@@ -1523,8 +1523,9 @@ not embedded.
 
 Writing inside a signed bundle breaks the signature, so a **write root** was
 added to `fileio.c` (`fileio_set_write_root`): writes / creates / deletes go to
-`~/Library/Application Support/NFSU2 Kayitlar` (the folder name is Turkish for
-"NFSU2 Saves" and is kept as-is so existing saves keep working), reads look
+`~/Library/Application Support/NFSU2 Saves` (until 2026-10-25 it was called
+"NFSU2 Kayitlar"; the runtime renames the old folder once on first start, so
+existing saves keep working), reads look
 there first and then in the game root, and directory listings are the union of
 both. Active only when the data is found inside the bundle (or when
 `NFSU2_SAVEDIR` is given); running from the terminal and a bundle with its data
@@ -2016,7 +2017,7 @@ text input arrives with `WM_CHAR` (we didn't generate it; `metal.m` character ri
 the attribute as a file (profiles are looked up as FOLDERS; the wildcard pattern
 was ignored too), `FileTimeToLocalFileTime`/`FileTimeToSystemTime` were missing (a
 crash when a save existed), `RemoveDirectoryA`/`GetTimeZoneInformation` were
-added. Saves are in `~/Library/Application Support/NFSU2 Kayitlar` for every
+added. Saves are in `~/Library/Application Support/NFSU2 Saves` for every
 bundle; in tests ALWAYS use `NFSU2_SAVEDIR=<scratch>`. Test:
 `AUTOTEXT='1650:\b\b\b\bTalha\n'` types a name, `FILEOPLOG=1` logs file operations.
 
@@ -2039,3 +2040,71 @@ tests can't produce (the end of a career race). Test hook `YAKALAKARE=<frame>`.
 Open item: in career mode the post-race scene (behind the results panel) stays
 black for the user; after a Quick Race drag loss the same scene is correct.
 
+
+## 2026-10-25: first public feedback (Reddit)
+
+Five reports from a player on another Mac. Findings and fixes:
+
+### First-run settings were all at minimum (pop-in, no crowds)
+
+On an empty registry the game runs its own hardware detection once
+(`sub_005ced70` → `sub_005ceca0` → `sub_005cde50`): score = CPU MHz bracket × 0.8
++ GPU table score × 0.2, truncated → `g_PerformanceLevel`, which picks the preset
+for every graphics option. CPU detection (`sub_005cdd00`) first checks for CPUID
+the classic way (pushfd, flip EFLAGS bit 21, popfd, pushfd, compare).
+`eflags_get/eflags_set` (`cpu.h`) did not keep bit 21, so the test always said
+"no CPUID", the MHz stayed 0, the level came out 0 and EVERY option was saved at
+its minimum (world detail 0 = visible building of the world ahead, no crowds,
+reflections, shadows). `NotFirstTime=1` was saved too, so it never detected again.
+
+- `g_eflags_hi` (`mem.c`) now carries the AC/ID bits through pushfd/popfd.
+- `rdtsc_shim` counts real time at a nominal 3.0 GHz (it used to add a fixed
+  3000 per call; the MHz measurement times RDTSC over 50 ms). `RDTSC=fixed`: old.
+- `GetAdapterIdentifier` fills the whole structure: NVIDIA 10DE/0040 (a GeForce
+  6800 Ultra, score 5.0 in the game's table). `ADAPTERID=ven:dev` overrides.
+- The `NotFirstTime` fake is gone (`REGFIRST=1` restores it).
+
+Result on an empty registry: level 4 (4.0 × 0.8 + 5.0 × 0.2 = 4.2; level 4 is the
+highest the game ever picks by itself, 5 is manual only), world LOD 2, crowds on,
+1080p row. Registries saved by the buggy detection (performance level, world
+LOD, car LOD and crowds all 0, no `PortSettingsRepaired` marker) are repaired
+once at load: `NotFirstTime` and the `g_*` values are dropped, so the game detects
+again.
+
+**Side effect, fixed:** the same CPUID test is in ten functions. Now that it
+passes, a library at 0x72d369 picks its SSE variant (0x7337d0 instead of
+0x733700), which uses `cvtpi2ps` and `shufps xmm, m128`; the lifter had neither
+(9.3 million traps in one Quick Race). Both were added to `lift.py`, with a
+`fuzzisa.py` template (all cases match real x86 under Rosetta), and `gen/all`
+was regenerated: the only code differences were these instructions. Traps per
+race: 0. The CRT's `stmxcsr` path stays unreachable (it needs SSE2, which our
+CPUID does not report).
+
+### Cinematic letterbox bars stopped at the 4:3 edges
+
+With `HUDFIX` every orthographic draw is narrowed to the centre so the HUD keeps
+its shape; the NIS letterbox bars were narrowed too and the 3D scene showed at the
+sides. Orthographic draws that span the whole width but only part of the height
+(the bars: y 0.75..1 and -1..-0.75) are now left at full width; full-screen
+pictures (splash, loading screen) keep their 4:3 shape. `HUDWIDE=0`: old.
+`ASPLOG=<frame>` logs each kind of full-width draw once.
+
+### Quit froze the app
+
+`ExitProcess` from a guest thread other than the main one parked that thread
+and nothing told the window to close. `guest_exit_now()` now asks the Metal side
+to quit first.
+
+### Menu music "skipping back" for a moment
+
+When the game stalls (first-launch shader compiles, loading), DirectSound keeps
+looping its 0.5 s buffer and replays old data. The mixer now tracks which 256-byte
+blocks were rewritten since playback last passed them and plays silence for
+stale ones (`SNDSTALE=0`: old). `STALL=<present>:<ms>` reproduces a stall: 2 s
+stall → 1.8 s muted instead of a replay; a normal race mutes ~85 ms.
+
+### Unsupported executables
+
+`SPEED2.EXE` is checked by SHA-256 at startup; any other build (the US retail
+executable, for one) gets a clear message instead of a crash.
+`NFSU2_ANY_EXE=1` skips the check.
@@ -51,8 +51,9 @@ The game boots, reaches the menus, and races are playable with sound.
 - One workaround with an unknown root cause remains: the front end's
   world-view-projection matrix arrives broken and an identity matrix is injected
   instead (`FIXMAT`, see `run.sh`).
-- 400 instructions in rarely used opcodes are still emitted as traps. None are
-  hit in the measured race scene.
+- About 310 instructions in rarely used opcodes (many of them data the
+  disassembler mistook for code) are still emitted as traps. None are hit in the
+  measured race scene.
 - Some visuals are unverified against a Windows reference (crowds / skinned
   meshes). See "Remaining graphics items" in `PROJECT.md`.
 - Under investigation: in career mode, the scene behind the post-race results
@@ -156,9 +157,12 @@ HD build draws about 18 W.
   | | |
   |---|---|
   | File | `SPEED2.EXE`, 4,788,224 bytes |
+  | Build | European v1.2 executable without the CD check |
   | SHA-256 | `8f6a9ae2c4cfa01181d2fd755d99c6f4b7103f60273908ea1de1e719dfe2a297` |
 
-  Other builds have not been tested and will not work without changes.
+  Other builds (for example the US retail executable) have not been tested and
+  will not work without changes. The app checks the file at startup and says so
+  instead of crashing; `NFSU2_ANY_EXE=1` skips the check.
 
 ## Build and run
 
 
@@ -16,7 +16,7 @@
 # and everyone runs it with their own installation.
 #
 # Saves (career profiles) are, in EVERY bundle, OUTSIDE the app and the game
-# folder, in ~/Library/Application Support/NFSU2 Kayitlar; settings in
+# folder, in ~/Library/Application Support/NFSU2 Saves; settings in
 # ~/.nfsu2_registry.  When a new version is shipped and the .app or the game
 # folder is replaced, the player's progress isn't lost (runtime/bundle.m).
 set -e
@@ -137,7 +137,7 @@ echo "ready: $APP  ($SZ)"
 
 if [ "$EMBED" = 1 ]; then
   echo "personal single-piece app ready (DON'T DISTRIBUTE: it contains the game itself)."
-  echo "saves: ~/Library/Application Support/NFSU2 Kayitlar"
+  echo "saves: ~/Library/Application Support/NFSU2 Saves"
   exit 0
 fi
 
@@ -188,7 +188,7 @@ IF SOMETHING GOES WRONG
      defaults delete $BID
 
 SAVES
-  Career saves:  ~/Library/Application Support/NFSU2 Kayitlar
+  Career saves:  ~/Library/Application Support/NFSU2 Saves
   Settings:      ~/.nfsu2_registry
   Both live OUTSIDE the app and the game folder: when a new version comes
   out, replacing $NAME.app (or the game folder) doesn't delete your
 
@@ -50,7 +50,8 @@ unset AUTOKEY AUTOCLICK FORCESWITCH FETICK GAMELOG DUMPFRAME BOOTFLOW \
       DRAWSUM PSISO SKIPPS PSINFO BLITLOG SNDCSV SNDDUMP SNDBACKEND \
       FPSCSV AUTOKEYSTOP VCLOCK VCLOCK_MAXD DECLLOG CULLWIND RSLOG NOFOG BLITQUAD RESSCAN ASPFIX ASPLOG PSHIST MIPLIN NOANISO LODMAX \
       RTIDLOG DRAWVPS ZSHARELOG XFORMAT CAMLOG HD_SSR_DEBUG VIEWLOG HD_RTPROBE HD_RTPROBE2 HD_RT_STAGE HD_RT_NOTEX HD_RT_PLAIN HD_RT_ONLYCX HD_RT_SLOWBUILD HD_RT_LOG HD_RT_DUMPTAB HD_RT_STRESS HD_COMP HD_MSLAZY HD_REORDER HD_RT_AB HD_RT_FIX HD_RT_POISON FORCERAIN FORCETOD FORCETOD_STATE GPUWIN PASSPROF PASSPROF_MODE GPUVSDUMP \
-      SNDMUTE YAKALAKARE DRAWLIST NODRAW LIMFREE ABTEST PASSPROF_CSV HD_MBLOG HD_RT_DLOG HD_RT_ONLY HD_RTPROBE2_HER
+      SNDMUTE YAKALAKARE DRAWLIST NODRAW LIMFREE ABTEST PASSPROF_CSV HD_MBLOG HD_RT_DLOG HD_RT_ONLY HD_RTPROBE2_HER \
+      STALL MEMDUMP REGFIRST ADAPTERID
 
 export FIXMAT="${FIXMAT:-1}"
 export NOMOVIES="${NOMOVIES:-1}"
 
@@ -74,7 +74,14 @@ static void update_rate_ratio(void){
     double   freq;            /* SetFrequency ratio (1.0 = original rate) */
     uint64_t plays, stops, wr_bytes, wr_calls, wr_nonzero;
     uint64_t over;            /* number of callbacks where we passed the writer */
+    /* STALE DATA GUARD (see audio_note_region): which 256-byte blocks hold data
+     * the game wrote and we have not played yet.  Only on streaming buffers. */
+    uint8_t *fresh;
+    uint32_t wr_play;         /* writes since this Play started (>= 8: a streaming buffer) */
+    uint64_t muted;           /* output frames muted because the data was stale */
+    uint32_t lastblk;         /* block the cursor was in at the end of the last callback */
 } SndBuf;
+#define FRESH_SH 8u           /* block = 256 bytes (~1.5 ms of 44.1 kHz stereo 16-bit) */
 
 static SndBuf g_snd[MAXSND];
 static int    g_sndn = 1;                    /* 0 = invalid id */
@@ -111,6 +118,7 @@ int audio_register(uint32_t data, uint32_t bytes, uint32_t rate,
         b->wpos = 0; b->wseen = 0; b->trim = 1.0; b->target = 0.0; b->over = 0;
         b->freq = 1.0; b->plays = b->stops = 0;
         b->wr_bytes = b->wr_calls = b->wr_nonzero = 0;
+        b->fresh = calloc((bytes >> FRESH_SH) + 1u, 1); b->wr_play = 0; b->muted = 0; b->lastblk = 0xFFFFFFFFu;
         fprintf(stderr, "  [sound] buffer #%d: %u Hz, %u channels, %u bits, %u bytes (%.2f s)\n",
                 id, rate, chans, bits, bytes,
                 (double)bytes / (double)(rate * chans * (bits/8u)));
@@ -125,7 +133,7 @@ void audio_play(int id, int loop){
         /* CAUTION: DON'T RESET the cursor on a buffer that is already playing.  The game
          * calls Play over and over on its streaming buffers; going back to the
          * start on every call made the song stutter "stop-start". */
-        if (!g_snd[id].playing){ g_snd[id].cursor = 0.0; g_replay++; }
+        if (!g_snd[id].playing){ g_snd[id].cursor = 0.0; g_snd[id].wr_play = 0; g_replay++; }
         else g_reissue++;
         g_snd[id].playing = 1;
         g_snd[id].loop = loop;
@@ -145,6 +153,37 @@ void audio_note_write(int id, uint32_t end_off){
     }
     pthread_mutex_unlock(&g_slock);
 }
+/* ---- STALE DATA GUARD --------------------------------------------------------
+ * The game streams music (and the mixed sound) into a looping 0.5 s buffer,
+ * writing what we consumed and keeping ~180 ms ahead (measured).  If it stops
+ * writing for a while (a stall: slow disk, a long frame), the play cursor -- which
+ * has to keep moving, the game picks where to write from it -- goes round the ring
+ * and plays the SAME old half second again and again: the "broken record, it
+ * jumps back for two seconds" glitch reported from menus.  Windows does the same
+ * with a looping buffer, the game just never stalls there.  Now every written
+ * region is marked fresh, a block is unmarked once played, and an unmarked block
+ * of a streaming buffer plays as silence: a stall becomes a short gap instead of
+ * a repeat.  The cursor keeps moving exactly as before (no change for the game).
+ * Static buffers (written once, then looped: engine sounds) are not streaming
+ * (fewer than 8 writes since Play) and loop as before.  SNDSTALE=0 disables. */
+static int stale_guard_on(void){
+    static int v = -1; if (v < 0){ const char *e = getenv("SNDSTALE"); v = !(e && *e == '0'); }
+    return v;
+}
+void audio_note_region(int id, uint32_t off, uint32_t n){
+    if (id <= 0 || id >= MAXSND || !n) return;
+    pthread_mutex_lock(&g_slock);
+    SndBuf *b = &g_snd[id];
+    if (b->used && b->bytes && b->fresh){
+        if (off >= b->bytes) off %= b->bytes;
+        if (n > b->bytes) n = b->bytes;
+        uint32_t end = off + n;                           /* may run past the end: wrap */
+        for (uint32_t q = off >> FRESH_SH; (q << FRESH_SH) < end; q++)
+            b->fresh[q % ((b->bytes >> FRESH_SH) + 1u)] = 1;
+        if (b->playing) b->wr_play++;
+    }
+    pthread_mutex_unlock(&g_slock);
+}
 void audio_note_write_stat(int id, uint32_t n, int nonzero){
     if (id <= 0 || id >= MAXSND) return;
     pthread_mutex_lock(&g_slock);
@@ -321,13 +360,23 @@ static void mix_into(int16_t *out, unsigned frames){
         }
         double step = (double)b->rate / (double)OUT_RATE * g_rate_ratio * b->trim * b->freq;
         active++;
+        /* see STALE DATA GUARD */
+        int guard = b->fresh && b->loop && b->wr_play >= 8u && stale_guard_on();
+        uint32_t nblk = (b->bytes >> FRESH_SH) + 1u, lastblk = b->lastblk;
         for (unsigned f = 0; f < frames; f++){
             double sp = b->cursor + step * (double)f;
             if (sp >= (double)nsrc){
                 if (b->loop) sp = fmod(sp, (double)nsrc);
                 else { b->playing = 0; break; }
             }
             uint32_t si = (uint32_t)sp;
+            if (guard){
+                uint32_t blk = (si * bpf) >> FRESH_SH;
+                if (blk != lastblk){                       /* leaving a block: it is played */
+                    if (lastblk != 0xFFFFFFFFu) b->fresh[lastblk % nblk] = 0;
+                    lastblk = blk; }
+                if (!b->fresh[blk % nblk]){ b->muted++; continue; }   /* stale: silence */
+            }
             for (int c = 0; c < OUT_CH; c++){
                 uint32_t sc = (b->chans == 2u) ? (uint32_t)c : 0u;
                 uint32_t off = b->data + si*bpf + sc*bps;
@@ -353,6 +402,7 @@ static void mix_into(int16_t *out, unsigned frames){
             fprintf(g_csv, "%.4f\n", nby ? (double)z/(double)nby : 0.0);
         }
         b->cursor += step * (double)frames;
+        b->lastblk = guard ? lastblk : 0xFFFFFFFFu;
         if (nsrc){
             if (b->cursor >= (double)nsrc){
                 if (b->loop) b->cursor = fmod(b->cursor, (double)nsrc);
@@ -567,6 +617,9 @@ void audio_report(void){
                 (unsigned long long)b->wr_calls, (unsigned long long)b->wr_nonzero,
                 b->wr_bytes/1024.0, b->playing ? "PLAYING" : "stopped");
     }
+    { uint64_t mu = 0; for (int i = 1; i < g_sndn; i++) mu += g_snd[i].muted;
+      fprintf(stderr, "  sound stale guard : %s, %.1f ms of not-yet-rewritten data muted instead of replayed\n",
+              stale_guard_on() ? "on" : "off (SNDSTALE=0)", (double)mu * 1000.0 / (double)OUT_RATE); }
     { uint64_t ov = 0; for (int i = 1; i < g_sndn; i++) ov += g_snd[i].over;
       fprintf(stderr, "  sound cursor overrun: %llu callbacks where playback passed the writer\n",
               (unsigned long long)ov); }
 
@@ -16,6 +16,7 @@
 #include <sys/stat.h>
 #include <libgen.h>
 #include <mach-o/dyld.h>
+#include <CommonCrypto/CommonDigest.h>
 
 static char g_exe_dir[1024];      /* .../NFSU2.app/Contents/MacOS      */
 static char g_app_dir[1024];      /* the directory CONTAINING the .app */
@@ -125,15 +126,20 @@ static int find_under(const char *dir, char *out, size_t osz, int depth){
     const char *env = getenv("NFSU2_SAVEDIR");
     if (env && *env){ snprintf(dir, sizeof dir, "%s", env); return dir; }
     const char *home = getenv("HOME"); if (!home) return NULL;
-    snprintf(dir, sizeof dir, "%s/Library/Application Support/NFSU2 Kayitlar", home);
+    snprintf(dir, sizeof dir, "%s/Library/Application Support/NFSU2 Saves", home);
+    /* The folder used to be called "NFSU2 Kayitlar": move existing saves over once. */
+    { char old[1200]; struct stat st;
+      snprintf(old, sizeof old, "%s/Library/Application Support/NFSU2 Kayitlar", home);
+      if (stat(dir, &st) != 0 && stat(old, &st) == 0 && S_ISDIR(st.st_mode)){
+          if (rename(old, dir) == 0) fprintf(stderr, "saves: moved \"%s\" -> \"%s\"\n", old, dir); } }
     return dir;
 }
 
 static void app_alert(const char *title, const char *msg){
     NSAlert *a = [NSAlert new];
     [a setMessageText:@(title)];
     [a setInformativeText:@(msg)];
-    [a addButtonWithTitle:@"Tamam"];
+    [a addButtonWithTitle:@"OK"];
     [a runModal];
 }
 
@@ -143,7 +149,7 @@ static int app_ask(char *out, size_t osz){
     [op setCanChooseFiles:NO];
     [op setCanChooseDirectories:YES];
     [op setAllowsMultipleSelection:NO];
-    [op setPrompt:@"Sec"];
+    [op setPrompt:@"Choose"];
     [op setMessage:@"Choose the Need for Speed Underground 2 folder "
                    @"(the folder containing SPEED2.EXE)."];
     [NSApp activateIgnoringOtherApps:YES];
@@ -222,6 +228,49 @@ static int app_ask(char *out, size_t osz){
     return NULL;
 }
 
+/* SUPPORTED EXECUTABLE.  Game addresses are hard-coded in the runtime (and the
+ * generated code is lifted from this exact file), so any other SPEED2.EXE --
+ * e.g. the US release -- crashes or hangs somewhere at startup with no hint why.
+ * Check the SHA-256 up front and say so.  NFSU2_ANY_EXE=1 skips the check. */
+#define NFSU2_EXE_SIZE   4788224u
+#define NFSU2_EXE_SHA256 "8f6a9ae2c4cfa01181d2fd755d99c6f4b7103f60273908ea1de1e719dfe2a297"
+int app_check_exe(const char *exe){
+    const char *any = getenv("NFSU2_ANY_EXE");
+    if (any && *any == '1') return 1;
+    FILE *f = fopen(exe, "rb");
+    if (!f) return 1;                                /* the loader reports a missing file */
+    CC_SHA256_CTX c; CC_SHA256_Init(&c);
+    unsigned char buf[65536]; size_t n, tot = 0;
+    while ((n = fread(buf, 1, sizeof buf, f)) > 0){ CC_SHA256_Update(&c, buf, (CC_LONG)n); tot += n; }
+    fclose(f);
+    unsigned char md[CC_SHA256_DIGEST_LENGTH]; CC_SHA256_Final(md, &c);
+    char hex[2 * CC_SHA256_DIGEST_LENGTH + 1];
+    for (int i = 0; i < CC_SHA256_DIGEST_LENGTH; i++) snprintf(hex + 2 * i, 3, "%02x", md[i]);
+    if (!strcmp(hex, NFSU2_EXE_SHA256)) return 1;
+    fprintf(stderr, "unsupported SPEED2.EXE: %s\n  size %zu bytes, sha256 %s\n"
+                    "  supported: %u bytes, sha256 %s (European v1.2 no-CD executable)\n"
+                    "  NFSU2_ANY_EXE=1 skips this check (it will almost certainly not run)\n",
+            exe, tot, hex, NFSU2_EXE_SIZE, NFSU2_EXE_SHA256);
+    if (app_is_bundled()){
+        char msg[1600];
+        snprintf(msg, sizeof msg,
+                 "This port runs exactly one build of the game's executable: the European "
+                 "v1.2 no-CD SPEED2.EXE (%u bytes). The SPEED2.EXE in the chosen folder is "
+                 "different (%zu bytes), for example the US release, and would crash.\n\n"
+                 "Replace SPEED2.EXE in your game folder with the supported one and open the "
+                 "app again. Details: README, \"Requirements\".\n\n%s",
+                 NFSU2_EXE_SIZE, tot, exe);
+        [NSApplication sharedApplication];
+        [NSApp setActivationPolicy:NSApplicationActivationPolicyRegular];
+        [NSApp activateIgnoringOtherApps:YES];
+        app_alert("Unsupported SPEED2.EXE", msg);
+        /* forget the folder so the next launch asks again */
+        [[NSUserDefaults standardUserDefaults] removeObjectForKey:kPrefKey];
+        [[NSUserDefaults standardUserDefaults] synchronize];
+    }
+    return 0;
+}
+
 /* When exiting without finding the game, tell the user why. */
 void app_no_game(void){
     app_alert("Game files not found",