v0.10.0-alpha2

Highlights

• This alpha introduces the first end-to-end full-engine co-op technical slice. A dedicated authoritative JA2 process can create or resume a persistent campaign, while a separate worldless client joins through the multiplayer screen and consumes host-owned campaign and tactical state.
• Co-op now has bounded protocol admission, actor assignment, durable reconnect credentials, voluntary retirement, campaign bootstrap/checkpoint transfer, ordered delta replication, gap recovery, and exact resynchronization. Stale epochs, identities, cursors, commands, and actor incarnations fail closed.
• Tactical replication now covers world dimensions, sector, actors, vitals, hostility, combat loadouts, doors, turn state, command blocking, and compact interrupt state. The authority path supports nine typed tactical intents, including host-owned interrupt eligibility and explicit interrupt passing.
• Dedicated campaigns use crash-safe dual-slot checkpoints, installed-content/runtime identity checks, deterministic campaign seeding, restorable runtime boundaries, and non-rewindable random transactions.
• The native SDL3_net transport and standalone multiplayer coordinator received additional framing, lifecycle, admission, disconnect, and authority hardening. The standalone ja2server remains the Deathmatch/Team Deathmatch coordinator; full campaign co-op runs inside JA2 --dedicated --dedicated-mode=coop.
• Platform release hardening includes corrected SDL timing on Apple Silicon and atomic Windows checkpoint-slot replacement while existing clients retain immutable readers.

Compatibility and security

• The global co-op protocol is now version 7. Alpha1 multiplayer peers are intentionally incompatible: the host and every client must run the same alpha2 build.
• The campaign save baseline remains 1003. This release does not deliberately change the established single-player save baseline.
• The experimental Engine SDK advances from 0.1.0 to 0.2.0. Its expanded tactical snapshot, command-variant, and deterministic-random checkpoint contracts are source-incompatible with the alpha1 SDK, so SDK consumers must update their requested compatibility line to 0.2.
• Co-op admission is currently intended only for a trusted LAN or VPN. Transport is plaintext and first joins are permissionless; this is not authentication and must not be exposed as a public Internet server.
• Packages contain the engine only and no copyrighted game data. An existing Jagged Alliance 2 / JA2 1.13 installation is required.

Verification

• Exact source candidate a8626de1d6d6a7b4fe11dca31fe3d3bd71ced2c3 built JA2, Unfinished Business, the map editor, and server/test targets locally against the pinned dependencies; all 147/147 registered tests passed.
• The affected platform repairs passed 20/20 repeated timing/filesystem runs and 6/6 focused AddressSanitizer suites. The four earlier Windows failure cases also passed locally with a constrained 1 MiB stack.
• Release workflow structure and ownership validation passed, including 52/52 release-validator tests and 11/11 sanitizer-coverage validator tests.
• Cross-platform candidate build passed all 13/13 jobs. Main JA2 completed 147/147 tests on Linux, macOS, and Windows, and Linux AddressSanitizer also completed 147/147. Exact-candidate lint passed.
• Non-publishing four-platform packaging rehearsal passed all 4/4 package jobs and produced exactly 11/11 expected artifacts. All 16 release-attachment steps were skipped, and the draft remained tagless and asset-free throughout rehearsal.
• Published tag packaging passed all 4/4 package jobs and uploaded exactly 11/11 expected release assets.

Packaging

• Compatibility ZIPs are produced for Linux x64, Linux ARM64, macOS, and Windows x64. Each contains JA2, Unfinished Business, Map Editor, and ja2server.
• Linux x64 and ARM64 also receive reproducible AppImages; Windows receives a per-user installer; every platform receives a matching experimental Engine SDK archive.
• Linux AppImages and the Windows installer are unsigned. macOS bundles use ad-hoc signatures rather than Developer ID notarization.

Known limitations

• Full-engine co-op is deliberately labeled a technical alpha. The authoritative foundation, persistence, reconnect/resync, and bounded tactical command path exist, but complete campaign/UI action parity and broad real-world multiplayer playtesting are not yet claimed.
• The worldless client renders host-replicated tactical state and exposes only the currently supported typed intent set. Unsupported legacy actions remain blocked rather than guessed locally.
• Runtime language infrastructure is still migrating; release applications are built in English.

Compare with alpha1

v0.10.0-alpha1

Highlights

• This is a broad engine-architecture alpha. More JA2 and Unfinished Business campaign choices now flow through runtime-owned policies and sessions, while tactical actions increasingly use typed, deterministic commands. The migrations are intended to preserve established game behavior while making campaign, package, save, and replay boundaries independently testable.
• Installed-data handling is safer. INI/property, localization XML, and Items.xml loads validate and stage their input before replacing live state; malformed input is rejected instead of leaving a partial update. Item XML publication is now atomic.
• Localization has a typed runtime-catalog foundation, complete compiled/export schema checks, selected-catalog export, and additional TextPack migrations. Existing catalog payloads and language identities remain pinned by tests.
• The portable SDL3 scalable-font backend replaces the retired platform-specific scalable path while retaining the legacy font catalogue, metrics, clipping, colors, and bitmap fallback.
• Save portability now has exact golden-byte coverage for every serializer primitive and representative production schemas. Those data-free save-contract tests are mandatory on every release packaging runner.

Compatibility

• The save baseline remains 1003, unchanged from alpha16; there is no deliberate save-format break in this release. The runtime-state migrations retain the established on-disk field positions.
• Existing data paths and valid XML/INI schemas are retained. Invalid numeric suffixes, overflow, truncated records, and other malformed inputs that could previously be accepted or partially applied are now rejected transactionally.
• These are engine-only packages. They contain no copyrighted game data and require an existing Jagged Alliance 2 / JA2 1.13 installation.

Packaging

• Compatibility ZIPs are built for Linux x64, Linux ARM64, macOS, and Windows x64. Each contains JA2, Unfinished Business, Map Editor, and the standalone ja2server coordinator; SDL3, SDL3_mixer, and their codecs are linked statically.
• Linux x64 and ARM64 also receive reproducible AppImages, and Windows receives a native per-user installer whose automated ownership test protects user Data/ content and server configuration during uninstall.
• A verified, platform-matching experimental Engine SDK archive is built beside each game archive, including CMake package metadata, a package-host example, and the 0.1 compatibility kit.

Verification

• Final-master CI for e7c63f6719269445258b4be6731dbcc4de8780ce passed: 13/13 build jobs and 1/1 lint job.
• The non-publishing release rehearsal passed 4/4 packaging jobs and produced all 11 expected artifacts (four game ZIPs, four SDK ZIPs, two AppImages, and one Windows installer). Both AppImages reproduced byte-for-byte; macOS signature verification and the Windows installer ownership smoke passed.
• The release workflow requires engine_core, save_serializer_golden, and ja2_headless separately on all four packaging runners. It also verifies macOS bundle signatures, reproduces each AppImage byte-for-byte, verifies the installed SDK manifest, and smoke-tests Windows installer ownership.

Known limitations

• Multiplayer now builds, appears in the menu, and ships with ja2server, but wire compatibility and end-to-end play remain experimental and unverified.
• Runtime language infrastructure is still in migration; the release applications are built in English only.
• Linux AppImages and the Windows installer are unsigned. macOS application bundles use ad-hoc signatures rather than notarized Developer ID signatures.
• The Engine SDK remains pre-1.0 and makes no cross-toolchain C++ ABI promise; consumers should use the platform-matching archive.
• Golden-byte tests prove deterministic serializer schemas, not a complete campaign-save exchange among Windows, macOS, and Linux. An installed-data alpha16-to-alpha1 load and alpha1 save/reload playtest was not performed for this release.

Compare with alpha16

v0.9.0-alpha16

Highlights

• Fixes the macOS ARM64 crash after hiring mercenaries and closing the Laptop.
• Corrects an 80-element ETA text buffer that was incorrectly treated as 128 elements. Its forced terminator crossed the stack-frame boundary and corrupted a saved ARM64 register.
• Passes actual destination capacities through the affected map-screen formatting helpers and hardens other touched wide-format call sites with real array extents.
• Adds architecture ratchets to prevent these unsafe capacity patterns from returning.
• Includes the complete macOS release-bundle signing repair from PR #767, covering JA2, Unfinished Business, and Map Editor bundles.

Compatibility

No save-format, campaign-data, or gameplay-content changes. These are engine-only packages and still require existing Jagged Alliance 2 game data.

Verification

• The original macOS campaign, hire, and Laptop-shutdown route was reproduced and confirmed fixed.
• Complete local Release and AddressSanitizer builds passed.
• Release CTest: 40 of 40 passed.
• ASan CTest: 40 of 40 passed.
• The full hosted Linux, Linux ARM64, macOS, Windows, and Linux ASan matrix passed before merge.

Compare with alpha15

v0.8.0

v0.8.0

A large stability release continuing the codebase-wide crash and undefined-behaviour sweep, plus the first two pieces of engine test and error-handling infrastructure. ~50 confirmed, adversarially-verified defects fixed across 23 PRs. No gameplay or content changes; saves and the multiplayer protocol stay compatible with v0.7.x.

Fixes:

• Dialogue: guard gFacesData[-1] OOB in the snitch / skyrider / special paths (#265)
• Strategic AI: guard gGarrisonGroup[] OOB by NO_GARRISON / -1 (#266)
• SGP: bound the PNG pixel-buffer size against a 32-bit multiply overflow (#267)
• OOB guards: LockTable[LOCK_UNOPENABLE] on blow-up, LightSetColors pPal[1] over-read (#268)
• Overhead map: clip the item exploration-ring pixels (OOB framebuffer write) (#269)
• Militia-move count underflow + l_GetStat on an empty merc list (#270)
• Laptop/economy: Speck-debt off-by-one + two MiniEvents Lua-helper bugs (#271)
• OOB/flag guards: personnel slot, blow-up profile, wall-orientation table, help-restore flag (#272)
• Harden the map/light file loaders against truncated/corrupt files (#273)
• Contract-renewal accumulation, vehicle seat rotation, creature call-priority tables (#274)
• Edgepoints: free the cached center-gridno buffer + include fCenterOnly in the cache key (#275)
• Militia sprite off-by-one, RandomSoldierId empty case, vehicle Lua helpers targeting the wrong vehicle (#276)
• Strategic AI: stop inflating new-AI enemy squads (elite double-count) (#277)
• Pre-battle: NULL-deref crash, tactical-placement soft-lock, guaranteed-ambush integer wrap (#278)
• Clamp unbounded data-driven indices in 5 XML/item loaders (OOB writes/reads) (#279)
• gCreaturePlacements[-1] every night after the queen dies + NPC gift inv[NO_SLOT] OOB (#280)
• IMP: bound the personality-quiz question index (iQuizAnswerList[16] OOB on re-entry) (#281)
• Strategic: AddEnemiesToBattle no longer hangs when tanks/jeeps can't be placed (#284)
• Email: swap message-subject pointers instead of copying between fixed buffers (heap overflow) (#285)
• Strategic: re-fetch the group after GroupArrivedAtSector (simultaneous-arrival use-after-free) (#286)
• Bobby Ray: bound the shipment loops by the gShipmentTable snapshot size (stale-snapshot OOB) (#287)

Engine / testing:

• FileRead now zeroes the unread tail on a short or failed read, retiring the "ignored FileRead -> uninitialized data" crash class at its source (#283)
• Headless engine smoke test: the engine now links into a standalone ctest binary and boots the data-free platform subsystems (memory / file / video), the first slice of an automated test harness (#282)

Engine-only archives (Linux/macOS/Windows). Drop into an existing JA2 1.13 install to run.