/check-guest-log-redact.py
          python3 tools/patch-wine-guest-log-redact.py wine/dlls/ntdll/unix/file.c

      # [file-trace]: every guest open / attribute query with its status when
      # MADEIRA_FILE_TRACE=1 (GTA V Enhanced's "incomplete installation"
      # screen names no file; [file-fail] stops after 64 DLL-search misses).
      - name: Patch wine with the guest file trace
        run: python3 tools/patch-wine-file-trace.py wine/dlls/ntdll/unix/file.c

      # [file-census] (round 624, agent D2 S19: Counter-Strike: Source's CreateFileA storm, QJKJZJ / RQ8CSF): Wine's file lookups
      # per ten-second window (whole-path shortcut, component lookups, misses, directory scans, time spent, the slowest path), a
      # line only for a window with 200 component lookups or more, 60 lines a session; log only; env MADEIRA_FILE_CENSUS = 0 off.
      - name: Patch wine with the file-lookup census
        run: |
          python3 tests/host/check-wine-file-census.py
          python3 tools/patch-wine-file-census.py wine/dlls/ntdll/unix/file.c

      # A file opened as \??\GLOBALROOT\??\C:\... (or \DosDevices\GLOBALROOT\??\C:\...) failed with "path not found"; the DOS path
      # behind the wrapper now reaches the drive resolver. Only names that failed before change (iOS only).
      # Based on thebcd69/bcd-games#16 by le0-VV.
      - name: Check and patch GLOBALROOT DOS paths
        run: |
          python3 tests/host/check-globalroot.py
          python3 tools/patch-wine-globalroot.py wine/dlls/ntdll/unix/file.c

      - name: Check and patch opt-in app-local DLL reads
        run: |
          python3 tests/host/check-app-local-dll.py
          python3 tools/patch-wine-app-local-dll.py wine/dlls/ntdll/unix/file.c

      # madeira-bcd: GetFileSizeEx and the other size/index/end-of-file queries from one
      # fstat instead of fstat + two xattr reads (env.MADEIRA_FILE_INFO_FULL=1 undoes it).
      - name: Patch wine with size queries from one fstat
        run: python3 tools/patch-wine-file-info-fstat.py wine/dlls/ntdll/unix/file.c

      # madeira-bcd (round 630, agent O1 S14): Ren'Py 6.99 games (Doki Doki Literature Club, Coming Out on Top) stopped at start-up:
      # Python's platform.mac_ver() found the iOS host's SystemVersion.plist through Wine's "/path is a Unix path" rule and called
      # os.uname(), which Python for Windows lacks. Exactly that one file is reported as not found to Windows programs.
      - name: Patch wine to hide the host's version file from Windows programs
        run: |
          python3 tests/host/check-hide-host-version-plist.py
          python3 tools/patch-wine-hide-host-version-plist.py wine/dlls/ntdll/unix/file.c

      - name: Check opt-in graphics DLL lifetime
        run: python3 tests/host/check-graphics-pin.py

      # madeira-bcd: RDR2 on build 476 loaded xinput1_4.dll only at its first
      # controller read, with the JIT pool full (MADEIRA_PRELOAD_DLLS).
      - name: Check opt-in DLL preload with the D3D12 device
        run: python3 tests/host/check-preload-dlls.py

      - name: Check ARM64EC allocator span geometry
        run: python3 tests/host/check-rpmalloc-span8.py

      - name: Check pool failure capacity diagnostics
        run: python3 tests/host/check-pool-failure-census.py

      - name: Check per-thread trampoline capacity
        run: python3 tests/host/check-teb-trampoline-capacity.py

      - name: Check read-only image patch diagnostics
        run: |
          python3 tests/host/check-image-patch-trace.py
          python3 tests/host/check-iat-sync-owner.py

      - name: Check virtual storage device contracts
        run: python3 tests/host/check-storage-device.py

      - name: Check paired IPA and OTA publication contracts
        run: python3 tests/host/check-ota-variants.py

      - name: Check the app's iOS 18 minimum
        run: python3 tests/host/check-ios-minimum.py

      # madeira-bcd (iOS 18 audit, 2026-10-18): GPUs with Tier 1 argument buffers
      # (A12 and older) and the A10's CPU get a message instead of a crash; A14 and
      # later pass untouched (DeviceCapability.swift).
      - name: Check the device gate
        run: python3 tests/host/check-device-gate.py

      # madeira-bcd: frame generation and ARM64-native Direct3D 11 hidden or refused
      # below iOS 26, where they cannot work; iOS 26 and later unchanged.
      - name: Check iOS 26-only features below iOS 26
        run: python3 tests/host/check-frame-gen-ios26.py

      # madeira-bcd env.MADEIRA_PAD_SYSTEM_GESTURES / env.MADEIRA_DEFER_EDGES (opt-in):
      # controller Home/Create buttons and edge swipes go to the game first.
      - name: Check system gestures during play
        run: python3 tests/host/check-device-system-gestures.py

      - name: Check the bundled third-party notices
        run: python3 tests/host/check-notices.py

      - name: Check WoW window guard reservation contracts
        run: |
          python3 tests/host/check-wow-guard.py
          python3 tests/host/check-lazy-windows.py

      # round 579: a .bat/.cmd library entry starts C:\windows\system32\cmd.exe, which only aarch64-windows ships; the
      # name heuristic's arm64ec-windows core ended every such start in c000007b ("could not load kernel32.dll", 0.5 s).
      # cmd.exe, and nothing else, takes the aarch64-windows core (WineProcessBridge.m madeira_target_is_cmd).
      - name: Check the session core choice (cmd.exe in aarch64-windows)
        run: |
          python3 tests/host/check-launch-routing.py
          python3 tests/host/check-cmd-bundle.py

      - name: Check JIT pool image placement contracts
        run: |
          python3 tests/host/check-pool-low-images.py
          python3 tests/host/check-x64-image-nocopy.py
          python3 tests/host/check-swap-images.py
          python3 tests/host/check-ec-hook.py
          python3 tests/host/check-x64-graphics-entry.py
          python3 tests/host/check-pool-startup-budget.py --require-swift
          python3 tests/host/check-pool-placement.py
          python3 tests/host/check-pool-split.py
          python3 tests/host/check-pool-low.py
          python3 tests/host/check-pool-code-exit.py

      # ajan2-tani: failure-path-only guest diagnostics ([entry-fail] for FEX's hlt / NoExec thunks,
      # [badrip] for a non-canonical guest RIP, [wow-initblock] when an i386 boot replaces another
      # ntdll base): Age of Empires IV, Garry's Mod, Vampire Survivors, art of rally. Log only; the
      # test compiles the production helpers and runs them on constructed memory (macOS).
      - name: Check the guest failure-path diagnostics
        run: python3 tests/host/check-guest-fail-diag.py

      # madeira-bcd ajan3-dyinglight: [av-args] (build/ntdll-unix/ios_av_args_diag.h), the registers of a
      # NULL-class guest fault that point at a module, an object with a vtable or text. Dying Light dies
      # on `obj = singleton->vfunc102(buf, "name"); obj->field_0x4c` with obj NULL. Log only; the test
      # compiles the production header and runs it on constructed memory (macOS).
      - name: Check the [av-args] diagnostic
        run: python3 tests/host/check-av-args-diag.py

      # madeira-bcd ajan5-mhs3: [rwx-fault] (build/ntdll-unix/ios_rwx_fault_diag.h), a guest fault in a page the
      # emulator translated from and that may have been rewritten under it: the host page's real protection, Wine's
      # byte for each 4 KB page of it, and the loaded image's bytes next to the pool copy's (Monster Hunter Stories 3
      # Trial, Monster Hunter Rise). Log only; the test compiles the production header and runs it on constructed
      # memory (macOS).
      - name: Check the [rwx-fault] diagnostic
        run: python3 tests/host/check-rwx-fault-diag.py

      # madeira-bcd ios18-jit: JIT readiness on P_TRACED, the SIGTRAP fallback when BCD starts
      # debugged, no exit after a failed pool request, and the debugger-less JIT pool where TXM
      # does not police code (iOS 18; iOS 26 without TXM). Runs JITAllocator.c's own probe.
      - name: Check JIT readiness and the debugger-less pool
        run: python3 tests/host/check-jit-no-debugger.py --require-swift

      # madeira-bcd pool-reserve: the JIT pool's range reserved at exec time (pool-bss, only in a
      # build made with BCD_POOL_BSS_MB) and the dropped mode-A floor (pool-floor = 0). The default
      # build carries no reservation; runs JITAllocator.c's own functions with a real __BCDPOOL segment.
      - name: Check the JIT pool reservation and pool-floor
        run: python3 tests/host/check-pool-reserve.py

      # [dns]: every guest getaddrinfo by name, and MADEIRA_DNS_TIMEOUT_MS to
      # bound one (Social Club's Chromium sat in three getaddrinfo calls for a
      # minute, GTA V Enhanced build 378). Patches wine/dlls/ws2_32/unixlib.c.
      - name: Patch wine with the DNS trace
        run: python3 tools/patch-wine-dns-trace.py wine/dlls/ws2_32/unixlib.c

      # madeira-bcd: D3DXCreateVolumeTextureFromResourceExA/W were stubs that aborted the program
      # (GTA IV, build 574); implemented like D3DXCreateTextureFromResourceExW.
      - name: Patch wine d3dx9 volume textures from resources
        run: python3 tools/patch-wine-d3dx9-volume-resource.py wine

      # madeira-bcd (round 630, Skyrim 93EMSH): opt-in (env.MADEIRA_XAUDIO2_CALLBACK_ORDER = 1): xaudio2's RegisterForCallbacks
      # publishes the callback array before its count, so FAudio's audio thread never reads a NULL array. Unset: unchanged.
      # The i386 farm builds it; the arm64ec copies stay the shipped ones.
      - name: Patch wine xaudio2 engine callbacks (opt-in)
        run: |
          python3 tests/host/check-xaudio2-callbacks.py
          python3 tools/patch-wine-xaudio2-callbacks.py wine

      # madeira-bcd (round 630, S.T.A.L.K.E.R. RVFPNE): Wine's HLSL compiler (vkd3d-shader) reads `point` as a name unless white
      # space and a type or a modifier follow it (the geometry-shader keyword); a Direct3D 9 shader naming a value `point` was a
      # syntax error. Sources that compile today tokenise the same. The i386 farm builds it (flex regenerates the lexer).
      - name: Patch wine vkd3d-shader to read point as a name
        run: |
          python3 tests/host/check-vkd3d-point-ident.py
          python3 tools/patch-wine-vkd3d-point-ident.py wine

      # madeira-bcd: [rpc-np] names the status of a failed RPC named-pipe read (Steam's CEG service
      # install and RockstarService failed their svcctl bind with 1726, build 574). Logging only.
      - name: Patch wine rpcrt4 named-pipe diagnostics
        run: python3 tools/patch-wine-rpc-np-diag.py wine

      # madeira-bcd: [msgbox-origin] / [pf-xmmi64] name the CPU check Burnout Paradise fails ("CPU Error ...
      # does not support the SSE2 Command Set", build 574 log AQY7NM; CPUID and the PF_XMMI64 tables say
      # SSE2 is present, so the game's check is unknown). Logging only.
      - name: Patch wine CPU-error diagnostics
        run: python3 tools/patch-wine-cpu-error-diag.py wine

      # madeira-bcd (build 580): the [steam-api] report for 64-bit processes. A 64-bit process handles OutputDebugString
      # inside the PE ntdll (a committed binary), so NtRaiseException never saw steam_api's "no running Steam" message there;
      # unixcall_wine_dbg_write (debug.c) now calls thread_ios.c's ios_steam_api_dbg_hook after it has written a log line.
      # Logging only; the line that triggers it is the PE ntdll's own "[exc] ml812 OutputDebugStringA" line.
      - name: Patch wine with the 64-bit [steam-api] hook
        run: |
          python3 tests/host/check-steam-api-diag.py
          python3 tools/patch-ntdll-unix-dbg-write-hook.py wine/dlls/ntdll/unix/debug.c

      - name: Patch wine with fault-safe waiter diagnostics
        run: python3 tools/patch-wine-waiter-read.py wine/dlls/ntdll/unix/sync.c

      # madeira-bcd: env MADEIRA_LOCK_ORPHAN = stamped (opt-in): the orphan-lock
      # reaper counts strikes per cycle, not per parked waiter, and releases only
      # locks a live thread has stamped. As it was, it released live locks
      # (Horizon Zero Dawn's "Error" stop, build 479). Unset, nothing changes.
      - name: Patch wine with the opt-in safe orphan-lock reaper
        run: |
          python3 tests/host/check-lock-orphan.py
          python3 tools/patch-wine-lock-orphan.py wine/dlls/ntdll/unix/sync.c

      # madeira-bcd (round 630, A2 S2): the monitor and the reaper read lock words through the fault-safe reader; msync() accepts the
      # PROT_NONE page of a dead 32-bit program's released window, and the plain read ended the app (the Steam client 9PB1B5).
      - name: Patch wine with the fault-safe orphan-lock reads
        run: |
          python3 tests/host/check-orphan-safe-read.py
          python3 tools/patch-wine-orphan-safe-read.py wine/dlls/ntdll/unix/sync.c

      # madeira-bcd: bcd.cfg yield-mode (opt-in): the yield primitive behind
      # SwitchToThread / Sleep(0) (switch or a bounded depress instead of
      # swtch_pri). Unset, nothing changes. Checked by "Check yield-mode".
      - name: Patch wine with the opt-in yield mode
        run: python3 tools/patch-wine-yield-mode.py wine/dlls/ntdll/unix/sync.c

      # bcd.cfg avail-phys = 1 (opt-in): GlobalMemoryStatusEx's available
      # physical memory is what remains before this app's memory limit, so
      # Chromium (Social Club, Steam) sees memory pressure before iOS kills the
      # app. Patches wine/dlls/ntdll/unix/system.c; off, nothing changes.
      - name: Patch wine with the opt-in available memory
        run: |
          python3 tests/host/check-avail-phys.py
          python3 tools/patch-wine-avail-phys.py wine/dlls/ntdll/unix/system.c

      # Self-modifying-code fault storms (RockstarService, builds 435-437):
      # the ARM64EC SMC path decides plain and backpatched stores without
      # FEX's backpatch lock, and the PE ntdll's uncapped "[rtcs] pre" line is
      # kept to 10 per second per thread (MADEIRA_RTCS_LOG=all|N).
      - name: Check the SMC store fast path and the [rtcs] log cap
        run: |
          python3 tests/host/check-smc-store-fastpath.py
          python3 tests/host/check-rtcs-cap.py

      - name: Build ntdll-unix
        # Keep going so one run reports every broken stage (and caches FEX and
        # LLVM). "Verify all linked archives exist" still fails the job before
        # anything is archived if this produced no library.
        continue-on-error: true
        run: bash build/ntdll-unix/build.sh 2>&1 | tee "$GITHUB_WORKSPACE/ntdll.log"; exit ${PIPESTATUS[0]}

      # The link failure showed up only at xcodebuild time; catch it here.
      # nm without -U also matches the UNDEFINED references virtual_ios.o
      # makes to these same names, which is why the first version of this
      # check passed while the linker still failed. -gU = external AND
      # defined only.
      - name: Verify ntdll-unix exports the crypto call tables
        continue-on-error: true
        shell: bash
        run: |
          set +e
          OBJ=build/ntdll-unix/obj
          # nm's own flags do the filtering -- -g external, -U defined-only --
          # so match on the symbol name alone. Anchoring the whole line
          # against "addr TYPE _name" is what made this check report every
          # table missing even when the objects plainly defined them: the
          # archive-member output format does not match that shape.
          nm -gU app/Madeira/libntdll_unix.a 2>/dev/null \
            | awk '{print $NF}' | sort -u > defined-syms.txt
          echo "defined external symbols in libntdll_unix.a: $(wc -l < defined-syms.txt | tr -d ' ')"
          MISSING=""
          for s in bcrypt_unix_call_funcs secur32_unix_call_funcs crypt32_unix_call_funcs \
                   ws2_32_unix_call_funcs dwrite_unix_call_funcs winedmo_unix_call_funcs; do
            if grep -qx "_$s" defined-syms.txt; then
              echo "  OK   $s (defined)"
            else
              echo "  MISS $s"; MISSING="$MISSING $s"
            fi
          done
          echo "-- object sizes (an empty object means its #ifdef guard was off) --"
          for o in ws2_32_unixlib bcrypt_unixlib secur32_unixlib crypt32_unixlib dwrite_unixlib winedmo_unixlib; do
            if [ -f "$OBJ/$o.o" ]; then
              printf '  %-18s %8s bytes, %s external defs\n' "$o" \
                "$(wc -c < "$OBJ/$o.o" | tr -d ' ')" \
                "$(nm -gU "$OBJ/$o.o" 2>/dev/null | wc -l | tr -d ' ')"
            else
              echo "  $o.o ABSENT"
            fi
          done
          if [ -n "$MISSING" ]; then
            echo "-- raw nm shape for bcrypt_unixlib.o --"
            nm -gU "$OBJ/bcrypt_unixlib.o" 2>&1 | head -5 | cat -A | head -5
            echo "::error::libntdll_unix.a defines none of ::$MISSING"
            for o in bcrypt_unixlib secur32_unixlib crypt32_unixlib; do
              if [ -s "$OBJ/$o.err" ]; then
                E=$(grep -m4 -B1 -A4 "error:" "$OBJ/$o.err" | head -c 1500 | python3 -c "import sys; print('%0A'.join(sys.stdin.read().splitlines()))")
                echo "::error::$o compile errors :: $E"
              fi
            done
            exit 1
          fi

      # madeira-bcd: Windows Media Video through Media Foundation's ASF source (Resident Evil 2 and 7: c0000135 for
      # mfasfsrcsnk.dll, then a NULL read). The keyed wiring (FFmpeg, the 64-bit table only, winedmo for 64-bit callers,
      # the opt-in DLLs and the mfasfsrcsnk patch), then the unix sides on the host: pixel conversions, the WMV transform
      # through the unix call entries, the winedmo demuxer with the PE callbacks emulated. Builds a host FFmpeg from the
      # tracked tarball (a few minutes, cached in ~/.cache/madeira-host-ffmpeg).
      - name: Check ASF and WMV
        run: python3 tests/host/check-wmv-asf.py

      # Round 626 (agent V; Unity cutscenes: Silksong DF0537, Hollow Knight H3SBFV, Power Drill Massacre 641PEM): BCD's raw video converter
      # wg_transform (NV12/YV12/I420 to RGB/YUV of the same size), behind env.MADEIRA_WG_VPROC = 1; key off is the old refusal.
      - name: Check the raw video converter
        run: python3 tests/host/check-vproc.py

      # Windows thread priorities must not demote USER_INTERACTIVE guest
      # threads onto the efficiency cores (Crysis's main thread ran there).
      - name: Patch wineserver thread priorities (keep pthread QoS)
        run: python3 tools/patch-wine-thread-qos.py

      # madeira-bcd: the cancel_async request (CancelIo, NtCancelIoFile[Ex]) keeps each async alive while it
      # cancels it. On iOS the APC for a busy thread cannot be queued, the async completes (and is freed) inside
      # cancel_async, and cancel_process_async then wrote into it: the whole app died in req_cancel_async
      # (BeamNG.drive, builds 574 and 576). Where cancel already worked nothing changes
      # (tests/host/check-wineserver-async-cancel.py runs the real async.c on the host).
      - name: Patch the wineserver's cancel_process_async (keep the async alive while it is cancelled)
        run: |
          python3 tests/host/check-wineserver-async-cancel.py
          python3 tools/patch-wineserver-async-cancel.py wine

      # madeira-bcd (round 624, agent C S10; MGS Ground Zeroes): the wineserver names each new process and a refused
      # init_process_done ([srv-proc], 64 lines each); the refusal itself is unchanged.
      - name: Patch the wineserver's process log
        run: |
          python3 tests/host/check-wineserver-proc-log.py
          python3 tools/patch-wineserver-proc-log.py wine

      # madeira-bcd: a WM_PAINT that never ends no longer starves WM_TIMER
      # (build/wineserver/queue_ios.c; the Rockstar Games Launcher installer
      # stayed at "Preparing to Install..."; 2026-10-12).
      - name: Check WM_TIMER fairness in the wineserver
        run: python3 tests/host/check-timer-fairness.py

      # madeira-bcd: MADEIRA_AUDIO_SPATIAL=0 leaves Wine's spatial audio out
      # (Horizon Forbidden West's 7.1.4 spatial bed got 23 % of its audio).
      - name: Check audio spatial switch
        run: python3 tests/host/check-audio-spatial.py

      # madeira-bcd env.MADEIRA_AUDIO_RESUME = 1 (opt-in): game audio comes back
      # after a call, Siri or an app switch, and its clock runs on meanwhile
      # (audio_null_ios.c, WineProcessBridge.m; iOS 18 audit, every iOS).
      - name: Check audio after an interruption
        run: python3 tests/host/check-audio-resume.py

      # The game's volume at the audio endpoint (round 604; env.MADEIRA_AUDIO_GAIN, build/ntdll-unix/audio_null_ios.c) and the Sound rows of a game's page
      # (BCDGameSound.swift): unchanged unless 10..200, exact scaling, read once, one comparison in the render callback when it is off.
      - name: Check the audio volume
        run: python3 tests/host/check-audio-gain.py

      # BCD (round 603): MIDI music. A game's MIDI output plays through Apple's synthesizer and a General MIDI SoundFont
      # (build/ntdll-unix/bcd_midi_ios.c, bcd_midi_synth_ios.m; env.MADEIRA_MIDI = 0 turns it off). The driver check runs
      # winmm's messages in mmdevapi's 64-bit and 32-bit argument blocks against a recording synthesizer.
      - name: Check the MIDI driver
        run: python3 tests/host/check-midi-driver.py

      # The SoundFont is a third party's file (TimGM6mb, GPL-2.0, app/Madeira/soundfont/NOTICE-TimGM6mb.txt): downloaded and
      # checked against its SHA-256 here (tools/fetch-soundfont.sh), never committed. Without it the build still works and
      # games' MIDI music stays silent, as before.
      - name: Fetch the General MIDI sound bank
        run: bash tools/fetch-soundfont.sh

      - name: Check the MIDI synthesizer against Apple's
        run: python3 tests/host/check-midi-synth.py

      # BCD (round 603): save backups per game (app/Madeira/BCDSaveBackups/, BCDGameSaves.swift): where a game saves, a dated
      # zip in Documents/Save Backups, a restore that asks first, the automatic backup when a game closes (off by default).
      - name: Check the save backups
        run: python3 tests/host/check-game-saves.py --require-swift

      # BCD (round 604): game setup (app/Madeira/BCDGameSetup/, BCDGameSetup*.swift): the Windows version, DLL components, FEX presets,
      # game fixes (INI, registry, delete, write, redist) and the Wine desktop's text size and colours, all lines of the game's own file.
      - name: Check the game setup
        run: python3 tests/host/check-game-setup.py --require-swift

      # BCD (round 604): the start helper (bcd-helper/): a delay before a game starts, a second program that runs beside it and window rules,
      # in a small Windows program the app copies beside the start script. core.h runs on the host against a fake system.
      - name: Check the start helper
        run: python3 tests/host/check-bcd-helper.py

      # madeira-bcd: MADEIRA_GAME_WINDOWS=2 (opt-in) draws a GDI game window that
      # covers the guest desktop (Warcraft II BNE: sound, no picture).
      - name: Check game windows cover switch
        run: python3 tests/host/check-game-windows-cover.py

      # madeira-bcd: d3d12-fl-12-1 = 1 and d3d12-sm-6-7 = 1 (opt-in) claim
      # feature level 12_1 and shader model 6.7 (Microsoft Flight Simulator 2024).
      - name: Check D3D12 feature level 12_1 and shader model 6.7 switches
        run: python3 tests/host/check-d3d12-fl-12-1.py

      # madeira-bcd env.MADEIRA_D3D12_CAPS_BY_FAMILY = 1 (opt-in): 64-bit atomics
      # claimed only on Apple9, wave operations only from Apple7 (iOS 18 audit).
      - name: Check D3D12 capability answers by GPU family
        run: python3 tests/host/check-d3d12-caps-family.py

      # madeira-bcd: d3d12-pipeline-library = 1 (opt-in): CreatePipelineLibrary makes a library that keeps
      # no pipeline instead of failing (Returnal ends in a fatal error without it, build 574).
      - name: Check the opt-in D3D12 pipeline library
        run: python3 tests/host/check-d3d12-pipeline-library.py

      # madeira-bcd (round 2026-10-24): d3d12-pso-cached-blob = 1 (opt-in): ID3D12PipelineState::GetCachedBlob answers a
      # 16-byte blob instead of E_NOTIMPL (Resident Evil Requiem's demo ends in its fatal-error dialog right after the call).
      - name: Check the opt-in D3D12 pipeline cached blob
        run: python3 tests/host/check-d3d12-pso-cached-blob.py

      # madeira-bcd (round 626): d3d12-heap-va-align = 1 (opt-in): a D3D12 heap with a placement alignment of 64 KB or more starts on a
      # 64 KB GPU address (Clair Obscur: Expedition 33's transient allocator got a NULL buffer from a heap Metal placed 32 KB off).
      - name: Check the opt-in D3D12 heap address alignment
        run: python3 tests/host/check-d3d12-heap-va-align.py

      # madeira-bcd (round 2026-10-24): wow64win passes a class atom (CreateWindowEx's class, UNICODE_STRING.Buffer, CREATESTRUCT.lpszClass)
      # through as an atom instead of adding the guest window base to it (Bioshock Remastered and LEGO Batman 2 died in their first window).
      - name: Check that wow64win keeps a class atom an atom
        run: python3 tests/host/check-wow64win-atoms.py

      # madeira-bcd (round 2026-10-24): env.BCD_EPIC_HOST_START = 1 (opt-in): an Epic game's signed-in start keeps BCD Host as its first program
      # (builds 590-597 set it and applyEnvironment's second configureLaunch put the game's own program back: the host never ran).
      - name: Check the opt-in Epic host start
        run: python3 tests/host/check-epic-host-hold.py

      # madeira-bcd (round 578): the runtime names a texture view Metal would refuse ([mip0-view]; Miles Morales'
      # level-1 UAV on a MipLevels 0 texture, builds 574/576); the fix itself is mip0-full = 1.
      - name: Check the mip0-view diagnostic
        run: python3 tests/host/check-mip0-view-diag.py

      - name: Build base libwineserver.a from wine/server sources
        shell: bash
        run: |
          SDK=$(xcrun --sdk iphoneos --show-sdk-path)
          BD="$GITHUB_WORKSPACE/build/wineserver"
          OBJ="$BD/obj"
          mkdir -p "$OBJ/base"
          FLAGS=(-arch arm64 -isysroot "$SDK" -miphoneos-version-min=17.0 -O2
            -I"$GITHUB_WORKSPACE/wine/include" -I"$GITHUB_WORKSPACE/wine/include/wine"
            -I"$GITHUB_WORKSPACE/wine/build-macos/include"
            -I"$BD" -I"$GITHUB_WORKSPACE/wine/server"
            -I"$GITHUB_WORKSPACE/build/ntdll-unix/shims"
            -include "$BD/config_ios.h" -include stdarg.h
            -include "$BD/unicode_fix.h" -include "$BD/wineserver_ios_kill.h"
            -DBINDIR=\"/usr/local/bin\" -DDATADIR=\"/usr/local/share\"
            -D__WINESRC__ -DWINE_IOS=1 -Dmain=wineserver_main
            -Wno-implicit-function-declaration)
          OK=0; BAD=0; BADLIST=""
          for src in "$GITHUB_WORKSPACE"/wine/server/*.c; do
            n=$(basename "$src" .c)
            if xcrun -sdk iphoneos clang "${FLAGS[@]}" -c "$src" -o "$OBJ/base/$n.o" 2>"$OBJ/base/$n.err"; then
              OK=$((OK+1))
            else
              BAD=$((BAD+1)); BADLIST="$BADLIST $n"
            fi
          done
          echo "base compile: $OK ok, $BAD failed:$BADLIST"
          echo "::notice::base wineserver compile :: $OK ok, $BAD failed:$BADLIST"
          ar rcs "$OBJ/libwineserver.a" "$OBJ"/base/*.o
          echo "::notice::base libwineserver.a $(wc -c < "$OBJ/libwineserver.a" | tr -d ' ') bytes"
          # surface the first few real failures so we can judge if any matter
          M=0
          for f in $(grep -rl "error:" "$OBJ/base" --include="*.err" 2>/dev/null | head -3); do
            M=$((M+1))
            MSG=$(grep -m3 -A3 "error:" "$f" | head -c 1200 | python3 -c "import sys; print('%0A'.join(sys.stdin.read().splitlines()))")
            echo "::error::base compile error in $f :: $MSG"
          done

      - name: Build wineserver
        # Keep going so one run reports every broken stage (and caches FEX and
        # LLVM). "Verify all linked archives exist" still fails the job before
        # anything is archived if this produced no library.
        continue-on-error: true
        run: bash build/wineserver/build.sh 2>&1 | tee "$GITHUB_WORKSPACE/wineserver.log"; exit ${PIPESTATUS[0]}

      - name: Build win32u-unix
        # Keep going so one run reports every broken stage (and caches FEX and
        # LLVM). "Verify all linked archives exist" still fails the job before
        # anything is archived if this produced no library.
        continue-on-error: true
        run: bash build/win32u-unix/build.sh 2>&1 | tee "$GITHUB_WORKSPACE/win32u.log"; exit ${PIPESTATUS[0]}

      - name: Restore llvm-mingw
        id: mingwcache
        uses: actions/cache/restore@v4
        with:
          path: toolchains/llvm-mingw-20260421-ucrt-macos-universal
          key: llvm-mingw-20260421-ucrt-macos-universal

      - name: Install ninja/meson and fetch llvm-mingw
        shell: bash
        run: |
          brew install ninja meson
          mkdir -p toolchains
          MINGW=toolchains/llvm-mingw-20260421-ucrt-macos-universal
          if [ -x "$MINGW/bin/arm64ec-w64-mingw32-clang++" ]; then
            echo "::notice::llvm-mingw restored from cache"
            echo "MINGW_OK=1" >> "$GITHUB_ENV"
          else
            # Piping curl into tar hid a failed download. Run 71 received 92
            # bytes of error page, tar said "Unrecognized archive format", the
            # step exited 0, and the IPA shipped the committed xtajit64.dll
            # instead of ours -- with the job green throughout. Download to a
            # file, retry, and check what arrived before unpacking.
            URL=https://github.com/mstorsjo/llvm-mingw/releases/download/20260421/llvm-mingw-20260421-ucrt-macos-universal.tar.xz
            for try in 1 2 3; do
              curl -fL --retry 3 --retry-delay 5 -o /tmp/mingw.tar.xz "$URL" && break
              echo "download attempt $try failed"
              sleep $((try * 5))
            done
            SZ=$(wc -c < /tmp/mingw.tar.xz 2>/dev/null || echo 0)
            echo "downloaded $SZ bytes"
            if [ "$SZ" -lt 10000000 ]; then
              echo "::error::llvm-mingw download failed -- $SZ bytes is not an archive; \
          the IPA will carry the COMMITTED xtajit64.dll, not the one we build"
            else
              tar -xJf /tmp/mingw.tar.xz -C toolchains/
              echo "::notice::llvm-mingw unpacked ($SZ bytes)"
              echo "MINGW_OK=1" >> "$GITHUB_ENV"
            fi
          fi
          ls toolchains/

      - name: Save llvm-mingw
        if: env.MINGW_OK == '1' && steps.mingwcache.outputs.cache-hit != 'true'
        uses: actions/cache/save@v4
        with:
          path: toolchains/llvm-mingw-20260421-ucrt-macos-universal
          key: llvm-mingw-20260421-ucrt-macos-universal

      # env.MADEIRA_DXGI_BUDGET_EVENTS = 1 (opt-in): the budget-change events
      # tools/patch-dxgi-budget-events.py adds to dxgi-src.dll, checked (and
      # compiled for arm64ec) before the build below applies it.
      - name: Check opt-in DXGI budget events
        env:
          MINGW: ${{ github.workspace }}/toolchains/llvm-mingw-20260421-ucrt-macos-universal/bin
        run: python3 tests/host/check-dxgi-budget-events.py

      # madeira-bcd: DXMT's 64-bit dxgi.dll compiled from the dxmt submodule
      # with IDXGIFactory7 + EnumAdapterByLuid (tools/patch-dxgi-factory7.py, on
      # a copy). The committed arm64ec dxgi.dll stops at IDXGIFactory6 and GTA V
      # Enhanced aborts with ERR_GFX_D3D_NOD3D12 without Factory7 (build 296).
      # Shipped as arm64ec-windows/dxgi-src.dll NEXT TO upstream's dxgi.dll,
      # which stays the default; a game opts in with env.MADEIRA_DXGI_SRC = 1
      # (WineProcessBridge.m). Runs before every DXMT patch step, so it compiles
      # the pristine pin, and it reports whether the unpatched build reproduces
      # upstream's binary. A failure only warns: nothing is shipped and
      # upstream's dxgi.dll goes out alone, as before. Since 2026-10-02 it also
      # applies tools/patch-dxgi-umd-version.py to a copy of dxgi_adapter.cpp:
      # CheckInterfaceSupport's UMD version comes from D3DKMT when
      # env.MADEIRA_KMT_ADAPTER = 1 (else ~0, upstream). Since 2026-10-09 also
      # tools/patch-dxgi-budget-events.py: video-memory budget-change events
      # when env.MADEIRA_DXGI_BUDGET_EVENTS = 1 (a failed patch only warns).
      - name: Build dxgi-src.dll (DXMT dxgi from source, IDXGIFactory7)
        continue-on-error: true
        run: bash tools/build-dxgi-dll.sh

      # env.DXMT_SMALL_RINGS (opt-in): 4 MB staging ring blocks for the
      # programs it names (tools/patch-d3d11-src-small-rings.py), checked (and
      # compiled for arm64ec) before the build below applies it.
      - name: Check opt-in small staging rings
        env:
          MINGW: ${{ github.workspace }}/toolchains/llvm-mingw-20260421-ucrt-macos-universal/bin
        run: python3 tests/host/check-d3d11-small-rings.py

      # madeira-bcd: DXMT's 64-bit d3d11.dll compiled from the dxmt submodule
      # with SwapDeviceContextState implemented (tools/patch-dxmt-context-state-
      # swap.py, on a copy). The committed arm64ec d3d11.dll aborts there, and
      # Wine's d2d1 calls it: Rockstar Games Launcher exits with code 3 (build
      # 366 still logged "SwapDeviceContextState is not implemented", as the
      # "Patch DXMT context state swap" step below reaches no 64-bit build).
      # Shipped as arm64ec-windows/d3d11-src.dll NEXT TO upstream's d3d11.dll,
      # which stays the default; a game opts in with env.MADEIRA_D3D11_SRC = 1
      # (WineProcessBridge.m). Runs before every DXMT patch step, so it compiles
      # the pristine pin, and it reports whether the unpatched build reproduces
      # upstream's binary. A failure only warns: nothing is shipped. Since
      # 2026-10-09 the DXMT core is compiled from a copy as well, with
      # tools/patch-d3d11-src-small-rings.py: 4 MB staging ring blocks for the
      # programs env.DXMT_SMALL_RINGS names (a failed patch only warns). Since
      # the 2026-10-15 upstream merge the pin and upstream's d3d11.dll carry
      # both patches: the script says so and builds nothing.
      - name: Build d3d11-src.dll (DXMT d3d11 from source, SwapDeviceContextState)
        continue-on-error: true
        run: bash tools/build-d3d11-dll.sh

      # madeira-bcd: DXMT's Direct3D 9 for 64-bit games (env.MADEIRA_D3D9_X64 = dxmt, off by default): the wiring, the opt-in
      # gates, the list entry and the auto-tune rules, and (with the toolchain, as here) a compile and link of the arm64ec DLL
      # into a scratch directory that proves the script writes d3d9-dxmt.dll and nothing else.
      - name: Check the opt-in 64-bit Direct3D 9 (DXMT)
        env:
          MINGW: ${{ github.workspace }}/toolchains/llvm-mingw-20260421-ucrt-macos-universal/bin
        run: python3 tests/host/check-d3d9-x64.py

      # The 64-bit guest fault report of d3d9-dxmt.dll ("[fault-dump]", Darksiders II's crash after its intro video): the portable
      # core against fake memory laid out like the crash, the glue for arm64ec, and that nothing but the ARM64EC d3d9 build compiles it.
      - name: Check the 64-bit fault report (d3d9-dxmt.dll)
        env:
          MINGW: ${{ github.workspace }}/toolchains/llvm-mingw-20260421-ucrt-macos-universal/bin
        run: python3 tests/host/check-d3d9-fault-dump.py

      # madeira-bcd (round 602): DXMT's Direct3D 9 as the default of a 64-bit game whose folder shows no Direct3D 11, DXGI or Direct3D 12:
      # the production BCDGraphicsScan.swift compiled with swiftc and run on synthetic game folders (Unity, Unreal, Chromium, 32-bit,
      # unsure scans), the one-line hook and the game's own word winning.
      - name: Check the 64-bit Direct3D 9 default (game folder scan)
        run: python3 tests/host/check-d3d9-x64-default.py
      - name: Check the 64-bit Direct3D 9 default's remembered answers
        run: python3 tests/host/check-d3d9-x64-cache.py

      # madeira-bcd (round 602): the two opt-in 32-bit replacements, crosire's d3d8to9 (env.MADEIRA_D3D8 = d3d9) and cnc-ddraw
      # (env.MADEIRA_DDRAW = cnc): the vendored sources byte for byte, the build scripts, the link helper (BCDGraphicsRoutes.c, compiled
      # and run on temporary folders), the bridge hook, the catalog, the list policy and auto-tune's rules.
      - name: Check the Direct3D 8 and DirectDraw routes (d3d8to9, cnc-ddraw)
        env:
          MINGW: ${{ github.workspace }}/toolchains/llvm-mingw-20260421-ucrt-macos-universal/bin
        run: python3 tests/host/check-d3d8-to-d3d9.py

      # The Xcode project links 7 archives out of FEX/build-ios/ -- FEXCore,
      # FEXCore_Base, JemallocLibs plus the External deps. Nothing built them
      # before, so archiving could never have linked.
      # Split restore/save: plain actions/cache only saves when the whole job
      # succeeds, so a later failure discarded the FEX and LLVM builds and they
      # were recompiled every iteration. Saving right after each verify step
      # keeps them once they are known good.
      - name: FEX submodule revision
        id: fexrev
        shell: bash
        run: echo "sha=$(git -C FEX rev-parse HEAD)" >> "$GITHUB_OUTPUT"

      - name: Restore FEX iOS build
        id: fexcache
        uses: actions/cache/restore@v4
        with:
          path: FEX/build-ios
          key: fex-ios-${{ steps.fexrev.outputs.sha }}-v3

      # FEX 0f8edf8 AllocatorHooks.cpp defines IOS_RPM_GUARD() only inside
      # #ifdef ENABLE_FEX_ALLOCATOR, then uses it (malloc_usable_size) in the
      # #else branch. Upstream's build/fex-ios/build.sh also sets
      # ENABLE_FEX_ALLOCATOR=OFF, so a clean build cannot compile there either.
      # That branch is the plain system allocator; the guard serialises rpmalloc
      # and has nothing to guard, so a no-op is the right definition.
      - name: Patch FEX IOS_RPM_GUARD for the system-allocator branch
        if: steps.fexcache.outputs.cache-hit != 'true'
        shell: bash
        run: |
          python3 - FEX/FEXCore/Source/Utils/AllocatorHooks.cpp <<'PYEOF'
          import sys
          p = sys.argv[1]
          s = open(p).read()
          guard = "#ifndef IOS_RPM_GUARD\n#define IOS_RPM_GUARD() ((void)0)\n#endif\n"
          anchor = "size_t malloc_usable_size(void* ptr) {\n  IOS_RPM_GUARD();"
          if guard in s:
              print("AllocatorHooks.cpp: already patched")
          elif s.count(anchor) >= 1:
              # Twice: the allocator and system-allocator branches. In the first
              # the macro already exists, so the #ifndef is inert there.
              open(p, "w").write(s.replace(anchor, guard + anchor))
              print("AllocatorHooks.cpp: IOS_RPM_GUARD fallback added")
          elif "IOS_RPM_GUARD" not in s:
              print("AllocatorHooks.cpp: no IOS_RPM_GUARD any more -- step can go")
          else:
              print("::error::AllocatorHooks.cpp anchor moved -- review this step")
              sys.exit(1)
          PYEOF

      - name: Guard FEX diagnostic probes for the iOS static-lib target
        if: steps.fexcache.outputs.cache-hit != 'true'
        run: python3 tools/patch-fex-ios-probes.py

      - name: Build FEX for iOS
        if: steps.fexcache.outputs.cache-hit != 'true'
        continue-on-error: true
        shell: bash
        run: |
          # Apple builds skip Source/ (Linux-only tools) via `if (NOT APPLE)`,
          # so only the libraries Xcode links get built.
          # CMAKE_SYSTEM_NAME=iOS puts CMake in cross mode, where it does not
          # infer CMAKE_SYSTEM_PROCESSOR -- FEX's CMakeLists.txt:89 then does
          # string(TOLOWER) on an empty value and aborts with "Unsupported
          # processor type ." Its regex accepts ^aarch64.
          cmake -S FEX -B FEX/build-ios -G Ninja \
            -DCMAKE_SYSTEM_NAME=iOS \
            -DCMAKE_SYSTEM_PROCESSOR=aarch64 \
            -DCMAKE_OSX_SYSROOT="$(xcrun --sdk iphoneos --show-sdk-path)" \
            -DCMAKE_OSX_ARCHITECTURES=arm64 \
            -DCMAKE_OSX_DEPLOYMENT_TARGET=17.0 \
            -DCMAKE_BUILD_TYPE=Release \
            -DCMAKE_MACOSX_BUNDLE=OFF \
            -DBUILD_TESTING=OFF -DBUILD_FEXCONFIG=OFF -DBUILD_THUNKS=OFF \
            -DENABLE_LTO=OFF -DENABLE_CCACHE=OFF \
            -DTUNE_CPU=generic -DTUNE_ARCH=generic \
            -DCMAKE_DISABLE_FIND_PACKAGE_fmt=ON \
            > "$GITHUB_WORKSPACE/fex-cfg.log" 2>&1
          # Explicit targets: `all` would also build FEXCore_shared, which we
          # don't link and which needs dylib settings iOS won't give us.
          cmake --build FEX/build-ios -j"$(sysctl -n hw.ncpu)" \
            --target FEXCore FEXCore_Base JemallocLibs \
                     cephes_128bit softfloat_3e fmt xxhash \
            -- -k 0 > "$GITHUB_WORKSPACE/fex-build.log" 2>&1

      - name: Verify FEX iOS archives
        if: always()
        # LLVM still builds (and caches) in a run where FEX failed; the
        # linked-archives check fails the job before archiving.
        continue-on-error: true
        shell: bash
        run: |
          set +e
          OK=1
          for a in FEXCore/Source/libFEXCore.a FEXCore/Source/libFEXCore_Base.a \
                   FEXCore/Source/libJemallocLibs.a External/cephes/libcephes_128bit.a \
                   External/fmt/libfmt.a External/SoftFloat-3e/libsoftfloat_3e.a \
                   External/xxhash/cmake_unofficial/libxxhash.a; do
            if [ -f "FEX/build-ios/$a" ]; then
              echo "  OK   $a ($(wc -c < "FEX/build-ios/$a" | tr -d ' ') bytes)"
            else
              echo "  MISS $a"; OK=0
            fi
          done
          if [ "$OK" -eq 0 ]; then
            for L in fex-cfg fex-build; do
              if [ -f "$L.log" ]; then
                # Compiler errors beat a blind tail: the real cause is usually
                # hundreds of lines above the end of a ninja log.
                E=$(grep -E "error:|CMake Error" "$L.log" | head -40)
                [ -n "$E" ] || E=$(tail -n 40 "$L.log")
                echo "::error::$L.log :: $(printf '%s' "$E" | python3 -c "import sys; print('%0A'.join(sys.stdin.read().splitlines()))")"
              else
                echo "::error::$L.log MISSING"
              fi
            done
            exit 1
          fi
          echo "::notice::all 7 FEX archives present"

      # Only a tree that produced the library: build 118 cached a failed one
      # under -v1, and a cache hit skips the build step for good.
      - name: Save FEX iOS build
        if: steps.fexcache.outputs.cache-hit != 'true' && hashFiles('FEX/build-ios/FEXCore/Source/libFEXCore.a') != ''
        uses: actions/cache/save@v4
        with:
          path: FEX/build-ios
          key: fex-ios-${{ steps.fexrev.outputs.sha }}-v3

      # xtajit64.dll (FEX's ARM64EC module) with the MADEIRA_FEX_AVX opt-in:
      # games built for AVX (Ghost of Tsushima) die on their first VEX
      # instruction otherwise. The script keeps the committed DLL unless an
      # unpatched rebuild matches it first.
      - name: Restore FEX ARM64EC build
        id: fexeccache
        uses: actions/cache/restore@v4
        with:
          path: FEX/build-arm64ec
          key: fex-arm64ec-${{ steps.fexrev.outputs.sha }}-v2

      - name: Build xtajit64.dll (FEX fixes, AVX opt-in)
        if: env.MINGW_OK == '1'
        continue-on-error: true
        run: bash tools/build-xtajit64.sh

      - name: Save FEX ARM64EC build
        if: steps.fexeccache.outputs.cache-hit != 'true' && hashFiles('FEX/build-arm64ec/Bin/libarm64ecfex.dll') != ''
        uses: actions/cache/save@v4
        with:
          path: FEX/build-arm64ec
          key: fex-arm64ec-${{ steps.fexrev.outputs.sha }}-v2

      # madeira-bcd: FEX's aarch64 WOW64 module (xtajit.dll, the 32-bit CPU
      # backend) was only ever built by hand (build/fex-wow64/build.sh). Built
      # here with the CPUID index fix; on failure the committed module stays.
      - name: Restore FEX WOW64 build
        id: fexwowcache
        uses: actions/cache/restore@v4
        with:
          path: FEX/build-wow64
          key: fex-wow64-${{ steps.fexrev.outputs.sha }}-v1

      - name: Build xtajit.dll (WOW64, CPUID index fix)
        if: env.MINGW_OK == '1'
        continue-on-error: true
        run: bash tools/build-xtajit-wow64.sh

      - name: Save FEX WOW64 build
        if: steps.fexwowcache.outputs.cache-hit != 'true' && hashFiles('FEX/build-wow64/Bin/libwow64fex.dll') != ''
        uses: actions/cache/save@v4
        with:
          path: FEX/build-wow64
          key: fex-wow64-${{ steps.fexrev.outputs.sha }}-v1

      - name: Restore LLVM 15.0.7 iOS build
        id: llvmcache
        uses: actions/cache/restore@v4
        with:
          path: |
            toolchains/llvm-ios-build
            toolchains/llvm-project
          key: llvm-15.0.7-ios-v2

      - name: Build LLVM 15.0.7 for iOS (two-stage, per build/dxmt-ios/README.md)
        if: steps.llvmcache.outputs.cache-hit != 'true'
        continue-on-error: true
        shell: bash
        run: |
          git clone --depth 1 --branch llvmorg-15.0.7 \
            https://github.com/llvm/llvm-project.git toolchains/llvm-project
          # README: Apple ld rejects --gc-sections; make the Darwin branch cover iOS
          sed -i '' 's/MATCHES "Darwin"/MATCHES "Darwin|iOS"/' \
            toolchains/llvm-project/llvm/cmake/modules/AddLLVM.cmake
          grep -n 'Darwin|iOS' toolchains/llvm-project/llvm/cmake/modules/AddLLVM.cmake | head

          # stage 1: host llvm-tblgen only (use Xcode clang, not brew's newer one)
          cmake -S toolchains/llvm-project/llvm -B toolchains/llvm-host-build -G Ninja \
            -DCMAKE_BUILD_TYPE=Release \
            -DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ \
            -DLLVM_TARGETS_TO_BUILD="" -DLLVM_INCLUDE_TESTS=Off \
            -DLLVM_INCLUDE_EXAMPLES=Off -DLLVM_INCLUDE_BENCHMARKS=Off \
            > "$GITHUB_WORKSPACE/llvm-host-cfg.log" 2>&1
          cmake --build toolchains/llvm-host-build --target llvm-tblgen \
            -j"$(sysctl -n hw.ncpu)" > "$GITHUB_WORKSPACE/llvm-host-build.log" 2>&1

          # stage 2: iOS target libs, reusing host tblgen
          cmake -S toolchains/llvm-project/llvm -B toolchains/llvm-ios-build -G Ninja \
            -DCMAKE_SYSTEM_NAME=iOS \
            -DCMAKE_OSX_SYSROOT="$(xcrun --sdk iphoneos --show-sdk-path)" \
            -DCMAKE_OSX_ARCHITECTURES=arm64 \
            -DCMAKE_OSX_DEPLOYMENT_TARGET=17.0 \
            -DCMAKE_BUILD_TYPE=Release \
            -DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ \
            -DLLVM_TABLEGEN="$GITHUB_WORKSPACE/toolchains/llvm-host-build/bin/llvm-tblgen" \
            -DCMAKE_MACOSX_BUNDLE=OFF \
            -DLLVM_BUILD_UTILS=Off -DLLVM_BUILD_TOOLS=Off \
            -DLLVM_TARGETS_TO_BUILD="" \
            -DLLVM_INCLUDE_TESTS=Off -DLLVM_INCLUDE_EXAMPLES=Off \
            -DLLVM_INCLUDE_BENCHMARKS=Off -DLLVM_INCLUDE_UTILS=Off \
            -DLLVM_ENABLE_TERMINFO=Off -DLLVM_ENABLE_LIBXML2=Off \
            -DLLVM_ENABLE_ZSTD=Off -DLLVM_ENABLE_ZLIB=Off \
            > "$GITHUB_WORKSPACE/llvm-ios-cfg.log" 2>&1
          cmake --build toolchains/llvm-ios-build -j"$(sysctl -n hw.ncpu)" \
            > "$GITHUB_WORKSPACE/llvm-ios-build.log" 2>&1

      - name: Verify LLVM iOS build
        if: always()
        shell: bash
        run: |
          set +e
          shopt -s nullglob
          LIBS=(toolchains/llvm-ios-build/lib/*.a)
          N=${#LIBS[@]}
          echo "llvm-ios-build static libs: $N"
          echo "::notice::llvm-ios-build has $N static libs"
          echo "-- toolchains tree --"
          ls -la toolchains 2>&1 | head -20
          ls -la toolchains/llvm-ios-build 2>&1 | head -20
          if [ "$N" -lt 5 ]; then
            for L in llvm-host-cfg llvm-host-build llvm-ios-cfg llvm-ios-build; do
              if [ -f "$L.log" ]; then
                T=$(tail -n 30 "$L.log" | python3 -c "import sys; print('%0A'.join(sys.stdin.read().splitlines()))")
                echo "::error::$L.log tail :: $T"
              else
                echo "::error::$L.log MISSING"
              fi
            done
            exit 1
          fi

      - name: Save LLVM 15.0.7 iOS build
        if: steps.llvmcache.outputs.cache-hit != 'true' && hashFiles('toolchains/llvm-ios-build/lib/libLLVMCore.a') != ''
        uses: actions/cache/save@v4
        with:
          path: |
            toolchains/llvm-ios-build
            toolchains/llvm-project
          key: llvm-15.0.7-ios-v2

      # The .metal shaders below need a Metal compiler. `xcodebuild
      # -downloadComponent` only exists on Xcode 16+; on older Xcode it exits 64
      # with a usage dump, and the compiler ships with the toolchain anyway. So
      # probe first and only try to download when it is actually missing.
      - name: Ensure Metal compiler
        shell: bash
        run: |
          xcodebuild -version
          if xcrun -sdk macosx metal --version 2>&1 | head -3; then
            echo "::notice::metal compiler already present"
          else
            echo "metal missing -- attempting download"
            xcodebuild -downloadComponent MetalToolchain \
              || echo "::warning::-downloadComponent unsupported on this Xcode"
          fi

      # build/dxmt-ios/shader-headers/ is gitignored and nothing generated it,
      # so airconv_context.cpp could not find air_msad.h / air_samplepos.h.
      # Mirrors the metalir + hexdump generators in dxmt/meson.build.
      - name: Generate DXMT shader headers
        shell: bash
        run: |
          SHADERS="$GITHUB_WORKSPACE/dxmt/src/airconv/shaders"
          OUT="$GITHUB_WORKSPACE/build/dxmt-ios/shader-headers"
          mkdir -p "$OUT"
          cd "$OUT"
          for s in air_msad air_samplepos air_tessellation; do
            xcrun -sdk macosx metal -o "$s.air" -c "$SHADERS/$s.metal" \
              -std=metal3.1 --target=air64-apple-macos14.0
            # meson passes `xxd -n <basename>`; that flag is not in every xxd,
            # so rename the symbols instead (air_msad_air -> air_msad).
            xxd -i "$s.air" | sed "s/${s}_air/${s}/g" > "$s.h"
          done
          ls -la

      # Metal Shader Converter, the way upstream ships it (owner's decision
      # 2026-10-07, replacing the msc-private draft release): the public headers
      # (Apache-2.0) are vendored in madeira-d3d12/third_party/metal-shader-converter
      # and the iOS library is tracked at app/Madeira/d3d12/libmetalirconverter.dylib
      # (Apple's agreement, app/Madeira/d3d12/NOTICE.txt); build/madeira-d3d12/deps.sh
      # checks both against their pinned hashes. A missing or mismatched converter
      # would build the stub that draws nothing in any D3D12 game, so fail instead.
      - name: Locate Metal Shader Converter headers
        shell: bash
        run: |
          INC="$GITHUB_WORKSPACE/madeira-d3d12/third_party/metal-shader-converter/include"
          if ! bash -c 'source build/madeira-d3d12/deps.sh'; then
            echo "::error::the vendored Metal Shader Converter does not match its pinned hashes (build/madeira-d3d12/deps.sh)"
            exit 1
          fi
          echo "MADEIRA_MSC_INCLUDE=$INC" >> "$GITHUB_ENV"
          V=$(grep -E "define IR_VERSION_(MAJOR|MINOR|PATCH)" "$INC/metal_irconverter/ir_version.h" | awk '{print $3}' | paste -sd. -)
          echo "::notice::Metal Shader Converter $V from the repository: headers vendored, iOS library tracked"

      # Upstream's Madeira Dock (Steam library helper): dockhost.exe is a build
      # output; without it the Dock stays hidden, so a failure here only warns.
      - name: Build Madeira Dock host
        continue-on-error: true
        run: |
          # env.MADEIRA_DOCK_GAME_SCM = 1: a service manager in the game session
          python3 tools/patch-dock-game-scm.py madeira-dock/src/launch.c || echo "::warning::Dock game-session service manager patch not applied"
          # env.MADEIRA_DOCK_KEEP_ALIVE = <exe>;<exe>: hold the session while a self-updating launcher restarts
          python3 tools/patch-dock-keep-alive.py madeira-dock/src/launch.c || echo "::warning::Dock keep-alive patch not applied"
          # round 624 (Steam 113): the published values read back while the game starts; env.MADEIRA_DOCK_PUMP_MS / _REASSERT experiments
          python3 tools/patch-dock-steam-readback.py madeira-dock/src/launch.c || echo "::warning::Dock Steam readback patch not applied"
          # round 630 (444TS8): a late sign-in gets 45 s for the licence list (at most 180 s); env.MADEIRA_DOCK_LICENCE_WAIT = 0: 90 s as before
          python3 tests/host/check-dock-licence-wait.py
          python3 tools/patch-dock-licence-wait.py madeira-dock/src/session.c || echo "::warning::Dock licence-wait patch not applied"
          # round 630 (FRKBN1): env.MADEIRA_DOCK_CEG_ZERO_JOBS = 1 (off by default): an accepted prepare request with zero jobs goes on to Valve's launch
          python3 tests/host/check-dock-ceg-zero-jobs.py
          python3 tools/patch-dock-ceg-zero-jobs.py madeira-dock/src/launch.c || echo "::warning::Dock CEG zero-jobs patch not applied"
          # round 630 (N14Q6D): the two silent install-folder failures (host result 41) report which check failed; log only
          python3 tests/host/check-dock-install-dir-events.py
          python3 tools/patch-dock-install-dir-events.py madeira-dock/src/launch.c || echo "::warning::Dock install-folder events patch not applied"
          # round 630 (BN3SXW): the Steam client entries step (42) says which part failed; a failed open is tried once more after 1 s
          python3 tests/host/check-dock-registry-events.py
          python3 tools/patch-dock-registry-events.py madeira-dock/src/launch.c || echo "::warning::Dock registry events patch not applied"
          bash build/madeira-dock/build.sh

      # madeira-bcd (round 624, Steam 113: 39 of 187 Rockstar Dock sessions): the Dock patches in order on a copy, the readback
      # helpers on the host, the whole host compiled with its flags, the app's report fields, the catalog.
      - name: Check the Dock Steam readback
        run: python3 tests/host/check-dock-steam-readback.py

      # 30 and 40 FPS caps (pacing modes 3 and 4) for the Session panel.
      - name: Patch DXMT present pacing with 30/40 FPS modes
        run: python3 tools/patch-dxmt-frame-limits.py

      # Experimental MetalFX frame interpolation in the present path
      # (MADEIRA_FRAMEGEN=1 per game).
      - name: Patch DXMT with frame generation
        run: python3 tools/patch-dxmt-framegen.py

      # Which encoder a GPU hang or fault came from (madeira_ctl ops 8 and 9).
      - name: Patch DXMT with GPU fault attribution
        run: python3 tools/patch-dxmt-gpu-fault-info.py

      - name: Patch DXMT buffer->texture blits with a depth/stencil aspect
        run: python3 tools/patch-dxmt-b2t-aspect.py

      # DXIL hull/domain pipelines through the Metal Shader Converter's
      # tessellation emulation (Ghost of Tsushima's water); madeira_d3d12 uses
      # the patched WMTGeometryEmulationInfo, so this runs before both builds.
      - name: Patch DXMT with DXIL tessellation emulation
        run: python3 tools/patch-dxmt-dxil-tess.py

      # D3D reads past the end of a short constant buffer as 0; Metal reads the
      # next bytes. Zero-padded copies for such bindings (32-bit Crysis's
      # D3D10 renderer throws vertices far out without it) and an index-offset
      # alignment census. Runs before the i386 farm, which is keyed on these
      # patch scripts.
      - name: Patch DXMT constant buffers bound short
        run: python3 tools/patch-dxmt-cb-short.py

      # 16-bit index offsets that are 2 mod 4 get their index range copied to a
      # 4-byte aligned place (Crysis D3D10 trees; MADEIRA_IDX_REALIGN=0 = off).
      - name: Patch DXMT to realign 16-bit index ranges
        run: python3 tools/patch-dxmt-idx-align.py

      # D3D10 reads zero past the end of a vertex buffer; the DXBC vertex fetch
      # read on into whatever memory followed (32-bit Crysis tree streaks).
      - name: Patch DXMT vertex fetch bounds
        run: python3 tools/patch-dxmt-vfetch-bounds.py

      # 32-bit Crysis may bind vertex buffers at offsets that are not 4-aligned;
      # SM 4.x vertex pulls use byte-aligned loads, and [vb-align] counts them.
      - name: Patch DXMT byte-aligned vertex fetch
        run: python3 tools/patch-dxmt-vb-align.py

      # Wine's d2d1 brackets its draws with SwapDeviceContextState, which was
      # IMPLEMENT_ME (abort): Rockstar Games Launcher exited with code 3.
      - name: Patch DXMT context state swap
        run: python3 tools/patch-dxmt-context-state-swap.py

      # F1 2020 (round 620): CopyStructureCount with an empty destination or counter crashed the encode thread;
      # such a call is skipped and logged ([copy-structure-count]).
      - name: Patch DXMT CopyStructureCount without a buffer
        run: python3 tools/patch-dxmt-copy-structure-count.py

      # Need for Speed: The Run (round 620, Frostbite 2): a render target view on a buffer failed with E_INVALIDARG and the
      # game stopped. Every failed view is logged ([rtv-fail]); env.MADEIRA_BUFFER_RTV_EMPTY = 1 answers S_OK and no view for a
      # buffer, as DXVK did for Battlefield 3/4 (off by default). A null view in ClearRenderTargetView is ignored.
      - name: Patch DXMT render target views on a buffer
        run: python3 tools/patch-dxmt-buffer-rtv.py

      # Dark Souls III (round 624, 10 logs of builds 565-622): an SRV made with MipLevels = -1 reported 0xFFFFFFFF from GetDesc and the
      # game sized an array with it. env.MADEIRA_SRV_GETDESC_RESOLVE = 1 resolves the count in the view's description (off by default;
      # [srv-getdesc]). The 64-bit game gets it through d3d11-src.dll (tools/build-d3d11-dll.sh).
      - name: Patch DXMT SRV GetDesc mip count
        run: python3 tools/patch-dxmt-srv-getdesc-mips.py

      # Build 623 (upstream willfaust/dxmt d811847f2): the GS/TS draw-argument marshal loops never advanced, so a batch of two
      # or more geometry/tessellation draws spun until the GPU timed out; a zero-size draw dispatches nothing. Reaches the
      # 32-bit d3d10/d3d11 and the native library (the 64-bit d3d11.dll is upstream's binary).
      - name: Patch DXMT GS/TS draw-argument marshal loops
        run: python3 tools/patch-dxmt-gsts-marshal.py

      # Build 623 (upstream willfaust/dxmt f25e5568d): d3d9.customDriver sets the adapter's driver file name (empty = off);
      # BCD's "NVIDIA GeForce 7900 GS" card uses it for Fallout 3 / New Vegas.
      - name: Patch DXMT d3d9.customDriver
        run: python3 tools/patch-dxmt-d3d9-custom-driver.py

      # A D3D9 R5G6B5 back buffer went straight to CAMetalLayer, which threw
      # 'invalid pixel format 40' and ended the app (Warcraft III, build 559).
      # A format the layer refuses now presents into BGRA8Unorm. Before the
      # i386 farm key, which hashes it.
      - name: Check DXMT layer format
        run: python3 tests/host/check-dxmt-layer-format.py

      - name: Patch DXMT layer format
        run: python3 tools/patch-dxmt-layer-format.py

      # A swapchain that goes fullscreen (Windowed = FALSE, SetFullscreenState(TRUE)) makes Windows' DXGI cover the
      # output with its window; DXMT's headless WSI only said "true". A fullscreen swapchain's window whose client
      # area is under 160x120 (American Truck Simulator: 132x38 around a 1024x768 picture) now gets the monitor's
      # size; every larger window is left as it was. Before the DXMT builds.
      - name: Check DXMT tiny fullscreen window
        run: python3 tests/host/check-dxmt-wsi-tiny-fullscreen.py

      - name: Patch DXMT tiny fullscreen window
        run: python3 tools/patch-dxmt-wsi-tiny-fullscreen.py

      # Blur (8XZKXY, S465J5: 1160x800@4199012 / 1174409890 uninitialized RefreshRateInHz) and The Secret of Monkey Island: SE
      # (0QM8ZF, FTZTQ1: 3456x2234@0 from a MacBook Retina Settings.ini) failed CreateDevice with D3DERR_INVALIDCALL (0x8876086c).
      # isPresentableFullscreenExtent now accepts plausible [320x200, 7680x4320] fullscreen extents and garbage refresh rates
      # (scaled by the layer; env.MADEIRA_D3D9_STRICT_MODES=1 rejects them). Before the i386 farm key, which hashes it.
      - name: Check DXMT D3D9 fullscreen extent
        run: python3 tests/host/check-dxmt-d3d9-fullscreen-extent.py

      - name: Patch DXMT D3D9 fullscreen extent
        run: python3 tools/patch-dxmt-fullscreen-extent.py

      # Call of Duty: World at War (K8K2D3, 32 FPS in heavy scenes): every draw after a lock of its ~1 MB dynamic index buffer copied
      # the whole buffer to the GPU, ~920 times a frame. env DXMT_D9_IB_RANGE=1 (default off) copies only the index bytes a draw reads,
      # renaming first when an earlier draw of the generation read them; the census gets a "buffer refresh per frame" line either
      # way. The check runs the state machine against a model of the GPU generations. Before the i386 farm key, which hashes it.
      - name: Check DXMT D3D9 index-buffer range refresh
        run: python3 tests/host/check-dxmt-d9-ib-range.py

      - name: Patch DXMT D3D9 index-buffer range refresh
        run: python3 tools/patch-dxmt-d9-ib-range.py

      # Far Cry 2 (Z7CADQ, round 624 agent D2 S16): with MADEIRA_FRAME_STATS (off by default) GetData times its park on the GPU
      # fence and [d3d9-query] gets a third line, parked ms a frame and issue-to-complete percentiles. Without it nothing changes.
      # After the index-range patch (same census file); before the i386 farm key, which hashes it.
      - name: Patch DXMT D3D9 query park time
        run: python3 tools/patch-dxmt-d3d9-query-park.py

      # LEGO Batman, Silent Hunter 3, Requiem (round 624, Discord forum item 11: wrong, pink or black textures): [d3d9-tex-fmt] names
      # each distinct texture format, pool and usage a game creates and the Metal format it became (40 lines; part of the D3D9 census,
      # MADEIRA_D3D9_CENSUS=0 turns it off). Log only. Before the i386 farm key, which hashes it.
      - name: Patch DXMT D3D9 texture format log
        run: python3 tools/patch-dxmt-d9-texfmt-log.py

      # Counter-Strike: Source 64-bit (round 624, agent D2 S18, W69RYK: a GetData poll loop for good): [d3d9-query-stuck] names a query
      # still pending after 1,048,576 polls (building, the GPU behind, or a lost occlusion result), 16 lines; DXMT_D9_QUERY_LOST_MS
      # (off unless a game's file sets it) answers a lost occlusion query as visible. Before the i386 farm key, which hashes it.
      - name: Patch DXMT D3D9 stuck query report
        run: python3 tools/patch-dxmt-d9-query-stuck.py

      # WRC 9 (round 624, agent D2 S11, JDJ8KE/WV1P7T: GetData on a TIMESTAMP_DISJOINT query for good): [query-stuck] says what an event-class
      # query pending 1.5 s waits for (its event, the signalled one, the queue, unsubmitted work); DXMT_QUERY_TS_WATCHDOG (off unless a
      # game's file sets it) answers a timestamp query pending 2 s as complete. The i386 d3d11.dll and d3d11-src.dll. Before the farm key.
      - name: Patch DXMT D3D11 stuck query report
        run: python3 tools/patch-dxmt-d11-query-stuck.py

      # Alan Wake (A6232G, round 630 agent O1 S3): 67 pipelines a run failed ("Fragment input(s) user(NORMAL0) ... not written by vertex
      # shader") because the SM3 vertex-output walk dropped NORMAL/TANGENT/BINORMAL/BLENDWEIGHT/BLENDINDICES/DEPTH; it emits them now,
      # under the names the pixel side already reads and stubs. After the D3D9/D3D11 query chain (each of its steps directly follows
      # the one before, by their checks); before the i386 farm key, which hashes it.
      - name: Check DXMT D3D9 SM3 vertex interface
        run: python3 tests/host/check-dxmt-d9-sm3-vs-interface.py

      - name: Patch DXMT D3D9 SM3 vertex interface
        run: python3 tools/patch-dxmt-d9-sm3-vs-interface.py

      # Batman: Arkham City (round 626, agent T S2, 9AGR39/AE9TXK): a tessellation mesh pipeline that did not compile ("Total mesh size
      # (33792) exceeds the maximum mesh size allowed (32768)") left no pipeline bound and its draws made the driver fault; they are now
      # dropped until a pipeline of that kind compiles ([mesh-skip] ml870; geometry the same). The i386 d3d11.dll and d3d11-src.dll.
      # Before the farm key, which hashes it.
      - name: Check DXMT mesh pipeline failures
        run: python3 tests/host/check-dxmt-tess-pso-failed.py

      - name: Patch DXMT mesh pipeline failures
        run: python3 tools/patch-dxmt-tess-pso-failed.py

      # env.MADEIRA_DXMT_FAULT_INFO = 1 (off by default): command buffers with
      # encoder execution status, labelled encoders and a [fault-enc] line after
      # "Device error", so a GPU hang names its encoder (GTA V Legacy hung the GPU
      # at Story Mode on build 546). Before the i386 farm key, which hashes it.
      - name: Check DXMT fault info
        run: python3 tests/host/check-dxmt-d3d11-fault-info.py

      - name: Patch DXMT fault info
        run: python3 tools/patch-dxmt-d3d11-fault-info.py

      # GTA IV (log JA13M8): a D3D9 dynamic buffer refresh with no room for a new generation (a full 32-bit
      # address space) drew stale data. It now waits for the GPU and reuses a generation instead; only on that
      # failure, DXMT_D9_RENAME_WAIT=0 keeps the old behaviour. In the dxmt submodule itself (the i386 farm key
      # hashes its commit). Source invariants only.
      - name: Check the D3D9 dynamic buffer rename wait
        run: python3 tests/host/check-d9-rename-wait.py

      # God of War died on a loading screen at 7.5 GB: 2.4 GB of native malloc in
      # two seconds while it created its shaders. DXMT keeps every shader with
      # airconv's parsed program; the parse is now dropped after creation and
      # redone per compiled variant (MADEIRA_SM50_LEAN=0 keeps it). Native only.
      - name: Patch airconv lean SM50 shaders
        run: python3 tools/patch-airconv-sm50-lean.py

      # iOS cannot bootstrap-register a shared texture's mach port; without a
      # port DXMT keeps the texture unshared instead of failing its creation
      # (Crysis Remastered died on ClearRenderTargetView(NULL) after that).
      # Native side only, so the i386 farm cache key is not touched.
      # Upstream moved research/dxmt to dxmt (79e28f0) on the same dxmt pin,
      # whose winemetal unix sources count "../" from the old place
      # (madeira_cfg.h, research/remote-metal): build 285 stopped on it.
      - name: Patch winemetal includes for the new layout
        run: python3 tools/patch-winemetal-layout.py

      - name: Patch winemetal shared textures for iOS
        run: python3 tools/patch-winemetal-ios-shared-texture.py

      # 8 GB devices: an iPad (7644 MB RAM) measured an 8192 MB process limit,
      # above its RAM, and starved (black frames) instead of trimming. Video
      # budget, its trim and the mip clamp now plan with min(limit, RAM - 2 GB);
      # unchanged on 12 GB phones. bcd.cfg ram-reserve-mb (0 = off).
      - name: Patch winemetal RAM cap for 8 GB devices
        run: python3 tools/patch-winemetal-ram-cap.py

      # God of War darkens outdoors (iPhone) and draws a black scene on an M1
      # iPad. Switches, all off by default: MADEIRA_PS_CLAMP=1|2 (pixel output
      # clamp like D3D's float16 conversion), MADEIRA_PRECISE_MINMAX=1
      # (NaN-ignoring min/max); [f32-tex] logs 32-bit float textures and the
      # device's float filtering support. Native only.
      - name: Patch airconv float experiments
        run: python3 tools/patch-airconv-float-experiments.py

      # God of War darkens at every internal resolution below 1080p: its 32x32
      # luminance tiles read past the bottom of a 1280x720 target. D3D returns
      # 0 for a texture Load out of range; Metal's read() does not. ld and
      # ld_uav_typed now check the range (MADEIRA_LD_BOUNDS=0 = off).
      - name: Patch airconv texture load bounds
        run: python3 tools/patch-airconv-ld-bounds.py

      # The same tiles also WRITE past the bottom; D3D drops out-of-range typed
      # UAV stores, Metal's write() is undefined there. Branch around them.
      - name: Patch airconv typed UAV store bounds
        run: python3 tools/patch-airconv-uav-store-bounds.py

      # God of War's outdoor darkening survived the float switches. Read back
      # what the game reads: [lum-readback] logs the 1x1 32-bit float values it
      # copies to the CPU (~2/s), [f32-mipgen] its 32-bit float GenerateMips.
      # MADEIRA_LUM_PROBE=0 turns it off. Native only.
      - name: Patch winemetal luminance probe
        run: python3 tools/patch-winemetal-lum-probe.py

      # The luminance probe saw no small 32-bit float readback: census every
      # texture/buffer readback ([rb-tex], [rb-buf]) with the values of small
      # ones. Same switch (MADEIRA_LUM_PROBE=0). Native only.
      - name: Patch winemetal readback census
        run: python3 tools/patch-winemetal-readback-census.py

      # The probes above read the previous readback buffer's memory later; a game may have
      # freed it by then (Batman: Arkham Asylum, Brutal Legend, Dishonored ended there,
      # build 574). The read goes through vm_read_overwrite: a freed page is "unreadable",
      # not a crash. A readable page logs the same values as before.
      - name: Patch winemetal probe safe read
        run: python3 tools/patch-winemetal-probe-safe-read.py

      # D3D12 MIN/MAX reduction samplers (Ghost of Tsushima's Hi-Z culling)
      # through Metal's own reductionMode on Apple10 GPUs (iOS 26), with
      # bcd.cfg sampler-reduction = 3. Native only.
      - name: Patch winemetal sampler reduction
        run: python3 tools/patch-winemetal-sampler-reduction.py

      # A lazy D3D12 pipeline's first draw compiles it: 35-47 ms the first time
      # this device sees it, 0.3-0.5 ms from Metal's cache afterwards (GTA V,
      # builds 447-451; bursts froze the game for 100-400 ms). With
      # bcd.cfg / a game's config pso-warm = N, madeira-d3d12 hands each
      # lazy pipeline to MadeiraCtl op 8 at creation and winemetal compiles it
      # once on N utility queues, keeping only the cached compile. Native only.
      - name: Patch winemetal pipeline cache warm-up
        run: python3 tools/patch-winemetal-pso-warm.py

      # madeira-d3d12's shader cache files, read and written natively
      # (MadeiraCtl ops 20-22) instead of through Wine's file API, which cost a
      # create_file, get_handle_fd and close_handle request and a server
      # realpath() per entry (Horizon Zero Dawn's menu: ~1,000 a second at
      # ~3.5 ms each). The same files; bcd.cfg shader-cache-native = 0
      # keeps Wine's file calls. Native only.
      - name: Patch winemetal native shader-cache access
        run: python3 tools/patch-winemetal-sc-native.py

      # Metal aborts on a mesh pipeline with rasterization on and no fragment
      # function; D3D allows a pipeline with no pixel shader. Horizon Zero
      # Dawn's vertex + geometry shader pipelines killed its pipeline thread
      # and the game hung after its first frame (build 469). Such a pipeline
      # now gets an empty fragment function and no colour writes (bcd.cfg
      # gs-null-fragment = 0 refuses it instead). Pipelines that have a
      # fragment function are untouched. Native only.
      - name: Patch winemetal empty fragment function
        run: python3 tools/patch-winemetal-null-fragment.py

      # Is God of War at 1080p GPU-bound? The logs had no GPU timing. The
      # [frame] instrument (server_ios.c, MADEIRA_FRAME_STATS=1, off by
      # default) gets each command buffer's GPU start/end, so it can print the
      # GPU's busy time per second. No effect while the switch is unset.
      # Native only, so the i386 farm cache key is not touched.
      - name: Patch winemetal GPU timeline for [frame]
        run: python3 tools/patch-winemetal-gpu-span.py

      # God of War darkens below 1080p (docs/gow-darkening.md). Opt-in
      # converter experiments, each with its own shader-cache table, all OFF
      # by default (converted shaders unchanged): MADEIRA_TGSM_SYNC=1
      # (warp-synchronous groupshared code, upstream a4cfaac + sync_g),
      # MADEIRA_SAMPLE_L_BIAS=1 (upstream eec0b65), MADEIRA_PRECISE_MATH=1,
      # MADEIRA_BOUNDS_EXTRA=1 (atomics / typed buffers / resinfo out of
      # range), and MADEIRA_SHADER_DUMP=cs|ps|...|<sha8> (DXBC to
      # Documents/shader-dump). Native only.
      - name: Patch airconv God of War experiments
        run: python3 tools/patch-airconv-gow-experiments.py

      # A geometry shader input declared with SV_ClipDistance, SV_CullDistance,
      # SV_RenderTargetArrayIndex or SV_ViewportArrayIndex aborted the game
      # (assert in handle_signature_gs, exit 0x80000101): GTA V Legacy before its
      # first frame. Such inputs are plain registers of the vertex stage's output
      # file; only shaders that aborted before change. Native only.
      - name: Check airconv geometry shader input system values
        run: python3 tests/host/check-airconv-gs-input-siv.py

      - name: Patch airconv geometry shader input system values
        run: python3 tools/patch-airconv-gs-input-siv.py

      # A geometry shader that declares its instance id (dcl_input vGSInstanceID, a Shader Model 5 [instance(N)] shader) aborted the game
      # (assert in handle_signature_gs, exit 0x80000101): ROBOBEAT, about 8 s into its start. The converter already does the rest of
      # geometry shader instancing; only the declaration is let through. Only shaders that aborted before change. Native only.
      - name: Check airconv geometry shader instance id
        run: python3 tests/host/check-airconv-gs-instance-id.py

      - name: Patch airconv geometry shader instance id
        run: python3 tools/patch-airconv-gs-instance-id.py

      # Same investigation, native winemetal, all OFF by default:
      # MADEIRA_GPU_TRACE=<s> (one frame's encoders + float-target values,
      # [gpu-trace] / [gpu-val] / [rb-src]), MADEIRA_RP_LOAD=1 (no DontCare
      # attachment load/store) and MADEIRA_BORDER=black (samplers DXMT gave
      # the white border get transparent black).
      - name: Patch winemetal GPU trace and render-pass experiment
        run: python3 tools/patch-winemetal-gpu-trace.py

      # Just Cause 3's world stall (round 624, agent D2 S15), both OFF by default: MADEIRA_GPU_TRACE=slow=<ms>,S,N starts the
      # trace above after 3 presents in a row more than <ms> apart; MADEIRA_GPU_STALL_MS=<ms> names a command buffer unfinished
      # that long after its commit ([gpu-stall]). Native only.
      - name: Patch winemetal GPU stall watch and slow-frame trace
        run: python3 tools/patch-winemetal-gpu-stall.py

      # A 32-bit DXMT game's [gpu-perf] line (round 624, agent D2 S16, Far Cry 2): MadeiraCtl op 3 for a 32-bit caller while
      # MADEIRA_FRAME_STATS is on, its guest pointer converted. Without the switch nothing changes. Native only.
      - name: Patch winemetal GPU time for 32-bit callers
        run: python3 tools/patch-winemetal-ctl-gpu-time-wow64.py

      # A render pass filled all eight colour attachments of its descriptor
      # (~240 Objective-C messages and 8 allocations a pass); only the slots
      # with a texture are filled now, the same pass for Metal. bcd.cfg /
      # a game's config rp-lean = 0 restores the full loop. Native only.
      - name: Patch winemetal lean render-pass descriptors
        run: python3 tools/patch-winemetal-rp-lean.py

      # madeira-bcd fps-gov (opt-in, env.MADEIRA_FPS_CAP / MADEIRA_FPS_GOV_MW):
      # DXMT's presents wait for the governor's frame cap (server_ios.c
      # ios_fps_cap_dxmt_pace); unarmed it returns at once. Native only.
      - name: Patch winemetal frame cap for the power governor
        run: python3 tools/patch-winemetal-fps-cap.py

      # madeira-bcd HUD (round 603): every Present of the process also stamps the frame-time ring (app/Madeira/BCDFrameRing.c, linked
      # into the app) for the HUD's graph and lows and the [session] summary line. A weak import: a link without the app's ring still
      # links. One clock read and two relaxed atomics a frame; always on. Native only, so the i386 farm cache key is not touched.
      - name: Patch winemetal frame-time ring
        run: python3 tools/patch-winemetal-frame-ring.py

      # On Apple's tile-based GPU every attachment a pass stores is a whole pass
      # over that surface in memory. With bcd.cfg / a game's config
      # rp-discard = 1, madeira-d3d12 leaves the store actions of a pass whose
      # texture the game discards open (Unknown) and sets them when the pass
      # ends: no store when the next use is a DiscardResource or a whole
      # clear. MadeiraCtl op 24 sets them; unused unless the switch is on.
      # Native only.
      - name: Patch winemetal late render-pass store actions
        run: python3 tools/patch-winemetal-rp-store.py

      # bcd.cfg heap-untracked = 1 (opt-in): madeira-d3d12's placement heaps
      # (D3D12 DEFAULT heaps, its texture heaps) without Metal hazard tracking;
      # the runtime's encoder fences order its work. Native only.
      - name: Patch winemetal untracked placement heaps
        run: python3 tools/patch-winemetal-heap-untracked.py

      # madeira-bcd (iOS 18 audit, 2026-10-18): Metal's private shader-cache path
      # calls become weak imports, so a system without them still starts the app
      # (the cache path is then reported as not set); where they exist nothing
      # changes. Native only.
      - name: Check winemetal for iOS 18 (weak cache SPI, frame generation)
        run: python3 tests/host/check-dxmt-ios18.py

      - name: Patch winemetal weak shader-cache SPI
        run: python3 tools/patch-winemetal-cache-spi-weak.py

      # madeira-bcd: env.MADEIRA_FRAMEGEN answers off below iOS 26, where MetalFX
      # frame interpolation does not exist; iOS 26 and later unchanged. Native only.
      - name: Patch winemetal frame generation below iOS 26
        run: python3 tools/patch-winemetal-framegen-ios26.py

      # madeira-bcd env.MADEIRA_PAUSE_IN_BACKGROUND = 1 (opt-in): commits and
      # presents wait while the app is not active (WineProcessBridge.m), so iOS
      # never refuses the game's GPU work from the background. Native only.
      - name: Check winemetal pause while inactive
        run: python3 tests/host/check-gpu-pause-inactive.py

      - name: Patch winemetal pause while inactive
        run: python3 tools/patch-winemetal-pause-inactive.py

      # madeira-bcd: env.MADEIRA_X64_MACHINE = 1 (off by default): a 32-bit program that asks which machine is native
      # (IsWow64Process2, PROCESSOR_ARCHITEW6432) hears AMD64 instead of ARM64 (BeamNG.drive's launcher starts its
      # native ARM64 build, which cannot load, otherwise). Applied to kernelbase/process.c and ntdll/env.c ONLY for
      # the i386 farm below and put back right after it: the arm64ec builds of extra DLLs (tools/build-wine-extra-
      # dlls.sh) compare an unpatched ntdll/kernelbase byte for byte with the shipped ones. This script is named
      # patch-wine-*, so the farm's cache key (which hashes it) rebuilds the farm once.
      - name: Patch wine for the opt-in x64 machine answer (i386 farm only)
        run: |
          python3 tests/host/check-x64-machine.py
          python3 tools/patch-wine-x64-machine.py wine

      # madeira-bcd (round 624, agent A S13: osu! SV6C4C, Deadpool, Diablo II): [veh] add, which of a 32-bit program's own modules
      # registers an exception handler (ntdll's RtlAddVectoredExceptionHandler / RtlAddVectoredContinueHandler, kernelbase's
      # SetUnhandledExceptionFilter; 16 lines a process at most; log only). i386 farm only, put back right after it like the x64
      # machine answer: the 64-bit ntdll/kernelbase are committed binaries and the arm64ec extra-DLL builds compare an unpatched
      # ntdll/kernelbase byte for byte with them.
      - name: Patch wine with the exception-handler registration log (i386 farm only)
        run: |
          python3 tests/host/check-veh-add-log.py
          python3 tools/patch-wine-veh-add-log.py wine

      # madeira-bcd (round 624, agent E2 S13: Guacamelee Gold 0P65SX, Hitman: Contracts KBBQJK, Guacamelee STCE DDFJM7/DNWRXA):
      # '"msvcrt.dll" failed to initialize' names no step; this says whether HeapCreate or the "C" locale failed (the TLS step already
      # does). Log only, on branches that end the process today. i386 farm only, put back right after it: dlls/msvcrt/main.c is
      # shared by the arm64ec msvcr* builds of tools/build-wine-extra-dlls.sh.
      - name: Patch wine with the msvcrt init diagnostics (i386 farm only)
        run: |
          python3 tests/host/check-msvcrt-initdiag.py
          python3 tools/patch-wine-msvcrt-initdiag.py wine

      # WoW64's 32-bit Windows farm (app/Madeira/i386-windows), which upstream
      # builds from the pinned wine and DXMT (build/wine-i386) and does not
      # commit. Cached per wine/DXMT revision and per the tools/patch-wine-*.py
      # source patches the steps above apply (madeira-bcd 2026-10-21: without
      # them in the key, a new Wine patch never reached the cached farm, e.g.
      # GTA IV's d3dx9_43); a failure only leaves 32-bit
      # programs without their DLLs, so it does not stop the IPA.
      - name: i386 farm revision
        id: i386rev
        shell: bash
        run: echo "key=i386-farm-$(git -C wine rev-parse HEAD)-$(git -C dxmt rev-parse HEAD)-${{ hashFiles('build/wine-i386/build.sh', 'tools/patch-dxmt-*.py', 'tools/patch-wine-*.py') }}" >> "$GITHUB_OUTPUT"

      - name: Restore i386 farm
        id: i386cache
        uses: actions/cache/restore@v4
        with:
          path: app/Madeira/i386-windows
          key: ${{ steps.i386rev.outputs.key }}

      - name: Build i386 farm (WoW64)
        id: i386build
        if: steps.i386cache.outputs.cache-hit != 'true'
        continue-on-error: true
        shell: bash
        run: |
          bash build/wine-i386/build.sh 2>&1 | tail -60; rc=${PIPESTATUS[0]}
          N=$(ls app/Madeira/i386-windows | wc -l | tr -d ' ')
          echo "::notice::i386 farm: $N files (build exit $rc)"
          [ "$rc" -eq 0 ] || { tail -40 wine/build-i386/madeira-i386-build.log 2>/dev/null; exit "$rc"; }

      - name: Save i386 farm
        if: steps.i386cache.outputs.cache-hit != 'true' && steps.i386build.outcome == 'success'
        uses: actions/cache/save@v4
        with:
          path: app/Madeira/i386-windows
          key: ${{ steps.i386rev.outputs.key }}

      - name: Put back the files patched for the i386 farm only (x64 machine answer)
        if: always()
        run: git -C wine checkout -- dlls/ntdll/env.c dlls/kernelbase/process.c dlls/ntdll/exception.c dlls/kernelbase/debug.c dlls/msvcrt/main.c

      # madeira-bcd: DXMT's Direct3D 9 frontend compiled for arm64ec (tools/build-d3d9-x64-dll.sh), shipped as
      # arm64ec-windows/d3d9-dxmt.dll NEXT TO Wine's d3d9.dll, which stays the default: a 64-bit game gets it as its d3d9.dll only
      # with env.MADEIRA_D3D9_X64 = dxmt (WineProcessBridge.m). Here, after every DXMT patch step and the i386 farm, so the
      # sources are the tree d3d9-emulated.dll was built from; outside the i386 farm's cache key (no tools/patch-dxmt-*.py,
      # tools/patch-wine-*.py or build/wine-i386/build.sh changed for it). Nothing that ships today may change: the step hashes the
      # d3d9, d3d11, dxgi, d3d10core and winemetal DLLs of both farms before and after and fails if one differs. A failure only
      # warns: nothing is shipped and Wine's d3d9.dll goes out alone, as before.
      - name: Build d3d9-dxmt.dll (DXMT Direct3D 9 for 64-bit games, arm64ec)
        continue-on-error: true
        shell: bash
        run: |
          shipped() {
            for f in app/Madeira/arm64ec-windows/{d3d9,d3d11,dxgi,d3d10core,winemetal}.dll \
                     app/Madeira/i386-windows/{d3d9,d3d9shim,d3d9-emulated,d3d11,dxgi,d3d10core,winemetal}.dll; do
              [ -f "$f" ] && shasum -a 256 "$f"
            done
            return 0
          }
          T="$(mktemp -d)"
          shipped > "$T/before"
          rc=0
          bash tools/build-d3d9-x64-dll.sh || rc=$?
          shipped > "$T/after"
          if ! cmp -s "$T/before" "$T/after"; then
            echo "::error::a shipped Direct3D / DXGI / winemetal DLL changed while d3d9-dxmt.dll was built:"
            diff "$T/before" "$T/after" || true
            exit 1
          fi
          echo "::notice::the $(wc -l < "$T/before" | tr -d ' ') shipped d3d9, d3d11, dxgi, d3d10core and winemetal DLLs are byte for byte what they were before d3d9-dxmt.dll was built"
          exit "$rc"

      # madeira-bcd (round 602): crosire's d3d8to9 (Direct3D 8 on Direct3D 9, BSD-2-Clause, third-party/d3d8to9) and FunkyFr3sh's cnc-ddraw
      # (a DirectDraw replacement, MIT, third-party/cnc-ddraw), built for i686 with llvm-mingw into the i386 farm AFTER its cache was
      # saved (outside the farm's cache key, like d3d9-dxmt.dll above), as d3d8to9.dll and cnc-ddraw.dll NEXT TO Wine's d3d8.dll and
      # ddraw.dll, which stay the default: a game gets them only with env.MADEIRA_D3D8 = d3d9 / env.MADEIRA_DDRAW = cnc (BCDGraphicsRoutes.c).
      # Nothing that ships today may change: each step hashes the farm's Direct3D, DirectDraw, DXGI and winemetal DLLs before and after
      # and fails if one differs. A failure only warns: nothing is shipped and Wine's DLLs go out alone, as before.
      - name: Build d3d8to9.dll (Direct3D 8 on Direct3D 9, i386)
        continue-on-error: true
        shell: bash
        run: |
          shipped() {
            for f in app/Madeira/i386-windows/{d3d8,d3d9,d3d9shim,d3d9-emulated,d3d11,dxgi,d3d10core,winemetal,ddraw,wined3d,d3dx9_43}.dll; do
              [ -f "$f" ] && shasum -a 256 "$f"
            done
            return 0
          }
          T="$(mktemp -d)"
          shipped > "$T/before"
          rc=0
          bash tools/build-d3d8to9-dll.sh || rc=$?
          shipped > "$T/after"
          if ! cmp -s "$T/before" "$T/after"; then
            echo "::error::a shipped Direct3D / DirectDraw / DXGI / winemetal DLL of the i386 farm changed while d3d8to9.dll was built:"
            diff "$T/before" "$T/after" || true
            exit 1
          fi
          exit "$rc"

      - name: Build cnc-ddraw.dll (DirectDraw replacement, i386)
        continue-on-error: true
        shell: bash
        run: |
          shipped() {
            for f in app/Madeira/i386-windows/{d3d8,d3d9,d3d9shim,d3d9-emulated,d3d11,dxgi,d3d10core,winemetal,ddraw,wined3d,d3dx9_43}.dll; do
              [ -f "$f" ] && shasum -a 256 "$f"
            done
            return 0
          }
          T="$(mktemp -d)"
          shipped > "$T/before"
          rc=0
          bash tools/build-cnc-ddraw-dll.sh || rc=$?
          shipped > "$T/after"
          if ! cmp -s "$T/before" "$T/after"; then
            echo "::error::a shipped Direct3D / DirectDraw / DXGI / winemetal DLL of the i386 farm changed while cnc-ddraw.dll was built:"
            diff "$T/before" "$T/after" || true
            exit 1
          fi
          exit "$rc"

      # madeira-bcd FORK-ONLY (owner's decision, 2026-10-11): never part of a pull request to
      # upstream. The D3D9 (i386, into the farm above, after its cache is saved) and D3D11
      # (x86-64) smoke tests the home screen's "Test programs" start (bcd-smoke/).
      - name: Build the fork-only smoke tests (bcd-smoke)
        if: env.MINGW_OK == '1'
        run: bash bcd-smoke/build.sh

      # BCD Host (bcd-host/, BCD's own, Epic Games milestone 2): bcdhost.exe, a ~17 KB x86-64 program with
      # kernel32 only that the app starts for an Epic game it starts signed in. A build output staged in
      # arm64ec-windows (gitignored); without it a signed-in start is not offered and every game starts as
      # before, so a failure here only warns (as the Dock host's does).
      - name: Build BCD Host
        if: env.MINGW_OK == '1'
        continue-on-error: true
        run: |
          bash build/bcd-host/build.sh || echo "::warning::BCD Host not built: Epic games start without the Epic sign-in"

      - name: Build dxmt-ios
        shell: bash
        run: |
          set +e
          bash build/dxmt-ios/build.sh
          rc=$?
          if [ "$rc" -ne 0 ]; then
            for f in build/dxmt-ios/obj/*.err; do
              [ -s "$f" ] || continue
              grep -q "error:" "$f" || continue
              echo "===== $f ====="
              grep -m 10 -B2 -A6 "error:" "$f"
            done
          fi
          exit "$rc"

      - name: Combine DXMT + LLVM into libdxmt_combined.a
        shell: bash
        run: |
          cd build/dxmt-ios
          xcrun -sdk iphoneos libtool -static -o libdxmt_combined.a \
            obj/*.o "$GITHUB_WORKSPACE"/toolchains/llvm-ios-build/lib/*.a
          cp libdxmt_combined.a "$GITHUB_WORKSPACE/app/Madeira/"
          echo "::notice::libdxmt_combined.a $(wc -c < libdxmt_combined.a | tr -d ' ') bytes"

      # bcd.cfg indirect-fast = 1 (opt-in): ExecuteIndirect records after
      # the first are encoded without per-record setup. fullscreen-window = 1
      # (opt-in): entering full screen moves the window over the monitor.
      # dxbc-register-spaces = 1 (opt-in): shader model 5.1 resources outside
      # register space 0 are converted instead of refused. The metal-gap line
      # (logging only) says what Metal's allocated total is made of.
      - name: Check the opt-in ExecuteIndirect fast path, full-screen window, DXBC register spaces and the Metal census
        run: |
          python3 tests/host/check-indirect-fast.py
          python3 tests/host/check-fullscreen-window.py
          python3 tests/host/check-dxbc-register-spaces.py
          python3 tests/host/check-metal-gap.py

      # A mesh pipeline without a fragment function gets an empty one instead
      # of Metal's abort (gs-null-fragment, on). The converter's code 4 names
      # no resource: the D3D12 runtime logs which bindings no root-signature
      # entry covers (logging only).
      - name: Check the empty fragment function and the root-signature miss log
        run: |
          python3 tests/host/check-null-fragment.py
          python3 tests/host/check-rsig-miss.py

      # Horizon Zero Dawn's refused shaders (build 475): a code-4 retry with
      # sized unbounded ranges, a session memo of refusals and placeholder
      # pipelines (msc-unbounded-retry, msc-fail-memo, pso-placeholder; all off).
      - name: Check the refused-shader retry, memo and placeholder
        run: python3 tests/host/check-msc-unbounded-retry.py

      # madeira-bcd: Horizon Zero Dawn on build 480 (20:28): 23,045 shader
      # libraries kept for 52,570 pipelines (iOS closed it at 8,189 MB), and
      # clears with rectangles cleared whole targets. Both opt-in.
      - name: Check shader libraries only for pipelines in use and rectangle clears
        run: |
          python3 tests/host/check-pso-lazy-libs.py
          python3 tests/host/check-clear-rects.py

      # madeira-bcd: Horizon Zero Dawn's compute-skinned characters lose faces,
      # hair or whole bodies every few frames on build 481 (gpu-sync or not):
      # skin-check and view-census log what those draws read and which buffer
      # views fall back. Both diagnostics, off by default.
      - name: Check the skin-check and view-census diagnostics
        run: python3 tests/host/check-skin-check.py

      # madeira-bcd: Horizon Zero Dawn's walls, trees and plants vanish for
      # single frames on build 486: aligned copies of offset typed views
      # (typed-view-shadow), the per-frame draw and culling-readback trace
      # (vis-trace) and the empty-readback experiment (readback-far). All off
      # by default.
      - name: Check typed-view-shadow, vis-trace and readback-far
        run: python3 tests/host/check-vis-trace.py

      # madeira-bcd: A/B switches for the same corruption, all off by default:
      # d3d12-wave-ops = 0, d3d12-binding-tier = 3, d3d12-raw-typed-views = 1,
      # and ignore-volatile-metadata = 1 (FEX's x86 ordering for whole images).
      - name: Check the opt-in switches for the Sony ports' corrupted meshes
        run: python3 tests/host/check-nixxes-optins.py

      # madeira-bcd: RDR2 froze on build 476 (16:55:52) when the guest RIP
      # profile took libpthread's thread-list lock with a thread suspended.
      - name: Check that no sampler takes a lock with a thread suspended
        run: python3 tests/host/check-suspend-windows.py

      # madeira-bcd: Horizon Zero Dawn got no input (build 471): XInput pads as
      # Windows.Gaming.Input gamepads (MADEIRA_WGI_HOST_PADS=1) and the opt-in
      # foreground for a process when no window is foreground
      # (MADEIRA_INPUT_FOREGROUND=1).
      - name: Check XInput pads in Windows.Gaming.Input and the input foreground
        run: |
          python3 tests/host/check-wgi-host-pads.py
          python3 tests/host/check-input-foreground.py

      # madeira-bcd: hardware keyboard and mouse (docs/KEYBOARD_MOUSE.md): the key map and
      # each key's PC scan code through Wine's US layout, the navigation keys' E0 flag, the
      # mouse's absolute mapping (a touch's, for every display mode and monitor size), the
      # hidden-cursor classification (follow the pointer or relative), key repeat, the
      # driver's clip and warp reports and the wineserver's reader report (2026-10-18: a
      # tester's Warcraft II on an iPad drifted away from the iPad pointer).
      - name: Check hardware keyboard and mouse
        run: |
          python3 tests/host/check-hardware-input.py
          python3 tests/host/check-nav-keys.py

      # madeira-bcd: Red Dead Redemption 2 kept 1.5 GB of argument-ring chunks (build 470);
      # ring-share = 1 returns them per batch. Also the ExecuteIndirect fast-path tallies.
      - name: Check the shared argument ring
        run: python3 tests/host/check-ring-share.py

      # madeira-bcd: static-cbv (Horizon Zero Dawn): table constant buffers as each draw was recorded.
      - name: Check static-cbv
        run: python3 tests/host/check-static-cbv.py

      # madeira-bcd: ucrtbase-x64math.dll (env.MADEIRA_UCRT_X64_MATH): floor and sqrt as x64 code.
      - name: Check ucrt-x64-math
        run: python3 tests/host/check-ucrt-x64-math.py

      # madeira-bcd: env.MADEIRA_APP_DLL_SHADOW (off by default) refuses named
      # app-local x64 DLLs like ucrtbase.dll (Crysis 3 Remastered's vcruntime140.dll).
      - name: Check app-local DLL shadow
        run: python3 tests/host/check-app-dll-shadow.py

      # madeira-bcd (build 580), engine fixes from the 580 log wave: CAS/CASAL on an anonymous RWX alias (Jetboard Joust), a
      # 32-byte STP Q across a 16 KB page (NFS Underground 2), a zero-size D3D12 texture (Spider-Man Remastered), the
      # [alloc-fail] log past 65536 failures (Spelunky 2).
      - name: Check the build 580 engine fixes
        run: |
          python3 tests/host/check-anon-cas.py
          python3 tests/host/check-stp-straddle.py
          python3 tests/host/check-d3d12-zero-extent.py
          python3 tests/host/check-alloc-fail-throttle.py

      - name: Check anonymous alias LDADDAL word emulation
        run: python3 tests/host/check-anon-ldadd.py

      # madeira-bcd (build 591), engine fixes from the 580 log wave: env.MADEIRA_FAULT_GUARD_RATE (fault-storm guards that ended live Unity
      # Mono games), env.MADEIRA_USER_VA_GB (FINAL FANTASY TACTICS asks for 256 GiB), create_view's assert, env.MADEIRA_ANON_CAS_FLUSH
      # (Jetboard Joust), and the log-only diagnostics: [stp-split] read-back, [cxx-type], [smc-loop].
      - name: Check the build 591 engine fixes
        run: |
          python3 tests/host/check-fault-guard-rate.py
          python3 tests/host/check-fault-guard-guest-rip.py
          python3 tests/host/check-recovery-log-sample.py
          python3 tests/host/check-pool-split-retry.py
          python3 tests/host/check-user-va-gb.py
          python3 tests/host/check-create-view-conflict.py
          python3 tests/host/check-anon-cas-flush.py
          python3 tests/host/check-stp-split-readback.py
          python3 tests/host/check-cxx-type-diag.py
          python3 tests/host/check-term-stack-32.py
          python3 tests/host/check-smc-loop-diag.py

      # madeira-bcd: env.MADEIRA_JUMBO_HALF (off by default) gives a failed 8 GB probe
      # reservation its 4 GB arena (Ratchet & Clank: Rift Apart).
      - name: Check jumbo half
        run: python3 tests/host/check-jumbo-half.py

      # madeira-bcd: env.MADEIRA_ALIAS_RELEASE (off by default): anonymous JIT aliases follow
      # MEM_RELEASE and MEM_DECOMMIT (Ratchet & Clank: Rift Apart froze loading a save).
      - name: Check alias release
        run: python3 tests/host/check-alias-release.py

      # madeira-bcd: env.MADEIRA_VA_PRESSURE_GAP_OK (off by default): a slow scan through the hole
      # iOS refuses below the app image does not latch address-space pressure (Rift Apart, 556).
      - name: Check va-pressure gap
        run: python3 tests/host/check-va-pressure-gap.py

      # madeira-bcd: env.MADEIRA_FEX_BAND_KEEP_MB (off by default): the steer valve may not take the lowest N MB
      # of the emulator's arena (No Rest for the Wicked, build 574: "FEXAlloc could not allocate").
      - name: Check FEX band keep
        run: python3 tests/host/check-fex-band-keep.py

      # madeira-bcd: env.DOTNET_EnableWriteXorExecute = 0 for a self-contained .NET 7+ game (Quaver, build 574: the
      # CLR's write-barrier assert); the runtime's own switch, wired to auto-tune and Quaver's list.
      - name: Check .NET write-xor-execute off
        run: python3 tests/host/check-dotnet-wx.py

      # madeira-bcd: env.DOTNET_GCRegionRange = 400000000 (16 GB) for a .NET 7+ game whose garbage collector cannot reserve its
      # 256 GB range (Unrailed! 2, build 576: "GC heap initialization failed with error 0x8007000E"); wired to auto-tune and the list.
      - name: Check .NET GC region range
        run: python3 tests/host/check-dotnet-gc-region.py

      # madeira-bcd: [nt-fail] (every failed NtAllocateVirtualMemory[Ex] / NtMapViewOfSection[Ex] with the process, size,
      # flags and extended parameters, once per kind) and [map-name] (every named section a process creates or opens, with the
      # status): the Rockstar service never reached its 2 MB shared-memory allocation in builds 574/576. Logging only.
      - name: Check [nt-fail] and [map-name]
        run: |
          python3 tests/host/check-nt-fail-log.py
          python3 tests/host/check-map-name-log.py

      # round 579: an AnyCPU IL-only .NET program (PE32, no 32BITREQUIRED) was run as a native ARM64 process, whose set has no
      # mscoree.dll: "mscoree.dll not found, IL-only binary ... cannot be loaded", c000007b (The Dishwasher: Vampire Smile,
      # SSXDRW). The server's copy (build/wineserver/mapping_ios.c) withholds ComPlusNativeReady while aarch64-windows has no
      # mscoree.dll, so the program runs as i386 under WoW64 with Wine Mono, as 32BITREQUIRED .NET programs do.
      - name: Check the AnyCPU .NET machine (no native ARM64 without an mscoree.dll)
        run: python3 tests/host/check-ilonly-machine.py

      # madeira-bcd (round 577): a child's ntdll copy skips a pool range that lost EXEC (Vice City AE6NQZ/S0TH0N), a small
      # address map retries the next free range after a refused MAP_FIXED (iPhone13,4 / iOS 18), and every spawn line
      # names the child's current directory (Terraria's "Asset could not be found").
      - name: Check pool dead-range skip, small-map retry, spawn cwd
        run: |
          python3 tests/host/check-pool-dead-range.py
          python3 tests/host/check-reserved-area-retry.py
          python3 tests/host/check-spawn-cwd-log.py
          python3 tests/host/check-tail-carve-exec.py

      # madeira-bcd (round 578): a program that ends on a thread other than the engine's boot thread (GTA IV, Stranglehold)
      # never made __wine_main return, so BCD kept the last frame for good: the library now ends such a session when none of
      # the program's own processes is left, says "The game closed (exit code N)", and returns; the app's own program name is
      # given back as the program ends (the dangling getprogname() that crashed iOS afterwards); a child that ended off its
      # boot thread no longer keeps a launcher's session alive (Hello Neighbor).
      - name: Check session end off the boot thread
        run: python3 tests/host/check-session-end.py

      # madeira-bcd (round 579, Trails in the Sky 1st Chapter 24VADD/X56ZXZ/YTMNEK): GetDisplayConfigBufferSizes says "1 path, 2 modes" for
      # the virtual monitor and QueryDisplayConfig answers "success, 0 paths": a game that builds its fullscreen window from the paths
      # makes a one-pixel window at 32767 and then clears a NULL swapchain. The default answers are unchanged (the test runs the
      # production function against build 578's, byte for byte, on the host); a [vdcfg-mismatch] line names both answers once, and
      # env.MADEIRA_VDCFG_PATH = 1 (auto-tune rule vdcfg-virtual-path, only after that crash) lists the virtual monitor's path.
      - name: Check QueryDisplayConfig and the virtual monitor's path
        run: python3 tests/host/check-vdcfg-path.py

      # madeira-bcd (round 579, Stardew Valley BD8079/S4QB4S/XK1A2J): the .NET runtime's threads call GetLastError / SetLastError 12-19
      # million times a second before any window exists. [spin] ml1140 (build/ntdll-unix/server_ios.c) keys on the xprobe's own x64->EC
      # numbers (same target, 4 reports) and logs the busy threads' registers, the x86 code at the guest RIP and the x86 return
      # addresses once per streak; nothing runs in the game's threads; MADEIRA_LEAN_DIAG touches no thread.
      - name: Check the [spin] call-rate look
        run: python3 tests/host/check-spin-diag.py

      # madeira-bcd (round 623, Forza Horizon 4 D9NHGJ / RVXHV6 / 58VNDB): the [spin] ml677 snapshot (build/ntdll-unix/signal_arm64_ios.c) also
      # prints 256 guest code bytes from rip-192, the guest registers and 128 guest stack words, only when a spin streak fires.
      - name: Check the [spin] guest code and stack window
        run: python3 tests/host/check-spin-guest-context.py

      # madeira-bcd (round 579): a BCD Dock session whose game died with an error (Dying Light 32FEAT, The Binding of Isaac VV5NHZ:
      # c0000005) stayed open on its dead desktop: the session's own program is Wine's desktop, which never closes by itself on iOS.
      # The library now ends it when the game's last process ended with an error status, nothing of the game runs, the host
      # finished and 10 s passed (DockGameEnd.swift, process_ios.c's ring of ended processes, wine_session_dock_game_ended), and says
      # which Windows error the game closed with; auto-tune gets the status.
      # env.MADEIRA_DOCK_GAME_END = 0 turns it off, env.MADEIRA_DOCK_GAME_END_GRACE sets the seconds.
      - name: Check Dock game end
        run: ASAN_OPTIONS=symbolize=0 python3 tests/host/check-dock-game-end.py

      # madeira-bcd (round 624, agent D2 S3 and S7; Geometry Dash from the Windows desktop VDFZHN, Steam with Rockstar's launcher RX4AK5):
      # the Windows desktop says why a program ended at once. The engine marks a process that made a real OpenGL call (the stub table,
      # virtual_ios.c) and keeps the mark with its end (process_ios.c, madeira_child_ends_since); the library logs [desktop-exit] and
      # puts one notice on the session line for an OpenGL program, and once when the JIT pool refuses an image. Text and log only.
      - name: Check the Windows desktop's exit watch
        run: ASAN_OPTIONS=symbolize=0 python3 tests/host/check-desktop-exit.py

      # madeira-bcd (round 579, Tomb Raider: Underworld ZWAA2K): a 32-bit main program that cannot get its 4 GB window ended the boot
      # thread with pthread_exit (fatal_error), so the session never ended and the app showed "running" for three minutes. The failure
      # now reports its status and leaves by exit(): the shim long-jumps back to wine_process_thread on the boot thread.
      - name: Check a 32-bit main program that cannot get its window
        run: python3 tests/host/check-main-window-exit.py

      # madeira-bcd (round 578, ajan6-arkham): Batman: Arkham City GOTY (builds 574/576) and Injustice (574) die in the same UE3 lock-free
      # list pop right after a 64-bit FILD/FISTP that the emulator's 64-bit x87 (X87ReducedPrecision, on for 32-bit guests) rounds to 53
      # bits. [x87-int64] (build/ntdll-unix/ios_x87_int64_diag.h) compares the list head's memory with the value the guest got and says
      # LOST or EXACT; [fault-rgn] names the views below and above the fault and the views under 1 MB around it, and the provenance
      # line says when its view is gone (virtual_ios.c). Log only; the first test compiles the production header and runs it on
      # constructed memory (macOS), the second the ring and provenance functions against fakes. Rule x87-int64-roundtrip (auto-tune)
      # is checked with the other rules.
      - name: Check [x87-int64] and the fault neighbour lines
        run: |
          python3 tests/host/check-x87-int64-diag.py
          python3 tests/host/check-fault-neighbour-diag.py

      # ajan7-arkham: [wow-null32] (a 32-bit guest's use of the NULL page: registers, stack and TLS cells) and the [tls-cross-clear] line
      # plus MADEIRA_TLS_CLEAR_OWN_PROCESS (TlsFree reaches into other pseudo-processes' threads); compiled runs against fakes (macOS).
      - name: Check [wow-null32] and the TlsFree cross-process line
        run: |
          python3 tests/host/check-wow-null-diag.py
          python3 tests/host/check-tls-clear-process.py

      # ajan11-wow64stack: a dead 32-bit thread's stack is released in ITS window (virtual_free_teb handed it to the next exiting
      # thread, of another process, and the release landed on that process's live stack: Battle.net's network-service helper), and a
      # storm in a child Windows process ends that process only, not the app (MADEIRA_REDELIV_CHILD_ONLY=0 = the old ending); a
      # protection fault (SIGBUS) inside a system call's __TRY (the EA installer's ReadProcessMemory probe of its own stack) fails the call.
      # Compiled runs against fakes (macOS/Linux); the four changed files are also compiled for iOS when the wine headers exist.
      - name: Check the dead-thread stack release, the child-process storm ending and the system-call fault
        run: python3 tests/host/check-wow-stack-storm.py

      # madeira-bcd: kernelbase-fibertrace.dll (env.MADEIRA_FIBER_TRACE): the fiber calls logged.
      - name: Check kernelbase fiber trace
        run: python3 tests/host/check-kernelbase-fibertrace.py

      # madeira-bcd: LDXR/LDAXR ... AND/ORR/EOR ... STXR/STLXR into a JIT-aliased page (Graveyard Keeper 2, build 574).
      - name: Check exclusive pairs with a logical operation
        run: python3 tests/host/check-excl-rmw.py

      # madeira-bcd: wer-optin.dll (env.MADEIRA_WER): Wine's wer.dll for the one game that imports it.
      - name: Check wer opt-in
        run: python3 tests/host/check-wer-optin.py

      # madeira-bcd: wintypes-optin.dll (env.MADEIRA_WINTYPES): Wine's wintypes.dll for Unity IL2CPP games.
      - name: Check wintypes opt-in
        run: python3 tests/host/check-wintypes-optin.py

      # madeira-bcd: env.MADEIRA_OPTIN_DLLS: dxva2, evr, xpsprint for the games that list them.
      - name: Check opt-in DLLs
        run: python3 tests/host/check-optin-dlls.py

      # madeira-bcd (round 620): NtMapViewOfSection judges a 32-bit program's explicit base by its guest address inside
      # its WoW64 window (DirectPlay's static data at 0x50000000: Requiem, Hotline Miami); the real block runs on the host.
      - name: Check WoW64 explicit section base
        run: python3 tests/host/check-wow-map-zero-bits.py

      # madeira-bcd (round 620): F1 2020's CopyStructureCount with an empty buffer is skipped (the DXMT patch).
      - name: Check DXMT CopyStructureCount
        run: python3 tests/host/check-dxmt-copy-structure-count.py

      # madeira-bcd (round 620): Frostbite 2's render target views on a buffer: logged, and env.MADEIRA_BUFFER_RTV_EMPTY = 1
      # answers them with no view (Need for Speed: The Run; the DXMT patch, d3d11-src.dll for 64-bit games).
      - name: Check DXMT render target views on a buffer
        run: python3 tests/host/check-dxmt-buffer-rtv.py

      # madeira-bcd (round 624): Dark Souls III's SRV mip count from GetDesc (the DXMT patch, opt-in; d3d11-src.dll for the 64-bit game).
      - name: Check DXMT SRV GetDesc mip count
        run: python3 tests/host/check-dxmt-srv-getdesc.py

      # madeira-bcd (round 620, thebcd69/bcd-games#17): Add a game names why a file is not a Windows program (words only).
      - name: Check the not-a-Windows-program words
        run: python3 tests/host/check-not-windows-program.py

      # ajan10/wine: Wine's bcrypt unix side answers STATUS_INVALID_BUFFER_SIZE for an unaligned AES/3DES-CBC length instead of
      # letting nettle's assert end the app (A Plague Tale: Innocence, build 580); the guard is compiled on the host.
      - name: Check bcrypt CBC length guard
        run: python3 tests/host/check-bcrypt-cbc-guard.py

      # ajan10/wine: env.MADEIRA_NLS_EXTRA = 1 makes Wine's c_932 / c_936 / c_949 / c_950 / c_874 / c_1250 ... c_1258 (app/Madeira/nls/extra)
      # visible to a game that asks for them (Sword and Fairy 3 asks for 936); the lookup is cut out of env_ios.c and compiled on the host.
      - name: Check extra code page tables
        run: python3 tests/host/check-nls-extra.py

      # madeira-bcd: setupapi-optin.dll (env.MADEIRA_OPTIN_DLLS = setupapi): a lock round Wine's device node
      # table, for Dying Light's controller library racing the main thread (build 576).
      - name: Check setupapi device node lock
        run: python3 tests/host/check-setupapi-devinst-lock.py

      # madeira-bcd: a game's own switches end with its session.
      - name: Check session switches
        run: python3 tests/host/check-session-switches.py

      # madeira-bcd: [win-create] / [tiny-win] and env.MADEIRA_TINY_WINDOW_FIX = 1 (off by default): a swapchain's window
      # that stays under 160x120 while a 320x200 or larger picture is drawn into it is sized to the virtual screen
      # (American Truck Simulator, 132x38). build/win32u-unix/driver_ios.c, app/Madeira/Winios/Winios.m.
      - name: Check tiny swapchain window
        run: python3 tests/host/check-tiny-window.py

      # madeira-bcd: a paused first-time Steam install survives closing BCD.
      - name: Check Steam paused download restore
        run: python3 tests/host/check-steam-restore-paused.py

      # madeira-bcd: Steam DLC for the games BCD downloads (BCDSteamDLC/, BCDGameDLC.swift): owned-DLC detection, depot
      # selection with and without DLC, the install record, removal, the choice file, the [steam-dlc] log lines.
      - name: Check Steam DLC
        run: python3 tests/host/check-steam-dlc.py --require-swift

      # madeira-bcd: exe-window-mb: room at 0x140000000 for a large fixed-address program (Hogwarts Legacy).
      - name: Check exe window
        run: python3 tests/host/check-exe-window.py

      # madeira-bcd: D3DXCreateVolumeTextureFromResourceEx (GTA IV).
      - name: Check d3dx9 volume textures from resources
        run: python3 tests/host/check-d3dx9-volume-resource.py

      # madeira-bcd: [steam-api] (build/ntdll-unix/thread_ios.c): the Steam registry values, the pid and the
      # DIPC objects a process sees when Valve's steam_api64.dll says no Steam is running (Rockstar launcher).
      - name: Check steam_api diagnostics
        run: python3 tests/host/check-steam-api-diag.py

      # madeira-bcd: the readback probes read a freed buffer safely (Batman: Arkham Asylum, build 574).
      - name: Check probe safe read
        run: python3 tests/host/check-probe-safe-read.py

      # madeira-bcd: quiet-log (madeira-d3d12) and MADEIRA_SRV_FGETPATH (wineserver).
      - name: Check quiet-log
        run: python3 tests/host/check-quiet-log.py

      # madeira-bcd: shader-cache-native (madeira-d3d12 + winemetal): the shader cache's files without Wine's file API.
      - name: Check sc-native
        run: python3 tests/host/check-sc-native.py

      # madeira-bcd: encode-batch (one encodeCommands call per encoder), draw-dedup
      # (no repeated render state) and rp-lean (winemetal fills only used targets).
      - name: Check encode-batch
        run: python3 tests/host/check-encode-batch.py

      - name: Check draw-dedup
        run: python3 tests/host/check-draw-dedup.py

      - name: Check rp-lean
        run: python3 tests/host/check-rp-lean.py

      # madeira-bcd: addr-scan (GPU-address lookups stop where nothing earlier reaches).
      - name: Check addr-scan
        run: python3 tests/host/check-addr-scan.py

      # madeira-bcd: get_handle_fd's descriptor in the reply and sampled per-descriptor
      # server log lines (on by default; MADEIRA_SRV_FD_SOCKET / MADEIRA_SRV_LOG_ALL undo them).
      - name: Check srv-fd-reply
        run: python3 tests/host/check-srv-fd-reply.py

      # madeira-bcd: opt-in direct wineserver requests (env.MADEIRA_SRV_DIRECT).
      - name: Check srv-direct
        run: python3 tests/host/check-srv-direct.py

      # madeira-bcd: opt-in server thread QoS following ECO and the server loop's idle tick
      # (env.MADEIRA_SRV_ECO_FOLLOW, env.MADEIRA_SRV_IDLE_US).
      - name: Check srv-eco-follow
        run: python3 tests/host/check-srv-eco-follow.py

      # madeira-bcd: size/index/end-of-file queries from one fstat (patched above, before ntdll-unix).
      - name: Check file-info-fstat
        run: python3 tests/host/check-file-info-fstat.py

      # madeira-bcd: env.MADEIRA_LEAN_DIAG (opt-in): no thread-suspending samplers, rare memory walks.
      - name: Check lean-diag
        run: python3 tests/host/check-lean-diag.py

      # madeira-bcd: env.MADEIRA_ECO_NATIVE (opt-in): the runtime's helper threads at utility QoS.
      - name: Check eco-native
        run: python3 tests/host/check-eco-native.py

      # madeira-bcd: the frame-cap power governor (opt-in: env.MADEIRA_FPS_CAP / MADEIRA_FPS_GOV_MW).
      - name: Check fps-gov
        run: python3 tests/host/check-fps-gov.py

      # madeira-bcd: env.MADEIRA_POWER_PROBE (opt-in): GPU, SoC and device power next to [xp].
      - name: Check power-probe
        run: python3 tests/host/check-power-probe.py

      # madeira-bcd: ntdll-sync.dll (tools/patch-wine-ntdll-sync.py), opt-in since build 499
      # (env.MADEIRA_NTDLL_SYNC = 1 maps it): cheaper SRW locks and critical sections.
      - name: Check ntdll-sync
        run: python3 tests/host/check-ntdll-sync.py

      # madeira-bcd, from thebcd69/bcd-games#4 and thebcd69/bcd-wine#1 by mckenna654 (Diablo II: Resurrected, build 598): five switches,
      # all off unless the game's own file sets them: env.MADEIRA_SHARED_SECTION_EXEC (an executable view of a pagefile section keeps its
      # shared memory), env.MADEIRA_NTDLL_XSEC (ntdll-xsec.dll, tools/patch-wine-ntdll-xsec.py: the emulator is told about it, and two
      # code-probe recoveries, one gated by env.MADEIRA_D2R_PROBE_RECOVERY), env.MADEIRA_NTDLL_DATA_SYNC_RANGE (a sub-page protect of
      # ntdll's .data copies only its bytes) and env.MADEIRA_FAULT_LOOP_GUEST_PROGRESS (breakpoints at different guest addresses are no
      # stuck thread). tests/x64/shared-section-x64.c is the device program for the first two.
      - name: Check the executable-section switches (D2R)
        run: |
          python3 tests/host/check-shared-section-exec.py
          python3 tests/host/check-ntdll-data-sync-range.py
          python3 tests/host/check-fault-loop-guest-progress.py
          python3 tests/host/check-ntdll-xsec.py

      # madeira-bcd: the Mach handler repairs a TEB access whose base an ADD computed from a
      # zeroed x18, also when the ADD wrote its own index register (HZD build 500).
      - name: Check x18-derived base
        run: python3 tests/host/check-x18-derived-base.py

      # madeira-bcd (round tur600): a page fault that has to wait for virtual_mutex says which fault it is before it waits ("[vm-fault-wait]",
      # build/ntdll-unix/virtual_ios.c). Seven logs of four games (OMORI, Demons Roots, Saints Row IV, ONE PIECE Bounty Rush) stop with a thread
      # parked in memset / memmove under NtFreeVirtualMemory or virtual_map_section and the Mach exception thread waiting for the mutex that
      # thread holds; the log never named the fault. Nothing else changes; the helper is cut out of the source and run on the host.
      - name: Check the vm-fault-wait line
        run: python3 tests/host/check-vm-fault-wait.py

      # BCD: EA redist processes reuse their WoW window/TEB addresses. A stale
      # exit handoff must never join self or free a replacement's live stack.
      - name: Check EA thread retirement
        run: python3 tests/host/check-ea-thread-reap.py

      # madeira-bcd: ... and also a sign-extending load (ldrsw x28, [x18, #0x180c]: FEX's WowTebOffset
      # read; Left 4 Dead 2 died of it after 200 s, FFXIV's WebView2 setup too, build 574).
      - name: Check x18 signed loads
        run: python3 tests/host/check-x18-signed-load.py

      # madeira-bcd: the WOW64 module's thread map is constructed when its static initialiser had no
      # effect (every 32-bit program on iOS 18 died in BTCpuThreadInit, build 574).
      - name: Check the WOW64 thread-map guard
        run: python3 tests/host/check-fex-wow-threads-ctor.py

      # madeira-bcd (round 624): the 32-bit FEX module translates 0x82, 0x80's 32-bit-only alias (Ubisoft Connect, South Park,
      # Assassin's Creed 2: "Unknown ALU Op: 0x10..0x16", c000001d, exit 0xdeadc0de); the patch on a copy of the pinned file, the
      # decode tables, the build wiring, the device test's compile, the trap's code bytes in [int3-guest], the auto-tune rule.
      - name: Check the FEX 0x82 alias
        run: python3 tests/host/check-fex-op82-alias.py

      # madeira-bcd: the WoW64 CPU module runs from its JIT-pool copy only where the kernel would let its PE
      # view execute next to it (iOS 18; the cause of the iOS 18 32-bit start failure, builds 573/574).
      - name: Check WoW64 CPU module pool-only execution
        run: python3 tests/host/check-wow-cpu-pool.py

      # madeira-bcd: bcd.cfg yield-mode (tools/patch-wine-yield-mode.py), opt-in.
      - name: Check yield-mode
        run: python3 tests/host/check-yield-mode.py

      # madeira-bcd: render-pass traffic (gpu-traffic counters, clear-defer;
      # opt-in rp-carry, rp-discard and its winemetal op 24, f6-rar).
      - name: Check render-pass traffic
        run: python3 tests/host/check-render-pass-traffic.py

      # madeira-bcd: FSR 3 frame-generation experiments (opt-in cs-split,
      # fi-setup-zero, fi-field-check: Horizon Forbidden West's black squares).
      - name: Check FidelityFX experiments
        run: python3 tests/host/check-ffx-experiments.py

      # madeira-bcd: default-buffer-swap (opt-in) and its -wire / -max-mb keys:
      # large committed DEFAULT buffers on file-backed storage.
      - name: Check default-buffer-swap
        run: python3 tests/host/check-default-buffer-swap.py

      # madeira-bcd: fence-poll-backoff (opt-in): GetCompletedValue without the lock,
      # and a thread spinning on an unchanged fence sleeps until it moves.
      - name: Check fence-poll-backoff
        run: python3 tests/host/check-fence-poll-backoff.py

      # madeira-bcd: fence-early (madeira-d3d12, off by default): a fence advances when the GPU
      # reached its batch; its command buffers retire on a second thread (Rift Apart, 556).
      - name: Check fence-early
        run: python3 tests/host/check-fence-early.py

      # madeira-bcd: write-buffer-immediate and query-timestamps (both opt-in, build 593): Marvel's Spider-Man
      # Remastered waits for a WriteBufferImmediate value; only its list and auto-tune rule turn them on.
      - name: Check write-buffer-immediate
        run: python3 tests/host/check-write-buffer-immediate.py

      # madeira-bcd: wow-reap (build 593): a 32-bit process that would get no guest window ends the leftover
      # threads of exited processes where they hold no host lock (Battle.net's Agent, build 592).
      - name: Check wow-reap
        run: python3 tests/host/check-wow-reap.py

      # madeira-bcd: an async I/O completion in a 32-bit process stores its IO_STATUS_BLOCK32 only where it can land (build 596). Battle.net's
      # Agent and AgentHelper (build 594), and cmd.exe children of Portal, Batman Arkham Asylum and LEGO Batman 2 (builds 579, 592): FEX's own
      # WriteFile writes rpmalloc's first log lines to a live console with an uninitialised 64-bit status block, and ntdll took it for a guest
      # one (0x10000). The decision compiled with counting probes, the real wrapper next to the original, the real probes on this Mac's
      # mappings, the sources' links, the auto-tune rule and fixtures.
      - name: Check the async I/O completion store into a 32-bit process
        run: python3 tests/host/check-iosb-dead-target.py

      # ajan18/bnet-cef: [int3-x86], an OPT-IN report for a 32-bit guest's int3 (env.MADEIRA_INT3_X86_DUMP = 1, Battle.net's launcher entry only):
      # the stack, the code, the modules and libcef.dll's CodeView record, to name the CHECK that ends Battle.net's Chromium renderers. Source
      # shape, "nothing changes when the switch is unset", compiled runs against a constructed 32-bit window (macOS), the launcher entry.
      - name: Check the 32-bit int3 report
        run: python3 tests/host/check-int3-x86-diag.py

      # ajan21/loglar: [ill-guest], the guest bytes FEX could not decode ("Invalid instruction in entry block": Jetboard Joust, build 592, seven
      # logs), printed with the same bytes through the JIT pool's alias when the dispatcher ends in SIGILL. Log only, no switch. Source shape,
      # compiled runs over real pages (plain, agreeing alias, differing alias, a block at the start of a mapped range, the cap), the iOS compile.
      - name: Check the ILL guest-bytes report
        run: python3 tests/host/check-ill-guest-diag.py

      # ajan21/loglar: [x86-fault], an OPT-IN report for a 32-bit guest's unhandled access violation or int3 (env.MADEIRA_X86_FAULT_DUMP = 1, the
      # lists of Need for Speed: Most Wanted and Underground 2 only): the code, the stack, the modules and the objects the registers point at.
      # Source shape, "nothing changes when the switch is unset", compiled runs against a constructed 32-bit window (macOS), the lists, the catalog.
      - name: Check the 32-bit fault report
        run: python3 tests/host/check-x86-fault-diag.py

      # ajan18/bnet-cef: env.MADEIRA_PROTECT_WRITECOPY_AS_RW (Battle.net's launcher entry only): VirtualProtect on a 32-bit program's writable image
      # data page, made read-only, reports PAGE_READWRITE (the value only), which V8's flag freeze checks (libcef.dll 108: Battle.net's renderers
      # ended on that int3). The evidence from the public libcef's bytes, the truth table of the change, the four pieces in virtual_ios.c, the
      # launcher entry, the auto-tune rule chromium-v8-flags-freeze-writecopy and its fixture.
      - name: Check the PAGE_WRITECOPY old protection (V8 flag freeze)
        run: python3 tests/host/check-wc-old-prot.py

      # ajan28/ozellik (2026-10-24): BCD Dock's Steam launch option. The game page lists the launch entries of Steam's configuration that a Dock
      # start can run and remembers the pick (LibraryEntry.steamLaunchOption); a game that never picked asks Valve's client for exactly the entry and
      # logs the line it did before (SteamDirectStart.dockLaunch against a verbatim copy of the old two lines). Fallout 4's configuration is one entry.
      - name: Check the Steam launch option of a Dock start
        run: python3 tests/host/check-dock-launch-option.py

      # ajan28/ozellik (2026-10-24): Fallout 4 (Steam 377160) through BCD Dock starts Fallout4.exe in place of its launcher: env.MADEIRA_SPAWN_SWAP
      # (opt-in; ios_spawn_swap.h compiled and run, the one call in process_ios.c, Fallout 4's list line with minBuild 598, the policy, the auto-tune rule
      # fallout-4-launcher-swap and its fixture).
      - name: Check the spawn swap (Fallout 4's launcher)
        run: python3 tests/host/check-spawn-swap.py

      # ajan22/loglar (2026-10-24): the Unity stop that follows a garbage collection. 31 logs of eight Unity titles answer the collector's
      # NtGetContextThread on its stopped threads with the Mach-O state and stop in a freed object's header a few dozen lines after the last burst
      # ([ec-getctx] ml715, [badrip]). The Wine server's old opt-in switch MADEIRA_CTX_FRAME (ml716: a thread parked in a system call is reported
      # by its saved call frame) is offered to that stop: No Rest for the Wicked's list from build 598, and the auto-tune rule
      # unity-gc-stopped-thread-context. This holds the server's gate, the list policy (0 or 1), the list line, the rule and its fixture.
      - name: Check the stopped-thread context switch for Unity's collector (MADEIRA_CTX_FRAME)
        run: python3 tests/host/check-ctx-frame-line.py

      # madeira-bcd: env.MADEIRA_ECO_PRIO (opt-in): under eco, threads that raise
      # themselves to TIME_CRITICAL (madeira-d3d12's workers) keep the performance cores.
      - name: Check eco-prio
        run: python3 tests/host/check-eco-prio.py

      # madeira-bcd: env.MADEIRA_WSEX_MINCORE (opt-in): QueryWorkingSetEx from mincore, and
      # madeira-d3d12's default-buffer-swap residency census.
      - name: Check wsex-mincore
        run: python3 tests/host/check-wsex-mincore.py

      # madeira-bcd: heap-untracked (opt-in, tools/patch-winemetal-heap-untracked.py).
      - name: Check heap-untracked
        run: python3 tests/host/check-heap-untracked.py

      # madeira-bcd: env.MADEIRA_SWAP_HEAT (opt-in): the swap tier's re-read census and
      # its filter for block sizes that keep paging back in.
      - name: Check swap-heat
        run: python3 tests/host/check-swap-heat.py

      # madeira-bcd (2026-10-28, build 622): in broad mode (swap-mode = 2) swap-mb caps the disk for commits into reservations
      # already in the file too, not only when a reservation is mapped (Spider-Man 2: 2,445 MB on the disk with swap-mb = 256).
      # Not the committed data (build 621): games commit several times what they write.
      - name: Check the swap-mb cap
        run: python3 tests/host/check-swap-cap.py

      # madeira-bcd (round 624; from rtmtree's fork bcd-games-persona): helper memory (mempool-mb, the ml1150 pool) spans its
      # regions, is asked before broad's disk cap, zeroes a decommit in place, merges freed space, counts free and file-backed
      # pages in its guard and ignores BCD's own limit warning; env.MADEIRA_POOL_MIN_KB and env.MADEIRA_POOL_FEX are opt-in.
      - name: Check helper memory
        run: python3 tests/host/check-helper-memory.py

      # madeira-bcd (build 623; upstream Madeira 726686e): a 32-bit program's branch to a low address faults in the guest
      # instead of ending the program (36 logs).
      - name: Check wow-low-rip
        run: python3 tests/host/check-wow-low-rip.py

      - name: Check DXMT GS/TS marshal loops
        run: python3 tests/host/check-dxmt-gsts-marshal.py

      - name: Check DXMT d3d9.customDriver and the GeForce 7900 GS card
        run: python3 tests/host/check-dxmt-d3d9-custom-driver.py

      # madeira-bcd (build 624, round 624: R.E.P.O. and other Unity games on Mono): an executable request outside the Wine view of its
      # nearest MZ page is not that image's tail (MADEIRA_MZ_VIEW_CHECK, build/ntdll-unix/ios_mz_view.h).
      - name: Check the MZ view check
        run: python3 tests/host/check-mz-view.py

      # madeira-bcd (round 626, Splatterhouse YWX9P5): a fixed section view beyond the address limit is refused (Wine answered a
      # success-class status with no view behind it), and big refused fixed views name the kernel's regions ([map-block]).
      - name: Check that a fixed view beyond the address limit is refused
        run: python3 tests/host/check-map-beyond-limit.py

      # madeira-bcd (build 624, round 624: Battle.net Y0HFHB, Garry's Mod): a 32-bit guest window is found by its reserving thread's
      # Darwin id, never by a pthread_t a dead thread left behind; the silent "already have one" branch logs how it found the window.
      - name: Check the 32-bit window owner
        run: python3 tests/host/check-wow-slot-owner.py

      # madeira-bcd (build 624, round 624: Garry's Mod, 8 of 8 logs): the committed aarch64 wow64.dll is byte-patched so a NULL SID from
      # NtQueryInformationToken (TokenAppContainerSid) is answered, not read (tools/patch-wow64-token-null-sid.py).
      - name: Check the patched wow64.dll
        run: python3 tests/host/check-wow64-token-null-sid.py

      # madeira-bcd (build 624, round 624): env.MADEIRA_STEAM_IDENTITY = none from a game's own file is checked after the game's env lines.
      - name: Check the Steam identity order
        run: python3 tests/host/check-steam-identity-order.py

      # madeira-bcd (build 624, round 624: LiveContainer, GTA V BTHD1F): the app's own __TEXT comes from the image that holds the code.
      - name: Check the app text range by dladdr
        run: python3 tests/host/check-app-text-dladdr.py

      # madeira-bcd (build 624, round 624: GTA V Legacy 71GQSA): pool-window-cut keeps the JIT pool clear of a window that was not held.
      - name: Check the pool window cut
        run: python3 tests/host/check-pool-window-cut.py

      # madeira-bcd: the ARM64EC JIT no longer maintains the call-ret shadow stack nothing reads on iOS
      # (MADEIRA_FEX_CALLRET_ELIDE=0 keeps it).
      - name: Check fex-callret-elide
        run: python3 tests/host/check-fex-callret-elide.py

      # madeira-bcd: guest calls into ARM64EC code leave the JIT with BLR and their returns re-enter it with
      # RET after an L1 probe (MADEIRA_FEX_EC_RET=0 keeps BR and the loop-top re-entry).
      - name: Check fex-ec-ret
        run: python3 tests/host/check-fex-ec-ret.py

      # madeira-bcd: the dispatcher's EC code check loads PEB->EcCodeBitMap from the thread's frame
      # (MADEIRA_FEX_EC_BITMAP_CACHE=0 keeps the TEB/PEB walk).
      - name: Check fex-ec-bitmap-cache
        run: python3 tests/host/check-fex-ec-bitmap-cache.py

      # madeira-bcd: JIT exits into ARM64EC code go through ExitFunctionECJit when AFP is off
      # (MADEIRA_FEX_EC_EXIT_LEAN=0 keeps ExitFunctionEC).
      - name: Check fex-ec-exit-lean
        run: python3 tests/host/check-fex-ec-exit-lean.py

      # madeira-bcd: IosJitReverseTranslate answers addresses outside every JIT copy without walking the table.
      - name: Check fex-alias-xlate-bounds
        run: python3 tests/host/check-fex-alias-xlate-bounds.py

      # madeira-bcd: RetToEntryThunk enters the JIT without its own EC code bitmap test
      # (MADEIRA_FEX_EC_RET_DIRECT=0 keeps it).
      - name: Check fex-ec-ret-direct
        run: python3 tests/host/check-fex-ec-ret-direct.py

      # madeira-bcd: FEX_MADEIRA_HOSTPROBE also reports LSE2, LRCPC3, FRINTTS, RPRES, CSSC, MOPS,
      # ECV and WFXT; FEX's parsers must keep reading every key exactly as published.
      - name: Check FEX host probe
        run: python3 tests/host/check-fex-hostprobe.py

      # madeira-bcd (round 623, Kindergarten 9DEZ8A / Mycopunk 997BBV / Skate Story XYPY9J): MonoBackpatcherWrite's alias-miss store runs
      # without CodeInvalidationMutex when MADEIRA_MONO_BP_UNLOCKED_MISS=1, so the access violation it raises leaves no write-owned mutex
      # behind ("[fexlock] STUCK write-wait", owner == waiter). Off by default; auto-tune's rule mono-backpatch-lock-leak adds the line.
      - name: Check fex-mono-bp-unlocked-miss
        run: python3 tests/host/check-fex-mono-bp-unlocked-miss.py

      # The native D3D12 runtime is ours to fix now, so build it from
      # madeira-d3d12 instead of shipping upstream's binary as is.
      # madeira-bcd: a failed build FAILS the run. It used to keep the tracked
      # DLL -- upstream's old binary without any of this fork's D3D12 fixes --
      # and the run still went green, so a broken build could reach the phone.
      # madeira-bcd (iOS 18 audit): the helper kernels get a second copy at AIR 2.7,
      # loaded only where the first is refused (iOS 18); iOS 26 and later unchanged.
      - name: Check D3D12 helper kernels for iOS 18
        run: python3 tests/host/check-metal-kernels-ios18.py

      - name: Build madeira_d3d12.dll from source
        env:
          MAD_BUILD_ID: ipa ${{ steps.bn.outputs.n }}
        run: bash tools/build-madeira-d3d12-dll.sh

      # BCD's Direct3D 9, 10 and 11 test programs for the Wine desktop's Start menu, next to the Direct3D 12 one the step above
      # builds: plain C for x86-64 Windows, shaders as bytecode in the repository. A build that fails keeps the tracked program.
      - name: Build the Direct3D 9, 10 and 11 test programs
        continue-on-error: true
        run: bash tools/build-dx-tests.sh

      # BCD's system tests (tests/systests/systest.c): bcd-systest-x64.exe into arm64ec-windows and bcd-systest-x86.exe into the
      # i386 farm's folder (after the farm, so its cache does not carry it). A build that fails keeps the tracked programs.
      - name: Build the system test programs (x64 and x86)
        continue-on-error: true
        run: bash tools/build-systests.sh

      # BCD's runtime installer (bcd-runtimes/runtimes.c, round 603): bcd-runtimes-x64.exe into arm64ec-windows, after the farm. A build that
      # fails keeps the tracked program.
      - name: Build the runtime installer (bcd-runtimes-x64.exe)
        continue-on-error: true
        run: bash tools/build-bcd-runtimes.sh

      # BCD's start helper (bcd-helper/helper.c, round 604): bcd-helper-x64.exe into arm64ec-windows, after the farm. A build that fails
      # keeps the tracked program.
      - name: Build the start helper (bcd-helper-x64.exe)
        continue-on-error: true
        run: bash tools/build-bcd-helper.sh

      # BCD's winebrowser.exe (bcd-openurl/, round 625, the owner's item 23): what a Windows program runs to open a web page; the app
      # asks the player. x86-64 into arm64ec-windows, aarch64 into aarch64-windows, i686 into the i386 farm in place of Wine's own (after
      # the farm). A build that fails keeps the tracked programs; the check after it says whether each farm has BCD's.
      - name: Build BCD's winebrowser.exe (three farms)
        continue-on-error: true
        shell: bash
        run: |
          bash tools/build-bcd-openurl.sh
          for f in app/Madeira/arm64ec-windows/winebrowser.exe app/Madeira/aarch64-windows/winebrowser.exe app/Madeira/i386-windows/winebrowser.exe; do
            if [ -f "$f" ] && LC_ALL=C grep -aq "\[open-url\] madeira-bcd" "$f"; then echo "::notice::$f is BCD's"; else echo "::warning::$f is not BCD's winebrowser.exe"; fi
          done

      # 7-Zip 26.05 from the pinned release (third-party/7zip), without its RAR code: 7zFM.exe (the File Manager) and 7z.exe, x86-64
      # Windows programs next to Wine's programs in arm64ec-windows. About ten minutes; a build that fails keeps the tracked programs.
      - name: Build 7-Zip (7zFM.exe and 7z.exe, without the RAR code)
        continue-on-error: true
        run: bash tools/build-7zip.sh

      # DXMT's NVAPI (dxmt/src/nvapi), which its DXMT build leaves
      # out; answers games that want a known vendor's driver version once the
      # library's "Report an NVIDIA GPU" switch sets DXMT_ENABLE_NVEXT=1.
      - name: Build DXMT nvapi64.dll
        continue-on-error: true
        run: bash tools/build-dxmt-nvapi.sh

      # Upstream ships no faultrep.dll; games that import it (Ghost of
      # Tsushima) fail in the loader with STATUS_DLL_NOT_FOUND.
      - name: Build faultrep.dll
        continue-on-error: true
        run: bash tools/build-faultrep-dll.sh

      # The Agility SDK half of D3D12 (D3D12SDKVersion + forwarders to
      # d3d12.dll). GTA V Enhanced under Proton loads d3d12core.dll right
      # after d3d12.dll; only bcd.cfg d3d12-core-dll makes ours load it.
      - name: Build d3d12core.dll
        continue-on-error: true
        run: bash tools/build-d3d12core-dll.sh

      # Wine PE DLLs upstream does not ship but games import (VC++ 2002-2012
      # runtimes, D3DX9/10/11, d3d10, avifil32, XAudio2, dinput), built from
      # the wine submodule for arm64ec. Never replaces a shipped DLL.
      - name: Restore wine arm64ec build
        id: wineeccache
        uses: actions/cache/restore@v4
        with:
          path: wine/build-arm64ec
          key: wine-arm64ec-${{ steps.winerev.outputs.sha }}-v1

      - name: Build extra Wine DLLs for arm64ec
        continue-on-error: true
        run: bash tools/build-wine-extra-dlls.sh "$GITHUB_WORKSPACE/wine/build-native"

      # Launcher error117 in406: WMVCORE.DLL was never packaged. Its genuine
      # Wine reader imports winegstreamer; both must build despite the optional
      # handling of unrelated extra DLLs above. Do not ship another missing farm.
      - name: Verify Wine media reader DLLs
        run: python3 tools/check-wine-media-dlls.py app/Madeira/arm64ec-windows

      # Round 624 (agent E2 S3): the step that builds the opt-in DLLs may fail without failing the build; a DLL a game list or an
      # auto-tune rule names in env.MADEIRA_OPTIN_DLLS (Glyphica's kernelbase-optin.dll, build 624) must not go missing silently.
      - name: Verify the opt-in DLLs the lists and rules name
        run: python3 tools/check-optin-dlls-shipped.py app/Madeira/arm64ec-windows

      - name: Save wine arm64ec build
        if: steps.wineeccache.outputs.cache-hit != 'true' && hashFiles('wine/build-arm64ec/dlls/msvcr80/arm64ec-windows/msvcr80.dll') != ''
        continue-on-error: true
        uses: actions/cache/save@v4
        with:
          path: wine/build-arm64ec
          key: wine-arm64ec-${{ steps.winerev.outputs.sha }}-v1

      # d3d10/avifil32/vulkan-1 stand-ins from Wine's .spec export lists:
      # Crysis Remastered imports all three and fails to load without them.
      - name: Build stand-in DLLs (d3d10, avifil32, vulkan-1)
        continue-on-error: true
        run: |
          M=toolchains/llvm-mingw-20260421-ucrt-macos-universal/bin
          python3 tools/build-stub-dlls.py wine build/stub-dlls "$M/arm64ec-w64-mingw32-clang" \
            "$M/llvm-readobj" app/Madeira/arm64ec-windows

      # The PE-side DXMT DLLs (d3d11/dxgi/winemetal/d3d10core) are committed
      # under app/Madeira/aarch64-windows/ despite the README calling them
      # gitignored, so there is nothing to build here -- just confirm they
      # are present before we try to archive.
      - name: Verify committed PE DLLs
        shell: bash
        run: |
          MISSING=""
          for d in d3d11.dll dxgi.dll winemetal.dll d3d10core.dll; do
            [ -f "app/Madeira/aarch64-windows/$d" ] || MISSING="$MISSING aarch64/$d"
          done
          # srvcli.dll comes from the extra Wine DLL build: Microsoft Flight
          # Simulator 2024's program does not load without it (build 534).
          for d in d3d11.dll dxgi.dll winemetal.dll d3d12.dll madeira_d3d12.dll xtajit64.dll ntdll.dll srvcli.dll; do
            [ -f "app/Madeira/arm64ec-windows/$d" ] || MISSING="$MISSING arm64ec/$d"
          done
          if [ -n "$MISSING" ]; then
            echo "::error::PE DLLs missing from app/Madeira ::$MISSING"
            exit 1
          fi
          echo "::notice::all PE DLLs present"
          # The ARM64EC source build permits a fallback on failure. This
          # allocator change requires its rebuilt module before archiving.
          python3 - <<'PYEOF'
          from pathlib import Path
          module = Path('app/Madeira/arm64ec-windows/xtajit64.dll').read_bytes()
          if b'rpmalloc-span4 madeira-bcd' not in module:
              raise SystemExit('Required ARM64EC rpmalloc span4 module was not built; refusing the fallback IPA')
          if b'branch-history-v1 madeira-bcd' not in module or b'IosGuestBranchTraceLayout' not in module:
              raise SystemExit('Required ARM64EC branch-history module was not built; refusing the fallback IPA')
          if b'launcher-smc-v1 madeira-bcd' not in module:
              raise SystemExit('Required ARM64EC Launcher SMC module was not built; refusing the fallback IPA')
          if b'smc-store-fastpath-v1 madeira-bcd' not in module:
              raise SystemExit('Required ARM64EC SMC store fast-path module was not built; refusing the fallback IPA')
          if b'callret-elide-v1 madeira-bcd' not in module:
              raise SystemExit('Required ARM64EC call-ret elision module was not built; refusing the fallback IPA')
          if b'ec-ret-v1 madeira-bcd' not in module:
              raise SystemExit('Required ARM64EC EC-return module was not built; refusing the fallback IPA')
          if b'ec-bitmap-cache-v1 madeira-bcd' not in module:
              raise SystemExit('Required ARM64EC EC-bitmap cache module was not built; refusing the fallback IPA')
          if b'ec-exit-lean-v1 madeira-bcd' not in module:
              raise SystemExit('Required ARM64EC lean JIT exit module was not built; refusing the fallback IPA')
          if b'ec-ret-direct-v1 madeira-bcd' not in module:
              raise SystemExit('Required ARM64EC direct return module was not built; refusing the fallback IPA')
          print('ARM64EC rpmalloc: span4 build marker verified')
          PYEOF
          # Verify the linked x64 entries; never silently ship a fallback DLL
          # that accepts the option but lacks the required interop ABI.
          python3 tests/host/check-x64-graphics-entry.py \
            --factory app/Madeira/arm64ec-windows/dxgi-src.dll \
            --d3d12 app/Madeira/arm64ec-windows/madeira_d3d12.dll
          # Likewise tools/build-d3d11-dll.sh (env.MADEIRA_D3D11_SRC). Round 620: BCD's Direct3D 11
          # patches reach a 64-bit game only through d3d11-src.dll, and recommended lists ask for it
          # (F1 2020), so an IPA in which no 64-bit d3d11.dll carries them is refused.
          NEED=""
          # Round 624: Dark Souls III's [srv-getdesc] and WRC 9's [query-stuck] too (build 624's first IPA shipped a
          # d3d11-src.dll without the second: tools/build-d3d11-dll.sh's BCD_PATCHES did not name it).
          for m in "[copy-structure-count] skipped #" "[rtv-fail] #" "[srv-getdesc] madeira-bcd #" "[query-stuck] madeira-bcd query=" "[mesh-skip] ml870 "; do
            LC_ALL=C grep -aqF "$m" app/Madeira/arm64ec-windows/d3d11.dll && continue
            [ -f app/Madeira/arm64ec-windows/d3d11-src.dll ] && LC_ALL=C grep -aqF "$m" app/Madeira/arm64ec-windows/d3d11-src.dll && continue
            NEED="$NEED \"$m\""
          done
          if [ -n "$NEED" ]; then
            echo "::error::no 64-bit d3d11.dll carries BCD's Direct3D 11 patches ($NEED): tools/build-d3d11-dll.sh did not ship d3d11-src.dll (see its step)"
            exit 1
          fi
          if [ -f app/Madeira/arm64ec-windows/d3d11-src.dll ]; then
            echo "::notice::d3d11-src.dll present ($(wc -c < app/Madeira/arm64ec-windows/d3d11-src.dll | tr -d ' ') bytes): env.MADEIRA_D3D11_SRC = 1 selects it"
          elif LC_ALL=C grep -aqF "madeira-bcd: SwapDeviceContextState in use" app/Madeira/arm64ec-windows/d3d11.dll; then
            echo "::notice::no d3d11-src.dll: upstream's d3d11.dll carries SwapDeviceContextState itself (dxmt pin 2026-10-15 and later); env.MADEIRA_D3D11_SRC = 1 keeps it"
          else
            echo "::warning::d3d11-src.dll missing: this IPA has only upstream's d3d11.dll (no SwapDeviceContextState); env.MADEIRA_D3D11_SRC = 1 does nothing"
          fi
          # And tools/build-wine-extra-dlls.sh's ucrtbase-x64math.dll
          # (env.MADEIRA_UCRT_X64_MATH): never ship one whose four exports are
          # not the x64 bodies.
          if [ -f app/Madeira/arm64ec-windows/ucrtbase-x64math.dll ]; then
            python3 tools/patch-wine-ucrtbase-x64-math.py --verify app/Madeira/arm64ec-windows/ucrtbase-x64math.dll
          else
            echo "::warning::ucrtbase-x64math.dll missing: env.MADEIRA_UCRT_X64_MATH = 1 does nothing in this IPA"
          fi
          # And its kernelbase-fibertrace.dll (env.MADEIRA_FIBER_TRACE): never ship
          # one without the trace or with other exports than the shipped kernelbase.dll.
          if [ -f app/Madeira/arm64ec-windows/kernelbase-fibertrace.dll ]; then
            python3 tools/patch-wine-kernelbase-fibertrace.py --verify app/Madeira/arm64ec-windows/kernelbase-fibertrace.dll \
              app/Madeira/arm64ec-windows/kernelbase.dll
          else
            echo "::warning::kernelbase-fibertrace.dll missing: env.MADEIRA_FIBER_TRACE = 1 does nothing in this IPA"
          fi
          # And its setupapi-optin.dll (env.MADEIRA_OPTIN_DLLS = setupapi): never ship one without the
          # device node lock or with other exports than the shipped setupapi.dll.
          if [ -f app/Madeira/arm64ec-windows/setupapi-optin.dll ]; then
            python3 tools/patch-wine-setupapi-devinst-lock.py --verify app/Madeira/arm64ec-windows/setupapi-optin.dll \
              app/Madeira/arm64ec-windows/setupapi.dll
          else
            echo "::warning::setupapi-optin.dll missing: env.MADEIRA_OPTIN_DLLS = setupapi does nothing in this IPA"
          fi
          # And the ASF source of env.MADEIRA_OPTIN_DLLS = mfasfsrcsnk,wmvdecod,wmadmod (Resident Evil 2/7): never ship the
          # handler without the winedmo patch (an unpatched one hands the game to the generic handler, which cannot read ASF).
          if [ -f app/Madeira/arm64ec-windows/mfasfsrcsnk-optin.dll ]; then
            python3 tools/patch-wine-mfasfsrcsnk-winedmo.py --verify app/Madeira/arm64ec-windows/mfasfsrcsnk-optin.dll
          else
            echo "::warning::mfasfsrcsnk-optin.dll missing: env.MADEIRA_OPTIN_DLLS = mfasfsrcsnk does nothing in this IPA"
          fi
          for d in winedmo.dll wmvdecod-optin.dll wmadmod-optin.dll; do
            [ -f "app/Madeira/arm64ec-windows/$d" ] || echo "::warning::$d missing: Resident Evil 2's cutscenes still end the game in this IPA"
          done
          # And its ntdll-sync.dll, which the unix loader maps by default: never
          # ship one whose SRW and critical-section exports are not the x64 bodies
          # or whose exports are not the shipped ntdll.dll's plus madeira_sync_x64_off.
          if [ -f app/Madeira/arm64ec-windows/ntdll-sync.dll ]; then
            python3 tools/patch-wine-ntdll-sync.py --verify app/Madeira/arm64ec-windows/ntdll-sync.dll \
              app/Madeira/arm64ec-windows/ntdll.dll
          else
            echo "::warning::ntdll-sync.dll missing: every game maps the shipped ntdll.dll"
          fi
          # And ntdll-xsec.dll (thebcd69/bcd-games#4), mapped only by a game with env.MADEIRA_NTDLL_XSEC = 1
          # (Diablo II: Resurrected): an ARM64EC image with the marker, the three log strings and the shipped ntdll.dll's exports.
          if [ -f app/Madeira/arm64ec-windows/ntdll-xsec.dll ]; then
            python3 tools/patch-wine-ntdll-xsec.py --verify app/Madeira/arm64ec-windows/ntdll-xsec.dll \
              app/Madeira/arm64ec-windows/ntdll.dll
          else
            echo "::warning::ntdll-xsec.dll missing: Diablo II: Resurrected's env.MADEIRA_NTDLL_XSEC = 1 maps the shipped ntdll.dll"
          fi

      # tools/fetch-vcruntime.md: the VC++ runtime DLLs (twelve, and since
      # 2026-10-09 MFC's mfc140.dll and mfc140u.dll from the same package:
      # Horizon Zero Dawn imports mfc140.dll) are Microsoft's
      # and are not redistributable under this project's license, so they are
      # gitignored and "you supply them yourself". Fetching them straight from
      # Microsoft at build time honours that -- nothing Microsoft-authored ever
      # enters this repository or its history. The files are copied
      # byte-for-byte; nothing is repacked or re-signed.
      #
      # Not with 7zz, though, whatever the doc says. It reports the download as
      #   Type = PE   CPU = x86   Image Size = 495616   InternalName: setup
      # for a 25 MB file: this is a WiX Burn bundle, a half-megabyte setup stub
      # with the real payload appended after the PE image as an attached
      # container. 7zz only ever sees the stub, so it unpacks 40 files of
      # sections and resources and none of the DLLs -- and the doc's
      # .rsrc/1033/CABINET path belongs to the pre-2015 layout, which this
      # package no longer has at all.
      #
      # cabextract is built for exactly this: it scans a file for embedded
      # cabinet headers rather than trusting its container format.
      - name: Check the VC++ runtime list and the MFC switch
        run: python3 tests/host/check-vcruntime-mfc.py

      # madeira-bcd (round 591): MFC for a game BCD Dock starts (env.MADEIRA_MFC_DOCK = 1), linked into sysx64.
      - name: Check MFC in a BCD Dock session
        run: python3 tests/host/check-mfc-dock.py

      # madeira-bcd (2026-10-23): env.MADEIRA_FEX_AVX = 2, AVX reported without AVX2 (FEX CPUID; Bink 2 video in Spider-Man 2).
      - name: Check AVX without AVX2
        run: python3 tests/host/check-fex-avx-no-avx2.py

      # madeira-bcd (2026-11-02): log-only FEX cache measurement ([CB_COST] compile/flush cost, [cb-sample] blocks), owner's go.
      - name: Check FEX cache measurement counters
        run: python3 tests/host/check-fex-cb-cost.py

      # madeira-bcd (round 630): LSE read-modify-write atomics (LD<OP>, CAS) on aliased pages, the last case of the Mach store emulator.
      - name: Check LSE atomics on aliased pages
        run: python3 tests/host/check-jit-alias-atomics.py
      - name: Check the thread registry reuses ended threads' slots
        run: python3 tests/host/check-thread-registry-reclaim.py
      - name: Check the Message window class per program (MADEIRA_MESSAGE_CLASS)
        run: python3 tests/host/check-message-class.py
      - name: Check MADEIRA_CHILD_ARGS never reaches a crash handler
        run: python3 tests/host/check-child-args-crashpad.py
      - name: Check a later desktop window never takes the input desktop
        run: python3 tests/host/check-input-desktop.py
      - name: Check an exiting process ends with the status it chose
        run: python3 tests/host/check-exiting-status.py

      # madeira-bcd (round 630, G1 S3): the guest code around a call through NULL ([guest-code-at-fault], log only).
      - name: Check the guest code dump at a call through NULL
        run: python3 tests/host/check-guest-code-at-fault.py
      - name: Check a fault a system call's __TRY answers is never a livelock
        run: python3 tests/host/check-syscall-fault-loop.py
      - name: Check the IL2CPP collector-race repair's third pass
        run: python3 tests/host/check-il2cpp-gc-vtable.py
      - name: Check an error status reaches the app whole
        run: python3 tests/host/check-exit-status-whole.py
      - name: Check the stuck-wait registry gives every thread its own slot
        run: python3 tests/host/check-wait-registry-slot.py

      - name: Fetch the VC++ runtime DLLs from Microsoft
        shell: bash
        run: |
          set +e
          shopt -s nullglob
          DEST="$GITHUB_WORKSPACE/app/Madeira/x86_64-vcruntime"
          WANT="concrt140.dll msvcp140.dll msvcp140_1.dll msvcp140_2.dll
                msvcp140_atomic_wait.dll msvcp140_codecvt_ids.dll vcamp140.dll
                vccorlib140.dll vcomp140.dll vcruntime140.dll vcruntime140_1.dll
                vcruntime140_threads.dll mfc140.dll mfc140u.dll"
          NWANT=$(echo $WANT | wc -w | tr -d ' ')
          command -v cabextract >/dev/null 2>&1 || brew install cabextract
          command -v msiextract >/dev/null 2>&1 || brew install msitools

          curl -fL --retry 3 --retry-delay 2 -o /tmp/vcr.exe \
            https://aka.ms/vs/17/release/vc_redist.x64.exe
          if [ ! -s /tmp/vcr.exe ]; then
            echo "::warning::VC_redist.x64.exe download failed -- MSVC games will not start"
            exit 0
          fi
          echo "downloaded $(wc -c < /tmp/vcr.exe | tr -d ' ') bytes"

          rm -rf /tmp/vcx; mkdir -p /tmp/vcx/a /tmp/vcx/carve
          cabextract -q -d /tmp/vcx/a /tmp/vcr.exe 2>&1 | tail -3

          # Only if the scan came up empty: carve every cabinet out by its
          # MSCF header and its own declared length.
          if [ "$(find /tmp/vcx/a -type f | wc -l | tr -d ' ')" -lt 2 ]; then
            python3 - <<'PYEOF'
          import struct
          d = open('/tmp/vcr.exe', 'rb').read()
          n = off = 0
          while True:
              i = d.find(b'MSCF', off)
              if i < 0:
                  break
              cb = struct.unpack_from('<I', d, i + 8)[0] if i + 36 <= len(d) else 0
              if 1000 < cb <= len(d) - i:
                  open('/tmp/vcx/carve/c%d.cab' % n, 'wb').write(d[i:i + cb])
                  n += 1
                  off = i + cb
              else:
                  off = i + 4
          print('carved %d cabinet(s) by MSCF header' % n)
          PYEOF
          fi

          # The payloads are named <name>.dll_amd64 and <name>.dll_arm64 --
          # not <name>.dll, and not the F_CENTRAL_<name>_x64 an MSI cab would
          # use. Rather than chase the spelling, read each candidate's PE
          # header and take the one whose machine field is AMD64 (0x8664).
          # Picking up the arm64 build by mistake would fail silently: FEX
          # emulates x86-64, so an ARM64 DLL is the wrong binary in a file
          # with the right name.
          is_x64() {
            python3 -c "
          import struct, sys
          d = open(sys.argv[1], 'rb').read()
          pe = struct.unpack_from('<I', d, 0x3c)[0] if len(d) > 0x40 else 0
          ok = d[pe:pe+4] == b'PE\\0\\0' and struct.unpack_from('<H', d, pe+4)[0] == 0x8664
          sys.exit(0 if ok else 1)" "$1" 2>/dev/null
          }

          collect() {
            FOUND=0; MISSING=""
            for d in $WANT; do
              base="${d%.dll}"
              src=""
              while IFS= read -r cand; do
                if is_x64 "$cand"; then src="$cand"; break; fi
              done < <(find /tmp/vcx -type f \
                         \( -iname "$base.dll*" -o -iname "F_CENTRAL_${base}_*" \) \
                         -print 2>/dev/null)
              if [ -n "$src" ]; then
                cp "$src" "$DEST/$d" && FOUND=$((FOUND+1))
              else
                MISSING="$MISSING $d"
              fi
            done
          }

          # Peel containers until all of them turn up, or nothing new appears.
          for pass in 1 2 3 4; do
            BEFORE=$(find /tmp/vcx -type f 2>/dev/null | wc -l | tr -d ' ')
            find /tmp/vcx -type f -size +20k 2>/dev/null | while IFS= read -r f; do
              case "${f##*/}" in *.dll|*.DLL|*.exe|*.EXE|*_amd64|*_arm64|*_x86) continue ;; esac
              [ -d "$f.d" ] && continue
              mkdir -p "$f.d"
              cabextract -q -d "$f.d" "$f" > /dev/null 2>&1 \
                || msiextract -C "$f.d" "$f" > /dev/null 2>&1 \
                || rmdir "$f.d" 2>/dev/null
            done
            AFTER=$(find /tmp/vcx -type f 2>/dev/null | wc -l | tr -d ' ')
            collect
            echo "pass $pass: $BEFORE -> $AFTER files, $FOUND of $NWANT recovered"
            [ "$FOUND" -eq "$NWANT" ] && break
            [ "$BEFORE" = "$AFTER" ] && break
          done

          echo "::notice::vcruntime :: recovered $FOUND of $NWANT$([ -n "$MISSING" ] && echo " -- missing:$MISSING")"

          if [ "$FOUND" -lt "$NWANT" ]; then
            echo "-- what the installer actually unpacked to (biggest 40) --"
            find /tmp/vcx -type f -size +20k -exec ls -S {} + 2>/dev/null \
              | head -40 | sed "s|/tmp/vcx/||"
          fi

          # tools/fetch-vcruntime.md: a truncated certificate table means the
          # file is no longer an unmodified Microsoft binary.
          python3 - "$DEST"/*.dll <<'PYEOF' || true
          import struct, sys
          for path in sys.argv[1:]:
              d = open(path, 'rb').read()
              pe = struct.unpack_from('<I', d, 0x3c)[0]
              off, size = struct.unpack_from('<II', d, pe + 24 + 112 + 4*8)
              ok = size and off + size <= len(d)
              print(('  signed  ' if ok else '  UNSIGNED'), path.split('/')[-1])
          PYEOF

      # BCD: the app's own download of the same DLLs, for builds that do not bundle
      # them (VCRuntimeDownload.swift, BCDCab.c): the cabinet reader refuses damaged
      # input, the app's extractor takes these fourteen files byte for byte out of
      # /tmp/vcr.exe, and a session links the bundle's copy first (WineProcessBridge.m).
      - name: Check the in-app VC++ runtime download
        run: python3 tests/host/check-vcruntime-download.py --require-swift

      # BCD (round 625, the owner's item 26): the same download for Microsoft's 32-bit package, whose four MFC DLLs a 32-bit game gets
      # with env.MADEIRA_MFC32 = 1. The package is fetched here only for the check (into /tmp, never shipped: every device downloads its
      # own copy from Microsoft); without it the check runs on its synthetic package alone.
      - name: Check the 32-bit MFC download and its session links
        shell: bash
        run: |
          curl -fsSL --retry 3 --retry-delay 2 --proto '=https' --proto-redir '=https' --max-filesize 134217728 -o /tmp/vcr-x86.exe \
            https://aka.ms/vs/17/release/vc_redist.x86.exe || { rm -f /tmp/vcr-x86.exe; echo "::warning::vc_redist.x86.exe not downloaded: the MFC check uses its synthetic package"; }
          python3 tests/host/check-mfc32.py --require-swift

      # madeira-bcd (upstream port 2026-10-25): PrefixExtractor.c refuses '..' components, absolute paths and a bad tar size field;
      # PrefixExtractor.c built on the host with zlib and sanitizers, given synthetic archives and the bundled prefix template.
      - name: Check the prefix tarball extractor
        run: python3 tests/host/check-prefix-extract.py

      # madeira-bcd (upstream port 2026-10-25): wineserver's alloc_shared_object rounds a shared object to 8 bytes so the next object's
      # 64-bit sequence store is aligned on ARM64 (SimCity 4 Deluxe); the production allocator under ASan/UBSan.
      - name: Check wineserver shared object alignment
        run: python3 tests/host/check-session-object-alignment.py

      # madeira-bcd (upstream port 2026-10-25): the ntdll build probes the iPhoneOS SDK for rusage_info_v6.ri_page_wait_time_mach; the
      # [xp] line's pgw= reads -1.0 when the member is absent.
      - name: Check the rusage SDK probe
        run: python3 tests/host/check-rusage-sdk.py

      # madeira-bcd (upstream port 2026-10-25): wine_process_exit_code() (the guest's exit status, release/acquire, also for a session
      # ended off the boot thread) and the JITAllocator early-VA accessors for Swift 6; the accessors built on the host, both files
      # syntax-checked with the iPhoneOS SDK.
      - name: Check wine_process_exit_code and the early VA accessors
        run: python3 tests/host/check-wine-exit-code.py

      # madeira-bcd (upstream port 2026-10-25): MADEIRA_ENV_LOCKED, a host's list of environment names that bcd.cfg's and a game's env.*
      # lines may not replace; off unless a host sets it; the matcher built on the host.
      - name: Check MADEIRA_ENV_LOCKED
        run: python3 tests/host/check-env-locked.py

      # madeira-bcd (upstream port 2026-10-25): the guest's stdin and stdout on pipes and a forced console, all opt-in
      # (env.MADEIRA_STDIN_PIPE, env.MADEIRA_STDOUT_PIPE, env.MADEIRA_FORCE_CONSOLE, or Documents/bcd-stdin.txt, bcd-stdout.txt, bcd-
      # console.txt); the accessors run over real pipes.
      - name: Check the guest stdin and stdout pipes
        run: python3 tests/host/check-guest-pipes.py

      # madeira-bcd (upstream port 2026-10-25): the VC++ overlay takes only .dll files and also Microsoft's fourteen names from
      # Documents/vcruntime (the list builder compiled on the host); tools/fetch-vcruntime.sh gives, from the build's own download, the
      # same fourteen DLLs byte for byte; tests/host/check-vcruntime.py on synthetic folders.
      - name: Check the VC++ runtime sources and tools/fetch-vcruntime.sh
        run: python3 tests/host/check-vcruntime-sources.py

      # madeira-bcd (upstream port 2026-10-25): a Steam request whose connection closes while it is being sent is resumed once (the
      # production SteamSession.swift with a stand-in connection; callServiceMethod, sendAndWait and sendAndWaitPICS).
      - name: Check SteamSession's pending jobs
        run: python3 tests/host/check-steam-session-jobs.py

      # madeira-bcd (upstream port 2026-10-25): Steam Cloud sync decisions on the production code, the Steam Cloud saves switch off
      # stops every check, transfer and Play prompt (BCD's Accounts settings), turning it back on starts clean, and save transfers
      # always go over https.
      - name: Check Steam Cloud
        run: python3 tests/host/check-steam-cloud.py

      # madeira-bcd (upstream port 2026-10-25): SteamRemoteCache, which rewrites the list Valve's client answers Steam Cloud API saves
      # from, compiled on the host over temporary prefixes; off in BCD unless env.MADEIRA_STEAM_CLOUD_REMOTECACHE is set.
      - name: Check Valve's client's remotecache.vdf
        run: python3 tests/host/check-steam-remotecache.py

      # madeira-bcd (upstream port 2026-10-25): the Steam game language (depots, install record, DLC depots, device mapping) and the
      # download and install sizes, on the production app info and record writer; English unless a language is chosen.
      - name: Check the Steam game language
        run: python3 tests/host/check-steam-language.py --require-swift

      # madeira-bcd (upstream port 2026-10-25): env.MADEIRA_ARENA_GUARD = 1 keeps a fixed or hinted guest reservation (and the steering
      # valve's top slot) out of the FEX arena; off unless set; the guard cut out of virtual_ios.c and run on the host.
      - name: Check the FEX arena guard
        run: python3 tests/host/check-arena-guard.py

      # madeira-bcd (upstream port 2026-10-25): env.MADEIRA_EXE_WINDOW_HANDOFF = 1 hands the fixed base to a relaunched copy of the same
      # program and rounds the claim's size; off unless set; the window code run on the host.
      - name: Check the executable window handoff
        run: python3 tests/host/check-exe-window-handoff.py

      # madeira-bcd (upstream port 2026-10-25): exe-window-auto (the window measured from the game's folder) and pool-above-window (the
      # game's pool line, the pair above the window), both off unless set; fixedBaseWindowMB run on synthetic PE headers.
      - name: Check the executable window from the game's folder and the pool above it
        run: python3 tests/host/check-exe-window-auto.py --require-swift

      # madeira-bcd (upstream port 2026-10-25): env.MADEIRA_THIN_RESERVE = 1 gives 1-2 GB read-write reserves a thin head (a game that
      # reserves dozens of 1 GB blocks and commits little); off unless set; the switch run on the host, the hooks read.
      - name: Check thin reservations
        run: python3 tests/host/check-thin-reserve.py

      # madeira-bcd (upstream port 2026-10-25): env.MADEIRA_IMAGE_LOW_ALIAS = 1 (the narrowed form of an image's address gets a name)
      # and env.MADEIRA_QUERY_CLIP = 1 (VirtualQuery calls only allocatable memory free); both off unless set; the switches and the pure
      # parts run on the host.
      - name: Check the image low alias and the query clip
        run: python3 tests/host/check-query-clip.py

      # madeira-bcd (upstream port 2026-10-25): env.MADEIRA_KUSER_KEEP_REGS = 1 leaves registers that only look like KUSER pointers
      # alone after the sub-floor service emulated the access; off unless set; the step's condition run on the host for every
      # combination.
      - name: Check the KUSER register switch
        run: python3 tests/host/check-kuser-keep-regs.py

      # madeira-bcd (upstream port 2026-10-25): env.MADEIRA_AUDIO_IO_MS asks the audio session for a smaller IO buffer and the driver
      # reports an engine period of at least two slices (a client that queues one period); off unless set, GetDevicePeriod answers 10 ms
      # as before; the driver's period code run on the host.
      - name: Check the audio engine period
        run: python3 tests/host/check-audio-period.py

      # madeira-bcd (upstream port 2026-10-25): the session sets DXMT_CENSUS_THROTTLE=1 (one [mem-census] report every 10 s; a memory
      # warning and the first report always); env.DXMT_CENSUS_THROTTLE = 0 undoes it; the app's line and, with the DXMT sources, DXMT's
      # side read.
      - name: Check DXMT's memory census throttle
        run: python3 tests/host/check-census-throttle.py

      # madeira-bcd (upstream port 2026-10-25): env.MADEIRA_THERMAL_CAP = 1 (off by default) caps a hot device at 40 FPS and gives the
      # session's mode back at nominal; the production ThermalPacing run on the host with the thermal notification posted for real.
      - name: Check the thermal frame cap
        run: python3 tests/host/check-thermal-cap.py --require-swift

      # madeira-bcd (upstream port 2026-10-25): env.MADEIRA_THREAD_QOS = pattern=class;... gives a guest thread a QoS class by its name
      # (off unless set; sync.c's QoS call goes through a wrapper that passes through without a rule); the rule parser, matcher, table
      # and wrapper run on the host.
      - name: Check the QoS class per thread name
        run: python3 tests/host/check-thread-qos.py

      # madeira-bcd (upstream port 2026-10-25): a Steam discovery value in the registry that names a client no longer there (a Steam
      # emulator's or a removed client's leftover) is replaced, a live client stays a conflict, and the failure line says what stopped
      # the setup; the production ZIP reader and registry writer run on the host.
      - name: Check BCD Dock's client components setup
        run: python3 tests/host/check-dock-components.py

      # madeira-bcd (upstream port 2026-10-25): the window census of a Dock start under AddressSanitizer and ThreadSanitizer, the born-
      # minimized restore, and env.MADEIRA_RESTORE_BORN_MINIMIZED_LATE = 1 (the restore goes on after the starting screen; off unless
      # set, where 2 ends the census like 0); the decision rules compiled with swiftc.
      - name: Check BCD Dock's starting-screen census
        run: python3 tests/host/check-dock-start-screen.py

      # madeira-bcd (upstream port 2026-10-25): the key bar's Paste button and the opt-in Command-V type the clipboard as key and text
      # events in order; pure paste types, the text event queue and the BCD wiring.
      - name: Check clipboard text paste
        run: python3 tests/host/check-clipboard-paste.py

      # The directory has to exist or xcodebuild fails the archive outright,
      # but the DLLs themselves are Microsoft's and cannot be committed.
      - name: Report vcruntime contents
        shell: bash
        run: |
          shopt -s nullglob
          DLLS=(app/Madeira/x86_64-vcruntime/*.dll)
          echo "x86_64-vcruntime DLLs present: ${#DLLS[@]} of 14 (12 C++ runtime + MFC's 2)"
          if [ "${#DLLS[@]}" -lt 14 ]; then
            echo "::warning::IPA will build, but games built with MSVC will not \
          start until the VC++ runtime DLLs are added -- see tools/fetch-vcruntime.md"
          fi

      # Upstream's Built-in StikJIT pairs with the device itself (app/Madeira/
      # JITPairing.swift, the MadeiraJITHelper extension); the app target links
      # this Rust static library. Dependencies come from crates.io at the
      # versions in Cargo.lock; the step regenerates the bundled licence notices.
      - name: Build libmadeira_rppairing.a (Built-in StikJIT pairing)
        shell: bash
        run: |
          set -euo pipefail
          command -v rustup >/dev/null || { echo "::error::rustup is not available on this runner"; exit 1; }
          rustup target add aarch64-apple-ios
          bash build/rppairing-ios/build.sh

      # Fail here with a clear list rather than deep inside a linker error.
      - name: Verify all linked archives exist
        shell: bash
        run: |
          set +e
          MISSING=""
          for a in libgmp.a libgnutls.a libhogweed.a libnettle.a \
                   libntdll_unix.a libwin32u_unix.a libwineserver.a \
                   libdxmt_combined.a libmadeira_rppairing.a; do
            [ -f "app/Madeira/$a" ] || MISSING="$MISSING app/Madeira/$a"
          done
          for a in FEXCore/Source/libFEXCore.a FEXCore/Source/libFEXCore_Base.a \
                   FEXCore/Source/libJemallocLibs.a External/cephes/libcephes_128bit.a \
                   External/fmt/libfmt.a External/SoftFloat-3e/libsoftfloat_3e.a \
                   External/xxhash/cmake_unofficial/libxxhash.a; do
            [ -f "FEX/build-ios/$a" ] || MISSING="$MISSING FEX/build-ios/$a"
          done
          if [ -n "$MISSING" ]; then
            echo "::error::archives missing before archive step ::$MISSING"
            exit 1
          fi
          echo "::notice::all 16 linked archives present"

      # The Xcode build phase fails when the bundled licence copies are stale.
      - name: Stage licence copies
        run: bash build/stage-licenses.sh

      # docs/BUILDING.md: "Debug is the configuration that runs the games;
      # Release builds have crashed the guest."
      # Version = 0.1.<build number> (step "Build number": the fork's one
      # sequence across Actions and the Mac), in the app (what Feather and
      # Settings > General show) and in the IPA's name, so an installed copy
      # can be matched to its build.
      - name: Stamp version 0.1.${{ steps.bn.outputs.n }}
        shell: bash
        run: |
          /usr/libexec/PlistBuddy \
            -c "Set :CFBundleShortVersionString 0.1.${{ steps.bn.outputs.n }}" \
            -c "Set :CFBundleVersion ${{ steps.bn.outputs.n }}" \
            app/Madeira/Info.plist
          echo "::notice::version 0.1.${{ steps.bn.outputs.n }} (build ${{ steps.bn.outputs.n }})"
          # madeira-bcd: which commit and run this IPA is; the D3D12 shader
          # cache identity (tools/build-madeira-d3d12-dll.sh) is only printed:
          # a new one means every D3D12 game converts its shaders once again.
          SCID=$(cat build/madeira-d3d12/out-pe/scid.txt 2>/dev/null || true)
          P=app/Madeira/Info.plist
          for kv in "MadeiraCommit:${GITHUB_SHA}" "MadeiraRepo:${GITHUB_REPOSITORY}" \
                    "MadeiraBuilt:$(date -u +%Y-%m-%dT%H:%M:%SZ)"; do
            k=${kv%%:*}; v=${kv#*:}
            /usr/libexec/PlistBuddy -c "Delete :$k" "$P" > /dev/null 2>&1 || true
            /usr/libexec/PlistBuddy -c "Add :$k string $v" "$P"
          done
          echo "::notice::shader cache identity ${SCID:-none}"

      # Upstream's prebuilt StikJIT.xcframework (Built-in StikJIT, read by the
      # MadeiraJITHelper extension) was built with Swift 6.4; its interface
      # names types with module selectors (Swift::String) that the runners'
      # Swift 6.3 cannot parse. Rewrite them into the dotted form in this
      # checkout (valid for every Swift); the framework binary is unchanged.
      - name: StikJIT interface for the runner's Swift
        shell: bash
        run: |
          echo "::notice::$(xcrun swift --version 2>&1 | grep -m1 'Swift version')"
          python3 tools/stikjit-interface-compat.py app/Frameworks/StikJIT.xcframework

      - name: Archive (unsigned)
        shell: bash
        run: |
          set +e
          # madeira-bcd pool-reserve: BCD_POOL_BSS_MB=1152 in the environment (run.sh / local_ci.py pass
          # it through) compiles JITAllocator.c's exec-time JIT pool reservation in. Unset or 0: the
          # command is exactly the one before, and the build carries no reservation.
          pool_bss=()
          if [ -n "${BCD_POOL_BSS_MB:-}" ] && [ "${BCD_POOL_BSS_MB}" != "0" ]; then
            pool_bss=("GCC_PREPROCESSOR_DEFINITIONS=\$(inherited) BCD_POOL_BSS_MB=${BCD_POOL_BSS_MB}")
            echo "::notice::JIT pool reservation compiled in: BCD_POOL_BSS_MB=${BCD_POOL_BSS_MB} (pool-bss)"
          fi
          xcodebuild -project app/Madeira.xcodeproj \
            -scheme Madeira -sdk iphoneos -configuration Debug \
            CODE_SIGNING_ALLOWED=NO "${pool_bss[@]}" \
            archive -archivePath build-out/Madeira.xcarchive \
            > "$GITHUB_WORKSPACE/archive.log" 2>&1
          rc=$?
          # A failing xcodebuild buries the diagnostic under a multi-kilobyte
          # swift-frontend invocation, so surface just the errors.
          if [ "$rc" -ne 0 ]; then
            echo "===== compiler errors ====="
            grep -E "^[^ ].*: (error|fatal error):" "$GITHUB_WORKSPACE/archive.log" | head -30
            # Linker diagnostics carry no "error:" prefix, so the undefined
            # symbol list needs matching on its own terms.
            echo "===== linker diagnostics ====="
            grep -E "Undefined symbol|^ld: |symbol\(s\) not found|referenced from|duplicate symbol" \
              "$GITHUB_WORKSPACE/archive.log" | head -40
            echo "===== failing build commands ====="
            sed -n '/The following build commands failed/,/failures)/p' \
              "$GITHUB_WORKSPACE/archive.log" | cut -c1-200 | head -15
          fi
          exit "$rc"

      # A device run reached DXMT and died there:
      #   err: Failed to create metal view, it seems like your Wine has no
      #        exported symbols needed by DXMT.
      # DXMT resolves the macdrv entry points with dlsym(RTLD_DEFAULT, ...)
      # against the main binary, so they have to survive into its export trie.
      # IOSDisplayShim.m marks all six __attribute__((used, visibility("default")))
      # precisely because they were dead-stripped once before, and its comment
      # records the check to confirm it -- which was never actually run. Run it.
      # A binary that ships without these renders a black screen and says
      # nothing until the log is read, so surface it at build time.
      - name: Verify the macdrv symbols DXMT resolves at runtime
        shell: bash
        run: |
          set +e
          BIN=$(find build-out/Madeira.xcarchive -type f -path "*/Madeira.app/Madeira" | head -1)
          if [ -z "$BIN" ]; then
            echo "::warning::app binary not found in the archive -- skipping export check"
            exit 0
          fi
          echo "binary: $BIN"
          xcrun dyld_info -exports "$BIN" > exports.txt 2>&1
          # Show that the tool produced a listing at all. Reading "MISS" off an
          # exports.txt that actually holds an error message would look exactly
          # like a stripped symbol, and the whole point of this step is to tell
          # those two apart.
          echo "-- dyld_info output: $(wc -l < exports.txt | tr -d ' ') lines --"
          head -5 exports.txt
          # Did the setting reach the link at all? Two rounds were lost to
          # flags that silently never arrived.
          echo "-- did the linker see the export list? --"
          grep -c "madeira-exports\|exported_symbol" archive.log 2>/dev/null \
            | sed "s/^/  archive.log mentions it this many times: /"
          echo "-- are the definitions even in the binary? (nm) --"
          nm -gU "$BIN" 2>&1 | grep -i "macdrv\|win_data" | head -10 \
            || echo "  (nm finds no macdrv symbol -- they are not in the binary at all)"
          echo "-- every macdrv symbol in the export trie --"
          grep -i "macdrv\|win_data" exports.txt | head -20
          MISSING=""
          for sym in macdrv_functions get_win_data release_win_data \
                     macdrv_view_create_metal_view macdrv_view_get_metal_layer \
                     macdrv_view_release_metal_view; do
            if grep -qE "_$sym\$" exports.txt; then
              echo "  OK   $sym"
            else
              echo "  MISS $sym"; MISSING="$MISSING $sym"
            fi
          done
          if [ -n "$MISSING" ]; then
            echo "::error::main binary does not export ::$MISSING -- DXMT's dlsym will fail and every D3D11 title renders black"
            # Was a warning while the cause was unknown. Now that a build with
            # all six renders, shipping one without them is a regression, and
            # its only symptom is a black screen that says nothing -- three
            # days were spent reaching that conclusion once.
            exit 1
          else
            echo "::notice::all six macdrv symbols are exported"
          fi

      - name: Package Madeira and Madeira2 unsigned IPAs
        run: python3 tools/ota-variants.py package build-out/Madeira.xcarchive/Products/Applications/Madeira.app build-out ${{ steps.bn.outputs.n }}

      # Over-the-air install: sign with the owner's certificate (kept in the
      # owner's PRIVATE bucket, never in the repository) and put both signed IPAs
      # plus installation pages (7-day pre-signed links) in the same bucket.
      # A signing/upload failure is caught by the private-bucket gate below.
      - name: Sign for OTA install (private bucket)
        id: ota
        continue-on-error: true
        env:
          B2_KEY_ID: ${{ secrets.B2_KEY_ID }}
          B2_APP_KEY: ${{ secrets.B2_APP_KEY }}
          B2_S3_ENDPOINT: ${{ secrets.B2_S3_ENDPOINT }}
          B2_SIGN_BUCKET: ${{ secrets.B2_SIGN_BUCKET }}
          SIGN_P12_PASSWORD: ${{ secrets.SIGN_P12_PASSWORD }}
          OTA_MAIL_USER: ${{ secrets.OTA_MAIL_USER }}
          OTA_MAIL_APP_PASSWORD: ${{ secrets.OTA_MAIL_APP_PASSWORD }}
          OTA_MAIL_TO: ${{ secrets.OTA_MAIL_TO }}
          R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
          R2_BUCKET: ${{ secrets.R2_BUCKET }}
        run: bash tools/sign-and-publish-ota.sh build-out/Madeira-0.1.${{ steps.bn.outputs.n }}-unsigned.ipa ${{ steps.bn.outputs.n }} build-out/Madeira2-0.1.${{ steps.bn.outputs.n }}-unsigned.ipa

      # Owner's decision (2026-10-02): no IPA artifact on GitHub at all. The
      # repository and its Actions are public, so an artifact is downloadable by
      # anyone; the only copy of a build is the signed IPA in the owner's
      # private R2 bucket (the OTA step above). If that step did not succeed,
      # the build fails here instead of keeping the IPA somewhere public.
      - name: Check the IPA reached the private bucket
        if: steps.ota.outcome != 'success'
        run: |
          echo "::error::OTA signing/upload did not succeed: this build's IPA was not kept anywhere (no GitHub artifact by design)"
          exit 1

      # Full logs as an artifact -- the annotations above are truncated, and
      # digging them out of the raw job log is painful.
      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: build-logs
          path: "*.log"
          if-no-files-found: ignore

      - name: Dump first build errors (on failure)
        if: failure()
        shell: bash
        run: |
          for L in ntdll wineserver win32u; do
            if [ -f "$L.log" ]; then
              T=$(grep -E "^(Results:|Failed:|ERROR)" "$L.log" | head -5 | python3 -c "import sys; print('%0A'.join(sys.stdin.read().splitlines()))")
              echo "::error::$L.log summary :: $T"
            fi
          done
          N=0
          for f in $(grep -rl "error:" build --include="*.err" 2>/dev/null | head -4); do
            N=$((N+1))
            MSG=$(grep -A4 -m3 "error:" "$f" | head -c 1500 | python3 -c "import sys; print('%0A'.join(sys.stdin.read().splitlines()))")
            echo "::error::REAL ERROR in $f :: $MSG"
          done
          if [ "$N" -eq 0 ]; then
            echo "::error::no .err file contains 'error:' -- failure is from a script exit or ar/link stage"
            for L in ntdll wineserver win32u; do
              if [ -f "$L.log" ]; then
                T=$(tail -n 25 "$L.log" | python3 -c "import sys; print('%0A'.join(sys.stdin.read().splitlines()))")
                echo "::error::$L.log tail :: $T"
              fi
            done
          fi