Golden Balloon 1.0.3

Golden Balloon 1.0.3

Golden Balloon 1.0.3 closes a family of texture, glyph, and Remastered
composition defects found after 1.0.2. Restored remains the default and gameplay
timing is unchanged. No game data is included.

Released 2026-08-02.

What changed

• Texture cache entries now describe the complete uploaded image. Source
  row pitch and span, palette, format, dimensions, LOADBLOCK row layout, SDF
  derivation, mip policy, and cutout policy all participate in cache identity.
  Recycled GPU texture IDs also invalidate their sampler memo before upload.
  This removes first-use-wins behavior that could bind old pixels or filtering
  after menu/level asset churn.
• WebGPU cache eviction cannot inherit a stale material or pipeline. The
  redundant-bind trackers are cleared before releasing a cached bind group or
  pipeline. A native implementation may recycle opaque handle addresses; the
  old ordering could mistake a replacement for the object already bound and
  skip a required bind.
• Remastered never applies world finishing to the HUD. At 1× render scale,
  or when the render-pixel budget clamps supersampling to 1×, terminal HUD and
  text are now composed after grading and tonemapping just as they are at 2×.
  The maintained GL/WebGPU gate proves 8,350 opaque HUD pixels are byte-exact
  across the finish A/B at both scales while the world changes materially.
• Cutout mipmaps preserve the silhouette the GPU actually draws. Mip
  coverage previously used alpha 128 while GL, WebGPU, and Metal discarded at
  a strict 0.19 boundary (RGBA8 alpha 49). One shared contract now drives every
  shader and the CPU mip reducer, preventing masked foliage, fences, decals,
  and similar details from changing thickness or disappearing with distance.
• Restored is consistently the safe default. Native defaults, CLI help,
  launcher copy, browser copy, README, and tests now identify Remastered as an
  opt-in work-in-progress mode. The reserved TexturePack setting remains
  parseable for forward compatibility but is hidden until a loader exists.
• The 1.0.2 door-numeral fix is now structurally guarded as an ownership
  rule. Per-door and racer material choices remain draw-local; native code
  cannot reintroduce the shared-model mutation. The real Adventure GL/WebGPU
  oracle still proves stable 1/2/3/5 requirements and distinct final glyphs.
• The corruption gates are fail-red and backend-complete. Odd-row texture
  decode now runs from isolated configuration/save directories on both GL and
  WebGPU, with deliberately broken decode controls. Runtime SDF, door glyph,
  moving mip, cache-ownership, and 1×/2× HUD composition checks cover the
  associated failure modes rather than one screenshot.

What did not change

• WebGPU remains the proven native and browser default. OpenGL remains an
  explicit compatibility/diagnostic backend.
• Original remains Recommended / Proven. Every non-Original frame limit is
  still Experimental — Under Construction and changes host pacing/input
  opportunities only; it does not increase unique visual FPS.
• The macOS artifact remains intentionally unsigned by a Developer ID. It is
  still sealed inside-out and the finished DMG must pass the read-only-mounted
  LaunchServices/WebGPU, dependency, deployment-target, and capture checks.
• Existing saves, ROM support, controls, simulation, input, events, and audio
  timing are unchanged.
• Windows still lets wgpu-native choose Vulkan or Direct3D 12 automatically,
  and still requires reasonably short, ASCII-only app/ROM paths. Explicit API
  selection, richer adapter diagnostics, wide-character filesystem APIs, and
  a reviewed application manifest remain deferred to a future portability
  release.

Golden Balloon 1.0.2

Golden Balloon 1.0.2

Golden Balloon 1.0.2 is a focused rendering-correctness hotfix for the native
1.0.1 patch. No game data is included.

Released 2026-08-02.

What changed

• Dino Domain door requirements stay attached to the correct door. The four
  ordinary race doors require 1, 2, 3, and 5 balloons but share one cached
  model. Version 1.0.1 wrote a door's selected numeral into that shared model
  during a view-dependent fixed-tick traversal. Whichever visible door wrote
  last could therefore put its digit on every sign, and moving the camera could
  change the displayed numbers without changing progression state. Version
  1.0.2 resolves each atlas offset from the door being submitted and never
  mutates the shared model.
• OpenGL no longer repeats a selected numeral across the door face. Its
  sampler memo now includes texture identity, so a newly bound OpenGL texture
  receives its own clamp/filter state even when those settings match the prior
  binding. WebGPU was not affected by this sampler defect and remains the native
  default.
• The regression is covered at the gameplay and pixel boundaries. A fresh
  Adventure route reaches the real Dino Domain lobby on GL and WebGPU, proves
  all four authored requirements remain stable on one shared model, submits all
  four in one frame, checks one- and two-digit atlas selection, and validates
  distinct 2/1/3 final pixels while the camera moves. Blank output, a common
  glyph on every door, repeated sampler output, and the old shared offset are
  all fail-red controls. Original, 240, and Uncapped presentation policies pass.
• Windows save custody stays byte-exact. Legacy preference/save migration
  now uses an exclusive binary destination on Windows, and the save utility's
  staging files bypass CRT text translation. The native Windows release gate
  compiles and executes these paths, the public-surface guard, and all other
  ROM-free CTests before packaging is allowed.

What did not change

• WebGPU remains the proven native and browser default. OpenGL remains an
  explicit compatibility/diagnostic backend.
• Original remains Recommended / Proven. Every non-Original frame limit is
  still Experimental — Under Construction and changes host pacing/input
  opportunities only; it does not increase unique visual FPS.
• The macOS artifact remains intentionally unsigned by a Developer ID. It is
  still sealed inside-out and the finished DMG must pass the read-only-mounted
  LaunchServices/WebGPU, dependency, deployment-target, and capture checks.
• Existing saves, ROM support, controls, and gameplay timing are unchanged.
• Windows still lets wgpu-native choose Vulkan or Direct3D 12 automatically,
  and still requires reasonably short, ASCII-only app/ROM paths. Explicit API
  selection, richer adapter diagnostics, wide-character filesystem APIs, and
  a reviewed application manifest remain deferred to a future portability
  release.

Golden Balloon 1.0.1

Golden Balloon 1.0.1

Windows WebGPU presentation no longer blocks the cooperative game/audio thread
after each submitted frame. This restores the responsive startup audio and menu
animation behavior of 1.0.0. Production submits only newly authored images and
polls GPU completion without a synchronous runtime drain.

Released 2026-08-01.

Golden Balloon 1.0.1 is the first native patch release. It repairs the macOS
package, keeps experimental host-pacing choices separate from the proven
Original mode, and keeps WebGPU as the native default. No game data is included.

What changed

• The macOS app is self-contained again. The old package accidentally
  bundled Homebrew's sdl2-compat shim, which dynamically loaded an unbundled
  SDL3 from the build machine. The replacement uses SHA-pinned standalone SDL2
  2.32.10, embeds its license, targets arm64/macOS 13, and rejects Homebrew,
  SDL3, unresolved load paths, mismatched architectures, and newer hidden
  deployment targets.
• The “damaged and can't be opened” failure is fixed at the package
  boundary. Nested code is sealed before the outer app after every bundle
  mutation, and the finished DMG is checksum-verified, mounted read-only, and
  revalidated in place. The exact app inside the mounted, read-only DMG must
  then launch through LaunchServices, select WebGPU, present and capture four
  real surface frames, and load no Homebrew or SDL3 libraries.
• WebGPU is the native default. Dense opening-sequence captures found
  localized sky/terrain texture corruption in the OpenGL path that sparse
  sampling had missed. WebGPU does not show that corruption and is also the
  project's extensively tested browser backend. OpenGL remains available with
  MDKR_RENDERER=gl as a diagnostic path, not the default release path.
• Windows startup audio and menu timing are restored. A post-1.0.0 queue
  bound called wgpuDevicePoll(..., true) after every second native WebGPU
  submission, synchronously draining the native WebGPU queue on the same
  cooperative thread that advances gameplay and refills audio. Production now
  polls completion without blocking and reserves the explicit queue bound for
  browser/internal replay stress. The final portable candidate passed a
  real-hardware Windows retest from launcher through intro, character select,
  gameplay, audio, and relaunch.
• Numeric and Uncapped frame limits no longer crash the native app. The
  adopted OpenGL context now initializes its function loader before the pacing
  code can use sync/fence entry points. Real launcher tests exercise both
  WebGPU and explicit OpenGL with the 240 and Uncapped policies. For 1.0.1,
  every non-Original choice is marked Experimental — Under Construction in
  the launcher and affects host pacing/input/event-pump opportunities, not
  unique visual FPS. Any benefit may be negligible, while higher settings can
  use more CPU.
• Unsafe motion smoothing is disabled for this patch. Release-candidate
  play-testing found that delayed display-list replay could run after the game
  had begun rewriting mutable viewport, matrix, vertex, texture, and display-
  list dependencies for the following task. The safe 1.0.1 policy submits only
  new authored images. The primary US 1.1 build remains at its authored roughly
  30 unique visual FPS, with no duplicate swaps. This removes the off-center
  UI, missing vehicle parts, fractured geometry, and related high-rate artifacts
  from the release path.
• Gameplay compatibility was re-checked. Automated Original-mode replay
  remains byte-exact with the pre-patch baseline. A direct two-player gate now
  proves exact P1/P2 controller-to-racer binding, button edges, stick input,
  and independent motion across GL/WebGPU at 60/120 Hz; the determinism and
  render-purity controls remain green.
  Numeric and Uncapped choices change host pacing only; they do not accelerate
  the simulation or increase the authored visual frame rate.
• Magic codes load and validate correctly. The decrypted big-endian table
  is normalized and fully bounds-checked before publication, fixing the
  reported 8/blank enabled-code rows and universal “code was incorrect”
  result without allowing a partial table through.
• The launcher and in-game overlay are cleaner and safer to use. Navigation,
  dropped-ROM intake, boot configuration, overlay state, confirmation flows,
  and panel rendering now have small named owners with typed state instead of
  a monolithic draw path. Invalid ROM replacements and failed preference writes
  leave the last-known-good choice active; a failed setting retains the value
  you entered and can be saved through the visible Retry button after write
  access is restored, without restarting the app. Escape and controller B now
  follow the same popup → confirmation → Settings → overlay back stack.
• The native launcher now adapts to its window and display. Its supported
  minimum is 640×480, where the side rail becomes compact top navigation and
  wide controls/actions stack instead of clipping. A persisted 0.75×–2.00× UI
  scale changes text, controls, and spacing together; moving between standard
  and HiDPI displays rebuilds the font atlas before the next frame.
• Native accessibility scope is stated explicitly. The launcher supports
  keyboard and gamepad navigation, visible focus, scalable high-contrast UI,
  and restrained motion. This patch does not claim a native VoiceOver,
  UI-Automation, or other screen-reader semantic tree.
• Return to Launcher shuts down cleanly before relaunching. The engine,
  borrowed renderer objects, host, and diagnostic log reader unwind before the
  resolved executable replaces the process. A failed relaunch is visible and
  returns an error instead of hanging on an orphaned diagnostics pipe.
• The Linux portable release is GPU-gated and self-contained. Linux and
  Windows validation builds compile the requested version and assert the binary
  reports it before packaging. The public portable files are
  Golden-Balloon-1.0.1-linux-x86_64.AppImage and
  Golden-Balloon-1.0.1-linux-x86_64.tar.gz. Before upload, deterministic
  Xvfb + Mesa software-GPU lanes content-validate the real launcher through
  default WebGPU and explicit GL, then extract the tarball, launch its AppRun
  from an unrelated directory using bundled SDL2, and repeat both pixel gates.
  Those Linux files are published only if that complete workflow passes; a
  failed or unavailable lane produces no endorsed Linux binary.
  Windows builds, import-checks, packages, and launches from its extracted zip,
  but windows-latest cannot guarantee a qualifying GPU/API surface. The 1.0.1
  Windows zip therefore received a separate manual native WebGPU gameplay,
  controller, audio, save, and relaunch acceptance pass on Windows hardware;
  the automated startup checks are not presented as a rendered gameplay gate.
• Release checks fail closed more often. Merge commits and pushed ref tips
  receive public-surface scans; committed-then-deleted history is checked;
  privacy and browser-presentation tasks are pinned by the CI contract; and
  the macOS target, dependencies, runtime loads, version, commit, renderer, and
  bundled license are independently verified.

FPS behavior

The launcher identifies Original as Recommended / Proven and marks Match
Display, numeric choices, and Uncapped Experimental — Under Construction.
In 1.0.1 these settings only alter host pacing and input/event-pump
opportunities. They do not increase unique visual FPS, swap duplicate images,
or speed up the game's authored simulation. The primary US 1.1 build remains at
its authored roughly 30 unique visual FPS. Any benefit may be negligible, while
higher settings can use more CPU.

Motion smoothing and delayed display-list replay are fully disabled for this
patch. The replay experiment could not prove immutable ownership of every
viewport, matrix, vertex, texture, and nested display-list dependency through a
delayed walk. The faster historical one-field simulation remains a separate,
explicit compatibility option; it is not enabled by Frame Limit. Use Original
for the recommended release behavior.

macOS first launch

This patch intentionally skips Developer ID signing and Apple notarization.
The app is ad-hoc signed for code/resource integrity, but macOS may show the
ordinary unidentified-developer warning. After the first blocked launch, open
System Settings → Privacy & Security, scroll down, choose Open Anyway,
and confirm Open. Apple documents that current flow in
Open apps safely on your Mac. A “damaged”
warning is not expected and should be reported as a bug.

The release artifact is Apple silicon only, requires macOS 13 or later, and is
named Golden-Balloon-1.0.1-macos-arm64-unsigned.dmg. Its checksum and
provenance sidecars identify the exact source commit and record
macos_signing: ad-hoc-unsigned so it cannot be mistaken for the optional
Developer ID/notarized flavor. If that trusted flavor is published later, its
exact name is Golden-Balloon-1.0.1-macos-arm64-signed-notarized.dmg and its
provenance records macos_signing: developer-id-notarized.

Current limitations

The patch does not expand its claims beyond the tested WebGPU paths: the
complete campaign is not automated end to end, OpenGL remains diagnostic while
its opening-sequence visual-parity issue is open, macOS requires the manual
first-open approval above, and Linux has less physical-hardware coverage.
Windows build/package/startup checks are automated, while native GPU gameplay,
controller, audio, and save acceptance remains a manual gate that passed for
this candidate. On Windows, wgpu-native automatically selects a compatible API
and may use Vulkan or Direct3D 12; MDKR_RENDERER does not force either one.
Windows 1.0.1 also requires reasonably short, ASCII-only paths f...

Golden Balloon 1.0.0

First public release. Native macOS, Windows, and Linux builds plus the browser version. No game data is included: you supply a ROM of the original game that you legally own. See RELEASE_NOTES.md in the repository for details, and the .provenance.json beside each file for its source commit and SHA-256.