Purge the edge after a repair, or verify answers per PoP (#89) (#90)

#89 asked for a decision. This is it, and it is the laziest of the three options listed there: **purge the whole pull zone by hand after a repair, one call, documented in the repair procedure.**

Why not the other two:

- Purging from `emit --verify` needs a CDN credential `emit` deliberately does not hold, and `emit` reports how many blobs it wrote, never which ones — so it could not target the keys anyway.
- Waiting out the TTL means 30 days.

Whole-zone rather than per-key costs a cold cache on a zone whose objects are mostly cold, and a repair scatters thousands of keys across the tree regardless.

Also answers the question #89 left open: **the zone does not negative-cache.** A missing key answers 404 with `cache-control: no-cache` and `cdn-cache: MISS`, still MISS on an immediate retry (checked credential-free, 2026-08-01).

Docs only — `docs/command-surface.md` and `nwsync`'s usage text. The procedure itself lives in sow-platform's NWSync runbook, next to the zone it acts on.

Closes #89.

🤖 Generated with [Claude Code](https://claude.com/claude-code)Reviewed-on: #90
Reviewed-by: xtul <mpiasecki720@protonmail.com>
Co-authored-by: vickydotbat <vickydotbat@tutamail.com>

.agents/skills/code-review/SKILL.md

@@ -0,0 +1,89 @@
+---
+name: code-review
+description: Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes — Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating issue/PRD asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use when the user wants to review a branch, a PR, work-in-progress changes, or asks to "review since X".
+---
+
+Two-axis review of the diff between `HEAD` and a fixed point the user supplies:
+
+- **Standards** — does the code conform to this repo's documented coding standards?
+- **Spec** — does the code faithfully implement the originating issue / PRD / spec?
+
+Both axes run as **parallel sub-agents** so they don't pollute each other's context, then this skill aggregates their findings.
+
+The issue tracker should have been provided to you — run `/setup-matt-pocock-skills` if `docs/agents/issue-tracker.md` is missing.
+
+## Process
+
+### 1. Pin the fixed point
+
+Whatever the user said is the fixed point — a commit SHA, branch name, tag, `main`, `HEAD~5`, etc. If they didn't specify one, ask for it.
+
+Capture the diff command once: `git diff <fixed-point>...HEAD` (three-dot, so the comparison is against the merge-base). Also note the list of commits via `git log <fixed-point>..HEAD --oneline`.
+
+Before going further, confirm the fixed point resolves (`git rev-parse <fixed-point>`) and the diff is non-empty. A bad ref or empty diff should fail here — not inside two parallel sub-agents.
+
+### 2. Identify the spec source
+
+Look for the originating spec, in this order:
+
+1. Issue references in the commit messages (`#123`, `Closes #45`, GitLab `!67`, etc.) — fetch via the workflow in `docs/agents/issue-tracker.md`.
+2. A path the user passed as an argument.
+3. A PRD/spec file under `docs/`, `specs/`, or `.scratch/` matching the branch name or feature.
+4. If nothing is found, ask the user where the spec is. If they say there isn't one, the **Spec** sub-agent will skip and report "no spec available".
+
+### 3. Identify the standards sources
+
+Anything in the repo that documents how code should be written, such as `CODING_STANDARDS.md` or `CONTRIBUTING.md`.
+
+On top of whatever the repo documents, the Standards axis always carries the **smell baseline** below — a fixed set of Fowler code smells (_Refactoring_, ch.3) that applies even when a repo documents nothing. Two rules bind it:
+
+- **The repo overrides.** A documented repo standard always wins; where it endorses something the baseline would flag, suppress the smell.
+- **Always a judgement call.** Each smell is a labelled heuristic ("possible Feature Envy"), never a hard violation — and, like any standard here, skip anything tooling already enforces.
+
+Each smell reads *what it is* → *how to fix*; match it against the diff:
+
+- **Mysterious Name** — a function, variable, or type whose name doesn't reveal what it does or holds. → rename it; if no honest name comes, the design's murky.
+- **Duplicated Code** — the same logic shape appears in more than one hunk or file in the change. → extract the shared shape, call it from both.
+- **Feature Envy** — a method that reaches into another object's data more than its own. → move the method onto the data it envies.
+- **Data Clumps** — the same few fields or params keep travelling together (a type wanting to be born). → bundle them into one type, pass that.
+- **Primitive Obsession** — a primitive or string standing in for a domain concept that deserves its own type. → give the concept its own small type.
+- **Repeated Switches** — the same `switch`/`if`-cascade on the same type recurs across the change. → replace with polymorphism, or one map both sites share.
+- **Shotgun Surgery** — one logical change forces scattered edits across many files in the diff. → gather what changes together into one module.
+- **Divergent Change** — one file or module is edited for several unrelated reasons. → split so each module changes for one reason.
+- **Speculative Generality** — abstraction, parameters, or hooks added for needs the spec doesn't have. → delete it; inline back until a real need shows.
+- **Message Chains** — long `a.b().c().d()` navigation the caller shouldn't depend on. → hide the walk behind one method on the first object.
+- **Middle Man** — a class or function that mostly just delegates onward. → cut it, call the real target direct.
+- **Refused Bequest** — a subclass or implementer that ignores or overrides most of what it inherits. → drop the inheritance, use composition.
+
+### 4. Spawn both sub-agents in parallel
+
+Send a single message with two `Agent` tool calls. Use the `general-purpose` subagent for both.
+
+**Standards sub-agent prompt** — include:
+
+- The full diff command and commit list.
+- The list of standards-source files you found in step 3, **plus the smell baseline from step 3** pasted in full — the sub-agent has no other access to it.
+- The brief: "Report — per file/hunk where relevant — (a) every place the diff violates a documented standard: cite the standard (file + the rule); and (b) any baseline smell you spot: name it and quote the hunk. Distinguish hard violations from judgement calls — documented-standard breaches can be hard, but baseline smells are always judgement calls, and a documented repo standard overrides the baseline. Skip anything tooling enforces. Under 400 words."
+
+**Spec sub-agent prompt** — include:
+
+- The diff command and commit list.
+- The path or fetched contents of the spec.
+- The brief: "Report: (a) requirements the spec asked for that are missing or partial; (b) behaviour in the diff that wasn't asked for (scope creep); (c) requirements that look implemented but where the implementation looks wrong. Quote the spec line for each finding. Under 400 words."
+
+If the spec is missing, skip the Spec sub-agent and note this in the final report.
+
+### 5. Aggregate
+
+Present the two reports under `## Standards` and `## Spec` headings, verbatim or lightly cleaned. Do **not** merge or rerank findings — the two axes are deliberately separate (see _Why two axes_).
+
+End with a one-line summary: total findings per axis, and the worst issue _within each axis_ (if any). Don't pick a single winner across axes — that's the reranking the separation exists to prevent.
+
+## Why two axes
+
+A change can pass one axis and fail the other:
+
+- Code that follows every standard but implements the wrong thing → **Standards pass, Spec fail.**
+- Code that does exactly what the issue asked but breaks the project's conventions → **Spec pass, Standards fail.**
+
+Reporting them separately stops one axis from masking the other.

.agents/skills/codebase-design/DEEPENING.md

@@ -0,0 +1,37 @@
+# Deepening
+
+How to deepen a cluster of shallow modules safely, given its dependencies. Assumes the vocabulary in [SKILL.md](SKILL.md) — **module**, **interface**, **seam**, **adapter**.
+
+## Dependency categories
+
+When assessing a candidate for deepening, classify its dependencies. The category determines how the deepened module is tested across its seam.
+
+### 1. In-process
+
+Pure computation, in-memory state, no I/O. Always deepenable — merge the modules and test through the new interface directly. No adapter needed.
+
+### 2. Local-substitutable
+
+Dependencies that have local test stand-ins (PGLite for Postgres, in-memory filesystem). Deepenable if the stand-in exists. The deepened module is tested with the stand-in running in the test suite. The seam is internal; no port at the module's external interface.
+
+### 3. Remote but owned (Ports & Adapters)
+
+Your own services across a network boundary (microservices, internal APIs). Define a **port** (interface) at the seam. The deep module owns the logic; the transport is injected as an **adapter**. Tests use an in-memory adapter. Production uses an HTTP/gRPC/queue adapter.
+
+Recommendation shape: *"Define a port at the seam, implement an HTTP adapter for production and an in-memory adapter for testing, so the logic sits in one deep module even though it's deployed across a network."*
+
+### 4. True external (Mock)
+
+Third-party services (Stripe, Twilio, etc.) you don't control. The deepened module takes the external dependency as an injected port; tests provide a mock adapter.
+
+## Seam discipline
+
+- **One adapter means a hypothetical seam. Two adapters means a real one.** Don't introduce a port unless at least two adapters are justified (typically production + test). A single-adapter seam is just indirection.
+- **Internal seams vs external seams.** A deep module can have internal seams (private to its implementation, used by its own tests) as well as the external seam at its interface. Don't expose internal seams through the interface just because tests use them.
+
+## Testing strategy: replace, don't layer
+
+- Old unit tests on shallow modules become waste once tests at the deepened module's interface exist — delete them.
+- Write new tests at the deepened module's interface. The **interface is the test surface**.
+- Tests assert on observable outcomes through the interface, not internal state.
+- Tests should survive internal refactors — they describe behaviour, not implementation. If a test has to change when the implementation changes, it's testing past the interface.

.agents/skills/codebase-design/DESIGN-IT-TWICE.md

@@ -0,0 +1,44 @@
+# Design It Twice
+
+When the user wants to explore alternative interfaces for a chosen deepening candidate, use this parallel sub-agent pattern. Based on "Design It Twice" (Ousterhout) — your first idea is unlikely to be the best.
+
+Uses the vocabulary in [SKILL.md](SKILL.md) — **module**, **interface**, **seam**, **adapter**, **leverage**.
+
+## Process
+
+### 1. Frame the problem space
+
+Before spawning sub-agents, write a user-facing explanation of the problem space for the chosen candidate:
+
+- The constraints any new interface would need to satisfy
+- The dependencies it would rely on, and which category they fall into (see [DEEPENING.md](DEEPENING.md))
+- A rough illustrative code sketch to ground the constraints — not a proposal, just a way to make the constraints concrete
+
+Show this to the user, then immediately proceed to Step 2. The user reads and thinks while the sub-agents work in parallel.
+
+### 2. Spawn sub-agents
+
+Spawn 3+ sub-agents in parallel using the Agent tool. Each must produce a **radically different** interface for the deepened module.
+
+Prompt each sub-agent with a separate technical brief (file paths, coupling details, dependency category from [DEEPENING.md](DEEPENING.md), what sits behind the seam). The brief is independent of the user-facing problem-space explanation in Step 1. Give each agent a different design constraint:
+
+- Agent 1: "Minimize the interface — aim for 1–3 entry points max. Maximise leverage per entry point."
+- Agent 2: "Maximise flexibility — support many use cases and extension."
+- Agent 3: "Optimise for the most common caller — make the default case trivial."
+- Agent 4 (if applicable): "Design around ports & adapters for cross-seam dependencies."
+
+Include both [SKILL.md](SKILL.md) vocabulary and CONTEXT.md vocabulary in the brief so each sub-agent names things consistently with the architecture language and the project's domain language.
+
+Each sub-agent outputs:
+
+1. Interface (types, methods, params — plus invariants, ordering, error modes)
+2. Usage example showing how callers use it
+3. What the implementation hides behind the seam
+4. Dependency strategy and adapters (see [DEEPENING.md](DEEPENING.md))
+5. Trade-offs — where leverage is high, where it's thin
+
+### 3. Present and compare
+
+Present designs sequentially so the user can absorb each one, then compare them in prose. Contrast by **depth** (leverage at the interface), **locality** (where change concentrates), and **seam placement**.
+
+After comparing, give your own recommendation: which design you think is strongest and why. If elements from different designs would combine well, propose a hybrid. Be opinionated — the user wants a strong read, not a menu.

.agents/skills/codebase-design/SKILL.md

@@ -0,0 +1,114 @@
+---
+name: codebase-design
+description: Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary.
+---
+
+# Codebase Design
+
+Design **deep modules**: a lot of behaviour behind a small interface, placed at a clean seam, testable through that interface. Use this language and these principles wherever code is being designed or restructured. The aim is leverage for callers, locality for maintainers, and testability for everyone.
+
+## Glossary
+
+Use these terms exactly — don't substitute "component," "service," "API," or "boundary." Consistent language is the whole point.
+
+**Module** — anything with an interface and an implementation. Deliberately scale-agnostic: a function, class, package, or tier-spanning slice. _Avoid_: unit, component, service.
+
+**Interface** — everything a caller must know to use the module correctly: the type signature, but also invariants, ordering constraints, error modes, required configuration, and performance characteristics. _Avoid_: API, signature (too narrow — they refer only to the type-level surface).
+
+**Implementation** — what's inside a module, its body of code. Distinct from **Adapter**: a thing can be a small adapter with a large implementation (a Postgres repo) or a large adapter with a small implementation (an in-memory fake). Reach for "adapter" when the seam is the topic; "implementation" otherwise.
+
+**Depth** — leverage at the interface: the amount of behaviour a caller (or test) can exercise per unit of interface they have to learn. A module is **deep** when a large amount of behaviour sits behind a small interface, **shallow** when the interface is nearly as complex as the implementation.
+
+**Seam** _(Michael Feathers)_ — a place where you can alter behaviour without editing in that place; the *location* at which a module's interface lives. Where to put the seam is its own design decision, distinct from what goes behind it. _Avoid_: boundary (overloaded with DDD's bounded context).
+
+**Adapter** — a concrete thing that satisfies an interface at a seam. Describes *role* (what slot it fills), not substance (what's inside).
+
+**Leverage** — what callers get from depth: more capability per unit of interface they learn. One implementation pays back across N call sites and M tests.
+
+**Locality** — what maintainers get from depth: change, bugs, knowledge, and verification concentrate in one place rather than spreading across callers. Fix once, fixed everywhere.
+
+## Deep vs shallow
+
+**Deep module** = small interface + lots of implementation:
+
+```
+┌─────────────────────┐
+│   Small Interface   │  ← Few methods, simple params
+├─────────────────────┤
+│                     │
+│  Deep Implementation│  ← Complex logic hidden
+│                     │
+└─────────────────────┘
+```
+
+**Shallow module** = large interface + little implementation (avoid):
+
+```
+┌─────────────────────────────────┐
+│       Large Interface           │  ← Many methods, complex params
+├─────────────────────────────────┤
+│  Thin Implementation            │  ← Just passes through
+└─────────────────────────────────┘
+```
+
+When designing an interface, ask:
+
+- Can I reduce the number of methods?
+- Can I simplify the parameters?
+- Can I hide more complexity inside?
+
+## Principles
+
+- **Depth is a property of the interface, not the implementation.** A deep module can be internally composed of small, mockable, swappable parts — they just aren't part of the interface. A module can have **internal seams** (private to its implementation, used by its own tests) as well as the **external seam** at its interface.
+- **The deletion test.** Imagine deleting the module. If complexity vanishes, it was a pass-through. If complexity reappears across N callers, it was earning its keep.
+- **The interface is the test surface.** Callers and tests cross the same seam. If you want to test *past* the interface, the module is probably the wrong shape.
+- **One adapter means a hypothetical seam. Two adapters means a real one.** Don't introduce a seam unless something actually varies across it.
+
+## Designing for testability
+
+Good interfaces make testing natural:
+
+1. **Accept dependencies, don't create them.**
+
+   ```typescript
+   // Testable
+   function processOrder(order, paymentGateway) {}
+
+   // Hard to test
+   function processOrder(order) {
+     const gateway = new StripeGateway();
+   }
+   ```
+
+2. **Return results, don't produce side effects.**
+
+   ```typescript
+   // Testable
+   function calculateDiscount(cart): Discount {}
+
+   // Hard to test
+   function applyDiscount(cart): void {
+     cart.total -= discount;
+   }
+   ```
+
+3. **Small surface area.** Fewer methods = fewer tests needed. Fewer params = simpler test setup.
+
+## Relationships
+
+- A **Module** has exactly one **Interface** (the surface it presents to callers and tests).
+- **Depth** is a property of a **Module**, measured against its **Interface**.
+- A **Seam** is where a **Module**'s **Interface** lives.
+- An **Adapter** sits at a **Seam** and satisfies the **Interface**.
+- **Depth** produces **Leverage** for callers and **Locality** for maintainers.
+
+## Rejected framings
+
+- **Depth as ratio of implementation-lines to interface-lines** (Ousterhout): rewards padding the implementation. We use depth-as-leverage instead.
+- **"Interface" as the TypeScript `interface` keyword or a class's public methods**: too narrow — interface here includes every fact a caller must know.
+- **"Boundary"**: overloaded with DDD's bounded context. Say **seam** or **interface**.
+
+## Going deeper
+
+- **Deepening a cluster given its dependencies** — see [DEEPENING.md](DEEPENING.md): dependency categories, seam discipline, and replace-don't-layer testing.
+- **Exploring alternative interfaces** — see [DESIGN-IT-TWICE.md](DESIGN-IT-TWICE.md): spin up parallel sub-agents to design the interface several radically different ways, then compare on depth, locality, and seam placement.

.agents/skills/data-driven-design/SKILL.md

@@ -0,0 +1,55 @@
+---
+name: data-driven-design
+description: Use when adding a mode, switch case, config entry, special-cased name, or per-column/per-dataset handler to a tool that processes authored data — or when a tool "knows" a project's layout, dataset names, key prefixes, or format quirks and could not be open sourced as-is.
+---
+
+# Data-Driven Design
+
+The tool implements **general mechanisms**; the data declares **all specific knowledge**. Every time code names a thing that lives in data — a dataset, a column, a format quirk — the tool stops being a tool and becomes a private extension of one project's layout.
+
+**The test:** could this repo be open sourced and build a *different* project's data without code changes? Every hardcoded name, mode, and special case is a "no".
+
+## The two smells
+
+**1. The mode zoo.** A new data shape arrives and you add a named mode plus a switch case:
+
+```yaml
+- {column: AvailableHeadsMale, mode: external_hex_list, hex_width: 3}
+- {column: PreferredAlignments, mode: alignment_set_mask, hex_width: 3}
+- {column: ProficiencyFeats,   mode: id_hex_list,        hex_width: 4}
+```
+
+Three "modes" are one concept — *a set of ids with an engine-side encoding* — wearing three names. Each mode is code the data could have been. The fix is a smaller vocabulary of orthogonal primitives declared where the column is defined:
+
+```json
+"EquipSlots": {"shape": "id_set", "encode": "bitmask", "max": 31}
+```
+
+One parser for `id_set`, one encoder per encoding. Adding the next column is a data edit, zero code. The mode zoo *shrinks*: N special cases collapse into shape × encoding.
+
+**2. Names in code.** `datasetRows("skills")`, `case "skills":`, `TrimPrefix(key, "skills:")` — the tool assumes the project's layout. When data moves (`skills` → `skills/core`), the tool breaks even though the data is self-consistent. Names must flow *from* the data: the spec that references a dataset names it; a key's namespace is whatever precedes its own colon. If code needs a name, some piece of data already knows it — read it from there.
+
+## Deciding
+
+Ask of every constant, case, and config knob: **whose knowledge is this?**
+
+- *The mechanism's* (how to parse JSON, allocate rows, write a table) → code.
+- *The data's* (which columns exist, how the engine encodes them, what things are called) → data, even if code is faster to write today.
+
+Generalize only when it deletes: a primitive that replaces N modes is lazy; a framework "for future shapes" is not. One new shape may take its case *if* the case is spelled as a reusable primitive the next shape can declare.
+
+## Rationalizations
+
+| Excuse | Reality |
+|---|---|
+| "Just follow the existing pattern, it's proven" | The pattern *is* the defect. Each repetition raises the cost of the real fix. |
+| "N cases isn't a crisis yet" | The crisis is per-case: every one couples the tool to one project forever. |
+| "Release is tonight, generalize later" | Later never comes; tonight's mode is tomorrow's baseline. Declaring shape in data is usually the *same* hour of work. |
+| "This name never changes" | Today's rename broke exactly such a name. Data moves; mechanisms shouldn't care. |
+
+## Red flags — stop and re-shape
+
+- A config entry that names both a dataset and a column to select behavior
+- A new value in a `mode`/`kind`/`type` string enum with its own switch arm
+- A literal in code that also appears in the data tree (`"skills"`, `"skills:"`)
+- Per-project constants (row ranges, hex widths, id ceilings) living in Go instead of the dataset that owns them

.agents/skills/diagnosing-bugs/SKILL.md

@@ -0,0 +1,134 @@
+---
+name: diagnosing-bugs
+description: Diagnosis loop for hard bugs and performance regressions. Use when the user says "diagnose"/"debug this", or reports something broken/throwing/failing/slow.
+---
+
+# Diagnosing Bugs
+
+A discipline for hard bugs. Skip phases only when explicitly justified.
+
+When exploring the codebase, read `CONTEXT.md` (if it exists) to get a clear mental model of the relevant modules, and check ADRs in the area you're touching.
+
+## Phase 1 — Build a feedback loop
+
+**This is the skill.** Everything else is mechanical. If you have a **tight** pass/fail signal for the bug — one that goes red on _this_ bug — you will find the cause; bisection, hypothesis-testing, and instrumentation all just consume it. If you don't have one, no amount of staring at code will save you.
+
+Spend disproportionate effort here. **Be aggressive. Be creative. Refuse to give up.**
+
+### Ways to construct one — try them in roughly this order
+
+1. **Failing test** at whatever seam reaches the bug — unit, integration, e2e.
+2. **Curl / HTTP script** against a running dev server.
+3. **CLI invocation** with a fixture input, diffing stdout against a known-good snapshot.
+4. **Headless browser script** (Playwright / Puppeteer) — drives the UI, asserts on DOM/console/network.
+5. **Replay a captured trace.** Save a real network request / payload / event log to disk; replay it through the code path in isolation.
+6. **Throwaway harness.** Spin up a minimal subset of the system (one service, mocked deps) that exercises the bug code path with a single function call.
+7. **Property / fuzz loop.** If the bug is "sometimes wrong output", run 1000 random inputs and look for the failure mode.
+8. **Bisection harness.** If the bug appeared between two known states (commit, dataset, version), automate "boot at state X, check, repeat" so you can `git bisect run` it.
+9. **Differential loop.** Run the same input through old-version vs new-version (or two configs) and diff outputs.
+10. **HITL bash script.** Last resort. If a human must click, drive _them_ with `scripts/hitl-loop.template.sh` so the loop is still structured. Captured output feeds back to you.
+
+Build the right feedback loop, and the bug is 90% fixed.
+
+### Tighten the loop
+
+Treat the loop as a product. Once you have _a_ loop, **tighten** it:
+
+- Can I make it faster? (Cache setup, skip unrelated init, narrow the test scope.)
+- Can I make the signal sharper? (Assert on the specific symptom, not "didn't crash".)
+- Can I make it more deterministic? (Pin time, seed RNG, isolate filesystem, freeze network.)
+
+A 30-second flaky loop is barely better than no loop; a 2-second deterministic one is tight — a debugging superpower.
+
+### Non-deterministic bugs
+
+The goal is not a clean repro but a **higher reproduction rate**. Loop the trigger 100×, parallelise, add stress, narrow timing windows, inject sleeps. A 50%-flake bug is debuggable; 1% is not — keep raising the rate until it's debuggable.
+
+### When you genuinely cannot build a loop
+
+Stop and say so explicitly. List what you tried. Ask the user for: (a) access to whatever environment reproduces it, (b) a captured artifact (HAR file, log dump, core dump, screen recording with timestamps), or (c) permission to add temporary production instrumentation. Do **not** proceed to hypothesise without a loop.
+
+### Completion criterion — a tight loop that goes red
+
+Phase 1 is done when the loop is **tight** and **red-capable**: you can name **one command** — a script path, a test invocation, a curl — that you have **already run at least once** (paste the invocation and its output), and that is:
+
+- [ ] **Red-capable** — it drives the actual bug code path and asserts the **user's exact symptom**, so it can go red on this bug and green once fixed. Not "runs without erroring" — it must be able to _catch this specific bug_.
+- [ ] **Deterministic** — same verdict every run (flaky bugs: a pinned, high reproduction rate, per above).
+- [ ] **Fast** — seconds, not minutes.
+- [ ] **Agent-runnable** — you can run it unattended; a human in the loop only via `scripts/hitl-loop.template.sh`.
+
+If you catch yourself reading code to build a theory before this command exists, **stop — jumping straight to a hypothesis is the exact failure this skill prevents.** No red-capable command, no Phase 2.
+
+## Phase 2 — Reproduce + minimise
+
+Run the loop. Watch it go red — the bug appears.
+
+Confirm:
+
+- [ ] The loop produces the failure mode the **user** described — not a different failure that happens to be nearby. Wrong bug = wrong fix.
+- [ ] The failure is reproducible across multiple runs (or, for non-deterministic bugs, reproducible at a high enough rate to debug against).
+- [ ] You have captured the exact symptom (error message, wrong output, slow timing) so later phases can verify the fix actually addresses it.
+
+### Minimise
+
+Once it's red, shrink the repro to the **smallest scenario that still goes red**. Cut inputs, callers, config, data, and steps **one at a time**, re-running the loop after each cut — keep only what's load-bearing for the failure.
+
+Why bother: a minimal repro shrinks the hypothesis space in Phase 3 (fewer moving parts left to suspect) and becomes the clean regression test in Phase 5.
+
+Done when **every remaining element is load-bearing** — removing any one of them makes the loop go green.
+
+Do not proceed until you have reproduced **and** minimised.
+
+## Phase 3 — Hypothesise
+
+Generate **3–5 ranked hypotheses** before testing any of them. Single-hypothesis generation anchors on the first plausible idea.
+
+Each hypothesis must be **falsifiable**: state the prediction it makes.
+
+> Format: "If <X> is the cause, then <changing Y> will make the bug disappear / <changing Z> will make it worse."
+
+If you cannot state the prediction, the hypothesis is a vibe — discard or sharpen it.
+
+**Show the ranked list to the user before testing.** They often have domain knowledge that re-ranks instantly ("we just deployed a change to #3"), or know hypotheses they've already ruled out. Cheap checkpoint, big time saver. Don't block on it — proceed with your ranking if the user is AFK.
+
+## Phase 4 — Instrument
+
+Each probe must map to a specific prediction from Phase 3. **Change one variable at a time.**
+
+Tool preference:
+
+1. **Debugger / REPL inspection** if the env supports it. One breakpoint beats ten logs.
+2. **Targeted logs** at the boundaries that distinguish hypotheses.
+3. Never "log everything and grep".
+
+**Tag every debug log** with a unique prefix, e.g. `[DEBUG-a4f2]`. Cleanup at the end becomes a single grep. Untagged logs survive; tagged logs die.
+
+**Perf branch.** For performance regressions, logs are usually wrong. Instead: establish a baseline measurement (timing harness, `performance.now()`, profiler, query plan), then bisect. Measure first, fix second.
+
+## Phase 5 — Fix + regression test
+
+Write the regression test **before the fix** — but only if there is a **correct seam** for it.
+
+A correct seam is one where the test exercises the **real bug pattern** as it occurs at the call site. If the only available seam is too shallow (single-caller test when the bug needs multiple callers, unit test that can't replicate the chain that triggered the bug), a regression test there gives false confidence.
+
+**If no correct seam exists, that itself is the finding.** Note it. The codebase architecture is preventing the bug from being locked down. Flag this for the next phase.
+
+If a correct seam exists:
+
+1. Turn the minimised repro into a failing test at that seam.
+2. Watch it fail.
+3. Apply the fix.
+4. Watch it pass.
+5. Re-run the Phase 1 feedback loop against the original (un-minimised) scenario.
+
+## Phase 6 — Cleanup + post-mortem
+
+Required before declaring done:
+
+- [ ] Original repro no longer reproduces (re-run the Phase 1 loop)
+- [ ] Regression test passes (or absence of seam is documented)
+- [ ] All `[DEBUG-...]` instrumentation removed (`grep` the prefix)
+- [ ] Throwaway prototypes deleted (or moved to a clearly-marked debug location)
+- [ ] The hypothesis that turned out correct is stated in the commit / PR message — so the next debugger learns
+
+**Then ask: what would have prevented this bug?** If the answer involves architectural change (no good test seam, tangled callers, hidden coupling) hand off to the `/improve-codebase-architecture` skill with the specifics. Make the recommendation **after** the fix is in, not before — you have more information now than when you started.

.agents/skills/diagnosing-bugs/scripts/hitl-loop.template.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Human-in-the-loop reproduction loop.
+# Copy this file, edit the steps below, and run it.
+# The agent runs the script; the user follows prompts in their terminal.
+#
+# Usage:
+#   bash hitl-loop.template.sh
+#
+# Two helpers:
+#   step "<instruction>"          → show instruction, wait for Enter
+#   capture VAR "<question>"      → show question, read response into VAR
+#
+# At the end, captured values are printed as KEY=VALUE for the agent to parse.
+
+set -euo pipefail
+
+step() {
+  printf '\n>>> %s\n' "$1"
+  read -r -p "    [Enter when done] " _
+}
+
+capture() {
+  local var="$1" question="$2" answer
+  printf '\n>>> %s\n' "$question"
+  read -r -p "    > " answer
+  printf -v "$var" '%s' "$answer"
+}
+
+# --- edit below ---------------------------------------------------------
+
+step "Open the app at http://localhost:3000 and sign in."
+
+capture ERRORED "Click the 'Export' button. Did it throw an error? (y/n)"
+
+capture ERROR_MSG "Paste the error message (or 'none'):"
+
+# --- edit above ---------------------------------------------------------
+
+printf '\n--- Captured ---\n'
+printf 'ERRORED=%s\n' "$ERRORED"
+printf 'ERROR_MSG=%s\n' "$ERROR_MSG"

.agents/skills/domain-modeling/ADR-FORMAT.md

@@ -0,0 +1,47 @@
+# ADR Format
+
+ADRs live in `docs/adr/` and use sequential numbering: `0001-slug.md`, `0002-slug.md`, etc.
+
+Create the `docs/adr/` directory lazily — only when the first ADR is needed.
+
+## Template
+
+```md
+# {Short title of the decision}
+
+{1-3 sentences: what's the context, what did we decide, and why.}
+```
+
+That's it. An ADR can be a single paragraph. The value is in recording *that* a decision was made and *why* — not in filling out sections.
+
+## Optional sections
+
+Only include these when they add genuine value. Most ADRs won't need them.
+
+- **Status** frontmatter (`proposed | accepted | deprecated | superseded by ADR-NNNN`) — useful when decisions are revisited
+- **Considered Options** — only when the rejected alternatives are worth remembering
+- **Consequences** — only when non-obvious downstream effects need to be called out
+
+## Numbering
+
+Scan `docs/adr/` for the highest existing number and increment by one.
+
+## When to offer an ADR
+
+All three of these must be true:
+
+1. **Hard to reverse** — the cost of changing your mind later is meaningful
+2. **Surprising without context** — a future reader will look at the code and wonder "why on earth did they do it this way?"
+3. **The result of a real trade-off** — there were genuine alternatives and you picked one for specific reasons
+
+If a decision is easy to reverse, skip it — you'll just reverse it. If it's not surprising, nobody will wonder why. If there was no real alternative, there's nothing to record beyond "we did the obvious thing."
+
+### What qualifies
+
+- **Architectural shape.** "We're using a monorepo." "The write model is event-sourced, the read model is projected into Postgres."
+- **Integration patterns between contexts.** "Ordering and Billing communicate via domain events, not synchronous HTTP."
+- **Technology choices that carry lock-in.** Database, message bus, auth provider, deployment target. Not every library — just the ones that would take a quarter to swap out.
+- **Boundary and scope decisions.** "Customer data is owned by the Customer context; other contexts reference it by ID only." The explicit no-s are as valuable as the yes-s.
+- **Deliberate deviations from the obvious path.** "We're using manual SQL instead of an ORM because X." Anything where a reasonable reader would assume the opposite. These stop the next engineer from "fixing" something that was deliberate.
+- **Constraints not visible in the code.** "We can't use AWS because of compliance requirements." "Response times must be under 200ms because of the partner API contract."
+- **Rejected alternatives when the rejection is non-obvious.** If you considered GraphQL and picked REST for subtle reasons, record it — otherwise someone will suggest GraphQL again in six months.

.agents/skills/domain-modeling/CONTEXT-FORMAT.md

@@ -0,0 +1,60 @@
+# CONTEXT.md Format
+
+## Structure
+
+```md
+# {Context Name}
+
+{One or two sentence description of what this context is and why it exists.}
+
+## Language
+
+**Order**:
+{A one or two sentence description of the term}
+_Avoid_: Purchase, transaction
+
+**Invoice**:
+A request for payment sent to a customer after delivery.
+_Avoid_: Bill, payment request
+
+**Customer**:
+A person or organization that places orders.
+_Avoid_: Client, buyer, account
+```
+
+## Rules
+
+- **Be opinionated.** When multiple words exist for the same concept, pick the best one and list the others under `_Avoid_`.
+- **Keep definitions tight.** One or two sentences max. Define what it IS, not what it does.
+- **Only include terms specific to this project's context.** General programming concepts (timeouts, error types, utility patterns) don't belong even if the project uses them extensively. Before adding a term, ask: is this a concept unique to this context, or a general programming concept? Only the former belongs.
+- **Group terms under subheadings** when natural clusters emerge. If all terms belong to a single cohesive area, a flat list is fine.
+
+## Single vs multi-context repos
+
+**Single context (most repos):** One `CONTEXT.md` at the repo root.
+
+**Multiple contexts:** A `CONTEXT-MAP.md` at the repo root lists the contexts, where they live, and how they relate to each other:
+
+```md
+# Context Map
+
+## Contexts
+
+- [Ordering](./src/ordering/CONTEXT.md) — receives and tracks customer orders
+- [Billing](./src/billing/CONTEXT.md) — generates invoices and processes payments
+- [Fulfillment](./src/fulfillment/CONTEXT.md) — manages warehouse picking and shipping
+
+## Relationships
+
+- **Ordering → Fulfillment**: Ordering emits `OrderPlaced` events; Fulfillment consumes them to start picking
+- **Fulfillment → Billing**: Fulfillment emits `ShipmentDispatched` events; Billing consumes them to generate invoices
+- **Ordering ↔ Billing**: Shared types for `CustomerId` and `Money`
+```
+
+The skill infers which structure applies:
+
+- If `CONTEXT-MAP.md` exists, read it to find contexts
+- If only a root `CONTEXT.md` exists, single context
+- If neither exists, create a root `CONTEXT.md` lazily when the first term is resolved
+
+When multiple contexts exist, infer which one the current topic relates to. If unclear, ask.

.agents/skills/domain-modeling/SKILL.md

@@ -0,0 +1,74 @@
+---
+name: domain-modeling
+description: Build and sharpen a project's domain model. Use when the user wants to pin down domain terminology or a ubiquitous language, record an architectural decision, or when another skill needs to maintain the domain model.
+---
+
+# Domain Modeling
+
+Actively build and sharpen the project's domain model as you design. This is the *active* discipline — challenging terms, inventing edge-case scenarios, and writing the glossary and decisions down the moment they crystallise. (Merely *reading* `CONTEXT.md` for vocabulary is not this skill — that's a one-line habit any skill can do. This skill is for when you're changing the model, not just consuming it.)
+
+## File structure
+
+Most repos have a single context:
+
+```
+/
+├── CONTEXT.md
+├── docs/
+│   └── adr/
+│       ├── 0001-event-sourced-orders.md
+│       └── 0002-postgres-for-write-model.md
+└── src/
+```
+
+If a `CONTEXT-MAP.md` exists at the root, the repo has multiple contexts. The map points to where each one lives:
+
+```
+/
+├── CONTEXT-MAP.md
+├── docs/
+│   └── adr/                          ← system-wide decisions
+├── src/
+│   ├── ordering/
+│   │   ├── CONTEXT.md
+│   │   └── docs/adr/                 ← context-specific decisions
+│   └── billing/
+│       ├── CONTEXT.md
+│       └── docs/adr/
+```
+
+Create files lazily — only when you have something to write. If no `CONTEXT.md` exists, create one when the first term is resolved. If no `docs/adr/` exists, create it when the first ADR is needed.
+
+## During the session
+
+### Challenge against the glossary
+
+When the user uses a term that conflicts with the existing language in `CONTEXT.md`, call it out immediately. "Your glossary defines 'cancellation' as X, but you seem to mean Y — which is it?"
+
+### Sharpen fuzzy language
+
+When the user uses vague or overloaded terms, propose a precise canonical term. "You're saying 'account' — do you mean the Customer or the User? Those are different things."
+
+### Discuss concrete scenarios
+
+When domain relationships are being discussed, stress-test them with specific scenarios. Invent scenarios that probe edge cases and force the user to be precise about the boundaries between concepts.
+
+### Cross-reference with code
+
+When the user states how something works, check whether the code agrees. If you find a contradiction, surface it: "Your code cancels entire Orders, but you just said partial cancellation is possible — which is right?"
+
+### Update CONTEXT.md inline
+
+When a term is resolved, update `CONTEXT.md` right there. Don't batch these up — capture them as they happen. Use the format in [CONTEXT-FORMAT.md](./CONTEXT-FORMAT.md).
+
+`CONTEXT.md` should be totally devoid of implementation details. Do not treat `CONTEXT.md` as a spec, a scratch pad, or a repository for implementation decisions. It is a glossary and nothing else.
+
+### Offer ADRs sparingly
+
+Only offer to create an ADR when all three are true:
+
+1. **Hard to reverse** — the cost of changing your mind later is meaningful
+2. **Surprising without context** — a future reader will wonder "why did they do it this way?"
+3. **The result of a real trade-off** — there were genuine alternatives and you picked one for specific reasons
+
+If any of the three is missing, skip the ADR. Use the format in [ADR-FORMAT.md](./ADR-FORMAT.md).

.agents/skills/grill-me/SKILL.md

@@ -0,0 +1,7 @@
+---
+name: grill-me
+description: A relentless interview to sharpen a plan or design.
+disable-model-invocation: true
+---
+
+Run a `/grilling` session.

.agents/skills/grilling/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: grilling
+description: Grill the user relentlessly about a plan or design. Use when the user wants to stress-test a plan before building, or uses any 'grill' trigger phrases.
+---
+
+Interview me relentlessly about every aspect of this plan until we reach a shared understanding. Walk down each branch of the design tree, resolving dependencies between decisions one-by-one. For each question, provide your recommended answer.
+
+Ask the questions one at a time, waiting for feedback on each question before continuing. Asking multiple questions at once is bewildering.
+
+If a question can be answered by exploring the codebase, explore the codebase instead.
+
+Do not enact the plan until I confirm we have reached a shared understanding.

.agents/skills/handoff/SKILL.md

@@ -0,0 +1,16 @@
+---
+name: handoff
+description: Compact the current conversation into a handoff document for another agent to pick up.
+argument-hint: "What will the next session be used for?"
+disable-model-invocation: true
+---
+
+Write a handoff document summarising the current conversation so a fresh agent can continue the work. Save to the temporary directory of the user's OS - not the current workspace.
+
+Include a "suggested skills" section in the document, which suggests skills that the agent should invoke.
+
+Do not duplicate content already captured in other artifacts (PRDs, plans, ADRs, issues, commits, diffs). Reference them by path or URL instead.
+
+Redact any sensitive information, such as API keys, passwords, or personally identifiable information.
+
+If the user passed arguments, treat them as a description of what the next session will focus on and tailor the doc accordingly.

.agents/skills/implement/SKILL.md

@@ -0,0 +1,15 @@
+---
+name: implement
+description: "Implement a piece of work based on a PRD or set of issues."
+disable-model-invocation: true
+---
+
+Implement the work described by the user in the PRD or issues.
+
+Use /tdd where possible, at pre-agreed seams.
+
+Run typechecking regularly, single test files regularly, and the full test suite once at the end.
+
+Once done, use /code-review to review the work.
+
+Commit your work to the current branch.

.agents/skills/research/SKILL.md

@@ -0,0 +1,12 @@
+---
+name: research
+description: Investigate a question against high-trust primary sources and capture the findings as a Markdown file in the repo. Use when the user wants a topic researched, docs or API facts gathered, or reading legwork delegated to a background agent.
+---
+
+Spin up a **background agent** to do the research, so you keep working while it reads.
+
+Its job:
+
+1. Investigate the question against **primary sources** — official docs, source code, specs, first-party APIs — not a secondary write-up of them. Follow every claim back to the source that owns it.
+2. Write the findings to a single Markdown file, citing each claim's source.
+3. Save it where the repo already keeps such notes; match the existing convention, and if there is none, put it somewhere sensible and say where.

.agents/skills/tdd/SKILL.md

@@ -0,0 +1,36 @@
+---
+name: tdd
+description: Test-driven development. Use when the user wants to build features or fix bugs test-first, mentions "red-green-refactor", or wants integration tests.
+---
+
+# Test-Driven Development
+
+TDD is the red → green loop. This skill is the reference that makes that loop produce tests worth keeping: what a good test is, where tests go, the anti-patterns, and the rules of the loop. Every section applies on every cycle — consult them before and during the loop, not after.
+
+When exploring the codebase, read `CONTEXT.md` (if it exists) so test names and interface vocabulary match the project's domain language, and respect ADRs in the area you're touching.
+
+## What a good test is
+
+Tests verify behavior through public interfaces, not implementation details. Code can change entirely; tests shouldn't. A good test reads like a specification — "user can checkout with valid cart" tells you exactly what capability exists — and survives refactors because it doesn't care about internal structure.
+
+See [tests.md](tests.md) for examples and [mocking.md](mocking.md) for mocking guidelines.
+
+## Seams — where tests go
+
+A **seam** is the public boundary you test at: the interface where you observe behavior without reaching inside. Tests live at seams, never against internals.
+
+**Test only at pre-agreed seams.** Before writing any test, write down the seams under test and confirm them with the user. No test is written at an unconfirmed seam. You can't test everything — agreeing the seams up front is how testing effort lands on the critical paths and complex logic instead of every edge case.
+
+Ask: "What's the public interface, and which seams should we test?"
+
+## Anti-patterns
+
+- **Implementation-coupled** — mocks internal collaborators, tests private methods, or verifies through a side channel (querying the database instead of using the interface). The tell: the test breaks when you refactor but behavior hasn't changed.
+- **Tautological** — the assertion recomputes the expected value the way the code does (`expect(add(a, b)).toBe(a + b)`, a snapshot derived by hand the same way, a constant asserted equal to itself), so it passes by construction and can never disagree with the code. Expected values must come from an independent source of truth — a known-good literal, a worked example, the spec.
+- **Horizontal slicing** — writing all tests first, then all implementation. Bulk tests verify _imagined_ behavior: you test the _shape_ of things rather than user-facing behavior, the tests go insensitive to real changes, and you commit to test structure before understanding the implementation. Work in **vertical slices** instead — one test → one implementation → repeat, each test a **tracer bullet** that responds to what the last cycle taught you.
+
+## Rules of the loop
+
+- **Red before green.** Write the failing test first, then only enough code to pass it. Don't anticipate future tests or add speculative features.
+- **One slice at a time.** One seam, one test, one minimal implementation per cycle.
+- **Refactoring is not part of the loop.** It belongs to the review stage (see the `code-review` skill), not the red → green implementation cycle.

.agents/skills/tdd/mocking.md

@@ -0,0 +1,59 @@
+# When to Mock
+
+Mock at **system boundaries** only:
+
+- External APIs (payment, email, etc.)
+- Databases (sometimes - prefer test DB)
+- Time/randomness
+- File system (sometimes)
+
+Don't mock:
+
+- Your own classes/modules
+- Internal collaborators
+- Anything you control
+
+## Designing for Mockability
+
+At system boundaries, design interfaces that are easy to mock:
+
+**1. Use dependency injection**
+
+Pass external dependencies in rather than creating them internally:
+
+```typescript
+// Easy to mock
+function processPayment(order, paymentClient) {
+  return paymentClient.charge(order.total);
+}
+
+// Hard to mock
+function processPayment(order) {
+  const client = new StripeClient(process.env.STRIPE_KEY);
+  return client.charge(order.total);
+}
+```
+
+**2. Prefer SDK-style interfaces over generic fetchers**
+
+Create specific functions for each external operation instead of one generic function with conditional logic:
+
+```typescript
+// GOOD: Each function is independently mockable
+const api = {
+  getUser: (id) => fetch(`/users/${id}`),
+  getOrders: (userId) => fetch(`/users/${userId}/orders`),
+  createOrder: (data) => fetch('/orders', { method: 'POST', body: data }),
+};
+
+// BAD: Mocking requires conditional logic inside the mock
+const api = {
+  fetch: (endpoint, options) => fetch(endpoint, options),
+};
+```
+
+The SDK approach means:
+- Each mock returns one specific shape
+- No conditional logic in test setup
+- Easier to see which endpoints a test exercises
+- Type safety per endpoint

.agents/skills/tdd/tests.md

@@ -0,0 +1,77 @@
+# Good and Bad Tests
+
+## Good Tests
+
+**Integration-style**: Test through real interfaces, not mocks of internal parts.
+
+```typescript
+// GOOD: Tests observable behavior
+test("user can checkout with valid cart", async () => {
+  const cart = createCart();
+  cart.add(product);
+  const result = await checkout(cart, paymentMethod);
+  expect(result.status).toBe("confirmed");
+});
+```
+
+Characteristics:
+
+- Tests behavior users/callers care about
+- Uses public API only
+- Survives internal refactors
+- Describes WHAT, not HOW
+- One logical assertion per test
+
+## Bad Tests
+
+**Implementation-detail tests**: Coupled to internal structure.
+
+```typescript
+// BAD: Tests implementation details
+test("checkout calls paymentService.process", async () => {
+  const mockPayment = jest.mock(paymentService);
+  await checkout(cart, payment);
+  expect(mockPayment.process).toHaveBeenCalledWith(cart.total);
+});
+```
+
+Red flags:
+
+- Mocking internal collaborators
+- Testing private methods
+- Asserting on call counts/order
+- Test breaks when refactoring without behavior change
+- Test name describes HOW not WHAT
+- Verifying through external means instead of interface
+
+```typescript
+// BAD: Bypasses interface to verify
+test("createUser saves to database", async () => {
+  await createUser({ name: "Alice" });
+  const row = await db.query("SELECT * FROM users WHERE name = ?", ["Alice"]);
+  expect(row).toBeDefined();
+});
+
+// GOOD: Verifies through interface
+test("createUser makes user retrievable", async () => {
+  const user = await createUser({ name: "Alice" });
+  const retrieved = await getUser(user.id);
+  expect(retrieved.name).toBe("Alice");
+});
+```
+
+**Tautological tests**: Expected value restates the implementation, so the test passes by construction.
+
+```typescript
+// BAD: Expected value is recomputed the way the code computes it
+test("calculateTotal sums line items", () => {
+  const items = [{ price: 10 }, { price: 5 }];
+  const expected = items.reduce((sum, i) => sum + i.price, 0);
+  expect(calculateTotal(items)).toBe(expected);
+});
+
+// GOOD: Expected value is an independent, known literal
+test("calculateTotal sums line items", () => {
+  expect(calculateTotal([{ price: 10 }, { price: 5 }])).toBe(15);
+});
+```

.claude

@@ -0,0 +1 @@
+.agents

.gitea/workflows/build-binaries.yml

@@ -1,25 +1,22 @@
-# Cross-platform Crucible binaries (D7 trigger standard):
-#   PR / push main -> cross-build ALL targets to prove they compile (no publish)
-#   tag v*         -> build all targets + SHA256SUMS, upload to the Gitea release
+# Cross-platform Crucible release binaries: a v* tag builds all targets,
+# then uploads them, SHA256SUMS, and the canonical wrappers to its Gitea release.
 # Crucible is pure Go (CGO_ENABLED=0), so cross-compiling is a fast loop.
 name: build-binaries
 
 on:
-  pull_request:
   push:
-    branches: [main]
     tags: ['v*']
-    paths-ignore:
-      - "docs/**"
-      - "README.md"
-      - "AGENTS.md"
-      - "LICENSE"
+
+permissions:
+  code: read
+  releases: write
 
 jobs:
   build-binaries:
     runs-on: nix-docker
+    timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with: { fetch-depth: 0 }
 
       - name: Cross-build all targets
@@ -45,9 +42,8 @@ jobs:
           '
 
       - name: Upload to Gitea release
-        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
         env:
-          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
           TAG: ${{ github.ref_name }}
           REPO: ${{ github.repository }}
           SERVER: ${{ github.server_url }}
@@ -69,3 +65,17 @@ jobs:
                 "${api}/releases/${id}/assets?name=$(basename "$f")"
             done
           '
+
+      # Gitea has no asset retention (#52): without this every tag keeps its
+      # ~57 MB binary set forever. Best-effort — a stale asset is cheaper than
+      # a blocked publish, so a failure here never fails the release.
+      - name: Prune assets of older releases
+        continue-on-error: true
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+          REPO: ${{ github.repository }}
+          SERVER: ${{ github.server_url }}
+        run: |
+          nix develop --command bash -c '
+            API="${SERVER}/api/v1/repos/${REPO}" scripts/prune-release-assets.sh
+          '

.gitea/workflows/build-image.yml

@@ -1,52 +0,0 @@
-# Publish the immutable crucible:<sha> image on version tags.
-# PR/main test builds live in test-image.yml and never publish, so registry
-# packages are only generated for releases we intend to use (not on every merge).
-#
-# Daemonless: the host-mode runner has no container runtime, so the image is
-# built by Nix (`nix build .#image`, see flake.nix) and pushed with skopeo
-# straight from the OCI tarball. No `docker build`/`docker login` involved.
-name: build-image
-
-on:
-  push:
-    tags: ['v*']
-
-env:
-  REGISTRY: registry.westgate.pw
-  IMAGE: deployment/crucible
-
-jobs:
-  publish:
-    runs-on: nix-docker
-    steps:
-      - uses: actions/checkout@v4
-        with: { fetch-depth: 0 }
-
-      - name: Resolve tag
-        id: tag
-        run: echo "sha=$(git rev-parse --short=12 HEAD)" >> "$GITHUB_OUTPUT"
-
-      - name: Build OCI image (daemonless)
-        run: nix build .#image
-
-      # This workflow only runs on v* tags, so every run is a release publish.
-      - name: Publish image
-        env:
-          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
-          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
-        run: |
-          nix shell nixpkgs#skopeo -c skopeo copy \
-            --dest-creds "${REGISTRY_USER}:${REGISTRY_PASSWORD}" \
-            docker-archive:result \
-            "docker://${REGISTRY}/${IMAGE}:${{ steps.tag.outputs.sha }}"
-
-      - name: Emit release fragment
-        run: |
-          FRAG_REPO=sow-tools \
-          FRAG_SHA=${{ steps.tag.outputs.sha }} \
-          FRAG_ARTIFACT="${REGISTRY}/${IMAGE}:${{ steps.tag.outputs.sha }}" \
-          FRAG_URL="${REGISTRY}/${IMAGE}" \
-          FRAG_RUN_ID=${{ gitea.run_id }} \
-          bash scripts/emit-release-fragment.sh
-      - uses: actions/upload-artifact@v3
-        with: { name: release-fragment, path: release-fragment.json }

.gitea/workflows/ci.yml

@@ -0,0 +1,47 @@
+# Pull-request validation for Crucible. Releases and wrapper synchronization
+# have their own narrow workflows because they need tag/main events.
+name: ci
+
+on:
+  pull_request:
+
+permissions: read-all
+
+jobs:
+  ci:
+    runs-on: nix-docker
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+
+      - name: vet + test + lint
+        run: |
+          nix develop --command bash -c '
+            set -euo pipefail
+            go vet ./...
+            go test ./...
+            shellcheck scripts/*.sh
+            yamllint .gitea
+          '
+
+      - name: binary smoke (fail-closed contract)
+        run: nix develop --command make smoke
+
+      - name: Cross-build all targets
+        run: |
+          nix develop --command bash -c '
+            set -euo pipefail
+            sha="$(git rev-parse --short=12 HEAD)"
+            ldflags="-s -w -X git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/buildinfo.Version=${sha}"
+            rm -rf dist && mkdir -p dist
+            export CGO_ENABLED=0
+            for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64 windows/amd64 windows/arm64; do
+              os="${target%/*}"; arch="${target#*/}"
+              ext=""; [ "$os" = windows ] && ext=".exe"
+              echo "building crucible-${os}-${arch}${ext}"
+              GOOS="$os" GOARCH="$arch" go build -trimpath -ldflags "$ldflags" \
+                -o "dist/crucible-${os}-${arch}${ext}" ./cmd/crucible
+            done
+          '

.gitea/workflows/publish-image.yml

@@ -1,49 +0,0 @@
-# Manual compatibility publisher for the Crucible image.
-# Normal release publishing happens in build-image.yml on v* tags; this is the
-# break-glass / re-publish path, triggered by hand.
-#
-# Daemonless: built by Nix (`nix build .#image`) and pushed with skopeo from the
-# OCI tarball. No `docker build`/`docker login` involved.
-name: publish-image
-
-on:
-  workflow_dispatch:
-
-env:
-  REGISTRY: registry.westgate.pw
-  IMAGE: deployment/crucible
-
-jobs:
-  publish:
-    runs-on: nix-docker
-    steps:
-      - uses: actions/checkout@v4
-        with: { fetch-depth: 0 }
-
-      - name: Resolve tag
-        id: tag
-        run: echo "sha=$(git rev-parse --short=12 HEAD)" >> "$GITHUB_OUTPUT"
-
-      - name: Build OCI image (daemonless)
-        run: nix build .#image
-
-      - name: Publish image
-        env:
-          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
-          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
-        run: |
-          nix shell nixpkgs#skopeo -c skopeo copy \
-            --dest-creds "${REGISTRY_USER}:${REGISTRY_PASSWORD}" \
-            docker-archive:result \
-            "docker://${REGISTRY}/${IMAGE}:${{ steps.tag.outputs.sha }}"
-
-      - name: Emit release fragment
-        run: |
-          FRAG_REPO=sow-tools \
-          FRAG_SHA=${{ steps.tag.outputs.sha }} \
-          FRAG_ARTIFACT="${REGISTRY}/${IMAGE}:${{ steps.tag.outputs.sha }}" \
-          FRAG_URL="${REGISTRY}/${IMAGE}" \
-          FRAG_RUN_ID=${{ gitea.run_id }} \
-          bash scripts/emit-release-fragment.sh
-      - uses: actions/upload-artifact@v3
-        with: { name: release-fragment, path: release-fragment.json }

.gitea/workflows/sync-wrappers.yml

@@ -14,11 +14,14 @@ on:
       - 'wrappers/crucible.sh'
       - 'wrappers/crucible.ps1'
 
+permissions: read-all
+
 jobs:
   sync:
     runs-on: nix-docker
+    timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Open sync PRs to consumers
         env:

.gitea/workflows/test-image.yml

@@ -1,19 +0,0 @@
-# Test-build the Crucible image on PRs. Proves `nix build .#image` still works
-# (daemonless, Nix-built OCI tarball) but does NOT publish — release publishing
-# happens in build-image.yml on v* tags. PR-only: with up-to-date-before-merge
-# protection, main == the tested PR head, so a throwaway post-merge rebuild that
-# publishes nothing is pure waste.
-name: test-image
-
-on:
-  pull_request:
-
-jobs:
-  build-image:
-    runs-on: nix-docker
-    steps:
-      - uses: actions/checkout@v4
-        with: { fetch-depth: 0 }
-
-      - name: Build OCI image (daemonless, no publish)
-        run: nix build .#image

.gitea/workflows/test.yml

@@ -1,30 +0,0 @@
-# Lint + unit tests for the Crucible suite. PR-first: PRs + push to main (D7).
-name: test
-
-on:
-  push:
-    branches: [main]
-    paths-ignore:
-      - "docs/**"
-      - "README.md"
-      - "AGENTS.md"
-      - "LICENSE"
-  pull_request:
-
-jobs:
-  test:
-    runs-on: nix-docker
-    steps:
-      - uses: actions/checkout@v4
-        with: { fetch-depth: 0 }
-      - name: vet + test + lint
-        run: |
-          nix develop --command bash -c '
-            set -euo pipefail
-            go vet ./...
-            go test ./...
-            shellcheck scripts/*.sh
-            yamllint .gitea
-          '
-      - name: binary smoke (fail-closed contract)
-        run: nix develop --command make smoke

AGENTS.md

@@ -41,13 +41,14 @@ section and `.gitea/workflows/`.
 - Dev loop: `nix develop`, then `make check` / `make build` / `make smoke`
   (see Commands below).
 - Release: push a `v*` tag. CI uploads cross-built binaries + wrappers to the
-  Gitea release and publishes the `crucible` container image.
+  Gitea release. There is no container image; Crucible ships as binaries,
+  wrappers, and the Nix input.
 - Consumers (they download released binaries via the wrapper; they never
   vendor a toolkit):
   - sow-module — https://git.westgate.pw/ShadowsOverWestgate/sow-module
   - sow-topdata — https://git.westgate.pw/ShadowsOverWestgate/sow-topdata
   - sow-assets-manifest — https://git.westgate.pw/ShadowsOverWestgate/sow-assets-manifest
-  - sow-platform (deploys the released image/pins) —
+  - sow-platform (infra/deploy authority) —
     https://git.westgate.pw/ShadowsOverWestgate/sow-platform
 
 ## What this repo owns / does not own
@@ -62,7 +63,7 @@ is `sow-platform`).
 
 1. **Fail closed, never fake.** A builder with no migrated logic yet (`depot`)
    exits `70`. Do not stub a builder to emit a placeholder artifact.
-2. **Binaries are not committed.** They are CI artifacts / image layers.
+2. **Binaries are not committed.** They are CI artifacts.
    `/bin/`, `*.exe`, `nwn-tool`, `sow-toolkit` are gitignored.
 3. **The registry is the command surface.** `internal/dispatch.Registry` is the
    single source of truth; keep it in sync with `cmd/` and
@@ -81,9 +82,26 @@ is `sow-platform`).
 nix develop && make check   # vet + test + shellcheck + yamllint
 make build                  # cmd/* -> ./bin
 make smoke                  # assert fail-closed contract
-make image                  # crucible:<sha>
 ```
 
 ## Tests
 
 Tests must survive harmless changes to constants, defaults, wording, ordering, fixture data, and internal implementation details. A test that fails merely because a basic value changed is usually a bad test. Only assert exact values when the value is part of a documented public contract, external protocol, compatibility requirement, security rule, migration, or business rule.
+
+## Agent skills
+
+### Issue tracker
+
+Issues live in Gitea at git.westgate.pw (`ShadowsOverWestgate/sow-tools`), managed with the `tea` CLI. Issues follow ownership — file work in the repo that owns it, not the one you happen to be standing in. See `docs/agents/issue-tracker.md`.
+
+### Triage labels
+
+Default label vocabulary (`needs-triage`, `needs-info`, `ready-for-agent`, `ready-for-human`, `wontfix`). See `docs/agents/triage-labels.md`.
+
+### Domain docs
+
+Single-context: `CONTEXT.md` at the repo root plus `docs/adr/`. See `docs/agents/domain.md`.
+
+### Where work lives
+
+Markdown here is **reference, law, or an ADR — nothing else** (`sow-codebase` ADR-0001). Live work -> wayfinder maps + Gitea issues (closeable, assignable, queryable). Settled decisions -> ADR files in `docs/adr/` (immutable, never closed, only superseded). Standing law -> `DOCTRINE.md` / `AGENTS.md` / `CONTEXT.md`. Current-state reference -> docs describing what the code does now. Everything else — plans, specs, concepts, handoffs, trackers — is process: it belongs in a Gitea issue, not a file. Harvest unfinished intent to an issue before deleting a process doc. `sow-docs` is deprecated and read-only.

Makefile

@@ -1,11 +1,13 @@
 SHELL := bash
 .ONESHELL:
-.PHONY: check test vet build smoke fmt image
+.PHONY: check test vet build smoke fmt
 
 # Lint + unit tests. Mirrors the `test` CI job; runs green inside `nix develop`.
 check: vet test
 	shellcheck scripts/*.sh
 	yamllint .gitea
+	bash tests/workflow-contract.sh
+	bash tests/prune-release-assets.sh
 
 vet:
 	go vet ./...
@@ -22,9 +24,3 @@ smoke: build
 
 fmt:
 	gofmt -l -w cmd internal
-
-# Build the Crucible image locally. Requires docker; mirrors build-image CI.
-IMAGE ?= crucible
-GIT_SHA ?= $(shell git rev-parse --short=12 HEAD 2>/dev/null || echo unknown)
-image:
-	docker build --build-arg GIT_SHA=$(GIT_SHA) -f docker/Dockerfile -t $(IMAGE):$(GIT_SHA) .

README.md

@@ -19,6 +19,7 @@ Crucible is how the artifact repos turn source into artifacts.
 | `crucible-depot`   | `crucible depot`   | content-addressed depot blob verify/move        |
 | `crucible-hak`     | `crucible hak`     | ERF/HAK pack/unpack + hak manifests             |
 | `crucible-module`  | `crucible module`  | build/extract/validate/compare the `.mod`       |
+| `crucible-nwsync`  | `crucible nwsync`  | NWSync blob emit + manifest assemble + verify   |
 | `crucible-topdata` | `crucible topdata` | compile 2da/tlk topdata + packages              |
 | `crucible-wiki`    | `crucible wiki`    | render + deploy mechanical wiki pages           |
 
@@ -71,25 +72,23 @@ nix develop            # Go + shellcheck + yamllint + make
 make check             # go vet + go test + shellcheck + yamllint
 make build             # build every cmd/* into ./bin (gitignored)
 make smoke             # build + assert the fail-closed contract
-make image             # docker build -> crucible:<sha>
 ```
 
-Binaries are **never committed** — they are CI artifacts / image layers (D19).
+Binaries are **never committed** — they are CI artifacts (D19).
 This retires the old habit of checking in `nwn-tool` / `sow-toolkit`.
 
 ## CI
 
-PR-first (D7): checks run on pull requests and on push to `main`; the only
-publish event is a `v*` tag (see `runbooks/ci-trigger-standard.md` in sow-docs,
+PR-first (D7): checks run once on pull requests; the only publish event is a
+`v*` tag (see `runbooks/ci-trigger-standard.md` in sow-docs,
 https://git.westgate.pw/ShadowsOverWestgate/sow-docs).
 
-- `test.yml` — vet, test, shellcheck, yamllint, binary smoke (PR + main).
-- `test-image.yml` — build the OCI image to prove it compiles (PR + main, no push).
-- `build-binaries.yml` — cross-build all targets (PR + main); on a `v*` tag, upload
-  the binaries, `SHA256SUMS`, and the wrappers to the Gitea release.
-- `build-image.yml` — on a `v*` tag, build and publish
-  `registry.westgate.pw/deployment/crucible:<sha>`.
-- `publish-image.yml` — manual `workflow_dispatch` break-glass republish.
+- `ci.yml` — vet, test, shellcheck, yamllint, binary smoke, and cross-build all
+  targets once per pull request.
+- `build-binaries.yml` — on a `v*` tag, cross-build and upload the binaries,
+  `SHA256SUMS`, and the wrappers to the Gitea release, then delete the assets
+  of every release except the newest two — Gitea keeps them forever otherwise,
+  and every binary is reproducible from its tag.
 - `sync-wrappers.yml` — on a `main` push that touches `wrappers/`, auto-PR the
   canonical wrappers to the consumer repos in `wrappers/consumers.txt`.
   Consumer drift checks run after those PRs merge to `main`, not on the PRs

cmd/crucible-assets/main.go

@@ -0,0 +1,11 @@
+// Command crucible-assets is the standalone assets builder (equivalent to
+// `crucible assets`). A single-token binary keeps consumer wrapper scripts simple.
+package main
+
+import (
+	"os"
+
+	"git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/dispatch"
+)
+
+func main() { os.Exit(dispatch.RunBuilder("assets", os.Args[1:])) }

cmd/crucible-nwsync/main.go

@@ -0,0 +1,11 @@
+// Command crucible-nwsync is the standalone nwsync builder (equivalent to
+// `crucible nwsync`). A single-token binary keeps consumer wrapper scripts simple.
+package main
+
+import (
+	"os"
+
+	"git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/dispatch"
+)
+
+func main() { os.Exit(dispatch.RunBuilder("nwsync", os.Args[1:])) }

docker/Dockerfile

@@ -1,38 +0,0 @@
-# syntax=docker/dockerfile:1
-#
-# Crucible toolchain image: registry.westgate.pw/deployment/crucible:<git-sha>
-#
-# Reproducible multi-stage build, no on-VPS build. Produces every cmd/* binary
-# and ships them on a static base. The `crucible` dispatcher is the entrypoint;
-# consumer CI can also call the standalone crucible-<name> binaries by path.
-#
-FROM golang:1.26-alpine AS build
-WORKDIR /src
-RUN apk add --no-cache git
-# go.sum is committed now that the migrated packages pull golang.org/x/text and
-# gopkg.in/yaml.v3; the glob keeps the build working if it is ever absent.
-COPY go.mod go.sum* ./
-RUN go mod download
-COPY . .
-ARG GIT_SHA=unknown
-ENV CGO_ENABLED=0
-RUN set -eux; \
-    mkdir -p /out; \
-    for dir in ./cmd/*/; do \
-      name="$(basename "${dir}")"; \
-      go build -trimpath \
-        -ldflags "-s -w -X git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/buildinfo.Version=${GIT_SHA}" \
-        -o "/out/${name}" "${dir}"; \
-    done
-
-FROM debian:12-slim
-# ca-certificates: builders fetch published manifests over HTTPS.
-RUN set -eux; \
-    apt-get update; \
-    apt-get install -y --no-install-recommends ca-certificates; \
-    rm -rf /var/lib/apt/lists/*; \
-    useradd --system --create-home --uid 65532 nonroot
-COPY --from=build /out/ /usr/local/bin/
-USER nonroot
-ENTRYPOINT ["/usr/local/bin/crucible"]
-CMD ["help"]

docs/adr/0001-markdown-is-reference-or-law-only.md

@@ -0,0 +1,55 @@
+# ADR-0001: Markdown in this repo is reference, law, or an ADR — nothing else
+
+- **Status:** Accepted
+- **Date:** 2026-07-24
+- **Origin:** Adopted workspace-wide from `sow-codebase` ADR-0001, which records
+  the full context (a `docs/` tree that had grown to 434 files, ~27MB, most of
+  it dead process artifacts). This repo adopts the same law so the rule is
+  local, not a cross-repo reference.
+
+## Context
+
+Markdown that *claims to describe current state or a plan* rots, because
+reality diverges and nobody edits the file. Markdown that claims neither — a
+dated, immutable decision record, or a standing rule — does not rot.
+
+Two different things get conflated:
+
+- **Rationale** — why a system is shaped the way it is. Worth keeping.
+- **Process artifacts** — plans, specs, concepts, handoffs, trackers. A record
+  of how work happened, not what is true now.
+
+Left unchecked, every completed effort leaves its planning behind and the repo
+accumulates a "historical" pile that agents and humans must route around to
+find the few live docs.
+
+## Decision
+
+Markdown may exist in this repo only as one of three genres:
+
+1. **Current-state reference** — describes what the code does now, kept honest
+   by code review touching it.
+2. **Standing law** — `DOCTRINE.md`, root and folder-scoped `AGENTS.md`,
+   `CONTEXT.md`. States rules and vocabulary, not plans.
+3. **Immutable decision record** — ADRs under `docs/adr/`. Append-only; never
+   edited, only superseded by a later ADR that points back.
+
+Anything else — implementation plans, design specs, concepts, handoffs,
+progress trackers, scratch — is **process** and does not live in the repo. It
+lives in Gitea issues and wayfinder maps, where it can be assigned, closed, and
+superseded. Small tasks need no written plan at all.
+
+Deleting a process document is not destroying history: `git log -- <path>`
+recovers it. The exception is *unfinished intent* (a design never built, an
+open question still wanted) — that is live, not history, and must be harvested
+to a Gitea ticket before its file is deleted. A citation from a living doc or
+from code must be resolved before the cited file is deleted.
+
+## Consequences
+
+- The documentation map lists only current truth; there is no "historical" pile
+  to route around.
+- No agent, under any plugin or skill, writes process-markdown into the repo.
+  The rule is plugin-agnostic on purpose — it binds the agent, not a named tool.
+- History of deleted process docs is in git; unfinished intent is in the issue
+  tracker; rationale is in ADRs and law. Each thing has exactly one home.

docs/adr/0002-sow-tools-becomes-the-crucible-suite.md

@@ -0,0 +1,12 @@
+# ADR-0002: `sow-tools` becomes the Crucible suite
+
+- **Status:** Accepted
+- **Date:** 2026-06-11
+- **Migrated from:** `sow-docs` `07-decisions-log.md` entry **D11**, on the
+  retirement of `sow-docs`. Content is the original decision, unchanged.
+
+- **Decision:** Rename the future toolchain surface to Crucible: one Go module,
+  multiple `cmd/` binaries, plus a dispatcher so wrapper commands can stay
+  stable.
+- **Rationale:** Depot, HAK, module, topdata, and wiki tooling share internals
+  but have different command surfaces. One module avoids premature repo splits.

docs/adr/0003-crucible-binary-contract-standalone-shims-fail-closed-scaffold.md

@@ -0,0 +1,29 @@
+# ADR-0003: Crucible binary contract: standalone shims, fail-closed scaffold, no committed binaries
+
+- **Status:** Accepted
+- **Date:** 2026-06-11
+- **Migrated from:** `sow-docs` `07-decisions-log.md` entry **D19**, on the
+  retirement of `sow-docs`. Content is the original decision, unchanged.
+
+- **Decision:** Phase 5 builds `migration/sow-tools` (Crucible, D11) as a
+  multi-binary Go scaffold:
+  - One `crucible` dispatcher plus standalone `crucible-{depot,hak,module,topdata,wiki}`
+    binaries sharing one registry (`internal/dispatch`). The dispatcher is for
+    humans/CI; the **standalone shims are canonical for consumers** so wrapper
+    scripts resolve a single-token command and `"$builder" args` quoting stays
+    correct.
+  - Consumer resolution order: explicit env override
+    (`$SOW_MODULE_BUILD`/`$SOW_TOPDATA_BUILD`/`$CRUCIBLE`) → `crucible-<name>` →
+    legacy `sow-<name>-build`. CI runs inside the pinned `crucible:<sha>` image.
+  - Every builder is **unwired** in the scaffold and fails closed (exit 70);
+    it never fakes an artifact. The `internal/` logic is migrated from
+    `gitea/sow-tools` by the operator at cutover (hard rule: no source
+    transplant by tooling).
+  - **Binaries are never committed** — they are CI artifacts / image layers.
+    Retires the committed `nwn-tool` / `tools/sow-toolkit`.
+  - Builders take `NWN_ROOT` only via explicit env/flag; no `$HOME` defaulting.
+- **Rationale:** Locks the command surface, container, and CI shape so migrated
+  logic drops into a stable frame; aligns the three artifact repos onto one
+  Crucible contract while keeping back-compat with the pre-D11 skeletons.
+- **Image name:** `registry.westgate.pw/deployment/crucible:<git-sha>` (the bare
+  `crucible:<sha>` is the local/dev tag).

docs/adr/0004-nix-built-oci-images-start-server-side-with.md

@@ -0,0 +1,24 @@
+# ADR-0004: Nix-built OCI images start server-side with Crucible; local Anvil images deferred
+
+- **Status:** Accepted
+- **Date:** 2026-06-12
+- **Migrated from:** `sow-docs` `07-decisions-log.md` entry **D29**, on the
+  retirement of `sow-docs`. Content is the original decision, unchanged.
+
+- **Decision:** Introduce Nix-built OCI images as an artifact-production option,
+  starting with `sow-tools`/Crucible in server-side CI. `sow-tools` will grow a
+  Nix-built `crucible` package plus `crucible-image`; PR CI builds/smokes it and
+  `main` publishes the normal pinned OCI image
+  `registry.westgate.pw/deployment/crucible:<sha>`. `docker/Dockerfile` stays during
+  parity and as the client-compatible fallback.
+- **Local rule:** Nix users may get optional wrappers that provide tools and
+  call the existing Dockerfiles for local Anvil/NWServer testing. A true
+  `nix build .#nwserver-test-image` is explicitly deferred until real
+  `sow-codebase/src` exists and the Dockerfile image is proven.
+- **Rationale:** Server-side image build shape is harder to change once deploy
+  promotion and registry gates are active, so prove Nix image builds before
+  cutover. Crucible is the lowest-risk pilot because it is a Go toolchain image;
+  NodeBB and Anvil/NWServer depend more heavily on upstream container filesystem
+  semantics.
+- **Non-goals:** no source builds in `sow-platform`; no `nix-sidecar` or
+  Kubernetes-style runtime cache layer; no removal of client Dockerfiles.

docs/agents/domain.md

@@ -0,0 +1,51 @@
+# Domain Docs
+
+How the engineering skills should consume this repo's domain documentation when exploring the codebase.
+
+## Before exploring, read these
+
+- **`CONTEXT.md`** at the repo root, or
+- **`CONTEXT-MAP.md`** at the repo root if it exists — it points at one `CONTEXT.md` per context. Read each one relevant to the topic.
+- **`docs/adr/`** — read ADRs that touch the area you're about to work in. In multi-context repos, also check `src/<context>/docs/adr/` for context-scoped decisions.
+
+If any of these files don't exist, **proceed silently**. Don't flag their absence; don't suggest creating them upfront. The `/domain-modeling` skill (reached via `/grill-with-docs` and `/improve-codebase-architecture`) creates them lazily when terms or decisions actually get resolved.
+
+## File structure
+
+Single-context repo (most repos):
+
+```
+/
+├── CONTEXT.md
+├── docs/adr/
+│   ├── 0001-event-sourced-orders.md
+│   └── 0002-postgres-for-write-model.md
+└── src/
+```
+
+Multi-context repo (presence of `CONTEXT-MAP.md` at the root):
+
+```
+/
+├── CONTEXT-MAP.md
+├── docs/adr/                          ← system-wide decisions
+└── src/
+    ├── ordering/
+    │   ├── CONTEXT.md
+    │   └── docs/adr/                  ← context-specific decisions
+    └── billing/
+        ├── CONTEXT.md
+        └── docs/adr/
+```
+
+## Use the glossary's vocabulary
+
+When your output names a domain concept (in an issue title, a refactor proposal, a hypothesis, a test name), use the term as defined in `CONTEXT.md`. Don't drift to synonyms the glossary explicitly avoids.
+
+If the concept you need isn't in the glossary yet, that's a signal — either you're inventing language the project doesn't use (reconsider) or there's a real gap (note it for `/domain-modeling`).
+
+## Flag ADR conflicts
+
+If your output contradicts an existing ADR, surface it explicitly rather than silently overriding:
+
+> _Contradicts ADR-0007 (event-sourced orders) — but worth reopening because…_

docs/agents/issue-tracker.md

@@ -0,0 +1,88 @@
+# Issue tracker: Gitea (via tea)
+
+Issues for this repo live in Gitea at `git.westgate.pw`, repo
+`ShadowsOverWestgate/sow-tools`. Use the `tea` CLI for all operations —
+`gh` does not work here. For anything `tea` lacks a subcommand for, use
+`tea api <endpoint>` (Gitea's API mirrors GitHub's closely).
+
+Authenticate with your own `tea` login (`tea login add`); never commit tokens
+or tea config into this repo. Note Gitea blocks self-review, so approving a PR
+needs a different account than the one that opened it.
+
+## Where work lives
+
+Markdown in this repo is **reference, law, or an ADR — nothing else**
+(`sow-codebase` ADR-0001). Four homes, no overlap:
+
+- **Live work** → wayfinder maps + Gitea issues. Closeable, assignable,
+  queryable. Never a markdown file.
+- **Settled decisions** → ADR files in `docs/adr/`. Immutable, findable, never
+  closed, never edited — only superseded by a later ADR pointing back. When an
+  issue ends in a durable decision, write the ADR, then close the issue
+  pointing at it. Decisions spanning repos go to `sow-platform/docs/adr/`.
+- **Standing law** → `DOCTRINE.md`, `AGENTS.md`, `CONTEXT.md`. Rules that are
+  always true and vocabulary everyone shares — not the record of one decision.
+- **Current-state reference** → docs describing what the code does now, kept
+  honest by review touching them.
+
+Anything else — implementation plans, design specs, concepts, handoffs,
+progress trackers, scratch — is **process**. It does not live in this repo. It
+lives in a Gitea issue or a wayfinder map, where it can be assigned, closed,
+and superseded. Small tasks need no written plan at all.
+
+Deleting a process doc is not destroying history — `git log -- <path>` recovers
+it. But *unfinished intent* (a design never built, an open question still
+wanted) is live, not history: harvest it to a Gitea issue before deleting.
+
+`sow-docs` is deprecated and read-only. Never add to it, never send work there.
+
+## Which repo gets the issue
+
+Issues follow ownership. File the issue in the repo that **owns the work** —
+see the Repo/Owns/Produces table in the workspace root `AGENTS.md`. Standing
+in one repo is not a reason to file there.
+
+If work spans repos, file it in the repo that owns the *outcome* and reference
+the others from it. A wrong-repo issue is a routing bug, not a filing
+preference — move it.
+
+## Conventions
+
+- **Create an issue**: `tea issues create --title "..." --description "..."`
+- **Read an issue**: `tea issues <number>` and
+  `tea api repos/ShadowsOverWestgate/sow-tools/issues/<number>/comments` for comments.
+- **List issues**: `tea issues list --state open` (add `--labels ...` to filter).
+- **Comment**: `tea comment <number> "..." </dev/null`
+  Always redirect stdin. `tea` reads stdin to EOF and appends it to the body,
+  so any non-interactive shell (every agent) hangs forever without
+  `</dev/null`. Same trap on `tea issues create --description` and
+  `tea pr create`.
+- **Apply / remove labels**: `tea api --method PATCH` on the issue, or
+  `tea api repos/ShadowsOverWestgate/sow-tools/issues/<number>/labels` endpoints.
+- **Close**: `tea issues close <number>`
+
+`tea` infers the repo from the git remote when run inside the clone.
+Gitea shares one number space across issues and PRs.
+
+## Pull requests as a triage surface
+
+**PRs as a request surface: no.**
+
+## When a skill says "publish to the issue tracker"
+
+Create a Gitea issue with `tea issues create`.
+
+## When a skill says "fetch the relevant ticket"
+
+Run `tea issues <number>` plus the comments API call above.
+
+## Wayfinding operations
+
+Used by `/wayfinder`. The **map** is a single issue with **child** issues as tickets.
+
+- **Map**: a single issue labelled `wayfinder:map`, holding the Notes / Decisions-so-far / Fog body. `tea issues create --title "..." --description "..." --labels wayfinder:map`.
+- **Child ticket**: this Gitea instance (v1.27) has no native sub-issue hierarchy, so a child issue carries `Part of #<map>` at the top of its description, and is also added to a task list in the map body. Labels: `wayfinder:<type>` (`research`/`prototype`/`grilling`/`task`). Once claimed, the ticket is assigned to the driving dev.
+- **Blocking**: Gitea's **native dependencies API** — the canonical, UI-visible representation (shows as "Depends on" / "Blocks" on the issue page). Add an edge with `tea api -X POST repos/ShadowsOverWestgate/sow-tools/issues/<child>/dependencies -f owner=ShadowsOverWestgate -f repo=sow-tools -F index=<blocker>`, where `<blocker>` is the blocker's issue **index** (its `#number` — Gitea's dependency API takes the index directly, unlike GitHub's numeric database id). Check status with `tea api repos/ShadowsOverWestgate/sow-tools/issues/<child>/dependencies` (GET) — a ticket is unblocked when every returned issue's `state` is `closed`.
+- **Frontier query**: list the map's open children (`tea issues list --state open`, keep the ones whose description contains `Part of #<map>`), drop any with an open dependency (per the GET above) or an assignee; first in map order wins.
+- **Claim**: `tea issues edit <n> --add-assignees <username>` — the session's first write.
+- **Resolve**: `tea comment <n> "<answer>" </dev/null`, then `tea issues close <n>`, then append a context pointer (gist + link) to the map's Decisions-so-far.

docs/agents/triage-labels.md

@@ -0,0 +1,15 @@
+# Triage Labels
+
+The skills speak in terms of five canonical triage roles. This file maps those roles to the actual label strings used in this repo's issue tracker (Gitea — see `issue-tracker.md` for how to apply labels with `tea`).
+
+| Label in mattpocock/skills | Label in our tracker | Meaning                                  |
+| -------------------------- | -------------------- | ---------------------------------------- |
+| `needs-triage`             | `needs-triage`       | Maintainer needs to evaluate this issue  |
+| `needs-info`               | `needs-info`         | Waiting on reporter for more information |
+| `ready-for-agent`          | `ready-for-agent`    | Fully specified, ready for an AFK agent  |
+| `ready-for-human`          | `ready-for-human`    | Requires human implementation            |
+| `wontfix`                  | `wontfix`            | Will not be actioned                     |
+
+When a skill mentions a role (e.g. "apply the AFK-ready triage label"), use the corresponding label string from this table.
+
+Edit the right-hand column to match whatever vocabulary you actually use.

docs/command-surface.md

@@ -22,9 +22,138 @@ aliases.
 | `topdata` | `convert` | Convert between 2DA and native JSON/module formats. |
 | `wiki` | `build` | Render wiki page drafts from compiled topdata. |
 | `wiki` | `deploy` | Deploy generated wiki pages to NodeBB. |
+| `assets` | `compile` | Compile ASCII `.mdl` models to binary in place. |
+| `assets` | `convert` | Convert textures to/from NWN DDS (flips vertically). |
+| `assets` | `upscale` | Upscale textures through an installed backend. |
+| `assets` | `check-mdl` | Report uncompiled ASCII `.mdl` and model-name mismatches. |
+| `assets` | `fix-mdl` | Lowercase `.mdl` names and rewrite model identity to match. |
+| `assets` | `check-dupes` | Report runtime-name (basename) collisions across dirs. |
+| `assets` | `clean-dupes` | Delete clean-tree files whose basename collides with primary. |
+| `depot` | `status` | Report referenced-vs-present drift against a backend. |
+| `depot` | `push` | Upload referenced-but-absent blobs from a local depot. |
+| `depot` | `verify` | Existence sweep plus sampled download re-hash. |
+| `depot` | `get` | Fetch one blob with sha re-verify. |
+| `depot` | `pull` | Incremental verified pull of every referenced blob. |
+| `nwsync` | `emit` | Explode one artifact into NWSync blobs plus its own NSYM manifest. |
+| `nwsync` | `assemble` | Merge per-artifact NSYM manifests into one merged manifest. |
+| `nwsync` | `verify` | Decompress and hash a published manifest's blobs through the pull zone. |
 
-`crucible-depot` remains registered but unwired. It fails closed with exit `70`
-and never emits placeholder artifacts.
+`depot status` and `depot get` pick their backend either with `--out DIR`, a
+depot tree on disk, or with `--target bunny|cdn`, a remote backend. The two
+flags are mutually exclusive.
+
+`nwsync emit` runs where an artifact is born (a `.hak`/`.erf`, or a loose file
+such as the TLK); `nwsync assemble` runs at module release and reads only the
+small per-artifact indexes. Both take **depot keys**: an artifact's index lives
+beside the artifact itself with the extension replaced, so `emit` and
+`assemble` agree on where it is without being told.
+
+```
+nwsync emit     [--as NAME] [--out DIR] [--jobs N] [--verify] <artifact-key> <file>
+nwsync assemble --group-id N [--tlk-key KEY] [--out DIR] <artifact-key>...
+nwsync verify   [--sample N] [--base URL] [--jobs N] <manifest-sha1>
+```
+
+`emit` is latency-bound, not CPU-bound: every blob costs an existence probe
+plus an upload, and a measured backfill spent 26 seconds of CPU across 9.5
+minutes of wall clock. `--jobs N` (default 16) sets how many resources are in
+flight at once. The manifest is byte-identical at any value — the number of
+workers is never observable in the output. Peak memory is `N` times the
+per-resource limit of 15 MB plus its compressed copy, so raising `N` far past
+the default costs real memory for little gain: the transport keeps 16 idle
+connections per host, and past that a worker pays a fresh TLS handshake.
+
+Both verbs upload by default; nothing bulky is ever written to the runner's
+disk. `--out DIR` writes a local repository tree instead, which is the
+conformance path against upstream `nwn_nwsync_write`. The zone comes from
+`NWSYNC_STORAGE_ZONE` and `NWSYNC_STORAGE_PASSWORD`, with the host from
+`BUNNY_STORAGE_HOST` — NWSync data is a separate zone from the asset depot.
+
+`assemble`'s artifact keys are in `Mod_HakList` order, highest priority first: a
+resref in more than one artifact resolves to the earliest one, the way the game
+resolves it. `--tlk-key` has its own slot because the TLK shadows nothing.
+`--group-id` is per channel — 1 is current, 2 is testing, and 0 leaves the field
+out of the sidecar.
+
+`nwsync verify` is the only check on a published blob upstream of a player's
+client. It reads the **pull zone**, not the storage API, and needs no
+credential: what matters is the bytes a client is served, edge behaviour
+included. Every blob is decompressed and hashed, and the zstd frame is asserted
+to declare its content size. Neither half is optional — a `Content-Length` check
+passes a byte-correct-looking object whose contents are short, and a round-trip
+check alone passes a frame the game client cannot decode but Go's decoder can.
+Failures are reported per blob as missing, malformed framing, size mismatch or
+hash mismatch, and the exit code is 1.
+
+A full sweep of the live manifest is roughly 69,000 blobs and 15 GB, so
+`--sample N` exists to make verifying routine; the default is a full sweep.
+`--base URL` (or `NWSYNC_PULL_BASE`) overrides the public host.
+
+`emit --verify` applies the same check where `emit` would otherwise skip. `emit`
+normally reads a blob's presence as proof of its contents, decided by a 1-byte
+range GET, so an object written truncated — or written by an emitter since found
+broken — is skipped by every later run forever and no backfill repairs it. With
+`--verify` the stored copy is read back, unwrapped, hashed against its own name,
+and replaced when it does not match. It costs a full GET per existing blob, so
+it is a repair pass, not the default.
+
+**After a repair, purge the pull zone before believing `verify`.** A repair is
+the one thing that makes a key serve different bytes than it did before, and the
+edge caches these objects for 30 days precisely because that normally cannot
+happen. The two commands therefore look at different copies on purpose: `emit
+--verify` repairs the **origin**, `verify` reads the **edge**, and in between a
+warm PoP still answers with the old bytes while a cold one answers with the new.
+Until the zone is purged `verify`'s verdict is per-PoP and settles nothing — a
+pass is not proof, and a failure is not the repair having failed. The purge is
+one call against the pull zone; it belongs in the repair procedure rather than
+in `emit`, which holds a storage credential and no CDN one (sow-tools#89, and
+the procedure itself is in sow-platform's NWSync runbook).
+
+`emit` uploads blobs first and the index last, so the presence of an index is
+the publication marker: an artifact whose emit died halfway leaves real blobs in
+the zone and no index. Blob names are content hashes, so re-running skips
+whatever already landed, and `assemble` fails closed on an artifact with no
+index rather than publishing a manifest that is missing a hak.
+
+### What an emitted tree looks like
+
+`--out DIR` produces the same tree `emit` would upload, which makes it the way
+to check a zone by hand without touching one:
+
+```
+<artifact-sha>.nsym          binary index
+<artifact-sha>.nsym.json     the same index, readable
+data/sha1/a7/4a/a74aa84a...  one blob per resource, two-level fanout
+```
+
+A blob's name is the SHA-1 of the resource's **original** bytes, but the file on
+disk is not those bytes: each blob is wrapped in NWCompressedBuffer framing, a
+24-byte `NSYC` header followed by a zstd frame. Hashing the file directly will
+not match its name, which is the obvious
+first thing to try and the obvious first thing to be confused by. Strip the
+header first:
+
+```
+tail -c +25 <blob> | zstd -dc | sha1sum   # == the blob's filename
+```
+
+The header carries the uncompressed length as a little-endian `uint32` at offset
+12, so the decompressed size is checkable without decompressing. Compression is
+worth roughly a 4:1
+saving on hak content: a 250 MB hak emitted 2296 blobs totalling 59 MB on disk
+against 249 MB of resources, as recorded in the sidecar's `on_disk_bytes` and
+`total_bytes`.
+
+The zstd frame always declares its `Frame_Content_Size`. The game client sizes
+its output buffer from that field and cannot decode a frame without one, but the
+Go encoder omits it below 256 bytes, so `emit` re-headers those frames into the
+shape reference libzstd emits: `Single_Segment_flag` set, `Window_Descriptor`
+dropped, and a one-byte content size in its place. `zstd -l <frame>` must print a
+decompressed size; a blank column there is the fault, and it is invisible to any
+check that only decompresses, because both `zstd -dc` and Go's decoder stream
+such a frame happily. This is what the sidecar's `emitter_version` counts:
+version 1 omitted the field and no client could sync past such a blob, version 2
+declares it. `assemble` refuses to merge indexes that disagree.
 
 ## Hidden compatibility aliases
 
@@ -42,6 +171,7 @@ but omitted from routine help and the interactive menu:
 | `topdata` | `build-top-package` | `build-top-package` |
 | `topdata` | `compare-topdata` | `compare-topdata` |
 | `topdata` | `convert-topdata` | `convert-topdata` |
+| `depot` | `--target local` | `--out $DEPOT_DIR` on `status`/`get` |
 | `wiki` | `build-wiki` | `build-wiki` |
 | `wiki` | `deploy-wiki` | `deploy-wiki` |
 

docs/consumer-contract.md

@@ -49,10 +49,10 @@ by `flake.lock`. CI runs the _same_ `crucible <build>` as local dev, inside the
 nix devshell (binary-cache fast). No build container, no token, no CI-only
 pre-steps.
 
-The `registry.westgate.pw/deployment/crucible:<sha>` image is **deployment-only**:
-`prod.yml` pins it so tools travel with the runtime host (`nwn.enable`), a
-disabled placeholder until the NWN stack lands. It is **not** a build tool and no
-build/CI job consumes it.
+The `registry.westgate.pw/deployment/crucible:<sha>` image is **retired**
+(2026-07-17): nothing consumed it, `prod.yml` no longer reserves a slot for
+it, and CI no longer builds or publishes it. Binaries, wrappers, and the Nix
+input are the only supported ways to run Crucible.
 
 ## Determinism
 

docs/superpowers/specs/2026-07-12-crucible-assets-builder-design.md

@@ -0,0 +1,343 @@
+# Crucible `assets` builder — design
+
+Date: 2026-07-12
+Status: approved, pre-implementation
+
+## Goal
+
+Fold the NWN:EE asset tools out of two standalone toolkits into Crucible as a
+new self-contained builder, `crucible assets`:
+
+- from the Python toolkit (`nwnee-asset-processing`) — model compile, texture
+  convert, texture upscale. Those scripts are references only; broken as-is and
+  carrying a heavy config/staging/report layer that we drop.
+- from `sow-assets-manifest/scripts/` — the model-name and duplicate-name
+  integrity tools (`check-ascii-mdl.sh`, `fix-mdl-model-names.sh`,
+  `check-duplicate-names.sh`, `clean-duplicate-names.sh`). These are ported into
+  Go and the shell drivers removed; `sow-assets-manifest` calls
+  `./crucible.sh assets …` through its bootstrap wrapper instead.
+
+Seven commands:
+
+- `crucible assets compile` — compile every ASCII `.mdl` in a directory to
+  binary, in place.
+- `crucible assets convert` — convert every texture in a directory to NWN:EE
+  DDS (or back to PNG/TGA), flipping vertically **every time** so a DDS is
+  always upside-down relative to its source.
+- `crucible assets upscale` — upscale every texture in a directory through
+  whatever upscaling backend is installed.
+- `crucible assets check-mdl` — report uncompiled ASCII `.mdl` files and
+  model-name mismatches (read-only).
+- `crucible assets fix-mdl` — lowercase `.mdl` filenames and rewrite ASCII
+  model/root names to match each file's stem.
+- `crucible assets check-dupes` — report runtime-name (basename) collisions
+  across directories.
+- `crucible assets clean-dupes` — delete files from a "clean" tree whose
+  basename collides with anything in a "primary" tree.
+
+## Principles
+
+- **No configuration files. Arguments only.** No `processing/` staging dirs, no
+  discards, no YAML, no reports. Operates in place on the target directory.
+- **Discover, don't configure.** External tools (the NWN engine, ImageMagick, an
+  upscaler) are found on `PATH` and at standard install locations. Each has a
+  single override flag when discovery is not enough.
+- **Fail closed, never fake** (Crucible rule #1). A missing backend is a clear
+  error naming what to install and a non-zero exit — never a placeholder
+  artifact.
+- **Simplify.** Drop the reference tools' padding / power-of-two / `nwn-safe` /
+  explicit-format knobs (convert auto-picks DXT1 vs DXT5) and the small-texture
+  staging (upscale). These can return later if wanted.
+
+## Architecture
+
+A new self-contained builder that follows the existing `depot` pattern exactly
+(delegates straight to its own internal package, bypassing the legacy
+`internal/app` surface):
+
+- `internal/assets/run.go` — `func Run(args []string, stdout, stderr io.Writer,
+  getenv func(string) string) int`. Parses the subcommand
+  (`compile|convert|upscale|check-mdl|fix-mdl|check-dupes|clean-dupes`) and
+  dispatches. Returns a sysexits-style code.
+- `internal/assets/` — one file per command plus small shared helpers
+  (recursion/file-selection, external-command runner, backend discovery).
+- `cmd/crucible-assets/main.go` — one-line shim:
+  `func main() { os.Exit(dispatch.RunBuilder("assets", os.Args[1:])) }`.
+- `internal/dispatch`:
+  - one `Registry` entry for `assets` (`Wired: true`) listing the seven
+    commands with `Usage`/`Options`;
+  - extend the direct-delegate branch that today reads
+    `if b.Name == "depot" && b.Wired` so `assets` also routes to
+    `assets.Run(...)` instead of the legacy `app.Run`.
+- `docs/command-surface.md` — seven visible-command rows.
+- `wrappers/consumers.txt` / wrappers are unchanged (no new consumer; the
+  consumers listed already vendor the wrapper).
+
+### Shared helpers (`internal/assets`)
+
+- `walk(roots, exts)` — collect files under each root (recursive by default)
+  whose extension is in `exts`, case-insensitively. Reject nothing fancy; these
+  are arguments the caller chose.
+- `run(cmd, args...)` — thin `exec.Command` wrapper capturing combined output,
+  returning `(output, error)`. A single indirection point so tests can observe
+  invocations. cwd and env overrides passed as needed.
+- `look(names...)` — return the first name found via `exec.LookPath`, or the
+  first path that exists from a supplied list of candidates. Used by every
+  backend discovery.
+
+### Shared MDL name module (`internal/assets/mdl`)
+
+A pure-Go port of `mdl-name-lib.sh` + `mdl-scan.awk`, no external tools. One
+place three commands share (`compile`'s pre-check, `check-mdl`, `fix-mdl`):
+
+- `IsASCII(path)` — NUL in the first 256 bytes → binary; else the leading
+  keyword must be `#`/`newmodel`/`node`/`setsupermodel`. Mirrors `mdl_is_ascii`.
+- `ExpectedName(path)` — the file stem (sans `.mdl`).
+- `CheckNames(path) []Mismatch` — for an ASCII model, report header-token
+  mismatches (`newmodel`, `setsupermodel`, `beginmodelgeom`, `endmodelgeom`,
+  `donemodel`, `newanim`, `doneanim` — case-insensitive vs the stem) and the
+  geometry **base node** mismatch (the node inside `beginmodelgeom` whose parent
+  is `null`; empty if none). Mirrors `mdl_check_model_name` + `mdl_base_name`.
+- `FixNames(in) (out []byte, changed bool)` — rewrite only the model identity:
+  the header tokens above, plus the base node's declaration / any `parent` /
+  `animroot` pointing at the *old* base name → the expected name. Animation bone
+  names and supermodel animroots are left untouched so inheritance keeps working.
+  Mirrors `mdl_fix_model_name` byte-for-byte in intent.
+
+Detection must stay identical to the awk classifier so behavior does not drift
+while `import.sh` still runs the awk version (see Consumer migration).
+
+## `crucible assets compile <dir>…`
+
+Usage: `crucible assets compile [--nwn <install>] [--non-recursive] <dir>…`
+
+Recursively find ASCII `.mdl` files under each `<dir>` and compile each to a
+binary `.mdl` in place (the compiled result replaces the source).
+
+The NWN:EE engine is the only real ASCII→binary MDL compiler, so this drives it
+exactly as the reference does:
+
+- **Discovery.** User data dir is fixed on Linux at
+  `~/.local/share/Neverwinter Nights` (holds the flat `development/` and
+  `modelcompiler/` folders the engine uses). The `nwmain` binary is found by
+  probing standard install roots, first hit wins:
+  - `~/.local/share/Steam/steamapps/common/Neverwinter Nights/bin/linux-x86/nwmain-linux`
+  - GOG: `~/GOG Games/Neverwinter Nights Enhanced Edition/.../nwmain-linux`
+  - Beamdog install dirs.
+  - `--nwn <install>` overrides (path to the install root or directly to the
+    binary).
+- **Headless.** The engine is a GUI binary. Require `xvfb-run` and wrap the call
+  regardless of the caller's `DISPLAY` so compilation never opens the client
+  UI; fail before invoking the engine when `xvfb-run` is unavailable:
+  `xvfb-run -a --server-args=-screen 0 1024x768x24 nwmain-linux compilemodel <stem>`.
+- **Per model (one at a time — the engine's `development/` and `modelcompiler/`
+  folders are flat and single-slot):**
+  1. Skip if the file is not ASCII (binary/compiled `.mdl`) — reported, not an
+     error.
+  2. Copy source into `development/<name>`.
+  3. Run `nwmain-linux compilemodel <stem>` with cwd = the binary dir.
+  4. Collect the compiled artifact from `modelcompiler/` matched
+     case-insensitively by stem.
+  5. Move it back over the source path, lowercased.
+  6. Clean the temp files created in `development/` and `modelcompiler/`.
+- **Collisions.** A pre-existing `development/<name>` or `modelcompiler/<stem>`
+  aborts that model before any mutation.
+
+Exit: non-zero if any model fails; each failure prints a short excerpt of the
+engine log (`~/.local/share/Neverwinter Nights/logs/nwengineLog.txt`) as
+advisory diagnostics.
+
+Dropped vs reference: internal-name-mismatch pre-checks and the
+`Model Names Differ` fail rule are kept (cheap, prevents silent wrong output),
+using the shared `internal/assets/mdl` module — `compile` aborts a model whose
+names differ and tells the user to run `crucible assets fix-mdl`. It does **not**
+auto-fix (kept separate, by decision). The discard-manifest, dry-run/report
+layer, and `processing/in|out` staging are dropped.
+
+## `crucible assets convert <dir>…`
+
+Usage: `crucible assets convert [--to dds|png|tga] [--backend <path>]
+[--non-recursive] <dir>…`
+
+Recursively convert textures in place. `--to` defaults to `dds`. The source set
+is every texture under the roots whose format is not already the target, among
+`{.dds, .png, .tga}`.
+
+**Every conversion flips vertically exactly once.** Converting to DDS produces
+an upside-down DDS (NWN's convention); converting a DDS back to PNG/TGA flips it
+upright again. The flip is unconditional — it is the defining behavior, not a
+policy.
+
+Backend: ImageMagick (`magick`), one tool for decode + flip + encode across all
+three formats:
+
+- to DDS: `magick <src> -flip -define dds:mipmaps=<n> -define
+  dds:compression=<dxt1|dxt5> <dst>.dds`, choosing DXT1 when the source is
+  opaque and DXT5 when it has alpha (detected with `magick identify`).
+- from DDS: `magick <src>.dds -flip <dst>.<png|tga>`.
+- `--backend <path>` points at a different ImageMagick-compatible binary or a
+  dedicated encoder for higher-quality DXT (e.g. compressonator); default is
+  `magick`.
+
+The original file is replaced in place — canonical DDS is the point. Exit
+non-zero if any file fails.
+
+Dropped vs reference: `--pad-color`, POT/legacy-safe/`nwn-safe`/`--strict`
+sizing, explicit `--format`, alpha-detect toggles, discard staging. Auto DXT
+selection replaces the format knobs.
+
+## `crucible assets upscale <dir>…`
+
+Usage: `crucible assets upscale [--scale N] [--backend <path>]
+[--non-recursive] <dir>…`
+
+Recursively upscale textures in place.
+
+- **Backend discovery**, first found wins: `upscayl-bin`, `upscayl`,
+  `realesrgan-ncnn-vulkan`, `waifu2x-ncnn-vulkan`. These share a compatible
+  ncnn-vulkan CLI shape (`-i <in> -o <out> -s <scale>`). `--backend <path>`
+  overrides.
+- `--scale N` default 4.
+- Backends operate on PNG; real NWN textures are DDS, so for a `.dds` input the
+  command reuses the convert helpers: dds→png (flip), run the backend, png→dds
+  (flip back) — yielding a correctly-flipped upscaled DDS. PNG/TGA inputs are
+  upscaled directly in place.
+- No backend found → fail closed with a message naming the supported backends.
+
+Dropped vs reference: min-dimension small-texture staging, the separate
+`--dds-backend` plumbing (it reuses convert), configured backend-path table.
+
+## `crucible assets check-mdl <path>…`
+
+Port of `check-ascii-mdl.sh`. Read-only. Each `<path>` is a file or a directory
+(recursed for `*.mdl`). For every model, using `internal/assets/mdl`:
+
+- report an **uncompiled ASCII** `.mdl` (a binary/compiled one is fine, skipped);
+- report every model-name mismatch (header tokens and geometry base node) with
+  file, line, the offending token, and the expected stem.
+
+Exit non-zero if any ASCII model or mismatch is found; zero and an `OK` line
+otherwise. No mutation.
+
+## `crucible assets fix-mdl [--dry-run] <path>…`
+
+Port of `fix-mdl-model-names.sh`. For each `*.mdl` under the paths:
+
+1. **Lowercase the filename** if it is not already lowercase (`mv`; abort that
+   file on a case-collision with an existing target).
+2. For ASCII models with a name mismatch, rewrite the model identity in place
+   via `mdl.FixNames` (binary models are skipped — the engine owns those).
+
+`--dry-run` reports every "would lowercase" / "would fix" without touching disk.
+Prints a per-file log and a final `no broken mdl model names found` when clean.
+
+Selection optimization from the reference is preserved: a file is a fix
+candidate only if it needs a content fix (name mismatch) or a filename
+lowercase, so the expensive per-file read/rewrite runs only on the few that
+matter, not the whole tree.
+
+## `crucible assets check-dupes <dir>…`
+
+Port of `check-duplicate-names.sh`'s **directory mode only**. Read-only. NWN
+packs hak entries by basename, not path, so files at different paths with the
+same basename (case-insensitively) silently clobber on pack. Across all `<dir>`
+args, report any two files whose lowercased basename matches.
+
+Exit non-zero if any collision is found.
+
+The script's `--manifests` mode (hak-scoped collisions read from `assets/*.yml`)
+is **not** ported here — it inspects manifest structure, not files on disk, so
+it belongs with the manifest/depot tooling. It moves in the follow-up spec (see
+Out of scope); until then `sow-assets-manifest` keeps
+`check-duplicate-names.sh` solely for that mode.
+
+## `crucible assets clean-dupes [--dry-run] <primary> <clean>`
+
+Port of `clean-duplicate-names.sh`. Deletes files from the `<clean>` tree whose
+basename collides (case-insensitively) with any file in the `<primary>` tree.
+Mutates only `<clean>`. Same rule as `check-dupes` directory mode, but resolves
+the collision by removal instead of reporting.
+
+- Refuses to run if `<primary>` and `<clean>` overlap (either contains the
+  other), matching the script's guard.
+- `--dry-run` reports every "would delete" without removing.
+
+Exit zero on success with a count of removed (or would-remove) files.
+
+## Consumer migration (`sow-assets-manifest`)
+
+`sow-assets-manifest` already ships the `crucible` bootstrap wrapper
+(`crucible.sh`) and uses `crucible depot` from its Makefile, so it resolves a
+released `crucible` with zero extra setup.
+
+- **Delete** the three fully-folded driver scripts: `scripts/check-ascii-mdl.sh`,
+  `scripts/fix-mdl-model-names.sh`, `scripts/clean-duplicate-names.sh`.
+- **Repoint** the Makefile targets to the wrapper:
+  - `check-mdl` → `./crucible.sh assets check-mdl …`
+  - `fix-mdl` → `./crucible.sh assets fix-mdl [--dry-run] …`
+  - `check-dupes` — its directory scan → `./crucible.sh assets check-dupes …`;
+    the `check-duplicate-names.sh --manifests` line stays as-is.
+  - `clean-dupes` → `./crucible.sh assets clean-dupes [--dry-run] <PRIMARY> <CLEAN>`
+- **Keep for now:**
+  - `scripts/check-duplicate-names.sh` — kept **only** for its `--manifests`
+    mode, still called by the `check` and `haks` targets. Its directory mode is
+    superseded by `crucible assets check-dupes`. Ported and deleted in the
+    follow-up.
+  - `scripts/mdl-scan.awk` and `scripts/mdl-name-lib.sh` — still sourced by
+    `import.sh` for its batched pre-import gate (~28× faster than per-file, on a
+    hot path). They retire in the follow-up too. Because both the awk classifier
+    and the Go `mdl` module must agree, the port keeps detection byte-for-byte
+    identical (a shared fixture set checks this).
+
+Nothing in `sow-assets-manifest` is committed by this project's plan except the
+script deletions and Makefile edits; that repo's change lands as its own commit
+once the new `crucible` release with `assets` is available.
+
+## Out of scope — follow-up spec
+
+Moving the **depot-interacting pipeline** into `crucible depot` is a separate
+project with its own spec
+(`2026-07-12-crucible-depot-pipeline-migration-design.md`). It covers
+`import.sh`, `sync-assets.sh`, `export.sh`, the inline mdl gate, and the
+`check-duplicate-names.sh --manifests` manifest-collision check. When that lands:
+its gate uses the in-process `internal/assets/mdl` module, and
+`scripts/mdl-scan.awk`, `scripts/mdl-name-lib.sh`, and
+`scripts/check-duplicate-names.sh` are all deleted. This spec deliberately stops
+at the standalone, file-on-disk integrity tools to keep one focused plan.
+
+## Error handling
+
+- Missing external tool (engine, `magick`, upscaler) → non-zero exit, message
+  names the tool and how to get it. Never a faked artifact. The pure-Go
+  integrity commands (`check-mdl`, `fix-mdl`, `check-dupes`, `clean-dupes`) need
+  no external tool.
+- Per-file failures are collected and printed as a summary line at the end; the
+  command exits non-zero if any file failed but still processes the rest.
+- Report commands (`check-mdl`, `check-dupes`) exit non-zero when they *find*
+  problems — that is their contract as CI/pre-import gates, not a tool error.
+- Unknown subcommand / bad flags → usage error, exit 64.
+
+## Testing
+
+Go tests in `internal/assets`:
+
+- flag/subcommand parsing and usage errors;
+- backend discovery against a fabricated `PATH` (temp dir with stub
+  executables) — asserts first-match ordering and the `--backend` override;
+- `walk` recursion and extension filtering, including `--non-recursive`;
+- one real convert round-trip using `magick` (present in the dev shell):
+  encode a small PNG to DDS and back, asserting the pixels are vertically
+  flipped after a single conversion and restored after the round trip.
+- `internal/assets/mdl`: table-driven fixtures — ASCII vs binary detection,
+  each header-token mismatch, the base-node mismatch, and `FixNames` producing
+  a model that then passes `CheckNames`. A parity fixture set shared in intent
+  with `mdl-scan.awk` so the Go port and the still-present awk agree.
+- `check-dupes`/`clean-dupes`: temp trees asserting basename-collision
+  detection (case-insensitive), the overlap guard, and `--dry-run` mutating
+  nothing.
+
+External engine/upscaler calls are exercised through the `run` indirection with
+a stub in tests; they are not invoked for real in CI.
+
+`make check` must stay green; add an `assets` expectation to `make smoke` for
+the wired exit.

docs/superpowers/specs/2026-07-12-crucible-depot-pipeline-migration-design.md

@@ -0,0 +1,90 @@
+# Crucible `depot` pipeline migration — design (charter / draft)
+
+Date: 2026-07-12
+Status: **draft — needs its own brainstorming pass before implementation.**
+Depends on: `2026-07-12-crucible-assets-builder-design.md` (the `assets` builder
+and `internal/assets/mdl` module) landing first.
+
+This is a scoping charter, not an implementation-ready design. The scripts it
+covers are nontrivial and lean heavily on `sow-assets-manifest/scripts/lib.sh`
+(~35 KB). A full design requires studying `lib.sh` and the manifest format in
+depth; that work happens in this spec's own brainstorming before any code.
+
+## Why this exists
+
+`sow-assets-manifest` is the last consumer still carrying real builder logic in
+shell. The `assets` spec folded its standalone integrity tools into Crucible but
+deliberately left the **depot-interacting pipeline** behind, because those
+scripts read/write the content-addressed depot and the asset manifests — depot
+domain, and a bigger lift. This charter completes the migration so
+`sow-assets-manifest` becomes what the other consumers already are: a thin
+caller of released `crucible` binaries with no vendored toolkit logic.
+
+## What moves into `crucible depot`
+
+The depot builder already owns `status/push/verify/get/pull`. This adds the
+authoring side:
+
+| Script | Proposed command | What it does today |
+| --- | --- | --- |
+| `import.sh` (318 lines) | `crucible depot import <edit-dir> [prefix…]` | Import an edit tree into the depot + manifests: sticky per-path member assignment, new paths to the tail member, per-category `max_bytes` rebalance (spill overflow forward, no full repack), a local stat-cache to skip unchanged files, batched hashing + parallel `depot_put_many`. |
+| `sync-assets.sh` (61 lines) | `crucible depot sync <tree> [prefix…]` | Full reconcile = import + prune manifest entries whose path no longer exists (scoped by prefix when given). Delegates to `import.sh`. |
+| `export.sh` (96 lines) | `crucible depot export [glob] [--hak m] [--restype ext] --to <dir>` | Materialize a manifest-selected subset out of the depot into a clean edit tree (category paths preserved, no metadata). |
+| `check-duplicate-names.sh --manifests` | `crucible depot check-dupes` (name TBD) | Hak-scoped basename collisions read from `assets/*.yml` (`.assets[].path` grouped by `.assets[].hak`). Manifest-structure check, not files on disk. |
+
+The inline **pre-import mdl gate** in `import.sh` (batched `mdl-scan.awk` pass
+that aborts on an H/B model-name mismatch before any blob is hashed/uploaded)
+is reimplemented with the in-process `internal/assets/mdl` module from the
+`assets` spec — same H/B contract, no subprocess.
+
+## What retires when this lands
+
+Deleted from `sow-assets-manifest/scripts/` once the commands above are wired
+and the Makefile is repointed:
+
+- `import.sh`, `sync-assets.sh`, `export.sh`
+- `mdl-scan.awk`, `mdl-name-lib.sh` (only remaining consumer was `import.sh`)
+- `check-duplicate-names.sh` (its directory mode already superseded by
+  `crucible assets check-dupes`; the `--manifests` mode moves here)
+- whatever else in `lib.sh` becomes dead once the above are gone (assess during
+  design — `lib.sh` also serves `build-haks.sh`, `pack-haks.sh`, `promote.sh`,
+  etc., which are **not** in scope here, so `lib.sh` likely shrinks, not dies)
+
+Makefile targets `import`, `sync`, `haks` (its sync/import/dupe steps), `export`
+repoint to `./crucible.sh depot …`.
+
+## Known hard parts (resolve in brainstorming)
+
+- **Manifest read/write parity.** Byte-stable output, member `max_bytes`
+  rebalance semantics, sticky path→member assignment. Must match the current
+  awk/`lib.sh` behavior or diff-review of manifests becomes noise. Crucible
+  already parses these manifests (`internal/pipeline`, hak build) — reuse, don't
+  reinvent.
+- **Depot backends.** `import`/`export` drive bunny/cdn/local through
+  `lib.sh`'s `depot_put_many`/`depot_require_write` (incl. the
+  `BUNNY_STORAGE_PASSWORD` prompt and cdn→bunny write normalization). Crucible's
+  `internal/depot` already speaks these backends for pull/push — the authoring
+  side should share that client, not a second implementation.
+- **Stat-cache.** `import.sh`'s `.cache/import/<target>/<cat>.tsv` skip-unchanged
+  optimization is the dominant re-import speedup. Decide whether Crucible
+  reproduces it, replaces it (content-addressing already dedupes uploads), or
+  drops it with a measured justification.
+- **Throughput.** The shell versions are already batched to avoid per-file
+  forks; a Go port should be at least as fast (in-process, no forks) — verify,
+  don't assume.
+- **Scoping semantics.** Prefix-scoped import/prune (segment-boundary match) and
+  export glob matching (`**`/`*`/literal dots, no shell expansion) must port
+  exactly.
+
+## Out of scope
+
+The HAK build/pack/promote/publish scripts (`build-haks.sh`, `pack-haks.sh`,
+`promote.sh`, `publish-release*.sh`, `hak-artifact-record.sh`) and their
+`lib.sh` support. `crucible hak build` already exists; whether these thin
+release wrappers also migrate is a separate question, not this charter.
+
+## Next step
+
+Brainstorm this charter into a full design: read `lib.sh` and the manifest
+format, settle the hard parts above, then write the implementation-ready spec
+and plan. Do not implement from this document.

flake.nix

@@ -22,12 +22,13 @@
             pname = "crucible";
             inherit version;
             src = ./.;
-            vendorHash = "sha256-hm6mrNAtXv0LidzHUfz4eukTFZouizGtxkZ8gKJFUVI=";
+            vendorHash = "sha256-0I8j7On9YGD2GK9xbj/KkgBrlkMJ6Y6XQv+KCLTgBBU=";
             subPackages = [
               "cmd/crucible"
               "cmd/crucible-depot"
               "cmd/crucible-hak"
               "cmd/crucible-module"
+              "cmd/crucible-nwsync"
               "cmd/crucible-topdata"
               "cmd/crucible-wiki"
             ];

go.mod

@@ -6,3 +6,5 @@ require (
 	golang.org/x/text v0.35.0
 	gopkg.in/yaml.v3 v3.0.1
 )
+
+require github.com/klauspost/compress v1.19.1

go.sum

@@ -1,3 +1,5 @@
+github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk=
+github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
 golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=

internal/app/app.go

@@ -385,7 +385,7 @@ func refreshBuildModuleManifest(ctx context, p *project.Project, progress func(s
 	}
 
 	progress("Refreshing hak list from the latest published sow-assets manifest...")
-	if err := runProjectScript(ctx, p, []string{"scripts", "fetch-hak-manifest"}, manifestPath); err != nil {
+	if err := runProjectScript(ctx, p, []string{"scripts", "fetch-upstream-manifests"}, manifestPath); err != nil {
 		return "", "", err
 	}
 	if _, err := pipeline.ApplyHAKManifest(p, manifestPath); err != nil {

internal/assets/checkmdl.go

@@ -0,0 +1,67 @@
+package assets
+
+import (
+	"flag"
+	"fmt"
+	"io"
+
+	"git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/assets/mdl"
+)
+
+// mdlExt is the file set shared by the mdl commands.
+var mdlExt = map[string]bool{".mdl": true}
+
+// runCheckMDL reports uncompiled ASCII .mdl files and model-name mismatches.
+// Read-only. Exit exitFail if any problem is found.
+func runCheckMDL(args []string, stdout, stderr io.Writer) int {
+	fs := flag.NewFlagSet("check-mdl", flag.ContinueOnError)
+	fs.SetOutput(stderr)
+	nonRecursive := fs.Bool("non-recursive", false, "do not descend into subdirectories")
+	if err := fs.Parse(args); err != nil {
+		return exitUsage
+	}
+	paths := fs.Args()
+	if len(paths) == 0 {
+		fmt.Fprintln(stderr, "assets check-mdl: usage: check-mdl <path>...")
+		return exitUsage
+	}
+
+	files, err := walk(paths, mdlExt, !*nonRecursive)
+	if err != nil {
+		fmt.Fprintln(stderr, "assets check-mdl:", err)
+		return exitUsage
+	}
+
+	fail := false
+	for _, f := range files {
+		ascii, err := mdl.IsASCII(f)
+		if err != nil {
+			fmt.Fprintln(stderr, "assets check-mdl:", err)
+			return exitTool
+		}
+		if ascii {
+			fmt.Fprintf(stderr, "uncompiled ascii mdl: %s\n", f)
+			fail = true
+		}
+		mismatches, err := mdl.CheckNames(f)
+		if err != nil {
+			fmt.Fprintln(stderr, "assets check-mdl:", err)
+			return exitTool
+		}
+		expected := mdl.ExpectedName(f)
+		for _, m := range mismatches {
+			if m.Line == 0 {
+				fmt.Fprintf(stderr, "%s: mdl model-name mismatch: root node is %s, expected %s\n", f, m.Got, expected)
+			} else {
+				fmt.Fprintf(stderr, "%s: mdl model-name mismatch: line %d: %s is %s, expected %s\n", f, m.Line, m.What, m.Got, expected)
+			}
+			fail = true
+		}
+	}
+	if fail {
+		fmt.Fprintln(stderr, "check-mdl: found broken or uncompiled .mdl file(s)")
+		return exitFail
+	}
+	fmt.Fprintln(stdout, "check-mdl: OK")
+	return exitOK
+}

internal/assets/checkmdl_test.go

@@ -0,0 +1,32 @@
+package assets
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestCheckMDL(t *testing.T) {
+	dir := t.TempDir()
+	// Uncompiled ASCII model with a name mismatch.
+	bad := filepath.Join(dir, "foo.mdl")
+	if err := os.WriteFile(bad, []byte("newmodel wrong\nbeginmodelgeom wrong\nendmodelgeom wrong\ndonemodel wrong\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	var out, errw bytes.Buffer
+	if code := runCheckMDL([]string{dir}, &out, &errw); code != exitFail {
+		t.Fatalf("bad mdl exit = %d, want %d\n%s", code, exitFail, errw.String())
+	}
+
+	// A binary (compiled) model is fine.
+	good := t.TempDir()
+	if err := os.WriteFile(filepath.Join(good, "bar.mdl"), []byte("\x00\x00compiled binary blob"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	out.Reset()
+	errw.Reset()
+	if code := runCheckMDL([]string{good}, &out, &errw); code != exitOK {
+		t.Fatalf("binary mdl exit = %d, want %d\n%s", code, exitOK, errw.String())
+	}
+}

internal/assets/compile.go

@@ -0,0 +1,190 @@
+package assets
+
+import (
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/assets/mdl"
+)
+
+// runCompile compiles ASCII .mdl models to binary in place, one at a time (the
+// engine's development/ and modelcompiler/ folders are flat, single-slot).
+func runCompile(args []string, stdout, stderr io.Writer, getenv func(string) string) int {
+	fs := flag.NewFlagSet("compile", flag.ContinueOnError)
+	fs.SetOutput(stderr)
+	nwn := fs.String("nwn", "", "path to the NWN install root or nwmain-linux binary")
+	nonRecursive := fs.Bool("non-recursive", false, "do not descend into subdirectories")
+	if err := fs.Parse(args); err != nil {
+		return exitUsage
+	}
+	dirs := fs.Args()
+	if len(dirs) == 0 {
+		fmt.Fprintln(stderr, "assets compile: usage: compile [--nwn INSTALL] <dir>...")
+		return exitUsage
+	}
+
+	home := getenv("HOME")
+	userData := filepath.Join(home, ".local", "share", "Neverwinter Nights")
+	dev := filepath.Join(userData, "development")
+	mc := filepath.Join(userData, "modelcompiler")
+
+	nwmain := findNWMain(*nwn, home)
+	if nwmain == "" {
+		fmt.Fprintln(stderr, "assets compile: nwmain-linux not found — pass --nwn <install> "+
+			"(Steam/GOG/Beamdog install root or the nwmain-linux binary)")
+		return exitTool
+	}
+	binDir := filepath.Dir(nwmain)
+
+	// Always use a virtual X so compilation never opens the client UI.
+	xvfb := look("xvfb-run")
+	if xvfb == "" {
+		fmt.Fprintln(stderr, "assets compile: xvfb-run not found — install it to run the NWN model compiler headlessly")
+		return exitTool
+	}
+	wrap := []string{xvfb, "-a", "--server-args=-screen 0 1024x768x24"}
+
+	files, err := walk(dirs, mdlExt, !*nonRecursive)
+	if err != nil {
+		fmt.Fprintln(stderr, "assets compile:", err)
+		return exitUsage
+	}
+
+	failed := false
+	for _, src := range files {
+		if err := compileOne(src, binDir, nwmain, dev, mc, wrap, userData, stdout, stderr); err != nil {
+			fmt.Fprintf(stderr, "assets compile: %s: %v\n", src, err)
+			failed = true
+		}
+	}
+	if failed {
+		return exitFail
+	}
+	return exitOK
+}
+
+// findNWMain resolves the nwmain-linux binary from --nwn or standard roots.
+func findNWMain(override, home string) string {
+	if override != "" {
+		if fi, err := os.Stat(override); err == nil && !fi.IsDir() {
+			return override
+		}
+		cand := filepath.Join(override, "bin", "linux-x86", "nwmain-linux")
+		if fi, err := os.Stat(cand); err == nil && !fi.IsDir() {
+			return cand
+		}
+		return ""
+	}
+	return look(
+		filepath.Join(home, ".local/share/Steam/steamapps/common/Neverwinter Nights/bin/linux-x86/nwmain-linux"),
+		filepath.Join(home, "GOG Games/Neverwinter Nights Enhanced Edition/game/bin/linux-x86/nwmain-linux"),
+		filepath.Join(home, ".steam/steam/steamapps/common/Neverwinter Nights/bin/linux-x86/nwmain-linux"),
+	)
+}
+
+// compileOne compiles a single model. Binary models are reported and skipped
+// (not an error). A name-mismatched model is aborted with guidance.
+func compileOne(src, binDir, nwmain, dev, mc string, wrap []string, userData string, stdout, stderr io.Writer) error {
+	ascii, err := mdl.IsASCII(src)
+	if err != nil {
+		return err
+	}
+	if !ascii {
+		fmt.Fprintf(stdout, "skip (already compiled): %s\n", src)
+		return nil
+	}
+	mismatches, err := mdl.CheckNames(src)
+	if err != nil {
+		return err
+	}
+	if len(mismatches) > 0 {
+		return fmt.Errorf("model names differ from the file stem; run `crucible assets fix-mdl` first")
+	}
+
+	stem := mdl.ExpectedNameStem(src)
+	name := strings.ToLower(filepath.Base(src))
+	devFile := filepath.Join(dev, name)
+	// Collision guard: a pre-existing slot aborts before any mutation.
+	if _, err := os.Stat(devFile); err == nil {
+		return fmt.Errorf("development slot already occupied: %s", devFile)
+	}
+
+	data, err := os.ReadFile(src)
+	if err != nil {
+		return err
+	}
+	if err := os.WriteFile(devFile, data, 0o644); err != nil {
+		return err
+	}
+	defer os.Remove(devFile)
+
+	// Run the engine with cwd = the binary dir.
+	cmd := append(append([]string{}, wrap...), nwmain, "compilemodel", stem)
+	if out, err := runner(binDir, nil, cmd[0], cmd[1:]...); err != nil {
+		printEngineLog(userData, stderr)
+		return fmt.Errorf("engine: %v: %s", err, strings.TrimSpace(string(out)))
+	}
+
+	// Collect the compiled artifact from modelcompiler/ (match by stem, any case).
+	compiled, err := findCompiled(mc, stem)
+	if err != nil {
+		printEngineLog(userData, stderr)
+		return err
+	}
+	defer os.Remove(compiled)
+
+	out, err := os.ReadFile(compiled)
+	if err != nil {
+		return err
+	}
+	// Move it back over the source path, lowercased.
+	dst := filepath.Join(filepath.Dir(src), name)
+	if err := os.WriteFile(dst, out, 0o644); err != nil {
+		return err
+	}
+	if dst != src {
+		_ = os.Remove(src)
+	}
+	fmt.Fprintf(stdout, "compiled: %s\n", dst)
+	return nil
+}
+
+// findCompiled returns the modelcompiler/ artifact whose stem matches (case-
+// insensitively).
+func findCompiled(mc, stem string) (string, error) {
+	entries, err := os.ReadDir(mc)
+	if err != nil {
+		return "", err
+	}
+	want := strings.ToLower(stem) + ".mdl"
+	for _, e := range entries {
+		if e.IsDir() {
+			continue
+		}
+		if strings.ToLower(e.Name()) == want {
+			return filepath.Join(mc, e.Name()), nil
+		}
+	}
+	return "", fmt.Errorf("engine produced no compiled model for %q", stem)
+}
+
+// printEngineLog appends a short tail of the engine log as advisory diagnostics.
+func printEngineLog(userData string, stderr io.Writer) {
+	log := filepath.Join(userData, "logs", "nwengineLog.txt")
+	data, err := os.ReadFile(log)
+	if err != nil {
+		return
+	}
+	lines := strings.Split(strings.TrimRight(string(data), "\n"), "\n")
+	if len(lines) > 8 {
+		lines = lines[len(lines)-8:]
+	}
+	fmt.Fprintf(stderr, "  engine log tail (%s):\n", log)
+	for _, l := range lines {
+		fmt.Fprintf(stderr, "    %s\n", l)
+	}
+}

internal/assets/compile_test.go

@@ -0,0 +1,171 @@
+package assets
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestCompileDrivesEngineAndReplacesInPlace(t *testing.T) {
+	home := t.TempDir()
+	userData := filepath.Join(home, ".local", "share", "Neverwinter Nights")
+	dev := filepath.Join(userData, "development")
+	mc := filepath.Join(userData, "modelcompiler")
+	for _, d := range []string{dev, mc} {
+		if err := os.MkdirAll(d, 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	// Fake nwmain binary for discovery via --nwn.
+	binDir := t.TempDir()
+	nwmain := filepath.Join(binDir, "nwmain-linux")
+	if err := os.WriteFile(nwmain, []byte("#!/bin/sh\n"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	xvfbDir := t.TempDir()
+	xvfb := filepath.Join(xvfbDir, "xvfb-run")
+	if err := os.WriteFile(xvfb, []byte("#!/bin/sh\n"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("PATH", xvfbDir+string(os.PathListSeparator)+os.Getenv("PATH"))
+
+	getenv := func(k string) string {
+		switch k {
+		case "HOME":
+			return home
+		case "DISPLAY":
+			return ":0" // a desktop display must not make compilation interactive
+		}
+		return ""
+	}
+
+	// Stub the engine: writes a binary compiled model into modelcompiler/.
+	orig := runner
+	defer func() { runner = orig }()
+	runner = func(dir string, env []string, name string, args ...string) ([]byte, error) {
+		if name != xvfb || len(args) != 5 || args[0] != "-a" ||
+			args[1] != "--server-args=-screen 0 1024x768x24" || args[2] != nwmain ||
+			args[3] != "compilemodel" {
+			t.Fatalf("engine command = %q %q, want xvfb-run wrapping nwmain", name, args)
+		}
+		stem := args[len(args)-1]
+		compiled := filepath.Join(mc, stem+".mdl")
+		return nil, os.WriteFile(compiled, []byte("\x00\x00compiled"), 0o644)
+	}
+
+	// Source tree with one ASCII model whose names already match its stem.
+	srcDir := t.TempDir()
+	src := filepath.Join(srcDir, "foo.mdl")
+	body := "newmodel foo\nbeginmodelgeom foo\n  node dummy foo\n    parent null\n  endnode\nendmodelgeom foo\ndonemodel foo\n"
+	if err := os.WriteFile(src, []byte(body), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	var stdout, stderr bytes.Buffer
+	code := runCompile([]string{"--nwn", nwmain, srcDir}, &stdout, &stderr, getenv)
+	if code != exitOK {
+		t.Fatalf("compile exit = %d\n%s", code, stderr.String())
+	}
+	// The source is now binary (the compiled artifact moved back over it).
+	data, err := os.ReadFile(src)
+	if err != nil {
+		t.Fatalf("compiled model missing: %v", err)
+	}
+	if string(data) != "\x00\x00compiled" {
+		t.Fatalf("source not replaced by compiled binary: %q", data)
+	}
+}
+
+func TestCompileAbortsOnNameMismatch(t *testing.T) {
+	home := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(home, ".local", "share", "Neverwinter Nights", "development"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	binDir := t.TempDir()
+	nwmain := filepath.Join(binDir, "nwmain-linux")
+	if err := os.WriteFile(nwmain, []byte("#!/bin/sh\n"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	xvfbDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(xvfbDir, "xvfb-run"), []byte("#!/bin/sh\n"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("PATH", xvfbDir+string(os.PathListSeparator)+os.Getenv("PATH"))
+	getenv := func(k string) string {
+		if k == "HOME" {
+			return home
+		}
+		if k == "DISPLAY" {
+			return ":0"
+		}
+		return ""
+	}
+	orig := runner
+	defer func() { runner = orig }()
+	engineCalled := false
+	runner = func(string, []string, string, ...string) ([]byte, error) {
+		engineCalled = true
+		return nil, nil
+	}
+
+	srcDir := t.TempDir()
+	// Internal name "wrong" != stem "foo": must abort before touching the engine.
+	if err := os.WriteFile(filepath.Join(srcDir, "foo.mdl"),
+		[]byte("newmodel wrong\ndonemodel wrong\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	var stdout, stderr bytes.Buffer
+	if code := runCompile([]string{"--nwn", nwmain, srcDir}, &stdout, &stderr, getenv); code != exitFail {
+		t.Fatalf("mismatch exit = %d, want %d", code, exitFail)
+	}
+	if engineCalled {
+		t.Fatal("engine should not run for a name-mismatched model")
+	}
+}
+
+func TestCompileFailsClosedWithoutXvfb(t *testing.T) {
+	home := t.TempDir()
+	userData := filepath.Join(home, ".local", "share", "Neverwinter Nights")
+	for _, d := range []string{filepath.Join(userData, "development"), filepath.Join(userData, "modelcompiler")} {
+		if err := os.MkdirAll(d, 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	nwmain := filepath.Join(t.TempDir(), "nwmain-linux")
+	if err := os.WriteFile(nwmain, []byte("#!/bin/sh\n"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("PATH", t.TempDir())
+
+	getenv := func(k string) string {
+		if k == "HOME" {
+			return home
+		}
+		return ""
+	}
+	orig := runner
+	defer func() { runner = orig }()
+	engineCalled := false
+	runner = func(string, []string, string, ...string) ([]byte, error) {
+		engineCalled = true
+		return nil, nil
+	}
+
+	srcDir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(srcDir, "foo.mdl"),
+		[]byte("newmodel foo\nbeginmodelgeom foo\n  node dummy foo\n    parent null\n  endnode\nendmodelgeom foo\ndonemodel foo\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	var stdout, stderr bytes.Buffer
+	if code := runCompile([]string{"--nwn", nwmain, srcDir}, &stdout, &stderr, getenv); code != exitTool {
+		t.Fatalf("compile exit = %d, want %d\n%s", code, exitTool, stderr.String())
+	}
+	if engineCalled {
+		t.Fatal("engine must not run without xvfb-run")
+	}
+	if !strings.Contains(stderr.String(), "xvfb-run") {
+		t.Fatalf("missing actionable xvfb-run error: %s", stderr.String())
+	}
+}

internal/assets/convert.go

@@ -0,0 +1,116 @@
+package assets
+
+import (
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+var textureExts = map[string]bool{".dds": true, ".png": true, ".tga": true}
+
+// runConvert converts textures in place, flipping vertically exactly once per
+// conversion. --to defaults to dds. Files already in the target format are
+// skipped.
+func runConvert(args []string, stdout, stderr io.Writer) int {
+	fs := flag.NewFlagSet("convert", flag.ContinueOnError)
+	fs.SetOutput(stderr)
+	to := fs.String("to", "dds", "target format: dds|png|tga")
+	backend := fs.String("backend", "magick", "ImageMagick-compatible binary")
+	nonRecursive := fs.Bool("non-recursive", false, "do not descend into subdirectories")
+	if err := fs.Parse(args); err != nil {
+		return exitUsage
+	}
+	target := strings.ToLower(*to)
+	if target != "dds" && target != "png" && target != "tga" {
+		fmt.Fprintln(stderr, "assets convert: --to must be dds, png, or tga")
+		return exitUsage
+	}
+	dirs := fs.Args()
+	if len(dirs) == 0 {
+		fmt.Fprintln(stderr, "assets convert: usage: convert [--to dds|png|tga] <dir>...")
+		return exitUsage
+	}
+
+	magick := look(*backend)
+	if magick == "" {
+		fmt.Fprintf(stderr, "assets convert: backend %q not found — install ImageMagick (magick)\n", *backend)
+		return exitTool
+	}
+
+	files, err := walk(dirs, textureExts, !*nonRecursive)
+	if err != nil {
+		fmt.Fprintln(stderr, "assets convert:", err)
+		return exitUsage
+	}
+
+	targetExt := "." + target
+	failed := false
+	for _, src := range files {
+		srcExt := strings.ToLower(filepath.Ext(src))
+		if srcExt == targetExt {
+			continue // already in the target format
+		}
+		dst := strings.TrimSuffix(src, filepath.Ext(src)) + targetExt
+		var convErr error
+		if target == "dds" {
+			convErr = pngToDDS(magick, src, dst)
+		} else {
+			convErr = ddsToPNG(magick, src, dst) // works for any decodable source
+		}
+		if convErr != nil {
+			fmt.Fprintf(stderr, "assets convert: %s: %v\n", src, convErr)
+			failed = true
+			continue
+		}
+		if dst != src {
+			if err := os.Remove(src); err != nil {
+				fmt.Fprintf(stderr, "assets convert: %s: %v\n", src, err)
+				failed = true
+			}
+		}
+	}
+	if failed {
+		return exitFail
+	}
+	return exitOK
+}
+
+// ddsToPNG decodes src to dst (PNG/TGA by dst's extension), flipping vertically
+// once. The single flip is the defining NWN behavior.
+func ddsToPNG(magickBin, src, dst string) error {
+	if out, err := runner("", nil, magickBin, src, "-flip", dst); err != nil {
+		return fmt.Errorf("magick: %v: %s", err, strings.TrimSpace(string(out)))
+	}
+	return nil
+}
+
+// pngToDDS encodes src to a DDS at dst, flipping vertically once and choosing
+// DXT1 for opaque images, DXT5 for images with alpha.
+func pngToDDS(magickBin, src, dst string) error {
+	compression := "dxt1"
+	if hasAlpha(magickBin, src) {
+		compression = "dxt5"
+	}
+	// ponytail: mipmaps rely on magick's default full chain (NWN wants a
+	// pyramid, which magick writes by default). Add `-define dds:mipmaps=N`
+	// here if a specific count is ever required.
+	out, err := runner("", nil, magickBin, src, "-flip",
+		"-define", "dds:compression="+compression, dst)
+	if err != nil {
+		return fmt.Errorf("magick: %v: %s", err, strings.TrimSpace(string(out)))
+	}
+	return nil
+}
+
+// hasAlpha reports whether src has any non-opaque pixel, via `magick identify`.
+// On any probe error it assumes alpha (DXT5), the safe/lossless-alpha default.
+func hasAlpha(magickBin, src string) bool {
+	out, err := runner("", nil, magickBin, "identify", "-format", "%[opaque]", src)
+	if err != nil {
+		return true
+	}
+	return !strings.EqualFold(strings.TrimSpace(string(out)), "true")
+}

internal/assets/convert_test.go

@@ -0,0 +1,108 @@
+package assets
+
+import (
+	"bytes"
+	"image"
+	"image/color"
+	"image/png"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"testing"
+)
+
+// writeTestPNG writes a 16x16 image: top half red, bottom half blue. The size
+// and the half-way split keep every 4x4 DXT block a single flat color, so the
+// DXT1 round trip stays lossless and only the flip is under test. (A 4x4 image
+// is one mixed DXT block that magick's encoder collapses to a single color.)
+func writeTestPNG(t *testing.T, path string) {
+	t.Helper()
+	const n = 16
+	img := image.NewRGBA(image.Rect(0, 0, n, n))
+	for y := 0; y < n; y++ {
+		c := color.RGBA{255, 0, 0, 255} // red
+		if y >= n/2 {
+			c = color.RGBA{0, 0, 255, 255} // blue
+		}
+		for x := 0; x < n; x++ {
+			img.Set(x, y, c)
+		}
+	}
+	f, err := os.Create(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer f.Close()
+	if err := png.Encode(f, img); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func topRowIsBlue(t *testing.T, pngPath string) bool {
+	t.Helper()
+	f, err := os.Open(pngPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer f.Close()
+	img, err := png.Decode(f)
+	if err != nil {
+		t.Fatal(err)
+	}
+	r, _, b, _ := img.At(0, 0).RGBA()
+	return b > r // blue dominates the top-left after a flip
+}
+
+func TestConvertFlipsOnceAndRoundTrips(t *testing.T) {
+	magick := look("magick")
+	if magick == "" {
+		t.Skip("magick not on PATH")
+	}
+	dir := t.TempDir()
+	src := filepath.Join(dir, "tex.png")
+	writeTestPNG(t, src)
+
+	// Convert PNG -> DDS (in place: tex.png becomes tex.dds, original removed).
+	var out, errw bytes.Buffer
+	if code := runConvert([]string{"--to", "dds", dir}, &out, &errw); code != exitOK {
+		t.Fatalf("to-dds exit = %d\n%s", code, errw.String())
+	}
+	dds := filepath.Join(dir, "tex.dds")
+	if _, err := os.Stat(dds); err != nil {
+		t.Fatalf("dds not produced: %v", err)
+	}
+	if _, err := os.Stat(src); !os.IsNotExist(err) {
+		t.Fatal("source png was not replaced")
+	}
+
+	// Decode the DDS RAW (no extra flip) and confirm a single flip happened:
+	// the source top row was red, so the DDS top row must now be blue.
+	raw := filepath.Join(dir, "raw.png")
+	if err := exec.Command(magick, dds, raw).Run(); err != nil {
+		t.Fatalf("raw decode: %v", err)
+	}
+	if !topRowIsBlue(t, raw) {
+		t.Fatal("expected the DDS to be vertically flipped vs the source")
+	}
+
+	// Convert DDS -> PNG (another flip). Result should match the original.
+	out.Reset()
+	errw.Reset()
+	if code := runConvert([]string{"--to", "png", dir}, &out, &errw); code != exitOK {
+		t.Fatalf("to-png exit = %d\n%s", code, errw.String())
+	}
+	restored := filepath.Join(dir, "tex.png")
+	if topRowIsBlue(t, restored) {
+		t.Fatal("round trip did not restore the original orientation")
+	}
+}
+
+func TestConvertMissingBackendFailsClosed(t *testing.T) {
+	dir := t.TempDir()
+	writeTestPNG(t, filepath.Join(dir, "tex.png"))
+	var out, errw bytes.Buffer
+	code := runConvert([]string{"--backend", "/nonexistent/magick", dir}, &out, &errw)
+	if code != exitTool {
+		t.Fatalf("missing backend exit = %d, want %d", code, exitTool)
+	}
+}

internal/assets/dupes.go

@@ -0,0 +1,151 @@
+package assets
+
+import (
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+)
+
+// allFiles returns every regular file under root (recursive).
+func allFiles(root string) ([]string, error) {
+	var out []string
+	err := filepath.WalkDir(root, func(p string, d os.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if !d.IsDir() {
+			out = append(out, p)
+		}
+		return nil
+	})
+	sort.Strings(out)
+	return out, err
+}
+
+// runCheckDupes reports files whose lower-cased basename collides across the
+// given dirs. Read-only. Exit exitFail if any collision is found.
+func runCheckDupes(args []string, stdout, stderr io.Writer) int {
+	fs := flag.NewFlagSet("check-dupes", flag.ContinueOnError)
+	fs.SetOutput(stderr)
+	if err := fs.Parse(args); err != nil {
+		return exitUsage
+	}
+	dirs := fs.Args()
+	if len(dirs) == 0 {
+		fmt.Fprintln(stderr, "assets check-dupes: usage: check-dupes <dir>...")
+		return exitUsage
+	}
+
+	first := map[string]string{}
+	fail := false
+	for _, dir := range dirs {
+		if fi, err := os.Stat(dir); err != nil || !fi.IsDir() {
+			fmt.Fprintf(stderr, "assets check-dupes: no such dir: %s\n", dir)
+			return exitUsage
+		}
+		files, err := allFiles(dir)
+		if err != nil {
+			fmt.Fprintln(stderr, "assets check-dupes:", err)
+			return exitTool
+		}
+		for _, f := range files {
+			key := strings.ToLower(filepath.Base(f))
+			if prev, ok := first[key]; ok {
+				fmt.Fprintf(stderr, "runtime-name collision: %s collides with %s\n", f, prev)
+				fail = true
+			} else {
+				first[key] = f
+			}
+		}
+	}
+	if fail {
+		fmt.Fprintln(stderr, "check-dupes: found runtime-name collision(s)")
+		return exitFail
+	}
+	fmt.Fprintln(stdout, "check-dupes: OK")
+	return exitOK
+}
+
+// runCleanDupes deletes files from <clean> whose lower-cased basename collides
+// with any file in <primary>. Mutates only <clean>. Refuses to run if the two
+// trees overlap.
+func runCleanDupes(args []string, stdout, stderr io.Writer) int {
+	fs := flag.NewFlagSet("clean-dupes", flag.ContinueOnError)
+	fs.SetOutput(stderr)
+	dryRun := fs.Bool("dry-run", false, "report deletions without removing")
+	if err := fs.Parse(args); err != nil {
+		return exitUsage
+	}
+	pos := fs.Args()
+	if len(pos) != 2 {
+		fmt.Fprintln(stderr, "assets clean-dupes: usage: clean-dupes [--dry-run] <primary> <clean>")
+		return exitUsage
+	}
+	primary, clean := pos[0], pos[1]
+	for _, d := range []string{primary, clean} {
+		if fi, err := os.Stat(d); err != nil || !fi.IsDir() {
+			fmt.Fprintf(stderr, "assets clean-dupes: no such dir: %s\n", d)
+			return exitUsage
+		}
+	}
+	primaryReal, err1 := filepath.EvalSymlinks(primary)
+	cleanReal, err2 := filepath.EvalSymlinks(clean)
+	if err1 != nil || err2 != nil {
+		fmt.Fprintln(stderr, "assets clean-dupes: cannot resolve dirs")
+		return exitTool
+	}
+	if overlaps(primaryReal, cleanReal) {
+		fmt.Fprintln(stderr, "assets clean-dupes: primary and clean dirs must not overlap")
+		return exitUsage
+	}
+
+	primaryFiles, err := allFiles(primary)
+	if err != nil {
+		fmt.Fprintln(stderr, "assets clean-dupes:", err)
+		return exitTool
+	}
+	names := map[string]bool{}
+	for _, f := range primaryFiles {
+		names[strings.ToLower(filepath.Base(f))] = true
+	}
+
+	cleanFiles, err := allFiles(clean)
+	if err != nil {
+		fmt.Fprintln(stderr, "assets clean-dupes:", err)
+		return exitTool
+	}
+	removed := 0
+	for _, f := range cleanFiles {
+		if !names[strings.ToLower(filepath.Base(f))] {
+			continue
+		}
+		if *dryRun {
+			fmt.Fprintf(stderr, "would delete clean-tree collision: %s\n", f)
+		} else {
+			if err := os.Remove(f); err != nil {
+				fmt.Fprintln(stderr, "assets clean-dupes:", err)
+				return exitTool
+			}
+			fmt.Fprintf(stderr, "deleted clean-tree collision: %s\n", f)
+		}
+		removed++
+	}
+	verb := "removed"
+	if *dryRun {
+		verb = "would remove"
+	}
+	fmt.Fprintf(stdout, "clean-dupes: %s %d file(s)\n", verb, removed)
+	return exitOK
+}
+
+// overlaps reports whether either directory contains the other (or they are
+// equal), using cleaned absolute-ish paths with a trailing separator.
+func overlaps(a, b string) bool {
+	as := a + string(filepath.Separator)
+	bs := b + string(filepath.Separator)
+	return strings.HasPrefix(as, bs) || strings.HasPrefix(bs, as)
+}

internal/assets/dupes_test.go

@@ -0,0 +1,80 @@
+package assets
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func touch(t *testing.T, path string) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(path, []byte("x"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestCheckDupes(t *testing.T) {
+	root := t.TempDir()
+	touch(t, filepath.Join(root, "tex", "Foo.tga"))
+	touch(t, filepath.Join(root, "plc", "foo.tga")) // basename collision (case-insensitive)
+
+	var out, errw bytes.Buffer
+	if code := runCheckDupes([]string{root}, &out, &errw); code != exitFail {
+		t.Fatalf("collision exit = %d, want %d\n%s", code, exitFail, errw.String())
+	}
+
+	clean := t.TempDir()
+	touch(t, filepath.Join(clean, "a.tga"))
+	touch(t, filepath.Join(clean, "sub", "b.tga"))
+	out.Reset()
+	errw.Reset()
+	if code := runCheckDupes([]string{clean}, &out, &errw); code != exitOK {
+		t.Fatalf("no-collision exit = %d, want %d\n%s", code, exitOK, errw.String())
+	}
+}
+
+func TestCleanDupes(t *testing.T) {
+	primary := t.TempDir()
+	clean := t.TempDir()
+	touch(t, filepath.Join(primary, "keep.tga"))
+	collide := filepath.Join(clean, "sub", "Keep.tga")
+	survive := filepath.Join(clean, "unique.tga")
+	touch(t, collide)
+	touch(t, survive)
+
+	// dry-run removes nothing.
+	var out, errw bytes.Buffer
+	if code := runCleanDupes([]string{"--dry-run", primary, clean}, &out, &errw); code != exitOK {
+		t.Fatalf("dry-run exit = %d\n%s", code, errw.String())
+	}
+	if _, err := os.Stat(collide); err != nil {
+		t.Fatal("dry-run deleted a file")
+	}
+
+	// real run deletes the collision, keeps the unique file.
+	out.Reset()
+	errw.Reset()
+	if code := runCleanDupes([]string{primary, clean}, &out, &errw); code != exitOK {
+		t.Fatalf("clean exit = %d\n%s", code, errw.String())
+	}
+	if _, err := os.Stat(collide); !os.IsNotExist(err) {
+		t.Fatal("collision file was not deleted")
+	}
+	if _, err := os.Stat(survive); err != nil {
+		t.Fatal("unique file was wrongly deleted")
+	}
+}
+
+func TestCleanDupesRejectsOverlap(t *testing.T) {
+	root := t.TempDir()
+	sub := filepath.Join(root, "child")
+	touch(t, filepath.Join(sub, "x.tga"))
+	var out, errw bytes.Buffer
+	if code := runCleanDupes([]string{root, sub}, &out, &errw); code != exitUsage {
+		t.Fatalf("overlap exit = %d, want %d", code, exitUsage)
+	}
+}

internal/assets/fixmdl.go

@@ -0,0 +1,103 @@
+package assets
+
+import (
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/assets/mdl"
+)
+
+// runFixMDL lowercases .mdl filenames and rewrites ASCII model identity to
+// match each file's stem. Binary models are skipped (the engine owns those).
+func runFixMDL(args []string, stdout, stderr io.Writer) int {
+	fs := flag.NewFlagSet("fix-mdl", flag.ContinueOnError)
+	fs.SetOutput(stderr)
+	dryRun := fs.Bool("dry-run", false, "report changes without touching disk")
+	nonRecursive := fs.Bool("non-recursive", false, "do not descend into subdirectories")
+	if err := fs.Parse(args); err != nil {
+		return exitUsage
+	}
+	paths := fs.Args()
+	if len(paths) == 0 {
+		fmt.Fprintln(stderr, "assets fix-mdl: usage: fix-mdl [--dry-run] <path>...")
+		return exitUsage
+	}
+
+	files, err := walk(paths, mdlExt, !*nonRecursive)
+	if err != nil {
+		fmt.Fprintln(stderr, "assets fix-mdl:", err)
+		return exitUsage
+	}
+
+	changed := 0
+	failed := false
+	for _, f := range files {
+		// 1. Lowercase the basename if needed.
+		//
+		// ponytail: 35k files are each read once here (CheckNames + the rewrite
+		// on candidates). The shell reference batched an awk pass to avoid
+		// per-file subprocess spawns; in Go a plain read is cheap, so the batch
+		// is not worth porting. If profiling ever shows this hot, parallelize
+		// the loop.
+		lower := f
+		if base := filepath.Base(f); base != strings.ToLower(base) {
+			lower = filepath.Join(filepath.Dir(f), strings.ToLower(base))
+			if _, err := os.Stat(lower); err == nil {
+				fmt.Fprintf(stderr, "assets fix-mdl: lowercase collision: %s -> %s\n", f, lower)
+				failed = true
+				continue
+			}
+			if *dryRun {
+				fmt.Fprintf(stdout, "would lowercase: %s -> %s\n", f, lower)
+			} else {
+				if err := os.Rename(f, lower); err != nil {
+					fmt.Fprintf(stderr, "assets fix-mdl: failed to lowercase %s: %v\n", f, err)
+					failed = true
+					continue
+				}
+				fmt.Fprintf(stdout, "lowercased: %s -> %s\n", f, lower)
+			}
+			changed++
+		}
+
+		// 2. Rewrite model identity if the (lowercased) file has a mismatch.
+		//    In dry-run the on-disk file is still the original path.
+		readPath := lower
+		if *dryRun && lower != f {
+			readPath = f
+		}
+		data, err := os.ReadFile(readPath)
+		if err != nil {
+			fmt.Fprintln(stderr, "assets fix-mdl:", err)
+			failed = true
+			continue
+		}
+		out, wasChanged := mdl.FixNames(data, mdl.ExpectedName(lower))
+		if !wasChanged {
+			continue
+		}
+		if *dryRun {
+			fmt.Fprintf(stdout, "would fix: %s\n", lower)
+		} else {
+			if err := os.WriteFile(lower, out, 0o644); err != nil {
+				fmt.Fprintln(stderr, "assets fix-mdl:", err)
+				failed = true
+				continue
+			}
+			fmt.Fprintf(stdout, "fixed: %s\n", lower)
+		}
+		changed++
+	}
+
+	if changed == 0 {
+		fmt.Fprintln(stdout, "no broken mdl model names found")
+	}
+	if failed {
+		return exitFail
+	}
+	return exitOK
+}

internal/assets/fixmdl_test.go

@@ -0,0 +1,48 @@
+package assets
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/assets/mdl"
+)
+
+func TestFixMDL(t *testing.T) {
+	dir := t.TempDir()
+	// Uppercase name + internal mismatch.
+	upper := filepath.Join(dir, "Foo.MDL")
+	body := "newmodel wrong\nbeginmodelgeom wrong\nendmodelgeom wrong\ndonemodel wrong\n"
+	if err := os.WriteFile(upper, []byte(body), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	// dry-run: nothing changes on disk.
+	var out, errw bytes.Buffer
+	if code := runFixMDL([]string{"--dry-run", dir}, &out, &errw); code != exitOK {
+		t.Fatalf("dry-run exit = %d\n%s", code, errw.String())
+	}
+	if _, err := os.Stat(upper); err != nil {
+		t.Fatal("dry-run renamed a file")
+	}
+
+	// real run: file is lowercased and its identity rewritten to match.
+	out.Reset()
+	errw.Reset()
+	if code := runFixMDL([]string{dir}, &out, &errw); code != exitOK {
+		t.Fatalf("fix exit = %d\n%s", code, errw.String())
+	}
+	lowered := filepath.Join(dir, "foo.mdl")
+	if _, err := os.Stat(lowered); err != nil {
+		t.Fatalf("file was not lowercased: %v", err)
+	}
+	mismatches, err := mdl.CheckNames(lowered)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(mismatches) != 0 {
+		data, _ := os.ReadFile(lowered)
+		t.Fatalf("model still has mismatches after fix: %+v\n%s", mismatches, data)
+	}
+}

internal/assets/helpers.go

@@ -0,0 +1,84 @@
+// Package assets is the crucible `assets` builder: NWN:EE model/texture tools
+// that operate in place on a target directory. Mirrors internal/depot's
+// Run(args, stdout, stderr, getenv) shape and bypasses the legacy internal/app
+// surface entirely.
+package assets
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"sort"
+	"strings"
+)
+
+// runner is the single external-command indirection so tests can observe and
+// stub every engine / ImageMagick / upscaler invocation. dir is the working
+// directory ("" = inherit); env replaces the child environment when non-nil.
+var runner = func(dir string, env []string, name string, args ...string) ([]byte, error) {
+	cmd := exec.Command(name, args...)
+	cmd.Dir = dir
+	if env != nil {
+		cmd.Env = env
+	}
+	return cmd.CombinedOutput()
+}
+
+// walk collects files under each root whose lower-cased extension is in exts. A
+// root that is itself a matching file is included. recursive controls descent
+// into subdirectories. Results are sorted and deduplicated.
+func walk(roots []string, exts map[string]bool, recursive bool) ([]string, error) {
+	seen := map[string]bool{}
+	var out []string
+	add := func(p string) {
+		if exts[strings.ToLower(filepath.Ext(p))] && !seen[p] {
+			seen[p] = true
+			out = append(out, p)
+		}
+	}
+	for _, root := range roots {
+		fi, err := os.Stat(root)
+		if err != nil {
+			return nil, err
+		}
+		if !fi.IsDir() {
+			add(root)
+			continue
+		}
+		err = filepath.WalkDir(root, func(p string, d os.DirEntry, err error) error {
+			if err != nil {
+				return err
+			}
+			if d.IsDir() {
+				if !recursive && p != root {
+					return filepath.SkipDir
+				}
+				return nil
+			}
+			add(p)
+			return nil
+		})
+		if err != nil {
+			return nil, err
+		}
+	}
+	sort.Strings(out)
+	return out, nil
+}
+
+// look returns the first bare name found on PATH, or the first candidate that
+// is an existing path. Returns "" if none resolve.
+func look(candidates ...string) string {
+	for _, c := range candidates {
+		if strings.ContainsRune(c, filepath.Separator) {
+			if fi, err := os.Stat(c); err == nil && !fi.IsDir() {
+				return c
+			}
+			continue
+		}
+		if p, err := exec.LookPath(c); err == nil {
+			return p
+		}
+	}
+	return ""
+}

internal/assets/helpers_test.go

@@ -0,0 +1,63 @@
+package assets
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestWalk(t *testing.T) {
+	root := t.TempDir()
+	must := func(rel string) {
+		p := filepath.Join(root, rel)
+		if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(p, []byte("x"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	must("a.MDL")
+	must("sub/b.mdl")
+	must("sub/c.txt")
+
+	exts := map[string]bool{".mdl": true}
+	got, err := walk([]string{root}, exts, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 2 {
+		t.Fatalf("recursive walk = %v, want 2 mdl files", got)
+	}
+
+	got, _ = walk([]string{root}, exts, false)
+	if len(got) != 1 || filepath.Base(got[0]) != "a.MDL" {
+		t.Fatalf("non-recursive walk = %v, want only a.MDL", got)
+	}
+
+	// A file argument that matches is included directly.
+	got, _ = walk([]string{filepath.Join(root, "sub", "b.mdl")}, exts, true)
+	if len(got) != 1 {
+		t.Fatalf("file arg walk = %v, want the file itself", got)
+	}
+}
+
+func TestLook(t *testing.T) {
+	dir := t.TempDir()
+	stub := filepath.Join(dir, "mytool")
+	if err := os.WriteFile(stub, []byte("#!/bin/sh\n"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("PATH", dir)
+
+	if got := look("nope-not-here", "mytool"); got == "" {
+		t.Fatal("look should find mytool on PATH")
+	}
+	// Explicit existing path candidate.
+	if got := look(stub); got != stub {
+		t.Fatalf("look(%q) = %q, want the path itself", stub, got)
+	}
+	if got := look("definitely-absent-binary-xyz"); got != "" {
+		t.Fatalf("look = %q, want empty", got)
+	}
+}

internal/assets/mdl/mdl.go

@@ -0,0 +1,218 @@
+// Package mdl ports the ASCII MDL model-name checks from sow-assets-manifest's
+// mdl-name-lib.sh + mdl-scan.awk to pure Go. Binary (compiled) MDLs are opaque
+// here; the NWN engine is the validator for those. Detection mirrors
+// mdl-scan.awk exactly so behavior does not drift while that awk still runs in
+// sow-assets-manifest.
+package mdl
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// Mismatch is one model-name problem. Line is 1-based; 0 means the geometry
+// base-node mismatch, which the source has no single line for.
+type Mismatch struct {
+	Line int
+	What string
+	Got  string
+}
+
+// ExpectedName is the file stem with a trailing ".mdl" (any case) removed.
+func ExpectedName(path string) string {
+	base := filepath.Base(path)
+	if len(base) >= 4 && strings.EqualFold(base[len(base)-4:], ".mdl") {
+		return base[:len(base)-4]
+	}
+	return base
+}
+
+// ExpectedNameStem is an alias of ExpectedName kept for call-site clarity where
+// the value is used as the engine's model stem argument.
+func ExpectedNameStem(path string) string { return ExpectedName(path) }
+
+// IsASCII reports whether path is an uncompiled ASCII model: no NUL in the
+// first 256 bytes, and a leading keyword of '#' / newmodel / node /
+// setsupermodel. Mirrors mdl_is_ascii.
+func IsASCII(path string) (bool, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return false, err
+	}
+	return isASCII(data), nil
+}
+
+func isASCII(data []byte) bool {
+	head := data
+	if len(head) > 256 {
+		head = head[:256]
+	}
+	if bytes.IndexByte(head, 0) >= 0 {
+		return false
+	}
+	line := head
+	if i := bytes.IndexByte(line, '\n'); i >= 0 {
+		line = line[:i]
+	}
+	trimmed := strings.TrimLeft(string(line), " \t\r")
+	if strings.HasPrefix(trimmed, "#") {
+		return true
+	}
+	fields := strings.Fields(trimmed)
+	if len(fields) == 0 {
+		return false
+	}
+	tok := strings.ToLower(fields[0])
+	return strings.HasPrefix(tok, "newmodel") ||
+		strings.HasPrefix(tok, "node") ||
+		strings.HasPrefix(tok, "setsupermodel")
+}
+
+// lineFields splits a line into whitespace-delimited tokens with the trailing
+// CR removed, matching awk's default field split + \r strip.
+func lineFields(line string) []string {
+	return strings.Fields(strings.TrimRight(line, "\r"))
+}
+
+// field returns the 1-based nth field or "" if absent.
+func field(f []string, n int) string {
+	if n >= 1 && n <= len(f) {
+		return f[n-1]
+	}
+	return ""
+}
+
+// CheckNames returns every model-name mismatch in an ASCII model. Returns nil
+// for a binary model or one with no newmodel line (not a real model).
+func CheckNames(path string) ([]Mismatch, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+	if !isASCII(data) {
+		return nil, nil
+	}
+	return checkNames(data, ExpectedName(path)), nil
+}
+
+func checkNames(data []byte, expected string) []Mismatch {
+	expLower := strings.ToLower(expected)
+	var out []Mismatch
+	seenModel := false
+	inGeom := false
+	curNode := ""
+	base := ""
+	baseFound := false
+
+	// header records one header-token mismatch (field n, 1-based) if the token
+	// is present and differs case-insensitively from the stem.
+	lines := strings.Split(string(data), "\n")
+	for i, raw := range lines {
+		f := lineFields(raw)
+		if len(f) == 0 {
+			continue
+		}
+		key := strings.ToLower(f[0])
+		mis := func(what string, n int) {
+			got := field(f, n)
+			if got != "" && !strings.EqualFold(got, expected) {
+				out = append(out, Mismatch{Line: i + 1, What: what, Got: got})
+			}
+		}
+		switch key {
+		case "newmodel":
+			seenModel = true
+			mis("newmodel", 2)
+		case "setsupermodel":
+			mis("setsupermodel model", 2)
+		case "beginmodelgeom":
+			inGeom = true
+			mis("beginmodelgeom", 2)
+		case "endmodelgeom":
+			inGeom = false
+			mis("endmodelgeom", 2)
+		case "donemodel":
+			mis("donemodel", 2)
+		case "newanim":
+			mis("newanim model", 3)
+		case "doneanim":
+			mis("doneanim model", 3)
+		case "node":
+			if inGeom {
+				curNode = field(f, 3)
+			}
+		case "parent":
+			if inGeom && !baseFound && strings.EqualFold(field(f, 2), "null") {
+				base = curNode
+				baseFound = true
+			}
+		}
+	}
+	if !seenModel {
+		return nil
+	}
+	if baseFound && base != "" && !strings.EqualFold(base, expLower) {
+		out = append(out, Mismatch{Line: 0, What: "root node", Got: base})
+	}
+	return out
+}
+
+// FixNames rewrites only the model identity to expected: the header tokens plus
+// the geometry base node's declaration / any parent / animroot pointing at the
+// old base name. Animation bone names and supermodel animroots are left alone
+// so inheritance keeps working. Mirrors mdl_fix_model_name in intent.
+//
+// ponytail: a rewritten line is rebuilt joining fields with single spaces and
+// drops a trailing CR, exactly like the awk it replaces; unchanged lines are
+// byte-identical. The engine ignores identity-line whitespace, and FixNames'
+// contract is only "produces a model that passes CheckNames", not byte parity.
+func FixNames(in []byte, expected string) (out []byte, changed bool) {
+	if !isASCII(in) {
+		return in, false
+	}
+	// oldbase: the base-node name to rename, only if it differs from expected.
+	oldbase := ""
+	for _, m := range checkNames(in, expected) {
+		if m.What == "root node" {
+			oldbase = m.Got
+		}
+	}
+
+	lines := strings.Split(string(in), "\n")
+	for idx, raw := range lines {
+		f := lineFields(raw)
+		if len(f) == 0 {
+			continue
+		}
+		key := strings.ToLower(f[0])
+		set := func(n int) bool {
+			if field(f, n) == "" {
+				return false
+			}
+			f[n-1] = expected
+			return true
+		}
+		modified := false
+		switch key {
+		case "newmodel", "setsupermodel", "beginmodelgeom", "endmodelgeom", "donemodel":
+			modified = set(2)
+		case "newanim", "doneanim":
+			modified = set(3)
+		case "node":
+			if oldbase != "" && strings.EqualFold(field(f, 3), oldbase) {
+				modified = set(3)
+			}
+		case "parent", "animroot":
+			if oldbase != "" && strings.EqualFold(field(f, 2), oldbase) {
+				modified = set(2)
+			}
+		}
+		if modified {
+			lines[idx] = strings.Join(f, " ")
+		}
+	}
+	out = []byte(strings.Join(lines, "\n"))
+	return out, !bytes.Equal(out, in)
+}

internal/assets/mdl/mdl_test.go

@@ -0,0 +1,114 @@
+package mdl
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func writeMDL(t *testing.T, name, body string) string {
+	t.Helper()
+	p := filepath.Join(t.TempDir(), name)
+	if err := os.WriteFile(p, []byte(body), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	return p
+}
+
+func TestIsASCII(t *testing.T) {
+	ascii := writeMDL(t, "foo.mdl", "newmodel foo\nbeginmodelgeom foo\n")
+	if ok, err := IsASCII(ascii); err != nil || !ok {
+		t.Fatalf("ascii: ok=%v err=%v, want true nil", ok, err)
+	}
+	bin := writeMDL(t, "bar.mdl", "\x00\x01binary\x00garbage")
+	if ok, err := IsASCII(bin); err != nil || ok {
+		t.Fatalf("binary: ok=%v err=%v, want false nil", ok, err)
+	}
+	hash := writeMDL(t, "baz.mdl", "# a comment\nnewmodel baz\n")
+	if ok, _ := IsASCII(hash); !ok {
+		t.Fatal("leading # should be ascii")
+	}
+}
+
+func TestExpectedName(t *testing.T) {
+	for in, want := range map[string]string{
+		"a/b/Foo.MDL":     "Foo",
+		"waxbt_b_091.mdl": "waxbt_b_091",
+		"x.mdl":           "x",
+	} {
+		if got := ExpectedName(in); got != want {
+			t.Errorf("ExpectedName(%q)=%q want %q", in, got, want)
+		}
+	}
+}
+
+func TestCheckNames(t *testing.T) {
+	// Header token mismatch + base-node mismatch in one file.
+	body := "newmodel wrong\n" +
+		"setsupermodel wrong a_base\n" +
+		"beginmodelgeom foo\n" +
+		"  node dummy Wmgst_m_081\n" +
+		"    parent null\n" +
+		"  endnode\n" +
+		"endmodelgeom foo\n" +
+		"donemodel foo\n"
+	p := writeMDL(t, "foo.mdl", body)
+	got, err := CheckNames(p)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Expected stem "foo": newmodel(wrong), setsupermodel(wrong), base node(Wmgst_m_081).
+	if len(got) != 3 {
+		t.Fatalf("got %d mismatches, want 3: %+v", len(got), got)
+	}
+	if got[0].What != "newmodel" || got[0].Got != "wrong" || got[0].Line != 1 {
+		t.Errorf("first mismatch = %+v", got[0])
+	}
+	base := got[len(got)-1]
+	if base.What != "root node" || base.Got != "Wmgst_m_081" || base.Line != 0 {
+		t.Errorf("base mismatch = %+v", base)
+	}
+
+	// Clean model -> no mismatches.
+	clean := writeMDL(t, "bar.mdl",
+		"newmodel bar\nbeginmodelgeom bar\n  node dummy bar\n    parent null\n  endnode\nendmodelgeom bar\ndonemodel bar\n")
+	if got, _ := CheckNames(clean); len(got) != 0 {
+		t.Fatalf("clean model reported mismatches: %+v", got)
+	}
+
+	// Binary model -> nil, no error.
+	bin := writeMDL(t, "b.mdl", "\x00\x00binary")
+	if got, _ := CheckNames(bin); got != nil {
+		t.Fatalf("binary reported mismatches: %+v", got)
+	}
+}
+
+func TestFixNamesRoundTrips(t *testing.T) {
+	body := "newmodel wrong\n" +
+		"setsupermodel wrong\n" +
+		"beginmodelgeom wrong\n" +
+		"  node dummy Wmgst_m_081\n" +
+		"    parent null\n" +
+		"  endnode\n" +
+		"endmodelgeom wrong\n" +
+		"donemodel wrong\n"
+	out, changed := FixNames([]byte(body), "foo")
+	if !changed {
+		t.Fatal("expected changed=true")
+	}
+	p := filepath.Join(t.TempDir(), "foo.mdl")
+	if err := os.WriteFile(p, out, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	got, err := CheckNames(p)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 0 {
+		t.Fatalf("fixed model still has mismatches: %+v\n%s", got, out)
+	}
+	// Idempotent: fixing a clean model changes nothing.
+	if _, changed := FixNames(out, "foo"); changed {
+		t.Fatal("second fix reported a change")
+	}
+}

internal/assets/run.go

@@ -0,0 +1,55 @@
+package assets
+
+import (
+	"fmt"
+	"io"
+)
+
+const (
+	exitOK    = 0
+	exitFail  = 1  // problems found / per-file failures
+	exitUsage = 64 // bad invocation / unknown subcommand / bad flags
+	exitTool  = 70 // missing external tool / internal error
+)
+
+// Run executes an assets subcommand. args[0] is the subcommand; returns the
+// process exit code.
+func Run(args []string, stdout, stderr io.Writer, getenv func(string) string) int {
+	if len(args) == 0 {
+		printUsage(stderr)
+		return exitUsage
+	}
+	rest := args[1:]
+	switch args[0] {
+	case "check-dupes":
+		return runCheckDupes(rest, stdout, stderr)
+	case "clean-dupes":
+		return runCleanDupes(rest, stdout, stderr)
+	case "check-mdl":
+		return runCheckMDL(rest, stdout, stderr)
+	case "fix-mdl":
+		return runFixMDL(rest, stdout, stderr)
+	case "convert":
+		return runConvert(rest, stdout, stderr)
+	case "upscale":
+		return runUpscale(rest, stdout, stderr)
+	case "compile":
+		return runCompile(rest, stdout, stderr, getenv)
+	default:
+		fmt.Fprintf(stderr, "assets: unknown subcommand %q\n\n", args[0])
+		printUsage(stderr)
+		return exitUsage
+	}
+}
+
+func printUsage(w io.Writer) {
+	fmt.Fprint(w, `usage:
+  assets compile      [--nwn INSTALL] [--non-recursive] <dir>...
+  assets convert      [--to dds|png|tga] [--backend PATH] [--non-recursive] <dir>...
+  assets upscale      [--scale N] [--backend PATH] [--non-recursive] <dir>...
+  assets check-mdl    <path>...
+  assets fix-mdl      [--dry-run] <path>...
+  assets check-dupes  <dir>...
+  assets clean-dupes  [--dry-run] <primary> <clean>
+`)
+}

internal/assets/run_test.go

@@ -0,0 +1,26 @@
+package assets
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+)
+
+func env(string) string { return "" }
+
+func TestRunNoArgsIsUsage(t *testing.T) {
+	var out, errw bytes.Buffer
+	if code := Run(nil, &out, &errw, env); code != exitUsage {
+		t.Fatalf("no args exit = %d, want %d", code, exitUsage)
+	}
+	if !strings.Contains(errw.String(), "usage") {
+		t.Fatalf("no args should print usage, got: %q", errw.String())
+	}
+}
+
+func TestRunUnknownSubcommandIsUsage(t *testing.T) {
+	var out, errw bytes.Buffer
+	if code := Run([]string{"frobnicate"}, &out, &errw, env); code != exitUsage {
+		t.Fatalf("unknown subcommand exit = %d, want %d", code, exitUsage)
+	}
+}

internal/assets/upscale.go

@@ -0,0 +1,98 @@
+package assets
+
+import (
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+)
+
+var upscaleBackends = []string{"upscayl-bin", "upscayl", "realesrgan-ncnn-vulkan", "waifu2x-ncnn-vulkan"}
+
+// runUpscale upscales textures in place through an installed ncnn-vulkan
+// backend. DDS inputs are bridged through PNG so the NWN flip stays correct.
+func runUpscale(args []string, stdout, stderr io.Writer) int {
+	fs := flag.NewFlagSet("upscale", flag.ContinueOnError)
+	fs.SetOutput(stderr)
+	scale := fs.Int("scale", 4, "upscale factor")
+	backend := fs.String("backend", "", "override the upscaler binary")
+	nonRecursive := fs.Bool("non-recursive", false, "do not descend into subdirectories")
+	if err := fs.Parse(args); err != nil {
+		return exitUsage
+	}
+	dirs := fs.Args()
+	if len(dirs) == 0 {
+		fmt.Fprintln(stderr, "assets upscale: usage: upscale [--scale N] <dir>...")
+		return exitUsage
+	}
+
+	candidates := upscaleBackends
+	if *backend != "" {
+		candidates = []string{*backend}
+	}
+	tool := look(candidates...)
+	if tool == "" {
+		fmt.Fprintf(stderr, "assets upscale: no upscaler found — install one of: %s\n", strings.Join(upscaleBackends, ", "))
+		return exitTool
+	}
+
+	files, err := walk(dirs, textureExts, !*nonRecursive)
+	if err != nil {
+		fmt.Fprintln(stderr, "assets upscale:", err)
+		return exitUsage
+	}
+
+	// magick is only needed if a .dds input is present; resolve lazily.
+	magick := ""
+	failed := false
+	for _, src := range files {
+		var upErr error
+		if strings.EqualFold(filepath.Ext(src), ".dds") {
+			if magick == "" {
+				if magick = look("magick"); magick == "" {
+					fmt.Fprintln(stderr, "assets upscale: .dds input needs ImageMagick (magick) for the png bridge")
+					return exitTool
+				}
+			}
+			upErr = upscaleDDS(tool, magick, src, *scale)
+		} else {
+			upErr = upscaleImage(tool, src, src, *scale)
+		}
+		if upErr != nil {
+			fmt.Fprintf(stderr, "assets upscale: %s: %v\n", src, upErr)
+			failed = true
+		}
+	}
+	if failed {
+		return exitFail
+	}
+	return exitOK
+}
+
+// upscaleImage runs the ncnn-vulkan backend to upscale src into dst (may be the
+// same path).
+func upscaleImage(tool, src, dst string, scale int) error {
+	tmp := dst + ".upscaled.png"
+	out, err := runner("", nil, tool, "-i", src, "-o", tmp, "-s", strconv.Itoa(scale))
+	if err != nil {
+		return fmt.Errorf("%s: %v: %s", filepath.Base(tool), err, strings.TrimSpace(string(out)))
+	}
+	return os.Rename(tmp, dst)
+}
+
+// upscaleDDS bridges a DDS through PNG: dds->png (flip), upscale, png->dds
+// (flip back), yielding a correctly-flipped upscaled DDS.
+func upscaleDDS(tool, magick, src string, scale int) error {
+	tmpPNG := src + ".bridge.png"
+	if err := ddsToPNG(magick, src, tmpPNG); err != nil {
+		return err
+	}
+	defer os.Remove(tmpPNG)
+	if err := upscaleImage(tool, tmpPNG, tmpPNG, scale); err != nil {
+		return err
+	}
+	return pngToDDS(magick, tmpPNG, src)
+}

internal/assets/upscale_test.go

@@ -0,0 +1,69 @@
+package assets
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestUpscalePNGUsesBackend(t *testing.T) {
+	// A fake backend binary on PATH so look() resolves it.
+	binDir := t.TempDir()
+	fake := filepath.Join(binDir, "upscayl-bin")
+	if err := os.WriteFile(fake, []byte("#!/bin/sh\n"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("PATH", binDir)
+
+	// Stub runner: emulate `-i in -o out -s scale` by copying in->out.
+	orig := runner
+	defer func() { runner = orig }()
+	var gotScale string
+	runner = func(dir string, env []string, name string, args ...string) ([]byte, error) {
+		var in, out string
+		for i := 0; i < len(args)-1; i++ {
+			switch args[i] {
+			case "-i":
+				in = args[i+1]
+			case "-o":
+				out = args[i+1]
+			case "-s":
+				gotScale = args[i+1]
+			}
+		}
+		data, err := os.ReadFile(in)
+		if err != nil {
+			return nil, err
+		}
+		return nil, os.WriteFile(out, data, 0o644)
+	}
+
+	dir := t.TempDir()
+	src := filepath.Join(dir, "tex.png")
+	if err := os.WriteFile(src, []byte("pngdata"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	var stdout, stderr bytes.Buffer
+	if code := runUpscale([]string{"--scale", "2", dir}, &stdout, &stderr); code != exitOK {
+		t.Fatalf("upscale exit = %d\n%s", code, stderr.String())
+	}
+	if gotScale != "2" {
+		t.Fatalf("scale passed to backend = %q, want 2", gotScale)
+	}
+	if data, _ := os.ReadFile(src); string(data) != "pngdata" {
+		t.Fatalf("upscaled file content = %q, want the backend output", data)
+	}
+}
+
+func TestUpscaleNoBackendFailsClosed(t *testing.T) {
+	t.Setenv("PATH", t.TempDir()) // empty PATH: no backend resolvable
+	dir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(dir, "tex.png"), []byte("x"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	var stdout, stderr bytes.Buffer
+	if code := runUpscale([]string{dir}, &stdout, &stderr); code != exitTool {
+		t.Fatalf("no-backend exit = %d, want %d", code, exitTool)
+	}
+}

internal/depot/keystore.go

@@ -0,0 +1,121 @@
+package depot
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"strings"
+)
+
+// KeyStore is the zone addressed by object key rather than by depot sha. The
+// depot names every object after the sha256 of its contents; NWSync does not —
+// a blob is named after the sha1 of its *uncompressed* bytes while the body
+// uploaded is the compressed form, and a per-artifact index is named after its
+// artifact. Both addressing modes want the same transport, retry and probe
+// discipline, so the sha-addressed Backend rides on this rather than the other
+// way round.
+type KeyStore interface {
+	// ProbeKey returns the existence state of one key. transient=true means a
+	// retry might change the answer — never read it as "missing, re-upload".
+	ProbeKey(ctx context.Context, key string) (state ProbeState, transient bool, err error)
+	// PutReader uploads size bytes read from r to key. checksum is the
+	// uppercase hex sha256 of those bytes, which Bunny verifies server-side.
+	PutReader(ctx context.Context, key string, r io.Reader, size int64, checksum string) error
+	// GetKey fetches the whole object at key. Small objects only — it holds
+	// the body in memory and does no hash check, because a key is not always
+	// a content hash.
+	GetKey(ctx context.Context, key string) ([]byte, error)
+}
+
+// NewKeyStore returns a KeyStore for cfg's storage zone. Fails closed on a
+// missing host or read key, matching NewBackend.
+func NewKeyStore(cfg Config) (KeyStore, error) {
+	if cfg.StorageHost == "" {
+		return nil, errors.New("storage backend requires a storage host")
+	}
+	if cfg.StorageZone == "" {
+		return nil, errors.New("storage backend requires a storage zone")
+	}
+	if cfg.ReadKey == "" {
+		return nil, errors.New("storage backend requires a read key")
+	}
+	return &httpBackend{name: "bunny", client: newHTTPClient(cfg), cfg: cfg}, nil
+}
+
+// keyURL is the storage URL of one object key.
+func (b *httpBackend) keyURL(key string) string {
+	host := b.cfg.StorageHost
+	// StorageHost is normally a bare host ("storage.bunnycdn.com"); allow a
+	// full scheme (used by tests against httptest.NewServer) to pass through
+	// unchanged.
+	if !strings.Contains(host, "://") {
+		host = "https://" + host
+	}
+	return fmt.Sprintf("%s/%s/%s", strings.TrimSuffix(host, "/"), b.cfg.StorageZone, key)
+}
+
+func (b *httpBackend) ProbeKey(ctx context.Context, key string) (ProbeState, bool, error) {
+	return b.rangeProbe(ctx, b.keyURL(key), map[string]string{"AccessKey": b.cfg.ReadKey})
+}
+
+func (b *httpBackend) PutReader(ctx context.Context, key string, r io.Reader, size int64, checksum string) error {
+	if b.name == "cdn" {
+		return errors.New("cdn backend is read-only")
+	}
+	if b.cfg.WriteKey == "" {
+		return errors.New("storage backend requires a write key to write")
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPut, b.keyURL(key), r)
+	if err != nil {
+		return err
+	}
+	req.ContentLength = size
+	req.Header.Set("AccessKey", b.cfg.WriteKey)
+	// Bunny defines Checksum as sha256 of the body and rejects a mismatch, so
+	// this is server-side integrity checking, not decoration.
+	req.Header.Set("Checksum", strings.ToUpper(checksum))
+
+	resp, err := b.client.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	_, _ = io.Copy(io.Discard, resp.Body)
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return fmt.Errorf("put %s: unexpected status %d", key, resp.StatusCode)
+	}
+	return nil
+}
+
+func (b *httpBackend) GetKey(ctx context.Context, key string) ([]byte, error) {
+	resp, err := b.get(ctx, b.keyURL(key), map[string]string{"AccessKey": b.cfg.ReadKey})
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		_, _ = io.Copy(io.Discard, resp.Body)
+		return nil, fmt.Errorf("get %s: unexpected status %d", key, resp.StatusCode)
+	}
+	return io.ReadAll(resp.Body)
+}
+
+// putFile uploads the file at src to key, streaming it. checksum is the
+// uppercase hex sha256 of the file's bytes.
+func (b *httpBackend) putFile(ctx context.Context, key, src, checksum string) error {
+	f, err := os.Open(src)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	info, err := f.Stat()
+	if err != nil {
+		return err
+	}
+	return b.PutReader(ctx, key, f, info.Size(), checksum)
+}

internal/depot/remote.go

@@ -10,7 +10,6 @@ import (
 	"net/http"
 	"os"
 	"path/filepath"
-	"strings"
 	"time"
 )
 
@@ -71,16 +70,7 @@ type httpBackend struct {
 
 func (b *httpBackend) Name() string { return b.name }
 
-func (b *httpBackend) storageURL(sha string) string {
-	host := b.cfg.StorageHost
-	// StorageHost is normally a bare host ("storage.bunnycdn.com"); allow a
-	// full scheme (used by tests against httptest.NewServer) to pass through
-	// unchanged.
-	if strings.Contains(host, "://") {
-		return fmt.Sprintf("%s/%s/%s", strings.TrimSuffix(host, "/"), b.cfg.StorageZone, BlobKey(sha))
-	}
-	return fmt.Sprintf("https://%s/%s/%s", host, b.cfg.StorageZone, BlobKey(sha))
-}
+func (b *httpBackend) storageURL(sha string) string { return b.keyURL(BlobKey(sha)) }
 
 func (b *httpBackend) cdnURL(sha string) string {
 	return fmt.Sprintf("%s/%s", b.cfg.CDNBase, BlobKey(sha))
@@ -140,7 +130,8 @@ func (b *httpBackend) Probe(ctx context.Context, sha string) (ProbeState, bool,
 	return b.rangeProbe(ctx, b.storageURL(sha), map[string]string{"AccessKey": b.cfg.ReadKey})
 }
 
-// Put uploads src for sha. cdn is read-only.
+// Put uploads src for sha. cdn is read-only. A depot object is named after the
+// sha256 of its own bytes, so the key's sha doubles as the Checksum header.
 func (b *httpBackend) Put(ctx context.Context, sha, src string) error {
 	if b.name == "cdn" {
 		return errors.New("cdn backend is read-only")
@@ -157,30 +148,7 @@ func (b *httpBackend) Put(ctx context.Context, sha, src string) error {
 		return nil
 	}
 
-	f, err := os.Open(src)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
-
-	req, err := http.NewRequestWithContext(ctx, http.MethodPut, b.storageURL(sha), f)
-	if err != nil {
-		return err
-	}
-	req.Header.Set("AccessKey", b.cfg.WriteKey)
-	req.Header.Set("Checksum", strings.ToUpper(sha))
-
-	resp, err := b.client.Do(req)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-	_, _ = io.Copy(io.Discard, resp.Body)
-
-	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
-		return fmt.Errorf("bunny put %s: unexpected status %d", sha, resp.StatusCode)
-	}
-	return nil
+	return b.putFile(ctx, BlobKey(sha), src, sha)
 }
 
 // Get fetches sha into dest via temp file + rename, re-hashing and deleting

internal/depot/run.go

@@ -11,6 +11,7 @@ import (
 	"os"
 	"path/filepath"
 	"sort"
+	"strings"
 	"sync"
 	"time"
 )
@@ -51,13 +52,15 @@ func Run(args []string, stdout, stderr io.Writer, getenv func(string) string) in
 
 func printRunUsage(w io.Writer) {
 	fmt.Fprint(w, `usage:
-  depot status [--manifests DIR] [--source LOCAL_DEPOT] --target bunny|cdn|local
-  depot push   [--manifests DIR] --source LOCAL_DEPOT   --target bunny
-  depot verify [--manifests DIR] --target bunny|cdn     [--sample N]
-  depot get    <sha> <dest>       --target cdn|bunny|local
-  depot pull   [--manifests DIR] --dest DIR             --target cdn|bunny
+  depot status [--manifests DIR] --target bunny|cdn | --out DIR
+  depot push   [--manifests DIR] --source LOCAL_DEPOT --target bunny
+  depot verify [--manifests DIR] --target bunny|cdn   [--sample N]
+  depot get    <sha> <dest>      --target cdn|bunny   | --out DIR
+  depot pull   [--manifests DIR] --dest DIR           --target cdn|bunny
 
---target local uses the DEPOT_DIR environment variable as the local root.
+--out DIR reads and writes a depot tree on disk at DIR instead of a remote
+backend. --target names a remote backend only; the two are mutually exclusive.
+--target local is a deprecated alias for --out $DEPOT_DIR.
 `)
 }
 
@@ -65,16 +68,27 @@ func printRunUsage(w io.Writer) {
 // than internal/backend failures (exit 70).
 var errUsage = errors.New("usage error")
 
-// resolveBackend builds the named backend, resolving "local" against DEPOT_DIR.
-func resolveBackend(target string, getenv func(string) string, cfg Config) (Backend, error) {
-	root := ""
-	if target == "local" {
-		root = getenv("DEPOT_DIR")
+// resolveBackend picks the backend for a command that can work either against a
+// depot tree on disk (--out DIR) or a remote backend (--target bunny|cdn).
+// "--target local" stays as a deprecated alias for --out $DEPOT_DIR so older
+// callers keep working.
+func resolveBackend(out, target string, getenv func(string) string, cfg Config) (Backend, error) {
+	switch {
+	case out != "" && target != "":
+		return nil, fmt.Errorf("--out and --target are mutually exclusive: %w", errUsage)
+	case out != "":
+		return NewBackend("local", out, cfg)
+	case target == "local":
+		root := getenv("DEPOT_DIR")
 		if root == "" {
-			return nil, fmt.Errorf("--target local requires DEPOT_DIR to be set: %w", errUsage)
+			return nil, fmt.Errorf("--target local requires DEPOT_DIR to be set (prefer --out DIR): %w", errUsage)
 		}
+		return NewBackend("local", root, cfg)
+	case target == "":
+		return nil, fmt.Errorf("--out DIR or --target bunny|cdn is required: %w", errUsage)
+	default:
+		return NewBackend(target, "", cfg)
 	}
-	return NewBackend(target, root, cfg)
 }
 
 // backendErrExit maps a resolveBackend error onto the exit contract.
@@ -119,18 +133,18 @@ func runStatus(args []string, stdout, stderr io.Writer, getenv func(string) stri
 	fs := flag.NewFlagSet("status", flag.ContinueOnError)
 	fs.SetOutput(stderr)
 	manifests := fs.String("manifests", "assets", "directory of *.yml manifests")
-	_ = fs.String("source", "", "local depot root (unused for status target=local; see DEPOT_DIR)")
-	target := fs.String("target", "", "bunny|cdn|local")
+	source := fs.String("source", "", "deprecated and ignored (use --out DIR for a depot tree on disk)")
+	out := fs.String("out", "", "depot tree on disk to read instead of a remote backend")
+	target := fs.String("target", "", "bunny|cdn")
 	if err := fs.Parse(args); err != nil {
 		return exitUsage
 	}
-	if *target == "" {
-		fmt.Fprintln(stderr, "depot status: --target is required")
-		return exitUsage
+	if *source != "" {
+		fmt.Fprintln(stderr, "depot status: --source is ignored; use --out DIR")
 	}
 
 	cfg := LoadConfig(getenv)
-	backend, err := resolveBackend(*target, getenv, cfg)
+	backend, err := resolveBackend(*out, *target, getenv, cfg)
 	if err != nil {
 		fmt.Fprintln(stderr, "depot status:", err)
 		return backendErrExit(err)
@@ -309,13 +323,21 @@ func runVerify(args []string, stdout, stderr io.Writer, getenv func(string) stri
 func runGet(args []string, stdout, stderr io.Writer, getenv func(string) string) int {
 	fs := flag.NewFlagSet("get", flag.ContinueOnError)
 	fs.SetOutput(stderr)
-	target := fs.String("target", "", "cdn|bunny|local")
-	if err := fs.Parse(args); err != nil {
+	out := fs.String("out", "", "depot tree on disk to read instead of a remote backend")
+	target := fs.String("target", "", "cdn|bunny")
+	// Positionals come first in the documented usage, and Go's flag package
+	// stops parsing at the first one, so split them off by hand.
+	split := 0
+	for split < len(args) && !strings.HasPrefix(args[split], "-") {
+		split++
+	}
+	positional := args[:split]
+	if err := fs.Parse(args[split:]); err != nil {
 		return exitUsage
 	}
-	positional := fs.Args()
+	positional = append(positional, fs.Args()...)
 	if len(positional) != 2 {
-		fmt.Fprintln(stderr, "depot get: usage: depot get <sha> <dest> --target cdn|bunny|local")
+		fmt.Fprintln(stderr, "depot get: usage: depot get <sha> <dest> --target cdn|bunny | --out DIR")
 		return exitUsage
 	}
 	sha, dest := positional[0], positional[1]
@@ -323,13 +345,9 @@ func runGet(args []string, stdout, stderr io.Writer, getenv func(string) string)
 		fmt.Fprintf(stderr, "depot get: invalid sha %q\n", sha)
 		return exitUsage
 	}
-	if *target == "" {
-		fmt.Fprintln(stderr, "depot get: --target is required")
-		return exitUsage
-	}
 
 	cfg := LoadConfig(getenv)
-	backend, err := resolveBackend(*target, getenv, cfg)
+	backend, err := resolveBackend(*out, *target, getenv, cfg)
 	if err != nil {
 		fmt.Fprintln(stderr, "depot get:", err)
 		return backendErrExit(err)

internal/depot/run_test.go

@@ -54,6 +54,91 @@ func TestRunUsage(t *testing.T) {
 	})
 }
 
+func TestOutFlag(t *testing.T) {
+	t.Run("status --out reads the given tree", func(t *testing.T) {
+		sha := shaOf("out-blob")
+		manifests := t.TempDir()
+		writeManifest(t, manifests, sha, 8)
+		depotDir := t.TempDir()
+		writeBlob(t, depotDir, sha, "out-blob")
+
+		var out, errb bytes.Buffer
+		code := Run([]string{"status", "--manifests", manifests, "--out", depotDir}, &out, &errb, testGetenv(nil))
+		if code != 0 {
+			t.Fatalf("expected 0, got %d (stdout=%s stderr=%s)", code, out.String(), errb.String())
+		}
+		if !bytesContains(out.String(), "present=1") {
+			t.Fatalf("expected present=1, got %s", out.String())
+		}
+	})
+
+	t.Run("get --out fetches from the given tree", func(t *testing.T) {
+		sha := shaOf("get-blob")
+		depotDir := t.TempDir()
+		writeBlob(t, depotDir, sha, "get-blob")
+		dest := filepath.Join(t.TempDir(), "fetched")
+
+		var out, errb bytes.Buffer
+		code := Run([]string{"get", sha, dest, "--out", depotDir}, &out, &errb, testGetenv(nil))
+		if code != 0 {
+			t.Fatalf("expected 0, got %d (stderr=%s)", code, errb.String())
+		}
+		got, err := os.ReadFile(dest)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if string(got) != "get-blob" {
+			t.Fatalf("got %q", got)
+		}
+	})
+
+	t.Run("--out with any --target is rejected", func(t *testing.T) {
+		for _, target := range []string{"bunny", "cdn", "local"} {
+			var out, errb bytes.Buffer
+			code := Run([]string{"status", "--manifests", t.TempDir(), "--out", t.TempDir(), "--target", target}, &out, &errb, testGetenv(nil))
+			if code != 64 {
+				t.Fatalf("--target %s: expected 64, got %d (stderr=%s)", target, code, errb.String())
+			}
+		}
+	})
+
+	t.Run("get accepts flags before the positionals", func(t *testing.T) {
+		sha := shaOf("flags-first-blob")
+		depotDir := t.TempDir()
+		writeBlob(t, depotDir, sha, "flags-first-blob")
+		dest := filepath.Join(t.TempDir(), "fetched")
+
+		var out, errb bytes.Buffer
+		code := Run([]string{"get", "--out", depotDir, sha, dest}, &out, &errb, testGetenv(nil))
+		if code != 0 {
+			t.Fatalf("expected 0, got %d (stderr=%s)", code, errb.String())
+		}
+	})
+
+	t.Run("neither --out nor --target is rejected", func(t *testing.T) {
+		var out, errb bytes.Buffer
+		code := Run([]string{"status", "--manifests", t.TempDir()}, &out, &errb, testGetenv(nil))
+		if code != 64 {
+			t.Fatalf("expected 64, got %d (stderr=%s)", code, errb.String())
+		}
+	})
+
+	t.Run("--target local still works as a hidden alias", func(t *testing.T) {
+		sha := shaOf("alias-blob")
+		manifests := t.TempDir()
+		writeManifest(t, manifests, sha, 11)
+		depotDir := t.TempDir()
+		writeBlob(t, depotDir, sha, "alias-blob")
+
+		var out, errb bytes.Buffer
+		code := Run([]string{"status", "--manifests", manifests, "--target", "local"}, &out, &errb,
+			testGetenv(map[string]string{"DEPOT_DIR": depotDir}))
+		if code != 0 {
+			t.Fatalf("expected 0, got %d (stdout=%s stderr=%s)", code, out.String(), errb.String())
+		}
+	})
+}
+
 func TestGetInvalidSHA(t *testing.T) {
 	var out, errb bytes.Buffer
 	dir := t.TempDir()
@@ -172,6 +257,17 @@ func bytesContains(s, substr string) bool {
 	return bytes.Contains([]byte(s), []byte(substr))
 }
 
+func writeBlob(t *testing.T, root, sha, content string) {
+	t.Helper()
+	path := filepath.Join(root, BlobKey(sha))
+	if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(path, []byte(content), 0644); err != nil {
+		t.Fatal(err)
+	}
+}
+
 func writeManifest(t *testing.T, dir, sha string, size int64) {
 	t.Helper()
 	content := fmt.Sprintf("assets:\n  - path: foo\n    sha256: %s\n    size: %d\n", sha, size)

internal/dispatch/dispatch.go

@@ -17,9 +17,11 @@ import (
 	"os"
 
 	"git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/app"
+	"git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/assets"
 	"git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/buildinfo"
 	"git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/depot"
 	"git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/menu"
+	"git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/nwsync"
 )
 
 // Exit codes follow the sysexits(3) convention so CI can distinguish
@@ -93,16 +95,42 @@ var Registry = []Builder{
 	{
 		Name:    "depot",
 		Bin:     "crucible-depot",
-		Summary: "content-addressed asset depot (local/cdn/bunny)",
+		Summary: "content-addressed asset depot (disk/cdn/bunny)",
 		Commands: []Command{
-			{Name: "status", Summary: "report referenced-vs-present drift against a backend", Usage: "crucible depot status [--manifests DIR] [--source DIR] --target bunny|cdn|local"},
+			{Name: "status", Summary: "report referenced-vs-present drift against a backend", Usage: "crucible depot status [--manifests DIR] --target bunny|cdn | --out DIR"},
 			{Name: "push", Summary: "upload referenced-but-absent blobs from a local depot", Usage: "crucible depot push [--manifests DIR] --source DIR --target bunny"},
 			{Name: "verify", Summary: "existence sweep plus sampled download re-hash", Usage: "crucible depot verify [--manifests DIR] --target bunny|cdn [--sample N]"},
-			{Name: "get", Summary: "fetch one blob with sha re-verify", Usage: "crucible depot get <sha> <dest> --target cdn|bunny|local"},
+			{Name: "get", Summary: "fetch one blob with sha re-verify", Usage: "crucible depot get <sha> <dest> --target cdn|bunny | --out DIR"},
 			{Name: "pull", Summary: "incremental verified pull of every referenced blob", Usage: "crucible depot pull [--manifests DIR] --dest DIR --target cdn|bunny"},
 		},
 		Wired: true,
 	},
+	{
+		Name:    "nwsync",
+		Bin:     "crucible-nwsync",
+		Summary: "publish NWSync blobs and manifests (emit/assemble/verify)",
+		Commands: []Command{
+			{Name: "emit", Summary: "explode one artifact into blobs plus its own NSYM manifest", Usage: "crucible nwsync emit <artifact> --out DIR"},
+			{Name: "assemble", Summary: "merge per-artifact NSYM manifests into one", Usage: "crucible nwsync assemble --order NAMES --entries DIR --out DIR [--group-id N]"},
+			{Name: "verify", Summary: "read a published manifest's blobs back through the pull zone and hash them", Usage: "crucible nwsync verify <manifest-sha1> [--sample N]"},
+		},
+		Wired: true,
+	},
+	{
+		Name:    "assets",
+		Bin:     "crucible-assets",
+		Summary: "compile/convert/upscale NWN assets + mdl/dupe integrity",
+		Commands: []Command{
+			{Name: "compile", Summary: "compile ASCII .mdl models to binary in place", Usage: "crucible assets compile [--nwn INSTALL] [--non-recursive] <dir>..."},
+			{Name: "convert", Summary: "convert textures to/from NWN DDS (flips vertically)", Usage: "crucible assets convert [--to dds|png|tga] [--backend PATH] [--non-recursive] <dir>..."},
+			{Name: "upscale", Summary: "upscale textures through an installed backend", Usage: "crucible assets upscale [--scale N] [--backend PATH] [--non-recursive] <dir>..."},
+			{Name: "check-mdl", Summary: "report uncompiled ASCII .mdl and model-name mismatches", Usage: "crucible assets check-mdl <path>..."},
+			{Name: "fix-mdl", Summary: "lowercase .mdl names and rewrite model identity to match", Usage: "crucible assets fix-mdl [--dry-run] <path>..."},
+			{Name: "check-dupes", Summary: "report runtime-name (basename) collisions across dirs", Usage: "crucible assets check-dupes <dir>..."},
+			{Name: "clean-dupes", Summary: "delete clean-tree files whose basename collides with primary", Usage: "crucible assets clean-dupes [--dry-run] <primary> <clean>"},
+		},
+		Wired: true,
+	},
 	{
 		Name:    "hak",
 		Bin:     "crucible-hak",
@@ -225,7 +253,7 @@ var Registry = []Builder{
 					"2da-to-module [flags] <input.2da> [output.json]",
 					"json-to-2da <input.json> <output.2da>",
 				},
-				Aliases:    []CommandAlias{{Name: "convert-topdata"}},
+				Aliases: []CommandAlias{{Name: "convert-topdata"}},
 			},
 		},
 		Wired: true,
@@ -375,11 +403,18 @@ func runBuilder(name string, args []string, out, errw io.Writer) int {
 			return exitOK
 		}
 	}
-	if b.Name == "depot" && b.Wired {
-		// depot parses its own subcommand (status/push/verify/get/pull) and
-		// has its own richer exit contract (0/1/2/64/70), so it bypasses the
-		// b.Commands/delegateLegacy routing entirely.
-		return depot.Run(args, out, errw, os.Getenv)
+	if b.Wired {
+		// depot, assets and nwsync are self-contained builders: they parse their own
+		// subcommands and own their exit contract, bypassing the
+		// b.Commands/delegateLegacy legacy routing entirely.
+		switch b.Name {
+		case "depot":
+			return depot.Run(args, out, errw, os.Getenv)
+		case "assets":
+			return assets.Run(args, out, errw, os.Getenv)
+		case "nwsync":
+			return nwsync.Run(args, out, errw)
+		}
 	}
 	if !b.Wired {
 		// No migrated logic yet (depot): fail closed, never fake an artifact.

internal/dispatch/dispatch_test.go

@@ -148,13 +148,19 @@ func TestBuilderHelpIsOK(t *testing.T) {
 	}
 }
 
+// selfContained builders parse their own subcommands instead of delegating to
+// the legacy internal/app surface.
+var selfContained = map[string]bool{"depot": true, "assets": true, "nwsync": true}
+
 func TestCanonicalCommandSurface(t *testing.T) {
 	want := map[string][]string{
 		"depot":   {"status", "push", "verify", "get", "pull"},
+		"assets":  {"compile", "convert", "upscale", "check-mdl", "fix-mdl", "check-dupes", "clean-dupes"},
 		"hak":     {"build", "manifest"},
 		"module":  {"build", "extract", "validate", "compare", "manifest"},
 		"topdata": {"validate", "build", "package", "compare", "convert"},
 		"wiki":    {"build", "deploy"},
+		"nwsync":  {"emit", "assemble", "verify"},
 	}
 	for _, builder := range Registry {
 		got := builder.subcommands()
@@ -172,10 +178,10 @@ func TestRegistryCommandNamesAndAliasesAreUnambiguous(t *testing.T) {
 	for _, builder := range Registry {
 		seen := map[string]bool{}
 		for _, command := range builder.Commands {
-			// depot parses its own subcommands and bypasses AppCommand routing
-			// entirely (see the depot special-case in runBuilder), so its
-			// Commands carry no AppCommand.
-			requireAppCommand := builder.Name != "depot"
+			// depot, assets and nwsync parse their own subcommands and bypass
+			// AppCommand routing entirely (see the self-contained-builder branch
+			// in runBuilder), so their Commands carry no AppCommand.
+			requireAppCommand := !selfContained[builder.Name]
 			if command.Name == "" || command.Summary == "" || command.Usage == "" || (requireAppCommand && command.AppCommand == "") {
 				t.Errorf("%s has incomplete command metadata: %#v", builder.Name, command)
 			}

internal/erf/erf.go

@@ -67,6 +67,19 @@ type resourceEntry struct {
 	Size   uint32
 }
 
+// extensionTypes and typeExtensions must stay exact inverses of each other;
+// init() panics if they drift apart.
+//
+// Numbers below 0x0BB8 follow upstream neverwinter.nim
+// (neverwinter/restype.nim). The 0x0BB8 and up entries are lyt/vis/mdx: real
+// Aurora archive types that NWN1 ships in its own data/*.bif but upstream
+// happens not to register. xoreos corroborates those three numbers
+// (src/aurora/types.h).
+//
+// This table is NWN:EE only. Do not add NWN2 formats (mdb, gr2, wlk, xml):
+// NWN:EE either gives that number to something else (2070 is xbc here and mdb
+// in NWN2) or has no number for it at all, so packing one into a HAK writes a
+// resource the game misreads. See the reserved list in erf_test.go.
 var extensionTypes = map[string]uint16{
 	"res": 0x0000,
 	"bmp": 0x0001,
@@ -96,12 +109,13 @@ var extensionTypes = map[string]uint16{
 	"utt": 0x07F0,
 	"dds": 0x07F1,
 	"uts": 0x07F3,
+	"ltr": 0x07F4,
+	"gff": 0x07F5,
 	"fac": 0x07F6,
-	"gff": 0x07F7,
 	"ute": 0x07F8,
 	"utd": 0x07FA,
 	"utp": 0x07FC,
-	"dfa": 0x07FD,
+	"dft": 0x07FD,
 	"gic": 0x07FE,
 	"gui": 0x07FF,
 	"utm": 0x0803,
@@ -117,20 +131,15 @@ var extensionTypes = map[string]uint16{
 	"ndb": 0x0810,
 	"ptm": 0x0811,
 	"ptt": 0x0812,
-	"ltr": 0x0813,
 	"shd": 0x0815,
-	"mdb": 0x0816,
 	"mtr": 0x0818,
-	"jpg": 0x081C,
 	"lod": 0x081E,
 	"gif": 0x081F,
 	"png": 0x0820,
+	"jpg": 0x0821,
 	"lyt": 0x0BB8,
 	"vis": 0x0BB9,
 	"mdx": 0x0BC0,
-	"wlk": 0x0BCC,
-	"xml": 0x0BCD,
-	"gr2": 0x0FA3,
 }
 
 var typeExtensions = map[uint16]string{
@@ -162,12 +171,13 @@ var typeExtensions = map[uint16]string{
 	0x07F0: "utt",
 	0x07F1: "dds",
 	0x07F3: "uts",
+	0x07F4: "ltr",
+	0x07F5: "gff",
 	0x07F6: "fac",
-	0x07F7: "gff",
 	0x07F8: "ute",
 	0x07FA: "utd",
 	0x07FC: "utp",
-	0x07FD: "dfa",
+	0x07FD: "dft",
 	0x07FE: "gic",
 	0x07FF: "gui",
 	0x0803: "utm",
@@ -183,20 +193,15 @@ var typeExtensions = map[uint16]string{
 	0x0810: "ndb",
 	0x0811: "ptm",
 	0x0812: "ptt",
-	0x0813: "ltr",
 	0x0815: "shd",
-	0x0816: "mdb",
 	0x0818: "mtr",
-	0x081C: "jpg",
 	0x081E: "lod",
 	0x081F: "gif",
 	0x0820: "png",
+	0x0821: "jpg",
 	0x0BB8: "lyt",
 	0x0BB9: "vis",
 	0x0BC0: "mdx",
-	0x0BCC: "wlk",
-	0x0BCD: "xml",
-	0x0FA3: "gr2",
 }
 
 func init() {
@@ -205,8 +210,13 @@ func init() {
 		if !ok {
 			panic(fmt.Sprintf("missing canonical extension for resource type 0x%04X", resourceType))
 		}
-		if canonicalExt == ext {
-			continue
+		if canonicalExt != ext {
+			panic(fmt.Sprintf("resource type 0x%04X is %q in extensionTypes but %q in typeExtensions", resourceType, ext, canonicalExt))
+		}
+	}
+	for resourceType, ext := range typeExtensions {
+		if registered, ok := extensionTypes[ext]; !ok || registered != resourceType {
+			panic(fmt.Sprintf("extension %q is 0x%04X in typeExtensions but 0x%04X in extensionTypes (registered=%v)", ext, resourceType, registered, ok))
 		}
 	}
 }
@@ -301,63 +311,110 @@ func Write(w io.Writer, archive Archive) error {
 	return nil
 }
 
+// IndexEntry locates one resource inside an archive without holding its
+// payload. Streaming callers read one payload at a time from these, so peak
+// memory tracks the largest resource instead of the whole archive.
+type IndexEntry struct {
+	Name   string
+	Type   uint16
+	Offset int64
+	Size   int64
+}
+
+// Index is the header plus the resource table of an ERF: everything except the
+// payloads.
+type Index struct {
+	FileType string
+	Version  string
+	Entries  []IndexEntry
+}
+
+// ReadIndex parses the tables of an ERF of the given size, reading only the
+// header, the key list and the resource list.
+func ReadIndex(r io.ReaderAt, size int64) (Index, error) {
+	if size < headerSize {
+		return Index{}, fmt.Errorf("erf file too small: %d bytes", size)
+	}
+
+	var hdr header
+	if err := binary.Read(io.NewSectionReader(r, 0, headerSize), binary.LittleEndian, &hdr); err != nil {
+		return Index{}, fmt.Errorf("decode erf header: %w", err)
+	}
+
+	if int64(hdr.KeyListOffset)+int64(hdr.EntryCount)*24 > size {
+		return Index{}, fmt.Errorf("erf key list exceeds file bounds")
+	}
+	keys := make([]keyEntry, hdr.EntryCount)
+	keyReader := io.NewSectionReader(r, int64(hdr.KeyListOffset), int64(hdr.EntryCount)*24)
+	if err := binary.Read(keyReader, binary.LittleEndian, &keys); err != nil {
+		return Index{}, fmt.Errorf("decode key list: %w", err)
+	}
+
+	if int64(hdr.ResourceListOffset)+int64(hdr.EntryCount)*8 > size {
+		return Index{}, fmt.Errorf("erf resource list exceeds file bounds")
+	}
+	entries := make([]resourceEntry, hdr.EntryCount)
+	entryReader := io.NewSectionReader(r, int64(hdr.ResourceListOffset), int64(hdr.EntryCount)*8)
+	if err := binary.Read(entryReader, binary.LittleEndian, &entries); err != nil {
+		return Index{}, fmt.Errorf("decode resource list: %w", err)
+	}
+
+	index := Index{
+		FileType: string(hdr.FileType[:]),
+		Version:  string(hdr.Version[:]),
+		Entries:  make([]IndexEntry, 0, hdr.EntryCount),
+	}
+	for position, key := range keys {
+		entry := entries[position]
+		if int64(entry.Offset)+int64(entry.Size) > size {
+			return Index{}, fmt.Errorf("resource %d exceeds file bounds", position)
+		}
+		index.Entries = append(index.Entries, IndexEntry{
+			Name:   string(bytes.TrimRight(key.ResRef[:], "\x00")),
+			Type:   key.ResourceType,
+			Offset: int64(entry.Offset),
+			Size:   int64(entry.Size),
+		})
+	}
+	return index, nil
+}
+
+// ReadPayload returns one resource's bytes.
+func ReadPayload(r io.ReaderAt, entry IndexEntry) ([]byte, error) {
+	payload := make([]byte, entry.Size)
+	if _, err := r.ReadAt(payload, entry.Offset); err != nil {
+		return nil, fmt.Errorf("read resource %q: %w", entry.Name, err)
+	}
+	return payload, nil
+}
+
+// Read materialises a whole archive. Payloads are subslices of the buffer the
+// archive was read into, so nothing is copied twice: a caller must not mutate
+// Data. Callers that only need one resource at a time should use ReadIndex
+// instead, which never holds the archive at all.
 func Read(r io.Reader) (Archive, error) {
 	data, err := io.ReadAll(r)
 	if err != nil {
 		return Archive{}, fmt.Errorf("read erf: %w", err)
 	}
-	if len(data) < headerSize {
-		return Archive{}, fmt.Errorf("erf file too small: %d bytes", len(data))
+	index, err := ReadIndex(bytes.NewReader(data), int64(len(data)))
+	if err != nil {
+		return Archive{}, err
 	}
 
-	var hdr header
-	if err := binary.Read(bytes.NewReader(data[:headerSize]), binary.LittleEndian, &hdr); err != nil {
-		return Archive{}, fmt.Errorf("decode erf header: %w", err)
-	}
-
-	keyStart := int(hdr.KeyListOffset)
-	keyEnd := keyStart + int(hdr.EntryCount)*24
-	if keyEnd > len(data) {
-		return Archive{}, fmt.Errorf("erf key list exceeds file bounds")
-	}
-	keys := make([]keyEntry, hdr.EntryCount)
-	if err := binary.Read(bytes.NewReader(data[keyStart:keyEnd]), binary.LittleEndian, &keys); err != nil {
-		return Archive{}, fmt.Errorf("decode key list: %w", err)
-	}
-
-	resourceStart := int(hdr.ResourceListOffset)
-	resourceEnd := resourceStart + int(hdr.EntryCount)*8
-	if resourceEnd > len(data) {
-		return Archive{}, fmt.Errorf("erf resource list exceeds file bounds")
-	}
-	entries := make([]resourceEntry, hdr.EntryCount)
-	if err := binary.Read(bytes.NewReader(data[resourceStart:resourceEnd]), binary.LittleEndian, &entries); err != nil {
-		return Archive{}, fmt.Errorf("decode resource list: %w", err)
-	}
-
-	resources := make([]Resource, 0, hdr.EntryCount)
-	for index, key := range keys {
-		entry := entries[index]
-		start := int(entry.Offset)
-		end := start + int(entry.Size)
-		if end > len(data) {
-			return Archive{}, fmt.Errorf("resource %d exceeds file bounds", index)
-		}
-
-		resref := string(bytes.TrimRight(key.ResRef[:], "\x00"))
-		payload := make([]byte, entry.Size)
-		copy(payload, data[start:end])
+	resources := make([]Resource, 0, len(index.Entries))
+	for _, entry := range index.Entries {
 		resources = append(resources, Resource{
-			Name: resref,
-			Type: key.ResourceType,
-			Data: payload,
-			Size: int64(entry.Size),
+			Name: entry.Name,
+			Type: entry.Type,
+			Data: data[entry.Offset : entry.Offset+entry.Size],
+			Size: entry.Size,
 		})
 	}
 
 	return Archive{
-		FileType:  string(hdr.FileType[:]),
-		Version:   string(hdr.Version[:]),
+		FileType:  index.FileType,
+		Version:   index.Version,
 		Resources: resources,
 	}, nil
 }

internal/erf/erf_test.go

@@ -134,14 +134,10 @@ func TestExtensionMappingsSupportModernAssetTypes(t *testing.T) {
 		"mtr": 0x0818,
 		"shd": 0x0815,
 		"txi": 0x07E6,
-		"jpg": 0x081C,
-		"mdb": 0x0816,
+		"jpg": 0x0821,
 		"lyt": 0x0BB8,
 		"vis": 0x0BB9,
 		"mdx": 0x0BC0,
-		"xml": 0x0BCD,
-		"wlk": 0x0BCC,
-		"gr2": 0x0FA3,
 	}
 	for ext, wantType := range cases {
 		gotType, ok := ResourceTypeForExtension(ext)
@@ -191,3 +187,71 @@ func TestExtensionMappingsSupportAllUTBlueprintTypes(t *testing.T) {
 		}
 	}
 }
+
+// TestRestypeTableMatchesUpstream pins the restype numbers Crucible shares with
+// neverwinter.nim's restype.nim. The values below are upstream's; a mismatch
+// means a HAK we write is mislabelled for the game.
+func TestRestypeTableMatchesUpstream(t *testing.T) {
+	upstream := map[string]uint16{
+		"res": 0, "bmp": 1, "mve": 2, "tga": 3, "wav": 4, "plt": 6, "ini": 7,
+		"bmu": 8, "txt": 10, "mdl": 2002, "nss": 2009, "ncs": 2010, "are": 2012,
+		"set": 2013, "ifo": 2014, "bic": 2015, "wok": 2016, "2da": 2017,
+		"tlk": 2018, "txi": 2022, "git": 2023, "uti": 2025, "utc": 2027,
+		"dlg": 2029, "itp": 2030, "utt": 2032, "dds": 2033, "uts": 2035,
+		"ltr": 2036, "gff": 2037, "fac": 2038, "ute": 2040, "utd": 2042,
+		"utp": 2044, "dft": 2045, "gic": 2046, "gui": 2047, "utm": 2051,
+		"dwk": 2052, "pwk": 2053, "utg": 2055, "jrl": 2056, "utw": 2058,
+		"ssf": 2060, "hak": 2061, "nwm": 2062, "bik": 2063, "ndb": 2064,
+		"ptm": 2065, "ptt": 2066, "shd": 2069, "mtr": 2072, "lod": 2078,
+		"gif": 2079, "png": 2080, "jpg": 2081,
+	}
+	for ext, want := range upstream {
+		got, ok := ResourceTypeForExtension(ext)
+		if !ok {
+			t.Errorf("%s: not registered, upstream has %d", ext, want)
+			continue
+		}
+		if got != want {
+			t.Errorf("%s: registered as %d, upstream has %d", ext, got, want)
+		}
+	}
+	// Extensions upstream registers that Crucible must not reuse for anything else.
+	reserved := map[uint16]string{2039: "bte", 2067: "bak", 2070: "xbc", 2076: "tml"}
+	for number, upstreamExt := range reserved {
+		if ext, ok := ExtensionForResourceType(number); ok {
+			t.Errorf("%d: registered as %s, upstream reserves it for %s", number, ext, upstreamExt)
+		}
+	}
+}
+
+// TestNWN2FormatsAreNotRegistered keeps NWN2 file formats out of an NWN:EE
+// table. mdb and gr2 have Aurora numbers that mean something else (or nothing)
+// in NWN:EE; wlk and xml have no archive number in any Aurora game, so the
+// values Crucible used for them were invented. Packing any of these into a HAK
+// writes a resource the game misreads.
+func TestNWN2FormatsAreNotRegistered(t *testing.T) {
+	for _, ext := range []string{"mdb", "gr2", "wlk", "xml"} {
+		if number, ok := ResourceTypeForExtension(ext); ok {
+			t.Errorf("%s is an NWN2 format but is registered as 0x%04X", ext, number)
+		}
+	}
+}
+
+// TestRestypeTablesAreMutualInverses is the check init() is meant to enforce.
+func TestRestypeTablesAreMutualInverses(t *testing.T) {
+	for ext, number := range extensionTypes {
+		canonical, ok := typeExtensions[number]
+		if !ok {
+			t.Errorf("%s: number 0x%04X missing from typeExtensions", ext, number)
+			continue
+		}
+		if canonical != ext {
+			t.Errorf("%s: maps to 0x%04X, which maps back to %s", ext, number, canonical)
+		}
+	}
+	for number, ext := range typeExtensions {
+		if got, ok := extensionTypes[ext]; !ok || got != number {
+			t.Errorf("0x%04X: maps to %s, which maps back to 0x%04X (ok=%v)", number, ext, got, ok)
+		}
+	}
+}

internal/nwsync/assemble.go

@@ -0,0 +1,128 @@
+package nwsync
+
+import (
+	"crypto/sha1"
+	"encoding/json"
+	"fmt"
+	"path"
+)
+
+// AssembleOptions describes one merged manifest.
+type AssembleOptions struct {
+	// ArtifactKeys are the depot keys of the artifacts to merge, in
+	// Mod_HakList order — highest priority first. Each one's index is read
+	// from the key beside it.
+	ArtifactKeys []string
+	TLKKey       string // the TLK's key, if the manifest carries one
+	OutDir       string // write locally instead of uploading — the conformance path
+	GroupID      int    // 1 = current, 2 = testing; 0 means absent
+	ModuleName   string
+	Description  string
+	Sink         sink // test seam; nil means OutDir or the zone
+}
+
+// AssembleResult reports what one assemble run produced.
+type AssembleResult struct {
+	SHA1         string
+	ManifestPath string
+	Entries      int
+}
+
+// Assemble merges the per-artifact NSYM manifests named by Order into one
+// manifest. It reads no bulk data at all — only the small index files.
+//
+// Merge rule is resref shadowing, not concatenation: a resref present in more
+// than one artifact resolves to the earliest artifact in Order, which is how
+// the game resolves it (upstream's resman adds haks in reverse and lets the
+// last one win). Get this backwards and the wrong texture ships silently.
+func Assemble(options AssembleOptions) (AssembleResult, error) {
+	if len(options.ArtifactKeys) == 0 {
+		return AssembleResult{}, fmt.Errorf("assemble: no artifact keys given")
+	}
+
+	target, err := openSink(options.OutDir, options.Sink)
+	if err != nil {
+		return AssembleResult{}, err
+	}
+
+	// The TLK carries no precedence — it is not a hak and shadows nothing —
+	// so it merges last, after every hak has had its say.
+	keys := append([]string{}, options.ArtifactKeys...)
+	if options.TLKKey != "" {
+		keys = append(keys, options.TLKKey)
+	}
+
+	merged := make([]Entry, 0, 1024)
+	winner := make(map[Identity]bool, 1024)
+	var onDiskBytes int64
+
+	for _, artifactKey := range keys {
+		key, err := resolveIndexKey(artifactKey, options.OutDir)
+		if err != nil {
+			return AssembleResult{}, err
+		}
+		data, sidecarBody, err := target.getIndex(key)
+		if err != nil {
+			// An artifact with no index is an artifact whose emit never
+			// finished. Publishing a manifest without it would ship a release
+			// missing a hak, so this fails closed.
+			return AssembleResult{}, fmt.Errorf("assemble: no index for %s: %w", artifactKey, err)
+		}
+		entries, err := readManifest(data)
+		if err != nil {
+			return AssembleResult{}, fmt.Errorf("%s: %w", target.describe(key), err)
+		}
+		sidecar, err := parseSidecar(target.describe(key), sidecarBody)
+		if err != nil {
+			return AssembleResult{}, err
+		}
+		// Two producers of blobs means a skewed emitter can write blobs the
+		// merged manifest quietly disagrees with. Refuse to merge across
+		// mismatched emitter versions.
+		if sidecar.EmitterVersion != emitterVersion {
+			return AssembleResult{}, fmt.Errorf(
+				"assemble: emitter version mismatch: %s was emitted by emitter %q, this is emitter %q",
+				artifactKey, sidecar.EmitterVersion, emitterVersion)
+		}
+		// on_disk_bytes overcounts by the handful of cross-artifact
+		// duplicates. It is a display statistic; no dedupe pass for it.
+		onDiskBytes += sidecar.OnDiskBytes
+
+		for _, entry := range entries {
+			identity := entry.identity()
+			if winner[identity] {
+				continue
+			}
+			winner[identity] = true
+			merged = append(merged, entry)
+		}
+	}
+
+	if len(merged) == 0 {
+		return AssembleResult{}, fmt.Errorf("assemble: merged manifest is empty")
+	}
+
+	data, err := writeManifest(merged)
+	if err != nil {
+		return AssembleResult{}, err
+	}
+	sha1Hex := fmt.Sprintf("%x", sha1.Sum(data))
+	manifestKey := path.Join("manifests", sha1Hex)
+	sidecar := Sidecar{
+		ModuleName:  options.ModuleName,
+		Description: options.Description,
+		GroupID:     options.GroupID,
+	}
+	if err := putManifestPair(target, manifestKey, data, merged, onDiskBytes, sidecar); err != nil {
+		return AssembleResult{}, err
+	}
+	return AssembleResult{SHA1: sha1Hex, ManifestPath: target.describe(manifestKey), Entries: len(merged)}, nil
+}
+
+func parseSidecar(where string, data []byte) (Sidecar, error) {
+	var sidecar Sidecar
+	if err := json.Unmarshal(data, &sidecar); err != nil {
+		return Sidecar{}, fmt.Errorf("%s: %w", where, err)
+	}
+	return sidecar, nil
+}

internal/nwsync/compressedbuf.go

@@ -0,0 +1,179 @@
+package nwsync
+
+import (
+	"bytes"
+	"encoding/binary"
+	"encoding/hex"
+	"fmt"
+
+	"github.com/klauspost/compress/zstd"
+)
+
+// NWCompressedBuffer framing, as upstream's neverwinter/compressedbuf.nim
+// writes it for NWSync blobs. All fields are little-endian uint32:
+//
+//	magic "NSYC", version 3, algorithm 2 (zstd), uncompressed size,
+//	zstd header version 1, dictionary 0, then the raw zstd frame.
+const (
+	blobMagic       = 0x4359534E // "NSYC" little-endian
+	blobVersion     = 3
+	algorithmZstd   = 2
+	zstdHeaderVer   = 1
+	zstdDictionary  = 0
+	blobHeaderBytes = 24
+)
+
+// EncodeAll/DecodeAll are single-threaded per call, so the default pool of one
+// encoder per CPU only buys idle memory: each holds a window-sized history, so
+// on a 24-core runner that is ~200 MB of live heap doing nothing. Concurrency 1
+// produces byte-identical output.
+var (
+	blobEncoder, _ = zstd.NewWriter(nil, zstd.WithEncoderConcurrency(1))
+	blobDecoder, _ = zstd.NewReader(nil, zstd.WithDecoderConcurrency(1))
+)
+
+// zstd frame header bits we care about. A frame starts with the magic, then a
+// one-byte Frame_Header_Descriptor: bits 7-6 size the Frame_Content_Size field,
+// bit 5 is Single_Segment_flag, bits 1-0 size the Dictionary_ID field.
+const (
+	zstdFrameMagic      = "\x28\xb5\x2f\xfd"
+	frameSingleSegment  = 1 << 5
+	frameDictionaryMask = 0x03
+	// oneByteContentSizeCeiling is the size above which a Frame_Content_Size no
+	// longer fits in one byte. Below it the field's size flag is 0, which is
+	// what lets klauspost/compress leave the field out entirely.
+	oneByteContentSizeCeiling = 256
+)
+
+// compressBlob wraps data in NWCompressedBuffer framing.
+func compressBlob(data []byte) []byte {
+	var out bytes.Buffer
+	header := []uint32{blobMagic, blobVersion, algorithmZstd, uint32(len(data)), zstdHeaderVer, zstdDictionary}
+	for _, field := range header {
+		_ = binary.Write(&out, binary.LittleEndian, field)
+	}
+	frame := declareFrameContentSize(blobEncoder.EncodeAll(data, nil), len(data))
+	// Fail closed rather than publish a blob no client can decode. An encoder
+	// upgrade that finds a new way to omit the field would otherwise reproduce
+	// #86 in silence, and a blob is skipped by every later emit once written.
+	if !frameDeclaresContentSize(frame) {
+		panic(fmt.Sprintf("nwsync: refusing to emit a %d-byte blob whose zstd frame declares no content size (descriptor %#x)",
+			len(data), frame[4]))
+	}
+	out.Write(frame)
+	return out.Bytes()
+}
+
+// inspectBlob unwraps a stored blob the way the game client reads it, and is the
+// only reader that should be trusted to judge a published blob.
+//
+// It asserts the frame property on top of the round trip. Go's decoder — like
+// the zstd CLI — streams a frame that declares no content size, so a check that
+// only decompresses and hashes is a *more* capable decoder than the client's: it
+// certifies exactly the blobs the client rejects, which is how #86 reached
+// production and survived an audit.
+func inspectBlob(blob []byte) ([]byte, error) {
+	data, err := decompressBlob(blob)
+	if err != nil {
+		return nil, fmt.Errorf("malformed framing: %w", err)
+	}
+	if len(blob) > blobHeaderBytes && !frameDeclaresContentSize(blob[blobHeaderBytes:]) {
+		return nil, fmt.Errorf("malformed framing: the zstd frame declares no content size, which the game client cannot decode")
+	}
+	return data, nil
+}
+
+// blobMatchesName holds a stored blob to its own file name: a blob is named
+// after the sha1 of its uncompressed bytes, so the name is a complete statement
+// about the contents and nothing else is needed to check it.
+func blobMatchesName(blob []byte, sha1Hex string) error {
+	data, err := inspectBlob(blob)
+	if err != nil {
+		return err
+	}
+	if got := hex.EncodeToString(sha1Sum(data)); got != sha1Hex {
+		return fmt.Errorf("blob %s holds the contents of %s", sha1Hex, got)
+	}
+	return nil
+}
+
+// frameDeclaresContentSize reports whether a zstd frame states how many bytes it
+// decompresses to. A frame with a zero-sized Frame_Content_Size field declares
+// one only when Single_Segment_flag is set; otherwise the size is unknown.
+func frameDeclaresContentSize(frame []byte) bool {
+	if len(frame) < 5 || string(frame[:4]) != zstdFrameMagic {
+		return false
+	}
+	descriptor := frame[4]
+	return descriptor>>6 != 0 || descriptor&frameSingleSegment != 0
+}
+
+// declareFrameContentSize rewrites a frame that does not declare its
+// Frame_Content_Size so that it does, and returns any other frame unchanged.
+//
+// klauspost/compress omits the field for inputs under 256 bytes, which the spec
+// permits. Reference libzstd never does, so the NWN client — which sizes its
+// output buffer from ZSTD_getFrameContentSize and has therefore never met a
+// frame without one — rejects the blob outright with an empty "potential
+// compression error" (#86). No encoder option changes this, so the frame is
+// re-headered here.
+//
+// The result is the shape libzstd itself emits for the same input: setting
+// Single_Segment_flag drops the Window_Descriptor byte, and the freed byte pays
+// for a one-byte Frame_Content_Size. Window_Size then equals the content size,
+// which is sound because the content is under 256 bytes and every match in it
+// therefore falls inside that window. Same length in, same length out.
+func declareFrameContentSize(frame []byte, size int) []byte {
+	if size <= 0 || size >= oneByteContentSizeCeiling || len(frame) < 6 || string(frame[:4]) != zstdFrameMagic {
+		return frame
+	}
+	descriptor := frame[4]
+	// Rewrite only the exact shape a small input produces: no declared size, no
+	// single segment, no dictionary. Anything else either declares a size
+	// already or is not a frame this reinterpretation is safe on.
+	if descriptor>>6 != 0 || descriptor&frameSingleSegment != 0 || descriptor&frameDictionaryMask != 0 {
+		return frame
+	}
+	reframed := make([]byte, len(frame))
+	copy(reframed, frame)
+	reframed[4] = descriptor | frameSingleSegment
+	reframed[5] = byte(size) // replaces Window_Descriptor
+	return reframed
+}
+
+// decompressBlob unwraps NWCompressedBuffer framing. It exists so a blob this
+// package wrote — or one upstream wrote — can be compared by its uncompressed
+// bytes, which is the only comparison that is meaningful across zstd
+// implementations.
+func decompressBlob(blob []byte) ([]byte, error) {
+	if len(blob) < blobHeaderBytes {
+		return nil, fmt.Errorf("blob too small: %d bytes", len(blob))
+	}
+	header := make([]uint32, 6)
+	if err := binary.Read(bytes.NewReader(blob[:blobHeaderBytes]), binary.LittleEndian, header); err != nil {
+		return nil, fmt.Errorf("decode blob header: %w", err)
+	}
+	switch {
+	case header[0] != blobMagic:
+		return nil, fmt.Errorf("invalid blob magic: %#x", header[0])
+	case header[1] != blobVersion:
+		return nil, fmt.Errorf("unsupported blob version: %d", header[1])
+	case header[2] != algorithmZstd:
+		return nil, fmt.Errorf("unsupported compression algorithm: %d", header[2])
+	case header[4] != zstdHeaderVer:
+		return nil, fmt.Errorf("unsupported zstd header version: %d", header[4])
+	case header[5] != zstdDictionary:
+		return nil, fmt.Errorf("zstd dictionaries are not supported")
+	}
+	if header[3] == 0 {
+		return nil, nil
+	}
+	data, err := blobDecoder.DecodeAll(blob[blobHeaderBytes:], nil)
+	if err != nil {
+		return nil, fmt.Errorf("decompress blob: %w", err)
+	}
+	if uint32(len(data)) != header[3] {
+		return nil, fmt.Errorf("blob size mismatch: header says %d, got %d", header[3], len(data))
+	}
+	return data, nil
+}

internal/nwsync/emit.go

@@ -0,0 +1,365 @@
+package nwsync
+
+import (
+	"context"
+	"crypto/sha1"
+	"fmt"
+	"io"
+	"os"
+	"path"
+	"path/filepath"
+	"slices"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/buildinfo"
+	"git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/erf"
+)
+
+// fileSizeLimit matches upstream's --limit-file-size default of 15 MB. A
+// resource over it is a hard failure, not a skip: upstream quit(1)s and so do
+// we. Our largest resource today is 13.66 MiB, so the headroom is thin.
+const fileSizeLimit = 15 * 1024 * 1024
+
+// skippedTypes are never published, matching upstream's GobalResTypeSkipList.
+var skippedTypes = resTypes("nss", "ndb", "gic")
+
+// emitterVersion identifies the blob/manifest byte format this package
+// produces. assemble refuses to merge indexes that disagree on it, because two
+// producers of blobs mean a skewed emitter can otherwise write blobs the merged
+// manifest quietly disagrees with. Bump it only when emitted bytes change — it
+// is deliberately not the build revision, which would invalidate every
+// published index on every unrelated commit.
+// Version 2 declares Frame_Content_Size on every blob (#86); version 1 omitted
+// it below 256 bytes and no client could sync past such a blob.
+const emitterVersion = "2"
+
+// serverTypes are loaded only server-side; a manifest holding nothing else
+// has no client contents. Mirrors upstream's GlobalResTypeServerList, whose
+// trailing 0 is RESTYPE_INVALID.
+var serverTypes = append(resTypes(
+	"are", "dlg", "fac", "gic", "git", "ifo", "itp", "jrl", "ncs", "ndb",
+	"nss", "ptm", "utc", "utd", "ute", "uti", "utm", "utp", "uts", "utt", "utw",
+), 0)
+
+func resTypes(extensions ...string) []uint16 {
+	types := make([]uint16, 0, len(extensions))
+	for _, extension := range extensions {
+		restype, ok := erf.ResourceTypeForExtension(extension)
+		if !ok {
+			panic("nwsync: unknown restype " + extension)
+		}
+		types = append(types, restype)
+	}
+	return types
+}
+
+// EmitResult reports what one emit run produced.
+type EmitResult struct {
+	Name         string // artifact name, without extension
+	ManifestPath string
+	Entries      int
+	BlobsWritten int
+}
+
+// defaultEmitJobs is how many resources are hashed, compressed and stored at
+// once. Emit is latency-bound, not CPU-bound: a blob costs a probe round-trip
+// plus an upload round-trip, and a measured backfill spent 26 s of CPU across
+// 9.5 minutes of wall clock. The figure matches depot's DEPOT_JOBS default and
+// the transport's MaxIdleConnsPerHost, so a worker per connection needs no new
+// TLS handshake.
+const defaultEmitJobs = 16
+
+// EmitOptions describes one emit run.
+type EmitOptions struct {
+	ArtifactKey  string // depot key of the artifact; the NSYM key is derived from it
+	ArtifactPath string // the file on disk
+	As           string // name override, for a TLK whose filename is not its published name
+	OutDir       string // write locally instead of uploading — the conformance path
+	Jobs         int    // resources in flight at once; 0 means defaultEmitJobs
+	Verify       bool   // hash what would be skipped instead of trusting presence
+	Sink         sink   // test seam; nil means OutDir or the zone
+}
+
+// Emit explodes one artifact — a .hak/.erf or a loose file such as the TLK —
+// into NWSync blobs plus a NSYM manifest describing only that artifact.
+//
+// Blobs go up as they are produced and the index lands last, so the presence of
+// an index is the publication marker: an artifact whose emit died halfway has
+// real blobs in the zone and no index, which is unambiguous. Blob names are
+// content hashes, so re-running skips whatever already landed.
+func Emit(options EmitOptions) (EmitResult, error) {
+	artifact, err := os.Open(options.ArtifactPath)
+	if err != nil {
+		return EmitResult{}, fmt.Errorf("read artifact: %w", err)
+	}
+	defer artifact.Close()
+	info, err := artifact.Stat()
+	if err != nil {
+		return EmitResult{}, fmt.Errorf("read artifact: %w", err)
+	}
+	// A section reader, not the file itself: hashing must not move the file
+	// offset out from under everything that reads the artifact afterwards.
+	if err := checkArtifactKey(options.ArtifactKey, io.NewSectionReader(artifact, 0, info.Size())); err != nil {
+		return EmitResult{}, err
+	}
+	name := options.As
+	if name == "" {
+		name = path.Base(options.ArtifactKey)
+	}
+	extension := path.Ext(name)
+	name = strings.TrimSuffix(name, extension)
+
+	key, err := resolveIndexKey(options.ArtifactKey, options.OutDir)
+	if err != nil {
+		return EmitResult{}, err
+	}
+
+	index, err := readArtifactIndex(options.ArtifactPath, artifact, info.Size(), name)
+	if err != nil {
+		return EmitResult{}, err
+	}
+
+	target, err := openSink(options.OutDir, options.Sink)
+	if err != nil {
+		return EmitResult{}, err
+	}
+
+	jobs := options.Jobs
+	if jobs < 1 {
+		jobs = defaultEmitJobs
+	}
+	entries, blobs, onDiskBytes, err := emitResources(artifact, index, target, jobs, options.Verify)
+	if err != nil {
+		return EmitResult{}, err
+	}
+	if len(entries) == 0 {
+		return EmitResult{}, fmt.Errorf("%s: nothing to index (no publishable resources)", options.ArtifactPath)
+	}
+
+	data, err := writeManifest(entries)
+	if err != nil {
+		return EmitResult{}, err
+	}
+	if err := putManifestPair(target, key, data, entries, onDiskBytes, Sidecar{ModuleName: name}); err != nil {
+		return EmitResult{}, err
+	}
+	return EmitResult{Name: name, ManifestPath: target.describe(key), Entries: len(entries), BlobsWritten: blobs}, nil
+}
+
+// openSink returns the zone sink, or a local directory when outDir is set.
+func openSink(outDir string, injected sink) (sink, error) {
+	if injected != nil {
+		return injected, nil
+	}
+	if outDir != "" {
+		return dirSink{root: outDir}, nil
+	}
+	return newZoneSink(context.Background(), os.Getenv)
+}
+
+// readArtifactIndex locates the resources of an ERF/HAK/MOD, or the single
+// resource a loose file represents, without reading any payload. Upstream's
+// resman does the same dispatch on the file's first three bytes. name is the
+// artifact's published name, which for a loose file is also its resref.
+func readArtifactIndex(path string, artifact io.ReaderAt, size int64, name string) ([]erf.IndexEntry, error) {
+	magic := make([]byte, 3)
+	if size >= 3 {
+		if _, err := artifact.ReadAt(magic, 0); err != nil {
+			return nil, fmt.Errorf("%s: %w", path, err)
+		}
+	}
+	switch string(magic) {
+	case "ERF", "HAK":
+		index, err := erf.ReadIndex(artifact, size)
+		if err != nil {
+			return nil, fmt.Errorf("%s: %w", path, err)
+		}
+		return index.Entries, nil
+	case "MOD":
+		// A persistent world never publishes module contents, so the .mod
+		// contributes no bytes to a manifest — it only says which haks and
+		// which TLK the manifest covers.
+		return nil, fmt.Errorf("%s: a module is never emitted; a manifest is haks plus the TLK", path)
+	}
+	extension := filepath.Ext(filepath.Base(path))
+	restype, ok := erf.ResourceTypeForExtension(extension)
+	if !ok {
+		return nil, fmt.Errorf("%s: unknown resource type %q", path, extension)
+	}
+	return []erf.IndexEntry{{Name: name, Type: restype, Offset: 0, Size: size}}, nil
+}
+
+// emitResources hashes, compresses and stores resources, reading each payload
+// from the artifact only when its turn comes. Peak memory tracks the resources
+// in flight, not the archive: a 2 GB hak must emit inside a runner's few spare
+// GB. jobs of them are in flight at once, so the ceiling is jobs multiplied by
+// fileSizeLimit and its compressed copy — bounded, and bounded by a constant
+// this package enforces itself.
+//
+// The returned entries are in artifact order whatever order the workers finish
+// in, because a manifest's bytes are promised deterministic by emitterVersion.
+func emitResources(artifact io.ReaderAt, index []erf.IndexEntry, target sink, jobs int, verify bool) ([]Entry, int, int64, error) {
+	// A resref appearing twice inside one artifact resolves to the last one,
+	// the way resman lets the last container added win.
+	order := make([]Identity, 0, len(index))
+	latest := make(map[Identity]erf.IndexEntry, len(index))
+	var tooBig []string
+	for _, entry := range index {
+		if _, ok := erf.ExtensionForResourceType(entry.Type); !ok {
+			return nil, 0, 0, fmt.Errorf("resref %s is not resolvable (unknown restype %d)", entry.Name, entry.Type)
+		}
+		if slices.Contains(skippedTypes, entry.Type) {
+			continue
+		}
+		if entry.Size > fileSizeLimit {
+			tooBig = append(tooBig, fmt.Sprintf("%s: %d bytes > %d", entry.Name, entry.Size, fileSizeLimit))
+			continue
+		}
+		identity := Identity{ResRef: strings.ToLower(entry.Name), ResType: entry.Type}
+		if _, seen := latest[identity]; !seen {
+			order = append(order, identity)
+		}
+		latest[identity] = entry
+	}
+	if len(tooBig) > 0 {
+		sort.Strings(tooBig)
+		return nil, 0, 0, fmt.Errorf("resources exceed the file size limit:\n  %s", strings.Join(tooBig, "\n  "))
+	}
+
+	// Index-addressed, never appended to: a worker owns entries[i] alone, so
+	// the slice comes back in artifact order and needs no lock.
+	entries := make([]Entry, len(order))
+	var blobs int
+	var onDiskBytes int64
+	var mu sync.Mutex
+	var firstErr error
+	// Two resrefs in one artifact can hold identical bytes, and therefore one
+	// blob. Serially the sink's existence check absorbed that; in parallel both
+	// workers would probe, both miss, and both upload. Claiming the sha1 here
+	// restores the dedupe and skips the probe round-trip as well.
+	claimed := make(map[[20]byte]bool, len(order))
+
+	failed := func() bool {
+		mu.Lock()
+		defer mu.Unlock()
+		return firstErr != nil
+	}
+
+	store := func(i int) {
+		identity := order[i]
+		payload, err := erf.ReadPayload(artifact, latest[identity])
+		if err != nil {
+			mu.Lock()
+			if firstErr == nil {
+				firstErr = err
+			}
+			mu.Unlock()
+			return
+		}
+		sum := sha1.Sum(payload)
+		entries[i] = Entry{
+			SHA1:    sum,
+			Size:    uint32(len(payload)),
+			ResRef:  identity.ResRef,
+			ResType: identity.ResType,
+		}
+		mu.Lock()
+		duplicate := claimed[sum]
+		claimed[sum] = true
+		mu.Unlock()
+		if duplicate {
+			return
+		}
+		written, err := target.putBlob(fmt.Sprintf("%x", sum), verify, func() []byte { return compressBlob(payload) })
+		mu.Lock()
+		defer mu.Unlock()
+		if err != nil {
+			if firstErr == nil {
+				firstErr = err
+			}
+			return
+		}
+		if written > 0 {
+			blobs++
+			onDiskBytes += written
+		}
+	}
+
+	if jobs < 1 {
+		jobs = 1
+	}
+	work := make(chan int)
+	var wg sync.WaitGroup
+	for range jobs {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for i := range work {
+				// After a failure the run is over — the caller discards
+				// everything and no index is written. Draining the rest of the
+				// channel cheaply, rather than returning, keeps the feeder from
+				// blocking on workers that have gone away.
+				if failed() {
+					continue
+				}
+				store(i)
+			}
+		}()
+	}
+	for i := range order {
+		work <- i
+	}
+	close(work)
+	wg.Wait()
+
+	if firstErr != nil {
+		return nil, 0, 0, firstErr
+	}
+	return entries, blobs, onDiskBytes, nil
+}
+
+// created is the sidecar timestamp. SOURCE_DATE_EPOCH pins it so a build can
+// be reproduced byte for byte; the manifest itself is deterministic already.
+func created() int64 {
+	if raw := os.Getenv("SOURCE_DATE_EPOCH"); raw != "" {
+		if seconds, err := strconv.ParseInt(raw, 10, 64); err == nil {
+			return seconds
+		}
+	}
+	return time.Now().Unix()
+}
+
+// putManifestPair stores a NSYM manifest and its .json sidecar at key. The
+// caller supplies the sidecar fields it knows; the rest are derived from the
+// entries. data must be the serialised form of entries.
+func putManifestPair(target sink, key string, data []byte, entries []Entry, onDiskBytes int64, sidecar Sidecar) error {
+	var totalBytes int64
+	clientContents := false
+	for _, entry := range entries {
+		totalBytes += int64(entry.Size)
+		if !slices.Contains(serverTypes, entry.ResType) {
+			clientContents = true
+		}
+	}
+	sidecar.Version = manifestVersion
+	sidecar.SHA1 = fmt.Sprintf("%x", sha1.Sum(data))
+	sidecar.HashTreeDepth = hashTreeDepth
+	sidecar.IncludesModuleContents = false
+	sidecar.IncludesClientContents = clientContents
+	sidecar.TotalFiles = len(entries)
+	sidecar.TotalBytes = totalBytes
+	sidecar.OnDiskBytes = onDiskBytes
+	sidecar.Created = created()
+	sidecar.CreatedWith = buildinfo.String()
+	sidecar.EmitterVersion = emitterVersion
+
+	body, err := marshalSidecar(sidecar)
+	if err != nil {
+		return err
+	}
+	return target.putIndex(key, data, body)
+}

internal/nwsync/jobs_test.go

@@ -0,0 +1,134 @@
+package nwsync
+
+import (
+	"bytes"
+	"fmt"
+	"path/filepath"
+	"runtime/debug"
+	"strings"
+	"testing"
+)
+
+// manyResources is a hak body with enough distinct resources that a worker pool
+// actually interleaves. Payloads differ so nothing is deduplicated away.
+func manyResources(count int) map[string][]byte {
+	contents := make(map[string][]byte, count)
+	for i := range count {
+		contents[fmt.Sprintf("res%05d.tga", i)] = []byte(fmt.Sprintf("payload %d", i))
+	}
+	return contents
+}
+
+// TestEmitProducesTheSameIndexAtEveryJobCount is the contract that lets emit be
+// parallel at all: emitterVersion promises a manifest's bytes are a function of
+// its artifact, so the number of workers must not be observable in the output.
+func TestEmitProducesTheSameIndexAtEveryJobCount(t *testing.T) {
+	// The sidecar stamps a wall-clock time unless this is set, which would make
+	// two runs differ for a reason that has nothing to do with job count.
+	t.Setenv("SOURCE_DATE_EPOCH", "1700000000")
+
+	dir := t.TempDir()
+	hak := filepath.Join(dir, "sow_test_01.hak")
+	writeHak(t, hak, manyResources(64))
+	key := artifactKey(t, hak)
+
+	emit := func(jobs int) (manifest, sidecar []byte, result EmitResult) {
+		out := filepath.Join(t.TempDir(), "out")
+		result, err := Emit(EmitOptions{
+			ArtifactKey:  key,
+			ArtifactPath: hak,
+			OutDir:       out,
+			Jobs:         jobs,
+		})
+		if err != nil {
+			t.Fatalf("emit at -jobs %d: %v", jobs, err)
+		}
+		manifest, sidecar, err = dirSink{root: out}.getIndex(filepath.Base(result.ManifestPath))
+		if err != nil {
+			t.Fatalf("read index at -jobs %d: %v", jobs, err)
+		}
+		return manifest, sidecar, result
+	}
+
+	serialManifest, serialSidecar, serial := emit(1)
+	parallelManifest, parallelSidecar, parallel := emit(16)
+
+	if !bytes.Equal(serialManifest, parallelManifest) {
+		t.Errorf("manifest bytes differ between -jobs 1 and -jobs 16")
+	}
+	if !bytes.Equal(serialSidecar, parallelSidecar) {
+		t.Errorf("sidecar bytes differ between -jobs 1 and -jobs 16:\n %s\n %s", serialSidecar, parallelSidecar)
+	}
+	if serial.Entries != parallel.Entries || serial.BlobsWritten != parallel.BlobsWritten {
+		t.Errorf("-jobs 1 wrote %d entries/%d blobs, -jobs 16 wrote %d/%d",
+			serial.Entries, serial.BlobsWritten, parallel.Entries, parallel.BlobsWritten)
+	}
+}
+
+// TestEmitLeavesNoIndexWhenAParallelUploadFails is the fail-closed check with
+// workers in flight: several uploads are in the air when the first one fails,
+// and the index must still never appear. Run under -race this also covers the
+// shared counters.
+func TestEmitLeavesNoIndexWhenAParallelUploadFails(t *testing.T) {
+	fixture := newZoneFixture(t)
+	fixture.zone.failOn = func(key string) bool { return strings.HasPrefix(key, "data/sha1/") }
+	dir := t.TempDir()
+	hak := filepath.Join(dir, "sow_test_01.hak")
+	writeHak(t, hak, manyResources(64))
+
+	if _, err := Emit(EmitOptions{
+		ArtifactKey:  artifactKey(t, hak),
+		ArtifactPath: hak,
+		Sink:         fixture.sink,
+		Jobs:         16,
+	}); err == nil {
+		t.Fatal("emit reported success after an upload failed")
+	}
+	fixture.zone.mu.Lock()
+	defer fixture.zone.mu.Unlock()
+	for key := range fixture.zone.objects {
+		if strings.HasSuffix(key, ".nsym") {
+			t.Errorf("a half-emitted artifact published an index: %s", key)
+		}
+	}
+}
+
+// TestEmitPeakMemoryIsBoundedByJobCount pins the ceiling the parallel emit
+// rests on. Peak still must not track the archive — it tracks the resources in
+// flight, so a bigger hak at the same job count costs the same.
+func TestEmitPeakMemoryIsBoundedByJobCount(t *testing.T) {
+	if testing.Short() {
+		t.Skip("writes a 64 MB fixture")
+	}
+	defer debug.SetGCPercent(debug.SetGCPercent(10))
+
+	measure := func(count, jobs int) uint64 {
+		dir := t.TempDir()
+		hak := filepath.Join(dir, "big.hak")
+		writeStreamedHak(t, hak, count)
+		options := EmitOptions{
+			ArtifactKey:  artifactKey(t, hak),
+			ArtifactPath: hak,
+			As:           filepath.Base(hak),
+			OutDir:       filepath.Join(dir, "out"),
+			Jobs:         jobs,
+		}
+		return peakHeapDuring(func() {
+			if _, err := Emit(options); err != nil {
+				t.Fatalf("emit %d resources at -jobs %d: %v", count, jobs, err)
+			}
+		})
+	}
+
+	const jobs = 8
+	small := measure(8, jobs)  // 8 MB
+	large := measure(64, jobs) // 64 MB
+	// Each worker may hold one resourceSize payload plus its compressed copy,
+	// so the pool itself is the slack — not the archive.
+	const slack = 24 << 20
+
+	t.Logf("peak heap at -jobs %d: 8 MB hak %d bytes, 64 MB hak %d bytes", jobs, small, large)
+	if large > small+slack {
+		t.Fatalf("peak heap scaled with artifact size at -jobs %d: 8 MB hak peaked at %d bytes, 64 MB hak at %d", jobs, small, large)
+	}
+}

internal/nwsync/manifest.go

@@ -0,0 +1,208 @@
+package nwsync
+
+import (
+	"bytes"
+	"encoding/binary"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"path"
+	"path/filepath"
+	"sort"
+	"strings"
+)
+
+// NSYM manifest, version 3, exactly as upstream neverwinter/nwsync.nim writes
+// it. Everything is little-endian:
+//
+//	"NSYM", uint32 version, uint32 entry count, uint32 mapping count,
+//	entries:  byte[20] raw sha1, uint32 size, char[16] resref, uint16 restype
+//	mappings: uint32 entry index,             char[16] resref, uint16 restype
+//
+// Entries are sorted by lowercase sha1 hex then resref, and a resource whose
+// sha1 was already written becomes a mapping instead of a second entry.
+const (
+	manifestVersion = 3
+	hashTreeDepth   = 2
+	resRefBytes     = 16
+)
+
+// Entry is one resource in a manifest.
+type Entry struct {
+	SHA1    [20]byte
+	Size    uint32
+	ResRef  string // lowercase, no extension, at most 16 characters
+	ResType uint16
+}
+
+func (e Entry) sha1Hex() string { return hex.EncodeToString(e.SHA1[:]) }
+
+// Identity is what a resref resolves by: name plus type. It is the merge key
+// inside one artifact and across artifacts alike.
+type Identity struct {
+	ResRef  string
+	ResType uint16
+}
+
+func (e Entry) identity() Identity { return Identity{ResRef: e.ResRef, ResType: e.ResType} }
+
+// writeManifest serialises entries into NSYM v3 bytes.
+func writeManifest(entries []Entry) ([]byte, error) {
+	sorted := make([]Entry, len(entries))
+	copy(sorted, entries)
+	sort.SliceStable(sorted, func(i, j int) bool {
+		left, right := sorted[i].sha1Hex(), sorted[j].sha1Hex()
+		if left != right {
+			return left < right
+		}
+		return sorted[i].ResRef < sorted[j].ResRef
+	})
+
+	var body, mappings bytes.Buffer
+	seen := make(map[string]uint32, len(sorted))
+	var entryCount, mappingCount uint32
+	for _, entry := range sorted {
+		padded, err := padResRef(entry.ResRef)
+		if err != nil {
+			return nil, err
+		}
+		if index, ok := seen[entry.sha1Hex()]; ok {
+			_ = binary.Write(&mappings, binary.LittleEndian, index)
+			mappings.Write(padded)
+			_ = binary.Write(&mappings, binary.LittleEndian, entry.ResType)
+			mappingCount++
+			continue
+		}
+		seen[entry.sha1Hex()] = entryCount
+		entryCount++
+		body.Write(entry.SHA1[:])
+		_ = binary.Write(&body, binary.LittleEndian, entry.Size)
+		body.Write(padded)
+		_ = binary.Write(&body, binary.LittleEndian, entry.ResType)
+	}
+
+	var out bytes.Buffer
+	out.WriteString("NSYM")
+	for _, field := range []uint32{manifestVersion, entryCount, mappingCount} {
+		_ = binary.Write(&out, binary.LittleEndian, field)
+	}
+	out.Write(body.Bytes())
+	out.Write(mappings.Bytes())
+	return out.Bytes(), nil
+}
+
+// readManifest parses NSYM v3 bytes. Mappings are expanded back into entries,
+// the way upstream's reader does, so a caller sees one entry per resref.
+func readManifest(data []byte) ([]Entry, error) {
+	reader := bytes.NewReader(data)
+	magic := make([]byte, 4)
+	if _, err := io.ReadFull(reader, magic); err != nil || string(magic) != "NSYM" {
+		return nil, fmt.Errorf("not a manifest (invalid magic bytes)")
+	}
+	var version, entryCount, mappingCount uint32
+	for _, field := range []*uint32{&version, &entryCount, &mappingCount} {
+		if err := binary.Read(reader, binary.LittleEndian, field); err != nil {
+			return nil, fmt.Errorf("truncated manifest header: %w", err)
+		}
+	}
+	if version != manifestVersion {
+		return nil, fmt.Errorf("unsupported manifest version %d", version)
+	}
+
+	entries := make([]Entry, 0, entryCount+mappingCount)
+	for i := uint32(0); i < entryCount; i++ {
+		var entry Entry
+		if _, err := io.ReadFull(reader, entry.SHA1[:]); err != nil {
+			return nil, fmt.Errorf("truncated entry %d: %w", i, err)
+		}
+		if err := binary.Read(reader, binary.LittleEndian, &entry.Size); err != nil {
+			return nil, fmt.Errorf("truncated entry %d: %w", i, err)
+		}
+		resref, restype, err := readResRef(reader)
+		if err != nil {
+			return nil, fmt.Errorf("truncated entry %d: %w", i, err)
+		}
+		entry.ResRef, entry.ResType = resref, restype
+		entries = append(entries, entry)
+	}
+	for i := uint32(0); i < mappingCount; i++ {
+		var index uint32
+		if err := binary.Read(reader, binary.LittleEndian, &index); err != nil {
+			return nil, fmt.Errorf("truncated mapping %d: %w", i, err)
+		}
+		if index >= entryCount {
+			return nil, fmt.Errorf("mapping %d references non-existent entry %d", i, index)
+		}
+		resref, restype, err := readResRef(reader)
+		if err != nil {
+			return nil, fmt.Errorf("truncated mapping %d: %w", i, err)
+		}
+		target := entries[index]
+		entries = append(entries, Entry{SHA1: target.SHA1, Size: target.Size, ResRef: resref, ResType: restype})
+	}
+	return entries, nil
+}
+
+func readResRef(reader *bytes.Reader) (string, uint16, error) {
+	raw := make([]byte, resRefBytes)
+	if _, err := io.ReadFull(reader, raw); err != nil {
+		return "", 0, err
+	}
+	var restype uint16
+	if err := binary.Read(reader, binary.LittleEndian, &restype); err != nil {
+		return "", 0, err
+	}
+	return strings.ToLower(string(bytes.TrimRight(raw, "\x00"))), restype, nil
+}
+
+func padResRef(resref string) ([]byte, error) {
+	if len(resref) > resRefBytes {
+		return nil, fmt.Errorf("resref %q exceeds %d characters", resref, resRefBytes)
+	}
+	padded := make([]byte, resRefBytes)
+	copy(padded, strings.ToLower(resref))
+	return padded, nil
+}
+
+// Sidecar is the .json file written next to every manifest. Clients fetch it
+// (nwn_nwsync_fetch.nim), so the field names and order match upstream.
+// Upstream omits an integer meta field whose value is 0, hence group_id's
+// omitempty: 0 means absent, not "group zero".
+type Sidecar struct {
+	Version                int    `json:"version"`
+	SHA1                   string `json:"sha1"`
+	HashTreeDepth          int    `json:"hash_tree_depth"`
+	ModuleName             string `json:"module_name"`
+	Description            string `json:"description"`
+	IncludesModuleContents bool   `json:"includes_module_contents"`
+	IncludesClientContents bool   `json:"includes_client_contents"`
+	TotalFiles             int    `json:"total_files"`
+	TotalBytes             int64  `json:"total_bytes"`
+	OnDiskBytes            int64  `json:"on_disk_bytes"`
+	Created                int64  `json:"created"`
+	CreatedWith            string `json:"created_with"`
+	EmitterVersion         string `json:"emitter_version,omitempty"`
+	GroupID                int    `json:"group_id,omitempty"`
+}
+
+func marshalSidecar(sidecar Sidecar) ([]byte, error) {
+	body, err := json.MarshalIndent(sidecar, "", "  ")
+	if err != nil {
+		return nil, err
+	}
+	// Upstream terminates the file with CRLF; match it.
+	return append(body, '\r', '\n'), nil
+}
+
+// blobKey is where a blob lives in a zone, hash tree depth 2. emit writes it,
+// verify reads it and the game client requests it, so the rule lives here and
+// nowhere else.
+func blobKey(sha1Hex string) string {
+	return path.Join("data", "sha1", sha1Hex[0:2], sha1Hex[2:4], sha1Hex)
+}
+
+// blobPath is the same location inside a local repository tree.
+func blobPath(root, sha1Hex string) string {
+	return filepath.Join(root, filepath.FromSlash(blobKey(sha1Hex)))
+}

internal/nwsync/memory_test.go

@@ -0,0 +1,150 @@
+package nwsync
+
+import (
+	"bytes"
+	"fmt"
+	"math/rand"
+	"os"
+	"path/filepath"
+	"runtime"
+	"runtime/debug"
+	"testing"
+	"time"
+
+	"github.com/klauspost/compress/zstd"
+
+	"git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/erf"
+)
+
+// TestSingleThreadedEncoderMatchesDefault pins the claim the blob encoder's
+// concurrency setting rests on: it saves memory only, and a published blob is
+// the same bytes either way.
+func TestSingleThreadedEncoderMatchesDefault(t *testing.T) {
+	standard, err := zstd.NewWriter(nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer standard.Close()
+
+	body := make([]byte, 4<<20)
+	random := rand.New(rand.NewSource(1))
+	random.Read(body[:len(body)/2])
+	for _, size := range []int{0, 1, 4 << 10, len(body)} {
+		if !bytes.Equal(blobEncoder.EncodeAll(body[:size], nil), standard.EncodeAll(body[:size], nil)) {
+			t.Fatalf("%d bytes compress differently at concurrency 1", size)
+		}
+	}
+}
+
+// resourceSize is one payload in the memory fixtures. Real haks hold a few MB
+// per resource, and peak memory is meant to track that, not the archive.
+const resourceSize = 1 << 20
+
+// writeStreamedHak builds a hak of count resources without ever holding the
+// archive in memory, so the fixture itself does not decide the measurement.
+// Payloads are distinct, so no blob is deduplicated away.
+func writeStreamedHak(t *testing.T, path string, count int) {
+	t.Helper()
+	payload := filepath.Join(t.TempDir(), "payload.bin")
+	body := make([]byte, resourceSize)
+	for index := range body {
+		body[index] = byte(index)
+	}
+
+	resources := make([]erf.Resource, 0, count)
+	for index := range count {
+		// A distinct first byte per resource is enough to give every payload
+		// its own sha1 while still streaming from one file per resource.
+		unique := filepath.Join(filepath.Dir(payload), fmt.Sprintf("p%d.bin", index))
+		body[0] = byte(index)
+		body[1] = byte(index >> 8)
+		if err := os.WriteFile(unique, body, 0o644); err != nil {
+			t.Fatal(err)
+		}
+		resources = append(resources, erf.Resource{
+			Name:       fmt.Sprintf("res%05d", index),
+			Type:       restype(t, "tga"),
+			SourcePath: unique,
+			Size:       resourceSize,
+		})
+	}
+
+	file, err := os.Create(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer file.Close()
+	if err := erf.Write(file, erf.New("HAK", resources)); err != nil {
+		t.Fatalf("write hak: %v", err)
+	}
+}
+
+// peakHeapDuring runs work while sampling the heap, and returns the largest
+// live heap it saw.
+func peakHeapDuring(work func()) uint64 {
+	runtime.GC()
+	done := make(chan struct{})
+	peak := make(chan uint64, 1)
+	go func() {
+		var highest uint64
+		var stats runtime.MemStats
+		for {
+			select {
+			case <-done:
+				peak <- highest
+				return
+			default:
+			}
+			runtime.ReadMemStats(&stats)
+			if stats.HeapAlloc > highest {
+				highest = stats.HeapAlloc
+			}
+			time.Sleep(time.Millisecond)
+		}
+	}()
+	work()
+	close(done)
+	return <-peak
+}
+
+// TestEmitPeakMemoryDoesNotScaleWithArtifactSize is the regression check for
+// the OOM kills on large haks: emit used to hold the whole archive (twice), so
+// a 2 GB hak needed about 10 GB. Emitting an archive 8× bigger must not cost
+// meaningfully more memory.
+func TestEmitPeakMemoryDoesNotScaleWithArtifactSize(t *testing.T) {
+	if testing.Short() {
+		t.Skip("writes a 64 MB fixture")
+	}
+	// A lazy GC lets garbage pile up in proportion to the live heap, which
+	// hides the thing under test. Collecting eagerly makes the sampled heap
+	// track what emit actually holds.
+	defer debug.SetGCPercent(debug.SetGCPercent(10))
+
+	measure := func(count int) uint64 {
+		dir := t.TempDir()
+		hak := filepath.Join(dir, "big.hak")
+		writeStreamedHak(t, hak, count)
+		// The key is computed outside the measurement: the test helper reads
+		// the whole file to hash it, which emit itself no longer does.
+		options := EmitOptions{
+			ArtifactKey:  artifactKey(t, hak),
+			ArtifactPath: hak,
+			As:           filepath.Base(hak),
+			OutDir:       filepath.Join(dir, "out"),
+		}
+		return peakHeapDuring(func() {
+			if _, err := Emit(options); err != nil {
+				t.Fatalf("emit %d resources: %v", count, err)
+			}
+		})
+	}
+
+	small := measure(8)  // 8 MB
+	large := measure(64) // 64 MB
+	const slack = 24 << 20
+
+	t.Logf("peak heap: 8 MB hak %d bytes, 64 MB hak %d bytes", small, large)
+	if large > small+slack {
+		t.Fatalf("peak heap scaled with artifact size: 8 MB hak peaked at %d bytes, 64 MB hak at %d", small, large)
+	}
+}

internal/nwsync/nwsync_test.go

@@ -0,0 +1,531 @@
+package nwsync
+
+import (
+	"bytes"
+	"crypto/sha1"
+	"crypto/sha256"
+	"encoding/binary"
+	"encoding/hex"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/erf"
+)
+
+func restype(t *testing.T, extension string) uint16 {
+	t.Helper()
+	value, ok := erf.ResourceTypeForExtension(extension)
+	if !ok {
+		t.Fatalf("unknown restype %q", extension)
+	}
+	return value
+}
+
+// writeHak builds a HAK fixture from resref.ext => body pairs.
+func writeHak(t *testing.T, path string, contents map[string][]byte) {
+	t.Helper()
+	resources := make([]erf.Resource, 0, len(contents))
+	for name, body := range contents {
+		stem, extension, _ := strings.Cut(name, ".")
+		resources = append(resources, erf.Resource{
+			Name: stem,
+			Type: restype(t, extension),
+			Data: body,
+			Size: int64(len(body)),
+		})
+	}
+	var out bytes.Buffer
+	if err := erf.Write(&out, erf.New("HAK", resources)); err != nil {
+		t.Fatalf("write hak: %v", err)
+	}
+	if err := os.WriteFile(path, out.Bytes(), 0o644); err != nil {
+		t.Fatalf("write hak file: %v", err)
+	}
+}
+
+// artifactKey is the depot key a file would be published under: the sha256 of
+// its bytes, hash-tree depth 2, keeping the extension.
+func artifactKey(t *testing.T, path string) string {
+	t.Helper()
+	body, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	sum := sha256.Sum256(body)
+	digest := hex.EncodeToString(sum[:])
+	return "artifacts/haks/sha256/" + digest[0:2] + "/" + digest[2:4] + "/" + digest + filepath.Ext(path)
+}
+
+// emitLocal emits one artifact into a local tree, the conformance path.
+func emitLocal(t *testing.T, path, out string) (EmitResult, error) {
+	t.Helper()
+	return Emit(EmitOptions{
+		ArtifactKey:  artifactKey(t, path),
+		ArtifactPath: path,
+		As:           filepath.Base(path),
+		OutDir:       out,
+	})
+}
+
+func TestBlobFramingRoundTrips(t *testing.T) {
+	data := []byte("the quick brown fox jumps over the lazy dog, repeatedly and at length")
+	blob := compressBlob(data)
+
+	header := make([]uint32, 6)
+	if err := binary.Read(bytes.NewReader(blob[:blobHeaderBytes]), binary.LittleEndian, header); err != nil {
+		t.Fatalf("read header: %v", err)
+	}
+	want := []uint32{blobMagic, 3, 2, uint32(len(data)), 1, 0}
+	for i := range want {
+		if header[i] != want[i] {
+			t.Errorf("header field %d = %d, want %d", i, header[i], want[i])
+		}
+	}
+	if string(blob[:4]) != "NSYC" {
+		t.Errorf("magic bytes = %q, want NSYC", blob[:4])
+	}
+
+	got, err := decompressBlob(blob)
+	if err != nil {
+		t.Fatalf("decompress: %v", err)
+	}
+	if !bytes.Equal(got, data) {
+		t.Errorf("round trip mismatch: %q", got)
+	}
+}
+
+func TestManifestBytesMatchUpstreamLayout(t *testing.T) {
+	shared := sha1.Sum([]byte("shared"))
+	other := sha1.Sum([]byte("other"))
+	// Deliberately out of order, and with two resrefs sharing one sha1: the
+	// second one must become a mapping, not a second entry.
+	entries := []Entry{
+		{SHA1: other, Size: 5, ResRef: "zzz", ResType: 1},
+		{SHA1: shared, Size: 6, ResRef: "bbb", ResType: 2},
+		{SHA1: shared, Size: 6, ResRef: "aaa", ResType: 3},
+	}
+	data, err := writeManifest(entries)
+	if err != nil {
+		t.Fatalf("write manifest: %v", err)
+	}
+
+	if string(data[:4]) != "NSYM" {
+		t.Fatalf("magic = %q", data[:4])
+	}
+	var version, entryCount, mappingCount uint32
+	reader := bytes.NewReader(data[4:16])
+	for _, field := range []*uint32{&version, &entryCount, &mappingCount} {
+		_ = binary.Read(reader, binary.LittleEndian, field)
+	}
+	if version != 3 || entryCount != 2 || mappingCount != 1 {
+		t.Fatalf("header = version %d, %d entries, %d mappings; want 3/2/1", version, entryCount, mappingCount)
+	}
+	wantSize := 16 + int(entryCount)*(20+4+16+2) + int(mappingCount)*(4+16+2)
+	if len(data) != wantSize {
+		t.Fatalf("manifest is %d bytes, want %d", len(data), wantSize)
+	}
+
+	// Sorted by sha1 hex then resref, so the shared hash's "aaa" is the entry
+	// and "bbb" is demoted to a mapping.
+	round, err := readManifest(data)
+	if err != nil {
+		t.Fatalf("read manifest: %v", err)
+	}
+	if len(round) != 3 {
+		t.Fatalf("round trip returned %d entries, want 3", len(round))
+	}
+	byResRef := map[string]Entry{}
+	for _, entry := range round {
+		byResRef[entry.ResRef] = entry
+	}
+	for _, entry := range entries {
+		got, ok := byResRef[entry.ResRef]
+		if !ok {
+			t.Fatalf("resref %q lost in round trip", entry.ResRef)
+		}
+		if got != entry {
+			t.Errorf("resref %q = %+v, want %+v", entry.ResRef, got, entry)
+		}
+	}
+	if round[0].ResRef != "aaa" && round[1].ResRef != "aaa" {
+		t.Errorf("entries are not sorted by sha1 then resref: %+v", round)
+	}
+}
+
+func TestEmitWritesBlobsAndManifest(t *testing.T) {
+	dir := t.TempDir()
+	hak := filepath.Join(dir, "sow_test_01.hak")
+	body := []byte("texture bytes")
+	writeHak(t, hak, map[string][]byte{
+		"bloodstain1.tga": body,
+		"copy1.txi":       body, // same content, different resref: one blob
+		"script1.nss":     []byte("void main() {}"),
+		"debug1.ndb":      []byte("debug"),
+		"comment1.gic":    []byte("comment"),
+	})
+
+	out := filepath.Join(dir, "out")
+	result, err := emitLocal(t, hak, out)
+	if err != nil {
+		t.Fatalf("emit: %v", err)
+	}
+	if result.Entries != 2 {
+		t.Errorf("emitted %d entries, want 2 (nss/ndb/gic are always skipped)", result.Entries)
+	}
+	if result.BlobsWritten != 1 {
+		t.Errorf("wrote %d blobs, want 1 (identical content shares a blob)", result.BlobsWritten)
+	}
+
+	// The blob is named by the sha1 of the uncompressed bytes, under a depth-2
+	// hash tree, and decompresses back to exactly those bytes.
+	sum := sha1.Sum(body)
+	name := hex.EncodeToString(sum[:])
+	path := filepath.Join(out, "data", "sha1", name[0:2], name[2:4], name)
+	blob, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("blob missing at %s: %v", path, err)
+	}
+	got, err := decompressBlob(blob)
+	if err != nil {
+		t.Fatalf("decompress blob: %v", err)
+	}
+	if !bytes.Equal(got, body) {
+		t.Errorf("blob decompressed to %q, want %q", got, body)
+	}
+
+	entries := readEmitted(t, result.ManifestPath)
+	for _, entry := range entries {
+		if entry.ResType == restype(t, "nss") || entry.ResType == restype(t, "ndb") || entry.ResType == restype(t, "gic") {
+			t.Errorf("skipped restype leaked into the manifest: %+v", entry)
+		}
+	}
+
+	var sidecar Sidecar
+	body2, err := os.ReadFile(result.ManifestPath + ".json")
+	if err != nil {
+		t.Fatalf("sidecar missing: %v", err)
+	}
+	if err := json.Unmarshal(body2, &sidecar); err != nil {
+		t.Fatalf("sidecar json: %v", err)
+	}
+	if sidecar.TotalFiles != 2 || sidecar.HashTreeDepth != 2 || sidecar.Version != 3 {
+		t.Errorf("sidecar = %+v", sidecar)
+	}
+	if sidecar.IncludesModuleContents {
+		t.Error("sidecar claims module contents; a published manifest never has them")
+	}
+	if strings.Contains(string(body2), "group_id") {
+		t.Error("per-artifact sidecar should omit group_id (0 means absent)")
+	}
+	if _, err := os.Stat(filepath.Join(out, "latest")); err == nil {
+		t.Error("a latest file was written; there must never be one")
+	}
+}
+
+func readEmitted(t *testing.T, indexPath string) []Entry {
+	t.Helper()
+	data, err := os.ReadFile(indexPath)
+	if err != nil {
+		t.Fatalf("read emitted manifest: %v", err)
+	}
+	entries, err := readManifest(data)
+	if err != nil {
+		t.Fatalf("parse emitted manifest: %v", err)
+	}
+	return entries
+}
+
+func TestEmitFailsClosedOnOversizeResource(t *testing.T) {
+	dir := t.TempDir()
+	hak := filepath.Join(dir, "big.hak")
+	writeHak(t, hak, map[string][]byte{"huge1.tga": make([]byte, fileSizeLimit+1)})
+
+	if _, err := emitLocal(t, hak, filepath.Join(dir, "out")); err == nil {
+		t.Fatal("emit accepted a resource over the 15 MB limit")
+	}
+}
+
+func TestEmitLooseFile(t *testing.T) {
+	dir := t.TempDir()
+	tlk := filepath.Join(dir, "sow_tlk.tlk")
+	if err := os.WriteFile(tlk, []byte("TLK V3.0 payload"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	out := filepath.Join(dir, "out")
+	result, err := emitLocal(t, tlk, out)
+	if err != nil {
+		t.Fatalf("emit tlk: %v", err)
+	}
+	entries := readEmitted(t, result.ManifestPath)
+	if len(entries) != 1 || entries[0].ResRef != "sow_tlk" || entries[0].ResType != restype(t, "tlk") {
+		t.Fatalf("tlk emitted as %+v", entries)
+	}
+	if result.BlobsWritten != 1 {
+		t.Errorf("wrote %d blobs, want 1", result.BlobsWritten)
+	}
+}
+
+// emitFixture emits two haks that share a resref, so the merge rule is
+// observable: "top" holds the winning body, "assets" the shadowed one.
+func emitFixture(t *testing.T) (out string, keys map[string]string, topBody, assetBody []byte) {
+	t.Helper()
+	dir := t.TempDir()
+	topBody = []byte("2da from sow_top")
+	assetBody = []byte("2da from the asset hak")
+	writeHak(t, filepath.Join(dir, "sow_top.hak"), map[string][]byte{"appearance.2da": topBody})
+	writeHak(t, filepath.Join(dir, "sow_core_01.hak"), map[string][]byte{
+		"appearance.2da":  assetBody,
+		"bloodstain1.tga": []byte("blood"),
+	})
+	out = filepath.Join(dir, "out")
+	keys = map[string]string{}
+	for _, name := range []string{"sow_top", "sow_core_01"} {
+		path := filepath.Join(dir, name+".hak")
+		keys[name] = artifactKey(t, path)
+		if _, err := emitLocal(t, path, out); err != nil {
+			t.Fatalf("emit %s: %v", name, err)
+		}
+	}
+	return out, keys, topBody, assetBody
+}
+
+func TestAssembleShadowsByOrder(t *testing.T) {
+	entriesDir, keys, topBody, assetBody := emitFixture(t)
+
+	result, err := Assemble(AssembleOptions{
+		ArtifactKeys: []string{keys["sow_top"], keys["sow_core_01"]},
+		OutDir:       entriesDir,
+		GroupID:      2,
+	})
+	if err != nil {
+		t.Fatalf("assemble: %v", err)
+	}
+	if result.Entries != 2 {
+		t.Fatalf("merged %d entries, want 2 (appearance.2da is shadowed, not duplicated)", result.Entries)
+	}
+
+	data, err := os.ReadFile(result.ManifestPath)
+	if err != nil {
+		t.Fatalf("read merged manifest: %v", err)
+	}
+	merged := sha1.Sum(data)
+	if hex.EncodeToString(merged[:]) != result.SHA1 || filepath.Base(result.ManifestPath) != result.SHA1 {
+		t.Errorf("manifest is not named by its own sha1: %s", result.ManifestPath)
+	}
+	entries, err := readManifest(data)
+	if err != nil {
+		t.Fatalf("parse merged manifest: %v", err)
+	}
+	for _, entry := range entries {
+		if entry.ResRef != "appearance" {
+			continue
+		}
+		if entry.SHA1 != sha1.Sum(topBody) {
+			t.Errorf("appearance.2da resolved to the wrong hak; want the earliest in --order")
+		}
+		if entry.SHA1 == sha1.Sum(assetBody) {
+			t.Error("appearance.2da resolved to the shadowed hak")
+		}
+	}
+
+	sidecar := Sidecar{}
+	body, err := os.ReadFile(result.ManifestPath + ".json")
+	if err != nil {
+		t.Fatalf("merged sidecar missing: %v", err)
+	}
+	if err := json.Unmarshal(body, &sidecar); err != nil {
+		t.Fatalf("merged sidecar json: %v", err)
+	}
+	if sidecar.GroupID != 2 {
+		t.Errorf("group_id = %d, want 2 (testing)", sidecar.GroupID)
+	}
+	if sidecar.SHA1 != result.SHA1 {
+		t.Errorf("sidecar sha1 = %s, want %s", sidecar.SHA1, result.SHA1)
+	}
+	if sidecar.TotalFiles != 2 {
+		t.Errorf("total_files = %d, want 2", sidecar.TotalFiles)
+	}
+}
+
+func TestAssembleReversedOrderPicksTheOtherHak(t *testing.T) {
+	entriesDir, keys, topBody, assetBody := emitFixture(t)
+
+	result, err := Assemble(AssembleOptions{
+		ArtifactKeys: []string{keys["sow_core_01"], keys["sow_top"]},
+		OutDir:       entriesDir,
+	})
+	if err != nil {
+		t.Fatalf("assemble: %v", err)
+	}
+	data, _ := os.ReadFile(result.ManifestPath)
+	entries, err := readManifest(data)
+	if err != nil {
+		t.Fatalf("parse merged manifest: %v", err)
+	}
+	for _, entry := range entries {
+		if entry.ResRef == "appearance" && entry.SHA1 != sha1.Sum(assetBody) {
+			t.Errorf("appearance.2da did not follow --order; still resolves to %x", entry.SHA1)
+		}
+	}
+	_ = topBody
+}
+
+func TestAssembleRefusesMismatchedEmitterVersions(t *testing.T) {
+	entriesDir, keys, _, _ := emitFixture(t)
+
+	index, err := resolveIndexKey(keys["sow_core_01"], entriesDir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(entriesDir, index+".json")
+	var sidecar Sidecar
+	body, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := json.Unmarshal(body, &sidecar); err != nil {
+		t.Fatal(err)
+	}
+	sidecar.EmitterVersion = "0"
+	patched, err := marshalSidecar(sidecar)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(path, patched, 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	_, err = Assemble(AssembleOptions{
+		ArtifactKeys: []string{keys["sow_top"], keys["sow_core_01"]},
+		OutDir:       entriesDir,
+	})
+	if err == nil || !strings.Contains(err.Error(), "emitter version mismatch") {
+		t.Fatalf("assemble merged across emitter versions: %v", err)
+	}
+}
+
+func TestEmitHonoursSourceDateEpoch(t *testing.T) {
+	t.Setenv("SOURCE_DATE_EPOCH", "1700000000")
+	dir := t.TempDir()
+	hak := filepath.Join(dir, "pinned.hak")
+	writeHak(t, hak, map[string][]byte{"one1.tga": []byte("body")})
+	result, err := emitLocal(t, hak, filepath.Join(dir, "out"))
+	if err != nil {
+		t.Fatalf("emit: %v", err)
+	}
+	body, err := os.ReadFile(result.ManifestPath + ".json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var sidecar Sidecar
+	if err := json.Unmarshal(body, &sidecar); err != nil {
+		t.Fatal(err)
+	}
+	if sidecar.Created != 1700000000 {
+		t.Errorf("created = %d, want the pinned SOURCE_DATE_EPOCH", sidecar.Created)
+	}
+}
+
+func TestEmitRejectsAModule(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "sow.mod")
+	var out bytes.Buffer
+	if err := erf.Write(&out, erf.New("MOD", []erf.Resource{
+		{Name: "module", Type: restype(t, "ifo"), Data: []byte("ifo"), Size: 3},
+	})); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(path, out.Bytes(), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := emitLocal(t, path, filepath.Join(dir, "out")); err == nil {
+		t.Fatal("emit accepted a .mod; a manifest never carries module contents")
+	}
+}
+
+func TestAssembleFailsClosedOnMissingIndex(t *testing.T) {
+	entriesDir, keys, _, _ := emitFixture(t)
+	missing := "artifacts/haks/sha256/00/11/" + strings.Repeat("0", 64) + ".hak"
+	_, err := Assemble(AssembleOptions{
+		ArtifactKeys: []string{keys["sow_top"], missing},
+		OutDir:       entriesDir,
+	})
+	if err == nil || !strings.Contains(err.Error(), missing) {
+		t.Fatalf("assemble did not fail closed and name the missing artifact: %v", err)
+	}
+}
+
+// Callers capture a script's stdout as a value: `dir="$(pack-haks.sh)"`. A
+// summary line on stdout gets glued onto that value, so both summaries belong
+// on stderr.
+func TestRunKeepsSummariesOffStdout(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "sow_top.hak")
+	writeHak(t, path, map[string][]byte{"appearance.2da": []byte("2da from sow_top")})
+	key := artifactKey(t, path)
+	out := filepath.Join(dir, "out")
+
+	for _, args := range [][]string{
+		{"emit", "--out", out, "--as", "sow_top.hak", key, path},
+		{"assemble", "--out", out, key},
+	} {
+		var stdout, stderr bytes.Buffer
+		if code := Run(args, &stdout, &stderr); code != exitOK {
+			t.Fatalf("Run(%v) exit=%d: %s", args, code, stderr.String())
+		}
+		if stdout.Len() != 0 {
+			t.Errorf("Run(%v) wrote to stdout: %q", args, stdout.String())
+		}
+		if stderr.Len() == 0 {
+			t.Errorf("Run(%v) reported no summary on stderr", args)
+		}
+	}
+}
+
+func TestRunUsageErrors(t *testing.T) {
+	cases := [][]string{
+		nil,
+		{"nope"},
+		{"emit"},
+		{"emit", "artifact-key.hak"},
+		{"emit", "a", "b", "c"},
+		{"assemble", "--out", "y"},
+	}
+	for _, args := range cases {
+		var out, errw bytes.Buffer
+		if code := Run(args, &out, &errw); code != exitUsage {
+			t.Errorf("Run(%v) exit=%d, want %d", args, code, exitUsage)
+		}
+	}
+}
+
+// TestEveryBlobDeclaresItsFrameContentSize guards the fault that stopped every
+// client sync (#86): klauspost/compress omits Frame_Content_Size for inputs
+// under 256 bytes, and the game client cannot decode a frame without it. This
+// asserts a frame property, not a round trip — the zstd CLI and Go's decoder
+// both stream such a frame happily, so round-tripping cannot see the defect.
+func TestEveryBlobDeclaresItsFrameContentSize(t *testing.T) {
+	// 230 and 175 are real sizes from the manifest that failed to sync; 255/256
+	// straddle the encoder's threshold.
+	for _, size := range []int{1, 32, 175, 230, 255, 256, 257, 1024, 5000} {
+		payload := make([]byte, size)
+		for i := range payload {
+			payload[i] = byte('a' + i%26)
+		}
+		blob := compressBlob(payload)
+		if !frameDeclaresContentSize(blob[blobHeaderBytes:]) {
+			t.Errorf("blob of %d bytes declares no frame content size (descriptor %#x)",
+				size, blob[blobHeaderBytes+4])
+		}
+		got, err := decompressBlob(blob)
+		if err != nil {
+			t.Fatalf("decompress %d-byte blob: %v", size, err)
+		}
+		if !bytes.Equal(got, payload) {
+			t.Errorf("%d-byte blob did not round trip", size)
+		}
+	}
+}

internal/nwsync/run.go

@@ -0,0 +1,201 @@
+// Package nwsync publishes NWSync repository data: blobs and a per-artifact
+// NSYM manifest at each artifact's birth (emit), and one merged manifest at
+// module release (assemble).
+//
+// The split exists because upstream nwn_nwsync_write wants every hak, the TLK
+// and the module present in one run on one disk, which our build hosts cannot
+// hold. Upstream stays the conformance oracle: manifests compare byte for
+// byte, blobs compare after decompression.
+package nwsync
+
+import (
+	"flag"
+	"fmt"
+	"io"
+	"os"
+)
+
+const (
+	exitOK       = 0
+	exitUsage    = 64
+	exitInternal = 70
+	// exitDrift says the command worked and the zone is wrong, which is a
+	// different thing for CI to act on than the command failing. It matches
+	// depot's code for the same meaning.
+	exitDrift = 1
+)
+
+// Run executes an nwsync subcommand. args[0] is the subcommand (emit|assemble);
+// returns the process exit code.
+func Run(args []string, stdout, stderr io.Writer) int {
+	if len(args) == 0 {
+		printRunUsage(stderr)
+		return exitUsage
+	}
+	switch args[0] {
+	case "emit":
+		return runEmit(args[1:], stderr)
+	case "assemble":
+		return runAssemble(args[1:], stderr)
+	case "verify":
+		return runVerify(args[1:], stdout, stderr, os.Getenv)
+	case "-h", "--help", "help":
+		printRunUsage(stdout)
+		return exitOK
+	default:
+		fmt.Fprintf(stderr, "nwsync: unknown subcommand %q\n\n", args[0])
+		printRunUsage(stderr)
+		return exitUsage
+	}
+}
+
+func printRunUsage(w io.Writer) {
+	fmt.Fprint(w, `usage:
+  nwsync emit     [--as NAME] [--out DIR] [--verify] <artifact-key> <file>
+  nwsync assemble --group-id N [--tlk-key KEY] [--out DIR] <artifact-key>...
+  nwsync verify   [--sample N] [--base URL] <manifest-sha1>
+
+emit explodes one .hak/.erf or one loose file (the TLK) into NWSync blobs plus
+a NSYM index covering only that artifact, and uploads both. assemble merges
+those indexes into one manifest, reading no bulk data. Artifact keys are depot
+keys; an index lives beside its artifact, with the extension replaced.
+
+verify reads a published manifest and its blobs back through the public pull
+zone, with no credential, and decompresses and hashes every one. It is the only
+check on a published blob upstream of a player's client.
+
+--verify makes emit hash what it would otherwise skip. emit normally treats a
+blob's presence as proof of its contents, so without this an object written
+truncated, or written by an emitter since found broken, is skipped forever.
+--verify repairs the storage zone, while verify reads the edge in front of it,
+so purge the pull zone after a repair or verify answers differently per PoP.
+
+--out DIR writes to a local repository tree instead of uploading, which is the
+conformance path against upstream nwn_nwsync_write. Without it, the zone comes
+from NWSYNC_STORAGE_ZONE, NWSYNC_STORAGE_PASSWORD and BUNNY_STORAGE_HOST.
+verify needs none of those; its base comes from --base or NWSYNC_PULL_BASE.
+`)
+}
+
+// parseArgs parses flags that may appear before, after or between positionals.
+// Go's flag package stops at the first non-flag argument, which turns
+// `emit <key> <file> --out DIR` into a confusing arity error.
+func parseArgs(fs *flag.FlagSet, args []string) ([]string, error) {
+	var positional []string
+	for {
+		if err := fs.Parse(args); err != nil {
+			return nil, err
+		}
+		rest := fs.Args()
+		if len(rest) == 0 {
+			return positional, nil
+		}
+		positional = append(positional, rest[0])
+		args = rest[1:]
+	}
+}
+
+func runEmit(args []string, stderr io.Writer) int {
+	fs := flag.NewFlagSet("emit", flag.ContinueOnError)
+	fs.SetOutput(stderr)
+	as := fs.String("as", "", "published name of the artifact, when it differs from the key")
+	out := fs.String("out", "", "write to a local repository tree instead of uploading")
+	jobs := fs.Int("jobs", defaultEmitJobs, "resources to hash, compress and store at once")
+	verify := fs.Bool("verify", false, "read back and hash blobs that already exist instead of trusting their presence")
+	positional, err := parseArgs(fs, args)
+	if err != nil {
+		return exitUsage
+	}
+	if len(positional) != 2 {
+		fmt.Fprintf(stderr, "nwsync emit: <artifact-key> and <file> are both required\n")
+		return exitUsage
+	}
+	if *jobs < 1 {
+		fmt.Fprintf(stderr, "nwsync emit: -jobs must be at least 1, got %d\n", *jobs)
+		return exitUsage
+	}
+
+	result, err := Emit(EmitOptions{
+		ArtifactKey:  positional[0],
+		ArtifactPath: positional[1],
+		As:           *as,
+		OutDir:       *out,
+		Jobs:         *jobs,
+		Verify:       *verify,
+	})
+	if err != nil {
+		fmt.Fprintf(stderr, "nwsync emit: %v\n", err)
+		return exitInternal
+	}
+	fmt.Fprintf(stderr, "emitted %s: %d resources, %d new blobs, index %s\n",
+		result.Name, result.Entries, result.BlobsWritten, result.ManifestPath)
+	return exitOK
+}
+
+func runVerify(args []string, stdout, stderr io.Writer, getenv func(string) string) int {
+	fs := flag.NewFlagSet("verify", flag.ContinueOnError)
+	fs.SetOutput(stderr)
+	base := fs.String("base", getenv("NWSYNC_PULL_BASE"), "pull zone base URL to read through")
+	sample := fs.Int("sample", 0, "check this many random blobs instead of all of them")
+	jobs := fs.Int("jobs", defaultEmitJobs, "blobs to fetch and hash at once")
+	positional, err := parseArgs(fs, args)
+	if err != nil {
+		return exitUsage
+	}
+	if len(positional) != 1 {
+		fmt.Fprintf(stderr, "nwsync verify: exactly one <manifest-sha1> is required\n")
+		return exitUsage
+	}
+
+	result, err := Verify(VerifyOptions{
+		ManifestSHA1: positional[0],
+		Base:         *base,
+		Sample:       *sample,
+		Jobs:         *jobs,
+		Log:          stderr,
+	})
+	if err != nil {
+		fmt.Fprintf(stderr, "nwsync verify: %v\n", err)
+		return exitInternal
+	}
+	fmt.Fprintf(stdout, "verified %d of %d blobs behind %d resources: %d failures, %d bytes checked\n",
+		result.Checked, result.Blobs, result.Entries, result.Failures, result.Bytes)
+	if result.Failures > 0 {
+		return exitDrift
+	}
+	return exitOK
+}
+
+func runAssemble(args []string, stderr io.Writer) int {
+	fs := flag.NewFlagSet("assemble", flag.ContinueOnError)
+	fs.SetOutput(stderr)
+	tlkKey := fs.String("tlk-key", "", "depot key of the TLK, which shadows nothing and merges last")
+	out := fs.String("out", "", "write to a local repository tree instead of uploading")
+	groupID := fs.Int("group-id", 0, "NWSync group id (1 = current, 2 = testing; 0 omits it)")
+	moduleName := fs.String("module-name", "", "module name recorded in the sidecar")
+	description := fs.String("description", "", "description recorded in the sidecar")
+	positional, err := parseArgs(fs, args)
+	if err != nil {
+		return exitUsage
+	}
+	if len(positional) == 0 {
+		fmt.Fprintf(stderr, "nwsync assemble: at least one artifact key is required\n")
+		return exitUsage
+	}
+
+	result, err := Assemble(AssembleOptions{
+		ArtifactKeys: positional,
+		TLKKey:       *tlkKey,
+		OutDir:       *out,
+		GroupID:      *groupID,
+		ModuleName:   *moduleName,
+		Description:  *description,
+	})
+	if err != nil {
+		fmt.Fprintf(stderr, "nwsync assemble: %v\n", err)
+		return exitInternal
+	}
+	fmt.Fprintf(stderr, "assembled manifest %s: %d resources, %s\n",
+		result.SHA1, result.Entries, result.ManifestPath)
+	return exitOK
+}

internal/nwsync/sink.go

@@ -0,0 +1,241 @@
+package nwsync
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+
+	"git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/depot"
+)
+
+// sink is where an emit or assemble run puts what it produces. The zone is the
+// production sink; a local directory exists only as the conformance path, so
+// upstream's output and ours can be diffed on a developer machine.
+type sink interface {
+	// putBlob stores one NWCompressedBuffer blob under its sha1 name and
+	// returns the bytes stored, or 0 if a good copy was already there. Blob
+	// names are content hashes, so an existing name is normally taken as
+	// existing content — which is why body is a thunk: compression is the
+	// expensive part of emit and a blob that is already stored must not pay
+	// for it.
+	//
+	// verify stops trusting presence: the stored copy is read back, unwrapped
+	// and hashed, and replaced when it is not what its name claims. Without it
+	// an object written truncated, or written by an emitter since found broken,
+	// is skipped by every later emit forever and no backfill can repair it.
+	putBlob(sha1Hex string, verify bool, body func() []byte) (int64, error)
+	// putIndex stores a NSYM manifest and its sidecar under key, which is
+	// either an artifact-derived object key or a local path.
+	putIndex(key string, manifest, sidecar []byte) error
+	// getIndex reads back a NSYM manifest and its sidecar.
+	getIndex(key string) (manifest, sidecar []byte, err error)
+	// describe names the sink for messages.
+	describe(key string) string
+}
+
+// dirSink writes a local NWSync repository tree.
+type dirSink struct{ root string }
+
+func (s dirSink) putBlob(sha1Hex string, verify bool, body func() []byte) (int64, error) {
+	blob := blobPath(s.root, sha1Hex)
+	if !verify {
+		// Stat, not read: the common path must not pay to open every blob that
+		// is already there.
+		if _, err := os.Stat(blob); err == nil {
+			return 0, nil
+		}
+	} else if stored, err := os.ReadFile(blob); err == nil && blobMatchesName(stored, sha1Hex) == nil {
+		return 0, nil
+	}
+	if err := os.MkdirAll(filepath.Dir(blob), 0o755); err != nil {
+		return 0, fmt.Errorf("create blob directory: %w", err)
+	}
+	data := body()
+	if err := os.WriteFile(blob, data, 0o644); err != nil {
+		return 0, fmt.Errorf("write blob: %w", err)
+	}
+	return int64(len(data)), nil
+}
+
+func (s dirSink) putIndex(key string, manifest, sidecar []byte) error {
+	target := filepath.Join(s.root, filepath.FromSlash(key))
+	if err := os.MkdirAll(filepath.Dir(target), 0o755); err != nil {
+		return fmt.Errorf("create manifest directory: %w", err)
+	}
+	if err := os.WriteFile(target, manifest, 0o644); err != nil {
+		return fmt.Errorf("write manifest: %w", err)
+	}
+	if err := os.WriteFile(target+".json", sidecar, 0o644); err != nil {
+		return fmt.Errorf("write sidecar: %w", err)
+	}
+	return nil
+}
+
+func (s dirSink) getIndex(key string) ([]byte, []byte, error) {
+	target := filepath.Join(s.root, filepath.FromSlash(key))
+	manifest, err := os.ReadFile(target)
+	if err != nil {
+		return nil, nil, fmt.Errorf("read index: %w", err)
+	}
+	sidecar, err := os.ReadFile(target + ".json")
+	if err != nil {
+		return nil, nil, fmt.Errorf("read sidecar: %w", err)
+	}
+	return manifest, sidecar, nil
+}
+
+func (s dirSink) describe(key string) string {
+	return filepath.Join(s.root, filepath.FromSlash(key))
+}
+
+// zoneSink uploads straight to the NWSync storage zone. Nothing bulky is ever
+// written to the runner's disk: the working set is one resource at a time.
+type zoneSink struct {
+	store depot.KeyStore
+	ctx   context.Context
+	zone  string
+}
+
+func (s zoneSink) putBlob(sha1Hex string, verify bool, body func() []byte) (int64, error) {
+	key := blobKey(sha1Hex)
+	// A throttled probe must never be read as "missing, re-upload" or as
+	// "present, skip", so only a confirmed Present skips the upload.
+	state, _, err := s.store.ProbeKey(s.ctx, key)
+	if err != nil {
+		return 0, fmt.Errorf("probe blob %s: %w", sha1Hex, err)
+	}
+	if state == depot.Present {
+		if !verify {
+			return 0, nil
+		}
+		// The probe only proved the object exists. Read it back and hold it to
+		// its own name.
+		//
+		// This reads the storage API rather than the pull zone: emit holds the
+		// write credential, and a repair decision has to be made against the
+		// copy it is about to overwrite, not against an edge cache of it. A
+		// read that fails outright is a fault, not a verdict — treating it as
+		// "bad, re-upload" would turn a throttled zone into a full backfill.
+		stored, err := s.store.GetKey(s.ctx, key)
+		if err != nil {
+			return 0, fmt.Errorf("read back blob %s: %w", sha1Hex, err)
+		}
+		if blobMatchesName(stored, sha1Hex) == nil {
+			return 0, nil
+		}
+	}
+	data := body()
+	if err := s.put(key, data); err != nil {
+		return 0, fmt.Errorf("upload blob %s: %w", sha1Hex, err)
+	}
+	return int64(len(data)), nil
+}
+
+func (s zoneSink) putIndex(key string, manifest, sidecar []byte) error {
+	// The manifest lands last: its presence is the publication marker, so it
+	// must never appear before the blobs it names.
+	if err := s.put(key+".json", sidecar); err != nil {
+		return fmt.Errorf("upload sidecar %s: %w", key, err)
+	}
+	if err := s.put(key, manifest); err != nil {
+		return fmt.Errorf("upload index %s: %w", key, err)
+	}
+	return nil
+}
+
+func (s zoneSink) getIndex(key string) ([]byte, []byte, error) {
+	manifest, err := s.store.GetKey(s.ctx, key)
+	if err != nil {
+		return nil, nil, fmt.Errorf("read index: %w", err)
+	}
+	sidecar, err := s.store.GetKey(s.ctx, key+".json")
+	if err != nil {
+		return nil, nil, fmt.Errorf("read sidecar: %w", err)
+	}
+	return manifest, sidecar, nil
+}
+
+func (s zoneSink) describe(key string) string { return s.zone + "/" + key }
+
+func (s zoneSink) put(key string, body []byte) error {
+	sum := sha256.Sum256(body)
+	return s.store.PutReader(s.ctx, key, bytes.NewReader(body), int64(len(body)), hex.EncodeToString(sum[:]))
+}
+
+// newZoneSink builds the upload sink from the environment. NWSync data lives
+// in its own zone, separate from the asset depot, so it has its own zone and
+// credential; only the host is shared, and Crucible has no default host.
+func newZoneSink(ctx context.Context, getenv func(string) string) (sink, error) {
+	cfg := depot.LoadConfig(getenv)
+	cfg.StorageZone = getenv("NWSYNC_STORAGE_ZONE")
+	cfg.WriteKey = getenv("NWSYNC_STORAGE_PASSWORD")
+	cfg.ReadKey = cfg.WriteKey
+	if cfg.StorageZone == "" {
+		return nil, fmt.Errorf("NWSYNC_STORAGE_ZONE is unset (or pass --out DIR to write locally)")
+	}
+	if cfg.WriteKey == "" {
+		return nil, fmt.Errorf("NWSYNC_STORAGE_PASSWORD is unset (or pass --out DIR to write locally)")
+	}
+	if cfg.StorageHost == "" {
+		return nil, fmt.Errorf("BUNNY_STORAGE_HOST is unset")
+	}
+	store, err := depot.NewKeyStore(cfg)
+	if err != nil {
+		return nil, err
+	}
+	return zoneSink{store: store, ctx: ctx, zone: cfg.StorageZone}, nil
+}
+
+// indexKey is where an artifact's NSYM lives: beside the artifact itself, with
+// the final extension replaced. emit and assemble must agree on this one rule,
+// so it lives here and nowhere else.
+//
+// artifacts/haks/sha256/30/46/3046….hak -> artifacts/haks/sha256/30/46/3046….nsym
+func indexKey(artifactKey string) (string, error) {
+	extension := path.Ext(artifactKey)
+	if extension == "" {
+		return "", fmt.Errorf("artifact key %q has no extension", artifactKey)
+	}
+	return strings.TrimSuffix(artifactKey, extension) + ".nsym", nil
+}
+
+// resolveIndexKey is where emit writes an artifact's index and where assemble
+// reads it from. On the zone that is beside the artifact; locally the indexes
+// sit flat beside the data tree, so upstream's output and ours diff directly.
+func resolveIndexKey(artifactKey, outDir string) (string, error) {
+	key, err := indexKey(artifactKey)
+	if err != nil {
+		return "", err
+	}
+	if outDir != "" {
+		return path.Base(key), nil
+	}
+	return key, nil
+}
+
+// checkArtifactKey fails closed when the key's embedded digest is not the
+// digest of the bytes being emitted. Publishing an index under the wrong key
+// silently pairs a manifest with the wrong artifact.
+// artifact is hashed by streaming, so a multi-gigabyte hak is never resident.
+func checkArtifactKey(artifactKey string, artifact io.Reader) error {
+	base := path.Base(artifactKey)
+	digest := strings.TrimSuffix(base, path.Ext(base))
+	if len(digest) != 64 {
+		return fmt.Errorf("artifact key %q does not name a sha256", artifactKey)
+	}
+	hash := sha256.New()
+	if _, err := io.Copy(hash, artifact); err != nil {
+		return fmt.Errorf("hash artifact: %w", err)
+	}
+	if got := hex.EncodeToString(hash.Sum(nil)); got != digest {
+		return fmt.Errorf("artifact key %q names digest %s but the file hashes to %s", artifactKey, digest, got)
+	}
+	return nil
+}

internal/nwsync/verify.go

@@ -0,0 +1,233 @@
+package nwsync
+
+import (
+	"crypto/sha1"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"math/rand/v2"
+	"net/http"
+	"path"
+	"sort"
+	"strconv"
+	"sync"
+	"time"
+
+	"git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/erf"
+)
+
+// defaultPullBase is the public NWSync host, which is a Bunny pull zone fronting
+// the storage zone. Verify reads through it rather than through the storage API
+// on purpose: what matters is the bytes a client is served, edge behaviour
+// included, not what the origin believes it holds.
+const defaultPullBase = "https://nwsync.westgate.pw"
+
+// errBlobMissing marks an object the zone does not serve at all, as distinct
+// from one it serves badly.
+var errBlobMissing = errors.New("missing")
+
+// blobSource reads one object out of the zone by key. Verify never writes and
+// never authenticates, so this is deliberately narrower than sink.
+type blobSource interface {
+	get(key string) ([]byte, error)
+	describe(key string) string
+}
+
+// pullZone reads the zone over plain HTTP, with no credential.
+type pullZone struct {
+	base   string
+	client *http.Client
+}
+
+func newPullZone(base string) blobSource {
+	if base == "" {
+		base = defaultPullBase
+	}
+	return pullZone{
+		base: base,
+		// A full sweep is tens of thousands of small requests, so connections
+		// have to be reused; the default transport does that already.
+		client: &http.Client{Timeout: 60 * time.Second},
+	}
+}
+
+func (z pullZone) describe(key string) string { return z.base + "/" + key }
+
+func (z pullZone) get(key string) ([]byte, error) {
+	resp, err := z.client.Get(z.describe(key))
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode == http.StatusNotFound || resp.StatusCode == http.StatusGone {
+		_, _ = io.Copy(io.Discard, resp.Body)
+		return nil, errBlobMissing
+	}
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		_, _ = io.Copy(io.Discard, resp.Body)
+		return nil, fmt.Errorf("unexpected status %d", resp.StatusCode)
+	}
+	return io.ReadAll(resp.Body)
+}
+
+// VerifyOptions describes one verify run.
+type VerifyOptions struct {
+	ManifestSHA1 string     // the merged manifest to verify
+	Base         string     // pull zone base URL; empty means defaultPullBase
+	Sample       int        // check this many random blobs; 0 means all of them
+	Jobs         int        // blobs in flight at once; 0 means defaultEmitJobs
+	Source       blobSource // test seam; nil means the pull zone at Base
+	Log          io.Writer  // per-blob failures land here; nil discards them
+}
+
+// VerifyResult reports what one verify run found.
+type VerifyResult struct {
+	Entries  int   // resources the manifest names
+	Blobs    int   // distinct blobs behind those resources
+	Checked  int   // blobs actually fetched
+	Failures int   // blobs that failed a check
+	Bytes    int64 // uncompressed bytes verified
+}
+
+// Verify reads a published manifest and its blobs the way a client reads them,
+// and reports every blob that is not what the manifest says it is.
+//
+// Presence is not correctness. emit skips an object that already exists on the
+// strength of a 1-byte range GET, so a truncated or wrongly framed object is
+// skipped by every later emit forever and the backfill cannot repair it. This is
+// the only thing upstream of a player's client that can tell that has happened.
+//
+// Every blob is decompressed and hashed. A Content-Length check would pass the
+// exact failure mode being hunted — a byte-correct-looking object whose contents
+// are wrong — and a round-trip check alone would pass a frame that omits its
+// content size, because Go's decoder is more capable than the client's (#86).
+func Verify(options VerifyOptions) (VerifyResult, error) {
+	// The argument is interpolated straight into a URL path, so it is checked
+	// rather than trusted: exactly 20 bytes of hex, nothing else.
+	if sum, err := hex.DecodeString(options.ManifestSHA1); err != nil || len(sum) != sha1.Size {
+		return VerifyResult{}, fmt.Errorf("%q is not a manifest sha1", options.ManifestSHA1)
+	}
+	source := options.Source
+	if source == nil {
+		source = newPullZone(options.Base)
+	}
+	log := options.Log
+	if log == nil {
+		log = io.Discard
+	}
+
+	manifestKey := path.Join("manifests", options.ManifestSHA1)
+	data, err := source.get(manifestKey)
+	if err != nil {
+		return VerifyResult{}, fmt.Errorf("%s: %w", source.describe(manifestKey), err)
+	}
+	// A manifest is named after its own sha1, so this catches the zone serving
+	// a different manifest — or a truncated one — before any blob is fetched.
+	if got := hex.EncodeToString(sha1Sum(data)); got != options.ManifestSHA1 {
+		return VerifyResult{}, fmt.Errorf("%s hashes to %s, not the manifest asked for",
+			source.describe(manifestKey), got)
+	}
+	entries, err := readManifest(data)
+	if err != nil {
+		return VerifyResult{}, fmt.Errorf("%s: %w", source.describe(manifestKey), err)
+	}
+
+	// A manifest names one blob many times over: mappings share a sha1, and so
+	// do resrefs with identical contents. Fetch each blob once.
+	blobs := make([]Entry, 0, len(entries))
+	seen := make(map[[20]byte]bool, len(entries))
+	for _, entry := range entries {
+		if seen[entry.SHA1] {
+			continue
+		}
+		seen[entry.SHA1] = true
+		blobs = append(blobs, entry)
+	}
+
+	result := VerifyResult{Entries: len(entries), Blobs: len(blobs)}
+	checking := blobs
+	if options.Sample > 0 && options.Sample < len(blobs) {
+		// A full sweep of the live manifest is ~69,000 objects and ~15 GB, so
+		// sampling is what makes verifying a routine act rather than an event.
+		picks := rand.Perm(len(blobs))[:options.Sample]
+		checking = make([]Entry, 0, options.Sample)
+		for _, i := range picks {
+			checking = append(checking, blobs[i])
+		}
+	}
+	result.Checked = len(checking)
+
+	jobs := options.Jobs
+	if jobs < 1 {
+		jobs = defaultEmitJobs
+	}
+	var (
+		mu       sync.Mutex
+		failures []string
+	)
+	work := make(chan Entry)
+	var wg sync.WaitGroup
+	for range jobs {
+		wg.Go(func() {
+			for entry := range work {
+				fault := checkEntry(source, entry)
+				mu.Lock()
+				if fault != "" {
+					failures = append(failures, fault)
+				} else {
+					result.Bytes += int64(entry.Size)
+				}
+				mu.Unlock()
+			}
+		})
+	}
+	for _, entry := range checking {
+		work <- entry
+	}
+	close(work)
+	wg.Wait()
+
+	// Workers finish in any order; a report an operator can diff must not.
+	sort.Strings(failures)
+	for _, fault := range failures {
+		fmt.Fprintln(log, fault)
+	}
+	result.Failures = len(failures)
+	return result, nil
+}
+
+// checkEntry fetches one blob and returns a one-line fault, or "" if it is
+// exactly what the manifest entry says it is.
+func checkEntry(source blobSource, entry Entry) string {
+	// Name the resource, not just the hash: an operator has to find the thing
+	// in a hak, and a bare sha1 says nothing about where to look.
+	extension, ok := erf.ExtensionForResourceType(entry.ResType)
+	if !ok {
+		extension = strconv.Itoa(int(entry.ResType))
+	}
+	where := fmt.Sprintf("%s (%s.%s)", entry.sha1Hex(), entry.ResRef, extension)
+	blob, err := source.get(blobKey(entry.sha1Hex()))
+	if err != nil {
+		if errors.Is(err, errBlobMissing) {
+			return where + ": missing"
+		}
+		return where + ": unreadable: " + err.Error()
+	}
+	data, err := inspectBlob(blob)
+	if err != nil {
+		return where + ": " + err.Error()
+	}
+	if uint32(len(data)) != entry.Size {
+		return fmt.Sprintf("%s: size mismatch: %d bytes, manifest says %d", where, len(data), entry.Size)
+	}
+	if sha1.Sum(data) != entry.SHA1 {
+		return fmt.Sprintf("%s: hash mismatch: contents hash to %x", where, sha1.Sum(data))
+	}
+	return ""
+}
+
+func sha1Sum(data []byte) []byte {
+	sum := sha1.Sum(data)
+	return sum[:]
+}

internal/nwsync/verify_test.go

@@ -0,0 +1,285 @@
+package nwsync
+
+import (
+	"bytes"
+	"crypto/sha1"
+	"encoding/hex"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/klauspost/compress/zstd"
+)
+
+// verifyFixture emits two haks and a TLK into a fake zone, assembles them, and
+// hands back a verifier reading that zone the way a client would.
+type verifyFixture struct {
+	*zoneSinkFixture
+	manifestSHA1 string
+}
+
+func newVerifyFixture(t *testing.T) *verifyFixture {
+	t.Helper()
+	zone := newZoneFixture(t)
+	dir := t.TempDir()
+	hak := filepath.Join(dir, "sow_test_01.hak")
+	// A payload under 256 bytes is the one the frame-header check exists for.
+	writeHak(t, hak, map[string][]byte{
+		"bloodstain1.tga": []byte("small"),
+		"appearance.2da":  bytes.Repeat([]byte("2DA V2.0\n"), 200),
+	})
+	tlk := filepath.Join(dir, "sow_tlk.tlk")
+	if err := os.WriteFile(tlk, []byte("TLK V3.0 payload"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	zone.emit(t, hak)
+	if _, err := Emit(EmitOptions{
+		ArtifactKey: artifactKey(t, tlk), ArtifactPath: tlk, As: "sow_tlk.tlk", Sink: zone.sink,
+	}); err != nil {
+		t.Fatalf("emit tlk: %v", err)
+	}
+	assembled, err := Assemble(AssembleOptions{
+		ArtifactKeys: []string{artifactKey(t, hak)}, TLKKey: artifactKey(t, tlk), Sink: zone.sink,
+	})
+	if err != nil {
+		t.Fatalf("assemble: %v", err)
+	}
+	return &verifyFixture{zoneSinkFixture: zone, manifestSHA1: assembled.SHA1}
+}
+
+func (f *verifyFixture) verify(t *testing.T, sample int) (VerifyResult, string, error) {
+	t.Helper()
+	var log bytes.Buffer
+	result, err := Verify(VerifyOptions{
+		ManifestSHA1: f.manifestSHA1,
+		Sample:       sample,
+		Source:       f.zone.pullZone(),
+		Log:          &log,
+	})
+	return result, log.String(), err
+}
+
+// keyOf is where a resource's blob lives, addressed by the sha1 of its
+// uncompressed bytes — the same path the client requests.
+func keyOf(body []byte) string {
+	sum := sha1.Sum(body)
+	return blobKey(hex.EncodeToString(sum[:]))
+}
+
+func TestVerifyPassesACleanZone(t *testing.T) {
+	fixture := newVerifyFixture(t)
+	result, log, err := fixture.verify(t, 0)
+	if err != nil {
+		t.Fatalf("verify: %v", err)
+	}
+	if result.Failures != 0 {
+		t.Errorf("verify reported %d failures on a clean zone: %s", result.Failures, log)
+	}
+	// A default run is a full sweep, so it must reach every blob the manifest
+	// names — not some of them.
+	if result.Checked != result.Blobs || result.Blobs == 0 {
+		t.Errorf("checked %d of %d blobs; a full sweep must check all of them", result.Checked, result.Blobs)
+	}
+}
+
+func TestVerifyReportsAMissingBlob(t *testing.T) {
+	fixture := newVerifyFixture(t)
+	key := keyOf([]byte("small"))
+	fixture.zone.mu.Lock()
+	delete(fixture.zone.objects, key)
+	fixture.zone.mu.Unlock()
+
+	result, log, err := fixture.verify(t, 0)
+	if err != nil {
+		t.Fatalf("verify: %v", err)
+	}
+	if result.Failures != 1 {
+		t.Fatalf("reported %d failures, want 1: %s", result.Failures, log)
+	}
+	if !strings.Contains(log, "missing") {
+		t.Errorf("a deleted blob was not reported as missing: %s", log)
+	}
+}
+
+func TestVerifyReportsATruncatedBlob(t *testing.T) {
+	fixture := newVerifyFixture(t)
+	key := keyOf([]byte("small"))
+	fixture.zone.mu.Lock()
+	fixture.zone.objects[key] = fixture.zone.objects[key][:blobHeaderBytes+4]
+	fixture.zone.mu.Unlock()
+
+	result, log, err := fixture.verify(t, 0)
+	if err != nil {
+		t.Fatalf("verify: %v", err)
+	}
+	if result.Failures != 1 {
+		t.Fatalf("reported %d failures, want 1: %s", result.Failures, log)
+	}
+	if !strings.Contains(log, "framing") {
+		t.Errorf("a truncated blob was not reported as malformed framing: %s", log)
+	}
+}
+
+// TestVerifyRejectsABlobWithNoDeclaredFrameContentSize is the check that #86
+// slipped past: the blob decompresses to exactly the right bytes, so a verifier
+// that only round-trips certifies it, yet the client cannot decode it.
+func TestVerifyRejectsABlobWithNoDeclaredFrameContentSize(t *testing.T) {
+	fixture := newVerifyFixture(t)
+	body := []byte("small")
+	key := keyOf(body)
+
+	fixture.zone.mu.Lock()
+	good := fixture.zone.objects[key]
+	encoder, err := zstd.NewWriter(nil, zstd.WithEncoderConcurrency(1))
+	if err != nil {
+		t.Fatal(err)
+	}
+	bad := append(append([]byte{}, good[:blobHeaderBytes]...), encoder.EncodeAll(body, nil)...)
+	fixture.zone.objects[key] = bad
+	fixture.zone.mu.Unlock()
+
+	if frameDeclaresContentSize(bad[blobHeaderBytes:]) {
+		t.Fatal("the fixture blob declares a content size; it cannot exercise the check")
+	}
+	if got, err := decompressBlob(bad); err != nil || !bytes.Equal(got, body) {
+		t.Fatalf("the fixture blob must round trip, or it proves nothing: %v", err)
+	}
+
+	result, log, err := fixture.verify(t, 0)
+	if err != nil {
+		t.Fatalf("verify: %v", err)
+	}
+	if result.Failures != 1 {
+		t.Fatalf("reported %d failures, want 1: %s", result.Failures, log)
+	}
+	if !strings.Contains(log, "content size") {
+		t.Errorf("undeclared frame content size was not the reported reason: %s", log)
+	}
+}
+
+func TestVerifyReportsWrongContents(t *testing.T) {
+	fixture := newVerifyFixture(t)
+	key := keyOf([]byte("small"))
+	fixture.zone.mu.Lock()
+	// Valid framing, valid zstd, wrong bytes: only decompressing and hashing
+	// can see this, which is why Content-Length is not enough.
+	fixture.zone.objects[key] = compressBlob([]byte("wrong"))
+	fixture.zone.mu.Unlock()
+
+	result, log, err := fixture.verify(t, 0)
+	if err != nil {
+		t.Fatalf("verify: %v", err)
+	}
+	if result.Failures != 1 {
+		t.Fatalf("reported %d failures, want 1: %s", result.Failures, log)
+	}
+	if !strings.Contains(log, "hash mismatch") {
+		t.Errorf("wrong contents were not reported as a hash mismatch: %s", log)
+	}
+}
+
+func TestVerifyReportsAShortBlob(t *testing.T) {
+	fixture := newVerifyFixture(t)
+	key := keyOf([]byte("small"))
+	fixture.zone.mu.Lock()
+	// Well-formed all the way down and simply too short — the shape a killed
+	// upload leaves behind, and the one a Content-Length check would pass.
+	fixture.zone.objects[key] = compressBlob([]byte("sma"))
+	fixture.zone.mu.Unlock()
+
+	result, log, err := fixture.verify(t, 0)
+	if err != nil {
+		t.Fatalf("verify: %v", err)
+	}
+	if result.Failures != 1 {
+		t.Fatalf("reported %d failures, want 1: %s", result.Failures, log)
+	}
+	if !strings.Contains(log, "size mismatch") {
+		t.Errorf("a short blob was not reported as a size mismatch: %s", log)
+	}
+}
+
+func TestVerifyFailsWhenTheManifestIsNotTheOneAsked(t *testing.T) {
+	fixture := newVerifyFixture(t)
+	fixture.zone.mu.Lock()
+	fixture.zone.objects["manifests/"+fixture.manifestSHA1] = []byte("NSYM garbage")
+	fixture.zone.mu.Unlock()
+
+	if _, _, err := fixture.verify(t, 0); err == nil {
+		t.Fatal("verify accepted a manifest that is not the one requested")
+	}
+}
+
+func TestVerifySampleChecksFewerBlobs(t *testing.T) {
+	fixture := newVerifyFixture(t)
+	result, log, err := fixture.verify(t, 1)
+	if err != nil {
+		t.Fatalf("verify: %v", err)
+	}
+	if result.Checked != 1 {
+		t.Errorf("--sample 1 checked %d blobs, want 1: %s", result.Checked, log)
+	}
+	if result.Blobs <= result.Checked {
+		t.Errorf("sampling %d of %d blobs is not a sample", result.Checked, result.Blobs)
+	}
+}
+
+// TestEmitVerifyReplacesABlobThatIsNotItsName covers the reason #86 could not be
+// fixed by the encoder alone: emit skips whatever is already present, so every
+// blob published by the broken encoder stays broken until emit stops trusting
+// presence.
+func TestEmitVerifyReplacesABlobThatIsNotItsName(t *testing.T) {
+	fixture := newZoneFixture(t)
+	dir := t.TempDir()
+	hak := filepath.Join(dir, "sow_test_01.hak")
+	body := []byte("blood")
+	writeHak(t, hak, map[string][]byte{"bloodstain1.tga": body})
+
+	emit := func(verify bool) EmitResult {
+		t.Helper()
+		result, err := Emit(EmitOptions{
+			ArtifactKey:  artifactKey(t, hak),
+			ArtifactPath: hak,
+			Sink:         fixture.sink,
+			Verify:       verify,
+		})
+		if err != nil {
+			t.Fatalf("emit (verify=%v): %v", verify, err)
+		}
+		return result
+	}
+
+	emit(false)
+	key := keyOf(body)
+	encoder, err := zstd.NewWriter(nil, zstd.WithEncoderConcurrency(1))
+	if err != nil {
+		t.Fatal(err)
+	}
+	fixture.zone.mu.Lock()
+	good := fixture.zone.objects[key]
+	fixture.zone.objects[key] = append(append([]byte{}, good[:blobHeaderBytes]...), encoder.EncodeAll(body, nil)...)
+	fixture.zone.mu.Unlock()
+
+	if plain := emit(false); plain.BlobsWritten != 0 {
+		t.Fatalf("a plain re-emit wrote %d blobs; it is supposed to trust presence", plain.BlobsWritten)
+	}
+	if verified := emit(true); verified.BlobsWritten != 1 {
+		t.Fatalf("--verify wrote %d blobs, want 1 (the bad copy must be replaced)", verified.BlobsWritten)
+	}
+
+	fixture.zone.mu.Lock()
+	repaired := fixture.zone.objects[key]
+	fixture.zone.mu.Unlock()
+	if !bytes.Equal(repaired, good) {
+		t.Error("the replaced blob is not what the current encoder produces")
+	}
+	if _, err := inspectBlob(repaired); err != nil {
+		t.Errorf("the replaced blob still fails inspection: %v", err)
+	}
+
+	// A second verifying run has nothing left to repair.
+	if again := emit(true); again.BlobsWritten != 0 {
+		t.Errorf("--verify rewrote %d good blobs", again.BlobsWritten)
+	}
+}

internal/nwsync/zone_test.go

@@ -0,0 +1,257 @@
+package nwsync
+
+import (
+	"crypto/sha1"
+	"crypto/sha256"
+	"encoding/hex"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+)
+
+// fakeZone is a Bunny-shaped object store: PUT stores, GET reads, and the
+// Checksum header is verified the way Bunny verifies it.
+type fakeZone struct {
+	mu      sync.Mutex
+	objects map[string][]byte
+	puts    []string
+	failOn  func(key string) bool // when true, the PUT fails
+	url     string                // base the same objects are readable at
+}
+
+// pullZone reads the fake zone the way the public pull zone is read: plain
+// unauthenticated GETs, no storage API.
+func (z *fakeZone) pullZone() blobSource {
+	return newPullZone(z.url)
+}
+
+func newFakeZone(t *testing.T) (*fakeZone, func(string) string) {
+	t.Helper()
+	zone := &fakeZone{objects: map[string][]byte{}}
+	server := httptest.NewServer(zone)
+	t.Cleanup(server.Close)
+	zone.url = server.URL + "/sow-nwsync"
+	getenv := func(name string) string {
+		switch name {
+		case "NWSYNC_STORAGE_ZONE":
+			return "sow-nwsync"
+		case "NWSYNC_STORAGE_PASSWORD":
+			return "write-key"
+		case "BUNNY_STORAGE_HOST":
+			return server.URL
+		}
+		return ""
+	}
+	return zone, getenv
+}
+
+func (z *fakeZone) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	key := strings.TrimPrefix(r.URL.Path, "/sow-nwsync/")
+	switch r.Method {
+	case http.MethodPut:
+		if z.failOn != nil && z.failOn(key) {
+			http.Error(w, "boom", http.StatusInternalServerError)
+			return
+		}
+		body, err := io.ReadAll(r.Body)
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusBadRequest)
+			return
+		}
+		sum := sha256.Sum256(body)
+		if want := strings.ToUpper(hex.EncodeToString(sum[:])); r.Header.Get("Checksum") != want {
+			http.Error(w, "checksum mismatch", http.StatusBadRequest)
+			return
+		}
+		z.mu.Lock()
+		z.objects[key] = body
+		z.puts = append(z.puts, key)
+		z.mu.Unlock()
+		w.WriteHeader(http.StatusCreated)
+	case http.MethodGet:
+		z.mu.Lock()
+		body, ok := z.objects[key]
+		z.mu.Unlock()
+		if !ok {
+			http.Error(w, "not found", http.StatusNotFound)
+			return
+		}
+		_, _ = w.Write(body)
+	default:
+		http.Error(w, "unsupported", http.StatusMethodNotAllowed)
+	}
+}
+
+func (z *zoneSinkFixture) emit(t *testing.T, path string) EmitResult {
+	t.Helper()
+	result, err := Emit(EmitOptions{
+		ArtifactKey:  artifactKey(t, path),
+		ArtifactPath: path,
+		Sink:         z.sink,
+	})
+	if err != nil {
+		t.Fatalf("emit %s: %v", path, err)
+	}
+	return result
+}
+
+type zoneSinkFixture struct {
+	zone *fakeZone
+	sink sink
+}
+
+func newZoneFixture(t *testing.T) *zoneSinkFixture {
+	t.Helper()
+	zone, getenv := newFakeZone(t)
+	target, err := newZoneSink(t.Context(), getenv)
+	if err != nil {
+		t.Fatalf("zone sink: %v", err)
+	}
+	return &zoneSinkFixture{zone: zone, sink: target}
+}
+
+func sha1Of(body []byte) [20]byte { return sha1.Sum(body) }
+
+func TestEmitUploadsBlobsThenIndex(t *testing.T) {
+	fixture := newZoneFixture(t)
+	dir := t.TempDir()
+	hak := filepath.Join(dir, "sow_test_01.hak")
+	body := []byte("texture bytes")
+	writeHak(t, hak, map[string][]byte{"bloodstain1.tga": body, "copy1.txi": body})
+
+	key := artifactKey(t, hak)
+	result := fixture.emit(t, hak)
+
+	index, err := indexKey(key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := fixture.zone.objects[index]; !ok {
+		t.Fatalf("no index at %s; zone holds %v", index, fixture.zone.puts)
+	}
+	if result.BlobsWritten != 1 {
+		t.Errorf("uploaded %d blobs, want 1 (identical content shares a blob)", result.BlobsWritten)
+	}
+
+	// The index is the publication marker, so it must land after every blob it
+	// names — including its own sidecar.
+	last := fixture.zone.puts[len(fixture.zone.puts)-1]
+	if last != index {
+		t.Errorf("index landed at position %d of %d; it must be last", len(fixture.zone.puts), len(fixture.zone.puts))
+	}
+	for _, key := range fixture.zone.puts[:len(fixture.zone.puts)-1] {
+		if strings.HasPrefix(key, "data/sha1/") || key == index+".json" {
+			continue
+		}
+		t.Errorf("unexpected object uploaded before the index: %s", key)
+	}
+}
+
+func TestEmitSkipsBlobsAlreadyInTheZone(t *testing.T) {
+	fixture := newZoneFixture(t)
+	dir := t.TempDir()
+	hak := filepath.Join(dir, "sow_test_01.hak")
+	writeHak(t, hak, map[string][]byte{"bloodstain1.tga": []byte("blood")})
+
+	first := fixture.emit(t, hak)
+	if first.BlobsWritten != 1 {
+		t.Fatalf("first emit uploaded %d blobs, want 1", first.BlobsWritten)
+	}
+	second := fixture.emit(t, hak)
+	if second.BlobsWritten != 0 {
+		t.Errorf("re-emit uploaded %d blobs, want 0 (a blob name is its content)", second.BlobsWritten)
+	}
+}
+
+func TestEmitLeavesNoIndexWhenAnUploadFails(t *testing.T) {
+	fixture := newZoneFixture(t)
+	fixture.zone.failOn = func(key string) bool { return strings.HasPrefix(key, "data/sha1/") }
+	dir := t.TempDir()
+	hak := filepath.Join(dir, "sow_test_01.hak")
+	writeHak(t, hak, map[string][]byte{"bloodstain1.tga": []byte("blood")})
+
+	_, err := Emit(EmitOptions{
+		ArtifactKey:  artifactKey(t, hak),
+		ArtifactPath: hak,
+		Sink:         fixture.sink,
+	})
+	if err == nil {
+		t.Fatal("emit reported success after an upload failed")
+	}
+	for key := range fixture.zone.objects {
+		if strings.HasSuffix(key, ".nsym") {
+			t.Errorf("a half-emitted artifact published an index: %s", key)
+		}
+	}
+}
+
+func TestEmitRejectsAKeyThatDoesNotMatchTheFile(t *testing.T) {
+	fixture := newZoneFixture(t)
+	dir := t.TempDir()
+	hak := filepath.Join(dir, "sow_test_01.hak")
+	writeHak(t, hak, map[string][]byte{"bloodstain1.tga": []byte("blood")})
+
+	wrong := "artifacts/haks/sha256/00/11/" + strings.Repeat("0", 64) + ".hak"
+	_, err := Emit(EmitOptions{ArtifactKey: wrong, ArtifactPath: hak, Sink: fixture.sink})
+	if err == nil || !strings.Contains(err.Error(), "hashes to") {
+		t.Fatalf("emit published under a key that names another artifact: %v", err)
+	}
+}
+
+func TestAssembleReadsIndexesFromTheZone(t *testing.T) {
+	fixture := newZoneFixture(t)
+	dir := t.TempDir()
+	topBody := []byte("2da from sow_top")
+	assetBody := []byte("2da from the asset hak")
+	top := filepath.Join(dir, "sow_top.hak")
+	core := filepath.Join(dir, "sow_core_01.hak")
+	writeHak(t, top, map[string][]byte{"appearance.2da": topBody})
+	writeHak(t, core, map[string][]byte{"appearance.2da": assetBody, "bloodstain1.tga": []byte("blood")})
+	tlkPath := filepath.Join(dir, "sow_tlk.tlk")
+	if err := os.WriteFile(tlkPath, []byte("TLK V3.0 payload"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	fixture.emit(t, top)
+	fixture.emit(t, core)
+	if _, err := Emit(EmitOptions{
+		ArtifactKey:  artifactKey(t, tlkPath),
+		ArtifactPath: tlkPath,
+		As:           "sow_tlk.tlk",
+		Sink:         fixture.sink,
+	}); err != nil {
+		t.Fatalf("emit tlk: %v", err)
+	}
+
+	result, err := Assemble(AssembleOptions{
+		ArtifactKeys: []string{artifactKey(t, top), artifactKey(t, core)},
+		TLKKey:       artifactKey(t, tlkPath),
+		GroupID:      2,
+		Sink:         fixture.sink,
+	})
+	if err != nil {
+		t.Fatalf("assemble: %v", err)
+	}
+	if result.Entries != 3 {
+		t.Fatalf("merged %d entries, want 3 (appearance.2da is shadowed, the TLK adds one)", result.Entries)
+	}
+
+	manifest, ok := fixture.zone.objects["manifests/"+result.SHA1]
+	if !ok {
+		t.Fatalf("no merged manifest in the zone; it holds %v", fixture.zone.puts)
+	}
+	entries, err := readManifest(manifest)
+	if err != nil {
+		t.Fatalf("parse merged manifest: %v", err)
+	}
+	for _, entry := range entries {
+		if entry.ResRef == "appearance" && entry.SHA1 != sha1Of(topBody) {
+			t.Errorf("appearance.2da resolved to the shadowed hak, not the first one given")
+		}
+	}
+}

internal/pipeline/build.go

@@ -593,9 +593,14 @@ func envBool(name string) bool {
 func collectModuleResources(p *project.Project, moduleHakOrder []string) ([]erf.Resource, error) {
 	var moduleResources []erf.Resource
 
+	palettes, err := collectPaletteDescriptors(p)
+	if err != nil {
+		return nil, err
+	}
+
 	for _, rel := range p.Inventory.SourceFiles {
 		abs := filepath.Join(p.SourceDir(), filepath.FromSlash(rel))
-		resource, err := resourceFromJSON(abs, moduleHakOrder)
+		resource, err := resourceFromJSON(abs, moduleHakOrder, palettes)
 		if err != nil {
 			return nil, err
 		}
@@ -1030,7 +1035,7 @@ func compareResourceKeys(a, b erf.Resource) int {
 	return 0
 }
 
-func resourceFromJSON(path string, moduleHakOrder []string) (erf.Resource, error) {
+func resourceFromJSON(path string, moduleHakOrder []string, palettes paletteProjection) (erf.Resource, error) {
 	name, extension, err := splitSourceName(path)
 	if err != nil {
 		return erf.Resource{}, err
@@ -1059,6 +1064,9 @@ func resourceFromJSON(path string, moduleHakOrder []string) (erf.Resource, error
 	if extension == ".ifo" && name == "module" && len(moduleHakOrder) > 0 {
 		setModuleHAKList(&document, moduleHakOrder)
 	}
+	if extension == ".itp" && isPaletteProjectionResref(name) {
+		projectPaletteDocument(&document, palettes[strings.ToLower(name)])
+	}
 
 	var buf bytes.Buffer
 	if err := gff.Write(&buf, document); err != nil {

internal/pipeline/compare.go

@@ -117,6 +117,10 @@ func expectedResources(p *project.Project) (map[string]resourceExpectation, erro
 	if err != nil {
 		return nil, err
 	}
+	palettes, err := collectPaletteDescriptors(p)
+	if err != nil {
+		return nil, err
+	}
 
 	for _, rel := range p.Inventory.SourceFiles {
 		abs := filepath.Join(p.SourceDir(), filepath.FromSlash(rel))
@@ -136,6 +140,9 @@ func expectedResources(p *project.Project) (map[string]resourceExpectation, erro
 		if extension == ".ifo" && strings.EqualFold(name, "module") && len(moduleHakOrder) > 0 {
 			setModuleHAKList(&document, moduleHakOrder)
 		}
+		if extension == ".itp" && isPaletteProjectionResref(name) {
+			projectPaletteDocument(&document, palettes[strings.ToLower(name)])
+		}
 
 		canonical, err := json.Marshal(document)
 		if err != nil {

internal/pipeline/extract.go

@@ -124,6 +124,13 @@ func extractArchiveResources(p *project.Project, archive erf.Archive, desired ma
 			skippedCount++
 			continue
 		}
+		// *palcus.itp are Toolset-generated palette projections; the module
+		// build regenerates them from source blueprints, so extraction never
+		// writes them back into source.
+		if ext == "itp" && isPaletteProjectionResref(resource.Name) {
+			skippedCount++
+			continue
+		}
 
 		target, data, err := extractedFile(p, resource, ext)
 		if err != nil {
@@ -350,26 +357,48 @@ func mergeExtractedGFFJSON(p *project.Project, target string, extracted *gff.Doc
 	}
 
 	raw, err := os.ReadFile(target)
-	if err != nil {
-		if errors.Is(err, os.ErrNotExist) {
-			return nil
-		}
+	if err != nil && !errors.Is(err, os.ErrNotExist) {
 		return fmt.Errorf("read existing source %s: %w", target, err)
 	}
-	var existing gff.Document
-	if err := json.Unmarshal(raw, &existing); err != nil {
-		return fmt.Errorf("parse existing source %s: %w", target, err)
+	if err == nil {
+		var existing gff.Document
+		if err := json.Unmarshal(raw, &existing); err != nil {
+			return fmt.Errorf("parse existing source %s: %w", target, err)
+		}
+
+		for _, label := range rule.PreserveFields {
+			if field, ok := gffField(existing.Root, label); ok {
+				setGFFField(&extracted.Root, field)
+			}
+		}
+		for _, listRule := range rule.MergeLists {
+			if err := mergeGFFListByKey(&extracted.Root, existing.Root, listRule); err != nil {
+				return err
+			}
+		}
 	}
 
-	for _, label := range rule.PreserveFields {
-		if field, ok := gffField(existing.Root, label); ok {
-			setGFFField(&extracted.Root, field)
+	// set_fields runs last so a forced value also wins over preserve_fields.
+	for _, setRule := range rule.SetFields {
+		if err := setGFFIntField(&extracted.Root, setRule); err != nil {
+			return fmt.Errorf("set_fields on %s: %w", target, err)
 		}
 	}
-	for _, listRule := range rule.MergeLists {
-		if err := mergeGFFListByKey(&extracted.Root, existing.Root, listRule); err != nil {
-			return err
+	return nil
+}
+
+// setGFFIntField forces an existing Int field to a fixed value; a field the
+// document does not have is left absent rather than invented.
+func setGFFIntField(s *gff.Struct, rule project.ExtractSetFieldRule) error {
+	for index, field := range s.Fields {
+		if field.Label != rule.Field {
+			continue
 		}
+		if _, ok := field.Value.(gff.IntValue); !ok {
+			return fmt.Errorf("field %q is %s, not Int", rule.Field, field.Type)
+		}
+		s.Fields[index].Value = gff.IntValue(rule.Value)
+		return nil
 	}
 	return nil
 }
@@ -384,7 +413,7 @@ func extractGFFJSONMergeRule(p *project.Project, target string) (project.Extract
 		return project.ExtractGFFJSONMergeRule{}, false, nil
 	}
 	for _, rule := range p.EffectiveConfig().Extract.Merge.GFFJSON {
-		if rule.Target == rel {
+		if rule.Target == rel || matchPathPattern(rel, rule.Target) {
 			return rule, true, nil
 		}
 	}

internal/pipeline/palette.go

@@ -0,0 +1,298 @@
+package pipeline
+
+// Custom palette projections (*palcus.itp) are generated artifacts: the Toolset
+// derives them from the category frameworks plus the blueprints present in the
+// module. Crucible reproduces that projection deterministically at build time so
+// the module source only carries descriptor-free category skeletons and the
+// blueprint files themselves. Extract never writes palcus files back.
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+
+	"git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/gff"
+	"git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/project"
+)
+
+const noStrref = 0xFFFFFFFF
+
+// hiddenPaletteID suppresses a blueprint from the Custom palette (engine
+// convention; see docs in sow-module's palette research notes).
+const hiddenPaletteID = 255
+
+var paletteFamilyByExtension = map[string]string{
+	".utc": "creaturepalcus",
+	".utd": "doorpalcus",
+	".ute": "encounterpalcus",
+	".uti": "itempalcus",
+	".utm": "storepalcus",
+	".utp": "placeablepalcus",
+	".uts": "soundpalcus",
+	".utt": "triggerpalcus",
+	".utw": "waypointpalcus",
+}
+
+type paletteDescriptor struct {
+	name     string
+	strref   uint32
+	resref   string
+	creature bool
+	cr       float32
+	faction  string
+}
+
+func (d paletteDescriptor) sortKey() string {
+	if d.strref != noStrref || d.name == "" {
+		return strings.ToLower(d.resref)
+	}
+	return strings.ToLower(d.name)
+}
+
+// palette resref (e.g. "itempalcus") -> terminal category ID -> descriptors.
+type paletteProjection map[string]map[uint8][]paletteDescriptor
+
+func isPaletteProjectionResref(name string) bool {
+	return strings.HasSuffix(strings.ToLower(name), "palcus")
+}
+
+func collectPaletteDescriptors(p *project.Project) (paletteProjection, error) {
+	projection := paletteProjection{}
+	factions, err := loadFactionNames(p)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, rel := range p.Inventory.SourceFiles {
+		abs := filepath.Join(p.SourceDir(), filepath.FromSlash(rel))
+		name, extension, err := splitSourceName(abs)
+		if err != nil {
+			return nil, err
+		}
+		family, ok := paletteFamilyByExtension[extension]
+		if !ok {
+			continue
+		}
+
+		raw, err := os.ReadFile(abs)
+		if err != nil {
+			return nil, fmt.Errorf("read %s: %w", abs, err)
+		}
+		var document gff.Document
+		if err := json.Unmarshal(raw, &document); err != nil {
+			return nil, fmt.Errorf("parse gff json %s: %w", abs, err)
+		}
+
+		descriptor, paletteID, ok := blueprintDescriptor(document.Root, name, extension, factions)
+		if !ok {
+			continue
+		}
+		if projection[family] == nil {
+			projection[family] = map[uint8][]paletteDescriptor{}
+		}
+		projection[family][paletteID] = append(projection[family][paletteID], descriptor)
+	}
+
+	for _, byID := range projection {
+		for _, descriptors := range byID {
+			sort.SliceStable(descriptors, func(i, j int) bool {
+				a, b := descriptors[i], descriptors[j]
+				if a.sortKey() != b.sortKey() {
+					return a.sortKey() < b.sortKey()
+				}
+				return a.resref < b.resref
+			})
+		}
+	}
+	return projection, nil
+}
+
+func blueprintDescriptor(root gff.Struct, fileName, extension string, factions []string) (paletteDescriptor, uint8, bool) {
+	descriptor := paletteDescriptor{
+		strref:   noStrref,
+		resref:   strings.ToLower(fileName),
+		creature: extension == ".utc",
+	}
+	paletteID := -1
+
+	for _, field := range root.Fields {
+		switch field.Label {
+		case "PaletteID":
+			if v, ok := field.Value.(gff.ByteValue); ok {
+				paletteID = int(v)
+			}
+		case "TemplateResRef":
+			if v, ok := field.Value.(gff.ResRefValue); ok && v != "" {
+				descriptor.resref = strings.ToLower(string(v))
+			}
+		case "LocalizedName", "LocName", "FirstName":
+			if v, ok := field.Value.(gff.LocString); ok {
+				name, strref := locStringLabel(v)
+				if field.Label == "FirstName" {
+					descriptor.name = strings.TrimSpace(descriptor.name + " " + name)
+					if descriptor.strref == noStrref {
+						descriptor.strref = strref
+					}
+				} else {
+					descriptor.name = name
+					descriptor.strref = strref
+				}
+			}
+		case "LastName":
+			if v, ok := field.Value.(gff.LocString); ok {
+				name, _ := locStringLabel(v)
+				descriptor.name = strings.TrimSpace(descriptor.name + " " + name)
+			}
+		case "ChallengeRating":
+			if v, ok := field.Value.(gff.FloatValue); ok {
+				descriptor.cr = float32(v)
+			}
+		case "FactionID":
+			if v, ok := field.Value.(gff.WordValue); ok && int(v) < len(factions) {
+				descriptor.faction = factions[v]
+			}
+		}
+	}
+
+	if paletteID < 0 || paletteID == hiddenPaletteID {
+		return paletteDescriptor{}, 0, false
+	}
+	return descriptor, uint8(paletteID), true
+}
+
+func locStringLabel(value gff.LocString) (string, uint32) {
+	if value.StringRef != noStrref {
+		return "", value.StringRef
+	}
+	for _, entry := range value.Entries {
+		if entry.Value != "" {
+			return entry.Value, noStrref
+		}
+	}
+	return "", noStrref
+}
+
+func loadFactionNames(p *project.Project) ([]string, error) {
+	for _, rel := range p.Inventory.SourceFiles {
+		if !strings.HasSuffix(strings.ToLower(rel), "repute.fac.json") {
+			continue
+		}
+		abs := filepath.Join(p.SourceDir(), filepath.FromSlash(rel))
+		raw, err := os.ReadFile(abs)
+		if err != nil {
+			return nil, fmt.Errorf("read %s: %w", abs, err)
+		}
+		var document gff.Document
+		if err := json.Unmarshal(raw, &document); err != nil {
+			return nil, fmt.Errorf("parse gff json %s: %w", abs, err)
+		}
+		var names []string
+		for _, field := range document.Root.Fields {
+			if field.Label != "FactionList" {
+				continue
+			}
+			list, ok := field.Value.(gff.ListValue)
+			if !ok {
+				continue
+			}
+			for _, faction := range list {
+				name := ""
+				for _, f := range faction.Fields {
+					if f.Label == "FactionName" {
+						if v, ok := f.Value.(gff.StringValue); ok {
+							name = string(v)
+						}
+					}
+				}
+				names = append(names, name)
+			}
+		}
+		return names, nil
+	}
+	return nil, nil
+}
+
+// projectPaletteDocument strips every blueprint descriptor from the palette
+// tree and re-inserts the descriptors derived from module source. Category
+// structure (branches, terminal IDs, labels) passes through untouched.
+func projectPaletteDocument(document *gff.Document, byID map[uint8][]paletteDescriptor) {
+	for i, field := range document.Root.Fields {
+		if field.Label != "MAIN" {
+			continue
+		}
+		if list, ok := field.Value.(gff.ListValue); ok {
+			document.Root.Fields[i] = gff.NewField("MAIN", projectPaletteNodes(list, byID))
+		}
+	}
+}
+
+func projectPaletteNodes(nodes gff.ListValue, byID map[uint8][]paletteDescriptor) gff.ListValue {
+	out := make(gff.ListValue, 0, len(nodes))
+	for _, node := range nodes {
+		if structHasField(node, "RESREF") {
+			continue // blueprint descriptor — regenerated below
+		}
+
+		terminalID := -1
+		fields := make([]gff.Field, 0, len(node.Fields))
+		for _, field := range node.Fields {
+			if field.Label == "LIST" {
+				continue // rebuilt for terminals, recursed for branches
+			}
+			if field.Label == "ID" {
+				if v, ok := field.Value.(gff.ByteValue); ok {
+					terminalID = int(v)
+				}
+			}
+			fields = append(fields, field)
+		}
+
+		switch {
+		case terminalID >= 0:
+			if descriptors := byID[uint8(terminalID)]; len(descriptors) > 0 {
+				fields = append(fields, gff.NewField("LIST", descriptorList(descriptors)))
+			}
+		default:
+			for _, field := range node.Fields {
+				if field.Label == "LIST" {
+					if list, ok := field.Value.(gff.ListValue); ok {
+						fields = append(fields, gff.NewField("LIST", projectPaletteNodes(list, byID)))
+					}
+				}
+			}
+		}
+		out = append(out, gff.Struct{Type: node.Type, Fields: fields})
+	}
+	return out
+}
+
+func descriptorList(descriptors []paletteDescriptor) gff.ListValue {
+	list := make(gff.ListValue, 0, len(descriptors))
+	for _, d := range descriptors {
+		fields := make([]gff.Field, 0, 4)
+		if d.strref != noStrref {
+			fields = append(fields, gff.NewField("STRREF", gff.DWordValue(d.strref)))
+		} else {
+			fields = append(fields, gff.NewField("NAME", gff.StringValue(d.name)))
+		}
+		fields = append(fields, gff.NewField("RESREF", gff.ResRefValue(d.resref)))
+		if d.creature {
+			fields = append(fields, gff.NewField("CR", gff.FloatValue(d.cr)))
+			fields = append(fields, gff.NewField("FACTION", gff.StringValue(d.faction)))
+		}
+		list = append(list, gff.Struct{Fields: fields})
+	}
+	return list
+}
+
+func structHasField(s gff.Struct, label string) bool {
+	for _, field := range s.Fields {
+		if field.Label == label {
+			return true
+		}
+	}
+	return false
+}

internal/pipeline/palette_test.go

@@ -0,0 +1,191 @@
+package pipeline
+
+import (
+	"bytes"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/erf"
+	"git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/gff"
+	"git.westgate.pw/ShadowsOverWestgate/sow-tools/internal/project"
+)
+
+const paletteTestSkeleton = `{
+  "file_type": "ITP ",
+  "file_version": "V3.2",
+  "root": {
+    "struct_type": 4294967295,
+    "fields": [
+      {
+        "label": "MAIN",
+        "type": "List",
+        "value": [
+          {
+            "struct_type": 0,
+            "fields": [
+              {"label": "STRREF", "type": "DWord", "value": 500},
+              {
+                "label": "LIST",
+                "type": "List",
+                "value": [
+                  {
+                    "struct_type": 0,
+                    "fields": [
+                      {"label": "STRREF", "type": "DWord", "value": 6699},
+                      {"label": "ID", "type": "Byte", "value": 23},
+                      {
+                        "label": "LIST",
+                        "type": "List",
+                        "value": [
+                          {
+                            "struct_type": 0,
+                            "fields": [
+                              {"label": "NAME", "type": "CExoString", "value": "Stale Junk"},
+                              {"label": "RESREF", "type": "ResRef", "value": "stalejunk"}
+                            ]
+                          }
+                        ]
+                      }
+                    ]
+                  },
+                  {
+                    "struct_type": 0,
+                    "fields": [
+                      {"label": "STRREF", "type": "DWord", "value": 6753},
+                      {"label": "ID", "type": "Byte", "value": 24}
+                    ]
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}
+`
+
+func paletteTestItem(resref, name string, paletteID int) string {
+	return `{
+  "file_type": "UTI ",
+  "file_version": "V3.2",
+  "root": {
+    "struct_type": 4294967295,
+    "fields": [
+      {"label": "TemplateResRef", "type": "ResRef", "value": "` + resref + `"},
+      {
+        "label": "LocalizedName",
+        "type": "CExoLocString",
+        "value": {"string_ref": 4294967295, "entries": [{"id": 0, "value": "` + name + `"}]}
+      },
+      {"label": "PaletteID", "type": "Byte", "value": ` + itoa(paletteID) + `}
+    ]
+  }
+}
+`
+}
+
+func itoa(v int) string {
+	data, _ := json.Marshal(v)
+	return string(data)
+}
+
+func TestBuildProjectsPaletteDescriptorsAndExtractSkipsThem(t *testing.T) {
+	root := t.TempDir()
+	mustMkdir(t, filepath.Join(root, "src", "module"))
+	mustMkdir(t, filepath.Join(root, "src", "palettes"))
+	mustMkdir(t, filepath.Join(root, "src", "blueprints", "items"))
+	mustMkdir(t, filepath.Join(root, "build"))
+
+	mustWriteFile(t, filepath.Join(root, "nwn-tool.json"), `{
+  "module": {"name": "Test Module", "resref": "testmod"},
+  "paths": {"source": "src", "build": "build"}
+}
+`)
+	mustWriteFile(t, filepath.Join(root, "src", "module", "module.ifo.json"), `{
+  "file_type": "IFO ",
+  "file_version": "V3.2",
+  "root": {"struct_type": 4294967295, "fields": [{"label": "Mod_Name", "type": "CExoString", "value": "Test Module"}]}
+}
+`)
+	mustWriteFile(t, filepath.Join(root, "src", "palettes", "itempalcus.itp.json"), paletteTestSkeleton)
+	mustWriteFile(t, filepath.Join(root, "src", "blueprints", "items", "i_b.uti.json"), paletteTestItem("i_b", "Bravo Item", 23))
+	mustWriteFile(t, filepath.Join(root, "src", "blueprints", "items", "i_a.uti.json"), paletteTestItem("i_a", "Alpha Item", 23))
+	mustWriteFile(t, filepath.Join(root, "src", "blueprints", "items", "i_hidden.uti.json"), paletteTestItem("i_hidden", "Hidden Item", 255))
+
+	p, err := project.Load(root)
+	if err != nil {
+		t.Fatalf("load project: %v", err)
+	}
+	if err := p.Scan(); err != nil {
+		t.Fatalf("scan: %v", err)
+	}
+	if _, err := BuildModule(p); err != nil {
+		t.Fatalf("build: %v", err)
+	}
+
+	archiveFile, err := os.Open(p.ModuleArchivePath())
+	if err != nil {
+		t.Fatalf("open module archive: %v", err)
+	}
+	defer archiveFile.Close()
+	archive, err := erf.Read(archiveFile)
+	if err != nil {
+		t.Fatalf("read module archive: %v", err)
+	}
+
+	var palette *gff.Document
+	for _, resource := range archive.Resources {
+		if resource.Name == "itempalcus" {
+			document, err := gff.Read(bytes.NewReader(resource.Data))
+			if err != nil {
+				t.Fatalf("decode itempalcus: %v", err)
+			}
+			palette = &document
+		}
+	}
+	if palette == nil {
+		t.Fatal("itempalcus missing from built module")
+	}
+
+	canonical, err := json.Marshal(palette)
+	if err != nil {
+		t.Fatalf("marshal palette: %v", err)
+	}
+	text := string(canonical)
+	if bytes.Contains(canonical, []byte("stalejunk")) {
+		t.Fatalf("stale descriptor survived projection: %s", text)
+	}
+	for _, resref := range []string{"i_a", "i_b"} {
+		if !bytes.Contains(canonical, []byte(resref)) {
+			t.Fatalf("descriptor %s missing from projection: %s", resref, text)
+		}
+	}
+	if bytes.Contains(canonical, []byte("i_hidden")) {
+		t.Fatalf("PaletteID 255 blueprint leaked into projection: %s", text)
+	}
+	if a, b := bytes.Index(canonical, []byte("i_a")), bytes.Index(canonical, []byte("i_b")); a > b {
+		t.Fatalf("descriptors not name-sorted: %s", text)
+	}
+
+	if _, err := Compare(p); err != nil {
+		t.Fatalf("compare after build: %v", err)
+	}
+
+	// Extraction must never write palcus files back into source.
+	if err := os.Remove(filepath.Join(root, "src", "palettes", "itempalcus.itp.json")); err != nil {
+		t.Fatalf("remove skeleton: %v", err)
+	}
+	if err := p.Scan(); err != nil {
+		t.Fatalf("rescan: %v", err)
+	}
+	if _, err := Extract(p); err != nil {
+		t.Fatalf("extract: %v", err)
+	}
+	if _, err := os.Stat(filepath.Join(root, "src", "palettes", "itempalcus.itp.json")); !os.IsNotExist(err) {
+		t.Fatalf("extract wrote palcus file back (stat err: %v)", err)
+	}
+}

internal/pipeline/pipeline_test.go

@@ -3503,6 +3503,100 @@ extract:
 	}
 }
 
+func TestExtractSetsConfiguredGFFJSONFields(t *testing.T) {
+	root := t.TempDir()
+	mustMkdir(t, filepath.Join(root, "src", "module"))
+	mustMkdir(t, filepath.Join(root, "src", "areas"))
+	mustMkdir(t, filepath.Join(root, "assets"))
+	mustMkdir(t, filepath.Join(root, "build"))
+
+	mustWriteFile(t, filepath.Join(root, "nwn-tool.yaml"), `
+module:
+  name: Test Module
+  resref: testmod
+paths:
+  source: src
+  assets: assets
+  build: build
+extract:
+  merge:
+    gff_json:
+      - target: areas/*.are.json
+        set_fields:
+          - field: ChanceRain
+            value: 0
+          - field: ChanceSnow
+            value: 0
+`)
+
+	mustWriteFile(t, filepath.Join(root, "src", "module", "module.ifo.json"), `{
+  "file_type": "IFO ",
+  "file_version": "V3.2",
+  "root": {
+    "struct_type": 0,
+    "fields": [
+      {
+        "label": "Mod_Name",
+        "type": "CExoString",
+        "value": "Test Module"
+      }
+    ]
+  }
+}
+`)
+	mustWriteFile(t, filepath.Join(root, "src", "areas", "area_a.are.json"), `{
+  "file_type": "ARE ",
+  "file_version": "V3.2",
+  "root": {
+    "struct_type": 0,
+    "fields": [
+      {
+        "label": "ChanceRain",
+        "type": "Int",
+        "value": 40
+      },
+      {
+        "label": "WindPower",
+        "type": "Int",
+        "value": 2
+      }
+    ]
+  }
+}
+`)
+
+	p, err := project.Load(root)
+	if err != nil {
+		t.Fatalf("load project: %v", err)
+	}
+	if err := p.ValidateLayout(); err != nil {
+		t.Fatalf("validate layout: %v", err)
+	}
+	if err := p.Scan(); err != nil {
+		t.Fatalf("scan: %v", err)
+	}
+	if _, err := BuildModule(p); err != nil {
+		t.Fatalf("build module: %v", err)
+	}
+	if err := p.Scan(); err != nil {
+		t.Fatalf("rescan before extract: %v", err)
+	}
+	if _, err := Extract(p); err != nil {
+		t.Fatalf("extract: %v", err)
+	}
+
+	document := readGFFJSON(t, filepath.Join(root, "src", "areas", "area_a.are.json"))
+	if got, want := fieldValue(t, document.Root, "ChanceRain"), gff.IntValue(0); got != want {
+		t.Fatalf("expected forced ChanceRain %#v, got %#v", want, got)
+	}
+	if got, want := fieldValue(t, document.Root, "WindPower"), gff.IntValue(2); got != want {
+		t.Fatalf("expected untouched WindPower %#v, got %#v", want, got)
+	}
+	if _, ok := gffField(document.Root, "ChanceSnow"); ok {
+		t.Fatalf("expected absent ChanceSnow to stay absent")
+	}
+}
+
 func TestExtractNormalizesResourceNamesToLowercase(t *testing.T) {
 	root := t.TempDir()
 	mustMkdir(t, filepath.Join(root, "src", "blueprints", "items"))

internal/project/project.go

@@ -31,7 +31,7 @@ var SourceExtensions = []string{
 }
 
 var AssetExtensions = []string{
-	".2da", ".bik", ".bmp", ".bmu", ".dds", ".dwk", ".gr2", ".itp", ".jpg", ".lod", ".lyt", ".mdb", ".mdl", ".mdx", ".mtr", ".plt", ".png", ".pwk", ".set", ".shd", ".tga", ".txi", ".uti", ".vis", ".wav", ".wlk", ".wok", ".xml",
+	".2da", ".bik", ".bmp", ".bmu", ".dds", ".dwk", ".itp", ".jpg", ".lod", ".lyt", ".mdl", ".mdx", ".mtr", ".plt", ".png", ".pwk", ".set", ".shd", ".tga", ".txi", ".uti", ".vis", ".wav", ".wok",
 }
 
 var BuiltinScriptPrefixes = []string{
@@ -281,6 +281,15 @@ type ExtractGFFJSONMergeRule struct {
 	Target         string                 `json:"target" yaml:"target"`
 	PreserveFields []string               `json:"preserve_fields" yaml:"preserve_fields"`
 	MergeLists     []ExtractListMergeRule `json:"merge_lists" yaml:"merge_lists"`
+	SetFields      []ExtractSetFieldRule  `json:"set_fields" yaml:"set_fields"`
+}
+
+// ExtractSetFieldRule forces an Int field to a fixed value on every extract,
+// overriding whatever the toolset saved. Fields absent from the extracted
+// document are left absent.
+type ExtractSetFieldRule struct {
+	Field string `json:"field" yaml:"field"`
+	Value int32  `json:"value" yaml:"value"`
 }
 
 type ExtractListMergeRule struct {
@@ -980,6 +989,12 @@ func validateExtractMergeConfig(config ExtractMergeConfig) []error {
 			seenTargets[normalized] = struct{}{}
 		}
 
+		for setIndex, setRule := range rule.SetFields {
+			if strings.TrimSpace(setRule.Field) == "" {
+				failures = append(failures, fmt.Errorf("%s.set_fields[%d].field must not be empty", prefix, setIndex))
+			}
+		}
+
 		for listIndex, listRule := range rule.MergeLists {
 			listPrefix := fmt.Sprintf("%s.merge_lists[%d]", prefix, listIndex)
 			if strings.TrimSpace(listRule.Field) == "" {
@@ -1346,6 +1361,9 @@ func normalizeConfig(cfg *Config) {
 		}
 		cfg.Extract.Merge.GFFJSON[i].Target = target
 		cfg.Extract.Merge.GFFJSON[i].PreserveFields = normalizeStringSlice(cfg.Extract.Merge.GFFJSON[i].PreserveFields)
+		for j := range cfg.Extract.Merge.GFFJSON[i].SetFields {
+			cfg.Extract.Merge.GFFJSON[i].SetFields[j].Field = strings.TrimSpace(cfg.Extract.Merge.GFFJSON[i].SetFields[j].Field)
+		}
 		for j := range cfg.Extract.Merge.GFFJSON[i].MergeLists {
 			cfg.Extract.Merge.GFFJSON[i].MergeLists[j].Field = strings.TrimSpace(cfg.Extract.Merge.GFFJSON[i].MergeLists[j].Field)
 			cfg.Extract.Merge.GFFJSON[i].MergeLists[j].KeyField = strings.TrimSpace(cfg.Extract.Merge.GFFJSON[i].MergeLists[j].KeyField)

internal/topdata/appearance_migrate.go

@@ -1,96 +0,0 @@
-package topdata
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-)
-
-func importLegacyAppearance(referenceBuilderDir, dataDir string, legacyTLK *legacyTLKData) (int, error) {
-	_ = legacyTLK
-
-	legacyDir := filepath.Join(referenceBuilderDir, "data", "appearance")
-	if _, err := os.Stat(legacyDir); err != nil {
-		if os.IsNotExist(err) {
-			return 0, nil
-		}
-		return 0, err
-	}
-
-	targetDir := filepath.Join(dataDir, "appearance")
-	targetBasePath := filepath.Join(targetDir, "base.json")
-	targetLockPath := filepath.Join(targetDir, "lock.json")
-	targetModulesDir := filepath.Join(targetDir, "modules")
-	moduleNames := []string{
-		"cotblreaver.json",
-		"crawlingclaw.json",
-		"halfogre.json",
-		"zombieknight.json",
-	}
-	targetModulePaths := make([]string, 0, len(moduleNames))
-	for _, name := range moduleNames {
-		targetModulePaths = append(targetModulePaths, filepath.Join(targetModulesDir, name))
-	}
-	if fileExists(targetBasePath) && fileExists(targetLockPath) {
-		allModulesPresent := true
-		for _, path := range targetModulePaths {
-			if !fileExists(path) {
-				allModulesPresent = false
-				break
-			}
-		}
-		if allModulesPresent {
-			return 0, nil
-		}
-	}
-
-	baseObj, err := loadJSONObject(filepath.Join(legacyDir, "base.json"))
-	if err != nil {
-		return 0, err
-	}
-	baseObj["output"] = "appearance.2da"
-
-	lockObj, err := loadJSONObject(filepath.Join(legacyDir, "lock.json"))
-	if err != nil {
-		return 0, err
-	}
-
-	moduleObjs := make([]map[string]any, 0, len(moduleNames))
-	for _, name := range moduleNames {
-		obj, err := loadJSONObject(filepath.Join(legacyDir, "modules", name))
-		if err != nil {
-			return 0, err
-		}
-		moduleObjs = append(moduleObjs, obj)
-	}
-
-	if err := os.MkdirAll(targetModulesDir, 0o755); err != nil {
-		return 0, err
-	}
-
-	writes := []struct {
-		path string
-		obj  map[string]any
-	}{
-		{path: targetBasePath, obj: baseObj},
-		{path: targetLockPath, obj: lockObj},
-	}
-	for i, path := range targetModulePaths {
-		writes = append(writes, struct {
-			path string
-			obj  map[string]any
-		}{path: path, obj: moduleObjs[i]})
-	}
-
-	for _, write := range writes {
-		raw, err := json.MarshalIndent(write.obj, "", "  ")
-		if err != nil {
-			return 0, err
-		}
-		raw = append(raw, '\n')
-		if err := os.WriteFile(write.path, raw, 0o644); err != nil {
-			return 0, err
-		}
-	}
-	return len(writes), nil
-}

internal/topdata/armor_migrate.go

@@ -1,160 +0,0 @@
-package topdata
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"sort"
-)
-
-func importLegacyArmor(referenceBuilderDir, dataDir string, legacyTLK *legacyTLKData) (int, error) {
-	_ = legacyTLK
-
-	legacyDir := filepath.Join(referenceBuilderDir, "data", "armor")
-	if _, err := os.Stat(legacyDir); err != nil {
-		if os.IsNotExist(err) {
-			return 0, nil
-		}
-		return 0, err
-	}
-
-	targetDir := filepath.Join(dataDir, "armor")
-	targetPath := filepath.Join(targetDir, "armor.json")
-	if _, err := os.Stat(targetPath); err == nil {
-		obj, err := loadJSONObject(targetPath)
-		if err == nil && countLegacyTLKRefsInValue(obj) == 0 {
-			return 0, nil
-		}
-	}
-
-	baseObj, err := loadJSONObject(filepath.Join(legacyDir, "base.json"))
-	if err != nil {
-		return 0, err
-	}
-	rows, err := mergeArmorRows(baseObj, filepath.Join(legacyDir, "modules"))
-	if err != nil {
-		return 0, err
-	}
-
-	if err := os.MkdirAll(targetDir, 0o755); err != nil {
-		return 0, err
-	}
-	if err := removePathIfExists(filepath.Join(targetDir, "base.json")); err != nil {
-		return 0, err
-	}
-	if err := removePathIfExists(filepath.Join(targetDir, "lock.json")); err != nil {
-		return 0, err
-	}
-	if err := removePathIfExists(filepath.Join(targetDir, "modules")); err != nil {
-		return 0, err
-	}
-
-	out := map[string]any{
-		"output":  "armor.2da",
-		"columns": baseObj["columns"],
-		"rows":    rows,
-	}
-	raw, err := json.MarshalIndent(out, "", "  ")
-	if err != nil {
-		return 0, err
-	}
-	raw = append(raw, '\n')
-	if err := os.WriteFile(targetPath, raw, 0o644); err != nil {
-		return 0, err
-	}
-	return 1, nil
-}
-
-func mergeArmorRows(baseObj map[string]any, modulesDir string) ([]any, error) {
-	rawRows, ok := baseObj["rows"].([]any)
-	if !ok {
-		return nil, nil
-	}
-
-	rows := make([]map[string]any, 0, len(rawRows))
-	byID := map[int]map[string]any{}
-	for _, raw := range rawRows {
-		row, ok := deepCopyValue(raw).(map[string]any)
-		if !ok {
-			continue
-		}
-		delete(row, "key")
-		rawID, ok := row["id"]
-		if !ok {
-			continue
-		}
-		id, err := asInt(rawID)
-		if err != nil {
-			return nil, err
-		}
-		row["id"] = id
-		rows = append(rows, row)
-		byID[id] = row
-	}
-
-	modulePaths, err := collectModulePaths(modulesDir)
-	if err != nil {
-		return nil, err
-	}
-	for _, path := range modulePaths {
-		obj, err := loadJSONObject(path)
-		if err != nil {
-			return nil, err
-		}
-		if entries, ok := obj["entries"].(map[string]any); ok {
-			for _, raw := range entries {
-				row, ok := deepCopyValue(raw).(map[string]any)
-				if !ok {
-					continue
-				}
-				delete(row, "key")
-				rawID, ok := row["id"]
-				if !ok {
-					continue
-				}
-				id, err := asInt(rawID)
-				if err != nil {
-					return nil, err
-				}
-				row["id"] = id
-				rows = append(rows, row)
-				byID[id] = row
-			}
-		}
-		if overrides, ok := obj["overrides"].([]any); ok {
-			for _, raw := range overrides {
-				override, ok := raw.(map[string]any)
-				if !ok {
-					continue
-				}
-				rawID, ok := override["id"]
-				if !ok {
-					continue
-				}
-				id, err := asInt(rawID)
-				if err != nil {
-					return nil, err
-				}
-				row := byID[id]
-				if row == nil {
-					continue
-				}
-				for key, value := range override {
-					if key == "id" || key == "key" || key == "_tlk" || isMetadataField(key) {
-						continue
-					}
-					row[key] = deepCopyValue(value)
-				}
-			}
-		}
-	}
-
-	sort.Slice(rows, func(i, j int) bool {
-		return rows[i]["id"].(int) < rows[j]["id"].(int)
-	})
-	out := make([]any, 0, len(rows))
-	for _, row := range rows {
-		out = append(out, row)
-	}
-	return out, nil
-}

internal/topdata/base_dialog_migrate.go

@@ -1,41 +0,0 @@
-package topdata
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-)
-
-func importLegacyBaseDialog(referenceBuilderDir, sourceDir string) (int, error) {
-	legacyPath := filepath.Join(referenceBuilderDir, "tlk", "base.json")
-	if _, err := os.Stat(legacyPath); err != nil {
-		if os.IsNotExist(err) {
-			return 0, nil
-		}
-		return 0, err
-	}
-
-	targetPath := filepath.Join(sourceDir, "base_dialog.json")
-	if fileExists(targetPath) {
-		current, err := loadJSONObject(targetPath)
-		if err == nil {
-			if entries, ok := current["entries"].(map[string]any); ok && len(entries) > 0 {
-				return 0, nil
-			}
-		}
-	}
-
-	obj, err := loadJSONObject(legacyPath)
-	if err != nil {
-		return 0, err
-	}
-	raw, err := json.MarshalIndent(obj, "", "  ")
-	if err != nil {
-		return 0, err
-	}
-	raw = append(raw, '\n')
-	if err := os.WriteFile(targetPath, raw, 0o644); err != nil {
-		return 0, err
-	}
-	return 1, nil
-}

internal/topdata/baseitems_migrate.go

@@ -1,105 +0,0 @@
-package topdata
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-)
-
-func importLegacyBaseitems(referenceBuilderDir, dataDir string, legacyTLK *legacyTLKData) (int, error) {
-	_ = legacyTLK
-
-	legacyDir := filepath.Join(referenceBuilderDir, "data", "baseitems")
-	if _, err := os.Stat(legacyDir); err != nil {
-		if os.IsNotExist(err) {
-			return 0, nil
-		}
-		return 0, err
-	}
-
-	targetDir := filepath.Join(dataDir, "baseitems")
-	targetBasePath := filepath.Join(targetDir, "base.json")
-	targetLockPath := filepath.Join(targetDir, "lock.json")
-	targetModulesDir := filepath.Join(targetDir, "modules")
-	moduleNames := []string{
-		"blunderbuss.json",
-		"coin.json",
-		"estoc.json",
-		"heavymace.json",
-		"maulandfalchion.json",
-		"ovr_baseitems.json",
-		"ovr_cloak255.json",
-		"ovr_helmet255.json",
-		"shortspear.json",
-	}
-	targetModulePaths := make([]string, 0, len(moduleNames))
-	for _, name := range moduleNames {
-		targetModulePaths = append(targetModulePaths, filepath.Join(targetModulesDir, name))
-	}
-	if fileExists(targetBasePath) && fileExists(targetLockPath) {
-		allModulesPresent := true
-		for _, path := range targetModulePaths {
-			if !fileExists(path) {
-				allModulesPresent = false
-				break
-			}
-		}
-		if allModulesPresent {
-			return 0, nil
-		}
-	}
-
-	baseObj, err := loadJSONObject(filepath.Join(legacyDir, "base.json"))
-	if err != nil {
-		return 0, err
-	}
-	baseObj["output"] = "baseitems.2da"
-	canonicalizeWikiMetadataDocument(baseObj)
-
-	lockObj, err := loadJSONObject(filepath.Join(legacyDir, "lock.json"))
-	if err != nil {
-		return 0, err
-	}
-
-	moduleObjs := make([]map[string]any, 0, len(moduleNames))
-	for _, name := range moduleNames {
-		obj, err := loadJSONObject(filepath.Join(legacyDir, "modules", name))
-		if err != nil {
-			return 0, err
-		}
-		canonicalizeWikiMetadataDocument(obj)
-		moduleObjs = append(moduleObjs, obj)
-	}
-
-	if err := os.MkdirAll(targetModulesDir, 0o755); err != nil {
-		return 0, err
-	}
-
-	writes := []struct {
-		path string
-		obj  map[string]any
-	}{
-		{path: targetBasePath, obj: baseObj},
-		{path: targetLockPath, obj: lockObj},
-	}
-	for index, path := range targetModulePaths {
-		writes = append(writes, struct {
-			path string
-			obj  map[string]any
-		}{
-			path: path,
-			obj:  moduleObjs[index],
-		})
-	}
-	for _, write := range writes {
-		raw, err := json.MarshalIndent(write.obj, "", "  ")
-		if err != nil {
-			return 0, err
-		}
-		raw = append(raw, '\n')
-		if err := os.WriteFile(write.path, raw, 0o644); err != nil {
-			return 0, err
-		}
-	}
-	return len(writes), nil
-}

internal/topdata/classes_migrate.go

@@ -1,226 +0,0 @@
-package topdata
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"slices"
-	"strings"
-)
-
-var legacyClassesPlainFamilies = []string{"feats", "skills", "savthr", "bfeat", "pres"}
-
-func importLegacyClasses(referenceBuilderDir, dataDir string, legacyTLK *legacyTLKData) (int, error) {
-	legacyRoot := filepath.Join(referenceBuilderDir, "data", "classes")
-	if _, err := os.Stat(legacyRoot); err != nil {
-		if os.IsNotExist(err) {
-			return 0, nil
-		}
-		return 0, err
-	}
-
-	targetRoot := filepath.Join(dataDir, "classes")
-	if canonicalClassesPresent(targetRoot) {
-		return 0, nil
-	}
-
-	coreCollected, plainCollected, err := collectLegacyClassesDatasets(legacyRoot)
-	if err != nil {
-		return 0, err
-	}
-
-	tableKeyByOutput := map[string]string{}
-	for _, dataset := range plainCollected {
-		if dataset.TableKey == "" {
-			continue
-		}
-		registerLegacyClassesTableKey(tableKeyByOutput, dataset.TableKey, dataset.Dataset.OutputName)
-	}
-
-	coreRows := make([]map[string]any, 0, len(coreCollected.Rows))
-	for _, rawRow := range coreCollected.Rows {
-		row, ok := deepCopyValue(rawRow).(map[string]any)
-		if !ok {
-			continue
-		}
-		if legacyTLK != nil {
-			if _, _, err := inlineLegacyTLKValue(row, legacyTLK); err != nil {
-				return 0, err
-			}
-		}
-		rewriteLegacyClassesCoreRow(row, tableKeyByOutput)
-		coreRows = append(coreRows, row)
-	}
-
-	if err := removePathIfExists(targetRoot); err != nil {
-		return 0, err
-	}
-	if err := os.MkdirAll(filepath.Join(targetRoot, "core"), 0o755); err != nil {
-		return 0, err
-	}
-
-	writes := []struct {
-		path string
-		obj  map[string]any
-	}{
-		{
-			path: filepath.Join(targetRoot, "core", "base.json"),
-			obj: map[string]any{
-				"output":  coreCollected.Dataset.OutputName,
-				"columns": stringSliceToAny(coreCollected.Columns),
-				"rows":    rowsToAny(coreRows),
-			},
-		},
-		{
-			path: filepath.Join(targetRoot, "core", "lock.json"),
-			obj:  anyMapInt(coreCollected.LockData),
-		},
-	}
-
-	for _, collected := range plainCollected {
-		obj := map[string]any{
-			"output":  collected.Dataset.OutputName,
-			"columns": stringSliceToAny(collected.Columns),
-			"rows":    rowsToAny(collected.Rows),
-		}
-		if strings.TrimSpace(collected.TableKey) != "" {
-			obj["key"] = collected.TableKey
-		}
-		writes = append(writes, struct {
-			path string
-			obj  map[string]any
-		}{
-			path: filepath.Join(dataDir, collected.Dataset.Name+".json"),
-			obj:  obj,
-		})
-	}
-
-	for _, write := range writes {
-		if err := os.MkdirAll(filepath.Dir(write.path), 0o755); err != nil {
-			return 0, err
-		}
-		raw, err := json.MarshalIndent(write.obj, "", "  ")
-		if err != nil {
-			return 0, err
-		}
-		raw = append(raw, '\n')
-		if err := os.WriteFile(write.path, raw, 0o644); err != nil {
-			return 0, err
-		}
-	}
-
-	return len(writes), nil
-}
-
-func canonicalClassesPresent(targetRoot string) bool {
-	if !fileExists(filepath.Join(targetRoot, "core", "base.json")) || !fileExists(filepath.Join(targetRoot, "core", "lock.json")) {
-		return false
-	}
-	for _, family := range legacyClassesPlainFamilies {
-		ok, err := hasJSONFiles(filepath.Join(targetRoot, family))
-		if err != nil || !ok {
-			return false
-		}
-	}
-	return true
-}
-
-func collectLegacyClassesDatasets(legacyRoot string) (nativeCollectedDataset, []nativeCollectedDataset, error) {
-	coreCollected, err := collectBaseDataset(nativeDataset{
-		Name:       "classes/core",
-		BasePath:   filepath.Join(legacyRoot, "core", "base.json"),
-		LockPath:   filepath.Join(legacyRoot, "core", "lock.json"),
-		ModulesDir: filepath.Join(legacyRoot, "core", "modules"),
-		OutputName: "classes.2da",
-		Spec:       specForDataset("classes"),
-	})
-	if err != nil {
-		return nativeCollectedDataset{}, nil, err
-	}
-	coreCollected.Dataset.OutputName = "classes.2da"
-
-	plainCollected := make([]nativeCollectedDataset, 0)
-	for _, family := range legacyClassesPlainFamilies {
-		familyDir := filepath.Join(legacyRoot, family)
-		entries, err := os.ReadDir(familyDir)
-		if err != nil {
-			if os.IsNotExist(err) {
-				continue
-			}
-			return nativeCollectedDataset{}, nil, err
-		}
-		for _, entry := range entries {
-			if entry.IsDir() || filepath.Ext(entry.Name()) != ".json" || strings.HasPrefix(entry.Name(), ".") || entry.Name() == "lock.json" {
-				continue
-			}
-			filePath := filepath.Join(familyDir, entry.Name())
-			tableData, err := loadJSONObject(filePath)
-			if err != nil {
-				return nativeCollectedDataset{}, nil, err
-			}
-			outputName, _ := tableData["output"].(string)
-			if strings.TrimSpace(outputName) == "" {
-				outputName = strings.TrimSuffix(entry.Name(), filepath.Ext(entry.Name())) + ".2da"
-			}
-			collected, err := collectPlainDataset(nativeDataset{
-				Name:       filepath.ToSlash(filepath.Join("classes", family, strings.TrimSuffix(entry.Name(), filepath.Ext(entry.Name())))),
-				BasePath:   filePath,
-				LockPath:   filepath.Join(familyDir, "lock.json"),
-				OutputName: outputName,
-				Spec:       specForDataset(filepath.ToSlash(filepath.Join("classes", family, strings.TrimSuffix(entry.Name(), filepath.Ext(entry.Name()))))),
-			})
-			if err != nil {
-				return nativeCollectedDataset{}, nil, err
-			}
-			plainCollected = append(plainCollected, collected)
-		}
-	}
-
-	slices.SortFunc(plainCollected, func(a, b nativeCollectedDataset) int {
-		return strings.Compare(a.Dataset.Name, b.Dataset.Name)
-	})
-	return coreCollected, plainCollected, nil
-}
-
-func registerLegacyClassesTableKey(tableKeyByOutput map[string]string, tableKey, outputName string) {
-	trimmedOutput := strings.TrimSpace(outputName)
-	if trimmedOutput != "" {
-		tableKeyByOutput[trimmedOutput] = tableKey
-	}
-	trimmedStem := strings.TrimSpace(outputStem(outputName))
-	if trimmedStem != "" {
-		tableKeyByOutput[trimmedStem] = tableKey
-	}
-}
-
-func rewriteLegacyClassesCoreRow(row map[string]any, tableKeyByOutput map[string]string) {
-	for _, field := range []string{"FeatsTable", "SavingThrowTable", "SkillsTable", "BonusFeatsTable", "PreReqTable"} {
-		tableKey := legacyClassesTableKeyForValue(row[field], tableKeyByOutput)
-		if tableKey == "" {
-			continue
-		}
-		row[field] = map[string]any{"table": tableKey}
-	}
-}
-
-func legacyClassesTableKeyForValue(value any, tableKeyByOutput map[string]string) string {
-	switch typed := value.(type) {
-	case map[string]any:
-		tableKey, _ := typed["table"].(string)
-		return strings.TrimSpace(tableKey)
-	case string:
-		trimmed := strings.TrimSpace(typed)
-		if trimmed == "" || trimmed == nullValue {
-			return ""
-		}
-		if trimmed != strings.ToLower(trimmed) {
-			return ""
-		}
-		if tableKey, ok := tableKeyByOutput[trimmed]; ok {
-			return tableKey
-		}
-		return ""
-	default:
-		return ""
-	}
-}

internal/topdata/cloakmodel_migrate.go

@@ -1,6 +0,0 @@
-package topdata
-
-func importLegacyCloakmodel(referenceBuilderDir, dataDir string, legacyTLK *legacyTLKData) (int, error) {
-	_ = legacyTLK
-	return importLegacyDatasetMirror(referenceBuilderDir, dataDir, "cloakmodel", "cloakmodel.2da", nil)
-}

internal/topdata/creaturespeed_migrate.go

@@ -1,145 +0,0 @@
-package topdata
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-)
-
-func importLegacyCreaturespeed(referenceBuilderDir, dataDir string, legacyTLK *legacyTLKData) (int, error) {
-	_ = legacyTLK
-
-	legacyDir := filepath.Join(referenceBuilderDir, "data", "creaturespeed")
-	if _, err := os.Stat(legacyDir); err != nil {
-		if os.IsNotExist(err) {
-			return 0, nil
-		}
-		return 0, err
-	}
-
-	targetDir := filepath.Join(dataDir, "creaturespeed")
-	targetPath := filepath.Join(targetDir, "creaturespeed.json")
-	if _, err := os.Stat(targetPath); err == nil {
-		obj, err := loadJSONObject(targetPath)
-		if err == nil && countLegacyTLKRefsInValue(obj) == 0 {
-			return 0, nil
-		}
-	}
-
-	baseObj, err := loadJSONObject(filepath.Join(legacyDir, "base.json"))
-	if err != nil {
-		return 0, err
-	}
-	rows, err := mergeCreaturespeedRows(baseObj, filepath.Join(legacyDir, "modules"))
-	if err != nil {
-		return 0, err
-	}
-	if err := os.MkdirAll(targetDir, 0o755); err != nil {
-		return 0, err
-	}
-
-	if err := removePathIfExists(filepath.Join(targetDir, "base.json")); err != nil {
-		return 0, err
-	}
-	if err := removePathIfExists(filepath.Join(targetDir, "lock.json")); err != nil {
-		return 0, err
-	}
-	if err := removePathIfExists(filepath.Join(targetDir, "modules")); err != nil {
-		return 0, err
-	}
-
-	out := map[string]any{
-		"output":  "creaturespeed.2da",
-		"columns": baseObj["columns"],
-		"rows":    rows,
-	}
-
-	raw, err := json.MarshalIndent(out, "", "  ")
-	if err != nil {
-		return 0, err
-	}
-	raw = append(raw, '\n')
-	if err := os.WriteFile(targetPath, raw, 0o644); err != nil {
-		return 0, err
-	}
-	return 1, nil
-}
-
-func mergeCreaturespeedRows(baseObj map[string]any, modulesDir string) ([]any, error) {
-	rawRows, ok := baseObj["rows"].([]any)
-	if !ok {
-		return nil, nil
-	}
-	rows := make([]map[string]any, 0, len(rawRows))
-	byID := map[int]map[string]any{}
-	for _, raw := range rawRows {
-		row, ok := deepCopyValue(raw).(map[string]any)
-		if !ok {
-			continue
-		}
-		delete(row, "key")
-		rows = append(rows, row)
-		if rawID, ok := row["id"]; ok {
-			id, err := asInt(rawID)
-			if err != nil {
-				return nil, err
-			}
-			byID[id] = row
-		}
-	}
-
-	modulePaths, err := collectModulePaths(modulesDir)
-	if err != nil {
-		return nil, err
-	}
-	for _, path := range modulePaths {
-		obj, err := loadJSONObject(path)
-		if err != nil {
-			return nil, err
-		}
-		overrideList, ok := obj["overrides"].([]any)
-		if !ok {
-			continue
-		}
-		for _, raw := range overrideList {
-			override, ok := raw.(map[string]any)
-			if !ok {
-				continue
-			}
-			rawID, ok := override["id"]
-			if !ok {
-				continue
-			}
-			id, err := asInt(rawID)
-			if err != nil {
-				return nil, err
-			}
-			row := byID[id]
-			if row == nil {
-				continue
-			}
-			for key, value := range override {
-				if key == "id" || key == "key" || key == "_tlk" {
-					continue
-				}
-				row[key] = deepCopyValue(value)
-			}
-		}
-	}
-
-	out := make([]any, 0, len(rows))
-	for _, row := range rows {
-		out = append(out, row)
-	}
-	return out, nil
-}
-
-func removePathIfExists(path string) error {
-	if _, err := os.Stat(path); err != nil {
-		if os.IsNotExist(err) {
-			return nil
-		}
-		return err
-	}
-	return os.RemoveAll(path)
-}