Merge pull request 'feat(bridge): protocol 5 — cutover 2a of 7 (edge → main)' (#20) from edge into main

Reviewed-on: #20
Reviewed-by: Colby Whitlock <whitlocktech@gmail.com>

.gitea/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,41 @@
+---
+name: Bug report
+about: Report something that is broken or behaving unexpectedly
+title: "[bug] "
+labels:
+  - bug
+---
+
+## Summary
+
+<!-- A clear, concise description of the bug. -->
+
+## Steps to reproduce
+
+1.
+2.
+3.
+
+## Expected behavior
+
+<!-- What you expected to happen. -->
+
+## Actual behavior
+
+<!-- What actually happened. Include exact error messages and logs if you have them. -->
+
+## Environment
+
+- Component / repo:
+- Version or commit:
+- OS / runtime (Node, Rust, ServUO, browser…):
+- Deployment (Docker Compose, local dev, bare metal…):
+
+## Additional context
+
+<!-- Screenshots, config (with secrets redacted), anything else that helps. -->
+
+<!--
+  Security issue? Do NOT file it here. See SECURITY.md and email
+  whitlocktech@gmail.com instead.
+-->

.gitea/ISSUE_TEMPLATE/config.yaml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security vulnerability
+    url: https://gitea.whitlocktech.com/RunicGateway/servuo-plugins/src/branch/main/SECURITY.md
+    about: Please do not open a public issue for security problems — report them privately by email instead (see SECURITY.md).

.gitea/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,23 @@
+---
+name: Feature request
+about: Suggest an idea, enhancement, or new capability
+title: "[feature] "
+labels:
+  - enhancement
+---
+
+## Problem / motivation
+
+<!-- What are you trying to do? What's missing or painful today? -->
+
+## Proposed solution
+
+<!-- What you'd like to see happen. -->
+
+## Alternatives considered
+
+<!-- Other approaches you thought about, and why you prefer the one above. -->
+
+## Additional context
+
+<!-- Mockups, links, related issues, affected component/repo, etc. -->

.gitea/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,33 @@
+<!--
+  Thanks for contributing to Runic Gateway!
+  Please fill out the sections below and check every box before requesting review.
+-->
+
+## What & why
+
+<!-- What does this PR change, and why? Link any related issue: "Closes #123". -->
+
+## How it was tested
+
+<!-- Commands you ran, manual steps, screenshots. -->
+
+## Checklist
+
+- [ ] I have read [CONTRIBUTING.md](CONTRIBUTING.md).
+- [ ] The change builds and existing tests/checks pass locally.
+- [ ] I have added or updated tests/docs where it makes sense.
+- [ ] My commits are reasonably scoped with clear messages.
+
+## AI-assisted contributions (required)
+
+This project **requires disclosure of AI tool usage**. Please pick one:
+
+- [ ] No AI tools were used to produce this contribution.
+- [ ] AI tools were used. Tool(s): `___________`. I have reviewed and understand
+      every change, and take responsibility for it. AI-authored commits are
+      marked with a `Co-Authored-By` / `Assisted-By` trailer.
+
+## License
+
+- [ ] I agree that my contribution is licensed under this project's license
+      (**GNU GPL v3.0 or later**), and I have the right to contribute it.

.gitea/workflows/release.yml

@@ -0,0 +1,623 @@
+# Automated release for the deployable ServUO overlay.
+#
+# Trigger: every push to `main` (i.e. every merged PR).
+#
+# Why this exists: the Runic Gateway installer deploys the plugin from a release
+# tarball, not from git — the shard host gets no git and no Gitea credentials
+# (docs/installer/PLAN.md §1, §5 Phase 0.1). Until this workflow, `link` was the
+# only repo that published releases, so there was nothing for the installer to
+# fetch. This is Phase 0 item 1.
+#
+# Flow (two conceptual halves, kept separate on purpose):
+#
+#   ┌── RELEASE ENGINE (language-agnostic) ─────────────────────────────┐
+#   │  reads: latest v* git tag + conventional-commit subjects          │
+#   │  produces: next version, changelog, and (at the end) the release  │
+#   └───────────────────────────────────────────────────────────────────┘
+#   ┌── OVERLAY ADAPTER (the only repo-specific part) ──────────────────┐
+#   │  consumes: the version                                            │
+#   │  produces: runicgateway-overlay-<ver>.tar.gz + SHA256SUMS         │
+#   └───────────────────────────────────────────────────────────────────┘
+#
+# The engine is `link/.gitea/workflows/release.yml`'s, reused as its own header
+# anticipated — the plan and release steps consume only {version, changelog,
+# artifacts} and know nothing about what is inside the artifacts.
+#
+# ── Three differences from link's copy, all forced by this repo ──────────────
+#
+# 1. NO BUILD. The plugin ships as C# source and ServUO compiles it at boot; it
+#    needs ServUO reference assemblies, so there is no way to compile it here.
+#    The build gates are replaced by the structural gates below, which is the
+#    most this repo can honestly assert about an artifact.
+#
+# 2. NO BUMP COMMIT, and so no push to `main`. link has to write the version
+#    into Cargo.toml because the binary embeds it; a tarball embeds nothing but
+#    the manifest.json this job generates, so the git tag IS the version. That
+#    removes a failure mode outright: this workflow never needs `main` to accept
+#    a direct push, so no branch-protection exception is required for it.
+#
+# 3. A MANIFEST. The tarball carries manifest.json — version, commit, declared
+#    protocol version, ServUO compatibility, and a SHA256 for every file. The
+#    installer needs it because the plugin announces no version on the wire and
+#    none is queryable before ServUO boots (PLAN.md §2.6): the manifest is the
+#    only thing that lets the bundle CI verify sidecar/overlay protocol
+#    agreement BEFORE an operator installs the pair (PLAN.md §7.1, gate 1).
+#
+# Version bump (conventional commits since the last v* tag):
+#   feat!: / BREAKING CHANGE  -> major     feat: -> minor     fix|perf: -> patch
+#   nothing releasable        -> no release is cut (a docs:/chore:-only merge
+#                                deliberately does NOT cut one — PLAN.md §7.3)
+#   (first ever run, no tag)  -> releases SEED_VERSION below
+#
+# Prerequisites (Settings → Actions → Secrets on RunicGateway/servuo-plugins):
+#   REGISTRY_TOKEN  — Gitea access token with `write:repository`, to push the
+#                     tag and create the release. The final step also dispatches
+#                     RunicGateway/installer's bundle workflow, so the token
+#                     ideally has write there too — a nicety, not a requirement:
+#                     without it the step warns and that repo's nightly cron
+#                     picks the release up instead.
+#   REGISTRY_USER   — the Gitea username that token belongs to.
+#
+# These are checked by an explicit preflight step rather than left to fail
+# wherever they happen to be used first — see the comment on that step for why
+# an absent token does NOT simply fail the tag push.
+#
+# The final step POSTs to the installer repo's bundle workflow, so a new overlay
+# release recomposes the compat matrix immediately instead of waiting for that
+# repo's nightly cron (PLAN.md §7.2). It was deliberately absent until Phase 0
+# item 3 landed something to dispatch — a step that 404s on every release is
+# worse than no step.
+
+name: Release overlay
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch: {}
+
+concurrency:
+  group: release-overlay
+  cancel-in-progress: false
+
+env:
+  GITEA_HOST: gitea.whitlocktech.com
+  REPO: RunicGateway/servuo-plugins
+  # Artifact naming per PLAN.md §3.
+  ARTIFACT: runicgateway-overlay
+  # Used only for the very first release, when no v* tag exists yet. Matches the
+  # house style set by link (pre-1.0; the release version is independent of the
+  # protocol version, which lives in overlay.toml).
+  SEED_VERSION: "0.1.0"
+  # Notified after a release so the installer's compat matrix picks up this
+  # overlay immediately rather than at its next nightly run (PLAN.md §7.2).
+  INSTALLER_REPO: RunicGateway/installer
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out full history (need tags + commit log for the bump)
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      # ── RELEASE ENGINE: decide the next version + changelog ──────────────
+      - name: Plan the release (version + changelog)
+        id: plan
+        env:
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -euo pipefail
+          mkdir -p dist
+          git fetch --tags --force >/dev/null 2>&1 || true
+
+          LAST_TAG="$(git describe --tags --match 'v*' --abbrev=0 2>/dev/null || true)"
+          if [ -n "$LAST_TAG" ]; then RANGE="${LAST_TAG}..HEAD"; else RANGE="HEAD"; fi
+
+          SUBJECTS="$(git log --no-merges --format='%s' $RANGE || true)"
+          BODIES="$(git log --no-merges --format='%B' $RANGE || true)"
+
+          BUMP=none
+          if echo "$BODIES"   | grep -qE 'BREAKING[ -]CHANGE'          ; then BUMP=major; fi
+          if echo "$SUBJECTS" | grep -qE '^[a-z]+(\([^)]+\))?!:'       ; then BUMP=major; fi
+          if [ "$BUMP" = none ] && echo "$SUBJECTS" | grep -qE '^feat(\([^)]+\))?:'      ; then BUMP=minor; fi
+          if [ "$BUMP" = none ] && echo "$SUBJECTS" | grep -qE '^(fix|perf)(\([^)]+\))?:'; then BUMP=patch; fi
+
+          bump() { # <x.y.z> <major|minor|patch> -> bumped
+            IFS=. read -r MA MI PA <<< "$1"
+            case "$2" in
+              major) echo "$((MA+1)).0.0" ;;
+              minor) echo "${MA}.$((MI+1)).0" ;;
+              patch) echo "${MA}.${MI}.$((PA+1))" ;;
+            esac
+          }
+
+          RELEASE=true
+          if [ -z "$LAST_TAG" ]; then
+            VERSION="$SEED_VERSION"                  # first release: seed
+          elif [ "$BUMP" = none ]; then
+            RELEASE=false                            # no feat/fix/breaking since last tag
+            VERSION="${LAST_TAG#v}"
+          else
+            VERSION="$(bump "${LAST_TAG#v}" "$BUMP")"
+          fi
+
+          # An existing tag is NOT automatically "nothing to do". A tag with no
+          # release behind it means a previous run tagged and then died before
+          # publishing — which is exactly what happened on the first run here,
+          # when the missing REGISTRY_* secrets took the release API call to 401
+          # after the tag had already been pushed. Standing down on the tag alone
+          # would make that state permanent: every later run would see the tag,
+          # set RELEASE=false, and the release would never appear. So distinguish
+          # the two cases and finish the job the earlier run started.
+          # Note this OVERRIDES the RELEASE=false decided just above. With the tag
+          # already in place there are no releasable commits after it, so the
+          # normal path stands down — which is precisely why the stuck state
+          # could never clear itself. Recovery has to be able to say "yes,
+          # publish" for a version the bump logic considers already done.
+          REUSE_TAG=false
+          if git rev-parse -q --verify "refs/tags/v${VERSION}" >/dev/null; then
+            REL_HTTP="$(curl -s -o /dev/null -w '%{http_code}' \
+              -H "Authorization: token $(printf '%s' "${REGISTRY_TOKEN:-}" | tr -d '\r\n')" \
+              "https://${GITEA_HOST}/api/v1/repos/${REPO}/releases/tags/v${VERSION}" || echo 000)"
+            if [ "$REL_HTTP" = "200" ]; then
+              echo "Tag v${VERSION} already has a release — nothing to do."
+              RELEASE=false
+            elif [ "$REL_HTTP" = "404" ]; then
+              echo "::warning::Tag v${VERSION} exists but has no release — a previous run failed after tagging. Reusing the tag and publishing the release it is missing."
+              REUSE_TAG=true
+              RELEASE=true
+            else
+              # Anything else (000 from a network failure, 401/403 from a bad
+              # token) is not evidence of absence. Guessing "no release" here
+              # would re-publish over a good one, so refuse instead.
+              echo "::error::Could not determine whether a release exists for v${VERSION} (HTTP ${REL_HTTP}). Refusing to guess."
+              exit 1
+            fi
+          fi
+
+          # ── Orphan sweep ────────────────────────────────────────────────
+          #
+          # The check above is VERSION-SCOPED: it only ever asks about the one
+          # version this run computed. That is enough to recover an orphan on
+          # the very next run, and useless afterwards — once any releasable
+          # commit lands, the next run computes a NEW version, never looks at
+          # the old tag again, and the orphan becomes permanent and silent.
+          #
+          # servuo-plugins v0.1.0 is the proof, and the proof is pointed: the
+          # commit that ADDED the recovery above was itself typed
+          # `fix(release): ... recover the orphaned v0.1.0 tag`, so it bumped to
+          # v0.1.1 — and the run that introduced the recovery stepped straight
+          # past the tag it was written to rescue. That tag is still orphaned.
+          #
+          # So every v* tag is checked, and anything missing a release is
+          # WARNED about. Deliberately not recovered: publishing an old version
+          # would mean building today's tree and shipping it under a tag whose
+          # tree it is not, which is worse than the inconsistency it fixes.
+          # A human decides whether to recover or drop it.
+          #
+          # Never fails the run. A sweep that can break a good release is a
+          # sweep someone will delete.
+          ORPHANS=""
+          for T in $(git tag -l 'v*' --sort=-v:refname); do
+            T_HTTP="$(curl -s -o /dev/null -w '%{http_code}' \
+              -H "Authorization: token $(printf '%s' "${REGISTRY_TOKEN:-}" | tr -d '\r\n')" \
+              "https://${GITEA_HOST}/api/v1/repos/${REPO}/releases/tags/${T}" || echo 000)"
+            [ "$T_HTTP" = "404" ] && ORPHANS="${ORPHANS} ${T}"
+          done
+          if [ -n "${ORPHANS}" ]; then
+            echo "::warning::Tags with no release:${ORPHANS} — a run failed after tagging. Publish or delete them; this job will not do either."
+          fi
+
+          # Changelog range. A recovery run has nothing after the tag, so
+          # summarize what the tag itself contains rather than emitting an empty
+          # list: the range that produced it, i.e. previous-tag..this-tag.
+          if [ "$REUSE_TAG" = true ]; then
+            PREV_TAG="$(git describe --tags --match 'v*' --abbrev=0 "v${VERSION}^" 2>/dev/null || true)"
+            if [ -n "$PREV_TAG" ]; then CL_RANGE="${PREV_TAG}..v${VERSION}"; else CL_RANGE="v${VERSION}"; fi
+            SINCE="$PREV_TAG"
+          else
+            CL_RANGE="$RANGE"
+            SINCE="$LAST_TAG"
+          fi
+          CL_SUBJECTS="$(git log --no-merges --format='%s' $CL_RANGE || true)"
+
+          {
+            echo "## ${ARTIFACT} v${VERSION}"
+            echo
+            FEATS="$(echo "$CL_SUBJECTS" | grep -E '^feat'        || true)"
+            FIXES="$(echo "$CL_SUBJECTS" | grep -E '^(fix|perf)'  || true)"
+            [ -n "$FEATS" ] && { echo "### Features";  echo "$FEATS" | sed 's/^/- /'; echo; }
+            [ -n "$FIXES" ] && { echo "### Fixes";     echo "$FIXES" | sed 's/^/- /'; echo; }
+            echo "### All changes"
+            if [ -n "$SINCE" ]; then echo "Since ${SINCE}:"; fi
+            echo "$CL_SUBJECTS" | sed 's/^/- /'
+          } > dist/CHANGELOG.md
+
+          echo "version=${VERSION}"     >> "$GITHUB_OUTPUT"
+          echo "tag=v${VERSION}"        >> "$GITHUB_OUTPUT"
+          echo "release=${RELEASE}"     >> "$GITHUB_OUTPUT"
+          echo "bump=${BUMP}"           >> "$GITHUB_OUTPUT"
+          echo "reuse_tag=${REUSE_TAG}" >> "$GITHUB_OUTPUT"
+          echo "==> release=${RELEASE} version=${VERSION} bump=${BUMP} reuse_tag=${REUSE_TAG} last_tag=${LAST_TAG:-<none>}"
+
+      # ── Credential preflight ─────────────────────────────────────────────
+      # Runs BEFORE anything is built or pushed, and only when this run intends
+      # to publish, so a docs:/chore:-only merge stays green on a repo that has
+      # no secrets.
+      #
+      # This exists because of how the first run failed. REGISTRY_USER and
+      # REGISTRY_TOKEN were empty, but the tag push SUCCEEDED anyway:
+      # actions/checkout leaves an `http.<host>.extraheader` credential in the
+      # local git config, so `git remote set-url` to a URL with empty
+      # credentials still authenticated through that leftover header. The
+      # release API call had no such fallback and returned 401 — so the run
+      # tagged the repo and then failed, which is the worst of both outcomes.
+      # Checking the secrets up front turns that into an immediate, legible
+      # failure instead of a half-published release.
+      - name: Verify release credentials are configured
+        if: ${{ steps.plan.outputs.release == 'true' }}
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -euo pipefail
+          MISSING=""
+          [ -n "$(printf '%s' "${REGISTRY_USER:-}"  | tr -d '\r\n')" ] || MISSING="${MISSING} REGISTRY_USER"
+          [ -n "$(printf '%s' "${REGISTRY_TOKEN:-}" | tr -d '\r\n')" ] || MISSING="${MISSING} REGISTRY_TOKEN"
+          if [ -n "$MISSING" ]; then
+            echo "::error::Missing Actions secret(s):${MISSING}. Set them under Settings → Actions → Secrets on ${REPO}. REGISTRY_TOKEN needs the write:repository scope to push the tag and create the release."
+            exit 1
+          fi
+          echo "Release credentials present."
+
+      - name: Install jq
+        if: ${{ steps.plan.outputs.release == 'true' }}
+        run: |
+          set -euo pipefail
+          command -v jq >/dev/null 2>&1 && exit 0
+          SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo"
+          $SUDO apt-get update -qq
+          $SUDO apt-get install -y -qq --no-install-recommends jq
+
+      # ── OVERLAY ADAPTER: gates ───────────────────────────────────────────
+      # There is no compiler to run, so these assert the things that CAN be
+      # checked without a ServUO tree — and each one has actually been a way to
+      # ship a broken overlay:
+      #
+      #   • overlay/ mirrors the server root; if Bridge.cfg or the Bridge scripts
+      #     go missing the deploy silently no-ops (PLAN.md §2.1).
+      #   • overlay/Scripts/Scripts.csproj is Phase 0 of the plugin itself — it
+      #     overwrites a stock file to fix ServUO's silent script-build bug. An
+      #     overlay shipped without it installs code that never compiles, and
+      #     ServUO reports success anyway.
+      #   • a malformed .patch is invisible until an operator runs the patch tier
+      #     on their live shard. `git apply --stat` parses the diff without
+      #     needing the target files present.
+      #   • each patch's companion .cs must exist, since it references symbols
+      #     the patch introduces and is meaningless without it (PLAN.md §2.2).
+      #   • patches/tier.json must describe every .patch and nothing but. That
+      #     table is what tells the installer which patches form one unit, which
+      #     companion follows which, and whether a CORE rebuild is needed — a
+      #     patch added without it would be shipped and silently never offered.
+      - name: Validate the overlay and patch tier
+        if: ${{ steps.plan.outputs.release == 'true' }}
+        run: |
+          set -euo pipefail
+          fail() { echo "::error::$*"; exit 1; }
+
+          [ -f overlay/Config/Bridge.cfg ]        || fail "overlay/Config/Bridge.cfg is missing"
+          [ -f overlay/Scripts/Scripts.csproj ]   || fail "overlay/Scripts/Scripts.csproj is missing (the silent-build-bug fix)"
+          [ -d overlay/Scripts/Custom/Bridge ]    || fail "overlay/Scripts/Custom/Bridge/ is missing"
+
+          CS_COUNT="$(find overlay/Scripts/Custom/Bridge -name '*.cs' | wc -l)"
+          [ "$CS_COUNT" -gt 0 ] || fail "overlay/Scripts/Custom/Bridge/ contains no .cs files"
+          echo "overlay: ${CS_COUNT} bridge script(s)"
+
+          for p in patches/*.patch; do
+            [ -e "$p" ] || fail "patches/ contains no .patch files"
+            echo "--- ${p}"
+            git apply --stat "$p" || fail "${p} is not a parseable unified diff"
+          done
+
+          # The tier table, checked in BOTH directions. A patch missing from
+          # tier.json ships but is never offered to an operator; a tier.json
+          # entry naming a file that is not there makes the installer report a
+          # feature it cannot apply. Neither surfaces until someone runs the
+          # tier on a live shard, so both fail the release here instead.
+          [ -f patches/tier.json ] || fail "patches/tier.json is missing (the patch-tier declaration)"
+          jq -e . patches/tier.json >/dev/null || fail "patches/tier.json is not valid JSON"
+
+          DESCRIBED="$(jq -r '.features[].patches[].file' patches/tier.json | LC_ALL=C sort)"
+          PRESENT="$(cd patches && ls *.patch | LC_ALL=C sort)"
+          if [ "$DESCRIBED" != "$PRESENT" ]; then
+            echo "described by tier.json:"; echo "$DESCRIBED" | sed 's/^/  /'
+            echo "present in patches/:";    echo "$PRESENT"   | sed 's/^/  /'
+            fail "patches/tier.json and patches/*.patch disagree — every patch must be described by exactly one feature"
+          fi
+
+          # Each patch's declared target must be the file its diff actually
+          # edits. The installer cross-checks the same pair at install time and
+          # refuses on a mismatch, so catching it here saves an operator the run.
+          while IFS=$'\t' read -r PFILE PTARGET; do
+            DIFF_TARGET="$(sed -n 's|^+++ b/||p' "patches/${PFILE}" | head -1 | tr -d '\r')"
+            [ "$DIFF_TARGET" = "$PTARGET" ] \
+              || fail "patches/${PFILE} edits ${DIFF_TARGET} but tier.json declares ${PTARGET}"
+          done < <(jq -r '.features[].patches[] | [.file, .target] | @tsv' patches/tier.json)
+
+          # Companions can only be copied after their feature's patches land, so
+          # they live here rather than in overlay/ — and a missing one turns a
+          # successfully patched shard into one that does not compile.
+          for f in $(jq -r '.features[].companions[].file' patches/tier.json); do
+            [ -f "patches/${f}" ] || fail "patches/${f} is missing (a feature's companion source)"
+          done
+
+          for r in $(jq -r '.features[].rebuild' patches/tier.json); do
+            case "$r" in
+              core|scripts) ;;
+              *) fail "tier.json declares rebuild=\"${r}\"; only \"core\" or \"scripts\" are understood" ;;
+            esac
+          done
+          echo "patch tier: $(jq -r '.features | length' patches/tier.json) feature(s), $(echo "$PRESENT" | wc -l) patch(es)"
+
+          [ -f overlay.toml ] || fail "overlay.toml is missing (protocol + ServUO declarations)"
+
+      # ── OVERLAY ADAPTER: stage, manifest, package ────────────────────────
+      # The tarball has a FIXED top-level directory (runicgateway-overlay/), not a
+      # versioned one: the installer extracts and then looks for overlay/,
+      # patches/ and manifest.json at known paths, and a version-dependent prefix
+      # would make it parse the very version it is trying to read.
+      #
+      # tar flags pin ownership, mtime and member order so the same tree produces
+      # a byte-identical tarball — a checksum that changes only when content
+      # changes is worth more than one that changes every run.
+      - name: Build manifest.json and the release tarball
+        if: ${{ steps.plan.outputs.release == 'true' }}
+        run: |
+          set -euo pipefail
+          VERSION="${{ steps.plan.outputs.version }}"
+          STAGE="dist/stage/${ARTIFACT}"
+
+          mkdir -p "${STAGE}"
+          cp -r overlay  "${STAGE}/overlay"
+          cp -r patches  "${STAGE}/patches"
+
+          # tier.json is folded into manifest.json below, so the staged copy is
+          # removed: shipping it twice would give the tarball two statements of
+          # the same table, one of which nothing reads and both of which are
+          # free to drift.
+          rm -f "${STAGE}/patches/tier.json"
+
+          # Declarations from overlay.toml. Read, don't hardcode — the point of
+          # that file is that the protocol number lives in one place.
+          PROTOCOL="$(grep -m1 -E '^protocol[[:space:]]*=' overlay.toml | sed -E 's/[^0-9]//g')"
+          MIN_SERVUO="$(grep -m1 -E '^min_servuo_version[[:space:]]*=' overlay.toml | sed -E 's/.*"([^"]+)".*/\1/')"
+          PATCHED_AGAINST="$(grep -m1 -E '^patches_verified_against[[:space:]]*=' overlay.toml | sed -E 's/.*"([^"]+)".*/\1/')"
+          [ -n "$PROTOCOL" ] || { echo "::error::could not read protocol from overlay.toml"; exit 1; }
+          [ -n "$MIN_SERVUO" ] || { echo "::error::could not read min_servuo_version from overlay.toml"; exit 1; }
+          [ -n "$PATCHED_AGAINST" ] || { echo "::error::could not read patches_verified_against from overlay.toml"; exit 1; }
+          echo "==> protocol=${PROTOCOL} min_servuo=${MIN_SERVUO} patches_verified_against=${PATCHED_AGAINST}"
+
+          # The patch tier, folded in verbatim minus its comment block. Paths are
+          # rewritten to be relative to the tarball root (`patches/<file>`), which
+          # is where the installer will find them after extraction — tier.json
+          # names them relative to patches/ because that is where a maintainer
+          # editing it is looking.
+          TIER="$(jq '
+            del(._comment)
+            | .features |= map(
+                .patches    |= map(.file |= "patches/" + .)
+              | .companions |= map(.file |= "patches/" + .)
+              )' patches/tier.json)"
+
+          # Per-file SHA256 of everything shipped, as a {path: sha} object. The
+          # installer records these in install.json so a later `doctor` can tell
+          # "operator edited a deployed file" from "the overlay drifted".
+          # The `\*?` is not paranoia: sha256sum marks binary mode by prefixing the
+          # path with `*` (`<hash> *path`) instead of the two-space text-mode
+          # separator. Coreutils on Linux defaults to text mode, but a build host
+          # that doesn't would otherwise put a leading `*` on EVERY key here and
+          # silently produce a manifest whose paths match nothing.
+          FILES="$(cd "${STAGE}" \
+            && find overlay patches -type f -print0 | LC_ALL=C sort -z | xargs -0 sha256sum \
+            | jq -R -s '
+                split("\n") | map(select(length > 0))
+                | map(capture("^(?<sha>[0-9a-f]+)[ \t]+\\*?(?<path>.+)$"))
+                | map({ (.path): .sha }) | add')"
+
+          jq -n \
+            --arg    component "servuo-plugins-overlay" \
+            --arg    version   "${VERSION}" \
+            --arg    commit    "${GITHUB_SHA}" \
+            --arg    repo      "${REPO}" \
+            --argjson protocol "${PROTOCOL}" \
+            --arg    min_servuo "${MIN_SERVUO}" \
+            --arg    patched_against "${PATCHED_AGAINST}" \
+            --argjson tier     "${TIER}" \
+            --argjson files    "${FILES}" \
+            '{
+               component: $component,
+               version:   $version,
+               commit:    $commit,
+               repo:      $repo,
+               protocol:  $protocol,
+               servuo: {
+                 min_version:              $min_servuo,
+                 patches_verified_against: $patched_against
+               },
+               patch_tier: $tier,
+               files: $files
+             }' > "${STAGE}/manifest.json"
+
+          echo "----- manifest.json (files elided) -----"
+          jq 'del(.files) + {file_count: (.files | length)}' "${STAGE}/manifest.json"
+
+          TARBALL="${ARTIFACT}-${VERSION}.tar.gz"
+          tar --sort=name --mtime='UTC 1970-01-01' \
+              --owner=0 --group=0 --numeric-owner \
+              -czf "dist/${TARBALL}" -C dist/stage "${ARTIFACT}"
+
+          ( cd dist && sha256sum "${TARBALL}" > SHA256SUMS )
+          echo "tarball=${TARBALL}" >> "$GITHUB_OUTPUT"
+          ls -l dist && echo "----" && cat dist/SHA256SUMS
+        id: package
+
+      # ── RELEASE ENGINE: tag ──────────────────────────────────────────────
+      # Tag only — no bump commit, so `main` is never pushed to (see header).
+      - name: Push the release tag
+        if: ${{ steps.plan.outputs.release == 'true' }}
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -euo pipefail
+          TAG="${{ steps.plan.outputs.tag }}"
+          # Secrets can arrive with a trailing newline (depending on how they were
+          # pasted); a stray CR/LF corrupts the remote URL ("credential url cannot
+          # be parsed"). Strip line breaks before building the URL.
+          CI_USER="$(printf '%s' "${REGISTRY_USER}" | tr -d '\r\n')"
+          CI_TOKEN="$(printf '%s' "${REGISTRY_TOKEN}" | tr -d '\r\n')"
+          git config user.name  "servuo-plugins-ci"
+          git config user.email "ci@whitlocktech.com"
+          git remote set-url origin \
+            "https://${CI_USER}:${CI_TOKEN}@${GITEA_HOST}/${REPO}.git"
+
+          # The tag may already exist when we are finishing a run that died after
+          # tagging (see the plan step). `git tag` on an existing name fails under
+          # `set -e`, and pushing an identical existing tag is a harmless no-op —
+          # so create it only if it is new, then push either way. A push that
+          # fails here means the remote tag points somewhere else, which SHOULD
+          # stop the run.
+          if git rev-parse -q --verify "refs/tags/${TAG}" >/dev/null; then
+            echo "Tag ${TAG} already exists — reusing it."
+          else
+            git tag "${TAG}"
+          fi
+          git push origin "${TAG}"
+
+      # ── RELEASE ENGINE: create the Gitea release + upload assets ─────────
+      - name: Create Gitea release and upload assets
+        if: ${{ steps.plan.outputs.release == 'true' }}
+        env:
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -euo pipefail
+          TAG="${{ steps.plan.outputs.tag }}"
+          TARBALL="${{ steps.package.outputs.tarball }}"
+          API="https://${GITEA_HOST}/api/v1/repos/${REPO}"
+          BODY="$(cat dist/CHANGELOG.md)"
+          # Same newline hygiene as the tag step: a stray CR/LF in the token would
+          # corrupt the Authorization header.
+          CI_TOKEN="$(printf '%s' "${REGISTRY_TOKEN}" | tr -d '\r\n')"
+
+          PAYLOAD="$(jq -n --arg tag "$TAG" --arg body "$BODY" \
+                       '{tag_name:$tag, name:$tag, body:$body, draft:false, prerelease:false}')"
+
+          # installer#22's release run failed exactly here: it landed one second
+          # after the tag push and Gitea answered 500, having not finished
+          # processing the pushed tag. Re-running published the same artifacts
+          # untouched, so it was a race, not a bad request — but the tag sat
+          # orphaned until a human noticed.
+          #
+          # Two things made that worse than it needed to be.
+          #
+          # 1. `curl -sSf` prints NO response body on an error status, so all the
+          #    log carried was "curl: (22) ... error: 500" and the cause had to be
+          #    inferred from timestamps. Capture the body and print it.
+          # 2. Nothing retried, so a transient 5xx became a permanent orphan.
+          #
+          # 4xx is deliberately NOT retried: a bad token or a malformed body does
+          # not improve by being sent again, and retrying only turns a clear
+          # failure into a slow one.
+          REL_ID=""
+          for attempt in 1 2 3 4 5; do
+            HTTP="$(curl -s -o /tmp/rel.json -w '%{http_code}' -X POST "${API}/releases" \
+              -H "Authorization: token ${CI_TOKEN}" \
+              -H "Content-Type: application/json" \
+              -d "${PAYLOAD}" || echo 000)"
+
+            if [ "$HTTP" = "201" ] || [ "$HTTP" = "200" ]; then
+              REL_ID="$(jq -r '.id' /tmp/rel.json)"
+              break
+            fi
+
+            echo "::warning::POST /releases attempt ${attempt} returned HTTP ${HTTP}"
+            echo "--- response body ---"
+            cat /tmp/rel.json || true
+            echo
+            echo "---------------------"
+
+            case "$HTTP" in
+              4*) echo "::error::HTTP ${HTTP} is a client error - not retrying."; exit 1 ;;
+            esac
+
+            if [ "$attempt" = 5 ]; then
+              echo "::error::POST /releases still failing after 5 attempts. Tag ${TAG} is pushed but has no release."
+              echo "::error::Re-run this workflow - the plan step detects the orphan tag and republishes it."
+              exit 1
+            fi
+            sleep $(( attempt * 5 ))
+          done
+
+          if [ -z "$REL_ID" ] || [ "$REL_ID" = "null" ]; then
+            echo "::error::Release created but no id came back; refusing to upload assets blind."
+            exit 1
+          fi
+          echo "Created release ${TAG} (id=${REL_ID})"
+
+          for f in "${TARBALL}" SHA256SUMS; do
+            # Same treatment. An upload that fails quietly leaves a release whose
+            # SHA256SUMS does not cover every artifact it advertises, which is
+            # worse than no release at all -- that file is the trust anchor.
+            HTTP="$(curl -s -o /tmp/asset.json -w '%{http_code}' -X POST "${API}/releases/${REL_ID}/assets?name=${f}" \
+              -H "Authorization: token ${CI_TOKEN}" \
+              -F "attachment=@dist/${f}" || echo 000)"
+            if [ "$HTTP" != "201" ] && [ "$HTTP" != "200" ]; then
+              echo "::error::uploading ${f} returned HTTP ${HTTP}"
+              cat /tmp/asset.json || true
+              exit 1
+            fi
+            echo "  uploaded ${f}"
+          done
+
+      # ── Recompose the installer's bundle manifest ────────────────────────
+      # The installer does not resolve "latest" at run time — it deploys the
+      # exact overlay named by a published bundle (docs/installer/PLAN.md §7.1).
+      # An overlay release that nobody recomposes around is therefore a release
+      # no operator will ever be offered. This tells the installer repo to
+      # rebuild that manifest now rather than leaving the new version invisible
+      # until its nightly cron.
+      #
+      # That job re-reads this tarball's manifest.json and checks its declared
+      # `protocol` against the sidecar's PROTOCOL_VERSION before publishing
+      # anything (PLAN.md §7.1, gate 1) — which is the check this repo cannot
+      # perform for itself, since the C# plugin announces no version on the wire.
+      #
+      # DISPATCH, DON'T WAIT (PLAN.md §7.3). Gitea's workflow-dispatch endpoint
+      # returns no run handle, so there is nothing to poll: a waiting step would
+      # have to guess which run is its own and hold a runner idle to do it.
+      #
+      # A failure here is a WARNING, never a failure of this job. The release is
+      # already published and correct by this point, and failing the run would
+      # misreport that. The installer's nightly cron recomposes from whatever the
+      # latest releases actually are, so a dropped dispatch costs latency, not
+      # correctness.
+      - name: Ask the installer repo to recompose its bundle
+        if: ${{ steps.plan.outputs.release == 'true' }}
+        env:
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -euo pipefail
+          CI_TOKEN="$(printf '%s' "${REGISTRY_TOKEN}" | tr -d '\r\n')"
+          HTTP="$(curl -s -o /dev/null -w '%{http_code}' -X POST \
+            -H "Authorization: token ${CI_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d '{"ref":"main"}' \
+            "https://${GITEA_HOST}/api/v1/repos/${INSTALLER_REPO}/actions/workflows/bundle.yml/dispatches" || echo 000)"
+          case "$HTTP" in
+            20*) echo "Dispatched ${INSTALLER_REPO} bundle.yml (HTTP ${HTTP}) — not waiting for it." ;;
+            403|404)
+              echo "::warning::Could not dispatch ${INSTALLER_REPO} bundle.yml (HTTP ${HTTP}). REGISTRY_TOKEN likely lacks write:repository on that repo. Release ${{ steps.plan.outputs.tag }} is published and fine; its bundle will be composed by the installer's nightly cron instead." ;;
+            *)
+              echo "::warning::Dispatching ${INSTALLER_REPO} bundle.yml returned HTTP ${HTTP}. Release ${{ steps.plan.outputs.tag }} is published and fine; the nightly cron will recompose the bundle." ;;
+          esac

.gitignore

@@ -7,3 +7,4 @@ obj/
 *.exe
 *.pdb
 *.log
+dist/

CODE_OF_CONDUCT.md

@@ -0,0 +1,133 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, caste, color, religion, or sexual
+identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the overall
+  community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or advances of
+  any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email address,
+  without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official email address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+**whitlocktech@gmail.com**.
+
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of
+actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or permanent
+ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior, harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the
+community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
+
+Community Impact Guidelines were inspired by
+[Mozilla's code of conduct enforcement ladder][Mozilla CoC].
+
+For answers to common questions about this code of conduct, see the FAQ at
+[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at
+[https://www.contributor-covenant.org/translations][translations].
+
+[homepage]: https://www.contributor-covenant.org
+[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
+[Mozilla CoC]: https://github.com/mozilla/diversity
+[FAQ]: https://www.contributor-covenant.org/faq
+[translations]: https://www.contributor-covenant.org/translations

CONTRIBUTING.md

@@ -0,0 +1,102 @@
+# Contributing to Runic Gateway — ServUO Plugin
+
+Thanks for your interest in contributing! This repo is the **C# ServUO side** of
+the game bridge. The shard emits newline-delimited JSON over a loopback TCP
+socket to the Rust sidecar
+([RunicGateway/link](https://gitea.whitlocktech.com/RunicGateway/link)).
+
+By participating you agree to abide by our
+[Code of Conduct](CODE_OF_CONDUCT.md).
+
+## Ways to contribute
+
+- **Report a bug** or **request a feature** through the
+  [issue tracker](https://gitea.whitlocktech.com/RunicGateway/servuo-plugins/issues)
+  (issue templates are provided).
+- **Improve the code or docs** by opening a pull request (see below).
+- **Never** report a security vulnerability in a public issue — see
+  [SECURITY.md](SECURITY.md).
+
+## Development setup
+
+This plugin is deployed as **source** and compiled by ServUO at boot — there is
+no standalone build artifact and no CI build (it needs the ServUO reference
+assemblies to compile). See the [README](README.md) for the full model.
+
+**Key rule:** anything under `overlay/` is authoritative and mirrors the ServUO
+server root. **Do not edit files in a deployed server tree directly** — edit here
+under `overlay/` (or `patches/` for changes to stock ServUO files) and deploy:
+
+```powershell
+# Show what would change, then write it into a ServUO install:
+.\deploy.ps1 -ServerPath C:\path\to\servuo -Verify
+.\deploy.ps1 -ServerPath C:\path\to\servuo
+```
+
+`deploy.ps1` deploys from *this working tree*, which is what you want while
+developing. It is not how a shard is set up: operators run the
+[Runic Gateway installer](https://gitea.whitlocktech.com/RunicGateway/installer),
+which syncs the released overlay tarball and installs the sidecar alongside it.
+Changes here reach shards through a [release](README.md#releases), so a change
+that only works when `deploy.ps1` copies it is a change that does not ship.
+
+- `overlay/` — copied over an install (the only thing `deploy.ps1` deploys).
+- `patches/` — unified diffs against stock ServUO for files we must modify.
+- `tools/` — never deployed: test scaffolding and stub sidecars.
+
+### Testing
+
+`tools/stub_sidecar.ps1` is a loopback listener that logs every line the shard
+sends — run it, boot the shard, and watch events arrive:
+
+```powershell
+.\tools\stub_sidecar.ps1 -Port 7788 -Log .\sidecar.log
+```
+
+`tools/stub_sidecar_request.ps1` additionally sends inbound requests to exercise
+the request/response handlers. For real end-to-end testing, run against the Rust
+sidecar rather than the throwaway PowerShell stubs.
+
+### Protocol compatibility
+
+The loopback JSON protocol is a **compatibility contract** shared with the
+sidecar. The canonical event/command catalog lives in the
+[docs repo](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link)
+(`PLAN.md` §5/§7 and `INTEGRATION.md`). If you add or change an event or command,
+keep the plugin, the sidecar, and the spec in sync.
+
+## Branch & PR workflow
+
+1. Branch from `main` with a descriptive name
+   (`feature/…`, `fix/…`, `docs/…`, `chore/…`).
+2. Keep changes focused; small PRs are easier to review.
+3. Push and open a pull request against `main`. Fill out the PR template,
+   including the **AI-assisted contributions** disclosure.
+4. A maintainer will review; address feedback with follow-up commits.
+
+### Commit messages
+
+We use [Conventional Commits](https://www.conventionalcommits.org/) —
+`type(scope): summary` (e.g. `feat(bridge): add vendor.sale event`).
+
+## AI-assisted contributions (disclosure required)
+
+This project is developed openly with AI assistance, and we ask the same
+transparency of everyone. **If you used an AI tool** (Claude, Copilot, ChatGPT,
+Cursor, etc.) to help produce a contribution, you must disclose it:
+
+- Tick the AI-usage box in the pull-request template and name the tool(s).
+- Mark AI-authored commits with a trailer, e.g.
+  `Co-Authored-By: Claude <noreply@anthropic.com>` or `Assisted-By: <tool>`.
+- You remain responsible for every line you submit: review it, understand it,
+  and make sure it is correct and that you have the right to contribute it.
+
+Disclosed AI assistance is welcome. Undisclosed AI-generated contributions are
+not, and may be closed.
+
+## License
+
+Runic Gateway is licensed under the **GNU General Public License v3.0 or later**
+(see [LICENSE.md](LICENSE.md)). By submitting a contribution you agree that it is
+licensed under the same terms (inbound = outbound) and that you have the right to
+contribute it.

CONTRIBUTORS.md

@@ -0,0 +1,31 @@
+# Contributors
+
+Runic Gateway is built and maintained by the people and tools listed here.
+Thank you to everyone who has contributed.
+
+## Maintainers
+
+- **whitlocktech** <whitlocktech@gmail.com> — project lead and maintainer
+
+## Contributors
+
+<!--
+  Add yourself here when your contribution is merged — alphabetical by name or
+  handle. One line each:
+
+  - **Name or handle** (optional link) — what you contributed
+-->
+
+- _Your name could be here — see [CONTRIBUTING.md](CONTRIBUTING.md)._
+
+## AI-assisted development
+
+Parts of Runic Gateway were developed with the assistance of AI coding tools,
+including **Claude** (Anthropic) via Claude Code. AI-assisted commits are
+attributed in their commit trailers (e.g. `Co-Authored-By: Claude ...`).
+
+In keeping with this project's transparency policy, **all contributors must
+disclose their use of AI tools** on any contribution — see the
+"AI-assisted contributions" section of [CONTRIBUTING.md](CONTRIBUTING.md).
+Disclosed AI assistance is welcome; undisclosed AI-generated contributions are
+not.

LICENSE.md

@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<https://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<https://www.gnu.org/licenses/why-not-lgpl.html>.

README.md

@@ -26,7 +26,9 @@ integration guide, protocol spec, research — with full history preserved).
 | `overlay/` | Mirrors the ServUO server root. Everything here — and **only** this — copies over an install. |
 | `patches/` | Unified diffs against stock ServUO for files we must modify rather than add. |
 | `tools/` | Never deployed. Test scaffolding (C# probes + PowerShell stub sidecars) and anything else that must not reach a server. |
-| `deploy.ps1` | Copies `overlay/` into a server root. `-Verify` diffs instead of writing. |
+| `deploy.ps1` | **Developer tool** — copies `overlay/` from this working tree into a server root. `-Verify` diffs instead of writing. Operators use the [installer](https://gitea.whitlocktech.com/RunicGateway/installer); see [Deploy](#deploy). |
+| `overlay.toml` | Release metadata: the wire-protocol version this overlay speaks, and its ServUO compatibility. Read by CI into the release manifest — see [Releases](#releases). |
+| `.gitea/workflows/release.yml` | Publishes `runicgateway-overlay-<ver>.tar.gz` on every merge to `main`. |
 | [INTEGRATION.md](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/INTEGRATION.md) | **Website integration guide** — the WebSocket feed, REST endpoints, auth, event catalog, and examples. |
 | [PLAN.md](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PLAN.md) | Implementation plan, measured performance budget, and the full data catalog. |
 | [RESEARCH.md](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/RESEARCH.md) | Original source-level research. Partly superseded — see the corrections table in `PLAN.md` §8. |
@@ -37,13 +39,17 @@ Anything under `overlay/` is authoritative. Do not edit files in the server tree
 ## Sidecar & deployment
 
 The Rust sidecar is the other half of the bridge and lives in **[RunicGateway/link](https://gitea.whitlocktech.com/RunicGateway/link)**.
-The two are deployed **together** but built **independently**:
+The two are deployed **together** — by the
+[installer](https://gitea.whitlocktech.com/RunicGateway/installer), in one run — but built
+**independently**:
 
-- **This plugin** is deployed as *source* — `deploy.ps1` copies `overlay/` into the ServUO server
-  root, and ServUO compiles it at boot (`Scripts.csproj`; see [Phase 0](#phase-0--what-it-fixes)).
-  There is no separate build artifact and no CI build — it cannot be compiled standalone without the
-  ServUO reference assemblies.
-- **The sidecar** is a standalone Rust binary, released from its own repo.
+- **This plugin** is deployed as *source*: `overlay/` is copied into the ServUO server root and
+  ServUO compiles it at boot (`Scripts.csproj`; see [Phase 0](#phase-0--what-it-fixes)). There is
+  **no CI build** — it cannot be compiled standalone without the ServUO reference assemblies. CI
+  publishes a *source* tarball, which is what the installer fetches and syncs; see
+  [Releases](#releases).
+- **The sidecar** is a standalone Rust binary, released from its own repo and installed from that
+  release.
 
 The **only** coupling is the loopback JSON protocol (the shard dials out to the sidecar on
 `127.0.0.1`). Compatibility is a **protocol** concern, not a build-order one: keep the event/command
@@ -54,11 +60,77 @@ without the sidecar running.
 
 ## Deploy
 
-```powershell
-.\deploy.ps1 -ServerPath C:\Users\colby\Desktop\servuo -Verify   # show what would change
-.\deploy.ps1 -ServerPath C:\Users\colby\Desktop\servuo           # write
+**On a shard, use the [Runic Gateway installer](https://gitea.whitlocktech.com/RunicGateway/installer).**
+One binary syncs this overlay from the release tarball below, offers the patch tier, installs the
+uo-link sidecar as a service, and prints the values your website needs — cross-platform, with a
+`doctor` afterwards to tell a copied file from a working bridge:
+
+```bash
+sudo ./runicgateway-installer-linux-x86_64 install
 ```
 
+Guide: [installer/INSTALL.md](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/installer/INSTALL.md).
+To place the overlay yourself instead — a host that cannot run the binary, or you want to see every
+file land — [Appendix A2](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/installer/INSTALL.md#a2-deploy-the-plugin-overlay)
+is the same copy done by hand, and stays supported.
+
+### `deploy.ps1` — the developer path
+
+`deploy.ps1` deploys from a **working tree**, which is what you want while writing plugin code and
+is the one thing the installer cannot do (it deploys from a release):
+
+```powershell
+.\deploy.ps1 -ServerPath <servuo> -Verify   # show what would change
+.\deploy.ps1 -ServerPath <servuo>           # write
+```
+
+It is Windows-only and stays developer-facing; it never installs the sidecar, registers a service,
+or checks the protocol pairing. Nothing shipped to an operator depends on it.
+
+## Releases
+
+Every merge to `main` that carries a releasable conventional commit (`feat:`, `fix:`, `perf:`, or a
+breaking change — a `docs:`/`chore:`-only merge deliberately cuts nothing) publishes a Gitea release:
+
+```
+runicgateway-overlay-<ver>.tar.gz
+└── runicgateway-overlay/
+    ├── manifest.json
+    ├── overlay/        # exactly what deploy.ps1 would copy
+    └── patches/        # the opt-in stock-file diffs + their companion sources
+SHA256SUMS
+```
+
+This is a **source** tarball, not a build — nothing here is compiled. It exists so the installer can
+deploy the plugin onto a shard host that has no git and no Gitea credentials.
+
+`manifest.json` is what makes the tarball self-describing:
+
+```json
+{
+  "component": "servuo-plugins-overlay",
+  "version": "0.1.0",
+  "commit": "968b526…",
+  "protocol": 3,
+  "servuo": { "min_version": "57.4", "patches_verified_against": "57.4" },
+  "files": { "overlay/Config/Bridge.cfg": "32718424…", … }
+}
+```
+
+- **`protocol`** comes from `overlay.toml` and is the plugin half of the compatibility contract. The
+  plugin announces no version on the wire and none is queryable before ServUO boots, so this
+  declaration is the only way the installer can check it against the sidecar's `PROTOCOL_VERSION`
+  *before* an operator installs the pair. **When the protocol changes, bump it in the same PR that
+  changes the emitters.**
+- **`files`** carries a SHA256 per shipped file, so a deployment can later tell "an operator edited
+  this" from "the overlay moved on".
+
+The version is derived from git tags — there is no version to maintain by hand and no bump commit,
+so this workflow never pushes to `main`.
+
+The tarball is byte-reproducible for a given tree (`tar --sort=name`, pinned mtime and ownership), so
+its checksum changes only when its contents do.
+
 ## Status
 
 | Phase | State |
@@ -121,3 +193,24 @@ Runtime script compilation therefore had no effect, silently. `overlay/Scripts/S
 Note: the throwaway PowerShell sidecars are fragile — they get reaped and contend on their log file. The real Rust sidecar ([RunicGateway/link](https://gitea.whitlocktech.com/RunicGateway/link)) replaces them; don't read their flakiness as a shard problem. The shard buffers non-perishable events through any outage and reconnects on its own (observed reconnecting 5× unattended in one session).
 
 `tools/scaffolding/` holds the world seeder and the performance probe. Neither is deployed — `deploy.ps1` only copies `overlay/`. They produced the budget in [PLAN.md](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PLAN.md) §1. See `tools/scaffolding/README.md`.
+
+---
+
+## License
+
+Runic Gateway is free software, licensed under the **GNU General Public License
+v3.0 or later** — see [LICENSE.md](LICENSE.md).
+
+    Copyright (C) 2026 Runic Gateway
+
+    This program is free software: you can redistribute it and/or modify it under
+    the terms of the GNU General Public License as published by the Free Software
+    Foundation, either version 3 of the License, or (at your option) any later
+    version. It is distributed WITHOUT ANY WARRANTY; without even the implied
+    warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+    General Public License for more details.
+
+Contributions are welcome — please read [CONTRIBUTING.md](CONTRIBUTING.md) (note
+the **AI-usage disclosure** requirement) and our
+[Code of Conduct](CODE_OF_CONDUCT.md). Report vulnerabilities privately per
+[SECURITY.md](SECURITY.md).

SECURITY.md

@@ -0,0 +1,50 @@
+# Security Policy
+
+Thank you for helping keep Runic Gateway and its users safe.
+
+## Reporting a vulnerability
+
+**Please do not report security vulnerabilities through public issues, pull
+requests, or the wiki.** A public report tips off attackers before a fix is
+available.
+
+Instead, report privately by email to:
+
+**whitlocktech@gmail.com**
+
+Please include as much of the following as you can:
+
+- The repository and component affected.
+- The type of issue (e.g. authentication bypass, injection, secret exposure,
+  remote code execution, denial of service).
+- Step-by-step instructions to reproduce, and a proof-of-concept if you have one.
+- The impact — what an attacker could do with it.
+- Any suggested remediation.
+
+You will receive an acknowledgement of your report, typically within a few days.
+We will keep you informed as we investigate and work toward a fix, and we are
+happy to credit you in the release notes once the issue is resolved (let us know
+if you would prefer to remain anonymous).
+
+## Scope
+
+Runic Gateway is a self-hosted platform made up of several components:
+
+| Component | Repo | Network exposure |
+|---|---|---|
+| Website (site + admin + API) | `RunicGateway/website` | Internet-facing (behind a reverse proxy) |
+| uo-link sidecar | `RunicGateway/link` | The only network-facing part of the game bridge |
+| ServUO plugin | `RunicGateway/servuo-plugins` | Loopback only — dials the sidecar on `127.0.0.1` |
+| Documentation | `RunicGateway/docs` | Content only |
+
+Because instances are self-hosted, the security of any given deployment also
+depends on how it is configured and operated — strong secrets (`JWT_SECRET`,
+`SECRET_ENC_KEY`, database and admin passwords), a correctly configured reverse
+proxy and `TRUST_PROXY`, and keeping the shard itself unreachable from the
+internet (only the sidecar should be exposed). See each repo's README for the
+security model.
+
+## Supported versions
+
+This project is developed continuously and does not maintain long-term release
+branches. Security fixes land on `main`; please run a recent build.

deploy.ps1

@@ -9,8 +9,8 @@
     Run with -Verify first. It reports what would change and touches nothing.
 
 .EXAMPLE
-    .\deploy.ps1 -ServerPath C:\Users\colby\Desktop\servuo -Verify
-    .\deploy.ps1 -ServerPath C:\Users\colby\Desktop\servuo
+    .\deploy.ps1 -ServerPath <servuo> -Verify
+    .\deploy.ps1 -ServerPath <servuo>
 #>
 [CmdletBinding()]
 param(

overlay.toml

@@ -0,0 +1,42 @@
+# Release metadata for the deployable overlay.
+#
+# Consumed by .gitea/workflows/release.yml, which folds these values into the
+# manifest.json shipped inside runicgateway-overlay-<ver>.tar.gz. The Runic
+# Gateway installer reads that manifest to decide what it is deploying and
+# whether it is compatible with the sidecar it is about to install
+# (docs/installer/PLAN.md §5 Phase 0, §7.1).
+#
+# There is deliberately NO version key here. The release version is derived from
+# git tags and conventional commits by the release workflow, so there is no bump
+# commit to keep in sync and no way for this file to disagree with the tag.
+
+# ── The loopback wire-protocol version this overlay speaks ───────────────────
+#
+# This is the plugin half of the compatibility contract. It MUST equal the
+# sidecar's PROTOCOL_VERSION (link/sidecar/src/main.rs) for a deployment to
+# work: the sidecar rejects a mismatch with 409 rather than mis-parsing.
+#
+# The C# plugin has no queryable version before ServUO boots — it does not
+# announce one on the wire — so this declaration is the only thing that lets the
+# installer's bundle CI check the pair BEFORE an operator installs them
+# (docs/installer/PLAN.md §2.6, §7.1 gate 1). Keeping it honest is therefore a
+# manual duty: when the protocol changes, bump it here in the same PR that
+# changes the emitters, exactly as link bumps PROTOCOL_VERSION.
+#
+# Current: 5 — see docs/link/v5.md (house.decay scheduling, vendor.listing fees, account.login.result).
+protocol = 5
+
+# ── ServUO compatibility ─────────────────────────────────────────────────────
+#
+# The base overlay (Config/Bridge.cfg + Scripts/Custom/Bridge/*.cs) only ADDS
+# files and is expected to work on any reasonably current ServUO. This is the
+# oldest version it is known good on.
+min_servuo_version = "57.4"
+
+# The patches/ tier is a different matter: those are unified diffs against STOCK
+# ServUO files, so they are verified against exactly one version and nothing
+# else. On any other version the installer skips the whole tier with a warning
+# and completes the base install (docs/installer/PLAN.md §1, §2.2) — losing
+# vendor.sale events and in-game moderation-audit forwarding, but never
+# half-patching an unknown tree.
+patches_verified_against = "57.4"

overlay/Config/Bridge.cfg

@@ -34,6 +34,18 @@ PageSweepSeconds=5
 # interval (emit guild.update / guild.remove). Guild membership moves slowly; 60s is ample.
 GuildSweepSeconds=60
 
+# Members per guild.roster frame (Protocol 4). A roster is the only fat frame the bridge emits
+# (~69 bytes per member) and the sidecar reads a line with no length bound, so this caps it; a
+# guild over the cap is split across continuation frames carrying seq/more. 500 members is ~35 KB,
+# past any realistic guild, so the split path is an edge case rather than the norm.
+GuildRosterMembersPerLine=500
+
+# Guilds that may emit a roster in one sweep. Every guild looks changed right after a sidecar
+# reconnect, and building hundreds of fat frames in a single Core-thread pass is exactly the stall
+# the bridge exists to avoid. The sweep re-arms itself every 2s while a baseline is draining, so
+# lowering this slows the catch-up without making the site wait a full sweep interval per batch.
+GuildRosterGuildsPerTick=25
+
 # Town-governor poll. Each city's Governor / election is diffed on this interval to emit
 # city.update on change. Governors turn over on the order of weeks, so a slow sweep is fine.
 # Idle (emits nothing) unless the City Loyalty system is enabled (CityLoyalty.Enabled).
@@ -48,6 +60,83 @@ PresenceSweepSeconds=30
 # house.remove (owner, region, location, decay). Houses change slowly; a few minutes is fine.
 HousingSweepSeconds=300
 
+# Points / loyalty leaderboards (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/v3.md §7). ServUO carries ~25 point
+# currencies (Queen's Loyalty, Void Pool, Casino, Clean Up Britannia, the nine city loyalties,
+# the Doom/Khaldun/Kotl treasure systems, …). Each is diffed on this interval and emitted as
+# one points.board frame per system when its top N moves.
+#
+# Slow on purpose: these are month-scale standings, and ten of the systems keep a row for
+# every character ever created, so the pass is the widest read in the bridge. It is still
+# cheap — a single bounded pass, never a sort — but there is nothing to gain by hurrying it.
+PointsSweepSeconds=300
+
+# Master switch for the boards. Off leaves char.profile points alone (see below).
+PointsLeaderboardEnabled=true
+
+# How many players per board. Clamped to 1..100 — the frame is emitted PER SYSTEM, so a big
+# N is multiplied by ~25.
+PointsTopN=10
+
+# Which systems to publish, as a comma-separated list of PointsType names, e.g.
+#   PointsSystems=QueensLoyalty,CleanUpBritannia,VoidPool
+# Blank (the default) publishes whatever the shard itself shows on the in-game loyalty gump
+# (ShowOnLoyaltyGump), so a subsystem you add later gets a board without an edit here.
+# An unrecognized name is logged and ignored, never silently dropped.
+PointsSystems=
+
+# Include a per-character "points" block in char.profile (the website character sheet). This
+# is a lookup across every published system's table, so it is the dominant cost of building a
+# profile; turn it off on a very large shard that does not want the sheet paying for it.
+PointsProfileEnabled=true
+
+# Also compute each system's rank in that block. OFF by default and worth leaving off: a
+# points lookup stops at the character's own row, but a rank must count every row that beats
+# them, in every system, on every profile build. The website already derives rank from the
+# board for anyone in the top N.
+PointsProfileRank=false
+
+# Player-vendor market index (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/v3.md §8). Every player vendor's shop name,
+# owner, location and priced inventory, published as one vendor.listing frame per vendor so the
+# website can offer the search the in-game Vendor Search gump offers. Honours each player's own
+# in-game opt-out (the vendor's VendorSearch flag) — hide your vendor in game and it is hidden
+# on the site too.
+MarketEnabled=true
+
+# Sweep interval. UNLIKE every other sweep here, a tick does NOT walk the whole world: it
+# inventories at most MarketSweepBatch vendors and a persistent cursor round-robins through the
+# rest, so the per-tick cost is bounded by the batch rather than by how many vendors exist. Full
+# coverage takes ceil(vendors / batch) x MarketSweepSeconds — 500 vendors at the defaults is one
+# complete pass every 20 minutes, and the site labels the data with how stale it may be.
+#
+# Lower this (or raise the batch) for faster coverage; both trade directly against per-tick cost,
+# and the expensive part is the item walk, which recurses into every container a vendor is selling.
+MarketSweepSeconds=60
+MarketSweepBatch=25
+
+# Per-vendor listing cap, after which the frame carries "truncated": true. A commodity reseller
+# with thousands of stacked resources is a real thing, and an uncapped frame for one is measured
+# in megabytes. Clamped to 1..5000.
+MarketMaxListings=250
+
+# Shard ruleset (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/v3.md §5). One world.ruleset frame — expansion, which
+# systems are on, skill/stat caps, account and house limits, champion scroll rules —
+# emitted on every sidecar connect (and on [bridge reload), so the website's rules page
+# cannot drift from the server. Not a sweep: it changes only when you edit a .cfg.
+#
+# The frame is built from an explicit allowlist of keys in BridgeRuleset.cs. Server.cfg,
+# Staff.cfg, Email.cfg, DataPath.cfg, Bridge.cfg, Compiler.cfg, Reports.cfg and Client.cfg
+# are never read.
+RulesetEnabled=true
+
+# The one connection detail the bridge will publish, e.g. play.myshard.com,2593. Blank
+# (the default) omits it entirely. Server.cfg's Address/Listen/Port are NEVER published —
+# if you want a connect string on the site, put it here deliberately.
+PublicConnectAddress=
+
+# Include the save/restart schedule (AutoSave frequency, AutoRestart hour) in the frame.
+# Turn off if you would rather not advertise a predictable restart window.
+RulesetIncludeSchedule=true
+
 # Shown to a player when they run [link. The website page where they enter the code.
 LinkUrl=https://yoursite/link
 

overlay/Scripts/Custom/Bridge/BridgeBoot.cs

@@ -165,8 +165,13 @@ namespace Server.Custom.Bridge
                     BridgeGovernance.Rearm();
                     BridgePresence.Rearm();
                     BridgeHousing.Rearm();
+                    BridgePoints.Rearm();
+                    BridgeMarket.Rearm();
+                    // Not a sweep, so it has nothing to re-arm — but an operator who just edited a
+                    // .cfg wants the change on the site now, not after a shard restart.
+                    BridgeRuleset.Emit();
                     e.Mobile.SendMessage("Bridge: {0}", BridgeConfig.Describe());
-                    e.Mobile.SendMessage("Bridge: sweeps re-armed; endpoint changes take effect on reconnect.");
+                    e.Mobile.SendMessage("Bridge: sweeps re-armed; ruleset re-emitted; endpoint changes take effect on reconnect.");
                     break;
 
                 case "ping":
@@ -181,6 +186,8 @@ namespace Server.Custom.Bridge
                     BridgeGovernance.SweepOnce();
                     BridgePresence.SweepOnce();
                     BridgeHousing.SweepOnce();
+                    BridgePoints.SweepOnce();
+                    BridgeMarket.SweepOnce();
                     e.Mobile.SendMessage("Bridge: ran one sweep of each stream.");
                     e.Mobile.SendMessage("Bridge: {0}", BridgeSweeps.Status());
                     e.Mobile.SendMessage("Bridge: {0}", BridgeChamps.Status());
@@ -188,6 +195,8 @@ namespace Server.Custom.Bridge
                     e.Mobile.SendMessage("Bridge: {0}", BridgeGovernance.Status());
                     e.Mobile.SendMessage("Bridge: {0}", BridgePresence.Status());
                     e.Mobile.SendMessage("Bridge: {0}", BridgeHousing.Status());
+                    e.Mobile.SendMessage("Bridge: {0}", BridgePoints.Status());
+                    e.Mobile.SendMessage("Bridge: {0}", BridgeMarket.Status());
                     break;
 
                 default:
@@ -202,7 +211,10 @@ namespace Server.Custom.Bridge
                     e.Mobile.SendMessage("Bridge: {0}", BridgeGovernance.Status());
                     e.Mobile.SendMessage("Bridge: {0}", BridgePresence.Status());
                     e.Mobile.SendMessage("Bridge: {0}", BridgeHousing.Status());
+                    e.Mobile.SendMessage("Bridge: {0}", BridgePoints.Status());
+                    e.Mobile.SendMessage("Bridge: {0}", BridgeMarket.Status());
                     e.Mobile.SendMessage("Bridge: {0}", BridgePages.Status());
+                    e.Mobile.SendMessage("Bridge: {0}", BridgeRuleset.Status());
                     break;
             }
         }

overlay/Scripts/Custom/Bridge/BridgeConfig.cs

@@ -35,6 +35,29 @@ namespace Server.Custom.Bridge
         public static int CitySweepSeconds { get; private set; }
         public static int PresenceSweepSeconds { get; private set; }
         public static int HousingSweepSeconds { get; private set; }
+        public static int PointsSweepSeconds { get; private set; }
+        public static int MarketSweepSeconds { get; private set; }
+
+        // ---- guild rosters (Protocol 4) ----
+        public static int GuildRosterMembersPerLine { get; private set; }
+        public static int GuildRosterGuildsPerTick { get; private set; }
+
+        // ---- player-vendor market index (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/v3.md §8) ----
+        public static bool MarketEnabled { get; private set; }
+        public static int MarketSweepBatch { get; private set; }
+        public static int MarketMaxListings { get; private set; }
+
+        // ---- points / loyalty leaderboards (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/v3.md §7) ----
+        public static bool PointsLeaderboardEnabled { get; private set; }
+        public static int PointsTopN { get; private set; }
+        public static string PointsSystems { get; private set; }
+        public static bool PointsProfileEnabled { get; private set; }
+        public static bool PointsProfileRank { get; private set; }
+
+        // ---- shard ruleset (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/v3.md §5) ----
+        public static bool RulesetEnabled { get; private set; }
+        public static string PublicConnectAddress { get; private set; }
+        public static bool RulesetIncludeSchedule { get; private set; }
 
         public static string LinkUrl { get; private set; }
 
@@ -95,6 +118,24 @@ namespace Server.Custom.Bridge
             if (GuildSweepSeconds < 1)
                 GuildSweepSeconds = 1;
 
+            // A roster line is the only fat frame this plugin emits — measured at roughly 69 bytes
+            // per member — and the sidecar reads a line with no length bound. The cap turns an
+            // unbounded frame into a bounded one; a guild above it is split across continuation
+            // lines. 500 members is ~35 KB, comfortably past any real guild, so the split path is
+            // an edge case rather than the norm.
+            GuildRosterMembersPerLine = Config.Get("Bridge.GuildRosterMembersPerLine", 500);
+            if (GuildRosterMembersPerLine < 16)
+                GuildRosterMembersPerLine = 16;
+
+            // How many guilds may emit a roster in a single sweep. Every guild re-emits after a
+            // reconnect (the diff caches are cleared), and building a few hundred fat JSON frames in
+            // one Core-thread pass is exactly the stall this bridge exists to avoid. The sweep
+            // re-arms itself promptly while a baseline is still draining, so this throttles the work
+            // without making the site wait a full sweep interval per batch.
+            GuildRosterGuildsPerTick = Config.Get("Bridge.GuildRosterGuildsPerTick", 25);
+            if (GuildRosterGuildsPerTick < 1)
+                GuildRosterGuildsPerTick = 1;
+
             CitySweepSeconds = Config.Get("Bridge.CitySweepSeconds", 300);
             if (CitySweepSeconds < 1)
                 CitySweepSeconds = 1;
@@ -107,6 +148,73 @@ namespace Server.Custom.Bridge
             if (HousingSweepSeconds < 1)
                 HousingSweepSeconds = 1;
 
+            // Points/loyalty boards. The sweep touches every point entry on the shard, and ten of
+            // the ~25 systems keep a row per character ever created, so the default interval is
+            // deliberately slow — these are month-scale standings, not live state.
+            PointsSweepSeconds = Config.Get("Bridge.PointsSweepSeconds", 300);
+            if (PointsSweepSeconds < 1)
+                PointsSweepSeconds = 1;
+
+            PointsLeaderboardEnabled = Config.Get("Bridge.PointsLeaderboardEnabled", true);
+
+            // Board size. Bounded below at 1 because the selection indexes the Nth slot directly,
+            // and above at 100 because the frame is emitted per system — a large N multiplied by
+            // ~25 systems is how a "board" turns into a bandwidth problem.
+            PointsTopN = Config.Get("Bridge.PointsTopN", 10);
+            if (PointsTopN < 1)
+                PointsTopN = 1;
+            if (PointsTopN > 100)
+                PointsTopN = 100;
+
+            // Blank (the default) means "publish whatever the shard itself shows on the loyalty
+            // gump", so a shard that adds a subsystem gets its board without an edit here.
+            PointsSystems = Config.Get("Bridge.PointsSystems", "");
+
+            PointsProfileEnabled = Config.Get("Bridge.PointsProfileEnabled", true);
+
+            // Off by default, and the default is the point: a rank cannot early-exit the way a
+            // points lookup can — it must count every row that beats the player, in every system,
+            // on every profile build. See BridgeProfile.WritePoints.
+            PointsProfileRank = Config.Get("Bridge.PointsProfileRank", false);
+
+            // Player-vendor market index. Unlike every other sweep, this one does NOT walk its whole
+            // collection per tick: MarketSweepBatch caps how many vendors are inventoried, and a
+            // persistent cursor round-robins through the rest, so the per-tick cost is bounded by
+            // the batch rather than by how many vendors the world holds.
+            MarketEnabled = Config.Get("Bridge.MarketEnabled", true);
+
+            MarketSweepSeconds = Config.Get("Bridge.MarketSweepSeconds", 60);
+            if (MarketSweepSeconds < 1)
+                MarketSweepSeconds = 1;
+
+            // Bounded below at 1 (a batch of 0 would advance the cursor nowhere and publish nothing,
+            // silently) and above at 500, past which the batch stops bounding anything on any
+            // realistic shard and the tick is a whole-world pass by another name.
+            MarketSweepBatch = Config.Get("Bridge.MarketSweepBatch", 25);
+            if (MarketSweepBatch < 1)
+                MarketSweepBatch = 1;
+            if (MarketSweepBatch > 500)
+                MarketSweepBatch = 500;
+
+            // Per-vendor listing cap. BridgeJson.Parse caps INBOUND frames at 1 MB; outbound is
+            // uncapped and the sidecar's read_line will allocate whatever arrives, so the cap here
+            // is what keeps one commodity reseller with 8,000 stacked resources from emitting a
+            // multi-megabyte frame. Over the cap the frame carries "truncated": true and the site
+            // says so.
+            MarketMaxListings = Config.Get("Bridge.MarketMaxListings", 250);
+            if (MarketMaxListings < 1)
+                MarketMaxListings = 1;
+            if (MarketMaxListings > 5000)
+                MarketMaxListings = 5000;
+
+            // The ruleset frame is not a sweep — it is emitted once per sidecar connect (and on
+            // `[bridge reload`), so it has no interval. PublicConnectAddress is the ONE connection
+            // detail the bridge will publish, and only because an operator typed it here for that
+            // purpose; Server.cfg's Address/Port are never read (see BridgeRuleset's allowlist note).
+            RulesetEnabled = Config.Get("Bridge.RulesetEnabled", true);
+            PublicConnectAddress = Config.Get("Bridge.PublicConnectAddress", "");
+            RulesetIncludeSchedule = Config.Get("Bridge.RulesetIncludeSchedule", true);
+
             LinkUrl = Config.Get("Bridge.LinkUrl", "https://yoursite/link");
 
             TownCrierMaxLines = Config.Get("Bridge.TownCrierMaxLines", 6);

overlay/Scripts/Custom/Bridge/BridgeEvents.cs

@@ -170,9 +170,53 @@ namespace Server.Custom.Bridge
                     .Str("acct", e.Username)
                     .Str("ip", address)
                     .End());
+
+                EmitLoginResult(e, address);
             });
         }
 
+        /// <summary>
+        ///     Protocol 5. The RESULT of the login above, which the attempt itself cannot carry.
+        ///
+        ///     Why a second kind rather than two more fields: PacketHandlers.AccountLogin invokes this
+        ///     sink and only THEN branches on e.Accepted, and the decision is made by the handlers
+        ///     themselves -- Server.Misc.AccountHandler is the one that validates the password and
+        ///     sets Accepted/RejectReason. Inside our own handler the verdict therefore does not exist
+        ///     yet: Accepted is still its constructor default of `true` for a password that is about
+        ///     to be rejected. Anything built on the attempt alone fires on every SUCCESSFUL login
+        ///     too, which is the wrong way round for a security notice -- it would tell a player
+        ///     "someone tried to get into your account" every time they logged in themselves.
+        ///
+        ///     Reading it one Core slice later, via DelayCall(Zero), is what makes the verdict final
+        ///     without a core patch and without depending on handler subscription ORDER, which
+        ///     ServUO does not define and which a shard's own scripts can change.
+        ///
+        ///     On holding the args object: it carries the plaintext Password, so it is deliberately
+        ///     alive for one extra slice and no longer, and exactly two properties are read off it.
+        ///     The password is never read, never logged and never emitted -- the same rule the
+        ///     attempt emitter above states.
+        /// </summary>
+        private static void EmitLoginResult(AccountLoginEventArgs e, string address)
+        {
+            // The NetState is disposed by AccountLogin_ReplyRej before this runs, which is why the
+            // address is passed in already resolved rather than re-read from e.State.
+            Timer.DelayCall(TimeSpan.Zero, () =>
+                Guard("account.login.result", () =>
+                {
+                    var sb = BridgeJson.Begin("account.login.result")
+                        .Str("acct", e.Username)
+                        .Str("ip", address)
+                        .Bool("accepted", e.Accepted);
+
+                    // ALRReason is only meaningful on a rejection; on an accept it is still the
+                    // enum's zero value (Invalid), which would read as a failure reason if emitted.
+                    if (!e.Accepted)
+                        sb.Str("reason", e.RejectReason.ToString());
+
+                    BridgeLink.Emit(sb.End());
+                }));
+        }
+
         // ---- economy ----
 
         private static void OnGoldChange(AccountGoldChangeEventArgs e)

overlay/Scripts/Custom/Bridge/BridgeJson.cs

@@ -85,14 +85,153 @@ namespace Server.Custom.Bridge
         public static StringBuilder Actor(this StringBuilder sb, string name, Mobile m)
         {
             sb.Append(",\"").Append(name).Append("\":");
+            WriteActor(sb, m);
+            return sb;
+        }
 
+        /// <summary>
+        ///     Writes a named array of actor objects — a guild roster (Protocol 4) being the first
+        ///     caller. Every other outbound helper here emits a leading `,"name":`, so an array
+        ///     element needs the bare object; that is why <see cref="WriteActor"/> exists separately
+        ///     rather than <see cref="Actor"/> being reused.
+        ///
+        ///     `count` bounds how many are written, because a roster frame must stay a bounded line
+        ///     (Bridge.GuildRosterMembersPerLine). A null entry in the sequence is skipped rather
+        ///     than written as null, so the array is always a list of real members and a caller can
+        ///     trust its length.
+        ///
+        ///     `withGuildRank` adds each member's guild rank to their object. It is a parameter
+        ///     rather than always-on because rank is a property of a mobile's membership of THIS
+        ///     guild, not of the mobile — every other actor this bridge writes is a bystander,
+        ///     a killer, a governor, and guild rank is meaningless on all of them.
+        /// </summary>
+        public static StringBuilder Actors(
+            this StringBuilder sb, string name, IList<Mobile> mobiles, int start, int count,
+            bool withGuildRank = false)
+        {
+            sb.Append(",\"").Append(name).Append("\":[");
+
+            if (mobiles != null)
+            {
+                var end = Math.Min(start + count, mobiles.Count);
+                bool first = true;
+
+                for (int i = start; i < end; i++)
+                {
+                    var m = mobiles[i];
+
+                    if (m == null)
+                        continue;
+
+                    if (!first)
+                        sb.Append(',');
+
+                    if (withGuildRank)
+                        WriteGuildMember(sb, m);
+                    else
+                        WriteActor(sb, m);
+
+                    first = false;
+                }
+            }
+
+            sb.Append(']');
+            return sb;
+        }
+
+        /// <summary>
+        ///     A roster member: the standard actor object plus the member's rank in their guild.
+        ///
+        ///     **Only the raw rank is emitted, never a resolved label.** ServUO names the five
+        ///     standard ranks with cliloc ids (1062959–1062963) and ships no text for them, so the
+        ///     shard cannot produce "Warlord" without a client-file table it does not have. The
+        ///     website module does have one, and resolving a game term is its job in any case.
+        ///
+        ///     `rank` is the numeric rank, 0–4, with 4 being Leader (`RankDefinition.Ranks`). A
+        ///     custom rank definition may carry a literal string instead of a cliloc, so `rankName`
+        ///     is written when there is one and `rankCliloc` when there is not; a shard that has
+        ///     replaced the rank table therefore keeps its own naming rather than being flattened
+        ///     into the stock five.
+        ///
+        ///     A member with no readable rank — a mobile that is not a PlayerMobile, or one whose
+        ///     GuildRank is null — is written with no rank fields at all rather than a fabricated
+        ///     default. Absent means "not known", and a consumer that treated a missing rank as 0
+        ///     would silently demote them.
+        ///
+        ///     **Staff are deliberately written with no rank, and this is not a rounding error.**
+        ///     `PlayerMobile.GuildRank` returns `RankDefinition.Leader` for anyone at GameMaster or
+        ///     above, whatever their actual rank — a gameplay convenience so staff can operate a
+        ///     guild stone, and emphatically not a claim about who leads the guild. The true value
+        ///     is in a private field with no accessor, so the only honest options are "Leader" and
+        ///     "not known", and publishing a staff member as a guild leader on a public roster is
+        ///     the worse of the two by a wide margin. A staff account that genuinely leads its guild
+        ///     shows as an unranked member, which is a visible gap rather than a false claim.
+        /// </summary>
+        private static void WriteGuildMember(StringBuilder sb, Mobile m)
+        {
             if (m == null)
             {
                 sb.Append("null");
-                return sb;
+                return;
             }
 
-            sb.Append("{\"serial\":\"0x").Append(m.Serial.Value.ToString("X")).Append('"');
+            sb.Append('{');
+            WriteActorFields(sb, m);
+
+            var pm = m as Server.Mobiles.PlayerMobile;
+            var rank = pm == null || pm.AccessLevel >= AccessLevel.GameMaster ? null : pm.GuildRank;
+
+            if (rank != null)
+            {
+                sb.Append(",\"rank\":").Append(rank.Rank);
+
+                if (!string.IsNullOrEmpty(rank.Name.String))
+                {
+                    sb.Append(",\"rankName\":");
+                    Escape(sb, rank.Name.String);
+                }
+                else if (rank.Name.Number > 0)
+                {
+                    sb.Append(",\"rankCliloc\":").Append(rank.Name.Number);
+                }
+            }
+
+            sb.Append('}');
+        }
+
+        /// <summary>
+        ///     One bare actor object, with no leading field name: serial, name, account (when there
+        ///     is one), the linked webId (when the account is linked), and the player flag. A `null`
+        ///     mobile writes null.
+        ///
+        ///     `acct` and `webId` are the site-identity fields, and they are emitted here
+        ///     unconditionally by design — the sidecar is a forwarder, and deciding who may see them
+        ///     is the website's job (it projects per the shard visibility rungs). Note that `acct` is
+        ///     genuinely optional: a PlayerMobile can have no Account at all.
+        /// </summary>
+        private static void WriteActor(StringBuilder sb, Mobile m)
+        {
+            if (m == null)
+            {
+                sb.Append("null");
+                return;
+            }
+
+            sb.Append('{');
+            WriteActorFields(sb, m);
+            sb.Append('}');
+        }
+
+        /// <summary>
+        ///     The actor fields, with no braces, so a caller can add its own.
+        ///
+        ///     Split out for <see cref="WriteGuildMember"/>, which is the same object plus guild
+        ///     rank. Note the first field is written WITHOUT a leading comma and every later one
+        ///     with, so this must be the first thing inside its object.
+        /// </summary>
+        private static void WriteActorFields(StringBuilder sb, Mobile m)
+        {
+            sb.Append("\"serial\":\"0x").Append(m.Serial.Value.ToString("X")).Append('"');
 
             sb.Append(",\"name\":");
             Escape(sb, m.Name ?? "");
@@ -112,8 +251,6 @@ namespace Server.Custom.Bridge
             }
 
             sb.Append(",\"player\":").Append(m.Player ? "true" : "false");
-            sb.Append('}');
-            return sb;
         }
 
         /// <summary>Closes the object. The trailing newline is the frame delimiter.</summary>

overlay/Scripts/Custom/Bridge/BridgeMarket.cs

@@ -0,0 +1,705 @@
+using System;
+using System.Collections.Generic;
+using System.Text;
+
+using Server.Accounting;
+using Server.Items;
+using Server.Mobiles;
+using Server.Multis;
+using Server.Engines.VendorSearching;
+
+namespace Server.Custom.Bridge
+{
+    /// <summary>
+    ///     The shard-wide player-vendor index (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/v3.md §8). Every player vendor's
+    ///     shop name, owner, location and priced inventory, published as one authoritative
+    ///     <c>vendor.listing</c> frame per vendor, so the website can offer the search the in-game
+    ///     Vendor Search gump offers — from outside the game.
+    ///
+    ///     ---- Why this is a sweep and not an RPC ----
+    ///
+    ///     The obvious shape is a <c>market.snapshot</c> request/reply like vendor.snapshot next
+    ///     door. It cannot work: the sidecar's rpc router correlates on the FIRST frame carrying a
+    ///     matching reqId and resolves a single oneshot, so a chunked reply sharing one reqId would
+    ///     deliver chunk 1 to the HTTP caller and LEAK chunks 2..N onto the broadcast feed. A
+    ///     whole-world snapshot in one frame is not an option either — the reply timeout is 10 s and
+    ///     40,000 listings do not serialize in time.
+    ///
+    ///     So it is a diff sweep on the broadcast stream, shaped like <see cref="BridgeHousing"/>:
+    ///     one frame per vendor, authoritative for that vendor, plus vendor.listing.remove when one
+    ///     goes away. The per-account <c>vendor.snapshot</c> RPC is untouched; the player portal
+    ///     keeps using it.
+    ///
+    ///     ---- The two perf traps, and what this does about them ----
+    ///
+    ///     1. **VendorSearch.GetItemName is a packet builder, not a field read.** It constructs an
+    ///        ObjectPropertyList, calls GetProperties, serialises it and then byte-parses the
+    ///        resulting packet — PER ITEM. Across a full pass that is a multi-hundred-millisecond
+    ///        stall on the Core thread. It is never called here. The frame carries `itemId`, `hue`,
+    ///        `amount`, `price`, the plain `item.Name` field (null for most items) and
+    ///        `item.LabelNumber`; the website resolves display names against its own cliloc table,
+    ///        exactly as char.profile.equipment already does.
+    ///
+    ///        (On any modern client the call would not even work: every current client ships its
+    ///        Cliloc.* files compressed, ServUO's bundled Ultima.StringList reads only the old plain
+    ///        layout, so VendorSearch.StringList is null and GetItemName returns item.Name anyway.
+    ///        The in-game gump has the same gap.)
+    ///
+    ///     2. **A full pass is unbounded in world size.** 500 vendors × 80 listings is ~40,000 item
+    ///        reads, and the reusable public GetItems(Container, List&lt;Item&gt;) recurses into
+    ///        sub-containers, so the real count runs ABOVE the top-level pack.Items a naive estimate
+    ///        would use. So the sweep is amortized: a persistent round-robin cursor over
+    ///        PlayerVendor.PlayerVendors advances at most MarketSweepBatch vendors per tick, which
+    ///        makes the PER-TICK cost bounded independently of how many vendors exist. Full coverage
+    ///        takes ceil(vendors / batch) × MarketSweepSeconds. This is the one genuinely new pattern
+    ///        versus the other sweeps, which all walk their whole collection every tick.
+    ///
+    ///     ---- Privacy ----
+    ///
+    ///     `pv.VendorSearch` is ServUO's own per-vendor opt-out and DoSearch filters on it, so a
+    ///     player who hid their vendor in game is hidden on the website too: an opted-out vendor is
+    ///     skipped entirely and the seen-set removal then drops it from the board. Map.Internal and
+    ///     a null Backpack are skipped for the same reason DoSearch skips them.
+    ///
+    ///     Owner is written as flat `ownerSerial`/`ownerName` — never through BridgeJson.Actor,
+    ///     which would add `acct` and `webId`. Same argument BridgePoints makes: this is the widest-
+    ///     audience surface the bridge has, and the site resolves serial → user from its own
+    ///     shard_account_links mirror when staff need it.
+    /// </summary>
+    public static class BridgeMarket
+    {
+        private static Timer _timer;
+
+        // vendor serial -> last-emitted signature.
+        private static readonly Dictionary<Serial, string> _last = new Dictionary<Serial, string>();
+
+        // Round-robin cursor: an INDEX into PlayerVendor.PlayerVendors, not a serial. The list is
+        // mutated by placement/deletion between ticks, so the cursor is a hint, not a promise — it
+        // is wrapped and clamped every tick, and a shifted list at worst re-visits or defers a
+        // vendor by one cycle. Tracking a serial instead would cost a lookup to find "where was I"
+        // and buy nothing: the sweep is idempotent per vendor.
+        private static int _cursor;
+
+        private static long _sweeps, _emitted, _removed, _scanned, _skipped, _truncated;
+
+        // Per-tick cost, in milliseconds. Reported by `[bridge status` because the
+        // whole design of this sweep is a claim about that number — the batch cap is what makes it
+        // independent of world size — and an operator tuning MarketSweepBatch is otherwise tuning
+        // blind. `_maxMs` is the one that matters: the Core thread runs this between frames, so the
+        // worst tick is the budget, not the average.
+        private static double _lastMs, _maxMs;
+        private static readonly System.Diagnostics.Stopwatch _clock = new System.Diagnostics.Stopwatch();
+
+        // Reused across ticks. The item walk is single-threaded (Core thread) and the list is
+        // cleared before each vendor, so one buffer serves the whole sweep — the alternative is a
+        // fresh List<Item> per vendor per tick, which at 25 vendors × every 60 s is pure garbage.
+        private static readonly List<Item> _items = new List<Item>();
+
+        public static void Initialize()
+        {
+            if (!BridgeConfig.Enabled)
+                return;
+
+            EventSink.ServerStarted += OnServerStarted;
+        }
+
+        private static void OnServerStarted()
+        {
+            BridgeLink.Connected_Core += OnConnected;
+            Rearm();
+        }
+
+        private static void OnConnected()
+        {
+            // A new sidecar knows nothing, so drop the diff state and start the round-robin from
+            // the top. The re-emit of the whole world is self-throttled by the batch window — this
+            // is the one place the amortized sweep pays for itself twice, because a reconnect on a
+            // whole-world sweep would otherwise be the biggest burst the bridge ever produces.
+            _last.Clear();
+            _cursor = 0;
+        }
+
+        /// <summary>Stops and recreates the timer from current config. Called by `[bridge reload`.</summary>
+        public static void Rearm()
+        {
+            Stop();
+
+            _timer = Timer.DelayCall(
+                TimeSpan.FromSeconds(BridgeConfig.MarketSweepSeconds),
+                TimeSpan.FromSeconds(BridgeConfig.MarketSweepSeconds),
+                MarketSweep);
+        }
+
+        public static void Stop()
+        {
+            if (_timer != null) { _timer.Stop(); _timer = null; }
+        }
+
+        /// <summary>
+        ///     A bare (key-less) string value, or JSON null.
+        ///
+        ///     <see cref="BridgeJson.Escape"/> takes a non-null string — it dereferences
+        ///     <c>value.Length</c> immediately — and <see cref="BridgeJson.Str"/> writes the `,"key":`
+        ///     prefix itself, so neither serves a value written inside a hand-built object. Most of
+        ///     what this frame writes is legitimately null (an item's plain Name is null for nearly
+        ///     every item, a vendor standing in the street has no house), so this is the common path
+        ///     rather than an edge case.
+        /// </summary>
+        private static void Text(StringBuilder sb, string value)
+        {
+            if (value == null)
+                sb.Append("null");
+            else
+                BridgeJson.Escape(sb, value);
+        }
+
+        public static string Status()
+        {
+            var all = PlayerVendor.PlayerVendors;
+
+            return String.Format(
+                "market(enabled={0} sweeps={1} scanned={2} emitted={3} removed={4} skipped={5} truncated={6} tracked={7} vendors={8} cursor={9} batch={10} lastMs={11:F2} maxMs={12:F2})",
+                BridgeConfig.MarketEnabled, _sweeps, _scanned, _emitted, _removed, _skipped,
+                _truncated, _last.Count, all == null ? 0 : all.Count, _cursor,
+                BridgeConfig.MarketSweepBatch, _lastMs, _maxMs);
+        }
+
+        /// <summary>Runs one sweep now. Wired into `[bridge sweepnow`.</summary>
+        public static void SweepOnce()
+        {
+            MarketSweep();
+        }
+
+        /// <summary>
+        ///     One tick: at most <c>MarketSweepBatch</c> vendors starting at the cursor, then the
+        ///     removal pass.
+        ///
+        ///     The removal pass is the part the batching makes subtle. `_last` holds every vendor
+        ///     seen in ANY previous tick, but this tick only visited a window — so "not in this
+        ///     tick's seen set" does NOT mean gone. Removals are therefore decided against the
+        ///     CURRENT vendor list (plus the opt-out/validity rules), not against the window, which
+        ///     is a cheap pass over serials rather than a second inventory walk.
+        /// </summary>
+        private static void MarketSweep()
+        {
+            try
+            {
+                if (!BridgeConfig.MarketEnabled)
+                    return;
+
+                _sweeps++;
+
+                if (!BridgeLink.Connected)
+                    return; // nothing is listening; do not fill the queue with perishable snapshots
+
+                _clock.Restart();
+
+                var all = PlayerVendor.PlayerVendors;
+
+                if (all == null || all.Count == 0)
+                {
+                    Reap(null);
+                    return;
+                }
+
+                // A live set of every serial that SHOULD be on the board right now, built as the
+                // window is walked plus a cheap pass over the rest. Built here rather than reusing
+                // a field so a throwing vendor cannot leave a half-built set behind.
+                var present = new HashSet<Serial>();
+
+                var count = all.Count;
+                var batch = Math.Min(BridgeConfig.MarketSweepBatch, count);
+
+                if (_cursor >= count)
+                    _cursor = 0;
+
+                for (int i = 0; i < count; i++)
+                {
+                    var vendor = all[i];
+
+                    if (Eligible(vendor))
+                        present.Add(vendor.Serial);
+                }
+
+                for (int n = 0; n < batch; n++)
+                {
+                    var index = (_cursor + n) % count;
+                    var vendor = all[index];
+
+                    if (!Eligible(vendor))
+                    {
+                        _skipped++;
+                        continue;
+                    }
+
+                    // One bad vendor must not cost the rest of the window: the item walk touches
+                    // arbitrary Item subclasses on a shard running modified scripts.
+                    try
+                    {
+                        SweepVendor(vendor);
+                    }
+                    catch (Exception ex)
+                    {
+                        Console.WriteLine("[Bridge] market sweep threw for 0x{0:X}: {1}",
+                            vendor.Serial.Value, ex.Message);
+                    }
+                }
+
+                _cursor = count == 0 ? 0 : (_cursor + batch) % count;
+
+                Reap(present);
+            }
+            catch (Exception ex)
+            {
+                Console.WriteLine("[Bridge] market sweep threw: {0}", ex.Message);
+            }
+            finally
+            {
+                // In `finally` so a throwing tick still records what it cost — a sweep that blows
+                // the budget and then throws is exactly the one worth seeing in the status line.
+                if (_clock.IsRunning)
+                {
+                    _clock.Stop();
+                    _lastMs = _clock.Elapsed.TotalMilliseconds;
+                    if (_lastMs > _maxMs)
+                        _maxMs = _lastMs;
+
+                    WarnIfSlow();
+                }
+            }
+        }
+
+        /// <summary>
+        ///     Per-tick budget, milliseconds. The batch cap exists to hold a tick under this
+        ///     regardless of world size, so exceeding it means MarketSweepBatch is too large for
+        ///     this shard's shops — the one thing an operator needs told, and the one thing
+        ///     `[bridge status` cannot tell them unprompted. Generous: a tick is off the frame
+        ///     budget, and the alternative to a rare 50 ms tick is a permanently stale market.
+        /// </summary>
+        private const double SlowTickMs = 50.0;
+
+        // At most one warning a minute. A shard whose batch is genuinely too big would otherwise
+        // print every MarketSweepSeconds forever, and a log nobody can read is a log nobody reads.
+        private static DateTime _lastWarn = DateTime.MinValue;
+
+        private static void WarnIfSlow()
+        {
+            if (_lastMs <= SlowTickMs)
+                return;
+
+            var now = DateTime.UtcNow;
+
+            if (now - _lastWarn < TimeSpan.FromMinutes(1))
+                return;
+
+            _lastWarn = now;
+
+            Console.WriteLine(
+                // ASCII only. The ServUO console writes in the OS code page, so an em dash here
+                // renders as "???" in the log an operator would paste into an issue.
+                "[Bridge] market sweep took {0:F1} ms (budget {1:F0} ms) - lower Bridge.MarketSweepBatch (now {2}) if this persists",
+                _lastMs, SlowTickMs, BridgeConfig.MarketSweepBatch);
+        }
+
+        /// <summary>
+        ///     The same filter DoSearch applies, so the website's index is the in-game index.
+        ///     <c>VendorSearch</c> is the player's own opt-out toggle and is honoured first.
+        /// </summary>
+        private static bool Eligible(PlayerVendor vendor)
+        {
+            return vendor != null
+                && !vendor.Deleted
+                && vendor.VendorSearch
+                && vendor.Map != null
+                && vendor.Map != Map.Internal
+                && vendor.Backpack != null;
+        }
+
+        /// <summary>
+        ///     Drops from the board every tracked vendor that is no longer eligible.
+        ///     <paramref name="present"/> null means "there are no vendors at all", which clears it.
+        /// </summary>
+        private static void Reap(HashSet<Serial> present)
+        {
+            if (_last.Count == 0)
+                return;
+
+            List<Serial> gone = null;
+
+            foreach (var serial in _last.Keys)
+            {
+                if (present != null && present.Contains(serial))
+                    continue;
+
+                if (gone == null)
+                    gone = new List<Serial>();
+
+                gone.Add(serial);
+            }
+
+            if (gone == null)
+                return;
+
+            for (int i = 0; i < gone.Count; i++)
+            {
+                _last.Remove(gone[i]);
+                BridgeLink.Emit(BridgeJson.Begin("vendor.listing.remove").Ser("serial", gone[i]).End());
+                _removed++;
+            }
+        }
+
+        private static void SweepVendor(PlayerVendor vendor)
+        {
+            _scanned++;
+
+            CollectItems(vendor);
+
+            var sig = Signature(vendor);
+
+            string prior;
+            if (_last.TryGetValue(vendor.Serial, out prior) && prior == sig)
+                return; // nothing about this shop changed since it was last published
+
+            _last[vendor.Serial] = sig;
+            BridgeLink.Emit(WriteVendor(vendor));
+            _emitted++;
+        }
+
+        /// <summary>
+        ///     Every sellable item on one vendor, into the shared buffer.
+        ///
+        ///     Mirrors VendorSearch's own private GetItems(PlayerVendor): the vendor's own movable
+        ///     equipment (minus the backpack itself and hair layers, which are not merchandise)
+        ///     followed by a recursive walk of the backpack. The recursion uses the PUBLIC
+        ///     GetItems(Container, List&lt;Item&gt;) rather than a hand-rolled one so that ServUO's
+        ///     rule about which containers are sold whole (quivers, seed boxes, jewelry boxes, …)
+        ///     stays ServUO's to define — the predicate that decides it is private, and a copy here
+        ///     would silently diverge the first time that list changes.
+        /// </summary>
+        private static void CollectItems(PlayerVendor vendor)
+        {
+            _items.Clear();
+
+            var own = vendor.Items;
+
+            if (own != null)
+            {
+                for (int i = 0; i < own.Count; i++)
+                {
+                    var item = own[i];
+
+                    if (item == null || !item.Movable || item == vendor.Backpack)
+                        continue;
+
+                    if (item.Layer == Layer.Hair || item.Layer == Layer.FacialHair)
+                        continue;
+
+                    _items.Add(item);
+                }
+            }
+
+            if (vendor.Backpack != null)
+                VendorSearch.GetItems(vendor.Backpack, _items);
+        }
+
+        /// <summary>
+        ///     A listing's price, and whether it was priced by an enclosing container.
+        ///
+        ///     ServUO prices a container as a unit: an item inside a priced bag has no VendorItem of
+        ///     its own and inherits the bag's price, which DoSearch surfaces as `isChild`. Reproduced
+        ///     exactly, because a website that priced every item in a 40k bag at 40k would be lying
+        ///     about the shard.
+        /// </summary>
+        private static int PriceOf(PlayerVendor vendor, Item item, out bool child)
+        {
+            child = false;
+
+            var vi = vendor.GetVendorItem(item);
+
+            if (vi != null)
+                return vi.Price;
+
+            var parent = item.Parent as Container;
+
+            while (parent != null)
+            {
+                vi = vendor.GetVendorItem(parent);
+
+                if (vi != null)
+                {
+                    child = true;
+                    return vi.Price;
+                }
+
+                parent = parent.Parent as Container;
+            }
+
+            return 0;
+        }
+
+        /// <summary>
+        ///     The diff key. Location, shop name and owner are in it because they move a vendor's
+        ///     row on the site; every listing's serial, price and amount are in it because those are
+        ///     what a shopper searches on.
+        ///
+        ///     Built over the SAME buffer the frame is written from, in the same order, so a
+        ///     signature match really does mean an identical frame — a cheaper hash (count + a sum
+        ///     of serial^price, as §8.3 first proposed) collides on the common case of two items
+        ///     swapping prices, which is exactly what re-pricing a shop looks like.
+        /// </summary>
+        private static string Signature(PlayerVendor vendor)
+        {
+            var sb = new StringBuilder(256);
+
+            sb.Append(vendor.ShopName ?? "").Append('|');
+            sb.Append(vendor.Owner == null ? 0 : vendor.Owner.Serial.Value).Append('|');
+            sb.Append(vendor.Map == null ? "" : vendor.Map.Name).Append('|');
+            sb.Append(vendor.X).Append(',').Append(vendor.Y).Append('|');
+
+            // The FEE STATE, and it belongs here for a reason found on a live rig: a vendor
+            // quietly running out of gold changes none of the fields above, so without this the
+            // sweep sees no change, emits nothing, and `uo.vendor.expiring` -- the warning whose
+            // entire subject is a vendor running out of gold -- can only fire by coincidence,
+            // when somebody happens to reprice an item on a shop that is already broke.
+            //
+            // The DERIVED values, not the raw ones. `periodsRemaining` is an integer division, so
+            // it moves only when the shard's own answer to "is this vendor in danger" moves --
+            // near-zero extra frame volume -- while `HoldGold` changes on every sale and
+            // `NextPayTime` on every tick, which would re-emit a fat listing frame for a shop
+            // whose listings did not change. Protocol-neutral: the fields already ship in
+            // `AppendFees`, and this changes only WHEN a frame is sent.
+            AppendFeeSignature(sb, vendor);
+
+            var limit = Math.Min(_items.Count, BridgeConfig.MarketMaxListings);
+
+            sb.Append(_items.Count).Append('|');
+
+            for (int i = 0; i < limit; i++)
+            {
+                var item = _items[i];
+
+                if (item == null || item.Deleted)
+                    continue;
+
+                bool child;
+                var price = PriceOf(vendor, item, out child);
+
+                if (price <= 0)
+                    continue;
+
+                sb.Append(item.Serial.Value.ToString("X")).Append(':')
+                  .Append(price).Append(':')
+                  .Append(item.Amount).Append(';');
+            }
+
+            return sb.ToString();
+        }
+
+        /// <summary>
+        ///     One vendor frame — authoritative for that vendor, so the website replaces its whole
+        ///     listing set from it rather than merging.
+        ///
+        ///     `location` is one nested object rather than flat map/x/y/region because it is ONE
+        ///     admin-configurable field on the site (`market.location`): the visibility projection
+        ///     matches literal JSON keys, so a nested object is what lets a single rule hide a
+        ///     vendor's whereabouts on both the live frame and the stored read model. Flat keys
+        ///     would need five rules that could drift apart.
+        ///
+        ///     `count` is the number of listings PUBLISHED, and `truncated` says the shop holds
+        ///     more. A shop over the cap is a real thing (commodity resellers run thousands of
+        ///     stacks) and the site says so rather than quietly showing a partial shop as complete.
+        /// </summary>
+        private static string WriteVendor(PlayerVendor vendor)
+        {
+            var sb = BridgeJson.Begin("vendor.listing")
+                .Ser("serial", vendor.Serial)
+                .Str("shopName", vendor.ShopName);
+
+            var owner = vendor.Owner;
+
+            if (owner != null)
+            {
+                sb.Ser("ownerSerial", owner.Serial);
+                sb.Str("ownerName", owner.Name);
+
+                // Protocol 5. Without this the listing names an owner the website cannot resolve to
+                // a person: ownerName is a character name, and only the account is the link key.
+                var acct = owner.Account as Account;
+                if (acct != null)
+                    sb.Str("ownerAcct", acct.Username);
+            }
+
+            AppendFees(sb, vendor);
+
+            sb.Append(",\"location\":{\"map\":");
+            Text(sb, vendor.Map == null ? null : vendor.Map.Name);
+            sb.Append(",\"x\":").Append(vendor.X);
+            sb.Append(",\"y\":").Append(vendor.Y);
+            sb.Append(",\"z\":").Append(vendor.Z);
+
+            var region = vendor.Region;
+            sb.Append(",\"region\":");
+            Text(sb, region == null ? null : region.Name);
+
+            // The house name is the sign's, which is what a player would be told to look for
+            // ("Bob's Villa"), not the house type. Null for a vendor standing outside one.
+            var house = vendor.House;
+            var sign = house == null ? null : house.Sign;
+            sb.Append(",\"house\":");
+            Text(sb, sign == null ? null : sign.GetName());
+
+            sb.Append('}');
+
+            var max = BridgeConfig.MarketMaxListings;
+            var published = 0;
+            var considered = 0;
+
+            var items = new StringBuilder(512);
+
+            for (int i = 0; i < _items.Count; i++)
+            {
+                var item = _items[i];
+
+                if (item == null || item.Deleted)
+                    continue;
+
+                bool child;
+                var price = PriceOf(vendor, item, out child);
+
+                // Unpriced items are inventory, not listings — DoSearch drops them the same way.
+                if (price <= 0)
+                    continue;
+
+                considered++;
+
+                if (published >= max)
+                    continue;
+
+                if (published > 0)
+                    items.Append(',');
+
+                items.Append("{\"serial\":\"0x").Append(item.Serial.Value.ToString("X")).Append('"');
+                items.Append(",\"itemId\":").Append(item.ItemID);
+                items.Append(",\"hue\":").Append(item.Hue);
+                items.Append(",\"amount\":").Append(item.Amount);
+                items.Append(",\"price\":").Append(price);
+
+                // The PLAIN Name field, which is null for most items — never GetItemName, which
+                // builds and parses a property packet per item. LabelNumber is the cliloc the
+                // website resolves against its own table.
+                items.Append(",\"name\":");
+                Text(items, item.Name);
+                items.Append(",\"cliloc\":").Append(item.LabelNumber);
+
+                if (child)
+                    items.Append(",\"child\":true");
+
+                items.Append('}');
+
+                published++;
+            }
+
+            sb.Num("count", published);
+            sb.Num("total", considered);
+            sb.Bool("truncated", considered > published);
+
+            if (considered > published)
+                _truncated++;
+
+            sb.Append(",\"items\":[").Append(items).Append(']');
+
+            return sb.End();
+        }
+
+        /// <summary>
+        ///     Protocol 5. The vendor's fee state, which is what makes "your vendor is about to be
+        ///     dismissed" a thing the website can say BEFORE it happens instead of after.
+        ///
+        ///     The dismissal rule is PlayerVendor.PayTimer.OnTick: at every tick the charge is
+        ///     compared with the funds, and `if (pay > totalGold) Destroy()`. Both halves of that
+        ///     comparison differ between ServUO's two vendor systems, so both are resolved here
+        ///     rather than left for the sidecar or the website to guess at:
+        ///
+        ///                        | charge                  | funds                     | interval
+        ///       NewVendorSystem  | ChargePerRealWorldDay   | HoldGold                  | 1 real day
+        ///       old system       | ChargePerDay            | BankAccount + HoldGold    | 1 UO day
+        ///
+        ///     Two consequences worth stating, because both are easy to get wrong downstream:
+        ///
+        ///       * A field called `daysRemaining` would be WRONG on an old-system shard, where a pay
+        ///         period is a UO day (Clock.MinutesPerUODay, roughly two real hours) rather than a
+        ///         real one. So this emits `periodsRemaining` plus the interval that gives it meaning,
+        ///         and resolves the arithmetic into `dismissalAt` -- an instant, which needs no units.
+        ///       * A commission vendor (IsCommission) has no PayTimer at all and is never dismissed
+        ///         for fees. It reports exempt:true and no schedule, rather than a misleading
+        ///         "infinite days".
+        ///
+        ///     `dismissalAt` assumes no further sales or deposits, exactly as a bank balance
+        ///     projection does. Unlike a dynamic-decay house, though, there is no randomness in it:
+        ///     given the current funds it is the exact tick the vendor is destroyed on.
+        /// </summary>
+        /// <summary>
+        ///     The fee state as the change-detector sees it: exempt, and how many pay ticks the
+        ///     vendor survives. Kept beside `AppendFees` so the two cannot drift -- a fee field
+        ///     that becomes decision-relevant has to be added in both places, and this comment is
+        ///     where the next person is told so.
+        /// </summary>
+        private static void AppendFeeSignature(StringBuilder sb, PlayerVendor vendor)
+        {
+            if (vendor == null || vendor.IsCommission)
+            {
+                sb.Append("exempt|");
+                return;
+            }
+
+            int charge = BaseHouse.NewVendorSystem ? vendor.ChargePerRealWorldDay : vendor.ChargePerDay;
+            int funds = BaseHouse.NewVendorSystem ? vendor.HoldGold : vendor.BankAccount + vendor.HoldGold;
+
+            // Mirrors AppendFees: a free vendor never runs out, and reports no periods at all.
+            sb.Append(charge > 0 ? (funds / charge).ToString() : "free").Append('|');
+        }
+
+        private static void AppendFees(StringBuilder sb, PlayerVendor vendor)
+        {
+            sb.Append(",\"fees\":{");
+
+            if (vendor.IsCommission)
+            {
+                sb.Append("\"exempt\":true}");
+                return;
+            }
+
+            bool newSystem = BaseHouse.NewVendorSystem;
+
+            int charge = newSystem ? vendor.ChargePerRealWorldDay : vendor.ChargePerDay;
+            int funds = newSystem ? vendor.HoldGold : vendor.BankAccount + vendor.HoldGold;
+
+            sb.Append("\"exempt\":false");
+            sb.Append(",\"newVendorSystem\":").Append(newSystem ? "true" : "false");
+            sb.Append(",\"chargePerPeriod\":").Append(charge);
+            sb.Append(",\"funds\":").Append(funds);
+            sb.Append(",\"holdGold\":").Append(vendor.HoldGold);
+            sb.Append(",\"bankAccount\":").Append(vendor.BankAccount);
+
+            var interval = newSystem ? TimeSpan.FromDays(1.0) : TimeSpan.FromMinutes(Clock.MinutesPerUODay);
+            sb.Append(",\"payIntervalSec\":").Append((long)interval.TotalSeconds);
+
+            var nextPay = vendor.NextPayTime.ToUniversalTime();
+            sb.Append(",\"nextPayAt\":");
+            Text(sb, nextPay.ToString("o"));
+
+            // A free vendor (no priced stock under the old system can reach charge 0) never runs out.
+            if (charge > 0)
+            {
+                // Ticks it survives before the one that finds pay > totalGold.
+                long periods = funds / charge;
+                sb.Append(",\"periodsRemaining\":").Append(periods);
+
+                sb.Append(",\"dismissalAt\":");
+                Text(sb, nextPay.AddSeconds(periods * interval.TotalSeconds).ToString("o"));
+            }
+
+            sb.Append('}');
+        }
+    }
+}

overlay/Scripts/Custom/Bridge/BridgePoints.cs

@@ -0,0 +1,404 @@
+using System;
+using System.Collections.Generic;
+using System.Text;
+
+using Server.Engines.Points;
+
+namespace Server.Custom.Bridge
+{
+    /// <summary>
+    ///     Points / loyalty leaderboards (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/v3.md §7). ServUO carries ~25 separate point
+    ///     currencies (Queen's Loyalty, Void Pool, Casino, Clean Up Britannia, the nine city
+    ///     loyalties, Blackthorn, the Doom/Khaldun/Kotl treasure systems, …), every one of them a
+    ///     standing a player accumulates over months — and none of them has ever been visible
+    ///     anywhere but an in-game gump. This is the diff sweep that publishes them as boards.
+    ///
+    ///     Shaped like <see cref="BridgeHousing"/>: ServerStarted arms a timer, a sidecar connect
+    ///     clears the diff state so a fresh sidecar gets every board, and each pass emits only the
+    ///     systems whose top N actually moved. One frame per system (~600 B) rather than one 12 KB
+    ///     frame, matching champ.update / guild.update.
+    ///
+    ///     **There is no `points.remove`.** The set of systems is fixed at Configure() time by
+    ///     PointsSystem.Configure — a system cannot disappear at runtime — which is the same
+    ///     argument city.update already makes for cities.
+    ///
+    ///     ---- The perf trap, and why the selection looks like this ----
+    ///
+    ///     `PlayerTable` is a plain List&lt;PointsEntry&gt;, and QueensLoyalty has AutoAdd = true, so it
+    ///     holds an entry for every PlayerMobile that has ever logged in — zero-point rows included.
+    ///     The obvious `.OrderByDescending(e =&gt; e.Points).Take(N)` is a full sort PER SYSTEM: at
+    ///     20,000 historical characters that is ~25 sorts and ~7.5 M comparisons on the Core thread,
+    ///     tens of milliseconds, which BRIDGE_PLUGIN_PLAN.md §1 measured as the second thing in the
+    ///     whole bridge capable of blowing a frame budget (bulk profile generation being the first).
+    ///
+    ///     So: a single pass per system into a fixed N-element array kept sorted by insertion.
+    ///     O(n·N) with tiny constants, one allocation for the whole sweep, and the common case is a
+    ///     single comparison against the running Nth place before the row is rejected. ~500 k cheap
+    ///     iterations per pass at the default 300 s interval.
+    /// </summary>
+    public static class BridgePoints
+    {
+        private static Timer _timer;
+
+        // PointsType name -> last-emitted signature.
+        private static readonly Dictionary<string, string> _last =
+            new Dictionary<string, string>(StringComparer.Ordinal);
+
+        private static long _sweeps, _emitted;
+
+        // Reused across systems and across sweeps: the selection is single-threaded (Core thread)
+        // and fully overwritten each time, so there is nothing to allocate per pass.
+        private static PointsEntry[] _top = new PointsEntry[0];
+
+        public static void Initialize()
+        {
+            if (!BridgeConfig.Enabled)
+                return;
+
+            EventSink.ServerStarted += OnServerStarted;
+        }
+
+        private static void OnServerStarted()
+        {
+            BridgeLink.Connected_Core += OnConnected;
+            Rearm();
+        }
+
+        private static void OnConnected()
+        {
+            // A new sidecar knows nothing; drop the diff state so the next pass re-emits every board.
+            _last.Clear();
+        }
+
+        /// <summary>Stops and recreates the timer from current config. Called by `[bridge reload`.</summary>
+        public static void Rearm()
+        {
+            Stop();
+
+            _timer = Timer.DelayCall(
+                TimeSpan.FromSeconds(BridgeConfig.PointsSweepSeconds),
+                TimeSpan.FromSeconds(BridgeConfig.PointsSweepSeconds),
+                PointsSweep);
+        }
+
+        public static void Stop()
+        {
+            if (_timer != null) { _timer.Stop(); _timer = null; }
+        }
+
+        public static string Status()
+        {
+            return String.Format("points(enabled={0} sweeps={1} emitted={2} tracked={3} topN={4})",
+                BridgeConfig.PointsLeaderboardEnabled, _sweeps, _emitted, _last.Count,
+                BridgeConfig.PointsTopN);
+        }
+
+        /// <summary>Runs one sweep now. Wired into `[bridge sweepnow`.</summary>
+        public static void SweepOnce()
+        {
+            PointsSweep();
+        }
+
+        private static void PointsSweep()
+        {
+            try
+            {
+                if (!BridgeConfig.PointsLeaderboardEnabled)
+                    return;
+
+                _sweeps++;
+
+                if (!BridgeLink.Connected)
+                    return; // nothing is listening; do not fill the queue with perishable snapshots
+
+                // Systems is a mutable static populated by ~25 separate subsystem constructors in
+                // PointsSystem.Configure(). It is null before that runs and could in principle hold
+                // a null element, so neither is assumed.
+                var systems = PointsSystem.Systems;
+
+                if (systems == null)
+                    return;
+
+                var selected = SelectedSystems();
+
+                var n = BridgeConfig.PointsTopN;
+                if (_top.Length != n)
+                    _top = new PointsEntry[n];
+
+                for (int i = 0; i < systems.Count; i++)
+                {
+                    var sys = systems[i];
+
+                    if (sys == null)
+                        continue;
+
+                    // One bad system must not cost the rest of the sweep: Name/MaxPoints are
+                    // abstract members implemented by 25 unrelated subsystems, any of which could
+                    // throw on a shard running modified scripts.
+                    try
+                    {
+                        SweepSystem(sys, selected);
+                    }
+                    catch (Exception ex)
+                    {
+                        Console.WriteLine("[Bridge] points sweep threw for {0}: {1}",
+                            sys.Loyalty, ex.Message);
+                    }
+                }
+            }
+            catch (Exception ex)
+            {
+                Console.WriteLine("[Bridge] points sweep threw: {0}", ex.Message);
+            }
+        }
+
+        private static void SweepSystem(PointsSystem sys, HashSet<string> selected)
+        {
+            var key = sys.Loyalty.ToString();
+
+            if (!IsPublished(sys, key, selected))
+                return;
+
+            int ranked;
+            var count = SelectTop(sys, out ranked);
+
+            var sig = Signature(count, ranked);
+
+            string prior;
+            if (_last.TryGetValue(key, out prior) && prior == sig)
+                return; // top N and participant count both unchanged since last emit
+
+            _last[key] = sig;
+            BridgeLink.Emit(WriteBoard(sys, key, count, ranked));
+            _emitted++;
+        }
+
+        /// <summary>
+        ///     Which systems are published. The default is the shard's OWN answer to "is this
+        ///     player-facing?" — ShowOnLoyaltyGump, the flag that decides whether a system appears
+        ///     on the in-game loyalty gump — rather than a list invented here that would drift from
+        ///     the server every time a subsystem is added. `Bridge.cfg PointsSystems=` overrides it
+        ///     with an explicit comma-separated list of PointsType names.
+        /// </summary>
+        private static bool IsPublished(PointsSystem sys, string key, HashSet<string> selected)
+        {
+            if (selected != null)
+                return selected.Contains(key);
+
+            return sys.ShowOnLoyaltyGump;
+        }
+
+        // Parsed form of BridgeConfig.PointsSystems, rebuilt when the raw string changes so
+        // `[bridge reload` picks up an edit without a restart. null == "no override, use
+        // ShowOnLoyaltyGump".
+        private static string _selectedRaw;
+        private static HashSet<string> _selected;
+
+        private static HashSet<string> SelectedSystems()
+        {
+            var raw = BridgeConfig.PointsSystems ?? "";
+
+            if (raw == _selectedRaw)
+                return _selected;
+
+            _selectedRaw = raw;
+            _selected = null;
+
+            if (raw.Trim().Length == 0)
+                return null;
+
+            var set = new HashSet<string>(StringComparer.Ordinal);
+
+            foreach (var part in raw.Split(','))
+            {
+                var name = part.Trim();
+
+                if (name.Length == 0)
+                    continue;
+
+                // Resolve through the enum so a typo is reported loudly rather than silently
+                // publishing one board fewer than the operator asked for.
+                PointsType parsed;
+                if (Enum.TryParse(name, true, out parsed) && Enum.IsDefined(typeof(PointsType), parsed))
+                    set.Add(parsed.ToString());
+                else
+                    Console.WriteLine("[Bridge] unknown PointsSystems entry '{0}', ignoring", name);
+            }
+
+            _selected = set;
+            return _selected;
+        }
+
+        /// <summary>
+        ///     Single pass over one system's PlayerTable, keeping the best <c>_top.Length</c> entries
+        ///     in descending order. Returns how many slots were filled; <paramref name="ranked"/>
+        ///     receives the number of players actually holding points.
+        ///
+        ///     Ties do not displace (the shift test is strict, and the reject test is inclusive), so
+        ///     an unchanged table produces an unchanged board — which is what makes the diff
+        ///     signature meaningful rather than a source of spurious re-emits.
+        /// </summary>
+        private static int SelectTop(PointsSystem sys, out int ranked)
+        {
+            ranked = 0;
+
+            var table = sys.PlayerTable;
+            var top = _top;
+
+            if (table == null || top.Length == 0)
+                return 0;
+
+            var count = 0;
+
+            for (int i = 0; i < table.Count; i++)
+            {
+                var entry = table[i];
+
+                if (entry == null)
+                    continue;
+
+                var player = entry.Player;
+
+                // A deleted character keeps its row until the next save/load cycle, and AutoAdd
+                // systems are mostly zero-point rows. Neither belongs on a leaderboard.
+                if (player == null || player.Deleted || entry.Points <= 0)
+                    continue;
+
+                ranked++;
+
+                var points = entry.Points;
+
+                // The common case for a big table: worse than the running Nth place, one compare.
+                if (count == top.Length && points <= top[count - 1].Points)
+                    continue;
+
+                var pos = count < top.Length ? count : top.Length - 1;
+
+                while (pos > 0 && top[pos - 1].Points < points)
+                {
+                    top[pos] = top[pos - 1];
+                    pos--;
+                }
+
+                top[pos] = entry;
+
+                if (count < top.Length)
+                    count++;
+            }
+
+            return count;
+        }
+
+        /// <summary>
+        ///     A system's point ceiling as a whole number, or **0 meaning "uncapped"**.
+        ///
+        ///     `MaxPoints` is a double, and ServUO's idiom for "no cap" is `double.MaxValue`
+        ///     (DespiseCrystals, ShameCrystals and VoidPool all do this). A plain `(long)` cast of
+        ///     that is an UNCHECKED conversion — it does not throw, it produces `long.MinValue` —
+        ///     which is exactly what the first sweep against a real shard published:
+        ///     `"maxPoints": -9223372036854775808`. Anything not representable as a positive long
+        ///     therefore becomes 0, which the website already renders as "no maximum".
+        /// </summary>
+        internal static long Cap(double value)
+        {
+            // NaN first: every comparison against NaN is false, so it would otherwise fall through
+            // to the same unchecked cast.
+            if (Double.IsNaN(value) || value <= 0 || value >= 9.2233720368547758E18)
+                return 0;
+
+            return (long)value;
+        }
+
+        /// <summary>
+        ///     A score as a whole number. Same unchecked-cast hazard as <see cref="Cap"/>, but the
+        ///     saturating direction is the opposite: an implausibly large score is still a large
+        ///     score, so it clamps to long.MaxValue rather than collapsing to 0.
+        /// </summary>
+        internal static long Score(double value)
+        {
+            if (Double.IsNaN(value) || value <= 0)
+                return 0;
+
+            if (value >= 9.2233720368547758E18)
+                return Int64.MaxValue;
+
+            return (long)value;
+        }
+
+        /// <summary>
+        ///     The diff key: every published serial and its whole-point score, plus the participant
+        ///     count. Points are compared exactly as they are emitted, so a fractional award that
+        ///     does not move the displayed number does not cost a frame either.
+        /// </summary>
+        private static string Signature(int count, int ranked)
+        {
+            var sb = new StringBuilder(64);
+
+            sb.Append(ranked).Append('|');
+
+            for (int i = 0; i < count; i++)
+            {
+                var entry = _top[i];
+                sb.Append(entry.Player.Serial.Value.ToString("X"))
+                  .Append(':')
+                  .Append(Score(entry.Points))
+                  .Append(';');
+            }
+
+            return sb.ToString();
+        }
+
+        /// <summary>
+        ///     One board frame.
+        ///
+        ///     `nameString` AND `nameNumber` are both emitted because Name is a TextDefinition, which
+        ///     may carry either a literal or a cliloc id — the same contract titles.reward already
+        ///     documents at BridgeProfile.cs:107-110. Resolving clilocs is the website's job.
+        ///
+        ///     **Entries are written inline as {serial, name} — never through BridgeJson.Actor.**
+        ///     That is deliberate even though the website can now reveal fields by audience rung:
+        ///     Actor would add `acct` and `webId`, and neither is needed here, because the site
+        ///     resolves serial → user from its own shard_account_links mirror for staff views. A
+        ///     board is the widest-audience surface the bridge has; the account name of every ranked
+        ///     player has no business crossing the wire to reach it.
+        /// </summary>
+        private static string WriteBoard(PointsSystem sys, string key, int count, int ranked)
+        {
+            var name = sys.Name;
+
+            var sb = BridgeJson.Begin("points.board")
+                .Str("system", key)
+                .Str("nameString", name == null ? null : name.String)
+                .Num("nameNumber", name == null ? 0 : name.Number)
+                .Num("maxPoints", Cap(sys.MaxPoints))
+                .Bool("showOnGump", sys.ShowOnLoyaltyGump)
+                // Players actually HOLDING points, not PlayerTable.Count: an AutoAdd system has a
+                // zero-point row for every character that ever logged in, so the raw count would
+                // report the shard's whole character census as this system's participants.
+                .Num("players", ranked);
+
+            sb.Append(",\"top\":[");
+
+            for (int i = 0; i < count; i++)
+            {
+                var entry = _top[i];
+
+                if (i > 0)
+                    sb.Append(',');
+
+                sb.Append("{\"rank\":").Append(i + 1);
+                sb.Append(",\"serial\":\"0x").Append(entry.Player.Serial.Value.ToString("X")).Append('"');
+                sb.Append(",\"name\":");
+                BridgeJson.Escape(sb, entry.Player.Name ?? "");
+                // Whole points: every one of these systems awards and displays integers in game,
+                // and a board that renders 29500.00000000001 would be a bug report.
+                sb.Append(",\"points\":").Append(Score(entry.Points));
+                sb.Append('}');
+            }
+
+            sb.Append(']');
+
+            return sb.End();
+        }
+    }
+}

overlay/Scripts/Custom/Bridge/BridgeProfile.cs

@@ -2,6 +2,7 @@ using System;
 using System.Text;
 
 using Server.Accounting;
+using Server.Engines.Points;
 using Server.Items;
 using Server.Mobiles;
 
@@ -99,6 +100,7 @@ namespace Server.Custom.Bridge
             sb.Append(']');
 
             WriteTitles(sb, m);
+            WritePoints(sb, m);
 
             return sb.End();
         }
@@ -147,6 +149,147 @@ namespace Server.Custom.Bridge
             sb.Append("]}");
         }
 
+        /// <summary>
+        ///     The point/loyalty standings this character holds (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/v3.md §7.3). Read-model
+        ///     enrichment on an existing kind, exactly like <see cref="WriteTitles"/> — there is no
+        ///     request kind for "one character's points", because the profile is already the place
+        ///     the website asks for everything about one character.
+        ///
+        ///     Systems with no entry, or an entry at zero, are omitted: ten of the ~25 systems have
+        ///     AutoAdd = true and therefore hold a zero-point row for every character that has ever
+        ///     logged in, so emitting them all would be ~25 lines of noise on every sheet.
+        ///
+        ///     **Never call PointsSystem.GetEntry / GetPoints here.** Both look benign and both
+        ///     MUTATE THE WORLD: `GetEntry(from, create: false)` still calls AddEntry when the system
+        ///     has AutoAdd (PointsSystem.cs:207), which appends a row to PlayerTable and fires
+        ///     OnPlayerAdded. A read model that used them would silently grow the points save file by
+        ///     up to ten rows every time anyone viewed a character sheet. Hence the manual scan.
+        ///
+        ///     Cost: one early-exiting pass over each published system's PlayerTable. The AutoAdd
+        ///     tables are census-sized, so this is the dominant term in the profile — roughly 10 × n
+        ///     comparisons, against the ~0.069 ms/2.4 KB the rest of the profile measures at. That is
+        ///     acceptable because profiles are built on demand at human rates and never in a sweep;
+        ///     PointsProfileEnabled turns it off for a shard where it isn't.
+        ///
+        ///     **Deliberately no `rank`.** Rank cannot early-exit — it must count every row that
+        ///     beats the player, in every system, every time — and the website can derive it from
+        ///     the points.board frame for anyone who is actually on a board. See PointsProfileRank.
+        /// </summary>
+        private static void WritePoints(StringBuilder sb, PlayerMobile m)
+        {
+            if (!BridgeConfig.PointsProfileEnabled)
+                return;
+
+            sb.Append(",\"points\":[");
+
+            try
+            {
+                var systems = PointsSystem.Systems;
+
+                if (systems != null)
+                {
+                    bool first = true;
+
+                    for (int i = 0; i < systems.Count; i++)
+                    {
+                        var sys = systems[i];
+
+                        if (sys == null || !sys.ShowOnLoyaltyGump)
+                            continue;
+
+                        var points = LookupPoints(sys, m);
+
+                        if (points <= 0)
+                            continue;
+
+                        if (!first) sb.Append(',');
+                        first = false;
+
+                        var name = sys.Name;
+
+                        sb.Append("{\"system\":\"").Append(sys.Loyalty).Append('"');
+                        sb.Append(",\"nameString\":");
+                        if (name == null || name.String == null)
+                            sb.Append("null");
+                        else
+                            BridgeJson.Escape(sb, name.String);
+                        sb.Append(",\"nameNumber\":").Append(name == null ? 0 : name.Number);
+                        sb.Append(",\"points\":").Append(BridgePoints.Score(points));
+                        sb.Append(",\"maxPoints\":").Append(BridgePoints.Cap(sys.MaxPoints));
+
+                        // Off by default. The field is absent rather than null when disabled, so a
+                        // consumer can tell "this shard does not compute rank" from "unranked".
+                        if (BridgeConfig.PointsProfileRank)
+                            sb.Append(",\"rank\":").Append(RankOf(sys, points));
+
+                        sb.Append('}');
+                    }
+                }
+            }
+            catch (Exception ex)
+            {
+                // A profile is worth more than its points block; never fail the sheet over one.
+                Console.WriteLine("[Bridge] profile points threw: {0}", ex.Message);
+            }
+
+            sb.Append(']');
+        }
+
+        /// <summary>
+        ///     This character's score in one system, or 0 if it has no entry. A hand-rolled scan
+        ///     rather than GetEntry/GetPoints for the mutation reason above; it stops at the match,
+        ///     which the rank computation could not.
+        /// </summary>
+        private static double LookupPoints(PointsSystem sys, PlayerMobile m)
+        {
+            var table = sys.PlayerTable;
+
+            if (table == null)
+                return 0;
+
+            for (int i = 0; i < table.Count; i++)
+            {
+                var entry = table[i];
+
+                if (entry != null && entry.Player == m)
+                    return entry.Points;
+            }
+
+            return 0;
+        }
+
+        /// <summary>
+        ///     1-based standing in one system: how many live characters hold strictly more points,
+        ///     plus one. Ties share a rank, which is what a player expects to see.
+        ///
+        ///     Only reachable with PointsProfileRank=true, and off by default for the reason stated
+        ///     in <see cref="WritePoints"/>: unlike the points lookup, this visits every row of the
+        ///     table every time, so it turns a bounded early-exiting scan into a guaranteed full one
+        ///     per published system per profile.
+        /// </summary>
+        private static int RankOf(PointsSystem sys, double points)
+        {
+            var table = sys.PlayerTable;
+
+            if (table == null)
+                return 1;
+
+            var better = 0;
+
+            for (int i = 0; i < table.Count; i++)
+            {
+                var entry = table[i];
+
+                if (entry == null || entry.Player == null || entry.Player.Deleted)
+                    continue;
+
+                if (entry.Points > points)
+                    better++;
+            }
+
+            return better + 1;
+        }
+
         private static bool IsGearLayer(Layer layer)
         {
             switch (layer)

overlay/Scripts/Custom/Bridge/BridgeRuleset.cs

@@ -0,0 +1,355 @@
+using System;
+using System.Text;
+
+using Server.Engines.CityLoyalty;
+using Server.Engines.VvV;
+using Server.Multis;
+
+namespace Server.Custom.Bridge
+{
+    /// <summary>
+    ///     The shard ruleset (https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/v3.md §5). One `world.ruleset` frame describing how
+    ///     this shard is actually configured: expansion, which systems are on, skill/stat caps, house
+    ///     and account limits, champion scroll rules, and the save/restart schedule. It is what turns
+    ///     the website's "Rules" page from hand-maintained prose into something that cannot drift from
+    ///     the server.
+    ///
+    ///     Modelled on <see cref="BridgeBoot.EmitHello"/>, NOT on the diff sweeps: the ruleset changes
+    ///     only when an operator edits Config/*.cfg and restarts (or runs `[bridge reload`), so there is
+    ///     nothing to poll. It subscribes Connected_Core so a sidecar that comes up second still learns
+    ///     the ruleset, exactly as server.hello does.
+    ///
+    ///     **The one hard rule: this is an explicit allowlist of Config.Get calls.** Never enumerate
+    ///     Config.Entries (Server/Config.cs) — that would sweep in every key on the server, secrets
+    ///     included. Files deliberately never read here, in addition to anything not named below:
+    ///
+    ///         Server.cfg     — Address / Listen / Port. Only Bridge.PublicConnectAddress is published,
+    ///                          and only because an operator typed it there for exactly this purpose.
+    ///         Staff.cfg      — staff account names.
+    ///         Email.cfg      — SMTP credentials.
+    ///         DataPath.cfg   — filesystem layout.
+    ///         Bridge.cfg     — the sidecar host/port and our own caps.
+    ///         Compiler.cfg   — build flags.
+    ///         Reports.cfg    — report upload credentials.
+    ///         Client.cfg     — client-version enforcement (not player-facing rules).
+    ///
+    ///     `rev` is an FNV-1a hash of the emitted body, so a reconnect that carries an unchanged ruleset
+    ///     is a no-op site-side. String.GetHashCode() is deliberately NOT used: it is randomized per
+    ///     process on modern .NET, so it would change on every shard restart and defeat the whole point.
+    /// </summary>
+    public static class BridgeRuleset
+    {
+        private static long _emitted;
+        private static string _rev = "";
+        private static int _bytes;
+
+        public static void Initialize()
+        {
+            if (!BridgeConfig.Enabled)
+                return;
+
+            BridgeLink.Connected_Core += Emit;
+        }
+
+        public static string Status()
+        {
+            return String.Format("ruleset(enabled={0} emitted={1} rev={2} bytes={3})",
+                BridgeConfig.RulesetEnabled, _emitted, _rev.Length == 0 ? "-" : _rev, _bytes);
+        }
+
+        /// <summary>
+        ///     Core thread. Builds and queues one `world.ruleset` frame. Called on every sidecar
+        ///     connect and by `[bridge reload` (an operator who just edited a .cfg wants to see the
+        ///     change on the site without restarting the shard).
+        /// </summary>
+        public static void Emit()
+        {
+            if (!BridgeConfig.RulesetEnabled)
+                return;
+
+            try
+            {
+                var body = BuildBody();
+
+                _rev = Fnv1a(body);
+                _bytes = body.Length;
+                _emitted++;
+
+                // rev goes first so a reader can short-circuit on an unchanged frame before parsing
+                // the rest of it.
+                BridgeLink.Emit(BridgeJson.Begin("world.ruleset")
+                    .Str("rev", _rev)
+                    .Append(body)
+                    .End());
+            }
+            catch (Exception ex)
+            {
+                Console.WriteLine("[Bridge] ruleset emit threw: {0}", ex.Message);
+            }
+        }
+
+        /// <summary>
+        ///     The allowlist. Every block is optional and omitted when its system is off, so a shard
+        ///     that does not run (say) VvV publishes no `vvv` block rather than a block of zeroes.
+        /// </summary>
+        private static string BuildBody()
+        {
+            var sb = new StringBuilder(2048);
+
+            sb.Str("shard", Server.Misc.ServerList.ServerName);
+            sb.Str("expansion", Core.Expansion.ToString());
+
+            // The ONLY thing published from a connection-address setting, and only because the
+            // operator put it in Bridge.cfg specifically to be shown. Server.cfg is never read.
+            var connect = BridgeConfig.PublicConnectAddress;
+            if (!String.IsNullOrEmpty(connect))
+                sb.Str("connect", connect);
+
+            WriteSystems(sb);
+            WriteCaps(sb);
+
+            sb.Append(",\"housing\":{\"accountHouseLimit\":")
+              .Append(BaseHouse.AccountHouseLimit).Append('}');
+
+            WriteAccounts(sb);
+            WriteVetRewards(sb);
+            WriteLoot(sb);
+            WriteVendors(sb);
+            WriteChampions(sb);
+            WriteTreasureMaps(sb);
+            WriteVvV(sb);
+            WriteStore(sb);
+
+            if (BridgeConfig.RulesetIncludeSchedule)
+                WriteSchedule(sb);
+
+            return sb.ToString();
+        }
+
+        /// <summary>
+        ///     Which optional systems this shard runs. Read from each system's own static rather than
+        ///     re-parsing its .cfg, so a system that derives its state (Factions is on exactly when VvV
+        ///     is off — Services/Factions/Core/Faction.cs) is reported the way the server actually sees
+        ///     it. This block subsumes the `world.systems` capability frame PROTOCOL_2.md §10.4
+        ///     sketched but never implemented.
+        /// </summary>
+        private static void WriteSystems(StringBuilder sb)
+        {
+            sb.Append(",\"systems\":{");
+            sb.Append("\"cityLoyalty\":").Append(Json(CityLoyaltySystem.Enabled));
+            sb.Append(",\"vvv\":").Append(Json(ViceVsVirtueSystem.Enabled));
+            sb.Append(",\"factions\":").Append(Json(Server.Factions.Settings.Enabled));
+            sb.Append(",\"siege\":").Append(Json(Siege.SiegeShard));
+            sb.Append(",\"chat\":").Append(Json(Config.Get("Chat.Enabled", true)));
+            sb.Append(",\"store\":").Append(Json(Config.Get("Store.Enabled", true)));
+            sb.Append(",\"dailyRares\":").Append(Json(Config.Get("DailyRares.Enabled", true)));
+            sb.Append(",\"honesty\":").Append(Json(Config.Get("Honesty.Enabled", true)));
+            sb.Append(",\"shadowguard\":").Append(Json(Core.TOL));
+            sb.Append(",\"treasureMaps\":").Append(Json(Config.Get("TreasureMaps.Enabled", true)));
+            sb.Append(",\"vetRewards\":").Append(Json(Config.Get("VetRewards.Enabled", true)));
+            sb.Append(",\"testCenter\":").Append(Json(Config.Get("TestCenter.Enabled", false)));
+            sb.Append('}');
+        }
+
+        /// <summary>
+        ///     Skill and stat caps — the single most-asked "what are the rules here?" question, and the
+        ///     one most often wrong on a hand-written page. SkillCap is in tenths (1000 = 100.0).
+        /// </summary>
+        private static void WriteCaps(StringBuilder sb)
+        {
+            sb.Append(",\"caps\":{");
+            sb.Append("\"skill\":").Append(Config.Get("PlayerCaps.SkillCap", 1000));
+            sb.Append(",\"totalSkill\":").Append(Config.Get("PlayerCaps.TotalSkillCap", 7000));
+            sb.Append(",\"stat\":").Append(Config.Get("PlayerCaps.TotalStatCap", 225));
+            sb.Append(",\"str\":").Append(Config.Get("PlayerCaps.StrCap", 125));
+            sb.Append(",\"dex\":").Append(Config.Get("PlayerCaps.DexCap", 125));
+            sb.Append(",\"int\":").Append(Config.Get("PlayerCaps.IntCap", 125));
+            sb.Append(",\"strMax\":").Append(Config.Get("PlayerCaps.StrMaxCap", 150));
+            sb.Append(",\"dexMax\":").Append(Config.Get("PlayerCaps.DexMaxCap", 150));
+            sb.Append(",\"intMax\":").Append(Config.Get("PlayerCaps.IntMaxCap", 150));
+            sb.Append('}');
+        }
+
+        /// <summary>
+        ///     Account limits. `autoCreate` is the in-game first-login auto-create switch, which pairs
+        ///     with the bridge's own SignupMode (BridgeConfig.WarnOnSignupMismatch) — publishing it
+        ///     lets the site's signup page tell a visitor the truth about how to get an account.
+        ///     Character slots come from Siege.cfg, which is where ServUO keeps them regardless of
+        ///     whether the shard is actually Siege.
+        /// </summary>
+        private static void WriteAccounts(StringBuilder sb)
+        {
+            sb.Append(",\"accounts\":{");
+            sb.Append("\"perIp\":").Append(Config.Get("Accounts.AccountsPerIp", 1));
+            sb.Append(",\"charSlots\":").Append(Siege.CharacterSlots);
+            sb.Append(",\"autoCreate\":").Append(Json(Config.Get("Accounts.AutoCreateAccounts", true)));
+            sb.Append('}');
+        }
+
+        private static void WriteVetRewards(StringBuilder sb)
+        {
+            var enabled = Config.Get("VetRewards.Enabled", true);
+
+            sb.Append(",\"vetRewards\":{\"enabled\":").Append(Json(enabled));
+
+            if (enabled)
+            {
+                var interval = Config.Get("VetRewards.RewardInterval", TimeSpan.FromDays(30.0));
+                sb.Append(",\"rewardIntervalDays\":").Append((int)interval.TotalDays);
+            }
+
+            sb.Append('}');
+        }
+
+        /// <summary>The Felucca risk-vs-reward numbers — the reason players choose a facet.</summary>
+        private static void WriteLoot(StringBuilder sb)
+        {
+            sb.Append(",\"loot\":{");
+            sb.Append("\"feluccaLuckBonus\":").Append(Config.Get("Loot.FeluccaLuckBonus", 0));
+            sb.Append(",\"feluccaBudgetBonus\":").Append(Config.Get("Loot.FeluccaBudgetBonus", 0));
+            sb.Append(",\"feluccaMaxProps\":").Append(Config.Get("Loot.MaxProps", 5));
+            sb.Append('}');
+        }
+
+        private static void WriteVendors(StringBuilder sb)
+        {
+            sb.Append(",\"vendors\":{");
+            sb.Append("\"restockDelayMinutes\":").Append(Config.Get("Vendors.RestockDelay", 60));
+            sb.Append(",\"maxSell\":").Append(Config.Get("Vendors.MaxSell", 500));
+            sb.Append(",\"economyStockAmount\":").Append(Config.Get("Vendors.EconomyStockAmount", 500));
+            sb.Append('}');
+        }
+
+        /// <summary>
+        ///     Champion spawn rewards. `rankThresholds` is the red-skull count at which each rank is
+        ///     reached, which is what a player actually wants to know before committing to a spawn.
+        /// </summary>
+        private static void WriteChampions(StringBuilder sb)
+        {
+            if (!Config.Get("Champions.Enabled", true))
+                return;
+
+            sb.Append(",\"champions\":{");
+            sb.Append("\"powerScrolls\":").Append(Config.Get("Champions.PowerScrolls", 6));
+            sb.Append(",\"statScrolls\":").Append(Config.Get("Champions.StatScrolls", 16));
+            sb.Append(",\"scrollChance\":").Append(Json(Config.Get("Champions.ScrollChance", 0.1)));
+            sb.Append(",\"transcendenceChance\":")
+              .Append(Json(Config.Get("Champions.TranscendenceChance", 50.0)));
+            sb.Append(",\"rankThresholds\":[")
+              .Append(Config.Get("Champions.Rank2RedSkulls", 5)).Append(',')
+              .Append(Config.Get("Champions.Rank3RedSkulls", 10)).Append(',')
+              .Append(Config.Get("Champions.Rank4RedSkulls", 13))
+              .Append(']');
+            sb.Append('}');
+        }
+
+        private static void WriteTreasureMaps(StringBuilder sb)
+        {
+            var enabled = Config.Get("TreasureMaps.Enabled", true);
+
+            sb.Append(",\"treasureMaps\":{\"enabled\":").Append(Json(enabled));
+
+            if (enabled)
+            {
+                sb.Append(",\"lootChance\":").Append(Json(Config.Get("TreasureMaps.LootChance", 0.01)));
+                sb.Append(",\"resetDays\":").Append(Json(Config.Get("TreasureMaps.ResetTime", 30.0)));
+            }
+
+            sb.Append('}');
+        }
+
+        private static void WriteVvV(StringBuilder sb)
+        {
+            if (!ViceVsVirtueSystem.Enabled)
+                return;
+
+            sb.Append(",\"vvv\":{");
+            sb.Append("\"enabled\":true");
+            sb.Append(",\"startSilver\":").Append(ViceVsVirtueSystem.StartSilver);
+            sb.Append(",\"enhancedRules\":").Append(Json(ViceVsVirtueSystem.EnhancedRules));
+            sb.Append('}');
+        }
+
+        /// <summary>
+        ///     The Ultima Store. Only `enabled` and the currency's display name — never the store's
+        ///     price table or any payment configuration, neither of which lives in Config anyway.
+        /// </summary>
+        private static void WriteStore(StringBuilder sb)
+        {
+            var enabled = Config.Get("Store.Enabled", true);
+
+            sb.Append(",\"store\":{\"enabled\":").Append(Json(enabled));
+
+            if (enabled)
+                sb.Str("currencyName", Config.Get("Store.CurrencyName", "Sovereigns"));
+
+            sb.Append('}');
+        }
+
+        /// <summary>
+        ///     Save and restart schedule — "when does the shard hiccup?", the other question a live
+        ///     status page is asked. Off behind RulesetIncludeSchedule for an operator who would rather
+        ///     not advertise a predictable restart window.
+        /// </summary>
+        private static void WriteSchedule(StringBuilder sb)
+        {
+            sb.Append(",\"schedule\":{");
+
+            var saves = Config.Get("AutoSave.Enabled", true);
+            sb.Append("\"autoSaveEnabled\":").Append(Json(saves));
+
+            if (saves)
+            {
+                var freq = Config.Get("AutoSave.Frequency", TimeSpan.FromMinutes(5.0));
+                sb.Append(",\"autoSaveFrequencyMinutes\":").Append((int)freq.TotalMinutes);
+            }
+
+            var restart = Config.Get("AutoRestart.Enabled", false);
+            sb.Append(",\"autoRestartEnabled\":").Append(Json(restart));
+
+            if (restart)
+            {
+                sb.Append(",\"autoRestartHour\":").Append(Config.Get("AutoRestart.Hour", 12));
+                sb.Append(",\"autoRestartMinute\":").Append(Config.Get("AutoRestart.Minute", 0));
+                sb.Append(",\"autoRestartFrequencyHours\":").Append(Config.Get("AutoRestart.Frequency", 24));
+            }
+
+            sb.Append('}');
+        }
+
+        // ---- helpers ----
+
+        private static string Json(bool value)
+        {
+            return value ? "true" : "false";
+        }
+
+        private static string Json(double value)
+        {
+            return value.ToString("R", System.Globalization.CultureInfo.InvariantCulture);
+        }
+
+        /// <summary>
+        ///     FNV-1a over the UTF-16 code units of the body, as 8 lowercase hex digits. Any stable
+        ///     hash would do; what matters is that it is stable ACROSS PROCESSES, which
+        ///     String.GetHashCode() is not (it is seeded randomly per process), so using that would
+        ///     produce a different rev after every restart and make the whole diff pointless.
+        /// </summary>
+        private static string Fnv1a(string s)
+        {
+            const uint offset = 2166136261;
+            const uint prime = 16777619;
+
+            uint hash = offset;
+
+            for (int i = 0; i < s.Length; i++)
+            {
+                char c = s[i];
+                hash = (hash ^ (byte)(c & 0xFF)) * prime;
+                hash = (hash ^ (byte)(c >> 8)) * prime;
+            }
+
+            return hash.ToString("x8");
+        }
+    }
+}

overlay/Scripts/Custom/Bridge/BridgeSocial.cs

@@ -15,10 +15,14 @@ namespace Server.Custom.Bridge
     ///     A guild that vanishes (or disbands — Disbanded == leader gone) leaves via `guild.remove`.
     ///
     ///     On top of the board we emit a real-time `guild.join` from EventSink.JoinGuild, so a "so-and-
-    ///     so joined" feed does not wait for the next sweep. A membership change also moves the board
-    ///     signature (member count + serial sum), so a *leave* surfaces as the member count dropping in
-    ///     the next `guild.update`; per-member leave events would need a core tap and are a later
-    ///     refinement (§10.1).
+    ///     so joined" feed does not wait for the next sweep.
+    ///
+    ///     Protocol 4 adds the membership half that §10.1 deferred. The sweep holds each guild's
+    ///     member serial **set** rather than a sum of it, so a change is detected by set comparison
+    ///     (no hash collisions, unlike the old sum where two offsetting changes could cancel) and the
+    ///     departures are recoverable by difference — which is what makes a per-member `guild.leave`
+    ///     possible without a core tap. A changed set also re-emits `guild.roster`, the full member
+    ///     list, so the board self-corrects and nothing downstream has to replay deltas to stay right.
     ///
     ///     "Created" is derived sidecar-side from a first-seen id (as champs derive it), rather than a
     ///     wire event — otherwise a sidecar reconnect, which clears the diff cache and re-emits every
@@ -32,7 +36,16 @@ namespace Server.Custom.Bridge
         // was cleared on reconnect), so its next sweep counts as a change.
         private static readonly Dictionary<int, string> _last = new Dictionary<int, string>();
 
-        private static long _sweeps, _emitted, _removed, _joins;
+        // guild id -> last-emitted member serial set (Protocol 4). Held rather than summed so a
+        // departure can be recovered as a set difference; see the class remarks.
+        private static readonly Dictionary<int, HashSet<int>> _members =
+            new Dictionary<int, HashSet<int>>();
+
+        private static long _sweeps, _emitted, _removed, _joins, _rosters, _leaves;
+
+        // Set while a post-reconnect baseline is still draining, so the sweep re-arms promptly
+        // instead of leaving the site a sweep interval behind. See GuildSweep.
+        private static bool _draining;
 
         public static void Initialize()
         {
@@ -52,6 +65,7 @@ namespace Server.Custom.Bridge
         private static void OnConnected()
         {
             _last.Clear();
+            _members.Clear();
         }
 
         /// <summary>Stops and recreates the timer from current config. Called by `[bridge reload`.</summary>
@@ -72,8 +86,9 @@ namespace Server.Custom.Bridge
 
         public static string Status()
         {
-            return String.Format("guilds(sweeps={0} emitted={1} removed={2} joins={3} tracked={4})",
-                _sweeps, _emitted, _removed, _joins, _last.Count);
+            return String.Format(
+                "guilds(sweeps={0} emitted={1} removed={2} joins={3} rosters={4} leaves={5} tracked={6} draining={7})",
+                _sweeps, _emitted, _removed, _joins, _rosters, _leaves, _last.Count, _draining);
         }
 
         /// <summary>Runs one sweep now. Wired into `[bridge sweepnow`.</summary>
@@ -93,6 +108,12 @@ namespace Server.Custom.Bridge
 
                 var seen = new HashSet<int>();
 
+                // Guilds whose roster this sweep is still allowed to emit. Every guild looks changed
+                // right after a reconnect, and a roster is this plugin's only fat frame, so the
+                // baseline is spread over several passes rather than built in one Core-thread tick.
+                var rosterBudget = BridgeConfig.GuildRosterGuildsPerTick;
+                var deferred = false;
+
                 foreach (var bg in BaseGuild.List.Values)
                 {
                     var g = bg as Guild;
@@ -104,15 +125,64 @@ namespace Server.Custom.Bridge
 
                     seen.Add(g.Id);
 
+                    var current = MemberSerials(g);
+
+                    HashSet<int> priorMembers;
+                    var known = _members.TryGetValue(g.Id, out priorMembers);
+                    var membersChanged = !known || !priorMembers.SetEquals(current);
+
                     var sig = Signature(g);
 
                     string prior;
-                    if (_last.TryGetValue(g.Id, out prior) && prior == sig)
+                    var sigChanged = !_last.TryGetValue(g.Id, out prior) || prior != sig;
+
+                    if (!sigChanged && !membersChanged)
                         continue; // unchanged since last emit
 
-                    _last[g.Id] = sig;
-                    BridgeLink.Emit(WriteGuild(g));
-                    _emitted++;
+                    if (sigChanged)
+                    {
+                        _last[g.Id] = sig;
+                        BridgeLink.Emit(WriteGuild(g));
+                        _emitted++;
+                    }
+
+                    if (!membersChanged)
+                        continue;
+
+                    // Over budget: leave _members untouched so this guild is still "changed" next
+                    // pass and gets its roster then. The guild.update above has already gone, so the
+                    // board's counts are current either way.
+                    if (rosterBudget <= 0)
+                    {
+                        deferred = true;
+                        continue;
+                    }
+
+                    rosterBudget--;
+
+                    // Departures, per member, before the roster that supersedes them: a consumer
+                    // building a "so-and-so left" feed needs the individual events, while a consumer
+                    // holding the membership table only needs the roster. On the very first sweep for
+                    // a guild there is no prior set, so nothing is reported as having left — an
+                    // unknown roster becoming known is not 155 people leaving.
+                    if (known)
+                    {
+                        foreach (var serial in priorMembers)
+                        {
+                            if (current.Contains(serial))
+                                continue;
+
+                            BridgeLink.Emit(BridgeJson.Begin("guild.leave")
+                                .Num("id", g.Id)
+                                .Str("name", g.Name)
+                                .Ser("who", (Serial)serial)
+                                .End());
+                            _leaves++;
+                        }
+                    }
+
+                    EmitRoster(g);
+                    _members[g.Id] = current;
                 }
 
                 // Anything tracked last sweep but not seen now has disbanded or been removed.
@@ -120,9 +190,19 @@ namespace Server.Custom.Bridge
                 foreach (var id in gone)
                 {
                     _last.Remove(id);
+                    _members.Remove(id);
                     BridgeLink.Emit(BridgeJson.Begin("guild.remove").Num("id", id).End());
                     _removed++;
                 }
+
+                // Re-arm promptly while a baseline is still draining. Without this the remaining
+                // guilds would each wait a full GuildSweepSeconds, so a 200-guild shard would take
+                // hours to publish its rosters after a reconnect instead of seconds. The sweep is
+                // idempotent, so an extra pass that finds nothing changed costs a few field reads.
+                _draining = deferred;
+
+                if (deferred)
+                    Timer.DelayCall(TimeSpan.FromSeconds(2.0), GuildSweep);
             }
             catch (Exception ex)
             {
@@ -130,14 +210,15 @@ namespace Server.Custom.Bridge
             }
         }
 
-        // The volatile fields that define a meaningful change: name, abbreviation, leader, member
-        // count, the member set (order-independent serial sum), and alliance.
-        private static string Signature(Guild g)
+        /// <summary>
+        ///     The guild's live member serials. Held per guild between sweeps so a membership change
+        ///     yields both the fact that it changed and *who* left (Protocol 4).
+        /// </summary>
+        private static HashSet<int> MemberSerials(Guild g)
         {
-            long memberSum = 0;
-            int count = 0;
-
+            var set = new HashSet<int>();
             var members = g.Members;
+
             if (members != null)
             {
                 for (int i = 0; i < members.Count; i++)
@@ -145,8 +226,28 @@ namespace Server.Custom.Bridge
                     var m = members[i];
                     if (m == null)
                         continue;
-                    count++;
-                    unchecked { memberSum += (uint)m.Serial.Value; }
+                    set.Add(m.Serial.Value);
+                }
+            }
+
+            return set;
+        }
+
+        // The volatile fields that define a meaningful change to the *board row*: name, abbreviation,
+        // leader, member count and alliance. Membership is no longer folded in here as a serial sum —
+        // the sweep compares the real member set instead, which cannot collide the way a sum can when
+        // one member joins and another leaves between two passes.
+        private static string Signature(Guild g)
+        {
+            int count = 0;
+
+            var members = g.Members;
+            if (members != null)
+            {
+                for (int i = 0; i < members.Count; i++)
+                {
+                    if (members[i] != null)
+                        count++;
                 }
             }
 
@@ -157,7 +258,6 @@ namespace Server.Custom.Bridge
                 g.Abbreviation ?? "", "|",
                 leaderSerial.ToString(), "|",
                 count.ToString(), "|",
-                memberSum.ToString(), "|",
                 g.Alliance == null ? "" : (g.AllianceName ?? ""));
         }
 
@@ -191,6 +291,55 @@ namespace Server.Custom.Bridge
             return sb.End();
         }
 
+        /// <summary>
+        ///     Emits the guild's full member list as one or more `guild.roster` frames (Protocol 4).
+        ///
+        ///     A roster is the only fat frame this plugin produces — roughly 69 bytes per member — and
+        ///     the sidecar reads a line with no length bound, so the member count per line is capped
+        ///     (Bridge.GuildRosterMembersPerLine). A guild over the cap is split, and each frame
+        ///     carries `seq` plus `more` so a consumer can tell a complete roster from a partial one:
+        ///     `seq` 0 begins a roster and replaces whatever was held, and `more` false ends it. A
+        ///     guild inside the cap — every realistic one — emits exactly one frame with `seq` 0 and
+        ///     `more` false, which is the same shape as if chunking did not exist.
+        /// </summary>
+        private static void EmitRoster(Guild g)
+        {
+            var members = g.Members;
+            var total = members == null ? 0 : members.Count;
+            var perLine = BridgeConfig.GuildRosterMembersPerLine;
+
+            var seq = 0;
+            var start = 0;
+
+            // do/while, not while: a guild with no members must still emit one empty roster frame,
+            // or a consumer could never learn that a roster it holds has emptied.
+            do
+            {
+                var more = start + perLine < total;
+
+                var sb = BridgeJson.Begin("guild.roster")
+                    .Num("id", g.Id)
+                    .Str("name", g.Name)
+                    .Str("abbr", g.Abbreviation)
+                    .Num("total", total)
+                    .Num("seq", seq)
+                    .Bool("more", more);
+
+                // `withGuildRank` — the roster is the one place a member's rank in THIS guild is
+                // meaningful, and the only frame that carries it. Leadership is rank 4
+                // (RankDefinition.Ranks), and a guild can have several members at it, which is why
+                // the board's single `leader` field was never enough to answer "who leads this".
+                sb.Actors("members", members, start, perLine, withGuildRank: true);
+
+                BridgeLink.Emit(sb.End());
+                _rosters++;
+
+                start += perLine;
+                seq++;
+            }
+            while (start < total);
+        }
+
         // ---- real-time join ----
 
         private static void OnJoinGuild(JoinGuildEventArgs e)

overlay/Scripts/Custom/Bridge/BridgeSweeps.cs

@@ -215,11 +215,14 @@ namespace Server.Custom.Bridge
             if (owner != null)
             {
                 sb.Ser("ownerSerial", owner.Serial);
+                sb.Str("ownerName", owner.Name);
                 var acct = owner.Account as Account;
                 if (acct != null)
                     sb.Str("ownerAcct", acct.Username);
             }
 
+            AppendDecaySchedule(sb, house, to);
+
             // Where a player would physically stand to see it.
             var ban = house.BanLocation;
             sb.Append(",\"ban\":{\"x\":").Append(ban.X)
@@ -232,6 +235,67 @@ namespace Server.Custom.Bridge
             return sb.End();
         }
 
+        /// <summary>
+        ///     Protocol 5. The three scheduling fields, and the reason they are not all always present.
+        ///
+        ///     ServUO has two decay implementations and they differ in how KNOWABLE the future is:
+        ///
+        ///       * Dynamic decay (DynamicDecay.Enabled, i.e. Core.ML) draws each stage's duration at
+        ///         RANDOM when the stage is entered (BaseHouse.SetDynamicDecay ->
+        ///         DynamicDecay.GetRandomDuration). So NextDecayStage is exact for the NEXT transition
+        ///         and nothing beyond it is known at all. Collapse becomes exact only once the house is
+        ///         already at IDOC, because then the next transition IS the collapse.
+        ///       * Static decay (GetOldDecayLevel) is a pure function of LastRefreshed and DecayPeriod,
+        ///         so collapse is exact at EVERY stage -- there is no randomness to wait out.
+        ///
+        ///     Emitting estimatedCollapse from a dynamic-decay house at, say, Fairly would therefore be
+        ///     publishing a guess as a fact, which on the website's side becomes a dated promise in a
+        ///     player's mail. It is omitted rather than approximated: the website's `required: false`
+        ///     declaration already permits its absence, and an absent field is honest where a wrong
+        ///     date is not.
+        /// </summary>
+        private static void AppendDecaySchedule(StringBuilder sb, BaseHouse house, DecayLevel to)
+        {
+            // ONE nested object rather than four sibling keys, for the same reason vendor.listing
+            // nests `location`: the website's visibility projection matches literal JSON keys, so a
+            // nested group is one admin rule that can hide the whole schedule, where four flat keys
+            // would be four rules that drift apart.
+            sb.Append(",\"schedule\":{");
+
+            // The stage clock. Only dynamic decay keeps one; static decay leaves it at MinValue.
+            bool dynamic = DynamicDecay.Enabled;
+            var next = house.NextDecayStage;
+
+            sb.Append("\"dynamicDecay\":").Append(dynamic ? "true" : "false");
+
+            if (dynamic && next > DateTime.MinValue)
+                sb.Str("nextStage", next.ToUniversalTime().ToString("o"));
+
+            // Total seconds from a full refresh to collapse. Constant per house type, but it is what
+            // lets a reader turn lastRefreshed into a percentage without knowing ServUO's tables.
+            var period = house.DecayPeriod;
+            if (period > TimeSpan.Zero)
+                sb.Num("decayPeriodSec", (long)period.TotalSeconds);
+
+            DateTime collapse;
+            bool knowable = true;
+
+            if (!dynamic)
+                collapse = house.LastRefreshed.ToUniversalTime() + period;
+            else if (to == DecayLevel.IDOC && next > DateTime.MinValue)
+                collapse = next.ToUniversalTime();
+            else
+            {
+                collapse = DateTime.MinValue;
+                knowable = false;
+            }
+
+            if (knowable)
+                sb.Str("estimatedCollapse", collapse.ToString("o"));
+
+            sb.Append('}');
+        }
+
         // ---- economy supply ----
 
         /// <summary>

patches/README.md

@@ -9,6 +9,14 @@ git apply --check patches/<name>.patch   # dry run
 git apply         patches/<name>.patch
 ```
 
+## `tier.json` — adding or changing a patch
+
+A `.patch` file does not say enough on its own. The Runic Gateway installer's patch tier also has to know which patches form **one all-or-nothing unit**, which companion `.cs` may only be copied once that unit has landed, whether the change needs a **core** solution rebuild or just the dynamic script build, and what the operator loses by declining. None of that is derivable from a diff, so it is declared in [`tier.json`](tier.json).
+
+**Adding a patch means adding it there in the same PR.** The release workflow checks the table in both directions — every `.patch` described by exactly one feature, every named patch and companion present, every `target` equal to the file the diff actually edits — so a patch without an entry fails the release rather than shipping a tier that silently never offers it.
+
+`tier.json` is folded into the tarball's `manifest.json` as `patch_tier` and removed from the staged `patches/` directory, so the artifact carries exactly one copy of the table and it is the one the installer reads. Installers older than this key ignore it; an installer newer than the overlay it is deploying falls back to a built-in copy. See `docs/installer/PLAN.md` §2.2 and §7.0.
+
 ## Phase 7 — player-vendor sale (a coupled unit)
 
 Player-vendor purchases raise **no** EventSink. `ValidVendorPurchase` / `ValidVendorSell` cover NPC vendors only. The commit point is `PlayerVendorBuyGump.OnResponse`, the only place where buyer, vendor **owner**, price, and commission are all in scope — exactly what cheat detection needs. See [PLAN.md](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/main/link/PLAN.md) §6.

patches/tier.json

@@ -0,0 +1,69 @@
+{
+  "_comment": [
+    "The patch tier, described for the Runic Gateway installer.",
+    "",
+    "A .patch file on its own does not say enough to run the tier safely. The installer",
+    "additionally has to know which patches form ONE all-or-nothing unit (the two",
+    "vendor-sale patches are useless apart), which companion .cs may only be copied once",
+    "that unit has landed, whether the change needs a CORE solution rebuild or just the",
+    "dynamic script build, and what capability the operator loses by declining. None of",
+    "that is derivable from the diffs, so it is declared here.",
+    "",
+    "This file is the maintainer-facing source of truth. release.yml folds it into",
+    "manifest.json as `patch_tier` and removes it from the staged patches/ directory, so",
+    "the tarball carries exactly one copy and it is the one the installer reads",
+    "(docs/installer/PLAN.md §7.0). CI also asserts that every .patch here is named by",
+    "exactly one feature and every named patch and companion exists — adding a patch",
+    "without describing it fails the release rather than shipping a tier that silently",
+    "ignores it.",
+    "",
+    "Older installers ignore `patch_tier` entirely, and an installer newer than the",
+    "overlay it is deploying falls back to its own built-in copy of this table."
+  ],
+
+  "features": [
+    {
+      "name": "vendor-sale",
+      "summary": "vendor.sale events — player-vendor purchases with buyer, owner, item, price and commission",
+      "lost": "no vendor.sale events",
+      "rebuild": "core",
+      "patches": [
+        {
+          "name": "playervendor-sale-eventsink",
+          "file": "playervendor-sale-eventsink.patch",
+          "target": "Server/EventSink.cs"
+        },
+        {
+          "name": "playervendor-sale-gump",
+          "file": "playervendor-sale-gump.patch",
+          "target": "Scripts/Gumps/PlayerVendorGumps.cs"
+        }
+      ],
+      "companions": [
+        {
+          "file": "BridgeVendorSale.cs",
+          "install_to": "Scripts/Custom/Bridge/BridgeVendorSale.cs"
+        }
+      ]
+    },
+    {
+      "name": "moderation-audit",
+      "summary": "in-game moderation actions ([ban, [kick, [bcast) forwarded to the website as admin.audit",
+      "lost": "no in-game moderation audit forwarding",
+      "rebuild": "scripts",
+      "patches": [
+        {
+          "name": "commandlogging-event",
+          "file": "commandlogging-event.patch",
+          "target": "Scripts/Commands/Logging.cs"
+        }
+      ],
+      "companions": [
+        {
+          "file": "BridgeModerationAudit.cs",
+          "install_to": "Scripts/Custom/Bridge/BridgeModerationAudit.cs"
+        }
+      ]
+    }
+  ]
+}

tools/scaffolding/BridgeDemoDress.cs

@@ -0,0 +1,687 @@
+using System;
+using System.Collections.Generic;
+
+using Server.Accounting;
+using Server.Commands;
+using Server.Guilds;
+using Server.Mobiles;
+using Server.Multis;
+
+namespace Server.Custom
+{
+    /// <summary>
+    ///     Gives a BridgeSeeder world presentable names, so a shard standing behind a public
+    ///     screenshot does not read as test data.
+    ///
+    ///     Test scaffolding. Not part of the bridge. Never deployed — see tools/README.md.
+    ///
+    ///     WHY THIS EXISTS
+    ///     ---------------
+    ///     BridgeSeeder builds a world at realistic SCALE, which is what the bridge needed:
+    ///     50 accounts, 150 characters, 30 houses, 30 vendors, 1,200 listings. It never needed
+    ///     the world to look like anything, so a vendor is "seed vendor" trading as
+    ///     "Seed Shop 810" and a character is "Seed004A". Every one of those names travels the
+    ///     whole bridge — plugin, sidecar, website — and lands on the marketplace, the guild
+    ///     roster and the housing pages, which are exactly the pages a screenshot wants.
+    ///
+    ///     This pass renames what is already there rather than seeding anything new. That
+    ///     matters: the data keeps its provenance. The prices, the listing counts, the decay
+    ///     stages, the fame and the skill sheets are all still whatever BridgeSeeder produced
+    ///     and whatever the shard has done to them since — only the strings a human reads are
+    ///     replaced. Nothing here invents shard state that the game did not produce.
+    ///
+    ///     IDEMPOTENT, AND DETERMINISTIC
+    ///     -----------------------------
+    ///     Names come from fixed tables indexed by the object's own serial, so the same vendor
+    ///     draws the same shop name on every run against the same save — screenshots retaken
+    ///     later still match. A second run is therefore a no-op, and a world half-dressed by an
+    ///     interrupted run finishes cleanly.
+    ///
+    ///     Shop and house names are also re-dressed when they are names THIS pass produced, so
+    ///     a change to the tables or to the hash can be applied to a world that has already been
+    ///     through here once. Character names are not: a person's name is an ordinary string
+    ///     with no closed set to recognise it by, so once dressed it is left alone.
+    ///
+    ///     WHAT IT ALSO DOES, AND WHY EACH IS HERE
+    ///     ---------------------------------------
+    ///     - Walks a few houses into IDOC, in two passes with a wait between them, because the
+    ///       website only records a collapse it watched happen. Decay is a live process: by the
+    ///       time anybody looks the stages have moved on and "Houses in danger" is empty. Empty
+    ///       is a true state and a poor screenshot, so this stages a handful — see PrimeIdoc.
+    ///     - Sets a known password on one seeded account. Logging a character in is the only
+    ///       way to make the online roster non-empty, and it needs a client, and a client needs
+    ///       a password. The seeder gives every account a random GUID nobody kept.
+    ///     - BUILDS GUILDS, which is the one thing here that creates rather than renames. The
+    ///       seeder never made any, so a shard behind these screenshots has an empty guild
+    ///       board and — because the website's Teams are reconciled from that board — no teams
+    ///       either. There is nothing to rename: a guild has to exist before it can be called
+    ///       something. Members are drawn from characters the seeder already made, so the only
+    ///       invention is the association itself.
+    ///
+    ///     A NOTE ON THE GUILD BOARD, FOUND WHILE BUILDING THIS
+    ///     ---------------------------------------------------
+    ///     `BridgeSocial.Signature()` folds name, abbreviation, leader serial, member count and
+    ///     alliance — not member NAMES — and the roster is only re-emitted when the member SET
+    ///     changes. So renaming a guild member never reaches the site: the board keeps the name
+    ///     the member had when the roster was last emitted. Dressing a world that was already
+    ///     published therefore leaves stale rosters behind, and creating the guilds after the
+    ///     rename (as this does) is what avoids it. Raised as a product observation, not fixed
+    ///     here — a rename is rare in a real shard, and the fix belongs in the plugin.
+    ///
+    ///     Flag: `DemoDressOnStart=True` in Config/Bridge.cfg. In game: `[demodress`.
+    /// </summary>
+    public static class BridgeDemoDress
+    {
+        private const string Prefix = "seed_";
+
+        /// <summary>The account whose password is set, so a character can be logged in.</summary>
+        private const string LoginAccount = "seed_000";
+
+        /// <summary>
+        ///     Read from Config/Bridge.cfg (`DemoDressPassword`) so a password never lands in
+        ///     source control. Absent means the account is left alone.
+        /// </summary>
+        private static string LoginPassword
+        {
+            get { return Config.Get("Bridge.DemoDressPassword", default(string)); }
+        }
+
+        /// <summary>How many condemned houses to put back into the last two decay stages.</summary>
+        private const int IdocHouses = 4;
+
+        /// <summary>
+        ///     How long after boot the second IDOC pass runs. See <see cref="PrimeIdoc"/> —
+        ///     the delay is the whole point, not a politeness.
+        /// </summary>
+        private static int IdocDelaySeconds
+        {
+            get { return Config.Get("Bridge.DemoDressIdocDelaySeconds", 150); }
+        }
+
+        // ── Name tables ────────────────────────────────────────────────────────────────
+        //
+        // Ordinary fantasy given names and English trade-sign nouns. Deliberately dull: the
+        // point is that a reader's eye passes over them, which is what a real roster does.
+
+        private static readonly string[] Given =
+        {
+            "Alaric", "Bess", "Corwin", "Dagna", "Edric", "Fenna", "Garrick", "Halle",
+            "Ivo", "Jessa", "Kellen", "Lira", "Marek", "Nessa", "Orrin", "Perrin",
+            "Quill", "Rowan", "Sera", "Tamsin", "Ulric", "Vera", "Wendel", "Xanthe",
+            "Yorick", "Zara", "Bram", "Caitrin", "Doran", "Elspeth"
+        };
+
+        private static readonly string[] Family =
+        {
+            "Ashdown", "Bellweather", "Crowe", "Dunmore", "Eastgate", "Fairbourne",
+            "Grimsby", "Hollowell", "Ironwood", "Larkspur", "Mosswick", "Thornbury"
+        };
+
+        private static readonly string[] ShopFirst =
+        {
+            "The Copper", "The Silver", "The Gilded", "The Iron", "The Rusted", "The Amber",
+            "The Quiet", "The Crooked", "The Old", "The Wandering", "The Salted", "The Ember"
+        };
+
+        private static readonly string[] ShopSecond =
+        {
+            "Anvil", "Kettle", "Lantern", "Compass", "Bellows", "Flask", "Ledger",
+            "Wagon", "Tankard", "Whetstone", "Sextant", "Coffer"
+        };
+
+        private static readonly string[] HouseNames =
+        {
+            "Ashwood Cottage", "Bramblegate", "Candlewick House", "Dovecote",
+            "Eastmarch", "Fernhollow", "Greywater", "Hearthstone",
+            "Ivyfall", "Kestrel Lodge", "Longmeadow", "Millrace",
+            "Northrest", "Oakenshaw", "Pinefall", "Quarrystone",
+            "Riverwatch", "Stonebrook", "Thistledown", "Umberley",
+            "Vinesend", "Westbarrow", "Yewcross", "Almsgate",
+            "Brightmoor", "Coldspring", "Duskvale", "Elmshade",
+            "Foxhollow", "Gravensward"
+        };
+
+        /// <summary>
+        ///     One guild to build, and how many of the seeded characters to put in it.
+        ///
+        ///     Four rather than one, and four of different sizes, because every screen that
+        ///     shows guilds shows a LIST: a board with one row proves nothing about sorting,
+        ///     member counts or the online column. The sizes are the shape a small shard
+        ///     actually has — one large guild, one middling, two small.
+        /// </summary>
+        private struct GuildPlan
+        {
+            public readonly string Name;
+            public readonly string Abbr;
+            public readonly int Size;
+
+            public GuildPlan(string name, string abbr, int size)
+            {
+                Name = name;
+                Abbr = abbr;
+                Size = size;
+            }
+        }
+
+        private static readonly GuildPlan[] GuildsToBuild =
+        {
+            new GuildPlan("The Ashen Compact", "ASH", 14),
+            new GuildPlan("Hollowell Rangers", "HOL", 9),
+            new GuildPlan("The Quiet Ledger", "QLG", 6),
+            new GuildPlan("Wardens of Northrest", "WRD", 4)
+        };
+
+        /// <summary>
+        ///     The first two guilds are allied, because `/uo/guilds` promises "rosters,
+        ///     alliances and who's online" and an alliance column that is empty on every row
+        ///     reads as a feature that does not work.
+        /// </summary>
+        private const string AllianceName = "The Northern Compact";
+
+        public static void Initialize()
+        {
+            CommandSystem.Register("demodress", AccessLevel.Administrator, Dress_OnCommand);
+
+            if (Config.Get("Bridge.DemoDressOnStart", false))
+                EventSink.ServerStarted += () => Run(null, save: true);
+        }
+
+        [Usage("demodress")]
+        [Description("Renames BridgeSeeder's synthetic world so it is presentable in screenshots.")]
+        private static void Dress_OnCommand(CommandEventArgs e)
+        {
+            Run(e.Mobile, save: false);
+        }
+
+        private static void Report(Mobile to, string text)
+        {
+            Console.WriteLine("[BridgeDemoDress] " + text);
+
+            if (to != null)
+                to.SendMessage(text);
+        }
+
+        private static void Run(Mobile to, bool save)
+        {
+            try
+            {
+                var start = DateTime.UtcNow;
+
+                int chars = DressCharacters();
+                int vendors = DressVendors();
+                int houses = DressHouses();
+
+                // After the rename, never before: the roster the bridge publishes is the one
+                // that exists when the guild's member set first changes, and that is here.
+                int guilds = BuildGuilds(to);
+
+                bool password = SetLoginPassword(to);
+
+                Report(to, String.Format(
+                    "Dressed {0} characters, {1} vendors, {2} house signs; " +
+                    "built {3} guilds; login password {4}. ({5:F1}s)",
+                    chars, vendors, houses, guilds, password ? "set" : "skipped",
+                    (DateTime.UtcNow - start).TotalSeconds));
+
+                // IDOC is two steps, and at boot the second one is LATE. See PrimeIdoc.
+                Report(to, "Primed " + PrimeIdoc() + " houses for decay.");
+
+                if (save)
+                    Timer.DelayCall(
+                        TimeSpan.FromSeconds(IdocDelaySeconds),
+                        () => Report(to, "Staged " + StageIdoc() + " houses into IDOC."));
+                else
+                    Report(to, "Staged " + StageIdoc() + " houses into IDOC.");
+
+                if (save)
+                {
+                    Report(to, "Saving world...");
+                    World.Save();
+                    Report(to, "Save complete.");
+                }
+            }
+            catch (Exception ex)
+            {
+                Report(to, "FAILED: " + ex);
+            }
+        }
+
+        /// <summary>
+        ///     A stable index for a world object, salted so that two names drawn for the SAME
+        ///     object land in unrelated places in their tables.
+        ///
+        ///     Serial is the only identifier that survives a save and is identical on every
+        ///     load, which is what makes the naming reproducible. But serials are dense and
+        ///     sequential, so a weak mix hands neighbouring objects neighbouring names. The
+        ///     first attempt derived the second word from `serial / 5`, which is constant
+        ///     across five consecutive serials — twenty-seven vendors came out as four
+        ///     Flasks, four Lanterns and three Anvils in a row. Salting and re-mixing per
+        ///     draw is what fixes that: each word is an independent hash of the pair.
+        /// </summary>
+        private static int Pick(int serial, int salt, int modulus)
+        {
+            unchecked
+            {
+                uint h = (uint)serial ^ ((uint)salt * 0x9E3779B1u);
+                h ^= h >> 15;
+                h *= 2246822519u;
+                h ^= h >> 13;
+                h *= 3266489917u;
+                h ^= h >> 16;
+                return (int)(h % (uint)modulus);
+            }
+        }
+
+        private static string PersonName(int serial)
+        {
+            return Given[Pick(serial, 1, Given.Length)] + " " + Family[Pick(serial, 2, Family.Length)];
+        }
+
+        private static string ShopSign(int serial)
+        {
+            return ShopFirst[Pick(serial, 3, ShopFirst.Length)] + " " +
+                   ShopSecond[Pick(serial, 4, ShopSecond.Length)];
+        }
+
+        private static bool LooksSeeded(string name, string marker)
+        {
+            return name != null && name.StartsWith(marker, StringComparison.OrdinalIgnoreCase);
+        }
+
+        /// <summary>
+        ///     True when a name is one this pass could have produced.
+        ///
+        ///     Dressing has to be re-runnable in both directions: a first pass renames what the
+        ///     seeder left, and a later pass — after the tables or the hash change — has to be
+        ///     able to rename its own earlier output. A name is recognised by MEMBERSHIP of the
+        ///     closed tables rather than by a marker on the object, because the object is a
+        ///     PlayerVendor whose name is a plain string with nowhere to hide a flag, and a
+        ///     name that is not in the tables was set by a person and is left alone.
+        /// </summary>
+        private static bool IsOurs(string name, string[] first, string[] second)
+        {
+            if (String.IsNullOrEmpty(name))
+                return false;
+
+            foreach (var a in first)
+            {
+                if (!name.StartsWith(a + " ", StringComparison.Ordinal))
+                    continue;
+
+                var rest = name.Substring(a.Length + 1);
+
+                foreach (var b in second)
+                {
+                    if (rest == b)
+                        return true;
+                }
+            }
+
+            return false;
+        }
+
+        private static bool IsOurHouseName(string name)
+        {
+            foreach (var h in HouseNames)
+            {
+                if (h == name)
+                    return true;
+            }
+
+            return false;
+        }
+
+        private static int DressCharacters()
+        {
+            int n = 0;
+
+            foreach (Account acct in Accounts.GetAccounts())
+            {
+                if (!acct.Username.StartsWith(Prefix, StringComparison.Ordinal))
+                    continue;
+
+                for (int i = 0; i < acct.Length; i++)
+                {
+                    var m = acct[i];
+
+                    if (m == null || !LooksSeeded(m.Name, "Seed"))
+                        continue;
+
+                    // Offset by the slot so an account's three characters are three people
+                    // rather than three spellings of one.
+                    m.Name = PersonName(m.Serial.Value + i * 101);
+                    n++;
+                }
+            }
+
+            return n;
+        }
+
+        private static int DressVendors()
+        {
+            int n = 0;
+
+            if (PlayerVendor.PlayerVendors == null)
+                return 0;
+
+            // PlayerVendors is a live collection; the rename does not add or remove members,
+            // but copy anyway so an unrelated vendor placement mid-pass cannot invalidate it.
+            var vendors = new List<PlayerVendor>(PlayerVendor.PlayerVendors);
+
+            foreach (var vendor in vendors)
+            {
+                bool touched = false;
+
+                // "Bridge Test Shop" is not the seeder's — it is left over from a hand-run
+                // smoke test — and it reaches the marketplace exactly like the rest.
+                if (LooksSeeded(vendor.ShopName, "Seed Shop") ||
+                    LooksSeeded(vendor.ShopName, "Bridge Test") ||
+                    IsOurs(vendor.ShopName, ShopFirst, ShopSecond))
+                {
+                    var sign = ShopSign(vendor.Serial.Value);
+
+                    if (sign != vendor.ShopName)
+                    {
+                        vendor.ShopName = sign;
+                        touched = true;
+                    }
+                }
+
+                if (LooksSeeded(vendor.Name, "seed vendor"))
+                {
+                    vendor.Name = PersonName(vendor.Serial.Value + 7919);
+                    touched = true;
+                }
+
+                if (touched)
+                    n++;
+            }
+
+            return n;
+        }
+
+        private static int DressHouses()
+        {
+            int n = 0;
+
+            foreach (var house in BaseHouse.AllHouses)
+            {
+                if (house.Sign == null)
+                    continue;
+
+                if (!LooksSeeded(house.Sign.Name, "Seed House") && !IsOurHouseName(house.Sign.Name))
+                    continue;
+
+                var name = HouseNames[Pick(house.Serial.Value, 5, HouseNames.Length)];
+
+                if (name == house.Sign.Name)
+                    continue;
+
+                house.Sign.Name = name;
+                n++;
+            }
+
+            return n;
+        }
+
+        /// <summary>
+        ///     The houses this run picked to walk into IDOC, held between the two passes so the
+        ///     second one moves the same houses the first one primed.
+        /// </summary>
+        private static readonly List<BaseHouse> _idocPicks = new List<BaseHouse>();
+
+        /// <summary>
+        ///     Picks the houses that will collapse and puts them at a MIDDLE decay stage.
+        ///
+        ///     Only houses that CAN decay are touched — an active owner's AutoRefresh house is
+        ///     left alone, because forcing one into IDOC would be inventing a state the game
+        ///     would never produce and the next refresh would undo it anyway.
+        ///
+        ///     WHY THE STAGING IS TWO PASSES, WITH A WAIT BETWEEN THEM
+        ///     ------------------------------------------------------
+        ///     The website's "Houses in danger" page reads a column the ingest only writes when
+        ///     the plugin reports a house CHANGING decay stage (`house.decay`). The richer
+        ///     `house.update` registry frame carries the stage as well, but the ingest
+        ///     deliberately leaves that column to the transition feed so the two cannot clobber
+        ///     each other. A house that is ALREADY in IDOC when the site connects therefore
+        ///     never appears: the plugin's baseline records IDOC as the starting state and no
+        ///     transition is ever emitted. The first run of this pass hit exactly that — the
+        ///     shard plainly had two collapsing houses and the page said none.
+        ///
+        ///     So: prime now, collapse later. The sweep takes its baseline at the middle stage
+        ///     and then sees a real move to IDOC, which is the event the page is built to show.
+        ///     The underlying asymmetry is a product observation, raised rather than patched
+        ///     from here.
+        /// </summary>
+        private static int PrimeIdoc()
+        {
+            _idocPicks.Clear();
+
+            foreach (var house in BaseHouse.AllHouses)
+            {
+                if (_idocPicks.Count >= IdocHouses)
+                    break;
+
+                if (house == null || house.Deleted || !house.CanDecay)
+                    continue;
+
+                _idocPicks.Add(house);
+            }
+
+            // Most of the world cannot decay at all: a house whose owner's account is active
+            // is AutoRefresh, and AutoRefresh reports Ageless forever. The seeder condemned
+            // its houses by backdating the owner's last login, which is the same lever a real
+            // shard pulls when somebody stops playing — so where there are not enough
+            // candidates, condemn a few more the same way rather than forcing a stage that
+            // the next refresh would undo.
+            if (_idocPicks.Count < IdocHouses)
+            {
+                foreach (var house in BaseHouse.AllHouses)
+                {
+                    if (_idocPicks.Count >= IdocHouses)
+                        break;
+
+                    if (house == null || house.Deleted || house.CanDecay || house.Owner == null)
+                        continue;
+
+                    var acct = house.Owner.Account as Account;
+
+                    // Never the account somebody is about to log in with: an inactive account
+                    // is exactly what this is making, and logging in would undo it anyway.
+                    if (acct == null || acct.Username == LoginAccount)
+                        continue;
+
+                    acct.LastLogin = DateTime.UtcNow - TimeSpan.FromDays(365);
+
+                    if (house.CanDecay)
+                        _idocPicks.Add(house);
+                }
+            }
+
+            foreach (var house in _idocPicks)
+            {
+                house.SetDynamicDecay(DecayLevel.Fairly);
+                house.NextDecayStage = DateTime.UtcNow + TimeSpan.FromHours(6);
+            }
+
+            return _idocPicks.Count;
+        }
+
+        /// <summary>Collapses the primed houses. See <see cref="PrimeIdoc"/> for the two-step.</summary>
+        private static int StageIdoc()
+        {
+            int n = 0;
+
+            foreach (var house in _idocPicks)
+            {
+                if (house == null || house.Deleted)
+                    continue;
+
+                // Alternating, so the page shows a stage column doing something rather than
+                // four identical rows.
+                house.SetDynamicDecay(n % 2 == 0 ? DecayLevel.IDOC : DecayLevel.Greatly);
+                house.NextDecayStage = DateTime.UtcNow + TimeSpan.FromHours(6);
+                n++;
+            }
+
+            return n;
+        }
+
+        /// <summary>
+        ///     Builds the guilds in <see cref="GuildsToBuild"/> out of seeded characters that
+        ///     are not in a guild already, and allies the first two.
+        ///
+        ///     Idempotent by NAME: a guild that already exists is left exactly as it is, so a
+        ///     second run adds nobody and a guild somebody has since edited in game is not
+        ///     stamped back to the table. A character already in a guild is never moved, which
+        ///     is what keeps a re-run from shuffling the world between screenshots.
+        ///
+        ///     Ranks are set rather than left at the default, because the roster the site draws
+        ///     shows a rank per member and a page where every row says the same word tells a
+        ///     reader nothing about what ranks are for. Real guilds are mostly members with a
+        ///     couple of officers, so that is what this makes.
+        /// </summary>
+        private static int BuildGuilds(Mobile to)
+        {
+            var pool = UnguildedSeedCharacters();
+            var cursor = 0;
+            var made = 0;
+
+            var built = new List<Guild>();
+
+            foreach (var plan in GuildsToBuild)
+            {
+                var existing = FindGuild(plan.Name);
+
+                if (existing != null)
+                {
+                    built.Add(existing);
+                    continue;
+                }
+
+                if (cursor >= pool.Count)
+                {
+                    Report(to, "Ran out of unguilded characters — " + plan.Name + " not built.");
+                    break;
+                }
+
+                var leader = pool[cursor++];
+                var guild = new Guild(leader, plan.Name, plan.Abbr);
+
+                for (int i = 1; i < plan.Size && cursor < pool.Count; i++)
+                {
+                    var member = pool[cursor++];
+                    guild.AddMember(member);
+
+                    var pm = member as PlayerMobile;
+
+                    if (pm == null)
+                        continue;
+
+                    // Two officers per guild, then members. RankDefinition.Ranks is
+                    // { Ronin, Member, Emissary, Warlord, Leader } — Ronin is the default a
+                    // fresh member gets, and a board of Ronins looks like nobody has ever
+                    // touched the guild.
+                    pm.GuildRank =
+                        i == 1 ? RankDefinition.Ranks[3] :
+                        i == 2 ? RankDefinition.Ranks[2] :
+                        RankDefinition.Member;
+                }
+
+                built.Add(guild);
+                made++;
+            }
+
+            if (built.Count >= 2 && built[0].Alliance == null && built[1].Alliance == null)
+            {
+                try
+                {
+                    var alliance = new AllianceInfo(built[0], AllianceName, built[1]);
+                    alliance.TurnToMember(built[1]);
+                }
+                catch (Exception ex)
+                {
+                    Report(to, "Alliance not formed: " + ex.Message);
+                }
+            }
+
+            return made;
+        }
+
+        /// <summary>
+        ///     Every seeded character with no guild, in a stable order: account name, then
+        ///     character slot. Stable ordering is what makes the same person lead the same
+        ///     guild on every run against the same save.
+        /// </summary>
+        private static List<Mobile> UnguildedSeedCharacters()
+        {
+            var accounts = new List<Account>();
+
+            foreach (Account acct in Accounts.GetAccounts())
+            {
+                if (acct.Username.StartsWith(Prefix, StringComparison.Ordinal))
+                    accounts.Add(acct);
+            }
+
+            accounts.Sort((a, b) => String.CompareOrdinal(a.Username, b.Username));
+
+            var chars = new List<Mobile>();
+
+            foreach (var acct in accounts)
+            {
+                for (int i = 0; i < acct.Length; i++)
+                {
+                    var m = acct[i];
+
+                    if (m == null || m.Deleted || m.Guild != null)
+                        continue;
+
+                    chars.Add(m);
+                }
+            }
+
+            return chars;
+        }
+
+        private static Guild FindGuild(string name)
+        {
+            foreach (var bg in BaseGuild.List.Values)
+            {
+                var g = bg as Guild;
+
+                if (g != null && !g.Disbanded && g.Name == name)
+                    return g;
+            }
+
+            return null;
+        }
+
+        /// <summary>
+        ///     Sets a known password on one seeded account so a character can be logged in with
+        ///     a real client. The seeder assigns a random GUID, which nobody kept.
+        /// </summary>
+        private static bool SetLoginPassword(Mobile to)
+        {
+            var password = LoginPassword;
+
+            if (String.IsNullOrEmpty(password))
+                return false;
+
+            var acct = Accounts.GetAccount(LoginAccount) as Account;
+
+            if (acct == null)
+            {
+                Report(to, "No account " + LoginAccount + " — password not set.");
+                return false;
+            }
+
+            acct.SetPassword(password);
+
+            // The seeder backdates some accounts past InactiveDuration to condemn their
+            // houses. This one has to be able to log in, so bring it back to the present.
+            acct.LastLogin = DateTime.UtcNow;
+
+            return true;
+        }
+    }
+}

tools/scaffolding/BridgeProtocol5Probe.cs

@@ -0,0 +1,275 @@
+using System;
+using System.Collections.Generic;
+
+using Server.Accounting;
+using Server.Commands;
+using Server.Mobiles;
+using Server.Multis;
+using Server.Network;
+
+namespace Server.Custom
+{
+    /// <summary>
+    ///     Exercises all three Protocol 5 enrichments on a live shard, without a game client.
+    ///
+    ///     Each of the three needs something a unit test cannot produce, and each needs it for a
+    ///     different reason:
+    ///
+    ///       * house.decay's `schedule` is only interesting ACROSS a transition, and the interesting
+    ///         pair is Greatly -> IDOC: the first must carry no estimatedCollapse (under dynamic
+    ///         decay the remaining stages have not been drawn yet) and the second must carry one.
+    ///         A fixture can assert the mapping; only a real BaseHouse walking a real
+    ///         SetDynamicDecay proves the emitter reads ServUO the way the comment claims.
+    ///       * vendor.listing's `fees` are computed from PlayerVendor state that differs between
+    ///         ServUO's two vendor systems. This reports what the shard actually holds so the
+    ///         emitted frame can be checked against it rather than against an assumption.
+    ///       * account.login.result is the one that could not be built at all before v5, because
+    ///         EventSink.AccountLogin fires BEFORE the verdict exists. Invoking the real sink with a
+    ///         real password (right and wrong) runs the shard's own AccountHandler, which is what
+    ///         sets Accepted/RejectReason -- so this proves the deferred read sees the FINAL verdict
+    ///         and not the constructor's default of true.
+    ///
+    ///     Test scaffolding. Never deployed; `deploy.ps1` copies only `overlay/`.
+    ///     In game / at the console: `[p5probe`.
+    /// </summary>
+    public static class BridgeProtocol5Probe
+    {
+        public static void Initialize()
+        {
+            CommandSystem.Register("p5probe", AccessLevel.Administrator, Probe_OnCommand);
+
+            if (Config.Get("Bridge.Protocol5ProbeOnStart", false))
+                EventSink.ServerStarted += () => Timer.DelayCall(TimeSpan.FromSeconds(8.0), () => Run(null));
+        }
+
+        [Usage("p5probe")]
+        [Description("Drives the three Protocol 5 enrichments so their frames can be observed.")]
+        private static void Probe_OnCommand(CommandEventArgs e)
+        {
+            Run(e.Mobile);
+        }
+
+        private static void Report(Mobile to, string line)
+        {
+            Console.WriteLine("[P5Probe] " + line);
+
+            if (to != null)
+                to.SendMessage(line);
+        }
+
+        private static void Run(Mobile to)
+        {
+            try
+            {
+                ReportVendorFees(to);
+                DriveLogins(to);
+                WalkHouseToIdoc(to);
+            }
+            catch (Exception ex)
+            {
+                Report(to, "threw: " + ex);
+            }
+        }
+
+        // ---- (a) house.decay schedule ----
+
+        /// <summary>
+        ///     Walks one house Greatly, then (after a pause long enough for a decay sweep to run)
+        ///     IDOC. Two frames, and the PAIR is the assertion: no estimatedCollapse on the first,
+        ///     one on the second.
+        /// </summary>
+        private static void WalkHouseToIdoc(Mobile to)
+        {
+            BaseHouse target = null;
+            var byType = new Dictionary<string, int>();
+
+            foreach (var h in BaseHouse.AllHouses)
+            {
+                if (h == null || h.Deleted || h.Owner == null)
+                    continue;
+
+                var type = h.DecayType.ToString();
+                byType[type] = (byType.ContainsKey(type) ? byType[type] : 0) + 1;
+
+                // CanDecay is the filter that matters, and getting it wrong is silent. A house
+                // whose DecayType is AutoRefresh or Ageless -- and the owner's NEWEST house is
+                // always AutoRefresh -- has a DecayLevel getter that calls ResetDynamicDecay() and
+                // reports Ageless, so a forced SetDynamicDecay is wiped on the very next read. The
+                // sweep then sees no change and emits nothing at all, which looks exactly like a
+                // broken emitter.
+                if (!h.CanDecay)
+                    continue;
+
+                // The current level does NOT disqualify a house. On this rig every decaying house
+                // is already at IDOC (a seeded world has only a couple of Condemned houses and they
+                // have long since bottomed out), so the walk starts by putting one BACK to Fairly.
+                // BridgeDemoDress.PrimeIdoc does the same thing for the same reason.
+                target = h;
+                break;
+            }
+
+            foreach (var kv in byType)
+                Report(to, "houses by DecayType: " + kv.Key + "=" + kv.Value);
+
+            if (target == null)
+            {
+                Report(to, "no walkable house found (none with CanDecay below IDOC)");
+                return;
+            }
+
+            Report(to, string.Format(
+                "walking house 0x{0:X} owner={1} decayType={2} from {3}; dynamicDecay={4}",
+                target.Serial.Value,
+                target.Owner == null ? "?" : target.Owner.Name,
+                target.DecayType,
+                target.DecayLevel,
+                DynamicDecay.Enabled));
+
+            // Each step needs its own sweep to land, or the sweep sees one net change and emits a
+            // single frame -- which would collapse the whole point, since the assertion is the
+            // DIFFERENCE between the Greatly frame and the IDOC one.
+            var step = TimeSpan.FromSeconds(Math.Max(4, BridgeConfigSeconds()) * 2 + 4);
+
+            Step(to, target, DecayLevel.Fairly, TimeSpan.Zero, "reset (no estimatedCollapse expected)");
+            Step(to, target, DecayLevel.Greatly, step, "expect schedule WITHOUT estimatedCollapse");
+            Step(to, target, DecayLevel.IDOC, TimeSpan.FromTicks(step.Ticks * 2), "expect schedule WITH estimatedCollapse");
+        }
+
+        private static void Step(Mobile to, BaseHouse house, DecayLevel level, TimeSpan after, string note)
+        {
+            Action go = () =>
+            {
+                if (house.Deleted)
+                    return;
+
+                Report(to, string.Format("house 0x{0:X} -> {1} ({2})", house.Serial.Value, level, note));
+                house.SetDynamicDecay(level);
+            };
+
+            if (after <= TimeSpan.Zero)
+                go();
+            else
+                Timer.DelayCall(after, () => go());
+        }
+
+        /// <summary>The decay sweep interval, read the same way the bridge reads it.</summary>
+        private static int BridgeConfigSeconds()
+        {
+            return Config.Get("Bridge.DecaySweepSeconds", 60);
+        }
+
+        // ---- (b) vendor.listing fees ----
+
+        /// <summary>
+        ///     Prints the fee state of the first few player vendors straight off the PlayerVendor
+        ///     objects, so the emitted `fees` block can be compared against the shard's own numbers
+        ///     rather than against what the emitter believes them to be.
+        /// </summary>
+        private static void ReportVendorFees(Mobile to)
+        {
+            bool newSystem = BaseHouse.NewVendorSystem;
+            int shown = 0;
+
+            Report(to, "NewVendorSystem=" + newSystem);
+
+            foreach (var m in World.Mobiles.Values)
+            {
+                var v = m as PlayerVendor;
+
+                if (v == null || v.Deleted)
+                    continue;
+
+                int charge = newSystem ? v.ChargePerRealWorldDay : v.ChargePerDay;
+                int funds = newSystem ? v.HoldGold : v.BankAccount + v.HoldGold;
+                var acct = v.Owner == null ? null : v.Owner.Account as Account;
+
+                Report(to, string.Format(
+                    "vendor 0x{0:X} owner={1} acct={2} commission={3} charge={4} funds={5} periods={6} nextPay={7:o}",
+                    v.Serial.Value,
+                    v.Owner == null ? "?" : v.Owner.Name,
+                    acct == null ? "<none>" : acct.Username,
+                    v.IsCommission,
+                    charge,
+                    funds,
+                    charge > 0 ? (funds / charge).ToString() : "n/a",
+                    v.NextPayTime.ToUniversalTime()));
+
+                if (++shown >= 3)
+                    break;
+            }
+
+            if (shown == 0)
+                Report(to, "no player vendors in the world");
+        }
+
+        // ---- (c) account.login.result ----
+
+        /// <summary>
+        ///     Fires the real EventSink.AccountLogin twice against a real account: once with a
+        ///     deliberately wrong password and once with the right one.
+        ///
+        ///     The shard's own AccountHandler is what decides, and it decides AFTER our handler has
+        ///     returned. So a correct implementation emits `accepted:false reason:BadPass` for the
+        ///     first and `accepted:true` for the second. An implementation that read the verdict
+        ///     inside the handler would emit `accepted:true` for BOTH -- which is precisely the bug
+        ///     this kind exists to make impossible, and precisely what this probe would show.
+        ///
+        ///     The password is read from config, never compiled in. `Bridge.Protocol5ProbeAccount`
+        ///     and `Bridge.Protocol5ProbePassword`; with no password configured only the failing
+        ///     half runs, which is still the half that matters.
+        /// </summary>
+        private static void DriveLogins(Mobile to)
+        {
+            var username = Config.Get("Bridge.Protocol5ProbeAccount", (string)null);
+
+            if (String.IsNullOrEmpty(username))
+            {
+                Report(to, "no Bridge.Protocol5ProbeAccount configured; skipping the login probe");
+                return;
+            }
+
+            var password = Config.Get("Bridge.Protocol5ProbePassword", (string)null);
+
+            // Accounts store a hash, so the rig cannot READ a password to log in with -- it has to
+            // set one. Same posture as BridgeDemoDress, which does this for the same reason: the
+            // value comes from config and is never compiled in or logged.
+            if (!String.IsNullOrEmpty(password))
+            {
+                var acct = Accounts.GetAccount(username) as Account;
+
+                if (acct == null)
+                {
+                    Report(to, "account '" + username + "' does not exist; skipping the login probe");
+                    return;
+                }
+
+                acct.SetPassword(password);
+                Report(to, "set a known password on '" + username + "' for the accepted half");
+            }
+
+            Report(to, "login probe: '" + username + "' with a WRONG password (expect accepted:false)");
+            Fire(username, "definitely-not-the-password-" + Guid.NewGuid().ToString("N"));
+
+            if (String.IsNullOrEmpty(password))
+            {
+                Report(to, "no Bridge.Protocol5ProbePassword configured; skipping the accepted half");
+                return;
+            }
+
+            // Spaced out so the two results are unambiguous in the sidecar's history.
+            Timer.DelayCall(TimeSpan.FromSeconds(3.0), () =>
+            {
+                Report(to, "login probe: '" + username + "' with the RIGHT password (expect accepted:true)");
+                Fire(username, password);
+            });
+        }
+
+        private static void Fire(string username, string password)
+        {
+            // A null NetState is deliberate and is itself part of the test: the real emitter reads
+            // the address defensively because AccountLogin_ReplyRej disposes the state before the
+            // deferred read runs, so it must already survive not having one.
+            EventSink.InvokeAccountLogin(new AccountLoginEventArgs(null, username, password));
+        }
+    }
+}

tools/scaffolding/BridgeRigDriver.cs

@@ -0,0 +1,486 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+
+using Server.Accounting;
+using Server.Commands;
+using Server.Engines.CityLoyalty;
+using Server.Mobiles;
+using Server.Multis;
+
+namespace Server.Custom
+{
+    /// <summary>
+    ///     Drives the shard from OUTSIDE the game, one verb per line in a file the driver polls.
+    ///
+    ///     Every other probe here runs a fixed script at boot or from `[command`, and both are the
+    ///     wrong shape for an acceptance walk: a walk asserts what happened BETWEEN two steps
+    ///     ("one mail, then nothing for a day"), so the steps have to be separated by the observer
+    ///     rather than by a hard-coded delay -- and ServUO's console reads a fixed verb set
+    ///     (`Scripts/Misc/ConsoleCommands.cs`), so `[p5probe` cannot be typed at a headless shard
+    ///     at all. A file is the one channel a headless shard already has.
+    ///
+    ///     Write one or more lines to `Config/rigcmd.txt`; the driver runs them on the Core thread
+    ///     within a second, prints `[RigDriver]` lines, and TRUNCATES the file so the next write is
+    ///     the next command. Output is console-only: nothing here emits, and everything observed
+    ///     travels the real bridge.
+    ///
+    ///     Verbs:
+    ///       decaylist                        houses that CAN decay, with owner account and stage
+    ///       decay &lt;serial|any&gt; &lt;stage&gt;       force a decay stage (LikeNew|Slightly|Somewhat|
+    ///                                        Fairly|Greatly|IDOC|Collapsed)
+    ///       vendorlist                       player vendors, with owner account and next pay time
+    ///       vendorfunds &lt;serial&gt; &lt;gold&gt;      set a vendor's held gold (drives periodsRemaining)
+    ///       citylist                         cities, governors and election phases
+    ///       governor &lt;city&gt; &lt;mobile|none&gt;    seat a governor (a mobile serial, or a player's name)
+    ///       election &lt;city&gt;                  force a new election into its nomination window
+    ///       activate &lt;account&gt;               clear an account's inactivity, so its houses stop
+    ///                                        being Condemned and CAN be refreshed
+    ///       password &lt;account&gt; &lt;pw&gt;        set a game account's password (for a login probe)
+    ///       save                             a world save
+    ///       shutdown                         a CLEAN shutdown, so the bridge emits server.shutdown
+    ///
+    ///     Test scaffolding. Never deployed; `deploy.ps1` copies only `overlay/`.
+    /// </summary>
+    public static class BridgeRigDriver
+    {
+        private static string _path;
+        private static DateTime _lastWrite = DateTime.MinValue;
+
+        public static void Initialize()
+        {
+            if (!Config.Get("Bridge.RigDriverEnabled", false))
+                return;
+
+            _path = Path.Combine(Core.BaseDirectory, "Config", "rigcmd.txt");
+
+            CommandSystem.Register("rigdriver", AccessLevel.Administrator, e => Poll());
+
+            Console.WriteLine("[RigDriver] watching {0}", _path);
+            Timer.DelayCall(TimeSpan.FromSeconds(2.0), TimeSpan.FromSeconds(1.0), Poll);
+        }
+
+        // ---- the poll ----
+
+        private static void Poll()
+        {
+            try
+            {
+                if (!File.Exists(_path))
+                    return;
+
+                // Written-and-not-finished is a real case: the observer writes with a shell
+                // redirect while this timer fires. An empty file is nothing to do, and the
+                // timestamp guard keeps a slow write from being run twice.
+                var stamp = File.GetLastWriteTimeUtc(_path);
+                if (stamp <= _lastWrite)
+                    return;
+
+                var lines = File.ReadAllLines(_path);
+                if (lines.Length == 0)
+                    return;
+
+                _lastWrite = stamp;
+                File.WriteAllText(_path, String.Empty);
+
+                foreach (var line in lines)
+                {
+                    var trimmed = (line ?? String.Empty).Trim();
+                    if (trimmed.Length == 0 || trimmed.StartsWith("#"))
+                        continue;
+
+                    try
+                    {
+                        Run(trimmed);
+                    }
+                    catch (Exception ex)
+                    {
+                        Say("\"" + trimmed + "\" threw: " + ex.Message);
+                    }
+                }
+
+                Say("done");
+            }
+            catch (IOException)
+            {
+                // The writer still holds it. Next tick.
+            }
+            catch (Exception ex)
+            {
+                Say("poll threw: " + ex.Message);
+            }
+        }
+
+        private static void Say(string line)
+        {
+            Console.WriteLine("[RigDriver] " + line);
+        }
+
+        private static void Run(string line)
+        {
+            var parts = line.Split(new[] { ' ' }, StringSplitOptions.RemoveEmptyEntries);
+            var verb = parts[0].ToLowerInvariant();
+
+            switch (verb)
+            {
+                case "decaylist": DecayList(); break;
+                case "decay": Decay(Arg(parts, 1), Arg(parts, 2)); break;
+                case "vendorlist": VendorList(); break;
+                case "vendorfunds": VendorFunds(Arg(parts, 1), Arg(parts, 2)); break;
+                case "citylist": CityList(); break;
+                case "governor": Governor(Arg(parts, 1), Arg(parts, 2)); break;
+                case "election": Election(Arg(parts, 1)); break;
+                case "activate": Activate(Arg(parts, 1)); break;
+                case "password": Password(Arg(parts, 1), Arg(parts, 2)); break;
+                case "save": Say("saving"); Misc.AutoSave.Save(); break;
+                // A clean shutdown, which is the only kind that EMITS. `Stop-Process` drops the
+                // socket and the shard says nothing, so a killed shard is indistinguishable from
+                // a wedged one -- and `uo.server.down` never fires. Core.Kill runs
+                // EventSink.Shutdown, which is what BridgeBoot listens on.
+                case "shutdown": Say("shutting down"); Timer.DelayCall(TimeSpan.Zero, () => Core.Kill(false)); break;
+                default: Say("unknown verb \"" + verb + "\""); break;
+            }
+        }
+
+        private static string Arg(string[] parts, int i)
+        {
+            return i < parts.Length ? parts[i] : null;
+        }
+
+        // ---- houses ----
+
+        /// <summary>
+        ///     `CanDecay` is the filter, and getting it wrong is silent: an AutoRefresh house --
+        ///     and the owner's newest house is always AutoRefresh -- has a DecayLevel getter that
+        ///     calls ResetDynamicDecay(), so a forced stage is wiped before the sweep reads it and
+        ///     NOTHING is emitted. That looks exactly like a broken emitter.
+        /// </summary>
+        private static IEnumerable<BaseHouse> Decayable()
+        {
+            return BaseHouse.AllHouses
+                .Where(h => h != null && !h.Deleted && h.Owner != null && h.CanDecay);
+        }
+
+        private static void DecayList()
+        {
+            foreach (var h in Decayable())
+            {
+                var acct = h.Owner.Account == null ? "-" : h.Owner.Account.Username;
+                Say(String.Format(
+                    "house 0x{0:X} owner={1} acct={2} name=\"{3}\" region={4} type={5} level={6}",
+                    h.Serial.Value, h.Owner.Name, acct, HouseName(h), RegionName(h),
+                    h.DecayType, h.DecayLevel));
+            }
+
+            Say("decayable=" + Decayable().Count());
+        }
+
+        private static string HouseName(BaseHouse h)
+        {
+            return h.Sign != null && h.Sign.Name != null ? h.Sign.Name : String.Empty;
+        }
+
+        private static string RegionName(BaseHouse h)
+        {
+            var r = Region.Find(h.Location, h.Map);
+            return r == null ? "-" : r.Name ?? "-";
+        }
+
+        private static void Decay(string which, string stage)
+        {
+            DecayLevel level;
+            if (!TryParseStage(stage, out level))
+            {
+                Say("unknown stage \"" + stage + "\"");
+                return;
+            }
+
+            BaseHouse house = null;
+
+            if (String.IsNullOrEmpty(which) || which == "any")
+                house = Decayable().FirstOrDefault();
+            else
+            {
+                var serial = ParseSerial(which);
+                house = Decayable().FirstOrDefault(h => h.Serial.Value == serial);
+            }
+
+            if (house == null)
+            {
+                Say("no decayable house matched \"" + which + "\"");
+                return;
+            }
+
+            var from = house.DecayLevel;
+
+            // A refresh is what a player does at the sign, and it is NOT SetDynamicDecay: the
+            // level is derived from LastRefreshed, so a "LikeNew" that only rewrote the dynamic
+            // stage would be undone by the next read.
+            if (level == DecayLevel.LikeNew)
+                house.RefreshDecay();
+            else
+                house.SetDynamicDecay(level);
+
+            Say(String.Format(
+                "house 0x{0:X} {1} -> {2} (now {3})",
+                house.Serial.Value, from, level, house.DecayLevel));
+        }
+
+        private static bool TryParseStage(string s, out DecayLevel level)
+        {
+            level = DecayLevel.Ageless;
+            if (String.IsNullOrEmpty(s))
+                return false;
+
+            foreach (DecayLevel candidate in Enum.GetValues(typeof(DecayLevel)))
+            {
+                if (String.Equals(candidate.ToString(), s, StringComparison.OrdinalIgnoreCase))
+                {
+                    level = candidate;
+                    return true;
+                }
+            }
+
+            return false;
+        }
+
+        private static int ParseSerial(string s)
+        {
+            var text = s.StartsWith("0x", StringComparison.OrdinalIgnoreCase) ? s.Substring(2) : s;
+            int parsed;
+
+            if (Int32.TryParse(text, NumberStyles.HexNumber, CultureInfo.InvariantCulture, out parsed))
+                return parsed;
+
+            return Int32.TryParse(s, out parsed) ? parsed : 0;
+        }
+
+        // ---- vendors ----
+
+        private static IEnumerable<PlayerVendor> Vendors()
+        {
+            return World.Mobiles.Values.OfType<PlayerVendor>().Where(v => !v.Deleted);
+        }
+
+        private static void VendorList()
+        {
+            Say("NewVendorSystem=" + BaseHouse.NewVendorSystem);
+
+            foreach (var v in Vendors())
+            {
+                var owner = v.Owner;
+                var acct = owner == null || owner.Account == null ? "-" : owner.Account.Username;
+                Say(String.Format(
+                    "vendor 0x{0:X} shop=\"{1}\" owner={2} acct={3} hold={4} charge={5} nextPay={6}",
+                    v.Serial.Value, v.ShopName, owner == null ? "-" : owner.Name, acct,
+                    v.HoldGold, v.ChargePerDay, v.NextPayTime.ToUniversalTime().ToString("o")));
+            }
+
+            Say("vendors=" + Vendors().Count());
+        }
+
+        /// <summary>
+        ///     Set a vendor's held gold, which is the only knob that walks it toward dismissal
+        ///     without waiting a pay period -- `NextPayTime` has a private setter, and a period is
+        ///     a real day on the new vendor system and a UO day (~2 real hours) on the old one.
+        ///     The emitter computes `periodsRemaining` as funds / chargePerPeriod, so this moves
+        ///     exactly the field the threshold tracker watches.
+        /// </summary>
+        private static void VendorFunds(string which, string gold)
+        {
+            var serial = ParseSerial(which ?? String.Empty);
+            var vendor = Vendors().FirstOrDefault(v => v.Serial.Value == serial);
+
+            if (vendor == null)
+            {
+                Say("no vendor matched \"" + which + "\"");
+                return;
+            }
+
+            int funds;
+            if (!Int32.TryParse(gold, out funds))
+            {
+                Say("bad gold \"" + gold + "\"");
+                return;
+            }
+
+            // Both, because the old vendor system spends BankAccount + HoldGold and the new one
+            // spends HoldGold alone -- setting one would leave the other paying the charge.
+            vendor.HoldGold = funds;
+            vendor.BankAccount = 0;
+
+            var charge = BaseHouse.NewVendorSystem ? vendor.ChargePerRealWorldDay : vendor.ChargePerDay;
+            Say(String.Format(
+                "vendor 0x{0:X} hold={1} bank=0 charge={2} periodsRemaining={3}",
+                vendor.Serial.Value, vendor.HoldGold, charge, charge > 0 ? funds / charge : -1));
+        }
+
+        // ---- accounts ----
+
+        /// <summary>
+        ///     Mark an account as having just logged in.
+        ///
+        ///     This is the ONLY way to walk a decaying house back out of danger on a seeded
+        ///     world, and the reason is ServUO's, not the rig's: every house that CAN decay here
+        ///     is `DecayType.Condemned` (the seeder backdates accounts past
+        ///     `Account.InactiveDuration` precisely to make them decay), and
+        ///     `BaseHouse.RefreshDecay()` returns false immediately for a Condemned house. A
+        ///     condemned house is not refreshable by anyone; it is rescued by its OWNER LOGGING
+        ///     IN, which is what this reproduces.
+        ///
+        ///     What the shard then reports depends on how many houses the owner has:
+        ///     `AutoRefresh` (their newest) stops decaying and reads **Ageless**, while an older
+        ///     `ManualRefresh` one is back on the clock and reads **LikeNew**. Both are "out of
+        ///     danger", and a mapper that reads only one of them misses most rescues.
+        /// </summary>
+        private static void Activate(string username)
+        {
+            var acct = Accounts.GetAccount(username) as Account;
+
+            if (acct == null)
+            {
+                Say("no account \"" + username + "\"");
+                return;
+            }
+
+            acct.LastLogin = DateTime.UtcNow;
+            Say(String.Format("account {0} lastLogin=now inactive={1}", acct.Username, acct.Inactive));
+
+            foreach (var h in BaseHouse.AllHouses)
+            {
+                if (h == null || h.Deleted || h.Owner == null || h.Owner.Account != acct)
+                    continue;
+
+                Say(String.Format(
+                    "  house 0x{0:X} type={1} level={2}", h.Serial.Value, h.DecayType, h.DecayLevel));
+            }
+        }
+
+        /// <summary>
+        ///     Set a game account's password, so a login can be driven over a real socket.
+        ///
+        ///     The socket is not optional for the ACCEPTED half: ServUO's own AccountHandler calls
+        ///     `acct.HasAccess(e.State)` before it ever checks the password, and a null NetState
+        ///     fails that -- so an in-process probe reports "access denied" for a correct password
+        ///     and can never produce `accepted:true`.
+        /// </summary>
+        private static void Password(string username, string pw)
+        {
+            var acct = Accounts.GetAccount(username) as Account;
+
+            if (acct == null)
+            {
+                Say("no account \"" + username + "\"");
+                return;
+            }
+
+            if (String.IsNullOrEmpty(pw))
+            {
+                Say("refusing to set an empty password");
+                return;
+            }
+
+            acct.SetPassword(pw);
+            Say("account " + acct.Username + " password set");
+        }
+
+        // ---- cities ----
+
+        private static void CityList()
+        {
+            Say("CityLoyaltySystem.Enabled=" + CityLoyaltySystem.Enabled);
+
+            foreach (var city in CityLoyaltySystem.Cities)
+            {
+                if (city == null)
+                    continue;
+
+                var e = city.Election;
+                Say(String.Format(
+                    "city={0} governor={1} elect={2} election={3} candidates={4} autoPick={5}",
+                    city.City,
+                    city.Governor == null ? "-" : city.Governor.Name + "/0x" + city.Governor.Serial.Value.ToString("X"),
+                    city.GovernorElect == null ? "-" : city.GovernorElect.Name,
+                    e == null ? "-" : (e.CanNominate() ? "nominate" : e.CanVote() ? "vote" : e.Ongoing ? "pending" : "none"),
+                    e == null || e.Candidates == null ? 0 : e.Candidates.Count,
+                    e == null ? "-" : e.AutoPickGovernor.ToUniversalTime().ToString("o")));
+            }
+        }
+
+        private static CityLoyaltySystem FindCity(string name)
+        {
+            return CityLoyaltySystem.Cities.FirstOrDefault(
+                c => c != null && String.Equals(c.City.ToString(), name, StringComparison.OrdinalIgnoreCase));
+        }
+
+        private static void Governor(string cityName, string who)
+        {
+            var city = FindCity(cityName);
+            if (city == null)
+            {
+                Say("no city \"" + cityName + "\"");
+                return;
+            }
+
+            if (String.Equals(who, "none", StringComparison.OrdinalIgnoreCase))
+            {
+                city.Governor = null;
+                Say("city=" + city.City + " governor cleared");
+                return;
+            }
+
+            var mob = FindMobile(who);
+            if (mob == null)
+            {
+                Say("no player matched \"" + who + "\"");
+                return;
+            }
+
+            city.Governor = mob;
+            var acct = mob.Account == null ? "-" : mob.Account.Username;
+            Say(String.Format(
+                "city={0} governor={1} 0x{2:X} acct={3}",
+                city.City, mob.Name, mob.Serial.Value, acct));
+        }
+
+        private static Mobile FindMobile(string who)
+        {
+            var serial = ParseSerial(who);
+
+            if (serial != 0)
+            {
+                var bySerial = World.FindMobile(serial);
+                if (bySerial != null)
+                    return bySerial;
+            }
+
+            return World.Mobiles.Values.OfType<PlayerMobile>()
+                .FirstOrDefault(m => !m.Deleted && String.Equals(m.Name, who, StringComparison.OrdinalIgnoreCase));
+        }
+
+        private static void Election(string cityName)
+        {
+            var city = FindCity(cityName);
+            if (city == null)
+            {
+                Say("no city \"" + cityName + "\"");
+                return;
+            }
+
+            if (city.Election == null)
+            {
+                Say("city=" + city.City + " has no election object");
+                return;
+            }
+
+            city.Election.StartNewElection();
+            Say(String.Format(
+                "city={0} election restarted; autoPick={1} nominate={2}",
+                city.City,
+                city.Election.AutoPickGovernor.ToUniversalTime().ToString("o"),
+                city.Election.CanNominate()));
+        }
+    }
+}

tools/scaffolding/README.md

@@ -13,6 +13,9 @@ These two scripts produced the measured budget in [PLAN.md](https://gitea.whitlo
 | `BridgeLinkProbe.cs` | `Scripts/Custom/BridgeLinkProbe.cs` | Triggers `[link` for seed_001 without a client, then saves so the `WebsiteUserId` tag reaches `accounts.xml`. Flag: `LinkProbeOnStart`. Pair with a sidecar that reads the code and sends `link.confirm`. |
 | `BridgeCrierProbe.cs` | `Scripts/Custom/BridgeCrierProbe.cs` | Logs the global town-crier entry list every 3s so `towncrier.add` / `remove` can be seen landing in game state. Flag: `CrierProbeOnStart`. |
 | `BridgeVendorSaleProbe.cs` | `Scripts/Custom/BridgeVendorSaleProbe.cs` | Fires `PlayerVendorSale` (Phase 7) with real seeded-vendor data so `vendor.sale` can be verified without a live buy. Requires the Phase 7 patches applied. Flag: `VendorSaleProbeOnStart`. |
+| `BridgeDemoDress.cs` | `Scripts/Custom/BridgeDemoDress.cs` | Renames a seeded world so it is presentable in a screenshot: shop signs, vendor and character names, house signs. Also stages a few condemned houses back into IDOC, and sets a known password on `seed_000` so a character can be logged in. Flags: `DemoDressOnStart`, `DemoDressPassword`. In game: `[demodress`. |
+| `BridgeRigDriver.cs` | `Scripts/Custom/BridgeRigDriver.cs` | Drives the shard from OUTSIDE the game, one verb per line in `Config/rigcmd.txt`, which the driver polls and truncates. Written for the engagement Phase 11b acceptance walk, where each step's assertion is what happened BETWEEN two steps, so the steps have to be separated by the observer rather than by a hard-coded delay -- and ServUO's console takes a fixed verb set (`Scripts/Misc/ConsoleCommands.cs`), so `[p5probe` cannot be typed at a headless shard at all. Verbs: `decaylist`, `decay`, `vendorlist`, `vendorfunds`, `citylist`, `governor`, `election`, `activate`, `password`, `save`, `shutdown`. Flag: `RigDriverEnabled`. **Sets passwords and mutates the world.** |
+| `BridgeProtocol5Probe.cs` | `Scripts/Custom/BridgeProtocol5Probe.cs` | Drives all three Protocol 5 enrichments so their frames can be observed: walks one house Fairly -> Greatly -> IDOC (the PAIR is the assertion -- `estimatedCollapse` must appear only on the IDOC frame), reports each player vendor's fee state straight off the `PlayerVendor` so the emitted `fees` block can be checked against the shard's own numbers, and fires `EventSink.AccountLogin`. Flags: `Protocol5ProbeOnStart`, `Protocol5ProbeAccount`, `Protocol5ProbePassword`. In game: `[p5probe`. **Sets a password on the named account.** |
 
 ## Deploy overwrites Bridge.cfg
 
@@ -34,6 +37,41 @@ Because `Config.Get` returns `false` for a missing key, a server whose `Bridge.c
 
 In-game, `[seedworld` and `[unseedworld` (Administrator) do the same work on a live shard.
 
+## Dressing a seeded world for screenshots
+
+`BridgeSeeder` builds a world at realistic **scale**, which is all the bridge ever needed. It does not
+build one that looks like anything: a vendor is `seed vendor` trading as `Seed Shop 810`, a character
+is `Seed004A`, a house sign says `Seed House 12`. Those strings travel the whole bridge and land on
+the marketplace, the guild roster and the housing pages of the website — fine for a protocol test,
+wrong for a screenshot.
+
+`BridgeDemoDress.cs` renames them in place. It seeds nothing: prices, listing counts, decay stages,
+fame and skills stay exactly as the seeder left them and as the shard has moved them since, so the
+data keeps its provenance and only the strings a human reads change. Names are drawn from fixed
+tables by a hash of each object's serial, so a re-run reproduces the same world, and shop and house
+names are re-dressed when they are names the pass itself produced — so a change to the tables can be
+applied to a world that has already been through here.
+
+```ini
+DemoDressOnStart=True
+DemoDressPassword=<a password you choose>
+```
+
+Boot once, then set `DemoDressOnStart=False`. The password is written to `seed_000` so a real client
+can log a character in — the only way to make the website's online roster non-empty — and it is read
+from the config rather than compiled in, so it never lands in source control.
+
+**It dresses seeded objects only, which means your own characters keep their names.** That is the
+right behaviour for a test shard and a thing to remember before pointing a camera at one: a dev
+world usually also holds the accounts, characters, guilds and houses of whoever built it, and those
+are real identifiers on a page that may end up public.
+
+**The sidecar's board is cached, so the website lags a rename.** A shop name reaches the site on the
+next market sweep, and a sweep advances `MarketSweepBatch` vendors per tick — 27 vendors at the
+defaults is two ticks. Allow a couple of minutes before concluding that a rename failed. This cost a
+debugging detour once: the shard had the new names all along and the sidecar was still serving the
+previous ones.
+
 ## Back up `Saves/` first
 
 `[seedworld` and `SeedOnStart` **write to the live world**. Copy `Saves/` somewhere outside the repo before running either. `Backups/Automatic` is rotated by `AutoSave.cs` and `Backups/Temp` is deleted outright, so neither is a safe destination.
@@ -70,3 +108,65 @@ Probe, best-of-20 on the Core thread:
 ```
 
 Seeded characters carry 8 items with ~6 mods each and ~12 trained skills. A real endgame character has more of both, so profile cost and payload are a **floor** — budget 2–4× for a fully-kitted character.
+
+## The login half needs a socket, not the sink
+
+`BridgeProtocol5Probe` fires `EventSink.InvokeAccountLogin` directly, which proves the REJECTED
+half of `account.login.result` and nothing more. ServUO's own `AccountHandler` calls
+`acct.HasAccess(e.State)` *before* it ever checks the password, and a null `NetState` fails that --
+so an in-process probe logs `Access denied` for a correct password too, and never produces an
+`accepted:true`.
+
+To prove the accepted half, speak the wire. A real socket also gives the frame a real `ip`, which
+is one of the fields being tested:
+
+```python
+# 4-byte seed, then 0x80 = [0x80][30b username][30b password][1b]
+s = socket.create_connection(('127.0.0.1', 2593))
+s.sendall(b'\x7f\x00\x00\x01')
+s.sendall(b'\x80' + pad(user) + pad(password) + b'\x5d')
+```
+
+The shard logs `Invalid password for '<acct>'` or `Valid credentials for '<acct>'`, and the sidecar's
+`/history?kind=account.login.result` should show `accepted:false reason:BadPass` and `accepted:true`
+respectively. **Both saying `accepted:true` is the bug the kind exists to prevent** -- it means the
+verdict was read inside the handler, before it existed.
+
+## Walking a house into IDOC needs a house that can decay
+
+Only a `Condemned` or `ManualRefresh` house decays. An `AutoRefresh` one -- and the owner's NEWEST
+house is always `AutoRefresh` -- has a `DecayLevel` getter that calls `ResetDynamicDecay()` and
+reports `Ageless`, so a forced `SetDynamicDecay` is wiped on the very next read, the sweep sees no
+change, and **nothing is emitted at all**. That looks exactly like a broken emitter. Filter on
+`house.CanDecay`, and expect a seeded world to have only one or two houses that qualify -- both
+probably already at IDOC, so the walk has to put one back down first.
+
+## A decaying house cannot be refreshed — only its owner coming back rescues it
+
+`BaseHouse.RefreshDecay()` returns `false` immediately when `DecayType == Condemned`, and on a
+seeded world **every house that can decay is Condemned** — the seeder backdates 18 accounts past
+`Account.InactiveDuration` precisely to make them decay. So `SetDynamicDecay(DecayLevel.LikeNew)`
+is wiped by the next read and `RefreshDecay()` does nothing: the sweep sees no change and emits
+nothing, which looks exactly like a broken emitter for the second time on the same page.
+
+The rescue is the OWNER LOGGING IN (`BridgeRigDriver`'s `activate <account>` reproduces it by
+setting `LastLogin`). What the shard then reports depends on how many houses that owner has:
+
+| the house | `DecayType` after the login | `DecayLevel` reads |
+|---|---|---|
+| their newest | `AutoRefresh` | **`Ageless`** — off the decay clock entirely |
+| any older one | `ManualRefresh` | **`LikeNew`** — back on the clock, at the top |
+
+Both are "out of danger", and the newest-house case is the common one. A consumer that watches only
+for `LikeNew` misses most rescues — which is what the engagement mapper did until this walk.
+
+## The console takes a fixed verb set, so `[commands` cannot be typed at a headless shard
+
+`Scripts/Misc/ConsoleCommands.cs` handles `save`, `shutdown`, `restart`, `online`, `kick` and a
+handful more; it does **not** dispatch arbitrary `[commands`. Every other probe here therefore runs
+either at boot or from an in-game client, and neither works for a walk driven from a script. That is
+what `BridgeRigDriver` and its `rigcmd.txt` are for.
+
+Also: only a CLEAN shutdown emits. `Stop-Process` drops the socket and the shard says nothing, so a
+killed shard is indistinguishable from a wedged one and `server.shutdown` never reaches the sidecar —
+use the driver's `shutdown` verb (`Core.Kill`) when the shutdown itself is what is being tested.