fix(modules): a site runs one module; the installer refuses a second

A site is one game, and the module contract already has singletons that
assume it. registerTeamProvider holds one value per deployment, and a
second module registering one fails that module's whole load. The loader
scans alphabetically, so installing module-rust (which gains a Team
provider in its phase 9) beside module-uo would have taken uo down, not
rust.

install() now refuses, with 409 and before the artifact is downloaded,
any install whose id differs from a module already on the volume. An
upgrade of the installed module is still accepted; to change game,
remove the module first. Both install surfaces share this path, so a
MODULES declaration naming two modules installs the first and reports
the second as refused without failing the boot.

"Installed" means what the loader would scan: a directory named with a
module id that holds a module.json. An install's scratch directory and a
swap's aside copy do not count.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

client/src/routes/admin/views/Dashboard.jsx

@@ -166,7 +166,12 @@ export default function Dashboard() {
             className="sans"
             style={{ display: 'flex', gap: 14, alignItems: 'center', padding: '13px 18px', borderBottom: '1px solid var(--line-soft)', fontSize: '0.86rem' }}
           >
-            <span style={{ flex: 'none', color: 'var(--accent)', fontSize: '0.66rem', fontWeight: 700, letterSpacing: '0.08em', textTransform: 'uppercase', width: 110, fontFamily: 'ui-monospace,Menlo,monospace' }}>
+            {/* `minWidth` rather than `width`: the column still lines up for core's
+                own short action names, and a longer one — a module's namespaced
+                action, say `rust.account.unlink.staff` — grows the box instead of
+                overflowing it and printing on top of the detail beside it. Found
+                on a live dashboard with a module installed. */}
+            <span style={{ flex: 'none', color: 'var(--accent)', fontSize: '0.66rem', fontWeight: 700, letterSpacing: '0.08em', textTransform: 'uppercase', minWidth: 110, fontFamily: 'ui-monospace,Menlo,monospace' }}>
               {a.action}
             </span>
             <span style={{ flex: 1, color: 'var(--text)' }}>{formatDetail(a)}</span>

server/engagement-triggers.json

@@ -27,6 +27,27 @@
           "example": "The Yew Invasion",
           "description": "The event title."
         },
+        {
+          "name": "summary",
+          "type": "string",
+          "required": false,
+          "example": "Orcish warbands are massing north of Yew.",
+          "description": "The event’s one-line summary, when it has one."
+        },
+        {
+          "name": "seriesName",
+          "type": "string",
+          "required": false,
+          "example": "The Yew Campaign",
+          "description": "The arc this event belongs to, when it belongs to one."
+        },
+        {
+          "name": "timezone",
+          "type": "string",
+          "required": false,
+          "example": "America/New_York",
+          "description": "The zone the run was computed in — what a time in the body should be read as."
+        },
         {
           "name": "phase",
           "type": "string",
@@ -89,6 +110,27 @@
           "example": "The Yew Invasion",
           "description": "The event title."
         },
+        {
+          "name": "summary",
+          "type": "string",
+          "required": false,
+          "example": "Orcish warbands are massing north of Yew.",
+          "description": "The event’s one-line summary, when it has one."
+        },
+        {
+          "name": "seriesName",
+          "type": "string",
+          "required": false,
+          "example": "The Yew Campaign",
+          "description": "The arc this event belongs to, when it belongs to one."
+        },
+        {
+          "name": "timezone",
+          "type": "string",
+          "required": false,
+          "example": "America/New_York",
+          "description": "The zone the run was computed in — what a time in the body should be read as."
+        },
         {
           "name": "reason",
           "type": "string",
@@ -135,7 +177,21 @@
           "type": "string",
           "required": false,
           "example": "Orcish warbands are massing north of Yew.",
-          "description": "The event summary, as authored."
+          "description": "The event’s one-line summary, when it has one."
+        },
+        {
+          "name": "seriesName",
+          "type": "string",
+          "required": false,
+          "example": "The Yew Campaign",
+          "description": "The arc this event belongs to, when it belongs to one."
+        },
+        {
+          "name": "timezone",
+          "type": "string",
+          "required": false,
+          "example": "America/New_York",
+          "description": "The zone the run was computed in — what a time in the body should be read as."
         },
         {
           "name": "participantCount",
@@ -185,6 +241,27 @@
           "example": "The Yew Invasion",
           "description": "The event title."
         },
+        {
+          "name": "summary",
+          "type": "string",
+          "required": false,
+          "example": "Orcish warbands are massing north of Yew.",
+          "description": "The event’s one-line summary, when it has one."
+        },
+        {
+          "name": "seriesName",
+          "type": "string",
+          "required": false,
+          "example": "The Yew Campaign",
+          "description": "The arc this event belongs to, when it belongs to one."
+        },
+        {
+          "name": "timezone",
+          "type": "string",
+          "required": false,
+          "example": "America/New_York",
+          "description": "The zone the run was computed in — what a time in the body should be read as."
+        },
         {
           "name": "eventUrl",
           "type": "url",
@@ -219,6 +296,27 @@
           "example": "The Yew Invasion",
           "description": "The event title."
         },
+        {
+          "name": "summary",
+          "type": "string",
+          "required": false,
+          "example": "Orcish warbands are massing north of Yew.",
+          "description": "The event’s one-line summary, when it has one."
+        },
+        {
+          "name": "seriesName",
+          "type": "string",
+          "required": false,
+          "example": "The Yew Campaign",
+          "description": "The arc this event belongs to, when it belongs to one."
+        },
+        {
+          "name": "timezone",
+          "type": "string",
+          "required": false,
+          "example": "America/New_York",
+          "description": "The zone the run was computed in — what a time in the body should be read as."
+        },
         {
           "name": "phase",
           "type": "string",
@@ -272,7 +370,7 @@
           "type": "string",
           "required": false,
           "example": "Orcish warbands are massing north of Yew.",
-          "description": "The event summary, as authored."
+          "description": "The event’s one-line summary, when it has one."
         },
         {
           "name": "seriesName",
@@ -281,6 +379,13 @@
           "example": "The Yew Campaign",
           "description": "The arc this event belongs to, when it belongs to one."
         },
+        {
+          "name": "timezone",
+          "type": "string",
+          "required": false,
+          "example": "America/New_York",
+          "description": "The zone the run was computed in — what a time in the body should be read as."
+        },
         {
           "name": "startsAt",
           "type": "datetime",
@@ -288,13 +393,6 @@
           "example": "2026-09-12T20:00:00.000Z",
           "description": "When the occurrence is due to start, UTC."
         },
-        {
-          "name": "timezone",
-          "type": "string",
-          "required": false,
-          "example": "America/New_York",
-          "description": "The shard-local zone the schedule was authored in."
-        },
         {
           "name": "startsAtLabel",
           "type": "string",
@@ -341,7 +439,7 @@
           "type": "string",
           "required": false,
           "example": "Orcish warbands are massing north of Yew.",
-          "description": "The event summary, as authored."
+          "description": "The event’s one-line summary, when it has one."
         },
         {
           "name": "seriesName",
@@ -350,6 +448,13 @@
           "example": "The Yew Campaign",
           "description": "The arc this event belongs to, when it belongs to one."
         },
+        {
+          "name": "timezone",
+          "type": "string",
+          "required": false,
+          "example": "America/New_York",
+          "description": "The zone the run was computed in — what a time in the body should be read as."
+        },
         {
           "name": "startsAt",
           "type": "datetime",
@@ -357,13 +462,6 @@
           "example": "2026-09-12T20:00:00.000Z",
           "description": "When it actually started, UTC."
         },
-        {
-          "name": "timezone",
-          "type": "string",
-          "required": false,
-          "example": "America/New_York",
-          "description": "The shard-local zone the schedule was authored in."
-        },
         {
           "name": "startsAtLabel",
           "type": "string",

server/src/config/coreTriggers.js

@@ -29,6 +29,29 @@
 // test-send without a live game event, which is the reason template systems go
 // untested.
 
+/**
+ * The three facts `events/announce.js` puts on EVERY `event.*` payload, declared
+ * once because they are spread into all seven.
+ *
+ * `baseFor()` has always computed them and nothing declared them, so
+ * `engagementEmit.validatePayload` dropped all three before a template could see
+ * one — they were absent from the variable list an author picks from, and every
+ * single event emit logged `emit carried undeclared variables`. Found by the
+ * Phase 16 acceptance walk, in the DEBUG line it had been writing all along.
+ *
+ * All three are optional, and each for its own reason rather than by default: an
+ * event need not carry a summary, most events belong to no series, and a run
+ * whose definition has been deleted resolves no zone.
+ */
+const EVENT_AMBIENT = [
+  { name: 'summary', type: 'string', required: false, example: 'Orcish warbands are massing north of Yew.',
+    description: 'The event’s one-line summary, when it has one.' },
+  { name: 'seriesName', type: 'string', required: false, example: 'The Yew Campaign',
+    description: 'The arc this event belongs to, when it belongs to one.' },
+  { name: 'timezone', type: 'string', required: false, example: 'America/New_York',
+    description: 'The zone the run was computed in — what a time in the body should be read as.' },
+]
+
 const TRIGGERS = [
   {
     id: 'news.post',
@@ -215,14 +238,9 @@ const TRIGGERS = [
         description: 'The run this is about. Also the cooldown subject.' },
       { name: 'title', type: 'string', required: true, example: 'The Yew Invasion',
         description: 'The event title.' },
-      { name: 'summary', type: 'string', required: false, example: 'Orcish warbands are massing north of Yew.',
-        description: 'The event summary, as authored.' },
-      { name: 'seriesName', type: 'string', required: false, example: 'The Yew Campaign',
-        description: 'The arc this event belongs to, when it belongs to one.' },
+      ...EVENT_AMBIENT,
       { name: 'startsAt', type: 'datetime', required: true, example: '2026-09-12T20:00:00.000Z',
         description: 'When the occurrence is due to start, UTC.' },
-      { name: 'timezone', type: 'string', required: false, example: 'America/New_York',
-        description: 'The shard-local zone the schedule was authored in.' },
       // **A presentational fragment, and §4.6.1 convention 1 is what sanctions
       // one.** `startsAt` is a `datetime`, which the seam normalises to an ISO
       // string — correct as data and unreadable in a mail, and a template has no
@@ -254,14 +272,9 @@ const TRIGGERS = [
         description: 'The run this is about. Also the cooldown subject.' },
       { name: 'title', type: 'string', required: true, example: 'The Yew Invasion',
         description: 'The event title.' },
-      { name: 'summary', type: 'string', required: false, example: 'Orcish warbands are massing north of Yew.',
-        description: 'The event summary, as authored.' },
-      { name: 'seriesName', type: 'string', required: false, example: 'The Yew Campaign',
-        description: 'The arc this event belongs to, when it belongs to one.' },
+      ...EVENT_AMBIENT,
       { name: 'startsAt', type: 'datetime', required: true, example: '2026-09-12T20:00:00.000Z',
         description: 'When it actually started, UTC.' },
-      { name: 'timezone', type: 'string', required: false, example: 'America/New_York',
-        description: 'The shard-local zone the schedule was authored in.' },
       // **A presentational fragment, and §4.6.1 convention 1 is what sanctions
       // one.** `startsAt` is a `datetime`, which the seam normalises to an ISO
       // string — correct as data and unreadable in a mail, and a template has no
@@ -293,6 +306,7 @@ const TRIGGERS = [
         description: 'The run this is about. Also the cooldown subject.' },
       { name: 'title', type: 'string', required: true, example: 'The Yew Invasion',
         description: 'The event title.' },
+      ...EVENT_AMBIENT,
       { name: 'phase', type: 'string', required: true, example: 'assault',
         description: 'The phase key just entered, as authored in the spec.' },
       { name: 'phaseLabel', type: 'string', required: false, example: 'The assault',
@@ -323,6 +337,7 @@ const TRIGGERS = [
         description: 'The run this is about. Also the cooldown subject.' },
       { name: 'title', type: 'string', required: true, example: 'The Yew Invasion',
         description: 'The event title.' },
+      ...EVENT_AMBIENT,
       // The public page for THIS occurrence (Phase 14a). Relative, like
       // `postUrl` and `runUrl`: the seam resolves it against the site's own
       // base, and an absolute one baked in here would be wrong on every
@@ -345,8 +360,7 @@ const TRIGGERS = [
         description: 'The run this is about. Also the cooldown subject.' },
       { name: 'title', type: 'string', required: true, example: 'The Yew Invasion',
         description: 'The event title.' },
-      { name: 'summary', type: 'string', required: false, example: 'Orcish warbands are massing north of Yew.',
-        description: 'The event summary, as authored.' },
+      ...EVENT_AMBIENT,
       // Counted from `event_run_participants` at emit. Zero on a run whose
       // module reported nobody, which is every run until a module collects —
       // a template that says "47 took part" needs a number that is never
@@ -377,6 +391,7 @@ const TRIGGERS = [
         description: 'The run this is about. Also the cooldown subject.' },
       { name: 'title', type: 'string', required: true, example: 'The Yew Invasion',
         description: 'The event title.' },
+      ...EVENT_AMBIENT,
       // **The operator's reason, and not the run's `last_error`.** `cancel`
       // takes a `{ reason }` a human typed for other humans; a diagnostic
       // string is for the run console and would read as gibberish in a mail.
@@ -408,6 +423,7 @@ const TRIGGERS = [
         description: 'The run this is about. Also the cooldown subject.' },
       { name: 'title', type: 'string', required: true, example: 'The Yew Invasion',
         description: 'The event title.' },
+      ...EVENT_AMBIENT,
       { name: 'phase', type: 'string', required: false, example: 'assault',
         description: 'The phase it failed in, when it had entered one.' },
       { name: 'error', type: 'string', required: false, example: 'sidecar responded 503',

server/src/events/announce.js

@@ -67,7 +67,18 @@ function startsAtLabel(at, zone) {
       // Explicit rather than left to the locale, because `en-GB` would otherwise
       // render midnight as "00:00" while the schedule editor beside it writes
       // "12:00 AM" — one event, two spellings of the same instant.
-      hour12: true,
+      //
+      // `hourCycle: 'h12'` and NOT `hour12: true`, which is not the same request
+      // and does not survive a Node upgrade. For a locale whose default cycle is
+      // h23 — `en-GB` is one — Node 20 resolves `hour12: true` to **h11**, whose
+      // hours run 0–11, so midnight comes out "0:00 am"; Node 22 and later
+      // resolve it to h12 and it comes out "12:00 am". Same ICU on both, so this
+      // is V8's ECMA-402 behaviour and not locale data, and the image ships
+      // node:20-alpine while a dev machine is newer — which is how this rendered
+      // correctly in front of everyone who wrote it and wrongly for every real
+      // recipient. `recurrence.js` states the mirror-image rule for `h23`; there
+      // is no `hour12` left in this repo and it should stay that way.
+      hourCycle: 'h12',
     }).format(when)
     return `${text} (${zone || 'UTC'})`
   } catch {

server/src/model/events/eventPublic.model.js

@@ -37,11 +37,19 @@ const participantsDb = require('./eventRunParticipants.db')
 const calendarModel = require('./eventCalendar.model')
 const recurrence = require('../../events/recurrence')
 
-// The public calendar's window when a caller names neither end: now through a
-// month out. A visitor arriving at /site/events wants "what is on", and a client
-// that had to compute a window before it could ask anything would make every
-// deep link carry two ISO instants.
+// The public calendar's window when a caller names neither end: a few days BACK
+// through a month out. A visitor arriving at /site/events wants "what is on", and
+// a client that had to compute a window before it could ask anything would make
+// every deep link carry two ISO instants.
+//
+// **The backward tail is not padding — it is the "recent" in §I's "upcoming, live
+// and recent".** The default used to start at `now`, so an event that finished an
+// hour ago was already gone and a visitor had nowhere to find the results of the
+// thing they had just attended. The LIVE half is answered by `listInWindow`'s
+// overlap test rather than by this number, so the tail only has to be long enough
+// to be a "recently" a reader would recognise.
 const DEFAULT_WINDOW_DAYS = 31
+const DEFAULT_RECENT_DAYS = 7
 
 // How many past occurrences an event page carries. It shows what is next and
 // what happened recently; the whole history of a three-year-old weekly event is
@@ -146,8 +154,15 @@ const publicProjectedEntry = (definition, occurrence) => ({
  * surface that has no login in front of it.
  */
 async function calendar({ from, to, seriesId = null, now = new Date() } = {}) {
-  const start = from ? new Date(from) : new Date(now)
-  const end = to ? new Date(to) : new Date(start.getTime() + DEFAULT_WINDOW_DAYS * recurrence.DAY_MS)
+  // The default `to` is measured from NOW, not from `start` — otherwise the
+  // backward tail would silently push the horizon a week further out and a caller
+  // naming only `from` would get a different span than one naming neither.
+  const start = from
+    ? new Date(from)
+    : new Date(new Date(now).getTime() - DEFAULT_RECENT_DAYS * recurrence.DAY_MS)
+  const end = to
+    ? new Date(to)
+    : new Date(new Date(now).getTime() + DEFAULT_WINDOW_DAYS * recurrence.DAY_MS)
 
   if (Number.isNaN(start.getTime()) || Number.isNaN(end.getTime())) {
     return { ok: false, status: 400, errors: ['from and to must be dates'] }
@@ -183,7 +198,22 @@ async function calendar({ from, to, seriesId = null, now = new Date() } = {}) {
     if (!schedule || schedule.kind === 'manual') continue
     let occurrences = []
     try {
-      occurrences = recurrence.occurrencesBetween(schedule, definition.timezone || 'UTC', start, end)
+      // **Forecast from `now`, never from `start`.** The default window now
+      // reaches a week backwards so that "recent" has somewhere to live, and a
+      // projection into that tail would advertise an occurrence that did not
+      // happen — a run that WAS created is a real row and arrives above, and one
+      // that was not is a slot the runner has already passed. A forecast is about
+      // the future; the tail is about the past. Only the materialised half fills
+      // it.
+      const forecastFrom = start > now ? start : new Date(now)
+      if (forecastFrom < end) {
+        occurrences = recurrence.occurrencesBetween(
+          schedule,
+          definition.timezone || 'UTC',
+          forecastFrom,
+          end,
+        )
+      }
     } catch {
       // A version whose schedule the recurrence engine will not read is one the
       // runner will not expand either. The calendar then shows that definition's
@@ -405,5 +435,6 @@ module.exports = {
   publicStatus,
   phaseLabel,
   DEFAULT_WINDOW_DAYS,
+  DEFAULT_RECENT_DAYS,
   PAST_RUNS,
 }

server/src/model/events/eventRunResources.db.js

@@ -194,18 +194,54 @@ async function unresolvedCounts(runIds) {
 }
 
 /**
- * Claim one row for a revert: `pending | confirmed | orphaned | drifted → reverting`.
+ * Claim one row for a revert: `pending | confirmed | orphaned | drifted → reverting`,
+ * and `reverting` again once the claim on it has gone stale.
  *
  * The compare-and-set that keeps the cleanup leg and the manual cleanup route off
- * each other's rows. `reverting` is deliberately not claimable — a row another
- * pass is mid-revert on is left alone, exactly as a step with a live claim is.
+ * each other's rows. A row another pass is mid-revert on is left alone, exactly as
+ * a step with a live claim is.
+ *
+ * **"Exactly as a step" has to include the expiry, and it did not until the Phase
+ * 16 acceptance walk.** A step's claim carries `claim_expires_at`, so a step whose
+ * process died is reclaimed once the lease lapses — that reclaim is the whole
+ * reason §E's CAS survives §N4's single instance. A `reverting` row had no such
+ * bound and nothing released it, so a process killed mid-teardown stranded the row
+ * for good: the sweep skipped it every 15s forever, `cleanup_status` never left
+ * `pending`, and `POST …/cleanup` — the recourse §I names — answered 200 and did
+ * nothing, because it claims through this same function. Observed with a lease,
+ * which then blocked the NEXT run of the same event from taking the value.
+ *
+ * The stale test is `updated_at`, not a new column: the row is stamped exactly
+ * when it enters `reverting` and is not written again until the revert resolves,
+ * so for a `reverting` row `updated_at` IS "when this claim was taken". The bound
+ * is the run lease's, for the run lease's reason — it has to outlast a whole
+ * tick's work on one run, and every revert in a sweep is bounded by its action's
+ * own `budgetMs` long before this.
+ *
+ * `revert_attempts` is deliberately NOT incremented by reclaiming. A stale claim
+ * is a process that died, not an attempt that failed, and counting it would burn
+ * the retry budget on crashes — Engagement Phase 14's rule, one table over.
+ *
+ * **`updated_at` is re-stamped explicitly, and that is what keeps this a CAS.**
+ * This connector sends `CLIENT_FOUND_ROWS`, so `affectedRows` counts rows MATCHED
+ * rather than changed. For the four fresh statuses that is harmless — the winner
+ * moves the row to `reverting` and the loser's `status IN (…)` no longer matches.
+ * A stale `reverting` row has no such natural change: without re-stamping, the
+ * row would still satisfy `status = 'reverting' AND updated_at < …` and a second
+ * claimer would match it too. Writing the column is what makes the second one
+ * miss.
  */
+const REVERT_CLAIM_TTL_MS = Number(process.env.EVENT_REVERT_CLAIM_TTL_MS) || 15 * 60 * 1000
+
 async function claimRevert(id) {
   const result = await query(
     `UPDATE event_run_resources
-        SET status = 'reverting'
-      WHERE id = ? AND status IN ('pending', 'confirmed', 'orphaned', 'drifted')`,
-    [id],
+        SET status = 'reverting', updated_at = NOW()
+      WHERE id = ?
+        AND (status IN ('pending', 'confirmed', 'orphaned', 'drifted')
+             OR (status = 'reverting'
+                 AND updated_at < (NOW() - INTERVAL ? MICROSECOND)))`,
+    [id, REVERT_CLAIM_TTL_MS * 1000],
   )
   return (result.affectedRows || 0) > 0
 }

server/src/model/events/eventRuns.db.js

@@ -108,14 +108,32 @@ const materialise = async (run) => {
 }
 
 /**
- * Every run whose instant falls inside a window — the calendar's real half.
+ * Every run whose OCCUPIED INTERVAL overlaps a window — the calendar's real half.
  *
  * Ascending, unlike the admin run list: a calendar is read forwards. The join
  * reaches the series so a month can be filtered to one arc without a second
  * round trip, and `d.timezone` is NOT what comes back — `r.timezone` is, because
  * a run records the zone it was COMPUTED in and a definition's zone can be
  * edited afterwards.
+ *
+ * **A run OVERLAPS the window; it does not merely START in it.** This asked
+ * `scheduled_for >= from` alone until the Phase 16 acceptance walk, and a run is
+ * not an instant — it is an interval, and a multi-phase event's whole point is
+ * that the interval is long. A run that began before `from` and has not ended is
+ * happening DURING the window and belongs in it. With the instant test, the
+ * public calendar answered `entries: []` while that same event's own page said
+ * `live: true`, so the site disagreed with itself about whether something was on
+ * — and `EVENTS.md` §I promises this route serves "upcoming, **live** and
+ * recent". The admin calendar had the same hole for the same reason: a run that
+ * started last Sunday and is still going was missing from "this week".
+ *
+ * A finished run needs no clause: it is `recent` only if its instant is in the
+ * window, which is what the window's own `from` decides (see
+ * `eventPublic.model.calendar`, which backdates its default `from` so that
+ * "recent" has somewhere to live).
  */
+const LIVE_STATUSES = ['starting', 'running', 'paused', 'ending']
+
 const listInWindow = async ({
   from,
   to,
@@ -125,8 +143,11 @@ const listInWindow = async ({
   limit = 500,
   publicOnly = false,
 } = {}) => {
-  const where = ['r.scheduled_for >= ?', 'r.scheduled_for < ?']
-  const args = [from, to]
+  const where = [
+    `((r.scheduled_for >= ? AND r.scheduled_for < ?)
+       OR (r.scheduled_for < ? AND r.status IN (${LIVE_STATUSES.map(() => '?').join(',')})))`,
+  ]
+  const args = [from, to, to, ...LIVE_STATUSES]
   if (status) {
     where.push('r.status = ?')
     args.push(status)

server/src/modules/declared.js

@@ -17,6 +17,11 @@
 // through modules/install.js, the same fetch-verify-unpack path the admin panel
 // uses, under the same host allowlist.
 //
+// **A site runs one module** (org lead, 2026-09-23), and install.js enforces it
+// for this path too: a declaration naming a second module installs the first,
+// and the second is refused — logged and kept for the admin screen like any
+// other failed entry, never fatal to the boot.
+//
 // Three things this file deliberately does not do:
 //
 //   - **It does not decide whether a module RUNS.** Resolution owns what is on

server/src/modules/install.js

@@ -290,6 +290,28 @@ function isInstalled(id) {
   }
 }
 
+/**
+ * Every module on the volume, by id — the directories the loader would scan.
+ *
+ * The loader's own rule, restated: a directory whose name is a module id and
+ * which holds a `module.json`. That excludes an install's scratch directory
+ * (`.install-*`) and a swap's aside copy (`<id>.replaced-*`), neither of which
+ * is a module and both of which can briefly exist beside one.
+ */
+function installedIds() {
+  let entries
+  try {
+    entries = fs.readdirSync(loader.dir(), { withFileTypes: true })
+  } catch {
+    return [] // no modules directory is the normal case for a bare core
+  }
+  return entries
+    .filter((e) => e.isDirectory() && ID.test(e.name))
+    .filter((e) => fs.existsSync(path.join(loader.dir(), e.name, 'module.json')))
+    .map((e) => e.name)
+    .sort()
+}
+
 /**
  * The absolute path of a module's `purge.sql`, or null.
  *
@@ -348,6 +370,25 @@ async function install({ url, hosts, expect = null, fetchImpl = fetch }) {
     )
   }
 
+  // One module per site (org lead, 2026-09-23). A site is one game, and the
+  // contract has singletons that assume it: `registerTeamProvider` holds ONE
+  // value per deployment, and a second module registering one fails its whole
+  // load — with modules loaded alphabetically, installing `rust` beside `uo`
+  // would have taken `uo` down, not `rust`. So an install is an UPGRADE of the
+  // module already here, or it is refused before a byte is downloaded.
+  //
+  // Refused here rather than in the admin controller so the declared module set
+  // (modules/declared.js) gets the same answer: an environment naming two
+  // modules installs the first and is told why the second was not.
+  const others = installedIds().filter((id) => id !== manifest.id)
+  if (others.length) {
+    throw new InstallError(
+      `this site already runs the module "${others.join('", "')}", and a site runs one module. ` +
+        `Upgrade it with its own release, or remove it before installing "${manifest.id}".`,
+      { status: 409 },
+    )
+  }
+
   const target = moduleDir(manifest.id)
   const scratch = await fsp.mkdtemp(path.join(loader.dir(), `.install-${manifest.id}-`))
   const tarball = path.join(scratch, 'bundle.tar.gz')
@@ -444,6 +485,7 @@ module.exports = {
   removeDir,
   moduleDir,
   isInstalled,
+  installedIds,
   purgeFile,
   MAX_MANIFEST_BYTES,
   MAX_ARTIFACT_BYTES,

server/src/router/v1/admin/modules.router.js

@@ -41,11 +41,12 @@ modulesRouter.post(
   '/',
   // #swagger.tags = ['Admin · Modules']
   // #swagger.summary = 'Install or upgrade a module from a release install-manifest URL'
-  // #swagger.description = 'Downloads the artifact the manifest names, verifies its sha256, inspects the archive in full and unpacks it onto the modules volume. The module mounts on the next restart.'
+  // #swagger.description = 'Downloads the artifact the manifest names, verifies its sha256, inspects the archive in full and unpacks it onto the modules volume. The module mounts on the next restart. A site runs ONE module: installing a module other than the one already on the volume is refused with 409 before anything is downloaded, and only an upgrade of the installed module is accepted.'
   // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
   /* #swagger.requestBody = { required: true, content: { "application/json": { schema: { type: "object", required: ["url"], properties: { url: { type: "string", description: "https URL of the release install manifest, on an allowed host" } } } } } } */
   /* #swagger.responses[201] = { description: 'Installed — restart to mount it', content: { "application/json": { schema: { type: "object", additionalProperties: true } } } } */
   /* #swagger.responses[400] = { description: 'The URL, the manifest, the hash or the archive was refused', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
+  /* #swagger.responses[409] = { description: 'A different module is already installed; a site runs one module', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
   /* #swagger.responses[502] = { description: 'The source host could not be reached or answered badly', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
   adminOnly,
   body('url').isString().trim().isLength({ min: 1, max: 2048 }),

server/swagger/swagger-output.json

@@ -7211,7 +7211,7 @@
           "Admin · Modules"
         ],
         "summary": "Install or upgrade a module from a release install-manifest URL",
-        "description": "Downloads the artifact the manifest names, verifies its sha256, inspects the archive in full and unpacks it onto the modules volume. The module mounts on the next restart.",
+        "description": "Downloads the artifact the manifest names, verifies its sha256, inspects the archive in full and unpacks it onto the modules volume. The module mounts on the next restart. A site runs ONE module: installing a module other than the one already on the volume is refused with 409 before anything is downloaded, and only an upgrade of the installed module is accepted.",
         "responses": {
           "201": {
             "description": "Installed — restart to mount it",
@@ -7234,6 +7234,16 @@
               }
             }
           },
+          "409": {
+            "description": "A different module is already installed; a site runs one module",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Error"
+                }
+              }
+            }
+          },
           "500": {
             "description": "Internal Server Error"
           },

server/test/eventAnnounce.test.js

@@ -260,9 +260,15 @@ test('the start time is written out in the SHARD\'s zone, not the server\'s', ()
 })
 
 test('midnight reads as 12:00 am and never as 00:00', () => {
-  // `hour12` is set explicitly. Left to the en-GB locale this would render
+  // The hour cycle is set explicitly. Left to the en-GB locale this would render
   // "00:00" while the schedule editor beside it writes "12:00 AM" — one event,
   // two spellings of the same instant.
+  //
+  // This assertion only has teeth on the Node the image ships (20), where
+  // `hour12: true` resolves to h11 and midnight reads "0:00 am". On Node 22+ it
+  // passes either way — so a green run on a dev machine is not evidence, and CI
+  // is what actually holds this line. See the note beside `hourCycle` in
+  // events/announce.js.
   assert.match(announce.startsAtLabel(new Date('2026-09-13T04:00:00Z'), 'America/New_York'), /12:00 am/)
 })
 

server/test/eventPublic.test.js

@@ -115,10 +115,15 @@ function installStubs() {
       .filter((d) => d.state === 'ready' && (!listedOnly || d.listed))
       .map((d) => ({ ...d, version_spec: d.spec }))
 
+  // Mirrors the OVERLAP predicate the real statement uses: a run is in the window
+  // if its instant falls inside it, OR if it began before the window and is still
+  // live. A run is an interval, not an instant — see `eventRuns.db.listInWindow`.
   runsDb.listInWindow = async ({ from, to, publicOnly = false }) =>
     store.runs.filter((r) => {
       const at = new Date(r.scheduled_for)
-      if (at < from || at >= to) return false
+      const startsInside = at >= from && at < to
+      const liveAcross = at < to && ['starting', 'running', 'paused', 'ending'].includes(r.status)
+      if (!startsInside && !liveAcross) return false
       if (!publicOnly) return true
       const d = store.definitions.find((x) => x.id === r.definition_id)
       return !r.rehearsal && d && d.listed && d.state !== 'archived'
@@ -163,12 +168,89 @@ test('a calendar entry carries no operational field at all', async () => {
   ])
 })
 
-test('the calendar defaults to a month from now when no window is given', async () => {
+test('the default window reaches back as well as forward', async () => {
+  // §I: this route is "upcoming, live and recent". The default used to start at
+  // `now`, which left no room for the third word — an event that finished an hour
+  // ago was already gone, so a visitor had nowhere to find the results of the
+  // thing they had just attended (Phase 16 walk).
   const result = await publicModel.calendar({ now: NOW })
   assert.equal(result.ok, true)
-  assert.equal(new Date(result.window.from).getTime(), NOW.getTime())
-  const days = (new Date(result.window.to) - new Date(result.window.from)) / 86_400_000
-  assert.equal(days, publicModel.DEFAULT_WINDOW_DAYS)
+  const back = (NOW - new Date(result.window.from)) / 86_400_000
+  const forward = (new Date(result.window.to) - NOW) / 86_400_000
+  assert.equal(back, publicModel.DEFAULT_RECENT_DAYS)
+  assert.equal(forward, publicModel.DEFAULT_WINDOW_DAYS)
+})
+
+test('a run happening RIGHT NOW is on the calendar, whenever it started', async () => {
+  // The defect this pair was written for: the site said `live: true` on the
+  // event's own page and served `entries: []` from the calendar, because the
+  // window test read the START instant and a live run had already started. A run
+  // is an interval; the calendar asks which intervals overlap it.
+  store.runs = [
+    {
+      ...run({
+        status: 'running',
+        // Well before any default window would begin.
+        scheduled_for: new Date('2026-08-01T00:00:00Z'),
+        ended_at: null,
+      }),
+      definition_title: 'The Yew Invasion',
+      definition_slug: 'the-yew-invasion',
+    },
+  ]
+  const result = await publicModel.calendar({ now: NOW })
+  assert.equal(result.ok, true)
+  const entry = result.entries.find((e) => e.kind === 'run')
+  assert.ok(entry, 'a live run must appear however long ago it began')
+  assert.equal(entry.live, true)
+  assert.equal(entry.status, 'live')
+})
+
+test('a run that finished inside the recent tail is still on the calendar', async () => {
+  store.runs = [
+    {
+      ...run({
+        status: 'completed',
+        scheduled_for: new Date(NOW.getTime() - 2 * 86_400_000),
+        ended_at: new Date(NOW.getTime() - 2 * 86_400_000 + 3_600_000),
+      }),
+      definition_title: 'The Yew Invasion',
+      definition_slug: 'the-yew-invasion',
+    },
+  ]
+  const result = await publicModel.calendar({ now: NOW })
+  assert.equal(result.ok, true)
+  assert.equal(result.entries.filter((e) => e.kind === 'run').length, 1)
+})
+
+test('nothing is FORECAST into the recent tail', async () => {
+  // The tail is for what happened, and only the materialised half fills it. A
+  // projection into the past would advertise an occurrence that did not happen:
+  // one that WAS created is a real row and arrives as a run, and one that was not
+  // is a slot the runner has already gone past.
+  store.definitions = [
+    definition({
+      spec: {
+        ...SPEC,
+        schedule: {
+          kind: 'weekly',
+          days: ['monday', 'tuesday', 'wednesday', 'thursday', 'friday', 'saturday', 'sunday'],
+          time: '20:00',
+        },
+      },
+    }),
+  ]
+  store.runs = []
+  const result = await publicModel.calendar({ now: NOW })
+  assert.equal(result.ok, true)
+  const projected = result.entries.filter((e) => e.kind !== 'run')
+  assert.ok(projected.length > 0, 'a daily schedule must still forecast forwards')
+  for (const entry of projected) {
+    assert.ok(
+      new Date(entry.scheduledFor) >= NOW,
+      `forecast ${entry.scheduledFor} is before now — the tail must hold no projections`,
+    )
+  }
 })
 
 test('a window wider than the cap is refused rather than served slowly', async () => {

server/test/eventRunnerSql.test.js

@@ -1448,6 +1448,77 @@ test('many released rows on one target coexist, which is the whole encoding', as
   assert.equal(await dup(() => insertResource(a.runId, { kind: 'override', ref: 'demo.rate' })), null)
 })
 
+// ── claimRevert's stale-claim reclaim (Phase 16) ───────────────────────────
+//
+// The statement's own comment explains WHY a `reverting` row must be reclaimable;
+// this proves it against a real server, because every part of the answer is the
+// server's: `NOW() - INTERVAL … MICROSECOND`, whether `ON UPDATE` re-stamps, and
+// above all what `affectedRows` counts. This connector sends `CLIENT_FOUND_ROWS`,
+// so it counts rows MATCHED — a stub counting CHANGED rows would call the reclaim
+// a failure, and one counting matched rows would miss that the second claimer
+// needs the re-stamp in order to lose. Only MariaDB settles it.
+
+const CLAIM_REVERT = `
+  UPDATE event_run_resources
+     SET status = 'reverting', updated_at = NOW()
+   WHERE id = ?
+     AND (status IN ('pending', 'confirmed', 'orphaned', 'drifted')
+          OR (status = 'reverting'
+              AND updated_at < (NOW() - INTERVAL ? MICROSECOND)))`
+
+const claimRevert = async (id, ttlMs) =>
+  Number((await pool.query(CLAIM_REVERT, [id, ttlMs * 1000]))?.affectedRows || 0) > 0
+
+const ageResource = (id, seconds) =>
+  pool.query('UPDATE event_run_resources SET updated_at = NOW() - INTERVAL ? SECOND WHERE id = ?', [
+    seconds,
+    id,
+  ])
+
+test('a reverting row whose claim has gone stale is claimable again', async (t) => {
+  if (needDb(t)) return
+  // The Phase 16 walk's finding: a process killed mid-teardown leaves the row in
+  // `reverting` and nothing releases it. The sweep ran every 15s for ever finding
+  // nothing it could claim, `cleanup_status` never left `pending`, and the manual
+  // retry answered 200 while doing nothing — it claims through this statement too.
+  const run = await seedRun()
+  const id = await insertResource(run.runId, { status: 'reverting' })
+
+  // Fresh: somebody else really is mid-revert on it. Left alone.
+  assert.equal(await claimRevert(id, 900_000), false)
+
+  // Stale: the holder is not coming back.
+  await ageResource(id, 1800)
+  assert.equal(await claimRevert(id, 900_000), true)
+})
+
+test('reclaiming re-stamps, so the second claimer of one stale row loses', async (t) => {
+  if (needDb(t)) return
+  // Under CLIENT_FOUND_ROWS the four fresh statuses need no re-stamp — the winner
+  // moves the row out of `status IN (…)` and the loser stops matching. A stale
+  // `reverting` row has no such natural change, so without writing `updated_at`
+  // BOTH claimers would match it and two passes would revert the same resource.
+  const run = await seedRun()
+  const id = await insertResource(run.runId, { status: 'reverting' })
+  await ageResource(id, 1800)
+
+  assert.equal(await claimRevert(id, 900_000), true)
+  assert.equal(await claimRevert(id, 900_000), false, 'the re-stamp must make the second miss')
+})
+
+test('reclaiming a stale revert does not spend a retry attempt', async (t) => {
+  if (needDb(t)) return
+  // A stale claim is a process that died, not an attempt that failed. Counting it
+  // would burn MAX_REVERT_ATTEMPTS on crashes — Engagement Phase 14's rule, one
+  // table over.
+  const run = await seedRun()
+  const id = await insertResource(run.runId, { status: 'reverting' })
+  await ageResource(id, 1800)
+  await claimRevert(id, 900_000)
+  const [row] = await pool.query('SELECT revert_attempts FROM event_run_resources WHERE id = ?', [id])
+  assert.equal(Number(row.revert_attempts), 0)
+})
+
 test('an UPDATE that releases a row frees the target at once', async (t) => {
   if (needDb(t)) return
   // The generated column is STORED, so this is really asking whether MariaDB

server/test/moduleInstall.test.js

@@ -395,6 +395,79 @@ test('a failed upgrade leaves the previous version in place', async () => {
   assert.deepEqual(fs.readdirSync(tmpRoot), ['uo'])
 })
 
+// ── One module per site ────────────────────────────────────────────────────
+
+/** A second, different module's manifest and artifact, served beside the first. */
+function otherModuleRoutes(id = 'rust') {
+  const tarball = bundle({ id })
+  const artifact = `https://releases.example.com/mod/${id}-1.0.0.tar.gz`
+  const url = `https://releases.example.com/mod/${id}-1.0.0.json`
+  return {
+    url,
+    routes: {
+      [url]: manifestFor(tarball, { id, name: id, artifact: `${id}-1.0.0.tar.gz`, url: artifact }),
+      [artifact]: tarball,
+    },
+    artifact,
+  }
+}
+
+test('a second, different module is refused before anything is downloaded', async () => {
+  const first = goodRoutes()
+  await install.install({ url: MANIFEST_URL, hosts: HOSTS, fetchImpl: fakeFetch(first.routes) })
+
+  const other = otherModuleRoutes('rust')
+  const fetchImpl = fakeFetch(other.routes)
+  await assert.rejects(
+    () => install.install({ url: other.url, hosts: HOSTS, fetchImpl }),
+    (err) => {
+      assert.equal(err.name, 'InstallError')
+      // 409: nothing is wrong with the URL; the SITE is not in a state to take it.
+      assert.equal(err.status, 409)
+      assert.match(err.message, /already runs the module "uo"/)
+      assert.match(err.message, /remove it before installing "rust"/)
+      return true
+    },
+  )
+
+  // Refused on the manifest alone: the artifact was never fetched, and the
+  // volume holds exactly what it held before.
+  assert.ok(!fetchImpl.seen.includes(other.artifact), 'the artifact was not downloaded')
+  assert.deepEqual(fs.readdirSync(tmpRoot), ['uo'])
+})
+
+test('the same module is still an upgrade, and removing it frees the site for another', async () => {
+  const first = goodRoutes()
+  await install.install({ url: MANIFEST_URL, hosts: HOSTS, fetchImpl: fakeFetch(first.routes) })
+
+  // An upgrade of what is installed is exactly what the rule allows.
+  const second = goodRoutes({ version: '2.0.0', manifest: { version: '2.0.0' } })
+  second.routes[MANIFEST_URL] = manifestFor(second.tarball, { version: '2.0.0' })
+  const upgraded = await install.install({ url: MANIFEST_URL, hosts: HOSTS, fetchImpl: fakeFetch(second.routes) })
+  assert.equal(upgraded.replaced, true)
+
+  // And once it is gone, the site takes a different one.
+  await install.removeDir('uo')
+  const other = otherModuleRoutes('rust')
+  const result = await install.install({ url: other.url, hosts: HOSTS, fetchImpl: fakeFetch(other.routes) })
+  assert.equal(result.id, 'rust')
+  assert.deepEqual(install.installedIds(), ['rust'])
+})
+
+test('what counts as installed is what the loader would scan', () => {
+  // A real module, an install's scratch directory, a swap's aside copy and a
+  // directory with no module.json. Only the first is a module.
+  fs.mkdirSync(path.join(tmpRoot, 'uo'))
+  fs.writeFileSync(path.join(tmpRoot, 'uo', 'module.json'), '{}')
+  fs.mkdirSync(path.join(tmpRoot, '.install-rust-abc'))
+  fs.writeFileSync(path.join(tmpRoot, '.install-rust-abc', 'module.json'), '{}')
+  fs.mkdirSync(path.join(tmpRoot, 'uo.replaced-123'))
+  fs.writeFileSync(path.join(tmpRoot, 'uo.replaced-123', 'module.json'), '{}')
+  fs.mkdirSync(path.join(tmpRoot, 'notes'))
+
+  assert.deepEqual(install.installedIds(), ['uo'])
+})
+
 // ── The volume ─────────────────────────────────────────────────────────────
 
 test('moduleDir refuses an id that is not one', () => {

server/tools/cliloc-export/Program.cs

@@ -1,140 +0,0 @@
-// Cliloc export — converts a modern client's COMPRESSED Cliloc.enu into the
-// plain format the website can read (docs/website/CLILOCS.md).
-//
-// Why this exists at all: every current UO client ships its cliloc files in the
-// compressed "Mythic" format — the first DWORD's high byte is 0x8E — and the
-// plain layout the website parses is what those files looked like before that
-// change. Decompressing is a bit-level inverse-BWT coder that the site has no
-// business carrying at runtime, and ServUO's own bundled `Ultima.StringList`
-// cannot read it either (which is why `VendorSearch.GetItemName` is already
-// inert on such a shard, and why the shard cannot supply names instead).
-//
-// So the conversion happens ONCE, here, against a decompressor that already
-// exists and is maintained: UOFiddler's `Ultima.dll`.
-//
-// ── Why reflection rather than a project reference ────────────────────────
-//
-// UOFiddler ships as net10.0. Referencing it from a project built by an older
-// SDK fails at COMPILE time with CS1705 ("uses System.Runtime 10.0 which has a
-// higher version than referenced assembly"). Loading it reflectively moves that
-// question to run time, where `RollForward: LatestMajor` answers it — so this
-// builds on whatever SDK an operator happens to have and runs on the newest
-// runtime installed.
-//
-// ── Why not StringList.SaveStringList ────────────────────────────────────
-//
-// It looks like exactly the right method and it is not: it RE-COMPRESSES on
-// save, because its purpose is round-tripping a file back into the client. The
-// output is byte-identical to the compressed input. The plain records below are
-// written by hand for that reason.
-//
-// Usage:
-//   dotnet run -- <Ultima.dll> <Cliloc.enu> <output> [--tsv]
-//
-// Nothing produced by this tool is committed. See docs/website/CLILOCS.md.
-
-using System;
-using System.Collections;
-using System.IO;
-using System.Reflection;
-using System.Text;
-
-internal static class Program
-{
-    private static int Main(string[] args)
-    {
-        if (args.Length < 3)
-        {
-            Console.Error.WriteLine("usage: clilocexport <path-to-Ultima.dll> <cliloc-file> <output-file> [--tsv]");
-            Console.Error.WriteLine("  Ultima.dll ships with UOFiddler (https://github.com/polserver/UOFiddler).");
-            return 2;
-        }
-
-        var (ultimaDll, input, output) = (args[0], args[1], args[2]);
-        var asTsv = Array.IndexOf(args, "--tsv") >= 0;
-
-        // The language code only names the file when StringList resolves the path
-        // itself; here the path is explicit, so it is cosmetic.
-        var language = Path.GetExtension(input).TrimStart('.');
-        if (string.IsNullOrWhiteSpace(language)) language = "enu";
-
-        var assembly = Assembly.LoadFrom(Path.GetFullPath(ultimaDll));
-        var stringListType = assembly.GetType("Ultima.StringList")
-            ?? throw new InvalidOperationException("Ultima.StringList not found — is that really UOFiddler's Ultima.dll?");
-
-        // (language, path, decompress). `decompress: true` is the whole point;
-        // the loader falls back to a plain read on its own if the file turns out
-        // not to be compressed, so an already-converted file passes through.
-        var ctor = stringListType.GetConstructor(new[] { typeof(string), typeof(string), typeof(bool) })
-            ?? throw new InvalidOperationException("Unexpected Ultima.StringList API — this tool targets UOFiddler 4.21+.");
-
-        var stringList = ctor.Invoke(new object[] { language, Path.GetFullPath(input), true });
-
-        // A partial parse is reported rather than thrown. Surfacing it matters:
-        // the output would otherwise be a quietly short table, which is exactly
-        // the failure mode the website's parser refuses to import.
-        var warning = stringListType.GetProperty("LoadWarning")?.GetValue(stringList) as string;
-        if (!string.IsNullOrWhiteSpace(warning)) Console.Error.WriteLine("warning: " + warning);
-
-        var entries = (IEnumerable)stringListType.GetProperty("Entries")!.GetValue(stringList)!;
-        var entryType = assembly.GetType("Ultima.StringEntry")!;
-        var numberProp = entryType.GetProperty("Number")!;
-        var textProp = entryType.GetProperty("Text")!;
-        var flagProp = entryType.GetProperty("Flag")!;
-
-        int written = 0, skipped = 0, maxBytes = 0;
-
-        if (asTsv)
-        {
-            using var writer = new StreamWriter(output, false, new UTF8Encoding(false));
-            foreach (var entry in entries)
-            {
-                var number = (int)numberProp.GetValue(entry)!;
-                var text = (string?)textProp.GetValue(entry) ?? "";
-                maxBytes = Math.Max(maxBytes, Encoding.UTF8.GetByteCount(text));
-                // A tab or newline inside a cliloc string would break the row.
-                // Neither occurs in real tables, but silently emitting a broken
-                // file is worse than collapsing the whitespace.
-                writer.WriteLine($"{number}\t{text.Replace('\t', ' ').Replace('\r', ' ').Replace('\n', ' ')}");
-                written++;
-            }
-        }
-        else
-        {
-            using var stream = new FileStream(output, FileMode.Create, FileAccess.Write);
-            using var binary = new BinaryWriter(stream);
-            binary.Write(2);        // int32 — the plain-format version marker
-            binary.Write((short)1); // int16 — language marker
-
-            foreach (var entry in entries)
-            {
-                var number = (int)numberProp.GetValue(entry)!;
-                var text = (string?)textProp.GetValue(entry) ?? "";
-                var flag = Convert.ToByte(Convert.ToInt32(flagProp.GetValue(entry)));
-
-                var utf8 = Encoding.UTF8.GetBytes(text);
-                maxBytes = Math.Max(maxBytes, utf8.Length);
-
-                // The length field is 16 bits. Real tables peak around 12 KB, so
-                // this has never fired — but writing a truncated length would
-                // corrupt every record after it, so an oversize entry is dropped
-                // and counted instead.
-                if (utf8.Length > ushort.MaxValue) { skipped++; continue; }
-
-                binary.Write(number);
-                binary.Write(flag);
-                binary.Write((ushort)utf8.Length);
-                binary.Write(utf8);
-                written++;
-            }
-        }
-
-        Console.WriteLine($"wrote {written} entries to {output} (maxTextBytes={maxBytes}, skippedOversize={skipped})");
-        if (written == 0)
-        {
-            Console.Error.WriteLine("no entries were written — is that a cliloc file?");
-            return 1;
-        }
-        return 0;
-    }
-}

server/tools/cliloc-export/README.md

@@ -1,64 +0,0 @@
-# cliloc-export
-
-Converts a UO client's **compressed** `Cliloc.enu` into the plain format the
-website can read.
-
-This is a one-off operator utility, not part of the website build. Nothing in the
-Node application references it and CI never touches it. Full background —
-including why the conversion is necessary at all — is in
-[`docs/website/CLILOCS.md`](https://gitea.whitlocktech.com/RunicGateway/docs/src/branch/edge/website/CLILOCS.md).
-
-## The short version
-
-Every current UO client ships its cliloc files in the compressed "Mythic"
-container (the first DWORD's high byte is `0x8E`). The website parses the plain
-layout those files used before that change. Decompressing is an inverse-BWT coder
-that the site has no business carrying at runtime — and ServUO's own bundled
-`Ultima.StringList` cannot read it either, so the shard cannot supply item names
-on our behalf.
-
-So: convert once, here, using a decompressor that already exists and is already
-maintained — [UOFiddler](https://github.com/polserver/UOFiddler)'s `Ultima.dll`.
-
-## Usage
-
-```bash
-dotnet build -c Release
-
-# plain binary (recommended — exact)
-dotnet run -- "<UOFiddler>/Ultima.dll" "<UO client>/Cliloc.enu" /srv/uo-data/clilocs.plain
-
-# tab-delimited text (convenient; does not preserve leading/trailing whitespace)
-dotnet run -- "<UOFiddler>/Ultima.dll" "<UO client>/Cliloc.enu" /srv/uo-data/clilocs.tsv --tsv
-```
-
-Then point the site at the output: **Admin → Shard → cliloc path**, or the
-`UO_CLIENT_PATH` environment variable. The setting wins over the environment.
-
-Expected output for a stock English client:
-
-```
-wrote 123490 entries to /srv/uo-data/clilocs.plain (maxTextBytes=12150, skippedOversize=0)
-```
-
-The site stores ~67,500 of those — roughly half a cliloc table is empty strings
-for ids the client reserves and never uses.
-
-## Two implementation notes worth keeping
-
-**`Ultima.dll` is loaded reflectively, not referenced.** UOFiddler ships as
-net10.0; a project reference from an older SDK fails at *compile* time with
-CS1705. Reflection moves that to run time, where `RollForward: LatestMajor`
-answers it — so this builds on whatever SDK you have and runs on the newest
-runtime installed.
-
-**`StringList.SaveStringList` is not the export path**, despite looking exactly
-like it. It *re-compresses* on save, because its purpose is round-tripping a file
-back into the client — its output is byte-identical to its input. The plain
-records are written by hand for that reason.
-
-## Output is never committed
-
-UO's strings are EA's. `.gitignore` covers this project's build output and the
-conventional in-repo output location, but the supported arrangement is a path
-**outside** the repository entirely.

server/tools/cliloc-export/clilocexport.csproj

@@ -1,26 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk">
-
-  <!--
-    A one-off operator utility, not part of the website build. Nothing in the
-    Node application references it and CI never touches it; it exists so an
-    operator can convert their client's compressed cliloc file without clicking
-    through a GUI. See README.md and docs/website/CLILOCS.md.
-
-    TargetFramework is deliberately net8.0 — the OLDEST runtime this needs — so
-    it builds on whatever SDK an operator already has. UOFiddler's Ultima.dll is
-    net10.0 and is loaded reflectively at run time rather than referenced, which
-    is what keeps that version difference from being a compile error; the
-    RollForward below is what lets the resulting binary run on it.
-  -->
-  <PropertyGroup>
-    <OutputType>Exe</OutputType>
-    <TargetFramework>net8.0</TargetFramework>
-    <AssemblyName>clilocexport</AssemblyName>
-    <RootNamespace>ClilocExport</RootNamespace>
-    <Nullable>enable</Nullable>
-    <ImplicitUsings>disable</ImplicitUsings>
-    <RollForward>LatestMajor</RollForward>
-    <InvariantGlobalization>true</InvariantGlobalization>
-  </PropertyGroup>
-
-</Project>