Fix missing-texture-fallback crash; replay hardening (seek asset-table fix, disk-spooled seek snapshots, parse robustness); clearer errors for unserializable app-config values; iOS/tvOS config-dir groundwork.

Author: efroemling

.efrocachemap

@@ -1,4 +1,4 @@
-### 1.8.0 (build 22971, api 9, 2026-08-11)
+### 1.8.0 (build 22972, api 9, 2026-08-11)
 - Fully implemented asset packages (more on this soon)
 - Upgraded to Python 3.14. This gives us a few nice useful bits such as zstd
   compression to help speed up online stuff and also means we can get rid of all

CHANGELOG.md

@@ -113,6 +113,18 @@ that should disappear with the feature-set, wrap it in
 `__SPINOFF_REQUIRE_FOO_BEGIN__` … `_END__`. Don't relocate the
 host file just to satisfy the strip.
 
+**Keep the stripped result format-stable (C++).** The stripped file
+must still be a fixed point of the destination's `clang-format`, or
+`pubsync pull` flags a bogus manual-merge: a function whose body is
+mostly one strip section can collapse to a single line under the
+public side's formatter, which then reads back as a public-side
+edit. When a strip section would leave behind a one-statement
+function body, keep a comment line *inside the function but outside
+the markers* so the stripped form stays multi-line. Precedent:
+`ReportHost()` in
+`src/ballistica/shared/foundation/fatal_error_report.cc`
+(hit 2026-08-11).
+
 ## Structuring code that crosses boundaries
 
 The spinoff system's most subtle rule: **a file's location is its

docs/design/spinoff.md

@@ -23,7 +23,7 @@
     "bauiv1lib": "buil"
   },
   "efrocache_repository_url": "https://files.ballistica.net/cache/ba1",
-  "engine_build_number": 22971,
+  "engine_build_number": 22972,
   "name": "BallisticaKit",
   "public": true,
   "python_paths": [
@@ -43,5 +43,5 @@
     "tests",
     "config"
   ],
-  "version": "1.8.0a79"
+  "version": "1.8.0a80"
 }

pconfig/projectconfig.json

@@ -55,8 +55,8 @@
 
 # Build number and version of the ballistica binary we expect to be
 # using.
-TARGET_BALLISTICA_BUILD = 22971
-TARGET_BALLISTICA_VERSION = '1.8.0a79'
+TARGET_BALLISTICA_BUILD = 22972
+TARGET_BALLISTICA_VERSION = '1.8.0a80'
 
 
 @dataclass

src/assets/ba_data/python/baenv.py

@@ -35,26 +35,35 @@ static constexpr bool kForceUncompressedDDS = false;
 
 TextureAsset::TextureAsset() = default;
 
+/// Derive the loader container hint from a resolved asset path. CAS
+/// blobs resolve to bare content-hash file names with no extension
+/// (all texture flavors are KTX2 containers), while every legacy
+/// on-disk path — including the headless ``.nop`` dummy — carries an
+/// extension for the loader's path-suffix sniff. Keying on the
+/// *resolved* path shape (rather than whether the *requested* name
+/// was a qualified ``<apverid>:<name>`` ref) matters because bare
+/// legacy names can still resolve to CAS blobs: a missing texture
+/// falls back to the builtin package's ``textures/white``, and that
+/// fallback must load rather than fail the asset (which is fatal if
+/// the render path later touches it).
+static auto DeriveContainerHint(const std::string& path) -> std::string {
+  auto slash_pos = path.find_last_of("/\\");
+  auto dot_pos =
+      path.find('.', slash_pos == std::string::npos ? 0 : slash_pos + 1);
+  if (dot_pos == std::string::npos) {
+    return ".ktx2";
+  }
+  return {};
+}
+
 TextureAsset::TextureAsset(const std::string& file_in, TextureType type_in,
                            TextureMinQuality min_quality_in)
     : file_name_(file_in), type_(type_in), min_quality_(min_quality_in) {
   file_name_full_ = g_base->assets->FindAssetFile(
       type_ == TextureType::kCubeMap ? Assets::FileType::kCubeMapTexture
                                      : Assets::FileType::kTexture,
       file_in);
-  // CAS-form ref (``<apverid>:<asset_name>``) resolves to a CAS blob
-  // whose on-disk name is just a hash — no extension. Set an
-  // explicit container hint so the loader can dispatch without
-  // sniffing the path. Hardcoded to ``.ktx2`` (FALLBACK_V1 produces
-  // KTX2 per initiative decision #12); Phase 3 construct-mode
-  // replaces this with per-profile dispatch. Headless mode resolves
-  // to a ``.nop`` dummy path which has its own loader branch, so
-  // we leave the container empty in that case and let the matcher's
-  // path-suffix fallback pick the right branch.
-  if (file_in.find(':') != std::string::npos
-      && !file_name_full_.ends_with(".nop")) {
-    container_ = ".ktx2";
-  }
+  container_ = DeriveContainerHint(file_name_full_);
   valid_ = true;
 }
 
@@ -116,10 +125,8 @@ auto TextureAsset::ReResolveSource() -> bool {
     return false;
   }
   file_name_full_ = new_full;
-  // Re-derive the container hint exactly as the constructor does: CAS blobs
-  // are extensionless KTX2; the headless ``.nop`` dummy keeps it empty so the
-  // matcher's path-suffix fallback picks the right branch.
-  container_ = file_name_full_.ends_with(".nop") ? "" : ".ktx2";
+  // Re-derive the container hint exactly as the constructor does.
+  container_ = DeriveContainerHint(file_name_full_);
   return true;
 }
 

src/ballistica/base/assets/texture_asset.cc

@@ -137,10 +137,21 @@ auto PlatformApple::GetDeviceUUIDInputs() -> std::list<std::string> {
 
 auto PlatformApple::DoGetConfigDirectoryMonolithicDefault()
     -> std::optional<std::string> {
-#if BA_PLATFORM_IOS_TVOS
-  // FIXME - this doesn't seem right.
-  printf("FIXME: get proper default-config-dir\n");
-  return std::string(getenv("HOME")) + "/Library";
+#if BA_PLATFORM_TVOS
+  // tvOS gives us no persistent writable location (only Caches and tmp
+  // are writable), so config state lives under our cache dir and may be
+  // purged by the OS while we're not running. That's acceptable for
+  // now: GameCenter auto-sign-in restores the account on a fresh
+  // launch and important state lives server-side. If it proves a
+  // problem in practice we can look at mirroring critical bits to
+  // NSUserDefaults/iCloud KVS (or storing more via our own cloud).
+  return std::string(BallisticaKit::FromCpp::getCacheDirectoryPath())
+         + "/config";
+#elif BA_PLATFORM_IOS
+  // Sandboxed per-app, but use a subdir to match our macOS layout.
+  return std::string(
+             BallisticaKit::FromCpp::getApplicationSupportDirectoryPath())
+         + "/BallisticaKit";
 #elif BA_PLATFORM_MACOS && BA_XCODE_BUILD
   return std::string(BallisticaKit::CocoaFromCpp::getApplicationSupportPath())
          + "/BallisticaKit";

src/ballistica/core/platform/apple/platform_apple.cc

@@ -1485,6 +1485,17 @@ void ClientSession::GetCorrectionMessages(
 }
 
 void ClientSession::DumpFullState(SessionStream* out) {
+  // Declare our asset-package table first so everything below can be
+  // written as indexed refs (mirroring HostSession::DumpFullState).
+  // This matters for replay seeks: the restore path resets the session
+  // (clearing the table) and then resumes reading the on-disk stream
+  // *past* its start-of-stream declarations, so the snapshot itself
+  // must re-establish the table or every indexed ref after a seek
+  // fails against an empty table.
+  if (!asset_package_table().empty()) {
+    out->DeclareAssetPackages(asset_package_table());
+  }
+
   // Add all scenes.
   for (auto&& i : scenes()) {
     if (Scene* sg = i.get()) {