Publish MASSFRONT web v1.33.60 (part 2)

assets/data/manifest.json

@@ -91,8 +91,9 @@
     "src/daily.js",
     "src/account.js",
     "src/economy-net.js",
-    "src/updater.js",
-    "src/intro.js",
+    "src/updater.js",
+    "src/intro.js",
+    "src/launcher.js",
     "src/session.js",
     "src/faction-id.js",
     "src/glrecover.js",

assets/data/runtime-compatibility.json

@@ -1,10 +1,10 @@
 {
   "schema": "massfront.runtime-compatibility",
   "schemaVersion": 1,
-  "buildVersion": "1.33.55",
+  "buildVersion": "1.33.60",
   "channel": "packaged-www",
-  "manifestHash": "68edb621ff67d152b7ad6a3bf43120317b9973f166ffa13f7a81091fc5b3aab9",
-  "balanceHash": "da4f1042e4ae8f1173dbdb51b2570cb539735aba701dd18f2721bb40b26fd72e",
+  "manifestHash": "addd4716b37b8595da29a6becfc8add0a0fba3e2150dd86281e50dfdff8b1168",
+  "balanceHash": "4154ba8ba6f0fea81cc28e3af073d1949680d4a67a9cb696a9e5861c5fb129fe",
   "algorithm": {
     "leaf": "sha256(raw-artifact-bytes)",
     "root": "sha256(domain\\0 + utf8ByteLength(path):path\\0decimalSize\\0leaf\\n for each ordered entry)",
@@ -16,23 +16,23 @@
   "manifestEntries": [
     {
       "path": "index.html",
-      "size": 428689,
-      "sha256": "0cc58c06ffa8de819e1c43bfb6872f177e2dc9ebbec7468193a4c7a6bfaf6ad3"
+      "size": 435619,
+      "sha256": "bf991b42fc3b9b472c85b215b8c862d43a73e07eeb5b9719bd7ea3cefc4dd032"
     },
     {
       "path": "boot.js",
-      "size": 33378,
-      "sha256": "99369a2124543b5bf5d9d4df0cb5f0092e3d835a3c603959ffeb9b323c799767"
+      "size": 46254,
+      "sha256": "14ec9d1c4d84304a9a768823e4958c80abf29383c070eff90925154d74bca573"
     },
     {
       "path": "sw.js",
       "size": 6419,
-      "sha256": "dc24d82f2e7be870cb1fbb9a2c4dbcac1926366f14431c820a710732ad2e64e4"
+      "sha256": "604a58aa0f607a303c37e68a4e93c52d333ca78fe403243a2c9603bdf385b14b"
     },
     {
       "path": "src/styles/ui.css",
-      "size": 342825,
-      "sha256": "fefbdc6f2bad8362b8474a183ebdd68527a7840b71ea06386b80acb114f34677"
+      "size": 372493,
+      "sha256": "39c2a056e6299458f38b7448a6a56cdc240e6c534ed52636758ec64e5c713d1b"
     },
     {
       "path": "assets/ui.css",
@@ -121,8 +121,8 @@
     },
     {
       "path": "src/engine/perf.js",
-      "size": 8281,
-      "sha256": "da348a05513b7ba75cd5c978a226faeaa7f870c9bf1cb117f9b8336332235bea"
+      "size": 25202,
+      "sha256": "e74249688bef2ede6a885f62e0f51300fe5d42aa4a1929924249194e3e713b2a"
     },
     {
       "path": "src/engine/noisegen.js",
@@ -371,8 +371,8 @@
     },
     {
       "path": "src/game/meta.js",
-      "size": 126856,
-      "sha256": "3c042a6d37171dc1121e28bb87b4639e60a779727900777da22e02cd27582e07"
+      "size": 127622,
+      "sha256": "5180c016ba355f55dc9230c9501e68b80c8b93b430a8fe6fede012752d77c332"
     },
     {
       "path": "src/game/ai.js",
@@ -391,8 +391,8 @@
     },
     {
       "path": "src/ui/hud.js",
-      "size": 178226,
-      "sha256": "aaa80213df462fad27dcf1f3dc17bd96075ca16c1987cf5151656d3efca27388"
+      "size": 183281,
+      "sha256": "9014df151281a0ba20b85d67b962e394e7902d6cda1e34105fe9373735dc0b87"
     },
     {
       "path": "src/ui/render3d.js",
@@ -441,8 +441,8 @@
     },
     {
       "path": "src/assetpack.js",
-      "size": 18120,
-      "sha256": "22ec799cfa0648e876c1a5f0ce9cad6696adbab49aa902d52ec7fbc26f5c1f97"
+      "size": 55805,
+      "sha256": "4d3f45ce562e56ee5137516be79bc6faa4fc3db75c483ef1c7ce0300d47363b6"
     },
     {
       "path": "src/hazards.js",
@@ -451,13 +451,13 @@
     },
     {
       "path": "src/game/statehash.js",
-      "size": 11138,
-      "sha256": "09b476476b4b4200b3d5a51338e105aa445ebfbef1d31049f83b517ba4cd79db"
+      "size": 12260,
+      "sha256": "f2c22000002e6b125f8876deedac28a932448890663257614e1c873129a901d2"
     },
     {
       "path": "src/authportal.js",
-      "size": 103419,
-      "sha256": "81f7604547f65c318cad5ca27803ee93ed55797124c9a9facaf2a2ef84ed4bef"
+      "size": 109260,
+      "sha256": "893c17c4c6ae384b875660284bab99be28b796f24b34af4647d3931eda6b13c7"
     },
     {
       "path": "src/tutorial.js",
@@ -501,8 +501,8 @@
     },
     {
       "path": "src/socialui.js",
-      "size": 81988,
-      "sha256": "700d217b7ea999dcc5fc7915282619e092d65b4b29ca02b947f59ffcfb1c1096"
+      "size": 94822,
+      "sha256": "906face8283ca5cf2ba416c79e11e22ce61afcedf6d39eba75907e5de169bd55"
     },
     {
       "path": "src/game/matchconsumer.js",
@@ -526,13 +526,18 @@
     },
     {
       "path": "src/updater.js",
-      "size": 102031,
-      "sha256": "198874ef66f3c0fef1a8b86507ef7c411532a26910c3dbd73a8328dc4b0b3146"
+      "size": 146225,
+      "sha256": "fc1024feb7d7bff0239e0c8792219d28c1b488ce1e1c263b75e8f7ae9d0cbcd8"
     },
     {
       "path": "src/intro.js",
-      "size": 207114,
-      "sha256": "3661c3b5e29ec597e0021c7c769d3748a67b948fa09d76d4f9ae601976c291d5"
+      "size": 207551,
+      "sha256": "d4ecb5df0a0353870f66697b9221872b2fbe3e6982f3f061275eb46d2caa5387"
+    },
+    {
+      "path": "src/launcher.js",
+      "size": 28822,
+      "sha256": "d8bd5b2ab2722aacf3576b886ea2da5305ebef9af9f15e8baa40cfe8e8b3850f"
     },
     {
       "path": "src/session.js",
@@ -551,8 +556,8 @@
     },
     {
       "path": "src/main.js",
-      "size": 181090,
-      "sha256": "857428872384b8e03a4c9804ead7b8187240c3f141193e1bbda312e9bcbe2e2b"
+      "size": 184506,
+      "sha256": "18036eba44152f565ba9e37d32f0e87031f1d767451d1d9a70b0336edd7e1456"
     },
     {
       "path": "src/intel.js",
@@ -586,8 +591,8 @@
     },
     {
       "path": "src/ui/hudflow.js",
-      "size": 37901,
-      "sha256": "107fd65fca0af162142e1661401149388dff46ae236ab16d6e9f592bf98ce4b4"
+      "size": 42564,
+      "sha256": "9496dd95562674ba8357536e68b2f76b398a959abcfc9e415749c9c569633f6a"
     },
     {
       "path": "src/ui/hotslots.js",
@@ -698,8 +703,8 @@
     },
     {
       "path": "src/game/meta.js",
-      "size": 126856,
-      "sha256": "3c042a6d37171dc1121e28bb87b4639e60a779727900777da22e02cd27582e07"
+      "size": 127622,
+      "sha256": "5180c016ba355f55dc9230c9501e68b80c8b93b430a8fe6fede012752d77c332"
     },
     {
       "path": "src/game/ai.js",
@@ -763,8 +768,8 @@
     },
     {
       "path": "src/main.js",
-      "size": 181090,
-      "sha256": "857428872384b8e03a4c9804ead7b8187240c3f141193e1bbda312e9bcbe2e2b"
+      "size": 184506,
+      "sha256": "18036eba44152f565ba9e37d32f0e87031f1d767451d1d9a70b0336edd7e1456"
     },
     {
       "path": "src/intel.js",

boot.js

@@ -24,21 +24,26 @@
     './assets/data/theatreprofiles-stage10.js',
     './assets/data/interiortopology-stage10.js','./assets/data/orbitaltopology-stage10.js',
     './src/game/determinism.js',
-    './assets/data/unitrows.js','./assets/data/unitsheet.js','./assets/data/itemart.js','./assets/data/planetart.js','./src/engine/gl.js','./src/engine/planetpreview.js','./src/engine/perf.js','./src/engine/noisegen.js','./src/engine/factionenergy.js','./src/engine/ordnancetrails.js','./src/engine/terragen.js','./src/terralab.js','./src/engine/mesh.js','./src/engine/billboard.js','./src/engine/macrofx.js','./src/engine/shieldfx.js','./src/engine/tacticons.js','./src/engine/gpufx.js','./src/engine/volfx.js','./src/engine/shockwave.js','./src/engine/vfxlayers.js','./src/engine/organicfx.js','./assets/basis/basis_transcoder.js','./src/engine/materials.js','./src/engine/materials-v2.js','./src/engine/terrain.js','./src/engine/models-world-data.js','./src/engine/models-world-loader.js','./src/engine/models.js','./assets/data/worldkit.js','./assets/data/locationgrammar.js','./assets/data/sitetemplates.js','./assets/data/sitetemplates-stage9.js','./assets/data/locationplans.js','./assets/data/battlefieldtopology-stage10.js','./src/engine/worldsites.js','./assets/data/meshes.js','./src/engine/models-legion.js','./src/engine/models-machine.js','./src/engine/models-infestation.js','./src/engine/models-civic.js','./src/engine/models-skyline.js','./src/engine/materials-world-v2.js','./src/engine/models-units-nova.js','./src/engine/models-units-legion.js','./src/engine/models-units-syndicate.js','./src/engine/models-units-brood.js','./src/engine/modkit.js','./src/engine/physics.js','./src/engine/cloudfx.js','./src/engine/cloudpostfx.js','./src/game/utilityjobs.js','./src/game/sim.js','./src/game/airwarfare.js','./src/game/economy.js','./src/game/commander.js','./src/game/meta.js','./src/game/ai.js','./src/ui/input.js','./src/ui/facticons.js','./src/ui/hud.js','./src/ui/render3d.js','./src/ui/orderfx.js','./src/airlift.js','./src/airlift-factions.js','./src/rumble.js','./src/factions.js','./src/factext.js','./src/offline.js','./src/audio.js','./src/assetpack.js','./src/hazards.js','./src/game/statehash.js','./src/authportal.js','./src/tutorial.js','./src/adboards.js','./src/storeui.js','./src/restree3d.js','./src/develop.js','./src/factiondoctrine.js','./src/endgame.js','./src/story.js','./src/socialui.js','./src/game/matchconsumer.js','./src/daily.js','./src/account.js','./src/economy-net.js','./src/updater.js','./src/intro.js','./src/session.js','./src/faction-id.js','./src/glrecover.js','./src/main.js','./src/intel.js','./src/repairbay.js','./src/galaxyui.js','./src/departure.js','./src/warprimer.js','./src/uistack.js','./src/ui/hudflow.js','./src/ui/hotslots.js','./src/galactic-operations.js','./src/onboarding.js','./src/career-faction-gate.js'
+    './assets/data/unitrows.js','./assets/data/unitsheet.js','./assets/data/itemart.js','./assets/data/planetart.js','./src/engine/gl.js','./src/engine/planetpreview.js','./src/engine/perf.js','./src/engine/noisegen.js','./src/engine/factionenergy.js','./src/engine/ordnancetrails.js','./src/engine/terragen.js','./src/terralab.js','./src/engine/mesh.js','./src/engine/billboard.js','./src/engine/macrofx.js','./src/engine/shieldfx.js','./src/engine/tacticons.js','./src/engine/gpufx.js','./src/engine/volfx.js','./src/engine/shockwave.js','./src/engine/vfxlayers.js','./src/engine/organicfx.js','./assets/basis/basis_transcoder.js','./src/engine/materials.js','./src/engine/materials-v2.js','./src/engine/terrain.js','./src/engine/models-world-data.js','./src/engine/models-world-loader.js','./src/engine/models.js','./assets/data/worldkit.js','./assets/data/locationgrammar.js','./assets/data/sitetemplates.js','./assets/data/sitetemplates-stage9.js','./assets/data/locationplans.js','./assets/data/battlefieldtopology-stage10.js','./src/engine/worldsites.js','./assets/data/meshes.js','./src/engine/models-legion.js','./src/engine/models-machine.js','./src/engine/models-infestation.js','./src/engine/models-civic.js','./src/engine/models-skyline.js','./src/engine/materials-world-v2.js','./src/engine/models-units-nova.js','./src/engine/models-units-legion.js','./src/engine/models-units-syndicate.js','./src/engine/models-units-brood.js','./src/engine/modkit.js','./src/engine/physics.js','./src/engine/cloudfx.js','./src/engine/cloudpostfx.js','./src/game/utilityjobs.js','./src/game/sim.js','./src/game/airwarfare.js','./src/game/economy.js','./src/game/commander.js','./src/game/meta.js','./src/game/ai.js','./src/ui/input.js','./src/ui/facticons.js','./src/ui/hud.js','./src/ui/render3d.js','./src/ui/orderfx.js','./src/airlift.js','./src/airlift-factions.js','./src/rumble.js','./src/factions.js','./src/factext.js','./src/offline.js','./src/audio.js','./src/assetpack.js','./src/hazards.js','./src/game/statehash.js','./src/authportal.js','./src/tutorial.js','./src/adboards.js','./src/storeui.js','./src/restree3d.js','./src/develop.js','./src/factiondoctrine.js','./src/endgame.js','./src/story.js','./src/socialui.js','./src/game/matchconsumer.js','./src/daily.js','./src/account.js','./src/economy-net.js','./src/updater.js','./src/intro.js','./src/launcher.js','./src/session.js','./src/faction-id.js','./src/glrecover.js','./src/main.js','./src/intel.js','./src/repairbay.js','./src/galaxyui.js','./src/departure.js','./src/warprimer.js','./src/uistack.js','./src/ui/hudflow.js','./src/ui/hotslots.js','./src/galactic-operations.js','./src/onboarding.js','./src/career-faction-gate.js'
   ];
   /* Packaged scripts need a release key. WebViews and development browsers can
      otherwise reuse a stale source even after the installer or local preview
      has changed, which made new settings appear to be missing until cache was
      cleared manually. Patch bundles keep their content-addressed Blob URLs. */
-  var PACKAGED_REV='1.33.55';
+  var PACKAGED_REV='1.33.60';
   /* Source-cache revision is deliberately independent from the user-facing
      release number. Local/hotfix rebuilds of the same release must not reuse
      an older gl.js merely because its ?v= version string is unchanged. */
   /* shell2 changes recovery delivery only. Keep the already-verified runtime
      source revision so a service-worker repair does not cold-fetch all 108
      scripts from the host at once. */
-  var PACKAGED_SRC_REV=PACKAGED_REV+'-boot6';
+  var PACKAGED_SRC_REV=PACKAGED_REV+'-boot8';
   var DB='massfront-updates', STORE='bundles';
+  /* Packaged boot capability flag. OTA source checks this before staging a
+     descriptor that references per-artifact records. Old APK-bound boot
+     loaders never set it and therefore continue receiving the legacy complete
+     in-record bundle they understand. */
+  window.__MF_ARTIFACT_BOOT_V1=true;
   var bootShield=null, bootShieldTimer=0, bootShieldWatchdog=0;
   var bootShieldEvents=['pointerdown','pointerup','touchstart','touchend','click'];
   /* Absolute ceiling on how long the shield/guard may live. The guard is only
@@ -107,12 +112,35 @@
   function bundleMeta(rec){
     if(!rec) return null;
     return {version:rec.version,channel:rec.channel||'stable',at:rec.at,
+      schema:rec.schema||1,
       notes:rec.notes||'',severity:rec.severity||'recommended',
-      kind:rec.kind||'full',patchedFrom:rec.patchedFrom||''};
+      kind:rec.kind||'full',patchedFrom:rec.patchedFrom||'',
+      manifestRoot:rec.manifestRoot||'',payloadRoot:rec.payloadRoot||'',
+      targetRoot:rec.targetRoot||'',sourcePayloadRoot:rec.sourcePayloadRoot||'',
+      fullRoot:rec.fullRoot||'',manifestKind:rec.manifestKind||'',
+      manifestCategory:rec.manifestCategory||'',
+      manifestPatchFrom:rec.manifestPatchFrom||'',
+      runtimeRoot:rec.runtimeRoot||'',
+      storage:rec.storage||''};
+  }
+  function sameRoots(a,b){
+    if(!a||!b) return false;
+    var ah=!!(a.manifestRoot||a.targetRoot||a.runtimeRoot),
+        bh=!!(b.manifestRoot||b.targetRoot||b.runtimeRoot);
+    if(!ah&&!bh) return true;
+    if(!(a.manifestRoot&&b.manifestRoot&&a.targetRoot&&b.targetRoot&&
+      String(a.manifestRoot).toLowerCase()===String(b.manifestRoot).toLowerCase()&&
+      String(a.targetRoot).toLowerCase()===String(b.targetRoot).toLowerCase())) return false;
+    /* Schema-1/2 records from before rooted identities remain compatible only
+       when both sides omit the runtime root. Once either side names one, both
+       must name the same ordered runtime or it cannot bless/replace the other. */
+    if(a.runtimeRoot||b.runtimeRoot) return !!(a.runtimeRoot&&b.runtimeRoot&&
+      String(a.runtimeRoot).toLowerCase()===String(b.runtimeRoot).toLowerCase());
+    return true;
   }
   function sameBundle(a,b){
     if(!a||!b||String(a.version)!==String(b.version)||
-       patchChannel(a)!==patchChannel(b)) return false;
+       patchChannel(a)!==patchChannel(b)||!sameRoots(a,b)) return false;
     if(a.at!=null||b.at!=null) return String(a.at||'')===String(b.at||'');
     return true;
   }
@@ -145,19 +173,21 @@
   }
   function probationMatchesBundle(prob,bundle){
     if(!prob||!bundle||String(prob.version)!==String(bundle.version)||
-       patchChannel(prob)!==patchChannel(bundle)) return false;
+       patchChannel(prob)!==patchChannel(bundle)||!sameRoots(prob,bundle)) return false;
     return prob.pendingAt==null||String(prob.pendingAt)===String(bundle.at||'');
   }
   function probationOwnsMetaExact(prob,meta){
     return !!(prob&&meta&&prob.pendingAt!=null&&meta.at!=null&&
       String(prob.version)===String(meta.version)&&
       patchChannel(prob)===patchChannel(meta)&&
+      sameRoots(prob,meta)&&
       String(prob.pendingAt)===String(meta.at));
   }
   function pendingMatchesFailure(pending,prob,bundle,version){
     if(!pending||String(pending.version)!==String(version)) return false;
     var owner=prob||bundle;
     if(owner&&patchChannel(pending)!==patchChannel(owner)) return false;
+    if(owner&&!sameRoots(pending,owner)) return false;
     var token=prob&&prob.pendingAt!=null?prob.pendingAt:
       (bundle&&bundle.at!=null?bundle.at:null);
     /* Old records without an attempt token cannot be distinguished from a
@@ -215,7 +245,58 @@
   function validBundle(b){
     if(!b||!b.files||!verNewer(b.version,PACKAGED_REV)) return false;
     var order=b.order&&b.order.length?b.order:MANIFEST;
-    for(var i=0;i<order.length;i++) if(typeof b.files[order[i]]!=='string') return false;
+    var schema=Number(b.schema||1);
+    if(schema>=3){
+      var hex=/^[0-9a-f]{64}$/;
+      if(!Number.isSafeInteger(schema)||
+         !hex.test(String(b.manifestRoot||''))||
+         !hex.test(String(b.payloadRoot||''))||
+         !hex.test(String(b.sourcePayloadRoot||''))||
+         !hex.test(String(b.fullRoot||''))||
+         !hex.test(String(b.targetRoot||''))||
+         !hex.test(String(b.runtimeRoot||''))||
+         String(b.targetRoot)!==String(b.fullRoot)||
+         (String(b.payloadRoot)!==String(b.sourcePayloadRoot)&&
+          String(b.payloadRoot)!==String(b.fullRoot))||
+         (b.manifestKind!=='full'&&b.manifestKind!=='patch')||
+         ['system','hotfix','content','overhaul'].indexOf(b.manifestCategory)<0||
+         (b.manifestKind==='patch'&&!/^\d+\.\d+\.\d+$/.test(String(b.manifestPatchFrom||'')))||
+         (b.manifestKind==='full'&&String(b.manifestPatchFrom||'')!=='')||
+         (b.channel!=='stable'&&b.channel!=='preview')||
+         (b.storage!=='artifact-v1'&&b.storage!=='bundle-v1')||
+         !Array.isArray(b.order)||!b.order.length||
+         !b.files||typeof b.files!=='object'||Array.isArray(b.files)) return false;
+      var own=Object.keys(b.files),seen={};
+      if(own.length!==b.order.length) return false;
+      for(var p=0;p<b.order.length;p++){
+        var path=b.order[p];
+        if(typeof path!=='string'||path.length>512||
+           !/^[A-Za-z0-9._/-]+$/.test(path)||path.charAt(0)==='/'||
+           path.slice(-1)==='/'||path.indexOf('//')>=0||
+           path.split('/').some(function(part){return !part||part==='.'||part==='..';})||
+           seen[path]||!Object.prototype.hasOwnProperty.call(b.files,path)) return false;
+        seen[path]=true;
+      }
+      for(var o=0;o<own.length;o++) if(!seen[own[o]]) return false;
+    }
+    for(var i=0;i<order.length;i++){
+      var file=b.files[order[i]];
+      if(typeof file==='string'){
+        if(schema>=3&&b.storage!=='bundle-v1') return false;
+        continue;
+      }
+      if(!file||typeof file!=='object'||typeof file.key!=='string'||!file.key||
+         typeof file.sha256!=='string'||!/^[0-9a-f]{64}$/i.test(file.sha256)||
+         !Number.isSafeInteger(file.size)||file.size<=0) return false;
+      if(schema>=3){
+        if(b.storage!=='artifact-v1') return false;
+        var suffix=':file:'+order[i];
+        if(file.key.slice(-suffix.length)!==suffix||
+           !/^transfer-v1:(stable|preview)-\d+\.\d+\.\d+-[0-9a-f]{64}-(payload|full)$/.test(
+             file.key.slice(0,-suffix.length)))
+          return false;
+      }
+    }
     return true;
   }
   function evictSuperseded(db){
@@ -353,6 +434,15 @@
                 :(!meta||sameBundle(meta,value)));
             if(good){
               store.put(value,'active'); store.put(bundleMeta(value),'activeMeta');
+              /* Re-validate the rollback payload on this launch. Its metadata
+                 was previously trusted, but descriptor records may since have
+                 been evicted or corrupted. tries:1 makes the next launch fail
+                 closed to packaged code unless this exact recovered runtime
+                 reaches __bootOk now. */
+              store.put({version:value.version,channel:value.channel||'stable',
+                manifestRoot:value.manifestRoot||'',targetRoot:value.targetRoot||'',
+                runtimeRoot:value.runtimeRoot||'',
+                pendingAt:value.at,at:Date.now(),tries:1,recoveryOf:version},'probation');
               clearPreviousRecords(store);
               clearFinishedRollback(value);
               decision={kind:'recovered',bundle:value,failedVersion:version,
@@ -404,6 +494,8 @@
               return;
             }
             var claimed={version:bundle.version,channel:bundle.channel||prob.channel,
+              manifestRoot:bundle.manifestRoot||'',targetRoot:bundle.targetRoot||'',
+              runtimeRoot:bundle.runtimeRoot||'',
               pendingAt:bundle.at!=null?bundle.at:prob.pendingAt,
               at:prob.at||Date.now(),tries:(prob.tries|0)+1};
             store.put(claimed,'probation');
@@ -415,6 +507,8 @@
             /* A mismatched legacy/torn guard must never be used to validate a
                different active record. Replace it with an exact first claim. */
             store.put({version:bundle.version,channel:bundle.channel||'stable',
+              manifestRoot:bundle.manifestRoot||'',targetRoot:bundle.targetRoot||'',
+              runtimeRoot:bundle.runtimeRoot||'',
               pendingAt:bundle.at,at:Date.now(),tries:1},'probation');
             clearFinishedRollback(bundle);
             decision={kind:'run',bundle:bundle,claimed:true,repaired:true};
@@ -509,10 +603,158 @@
     injectScripts(function(s,i){ s.src=MANIFEST[i]+'?v='+PACKAGED_SRC_REV; },
                   MANIFEST.length,rendererGateIndex(MANIFEST));
   }
+  function runArtifactBundle(b){
+    /* Descriptor bundles keep each verified source artifact in its own IDB
+       record. Load, re-hash, execute and release one file at a time so a large
+       source update does not deserialize a ~93 MB object or create 110 Blob
+       URLs simultaneously. Strict sequencing preserves the classic shared
+       global scope just like async=false script tags. */
+    var order=b.order&&b.order.length?b.order:MANIFEST;
+    var gate=rendererGateIndex(order),index=0,total=order.length,executed=0,stopped=false;
+    var runtimeRows=[];
+    bootProgress(0,total);
+    function rangeFailure(path,reason){
+      if(stopped) return;
+      stopped=true;
+      console.error('boot: failed',path,reason||'stored artifact unavailable');
+      clearBootShield();
+      try{if(typeof window.__MASSFRONT_CLEAR_INPUT_GUARD==='function')
+        window.__MASSFRONT_CLEAR_INPUT_GUARD();}catch(e){}
+      if(executed===0){
+        /* The verification pass failed before one downloaded script executed,
+           so a packaged session is safe. Keep probation in IndexedDB; clearing
+           only the window identity prevents that fallback frame from blessing
+           the broken patch through __bootOk. */
+        try{
+          delete window.__MASSFRONT_PATCHED; delete window.__MASSFRONT_PATCH_AT;
+          delete window.__MASSFRONT_PATCH_CHANNEL;
+          delete window.__MASSFRONT_PATCH_MANIFEST_ROOT;
+          delete window.__MASSFRONT_PATCH_TARGET_ROOT;
+          delete window.__MASSFRONT_PATCH_RUNTIME_ROOT;
+        }catch(e){}
+        runPackaged();
+      }else{
+        /* A record changed between preflight and execution. Never mix a partial
+           classic-script global scope with packaged code; restart so the armed
+           probation transaction performs normal recovery. */
+        console.warn('boot: stored artifact changed during execution; restarting for recovery');
+        try{ if(window.location&&typeof window.location.reload==='function') window.location.reload(); }
+        catch(e){}
+      }
+    }
+    function textDigest(text){
+      if(!window.crypto||!window.crypto.subtle||typeof TextEncoder==='undefined')
+        return Promise.reject(new Error('integrity checks unavailable'));
+      var bytes=new TextEncoder().encode(text);
+      return window.crypto.subtle.digest('SHA-256',bytes).then(function(value){
+        var a=new Uint8Array(value),hex='';
+        for(var i=0;i<a.length;i++) hex+=a[i].toString(16).padStart(2,'0');
+        return {size:bytes.byteLength,sha256:hex.toLowerCase()};
+      });
+    }
+    function digest(text,ref,path){
+      return textDigest(text).then(function(actual){
+        if(!Number.isSafeInteger(ref.size)||ref.size<=0||actual.size!==ref.size)
+          throw new Error('stored size mismatch');
+        if(actual.sha256!==String(ref.sha256).toLowerCase())
+          throw new Error('stored hash mismatch');
+        return text;
+      });
+    }
+    function append(text,path){
+      var blob=URL.createObjectURL(new Blob([text+'\n//# sourceURL='+path],{type:'text/javascript'}));
+      var script=document.createElement('script'); script.async=false; script.src=blob;
+      script.onload=function(){
+        URL.revokeObjectURL(blob);
+        var current=index++; executed++;
+        bootProgress(index,total);
+        if(current===gate&&window.__MF_GL_BOOT_FAILED===true){
+          console.warn('boot: renderer phase stopped after WebGL2 initialization failed');
+          clearBootShield();
+          try{if(typeof window.__MASSFRONT_CLEAR_INPUT_GUARD==='function')
+            window.__MASSFRONT_CLEAR_INPUT_GUARD();}catch(e){}
+          return;
+        }
+        next();
+      };
+      script.onerror=function(){ URL.revokeObjectURL(blob); rangeFailure(path,'script load error'); };
+      document.body.appendChild(script);
+    }
+    var dbPromise=idb();
+    function readArtifact(path,ref){
+      if(typeof ref==='string') return Promise.resolve(ref);
+      return dbPromise.then(function(db){
+        return new Promise(function(res,rej){
+          try{
+            var q=db.transaction(STORE,'readonly').objectStore(STORE).get(ref.key);
+            q.onsuccess=function(){ res(q.result); };
+            q.onerror=function(){ rej(q.error||new Error('artifact read failed')); };
+          }catch(e){ rej(e); }
+        });
+      }).then(function(rec){
+        if(!rec||typeof rec.text!=='string'||!Number.isSafeInteger(rec.size)||
+           rec.size<=0||rec.size!==ref.size||
+           String(rec.sha256).toLowerCase()!==String(ref.sha256).toLowerCase())
+          throw new Error('stored artifact metadata mismatch');
+        return digest(rec.text,ref,path);
+      });
+    }
+    function preflight(i){
+      if(stopped) return;
+      if(i>=total){
+        textDigest(runtimeRows.join('\n')).then(function(actual){
+          if(Number(b.schema||1)<3) return actual;
+          if(actual.sha256!==String(b.runtimeRoot||'').toLowerCase())
+            throw new Error('ordered runtime root mismatch');
+          var contract=[
+            'schema='+b.schema,'channel='+b.channel,'version='+b.version,
+            'kind='+b.manifestKind,'category='+b.manifestCategory,
+            'patchFrom='+b.manifestPatchFrom,
+            'payload='+b.sourcePayloadRoot,'full='+b.fullRoot,
+            'runtime='+actual.sha256
+          ].join('\n');
+          return textDigest(contract).then(function(root){
+            if(root.sha256!==String(b.manifestRoot||'').toLowerCase())
+              throw new Error('manifest root contract mismatch');
+            return actual;
+          });
+        }).then(function(){
+          index=0;bootProgress(0,total);next();
+        }).catch(function(error){ rangeFailure('__runtime__',error&&error.message); });
+        return;
+      }
+      var path=order[i],ref=b.files[path];
+      if(typeof ref==='string'){
+        textDigest(ref).then(function(actual){
+          if(!Number.isSafeInteger(actual.size)||actual.size<=0)
+            throw new Error('stored size mismatch');
+          runtimeRows.push(path+'|'+actual.size+'|'+actual.sha256);
+          bootProgress(i+1,total);preflight(i+1);
+        }).catch(function(error){ rangeFailure(path,error&&error.message); });
+        return;
+      }
+      readArtifact(path,ref).then(function(){
+        runtimeRows.push(path+'|'+ref.size+'|'+String(ref.sha256).toLowerCase());
+        bootProgress(i+1,total);preflight(i+1);
+      }).catch(function(error){ rangeFailure(path,error&&error.message); });
+    }
+    function next(){
+      if(stopped||index>=total) return;
+      var path=order[index],ref=b.files[path];
+      if(typeof ref==='string'){ append(ref,path); return; }
+      readArtifact(path,ref).then(function(text){ append(text,path); })
+        .catch(function(error){ rangeFailure(path,error&&error.message); });
+    }
+    preflight(0);
+  }
   function runBundle(b){
     /* Blob URLs rather than inline text: the browser keeps a real filename for
        each source, so a stack trace from a patched build is still readable. */
     var order=b.order&&b.order.length? b.order : MANIFEST;
+    if(Number(b.schema||1)>=3&&b.runtimeRoot){ runArtifactBundle(b);return; }
+    for(var i=0;i<order.length;i++) if(typeof b.files[order[i]]!=='string'){
+      runArtifactBundle(b); return;
+    }
     injectScripts(function(s,i){
       var path=order[i], src=b.files[path];
       if(src==null) s.src=path;
@@ -533,6 +775,9 @@
         window.__MASSFRONT_PATCHED=decision.bundle.version||'?';
         window.__MASSFRONT_PATCH_AT=decision.bundle.at;
         window.__MASSFRONT_PATCH_CHANNEL=decision.bundle.channel||'stable';
+        window.__MASSFRONT_PATCH_MANIFEST_ROOT=decision.bundle.manifestRoot||'';
+        window.__MASSFRONT_PATCH_TARGET_ROOT=decision.bundle.targetRoot||'';
+        window.__MASSFRONT_PATCH_RUNTIME_ROOT=decision.bundle.runtimeRoot||'';
         window.__MASSFRONT_RECOVERED_PATCH=decision.failedVersion||'?';
         console.warn('boot: restored validated patch '+decision.bundle.version+
                      ' after '+decision.failedVersion+' failed');
@@ -543,6 +788,9 @@
         window.__MASSFRONT_PATCHED=decision.bundle.version||'?';
         window.__MASSFRONT_PATCH_AT=decision.bundle.at;
         window.__MASSFRONT_PATCH_CHANNEL=decision.bundle.channel||'stable';
+        window.__MASSFRONT_PATCH_MANIFEST_ROOT=decision.bundle.manifestRoot||'';
+        window.__MASSFRONT_PATCH_TARGET_ROOT=decision.bundle.targetRoot||'';
+        window.__MASSFRONT_PATCH_RUNTIME_ROOT=decision.bundle.runtimeRoot||'';
         runBundle(decision.bundle);
         return;
       }
@@ -560,12 +808,16 @@
        failed before it selected `active`. It has NOT proved the stored patch
        good, so it must not erase that patch's probation record. Leaving it in
        place means the next healthy launch retries under the normal rollback
-       guard instead of running an unguarded payload. A recovered previous
-       patch is similarly only a fallback for a different failed version. */
-    if(!window.__MASSFRONT_PATCHED||window.__MASSFRONT_RECOVERED_PATCH) return;
+       guard instead of running an unguarded payload. Recovered previous code
+       now owns a fresh probation guard and must confirm its own descriptor
+       records before becoming the new last-known-good runtime. */
+    if(!window.__MASSFRONT_PATCHED) return;
     idb().then(function(db){
       return confirmPatch(db,{version:window.__MASSFRONT_PATCHED,
         channel:window.__MASSFRONT_PATCH_CHANNEL||'stable',
+        manifestRoot:window.__MASSFRONT_PATCH_MANIFEST_ROOT||'',
+        targetRoot:window.__MASSFRONT_PATCH_TARGET_ROOT||'',
+        runtimeRoot:window.__MASSFRONT_PATCH_RUNTIME_ROOT||'',
         at:window.__MASSFRONT_PATCH_AT});
     }).catch(function(){});
   };
@@ -583,7 +835,7 @@
   if(!secure) return;
   window.__mfPwaDiag={supported:true,registered:false,controlled:!!navigator.serviceWorker.controller,error:null};
   window.addEventListener('load',function(){
-    navigator.serviceWorker.register('./sw.js?v=1.33.55-shell2',{scope:'./',updateViaCache:'none'})
+    navigator.serviceWorker.register('./sw.js?v=1.33.60-shell2',{scope:'./',updateViaCache:'none'})
       .then(function(reg){
         window.__mfPwaDiag.registered=true;
         window.__mfPwaDiag.scope=reg.scope;

index.html

@@ -17,19 +17,19 @@
 <meta name="mobile-web-app-capable" content="yes">
 <meta name="theme-color" content="#060c16">
 <meta name="format-detection" content="telephone=no">
-<link rel="apple-touch-icon" href="./assets/icons/icon-180.png?v=1.33.55">
-  <link rel="apple-touch-icon" sizes="152x152" href="./assets/icons/icon-152.png?v=1.33.55">
-  <link rel="apple-touch-startup-image" href="./assets/icons/splash-2732.png?v=1.33.55">
-  <link rel="icon" href="./assets/icons/icon-192.png?v=1.33.55">
-  <link rel="manifest" href="./assets/app.webmanifest?v=1.33.55">
-  <link rel="stylesheet" href="./src/styles/ui.css?v=1.33.55-hud">
-  <link rel="stylesheet" href="./assets/ui.css?v=1.33.55-ui-safety">
-  <link rel="stylesheet" href="./src/styles/auth.css?v=1.33.55">
-  <link rel="stylesheet" href="./src/styles/tutorial.css?v=1.33.55">
-  <link rel="stylesheet" href="./src/styles/ads.css?v=1.33.55">
-  <link rel="stylesheet" href="./src/styles/store.css?v=1.33.55">
-  <link rel="stylesheet" href="./src/styles/restree.css?v=1.33.55">
-  <link rel="stylesheet" href="./src/styles/intro.css?v=1.33.55">
+<link rel="apple-touch-icon" href="./assets/icons/icon-180.png?v=1.33.60">
+  <link rel="apple-touch-icon" sizes="152x152" href="./assets/icons/icon-152.png?v=1.33.60">
+  <link rel="apple-touch-startup-image" href="./assets/icons/splash-2732.png?v=1.33.60">
+  <link rel="icon" href="./assets/icons/icon-192.png?v=1.33.60">
+  <link rel="manifest" href="./assets/app.webmanifest?v=1.33.60">
+<link rel="stylesheet" href="./src/styles/ui.css?v=1.33.60-hud2">
+  <link rel="stylesheet" href="./assets/ui.css?v=1.33.60-ui-safety">
+  <link rel="stylesheet" href="./src/styles/auth.css?v=1.33.60">
+  <link rel="stylesheet" href="./src/styles/tutorial.css?v=1.33.60">
+  <link rel="stylesheet" href="./src/styles/ads.css?v=1.33.60">
+  <link rel="stylesheet" href="./src/styles/store.css?v=1.33.60">
+  <link rel="stylesheet" href="./src/styles/restree.css?v=1.33.60">
+  <link rel="stylesheet" href="./src/styles/intro.css?v=1.33.60">
 <style>
 /* CRITICAL — inline so it holds on the FIRST painted frame even if the linked
    intro.css above is slow or fails. The launch reveal (src/intro.js, z-index 950)
@@ -73,14 +73,17 @@ body:not(.mfIntroDone) .overlay{display:none!important}
   <div id="goalBar" role="status" aria-live="polite"></div>
 </div>
 
-<!-- Was: a truncated profile name ("COMMANDE ▪ LV 1"), an XP bar and a health
-     bar. The name was slice(0,8) of whatever the profile was called, so it read
-     as a different word for most players, and the commander's health is already
-     on the unit itself in the 3D view. Now: rank symbol + level + XP, pinned to
-     the top-left corner. Still tappable to select and center the Commander. -->
+<!-- The upper-left commander locator is both identity and navigation: it uses
+     the chosen commander's canonical portrait/callsign, exposes live HP/XP, and
+     a tap always selects and recentres that commander. -->
 <div id="heroBar" role="button" tabindex="0" aria-label="Select and center the Commander">
-  <div class="heroRow"><span id="heroRankEm">🎗</span><span id="heroLvlTxt">LV 1</span></div>
-  <div id="xpOuter"><div id="xpFill"></div></div>
+  <span id="heroPortrait" aria-hidden="true"><img id="heroPortraitImg" alt=""><i id="heroPortraitFallback">C</i><b id="heroRankEm">🎗</b></span>
+  <span class="heroProfileBody">
+    <span class="heroProfileHead"><strong id="heroNameTxt">COMMANDER</strong><b id="heroLvlTxt">LV 1</b></span>
+    <span id="heroCallsignTxt">FIELD COMMAND</span>
+    <span class="heroVital"><small>HP</small><span class="heroBarOuter"><i id="heroHpFill"></i></span><b id="heroHpTxt">100%</b></span>
+    <span class="heroVital heroXp"><small>XP</small><span id="xpOuter"><i id="xpFill"></i></span><b id="heroXpTxt">0%</b></span>
+  </span>
 </div>
 
 <div id="toast"></div>
@@ -105,11 +108,12 @@ body:not(.mfIntroDone) .overlay{display:none!important}
       </span>
     </div>
   </div>
-  <div id="hudDeckTabs" aria-label="Command dock">
-    <button class="hudDeckBtn on" data-deck="orders"><span>⌁</span>ORDERS</button>
-    <button class="hudDeckBtn" data-deck="platoons"><span>Ⅳ</span>PLATOONS</button>
-    <button class="hudDeckBtn" data-deck="abilities" disabled aria-disabled="true"><span>✦</span>ABILITIES</button>
-    <button class="hudDeckBtn" data-deck="view"><span>◇</span>VIEW</button>
+  <div id="hudDeckTabs" role="tablist" aria-label="Command dock">
+    <button class="hudDeckBtn on" role="tab" aria-selected="true" data-deck="orders"><span>⌁</span>ORDERS</button>
+    <button class="hudDeckBtn" role="tab" aria-selected="false" data-deck="platoons"><span>Ⅳ</span>PLATOONS</button>
+    <button class="hudDeckBtn" role="tab" aria-selected="false" data-deck="buildings"><span>⌂</span>BUILDINGS</button>
+    <button class="hudDeckBtn" role="tab" aria-selected="false" data-deck="abilities" disabled aria-disabled="true"><span>✦</span>ABILITIES</button>
+    <button class="hudDeckBtn" role="tab" aria-selected="false" data-deck="view"><span>◇</span>VIEW</button>
   </div>
   <div class="btnrow" id="camRow">
     <button class="cbtn camBtn" id="rotL"><span class="em">⟲</span><span>Rot</span></button>
@@ -156,7 +160,6 @@ body:not(.mfIntroDone) .overlay{display:none!important}
     <button class="cbtn" id="boxBtn"><span class="em">⬚</span><span>Select</span></button>
     <button class="cbtn" id="stopBtn"><span class="em">✋</span><span>Stop</span></button>
     <button class="cbtn" id="buildBtn"><span class="em">🏗</span><span>Build</span></button>
-    <button class="cbtn" id="baseFindBtn"><span class="em">⌖</span><span>Base</span></button>
   </div>
 </div>
 
@@ -526,30 +529,129 @@ body:not(.mfIntroDone) .overlay{display:none!important}
 <!-- The version block used to sit permanently at the bottom of the menu. It is
      now a status dot in the header — grey unchecked, amber checking or update
      waiting, green current, red failed — and this is where the dot leads. -->
-<div class="overlay" id="updScr">
-  <div class="subMenuHead">
-    <h2>◈ GAME VERSION</h2>
-    <span>Updates · release notes · rollback</span>
-  </div>
-  <div class="updScroll">
-  <div id="updPanel" class="mini">
-    <div class="updHead">
-      <div>
-        <div id="updTxt">GAME VERSION</div>
-        <div id="updSub">v1.32.40</div>
+<!-- GAME LAUNCHER / VERSION CENTER
+     One surface owns both cold-launch readiness and the menu's version detail.
+     The updater keeps its established IDs and authority; src/launcher.js reads
+     explicit updater/auth events and never infers state from the labels below. -->
+<div class="overlay mfLauncher" id="updScr" aria-label="MASSFRONT launcher and game version">
+  <div class="mfLauncherBackdrop" aria-hidden="true"><i></i><i></i><i></i></div>
+  <header class="mfLauncherTop">
+    <div class="mfLauncherTopBrand"><b>MASSFRONT</b><span>COMMAND NETWORK</span></div>
+    <div class="mfLauncherIdentity" id="mfLaunchIdentity" data-state="pending">
+      <i aria-hidden="true"></i><span id="mfLaunchIdentityText">IDENTITY LINK</span>
+    </div>
+  </header>
+  <div class="updScroll mfLauncherScroll" id="mfLauncherScroll">
+    <section class="mfLauncherHero" aria-labelledby="mfLaunchHeroTitle">
+      <div class="mfLauncherHeroArt" aria-hidden="true">
+        <img src="./assets/icons/splash-2732.png?v=1.33.60" alt="" decoding="async">
+        <span class="mfLauncherOrbit"></span><span class="mfLauncherSweep"></span>
       </div>
-      <div class="updBtns">
-        <button id="updCancel" style="display:none">✕</button>
-        <button id="updBtn">CHECK</button>
+      <div class="mfLauncherHeroCopy">
+        <span class="mfLauncherEyebrow">◈ MASSFRONT LAUNCH CONTROL</span>
+        <h2 id="mfLaunchHeroTitle">YOUR COMMAND AWAITS</h2>
+        <p id="mfLaunchHeroSummary">Verifying the installed battlefield and command link.</p>
+        <div class="mfLauncherHeroChips">
+          <span id="mfLaunchVersion">v—</span><span id="mfLaunchCategory">SYSTEM</span><span id="mfLaunchNetwork">CHECKING LINK</span>
+        </div>
       </div>
-    </div>
-    <div id="updBarO"><div id="updBarF"></div></div>
-    <div id="updFeed" style="display:none"></div>
-    <div id="updNotes" style="display:none"></div>
-    <button id="updRoll">↺ Revert to the packaged build</button>
-  </div>
+    </section>
+
+    <section class="mfLauncherConsole" aria-labelledby="mfLaunchUpdateTitle">
+      <div class="mfLauncherSectionHead">
+        <div><span>01</span><h3 id="mfLaunchUpdateTitle">GAME READINESS</h3></div>
+        <b id="mfLaunchPhase">INITIALIZING</b>
+      </div>
+      <div id="updPanel" class="mini">
+        <div class="updHead">
+          <div>
+            <div id="updTxt">GAME VERSION</div>
+            <div id="updSub">Preparing local runtime</div>
+          </div>
+          <div class="updBtns">
+            <button id="updCancel" type="button" aria-label="Cancel update" style="display:none">✕</button>
+            <button id="updBtn" type="button">CHECK</button>
+          </div>
+        </div>
+        <div id="updBarO" role="progressbar" aria-label="Update progress" aria-valuemin="0" aria-valuemax="100" aria-valuenow="0"><div id="updBarF"></div></div>
+        <div class="mfLauncherTelemetry" aria-live="polite">
+          <span><small>TRANSFER</small><b id="mfLaunchTransfer">—</b></span>
+          <span><small>SPEED</small><b id="mfLaunchSpeed">—</b></span>
+          <span><small>INTEGRITY</small><b id="mfLaunchIntegrity">LOCAL</b></span>
+        </div>
+        <div id="updFeed" style="display:none"></div>
+        <div id="updNotes" style="display:none"></div>
+        <button id="updRoll" type="button">↺ Revert to the packaged build</button>
+      </div>
+    </section>
+
+    <section class="mfLauncherRelease" aria-labelledby="mfLaunchReleaseTitle">
+      <div class="mfLauncherSectionHead">
+        <div><span>02</span><h3 id="mfLaunchReleaseTitle">LATEST RELEASE</h3></div>
+        <b id="mfLaunchReleaseVersion">v—</b>
+      </div>
+      <article class="mfLauncherReleaseCard">
+        <div class="mfLauncherReleaseBanner">
+          <span id="mfLaunchReleaseKind">SYSTEM</span>
+          <div><h4 id="mfLaunchReleaseName">COMMAND SYSTEM</h4><p id="mfLaunchReleaseSummary">Release information is loading.</p></div>
+        </div>
+        <div class="mfLauncherTabs" role="tablist" aria-label="Release note sections">
+          <button type="button" class="on" role="tab" aria-selected="true" data-launch-notes="features">FEATURES</button>
+          <button type="button" role="tab" aria-selected="false" data-launch-notes="fixes">BUG FIXES</button>
+          <button type="button" role="tab" aria-selected="false" data-launch-notes="upcoming">UPCOMING</button>
+        </div>
+        <ul id="mfLaunchNoteList" class="mfLauncherNoteList"><li>Preparing release briefing…</li></ul>
+      </article>
+    </section>
+
+    <section class="mfLauncherContent" aria-labelledby="mfLaunchContentTitle">
+      <div class="mfLauncherSectionHead">
+        <div><span>03</span><h3 id="mfLaunchContentTitle">OPTIONAL DOWNLOADS</h3></div>
+        <b>CORE PLAY UNAFFECTED</b>
+      </div>
+      <div class="mfLauncherPackRail">
+        <article class="mfLauncherPack" data-launch-pack="audio">
+          <img src="./assets/icons/icon-512.png?v=1.33.60" alt="MASSFRONT faction command insignia" loading="lazy" decoding="async">
+          <div><span>COMMAND AUDIO</span><h4>VOICES + MUSIC</h4><p>Faction radio, UGA KEEL guidance and the full battle score.</p><small id="mfLaunchPackAudioState">CHECKING</small></div>
+          <button id="mfLaunchPackAudio" type="button">MANAGE</button>
+        </article>
+        <article class="mfLauncherPack onlineOnly" data-launch-pack="galactic">
+          <img src="./assets/textures/planets/war-table/aelos-basecolor-v1.png?v=1.33.60" alt="Aelos planetary surface" loading="lazy" decoding="async">
+          <div><span>EXPANSION MODULE</span><h4>GALACTIC EXPLORATION</h4><p>Optional ship, orbital and planetary campaign content.</p><small id="mfLaunchPackGalacticState">OPTIONAL</small></div>
+          <button id="mfLaunchPackGalactic" type="button">INSTALL</button>
+          <i class="mfRequiresNet">☁ REQUIRES INTERNET</i>
+        </article>
+      </div>
+      <div id="mfLaunchPackProgress"></div>
+    </section>
+
+    <section class="mfLauncherHistory" aria-labelledby="mfLaunchHistoryTitle">
+      <div class="mfLauncherSectionHead">
+        <div><span>04</span><h3 id="mfLaunchHistoryTitle">VERSION HISTORY</h3></div>
+        <b>EVIDENCE-BACKED</b>
+      </div>
+      <div class="mfLauncherTabs mfLauncherHistoryTabs" role="tablist" aria-label="Version history source">
+        <button type="button" class="on" role="tab" aria-selected="true" data-launch-history="published">PUBLISHED</button>
+        <button type="button" role="tab" aria-selected="false" data-launch-history="device">THIS DEVICE</button>
+      </div>
+      <ol id="mfLaunchHistoryList" class="mfLauncherTimeline"><li><b>BUILDING CATALOG</b><span>Verified records are loading.</span></li></ol>
+    </section>
+
+    <details class="mfLauncherDetails" id="mfLaunchDetails">
+      <summary>TECHNICAL DETAILS <span>storage · channel · rollback</span></summary>
+      <div class="mfLauncherDetailGrid">
+        <span><small>INSTALLED</small><b id="mfLaunchTechInstalled">v—</b></span>
+        <span><small>CHANNEL</small><b id="mfLaunchTechChannel">STABLE</b></span>
+        <span><small>NETWORK</small><b id="mfLaunchTechNetwork">CHECKING</b></span>
+        <span><small>AVAILABLE STORAGE</small><b id="mfLaunchTechStorage">—</b></span>
+      </div>
+    </details>
   </div>
-  <div class="warFoot"><button class="mbtn alt" id="updBack">◀ &nbsp;BACK</button></div>
+  <footer class="warFoot mfLauncherFoot">
+    <button class="mbtn alt mfLauncherOfflineAction" id="mfLaunchOffline" type="button">PLAY OFFLINE</button>
+    <button class="accBtn mfLauncherPlay" id="mfLaunchPlay" type="button" data-front-focus disabled>VERIFYING GAME…</button>
+    <button class="mbtn alt" id="updBack" type="button">◀ &nbsp;BACK</button>
+  </footer>
 </div>
 
 <div class="overlay" id="inboxScr">
@@ -707,6 +809,6 @@ body:not(.mfIntroDone) .overlay{display:none!important}
   <button class="mbtn alt" id="pauseSettings">⚙ &nbsp;SETTINGS</button>
   <button class="mbtn alt" id="quitBtn">✦ &nbsp;ABANDON MATCH</button>
 </div>
-<script src="./boot.js?v=1.33.55-boot7"></script>
+<script src="./boot.js?v=1.33.60-boot7"></script>
 </body>
 </html>

src/assetpack.js

@@ -30,42 +30,186 @@
        size; a pack that has not changed costs one small JSON request.
    ============================================================================ */
 
-const PACK = { idx:null, have:{}, busy:false, got:0, total:0, state:'idle', err:'' };
-const PACK_DB = 'massfront-packs', PACK_STORE = 'files';
-const PACK_PREF = 'massfront_pack_pref';       // 'auto' | 'ask' | 'off'
-
-function packDb(){
-  return new Promise((res, rej) => {
-    const r = indexedDB.open(PACK_DB, 1);
-    r.onupgradeneeded = () => { const d = r.result;
-      if(!d.objectStoreNames.contains(PACK_STORE)) d.createObjectStore(PACK_STORE); };
-    r.onsuccess = () => res(r.result); r.onerror = () => rej(r.error);
-  });
-}
-async function packGet(k){
-  const db = await packDb();
-  return new Promise((res, rej) => {
-    const tx = db.transaction(PACK_STORE, 'readonly');
-    const q = tx.objectStore(PACK_STORE).get(k);
-    q.onsuccess = () => res(q.result); q.onerror = () => rej(q.error);
-  });
-}
-async function packPut(k, v){
-  const db = await packDb();
-  return new Promise((res, rej) => {
-    const tx = db.transaction(PACK_STORE, 'readwrite');
-    tx.objectStore(PACK_STORE).put(v, k);
-    tx.oncomplete = () => res(); tx.onerror = () => rej(tx.error);
-  });
-}
-async function packKeys(){
-  const db = await packDb();
-  return new Promise((res, rej) => {
-    const tx = db.transaction(PACK_STORE, 'readonly');
-    const q = tx.objectStore(PACK_STORE).getAllKeys();
-    q.onsuccess = () => res(q.result || []); q.onerror = () => rej(q.error);
-  });
-}
+const PACK = {
+  /* idx/rawIndex describe what the server currently offers. activeIdx/rawActive
+     describe the last fully verified set the game is allowed to mount. Keeping
+     those identities separate is what lets a player keep using v1 while a v2
+     download is declined, interrupted, corrupt or too large for free storage. */
+  idx:null, rawIndex:null, activeIdx:Object.create(null), rawActive:{version:2,packs:{}},
+  have:{}, busy:false, got:0, total:0, state:'idle', err:'', storage:null
+};
+const PACK_DB = 'massfront-packs', PACK_STORE = 'files';
+const PACK_CHUNK_STORE = 'chunks', PACK_META_STORE = 'meta', PACK_DB_VERSION = 2;
+const PACK_PREF = 'massfront_pack_pref';       // 'auto' | 'ask' | 'off'
+/* Two MiB keeps a killed phone from repeating a large transfer, but does not
+   turn IndexedDB into tens of thousands of tiny transactions. Publishers may
+   choose smaller chunks; anything larger than eight MiB is rejected so a bad
+   manifest cannot silently defeat the bounded-memory contract. A single file
+   is capped too: very large products must be sectioned into independent files
+   and packs instead of recreating the old monolithic download problem. */
+const PACK_DEFAULT_CHUNK_BYTES = 2 * 1024 * 1024;
+const PACK_MAX_CHUNK_BYTES = 8 * 1024 * 1024;
+const PACK_MAX_FILE_BYTES = 256 * 1024 * 1024;
+const PACK_MAX_PACKS = 512, PACK_MAX_FILES = 4096, PACK_MAX_CHUNKS_PER_FILE = 4096;
+const PACK_STORAGE_MARGIN_BYTES = 16 * 1024 * 1024;
+
+const PACK_SHA256_K = new Uint32Array([
+  0x428a2f98,0x71374491,0xb5c0fbcf,0xe9b5dba5,0x3956c25b,0x59f111f1,0x923f82a4,0xab1c5ed5,
+  0xd807aa98,0x12835b01,0x243185be,0x550c7dc3,0x72be5d74,0x80deb1fe,0x9bdc06a7,0xc19bf174,
+  0xe49b69c1,0xefbe4786,0x0fc19dc6,0x240ca1cc,0x2de92c6f,0x4a7484aa,0x5cb0a9dc,0x76f988da,
+  0x983e5152,0xa831c66d,0xb00327c8,0xbf597fc7,0xc6e00bf3,0xd5a79147,0x06ca6351,0x14292967,
+  0x27b70a85,0x2e1b2138,0x4d2c6dfc,0x53380d13,0x650a7354,0x766a0abb,0x81c2c92e,0x92722c85,
+  0xa2bfe8a1,0xa81a664b,0xc24b8b70,0xc76c51a3,0xd192e819,0xd6990624,0xf40e3585,0x106aa070,
+  0x19a4c116,0x1e376c08,0x2748774c,0x34b0bcb5,0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3,
+  0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208,0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2
+]);
+
+/* WebCrypto has no streaming digest. Reading a 200+ MiB GLB into one
+   ArrayBuffer merely to verify it would negate chunked delivery, so this small
+   incremental SHA-256 keeps verification bounded to one chunk at a time. */
+class PackSha256State{
+  constructor(){
+    this.h = new Uint32Array([0x6a09e667,0xbb67ae85,0x3c6ef372,0xa54ff53a,0x510e527f,0x9b05688c,0x1f83d9ab,0x5be0cd19]);
+    this.w = new Uint32Array(64);
+    this.buf = new Uint8Array(64);
+    this.bufLen = 0;
+    this.bytes = 0;
+  }
+  block(data, off){
+    const w=this.w;
+    for(let i=0;i<16;i++){
+      const p=off+i*4;
+      w[i]=((data[p]<<24)|(data[p+1]<<16)|(data[p+2]<<8)|data[p+3])>>>0;
+    }
+    for(let i=16;i<64;i++){
+      const x=w[i-15],y=w[i-2];
+      const s0=((x>>>7)|(x<<25))^((x>>>18)|(x<<14))^(x>>>3);
+      const s1=((y>>>17)|(y<<15))^((y>>>19)|(y<<13))^(y>>>10);
+      w[i]=(w[i-16]+s0+w[i-7]+s1)>>>0;
+    }
+    let a=this.h[0],b=this.h[1],c=this.h[2],d=this.h[3];
+    let e=this.h[4],f=this.h[5],g=this.h[6],h=this.h[7];
+    for(let i=0;i<64;i++){
+      const s1=((e>>>6)|(e<<26))^((e>>>11)|(e<<21))^((e>>>25)|(e<<7));
+      const ch=(e&f)^(~e&g);
+      const t1=(h+s1+ch+PACK_SHA256_K[i]+w[i])>>>0;
+      const s0=((a>>>2)|(a<<30))^((a>>>13)|(a<<19))^((a>>>22)|(a<<10));
+      const maj=(a&b)^(a&c)^(b&c);
+      const t2=(s0+maj)>>>0;
+      h=g;g=f;f=e;e=(d+t1)>>>0;d=c;c=b;b=a;a=(t1+t2)>>>0;
+    }
+    this.h[0]=(this.h[0]+a)>>>0;this.h[1]=(this.h[1]+b)>>>0;
+    this.h[2]=(this.h[2]+c)>>>0;this.h[3]=(this.h[3]+d)>>>0;
+    this.h[4]=(this.h[4]+e)>>>0;this.h[5]=(this.h[5]+f)>>>0;
+    this.h[6]=(this.h[6]+g)>>>0;this.h[7]=(this.h[7]+h)>>>0;
+  }
+  update(input){
+    const data=input instanceof Uint8Array?input:new Uint8Array(input);
+    this.bytes+=data.length;
+    let off=0;
+    if(this.bufLen){
+      const n=Math.min(64-this.bufLen,data.length);
+      this.buf.set(data.subarray(0,n),this.bufLen);this.bufLen+=n;off=n;
+      if(this.bufLen===64){this.block(this.buf,0);this.bufLen=0;}
+    }
+    while(off+64<=data.length){this.block(data,off);off+=64;}
+    if(off<data.length){this.buf.set(data.subarray(off),0);this.bufLen=data.length-off;}
+    return this;
+  }
+  hex(){
+    const bitHi=Math.floor(this.bytes/0x20000000),bitLo=(this.bytes*8)>>>0;
+    this.buf[this.bufLen++]=0x80;
+    if(this.bufLen>56){this.buf.fill(0,this.bufLen);this.block(this.buf,0);this.bufLen=0;}
+    this.buf.fill(0,this.bufLen,56);
+    this.buf[56]=(bitHi>>>24)&255;this.buf[57]=(bitHi>>>16)&255;
+    this.buf[58]=(bitHi>>>8)&255;this.buf[59]=bitHi&255;
+    this.buf[60]=(bitLo>>>24)&255;this.buf[61]=(bitLo>>>16)&255;
+    this.buf[62]=(bitLo>>>8)&255;this.buf[63]=bitLo&255;
+    this.block(this.buf,0);
+    return [...this.h].map(n=>n.toString(16).padStart(8,'0')).join('');
+  }
+}
+
+async function packHashBlob(blob, sliceBytes=PACK_DEFAULT_CHUNK_BYTES){
+  const hash=new PackSha256State();
+  for(let off=0;off<blob.size;off+=sliceBytes)
+    hash.update(new Uint8Array(await blob.slice(off,Math.min(blob.size,off+sliceBytes)).arrayBuffer()));
+  return hash.hex();
+}
+
+let packDbPromise=null;
+function packDb(){
+  if(packDbPromise) return packDbPromise;
+  packDbPromise=new Promise((res, rej) => {
+    const r = indexedDB.open(PACK_DB, PACK_DB_VERSION);
+    r.onupgradeneeded = () => { const d = r.result;
+      if(!d.objectStoreNames.contains(PACK_STORE)) d.createObjectStore(PACK_STORE);
+      if(!d.objectStoreNames.contains(PACK_CHUNK_STORE)) d.createObjectStore(PACK_CHUNK_STORE);
+      if(!d.objectStoreNames.contains(PACK_META_STORE)) d.createObjectStore(PACK_META_STORE); };
+    r.onsuccess = () => {
+      r.result.onversionchange=()=>{r.result.close();packDbPromise=null;};
+      res(r.result);
+    };
+    r.onerror = () => {packDbPromise=null;rej(r.error);};
+    r.onblocked=()=>{packDbPromise=null;rej(new Error('Asset-pack storage upgrade is blocked by another tab'));};
+  });
+  return packDbPromise;
+}
+async function packStoreGet(store,k){
+  const db = await packDb();
+  return new Promise((res, rej) => {
+    const tx = db.transaction(store, 'readonly');
+    const q = tx.objectStore(store).get(k);
+    q.onsuccess = () => res(q.result); q.onerror = () => rej(q.error);
+  });
+}
+async function packStorePut(store,k,v){
+  const db = await packDb();
+  return new Promise((res, rej) => {
+    const tx = db.transaction(store, 'readwrite');
+    tx.objectStore(store).put(v, k);
+    tx.oncomplete = () => res(); tx.onerror = () => rej(tx.error);tx.onabort=()=>rej(tx.error);
+  });
+}
+async function packStoreDelete(store,k){
+  const db=await packDb();
+  return new Promise((res,rej)=>{
+    const tx=db.transaction(store,'readwrite');
+    tx.objectStore(store).delete(k);
+    tx.oncomplete=()=>res();tx.onerror=()=>rej(tx.error);tx.onabort=()=>rej(tx.error);
+  });
+}
+async function packKeys(store=PACK_STORE){
+  const db = await packDb();
+  return new Promise((res, rej) => {
+    const tx = db.transaction(store, 'readonly');
+    const q = tx.objectStore(store).getAllKeys();
+    q.onsuccess = () => res(q.result || []); q.onerror = () => rej(q.error);
+  });
+}
+async function packDeletePrefix(store,prefix){
+  const keys=(await packKeys(store)).filter(k=>String(k).startsWith(prefix));
+  if(!keys.length) return 0;
+  const db=await packDb();
+  await new Promise((res,rej)=>{
+    const tx=db.transaction(store,'readwrite'),target=tx.objectStore(store);
+    for(const k of keys) target.delete(k);
+    tx.oncomplete=()=>res();tx.onerror=()=>rej(tx.error);tx.onabort=()=>rej(tx.error);
+  });
+  return keys.length;
+}
+async function packDeleteKeys(store,keys){
+  if(!keys.length) return 0;
+  const db=await packDb();
+  await new Promise((res,rej)=>{
+    const tx=db.transaction(store,'readwrite'),target=tx.objectStore(store);
+    for(const key of keys) target.delete(key);
+    tx.oncomplete=()=>res();tx.onerror=()=>rej(tx.error);tx.onabort=()=>rej(tx.error);
+  });
+  return keys.length;
+}
+const packGet=k=>packStoreGet(PACK_STORE,k);
+const packPut=(k,v)=>packStorePut(PACK_STORE,k,v);
 
 /* The endpoint is the same one the updater resolves — one server, one setting,
    configured in exactly one place. */
@@ -80,79 +224,645 @@ function packBytes(n){
   return n < 1048576 ? (n / 1024).toFixed(0) + ' KB' : (n / 1048576).toFixed(1) + ' MB';
 }
 
-async function packLoadIndex(){
-  if(typeof netAllowed==='function' && !netAllowed()) return null;
-  const base = packEndpoint();
-  if(!base) return null;
-  try{
-    const r = await fetch(base + '/packs.json?t=' + Date.now(), {cache:'no-store'});
-    if(!r.ok) return null;
-    const j = await r.json();
-    PACK.idx = j && j.packs ? j.packs : null;
-    return PACK.idx;
-  }catch(e){ return null; }
-}
-
-/* What is missing, and how many bytes that is. Size is part of the key so a
-   replaced file re-downloads without needing a version number. */
-async function packMissing(pack){
-  if(!PACK.idx || !PACK.idx[pack]) return {files:[], bytes:0};
-  const keys = new Set(await packKeys());
-  const out = [];
-  let bytes = 0;
-  for(const f of PACK.idx[pack].files){
-    const k = pack + '/' + f.name + ':' + f.size;
-    if(!keys.has(k)){ out.push({...f, key:k}); bytes += f.size; }
-  }
-  return {files:out, bytes};
-}
-
-async function packDownload(pack, onProgress){
-  if(typeof netAllowed==='function' && !netAllowed()){
-    PACK.state='idle'; packRenderBar(); return false;
-  }
-  const base = packEndpoint();
-  if(!base) return false;
-  if(PACK.busy) return false;              // second reader of the flag; see packStarting
-  const miss = await packMissing(pack);
-  if(!miss.files.length){ PACK.state = 'ready'; return true; }
-  PACK.busy = true; PACK.state = 'downloading';
-  PACK.total = miss.bytes; PACK.got = 0;
-  for(const f of miss.files){
-    try{
-      const r = await fetch(base + '/pack/' + pack + '/' + encodeURIComponent(f.name));
-      if(!r.ok) throw new Error('HTTP ' + r.status);
-      const blob = await r.blob();
-      await packPut(f.key, blob);
-      PACK.got += f.size;
-      if(onProgress) onProgress(PACK.got, PACK.total);
-      packRenderBar();
-    }catch(e){
-      PACK.busy = false; PACK.state = 'error';
-      PACK.err = 'Download failed — the game runs without it';
-      packRenderBar();
-      return false;
-    }
-  }
-  PACK.busy = false; PACK.state = 'ready';
-  packRenderBar();
-  return true;
-}
+const PACK_INDEX_META_KEY='index:active';
+const PACK_OFFER_META_KEY='index:offered';
+const PACK_ACTIVE_ROLE='active-v2';
+function packIndexRecord(saved){return saved&&saved.index?saved.index:saved;}
+async function packPersistOffer(raw){
+  await packStorePut(PACK_META_STORE,PACK_OFFER_META_KEY,{role:'offered-v2',index:raw,savedAt:Date.now()});
+}
+async function packPersistActive(raw){
+  const normalized=packNormalizeIndex(raw);
+  /* One IndexedDB record is the activation pointer. Payload Blobs may arrive
+     over many launches, but the game sees all of the new dependency set or
+     none of it because this transaction completes before the in-memory pointer
+     moves. */
+  await packStorePut(PACK_META_STORE,PACK_INDEX_META_KEY,{
+    role:PACK_ACTIVE_ROLE,index:raw,savedAt:Date.now()
+  });
+  PACK.rawActive=raw;PACK.activeIdx=normalized;
+  return normalized;
+}
+function packPackIdentity(pack){
+  if(!pack) return '';
+  return JSON.stringify({
+    format:pack.format,dependencies:pack.dependencies,
+    files:pack.files.map(file=>({
+      name:file.name,size:file.size,sha256:file.sha256,
+      chunks:file.chunks.map(chunk=>[chunk.offset,chunk.size,chunk.sha256])
+    }))
+  });
+}
+async function packOwnFilesReady(index,id){
+  const pack=index&&index[id];
+  if(!pack) return false;
+  for(const file of pack.files) if(!(await packFileReady(id,file))) return false;
+  return true;
+}
+async function packRecoverLegacyActive(raw,index){
+  const packs={},accepted=new Set(),order=[];
+  const seen=new Set();
+  function add(id){if(seen.has(id)) return;seen.add(id);for(const dep of index[id].dependencies)add(dep);order.push(id);}
+  for(const id of Object.keys(index)) add(id);
+  for(const id of order){
+    if(index[id].dependencies.some(dep=>!accepted.has(dep))) continue;
+    if(await packOwnFilesReady(index,id)){packs[id]=raw.packs[id];accepted.add(id);}
+  }
+  return {version:Number(raw.version)||2,packs};
+}
+async function packLoadCachedIndex(){
+  try{
+    const offeredSaved=await packStoreGet(PACK_META_STORE,PACK_OFFER_META_KEY);
+    const activeSaved=await packStoreGet(PACK_META_STORE,PACK_INDEX_META_KEY);
+    const taggedActive=!!(activeSaved&&activeSaved.role===PACK_ACTIVE_ROLE);
+    const legacyRaw=!taggedActive?packIndexRecord(activeSaved):null;
+    let offeredRaw=packIndexRecord(offeredSaved)||legacyRaw;
+    let activeRaw=taggedActive?packIndexRecord(activeSaved):null;
+    if(!offeredRaw&&activeRaw) offeredRaw=activeRaw;
+    if(!offeredRaw) return null;
+    const offered=packNormalizeIndex(offeredRaw);
+    if(!activeRaw){
+      /* v1 stored a server offer under the misleading `index:active` key.
+         Promote only entries whose final Blobs already verify; a merely cached
+         manifest must never become executable authority during migration. */
+      activeRaw=await packRecoverLegacyActive(offeredRaw,offered);
+      try{await packPersistOffer(offeredRaw);}catch(e){}
+      await packPersistActive(activeRaw);
+    }else{
+      PACK.rawActive=activeRaw;PACK.activeIdx=packNormalizeIndex(activeRaw);
+    }
+    PACK.idx=offered;PACK.rawIndex=offeredRaw;
+    return PACK.idx;
+  }catch(e){return null;}
+}
+async function packAdoptInstalledOffers(){
+  if(!PACK.idx||!PACK.rawIndex) return false;
+  const raw={...PACK.rawActive,packs:{...(PACK.rawActive&&PACK.rawActive.packs||{})}};
+  const activeNext={...PACK.activeIdx};
+  let changed=false;
+  const order=[],seen=new Set();
+  function add(id){if(seen.has(id))return;seen.add(id);for(const dep of PACK.idx[id].dependencies)add(dep);order.push(id);}
+  for(const id of Object.keys(PACK.idx)) add(id);
+  for(const id of order){
+    if(activeNext[id]) continue;
+    let depsReady=true;
+    for(const dep of PACK.idx[id].dependencies){
+      const active=activeNext[dep];
+      if(!active||packPackIdentity(active)!==packPackIdentity(PACK.idx[dep])){depsReady=false;break;}
+    }
+    if(!depsReady||!(await packOwnFilesReady(PACK.idx,id))) continue;
+    raw.packs[id]=PACK.rawIndex.packs[id];
+    /* Make this entry visible to later nodes in the same topological pass, but
+       do not move the live pointer before the IDB activation record commits. */
+    activeNext[id]=PACK.idx[id];
+    changed=true;
+  }
+  if(changed) await packPersistActive(raw);
+  return changed;
+}
+async function packLoadIndex(){
+  if(PACK.busy&&PACK.idx) return PACK.idx;
+  const cached=await packLoadCachedIndex();
+  if(typeof netAllowed==='function' && !netAllowed()) return cached;
+  const base = packEndpoint();
+  if(!base) return cached;
+  try{
+    const r = await fetch(base + '/packs.json?t=' + Date.now(), {cache:'no-store'});
+    if(!r.ok) return cached;
+    const j = await r.json();
+    let merged=j;
+    try{
+      const prior=PACK.rawIndex&&PACK.rawIndex.packs?PACK.rawIndex.packs:{};
+      const local=Object.fromEntries(Object.entries(prior).filter(([,pack])=>pack&&pack.localRegistration));
+      merged={...j,packs:{...local,...j.packs}}; // an official endpoint entry supersedes a local registration.
+    }catch(e){}
+    PACK.idx = packNormalizeIndex(merged);PACK.rawIndex=merged;
+    /* The offer is durable for interrupted downloads, but it is not the mount
+       pointer. packPersistActive() is the sole authority transition. */
+    try{await packPersistOffer(merged);}catch(e){}
+    try{await packAdoptInstalledOffers();}catch(e){}
+    return PACK.idx;
+  }catch(e){
+    if(cached) return cached;
+    PACK.err='Optional content manifest is invalid';return null;
+  }
+}
+
+function packValidId(id){return /^[a-z0-9][a-z0-9._-]{0,63}$/i.test(String(id||''));}
+function packValidPath(name){
+  const p=String(name||'').replace(/\\/g,'/');
+  return p&&!p.startsWith('/')&&!p.split('/').some(s=>!s||s==='.'||s==='..')?p:'';
+}
+function packHash(value){
+  const h=String(value||'').toLowerCase();
+  return /^[a-f0-9]{64}$/.test(h)?h:'';
+}
+function packNormalizeIndex(index){
+  if(!index||typeof index!=='object'||!index.packs||typeof index.packs!=='object') throw new Error('packs');
+  if(Object.keys(index.packs).length>PACK_MAX_PACKS) throw new Error('packs');
+  const out=Object.create(null);
+  for(const [id,raw] of Object.entries(index.packs)){
+    if(!packValidId(id)||!raw||!Array.isArray(raw.files)||raw.files.length>PACK_MAX_FILES) throw new Error('pack');
+    const format=Math.max(1,Number(raw.format||raw.manifestVersion||1)|0);
+    const chunkSize=Number(raw.chunkSize||PACK_DEFAULT_CHUNK_BYTES);
+    if(!Number.isSafeInteger(chunkSize)||chunkSize<1||chunkSize>PACK_MAX_CHUNK_BYTES) throw new Error('chunk-size');
+    const dependencies=Array.isArray(raw.dependencies)?raw.dependencies.map(String):[];
+    if(new Set(dependencies).size!==dependencies.length||dependencies.some(dep=>!packValidId(dep))) throw new Error('dependencies');
+    const seen=new Set(),files=[];
+    let bytes=0;
+    for(const source of raw.files){
+      const name=packValidPath(source&&source.name);
+      const size=Number(source&&source.size);
+      const sha256=packHash(source&&source.sha256);
+      if(!name||seen.has(name)||!Number.isSafeInteger(size)||size<1||size>PACK_MAX_FILE_BYTES) throw new Error('file');
+      if(format>=2&&!sha256) throw new Error('whole-hash');
+      seen.add(name);bytes+=size;
+      let chunks=[];
+      if(Array.isArray(source.chunks)){
+        if(source.chunks.length>PACK_MAX_CHUNKS_PER_FILE) throw new Error('chunks');
+        let offset=0;
+        chunks=source.chunks.map((chunk,index)=>{
+          const at=Number(chunk&&chunk.offset),n=Number(chunk&&chunk.size),hash=packHash(chunk&&chunk.sha256);
+          if(!Number.isSafeInteger(at)||at!==offset||!Number.isSafeInteger(n)||n<1||n>PACK_MAX_CHUNK_BYTES||at+n>size||!hash)
+            throw new Error('chunk');
+          offset+=n;
+          return {index,offset:at,size:n,sha256:hash};
+        });
+        if(offset!==size) throw new Error('chunk-coverage');
+      }else{
+        if(format>=2) throw new Error('chunks');
+        if(Math.ceil(size/chunkSize)>PACK_MAX_CHUNKS_PER_FILE) throw new Error('chunks');
+        for(let offset=0,index=0;offset<size;offset+=chunkSize,index++)
+          chunks.push({index,offset,size:Math.min(chunkSize,size-offset),sha256:''});
+      }
+      files.push({...source,name,size,sha256,chunks});
+    }
+    if(raw.bytes!==undefined&&Number(raw.bytes)!==bytes) throw new Error('pack-bytes');
+    out[id]={...raw,id,format,chunkSize,bytes,files,dependencies};
+  }
+  /* Reject missing edges and cycles at the trust boundary. Install order can
+     then be a small deterministic DFS, and a malformed remote manifest can
+     never recurse forever or silently omit a prerequisite. */
+  const visiting=new Set(),visited=new Set();
+  function visit(id){
+    if(visited.has(id)) return;
+    if(visiting.has(id)) throw new Error('dependency-cycle');
+    visiting.add(id);
+    for(const dep of out[id].dependencies){if(!out[dep]) throw new Error('dependency-missing');visit(dep);}
+    visiting.delete(id);visited.add(id);
+  }
+  for(const id of Object.keys(out)) visit(id);
+  return out;
+}
+async function packRegisterPack(id,raw){
+  if(!packValidId(id)||!raw) throw new Error('pack');
+  const base=PACK.rawIndex&&PACK.rawIndex.packs?PACK.rawIndex:{version:2,packs:{}};
+  const merged={...base,packs:{...base.packs,[id]:{...raw,localRegistration:true}}};
+  const normalized=packNormalizeIndex(merged);
+  PACK.rawIndex=merged;PACK.idx=normalized;
+  await packPersistOffer(merged);
+  return normalized[id];
+}
+function packLegacyFileKey(pack,file){return pack+'/'+file.name+':'+file.size;}
+function packFileKey(pack,file){
+  const legacy=packLegacyFileKey(pack,file);
+  return file.sha256?legacy+':sha256:'+file.sha256:legacy;
+}
+function packMetaKey(pack,file,storageKey=packFileKey(pack,file)){return 'file:'+storageKey;}
+function packChunkPrefix(pack,file){return pack+'/'+file.name+':'+file.size+':'+(file.sha256||'legacy')+':chunk:';}
+function packChunkKey(pack,file,chunk){return packChunkPrefix(pack,file)+chunk.index;}
+function packStoredBlob(value){return value instanceof Blob?value:(value&&value.blob instanceof Blob?value.blob:null);}
+async function packStoredFinal(pack,file){
+  const key=packFileKey(pack,file);
+  let blob=packStoredBlob(await packGet(key));
+  if(blob) return {key,blob};
+  const legacyKey=packLegacyFileKey(pack,file);
+  if(legacyKey!==key){
+    blob=packStoredBlob(await packGet(legacyKey));
+    if(blob) return {key:legacyKey,blob};
+  }
+  return {key,blob:null};
+}
+async function packFileReady(pack,file,{forceHash=false}={}){
+  const stored=await packStoredFinal(pack,file),blob=stored.blob;
+  if(!blob||blob.size!==file.size) return false;
+  if(!file.sha256) return true; // v1 manifests and their legacy Blobs remain playable.
+  const metaKey=packMetaKey(pack,file,stored.key);
+  const meta=await packStoreGet(PACK_META_STORE,metaKey);
+  if(!forceHash&&meta&&meta.sha256===file.sha256&&meta.size===file.size) return true;
+  const actual=await packHashBlob(blob,file.chunkSize||PACK_DEFAULT_CHUNK_BYTES);
+  if(actual!==file.sha256) return false;
+  await packStorePut(PACK_META_STORE,metaKey,{sha256:actual,size:file.size,verifiedAt:Date.now()});
+  return true;
+}
+async function packStoredChunk(pack,file,chunk){
+  const value=await packStoreGet(PACK_CHUNK_STORE,packChunkKey(pack,file,chunk));
+  const blob=packStoredBlob(value);
+  if(!blob||blob.size!==chunk.size) return null;
+  if(chunk.sha256){
+    /* IDB is durable, not an integrity oracle. A killed or externally damaged
+       record can retain its old metadata, so always re-hash persisted chunks
+       before resuming instead of trusting value.sha256. */
+    if(await packHashBlob(blob,chunk.size)!==chunk.sha256) return null;
+  }
+  return blob;
+}
+async function packResumeState(pack,file){
+  const present=new Map();let bytes=0;
+  for(const chunk of file.chunks){
+    const blob=await packStoredChunk(pack,file,chunk);
+    if(blob){present.set(chunk.index,blob);bytes+=chunk.size;}
+  }
+  return {present,bytes,remaining:file.size-bytes};
+}
+
+/* What is missing, including already-persisted partial chunks. Hashed finals
+   use content identities so a same-size replacement cannot overwrite the live
+   version before activation; packStoredFinal keeps the v1 name+size key as a
+   read-compatible fallback for existing voice/music installs. */
+async function packMissing(pack,options={},index=PACK.idx){
+  if(!index || !index[pack]) return {files:[], bytes:0};
+  const out = [];
+  let bytes = 0,storedBytes=0;
+  for(const f of index[pack].files){
+    if(await packFileReady(pack,f,{forceHash:!!options.forceHash})){storedBytes+=f.size;continue;}
+    const resume=await packResumeState(pack,f);
+    out.push({...f,key:packFileKey(pack,f),remainingBytes:resume.remaining});
+    bytes+=resume.remaining;storedBytes+=resume.bytes;
+  }
+  return {files:out,bytes,storedBytes,totalBytes:index[pack].bytes};
+}
+
+function packFail(code,message){const e=new Error(message||code);e.code=code;throw e;}
+function packFileUrl(base,pack,file,meta){
+  meta=meta||(PACK.idx&&PACK.idx[pack]);
+  if(meta&&meta.baseUrl){
+    const root=String(meta.baseUrl).replace(/\/?$/,'/');
+    const url=root+file.name.split('/').map(encodeURIComponent).join('/');
+    const query=String(meta.downloadQuery||'');
+    return url+(query&&url.indexOf('?')<0?(query.startsWith('?')?query:'?'+query):'');
+  }
+  return String(base||'').replace(/\/$/,'')+'/pack/'+encodeURIComponent(pack)+'/'
+    +file.name.split('/').map(encodeURIComponent).join('/');
+}
+async function packStoragePreflight(pack,missing){
+  const largest=missing.files.reduce((n,f)=>Math.max(n,f.size),0);
+  const margin=missing.bytes?Math.max(PACK_STORAGE_MARGIN_BYTES,Math.ceil(missing.bytes*.08)):0;
+  const required=missing.bytes+largest+margin;
+  const storage=typeof navigator!=='undefined'&&navigator.storage;
+  if(!storage||typeof storage.estimate!=='function')
+    return {ok:true,supported:false,pack,required,available:null,quota:null,usage:null};
+  try{
+    const estimate=await storage.estimate();
+    const quota=Number(estimate.quota),usage=Number(estimate.usage||0);
+    const available=Number.isFinite(quota)?Math.max(0,quota-usage):null;
+    return {ok:available===null||available>=required,supported:true,pack,required,available,quota,usage};
+  }catch(e){return {ok:true,supported:false,pack,required,available:null,quota:null,usage:null};}
+}
+async function packClearChunks(pack,file){await packDeletePrefix(PACK_CHUNK_STORE,packChunkPrefix(pack,file));}
+function packDropURL(pack,name){
+  const key=pack+'/'+name,entry=packURLs[key],url=entry&&entry.url||entry;
+  if(url&&typeof URL.revokeObjectURL==='function') try{URL.revokeObjectURL(url);}catch(e){}
+  delete packURLs[key];
+}
+async function packCommitFullResponse(pack,file,response,onBytes,resume){
+  /* A 200 response means the origin ignored Range. Consume its body as a
+     stream and commit only complete manifest chunks; response.blob() would
+     recreate the exact monolithic allocation this subsystem exists to avoid.
+     Completed chunks survive a short response or killed tab and are reused on
+     the next attempt. Browsers without response streaming fail closed here;
+     the origin must honor Range for them. */
+  const reader=response.body&&typeof response.body.getReader==='function'?response.body.getReader():null;
+  if(!reader) packFail('range-stream','Range was ignored and bounded response streaming is unavailable');
+  const whole=new PackSha256State();
+  let total=0,index=0,chunk=file.chunks[0],filled=0;
+  let buffer=chunk?new Uint8Array(chunk.size):null;
+  try{
+    while(true){
+      const read=await reader.read();
+      if(read.done) break;
+      const data=read.value instanceof Uint8Array?read.value:new Uint8Array(read.value||0);
+      if(total+data.length>file.size) packFail('range-ignored-size','Ignored Range response exceeds manifest size');
+      whole.update(data);total+=data.length;
+      let at=0;
+      while(at<data.length){
+        if(!chunk) packFail('range-ignored-size','Ignored Range response exceeds manifest chunks');
+        const n=Math.min(chunk.size-filled,data.length-at);
+        buffer.set(data.subarray(at,at+n),filled);filled+=n;at+=n;
+        if(filled===chunk.size){
+          const actual=new PackSha256State().update(buffer).hex();
+          if(chunk.sha256&&actual!==chunk.sha256) packFail('chunk-hash','Full response chunk hash failed');
+          const reusable=!!chunk.sha256&&resume.present.has(chunk.index);
+          if(!reusable){
+            await packStorePut(PACK_CHUNK_STORE,packChunkKey(pack,file,chunk),{
+              blob:new Blob([buffer],{type:file.type||'application/octet-stream'}),
+              size:chunk.size,sha256:chunk.sha256||actual
+            });
+            if(onBytes&&!resume.present.has(chunk.index)) onBytes(chunk.size);
+          }
+          chunk=file.chunks[++index];filled=0;
+          buffer=chunk?new Uint8Array(chunk.size):null;
+        }
+      }
+    }
+  }catch(e){try{await reader.cancel();}catch(ignore){}throw e;}
+  if(total!==file.size||index!==file.chunks.length||filled)
+    packFail('range-ignored-size','Ignored Range response ended before manifest size');
+  const actual=whole.hex();
+  if(file.sha256&&actual!==file.sha256){
+    /* Synthetic legacy chunks carry no individual hashes. Keeping them after
+       a whole-file failure poisons every retry because size alone would make
+       the bad records look resumable. Clear the identity as one unit. */
+    await packClearChunks(pack,file);
+    packFail('file-hash','Whole-file hash failed');
+  }
+  await packAssembleFile(pack,file);
+}
+async function packFetchChunk(base,pack,file,chunk,packMeta){
+  const end=chunk.offset+chunk.size-1;
+  const response=await fetch(packFileUrl(base,pack,file,packMeta),{
+    cache:'no-store',headers:{Range:'bytes='+chunk.offset+'-'+end}
+  });
+  if(!response.ok) packFail('http','HTTP '+response.status);
+  if(response.status===200){
+    /* A CDN may legally ignore Range. Treat that as one explicit full-file
+       fallback, never as the requested chunk, or each loop iteration would
+       download and append the entire object again. */
+    return {fullResponse:response};
+  }
+  if(response.status!==206) packFail('range-status','Unexpected Range response');
+  const blob=await response.blob();
+  const contentRange=response.headers&&response.headers.get&&response.headers.get('content-range');
+  const match=/^bytes\s+(\d+)-(\d+)\/(\d+)$/i.exec(String(contentRange||''));
+  if(!match||Number(match[1])!==chunk.offset||Number(match[2])!==end||Number(match[3])!==file.size)
+    packFail('content-range','Content-Range does not match request');
+  if(blob.size!==chunk.size) packFail('chunk-size','Chunk size does not match manifest');
+  const hash=await packHashBlob(blob,chunk.size);
+  if(chunk.sha256&&hash!==chunk.sha256) packFail('chunk-hash','Chunk hash failed');
+  return {chunk:blob,sha256:hash};
+}
+async function packAssembleFile(pack,file){
+  const parts=[],hash=new PackSha256State();let size=0;
+  for(const chunk of file.chunks){
+    const blob=await packStoredChunk(pack,file,chunk);
+    if(!blob) packFail('chunk-missing','Verified chunk disappeared before assembly');
+    const bytes=new Uint8Array(await blob.arrayBuffer());
+    hash.update(bytes);parts.push(blob);size+=blob.size;
+  }
+  if(size!==file.size) packFail('size','Assembled size does not match manifest');
+  const actual=hash.hex();
+  if(file.sha256&&actual!==file.sha256){
+    await packClearChunks(pack,file);
+    packFail('file-hash','Whole-file hash failed');
+  }
+  const blob=new Blob(parts,{type:file.type||'application/octet-stream'});
+  packDropURL(pack,file.name);
+  await packPut(packFileKey(pack,file),blob);
+  if(file.sha256) await packStorePut(PACK_META_STORE,packMetaKey(pack,file),{sha256:actual,size:file.size,verifiedAt:Date.now()});
+  await packClearChunks(pack,file);
+}
+async function packDownloadFile(base,pack,file,onBytes,packMeta){
+  /* Keep the prior final Blob until the replacement has passed every chunk and
+     whole-file hash. packPut() is the atomic identity swap; deleting first made
+     an interrupted Repair destroy the last-known-good offline copy. */
+  const resume=await packResumeState(pack,file);
+  for(const chunk of file.chunks){
+    if(resume.present.has(chunk.index)) continue;
+    const received=await packFetchChunk(base,pack,file,chunk,packMeta);
+    if(received.fullResponse){
+      await packCommitFullResponse(pack,file,received.fullResponse,onBytes,resume);
+      return;
+    }
+    await packStorePut(PACK_CHUNK_STORE,packChunkKey(pack,file,chunk),{
+      blob:received.chunk,size:chunk.size,sha256:chunk.sha256||received.sha256
+    });
+    if(onBytes) onBytes(chunk.size);
+  }
+  await packAssembleFile(pack,file);
+}
+function packDependencyOrder(pack,index=PACK.idx){
+  const order=[],seen=new Set();
+  function add(id){if(seen.has(id)) return;seen.add(id);for(const dep of index[id].dependencies) add(dep);order.push(id);}
+  add(pack);return order;
+}
+async function packPlan(pack,{forceHash=false,index=PACK.idx}={}){
+  const order=packDependencyOrder(pack,index),byPack=[],files=[];
+  let bytes=0,storedBytes=0;
+  for(const id of order){
+    const missing=await packMissing(id,{forceHash},index);
+    byPack.push({pack:id,meta:index[id],missing});bytes+=missing.bytes;storedBytes+=missing.storedBytes;
+    for(const file of missing.files) files.push(file);
+  }
+  return {order,byPack,files,bytes,storedBytes};
+}
+async function packGcPromotedPack(pack){
+  const active=PACK.activeIdx&&PACK.activeIdx[pack];
+  if(!active) return {files:0,chunks:0,metadata:0};
+  const filePrefix=pack+'/',metaPrefix='file:'+filePrefix;
+  const keepFiles=new Set(),keepMeta=new Set();
+  for(const file of active.files){
+    const stored=await packStoredFinal(pack,file);
+    if(stored.blob){keepFiles.add(stored.key);keepMeta.add(packMetaKey(pack,file,stored.key));}
+  }
+  const staleFiles=(await packKeys(PACK_STORE)).filter(key=>{
+    const value=String(key);return value.startsWith(filePrefix)&&!keepFiles.has(value);
+  });
+  const staleMeta=(await packKeys(PACK_META_STORE)).filter(key=>{
+    const value=String(key);return value.startsWith(metaPrefix)&&!keepMeta.has(value);
+  });
+  /* Promotion proves every active file has a verified final Blob. No chunk is
+     still needed by that identity, and any older hash/size identity is now
+     unreachable. Clearing only this pack namespace preserves dependencies and
+     every independently installed optional pack. */
+  const staleChunks=(await packKeys(PACK_CHUNK_STORE)).filter(key=>String(key).startsWith(filePrefix));
+  return {
+    files:await packDeleteKeys(PACK_STORE,staleFiles),
+    chunks:await packDeleteKeys(PACK_CHUNK_STORE,staleChunks),
+    metadata:await packDeleteKeys(PACK_META_STORE,staleMeta)
+  };
+}
+async function packPromotePlan(plan,index,rawIndex){
+  for(const id of plan.order){
+    const remaining=await packMissing(id,{},index);
+    if(remaining.files.length) packFail('verify','Pack cannot activate before every file verifies');
+  }
+  const packs={...(PACK.rawActive&&PACK.rawActive.packs||{})};
+  for(const id of plan.order){
+    if(!rawIndex||!rawIndex.packs||!rawIndex.packs[id]) packFail('manifest','Pack offer changed before activation');
+    packs[id]=rawIndex.packs[id];
+  }
+  const next={...(PACK.rawActive||{}),version:Number(rawIndex&&rawIndex.version)||2,packs};
+  await packPersistActive(next);
+  const gc={};
+  for(const id of plan.order){
+    try{gc[id]=await packGcPromotedPack(id);}
+    catch(e){gc[id]={error:e&&e.message||String(e)};}
+  }
+  return gc;
+}
+function packJournalKey(pack){return 'journal:'+pack;}
+async function packInstallPack(pack,options={}){
+  if(!packValidId(pack)) return {ok:false,reason:'pack-id'};
+  if(PACK.busy) return {ok:false,reason:'busy'};
+  PACK.busy=true;PACK.state='downloading';PACK.err='';
+  try{
+    /* Own the operation before the first await. Otherwise two callers that
+       both need packs.json can pass the busy check and begin parallel writes. */
+    const idx=PACK.idx||await packLoadIndex();
+    if(!idx||!idx[pack]){PACK.state='error';PACK.err='Optional content manifest is unavailable';return {ok:false,reason:'manifest'};}
+    const offerIndex=idx,offerRaw=PACK.rawIndex;
+    const plan=await packPlan(pack,{forceHash:!!options.repair,index:offerIndex});
+    if(!plan.files.length){
+      const gc=await packPromotePlan(plan,offerIndex,offerRaw);
+      PACK.state='ready';return {ok:true,pack,packs:plan.order,installed:true,downloaded:0,gc};
+    }
+    if(typeof netAllowed==='function'&&!netAllowed()){
+      PACK.state='error';PACK.err='Optional content is unavailable while offline';
+      return {ok:false,reason:'offline'};
+    }
+    const storage=await packStoragePreflight(pack,plan);PACK.storage=storage;
+    if(!storage.ok){
+      PACK.state='error';PACK.err='Not enough storage for this optional pack';
+      return {ok:false,reason:'storage',storage};
+    }
+    const base=packEndpoint();
+    if(!base&&plan.byPack.some(item=>item.missing.files.length&&!offerIndex[item.pack].baseUrl)){
+      PACK.state='error';PACK.err='Optional content server is unavailable';return {ok:false,reason:'endpoint'};
+    }
+    PACK.total=plan.bytes;PACK.got=0;
+    await packStorePut(PACK_META_STORE,packJournalKey(pack),{
+      state:'installing',pack,dependencies:plan.order,bytes:plan.bytes,startedAt:Date.now()
+    });
+    for(const item of plan.byPack){
+      for(const file of item.missing.files){
+        await packDownloadFile(base,item.pack,file,n=>{
+          PACK.got+=n;
+          if(options.onProgress) options.onProgress(PACK.got,PACK.total,{pack:item.pack,file:file.name});
+          if(options.ui) packRenderBar();
+        },item.meta);
+        await packStorePut(PACK_META_STORE,packJournalKey(pack),{
+          state:'installing',pack,dependencies:plan.order,bytes:plan.bytes,downloaded:PACK.got,
+          completedPack:item.pack,completedFile:file.name,updatedAt:Date.now()
+        });
+      }
+      if((await packMissing(item.pack,{},offerIndex)).files.length) packFail('verify','Pack remained incomplete after install');
+    }
+    const gc=await packPromotePlan(plan,offerIndex,offerRaw);
+    await packStorePut(PACK_META_STORE,packJournalKey(pack),{
+      state:'ready',pack,dependencies:plan.order,bytes:plan.bytes,completedAt:Date.now()
+    });
+    PACK.state='ready';
+    return {ok:true,pack,packs:plan.order,installed:true,downloaded:plan.bytes,storage,gc};
+  }catch(e){
+    PACK.state='error';PACK.err='Download failed — the game runs without it';
+    try{await packStorePut(PACK_META_STORE,packJournalKey(pack),{
+      state:'failed',pack,reason:e&&e.code||'download',updatedAt:Date.now()
+    });}catch(ignore){}
+    return {ok:false,reason:e&&e.code||'download',message:e&&e.message||String(e)};
+  }finally{
+    PACK.busy=false;
+    if(options.ui) packRenderBar();
+  }
+}
+async function packDownload(pack,onProgress){
+  const result=await packInstallPack(pack,{onProgress,ui:true});
+  return !!result.ok;
+}
 
 /* Hand back a playable URL for a pack file, or null if it is not stored. The
    object URL is cached per file — creating a new one on every play would leak a
    blob reference for the lifetime of the document. */
 const packURLs = {};
-async function packURL(pack, name){
-  const k = pack + '/' + name;
-  if(packURLs[k]) return packURLs[k];
-  if(!PACK.idx || !PACK.idx[pack]) return null;
-  const meta = PACK.idx[pack].files.find(f => f.name === name);
-  if(!meta) return null;
-  const blob = await packGet(k + ':' + meta.size);
-  if(!blob) return null;
-  return (packURLs[k] = URL.createObjectURL(blob));
-}
+async function packURL(pack, name){
+  const k = pack + '/' + name;
+  if(!PACK.idx) await packLoadIndex();
+  const active=PACK.activeIdx&&PACK.activeIdx[pack];
+  if(!active) return null;
+  const meta = active.files.find(f => f.name === name);
+  if(!meta) return null;
+  const identity=packFileKey(pack,meta)+':'+(meta.sha256||'legacy');
+  if(packURLs[k]&&packURLs[k].identity===identity) return packURLs[k].url;
+  if(packURLs[k]) packDropURL(pack,name);
+  if(!(await packFileReady(pack,meta))) return null;
+  const blob = (await packStoredFinal(pack,meta)).blob;
+  if(!blob) return null;
+  const url=URL.createObjectURL(blob);
+  packURLs[k]={identity,url};return url;
+}
+
+async function packList(){
+  const idx=PACK.idx||await packLoadIndex();
+  const ids=new Set([...Object.keys(PACK.activeIdx||{}),...Object.keys(idx||{})]);
+  return [...ids].map(id=>{
+    const offer=idx&&idx[id],active=PACK.activeIdx&&PACK.activeIdx[id],pack=offer||active;
+    return {
+      id,label:String(pack.label||id),bytes:pack.bytes,files:pack.files.length,
+      installed:!!active,updateAvailable:!!(active&&offer&&packPackIdentity(active)!==packPackIdentity(offer)),
+      dependencies:Array.isArray(pack.dependencies)?[...pack.dependencies]:[]
+    };
+  });
+}
+async function packStatus(pack,options={}){
+  const idx=PACK.idx||await packLoadIndex();
+  if(!idx||!idx[pack]) return {ok:false,reason:'manifest',pack};
+  const plan=await packPlan(pack,{forceHash:!!options.verify,index:idx});
+  const missing=plan.byPack.find(item=>item.pack===pack).missing;
+  const active=PACK.activeIdx&&PACK.activeIdx[pack];
+  const activePlan=active?await packPlan(pack,{forceHash:!!options.verify,index:PACK.activeIdx}):null;
+  const installed=!!(activePlan&&!activePlan.files.length);
+  return {
+    ok:true,pack,installed,partial:plan.storedBytes>0&&plan.files.length>0,
+    updateAvailable:!!(active&&packPackIdentity(active)!==packPackIdentity(idx[pack])),
+    bytes:idx[pack].bytes,storedBytes:missing.storedBytes,remainingBytes:missing.bytes,
+    missingFiles:missing.files.map(f=>f.name),dependencies:plan.order.filter(id=>id!==pack),
+    missingDependencies:plan.byPack.filter(item=>item.pack!==pack&&item.missing.files.length).map(item=>item.pack)
+  };
+}
+async function packPreflight(pack){
+  const idx=PACK.idx||await packLoadIndex();
+  if(!idx||!idx[pack]) return {ok:false,reason:'manifest',pack};
+  return packStoragePreflight(pack,await packPlan(pack));
+}
+async function packRemove(pack,options={}){
+  if(!packValidId(pack)) return {ok:false,reason:'pack-id'};
+  if(PACK.busy) return {ok:false,reason:'busy'};
+  PACK.busy=true;
+  try{
+    const idx=PACK.idx||await packLoadIndex();
+    const active=PACK.activeIdx||Object.create(null),dependents=[];
+    if(active[pack]){
+      for(const id of Object.keys(active)){
+        if(id!==pack&&packDependencyOrder(id,active).includes(pack)) dependents.push(id);
+      }
+      if(dependents.length&&!options.force) return {ok:false,reason:'dependency',pack,dependents};
+      const deactivate=new Set([pack,...(options.force?dependents:[])]);
+      const packs=Object.fromEntries(Object.entries(PACK.rawActive.packs||{}).filter(([id])=>!deactivate.has(id)));
+      await packPersistActive({...PACK.rawActive,packs});
+    }
+    const files=await packDeletePrefix(PACK_STORE,pack+'/');
+    const chunks=await packDeletePrefix(PACK_CHUNK_STORE,pack+'/');
+    const metadata=await packDeletePrefix(PACK_META_STORE,'file:'+pack+'/');
+    await packStoreDelete(PACK_META_STORE,packJournalKey(pack));
+    for(const key of Object.keys(packURLs)) if(key.startsWith(pack+'/')) packDropURL(pack,key.slice(pack.length+1));
+    return {ok:true,pack,removed:true,files,chunks,metadata};
+  }catch(e){return {ok:false,reason:'storage',message:e&&e.message||String(e)};}
+  finally{PACK.busy=false;}
+}
+
+/* Public, pack-ID-neutral control surface. Audio keeps using packURL() and the
+   legacy start-screen prompt; launcher/settings code can install, verify,
+   repair or remove any manifest pack without learning its IndexedDB layout. */
+const MASSFRONT_ASSET_PACKS=Object.freeze({
+  loadIndex:packLoadIndex,
+  list:packList,
+  status:packStatus,
+  preflight:packPreflight,
+  install:(pack,options)=>packInstallPack(pack,options||{}),
+  repair:(pack,options)=>packInstallPack(pack,{...(options||{}),repair:true}),
+  remove:(pack,options)=>packRemove(pack,options||{}),
+  url:packURL
+});
+if(typeof window!=='undefined') window.MASSFRONT_ASSET_PACKS=MASSFRONT_ASSET_PACKS;
 
 /* ---- UI -------------------------------------------------------------------
    A single line on the start screen, in the same register as the updater panel:
@@ -248,15 +958,19 @@ async function packStartInner(manual){
   if(!want.length){ PACK.state = 'idle'; packRenderBar(); return; }
   let bytes = 0;
   const need = [];
-  for(const p of want){
-    const m = await packMissing(p);
-    if(m.files.length){ need.push(p); bytes += m.bytes; }
-  }
-  PACK.total = bytes;
-  if(!need.length){
-    PACK.state = 'ready'; packRenderBar();
-    if(typeof audAttachPack === 'function') audAttachPack();
-    return;
+  for(const p of want){
+    const m = await packMissing(p);
+    if(m.files.length){ need.push(p); bytes += m.bytes; }
+  }
+  let activeOne=false;
+  for(const p of want){
+    if(PACK.activeIdx[p]&&!(await packPlan(p,{index:PACK.activeIdx})).files.length){activeOne=true;break;}
+  }
+  if(activeOne&&typeof audAttachPack==='function') audAttachPack();
+  PACK.total = bytes;
+  if(!need.length){
+    PACK.state = 'ready'; packRenderBar();
+    return;
   }
   let pref = 'ask';
   try{ pref = localStorage.getItem(PACK_PREF) || 'ask'; }catch(e){}
@@ -274,8 +988,10 @@ async function packStartInner(manual){
      IndexedDB and never hear a note of it, permanently, with no control in
      the UI that would fix it. Re-derived from storage rather than from the
      download results so a pack completed on an EARLIER launch also counts. */
-  let haveOne = false;
-  for(const p of want) if(!(await packMissing(p)).files.length){ haveOne = true; break; }
+  let haveOne = false;
+  for(const p of want){
+    if(PACK.activeIdx[p]&&!(await packPlan(p,{index:PACK.activeIdx})).files.length){haveOne=true;break;}
+  }
   if(haveOne && typeof audAttachPack === 'function') audAttachPack();
   /* A later pack succeeding must not bury an earlier one's failure: PACK.state
      is what the panel reads, and 'ready' hides the panel outright — so voice
@@ -296,25 +1012,30 @@ function initAssetPacks(){
 
 /* Galactic Exploration ships in player APK/www from the signed runtime pack.
    Older installs (notably 1.33.51) omitted it. When the HEAD probe misses, this
-   fetches the remote stub, then the signed manifest, then each file into a
-   dedicated IndexedDB — same blob-keyed pattern as audio packs. A blob: URL for
-   index.html was considered for navigation and rejected: the Galactic entry
+   fetches the remote stub and signed manifest, then registers that manifest
+   with the same bounded pack engine used by audio. The former dedicated DB is
+   read only for verified migration. A blob: URL for index.html was considered
+   for navigation and rejected: the Galactic entry
    ticket lives in this document's sessionStorage, and a blob: document is a
    different origin, so the ticket and the return bridge would vanish. Cache
    here; mfOpenExploration keeps the War Room fallback. Opening still needs the
    files on the same origin (packaged www), which is why player packs include
    the module instead of relying on this download alone. */
-const EXP_PACK_DB='massfront-exploration-pack', EXP_PACK_STORE='files';
-const EXP_PACK_STUB='assets/data/exploration-pack-remote.json';
-let expPackBusy=false;
-
-function expPackDb(){
-  return new Promise((res, rej) => {
-    const r = indexedDB.open(EXP_PACK_DB, 1);
-    r.onupgradeneeded = () => { const d = r.result;
-      if(!d.objectStoreNames.contains(EXP_PACK_STORE)) d.createObjectStore(EXP_PACK_STORE); };
-    r.onsuccess = () => res(r.result); r.onerror = () => rej(r.error);
-  });
+const EXP_PACK_DB='massfront-exploration-pack', EXP_PACK_STORE='files';
+const EXP_PACK_ID='galactic-exploration';
+const EXP_PACK_STUB='assets/data/exploration-pack-remote.json';
+let expPackBusy=false,expPackDbPromise=null;
+
+function expPackDb(){
+  if(expPackDbPromise) return expPackDbPromise;
+  expPackDbPromise=new Promise((res, rej) => {
+    const r = indexedDB.open(EXP_PACK_DB, 1);
+    r.onupgradeneeded = () => { const d = r.result;
+      if(!d.objectStoreNames.contains(EXP_PACK_STORE)) d.createObjectStore(EXP_PACK_STORE); };
+    r.onsuccess = () => {r.result.onversionchange=()=>{r.result.close();expPackDbPromise=null;};res(r.result);};
+    r.onerror = () => {expPackDbPromise=null;rej(r.error);};
+  });
+  return expPackDbPromise;
 }
 async function expPackGet(k){
   const db = await expPackDb();
@@ -323,14 +1044,6 @@ async function expPackGet(k){
     q.onsuccess = () => res(q.result); q.onerror = () => rej(q.error);
   });
 }
-async function expPackPut(k, v){
-  const db = await expPackDb();
-  return new Promise((res, rej) => {
-    const tx = db.transaction(EXP_PACK_STORE, 'readwrite');
-    tx.objectStore(EXP_PACK_STORE).put(v, k);
-    tx.oncomplete = () => res(); tx.onerror = () => rej(tx.error);
-  });
-}
 function expPackJoin(base, rel){
   const root=String(base||'').replace(/\/?$/,'/');
   const path=String(rel||'').replace(/^\/+/,'');
@@ -351,38 +1064,69 @@ async function mfExplorationRemoteSpec(){
   const q=String(stub&&stub.downloadQuery||'');
   return {base,manifest,downloadQuery:q};
 }
-async function mfInstallExplorationPack(){
-  if(expPackBusy) return {ok:false,reason:'busy'};
-  if(typeof indexedDB==='undefined') return {ok:false,reason:'no-idb'};
-  if(typeof netAllowed==='function'&&!netAllowed()) return {ok:false,reason:'offline'};
-  expPackBusy=true;
-  if(typeof toast==='function') toast('Galactic pack downloading...');
-  try{
-    const spec=await mfExplorationRemoteSpec();
+async function mfInstallExplorationPack(){
+  if(expPackBusy) return {ok:false,reason:'busy'};
+  if(typeof indexedDB==='undefined') return {ok:false,reason:'no-idb'};
+  expPackBusy=true;
+  if(typeof toast==='function') toast('Galactic pack downloading...');
+  try{
+    /* A completed generic pack remains discoverable from the cached manifest
+       after an offline restart. Do not require the remote special manifest in
+       that case. */
+    const cached=PACK.idx||await packLoadCachedIndex();
+    if(cached&&cached[EXP_PACK_ID]){
+      const ready=await packStatus(EXP_PACK_ID);
+      if(ready.installed) return {ok:true,cached:true,openUrl:null,pack:EXP_PACK_ID};
+    }
+    if(typeof netAllowed==='function'&&!netAllowed()) return {ok:false,reason:'offline'};
+    const spec=await mfExplorationRemoteSpec();
     if(!spec.manifest&&!spec.base) return {ok:false,reason:'no-endpoint'};
     let manUrl=spec.manifest||expPackJoin(spec.base,'exploration-content-manifest-v1.json');
     if(spec.downloadQuery&&manUrl.indexOf('?')<0) manUrl+=spec.downloadQuery;
-    const mr=await fetch(manUrl,{cache:'no-store'});
-    if(!mr.ok) return {ok:false,reason:'manifest'};
-    const man=await mr.json();
-    if(!man||man.kind!=='ExplorationContentManifestV1'||!Array.isArray(man.files)||!man.files.length)
-      return {ok:false,reason:'manifest'};
-    const q=spec.downloadQuery||'';
-    for(const entry of man.files){
-      const rel=String(entry.path||'').replace(/\\/g,'/');
-      if(!rel||rel.startsWith('/')||rel.includes('..')) return {ok:false,reason:'path'};
-      const have=await expPackGet(rel);
-      if(have&&typeof have.size==='number'&&have.size===entry.bytes) continue;
-      const fileUrl=expPackJoin(spec.base,rel);
-      const url=fileUrl+(q&&fileUrl.indexOf('?')<0?q:'');
-      const fr=await fetch(url,{cache:'no-store'});
-      if(!fr.ok) return {ok:false,reason:'file'};
-      const blob=await fr.blob();
-      await expPackPut(rel, blob);
-    }
-    return {ok:true,cached:true,openUrl:null};
-  }catch(e){
-    return {ok:false,reason:'fetch'};
+    const mr=await fetch(manUrl,{cache:'no-store'});
+    if(!mr.ok) return {ok:false,reason:'manifest'};
+    const man=await mr.json();
+    if(!man||man.kind!=='ExplorationContentManifestV1'||!Array.isArray(man.files)||!man.files.length)
+      return {ok:false,reason:'manifest'};
+    const files=[];
+    for(const entry of man.files){
+      const rel=String(entry.path||'').replace(/\\/g,'/');
+      if(!rel||rel.startsWith('/')||rel.includes('..')) return {ok:false,reason:'path'};
+      const match=/^sha256-([a-f0-9]{64})$/i.exec(String(entry.hash||''));
+      if(!match) return {ok:false,reason:'hash'};
+      files.push({name:rel,size:Number(entry.bytes),sha256:match[1].toLowerCase()});
+    }
+    const bytes=files.reduce((n,file)=>n+file.size,0);
+    if(!Number.isSafeInteger(bytes)||Number(man.totalBytes)!==bytes) return {ok:false,reason:'size'};
+    if(!PACK.idx) await packLoadIndex();
+    const registered=await packRegisterPack(EXP_PACK_ID,{
+      format:1,label:'Galactic Exploration',bytes,chunkSize:PACK_DEFAULT_CHUNK_BYTES,
+      baseUrl:spec.base,downloadQuery:spec.downloadQuery||'',files
+    });
+    const migrationPlan=await packPlan(EXP_PACK_ID);
+    const migrationStorage=await packStoragePreflight(EXP_PACK_ID,migrationPlan);
+    if(!migrationStorage.ok) return {ok:false,reason:'storage',storage:migrationStorage};
+
+    /* 1.33.51 wrote whole, size-only Blobs into a separate database. Import
+       only those that pass the signed manifest's whole-file SHA-256; the old
+       store is otherwise read-only and the generic engine owns all new data,
+       repair, removal, quota checks, Range chunks and offline mounting. */
+    for(const file of registered.files){
+      if(await packFileReady(EXP_PACK_ID,file)) continue;
+      let legacy=null;
+      try{legacy=packStoredBlob(await expPackGet(file.name));}catch(e){}
+      if(!legacy||legacy.size!==file.size) continue;
+      const actual=await packHashBlob(legacy,file.chunkSize);
+      if(actual!==file.sha256) continue;
+      await packPut(packFileKey(EXP_PACK_ID,file),legacy);
+      await packStorePut(PACK_META_STORE,packMetaKey(EXP_PACK_ID,file),{
+        sha256:actual,size:file.size,verifiedAt:Date.now(),migratedFrom:EXP_PACK_DB
+      });
+    }
+    const result=await packInstallPack(EXP_PACK_ID);
+    return {...result,cached:!!result.ok,openUrl:null};
+  }catch(e){
+    return {ok:false,reason:e&&e.code||'fetch',message:e&&e.message||String(e)};
   }finally{
     expPackBusy=false;
   }

src/authportal.js

@@ -74,6 +74,45 @@ let AP_CONFIRM_FOCUS_TOKEN = 0;
 let AP_SYNC_KIND = 'idle';       // idle | busy | success | error
 let AP_SYNC_MESSAGE = '';
 let AP_SESSION_EPOCH = 0;        // invalidates authenticated work across account switches
+let AP_SESSION_VERIFIED = false; // cached tokens stay pending until /me confirms this process
+
+/* The launcher consumes identity as state, never by inspecting portal text or
+   account fields. Keep this payload deliberately small: identity readiness is
+   useful to every front-end surface, while an email, username or bearer token
+   in a broadcast event would be needless exposure to every script on page. */
+let AP_IDENTITY_REVISION = 0;
+let AP_IDENTITY_STATE = Object.freeze({
+  state:'pending', signedIn:false, verified:false, source:'boot', revision:0
+});
+function mfIdentitySnapshot(){
+  return {
+    state:AP_IDENTITY_STATE.state,
+    signedIn:AP_IDENTITY_STATE.signedIn,
+    verified:AP_IDENTITY_STATE.verified,
+    source:AP_IDENTITY_STATE.source,
+    revision:AP_IDENTITY_STATE.revision
+  };
+}
+function apIdentitySet(state, source){
+  const cleanState=state==='connected'||state==='offline'?state:'pending';
+  const cleanSource=String(source||'unknown').replace(/[^a-z0-9_-]/gi,'').slice(0,40)||'unknown';
+  AP_IDENTITY_STATE=Object.freeze({
+    state:cleanState,
+    signedIn:!!(AP_SESSION&&AP_SESSION.token),
+    verified:cleanState==='connected'&&!!AP_SESSION_VERIFIED,
+    source:cleanSource,
+    revision:++AP_IDENTITY_REVISION
+  });
+  const detail=mfIdentitySnapshot();
+  try{
+    if(typeof window!=='undefined'&&typeof window.dispatchEvent==='function'&&typeof CustomEvent==='function')
+      window.dispatchEvent(new CustomEvent('massfront:identity-state',{detail}));
+  }catch(e){}
+  return detail;
+}
+if(typeof window!=='undefined') window.MFIdentity=Object.freeze({
+  event:'massfront:identity-state', snapshot:mfIdentitySnapshot
+});
 
 const AP_SESSION_KEY = 'massfront_authp_session_v1';
 const AP_URL_KEY = 'massfront_authp_url';
@@ -142,6 +181,7 @@ function apSaveSession(){
   }catch(e){}
 }
 function apLoadSession(){
+  AP_SESSION_VERIFIED = false;
   try{
     const s = localStorage.getItem(AP_SESSION_KEY);
     if (s){
@@ -173,6 +213,7 @@ function apLoadSession(){
 function apClearSession(){
   AP_SESSION_EPOCH++;
   AP_SESSION = null;
+  AP_SESSION_VERIFIED = false;
   apSocialResetCapabilities();
   AP_SYNC_KIND = 'idle'; AP_SYNC_MESSAGE = '';
   apSaveSession();
@@ -182,6 +223,7 @@ function apClearSession(){
      left with no launch prompt at all. Signing out is exactly the moment the
      gate should ask again. */
   try{ localStorage.removeItem(AP_GATE_KEY); }catch(e){}
+  apIdentitySet('pending','signed-out');
   if(typeof renderAccount==='function')renderAccount();
 }
 
@@ -304,11 +346,14 @@ function apSetSessionFrom(data, email){
                     paths into the same field disagreed. */
                  ageOk: (u && 'ageOk' in u) ? !!u.ageOk : null,
                  expiresAt: data.expiresAt || 0 };
+  /* register/login just returned this token from the account server, so this
+     is the one path that may become connected without a separate /me call. */
+  AP_SESSION_VERIFIED = true;
   AP_SYNC_KIND = 'idle';
   AP_SYNC_MESSAGE = '';
   apSaveSession();
   if(typeof renderAccount==='function')renderAccount();
-  apGateSatisfied();
+  apGateSatisfied('connected');
   apGreet();
 }
 /* "Welcome Commander <name>" — shown once per sign-in, on the menu the player
@@ -342,6 +387,29 @@ async function apDeleteAccount(){
 async function apLogin(email, password){
   const data = await apRequest('POST', '/login', { email, password }, false);
   apSetSessionFrom(data, email);
+  /* Backward-compatible identity hydration: older deployed Workers returned a
+     valid login token but omitted the account's persisted username. /me has
+     always returned the canonical row, so query it before the sign-in flow
+     completes. A transient second-request failure does not undo a successful
+     login; boot/session verification will retry it later. */
+  const token=AP_SESSION&&AP_SESSION.token,epoch=AP_SESSION_EPOCH;
+  try{
+    const me=await apRequest('GET','/me',undefined,true);
+    if(AP_SESSION&&AP_SESSION_EPOCH===epoch&&AP_SESSION.token===token&&me&&me.user){
+      if('username' in me.user){
+        const value=String(me.user.username==null?'':me.user.username).trim();
+        AP_SESSION.username=/^[a-z0-9_]{3,16}$/i.test(value)?value:null;
+      }
+      if('ageOk' in me.user)AP_SESSION.ageOk=!!me.user.ageOk;
+      AP_SESSION.email=String(me.user.email||AP_SESSION.email).trim().toLowerCase();
+      apSaveSession();
+    }
+  }catch(e){
+    /* apRequest already clears an actually invalid 401 session. Network and
+       old-server failures leave the authenticated session available, and the
+       next /me verification retries without asking the player to sign in. */
+    if(e&&e.status===401)throw e;
+  }
 }
 async function apLogout(){
   try{ await apRequest('POST', '/logout', undefined, true); }catch(e){ /* best-effort — clear locally regardless */ }
@@ -354,6 +422,8 @@ async function apLogout(){
 async function apVerifySession(){
   if (!AP_SESSION) return;
   const token=AP_SESSION.token, epoch=AP_SESSION_EPOCH;
+  AP_SESSION_VERIFIED = false;
+  apIdentitySet('pending','session-verification');
   try{
     const data = await apRequest('GET', '/me', undefined, true);
     if(!AP_SESSION||AP_SESSION_EPOCH!==epoch||AP_SESSION.token!==token) return;
@@ -361,7 +431,9 @@ async function apVerifySession(){
     if (data.user && 'username' in data.user) AP_SESSION.username = data.user.username;
     if (data.user && 'ageOk' in data.user) AP_SESSION.ageOk = !!data.user.ageOk;
     AP_SESSION.offline = false;
+    AP_SESSION_VERIFIED = true;
     apSaveSession();
+    apIdentitySet('connected','session-verified');
   }catch(e){
     if(e.kind==='stale_session') return;
     if (e.status === 401){
@@ -369,7 +441,12 @@ async function apVerifySession(){
          synchronous sign-in callback may already have installed a new one. */
       if(AP_SESSION&&AP_SESSION_EPOCH===epoch&&AP_SESSION.token===token) apClearSession();
       apToast('Your session expired — sign in again.');
-    }else if (AP_SESSION&&AP_SESSION_EPOCH===epoch&&AP_SESSION.token===token) AP_SESSION.offline = true;
+    }else if (AP_SESSION&&AP_SESSION_EPOCH===epoch&&AP_SESSION.token===token){
+      AP_SESSION.offline = true;
+      AP_SESSION_VERIFIED = false;
+      apSaveSession();
+      apIdentitySet('offline','session-unverified');
+    }
   }
   if(typeof renderAccount==='function')renderAccount();
   apRender();
@@ -904,6 +981,7 @@ async function apDoClaimUsername(){
   try{
     const d = await apRequest('POST', '/username', { username: v }, true);
     if (AP_SESSION) { AP_SESSION.username = d.username || v; apSaveSession(); }
+    apSocialResetCapabilities();
     sfx('level'); apToast('✓ Username set to ' + (d.username || v));
   }catch(e){
     sfx('alarm');
@@ -1104,14 +1182,17 @@ function apClose(){
   if (!ov) return;
   /* Dismissing the gate by ✕ counts as answering it — otherwise the same modal
      returns on the next launch and reads as a bug. */
+  let gateDismissed=false;
   if (typeof AP_GATE_OPEN !== 'undefined' && AP_GATE_OPEN){
     AP_GATE_OPEN = false;
+    gateDismissed=true;
     try{ localStorage.setItem(AP_GATE_KEY, '1'); }catch(e){}
   }
   if (typeof apGateFoot === 'function') apGateFoot(false);
   ov.style.display = 'none';
   document.removeEventListener('keydown', apKeyHandler, true);
   if (AP_LAST_FOCUS && AP_LAST_FOCUS.focus) AP_LAST_FOCUS.focus();
+  if(gateDismissed) apIdentitySet('offline','gate-dismissed');
 }
 
 /* ---- build the modal DOM once (createElement/innerHTML, appended to body) --------- */
@@ -1225,9 +1306,14 @@ let AP_GATE_OPEN = false;
 function apGateSeen(){
   try{ return localStorage.getItem(AP_GATE_KEY) === '1'; }catch(e){ return true; }
 }
-function apGateSatisfied(){
+function apGateSatisfied(choice){
   try{ localStorage.setItem(AP_GATE_KEY, '1'); }catch(e){}
   if (AP_GATE_OPEN){ AP_GATE_OPEN = false; apClose(); }
+  if(choice==='offline') return apIdentitySet('offline','offline-choice');
+  if(choice==='connected'&&AP_SESSION_VERIFIED) return apIdentitySet('connected','session-server');
+  if(AP_SESSION&&AP_SESSION_VERIFIED) return apIdentitySet('connected','session-server');
+  if(AP_SESSION) return apIdentitySet('pending','session-verification');
+  return apIdentitySet('offline','offline-choice');
 }
 function apGateFoot(on){
   const box = document.querySelector('#apOverlay .apBox');
@@ -1242,22 +1328,32 @@ function apGateFoot(on){
   box.appendChild(f);
   apTapBind(document.getElementById('apOfflineBtn'), () => {
     if (typeof sfx === 'function'){ try{ sfx('ui'); }catch(e){} }
-    apGateSatisfied();
+    apGateSatisfied('offline');
   });
 }
 /* Called by intro.js the moment the launch title hands off to the front end. */
 function mfAuthGate(){
   try{
-    if (AP_SESSION) return;        // already signed in — nothing to ask
-    if (apGateSeen()) return;      // asked once; never nag again
-    if (!document.getElementById('apOverlay')) return;
+    /* A cached token is not connected merely because it survived a restart.
+       apVerifySession will advance pending to connected or offline. */
+    if (AP_SESSION){
+      if(AP_SESSION_VERIFIED) return apIdentitySet('connected','session-verified');
+      return apIdentitySet('pending','session-verification');
+    }
+    if (apGateSeen()) return apIdentitySet('offline','remembered-offline');
+    if (!document.getElementById('apOverlay')) return apIdentitySet('pending','gate-unavailable');
     AP_GATE_OPEN = true;
+    apIdentitySet('pending','awaiting-choice');
     apGateFoot(true);
     /* On the gate this modal is a welcome, not a settings panel. */
     const t = document.getElementById('apTitleTx');
     if (t) t.textContent = '\u2b21 SIGN IN OR REGISTER';
     apOpen(null);
-  }catch(e){ AP_GATE_OPEN = false; }
+    return mfIdentitySnapshot();
+  }catch(e){
+    AP_GATE_OPEN = false;
+    return apIdentitySet('pending','gate-error');
+  }
 }
 
 /* ---- boot -------------------------------------------------------------------------- */
@@ -1265,6 +1361,7 @@ function initAuthPortal(){
   apBuildUI();
   apInjectMenuButton();
   apLoadSession();
+  if(AP_SESSION) apIdentitySet('pending','session-verification');
   apResolveEndpoint().then(() => {
     apRender();
     if (AP_SESSION) apVerifySession();
@@ -1274,7 +1371,7 @@ function initAuthPortal(){
 /* ============================================================================
    SOCIAL CLIENT — thin, NON-THROWING wrappers over apRequest
    ============================================================================
-   The verification-first server exposes:
+   The authenticated Social server exposes:
 
      GET  /social/friends            -> {friends:[…]}                  (server pre-filters blocks)
      GET  /social/requests           -> {requests:[…]}
@@ -1286,10 +1383,9 @@ function initAuthPortal(){
      POST /social/online/heartbeat       aggregate count only
      GET  /social/online                 aggregate count only
 
-   and refuses an account that may not use social at all with 403 plus one of
-   three codes: 'unverified', 'age_restricted', 'social_banned'. apRequest
-   already lifts {error,message} off a non-2xx body onto e.kind/e.message, so
-   those three arrive here intact.
+   and refuses an account that may not use social with age, username,
+   moderation or ban codes. E-mail verification is optional account metadata
+   and is permanently outside Social and multiplayer authorization.
 
    Everything below RESOLVES. Not one of these functions rejects, because the
    caller is a mailbox section that repaints mid-match: an unhandled rejection
@@ -1354,11 +1450,14 @@ function apSocialFail(e){
     return { ok:false, code:'signed_out',
              message:'Your session expired — sign in again to use friends.' };
   if (kind === 'unverified')
-    return { ok:false, code:'unverified',
-             message: raw || 'Verify your email address before using friends.' };
+    return { ok:false, code:'service_policy',
+             message:'The Social service is using an obsolete access policy — retry after it updates.' };
   if (kind === 'age_restricted')
     return { ok:false, code:'age_restricted',
              message: raw || 'Friends are not available on this account.' };
+  if (kind === 'username_required')
+    return { ok:false, code:'username_required',
+             message: raw || 'Choose your commander username before using Social Command.' };
   if (kind === 'social_banned')
     return { ok:false, code:'social_banned',
              message: raw || 'Friends have been disabled on this account.' };
@@ -1380,7 +1479,36 @@ function apSocialUsername(raw){
   }
   return {ok:true,value};
 }
+function mfSocialIdentity(){
+  let value='';
+  try{value=String(AP_SESSION&&AP_SESSION.username||'').trim();}catch(e){}
+  return {username:AP_SOCIAL_USERNAME_RE.test(value)?value:'',hasUsername:AP_SOCIAL_USERNAME_RE.test(value)};
+}
+function apSocialUsernameGate(){
+  if(!mfSocialSignedIn())return null;
+  return mfSocialIdentity().hasUsername?null:{ok:false,code:'username_required',
+    message:'Choose your commander username before using Social Command.'};
+}
+/* The Social chooser writes the same canonical account field as Account. It
+   does not create a second display name, and it never substitutes a local
+   profile label for server identity. */
+async function socialClaimUsername(raw){
+  const uv=apSocialUsername(raw);if(!uv.ok)return uv.result;
+  if(!mfSocialSignedIn())return {ok:false,code:'signed_out',message:'Sign in before choosing a commander username.'};
+  try{
+    const d=await apRequest('POST','/username',{username:uv.value},true);
+    const value=String(d&&d.username||uv.value).trim();
+    if(!AP_SOCIAL_USERNAME_RE.test(value))return {ok:false,code:'bad_response',message:'The account server returned an invalid username.'};
+    if(AP_SESSION){AP_SESSION.username=value;apSaveSession();}
+    apSocialResetCapabilities();
+    if(typeof renderAccount==='function')try{renderAccount();}catch(e){}
+    if(typeof renderMetaHead==='function')try{renderMetaHead();}catch(e){}
+    return {ok:true,username:value};
+  }catch(e){return apSocialFail(e);}
+}
 async function apSocialOnce(key,work){
+  const usernameGate=apSocialUsernameGate();
+  if(usernameGate)return usernameGate;
   const scoped=(AP_SESSION?AP_SESSION_EPOCH:'guest')+':'+key;
   if(AP_SOCIAL_PENDING.has(scoped)){
     AP_SOCIAL_PROBE.coalesced++;
@@ -1513,6 +1641,7 @@ async function socialReport(u,reason,context){
    bound to AP_SESSION_EPOCH, so it cannot carry across sign-out/sign-in. */
 async function socialHandshake(force){
   if(!mfSocialSignedIn()) return {ok:false,code:'signed_out',message:'Sign in to check social capabilities.'};
+  const usernameGate=apSocialUsernameGate();if(usernameGate)return usernameGate;
   if(!force&&AP_SOCIAL_CAPS.handshake&&AP_SOCIAL_CAPS.sessionEpoch===AP_SESSION_EPOCH&&
      Date.now()-AP_SOCIAL_CAPS.checkedAt<AP_SOCIAL_CAP_TTL_MS)
     return {ok:true,capabilities:mfSocialCapabilities()};
@@ -1885,24 +2014,15 @@ async function socialMatchCredential(match,rules,handoff){
    Accepts either a wrapper result or a bare code string. */
 function mfSocialGate(x){
   const code = (x && typeof x === 'object') ? (x.code || x.kind || '') : String(x || '');
-  if (code === 'unverified'     || code === 'email_unverified') return 'unverified';
   if (code === 'age_restricted' || code === 'age')              return 'age';
   if (code === 'social_banned'  || code === 'banned')           return 'banned';
+  if (code === 'username_required' || code === 'username')      return 'username';
   return 'ok';
 }
-/* The nudge that goes with each gate. Only ONE of the three is actionable —
-   an unverified email is fixed by the player, from the account portal, which
-   is why this lives in the file that owns the portal rather than in the
-   mailbox. Age and ban are stated plainly and offer no button, because
-   offering a button that cannot help is worse than offering none. */
+/* Age and ban are stated plainly and offer no button because account e-mail
+   verification is not, and must never become, a Social access action. */
 function mfSocialNudge(gate){
   const g = mfSocialGate(gate);
-  if (g === 'unverified')
-    return { gate:g,
-             text:'Verify your email address to send and accept friend requests. '+
-                  'Everything else in the game keeps working.',
-             cta:'OPEN ACCOUNT',
-             act:(trigger)=>{ try{ if (typeof apOpen === 'function') apOpen(trigger || null); }catch(e){} } };
   if (g === 'age')
     return { gate:g, text:'Friends are not available on this account.', cta:'', act:null };
   if (g === 'banned')
@@ -1963,6 +2083,7 @@ if(typeof window!=='undefined') window.MFSocial={
   lobbyInvites:socialLobbyInvites,respondLobbyInvite:socialLobbyInviteRespond,
   verifyLobbyCompatibility:socialLobbyCompatibility,launchLobby:socialLobbyLaunch,
   claimMatchCredential:socialMatchCredential,rulesHash:apSocialRulesHash,matchSocketUrl:socialMatchSocketUrl,
-  signedIn:mfSocialSignedIn,capabilities:mfSocialCapabilities,probe:mfSocialProbe
+  signedIn:mfSocialSignedIn,identity:mfSocialIdentity,claimUsername:socialClaimUsername,
+  capabilities:mfSocialCapabilities,probe:mfSocialProbe
 };
 /* ---- end social client ---- */