v1.32.43 — KEEN voice, mailbox release notes, batch-0 fixes, terrain recovery

src/account.js

@@ -224,7 +224,12 @@ async function syncPull(){
 /* Never overwrite silently. Progress is compared on the one axis a player would
    compare it on themselves — how far the career has actually got — and the
    choice is theirs whenever both sides have something worth keeping. */
-function careerWeight(m){ return (m?(m.xp||0):0)+(m?(m.cores||0):0)*3+(m?(m.researchData||0):0)*8+(m?(m.matches||0):0)*40; }
+/* Cores are deliberately NOT weighed. They are the one term in this sum an
+   imported .mfsave can set to anything, and at x3 a forged balance outweighs
+   every honest axis combined — so the file that lies the hardest wins the merge
+   and overwrites the real career. XP, research and matches all cost time to
+   accumulate; a spendable currency is not evidence of progress. */
+function careerWeight(m){ return (m?(m.xp||0):0)+(m?(m.researchData||0):0)*8+(m?(m.matches||0):0)*40; }
 function applyIncoming(p,src){
   const mine=careerWeight(META), theirs=careerWeight(p.meta);
   const use=()=>{

src/assetpack.js

@@ -183,17 +183,20 @@ function packRenderBar(){
   el.classList.toggle('busy', PACK.state === 'downloading');
   if(PACK.state === 'downloading'){
     const pct = PACK.total ? Math.round(PACK.got / PACK.total * 100) : 0;
-    txt.textContent = 'DOWNLOADING SOUNDTRACK';
+    txt.textContent = 'DOWNLOADING AUDIO PACK';
     sub.textContent = packBytes(PACK.got) + ' of ' + packBytes(PACK.total) + '  ·  ' + pct + '%';
     bar.style.width = pct + '%'; btn.textContent = '…'; btn.disabled = true;
     el.style.display = '';
   } else if(PACK.state === 'offer'){
-    txt.textContent = 'SOUNDTRACK AVAILABLE';
-    sub.textContent = packBytes(PACK.total) + ' — faction music, downloaded once';
+    /* No longer soundtrack-only: this panel now covers the voice bank too, and
+       telling a player they are downloading music when they are also getting
+       every spoken line is the kind of small lie that gets a refund request. */
+    txt.textContent = 'AUDIO PACK AVAILABLE';
+    sub.textContent = packBytes(PACK.total) + ' — faction music and voices, downloaded once';
     bar.style.width = '0%'; btn.textContent = 'GET IT'; btn.disabled = false;
     el.style.display = '';
   } else if(PACK.state === 'error'){
-    txt.textContent = 'SOUNDTRACK UNAVAILABLE';
+    txt.textContent = 'AUDIO PACK UNAVAILABLE';
     sub.textContent = PACK.err;
     bar.style.width = '0%'; btn.textContent = 'RETRY'; btn.disabled = false;
     el.style.display = '';
@@ -202,13 +205,33 @@ function packRenderBar(){
   }
 }
 
+/* Every pack this build knows how to consume, in the order it wants them.
+   `voice` was published on the channel and then never requested by anything —
+   packDownload's only call site asked for 'music' and packStart returned early
+   unless idx.music existed — so on a pack-only build the radio and KEEN banks
+   were never fetched, packURL('voice', …) always returned null, and voice was
+   silent on every device. Generalised over a list so the next pack is data. */
+/* Voice FIRST. Music is 16.1 MB and voice is 5.2, so fetching in the old order
+   meant the download prompt quoted 21.3 MB and KEEN stayed mute until the whole
+   soundtrack had landed — on a phone, on mobile data, that is most of a session
+   of silence from the feature the update is for. Ordered by what the player
+   notices missing, not by what was written first. */
+const PACK_WANT = ['voice', 'music'];
+
 async function packStart(manual){
   packPanel();
   const idx = PACK.idx || await packLoadIndex();
-  if(!idx || !idx.music){ PACK.state = 'idle'; packRenderBar(); return; }
-  const miss = await packMissing('music');
-  PACK.total = miss.bytes;
-  if(!miss.files.length){
+  if(!idx){ PACK.state = 'idle'; packRenderBar(); return; }
+  const want = PACK_WANT.filter(p => idx[p]);
+  if(!want.length){ PACK.state = 'idle'; packRenderBar(); return; }
+  let bytes = 0;
+  const need = [];
+  for(const p of want){
+    const m = await packMissing(p);
+    if(m.files.length){ need.push(p); bytes += m.bytes; }
+  }
+  PACK.total = bytes;
+  if(!need.length){
     PACK.state = 'ready'; packRenderBar();
     if(typeof audAttachPack === 'function') audAttachPack();
     return;
@@ -217,7 +240,8 @@ async function packStart(manual){
   try{ pref = localStorage.getItem(PACK_PREF) || 'ask'; }catch(e){}
   if(!manual && pref !== 'auto'){ PACK.state = 'offer'; packRenderBar(); return; }
   try{ localStorage.setItem(PACK_PREF, 'auto'); }catch(e){}
-  const ok = await packDownload('music');
+  let ok = true;
+  for(const p of need) ok = (await packDownload(p)) && ok;
   if(ok && typeof audAttachPack === 'function') audAttachPack();
 }
 

src/audio.js

@@ -145,10 +145,12 @@ function audUnique(){
 async function audLoad(name){
   try{
     let url = AUD.base + name + '.' + AUD.ext;
-    /* The radio bank ships as an on-demand pack, exactly like the soundtrack —
-       216 clips is not something every installer should carry. If the pack is
+    /* The voice bank also ships on the optional pack channel. If the pack is
        stored, play it from IndexedDB; otherwise fall through to the packaged
-       path, which is what a build whose APK already carries them uses. */
+       path under assets/audio/voice/, which is where the bank now lives in the
+       repo — so a build that never fetched a pack still speaks. Both formats are
+       reachable either way: AUD.ext is chosen by asking the browser what it can
+       decode, never by hard-coding one container. */
     if(name.lastIndexOf('voice/',0)===0 && typeof packURL==='function'){
       try{ const u = await packURL('voice', name.slice(6) + '.' + AUD.ext); if(u) url = u; }catch(e){}
     }
@@ -202,15 +204,21 @@ async function audLoadSlots(){
   }catch(e){}
 }
 
-/* The rendered radio bank. Each line becomes an ordinary AUD_MAP slot, so voice
-   inherits the whole existing pipeline for free: format selection, decoding,
-   the sfx bus and its volume slider, ducking, priority culling. AUD_CLEAR keeps
-   them un-muffled by distance — a radio call arrives over the radio, not from
-   wherever on the map the unit happens to be standing.
+/* The rendered voice bank — four factions of unit radio plus KEEN, the training
+   liaison. Each line becomes an ordinary AUD_MAP slot, so voice inherits the
+   whole existing pipeline for free: format selection, decoding, the sfx bus and
+   its volume slider, ducking, priority culling. AUD_CLEAR keeps them un-muffled
+   by distance — a radio call arrives over the radio, not from wherever on the
+   map the unit happens to be standing.
 
-   Buffers are NOT fetched here. 108 clips is four factions' worth and a player
-   only ever hears their own, so voPlay() loads a slot the first time it is
-   actually asked for and voPrewarm() pulls the player's faction at match start. */
+   Nothing here is speaker-specific: the loop walks whatever `lines` the manifest
+   declares, so adding a speaker is a data change. KEEN's 54 authored ids arrive
+   through exactly this path.
+
+   Buffers are NOT fetched here. 162 takes is four factions plus a narrator and a
+   player only ever hears one faction, so voPlay() loads a slot the first time it
+   is actually asked for and voPrewarm() pulls the player's faction at match
+   start. */
 let VOICE_BANK = null;
 async function audLoadVoiceBank(){
   try{
@@ -223,13 +231,28 @@ async function audLoadVoiceBank(){
       for(const action in j.lines[fac]){
         const slot = 'vo_' + fac + '_' + action;
         AUD_MAP[slot] = j.lines[fac][action].map(stem => 'voice/' + stem);
-        AUD_MIX[slot] = { g: 0.9, gap: 1200, p: 1 };
+        /* Speech is the most information-dense thing in the mix and there are at
+           most two of it (see audVoiceChannel). Priority 1 put it at the bottom
+           of audMakeRoom's eviction order, so the moment a firefight filled the
+           22-voice pool the tutorial narration was the first thing thrown out. */
+        AUD_MIX[slot] = { g: 0.9, gap: 1200, p: 5 };
         AUD_CLEAR.add(slot);
         AUD_DUCK.add(slot);
       }
     }
   }catch(e){ VOICE_BANK = null; }
 }
+/* True if the MANIFEST carries a take for this line, decoded or not. Separate
+   from voReady on purpose: "is there a recording of this" and "can it start on
+   this exact millisecond" are different questions, and answering the first with
+   the second is what made every caller conclude there was no voice at all
+   during the whole of a cold start. */
+function voHas(fac, action){
+  if(!fac || !action) return null;
+  const slot = 'vo_' + fac + '_' + action;
+  const list = AUD_MAP[slot];
+  return (list && list.length) ? slot : null;
+}
 /* True if the slot is playable right now. Kicks off the decode when it is not,
    so the very next order in that category speaks. */
 function voReady(fac, action){
@@ -240,10 +263,89 @@ function voReady(fac, action){
   if(typeof AC !== 'undefined' && AC) list.forEach(f => { if(!AUD.buf[f]) audLoad(f); });
   return null;
 }
-function voPlay(fac, action, wx, wy){
-  const slot = voReady(fac, action);
+/* Duration of the take a slot would play, in seconds, straight out of the
+   manifest — available before anything is decoded. Used to hold the music duck
+   open for the length of a narration line rather than a fixed 650 ms. */
+function voSeconds(slot){
+  if(!VOICE_BANK || !VOICE_BANK.takes) return 0;
+  const list = AUD_MAP[slot];
+  if(!list || !list.length) return 0;
+  let s = 0;
+  for(const f of list){
+    const t = VOICE_BANK.takes[f.lastIndexOf('voice/',0)===0 ? f.slice(6) : f];
+    if(t && t.seconds > s) s = t.seconds;
+  }
+  return s;
+}
+/* KEEN alone is 345 seconds of speech. Decoded to float PCM at the context rate
+   that is ~66 MB resident if every line the tutorial plays is kept — the exact
+   arithmetic the playlist comment below refuses to pay for a soundtrack. Voice
+   buffers are therefore released once the bank grows past a working set; a
+   recall inside the window is still instant, and anything older simply decodes
+   again the next time it is asked for.
+
+   Budgeted in SECONDS, not files: a faction's whole radio vocabulary is 27 clips
+   of about two seconds and must stay resident, while three KEEN narration lines
+   are the same memory. 90 s is roughly 17 MB of mono float at 48 kHz. */
+const VO_BUDGET_SEC = 90;
+const voSeen = [];
+function voFileSeconds(f){
+  if(!VOICE_BANK || !VOICE_BANK.takes) return 2;
+  const t = VOICE_BANK.takes[f.lastIndexOf('voice/',0)===0 ? f.slice(6) : f];
+  return (t && t.seconds) || 2;
+}
+function voTouch(files){
+  for(const f of files){
+    const i = voSeen.indexOf(f);
+    if(i >= 0) voSeen.splice(i, 1);
+    voSeen.push(f);
+  }
+  let held = 0;
+  for(const f of voSeen) held += voFileSeconds(f);
+  while(voSeen.length > 1 && held > VO_BUDGET_SEC){
+    const old = voSeen.shift();
+    if(AUD.active.some(v => !v.done && AUD_MAP[v.name] && AUD_MAP[v.name].indexOf(old) >= 0)){
+      voSeen.push(old); break;                 // still sounding: keep it, try later
+    }
+    held -= voFileSeconds(old);
+    delete AUD.buf[old];
+  }
+}
+/* Play a rendered line.
+
+   Returns TRUE when this call has taken responsibility for the line — either it
+   started, or the decode is in flight and playback/miss is scheduled. Returns
+   FALSE only when no take exists at all, which is the caller's cue to fall back
+   to synthesis IMMEDIATELY. `onMiss` fires when a take existed but could not be
+   produced (fetch 404, decode reject), which is the deferred version of the same
+   cue. Reporting false the instant a slot was merely undecoded is what pushed
+   every first airing — and for KEEN, every airing — onto speechSynthesis. */
+function voPlay(fac, action, wx, wy, idx, onMiss){
+  const slot = voHas(fac, action);
   if(!slot) return false;
-  try{ return sfx(slot, wx, wy, 1) !== false; }catch(e){ return false; }
+  const list = AUD_MAP[slot];
+  const want = (typeof idx === 'number' && idx >= 0) ? list[(idx | 0) % list.length] : null;
+  if(want ? !!AUD.buf[want] : list.some(f => AUD.buf[f])){
+    voTouch(list.filter(f => AUD.buf[f]));
+    try{ if(sfx(slot, wx, wy, 1, idx) !== false) return true; }catch(e){}
+    return false;
+  }
+  if(typeof AC === 'undefined' || !AC) return false;
+  const t0 = performance.now();
+  Promise.all(list.map(f => AUD.buf[f] ? null : audLoad(f))).then(() => {
+    const got = list.filter(f => AUD.buf[f]);
+    /* A take that arrives after the bubble it belonged to has gone is worse than
+       silence — it talks over the next one. Past the deadline, drop it; the
+       buffer stays decoded so the same line is instant if it comes round again. */
+    if(!got.length || performance.now() - t0 > 6000){
+      if(!got.length && typeof onMiss === 'function') onMiss();
+      return;
+    }
+    voTouch(got);
+    try{ if(sfx(slot, wx, wy, 1, idx) === false && typeof onMiss === 'function') onMiss(); }
+    catch(e){ if(typeof onMiss === 'function') onMiss(); }
+  });
+  return true;
 }
 /* Called when a match starts: pull the one faction the player will actually
    hear, rather than paying for all four. */
@@ -265,7 +367,16 @@ async function initAudioSamples(){
   const sfxFirst = names.filter(n => !n.startsWith('mus_'));
   const music = names.filter(n => n.startsWith('mus_'));
   await Promise.all(sfxFirst.map(audLoad));
-  AUD.ready = Object.keys(AUD.buf).length > 0;
+  /* THE SFX BANK AND THE VOICE BANK SHIP SEPARATELY, so the engine must not be
+     declared dead when only one of them arrived. assets/audio/sfx.json and its
+     clips are not in this repo (see AUD_MAP's floor above); the voice bank is.
+     Gating readiness on "at least one SFX buffer decoded" therefore left
+     sfxSample() returning false on its very first line for every caller — and
+     voice runs through sfxSample, so a build with a complete voice bank sitting
+     on disk still spoke nothing at all. A decoded-on-demand voice bank is a
+     usable sample engine; slots with no file behind them still decline
+     individually at audPick(). */
+  AUD.ready = Object.keys(AUD.buf).length > 0 || !!(VOICE_BANK && VOICE_BANK.lines);
   await audLoadPlaylists();
   /* The title/menu has no match state, so it cannot wait for combat's frame
      intensity to start the first track. Once a user gesture created the audio
@@ -277,9 +388,19 @@ async function initAudioSamples(){
   if(!audPlaylistFor()) music.forEach(audLoad);
 }
 
-function audPick(name){
+/* `pickIdx` selects a SPECIFIC take instead of a random one. radioAck prints one
+   of three lines and then asked for a random recording of the three, so the
+   printed line and the spoken line disagreed about two times in three. Every
+   existing caller passes nothing and keeps the random behaviour byte for byte. */
+function audPick(name, pickIdx){
   const list = AUD_MAP[name];
   if(!list) return null;
+  /* Indexed against the FULL list, not the decoded subset — indexing the subset
+     would silently shift which line you hear as buffers come and go. */
+  if(typeof pickIdx === 'number' && pickIdx >= 0){
+    const want = list[(pickIdx | 0) % list.length];
+    if(AUD.buf[want]) return AUD.buf[want];
+  }
   const avail = list.filter(f => AUD.buf[f]);
   if(!avail.length) return null;
   return AUD.buf[avail[(Math.random() * avail.length) | 0]];
@@ -302,19 +423,48 @@ function audMakeRoom(priority){
   try{ low.src.stop(); }catch(e){}
   return true;
 }
+function audVoiceChannel(name){
+  if(name.lastIndexOf('vo_',0)!==0) return null;
+  return name.lastIndexOf('vo_keen_',0)===0 ? 'keen' : 'radio';
+}
+/* TWO VOICE CHANNELS, each still capped at one.
+
+   The cap was originally per-NAME, so three different vo_ lines could play at
+   once — a burst of orders fired select, move and attack acks simultaneously and
+   the result was unintelligible. Collapsing every vo_ line onto a single channel
+   fixed that and created a worse bug: KEEN's narration is 3-15 seconds long and
+   unit acks fire on every order the tutorial is asking the player to perform, so
+   the tutorial voice lost that race by construction — and lost it SILENTLY,
+   because sfxSample treats a full slot as handled and returns true, which
+   suppresses the fallback too.
+
+   KEEN is a different character on a different net. Unit radio can no longer
+   block her and she can no longer block it; neither can stack on itself. */
 function audSlotHasRoom(name){
   const cap=AUD_CAP[name]||3;
+  const ch=audVoiceChannel(name);
   let n=0;
-  /* RADIO IS ONE CHANNEL. The cap was per-NAME, so three different vo_ lines
-     could play at once — a burst of orders fired select, move and attack acks
-     simultaneously and the result was unintelligible. Any vo_ voice now blocks
-     every other vo_ voice; sfxSample treats a full slot as handled, so the
-     extra line is dropped rather than queued or errored. */
-  const vo=name.lastIndexOf('vo_',0)===0;
-  for(const v of AUD.active)
-    if(!v.done&&(vo?v.name.lastIndexOf('vo_',0)===0:v.name===name)&&++n>=(vo?1:cap)) return false;
+  for(const v of AUD.active){
+    if(v.done) continue;
+    const hit = ch ? (audVoiceChannel(v.name)===ch) : (v.name===name);
+    if(hit && ++n >= (ch?1:cap)) return false;
+  }
   return true;
 }
+/* A narrator interrupts herself; she does not queue. The KEEN channel holds one
+   line, her lines run up to 15 seconds, and the bubble advances every 2.4-6.5 s,
+   so without this the second and every subsequent line of a run is dropped and
+   the player watches text they never hear. The fallback path does exactly this
+   already — speakVoiceFallback calls speechSynthesis.cancel() first. Unit radio
+   keeps the old drop behaviour: a formation drag must not machine-gun acks. */
+function audVoiceYield(name){
+  if(audVoiceChannel(name)!=='keen') return;
+  for(const v of AUD.active.slice()){
+    if(v.done||audVoiceChannel(v.name)!=='keen') continue;
+    audRetireVoice(v);
+    try{ v.src.stop(); }catch(e){}
+  }
+}
 function audMusicGain(v){
   return v*audMusicLevel()*(performance.now()<AUD.duckUntil?0.58:1);
 }
@@ -397,9 +547,9 @@ function artilleryWorldAudio(kind,wx,wy,team,scale){
 }
 
 /* The replacement for hud.js's sfx(). Same signature, same call sites. */
-function sfxSample(name, wx, wy, scale){
+function sfxSample(name, wx, wy, scale, pickIdx){
   if(!AC || muted || (typeof sfxOn!=='undefined'&&!sfxOn) || !AUD.ready) return false;
-  const buf = audPick(name);
+  const buf = audPick(name, pickIdx);
   if(!buf) return false;
 
   const mix = AUD_MIX[name] || {g:0.6, gap:40, p:2};
@@ -411,6 +561,7 @@ function sfxSample(name, wx, wy, scale){
   const pan=spatial.pan,dist=spatial.gain;
   /* Cull in world space before touching the voice pool. An off-screen alarm
      must not evict an on-screen cannon simply because alarms have priority. */
+  audVoiceYield(name);
   if(!audSlotHasRoom(name)) return true;
   if(!audMakeRoom(mix.p||2)) return true;
   AUD.lastAt[name] = now;
@@ -446,7 +597,14 @@ function sfxSample(name, wx, wy, scale){
   AUD.active.push(voice); AUD.voices++;
   src.onended = () => { audRetireVoice(voice); };
   try{ src.start(); }catch(e){ audRetireVoice(voice); return false; }
-  if(AUD_DUCK.has(name)) AUD.duckUntil=Math.max(AUD.duckUntil,now+650);
+  /* 650 ms is right for an explosion and wrong for speech: a KEEN line runs 3-15
+     seconds, so the music came back up over the top of her within the first
+     sentence. A voice line holds the duck open for as long as it is actually
+     talking, measured from the decoded buffer rather than assumed. */
+  if(AUD_DUCK.has(name)){
+    const hold = (name.lastIndexOf('vo_',0)===0 && buf.duration) ? buf.duration*1000+240 : 650;
+    AUD.duckUntil=Math.max(AUD.duckUntil,now+hold);
+  }
   return true;
 }
 
@@ -490,8 +648,14 @@ function audMusicTick(dt){
     g.gain.setTargetAtTime(1, AC.currentTime, 1.6);
     audMusSrc = s; audMusName = want;
   }
+  /* Same duck arithmetic as audPlaylistTick: at tau = 0.8 s the bus travels only
+     a fraction of the way to the ducked target before the duck expires, so the
+     dip never reaches the depth AUD_DUCK's 0.58 asks for. Fast attack while
+     ducked, slow release after — otherwise nothing cuts through the bed and the
+     bundled-bed build stays exactly as deaf as before. */
   const target = audMusicGain(0.30 + (typeof musicInt === 'number' ? musicInt : 0) * 0.16);
-  audMusBus.gain.setTargetAtTime(target, AC.currentTime, 0.8);
+  audMusBus.gain.setTargetAtTime(target, AC.currentTime,
+    performance.now() < AUD.duckUntil ? 0.06 : 0.8);
 }
 
 /* ---- TAKEOVER --------------------------------------------------------------
@@ -528,12 +692,18 @@ function initSampleAudio(){
     },{passive:true});
   }
 
-  sfx = function(name, wx, wy, scale){
+  sfx = function(name, wx, wy, scale, pickIdx){
     /* The shipped bank is dual-codec, so every supported device has a sample
        path. Do not expose the old oscillator/chiptune bank while decoding or
        for a missing slot: a brief silence is preferable to retro arcade audio
-       in a cinematic RTS mix. Keep the binding only for legacy diagnostics. */
-    sfxSample(name, wx, wy, scale);
+       in a cinematic RTS mix. Keep the binding only for legacy diagnostics.
+
+       RETURN THE RESULT. Dropping it made sfx() yield undefined for every
+       caller, and voPlay's `sfx(...) !== false` was therefore unconditionally
+       true — a declined or impossible voice line reported success and
+       suppressed its own fallback. voPlay is the only call site in the tree
+       that reads this value, so returning it changes nothing else. */
+    return sfxSample(name, wx, wy, scale, pickIdx);
   };
 
   if(synthMusic){

src/authportal.js

@@ -196,9 +196,18 @@ function apErrorText(e){
 
 /* ---- account actions ---------------------------------------------------------- */
 function apSetSessionFrom(data, email){
-  AP_SESSION = { token: data.token, email: (data.user && data.user.email) || email,
-                 username: (data.user && data.user.username) || null,
-                 ageOk: !!(data.user && data.user.ageOk),
+  const u = data.user || null;
+  AP_SESSION = { token: data.token, email: (u && u.email) || email,
+                 username: (u && u.username) || null,
+                 /* A MISSING ageOk means the server did not say — not that the
+                    player answered and failed. Coercing absence to false is why
+                    a perfectly good signed-in account meets the ONE-TIME AGE
+                    CHECK panel on every single sign-in, and the CONFIRM button
+                    behind it posts to a route the deployed worker does not
+                    have. Only `false` should nag; `null` is "unknown, carry on".
+                    Line 256 already gets this right with an `in` test — the two
+                    paths into the same field disagreed. */
+                 ageOk: (u && 'ageOk' in u) ? !!u.ageOk : null,
                  expiresAt: data.expiresAt || 0 };
   AP_SYNC_KIND = 'idle';
   AP_SYNC_MESSAGE = '';

src/engine/terrain.js

@@ -32,6 +32,18 @@ let waterMesh=null, waterVAO=null, waterVBO=null, waterIBO=null, waterIdxCount=0
    pathfinding, fog sensors, placement or deformation. */
 const TERR_EDGE_EXT=960;
 let terrEdgeVAO=null, terrEdgeVBO=null, terrEdgeIBO=null, terrEdgeIdxCount=0;
+/* CONTEXT-LOSS RESET. Every builder above caches its VAO/VBO in a module
+   variable and takes an if(!vao) create-else-update branch. After a context
+   loss those handles still LOOK truthy but point at dead GL objects, so the
+   rebuild path poured fresh vertices into dead buffers and the ground simply
+   never drew again - the exact match-killing symptom on device: units,
+   structures and boundary intact, terrain a flat fog-coloured void. Recovery
+   must forget the handles so the builders genuinely re-create. */
+function terrainGLReset(){
+  terrVAO=terrVBO=terrIBO=null;
+  terrEdgeVAO=terrEdgeVBO=terrEdgeIBO=null;
+  waterVAO=waterVBO=waterIBO=null;
+}
 
 /* World height in world units. Bilinear so slopes are smooth and the camera
    ray-march in s2w() converges instead of stair-stepping. */

src/game/meta.js

@@ -835,7 +835,7 @@ function mfSetTabs(root,key,focus){
      deployment plan in sync with the Weekly contract being inspected. */
   try{ root.dispatchEvent(new CustomEvent('mftabchange',{detail:{key:active,focus:!!focus}})); }catch(e){}
   if(focus){
-    const scroller=root.querySelector('.settingsScroll,.profileScroll,.opsScroll,.dailyScroll');
+    const scroller=root.querySelector('.settingsScroll,.profileScroll,.opsScroll,.dailyScroll,.inboxScroll');
     if(scroller) scroller.scrollTop=0;
     const b=tabs.find(x=>x.dataset.mfTab===active);
     if(b) try{ b.focus({preventScroll:true}); }catch(e){ b.focus(); }
@@ -1051,8 +1051,8 @@ function renderSettings(){
      +cyc('menubg','Menu Backdrop',BGD[bg],BGL[bg],bg!=='off'));
 
   h+=group('command','COMMAND INTERFACE','Planning aids for formations, platoons, and patrol routes.',
-      tog('formationPreview','Formation Holograms','Show one placement marker for every selected unit before issuing a formation order')
-     +tog('orderPaths','Waypoint & Patrol Cues','Show numbered nodes, direction pulses, and committed patrol loops'));
+      tog('formationPreview','Formation Preview','Outline where the platoon will end up, on every move order, before it commits')
+     +tog('orderPaths','Route Arrows & Patrol Cues','Flashing arrows along the real pathfinding route, plus numbered waypoints and committed patrol loops'));
   h+='<section class="setGroup mfTabPanel" id="setExtras" role="tabpanel" aria-labelledby="setTab-system" data-mf-panel="system"><div class="setGroupHd">SERVICES & ACCESSIBILITY</div>'
     +'<div class="setGroupDs">Tutorial, offline, connectivity, and optional world systems.</div><div id="setExtraRows"></div><div class="setEmpty">No additional services are configured.</div></section>';
   list.innerHTML=h;

src/glrecover.js

@@ -54,6 +54,13 @@ function glrQualityDown(){
    or stack a second set of deposits on top of the first. */
 function glrRebuildResources(){
   const step=(name,fn)=>{ try{ fn(); }catch(e){ console.warn('glrecover: '+name+' failed',e); throw e; } };
+  /* FORGET THE DEAD HANDLES FIRST. Builders that cache their VAO/texture in a
+     module variable branch on if(!handle) - after a loss the handle is truthy
+     but dead, so without this the terrain rebuild poured vertices into dead
+     buffers and the ground stayed a fog-coloured void for the rest of the
+     match (seen on device at 11:37: units and structures back, terrain gone). */
+  step('terrainGLReset',()=>{ if(typeof terrainGLReset==='function') terrainGLReset(); });
+  step('fogGLReset',    ()=>{ if(typeof fogGLReset==='function') fogGLReset(); });
   step('initGL3D',      ()=>initGL3D());
   step('buildMatAtlas', ()=>buildMatAtlas());
   step('initBillboards',()=>{ if(typeof initBillboards==='function') initBillboards(); });

src/main.js

@@ -303,11 +303,15 @@ function newSkirmish(){
   const pxs=PS.x, pys=PS.y;
   matchLive=false;
   carrier.active=true; carrier.phase=0; carrier.alt=980; carrier.clearance=0;
-  /* Nova is the current playable army. The query override is deliberately QA-
-     only so every registered deployer can be inspected without implying that a
-     not-yet-playable faction has been selected in progression. */
+  /* The drop is the FIRST thing anyone sees of their own army, and it was
+     always Nova — "Nova is the current playable army" stopped being true once
+     the faction picker went into battle setup. It now arrives in the colours
+     and hardware of whatever the player actually chose. The query override
+     stays, ahead of the choice, so QA can still inspect any registered
+     deployer without touching progression. */
   const carrierFacQa=(location.search.match(/[?&]carrierfac=(nova|terran|frontline|federation|legion|ascendancy|red|syndicate|machine|coalition|horde|brood|swarm|infestation)/)||[])[1]||'';
-  carrier.fac=typeof dropFactionKey==='function'?dropFactionKey(carrierFacQa||'nova'):'nova';
+  const carrierFacOwn=(typeof playerKitKey==='function')?playerKitKey():'nova';
+  carrier.fac=typeof dropFactionKey==='function'?dropFactionKey(carrierFacQa||carrierFacOwn):'nova';
   carrier.x=pxs; carrier.y=pys; carrier.tx=pxs; carrier.ty=pys; carrier.ang=0; carrier.dust=0;
   // AI start (mirrored)
   /* The enemy fields its FACTION'S hero, not a mirror of yours. The Legion
@@ -319,6 +323,10 @@ function newSkirmish(){
      avoids keeping three unused structure libraries resident on phones. */
   if(typeof ensureBldFactionMeshes==='function'){
     ensureBldFactionMeshes(AI.fac);
+    /* The player's own architecture too. bldMeshFor() would fault it in lazily,
+       but that lands on the frame the first structure finishes rather than
+       here in the carrier phase where an allocation is invisible. */
+    if(typeof playerKitKey==='function') ensureBldFactionMeshes(playerKitKey());
     /* Neutral nests use Horde architecture even when another faction owns the
        enemy base. Upload it during the carrier/deployment phase, where a short
        allocation is invisible, instead of hitching the first frame a nest
@@ -420,7 +428,15 @@ function deployCarrier(){
      down yourself, and it should be yours from the first structure. The HQ
      generates enough on its own to fund that first move. */
   const hq=addBld('hq',0,cx2,cy2,true);
-  heroIdx=spawnUnit(4,0,cx2+52,cy2+44);
+  /* You field YOUR faction's hero, the same way the enemy fields theirs. The
+     Dominion walks Lord Darion Vex, the Syndicate a shielded hover platform,
+     the Brood its Sovereign — and Nova keeps the Commander. Until now only the
+     AI got this, so choosing a faction changed who you fought as everywhere
+     except the one unit you spend the whole match looking at.
+     No hero builds anything — `builder:1` belongs to the Constructor, which
+     lands beside you regardless — so this swaps a fighter, not an economy. */
+  const PH=(typeof FACTIONS!=='undefined'&&FACTIONS[playerFaction])||null;
+  heroIdx=spawnUnit(PH&&PH.hero!=null?PH.hero:4,0,cx2+52,cy2+44);
   spawnUnit(UT_ENGINEER,0,cx2-52,cy2+44);
   AI.base.x=AI.base.x; // (AI base already placed)
   matchLive=true; stats.t=0; matchClock=timeLimit;
@@ -980,6 +996,12 @@ function nativeLayerVisible(id){
 function nativeBackTap(id){
   const el=$(id);if(!el)return false;
   if(typeof MF_POINTER_COMMIT!=='undefined') MF_POINTER_COMMIT=-1e9;
+  /* Blur FIRST. Android Back used to navigate straight out of a screen with a
+     text field still focused, so the field's commit handler never ran and
+     whatever had been typed was discarded — silently, which is the worst way to
+     lose a name someone chose. */
+  const a=document.activeElement;
+  if(a&&a!==document.body&&typeof a.blur==='function') a.blur();
   el.click();
   return true;
 }
@@ -1251,10 +1273,18 @@ function wire(){
   mfBindTap($('profBack'),()=>{
     renderMetaHead(); sfx('ui'); showFrontScreen('startScreen');
   });
-  $('profName').addEventListener('change',()=>{
+  /* `change` alone loses the name. On a phone the field is committed by the
+     player leaving the screen, and the two ways they actually do that — the
+     hardware Back button, and a tap on BACK that fires from pointerdown before
+     the input has blurred — neither produces a `change` event. So a commander
+     typed their name, went back, and the game had forgotten it. Commit on
+     `blur` as well, and see nativeBackTap() for the other half. */
+  const profNameCommit=()=>{
     const P=activeProf(), v=$('profName').value.trim();
-    if(v){ P.name=v.slice(0,14); profSave(); renderMetaHead(); renderProfile(); }
-  });
+    if(v&&P&&P.name!==v.slice(0,14)){ P.name=v.slice(0,14); profSave(); renderMetaHead(); renderProfile(); }
+  };
+  $('profName').addEventListener('change',profNameCommit);
+  $('profName').addEventListener('blur',profNameCommit);
   $('profNew').addEventListener('pointerdown',()=>{
     if(PROFILES.list.length>=6){ toast('Profile limit reached (6)'); return; }
     const id='p'+(++PROFILES.seq);
@@ -1464,7 +1494,14 @@ function boot(){
     if(used.has(A.zone)) A.zone=START_ZONES.find(z=>!used.has(z.id)).id;
     used.add(A.zone);
   }
-  if(su.pf&&typeof FACTIONS!=='undefined'&&FACTIONS[su.pf]) playerFaction=su.pf;
+  /* Validate against the PICKER's own list, not against FACTIONS. FACTIONS has
+     no 'nova' entry — it is the enemy roster — so validating a saved player
+     faction against it silently rejects the one everybody starts on. It happens
+     to land on 'nova' anyway because that is the declared default, which is
+     exactly the kind of accident that stops being true the moment the default
+     moves. */
+  if(su.pf&&typeof playableFactions==='function'&&playableFactions().includes(su.pf)) playerFaction=su.pf;
+  else if(su.pf&&typeof FACTIONS!=='undefined'&&FACTIONS[su.pf]) playerFaction=su.pf;
   if(su.df!=null) defenseFocus=su.df?1:0;
   difficulty=Math.max(...activeAiSlots().map(A=>A.diff));
   document.querySelectorAll('.glbtn').forEach(b=>b.classList.toggle('on',b.dataset.g===goalSel));
@@ -1512,24 +1549,12 @@ function boot(){
   const showScr=id=>{ showFrontScreen(id); sfx('ui'); };
   mfBindTap($('dailyBtn'),()=>{ renderDaily(); showScr('dailyScr'); });
   mfBindTap($('dailyBack'),()=>{ showFrontScreen('startScreen'); renderMetaHead(); sfx('ui'); });
+  /* One purpose, so no tab row: the Dossier is the faction codex. Dispatches
+     moved to the mailbox whole, sealed entries included (see renderInbox). */
   mfBindTap($('dossierBtn'),()=>{
-    renderDossier();
     if(typeof renderCodex==='function') renderCodex();
     showScr('dossierScr');
   });
-  /* Dispatches and Factions share one screen; two panes, one tab row. */
-  document.querySelectorAll('#dossTabs .tabBtn').forEach(b=>{
-    mfBindTap(b,()=>{
-      document.querySelectorAll('#dossTabs .tabBtn').forEach(x=>x.classList.remove('on'));
-      b.classList.add('on');
-      const fac=b.dataset.dt==='fac';
-      const d=$('dossPaneDisp'), c=$('codexList');
-      if(d) d.style.display=fac?'none':'';
-      if(c) c.style.display=fac?'':'none';
-      const s=$('dossScroll'); if(s) s.scrollTop=0;
-      sfx('ui');
-    });
-  });
   mfBindTap($('opsBtn'),()=>{ renderOps(); showScr('opsScr'); });
   mfBindTap($('devBtn'),()=>{ renderDevelop(); showScr('devScr'); });
   mfBindTap($('devBack'),()=>{ showFrontScreen('startScreen'); renderMetaHead(); sfx('ui'); });
@@ -1542,8 +1567,17 @@ function boot(){
   if(wkB) wkB.addEventListener('pointerdown',()=>{ renderOps(); showScr('opsScr');
     setTimeout(()=>{ const w=$('weeklyBox'); if(w) w.scrollIntoView({behavior:'smooth',block:'center'}); },120); });
   mfBindTap($('dossBack'),()=>{ showFrontScreen('startScreen'); sfx('ui'); });
+  /* Dismissing a dispatch marks it read, but nothing used to re-render the list
+     underneath — the corner badge cleared while the row it came from still
+     showed a green dot and NEW until you left the screen and came back. Redraw
+     the mailbox on dismiss (never from inside showDispatch, which would rebuild
+     the list under a live modal). handleNativeBack routes #dispatch here too,
+     so hardware Back gets the same fix. */
   mfBindTap($('dispOk'),()=>{ $('dispatch').style.display='none';
-    if(typeof storyRefreshBadge==='function') storyRefreshBadge(); sfx('ui'); });
+    if(typeof storyRefreshBadge==='function') storyRefreshBadge();
+    const ib=$('inboxScr');
+    if(ib&&ib.style.display!=='none'&&typeof renderInbox==='function') renderInbox();
+    sfx('ui'); });
   /* New subsystems. Each lives in its own module and registers its own UI, so
      none of them need to touch index.html or this file beyond this line. */
   for(const fn of ['initOffline','initSampleAudio','initAssetPacks','initAuthPortal','initTutorial','initAdBoards','initStoreUI','initResTree3D','initEconomyNet','initIntro'])

src/storeui.js

@@ -374,8 +374,14 @@ renderArmory=function(){
     ev.stopPropagation(); armTab='inventory'; sfx('ui'); renderArmory(); list.scrollTop=0;
   }));
 
+  /* SPENDING ON FINGER-DOWN. These two were raw `pointerdown` handlers inside a
+     `touch-action:pan-y` list, so the act of SCROLLING the Armory bought
+     whatever was under your thumb — up to 1600 cores gone before the finger had
+     moved far enough for the browser to call it a scroll. mfBindTap already
+     exists for exactly this: it waits for the release and cancels past a 12px
+     drag. The cart is the structural fix; this is the bleeding one. */
   list.querySelectorAll('.armIt').forEach(el=>{
-    el.addEventListener('pointerdown',()=>{
+    mfBindTap(el,()=>{
       const it=STORE.find(s=>s.id===el.dataset.id); if(!it) return;
       const t=META.owned[it.id]||0;
       if(t>=it.max){ toast(it.nm+' is fully upgraded'); return; }
@@ -388,7 +394,7 @@ renderArmory=function(){
   });
 
   list.querySelectorAll('.swatch').forEach(el=>{
-    el.addEventListener('pointerdown',()=>{
+    mfBindTap(el,()=>{
       const key=el.dataset.col, C=COLORS[key];
       const owned=key==='azure'||META.owned['col_'+key];
       if(!owned){

src/story.js

@@ -207,28 +207,52 @@ function storyPending(){
 }
 function storyMarkSeen(i){ storySeen()['d'+i]=1; metaSave(); storyRefreshBadge(); }
 
-/* Dispatches belong in the Dossier, not in a compulsory modal queue. The old
+/* Dispatches belong in the mailbox, not in a compulsory modal queue. The old
    post-match flow reopened the next unlocked dispatch 260 ms after every
    ACKNOWLEDGE. On devices where the card failed to composite, its fixed
    full-screen backdrop was invisible but still intercepted every menu tap.
    A visible badge and one toast preserve the narrative reward without ever
    taking control away from the player. */
-function storyRefreshBadge(){
-  const pending=!!storyPending();
-  const unread=storyUnreadCount();
-  const b=document.getElementById('dossierBtn');
-  if(b){
-    b.classList.toggle('pendingDispatch',pending);
-    b.setAttribute('aria-label',pending?'Dossier, new dispatch available':'Dossier');
+/* One number for the mailbox dot. Anything else that becomes unread mail —
+   release notes, friend requests — adds its term HERE and nowhere else, so no
+   two features ever have to edit the same line of storyRefreshBadge(). */
+function inboxUnreadCount(){ return storyUnreadCount()+inboxUnreadUpdates(); }
+/* The UPDATES tab has no count element: index.html only gave one to DISPATCHES.
+   Create it once here rather than asking for a shell edit — an OTA bundle is
+   scripts only (boot.js replaces sources, never index.html or the stylesheet),
+   so a badge that lives in the markup can never reach a device that has already
+   shipped, and one built in JS can. Same class as the dispatch badge, so it
+   inherits the styling that is already on disk. */
+function inboxUpdTabCount(){
+  const t=document.getElementById('inboxTab-updates'); if(!t) return null;
+  let c=t.querySelector('.tabCount');
+  if(!c){
+    c=document.createElement('span');
+    c.className='tabCount'; c.id='inboxUpdTabCount';
+    c.setAttribute('aria-hidden','true');
+    t.appendChild(c);
   }
-  /* The Inbox is the notification surface now, so it carries the dot. A toast
-     that fires while the player is mid-match is a notification you can miss;
-     a badge is not. */
+  return c;
+}
+function storyRefreshBadge(){
+  /* The mailbox is the notification surface — the Dossier no longer carries a
+     dispatch badge because it no longer carries dispatches. A toast that fires
+     while the player is mid-match is a notification you can miss; a badge is
+     not. */
+  const unread=inboxUnreadCount();
   for(const id of ['inboxBtn','inboxHudBtn']){
     const i=document.getElementById(id); if(!i) continue;
     i.classList.toggle('pendingDispatch',unread>0);
-    i.setAttribute('aria-label',unread?('Inbox, '+unread+' unread transmission'+(unread>1?'s':'')):'Inbox');
+    i.setAttribute('aria-label',unread?('Mailbox, '+unread+' unread transmission'+(unread>1?'s':'')):'Mailbox');
   }
+  /* Per-tab counts name only their own pane. The tile above is the whole
+     mailbox so it carries the sum, but a DISPATCHES badge reading 13 over a
+     list of 12 dispatches and one release note is simply wrong — a badge has to
+     agree with what is under it. */
+  const setCount=(el,n)=>{ if(!el) return;
+    el.textContent=n>99?'99+':String(n); el.classList.toggle('on',n>0); };
+  setCount(document.getElementById('inboxTabCount'),storyUnreadCount());
+  setCount(inboxUpdTabCount(),inboxUnreadUpdates());
 }
 /* Unlocked and not yet read. storyPending() stops at the first LOCKED dispatch
    because the arc is strictly sequential; the badge wants the true unread count
@@ -239,10 +263,19 @@ function storyUnreadCount(){
   return n;
 }
 
-/* ---------- INBOX ----------
-   Everything addressed to the player, in one place. Dispatches are live today;
-   friend requests and messages declare themselves as pending so the screen does
-   not silently change shape when social ships. */
+/* The unlock condition, in the player's words. The mailbox archive is the only
+   caller now that the Dossier is a faction codex and nothing else. */
+function storyLockHint(d){
+  const r=RANKS[d.r];
+  return 'Reach '+r.em+' '+r.nm+(d.trig&&d.hint? '  ·  '+d.hint : '');
+}
+
+/* ---------- MAILBOX ----------
+   Everything addressed to the player, in one place, including the sealed tail
+   of the arc. The mailbox owns dispatches outright: the whole 27-entry archive
+   lives here, unread first, then read, then the CLASSIFIED entries the player
+   has not earned yet. Friend requests and messages declare themselves as
+   pending so the screen does not silently change shape when social ships. */
 function renderInbox(){
   const g=document.getElementById('inboxDispatches');
   if(g){
@@ -250,20 +283,38 @@ function renderInbox(){
     const rows=[];
     for(let i=0;i<STORY.length;i++){
       const d=STORY[i], readable=storyUnlocked(i), read=!!seen['d'+i];
-      if(!readable && !read) continue;                 // locked: it lives in the Dossier
-      rows.push({i,d,read});
+      rows.push({i,d,read,locked:!readable&&!read});
     }
-    rows.sort((a,b)=>(a.read?1:0)-(b.read?1:0) || b.i-a.i);   // unread first, newest first
-    g.innerHTML = rows.length
-      ? rows.map(r=>'<button type="button" class="inboxItem'+(r.read?'':' unread')+'" data-i="'+r.i+'">'
-          +'<span class="inboxDot" aria-hidden="true"></span>'
-          +'<span class="inboxTx"><b>'+r.d.ttl+'</b><span>'+r.d.from+'</span></span>'
-          +'<span class="inboxMeta">'+(r.read?'READ':'NEW')+'</span></button>').join('')
-      : '<div class="inboxEmpty">No transmissions yet. Rank up to receive your first orders.</div>';
-    g.querySelectorAll('.inboxItem').forEach(el=>{
+    /* Unread OLDEST first: this arc is authored sequentially (see the header of
+       this file) and the old `b.i-a.i` served the newest unread first, so a
+       player who banked four dispatches read the war backwards. Read mail is
+       newest-first like any mailbox; the sealed archive keeps canonical order. */
+    const bucket=r=>r.locked?2:r.read?1:0;
+    rows.sort((a,b)=>bucket(a)-bucket(b) || (bucket(a)===1 ? b.i-a.i : a.i-b.i));
+    g.innerHTML=rows.map(r=>r.locked
+      ? '<div class="inboxItem inboxLog locked">'
+        +'<span class="inboxDot" aria-hidden="true"></span>'
+        +'<span class="inboxTx"><b>CLASSIFIED</b><span>'+storyLockHint(r.d)+'</span></span>'
+        +'<span class="inboxMeta">🔒</span></div>'
+      : '<button type="button" class="inboxItem'+(r.read?'':' unread')+'" data-i="'+r.i+'">'
+        +'<span class="inboxDot" aria-hidden="true"></span>'
+        +'<span class="inboxTx"><b>'+r.d.ttl+'</b><span>'+r.d.from+'</span></span>'
+        +'<span class="inboxMeta">'+(r.read?'READ':'NEW')+'</span></button>').join('');
+    /* Locked rows carry no data-i and must not bind — a sealed dispatch is not
+       a tap target. */
+    g.querySelectorAll('.inboxItem[data-i]').forEach(el=>{
       const go=()=>{ showDispatch(STORY[+el.dataset.i]); };
       if(typeof mfBindTap==='function') mfBindTap(el,go); else el.addEventListener('pointerdown',go);
     });
+    /* Replaces the unreachable "No transmissions yet" empty state — three
+       dispatches are already unlocked at rank 0, so that string never showed.
+       This carries the progression the Dossier used to own. */
+    const hd=document.getElementById('inboxDispHead');
+    if(hd){
+      const open=rows.filter(r=>!r.locked).length, unread=storyUnreadCount();
+      hd.textContent='📡 '+open+' of '+STORY.length+' declassified'
+        +(unread? '  ·  '+unread+' unread' : '');
+    }
   }
   const f=document.getElementById('inboxFriends');
   if(f) f.innerHTML='<div class="inboxEmpty">Friend requests arrive here once the friends update ships.</div>';
@@ -272,29 +323,79 @@ function renderInbox(){
   renderInboxUpdates();
   renderInboxNews();
   storyRefreshBadge();
+  /* mfBindTabs is idempotent — it guards every button with dataset.mfTapBound
+     and the root with dataset.mfTabsBound — so re-binding on every open is safe
+     and keeps working if the shell was replaced by an OTA patch. */
+  if(typeof mfBindTabs==='function') mfBindTabs(document.getElementById('inboxScr'),'dispatches');
 }
 /* The update history this device actually received — written by initUpdater as
-   each patch starts for the first time. A local log rather than a changelog
-   fetched from the server, so it stays truthful offline and after a rollback. */
+   each release starts for the first time. A local log rather than a changelog
+   fetched from the server, so it stays truthful offline and after a rollback.
+
+   Every row is a real mail item, not a caption. The notes body runs to ~900
+   characters and .inboxTx span clamps to one ellipsised line, so a row that
+   could not be opened was a release log you could see and not read. */
+function updateLogRows(){ return (typeof updLogRead==='function')? updLogRead() : []; }
+/* Strictly `read===false`, never `!read`. Entries written before this feature
+   existed carry no read flag at all, and treating those as unread would greet
+   every upgrading player with a badge full of releases they installed months
+   ago. An entry that was never announced is history, not news; only the writer
+   that can announce one marks it. */
+function inboxUnreadUpdates(){ return updateLogRows().filter(e=>e.read===false).length; }
 function renderInboxUpdates(){
   const g=document.getElementById('inboxUpdates'); if(!g) return;
-  let log=[];
-  try{ log=JSON.parse(localStorage.getItem('mf_update_log')||'[]'); }catch(e){ log=[]; }
+  /* Notes are publisher copy, not player input, but they land in innerHTML and
+     an unescaped & or < in a changelog would silently eat the rest of a row. */
+  const esc=s=>String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;');
+  /* The version actually running: on a patched build the bundle carries its own
+     updater.js with the bumped APP_VERSION, and after a rollback APP_VERSION is
+     once again what is executing. Both true, so this needs no patch state. */
   const cur=(typeof APP_VERSION!=='undefined'&&APP_VERSION)||'';
-  if(!log.length){
+  const rows=updateLogRows();
+  if(!rows.length){
     g.innerHTML='<div class="inboxEmpty">No updates installed on this device yet'
       +(cur?' — running v'+cur:'')+'.</div>';
     return;
   }
-  g.innerHTML=log.slice(0,12).map(e=>{
+  /* No slice: the log is already capped at 40 by updLogPost, and rendering a
+     shorter window than the badge counts would put a number on the tab that
+     nothing under it explains. */
+  g.innerHTML=rows.map((e,i)=>{
     const d=new Date(e.at||0);
-    const when=isNaN(d.getTime())?'':d.toLocaleDateString(undefined,{month:'short',day:'numeric'});
-    return '<div class="inboxItem inboxLog">'
+    const when=(!e.at||isNaN(d.getTime()))?''
+      :d.toLocaleDateString(undefined,{month:'short',day:'numeric'});
+    /* Reverted beats running: a rolled-back entry cannot also be what is on the
+       device, and initUpdater clears the mark if that version is ever applied
+       again. */
+    const tag=e.rolledBack?' · reverted':(String(e.version)===cur?' · running now':'');
+    const isNew=e.read===false;          // see inboxUnreadUpdates
+    return '<button type="button" class="inboxItem inboxUpd'+(isNew?' unread':'')+'" data-u="'+i+'">'
       +'<span class="inboxDot" aria-hidden="true"></span>'
-      +'<span class="inboxTx"><b>v'+e.version+(e.version===cur?' · running now':'')+'</b>'
-      +'<span>'+(e.notes? String(e.notes).replace(/</g,'&lt;') : 'Update installed')+'</span></span>'
-      +'<span class="inboxMeta">'+when+'</span></div>';
+      +'<span class="inboxTx"><b>v'+esc(e.version)+tag+'</b>'
+      +'<span>'+esc(e.notes||'Update installed')+'</span></span>'
+      +'<span class="inboxMeta">'+(isNew?'NEW':when)+'</span></button>';
   }).join('');
+  g.querySelectorAll('.inboxUpd').forEach(el=>{
+    const go=()=>inboxOpenUpdate(rows[+el.dataset.u]);
+    if(typeof mfBindTap==='function') mfBindTap(el,go); else el.addEventListener('pointerdown',go);
+  });
+}
+/* A release note is mail, so it opens the same transmission card the dispatches
+   use — that card scrolls, which is the only thing on this screen that can show
+   900 characters. The list underneath is deliberately NOT repainted here: the
+   dismiss handler in main.js already redraws the mailbox, and rebuilding a list
+   under a live modal is what that handler exists to avoid. */
+function inboxOpenUpdate(e){
+  if(!e) return;
+  if(typeof updLogMark==='function') updLogMark(e.version,{read:true});
+  e.read=true;
+  /* from/ttl are FIXED strings and never the notes body: storySpeakerVisual and
+     storyTransmissionVisual keyword-match those two fields, and a changelog that
+     happens to mention the Syndicate must not arrive spoken by Broker Renn. */
+  showDispatch({ttl:'BUILD v'+e.version, idx:'RELEASE NOTES',
+    from:'MASSFRONT RELEASE CHANNEL · BROADCAST',
+    txt:e.notes||'This build was installed on this device.'});
+  storyRefreshBadge();
 }
 /* Newsletters are optional and served from the release channel. A build whose
    channel has no news.json simply says so — it never errors and never blocks. */
@@ -313,15 +414,24 @@ function renderInboxNews(){
   };
   draw();
   if(INBOX_NEWS!==null) return;
-  INBOX_NEWS=[];
+  /* Latch the cache ONLY once a request is actually issued. Setting it to []
+     above these guards meant a single Inbox open while offline — or before
+     updResolveEndpoint had finished — killed newsletters for the rest of the
+     session, with no retry when the player came back online. */
   if(typeof netAllowed==='function'&&!netAllowed()) return;
+  const base=(typeof updEndpoint==='function'&&updEndpoint())||'';
+  if(!base) return;
+  INBOX_NEWS=[];
   try{
-    const base=(typeof updEndpoint==='function'&&updEndpoint())||'';
-    if(!base) return;
-    fetch(base.replace(/\/[^/]*$/,'/')+'news.json',{cache:'no-store'})
-      .then(r=>r.ok?r.json():null)
-      .then(j=>{ if(j&&Array.isArray(j.items)){ INBOX_NEWS=j.items; draw(); } })
-      .catch(()=>{});
+    /* netFetch, not fetch: it re-checks the offline gate and aborts at 12s. A
+       raw fetch hangs forever on a captive portal, which is the exact failure
+       src/offline.js exists to prevent. */
+    const url=base.replace(/\/[^/]*$/,'/')+'news.json';
+    const req=(typeof netFetch==='function')
+      ? netFetch(url,{cache:'no-store'}) : fetch(url,{cache:'no-store'});
+    req.then(r=>r.ok?r.json():null)
+       .then(j=>{ if(j&&Array.isArray(j.items)){ INBOX_NEWS=j.items; draw(); } })
+       .catch(()=>{});
   }catch(e){}
 }
 
@@ -332,6 +442,14 @@ function renderInboxNews(){
    Nova xenobiology report into a message spoken by the Brood Sovereign. */
 function storySpeakerVisual(d){
   const source=((d&&d.from)||'').toLowerCase(), title=((d&&d.ttl)||'').toLowerCase();
+  /* A changelog is the only thing in this card that is not in-fiction. It must
+     not arrive signed by Captain Kai — which is what the default below would do
+     — but it also cannot invent a portrait key, because #dispPortrait has no
+     onerror and a missing faction image renders as a broken-image glyph. Keep
+     the Nova art as the channel avatar and say plainly who is talking. */
+  if(source.includes('release channel'))
+    return {key:'nova',name:'MASSFRONT',commander:'RELEASE CHANNEL',
+      src:'./assets/factions/nova_192.jpg',alt:'MASSFRONT release channel'};
   let key='nova';
   /* Machine Ascendancy is the Coalition's doctrinal name, not the Red
      Ascendancy. Test it first so the shared word cannot select Vex. */
@@ -389,11 +507,16 @@ function showDispatch(d){
   document.getElementById('dispTtl').textContent=d.ttl;
   document.getElementById('dispFrom').textContent=d.from;
   document.getElementById('dispTxt').textContent=d.txt;
-  document.getElementById('dispIdx').textContent='DISPATCH '+(STORY.indexOf(d)+1)+' / '+STORY.length;
+  /* This card now also shows release notes, which are not STORY entries. Without
+     the guard indexOf returns -1, the header reads "DISPATCH 0 / 27" and
+     storyMarkSeen(-1) writes a junk META.story['d-1'] key into the save. */
+  const si=STORY.indexOf(d);
+  document.getElementById('dispIdx').textContent = si>=0
+    ? 'DISPATCH '+(si+1)+' / '+STORY.length : (d.idx||'RELEASE NOTES');
   el.setAttribute('aria-label',speaker.commander+' — '+d.ttl);
   el.style.display='flex';
   el.classList.remove('in'); void el.offsetWidth; el.classList.add('in');
-  storyMarkSeen(STORY.indexOf(d));
+  if(si>=0) storyMarkSeen(si);
   if(typeof sfx==='function') sfx(tx.mode==='urgent'?'alarm':'level');
 }
 /* Show whatever is owed, one at a time — a player who ranks up twice in a
@@ -401,36 +524,12 @@ function showDispatch(d){
 function storyCheck(){
   const d=storyPending();
   storyRefreshBadge();
-  if(d&&typeof toast==='function') toast('📡 NEW DISPATCH — open DOSSIER when ready');
+  if(d&&typeof toast==='function') toast('📡 NEW DISPATCH — check your MAILBOX ✉');
   return d;
 }
-function renderDossier(){
-  const g=document.getElementById('dossierList'); if(!g) return;
-  let h='';
-  STORY.forEach((d,i)=>{
-    const open=!!storySeen()['d'+i] || storyUnlocked(i);
-    const lock=d.trig? ('Reach '+RANKS[d.r].em+' '+RANKS[d.r].nm+'  ·  '+d.hint)
-                      : ('Reach '+RANKS[d.r].em+' '+RANKS[d.r].nm);
-    h+='<div class="dossItem'+(open?'':' locked')+'" data-i="'+i+'">'
-      +'<div class="dossN">'+String(i+1).padStart(2,'0')+'</div>'
-      +'<div class="dossTx"><b>'+(open?d.ttl:'CLASSIFIED')+'</b>'
-      +'<span>'+(open?d.from:lock)+'</span></div>'
-      +(open?'':'<div class="dossLock">🔒</div>')+'</div>';
-  });
-  g.innerHTML=h;
-  g.querySelectorAll('.dossItem').forEach(el=>{
-    el.addEventListener('pointerdown',()=>{
-      const i=+el.dataset.i;
-      if(!(storySeen()['d'+i]||storyUnlocked(i))){
-        const d=STORY[i];
-        toast('🔒 Unlocks at '+RANKS[d.r].em+' '+RANKS[d.r].nm+(d.trig?' — or '+d.hint:''));
-        return;
-      }
-      showDispatch(STORY[i]);
-    });
-  });
-  storyRefreshBadge();
-}
+/* renderDossier() lived here. The Dossier is the faction codex now and nothing
+   else; the whole dispatch archive, sealed entries included, is renderInbox()
+   above. Its lock-hint string survives as storyLockHint(). */
 
 /* ============================================================================
    CAMPAIGN PROLOGUE — a playable front door for first-time commanders

src/tutorial.js

@@ -272,7 +272,7 @@ function sawQueuedUnit(){
    barks are not tied to a step: they interrupt, hold briefly, then hand back
    to whatever the resting text was (or hide, if the tutorial isn't running).
    --------------------------------------------------------------------------- */
-var queue=[], holdUntil=0, restingText='', restingTag='', lastText=null, domReady=false;
+var queue=[], holdUntil=0, restingText='', restingTag='', restingId='', lastText=null, domReady=false;
 var focusEls=[], mapCue=null;
 
 function buildDOM(){
@@ -314,7 +314,7 @@ function buildDOM(){
      its dim resting state — a quiet "say that again" without extra chrome. */
   document.getElementById('keelBar').addEventListener('pointerdown',function(ev){
     if(ev.target===skipBtn||ev.target===nextBtn) return;
-    if(restingText) speak(restingText,4.2,'recall');
+    if(restingText) speak(restingText,4.2,'recall',restingId);
   });
   mapCue=cue;
 }
@@ -488,9 +488,12 @@ function syncFocus(){
    step the player is looking at right now matters more than a "done" bark
    for something they finished three actions ago. */
 var MAX_QUEUE=3;
-function speak(text,holdSec,kind){
+/* `id` is the AUTHORED voice key for this line (see keenLineId). It travels with
+   the line through the queue instead of being reconstructed from the copy on the
+   far side — reconstructing it is what let the gate and the player disagree. */
+function speak(text,holdSec,kind,id){
   if(!text) return;
-  queue.push({text:text,hold:holdSec||4.4,kind:kind||'bark'});
+  queue.push({text:text,hold:holdSec||4.4,kind:kind||'bark',id:id||null});
   while(queue.length>MAX_QUEUE) queue.shift();
 }
 function pump(){
@@ -506,7 +509,7 @@ function pump(){
     showWrap(true);
     /* Pass the line's identity through, so a rendered take can be found for it
        instead of every line silently falling through to synthesis. */
-    speakVoice(m.text,'keen',keenLineId(m.kind,m.text));
+    speakVoice(m.text,'keen',keenLineId(m.kind,m.id));
     return;
   }
   if(TUT.active && restingText){
@@ -535,6 +538,11 @@ function pump(){
 function voiceOn(){
   try{
     if(!(typeof META!=='undefined' && META.settings && META.settings.tutorialVoice)) return false;
+    /* voHas asks the BANK MANIFEST; voReady asks whether the buffer is decoded
+       yet. Gating on voReady alone made the answer "no voice available" for the
+       whole of a cold start, because nothing is decoded until something asks for
+       it — and this gate is the thing that asks. */
+    if(typeof voHas==='function' && voHas('keen','greeting')) return true;
     if(typeof voReady==='function' && voReady('keen','greeting')) return true;
     return 'speechSynthesis' in window;
   }catch(e){ return false; }
@@ -542,12 +550,23 @@ function voiceOn(){
 /* A stable id per scripted line, so a rendered take can be looked up for it.
    KEEN's script is FIXED — every step's say/done, the greeting, the graduation
    and the reactive barks are constants — which is precisely what makes them
-   renderable offline the same way the command acks already are. */
-function keenLineId(kind,text){
-  if(!text) return null;
-  var h=0, t=String(text);
-  for(var k=0;k<t.length;k++){ h=(h*31+t.charCodeAt(k))>>>0; }
-  return (kind||'bark')+'_'+h.toString(36);
+   renderable offline the same way the command acks already are.
+
+   THE ID IS AUTHORED AT THE CALL SITE. It must match an action key under
+   `lines.keen` in assets/audio/voice.json (step_camera, done_camera, greeting,
+   skip, graduation, react_low_power, react_hazard_default, …), which is what
+   verifykeen.mjs diffs. This used to hash the line's own TEXT, which meant the
+   gate at voiceOn() probed vo_keen_greeting while playback asked for
+   vo_keen_greeting_19hur50, no rendered take could ever match either, and
+   correcting a typo silently orphaned a take.
+
+   `kind` no longer contributes to the key — it survives only as the bubble's
+   hold/emphasis class. That is deliberate: it is what lets a 'recall' replay
+   resolve to the SAME take as the 'step' line it is repeating instead of
+   demanding a second recording of identical copy. */
+function keenLineId(kind,id){
+  if(!id) return null;
+  return String(id).toLowerCase().replace(/[^a-z0-9_]/g,'');
 }
 /* CHARACTER VOICES.
 
@@ -565,7 +584,14 @@ function keenLineId(kind,text){
 function speakVoice(text,faction,action,idx,wx,wy){
   if(!voiceOn()) return;
   var fac=faction||'nova';
-  if(action&&typeof voPlay==='function'&&voPlay(fac,action,wx,wy)) return;
+  if(action&&typeof voPlay==='function'){
+    /* A slot the player has not heard yet is not decoded yet, and the decode is
+       asynchronous. Reporting "no take" at that instant is what made the FIRST
+       airing of every line — which for KEEN is the only airing — fall through to
+       speech synthesis. voPlay now owns the wait and calls back only if the take
+       genuinely cannot be produced. */
+    if(voPlay(fac,action,wx,wy,idx,function(){ speakVoiceFallback(text,fac); })) return;
+  }
   speakVoiceFallback(text,fac);
 }
 /* Chrome returns an EMPTY voice list on the first getVoices() call and fills it
@@ -649,7 +675,7 @@ function beginRun(){
   MATCH.cameraBase={yaw:yawTarget,pitch:pitchTarget,span:orthoSpan};
   MATCH.lastAbCool=(typeof abCool!=='undefined')?abCool.slice():[0,0,0,0];
   queue.length=0;
-  speak(GREETING,5.5,'greeting');
+  speak(GREETING,5.5,'greeting','greeting');
 }
 function evalSteps(){
   if(!TUT.active) return;
@@ -659,7 +685,7 @@ function evalSteps(){
     try{ ok=!!STEPS[i].test(); }catch(e){ ok=false; }
     if(ok){
       TUT.doneFlags[i]=true;
-      if(i===TUT.stepIdx) speak(STEPS[i].done,3.8,'done');
+      if(i===TUT.stepIdx) speak(STEPS[i].done,3.8,'done','done_'+STEPS[i].id);
     }
   }
   while(TUT.stepIdx<STEPS.length && TUT.doneFlags[TUT.stepIdx]) TUT.stepIdx++;
@@ -673,8 +699,8 @@ function evalSteps(){
       TUT.graduated=true; TUT.active=false;
       var M=tutMeta(); M.done=true; M.skipped=false; M.version=GUIDE_VERSION;
       M.progress=STEPS.length;
-      restingText=''; restingTag='';
-      speak(GRADUATION,6.5,'graduation');
+      restingText=''; restingTag=''; restingId='';
+      speak(GRADUATION,6.5,'graduation','graduation');
       if(typeof sfx==='function'){ try{ sfx('level'); }catch(e){} }
       if(TUT.trainingMode&&!TUT.finishTimer) TUT.finishTimer=setTimeout(finishTrainingMission,1300);
       else if(typeof metaSave==='function') metaSave();
@@ -683,10 +709,11 @@ function evalSteps(){
   }
   var cur=STEPS[TUT.stepIdx];
   restingText=cur.say;
+  restingId='step_'+cur.id;
   restingTag=(cur.icon||'◇')+'  STEP '+(TUT.stepIdx+1)+' / '+STEPS.length;
   if(TUT.shownStepIdx!==TUT.stepIdx){
     TUT.shownStepIdx=TUT.stepIdx;
-    speak(cur.say,5.5,'step');
+    speak(cur.say,5.5,'step',restingId);
   }
 }
 function tutSkip(){
@@ -695,14 +722,14 @@ function tutSkip(){
   var wasTraining=TUT.trainingMode;
   var M=tutMeta(); M.skipped=true; M.version=GUIDE_VERSION;
   queue.length=0;
-  restingText=''; restingTag='';
+  restingText=''; restingTag=''; restingId='';
   clearFocus();
   if(wasTraining){
     TUT.trainingMode=false; trainingLaunched=false; restoreTrainingConfig();
     if(typeof metaSave==='function') metaSave();
     if(typeof returnToMainMenu==='function') returnToMainMenu();
   } else if(typeof metaSave==='function') metaSave();
-  speak(SKIP_LINE,4.0,'skip');
+  speak(SKIP_LINE,4.0,'skip','skip');
   if(typeof sfx==='function'){ try{ sfx('ui'); }catch(e){} }
 }
 
@@ -725,11 +752,16 @@ function checkReactive(){
   if(typeof matchLive==='undefined'||!matchLive) return;
   if(typeof alarmT!=='undefined' && alarmT>0 && alarmT!==REACT.lastAlarmT){
     REACT.lastAlarmT=alarmT;
-    if(!REACT.baseAttack){ REACT.baseAttack=true; speak(pick(BASE_ATTACK_LINES),5.0,'reactive'); }
+    /* pick() throws the chosen index away, and the index is exactly what the
+       voice key needs — the two variants are two separate recordings. Indexed
+       inline rather than changing pick(), which has other callers. */
+    if(!REACT.baseAttack){ REACT.baseAttack=true;
+      var bi=(Math.random()*BASE_ATTACK_LINES.length)|0;
+      speak(BASE_ATTACK_LINES[bi],5.0,'reactive','react_base_attack'+bi); }
   }
   if(typeof stallE!=='undefined'){
     var nowStall=stallE>0;
-    if(nowStall && !REACT.lastStallE && !REACT.lowPower){ REACT.lowPower=true; speak(LOW_POWER_LINE,4.6,'reactive'); }
+    if(nowStall && !REACT.lastStallE && !REACT.lowPower){ REACT.lowPower=true; speak(LOW_POWER_LINE,4.6,'reactive','react_low_power'); }
     REACT.lastStallE=nowStall;
   }
   if(typeof HAZ!=='undefined'){
@@ -737,15 +769,22 @@ function checkReactive(){
     if(nowWarn && !REACT.lastHazWarn && !REACT.hazard){
       REACT.hazard=true;
       var key=(typeof curMap!=='undefined')?curMap:'';
-      speak(HAZARD_LINES[key]||HAZARD_LINES._default,5.2,'reactive');
+      /* HAZARD_LINES._default is keyed with a leading underscore so it cannot
+         collide with a map id; the rendered take is plain `react_hazard_default`.
+         Guard the underscore explicitly — a map literally named "_default" would
+         otherwise ask for a take that was never rendered. */
+      var hk=(key&&key.charAt(0)!=='_'&&HAZARD_LINES[key])?key:'default';
+      speak(HAZARD_LINES[key]||HAZARD_LINES._default,5.2,'reactive','react_hazard_'+hk);
     }
     REACT.lastHazWarn=nowWarn;
   }
   if(typeof stats!=='undefined' && stats.kills && !REACT.unitLost && ((stats.kills[1]|0)+(stats.kills[2]|0))>0){
-    REACT.unitLost=true; speak(pick(UNIT_LOST_LINES),4.2,'reactive');
+    REACT.unitLost=true;
+    var ui=(Math.random()*UNIT_LOST_LINES.length)|0;
+    speak(UNIT_LOST_LINES[ui],4.2,'reactive','react_unit_lost'+ui);
   }
   if(typeof AI!=='undefined'){
-    if(AI.warned && !REACT.lastWarned && !REACT.wave){ REACT.wave=true; speak(WAVE_LINE,5.0,'reactive'); }
+    if(AI.warned && !REACT.lastWarned && !REACT.wave){ REACT.wave=true; speak(WAVE_LINE,5.0,'reactive','react_wave'); }
     REACT.lastWarned=!!AI.warned;
   }
 }
@@ -822,7 +861,7 @@ function restoreTrainingConfig(){
 function cancelTrainingMission(){
   if(!TUT.trainingMode&&!trainingPrev) return;
   TUT.trainingMode=false; trainingLaunched=false; TUT.active=false; TUT.finishTimer=0;
-  queue.length=0; restingText=''; restingTag=''; clearFocus(); hideWrap();
+  queue.length=0; restingText=''; restingTag=''; restingId=''; clearFocus(); hideWrap();
   document.body.classList.remove('trainingOperation');
   restoreTrainingConfig();
   updateTrainingEntry();
@@ -1125,6 +1164,11 @@ window.initTutorial=initTutorial;
    wired for real players (no different from any other console-reachable
    global in this codebase). */
 window.__tutDebug=function(){ return {TUT:TUT,MATCH:MATCH,REACT:REACT,STEPS:STEPS,
-  needsTraining:needsTraining(),startTraining:startTrainingMission}; };
+  needsTraining:needsTraining(),startTraining:startTrainingMission,
+  /* The voice plumbing lives inside this IIFE, so verifykeen.mjs cannot reach
+     speak()/keenLineId()/pump() any other way. Read-only handles, no state. */
+  speak:speak,pump:pump,queue:queue,voiceOn:voiceOn,keenLineId:keenLineId,
+  speakVoice:speakVoice,beginRun:beginRun,
+  keenKey:function(kind,id){ return 'vo_keen_'+keenLineId(kind,id); }}; };
 
 })();

src/ui/hud.js

@@ -78,6 +78,10 @@ const fogCanvas=document.createElement('canvas'); fogCanvas.width=FN; fogCanvas.
 const fogCtx=fogCanvas.getContext('2d');
 const fogImg=fogCtx.createImageData(FN,FN);
 let fogTex=null, fogDirty=true;
+/* Context-loss reset: the fog texture handle survives the loss as a truthy
+   reference to a dead object; updateFog would then upload into it forever and
+   the explored map would never come back. Recovery calls this first. */
+function fogGLReset(){ fogTex=null; }
 function covAt(wx,wy){
   if(!fogOn) return 1;
   return fogCov[clamp(wy/MAP*FN|0,0,FN-1)*FN+clamp(wx/MAP*FN|0,0,FN-1)];

src/updater.js

@@ -29,7 +29,14 @@
    ============================================================================ */
 
 /* Bumped by the release script. Compared against the manifest's `version`. */
-const APP_VERSION = '1.32.42';
+const APP_VERSION = '1.32.43';
+
+/* Release notes for the PACKAGED build, bumped by the release script beside
+   APP_VERSION and PACKAGED_REV. A device that has never taken an OTA has no
+   download history to read notes from, and an offline device can never fetch
+   them, so the build carries its own copy — otherwise a fresh install shows a
+   permanently empty first entry in the mailbox. */
+const APP_NOTES = "Your faction is now your army. Picking the Crimson Dominion or the Syndicate used to change your unit models and nothing else — your base, your build plates and the carrier you land in were always Nova. All three now follow your choice, and so does your commander: the Dominion walks Lord Darion Vex, the Syndicate fields Broker Lys Renn, the Brood its Sovereign. Salvage follows material. Machines leave scrap you can reclaim for mass; animals and soldiers leave biomass that pays energy only and rots fast, so an organic battlefield has to be harvested now while a mechanised one waits for you. Killing wildlife pays energy rather than mass, and a free-spawning swarm no longer mints mass out of nothing. KEEN has a voice — 162 recorded takes across her narration and all four factions' command radio, in place of the robotic fallback that was silent on Android entirely. Crystals are crystal: every phase-ore spire in the game was being drawn as riveted vehicle armour, and now transmits light like a mineral. Armour hits read properly too — a deflection throws sparks along the shot, a penetration throws hot spall, and five weapon types that were calculating the armour multiplier and discarding it now show it. Move orders draw the route your army will actually walk, around obstacles rather than through them, with a formation outline showing where the platoon ends up before you commit. Dispatches now live in your mailbox, with a sealed archive for the ones you have not unlocked, and every release posts its notes there — including this one. Fixes: the one-time age check no longer reappears on every sign-in; scrolling the Armory no longer buys whatever is under your thumb; Android Back no longer discards the commander name you just typed; and an imported save can no longer overwrite a real career by claiming a huge core balance.";
 
 /* The channel URL in update-config.json remains publisher-configurable, but a
    production checker also needs one known-good recovery path. More importantly,
@@ -231,6 +238,93 @@ async function updDel(key){
   });
 }
 
+/* ---- THE RELEASE LOG, AND THE NOTES THAT GO IN IT --------------------------
+   Every release the player actually receives posts one mail item, and the body
+   of that item is the publisher's notes for that exact version.
+
+   Two storage rules make that work on a phone:
+
+   * The notes are staged in localStorage at DOWNLOAD time, not read back out
+     of the bundle at install time. They travel with the bundle in the IndexedDB
+     `pending` record, but that record holds the whole payload — the live
+     channel ships one 26.7 MB source string — and deserialising 26 MB on the
+     boot path to recover 1 KB of text is not something a 360px phone should be
+     asked to do. localStorage survives the location.replace() that restarts the
+     document, which is the only thing the install path actually needs.
+
+   * The log is keyed by VERSION and appended in exactly one place, so a re-check,
+     a relaunch, a rollback or a re-apply can never post the same release twice.
+     Everything here is localStorage only: no network, so the whole path is
+     already offline-clean and stays that way.                                  */
+const UPD_LOG_KEY='mf_update_log';
+const UPD_NOTES_KEY='mf_update_notes';
+const UPD_NOTES_MAX=2000;
+
+function updLogRead(){
+  try{
+    const a=JSON.parse(localStorage.getItem(UPD_LOG_KEY)||'[]');
+    return Array.isArray(a)? a.filter(e=>e&&e.version) : [];
+  }catch(e){ return []; }
+}
+function updLogWrite(log){
+  try{ localStorage.setItem(UPD_LOG_KEY,JSON.stringify(log.slice(0,40))); return true; }
+  catch(e){ return false; }
+}
+function updStageNotes(version,notes){
+  if(!version) return;
+  try{
+    let a=JSON.parse(localStorage.getItem(UPD_NOTES_KEY)||'[]');
+    if(!Array.isArray(a)) a=[];
+    a=a.filter(e=>e&&e.version!==String(version));
+    a.unshift({version:String(version),notes:String(notes||'').slice(0,UPD_NOTES_MAX)});
+    localStorage.setItem(UPD_NOTES_KEY,JSON.stringify(a.slice(0,6)));
+  }catch(e){}
+}
+function updNotesFor(version){
+  try{
+    const a=JSON.parse(localStorage.getItem(UPD_NOTES_KEY)||'[]');
+    const e=Array.isArray(a)&&a.find(x=>x&&x.version===String(version));
+    return (e&&e.notes)||'';
+  }catch(e){ return ''; }
+}
+/* The ONE place that appends to the log, so the install path, the packaged seed
+   and any future writer cannot disagree about an entry's shape. Version is the
+   dedupe key. Returns true only when an entry was really added. */
+function updLogPost(version,notes,extra){
+  if(!version) return false;
+  const v=String(version), log=updLogRead();
+  if(log.some(e=>String(e.version)===v)) return false;
+  log.unshift(Object.assign({version:v,at:Date.now(),
+    notes:String(notes||'').slice(0,UPD_NOTES_MAX),read:false},extra||{}));
+  return updLogWrite(log);
+}
+/* Stamp fields onto an existing entry: read state, and the rollback marker.
+   Writes only when something actually changed, because this is called on every
+   launch of a patched build. */
+function updLogMark(version,patch){
+  if(!version||!patch) return false;
+  const v=String(version), log=updLogRead();
+  const e=log.find(x=>String(x.version)===v);
+  if(!e) return false;
+  let dirty=false;
+  for(const k of Object.keys(patch)) if(e[k]!==patch[k]){ e[k]=patch[k]; dirty=true; }
+  return dirty? updLogWrite(log) : false;
+}
+/* An entry written by a build that predates staging has an empty body, and so
+   does one whose staged notes were evicted. A later check whose manifest is for
+   THAT EXACT version can fill it in. The equality guard matters: the channel is
+   normally ahead of the device, and pasting the next release's notes onto the
+   installed one is worse than leaving it blank. */
+function updBackfillNotes(m){
+  if(!m||!m.notes||!m.version) return;
+  const log=updLogRead();
+  const e=log.find(x=>String(x.version)===String(m.version));
+  if(!e||e.notes) return;
+  e.notes=String(m.notes).slice(0,UPD_NOTES_MAX);
+  if(updLogWrite(log)&&typeof renderInboxUpdates==='function')
+    try{ renderInboxUpdates(); }catch(err){}
+}
+
 /* Compare dotted version strings numerically: '1.10.0' is newer than '1.9.9',
    which a string comparison gets backwards. */
 function verNewer(a,b){
@@ -306,6 +400,7 @@ async function updCheck(manual){
     UPD.manifest=m;
     UPD.checkedVersion=m.version;
     UPD.source=found.source;
+    updBackfillNotes(m);          // repair a note-less log entry for THIS version only
     /* Compare against the version actually running. A live-patched client can
        be newer than its packaged APP_VERSION; comparing only to the package
        made it repeatedly offer an older patch. Also distinguish a stale
@@ -390,6 +485,9 @@ async function updDownload(){
     /* Commit only once every file is present and accounted for. */
     await updPut('pending',{version:m.version, notes:m.notes||'', at:Date.now(),
                             order:m.files.map(f=>f.path), files:out});
+    /* Stage the notes where the NEXT document can read them without touching
+       the megabytes of source sitting in the record above. */
+    updStageNotes(m.version,m.notes);
     await updDel('applyFailure');
     updSet('ready',{pct:100,abort:null});
   }catch(e){
@@ -429,6 +527,12 @@ function updHardReload(){
   }catch(e){ location.reload(); }
 }
 async function updRollback(){
+  /* Mark the entry BEFORE the records are destroyed: one reload from now
+     __MASSFRONT_PATCHED is gone and nothing can tell which version was
+     reverted. The entry is not removed — the player really did run that build
+     on this device — it just stops implying it is still installed. */
+  const v=typeof window!=='undefined'?String(window.__MASSFRONT_PATCHED||''):'';
+  if(v) updLogMark(v,{rolledBack:true});
   await updDel('active'); await updDel('pending'); await updDel('probation');
   location.reload();
 }
@@ -585,21 +689,25 @@ async function initUpdater(){
   if(window.__MASSFRONT_PATCHED) document.body.classList.add('patched');
   const pend=await updGet('pending');
   const fail=await updGet('applyFailure');
-  const installed=window.__MASSFRONT_PATCHED&&
-    localStorage.getItem('mf_update_installed_notice')!==String(window.__MASSFRONT_PATCHED);
+  const running=window.__MASSFRONT_PATCHED?String(window.__MASSFRONT_PATCHED):'';
+  const installed=running&&localStorage.getItem('mf_update_installed_notice')!==running;
+  /* This document IS the patch, so an entry still marked reverted is describing
+     the build the player is looking at. Re-applying a rolled-back version can
+     only be caught here: it does not re-enter the branch below, because
+     mf_update_installed_notice still holds that version from the first install. */
+  if(running) updLogMark(running,{rolledBack:false});
   if(installed){
-    localStorage.setItem('mf_update_installed_notice',String(window.__MASSFRONT_PATCHED));
-    /* Append to the local install log. This is the history the player actually
+    localStorage.setItem('mf_update_installed_notice',running);
+    /* Post the mail for this release. This is the history the player actually
        received on THIS device — not a changelog fetched from the server — so it
-       stays truthful offline and after a rollback. */
-    try{
-      const log=JSON.parse(localStorage.getItem('mf_update_log')||'[]');
-      const v=String(window.__MASSFRONT_PATCHED);
-      if(!log.some(e=>e.version===v)){
-        log.unshift({version:v,at:Date.now(),notes:(UPD.manifest&&UPD.manifest.notes)||''});
-        localStorage.setItem('mf_update_log',JSON.stringify(log.slice(0,40)));
-      }
-    }catch(e){}
+       stays truthful offline and after a rollback.
+
+       The body comes from the copy updDownload staged in localStorage. Reading
+       UPD.manifest here, as this did, always produced an empty body: this is a
+       fresh document, UPD is the literal declared above with manifest:null, and
+       the first updCheck that would fill it in is still 1.4 seconds away. */
+    if(updLogPost(running,updNotesFor(running))&&typeof storyRefreshBadge==='function')
+      try{ storyRefreshBadge(); }catch(e){}
     updSet('installed');
   } else if(fail&&fail.quarantined&&verNewer(fail.version,updVerShown)){
     updSet('error',{err:'v'+fail.version+' failed to start twice and was removed - check again to download a fresh copy'});
@@ -612,6 +720,21 @@ async function initUpdater(){
   } else if(!UPDATE_URL) updSet('unset');
   else renderUpdatePanel();
 
+  /* FRESH INSTALL, and native store upgrades. No OTA ran, so nothing above
+     posted anything, and the mailbox would read "no updates yet" on a build the
+     player installed five minutes ago. Log the packaged build from its own
+     APP_NOTES — entirely local, so it works on a device that has never had a
+     network. Silent (read:true) when the log was empty: a brand-new player has
+     no "what's new" to catch up on and should not be handed an unread badge on
+     first launch. A store upgrade over existing history is real news, so that
+     one arrives unread. Dedupe is by version, so a rollback to a packaged build
+     that is already logged posts nothing. */
+  if(!running&&APP_NOTES){
+    const empty=!updLogRead().length;
+    if(updLogPost(APP_VERSION,APP_NOTES,{packaged:true,read:empty})&&!empty&&
+       typeof storyRefreshBadge==='function') try{ storyRefreshBadge(); }catch(e){}
+  }
+
   /* Auto-check on arrival at the main menu. The dot goes amber while the request
      is in flight and settles green or amber-with-an-update, so the player never
      has to remember to press CHECK. Silent: no toast, no modal — a check that