CRYSTALBOUND LAUNCHER — 0.2.1 DEVELOPMENT CANDIDATE

This feature branch contains the Windows launcher, signed client updater, account
interface, and a small adaptation of the LandSandBoat game loader. It has not been
promoted to dev/live. The owner successfully launched the previous build through
Windower. This revision adds automatic Windows permission handling and download
authorization through game sign-in. On October 6 the owner confirmed successful
sign-in and game launch without a development access code on the updated laptop.

PLAYER PACKAGE
Extract the candidate into an already installed and updated US FINAL FANTASY XI
folder. Keep Crystalbound.exe and crystalbound.json together; local-feed packages
also need their release folder. Double-click Crystalbound.exe. If the selected
Windower requires administrator permission, Crystalbound requests Windows approval
before sign-in. Approve that prompt; canceling leaves an Allow game launch button
for retry. Options remain available to correct the Windower path. If needed,
right-click Crystalbound.exe and choose Run as administrator. Existing PlayOnline/FFXI
registration, Windower, and Microsoft Edge WebView2 Runtime are required.
Options selects the game folder, Windower.exe, an existing Windower profile,
resolution/window mode, and the home-network hairpin option. Existing profile
addons, plugins, input configuration, and frame rate remain in Windower.

With accountUpdates:true, sign in or create a game account in the launcher. On
successful sign-in it checks the client and installs approved managed-file updates
automatically before enabling Play. No development invitation is needed. This release
checks FFXiMain.dll and the primary file tables against the working laptop, then
hashes every managed custom file. It is NOT a full audit of every retail DAT.
Missing or mismatched baseline files require the official client installer/update.
The package only supplies the approved Qiqirn DAT and the background game bridge.

Before installation, close FFXI, xiloader, and Windower completely. Downloads are
staged and SHA-256 verified before files change. Original files are retained under
.crystalbound/transactions. An interrupted commit is recovered on the next check.
External edits encountered during recovery stop it for review instead of being
overwritten. Settings, screenshots, and addons are outside the updater allowlist.

The same GUI supports account creation, sign-in, password change, authenticator
setup/verification/removal, recovery-code replacement, and Play. Passwords are not
remembered. Separate short-lived game and download credentials stay in native
memory. The game session crosses a private
current-user pipe only after verifying the loader process. Auth uses TLS with a
pinned server certificate. The loader executable is a Windows-subsystem build;
its startup messages are relayed into the GUI instead of a console window.

FIRST TEST
Use the owner's gaming laptop first. Verify the displayed scan/release, installation
backup, login, launch through the existing profile, gestures/prayer, zoning, and
logout/relogin. Observe whether Windower itself shows any splash/update UI: its
--hide behavior is controlled upstream and needs verification on the real client.
Only after that test and owner approval should this be offered to another player.

DEVELOPMENT
Requires .NET SDK 10.0.401, VS C++ Build Tools (x86), CMake, Ninja, Python, and Git.
WebView2 SDK is pinned to 1.0.4258.31. The built launcher includes the .NET runtime.

  dotnet build Desktop/Crystalbound.Desktop.csproj
  dotnet run --project Tests/Crystalbound.Tests.csproj -- <Crystalbound.Game.exe>
  dotnet run --project Desktop.Tests/Crystalbound.Desktop.Tests.csproj -c Release
  node Tests/ui.cjs <playwright-module-folder> <test-output-folder>
  dotnet publish Desktop/Crystalbound.Desktop.csproj -c Release -o <output>

Build-Bridge.ps1 expects an x86 Native Tools shell. It fetches upstream commit
ceb79a0c905a575a5ab4caad093b9e9ab7ede17c and applies Bridge/prepare.py. Keep the
checkout clean before applying; rebuilding already prepared source uses cmake.

RELEASES
Tools is an owner/developer command-line utility, not a player application:
  dotnet run --project Tools -- keygen <private.pem> <public-key.txt>
  dotnet run --project Tools -- release <recipe.json> <private.pem> <payload> <feed>
  dotnet run --project Tools -- verify <crystalbound.json> <app-dir> <game-dir>

Keep signing keys outside Git and download directories. The manifest uses RSA-PSS
SHA-256 signatures, monotonically increasing per-channel sequences, expiry, and
content-addressed blobs. A rollback is a NEW approved sequence referencing older
known-good content. Do not replace a published release in place. Protect the
launcher/configuration download itself; its verification key is the trust anchor.

The original candidate reads its local release folder. Hosting/ now contains the
development service for updates-dev.aletheiagames.com, backed by the private
crystalbound-updates-dev R2 bucket. See Hosting/README.txt for deployment status,
sign-in authorization and publication. Online packages use an HTTPS feed
(redirects and HTTP refused). Set accountUpdates:true and requireUpdateAccessCode:false
after deploying the matching game-login extension. It issues a separate 15-minute
download ticket after normal password and configured authenticator verification.
The Worker verifies its signature and download-only development scope. Passwords
and game session hashes never go to Cloudflare. Tickets are not saved or sent into
the HTML interface. Sign-out clears both credentials; expired access requires a
fresh sign-in. Downloads retain signed-manifest and per-file hash verification.
Older invitation builds remain supported during the development transition.
Host only the immutable release/feed files; the local administration application
must remain private. NewsUrl can point at an HTTPS news.json exported by the server
control panel. A release key and server TLS pin belong in crystalbound.json; no
password or private signing key belongs there. Launcher self-updates now use a
separate signed public feed before sign-in, with verified backups, automatic
restart and failed-start recovery. See SELF-UPDATES.txt. Existing launchers below
0.2.0 need one manual replacement to enable it. Windows code signing remains
separate and is not yet implemented.

BRANCHES AND LICENSES
Feature -> dev -> live, with tests and owner approval at both promotions. A Git
push is source backup, not server/client deployment. Development packages are
not live releases. Ship corresponding source with the GPL game bridge.
See LICENSE and THIRD-PARTY-NOTICES.txt. The artwork is the approved generated
Crystalbound harbor illustration; it is separate from the game asset payload.
