# PantheonMU Valhalla Launcher

Native Windows launcher, built for the PantheonMU client. The website provides its ZIP download, public signed update channel and SHA-256 addressed patch files.

## Players

1. Download `PantheonMU_Launcher_1.1.2.zip` from `https://pantheonmu.online/launcher`.
2. Close an older launcher if it is open. Extract the new ZIP. Open `PantheonMU.exe` from the extracted folder.
3. If the launcher is inside the game folder, it detects `Main.exe`. Otherwise choose your game's executable with **Select client** or **Settings**.
4. Finish the update check and press **Start game**. If Windows asks permission to start your client, choose **Yes**. Declining leaves the launcher open so you can try again. Sign in inside the game.

Windows 10/11 with Microsoft .NET Framework 4.8 is required. The launcher uses your existing MU client; the full game is not included. The launcher runs as a standard user. Windows can request administrator permission for a game executable that requires it. Keep `PantheonMU.exe.config` beside the executable.

If your client needs launch arguments, enter the exact arguments in Settings. The launcher passes them directly to the selected executable with its client folder as the working directory. It does not alter the client's server IP or encryption configuration.

The stable channel publishes client release `2026.10.18.1` (sequence `2`). It includes the 17 files from the owner's `Data(1).zip`: `Data/Local/CustomInfo.bmd` and the World 1 / World 116 minimaps for Chs, Eng, Heb, Kor, Por, Spn, Tai and Vie. The previous official `Data/Gate.bmd` update remains included, for 18 tracked files in total. The launcher replaces a tracked file when its size or SHA-256 differs from the signed release. Other client files are left intact. Finish the update check before starting the game. If the channel fails verification, retry before starting the game.

## Updates

Updates are accepted only from `https://pantheonmu.online/launcher/patches/`, after the RSA-3072/SHA-256 manifest signature and every file's size and SHA-256 are verified. Redirects, unsafe paths, duplicate case-insensitive paths, junctions inside the client, script files, the launcher and an older release sequence are rejected.

All changed files are staged before replacement. Applying a release restores previous files on failure. If recovery itself fails, backups remain in the displayed recovery folder. Patching stops while the game is running. Cancel stops verification or download before the commit step; the short commit is allowed to finish safely.

Publisher tooling takes a patch folder, a release version and an increasing sequence. Each patch file can be at most 24 MB, a manifest at most 1 MB, and a complete release at most 8 GB. Include the full intended set of tracked files on subsequent releases; untracked local files are left intact. Deleting remote files is not supported.

The owner's private publisher key is never included in public source, downloads or website assets. Keep the separate owner toolkit private and backed up. Public source contains only the verification key.

## Build

Generate palette adapters with `node launcher/tools/theme.mjs`. Compile the C# sources with Mono `mcs` or the Microsoft .NET Framework C# compiler, targeting a Windows application and referencing `System.Windows.Forms`, `System.Drawing`, `System.Net.Http`, `System.Web.Extensions` and `System.Core`. Embed the text-free Valhalla skin, original emblem, icon, Cinzel heading font and Geist interface font. Include `app.manifest` and the executable config.

The repeatable Linux packaging command is `node launcher/tools/package.mjs`; it requires `mcs` and the .NET Framework 4.8 reference assemblies. Compilation explicitly selects `-sdk:4.8`, so overload resolution cannot bind to additional APIs in the build machine's Mono runtime. The managed executable targets the .NET Framework runtime already present on Windows, so no Mono runtime is distributed to players.

Run `node launcher/tools/test-native.mjs` with `mcs`, `mono` and `monodis` available to inspect the shipped executable's API references and exercise native updater, cumulative-release and game-start checks.

## Verification boundary

The release is compiled and the updater's signatures, path policy, release generator, file hashes and replacement rollback are exercised automatically. The production drawing code is also rendered offscreen at 100%, 125%, 150% and a smaller viewport, with ready, checking, client-selection and error states. These images validate the artwork and drawing layout; actual Windows control behavior, monitor DPI changes and real-client patching still require a Windows/client smoke test.
