Release v7.1.8

Kraken: a small first half of a block is valid (#477 )
The reference decoder needs 13 bytes for the whole chunk, seed included; we asked for 13 after the 8-byte seed and refused valid level-7 chunks with "chunk too short". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-19 02:20:02 -05:00 · 2026-10-18 23:14:40 -07:00 · 2026-10-18 23:14:32 -07:00 · 2026-10-18 22:53:13 -07:00 · 2026-10-18 22:52:57 -07:00 · 2026-10-18 22:52:57 -07:00
1932 changed files with 409421 additions and 74996 deletions
@@ -32,6 +32,9 @@ client/node_modules/
 # Docs, tests, scripts (not needed at runtime)
 docs/
 *.md
+# …except the two the web UI bundles (its FAQ and Changelog screens).
+!FAQ.md
+!CHANGELOG.md
 LICENSE*
 # ...but keep the vendored crate whole: its licences must travel with the
 # source we build from, and excluding them here would quietly drop the
@@ -6,6 +6,7 @@ body:
    attributes:
      value: |
        Thanks for taking the time to file a bug report!
+        The app's **More → Bug report** fills this in for you and saves a zip with the logs: drag that zip into this issue.
  - type: textarea
    id: what-happened
    attributes:
@@ -41,6 +42,11 @@ body:
    attributes:
      label: PS5 firmware
      placeholder: "e.g. 9.60, 5.10"
+  - type: textarea
+    id: payloads
+    attributes:
+      label: Other payloads loaded
+      description: Anything else running on the console (kstuff, ShadowMount+, etaHEN, ftpsrv, Payload Manager, ...), with versions if you know them.
  - type: textarea
    id: logs
    attributes:
@@ -53,3 +59,11 @@ body:
      label: Steps to reproduce
      description: If the bug is reproducible, list the exact steps.
      placeholder: "1. ...\n2. ...\n3. ..."
+  - type: dropdown
+    id: frequency
+    attributes:
+      label: How often does it happen?
+      options:
+        - Once
+        - Sometimes
+        - Every time
@@ -27,6 +27,7 @@

 If yes, which files:
 - [ ] README.md
+- [ ] CHANGELOG.md
 - [ ] TESTING.md
 - [ ] FAQ.md
 - [ ] bench/README.md
@@ -38,8 +39,8 @@ If yes, which files:
 ## Testing
 <!-- Describe the tests you ran -->

- [ ] `npm run validate`
- [ ] `npm run coverage`
+- [ ] `npm run validate` (CI also needs `cargo fmt --check` in `engine/` AND `client/src-tauri`)
+- [ ] `cargo test -p ava1-ctest -- --test-threads=1` (in `engine/`), `make test-payload`, and the retired-protocol check (see CONTRIBUTING.md)
 - [ ] Built PS5 payload successfully
 - [ ] Cross-platform CI target checks passed
 - [ ] Tested on real PS5 hardware
@@ -0,0 +1,48 @@
+name: ava1-soak
+
+# Weekly host soak (review 009 #2c): whole jobs (mixed small and large uploads with cancel and resume,
+# zip downloads, parked jobs reaped) against the real console C, built with ASan + UBSan + LSan, for
+# an hour. After every round the data layer's counters must be back at baseline: job table empty,
+# nothing unswept, no pack segments on disk, the open-descriptor count unchanged, memory bounded.
+# Not part of the PR gate.
+
+on:
+  schedule:
+    - cron: '17 3 * * 0'
+  workflow_dispatch:
+    inputs:
+      minutes:
+        description: 'Minutes to soak'
+        default: '60'
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  soak:
+    name: soak (ASan + UBSan)
+    runs-on: ubuntu-24.04
+    timeout-minutes: 150
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install clang + sanitizer runtimes
+        run: sudo apt-get update && sudo apt-get install -y clang libclang-rt-18-dev
+
+      - name: Soak
+        working-directory: engine
+        env:
+          CC: clang
+          AVA1_CTEST_SANITIZE: '1'
+          RUSTFLAGS: -Clinker=clang
+          ASAN_OPTIONS: detect_leaks=1
+          LSAN_OPTIONS: suppressions=${{ github.workspace }}/engine/crates/ava1-ctest/lsan.supp
+          AVA1_SOAK_MINUTES: ${{ github.event.inputs.minutes || '60' }}
+          AVA1_SOAK_RSS_MB: '512'
+        run: cargo test -p ava1-ctest --test soak -- --ignored --test-threads=1 --nocapture
@@ -27,7 +27,7 @@ on:
  push:
    tags: ['v*']
  pull_request:
-    paths: ['engine/**', 'client/**', '.github/workflows/docker-engine.yml']
+    paths: ['engine/**', 'client/**', 'payload/**', 'scripts/docker-smoke.sh', '.github/workflows/docker-engine.yml']
  workflow_dispatch:
    inputs:
      tag:
@@ -50,7 +50,9 @@ jobs:
  verify:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-24.04
-    timeout-minutes: 10
+    # A full engine (and, for the web UI, client) build: ~7-10 min on a good
+    # runner, so 10 cancelled ordinary runs (PR #338).
+    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v7

@@ -72,14 +74,25 @@ jobs:
          file: engine/Dockerfile
          platforms: linux/amd64
          push: false
+          # Load it so the smoke test below can run it.
+          load: true
+          tags: ps5upload-engine:smoke
          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-to: type=gha,mode=min
+
+      # Building proved nothing about whether the image works: 5.40.0 built
+      # fine and refused every request, had no /tmp for uploads and no
+      # writable home. Run it and check those.
+      - name: Smoke-test the image
+        run: scripts/docker-smoke.sh ps5upload-engine:smoke

  # ── PR gate for the webui image: same idea, root context + Dockerfile.webui ─
  verify-webui:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-24.04
-    timeout-minutes: 10
+    # A full engine (and, for the web UI, client) build: ~7-10 min on a good
+    # runner, so 10 cancelled ordinary runs (PR #338).
+    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v7

@@ -101,8 +114,13 @@ jobs:
          file: engine/Dockerfile.webui
          platforms: linux/amd64
          push: false
+          load: true
+          tags: ps5upload-engine-webui:smoke
          cache-from: type=gha,scope=webui
-          cache-to: type=gha,mode=max,scope=webui
+          cache-to: type=gha,mode=min,scope=webui
+
+      - name: Smoke-test the image
+        run: scripts/docker-smoke.sh ps5upload-engine-webui:smoke --webui

  # ── Resolve + validate the tag ONCE, hand the trusted values to build/merge ─
  # Centralizing this means the tag is regex-validated before it ever reaches a
@@ -157,6 +175,18 @@ jobs:
        with:
          ref: ${{ needs.resolve.outputs.tag }}

+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: client/package-lock.json
+
+      # make payload embeds the console web page (payload/Makefile: build/webui_page.c runs
+      # `npm run build:console` in client/), so the client's dependencies must be installed.
+      - name: Install client deps (console web page)
+        working-directory: client
+        run: npm ci --no-audit --no-fund
+
      - name: Install payload toolchain
        timeout-minutes: 12
        run: |
@@ -250,7 +280,7 @@ jobs:
          set -euo pipefail
          mkdir -p engine/crates/ps5upload-engine/payload
          cp -v /tmp/payload-elves/ps5upload.elf \
-                /tmp/payload-elves/dpi/ps5upload-installer.elf \
+                /tmp/payload-elves/installer/ps5upload-installer.elf \
                engine/crates/ps5upload-engine/payload/
          ls -la engine/crates/ps5upload-engine/payload/

@@ -267,6 +297,21 @@ jobs:
        with:
          images: ${{ env.IMAGE }}

+      # Same build, loaded locally and run before anything is pushed: a
+      # release tag can't be moved, so a broken image would need a new release.
+      - name: Build for the smoke test
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: engine/Dockerfile
+          platforms: ${{ matrix.platform }}
+          load: true
+          tags: ps5upload-smoke:local
+          cache-from: type=registry,ref=${{ env.IMAGE }}:buildcache-${{ env.PLATFORM_PAIR }}
+
+      - name: Smoke-test the image
+        run: scripts/docker-smoke.sh ps5upload-smoke:local
+
      - name: Build and push by digest
        id: push
        uses: docker/build-push-action@v7
@@ -276,8 +321,8 @@ jobs:
          platforms: ${{ matrix.platform }}
          labels: ${{ steps.meta.outputs.labels }}
          outputs: type=image,name=${{ env.IMAGE }},push-by-digest=true,name-canonical=true,push=true
-          cache-from: type=gha,scope=${{ env.PLATFORM_PAIR }}
-          cache-to: type=gha,mode=max,scope=${{ env.PLATFORM_PAIR }}
+          cache-from: type=registry,ref=${{ env.IMAGE }}:buildcache-${{ env.PLATFORM_PAIR }}
+          cache-to: type=registry,ref=${{ env.IMAGE }}:buildcache-${{ env.PLATFORM_PAIR }},mode=max

      - name: Export digest
        env:
@@ -338,7 +383,7 @@ jobs:
          set -euo pipefail
          mkdir -p engine/crates/ps5upload-engine/payload
          cp -v /tmp/payload-elves/ps5upload.elf \
-                /tmp/payload-elves/dpi/ps5upload-installer.elf \
+                /tmp/payload-elves/installer/ps5upload-installer.elf \
                engine/crates/ps5upload-engine/payload/
          ls -la engine/crates/ps5upload-engine/payload/

@@ -355,6 +400,21 @@ jobs:
        with:
          images: ${{ env.IMAGE }}

+      # Same build, loaded locally and run before anything is pushed: a
+      # release tag can't be moved, so a broken image would need a new release.
+      - name: Build for the smoke test
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: engine/Dockerfile.webui
+          platforms: ${{ matrix.platform }}
+          load: true
+          tags: ps5upload-smoke:local
+          cache-from: type=registry,ref=${{ env.IMAGE }}:buildcache-${{ env.PLATFORM_PAIR }}
+
+      - name: Smoke-test the image
+        run: scripts/docker-smoke.sh ps5upload-smoke:local --webui
+
      - name: Build and push by digest
        id: push
        uses: docker/build-push-action@v7
@@ -364,8 +424,8 @@ jobs:
          platforms: ${{ matrix.platform }}
          labels: ${{ steps.meta.outputs.labels }}
          outputs: type=image,name=${{ env.IMAGE }},push-by-digest=true,name-canonical=true,push=true
-          cache-from: type=gha,scope=webui-${{ env.PLATFORM_PAIR }}
-          cache-to: type=gha,mode=max,scope=webui-${{ env.PLATFORM_PAIR }}
+          cache-from: type=registry,ref=${{ env.IMAGE }}:buildcache-${{ env.PLATFORM_PAIR }}
+          cache-to: type=registry,ref=${{ env.IMAGE }}:buildcache-${{ env.PLATFORM_PAIR }},mode=max

      - name: Export digest
        env:
@@ -51,13 +51,13 @@ jobs:
        run: node scripts/update-version.js --check

  # ─────────────────────────────────────────────────────────────────────
-  # Rust workspace (engine + core + ftx2-proto). Format, clippy, tests.
+  # Rust workspace (engine, core, AVA1 crates). Format, clippy, tests.
  # Gates PRs that touch any Rust code.
  # ─────────────────────────────────────────────────────────────────────
  rust-engine:
    name: rust (engine workspace)
    runs-on: ubuntu-24.04
-    timeout-minutes: 30
+    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v7

@@ -66,15 +66,19 @@ jobs:
        with:
          components: rustfmt, clippy

-      - name: Cache cargo registry + target
-        uses: actions/cache@v6
+      # Restored on every run; saved (under a new key per run, so it stays current) only from
+      # main, where later runs can restore it. A PR's own cache would be visible to that PR only.
+      - name: Restore cargo cache
+        uses: actions/cache/restore@v6
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            engine/target
-          key: ${{ runner.os }}-engine-cargo-${{ hashFiles('engine/Cargo.lock') }}
-          restore-keys: ${{ runner.os }}-engine-cargo-
+          key: ${{ runner.os }}-engine-lint-${{ hashFiles('engine/Cargo.lock') }}-${{ github.run_id }}
+          restore-keys: |
+            ${{ runner.os }}-engine-lint-${{ hashFiles('engine/Cargo.lock') }}-
+            ${{ runner.os }}-engine-lint-

      - name: cargo fmt
        working-directory: engine
@@ -104,11 +108,253 @@ jobs:
        working-directory: engine
        run: cargo check -p ps5upload-engine --features webui

-      - name: cargo test
+      - name: Save cargo cache
+        if: github.ref == 'refs/heads/main'
+        uses: actions/cache/save@v6
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            engine/target
+          key: ${{ runner.os }}-engine-lint-${{ hashFiles('engine/Cargo.lock') }}-${{ github.run_id }}
+
+  # The workspace's tests, in two legs that run side by side: the engine crate (and the
+  # integration suite built on it) is about half of the time, everything else the other half.
+  # Together they are `cargo test --workspace --exclude ava1-ctest`; a crate added later lands
+  # in `libs` without anyone listing it.
+  rust-engine-tests:
+    name: rust tests (${{ matrix.part }})
+    runs-on: ubuntu-24.04
+    timeout-minutes: 40
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - part: engine
+            select: -p ps5upload-engine -p ps5upload-tests
+          - part: libs
+            select: --workspace --exclude ava1-ctest --exclude ps5upload-engine --exclude ps5upload-tests
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+
+      # Restored on every run; saved (under a new key per run, so it stays current) only from
+      # main, where later runs can restore it. A PR's own cache would be visible to that PR only.
+      - name: Restore cargo cache
+        uses: actions/cache/restore@v6
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            engine/target
+          key: ${{ runner.os }}-engine-test-${{ matrix.part }}-${{ hashFiles('engine/Cargo.lock') }}-${{ github.run_id }}
+          restore-keys: |
+            ${{ runner.os }}-engine-test-${{ matrix.part }}-${{ hashFiles('engine/Cargo.lock') }}-
+            ${{ runner.os }}-engine-test-${{ matrix.part }}-
+
+      - name: Install cargo-nextest
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-nextest
+
+      # nextest runs the test binaries side by side (cargo test runs them one at a time, and most
+      # of these sit in network sleeps); doctests, which nextest does not run, follow separately.
+      # Timing-sensitive binaries are serialized by engine/.config/nextest.toml.
+      # Bounded per step: a hung test fails here in minutes instead of holding the job.
+      - name: cargo nextest
        working-directory: engine
+        timeout-minutes: 25
        env:
          RUST_BACKTRACE: 1
-        run: cargo test --workspace -- --nocapture
+        run: cargo nextest run --profile ci ${{ matrix.select }}
+
+      - name: cargo test --doc
+        working-directory: engine
+        timeout-minutes: 10
+        run: cargo test --doc ${{ matrix.select }}
+
+      - name: Save cargo cache
+        if: github.ref == 'refs/heads/main'
+        uses: actions/cache/save@v6
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            engine/target
+          key: ${{ runner.os }}-engine-test-${{ matrix.part }}-${{ hashFiles('engine/Cargo.lock') }}-${{ github.run_id }}
+
+  # The C interop suite. The C server and the data layer are process-wide singletons, so the
+  # suite runs one test at a time: a test that holds the server cannot starve the others. That
+  # rule holds inside one machine, so the test files are dealt across four machines, each still
+  # running its share one at a time.
+  rust-ctest:
+    name: rust (ava1 C interop ${{ matrix.shard }}/4)
+    runs-on: ubuntu-24.04
+    timeout-minutes: 40
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4]
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+
+      # Restored on every run; saved (under a new key per run, so it stays current) only from
+      # main, where later runs can restore it. A PR's own cache would be visible to that PR only.
+      - name: Restore cargo cache
+        uses: actions/cache/restore@v6
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            engine/target
+          key: ${{ runner.os }}-engine-ctest-${{ hashFiles('engine/Cargo.lock') }}-${{ github.run_id }}
+          restore-keys: |
+            ${{ runner.os }}-engine-ctest-${{ hashFiles('engine/Cargo.lock') }}-
+            ${{ runner.os }}-engine-ctest-
+
+      - name: cargo test (ava1 C interop, serial)
+        working-directory: engine
+        timeout-minutes: 25
+        env:
+          RUST_BACKTRACE: 1
+          SHARD: ${{ matrix.shard }}
+        run: |
+          # Every test file, sorted, dealt round-robin: file N goes to shard (N mod 4) + 1.
+          # A file added later is picked up by one of the four without being listed anywhere.
+          mapfile -t all < <(ls crates/ava1-ctest/tests/*.rs | sort)
+          args=()
+          for i in "${!all[@]}"; do
+            if [ $(( i % 4 + 1 )) -eq "$SHARD" ]; then
+              args+=(--test "$(basename "${all[$i]}" .rs)")
+            fi
+          done
+          [ "${#args[@]}" -gt 0 ] || { echo "::error::shard $SHARD got no test files"; exit 1; }
+          echo "shard $SHARD of 4: ${#args[@]} of ${#all[@]} test files"
+          cargo test -p ava1-ctest "${args[@]}" -- --test-threads=1
+
+      - name: Save cargo cache
+        if: github.ref == 'refs/heads/main'
+        uses: actions/cache/save@v6
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            engine/target
+          key: ${{ runner.os }}-engine-ctest-${{ hashFiles('engine/Cargo.lock') }}-${{ github.run_id }}
+
+  # ─────────────────────────────────────────────────────────────────────
+  # AVA1: C/Rust conformance + interop runs in rust-engine-tests and rust-ctest
+  # above. This job adds what those cannot:
+  # fuzzing the C decoders and data-plane parsers under ASan/UBSan and the
+  # Rust decoders with cargo-fuzz.
+  # ─────────────────────────────────────────────────────────────────────
+  ava1:
+    name: ava1 (fuzz C + Rust decoders)
+    runs-on: ubuntu-24.04
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install clang + libFuzzer
+        run: sudo apt-get update && sudo apt-get install -y clang libclang-rt-18-dev
+
+      - name: C frame AEAD (RFC 8439 + Monocypher differential, AVX2 and portable paths)
+        run: scripts/ava1-aead-test.sh
+
+      - name: No FTX2 or ports 9113/9114 in the repository
+        run: make check-no-ftx2
+
+      - name: Fuzz C decoders + data-plane parsers (60 s each)
+        env:
+          AVA1_FUZZ_SECONDS: 60
+        run: make ava1-fuzz-c
+
+      - name: Install Rust nightly + cargo-fuzz
+        run: |
+          rustup toolchain install nightly --profile minimal
+          cargo install cargo-fuzz --locked
+
+      - name: Fuzz Rust decoders (60 s + 30 s)
+        working-directory: engine/crates/ava1/fuzz
+        run: |
+          cargo +nightly fuzz run decode -- -max_total_time=60
+          cargo +nightly fuzz run frame_header -- -max_total_time=30
+
+  # ─────────────────────────────────────────────────────────────────────
+  # AVA1 sanitizers (review 009 #2a): the whole ctest suite, i.e. every console C path the host can run,
+  # with ASan + UBSan (+ LSan on Linux) on every C unit. A leak, use-after-free, overflow or UB in the
+  # payload C fails here instead of on a console with no debugger. Slow on purpose.
+  # engine/crates/ava1-ctest/lsan.supp lists the tests that exit on purpose, each with its reason.
+  # ─────────────────────────────────────────────────────────────────────
+  ava1-ctest-sanitize:
+    name: ava1-ctest (ASan + UBSan)
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    # Four shards, test files dealt round-robin exactly like rust-ctest: the serial sanitized run
+    # was ~15 min on one runner.
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4]
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install Rust stable
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install clang + sanitizer runtimes
+        run: sudo apt-get update && sudo apt-get install -y clang libclang-rt-18-dev
+
+      # Restored on every run; saved (under a new key per run, so it stays current) only from
+      # main, where later runs can restore it. A PR's own cache would be visible to that PR only.
+      - name: Restore cargo cache
+        uses: actions/cache/restore@v6
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            engine/target
+          key: ${{ runner.os }}-ava1-san-${{ hashFiles('engine/Cargo.lock') }}-${{ github.run_id }}
+          restore-keys: |
+            ${{ runner.os }}-ava1-san-${{ hashFiles('engine/Cargo.lock') }}-
+            ${{ runner.os }}-ava1-san-
+
+      - name: cargo test -p ava1-ctest (sanitized, serial)
+        working-directory: engine
+        env:
+          CC: clang
+          AVA1_CTEST_SANITIZE: '1'
+          RUSTFLAGS: -Clinker=clang
+          ASAN_OPTIONS: detect_leaks=1
+          LSAN_OPTIONS: suppressions=${{ github.workspace }}/engine/crates/ava1-ctest/lsan.supp:print_suppressions=0
+          RUST_BACKTRACE: 1
+          SHARD: ${{ matrix.shard }}
+        run: |
+          mapfile -t all < <(ls crates/ava1-ctest/tests/*.rs | sort)
+          args=()
+          for i in "${!all[@]}"; do
+            if [ $(( i % 4 + 1 )) -eq "$SHARD" ]; then
+              args+=(--test "$(basename "${all[$i]}" .rs)")
+            fi
+          done
+          [ "${#args[@]}" -gt 0 ] || { echo "::error::shard $SHARD got no test files"; exit 1; }
+          echo "sanitized shard $SHARD of 4: ${#args[@]} of ${#all[@]} test files"
+          cargo test -p ava1-ctest "${args[@]}" -- --test-threads=1
+
+      - name: Save cargo cache
+        if: github.ref == 'refs/heads/main'
+        uses: actions/cache/save@v6
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            engine/target
+          key: ${{ runner.os }}-ava1-san-${{ hashFiles('engine/Cargo.lock') }}-${{ github.run_id }}

  # ─────────────────────────────────────────────────────────────────────
  # Engine/core target portability. This is intentionally separate from
@@ -231,22 +477,25 @@ jobs:
            clang \
            libclang-dev

-      - name: Cache cargo target
-        uses: actions/cache@v6
+      # Restored on every run; saved (under a new key per run, so it stays current) only from
+      # main, where later runs can restore it. A PR's own cache would be visible to that PR only.
+      - name: Restore cargo cache
+        uses: actions/cache/restore@v6
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            client/src-tauri/target
-          key: ${{ matrix.os }}-desktop-cargo-${{ hashFiles('client/src-tauri/Cargo.lock') }}
-          restore-keys: ${{ matrix.os }}-desktop-cargo-
+          key: ${{ runner.os }}-desktop-${{ matrix.os }}-${{ hashFiles('client/src-tauri/Cargo.lock') }}-${{ github.run_id }}
+          restore-keys: |
+            ${{ runner.os }}-desktop-${{ matrix.os }}-${{ hashFiles('client/src-tauri/Cargo.lock') }}-
+            ${{ runner.os }}-desktop-${{ matrix.os }}-

      # tauri.conf.json bundles two out-of-tree resources: the PS5
      # payload (ps5upload.elf.gz) and the engine sidecar binary.
      # cargo check parses those resource paths and errors out if
      # anything is missing, long before any code compiles. Stub the
-      # payload .gz and build the engine binary for real so its target
-      # path exists.
+      # payload .gz and the engine binary (see the next step).
      #
      # The stub is a *fake ELF* (ELF magic + 200 KB of zeros, gzipped),
      # not an empty gzip: `cargo test` runs probes.rs::
@@ -263,14 +512,19 @@ jobs:
          { printf '\x7fELF'; head -c 204800 /dev/zero; } > payload/ps5upload.elf
          gzip -nf payload/ps5upload.elf   # -> payload/ps5upload.elf.gz

-      - name: Build engine sidecar (needed as a Tauri resource)
-        working-directory: engine
-        run: cargo build --release -p ps5upload-engine
-
-      - name: cargo check
-        working-directory: client/src-tauri
-        run: cargo check --all-targets
+      # The desktop shell only include_bytes! the engine binary (it is extracted and started at
+      # run time, which no test here does), so a placeholder at the same path is enough. The real
+      # engine is built and checked by the rust-engine jobs; releases build it in publish.yml.
+      # Building it here cost 4-9 min per OS.
+      - name: Stub engine sidecar (needed as a Tauri resource)
+        shell: bash
+        run: |
+          mkdir -p engine/target/release
+          exe=engine/target/release/ps5upload-engine
+          [ "$RUNNER_OS" = "Windows" ] && exe="$exe.exe"
+          printf 'engine stub for CI\n' > "$exe"

+      # No separate `cargo check --all-targets`: clippy --all-targets type-checks the same code.
      - name: cargo clippy
        working-directory: client/src-tauri
        run: cargo clippy --all-targets -- -D warnings
@@ -281,6 +535,16 @@ jobs:
          RUST_BACKTRACE: 1
        run: cargo test

+      - name: Save cargo cache
+        if: github.ref == 'refs/heads/main'
+        uses: actions/cache/save@v6
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            client/src-tauri/target
+          key: ${{ runner.os }}-desktop-${{ matrix.os }}-${{ hashFiles('client/src-tauri/Cargo.lock') }}-${{ github.run_id }}
+
  # ─────────────────────────────────────────────────────────────────────
  # Client frontend — TypeScript typecheck, ESLint, Vitest, Vite build.
  # ─────────────────────────────────────────────────────────────────────
@@ -368,14 +632,18 @@ jobs:
  # ─────────────────────────────────────────────────────────────────────
  coverage:
    name: coverage reports
+    # A report, not a gate (pr-gate does not need it): ~35 min of instrumented tests is not worth
+    # holding a runner on every PR. Pushes to main and manual runs still produce it.
+    if: github.event_name != 'pull_request'
    runs-on: ubuntu-24.04
    # `continue-on-error` below does NOT cover the timeout: a job that hits
    # `timeout-minutes` is reported as *cancelled*, which cancels the whole
    # run and leaves main red over a job that is explicitly not a gate. It
    # reached 20m17s on 2026-09-16 against a 16m02s green run the day
    # before, so the headroom here is deliberate — keep it well clear of
-    # the real runtime as the test suite grows.
-    timeout-minutes: 40
+    # the real runtime as the test suite grows. On 2026-10-06 one test pass took
+    # ~34 min under instrumentation (scripts/coverage.mjs now runs the suite once).
+    timeout-minutes: 60
    # Reporting job — not a gate. cargo-llvm-cov occasionally trails
    # rustc's profraw format version (we hit "raw profile version
    # mismatch: ... expected version = 9" when rustc bumped to v10),
@@ -428,6 +696,18 @@ jobs:
    steps:
      - uses: actions/checkout@v7

+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: client/package-lock.json
+
+      # make payload embeds the console web page (payload/Makefile: build/webui_page.c runs
+      # `npm run build:console` in client/), so the client's dependencies must be installed.
+      - name: Install client deps (console web page)
+        working-directory: client
+        run: npm ci --no-audit --no-fund
+
      - name: Install payload toolchain
        timeout-minutes: 12
        run: |
@@ -493,6 +773,8 @@ jobs:
            echo "::error::payload ELF is smaller than expected — build may have failed silently"
            exit 1
          fi
+          # AVA1: the engine stamps its key into exactly one trust slot (SPEC.md §5.1).
+          python3 -c "d=open('payload/ps5upload.elf','rb').read(); n=d.count(b'AVA1TRUST'); assert n==1, n"
          dpi_size_bytes=$(stat -c '%s' payload/installer/ps5upload-installer.elf)
          echo "ps5upload-installer.elf: ${dpi_size_bytes} bytes"
          if [ "$dpi_size_bytes" -lt 50000 ]; then
@@ -533,15 +815,19 @@ jobs:
        with:
          targets: aarch64-linux-android,armv7-linux-androideabi

-      - name: Cache cargo target
-        uses: actions/cache@v6
+      # Restored on every run; saved (under a new key per run, so it stays current) only from
+      # main, where later runs can restore it. A PR's own cache would be visible to that PR only.
+      - name: Restore cargo cache
+        uses: actions/cache/restore@v6
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            client/src-tauri/target
-          key: ${{ runner.os }}-android-cargo-${{ hashFiles('client/src-tauri/Cargo.lock') }}
-          restore-keys: ${{ runner.os }}-android-cargo-
+          key: ${{ runner.os }}-android-${{ hashFiles('client/src-tauri/Cargo.lock') }}-${{ github.run_id }}
+          restore-keys: |
+            ${{ runner.os }}-android-${{ hashFiles('client/src-tauri/Cargo.lock') }}-
+            ${{ runner.os }}-android-

      # Gradle's dependency cache.
      #
@@ -617,12 +903,6 @@ jobs:
        working-directory: client
        run: npx tauri android init

-      # `android init` seeds placeholder launcher icons; re-apply ours so
-      # the Android app icon matches the desktop app icon.
-      - name: Apply app icon
-        working-directory: client
-        run: npx tauri icon src-tauri/icons/sources/macos_squircle_1024.png
-
      # Keep the manifest patch in the build-verification path too, so a
      # regression in android-postinit-patch.sh is caught by CI (release
      # parity; the loopback + backup config is harmless for debug).
@@ -641,6 +921,16 @@ jobs:
          if-no-files-found: error
          retention-days: 7

+      - name: Save cargo cache
+        if: github.ref == 'refs/heads/main'
+        uses: actions/cache/save@v6
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            client/src-tauri/target
+          key: ${{ runner.os }}-android-${{ hashFiles('client/src-tauri/Cargo.lock') }}-${{ github.run_id }}
+
  # ─────────────────────────────────────────────────────────────────────
  # Aggregate gate. One stable check that turns green only when every
  # required job above succeeded. Branch protection on `main` requires
@@ -662,6 +952,10 @@ jobs:
    needs:
      - version-sync
      - rust-engine
+      - rust-engine-tests
+      - rust-ctest
+      - ava1
+      - ava1-ctest-sanitize
      - rust-engine-targets
      - rust-desktop
      - client-frontend
@@ -0,0 +1,61 @@
+name: pages
+
+# The website (site/) on GitHub Pages: https://phantomptr.github.io/ps5upload/
+#
+# The page reads GitHub's releases API live in the visitor's browser, so a new release shows
+# up without a deploy. Each deploy also writes site/releases.json, the copy the page falls
+# back on when the API can't be reached (offline, or GitHub's anonymous rate limit).
+#
+# When it deploys:
+# - a change to site/ (or this file) on main;
+# - after the publish workflow finishes;
+# - once a day, so the snapshot never drifts far (this is what picks up a pre-release promoted
+#   by hand; the page itself reads the releases API live, so visitors see it at once);
+# - by hand (Actions → pages → Run workflow).
+
+on:
+  push:
+    branches: [main]
+    paths: ["site/**", "scripts/site-releases.mjs", ".github/workflows/pages.yml"]
+  workflow_run:
+    workflows: [publish]
+    types: [completed]
+  # No `release` trigger: that run's ref is the tag, and the github-pages environment only
+  # deploys from main, so it was always rejected ("Tag ... is not allowed to deploy").
+  schedule:
+    - cron: "17 6 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    runs-on: ubuntu-24.04
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: main
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+      - name: Snapshot the releases (fallback for the page)
+        run: node scripts/site-releases.mjs
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GITHUB_TOKEN: ${{ github.token }}
+      - uses: actions/configure-pages@v6
+      - uses: actions/upload-pages-artifact@v5
+        with:
+          path: site
+      - id: deployment
+        uses: actions/deploy-pages@v5
@@ -67,6 +67,8 @@ jobs:
      - uses: actions/setup-node@v7
        with:
          node-version: 22
+          cache: npm
+          cache-dependency-path: client/package-lock.json
      - name: Sync version from VERSION
        run: node scripts/update-version.js

@@ -99,6 +101,12 @@ jobs:
      - name: Install pinned PS5 Payload SDK
        run: sudo env PS5_SDK_INSTALL_DIR=/opt/ps5-payload-sdk bash scripts/install-ps5-sdk.sh

+      # make payload embeds the console web page (payload/Makefile: build/webui_page.c runs
+      # `npm run build:console` in client/), so the client's dependencies must be installed.
+      - name: Install client deps (console web page)
+        working-directory: client
+        run: npm ci --no-audit --no-fund
+
      - name: Build payload ELF
        env:
          PS5_PAYLOAD_SDK: /opt/ps5-payload-sdk
@@ -136,7 +144,9 @@ jobs:
    name: build-client-${{ matrix.platform }}-${{ matrix.arch }}
    needs: build-payload
    runs-on: ${{ matrix.os }}
-    timeout-minutes: 45
+    # The Intel macOS runner took ~33 min for v5.35/5.36 and ran past 45 on
+    # v5.37.0, cancelling the whole release (create-release needs every build).
+    timeout-minutes: 75
    strategy:
      fail-fast: false
      matrix:
@@ -186,16 +196,9 @@ jobs:
        with:
          targets: ${{ matrix.rust_target }}

-      - name: Cache cargo target
-        uses: actions/cache@v6
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            client/src-tauri/target
-          key: ${{ runner.os }}-${{ matrix.arch }}-tauri-${{ hashFiles('client/src-tauri/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-${{ matrix.arch }}-tauri-
+      # No cargo cache here: release runs are tag runs, and a cache a tag run saves is visible to
+      # that tag only, so saving never helped a later release (it filled the shared 10 GiB and
+      # evicted CI's caches); and CI's debug clippy/test caches don't match this release build.

      # Bounded and retried on purpose. During the v5.3.3 publish this step
      # stalled inside apt for 45 minutes, ate the whole job budget, and took
@@ -574,12 +577,6 @@ jobs:
        working-directory: client
        run: npx tauri android init

-      # `android init` seeds placeholder launcher icons; re-apply ours so
-      # the released Android app icon matches the desktop app icon.
-      - name: Apply app icon
-        working-directory: client
-        run: npx tauri icon src-tauri/icons/sources/macos_squircle_1024.png
-
      # Post-init manifest patches: (1) loopback-only cleartext so the
      # renderer can reach the in-process engine in release builds
      # (otherwise the engine shows "red"), and (2) backup rules so user
@@ -0,0 +1,55 @@
+# Cuts a release from GitHub instead of a local clone: creates the annotated
+# `vX.Y.Z` tag that scripts/release.sh would push, at the commit this run was
+# dispatched on, then dispatches publish.yml for it.
+#
+#   gh workflow run release-tag.yml --ref main
+#
+# A tag pushed with GITHUB_TOKEN does not trigger `push: tags` workflows, so
+# publish.yml is dispatched explicitly (workflow_dispatch is exempt from that
+# rule). The tag is VERSION's; a run whose VERSION already has a tag stops.
+name: release-tag
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  actions: write
+
+concurrency:
+  group: release-tag
+  cancel-in-progress: false
+
+jobs:
+  tag:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Create and push the tag
+        id: tag
+        run: |
+          version="$(tr -d '[:space:]' < VERSION)"
+          if ! echo "$version" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "::error::VERSION '$version' is not X.Y.Z"
+            exit 1
+          fi
+          tag="v$version"
+          if git ls-remote --exit-code --tags origin "refs/tags/$tag" >/dev/null; then
+            echo "::error::$tag already exists"
+            exit 1
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git tag -a "$tag" -m "$tag" "$GITHUB_SHA"
+          git push origin "refs/tags/$tag"
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+          echo "Tagged $GITHUB_SHA as $tag"
+
+      - name: Dispatch publish
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: gh workflow run publish.yml --ref "$TAG" -f tag="$TAG"
@@ -12,7 +12,7 @@ desktop.ini
 .aider*

 # ─── Node / pnpm / yarn ──────────────────────────────────────────────────
-node_modules/
+node_modules
 .pnp
 .pnp.*
 .yarn/*
@@ -53,6 +53,7 @@ scripts/.translate-cache.json

 # ─── Client (Vite / Tauri) ───────────────────────────────────────────────
 client/dist/
+client/dist-console/
 client/.vite/
 client/out/
 client/.cache/
@@ -72,9 +73,7 @@ tests/lab/elev_probe/*.elf

 # ─── Bench artefacts (generated on demand) ───────────────────────────────
 bench/fixtures/
-bench/results/
 bench/reports/
-bench/baselines/*.tmp

 # ─── Logs / debug dumps ──────────────────────────────────────────────────
 # Anchor `logs/` and `debug/` to the repo root so the patterns don't
@@ -148,6 +147,7 @@ playwright-report/
 test-results/
 /output/playwright/
 /output/research-*/
+/output/validate/
 /.playwright-cli/

 # ─── Dev screenshots / debug captures ────────────────────────────────────
@@ -160,7 +160,7 @@ test-results/
 #
 # So ignore image/video files AT THE ROOT by default and name the
 # exceptions. Anchored with a leading slash, so real assets under
-# client/icons/, client/public/ and client/src-tauri/icons/ are untouched.
+# client/public/ and client/src-tauri/icons/ are untouched.
 /*.png
 /*.jpg
 /*.jpeg
@@ -195,7 +195,7 @@ ps5upload.elf.gz.blake3.tmp

 # ─── Built payload artifacts ────────────────────────────────────────────
 # CI rebuilds these from C source on every release (see
-# .github/workflows/release.yml: "make payload" step). Tracking them
+# .github/workflows/publish.yml: "make payload" step). Tracking them
 # caused two recurring problems:
 #   1. Binary churn: contributors who run `make payload` locally get a
 #      diff-noise commit they have to revert (hit twice in 2.8.0 dev).
@@ -248,8 +248,8 @@ payload/sqlite3.o
 # developer's own console for backport work. NEVER committed: these are Sony
 # binaries, and every comparable project (BackPork, Backport Kitchen,
 # Auto-Backpork, MacPork) refuses to redistribute them for the same reason.
-# Populate with scripts/gather-fakelibs.py; the tool sources them from the
-# user's own games at runtime.
+# The app gathers them itself (Backport > Scan this console) from the user's
+# own games, into ~/.ps5upload/fakelibs.
 fakelibs/

 # Brainstorming mockups (visual companion)
@@ -257,3 +257,14 @@ fakelibs/

 # ─── Local-only docs (specs, plans, research — kept off GitHub) ──────────
 docs/
+
+# Intermediate objects of the vendored elfldr build (its ELF is tracked).
+third_party/elfldr/*.o
+third_party/elfldr/socksrv.elf
+third_party/elfldr/bootstrap.elf
+
+# Our build of the PS5 SDK startup code (payload/sdk-crt.mk)
+payload/third_party/sdk-crt/build/
+
+# ─── Release announcement drafts (make release-post) ─────────────────────
+.release_posts/
@@ -12,7 +12,7 @@ same way.
 3. Make your change, keeping it focused — one logical change per PR.
 4. **Run the quality gate locally** (see below) until it's green.
 5. Open a **pull request** against `phantomptr/ps5upload:main` and fill out
-   the PR template (`.github/PULL_REQUEST_TEMPLATE.md`).
+   the PR template.

 Every PR is gated by CI (the **`PR gate`** check) and reviewed by the code
 owner before it can merge. PRs are squash-merged, so your branch becomes a
@@ -29,27 +29,38 @@ make run-client  # launch the Tauri dev app
 See the [README](README.md) and [TESTING.md](TESTING.md) for the full
 toolchain (PS5 Payload SDK, Rust, Node 22, Tauri prerequisites).

-## Quality gate — run before opening a PR
+The PS5 Payload SDK release is pinned in `scripts/ps5-sdk.env`. `make update-sdk`
+moves the pin to the latest upstream release and installs it (`SDK_TAG=vX.Y` for a
+specific one, `SDK_CHECK=1` to only check); see TESTING.md, Layer 2.

-CI runs the same checks; running them locally first saves a round-trip:
+## Quality gate: run before opening a PR
+
+CI runs the same checks; running them locally first saves a round-trip.
+`npm run validate` runs most of it in one command (version sync, script checks, i18n,
+engine and desktop fmt/clippy/tests, client typecheck/lint/tests/build). The complete gate is
+these, and `cargo fmt --check` must pass in BOTH `engine/` and `client/src-tauri`:

 ```bash
-npm run validate        # lints + unit/integration tests + typecheck + i18n + build
+( cd engine && cargo fmt --all -- --check )       # fmt in BOTH workspaces
+( cd client/src-tauri && cargo fmt --all -- --check )
+( cd engine && cargo clippy --workspace -- -D warnings )
+( cd engine && cargo test --workspace )
+( cd engine && cargo test -p ava1-ctest -- --test-threads=1 )
+make test-payload                                 # needs PS5_PAYLOAD_SDK
+make check-no-ftx2                                # the retired protocol must stay gone
+( cd client && npm run lint && npm run typecheck && npm test && npm run build:vite )
+npm run i18n:check                                # from the repo root
 ```

-`npm run validate` covers, across all three layers:
-
- **Lints** — `cargo fmt`/`clippy` (engine + Tauri shell), ESLint, `tsc`,
-  script syntax/audit, and the i18n coverage gate.
- **Unit + integration tests** — `cargo test --workspace` (protocol, core,
-  engine, pkg, and the mock-FTX2 integration tests — no PS5 required),
-  the Tauri shell tests, and the client Vitest suite.
+`ava1-ctest` builds the payload's AVA1 C on the host and tests it against the Rust side, so no
+PS5 is needed. `check-no-ftx2` fails if the old protocol name or ports 9113/9114 reappear
+outside the changelog and a short list of exceptions in the Makefile.

 Other useful targets:

 ```bash
 make test               # script + engine + payload + client checks
-npm run validate:full   # adds the payload ELF build (needs PS5_PAYLOAD_SDK)
+npm run validate:full   # adds the payload ELF build and self-tests
 npm run coverage        # frontend + Rust coverage reports
 ```

@@ -96,7 +96,18 @@ claims, liabilities, damages, losses, and expenses, including
 reasonable legal fees, arising out of or in any way connected with your
 use or misuse of the Software or your violation of these terms.

-## 8. Severability and governing terms
+## 8. Development process
+
+The Software is developed with AI coding tools ("vibe-coded"), directed
+and tested by its maintainer. This is a deliberate choice to keep a fast
+development cycle and a short turnaround on bug reports, feature
+requests and enhancements. It also means the code has not received the
+extended, line-by-line human review that a conventionally written
+project of comparable size would. Releases are tested on real consoles
+before publication, but defects may remain. You accept the Software on
+that basis and use it at your own discretion.
+
+## 9. Severability and governing terms

 If any provision of this disclaimer is held to be unenforceable or
 invalid, that provision shall be limited or eliminated to the minimum
@@ -109,7 +120,7 @@ distributed. See [LICENSE](LICENSE). Where this disclaimer and the
 licence differ on warranty and liability, the broader exclusion
 applies to the maximum extent permitted by applicable law.

-## 9. If you do not agree
+## 10. If you do not agree

 If you do not agree with any part of this disclaimer, **do not
 download, build, install, or use the Software**, and delete any copy in
@@ -2,17 +2,12 @@
 #
 # Tree layout (current):
 #   payload/   — PS5 C payload (FreeBSD 11)
-#   engine/    — Rust workspace: ftx2-proto, ps5upload-core, -engine HTTP service,
-#                -lab CLI, -tests mock server, -bench, -pkg
+#   engine/    — Rust workspace: ava1, ps5upload-core, -ava1, -engine HTTP service,
+#                -lab CLI, -tests, -pkg
 #   client/    — Tauri 2 desktop app, cross-platform (Linux/macOS/Windows, x64+arm64)
 #   tests/     — root integration smoke + tests/lab/ (real-hardware shell scripts)
-#   bench/     — golden workloads, baselines, perf-gate helpers
+#   bench/     — hardware sweep, golden workloads and profiles
 #   scripts/   — install + dev helpers (one per OS, plus shared mjs utilities)
-#
-# Retired pre-2.1: app/ (browser server), shared/ (legacy JS modules),
-# ui/ (empty scaffold), client/electron/ (Tauri replaces Electron),
-# specs/ (consolidated into in-tree doc comments + CHANGELOG), tools/
-# (folded into scripts/). The 1.x C payload was already gone pre-rename.

 JOBS ?= $(shell getconf _NPROCESSORS_ONLN 2>/dev/null || nproc 2>/dev/null || echo 4)
 # `npm ci` — NOT `npm install`. The lockfile carries `libc` fields that select
@@ -35,14 +30,14 @@ export PS5_PAYLOAD_SDK
 PS5_SDK_TAG := $(shell sed -n 's/^PS5_SDK_TAG=//p' scripts/ps5-sdk.env 2>/dev/null)

 # On macOS the payload SDK's `prospero-clang` wrapper resolves `ld.lld`
-# and `clang` through `prospero-llvm-config`. SDK v0.42 supports LLVM 16–22.
-# Homebrew exposes the current major as `llvm` (not `llvm@22`), so discover
+# and `clang` through `prospero-llvm-config`. SDK v0.44 supports LLVM 16–23.
+# Homebrew exposes the current major as `llvm` (not `llvm@23`), so discover
 # its real prefix and retain versioned fallbacks for older installations.
 # Linux/WSL picks up `llvm-config-<N>` from apt naturally.
 ifeq ($(shell uname -s),Darwin)
  MACOS_LLVM_CONFIG := $(shell \
    if command -v brew >/dev/null 2>&1; then \
-      for formula in llvm llvm@22 llvm@18; do \
+      for formula in llvm llvm@23 llvm@22 llvm@18; do \
        prefix="$$(brew --prefix "$$formula" 2>/dev/null || true)"; \
        if [ -n "$$prefix" ] && [ -x "$$prefix/bin/llvm-config" ]; then \
          printf '%s\n' "$$prefix/bin/llvm-config"; \
@@ -80,10 +75,6 @@ ANDROID_APK        := $(ANDROID_GEN_DIR)/app/build/outputs/apk/universal/debug/a
 # Package id (matches tauri.conf.json `identifier`). Used to recover from a
 # signature-mismatched prior install during the convenience deploy step.
 ANDROID_APP_ID     := com.phantomptr.ps5upload
-# App-icon source (relative to CLIENT_DIR). `tauri android init` seeds
-# placeholder launcher icons; we re-apply ours so the Android icon matches
-# the desktop app icon. gen/ is gitignored, so this runs at init time.
-ANDROID_ICON_SRC   := src-tauri/icons/sources/macos_squircle_1024.png
 # rustup's *real* toolchain bin (not the ~/.cargo/bin shim). The Android std
 # lives only here; Homebrew `rust` ships only the host std. We pin PATH to this
 # dir for the android recipes so cross-compilation works even when Homebrew's
@@ -91,12 +82,17 @@ ANDROID_ICON_SRC   := src-tauri/icons/sources/macos_squircle_1024.png
 # picks Homebrew's cargo and fails with "can't find crate for `core`/`std`").
 RUSTUP_CARGO_BIN := $(shell dirname "$$(rustup which cargo 2>/dev/null)" 2>/dev/null)
 # Env preamble shared by the android recipes.
-ANDROID_ENV = JAVA_HOME="$(ANDROID_JAVA_HOME)" ANDROID_HOME="$(ANDROID_HOME)" NDK_HOME="$(ANDROID_NDK_HOME)" $(if $(RUSTUP_CARGO_BIN),PATH="$(RUSTUP_CARGO_BIN):$$PATH")
+# Debug APKs keep line tables only. With full debug info the app library was
+# 558 MB, stored uncompressed, so the APK passed 1.1 GB and `adb install`
+# failed on an emulator with INSTALL_FAILED_INSUFFICIENT_STORAGE. Line tables
+# keep function names and file:line in backtraces. Set here, not in
+# Cargo.toml, so the desktop `tauri dev` build keeps its full debug info.
+ANDROID_ENV = JAVA_HOME="$(ANDROID_JAVA_HOME)" ANDROID_HOME="$(ANDROID_HOME)" NDK_HOME="$(ANDROID_NDK_HOME)" CARGO_PROFILE_DEV_DEBUG=line-tables-only $(if $(RUSTUP_CARGO_BIN),PATH="$(RUSTUP_CARGO_BIN):$$PATH")
 # adb from the SDK (falls back to PATH if a device-only adb is installed).
 ADB ?= $(ANDROID_HOME)/platform-tools/adb

 .PHONY: all help
-.PHONY: install install-ubuntu install-macos install-windows
+.PHONY: install install-ubuntu install-macos install-windows update-sdk
 .PHONY: setup setup-engine setup-payload setup-client
 .PHONY: build payload installer engine client _engine-release _payload-if-ready _android-build-if-ready
 .PHONY: test test-root test-engine test-engine-coverage test-desktop test-payload test-client test-client-coverage
@@ -104,6 +100,7 @@ ADB ?= $(ANDROID_HOME)/platform-tools/adb
 .PHONY: quality quality-full quality-hardware ci ci-full
 .PHONY: clean clean-payload clean-engine clean-client
 .PHONY: verify info install-hooks
+.PHONY: test-ava1 test-ava1-sanitize ava1-fuzz-c ava1-soak check-no-ftx2
 .PHONY: run-engine run-client dev start _check-tauri-system-deps
 .PHONY: install-engine uninstall-engine
 .PHONY: dist dist-win dist-win-arm dist-mac dist-mac-x64 dist-linux dist-linux-arm
@@ -128,6 +125,8 @@ help:
 	@echo "  make install-ubuntu   - Ubuntu/Debian/WSL2: apt + rustup + node + PS5 SDK $(PS5_SDK_TAG)"
 	@echo "  make install-macos    - macOS: brew + rustup + LLVM + PS5 SDK $(PS5_SDK_TAG)"
 	@echo "  make install-windows  - Windows 11: winget + rustup + VS Build Tools + PS5 SDK $(PS5_SDK_TAG)"
+	@echo "  make update-sdk       - Move the PS5 SDK pin to the latest release and install it"
+	@echo "                          (SDK_TAG=vX.Y for a specific one; SDK_CHECK=1 to only check)"
 	@echo ""
 	@echo "Quick start (after install):"
 	@echo "  1. make setup         - Check toolchains, install client deps"
@@ -155,8 +154,9 @@ help:
 	@echo "  make coverage         - Rust + frontend coverage reports"
 	@echo "  make coverage-engine  - Rust coverage report only"
 	@echo "  make coverage-client  - Frontend coverage report only"
-	@echo "  make test-engine      - cargo test --workspace"
+	@echo "  make test-engine      - cargo test --workspace (C interop serial)"
 	@echo "  make test-desktop     - Tauri Rust cargo check/clippy/test"
+	@echo "  make test-ava1        - AVA1 Rust + C conformance and interop tests"
 	@echo "  make test-payload     - Validate $(PAYLOAD_ELF)"
 	@echo "  make test-client      - Type-check + lint + unit tests + build client UI"
 	@echo ""
@@ -171,8 +171,10 @@ help:
 	@echo "  make dist-linux|dist-linux-arm"
 	@echo ""
 	@echo "Android (Tauri mobile — needs Android SDK + JDK 17 + NDK + rustup):"
-	@echo "  make run-android      - Build + run with live reload; boots the emulator WITH its window"
-	@echo "  make run-android-background - Same, but the emulator boots headless (no window)"
+	@echo "  make run-android      - Build + run with live reload; emulator in the FOREGROUND (window)"
+	@echo "  make run-android-background - Same, but the emulator runs headless (no window)"
+	@echo "      Both reuse a running emulator instead of booting another; run-android"
+	@echo "      brings its window to the front (and reopens a headless one with a window)."
 	@echo "  make android-deploy   - Build APK + install/update it on connected device(s)"
 	@echo "  make android-build    - Build a debug APK (no device needed)"
 	@echo "  make android-init     - One-time: scaffold src-tauri/gen/android"
@@ -180,7 +182,6 @@ help:
 	@echo "  make emu-test         - Build + run the app on a headless emulator, with a screenshot"
 	@echo "  make emu-start        - Boot the test emulator (headless); emu-stop to shut it down"
 	@echo "  make emu-status       - Show AVDs, whether one is running, and where artifacts go"
-	@echo "  make run-android      - Boots the emulator (windowed) only if nothing is attached"
 	@echo "      emu-test leaves the emulator up for fast re-runs; PS5UPLOAD_EMU_TEARDOWN=1 stops it"
 	@echo ""
 	@echo "Auto-launch (engine starts at OS login):"
@@ -240,6 +241,13 @@ install-windows:
 	  exit 1; \
 	fi

+# Bump the PS5 Payload SDK pin (scripts/ps5-sdk.env) to the latest upstream
+# release, or SDK_TAG, and install it into $(PS5_PAYLOAD_SDK); the old SDK is
+# kept as a backup. SDK_CHECK=1 only reports whether a newer release exists.
+update-sdk:
+	@PS5_SDK_INSTALL_DIR="$(PS5_PAYLOAD_SDK)" bash scripts/update-ps5-sdk.sh \
+	  $(if $(SDK_TAG),--tag $(SDK_TAG)) $(if $(SDK_CHECK),--check)
+
 #──────────────────────────────────────────────────────────────────────────────
 # Setup
 #──────────────────────────────────────────────────────────────────────────────
@@ -300,9 +308,17 @@ setup-client:
 	@command -v node >/dev/null 2>&1 || { echo "ERROR: Node.js is not installed."; exit 1; }
 	@command -v npm >/dev/null 2>&1 || { echo "ERROR: npm is not installed."; exit 1; }
 	@echo "✓ Node.js toolchain found: node $$(node --version), npm $$(npm --version)"
-	@echo "Installing client dependencies..."
-	@cd $(CLIENT_DIR) && $(NPM_INSTALL)
-	@echo "✓ Client dependencies installed"
+	@# Reinstall only when the lockfile (or Node) changed since the last install. npm ci
+	@# deletes node_modules first — including Vite's dependency cache — so running it on
+	@# every make broke any dev server already running (make run-client beside
+	@# run-android or emu-test): its screens failed with "Importing a module script failed".
+	@cd $(CLIENT_DIR) && want="$$(node -e "const c=require('crypto'),f=require('fs');process.stdout.write(c.createHash('sha256').update(f.readFileSync('package-lock.json')).update(process.version).digest('hex'))")"; \
+	if [ -f node_modules/.ps5upload-installed ] && [ "$$(cat node_modules/.ps5upload-installed)" = "$$want" ]; then \
+		echo "✓ Client dependencies already match package-lock.json"; \
+	else \
+		echo "Installing client dependencies..." && $(NPM_INSTALL) && printf '%s' "$$want" > node_modules/.ps5upload-installed && \
+		echo "✓ Client dependencies installed"; \
+	fi

 #──────────────────────────────────────────────────────────────────────────────
 # Build
@@ -337,6 +353,7 @@ _android-install-if-device:
 		echo "⚠ No Android device connected — APK is at $$apk."; \
 		echo "  Plug in a device (USB debugging on), then: $$adb install -r \"$$apk\""; \
 	else \
+		failed=0; \
 		for d in $$devs; do \
 			echo "Updating the app on device $$d (adb install -r)..."; \
 			out=$$("$$adb" -s "$$d" install -r "$$apk" 2>&1); \
@@ -349,18 +366,36 @@ _android-install-if-device:
 					echo "✓ App reinstalled on $$d"; \
 				else \
 					echo "⚠ Could not install on $$d — APK is at $$apk (install manually: $$adb -s $$d install -r \"$$apk\")."; \
+					failed=1; \
+				fi; \
+			elif printf '%s' "$$out" | grep -qi 'INSUFFICIENT_STORAGE' && case "$$d" in emulator-*) true;; *) false;; esac; then \
+				echo "⚠ $$d is out of space — removing the old install (an emulator's app data is disposable) and retrying..."; \
+				"$$adb" -s "$$d" uninstall "$(ANDROID_APP_ID)" >/dev/null 2>&1 || true; \
+				if out=$$("$$adb" -s "$$d" install "$$apk" 2>&1) && ! printf '%s' "$$out" | grep -qi 'Failure'; then \
+					echo "✓ App reinstalled on $$d"; \
+				else \
+					echo "⚠ Still could not install on $$d — free space on it (or wipe it: emulator -avd <name> -wipe-data):"; \
+					printf '%s\n' "$$out" | sed 's/^/    /'; \
+					failed=1; \
 				fi; \
 			else \
 				echo "⚠ adb install failed on $$d (build is fine — APK is at $$apk):"; \
 				printf '%s\n' "$$out" | sed 's/^/    /'; \
+				if printf '%s' "$$out" | grep -qi 'INSUFFICIENT_STORAGE'; then \
+					echo "  The device is out of space. Free some, then: $$adb -s $$d install -r \"$$apk\""; \
+				fi; \
+				failed=1; \
 			fi; \
 		done; \
+		if [ $$failed -eq 0 ]; then echo "✓ Android build deployed to connected device(s)."; \
+		else echo "⚠ Android build NOT deployed to every device — see above."; fi; \
 	fi

 # Build the Android APK and install/update it on the connected device(s) in
 # one step — the simplest "push my latest changes to the phone".
+# The install step reports its own outcome: it used to be followed by an
+# unconditional "✓ deployed", even straight after a failed install.
 android-deploy: android-build _android-install-if-device
-	@echo "✓ Android build deployed to connected device(s)."

 # Rebuild the payload only when the PS5 SDK is configured; otherwise skip so a
 # frontend-only `make run-client` keeps working without the SDK. The shell
@@ -410,6 +445,16 @@ installer: setup-payload
 	@$(MAKE) -C $(INSTALLER_DIR) -j$(JOBS)
 	@echo "✓ Built $(INSTALLER_ELF)"

+# The patched elfldr the engine sends to replace a console's stock one (see
+# third_party/elfldr/README.md). Its ELF is checked in, so a build without the
+# SDK still embeds it; rebuild after changing the vendored sources.
+.PHONY: elfldr
+elfldr: setup-payload
+	@echo "Building the patched elfldr..."
+	@$(MAKE) -C third_party/elfldr
+	@rm -f third_party/elfldr/*.o
+	@echo "✓ Built third_party/elfldr/elfldr-ps5.elf"
+
 send-payload: payload
 	@echo "Sending payload to $(PS5_HOST):$(PS5_LOADER_PORT) ..."
 	@if ! command -v python3 >/dev/null 2>&1; then \
@@ -457,28 +502,83 @@ gen-fixtures:
 	@node scripts/gen-fixtures.mjs

 sweep:
-	@echo "Running FTX2 sweep against live PS5 at $(PS5_HOST):9113 ..."
-	@node bench/run-ftx2-sweep.mjs --spawn-engine --gen-fixtures
+	@echo "Running the upload sweep against live PS5 at $(PS5_HOST) ..."
+	@node bench/run-sweep.mjs --spawn-engine --gen-fixtures

 # Wait for the payload's runtime port to accept connections after send.
 # Retries 15×/2s = 30s ceiling; exits non-zero if the port never opens.
 _wait-payload-ready:
-	@echo "Waiting for PS5 runtime port 9113 ..."
+	@echo "Waiting for the helper's AVA1 port 9120 ..."
 	@i=0; while [ $$i -lt 15 ]; do \
-		if nc -z -w 1 "$(PS5_HOST)" 9113 >/dev/null 2>&1; then \
+		if nc -z -w 1 "$(PS5_HOST)" 9120 >/dev/null 2>&1; then \
 			echo "✓ runtime port open"; exit 0; \
 		fi; \
 		i=$$((i+1)); sleep 2; \
 	done; \
-	echo "ERROR: PS5 runtime port 9113 did not open within 30s"; exit 1
+	echo "ERROR: PS5 AVA1 port 9120 did not open within 30s"; exit 1

-validate: send-payload _wait-payload-ready
+#──────────────────────────────────────────────────────────────────────────────
+# check-no-ftx2: the retired protocol (FTX2) and its ports (9113 transfer, 9114
+# management) must not reappear anywhere in the repository.
+#
+# The scope is the whole tree, payload and the host C tests included, except the history the
+# project keeps on purpose and the files that must name the legacy protocol (listed below). The
+# pattern is case-insensitive "ftx2" or a bare port 9113/9114. Digits on either side are excluded
+# so the engine's own 19113 is not a match. Binary files and lockfiles are not searched.
+#
+# Exceptions (each is a path excluded from the search; keep this list to files that must name
+# the legacy protocol, and reword anything else to AVA1 terms):
+#   CHANGELOG.md                     history keeps FTX2 by design.
+#   site/releases.json               the website's copy of the release notes (same history).
+#   protocol/ava1/                   the spec, the cutover checklist and the method
+#                                    checklist describe the migration from FTX2.
+#   Makefile, .github/workflows/engine-ci.yml
+#                                    name this check and its pattern.
+#   .../ava1-ctest/tests/payload_cutover.rs
+#                                    asserts the payload no longer says FTX2 or 9113/9114.
+#   .../ps5upload-engine/src/ava1_only_tests.rs
+#                                    the tests that pin the engine free of the retired symbols.
+#   client/src/lib/addr.ts,
+#   client/src/lib/humanizeError.ts  tolerate a stale host:9113 / host:9114 a user or an
+#                                    older engine message still carries.
+#   *.test.ts, *.test.tsx            use 9113/9114 as fixture addresses for that same tolerance.
+#   engine .../install/, fakelibs_api.rs, icon_cache.rs, ps5upload-ava1 pool.rs, the lab's
+#   main.rs and bench.rs             old-port strip logic and its fixtures.
+#   payload/third_party              vendored code (zlib's CRC table holds 0x...9113 words).
+CHECK_NO_FTX2_PATTERN := ftx2|(^|[^0-9])911[34]([^0-9]|$$)
+CHECK_NO_FTX2_SCOPE := .
+CHECK_NO_FTX2_EXCEPT := \
+	':!engine/crates/ava1-ctest/tests/payload_cutover.rs' \
+	':!CHANGELOG.md' ':!site/releases.json' \
+	':!CONTRIBUTING.md' ':!TESTING.md' \
+	':!protocol/ava1' \
+	':!Makefile' \
+	':!.github/workflows/engine-ci.yml' \
+	':!*Cargo.lock' ':!*package-lock.json' \
+	':!engine/crates/ps5upload-engine/src/ava1_only_tests.rs' \
+	':!engine/crates/ps5upload-engine/src/install' \
+	':!engine/crates/ps5upload-engine/src/fakelibs_api.rs' \
+	':!engine/crates/ps5upload-engine/src/icon_cache.rs' \
+	':!engine/crates/ps5upload-ava1/src/pool.rs' \
+	':!engine/crates/ps5upload-lab/src/main.rs' \
+	':!engine/crates/ps5upload-lab/src/bench.rs' \
+	':!client/src/lib/addr.ts' \
+	':!client/src/lib/humanizeError.ts' \
+	':!client/src/**/*.test.ts' ':!client/src/**/*.test.tsx' \
+	':!payload/third_party'
+
+check-no-ftx2:
+	@if git grep -n -I -i -E '$(CHECK_NO_FTX2_PATTERN)' -- $(CHECK_NO_FTX2_SCOPE) $(CHECK_NO_FTX2_EXCEPT); then \
+		echo "ERROR: FTX2 or port 9113/9114 found above (see the check-no-ftx2 notes in the Makefile)"; exit 1; \
+	else echo "✓ check-no-ftx2: clean"; fi
+
+validate: check-no-ftx2 send-payload _wait-payload-ready
 	@echo ""
 	@echo "── Running smoke suite ────────────────────────────────"
 	@npm run --silent smoke:hardware
 	@echo ""
 	@echo "── Running sweep (default profiles) ────────────────────"
-	@node bench/run-ftx2-sweep.mjs --spawn-engine --gen-fixtures
+	@node bench/run-sweep.mjs --spawn-engine --gen-fixtures
 	@echo ""
 	@echo "✓ validate complete — see bench/reports/ for the full report"

@@ -488,7 +588,7 @@ validate-xl: send-payload _wait-payload-ready
 	@npm run --silent smoke:hardware
 	@echo ""
 	@echo "── Running sweep (INCLUDING XL 200k-file stress) ───────"
-	@node bench/run-ftx2-sweep.mjs --spawn-engine --gen-fixtures --xl
+	@node bench/run-sweep.mjs --spawn-engine --gen-fixtures --xl
 	@echo ""
 	@echo "✓ validate-xl complete — see bench/reports/ for the full report"

@@ -587,8 +687,6 @@ emu-test: android-build
 android-init: android-deps setup-client
 	@echo "Scaffolding Android project (tauri android init)..."
 	@cd $(CLIENT_DIR) && $(ANDROID_ENV) npx tauri android init
-	@echo "Applying app icon from $(ANDROID_ICON_SRC) (matches the desktop icon)..."
-	@cd $(CLIENT_DIR) && $(ANDROID_ENV) npx tauri icon $(ANDROID_ICON_SRC) >/dev/null
 	@echo "Allowing loopback cleartext so the in-process engine is reachable..."
 	@bash scripts/release/android-postinit-patch.sh

@@ -610,6 +708,11 @@ android-build: android-deps payload setup-client
 # run-android: the emulator boots WITH its window (foreground) so the app can be
 # seen and used. run-android-background: it boots headless, as emu-test does.
 # Either way the dev server stays attached here for live reload.
+# Android dev's Vite ports (live reload on the next one up), separate from
+# desktop dev's 1420/1421 so `make run-client` and `make run-android` can run
+# at the same time.
+ANDROID_VITE_PORT ?= 1430
+
 run-android: EMU_WINDOW := 1
 run-android-background: EMU_WINDOW := 0
 run-android run-android-background: android-deps payload setup-client
@@ -621,7 +724,8 @@ run-android run-android-background: android-deps payload setup-client
 		echo "  (leaving the existing device/emulator running)"; \
 	fi; \
 	echo "Launching on the attached Android device/emulator (tauri android dev)..."; \
-	cd $(CLIENT_DIR) && $(ANDROID_ENV) npx tauri android dev
+	cd $(CLIENT_DIR) && PS5UPLOAD_VITE_PORT=$(ANDROID_VITE_PORT) $(ANDROID_ENV) npx tauri android dev \
+		--config '{"build":{"devUrl":"http://localhost:$(ANDROID_VITE_PORT)"}}'

 #──────────────────────────────────────────────────────────────────────────────
 # Docker — self-hosted engine image. Mirrors what .github/workflows/
@@ -639,15 +743,15 @@ DOCKER_ENGINE_IMAGE ?= ps5upload-engine

 docker-engine:
 	@command -v $(DOCKER) >/dev/null 2>&1 || { echo "ERROR: docker not found on PATH."; exit 1; }
-	@echo "Building $(DOCKER_ENGINE_IMAGE) image (context: $(ENGINE_DIR)/)..."
-	@$(DOCKER) build -t $(DOCKER_ENGINE_IMAGE) $(ENGINE_DIR)
+	@echo "Building $(DOCKER_ENGINE_IMAGE) image (context: repo root, as in CI)..."
+	@$(DOCKER) build -t $(DOCKER_ENGINE_IMAGE) -f $(ENGINE_DIR)/Dockerfile .
 	@echo "✓ Built image $(DOCKER_ENGINE_IMAGE) — run with: make docker-engine-run"

 # Run the locally-built engine image. Binds the published port and points it at
-# the PS5's transfer port. Override PS5_HOST / the bind address as needed.
+# the PS5 (AVA1, port 9120). Override PS5_HOST / the bind address as needed.
 docker-engine-run: docker-engine
-	@echo "Running $(DOCKER_ENGINE_IMAGE) — engine on :19113, PS5 at $(PS5_HOST):9113 ..."
-	@$(DOCKER) run --rm -p 19113:19113 -e PS5_ADDR=$(PS5_HOST):9113 $(DOCKER_ENGINE_IMAGE)
+	@echo "Running $(DOCKER_ENGINE_IMAGE) — engine on :19113, PS5 at $(PS5_HOST) ..."
+	@$(DOCKER) run --rm -p 19113:19113 -e PS5_ADDR=$(PS5_HOST) $(DOCKER_ENGINE_IMAGE)

 #──────────────────────────────────────────────────────────────────────────────
 # Testing
@@ -696,9 +800,7 @@ ci-full: quality-full
 test-root:
 	@echo "Syntax-checking root node scripts..."
 	@node --check tests/smoke-hardware.mjs
-	@node --check bench/run-ftx2-sweep.mjs
-	@node --check bench/run-ftx2-upload.mjs
-	@node --check bench/check-ftx2-baseline.mjs
+	@node --check bench/run-sweep.mjs
 	@node --check scripts/gen-fixtures.mjs
 	@node --check scripts/check-lockfile.mjs
 	@node scripts/check-lockfile.mjs --self-test
@@ -708,10 +810,12 @@ test-root:

 test-engine: setup-engine
 	@echo "Running Rust engine tests..."
-	@cd $(ENGINE_DIR) && $(CARGO) test --workspace
+	@cd $(ENGINE_DIR) && $(CARGO) test --workspace --exclude ava1-ctest
+	@# The C interop tests share one C server and must run serially (as in CI).
+	@cd $(ENGINE_DIR) && $(CARGO) test -p ava1-ctest -- --test-threads=1
 	@echo "✓ Engine tests passed"
-	@# Android cross-compile check. The engine cfg's some modules out on
-	@# Android (remote_pkg, which needs an HTTP client), so a call site added
+	@# Android cross-compile check. The engine cfg's some code out on
+	@# Android (RAR, which needs the UnRAR C++ dep), so a call site added
 	@# without the matching cfg builds fine on every desktop target and fails
 	@# ONLY here. That is exactly how v5.31.0 shipped with no APK: every local
 	@# gate was green on macOS while the Android build was broken, and it was
@@ -759,16 +863,6 @@ test-payload: payload
 	done
 	@echo "✓ Main payload and PS5Upload installer are PS5 ELFs with gzip resources"
 	@echo "Running play-time launch/resume self-test (host build)..."
-	@echo "Running accept-recovery self-test (host build)..."
-	@cc -O2 -Wall -Wextra -Werror -o /tmp/ps5upload-accept-recovery-selftest \
-		$(PAYLOAD_DIR)/tests/accept_recovery_selftest.c
-	@/tmp/ps5upload-accept-recovery-selftest
-	@echo "✓ accept() failures keep the helper serving until its network is gone"
-	@echo "Running direct-commit apply self-test (host build)..."
-	@cc -O2 -Wall -Wextra -Werror -o /tmp/ps5upload-commit-apply-selftest \
-		$(PAYLOAD_DIR)/tests/commit_apply_selftest.c
-	@/tmp/ps5upload-commit-apply-selftest
-	@echo "✓ a repeat COMMIT never unlinks a destination it cannot replace"
 	@cc -O2 -Wall -Wextra -Werror -o /tmp/ps5upload-activity-selftest \
 		$(PAYLOAD_DIR)/tests/activity_launch_selftest.c
 	@/tmp/ps5upload-activity-selftest
@@ -776,16 +870,127 @@ test-payload: payload
 	@cc -O2 -Wall -Wextra -Werror -o /tmp/ps5upload-app-info-selftest \
 		$(PAYLOAD_DIR)/tests/app_info_selftest.c
 	@/tmp/ps5upload-app-info-selftest
+	@echo "Running uninstall outcome self-test (host build)..."
+	@cc -O2 -Wall -Wextra -Werror -I$(PAYLOAD_DIR)/include \
+		-o /tmp/ps5upload-unregister-outcome-selftest \
+		$(PAYLOAD_DIR)/tests/unregister_outcome_selftest.c
+	@/tmp/ps5upload-unregister-outcome-selftest
 	@echo "Running metadata title-id normalizer self-test (host build)..."
 	@cc -O2 -Wall -Wextra -Werror -o /tmp/ps5upload-tmdb-id-selftest \
 		$(PAYLOAD_DIR)/tests/tmdb_id_selftest.c
 	@/tmp/ps5upload-tmdb-id-selftest
+	@echo "Running console port scan self-test (host build)..."
+	@cc -O2 -Wall -Wextra -Werror -I$(PAYLOAD_DIR)/include \
+		-o /tmp/ps5upload-net-ports-selftest \
+		$(PAYLOAD_DIR)/tests/net_ports_selftest.c
+	@/tmp/ps5upload-net-ports-selftest
 	@echo "Running cheat XML UTF-16 normalizer self-test (host build)..."
 	@cc -O2 -Wall -Wextra -Werror -I$(PAYLOAD_DIR)/include \
 		-o /tmp/ps5upload-xml-encoding-selftest \
 		$(PAYLOAD_DIR)/tests/xml_encoding_selftest.c
 	@/tmp/ps5upload-xml-encoding-selftest
 	@echo "✓ UTF-16 SHN/MC4 cheat files convert so their cheats appear"
+	@echo "Running web UI HTTP parser self-test (host build)..."
+	@cc -O2 -Wall -Wextra -Werror -I$(PAYLOAD_DIR)/include \
+		-o /tmp/ps5upload-webui-http-selftest \
+		$(PAYLOAD_DIR)/tests/webui_http_selftest.c
+	@/tmp/ps5upload-webui-http-selftest
+	@echo "Running webui strings lookup self-test (host build)..."
+	@cc -O2 -Wall -Wextra -Werror -I$(PAYLOAD_DIR)/include \
+		-o /tmp/ps5upload-webui-strings-selftest \
+		$(PAYLOAD_DIR)/tests/webui_strings_selftest.c $(PAYLOAD_DIR)/src/webui_strings.c
+	@/tmp/ps5upload-webui-strings-selftest
+	@echo "✓ GET /strings/<lang>.json answers only the embedded languages, never a crafted path"
+	@echo "Running webui offline copy lookup self-test (host build)..."
+	@cc -O2 -Wall -Wextra -Werror -I$(PAYLOAD_DIR)/include \
+		-o /tmp/ps5upload-webui-offline-selftest \
+		$(PAYLOAD_DIR)/tests/webui_offline_selftest.c $(PAYLOAD_DIR)/src/webui_offline.c
+	@/tmp/ps5upload-webui-offline-selftest
+	@echo "✓ GET /sw.js and /cache.appcache answer with their own types; nothing else matches"
+	@echo "Running webui auth self-test (host build)..."
+	@cc -O2 -Wall -Wextra -Werror -I$(PAYLOAD_DIR)/include \
+		-o /tmp/ps5upload-webui-auth-selftest \
+		$(PAYLOAD_DIR)/tests/webui_auth_selftest.c $(PAYLOAD_DIR)/src/webui_auth.c
+	@/tmp/ps5upload-webui-auth-selftest
+	@echo "Running webui server self-test (host build, ~25 s)..."
+	@cc -O2 -Wall -Wextra -Werror -pthread -I$(PAYLOAD_DIR)/include -I$(PAYLOAD_DIR)/ava1 \
+		-o /tmp/ps5upload-webui-server-selftest \
+		$(PAYLOAD_DIR)/tests/webui_server_selftest.c $(PAYLOAD_DIR)/src/webui_server.c \
+		$(PAYLOAD_DIR)/src/webui_http.c $(PAYLOAD_DIR)/src/webui_auth.c
+	@/tmp/ps5upload-webui-server-selftest
+	@echo "✓ silent, half-sent and flooding web clients never stall the helper"
+	@echo "Running webui codec self-test (host build)..."
+	@cc -O2 -Wall -Wextra -Werror -I$(PAYLOAD_DIR)/include -I$(PAYLOAD_DIR)/ava1 -I$(PAYLOAD_DIR)/ava1/gen \
+		-o /tmp/ps5upload-webui-codec-selftest \
+		$(PAYLOAD_DIR)/tests/webui_codec_selftest.c $(PAYLOAD_DIR)/src/webui_codec.c \
+		$(PAYLOAD_DIR)/ava1/gen/ava1_gen.c $(PAYLOAD_DIR)/ava1/ava1_wire.c
+	@/tmp/ps5upload-webui-codec-selftest
+	@echo "✓ Unicode, quoted and very large folders survive the web UI's JSON both ways"
+	@echo "Running webui file transfer self-test (host build)..."
+	@cc -O2 -Wall -Wextra -Werror -pthread -I$(PAYLOAD_DIR)/include \
+		-o /tmp/ps5upload-webui-files-selftest \
+		$(PAYLOAD_DIR)/tests/webui_files_selftest.c $(PAYLOAD_DIR)/src/webui_files.c
+	@/tmp/ps5upload-webui-files-selftest
+	@echo "✓ text saves and uploads go through a same-folder temp + rename; a cut-off upload leaves no file; folders stream as a valid .tar"
+	@echo "Running file index name-match self-test (host build)..."
+	@cc -O2 -Wall -Wextra -Werror -I$(PAYLOAD_DIR)/include \
+		-o /tmp/ps5upload-index-glob-selftest $(PAYLOAD_DIR)/tests/index_glob_selftest.c
+	@/tmp/ps5upload-index-glob-selftest
+	@echo "✓ index name patterns match in linear time, whatever the pattern"
+	@echo "Running file manager prefs self-test (host build)..."
+	@cc -O2 -Wall -Wextra -Werror -pthread -I$(PAYLOAD_DIR)/include -I$(PAYLOAD_DIR)/ava1 -I$(PAYLOAD_DIR)/ava1/gen \
+		-o /tmp/ps5upload-files-prefs-selftest \
+		$(PAYLOAD_DIR)/tests/files_prefs_selftest.c $(PAYLOAD_DIR)/src/files_prefs.c $(PAYLOAD_DIR)/src/webui_codec.c \
+		$(PAYLOAD_DIR)/ava1/gen/ava1_gen.c $(PAYLOAD_DIR)/ava1/ava1_wire.c
+	@/tmp/ps5upload-files-prefs-selftest
+	@echo "✓ pinned/recent folders stay bounded; a garbled prefs file reads as empty; saves are atomic"
+	@echo "Running Show on TV / Show on PC handoff self-test (host build)..."
+	@cc -O2 -Wall -Wextra -Werror -pthread -I$(PAYLOAD_DIR)/include -I$(PAYLOAD_DIR)/ava1 -I$(PAYLOAD_DIR)/ava1/gen \
+		-o /tmp/ps5upload-files-handoff-selftest \
+		$(PAYLOAD_DIR)/tests/files_handoff_selftest.c $(PAYLOAD_DIR)/src/files_handoff.c $(PAYLOAD_DIR)/src/files_prefs.c \
+		$(PAYLOAD_DIR)/src/webui_codec.c $(PAYLOAD_DIR)/ava1/gen/ava1_gen.c $(PAYLOAD_DIR)/ava1/ava1_wire.c
+	@/tmp/ps5upload-files-handoff-selftest
+	@echo "✓ a handoff opens once, expires after two minutes, and the PC reads the same prefs as the console"
+	@echo "Running webui settings + tile self-test (host build)..."
+	@cc -O2 -Wall -Wextra -Werror -DWEBUI_TILE_HOST_TEST -I$(PAYLOAD_DIR)/include -I$(PAYLOAD_DIR)/ava1 -I$(PAYLOAD_DIR)/ava1/gen \
+		-o /tmp/ps5upload-webui-settings-selftest \
+		$(PAYLOAD_DIR)/tests/webui_settings_selftest.c $(PAYLOAD_DIR)/src/webui_settings.c \
+		$(PAYLOAD_DIR)/src/webui_tile.c $(PAYLOAD_DIR)/src/webui_codec.c \
+		$(PAYLOAD_DIR)/ava1/gen/ava1_gen.c $(PAYLOAD_DIR)/ava1/ava1_wire.c
+	@/tmp/ps5upload-webui-settings-selftest
+	@echo "✓ a missing or garbled settings file falls back to defaults; the tile is written only when it differs"
+	@echo "Running webui input log self-test (host build)..."
+	@cc -O2 -Wall -Wextra -Werror -I$(PAYLOAD_DIR)/include \
+		-o /tmp/ps5upload-webui-inputlog-selftest \
+		$(PAYLOAD_DIR)/tests/webui_inputlog_selftest.c $(PAYLOAD_DIR)/src/webui_inputlog.c
+	@/tmp/ps5upload-webui-inputlog-selftest
+	@echo "✓ the controller input log takes only plain short lines and never grows past its 64 KiB ring"
+	@echo "Running webui cheat download store self-test (host build)..."
+	@cc -O2 -Wall -Wextra -Werror -pthread -I$(PAYLOAD_DIR)/include -I$(PAYLOAD_DIR)/ava1 -I$(PAYLOAD_DIR)/ava1/gen \
+		-o /tmp/ps5upload-webui-cheats-store-selftest \
+		$(PAYLOAD_DIR)/tests/webui_cheats_store_selftest.c $(PAYLOAD_DIR)/src/webui_cheats_store.c \
+		$(PAYLOAD_DIR)/src/webui_files.c $(PAYLOAD_DIR)/src/webui_codec.c \
+		$(PAYLOAD_DIR)/ava1/gen/ava1_gen.c $(PAYLOAD_DIR)/ava1/ava1_wire.c
+	@/tmp/ps5upload-webui-cheats-store-selftest
+	@echo "✓ a downloaded cheat is stored only under a plain name with its format's extension, through a same-folder temp + rename"
+	@echo "Running AVA1 in-flight RPC gate self-test (host build)..."
+	@cc -O2 -Wall -Wextra -Werror -pthread -I$(PAYLOAD_DIR)/ava1 \
+		-o /tmp/ps5upload-ava1-rpc-gate-selftest \
+		$(PAYLOAD_DIR)/tests/ava1_rpc_gate_selftest.c
+	@/tmp/ps5upload-ava1-rpc-gate-selftest
+	@echo "✓ the helper's exit waits for web UI calls and refuses new ones"
+	@echo "Running cheat title list self-test (host build)..."
+	@cc -O2 -Wall -Wextra -Werror -I$(PAYLOAD_DIR)/include \
+		-o /tmp/ps5upload-cheats-list-selftest \
+		$(PAYLOAD_DIR)/tests/cheats_list_selftest.c
+	@/tmp/ps5upload-cheats-list-selftest
+	@echo "✓ a large or badly encoded cheat pack lists as valid, bounded JSON"
+	@echo "Running cheat apply-plan self-test (host build)..."
+	@cc -O2 -Wall -Wextra -Werror -I$(PAYLOAD_DIR)/include \
+		-o /tmp/ps5upload-cheats-plan-selftest \
+		$(PAYLOAD_DIR)/tests/cheats_plan_selftest.c
+	@/tmp/ps5upload-cheats-plan-selftest
+	@echo "✓ a cheat's code caves are written before the jumps into them, and removed after"
 	@echo "Checking per-console isolation..."
 	@./scripts/check-per-console-isolation.sh
 	@echo "✓ one console's data cannot be shown under another's name"
@@ -837,6 +1042,7 @@ test-payload: payload
 		-I$(PAYLOAD_DIR)/third_party/sqlite3 \
 		-DCONTENT_DB_APP='"/tmp/ps5upload-cdb/app.db"' \
 		-DCONTENT_DB_APPINFO='"/tmp/ps5upload-cdb/appinfo.db"' \
+		-DCONTENT_DB_APP_BACKUP='"/tmp/ps5upload-cdb/app.db.before-hide"' \
 		-o /tmp/ps5upload-content-db-selftest \
 		$(PAYLOAD_DIR)/src/content_db.c \
 		$(PAYLOAD_DIR)/tests/content_db_selftest.c \
@@ -860,17 +1066,6 @@ test-payload: payload
 		/tmp/ps5upload-cdb/sqlite3.o
 	@/tmp/ps5upload-actjson/selftest
 	@echo "✓ every Game Activity tab names its titles, in the keys the engine reads"
-	@echo "Running FTP wire-format self-test (host build)..."
-	@cc -O2 -Wall -Wextra -Werror -o /tmp/ps5upload-ftp-format-selftest \
-		$(PAYLOAD_DIR)/tests/ftp_format_selftest.c
-	@/tmp/ps5upload-ftp-format-selftest
-	@echo "✓ FTP PASV/EPSV/LIST replies match the shapes clients parse"
-	@echo "Running FTP lifecycle self-test (host build)..."
-	@cc -O2 -Wall -Wextra -Werror -pthread -I$(PAYLOAD_DIR)/include \
-		-o /tmp/ps5upload-ftp-lifecycle-selftest \
-		$(PAYLOAD_DIR)/tests/ftp_lifecycle_selftest.c
-	@/tmp/ps5upload-ftp-lifecycle-selftest
-	@echo "✓ FTP stop/start drains sessions without stale listeners or fd reuse"
 	@echo "Running timed initializer serialization self-test (host build)..."
 	@cc -O2 -Wall -Wextra -Werror -pthread -I$(PAYLOAD_DIR)/include \
 		-o /tmp/ps5upload-timed-init-selftest \
@@ -1181,4 +1376,49 @@ dev: run-client
 start: run-client

 release-post:
-	@./scripts/release-posts.sh
+	@node scripts/release-posts.js $(ARGS)
+
+promo-post:
+	@node scripts/promo-posts.js $(ARGS)
+
+AVA1_C := payload/ava1
+AVA1_C_CODEC := $(AVA1_C)/ava1_wire.c $(AVA1_C)/ava1_frame.c $(AVA1_C)/gen/ava1_gen.c \
+	$(AVA1_C)/ava1_keys.c $(AVA1_C)/ava1_noise.c $(AVA1_C)/ava1_aead.c $(AVA1_C)/platform_posix.c \
+	payload/third_party/monocypher/monocypher.c
+
+# scripts/ava1-aead-test.sh: the C AEAD against RFC 8439 and Monocypher, including the
+# AVX2 path (x86-64 natively, or under Rosetta 2 on an arm64 Mac).
+test-ava1:
+	scripts/ava1-aead-test.sh
+	cd engine && cargo test -p ava1 -p ava1-gen -p ava1-chaos
+	# The C server and the data layer are process-wide singletons
+	# (one CServer at a time, one ava1_data_start): serial, not two shells.
+	cd engine && cargo test -p ava1-ctest -- --test-threads=1
+
+# The whole ctest suite with ASan + UBSan on every C unit (review 009 #2a), LSan included on Linux.
+# Run it on Linux (CI, or `docker run rust:latest` with clang + libclang-rt-dev installed): the Rust link
+# of the sanitized C did not link with Homebrew's clang on macOS when tried (not investigated further).
+# engine/crates/ava1-ctest/lsan.supp lists the intentional leaks (test-side Box::leak), each with its reason.
+CLANG ?= clang
+test-ava1-sanitize:
+	cd engine && CC=$(CLANG) AVA1_CTEST_SANITIZE=1 RUSTFLAGS="-Clinker=$(CLANG) $$RUSTFLAGS" \
+		ASAN_OPTIONS=$${ASAN_OPTIONS:-detect_leaks=$$([ "$$(uname)" = Linux ] && echo 1 || echo 0)} \
+		LSAN_OPTIONS=suppressions=$(CURDIR)/engine/crates/ava1-ctest/lsan.supp \
+		cargo test -p ava1-ctest -- --test-threads=1
+
+# The host soak (review 009 #2c): AVA1_SOAK_MINUTES=60 make ava1-soak. Add AVA1_CTEST_SANITIZE=1 (and
+# CC/RUSTFLAGS as above) to run it under ASan.
+ava1-soak:
+	cd engine && AVA1_SOAK_MINUTES=$${AVA1_SOAK_MINUTES:-5} cargo test -p ava1-ctest --test soak -- --ignored --test-threads=1 --nocapture
+
+ava1-fuzz-c:
+	$${CC:-clang} -g -O1 -fsanitize=fuzzer,address,undefined -DAVA1_AEAD_PORTABLE -I$(AVA1_C) -I$(AVA1_C)/gen -Ipayload/third_party/monocypher \
+		-o /tmp/ava1-fuzz-decode $(AVA1_C)/fuzz/fuzz_decode.c $(AVA1_C_CODEC)
+	/tmp/ava1-fuzz-decode -max_total_time=$${AVA1_FUZZ_SECONDS:-60} -max_len=65536
+	$${CC:-clang} -g -O1 -fsanitize=fuzzer,address,undefined -I$(AVA1_C) -I$(AVA1_C)/gen -Ipayload/third_party/blake3 \
+		-DBLAKE3_NO_SSE2 -DBLAKE3_NO_SSE41 -DBLAKE3_NO_AVX2 -DBLAKE3_NO_AVX512 -DBLAKE3_USE_NEON=0 \
+		-o /tmp/ava1-fuzz-data $(AVA1_C)/fuzz/fuzz_data.c $(AVA1_C)/ava1_manifest.c $(AVA1_C)/ava1_journal.c \
+		$(AVA1_C)/ava1_ranges.c $(AVA1_C)/ava1_wire.c $(AVA1_C)/ava1_frame.c $(AVA1_C)/gen/ava1_gen.c \
+		payload/third_party/blake3/blake3.c payload/third_party/blake3/blake3_dispatch.c \
+		payload/third_party/blake3/blake3_portable.c
+	/tmp/ava1-fuzz-data -max_total_time=$${AVA1_FUZZ_SECONDS:-60} -max_len=65536
@@ -5,15 +5,14 @@
 </p>

 <p align="center">
-  <strong>Fast, reliable transfers from your computer to your PS5.</strong><br/>
-  Transfer · Mount · Browse — designed to live alongside your PS5-side tools.
+  PS5 Upload gets your games, apps and homebrew onto a jailbroken PS5 quickly and reliably: uploads resume after a dropped connection, installs pick the route that works, and you can browse files, manage the console and run cheats from your computer, phone or browser.
 </p>

 <p align="center">
  <a href="https://github.com/phantomptr/ps5upload/releases"><img alt="release" src="https://img.shields.io/github/v/release/phantomptr/ps5upload?display_name=tag&sort=semver&color=blue" /></a>
  <a href="LICENSE"><img alt="license" src="https://img.shields.io/badge/license-GPL--3-green" /></a>
-  <img alt="platforms" src="https://img.shields.io/badge/platforms-macOS_·_Linux_·_Windows-lightgrey" />
-  <img alt="firmware" src="https://img.shields.io/badge/PS5_firmware-1.00_–_13.60_supported_•_9.x–12.x_tested-brightgreen" />
+  <img alt="platforms" src="https://img.shields.io/badge/platforms-macOS_·_Linux_·_Windows_·_Android_·_Web-lightgrey" />
+  <img alt="firmware" src="https://img.shields.io/badge/PS5_firmware-1.00_–_13.60_supported_•_5.10,_9.60_&_13.60_tested-brightgreen" />
  <a href="https://discord.gg/fzK3xddtrM"><img alt="discord" src="https://img.shields.io/badge/discord-join-5865F2" /></a>
 </p>

@@ -21,131 +20,36 @@

 ## What it does

- **Fast transfer** — FTX2 binary protocol with BLAKE3 per-shard
-  verification, small-file packing, and resume on disconnect.
-  Uses your LAN flat-out. Pack worker absorbs transient
-  `EIO`/`EMFILE` hiccups so a 200k-file game upload doesn't get
-  killed by one unlucky syscall.
- **Upload queue** — line up multiple games or images, hit Start,
-  walk away. Every running row shows live MiB/s and ETA; done
-  rows show the wall-clock-average rate so you can spot a slow
-  destination. Queue state survives app restarts.
- **Compressed archive uploads (`.zip` / `.7z` / `.rar`)** — keep a game
-  dump as a single archive on your PC (less disk, easier to move) and
-  upload it directly. ps5upload decompresses on the host and streams
-  the files into the same FTX2 pipeline, so they land **already
-  extracted** on the PS5 — no manual unpack, no temp copy of the whole
-  game. The Upload screen previews the expansion (`zipped → extracted`,
-  file count, space saved) and detects the embedded game. Decompresses
-  one file at a time, so a 100 GB archive doesn't need 100 GB of RAM.
-  `.7z` and `.rar` stream straight into the pipeline and write nothing to
-  your disk at all; `.zip` spills large entries to a temp file because its
-  format needs random access. `.rar` is desktop-only (the UnRAR C dep is
-  excluded from the Android build).
- **Native image mount** — attach `.exfat` and `.ffpkg` images on
-  the PS5 (MDIOCATTACH + nmount) with no third-party helper. Every
-  mount survives payload restarts and auto-reconciles on startup.
-  Mount read-write to **edit an image in place** — add DLC, swap
-  assets, or apply a backport patch to a game that ships as an image
-  rather than a folder. Edits go straight into the image file, so the
-  app warns before you start.
-  When ShadowMount+ owns the image (it mounts everything read-only and
-  re-adopts anything it finds), **Edit files…** checks the image out —
-  moving it out of ShadowMount+'s scan folder, mounting it read-write
-  where you choose, and putting it back when you finish. The checkout is
-  journalled on the console, so an edit interrupted by a crash or a
-  reboot can still be finished later, from any machine.
- **Browse everything** — list games anywhere on the PS5 (including
-  inside mounted images), disk images, files, and volumes. Run FS
-  ops (add files, replace a file, chmod, delete, move, copy, mkdir)
-  with a real directory tree. Bulk delete of a 200k-file folder
-  shows live progress with a working Stop button.
- **NAS / SMB upload** — browse a Windows share or Samba NAS from the
-  app, download to this computer, or **upload a file or folder
-  straight to the PS5** in one step (streamed to a host temp dir, then
-  FTX2 — no 2 GiB memory cap on that path).
- **FTP server on the PS5** — optional built-in FTP for FileZilla and
-  other clients (default port **2122**, so it coexists with ftpsrv on
-  2121). Not a replacement for FTX2 Upload.
- **Backport helpers** — Fakelib folder manager, BPS patch apply, and
-  SDK Version Changer for folder dumps that need newer system libs.
-  Runtime mount is still BackPork or ShadowMount+ (don’t run both).
- **Stay-in-the-loop notifications** — in-app alerts mirror to your
-  computer's notification center (macOS / Windows / Linux, plus the
-  Android shade) when a transfer finishes or fails in the background,
-  and the PS5 itself shows a toast when an upload starts and completes.
-  Your machine is kept awake automatically while a transfer runs.
- **Hardware view** — model, serial, uptime, storage and RAM, refreshed
-  live; plus a fan-threshold control that rings through to
-  `/dev/icc_fan` for quieter operation. Temperatures (CPU, SoC, M.2) and
-  CPU frequency are read **on demand** (a button), not auto-polled — each
-  read briefly pauses the system UI, so polling them could destabilize the
-  console. Some readings on that panel are simply not available on retail
-  firmware and show `—`: SoC clock, SoC power, CPU usage, fan duty, and
-  the per-drive sensor list. Storage totals and temperatures do work.
- **Power control & wake** — reboot, rest mode, or shut down the PS5 from
-  the app, and **wake it from standby** over the network (Sony's discovery
-  protocol — a PS5 does not respond to Wake-on-LAN). With the console's
-  Remote Play session keys stored, **Wake & sign in** brings it up straight
-  on your user's home screen instead of the user-select screen, the way the
-  PS Remote Play app does. Waking needs three console settings enabled
-  (Remote Play, plus *Stay Connected to the Internet* and *Enable Turning On
-  PS5 from Network* under Rest Mode) — the app spells them out, since without
-  them the wake fails silently.
- **Send any payload** — push `.elf`, `.bin`, `.js`, `.lua`, or
-  `.jar` files to the PS5's loader port (typical defaults: `.elf` →
-  9021 elfldr, `.js` → 50000 WebKit-stage, `.lua` → 9026, `.jar` →
-  9025 BD-JB / BDJ; custom loaders may listen anywhere). Recent-sends
-  history with click-to-replay and per-row success/fail badges. Curated
-  payload catalogue (kstuff, ShadowMount+, etaHEN, …) fetches releases on
-  demand — or **add your own GitHub/Gitea repo** and it tracks + caches
-  that too. **Payload playlists** run a scripted boot sequence, and a
-  playlist step can pull straight from a repo at run time so you don't
-  keep a pile of `.elf` files on your PC.
- **Install packages** — install a PS4 `.pkg` or PS5 fake package two ways:
-  **Stream install** sends it straight from your PC (nothing is copied to
-  the PS5 first — handy when console storage is tight), and **Upload &
-  install** copies it to the PS5's package library first, where it stays so
-  you can **Install**, **Reinstall** or **Delete** it later without
-  re-uploading. **Install all** does a whole set in base → update → DLC order.
-  Packages on a NAS/SMB share or behind an HTTP(S) link install the same way.
-  Everything goes through ps5upload's own on-console installer, and an
-  install is only marked done once the console has pulled the whole package
-  and the result checks out — an update that didn't raise the game's version
-  is reported, not called a success. Base, update and DLC installs verified
-  on FW 5.10.
- **Convert to FPKG (beta)** — turn a decrypted game folder or an `.exfat` /
-  `.ffpkg` image into an installable fake package on your computer, with the
-  same compression Sony's packages use, then install it with Stream install
-  or Upload & install. Enable it under Settings → Beta features.
- **Web browser access** — run the engine (or the official Docker image)
-  and manage your PS5 from any browser on the LAN, the full app served
-  over HTTP. No desktop install needed on that machine. Unauthenticated —
-  keep it on a trusted LAN. See the self-hosted-engine FAQ below.
- **Screenshots & video clips** — browse the PS5's Capture Gallery,
-  preview, and download screenshots (HDR `.jxr` auto-converted to PNG) or
-  gameplay video clips to your computer.
- **Register + launch** — Library row's Play button always registers
-  first (idempotent if already registered), retries with DRM-type
-  patch on rejection, then launches. Unmount unregisters every
-  title inside the image first so the dashboard stays clean —
-  no ghost tiles after unmount.
- **Speaks your language** — the whole UI, including error messages
-  and troubleshooting hints, is available in 20 languages: English,
-  Simplified & Traditional Chinese, Spanish, Hindi, Arabic, Bengali,
-  Brazilian Portuguese, Russian, Japanese, German, French, Korean,
-  Turkish, Vietnamese, Indonesian, Italian, Thai, Polish, and Hungarian.
+- **Fast, resumable uploads** of games, folders, disk images and `.zip` / `.7z` / `.rar`
+  archives (unpacked on the way, nothing extracted to your disk). Everything runs over
+  **AVA1**, one encrypted connection on port 9120. Every file is verified, and an upload
+  continues after a dropped connection, a helper restart or rest mode. A job that will not
+  fit is refused up front, counting what is already on the console. Queue, live speed and ETA.
+- **Install any package.** PS4 `.pkg` and PS5 fake packages (base, update, DLC) from your
+  computer (**Stream & install** or **Upload & install**), a NAS/SMB share, a USB drive or a
+  link. If the PS5 refuses one route, the app offers another.
+- **Collection.** Every game in your folders (including folders on a NAS, scanned in place),
+  grouped with its updates and DLC, with what each PS5 already has and one click to install the
+  rest. Organize, de-duplicate and clean up the drives. Replaces PS Game Library.
+- **Convert Games.** Build an installable package from a decrypted game folder or an
+  image, or write a game folder as a game image (`.exfat`, `.ffpkg`, `.ffpfs`, or the smaller
+  `.ffpfsc`) that ShadowMount+ mounts, and upload it in one step.
+- **Browse and manage.** Files, games, disk images (mount, edit in place), saves, screenshots
+  and video clips; register, launch, stop and uninstall games; copy, move (Move to…),
+  delete, set permissions.
+- **Cheats, fan curve, hardware view,** Remote Play pairing, payload sender with a catalogue
+  and playlists, and backport tools.
+- **Power.** Rest mode, reboot, shut down, and wake over the network (optionally straight
+  into your signed-in user).
+- **Runs everywhere:** macOS, Windows, Linux, Android, or any browser through the self-hosted
+  Docker web UI ([compose file](engine/compose.yaml), see
+  [Self-hosted engine and web UI](#self-hosted-engine-and-web-ui)). 21 languages.

 ## What it doesn't do

- **System pkg patches.** `sceAppInstUtilInstallByPackage` is built
-  for game pkgs; NPXS-prefix system pkgs (Store updates, Settings
-  app patches) register but the install path freezes Sony's mgmt
-  service mid-flight on most firmwares. Use the on-PS5 Settings →
-  Debug Settings → Game → Package Installer for those.
- **Insecure pkg signing keys.** The engine only installs pkgs signed
-  with keys already in the PS5's trust store. It does not generate or
-  inject fake signing keys.
+- **System package patches** (NPXS Store or Settings updates). Use the PS5's own
+  Settings → Debug Settings → Game → Package Installer.
+- **Sign packages with fake keys.** It only installs packages the console already trusts.

 ## A quick look

@@ -161,9 +65,72 @@ Pre-built downloads land on the
 | macOS (Apple Silicon / Intel) | `PS5Upload-<ver>-mac-{arm64,x64}.dmg` | Open the `.dmg`, drag PS5Upload into Applications. See **First launch on macOS** below — Gatekeeper blocks downloaded apps the first time. |
 | Windows (x64 / ARM64) | `PS5Upload-<ver>-win-{x64,arm64}.zip` | Unzip, double-click `PS5Upload.exe` — portable, no installer. See **First launch on Windows** — SmartScreen warns on first run. |
 | Linux — Debian / Ubuntu (x64 / ARM64) | `PS5Upload-<ver>-linux-{x64,arm64}.deb` | `sudo apt install ./PS5Upload-<ver>-linux-<arch>.deb` — installs a normal app with a menu entry; pulls in the WebKitGTK deps automatically. |
-| Linux — Fedora / RHEL / Bazzite (x64 / ARM64) | `PS5Upload-<ver>-linux-{x64,arm64}.rpm` | `sudo dnf install ./PS5Upload-<ver>-linux-<arch>.rpm` (Bazzite/Silverblue: `rpm-ostree install`) — menu entry + auto deps. |
+| Linux — Fedora / RHEL / Bazzite (x64 / ARM64) | `PS5Upload-<ver>-linux-{x64,arm64}.rpm` | `sudo dnf install ./PS5Upload-<ver>-linux-<arch>.rpm` (Bazzite/Silverblue: `rpm-ostree install`; to update, `rpm-ostree uninstall ps5-upload --install ./<new>.rpm` and reboot, which Settings → Updates shows ready to copy) — menu entry + auto deps. |
 | Linux — any distro (x64 / ARM64) | `PS5Upload-<ver>-linux-{x64,arm64}.zip` | Universal fallback (no install). Unzip, then `chmod +x PS5Upload.sh PS5Upload.AppImage` and run **`./PS5Upload.sh`** (the wrapper — handles the FUSE-less and WebKit white-screen cases for you). Running `./PS5Upload.AppImage` directly also works if your system has libfuse2 and a happy WebKitGTK. |
-| Android | `PS5Upload-<ver>-android.apk` | Enable "install unknown apps" for your browser/file manager, then open the `.apk`. Same interface, mobile-friendly; connects to and manages your PS5 over Wi-Fi. |
+| Linux — NixOS (x64 / ARM64) | no release artifact | Packaged in [NUR](https://github.com/GriefNorth/nur-packages) as `ps5upload` — see **NixOS** below. |
+| Android | `PS5Upload-<ver>-android.apk` | Enable "install unknown apps" for your browser/file manager, then open the `.apk`. Same interface, mobile-friendly; connects to and manages your PS5 over Wi-Fi. On Android 17, allow local network access ("nearby devices") when asked. |
+
+### NixOS
+
+No NixOS artifact is published on the Releases page, but ps5upload is
+packaged in [GriefNorth's NUR](https://github.com/GriefNorth/nur-packages) as
+`ps5upload` (x64 and ARM64) — it wraps the same `.AppImage` and needs no
+FUSE. With flakes:
+
+```nix
+{
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nur.url = "github:GriefNorth/nur-packages";
+  };
+
+  outputs = { nixpkgs, nur, ... }: {
+    nixosConfigurations.myhost = nixpkgs.lib.nixosSystem {
+      system = "x86_64-linux";
+      modules = [
+        ({ pkgs, ... }: {
+          environment.systemPackages = [
+            nur.packages.${pkgs.system}.ps5upload
+          ];
+        })
+      ];
+    };
+  };
+}
+```
+
+Then `nixos-rebuild switch --flake .#myhost` and launch **ps5upload** from
+your app menu. Without flakes, call the package straight out of the repo —
+and note that ps5upload bundles UnRAR for `.rar` support, so nixpkgs needs
+`config.allowUnfree = true`:
+
+```nix
+{ pkgs, ... }:
+{
+  nixpkgs.config.allowUnfree = true;
+
+  environment.systemPackages = [
+    (pkgs.callPackage
+      ((builtins.fetchTarball
+        "https://github.com/GriefNorth/nur-packages/archive/refs/heads/main.tar.gz")
+        + "/pkgs/ps5upload")
+      { })
+  ];
+}
+```
+
+Or try it without installing anything:
+
+```bash
+nix run github:GriefNorth/nur-packages#ps5upload
+```
+
+The Nix expression pins one release version, so bump it there when a new
+ps5upload comes out. Prefer to run the AppImage yourself? Prefer the
+`./PS5Upload.sh` wrapper from the zip above — on NixOS the bare
+`.AppImage` usually renders an empty window, because its bundled
+`libwayland-client` shadows the host one and WebKitGTK then fails to create
+an EGL display. The Nix package works around that for you.

 ### First-launch warnings (and why they're there)

@@ -217,7 +184,7 @@ only needs to be done once per install.

 The app checks GitHub for updates once per launch (Settings → Updates)
 and downloads a fresh archive to your Downloads folder when you click
-Download — replace the old app manually and relaunch.
+Download. Replace the old app and relaunch; the app then offers to update the helper.

 Building from source:

@@ -235,11 +202,11 @@ make run-client    # launch the Tauri dev app
  (`libwebkit2gtk-4.1-dev`, `libgtk-3-dev`, `librsvg2-dev`,
  `libayatana-appindicator3-dev`, `libxdo-dev`, `libssl-dev`,
  `build-essential`), Node.js 22 LTS via NodeSource (only if missing),
-  Rust via rustup, and checksum-verified PS5 Payload SDK v0.42 →
+  Rust via rustup, and checksum-verified PS5 Payload SDK v0.44 →
  `~/ps5-payload-sdk`.
 - **`make install-macos`** — macOS: Xcode CLT, Homebrew, `node`, current
-  `llvm` (LLVM 22 at this release), Rust via rustup, and checksum-verified
-  PS5 Payload SDK v0.42.
+  `llvm` (LLVM 23 at this release), Rust via rustup, and checksum-verified
+  PS5 Payload SDK v0.44.
 - **`make install-windows`** — Windows 11: Node.js LTS, Rust, VS 2022 Build
  Tools (C++ workload), WebView2 Runtime, 7-Zip, and PS5 Payload SDK
  via `winget`. Run from an elevated PowerShell (or any shell with
@@ -257,314 +224,112 @@ For per-platform bundles only (no full dev env): `make dist-mac`,

 ## Quick start

-1. Launch ps5upload on your computer.
-2. Open the **Connection** tab and enter your PS5's IP address.
-3. Click **Check**, then **Send payload**.
-4. Once the third step turns green, go to any other tab — you're
-   connected.
+1. Jailbreak the PS5 and keep an ELF loader running on port **9021**.
+2. Launch ps5upload and open **Connection**. Enter the PS5's IP address.
+3. Click **Check**, then **Send payload**. The app launches the helper and pairs with it by
+   itself.
+4. If you loaded the helper another way, the console shows a **6-digit code**. Enter it in the
+   app once; the computer is remembered.

-The payload stays loaded until the PS5 reboots or goes into rest mode.
+The helper stays until the PS5 reboots or enters rest mode. The app only needs ports **9120**
+(the helper) and **9021** (the loader); allow both in your firewall. 6.0 cannot talk to a
+v5.x helper: the app offers **Update the helper** and replaces it in one click.

 ## Architecture

 ```
-client/ (Tauri 2 · React · TypeScript)
+client/ (Tauri 2 · React · TypeScript)   Android app · Docker web UI
   │
   └── spawns ── ps5upload-engine (HTTP :19113)
                          │
-                          ▼  FTX2 binary framing
-                payload/ps5upload.elf  (PS5 C payload, ports 9113 + 9114)
+                          ▼  AVA1 (Noise-encrypted, port 9120)
+                payload/ps5upload.elf  (PS5 C payload)
 ```

-Three layers:
+- **`payload/`**: C payload on the PS5 (FreeBSD 11). Transfers, BLAKE3 verification, mounts,
+  file operations and every management call. Spec: [`protocol/ava1/SPEC.md`](protocol/ava1/SPEC.md).
+- **`engine/`**: Rust workspace with the AVA1 client, transfer logic, HTTP API and lab tools.
+- **`client/`**: Tauri 2 desktop app (and the Android and web builds), talking to the engine.

- **`payload/`** — C payload that runs on the PS5 (FreeBSD 11).
-  Ports 9113 (transfer) + 9114 (management). Handles FTX2 framing,
-  BLAKE3 verification, mount pipelines, and FS ops.
- **`engine/`** — Rust workspace with the protocol types, transfer
-  logic, HTTP service, lab CLI, mock server, and benchmarks.
- **`client/`** — Tauri 2 desktop app. Tauri IPC commands proxy to the
-  sidecar HTTP engine, keeping the engine usable from CLI / CI too.
+## Build and test

-## Build
+All workflows go through the root `Makefile` (`make help`).

-All workflows go through the root `Makefile` (see `make help`).
-
-| Target | What it does |
+| Command | What it does |
 |---|---|
 | `make build` | Payload + engine + client |
-| `make payload` | PS5 ELF at `payload/ps5upload.elf` (requires `PS5_PAYLOAD_SDK` env var) |
-| `make engine` | `cargo build --workspace` |
-| `make client` | `vite build` in `client/` |
-| `make run-client` | Tauri dev (vite + Rust main process) |
-| `make run-engine` | `ps5upload-engine` on `localhost:19113` |
-| `make send-payload` | Send the built ELF to `PS5_HOST:PS5_LOADER_PORT` |
-| `npm run validate` | Full non-hardware quality gate |
-| `make quality` | Same full non-hardware quality gate via Make |
-| `npm run coverage` | Generate frontend + Rust coverage reports |
-| `make coverage` | Same coverage reports via Make |
-| `make test` | Script syntax + engine tests + payload validation + client build |
-| `make test-engine` | `cargo test --workspace` (no hardware needed) |
-| `make dist` | Tauri bundle under `client/src-tauri/target/release/bundle/` |
+| `make run-client` | Tauri dev app |
+| `make run-engine` | Engine on `localhost:19113` |
+| `make test-engine` | Rust tests, no PS5 needed |
+| `make test-payload` | Console C code compiled and run on the host |
+| `npm run validate` | Full non-hardware gate |
+| `make dist` | Tauri bundle |

-## Test
-
-Unit and integration tests run entirely against an in-process mock
-FTX2 server — no PS5 needed:
-
-```bash
-make test-engine
-```
-
-Full local quality gate and coverage reports:
-
-```bash
-npm run validate
-npm run coverage
-```
-
-Real-hardware smoke test (requires payload already loaded):
-
-```bash
-npm run smoke:hardware
-```
-
-See [`TESTING.md`](TESTING.md) for the complete mock-test, coverage,
-cross-platform, and live-PS5 validation workflow.
+See [`TESTING.md`](TESTING.md) for the full workflow, and [`CONTRIBUTING.md`](CONTRIBUTING.md).

 ## Tech stack

- **Payload** — C (FreeBSD 11), prospero-clang toolchain
- **Engine** — Rust (edition 2021), tokio + axum 0.8
- **Desktop client** — Tauri 2, React, TypeScript, Zustand,
-  Tailwind CSS v4, Vite
- **Protocol** — FTX2 (custom binary framing, BLAKE3 shard
-  verification)
+- **Payload**: C (FreeBSD 11), prospero-clang, PS5 Payload SDK v0.44
+- **Engine**: Rust, tokio + axum
+- **Client**: Tauri 2, React, TypeScript, Zustand, Tailwind CSS v4, Vite
+- **Protocol**: AVA1 (Noise XX handshake, ChaCha20-Poly1305, BLAKE3 verification)

 ## Supported platforms

-**Desktop client**
+- **Desktop:** macOS, Linux and Windows, x64 and arm64.
+- **Android:** the `.apk` from Releases.
+- **Web UI:** the self-hosted Docker image, in any browser on your LAN (see below).
+- **PS5 firmware:** 1.00 through 13.60 on every model; one payload binary for all. Tested on
+  5.10, 9.60 and 13.60. In practice the limit is your jailbreak's ELF loader on port 9021.

-| | x64 | arm64 |
-|---|---|---|
-| **macOS**   | ✓ | ✓ |
-| **Linux**   | ✓ | ✓ |
-| **Windows** | ✓ | ✓ |
+Fake package install needs live kernel patches (kstuff / fpkg-enable) on the console; where
+they are missing the app says so instead of reporting a false success.

-**PS5 payload** — every firmware the PS5 Payload SDK supports,
-currently **1.00 through 13.60** on every console model (original
-CFI-1xxx, Slim CFI-2xxx, Pro CFI-7xxx, Digital). Built against SDK
-v0.42, which ships per-firmware kernel offsets and resolves them at
-payload startup via `kernel_get_fw_version()` — the same binary
-runs on every supported firmware without per-release rebuilds.
+## Self-hosted engine and web UI

-| Ceiling | Range | Meaning |
-|---|---|---|
-| **Payload binary** | **1.00 – 13.60** | Same ELF runs on every FW the SDK has offsets for |
-| **Practical jailbreak** | **~1.00 – 12.70** | Limited by the public ELF loader / exploit chain, not by our payload |
-| Hardware-tested here | **5.10** and **9.60** | Core transfer, mount, browse, install, FTP, metadata |
+Run the engine on a NAS or server and use it from a browser, or point the desktop app at it
+with **Settings → Engine URL**.

-> Fake/debug package install depends on the console's jailbreak having live kernel
-> patches (kstuff / fpkg-enable). On builds where those aren't active the
-> installer reports it honestly rather than claiming a false success — see
-> the FAQ on install firmware support. `.ffpkg` / `.ffpfs` are UFS images for
-> the mount flow, not install-package filename variants.
-
-The process-list feature (Hardware tab's process snapshot) reads
-`kinfo_proc` via `sysctl(KERN_PROC_PROC)` with field offsets that
-have been stable across every SDK-supported firmware — pid at
-byte 72, thread name at byte 447. No firmware-specific fallback
-table required; real command names appear across the full 1.00 –
-13.60 range. Transfer, mount, file browse, hardware monitor and FS
-ops work identically across all supported firmwares. The Hardware
-tab's blank readings (SoC clock, SoC power, CPU usage, fan duty,
-date/time) are values retail firmware doesn't expose at all, not a
-firmware-version difference — temperatures and CPU frequency read
-fine on 5.10 and 9.60 alike.
-
-**What actually gates users in practice is the ELF loader** on
-port 9021 — a third-party component, not part of ps5upload.
+- Images: `ghcr.io/phantomptr/ps5upload-engine-webui` (full web UI) and
+  `ghcr.io/phantomptr/ps5upload-engine` (engine only), tagged `:latest` or `:<version>`.
+- Start from [`engine/compose.yaml`](engine/compose.yaml). It uses host networking (stream
+  installs need the PS5 to reach the engine). Set `PS5_ADDR` and `PS5UPLOAD_ALLOW_IP`.
+- Open `http://<host>:19113`. The file picker browses the engine's disk; mount your games
+  folder into the container and set `PS5UPLOAD_BROWSE_ROOTS`.
+- Map `/data` to a host folder (on Unraid, `/mnt/user/appdata/ps5upload`): it holds the pairing
+  key, so the PS5 keeps trusting the web UI after the container is recreated.
+- An upload keeps running when you close the tab.
+- **No password.** Anyone allowed can read, write and delete on your PS5. Keep it on a trusted
+  LAN, never on the internet.
+- You may build the docker container with the `PS5UPLOAD_BASE_URL` to host the webui through a
+  reverse proxy. This cannot be changed on runtime.
+- **Scripting it:** [ps5upctl](https://github.com/yuanzhengze/ps5upctl) is a community
+  command-line client for the engine API (unofficial; the API can change between versions).

 ## FAQ

-**Q: "Connection Refused" or it won't connect?**
-* Did you load the payload first? The PS5 stops listening after a
-  reboot or rest-mode cycle — send the payload again from the
-  **Connection** tab.
-* Is your computer's firewall blocking outbound connections to
-  port 9113 / 9114 / 9021 on your PS5?
-* Your computer and PS5 don't have to be on the same subnet, but
-  there has to be a route to the IP.
-
-**Q: It connects, then drops within seconds?**
-* If you load ps5upload with an autoloader or PLDMGR, put **elfldr first**
-  in its list, before `ps5upload.elf`. Without elfldr loaded first,
-  ps5upload connects and then drops after a few seconds. Loading elfldr
-  once from PLDMGR and then sending ps5upload again also fixes it.
-
-**Q: Stream install fails before the PS5 downloads anything?**
-* The PS5 pulls the package from your computer, so it has to be able to
-  reach it. Allow ps5upload through your computer's firewall (on Windows,
-  for both Private and Public networks), keep the computer and the PS5 on
-  the same network with any VPN off, and set the PS5's Proxy Server to
-  "Do Not Use". **Upload & install** works without this connection.
-
-**Q: Resume gets stuck on "Checking what's already on your PS5…"?**
-* Reconcile scoped to the *local* tree's parent directories, so a
-  single-file upload into a folder that already holds other games
-  is now one `FS_LIST_DIR` call instead of a recursive walk of the
-  whole destination. Update to the latest build.
-* Safe-mode reconcile still hashes every same-size remote file via
-  BLAKE3 — that's ~2–3 s per GiB on PS5 UFS. Use Fast mode for
-  single-file or large-file transfers.
-
-**Q: Do I need a LAN cable?**
-* Not strictly, but Wi-Fi caps throughput well below what the PS5
-  NIC can actually do. Plug in an Ethernet cable for the best
-  experience.
-
-**Q: Can I use this over the Internet?**
-* Yes, technically. If you forward ports 9113 / 9114 to your PS5
-  it will work. However, the FTX2 protocol is optimised for speed,
-  not for authentication — we don't recommend exposing an
-  exploited PS5 to the open Internet.
-
-**Q: How do I install / launch a game from the Library tab?**
-* The Library row exposes **Mount** for `.exfat` / `.ffpkg` /
-  `.ffpfs` images plus **Register** / **Register (patch DRM)** /
-  **Launch** / **Unregister** buttons on the games inside.
-* **Mount** is hardware-validated on FW 9.60 — a 76 GiB UFS
-  `.ffpkg` mounts on `/dev/lvd1`, appears in Volumes with the
-  correct `source_image`, and unmounts cleanly. The new round's
-  payload uses compile-time `-lSce*` linkage so the rtld
-  initialises the Sony sprx state via `DT_NEEDED` before main()
-  runs.
-* **Register** is hardware-validated: pointing it at a folder
-  game with `eboot.bin` + `sce_sys/param.json` succeeds end to
-  end — `sceAppInstUtilAppInstallTitleDir` returns 0, the title
-  appears in `app.db` with the correct title name, and a nullfs
-  bind is installed at `/system_ex/app/<title_id>`. Idempotent —
-  re-registering the same path returns the same result.
-* **Register (patch DRM)** rewrites the source's
-  `sce_sys/param.json`'s `applicationDrmType` to `"standard"`
-  before staging — needed for PSN-extracted dumps that ship with
-  `"PSN"` or `"disc"`. Modifies the source file in place; only
-  use when a normal Register fails with a DRM error.
-* **Launch** routes `sceLncUtilLaunchApp` through a ptrace RPC
-  into `SceShellUI` so Sony's `getpid() == SceShellUI.pid`
-  caller-context check passes natively. Hardware-validated on
-  FW 9.60: hitting Launch on a registered title actually starts
-  the game (SoC power draw confirms the title comes up). Falls
-  back to a direct call when ShellUI RPC isn't available.
-* **Listing inside an active mount** (`/mnt/ps5upload/<name>/...`)
-  is gated by the PS5 sandbox / LVD mount permission set rather
-  than payload privilege. We re-check after every credential
-  elevation; treat "ENOTDIR descending into a mount" as
-  expected for now. Other PS5-side tools see the mount via
-  `/mnt/ps5upload/`, and the source path is recorded in our
-  tracker so reconcile-on-next-boot keeps state consistent.
-* Sensors are read **on demand** (the Hardware tab's "Read sensors"
-  button), not on a timer. Each read briefly ptrace-pauses the system UI,
-  and doing that on a loop could destabilize the console — it powered
-  some consoles off — so the auto-refresh covers only the ptrace-free
-  data (info, uptime, storage).
-* Which readings actually work, measured on FW 9.60 and 5.10:
-  * **Work:** CPU / SoC / M.2 temperature, CPU frequency, storage totals.
-  * **Show `—`:** SoC clock, SoC power, CPU usage, fan duty, per-drive
-    sensors, and the console date/time. These aren't broken payload code
-    — retail firmware doesn't expose them to us. A persistent `—` there
-    is the expected result, not a fault to report.
-
-**Q: "No writable storage found"?**
-* The tool blocks writes to read-only system partitions. If you
-  want to write to a USB drive, make sure it's formatted (exFAT is
-  best) and plugged in *before* you load the payload.
-
-**Q: macOS: "App is damaged" or "Unidentified Developer"?**
-* This is normal for unsigned apps. Right-click the app, select
-  **Open**, then click **Open** in the dialog.
-* If macOS still blocks it, **System Settings → Privacy &
-  Security → Open Anyway**.
-* Last resort — remove the quarantine flag:
-  ```bash
-  xattr -dr com.apple.quarantine /Applications/ps5upload.app
-  ```
-* No Apple Developer account is required; the app is intentionally
-  unsigned.
-
-**Q: Where are config and logs saved?**
-* The desktop client uses the OS app-data directory:
-  * **Windows:** `%APPDATA%\com.phantomptr.ps5upload`
-  * **macOS:** `~/Library/Application Support/com.phantomptr.ps5upload`
-  * **Linux:** `~/.local/share/com.phantomptr.ps5upload`
-
-**Q: Does this work on PS4?**
-* No. The payload is compiled specifically for the PS5 (FreeBSD
-  11, Zen 2) and calls PS5-only kernel entry points.
-
-**Q: What about older firmware (≤ 9.00)?**
-* The FTX2 payload itself doesn't call firmware-gated APIs, but
-  the ELF loader workflow on port 9021 depends on what your
-  jailbreak exposes. Patches welcome.
-
-**Q: Can I run ps5upload headless / over SSH?**
-* Not the GUI. The `ps5upload-engine` binary speaks HTTP on
-  `:19113` and exposes the full transfer / reconcile / FS API, so
-  you can script transfers from a terminal or CI job without ever
-  opening the desktop client.
-
-**Q: Can the engine run on a different machine (remote / self-hosted)?**
-* Yes (3.3.7+). Host the engine elsewhere and point the desktop app at it via
-  **Settings → Engine URL**. An official multi-arch image is published at
-  `ghcr.io/phantomptr/ps5upload-engine` (`:latest` or `:<version>`); you can
-  also build from `engine/Dockerfile`. To let a remote box reach it, set
-  `PS5UPLOAD_ALLOW_IP` to that box's IP. **Security:** the engine's API is
-  unauthenticated (it can read/write/delete PS5 files), so only do this on a
-  trusted LAN — never expose the engine to the internet.
-
-**Q: Can I run ps5upload from a browser, with no desktop app at all (self-hosted web UI)?**
-* Yes (3.3.25+). A separate `webui` build of the engine serves the **full
-  React app over HTTP**, so you can manage your PS5 from any browser on the
-  LAN — handy for a NAS or headless box you don't want to install the desktop
-  client on. An official multi-arch image is published at
-  `ghcr.io/phantomptr/ps5upload-engine-webui` (`:latest` or `:<version>`); or
-  build it yourself with
-  `docker build -f engine/Dockerfile.webui -t ps5upload-engine-webui .`
-  (build context is the **repo root**, not `engine/` — it needs `client/` to
-  build the frontend first). Run it the same way as the plain engine image
-  (`PS5_ADDR`, `PS5UPLOAD_ALLOW_IP`) and open `http://<host>:19113` in a
-  browser on an allowlisted IP. Same security model as the remote engine
-  above: **unauthenticated**, LAN-only, never expose it to the internet.
-  **Upload works in the browser** too, operating on files already
-  present on the **engine's own machine** — e.g. mount a folder into the
-  container with `-v /host/games:/data/games`, then browse to `/data/games`
-  in the in-app file picker. That picker browses the *engine's* filesystem,
-  not the browser's own machine — a browser tab has no way to reach a
-  remote engine's disk except through what the engine itself can already
-  read. A few things are still desktop-only and hidden in the browser UI:
-  archive uploads (`.zip`/`.7z`/`.rar`), Payloads (sending a `.elf`/etc. from
-  disk), installing a `.pkg` you pick from your PC, and saving a save-data
-  backup to your computer — everything else that operates on the PS5 itself
-  (browse, transfer, install from a PS5-connected USB drive, hardware
-  monitor, saves list, …) works the same as the desktop app. The upload
-  queue also doesn't persist across a full page reload in browser mode
-  (queue persistence is desktop-only).
-* Installing packages from the browser needs an engine that carries
-  ps5upload's on-console installer (`ps5upload-installer.elf`): every
-  install goes through it, and the engine sends it to the console when it
-  isn't already running there (it runs alongside the ps5upload helper and
-  never replaces it). The released engine binaries and the official Docker
-  images include it, and so does an engine built from a full checkout — the
-  ELF is in the repository. You can also point the engine at your own copies
-  with `-e PS5UPLOAD_PAYLOAD_DIR=/path/to/elves`.
+Common questions (connection problems, install errors, USB drives, firmware) are in
+[`FAQ.md`](FAQ.md), also available inside the app.

 ## Contributing

 - Report bugs:
  [GitHub Issues](https://github.com/phantomptr/ps5upload/issues)
- Pull requests welcome — please read
-  `.github/PULL_REQUEST_TEMPLATE.md` and run `make test` locally
-  before opening.
+- Pull requests welcome. Read [`CONTRIBUTING.md`](CONTRIBUTING.md) and run the checks in
+  [`TESTING.md`](TESTING.md) before opening.
+
+## How this project is built
+
+ps5upload is a vibe-coded project. The code is written with AI coding
+tools, directed, tested on real consoles and released by one maintainer.
+That is what keeps the development cycle fast: bug reports, feature
+requests and enhancements are usually turned around in days, not months.
+
+The trade-off is that the code has not had the slow, line-by-line human
+review a hand-written project of this size would get. Every release is
+tested on hardware, but you should expect rough edges, read the
+[disclaimer](DISCLAIMER.md), keep backups of anything you care about on
+the console, and use the tool at your own discretion.

 ## Disclaimer

@@ -648,11 +413,23 @@ This software builds on the following open-source projects:
 * [unrar / unrar_sys](https://crates.io/crates/unrar) — `.rar` extraction on **desktop** (bundles the **UnRAR** source by Alexander Roshal; used to *extract only*, never to compress). See the required notice and the GPLv3 §7 linking exception in [`LICENSES/`](LICENSES/). The `unrar` wrapper (MIT OR Apache-2.0) is **vendored** at [`third_party/unrar`](third_party/unrar) carrying one local fix for an out-of-bounds read on multi-volume archives — upstream 0.5.8 has no fix; see that directory's README.

 **Payload (PS5):**
-* [PS5 Payload SDK](https://github.com/ps5-payload-dev/sdk) — Open-source SDK for PS5 payload development
-* [BLAKE3](https://github.com/BLAKE3-team/BLAKE3) — Fast cryptographic hashing (per-shard verification)
+* [PS5 Payload SDK](https://github.com/ps5-payload-dev/sdk) — Open-source SDK for PS5 payload development; its startup code is **vendored** at [`payload/third_party/sdk-crt`](payload/third_party/sdk-crt) with one fix so payloads start on firmware where two kernel lookups fail (FW 5.50)
+* [elfldr](https://github.com/ps5-payload-dev/elfldr) (GPLv3) — the ELF loader; a patched copy is **vendored** at [`third_party/elfldr`](third_party/elfldr) (fix for a loader that hangs on a silent client)
+* [Monocypher](https://github.com/LoupVaillant/Monocypher) (CC0 / BSD-2) — AVA1's cryptography on the console (X25519, ChaCha20-Poly1305, BLAKE2b)
+* [BLAKE3](https://github.com/BLAKE3-team/BLAKE3) (CC0 / Apache-2.0) — fast hashing for AVA1 file verification
+* [SQLite](https://sqlite.org/) (public domain) — reading the console's app database
+* [tiny-AES-c](https://github.com/kokke/tiny-AES-c) (Unlicense) — MC4 cheat decryption

 ## Thanks

+* [elf-arsenal](https://git.etawen.dev/soniciso/elf-arsenal) (soniciso, Sanad) — parts of the drive sensor, cheat and wake-watchdog code
+* [PS5 Dump Forge](https://github.com/quer3q/ps5-dump-forge) (quer3q) — the UFS2 (`.ffpkg`) and PFS (`.ffpfs`) image writers, the streaming `.ffpfsc` container, reader and safety fixes to the package crates, and the ideas behind hash-checked images and spare space for read-write mounts
+* [ampr_emu](https://github.com/drakmor/ampr_emu) and [ShadowMountPlus](https://github.com/drakmor/ShadowMountPlus) (drakmor) — the AMPR emulator that plays LZ4 asset packs, and the mount tool that shows our images on the home screen. Our packer is a port of its `ampr_pack.py`, the index writer follows `build_ampr_index.py`, and "Measure how it plays" is a port of `ampr_pack_profile.py` fed by the debug build's command journal
+* [garlic-savemgr](https://github.com/earthonion/garlic-savemgr) (earthonion) — how a save image is opened on the console: the sealed key unsealed through `/dev/pfsmgr` and the image mounted with `sceFsMountSaveData` from a copy under `/data`, which "Open save" follows
+* [PROSPEROPatches](https://prosperopatches.com/), [ORBISPatches](https://orbispatches.com/) and [TMDB](https://www.themoviedb.org/) — game details and artwork
+* [etaHEN PS5_Cheats](https://github.com/etaHEN/PS5_Cheats) and GoldHEN — cheat files
+* Everyone who contributed code, translations and docs, and the Discord testers
+
 ps5upload stands on the shoulders of the **PS5 homebrew scene**. Huge
 thanks to everyone who makes this ecosystem possible — the exploit and
 kernel researchers, the ELF/payload loader authors, the PS5 Payload SDK
@@ -660,6 +437,12 @@ maintainers, the homebrew tool developers whose work this lives alongside,
 and everyone in the community who tests, reports bugs, and shares
 knowledge. None of this exists without your collective effort. 🙏

+ps5upload is one tool among many. The scene is full of great work:
+loaders, kernel patches, mount tools, dumpers, cheat engines, file
+managers, save tools and more, most of it made by people in their spare
+time. If something here saves you time, the people behind the tools it
+lives alongside deserve the same thanks. **Please support them too.**
+
 ## License

 GNU General Public License v3.0 (GPLv3).
@@ -32,9 +32,11 @@ reports are taken seriously and prioritized.

 ## Scope

-ps5upload talks to a **jailbroken PS5 over a trusted LAN**. The FTX2
-transfer protocol is optimized for speed, not authentication, and is not
-designed to be exposed to untrusted networks — see the README's FAQ. The
+ps5upload talks to a **jailbroken PS5 over a LAN**. The AVA1 protocol
+(port 9120) uses the Noise XX handshake and encrypts and authenticates
+every byte; the console only accepts devices that were paired by comparing
+a six-digit code, or the engine that launched it. Weaknesses in pairing,
+the handshake, or AVA1's message parsers are squarely in scope. The
 local engine binds loopback (`127.0.0.1:19113`) and rejects non-loopback
 callers except the PS5-facing `/pkg-host/` route. Reports most in scope:

@@ -37,6 +37,15 @@ caught real regressions:
 Running a narrower check and assuming the wider one follows is the most
 common way to burn a cycle here.

+`npm run validate` is not the whole gate. Before a PR also run:
+
+```sh
+( cd client/src-tauri && cargo fmt --all -- --check )   # validate only checks fmt in engine/
+( cd engine && cargo test -p ava1-ctest -- --test-threads=1 )
+make test-payload                                       # needs PS5_PAYLOAD_SDK
+make check-no-ftx2                                      # the retired protocol must stay gone
+```
+
 ## Layer 2 — payload build and self-tests

 ```sh
@@ -48,21 +57,24 @@ Builds `payload/ps5upload.elf` and the DPI daemon, checks both are PS5
 ELFs with valid gzip resources, then runs every host self-test with
 `-Wall -Wextra -Werror`:

-| Self-test | Pins |
-|---|---|
-| `hw_guard` | Recovering from a faulting Sony getter without losing the helper |
-| `ptrace_recovery` | Timeout recovery never resuming injected registers |
-| `timed_init` | Bounded one-time init never starting a second initializer |
-| `appdb_scan` | Reading `app.db` as real SQLite records, not printable runs |
-| `ftp_format` | PASV/EPSV/LIST reply shapes clients parse strictly |
-| `ftp_lifecycle` | Session registration, generations, stop-to-kill |
-| `sdk_param` | `param.json` rewrite, and reporting when nothing changed |
-| `elf_param` | Finding SDK fields via program headers, not stray magic bytes |
-| `sdk_changer_file` | Patching only tracked sources; durable backups |
+Each self-test lives in `payload/tests/*_selftest.c` (hardware guards, ptrace recovery,
+`app.db` reading, FTP, SDK param rewriting, installer, cheats, wake watchdog and more). The
+AVA1 C itself is tested by `ava1-ctest`, which compiles it on the host and checks it against the
+Rust side (see the full gate below).

-The SDK version is pinned in `scripts/ps5-sdk.env` (currently **v0.42**)
+The SDK version is pinned in `scripts/ps5-sdk.env` (currently **v0.44**)
 and verified by checksum. Local installers and CI read the same file.

+To move to a newer SDK release, run `make update-sdk` (or
+`scripts/update-ps5-sdk.sh [--tag vX.Y] [--check]`). It downloads the release,
+rewrites the pin and its checksum, refreshes the vendored `prospero-nid` and
+`payload/third_party/sdk-crt` if upstream changed them at that tag, and installs
+the SDK into `$PS5_PAYLOAD_SDK` (default `/opt/ps5-payload-sdk`), keeping the old
+one as a `.backup-<old tag>-<time>` directory. If `/opt` needs root it uses
+`sudo` from a terminal; without it, the backup goes to your home directory.
+Then `rm -rf payload/build payload/installer/build payload/third_party/sdk-crt/build`,
+run `make test-payload`, and commit the changed pin.
+
 **Adding payload logic?** If it can be separated from the console, put it
 header-only in `payload/include/` and give it a self-test here. That is
 the established convention and the reason the list above exists.
@@ -73,7 +85,7 @@ Nothing here is tied to one network. Every entry point takes an address:

 ```sh
 export PS5_HOST=192.168.1.50            # console IP (loader + payload)
-export PS5_ADDR=192.168.1.50:9113       # transfer port, for scripts/bench
+export PS5_ADDR=192.168.1.50            # console IP; the engine owns the port (9120)

 make send-payload PS5_HOST=$PS5_HOST
 npm run smoke:hardware                  # or: node tests/smoke-hardware.mjs
@@ -85,7 +97,7 @@ committed defaults — those stay generic on purpose.

 | Command | Does |
 |---|---|
-| `make validate` | Build, send, wait for `:9113`, smoke, sweep, write `bench/reports/<ts>-sweep.{json,md}` |
+| `make validate` | Build, send, wait for `:9120`, smoke, sweep, write `bench/reports/<ts>-sweep.{json,md}` |
 | `make validate-xl` | Adds the 200k-file stress profile |
 | `node tests/smoke-hardware.mjs --no-spawn-engine` | Against an engine already running |

@@ -94,11 +106,11 @@ Clean up test uploads afterwards:
 ```sh
 curl -X POST http://127.0.0.1:19113/api/ps5/cleanup \
  -H 'content-type: application/json' \
-  -d '{"addr":"'"$PS5_HOST"':9114","path":"/data/ps5upload/tests/manual"}'
+  -d '{"addr":"'"$PS5_HOST"'","path":"/data/ps5upload/tests/manual"}'
 ```

-**Use a live console when touching:** the payload C runtime, FTX2
-framing, transfer/reconcile/resume, storage, mount, cleanup, the file
+**Use a live console when touching:** the payload C runtime, AVA1
+(`payload/ava1/`), transfer/reconcile/resume, storage, mount, cleanup, the file
 browser, volume commands, or anything performance-sensitive.

 ### Hardware testing has teeth
@@ -220,8 +232,7 @@ out-of-bounds read in release. `0.5.8` is the latest release, so the crate
 is vendored at `third_party/unrar` with the fix and both workspaces
 redirect to it via `[patch.crates-io]`.

-See `third_party/unrar/README.md` for the patch and
-`docs/unrar-upstream-bug.md` for the report to send upstream. If you bump
+See `third_party/unrar/README.md` for the patch. If you bump
 the crate, re-apply the hunk or drop the vendoring once upstream ships the
 fix.

@@ -1 +1 @@
-5.35.0
+7.1.8
@@ -1,37 +1,26 @@
 # Bench

-This directory now contains the first repo-native benchmark tooling for the `2.0` FTX2 path.
+Repo-native benchmark and hardware-sweep tooling that drives a running `ps5upload-engine` over its HTTP API.

 Current contents:

- `run-ftx2-upload.mjs`
-  Runs a real upload benchmark against `ps5upload-engine` and stores a JSON result snapshot under `bench/results/`.
- `check-ftx2-baseline.mjs`
-  Compares one result JSON against a baseline result JSON and fails on throughput or elapsed-time regression.
- `baselines/`
-  Commit known-good result snapshots here when you want a stable comparison target.
- `results/`
-  Local benchmark outputs written by `run-ftx2-upload.mjs`.
+- `run-sweep.mjs`
+  Runs every profile in `profiles.mjs` against a live PS5 through the engine (`make validate`, `make validate-xl`) and writes a report under `bench/reports/`.
+- `profiles.mjs`
+  The shared profile definitions. `scripts/gen-fixtures.mjs` builds the local trees they upload.
+- `resume-test.mjs`, `edge-case-sweep.mjs`
+  Hardware checks for resume and edge cases.
+
+Protocol benchmarks (AVA1 upload, download, copy, resume, relay and the drop-and-resend run) are `ps5upload-lab bench` scenarios; see `cargo run -p ps5upload-lab -- bench --help` from `engine/`.

 Example flow:

 ```bash
-node bench/run-ftx2-upload.mjs \
-  --spawn-engine \
-  --ps5-addr=192.168.137.2:9113 \
-  --source=/path/to/workload
-
-cp bench/results/<new-result>.json bench/baselines/ftx2-upload-main.json
-
-node bench/check-ftx2-baseline.mjs \
-  --result=bench/results/<new-result>.json \
-  --baseline=bench/baselines/ftx2-upload-main.json
+node bench/run-sweep.mjs --spawn-engine --ps5-addr=192.168.137.2
 ```

 Notes:

- The benchmark targets the `2.0` engine HTTP API, not the legacy app/desktop transfer path.
- `run-ftx2-upload.mjs` accepts either a file or a directory source.
+- The sweep targets the engine HTTP API. The console address is a bare host; a `:port` suffix is ignored.
 - If the engine is already running, omit `--spawn-engine`.
- Baselines are intentionally captured from real hardware; this repo does not invent threshold numbers ahead of measurement.
- The baseline JSON files in `bench/baselines/` were captured against the pre-2.2.0 engine which bound port `9114`. The current engine binds `19113`. The captured `engine_url` field in the older JSONs is a historical record of where the run actually executed, not a current configuration knob — `check-ftx2-baseline.mjs` compares throughput and elapsed-time, not URLs, so the drift is harmless. When refreshing a baseline against the current engine, generate a new run and overwrite the file rather than patching the URL in place. The throughput numbers themselves remain valid as a regression target across the port change.
+- Results are captured from real hardware; this repo does not invent threshold numbers ahead of measurement.
@@ -1 +0,0 @@
-
@@ -1,29 +0,0 @@
-{
-  "schema_version": 1,
-  "benchmark": "ftx2_upload",
-  "created_at": "2026-04-17T08:24:54.610Z",
-  "engine_url": "http://127.0.0.1:9114",
-  "ps5_addr": "192.168.137.2:9113",
-  "source": {
-    "path": "/tmp/bench-dir-32x4m",
-    "kind": "dir",
-    "bytes": 4096
-  },
-  "destination": {
-    "root": "/data/ps5upload-bench",
-    "final_path": "/data/ps5upload-bench"
-  },
-  "job": {
-    "job_id": "4c95a227-c2b6-4edd-82a8-194918c2bb36",
-    "tx_id_hex": "f2f61953e76b41bba9306ef50967fae5",
-    "shards_sent": 32,
-    "bytes_sent": 134217728,
-    "started_at_ms": 1776414290591,
-    "completed_at_ms": 1776414294259,
-    "elapsed_ms": 3668
-  },
-  "metrics": {
-    "bytes_per_sec": 36591528.89858233,
-    "mib_per_sec": 34.89640130861505
-  }
-}
@@ -1,29 +0,0 @@
-{
-  "schema_version": 1,
-  "benchmark": "ftx2_upload",
-  "created_at": "2026-04-17T08:24:50.510Z",
-  "engine_url": "http://127.0.0.1:9114",
-  "ps5_addr": "192.168.137.2:9113",
-  "source": {
-    "path": "/tmp/bench-128m.bin",
-    "kind": "file",
-    "bytes": 134217728
-  },
-  "destination": {
-    "root": "/data/ps5upload-bench",
-    "final_path": "/data/ps5upload-bench/bench-128m.bin"
-  },
-  "job": {
-    "job_id": "7d35bac6-cea8-4dda-ac19-02caf63dbb83",
-    "tx_id_hex": "20f7c34a255248879375509d1fab858c",
-    "shards_sent": 4,
-    "bytes_sent": 134217728,
-    "started_at_ms": 1776414287499,
-    "completed_at_ms": 1776414290094,
-    "elapsed_ms": 2595
-  },
-  "metrics": {
-    "bytes_per_sec": 51721667.82273603,
-    "mib_per_sec": 49.32562620423892
-  }
-}
@@ -1,96 +0,0 @@
-#!/usr/bin/env node
-
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
-const repoRoot = path.resolve(__dirname, '..');
-
-function log(message) {
-  process.stdout.write(`[bench-ftx2-gate] ${message}\n`);
-}
-
-function parseArgs(argv) {
-  const out = {
-    result: '',
-    baseline: '',
-    minThroughputRatio: 0.9,
-    maxElapsedRatio: 1.15,
-  };
-
-  for (const arg of argv) {
-    if (arg.startsWith('--result=')) out.result = path.resolve(repoRoot, arg.slice('--result='.length));
-    else if (arg.startsWith('--baseline=')) out.baseline = path.resolve(repoRoot, arg.slice('--baseline='.length));
-    else if (arg.startsWith('--min-throughput-ratio=')) out.minThroughputRatio = Number(arg.slice('--min-throughput-ratio='.length)) || out.minThroughputRatio;
-    else if (arg.startsWith('--max-elapsed-ratio=')) out.maxElapsedRatio = Number(arg.slice('--max-elapsed-ratio='.length)) || out.maxElapsedRatio;
-  }
-
-  if (!out.result || !out.baseline) {
-    throw new Error('usage: node bench/check-ftx2-baseline.mjs --result=... --baseline=...');
-  }
-
-  return out;
-}
-
-async function readJson(filePath) {
-  return JSON.parse(await fs.readFile(filePath, 'utf8'));
-}
-
-function formatMiBPerSec(value) {
-  return `${Number(value || 0).toFixed(2)} MiB/s`;
-}
-
-async function main() {
-  const options = parseArgs(process.argv.slice(2));
-  const result = await readJson(options.result);
-  const baseline = await readJson(options.baseline);
-
-  const resultBps = Number(result?.metrics?.bytes_per_sec || 0);
-  const baselineBps = Number(baseline?.metrics?.bytes_per_sec || 0);
-  const resultElapsedMs = Number(result?.job?.elapsed_ms || 0);
-  const baselineElapsedMs = Number(baseline?.job?.elapsed_ms || 0);
-
-  if (resultBps <= 0 || baselineBps <= 0) {
-    throw new Error('result and baseline must both have positive metrics.bytes_per_sec');
-  }
-  if (resultElapsedMs <= 0 || baselineElapsedMs <= 0) {
-    throw new Error('result and baseline must both have positive job.elapsed_ms');
-  }
-
-  const throughputRatio = resultBps / baselineBps;
-  const elapsedRatio = resultElapsedMs / baselineElapsedMs;
-
-  log(`result throughput:   ${formatMiBPerSec(result?.metrics?.mib_per_sec)}`);
-  log(`baseline throughput: ${formatMiBPerSec(baseline?.metrics?.mib_per_sec)}`);
-  log(`throughput ratio:    ${throughputRatio.toFixed(3)}`);
-  log(`elapsed ratio:       ${elapsedRatio.toFixed(3)}`);
-
-  const failures = [];
-  if (throughputRatio < options.minThroughputRatio) {
-    failures.push(
-      `throughput ratio ${throughputRatio.toFixed(3)} is below threshold ${options.minThroughputRatio.toFixed(3)}`,
-    );
-  }
-  if (elapsedRatio > options.maxElapsedRatio) {
-    failures.push(
-      `elapsed ratio ${elapsedRatio.toFixed(3)} exceeds threshold ${options.maxElapsedRatio.toFixed(3)}`,
-    );
-  }
-
-  if (failures.length) {
-    for (const failure of failures) {
-      log(`FAIL: ${failure}`);
-    }
-    process.exitCode = 1;
-    return;
-  }
-
-  log('PASS');
-}
-
-main().catch((error) => {
-  process.stderr.write(`[bench-ftx2-gate] error: ${error.message}\n`);
-  process.exitCode = 1;
-});
@@ -3,8 +3,8 @@
 * Upload edge-case sweep (manual hardware test, not CI).
 *
 * Exercises the tricky upload paths the smoke test doesn't: special-char
- * filenames, empty files, nested dirs, reconcile-skip, zip upload, multistream
- * with odd names, and concurrent uploads — and VERIFIES correctness by
+ * filenames, empty files, nested dirs, reconcile-skip, zip upload and
+ * concurrent uploads — and VERIFIES correctness by
 * downloading each upload back and byte-comparing (catches silent corruption,
 * not just "job said ok").
 *
@@ -20,7 +20,7 @@ import { execFileSync } from "node:child_process";
 const ENGINE = process.env.ENGINE_URL || "http://127.0.0.1:19113";
 const HOST = process.argv[2];
 if (!HOST) { console.error("usage: edge-case-sweep.mjs <ps5-ip>"); process.exit(2); }
-const ADDR = HOST.includes(":") ? HOST : `${HOST}:9113`;
+const ADDR = HOST;
 const DEST = "/data/ps5upload/tests/edge";

 let pass = 0, fail = 0;
@@ -55,13 +55,13 @@ async function pollJob(id, timeoutMs = 120000) {
 async function del(p) { await jpost("/api/ps5/fs/delete", { path: p, addr: ADDR }); }

 // Upload a dir, download it back to a fresh local dir, return map name->sha of downloaded files.
-async function uploadDirAndVerify(label, localDir, ps5Sub, { streams = 1, reconcile = false } = {}) {
+async function uploadDirAndVerify(label, localDir, ps5Sub, { reconcile = false } = {}) {
  const destRoot = `${DEST}/${ps5Sub}`;
  await del(destRoot);
  await new Promise((x) => setTimeout(x, 400));
  const ep = reconcile ? "/api/transfer/dir-reconcile" : "/api/transfer/dir";
  const body = reconcile
-    ? { src_dir: localDir, dest_root: destRoot, addr: ADDR, mode: "fast", tx_id: null, excludes: [], streams }
+    ? { src_dir: localDir, dest_root: destRoot, addr: ADDR, mode: "fast", tx_id: null, excludes: [] }
    : { src_dir: localDir, dest_root: destRoot, addr: ADDR };
  const st = await jpost(ep, body);
  if (!st.ok || !st.json.job_id) return bad(label, `start HTTP ${st.status} ${JSON.stringify(st.json)}`);
@@ -88,7 +88,7 @@ async function uploadDirAndVerify(label, localDir, ps5Sub, { streams = 1, reconc
  await fs.rm(dlDir, { recursive: true, force: true });
  if (missing.length) return bad(label, `${missing.length} file(s) missing after round-trip, e.g. ${JSON.stringify(missing.slice(0,3))}`);
  if (mism) return bad(label, `${mism}/${checked} file(s) byte-mismatch after round-trip`);
-  ok(`${label} (${checked} files round-tripped, streams=${streams}${reconcile ? ", reconcile" : ""})`);
+  ok(`${label} (${checked} files round-tripped${reconcile ? ", reconcile" : ""})`);
  return res.j;
 }

@@ -120,8 +120,7 @@ async function main() {
  for (let i = 0; i < trickyNames.length; i++) {
    await fs.writeFile(path.join(specialDir, trickyNames[i]), crypto.randomBytes(1024 + i * 37));
  }
-  await uploadDirAndVerify("special-chars (dir, single stream)", specialDir, "special", { streams: 1 });
-  await uploadDirAndVerify("special-chars (dir, 4 streams)", specialDir, "special4", { streams: 4 });
+  await uploadDirAndVerify("special-chars (dir)", specialDir, "special");

  // ---- 2. Empty file + empty-ish mix ----
  const emptyDir = path.join(work, "empties");
@@ -148,11 +147,11 @@ async function main() {
  for (let i = 0; i < 6; i++) await fs.writeFile(path.join(recDir, `rec_${i}.bin`), crypto.randomBytes(64 * 1024));
  const destRec = `${DEST}/rec`;
  await del(destRec); await new Promise((x) => setTimeout(x, 400));
-  const r1 = await jpost("/api/transfer/dir-reconcile", { src_dir: recDir, dest_root: destRec, addr: ADDR, mode: "fast", tx_id: null, excludes: [], streams: 1 });
+  const r1 = await jpost("/api/transfer/dir-reconcile", { src_dir: recDir, dest_root: destRec, addr: ADDR, mode: "fast", tx_id: null, excludes: [] });
  const r1res = await pollJob(r1.json.job_id);
  if (!r1res.ok) bad("reconcile run-1", r1res.error);
  else {
-    const r2 = await jpost("/api/transfer/dir-reconcile", { src_dir: recDir, dest_root: destRec, addr: ADDR, mode: "fast", tx_id: null, excludes: [], streams: 1 });
+    const r2 = await jpost("/api/transfer/dir-reconcile", { src_dir: recDir, dest_root: destRec, addr: ADDR, mode: "fast", tx_id: null, excludes: [] });
    const r2res = await pollJob(r2.json.job_id);
    if (!r2res.ok) bad("reconcile run-2", r2res.error);
    else {
@@ -1,190 +0,0 @@
-#!/usr/bin/env node
-/*
- * Multi-stream hardware test harness (manual, not CI).
- *
- * Drives the ps5upload engine HTTP API against a live PS5 to measure upload
- * throughput at varying parallel-stream counts. Assumes the engine is already
- * running (spawn it separately so it survives across subcommands and its logs
- * are visible). Sequential by design — one upload at a time.
- *
- * Subcommands:
- *   status <host>                          print STATUS (incl max_transfer_streams)
- *   delete <host> <ps5path>                rm -rf a PS5 path (best effort)
- *   dir    <host> <src> <destRoot> <csv>   folder upload at each stream count in <csv>
- *   file   <host> <src> <ps5dest>          single-file upload (single stream)
- *
- * Env: ENGINE_URL (default http://127.0.0.1:19113)
- */
-const ENGINE = process.env.ENGINE_URL || "http://127.0.0.1:19113";
-const MGMT = (h) => (h.includes(":") ? h : `${h}:9113`); // engine derives mgmt from this
-
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-const mib = (b) => b / (1024 * 1024);
-
-async function jpost(path, body) {
-  const r = await fetch(`${ENGINE}${path}`, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify(body),
-  });
-  const text = await r.text();
-  let json;
-  try {
-    json = JSON.parse(text);
-  } catch {
-    json = { raw: text };
-  }
-  return { ok: r.ok, status: r.status, json };
-}
-
-async function jget(path) {
-  const r = await fetch(`${ENGINE}${path}`);
-  const text = await r.text();
-  let json;
-  try {
-    json = JSON.parse(text);
-  } catch {
-    json = { raw: text };
-  }
-  return { ok: r.ok, status: r.status, json };
-}
-
-async function cmdStatus(host) {
-  const r = await jget(`/api/ps5/status?addr=${encodeURIComponent(MGMT(host))}`);
-  console.log(`STATUS ${host}: HTTP ${r.status}`);
-  console.log(JSON.stringify(r.json, null, 2));
-}
-
-async function cmdDelete(host, ps5path) {
-  const r = await jpost("/api/ps5/fs/delete", { addr: MGMT(host), path: ps5path, op_id: 0 });
-  console.log(`delete ${ps5path}: HTTP ${r.status} ${JSON.stringify(r.json)}`);
-}
-
-// Poll a job to completion, sampling bytes_sent to estimate peak instantaneous
-// rate. Returns { ok, elapsedMs, bytes, shards, files, peakMiBs, error }.
-async function pollJob(jobId, { sampleMs = 500 } = {}) {
-  let last = { t: Date.now(), bytes: 0 };
-  let peak = 0;
-  for (;;) {
-    const r = await jget(`/api/jobs/${jobId}`);
-    const j = r.json || {};
-    const status = j.status;
-    if (status === "running") {
-      const now = Date.now();
-      const bytes = j.bytes_sent || 0;
-      const dt = (now - last.t) / 1000;
-      if (dt >= 0.4) {
-        const inst = mib(bytes - last.bytes) / dt;
-        if (inst > peak) peak = inst;
-        last = { t: now, bytes };
-      }
-      await sleep(sampleMs);
-      continue;
-    }
-    if (status === "done") {
-      return {
-        ok: true,
-        elapsedMs: j.elapsed_ms || 0,
-        bytes: j.bytes_sent || 0,
-        shards: j.shards_sent || 0,
-        files: j.files_sent || 0,
-        peakMiBs: peak,
-      };
-    }
-    if (status === "failed") {
-      return { ok: false, error: j.error || JSON.stringify(j) };
-    }
-    // Unknown / queued — keep polling.
-    await sleep(sampleMs);
-  }
-}
-
-async function cmdDir(host, src, destRoot, csv) {
-  const streamsList = csv.split(",").map((s) => parseInt(s.trim(), 10)).filter((n) => n >= 1);
-  const results = [];
-  for (const streams of streamsList) {
-    // Clean the dest so every run re-sends the full folder (reconcile would
-    // otherwise skip already-present files and report ~0 bytes on run 2+).
-    await cmdDelete(host, destRoot);
-    await sleep(1500); // let the payload settle after the delete
-    console.log(`\n=== dir upload: streams=${streams} → ${destRoot} ===`);
-    const t0 = Date.now();
-    const start = await jpost("/api/transfer/dir-reconcile", {
-      src_dir: src,
-      dest_root: destRoot,
-      addr: MGMT(host),
-      mode: "fast",
-      tx_id: null,
-      excludes: [],
-      streams,
-    });
-    if (!start.ok || !start.json.job_id) {
-      console.log(`  START FAILED: HTTP ${start.status} ${JSON.stringify(start.json)}`);
-      results.push({ streams, ok: false, error: `start ${start.status}` });
-      continue;
-    }
-    const res = await pollJob(start.json.job_id);
-    const wallMs = Date.now() - t0;
-    if (!res.ok) {
-      console.log(`  FAILED: ${res.error}`);
-      results.push({ streams, ok: false, error: res.error });
-      continue;
-    }
-    const avg = mib(res.bytes) / (res.elapsedMs / 1000);
-    const avgWall = mib(res.bytes) / (wallMs / 1000);
-    console.log(
-      `  OK ${(mib(res.bytes)).toFixed(0)} MiB / ${(res.elapsedMs / 1000).toFixed(1)}s` +
-        ` | avg ${avg.toFixed(1)} MiB/s (job) ${avgWall.toFixed(1)} MiB/s (wall)` +
-        ` | peak ${res.peakMiBs.toFixed(1)} MiB/s | files=${res.files} shards=${res.shards}`,
-    );
-    results.push({ streams, ok: true, bytes: res.bytes, elapsedMs: res.elapsedMs, avg, peak: res.peakMiBs });
-    await sleep(2000);
-  }
-  console.log(`\n── summary (${host}) ──`);
-  for (const r of results) {
-    if (r.ok) console.log(`  streams=${r.streams}: avg ${r.avg.toFixed(1)} MiB/s, peak ${r.peak.toFixed(1)} MiB/s`);
-    else console.log(`  streams=${r.streams}: FAILED ${r.error}`);
-  }
-}
-
-async function cmdFile(host, src, dest) {
-  console.log(`\n=== single-file upload → ${dest} ===`);
-  const t0 = Date.now();
-  const start = await jpost("/api/transfer/file", {
-    src,
-    dest,
-    addr: MGMT(host),
-    tx_id: null,
-  });
-  if (!start.ok || !start.json.job_id) {
-    console.log(`  START FAILED: HTTP ${start.status} ${JSON.stringify(start.json)}`);
-    return;
-  }
-  const res = await pollJob(start.json.job_id);
-  const wallMs = Date.now() - t0;
-  if (!res.ok) {
-    console.log(`  FAILED: ${res.error}`);
-    return;
-  }
-  const avg = mib(res.bytes) / (res.elapsedMs / 1000);
-  console.log(
-    `  OK ${(mib(res.bytes)).toFixed(0)} MiB / ${(res.elapsedMs / 1000).toFixed(1)}s` +
-      ` | avg ${avg.toFixed(1)} MiB/s | peak ${res.peakMiBs.toFixed(1)} MiB/s | wall ${(wallMs / 1000).toFixed(1)}s`,
-  );
-}
-
-const [cmd, ...args] = process.argv.slice(2);
-const run = {
-  status: () => cmdStatus(args[0]),
-  delete: () => cmdDelete(args[0], args[1]),
-  dir: () => cmdDir(args[0], args[1], args[2], args[3]),
-  file: () => cmdFile(args[0], args[1], args[2]),
-};
-if (!run[cmd]) {
-  console.error("usage: status|delete|dir|file (see header)");
-  process.exit(2);
-}
-run[cmd]().catch((e) => {
-  console.error(e);
-  process.exit(1);
-});
@@ -1,6 +1,6 @@
-// Shared profile definitions for the FTX2 sweep.
+// Shared profile definitions for the upload sweep.
 //
-// Kept in one file so gen-fixtures and run-ftx2-sweep stay in lockstep.
+// Kept in one file so gen-fixtures and run-sweep stay in lockstep.
 // Add a profile by appending to PROFILES; give it a unique `name` and at most
 // one tag in the opt-in tag set below. `bytesTotal` is derived (not declared)
 // so sizes stay correct if the raw numbers change.
@@ -33,25 +33,25 @@ export const PROFILES = [
    name: 'small-file',
    kind: 'file',
    size: 1 * MIB,
-    note: 'small single-shard direct-mode',
+    note: 'small file',
  },
  {
    name: 'medium-file',
    kind: 'file',
    size: 32 * MIB,
-    note: 'exactly one shard at current shard size',
+    note: 'medium file',
  },
  {
    name: 'large-file',
    kind: 'file',
    size: 128 * MIB,
-    note: 'previous single-file baseline; 4 shards; persistent-fd win lives here',
+    note: 'previous single-file baseline; persistent-fd win lives here',
  },
  {
    name: 'huge-file',
    kind: 'file',
    size: 1 * GIB,
-    note: 'deep persistent-writer test, 32 shards',
+    note: 'deep persistent-writer test',
  },

  // ── Directory workloads ───────────────────────────────────────────────────
@@ -4,8 +4,8 @@
 *
 * 1. Start a 1 GiB single-file upload with a fixed tx_id.
 * 2. Kill the engine mid-transfer (simulates a crash / hard network drop).
- * 3. Restart the engine, re-issue the SAME tx_id → payload resumes from its
- *    journaled last_acked_shard (BeginTxAck), engine sends only the remainder.
+ * 3. Restart the engine, re-issue the SAME tx_id → the payload resumes from the
+ *    progress it journaled (AVA1 job journal), and the engine sends only the remainder.
 * 4. Verify: run-2 sent < full size (proves resume, not re-send) AND the
 *    final file on the PS5 byte-matches the source (download-back sha256).
 *
@@ -23,7 +23,7 @@ const ENGINE_BIN = path.join(repoRoot, "engine", "target", "release", "ps5upload
 const ENGINE = "http://127.0.0.1:19113";
 const HOST = process.argv[2];
 if (!HOST) { console.error("usage: resume-test.mjs <ps5-ip>"); process.exit(2); }
-const ADDR = `${HOST}:9113`;
+const ADDR = HOST;
 const SRC = path.join(repoRoot, "bench", "fixtures", "huge-file", "huge-file.bin");
 const TXID = "aabbccddeeff00112233445566778899";
 const DEST = "/data/ps5upload/tests/resume/huge.bin";
@@ -98,11 +98,12 @@ async function main() {
  console.log("  run-2: re-issuing SAME tx_id (resume)...");
  const r2 = await jpost("/api/transfer/file", { src: SRC, dest: DEST, addr: ADDR, tx_id: TXID });
  if (!r2.job_id) { console.log("  ✗ run-2 start failed", JSON.stringify(r2)); process.exit(1); }
-  // Diagnostic: log run-2 progress + payload active-tx every 5s so a stall is visible.
+  // Diagnostic: log run-2 progress + the payload's command count every 5s so a stall is visible
+  // (AVA1's node.status has no transaction fields).
  const diag = setInterval(async () => {
    const j = await jget(`/api/jobs/${r2.job_id}`).catch(() => ({}));
    const st = await jget(`/api/ps5/status?addr=${encodeURIComponent(ADDR)}`).catch(() => ({}));
-    console.log(`    [diag] job=${j.status} sent=${((j.bytes_sent||0)/1048576).toFixed(0)}MiB | payload active_tx=${st.active_transactions} last_seq=${st.last_tx_seq}`);
+    console.log(`    [diag] job=${j.status} sent=${((j.bytes_sent||0)/1048576).toFixed(0)}MiB | payload commands=${st.command_count}`);
  }, 5000);
  const res2 = await pollJob(r2.job_id, 150000);
  clearInterval(diag);
@@ -126,7 +127,7 @@ async function main() {
  if (back.length !== fullSize) { console.log(`  ✗ size mismatch: ${back.length} vs ${fullSize}`); okAll = false; }
  if (backSha !== srcSha) { console.log(`  ✗ SHA MISMATCH — resumed file is corrupt`); okAll = false; }
  else console.log(`  ✓ final file byte-identical to source (sha match)`);
-  if (partialSeen && sent2 >= fullSize) console.log(`  ⚠ run-2 re-sent the whole file (${(sent2/1048576).toFixed(0)} MiB) — resume did not skip acked shards`);
+  if (partialSeen && sent2 >= fullSize) console.log(`  ⚠ run-2 re-sent the whole file (${(sent2/1048576).toFixed(0)} MiB) — resume did not skip the data the console already had`);
  else if (partialSeen) console.log(`  ✓ resume skipped already-acked data (run-2 sent only ${(sent2 / 1048576).toFixed(0)}/${(fullSize/1048576).toFixed(0)} MiB)`);

  await jpost("/api/ps5/fs/delete", { path: DESTDIR, addr: ADDR });
@@ -1,318 +0,0 @@
-#!/usr/bin/env node
-
-import fs from 'node:fs/promises';
-import { existsSync } from 'node:fs';
-import path from 'node:path';
-import { spawn } from 'node:child_process';
-import { fileURLToPath } from 'node:url';
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = path.dirname(__filename);
-const repoRoot = path.resolve(__dirname, '..');
-
-const DEFAULT_ENGINE_URL = 'http://127.0.0.1:19113';
-const DEFAULT_PS5_ADDR = '192.168.137.2:9113';
-// Unified test sandbox — matches smoke/sweep. Wipe with a single CLEANUP:
-// POST /api/ps5/cleanup {"path":"/data/ps5upload/tests"}
-const DEFAULT_DEST_ROOT = '/data/ps5upload/tests/bench';
-const DEFAULT_RESULTS_DIR = path.join(repoRoot, 'bench', 'results');
-const DEFAULT_TIMEOUT_MS = 30 * 60 * 1000;
-
-function log(message) {
-  process.stdout.write(`[bench-ftx2-upload] ${message}\n`);
-}
-
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
-function formatBytes(bytes) {
-  const value = Number(bytes || 0);
-  if (!Number.isFinite(value) || value <= 0) return '0 B';
-  const units = ['B', 'KiB', 'MiB', 'GiB', 'TiB'];
-  let scaled = value;
-  let index = 0;
-  while (scaled >= 1024 && index < units.length - 1) {
-    scaled /= 1024;
-    index += 1;
-  }
-  return `${scaled.toFixed(index === 0 ? 0 : 2)} ${units[index]}`;
-}
-
-async function sourceStats(sourcePath, stat) {
-  if (stat.isFile()) {
-    return { bytes: stat.size, fileCount: 1 };
-  }
-  if (!stat.isDirectory()) {
-    return { bytes: null, fileCount: 0 };
-  }
-
-  let bytes = 0;
-  let fileCount = 0;
-  const stack = [sourcePath];
-  while (stack.length > 0) {
-    const dir = stack.pop();
-    let entries;
-    try {
-      entries = await fs.readdir(dir, { withFileTypes: true });
-    } catch {
-      continue;
-    }
-    for (const entry of entries) {
-      const p = path.join(dir, entry.name);
-      if (entry.isDirectory()) {
-        stack.push(p);
-      } else if (entry.isFile()) {
-        try {
-          const s = await fs.stat(p);
-          bytes += s.size;
-          fileCount += 1;
-        } catch {}
-      }
-    }
-  }
-  return { bytes, fileCount };
-}
-
-function parseArgs(argv) {
-  const out = {
-    engineUrl: DEFAULT_ENGINE_URL,
-    ps5Addr: process.env.PS5_ADDR || DEFAULT_PS5_ADDR,
-    source: '',
-    destRoot: DEFAULT_DEST_ROOT,
-    timeoutMs: DEFAULT_TIMEOUT_MS,
-    spawnEngine: false,
-    resultsDir: DEFAULT_RESULTS_DIR,
-    writeResult: true,
-  };
-
-  for (const arg of argv) {
-    if (arg.startsWith('--engine-url=')) out.engineUrl = arg.slice('--engine-url='.length);
-    else if (arg.startsWith('--ps5-addr=')) out.ps5Addr = arg.slice('--ps5-addr='.length);
-    else if (arg.startsWith('--source=')) out.source = arg.slice('--source='.length);
-    else if (arg.startsWith('--dest-root=')) out.destRoot = arg.slice('--dest-root='.length);
-    else if (arg.startsWith('--timeout-ms=')) out.timeoutMs = Number(arg.slice('--timeout-ms='.length)) || out.timeoutMs;
-    else if (arg.startsWith('--results-dir=')) out.resultsDir = path.resolve(repoRoot, arg.slice('--results-dir='.length));
-    else if (arg === '--spawn-engine') out.spawnEngine = true;
-    else if (arg === '--no-write-result') out.writeResult = false;
-  }
-
-  if (!out.source) {
-    throw new Error('missing required --source=/path/to/file-or-dir');
-  }
-
-  return out;
-}
-
-async function waitForHttpOk(url, timeoutMs) {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    try {
-      const response = await fetch(url);
-      if (response.ok) return;
-    } catch {}
-    await sleep(250);
-  }
-  throw new Error(`timed out waiting for ${url}`);
-}
-
-function spawnEngine(ps5Addr) {
-  // Prefer the pre-built release binary — `cargo run` defaults to debug which
-  // is dramatically slower for high-throughput transfers (the engine allocates
-  // per-shard in the hot path). Fall back to release cargo build if the
-  // binary isn't present.
-  const releaseBin = path.join(repoRoot, 'engine', 'target', 'release', 'ps5upload-engine');
-  let cmd, args;
-  if (existsSync(releaseBin)) {
-    cmd = releaseBin;
-    args = [];
-  } else {
-    cmd = 'cargo';
-    args = ['run', '--release', '-p', 'ps5upload-engine'];
-  }
-  const child = spawn(cmd, args, {
-    cwd: path.join(repoRoot, 'engine'),
-    env: {
-      ...process.env,
-      PS5_ADDR: ps5Addr,
-    },
-    stdio: ['ignore', 'pipe', 'pipe'],
-  });
-  child.stdout?.on('data', (chunk) => process.stdout.write(String(chunk)));
-  child.stderr?.on('data', (chunk) => process.stderr.write(String(chunk)));
-  return child;
-}
-
-async function stopChild(child, name) {
-  if (!child || child.exitCode != null || child.killed) return;
-  child.kill('SIGTERM');
-  await new Promise((resolve) => {
-    const timer = setTimeout(() => {
-      try {
-        child.kill('SIGKILL');
-      } catch {}
-      resolve();
-    }, 5000);
-    child.once('exit', () => {
-      clearTimeout(timer);
-      resolve();
-    });
-  });
-  log(`${name} stopped`);
-}
-
-async function postJson(url, body) {
-  const response = await fetch(url, {
-    method: 'POST',
-    headers: { 'content-type': 'application/json' },
-    body: JSON.stringify(body),
-  });
-  const text = await response.text();
-  let parsed = null;
-  try {
-    parsed = text ? JSON.parse(text) : null;
-  } catch {
-    parsed = text;
-  }
-  if (!response.ok) {
-    throw new Error(`POST ${url} failed (${response.status}): ${typeof parsed === 'string' ? parsed : JSON.stringify(parsed)}`);
-  }
-  return parsed;
-}
-
-async function getJson(url) {
-  const response = await fetch(url);
-  const text = await response.text();
-  let parsed = null;
-  try {
-    parsed = text ? JSON.parse(text) : null;
-  } catch {
-    parsed = text;
-  }
-  if (!response.ok) {
-    throw new Error(`GET ${url} failed (${response.status}): ${typeof parsed === 'string' ? parsed : JSON.stringify(parsed)}`);
-  }
-  return parsed;
-}
-
-function nowIsoCompact() {
-  return new Date().toISOString().replaceAll(':', '').replace(/\.\d{3}Z$/, 'Z');
-}
-
-async function main() {
-  const options = parseArgs(process.argv.slice(2));
-  const sourcePath = path.resolve(options.source);
-  const stat = await fs.stat(sourcePath);
-  const sourceKind = stat.isDirectory() ? 'dir' : stat.isFile() ? 'file' : 'other';
-  if (sourceKind === 'other') {
-    throw new Error(`source must be a regular file or directory: ${sourcePath}`);
-  }
-  const sourceSummary = await sourceStats(sourcePath, stat);
-
-  let engineChild = null;
-  try {
-    if (options.spawnEngine) {
-      log(`spawning engine with PS5_ADDR=${options.ps5Addr}`);
-      engineChild = spawnEngine(options.ps5Addr);
-    }
-
-    await waitForHttpOk(`${options.engineUrl}/api/jobs`, 30_000);
-    log(`engine ready at ${options.engineUrl}`);
-
-    const destName = path.basename(sourcePath);
-    const reqBody = sourceKind === 'dir'
-      ? {
-          addr: options.ps5Addr,
-          dest_root: options.destRoot,
-          src_dir: sourcePath,
-        }
-      : {
-          addr: options.ps5Addr,
-          dest: `${options.destRoot}/${destName}`,
-          src: sourcePath,
-        };
-    const route = sourceKind === 'dir' ? '/api/transfer/dir' : '/api/transfer/file';
-
-    log(`starting ${sourceKind} benchmark from ${sourcePath} to ${options.destRoot}`);
-    const startedAt = Date.now();
-    const created = await postJson(`${options.engineUrl}${route}`, reqBody);
-    const jobId = created?.job_id;
-    if (!jobId) {
-      throw new Error(`engine did not return job_id: ${JSON.stringify(created)}`);
-    }
-
-    let job = null;
-    const deadline = Date.now() + options.timeoutMs;
-    while (Date.now() < deadline) {
-      job = await getJson(`${options.engineUrl}/api/jobs/${jobId}`);
-      if (job?.status === 'done' || job?.status === 'failed') break;
-      await sleep(1000);
-    }
-    if (!job || (job.status !== 'done' && job.status !== 'failed')) {
-      throw new Error(`job ${jobId} did not complete within ${options.timeoutMs} ms`);
-    }
-    if (job.status !== 'done') {
-      throw new Error(`job ${jobId} failed: ${job.error || JSON.stringify(job)}`);
-    }
-
-    const finishedAt = Date.now();
-    const elapsedMs = Number(job.elapsed_ms || (finishedAt - startedAt));
-    const bytesSent = Number(job.bytes_sent || 0);
-    const shardsSent = Number(job.shards_sent || 0);
-    const bytesPerSec = elapsedMs > 0 ? (bytesSent * 1000) / elapsedMs : 0;
-    const mibPerSec = bytesPerSec / (1024 * 1024);
-    const result = {
-      schema_version: 1,
-      benchmark: 'ftx2_upload',
-      created_at: new Date().toISOString(),
-      engine_url: options.engineUrl,
-      ps5_addr: options.ps5Addr,
-      source: {
-        path: sourcePath,
-        kind: sourceKind,
-        bytes: sourceSummary.bytes,
-        file_count: sourceSummary.fileCount,
-      },
-      destination: {
-        root: options.destRoot,
-        final_path: job.dest,
-      },
-      job: {
-        job_id: jobId,
-        tx_id_hex: job.tx_id_hex,
-        shards_sent: shardsSent,
-        bytes_sent: bytesSent,
-        started_at_ms: Number(job.started_at_ms || 0),
-        completed_at_ms: Number(job.completed_at_ms || 0),
-        elapsed_ms: elapsedMs,
-      },
-      metrics: {
-        bytes_per_sec: bytesPerSec,
-        mib_per_sec: mibPerSec,
-      },
-    };
-
-    log(`job ${jobId} complete`);
-    log(`bytes sent: ${formatBytes(bytesSent)} in ${(elapsedMs / 1000).toFixed(2)} s`);
-    log(`throughput: ${mibPerSec.toFixed(2)} MiB/s`);
-
-    if (options.writeResult) {
-      await fs.mkdir(options.resultsDir, { recursive: true });
-      const outputPath = path.join(
-        options.resultsDir,
-        `${nowIsoCompact()}-${sourceKind}-${path.basename(sourcePath)}.json`,
-      );
-      await fs.writeFile(outputPath, `${JSON.stringify(result, null, 2)}\n`, 'utf8');
-      log(`wrote result ${outputPath}`);
-    } else {
-      process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
-    }
-  } finally {
-    await stopChild(engineChild, 'engine');
-  }
-}
-
-main().catch((error) => {
-  process.stderr.write(`[bench-ftx2-upload] error: ${error.message}\n`);
-  process.exitCode = 1;
-});
@@ -1,23 +1,23 @@
 #!/usr/bin/env node
 /**
- * bench/run-ftx2-sweep.mjs
+ * bench/run-sweep.mjs
 *
- * Runs the FTX2 upload benchmark across every profile in bench/profiles.mjs,
+ * Runs the upload benchmark across every profile in bench/profiles.mjs,
 * with PS5-side cleanup before each profile and after the whole run. Writes
 * one timestamped JSON + one Markdown report under bench/reports/, and prints
 * a summary table to stdout.
 *
 * Prerequisites:
- *   - PS5 payload loaded and listening at PS5_ADDR (default 192.168.137.2:9113).
+ *   - PS5 payload loaded and listening at PS5_ADDR (default 192.168.137.2).
 *   - Fixture trees present under bench/fixtures/ (run scripts/gen-fixtures.mjs
 *     first, or pass --gen-fixtures).
 *   - Either engine already running, or pass --spawn-engine to launch it.
 *
 * Usage:
- *   node bench/run-ftx2-sweep.mjs --spawn-engine
- *   node bench/run-ftx2-sweep.mjs --xl --spawn-engine
- *   node bench/run-ftx2-sweep.mjs --only=large-file,medium-dir --spawn-engine
- *   node bench/run-ftx2-sweep.mjs --no-cleanup   # for debugging: leave PS5 state
+ *   node bench/run-sweep.mjs --spawn-engine
+ *   node bench/run-sweep.mjs --xl --spawn-engine
+ *   node bench/run-sweep.mjs --only=large-file,medium-dir --spawn-engine
+ *   node bench/run-sweep.mjs --no-cleanup   # for debugging: leave PS5 state
 */

 import fs from 'node:fs/promises';
@@ -34,7 +34,7 @@ const __dirname = path.dirname(__filename);
 const repoRoot = path.resolve(__dirname, '..');

 const DEFAULT_ENGINE_URL = 'http://127.0.0.1:19113';
-const DEFAULT_PS5_ADDR = '192.168.137.2:9113';
+const DEFAULT_PS5_ADDR = '192.168.137.2';
 // Unified test sandbox — see tests/smoke-hardware.mjs for the shape.
 // All sweep dest_root entries land under this root so `rm -rf
 // /data/ps5upload/tests` wipes every test artifact in one shot.
@@ -102,11 +102,11 @@ function parseArgs(argv) {
 }

 function printHelp() {
-  process.stdout.write(`ftx2 sweep — run every bench profile against a live PS5
+  process.stdout.write(`sweep — run every bench profile against a live PS5

 Options:
  --engine-url=URL       engine HTTP base URL  (default: http://127.0.0.1:19113)
-  --ps5-addr=HOST:PORT   PS5 FTX2 address      (default: 192.168.137.2:9113)
+  --ps5-addr=HOST        PS5 address (a :port suffix is ignored) (default: 192.168.137.2)
  --dest-root=PATH       dest root on PS5      (default: /data/ps5upload-sweep)
  --fixtures-dir=PATH    fixture source root   (default: bench/fixtures)
  --reports-dir=PATH     where to write report (default: bench/reports)
@@ -143,10 +143,6 @@ async function postJson(url, body) {

 function tryParse(t) { try { return JSON.parse(t); } catch { return t; } }

-function mgmtAddrFor(transferAddr) {
-  const i = transferAddr.lastIndexOf(':');
-  return i < 0 ? `${transferAddr}:9114` : `${transferAddr.slice(0, i)}:9114`;
-}

 async function waitForHttpOk(url, timeoutMs) {
  const deadline = Date.now() + timeoutMs;
@@ -267,7 +263,7 @@ async function runProfile(opts, profile) {
  }

  const bytesSent = Number(job.bytes_sent || 0);
-  const shardsSent = Number(job.shards_sent || 0);
+  const filesSent = Number(job.files_sent || 0);
  const elapsedMs = Number(job.elapsed_ms || wallMs);
  const mibPerSec = elapsedMs > 0 ? (bytesSent * 1000) / elapsedMs / (1024 * 1024) : 0;

@@ -278,7 +274,7 @@ async function runProfile(opts, profile) {
    file_count: profileFileCount(profile),
    bytes_total: profileBytesTotal(profile),
    bytes_sent: bytesSent,
-    shards_sent: shardsSent,
+    files_sent: filesSent,
    job_id: jobId,
    tx_id_hex: job.tx_id_hex,
    elapsed_ms: elapsedMs,
@@ -346,7 +342,7 @@ function renderMarkdown(report, previous) {
    for (const r of previous.results) if (r.status === 'ok') prevByName.set(r.profile, r);
  }
  const lines = [];
-  lines.push(`# FTX2 sweep report`);
+  lines.push(`# Upload sweep report`);
  lines.push('');
  lines.push(`- **Timestamp**: ${report.created_at}`);
  lines.push(`- **PS5 address**: ${report.ps5_addr}`);
@@ -354,14 +350,14 @@ function renderMarkdown(report, previous) {
  lines.push(`- **Host**: ${report.host.platform}/${report.host.arch} (node ${report.host.node})`);
  if (previous?.created_at) lines.push(`- **Previous report**: ${previous.created_at}`);
  lines.push('');
-  lines.push('| Profile | Kind | Files | Bytes | Time | Shards | Throughput | Δ vs prev |');
+  lines.push('| Profile | Kind | Files | Bytes | Time | Files sent | Throughput | Δ vs prev |');
  lines.push('| --- | --- | ---: | ---: | ---: | ---: | ---: | --- |');
  for (const r of report.results) {
    if (r.status === 'ok') {
      const prev = prevByName.get(r.profile);
      const delta = prev ? fmtDelta(r.mib_per_sec, prev.mib_per_sec) : '';
      lines.push(
-        `| \`${r.profile}\` | ${r.kind} | ${r.file_count} | ${formatBytes(r.bytes_total)} | ${(r.elapsed_ms / 1000).toFixed(2)}s | ${r.shards_sent} | **${r.mib_per_sec.toFixed(2)} MiB/s** |${delta} |`
+        `| \`${r.profile}\` | ${r.kind} | ${r.file_count} | ${formatBytes(r.bytes_total)} | ${(r.elapsed_ms / 1000).toFixed(2)}s | ${r.files_sent} | **${r.mib_per_sec.toFixed(2)} MiB/s** |${delta} |`
      );
    } else {
      lines.push(`| \`${r.profile}\` | — | — | — | — | — | **${r.status.toUpperCase()}** | ${r.error ?? ''} |`);
@@ -419,7 +415,7 @@ async function main() {

  log(`engine:    ${opts.engineUrl}`);
  log(`ps5:       ${opts.ps5Addr}`);
-  opts.ps5MgmtAddr = mgmtAddrFor(opts.ps5Addr);
+  opts.ps5MgmtAddr = opts.ps5Addr;
  log(`ps5 fs:    ${opts.ps5MgmtAddr}`);
  log(`dest root: ${opts.destRoot}`);
  log(`profiles:  ${selected.map((p) => p.name).join(', ')}`);
@@ -462,7 +458,7 @@ async function main() {
      const r = await runProfile(opts, profile);
      results.push(r);
      if (r.status === 'ok') {
-        log(`  ${profile.name}: ${formatBytes(r.bytes_sent)} in ${(r.elapsed_ms / 1000).toFixed(2)}s = ${r.mib_per_sec.toFixed(2)} MiB/s (${r.shards_sent} shards)`);
+        log(`  ${profile.name}: ${formatBytes(r.bytes_sent)} in ${(r.elapsed_ms / 1000).toFixed(2)}s = ${r.mib_per_sec.toFixed(2)} MiB/s (${r.files_sent} files)`);
      } else {
        logErr(`  ${profile.name}: ${r.status.toUpperCase()} — ${r.error ?? ''}`);
      }
@@ -0,0 +1,115 @@
+import { expect, test } from "@playwright/test";
+
+// The desktop app's Capture button (status bar, bottom right) saves screenshots for bug reports.
+// The Bug report page says where that button is, lists every capture to pick from, and a capture
+// taken while a report is being written is added to it.
+
+const PNG =
+  "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==";
+const shot = (n: number) => ({
+  name: `screenshot-2026100${n}-120000-000.png`,
+  path: `/shots/screenshot-2026100${n}-120000-000.png`,
+  bytes: 70,
+  data_url: `data:image/png;base64,${PNG}`,
+});
+
+test("captures are listed to pick from, and a new capture joins the report", async ({ page }) => {
+  await page.addInitScript(
+    ([a, b, saved]) => {
+      const w = window as unknown as Record<string, unknown>;
+      let id = 0;
+      const list = [a, b];
+      w.__TAURI_INTERNALS__ = {
+        invoke: async (cmd: string) => {
+          if (cmd === "screenshot_list") return list;
+          if (cmd === "screenshot_save") {
+            list.unshift(saved);
+            return saved;
+          }
+          return null;
+        },
+        transformCallback: () => ++id,
+        unregisterCallback: () => {},
+        convertFileSrc: (p: string) => p,
+        metadata: { currentWindow: { label: "main" }, currentWebview: { windowLabel: "main", label: "main" } },
+        plugins: {},
+      };
+      w.__TAURI_EVENT_PLUGIN_INTERNALS__ = { unregisterListener: () => {} };
+    },
+    [shot(1), shot(2), shot(3)],
+  );
+  await page.route(
+    (u) => u.pathname.startsWith("/api/"),
+    (route) => route.fulfill({ status: 200, contentType: "application/json", body: "{}" }),
+  );
+
+  await page.goto("/bug-report", { waitUntil: "domcontentloaded" });
+  const main = page.getByRole("main");
+  await expect(main.getByTestId("br-capture-hint")).toContainText("bottom right", { timeout: 30_000 });
+
+  // The include toggles (each capture also has a Preview button).
+  const captures = main.getByTestId("br-captures").locator("button[aria-pressed]");
+  await expect(captures).toHaveCount(2);
+  await expect(captures.first()).toHaveAttribute("aria-pressed", "false");
+  await captures.first().click();
+  await expect(captures.first()).toHaveAttribute("aria-pressed", "true");
+
+  await page.getByRole("button", { name: "Capture", exact: true }).click();
+  await expect(captures).toHaveCount(3);
+  await expect(main.getByRole("button", { name: "screenshot-20261003-120000-000.png", exact: true })).toHaveAttribute("aria-pressed", "true");
+});
+
+test("captures open large, page with the arrow keys, and delete from this computer", async ({ page }) => {
+  await page.addInitScript(
+    ([a, b, c]) => {
+      const w = window as unknown as Record<string, unknown>;
+      let id = 0;
+      let list = [a, b, c];
+      w.__TAURI_INTERNALS__ = {
+        invoke: async (cmd: string, args: { names?: string[] }) => {
+          if (cmd === "screenshot_list") return list;
+          if (cmd === "screenshot_delete") {
+            const names = args?.names ?? [];
+            list = list.filter((s) => !names.includes(s.name));
+            return names;
+          }
+          return null;
+        },
+        transformCallback: () => ++id,
+        unregisterCallback: () => {},
+        convertFileSrc: (p: string) => p,
+        metadata: { currentWindow: { label: "main" }, currentWebview: { windowLabel: "main", label: "main" } },
+        plugins: {},
+      };
+      w.__TAURI_EVENT_PLUGIN_INTERNALS__ = { unregisterListener: () => {} };
+    },
+    [shot(3), shot(2), shot(1)],
+  );
+  await page.route(
+    (u) => u.pathname.startsWith("/api/"),
+    (route) => route.fulfill({ status: 200, contentType: "application/json", body: "{}" }),
+  );
+
+  await page.goto("/bug-report", { waitUntil: "domcontentloaded" });
+  const main = page.getByRole("main");
+  await expect(main.getByTestId("br-captures").locator("button[aria-pressed]")).toHaveCount(3, {
+    timeout: 30_000,
+  });
+
+  // The status bar opens the viewer on the newest capture.
+  await page.getByRole("button", { name: "View captures" }).first().click();
+  const viewer = page.getByRole("dialog");
+  await expect(viewer).toContainText("1 of 3");
+  await page.keyboard.press("ArrowRight");
+  await expect(viewer).toContainText("2 of 3");
+  await page.keyboard.press("ArrowLeft");
+  await page.keyboard.press("ArrowLeft");
+  await expect(viewer).toContainText("3 of 3");
+
+  // Delete asks first, then the capture is gone from the viewer and the Bug report.
+  await viewer.getByRole("button", { name: "Delete", exact: true }).click();
+  await page.getByRole("alertdialog").getByRole("button", { name: "Delete", exact: true }).click();
+  await expect(viewer).toContainText("2 of 2");
+  await page.keyboard.press("Escape");
+  await expect(main.getByTestId("br-captures").locator("button[aria-pressed]")).toHaveCount(2);
+});
@@ -0,0 +1,90 @@
+import { expect, test, type Route } from "@playwright/test";
+
+// The bug report page end to end in the web UI: describe it, pick how far back, create the report
+// (everything recorded in that window, redacted, with MISSING.txt), then Post to GitHub / Discord.
+
+const HOST = "192.168.86.100";
+
+test("one page builds a redacted report of the whole time frame and pre-fills GitHub", async ({ page }) => {
+  await page.addInitScript((host) => {
+    window.localStorage.setItem("ps5upload.host", host);
+    // Record what the page asks the browser to open instead of opening it.
+    (window as unknown as { __opened: string[] }).__opened = [];
+    window.open = ((url: string) => {
+      (window as unknown as { __opened: string[] }).__opened.push(url);
+      return null;
+    }) as typeof window.open;
+  }, HOST);
+
+  const now = Date.now();
+  let bundle: { filename: string; entries: { path: string; text?: string }[] } | null = null;
+  const json = (route: Route, body: unknown, status = 200) =>
+    route.fulfill({ status, contentType: "application/json", body: JSON.stringify(body) });
+  await page.route(
+    (u) => u.pathname.startsWith("/api/"),
+    async (route) => {
+      const req = route.request();
+      const p = new URL(req.url()).pathname;
+      if (p === "/api/version") return json(route, { caps: {}, version: "6.5.2" });
+      if (p === "/api/event-journal")
+        return json(route, {
+          dropped: 0,
+          events: [
+            { ts: now - 60_000, src: "helper", cat: "helper", level: "error", code: "helper_fatal", console: HOST, msg: "[fatal] signal 11 while serving frame 88" },
+            { ts: now - 50_000, src: "engine", cat: "connection", level: "warn", code: "reconnecting", console: HOST, msg: `reconnecting to ${HOST}`, count: 3, last_ts: now - 40_000 },
+          ],
+        });
+      if (p === "/api/ps5/helper-log-ftp") return json(route, { error: "connect: refused" }, 502);
+      if (p === "/api/bug-report/bundle" && req.method() === "POST") {
+        bundle = req.postDataJSON();
+        return route.fulfill({ status: 200, contentType: "application/zip", body: "PK\u0005\u0006" + "\0".repeat(18) });
+      }
+      if (p === "/api/jobs") return json(route, []);
+      return json(route, {});
+    },
+  );
+
+  await page.goto("/bug-report", { waitUntil: "domcontentloaded" });
+  const main = page.getByRole("main");
+
+  // Nothing to build until there's a description; the bar says why.
+  const create = main.getByRole("button", { name: "Create report" });
+  await expect(create).toBeVisible({ timeout: 30_000 });
+  await expect(create).toBeDisabled();
+  await expect(main.getByTestId("br-blocked")).toContainText("Describe what went wrong");
+  await main.getByLabel("What went wrong?").fill("The helper crashed while I had the Hardware screen open.");
+  // No log checkboxes: only how far back.
+  await expect(main.getByRole("checkbox")).toHaveCount(0);
+  await main.getByRole("radio", { name: "Last 6 hours" }).click();
+  await expect(main.getByTestId("br-blocked")).toHaveCount(0);
+  await create.click();
+  await expect(main.getByTestId("br-saved")).toBeVisible({ timeout: 30_000 });
+  expect(bundle).not.toBeNull();
+  const b = bundle as unknown as { filename: string; entries: { path: string; text?: string }[] };
+  const paths = b.entries.map((e) => e.path);
+  expect(paths).toEqual(expect.arrayContaining(["README.txt", "report.md", "report.json", "timeline.txt", "timeline.jsonl", "MISSING.txt"]));
+  const timeline = b.entries.find((e) => e.path === "timeline.txt")?.text ?? "";
+  expect(timeline).toContain("signal 11");
+  expect(timeline).toContain("<ip-1>");
+  expect(JSON.stringify(b.entries)).not.toContain(HOST);
+  expect(b.entries.find((e) => e.path === "MISSING.txt")?.text).toContain("helper_ftp: connect: refused");
+  expect(b.entries.find((e) => e.path === "report.md")?.text).toContain("signal 11");
+
+  // GitHub, then Discord
+  await main.getByRole("button", { name: "Post to GitHub" }).click();
+  await main.getByRole("button", { name: "Post to Discord" }).click();
+  // Discord copies the text first, then opens the channel (a page that lost focus cannot write the clipboard).
+  await expect
+    .poll(() => page.evaluate(() => (window as unknown as { __opened: string[] }).__opened.length))
+    .toBe(2);
+  const opened = await page.evaluate(() => (window as unknown as { __opened: string[] }).__opened);
+  const gh = new URL(opened[0]);
+  expect(gh.pathname).toBe("/phantomptr/ps5upload/issues/new");
+  expect(gh.searchParams.get("template")).toBe("bug_report.yml");
+  expect(gh.searchParams.get("title")).toContain("The helper crashed");
+  expect(gh.searchParams.get("what-happened")).toContain("The helper crashed");
+  // Everything recorded in the window, no picking: the crash reaches the issue's logs field.
+  expect(gh.searchParams.get("logs")).toContain("signal 11");
+  expect(gh.searchParams.get("platform")).toBe("Browser / self-hosted web UI");
+  expect(opened[1]).toBe("https://discord.com/channels/1464735724434624524/1465533832953462794");
+});
@@ -0,0 +1,13 @@
+import { expect, test } from "@playwright/test";
+
+// The FAQ and What's New screens bundle the repo-root FAQ.md and CHANGELOG.md. On the dev server
+// those sit outside the client folder, and Vite served them as raw markdown instead of modules,
+// so both screens failed to load their document.
+test("the FAQ and What's New screens load their documents", async ({ page }) => {
+  await page.goto("/faq", { waitUntil: "domcontentloaded" });
+  await expect(page.getByRole("heading", { name: "What ps5upload does (and doesn't)" })).toBeVisible({
+    timeout: 20_000,
+  });
+  await page.goto("/whats-new", { waitUntil: "domcontentloaded" });
+  await expect(page.getByRole("heading", { name: "5.37.1" }).first()).toBeVisible({ timeout: 20_000 });
+});
@@ -0,0 +1,139 @@
+import { expect, test, type Route } from "@playwright/test";
+
+// A game kept as a folder used to offer "Copy it with Upload", which only opened the Upload
+// screen. Send to PS5 now queues the copy and starts it from the game's page (opened from the
+// Collection), and the console's row says how it is going. The engine here is a fake that
+// answers the same routes.
+
+const HOST = "192.168.0.5";
+const FOLDER = "/games/app/PPSA11386-app";
+
+test("Send to PS5 queues a game folder from the Collection and shows its progress", async ({
+  page,
+}) => {
+  await page.addInitScript((host) => {
+    window.localStorage.setItem("ps5upload.host", host);
+  }, HOST);
+  const json = (route: Route, body: unknown, status = 200) =>
+    route.fulfill({ status, contentType: "application/json", body: JSON.stringify(body) });
+
+  const started: { path?: string; dest?: string } = {};
+  const game = {
+    game_id: "PPSA11386",
+    title: "007 First Light",
+    platform: "PS5",
+    sources: ["/games"],
+    locations: [
+      {
+        root: "/games",
+        container: "app",
+        name: "PPSA11386-app",
+        type: "folder",
+        path: "app/PPSA11386-app",
+        absolute_path: FOLDER,
+        size_bytes: 80_900_000_000,
+        added_ts: 0,
+        pkg: { kind: "base", version: "1.18.0", region: "Europe", content_id: "EP3969-PPSA11386_00-007FIRSTLIGHT000" },
+      },
+    ],
+    total_size_bytes: 80_900_000_000,
+    copies: 1,
+    is_duplicate: false,
+    added_ts: 0,
+  };
+
+  await page.route(
+    (u) => u.pathname.startsWith("/api/"),
+    async (route) => {
+      const req = route.request();
+      const url = new URL(req.url());
+      const p = url.pathname;
+      if (p === "/api/version") return json(route, { caps: { rar: true }, version: "6.5.0" });
+      if (p === "/api/ps5/status")
+        return json(route, {
+          command_count: 1,
+          instance_id: 1,
+          prior_instance: "clean",
+          ps5_kernel: "r229358/releases/13.60",
+          ucred_elevated: true,
+          version: "6.5.0",
+        });
+      if (p === "/api/ps5/volumes")
+        return json(route, {
+          volumes: [
+            {
+              path: "/data",
+              fs_type: "nullfs",
+              total_bytes: 900_000_000_000,
+              free_bytes: 400_000_000_000,
+              allocatable_bytes: 398_000_000_000,
+              writable: true,
+              is_placeholder: false,
+            },
+          ],
+        });
+      if (p === "/api/collection/settings")
+        return json(route, { roots: ["/games"], refresh_secs: null, sweep_sidecars: false, trash_available: true });
+      if (p === "/api/collection/scan")
+        return json(route, { running: false, deep: false, found: 1, done: 1, started_ms: 0, finished_ms: 1, error: null, games: 1, locations: 1 });
+      if (p === "/api/collection/library")
+        return json(route, {
+          roots: ["/games"],
+          generated_at: "2026-10-08T00:00:00Z",
+          summary: { total_games: 1, total_locations: 1, total_size_bytes: game.total_size_bytes, duplicates_count: 0, reclaimable_bytes: 0 },
+          games: { [game.game_id]: game },
+        });
+      if (p === "/api/collection/console")
+        return json(route, {
+          games: [{ game_id: game.game_id, installed: false, dlc_missing: [], non_package_copy: true }],
+        });
+      if (p === `/api/games/${game.game_id}`)
+        return json(route, {
+          title_id: game.game_id,
+          title: game.title,
+          platform: "PS5",
+          cover: null,
+          copies: game.locations,
+          consoles: [{ host: HOST, read_at: Math.floor(Date.now() / 1000), installed: false, dlc_missing: [] }],
+        });
+      if (p === `/api/games/${game.game_id}/refresh`)
+        return json(route, { host: HOST, read_at: Math.floor(Date.now() / 1000), installed: false, dlc_missing: [] });
+      if (p === "/api/transfer/dir" || p === "/api/transfer/dir-reconcile") {
+        const body = req.postDataJSON() as { src_dir?: string; dest_root?: string; src?: string; dest?: string };
+        started.path = body.src_dir ?? body.src;
+        started.dest = body.dest_root ?? body.dest;
+        return json(route, { job_id: "j1" });
+      }
+      if (p === "/api/pkg/links") return json(route, []);
+      if (p.startsWith("/api/jobs"))
+        return json(route, { status: "running", bytes_sent: 20_000_000_000, total_bytes: 80_900_000_000 });
+      if (p === "/api/ps5/list-dir")
+        return json(route, {
+          path: url.searchParams.get("path") ?? "/data",
+          entries: [],
+          truncated: false,
+          total_scanned: 0,
+          returned: 0,
+        });
+      if (p === "/api/ps5/process/list") return json(route, { processes: [] });
+      if (p === "/api/engine-logs") return json(route, { lines: [] });
+      if (p === "/api/ps5/readiness") return json(route, { ready: true, detail: "" });
+      return json(route, {});
+    },
+  );
+
+  await page.goto("/collection", { waitUntil: "domcontentloaded" });
+  await page.getByTestId("collection-card").first().click();
+  await expect(page).toHaveURL(/\/games\/PPSA11386$/);
+  const row = page.getByTestId(`game-console-${HOST}`);
+  await expect(row).toContainText("Not installed", { timeout: 30_000 });
+  // The old button only navigated away; this one opens the send panel in place.
+  await row.getByRole("button", { name: "Send to PS5" }).click();
+  await expect(row.getByText(/To \/data\/homebrew\/PPSA11386-app/)).toBeVisible();
+  // Folder as is: the default for a game folder.
+  await expect(row.getByRole("radio", { name: "As the folder" })).toBeChecked();
+  await row.getByRole("button", { name: "Send", exact: true }).click();
+  // Queued and started from here; the console's row follows it.
+  await expect.poll(() => started.path, { timeout: 20_000 }).toBe(FOLDER);
+  await expect(row.getByText(/Sending|Waiting in the queue/).first()).toBeVisible({ timeout: 20_000 });
+});
@@ -0,0 +1,58 @@
+import { expect, test } from "@playwright/test";
+
+// Switching console tabs used to rebuild every screen, so anything typed or loaded for one
+// console was gone when you came back to it. Each console now keeps its own screens.
+
+const A = { id: "console-a", name: "Living room", host: "192.168.0.5" };
+const B = { id: "console-b", name: "Office", host: "192.168.0.6" };
+
+test("each console keeps its own screens across a console switch", async ({
+  page,
+}) => {
+  await page.addInitScript(
+    ([a, b]) => {
+      // Only on the first load: a reload must find what the app itself saved.
+      if (window.localStorage.getItem("ps5upload.roster.v1")) return;
+      window.localStorage.setItem("ps5upload.host", a.host);
+      window.localStorage.setItem(
+        "ps5upload.roster.v1",
+        JSON.stringify({ profiles: [a, b], active_id: a.id }),
+      );
+    },
+    [A, B],
+  );
+  // No engine here: every engine route answers with nothing.
+  await page.route(
+    (u) => u.pathname.startsWith("/api/"),
+    (route) =>
+      route.fulfill({ status: 200, contentType: "application/json", body: "{}" }),
+  );
+
+  await page.goto("/faq", { waitUntil: "domcontentloaded" });
+  // Each console's tree has its own tab strip; only the one on show is visible.
+  const tabA = page.locator(`[data-console-id="${A.id}"]:visible`);
+  const tabB = page.locator(`[data-console-id="${B.id}"]:visible`);
+  await expect(tabA).toHaveAttribute("aria-current", "page", { timeout: 30_000 });
+
+  // The screen on show, whichever console's it is.
+  const search = page
+    .locator("[data-scroll-root]:visible")
+    .getByPlaceholder("Search the FAQ…");
+  await search.fill("rest mode");
+
+  await tabB.click();
+  await expect(tabB).toHaveAttribute("aria-current", "page");
+  // B has its own screen: nothing of A's typing is in it.
+  await expect(search).toHaveValue("");
+  await search.fill("firewall");
+  // One scroll root is on show: the selected console's.
+  await expect(page.locator("[data-scroll-root]:visible")).toHaveCount(1);
+
+  await tabA.click();
+  await expect(tabA).toHaveAttribute("aria-current", "page");
+  await expect(search).toHaveValue("rest mode");
+
+  await tabB.click();
+  await expect(tabB).toHaveAttribute("aria-current", "page");
+  await expect(search).toHaveValue("firewall");
+});
@@ -8,15 +8,12 @@ test("guides a disconnected user through primary navigation and recovery", async
  // serves any same-origin /api probe as inert app HTML in this test setup.
  await page.goto("/home", { waitUntil: "domcontentloaded" });

-  // The sidebar pins Home and nothing else until the user stars screens in
-  // More, so a fresh profile sees exactly one favourite plus the More
-  // escape hatch. (The nav landmark keeps its "Primary" name deliberately —
-  // "Favorites" is the visible heading, not the landmark's accessible name.)
+  // A fresh profile's sidebar lists every screen: nothing is hidden behind More
+  // until the user hides it.
  const primary = page.getByRole("navigation", { name: "Primary" });
  await expect(primary.getByRole("link", { name: "Home" })).toBeVisible();
-  await expect(primary.getByText("Star screens in More")).toBeVisible();
-  for (const notPinned of ["Games", "Files", "Console", "Tasks"]) {
-    await expect(primary.getByRole("link", { name: notPinned })).toHaveCount(0);
+  for (const shown of ["Games", "Files", "Console", "Tasks", "Convert Games"]) {
+    await expect(primary.getByRole("link", { name: shown, exact: true })).toBeVisible();
  }

  await expect(
@@ -33,18 +30,23 @@ test("guides a disconnected user through primary navigation and recovery", async
    page.locator('[aria-disabled="true"]').filter({ hasText: /^Upload/ }),
  ).toBeVisible();

-  // Everything unpinned stays one click away through More.
+  // More lists every screen too (and is where hidden ones come back). Scoped to the
+  // page body: the sidebar carries the same links.
+  const body = page.getByRole("main");
  await page.getByRole("link", { name: "More" }).click();
-  await page.getByRole("link", { name: "Tasks" }).click();
+  // Wait for More itself: Home also has a "Tasks" link, and Home stays in the page (hidden)
+  // after the switch, so a click aimed at it would wait on a link that never shows again.
+  await expect(page.getByRole("heading", { name: "More" })).toBeVisible();
+  await body.getByRole("link", { name: "Tasks", exact: true }).click();
  await expect(page.getByRole("heading", { name: "Tasks" })).toBeVisible();
-  await expect(page.getByRole("button", { name: "Tasks", pressed: true })).toBeVisible();
-  await expect(page.getByRole("button", { name: /history/i })).toBeVisible();
+  await expect(page.getByRole("tab", { name: "Tasks", selected: true })).toBeVisible();
+  await expect(page.getByRole("tab", { name: /history/i })).toBeVisible();
  await expect(page.getByText("No activity yet")).toBeVisible();

  await page.getByRole("link", { name: "More" }).click();
  await expect(page.getByRole("heading", { name: "More" })).toBeVisible();
-  await expect(page.getByRole("link", { name: "Install Package" })).toBeVisible();
-  await expect(page.getByRole("link", { name: "Settings" })).toBeVisible();
+  await expect(body.getByRole("link", { name: "Install Package" })).toBeVisible();
+  await expect(body.getByRole("link", { name: "Settings" })).toBeVisible();

  // Regression: this screen used to draw its entire staging UI with no console
  // connected — a small "No PS5 host set" warning, and then the full body
@@ -0,0 +1,104 @@
+import { expect, test, type Route } from "@playwright/test";
+
+// The Files right-click menu offers New folder: on a row (with the row's own actions) and on
+// the list's empty space (a folder menu: New folder, Refresh). The engine here is a fake.
+
+const HOST = "192.168.0.5";
+
+test("right-click offers New folder on a row and on empty space", async ({
+  page,
+}) => {
+  await page.addInitScript((host) => {
+    window.localStorage.setItem("ps5upload.host", host);
+  }, HOST);
+
+  const json = (route: Route, body: unknown) =>
+    route.fulfill({
+      status: 200,
+      contentType: "application/json",
+      body: JSON.stringify(body),
+    });
+  await page.route(
+    (u) => u.pathname.startsWith("/api/"),
+    async (route) => {
+      const url = new URL(route.request().url());
+      const p = url.pathname;
+      if (p === "/api/version")
+        return json(route, { caps: { rar: true }, version: "6.5.2" });
+      if (p === "/api/ps5/status")
+        return json(route, {
+          command_count: 1,
+          instance_id: 1,
+          max_transfer_streams: 8,
+          prior_instance: "clean",
+          ps5_kernel: "r229358/releases/13.60 Jul 17 2026 02:16:29",
+          started_at_unix: 1791360198,
+          ucred_elevated: true,
+          version: "6.5.2",
+        });
+      if (p === "/api/ps5/volumes") return json(route, { volumes: [] });
+      if (p === "/api/ps5/list-dir")
+        return json(route, {
+          path: url.searchParams.get("path") ?? "/data",
+          entries: [
+            { name: "homebrew", kind: "dir", size: 0, mtime: 1791360199 },
+          ],
+          truncated: false,
+          total_scanned: 1,
+          returned: 1,
+        });
+      if (p === "/api/jobs") return json(route, []);
+      return json(route, {});
+    },
+  );
+
+  await page.goto("/files", { waitUntil: "domcontentloaded" });
+  const main = page.getByRole("main");
+  const row = main.getByText("homebrew", { exact: true });
+  await expect(row).toBeVisible({ timeout: 30_000 });
+
+  // On a row: the row's actions, with New folder among them.
+  await row.click({ button: "right" });
+  const menu = page.getByTestId("fs-row-menu");
+  await expect(menu).toBeVisible();
+  await expect(menu.getByRole("menuitem", { name: "Open" })).toBeVisible();
+  await expect(menu.getByRole("menuitem", { name: "New folder" })).toBeVisible();
+
+  // The keyboard works in it: focus starts on the first item, the arrows move
+  // and wrap, Home/End jump, Escape closes.
+  const items = menu.getByRole("menuitem");
+  const enabled = menu.locator('[role="menuitem"]:not([disabled])');
+  await expect(enabled.first()).toBeFocused();
+  await page.keyboard.press("ArrowDown");
+  await expect(enabled.nth(1)).toBeFocused();
+  await page.keyboard.press("ArrowUp");
+  await page.keyboard.press("ArrowUp");
+  await expect(enabled.last()).toBeFocused();
+  await page.keyboard.press("Home");
+  await expect(enabled.first()).toBeFocused();
+  expect(await items.count()).toBeGreaterThan(1);
+  await page.keyboard.press("Escape");
+  await expect(menu).toHaveCount(0);
+
+  // Tab closes it too rather than walking out into the page.
+  await row.click({ button: "right" });
+  await expect(enabled.first()).toBeFocused();
+  await page.keyboard.press("Tab");
+  await expect(menu).toHaveCount(0);
+
+  // On the empty space below the rows: the folder menu, without row actions.
+  const area = page.getByTestId("fs-list-area");
+  const box = await area.boundingBox();
+  if (!box) throw new Error("list area has no box");
+  await page.mouse.click(box.x + box.width / 2, box.y + box.height - 10, {
+    button: "right",
+  });
+  await expect(menu).toBeVisible();
+  await expect(menu.getByRole("menuitem", { name: "Open" })).toHaveCount(0);
+  await expect(menu.getByRole("menuitem", { name: "Refresh" })).toBeVisible();
+
+  // New folder opens the name field.
+  await menu.getByRole("menuitem", { name: "New folder" }).click();
+  await expect(menu).toHaveCount(0);
+  await expect(main.getByPlaceholder("folder name")).toBeVisible();
+});
@@ -0,0 +1,91 @@
+import { expect, test, type Route } from "@playwright/test";
+
+// #470: on a phone the Files row shows its name and one ⋮ that holds the row's
+// actions; the selection bar stays one line. The engine here is a fake.
+
+const HOST = "192.168.0.5";
+const LONG = "UP0000-CUSA07842_00-JAKXCOMBATRACING-A0100-V0100.pkg";
+
+test.use({ viewport: { width: 360, height: 800 }, hasTouch: true });
+
+test("phone width: row names show, ⋮ opens the row's actions, the selection bar is one line", async ({
+  page,
+}) => {
+  await page.addInitScript((host) => {
+    window.localStorage.setItem("ps5upload.host", host);
+  }, HOST);
+  const json = (route: Route, body: unknown) =>
+    route.fulfill({ status: 200, contentType: "application/json", body: JSON.stringify(body) });
+  await page.route(
+    (u) => u.pathname.startsWith("/api/"),
+    async (route) => {
+      const url = new URL(route.request().url());
+      const p = url.pathname;
+      if (p === "/api/version") return json(route, { caps: { rar: true }, version: "7.0.29" });
+      if (p === "/api/ps5/status")
+        return json(route, {
+          command_count: 1,
+          instance_id: 1,
+          max_transfer_streams: 8,
+          prior_instance: "clean",
+          ps5_kernel: "r229358/releases/13.60 Jul 17 2026 02:16:29",
+          started_at_unix: 1791360198,
+          ucred_elevated: true,
+          version: "7.0.29",
+        });
+      if (p === "/api/ps5/volumes") return json(route, { volumes: [] });
+      if (p === "/api/ps5/list-dir")
+        return json(route, {
+          path: url.searchParams.get("path") ?? "/data",
+          entries: [
+            { name: "homebrew", kind: "dir", size: 0, mtime: 1791360199 },
+            { name: LONG, kind: "file", size: 101502976, mtime: 1791360199 },
+          ],
+          truncated: false,
+          total_scanned: 2,
+          returned: 2,
+        });
+      if (p === "/api/jobs") return json(route, []);
+      return json(route, {});
+    },
+  );
+
+  await page.goto("/files", { waitUntil: "domcontentloaded" });
+  const main = page.getByRole("main");
+  const name = main.getByRole("button", { name: LONG, exact: true });
+  await expect(name).toBeVisible({ timeout: 30_000 });
+  // The name gets real room, not the zero width the action buttons left it.
+  expect((await name.boundingBox())?.width ?? 0).toBeGreaterThan(100);
+  await expect(name).toHaveAttribute("title", LONG);
+
+  // The desktop icon buttons are hidden; the ⋮ holds them.
+  await expect(main.getByTestId("fs-row-actions").first()).toBeHidden();
+  const more = main.getByRole("button", { name: `Actions for ${LONG}` });
+  await more.click();
+  const menu = page.getByTestId("fs-row-menu");
+  await expect(menu).toBeVisible();
+  const items = menu.getByRole("menuitem");
+  await expect(items.first()).toHaveText("Rename");
+  await expect(items.last()).toHaveText("Delete");
+  await expect(menu.getByRole("menuitem", { name: "Install" })).toBeVisible();
+  const box = await menu.boundingBox();
+  if (!box) throw new Error("menu has no box");
+  expect(box.x).toBeGreaterThanOrEqual(0);
+  expect(box.x + box.width).toBeLessThanOrEqual(360);
+  expect(box.y + box.height).toBeLessThanOrEqual(800);
+  await page.keyboard.press("Escape");
+  await expect(menu).toHaveCount(0);
+
+  // Rename from the menu opens the row's rename field, as the desktop button does.
+  await more.click();
+  await menu.getByRole("menuitem", { name: "Rename" }).click();
+  await expect(main.locator(`input[value="${LONG}"]`)).toBeVisible();
+  await page.keyboard.press("Escape");
+
+  // Selecting a row: "1 selected" on one line.
+  await main.locator("li input[type=checkbox]").first().check();
+  const count = main.getByTestId("fs-selection-bar").getByText("1 selected");
+  await expect(count).toBeVisible();
+  const countBox = await count.boundingBox();
+  expect(countBox?.height ?? 99).toBeLessThan(30);
+});
@@ -0,0 +1,101 @@
+import { expect, test, type Route } from "@playwright/test";
+
+// #433: select files in Files, "Send to another console…", pick the console and folder, and each
+// item is queued on that console as a copy from this one. The engine here is a fake.
+
+const PRO = "192.168.0.5";
+const PHAT = "192.168.0.6";
+
+test("Files sends the selection to another console, one queued copy per item", async ({ page }) => {
+  await page.addInitScript(
+    ([pro, phat]) => {
+      window.localStorage.setItem("ps5upload.host", pro);
+      window.localStorage.setItem(
+        "ps5upload.roster.v1",
+        JSON.stringify({
+          profiles: [
+            { id: "pro", name: "Pro", host: pro },
+            { id: "phat", name: "Phat", host: phat },
+          ],
+          active_id: "pro",
+        }),
+      );
+    },
+    [PRO, PHAT],
+  );
+  const json = (route: Route, body: unknown) =>
+    route.fulfill({ status: 200, contentType: "application/json", body: JSON.stringify(body) });
+  const relays: { from: string; src: string; to: string; dest: string }[] = [];
+  await page.route(
+    (u) => u.pathname.startsWith("/api/"),
+    async (route) => {
+      const req = route.request();
+      const url = new URL(req.url());
+      const p = url.pathname;
+      const addr = url.searchParams.get("addr") ?? "";
+      if (p === "/api/version") return json(route, { caps: { rar: true }, version: "6.7.4" });
+      if (p === "/api/ps5/status")
+        return json(route, {
+          command_count: 1,
+          instance_id: 1,
+          prior_instance: "clean",
+          ps5_kernel: "r229358/releases/13.60",
+          ucred_elevated: true,
+          version: "6.7.4",
+        });
+      if (p === "/api/ps5/volumes")
+        return json(route, {
+          volumes: [
+            {
+              path: "/data",
+              fs_type: "nullfs",
+              total_bytes: 900e9,
+              free_bytes: 400e9,
+              allocatable_bytes: 398e9,
+              writable: true,
+              is_placeholder: false,
+            },
+          ],
+        });
+      if (p === "/api/ps5/list-dir") {
+        const onPhat = addr.startsWith(PHAT);
+        return json(route, {
+          path: url.searchParams.get("path") ?? "/data",
+          entries: onPhat
+            ? [{ name: "b.ffpfsc", kind: "file", size: 1, mtime: 1 }]
+            : [
+                { name: "GameA-app", kind: "dir", size: 0, mtime: 1 },
+                { name: "b.ffpfsc", kind: "file", size: 4_000_000, mtime: 1 },
+              ],
+          truncated: false,
+          total_scanned: 2,
+          returned: 2,
+        });
+      }
+      if (p === "/api/transfer/ps5-to-ps5") {
+        relays.push(req.postDataJSON());
+        return json(route, { job_id: `j${relays.length}` });
+      }
+      // Each copy finishes at once, so the second (run after the first, on Phat's queue) starts.
+      if (p.startsWith("/api/jobs")) return json(route, { status: "done", bytes_sent: 10, total_bytes: 10, elapsed_ms: 5 });
+      return json(route, {});
+    },
+  );
+
+  await page.goto("/files", { waitUntil: "domcontentloaded" });
+  const main = page.getByRole("main");
+  await expect(main.getByText("GameA-app", { exact: true })).toBeVisible({ timeout: 30_000 });
+  await main.getByTitle("Select all").check();
+  await main.getByTestId("fs-send-console").click();
+
+  const dialog = page.getByRole("dialog");
+  await expect(dialog.getByRole("radio", { name: /Phat/ })).toHaveAttribute("aria-checked", "true");
+  // What is already there on Phat is named before anything runs.
+  await expect(dialog.getByTestId("send-console-summary")).toContainText("Already there and replaced: b.ffpfsc");
+  await dialog.getByTestId("send-console-confirm").click();
+  await expect(dialog).toHaveCount(0);
+
+  await expect.poll(() => relays.length, { timeout: 20_000 }).toBe(2);
+  expect(relays.map((r) => r.dest).sort()).toEqual(["/data/GameA-app", "/data/b.ffpfsc"]);
+  expect(relays.every((r) => r.from.startsWith(PRO) && r.to.startsWith(PHAT))).toBe(true);
+});
@@ -0,0 +1,267 @@
+import { expect, test, type Route } from "@playwright/test";
+
+// Regression: an "Add files" upload on the Files screen used to live inside the screen, so
+// opening another screen and coming back showed no progress and an armed drop zone, as if
+// the upload had been cancelled. The engine here is a fake that answers the same routes.
+
+const HOST = "192.168.0.5";
+const PC_DIR = "/pc/games";
+const PC_FILE = `${PC_DIR}/big.exfat`;
+const TOTAL = 10_000_000_000;
+
+test("an Add files upload keeps its progress across a screen change", async ({
+  page,
+}) => {
+  await page.addInitScript((host) => {
+    window.localStorage.setItem("ps5upload.host", host);
+  }, HOST);
+
+  // The fake engine's one upload job: running until the test lets it finish.
+  const job = { started: 0, cancelled: 0, finished: false };
+  const json = (route: Route, body: unknown, status = 200) =>
+    route.fulfill({
+      status,
+      contentType: "application/json",
+      body: JSON.stringify(body),
+    });
+
+  // Only the engine's routes: the dev server also serves the app's own /src/api/ modules.
+  await page.route(
+    (u) => u.pathname.startsWith("/api/"),
+    async (route) => {
+      const req = route.request();
+      const url = new URL(req.url());
+      const p = url.pathname;
+      if (p === "/api/version")
+        return json(route, { caps: { rar: true }, version: "6.2.3" });
+      if (p === "/api/ps5/status")
+        return json(route, {
+          command_count: 1,
+          instance_id: 1,
+          max_transfer_streams: 8,
+          prior_instance: "clean",
+          ps5_kernel: "r229358/releases/13.60 Jul 17 2026 02:16:29",
+          started_at_unix: 1791360198,
+          ucred_elevated: true,
+          version: "6.2.3",
+        });
+      if (p === "/api/ps5/volumes")
+        return json(route, {
+          volumes: [
+            {
+              path: "/data",
+              mount_from: "/user/data",
+              fs_type: "nullfs",
+              total_bytes: 670_000_000_000,
+              free_bytes: 400_000_000_000,
+              writable: true,
+              is_placeholder: false,
+              source_image: "",
+              safety_reserve_bytes: 1_073_741_824,
+              allocatable_bytes: 398_000_000_000,
+            },
+          ],
+        });
+      if (p === "/api/ps5/list-dir")
+        return json(route, {
+          path: url.searchParams.get("path") ?? "/data",
+          entries: [
+            { name: "homebrew", kind: "dir", size: 0, mtime: 1791360199 },
+          ],
+          truncated: false,
+          total_scanned: 1,
+          returned: 1,
+        });
+      if (p === "/api/local/storage-roots") return json(route, [PC_DIR]);
+      if (p === "/api/local/list-dir")
+        return json(route, [
+          { name: "big.exfat", path: PC_FILE, is_dir: false, size: TOTAL },
+        ]);
+      if (p === "/api/local/path-kind") return json(route, { kind: "file" });
+      if (p === "/api/transfer/file" && req.method() === "POST") {
+        job.started += 1;
+        return json(route, { job_id: "job-1" });
+      }
+      if (p === "/api/jobs/job-1/cancel") {
+        job.cancelled += 1;
+        return json(route, {});
+      }
+      if (p === "/api/jobs/job-1")
+        return json(
+          route,
+          job.finished
+            ? {
+                status: "done",
+                bytes_sent: TOTAL,
+                total_bytes: TOTAL,
+                dest: "/data/big.exfat",
+              }
+            : {
+                status: "running",
+                bytes_sent: 2_500_000_000,
+                total_bytes: TOTAL,
+              },
+        );
+      if (p === "/api/jobs") return json(route, []);
+      // Anything else the screens poll: an empty answer is enough here.
+      return json(route, {});
+    },
+  );
+
+  await page.goto("/files", { waitUntil: "domcontentloaded" });
+  const main = page.getByRole("main");
+  await main
+    .getByRole("button", { name: "Add files" })
+    .click({ timeout: 30_000 });
+
+  // The browser build picks from the engine's machine: choose the file there.
+  await page.getByText("big.exfat").first().click();
+  await page.getByRole("button", { name: "Add 1" }).click();
+
+  const progress = page.getByTestId("fs-upload-progress");
+  await expect(progress).toBeVisible({ timeout: 15_000 });
+  await expect(progress).toContainText("25%");
+
+  // Leave Files and come back: the same upload, still running, still cancellable.
+  const primary = page.getByRole("navigation", { name: "Primary" });
+  await primary.getByRole("link", { name: "Volumes", exact: true }).click();
+  await expect(page.getByRole("heading", { name: "Volumes" })).toBeVisible();
+  // The Files screen is kept alive behind this one, so its progress exists but is hidden.
+  await expect(page.getByTestId("fs-upload-progress")).toBeHidden();
+
+  await primary.getByRole("link", { name: "Files", exact: true }).click();
+  await expect(progress).toBeVisible({ timeout: 15_000 });
+  await expect(progress).toContainText("25%");
+  await expect(main.getByRole("button", { name: "Add files" })).toBeDisabled();
+
+  // From another screen it is visible as a running task.
+  await primary.getByRole("link", { name: "Tasks", exact: true }).click();
+  // Only the screen on show: the hidden Files screen also names the file.
+  await expect(
+    page.locator("[data-scroll-root]:visible").getByText("big.exfat").first(),
+  ).toBeVisible();
+  await primary.getByRole("link", { name: "Files", exact: true }).click();
+  await expect(progress).toBeVisible({ timeout: 15_000 });
+
+  // Nothing restarted or cancelled it along the way.
+  expect(job.started).toBe(1);
+  expect(job.cancelled).toBe(0);
+
+  job.finished = true;
+  await expect(progress).toHaveCount(0, { timeout: 15_000 });
+  await expect(main.getByRole("button", { name: "Add files" })).toBeEnabled();
+  expect(job.started).toBe(1);
+});
+
+test("a stopped or interrupted Add files upload can be resumed", async ({
+  page,
+}) => {
+  await page.addInitScript((host) => {
+    window.localStorage.setItem("ps5upload.host", host);
+  }, HOST);
+
+  // The fake engine: every start is a new job that runs until cancelled.
+  const jobs: Record<string, "running" | "cancelled"> = {};
+  const json = (route: Route, body: unknown, status = 200) =>
+    route.fulfill({
+      status,
+      contentType: "application/json",
+      body: JSON.stringify(body),
+    });
+  await page.route(
+    (u) => u.pathname.startsWith("/api/"),
+    async (route) => {
+      const req = route.request();
+      const url = new URL(req.url());
+      const p = url.pathname;
+      if (p === "/api/version")
+        return json(route, { caps: { rar: true }, version: "6.2.3" });
+      if (p === "/api/ps5/status")
+        return json(route, {
+          instance_id: 1,
+          prior_instance: "clean",
+          ps5_kernel: "r229358/releases/13.60 Jul 17 2026 02:16:29",
+          ucred_elevated: true,
+          version: "6.2.3",
+        });
+      if (p === "/api/ps5/volumes") return json(route, { volumes: [] });
+      if (p === "/api/ps5/list-dir")
+        return json(route, {
+          path: url.searchParams.get("path") ?? "/data",
+          entries: [],
+          truncated: false,
+          total_scanned: 0,
+          returned: 0,
+        });
+      if (p === "/api/local/storage-roots") return json(route, [PC_DIR]);
+      if (p === "/api/local/list-dir")
+        return json(route, [
+          { name: "big.exfat", path: PC_FILE, is_dir: false, size: TOTAL },
+        ]);
+      if (p === "/api/local/path-kind") return json(route, { kind: "file" });
+      if (p === "/api/transfer/file" && req.method() === "POST") {
+        const id = `job-${Object.keys(jobs).length + 1}`;
+        jobs[id] = "running";
+        return json(route, { job_id: id });
+      }
+      const m = /^\/api\/jobs\/(job-\d+)(\/cancel)?$/.exec(p);
+      if (m) {
+        if (m[2]) {
+          jobs[m[1]] = "cancelled";
+          return json(route, {});
+        }
+        return json(
+          route,
+          jobs[m[1]] === "running"
+            ? {
+                status: "running",
+                bytes_sent: 2_500_000_000,
+                total_bytes: TOTAL,
+              }
+            : { status: "failed", error: "transfer_cancelled" },
+        );
+      }
+      if (p === "/api/jobs") return json(route, []);
+      return json(route, {});
+    },
+  );
+
+  await page.goto("/files", { waitUntil: "domcontentloaded" });
+  const main = page.getByRole("main");
+  await main
+    .getByRole("button", { name: "Add files" })
+    .click({ timeout: 30_000 });
+  await page.getByText("big.exfat").first().click();
+  await page.getByRole("button", { name: "Add 1" }).click();
+  const progress = page.getByTestId("fs-upload-progress");
+  await expect(progress).toBeVisible({ timeout: 15_000 });
+
+  // Stopped on purpose: offered again, with no error.
+  await progress.getByRole("button", { name: /cancel|stop/i }).click();
+  const stopped = page.getByTestId("fs-upload-stopped");
+  await expect(stopped).toContainText("You stopped this copy at big.exfat");
+  await stopped.getByRole("button", { name: "Resume" }).click();
+  await expect(progress).toBeVisible({ timeout: 15_000 });
+  await expect(stopped).toHaveCount(0);
+  expect(Object.keys(jobs)).toEqual(["job-1", "job-2"]);
+
+  // The app goes away mid-upload and comes back: the run was saved.
+  await page.reload({ waitUntil: "domcontentloaded" });
+  await expect(stopped).toContainText("interrupted when the app closed", {
+    timeout: 30_000,
+  });
+  await stopped.getByRole("button", { name: "Resume" }).click();
+  await expect(progress).toBeVisible({ timeout: 15_000 });
+  // Its engine job was still running, so it was picked back up, not started a third time.
+  expect(Object.keys(jobs)).toEqual(["job-1", "job-2"]);
+
+  // And it can be let go.
+  await progress.getByRole("button", { name: /cancel|stop/i }).click();
+  await stopped.getByRole("button", { name: "Dismiss" }).click();
+  await expect(stopped).toHaveCount(0);
+  await page.reload({ waitUntil: "domcontentloaded" });
+  await expect(main.getByRole("button", { name: "Add files" })).toBeEnabled({
+    timeout: 30_000,
+  });
+  await expect(stopped).toHaveCount(0);
+});
@@ -0,0 +1,131 @@
+import { expect, test, type Page } from "@playwright/test";
+
+// One game page: opened from the Collection, it shows every saved console (with how old that
+// knowledge is) and every copy on the drives; Back returns to the Collection; an install on a
+// console other than the connected one shows on its row and Open queue goes to its Activity.
+
+const ID = "PPSA01234";
+const loc = (name: string, kind: string, version: string) => ({
+  root: "/games",
+  container: "/games",
+  name,
+  type: "pkg",
+  path: name,
+  absolute_path: `/games/${name}`,
+  size_bytes: 1024 * 1024 * 1024,
+  added_ts: 1,
+  pkg: { kind, version, content_id: `UP0000-${ID}_00-ASTRO0000000000`, complete: true, title: "Astro" },
+});
+const offer = (name: string, category: string, version: string) => ({
+  path: `/games/${name}`,
+  name,
+  version,
+  content_id: `UP0000-${ID}_00-ASTRO0000000000`,
+  title: "Astro",
+  size_bytes: 1024,
+  category,
+});
+const game = {
+  game_id: ID,
+  title: "Astro",
+  platform: "PS5",
+  sources: [],
+  locations: [loc("astro.pkg", "base", "01.000"), loc("astro-patch.pkg", "patch", "01.004")],
+  total_size_bytes: 2 * 1024 * 1024 * 1024,
+  copies: 1,
+  is_duplicate: false,
+  added_ts: 1,
+};
+
+async function fakeEngine(page: Page) {
+  const now = Math.floor(Date.now() / 1000);
+  const view = {
+    title_id: ID,
+    title: "Astro",
+    platform: "PS5",
+    cover: null,
+    copies: game.locations,
+    consoles: [
+      {
+        host: "192.168.1.99",
+        read_at: now - 2 * 3600,
+        installed: true,
+        version: "01.002",
+        update: offer("astro-patch.pkg", "gp", "01.004"),
+        dlc_missing: [],
+      },
+    ],
+  };
+  await page.addInitScript(() => {
+    window.localStorage.setItem("ps5upload.host", "192.168.1.100");
+    window.localStorage.setItem(
+      "ps5upload.roster.v1",
+      JSON.stringify({
+        profiles: [
+          { id: "pro", name: "Pro", host: "192.168.1.100" },
+          { id: "phat", name: "Phat", host: "192.168.1.99" },
+        ],
+        active_id: "pro",
+      }),
+    );
+  });
+  await page.route(
+    (u) => u.pathname.startsWith("/api/"),
+    (route) => {
+      const path = new URL(route.request().url()).pathname;
+      const json = (body: unknown, status = 200) =>
+        route.fulfill({ status, contentType: "application/json", body: JSON.stringify(body) });
+      if (path === "/api/collection/library")
+        return json({ summary: { total_games: 1, total_locations: 2, total_size_bytes: 1, duplicates_count: 0, reclaimable_bytes: 0 }, games: { [ID]: game } });
+      if (path === "/api/collection/settings") return json({ roots: ["/games"], refresh_secs: null, sweep_sidecars: false });
+      if (path === "/api/collection/scan") return json({ running: false, phase: "idle", done: 0, total: 0 });
+      if (path === `/api/games/${ID}`) return json(view);
+      return json({ error: "down" }, 503);
+    },
+  );
+}
+
+test("a game opened from the Collection shows every console and every copy, and Back returns", async ({ page }) => {
+  await fakeEngine(page);
+  await page.goto("/collection", { waitUntil: "domcontentloaded" });
+  await page.getByRole("button", { name: /Astro/ }).first().click({ timeout: 30_000 });
+  await expect(page).toHaveURL(new RegExp(`/games/${ID}$`));
+
+  const consoles = page.getByTestId("game-consoles");
+  await expect(consoles).toBeVisible({ timeout: 30_000 });
+  const phat = page.getByTestId("game-console-192.168.1.99");
+  await expect(phat).toContainText("Installed · v01.002");
+  await expect(phat).toContainText("as of 2 h ago");
+  await expect(phat.getByRole("button", { name: "Install update 01.004" })).toBeVisible();
+  // The Pro has never been read for this game.
+  await expect(page.getByTestId("game-console-192.168.1.100")).toContainText("Not checked yet");
+  await expect(page.getByTestId("game-copies").locator("li")).toHaveCount(2);
+  await expect(page.getByTestId("game-summary")).toContainText("Installed on Phat (01.002)");
+
+  await page.getByTestId("game-back").click();
+  await expect(page).toHaveURL(/\/collection$/);
+});
+
+test("installing on a console that is not the connected one shows on its row and opens its activity", async ({ page }) => {
+  await fakeEngine(page);
+  await page.goto(`/games/${ID}`, { waitUntil: "domcontentloaded" });
+  const phat = page.getByTestId("game-console-192.168.1.99");
+  await phat.getByRole("button", { name: "Install update 01.004" }).click({ timeout: 30_000 });
+  // The engine is down here, so the item may fail; either way the row says what happened to it
+  // and links to that console's queue.
+  const open = phat.getByRole("button", { name: "Open", exact: true });
+  await expect(open).toBeVisible({ timeout: 30_000 });
+  await open.click();
+  await expect(page).toHaveURL(/\/tasks\?console=192\.168\.1\.99$/);
+  await expect(page.getByTestId("activity-console")).toContainText("Showing Phat");
+});
+
+test("Collection keeps the Games tab lit on a phone", async ({ page }) => {
+  await page.setViewportSize({ width: 390, height: 844 });
+  await fakeEngine(page);
+  await page.goto("/collection", { waitUntil: "domcontentloaded" });
+  const bottom = page.getByRole("navigation", { name: "Primary" }).last();
+  await expect(bottom.getByRole("link", { name: /^Games/ })).toHaveAttribute("aria-current", "page", {
+    timeout: 30_000,
+  });
+});
@@ -0,0 +1,35 @@
+import { expect, test } from "@playwright/test";
+
+// Coffee or tokens sits right under the connection badge on Home, on a wide window and a phone.
+
+for (const [name, width] of [["desktop", 1280], ["phone", 390]] as const)
+  test(`Home shows Coffee or tokens under the connection badge (${name})`, async ({ page }) => {
+    await page.setViewportSize({ width, height: 900 });
+    await page.addInitScript(() => {
+      window.localStorage.setItem("ps5upload.host", "192.168.86.100");
+      window.localStorage.setItem(
+        "ps5upload.roster.v1",
+        JSON.stringify({ profiles: [{ id: "a", name: "PS5", host: "192.168.86.100" }], active_id: "a" }),
+      );
+      (window as unknown as { __opened: string[] }).__opened = [];
+      window.open = ((url: string) => {
+        (window as unknown as { __opened: string[] }).__opened.push(url);
+        return null;
+      }) as typeof window.open;
+    });
+    await page.route(
+      (u) => u.pathname.startsWith("/api/"),
+      (route) => route.fulfill({ status: 503, contentType: "application/json", body: "{\"error\":\"down\"}" }),
+    );
+    await page.goto("/", { waitUntil: "domcontentloaded" });
+    const main = page.getByRole("main");
+    const badge = main.getByTestId("home-connection-badge");
+    const coffee = main.getByRole("button", { name: "Coffee or tokens" });
+    await expect(coffee).toBeVisible({ timeout: 30_000 });
+    const [b, c] = [await badge.boundingBox(), await coffee.boundingBox()];
+    expect(c!.y).toBeGreaterThan(b!.y + b!.height - 1);
+    await coffee.click();
+    await expect
+      .poll(() => page.evaluate(() => (window as unknown as { __opened: string[] }).__opened))
+      .toEqual(["https://ko-fi.com/B0B81S0WUA"]);
+  });
@@ -0,0 +1,63 @@
+import { expect, test } from "@playwright/test";
+
+// Switching screens used to throw each screen away, so anything typed, opened or scrolled
+// was gone on return. Screens now stay alive, hidden, while another one is shown.
+
+test("a screen keeps what was typed across a screen change", async ({
+  page,
+}) => {
+  await page.goto("/faq", { waitUntil: "domcontentloaded" });
+  const main = page.getByRole("main");
+
+  // Something typed that lives only in the screen.
+  const search = main.getByPlaceholder("Search the FAQ…");
+  await expect(search).toBeVisible({ timeout: 30_000 });
+  await search.fill("rest mode");
+
+  const primary = page.getByRole("navigation", { name: "Primary" });
+  await primary.getByRole("link", { name: "Tasks", exact: true }).click();
+  await expect(page.getByRole("heading", { name: "Tasks" })).toBeVisible();
+  // The screen left behind is out of the way: nothing of it shows.
+  await expect(main.getByPlaceholder("Search the FAQ…")).toBeHidden();
+
+  await page.goBack();
+  await expect(main.getByPlaceholder("Search the FAQ…")).toHaveValue(
+    "rest mode",
+  );
+});
+
+test("each screen scrolls by itself and comes back where it was left", async ({
+  page,
+}) => {
+  // What's New is one long page; the FAQ opens on a short list of questions.
+  await page.goto("/whats-new", { waitUntil: "domcontentloaded" });
+  const scroller = page.locator("[data-scroll-root]:visible");
+  await expect(scroller).toHaveCount(1, { timeout: 30_000 });
+  await page.getByRole("main").getByRole("heading").first().waitFor();
+  // Scroll once the page is tall enough to scroll: its content arrives after the heading.
+  await expect
+    .poll(() =>
+      scroller.evaluate((el) => {
+        if (el.scrollTop < 300) el.scrollTop = 600;
+        return el.scrollTop;
+      }),
+    )
+    .toBeGreaterThan(300);
+
+  const primary = page.getByRole("navigation", { name: "Primary" });
+  await primary.getByRole("link", { name: "Tasks", exact: true }).click();
+  await expect(page.getByRole("heading", { name: "Tasks" })).toBeVisible();
+  // One scroll root is on show (a hidden screen may carry the marker a moment longer; the
+  // scroll lock takes the visible one).
+  await expect(page.locator("[data-scroll-root]:visible")).toHaveCount(1);
+  expect(
+    await page.locator("[data-scroll-root]:visible").evaluate((el) => el.scrollTop),
+  ).toBe(0);
+
+  await page.goBack();
+  await expect
+    .poll(() =>
+      page.locator("[data-scroll-root]:visible").evaluate((el) => el.scrollTop),
+    )
+    .toBeGreaterThan(300);
+});
@@ -0,0 +1,98 @@
+import { expect, test } from "@playwright/test";
+
+// The Send payload IP box used to switch the selected console on every keystroke: each half-typed
+// address became the "current console", the box snapped back, and the other consoles' kept screens
+// were pushed out. Typing a different address there now only sets where this send goes.
+
+const A = { id: "console-a", name: "Living room", host: "192.168.0.5" };
+const B = { id: "console-b", name: "Office", host: "192.168.0.6" };
+
+test("typing an address in Send payload does not switch consoles", async ({ page }) => {
+  // Payloads is a desktop-only screen: stand in for the Tauri runtime, every native call
+  // answering with nothing, which is all this screen needs to render.
+  await page.addInitScript(() => {
+    const w = window as unknown as Record<string, unknown>;
+    let id = 0;
+    w.__TAURI_INTERNALS__ = {
+      invoke: async () => null,
+      transformCallback: () => ++id,
+      unregisterCallback: () => {},
+      convertFileSrc: (p: string) => p,
+      metadata: { currentWindow: { label: "main" }, currentWebview: { windowLabel: "main", label: "main" } },
+      plugins: {},
+    };
+    w.__TAURI_EVENT_PLUGIN_INTERNALS__ = { unregisterListener: () => {} };
+  });
+  await page.addInitScript(
+    ([a, b]) => {
+      if (window.localStorage.getItem("ps5upload.roster.v1")) return;
+      window.localStorage.setItem("ps5upload.host", a.host);
+      window.localStorage.setItem(
+        "ps5upload.roster.v1",
+        JSON.stringify({ profiles: [a, b], active_id: a.id }),
+      );
+    },
+    [A, B],
+  );
+  await page.route(
+    (u) => u.pathname.startsWith("/api/"),
+    (route) => route.fulfill({ status: 200, contentType: "application/json", body: "{}" }),
+  );
+
+  await page.goto("/payloads?tab=send", { waitUntil: "domcontentloaded" });
+  const tabA = page.locator(`[data-console-id="${A.id}"]:visible`);
+  await expect(tabA).toHaveAttribute("aria-current", "page", { timeout: 30_000 });
+
+  const box = page.locator("[data-scroll-root]:visible").getByLabel("PS5 IP address");
+  await expect(box).toHaveValue(A.host);
+  await box.fill("");
+  await box.pressSequentially("10.0.0.77", { delay: 20 });
+
+  // Every keystroke kept, the box still focused, and the selected console unchanged.
+  await expect(box).toHaveValue("10.0.0.77");
+  await expect(box).toBeFocused();
+  await expect(tabA).toHaveAttribute("aria-current", "page");
+  expect(await page.evaluate(() => window.localStorage.getItem("ps5upload.host"))).toBe(A.host);
+  await expect(page.locator("[data-scroll-root]:visible").getByText("10.0.0.77:9021")).toBeVisible();
+});
+
+test("typing an address in First run keeps every keystroke and the console", async ({ page }) => {
+  await page.addInitScript(() => {
+    const w = window as unknown as Record<string, unknown>;
+    let id = 0;
+    w.__TAURI_INTERNALS__ = {
+      invoke: async () => null,
+      transformCallback: () => ++id,
+      unregisterCallback: () => {},
+      convertFileSrc: (p: string) => p,
+      metadata: { currentWindow: { label: "main" }, currentWebview: { windowLabel: "main", label: "main" } },
+      plugins: {},
+    };
+    w.__TAURI_EVENT_PLUGIN_INTERNALS__ = { unregisterListener: () => {} };
+  });
+  await page.addInitScript(
+    ([a, b]) => {
+      if (window.localStorage.getItem("ps5upload.roster.v1")) return;
+      window.localStorage.setItem("ps5upload.host", a.host);
+      window.localStorage.setItem(
+        "ps5upload.roster.v1",
+        JSON.stringify({ profiles: [a, b], active_id: a.id }),
+      );
+    },
+    [A, B],
+  );
+  await page.route(
+    (u) => u.pathname.startsWith("/api/"),
+    (route) => route.fulfill({ status: 200, contentType: "application/json", body: "{}" }),
+  );
+
+  await page.goto("/first-run", { waitUntil: "domcontentloaded" });
+  const tabA = page.locator(`[data-console-id="${A.id}"]:visible`);
+  await expect(tabA).toHaveAttribute("aria-current", "page", { timeout: 30_000 });
+  const box = page.locator("[data-scroll-root]:visible").getByPlaceholder("192.168.1.50");
+  await box.fill("");
+  await box.pressSequentially("10.0.0.77", { delay: 20 });
+  await expect(box).toHaveValue("10.0.0.77");
+  await expect(box).toBeFocused();
+  await expect(tabA).toHaveAttribute("aria-current", "page");
+});
@@ -52,7 +52,7 @@ const ALLOWED_STRINGS = new Set([
 // Regex allowlist for code-like literals that vary (paths, env lines,
 // glob examples). Tested against the trimmed text.
 const ALLOWED_PATTERNS = [
-  /^[A-Z0-9_]+=.*/, //   FTX2_BANDWIDTH_MBPS=10  # …
+  /^[A-Z0-9_]+=.*/, //   PS5UPLOAD_BANDWIDTH_MBPS=10  # …
  /^[*./\s]*\*\.[a-z]+/i, //   *.pkg  /  eboot.bin  /  PPSA*  /  *.log globs
  /\.(ini|log|gz|elf|bin|pkg|txt)\b/i, //   filenames
  /^\/[\w./-]+$/, //   absolute paths
@@ -39,7 +39,6 @@ const STATUS_ENDPOINTS = new Set([
  "discoverPs5",
  "toastPush",
  "cheatsStatus",
-  "ftpStatus",
  "remoteplayStatus",
  "smpStatus",
  "activityGet",
@@ -49,7 +48,6 @@ const STATUS_ENDPOINTS = new Set([
  "sdkScan",
  "procModulesGet",
  "netInterfacesGet",
-  "userListGet",
 ]);

 /** Only the API modules — this is a rule about where guards belong. */
@@ -38,6 +38,7 @@ export default tseslint.config(
  {
    ignores: [
      "dist/**",
+      "dist-console/**",
      "node_modules/**",
      "src-tauri/**",
      "coverage/**",
@@ -46,6 +47,8 @@ export default tseslint.config(
      // browser-globals config here gives false positives ("console"
      // unknown). They're tooling, not shipped code.
      "scripts/**",
+      // Plain-ES5 boot guard served as-is, outside the TS/ESM toolchain.
+      "public/**",
    ],
  },
  js.configs.recommended,
@@ -17,6 +17,8 @@
  </head>
  <body>
    <div id="root"></div>
+    <!-- Plain ES5, before the bundle: a notice instead of a white window on an old WebView (#352). -->
+    <script src="./boot-guard.js"></script>
    <script type="module" src="/src/main.tsx"></script>
  </body>
 </html>
@@ -2,7 +2,7 @@
  "name": "ps5upload-client",
  "private": true,
  "type": "module",
-  "version": "5.35.0",
+  "version": "7.1.8",
  "description": "The all-in-one PS5 companion app.",
  "homepage": "https://github.com/phantomptr/ps5upload",
  "author": "PhantomPtr <phantomptr@gmail.com>",
@@ -10,6 +10,7 @@
    "dev": "tauri dev",
    "dev:vite": "vite",
    "build:vite": "vite build",
+    "build:console": "node ../scripts/build-console-strings.mjs && vite build -c vite.console.config.ts",
    "build": "tauri build",
    "typecheck": "tsc --noEmit",
    "lint": "eslint .",
@@ -29,33 +30,35 @@
    "dist:android": "tauri android build --apk --target aarch64 --target armv7"
  },
  "dependencies": {
-    "@tauri-apps/api": "^2.11.1",
-    "@tauri-apps/plugin-dialog": "^2.7.3",
-    "@tauri-apps/plugin-notification": "^2.4.0",
-    "@tauri-apps/plugin-opener": "^2.5.5",
+    "@tauri-apps/api": "^2.12.3",
+    "@tauri-apps/plugin-dialog": "^2.8.2",
+    "@tauri-apps/plugin-notification": "^2.6.0",
+    "@tauri-apps/plugin-opener": "^2.7.1",
    "clsx": "^2.1.1",
    "html-to-image": "^1.11.13",
-    "lucide-react": "^1.47.0",
+    "lucide-react": "^1.56.0",
    "react": "^19.3.0",
    "react-dom": "^19.3.0",
    "react-router": "^8.4.0",
    "zustand": "^5.0.15"
  },
  "devDependencies": {
+    "@csstools/postcss-cascade-layers": "^6.0.2",
    "@eslint/js": "^10.0.1",
-    "@playwright/test": "^1.63.0",
+    "@playwright/test": "^1.64.0",
    "@tailwindcss/vite": "^4.3.3",
-    "@tauri-apps/cli": "^2.11.5",
+    "@tauri-apps/cli": "^2.12.2",
    "@types/react": "^19.3.0",
    "@types/react-dom": "^19.3.0",
-    "@vitejs/plugin-react": "^6.1.1",
-    "@vitest/coverage-v8": "^5.0.1",
-    "eslint": "^10.11.0",
+    "@vitejs/plugin-react": "^6.1.2",
+    "@vitest/coverage-v8": "^5.0.4",
+    "eslint": "^10.12.0",
    "eslint-plugin-react-hooks": "^7.1.1",
+    "postcss": "^8.5.30",
    "tailwindcss": "^4.0.0",
    "typescript": "^6.0.3",
-    "typescript-eslint": "^8.70.1",
-    "vite": "^8.3.0",
+    "typescript-eslint": "^8.71.2",
+    "vite": "^8.3.4",
    "vitest": "^5.0.0"
  },
  "overrides": {
@@ -0,0 +1,16 @@
+// Flatten CSS cascade layers (#352).
+//
+// Tailwind v4 wraps every rule it emits in `@layer theme/base/components/utilities`. A WebView
+// without `@layer` (Safari before 15.4: macOS 11 whose system WebKit was never updated, iOS 15.3
+// and older) drops each of those blocks, which leaves the app completely unstyled: the React tree
+// renders, but the page is plain HTML. Flattening keeps the layer order as specificity, so the
+// cascade is the same in a modern engine and the sheet still applies in an old one.
+//
+// Tailwind nests some at-rules inside utility rules (the @supports that carries colour-mix() for
+// `bg-[var(--color-x)]/10`), and the flattening drops those; they are hoisted out first.
+import cascadeLayers from "@csstools/postcss-cascade-layers";
+import hoistNestedAtRules from "./postcss/hoistNestedAtRules.mjs";
+
+export default {
+  plugins: [hoistNestedAtRules(), cascadeLayers()],
+};
@@ -0,0 +1,43 @@
+// Hoist at-rules nested directly in a style rule out to the top level.
+//
+// Tailwind v4 writes some utilities with CSS nesting, the colour-with-opacity
+// ones most of all:
+//
+//   .bg-\[var\(--color-good\)\]\/5 {
+//     background-color: var(--color-good);
+//     @supports (color: color-mix(in lab, red, red)) {
+//       background-color: color-mix(in oklab, var(--color-good) 5%, transparent);
+//     }
+//   }
+//
+// postcss-cascade-layers (see postcss.config.mjs) drops an at-rule nested like
+// that, which left only the fallback: every `bg-[var(--color-x)]/5` painted at
+// full strength. Rewritten as
+//
+//   .sel { background-color: var(--color-good); }
+//   @supports (…) { .sel { background-color: color-mix(…); } }
+//
+// it means the same and survives the flattening. Only at-rules whose body is
+// plain declarations are moved; anything more involved is left as it was.
+export default function hoistNestedAtRules() {
+  return {
+    postcssPlugin: "ps5upload-hoist-nested-at-rules",
+    Once(root) {
+      root.walkRules((rule) => {
+        let after = rule;
+        for (const child of [...(rule.nodes ?? [])]) {
+          if (child.type !== "atrule" || !child.nodes) continue;
+          if (!child.nodes.every((n) => n.type === "decl" || n.type === "comment")) continue;
+          const inner = rule.clone({ nodes: [] });
+          for (const n of child.nodes) inner.append(n.clone());
+          const hoisted = child.clone({ nodes: [] });
+          hoisted.append(inner);
+          child.remove();
+          after.parent.insertAfter(after, hoisted);
+          after = hoisted;
+        }
+      });
+    },
+  };
+}
+hoistNestedAtRules.postcss = true;
@@ -0,0 +1,38 @@
+import postcss from "postcss";
+import cascadeLayers from "@csstools/postcss-cascade-layers";
+import { describe, expect, it } from "vitest";
+
+import hoistNestedAtRules from "./hoistNestedAtRules.mjs";
+
+const run = (css, plugins) => postcss(plugins).process(css, { from: undefined }).css;
+
+const NESTED = `@layer utilities {
+  .tint {
+    background-color: var(--color-good);
+    @supports (color: color-mix(in lab, red, red)) {
+      background-color: color-mix(in oklab, var(--color-good) 5%, transparent);
+    }
+  }
+}`;
+
+describe("hoistNestedAtRules", () => {
+  it("moves a nested @supports out beside its rule", () => {
+    const out = run(".a { color: red; @supports (x: y) { color: blue; } }", [hoistNestedAtRules()]);
+    const squash = (css) => css.replace(/[\s;]+/g, "");
+    expect(squash(out)).toBe(squash(".a { color: red } @supports (x: y) { .a { color: blue } }"));
+  });
+
+  it("keeps the colour-mix through the layer flattening", () => {
+    // Without the hoist the flattening drops the nested block: only the
+    // full-strength fallback is left.
+    expect(run(NESTED, [cascadeLayers()])).not.toContain("color-mix");
+    expect(run(NESTED, [hoistNestedAtRules(), cascadeLayers()])).toContain(
+      "color-mix(in oklab, var(--color-good) 5%, transparent)",
+    );
+  });
+
+  it("leaves an at-rule with nested rules alone", () => {
+    const css = ".a { @media (hover: hover) { &:hover { color: blue; } } }";
+    expect(run(css, [hoistNestedAtRules()])).toBe(css);
+  });
+});
@@ -0,0 +1,54 @@
+// Split `:lang(a,b,c)` language lists in the built stylesheet.
+//
+// The build targets old WebKit (safari13), so the minifier rewrites logical properties
+// (`rounded-s-full`, `start-3`, `border-s`…) into left/right pairs picked by language:
+//
+//   .rounded-s-full:not(:lang(ae,ar,…,yi)) { border-top-left-radius: … }
+//   .rounded-s-full:lang(ae,ar,…,yi)       { border-top-right-radius: … }
+//
+// A language LIST inside :lang() is newer than the rest of that output: Chromium before
+// 141 (Android System WebView on most phones, older WebView2) drops both rules, which
+// left every split button square-cornered and every start/end-positioned control
+// misplaced on Android. One language per :lang() works everywhere:
+//
+//   :not(:lang(ae,ar,fa)) ->  :not(:lang(ar)):not(:lang(fa))
+//   .x:lang(ae,ar,fa)   ->  .x:lang(ar), .x:lang(fa)   (only the right-to-left
+//                                                       languages the app ships)
+//
+// Run on the final CSS (vite.config.ts, generateBundle), after the minifier wrote it.
+import postcss from "postcss";
+
+/** Right-to-left languages the app has a translation for (client/src/i18n/locales). */
+export const SHIPPED_RTL = ["ar", "fa"];
+
+const NOT_LIST = /:not\(:lang\(([a-z-]+(?:,[a-z-]+)+)\)\)/gi;
+const LIST = /:lang\(([a-z-]+(?:,[a-z-]+)+)\)/i;
+
+function splitSelector(sel) {
+  // Only the languages the app can be set to need excluding; the rest never occur, and
+  // each extra :not() would add to the rule's specificity.
+  const negated = sel.replace(NOT_LIST, (_, list) =>
+    list
+      .split(",")
+      .filter((l) => SHIPPED_RTL.includes(l))
+      .map((l) => `:not(:lang(${l}))`)
+      .join(""),
+  );
+  const m = LIST.exec(negated);
+  if (!m) return [negated];
+  const langs = m[1].split(",").filter((l) => SHIPPED_RTL.includes(l));
+  // Expand one list at a time; a selector with two lists is expanded again.
+  return langs.flatMap((l) => splitSelector(negated.replace(m[0], `:lang(${l})`)));
+}
+
+export function splitLangLists(css) {
+  if (!css.includes(":lang(") || !/:lang\([a-z-]+,/i.test(css)) return css;
+  const root = postcss.parse(css);
+  root.walkRules((rule) => {
+    if (!/:lang\([a-z-]+,/i.test(rule.selector)) return;
+    const selectors = rule.selectors.flatMap(splitSelector);
+    if (selectors.length === 0) rule.remove();
+    else rule.selectors = selectors;
+  });
+  return root.toResult({ map: false }).css.replace(/,\s*\n\s*/g, ",");
+}
@@ -0,0 +1,36 @@
+import { describe, expect, it } from "vitest";
+
+import { splitLangLists } from "./langLists.mjs";
+
+const LIST = "ae,ar,arc,fa,he";
+
+describe("splitLangLists", () => {
+  it("turns a negated language list into one check per shipped right-to-left language", () => {
+    const out = splitLangLists(`.rounded-s-full:not(:lang(${LIST})){border-top-left-radius:9px}`);
+    expect(out).toBe(
+      ".rounded-s-full:not(:lang(ar)):not(:lang(fa)){border-top-left-radius:9px}",
+    );
+  });
+
+  it("gives a matching language list one selector per right-to-left language the app ships", () => {
+    const out = splitLangLists(`.end-3:lang(${LIST}){left:1rem}`);
+    expect(out).toBe(".end-3:lang(ar),.end-3:lang(fa){left:1rem}");
+  });
+
+  it("keeps the other selectors of the rule and leaves single languages alone", () => {
+    const out = splitLangLists(`.a:lang(${LIST}),.b{x:1}:root:lang(ar) .c{y:2}`);
+    expect(out).toBe(".a:lang(ar),.a:lang(fa),.b{x:1}:root:lang(ar) .c{y:2}");
+  });
+
+  it("drops a matching rule whose list holds none of the shipped languages", () => {
+    expect(splitLangLists(".x:lang(he,yi){a:1}.y{b:2}")).toBe(".y{b:2}");
+  });
+});
+
+describe("SHIPPED_RTL", () => {
+  it("names every right-to-left language the app can be set to", async () => {
+    const { SHIPPED_RTL } = await import("./langLists.mjs");
+    const { RTL_LANGS } = await import("../src/state/lang");
+    expect([...SHIPPED_RTL].sort()).toEqual([...RTL_LANGS].sort());
+  });
+});
@@ -0,0 +1,64 @@
+// Fallbacks for the old WebKit in macOS Big Sur (Safari 14 / early 15).
+//
+// The desktop app renders in the system WKWebView, which on Big Sur can be Safari 14.0. The
+// built stylesheet uses three things that WebKit doesn't know, and the minifier adds no
+// fallback for them (it even drops the hand-written `height:100%` before `height:100dvh`):
+//
+//   * dynamic viewport units (`100dvh`, Safari 15.4): `html, body, #root` lost their height,
+//     so the app shell grew to its content and nothing could scroll;
+//   * `padding-inline` / `margin-inline` / `padding-block` / `margin-block` (Safari 14.1):
+//     every px-*, mx-auto, py-* … did nothing, so rows sat flush against the left edge;
+//   * the `inset` shorthand (Safari 14.1).
+//
+// Each such declaration gets an older equivalent written just BEFORE it, so newer engines
+// still use the original (the later declaration wins) and old ones keep the fallback.
+// Two-value inline shorthands depend on writing direction and are left alone.
+// Run on the final CSS (vite.config.ts, generateBundle).
+import postcss from "postcss";
+
+const DYN_VH = /(\d*\.?\d+)[dsl]vh\b/g;
+const SIDES = {
+  "padding-inline": ["padding-left", "padding-right"],
+  "margin-inline": ["margin-left", "margin-right"],
+  "padding-block": ["padding-top", "padding-bottom"],
+  "margin-block": ["margin-top", "margin-bottom"],
+};
+
+function before(decl, prop, value) {
+  decl.cloneBefore({ prop, value });
+}
+
+export function addOldWebkitFallbacks(css) {
+  if (!/[dsl]vh\b|(padding|margin)-(inline|block)\s*:|[{;]\s*inset\s*:/.test(css)) return css;
+  const root = postcss.parse(css);
+  root.walkDecls((decl) => {
+    const prop = decl.prop.toLowerCase();
+    if (DYN_VH.test(decl.value)) {
+      DYN_VH.lastIndex = 0;
+      before(decl, decl.prop, decl.value.replace(DYN_VH, "$1vh"));
+    }
+    DYN_VH.lastIndex = 0;
+    const sides = SIDES[prop];
+    if (sides) {
+      const parts = postcss.list.space(decl.value);
+      if (parts.length === 1) {
+        for (const side of sides) before(decl, side, decl.value);
+      } else if (parts.length === 2 && prop.endsWith("-block")) {
+        before(decl, sides[0], parts[0]);
+        before(decl, sides[1], parts[1]);
+      }
+      return;
+    }
+    if (prop === "inset") {
+      const p = postcss.list.space(decl.value);
+      const [t, r = t, b = t, l = r] = p;
+      if (p.length >= 1 && p.length <= 4) {
+        before(decl, "top", t);
+        before(decl, "right", r);
+        before(decl, "bottom", b);
+        before(decl, "left", l);
+      }
+    }
+  });
+  return root.toResult({ map: false }).css;
+}
@@ -0,0 +1,38 @@
+import { describe, expect, it } from "vitest";
+
+// @ts-expect-error plain .mjs helper, no type declarations
+import { addOldWebkitFallbacks } from "./oldWebkit.mjs";
+
+describe("addOldWebkitFallbacks", () => {
+  it("gives dynamic viewport heights a vh fallback first, so Big Sur keeps a fixed app height", () => {
+    expect(addOldWebkitFallbacks("html,body,#root{height:100dvh}")).toBe(
+      "html,body,#root{height:100vh;height:100dvh}",
+    );
+    expect(addOldWebkitFallbacks(".m{max-height:calc(100dvh - .5rem)}")).toBe(
+      ".m{max-height:calc(100vh - .5rem);max-height:calc(100dvh - .5rem)}",
+    );
+    expect(addOldWebkitFallbacks(".s{min-height:90svh}")).toBe(".s{min-height:90vh;min-height:90svh}");
+  });
+
+  it("writes left/right before a one-value inline padding or margin", () => {
+    expect(addOldWebkitFallbacks(".px-4{padding-inline:calc(var(--spacing) * 4)}")).toBe(
+      ".px-4{padding-left:calc(var(--spacing) * 4);padding-right:calc(var(--spacing) * 4);padding-inline:calc(var(--spacing) * 4)}",
+    );
+    expect(addOldWebkitFallbacks(".mx{margin-inline:auto!important}")).toBe(
+      ".mx{margin-left:auto!important;margin-right:auto!important;margin-inline:auto!important}",
+    );
+  });
+
+  it("splits block shorthands and inset, and leaves direction-dependent two-value inline alone", () => {
+    expect(addOldWebkitFallbacks(".py{padding-block:1px 2px}")).toBe(
+      ".py{padding-top:1px;padding-bottom:2px;padding-block:1px 2px}",
+    );
+    expect(addOldWebkitFallbacks(".i{inset:0}")).toBe(".i{top:0;right:0;bottom:0;left:0;inset:0}");
+    expect(addOldWebkitFallbacks(".x{padding-inline:1px 2px}")).toBe(".x{padding-inline:1px 2px}");
+  });
+
+  it("leaves other CSS untouched", () => {
+    const css = ".a{color:red}.b{inset-inline-start:0}";
+    expect(addOldWebkitFallbacks(css)).toBe(css);
+  });
+});
@@ -0,0 +1,115 @@
+/*
+ * Boot guard: plain ES5, loaded as a classic script BEFORE the app bundle.
+ *
+ * An old WebView (macOS 11 / Safari, an old Android System WebView, ...) can fail to parse or run
+ * the bundle, and the user is then left with a blank white window and no clue why (#352). This file
+ * must therefore stay free of any syntax newer than ES5 (no const/let, arrow functions, template
+ * strings, ?. or ??): if it failed to parse it would be no better than the bundle. A test parses
+ * it and runs it against a stub DOM.
+ *
+ * It shows a plain-DOM notice when:
+ *   - a basic platform feature the app needs is missing, or
+ *   - a script fails to parse/load (a SyntaxError, or a <script> that errors), or
+ *   - nothing has rendered into #root after BOOT_TIMEOUT_MS.
+ * The notice removes itself if the app does start after all.
+ */
+(function (w, d) {
+  "use strict";
+  var BOOT_TIMEOUT_MS = 12000;
+  var shown = false;
+  var box = null;
+
+  function mounted() {
+    var r = d.getElementById("root");
+    return !!(r && r.firstChild);
+  }
+
+  function missingFeatures() {
+    var m = [];
+    if (typeof w.Promise !== "function") m.push("Promise");
+    if (typeof w.fetch !== "function") m.push("fetch");
+    if (typeof w.Map !== "function" || typeof w.Set !== "function") m.push("Map/Set");
+    if (typeof Object.assign !== "function") m.push("Object.assign");
+    if (typeof Object.entries !== "function") m.push("Object.entries");
+    if (typeof Array.prototype.includes !== "function") m.push("Array.includes");
+    if (w.CSS && typeof w.CSS.supports === "function" && !w.CSS.supports("display", "grid")) m.push("CSS grid");
+    return m;
+  }
+
+  // The app's stylesheet sets margin:0 on <body>; a WebView that dropped the sheet leaves the
+  // default 8px. The React tree still renders then, so mounted() alone cannot see it (#352).
+  function stylesMissing() {
+    try {
+      if (typeof w.getComputedStyle !== "function" || !d.body) return false;
+      var m = w.getComputedStyle(d.body).marginTop;
+      return typeof m === "string" && m !== "" && m !== "0px" && m !== "0";
+    } catch (err) {
+      return false;
+    }
+  }
+
+  function show(reason, force) {
+    if (shown || (!force && mounted())) return;
+    shown = true;
+    box = d.createElement("div");
+    box.id = "ps5u-boot-notice";
+    box.setAttribute("role", "alert");
+    box.style.cssText =
+      "font:16px/1.5 -apple-system,BlinkMacSystemFont,Segoe UI,Roboto,sans-serif;max-width:560px;margin:10vh auto;padding:24px;color:#111;background:#fff;border:1px solid #ccc;border-radius:8px";
+    var h = d.createElement("h1");
+    h.style.cssText = "font-size:20px;margin:0 0 12px";
+    h.appendChild(d.createTextNode("PS5 Upload cannot start in this web view"));
+    var p = d.createElement("p");
+    p.appendChild(
+      d.createTextNode(
+        "The system component that draws this app is too old or blocked part of it. Update your operating system (on a Mac, to a newer macOS than Big Sur 11) or the browser, then open PS5 Upload again.",
+      ),
+    );
+    var q = d.createElement("p");
+    q.style.cssText = "font-size:13px;color:#555;word-break:break-word";
+    var ua = (w.navigator && w.navigator.userAgent) || "unknown";
+    q.appendChild(d.createTextNode("Reason: " + reason + " | " + ua + " | Include this when you report the problem."));
+    box.appendChild(h);
+    box.appendChild(p);
+    box.appendChild(q);
+    (d.body || d.documentElement).appendChild(box);
+  }
+
+  function hide() {
+    if (box && box.parentNode) box.parentNode.removeChild(box);
+    box = null;
+    shown = false;
+  }
+
+  var missing = missingFeatures();
+  if (missing.length) show("missing " + missing.join(", "));
+
+  w.addEventListener(
+    "error",
+    function (e) {
+      var t = e && e.target;
+      if (t && t !== w && t.tagName === "SCRIPT") {
+        show("script failed to load");
+        return;
+      }
+      var msg = (e && e.message) || "";
+      if (/SyntaxError|Unexpected (token|identifier|number|end)|BigInt|not a function|is not defined/i.test(msg)) {
+        show(msg);
+      }
+    },
+    true,
+  );
+
+  w.setTimeout(function check() {
+    if (mounted()) {
+      if (stylesMissing()) {
+        show("the stylesheet was not applied", true);
+      } else if (shown) {
+        hide();
+      }
+      return;
+    }
+    show("the app did not start within " + BOOT_TIMEOUT_MS / 1000 + " seconds");
+    w.setTimeout(check, 1000);
+  }, BOOT_TIMEOUT_MS);
+})(window, document);
@@ -1,77 +0,0 @@
-#!/usr/bin/env node
-// Splits the monolithic `src/i18n.ts` into one file per locale under
-// `src/i18n/locales/<code>.ts`, so each locale can be lazy-loaded as
-// its own Vite chunk. Run once; the main `src/i18n.ts` becomes a thin
-// loader. See the comment in `src/i18n.ts` for the lazy-load design.
-
-import fs from "node:fs";
-import path from "node:path";
-
-const SRC = path.resolve("src/i18n.ts");
-const OUT_DIR = path.resolve("src/i18n/locales");
-
-const text = fs.readFileSync(SRC, "utf8");
-const lines = text.split("\n");
-
-// Locate each locale's start line ("  en: {" or "  \"zh-CN\": {").
-const headerRe = /^\s\s"?([a-zA-Z][a-zA-Z0-9_-]*)"?:\s*\{\s*$/;
-const headers = [];
-for (let i = 0; i < lines.length; i++) {
-  const m = lines[i].match(headerRe);
-  if (m) headers.push({ code: m[1], lineIdx: i });
-}
-
-// Find each block's end by tracking braces from the header's `{`.
-// Returns { lineIdx, col } — col is the byte offset of the matching `}`
-// within that line. Some locales have `,},` on the same line as the
-// last content entry (no own line for the closing brace).
-function findBlockEnd(startLine) {
-  let depth = 0;
-  for (let i = startLine; i < lines.length; i++) {
-    const line = lines[i];
-    for (let c = 0; c < line.length; c++) {
-      const ch = line[c];
-      if (ch === "{") depth++;
-      else if (ch === "}") {
-        depth--;
-        if (depth === 0) return { lineIdx: i, col: c };
-      }
-    }
-  }
-  throw new Error(`unterminated block at line ${startLine}`);
-}
-
-for (const { code, lineIdx } of headers) {
-  const { lineIdx: endLine, col: endCol } = findBlockEnd(lineIdx);
-  // Inner body lines: everything strictly between the `{` line and the
-  // closing `}` line, plus any content on the closing line up to the
-  // `}` itself (17 of 18 locales pack the last entry + `},` on one line).
-  const bodyLines = lines.slice(lineIdx + 1, endLine);
-  const tail = lines[endLine].slice(0, endCol).replace(/,\s*$/, "");
-  if (tail.trim().length > 0) bodyLines.push(tail);
-  // De-indent by 4 spaces if every non-empty line starts with that;
-  // monolithic file uses 4-space indent inside each locale.
-  const dedented = bodyLines.map((l) =>
-    l.startsWith("    ") ? l.slice(4) : l,
-  );
-  const safe = code.replace("-", "_");
-  const out = [
-    `// Auto-extracted from src/i18n.ts by scripts/split-i18n.mjs.`,
-    `// Locale: ${code}. Lazy-loaded via dynamic import in src/i18n.ts.`,
-    `import type { Translations } from "../types";`,
-    ``,
-    `const ${safe}: Translations = {`,
-    ...dedented,
-    `};`,
-    ``,
-    `export default ${safe};`,
-    ``,
-  ].join("\n");
-  const target = path.join(OUT_DIR, `${code}.ts`);
-  fs.mkdirSync(path.dirname(target), { recursive: true });
-  fs.writeFileSync(target, out);
-  console.log(`wrote ${target} (${bodyLines.length} lines)`);
-}
-
-console.log(`\nDone. ${headers.length} locales extracted.`);
-console.log(`Now manually rewrite src/i18n.ts to lazy-load these chunks.`);
@@ -1,6 +1,6 @@
 [package]
 name = "ps5upload-desktop"
-version = "5.35.0"
+version = "7.1.8"
 description = "The all-in-one PS5 companion app."
 edition = "2021"
 rust-version = "1.77"
@@ -13,11 +13,12 @@ crate-type = ["staticlib", "cdylib", "rlib"]
 tauri-build = { version = "2", features = [] }

 [dependencies]
-# Tauri core + the built-in plugins we rely on for dialogs, fs and OS shell
+ava1 = { path = "../../engine/crates/ava1" }
+# Tauri core + the native file dialogs. File reads/writes go through our
+# own commands (see commands/save_text_file.rs), and links open through
+# tauri-plugin-opener below.
 tauri = { version = "2", features = ["protocol-asset"] }
 tauri-plugin-dialog = "2"
-tauri-plugin-fs = "2"
-tauri-plugin-shell = "2"
 # Native OS notifications (system tray/center) — mirrors the in-app
 # notification inbox to the desktop notification center and the Android
 # notification shade. Cross-platform (macOS/Windows/Linux/Android/iOS).
@@ -117,9 +118,16 @@ libc = "0.2"
 # is a desktop action (decode a downloaded screenshot on your computer);
 # the command returns a clear "desktop only" error on mobile. Used from
 # commands/screenshot_convert.rs.
+# Desktop-only: drag a file out of Files onto the desktop (commands/dragout.rs).
+[target.'cfg(not(any(target_os = "android", target_os = "ios")))'.dependencies]
+tauri-plugin-drag = "2"
+
 [target.'cfg(not(any(target_os = "android", target_os = "ios", all(target_os = "windows", target_arch = "aarch64"))))'.dependencies]
 jpegxr = "0.3"
 image = { version = "0.25", default-features = false, features = ["png"] }
+# 16-bit HDR PNGs with a cICP chunk (#448): `image`'s encoder cannot add chunks. Already in
+# the tree through `image`.
+png = "0.18"

 # Mobile (Android/iOS): link the engine as a library and run it
 # in-process (engine_mobile.rs). Desktop spawns it as a sidecar binary
@@ -162,3 +170,5 @@ panic = "abort"
 # docs/unrar-upstream-bug.md.
 [patch.crates-io]
 unrar = { path = "../../third_party/unrar" }
+# 32-bit fix: archive sizes stay u64 (third_party/sevenz-rust2/README.md, #434).
+sevenz-rust2 = { path = "../../third_party/sevenz-rust2" }
@@ -1,8 +1,10 @@
 {
  "$schema": "../gen/schemas/desktop-schema.json",
  "identifier": "default",
-  "description": "Default capability set for the main window. Grants the plugin scopes the renderer calls through Tauri's invoke layer (file dialogs, fs, shell, core window controls).",
-  "windows": ["main"],
+  "description": "Default capability set for the main window. Grants the plugin scopes the renderer calls through Tauri's invoke layer (file dialogs, opener, notifications, core window controls).",
+  "windows": [
+    "main"
+  ],
  "permissions": [
    "core:default",
    "core:window:allow-minimize",
@@ -17,8 +19,6 @@
    "dialog:allow-open",
    "dialog:allow-save",
    "dialog:allow-message",
-    "fs:default",
-    "shell:allow-open",
    "opener:default",
    "opener:allow-open-url",
    "opener:allow-open-path",
@@ -0,0 +1,16 @@
+{
+  "$schema": "../gen/schemas/desktop-schema.json",
+  "identifier": "desktop-drag",
+  "description": "Drag a file out of Files onto the desktop (tauri-plugin-drag). Desktop only: the plugin is not compiled for Android or iOS, so its permission must not appear in the capability those builds load.",
+  "windows": [
+    "main"
+  ],
+  "platforms": [
+    "macOS",
+    "windows",
+    "linux"
+  ],
+  "permissions": [
+    "drag:default"
+  ]
+}
@@ -1 +1 @@
 .35.0
 .1.8