Merge pull request 'feat(bridge)!: Protocol 3.0 cutover — world.ruleset, points.board, vendor.listing' (#6) from edge into main

Reviewed-on: #6
Reviewed-by: Colby Whitlock <whitlocktech@gmail.com>

.gitea/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,41 @@
+---
+name: Bug report
+about: Report something that is broken or behaving unexpectedly
+title: "[bug] "
+labels:
+  - bug
+---
+
+## Summary
+
+<!-- A clear, concise description of the bug. -->
+
+## Steps to reproduce
+
+1.
+2.
+3.
+
+## Expected behavior
+
+<!-- What you expected to happen. -->
+
+## Actual behavior
+
+<!-- What actually happened. Include exact error messages and logs if you have them. -->
+
+## Environment
+
+- Component / repo:
+- Version or commit:
+- OS / runtime (Node, Rust, ServUO, browser…):
+- Deployment (Docker Compose, local dev, bare metal…):
+
+## Additional context
+
+<!-- Screenshots, config (with secrets redacted), anything else that helps. -->
+
+<!--
+  Security issue? Do NOT file it here. See SECURITY.md and email
+  whitlocktech@gmail.com instead.
+-->

.gitea/ISSUE_TEMPLATE/config.yaml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security vulnerability
+    url: https://gitea.whitlocktech.com/RunicGateway/servuo-plugins/src/branch/main/SECURITY.md
+    about: Please do not open a public issue for security problems — report them privately by email instead (see SECURITY.md).

.gitea/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,23 @@
+---
+name: Feature request
+about: Suggest an idea, enhancement, or new capability
+title: "[feature] "
+labels:
+  - enhancement
+---
+
+## Problem / motivation
+
+<!-- What are you trying to do? What's missing or painful today? -->
+
+## Proposed solution
+
+<!-- What you'd like to see happen. -->
+
+## Alternatives considered
+
+<!-- Other approaches you thought about, and why you prefer the one above. -->
+
+## Additional context
+
+<!-- Mockups, links, related issues, affected component/repo, etc. -->

.gitea/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,33 @@
+<!--
+  Thanks for contributing to Runic Gateway!
+  Please fill out the sections below and check every box before requesting review.
+-->
+
+## What & why
+
+<!-- What does this PR change, and why? Link any related issue: "Closes #123". -->
+
+## How it was tested
+
+<!-- Commands you ran, manual steps, screenshots. -->
+
+## Checklist
+
+- [ ] I have read [CONTRIBUTING.md](CONTRIBUTING.md).
+- [ ] The change builds and existing tests/checks pass locally.
+- [ ] I have added or updated tests/docs where it makes sense.
+- [ ] My commits are reasonably scoped with clear messages.
+
+## AI-assisted contributions (required)
+
+This project **requires disclosure of AI tool usage**. Please pick one:
+
+- [ ] No AI tools were used to produce this contribution.
+- [ ] AI tools were used. Tool(s): `___________`. I have reviewed and understand
+      every change, and take responsibility for it. AI-authored commits are
+      marked with a `Co-Authored-By` / `Assisted-By` trailer.
+
+## License
+
+- [ ] I agree that my contribution is licensed under this project's license
+      (**GNU GPL v3.0 or later**), and I have the right to contribute it.

.gitignore

@@ -0,0 +1,9 @@
+bin/
+obj/
+*.user
+*.suo
+.vs/
+*.dll
+*.exe
+*.pdb
+*.log

CODE_OF_CONDUCT.md

@@ -0,0 +1,133 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, caste, color, religion, or sexual
+identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the overall
+  community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or advances of
+  any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email address,
+  without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official email address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+**whitlocktech@gmail.com**.
+
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of
+actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or permanent
+ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior, harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the
+community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
+
+Community Impact Guidelines were inspired by
+[Mozilla's code of conduct enforcement ladder][Mozilla CoC].
+
+For answers to common questions about this code of conduct, see the FAQ at
+[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at
+[https://www.contributor-covenant.org/translations][translations].
+
+[homepage]: https://www.contributor-covenant.org
+[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
+[Mozilla CoC]: https://github.com/mozilla/diversity
+[FAQ]: https://www.contributor-covenant.org/faq
+[translations]: https://www.contributor-covenant.org/translations

CONTRIBUTING.md

@@ -0,0 +1,95 @@
+# Contributing to Runic Gateway — ServUO Plugin
+
+Thanks for your interest in contributing! This repo is the **C# ServUO side** of
+the game bridge. The shard emits newline-delimited JSON over a loopback TCP
+socket to the Rust sidecar
+([RunicGateway/link](https://gitea.whitlocktech.com/RunicGateway/link)).
+
+By participating you agree to abide by our
+[Code of Conduct](CODE_OF_CONDUCT.md).
+
+## Ways to contribute
+
+- **Report a bug** or **request a feature** through the
+  [issue tracker](https://gitea.whitlocktech.com/RunicGateway/servuo-plugins/issues)
+  (issue templates are provided).
+- **Improve the code or docs** by opening a pull request (see below).
+- **Never** report a security vulnerability in a public issue — see
+  [SECURITY.md](SECURITY.md).
+
+## Development setup
+
+This plugin is deployed as **source** and compiled by ServUO at boot — there is
+no standalone build artifact and no CI build (it needs the ServUO reference
+assemblies to compile). See the [README](README.md) for the full model.
+
+**Key rule:** anything under `overlay/` is authoritative and mirrors the ServUO
+server root. **Do not edit files in a deployed server tree directly** — edit here
+under `overlay/` (or `patches/` for changes to stock ServUO files) and deploy:
+
+```powershell
+# Show what would change, then write it into a ServUO install:
+.\deploy.ps1 -ServerPath C:\path\to\servuo -Verify
+.\deploy.ps1 -ServerPath C:\path\to\servuo
+```
+
+- `overlay/` — copied over an install (the only thing `deploy.ps1` deploys).
+- `patches/` — unified diffs against stock ServUO for files we must modify.
+- `tools/` — never deployed: test scaffolding and stub sidecars.
+
+### Testing
+
+`tools/stub_sidecar.ps1` is a loopback listener that logs every line the shard
+sends — run it, boot the shard, and watch events arrive:
+
+```powershell
+.\tools\stub_sidecar.ps1 -Port 7788 -Log .\sidecar.log
+```
+
+`tools/stub_sidecar_request.ps1` additionally sends inbound requests to exercise
+the request/response handlers. For real end-to-end testing, run against the Rust
+sidecar rather than the throwaway PowerShell stubs.
+
+### Protocol compatibility
+
+The loopback JSON protocol is a **compatibility contract** shared with the
+sidecar. The canonical event/command catalog lives in the
+[docs repo](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link)
+(`PLAN.md` §5/§7 and `INTEGRATION.md`). If you add or change an event or command,
+keep the plugin, the sidecar, and the spec in sync.
+
+## Branch & PR workflow
+
+1. Branch from `main` with a descriptive name
+   (`feature/…`, `fix/…`, `docs/…`, `chore/…`).
+2. Keep changes focused; small PRs are easier to review.
+3. Push and open a pull request against `main`. Fill out the PR template,
+   including the **AI-assisted contributions** disclosure.
+4. A maintainer will review; address feedback with follow-up commits.
+
+### Commit messages
+
+We use [Conventional Commits](https://www.conventionalcommits.org/) —
+`type(scope): summary` (e.g. `feat(bridge): add vendor.sale event`).
+
+## AI-assisted contributions (disclosure required)
+
+This project is developed openly with AI assistance, and we ask the same
+transparency of everyone. **If you used an AI tool** (Claude, Copilot, ChatGPT,
+Cursor, etc.) to help produce a contribution, you must disclose it:
+
+- Tick the AI-usage box in the pull-request template and name the tool(s).
+- Mark AI-authored commits with a trailer, e.g.
+  `Co-Authored-By: Claude <noreply@anthropic.com>` or `Assisted-By: <tool>`.
+- You remain responsible for every line you submit: review it, understand it,
+  and make sure it is correct and that you have the right to contribute it.
+
+Disclosed AI assistance is welcome. Undisclosed AI-generated contributions are
+not, and may be closed.
+
+## License
+
+Runic Gateway is licensed under the **GNU General Public License v3.0 or later**
+(see [LICENSE.md](LICENSE.md)). By submitting a contribution you agree that it is
+licensed under the same terms (inbound = outbound) and that you have the right to
+contribute it.

CONTRIBUTORS.md

@@ -0,0 +1,31 @@
+# Contributors
+
+Runic Gateway is built and maintained by the people and tools listed here.
+Thank you to everyone who has contributed.
+
+## Maintainers
+
+- **whitlocktech** <whitlocktech@gmail.com> — project lead and maintainer
+
+## Contributors
+
+<!--
+  Add yourself here when your contribution is merged — alphabetical by name or
+  handle. One line each:
+
+  - **Name or handle** (optional link) — what you contributed
+-->
+
+- _Your name could be here — see [CONTRIBUTING.md](CONTRIBUTING.md)._
+
+## AI-assisted development
+
+Parts of Runic Gateway were developed with the assistance of AI coding tools,
+including **Claude** (Anthropic) via Claude Code. AI-assisted commits are
+attributed in their commit trailers (e.g. `Co-Authored-By: Claude ...`).
+
+In keeping with this project's transparency policy, **all contributors must
+disclose their use of AI tools** on any contribution — see the
+"AI-assisted contributions" section of [CONTRIBUTING.md](CONTRIBUTING.md).
+Disclosed AI assistance is welcome; undisclosed AI-generated contributions are
+not.

LICENSE.md

@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<https://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<https://www.gnu.org/licenses/why-not-lgpl.html>.

README.md

@@ -0,0 +1,144 @@
+# Runic Gateway — ServUO Plugin
+
+The **C# ServUO side** of the Runic Gateway bridge. The shard emits newline-delimited JSON
+over a loopback TCP socket to the Rust **sidecar** ([RunicGateway/link](https://gitea.whitlocktech.com/RunicGateway/link)),
+which owns the WebSocket the website consumes.
+
+```
+ServUO plugin (C#, net48)  ──loopback TCP, newline-JSON──►  Rust sidecar  ──WebSocket/JSON──►  website
+      (Core-thread reads)  ◄──inbound commands─────────────┘  (owns WS, auth, buffering, fan-out)
+   >>> THIS REPO <<<                                          (RunicGateway/link)
+```
+
+The shard never speaks WebSocket. Every world read happens on the Core thread; the socket is
+touched only by a dedicated writer thread draining a bounded queue.
+
+## Documentation
+
+All project documentation lives in the central **[RunicGateway/docs](https://gitea.whitlocktech.com/RunicGateway/docs)** repo,
+under [`link/`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link) (design docs,
+integration guide, protocol spec, research — with full history preserved).
+
+## Layout
+
+| Path | What |
+|------|------|
+| `overlay/` | Mirrors the ServUO server root. Everything here — and **only** this — copies over an install. |
+| `patches/` | Unified diffs against stock ServUO for files we must modify rather than add. |
+| `tools/` | Never deployed. Test scaffolding (C# probes + PowerShell stub sidecars) and anything else that must not reach a server. |
+| `deploy.ps1` | Copies `overlay/` into a server root. `-Verify` diffs instead of writing. |
+| [INTEGRATION.md](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/INTEGRATION.md) | **Website integration guide** — the WebSocket feed, REST endpoints, auth, event catalog, and examples. |
+| [PLAN.md](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PLAN.md) | Implementation plan, measured performance budget, and the full data catalog. |
+| [RESEARCH.md](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/RESEARCH.md) | Original source-level research. Partly superseded — see the corrections table in `PLAN.md` §8. |
+| [SHARD_PREREQS.md](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/SHARD_PREREQS.md) | Repairs the target shard needed before any of this could load. |
+
+Anything under `overlay/` is authoritative. Do not edit files in the server tree directly — edit here and deploy.
+
+## Sidecar & deployment
+
+The Rust sidecar is the other half of the bridge and lives in **[RunicGateway/link](https://gitea.whitlocktech.com/RunicGateway/link)**.
+The two are deployed **together** but built **independently**:
+
+- **This plugin** is deployed as *source* — `deploy.ps1` copies `overlay/` into the ServUO server
+  root, and ServUO compiles it at boot (`Scripts.csproj`; see [Phase 0](#phase-0--what-it-fixes)).
+  There is no separate build artifact and no CI build — it cannot be compiled standalone without the
+  ServUO reference assemblies.
+- **The sidecar** is a standalone Rust binary, released from its own repo.
+
+The **only** coupling is the loopback JSON protocol (the shard dials out to the sidecar on
+`127.0.0.1`). Compatibility is a **protocol** concern, not a build-order one: keep the event/command
+catalog in sync across the two repos (canonical spec: [PLAN.md](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PLAN.md)
+§5/§7 and [INTEGRATION.md](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/INTEGRATION.md)).
+A wedged or absent sidecar cannot stall the shard, so the plugin can be deployed before, after, or
+without the sidecar running.
+
+## Deploy
+
+```powershell
+.\deploy.ps1 -ServerPath <servuo> -Verify   # show what would change
+.\deploy.ps1 -ServerPath <servuo>           # write
+```
+
+## Status
+
+| Phase | State |
+|------:|-------|
+| 0 — build fix (`Scripts.csproj`) | **done, verified end-to-end** |
+| 1 — transport (`BridgeLink`) | **done, acceptance in [PLAN.md](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PLAN.md) §11** |
+| 2 — event streams (`BridgeEvents`) | **done, acceptance in [PLAN.md](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PLAN.md) §12** |
+| 3 — sweeps (`BridgeSweeps`) | **done, acceptance in [PLAN.md](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PLAN.md) §13** |
+| 4 — request/response (`BridgeRequests`) | **done, acceptance in [PLAN.md](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PLAN.md) §14** |
+| 5 — `[link` account linking (`BridgeAccountLink`) | **done, acceptance in [PLAN.md](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PLAN.md) §15** |
+| 6 — town-crier inbound (`BridgeTownCrier`) | **done, acceptance in [PLAN.md](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PLAN.md) §16** |
+| 7 — `PlayerVendorSale` core event (`patches/` + `BridgeVendorSale`) | **done, acceptance in [PLAN.md](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PLAN.md) §17** |
+
+Every phase on the ServUO side is complete. Phases 0–6 are drop-in (`overlay/`); Phase 7 is the one
+core change, shipped as `patches/`.
+
+Cheat-detection signals are not a separate phase — they are folded into the streams above:
+`cheat.fastwalk`, `audit.set`, `audit.command`, and `vendor.sale` (buyer + owner for laundering detection).
+
+## Phase 0 — what it fixes
+
+`ScriptCompiler.Compile()` runs `dotnet build Scripts/Scripts.csproj -c Release`, prints the output, and **never checks the exit code**, then `Assembly.LoadFrom("Scripts.dll")` and returns `true`. Because that build passed no `Platform`, MSBuild defaulted to `AnyCPU`, and `Scripts.csproj` gated both `OutputPath` and `DefineConstants` on `Configuration|Platform == Release|x64`. So:
+
+- the DLL landed in `Scripts/bin/Release/` while the core loads `Scripts.dll` from the base directory, and
+- `TRACE;NEWTIMERS;ServUO` went undefined, so XmlSpawner compiled its non-ServUO branches.
+
+Runtime script compilation therefore had no effect, silently. `overlay/Scripts/Scripts.csproj` conditions both property groups on `Configuration` alone.
+
+`Server.csproj` is deliberately left alone: nothing under `Server/` uses those symbols, and giving it `OutputPath=..\` would make the boot-time build try to overwrite the running `ServUO.exe`.
+
+## The plugin (Phase 1)
+
+`overlay/Scripts/Custom/Bridge/`:
+
+| File | Responsibility |
+|------|----------------|
+| `BridgeConfig.cs` | Reads `Config/Bridge.cfg` in `Configure()`, before `World.Load`. |
+| `BridgeJson.cs` | Outbound JSON by hand (Core thread, so no reflection serializer). Inbound via `JavaScriptSerializer`. |
+| `BridgeLink.cs` | The socket. Link thread owns it; a bounded drop-oldest queue fronts it; a reader thread marshals inbound lines to the Core thread. |
+| `BridgeBoot.cs` | Lifecycle, inbound dispatch, `[bridge status\|reload\|ping]`. |
+| `BridgeEvents.cs` | EventSink subscriptions (Phase 2). Read-only, player-filtered, never emits secrets. |
+| `BridgeSweeps.cs` | Polled streams (Phase 3): vitals, house decay on transition, economy supply. Core-thread timers. |
+| `BridgeProfile.cs` | Read-model builders (Phase 4): full character profile, account roster. Core-thread reads. |
+| `BridgeRequests.cs` | Inbound request handlers (Phase 4): `char.request`, `account.roster`, `vendor.snapshot`, with `bridge.error` replies. |
+| `BridgeAccountLink.cs` | `[link` account linking (Phase 5): one-time code, `link.confirm`, `WebsiteUserId` account tag. |
+| `BridgeTownCrier.cs` | Town-crier news (Phase 6): inbound `towncrier.add` / `remove` into the global crier list, with abuse caps. |
+
+`Emit()` is called from the Core thread. It enqueues and returns — it never touches the socket, never blocks, never allocates a syscall. **A wedged or absent sidecar cannot stall the shard**, and that is the property everything else depends on.
+
+## Testing
+
+`tools/stub_sidecar.ps1` is a loopback listener that logs every line the shard sends. Run it, boot the shard, watch `server.hello` arrive. It survives a just-killed instance (SO_REUSEADDR) and won't die on a transient error.
+
+```powershell
+.\tools\stub_sidecar.ps1 -Port 7788 -Log .\sidecar.log
+```
+
+`tools/stub_sidecar_request.ps1` additionally *sends* inbound requests (`char.request`, `account.roster`, `vendor.snapshot`, plus an error case) right after the shard connects, and logs the replies — the harness used to validate Phase 4.
+
+Note: the throwaway PowerShell sidecars are fragile — they get reaped and contend on their log file. The real Rust sidecar ([RunicGateway/link](https://gitea.whitlocktech.com/RunicGateway/link)) replaces them; don't read their flakiness as a shard problem. The shard buffers non-perishable events through any outage and reconnects on its own (observed reconnecting 5× unattended in one session).
+
+`tools/scaffolding/` holds the world seeder and the performance probe. Neither is deployed — `deploy.ps1` only copies `overlay/`. They produced the budget in [PLAN.md](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PLAN.md) §1. See `tools/scaffolding/README.md`.
+
+---
+
+## License
+
+Runic Gateway is free software, licensed under the **GNU General Public License
+v3.0 or later** — see [LICENSE.md](LICENSE.md).
+
+    Copyright (C) 2026 Runic Gateway
+
+    This program is free software: you can redistribute it and/or modify it under
+    the terms of the GNU General Public License as published by the Free Software
+    Foundation, either version 3 of the License, or (at your option) any later
+    version. It is distributed WITHOUT ANY WARRANTY; without even the implied
+    warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+    General Public License for more details.
+
+Contributions are welcome — please read [CONTRIBUTING.md](CONTRIBUTING.md) (note
+the **AI-usage disclosure** requirement) and our
+[Code of Conduct](CODE_OF_CONDUCT.md). Report vulnerabilities privately per
+[SECURITY.md](SECURITY.md).

SECURITY.md

@@ -0,0 +1,50 @@
+# Security Policy
+
+Thank you for helping keep Runic Gateway and its users safe.
+
+## Reporting a vulnerability
+
+**Please do not report security vulnerabilities through public issues, pull
+requests, or the wiki.** A public report tips off attackers before a fix is
+available.
+
+Instead, report privately by email to:
+
+**whitlocktech@gmail.com**
+
+Please include as much of the following as you can:
+
+- The repository and component affected.
+- The type of issue (e.g. authentication bypass, injection, secret exposure,
+  remote code execution, denial of service).
+- Step-by-step instructions to reproduce, and a proof-of-concept if you have one.
+- The impact — what an attacker could do with it.
+- Any suggested remediation.
+
+You will receive an acknowledgement of your report, typically within a few days.
+We will keep you informed as we investigate and work toward a fix, and we are
+happy to credit you in the release notes once the issue is resolved (let us know
+if you would prefer to remain anonymous).
+
+## Scope
+
+Runic Gateway is a self-hosted platform made up of several components:
+
+| Component | Repo | Network exposure |
+|---|---|---|
+| Website (site + admin + API) | `RunicGateway/website` | Internet-facing (behind a reverse proxy) |
+| uo-link sidecar | `RunicGateway/link` | The only network-facing part of the game bridge |
+| ServUO plugin | `RunicGateway/servuo-plugins` | Loopback only — dials the sidecar on `127.0.0.1` |
+| Documentation | `RunicGateway/docs` | Content only |
+
+Because instances are self-hosted, the security of any given deployment also
+depends on how it is configured and operated — strong secrets (`JWT_SECRET`,
+`SECRET_ENC_KEY`, database and admin passwords), a correctly configured reverse
+proxy and `TRUST_PROXY`, and keeping the shard itself unreachable from the
+internet (only the sidecar should be exposed). See each repo's README for the
+security model.
+
+## Supported versions
+
+This project is developed continuously and does not maintain long-term release
+branches. Security fixes land on `main`; please run a recent build.

deploy.ps1

@@ -9,8 +9,8 @@
     Run with -Verify first. It reports what would change and touches nothing.
 
 .EXAMPLE
-    .\deploy.ps1 -ServerPath C:\Users\colby\Desktop\servuo -Verify
-    .\deploy.ps1 -ServerPath C:\Users\colby\Desktop\servuo
+    .\deploy.ps1 -ServerPath <servuo> -Verify
+    .\deploy.ps1 -ServerPath <servuo>
 #>
 [CmdletBinding()]
 param(

overlay/Config/Bridge.cfg

@@ -14,7 +14,7 @@ Port=7788
 QueueCap=10000
 
 # Sweep intervals, seconds. Measured on a 150-character shard: a vitals sweep costs
-# 0.0015 ms/char, so 1000 online players is ~1.5 ms per sweep. See docs/PLAN.md §1.
+# 0.0015 ms/char, so 1000 online players is ~1.5 ms per sweep. See https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PLAN.md §1.
 StatSweepSeconds=30
 DecaySweepSeconds=60
 EconomySweepSeconds=300
@@ -29,6 +29,102 @@ ChampSweepSeconds=10
 # support queue; the full open queue is also available on demand via pages.snapshot.
 PageSweepSeconds=5
 
+# Guild roster poll (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PROTOCOL_2.md Part B). Guilds expose only EventSink.JoinGuild, so
+# create/disband/leave/leader/alliance changes are found by diffing BaseGuild.List on this
+# interval (emit guild.update / guild.remove). Guild membership moves slowly; 60s is ample.
+GuildSweepSeconds=60
+
+# Town-governor poll. Each city's Governor / election is diffed on this interval to emit
+# city.update on change. Governors turn over on the order of weeks, so a slow sweep is fine.
+# Idle (emits nothing) unless the City Loyalty system is enabled (CityLoyalty.Enabled).
+CitySweepSeconds=300
+
+# Presence poll. Online population (total, per-facet, per-region) is snapshotted on this
+# interval and emitted as presence.online only when it changes. Region transitions come
+# through separately in real time as region.enter (EventSink.OnEnterRegion).
+PresenceSweepSeconds=30
+
+# Housing registry poll. Every house is diffed on this interval to emit house.update /
+# house.remove (owner, region, location, decay). Houses change slowly; a few minutes is fine.
+HousingSweepSeconds=300
+
+# Points / loyalty leaderboards (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/v3.md §7). ServUO carries ~25 point
+# currencies (Queen's Loyalty, Void Pool, Casino, Clean Up Britannia, the nine city loyalties,
+# the Doom/Khaldun/Kotl treasure systems, …). Each is diffed on this interval and emitted as
+# one points.board frame per system when its top N moves.
+#
+# Slow on purpose: these are month-scale standings, and ten of the systems keep a row for
+# every character ever created, so the pass is the widest read in the bridge. It is still
+# cheap — a single bounded pass, never a sort — but there is nothing to gain by hurrying it.
+PointsSweepSeconds=300
+
+# Master switch for the boards. Off leaves char.profile points alone (see below).
+PointsLeaderboardEnabled=true
+
+# How many players per board. Clamped to 1..100 — the frame is emitted PER SYSTEM, so a big
+# N is multiplied by ~25.
+PointsTopN=10
+
+# Which systems to publish, as a comma-separated list of PointsType names, e.g.
+#   PointsSystems=QueensLoyalty,CleanUpBritannia,VoidPool
+# Blank (the default) publishes whatever the shard itself shows on the in-game loyalty gump
+# (ShowOnLoyaltyGump), so a subsystem you add later gets a board without an edit here.
+# An unrecognized name is logged and ignored, never silently dropped.
+PointsSystems=
+
+# Include a per-character "points" block in char.profile (the website character sheet). This
+# is a lookup across every published system's table, so it is the dominant cost of building a
+# profile; turn it off on a very large shard that does not want the sheet paying for it.
+PointsProfileEnabled=true
+
+# Also compute each system's rank in that block. OFF by default and worth leaving off: a
+# points lookup stops at the character's own row, but a rank must count every row that beats
+# them, in every system, on every profile build. The website already derives rank from the
+# board for anyone in the top N.
+PointsProfileRank=false
+
+# Player-vendor market index (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/v3.md §8). Every player vendor's shop name,
+# owner, location and priced inventory, published as one vendor.listing frame per vendor so the
+# website can offer the search the in-game Vendor Search gump offers. Honours each player's own
+# in-game opt-out (the vendor's VendorSearch flag) — hide your vendor in game and it is hidden
+# on the site too.
+MarketEnabled=true
+
+# Sweep interval. UNLIKE every other sweep here, a tick does NOT walk the whole world: it
+# inventories at most MarketSweepBatch vendors and a persistent cursor round-robins through the
+# rest, so the per-tick cost is bounded by the batch rather than by how many vendors exist. Full
+# coverage takes ceil(vendors / batch) x MarketSweepSeconds — 500 vendors at the defaults is one
+# complete pass every 20 minutes, and the site labels the data with how stale it may be.
+#
+# Lower this (or raise the batch) for faster coverage; both trade directly against per-tick cost,
+# and the expensive part is the item walk, which recurses into every container a vendor is selling.
+MarketSweepSeconds=60
+MarketSweepBatch=25
+
+# Per-vendor listing cap, after which the frame carries "truncated": true. A commodity reseller
+# with thousands of stacked resources is a real thing, and an uncapped frame for one is measured
+# in megabytes. Clamped to 1..5000.
+MarketMaxListings=250
+
+# Shard ruleset (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/v3.md §5). One world.ruleset frame — expansion, which
+# systems are on, skill/stat caps, account and house limits, champion scroll rules —
+# emitted on every sidecar connect (and on [bridge reload), so the website's rules page
+# cannot drift from the server. Not a sweep: it changes only when you edit a .cfg.
+#
+# The frame is built from an explicit allowlist of keys in BridgeRuleset.cs. Server.cfg,
+# Staff.cfg, Email.cfg, DataPath.cfg, Bridge.cfg, Compiler.cfg, Reports.cfg and Client.cfg
+# are never read.
+RulesetEnabled=true
+
+# The one connection detail the bridge will publish, e.g. play.myshard.com,2593. Blank
+# (the default) omits it entirely. Server.cfg's Address/Listen/Port are NEVER published —
+# if you want a connect string on the site, put it here deliberately.
+PublicConnectAddress=
+
+# Include the save/restart schedule (AutoSave frequency, AutoRestart hour) in the frame.
+# Turn off if you would rather not advertise a predictable restart window.
+RulesetIncludeSchedule=true
+
 # Shown to a player when they run [link. The website page where they enter the code.
 LinkUrl=https://yoursite/link
 
@@ -39,6 +135,15 @@ TownCrierMaxLineLength=200
 TownCrierMaxActive=20
 TownCrierMaxDurationSec=86400
 
+# Town Cryer news gump. Website articles (news.add) become entries in the modern Town
+# Cryer News gump (TownCryerSystem.NewsEntries), separate from the scrolling-crier lines
+# above. The article title is also proclaimed by the criers (announce defaults on). Caps
+# are defense in depth on top of the loopback trust boundary.
+NewsMaxTitleLength=100
+NewsMaxBodyLength=2000
+NewsMaxExternal=20
+NewsAnnounceDurationSec=300
+
 # Admin write plane (staff moderation from the website). OFF by default: the whole
 # feature is opt-in per shard. When enabled, inbound admin.* commands (kick/ban/unban/
 # broadcast) are honored. Authorization is enforced on the website; the shard trusts the
@@ -57,6 +162,31 @@ AdminReasonMaxLength=400
 # Clamp on a timed ban's duration, seconds. A ban with no/zero duration is indefinite.
 AdminBanMaxDurationSec=31536000
 
+# Account provisioning (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PROTOCOL_2.md Part A). Which side may mint game accounts:
+#   website — the website is the authority; pair with Accounts.AutoCreateAccounts=false
+#             (else an in-game login of any new name still mints an account).
+#   game    — the game server is the authority; website account.create is refused.
+#   hybrid  — either side may create (the default).
+# The bridge governs only the account.create verb; the in-game first-login auto-create is
+# the core Accounts.AutoCreateAccounts setting, which you pair with the mode above. On boot
+# the bridge warns if the two contradict. An unrecognized value here falls back to 'game'
+# (the safest — no website creation).
+SignupMode=hybrid
+
+# Master switch for the account.create verb. Absent, it follows the mode (on unless
+# SignupMode=game). Set explicitly to force it on or off regardless of mode.
+AccountCreateEnabled=true
+
+# Fail closed if account.create omits a usable browser IP. The per-IP cap
+# (Accounts.AccountsPerIp) only means something if a missing/loopback IP is refused rather
+# than waved through. Turn off only for a deployment that deliberately does not cap website
+# signups by IP (MaxAccountsPerIP still applies in-game either way).
+RequireIpForCreate=true
+
+# Length caps on a website-supplied username / password, checked before the account is made.
+AccountNameMaxLength=16
+AccountPasswordMaxLength=30
+
 # The test scaffolding in tools/scaffolding/ reads its own flags from this file
 # (SeedOnStart, CensusOnStart, ProbeOnStart). They are absent here on purpose:
 # Config.Get returns the default of false when a key is missing, so a deployed

overlay/Scripts/Custom/Bridge/BridgeAccountLink.cs

@@ -18,7 +18,7 @@ namespace Server.Custom.Bridge
     ///          and replies link.ok. The tag persists to accounts.xml across restarts.
     ///
     ///     The code table and the account write both live on the Core thread. The websiteUserId in
-    ///     link.confirm is trusted only because the socket is loopback-only (docs/PLAN.md §2); if the
+    ///     link.confirm is trusted only because the socket is loopback-only (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PLAN.md §2); if the
     ///     sidecar ever moves off-host, gate it behind a shared secret.
     /// </summary>
     public static class BridgeAccountLink
@@ -52,6 +52,7 @@ namespace Server.Custom.Bridge
                 return;
 
             CommandSystem.Register("link", AccessLevel.Player, OnLinkCommand);
+            CommandSystem.Register("unlink", AccessLevel.Player, OnUnlinkCommand);
             BridgeBoot.RegisterHandler("link.confirm", OnLinkConfirm);
 
             // Purge expired codes so an unconfirmed spam of [link cannot grow the table forever.
@@ -127,6 +128,53 @@ namespace Server.Custom.Bridge
                 url, (int)CodeTtl.TotalMinutes);
         }
 
+        // ---- [unlink ----
+
+        [Usage("unlink")]
+        [Description("Unlinks this game account from your website account.")]
+        private static void OnUnlinkCommand(CommandEventArgs e)
+        {
+            Unlink(e.Mobile);
+        }
+
+        /// <summary>
+        ///     Clears the WebsiteUserId tie from the caller's own account and tells the sidecar, so
+        ///     the website can reconcile a player-initiated unlink. Player-scoped (own account only),
+        ///     so it needs no access floor. After unlinking, [link works again.
+        /// </summary>
+        public static void Unlink(Mobile m)
+        {
+            if (m == null)
+                return;
+
+            var acct = m.Account as Account;
+
+            if (acct == null)
+            {
+                m.SendMessage("Bridge: no account on this character.");
+                return;
+            }
+
+            var existing = acct.GetTag(Tag);
+            if (existing == null)
+            {
+                m.SendMessage("Your account is not linked to a website account.");
+                return;
+            }
+
+            acct.RemoveTag(Tag);
+            DropCodesFor(acct.Username); // drop any pending codes so nothing dangles
+
+            BridgeLink.Emit(BridgeJson.Begin("account.unlinked")
+                .Str("origin", "in-game")
+                .Str("account", acct.Username)
+                .Str("websiteUserId", existing)
+                .Str("char", m.Name)
+                .End());
+
+            m.SendMessage(0x40, "Your account is no longer linked to website user {0}.", existing);
+        }
+
         // ---- inbound link.confirm ----
 
         private static void OnLinkConfirm(Dictionary<string, object> o)

overlay/Scripts/Custom/Bridge/BridgeAccounts.cs

@@ -0,0 +1,281 @@
+using System;
+using System.Collections.Generic;
+using System.Net;
+
+using Server.Accounting;
+using Server.Misc;
+
+namespace Server.Custom.Bridge
+{
+    /// <summary>
+    ///     The account provisioning plane (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PROTOCOL_2.md Part A): website-driven account
+    ///     creation and unlinking. Companion to BridgeAccountLink (the in-game [link flow), which
+    ///     is unchanged.
+    ///
+    ///       account.create  — mint a game account and link it to a website user in one step.
+    ///       account.unlink  — sever the WebsiteUserId tie from the website side.
+    ///
+    ///     Both handlers run on the Core thread (BridgeBoot marshals inbound lines through
+    ///     Timer.DelayCall first), so they touch accounts freely.
+    ///
+    ///     Trust model matches the admin plane (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/ADMIN_CONTROLS.md §5): authorization lives on
+    ///     the website; the shard trusts the loopback + token socket and a required "actor" field.
+    ///     The one shard-side floor on unlink is BridgeAdmin.Protected — a protected staff account is
+    ///     never unlinkable from the web. The whole create plane is opt-in via SignupMode /
+    ///     AccountCreateEnabled.
+    /// </summary>
+    public static class BridgeAccounts
+    {
+        private const string Tag = "WebsiteUserId";
+
+        // Mirrors AccountHandler.m_ForbiddenChars so a website-created name behaves exactly like an
+        // in-game one (AccountHandler.cs). Kept local because that array is private.
+        private static readonly char[] ForbiddenChars =
+        {
+            '<', '>', ':', '"', '/', '\\', '|', '?', '*', ' '
+        };
+
+        public static void Initialize()
+        {
+            if (!BridgeConfig.Enabled)
+                return;
+
+            BridgeBoot.RegisterHandler("account.create", OnCreate);
+            BridgeBoot.RegisterHandler("account.unlink", OnUnlink);
+        }
+
+        // ---- account.create ----
+
+        /// <summary>
+        ///     Creates a game account and links it to the given website user. Refused unless the
+        ///     signup mode allows website creation. Enforces the same username/password character
+        ///     safety and per-IP cap as ServUO's in-game create path; the password never leaves the
+        ///     process in any reply, audit, or log.
+        /// </summary>
+        private static void OnCreate(Dictionary<string, object> o)
+        {
+            var reqId = BridgeJson.GetString(o, "reqId");
+            var actor = BridgeJson.GetString(o, "actor");
+            const string action = "create";
+
+            if (!BridgeConfig.AccountCreateEnabled || BridgeConfig.Signup == SignupMode.Game)
+            {
+                Err(reqId, action, "signups disabled for this mode");
+                return;
+            }
+
+            if (String.IsNullOrEmpty(actor) || actor.Trim().Length == 0)
+            {
+                Err(reqId, action, "missing actor");
+                return;
+            }
+
+            var account = BridgeJson.GetString(o, "account");
+            var password = BridgeJson.GetString(o, "password");
+            var webId = BridgeJson.GetString(o, "websiteUserId");
+            var ipStr = BridgeJson.GetString(o, "ip");
+
+            if (String.IsNullOrEmpty(account))
+            {
+                Err(reqId, action, "missing account");
+                return;
+            }
+
+            if (String.IsNullOrEmpty(password))
+            {
+                Err(reqId, action, "missing password");
+                return;
+            }
+
+            if (String.IsNullOrEmpty(webId))
+            {
+                Err(reqId, action, "missing websiteUserId");
+                return;
+            }
+
+            if (account.Length > BridgeConfig.AccountNameMaxLength ||
+                password.Length > BridgeConfig.AccountPasswordMaxLength)
+            {
+                Err(reqId, action, "username or password too long");
+                return;
+            }
+
+            if (!IsSafeUsername(account) || !IsSafePassword(password))
+            {
+                Err(reqId, action, "invalid username/password");
+                return;
+            }
+
+            // Collision: the only correct resolution of a website/in-game race for a name.
+            if (Accounts.GetAccount(account) != null)
+            {
+                Err(reqId, action, "account already exists");
+                return;
+            }
+
+            // Per-IP cap. Fail closed on a missing/loopback IP when RequireIpForCreate — loopback is
+            // exempt in IPLimiter, so accepting it would silently bypass the cap.
+            IPAddress ip;
+            bool haveIp = TryParseIp(ipStr, out ip);
+
+            if (BridgeConfig.RequireIpForCreate && (!haveIp || IPAddress.IsLoopback(ip)))
+            {
+                Err(reqId, action, "client ip required");
+                return;
+            }
+
+            if (haveIp && !AccountHandler.CanCreate(ip))
+            {
+                Err(reqId, action, "ip account limit reached");
+                return;
+            }
+
+            // Create + link. new Account self-registers (Accounts.Add) and hashes the password per
+            // the shard's ProtectPasswords; LogAccess records the IP and bumps IPTable exactly as an
+            // in-game first-login does; the tag persists on the next world save.
+            var acct = new Account(account, password);
+
+            if (haveIp)
+                acct.LogAccess(ip);
+
+            acct.SetTag(Tag, webId);
+
+            Console.WriteLine("[Bridge][account] web:{0} create {1} websiteUserId={2} ip={3}",
+                actor, account, webId, haveIp ? ip.ToString() : "-");
+
+            BridgeLink.Emit(AuditBegin(action, actor, account)
+                .Str("websiteUserId", webId)
+                .End());
+
+            var sb = BridgeJson.Begin("account.ok");
+            if (reqId != null) sb.Str("reqId", reqId);
+            sb.Str("action", action).Str("account", account).Str("websiteUserId", webId);
+            BridgeLink.Emit(sb.End());
+        }
+
+        // ---- account.unlink ----
+
+        /// <summary>
+        ///     Removes the WebsiteUserId tie from an account. Symmetric with the in-game [unlink; the
+        ///     Owner floor keeps a protected staff account unreachable from the web.
+        /// </summary>
+        private static void OnUnlink(Dictionary<string, object> o)
+        {
+            var reqId = BridgeJson.GetString(o, "reqId");
+            var actor = BridgeJson.GetString(o, "actor");
+            const string action = "unlink";
+
+            if (String.IsNullOrEmpty(actor) || actor.Trim().Length == 0)
+            {
+                Err(reqId, action, "missing actor");
+                return;
+            }
+
+            var acct = BridgeAdmin.ResolveTargetAccount(o);
+            if (acct == null)
+            {
+                Err(reqId, action, "unknown or accountless target");
+                return;
+            }
+
+            if (BridgeAdmin.Protected(acct))
+            {
+                Err(reqId, action, "target is protected staff; refused");
+                return;
+            }
+
+            var existing = acct.GetTag(Tag);
+            if (existing == null)
+            {
+                Err(reqId, action, "not linked");
+                return;
+            }
+
+            acct.RemoveTag(Tag);
+
+            Console.WriteLine("[Bridge][account] web:{0} unlink {1} (was websiteUserId={2})",
+                actor, acct.Username, existing);
+
+            BridgeLink.Emit(AuditBegin(action, actor, acct.Username)
+                .Str("websiteUserId", existing)
+                .End());
+
+            var sb = BridgeJson.Begin("account.ok");
+            if (reqId != null) sb.Str("reqId", reqId);
+            sb.Str("action", action).Str("account", acct.Username);
+            BridgeLink.Emit(sb.End());
+        }
+
+        // ---- helpers ----
+
+        private static void Err(string reqId, string action, string reason)
+        {
+            var sb = BridgeJson.Begin("account.error");
+            if (reqId != null) sb.Str("reqId", reqId);
+            if (action != null) sb.Str("action", action);
+            sb.Str("reason", reason);
+            BridgeLink.Emit(sb.End());
+        }
+
+        /// <summary>
+        ///     Opens an account.audit frame (origin=web) broadcast to every dashboard, parallel to
+        ///     admin.audit. Never carries the password.
+        /// </summary>
+        private static System.Text.StringBuilder AuditBegin(string action, string actor, string target)
+        {
+            return BridgeJson.Begin("account.audit")
+                .Str("origin", "web")
+                .Str("action", action)
+                .Str("actor", "web:" + actor)
+                .Str("target", target);
+        }
+
+        /// <summary>Mirrors the username safety rules in AccountHandler.CreateAccount.</summary>
+        private static bool IsSafeUsername(string un)
+        {
+            if (un.StartsWith(" ") || un.EndsWith(" ") || un.EndsWith("."))
+                return false;
+
+            for (int i = 0; i < un.Length; i++)
+            {
+                char c = un[i];
+                if (c < 0x20 || c >= 0x7F || IsForbidden(c))
+                    return false;
+            }
+
+            return true;
+        }
+
+        /// <summary>Mirrors the password safety rules in AccountHandler.CreateAccount.</summary>
+        private static bool IsSafePassword(string pw)
+        {
+            for (int i = 0; i < pw.Length; i++)
+            {
+                char c = pw[i];
+                if (c < 0x20 || c >= 0x7F)
+                    return false;
+            }
+
+            return true;
+        }
+
+        private static bool IsForbidden(char c)
+        {
+            for (int i = 0; i < ForbiddenChars.Length; i++)
+                if (c == ForbiddenChars[i])
+                    return true;
+
+            return false;
+        }
+
+        private static bool TryParseIp(string s, out IPAddress ip)
+        {
+            ip = null;
+
+            if (String.IsNullOrEmpty(s))
+                return false;
+
+            return IPAddress.TryParse(s.Trim(), out ip);
+        }
+    }
+}

overlay/Scripts/Custom/Bridge/BridgeAdmin.cs

@@ -13,7 +13,7 @@ namespace Server.Custom.Bridge
     ///     Every handler runs on the Core thread (BridgeBoot marshals inbound lines through
     ///     Timer.DelayCall first), so they may touch accounts, mobiles, and the network freely.
     ///
-    ///     Trust model (docs/ADMIN_CONTROLS.md §5): authorization is enforced on the *website* —
+    ///     Trust model (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/ADMIN_CONTROLS.md §5): authorization is enforced on the *website* —
     ///     these commands are gated there behind admin/moderator roles. The shard trusts the
     ///     loopback socket exactly as town-crier does, and applies inbound commands with an implicit
     ///     CoOwner authority. Its one hard floor is <see cref="Protected"/>: a command refuses any
@@ -248,7 +248,7 @@ namespace Server.Custom.Bridge
         ///     Opens an admin.audit frame (origin=web) with the common fields. Broadcast to every
         ///     connected dashboard so the website's moderation log stays complete regardless of which
         ///     client issued the action. The in-game counterpart (origin=in-game) is emitted from
-        ///     BridgeEvents; see docs/ADMIN_CONTROLS.md §5.5.
+        ///     BridgeEvents; see https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/ADMIN_CONTROLS.md §5.5.
         /// </summary>
         private static System.Text.StringBuilder AuditBegin(string action, string actor, string target)
         {
@@ -283,9 +283,10 @@ namespace Server.Custom.Bridge
 
         /// <summary>
         ///     Resolves the command's target account, by "serial" (a player mobile's account) or by
-        ///     "account" (username). Returns null if neither resolves to a real account.
+        ///     "account" (username). Returns null if neither resolves to a real account. Public so the
+        ///     account plane (unlink) resolves targets the same way the moderation plane does.
         /// </summary>
-        private static Account ResolveTargetAccount(Dictionary<string, object> o)
+        public static Account ResolveTargetAccount(Dictionary<string, object> o)
         {
             var serialStr = BridgeJson.GetString(o, "serial");
             if (serialStr != null)
@@ -301,9 +302,10 @@ namespace Server.Custom.Bridge
         /// <summary>
         ///     The one shard-side safety floor. Protects any account whose effective access level —
         ///     the account's own or the highest of its characters' — is at or above the configured
-        ///     floor. Even under CoOwner authority the Owner is never reachable from the web.
+        ///     floor. Even under CoOwner authority the Owner is never reachable from the web. Public
+        ///     so the account plane (unlink) enforces the identical floor.
         /// </summary>
-        private static bool Protected(Account acct)
+        public static bool Protected(Account acct)
         {
             var lvl = acct.AccessLevel;
 

overlay/Scripts/Custom/Bridge/BridgeBoot.cs

@@ -161,8 +161,17 @@ namespace Server.Custom.Bridge
                     BridgeSweeps.Rearm();
                     BridgePages.Rearm();
                     BridgeChamps.Rearm();
+                    BridgeSocial.Rearm();
+                    BridgeGovernance.Rearm();
+                    BridgePresence.Rearm();
+                    BridgeHousing.Rearm();
+                    BridgePoints.Rearm();
+                    BridgeMarket.Rearm();
+                    // Not a sweep, so it has nothing to re-arm — but an operator who just edited a
+                    // .cfg wants the change on the site now, not after a shard restart.
+                    BridgeRuleset.Emit();
                     e.Mobile.SendMessage("Bridge: {0}", BridgeConfig.Describe());
-                    e.Mobile.SendMessage("Bridge: sweeps re-armed; endpoint changes take effect on reconnect.");
+                    e.Mobile.SendMessage("Bridge: sweeps re-armed; ruleset re-emitted; endpoint changes take effect on reconnect.");
                     break;
 
                 case "ping":
@@ -173,9 +182,21 @@ namespace Server.Custom.Bridge
                 case "sweepnow":
                     BridgeSweeps.SweepOnce();
                     BridgeChamps.SweepOnce();
+                    BridgeSocial.SweepOnce();
+                    BridgeGovernance.SweepOnce();
+                    BridgePresence.SweepOnce();
+                    BridgeHousing.SweepOnce();
+                    BridgePoints.SweepOnce();
+                    BridgeMarket.SweepOnce();
                     e.Mobile.SendMessage("Bridge: ran one sweep of each stream.");
                     e.Mobile.SendMessage("Bridge: {0}", BridgeSweeps.Status());
                     e.Mobile.SendMessage("Bridge: {0}", BridgeChamps.Status());
+                    e.Mobile.SendMessage("Bridge: {0}", BridgeSocial.Status());
+                    e.Mobile.SendMessage("Bridge: {0}", BridgeGovernance.Status());
+                    e.Mobile.SendMessage("Bridge: {0}", BridgePresence.Status());
+                    e.Mobile.SendMessage("Bridge: {0}", BridgeHousing.Status());
+                    e.Mobile.SendMessage("Bridge: {0}", BridgePoints.Status());
+                    e.Mobile.SendMessage("Bridge: {0}", BridgeMarket.Status());
                     break;
 
                 default:
@@ -186,7 +207,14 @@ namespace Server.Custom.Bridge
                         BridgeLink.Received, BridgeLink.Connects, BridgeLink.WriteErrors);
                     e.Mobile.SendMessage("Bridge: {0}", BridgeSweeps.Status());
                     e.Mobile.SendMessage("Bridge: {0}", BridgeChamps.Status());
+                    e.Mobile.SendMessage("Bridge: {0}", BridgeSocial.Status());
+                    e.Mobile.SendMessage("Bridge: {0}", BridgeGovernance.Status());
+                    e.Mobile.SendMessage("Bridge: {0}", BridgePresence.Status());
+                    e.Mobile.SendMessage("Bridge: {0}", BridgeHousing.Status());
+                    e.Mobile.SendMessage("Bridge: {0}", BridgePoints.Status());
+                    e.Mobile.SendMessage("Bridge: {0}", BridgeMarket.Status());
                     e.Mobile.SendMessage("Bridge: {0}", BridgePages.Status());
+                    e.Mobile.SendMessage("Bridge: {0}", BridgeRuleset.Status());
                     break;
             }
         }

overlay/Scripts/Custom/Bridge/BridgeConfig.cs

@@ -2,6 +2,18 @@ using System;
 
 namespace Server.Custom.Bridge
 {
+    /// <summary>
+    ///     Which side may mint game accounts. Governs the bridge's inbound account.create verb;
+    ///     the in-game first-login auto-create is a separate core setting (Accounts.AutoCreateAccounts)
+    ///     the operator pairs with this (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PROTOCOL_2.md §2).
+    /// </summary>
+    public enum SignupMode
+    {
+        Website, // website is the account authority; in-game auto-create should be off
+        Game,    // game server is the authority; account.create is refused
+        Hybrid   // either side may create
+    }
+
     /// <summary>
     ///     Tunables from Config/Bridge.cfg. Key scope is the filename, so `Port=7788` there
     ///     reads as "Bridge.Port" here.
@@ -19,6 +31,29 @@ namespace Server.Custom.Bridge
         public static int EconomySweepSeconds { get; private set; }
         public static int PageSweepSeconds { get; private set; }
         public static int ChampSweepSeconds { get; private set; }
+        public static int GuildSweepSeconds { get; private set; }
+        public static int CitySweepSeconds { get; private set; }
+        public static int PresenceSweepSeconds { get; private set; }
+        public static int HousingSweepSeconds { get; private set; }
+        public static int PointsSweepSeconds { get; private set; }
+        public static int MarketSweepSeconds { get; private set; }
+
+        // ---- player-vendor market index (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/v3.md §8) ----
+        public static bool MarketEnabled { get; private set; }
+        public static int MarketSweepBatch { get; private set; }
+        public static int MarketMaxListings { get; private set; }
+
+        // ---- points / loyalty leaderboards (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/v3.md §7) ----
+        public static bool PointsLeaderboardEnabled { get; private set; }
+        public static int PointsTopN { get; private set; }
+        public static string PointsSystems { get; private set; }
+        public static bool PointsProfileEnabled { get; private set; }
+        public static bool PointsProfileRank { get; private set; }
+
+        // ---- shard ruleset (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/v3.md §5) ----
+        public static bool RulesetEnabled { get; private set; }
+        public static string PublicConnectAddress { get; private set; }
+        public static bool RulesetIncludeSchedule { get; private set; }
 
         public static string LinkUrl { get; private set; }
 
@@ -27,12 +62,25 @@ namespace Server.Custom.Bridge
         public static int TownCrierMaxActive { get; private set; }
         public static int TownCrierMaxDurationSec { get; private set; }
 
+        // Town Cryer news gump (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PROTOCOL_2.md §16).
+        public static int NewsMaxTitleLength { get; private set; }
+        public static int NewsMaxBodyLength { get; private set; }
+        public static int NewsMaxExternal { get; private set; }
+        public static int NewsAnnounceDurationSec { get; private set; }
+
         public static bool AdminWriteEnabled { get; private set; }
         public static AccessLevel AdminAccessFloor { get; private set; }
         public static int AdminBroadcastMaxLength { get; private set; }
         public static int AdminReasonMaxLength { get; private set; }
         public static int AdminBanMaxDurationSec { get; private set; }
 
+        // ---- account provisioning (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PROTOCOL_2.md Part A) ----
+        public static SignupMode Signup { get; private set; }
+        public static bool AccountCreateEnabled { get; private set; }
+        public static bool RequireIpForCreate { get; private set; }
+        public static int AccountNameMaxLength { get; private set; }
+        public static int AccountPasswordMaxLength { get; private set; }
+
         public static bool Enabled { get; private set; }
 
         public static void Configure()
@@ -60,6 +108,91 @@ namespace Server.Custom.Bridge
             if (ChampSweepSeconds < 1)
                 ChampSweepSeconds = 1;
 
+            // Social/political sweeps (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PROTOCOL_2.md Part B). Both change slowly, so the
+            // defaults are unhurried; the pass is a handful of field reads over a small set.
+            GuildSweepSeconds = Config.Get("Bridge.GuildSweepSeconds", 60);
+            if (GuildSweepSeconds < 1)
+                GuildSweepSeconds = 1;
+
+            CitySweepSeconds = Config.Get("Bridge.CitySweepSeconds", 300);
+            if (CitySweepSeconds < 1)
+                CitySweepSeconds = 1;
+
+            PresenceSweepSeconds = Config.Get("Bridge.PresenceSweepSeconds", 30);
+            if (PresenceSweepSeconds < 1)
+                PresenceSweepSeconds = 1;
+
+            HousingSweepSeconds = Config.Get("Bridge.HousingSweepSeconds", 300);
+            if (HousingSweepSeconds < 1)
+                HousingSweepSeconds = 1;
+
+            // Points/loyalty boards. The sweep touches every point entry on the shard, and ten of
+            // the ~25 systems keep a row per character ever created, so the default interval is
+            // deliberately slow — these are month-scale standings, not live state.
+            PointsSweepSeconds = Config.Get("Bridge.PointsSweepSeconds", 300);
+            if (PointsSweepSeconds < 1)
+                PointsSweepSeconds = 1;
+
+            PointsLeaderboardEnabled = Config.Get("Bridge.PointsLeaderboardEnabled", true);
+
+            // Board size. Bounded below at 1 because the selection indexes the Nth slot directly,
+            // and above at 100 because the frame is emitted per system — a large N multiplied by
+            // ~25 systems is how a "board" turns into a bandwidth problem.
+            PointsTopN = Config.Get("Bridge.PointsTopN", 10);
+            if (PointsTopN < 1)
+                PointsTopN = 1;
+            if (PointsTopN > 100)
+                PointsTopN = 100;
+
+            // Blank (the default) means "publish whatever the shard itself shows on the loyalty
+            // gump", so a shard that adds a subsystem gets its board without an edit here.
+            PointsSystems = Config.Get("Bridge.PointsSystems", "");
+
+            PointsProfileEnabled = Config.Get("Bridge.PointsProfileEnabled", true);
+
+            // Off by default, and the default is the point: a rank cannot early-exit the way a
+            // points lookup can — it must count every row that beats the player, in every system,
+            // on every profile build. See BridgeProfile.WritePoints.
+            PointsProfileRank = Config.Get("Bridge.PointsProfileRank", false);
+
+            // Player-vendor market index. Unlike every other sweep, this one does NOT walk its whole
+            // collection per tick: MarketSweepBatch caps how many vendors are inventoried, and a
+            // persistent cursor round-robins through the rest, so the per-tick cost is bounded by
+            // the batch rather than by how many vendors the world holds.
+            MarketEnabled = Config.Get("Bridge.MarketEnabled", true);
+
+            MarketSweepSeconds = Config.Get("Bridge.MarketSweepSeconds", 60);
+            if (MarketSweepSeconds < 1)
+                MarketSweepSeconds = 1;
+
+            // Bounded below at 1 (a batch of 0 would advance the cursor nowhere and publish nothing,
+            // silently) and above at 500, past which the batch stops bounding anything on any
+            // realistic shard and the tick is a whole-world pass by another name.
+            MarketSweepBatch = Config.Get("Bridge.MarketSweepBatch", 25);
+            if (MarketSweepBatch < 1)
+                MarketSweepBatch = 1;
+            if (MarketSweepBatch > 500)
+                MarketSweepBatch = 500;
+
+            // Per-vendor listing cap. BridgeJson.Parse caps INBOUND frames at 1 MB; outbound is
+            // uncapped and the sidecar's read_line will allocate whatever arrives, so the cap here
+            // is what keeps one commodity reseller with 8,000 stacked resources from emitting a
+            // multi-megabyte frame. Over the cap the frame carries "truncated": true and the site
+            // says so.
+            MarketMaxListings = Config.Get("Bridge.MarketMaxListings", 250);
+            if (MarketMaxListings < 1)
+                MarketMaxListings = 1;
+            if (MarketMaxListings > 5000)
+                MarketMaxListings = 5000;
+
+            // The ruleset frame is not a sweep — it is emitted once per sidecar connect (and on
+            // `[bridge reload`), so it has no interval. PublicConnectAddress is the ONE connection
+            // detail the bridge will publish, and only because an operator typed it here for that
+            // purpose; Server.cfg's Address/Port are never read (see BridgeRuleset's allowlist note).
+            RulesetEnabled = Config.Get("Bridge.RulesetEnabled", true);
+            PublicConnectAddress = Config.Get("Bridge.PublicConnectAddress", "");
+            RulesetIncludeSchedule = Config.Get("Bridge.RulesetIncludeSchedule", true);
+
             LinkUrl = Config.Get("Bridge.LinkUrl", "https://yoursite/link");
 
             TownCrierMaxLines = Config.Get("Bridge.TownCrierMaxLines", 6);
@@ -67,14 +200,77 @@ namespace Server.Custom.Bridge
             TownCrierMaxActive = Config.Get("Bridge.TownCrierMaxActive", 20);
             TownCrierMaxDurationSec = Config.Get("Bridge.TownCrierMaxDurationSec", 86400);
 
+            NewsMaxTitleLength = Config.Get("Bridge.NewsMaxTitleLength", 100);
+            NewsMaxBodyLength = Config.Get("Bridge.NewsMaxBodyLength", 2000);
+            NewsMaxExternal = Config.Get("Bridge.NewsMaxExternal", 20);
+            NewsAnnounceDurationSec = Config.Get("Bridge.NewsAnnounceDurationSec", 300);
+            if (NewsAnnounceDurationSec < 1)
+                NewsAnnounceDurationSec = 1;
+
             AdminWriteEnabled = Config.Get("Bridge.AdminWriteEnabled", false);
             AdminAccessFloor = ParseAccessLevel(Config.Get("Bridge.AdminAccessFloor", "CoOwner"), AccessLevel.CoOwner);
             AdminBroadcastMaxLength = Config.Get("Bridge.AdminBroadcastMaxLength", 300);
             AdminReasonMaxLength = Config.Get("Bridge.AdminReasonMaxLength", 400);
             AdminBanMaxDurationSec = Config.Get("Bridge.AdminBanMaxDurationSec", 31536000);
 
+            // Account provisioning. An absent SignupMode defaults to Hybrid; a *present but
+            // unrecognized* value falls back to Game (the safest — no website creation), so a
+            // typo can never accidentally open provisioning.
+            Signup = ParseSignupMode(Config.Get("Bridge.SignupMode", "hybrid"), SignupMode.Game);
+            // Default follows the mode: creation is on unless the shard is game-authority.
+            AccountCreateEnabled = Config.Get("Bridge.AccountCreateEnabled", Signup != SignupMode.Game);
+            RequireIpForCreate = Config.Get("Bridge.RequireIpForCreate", true);
+            AccountNameMaxLength = Config.Get("Bridge.AccountNameMaxLength", 16);
+            AccountPasswordMaxLength = Config.Get("Bridge.AccountPasswordMaxLength", 30);
+            if (AccountNameMaxLength < 1)
+                AccountNameMaxLength = 1;
+            if (AccountPasswordMaxLength < 1)
+                AccountPasswordMaxLength = 1;
+
             if (QueueCap < 16)
                 QueueCap = 16;
+
+            WarnOnSignupMismatch();
+        }
+
+        /// <summary>
+        ///     The bridge governs only the account.create verb; ServUO's in-game first-login
+        ///     auto-create is the core Accounts.AutoCreateAccounts setting. A shard whose two halves
+        ///     disagree is quietly broken (website-only that still auto-creates in game, or a mode
+        ///     that expects in-game creation with it switched off), so surface the contradiction
+        ///     loudly rather than silently doing the permissive thing.
+        /// </summary>
+        private static void WarnOnSignupMismatch()
+        {
+            var autoCreate = Config.Get("Accounts.AutoCreateAccounts", true);
+
+            if (Signup == SignupMode.Website && autoCreate)
+                Console.WriteLine(
+                    "[Bridge] WARNING: SignupMode=website but Accounts.AutoCreateAccounts=true; "
+                    + "an in-game login of any new name still mints an account. Set it false for website-only.");
+            else if (Signup == SignupMode.Game && !autoCreate)
+                Console.WriteLine(
+                    "[Bridge] WARNING: SignupMode=game but Accounts.AutoCreateAccounts=false; "
+                    + "in-game creation is off and account.create is refused, so no account can be created.");
+            else if (Signup == SignupMode.Hybrid && !autoCreate)
+                Console.WriteLine(
+                    "[Bridge] WARNING: SignupMode=hybrid but Accounts.AutoCreateAccounts=false; "
+                    + "in-game first-login creation is off. Only website account.create will work.");
+        }
+
+        /// <summary>
+        ///     Parses a SignupMode name, case-insensitively, falling back to <paramref name="fallback"/>
+        ///     on anything unrecognized so a typo can never open provisioning wider than intended.
+        /// </summary>
+        private static SignupMode ParseSignupMode(string value, SignupMode fallback)
+        {
+            SignupMode parsed;
+            if (!String.IsNullOrEmpty(value) && Enum.TryParse(value.Trim(), true, out parsed) &&
+                Enum.IsDefined(typeof(SignupMode), parsed))
+                return parsed;
+
+            Console.WriteLine("[Bridge] unrecognized SignupMode '{0}', using {1}", value, fallback);
+            return fallback;
         }
 
         /// <summary>
@@ -95,9 +291,9 @@ namespace Server.Custom.Bridge
         public static string Describe()
         {
             return String.Format(
-                "enabled={0} endpoint={1}:{2} queueCap={3} sweeps(stat={4}s decay={5}s econ={6}s champ={7}s) adminWrite={8}(floor={9})",
+                "enabled={0} endpoint={1}:{2} queueCap={3} sweeps(stat={4}s decay={5}s econ={6}s champ={7}s) adminWrite={8}(floor={9}) signup={10}(create={11})",
                 Enabled, Host, Port, QueueCap, StatSweepSeconds, DecaySweepSeconds, EconomySweepSeconds,
-                ChampSweepSeconds, AdminWriteEnabled, AdminAccessFloor);
+                ChampSweepSeconds, AdminWriteEnabled, AdminAccessFloor, Signup, AccountCreateEnabled);
         }
     }
 }

overlay/Scripts/Custom/Bridge/BridgeGovernance.cs

@@ -0,0 +1,175 @@
+using System;
+using System.Collections.Generic;
+
+using Server.Engines.CityLoyalty;
+
+namespace Server.Custom.Bridge
+{
+    /// <summary>
+    ///     The town-governor stream (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PROTOCOL_2.md §10.2). In modern ServUO the "mayor of a
+    ///     town" is the Governor in the City Loyalty System (King Blackthorn's governance): each of
+    ///     the governed cities has a Governor, a GovernorElect, and an Election. None of these raises
+    ///     an EventSink, so — like <see cref="BridgeChamps"/> and <see cref="BridgeSocial"/> — the set
+    ///     is polled and each city emits `city.update` only when its signature changes. Governors turn
+    ///     over on the order of weeks, so a slow sweep (default 5 min) is ample.
+    ///
+    ///     The wire model is uniform with the rest of Part B: a full-state `city.update` upsert, with
+    ///     "the governor changed" derived sidecar-side by comparing to the stored board — rather than a
+    ///     discrete from→to event, which a sidecar reconnect (cache cleared, full re-emit) would
+    ///     otherwise fire spuriously for every city.
+    ///
+    ///     Gated on CityLoyaltySystem.Enabled: a shard running its own town system emits nothing here.
+    /// </summary>
+    public static class BridgeGovernance
+    {
+        private static Timer _timer;
+
+        // City enum value -> last-emitted signature.
+        private static readonly Dictionary<int, string> _last = new Dictionary<int, string>();
+
+        private static long _sweeps, _emitted;
+        private static bool _warnedDisabled;
+
+        public static void Initialize()
+        {
+            if (!BridgeConfig.Enabled)
+                return;
+
+            EventSink.ServerStarted += OnServerStarted;
+        }
+
+        private static void OnServerStarted()
+        {
+            BridgeLink.Connected_Core += OnConnected;
+            Rearm();
+        }
+
+        private static void OnConnected()
+        {
+            _last.Clear();
+        }
+
+        /// <summary>Stops and recreates the timer from current config. Called by `[bridge reload`.</summary>
+        public static void Rearm()
+        {
+            Stop();
+
+            _timer = Timer.DelayCall(
+                TimeSpan.FromSeconds(BridgeConfig.CitySweepSeconds),
+                TimeSpan.FromSeconds(BridgeConfig.CitySweepSeconds),
+                CitySweep);
+        }
+
+        public static void Stop()
+        {
+            if (_timer != null) { _timer.Stop(); _timer = null; }
+        }
+
+        public static string Status()
+        {
+            return String.Format("cities(enabled={0} sweeps={1} emitted={2} tracked={3})",
+                CityLoyaltySystem.Enabled, _sweeps, _emitted, _last.Count);
+        }
+
+        /// <summary>Runs one sweep now. Wired into `[bridge sweepnow`.</summary>
+        public static void SweepOnce()
+        {
+            CitySweep();
+        }
+
+        private static void CitySweep()
+        {
+            try
+            {
+                _sweeps++;
+
+                if (!CityLoyaltySystem.Enabled || CityLoyaltySystem.Cities == null)
+                {
+                    if (!_warnedDisabled)
+                    {
+                        Console.WriteLine("[Bridge] city loyalty disabled; governor stream idle.");
+                        _warnedDisabled = true;
+                    }
+                    return;
+                }
+
+                if (!BridgeLink.Connected)
+                    return; // nothing is listening; do not fill the queue with perishable snapshots
+
+                foreach (var city in CityLoyaltySystem.Cities)
+                {
+                    if (city == null)
+                        continue;
+
+                    var sig = Signature(city);
+
+                    int key = (int)city.City;
+
+                    string prior;
+                    if (_last.TryGetValue(key, out prior) && prior == sig)
+                        continue; // unchanged since last emit
+
+                    _last[key] = sig;
+                    BridgeLink.Emit(WriteCity(city));
+                    _emitted++;
+                }
+            }
+            catch (Exception ex)
+            {
+                Console.WriteLine("[Bridge] city sweep threw: {0}", ex.Message);
+            }
+        }
+
+        // The volatile fields: governor, governor-elect, and the election phase / candidate count.
+        private static string Signature(CityLoyaltySystem city)
+        {
+            var gov = city.Governor == null ? 0 : city.Governor.Serial.Value;
+            var elect = city.GovernorElect == null ? 0 : city.GovernorElect.Serial.Value;
+
+            var e = city.Election;
+            var phase = ElectionPhase(e);
+            var candidates = (e == null || e.Candidates == null) ? 0 : e.Candidates.Count;
+
+            return String.Concat(
+                gov.ToString(), "|", elect.ToString(), "|", phase, "|", candidates.ToString());
+        }
+
+        private static string WriteCity(CityLoyaltySystem city)
+        {
+            var e = city.Election;
+            var phase = ElectionPhase(e);
+            var candidates = (e == null || e.Candidates == null) ? 0 : e.Candidates.Count;
+
+            var sb = BridgeJson.Begin("city.update")
+                .Str("city", city.City.ToString())
+                .Str("electionPhase", phase)
+                .Num("candidates", candidates);
+
+            sb.Actor("governor", city.Governor);
+            sb.Actor("governorElect", city.GovernorElect);
+
+            if (e != null && e.Ongoing)
+                sb.Str("autoPickAt", e.AutoPickGovernor.ToUniversalTime().ToString("o"));
+
+            return sb.End();
+        }
+
+        /// <summary>Folds the election state into one of: none / nominate / vote / pending.</summary>
+        private static string ElectionPhase(CityElection e)
+        {
+            if (e == null)
+                return "none";
+
+            if (e.CanNominate())
+                return "nominate";
+
+            if (e.CanVote())
+                return "vote";
+
+            if (e.Ongoing)
+                return "pending";
+
+            return "none";
+        }
+    }
+}

overlay/Scripts/Custom/Bridge/BridgeHousing.cs

@@ -0,0 +1,165 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+
+using Server.Multis;
+
+namespace Server.Custom.Bridge
+{
+    /// <summary>
+    ///     The housing registry (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PROTOCOL_2.md §11 #9). BridgeSweeps already emits house.decay
+    ///     *transitions*; this is the complementary *board*: one row per house with owner, location,
+    ///     region, co-owners, value, and current decay level, so the website can render an owner→houses
+    ///     map. Like the other Part B boards it is a diff sweep over BaseHouse.AllHouses — emit
+    ///     house.update only when a house's signature changes, and house.remove when a house is gone.
+    ///
+    ///     Note: stock ServUO has no "for sale" flag on a house (houses are traded, not listed), so the
+    ///     registry is owner→houses; `price` is the house's placement value, not a sale listing.
+    /// </summary>
+    public static class BridgeHousing
+    {
+        private static Timer _timer;
+
+        // house serial -> last-emitted signature.
+        private static readonly Dictionary<Serial, string> _last = new Dictionary<Serial, string>();
+
+        private static long _sweeps, _emitted, _removed;
+
+        public static void Initialize()
+        {
+            if (!BridgeConfig.Enabled)
+                return;
+
+            EventSink.ServerStarted += OnServerStarted;
+        }
+
+        private static void OnServerStarted()
+        {
+            BridgeLink.Connected_Core += OnConnected;
+            Rearm();
+        }
+
+        private static void OnConnected()
+        {
+            _last.Clear();
+        }
+
+        /// <summary>Stops and recreates the timer from current config. Called by `[bridge reload`.</summary>
+        public static void Rearm()
+        {
+            Stop();
+
+            _timer = Timer.DelayCall(
+                TimeSpan.FromSeconds(BridgeConfig.HousingSweepSeconds),
+                TimeSpan.FromSeconds(BridgeConfig.HousingSweepSeconds),
+                HouseSweep);
+        }
+
+        public static void Stop()
+        {
+            if (_timer != null) { _timer.Stop(); _timer = null; }
+        }
+
+        public static string Status()
+        {
+            return String.Format("housing(sweeps={0} emitted={1} removed={2} tracked={3})",
+                _sweeps, _emitted, _removed, _last.Count);
+        }
+
+        /// <summary>Runs one sweep now. Wired into `[bridge sweepnow`.</summary>
+        public static void SweepOnce()
+        {
+            HouseSweep();
+        }
+
+        private static void HouseSweep()
+        {
+            try
+            {
+                _sweeps++;
+
+                if (!BridgeLink.Connected)
+                    return; // nothing is listening; do not fill the queue with perishable snapshots
+
+                var seen = new HashSet<Serial>();
+
+                foreach (var house in BaseHouse.AllHouses)
+                {
+                    if (house == null || house.Deleted)
+                        continue;
+
+                    seen.Add(house.Serial);
+
+                    var level = house.DecayLevel; // computed getter — read once
+                    var sig = Signature(house, level);
+
+                    string prior;
+                    if (_last.TryGetValue(house.Serial, out prior) && prior == sig)
+                        continue; // unchanged since last emit
+
+                    _last[house.Serial] = sig;
+                    BridgeLink.Emit(WriteHouse(house, level));
+                    _emitted++;
+                }
+
+                var gone = _last.Keys.Where(k => !seen.Contains(k)).ToList();
+                foreach (var serial in gone)
+                {
+                    _last.Remove(serial);
+                    BridgeLink.Emit(BridgeJson.Begin("house.remove").Ser("serial", serial).End());
+                    _removed++;
+                }
+            }
+            catch (Exception ex)
+            {
+                Console.WriteLine("[Bridge] housing sweep threw: {0}", ex.Message);
+            }
+        }
+
+        private static string Signature(BaseHouse house, DecayLevel level)
+        {
+            var ownerSerial = house.Owner == null ? 0 : house.Owner.Serial.Value;
+            var region = house.Region;
+            var regionName = region == null ? "" : (region.Name ?? "");
+            var sign = house.Sign;
+            var name = sign == null ? "" : (sign.GetName() ?? "");
+            var coOwners = house.CoOwners == null ? 0 : house.CoOwners.Count;
+
+            return String.Concat(
+                ownerSerial.ToString(), "|",
+                level.ToString(), "|",
+                regionName, "|",
+                name, "|",
+                coOwners.ToString(), "|",
+                house.Price.ToString());
+        }
+
+        private static string WriteHouse(BaseHouse house, DecayLevel level)
+        {
+            var sb = BridgeJson.Begin("house.update")
+                .Ser("serial", house.Serial)
+                .Str("decay", level.ToString())
+                .Num("price", house.Price)
+                .Str("map", house.Map == null ? null : house.Map.Name)
+                .Num("x", house.X).Num("y", house.Y).Num("z", house.Z);
+
+            var sign = house.Sign;
+            if (sign != null)
+                sb.Str("name", sign.GetName());
+
+            var region = house.Region;
+            if (region != null)
+                sb.Str("region", region.Name);
+
+            sb.Actor("owner", house.Owner);
+
+            sb.Num("coOwners", house.CoOwners == null ? 0 : house.CoOwners.Count);
+            sb.Num("friends", house.Friends == null ? 0 : house.Friends.Count);
+
+            sb.Str("builtOn", house.BuiltOn.ToUniversalTime().ToString("o"));
+            sb.Str("lastRefreshed", house.LastRefreshed.ToUniversalTime().ToString("o"));
+
+            return sb.End();
+        }
+    }
+}

overlay/Scripts/Custom/Bridge/BridgeJson.cs

@@ -8,7 +8,7 @@ namespace Server.Custom.Bridge
 {
     /// <summary>
     ///     Outbound JSON is written by hand into a StringBuilder. It runs on the Core thread for
-    ///     every emitted event, and the measured budget in docs/PLAN.md assumes this cost, not a
+    ///     every emitted event, and the measured budget in https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PLAN.md assumes this cost, not a
     ///     reflection serializer's.
     ///
     ///     Inbound JSON is parsed with JavaScriptSerializer. Commands arrive at human rates, so
@@ -76,6 +76,46 @@ namespace Server.Custom.Bridge
             return sb;
         }
 
+        /// <summary>
+        ///     Writes a nested actor object: serial, name, account (when there is one), the linked
+        ///     webId (when the account is linked), and the player flag. A `null` mobile writes null.
+        ///     The richer counterpart to BridgeEvents' internal writer, used by the Part B streams so a
+        ///     guild leader / joiner / governor can be attributed to a site user without a lookup.
+        /// </summary>
+        public static StringBuilder Actor(this StringBuilder sb, string name, Mobile m)
+        {
+            sb.Append(",\"").Append(name).Append("\":");
+
+            if (m == null)
+            {
+                sb.Append("null");
+                return sb;
+            }
+
+            sb.Append("{\"serial\":\"0x").Append(m.Serial.Value.ToString("X")).Append('"');
+
+            sb.Append(",\"name\":");
+            Escape(sb, m.Name ?? "");
+
+            var acct = m.Account as Accounting.Account;
+            if (acct != null)
+            {
+                sb.Append(",\"acct\":");
+                Escape(sb, acct.Username);
+
+                var webId = BridgeAccountLink.WebIdFor(acct);
+                if (webId != null)
+                {
+                    sb.Append(",\"webId\":");
+                    Escape(sb, webId);
+                }
+            }
+
+            sb.Append(",\"player\":").Append(m.Player ? "true" : "false");
+            sb.Append('}');
+            return sb;
+        }
+
         /// <summary>Closes the object. The trailing newline is the frame delimiter.</summary>
         public static string End(this StringBuilder sb)
         {

overlay/Scripts/Custom/Bridge/BridgeMarket.cs

@@ -0,0 +1,591 @@
+using System;
+using System.Collections.Generic;
+using System.Text;
+
+using Server.Items;
+using Server.Mobiles;
+using Server.Multis;
+using Server.Engines.VendorSearching;
+
+namespace Server.Custom.Bridge
+{
+    /// <summary>
+    ///     The shard-wide player-vendor index (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/v3.md §8). Every player vendor's
+    ///     shop name, owner, location and priced inventory, published as one authoritative
+    ///     <c>vendor.listing</c> frame per vendor, so the website can offer the search the in-game
+    ///     Vendor Search gump offers — from outside the game.
+    ///
+    ///     ---- Why this is a sweep and not an RPC ----
+    ///
+    ///     The obvious shape is a <c>market.snapshot</c> request/reply like vendor.snapshot next
+    ///     door. It cannot work: the sidecar's rpc router correlates on the FIRST frame carrying a
+    ///     matching reqId and resolves a single oneshot, so a chunked reply sharing one reqId would
+    ///     deliver chunk 1 to the HTTP caller and LEAK chunks 2..N onto the broadcast feed. A
+    ///     whole-world snapshot in one frame is not an option either — the reply timeout is 10 s and
+    ///     40,000 listings do not serialize in time.
+    ///
+    ///     So it is a diff sweep on the broadcast stream, shaped like <see cref="BridgeHousing"/>:
+    ///     one frame per vendor, authoritative for that vendor, plus vendor.listing.remove when one
+    ///     goes away. The per-account <c>vendor.snapshot</c> RPC is untouched; the player portal
+    ///     keeps using it.
+    ///
+    ///     ---- The two perf traps, and what this does about them ----
+    ///
+    ///     1. **VendorSearch.GetItemName is a packet builder, not a field read.** It constructs an
+    ///        ObjectPropertyList, calls GetProperties, serialises it and then byte-parses the
+    ///        resulting packet — PER ITEM. Across a full pass that is a multi-hundred-millisecond
+    ///        stall on the Core thread. It is never called here. The frame carries `itemId`, `hue`,
+    ///        `amount`, `price`, the plain `item.Name` field (null for most items) and
+    ///        `item.LabelNumber`; the website resolves display names against its own cliloc table,
+    ///        exactly as char.profile.equipment already does.
+    ///
+    ///        (On any modern client the call would not even work: every current client ships its
+    ///        Cliloc.* files compressed, ServUO's bundled Ultima.StringList reads only the old plain
+    ///        layout, so VendorSearch.StringList is null and GetItemName returns item.Name anyway.
+    ///        The in-game gump has the same gap.)
+    ///
+    ///     2. **A full pass is unbounded in world size.** 500 vendors × 80 listings is ~40,000 item
+    ///        reads, and the reusable public GetItems(Container, List&lt;Item&gt;) recurses into
+    ///        sub-containers, so the real count runs ABOVE the top-level pack.Items a naive estimate
+    ///        would use. So the sweep is amortized: a persistent round-robin cursor over
+    ///        PlayerVendor.PlayerVendors advances at most MarketSweepBatch vendors per tick, which
+    ///        makes the PER-TICK cost bounded independently of how many vendors exist. Full coverage
+    ///        takes ceil(vendors / batch) × MarketSweepSeconds. This is the one genuinely new pattern
+    ///        versus the other sweeps, which all walk their whole collection every tick.
+    ///
+    ///     ---- Privacy ----
+    ///
+    ///     `pv.VendorSearch` is ServUO's own per-vendor opt-out and DoSearch filters on it, so a
+    ///     player who hid their vendor in game is hidden on the website too: an opted-out vendor is
+    ///     skipped entirely and the seen-set removal then drops it from the board. Map.Internal and
+    ///     a null Backpack are skipped for the same reason DoSearch skips them.
+    ///
+    ///     Owner is written as flat `ownerSerial`/`ownerName` — never through BridgeJson.Actor,
+    ///     which would add `acct` and `webId`. Same argument BridgePoints makes: this is the widest-
+    ///     audience surface the bridge has, and the site resolves serial → user from its own
+    ///     shard_account_links mirror when staff need it.
+    /// </summary>
+    public static class BridgeMarket
+    {
+        private static Timer _timer;
+
+        // vendor serial -> last-emitted signature.
+        private static readonly Dictionary<Serial, string> _last = new Dictionary<Serial, string>();
+
+        // Round-robin cursor: an INDEX into PlayerVendor.PlayerVendors, not a serial. The list is
+        // mutated by placement/deletion between ticks, so the cursor is a hint, not a promise — it
+        // is wrapped and clamped every tick, and a shifted list at worst re-visits or defers a
+        // vendor by one cycle. Tracking a serial instead would cost a lookup to find "where was I"
+        // and buy nothing: the sweep is idempotent per vendor.
+        private static int _cursor;
+
+        private static long _sweeps, _emitted, _removed, _scanned, _skipped, _truncated;
+
+        // Per-tick cost, in milliseconds. Reported by `[bridge status` because the
+        // whole design of this sweep is a claim about that number — the batch cap is what makes it
+        // independent of world size — and an operator tuning MarketSweepBatch is otherwise tuning
+        // blind. `_maxMs` is the one that matters: the Core thread runs this between frames, so the
+        // worst tick is the budget, not the average.
+        private static double _lastMs, _maxMs;
+        private static readonly System.Diagnostics.Stopwatch _clock = new System.Diagnostics.Stopwatch();
+
+        // Reused across ticks. The item walk is single-threaded (Core thread) and the list is
+        // cleared before each vendor, so one buffer serves the whole sweep — the alternative is a
+        // fresh List<Item> per vendor per tick, which at 25 vendors × every 60 s is pure garbage.
+        private static readonly List<Item> _items = new List<Item>();
+
+        public static void Initialize()
+        {
+            if (!BridgeConfig.Enabled)
+                return;
+
+            EventSink.ServerStarted += OnServerStarted;
+        }
+
+        private static void OnServerStarted()
+        {
+            BridgeLink.Connected_Core += OnConnected;
+            Rearm();
+        }
+
+        private static void OnConnected()
+        {
+            // A new sidecar knows nothing, so drop the diff state and start the round-robin from
+            // the top. The re-emit of the whole world is self-throttled by the batch window — this
+            // is the one place the amortized sweep pays for itself twice, because a reconnect on a
+            // whole-world sweep would otherwise be the biggest burst the bridge ever produces.
+            _last.Clear();
+            _cursor = 0;
+        }
+
+        /// <summary>Stops and recreates the timer from current config. Called by `[bridge reload`.</summary>
+        public static void Rearm()
+        {
+            Stop();
+
+            _timer = Timer.DelayCall(
+                TimeSpan.FromSeconds(BridgeConfig.MarketSweepSeconds),
+                TimeSpan.FromSeconds(BridgeConfig.MarketSweepSeconds),
+                MarketSweep);
+        }
+
+        public static void Stop()
+        {
+            if (_timer != null) { _timer.Stop(); _timer = null; }
+        }
+
+        /// <summary>
+        ///     A bare (key-less) string value, or JSON null.
+        ///
+        ///     <see cref="BridgeJson.Escape"/> takes a non-null string — it dereferences
+        ///     <c>value.Length</c> immediately — and <see cref="BridgeJson.Str"/> writes the `,"key":`
+        ///     prefix itself, so neither serves a value written inside a hand-built object. Most of
+        ///     what this frame writes is legitimately null (an item's plain Name is null for nearly
+        ///     every item, a vendor standing in the street has no house), so this is the common path
+        ///     rather than an edge case.
+        /// </summary>
+        private static void Text(StringBuilder sb, string value)
+        {
+            if (value == null)
+                sb.Append("null");
+            else
+                BridgeJson.Escape(sb, value);
+        }
+
+        public static string Status()
+        {
+            var all = PlayerVendor.PlayerVendors;
+
+            return String.Format(
+                "market(enabled={0} sweeps={1} scanned={2} emitted={3} removed={4} skipped={5} truncated={6} tracked={7} vendors={8} cursor={9} batch={10} lastMs={11:F2} maxMs={12:F2})",
+                BridgeConfig.MarketEnabled, _sweeps, _scanned, _emitted, _removed, _skipped,
+                _truncated, _last.Count, all == null ? 0 : all.Count, _cursor,
+                BridgeConfig.MarketSweepBatch, _lastMs, _maxMs);
+        }
+
+        /// <summary>Runs one sweep now. Wired into `[bridge sweepnow`.</summary>
+        public static void SweepOnce()
+        {
+            MarketSweep();
+        }
+
+        /// <summary>
+        ///     One tick: at most <c>MarketSweepBatch</c> vendors starting at the cursor, then the
+        ///     removal pass.
+        ///
+        ///     The removal pass is the part the batching makes subtle. `_last` holds every vendor
+        ///     seen in ANY previous tick, but this tick only visited a window — so "not in this
+        ///     tick's seen set" does NOT mean gone. Removals are therefore decided against the
+        ///     CURRENT vendor list (plus the opt-out/validity rules), not against the window, which
+        ///     is a cheap pass over serials rather than a second inventory walk.
+        /// </summary>
+        private static void MarketSweep()
+        {
+            try
+            {
+                if (!BridgeConfig.MarketEnabled)
+                    return;
+
+                _sweeps++;
+
+                if (!BridgeLink.Connected)
+                    return; // nothing is listening; do not fill the queue with perishable snapshots
+
+                _clock.Restart();
+
+                var all = PlayerVendor.PlayerVendors;
+
+                if (all == null || all.Count == 0)
+                {
+                    Reap(null);
+                    return;
+                }
+
+                // A live set of every serial that SHOULD be on the board right now, built as the
+                // window is walked plus a cheap pass over the rest. Built here rather than reusing
+                // a field so a throwing vendor cannot leave a half-built set behind.
+                var present = new HashSet<Serial>();
+
+                var count = all.Count;
+                var batch = Math.Min(BridgeConfig.MarketSweepBatch, count);
+
+                if (_cursor >= count)
+                    _cursor = 0;
+
+                for (int i = 0; i < count; i++)
+                {
+                    var vendor = all[i];
+
+                    if (Eligible(vendor))
+                        present.Add(vendor.Serial);
+                }
+
+                for (int n = 0; n < batch; n++)
+                {
+                    var index = (_cursor + n) % count;
+                    var vendor = all[index];
+
+                    if (!Eligible(vendor))
+                    {
+                        _skipped++;
+                        continue;
+                    }
+
+                    // One bad vendor must not cost the rest of the window: the item walk touches
+                    // arbitrary Item subclasses on a shard running modified scripts.
+                    try
+                    {
+                        SweepVendor(vendor);
+                    }
+                    catch (Exception ex)
+                    {
+                        Console.WriteLine("[Bridge] market sweep threw for 0x{0:X}: {1}",
+                            vendor.Serial.Value, ex.Message);
+                    }
+                }
+
+                _cursor = count == 0 ? 0 : (_cursor + batch) % count;
+
+                Reap(present);
+            }
+            catch (Exception ex)
+            {
+                Console.WriteLine("[Bridge] market sweep threw: {0}", ex.Message);
+            }
+            finally
+            {
+                // In `finally` so a throwing tick still records what it cost — a sweep that blows
+                // the budget and then throws is exactly the one worth seeing in the status line.
+                if (_clock.IsRunning)
+                {
+                    _clock.Stop();
+                    _lastMs = _clock.Elapsed.TotalMilliseconds;
+                    if (_lastMs > _maxMs)
+                        _maxMs = _lastMs;
+
+                    WarnIfSlow();
+                }
+            }
+        }
+
+        /// <summary>
+        ///     Per-tick budget, milliseconds. The batch cap exists to hold a tick under this
+        ///     regardless of world size, so exceeding it means MarketSweepBatch is too large for
+        ///     this shard's shops — the one thing an operator needs told, and the one thing
+        ///     `[bridge status` cannot tell them unprompted. Generous: a tick is off the frame
+        ///     budget, and the alternative to a rare 50 ms tick is a permanently stale market.
+        /// </summary>
+        private const double SlowTickMs = 50.0;
+
+        // At most one warning a minute. A shard whose batch is genuinely too big would otherwise
+        // print every MarketSweepSeconds forever, and a log nobody can read is a log nobody reads.
+        private static DateTime _lastWarn = DateTime.MinValue;
+
+        private static void WarnIfSlow()
+        {
+            if (_lastMs <= SlowTickMs)
+                return;
+
+            var now = DateTime.UtcNow;
+
+            if (now - _lastWarn < TimeSpan.FromMinutes(1))
+                return;
+
+            _lastWarn = now;
+
+            Console.WriteLine(
+                // ASCII only. The ServUO console writes in the OS code page, so an em dash here
+                // renders as "???" in the log an operator would paste into an issue.
+                "[Bridge] market sweep took {0:F1} ms (budget {1:F0} ms) - lower Bridge.MarketSweepBatch (now {2}) if this persists",
+                _lastMs, SlowTickMs, BridgeConfig.MarketSweepBatch);
+        }
+
+        /// <summary>
+        ///     The same filter DoSearch applies, so the website's index is the in-game index.
+        ///     <c>VendorSearch</c> is the player's own opt-out toggle and is honoured first.
+        /// </summary>
+        private static bool Eligible(PlayerVendor vendor)
+        {
+            return vendor != null
+                && !vendor.Deleted
+                && vendor.VendorSearch
+                && vendor.Map != null
+                && vendor.Map != Map.Internal
+                && vendor.Backpack != null;
+        }
+
+        /// <summary>
+        ///     Drops from the board every tracked vendor that is no longer eligible.
+        ///     <paramref name="present"/> null means "there are no vendors at all", which clears it.
+        /// </summary>
+        private static void Reap(HashSet<Serial> present)
+        {
+            if (_last.Count == 0)
+                return;
+
+            List<Serial> gone = null;
+
+            foreach (var serial in _last.Keys)
+            {
+                if (present != null && present.Contains(serial))
+                    continue;
+
+                if (gone == null)
+                    gone = new List<Serial>();
+
+                gone.Add(serial);
+            }
+
+            if (gone == null)
+                return;
+
+            for (int i = 0; i < gone.Count; i++)
+            {
+                _last.Remove(gone[i]);
+                BridgeLink.Emit(BridgeJson.Begin("vendor.listing.remove").Ser("serial", gone[i]).End());
+                _removed++;
+            }
+        }
+
+        private static void SweepVendor(PlayerVendor vendor)
+        {
+            _scanned++;
+
+            CollectItems(vendor);
+
+            var sig = Signature(vendor);
+
+            string prior;
+            if (_last.TryGetValue(vendor.Serial, out prior) && prior == sig)
+                return; // nothing about this shop changed since it was last published
+
+            _last[vendor.Serial] = sig;
+            BridgeLink.Emit(WriteVendor(vendor));
+            _emitted++;
+        }
+
+        /// <summary>
+        ///     Every sellable item on one vendor, into the shared buffer.
+        ///
+        ///     Mirrors VendorSearch's own private GetItems(PlayerVendor): the vendor's own movable
+        ///     equipment (minus the backpack itself and hair layers, which are not merchandise)
+        ///     followed by a recursive walk of the backpack. The recursion uses the PUBLIC
+        ///     GetItems(Container, List&lt;Item&gt;) rather than a hand-rolled one so that ServUO's
+        ///     rule about which containers are sold whole (quivers, seed boxes, jewelry boxes, …)
+        ///     stays ServUO's to define — the predicate that decides it is private, and a copy here
+        ///     would silently diverge the first time that list changes.
+        /// </summary>
+        private static void CollectItems(PlayerVendor vendor)
+        {
+            _items.Clear();
+
+            var own = vendor.Items;
+
+            if (own != null)
+            {
+                for (int i = 0; i < own.Count; i++)
+                {
+                    var item = own[i];
+
+                    if (item == null || !item.Movable || item == vendor.Backpack)
+                        continue;
+
+                    if (item.Layer == Layer.Hair || item.Layer == Layer.FacialHair)
+                        continue;
+
+                    _items.Add(item);
+                }
+            }
+
+            if (vendor.Backpack != null)
+                VendorSearch.GetItems(vendor.Backpack, _items);
+        }
+
+        /// <summary>
+        ///     A listing's price, and whether it was priced by an enclosing container.
+        ///
+        ///     ServUO prices a container as a unit: an item inside a priced bag has no VendorItem of
+        ///     its own and inherits the bag's price, which DoSearch surfaces as `isChild`. Reproduced
+        ///     exactly, because a website that priced every item in a 40k bag at 40k would be lying
+        ///     about the shard.
+        /// </summary>
+        private static int PriceOf(PlayerVendor vendor, Item item, out bool child)
+        {
+            child = false;
+
+            var vi = vendor.GetVendorItem(item);
+
+            if (vi != null)
+                return vi.Price;
+
+            var parent = item.Parent as Container;
+
+            while (parent != null)
+            {
+                vi = vendor.GetVendorItem(parent);
+
+                if (vi != null)
+                {
+                    child = true;
+                    return vi.Price;
+                }
+
+                parent = parent.Parent as Container;
+            }
+
+            return 0;
+        }
+
+        /// <summary>
+        ///     The diff key. Location, shop name and owner are in it because they move a vendor's
+        ///     row on the site; every listing's serial, price and amount are in it because those are
+        ///     what a shopper searches on.
+        ///
+        ///     Built over the SAME buffer the frame is written from, in the same order, so a
+        ///     signature match really does mean an identical frame — a cheaper hash (count + a sum
+        ///     of serial^price, as §8.3 first proposed) collides on the common case of two items
+        ///     swapping prices, which is exactly what re-pricing a shop looks like.
+        /// </summary>
+        private static string Signature(PlayerVendor vendor)
+        {
+            var sb = new StringBuilder(256);
+
+            sb.Append(vendor.ShopName ?? "").Append('|');
+            sb.Append(vendor.Owner == null ? 0 : vendor.Owner.Serial.Value).Append('|');
+            sb.Append(vendor.Map == null ? "" : vendor.Map.Name).Append('|');
+            sb.Append(vendor.X).Append(',').Append(vendor.Y).Append('|');
+
+            var limit = Math.Min(_items.Count, BridgeConfig.MarketMaxListings);
+
+            sb.Append(_items.Count).Append('|');
+
+            for (int i = 0; i < limit; i++)
+            {
+                var item = _items[i];
+
+                if (item == null || item.Deleted)
+                    continue;
+
+                bool child;
+                var price = PriceOf(vendor, item, out child);
+
+                if (price <= 0)
+                    continue;
+
+                sb.Append(item.Serial.Value.ToString("X")).Append(':')
+                  .Append(price).Append(':')
+                  .Append(item.Amount).Append(';');
+            }
+
+            return sb.ToString();
+        }
+
+        /// <summary>
+        ///     One vendor frame — authoritative for that vendor, so the website replaces its whole
+        ///     listing set from it rather than merging.
+        ///
+        ///     `location` is one nested object rather than flat map/x/y/region because it is ONE
+        ///     admin-configurable field on the site (`market.location`): the visibility projection
+        ///     matches literal JSON keys, so a nested object is what lets a single rule hide a
+        ///     vendor's whereabouts on both the live frame and the stored read model. Flat keys
+        ///     would need five rules that could drift apart.
+        ///
+        ///     `count` is the number of listings PUBLISHED, and `truncated` says the shop holds
+        ///     more. A shop over the cap is a real thing (commodity resellers run thousands of
+        ///     stacks) and the site says so rather than quietly showing a partial shop as complete.
+        /// </summary>
+        private static string WriteVendor(PlayerVendor vendor)
+        {
+            var sb = BridgeJson.Begin("vendor.listing")
+                .Ser("serial", vendor.Serial)
+                .Str("shopName", vendor.ShopName);
+
+            var owner = vendor.Owner;
+
+            if (owner != null)
+            {
+                sb.Ser("ownerSerial", owner.Serial);
+                sb.Str("ownerName", owner.Name);
+            }
+
+            sb.Append(",\"location\":{\"map\":");
+            Text(sb, vendor.Map == null ? null : vendor.Map.Name);
+            sb.Append(",\"x\":").Append(vendor.X);
+            sb.Append(",\"y\":").Append(vendor.Y);
+            sb.Append(",\"z\":").Append(vendor.Z);
+
+            var region = vendor.Region;
+            sb.Append(",\"region\":");
+            Text(sb, region == null ? null : region.Name);
+
+            // The house name is the sign's, which is what a player would be told to look for
+            // ("Bob's Villa"), not the house type. Null for a vendor standing outside one.
+            var house = vendor.House;
+            var sign = house == null ? null : house.Sign;
+            sb.Append(",\"house\":");
+            Text(sb, sign == null ? null : sign.GetName());
+
+            sb.Append('}');
+
+            var max = BridgeConfig.MarketMaxListings;
+            var published = 0;
+            var considered = 0;
+
+            var items = new StringBuilder(512);
+
+            for (int i = 0; i < _items.Count; i++)
+            {
+                var item = _items[i];
+
+                if (item == null || item.Deleted)
+                    continue;
+
+                bool child;
+                var price = PriceOf(vendor, item, out child);
+
+                // Unpriced items are inventory, not listings — DoSearch drops them the same way.
+                if (price <= 0)
+                    continue;
+
+                considered++;
+
+                if (published >= max)
+                    continue;
+
+                if (published > 0)
+                    items.Append(',');
+
+                items.Append("{\"serial\":\"0x").Append(item.Serial.Value.ToString("X")).Append('"');
+                items.Append(",\"itemId\":").Append(item.ItemID);
+                items.Append(",\"hue\":").Append(item.Hue);
+                items.Append(",\"amount\":").Append(item.Amount);
+                items.Append(",\"price\":").Append(price);
+
+                // The PLAIN Name field, which is null for most items — never GetItemName, which
+                // builds and parses a property packet per item. LabelNumber is the cliloc the
+                // website resolves against its own table.
+                items.Append(",\"name\":");
+                Text(items, item.Name);
+                items.Append(",\"cliloc\":").Append(item.LabelNumber);
+
+                if (child)
+                    items.Append(",\"child\":true");
+
+                items.Append('}');
+
+                published++;
+            }
+
+            sb.Num("count", published);
+            sb.Num("total", considered);
+            sb.Bool("truncated", considered > published);
+
+            if (considered > published)
+                _truncated++;
+
+            sb.Append(",\"items\":[").Append(items).Append(']');
+
+            return sb.End();
+        }
+    }
+}

overlay/Scripts/Custom/Bridge/BridgeNews.cs

@@ -0,0 +1,176 @@
+using System;
+using System.Collections.Generic;
+
+using Server.Mobiles;
+using Server.Services.TownCryer;
+
+namespace Server.Custom.Bridge
+{
+    /// <summary>
+    ///     Website news articles pushed into the modern Town Cryer News gump
+    ///     (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PROTOCOL_2.md §16). Distinct from BridgeTownCrier, which drives the scrolling-crier
+    ///     announcement lines (GlobalTownCrierEntryList). Here the full article — title, body (HTML),
+    ///     image, and a "more info" URL — becomes a TownCryerNewsEntry in TownCryerSystem.NewsEntries,
+    ///     which the stock news gumps already render (they branch on TextDefinition.Number, so string
+    ///     content needs no gump change).
+    ///
+    ///     No stock edit: NewsEntries is a public mutable list, so we insert/remove directly and keep
+    ///     our own id -> entry map, leaving the stock entries untouched. On add we also proclaim just
+    ///     the title through the existing crier say path (default on), so players hear it in-world.
+    ///
+    ///     Everything runs on the Core thread (inbound lines are marshaled through Timer.DelayCall),
+    ///     which is required to touch the shared news list and to send crier packets.
+    /// </summary>
+    public static class BridgeNews
+    {
+        // A neutral scroll gump when the website supplies no image.
+        private const int DefaultImage = 0x64E;
+
+        // Website id -> the news entry we created for it, so a later remove/replace can find it.
+        private static readonly Dictionary<string, TownCryerNewsEntry> _ours =
+            new Dictionary<string, TownCryerNewsEntry>(StringComparer.Ordinal);
+
+        public static void Initialize()
+        {
+            if (!BridgeConfig.Enabled)
+                return;
+
+            BridgeBoot.RegisterHandler("news.add", OnAdd);
+            BridgeBoot.RegisterHandler("news.remove", OnRemove);
+        }
+
+        private static void OnAdd(Dictionary<string, object> o)
+        {
+            var id = BridgeJson.GetString(o, "id");
+
+            if (id == null)
+            {
+                Reply("news.error", null, "missing id");
+                return;
+            }
+
+            var list = TownCryerSystem.NewsEntries;
+            if (list == null)
+            {
+                Reply("news.error", id, "town cryer unavailable");
+                return;
+            }
+
+            var title = BridgeJson.GetString(o, "title");
+            if (String.IsNullOrEmpty(title))
+            {
+                Reply("news.error", id, "missing title");
+                return;
+            }
+
+            var body = BridgeJson.GetString(o, "body") ?? "";
+            var url = BridgeJson.GetString(o, "url");
+            int image = BridgeJson.GetInt(o, "image", DefaultImage);
+
+            // announce defaults to true (proclaim the title in-world); "announce":false suppresses it.
+            bool announce = true;
+            object rawAnnounce;
+            if (o.TryGetValue("announce", out rawAnnounce) && rawAnnounce is bool)
+                announce = (bool)rawAnnounce;
+
+            if (title.Length > BridgeConfig.NewsMaxTitleLength)
+                title = title.Substring(0, BridgeConfig.NewsMaxTitleLength);
+            if (body.Length > BridgeConfig.NewsMaxBodyLength)
+                body = body.Substring(0, BridgeConfig.NewsMaxBodyLength);
+
+            try
+            {
+                // Replace an existing id in place: drop the old entry first.
+                TownCryerNewsEntry old;
+                if (_ours.TryGetValue(id, out old) && old != null)
+                {
+                    list.Remove(old);
+                    _ours.Remove(id);
+                }
+                else if (_ours.Count >= BridgeConfig.NewsMaxExternal)
+                {
+                    Reply("news.error", id, "too many news entries");
+                    return;
+                }
+
+                var entry = new TownCryerNewsEntry(
+                    new TextDefinition(title),
+                    new TextDefinition(body),
+                    image,
+                    null,
+                    url);
+
+                list.Insert(0, entry); // newest first, as the gump reads top-down
+                _ours[id] = entry;
+
+                if (announce)
+                    Announce(title);
+
+                Reply("news.ok", id, null);
+            }
+            catch (Exception ex)
+            {
+                Console.WriteLine("[Bridge] news.add threw: {0}", ex.Message);
+                Reply("news.error", id, "internal error");
+            }
+        }
+
+        private static void OnRemove(Dictionary<string, object> o)
+        {
+            var id = BridgeJson.GetString(o, "id");
+
+            if (id == null)
+            {
+                Reply("news.error", null, "missing id");
+                return;
+            }
+
+            TownCryerNewsEntry entry;
+            if (!_ours.TryGetValue(id, out entry))
+            {
+                Reply("news.error", id, "unknown id");
+                return;
+            }
+
+            _ours.Remove(id);
+
+            try
+            {
+                var list = TownCryerSystem.NewsEntries;
+                if (list != null && entry != null)
+                    list.Remove(entry);
+
+                Reply("news.ok", id, null);
+            }
+            catch (Exception ex)
+            {
+                Console.WriteLine("[Bridge] news.remove threw: {0}", ex.Message);
+                Reply("news.error", id, "internal error");
+            }
+        }
+
+        /// <summary>Proclaims a single line — the article title — through the town criers.</summary>
+        private static void Announce(string title)
+        {
+            try
+            {
+                GlobalTownCrierEntryList.Instance.AddEntry(
+                    new[] { title },
+                    TimeSpan.FromSeconds(BridgeConfig.NewsAnnounceDurationSec));
+            }
+            catch (Exception ex)
+            {
+                // A failed proclamation must not fail the news add — the article is already posted.
+                Console.WriteLine("[Bridge] news announce threw: {0}", ex.Message);
+            }
+        }
+
+        private static void Reply(string kind, string id, string reason)
+        {
+            var sb = BridgeJson.Begin(kind);
+            if (id != null) sb.Str("id", id);
+            if (reason != null) sb.Str("reason", reason);
+            BridgeLink.Emit(sb.End());
+        }
+    }
+}

overlay/Scripts/Custom/Bridge/BridgePoints.cs

@@ -0,0 +1,404 @@
+using System;
+using System.Collections.Generic;
+using System.Text;
+
+using Server.Engines.Points;
+
+namespace Server.Custom.Bridge
+{
+    /// <summary>
+    ///     Points / loyalty leaderboards (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/v3.md §7). ServUO carries ~25 separate point
+    ///     currencies (Queen's Loyalty, Void Pool, Casino, Clean Up Britannia, the nine city
+    ///     loyalties, Blackthorn, the Doom/Khaldun/Kotl treasure systems, …), every one of them a
+    ///     standing a player accumulates over months — and none of them has ever been visible
+    ///     anywhere but an in-game gump. This is the diff sweep that publishes them as boards.
+    ///
+    ///     Shaped like <see cref="BridgeHousing"/>: ServerStarted arms a timer, a sidecar connect
+    ///     clears the diff state so a fresh sidecar gets every board, and each pass emits only the
+    ///     systems whose top N actually moved. One frame per system (~600 B) rather than one 12 KB
+    ///     frame, matching champ.update / guild.update.
+    ///
+    ///     **There is no `points.remove`.** The set of systems is fixed at Configure() time by
+    ///     PointsSystem.Configure — a system cannot disappear at runtime — which is the same
+    ///     argument city.update already makes for cities.
+    ///
+    ///     ---- The perf trap, and why the selection looks like this ----
+    ///
+    ///     `PlayerTable` is a plain List&lt;PointsEntry&gt;, and QueensLoyalty has AutoAdd = true, so it
+    ///     holds an entry for every PlayerMobile that has ever logged in — zero-point rows included.
+    ///     The obvious `.OrderByDescending(e =&gt; e.Points).Take(N)` is a full sort PER SYSTEM: at
+    ///     20,000 historical characters that is ~25 sorts and ~7.5 M comparisons on the Core thread,
+    ///     tens of milliseconds, which BRIDGE_PLUGIN_PLAN.md §1 measured as the second thing in the
+    ///     whole bridge capable of blowing a frame budget (bulk profile generation being the first).
+    ///
+    ///     So: a single pass per system into a fixed N-element array kept sorted by insertion.
+    ///     O(n·N) with tiny constants, one allocation for the whole sweep, and the common case is a
+    ///     single comparison against the running Nth place before the row is rejected. ~500 k cheap
+    ///     iterations per pass at the default 300 s interval.
+    /// </summary>
+    public static class BridgePoints
+    {
+        private static Timer _timer;
+
+        // PointsType name -> last-emitted signature.
+        private static readonly Dictionary<string, string> _last =
+            new Dictionary<string, string>(StringComparer.Ordinal);
+
+        private static long _sweeps, _emitted;
+
+        // Reused across systems and across sweeps: the selection is single-threaded (Core thread)
+        // and fully overwritten each time, so there is nothing to allocate per pass.
+        private static PointsEntry[] _top = new PointsEntry[0];
+
+        public static void Initialize()
+        {
+            if (!BridgeConfig.Enabled)
+                return;
+
+            EventSink.ServerStarted += OnServerStarted;
+        }
+
+        private static void OnServerStarted()
+        {
+            BridgeLink.Connected_Core += OnConnected;
+            Rearm();
+        }
+
+        private static void OnConnected()
+        {
+            // A new sidecar knows nothing; drop the diff state so the next pass re-emits every board.
+            _last.Clear();
+        }
+
+        /// <summary>Stops and recreates the timer from current config. Called by `[bridge reload`.</summary>
+        public static void Rearm()
+        {
+            Stop();
+
+            _timer = Timer.DelayCall(
+                TimeSpan.FromSeconds(BridgeConfig.PointsSweepSeconds),
+                TimeSpan.FromSeconds(BridgeConfig.PointsSweepSeconds),
+                PointsSweep);
+        }
+
+        public static void Stop()
+        {
+            if (_timer != null) { _timer.Stop(); _timer = null; }
+        }
+
+        public static string Status()
+        {
+            return String.Format("points(enabled={0} sweeps={1} emitted={2} tracked={3} topN={4})",
+                BridgeConfig.PointsLeaderboardEnabled, _sweeps, _emitted, _last.Count,
+                BridgeConfig.PointsTopN);
+        }
+
+        /// <summary>Runs one sweep now. Wired into `[bridge sweepnow`.</summary>
+        public static void SweepOnce()
+        {
+            PointsSweep();
+        }
+
+        private static void PointsSweep()
+        {
+            try
+            {
+                if (!BridgeConfig.PointsLeaderboardEnabled)
+                    return;
+
+                _sweeps++;
+
+                if (!BridgeLink.Connected)
+                    return; // nothing is listening; do not fill the queue with perishable snapshots
+
+                // Systems is a mutable static populated by ~25 separate subsystem constructors in
+                // PointsSystem.Configure(). It is null before that runs and could in principle hold
+                // a null element, so neither is assumed.
+                var systems = PointsSystem.Systems;
+
+                if (systems == null)
+                    return;
+
+                var selected = SelectedSystems();
+
+                var n = BridgeConfig.PointsTopN;
+                if (_top.Length != n)
+                    _top = new PointsEntry[n];
+
+                for (int i = 0; i < systems.Count; i++)
+                {
+                    var sys = systems[i];
+
+                    if (sys == null)
+                        continue;
+
+                    // One bad system must not cost the rest of the sweep: Name/MaxPoints are
+                    // abstract members implemented by 25 unrelated subsystems, any of which could
+                    // throw on a shard running modified scripts.
+                    try
+                    {
+                        SweepSystem(sys, selected);
+                    }
+                    catch (Exception ex)
+                    {
+                        Console.WriteLine("[Bridge] points sweep threw for {0}: {1}",
+                            sys.Loyalty, ex.Message);
+                    }
+                }
+            }
+            catch (Exception ex)
+            {
+                Console.WriteLine("[Bridge] points sweep threw: {0}", ex.Message);
+            }
+        }
+
+        private static void SweepSystem(PointsSystem sys, HashSet<string> selected)
+        {
+            var key = sys.Loyalty.ToString();
+
+            if (!IsPublished(sys, key, selected))
+                return;
+
+            int ranked;
+            var count = SelectTop(sys, out ranked);
+
+            var sig = Signature(count, ranked);
+
+            string prior;
+            if (_last.TryGetValue(key, out prior) && prior == sig)
+                return; // top N and participant count both unchanged since last emit
+
+            _last[key] = sig;
+            BridgeLink.Emit(WriteBoard(sys, key, count, ranked));
+            _emitted++;
+        }
+
+        /// <summary>
+        ///     Which systems are published. The default is the shard's OWN answer to "is this
+        ///     player-facing?" — ShowOnLoyaltyGump, the flag that decides whether a system appears
+        ///     on the in-game loyalty gump — rather than a list invented here that would drift from
+        ///     the server every time a subsystem is added. `Bridge.cfg PointsSystems=` overrides it
+        ///     with an explicit comma-separated list of PointsType names.
+        /// </summary>
+        private static bool IsPublished(PointsSystem sys, string key, HashSet<string> selected)
+        {
+            if (selected != null)
+                return selected.Contains(key);
+
+            return sys.ShowOnLoyaltyGump;
+        }
+
+        // Parsed form of BridgeConfig.PointsSystems, rebuilt when the raw string changes so
+        // `[bridge reload` picks up an edit without a restart. null == "no override, use
+        // ShowOnLoyaltyGump".
+        private static string _selectedRaw;
+        private static HashSet<string> _selected;
+
+        private static HashSet<string> SelectedSystems()
+        {
+            var raw = BridgeConfig.PointsSystems ?? "";
+
+            if (raw == _selectedRaw)
+                return _selected;
+
+            _selectedRaw = raw;
+            _selected = null;
+
+            if (raw.Trim().Length == 0)
+                return null;
+
+            var set = new HashSet<string>(StringComparer.Ordinal);
+
+            foreach (var part in raw.Split(','))
+            {
+                var name = part.Trim();
+
+                if (name.Length == 0)
+                    continue;
+
+                // Resolve through the enum so a typo is reported loudly rather than silently
+                // publishing one board fewer than the operator asked for.
+                PointsType parsed;
+                if (Enum.TryParse(name, true, out parsed) && Enum.IsDefined(typeof(PointsType), parsed))
+                    set.Add(parsed.ToString());
+                else
+                    Console.WriteLine("[Bridge] unknown PointsSystems entry '{0}', ignoring", name);
+            }
+
+            _selected = set;
+            return _selected;
+        }
+
+        /// <summary>
+        ///     Single pass over one system's PlayerTable, keeping the best <c>_top.Length</c> entries
+        ///     in descending order. Returns how many slots were filled; <paramref name="ranked"/>
+        ///     receives the number of players actually holding points.
+        ///
+        ///     Ties do not displace (the shift test is strict, and the reject test is inclusive), so
+        ///     an unchanged table produces an unchanged board — which is what makes the diff
+        ///     signature meaningful rather than a source of spurious re-emits.
+        /// </summary>
+        private static int SelectTop(PointsSystem sys, out int ranked)
+        {
+            ranked = 0;
+
+            var table = sys.PlayerTable;
+            var top = _top;
+
+            if (table == null || top.Length == 0)
+                return 0;
+
+            var count = 0;
+
+            for (int i = 0; i < table.Count; i++)
+            {
+                var entry = table[i];
+
+                if (entry == null)
+                    continue;
+
+                var player = entry.Player;
+
+                // A deleted character keeps its row until the next save/load cycle, and AutoAdd
+                // systems are mostly zero-point rows. Neither belongs on a leaderboard.
+                if (player == null || player.Deleted || entry.Points <= 0)
+                    continue;
+
+                ranked++;
+
+                var points = entry.Points;
+
+                // The common case for a big table: worse than the running Nth place, one compare.
+                if (count == top.Length && points <= top[count - 1].Points)
+                    continue;
+
+                var pos = count < top.Length ? count : top.Length - 1;
+
+                while (pos > 0 && top[pos - 1].Points < points)
+                {
+                    top[pos] = top[pos - 1];
+                    pos--;
+                }
+
+                top[pos] = entry;
+
+                if (count < top.Length)
+                    count++;
+            }
+
+            return count;
+        }
+
+        /// <summary>
+        ///     A system's point ceiling as a whole number, or **0 meaning "uncapped"**.
+        ///
+        ///     `MaxPoints` is a double, and ServUO's idiom for "no cap" is `double.MaxValue`
+        ///     (DespiseCrystals, ShameCrystals and VoidPool all do this). A plain `(long)` cast of
+        ///     that is an UNCHECKED conversion — it does not throw, it produces `long.MinValue` —
+        ///     which is exactly what the first sweep against a real shard published:
+        ///     `"maxPoints": -9223372036854775808`. Anything not representable as a positive long
+        ///     therefore becomes 0, which the website already renders as "no maximum".
+        /// </summary>
+        internal static long Cap(double value)
+        {
+            // NaN first: every comparison against NaN is false, so it would otherwise fall through
+            // to the same unchecked cast.
+            if (Double.IsNaN(value) || value <= 0 || value >= 9.2233720368547758E18)
+                return 0;
+
+            return (long)value;
+        }
+
+        /// <summary>
+        ///     A score as a whole number. Same unchecked-cast hazard as <see cref="Cap"/>, but the
+        ///     saturating direction is the opposite: an implausibly large score is still a large
+        ///     score, so it clamps to long.MaxValue rather than collapsing to 0.
+        /// </summary>
+        internal static long Score(double value)
+        {
+            if (Double.IsNaN(value) || value <= 0)
+                return 0;
+
+            if (value >= 9.2233720368547758E18)
+                return Int64.MaxValue;
+
+            return (long)value;
+        }
+
+        /// <summary>
+        ///     The diff key: every published serial and its whole-point score, plus the participant
+        ///     count. Points are compared exactly as they are emitted, so a fractional award that
+        ///     does not move the displayed number does not cost a frame either.
+        /// </summary>
+        private static string Signature(int count, int ranked)
+        {
+            var sb = new StringBuilder(64);
+
+            sb.Append(ranked).Append('|');
+
+            for (int i = 0; i < count; i++)
+            {
+                var entry = _top[i];
+                sb.Append(entry.Player.Serial.Value.ToString("X"))
+                  .Append(':')
+                  .Append(Score(entry.Points))
+                  .Append(';');
+            }
+
+            return sb.ToString();
+        }
+
+        /// <summary>
+        ///     One board frame.
+        ///
+        ///     `nameString` AND `nameNumber` are both emitted because Name is a TextDefinition, which
+        ///     may carry either a literal or a cliloc id — the same contract titles.reward already
+        ///     documents at BridgeProfile.cs:107-110. Resolving clilocs is the website's job.
+        ///
+        ///     **Entries are written inline as {serial, name} — never through BridgeJson.Actor.**
+        ///     That is deliberate even though the website can now reveal fields by audience rung:
+        ///     Actor would add `acct` and `webId`, and neither is needed here, because the site
+        ///     resolves serial → user from its own shard_account_links mirror for staff views. A
+        ///     board is the widest-audience surface the bridge has; the account name of every ranked
+        ///     player has no business crossing the wire to reach it.
+        /// </summary>
+        private static string WriteBoard(PointsSystem sys, string key, int count, int ranked)
+        {
+            var name = sys.Name;
+
+            var sb = BridgeJson.Begin("points.board")
+                .Str("system", key)
+                .Str("nameString", name == null ? null : name.String)
+                .Num("nameNumber", name == null ? 0 : name.Number)
+                .Num("maxPoints", Cap(sys.MaxPoints))
+                .Bool("showOnGump", sys.ShowOnLoyaltyGump)
+                // Players actually HOLDING points, not PlayerTable.Count: an AutoAdd system has a
+                // zero-point row for every character that ever logged in, so the raw count would
+                // report the shard's whole character census as this system's participants.
+                .Num("players", ranked);
+
+            sb.Append(",\"top\":[");
+
+            for (int i = 0; i < count; i++)
+            {
+                var entry = _top[i];
+
+                if (i > 0)
+                    sb.Append(',');
+
+                sb.Append("{\"rank\":").Append(i + 1);
+                sb.Append(",\"serial\":\"0x").Append(entry.Player.Serial.Value.ToString("X")).Append('"');
+                sb.Append(",\"name\":");
+                BridgeJson.Escape(sb, entry.Player.Name ?? "");
+                // Whole points: every one of these systems awards and displays integers in game,
+                // and a board that renders 29500.00000000001 would be a bug report.
+                sb.Append(",\"points\":").Append(Score(entry.Points));
+                sb.Append('}');
+            }
+
+            sb.Append(']');
+
+            return sb.End();
+        }
+    }
+}

overlay/Scripts/Custom/Bridge/BridgePresence.cs

@@ -0,0 +1,203 @@
+using System;
+using System.Collections.Generic;
+
+using Server.Mobiles;
+
+namespace Server.Custom.Bridge
+{
+    /// <summary>
+    ///     The presence stream (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PROTOCOL_2.md §11 #1/#2): who is online and where. Two parts:
+    ///
+    ///       presence.online - a periodic population snapshot (total, per-facet, per-region), emitted
+    ///                         on a sweep but only when it changes, so the site has a live "N online"
+    ///                         plus a change history without a firehose of identical frames.
+    ///       region.enter    - a real-time location transition from EventSink.OnEnterRegion, the cheap
+    ///                         per-player movement signal PLAN.md §5.6 recommends over Movement.
+    ///
+    ///     The snapshot is derived each sweep from the online PlayerMobiles (NetState != null), the
+    ///     same population the vitals sweep already walks; counting them by map and region is a handful
+    ///     of field reads. region.enter is filtered to players.
+    /// </summary>
+    public static class BridgePresence
+    {
+        private static Timer _timer;
+
+        // Signature of the last-emitted snapshot, so an unchanged population emits nothing.
+        private static string _lastSig;
+
+        private static long _sweeps, _emitted, _regionEnters;
+
+        public static void Initialize()
+        {
+            if (!BridgeConfig.Enabled)
+                return;
+
+            EventSink.OnEnterRegion += OnEnterRegion;
+            EventSink.ServerStarted += OnServerStarted;
+        }
+
+        private static void OnServerStarted()
+        {
+            // Force the next sweep to emit after a (re)connect, so a sidecar that restarted gets the
+            // current population within one sweep.
+            BridgeLink.Connected_Core += OnConnected;
+            Rearm();
+        }
+
+        private static void OnConnected()
+        {
+            _lastSig = null;
+        }
+
+        /// <summary>Stops and recreates the timer from current config. Called by `[bridge reload`.</summary>
+        public static void Rearm()
+        {
+            Stop();
+
+            _timer = Timer.DelayCall(
+                TimeSpan.FromSeconds(BridgeConfig.PresenceSweepSeconds),
+                TimeSpan.FromSeconds(BridgeConfig.PresenceSweepSeconds),
+                PresenceSweep);
+        }
+
+        public static void Stop()
+        {
+            if (_timer != null) { _timer.Stop(); _timer = null; }
+        }
+
+        public static string Status()
+        {
+            return String.Format("presence(sweeps={0} emitted={1} regionEnters={2})",
+                _sweeps, _emitted, _regionEnters);
+        }
+
+        /// <summary>Runs one sweep now. Wired into `[bridge sweepnow`.</summary>
+        public static void SweepOnce()
+        {
+            PresenceSweep();
+        }
+
+        private static void PresenceSweep()
+        {
+            try
+            {
+                _sweeps++;
+
+                if (!BridgeLink.Connected)
+                    return; // nothing is listening; do not fill the queue with perishable snapshots
+
+                int total = 0;
+                var byFacet = new SortedDictionary<string, int>(StringComparer.Ordinal);
+                var byRegion = new SortedDictionary<string, int>(StringComparer.Ordinal);
+
+                foreach (var m in World.Mobiles.Values)
+                {
+                    var pm = m as PlayerMobile;
+
+                    if (pm == null || pm.NetState == null || pm.Deleted)
+                        continue;
+
+                    total++;
+
+                    var facet = pm.Map == null ? "Internal" : pm.Map.Name;
+                    Bump(byFacet, facet);
+
+                    var region = pm.Region;
+                    var regionName = (region == null || String.IsNullOrEmpty(region.Name)) ? "Wilderness" : region.Name;
+                    Bump(byRegion, regionName);
+                }
+
+                var sig = Signature(total, byFacet, byRegion);
+                if (sig == _lastSig)
+                    return; // population unchanged since last emit
+
+                _lastSig = sig;
+                BridgeLink.Emit(WriteOnline(total, byFacet, byRegion));
+                _emitted++;
+            }
+            catch (Exception ex)
+            {
+                Console.WriteLine("[Bridge] presence sweep threw: {0}", ex.Message);
+            }
+        }
+
+        private static void Bump(IDictionary<string, int> map, string key)
+        {
+            int n;
+            map[key] = map.TryGetValue(key, out n) ? n + 1 : 1;
+        }
+
+        private static string Signature(int total, SortedDictionary<string, int> byFacet, SortedDictionary<string, int> byRegion)
+        {
+            var sb = new System.Text.StringBuilder();
+            sb.Append(total);
+            foreach (var kv in byFacet) sb.Append('|').Append(kv.Key).Append(':').Append(kv.Value);
+            sb.Append('#');
+            foreach (var kv in byRegion) sb.Append('|').Append(kv.Key).Append(':').Append(kv.Value);
+            return sb.ToString();
+        }
+
+        private static string WriteOnline(int total, SortedDictionary<string, int> byFacet, SortedDictionary<string, int> byRegion)
+        {
+            var sb = BridgeJson.Begin("presence.online").Num("count", total);
+
+            WriteCounts(sb, "byFacet", byFacet);
+            WriteCounts(sb, "byRegion", byRegion);
+
+            return sb.End();
+        }
+
+        /// <summary>Writes a nested object of {name: count} pairs.</summary>
+        private static void WriteCounts(System.Text.StringBuilder sb, string field, SortedDictionary<string, int> counts)
+        {
+            sb.Append(",\"").Append(field).Append("\":{");
+
+            bool first = true;
+            foreach (var kv in counts)
+            {
+                if (!first)
+                    sb.Append(',');
+                first = false;
+
+                BridgeJson.Escape(sb, kv.Key);
+                sb.Append(':').Append(kv.Value);
+            }
+
+            sb.Append('}');
+        }
+
+        // ---- real-time region transitions ----
+
+        private static void OnEnterRegion(OnEnterRegionEventArgs e)
+        {
+            try
+            {
+                if (e == null || e.From == null || !e.From.Player)
+                    return;
+
+                var from = e.OldRegion;
+                var to = e.NewRegion;
+
+                // Only meaningful when the named region actually changed.
+                var fromName = from == null ? null : from.Name;
+                var toName = to == null ? null : to.Name;
+                if (String.Equals(fromName, toName, StringComparison.Ordinal))
+                    return;
+
+                var sb = BridgeJson.Begin("region.enter")
+                    .Str("from", fromName)
+                    .Str("to", toName)
+                    .Str("map", e.From.Map == null ? null : e.From.Map.Name);
+
+                sb.Actor("who", e.From);
+
+                BridgeLink.Emit(sb.End());
+                _regionEnters++;
+            }
+            catch (Exception ex)
+            {
+                Console.WriteLine("[Bridge] region enter handler threw: {0}", ex.Message);
+            }
+        }
+    }
+}

overlay/Scripts/Custom/Bridge/BridgeProfile.cs

@@ -2,6 +2,7 @@ using System;
 using System.Text;
 
 using Server.Accounting;
+using Server.Engines.Points;
 using Server.Items;
 using Server.Mobiles;
 
@@ -15,7 +16,7 @@ namespace Server.Custom.Bridge
     ///
     ///     A profile is the single most expensive read in the bridge (~0.07 ms + ~2.4 KB at the
     ///     seeded scale, more for a fully-kitted character), so it is built on demand only, never in
-    ///     a sweep. See docs/PLAN.md §1.
+    ///     a sweep. See https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PLAN.md §1.
     /// </summary>
     public static class BridgeProfile
     {
@@ -83,7 +84,7 @@ namespace Server.Custom.Bridge
             }
             sb.Append(']');
 
-            // worn equipment only — not the backpack/bank (see docs/PLAN.md §IV.4)
+            // worn equipment only — not the backpack/bank (see https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PLAN.md §IV.4)
             sb.Append(",\"equipment\":[");
             first = true;
             foreach (var item in m.Items)
@@ -98,9 +99,197 @@ namespace Server.Custom.Bridge
             }
             sb.Append(']');
 
+            WriteTitles(sb, m);
+            WritePoints(sb, m);
+
             return sb.End();
         }
 
+        /// <summary>
+        ///     The titles a character holds (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PROTOCOL_2.md §10.3). `selected` is the index into
+        ///     `reward` currently displayed (-1 if none). `fameKarma` and `skill` are the computed
+        ///     display titles (may be absent). `reward` is the raw reward-title list — an entry may be
+        ///     a cliloc number (as a string) or a literal string; resolve clilocs website-side.
+        /// </summary>
+        private static void WriteTitles(StringBuilder sb, PlayerMobile m)
+        {
+            sb.Append(",\"titles\":{\"selected\":").Append(m.SelectedTitle);
+
+            var fameKarma = m.FameKarmaTitle;
+            if (!String.IsNullOrEmpty(fameKarma))
+            {
+                sb.Append(",\"fameKarma\":");
+                BridgeJson.Escape(sb, fameKarma);
+            }
+
+            var skill = m.PaperdollSkillTitle;
+            if (!String.IsNullOrEmpty(skill))
+            {
+                sb.Append(",\"skill\":");
+                BridgeJson.Escape(sb, skill);
+            }
+
+            sb.Append(",\"reward\":[");
+            var rewards = m.RewardTitles;
+            if (rewards != null)
+            {
+                bool first = true;
+                for (int i = 0; i < rewards.Count; i++)
+                {
+                    var r = rewards[i];
+                    if (r == null)
+                        continue;
+
+                    if (!first) sb.Append(',');
+                    first = false;
+
+                    BridgeJson.Escape(sb, Convert.ToString(r, System.Globalization.CultureInfo.InvariantCulture));
+                }
+            }
+            sb.Append("]}");
+        }
+
+        /// <summary>
+        ///     The point/loyalty standings this character holds (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/v3.md §7.3). Read-model
+        ///     enrichment on an existing kind, exactly like <see cref="WriteTitles"/> — there is no
+        ///     request kind for "one character's points", because the profile is already the place
+        ///     the website asks for everything about one character.
+        ///
+        ///     Systems with no entry, or an entry at zero, are omitted: ten of the ~25 systems have
+        ///     AutoAdd = true and therefore hold a zero-point row for every character that has ever
+        ///     logged in, so emitting them all would be ~25 lines of noise on every sheet.
+        ///
+        ///     **Never call PointsSystem.GetEntry / GetPoints here.** Both look benign and both
+        ///     MUTATE THE WORLD: `GetEntry(from, create: false)` still calls AddEntry when the system
+        ///     has AutoAdd (PointsSystem.cs:207), which appends a row to PlayerTable and fires
+        ///     OnPlayerAdded. A read model that used them would silently grow the points save file by
+        ///     up to ten rows every time anyone viewed a character sheet. Hence the manual scan.
+        ///
+        ///     Cost: one early-exiting pass over each published system's PlayerTable. The AutoAdd
+        ///     tables are census-sized, so this is the dominant term in the profile — roughly 10 × n
+        ///     comparisons, against the ~0.069 ms/2.4 KB the rest of the profile measures at. That is
+        ///     acceptable because profiles are built on demand at human rates and never in a sweep;
+        ///     PointsProfileEnabled turns it off for a shard where it isn't.
+        ///
+        ///     **Deliberately no `rank`.** Rank cannot early-exit — it must count every row that
+        ///     beats the player, in every system, every time — and the website can derive it from
+        ///     the points.board frame for anyone who is actually on a board. See PointsProfileRank.
+        /// </summary>
+        private static void WritePoints(StringBuilder sb, PlayerMobile m)
+        {
+            if (!BridgeConfig.PointsProfileEnabled)
+                return;
+
+            sb.Append(",\"points\":[");
+
+            try
+            {
+                var systems = PointsSystem.Systems;
+
+                if (systems != null)
+                {
+                    bool first = true;
+
+                    for (int i = 0; i < systems.Count; i++)
+                    {
+                        var sys = systems[i];
+
+                        if (sys == null || !sys.ShowOnLoyaltyGump)
+                            continue;
+
+                        var points = LookupPoints(sys, m);
+
+                        if (points <= 0)
+                            continue;
+
+                        if (!first) sb.Append(',');
+                        first = false;
+
+                        var name = sys.Name;
+
+                        sb.Append("{\"system\":\"").Append(sys.Loyalty).Append('"');
+                        sb.Append(",\"nameString\":");
+                        if (name == null || name.String == null)
+                            sb.Append("null");
+                        else
+                            BridgeJson.Escape(sb, name.String);
+                        sb.Append(",\"nameNumber\":").Append(name == null ? 0 : name.Number);
+                        sb.Append(",\"points\":").Append(BridgePoints.Score(points));
+                        sb.Append(",\"maxPoints\":").Append(BridgePoints.Cap(sys.MaxPoints));
+
+                        // Off by default. The field is absent rather than null when disabled, so a
+                        // consumer can tell "this shard does not compute rank" from "unranked".
+                        if (BridgeConfig.PointsProfileRank)
+                            sb.Append(",\"rank\":").Append(RankOf(sys, points));
+
+                        sb.Append('}');
+                    }
+                }
+            }
+            catch (Exception ex)
+            {
+                // A profile is worth more than its points block; never fail the sheet over one.
+                Console.WriteLine("[Bridge] profile points threw: {0}", ex.Message);
+            }
+
+            sb.Append(']');
+        }
+
+        /// <summary>
+        ///     This character's score in one system, or 0 if it has no entry. A hand-rolled scan
+        ///     rather than GetEntry/GetPoints for the mutation reason above; it stops at the match,
+        ///     which the rank computation could not.
+        /// </summary>
+        private static double LookupPoints(PointsSystem sys, PlayerMobile m)
+        {
+            var table = sys.PlayerTable;
+
+            if (table == null)
+                return 0;
+
+            for (int i = 0; i < table.Count; i++)
+            {
+                var entry = table[i];
+
+                if (entry != null && entry.Player == m)
+                    return entry.Points;
+            }
+
+            return 0;
+        }
+
+        /// <summary>
+        ///     1-based standing in one system: how many live characters hold strictly more points,
+        ///     plus one. Ties share a rank, which is what a player expects to see.
+        ///
+        ///     Only reachable with PointsProfileRank=true, and off by default for the reason stated
+        ///     in <see cref="WritePoints"/>: unlike the points lookup, this visits every row of the
+        ///     table every time, so it turns a bounded early-exiting scan into a guaranteed full one
+        ///     per published system per profile.
+        /// </summary>
+        private static int RankOf(PointsSystem sys, double points)
+        {
+            var table = sys.PlayerTable;
+
+            if (table == null)
+                return 1;
+
+            var better = 0;
+
+            for (int i = 0; i < table.Count; i++)
+            {
+                var entry = table[i];
+
+                if (entry == null || entry.Player == null || entry.Player.Deleted)
+                    continue;
+
+                if (entry.Points > points)
+                    better++;
+            }
+
+            return better + 1;
+        }
+
         private static bool IsGearLayer(Layer layer)
         {
             switch (layer)

overlay/Scripts/Custom/Bridge/BridgeRuleset.cs

@@ -0,0 +1,355 @@
+using System;
+using System.Text;
+
+using Server.Engines.CityLoyalty;
+using Server.Engines.VvV;
+using Server.Multis;
+
+namespace Server.Custom.Bridge
+{
+    /// <summary>
+    ///     The shard ruleset (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/v3.md §5). One `world.ruleset` frame describing how
+    ///     this shard is actually configured: expansion, which systems are on, skill/stat caps, house
+    ///     and account limits, champion scroll rules, and the save/restart schedule. It is what turns
+    ///     the website's "Rules" page from hand-maintained prose into something that cannot drift from
+    ///     the server.
+    ///
+    ///     Modelled on <see cref="BridgeBoot.EmitHello"/>, NOT on the diff sweeps: the ruleset changes
+    ///     only when an operator edits Config/*.cfg and restarts (or runs `[bridge reload`), so there is
+    ///     nothing to poll. It subscribes Connected_Core so a sidecar that comes up second still learns
+    ///     the ruleset, exactly as server.hello does.
+    ///
+    ///     **The one hard rule: this is an explicit allowlist of Config.Get calls.** Never enumerate
+    ///     Config.Entries (Server/Config.cs) — that would sweep in every key on the server, secrets
+    ///     included. Files deliberately never read here, in addition to anything not named below:
+    ///
+    ///         Server.cfg     — Address / Listen / Port. Only Bridge.PublicConnectAddress is published,
+    ///                          and only because an operator typed it there for exactly this purpose.
+    ///         Staff.cfg      — staff account names.
+    ///         Email.cfg      — SMTP credentials.
+    ///         DataPath.cfg   — filesystem layout.
+    ///         Bridge.cfg     — the sidecar host/port and our own caps.
+    ///         Compiler.cfg   — build flags.
+    ///         Reports.cfg    — report upload credentials.
+    ///         Client.cfg     — client-version enforcement (not player-facing rules).
+    ///
+    ///     `rev` is an FNV-1a hash of the emitted body, so a reconnect that carries an unchanged ruleset
+    ///     is a no-op site-side. String.GetHashCode() is deliberately NOT used: it is randomized per
+    ///     process on modern .NET, so it would change on every shard restart and defeat the whole point.
+    /// </summary>
+    public static class BridgeRuleset
+    {
+        private static long _emitted;
+        private static string _rev = "";
+        private static int _bytes;
+
+        public static void Initialize()
+        {
+            if (!BridgeConfig.Enabled)
+                return;
+
+            BridgeLink.Connected_Core += Emit;
+        }
+
+        public static string Status()
+        {
+            return String.Format("ruleset(enabled={0} emitted={1} rev={2} bytes={3})",
+                BridgeConfig.RulesetEnabled, _emitted, _rev.Length == 0 ? "-" : _rev, _bytes);
+        }
+
+        /// <summary>
+        ///     Core thread. Builds and queues one `world.ruleset` frame. Called on every sidecar
+        ///     connect and by `[bridge reload` (an operator who just edited a .cfg wants to see the
+        ///     change on the site without restarting the shard).
+        /// </summary>
+        public static void Emit()
+        {
+            if (!BridgeConfig.RulesetEnabled)
+                return;
+
+            try
+            {
+                var body = BuildBody();
+
+                _rev = Fnv1a(body);
+                _bytes = body.Length;
+                _emitted++;
+
+                // rev goes first so a reader can short-circuit on an unchanged frame before parsing
+                // the rest of it.
+                BridgeLink.Emit(BridgeJson.Begin("world.ruleset")
+                    .Str("rev", _rev)
+                    .Append(body)
+                    .End());
+            }
+            catch (Exception ex)
+            {
+                Console.WriteLine("[Bridge] ruleset emit threw: {0}", ex.Message);
+            }
+        }
+
+        /// <summary>
+        ///     The allowlist. Every block is optional and omitted when its system is off, so a shard
+        ///     that does not run (say) VvV publishes no `vvv` block rather than a block of zeroes.
+        /// </summary>
+        private static string BuildBody()
+        {
+            var sb = new StringBuilder(2048);
+
+            sb.Str("shard", Server.Misc.ServerList.ServerName);
+            sb.Str("expansion", Core.Expansion.ToString());
+
+            // The ONLY thing published from a connection-address setting, and only because the
+            // operator put it in Bridge.cfg specifically to be shown. Server.cfg is never read.
+            var connect = BridgeConfig.PublicConnectAddress;
+            if (!String.IsNullOrEmpty(connect))
+                sb.Str("connect", connect);
+
+            WriteSystems(sb);
+            WriteCaps(sb);
+
+            sb.Append(",\"housing\":{\"accountHouseLimit\":")
+              .Append(BaseHouse.AccountHouseLimit).Append('}');
+
+            WriteAccounts(sb);
+            WriteVetRewards(sb);
+            WriteLoot(sb);
+            WriteVendors(sb);
+            WriteChampions(sb);
+            WriteTreasureMaps(sb);
+            WriteVvV(sb);
+            WriteStore(sb);
+
+            if (BridgeConfig.RulesetIncludeSchedule)
+                WriteSchedule(sb);
+
+            return sb.ToString();
+        }
+
+        /// <summary>
+        ///     Which optional systems this shard runs. Read from each system's own static rather than
+        ///     re-parsing its .cfg, so a system that derives its state (Factions is on exactly when VvV
+        ///     is off — Services/Factions/Core/Faction.cs) is reported the way the server actually sees
+        ///     it. This block subsumes the `world.systems` capability frame PROTOCOL_2.md §10.4
+        ///     sketched but never implemented.
+        /// </summary>
+        private static void WriteSystems(StringBuilder sb)
+        {
+            sb.Append(",\"systems\":{");
+            sb.Append("\"cityLoyalty\":").Append(Json(CityLoyaltySystem.Enabled));
+            sb.Append(",\"vvv\":").Append(Json(ViceVsVirtueSystem.Enabled));
+            sb.Append(",\"factions\":").Append(Json(Server.Factions.Settings.Enabled));
+            sb.Append(",\"siege\":").Append(Json(Siege.SiegeShard));
+            sb.Append(",\"chat\":").Append(Json(Config.Get("Chat.Enabled", true)));
+            sb.Append(",\"store\":").Append(Json(Config.Get("Store.Enabled", true)));
+            sb.Append(",\"dailyRares\":").Append(Json(Config.Get("DailyRares.Enabled", true)));
+            sb.Append(",\"honesty\":").Append(Json(Config.Get("Honesty.Enabled", true)));
+            sb.Append(",\"shadowguard\":").Append(Json(Core.TOL));
+            sb.Append(",\"treasureMaps\":").Append(Json(Config.Get("TreasureMaps.Enabled", true)));
+            sb.Append(",\"vetRewards\":").Append(Json(Config.Get("VetRewards.Enabled", true)));
+            sb.Append(",\"testCenter\":").Append(Json(Config.Get("TestCenter.Enabled", false)));
+            sb.Append('}');
+        }
+
+        /// <summary>
+        ///     Skill and stat caps — the single most-asked "what are the rules here?" question, and the
+        ///     one most often wrong on a hand-written page. SkillCap is in tenths (1000 = 100.0).
+        /// </summary>
+        private static void WriteCaps(StringBuilder sb)
+        {
+            sb.Append(",\"caps\":{");
+            sb.Append("\"skill\":").Append(Config.Get("PlayerCaps.SkillCap", 1000));
+            sb.Append(",\"totalSkill\":").Append(Config.Get("PlayerCaps.TotalSkillCap", 7000));
+            sb.Append(",\"stat\":").Append(Config.Get("PlayerCaps.TotalStatCap", 225));
+            sb.Append(",\"str\":").Append(Config.Get("PlayerCaps.StrCap", 125));
+            sb.Append(",\"dex\":").Append(Config.Get("PlayerCaps.DexCap", 125));
+            sb.Append(",\"int\":").Append(Config.Get("PlayerCaps.IntCap", 125));
+            sb.Append(",\"strMax\":").Append(Config.Get("PlayerCaps.StrMaxCap", 150));
+            sb.Append(",\"dexMax\":").Append(Config.Get("PlayerCaps.DexMaxCap", 150));
+            sb.Append(",\"intMax\":").Append(Config.Get("PlayerCaps.IntMaxCap", 150));
+            sb.Append('}');
+        }
+
+        /// <summary>
+        ///     Account limits. `autoCreate` is the in-game first-login auto-create switch, which pairs
+        ///     with the bridge's own SignupMode (BridgeConfig.WarnOnSignupMismatch) — publishing it
+        ///     lets the site's signup page tell a visitor the truth about how to get an account.
+        ///     Character slots come from Siege.cfg, which is where ServUO keeps them regardless of
+        ///     whether the shard is actually Siege.
+        /// </summary>
+        private static void WriteAccounts(StringBuilder sb)
+        {
+            sb.Append(",\"accounts\":{");
+            sb.Append("\"perIp\":").Append(Config.Get("Accounts.AccountsPerIp", 1));
+            sb.Append(",\"charSlots\":").Append(Siege.CharacterSlots);
+            sb.Append(",\"autoCreate\":").Append(Json(Config.Get("Accounts.AutoCreateAccounts", true)));
+            sb.Append('}');
+        }
+
+        private static void WriteVetRewards(StringBuilder sb)
+        {
+            var enabled = Config.Get("VetRewards.Enabled", true);
+
+            sb.Append(",\"vetRewards\":{\"enabled\":").Append(Json(enabled));
+
+            if (enabled)
+            {
+                var interval = Config.Get("VetRewards.RewardInterval", TimeSpan.FromDays(30.0));
+                sb.Append(",\"rewardIntervalDays\":").Append((int)interval.TotalDays);
+            }
+
+            sb.Append('}');
+        }
+
+        /// <summary>The Felucca risk-vs-reward numbers — the reason players choose a facet.</summary>
+        private static void WriteLoot(StringBuilder sb)
+        {
+            sb.Append(",\"loot\":{");
+            sb.Append("\"feluccaLuckBonus\":").Append(Config.Get("Loot.FeluccaLuckBonus", 0));
+            sb.Append(",\"feluccaBudgetBonus\":").Append(Config.Get("Loot.FeluccaBudgetBonus", 0));
+            sb.Append(",\"feluccaMaxProps\":").Append(Config.Get("Loot.MaxProps", 5));
+            sb.Append('}');
+        }
+
+        private static void WriteVendors(StringBuilder sb)
+        {
+            sb.Append(",\"vendors\":{");
+            sb.Append("\"restockDelayMinutes\":").Append(Config.Get("Vendors.RestockDelay", 60));
+            sb.Append(",\"maxSell\":").Append(Config.Get("Vendors.MaxSell", 500));
+            sb.Append(",\"economyStockAmount\":").Append(Config.Get("Vendors.EconomyStockAmount", 500));
+            sb.Append('}');
+        }
+
+        /// <summary>
+        ///     Champion spawn rewards. `rankThresholds` is the red-skull count at which each rank is
+        ///     reached, which is what a player actually wants to know before committing to a spawn.
+        /// </summary>
+        private static void WriteChampions(StringBuilder sb)
+        {
+            if (!Config.Get("Champions.Enabled", true))
+                return;
+
+            sb.Append(",\"champions\":{");
+            sb.Append("\"powerScrolls\":").Append(Config.Get("Champions.PowerScrolls", 6));
+            sb.Append(",\"statScrolls\":").Append(Config.Get("Champions.StatScrolls", 16));
+            sb.Append(",\"scrollChance\":").Append(Json(Config.Get("Champions.ScrollChance", 0.1)));
+            sb.Append(",\"transcendenceChance\":")
+              .Append(Json(Config.Get("Champions.TranscendenceChance", 50.0)));
+            sb.Append(",\"rankThresholds\":[")
+              .Append(Config.Get("Champions.Rank2RedSkulls", 5)).Append(',')
+              .Append(Config.Get("Champions.Rank3RedSkulls", 10)).Append(',')
+              .Append(Config.Get("Champions.Rank4RedSkulls", 13))
+              .Append(']');
+            sb.Append('}');
+        }
+
+        private static void WriteTreasureMaps(StringBuilder sb)
+        {
+            var enabled = Config.Get("TreasureMaps.Enabled", true);
+
+            sb.Append(",\"treasureMaps\":{\"enabled\":").Append(Json(enabled));
+
+            if (enabled)
+            {
+                sb.Append(",\"lootChance\":").Append(Json(Config.Get("TreasureMaps.LootChance", 0.01)));
+                sb.Append(",\"resetDays\":").Append(Json(Config.Get("TreasureMaps.ResetTime", 30.0)));
+            }
+
+            sb.Append('}');
+        }
+
+        private static void WriteVvV(StringBuilder sb)
+        {
+            if (!ViceVsVirtueSystem.Enabled)
+                return;
+
+            sb.Append(",\"vvv\":{");
+            sb.Append("\"enabled\":true");
+            sb.Append(",\"startSilver\":").Append(ViceVsVirtueSystem.StartSilver);
+            sb.Append(",\"enhancedRules\":").Append(Json(ViceVsVirtueSystem.EnhancedRules));
+            sb.Append('}');
+        }
+
+        /// <summary>
+        ///     The Ultima Store. Only `enabled` and the currency's display name — never the store's
+        ///     price table or any payment configuration, neither of which lives in Config anyway.
+        /// </summary>
+        private static void WriteStore(StringBuilder sb)
+        {
+            var enabled = Config.Get("Store.Enabled", true);
+
+            sb.Append(",\"store\":{\"enabled\":").Append(Json(enabled));
+
+            if (enabled)
+                sb.Str("currencyName", Config.Get("Store.CurrencyName", "Sovereigns"));
+
+            sb.Append('}');
+        }
+
+        /// <summary>
+        ///     Save and restart schedule — "when does the shard hiccup?", the other question a live
+        ///     status page is asked. Off behind RulesetIncludeSchedule for an operator who would rather
+        ///     not advertise a predictable restart window.
+        /// </summary>
+        private static void WriteSchedule(StringBuilder sb)
+        {
+            sb.Append(",\"schedule\":{");
+
+            var saves = Config.Get("AutoSave.Enabled", true);
+            sb.Append("\"autoSaveEnabled\":").Append(Json(saves));
+
+            if (saves)
+            {
+                var freq = Config.Get("AutoSave.Frequency", TimeSpan.FromMinutes(5.0));
+                sb.Append(",\"autoSaveFrequencyMinutes\":").Append((int)freq.TotalMinutes);
+            }
+
+            var restart = Config.Get("AutoRestart.Enabled", false);
+            sb.Append(",\"autoRestartEnabled\":").Append(Json(restart));
+
+            if (restart)
+            {
+                sb.Append(",\"autoRestartHour\":").Append(Config.Get("AutoRestart.Hour", 12));
+                sb.Append(",\"autoRestartMinute\":").Append(Config.Get("AutoRestart.Minute", 0));
+                sb.Append(",\"autoRestartFrequencyHours\":").Append(Config.Get("AutoRestart.Frequency", 24));
+            }
+
+            sb.Append('}');
+        }
+
+        // ---- helpers ----
+
+        private static string Json(bool value)
+        {
+            return value ? "true" : "false";
+        }
+
+        private static string Json(double value)
+        {
+            return value.ToString("R", System.Globalization.CultureInfo.InvariantCulture);
+        }
+
+        /// <summary>
+        ///     FNV-1a over the UTF-16 code units of the body, as 8 lowercase hex digits. Any stable
+        ///     hash would do; what matters is that it is stable ACROSS PROCESSES, which
+        ///     String.GetHashCode() is not (it is seeded randomly per process), so using that would
+        ///     produce a different rev after every restart and make the whole diff pointless.
+        /// </summary>
+        private static string Fnv1a(string s)
+        {
+            const uint offset = 2166136261;
+            const uint prime = 16777619;
+
+            uint hash = offset;
+
+            for (int i = 0; i < s.Length; i++)
+            {
+                char c = s[i];
+                hash = (hash ^ (byte)(c & 0xFF)) * prime;
+                hash = (hash ^ (byte)(c >> 8)) * prime;
+            }
+
+            return hash.ToString("x8");
+        }
+    }
+}

overlay/Scripts/Custom/Bridge/BridgeSocial.cs

@@ -0,0 +1,218 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+
+using Server.Guilds;
+
+namespace Server.Custom.Bridge
+{
+    /// <summary>
+    ///     The guild stream (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PROTOCOL_2.md §10.1). Guilds have almost no useful EventSink:
+    ///     EventSink.CreateGuild is only the load-time deserialization factory (Server/World.cs), and
+    ///     leave/disband/leader/alliance changes raise nothing. Only EventSink.JoinGuild is real. So,
+    ///     exactly like <see cref="BridgeChamps"/>, the roster is polled: enumerate BaseGuild.List each
+    ///     tick, fold each guild to a small signature, and emit `guild.update` only when it changes.
+    ///     A guild that vanishes (or disbands — Disbanded == leader gone) leaves via `guild.remove`.
+    ///
+    ///     On top of the board we emit a real-time `guild.join` from EventSink.JoinGuild, so a "so-and-
+    ///     so joined" feed does not wait for the next sweep. A membership change also moves the board
+    ///     signature (member count + serial sum), so a *leave* surfaces as the member count dropping in
+    ///     the next `guild.update`; per-member leave events would need a core tap and are a later
+    ///     refinement (§10.1).
+    ///
+    ///     "Created" is derived sidecar-side from a first-seen id (as champs derive it), rather than a
+    ///     wire event — otherwise a sidecar reconnect, which clears the diff cache and re-emits every
+    ///     guild, would look like every guild being created at once.
+    /// </summary>
+    public static class BridgeSocial
+    {
+        private static Timer _timer;
+
+        // guild id -> last-emitted signature. An id absent here has never been emitted (or the cache
+        // was cleared on reconnect), so its next sweep counts as a change.
+        private static readonly Dictionary<int, string> _last = new Dictionary<int, string>();
+
+        private static long _sweeps, _emitted, _removed, _joins;
+
+        public static void Initialize()
+        {
+            if (!BridgeConfig.Enabled)
+                return;
+
+            EventSink.JoinGuild += OnJoinGuild;
+            EventSink.ServerStarted += OnServerStarted;
+        }
+
+        private static void OnServerStarted()
+        {
+            BridgeLink.Connected_Core += OnConnected;
+            Rearm();
+        }
+
+        private static void OnConnected()
+        {
+            _last.Clear();
+        }
+
+        /// <summary>Stops and recreates the timer from current config. Called by `[bridge reload`.</summary>
+        public static void Rearm()
+        {
+            Stop();
+
+            _timer = Timer.DelayCall(
+                TimeSpan.FromSeconds(BridgeConfig.GuildSweepSeconds),
+                TimeSpan.FromSeconds(BridgeConfig.GuildSweepSeconds),
+                GuildSweep);
+        }
+
+        public static void Stop()
+        {
+            if (_timer != null) { _timer.Stop(); _timer = null; }
+        }
+
+        public static string Status()
+        {
+            return String.Format("guilds(sweeps={0} emitted={1} removed={2} joins={3} tracked={4})",
+                _sweeps, _emitted, _removed, _joins, _last.Count);
+        }
+
+        /// <summary>Runs one sweep now. Wired into `[bridge sweepnow`.</summary>
+        public static void SweepOnce()
+        {
+            GuildSweep();
+        }
+
+        private static void GuildSweep()
+        {
+            try
+            {
+                _sweeps++;
+
+                if (!BridgeLink.Connected)
+                    return; // nothing is listening; do not fill the queue with perishable snapshots
+
+                var seen = new HashSet<int>();
+
+                foreach (var bg in BaseGuild.List.Values)
+                {
+                    var g = bg as Guild;
+
+                    // Skip disbanded guilds (leader gone): they linger in the list until cleaned up,
+                    // and treating them as absent lets the "gone" pass below emit guild.remove.
+                    if (g == null || g.Disbanded)
+                        continue;
+
+                    seen.Add(g.Id);
+
+                    var sig = Signature(g);
+
+                    string prior;
+                    if (_last.TryGetValue(g.Id, out prior) && prior == sig)
+                        continue; // unchanged since last emit
+
+                    _last[g.Id] = sig;
+                    BridgeLink.Emit(WriteGuild(g));
+                    _emitted++;
+                }
+
+                // Anything tracked last sweep but not seen now has disbanded or been removed.
+                var gone = _last.Keys.Where(k => !seen.Contains(k)).ToList();
+                foreach (var id in gone)
+                {
+                    _last.Remove(id);
+                    BridgeLink.Emit(BridgeJson.Begin("guild.remove").Num("id", id).End());
+                    _removed++;
+                }
+            }
+            catch (Exception ex)
+            {
+                Console.WriteLine("[Bridge] guild sweep threw: {0}", ex.Message);
+            }
+        }
+
+        // The volatile fields that define a meaningful change: name, abbreviation, leader, member
+        // count, the member set (order-independent serial sum), and alliance.
+        private static string Signature(Guild g)
+        {
+            long memberSum = 0;
+            int count = 0;
+
+            var members = g.Members;
+            if (members != null)
+            {
+                for (int i = 0; i < members.Count; i++)
+                {
+                    var m = members[i];
+                    if (m == null)
+                        continue;
+                    count++;
+                    unchecked { memberSum += (uint)m.Serial.Value; }
+                }
+            }
+
+            var leaderSerial = g.Leader == null ? 0 : g.Leader.Serial.Value;
+
+            return String.Concat(
+                g.Name ?? "", "|",
+                g.Abbreviation ?? "", "|",
+                leaderSerial.ToString(), "|",
+                count.ToString(), "|",
+                memberSum.ToString(), "|",
+                g.Alliance == null ? "" : (g.AllianceName ?? ""));
+        }
+
+        private static string WriteGuild(Guild g)
+        {
+            int online = 0, count = 0;
+            var members = g.Members;
+            if (members != null)
+            {
+                for (int i = 0; i < members.Count; i++)
+                {
+                    var m = members[i];
+                    if (m == null)
+                        continue;
+                    count++;
+                    if (m.NetState != null)
+                        online++;
+                }
+            }
+
+            var sb = BridgeJson.Begin("guild.update")
+                .Num("id", g.Id)
+                .Str("name", g.Name)
+                .Str("abbr", g.Abbreviation)
+                .Num("members", count)
+                .Num("online", online)
+                .Str("alliance", g.Alliance == null ? null : g.AllianceName);
+
+            sb.Actor("leader", g.Leader);
+
+            return sb.End();
+        }
+
+        // ---- real-time join ----
+
+        private static void OnJoinGuild(JoinGuildEventArgs e)
+        {
+            try
+            {
+                if (e == null || e.Mobile == null)
+                    return;
+
+                var g = e.Guild as Guild;
+
+                var sb = BridgeJson.Begin("guild.join");
+                if (g != null)
+                    sb.Num("id", g.Id).Str("name", g.Name).Str("abbr", g.Abbreviation);
+                sb.Actor("who", e.Mobile);
+                BridgeLink.Emit(sb.End());
+                _joins++;
+            }
+            catch (Exception ex)
+            {
+                Console.WriteLine("[Bridge] guild join handler threw: {0}", ex.Message);
+            }
+        }
+    }
+}

overlay/Scripts/Custom/Bridge/BridgeSweeps.cs

@@ -11,7 +11,7 @@ namespace Server.Custom.Bridge
     /// <summary>
     ///     The three polled streams, for state that has no EventSink: player vitals, house decay,
     ///     and money supply. All three run on the Core thread via repeating Timers, and the
-    ///     measured cost (docs/PLAN.md §1) is why they can: at the seeded scale a full pass of all
+    ///     measured cost (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PLAN.md §1) is why they can: at the seeded scale a full pass of all
     ///     three is well under a millisecond.
     ///
     ///     Timers do not fire during a world save (Timer.cs:322), so a sweep that would have landed

patches/BridgeModerationAudit.cs

@@ -9,7 +9,7 @@ namespace Server.Custom.Bridge
     /// <summary>
     ///     Forwards IN-GAME uses of the write-plane verbs to the website as admin.audit
     ///     (origin=in-game), so the site's moderation log is complete regardless of whether an action
-    ///     came from the website or a staff member in the game client. See docs/ADMIN_CONTROLS.md §5.5.
+    ///     came from the website or a staff member in the game client. See https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/ADMIN_CONTROLS.md §5.5.
     ///
     ///     Two sources, mirroring how the shard records each:
     ///       - ban / kick: resolved with their target inside the stock generic command, which logs a

patches/README.md

@@ -11,7 +11,7 @@ git apply         patches/<name>.patch
 
 ## Phase 7 — player-vendor sale (a coupled unit)
 
-Player-vendor purchases raise **no** EventSink. `ValidVendorPurchase` / `ValidVendorSell` cover NPC vendors only. The commit point is `PlayerVendorBuyGump.OnResponse`, the only place where buyer, vendor **owner**, price, and commission are all in scope — exactly what cheat detection needs. See `docs/PLAN.md` §6.
+Player-vendor purchases raise **no** EventSink. `ValidVendorPurchase` / `ValidVendorSell` cover NPC vendors only. The commit point is `PlayerVendorBuyGump.OnResponse`, the only place where buyer, vendor **owner**, price, and commission are all in scope — exactly what cheat detection needs. See [PLAN.md](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PLAN.md) §6.
 
 This is the one non-drop-in piece. Apply all three together:
 
@@ -56,4 +56,4 @@ Phase 0 modifies an existing file but ships as a whole-file overlay (`overlay/Sc
 
 ## Note on shard repairs
 
-The deletions and edits described in `docs/SHARD_PREREQS.md` are one-time repairs to a specific broken install, not part of the bridge. They are not shipped here.
+The deletions and edits described in [SHARD_PREREQS.md](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/SHARD_PREREQS.md) are one-time repairs to a specific broken install, not part of the bridge. They are not shipped here.

tools/scaffolding/README.md

@@ -2,7 +2,7 @@
 
 **Not part of the bridge. Never deployed.** `deploy.ps1` only copies `overlay/`, so nothing here reaches a server unless you put it there by hand.
 
-These two scripts produced the measured budget in `docs/PLAN.md` §1. They are kept because those numbers should be reproducible, and because re-running the probe is the only honest way to check whether a change to the plugin's read path got more expensive.
+These two scripts produced the measured budget in [PLAN.md](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PLAN.md) §1. They are kept because those numbers should be reproducible, and because re-running the probe is the only honest way to check whether a change to the plugin's read path got more expensive.
 
 | File | Server path when testing | What |
 |------|--------------------------|------|