QorCap v0.3.38: end-menu clipped logo fringe

receipt.v0.json is unchanged.

• #116: online FINISH GAME no longer fails home_glyph_count when the home logo fringe is clipped. With at least two clean side glyphs (w≥12), a thin/None fringe is dropped instead of poisoning the count. Live auto-stop can reach FINAL via end_menu on the geometry that left match-20261026-205511 PARTIAL on final re-read.

qorcap.exe sha256 20474dcec349197cba2cd28e2e1b89189d55a99ad71e2127ff9161de782eb71d

QorCap v0.3.37: challenge card press feedback

receipt.v0.json is unchanged. Referee verification is unchanged.

• #113: the live challenge card reads each press from /status input.recent_presses (newest 64 rising edges, on the same clock the referee reads from inputs.jsonl), so a short tap is no longer missed between polls. The card follows the referee rule: OPTIONS, then exactly the pattern as the next presses. An extra or wrong press, including a rolled d-pad, resets the count and the card says so. Once the pattern is complete, later presses are not counted. Each press shows Got X. Next: Y. or Extra X: not counted. Redo OPTIONS + all at next snap. Before this, the card skipped stray presses and could show PASS for a sequence the referee rejects. Display only; nothing new goes into the bundle.

qorcap.exe sha256 ce61e3fe5136395e74b37e368a9f6af31a926bbdd745c648ac9e06c5a6b6f081

QorCap v0.3.36: Rumble Echo tuning

receipt.v0.json is unchanged. Defaults are the v0.3.35 behaviour.

• #110: qorcap align-ab DIR --rumble-echo takes --re-pair-tol-ms, --re-max-lag-ms, --re-quiet-ms, --re-onset-threshold, --re-spike-threshold, --re-spike-pct, and --re-mode hist|strongest. --re-hist prints the lag histogram with a chance column, and --re-sweep prints a 36-row parameter grid (stderr and report only; rumble_echo.json holds the selected parameters). Same gates and chance check; sidecar only; nothing is sent to the controller.

qorcap.exe sha256 205880fc0a33a12162ad3d6002dd0db022a120a1216ca82a0f24c08adfe5be64

QorCap v0.3.35: frame-clock latency and Rumble Echo

receipt.v0.json is unchanged. The frame clock stays off by default.

• #107: On the opt-in frame clock, search capture latency one-sided (0 to 1500 ms, one-frame steps), score only presses with a frame stamp, and report one per-session latency with its IQR. Mark it unscorable with fewer than 3 anchors, an IQR above 100 ms, or calibration halves more than 100 ms apart. The input proof keeps the fit unless the measured score is scorable and not higher. Frame indices restart per part file.
• #108: qorcap align-ab DIR --rumble-echo pairs game rumble seen by the pad IMU with sharp visual changes and writes an advisory rumble_echo.json sidecar (status ok, partial, or unscorable). Read-only toward the controller; not in the receipt, the input proof, or the hash chain.
• #106: QorTime site links point at https://qortime.com.

qorcap.exe sha256 e07c7e102c6a1fbb55e72a336264e96f654c4e1bc194fc2726c2eef12124d8e6

QorCap v0.3.34: reader stall watchdog and post-final tail

receipt.v0.json is unchanged.

• #85: Keep the live score reader at 4 Hz when the bundle grows, and log a stall without minting a score.
• #96: Write one stall notice when the reader fetches frames but adds no timeline or health row for 30 seconds, fail a stuck pre-sign lock closed, and cap pause progress at five minutes.
• #82: Keep capturing for a short tail after the first committed end screen (default 10 seconds) and hash those segments on the same chain.
• #98: Count an end screen toward the evidence cutoff when it is at or after the latest scorebug read, leave a contradicting later menu unconfirmed, and name a scorebug in the dispute note only when one sits strictly between the two menus.
• #100: An observation, a row with no home score, or a flushed touchdown hold does not add the phrase that a scorebug came back.
• #102: The recorded-tail re-read scans past the first end menu, so a later different menu leaves the first score unconfirmed and disputed.
• #89: Parse challenge-alert volume and frequency so a bad value cannot drop the toast or the flash, and skip a second beep while a hung player is still running.
• #95: Fail CI when a test file is missing from either suite list or the list command crashes, and keep a signed-zero beep volume audible.
• #91: Re-vendor compat.json from QorTime 393045e, which sets recorder_versions.current to 0.3.33.

qorcap.exe sha256 b1ed0969d9a8c403972aae55d83dc6187fe43060558a1f99c78266af3a8da59b

QorCap v0.3.33: audible challenge alert and scorebug re-anchor

receipt.v0.json is unchanged. Nothing new is written to the receipt or a checkpoint.

• When QorTime posts a liveness challenge, the console plays a loud three-beep clip, tries to show a Windows toast with the prompt (best-effort; some Windows builds refuse it), and flashes the console caption and taskbar button until the window is focused. These alerts are local to this PC and non-blocking: they run on a separate worker after the challenge is recorded and posted, they do not move the issued or deadline times, nothing about them is sent to QorTime or written to the bundle or receipt, and a missed challenge is still a miss. Set QORCAP_CHALLENGE_BEEP=0 to skip the clip (QORCAP_CHALLENGE_TOAST=0 and QORCAP_CHALLENGE_FLASH=0 skip the others); the old MessageBeep still runs. Windows only. Covered by unit tests; not yet exercised on Windows hardware. PR #83.
• The standard-bar scorebug reader re-anchors a stuck score or clock lock (4 gated reads across 2 s) and abstains on an illegal score step. On an unresolved disagreement it publishes null scores and winner unknown, unless a gated end-menu final is present. Re-anchor notes are written to reanchor_notes.jsonl in the match bundle, not to the receipt. No clock or banner template is cut from the held-out matches: the standard-bar clock uses the stock glyphs and no banner pack ships, so field-goal and touchdown banners are not detected. PR #76.
• contracts/compat.json and contracts/qorcap-bundle.v0.json re-vendored from QorTime main (dd01b6c, then 61976ca), and a CI job compares the vendored contracts against QorTime main. PRs #72, #74.
• Vendored contracts re-vendored from QorTime 585ccc4 (frame-bind and readers schemas). Submit uploads frames.jsonl and readers.json when present; this recorder does not write them yet. PR #87.
• CI runs the sidecar scorebug reader tests on Linux and Windows. PR #73.

qorcap.exe sha256 bd1b8b2f14ffa55fc870cc8b55d6880b93324ae63a4eb3d288a3af7248fd61d4

QorCap v0.3.32: receipt schema in the Windows zip

receipt.v0.json is unchanged. The recorder does not stamp a rule on its own challenge result.

• The Windows zip includes contracts/ next to sidecar/. The release build checks every file the sidecar reads and fails if one is missing. If contracts/receipt.v0.json is absent, signing prints a clear message instead of crashing at the end of the match.
• The local finalize summary explains a challenge the recorder already accepted. That receipt check still uses the 600 ms ceiling. The official referee decides with its own rule.
• The challenge card says In the order shown. CIRCLE closes menu; stay until done. when CIRCLE or CROSS is in the pattern and the row fits. Press the pattern in the order shown.
• On Windows, virtual-terminal mode is enabled on the Start Match window. A redirected log no longer turns the branded console off.

qorcap.exe sha256 8b10e63a0d94d1ba5f41153e7f36eb50ae9f03e69d5e7bd100dc7e91f287c4a8

QorCap v0.3.31: pairing and corroboration sidecars

receipt.v0.json is unchanged. Two-sided corroboration is a separate indicator and never changes the verdict. It has not yet been tested on a real two-player match.

• PR #64: qorcap submit uploads score_timeline.json, device_attest.v0.json, and pairing.json when they exist. qorcap pair create asks the QorTime referee for a pairing token (POST /v1/pairings) and prints a code; the other player joins with qorcap pair join or Start Match --pair-code. Both write pairing.json beside the receipt, never inside it. contracts/compat.json is re-vendored from QorTime.
• PR #65: site copy for v0.3.30. The pad-identity check is local (the referee does not check the pad), the opt-in TPM device key is reported only as claimed or unverified, and the red-team missed and weak rows are listed.

qorcap.exe sha256 4482d63923ff55afcd7b54a8d6d7bfc05bd9225526d224649248151c2de21878

QorCap v0.3.30: TPM device key on Intel PTT

qorcap device-key init now creates the TPM-backed key in the Microsoft Platform Crypto Provider. receipt.v0.json is unchanged and the software-key fallback is kept.

• PR #62: NCryptIsAlgSupported was called with NCRYPT_SILENT_FLAG, which the Platform Crypto Provider rejects with NTE_BAD_FLAGS (0x80090009). Neither ECDSA P-256 nor RSA-2048 was tried and init fell back to the software key. The algorithm check and NCryptDeleteKey now pass flags 0, so a failed create no longer leaves a key behind, and the fallback message records each call's HRESULT. Run qorcap device-key init again on a PC that fell back to replace the software key record with the TPM key QorCap-Device-Attest-v0.

qorcap.exe sha256 609c3440f5b58ede5c8f6d5cee413c6eda6ee72ce6588dd6d4f844396a16e690

QorCap v0.3.29: device key, red team, and pad identity

This build collects the changes merged after v0.3.28. receipt.v0.json is unchanged, Glimpse stays observer-only, QORCAP_GLIMPSE_TD_VETO stays off, and nothing is written to the controller.

• PR #53: close path, receipt, key, zip, and spend-cap holes before live Stripe. Manifest and clip paths outside the bundle are refused, the signer keeps only properties the receipt schema allows, keys are created owner-only, and an unusable OpenRouter cost is booked at the worst-case estimate.
• PR #54: grip jolts and hard hand motion are low-confidence in haptic detection. They are capped, not dropped.
• PR #55: qorcap redteam scores synthetic replay, relay, splice, and receipt attacks with the checks that already ship. See docs/REDTEAM.md.
• PR #56: README corrections. A DualSense was read, and the QorTime referee is live.
• PR #57: qorcap device-key init|status. An opt-in TPM-backed device key (software fallback) and the device_attest.v0.json sidecar. receipt.json gains no fields.
• PR #58: qorcap submit refuses side-corrected or offline-re-signed receipts before any network call (exit 4, state: not_submitted).
• PR #59: a signed score_timeline.json sidecar for two-sided corroboration.
• PR #60: the controller identity is sealed into inputs.jsonl, and input-proof fails corroboration when the pad changes mid-match.

qorcap.exe sha256 525c7a4e99b79a22433781377835864c9fb00392edc8d06c14bded5bd4468997