diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..4e51d74
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,108 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  rust:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-22.04, windows-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+
+      # Windows and macOS need nothing beyond the toolchain.
+      - name: Install Tauri system packages
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf
+
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+        with:
+          toolchain: stable
+          components: rustfmt, clippy
+
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+        with:
+          workspaces: src-tauri
+
+      # tauri::generate_context! wants the built frontend to exist.
+      - name: Placeholder frontend
+        shell: bash
+        run: mkdir -p dist && touch dist/index.html
+
+      - name: Format
+        working-directory: src-tauri
+        run: cargo fmt --check
+
+      - name: Clippy
+        working-directory: src-tauri
+        run: cargo clippy --all-targets -- -D warnings
+
+      # Includes bindings_are_current (fails if src/mods/bindings is out of date) and the shared
+      # rule cases in src/dev/fixtures/rules.json (rules_fixture.rs).
+      - name: Test
+        working-directory: src-tauri
+        run: cargo test
+
+  frontend:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: lts/*
+          cache: npm
+
+      - run: npm ci
+
+      # On its own, so a missing translation or a sentence assembled from pieces is labelled as
+      # such, not as a failed build (the build runs it again).
+      - name: Check translations
+        run: npm run check:i18n
+
+      # check:i18n, tsc and vite build
+      - name: Build
+        run: npm run build
+
+      - name: Unit tests
+        run: npm test
+
+  ui:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: lts/*
+          cache: npm
+
+      - run: npm ci
+
+      - name: Install Chromium
+        run: npx playwright install --with-deps chromium
+
+      # Every mock scenario in all four languages at 960×565, plus the safety and keyboard flows.
+      - name: UI tests
+        run: npm run test:ui
+
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        if: failure()
+        with:
+          name: playwright-traces
+          path: test-results/
+          retention-days: 7
diff --git a/.gitignore b/.gitignore
index 85d23d2..1507d23 100644
--- a/.gitignore
+++ b/.gitignore
@@ -34,4 +34,6 @@ desktop.ini
 # Logs
 logs
 *.log
-*.bak
\ No newline at end of file
+*.bak
+test-results/
+playwright-report/
diff --git a/README.md b/README.md
index 15dfae2..5acc1cb 100644
--- a/README.md
+++ b/README.md
@@ -23,10 +23,14 @@ The builds aren't code-signed yet:
 
 **Versions** -> **Install** -> back to **Home** -> **Play**. Delete a version with a double click on **Delete** (blocked while the game is running).
 
+**Mods** -> pick the game version -> **Browse** -> **Install**. Each game version keeps its own mods. Mods are native programs that run with your privileges.
+
+Besides the signed [Weft mod index](https://github.com/Weft-Rust/weft-mods-index), you can add GitHub repos under **Sources** or install a zip **From file**. Builds pinned in the index are Reviewed; others are Unreviewed or Unverified. See the [mod manager design](docs/mod-manager/PROPOSAL.md).
+
 ## Data
 
-- **Game data** (worlds, settings): `%APPDATA%\Weft` - the launcher never reads or writes it.
-- **Launcher data**: `%APPDATA%\dev.weft.launcher` - `versions/`, `logs/<tag>.log`, `cache/`, `downloads/`.
+- **Game data** (worlds, settings): `%APPDATA%\Weft` - the launcher never writes it, and only lists its `mods` folder to warn about mods it can't manage.
+- **Launcher data**: `%APPDATA%\dev.weft.launcher` - `versions/`, `logs/<tag>.log`, `cache/`, `downloads/`, and for mods `mods/store/` (downloads by SHA-256) and `profiles/<tag>/` (each version's mod set).
 
 Newer versions may write saves older ones can't open - back up `saves` before downgrading.
 
@@ -40,7 +44,24 @@ npm run tauri dev     # dev mode (plain `cargo run` won't work - UI is served by
 npm run tauri build   # installer
 ```
 
-Before a PR: `cargo fmt --check && cargo clippy` in `src-tauri`, and `npm run build`. UI strings go through `src/i18n` - add keys to all four languages (en, pt-BR, es, ru).
+Before a PR:
+
+- `cargo fmt --check && cargo clippy --all-targets -- -D warnings && cargo test` in `src-tauri`.
+- `npm run build`. It runs `npm run check:i18n` first.
+- UI strings go through `src/i18n`: add every key to all four languages (en, pt-BR, es, ru), with the plural forms each needs. A key built from a prefix goes in the checker's `DYNAMIC` list.
+- `npm test`: the unit tests (vitest).
+- `npm run test:ui`: the UI tests (Playwright, `e2e/`). Run `npx playwright install chromium` once first, or point `PW_CHROMIUM` at an installed Chromium. Each run starts its own mock server on a free port; `PW_PORT=<port>` fixes the port, and `PW_REUSE=1` with it tests a server you already started.
+- After changing an IPC type or command, regenerate `src/mods/bindings` with `cd src-tauri && cargo test export_bindings -- --ignored`. CI fails until it is committed.
+
+CI (`.github/workflows/ci.yml`) runs all of these on every pull request.
+
+### UI without Tauri
+
+```bash
+npm run dev:mock      # http://localhost:1420/?scenario=mods
+```
+
+Runs the UI in a browser against a fake backend that follows the real backend's rules. Scenarios and URL flags are in [docs/dev-mock.md](docs/dev-mock.md).
 
 ## Releasing
 
diff --git a/docs/dev-mock.md b/docs/dev-mock.md
new file mode 100644
index 0000000..1f45e37
--- /dev/null
+++ b/docs/dev-mock.md
@@ -0,0 +1,60 @@
+# Mock backend
+
+`npm run dev:mock` serves the UI at http://localhost:1420/?scenario=mods against a fake backend
+(`src/dev/mockBackend.ts`). The mock never ships in a production build.
+
+Its rules are ported from the Rust backend (`src/dev/mockRules.ts`), and both are checked against
+the shared cases in `src/dev/fixtures/` (`npm test`, `cargo test`). File system and network failures
+are only simulated as the error code they end in; Rust tests them against real files and a local
+HTTP server.
+
+Pick a state with `?scenario=` and adjust it with flags, which combine:
+`?scenario=mods&index=cached&revoked=cogwork&slow=1`. Flags in the URL override the ones a scenario
+sets. Both lists come from `src/dev/scenarios.ts`; `npm test` fails if this page misses one.
+
+## Scenarios
+
+| Scenario | What it shows | Flags it sets |
+|---|---|---|
+| `mods` | The default: a mod built for another version (with a fitting update), an update, an off prerelease, a source, a local file and a file in the player's own folder. | — |
+| `empty` | The newest version has no mods; the older one has mods to copy. | — |
+| `fresh` | No game version installed. | — |
+| `offline` | No network: the cached index and a source's cached mods. | `index=cached` `source=offline` |
+| `crash` | The game stops while loading Structures, which has an update. | `crash=loadFailed` |
+| `knownfile` | From file picks a catalogued build (Cogwork 0.2.0). | `file=known` |
+| `revoked` | The installed Cogwork build is revoked. | `revoked=cogwork` |
+| `ratelimited` | GitHub rate-limits the source; its last mods are shown. | `source=ratelimited` |
+| `indexdown` | No index on the server (404) and none saved: no Reviewed mods. | `index=unavailable` |
+| `stale` | The index signature is over 30 days old. | `index=stale` |
+| `invalid` | The new index's signature doesn't verify; the last good one is shown. | `index=invalid` |
+| `rollback` | The new index is older than one already accepted; the last good one is shown. | `index=rollback` |
+| `missingdep` | Hearth needs Cogwork (off); Lanterns needs Glowmoss (not installed); Railways needs Signals (no build). | — |
+| `lateblock` | Play itself finds Cogwork revoked; Hearth, which needs it, blocks the start. | `prelaunch=revoke` |
+| `long` | Very long mod names, ids and repos. | `long=1` |
+| `shadowed` | Cogwork is revoked and the player's own folder has a copy: Play is blocked until that file goes. | `revoked=cogwork` `shadow=cogwork` |
+| `slowrefresh` | A refresh revokes Cogwork at once while the source lantern-dev/lanterns takes three seconds. | `slowsource=lantern-dev/lanterns` `refreshrevokes=cogwork` |
+| `chain` | Chimneys → Hearth → Cogwork, both installed and off; Junctions → Railways → Signals, which has no build. | `chain=1` |
+
+## Flags
+
+| Flag | Values | Effect |
+|---|---|---|
+| `index` | `fresh`, `stale`, `cached`, `unavailable`, `unreachable`, `invalid`, `rollback`, `unsaved` | State of the signed index. `unavailable`: none saved, server answers 404. `unreachable`: none saved, no network. `unsaved`: fresh but not saved (`cacheError`). |
+| `source` | `ok`, `notfound`, `ratelimited`, `offline` | State of the added GitHub source. |
+| `nomods` | `noReleases`, `noModFiles`, `unreadable`, `noDigest`, `disagrees`, `invalid` | The source has no usable mods, for this reason. |
+| `race` | `stale`, `error` | The first refresh answers last, with an older catalogue or an error. The page keeps the newer answer. |
+| `slowsource` | `<repo>` | That source takes three seconds; the index is shown before it answers. |
+| `refreshrevokes` | `<mod id>` | The next refresh's index revokes that mod's installed builds, once. |
+| `revoked` | `<mod id>` | Revokes that mod's installed builds. |
+| `abi` | `error` | The version's ABI can't be found. |
+| `fail` | `install`, `network`, `toolarge`, `dep`, `meanwhile`, `catalog`, `sources` | Comma-separated. `install`: the hash check fails. `network`: the download breaks off midway. `toolarge`: the zip is refused before downloading. `dep`: a dependency's download fails. `meanwhile`: a newer Glowmoss appears after the first plan, so that plan is refused and planned again. `catalog`: the catalogue fails to load. `sources`: the sources list is damaged. |
+| `file` | `unverified`, `known`, `notamod`, `revoked`, `revokedlate`, `wrongplatform` | What From file picks; `revokedlate` is revoked during the install. |
+| `shadow` | `<mod id>` | The player's own folder has a copy of that mod. Tests delete it with `window.mockPlayer.deleteFile(name)`. |
+| `revocations` | `messy` | Uppercase hashes, no reason or time, and one entry that isn't a hash: only that one is dropped. |
+| `chain` | `1` | Adds Chimneys and Junctions. |
+| `crash` | `wrongVersion`, `loadFailed`, `notAMod`, `wrongName`, `missingDep`, `initPanicked`, `exit` | The game stops with this failure; `exit` names no mod. |
+| `prelaunch` | `revoke`, `storemissing` | Play finds Cogwork revoked, or the store's copy of Structures gone (`ModStoreMissing`). |
+| `long` | `1` | Adds very long names, ids and repos. |
+| `slow` | `1` | Everything takes four times as long. |
+| `fast` | `1` | Everything takes a quarter as long. |
+| `profile` | `fail`, `failafterplay` | Reading a version's set fails: always, or only the first read after Play. |
diff --git a/docs/mod-manager/AUTHORING.md b/docs/mod-manager/AUTHORING.md
new file mode 100644
index 0000000..fb483e6
--- /dev/null
+++ b/docs/mod-manager/AUTHORING.md
@@ -0,0 +1,83 @@
+# Publishing a Weft mod
+
+For mod authors: how to ship a mod the launcher can install, first from your own GitHub repo
+(players see it as **Unreviewed**), then in the signed Weft mod index (**Reviewed**). The exact
+rules are in [INDEX_FORMAT.md](INDEX_FORMAT.md); this page is the path through them.
+
+## 1. The zip
+
+One `<id>.zip` per build, where `<id>` is your mod id: `[a-z0-9_]{1,64}`, not `base`, and equal to
+your crate name (the engine refuses a mismatch). Inside, nothing but:
+
+```text
+<id>.dll          Windows
+lib<id>.so        Linux
+lib<id>.dylib     macOS
+assets/…          textures, lang files, and assets/textures/gui/icon.png
+```
+
+No other files at the top, no folders above these, no `..`, absolute paths or links. Ship the
+libraries for the platforms you build, and list them in `platforms`. Limits: 512 MB, 20,000 entries
+and 1 GB unpacked ([all limits](INDEX_FORMAT.md#size-limits)).
+
+## 2. The release
+
+- **Tag** each build `<id>-v<version>`, for example `lanterns-v1.2.0`, to keep several mods in one
+  repo apart. Any tag works if it is 1–100 letters, digits, `.`, `_` or `-` and doesn't start with
+  `.`.
+- **Version** is semver (`1.2.0`, `1.3.0-beta.1`). A prerelease on GitHub is a prerelease in the
+  launcher too.
+- Make the release (not a draft) with `<id>.zip` and `<id>.mod.json` as its assets. GitHub records
+  a SHA-256 digest for each asset; a zip without one is skipped.
+- A new build is a new version and a new release, every time. If two releases share a version or
+  a zip hash, the older one's copy is skipped.
+
+## 3. `<id>.mod.json`
+
+Describe the build exactly as GitHub has it: the example and every rule are in
+[INDEX_FORMAT, `<id>.mod.json`](INDEX_FORMAT.md#idmodjson-for-unreviewed-sources), and
+[`schema/mod.schema.json`](schema/mod.schema.json) checks the shape. The fields that trip people:
+
+- `asset.url` is the zip's `browser_download_url`, character for character, and `asset.size` and
+  `asset.sha256` are the zip's.
+- `weft.abi` is the FNV-1a-64 hash of the raw bytes of `crates/abi/src/lib.rs` at the Weft commit
+  you built against, as 16 lowercase hex digits. Players get your build only on Weft versions with
+  the same ABI.
+- `deps` lists every mod yours needs to load, by id.
+- `provenance` from your own repo is shown as your claim, never as a record: leave it `null`, or
+  describe your attestation (step 4).
+
+Then add your repo in the launcher (Mods → Sources).
+
+### When a source shows no mods
+
+The Sources dialog shows one reason: that of the release that passed the most checks. The checks run in this order:
+
+| Reason | Means |
+| --- | --- |
+| `noReleases` | The repo has no published releases. |
+| `noModFiles` | No release has an `<id>.zip` together with its `<id>.mod.json`. |
+| `unreadable` | An `<id>.mod.json` couldn't be read as JSON, or isn't a description. |
+| `noDigest` | GitHub has no SHA-256 digest for the zip, so nothing could be checked. |
+| `disagrees` | The description doesn't match GitHub's record of the release: tag, repo, asset name, URL, size or hash, or the id isn't the zip's. |
+| `invalid` | It matches, but breaks a [rule every entry follows](INDEX_FORMAT.md#rules-the-launcher-enforces). |
+
+## 4. Into the signed index
+
+A build in the index is **Reviewed**: someone read it, and the index signature pins its bytes, so a
+changed release can't change what players install.
+
+1. Build in GitHub Actions and attest the zip with
+   [`actions/attest-build-provenance`](https://github.com/actions/attest-build-provenance), from a
+   workflow in `.github/workflows/`.
+2. Open a pull request on `Weft-Rust/weft-mods-index` that adds the version to your mod's entry
+   (the mod too, the first time): the same fields as your `<id>.mod.json`, with `source.commit`
+   the full commit the release was built from.
+3. A reviewer reads the source at that commit, runs `gh attestation verify` on the zip, and adds
+   `reviewed` and `provenance`. The launcher shows a build record only when that record is complete
+   ([INDEX_FORMAT, Provenance](INDEX_FORMAT.md#provenance)).
+4. Once merged, CI signs the index and Pages serves it; players get it on their next refresh.
+
+If a build turns out to be harmful or broken, ask for its `sha256` to be revoked, with a reason.
+Launchers learn of it when they next read the index, and turn the build off the next time its
+version's mods are read or before Play. A running game keeps it until it stops.
diff --git a/docs/mod-manager/INDEX_FORMAT.md b/docs/mod-manager/INDEX_FORMAT.md
new file mode 100644
index 0000000..f2add92
--- /dev/null
+++ b/docs/mod-manager/INDEX_FORMAT.md
@@ -0,0 +1,267 @@
+# Mod index format, v1
+
+This file is the contract between Weft Launcher and [`Weft-Rust/weft-mods-index`](https://github.com/Weft-Rust/weft-mods-index). The launcher accepts exactly this format. A change that breaks it needs a new `schema` number and a new URL path (`/v2/`). Mod authors: the publishing guide is [AUTHORING.md](AUTHORING.md).
+
+The examples below are complete and valid; `src-tauri/src/mods/doc_tests.rs` checks them against the launcher's parser and the schemas.
+
+## Where it lives
+
+| File | URL |
+|---|---|
+| Index | `https://weft-rust.github.io/weft-mods-index/v1/index.json` |
+| Signature | `https://weft-rust.github.io/weft-mods-index/v1/index.json.minisig` |
+
+- The signature is a **prehashed** minisign signature of the exact bytes of `index.json` (`minisign -S -H`, the default of current minisign). Legacy signatures are refused.
+- The launcher embeds the public key (`keys/index.pub` in the index repo; `INDEX_PUBLIC_KEY` in `src-tauri/src/mods/index/signature.rs`).
+- An index whose signature doesn't verify is refused, and the launcher keeps its last verified copy.
+- The trusted comment carries `timestamp:<unix seconds>`, as `minisign -S` writes by default (`timestamp:1793819114 file:index.json`). The launcher reports it as `signedAt` ([how it is used](#freshness-and-cache)).
+- The index repository re-signs the index weekly, even when nothing changed, so it never goes [stale](#freshness-and-cache).
+
+### Key rotation
+
+The launcher trusts exactly one built-in key, for fetched and cached indexes alike, so there is no overlap period. Rotating it takes a launcher release and a coordinated switch of the index's signing key. An index signed with another key is refused like any bad signature.
+
+## `index.json`
+
+JSON Schemas: [`schema/index.schema.json`](schema/index.schema.json) and [`schema/mod.schema.json`](schema/mod.schema.json). Rules that compare fields with each other or with GitHub are only in this file.
+
+```json
+{
+  "schema": 1,
+  "generated": "2026-11-04T18:00:00Z",
+  "weft": [
+    { "tag": "v26.11.1", "commit": "ff9c7128511fc0dce7719b67c9a59274d70bdd5a", "abi": "f470b1cbb1f9ad91" }
+  ],
+  "mods": [
+    {
+      "id": "cogwork",
+      "name": "Cogwork",
+      "summary": "Gears, item tubes and engines.",
+      "authors": ["Zorro909"],
+      "license": "MPL-2.0",
+      "homepage": "https://github.com/Zorro909/weft-mods/tree/main/cogwork",
+      "icon": "https://raw.githubusercontent.com/Zorro909/weft-mods/main/cogwork/assets/textures/gui/icon.png",
+      "versions": [
+        {
+          "version": "0.2.0",
+          "channel": "release",
+          "tag": "cogwork-v0.2.0",
+          "published": "2026-11-04T12:00:00Z",
+          "source": { "repo": "Zorro909/weft-mods", "commit": "cceea7805df5902d62017d2008d1bb29ed84e152" },
+          "weft": { "tag": "v26.11.1", "commit": "ff9c7128511fc0dce7719b67c9a59274d70bdd5a", "abi": "f470b1cbb1f9ad91" },
+          "deps": [{ "id": "base" }],
+          "platforms": ["windows-x64", "linux-x64", "macos-arm64"],
+          "asset": {
+            "name": "cogwork.zip",
+            "url": "https://github.com/Zorro909/weft-mods/releases/download/cogwork-v0.2.0/cogwork.zip",
+            "size": 2642469,
+            "sha256": "989b2191c0ffee00989b2191c0ffee00989b2191c0ffee00989b2191c0ffee00"
+          },
+          "provenance": {
+            "kind": "github-attestation",
+            "repo": "Zorro909/weft-mods",
+            "workflow": ".github/workflows/release.yml",
+            "ref": "refs/heads/main",
+            "verified_at": "2026-11-04T18:00:00Z"
+          },
+          "reviewed": { "by": "Zorro909", "at": "2026-11-04" }
+        }
+      ]
+    }
+  ],
+  "revoked": [
+    { "sha256": "5f0569a6bea71b815f0569a6bea71b815f0569a6bea71b815f0569a6bea71b81", "reason": "Shipped a debug build that deletes saves", "at": "2026-11-05" }
+  ]
+}
+```
+
+### Fields
+
+"Default" is what the launcher uses when the field is missing; a field marked required has none. "Value" gives the accepted values and any field-specific handling. What happens to a value outside them is in [Rules the launcher enforces](#rules-the-launcher-enforces).
+
+| Field | Default | Value |
+|---|---|---|
+| `schema` | required | `1`. |
+| `generated` | required | RFC 3339 time the index was built. |
+| `weft[]` | `[]` | ABI hash per Weft release, so the launcher doesn't compute it: `tag`, `commit` (full hash) and `abi`, all required. |
+| `mods[]` | `[]` | The mods. |
+| `mods[].id` | required | `[a-z0-9_]{1,64}`, not `base`. Equal to the crate name and the zip stem. |
+| `mods[].name` | required | Display name. |
+| `mods[].summary` | `""` | One line. The launcher shows the first line, cut to 140 characters. |
+| `mods[].authors` | `[]` | Display names. |
+| `mods[].license` | `null` | License, for display. |
+| `mods[].homepage` | `null` | Absolute `https://` URL; anything else is dropped. |
+| `mods[].icon` | `null` | PNG on a GitHub host; see [Icons](#icons). |
+| `versions[]` | `[]` | Newest first (the launcher sorts again). A mod without a valid version is left out. |
+| `version` | required | Semver: `MAJOR.MINOR.PATCH`, optional `-prerelease` and `+build`. |
+| `channel` | required | `release`, `prerelease` or `experimental`. |
+| `tag` | required | The GitHub release tag of this build. |
+| `published` | `""` | RFC 3339 when not empty. |
+| `source` | required | `repo` (`owner/name`) and `commit` (full hash) the build was made from, both required. |
+| `weft` | required | `abi` (required), plus the Weft `tag` (default `null`) and `commit` (default `""`, else a full hash) it was built against. |
+| `deps[]` | `[]` | `{ "id": … }` of every mod it needs, each a valid mod id. `base` ships with Weft. |
+| `platforms[]` | `[]` | Which libraries the zip has ([Platforms](#platforms)). Unknown strings are ignored. |
+| `asset` | required | `name`, `url`, `size` and `sha256` of the zip, all required. |
+| `provenance` | `null` | The attestation the index CI checked. `kind` is required; `repo`, `workflow`, `ref` and `verified_at` default to `null`. See [Provenance](#provenance). |
+| `reviewed` | required in the index | `by` (not empty) and `at`: who reviewed exactly these bytes, and when. Never read from sources. |
+| `revoked[]` | `[]` | Builds that must never be used again. |
+| `revoked[].sha256` | required | The build's hash, in any case. |
+| `revoked[].reason` | none (`null`) | Why, for the player. Empty or not a string also means none; the launcher then says "No reason given". |
+| `revoked[].at` | `null` | When. Not a string also means `null`. |
+
+Unknown fields are ignored.
+
+### Rules the launcher enforces
+
+The whole index is refused, and the last verified copy kept, when `schema` isn't `1`, `generated` isn't RFC 3339, or `weft`, `mods` or `revoked` isn't a list.
+
+Otherwise a mod, version or `weft[]` entry is skipped on its own when it fails to parse, breaks a value in the [Fields](#fields) table (such as `id`, `version`, `published` or `deps[].id`), or breaks one of these rules:
+
+| Field | Form |
+|---|---|
+| Commits (`source.commit`, `weft.commit`, `weft[].commit`) | 40 lowercase hex characters, or 64 in a SHA-256 repository |
+| `asset.sha256` | 64 lowercase hex characters |
+| `weft.abi`, `weft[].abi` | 16 lowercase hex characters: the FNV-1a-64 hash of `crates/abi/src/lib.rs` at that commit |
+
+- `tag`, `weft.tag` and `weft[].tag` are 1–100 of `A–Z a–z 0–9 . - _`, and don't start with `.`.
+- `source.repo` is `owner/name`, each part 1–100 of `A–Z a–z 0–9 - _ .`, and neither `.` nor `..`.
+- `asset.name` is `<id>.zip`.
+- `asset.url` follows [the asset URL rule](#the-asset-url-rule).
+
+**Revocations fail closed.** A `revoked[]` entry is dropped only when its `sha256` can't be a SHA-256 at all (64 hex characters, any case, after trimming), and that is logged. Every other problem leaves it in force: the hash is lowercased and compared without case, and `reason` and `at` take their defaults. What the launcher then does with a revoked build: [PROPOSAL, Revocation](PROPOSAL.md#revocation).
+
+Not enforced: that `summary` is one short line, that `versions[]` is sorted, and that `published` is in the past.
+
+### Icons
+
+In the index and in `<id>.mod.json`, an `icon` must be an `https://` URL on `github.com`, `raw.githubusercontent.com`, `user-images.githubusercontent.com` or a `<name>.github.io` site, with no port or user name; any other is dropped. It must be a PNG of at most 512 KB, or it isn't shown. Redirects follow the [download rules](#downloads).
+
+## `<id>.mod.json`, for Unreviewed sources
+
+A GitHub repo the player adds as a source publishes `<id>.mod.json` next to `<id>.zip` in each release. It holds the mod-level fields plus one version's fields at the top level, with the same defaults; `schema` is required too:
+
+```json
+{
+  "schema": 1,
+  "id": "lanterns",
+  "name": "Lanterns",
+  "summary": "Hanging lanterns in six colours.",
+  "authors": ["Someone"],
+  "license": "MIT",
+  "homepage": "https://github.com/Someone/lanterns",
+  "icon": "https://raw.githubusercontent.com/Someone/lanterns/main/assets/textures/gui/icon.png",
+  "version": "1.2.0",
+  "channel": "release",
+  "tag": "lanterns-v1.2.0",
+  "published": "2026-11-03T09:30:00Z",
+  "source": { "repo": "Someone/lanterns", "commit": "0123456789abcdef0123456789abcdef01234567" },
+  "weft": { "tag": "v26.11.1", "commit": "ff9c7128511fc0dce7719b67c9a59274d70bdd5a", "abi": "f470b1cbb1f9ad91" },
+  "deps": [{ "id": "base" }],
+  "platforms": ["windows-x64", "linux-x64", "macos-arm64"],
+  "asset": {
+    "name": "lanterns.zip",
+    "url": "https://github.com/Someone/lanterns/releases/download/lanterns-v1.2.0/lanterns.zip",
+    "size": 1048576,
+    "sha256": "aa11bb22cc33dd44ee55ff66aa11bb22cc33dd44ee55ff66aa11bb22cc33dd44"
+  },
+  "provenance": null
+}
+```
+
+The launcher reads the repo's releases (drafts are ignored) and accepts a `<id>.mod.json` only when it agrees with GitHub's record of the same release (`sources.rs`, `accept`):
+
+1. `schema` is `1`.
+2. The release also has an asset `<id>.zip`, `id` equals its stem, and `id` is a valid mod id.
+3. `tag` equals the release's tag.
+4. `source.repo` equals the source repo (compared without case).
+5. `asset.name`, `asset.url` and `asset.size` equal the zip's name, `browser_download_url` and size.
+6. GitHub reports a `digest` for the zip, and `asset.sha256` equals it.
+7. Every [rule the launcher enforces](#rules-the-launcher-enforces).
+
+Then:
+
+- If GitHub marks the release a prerelease, a `channel` of `release` becomes `prerelease`.
+- `published` comes from GitHub when it has one.
+- `reviewed` is ignored: a source can't mark its own build Reviewed.
+- `provenance` is the publisher's claim (`buildRecord: "claimed"`), never a record.
+
+The launcher can't check `weft.abi`, `source.commit`, `deps` or `provenance` of a source; the UI shows them as claims. The game has the last word on the ABI when it loads the library.
+
+A release may carry several mods: each `<id>.mod.json` with its `<id>.zip` is read on its own. Releases are read newest first:
+
+- The mod-level fields (name, summary, icon …) come from the newest release that passes.
+- A version string or zip `sha256` that a newer release already published is skipped in older releases.
+
+A source mod is listed apart from an index mod with the same `id`. Dependencies resolve in the index first, then in the same source. A source build whose `sha256` is also in the index shows once, as Reviewed.
+
+Publishing steps, and why a source shows no mods: [AUTHORING.md](AUTHORING.md#when-a-source-shows-no-mods).
+
+## Provenance
+
+The launcher never verifies an attestation. The index CI runs `gh attestation verify` when it adds a version and records the result in `provenance`; the index signature makes that record the index's word. The launcher shows it as the index's record, and only when it is complete:
+
+| `buildRecord` | When | Shown as |
+|---|---|---|
+| `recorded` | In the signed index, `kind` is `github-attestation`, `repo` is `owner/name`, `workflow` is `.github/workflows/<name>.yml` (or `.yaml`), and `verified_at` is RFC 3339. `ref` is optional. | ✓, worded as the index's record |
+| `incomplete` | In the signed index, but any of the above is missing or malformed, or `kind` is another one. | ? (unknown): "an incomplete build record" |
+| `claimed` | From a source's `<id>.mod.json`, whatever it says. | ? (unknown): "the repo says" |
+| `none` | No `provenance`. | ? (unknown): "No build record" |
+
+An incomplete record doesn't drop the version: the review stands, and only the build row is unknown (`catalog::build_record`).
+
+## Launcher behaviour
+
+### Size limits
+
+| What | Limit |
+|---|---|
+| `index.json`, `index.json.minisig` | 8 MB each |
+| `<id>.mod.json` | 64 KB; a longer one is ignored |
+| Icon | 512 KB, PNG |
+| Mod zip | 512 MB, and at most `asset.size` + 1 KB |
+| Zip entries | 20,000 |
+| Zip unpacked | 1 GB |
+| Compression ratio | 200:1 for any entry over 1 MB |
+
+Before a zip is stored, the launcher inflates every entry once, without writing it to disk. It refuses the zip if an entry's real size or checksum differs from its header, if an entry won't inflate, or if it is encrypted.
+
+### Downloads
+
+- Redirects are followed only over `https`, to `github.com`, `githubusercontent.com`, `github.io` and their subdomains.
+- Every file is hashed when it enters the store and must equal `asset.sha256`. Its zip contents and its library for this system are checked then too, even when the store already has that hash.
+- A zip may hold only `<id>.dll`, `lib<id>.so`, `lib<id>.dylib` and files under `assets/`. Other folders, `..`, absolute paths, `\` in names and symbolic links are refused. The library for the player's system must be there.
+- A download checks [the asset URL rule](#the-asset-url-rule) again right before it starts.
+
+### Freshness and cache
+
+- **Rollback refusal.** An index's age is the pair (`generated`, signing time), compared by `generated` first; with equal `generated`, the later signing time is newer, and a signature without a time is older than one with it. A fetched index older than the newest pair ever accepted is refused with `IndexRollback`, and the launcher keeps its copy. That pair is kept in `cache/mod-index.state.json`, so deleting the cached index doesn't reset it. The same index fetched again is accepted.
+- **Dated in the future.** An index whose `generated` or signing time is more than a day ahead of the computer's clock is refused with `IndexInvalid`.
+- **Stale.** An index signed more than 30 days ago (by `generated` when there is no signing time) has freshness `stale`. It is still used; the launcher says revocations since then may be missing.
+- **Cache.** The launcher keeps the newest two verified generations and verifies the cached copy on every read; if the newest fails, the previous one is used. Offline, freshness is `cached` (or `stale`). The index is fetched only on a catalogue refresh, never by Play. If saving a fetched index fails, it is used for this session and reported as `cacheError`.
+
+### Duplicates
+
+The first entry wins. Two `mods[]` with the same `id` both stay listed, but lookups by id (dependencies, updates) use the first. Two versions with the same `asset.sha256` resolve to the first one. The index CI should refuse both.
+
+### Sources
+
+The newest 500 releases of a source are read. Each source's cached answer is checked again on every read. When GitHub can't be reached or refuses (rate limit, server error), the last good answer is shown with the error.
+
+### The asset URL rule
+
+The launcher parses `asset.url` and requires exactly:
+
+- scheme `https`, host `github.com`, no port, user, query or fragment;
+- the path segments `[owner, repo, "releases", "download", tag, "<id>.zip"]`, with `owner/repo` equal to `source.repo` without case, and `tag` equal to the version's `tag`;
+- the URL exactly as a URL parser would write it back: no `.` or `..` segments, and nothing it would rewrite;
+- no `\` and no percent-encoding anywhere.
+
+So `…/releases/download/%2e%2e/…`, `…/download/x/..` and `…\..\evil\…` are all refused.
+
+## Platforms
+
+| Platform | OS and architecture |
+|---|---|
+| `windows-x64` | Windows x86_64 |
+| `linux-x64` | Linux x86_64, glibc |
+| `macos-arm64` | macOS on Apple Silicon |
diff --git a/docs/mod-manager/PROPOSAL.md b/docs/mod-manager/PROPOSAL.md
new file mode 100644
index 0000000..ac06dc2
--- /dev/null
+++ b/docs/mod-manager/PROPOSAL.md
@@ -0,0 +1,272 @@
+# Mod manager design
+
+The launcher keeps a separate mod set for each installed Weft version. It installs mods from a
+signed index, from GitHub repos the player adds, and from local zips; it checks the set before Play
+and names the mod when the game fails to load one.
+
+Status: the launcher side is built. Engine-side changes are still needed; see
+[Remaining work](#5-remaining-work). The index contract is [INDEX_FORMAT.md](INDEX_FORMAT.md); the
+path for mod authors is [AUTHORING.md](AUTHORING.md).
+
+## 1. Engine constraints
+
+These facts explain the design. They are from `Weft-Rust/Weft` @ `7c69c9c`; paths are relative to
+that repo.
+
+- **A mod is native code.** It is a Rust `cdylib` exporting `weft_mod()`
+  (`crates/sdk/src/lib.rs`), shipped as one `<id>.zip` with `<id>.dll`, `lib<id>.so`,
+  `lib<id>.dylib` and `assets/`. The engine loads the library for its OS with `libloading`, so it
+  runs with the player's privileges. There is no sandbox and no permission system.
+- **Turned-off mods still run code.** The engine `dlopen`s every library and calls `weft_mod()`
+  before it applies `disabled_mods.txt` (`crates/engine/src/modloader.rs`).
+- **No manifest.** `id`, `version` and `deps` are compiled into the library; reading them means
+  loading it. The zip's stem must equal the crate name. A mod without a library is an error.
+- **Compatibility is exact.** `ABI_VERSION` is the FNV-1a-64 hash of the raw text of
+  `crates/abi/src/lib.rs`, and a mod loads only if its hash is equal. It changes in almost every
+  release.
+- **Failure is fatal.** An ABI mismatch, a missing symbol, a missing dependency or a panicking
+  `init` aborts startup with `exit(1)` and no dialog; the reason is only in `latest.log`. The ABI
+  check runs before the off filter, so one mismatched mod, even a turned-off one, blocks the
+  version.
+- **Search order.** For each id the first copy found wins: every `--mods <dir>`, then the player's
+  `<data>/mods` (shared by every version), then `<install>/run/mods` (shipped mods such as `base`).
+  There is no flag to skip the player's folder.
+- **No safe probe.** Unknown flags are passed to mods and start the game, so `weft --version`
+  can't be used to ask a build for its ABI.
+
+## 2. Design principles
+
+1. **Mod sets belong to a game version.** The ABI changes almost every release, so a shared mod
+   folder is a trap. Each installed version gets its own set, passed with `--mods`.
+2. **The launcher never writes into the player's Weft folder.** Mods live under the launcher's
+   data folder.
+3. **"Off" means not passed to the game.** The engine runs code even from turned-off mods, so the
+   launcher leaves an off mod out of the folder it hands over. It doesn't use `disabled_mods.txt`.
+4. **Don't start a launch that is known to fail.** Check the ABI and dependencies before Play. If
+   the game still dies during mod loading, name the mod.
+5. **Be honest about trust.** Show what was actually verified. Never show a permission list.
+   Always say that native mods can do anything.
+
+## 3. Architecture
+
+### On-disk layout
+
+Under the launcher's data folder (`src-tauri/src/mods/paths.rs`):
+
+```
+mods/
+  store/<sha256>.zip              content-addressed; hashed when added, and again whenever reused
+  sources.json                    the GitHub repos the player added, as GitHub spells them
+  sources.damaged-<secs>.json     a sources.json that couldn't be read, set aside rather than lost
+profiles/<weft-tag>/
+  mods/<id>.zip                   only the turned-on mods, each its own copy (never a hard link)
+  mods.lock.json                  every installed mod: id, version, sha256, origin, trust, enabled,
+                                  ABI, deps, and the revocation once one applied
+  removed.json                    the last removed mod, until the version's next change (Undo)
+cache/
+  mod-index/<n>/index.json        verified index generations, each with its index.json.minisig;
+  mod-index/current               `current` names the newest; the newest two are kept
+  mod-index.state.json            the newest (generated, signedAt) ever accepted, for rollback refusal
+  mod-sources/<owner__repo>.json  the last good answer of each source, with when it was fetched
+  mod-icons/<hash>.png            catalogue icons
+  abi.json                        ABI hash per Weft tag, kept forever since tags don't change
+downloads/mod-<sha256>-<unique>.part   a download in progress; never shared by two downloads
+```
+
+The index URL is built in (`index/fetch.rs`); `sources.json` holds only repos. A damaged
+`sources.json` is reported as `ModSourcesDamaged`, and adding a source starts a new list.
+
+Launch is `weft --mods <profiles/<tag>/mods>`. Turning a mod on or off copies its build into that
+folder or removes it. Deleting a version deletes its profile, and unused store entries are
+garbage-collected. Garbage collection never deletes an object an install has reserved or a removal
+can still undo, and deletes nothing if a lock file can't be read. Lock files are validated on read:
+an id or hash of the wrong form is an error, never a path.
+
+### Backend (`src-tauri/src/mods/`)
+
+| Part | Modules | Boundary |
+|---|---|---|
+| Rules | `plan/`, `profile.rs`, `catalog.rs`, `index/format.rs`, `diagnose.rs`, `version.rs` | Plain data in and out; no I/O. |
+| Store | `store.rs`, `paths.rs` | `store::admit` is the only way into the store: it hashes the file and checks its zip and platform, also when the store already has that hash. |
+| Fetching | `index/`, `sources.rs`, `abi.rs`, `install.rs` | Network and caches. `install.rs` downloads through the shared `download.rs`. |
+| Files | `archive.rs`, `inspect.rs` | Zip checks and local-file inspection. Never unpack to disk, never load a library. |
+| Operations | `service/`, `context.rs` | One operation per command; `Ctx` holds the folders, locks and running game. |
+| IPC | `commands.rs`, `error.rs` | Each command is one call into `service/`. Errors reach the page as an `ErrorCode`, never an English sentence. |
+
+Everything outside `service/` takes plain data, a `Paths` root or a `Ctx`, so it is tested without
+the app; `service_tests.rs` runs the operations against a local HTTP server. The IPC types are
+generated into `src/mods/bindings/`, and `src/mods/api.ts` calls commands only through them (the
+README says how to regenerate them).
+
+The catalogue merges the index and every source. Each part carries the ticket of the refresh that
+fetched it, so a slow refresh that finishes last can't replace newer answers; the page keeps the
+catalogue with the highest `revision`.
+
+### Changing a mod set safely
+
+- **One lock.** Every change to a profile or to the store's contents happens under the mods lock.
+  Downloads happen before it is taken; their store files are reserved so garbage collection leaves
+  them alone.
+- **Dependencies resolve through the whole graph.** An install, a copy and turning a mod on walk
+  every dependency, through new builds and installed mods alike. An installed dependency that fits
+  and isn't revoked is used, and turned on if it is off. `InstallPlan.enable` lists everything that
+  turns on.
+- **The reviewed plan is binding.** What the player approves is what gets committed. Install,
+  copy and file-install previews return a `planToken` covering the builds (hash and trust), what
+  ends up on, what is installed off or missing, and the version's ABI. The backend checks it before
+  downloading and again under the lock at commit. A changed plan fails with `ModChangedMeanwhile`,
+  writes nothing, and the page plans again. At commit the version must still be installed and not
+  running, and no build may be revoked; a file install re-checks revocation by the file's hash.
+- **Operations can be cancelled.** Installs, copies and restores carry an `operationId` that every
+  progress event repeats. Until the operation starts writing, cancelling aborts it with
+  `ModCancelled` and leaves nothing behind; after that, cancelling returns `false`.
+- **A new install never breaks Play.** A mod is installed on when it is new or was on, and nothing
+  it needs is missing at any depth (`InstallPlan.turnsOn`). Otherwise it and the dependencies it
+  brought are installed off (`ChangeResult.installedOff`). Copies follow the same rule per mod.
+  Updates keep a mod's on/off state. A mod already on can still block Play when something it needs
+  is turned off, removed or revoked; the report says which (`depsNotInstalled`, `blockingReasons`),
+  and Home and Mods offer the fix.
+- **Nothing changes under a running game.** While a version's game runs, its lock file and `mods/`
+  folder are not rewritten. Changes fail with `GameRunning`. A revocation that arrives is reported
+  (`ProfileReport.revocationsPending`) and applied when the game stops.
+- **Saving writes in a fixed order:** clear the old Undo, write the lock, write the removal's Undo
+  (a failure there only loses Undo), then reconcile the version's folder from the lock.
+- **Folders hold copies.** `reconcile` copies each turned-on build from the store (a reflink where
+  possible, never a hard link), so a write to one file can't reach the store or another version. On
+  every save and launch it hashes each file again and replaces any that changed: the folder is the
+  player's to touch, and size and time say nothing about the bytes.
+- **Remove can be undone.** `remove_mod` keeps the entry in `removed.json`, and its store file,
+  until the version's next change. `restore_mod` puts it back and turns on again what the removal
+  turned off.
+
+### Checking the zip
+
+Before a zip is stored, `archive.rs` checks its contents and limits and inflates every entry once
+without writing it to disk ([contents](INDEX_FORMAT.md#downloads),
+[limits](INDEX_FORMAT.md#size-limits)). The store names the file `<sha256>.zip`; the version's
+folder names it `<id>.zip`, as the engine requires. The launcher never unpacks a mod to run it, and
+never loads a library to read its metadata: that would run its code.
+
+### The pre-Play check
+
+- Every turned-on mod's ABI must equal the version's ABI. ABIs come from published metadata
+  (`weft.abi`), never the library, and a build fits every release with that ABI, tagged or not.
+  With the version's ABI unknown, `fitsVersion` is `null`, mods are "unchecked", and Play isn't
+  blocked for it.
+- Every dependency must be turned on, or be `base`.
+- If either fails, Play is blocked with the reason and a fix (turn off, find update).
+- It never touches the network: it uses the catalogue the page last loaded (or the cached one) and
+  the cached ABI.
+- It runs inside `launch_version`, which holds the mods lock until the game counts as running, so
+  no mod change lands in between.
+- It lists the player's own `<data>/mods` (path from the `game folder …` log line) and warns that
+  those load in every version and can't be checked. This is the only place the launcher reads the
+  game folder, and it only lists it.
+
+### The player's folder and precedence
+
+The engine loads the first copy of each id it finds: the launcher's `--mods` folder, then the
+player's `<data>/mods`, then the shipped mods. A file in the player's folder with the id of a mod
+in the set (`ProfileReport.shadowed`):
+
+- is ignored while the launcher's copy is on;
+- **loads instead** while the launcher's copy is off: a warning, since "Turn off" doesn't turn it
+  off;
+- **blocks Play** when the launcher's copy is revoked, since the pulled mod would load anyway
+  (reason `shadowedRevoked`), even with nothing on.
+
+Names compare exactly, as the engine compares them: `Cogwork.zip` is another id than `cogwork`. The
+launcher never deletes the player's file.
+
+### Diagnosing a failure after Play
+
+On `exit(1)`, `diagnose.rs` looks for the engine's mod-loading failures in the version's log. Only
+ERROR lines of target `weft` establish a failure; a mod's own lines (`[mod:x]`) can say anything.
+The one exception: when the engine reports an init panic without naming the mod, the mod's own
+panic line before it, else the nearest "loading mod" line, names it. The messages it matches are
+listed in `diagnose.rs`.
+
+Home shows "X stopped Weft from starting" with Turn off, Find update and Open log. A crash that
+names no mod offers turning off all the version's mods, with Undo; a crash of a file-installed mod
+offers picking another file.
+
+### Copying mods to a new version
+
+"Copy mods from…" (`preview_copy_mod_profile`, `copy_mod_profile`) resolves each mod of another
+version to the build for this version's ABI, lists the ones with no build yet, and merges into a
+set that already has mods.
+
+## 4. Trust and revocation
+
+The launcher can prove where a file came from and that it hasn't changed. It cannot prove that the
+file is harmless: every tier runs native code with the player's privileges, and the UI says so on
+every install.
+
+### Tiers
+
+Each build has exactly one tier.
+
+| Badge | Meaning | What was checked |
+|---|---|---|
+| **Reviewed** (green) | In the signed index, with a recorded review (`reviewed.by`) | Index signature, SHA-256 equals the index pin, zip structure. A compromised mod repo or GitHub account can't change pinned bytes without the index key. |
+| **Unreviewed** (grey) | From a GitHub repo the player added as a source | The `<id>.mod.json` agrees with GitHub's record of the release, SHA-256 equals GitHub's `digest`, zip structure. |
+| **Unverified** (red) | A local file that isn't in the catalogue | Zip structure only. The player types the mod id to confirm. |
+
+GitHub serves both a source's file and its digest, so their agreement only proves the download
+wasn't corrupted.
+
+A source build whose hash is in the index is Reviewed. A local file whose hash is in the catalogue
+installs with that build's tier. An index version without a `reviewed` record is dropped.
+
+**Provenance:** the launcher doesn't verify attestations. For index builds it shows the result of
+the index CI's `gh attestation verify` as the index's record; for source builds it shows
+`provenance` as the publisher's claim. See [INDEX_FORMAT.md](INDEX_FORMAT.md#provenance).
+
+The UI has **no permission list**: native code has no permissions to list.
+
+### Revocation
+
+**Revoked** is a status, not a tier. A build of any tier whose `sha256` the index lists in
+`revoked` is never installed and can't be turned back on, not even by turning on something that
+needs it. The UI shows a Revoked badge and the reason.
+
+- The launcher learns of a revocation whenever it reads the index: from its cache, or from the
+  network when the catalogue is refreshed.
+- An installed revoked build is turned off the next time its version's mods are read
+  (`get_mod_profile`) or before Play, whichever comes first, unless that version's game is running.
+  The revocation is then recorded in `mods.lock.json` and stays even if the index can't be loaded
+  later, until the build is replaced or removed.
+- An install already downloading when a revocation arrives fails at commit with
+  `ModChangedMeanwhile`.
+
+**Age.** The launcher reports when the index was signed (`signedAt`). A stale index is still used,
+with a note that revocations since then may be missing; an index older than one already accepted is
+refused ([Freshness and cache](INDEX_FORMAT.md#freshness-and-cache)).
+
+## 5. Remaining work
+
+**Engine** (`Weft-Rust/Weft`), by value to the launcher:
+
+1. Don't load turned-off mods, and make mod failures non-fatal: check the off list before `dlopen`,
+   then skip and report instead of `Err`.
+2. `--no-user-mods` (only `--mods` folders count) and `--disabled-mods <file>`. These end
+   shadowing and give the launcher the whole mod set.
+3. Publish `weft-abi.txt` (or `release.json`) as a release asset, and/or `weft --info --json` that
+   exits before any window or mod loading. `abi.rs` would read it instead of hashing the source.
+4. `weft-mod.toml` inside the zip, written by `--pack-mod`: id, version, ABI, deps and each
+   library's SHA-256, readable without loading code.
+5. A machine-readable load report (`logs/mods.json`) and a separate exit code for a mod load
+   failure.
+6. `--mod-hashes <file>`: the engine hashes the copy it loads, closing the gap between the
+   launcher's check and the load.
+7. A less fragile ABI hash (declarations only, or a hand-bumped epoch), and an unpack cache keyed on
+   content hash.
+
+**weft-mods** (`Zorro909/weft-mods`): publish `<id>.mod.json` next to each `<id>.zip`
+([format](INDEX_FORMAT.md#idmodjson-for-unreviewed-sources)); attest builds with
+`actions/attest-build-provenance`; add a LICENSE, `license` fields and icons.
+
+**Later:** data-only mods and a WASM tier (the only options that limit what a mod can do), and
+server mod-set sync. All need engine design work.
+
+**Open questions:** who else reviews for the index, and moving its signing key offline.
diff --git a/docs/mod-manager/schema/index.schema.json b/docs/mod-manager/schema/index.schema.json
new file mode 100644
index 0000000..7ce8966
--- /dev/null
+++ b/docs/mod-manager/schema/index.schema.json
@@ -0,0 +1,164 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "index.schema.json",
+  "title": "Weft mod index, schema 1",
+  "description": "Weft mod index, schema 1. Cross-field rules and how the launcher handles a bad entry are in INDEX_FORMAT.md.",
+  "type": "object",
+  "required": ["schema", "generated"],
+  "properties": {
+    "schema": { "const": 1 },
+    "generated": { "$ref": "#/$defs/time" },
+    "weft": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["tag", "commit", "abi"],
+        "properties": {
+          "tag": { "$ref": "#/$defs/tag" },
+          "commit": { "$ref": "#/$defs/commit" },
+          "abi": { "$ref": "#/$defs/abi" }
+        }
+      }
+    },
+    "mods": {
+      "type": "array",
+      "items": {
+        "allOf": [
+          { "$ref": "#/$defs/modFields" },
+          {
+            "type": "object",
+            "properties": {
+              "versions": { "type": "array", "items": { "$ref": "#/$defs/reviewedBuild" } }
+            }
+          }
+        ]
+      }
+    },
+    "revoked": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["sha256"],
+        "properties": {
+          "sha256": { "description": "Any case; surrounding spaces are trimmed. An entry is dropped only when this can't be a SHA-256.", "type": "string", "pattern": "^\\s*[0-9A-Fa-f]{64}\\s*$" },
+          "reason": { "type": ["string", "null"] },
+          "at": { "type": ["string", "null"] }
+        }
+      }
+    }
+  },
+  "$defs": {
+    "time": { "description": "RFC 3339.", "type": "string", "format": "date-time", "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})$" },
+    "modId": { "description": "Equal to the crate name and the zip stem; base ships with Weft.", "type": "string", "pattern": "^[a-z0-9_]{1,64}$", "not": { "const": "base" } },
+    "depId": { "type": "string", "pattern": "^[a-z0-9_]{1,64}$" },
+    "tag": { "type": "string", "pattern": "^[A-Za-z0-9_-][A-Za-z0-9._-]{0,99}$" },
+    "repo": { "description": "owner/name; neither part is . or ..", "type": "string", "pattern": "^[A-Za-z0-9._-]{1,100}/[A-Za-z0-9._-]{1,100}$" },
+    "commit": { "description": "A full commit hash: SHA-1, or SHA-256 in a SHA-256 repository.", "type": "string", "pattern": "^([0-9a-f]{40}|[0-9a-f]{64})$" },
+    "abi": { "description": "FNV-1a-64 of crates/abi/src/lib.rs at that commit.", "type": "string", "pattern": "^[0-9a-f]{16}$" },
+    "sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "semver": { "type": "string", "pattern": "^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(-[0-9A-Za-z-]+(\\.[0-9A-Za-z-]+)*)?(\\+[0-9A-Za-z-]+(\\.[0-9A-Za-z-]+)*)?$" },
+    "modFields": {
+      "type": "object",
+      "required": ["id", "name"],
+      "properties": {
+        "id": { "$ref": "#/$defs/modId" },
+        "name": { "type": "string" },
+        "summary": { "description": "One line; the launcher shows the first, cut to 140 characters.", "type": "string" },
+        "authors": { "type": "array", "items": { "type": "string" } },
+        "license": { "type": ["string", "null"] },
+        "homepage": { "description": "Dropped unless it is https.", "type": ["string", "null"], "pattern": "^https://" },
+        "icon": {
+          "description": "A PNG of at most 512 KB on one of GitHub's hosts, with no port or user name; dropped otherwise.",
+          "type": ["string", "null"],
+          "pattern": "^https://(github\\.com|raw\\.githubusercontent\\.com|user-images\\.githubusercontent\\.com|[A-Za-z0-9-]+\\.github\\.io)/"
+        }
+      }
+    },
+    "build": {
+      "type": "object",
+      "required": ["version", "channel", "tag", "source", "weft", "asset"],
+      "properties": {
+        "version": { "$ref": "#/$defs/semver" },
+        "channel": { "enum": ["release", "prerelease", "experimental"] },
+        "tag": { "$ref": "#/$defs/tag" },
+        "published": { "description": "RFC 3339, or empty.", "type": "string" },
+        "source": {
+          "type": "object",
+          "required": ["repo", "commit"],
+          "properties": { "repo": { "$ref": "#/$defs/repo" }, "commit": { "$ref": "#/$defs/commit" } }
+        },
+        "weft": {
+          "type": "object",
+          "required": ["abi"],
+          "properties": {
+            "abi": { "$ref": "#/$defs/abi" },
+            "tag": { "anyOf": [{ "$ref": "#/$defs/tag" }, { "type": "null" }] },
+            "commit": { "description": "A full hash, or empty.", "type": "string" }
+          }
+        },
+        "deps": {
+          "type": "array",
+          "items": { "type": "object", "required": ["id"], "properties": { "id": { "$ref": "#/$defs/depId" } } }
+        },
+        "platforms": { "description": "Unknown platforms are ignored.", "type": "array", "items": { "type": "string" } },
+        "asset": {
+          "type": "object",
+          "required": ["name", "url", "size", "sha256"],
+          "properties": {
+            "name": { "description": "<id>.zip", "type": "string" },
+            "url": { "description": "https://github.com/<source.repo>/releases/download/<tag>/<id>.zip", "type": "string", "pattern": "^https://github\\.com/" },
+            "size": { "type": "integer", "minimum": 0 },
+            "sha256": { "$ref": "#/$defs/sha256" }
+          }
+        },
+        "provenance": {
+          "description": "How the build was made: the signed index's record, or a source's claim. The launcher doesn't verify attestations. See INDEX_FORMAT.md, Provenance.",
+          "anyOf": [
+            { "type": "null" },
+            {
+              "description": "A complete GitHub attestation record.",
+              "type": "object",
+              "required": ["kind", "repo", "workflow", "verified_at"],
+              "properties": {
+                "kind": { "const": "github-attestation" },
+                "repo": { "$ref": "#/$defs/repo" },
+                "workflow": { "description": ".github/workflows/<name>.yml or .yaml", "type": "string", "pattern": "^\\.github/workflows/[A-Za-z0-9._-]+\\.ya?ml$" },
+                "ref": { "type": ["string", "null"] },
+                "verified_at": { "description": "When the index's CI checked the attestation.", "type": "string", "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(\\.\\d+)?(Z|[+-]\\d{2}:\\d{2})$" }
+              }
+            },
+            {
+              "description": "Another kind or an incomplete record, shown as unknown.",
+              "type": "object",
+              "required": ["kind"],
+              "properties": {
+                "kind": { "type": "string" },
+                "repo": { "type": ["string", "null"] },
+                "workflow": { "type": ["string", "null"] },
+                "ref": { "type": ["string", "null"] },
+                "verified_at": { "type": ["string", "null"] }
+              }
+            }
+          ]
+        }
+      }
+    },
+    "reviewedBuild": {
+      "allOf": [
+        { "$ref": "#/$defs/build" },
+        {
+          "type": "object",
+          "required": ["reviewed"],
+          "properties": {
+            "reviewed": {
+              "description": "Who reviewed exactly these bytes, and when. Required in the index; never read from a source.",
+              "type": "object",
+              "required": ["by", "at"],
+              "properties": { "by": { "type": "string", "minLength": 1 }, "at": { "type": "string" } }
+            }
+          }
+        }
+      ]
+    }
+  }
+}
diff --git a/docs/mod-manager/schema/mod.schema.json b/docs/mod-manager/schema/mod.schema.json
new file mode 100644
index 0000000..dcf46b8
--- /dev/null
+++ b/docs/mod-manager/schema/mod.schema.json
@@ -0,0 +1,11 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "mod.schema.json",
+  "title": "<id>.mod.json for an Unreviewed source, schema 1",
+  "description": "One build of one mod, published next to <id>.zip. It must also match GitHub's record of the release; see INDEX_FORMAT.md. reviewed is never read from a source.",
+  "allOf": [
+    { "$ref": "index.schema.json#/$defs/modFields" },
+    { "$ref": "index.schema.json#/$defs/build" },
+    { "type": "object", "required": ["schema"], "properties": { "schema": { "const": 1 } } }
+  ]
+}
diff --git a/e2e/flows.spec.ts b/e2e/flows.spec.ts
new file mode 100644
index 0000000..d03e831
--- /dev/null
+++ b/e2e/flows.spec.ts
@@ -0,0 +1,1402 @@
+// The flows the mod manager's safety depends on, and keyboard use, against the mock backend.
+import { expect, test, type Page } from "@playwright/test";
+import trace from "../src/dev/fixtures/trace.json" with { type: "json" };
+import { LOCALES, MODS_TAB, VERSIONS_TAB, browse, confirmRemove, cutButtons, expectWhole, focused, fullRows, goToTab, lowContrast, open, settled, spoken, tops } from "./helpers";
+
+const dialog = "[role=dialog]";
+
+/** `file:stage:percent`, keeping the first and last percent of each run (see the fixture). */
+function collapseTrace(events: { index: number; stage: string; percent: number }[]): string[] {
+  const runs: { index: number; stage: string; first: number; last: number }[] = [];
+  for (const e of events) {
+    const r = runs[runs.length - 1];
+    if (r && r.index === e.index && r.stage === e.stage) r.last = e.percent;
+    else runs.push({ index: e.index, stage: e.stage, first: e.percent, last: e.percent });
+  }
+  return runs.flatMap((r) => [`${r.index}:${r.stage}:${r.first}`, ...(r.last !== r.first ? [`${r.index}:${r.stage}:${r.last}`] : [])]);
+}
+
+test.describe("launch safety", () => {
+  test("blocked mods disable Play and one click fixes it", async ({ page }) => {
+    await open(page, "scenario=mods");
+    await expect(page.locator(".btn-play")).toBeDisabled();
+    await expect(page.locator(".hero-version-badge")).toContainText("MODS NEED A FIX");
+    await page.locator(".blocker button", { hasText: "Turn off" }).first().click();
+    await expect(page.locator(".btn-play")).toBeEnabled();
+  });
+
+  test("a crash notice names the mod and stays until it is fixed", async ({ page }) => {
+    await open(page, "scenario=crash");
+    await page.locator(".btn-play").click();
+    const notice = page.locator(".mod-failure");
+    await expect(notice).toBeVisible({ timeout: 10_000 });
+    await expect(notice.locator(".mod-failure-title")).toHaveText("Structures stopped Weft from starting: its library didn't load.");
+    // Turning it off surely helps, so it comes first; the update is offered as a try, since
+    // nothing says it fixes a library that didn't load. The log's line is folded behind Details.
+    const fixes = notice.locator(".mod-failure-actions > button");
+    await expect(fixes.first()).toHaveText("Turn off Structures");
+    await expect(notice.locator("button", { hasText: "Try 0.1.3…" })).toHaveCount(1);
+    await expect(notice.locator(".error-details summary")).toHaveText("Log line");
+    await expect(notice.locator(".error-details code")).toBeHidden();
+    await goToTab(page, MODS_TAB);
+    await expect(page.locator(".mod-failure")).toHaveCount(1);
+    await page.locator(".mod-failure button", { hasText: "Turn off" }).click();
+    await expect(page.locator(".mod-failure")).toHaveCount(0);
+  });
+
+  const CRASHES = [
+    // My Tweak is a file from the player's computer: another file is its fix, and leads.
+    { kind: "wrongName", title: "My Tweak stopped Weft from starting: its file has the wrong name.", fix: "Replace My Tweak from file…" },
+    { kind: "notAMod", title: "oldtweak stopped Weft from starting: it isn't a Weft mod.", fix: "Open mods folder" },
+    { kind: "initPanicked", title: "Cogwork crashed while Weft was starting.", fix: "Turn off Cogwork" },
+    { kind: "exit", title: "Game closed with error (code 1)", fix: "Turn off all mods for v26.11.1" },
+  ];
+  for (const c of CRASHES) {
+    test(`a ${c.kind} crash says what happened, with the log a click away`, async ({ page }) => {
+      await open(page, `scenario=crash&crash=${c.kind}`);
+      await page.locator(".btn-play").click();
+      const notice = page.locator(".mod-failure");
+      await expect(notice).toBeVisible({ timeout: 10_000 });
+      await expect(notice.locator(".mod-failure-title")).toHaveText(c.title);
+      await expect(notice.locator("button", { hasText: "Open log" })).toHaveCount(1);
+      await expect(notice.locator("button", { hasText: "Dismiss" })).toHaveCount(1);
+      await expect(notice.locator("button").first()).toHaveText(c.fix);
+      await expectWhole(page, `${c.kind} crash`);
+      // The game folder's button stays in view under the notice, at 565px.
+      const folder = await page.locator(".btn-open-folder").boundingBox();
+      expect(folder!.y + folder!.height, "Open folder in view").toBeLessThanOrEqual(565);
+    });
+  }
+
+  test("a mod whose stored copy is gone offers installing it again, and then Play starts", async ({ page }) => {
+    await open(page, "scenario=crash&crash=&prelaunch=storemissing");
+    await settled(page);
+    await page.locator(".btn-play").click();
+    const refusal = page.locator(".launch-error");
+    await expect(refusal).toContainText("The launcher's stored copy of structures is gone");
+    const again = refusal.locator("button[data-fix=reinstall]");
+    await expect(again).toHaveText("Install Structures again…");
+    await again.click();
+    const d = page.locator(dialog);
+    await expect(d.locator(".dialog-title")).toContainText("Structures");
+    await d.locator(".dialog-actions .btn-primary").click();
+    await expect(d).toHaveCount(0, { timeout: 15_000 });
+    await page.locator(".btn-play").click();
+    await expect(page.locator(".launch-error")).toHaveCount(0);
+    // Started: the badge says the version is playing.
+    await expect(page.locator(".home-page")).toContainText("PLAYING", { timeout: 10_000 });
+  });
+
+  test("a crash of a mod from a file offers another file, in the From file dialog", async ({ page }) => {
+    await open(page, "scenario=crash&crash=wrongVersion");
+    await page.locator(".btn-play").click();
+    const notice = page.locator(".mod-failure");
+    const replace = notice.locator("button[data-fix=replaceFile]");
+    await expect(replace).toHaveText("Replace My Tweak from file…", { timeout: 10_000 });
+    await expect(replace).toHaveClass(/btn-primary/);
+    await expect(notice.locator("button").first()).toHaveText("Replace My Tweak from file…");
+    // The log and Dismiss come after the fixes, apart, as links.
+    await expect(notice.locator(".mod-failure-quiet .link-btn")).toHaveCount(2);
+    await replace.click();
+    const d = page.locator(dialog);
+    await expect(d).toBeVisible();
+    await expect(d).toContainText("mytweak.zip");
+    await page.keyboard.press("Escape");
+    await expect(d).toHaveCount(0);
+  });
+
+  test("a crash that names no mod offers trying without mods, with Undo", async ({ page }) => {
+    await open(page, "scenario=crash&crash=exit");
+    await page.locator(".btn-play").click();
+    const notice = page.locator(".mod-failure");
+    await expect(notice.getByTestId("crash-unnamed")).toHaveText("The log names no mod. If it happens again, try without mods.", { timeout: 10_000 });
+    await notice.locator("button", { hasText: "Turn off all mods for v26.11.1" }).click();
+    await expect(notice.getByTestId("crash-unnamed")).toHaveText(/^Turned off \d+ mods for v26\.11\.1\. Press Play to try without them\.$/);
+    await expect(spoken(page)).toContainText("Press Play to try without them.");
+    await expect(page.locator(".mods-line")).toContainText("No mods");
+    await expect(page.locator(".btn-play")).toBeEnabled();
+    // Undo turns the same mods back on.
+    await notice.locator("button", { hasText: "Undo" }).click();
+    await expect(notice.getByTestId("crash-unnamed")).toHaveText("The log names no mod. If it happens again, try without mods.");
+    await goToTab(page, MODS_TAB);
+    const on = await page.locator(".mod-row .toggle[aria-checked=true]").count();
+    expect(on).toBeGreaterThan(0);
+  });
+
+  test("a crash notice for a mod with a copy in the player's folder stays until that copy goes", async ({ page }) => {
+    await open(page, "scenario=crash&shadow=structures");
+    await page.locator(".btn-play").click();
+    const notice = page.locator(".mod-failure");
+    await expect(notice).toBeVisible({ timeout: 10_000 });
+    await expect(notice.getByTestId("crash-shadow")).toContainText("structures-old.zip");
+    // Turning off the launcher's copy doesn't fix it: the player's own copy loads instead.
+    await notice.locator("button", { hasText: "Turn off" }).click();
+    await expect(notice).toHaveCount(1);
+    await expect(notice.getByTestId("crash-shadow")).toContainText("still has structures-old.zip");
+    // The player opens their folder and deletes it; back in the launcher, the notice goes.
+    await notice.locator("button", { hasText: "Open mods folder" }).click();
+    await page.evaluate(() => (window as unknown as { mockPlayer: { deleteFile(f: string): void } }).mockPlayer.deleteFile("structures-old.zip"));
+    await page.evaluate(() => window.dispatchEvent(new Event("focus")));
+    await expect(notice).toHaveCount(0);
+  });
+
+  test("a missing-dependency crash names the dependency and turns it on", async ({ page }) => {
+    await open(page, "scenario=crash&crash=missingDep");
+    await page.locator(".btn-play").click();
+    const notice = page.locator(".mod-failure");
+    await expect(notice.locator(".mod-failure-title")).toHaveText("My Tweak stopped Weft from starting: it needs Cogwork.", { timeout: 10_000 });
+    await expect(notice.locator("button", { hasText: "Update" })).toHaveCount(0);
+    await notice.locator("button", { hasText: "Turn on Cogwork" }).click();
+    // Fixed, so the notice goes: on Home and on Mods.
+    await expect(page.locator(".mod-failure")).toHaveCount(0);
+    await goToTab(page, MODS_TAB);
+    await expect(page.locator(".mod-row", { hasText: "Cogwork" }).locator(".toggle")).toHaveAttribute("aria-checked", "true");
+    await expect(page.locator(".mod-failure")).toHaveCount(0);
+  });
+
+  test("Home shows a blocker the backend found at Play, with its fixes", async ({ page }) => {
+    await open(page, "scenario=lateblock");
+    await expect(page.locator(".blocker")).toHaveCount(0);
+    await page.locator(".btn-play").click();
+    const hearth = page.locator(".blocker", { hasText: "Hearth" });
+    await expect(hearth).toContainText("Hearth stops Play: it needs Cogwork, which was pulled from the index.");
+    // It appeared just now, so it is said at once.
+    await expect(page.locator(".blockers [role=alert]")).toContainText("Hearth");
+    await expect(page.locator(".btn-play")).toBeDisabled();
+    // The panel says it; no second, rawer copy of the error.
+    await expect(page.locator(".hero > .launch-error[role=alert]")).toHaveCount(0);
+    await hearth.locator("button", { hasText: "Turn off Hearth" }).click();
+    await expect(page.locator(".btn-play")).toBeEnabled();
+    // Nothing of the refused start is left once it is fixed.
+    await expect(page.locator(".blocker")).toHaveCount(0);
+    await expect(page.locator(".launch-error")).toHaveCount(0);
+  });
+
+  test("Versions shows a blocker the backend found at Play, with its fixes, and Home agrees", async ({ page }) => {
+    await open(page, "scenario=lateblock&slow=1");
+    await goToTab(page, VERSIONS_TAB);
+    const entry = page.locator(".version-entry", { hasText: "v26.11.1" });
+    const play = entry.locator(".play-btn");
+    await expect(play).toBeEnabled();
+    await play.click();
+    // While the backend checks the set, the start is pending: said, and not sent twice.
+    await expect(play).toHaveAttribute("aria-label", "Starting...");
+    await expect(play).toBeDisabled();
+    const hearth = entry.locator(".version-blockers .blocker", { hasText: "Hearth" });
+    await expect(hearth).toContainText("Hearth stops Play: it needs Cogwork, which was pulled from the index.");
+    await expect(play).toBeDisabled();
+    await expect(play).toHaveAttribute("aria-label", "Play");
+    // Said by the panel with its fixes; no rawer copy of the refusal beside it.
+    await expect(entry.locator(".launch-error")).toHaveCount(0);
+    await expectWhole(page, "Versions after a refused start");
+    await page.screenshot({ path: test.info().outputPath("versions-refused.png") });
+    // Home read the same set again: it doesn't say READY, and it offers the same fix.
+    await goToTab(page, 0);
+    await expect(page.locator(".hero-version-badge")).toContainText("MODS NEED A FIX");
+    await expect(page.locator(".btn-play")).toBeDisabled();
+    await goToTab(page, VERSIONS_TAB);
+    // Back on Versions, the row says mods block it and where to fix them.
+    await expect(entry.locator(".version-note.bad")).toBeVisible();
+    await expect(play).toBeDisabled();
+  });
+
+  test("a fix applied on Versions clears the refusal there", async ({ page }) => {
+    await open(page, "scenario=lateblock");
+    await goToTab(page, VERSIONS_TAB);
+    const entry = page.locator(".version-entry", { hasText: "v26.11.1" });
+    await entry.locator(".play-btn").click();
+    const hearth = entry.locator(".version-blockers .blocker", { hasText: "Hearth" });
+    await hearth.locator("button", { hasText: "Turn off Hearth" }).click();
+    await expect(entry.locator(".play-btn")).toBeEnabled();
+    await expect(entry.locator(".blocker")).toHaveCount(0);
+    await expect(entry.locator(".launch-error")).toHaveCount(0);
+    await expect(entry.locator(".version-note")).toHaveCount(0);
+  });
+
+  test("a crash after a start from Versions shows its diagnosis and fixes there", async ({ page }) => {
+    await open(page, "scenario=crash");
+    await goToTab(page, VERSIONS_TAB);
+    const entry = page.locator(".version-entry", { hasText: "v26.11.1" });
+    await entry.locator(".play-btn").click();
+    const notice = entry.locator(".version-crash .mod-failure");
+    await expect(notice.locator(".mod-failure-title")).toHaveText("Structures stopped Weft from starting: its library didn't load.", { timeout: 10_000 });
+    await expect(notice.locator("button", { hasText: "Open log" })).toHaveCount(1);
+    await expectWhole(page, "Versions after a crash");
+    await notice.locator("button", { hasText: "Turn off Structures" }).click();
+    await expect(page.locator(".mod-failure")).toHaveCount(0);
+  });
+
+  test("deleting a version takes a deliberate second press, like removing a mod", async ({ page }) => {
+    await open(page, "scenario=mods");
+    await goToTab(page, VERSIONS_TAB);
+    const entry = page.locator(".version-entry", { hasText: "v26.10.4" });
+    const del = entry.locator(".delete-btn");
+    // A double-click asks, and says why it didn't delete.
+    await del.dblclick();
+    await expect(del).toHaveClass(/confirming/);
+    await expect(spoken(page)).toContainText("A double-click doesn't delete v26.10.4");
+    // No timer takes the question back while it is being read.
+    await page.waitForTimeout(4500);
+    await expect(del).toHaveClass(/confirming/);
+    // Escape does, and says so.
+    await del.press("Escape");
+    await expect(del).not.toHaveClass(/confirming/);
+    await expect(spoken(page)).toContainText("v26.10.4 stays installed.");
+    // By keyboard: Enter asks, Enter again deletes, with no dead time between.
+    await del.focus();
+    await page.keyboard.press("Enter");
+    await expect(del).toHaveClass(/confirming/);
+    await page.keyboard.press("Enter");
+    await expect(page.locator(".version-entry", { hasText: "v26.10.4" }).locator(".play-btn")).toHaveCount(0);
+  });
+
+  test("a refused start stays on screen, with a way to check again, when the set can't be read again", async ({ page }) => {
+    await open(page, "scenario=lateblock&profile=failafterplay");
+    await expect(page.locator(".hero-version-badge")).toContainText("READY");
+    // The start-up refresh reads every set again when it ends: not in the middle of this.
+    await settled(page);
+    await page.locator(".btn-play").click();
+    // Play was refused for mods, and reading them again failed: the refusal says so, never
+    // silently gone, and Play isn't offered as if all were well.
+    const refusal = page.locator(".refused-unread");
+    await expect(refusal).toContainText("Weft didn't start because of its mods, and they couldn't be read again to say which");
+    await expect(refusal.locator(".error-details summary")).toHaveText("Details");
+    await expect(page.locator(".blocker")).toHaveCount(0);
+    // Check again: the read works this time, and the panel with the fixes takes over.
+    await refusal.locator("button", { hasText: "Check mods again" }).click();
+    await expect(page.locator(".blocker", { hasText: "Hearth" })).toHaveCount(1);
+    await expect(page.locator(".refused-unread")).toHaveCount(0);
+    await expect(page.locator(".btn-play")).toBeDisabled();
+  });
+
+  test("turning on a mod that would stop Play asks first, with the reason", async ({ page }) => {
+    await open(page, "scenario=chain");
+    await goToTab(page, MODS_TAB);
+    const row = page.locator(".mod-row[data-mod=railways]");
+    const toggle = row.locator(".toggle");
+    await expect(toggle).toHaveAttribute("aria-checked", "false");
+    await toggle.click();
+    const ask = row.locator(".mod-ask");
+    await expect(ask).toContainText("Turn on Railways? Play stops until this is fixed:");
+    await expect(ask).toContainText("Railways stops Play: it needs Signals, which has no build for v26.11.1 yet.");
+    await expect(spoken(page)).toContainText("Turn on Railways?");
+    // The safe choice has focus; Escape keeps it off and gives focus back to the switch.
+    await expect.poll(async () => (await focused(page)).text).toBe("Keep it off");
+    await page.keyboard.press("Escape");
+    await expect(ask).toHaveCount(0);
+    await expect(toggle).toBeFocused();
+    await expect(toggle).toHaveAttribute("aria-checked", "false");
+    await expectWhole(page, "a row asking");
+    // Asked again, and turned on anyway: then Play is off, and the banner says why.
+    await toggle.click();
+    await ask.locator("button", { hasText: "Turn on anyway" }).click();
+    await expect(toggle).toHaveAttribute("aria-checked", "true");
+    await expect(page.locator(".blockers.in-banner")).toContainText("Railways");
+  });
+
+  test("turning on a mod whose needs are all installed doesn't ask", async ({ page }) => {
+    await open(page, "scenario=chain");
+    await goToTab(page, MODS_TAB);
+    // Hearth needs Cogwork, installed and off: the two turn on together, and Play keeps working.
+    const toggle = page.locator(".mod-row[data-mod=hearth] .toggle");
+    await toggle.click();
+    await expect(toggle).toHaveAttribute("aria-checked", "true");
+    await expect(page.locator(".mod-row[data-mod=cogwork] .toggle")).toHaveAttribute("aria-checked", "true");
+    await expect(page.locator(".mod-ask")).toHaveCount(0);
+  });
+
+  test("Home says it is checking mods, or that it couldn't, never ready before it knows", async ({ page }) => {
+    await open(page, "scenario=mods&profile=fail");
+    await expect(page.locator(".hero-version-badge")).toContainText("MODS NOT CHECKED");
+    await expect(page.locator(".hero-version-badge")).not.toContainText("READY");
+    const failed = page.locator(".launch-error", { hasText: "Couldn't read the mods for v26.11.1" });
+    await expect(failed).toBeVisible();
+    await expect(failed.locator("button")).toHaveText("Retry loading mods");
+  });
+
+  test("turning off a mod with a copy in the player's own folder says that copy loads", async ({ page }) => {
+    await open(page, "scenario=mods&shadow=structures");
+    await goToTab(page, MODS_TAB);
+    await page.locator(".mod-row[data-mod=structures] .toggle").click();
+    const notice = page.locator(".banner", { hasText: "Turned off Structures." });
+    await expect(notice).toContainText("Your own mods folder has a copy of Structures (structures-old.zip), so the game loads that one instead.");
+    await expect(spoken(page)).toContainText("structures-old.zip");
+    await expect(page.locator(".mod-row[data-mod=structures]")).toHaveAttribute("data-shadowed", "true");
+  });
+
+  test("a revoked mod copied in the player's own folder blocks until that file goes", async ({ page }) => {
+    await open(page, "scenario=shadowed");
+    await expect(page.locator(".btn-play")).toBeDisabled();
+    await goToTab(page, MODS_TAB);
+    const blocker = page.locator(".blockers.in-banner .blocker", { hasText: "cogwork-old.zip" });
+    await blocker.locator("button", { hasText: "Show cogwork-old.zip" }).click();
+    // Showing the folder alone changes nothing.
+    await page.evaluate(() => window.dispatchEvent(new Event("focus")));
+    await page.waitForTimeout(300);
+    await expect(blocker).toHaveCount(1);
+    // The player deletes it in the folder that opened; back in the launcher, it looks again.
+    await page.evaluate(() => (window as unknown as { mockPlayer: { deleteFile(f: string): void } }).mockPlayer.deleteFile("cogwork-old.zip"));
+    await page.evaluate(() => window.dispatchEvent(new Event("focus")));
+    await expect(blocker).toHaveCount(0);
+    await expect(page.locator(".mod-row[data-mod=cogwork]")).not.toHaveAttribute("data-shadowed", "true");
+  });
+});
+
+test.describe("every install shows what it does", () => {
+  test("an update opens the review dialog, warning first", async ({ page }) => {
+    await open(page, "scenario=mods");
+    await goToTab(page, MODS_TAB);
+    await page.locator(".mod-row .update-btn-row").first().click();
+    const d = page.locator(dialog);
+    await expect(d.locator(".dialog-warning")).toContainText("It can do anything you can do on this computer");
+    // Lanterns 1.1.0 needs Glowmoss, from the same source: named, with its tier.
+    await expect(d.locator(".checks li", { hasText: "Needs Glowmoss: installs 0.3.0 with it" }).locator(".badge")).toHaveText("Unreviewed");
+  });
+
+  test("provenance a repo only claims is never a green check", async ({ page }) => {
+    await open(page, "scenario=mods");
+    await goToTab(page, MODS_TAB);
+    await browse(page);
+    await page.locator(".mod-card", { hasText: "Glowmoss" }).locator("button.btn-primary").click();
+    const claimed = page.locator(".checks li", { hasText: "the repo says" });
+    await expect(claimed).toHaveClass(/check-unknown/);
+    const spoken = await page.locator(".checks li:not([data-check=fold])").evaluateAll((rows) => rows.map((r) => r.querySelector(".sr-only")?.textContent ?? ""));
+    expect(spoken.length).toBeGreaterThan(0);
+    for (const s of spoken) expect(s).toMatch(/Passed|Failed|Unknown|Unreviewed/);
+    // Nobody reviewed it: heard as the tier's word, not as a failed check.
+    await expect(page.locator(".checks li[data-check=review] .sr-only")).toHaveText("Unreviewed: ");
+  });
+
+  test("a missing dependency installs the mod turned off, and Play keeps working", async ({ page }) => {
+    await open(page, "scenario=crash");
+    await goToTab(page, MODS_TAB);
+    await browse(page);
+    await page.locator(".mod-card", { hasText: "Railways" }).locator("button.btn-primary").click();
+    const d = page.locator(dialog);
+    await expect(d).toContainText("Signals has no build for v26.11.1 yet, so Railways is installed turned off. Play keeps working.");
+    await d.locator(".dialog-actions .btn-primary", { hasText: "Install turned off" }).click();
+    await expect(d).toHaveCount(0, { timeout: 15_000 });
+    await expect(page.locator(".banner", { hasText: "Railways is installed turned off" })).toHaveCount(1);
+    await page.locator(".switch [role=tab]").first().click();
+    await expect(page.locator(".mod-row", { hasText: "Railways" }).locator(".toggle")).toHaveAttribute("aria-checked", "false");
+    await goToTab(page, 0);
+    await expect(page.locator(".btn-play")).toBeEnabled();
+  });
+
+  test("Install … on a missing dependency opens its review", async ({ page }) => {
+    await open(page, "scenario=missingdep");
+    await page.locator(".blocker button", { hasText: "Install Glowmoss…" }).click();
+    const d = page.locator(dialog);
+    await expect(d.locator(".dialog-title")).toHaveText("Install Glowmoss 0.3.0 for v26.11.1?");
+    await d.locator(".dialog-actions .btn-primary").click();
+    await expect(d).toHaveCount(0, { timeout: 15_000 });
+    await expect(page.locator(".blocker", { hasText: "Lanterns" })).toHaveCount(0);
+  });
+
+  test("copying a mod set shows everything it brings, then does it", async ({ page }) => {
+    await open(page, "scenario=empty");
+    await goToTab(page, MODS_TAB);
+    await page.locator(".empty-actions .btn-secondary").first().click();
+    const d = page.locator(dialog);
+    // Only turned-on mods; each with its outcome, then what they need.
+    await expect(d.locator(".copy-list").first().locator("li")).toHaveCount(6);
+    // What stays behind is said first, above the list, and leads it.
+    const stays = await d.locator(".copy-list").first().locator("li.check-no .copy-name").allTextContents();
+    expect(stays.length).toBeGreaterThan(0);
+    await expect(d.getByTestId("copy-stays")).toContainText(`stay${stays.length === 1 ? "s" : ""} behind`);
+    const first = await d.locator(".copy-list").first().locator("li").evaluateAll((li) => li.map((l) => l.className));
+    expect(first.slice(0, stays.length).every((c) => /check-no/.test(c))).toBe(true);
+    await expect(d.locator("li", { hasText: "Glowmoss 0.3.0: a copied mod needs it" }).locator(".badge")).toHaveText("Unreviewed");
+    await expect(d.locator(".dialog-warning")).toContainText("nobody reviewed these: Lanterns and Glowmoss");
+    // One line says what the copy does, and stays: it adds, and replaces nothing. The title
+    // names the one version it copies from; no line under it says that again.
+    await expect(d.getByTestId("copy-intro")).toContainText("Copying adds 4 mods to v26.11.1. Nothing v26.11.1 has now is removed or replaced.");
+    await expect(d.locator(".dialog-field")).toHaveCount(0);
+    // Each build it installs, dependencies too, shows what its own install dialog would: review,
+    // the whole hash, build record. One control for all of them, and no tab stop per value.
+    const evidence = d.locator(".copy-evidence-btn");
+    await expect(evidence).toHaveAttribute("aria-expanded", "false");
+    await expect(d.locator(".copy-item .checks")).toHaveCount(0);
+    await evidence.click();
+    await expect(evidence).toHaveAttribute("aria-expanded", "true");
+    const installs = await d.locator(".copy-list > li.check-yes").count();
+    await expect(d.locator(".copy-item .checks")).toHaveCount(installs);
+    for (const list of await d.locator(".copy-item .checks").all()) {
+      await expect(list.locator("[data-check=review]")).toHaveCount(1);
+      await expect(list.locator("[data-check=pin] .code-full")).toHaveText(/^[0-9a-f]{64}$/);
+      await expect(list.locator("[data-check=provenance]")).toHaveCount(1);
+    }
+    const glowEvidence = d.locator(".copy-item", { hasText: "Glowmoss 0.3.0" }).locator(".checks");
+    await expect(glowEvidence.locator("[data-check=review]")).toHaveClass(/check-no/);
+    await expect(glowEvidence.locator("[data-check=review]")).toContainText("Published by");
+    expect(await d.locator(".copy-item [tabindex], .copy-item button").count()).toBe(0);
+    await expectWhole(page, "copy evidence");
+    await evidence.click();
+    await expect(d.locator(".copy-item .checks")).toHaveCount(0);
+    await d.locator(".dialog-actions .btn-primary", { hasText: "Copy 4 mods to v26.11.1" }).click();
+    await expect(d.locator(".dialog-title")).toHaveText("Mods copied to v26.11.1", { timeout: 30_000 });
+    // The four it was asked for, and Glowmoss, which one of them needs.
+    await expect(d.locator(".dialog-summary")).toHaveText("Copied 5 mods from v26.10.4 to v26.11.1.");
+    // Each build it installed stays listed, whole, dependency included, with whether it is on.
+    const doneList = d.getByTestId("copy-done");
+    await expect(doneList.locator("li")).toHaveCount(5);
+    const glow = doneList.locator("li", { hasText: "Glowmoss" });
+    await expect(glow.locator(".mod-version")).toHaveText("0.3.0");
+    await expect(glow).toContainText(/Installed for v26\.11\.1, turned (on|off)/);
+    for (const li of await doneList.locator("li").all()) {
+      await expect(li.locator(".copy-name")).toBeVisible();
+      await expect(li.locator(".mod-version")).toBeVisible();
+    }
+    await expectWhole(page, "copy result");
+    await d.locator(".dialog-actions .btn-primary").click();
+    await expect(page.locator(".mod-row")).toHaveCount(5);
+    await expect(page.locator(".mod-row .mod-name", { hasText: /^Glowmoss$/ })).toHaveCount(1);
+  });
+
+  test("a catalogued file shows the plan of that build", async ({ page }) => {
+    await open(page, "scenario=knownfile");
+    await goToTab(page, MODS_TAB);
+    await page.locator(".toolbar-actions button").first().click();
+    const d = page.locator(dialog);
+    // Cogwork is installed: the title and the button both say Update.
+    await expect(d.locator(".dialog-title")).toHaveText("Update Cogwork to 0.2.0 for v26.11.1 from this file?");
+    await expect(d.locator(".checks li", { hasText: "Same file as Cogwork 0.2.0" })).toHaveClass(/check-yes/);
+    await expect(d.locator(".dialog-actions .btn-primary")).toHaveText("Update");
+  });
+
+  test("a file whose fit can't be found out says unknown, with Retry, never no", async ({ page }) => {
+    await open(page, "scenario=knownfile&abi=error");
+    await goToTab(page, MODS_TAB);
+    await page.locator(".toolbar-actions button").first().click();
+    const d = page.locator(dialog);
+    const fit = d.locator(".checks li").first();
+    await expect(fit).toHaveAttribute("data-check", "abi");
+    await expect(fit).toHaveClass(/check-unknown/);
+    await expect(fit).toContainText("Whether it fits v26.11.1 couldn't be checked");
+    await expect(d.locator(".checks li.check-no")).toHaveCount(0);
+    await expect(d.locator(".dialog-actions .btn-primary")).toBeDisabled();
+    const retry = fit.locator(".check-retry");
+    await retry.click();
+    // Taken, and said so, until the version has been asked again.
+    await expect(retry).toHaveText("Retrying…");
+    await expect(retry).toBeDisabled();
+    await expect(d.locator(".checks li").first()).toHaveClass(/check-unknown/);
+    await expect(d.locator(".checks li").first().locator(".check-retry")).toHaveText("Retry");
+  });
+
+  test("installing a mod that needs mods that need others turns the whole chain on", async ({ page }) => {
+    await open(page, "scenario=chain");
+    await goToTab(page, MODS_TAB);
+    await browse(page);
+    await page.locator(".mod-card", { hasText: "Chimneys" }).locator("button.btn-primary").click();
+    const d = page.locator(dialog);
+    await expect(d.locator(".checks li", { hasText: "Needs Hearth: turns it on too" })).toHaveClass(/check-yes/);
+    await expect(d.locator(".checks li", { hasText: "Needs Cogwork: turns it on too" })).toHaveClass(/check-yes/);
+    await d.locator(".dialog-actions .btn-primary").click();
+    await expect(d).toHaveCount(0, { timeout: 15_000 });
+    await page.locator(".switch [role=tab]").first().click();
+    for (const name of ["Chimneys", "Hearth", "Cogwork"]) {
+      await expect(page.locator(".mod-row", { has: page.locator(".mod-name", { hasText: name }) }).locator(".toggle")).toHaveAttribute("aria-checked", "true");
+    }
+  });
+
+  test("an update keeps a mod that is off turned off", async ({ page }) => {
+    await open(page, "scenario=mods");
+    await goToTab(page, MODS_TAB);
+    const row = page.locator(".mod-row", { hasText: "Structures" });
+    const toggle = row.locator(".toggle");
+    if ((await toggle.getAttribute("aria-checked")) === "true") await toggle.click();
+    await expect(toggle).toHaveAttribute("aria-checked", "false");
+    await row.locator(".update-btn-row").click();
+    await page.locator(`${dialog} .dialog-actions .btn-primary`).click();
+    await expect(page.locator(dialog)).toHaveCount(0, { timeout: 15_000 });
+    await expect(row.locator(".toggle")).toHaveAttribute("aria-checked", "false");
+  });
+
+  test("the install button doesn't flicker while the set and the catalogue load again", async ({ page }) => {
+    await open(page, "scenario=mods");
+    // The button's state every frame from the moment the dialog shows.
+    await page.evaluate(() => {
+      const w = window as unknown as { seq: string[] };
+      w.seq = [];
+      const tick = () => {
+        const b = document.querySelector<HTMLButtonElement>("[role=dialog] .dialog-actions .btn-primary");
+        if (b) w.seq.push(b.disabled ? "D" : "e");
+        requestAnimationFrame(tick);
+      };
+      tick();
+    });
+    await goToTab(page, MODS_TAB);
+    // As early as it can be opened: the catalogue and every set are still being read again.
+    await page.locator(".mod-row", { hasText: "Lanterns" }).locator(".update-btn-row").click();
+    const button = page.locator(`${dialog} .dialog-actions .btn-primary`);
+    await expect(button).toBeEnabled();
+    await page.waitForTimeout(1500);
+    // A refresh from the header brings the same plan again: nothing changes either.
+    await page.evaluate(() => (document.querySelector(".mods-refresh") as HTMLButtonElement | null)?.click());
+    await page.waitForTimeout(800);
+    const seq = await page.evaluate(() => (window as unknown as { seq: string[] }).seq.join(""));
+    // Off until the first plan, then on for good.
+    expect(seq.replace(/(.)\1*/g, "$1"), "enabled, disabled, enabled again").toBe("De");
+    await button.click();
+    await expect(page.locator(`${dialog} .progress-bar`)).toHaveCount(1);
+  });
+
+  test("a click in the very frame the button turns on starts the install", async ({ page }) => {
+    await open(page, "scenario=mods");
+    // Clicks from inside the page in the first frame the button is enabled: no wait for a
+    // stable state, as a quick player wouldn't wait either.
+    await page.evaluate(() => {
+      const tick = () => {
+        const b = document.querySelector<HTMLButtonElement>("[role=dialog] .dialog-actions .btn-primary");
+        if (b && !b.disabled) b.click();
+        else requestAnimationFrame(tick);
+      };
+      tick();
+    });
+    await goToTab(page, MODS_TAB);
+    await page.locator(".mod-row", { hasText: "Lanterns" }).locator(".update-btn-row").click();
+    await expect(page.locator(`${dialog} .progress-bar`)).toHaveCount(1);
+    await expect(page.locator(dialog)).toHaveCount(0, { timeout: 15_000 });
+    await expect(page.locator(".mod-row[data-mod=lanterns] .mod-version")).toHaveText("1.1.0");
+  });
+
+  test("a failed dependency download leaves no progress behind", async ({ page }) => {
+    await open(page, "scenario=mods&fail=dep");
+    await goToTab(page, MODS_TAB);
+    await page.locator(".mod-row", { hasText: "Lanterns" }).locator(".update-btn-row").click();
+    await page.locator(`${dialog} .dialog-actions .btn-primary`).click();
+    await expect(page.locator(`${dialog} .inline-error`)).toContainText("gone from GitHub", { timeout: 15_000 });
+    await expect(page.locator(`${dialog} .progress-bar`)).toHaveCount(0);
+    await page.keyboard.press("Escape");
+    await expect(page.locator(".progress-bar")).toHaveCount(0);
+  });
+});
+
+/** Opens the update of Lanterns (1.0.0 → 1.1.0, which brings Glowmoss along). */
+async function updateLanterns(page: Page, query: string) {
+  await open(page, query);
+  await goToTab(page, MODS_TAB);
+  await page.locator(".mod-row", { hasText: "Lanterns" }).locator(".update-btn-row").click();
+  await expect(page.locator(`${dialog} .checks`)).toBeVisible();
+  return page.locator(dialog);
+}
+
+test.describe("operations", () => {
+  test("the mock's progress follows the backend's trace", async ({ page }) => {
+    const d = await updateLanterns(page, "scenario=mods");
+    // Listened to on the event bus, as the page listens: what the mock sends, not what it shows.
+    await page.evaluate(() => {
+      const w = window as unknown as {
+        __TAURI_INTERNALS__: { transformCallback(f: (e: { payload: unknown }) => void): number; invoke(cmd: string, args: unknown): Promise<unknown> };
+        progressSeen: unknown[];
+      };
+      w.progressSeen = [];
+      const handler = w.__TAURI_INTERNALS__.transformCallback((e) => w.progressSeen.push(e.payload));
+      return w.__TAURI_INTERNALS__.invoke("plugin:event|listen", { event: "mod-progress", target: { kind: "Any" }, handler });
+    });
+    await d.locator(".dialog-actions .btn-primary").click();
+    await expect(d).toHaveCount(0, { timeout: 15_000 });
+    type Seen = { operationId: string; index: number; count: number; stage: string; percent: number };
+    const seen = (await page.evaluate(() => (window as unknown as { progressSeen: unknown[] }).progressSeen)) as Seen[];
+    const want = trace.installWithDependency;
+    expect(new Set(seen.map((e) => e.operationId)).size).toBe(1);
+    expect(seen.every((e) => e.count === want.count)).toBe(true);
+    expect(collapseTrace(seen)).toEqual(want.steps);
+  });
+
+  test("a cancel is refused once the install writes, as the backend refuses it", async ({ page }) => {
+    const d = await updateLanterns(page, "scenario=mods");
+    // At the first `installing`, ask to cancel, as a late click on Cancel would.
+    await page.evaluate(() => {
+      const w = window as unknown as {
+        __TAURI_INTERNALS__: { transformCallback(f: (e: { payload: { operationId: string; stage: string } }) => void): number; invoke(cmd: string, args: unknown): Promise<unknown> };
+        lateCancel: Promise<unknown> | null;
+        earlyCancel: unknown;
+      };
+      w.lateCancel = null;
+      const handler = w.__TAURI_INTERNALS__.transformCallback((e) => {
+        if (e.payload.stage === "installing" && !w.lateCancel) {
+          w.lateCancel = w.__TAURI_INTERNALS__.invoke("cancel_mod_operation", { operationId: e.payload.operationId });
+        }
+      });
+      return w.__TAURI_INTERNALS__.invoke("plugin:event|listen", { event: "mod-progress", target: { kind: "Any" }, handler });
+    });
+    await d.locator(".dialog-actions .btn-primary").click();
+    await expect(d).toHaveCount(0, { timeout: 15_000 });
+    expect(await page.evaluate(() => (window as unknown as { lateCancel: Promise<unknown> }).lateCancel)).toBe(false);
+    // It finished: the update is in, and nothing says it was cancelled.
+    await expect(page.locator(".mod-row").filter({ has: page.locator(".mod-name", { hasText: /^Lanterns$/ }) }).locator(".mod-version")).toHaveText("1.1.0");
+    await expect(page.locator(".banners")).not.toContainText(/cancel/i);
+  });
+
+  test("progress names the file, and Cancel stops it calmly with nothing changed", async ({ page }) => {
+    const d = await updateLanterns(page, "scenario=mods&slow=1");
+    await d.locator(".dialog-actions .btn-primary").click();
+    // As the backend works: the build asked for first, then what it needs. File 1 of 2.
+    await expect(d.locator(".progress-label")).toHaveText(/^File 1 of 2: Lanterns, downloading \d+%/);
+    // Heard once per file and step, with no number and no stray "%".
+    await expect(spoken(page)).toContainText("File 1 of 2: Lanterns, downloading");
+    await expect(spoken(page)).not.toContainText("%");
+    await expect(d.locator("[aria-live]")).toHaveCount(0);
+    await d.locator(".progress-cancel").click();
+    await expect(d.getByTestId("cancelled-note")).toHaveText("Cancelled. Nothing was changed.", { timeout: 15_000 });
+    await expect(d.locator(".inline-error, [role=alert]")).toHaveCount(0);
+    await expect(spoken(page)).toHaveText("Cancelled. Nothing was changed.");
+    await expect(d.locator(".progress-bar")).toHaveCount(0);
+    await page.keyboard.press("Escape");
+    await expect(page.locator(".mod-row[data-mod=lanterns] .mod-version")).toHaveText("1.0.0");
+    await expect(page.locator(".mod-row[data-mod=glowmoss]")).toHaveCount(0);
+    await expect(page.locator(".progress-bar")).toHaveCount(0);
+  });
+
+  test("each progress line names the file it is about: its number, its name and its step together", async ({ page }) => {
+    await open(page, "scenario=empty");
+    // Everything the bar shows and the live region says, as it changes.
+    await page.evaluate(() => {
+      const log: string[] = ((window as unknown as { progressLog: string[] }).progressLog = []);
+      const keep = (t: string | null | undefined) => t && /^File \d+ of \d+:/.test(t) && log[log.length - 1] !== t && log.push(t);
+      new MutationObserver(() => {
+        keep(document.querySelector("[role=dialog] .dialog-actions .progress-label")?.textContent?.replace(/ \d+%$/, ""));
+        document.querySelector("[data-testid=live-region]")?.textContent?.split(/(?=File \d+ of)/).forEach((x) => keep(x.trim()));
+      }).observe(document.body, { subtree: true, childList: true, characterData: true });
+    });
+    await goToTab(page, MODS_TAB);
+    await page.locator(".empty-actions .btn-secondary").first().click();
+    const d = page.locator(dialog);
+    await d.locator(".dialog-actions .btn-primary", { hasText: "Copy 4 mods to v26.11.1" }).click();
+    await expect(d.locator(".dialog-title")).toHaveText("Mods copied to v26.11.1", { timeout: 30_000 });
+    const log = await page.evaluate(() => (window as unknown as { progressLog: string[] }).progressLog);
+    const lines = log.map((l) => l.match(/^File (\d+) of \d+: (.+), (downloading|checking the file|installing|getting ready)$/)!);
+    expect(lines.every(Boolean), log.join("\n")).toBe(true);
+    // One name per file number, all the way through.
+    const names = new Map<string, string>();
+    for (const [, index, name] of lines) {
+      expect(names.get(index) ?? name, `file ${index}`).toBe(name);
+      names.set(index, name);
+    }
+    expect(names.size).toBeGreaterThan(1);
+    // A file is checked only after it was shown downloading.
+    lines.forEach(([line, index, name, step], i) => {
+      if (step === "checking the file") expect(log.slice(0, i), line).toContain(`File ${index} of ${line.match(/of (\d+)/)![1]}: ${name}, downloading`);
+    });
+  });
+
+  test("a set that changed meanwhile is planned again, shown, and asked again", async ({ page }) => {
+    const d = await updateLanterns(page, "scenario=mods&fail=meanwhile");
+    await d.locator(".dialog-actions .btn-primary").click();
+    const changes = d.getByTestId("plan-changes");
+    await expect(changes).toContainText("This changed since you looked:");
+    await expect(changes).toContainText("Glowmoss 0.3.1 instead of 0.3.0");
+    await expect(d.locator(".checks li", { hasText: "Needs Glowmoss: installs 0.3.1 with it" })).toHaveCount(1);
+    // Asked again: nothing ran, and the button works on the new plan.
+    await expect(d.locator(".progress-bar")).toHaveCount(0);
+    await d.locator(".dialog-actions .btn-primary").click();
+    await expect(d).toHaveCount(0, { timeout: 15_000 });
+    await expect(page.locator(".mod-row[data-mod=glowmoss] .mod-version")).toHaveText("0.3.1");
+  });
+});
+
+test.describe("announcements", () => {
+  test("results are said politely; only blockers that appear are said assertively", async ({ page }) => {
+    await open(page, "scenario=mods");
+    await goToTab(page, MODS_TAB);
+    // Every assertive region belongs to a blocker panel.
+    const alerts = page.locator("[role=alert]");
+    for (const a of await alerts.all()) expect(await a.evaluate((e) => !!e.closest(".blockers"))).toBe(true);
+    const said = await alerts.allTextContents();
+    // A plain toggle is said by the switch itself; a result with more to it goes to the live region.
+    const remove = page.locator(".mod-row[data-mod=showcase] .delete-btn");
+    await confirmRemove(page, remove);
+    await expect(spoken(page)).toContainText("Removed Showcase from v26.11.1.");
+    // The blockers didn't change, so nothing is said about them again.
+    expect(await alerts.allTextContents()).toEqual(said);
+  });
+});
+
+test.describe("announcement wording", () => {
+  test("several blockers are said as whole sentences, never joined with a comma", async ({ page }) => {
+    await open(page, "scenario=missingdep");
+    const alert = page.locator(".blockers [role=alert]").first();
+    await expect(alert).toContainText("Hearth");
+    await expect(alert).toContainText("Lanterns");
+    for (const text of await page.locator("[role=alert], [data-testid=live-region]").allTextContents()) {
+      expect(text, text).not.toMatch(/[.!?:],/);
+    }
+  });
+});
+
+test.describe("focus after a result", () => {
+  const notOnBody = async (page: Page) => {
+    await expect.poll(async () => (await focused(page)).tag).not.toBe("BODY");
+    await expect.poll(async () => (await focused(page)).inDialog).toBe(false);
+  };
+
+  test("an install from Browse leaves focus on its card, though Install became Installed", async ({ page }) => {
+    await open(page, "scenario=mods");
+    await goToTab(page, MODS_TAB);
+    await browse(page);
+    const card = page.locator(".mod-card", { has: page.locator(".mod-card-foot .btn-primary", { hasText: /^Install$/ }) }).first();
+    const key = await card.getAttribute("data-key");
+    await card.locator(".mod-card-foot .btn-primary").click();
+    const d = page.locator(dialog);
+    await d.locator(".dialog-actions .btn-primary").click();
+    await expect(d).toHaveCount(0, { timeout: 15_000 });
+    await expect(page.locator(`.mod-card[data-key="${key}"] .installed-mark`)).toHaveCount(1);
+    await notOnBody(page);
+    expect(await page.evaluate(() => document.activeElement?.closest(".mod-card")?.getAttribute("data-key"))).toBe(key);
+  });
+
+  test("a copy into an empty set leaves focus in the list, not on the page body", async ({ page }) => {
+    await open(page, "scenario=empty");
+    await goToTab(page, MODS_TAB);
+    await page.locator(".empty-actions .btn-secondary").first().click();
+    const d = page.locator(dialog);
+    await d.locator(".dialog-actions .btn-primary", { hasText: "Copy 4 mods to v26.11.1" }).click();
+    await expect(d.locator(".dialog-title")).toHaveText("Mods copied to v26.11.1", { timeout: 30_000 });
+    await d.locator(".dialog-actions .btn-primary").click();
+    await expect(d).toHaveCount(0);
+    await notOnBody(page);
+    expect(await page.evaluate(() => !!document.activeElement?.closest(".mods-panel"))).toBe(true);
+  });
+
+  test("a file install leaves focus on the page, not the body", async ({ page }) => {
+    await open(page, "scenario=mods&file=known");
+    await goToTab(page, MODS_TAB);
+    await page.locator("button", { hasText: "From file" }).click();
+    const d = page.locator(dialog);
+    const go = d.locator(".dialog-actions .btn-primary");
+    await expect(go).toBeEnabled({ timeout: 10_000 });
+    await go.click();
+    await expect(d).toHaveCount(0, { timeout: 15_000 });
+    await notOnBody(page);
+  });
+});
+
+test.describe("remove and undo", () => {
+  test("a double-click on Remove asks, and doesn't remove", async ({ page }) => {
+    await open(page, "scenario=mods");
+    await goToTab(page, MODS_TAB);
+    const row = page.locator(".mod-row", { hasText: "Showcase" });
+    await row.locator(".delete-btn").dblclick();
+    await page.waitForTimeout(300);
+    await expect(row).toHaveCount(1);
+    await expect(row.locator(".delete-btn")).toHaveClass(/confirming/);
+    // Never silent: it says why the second click didn't remove.
+    await expect(spoken(page)).toContainText("A double-click doesn't remove Showcase. Press Remove again to confirm.");
+  });
+
+  test("a quick second press by keyboard confirms: no dead time once the question shows", async ({ page }) => {
+    await open(page, "scenario=mods");
+    await goToTab(page, MODS_TAB);
+    const remove = page.locator(".mod-row", { hasText: "Showcase" }).locator(".delete-btn");
+    await remove.focus();
+    await page.keyboard.press("Enter");
+    await expect(remove).toHaveClass(/confirming/);
+    await page.keyboard.press("Enter");
+    await expect(page.locator(".mod-row", { hasText: "Showcase" })).toHaveCount(0);
+  });
+
+  test("a held Enter asks once and doesn't repeat into a removal", async ({ page }) => {
+    await open(page, "scenario=mods");
+    await goToTab(page, MODS_TAB);
+    const remove = page.locator(".mod-row", { hasText: "Showcase" }).locator(".delete-btn");
+    await remove.focus();
+    // A key pressed while it is down is the system's auto-repeat (`repeat: true`).
+    for (let i = 0; i < 4; i++) await page.keyboard.down("Enter");
+    await page.keyboard.up("Enter");
+    await expect(remove).toHaveClass(/confirming/);
+    await expect(page.locator(".mod-row", { hasText: "Showcase" })).toHaveCount(1);
+  });
+
+  test("the Installed tab says which version its count is for", async ({ page }) => {
+    await open(page, "scenario=mods");
+    await goToTab(page, MODS_TAB);
+    const n = await page.locator(".mod-row").count();
+    await expect(page.getByRole("tab", { name: `Installed in v26.11.1: ${n} mods` })).toHaveCount(1);
+  });
+
+  test("Remove says what it did, Undo puts it back, and focus stays on a row", async ({ page }) => {
+    await open(page, "scenario=mods");
+    await goToTab(page, MODS_TAB);
+    const remove = page.locator(".mod-row", { hasText: "Showcase" }).locator(".delete-btn");
+    await confirmRemove(page, remove);
+    const notice = page.locator(".banner", { hasText: "Removed Showcase from v26.11.1." });
+    await expect(notice).toHaveCount(1);
+    await expect(page.locator(".mod-row", { hasText: "Showcase" })).toHaveCount(0);
+    // Focus went to the row that took its place, not to <body>.
+    await expect.poll(async () => (await focused(page)).row).not.toBeNull();
+    await notice.locator("button", { hasText: "Undo" }).click();
+    await expect(page.locator(".banner", { hasText: "Showcase is back in v26.11.1, turned off as before." })).toHaveCount(1);
+    const back = page.locator(".mod-row", { hasText: "Showcase" });
+    await expect(back.locator(".toggle")).toHaveAttribute("aria-checked", "false");
+    await expect.poll(async () => (await focused(page)).row).toBe("showcase");
+  });
+});
+
+test.describe("mock", () => {
+  test("the window title names the scenario and its flags", async ({ page }) => {
+    await open(page, "scenario=crash&crash=exit");
+    await expect(page).toHaveTitle("Weft (mock: crash, crash=exit)");
+  });
+
+  test("an event never reaches a listener that was let go", async ({ page }) => {
+    const lost: string[] = [];
+    page.on("console", (m) => m.text().includes("Couldn't find callback") && lost.push(m.text()));
+    await open(page, "scenario=mods");
+    await goToTab(page, MODS_TAB);
+    await browse(page);
+    await page.locator(".mod-card", { hasText: "Hearth" }).locator(".mod-card-foot .btn-primary").click();
+    await page.locator(`${dialog} .dialog-actions .btn-primary`).click();
+    await expect(page.locator(dialog)).toHaveCount(0, { timeout: 15_000 });
+    await settled(page);
+    expect(lost).toEqual([]);
+  });
+});
+
+test.describe("contrast", () => {
+  test("an off mod's name reads as well as small text: a solid colour, not faded", async ({ page }) => {
+    await open(page, "scenario=chain");
+    await goToTab(page, MODS_TAB);
+    const off = page.locator(".mod-row.is-off");
+    expect(await off.count()).toBeGreaterThan(0);
+    // Opacity anywhere above the name counts: what is measured is what is seen.
+    expect(await off.locator(".mod-name").evaluateAll((n) => n.map((e) => getComputedStyle(e).opacity))).not.toContain("0.55");
+    expect(await lowContrast(page, 4.5, 4.5, ".mod-row.is-off"), "off rows under 4.5:1").toEqual([]);
+    // And the whole page at WCAG AA: 4.5:1, 3:1 for large text.
+    expect(await lowContrast(page)).toEqual([]);
+  });
+
+  test("the Installed and Browse tabs keep their place and size when selected; the count is text, not a block", async ({ page }) => {
+    await open(page, "scenario=mods");
+    await goToTab(page, MODS_TAB);
+    const boxes = () =>
+      page.locator(".switch [role=tab]").evaluateAll((tabs) =>
+        tabs.map((t) => {
+          const r = t.getBoundingClientRect();
+          return [r.x, r.y, r.width, r.height];
+        }),
+      );
+    const installed = await boxes();
+    const count = page.locator(".switch [role=tab]").first().locator(".count");
+    expect(await count.evaluate((e) => getComputedStyle(e).backgroundColor)).toBe("rgba(0, 0, 0, 0)");
+    expect(await lowContrast(page, 4.5, 4.5, ".switch")).toEqual([]);
+    await browse(page);
+    expect(await boxes()).toEqual(installed);
+    expect(await lowContrast(page, 4.5, 4.5, ".switch")).toEqual([]);
+  });
+
+  test("the contrast check composites opacity and measures large text", async ({ page }) => {
+    await open(page, "scenario=mods");
+    await goToTab(page, MODS_TAB);
+    // Fade one name as the off rows used to be: amber at .55 on the row is 3.9:1, under 4.5:1.
+    await page.locator(".mod-row .mod-name").first().evaluate((e) => (e.parentElement!.style.opacity = "0.55"));
+    expect(await lowContrast(page, 4.5, 4.5, ".mod-row")).not.toEqual([]);
+    // A 24px name at 0.3 is under 3:1 too: large text is checked, not skipped.
+    await page.locator(".mod-row .mod-name").first().evaluate((e) => (e.parentElement!.style.opacity = "0.3"));
+    expect((await lowContrast(page, 4.5, 3, ".mod-row")).some((t) => t.includes("(large)"))).toBe(true);
+  });
+});
+
+test.describe("keyboard", () => {
+  test("top tabs: one tab stop, arrows, Home and End", async ({ page }) => {
+    await open(page, "scenario=mods");
+    const stops = await page.locator(".tab-btn").evaluateAll((els) => els.filter((e) => (e as HTMLElement).tabIndex === 0).length);
+    expect(stops).toBe(1);
+    await page.locator(".tab-btn").first().focus();
+    await page.keyboard.press("ArrowRight");
+    expect((await focused(page)).text).toMatch(/^Versions/);
+    await expect(page.locator("#main-panel-versions[role=tabpanel]")).toHaveCount(1);
+    await page.keyboard.press("End");
+    expect((await focused(page)).text).toMatch(/^Release Notes/);
+    await page.keyboard.press("Home");
+    await page.keyboard.press("ArrowLeft");
+    expect((await focused(page)).text).toMatch(/^Release Notes/);
+  });
+
+  test("arrows move from the tab that has focus, not the one selected", async ({ page }) => {
+    await open(page, "scenario=mods");
+    await goToTab(page, MODS_TAB);
+    // Mods is selected; focus is on Home.
+    await page.locator(".tab-btn").first().focus();
+    await page.keyboard.press("ArrowRight");
+    expect((await focused(page)).text).toMatch(/^Versions/);
+    await page.keyboard.press("ArrowLeft");
+    expect((await focused(page)).text).toMatch(/^Home/);
+  });
+
+  test("Tab and Shift+Tab go through an error's Details inside a dialog, in order", async ({ page }) => {
+    await open(page, "scenario=mods&fail=sources");
+    await goToTab(page, MODS_TAB);
+    await page.locator(".header-actions button", { hasText: "Sources" }).click();
+    const summary = page.locator(`${dialog} .inline-error summary`);
+    await expect(summary).toBeVisible();
+    // The dialog's tab stops in document order.
+    const stops = await page.locator(dialog).evaluate((d) =>
+      [...d.querySelectorAll<HTMLElement>("button, input, summary, [href], [tabindex]")]
+        .filter((e) => e.tabIndex >= 0 && !(e as HTMLButtonElement).disabled && e.getClientRects().length > 0)
+        .map((e) => e.textContent?.trim() || e.getAttribute("placeholder") || e.tagName)
+    );
+    const at = stops.indexOf("Details");
+    expect(at, "Details is a tab stop").toBeGreaterThan(0);
+    const name = () => page.evaluate(() => { const a = document.activeElement as HTMLElement; return a.textContent?.trim() || a.getAttribute("placeholder") || a.tagName; });
+    await summary.focus();
+    await page.keyboard.press("Tab");
+    expect(await name()).toBe(stops[at + 1]);
+    await page.keyboard.press("Shift+Tab");
+    expect(await name()).toBe("Details");
+    await page.keyboard.press("Shift+Tab");
+    expect(await name()).toBe(stops[at - 1]);
+    // All the way round, forward, through Details and back to where it started.
+    await summary.focus();
+    const seen: string[] = [];
+    for (let i = 0; i < stops.length; i++) {
+      await page.keyboard.press("Tab");
+      seen.push(await name());
+    }
+    expect(seen.at(-1)).toBe("Details");
+    expect(new Set(seen).size).toBe(stops.length);
+  });
+
+  test("Installed/Browse switch follows the arrows", async ({ page }) => {
+    await open(page, "scenario=mods");
+    await goToTab(page, MODS_TAB);
+    await page.locator(".switch [role=tab]").first().focus();
+    await page.keyboard.press("ArrowRight");
+    expect((await focused(page)).text).toMatch(/^Browse/);
+    await expect(page.locator("#mods-panel-browse")).toHaveCount(1);
+  });
+
+  test("the version picker is a combobox over a listbox", async ({ page }) => {
+    await open(page, "scenario=mods");
+    const box = page.locator(".hero-play-area [role=combobox]");
+    await expect(box).toHaveAttribute("aria-expanded", "false");
+    await box.focus();
+    await page.keyboard.press("ArrowDown");
+    await expect(box).toHaveAttribute("aria-expanded", "true");
+    const list = page.locator(`#${await box.getAttribute("aria-controls")}`);
+    await expect(list).toHaveAttribute("role", "listbox");
+    const active = await box.getAttribute("aria-activedescendant");
+    await expect(list.locator(`#${active}`)).toHaveAttribute("aria-selected", "true");
+    await page.keyboard.press("ArrowDown");
+    const next = await box.getAttribute("aria-activedescendant");
+    expect(next).not.toBe(active);
+    await expect(list.locator("[aria-selected=true]")).toHaveCount(1);
+    await page.keyboard.press("Escape");
+    await expect(box).toHaveAttribute("aria-expanded", "false");
+  });
+
+  test("typing in the version picker goes to the version that starts with it", async ({ page }) => {
+    await open(page, "scenario=mods");
+    const box = page.locator(".hero-play-area [role=combobox]");
+    await box.focus();
+    await page.keyboard.type("26.10");
+    await expect(box).toHaveAttribute("aria-expanded", "true");
+    const active = await box.getAttribute("aria-activedescendant");
+    await expect(page.locator(`#${active}`)).toHaveText("v26.10.4");
+    await page.keyboard.press("Enter");
+    await expect(box).toHaveText("v26.10.4");
+  });
+
+  test("the notes toggle keeps focus and says whether it is open", async ({ page }) => {
+    await open(page, "scenario=offline");
+    await goToTab(page, MODS_TAB);
+    const toggle = page.locator(".banner-toggle");
+    await toggle.focus();
+    await page.keyboard.press("Enter");
+    await expect(toggle).toHaveAttribute("aria-expanded", "true");
+    await expect(toggle).toBeFocused();
+    await expect(page.locator(`#${await toggle.getAttribute("aria-controls")} .banner`).first()).toBeVisible();
+    await page.keyboard.press("Enter");
+    await expect(toggle).toHaveAttribute("aria-expanded", "false");
+    await expect(toggle).toBeFocused();
+  });
+
+  test("dialogs start on Cancel, keep focus inside, and Escape on Cancel closes them", async ({ page }) => {
+    await open(page, "scenario=mods");
+    await goToTab(page, MODS_TAB);
+    const opener = page.locator(".mod-row[data-mod=structures] .update-btn-row");
+    await opener.click();
+    await expect(page.locator(dialog)).toBeVisible();
+    // The plan is in before anything is counted: the tab order is the final one.
+    await expect(page.locator(`${dialog} .checks .check:not([hidden])`).first()).toBeVisible();
+    const first = await focused(page);
+    expect(first.inDialog).toBe(true);
+    expect(first.text).toBe("Cancel");
+    await page.evaluate(() => (document.querySelector(".tab-btn") as HTMLElement | null)?.focus());
+    await expect.poll(async () => (await focused(page)).inDialog).toBe(true);
+    // Round and round: focus never leaves.
+    for (let i = 0; i < 12; i++) {
+      await page.keyboard.press("Tab");
+      expect((await focused(page)).inDialog).toBe(true);
+    }
+    for (let i = 0; i < 12; i++) await page.keyboard.press("Shift+Tab");
+    expect((await focused(page)).inDialog).toBe(true);
+    // From Cancel, with no tooltip open, one Escape closes it and focus goes back to the opener.
+    await page.locator(`${dialog} [data-autofocus]`).focus();
+    await page.keyboard.press("Escape");
+    await expect(page.locator(dialog)).toHaveCount(0);
+    await expect(opener).toBeFocused();
+  });
+
+  test("one control shows the checks that passed and every full hash, with no tab stop per value", async ({ page }) => {
+    await open(page, "scenario=mods");
+    await goToTab(page, MODS_TAB);
+    await page.locator(".mod-row[data-mod=lanterns] .update-btn-row").click();
+    const d = page.locator(dialog);
+    const fold = d.locator(".check-fold");
+    await expect(fold).toContainText(/\d+ checks passed · Show/);
+    // What failed or isn't known is in view; what passed is folded.
+    await expect(d.locator(".check-unknown:not([hidden])").first()).toBeVisible();
+    await expect(d.locator(".check-yes[hidden]").first()).toBeAttached();
+    // No hash, commit or badge in the dialog is a tab stop.
+    expect(await d.locator(".code-short[tabindex], .badge[tabindex]").count()).toBe(0);
+    const button = fold.locator("button");
+    await expect(button).toHaveAttribute("aria-expanded", "false");
+    await button.focus();
+    await page.keyboard.press("Enter");
+    await expect(button).toHaveAttribute("aria-expanded", "true");
+    await expect(button).toHaveText("Hide");
+    await expect(d.locator(".check[hidden]")).toHaveCount(0);
+    // Every shortened value is whole now.
+    await expect(d.locator(".code-short")).toHaveCount(0);
+    expect(await d.locator(".code-full").evaluateAll((c) => c.some((x) => /^[0-9a-f]{64}$/.test(x.textContent ?? "")))).toBe(true);
+    await expectWhole(page, "checks shown whole");
+    await page.keyboard.press("Escape");
+    await expect(d).toHaveCount(0);
+  });
+
+  test("the page behind a dialog is inert while it is open, except the live region", async ({ page }) => {
+    await open(page, "scenario=mods");
+    await goToTab(page, MODS_TAB);
+    const opener = page.locator(".mod-row[data-mod=lanterns] .update-btn-row");
+    await opener.click();
+    await expect(page.locator(dialog)).toBeVisible();
+    const inert = () =>
+      page.evaluate(() => ({
+        tabs: !!document.querySelector(".tab-btn")?.closest("[inert]"),
+        rows: !!document.querySelector(".mod-row")?.closest("[inert]"),
+        live: !!document.querySelector("[data-testid=live-region]")?.closest("[inert]"),
+        dialog: !!document.querySelector("[role=dialog]")?.closest("[inert]"),
+      }));
+    expect(await inert()).toEqual({ tabs: true, rows: true, live: false, dialog: false });
+    await page.keyboard.press("Escape");
+    await expect(page.locator(dialog)).toHaveCount(0);
+    expect(await page.evaluate(() => document.querySelectorAll("[inert]").length)).toBe(0);
+    await expect(opener).toBeFocused();
+  });
+
+  test("a tooltip under the mouse doesn't stop Escape on Cancel", async ({ page }) => {
+    await open(page, "scenario=mods");
+    await goToTab(page, MODS_TAB);
+    // Lanterns is Unreviewed: its download pin is unknown, so that row (with its hash) shows.
+    await page.locator(".mod-row[data-mod=lanterns] .update-btn-row").click();
+    await page.locator(`${dialog} .code-short`).first().hover();
+    await expect(page.locator(".tip")).toHaveCount(1);
+    await page.locator(`${dialog} [data-autofocus]`).focus();
+    await page.keyboard.press("Escape");
+    await expect(page.locator(dialog)).toHaveCount(0);
+  });
+
+  test("an unverified file starts in its typed confirmation, which says why Replace is off", async ({ page }) => {
+    await open(page, "scenario=mods");
+    await goToTab(page, MODS_TAB);
+    await page.locator(".toolbar-actions button").first().click();
+    const input = page.locator(`${dialog} .dialog-actions input`);
+    await expect(input).toBeFocused();
+    // My Tweak is installed: the title, the button and the hint all say Replace.
+    await expect(page.locator(`${dialog} .dialog-title`)).toHaveText("Replace My Tweak with unverified mytweak.zip for v26.11.1?");
+    const install = page.locator(`${dialog} .btn-danger`);
+    await expect(install).toHaveText("Replace anyway");
+    await expect(install).toBeDisabled();
+    const why = await install.getAttribute("aria-describedby");
+    await expect(page.locator(`[id="${why}"]`)).toHaveText("Type mytweak to replace it anyway");
+    // What wasn't shown is said right above, without scrolling the checks.
+    await expect(page.getByTestId("typed-summary")).toContainText("Not shown to be safe");
+    await expect(page.getByTestId("typed-summary")).toContainText("Not in the Weft mod index");
+    await page.keyboard.type("mytweak");
+    await expect(install).toBeEnabled();
+    await page.keyboard.press("Enter");
+    await expect(page.locator(dialog)).toHaveCount(0, { timeout: 10_000 });
+  });
+
+  test("toggling a mod doesn't move its row", async ({ page }) => {
+    await open(page, "scenario=mods");
+    await goToTab(page, MODS_TAB);
+    const names = () => page.locator(".mod-list .mod-name").allInnerTexts();
+    const before = await names();
+    await page.locator(".mod-row", { hasText: "Cogwork" }).locator(".toggle").click();
+    await expect.poll(names).toEqual(before);
+  });
+});
+
+test.describe("degraded states", () => {
+  test("Sources says how old the index signature is, and why a source couldn't be refreshed", async ({ page }) => {
+    await open(page, "scenario=stale&source=ratelimited");
+    await goToTab(page, MODS_TAB);
+    await page.locator(".header-actions button", { hasText: "Sources" }).click();
+    await expect(page.getByTestId("index-meta")).toContainText(/signed Sep 21: revocations since then may be missing/);
+    const index = page.locator(".source-row").first();
+    // The index has its own state, never a mod's green Reviewed: signed, and amber when old.
+    await expect(index.locator(".badge[class*=trust-]")).toHaveCount(0);
+    await expect(index.locator(".index-badge")).toHaveClass(/stale/);
+    await expect(index.locator(".index-badge")).toHaveText("Signed Sep 21 · may be out of date");
+    await expect(index.locator("button", { hasText: "Retry" })).toHaveCount(1);
+    const source = page.locator(".source-row", { hasText: "lantern-dev/lanterns" });
+    // GitHub said when the limit ends: that is what the player needs.
+    await expect(source).toContainText(/GitHub is limiting requests until \d{1,2}:\d{2}( [AP]M)?, so lantern-dev\/lanterns couldn't be refreshed\./);
+    await expect(source.locator("button", { hasText: "Retry" })).toHaveCount(1);
+  });
+
+  test("a catalogue that fails to load offers Retry, not 'no mods'", async ({ page }) => {
+    await open(page, "scenario=mods&fail=catalog");
+    await goToTab(page, MODS_TAB);
+    await browse(page);
+    await expect(page.locator(".mods-panel button", { hasText: "Retry" })).toHaveCount(1);
+  });
+
+  test("removing a source asks first, and a bad or unknown repo fails inline", async ({ page }) => {
+    await open(page, "scenario=mods");
+    await goToTab(page, MODS_TAB);
+    await page.locator(".header-actions button", { hasText: "Sources" }).click();
+    await page.locator(".source-row button", { hasText: "Remove" }).click();
+    await expect(page.locator(".source-confirm")).toHaveCount(1);
+    await page.locator(".source-confirm .btn-danger").click();
+    await expect(page.locator(".source-row")).toHaveCount(1);
+    const input = page.locator(`${dialog} input`);
+    await input.fill("not a repo");
+    await page.keyboard.press("Enter");
+    await expect(page.locator(`${dialog} .inline-error`)).toContainText("Not a GitHub repo");
+    await input.fill("nobody/nothing-here");
+    await page.keyboard.press("Enter");
+    await expect(page.locator(`${dialog} .inline-error`)).toContainText("No such GitHub repo: nobody/nothing-here");
+  });
+});
+
+test.describe("sources", () => {
+  test("a fresh index is signed and verified, not Reviewed", async ({ page }) => {
+    await open(page, "scenario=mods");
+    await goToTab(page, MODS_TAB);
+    await page.locator(".header-actions button", { hasText: "Sources" }).click();
+    const badge = page.locator(".source-row").first().locator(".index-badge");
+    await expect(badge).toHaveClass(/ok/);
+    await expect(badge).toHaveText("Signed · verified Nov 4");
+    await expect(page.locator(`${dialog} .trust-reviewed`)).toHaveCount(0);
+  });
+
+  test("a source added is checked while the dialog is open, and one with no mods says why", async ({ page }) => {
+    await open(page, "scenario=mods");
+    await goToTab(page, MODS_TAB);
+    await page.locator(".header-actions button", { hasText: "Sources" }).click();
+    await page.locator(`${dialog} input`).fill("glow-team/fireflies");
+    await page.keyboard.press("Enter");
+    const row = page.locator(".source-row[data-repo='glow-team/fireflies']");
+    await expect(row).toHaveCount(1);
+    // Before Close: what GitHub has there, and what a source needs.
+    await expect(row.getByTestId("source-meta")).toHaveText(
+      "No compatible mod releases found: no release has an <id>.zip with its <id>.mod.json. What a source needs",
+      { timeout: 10_000 }
+    );
+    await expect(row.getByTestId("source-meta")).toHaveClass(/warn/);
+    await expect(row.locator(".link-btn", { hasText: "What a source needs" })).toHaveCount(1);
+  });
+
+  test("a damaged list of sources is kept and said, and a new one can be started", async ({ page }) => {
+    await open(page, "scenario=mods&fail=sources");
+    await goToTab(page, MODS_TAB);
+    // Said on the Mods tab too, never shown as "no sources".
+    await browse(page);
+    const toggle = page.locator(".banner-toggle");
+    if ((await toggle.getAttribute("aria-expanded")) === "false") await toggle.click();
+    await expect(page.locator(".banner-group .banner", { hasText: "Your list of sources couldn't be read" })).toHaveCount(1);
+    await page.locator(".header-actions button", { hasText: "Sources" }).click();
+    const d = page.locator(dialog);
+    await expect(d.locator(".inline-error")).toContainText("Your list of mod sources couldn't be read, so it was set aside and kept.");
+    await d.locator(".inline-error summary").click();
+    await expect(d.locator(".inline-error code")).toContainText("sources.damaged-");
+    await d.locator("input").fill("lantern-dev/lanterns");
+    await page.keyboard.press("Enter");
+    await expect(d.locator(".source-row[data-repo='lantern-dev/lanterns']")).toHaveCount(1);
+    await expect(d.locator(".inline-error")).toHaveCount(0);
+  });
+});
+
+test.describe("catalogue answers in any order", () => {
+  for (const race of ["stale", "error"] as const) {
+    test(`a slow refresh answering last (${race}) never replaces a newer one`, async ({ page }) => {
+      await open(page, `scenario=mods&race=${race}`);
+      await goToTab(page, MODS_TAB);
+      // The first refresh is slow; removing a source and closing asks a second one, which answers first.
+      await page.locator(".header-actions button", { hasText: "Sources" }).click();
+      await page.locator(".source-row button", { hasText: "Remove" }).click();
+      await page.locator(".source-confirm .btn-danger").click();
+      await expect(page.locator(".source-row")).toHaveCount(1);
+      await page.locator(`${dialog} .btn-secondary`, { hasText: "Close" }).click();
+      await expect(page.locator(".mods-refresh")).toBeEnabled({ timeout: 2000 });
+      // The slow one has answered by now, older (with every source rate limited) or failed.
+      await page.waitForTimeout(2600);
+      await browse(page);
+      await expect(page.locator(".banners")).not.toContainText("GitHub rate limit");
+      await expect(page.locator(".banners")).not.toContainText("Couldn't refresh");
+      await expect(page.locator(".mods-panel")).not.toContainText("lantern-dev/lanterns");
+      await expect(page.locator(".mods-refresh")).toBeEnabled();
+    });
+  }
+});
+
+test.describe("a slow source holds nothing back", () => {
+  test("a refresh shows the index and its revocations before a slow source answers", async ({ page }) => {
+    await open(page, "scenario=slowrefresh");
+    await goToTab(page, MODS_TAB);
+    const refresh = page.locator(".mods-refresh");
+    await expect(refresh).toHaveAttribute("title", "Still checking lantern-dev/lanterns…");
+    await expect(page.locator(`#${await refresh.getAttribute("aria-describedby")}`)).toHaveText("Still checking lantern-dev/lanterns…");
+    // The index the refresh brought pulled Cogwork: shown, and its set read again, at once.
+    await expect(page.locator(".mod-row[data-mod=cogwork] .badge.revoked")).toBeVisible();
+    await expect(refresh).toHaveClass(/pending/);
+    // Sources says which one is still being asked.
+    await page.locator(".header-actions button", { hasText: "Sources" }).click();
+    await expect(page.locator(dialog)).toContainText("checking…");
+    await page.keyboard.press("Escape");
+    // Then the source answers, and nothing is left waiting.
+    await expect(refresh).not.toHaveClass(/pending/, { timeout: 8_000 });
+    await expect(refresh).toHaveAttribute("title", "Check for new mods");
+  });
+});
+
+test.describe("one source at a time", () => {
+  test("a source's own Retry runs alone, says so, and leaves everything else usable", async ({ page }) => {
+    await open(page, "scenario=mods&source=ratelimited&slowsource=lantern-dev/lanterns");
+    await goToTab(page, MODS_TAB);
+    await page.locator(".header-actions button", { hasText: "Sources" }).click();
+    const row = page.locator(".source-row[data-repo='lantern-dev/lanterns']");
+    const retry = row.getByRole("button", { name: "Ask lantern-dev/lanterns again" });
+    await retry.click();
+    await expect(retry).toHaveText("Retrying…");
+    await expect(retry).toBeDisabled();
+    await expect(row.getByTestId("source-meta")).toHaveText("checking…");
+    // The whole catalogue isn't being refreshed: its own button stays usable.
+    await expect(page.locator(".mods-refresh")).toBeEnabled();
+    await expect(retry).toHaveText("Retry", { timeout: 5000 });
+    await expect(row).toContainText("GitHub is limiting requests");
+  });
+
+  test("the banner for one source retries that source only", async ({ page }) => {
+    await open(page, "scenario=mods&source=ratelimited&slowsource=lantern-dev/lanterns");
+    await goToTab(page, MODS_TAB);
+    await browse(page);
+    const toggle = page.locator(".banner-toggle");
+    if ((await toggle.getAttribute("aria-expanded")) === "false") await toggle.click();
+    const retry = page.locator(".banners").getByRole("button", { name: "Ask lantern-dev/lanterns again" }).first();
+    await retry.click();
+    await expect(retry).toHaveText("Retrying…");
+    await expect(page.locator(".mods-refresh")).toBeEnabled();
+    await expect(retry).toHaveText("Retry", { timeout: 5000 });
+  });
+
+  const NO_MODS = {
+    noReleases: "it has no releases yet.",
+    noModFiles: "no release has an <id>.zip with its <id>.mod.json.",
+    unreadable: "a release's <id>.mod.json couldn't be read.",
+    noDigest: "GitHub has no SHA-256 for its zips, so they can't be checked.",
+    disagrees: "a release's <id>.mod.json doesn't match that release on GitHub.",
+    invalid: "its releases break a rule every mod follows.",
+  };
+  for (const [reason, words] of Object.entries(NO_MODS)) {
+    test(`a source with no mods says why: ${reason}`, async ({ page }) => {
+      await open(page, `scenario=mods&nomods=${reason}`);
+      await goToTab(page, MODS_TAB);
+      await page.locator(".header-actions button", { hasText: "Sources" }).click();
+      const meta = page.locator(".source-row[data-repo='lantern-dev/lanterns']").getByTestId("source-meta");
+      await expect(meta).toContainText(`No compatible mod releases found: ${words}`);
+      await expect(meta).toHaveClass(/warn/);
+    });
+  }
+
+  test("an index in use but not saved says so, and what that means offline", async ({ page }) => {
+    await open(page, "scenario=mods&index=unsaved");
+    await goToTab(page, MODS_TAB);
+    await browse(page);
+    await expect(page.locator(".banners")).toContainText("Mod index not saved");
+    await page.locator(".header-actions button", { hasText: "Sources" }).click();
+    await expect(page.getByTestId("index-meta")).toContainText("Checked on this refresh. It couldn't be saved on this computer");
+    await page.getByTestId("index-meta").locator("summary").click();
+    await expect(page.getByTestId("index-meta").locator("code")).not.toBeEmpty();
+  });
+});
+
+test.describe("network down is not index down", () => {
+  test("offline, a download says it needs the internet", async ({ page }) => {
+    await open(page, "scenario=offline");
+    await goToTab(page, MODS_TAB);
+    await browse(page);
+    await expect(page.locator(".banners")).toContainText("Offline: mod index from Nov 2");
+    await expect(page.locator(".mods-panel").getByText("needs internet").first()).toBeVisible();
+  });
+
+  test("an index the server doesn't have never says the internet is down", async ({ page }) => {
+    await open(page, "scenario=indexdown");
+    await goToTab(page, MODS_TAB);
+    await browse(page);
+    await expect(page.locator(".banners")).toContainText("No mod index (server said 404): no Reviewed mods");
+    await expect(page.locator(".banners")).not.toContainText("unreachable");
+    await expect(page.locator(".mods-panel")).not.toContainText("needs internet");
+  });
+
+  test("an index that can't be reached while a source answers is unreachable, but downloads still work", async ({ page }) => {
+    await open(page, "scenario=mods&index=unreachable");
+    await goToTab(page, MODS_TAB);
+    await browse(page);
+    await expect(page.locator(".banners")).toContainText("Index unreachable: no Reviewed mods");
+    await expect(page.locator(".mods-panel")).not.toContainText("needs internet");
+  });
+});
+
+test.describe("icons", () => {
+  test("icons come only from GitHub's hosts: one elsewhere is never asked for", async ({ page }) => {
+    await open(page, "scenario=mods");
+    await goToTab(page, MODS_TAB);
+    await browse(page);
+    await expect(page.locator(".mod-card", { hasText: "Cogwork" }).locator("img")).toHaveCount(1);
+    const asked = await page.evaluate(() => (window as unknown as { mockIconRequests: string[] }).mockIconRequests);
+    expect(asked.length).toBeGreaterThan(0);
+    for (const url of asked) expect(new URL(url).hostname).toMatch(/(^|\.)(github\.com|githubusercontent\.com|github\.io)$/);
+  });
+});
+
+test.describe("results never move the list", () => {
+  const FIXED = [".mods-page .version-select", ".switch", ".banners", ".mods-panel"];
+  for (const locale of LOCALES) {
+    test(`a result is a toast over the list, which keeps its place and room for its last row, in ${locale}`, async ({ page }) => {
+      // The busiest Installed: a blocker with a pager, the folded notes, and then a result.
+      await open(page, "scenario=shadowed", locale);
+      await goToTab(page, MODS_TAB);
+      await expect(page.locator(".mod-row").first()).toBeVisible();
+      const before = await tops(page, FIXED);
+      const remove = page.locator(".mod-row[data-mod=structures] .delete-btn");
+      await confirmRemove(page, remove);
+      const toast = page.locator(".toasts .toast");
+      await expect(toast).toHaveCount(1);
+      // Nothing above the list moved, nor its first row.
+      expect(await tops(page, FIXED)).toEqual(before);
+      expect(await cutButtons(page, ".toasts"), "toast buttons in view").toEqual([]);
+      // Scrolled to its end, the last row's buttons are clear of the toast.
+      await page.locator(".mods-panel").evaluate((e) => (e.scrollTop = e.scrollHeight));
+      expect(await cutButtons(page, ".mod-row:last-child"), "the last row's buttons").toEqual([]);
+    });
+  }
+
+  test("an install keeps the version picker and the switch where they are", async ({ page }) => {
+    await open(page, "scenario=mods");
+    await goToTab(page, MODS_TAB);
+    await expect(page.locator(".mod-row").first()).toBeVisible();
+    const before = await tops(page, FIXED);
+    await page.locator(".mod-row[data-mod=structures] .update-btn-row").click();
+    await page.locator(`${dialog} .dialog-actions .btn-primary`).click();
+    await expect(page.locator(dialog)).toHaveCount(0, { timeout: 15_000 });
+    await expect(page.locator(".toasts .toast")).toHaveCount(1);
+    expect(await tops(page, FIXED)).toEqual(before);
+    await page.locator(".mods-panel").evaluate((e) => (e.scrollTop = 0));
+    expect(await fullRows(page)).toBeGreaterThanOrEqual(3);
+  });
+});
diff --git a/e2e/helpers.ts b/e2e/helpers.ts
new file mode 100644
index 0000000..10039d8
--- /dev/null
+++ b/e2e/helpers.ts
@@ -0,0 +1,254 @@
+import { expect, type Locator, type Page } from "@playwright/test";
+
+export const LOCALES = ["en", "pt-BR", "es", "ru"] as const;
+
+/** Opens the launcher on a mock scenario, in a language, and fails the test on any page error. */
+export async function open(page: Page, query: string, locale = "en") {
+  const errors: string[] = [];
+  page.on("pageerror", (e) => errors.push(e.message));
+  await page.addInitScript((l) => localStorage.setItem("locale", l), locale);
+  await page.goto(`/?${query}`);
+  await expect(page.locator(".tab-btn").first()).toBeVisible();
+  return errors;
+}
+
+/** Waits until the mock has answered every command the page sent, e.g. the start-up refresh. */
+export async function settled(page: Page) {
+  await page.evaluate(() => (window as unknown as { mockSettled(): Promise<void> }).mockSettled());
+}
+
+export async function goToTab(page: Page, index: number) {
+  await page.locator(".tab-btn").nth(index).click();
+}
+
+export const VERSIONS_TAB = 1;
+export const MODS_TAB = 2;
+
+export async function browse(page: Page) {
+  await page.locator(".switch [role=tab]").nth(1).click();
+  await expect(page.locator("#mods-panel-browse")).toBeVisible();
+}
+
+/** What has keyboard focus, and whether it is inside the open dialog. */
+export const focused = (page: Page) =>
+  page.evaluate(() => {
+    const a = document.activeElement;
+    return {
+      tag: a?.tagName ?? "",
+      text: a?.textContent?.trim() ?? "",
+      label: a?.getAttribute("aria-label") ?? "",
+      inDialog: !!a?.closest("[role=dialog]"),
+      row: a?.closest("[data-mod]")?.getAttribute("data-mod") ?? null,
+    };
+  });
+
+/** Nothing sticks out sideways, and the dialog's buttons (if one is open) are inside the window. */
+export async function expectFits(page: Page) {
+  const overflow = await page.evaluate(() => document.documentElement.scrollWidth - window.innerWidth);
+  expect(overflow, "page scrolls sideways").toBeLessThanOrEqual(0);
+  const actions = page.locator("[role=dialog] .dialog-actions");
+  if (await actions.count()) {
+    const box = await actions.boundingBox();
+    const viewport = page.viewportSize()!;
+    expect(box, "dialog actions are rendered").not.toBeNull();
+    expect(box!.y + box!.height, "dialog actions are below the window").toBeLessThanOrEqual(viewport.height);
+  }
+}
+
+/** On Browse, the banners leave room for two whole rows of cards, when there are that many. */
+export async function expectTwoCardRows(page: Page) {
+  const { total, visible } = await page.locator(".mod-card").evaluateAll((cards) => ({
+    total: cards.length,
+    visible: cards.filter((c) => c.getBoundingClientRect().bottom <= window.innerHeight).length,
+  }));
+  expect(visible, `whole cards in view (of ${total})`).toBeGreaterThanOrEqual(Math.min(4, total));
+}
+
+/** An element is inside the window, not below the fold. */
+export async function expectInView(page: Page, selector: string) {
+  const box = await page.locator(selector).first().boundingBox();
+  expect(box, `${selector} is rendered`).not.toBeNull();
+  expect(box!.y + box!.height, `${selector} is below the window`).toBeLessThanOrEqual(page.viewportSize()!.height);
+}
+
+/** How many installed rows are wholly inside the list's scroll box, above any toast over it. */
+export const fullRows = (page: Page) =>
+  page.evaluate(() => {
+    const box = document.querySelector(".mods-panel")!.getBoundingClientRect();
+    const toasts = document.querySelector<HTMLElement>(".toasts:not([hidden])");
+    const bottom = Math.min(box.bottom, window.innerHeight, toasts ? toasts.getBoundingClientRect().top : Infinity);
+    return [...document.querySelectorAll(".mod-row")].filter((r) => {
+      const b = r.getBoundingClientRect();
+      return b.top >= box.top - 0.5 && b.bottom <= bottom + 0.5;
+    }).length;
+  });
+
+/**
+ * Buttons in `scope` that aren't wholly visible: cut by an ancestor that clips (a scroller, a
+ * clamp), by the window, or covered by something drawn over them. Empty when every one can be
+ * seen and pressed in full.
+ */
+export const cutButtons = (page: Page, scope: string) =>
+  page.evaluate((scope) => {
+    const bad: string[] = [];
+    for (const root of document.querySelectorAll(scope)) {
+      for (const b of root.querySelectorAll<HTMLElement>("button")) {
+        const r = b.getBoundingClientRect();
+        if (!r.width || !r.height || b.closest("[hidden], .sr-only")) continue;
+        const name = (b.getAttribute("aria-label") || b.textContent || "").trim().slice(0, 40);
+        const outside = (c: DOMRect) => r.top < c.top - 0.5 || r.bottom > c.bottom + 0.5 || r.left < c.left - 0.5 || r.right > c.right + 0.5;
+        if (outside(new DOMRect(0, 0, window.innerWidth, window.innerHeight))) {
+          bad.push(`${name}: outside the window`);
+          continue;
+        }
+        for (let a = b.parentElement; a && a !== document.body; a = a.parentElement) {
+          const s = getComputedStyle(a);
+          if (/(auto|scroll|hidden|clip)/.test(s.overflowX + s.overflowY) && outside(a.getBoundingClientRect())) {
+            bad.push(`${name}: cut by .${a.className.split(" ").join(".")}`);
+            break;
+          }
+        }
+        // Nothing drawn over its corners and middle.
+        const points = [[r.left + 2, r.top + 2], [r.right - 2, r.top + 2], [r.left + 2, r.bottom - 2], [r.right - 2, r.bottom - 2], [(r.left + r.right) / 2, (r.top + r.bottom) / 2]];
+        if (points.some(([x, y]) => { const hit = document.elementFromPoint(x, y); return !hit || !b.contains(hit); })) bad.push(`${name}: covered`);
+      }
+    }
+    return [...new Set(bad)];
+  }, scope);
+
+/**
+ * Every page of the Mods tab's blocker banner, each with all its fix buttons wholly in view. Goes
+ * through the pager and back to the first page.
+ */
+export async function expectBlockerFixesInView(page: Page) {
+  const banner = page.locator(".blockers.in-banner");
+  if (!(await banner.count())) return;
+  const pager = banner.locator(".blocker-pager");
+  const pages = (await pager.count()) ? Number((await pager.locator(".pager-at").innerText()).match(/\d+/g)!.at(-1)) : 1;
+  const seen = new Set<string>();
+  for (let i = 0; i < pages; i++) {
+    const id = (await banner.locator(".blocker").getAttribute("data-blocker"))!;
+    seen.add(id);
+    expect(await banner.locator(".blocker-actions button").count(), `${id} has fixes`).toBeGreaterThan(0);
+    expect(await cutButtons(page, ".blockers.in-banner"), `fixes of ${id} in view`).toEqual([]);
+    if (pages > 1) await pager.locator("button").last().click();
+  }
+  expect(seen.size, "the pager reaches every blocking mod").toBe(pages);
+}
+
+/** Where some elements are, to check they don't move. */
+export const tops = (page: Page, selectors: string[]) =>
+  page.evaluate((s) => s.map((sel) => Math.round(document.querySelector(sel)?.getBoundingClientRect().top ?? -1)), selectors);
+
+/** What the one polite live region says now. */
+export const spoken = (page: Page) => page.getByTestId("live-region");
+
+/**
+ * Text on screen with less contrast than WCAG AA asks against what is behind it: 4.5:1, or 3:1
+ * for large text (24px and up, or 18.66px and up in bold). What is seen is what is measured: the
+ * colour's own alpha and the opacity of the element and every ancestor are composited over the
+ * background, the first opaque one up the tree. Text on an image, disabled controls and text
+ * that is being animated (a pulse) aren't checked. `within` limits it to text inside a selector.
+ */
+export const lowContrast = (page: Page, min = 4.5, large = 3, within = "body") =>
+  page.evaluate(
+    ([min, large, within]) => {
+      const rgb = (c: string) => (c.match(/[\d.]+/g) ?? []).map(Number);
+      const lum = ([r, g, b]: number[]) => {
+        const f = (v: number) => ((v /= 255) <= 0.03928 ? v / 12.92 : ((v + 0.055) / 1.055) ** 2.4);
+        return 0.2126 * f(r) + 0.7152 * f(g) + 0.0722 * f(b);
+      };
+      const bg = (el: Element | null): number[] | null => {
+        for (; el; el = el.parentElement) {
+          const s = getComputedStyle(el);
+          if (s.backgroundImage !== "none" && el !== document.body && el !== document.documentElement) return null;
+          const c = rgb(s.backgroundColor);
+          if (c.length >= 3 && (c.length < 4 || c[3] === 1)) return c;
+        }
+        return [0, 0, 0];
+      };
+      const opacity = (el: Element | null) => {
+        let a = 1;
+        for (; el; el = el.parentElement) a *= parseFloat(getComputedStyle(el).opacity);
+        return a;
+      };
+      const animated = new Set(document.getAnimations().map((a) => (a.effect as KeyframeEffect | null)?.target).filter(Boolean));
+      const moving = (el: Element | null) => {
+        for (; el; el = el.parentElement) if (animated.has(el)) return true;
+        return false;
+      };
+      const bad: string[] = [];
+      const walker = document.createTreeWalker(document.body, NodeFilter.SHOW_TEXT);
+      for (let n = walker.nextNode(); n; n = walker.nextNode()) {
+        const el = n.parentElement;
+        if (!el || !n.textContent?.trim() || !el.closest(within)) continue;
+        const s = getComputedStyle(el);
+        if (s.visibility === "hidden" || el.closest(".sr-only, [aria-hidden=true], :disabled, [hidden]")) continue;
+        const r = el.getBoundingClientRect();
+        if (!r.width || r.bottom < 0 || r.top > window.innerHeight) continue;
+        const back = bg(el);
+        if (!back || moving(el)) continue;
+        const [fr, fg, fb, fa = 1] = rgb(s.color);
+        const a = fa * opacity(el);
+        const seen = [fr, fg, fb].map((v, k) => v * a + back[k] * (1 - a));
+        const [hi, lo] = [lum(seen), lum(back)].sort((x, y) => y - x);
+        const ratio = (hi + 0.05) / (lo + 0.05);
+        const size = parseFloat(s.fontSize);
+        const big = size >= 24 || (size >= 18.66 && Number(s.fontWeight) >= 700);
+        if (ratio < (big ? large : min)) bad.push(`${el.className || el.tagName}: "${n.textContent.trim().slice(0, 30)}" ${ratio.toFixed(2)}${big ? " (large)" : ""}`);
+      }
+      return [...new Set(bad)];
+    },
+    [min, large, within] as const
+  );
+
+/**
+ * Remove, then confirm: two separate presses (the second click of a double-click doesn't
+ * confirm, so a double-click can't remove a mod).
+ */
+export async function confirmRemove(_page: Page, button: Locator) {
+  await button.click();
+  await expect(button).toHaveClass(/confirming/);
+  await button.click();
+}
+
+/**
+ * Elements marked `data-must-fit` (a tier word, a reason, a version, a cause, an installed mod's
+ * name, an error) that don't show whole: their text is wider or taller than their own box, or an
+ * ancestor that clips cuts them. Ancestors that scroll end the search: what is in a scroller is
+ * reached by scrolling. So does a fixed ancestor, which only the window clips. Empty when every one is whole.
+ */
+export const unfit = (page: Page) =>
+  page.evaluate(() => {
+    const bad: string[] = [];
+    for (const el of document.querySelectorAll<HTMLElement>("[data-must-fit]")) {
+      if (!el.getClientRects().length || el.closest("[hidden], .sr-only")) continue;
+      const name = `${el.className || el.tagName} "${(el.textContent ?? "").trim().slice(0, 40)}"`;
+      if (getComputedStyle(el).display !== "inline") {
+        if (el.scrollWidth > el.clientWidth + 0.5) bad.push(`${name}: wider than its box (${el.scrollWidth} > ${el.clientWidth})`);
+        if (el.scrollHeight > el.clientHeight + 0.5) bad.push(`${name}: taller than its box (${el.scrollHeight} > ${el.clientHeight})`);
+      }
+      const r = el.getBoundingClientRect();
+      for (let a = el.parentElement; a && a !== document.body; a = a.parentElement) {
+        const s = getComputedStyle(a);
+        const overflow = s.overflowX + " " + s.overflowY;
+        if (/auto|scroll/.test(overflow)) break;
+        if (!/hidden|clip/.test(overflow)) {
+          // A fixed box (a dialog's scrim) is placed by the window: no ancestor above it clips it.
+          if (s.position === "fixed") break;
+          continue;
+        }
+        const c = a.getBoundingClientRect();
+        if (r.left < c.left - 0.5 || r.right > c.right + 0.5 || r.top < c.top - 0.5 || r.bottom > c.bottom + 0.5) {
+          bad.push(`${name}: cut by .${String(a.className).split(" ").join(".")}`);
+          break;
+        }
+      }
+    }
+    return [...new Set(bad)];
+  });
+
+/** Every element that must show whole does. */
+export async function expectWhole(page: Page, where: string) {
+  expect(await unfit(page), `cut on ${where}`).toEqual([]);
+}
diff --git a/e2e/scenarios.spec.ts b/e2e/scenarios.spec.ts
new file mode 100644
index 0000000..f6e3771
--- /dev/null
+++ b/e2e/scenarios.spec.ts
@@ -0,0 +1,355 @@
+// Every mock scenario, in every language: it renders without errors, nothing overflows the
+// 960×565 window, nothing that carries meaning is cut (`data-must-fit`: tiers, Revoked, reasons,
+// causes, installed names, versions, errors) on Home, Installed or Browse, Installed keeps four
+// whole rows under every banner of the busiest scenarios (three elsewhere) and Browse two rows of
+// cards, small text is readable, and the state the scenario exists for is on screen. Text is checked in English; the other languages check the same state
+// by structure, since their words differ.
+import { expect, test, type Page } from "@playwright/test";
+import { SCENARIOS } from "../src/dev/scenarios";
+import { LOCALES, MODS_TAB, browse, cutButtons, expectBlockerFixesInView, expectFits, expectTwoCardRows, expectWhole, fullRows, goToTab, lowContrast, open, tops } from "./helpers";
+
+type Check = (page: Page, en: boolean) => Promise<void>;
+interface Checks {
+  home?: Check;
+  installed?: Check;
+  browse?: Check;
+}
+
+const row = (page: Page, name: string) => page.locator(".mod-row", { hasText: name });
+
+/** The scenarios with the most banners over Installed: four whole rows under them all. */
+const BUSIEST = ["mods", "offline", "shadowed", "missingdep", "revoked"];
+
+/** Rows whose red reason shows less than its first line: "Built f…". */
+const cutReasons = (page: Page) =>
+  page.locator(".mod-meta.bad").evaluateAll((els) =>
+    els
+      .filter((e) => {
+        const style = getComputedStyle(e);
+        const line = parseFloat(style.lineHeight);
+        // Cut on its first line (one-line ellipsis, or a clamp that couldn't wrap at all).
+        return e.scrollWidth > e.clientWidth + 1 || (e.scrollHeight > e.clientHeight + 1 && e.clientHeight < line * 2 - 1);
+      })
+      .map((e) => e.closest("[data-mod]")?.getAttribute("data-mod") ?? "?")
+  );
+const openNotes = async (page: Page) => {
+  const toggle = page.locator(".banner-toggle");
+  if ((await toggle.getAttribute("aria-expanded")) === "false") await toggle.click();
+  return page.locator(".banner-group .banner");
+};
+
+const CHECKS: Record<string, Checks> = {
+  long: {
+    installed: async (page) => {
+      // A very long name has the row's width, so it wraps once, not into a narrow column.
+      const rows = page.locator(".mod-row.long-name");
+      expect(await rows.count()).toBeGreaterThan(0);
+      for (const name of await rows.locator(".mod-name").all()) {
+        const lines = await name.evaluate((e) => Math.round(e.getBoundingClientRect().height / parseFloat(getComputedStyle(e).lineHeight)));
+        expect(lines, "lines of a long name").toBeLessThanOrEqual(2);
+      }
+    },
+  },
+  mods: {
+    home: async (page, en) => {
+      await expect(page.locator(".btn-play")).toBeDisabled();
+      await expect(page.locator(".blockers .blocker strong")).toHaveText(["Lanterns"]);
+      if (en) await expect(page.locator(".hero-version-badge")).toContainText("MODS NEED A FIX");
+    },
+    installed: async (page, en) => {
+      await expect(page.locator(".mod-row")).toHaveCount(5);
+      // The same fixes as Home, right above the rows.
+      await expect(page.locator(".blockers.in-banner .blocker-actions button")).toHaveCount(2);
+      await expect(page.locator(".blockers.in-banner .blocker-pager")).toHaveCount(0);
+      if (en) await expect(page.locator(".blockers.in-banner")).toContainText("Update to 1.1.0…");
+    },
+  },
+  empty: {
+    installed: async (page, en) => {
+      await expect(page.locator(".framed-empty .empty-actions button")).toHaveCount(2);
+      await expect(page.locator(".framed-empty .empty-actions .btn-secondary")).toContainText("v26.10.4");
+      if (en) await expect(page.locator(".framed-empty")).toContainText("No mods for v26.11.1 yet.");
+    },
+  },
+  fresh: {
+    home: async (page, en) => {
+      await expect(page.locator(".hero.empty button")).toHaveCount(1);
+      if (en) await expect(page.locator(".hero.empty")).toContainText("No versions installed.");
+    },
+  },
+  offline: {
+    browse: async (page, en) => {
+      // Offline leads the folded row, also with a blocker among the notes.
+      if (en) await expect(page.locator(".banner.compact")).toContainText(/^Offline: mod index from Nov 2/);
+      const notes = await openNotes(page);
+      const texts = await notes.allInnerTexts();
+      const at = (s: RegExp) => texts.findIndex((x) => s.test(x));
+      if (en) {
+        // The player's own folder is last.
+        expect(at(/Showing the mod index from Nov 2/)).toBe(0);
+        expect(at(/stops Play/)).toBe(1);
+        expect(at(/Showing its mods from/)).toBe(2);
+        expect(at(/own Weft mods folder/)).toBe(3);
+      }
+      expect(texts.length).toBe(4);
+      // Every install button says it needs the network, and is described by that.
+      const buttons = page.locator(".mod-card .btn-primary");
+      expect(await buttons.count()).toBeGreaterThan(0);
+      for (const b of await buttons.all()) {
+        const why = await b.getAttribute("aria-describedby");
+        await expect(page.locator(`[id="${why}"]`)).toHaveClass(/needs-net/);
+      }
+      if (en) await expect(page.locator(".needs-net").first()).toHaveText("needs internet");
+    },
+  },
+  crash: {
+    home: async (page, en) => {
+      await expect(page.locator(".btn-play")).toBeEnabled();
+      if (en) await expect(page.locator(".mods-line")).toContainText("Cogwork, My Tweak, and Structures");
+    },
+  },
+  knownfile: {
+    installed: async (page) => {
+      await expect(page.locator(".mod-row")).toHaveCount(3);
+    },
+  },
+  revoked: {
+    installed: async (page, en) => {
+      const cogwork = row(page, "Cogwork");
+      // Revoked in place of the tier, and it can't be turned on.
+      await expect(cogwork.locator(".badge.revoked")).toHaveCount(1);
+      await expect(cogwork.locator(".badge[class*=trust-]")).toHaveCount(0);
+      await expect(cogwork.locator(".toggle")).toBeDisabled();
+      if (en) {
+        await expect(cogwork.locator(".mod-meta")).toContainText("Turned off, pulled from the index: “Corrupts worlds");
+        await expect(cogwork.locator(".update-btn-row")).toHaveText("0.2.1");
+        await expect(cogwork.locator(".update-btn-row")).toHaveAttribute("aria-label", "Update Cogwork to 0.2.1 for v26.11.1…");
+      }
+    },
+  },
+  ratelimited: {
+    browse: async (page, en) => {
+      const notes = await openNotes(page);
+      if (en) await expect(notes.filter({ hasText: "GitHub is limiting requests" })).toHaveCount(1);
+    },
+  },
+  indexdown: {
+    browse: async (page, en) => {
+      // Never behind "More": it leads the one banner row, with its Retry.
+      const lead = page.locator(".banner.compact");
+      await expect(lead).toHaveClass(/warn/);
+      await expect(lead.locator(".banner-actions button")).toHaveCount(1);
+      // Pages answered 404: the network works, so it never says unreachable or offline.
+      if (en) await expect(lead).toContainText("No mod index (server said 404): no Reviewed mods");
+      // Under the cards, where Reviewed mods would be: why there are none, and when they come.
+      await expect(page.getByTestId("browse-no-index")).toBeVisible();
+      if (en) await expect(page.getByTestId("browse-no-index")).toHaveText("Reviewed mods appear here once the Weft mod index can be fetched.");
+      await expect(page.locator(".mod-card .trust-reviewed")).toHaveCount(0);
+    },
+  },
+  stale: {
+    installed: async (page, en) => {
+      if (en) await expect(page.locator(".banner.compact")).toContainText(/^Mod index signed Sep 21/);
+    },
+  },
+  // A refused index is a warning that says it was refused, never "Offline": the network worked.
+  invalid: {
+    installed: async (page, en) => {
+      const lead = page.locator(".banner.compact", { has: page.locator(".banner-actions button", { hasText: /./ }) }).filter({ hasNotText: /stops Play/ }).first();
+      await expect(lead).toHaveClass(/warn/);
+      if (en) await expect(lead).toContainText("Index refused: using the copy from Nov 2");
+      await expect(page.locator(".banner", { hasText: /Offline/ })).toHaveCount(0);
+    },
+  },
+  rollback: {
+    installed: async (page, en) => {
+      if (en) await expect(page.locator(".banner.compact", { hasText: "Index refused" })).toHaveClass(/warn/);
+      await expect(page.locator(".banner", { hasText: /Offline/ })).toHaveCount(0);
+    },
+  },
+  missingdep: {
+    home: async (page, en) => {
+      await expect(page.locator(".btn-play")).toBeDisabled();
+      const blocker = (name: string) => page.locator(".blocker", { has: page.locator("strong", { hasText: name }) });
+      await expect(page.locator(".blocker")).toHaveCount(3);
+      await expect(blocker("Hearth").locator("button")).toHaveCount(2);
+      await expect(blocker("Lanterns").locator("button")).toHaveCount(2);
+      await expect(blocker("Railways").locator("button")).toHaveCount(1);
+      if (en) {
+        // One whole sentence per reason, naming the mod.
+        await expect(blocker("Hearth")).toContainText("Hearth stops Play: it needs Cogwork, which is off.");
+        await expect(blocker("Hearth").locator("button").first()).toHaveText("Turn on Cogwork");
+        await expect(blocker("Lanterns")).toContainText("Lanterns stops Play: it needs Glowmoss, which isn't installed.");
+        await expect(blocker("Lanterns").locator("button").first()).toHaveText("Install Glowmoss…");
+        await expect(blocker("Railways")).toContainText("Railways stops Play: it needs Signals, which has no build for v26.11.1 yet.");
+      }
+    },
+  },
+  shadowed: {
+    home: async (page, en) => {
+      await expect(page.locator(".btn-play")).toBeDisabled();
+      // What loads includes the player's own folder, which loads in every version.
+      if (en) await expect(page.locator(".mods-line")).toContainText(", and 1 file from your own folder");
+    },
+    installed: async (page, en) => {
+      // The copy in the player's folder blocks, with a fix that shows that file: one page on.
+      const banner = page.locator(".blockers.in-banner");
+      await expect(banner.locator(".pager-at")).toHaveText(/^1\D+2$/);
+      // Cogwork first, the one that blocks itself; then Hearth, which needs it.
+      await expect(banner.locator(".blocker")).toHaveAttribute("data-blocker", "cogwork");
+      const blocker = banner.locator(".blocker[data-blocker=cogwork]");
+      await expect(blocker.locator(".blocker-actions button")).toHaveCount(2);
+      await expect(page.locator(".mod-row[data-mod=cogwork]")).toHaveAttribute("data-shadowed", "true");
+      if (en) {
+        // Collapsed, the folder's banner still says what matters most: those files load everywhere.
+        await expect(page.locator(".banners")).toContainText("Own folder: 1 file, loads in every version");
+        await expect(blocker).toContainText("Cogwork stops Play: it was pulled from the index, but the copy in your own mods folder (cogwork-old.zip) would load instead.");
+        await expect(blocker.locator(".blocker-actions button").nth(1)).toHaveText("Show cogwork-old.zip");
+      }
+    },
+  },
+  chain: {
+    browse: async (page) => {
+      await expect(page.locator(".mod-card[data-key*=chimneys], .mod-card[data-key*=junctions]")).toHaveCount(2);
+    },
+  },
+  lateblock: {
+    home: async (page) => {
+      await expect(page.locator(".btn-play")).toBeEnabled();
+      await expect(page.locator(".blocker")).toHaveCount(0);
+    },
+  },
+};
+
+// One verb for copying a set, in every language: a copy, never a move («Перенести»).
+const COPY_FROM: Record<(typeof LOCALES)[number], string> = {
+  en: "Copy mods from…",
+  "pt-BR": "Copiar mods de…",
+  es: "Copiar mods de…",
+  ru: "Скопировать моды из…",
+};
+
+/** Shown check rows (and the passed-checks line) of the open dialog that need a scroll to see. */
+const checksBelowFold = (page: Page) =>
+  page.evaluate(() => {
+    const body = document.querySelector("[role=dialog] .dialog-body")!.getBoundingClientRect();
+    return [...document.querySelectorAll<HTMLElement>("[role=dialog] .check:not([hidden])")]
+      .filter((c) => c.getBoundingClientRect().bottom > body.bottom + 0.5)
+      .map((c) => c.dataset.check);
+  });
+
+for (const locale of LOCALES) {
+  for (const scenario of SCENARIOS) {
+    test(`${scenario.name} in ${locale}`, async ({ page }) => {
+      const en = locale === "en";
+      const checks = CHECKS[scenario.name] ?? {};
+      const errors = await open(page, `scenario=${scenario.name}`, locale);
+      await expectFits(page);
+      await checks.home?.(page, en);
+      await expectWhole(page, "Home");
+      await goToTab(page, MODS_TAB);
+      await expect(page.locator(".mods-page")).toBeVisible();
+      await expectFits(page);
+      if (await page.locator(".switch [role=tab]").count()) {
+        await expect(page.locator(".mod-row, .framed-empty").first()).toBeVisible();
+        // However many banners, four whole rows stay in view in the busiest scenarios and three
+        // elsewhere (or all of them, if fewer). Very long names wrap whole, so two there.
+        const rows = await page.locator(".mod-row").count();
+        const want = BUSIEST.includes(scenario.name) ? 4 : scenario.name === "long" ? 2 : 3;
+        expect(await fullRows(page), "whole rows in view").toBeGreaterThanOrEqual(Math.min(want, rows));
+        await expectWhole(page, "Installed");
+        // Every fix of every blocking mod, and every banner's button, wholly in view.
+        await expectBlockerFixesInView(page);
+        expect(await cutButtons(page, ".banners"), "banner buttons in view").toEqual([]);
+        // A row's reason is never cut after a few letters: it has a line of its own, two when needed.
+        if (scenario.name !== "long") expect(await cutReasons(page), "reasons cut short").toEqual([]);
+        await checks.installed?.(page, en);
+        expect(await lowContrast(page), "text under 4.5:1 (3:1 when large)").toEqual([]);
+        await browse(page);
+        await expect(page.locator(".mod-card").first()).toBeVisible();
+        await expectFits(page);
+        await expectTwoCardRows(page);
+        if (scenario.name !== "long") {
+          // Names have the card's width: the tier and source sit on the line below.
+          await expect(page.locator(".mod-card .mod-name[tabindex='0']"), "cut names").toHaveCount(0);
+        }
+        // Who a mod is from and why there is nothing to install (e.g. "Prereleases only") are whole
+        // on every card: they wrap rather than being cut, and nothing about them is a tab stop.
+        expect(await page.locator(".mod-card-by[data-must-fit]").count()).toBe(await page.locator(".mod-card").count());
+        await checks.browse?.(page, en);
+        await expectWhole(page, "Browse");
+        expect(await lowContrast(page), "text under 4.5:1 (3:1 when large)").toEqual([]);
+      }
+      expect(errors).toEqual([]);
+    });
+  }
+
+  test(`the Mods header stays put and blockers stay bounded in ${locale}`, async ({ page }) => {
+    await open(page, "scenario=missingdep", locale);
+    await goToTab(page, MODS_TAB);
+    await expect(page.locator(".mod-row").first()).toBeVisible();
+    // The switch and the toolbar share one line, in every language.
+    const [sw, actions] = await tops(page, [".switch", ".toolbar-actions"]);
+    expect(Math.abs(sw - actions), "toolbar wrapped").toBeLessThanOrEqual(8);
+    // Three blockers: one at a time, with a pager, so the banner stays a few lines tall whichever
+    // is shown, and four rows still show below it on every page.
+    const banner = page.locator(".blockers.in-banner");
+    await expect(banner.locator(".pager-at")).toHaveText(/^1\D+3$/);
+    const heights = new Set<number>();
+    for (let i = 0; i < 3; i++) {
+      heights.add(Math.round((await page.locator(".banners").boundingBox())!.height));
+      expect(await fullRows(page), `whole rows under blocker ${i + 1}`).toBeGreaterThanOrEqual(4);
+      await banner.locator(".pager-btn").last().click();
+    }
+    expect(Math.max(...heights), "banner height").toBeLessThanOrEqual(124);
+    // Round the pager and back: the first one again.
+    await expect(banner.locator(".blocker")).toHaveAttribute("data-blocker", "hearth");
+    // Only the list scrolls: the header, version picker, switch, toolbar and banners stay put.
+    const fixed = [".page-header", ".mods-page .version-select", ".switch", ".toolbar-actions", ".banners"];
+    const before = await tops(page, fixed);
+    const scrolled = await page.locator(".mods-panel").evaluate((e) => {
+      e.scrollTop = e.scrollHeight;
+      return e.scrollTop;
+    });
+    expect(scrolled, "the list scrolls").toBeGreaterThan(0);
+    expect(await tops(page, fixed)).toEqual(before);
+    expect(await page.evaluate(() => document.querySelector(".page-container")?.scrollTop ?? 0)).toBe(0);
+    await expect(page.locator(".toolbar-actions button").last()).toHaveText(COPY_FROM[locale]);
+  });
+
+  test(`dialogs fit in ${locale}`, async ({ page }) => {
+    await open(page, "scenario=mods&long=1", locale);
+    await goToTab(page, MODS_TAB);
+
+    // Install dialog for an update: the warning is above the checks, in view.
+    await page.locator(".mod-row .update-btn-row").first().click();
+    await expect(page.locator("[role=dialog] .checks")).toBeVisible();
+    await expectFits(page);
+    const warning = await page.locator("[role=dialog] .dialog-warning").boundingBox();
+    const checks = await page.locator("[role=dialog] .checks").boundingBox();
+    expect(warning!.y).toBeLessThan(checks!.y);
+    expect(warning!.y + warning!.height).toBeLessThanOrEqual(565);
+    expect(await checksBelowFold(page), "check rows below the fold").toEqual([]);
+    await page.keyboard.press("Escape");
+
+    // A new install from Browse: every shown check row and the passed-checks line are in view
+    // without scrolling.
+    await page.locator(".switch [role=tab]").nth(1).click();
+    await page.locator(".mod-card", { hasText: "Hearth" }).locator(".mod-card-foot .btn-primary").click();
+    await expect(page.locator("[role=dialog] .check-fold")).toBeVisible();
+    await expectFits(page);
+    expect(await checksBelowFold(page), "check rows below the fold").toEqual([]);
+    await page.keyboard.press("Escape");
+    await page.locator(".switch [role=tab]").first().click();
+
+    // The unverified file dialog is the tallest: warning in view, typed confirmation in the footer.
+    await page.locator(".toolbar-actions button").first().click();
+    const input = page.locator("[role=dialog] .dialog-actions input");
+    await expect(input).toBeVisible();
+    await expect(input).toBeFocused();
+    await expectFits(page);
+    const w = await page.locator("[role=dialog] .dialog-warning").boundingBox();
+    expect(w!.y + w!.height).toBeLessThanOrEqual(565);
+    await page.keyboard.press("Escape");
+  });
+}
diff --git a/index.html b/index.html
index 962d6e8..ca52b04 100644
--- a/index.html
+++ b/index.html
@@ -4,6 +4,8 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>Weft Launcher</title>
+    <!-- No icon to fetch: the window has its own, and a browser on the mock would log a 404. -->
+    <link rel="icon" href="data:," />
   </head>
 
   <body>
diff --git a/package-lock.json b/package-lock.json
index 9501616..19c8467 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -10,6 +10,7 @@
       "license": "MPL-2.0",
       "dependencies": {
         "@tauri-apps/api": "^2",
+        "@tauri-apps/plugin-dialog": "^2.8.4",
         "@tauri-apps/plugin-opener": "^2",
         "@tauri-apps/plugin-process": "^2.4.0",
         "@tauri-apps/plugin-updater": "^2.14.1",
@@ -17,12 +18,42 @@
         "react-dom": "^19.1.0"
       },
       "devDependencies": {
+        "@playwright/test": "1.54.2",
         "@tauri-apps/cli": "^2",
         "@types/react": "^19.1.8",
         "@types/react-dom": "^19.1.6",
         "@vitejs/plugin-react": "^6.0.2",
         "typescript": "~6.0.3",
-        "vite": "^8.0.16"
+        "vite": "^8.0.16",
+        "vitest": "^5.1.0"
+      }
+    },
+    "node_modules/@jridgewell/resolve-uri": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
+      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@jridgewell/sourcemap-codec": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.6.0.tgz",
+      "integrity": "sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@jridgewell/trace-mapping": {
+      "version": "0.3.31",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
+      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/resolve-uri": "^3.1.0",
+        "@jridgewell/sourcemap-codec": "^1.4.14"
       }
     },
     "node_modules/@oxc-project/types": {
@@ -33,6 +64,22 @@
         "url": "https://github.com/sponsors/oxc-project"
       }
     },
+    "node_modules/@playwright/test": {
+      "version": "1.54.2",
+      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.54.2.tgz",
+      "integrity": "sha512-A+znathYxPf+72riFd1r1ovOLqsIIB0jKIoPjyK2kqEIe30/6jF6BC7QNluHuwUmsD2tv1XZVugN8GqfTMOxsA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright": "1.54.2"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@rolldown/binding-android-arm-eabi": {
       "version": "1.2.16",
       "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm-eabi/-/binding-android-arm-eabi-1.2.16.tgz",
@@ -143,9 +190,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -163,9 +207,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -183,9 +224,6 @@
         "ppc64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -203,9 +241,6 @@
         "s390x"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -223,9 +258,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -243,9 +275,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -404,9 +433,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "Apache-2.0 OR MIT",
       "optional": true,
       "os": [
@@ -424,9 +450,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "Apache-2.0 OR MIT",
       "optional": true,
       "os": [
@@ -444,9 +467,6 @@
         "riscv64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "Apache-2.0 OR MIT",
       "optional": true,
       "os": [
@@ -464,9 +484,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "Apache-2.0 OR MIT",
       "optional": true,
       "os": [
@@ -484,9 +501,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "Apache-2.0 OR MIT",
       "optional": true,
       "os": [
@@ -545,6 +559,15 @@
         "node": ">= 10"
       }
     },
+    "node_modules/@tauri-apps/plugin-dialog": {
+      "version": "2.8.4",
+      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-dialog/-/plugin-dialog-2.8.4.tgz",
+      "integrity": "sha512-+6ZOiXenOaxXwb8qCbBPdT2jX2cFPaVVHGIskrpmJLpmWj+qKRTD6X/z9x7hTdSQn7NedcoXCkWGej4a7dC4lw==",
+      "license": "MIT OR Apache-2.0",
+      "dependencies": {
+        "@tauri-apps/api": "^2.12.0"
+      }
+    },
     "node_modules/@tauri-apps/plugin-opener": {
       "version": "2.7.2",
       "license": "MIT OR Apache-2.0",
@@ -570,6 +593,31 @@
         "@tauri-apps/api": "^2.12.0"
       }
     },
+    "node_modules/@types/chai": {
+      "version": "5.2.3",
+      "resolved": "https://registry.npmjs.org/@types/chai/-/chai-5.2.3.tgz",
+      "integrity": "sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/deep-eql": "*",
+        "assertion-error": "^2.0.1"
+      }
+    },
+    "node_modules/@types/deep-eql": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/@types/deep-eql/-/deep-eql-4.0.2.tgz",
+      "integrity": "sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/estree": {
+      "version": "1.0.10",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.10.tgz",
+      "integrity": "sha512-lTyOMnOcmRBzdCv6/4zUZCrEhV0xrqQiUZBZtVcbmLHBXKLnN8q89v/wKRF/Q0HbwVsqbIG3o5HDoFl9sduM+g==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/react": {
       "version": "19.3.0",
       "dev": true,
@@ -614,6 +662,64 @@
         }
       }
     },
+    "node_modules/@vitest/mocker": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-5.1.0.tgz",
+      "integrity": "sha512-5umB9/jlWcqVS6fsrFmv5Gdnpu6wAUio/lEOwAmvB7v+lFo/IW2B9FhAD0p19GCULTgMzLCdUmuCDCnAzWgppQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/trace-mapping": "0.3.31",
+        "@vitest/spy": "5.1.0",
+        "estree-walker": "^3.0.3",
+        "magic-string": "^1.4.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "msw": "^2.4.9 || ^3.0.0",
+        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "msw": {
+          "optional": true
+        },
+        "vite": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@vitest/spy": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-5.1.0.tgz",
+      "integrity": "sha512-2DPO5OMHWKrBngC+fCmTQqemNF0gidRhp3lxbBmRhW+M1XJrfgPpqNqWVevXtn2f2ufD5ZaR1B6B641aAlcX5A==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/assertion-error": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-2.0.1.tgz",
+      "integrity": "sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/chai": {
+      "version": "6.3.0",
+      "resolved": "https://registry.npmjs.org/chai/-/chai-6.3.0.tgz",
+      "integrity": "sha512-XWAtwJ6OHO+tj0EKCs0Y2UamnyOxseZWltU4x2U2wh8g4AigdjwvtUjvLP2tqkA/avxHEtzxNaqGq/YGNwckKg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/csstype": {
       "version": "3.2.3",
       "dev": true,
@@ -627,6 +733,33 @@
         "node": ">=8"
       }
     },
+    "node_modules/es-module-lexer": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.3.2.tgz",
+      "integrity": "sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/estree-walker": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
+      "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "^1.0.0"
+      }
+    },
+    "node_modules/expect-type": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.4.0.tgz",
+      "integrity": "sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
     "node_modules/fdir": {
       "version": "6.5.0",
       "dev": true,
@@ -799,9 +932,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -823,9 +953,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -847,9 +974,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -871,9 +995,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -927,6 +1048,16 @@
         "url": "https://opencollective.com/parcel"
       }
     },
+    "node_modules/magic-string": {
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-1.4.5.tgz",
+      "integrity": "sha512-oLLC2+YvQUfAa+vxoufE/yc1icb87M9iXIRqAoR/2EhE/8cb3SF/+Gi0c2By1B+5Vz2e2vQtUvHiu1+63Znh+w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.6.0"
+      }
+    },
     "node_modules/nanoid": {
       "version": "3.3.20",
       "dev": true,
@@ -944,6 +1075,20 @@
         "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
       }
     },
+    "node_modules/obug": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/obug/-/obug-3.0.0.tgz",
+      "integrity": "sha512-5vvB5+W7ePv+p3uqxi+RcW1XAzLW0/hxt3/4X4Lc4qHudzOhmBiBwOY6DRob4WnanAEGvNcLjF+KNOufrUoEQw==",
+      "dev": true,
+      "funding": [
+        "https://github.com/sponsors/sxzz",
+        "https://opencollective.com/debug"
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.20.0"
+      }
+    },
     "node_modules/picocolors": {
       "version": "1.1.1",
       "dev": true,
@@ -960,6 +1105,53 @@
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
+    "node_modules/playwright": {
+      "version": "1.54.2",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.54.2.tgz",
+      "integrity": "sha512-Hu/BMoA1NAdRUuulyvQC0pEqZ4vQbGfn8f7wPXcnqQmM+zct9UliKxsIkLNmz/ku7LElUNqmaiv1TG/aL5ACsw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright-core": "1.54.2"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "fsevents": "2.3.2"
+      }
+    },
+    "node_modules/playwright-core": {
+      "version": "1.54.2",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.54.2.tgz",
+      "integrity": "sha512-n5r4HFbMmWsB4twG7tJLDN9gmBUeSPcsBZiWSE4DnYz9mJMAFqr2ID7+eGC9kpEnxExJ1epttwR59LEWCk8mtA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "playwright-core": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/playwright/node_modules/fsevents": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
+      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
     "node_modules/postcss": {
       "version": "8.5.32",
       "dev": true,
@@ -1018,6 +1210,33 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/std-env": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/std-env/-/std-env-4.3.0.tgz",
+      "integrity": "sha512-OtU/EgQ1kIm5KwqQpBC6ZEMXrZRui11w8zgfTWp8cdO9B8OaPsbA8bTHO2P+HNo1VlUTGMVBwPhydu6poeXiag==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/tinybench": {
+      "version": "6.2.3",
+      "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-6.2.3.tgz",
+      "integrity": "sha512-Al01C2JIBnO2CXCAPbpAl6sUiOZHeThGtHYNTa51JRw9PyWOCdr+9Ong05R4qg/Sk3+H645E8ov1h2c58ityNw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/tinyexec": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.3.1.tgz",
+      "integrity": "sha512-GCvB3aoys96IuDFBMcTB46JOR6mdMtAToqwiW8JlWhsoh1mhHi/xn9ss/Dg7N555GiJyEt2qzoG/NHCwM6h1EA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/tinyglobby": {
       "version": "0.2.17",
       "dev": true,
@@ -1156,6 +1375,102 @@
         "@rolldown/binding-win32-arm64-msvc": "1.2.16",
         "@rolldown/binding-win32-x64-msvc": "1.2.16"
       }
+    },
+    "node_modules/vitest": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-5.1.0.tgz",
+      "integrity": "sha512-MzmNFnrwa8v8lF1bLxw3UJ4EREwVOVb75VqJZmUDRjJ6EluK/x9th7qTbaeDk41WxE1GxWqmTXcdsfobfH5sOA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/chai": "^5.2.2",
+        "@vitest/mocker": "5.1.0",
+        "chai": "^6.3.0",
+        "es-module-lexer": "^2.3.2",
+        "expect-type": "^1.4.0",
+        "magic-string": "^1.4.3",
+        "obug": "^3.0.0",
+        "picomatch": "^4.0.7",
+        "std-env": "^4.3.0",
+        "tinybench": "^6.2.2",
+        "tinyexec": "^1.3.1",
+        "tinyglobby": "^0.2.17",
+        "why-is-node-running": "3.2.1"
+      },
+      "bin": {
+        "vitest": "vitest.mjs"
+      },
+      "engines": {
+        "node": "^22.12.0 || ^24.0.0 || >=26.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "@edge-runtime/vm": "*",
+        "@opentelemetry/api": "^1.9.0",
+        "@types/node": "^22.0.0 || >=24.0.0",
+        "@vitest/browser-playwright": "5.1.0",
+        "@vitest/browser-preview": "5.1.0",
+        "@vitest/browser-webdriverio": "^5.0.0-beta.5 || >=5.0.0",
+        "@vitest/coverage-istanbul": "5.1.0",
+        "@vitest/coverage-v8": "5.1.0",
+        "@vitest/ui": "5.1.0",
+        "happy-dom": "*",
+        "jsdom": "*",
+        "vite": "^6.4.0 || ^7.0.0 || ^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@edge-runtime/vm": {
+          "optional": true
+        },
+        "@opentelemetry/api": {
+          "optional": true
+        },
+        "@types/node": {
+          "optional": true
+        },
+        "@vitest/browser-playwright": {
+          "optional": true
+        },
+        "@vitest/browser-preview": {
+          "optional": true
+        },
+        "@vitest/browser-webdriverio": {
+          "optional": true
+        },
+        "@vitest/coverage-istanbul": {
+          "optional": true
+        },
+        "@vitest/coverage-v8": {
+          "optional": true
+        },
+        "@vitest/ui": {
+          "optional": true
+        },
+        "happy-dom": {
+          "optional": true
+        },
+        "jsdom": {
+          "optional": true
+        },
+        "vite": {
+          "optional": false
+        }
+      }
+    },
+    "node_modules/why-is-node-running": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/why-is-node-running/-/why-is-node-running-3.2.1.tgz",
+      "integrity": "sha512-Tb2FUhB4vUsGQlfSquQLYkApkuPAFQXGFzxWKHHumVz2dK+X1RUm/HnID4+TfIGYJ1kTcwOaCk/buYCEJr6YjQ==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "why-is-node-running": "cli.js"
+      },
+      "engines": {
+        "node": ">=20.11"
+      }
     }
   }
 }
diff --git a/package.json b/package.json
index b58c853..05a4752 100644
--- a/package.json
+++ b/package.json
@@ -7,12 +7,18 @@
   "scripts": {
     "release": "powershell -NoProfile -ExecutionPolicy Bypass -File scripts/release.ps1",
     "dev": "vite",
-    "build": "tsc && vite build",
+    "dev:mock": "vite --mode mock",
+    "build": "node scripts/check-i18n.mjs && tsc && vite build",
+    "check:i18n": "node scripts/check-i18n.mjs",
+    "test": "vitest run",
+    "test:watch": "vitest",
     "preview": "vite preview",
-    "tauri": "tauri"
+    "tauri": "tauri",
+    "test:ui": "playwright test"
   },
   "dependencies": {
     "@tauri-apps/api": "^2",
+    "@tauri-apps/plugin-dialog": "^2.8.4",
     "@tauri-apps/plugin-opener": "^2",
     "@tauri-apps/plugin-process": "^2.4.0",
     "@tauri-apps/plugin-updater": "^2.14.1",
@@ -20,11 +26,13 @@
     "react-dom": "^19.1.0"
   },
   "devDependencies": {
+    "@playwright/test": "1.54.2",
     "@tauri-apps/cli": "^2",
     "@types/react": "^19.1.8",
     "@types/react-dom": "^19.1.6",
     "@vitejs/plugin-react": "^6.0.2",
     "typescript": "~6.0.3",
-    "vite": "^8.0.16"
+    "vite": "^8.0.16",
+    "vitest": "^5.1.0"
   }
 }
diff --git a/playwright.config.ts b/playwright.config.ts
new file mode 100644
index 0000000..222fd3c
--- /dev/null
+++ b/playwright.config.ts
@@ -0,0 +1,38 @@
+// `npm run test:ui`: the UI against the mock backend (src/dev/mockBackend.ts) at the launcher's
+// minimum window size.
+//
+// - Each run starts its own mock server on a free port, so a run never tests a server someone
+//   else started. `PW_PORT=1450` picks the port instead; a port already in use fails the run.
+// - `PW_REUSE=1` tests a server already running on `PW_PORT` (yours, e.g. while editing).
+// - `PW_CHROMIUM=/path/to/chrome` uses an installed Chromium instead of
+//   `npx playwright install chromium`.
+import { execFileSync } from "node:child_process";
+import { defineConfig } from "@playwright/test";
+
+// Chosen once, in the runner; the workers inherit it through the environment.
+if (!process.env.PW_PORT) {
+  const probe = "const s=require('net').createServer().listen(0,'127.0.0.1',()=>{console.log(s.address().port);s.close()})";
+  process.env.PW_PORT = execFileSync(process.execPath, ["-e", probe], { encoding: "utf8" }).trim();
+}
+const PORT = Number(process.env.PW_PORT);
+const REUSE = process.env.PW_REUSE === "1";
+
+export default defineConfig({
+  testDir: "e2e",
+  fullyParallel: true,
+  forbidOnly: !!process.env.CI,
+  // No retries, also in CI: a flaky test is a bug to fix, not to hide.
+  retries: 0,
+  reporter: process.env.CI ? [["github"], ["list"]] : "list",
+  use: {
+    baseURL: `http://127.0.0.1:${PORT}`,
+    viewport: { width: 960, height: 565 },
+    launchOptions: process.env.PW_CHROMIUM ? { executablePath: process.env.PW_CHROMIUM } : {},
+    trace: "retain-on-failure",
+  },
+  webServer: {
+    command: `npx vite --mode mock --host 127.0.0.1 --port ${PORT} --strictPort`,
+    url: `http://127.0.0.1:${PORT}`,
+    reuseExistingServer: REUSE,
+  },
+});
diff --git a/scripts/check-i18n.mjs b/scripts/check-i18n.mjs
new file mode 100644
index 0000000..41af5bc
--- /dev/null
+++ b/scripts/check-i18n.mjs
@@ -0,0 +1,196 @@
+// Runs before every build: a missing string would show up as its key.
+//
+// Fails when
+// - a language lacks a key English has, has one English doesn't, or drops a `{n}` placeholder;
+// - a counted message (`key_one`, `key_other`...) lacks a plural form the language needs, as
+//   Intl.PluralRules says (Russian: one, few, many, other), or has one it doesn't use;
+// - code under src/ uses a message key that en.json doesn't have, or en.json has a key no code
+//   names (keys built from a prefix, like `sizeUnits.${unit}`, are listed in DYNAMIC);
+// - an error code the backend can send has no `errors.*` message, going by the generated
+//   ErrorCode union in src/mods/bindings/ErrorCode.ts;
+// - a message names a trust tier or a revocation in English but not with that language's term
+//   for it, or uses a word the glossary rules out (Russian «отзыв» reads as "review");
+// - code puts two translated pieces side by side in one text, `{t(a)} {t(b)}` in JSX or
+//   `${t(a)} ${t(b)}` in a template: a sentence assembled from parts can't be put in another
+//   language's order. One message per sentence, with the parts as `{0}`, `{1}`.
+import { readFileSync, readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = fileURLToPath(new URL("..", import.meta.url));
+const dir = join(root, "src/i18n");
+const locales = ["en", "pt-BR", "es", "ru"];
+const load = (l) => JSON.parse(readFileSync(join(dir, `${l}.json`), "utf8"));
+const problems = [];
+
+function flatten(obj, prefix = "", out = {}) {
+  for (const [k, v] of Object.entries(obj)) {
+    const key = prefix ? `${prefix}.${k}` : k;
+    if (v && typeof v === "object") flatten(v, key, out);
+    else out[key] = String(v);
+  }
+  return out;
+}
+
+const PLURAL = /^(.*)_(zero|one|two|few|many|other)$/;
+const placeholders = (s) => [...new Set([...s.matchAll(/\{(\d+|n)\}/g)].map((m) => m[1]))].sort().join(",");
+
+/** Plain keys, and counted messages by base key with their forms. */
+function split(flat) {
+  const plain = {};
+  const plural = {};
+  for (const [key, value] of Object.entries(flat)) {
+    const m = key.match(PLURAL);
+    if (m) (plural[m[1]] ??= {})[m[2]] = value;
+    else plain[key] = value;
+  }
+  return { plain, plural };
+}
+
+const en = split(flatten(load("en")));
+
+for (const locale of locales) {
+  const { plain, plural } = locale === "en" ? en : split(flatten(load(locale)));
+  const needed = new Intl.PluralRules(locale).resolvedOptions().pluralCategories.sort();
+
+  if (locale !== "en") {
+    for (const key of Object.keys(en.plain)) {
+      if (!(key in plain)) problems.push(`${locale}: missing ${key}`);
+      else if (placeholders(en.plain[key]) !== placeholders(plain[key])) {
+        problems.push(`${locale}: ${key} has {${placeholders(plain[key])}}, English has {${placeholders(en.plain[key])}}`);
+      }
+    }
+    for (const key of Object.keys(plain)) {
+      if (!(key in en.plain)) problems.push(`${locale}: ${key} is not in en.json`);
+    }
+    for (const base of Object.keys(plural)) {
+      if (!(base in en.plural)) problems.push(`${locale}: counted message ${base} is not in en.json`);
+    }
+  }
+
+  for (const [base, enForms] of Object.entries(en.plural)) {
+    const forms = plural[base];
+    if (!forms) {
+      problems.push(`${locale}: missing counted message ${base} (${needed.map((c) => `${base}_${c}`).join(", ")})`);
+      continue;
+    }
+    const have = Object.keys(forms).sort();
+    for (const c of needed) if (!have.includes(c)) problems.push(`${locale}: ${base} needs a _${c} form`);
+    for (const c of have) if (!needed.includes(c)) problems.push(`${locale}: ${base}_${c} is a form ${locale} doesn't use`);
+    const want = placeholders(enForms.other ?? "");
+    for (const [c, text] of Object.entries(forms)) {
+      if (placeholders(text) !== want) problems.push(`${locale}: ${base}_${c} has {${placeholders(text)}}, English has {${want}}`);
+    }
+  }
+}
+
+// Keys used in code.
+function sources(path, out = []) {
+  for (const name of readdirSync(path)) {
+    const full = join(path, name);
+    if (statSync(full).isDirectory()) {
+      if (name !== "bindings") sources(full, out);
+    } else if (/\.(ts|tsx)$/.test(name) && !/\.test\.tsx?$/.test(name)) out.push(full);
+  }
+  return out;
+}
+
+const known = (key) => key in en.plain || key in en.plural;
+const CALL = /\b(t|tn|tr)\(\s*["']([^"']+)["']/g;
+// Quoted only: backticks are comments' code spans here, not keys.
+const LITERAL = /["']((?:mods|errors|sizeUnits)\.[A-Za-z0-9_]+)["']/g;
+const PIECE = String.raw`\b(?:t|tn|tm)\((?:[^()]|\([^()]*\))*\)`;
+const SIDE_BY_SIDE = [
+  new RegExp(String.raw`\{\s*${PIECE}\s*\}(?:\s|\{" "\}|[,:;.—-])*\{\s*${PIECE}\s*\}`, "g"),
+  new RegExp(String.raw`\$\{\s*${PIECE}\s*\}[^\`$]{0,3}\$\{\s*${PIECE}\s*\}`, "g"),
+];
+function sideBySide(text) {
+  return SIDE_BY_SIDE.flatMap((re) => [...text.matchAll(re)].map((m) => ({ line: text.slice(0, m.index).split("\n").length, text: m[0].replace(/\s+/g, " ") })));
+}
+// Every message is used: a key is used when code names it in quotes (t("playButton"),
+// "mods.ckIndex" in a table). Keys that code builds from a prefix are listed here, and only these.
+const DYNAMIC = ["sizeUnits."];
+const mentioned = new Set();
+for (const file of sources(join(root, "src"))) {
+  const text = readFileSync(file, "utf8");
+  for (const m of text.matchAll(/["'`]([A-Za-z][A-Za-z0-9_.]*)["'`]/g)) mentioned.add(m[1]);
+  const rel = file.slice(root.length);
+  for (const m of sideBySide(text)) problems.push(`${rel}:${m.line}: two translated pieces side by side make one sentence: ${m.text}`);
+  for (const m of text.matchAll(CALL)) {
+    const [, fn, key] = m;
+    if (fn === "tn" ? !(key in en.plural) : !(key in en.plain)) {
+      problems.push(`${rel}: ${fn}("${key}") is not ${fn === "tn" ? "a counted message" : "a message"} in en.json`);
+    }
+  }
+  for (const m of text.matchAll(LITERAL)) {
+    if (!known(m[1])) problems.push(`${rel}: "${m[1]}" is not in en.json`);
+  }
+}
+
+for (const key of [...Object.keys(en.plain), ...Object.keys(en.plural)]) {
+  if (!mentioned.has(key) && !DYNAMIC.some((p) => key.startsWith(p))) problems.push(`en.json: "${key}" is never used; remove it from every locale`);
+}
+
+// Every error code the backend can send has a message. The codes are the ErrorCode union that
+// the backend generates (src/mods/bindings/ErrorCode.ts); a Rust test keeps that file current.
+const codes = new Set();
+const unionPath = "src/mods/bindings/ErrorCode.ts";
+const union = readFileSync(join(root, unionPath), "utf8").match(/export type ErrorCode =([\s\S]*?);/);
+if (!union) problems.push(`${unionPath}: no ErrorCode union found`);
+else for (const m of union[1].matchAll(/"([A-Za-z0-9]+)"/g)) codes.add(m[1]);
+const errorsTs = readFileSync(join(dir, "errors.ts"), "utf8");
+const mapping = Object.fromEntries([...errorsTs.matchAll(/^\s*([A-Z][A-Za-z0-9]*):\s*'([^']+)'/gm)].map((m) => [m[1], m[2]]));
+for (const code of codes) {
+  const key = mapping[code];
+  if (!key) problems.push(`src/i18n/errors.ts: error code ${code} has no message in ERROR_KEY`);
+  else if (!(key in en.plain)) problems.push(`src/i18n/errors.ts: ${code} maps to ${key}, which en.json doesn't have`);
+}
+for (const code of Object.keys(mapping)) {
+  if (!codes.has(code)) problems.push(`src/i18n/errors.ts: ${code} is not an ErrorCode the backend sends`);
+}
+
+// The trust words, one term per language: a player learns them from the badges, so every message
+// that names one says it the same way. Stems, compared without case, so inflected forms pass.
+//
+// Russian keeps the three tiers apart, as three steps a reader recognises, and never with the
+// stem of the mechanical checks («провер…»: the signature, the file, the version), which a
+// tier word would be confused with: Reviewed «Одобрен» (approved by the index's reviewers),
+// Unreviewed «Без модерации» (published, nobody moderated it), Unverified «С компьютера» (a file
+// from the player's computer, of unknown origin; short enough to sit beside a name, and not
+// «источник», which is what an added GitHub repo is called).
+const TIER_FORMS = { ru: [/провер/i] };
+const GLOSSARY = [
+  { en: /\bunverified\b/i, term: { ru: "компьютер", "pt-BR": "não verificad", es: "sin verificar" }, not: TIER_FORMS },
+  { en: /\bunreviewed\b|nobody reviewed|\bnot reviewed\b/i, term: { ru: "модерац", "pt-BR": "revis", es: "revis" }, not: TIER_FORMS },
+  // The tier's own word (capitalised in English), and what it means: someone reviewed exactly this file.
+  { en: /\bReviewed\b|reviewed exactly/, term: { ru: "одобр", "pt-BR": "revis", es: "revis" }, not: TIER_FORMS },
+  { en: /\brevok|\brevocation/i, term: { ru: "отозв", "pt-BR": "retirad", es: "retirad" } },
+  // One word for a build its author marks as not final, on the version list and in Mods alike.
+  { en: /\bprerelease/i, term: { ru: "предрелиз", "pt-BR": "pré-lançamento", es: "preversi" } },
+];
+const FORBIDDEN = { ru: [/отзыв/i, /неизвестн\S* файл/i], en: [/\bpre-release/i], es: [/preliminar/i] };
+const flat = Object.fromEntries(locales.map((l) => [l, flatten(load(l))]));
+for (const [key, english] of Object.entries(flat.en)) {
+  for (const { en: pattern, term, not = {} } of GLOSSARY) {
+    if (!pattern.test(english)) continue;
+    for (const [locale, stem] of Object.entries(term)) {
+      const text = flat[locale][key];
+      if (text !== undefined && !text.toLowerCase().includes(stem)) problems.push(`${locale}: ${key} should say "${stem}…" for "${english.match(pattern)[0]}"`);
+      for (const word of not[locale] ?? []) {
+        if (text !== undefined && word.test(text)) problems.push(`${locale}: ${key} names a tier with ${word}, the word of the mechanical checks`);
+      }
+    }
+  }
+}
+for (const [locale, words] of Object.entries(FORBIDDEN))
+  for (const [key, text] of Object.entries(flat[locale]))
+    for (const word of words) if (word.test(text)) problems.push(`${locale}: ${key} uses ${word}, which the glossary rules out`);
+
+if (problems.length) {
+  console.error(problems.join("\n"));
+  process.exit(1);
+}
+console.log(
+  `i18n: ${Object.keys(en.plain).length} messages and ${Object.keys(en.plural).length} counted messages in ${locales.join(", ")}; ` +
+    `${codes.size} error codes covered`
+);
diff --git a/scripts/font-glyphs.py b/scripts/font-glyphs.py
new file mode 100644
index 0000000..111bed0
--- /dev/null
+++ b/scripts/font-glyphs.py
@@ -0,0 +1,187 @@
+#!/usr/bin/env python3
+"""Adds the accented Latin letters pt-BR and es need to the launcher's pixel font.
+
+The font (src/fonts/weft.woff2) is drawn on a grid of 100-unit pixels: lowercase is 5 rows tall,
+capitals 7, and Cyrillic Ё is the font's own model for an accented capital (the letter one row
+shorter, the mark above it). The marks here follow the same grid, two rows tall:
+
+- lowercase: letter rows 0-4, a free row, the mark in rows 6-7;
+- capitals: the letter squashed to 6 rows (one of its repeated rows dropped), a free row, the
+  mark in rows 7-8;
+- ç and Ç: the cedilla hangs in the two rows under the baseline;
+- ¿ and ¡: ? and ! turned upside down, hanging one row lower, as Spanish sets them.
+
+Glyphs the font already has are left alone, so running it twice changes nothing.
+
+    python3 -m venv /tmp/ft && /tmp/ft/bin/pip install fonttools brotli
+    /tmp/ft/bin/python scripts/font-glyphs.py
+"""
+
+import sys
+from pathlib import Path
+
+from fontTools.pens.pointInsidePen import PointInsidePen
+from fontTools.pens.ttGlyphPen import TTGlyphPen
+from fontTools.ttLib import TTFont
+
+PX = 100
+FONT = Path(__file__).resolve().parent.parent / "src" / "fonts" / "weft.woff2"
+
+# Marks, top row first, five pixels wide.
+MARKS = {
+    "acute": ["...#.", "..#.."],
+    "grave": [".#...", "..#.."],
+    "circumflex": ["..#..", ".#.#."],
+    "tilde": [".##.#", "#.##."],
+    "diaeresis": [".....", ".#.#."],
+}
+CEDILLA = ["..#..", ".#..."]
+
+# (character, base, mark)
+LETTERS = [
+    ("á", "a", "acute"), ("à", "a", "grave"), ("â", "a", "circumflex"), ("ã", "a", "tilde"), ("ä", "a", "diaeresis"),
+    ("é", "e", "acute"), ("è", "e", "grave"), ("ê", "e", "circumflex"),
+    ("í", "ı", "acute"),
+    ("ó", "o", "acute"), ("ò", "o", "grave"), ("ô", "o", "circumflex"), ("õ", "o", "tilde"), ("ö", "o", "diaeresis"),
+    ("ú", "u", "acute"), ("ù", "u", "grave"), ("û", "u", "circumflex"), ("ü", "u", "diaeresis"),
+    ("ñ", "n", "tilde"),
+    ("Á", "A", "acute"), ("À", "A", "grave"), ("Â", "A", "circumflex"), ("Ã", "A", "tilde"), ("Ä", "A", "diaeresis"),
+    ("É", "E", "acute"), ("Ê", "E", "circumflex"),
+    ("Í", "I", "acute"),
+    ("Ó", "O", "acute"), ("Ô", "O", "circumflex"), ("Õ", "O", "tilde"), ("Ö", "O", "diaeresis"),
+    ("Ú", "U", "acute"), ("Ü", "U", "diaeresis"),
+    ("Ñ", "N", "tilde"),
+]
+
+
+def bitmap(font: TTFont, char: str) -> dict[tuple[int, int], bool]:
+    """The glyph's pixels, as (column, row) with row 0 on the baseline."""
+    glyphs = font.getGlyphSet()
+    name = font.getBestCmap()[ord(char)]
+    width = font["hmtx"][name][0] // PX
+    out = {}
+    for row in range(-3, 10):
+        for col in range(width):
+            pen = PointInsidePen(glyphs, (col * PX + PX / 2, row * PX + PX / 2))
+            glyphs[name].draw(pen)
+            if pen.getResult():
+                out[(col, row)] = True
+    return out
+
+
+def squash(pixels: dict[tuple[int, int], bool]) -> dict[tuple[int, int], bool]:
+    """A 7-row capital as 6 rows: drops the repeated row nearest the middle, as Ё does."""
+    rows = {r: frozenset(c for (c, rr) in pixels if rr == r) for r in range(7)}
+    repeats = [r for r in range(1, 7) if rows[r] == rows[r - 1]]
+    if not repeats:
+        sys.exit("no repeated row to drop")
+    drop = min(repeats, key=lambda r: abs(r - 3))
+    return {(c, r if r < drop else r - 1): True for (c, r) in pixels if r != drop}
+
+
+def mark(rows: list[str], top: int, shift: int = 0) -> dict[tuple[int, int], bool]:
+    out = {}
+    for i, line in enumerate(rows):
+        for col, ch in enumerate(line):
+            if ch == "#":
+                out[(col + shift, top - i)] = True
+    return out
+
+
+def draw(pixels: dict[tuple[int, int], bool]):
+    """One rectangle per horizontal run of pixels."""
+    pen = TTGlyphPen(None)
+    for row in sorted({r for (_, r) in pixels}):
+        cols = sorted(c for (c, r) in pixels if r == row)
+        start = prev = cols[0]
+        for c in cols[1:] + [None]:
+            if c is not None and c == prev + 1:
+                prev = c
+                continue
+            x0, x1, y0, y1 = start * PX, (prev + 1) * PX, row * PX, (row + 1) * PX
+            pen.moveTo((x0, y0))
+            pen.lineTo((x0, y1))
+            pen.lineTo((x1, y1))
+            pen.lineTo((x1, y0))
+            pen.closePath()
+            if c is not None:
+                start = prev = c
+    return pen.glyph()
+
+
+def add(font: TTFont, char: str, pixels: dict[tuple[int, int], bool], advance: int):
+    cmap = font.getBestCmap()
+    if ord(char) in cmap:
+        return False
+    name = f"uni{ord(char):04X}"
+    glyph = draw(pixels)
+    font["glyf"][name] = glyph
+    glyph.recalcBounds(font["glyf"])
+    font["hmtx"][name] = (advance, glyph.xMin if hasattr(glyph, "xMin") else 0)
+    for table in font["cmap"].tables:
+        if table.isUnicode():
+            table.cmap[ord(char)] = name
+    return True
+
+
+def main():
+    font = TTFont(FONT)
+    before = len(font.getGlyphOrder())
+    added = []
+
+    def advance(char: str) -> int:
+        return font["hmtx"][font.getBestCmap()[ord(char)]][0]
+
+    # Dotless i: the stem of i.
+    if ord("ı") not in font.getBestCmap():
+        stem = {k: v for k, v in bitmap(font, "i").items() if k[1] < 5}
+        if add(font, "ı", stem, advance("i")):
+            added.append("ı")
+
+    for char, base, kind in LETTERS:
+        if ord(char) in font.getBestCmap():
+            continue
+        pixels = bitmap(font, base)
+        capital = base.isupper()
+        if capital:
+            pixels = squash(pixels)
+        top = 8 if capital else 7
+        if base == "ı":
+            # A narrow letter: the mark is two pixels wide, and the letter makes room for it.
+            pixels = {(c + 0, r): True for (c, r) in pixels}
+            pixels.update(mark([".#", "#."] if kind == "acute" else ["#.", ".#"], top))
+            width = advance("i") + PX
+        else:
+            # Marks centre on the letter's own width (5 pixels for nearly all of them).
+            letter = max(c for (c, _) in pixels) + 1
+            pixels.update(mark(MARKS[kind], top, shift=(letter - 5) // 2))
+            width = advance(base)
+        if add(font, char, pixels, width):
+            added.append(char)
+
+    for char, base in (("ç", "c"), ("Ç", "C")):
+        pixels = bitmap(font, base)
+        pixels.update(mark(CEDILLA, -1))
+        if add(font, char, pixels, advance(base)):
+            added.append(char)
+
+    # Upside down, one row lower.
+    for char, base in (("¿", "?"), ("¡", "!")):
+        pixels = bitmap(font, base)
+        width = max(c for (c, _) in pixels) + 1
+        turned = {(width - 1 - c, 4 - r): True for (c, r) in pixels}
+        if add(font, char, turned, advance(base)):
+            added.append(char)
+
+    if not added:
+        print("nothing to add")
+        return
+    # `glyf` appends each new glyph to the glyph order; maxp counts them.
+    font["maxp"].numGlyphs = len(font.getGlyphOrder())
+    font.flavor = "woff2"
+    font.save(FONT)
+    print("added", "".join(added), len(font.getGlyphOrder()) - before, "glyphs")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/src-tauri/.gitattributes b/src-tauri/.gitattributes
new file mode 100644
index 0000000..daa3170
--- /dev/null
+++ b/src-tauri/.gitattributes
@@ -0,0 +1,2 @@
+# Signed fixtures: their bytes must stay as signed, whatever the checkout does to line ends.
+src/mods/testdata/** -text
diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock
index feca8a9..3bf6121 100644
--- a/src-tauri/Cargo.lock
+++ b/src-tauri/Cargo.lock
@@ -3223,6 +3223,32 @@ dependencies = [
  "web-sys",
 ]
 
+[[package]]
+name = "rfd"
+version = "0.17.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20dafead71c16a34e1ff357ddefc8afc11e7d51d6d2b9fbd07eaa48e3e540220"
+dependencies = [
+ "block2",
+ "dispatch2",
+ "glib-sys",
+ "gobject-sys",
+ "gtk-sys",
+ "js-sys",
+ "libc",
+ "log",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-core-foundation",
+ "objc2-foundation",
+ "percent-encoding",
+ "raw-window-handle",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "ring"
 version = "0.17.14"
@@ -4129,6 +4155,48 @@ dependencies = [
  "walkdir",
 ]
 
+[[package]]
+name = "tauri-plugin-dialog"
+version = "2.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce0fb9c2b6d34a9720627ed930ebc8af26f61e648695aecaeb03d5c33c5896f5"
+dependencies = [
+ "log",
+ "raw-window-handle",
+ "rfd",
+ "serde",
+ "serde_json",
+ "tauri",
+ "tauri-plugin",
+ "tauri-plugin-fs",
+ "thiserror 2.0.21",
+ "url",
+]
+
+[[package]]
+name = "tauri-plugin-fs"
+version = "2.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d58eb1d4984e535f47a642ffec09a2da6f5c18a12b5902d12126cb7626d628b"
+dependencies = [
+ "anyhow",
+ "dunce",
+ "glob",
+ "log",
+ "objc2-foundation",
+ "percent-encoding",
+ "schemars 0.8.22",
+ "serde",
+ "serde_json",
+ "serde_repr",
+ "tauri",
+ "tauri-plugin",
+ "tauri-utils",
+ "thiserror 2.0.21",
+ "toml 1.1.8+spec-1.1.0",
+ "url",
+]
+
 [[package]]
 name = "tauri-plugin-opener"
 version = "2.7.2"
@@ -4332,6 +4400,15 @@ dependencies = [
  "new_debug_unreachable",
 ]
 
+[[package]]
+name = "termcolor"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
+dependencies = [
+ "winapi-util",
+]
+
 [[package]]
 name = "thiserror"
 version = "1.0.69"
@@ -4663,6 +4740,28 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
+[[package]]
+name = "ts-rs"
+version = "12.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "756050066659291d47a554a9f558125db17428b073c5ffce1daf5dcb0f7231d8"
+dependencies = [
+ "thiserror 2.0.21",
+ "ts-rs-macros",
+]
+
+[[package]]
+name = "ts-rs-macros"
+version = "12.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38d90eea51bc7988ef9e674bf80a85ba6804739e535e9cab48e4bb34a8b652aa"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "termcolor",
+]
+
 [[package]]
 name = "typed-path"
 version = "0.13.0"
@@ -5041,8 +5140,11 @@ dependencies = [
 name = "weft-launcher"
 version = "1.1.1"
 dependencies = [
+ "base64 0.22.1",
  "flate2",
  "futures-util",
+ "http",
+ "minisign-verify",
  "reqwest 0.12.28",
  "serde",
  "serde_json",
@@ -5050,13 +5152,17 @@ dependencies = [
  "tar",
  "tauri",
  "tauri-build",
+ "tauri-plugin-dialog",
  "tauri-plugin-opener",
  "tauri-plugin-process",
  "tauri-plugin-single-instance",
  "tauri-plugin-updater",
+ "tempfile",
  "thiserror 2.0.21",
  "time",
  "tokio",
+ "ts-rs",
+ "url",
  "zip 0.6.6",
 ]
 
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index ed18ce9..0cbfaa7 100644
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -22,17 +22,22 @@ tauri-build = { version = "2", features = [] }
 tauri = { version = "2", features = [] }
 tauri-plugin-single-instance = "2"
 tauri-plugin-opener = "2"
+tauri-plugin-dialog = "2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "json", "gzip", "stream"] }
 thiserror = "2"
-tokio = { version = "1", features = ["fs", "io-util", "process", "rt", "time"] }
+tokio = { version = "1", features = ["fs", "io-util", "process", "rt", "sync", "time"] }
 time = { version = "0.3", features = ["serde", "formatting", "local-offset"] }
 futures-util = "0.3"
 sha2 = "0.10"
 zip = "0.6"
 flate2 = "1.0"
 tar = "0.4"
+minisign-verify = "0.3"
+base64 = "0.22"
+ts-rs = { version = "12", features = ["no-serde-warnings"] }
+url = "2"
 
 [target.'cfg(not(any(target_os = "android", target_os = "ios")))'.dependencies]
 tauri-plugin-updater = "2"
@@ -46,3 +51,7 @@ lto = true
 opt-level = 3
 panic = "abort"
 strip = true
+
+[dev-dependencies]
+tempfile = "3"
+http = "1"
diff --git a/src-tauri/capabilities/default.json b/src-tauri/capabilities/default.json
index 297cfd4..211c400 100644
--- a/src-tauri/capabilities/default.json
+++ b/src-tauri/capabilities/default.json
@@ -6,6 +6,7 @@
   "permissions": [
     "core:default",
     "opener:default",
+    "dialog:allow-open",
     "updater:default",
     "process:allow-restart"
   ]
diff --git a/src-tauri/src/bindings.rs b/src-tauri/src/bindings.rs
new file mode 100644
index 0000000..5fd230b
--- /dev/null
+++ b/src-tauri/src/bindings.rs
@@ -0,0 +1,529 @@
+//! The TypeScript side of every type that crosses IPC, generated with `ts-rs` into
+//! `src/mods/bindings/` (one file per type, plus `index.ts` and `commands.ts`).
+//!
+//! `commands.ts` also maps every command to its arguments and result (`CommandSignatures`),
+//! read from the command's own declaration, and every event to its payload (`EventPayloads`).
+//! A renamed argument or a changed result type changes the page's types with it.
+//!
+//! `bindings_are_current` fails when the committed files differ from what the Rust types say.
+//! To regenerate them: `cargo test export_bindings -- --ignored` in `src-tauri`.
+
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+use ts_rs::{Config, TS};
+
+use crate::error::{AppError, ErrorCode};
+use crate::install::{InstallProgress, InstalledVersion};
+use crate::launch::GameStateEvent;
+use crate::mods::catalog::{Catalog, CatalogUpdate};
+use crate::mods::diagnose::{FailureKind, ModFailure};
+use crate::mods::inspect::FileInspection;
+use crate::mods::install::{ModProgress, ProgressStage};
+use crate::mods::plan::{
+    ChangeResult, CopyItem, CopyOutcome, CopyPreview, CopyResult, InstallPlan,
+};
+use crate::mods::profile::ProfileReport;
+use crate::releases::Release;
+
+fn committed_dir() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR")).join("../src/mods/bindings")
+}
+
+const HEADER: &str =
+    "// Generated from the Rust types by src-tauri/src/bindings.rs. Do not edit.\n";
+
+/// Every command `lib.rs` registers, as written in its `generate_handler!` list
+/// (`mods::commands::install_mod`).
+pub(crate) fn command_paths() -> Vec<String> {
+    let lib = include_str!("lib.rs");
+    let start = lib
+        .find("generate_handler![")
+        .expect("generate_handler! in lib.rs");
+    let list = &lib[start + "generate_handler![".len()..];
+    let list = &list[..list.find(']').expect("end of generate_handler!")];
+    list.split(',')
+        .map(|p| p.trim())
+        .filter(|p| !p.is_empty())
+        .map(str::to_string)
+        .collect()
+}
+
+pub(crate) fn command_names() -> Vec<String> {
+    command_paths()
+        .iter()
+        .map(|p| p.rsplit("::").next().unwrap().to_string())
+        .collect()
+}
+
+/// A command's arguments as the page passes them, and its result.
+#[derive(Debug, PartialEq)]
+struct Signature {
+    args: Vec<(String, String)>,
+    result: String,
+}
+
+/// Splits at commas that aren't inside `<>` or `()`.
+fn split_top(s: &str) -> Vec<&str> {
+    let (mut depth, mut start, mut out) = (0i32, 0, Vec::new());
+    for (i, c) in s.char_indices() {
+        match c {
+            '<' | '(' => depth += 1,
+            '>' | ')' => depth -= 1,
+            ',' if depth == 0 => {
+                out.push(s[start..i].trim());
+                start = i + 1;
+            }
+            _ => {}
+        }
+    }
+    out.push(s[start..].trim());
+    out.into_iter().filter(|p| !p.is_empty()).collect()
+}
+
+/// The TypeScript for a Rust type in a command signature. Named types must be exported
+/// bindings; they are collected into `named`, and `export_into` fails if one isn't (a type
+/// alias is such a name: write the type it stands for).
+///
+/// Numbers are TypeScript `number`, a double: integers past `Number.MAX_SAFE_INTEGER`
+/// (2^53 − 1) would lose precision. Every 64-bit integer that crosses IPC today stays far below
+/// that (sizes in bytes, capped at 512 MB for a mod and a few GB for a game version, timestamps,
+/// revision counters); one that could pass it must cross as a string instead.
+fn ts_type(rust: &str, named: &mut std::collections::BTreeSet<String>) -> String {
+    let t = rust.trim();
+    let inner = |prefix: &str| {
+        t.strip_prefix(prefix)
+            .and_then(|r| r.strip_suffix('>'))
+            .map(str::to_string)
+    };
+    if let Some(i) = inner("Option<") {
+        return format!("{} | null", ts_type(&i, named));
+    }
+    if let Some(i) = inner("Vec<") {
+        return format!("Array<{}>", ts_type(&i, named));
+    }
+    match t {
+        "String" | "&str" | "PathBuf" => "string".into(),
+        "bool" => "boolean".into(),
+        "()" => "void".into(),
+        "u8" | "u16" | "u32" | "u64" | "usize" | "i32" | "i64" | "f64" => "number".into(),
+        path => {
+            let name = path.rsplit("::").next().unwrap();
+            assert!(
+                name.chars().all(|c| c.is_ascii_alphanumeric()) && !name.is_empty(),
+                "can't write {path:?} in TypeScript: a command's types are String, &str, PathBuf, \
+                 bool, numbers, Option<…>, Vec<…>, (), and types exported to the bindings"
+            );
+            let name = if name == "AppError" {
+                "AppErrorPayload"
+            } else {
+                name
+            };
+            named.insert(name.to_string());
+            name.to_string()
+        }
+    }
+}
+
+/// Arguments the page doesn't pass: Tauri fills them in.
+fn injected(rust_type: &str) -> bool {
+    ["AppHandle", "State<", "Window", "Webview"]
+        .iter()
+        .any(|t| rust_type.contains(t))
+}
+
+/// Reads a command's signature from Rust source. The shapes it supports, and the only ones a
+/// command may have:
+///
+/// - `pub async fn name(` or `pub fn name(`, with no generics and no `where` clause;
+/// - arguments `name: Type`, without attributes or patterns, where `Type` is `String`, `&str`,
+///   `PathBuf`, `bool`, a number, `Option<…>`, `Vec<…>`, or a type exported to the bindings;
+///   `AppHandle`, `State<…>`, `Window` and `Webview` are filled in by Tauri and skipped;
+/// - the result `-> Result<T, AppError>`, `-> T`, or none.
+///
+/// Anything else (a `#[tauri::command(rename_all = …)]`, an attribute on an argument, `impl`,
+/// `&mut`, `dyn`, a lifetime) fails here with the command's name, rather than being read
+/// wrongly.
+fn signature_in(
+    source: &str,
+    name: &str,
+    named: &mut std::collections::BTreeSet<String>,
+) -> Signature {
+    let (decl, start) = [format!("pub async fn {name}("), format!("pub fn {name}(")]
+        .iter()
+        .find_map(|p| source.find(p.as_str()).map(|at| (at, at + p.len())))
+        .unwrap_or_else(|| panic!("no declaration of command {name} (generics aren't supported)"));
+    let attribute = source[..decl].trim_end().lines().last().unwrap_or("");
+    assert!(
+        !attribute.contains("tauri::command("),
+        "command {name}: options on #[tauri::command] aren't supported"
+    );
+    let rest = &source[start..];
+    let mut depth = 1;
+    let close = rest
+        .char_indices()
+        .find(|&(_, c)| {
+            match c {
+                '(' => depth += 1,
+                ')' => depth -= 1,
+                _ => {}
+            }
+            depth == 0
+        })
+        .map(|(i, _)| i)
+        .expect("end of the argument list");
+    let params = &rest[..close];
+    for bad in ["#[", "impl ", "&mut", "dyn ", "'"] {
+        assert!(
+            !params.contains(bad),
+            "command {name}: {bad:?} in its arguments isn't supported"
+        );
+    }
+    let args = split_top(params)
+        .into_iter()
+        .filter_map(|param| {
+            let (arg, ty) = param
+                .split_once(':')
+                .unwrap_or_else(|| panic!("command {name}: {param:?} is not name: Type"));
+            assert!(
+                arg.trim()
+                    .bytes()
+                    .all(|b| b.is_ascii_alphanumeric() || b == b'_'),
+                "command {name}: argument {arg:?} isn't a plain name"
+            );
+            (!injected(ty)).then(|| (camel(arg.trim()), ts_type(ty, named)))
+        })
+        .collect();
+    let after = &rest[close + 1..];
+    let head = after[..after.find('{').expect("function body")].trim();
+    assert!(
+        !head.contains("where") && !head.contains("impl "),
+        "command {name}: `where` and `impl` results aren't supported"
+    );
+    let ret = head.strip_prefix("->").map(str::trim).unwrap_or("()");
+    let ok = ret
+        .strip_prefix("Result<")
+        .and_then(|r| r.strip_suffix('>'))
+        .map(|r| split_top(r)[0].to_string())
+        .unwrap_or_else(|| ret.to_string());
+    Signature {
+        args,
+        result: ts_type(&ok, named),
+    }
+}
+
+/// The source file of a module path like `mods::commands`.
+fn module_source(module: &str) -> String {
+    let src = Path::new(env!("CARGO_MANIFEST_DIR")).join("src");
+    let rel = module.replace("::", "/");
+    [format!("{rel}.rs"), format!("{rel}/mod.rs")]
+        .iter()
+        .find_map(|f| std::fs::read_to_string(src.join(f)).ok())
+        .unwrap_or_else(|| panic!("no source for module {module}"))
+}
+
+fn signatures(named: &mut std::collections::BTreeSet<String>) -> Vec<(String, Signature)> {
+    command_paths()
+        .iter()
+        .map(|path| {
+            let (module, name) = path.rsplit_once("::").expect("module::command");
+            let sig = signature_in(&module_source(module), name, named);
+            (name.to_string(), sig)
+        })
+        .collect()
+}
+
+/// Tauri passes arguments under their camelCase names (`asset_url` as `assetUrl`).
+fn camel(snake: &str) -> String {
+    let mut out = String::new();
+    let mut upper = false;
+    for c in snake.trim_start_matches('_').chars() {
+        if c == '_' {
+            upper = true;
+        } else if upper {
+            out.push(c.to_ascii_uppercase());
+            upper = false;
+        } else {
+            out.push(c);
+        }
+    }
+    out
+}
+
+fn commands_ts() -> String {
+    let mut named = std::collections::BTreeSet::new();
+    let sigs = signatures(&mut named);
+    named.extend(crate::ipc::EVENTS.iter().map(|(_, _, t)| t.to_string()));
+    let mut s = String::from(HEADER);
+    s.push('\n');
+    for t in &named {
+        s.push_str(&format!("import type {{ {t} }} from \"./{t}\";\n"));
+    }
+    s.push_str(
+        "\n/** Every Tauri command, by the name `invoke` takes. */\nexport const COMMANDS = {\n",
+    );
+    for name in command_names() {
+        s.push_str(&format!("  {}: \"{name}\",\n", camel(&name)));
+    }
+    s.push_str(
+        "} as const;\n\nexport type CommandName = (typeof COMMANDS)[keyof typeof COMMANDS];\n",
+    );
+    s.push_str("\n/** Every event the backend emits. */\nexport const EVENTS = {\n");
+    for (key, name, _) in crate::ipc::EVENTS {
+        s.push_str(&format!("  {key}: \"{name}\",\n"));
+    }
+    s.push_str("} as const;\n\nexport type EventName = (typeof EVENTS)[keyof typeof EVENTS];\n");
+
+    s.push_str(
+        "\n/** Every command's arguments and result, read from its declaration in Rust. */\n\
+         export interface CommandSignatures {\n",
+    );
+    for (name, sig) in &sigs {
+        let args = if sig.args.is_empty() {
+            "Record<string, never>".to_string()
+        } else {
+            let fields: Vec<String> = sig.args.iter().map(|(n, t)| format!("{n}: {t}")).collect();
+            format!("{{ {} }}", fields.join("; "))
+        };
+        s.push_str(&format!(
+            "  {name}: {{ args: {args}; result: {} }};\n",
+            sig.result
+        ));
+    }
+    s.push_str("}\n\n/** Every event's payload. */\nexport interface EventPayloads {\n");
+    for (_, name, payload) in crate::ipc::EVENTS {
+        s.push_str(&format!("  \"{name}\": {payload};\n"));
+    }
+    s.push_str("}\n");
+    s
+}
+
+/// Writes every binding into `dir`, which must exist.
+fn export_into(dir: &Path) {
+    let cfg = Config::new().with_large_int("number").with_out_dir(dir);
+    macro_rules! export {
+        ($($t:ty),* $(,)?) => {
+            $( <$t>::export_all(&cfg).expect(stringify!($t)); )*
+        };
+    }
+    export!(
+        AppError,
+        ErrorCode,
+        Catalog,
+        CatalogUpdate,
+        ProfileReport,
+        ChangeResult,
+        CopyResult,
+        CopyItem,
+        CopyOutcome,
+        CopyPreview,
+        InstallPlan,
+        FileInspection,
+        ModProgress,
+        ProgressStage,
+        ModFailure,
+        FailureKind,
+        GameStateEvent,
+        InstallProgress,
+        Release,
+        InstalledVersion,
+    );
+
+    let mut modules: Vec<String> = std::fs::read_dir(dir)
+        .unwrap()
+        .filter_map(|e| {
+            let name = e.unwrap().file_name().to_string_lossy().to_string();
+            name.strip_suffix(".ts").map(str::to_string)
+        })
+        .collect();
+    modules.sort();
+    let mut index = String::from(HEADER);
+    index.push('\n');
+    for m in &modules {
+        index.push_str(&format!("export type * from \"./{m}\";\n"));
+    }
+    index.push_str("export * from \"./commands\";\n");
+    std::fs::write(dir.join("index.ts"), index).unwrap();
+    let commands = commands_ts();
+    for line in commands.lines().filter(|l| l.starts_with("import type")) {
+        let module = line.rsplit("\"./").next().unwrap().trim_end_matches("\";");
+        assert!(
+            modules.iter().any(|m| m == module),
+            "commands.ts names {module}, which no exported type is; add it to export_into"
+        );
+    }
+    std::fs::write(dir.join("commands.ts"), commands).unwrap();
+}
+
+fn read_all(dir: &Path) -> BTreeMap<String, String> {
+    std::fs::read_dir(dir)
+        .map(|entries| {
+            entries
+                .flatten()
+                .filter(|e| e.path().extension().is_some_and(|x| x == "ts"))
+                .map(|e| {
+                    let name = e.file_name().to_string_lossy().to_string();
+                    let text = std::fs::read_to_string(e.path()).unwrap();
+                    (name, text.replace("\r\n", "\n"))
+                })
+                .collect()
+        })
+        .unwrap_or_default()
+}
+
+#[test]
+fn bindings_are_current() {
+    let tmp = tempfile::tempdir().unwrap();
+    export_into(tmp.path());
+    let fresh = read_all(tmp.path());
+    let committed = read_all(&committed_dir());
+    let mut stale: Vec<&str> = fresh
+        .iter()
+        .filter(|(name, text)| committed.get(*name) != Some(*text))
+        .map(|(name, _)| name.as_str())
+        .collect();
+    stale.extend(
+        committed
+            .keys()
+            .filter(|name| !fresh.contains_key(*name))
+            .map(String::as_str),
+    );
+    assert!(
+        stale.is_empty(),
+        "src/mods/bindings is out of date ({}).\n\
+         Regenerate it with `cargo test export_bindings -- --ignored` in src-tauri, then commit it.",
+        stale.join(", ")
+    );
+}
+
+#[test]
+#[ignore = "writes src/mods/bindings; run on purpose"]
+fn export_bindings() {
+    let dir = committed_dir();
+    std::fs::create_dir_all(&dir).unwrap();
+    for name in read_all(&dir).keys() {
+        std::fs::remove_file(dir.join(name)).unwrap();
+    }
+    export_into(&dir);
+}
+
+#[test]
+fn every_command_is_listed() {
+    let names = command_names();
+    for expected in [
+        "list_mod_catalog",
+        "plan_mod_install",
+        "preview_copy_mod_profile",
+        "launch_version",
+    ] {
+        assert!(names.iter().any(|n| n == expected), "{expected}");
+    }
+    assert_eq!(camel("preview_copy_mod_profile"), "previewCopyModProfile");
+    assert_eq!(camel("expected_sha256"), "expectedSha256");
+    assert_eq!(camel("_tag"), "tag");
+}
+
+#[test]
+fn signatures_are_read_from_the_declarations() {
+    let source = r#"
+        #[tauri::command]
+        pub async fn install_version(
+            app_handle: tauri::AppHandle,
+            tag: String,
+            expected_sha256: Option<String>,
+        ) -> Result<InstalledVersion, AppError> {
+            todo!()
+        }
+        pub async fn list(app: AppHandle, force_refresh: bool) -> Result<Vec<String>, AppError> {}
+        pub async fn open(app: AppHandle, _tag: String) -> Result<(), AppError> {}
+    "#;
+    let mut named = std::collections::BTreeSet::new();
+    let sig = signature_in(source, "install_version", &mut named);
+    assert_eq!(
+        sig,
+        Signature {
+            args: vec![
+                ("tag".into(), "string".into()),
+                ("expectedSha256".into(), "string | null".into())
+            ],
+            result: "InstalledVersion".into(),
+        }
+    );
+    let sig = signature_in(source, "list", &mut named);
+    assert_eq!(
+        sig.args,
+        [("forceRefresh".to_string(), "boolean".to_string())]
+    );
+    assert_eq!(sig.result, "Array<string>");
+    let sig = signature_in(source, "open", &mut named);
+    assert_eq!(sig.args, [("tag".to_string(), "string".to_string())]);
+    assert_eq!(sig.result, "void");
+    assert_eq!(named.into_iter().collect::<Vec<_>>(), ["InstalledVersion"]);
+
+    // Shapes it can't read are refused, by name.
+    for (bad, why) in [
+        (
+            "#[tauri::command(rename_all = \"snake_case\")]\npub async fn a(x: String) {}",
+            "options",
+        ),
+        ("pub async fn a(#[allow(x)] x: String) {}", "#["),
+        ("pub async fn a(x: impl Into<String>) {}", "impl"),
+        ("pub async fn a<T>(x: T) {}", "generics"),
+        (
+            "pub fn a(x: String) -> Result<T, E> where T: Clone {}",
+            "where",
+        ),
+        ("pub fn a((x, y): (u8, u8)) {}", "plain name"),
+    ] {
+        let got = std::panic::catch_unwind(|| {
+            signature_in(bad, "a", &mut std::collections::BTreeSet::new())
+        });
+        let message = got
+            .err()
+            .and_then(|e| e.downcast::<String>().ok())
+            .map(|m| *m)
+            .unwrap_or_else(|| panic!("{bad:?} was read"));
+        assert!(message.contains(why), "{bad:?}: {message}");
+    }
+
+    // Containers nest; paths and the AppError payload are written by their exported name.
+    let mut named = std::collections::BTreeSet::new();
+    assert_eq!(
+        ts_type("Option<Vec<Option<u64>>>", &mut named),
+        "Array<number | null> | null"
+    );
+    assert_eq!(
+        ts_type("Vec<crate::mods::catalog::Catalog>", &mut named),
+        "Array<Catalog>"
+    );
+    assert_eq!(
+        ts_type("crate::error::AppError", &mut named),
+        "AppErrorPayload"
+    );
+    assert_eq!(
+        named.into_iter().collect::<Vec<_>>(),
+        ["AppErrorPayload", "Catalog"]
+    );
+    // What TypeScript can't be written for is refused with what can.
+    for bad in [
+        "HashMap<String, u8>",
+        "(u8, u8)",
+        "&String",
+        "[u8; 4]",
+        "Box<str>",
+    ] {
+        let got = std::panic::catch_unwind(|| ts_type(bad, &mut std::collections::BTreeSet::new()));
+        let message = got
+            .err()
+            .and_then(|e| e.downcast::<String>().ok())
+            .map(|m| *m)
+            .unwrap_or_else(|| panic!("{bad:?} was written"));
+        assert!(message.contains("Option<…>, Vec<…>"), "{bad:?}: {message}");
+    }
+
+    // Every registered command has one.
+    let mut named = std::collections::BTreeSet::new();
+    let all = signatures(&mut named);
+    assert_eq!(all.len(), command_names().len());
+    let restore = all.iter().find(|(n, _)| n == "restore_mod").unwrap();
+    assert_eq!(restore.1.result, "ChangeResult");
+}
diff --git a/src-tauri/src/download.rs b/src-tauri/src/download.rs
new file mode 100644
index 0000000..6cb20d1
--- /dev/null
+++ b/src-tauri/src/download.rs
@@ -0,0 +1,249 @@
+//! Streams a download to a file and hashes it on the way, for game versions and mods alike.
+
+use futures_util::StreamExt;
+use reqwest::header::USER_AGENT;
+use sha2::{Digest, Sha256};
+use std::path::Path;
+use thiserror::Error;
+use tokio::io::AsyncWriteExt;
+
+const USER_AGENT_VALUE: &str = concat!("weft-launcher/", env!("CARGO_PKG_VERSION"));
+
+#[derive(Debug, Error)]
+pub enum DownloadError {
+    #[error("{0}")]
+    Network(#[from] reqwest::Error),
+    #[error("{0}")]
+    Io(#[from] std::io::Error),
+    #[error("HTTP {0}")]
+    Status(reqwest::StatusCode),
+    #[error("larger than {0} bytes")]
+    TooLarge(u64),
+}
+
+#[derive(Debug, Clone, Copy)]
+pub struct Progress {
+    pub downloaded: u64,
+    /// 0 when the server doesn't say.
+    pub total: u64,
+    pub percent: u32,
+    pub speed_mbps: f64,
+}
+
+pub struct Downloaded {
+    pub bytes: u64,
+    /// Lowercase hex.
+    pub sha256: String,
+}
+
+/// Where a redirect may lead: https, on GitHub's own hosts. Release downloads redirect from
+/// `github.com` to `objects.githubusercontent.com` or `release-assets.githubusercontent.com`,
+/// and GitHub Pages may redirect within `github.io`.
+pub fn redirect_allowed(url: &url::Url) -> bool {
+    let host = url.host_str().unwrap_or("");
+    let on = |domain: &str| host == domain || host.ends_with(&format!(".{domain}"));
+    url.scheme() == "https"
+        && url.port().is_none()
+        && url.username().is_empty()
+        && url.password().is_none()
+        && (on("github.com") || on("githubusercontent.com") || on("github.io"))
+}
+
+/// Where a mod's icon may come from: GitHub's own hosts for repository files and images, and
+/// GitHub Pages. Anything else is dropped where a catalogue is read, and refused again before a
+/// fetch, so browsing never tells another host the player's address.
+pub fn icon_url_allowed(raw: &str) -> bool {
+    let Ok(url) = url::Url::parse(raw) else {
+        return false;
+    };
+    let host = url.host_str().unwrap_or("");
+    let pages = host
+        .strip_suffix(".github.io")
+        .is_some_and(|name| !name.is_empty() && !name.contains('.'));
+    url.scheme() == "https"
+        && url.port().is_none()
+        && url.username().is_empty()
+        && url.password().is_none()
+        && (matches!(
+            host,
+            "github.com" | "raw.githubusercontent.com" | "user-images.githubusercontent.com"
+        ) || pages)
+}
+
+/// Follows at most 10 redirects, each to an allowed place (see [`redirect_allowed`]).
+pub fn redirect_policy() -> reqwest::redirect::Policy {
+    reqwest::redirect::Policy::custom(|attempt| {
+        if attempt.previous().len() >= 10 {
+            attempt.error("too many redirects")
+        } else if redirect_allowed(attempt.url()) {
+            attempt.follow()
+        } else {
+            let to = attempt.url().to_string();
+            attempt.error(format!("refused a redirect to {to}"))
+        }
+    })
+}
+
+/// No total timeout: a slow connection may take long, as long as data keeps coming.
+pub fn client() -> Result<reqwest::Client, reqwest::Error> {
+    reqwest::Client::builder()
+        .connect_timeout(std::time::Duration::from_secs(30))
+        .read_timeout(std::time::Duration::from_secs(60))
+        .redirect(redirect_policy())
+        .build()
+}
+
+/// Reads at most `max` bytes of a response, chunk by chunk; `None` if it is longer. Nothing past
+/// the limit is read, whatever the response claims its length is.
+pub async fn read_capped(
+    mut response: reqwest::Response,
+    max: usize,
+) -> Result<Option<Vec<u8>>, reqwest::Error> {
+    if response.content_length().is_some_and(|n| n > max as u64) {
+        return Ok(None);
+    }
+    let mut bytes = Vec::new();
+    while let Some(chunk) = response.chunk().await? {
+        if bytes.len() + chunk.len() > max {
+            return Ok(None);
+        }
+        bytes.extend_from_slice(&chunk);
+    }
+    Ok(Some(bytes))
+}
+
+/// Reports about every 1% (or 100 KB when the size is unknown). `max_bytes` stops a download that
+/// grows past what was announced.
+pub async fn to_file(
+    client: &reqwest::Client,
+    url: &str,
+    dest: &Path,
+    max_bytes: Option<u64>,
+    mut on_progress: impl FnMut(Progress),
+) -> Result<Downloaded, DownloadError> {
+    let response = client
+        .get(url)
+        .header(USER_AGENT, USER_AGENT_VALUE)
+        .send()
+        .await?;
+    if !response.status().is_success() {
+        return Err(DownloadError::Status(response.status()));
+    }
+    let total = response.content_length().unwrap_or(0);
+    if let Some(max) = max_bytes
+        && total > max
+    {
+        return Err(DownloadError::TooLarge(max));
+    }
+
+    let mut file = tokio::fs::File::create(dest).await?;
+    let mut hasher = Sha256::new();
+    let mut downloaded: u64 = 0;
+    let mut last_percent = 0u32;
+    let mut last_bytes = 0u64;
+    let mut last_time = std::time::Instant::now();
+    #[cfg(debug_assertions)]
+    let start = std::time::Instant::now();
+
+    let mut stream = response.bytes_stream();
+    while let Some(chunk) = stream.next().await {
+        let chunk = chunk?;
+        downloaded += chunk.len() as u64;
+        if let Some(max) = max_bytes
+            && downloaded > max
+        {
+            return Err(DownloadError::TooLarge(max));
+        }
+        hasher.update(&chunk);
+        file.write_all(&chunk).await?;
+
+        let percent = if total > 0 {
+            ((downloaded as f64 / total as f64) * 100.0) as u32
+        } else {
+            0
+        };
+        let due = if total > 0 {
+            percent > last_percent
+        } else {
+            downloaded >= last_bytes + 100_000
+        };
+        if due {
+            let now = std::time::Instant::now();
+            let elapsed = now.duration_since(last_time).as_secs_f64();
+            let speed_mbps = if elapsed > 0.0 {
+                (downloaded.saturating_sub(last_bytes) as f64 * 8.0 / 1_000_000.0) / elapsed
+            } else {
+                0.0
+            };
+            on_progress(Progress {
+                downloaded,
+                total,
+                percent,
+                speed_mbps,
+            });
+            last_percent = percent;
+            last_bytes = downloaded;
+            last_time = now;
+        }
+
+        // `WEFT_THROTTLE_KBPS=200 npm run tauri dev` shows the progress UI on a fast connection.
+        #[cfg(debug_assertions)]
+        if let Ok(val) = std::env::var("WEFT_THROTTLE_KBPS")
+            && let Ok(kbps) = val.parse::<f64>()
+            && kbps > 0.0
+        {
+            let expected = downloaded as f64 / (kbps * 1024.0);
+            let actual = start.elapsed().as_secs_f64();
+            if expected > actual {
+                tokio::time::sleep(std::time::Duration::from_secs_f64(expected - actual)).await;
+            }
+        }
+    }
+    file.flush().await?;
+
+    Ok(Downloaded {
+        bytes: downloaded,
+        sha256: format!("{:x}", hasher.finalize()),
+    })
+}
+
+pub fn sha256_hex(bytes: &[u8]) -> String {
+    format!("{:x}", Sha256::digest(bytes))
+}
+
+/// SHA-256 of a file on disk, lowercase hex.
+pub fn sha256_file(path: &Path) -> std::io::Result<String> {
+    let mut file = std::fs::File::open(path)?;
+    let mut hasher = Sha256::new();
+    std::io::copy(&mut file, &mut hasher)?;
+    Ok(format!("{:x}", hasher.finalize()))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn redirects_stay_on_github_over_https() {
+        for ok in [
+            "https://github.com/a/b/releases/download/t/x.zip",
+            "https://objects.githubusercontent.com/github-production-release-asset/1",
+            "https://release-assets.githubusercontent.com/x",
+            "https://raw.githubusercontent.com/a/b/main/x",
+            "https://weft-rust.github.io/weft-mods-index/v1/index.json",
+        ] {
+            assert!(redirect_allowed(&url::Url::parse(ok).unwrap()), "{ok}");
+        }
+        for bad in [
+            "http://objects.githubusercontent.com/x",
+            "https://evil.example/x",
+            "https://github.com.evil.example/x",
+            "https://notgithub.com/x",
+            "https://github.com:8443/x",
+            "https://user@github.com/x",
+            "https://127.0.0.1/x",
+        ] {
+            assert!(!redirect_allowed(&url::Url::parse(bad).unwrap()), "{bad}");
+        }
+    }
+}
diff --git a/src-tauri/src/error.rs b/src-tauri/src/error.rs
index abc78ed..5569ec0 100644
--- a/src-tauri/src/error.rs
+++ b/src-tauri/src/error.rs
@@ -1,46 +1,154 @@
 use serde::Serialize;
 use thiserror::Error;
+use ts_rs::TS;
 
-#[derive(Debug, Clone, Serialize, Error)]
+macro_rules! error_codes {
+    ($($code:ident),* $(,)?) => {
+        /// Every code an [`AppError`] can carry, across the whole app. On the wire a code is its
+        /// variant name; `src/i18n/errors.ts` turns it into a translation key.
+        #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, TS)]
+        pub enum ErrorCode {
+            $($code),*
+        }
+
+        impl ErrorCode {
+            pub const ALL: &'static [ErrorCode] = &[$(ErrorCode::$code),*];
+
+            pub fn as_str(self) -> &'static str {
+                match self {
+                    $(ErrorCode::$code => stringify!($code)),*
+                }
+            }
+        }
+    };
+}
+
+error_codes! {
+    // Shared
+    Network,
+    HttpStatus,
+    Io,
+    DiskFull,
+    Serde,
+    RateLimited,
+    InvalidName,
+    // Releases
+    InvalidHeader,
+    CacheCorrupted,
+    AssetNotFound,
+    MissingDigest,
+    Forbidden,
+    OfflineNoCache,
+    // Installing game versions
+    Zip,
+    CreateDir,
+    Sha256Mismatch,
+    HashMissing,
+    AlreadyInstalled,
+    NotInstalled,
+    DownloadFailed,
+    ExtractFailed,
+    GameRunning,
+    VersionInUse,
+    InstallInProgress,
+    // Launching
+    AlreadyRunning,
+    AnotherGameRunning,
+    ExecutableNotFound,
+    ProcessSpawnFailed,
+    LogDirCreateFailed,
+    GameFolderNotFound,
+    OpenerError,
+    // Mods
+    IndexSignatureInvalid,
+    IndexRollback,
+    IndexInvalid,
+    AbiUnavailable,
+    ModNotInCatalog,
+    ModIncompatible,
+    ModNotForPlatform,
+    ModRevoked,
+    ModArchiveInvalid,
+    ModFileChanged,
+    ModNotInstalled,
+    ModStoreMissing,
+    ModsBlocked,
+    ModSourceInvalid,
+    ModSourceNotFound,
+    ModSourcesDamaged,
+    ModSourceRateLimited,
+    ModDownloadNotFound,
+    ModTooLarge,
+    ModIdReserved,
+    ModChangedMeanwhile,
+    ModCancelled,
+    ModLockInvalid,
+    ModUrlRefused,
+    ModIconInvalid,
+}
+
+impl std::fmt::Display for ErrorCode {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(self.as_str())
+    }
+}
+
+/// What a command rejects with, and what successful payloads carry as an embedded error.
+#[derive(Debug, Clone, Serialize, Error, TS)]
+#[ts(rename = "AppErrorPayload")]
 #[error("{code}{}", .detail.as_ref().map(|d| format!(": {}", d)).unwrap_or_default())]
 pub struct AppError {
-    pub code: &'static str,
+    pub code: ErrorCode,
     pub detail: Option<String>,
 }
 
 impl AppError {
-    pub fn new(code: &'static str, detail: Option<String>) -> Self {
+    pub fn new(code: ErrorCode, detail: Option<String>) -> Self {
         Self { code, detail }
     }
 }
 
+/// A full disk is its own problem: the player can fix it, a retry won't.
+pub fn is_disk_full(err: &std::io::Error) -> bool {
+    matches!(
+        err.kind(),
+        std::io::ErrorKind::StorageFull | std::io::ErrorKind::QuotaExceeded
+    )
+}
+
 impl From<std::io::Error> for AppError {
     fn from(err: std::io::Error) -> Self {
-        AppError::new("Io", Some(err.to_string()))
+        let code = if is_disk_full(&err) {
+            ErrorCode::DiskFull
+        } else {
+            ErrorCode::Io
+        };
+        AppError::new(code, Some(err.to_string()))
     }
 }
 
 impl From<reqwest::Error> for AppError {
     fn from(err: reqwest::Error) -> Self {
-        AppError::new("Network", Some(err.to_string()))
+        AppError::new(ErrorCode::Network, Some(err.to_string()))
     }
 }
 
 impl From<crate::releases::ReleasesError> for AppError {
     fn from(err: crate::releases::ReleasesError) -> Self {
         use crate::releases::ReleasesError::*;
+        use ErrorCode as C;
         match err {
-            Network(e) => AppError::new("Network", Some(e.to_string())),
-            Io(e) => AppError::new("Io", Some(e.to_string())),
-            Serde(e) => AppError::new("Serde", Some(e.to_string())),
-            InvalidHeader(e) => AppError::new("InvalidHeader", Some(e.to_string())),
-            CacheCorrupted(msg) => AppError::new("CacheCorrupted", Some(msg)),
-            AssetNotFound => AppError::new("AssetNotFound", None),
-            MissingDigest => AppError::new("MissingDigest", None),
-            RateLimited => AppError::new("RateLimited", None),
-            Forbidden => AppError::new("Forbidden", None),
-            OfflineNoCache => AppError::new("OfflineNoCache", None),
-            UnexpectedStatus(status) => AppError::new("Network", Some(format!("HTTP {status}"))),
+            Network(e) => AppError::new(C::Network, Some(e.to_string())),
+            Io(e) => e.into(),
+            Serde(e) => AppError::new(C::Serde, Some(e.to_string())),
+            InvalidHeader(e) => AppError::new(C::InvalidHeader, Some(e.to_string())),
+            CacheCorrupted(msg) => AppError::new(C::CacheCorrupted, Some(msg)),
+            AssetNotFound => AppError::new(C::AssetNotFound, None),
+            MissingDigest => AppError::new(C::MissingDigest, None),
+            RateLimited => AppError::new(C::RateLimited, None),
+            Forbidden => AppError::new(C::Forbidden, None),
+            OfflineNoCache => AppError::new(C::OfflineNoCache, None),
+            UnexpectedStatus(status) => AppError::new(C::Network, Some(format!("HTTP {status}"))),
         }
     }
 }
@@ -48,30 +156,31 @@ impl From<crate::releases::ReleasesError> for AppError {
 impl From<crate::install::InstallError> for AppError {
     fn from(err: crate::install::InstallError) -> Self {
         use crate::install::InstallError::*;
+        use ErrorCode as C;
         match err {
-            Network(e) => AppError::new("Network", Some(e.to_string())),
-            Io(e) => AppError::new("Io", Some(e.to_string())),
-            Serde(e) => AppError::new("Serde", Some(e.to_string())),
-            Zip(e) => AppError::new("Zip", Some(e.to_string())),
-            CreateDir(msg) => AppError::new("CreateDir", Some(msg)),
+            Network(e) => AppError::new(C::Network, Some(e.to_string())),
+            Io(e) => e.into(),
+            Serde(e) => AppError::new(C::Serde, Some(e.to_string())),
+            Zip(e) => AppError::new(C::Zip, Some(e.to_string())),
+            CreateDir(msg) => AppError::new(C::CreateDir, Some(msg)),
             Sha256Mismatch { expected, actual } => AppError::new(
-                "Sha256Mismatch",
+                C::Sha256Mismatch,
                 Some(format!("expected {}, got {}", expected, actual)),
             ),
-            MissingDigest => AppError::new("MissingDigest", None),
-            HashMissing => AppError::new("HashMissing", None),
-            AssetNotFound => AppError::new("AssetNotFound", None),
-            AlreadyInstalled(tag) => AppError::new("AlreadyInstalled", Some(tag)),
-            NotInstalled(tag) => AppError::new("NotInstalled", Some(tag)),
-            RateLimited => AppError::new("RateLimited", None),
-            Forbidden => AppError::new("Forbidden", None),
-            OfflineNoCache => AppError::new("OfflineNoCache", None),
-            DownloadFailed(msg) => AppError::new("DownloadFailed", Some(msg)),
-            ExtractFailed(msg) => AppError::new("ExtractFailed", Some(msg)),
-            GameRunning(tag) => AppError::new("GameRunning", Some(tag)),
-            VersionInUse(tag) => AppError::new("VersionInUse", Some(tag)),
-            InvalidName(name) => AppError::new("InvalidName", Some(name)),
-            InstallInProgress(tag) => AppError::new("InstallInProgress", Some(tag)),
+            MissingDigest => AppError::new(C::MissingDigest, None),
+            HashMissing => AppError::new(C::HashMissing, None),
+            AssetNotFound => AppError::new(C::AssetNotFound, None),
+            AlreadyInstalled(tag) => AppError::new(C::AlreadyInstalled, Some(tag)),
+            NotInstalled(tag) => AppError::new(C::NotInstalled, Some(tag)),
+            RateLimited => AppError::new(C::RateLimited, None),
+            Forbidden => AppError::new(C::Forbidden, None),
+            OfflineNoCache => AppError::new(C::OfflineNoCache, None),
+            DownloadFailed(msg) => AppError::new(C::DownloadFailed, Some(msg)),
+            ExtractFailed(msg) => AppError::new(C::ExtractFailed, Some(msg)),
+            GameRunning(tag) => AppError::new(C::GameRunning, Some(tag)),
+            VersionInUse(tag) => AppError::new(C::VersionInUse, Some(tag)),
+            InvalidName(name) => AppError::new(C::InvalidName, Some(name)),
+            InstallInProgress(tag) => AppError::new(C::InstallInProgress, Some(tag)),
         }
     }
 }
@@ -79,17 +188,47 @@ impl From<crate::install::InstallError> for AppError {
 impl From<crate::launch::LaunchError> for AppError {
     fn from(err: crate::launch::LaunchError) -> Self {
         use crate::launch::LaunchError::*;
+        use ErrorCode as C;
         match err {
-            Io(e) => AppError::new("Io", Some(e.to_string())),
-            AlreadyRunning(tag) => AppError::new("AlreadyRunning", Some(tag)),
-            AnotherGameRunning(tag) => AppError::new("AnotherGameRunning", Some(tag)),
+            Io(e) => e.into(),
+            AlreadyRunning(tag) => AppError::new(C::AlreadyRunning, Some(tag)),
+            AnotherGameRunning(tag) => AppError::new(C::AnotherGameRunning, Some(tag)),
             ExecutableNotFound(path_or_tag) => {
-                AppError::new("ExecutableNotFound", Some(path_or_tag))
+                AppError::new(C::ExecutableNotFound, Some(path_or_tag))
             }
-            ProcessSpawnFailed(msg) => AppError::new("ProcessSpawnFailed", Some(msg)),
-            LogDirCreateFailed(msg) => AppError::new("LogDirCreateFailed", Some(msg)),
-            GameFolderNotFound(msg) => AppError::new("GameFolderNotFound", Some(msg)),
-            OpenerError(e) => AppError::new("OpenerError", Some(e.to_string())),
+            ProcessSpawnFailed(msg) => AppError::new(C::ProcessSpawnFailed, Some(msg)),
+            LogDirCreateFailed(msg) => AppError::new(C::LogDirCreateFailed, Some(msg)),
+            GameFolderNotFound(detail) => AppError::new(C::GameFolderNotFound, detail),
+            OpenerError(e) => AppError::new(C::OpenerError, Some(e.to_string())),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn codes_keep_their_wire_strings() {
+        for code in ErrorCode::ALL {
+            assert_eq!(
+                serde_json::to_value(code).unwrap(),
+                serde_json::Value::String(code.as_str().to_string())
+            );
         }
+        let e = AppError::new(ErrorCode::ModsBlocked, Some("Cogwork".into()));
+        assert_eq!(
+            serde_json::to_string(&e).unwrap(),
+            r#"{"code":"ModsBlocked","detail":"Cogwork"}"#
+        );
+        assert_eq!(e.to_string(), "ModsBlocked: Cogwork");
+    }
+
+    #[test]
+    fn a_full_disk_has_its_own_code() {
+        let full = std::io::Error::from(std::io::ErrorKind::StorageFull);
+        assert_eq!(AppError::from(full).code, ErrorCode::DiskFull);
+        let other = std::io::Error::from(std::io::ErrorKind::PermissionDenied);
+        assert_eq!(AppError::from(other).code, ErrorCode::Io);
     }
 }
diff --git a/src-tauri/src/install.rs b/src-tauri/src/install.rs
index f08c3df..ce084c4 100644
--- a/src-tauri/src/install.rs
+++ b/src-tauri/src/install.rs
@@ -1,15 +1,11 @@
-use futures_util::StreamExt;
-use reqwest::header::USER_AGENT;
 use serde::{Deserialize, Serialize};
-use sha2::{Digest, Sha256};
 use std::collections::HashSet;
 use std::fs::File as StdFile;
 use std::path::{Component, Path, PathBuf};
 use std::sync::{Arc, Mutex};
-use tauri::{Emitter, Manager};
+use tauri::Manager;
 use thiserror::Error;
 use tokio::fs;
-use tokio::io::{AsyncReadExt, AsyncWriteExt};
 use zip::result::ZipError;
 
 #[cfg(unix)]
@@ -19,7 +15,6 @@ use crate::config::WEFT_REPO;
 use crate::error::AppError;
 use crate::launch::running_game;
 
-const USER_AGENT_VALUE: &str = concat!("weft-launcher/", env!("CARGO_PKG_VERSION"));
 const TEMP_EXTRACT_PREFIX: &str = ".tmp-";
 const REMOVING_PREFIX: &str = ".removing-";
 
@@ -67,7 +62,30 @@ pub enum InstallError {
     InstallInProgress(String),
 }
 
-#[derive(Debug, Clone, Serialize, Deserialize)]
+/// What a game version install is doing.
+#[derive(Debug, Clone, Copy, Serialize, ts_rs::TS)]
+#[serde(rename_all = "lowercase")]
+pub enum InstallStage {
+    Downloading,
+    Verifying,
+    Extracting,
+    Finalizing,
+}
+
+/// The `install-progress` event.
+#[derive(Debug, Clone, Serialize, ts_rs::TS)]
+#[serde(rename_all = "camelCase")]
+pub struct InstallProgress {
+    pub tag: String,
+    pub downloaded: u64,
+    /// 0 when the server doesn't say.
+    pub total: u64,
+    pub percent: u32,
+    pub stage: InstallStage,
+    pub speed_mbps: f64,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, ts_rs::TS)]
 pub struct InstalledVersion {
     pub tag: String,
     pub path: String,
@@ -167,6 +185,17 @@ pub fn sweep_leftovers(app_handle: &tauri::AppHandle) {
     }
 }
 
+/// Why `url` is not the release asset `asset_name` of game version `tag`, if it isn't: the mods'
+/// rule ([`crate::mods::index::release_asset_problem`]) for the game's own repo. A URL that only
+/// starts right, like `…/releases/download/../../../other/repo/…`, is refused.
+pub fn version_url_problem(
+    tag: &str,
+    asset_name: &str,
+    url: &str,
+) -> Option<crate::mods::index::UrlProblem> {
+    crate::mods::index::release_asset_problem(WEFT_REPO, tag, asset_name, url)
+}
+
 #[tauri::command]
 pub async fn install_version(
     app_handle: tauri::AppHandle,
@@ -180,9 +209,10 @@ pub async fn install_version(
     let expected_sha256 = expected_sha256
         .filter(|s| !s.is_empty())
         .ok_or(InstallError::HashMissing)?;
-    let allowed = format!("https://github.com/{WEFT_REPO}/releases/download/");
-    if !asset_url.starts_with(&allowed) {
-        return Err(InstallError::DownloadFailed(format!("unexpected URL: {asset_url}")).into());
+    if let Some(why) = version_url_problem(&tag, &asset_name, &asset_url) {
+        return Err(
+            InstallError::DownloadFailed(format!("unexpected URL {asset_url}: {why}")).into(),
+        );
     }
 
     let active = app_handle.state::<ActiveInstalls>().inner().clone();
@@ -234,146 +264,58 @@ async fn download_and_install(
         fs::remove_dir_all(&version_dir).await?;
     }
 
-    // No total timeout: a slow connection may take long, as long as data keeps coming.
-    let client = reqwest::Client::builder()
-        .connect_timeout(std::time::Duration::from_secs(30))
-        .read_timeout(std::time::Duration::from_secs(60))
-        .build()?;
-
-    let response = client
-        .get(asset_url)
-        .header(USER_AGENT, USER_AGENT_VALUE)
-        .send()
-        .await
-        .map_err(|e| InstallError::DownloadFailed(e.to_string()))?;
-
-    if !response.status().is_success() {
-        return Err(InstallError::DownloadFailed(format!("HTTP {}", response.status())).into());
-    }
-
-    let total_size = response.content_length().unwrap_or(0);
-    let mut downloaded: u64 = 0;
-    let mut last_reported_percent = 0u32;
-    let mut last_reported_bytes = 0u64;
-    let mut last_report_time = std::time::Instant::now();
-
-    #[cfg(debug_assertions)]
-    let download_start = std::time::Instant::now();
-
-    let mut file = fs::File::create(temp_download).await?;
-
-    // Stream download with progress
-    let mut stream = response.bytes_stream();
-    while let Some(chunk_result) = stream.next().await {
-        let chunk = chunk_result?;
-
-        file.write_all(&chunk).await?;
-
-        downloaded += chunk.len() as u64;
-
-        // Throttle progress: emit every ~1% or 100KB
-        let percent = if total_size > 0 {
-            ((downloaded as f64 / total_size as f64) * 100.0) as u32
-        } else {
-            0
-        };
-        let should_report = if total_size > 0 {
-            percent > last_reported_percent
-        } else {
-            downloaded >= last_reported_bytes + 100_000
-        };
-
-        if should_report {
-            let now = std::time::Instant::now();
-            let elapsed = now.duration_since(last_report_time).as_secs_f64();
-            let bytes_since_last = downloaded.saturating_sub(last_reported_bytes);
-            let speed_mbps = if elapsed > 0.0 {
-                (bytes_since_last as f64 * 8.0 / 1_000_000.0) / elapsed
-            } else {
-                0.0
-            };
-
-            let _ = app_handle.emit(
-                "install-progress",
-                serde_json::json!({
-                    "tag": tag,
-                    "downloaded": downloaded,
-                    "total": total_size,
-                    "percent": percent,
-                    "stage": "downloading",
-                    "speedMbps": speed_mbps
-                }),
-            );
-            last_reported_percent = percent;
-            last_reported_bytes = downloaded;
-            last_report_time = now;
-        }
-
-        #[cfg(debug_assertions)]
-        {
-            if let Ok(val) = std::env::var("WEFT_THROTTLE_KBPS")
-                && let Ok(kbps) = val.parse::<f64>()
-                && kbps > 0.0
-            {
-                let bytes_per_sec = kbps * 1024.0;
-                let expected_duration = downloaded as f64 / bytes_per_sec;
-                let actual_duration = download_start.elapsed().as_secs_f64();
-                if expected_duration > actual_duration {
-                    let sleep_secs = expected_duration - actual_duration;
-                    tokio::time::sleep(std::time::Duration::from_secs_f64(sleep_secs)).await;
-                }
-            }
-        }
-    }
+    let client = crate::download::client()?;
+    let tag_owned = tag.to_string();
+    let downloaded = crate::download::to_file(&client, asset_url, temp_download, None, |p| {
+        crate::ipc::emit_install_progress(
+            app_handle,
+            &InstallProgress {
+                tag: tag_owned.clone(),
+                downloaded: p.downloaded,
+                total: p.total,
+                percent: p.percent,
+                stage: InstallStage::Downloading,
+                speed_mbps: p.speed_mbps,
+            },
+        );
+    })
+    .await
+    .map_err(|e| InstallError::DownloadFailed(e.to_string()))?;
+    let total_size = downloaded.bytes;
 
-    file.flush().await?;
-    drop(file);
-
-    // Final download progress
-    let _ = app_handle.emit(
-        "install-progress",
-        serde_json::json!({
-            "tag": tag,
-            "downloaded": downloaded,
-            "total": total_size,
-            "percent": 100,
-            "stage": "verifying",
-            "speedMbps": 0.0
-        }),
+    crate::ipc::emit_install_progress(
+        app_handle,
+        &InstallProgress {
+            tag: tag.to_string(),
+            downloaded: downloaded.bytes,
+            total: total_size,
+            percent: 100,
+            stage: InstallStage::Verifying,
+            speed_mbps: 0.0,
+        },
     );
 
-    // Verify SHA256
-    let mut file = fs::File::open(temp_download).await?;
-    let mut hasher = Sha256::new();
-    let mut buffer = vec![0u8; 8192];
-    loop {
-        let n = file.read(&mut buffer).await?;
-        if n == 0 {
-            break;
-        }
-        hasher.update(&buffer[..n]);
-    }
-    let actual = format!("{:x}", hasher.finalize());
-    if !actual.eq_ignore_ascii_case(expected_sha256) {
+    // Hashed while it downloaded.
+    if !downloaded.sha256.eq_ignore_ascii_case(expected_sha256) {
         return Err(InstallError::Sha256Mismatch {
             expected: expected_sha256.to_string(),
-            actual,
+            actual: downloaded.sha256,
         }
         .into());
     }
-    drop(file);
+    let downloaded = downloaded.bytes;
 
     // Extract to temp directory
-    let _ = app_handle.emit(
-        "install-progress",
-        serde_json::json!({
-            "tag": tag,
-            "downloaded": downloaded,
-            "total": total_size,
-            "percent": 100,
-            "stage": "extracting",
-            "speedMbps": 0.0
-        }),
+    crate::ipc::emit_install_progress(
+        app_handle,
+        &InstallProgress {
+            tag: tag.to_string(),
+            downloaded,
+            total: total_size,
+            percent: 100,
+            stage: InstallStage::Extracting,
+            speed_mbps: 0.0,
+        },
     );
 
     if temp_extract.exists() {
@@ -430,16 +372,16 @@ async fn download_and_install(
     }
 
     // Finalizing
-    let _ = app_handle.emit(
-        "install-progress",
-        serde_json::json!({
-            "tag": tag,
-            "downloaded": downloaded,
-            "total": total_size,
-            "percent": 100,
-            "stage": "finalizing",
-            "speedMbps": 0.0
-        }),
+    crate::ipc::emit_install_progress(
+        app_handle,
+        &InstallProgress {
+            tag: tag.to_string(),
+            downloaded,
+            total: total_size,
+            percent: 100,
+            stage: InstallStage::Finalizing,
+            speed_mbps: 0.0,
+        },
     );
 
     // Atomic rename
@@ -672,6 +614,7 @@ pub async fn remove_version(app_handle: tauri::AppHandle, tag: String) -> Result
         Ok(_) => {
             // Rename succeeded, now delete the renamed folder
             fs::remove_dir_all(&removing_dir).await?;
+            crate::mods::forget_version(&app_handle, &tag).await;
             Ok(())
         }
         Err(e) => {
@@ -755,4 +698,31 @@ mod tests {
         }
         assert!(validate_name("v26.10.4").is_ok());
     }
+
+    #[test]
+    fn version_urls_are_the_release_asset() {
+        let (tag, name) = ("v26.11.1", "weft-linux-x64.tar.gz");
+        let good =
+            "https://github.com/Weft-Rust/Weft/releases/download/v26.11.1/weft-linux-x64.tar.gz";
+        assert_eq!(version_url_problem(tag, name, good), None);
+        for bad in [
+            "https://github.com/Weft-Rust/Weft/releases/download/../../../evil/repo/releases/download/v26.11.1/weft-linux-x64.tar.gz",
+            "https://github.com/Weft-Rust/Weft/releases/download/%2e%2e/%2e%2e/evil/repo/releases/download/v26.11.1/weft-linux-x64.tar.gz",
+            r"https://github.com/Weft-Rust/Weft/releases/download/..\..\evil\v26.11.1/weft-linux-x64.tar.gz",
+            "https://github.com/Weft-Rust/Weft/releases/download/v26.11.1/../v26.11.1/weft-linux-x64.tar.gz",
+            "https://github.com/Weft-Rust/Weft/releases/download/v26.10.4/weft-linux-x64.tar.gz",
+            "https://github.com/Weft-Rust/Weft/releases/download/v26.11.1/other.tar.gz",
+            "https://github.com/Weft-Rust/Weft-evil/releases/download/v26.11.1/weft-linux-x64.tar.gz",
+            "https://github.com.evil.example/Weft-Rust/Weft/releases/download/v26.11.1/weft-linux-x64.tar.gz",
+            "https://github.com:444/Weft-Rust/Weft/releases/download/v26.11.1/weft-linux-x64.tar.gz",
+            "https://u@github.com/Weft-Rust/Weft/releases/download/v26.11.1/weft-linux-x64.tar.gz",
+            "http://github.com/Weft-Rust/Weft/releases/download/v26.11.1/weft-linux-x64.tar.gz",
+            "https://github.com/Weft-Rust/Weft/releases/download/v26.11.1/weft-linux-x64.tar.gz?x",
+            "https://github.com/Weft-Rust/Weft/releases/download/v26.11.1/weft-linux-x64.tar.gz#x",
+            "https://github.com/Weft-Rust/Weft/releases/download/v26.11.1/sub/weft-linux-x64.tar.gz",
+            "not a url",
+        ] {
+            assert!(version_url_problem(tag, name, bad).is_some(), "{bad}");
+        }
+    }
 }
diff --git a/src-tauri/src/ipc.rs b/src-tauri/src/ipc.rs
new file mode 100644
index 0000000..f74219e
--- /dev/null
+++ b/src-tauri/src/ipc.rs
@@ -0,0 +1,47 @@
+//! Names shared with the page. Command names and signatures come from `generate_handler!` in
+//! `lib.rs` and the commands' own declarations; they and the events below are written to
+//! `src/mods/bindings/commands.ts` by the `bindings` test.
+//!
+//! Every event is sent through its own `emit_*` function, so the payload type sent under a name
+//! is the one `EVENTS` (and so `EventPayloads`) says.
+
+use tauri::{AppHandle, Emitter};
+
+use crate::install::InstallProgress;
+use crate::launch::GameStateEvent;
+use crate::mods::catalog::CatalogUpdate;
+use crate::mods::install::ModProgress;
+
+/// `ModProgress`, while a mod downloads, is checked and is installed.
+pub const MOD_PROGRESS: &str = "mod-progress";
+/// `GameStateEvent`, when a game starts or stops.
+pub const GAME_STATE: &str = "game-state";
+/// `InstallProgress`, while a game version downloads and installs.
+pub const INSTALL_PROGRESS: &str = "install-progress";
+/// `CatalogUpdate`, as each part of a catalogue refresh comes in: the index first, without
+/// waiting for the sources.
+pub const MOD_CATALOG: &str = "mod-catalog";
+
+/// Every event: its key in `EVENTS`, its name, and the type of its payload.
+pub const EVENTS: &[(&str, &str, &str)] = &[
+    ("modProgress", MOD_PROGRESS, "ModProgress"),
+    ("gameState", GAME_STATE, "GameStateEvent"),
+    ("installProgress", INSTALL_PROGRESS, "InstallProgress"),
+    ("modCatalog", MOD_CATALOG, "CatalogUpdate"),
+];
+
+pub fn emit_mod_progress(app: &AppHandle, payload: &ModProgress) {
+    let _ = app.emit(MOD_PROGRESS, payload);
+}
+
+pub fn emit_game_state(app: &AppHandle, payload: &GameStateEvent) {
+    let _ = app.emit(GAME_STATE, payload);
+}
+
+pub fn emit_install_progress(app: &AppHandle, payload: &InstallProgress) {
+    let _ = app.emit(INSTALL_PROGRESS, payload);
+}
+
+pub fn emit_mod_catalog(app: &AppHandle, payload: &CatalogUpdate) {
+    let _ = app.emit(MOD_CATALOG, payload);
+}
diff --git a/src-tauri/src/launch.rs b/src-tauri/src/launch.rs
index 6548171..9962664 100644
--- a/src-tauri/src/launch.rs
+++ b/src-tauri/src/launch.rs
@@ -3,7 +3,7 @@ use std::path::{Path, PathBuf};
 use std::process::Stdio;
 use std::sync::{Arc, Mutex};
 use std::time::Duration;
-use tauri::{AppHandle, Emitter, Manager};
+use tauri::{AppHandle, Manager};
 use tauri_plugin_opener::{Error as OpenerError, OpenerExt};
 use thiserror::Error;
 use tokio::fs;
@@ -27,14 +27,16 @@ pub enum LaunchError {
     ProcessSpawnFailed(String),
     #[error("Failed to create log directory: {0}")]
     LogDirCreateFailed(String),
-    #[error("Game folder not found: {0}")]
-    GameFolderNotFound(String),
+    /// The page's sentence says what to do; the detail, if any, is the backend's own words (a
+    /// path), never a sentence of its own.
+    #[error("Game folder not found{}", .0.as_ref().map(|d| format!(": {d}")).unwrap_or_default())]
+    GameFolderNotFound(Option<String>),
     #[error("Failed to open: {0}")]
     OpenerError(#[from] OpenerError),
 }
 
 /// Remove ANSI escape codes from a string.
-fn strip_ansi_codes(input: &str) -> String {
+pub(crate) fn strip_ansi_codes(input: &str) -> String {
     let mut result = String::with_capacity(input.len());
     let mut chars = input.chars().peekable();
 
@@ -103,30 +105,55 @@ fn extract_game_folder_path(line: &str) -> Option<String> {
     Some(cleaned[start..start + end].trim().to_string())
 }
 
-#[derive(Debug, Clone, serde::Serialize)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, ts_rs::TS)]
+#[serde(rename_all = "lowercase")]
+pub enum GameState {
+    Running,
+    Stopped,
+}
+
+/// The `game-state` event.
+#[derive(Debug, Clone, serde::Serialize, ts_rs::TS)]
 #[serde(rename_all = "camelCase")]
 pub struct GameStateEvent {
     pub tag: String,
-    pub state: String,
+    pub state: GameState,
     pub exit_code: Option<i32>,
     /// The game only ends with an error of its own, a panic or a fault when something went
     /// wrong. On Unix a signal leaves no exit code at all, so the code alone can't tell.
     pub crashed: bool,
+    /// The mod that stopped the game from starting, when the log names one.
+    pub mod_failure: Option<crate::mods::diagnose::ModFailure>,
 }
 
 /// Tags of the games this launcher has started and is waiting for.
 #[derive(Default, Clone)]
 pub struct RunningGames(Arc<Mutex<HashSet<String>>>);
 
+impl RunningGames {
+    /// The game that is running now, if any: only one runs at a time.
+    pub fn current(&self) -> Option<String> {
+        self.0.lock().unwrap().iter().next().cloned()
+    }
+
+    #[cfg(test)]
+    pub fn insert(&self, tag: &str) {
+        self.0.lock().unwrap().insert(tag.to_string());
+    }
+
+    #[cfg(test)]
+    pub fn remove(&self, tag: &str) {
+        self.0.lock().unwrap().remove(tag);
+    }
+}
+
 fn running_games(app_handle: &AppHandle) -> RunningGames {
     app_handle.state::<RunningGames>().inner().clone()
 }
 
 /// The game that is running now, if any: only one runs at a time.
 pub fn running_game(app_handle: &AppHandle) -> Option<String> {
-    let games = running_games(app_handle);
-    let games = games.0.lock().unwrap();
-    games.iter().next().cloned()
+    running_games(app_handle).current()
 }
 
 fn get_versions_dir(app_handle: &AppHandle) -> Result<PathBuf, LaunchError> {
@@ -179,6 +206,18 @@ pub async fn launch_version(app_handle: AppHandle, tag: String) -> Result<(), Ap
     if !executable.exists() {
         return Err(LaunchError::ExecutableNotFound(tag).into());
     }
+    if let Some(running) = running_game(&app_handle) {
+        return Err(if running == tag {
+            LaunchError::AlreadyRunning(tag)
+        } else {
+            LaunchError::AnotherGameRunning(running)
+        }
+        .into());
+    }
+
+    // Refuses a mod set the game would refuse, before anything starts. Holds the mod lock until
+    // the game is registered, so no mod change lands in between.
+    let mods = crate::mods::prepare_launch(&app_handle, &tag).await?;
 
     let games = running_games(&app_handle);
 
@@ -193,23 +232,67 @@ pub async fn launch_version(app_handle: AppHandle, tag: String) -> Result<(), Ap
         }
         running.insert(tag.clone());
     }
-
-    if let Err(e) = start_game(&app_handle, &games, &tag, &executable, &version_dir).await {
+    let mods_dir = mods.release();
+
+    let launch = Launch {
+        tag: &tag,
+        executable: &executable,
+        version_dir: &version_dir,
+        mods_dir: mods_dir.as_deref(),
+    };
+    if let Err(e) = start_game(&app_handle, &games, launch).await {
         games.0.lock().unwrap().remove(&tag);
         return Err(e.into());
     }
     Ok(())
 }
 
+/// The game's arguments. `--mods` is searched before the player's own mods folder, and the
+/// first copy of a mod wins; without a folder nothing is passed.
+fn game_args(mods_dir: Option<&Path>) -> Vec<std::ffi::OsString> {
+    match mods_dir {
+        Some(dir) => vec!["--mods".into(), dir.as_os_str().to_owned()],
+        None => Vec::new(),
+    }
+}
+
+struct Launch<'a> {
+    tag: &'a str,
+    executable: &'a Path,
+    version_dir: &'a Path,
+    mods_dir: Option<&'a Path>,
+}
+
+/// The first mod failure logged since `start`, the size of the log when this run began.
+async fn mod_failure_since(
+    log_path: &Path,
+    start: u64,
+) -> Option<crate::mods::diagnose::ModFailure> {
+    use tokio::io::{AsyncReadExt, AsyncSeekExt};
+    let mut file = fs::File::open(log_path).await.ok()?;
+    file.seek(std::io::SeekFrom::Start(start)).await.ok()?;
+    let mut bytes = Vec::new();
+    file.take(4 * 1024 * 1024)
+        .read_to_end(&mut bytes)
+        .await
+        .ok()?;
+    crate::mods::diagnose::find(&String::from_utf8_lossy(&bytes))
+}
+
 async fn start_game(
     app_handle: &AppHandle,
     games: &RunningGames,
-    tag: &str,
-    executable: &Path,
-    version_dir: &Path,
+    launch: Launch<'_>,
 ) -> Result<(), LaunchError> {
+    let Launch {
+        tag,
+        executable,
+        version_dir,
+        mods_dir,
+    } = launch;
     let logs_dir = get_logs_dir(app_handle)?;
     let log_path = logs_dir.join(format!("{tag}.log"));
+    let log_start = fs::metadata(&log_path).await.map(|m| m.len()).unwrap_or(0);
     let log_stdout = fs::OpenOptions::new()
         .create(true)
         .append(true)
@@ -219,6 +302,7 @@ async fn start_game(
 
     let mut cmd = TokioCommand::new(executable);
     cmd.current_dir(version_dir)
+        .args(game_args(mods_dir))
         .stdout(Stdio::piped())
         .stderr(Stdio::piped());
 
@@ -236,13 +320,14 @@ async fn start_game(
     let stdout_log = tokio::spawn(copy_to_log(stdout, log_stdout, "stdout"));
     let stderr_log = tokio::spawn(copy_to_log(stderr, log_stderr, "stderr"));
 
-    let _ = app_handle.emit(
-        "game-state",
-        GameStateEvent {
+    crate::ipc::emit_game_state(
+        app_handle,
+        &GameStateEvent {
             tag: tag.to_string(),
-            state: "running".to_string(),
+            state: GameState::Running,
             exit_code: None,
             crashed: false,
+            mod_failure: None,
         },
     );
 
@@ -258,13 +343,22 @@ async fn start_game(
         let _ = tokio::time::timeout(Duration::from_secs(2), logs).await;
 
         games.0.lock().unwrap().remove(&tag);
-        let _ = app_handle.emit(
-            "game-state",
-            GameStateEvent {
+        // Revocations that arrived while it ran turn those mods off now.
+        crate::mods::after_game(&app_handle, &tag).await;
+        let crashed = status.is_some_and(|s| !s.success());
+        let mod_failure = if crashed {
+            mod_failure_since(&log_path, log_start).await
+        } else {
+            None
+        };
+        crate::ipc::emit_game_state(
+            &app_handle,
+            &GameStateEvent {
                 tag,
-                state: "stopped".to_string(),
+                state: GameState::Stopped,
                 exit_code: status.and_then(|s| s.code()),
-                crashed: status.is_some_and(|s| !s.success()),
+                crashed,
+                mod_failure,
             },
         );
     });
@@ -279,12 +373,22 @@ pub async fn get_running_versions(app_handle: AppHandle) -> Result<Vec<String>,
 
 #[tauri::command]
 pub async fn open_game_folder(app_handle: AppHandle, _tag: String) -> Result<(), AppError> {
-    let logs_dir = get_logs_dir(&app_handle)?;
+    match find_game_folder(&app_handle).await {
+        Some(folder) => Ok(open_path(&app_handle, &folder)?),
+        None => Err(LaunchError::GameFolderNotFound(None).into()),
+    }
+}
+
+/// The game's data folder, as the newest log that names one says. The game prints it at start.
+pub async fn find_game_folder(app_handle: &AppHandle) -> Option<PathBuf> {
+    find_game_folder_in(&get_logs_dir(app_handle).ok()?).await
+}
 
-    // Read all log files, sort by modification time (newest first)
-    let mut entries = fs::read_dir(&logs_dir).await?;
-    let mut log_files: Vec<_> = Vec::new();
-    while let Some(entry) = entries.next_entry().await? {
+/// The same, given the launcher's logs folder.
+pub async fn find_game_folder_in(logs_dir: &Path) -> Option<PathBuf> {
+    let mut entries = fs::read_dir(logs_dir).await.ok()?;
+    let mut log_files = Vec::new();
+    while let Ok(Some(entry)) = entries.next_entry().await {
         let path = entry.path();
         if path.extension().and_then(|s| s.to_str()) == Some("log")
             && let Ok(metadata) = entry.metadata().await
@@ -293,33 +397,23 @@ pub async fn open_game_folder(app_handle: AppHandle, _tag: String) -> Result<(),
             log_files.push((path, modified));
         }
     }
-
-    // Sort by modification time, newest first
     log_files.sort_by_key(|a| std::cmp::Reverse(a.1));
 
-    // Search each log file for the "game folder" line
     for (log_path, _) in log_files {
-        let file = fs::File::open(&log_path).await?;
-        let reader = BufReader::new(file);
-        let mut lines = reader.lines();
-
+        let Ok(file) = fs::File::open(&log_path).await else {
+            continue;
+        };
+        let mut lines = BufReader::new(file).lines();
         while let Ok(Some(line)) = lines.next_line().await {
-            if let Some(game_folder) = extract_game_folder_path(&line) {
-                let game_folder_path = PathBuf::from(&game_folder);
-                if game_folder_path.exists() {
-                    open_path(&app_handle, &game_folder_path)?;
-                    return Ok(());
-                }
-                // Path from log doesn't exist, continue searching
+            // A folder that no longer exists may still be named in an old log.
+            if let Some(folder) = extract_game_folder_path(&line).map(PathBuf::from)
+                && folder.exists()
+            {
+                return Some(folder);
             }
         }
     }
-
-    // No valid game folder found in any log
-    Err(
-        LaunchError::GameFolderNotFound("not in the logs yet, start the game once".to_string())
-            .into(),
-    )
+    None
 }
 
 #[tauri::command]
@@ -328,17 +422,13 @@ pub async fn open_log(app_handle: AppHandle, tag: String) -> Result<(), AppError
     let logs_dir = get_logs_dir(&app_handle)?;
     let log_file = logs_dir.join(format!("{tag}.log"));
     if !log_file.exists() {
-        return Err(LaunchError::GameFolderNotFound(format!(
-            "log file not found: {}",
-            log_file.display()
-        ))
-        .into());
+        return Err(LaunchError::GameFolderNotFound(Some(log_file.display().to_string())).into());
     }
     open_path(&app_handle, &log_file)?;
     Ok(())
 }
 
-fn open_path(app_handle: &AppHandle, path: &Path) -> Result<(), LaunchError> {
+pub(crate) fn open_path(app_handle: &AppHandle, path: &Path) -> Result<(), LaunchError> {
     // Programs spawned from the AppImage crash on its bundled libraries; reveal goes over D-Bus.
     if cfg!(target_os = "linux") && std::env::var_os("APPDIR").is_some() {
         app_handle.opener().reveal_item_in_dir(path)?;
@@ -349,3 +439,18 @@ fn open_path(app_handle: &AppHandle, path: &Path) -> Result<(), LaunchError> {
         .open_path(path.to_string_lossy().as_ref(), None::<&str>)?;
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn the_mods_argument() {
+        assert!(game_args(None).is_empty(), "no folder, no --mods");
+        let dir = Path::new("/data/profiles/v26.11.1/mods");
+        assert_eq!(
+            game_args(Some(dir)),
+            ["--mods", "/data/profiles/v26.11.1/mods"]
+        );
+    }
+}
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index b6f75fd..69ae5d3 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -1,9 +1,15 @@
 pub mod config;
+pub mod download;
 pub mod error;
 pub mod install;
+pub mod ipc;
 pub mod launch;
+pub mod mods;
 pub mod releases;
 
+#[cfg(test)]
+mod bindings;
+
 use tauri::Manager;
 
 #[cfg_attr(mobile, tauri::mobile_entry_point)]
@@ -16,7 +22,8 @@ pub fn run() {
                 let _ = w.set_focus();
             });
         }))
-        .plugin(tauri_plugin_opener::init());
+        .plugin(tauri_plugin_opener::init())
+        .plugin(tauri_plugin_dialog::init());
 
     #[cfg(desktop)]
     {
@@ -28,6 +35,10 @@ pub fn run() {
     builder
         .manage(install::ActiveInstalls::default())
         .manage(launch::RunningGames::default())
+        .manage(mods::catalog::CatalogState::default())
+        .manage(mods::ModsLock::default())
+        .manage(mods::store::Reservations::default())
+        .manage(mods::Operations::default())
         .setup(|app| {
             install::sweep_leftovers(app.handle());
             Ok(())
@@ -40,7 +51,25 @@ pub fn run() {
             launch::launch_version,
             launch::get_running_versions,
             launch::open_game_folder,
-            launch::open_log
+            launch::open_log,
+            mods::commands::list_mod_catalog,
+            mods::commands::refresh_mod_source,
+            mods::commands::get_mod_sources,
+            mods::commands::add_mod_source,
+            mods::commands::remove_mod_source,
+            mods::commands::get_mod_profile,
+            mods::commands::plan_mod_install,
+            mods::commands::install_mod,
+            mods::commands::inspect_mod_file,
+            mods::commands::install_mod_file,
+            mods::commands::set_mod_enabled,
+            mods::commands::remove_mod,
+            mods::commands::restore_mod,
+            mods::commands::preview_copy_mod_profile,
+            mods::commands::copy_mod_profile,
+            mods::commands::cancel_mod_operation,
+            mods::commands::get_mod_icon,
+            mods::commands::open_player_mods_folder
         ])
         .run(tauri::generate_context!())
         .expect("error while running tauri application");
diff --git a/src-tauri/src/mods/abi.rs b/src-tauri/src/mods/abi.rs
new file mode 100644
index 0000000..6a119db
--- /dev/null
+++ b/src-tauri/src/mods/abi.rs
@@ -0,0 +1,118 @@
+//! The mod interface ("ABI") of a game version. Weft loads a mod only if the mod was built against
+//! a byte-identical `crates/abi/src/lib.rs`: `ABI_VERSION` is the FNV-1a-64 hash of that file. So
+//! the launcher can tell what a version accepts without running it, from the file at its tag.
+
+use std::collections::BTreeMap;
+use std::time::Duration;
+
+use super::error::ModsError;
+use super::index::WeftAbi;
+use super::paths::{Paths, write_atomic};
+use crate::config::WEFT_REPO;
+
+pub fn fnv1a64(bytes: &[u8]) -> u64 {
+    let mut h: u64 = 0xcbf2_9ce4_8422_2325;
+    for &b in bytes {
+        h = (h ^ b as u64).wrapping_mul(0x0100_0000_01b3);
+    }
+    h
+}
+
+pub fn format_abi(hash: u64) -> String {
+    format!("{hash:016x}")
+}
+
+pub fn is_abi(s: &str) -> bool {
+    s.len() == 16 && s.bytes().all(|b| matches!(b, b'0'..=b'9' | b'a'..=b'f'))
+}
+
+/// A git ref that can go into a URL path as it is.
+pub fn is_safe_ref(s: &str) -> bool {
+    !s.is_empty()
+        && s.len() <= 100
+        && !s.starts_with('.')
+        && s.bytes()
+            .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'.' | b'-' | b'_'))
+}
+
+/// `crates/abi/src/lib.rs` is a few tens of KB.
+const MAX_ABI_FILE_BYTES: usize = 1024 * 1024;
+
+fn cache_file(paths: &Paths) -> std::path::PathBuf {
+    paths.cache_dir().join("abi.json")
+}
+
+fn read_cache(paths: &Paths) -> BTreeMap<String, String> {
+    std::fs::read(cache_file(paths))
+        .ok()
+        .and_then(|b| serde_json::from_slice(&b).ok())
+        .unwrap_or_default()
+}
+
+/// The ABI of a cached tag, without going to the network. A tag's file never changes.
+pub fn cached_abi(paths: &Paths, tag: &str, table: &[WeftAbi]) -> Option<String> {
+    table
+        .iter()
+        .find(|w| w.tag == tag)
+        .map(|w| w.abi.clone())
+        .or_else(|| read_cache(paths).remove(tag))
+}
+
+pub async fn abi_for_tag(
+    paths: &Paths,
+    client: &reqwest::Client,
+    tag: &str,
+    table: &[WeftAbi],
+) -> Result<String, ModsError> {
+    if let Some(abi) = cached_abi(paths, tag, table) {
+        return Ok(abi);
+    }
+    if !is_safe_ref(tag) {
+        return Err(ModsError::InvalidName(tag.to_string()));
+    }
+    let url = format!("https://raw.githubusercontent.com/{WEFT_REPO}/{tag}/crates/abi/src/lib.rs");
+    let response = client
+        .get(&url)
+        .timeout(Duration::from_secs(15))
+        .send()
+        .await
+        .map_err(|_| ModsError::AbiUnavailable(tag.to_string()))?;
+    if !response.status().is_success() {
+        return Err(ModsError::AbiUnavailable(tag.to_string()));
+    }
+    let bytes = crate::download::read_capped(response, MAX_ABI_FILE_BYTES)
+        .await
+        .ok()
+        .flatten()
+        .ok_or_else(|| ModsError::AbiUnavailable(tag.to_string()))?;
+    let abi = format_abi(fnv1a64(&bytes));
+
+    let mut cache = read_cache(paths);
+    cache.insert(tag.to_string(), abi.clone());
+    // Without the cache the hash is just fetched again next time.
+    let _ = serde_json::to_vec_pretty(&cache).map(|b| write_atomic(&cache_file(paths), &b));
+    Ok(abi)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn fnv_matches_the_engine() {
+        // The engine's own constants: an empty file hashes to the offset basis.
+        assert_eq!(format_abi(fnv1a64(b"")), "cbf29ce484222325");
+        assert_eq!(format_abi(fnv1a64(b"a")), "af63dc4c8601ec8c");
+    }
+
+    #[test]
+    fn abi_and_ref_shapes() {
+        assert!(is_abi("f470b1cbb1f9ad91"));
+        assert!(!is_abi("F470B1CBB1F9AD91"));
+        assert!(!is_abi("f470b1cb"));
+        assert!(is_safe_ref("v26.11.1"));
+        for bad in ["", "../x", "v1/../../x", "a?b", "a#b", ".hidden"] {
+            assert!(!is_safe_ref(bad), "{bad:?}");
+        }
+    }
+}
diff --git a/src-tauri/src/mods/archive.rs b/src-tauri/src/mods/archive.rs
new file mode 100644
index 0000000..1a906f0
--- /dev/null
+++ b/src-tauri/src/mods/archive.rs
@@ -0,0 +1,580 @@
+//! What a mod zip may contain before it is stored: the mod's library for each system and its
+//! `assets/`, nothing else. The launcher never unpacks a mod to disk or runs it: it reads the
+//! zip's table of contents, then inflates every entry once into nothing, counting, so a strange
+//! file, a damaged one or one that lies about its sizes is refused before the game ever sees it.
+
+use serde::Serialize;
+use std::io::Read;
+use std::path::{Component, Path};
+use thiserror::Error;
+use ts_rs::TS;
+
+use super::error::ModsError;
+use super::index::{Platform, is_mod_id};
+
+pub const MAX_ENTRIES: usize = 20_000;
+pub const MAX_TOTAL_BYTES: u64 = 1024 * 1024 * 1024;
+pub const MAX_RATIO: u64 = 200;
+/// Entries smaller than this are never called a zip bomb, however well they compress.
+const RATIO_FLOOR: u64 = 1024 * 1024;
+pub const MAX_FILE_BYTES: u64 = 512 * 1024 * 1024;
+
+/// The system this launcher runs on; `None` where the game isn't built.
+pub fn current_platform() -> Option<Platform> {
+    Platform::current()
+}
+
+fn platform_of_library(name: &str) -> Option<(Platform, &str)> {
+    if let Some(id) = name.strip_suffix(".dll") {
+        return Some((Platform::WindowsX64, id));
+    }
+    let rest = name.strip_prefix("lib")?;
+    if let Some(id) = rest.strip_suffix(".so") {
+        return Some((Platform::LinuxX64, id));
+    }
+    rest.strip_suffix(".dylib")
+        .map(|id| (Platform::MacosArm64, id))
+}
+
+#[derive(Debug, Clone, Serialize, PartialEq, TS)]
+#[serde(rename_all = "camelCase")]
+pub struct ArchiveInfo {
+    pub id: String,
+    pub libraries: Vec<String>,
+    pub platforms: Vec<Platform>,
+    pub has_assets: bool,
+    pub entries: usize,
+}
+
+/// Why a zip is not a mod the launcher will store. The text goes to the player as the error
+/// detail.
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+pub enum ArchiveProblem {
+    #[error("not a zip file ({0})")]
+    NotZip(String),
+    #[error("more than {MAX_ENTRIES} files")]
+    TooManyEntries,
+    #[error("unpacks to more than 1 GB")]
+    TooLarge,
+    #[error("{0} is compressed suspiciously well")]
+    Ratio(String),
+    #[error("odd file name {0:?}")]
+    OddName(String),
+    #[error("unsafe path {0:?}")]
+    UnsafePath(String),
+    #[error("symbolic link {0:?}")]
+    Symlink(String),
+    #[error("unexpected folder {0:?}")]
+    UnexpectedFolder(String),
+    #[error("unexpected file {0:?}")]
+    UnexpectedFile(String),
+    #[error("library name {0:?}")]
+    LibraryName(String),
+    #[error("{file} belongs to mod {found:?}, not {expected:?}")]
+    WrongMod {
+        file: String,
+        found: String,
+        expected: String,
+    },
+    #[error("two libraries for {0}")]
+    TwoLibraries(&'static str),
+    #[error("no mod library inside")]
+    NoLibrary,
+    #[error("{0} unpacks to more than the zip says it does")]
+    SizeMismatch(String),
+    #[error("{0} is damaged ({1})")]
+    Damaged(String, String),
+    #[error("{0} is encrypted")]
+    Encrypted(String),
+}
+
+/// Checks the layout of a mod zip. With `expected_id`, the library names must say that id.
+pub fn inspect<R: Read + std::io::Seek>(
+    reader: R,
+    expected_id: Option<&str>,
+) -> Result<ArchiveInfo, ModsError> {
+    use ArchiveProblem as P;
+    let not_zip = |e: zip::result::ZipError| P::NotZip(e.to_string());
+    let mut zip = zip::ZipArchive::new(reader).map_err(not_zip)?;
+    if zip.len() > MAX_ENTRIES {
+        return Err(P::TooManyEntries.into());
+    }
+
+    let mut id: Option<String> = expected_id.map(str::to_string);
+    let mut libraries = Vec::new();
+    let mut platforms = Vec::new();
+    let mut has_assets = false;
+    let mut total: u64 = 0;
+
+    for i in 0..zip.len() {
+        let entry = zip.by_index_raw(i).map_err(not_zip)?;
+        let raw = entry.name().to_string();
+        if raw.contains('\\') || raw.contains('\0') {
+            return Err(P::OddName(raw).into());
+        }
+        if let Some(mode) = entry.unix_mode()
+            && mode & 0o170000 == 0o120000
+        {
+            return Err(P::Symlink(raw).into());
+        }
+        let Some(path) = entry.enclosed_name().map(Path::to_path_buf) else {
+            return Err(P::UnsafePath(raw).into());
+        };
+        if path
+            .components()
+            .any(|c| !matches!(c, Component::Normal(_)))
+        {
+            return Err(P::UnsafePath(raw).into());
+        }
+        // Declared sizes, from the central directory: a fast refusal. What each entry really
+        // inflates to is counted below, against these same declared sizes.
+        total = total.saturating_add(entry.size());
+        if total > MAX_TOTAL_BYTES {
+            return Err(P::TooLarge.into());
+        }
+        if entry.size() > RATIO_FLOOR && entry.size() / entry.compressed_size().max(1) > MAX_RATIO {
+            return Err(P::Ratio(raw).into());
+        }
+
+        let mut parts = path.components();
+        let first = parts
+            .next()
+            .and_then(|c| c.as_os_str().to_str())
+            .unwrap_or("");
+        let nested = parts.next().is_some();
+
+        if first == "assets" {
+            has_assets = true;
+            continue;
+        }
+        if nested || entry.is_dir() {
+            return Err(P::UnexpectedFolder(raw).into());
+        }
+        let Some((platform, lib_id)) = platform_of_library(first) else {
+            return Err(P::UnexpectedFile(raw).into());
+        };
+        if !is_mod_id(lib_id) {
+            return Err(P::LibraryName(raw).into());
+        }
+        match &id {
+            Some(known) if known != lib_id => {
+                return Err(P::WrongMod {
+                    file: raw,
+                    found: lib_id.to_string(),
+                    expected: known.clone(),
+                }
+                .into());
+            }
+            Some(_) => {}
+            None => id = Some(lib_id.to_string()),
+        }
+        if platforms.contains(&platform) {
+            return Err(P::TwoLibraries(platform.as_str()).into());
+        }
+        platforms.push(platform);
+        libraries.push(first.to_string());
+    }
+
+    let Some(id) = id.filter(|_| !libraries.is_empty()) else {
+        return Err(P::NoLibrary.into());
+    };
+    inflate_all(&mut zip)?;
+    platforms.sort();
+    libraries.sort();
+    Ok(ArchiveInfo {
+        id,
+        libraries,
+        platforms,
+        has_assets,
+        entries: zip.len(),
+    })
+}
+
+/// Inflates every entry once into nothing, counting what comes out. An entry that inflates to
+/// more than its declared size, that is shorter, whose checksum doesn't match, that can't be
+/// inflated or that is encrypted refuses the zip: the declared sizes, which the limits were
+/// checked against, then hold for what the game unpacks too. Reads at most the declared total,
+/// which is at most MAX_TOTAL_BYTES, plus one buffer.
+fn inflate_all<R: Read + std::io::Seek>(
+    zip: &mut zip::ZipArchive<R>,
+) -> Result<(), ArchiveProblem> {
+    use ArchiveProblem as P;
+    let mut buf = vec![0u8; 64 * 1024];
+    let mut total: u64 = 0;
+    for i in 0..zip.len() {
+        let name = zip
+            .by_index_raw(i)
+            .map(|e| e.name().to_string())
+            .map_err(|e| P::NotZip(e.to_string()))?;
+        let mut entry = match zip.by_index(i) {
+            Ok(entry) => entry,
+            Err(zip::result::ZipError::UnsupportedArchive(why))
+                if why == zip::result::ZipError::PASSWORD_REQUIRED =>
+            {
+                return Err(P::Encrypted(name));
+            }
+            Err(e) => return Err(P::Damaged(name, e.to_string())),
+        };
+        let declared = entry.size();
+        let mut actual: u64 = 0;
+        loop {
+            let n = match entry.read(&mut buf) {
+                Ok(0) => break,
+                Ok(n) => n as u64,
+                Err(e) if e.kind() == std::io::ErrorKind::Interrupted => continue,
+                Err(e) => return Err(P::Damaged(name, e.to_string())),
+            };
+            actual += n;
+            if actual > declared {
+                return Err(P::SizeMismatch(name));
+            }
+            if total + actual > MAX_TOTAL_BYTES {
+                return Err(P::TooLarge);
+            }
+        }
+        if actual < declared {
+            return Err(P::Damaged(name, "shorter than it says".into()));
+        }
+        total += actual;
+    }
+    Ok(())
+}
+
+/// The name and description a mod gives itself in `assets/lang/en_us.lang`. Shown as what the
+/// file says it is, nothing more.
+pub fn read_lang(path: &Path, id: &str) -> (Option<String>, Option<String>) {
+    let read = || -> Option<String> {
+        let file = std::fs::File::open(path).ok()?;
+        let mut zip = zip::ZipArchive::new(file).ok()?;
+        let entry = zip.by_name("assets/lang/en_us.lang").ok()?;
+        let mut text = String::new();
+        entry.take(64 * 1024).read_to_string(&mut text).ok()?;
+        Some(text)
+    };
+    let Some(text) = read() else {
+        return (None, None);
+    };
+    let value = |key: &str| {
+        text.lines().find_map(|l| {
+            let (k, v) = l.split_once('=')?;
+            (k.trim() == key)
+                .then(|| v.trim().chars().take(140).collect::<String>())
+                .filter(|v| !v.is_empty())
+        })
+    };
+    (
+        value(&format!("mod.{id}.name")),
+        value(&format!("mod.{id}.description")),
+    )
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use super::*;
+    use std::io::{Cursor, Write};
+    use zip::write::FileOptions;
+
+    pub fn make_zip(files: &[(&str, &[u8])]) -> Vec<u8> {
+        let mut buf = Cursor::new(Vec::new());
+        {
+            let mut zip = zip::ZipWriter::new(&mut buf);
+            for (name, body) in files {
+                if name.ends_with('/') {
+                    zip.add_directory(*name, FileOptions::default()).unwrap();
+                } else {
+                    zip.start_file(*name, FileOptions::default()).unwrap();
+                    zip.write_all(body).unwrap();
+                }
+            }
+            zip.finish().unwrap();
+        }
+        buf.into_inner()
+    }
+
+    fn check(files: &[(&str, &[u8])], id: Option<&str>) -> Result<ArchiveInfo, ModsError> {
+        inspect(Cursor::new(make_zip(files)), id)
+    }
+
+    fn problem(result: Result<ArchiveInfo, ModsError>) -> ArchiveProblem {
+        match result {
+            Err(ModsError::ArchiveInvalid(p)) => p,
+            other => panic!("expected an archive problem, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn a_real_mod_layout_passes() {
+        let info = check(
+            &[
+                ("cogwork.dll", b"pe"),
+                ("libcogwork.so", b"elf"),
+                ("libcogwork.dylib", b"macho"),
+                ("assets/", b""),
+                ("assets/lang/en_us.lang", b"mod.cogwork.name = Cogwork"),
+            ],
+            None,
+        )
+        .unwrap();
+        assert_eq!(info.id, "cogwork");
+        assert_eq!(
+            info.platforms,
+            [
+                Platform::WindowsX64,
+                Platform::LinuxX64,
+                Platform::MacosArm64
+            ]
+        );
+        assert!(info.has_assets);
+    }
+
+    #[test]
+    fn anything_else_is_refused_for_its_own_reason() {
+        use ArchiveProblem as P;
+        type Case<'a> = (&'a [(&'a str, &'a [u8])], Option<&'a str>, P);
+        let cases: &[Case] = &[
+            (
+                &[("cogwork.dll", b""), ("run.exe", b"")],
+                None,
+                P::UnexpectedFile("run.exe".into()),
+            ),
+            (
+                &[("cogwork.dll", b""), ("libother.so", b"")],
+                None,
+                P::WrongMod {
+                    file: "libother.so".into(),
+                    found: "other".into(),
+                    expected: "cogwork".into(),
+                },
+            ),
+            (
+                &[("cogwork/cogwork.dll", b"")],
+                None,
+                P::UnexpectedFolder("cogwork/cogwork.dll".into()),
+            ),
+            (
+                &[("../cogwork.dll", b"")],
+                None,
+                P::UnsafePath("../cogwork.dll".into()),
+            ),
+            (
+                &[("/abs/cogwork.dll", b"")],
+                None,
+                P::UnsafePath("/abs/cogwork.dll".into()),
+            ),
+            (
+                &[("assets\\x.png", b""), ("cogwork.dll", b"")],
+                None,
+                P::OddName("assets\\x.png".into()),
+            ),
+            (&[("assets/x.png", b"")], None, P::NoLibrary),
+            (
+                &[("Cogwork.dll", b"")],
+                None,
+                P::LibraryName("Cogwork.dll".into()),
+            ),
+            (
+                &[("cogwork.dll", b"")],
+                Some("structures"),
+                P::WrongMod {
+                    file: "cogwork.dll".into(),
+                    found: "cogwork".into(),
+                    expected: "structures".into(),
+                },
+            ),
+        ];
+        for (files, id, want) in cases {
+            assert_eq!(&problem(check(files, *id)), want, "{files:?}");
+        }
+        assert!(matches!(
+            problem(inspect(Cursor::new(b"not a zip".to_vec()), None)),
+            P::NotZip(_)
+        ));
+    }
+
+    #[test]
+    fn a_symbolic_link_is_refused() {
+        let mut buf = Cursor::new(Vec::new());
+        {
+            let mut zip = zip::ZipWriter::new(&mut buf);
+            zip.start_file("libcogwork.so", FileOptions::default())
+                .unwrap();
+            zip.write_all(b"elf").unwrap();
+            zip.add_symlink("assets/link", "/etc/passwd", FileOptions::default())
+                .unwrap();
+            zip.finish().unwrap();
+        }
+        assert_eq!(
+            problem(inspect(Cursor::new(buf.into_inner()), None)),
+            ArchiveProblem::Symlink("assets/link".into())
+        );
+    }
+
+    #[test]
+    fn a_zip_bomb_is_refused() {
+        let zeros = vec![0u8; 4 * 1024 * 1024];
+        let mut buf = Cursor::new(Vec::new());
+        {
+            let mut zip = zip::ZipWriter::new(&mut buf);
+            let deflate =
+                FileOptions::default().compression_method(zip::CompressionMethod::Deflated);
+            zip.start_file("libcogwork.so", deflate).unwrap();
+            zip.write_all(b"elf").unwrap();
+            zip.start_file("assets/zeros.bin", deflate).unwrap();
+            zip.write_all(&zeros).unwrap();
+            zip.finish().unwrap();
+        }
+        assert_eq!(
+            problem(inspect(Cursor::new(buf.into_inner()), None)),
+            ArchiveProblem::Ratio("assets/zeros.bin".into())
+        );
+    }
+
+    /// The entry count and the total size come from the zip's directory, so a zip can claim
+    /// either without containing it. These build such directories by hand.
+    fn central_directory_zip(entries: &[(&str, u64)]) -> Vec<u8> {
+        let mut out = Vec::new();
+        let mut central = Vec::new();
+        for (name, size) in entries {
+            let offset = out.len() as u32;
+            let n = name.as_bytes();
+            let size32 = (*size).min(u32::MAX as u64) as u32;
+            // Local header, stored, no data (only the central directory is read).
+            out.extend_from_slice(&0x04034b50u32.to_le_bytes());
+            out.extend_from_slice(&[20, 0, 0, 0, 0, 0, 0, 0, 0, 0]);
+            out.extend_from_slice(&0u32.to_le_bytes()); // crc
+            out.extend_from_slice(&size32.to_le_bytes()); // compressed
+            out.extend_from_slice(&size32.to_le_bytes()); // uncompressed
+            out.extend_from_slice(&(n.len() as u16).to_le_bytes());
+            out.extend_from_slice(&0u16.to_le_bytes());
+            out.extend_from_slice(n);
+            central.extend_from_slice(&0x02014b50u32.to_le_bytes());
+            central.extend_from_slice(&[20, 0, 20, 0, 0, 0, 0, 0, 0, 0, 0, 0]);
+            central.extend_from_slice(&0u32.to_le_bytes()); // crc
+            central.extend_from_slice(&size32.to_le_bytes());
+            central.extend_from_slice(&size32.to_le_bytes());
+            central.extend_from_slice(&(n.len() as u16).to_le_bytes());
+            central.extend_from_slice(&[0, 0, 0, 0, 0, 0, 0, 0]);
+            central.extend_from_slice(&0u32.to_le_bytes()); // external attributes
+            central.extend_from_slice(&offset.to_le_bytes());
+            central.extend_from_slice(n);
+        }
+        let cd_offset = out.len() as u32;
+        let count = entries.len() as u16;
+        out.extend_from_slice(&central);
+        out.extend_from_slice(&0x06054b50u32.to_le_bytes());
+        out.extend_from_slice(&[0, 0, 0, 0]);
+        out.extend_from_slice(&count.to_le_bytes());
+        out.extend_from_slice(&count.to_le_bytes());
+        out.extend_from_slice(&(central.len() as u32).to_le_bytes());
+        out.extend_from_slice(&cd_offset.to_le_bytes());
+        out.extend_from_slice(&0u16.to_le_bytes());
+        out
+    }
+
+    #[test]
+    fn too_many_entries_or_bytes_are_refused() {
+        let names: Vec<String> = (0..=MAX_ENTRIES).map(|i| format!("assets/{i}")).collect();
+        let entries: Vec<(&str, u64)> = names.iter().map(|n| (n.as_str(), 0)).collect();
+        assert_eq!(
+            problem(inspect(Cursor::new(central_directory_zip(&entries)), None)),
+            ArchiveProblem::TooManyEntries
+        );
+
+        let big = [
+            ("libcogwork.so", 600 * 1024 * 1024),
+            ("assets/a", 600 * 1024 * 1024),
+        ];
+        assert_eq!(
+            problem(inspect(Cursor::new(central_directory_zip(&big)), None)),
+            ArchiveProblem::TooLarge
+        );
+    }
+
+    /// A deflated zip of a library and one asset, and where that asset's headers are, so a test
+    /// can make the zip lie about it.
+    fn zip_with_asset(asset: &[u8]) -> Vec<u8> {
+        let mut buf = Cursor::new(Vec::new());
+        {
+            let mut zip = zip::ZipWriter::new(&mut buf);
+            let deflate =
+                FileOptions::default().compression_method(zip::CompressionMethod::Deflated);
+            zip.start_file("libcogwork.so", deflate).unwrap();
+            zip.write_all(b"elf").unwrap();
+            zip.start_file("assets/data.bin", deflate).unwrap();
+            zip.write_all(asset).unwrap();
+            zip.finish().unwrap();
+        }
+        buf.into_inner()
+    }
+
+    /// Offsets of `name`'s local header and central directory entry.
+    fn headers_of(zip: &[u8], name: &str) -> (usize, usize) {
+        let find = |sig: &[u8; 4], name_len_at: usize, name_at: usize| {
+            (0..zip.len() - 4)
+                .find(|&i| {
+                    &zip[i..i + 4] == sig && {
+                        let n = u16::from_le_bytes([zip[i + name_len_at], zip[i + name_len_at + 1]])
+                            as usize;
+                        zip.get(i + name_at..i + name_at + n) == Some(name.as_bytes())
+                    }
+                })
+                .unwrap()
+        };
+        (find(b"PK\x03\x04", 26, 30), find(b"PK\x01\x02", 28, 46))
+    }
+
+    /// Writes `size` as `name`'s uncompressed size, in both headers.
+    fn declare_size(zip: &mut [u8], name: &str, size: u32) {
+        let (local, central) = headers_of(zip, name);
+        zip[local + 22..local + 26].copy_from_slice(&size.to_le_bytes());
+        zip[central + 24..central + 28].copy_from_slice(&size.to_le_bytes());
+    }
+
+    /// A zip that says an entry is small, so it passes every declared limit, but inflates to
+    /// megabytes: the count of what really comes out refuses it.
+    #[test]
+    fn a_zip_that_lies_about_its_sizes_is_refused() {
+        let mut lying = zip_with_asset(&vec![0u8; 2 * 1024 * 1024]);
+        declare_size(&mut lying, "assets/data.bin", 1000);
+        assert_eq!(
+            problem(inspect(Cursor::new(lying), None)),
+            ArchiveProblem::SizeMismatch("assets/data.bin".into())
+        );
+        // A size larger than what is there is a lie too: the entry is cut short.
+        let mut short = zip_with_asset(b"some asset bytes");
+        declare_size(&mut short, "assets/data.bin", 4000);
+        assert!(matches!(
+            problem(inspect(Cursor::new(short), None)),
+            ArchiveProblem::Damaged(name, _) if name == "assets/data.bin"
+        ));
+    }
+
+    #[test]
+    fn a_damaged_or_encrypted_entry_is_refused() {
+        let body: Vec<u8> = (0..64 * 1024u32).map(|i| (i * 7 % 251) as u8).collect();
+        let good = zip_with_asset(&body);
+        assert!(inspect(Cursor::new(good.clone()), None).is_ok());
+
+        // Bytes of the compressed stream changed: it doesn't inflate, or its checksum fails.
+        let mut damaged = good.clone();
+        let (local, _) = headers_of(&damaged, "assets/data.bin");
+        let data = local + 30 + "assets/data.bin".len();
+        for b in &mut damaged[data + 8..data + 40] {
+            *b ^= 0x5a;
+        }
+        assert!(matches!(
+            problem(inspect(Cursor::new(damaged), None)),
+            ArchiveProblem::Damaged(name, _) if name == "assets/data.bin"
+        ));
+
+        // The encrypted flag, in both headers.
+        let mut encrypted = good;
+        let (local, central) = headers_of(&encrypted, "assets/data.bin");
+        encrypted[local + 6] |= 1;
+        encrypted[central + 8] |= 1;
+        assert_eq!(
+            problem(inspect(Cursor::new(encrypted), None)),
+            ArchiveProblem::Encrypted("assets/data.bin".into())
+        );
+    }
+}
diff --git a/src-tauri/src/mods/catalog.rs b/src-tauri/src/mods/catalog.rs
new file mode 100644
index 0000000..f8ac14e
--- /dev/null
+++ b/src-tauri/src/mods/catalog.rs
@@ -0,0 +1,719 @@
+//! Everything installable: the reviewed index plus the player's sources, as one list. The backend
+//! keeps the last list it built, and installs only what is in it: the page names a file by its
+//! hash, and the URL and hash always come from here, never from the page.
+
+use serde::Serialize;
+use std::sync::{Arc, Mutex};
+use ts_rs::TS;
+
+use super::archive::current_platform;
+use super::index::{
+    Channel, Freshness, Index, IndexMod, IndexVersion, Platform, Provenance, WeftAbi, same_repo,
+};
+use super::sources::NoModsReason;
+use crate::error::AppError;
+
+#[derive(Debug, Clone, Copy, Serialize, serde::Deserialize, PartialEq, Eq, TS)]
+#[serde(rename_all = "lowercase")]
+pub enum Trust {
+    /// In the signed index, with a recorded review of exactly these bytes.
+    Reviewed,
+    /// From a source the player added. Built and published by its repo, not reviewed.
+    Unreviewed,
+    /// A file from the player's computer. Nothing about where it came from can be checked.
+    Unverified,
+}
+
+#[derive(Debug, Clone, Serialize, serde::Deserialize, PartialEq, Eq, TS)]
+#[serde(tag = "kind", rename_all = "camelCase")]
+pub enum Origin {
+    Index,
+    Source { repo: String },
+    File { name: String },
+}
+
+impl Origin {
+    /// The catalogue key of mod `id` from here; files from the player's computer have none.
+    pub fn key(&self, id: &str) -> Option<String> {
+        match self {
+            Origin::Index => Some(format!("index:{id}")),
+            Origin::Source { repo } => Some(format!("source:{repo}:{id}")),
+            Origin::File { .. } => None,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+pub struct CatalogVersion {
+    pub version: String,
+    pub channel: Channel,
+    pub tag: String,
+    pub published: String,
+    pub source_repo: String,
+    pub source_commit: String,
+    pub weft_tag: Option<String>,
+    pub abi: String,
+    pub deps: Vec<String>,
+    pub platforms: Vec<Platform>,
+    pub sha256: String,
+    pub size: u64,
+    pub url: String,
+    pub provenance: Option<ProvenanceView>,
+    /// What `provenance` is worth: only a complete record in the signed index is `recorded`.
+    pub build_record: BuildRecord,
+    pub reviewed: Option<ReviewedView>,
+    pub trust: Trust,
+}
+
+/// Where a build's provenance comes from, and whether it says enough to be shown as a record.
+/// The launcher never verifies an attestation itself: at best the signed index records that its
+/// CI did.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+pub enum BuildRecord {
+    /// No provenance at all.
+    None,
+    /// The publisher's own `<id>.mod.json` says so. Nothing checked it.
+    Claimed,
+    /// The signed index has a provenance record, but not a whole one: a kind the launcher doesn't
+    /// know, or no repo, workflow or check time, or one that is malformed.
+    Incomplete,
+    /// The signed index records a GitHub Actions build: its repo, workflow and commit, and when
+    /// the index CI checked the attestation.
+    Recorded,
+}
+
+#[derive(Debug, Clone, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+pub struct ProvenanceView {
+    pub repo: Option<String>,
+    pub workflow: Option<String>,
+    pub git_ref: Option<String>,
+    pub verified_at: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+pub struct ReviewedView {
+    pub by: String,
+    pub at: String,
+}
+
+#[derive(Debug, Clone, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+pub struct CatalogMod {
+    /// Unique across origins: the index and a source may both have a `cogwork`.
+    pub key: String,
+    pub id: String,
+    pub name: String,
+    pub summary: String,
+    pub authors: Vec<String>,
+    pub license: Option<String>,
+    pub homepage: Option<String>,
+    pub icon: Option<String>,
+    pub origin: Origin,
+    pub versions: Vec<CatalogVersion>,
+}
+
+#[derive(Debug, Clone, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+pub struct IndexStatus {
+    pub freshness: Freshness,
+    pub generated: Option<String>,
+    /// RFC 3339, from the signature's trusted comment (`timestamp:`).
+    pub signed_at: Option<String>,
+    pub error: Option<AppError>,
+    /// The index shown was fetched and checked, but couldn't be saved: it is fetched again at
+    /// the next start, and offline until then the older saved copy, if any, is what shows.
+    pub cache_error: Option<AppError>,
+}
+
+#[derive(Debug, Clone, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+pub struct SourceStatus {
+    /// As GitHub spells it.
+    pub repo: String,
+    pub mods: usize,
+    /// `cached`: the last good answer, because it wasn't refreshed or the refresh failed.
+    pub freshness: Freshness,
+    /// RFC 3339 time the data shown was fetched.
+    pub checked: Option<String>,
+    /// Set whenever the last refresh failed, even when cached data is shown.
+    pub error: Option<AppError>,
+    /// Why GitHub's answer has no mods in it, when it has none.
+    pub no_mods: Option<NoModsReason>,
+}
+
+#[derive(Debug, Clone, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+pub struct Catalog {
+    pub mods: Vec<CatalogMod>,
+    pub revoked: Vec<RevokedView>,
+    pub index: IndexStatus,
+    pub sources: Vec<SourceStatus>,
+    pub weft: Vec<WeftAbi>,
+    /// The system the launcher runs on (`windows-x64`, `linux-x64`, `macos-arm64`), or empty.
+    pub platform: String,
+    /// The player's list of sources couldn't be read (`ModSourcesDamaged`): it was kept aside,
+    /// and `sources` is empty until they save a new one.
+    pub sources_error: Option<AppError>,
+    /// Counts up each time the launcher holds a new catalogue (0: read from disk, never held).
+    /// Answers can reach the page in any order; it keeps the one with the highest revision.
+    /// A count of refreshes in one session, far below 2^53, so a JavaScript number holds it.
+    pub revision: u64,
+}
+
+/// A part of a refresh that is in before the rest: the catalogue held now, and the sources this
+/// refresh still waits on. Sent as the `mod-catalog` event, so the index (and its revocations)
+/// shows without waiting for a slow source.
+#[derive(Debug, Clone, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+pub struct CatalogUpdate {
+    pub catalog: Catalog,
+    pub pending: Vec<String>,
+}
+
+#[derive(Debug, Clone, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+pub struct RevokedView {
+    pub sha256: String,
+    /// The index's words; null when it gave none (the page says "No reason given" itself).
+    pub reason: Option<String>,
+}
+
+impl RevokedView {
+    /// For an error's detail, which is the backend's own words.
+    pub fn detail(&self) -> String {
+        self.reason
+            .clone()
+            .unwrap_or_else(|| "no reason given".into())
+    }
+}
+
+impl Catalog {
+    pub fn find(&self, sha256: &str) -> Option<(&CatalogMod, &CatalogVersion)> {
+        self.mods.iter().find_map(|m| {
+            m.versions
+                .iter()
+                .find(|v| v.sha256 == sha256)
+                .map(|v| (m, v))
+        })
+    }
+
+    /// Keys hold a repo name, and repos compare without case.
+    pub fn by_key(&self, key: &str) -> Option<&CatalogMod> {
+        self.mods.iter().find(|m| m.key.eq_ignore_ascii_case(key))
+    }
+
+    /// The revocation of a build, by its hash in any case.
+    pub fn revocation(&self, sha256: &str) -> Option<&RevokedView> {
+        self.revoked
+            .iter()
+            .find(|r| r.sha256.eq_ignore_ascii_case(sha256))
+    }
+}
+
+/// What a catalogue is built from, each part with the ticket of the refresh that brought it.
+/// Refreshes take tickets in the order they start; a part is replaced only by an answer from a
+/// later one, so a slow refresh that finishes last can't put back older answers over newer ones.
+#[derive(Debug, Clone)]
+pub struct CatalogParts {
+    pub index: Option<Index>,
+    pub index_status: IndexStatus,
+    pub index_ticket: u64,
+    pub sources: Vec<(SourceResult, u64)>,
+    pub sources_error: Option<AppError>,
+}
+
+impl CatalogParts {
+    /// `new` over `old`, part by part, keeping whichever answer is from the later refresh. The
+    /// sources are those `listed` now, in that order: one removed meanwhile doesn't come back,
+    /// and one whose answer neither has yet waits for the next refresh.
+    pub fn merge(old: Option<&CatalogParts>, new: CatalogParts, listed: &[String]) -> CatalogParts {
+        let Some(old) = old else {
+            let sources = new
+                .sources
+                .into_iter()
+                .filter(|(s, _)| listed.iter().any(|r| same_repo(r, &s.repo)))
+                .collect();
+            return CatalogParts { sources, ..new };
+        };
+        let (index, index_status, index_ticket) = if new.index_ticket >= old.index_ticket {
+            (new.index, new.index_status, new.index_ticket)
+        } else {
+            (
+                old.index.clone(),
+                old.index_status.clone(),
+                old.index_ticket,
+            )
+        };
+        let find = |list: &[(SourceResult, u64)], repo: &str| {
+            list.iter().find(|(s, _)| same_repo(&s.repo, repo)).cloned()
+        };
+        let sources = listed
+            .iter()
+            .filter_map(
+                |repo| match (find(&new.sources, repo), find(&old.sources, repo)) {
+                    (Some(n), Some(o)) => Some(if n.1 >= o.1 { n } else { o }),
+                    (n, o) => n.or(o),
+                },
+            )
+            .collect();
+        CatalogParts {
+            index,
+            index_status,
+            index_ticket,
+            sources,
+            sources_error: new.sources_error,
+        }
+    }
+
+    pub fn build(&self) -> Catalog {
+        let sources = self.sources.iter().map(|(s, _)| s.clone()).collect();
+        Catalog {
+            sources_error: self.sources_error.clone(),
+            ..build(self.index.as_ref(), self.index_status.clone(), sources)
+        }
+    }
+}
+
+/// The catalogue the page last loaded, what it was built from, and the refresh tickets.
+#[derive(Default)]
+pub struct HeldCatalog {
+    pub issued: u64,
+    /// The revision of the catalogue held last.
+    pub revision: u64,
+    pub parts: Option<CatalogParts>,
+    pub catalog: Option<Catalog>,
+}
+
+#[derive(Default, Clone)]
+pub struct CatalogState(pub Arc<Mutex<HeldCatalog>>);
+
+/// What a build's provenance is worth: a record only when the signed index has all of it.
+pub fn build_record(provenance: Option<&Provenance>, from_index: bool) -> BuildRecord {
+    match provenance {
+        None => BuildRecord::None,
+        Some(_) if !from_index => BuildRecord::Claimed,
+        Some(p) if p.is_complete() => BuildRecord::Recorded,
+        Some(_) => BuildRecord::Incomplete,
+    }
+}
+
+fn version_view(v: &IndexVersion, trust: Trust, from_index: bool) -> CatalogVersion {
+    CatalogVersion {
+        version: v.version.clone(),
+        channel: v.channel,
+        tag: v.tag.clone(),
+        published: v.published.clone(),
+        source_repo: v.source.repo.clone(),
+        source_commit: v.source.commit.clone(),
+        weft_tag: v.weft.tag.clone(),
+        abi: v.weft.abi.clone(),
+        deps: v.deps.iter().map(|d| d.id.clone()).collect(),
+        platforms: v.known_platforms(),
+        sha256: v.asset.sha256.to_ascii_lowercase(),
+        size: v.asset.size,
+        url: v.asset.url.clone(),
+        provenance: v.provenance.as_ref().map(|p| ProvenanceView {
+            repo: p.repo.clone(),
+            workflow: p.workflow.clone(),
+            git_ref: p.git_ref.clone(),
+            verified_at: p.verified_at.clone(),
+        }),
+        build_record: build_record(v.provenance.as_ref(), from_index),
+        // Only the index records reviews; a source can't claim one.
+        reviewed: v
+            .reviewed
+            .as_ref()
+            .filter(|_| from_index)
+            .map(|r| ReviewedView {
+                by: r.by.clone(),
+                at: r.at.clone(),
+            }),
+        trust,
+    }
+}
+
+fn mod_view(m: &IndexMod, origin: Origin, trust: Trust, skip: &[String]) -> CatalogMod {
+    let key = origin
+        .key(&m.id)
+        .unwrap_or_else(|| format!("file:{}", m.id));
+    let from_index = origin == Origin::Index;
+    let mut versions: Vec<CatalogVersion> = m
+        .versions
+        .iter()
+        .filter(|v| !skip.contains(&v.asset.sha256.to_ascii_lowercase()))
+        .map(|v| version_view(v, trust, from_index))
+        .collect();
+    versions.sort_by(|a, b| super::version::compare(&b.version, &a.version));
+    CatalogMod {
+        key,
+        id: m.id.clone(),
+        name: m.name.clone(),
+        summary: m.summary.clone(),
+        authors: m.authors.clone(),
+        license: m.license.clone(),
+        homepage: m.homepage.clone(),
+        icon: m.icon.clone(),
+        origin,
+        versions,
+    }
+}
+
+/// One source as read for this catalogue: its mods (possibly from the cache) and how fresh
+/// they are.
+#[derive(Debug, Clone)]
+pub struct SourceResult {
+    pub repo: String,
+    pub mods: Vec<IndexMod>,
+    pub freshness: Freshness,
+    pub checked: Option<String>,
+    pub error: Option<AppError>,
+    pub no_mods: Option<NoModsReason>,
+}
+
+/// One list from the index and every source. A source release that is also in the index shows
+/// once, as reviewed.
+pub fn build(
+    index: Option<&Index>,
+    index_status: IndexStatus,
+    sources: Vec<SourceResult>,
+) -> Catalog {
+    let mut mods = Vec::new();
+    let mut reviewed_hashes = Vec::new();
+    if let Some(index) = index {
+        for m in &index.mods {
+            reviewed_hashes.extend(
+                m.versions
+                    .iter()
+                    .map(|v| v.asset.sha256.to_ascii_lowercase()),
+            );
+            mods.push(mod_view(m, Origin::Index, Trust::Reviewed, &[]));
+        }
+    }
+    let mut statuses: Vec<SourceStatus> = Vec::new();
+    for source in sources {
+        if statuses.iter().any(|s| same_repo(&s.repo, &source.repo)) {
+            continue;
+        }
+        let mut count = 0;
+        for m in &source.mods {
+            let view = mod_view(
+                m,
+                Origin::Source {
+                    repo: source.repo.clone(),
+                },
+                Trust::Unreviewed,
+                &reviewed_hashes,
+            );
+            if !view.versions.is_empty() {
+                count += 1;
+                mods.push(view);
+            }
+        }
+        statuses.push(SourceStatus {
+            repo: source.repo,
+            mods: count,
+            freshness: source.freshness,
+            checked: source.checked,
+            error: source.error,
+            no_mods: if count == 0 { source.no_mods } else { None },
+        });
+    }
+    mods.sort_by_key(|m| m.name.to_lowercase());
+    Catalog {
+        mods,
+        revoked: index
+            .map(|i| {
+                i.revoked
+                    .iter()
+                    .map(|r| RevokedView {
+                        sha256: r.sha256.to_ascii_lowercase(),
+                        reason: r.reason.clone(),
+                    })
+                    .collect()
+            })
+            .unwrap_or_default(),
+        index: index_status,
+        sources: statuses,
+        weft: index.map(|i| i.weft.clone()).unwrap_or_default(),
+        platform: current_platform()
+            .map(|p| p.as_str().to_string())
+            .unwrap_or_default(),
+        sources_error: None,
+        revision: 0,
+    }
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use super::super::index::{Provenance, tests::version};
+    use super::*;
+
+    fn answer(repo: &str, sha: &str, freshness: Freshness) -> SourceResult {
+        SourceResult {
+            repo: repo.into(),
+            mods: vec![index_mod("lanterns", repo, sha)],
+            freshness,
+            checked: None,
+            error: None,
+            no_mods: None,
+        }
+    }
+
+    fn parts(ticket: u64, sources: Vec<SourceResult>, index_freshness: Freshness) -> CatalogParts {
+        CatalogParts {
+            index: None,
+            index_status: IndexStatus {
+                freshness: index_freshness,
+                ..status()
+            },
+            index_ticket: ticket,
+            sources: sources.into_iter().map(|s| (s, ticket)).collect(),
+            sources_error: None,
+        }
+    }
+
+    /// Two refreshes, the first finishing last: its answers don't replace the second's, part
+    /// by part, and what neither had is kept from before.
+    #[test]
+    fn answers_arriving_in_reverse_order_keep_the_newer_parts() {
+        let listed = vec!["a/one".to_string(), "b/two".to_string()];
+        let first = parts(
+            1,
+            vec![
+                answer("a/one", &"1".repeat(64), Freshness::Cached),
+                answer("b/two", &"1".repeat(64), Freshness::Cached),
+            ],
+            Freshness::Cached,
+        );
+        let second = parts(
+            2,
+            vec![answer("a/one", &"2".repeat(64), Freshness::Fresh)],
+            Freshness::Fresh,
+        );
+        // The second arrives first, over nothing; then the first, late.
+        let held = CatalogParts::merge(None, second, &listed);
+        let held = CatalogParts::merge(Some(&held), first, &listed);
+        assert_eq!(
+            held.index_status.freshness,
+            Freshness::Fresh,
+            "the index from the later refresh"
+        );
+        let one = held
+            .sources
+            .iter()
+            .find(|(s, _)| s.repo == "a/one")
+            .unwrap();
+        assert_eq!(
+            (one.0.freshness, one.1),
+            (Freshness::Fresh, 2),
+            "a/one from the later refresh"
+        );
+        let two = held
+            .sources
+            .iter()
+            .find(|(s, _)| s.repo == "b/two")
+            .unwrap();
+        assert_eq!(two.1, 1, "b/two only the first had");
+        let built = held.build();
+        assert_eq!(built.mods[0].versions[0].sha256, "2".repeat(64));
+    }
+
+    #[test]
+    fn a_source_removed_meanwhile_does_not_come_back() {
+        let held = parts(
+            1,
+            vec![answer("a/one", &"1".repeat(64), Freshness::Fresh)],
+            Freshness::Fresh,
+        );
+        let late = parts(
+            2,
+            vec![answer("a/one", &"2".repeat(64), Freshness::Fresh)],
+            Freshness::Fresh,
+        );
+        let merged = CatalogParts::merge(Some(&held), late, &[]);
+        assert!(merged.sources.is_empty());
+    }
+
+    #[test]
+    fn a_disk_read_never_replaces_a_refreshed_part() {
+        let listed = vec!["a/one".to_string()];
+        let fresh = parts(
+            3,
+            vec![answer("a/one", &"3".repeat(64), Freshness::Fresh)],
+            Freshness::Fresh,
+        );
+        let from_disk = parts(
+            0,
+            vec![answer("a/one", &"0".repeat(64), Freshness::Cached)],
+            Freshness::Cached,
+        );
+        let merged = CatalogParts::merge(Some(&fresh), from_disk, &listed);
+        assert_eq!(merged.index_status.freshness, Freshness::Fresh);
+        assert_eq!(merged.sources[0].1, 3);
+    }
+
+    pub fn index_mod(id: &str, repo: &str, sha: &str) -> IndexMod {
+        IndexMod {
+            id: id.into(),
+            name: id.into(),
+            summary: String::new(),
+            authors: vec![],
+            license: None,
+            homepage: None,
+            icon: None,
+            versions: vec![version(id, repo, sha)],
+        }
+    }
+
+    fn status() -> IndexStatus {
+        IndexStatus {
+            freshness: Freshness::Fresh,
+            generated: None,
+            signed_at: None,
+            error: None,
+            cache_error: None,
+        }
+    }
+
+    fn source(repo: &str, mods: Vec<IndexMod>) -> SourceResult {
+        SourceResult {
+            repo: repo.into(),
+            mods,
+            freshness: Freshness::Fresh,
+            checked: None,
+            error: None,
+            no_mods: None,
+        }
+    }
+
+    #[test]
+    fn source_copy_of_a_reviewed_file_shows_once() {
+        let sha = "a".repeat(64);
+        let index = Index {
+            schema: 1,
+            generated: "2026-11-04T00:00:00Z".into(),
+            weft: vec![],
+            mods: vec![index_mod("cogwork", "Zorro909/weft-mods", &sha)],
+            revoked: vec![],
+        };
+        let catalog = build(
+            Some(&index),
+            status(),
+            vec![source(
+                "Zorro909/weft-mods",
+                vec![index_mod("cogwork", "Zorro909/weft-mods", &sha)],
+            )],
+        );
+        assert_eq!(catalog.mods.len(), 1);
+        assert_eq!(catalog.find(&sha).unwrap().1.trust, Trust::Reviewed);
+        assert_eq!(catalog.sources[0].mods, 0);
+    }
+
+    /// Provenance is a record only when the signed index recorded all of it; a source's own claim
+    /// is passed on but never a record, and a source can't claim a review.
+    #[test]
+    fn only_the_index_records_provenance() {
+        let provenance = Provenance {
+            kind: "github-attestation".into(),
+            repo: Some("Zorro909/weft-mods".into()),
+            workflow: Some(".github/workflows/release.yml".into()),
+            git_ref: None,
+            verified_at: Some("2026-11-04T18:00:00Z".into()),
+        };
+        let mut reviewed = index_mod("cogwork", "Zorro909/weft-mods", &"a".repeat(64));
+        reviewed.versions[0].provenance = Some(provenance.clone());
+        let mut plain = index_mod("showcase", "Zorro909/weft-mods", &"b".repeat(64));
+        plain.versions[0].provenance = None;
+        let mut claimed = index_mod("lanterns", "Someone/lanterns", &"c".repeat(64));
+        claimed.versions[0].provenance = Some(provenance);
+        let index = Index {
+            schema: 1,
+            generated: "2026-11-04T00:00:00Z".into(),
+            weft: vec![],
+            mods: vec![reviewed, plain],
+            revoked: vec![],
+        };
+        let catalog = build(
+            Some(&index),
+            status(),
+            vec![source("Someone/lanterns", vec![claimed])],
+        );
+        let v = |sha: char| catalog.find(&sha.to_string().repeat(64)).unwrap().1;
+        assert_eq!(v('a').build_record, BuildRecord::Recorded);
+        assert_eq!(v('b').build_record, BuildRecord::None);
+        assert!(v('c').provenance.is_some());
+        assert_eq!(v('c').build_record, BuildRecord::Claimed);
+        assert!(v('c').reviewed.is_none());
+        assert_eq!(v('c').trust, Trust::Unreviewed);
+    }
+
+    /// A provenance record in the signed index that doesn't say all of it (another kind, no
+    /// workflow, no or a malformed check time, a repo that isn't one) is incomplete: never shown
+    /// as a recorded build.
+    #[test]
+    fn an_incomplete_index_record_is_not_a_record() {
+        let whole = Provenance {
+            kind: "github-attestation".into(),
+            repo: Some("Zorro909/weft-mods".into()),
+            workflow: Some(".github/workflows/release.yml".into()),
+            git_ref: Some("refs/heads/main".into()),
+            verified_at: Some("2026-11-04T18:00:00Z".into()),
+        };
+        type Spoil = fn(&mut Provenance);
+        let cases: [(&str, Spoil); 8] = [
+            ("unknown kind", |p| p.kind = "unknown".into()),
+            ("no repo", |p| p.repo = None),
+            ("repo not a repo", |p| p.repo = Some("not a repo".into())),
+            ("no workflow", |p| p.workflow = None),
+            ("workflow outside", |p| {
+                p.workflow = Some("../evil.yml".into())
+            }),
+            ("workflow not yaml", |p| {
+                p.workflow = Some(".github/workflows/x.sh".into())
+            }),
+            ("no check time", |p| p.verified_at = None),
+            ("bad check time", |p| {
+                p.verified_at = Some("yesterday".into())
+            }),
+        ];
+        for (i, (why, spoil)) in cases.iter().enumerate() {
+            let mut p = whole.clone();
+            spoil(&mut p);
+            let sha = format!("{:064x}", i + 1);
+            let mut m = index_mod("cogwork", "Zorro909/weft-mods", &sha);
+            m.versions[0].provenance = Some(p);
+            let index = Index {
+                schema: 1,
+                generated: "2026-11-04T00:00:00Z".into(),
+                weft: vec![],
+                mods: vec![m],
+                revoked: vec![],
+            };
+            let catalog = build(Some(&index), status(), vec![]);
+            let v = catalog.find(&sha).unwrap().1;
+            assert_eq!(v.build_record, BuildRecord::Incomplete, "{why}");
+            assert_eq!(v.trust, Trust::Reviewed, "{why}: the review still stands");
+        }
+    }
+
+    #[test]
+    fn keys_ignore_repo_case_and_sources_show_once() {
+        let catalog = build(
+            None,
+            status(),
+            vec![
+                source(
+                    "Someone/Lanterns",
+                    vec![index_mod("lanterns", "Someone/Lanterns", &"c".repeat(64))],
+                ),
+                source("someone/lanterns", vec![]),
+            ],
+        );
+        assert_eq!(catalog.sources.len(), 1);
+        assert!(catalog.by_key("source:someone/lanterns:lanterns").is_some());
+    }
+}
diff --git a/src-tauri/src/mods/commands.rs b/src-tauri/src/mods/commands.rs
new file mode 100644
index 0000000..b220e62
--- /dev/null
+++ b/src-tauri/src/mods/commands.rs
@@ -0,0 +1,160 @@
+//! The mod manager's Tauri commands. Each one takes the app's [`Ctx`] and calls one operation in
+//! `service/`, where the checks, the locking and the rules are.
+
+use tauri::AppHandle;
+
+use super::catalog::Catalog;
+use super::context::Ctx;
+use super::inspect::FileInspection;
+use super::plan::{ChangeResult, CopyPreview, CopyResult, InstallPlan};
+use super::profile::ProfileReport;
+use super::service;
+use crate::error::AppError;
+
+#[tauri::command]
+pub async fn list_mod_catalog(app: AppHandle, force_refresh: bool) -> Result<Catalog, AppError> {
+    Ok(service::load_catalog(&Ctx::of(&app)?, force_refresh).await?)
+}
+
+/// Asks one source again; the others keep their answers.
+#[tauri::command]
+pub async fn refresh_mod_source(app: AppHandle, repo: String) -> Result<Catalog, AppError> {
+    Ok(service::refresh_source(&Ctx::of(&app)?, &repo).await?)
+}
+
+#[tauri::command]
+pub async fn get_mod_sources(app: AppHandle) -> Result<Vec<String>, AppError> {
+    Ok(service::source_list(&Ctx::of(&app)?)?)
+}
+
+#[tauri::command]
+pub async fn add_mod_source(app: AppHandle, repo: String) -> Result<Vec<String>, AppError> {
+    Ok(service::add_source(&Ctx::of(&app)?, &repo).await?)
+}
+
+#[tauri::command]
+pub async fn remove_mod_source(app: AppHandle, repo: String) -> Result<Vec<String>, AppError> {
+    Ok(service::remove_source(&Ctx::of(&app)?, &repo).await?)
+}
+
+#[tauri::command]
+pub async fn get_mod_profile(app: AppHandle, tag: String) -> Result<ProfileReport, AppError> {
+    Ok(service::profile(&Ctx::of(&app)?, &tag).await?)
+}
+
+#[tauri::command]
+pub async fn plan_mod_install(
+    app: AppHandle,
+    tag: String,
+    sha256: String,
+) -> Result<InstallPlan, AppError> {
+    Ok(service::plan(&Ctx::of(&app)?, &tag, &sha256).await?)
+}
+
+#[tauri::command]
+pub async fn install_mod(
+    app: AppHandle,
+    tag: String,
+    sha256: String,
+    plan_token: String,
+    operation_id: String,
+) -> Result<ChangeResult, AppError> {
+    let ctx = Ctx::of(&app)?;
+    Ok(service::install(&ctx, &tag, &sha256, &plan_token, &operation_id).await?)
+}
+
+#[tauri::command]
+pub async fn inspect_mod_file(
+    app: AppHandle,
+    tag: String,
+    path: String,
+) -> Result<FileInspection, AppError> {
+    Ok(service::inspect_file(&Ctx::of(&app)?, &tag, &path).await?)
+}
+
+#[tauri::command]
+pub async fn install_mod_file(
+    app: AppHandle,
+    tag: String,
+    path: String,
+    sha256: String,
+    plan_token: String,
+    operation_id: String,
+) -> Result<ChangeResult, AppError> {
+    let ctx = Ctx::of(&app)?;
+    Ok(service::install_file(&ctx, &tag, &path, &sha256, &plan_token, &operation_id).await?)
+}
+
+#[tauri::command]
+pub async fn set_mod_enabled(
+    app: AppHandle,
+    tag: String,
+    id: String,
+    enabled: bool,
+) -> Result<ChangeResult, AppError> {
+    Ok(service::set_enabled(&Ctx::of(&app)?, &tag, &id, enabled).await?)
+}
+
+#[tauri::command]
+pub async fn remove_mod(app: AppHandle, tag: String, id: String) -> Result<ChangeResult, AppError> {
+    Ok(service::remove(&Ctx::of(&app)?, &tag, &id).await?)
+}
+
+#[tauri::command]
+pub async fn restore_mod(
+    app: AppHandle,
+    tag: String,
+    id: String,
+    operation_id: String,
+) -> Result<ChangeResult, AppError> {
+    Ok(service::restore(&Ctx::of(&app)?, &tag, &id, &operation_id).await?)
+}
+
+#[tauri::command]
+pub async fn preview_copy_mod_profile(
+    app: AppHandle,
+    from: String,
+    to: String,
+) -> Result<CopyPreview, AppError> {
+    Ok(service::copy_preview(&Ctx::of(&app)?, &from, &to).await?)
+}
+
+#[tauri::command]
+pub async fn copy_mod_profile(
+    app: AppHandle,
+    from: String,
+    to: String,
+    plan_token: String,
+    operation_id: String,
+) -> Result<CopyResult, AppError> {
+    let ctx = Ctx::of(&app)?;
+    Ok(service::copy(&ctx, &from, &to, &plan_token, &operation_id).await?)
+}
+
+/// Stops an install, copy, file install or restore until it starts writing; it then fails with
+/// `ModCancelled` and changes nothing. False when no such operation is under way any more.
+#[tauri::command]
+pub async fn cancel_mod_operation(app: AppHandle, operation_id: String) -> Result<bool, AppError> {
+    Ok(Ctx::of(&app)?.operations.cancel(&operation_id))
+}
+
+/// A mod icon as a `data:` URL: the page may not load images from the network.
+#[tauri::command]
+pub async fn get_mod_icon(app: AppHandle, url: String) -> Result<String, AppError> {
+    use base64::Engine;
+    let bytes = service::icon_png(&Ctx::of(&app)?, &url).await?;
+    Ok(format!(
+        "data:image/png;base64,{}",
+        base64::engine::general_purpose::STANDARD.encode(bytes)
+    ))
+}
+
+#[tauri::command]
+pub async fn open_player_mods_folder(app: AppHandle) -> Result<(), AppError> {
+    let folder = crate::launch::find_game_folder(&app)
+        .await
+        .ok_or(crate::launch::LaunchError::GameFolderNotFound(None))?;
+    let mods = folder.join("mods");
+    crate::launch::open_path(&app, if mods.exists() { &mods } else { &folder })?;
+    Ok(())
+}
diff --git a/src-tauri/src/mods/context.rs b/src-tauri/src/mods/context.rs
new file mode 100644
index 0000000..8039925
--- /dev/null
+++ b/src-tauri/src/mods/context.rs
@@ -0,0 +1,518 @@
+//! What the mod manager needs from the running app, in one value: its folders, its locks, the
+//! catalogue the page last saw, which game runs, the operations under way, and where progress
+//! goes. [`Ctx::of`] takes them from Tauri; tests build one on a temporary folder, so the whole
+//! service runs without the app.
+
+use std::collections::HashMap;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicU8, Ordering};
+use tauri::{AppHandle, Manager};
+use tokio::sync::{Mutex, OwnedMutexGuard, watch};
+
+use super::catalog::{Catalog, CatalogParts, CatalogState, CatalogUpdate, SourceResult};
+use super::error::ModsError;
+use super::index::is_sha256;
+use super::install::{ModProgress, ProgressStage};
+use super::paths::Paths;
+use super::store::{self, Reservations};
+use crate::error::AppError;
+use crate::launch::RunningGames;
+
+/// Held while a profile or the store changes, and by a launch from its last check until the
+/// game counts as running.
+#[derive(Default, Clone)]
+pub struct ModsLock(Arc<Mutex<()>>);
+
+impl ModsLock {
+    pub async fn acquire(&self) -> OwnedMutexGuard<()> {
+        self.0.clone().lock_owned().await
+    }
+
+    #[cfg(test)]
+    pub fn is_held(&self) -> bool {
+        self.0.clone().try_lock_owned().is_err()
+    }
+}
+
+type Progress = Arc<dyn Fn(ModProgress) + Send + Sync>;
+type CatalogListener = Arc<dyn Fn(CatalogUpdate) + Send + Sync>;
+
+const RUNNING: u8 = 0;
+const COMMITTING: u8 = 1;
+const CANCELLED: u8 = 2;
+
+struct OpState {
+    phase: AtomicU8,
+    cancel: watch::Sender<bool>,
+}
+
+/// The operations under way (installs, copies, file installs, restores), by the id the page
+/// gave each. [`Operations::cancel`] stops one until it starts writing.
+#[derive(Default, Clone)]
+pub struct Operations(Arc<std::sync::Mutex<HashMap<String, Arc<OpState>>>>);
+
+impl Operations {
+    /// Registers an operation. Its id must be new, and short and plain, like a UUID.
+    pub fn begin(&self, id: &str) -> Result<Operation, ModsError> {
+        let plain = !id.is_empty()
+            && id.len() <= 128
+            && id
+                .bytes()
+                .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'-' | b'_'));
+        if !plain {
+            return Err(ModsError::InvalidName(format!("operation id {id:?}")));
+        }
+        let mut map = self.0.lock().unwrap();
+        if map.contains_key(id) {
+            return Err(ModsError::InvalidName(format!(
+                "operation {id} is already under way"
+            )));
+        }
+        let state = Arc::new(OpState {
+            phase: AtomicU8::new(RUNNING),
+            cancel: watch::Sender::new(false),
+        });
+        map.insert(id.to_string(), state.clone());
+        Ok(Operation {
+            id: id.to_string(),
+            state,
+            owner: self.clone(),
+        })
+    }
+
+    /// Cancels the operation, unless it has ended or has started writing. Whether it did.
+    pub fn cancel(&self, id: &str) -> bool {
+        let Some(state) = self.0.lock().unwrap().get(id).cloned() else {
+            return false;
+        };
+        let cancelled = state
+            .phase
+            .compare_exchange(RUNNING, CANCELLED, Ordering::SeqCst, Ordering::SeqCst)
+            .is_ok();
+        if cancelled {
+            state.cancel.send_replace(true);
+        }
+        cancelled
+    }
+
+    #[cfg(test)]
+    pub fn is_empty(&self) -> bool {
+        self.0.lock().unwrap().is_empty()
+    }
+}
+
+/// One operation under way. Dropping it forgets it.
+pub struct Operation {
+    id: String,
+    state: Arc<OpState>,
+    owner: Operations,
+}
+
+impl Operation {
+    pub fn id(&self) -> &str {
+        &self.id
+    }
+
+    /// `ModCancelled` once the operation was cancelled.
+    pub fn check(&self) -> Result<(), ModsError> {
+        if self.state.phase.load(Ordering::SeqCst) == CANCELLED {
+            Err(ModsError::Cancelled)
+        } else {
+            Ok(())
+        }
+    }
+
+    /// Resolves when the operation is cancelled; never otherwise.
+    pub async fn cancelled(&self) {
+        let mut rx = self.state.cancel.subscribe();
+        if rx.wait_for(|c| *c).await.is_err() {
+            std::future::pending::<()>().await;
+        }
+    }
+
+    /// From here on the operation writes, and can't be cancelled; `ModCancelled` if it already
+    /// was. The caller holds `ModsLock`.
+    pub fn start_writing(&self) -> Result<(), ModsError> {
+        self.state
+            .phase
+            .compare_exchange(RUNNING, COMMITTING, Ordering::SeqCst, Ordering::SeqCst)
+            .map(|_| ())
+            .map_err(|_| ModsError::Cancelled)
+    }
+}
+
+impl Drop for Operation {
+    fn drop(&mut self) {
+        self.owner.0.lock().unwrap().remove(&self.id);
+    }
+}
+
+/// One file of an operation, for its progress: "file `index` of `count`".
+#[derive(Clone, Copy)]
+pub struct Step<'a> {
+    pub op: &'a Operation,
+    pub index: usize,
+    pub count: usize,
+    pub sha256: &'a str,
+    pub mod_id: &'a str,
+}
+
+#[derive(Clone)]
+pub struct Ctx {
+    pub paths: Paths,
+    pub lock: ModsLock,
+    pub reservations: Reservations,
+    pub catalog: CatalogState,
+    pub games: RunningGames,
+    pub operations: Operations,
+    progress: Progress,
+    /// Where each early part of a catalogue refresh goes: the `mod-catalog` event.
+    catalog_parts: CatalogListener,
+    /// Whether a download's URL must be its build's GitHub release asset. Only tests, whose
+    /// downloads come from a local server, turn this off.
+    check_urls: bool,
+    /// Where GitHub's API is: `https://api.github.com`, or a local server in tests.
+    github_api: String,
+    /// Where the signed index is, and the key it is signed with: the real ones (or the debug
+    /// overrides, `index::index_url`), or a local server and the fixture key in tests.
+    index_url: String,
+    index_key: String,
+}
+
+pub const GITHUB_API: &str = "https://api.github.com";
+
+impl Ctx {
+    pub fn of(app: &AppHandle) -> Result<Ctx, ModsError> {
+        let emitter = app.clone();
+        Ok(Ctx {
+            paths: Paths::of(app)?,
+            lock: app.state::<ModsLock>().inner().clone(),
+            reservations: app.state::<Reservations>().inner().clone(),
+            catalog: app.state::<CatalogState>().inner().clone(),
+            games: app.state::<RunningGames>().inner().clone(),
+            operations: app.state::<Operations>().inner().clone(),
+            progress: Arc::new(move |p| crate::ipc::emit_mod_progress(&emitter, &p)),
+            catalog_parts: {
+                let app = app.clone();
+                Arc::new(move |u| crate::ipc::emit_mod_catalog(&app, &u))
+            },
+            check_urls: true,
+            github_api: GITHUB_API.to_string(),
+            index_url: super::index::index_url(),
+            index_key: super::index::public_key(),
+        })
+    }
+
+    /// A context of its own on `paths`: nothing running, nothing held, progress dropped.
+    pub fn new(paths: Paths) -> Ctx {
+        Ctx {
+            paths,
+            lock: ModsLock::default(),
+            reservations: Reservations::default(),
+            catalog: CatalogState::default(),
+            games: RunningGames::default(),
+            operations: Operations::default(),
+            progress: Arc::new(|_| {}),
+            catalog_parts: Arc::new(|_| {}),
+            check_urls: true,
+            github_api: GITHUB_API.to_string(),
+            index_url: super::index::index_url(),
+            index_key: super::index::public_key(),
+        }
+    }
+
+    pub fn with_catalog_listener(
+        mut self,
+        listener: impl Fn(CatalogUpdate) + Send + Sync + 'static,
+    ) -> Ctx {
+        self.catalog_parts = Arc::new(listener);
+        self
+    }
+
+    /// Says an early part of a refresh: the catalogue held now and the sources still asked.
+    pub fn tell_catalog(&self, catalog: Catalog, pending: Vec<String>) {
+        (self.catalog_parts)(CatalogUpdate { catalog, pending });
+    }
+
+    pub fn with_progress(mut self, progress: impl Fn(ModProgress) + Send + Sync + 'static) -> Ctx {
+        self.progress = Arc::new(progress);
+        self
+    }
+
+    /// For tests that download from a local server.
+    #[cfg(test)]
+    pub fn trusting_any_url(mut self) -> Ctx {
+        self.check_urls = false;
+        self
+    }
+
+    /// For tests that stand in for GitHub's API.
+    #[cfg(test)]
+    pub fn with_github_api(mut self, base: &str) -> Ctx {
+        self.github_api = base.to_string();
+        self
+    }
+
+    /// For tests that serve a signed index of their own.
+    #[cfg(test)]
+    pub fn with_index(mut self, url: &str, key: &str) -> Ctx {
+        self.index_url = url.to_string();
+        self.index_key = key.to_string();
+        self
+    }
+
+    pub fn index_url(&self) -> &str {
+        &self.index_url
+    }
+
+    pub fn index_key(&self) -> String {
+        self.index_key.clone()
+    }
+
+    pub fn github_api(&self) -> &str {
+        &self.github_api
+    }
+
+    pub fn checks_urls(&self) -> bool {
+        self.check_urls
+    }
+
+    pub fn emit(&self, step: Step<'_>, stage: ProgressStage, percent: u32) {
+        (self.progress)(ModProgress {
+            operation_id: step.op.id().to_string(),
+            sha256: step.sha256.to_string(),
+            mod_id: step.mod_id.to_string(),
+            stage,
+            percent,
+            index: step.index as u32,
+            count: step.count as u32,
+        });
+    }
+
+    pub async fn lock_mods(&self) -> OwnedMutexGuard<()> {
+        self.lock.acquire().await
+    }
+
+    pub fn is_running(&self, tag: &str) -> bool {
+        self.games.current().is_some_and(|r| r == tag)
+    }
+
+    /// The running game read its mods at start; changing them under it would only confuse.
+    pub fn ensure_not_running(&self, tag: &str) -> Result<(), ModsError> {
+        match self.games.current() {
+            Some(running) if running == tag => Err(ModsError::GameRunning(running)),
+            _ => Ok(()),
+        }
+    }
+
+    /// The catalogue the page last loaded, if it loaded one.
+    pub fn held_catalog(&self) -> Option<Catalog> {
+        self.catalog.0.lock().unwrap().catalog.clone()
+    }
+
+    /// Holds a catalogue as it is, with nothing to merge a later answer into (tests).
+    pub fn hold_catalog(&self, catalog: Catalog) {
+        let mut held = self.catalog.0.lock().unwrap();
+        held.revision += 1;
+        held.catalog = Some(Catalog {
+            revision: held.revision,
+            ..catalog
+        });
+        held.parts = None;
+    }
+
+    /// A ticket for a refresh that starts now: later refreshes get higher ones.
+    pub fn catalog_ticket(&self) -> u64 {
+        let mut held = self.catalog.0.lock().unwrap();
+        held.issued += 1;
+        held.issued
+    }
+
+    /// Takes a refresh's answer part by part ([`CatalogParts::merge`]) and holds the catalogue
+    /// built from the result, which it returns: never older, part by part, than what was held.
+    pub fn publish_catalog(&self, new: CatalogParts, listed: &[String]) -> Catalog {
+        let mut held = self.catalog.0.lock().unwrap();
+        let parts = CatalogParts::merge(held.parts.as_ref(), new, listed);
+        held.revision += 1;
+        let catalog = Catalog {
+            revision: held.revision,
+            ..parts.build()
+        };
+        held.parts = Some(parts);
+        held.catalog = Some(catalog.clone());
+        catalog
+    }
+
+    /// One source's answer into the held catalogue; `None` when there is nothing to merge it
+    /// into yet (then a whole refresh is needed).
+    pub fn publish_source(
+        &self,
+        ticket: u64,
+        result: SourceResult,
+        listed: &[String],
+        sources_error: Option<AppError>,
+    ) -> Option<Catalog> {
+        let mut held = self.catalog.0.lock().unwrap();
+        let old = held.parts.as_ref()?;
+        let new = CatalogParts {
+            index: old.index.clone(),
+            index_status: old.index_status.clone(),
+            index_ticket: old.index_ticket,
+            sources: vec![(result, ticket)],
+            sources_error,
+        };
+        let parts = CatalogParts::merge(Some(old), new, listed);
+        held.revision += 1;
+        let catalog = Catalog {
+            revision: held.revision,
+            ..parts.build()
+        };
+        held.parts = Some(parts);
+        held.catalog = Some(catalog.clone());
+        Some(catalog)
+    }
+
+    /// Deletes store files nothing uses. The caller holds `ModsLock`.
+    pub async fn collect_garbage(&self) {
+        let (paths, reservations) = (self.paths.clone(), self.reservations.clone());
+        let result = blocking(move || store::collect_garbage(&paths, &reservations)).await;
+        if let Err(e) = result {
+            eprintln!("mods: garbage collection skipped: {e}");
+        }
+    }
+}
+
+/// Runs disk work that may take long (hashing and copying files of up to 512 MB) off the async
+/// runtime.
+pub async fn blocking<T, F>(f: F) -> Result<T, ModsError>
+where
+    T: Send + 'static,
+    F: FnOnce() -> Result<T, ModsError> + Send + 'static,
+{
+    tokio::task::spawn_blocking(f)
+        .await
+        .map_err(|e| ModsError::Io(std::io::Error::other(e)))?
+}
+
+fn executable_name() -> &'static str {
+    if cfg!(target_os = "windows") {
+        "weft.exe"
+    } else {
+        "weft"
+    }
+}
+
+pub fn ensure_installed(paths: &Paths, tag: &str) -> Result<(), ModsError> {
+    crate::install::validate_name(tag).map_err(|_| ModsError::InvalidName(tag.to_string()))?;
+    if paths
+        .versions_dir()
+        .join(tag)
+        .join(executable_name())
+        .exists()
+    {
+        Ok(())
+    } else {
+        Err(ModsError::VersionNotInstalled(tag.to_string()))
+    }
+}
+
+/// The page names builds by hash; anything else is refused before it reaches a path or a lookup.
+pub fn check_sha(sha256: &str) -> Result<String, ModsError> {
+    let sha = sha256.to_ascii_lowercase();
+    if is_sha256(&sha) {
+        Ok(sha)
+    } else {
+        Err(ModsError::InvalidName(sha256.to_string()))
+    }
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use super::*;
+
+    /// A data folder with game version `tag` installed, downloading from a local server.
+    pub fn with_version(root: &std::path::Path, tag: &str) -> Ctx {
+        let paths = Paths::new(root);
+        let dir = paths.versions_dir().join(tag);
+        std::fs::create_dir_all(&dir).unwrap();
+        std::fs::write(dir.join(executable_name()), b"").unwrap();
+        Ctx::new(paths).trusting_any_url()
+    }
+
+    #[test]
+    fn operations_cancel_until_they_write() {
+        let ops = Operations::default();
+        let a = ops.begin("op-1").unwrap();
+        assert!(matches!(ops.begin("op-1"), Err(ModsError::InvalidName(_))));
+        for bad in ["", "../x", "a b", &"x".repeat(129)] {
+            assert!(ops.begin(bad).is_err(), "{bad:?}");
+        }
+        assert!(a.check().is_ok());
+        assert!(ops.cancel("op-1"));
+        assert!(!ops.cancel("op-1"), "once");
+        assert!(matches!(a.check(), Err(ModsError::Cancelled)));
+        assert!(matches!(a.start_writing(), Err(ModsError::Cancelled)));
+        tokio::runtime::Builder::new_current_thread()
+            .build()
+            .unwrap()
+            .block_on(a.cancelled());
+
+        let b = ops.begin("op-2").unwrap();
+        b.start_writing().unwrap();
+        assert!(!ops.cancel("op-2"), "too late once it writes");
+        assert!(b.check().is_ok());
+        drop((a, b));
+        assert!(ops.is_empty());
+        assert!(!ops.cancel("op-2"), "unknown once it ended");
+    }
+
+    #[test]
+    fn sha256_arguments_are_checked() {
+        let sha = "AB".repeat(32);
+        assert_eq!(check_sha(&sha).unwrap(), "ab".repeat(32));
+        for bad in [
+            "",
+            "abc",
+            "../../etc/passwd",
+            &"g".repeat(64),
+            &"a".repeat(65),
+        ] {
+            assert!(
+                matches!(check_sha(bad), Err(ModsError::InvalidName(_))),
+                "{bad:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn the_mods_lock_is_held_until_released() {
+        let rt = tokio::runtime::Builder::new_current_thread()
+            .build()
+            .unwrap();
+        rt.block_on(async {
+            let lock = ModsLock::default();
+            let held = lock.acquire().await;
+            assert!(lock.is_held());
+            drop(held);
+            assert!(!lock.is_held());
+        });
+    }
+
+    #[test]
+    fn versions_and_running_games() {
+        let tmp = tempfile::tempdir().unwrap();
+        let ctx = with_version(tmp.path(), "v1");
+        assert!(ensure_installed(&ctx.paths, "v1").is_ok());
+        assert!(matches!(
+            ensure_installed(&ctx.paths, "v2"),
+            Err(ModsError::VersionNotInstalled(_))
+        ));
+        assert!(ensure_installed(&ctx.paths, "../v1").is_err());
+        ctx.games.insert("v1");
+        assert!(ctx.is_running("v1") && !ctx.is_running("v2"));
+        assert!(matches!(
+            ctx.ensure_not_running("v1"),
+            Err(ModsError::GameRunning(_))
+        ));
+    }
+}
diff --git a/src-tauri/src/mods/diagnose.rs b/src-tauri/src/mods/diagnose.rs
new file mode 100644
index 0000000..2ceef65
--- /dev/null
+++ b/src-tauri/src/mods/diagnose.rs
@@ -0,0 +1,430 @@
+//! Names the mod that stopped the game from starting. Weft exits with code 1 and leaves the
+//! reason in its log; these are the engine's own messages (`crates/engine/src/modloader.rs`),
+//! which `crates/app/src/main.rs` logs with `log::error!`, so as `<time> ERROR [weft] <message>`
+//! (`crates/engine/src/log.rs`). Only ERROR lines of the target `weft` count: the engine logs
+//! ordinary mod loading at INFO, and a mod's own lines (`[mod:x]`) may say anything.
+
+use serde::Serialize;
+use ts_rs::TS;
+
+#[derive(Debug, Clone, Copy, Serialize, PartialEq, Eq, TS)]
+#[serde(rename_all = "camelCase")]
+pub enum FailureKind {
+    /// `mod X was built against another mod ABI (…)`
+    WrongVersion,
+    /// `loading mod X from <path>: <why>`
+    LoadFailed,
+    /// `<path> is not a Weft mod`
+    NotAMod,
+    /// `mod X is the crate Y: name its folder or zip Y`
+    WrongName,
+    /// `mod X requires missing mod Y`
+    MissingDep,
+    /// `X: init panicked`, after the mod's own `[mod:X] panicked at …`
+    InitPanicked,
+}
+
+/// The first mod failure in a run's log, by kind, each with what that kind names. `modId` is the
+/// mod the engine blamed, when the line names one; `line` is the log line, so the player can
+/// search for it.
+#[derive(Debug, Clone, Serialize, PartialEq, TS)]
+#[serde(tag = "kind", rename_all = "camelCase")]
+pub enum ModFailure {
+    WrongVersion {
+        #[serde(rename = "modId")]
+        mod_id: Option<String>,
+        line: String,
+    },
+    LoadFailed {
+        #[serde(rename = "modId")]
+        mod_id: Option<String>,
+        line: String,
+    },
+    NotAMod {
+        #[serde(rename = "modId")]
+        mod_id: Option<String>,
+        line: String,
+    },
+    WrongName {
+        #[serde(rename = "modId")]
+        mod_id: Option<String>,
+        /// The crate the library is: the name its folder or zip needs.
+        #[serde(rename = "crate")]
+        crate_name: String,
+        line: String,
+    },
+    MissingDep {
+        #[serde(rename = "modId")]
+        mod_id: Option<String>,
+        /// The mod that is missing.
+        dependency: String,
+        line: String,
+    },
+    InitPanicked {
+        #[serde(rename = "modId")]
+        mod_id: Option<String>,
+        line: String,
+    },
+}
+
+impl ModFailure {
+    pub fn kind(&self) -> FailureKind {
+        match self {
+            Self::WrongVersion { .. } => FailureKind::WrongVersion,
+            Self::LoadFailed { .. } => FailureKind::LoadFailed,
+            Self::NotAMod { .. } => FailureKind::NotAMod,
+            Self::WrongName { .. } => FailureKind::WrongName,
+            Self::MissingDep { .. } => FailureKind::MissingDep,
+            Self::InitPanicked { .. } => FailureKind::InitPanicked,
+        }
+    }
+
+    fn mod_id_mut(&mut self) -> &mut Option<String> {
+        match self {
+            Self::WrongVersion { mod_id, .. }
+            | Self::LoadFailed { mod_id, .. }
+            | Self::NotAMod { mod_id, .. }
+            | Self::WrongName { mod_id, .. }
+            | Self::MissingDep { mod_id, .. }
+            | Self::InitPanicked { mod_id, .. } => mod_id,
+        }
+    }
+
+    pub fn mod_id(&self) -> Option<&str> {
+        match self {
+            Self::WrongVersion { mod_id, .. }
+            | Self::LoadFailed { mod_id, .. }
+            | Self::NotAMod { mod_id, .. }
+            | Self::WrongName { mod_id, .. }
+            | Self::MissingDep { mod_id, .. }
+            | Self::InitPanicked { mod_id, .. } => mod_id.as_deref(),
+        }
+    }
+
+    pub fn line(&self) -> &str {
+        match self {
+            Self::WrongVersion { line, .. }
+            | Self::LoadFailed { line, .. }
+            | Self::NotAMod { line, .. }
+            | Self::WrongName { line, .. }
+            | Self::MissingDep { line, .. }
+            | Self::InitPanicked { line, .. } => line,
+        }
+    }
+}
+
+fn word_after<'a>(line: &'a str, prefix: &str) -> Option<&'a str> {
+    let rest = &line[line.find(prefix)? + prefix.len()..];
+    let end = rest
+        .find(|c: char| !(c.is_ascii_alphanumeric() || c == '_'))
+        .unwrap_or(rest.len());
+    (end > 0).then(|| &rest[..end])
+}
+
+/// `…/mods/libcogwork.so` or `C:\…\123-cogwork.dll` → `cogwork`.
+fn id_from_library(path: &str) -> Option<String> {
+    let file = path.rsplit(['/', '\\']).next()?;
+    let stem = file
+        .strip_suffix(".dll")
+        .or_else(|| file.strip_suffix(".so"))
+        .or_else(|| file.strip_suffix(".dylib"))?;
+    // The engine loads a copy named `<pid>-<file>`.
+    let stem = stem.split_once('-').map_or(stem, |(pid, rest)| {
+        if pid.bytes().all(|b| b.is_ascii_digit()) {
+            rest
+        } else {
+            stem
+        }
+    });
+    let id = stem.strip_prefix("lib").unwrap_or(stem);
+    (!id.is_empty()).then(|| id.to_string())
+}
+
+/// A log line split as the engine writes it, after the launcher's `[stderr] ` or `[stdout] `:
+/// `{t:9.3} {LEVEL} [{target}] {message}`.
+struct Record<'a> {
+    level: &'a str,
+    target: &'a str,
+    message: &'a str,
+}
+
+fn record(line: &str) -> Option<Record<'_>> {
+    let rest = line.trim_start();
+    let rest = ["[stderr]", "[stdout]"]
+        .iter()
+        .find_map(|p| rest.strip_prefix(p))
+        .unwrap_or(rest)
+        .trim_start();
+    let (time, rest) = rest.split_once(char::is_whitespace)?;
+    time.parse::<f64>().ok()?;
+    let (level, rest) = rest.trim_start().split_once(char::is_whitespace)?;
+    let rest = rest.trim_start().strip_prefix('[')?;
+    let (target, message) = rest.split_once("] ")?;
+    Some(Record {
+        level,
+        target,
+        message,
+    })
+}
+
+/// The message of an engine ERROR line, if this is one.
+fn engine_error(line: &str) -> Option<&str> {
+    let r = record(line)?;
+    (r.level == "ERROR" && r.target == "weft").then_some(r.message)
+}
+
+fn is_id(s: &str) -> bool {
+    !s.is_empty() && s.bytes().all(|b| b.is_ascii_alphanumeric() || b == b'_')
+}
+
+fn classify(line: &str) -> Option<ModFailure> {
+    use ModFailure as F;
+    let message = engine_error(line)?;
+    let line = line.trim().to_string();
+    let named = |prefix: &str| word_after(message, prefix).map(str::to_string);
+    if message.contains("was built against another mod ABI") {
+        return Some(F::WrongVersion {
+            mod_id: named("mod "),
+            line,
+        });
+    }
+    // The engine always names the missing mod and the crate; a line without them isn't its.
+    if message.contains(" requires missing mod ") {
+        return Some(F::MissingDep {
+            mod_id: named("mod "),
+            dependency: named(" requires missing mod ")?,
+            line,
+        });
+    }
+    if message.contains(" is the crate ") {
+        return Some(F::WrongName {
+            mod_id: named("mod "),
+            crate_name: named(" is the crate ")?,
+            line,
+        });
+    }
+    if let Some(id) = word_after(message, "loading mod ")
+        && message.starts_with(&format!("loading mod {id} from "))
+    {
+        return Some(F::LoadFailed {
+            mod_id: Some(id.to_string()),
+            line,
+        });
+    }
+    if let Some(at) = message.find(" is not a Weft mod") {
+        return Some(F::NotAMod {
+            mod_id: id_from_library(message[..at].trim()),
+            line,
+        });
+    }
+    if let Some(before) = message.trim_end().strip_suffix("init panicked") {
+        // The engine prefixes each registration error with the mod's id: `showcase: init panicked`.
+        let id = before
+            .trim_end()
+            .strip_suffix(':')
+            .map(str::trim)
+            .filter(|id| is_id(id));
+        return Some(F::InitPanicked {
+            mod_id: id.map(str::to_string),
+            line,
+        });
+    }
+    None
+}
+
+/// For an init panic, the mod named by the lines before it: the mod's own `[mod:X] panicked`
+/// line, else the nearest `loading mod X`.
+fn panicked_mod(before: &[String]) -> Option<String> {
+    let from_panic = before.iter().rev().find_map(|l| {
+        if !l.contains("panicked") {
+            return None;
+        }
+        word_after(l, "[mod:").map(str::to_string)
+    });
+    from_panic.or_else(|| {
+        before
+            .iter()
+            .rev()
+            .find_map(|l| word_after(l, "loading mod ").map(str::to_string))
+    })
+}
+
+/// The first mod failure in the log of one run.
+pub fn find(log: &str) -> Option<ModFailure> {
+    let lines: Vec<String> = log.lines().map(crate::launch::strip_ansi_codes).collect();
+    lines.iter().enumerate().find_map(|(i, l)| {
+        let mut failure = classify(l)?;
+        if failure.kind() == FailureKind::InitPanicked && failure.mod_id().is_none() {
+            *failure.mod_id_mut() = panicked_mod(&lines[..i]);
+        }
+        Some(failure)
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use FailureKind as K;
+
+    /// One fixture per kind, in the shape the launcher's log has: `[stderr]` from the launcher,
+    /// then the engine's own `{t:9.3} {LEVEL} [{target}] {message}` with its colour codes
+    /// (`crates/engine/src/log.rs`). The messages are the engine's `format!` strings in
+    /// `crates/engine/src/modloader.rs` and `content.rs`, logged by `crates/app` (target `weft`).
+    #[test]
+    fn every_failure_kind() {
+        // What, log, kind, mod, other.
+        type Case<'a> = (&'a str, &'a str, K, Option<&'a str>, Option<&'a str>);
+        let cases: &[Case] = &[
+            (
+                "wrong version",
+                "[stderr] \x1b[90m    0.512\x1b[0m \x1b[1;31mERROR\x1b[0m \x1b[90m[weft]\x1b[0m mod structures was built against another mod ABI (5f0569a6bea71b81, this engine has f470b1cbb1f9ad91); rebuild it against the current weft_sdk",
+                K::WrongVersion,
+                Some("structures"),
+                None,
+            ),
+            (
+                "load failed",
+                "[stderr]     0.402 ERROR [weft] loading mod cogwork from /home/u/.cache/weft/unpacked/cogwork-2642469-1793815500/libcogwork.so: undefined symbol: foo",
+                K::LoadFailed,
+                Some("cogwork"),
+                None,
+            ),
+            (
+                "not a mod",
+                "[stderr]     0.402 ERROR [weft] /home/u/.cache/weft/unpacked/mytweak-1048-1793815500/libmytweak.so is not a Weft mod",
+                K::NotAMod,
+                Some("mytweak"),
+                None,
+            ),
+            (
+                "not a mod, path with spaces",
+                r"[stderr]     0.402 ERROR [weft] C:\Users\Jo Doe\AppData\Local\weft\cache\unpacked\my_tweak-1048-1793815500\my_tweak.dll is not a Weft mod",
+                K::NotAMod,
+                Some("my_tweak"),
+                None,
+            ),
+            (
+                "wrong name",
+                "[stderr]     0.402 ERROR [weft] mod cogworks is the crate cogwork: name its folder or zip cogwork",
+                K::WrongName,
+                Some("cogworks"),
+                Some("cogwork"),
+            ),
+            (
+                "missing dependency",
+                "[stderr]     0.402 ERROR [weft] mod cogwork requires missing mod showcase",
+                K::MissingDep,
+                Some("cogwork"),
+                Some("showcase"),
+            ),
+            (
+                "init panic, named by the engine",
+                "[stderr]     0.903 ERROR [weft] showcase: init panicked",
+                K::InitPanicked,
+                Some("showcase"),
+                None,
+            ),
+        ];
+        for (what, log, kind, id, other) in cases {
+            let f = find(log).unwrap_or_else(|| panic!("{what}: nothing found"));
+            assert_eq!(f.kind(), *kind, "{what}");
+            assert_eq!(f.mod_id(), *id, "{what}");
+            let named = match &f {
+                ModFailure::MissingDep { dependency, .. } => Some(dependency.as_str()),
+                ModFailure::WrongName { crate_name, .. } => Some(crate_name.as_str()),
+                _ => None,
+            };
+            assert_eq!(named, *other, "{what}");
+            assert!(!f.line().contains('\x1b'), "{what}: colour codes stripped");
+        }
+    }
+
+    /// A path with `] ` in it doesn't move the message.
+    #[test]
+    fn paths_with_brackets() {
+        let line =
+            "[stderr]     0.402 ERROR [weft] /home/u/mods [old] /x/libmytweak.so is not a Weft mod";
+        let f = find(line).unwrap();
+        assert_eq!(f.kind(), K::NotAMod);
+        assert_eq!(f.mod_id(), Some("mytweak"));
+    }
+
+    #[test]
+    fn an_init_panic_names_the_mod() {
+        // Several registration errors are joined with newlines into one ERROR record: only the
+        // first line carries the prefix, and the first failure counts.
+        let log = "\
+[stderr]     0.101 INFO  [modloader] unpacked mod cogwork
+[stderr]     0.101 INFO  [modloader] unpacked mod showcase
+[stderr]     0.310 ERROR [mod:showcase] panicked at src/lib.rs:12: no tubes
+[stderr]     0.320 ERROR [weft] showcase: init panicked
+[stderr] cogwork: init panicked
+";
+        let f = find(log).unwrap();
+        assert_eq!(f.kind(), K::InitPanicked);
+        assert_eq!(f.mod_id(), Some("showcase"));
+
+        // Without the prefix (older engines), the mod's own panic line names it.
+        let log = "\
+[stderr]     0.310 ERROR [mod:cogwork::pipes] panicked at src/pipes.rs:3: x
+[stderr]     0.320 ERROR [weft] init panicked
+";
+        assert_eq!(find(log).unwrap().mod_id(), Some("cogwork"));
+
+        let log = "\
+[stderr]     0.200 DEBUG [weft] loading mod lanterns
+[stderr]     0.320 ERROR [weft] init panicked
+";
+        assert_eq!(find(log).unwrap().mod_id(), Some("lanterns"));
+    }
+
+    /// What the page gets: one shape per kind, with only that kind's fields.
+    #[test]
+    fn each_kind_crosses_with_its_own_fields() {
+        let f = find("[stderr]     0.402 ERROR [weft] mod cogwork requires missing mod showcase")
+            .unwrap();
+        assert_eq!(
+            serde_json::to_value(&f).unwrap(),
+            serde_json::json!({
+                "kind": "missingDep",
+                "modId": "cogwork",
+                "dependency": "showcase",
+                "line": "[stderr]     0.402 ERROR [weft] mod cogwork requires missing mod showcase"
+            })
+        );
+        let f = find("[stderr]     0.402 ERROR [weft] mod cogworks is the crate cogwork: name its folder or zip cogwork").unwrap();
+        let v = serde_json::to_value(&f).unwrap();
+        assert_eq!(
+            (v["kind"].as_str(), v["crate"].as_str()),
+            (Some("wrongName"), Some("cogwork"))
+        );
+        let f = find("[stderr]     0.903 ERROR [weft] init panicked").unwrap();
+        assert_eq!(
+            serde_json::to_value(&f).unwrap(),
+            serde_json::json!({ "kind": "initPanicked", "modId": null, "line": "[stderr]     0.903 ERROR [weft] init panicked" })
+        );
+    }
+
+    #[test]
+    fn ordinary_lines_are_not_failures() {
+        for line in [
+            "[stderr]     1.200 INFO  [modloader] loaded mod cogwork 0.2.0 (load position 1)",
+            "[stderr]     0.101 INFO  [modloader] unpacked mod cogwork",
+            "[stderr]     0.101 INFO  [modloader] mod cogwork is turned off",
+            "[stderr]     0.101 WARN  [modloader] mod lanterns is off, as it needs one that is",
+            "[stderr]    90.000 ERROR [mod:cogwork] panicked at src/lib.rs:1: later, in game",
+            // The same words at another level, or in a mod's own chat, are not the engine's.
+            "[stderr]     0.402 INFO  [mod:hints] loading mod cogwork from the cache",
+            "[stderr]     0.402 WARN  [weft] mod cogwork requires missing mod showcase",
+            "[stdout] <player> my build is not a Weft mod",
+            // A mod's own ERROR lines name other mods; only the engine's count.
+            "[stderr]     0.402 ERROR [mod:hints] mod cogwork requires missing mod showcase",
+            "[stderr]     0.402 ERROR [mod:x] mod y was built against another mod ABI (1, this engine has 2)",
+            "[stderr]     0.402 ERROR [modloader] showcase: init panicked",
+            "ERROR [weft] mod cogwork requires missing mod showcase",
+            "",
+        ] {
+            assert!(find(line).is_none(), "{line:?}");
+        }
+    }
+}
diff --git a/src-tauri/src/mods/doc_tests.rs b/src-tauri/src/mods/doc_tests.rs
new file mode 100644
index 0000000..5e91839
--- /dev/null
+++ b/src-tauri/src/mods/doc_tests.rs
@@ -0,0 +1,440 @@
+//! The JSON examples in `docs/mod-manager/INDEX_FORMAT.md` and `PROPOSAL.md`, read with the
+//! launcher's own code: the documented format is the accepted one.
+
+use super::catalog::{self, IndexStatus, Trust};
+use super::index::{self, Freshness};
+use super::sources::{GhAsset, GhRelease, ModJson, accept};
+
+const DOC: &str = include_str!("../../../docs/mod-manager/INDEX_FORMAT.md");
+const PROPOSAL: &str = include_str!("../../../docs/mod-manager/PROPOSAL.md");
+const AUTHORING: &str = include_str!("../../../docs/mod-manager/AUTHORING.md");
+
+/// The author's guide sends them to sections and files that exist, and INDEX_FORMAT to it.
+#[test]
+fn the_authoring_guide_points_at_what_is_there() {
+    for (link, heading) in [
+        (
+            "INDEX_FORMAT.md#idmodjson-for-unreviewed-sources",
+            "## `<id>.mod.json`, for Unreviewed sources",
+        ),
+        ("INDEX_FORMAT.md#provenance", "## Provenance"),
+    ] {
+        assert!(AUTHORING.contains(link), "{link}");
+        assert!(DOC.contains(heading), "{heading}");
+    }
+    assert!(AUTHORING.contains("schema/mod.schema.json"));
+    assert!(DOC.contains("[AUTHORING.md](AUTHORING.md)"));
+    // The tag it suggests is one the launcher takes.
+    assert!(super::abi::is_safe_ref("lanterns-v1.2.0"));
+}
+
+fn json_blocks() -> Vec<serde_json::Value> {
+    json_blocks_in(DOC)
+}
+
+fn json_blocks_in(doc: &str) -> Vec<serde_json::Value> {
+    // A Windows checkout may have turned the line ends into CRLF.
+    let doc = doc.replace("\r\n", "\n");
+    let mut out = Vec::new();
+    let mut rest = doc.as_str();
+    while let Some(start) = rest.find("```json\n") {
+        let body = &rest[start + "```json\n".len()..];
+        let end = body.find("\n```").expect("closed code block");
+        out.push(
+            serde_json::from_str(&body[..end])
+                .unwrap_or_else(|e| panic!("example is not valid JSON: {e}\n{}", &body[..end])),
+        );
+        rest = &body[end..];
+    }
+    out
+}
+
+fn example(has: &str) -> serde_json::Value {
+    json_blocks()
+        .into_iter()
+        .find(|v| v.get(has).is_some())
+        .unwrap_or_else(|| panic!("no example with {has:?}"))
+}
+
+#[test]
+fn the_index_example_parses_and_keeps_everything() {
+    let raw = example("mods");
+    let index = index::parse(raw.to_string().as_bytes()).unwrap();
+    let raw_versions: usize = raw["mods"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .map(|m| m["versions"].as_array().unwrap().len())
+        .sum();
+    let versions: usize = index.mods.iter().map(|m| m.versions.len()).sum();
+    assert_eq!(versions, raw_versions, "an example version was dropped");
+    assert_eq!(index.weft.len(), raw["weft"].as_array().unwrap().len());
+    assert_eq!(
+        index.revoked.len(),
+        raw["revoked"].as_array().unwrap().len()
+    );
+    assert!(index.mods[0].icon.is_some() && index.mods[0].homepage.is_some());
+
+    let status = IndexStatus {
+        freshness: Freshness::Fresh,
+        generated: None,
+        signed_at: None,
+        error: None,
+        cache_error: None,
+    };
+    let catalog = catalog::build(Some(&index), status, vec![]);
+    let v = &catalog.mods[0].versions[0];
+    assert_eq!(v.trust, Trust::Reviewed);
+    assert_eq!(v.build_record, catalog::BuildRecord::Recorded);
+    assert_eq!(v.platforms.len(), 3);
+}
+
+#[test]
+fn the_mod_json_example_is_accepted() {
+    assert_accepted(example("asset"));
+}
+
+/// The proposal links to INDEX_FORMAT instead of keeping its own examples; any it gains must be
+/// valid too.
+#[test]
+fn the_proposal_has_no_stale_examples() {
+    for raw in json_blocks_in(PROPOSAL) {
+        if raw.get("asset").is_some() {
+            assert_accepted(raw);
+        } else if raw.get("mods").is_some() {
+            index::parse(raw.to_string().as_bytes()).unwrap();
+        }
+    }
+}
+
+fn assert_accepted(raw: serde_json::Value) {
+    let json: ModJson = serde_json::from_value(raw.clone()).unwrap();
+    let zip = GhAsset {
+        name: json.asset.name.clone(),
+        browser_download_url: json.asset.url.clone(),
+        size: json.asset.size,
+        digest: Some(format!("sha256:{}", json.asset.sha256)),
+    };
+    let release = GhRelease {
+        tag_name: json.tag.clone(),
+        draft: false,
+        prerelease: false,
+        published_at: None,
+        assets: vec![zip.clone()],
+    };
+    let repo = json.source.repo.clone();
+    let accepted = accept(&repo, &release, &zip, json).expect("the example is accepted");
+    assert!(accepted.icon.is_some(), "the icon is an absolute URL");
+    assert!(accepted.versions[0].reviewed.is_none());
+}
+
+/// The documented defaults of a revocation are the ones the parser uses.
+#[test]
+fn the_revocation_defaults_are_documented() {
+    let none = index::revocation(serde_json::json!({ "sha256": "a".repeat(64) })).unwrap();
+    assert_eq!(none.reason, None, "a revocation without a reason has none");
+    assert!(
+        DOC.contains("| `revoked[].reason` | none (`null`) |"),
+        "INDEX_FORMAT.md says a missing reason is none"
+    );
+    assert!(DOC.contains("Revocations fail closed"));
+}
+
+// ---------------------------------------------------------------------------------------------
+// The JSON Schemas in docs/mod-manager/schema, held to the examples and to the launcher's checks.
+
+const INDEX_SCHEMA: &str = include_str!("../../../docs/mod-manager/schema/index.schema.json");
+const MOD_SCHEMA: &str = include_str!("../../../docs/mod-manager/schema/mod.schema.json");
+
+/// What each `pattern` in the schemas stands for: the launcher's own check, so a pattern can't
+/// drift from what is enforced without this table changing too. A pattern not here fails.
+fn pattern_check(pattern: &str) -> fn(&str) -> bool {
+    use super::abi::{is_abi, is_safe_ref};
+    use super::index::{is_commit, is_mod_id, is_repo, is_rfc3339, is_semver, is_sha256};
+    match pattern {
+        r"^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$" => is_rfc3339,
+        "^[a-z0-9_]{1,64}$" => is_mod_id,
+        "^[A-Za-z0-9_-][A-Za-z0-9._-]{0,99}$" => is_safe_ref,
+        "^[A-Za-z0-9._-]{1,100}/[A-Za-z0-9._-]{1,100}$" => is_repo,
+        "^([0-9a-f]{40}|[0-9a-f]{64})$" => is_commit,
+        "^[0-9a-f]{16}$" => is_abi,
+        "^[0-9a-f]{64}$" => is_sha256,
+        r"^\s*[0-9A-Fa-f]{64}\s*$" => |s| {
+            let t = s.trim();
+            t.len() == 64 && t.bytes().all(|b| b.is_ascii_hexdigit())
+        },
+        r"^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$" => {
+            is_semver
+        }
+        r"^\.github/workflows/[A-Za-z0-9._-]+\.ya?ml$" => super::index::is_workflow_path,
+        "^https://" => |s| s.starts_with("https://"),
+        r"^https://github\.com/" => |s| s.starts_with("https://github.com/"),
+        r"^https://(github\.com|raw\.githubusercontent\.com|user-images\.githubusercontent\.com|[A-Za-z0-9-]+\.github\.io)/" => {
+            crate::download::icon_url_allowed
+        }
+        other => {
+            panic!("schema pattern {other:?} stands for no launcher check; add it to pattern_check")
+        }
+    }
+}
+
+/// A validator for the part of JSON Schema the schemas use, and only that: a keyword it doesn't
+/// know fails, so the schemas stay checkable here.
+struct Schemas {
+    files: Vec<(&'static str, serde_json::Value)>,
+}
+
+impl Schemas {
+    fn load() -> Self {
+        let parse = |s: &str| serde_json::from_str::<serde_json::Value>(s).expect("schema is JSON");
+        Schemas {
+            files: vec![
+                ("index.schema.json", parse(INDEX_SCHEMA)),
+                ("mod.schema.json", parse(MOD_SCHEMA)),
+            ],
+        }
+    }
+
+    fn file(&self, name: &str) -> &serde_json::Value {
+        &self
+            .files
+            .iter()
+            .find(|(n, _)| *n == name)
+            .unwrap_or_else(|| panic!("no schema {name}"))
+            .1
+    }
+
+    /// Where `value` breaks `schema` (inside file `file`), as JSON-pointer-ish paths.
+    fn errors(
+        &self,
+        file: &str,
+        schema: &serde_json::Value,
+        value: &serde_json::Value,
+        at: &str,
+    ) -> Vec<String> {
+        use serde_json::Value as V;
+        let mut out = Vec::new();
+        let Some(rules) = schema.as_object() else {
+            panic!("schema at {at} is not an object");
+        };
+        for (key, rule) in rules {
+            match key.as_str() {
+                "$schema" | "$id" | "$defs" | "title" | "description" | "format" => {}
+                "$ref" => {
+                    let r = rule.as_str().unwrap();
+                    let (target, pointer) = r.split_once('#').unwrap();
+                    let target = if target.is_empty() { file } else { target };
+                    let resolved = self
+                        .file(target)
+                        .pointer(pointer)
+                        .unwrap_or_else(|| panic!("no {r}"));
+                    out.extend(self.errors(target, resolved, value, at));
+                }
+                "type" => {
+                    let types: Vec<&str> = match rule {
+                        V::String(t) => vec![t.as_str()],
+                        V::Array(ts) => ts.iter().map(|t| t.as_str().unwrap()).collect(),
+                        _ => panic!("type at {at}"),
+                    };
+                    let fits = |t: &str| match t {
+                        "object" => value.is_object(),
+                        "array" => value.is_array(),
+                        "string" => value.is_string(),
+                        "integer" => value.is_u64() || value.is_i64(),
+                        "number" => value.is_number(),
+                        "boolean" => value.is_boolean(),
+                        "null" => value.is_null(),
+                        other => panic!("type {other} at {at}"),
+                    };
+                    if !types.iter().any(|t| fits(t)) {
+                        out.push(format!("{at}: not {types:?}"));
+                    }
+                }
+                "const" if value != rule => out.push(format!("{at}: not {rule}")),
+                "const" => {}
+                "enum" if !rule.as_array().unwrap().contains(value) => {
+                    out.push(format!("{at}: not one of {rule}"))
+                }
+                "enum" => {}
+                "required" => {
+                    if let Some(o) = value.as_object() {
+                        for k in rule.as_array().unwrap() {
+                            if !o.contains_key(k.as_str().unwrap()) {
+                                out.push(format!("{at}: lacks {k}"));
+                            }
+                        }
+                    }
+                }
+                "properties" => {
+                    if let Some(o) = value.as_object() {
+                        for (k, sub) in rule.as_object().unwrap() {
+                            if let Some(v) = o.get(k) {
+                                out.extend(self.errors(file, sub, v, &format!("{at}/{k}")));
+                            }
+                        }
+                    }
+                }
+                "items" => {
+                    if let Some(a) = value.as_array() {
+                        for (i, v) in a.iter().enumerate() {
+                            out.extend(self.errors(file, rule, v, &format!("{at}/{i}")));
+                        }
+                    }
+                }
+                "allOf" => {
+                    for sub in rule.as_array().unwrap() {
+                        out.extend(self.errors(file, sub, value, at));
+                    }
+                }
+                "anyOf" => {
+                    let any = rule
+                        .as_array()
+                        .unwrap()
+                        .iter()
+                        .any(|sub| self.errors(file, sub, value, at).is_empty());
+                    if !any {
+                        out.push(format!("{at}: matches none of anyOf"));
+                    }
+                }
+                "not" => {
+                    if self.errors(file, rule, value, at).is_empty() {
+                        out.push(format!("{at}: matches what `not` rules out"));
+                    }
+                }
+                "pattern" => {
+                    if let Some(s) = value.as_str()
+                        && !pattern_check(rule.as_str().unwrap())(s)
+                    {
+                        out.push(format!("{at}: {s:?} doesn't match {rule}"));
+                    }
+                }
+                "minLength" => {
+                    if let Some(s) = value.as_str()
+                        && (s.chars().count() as u64) < rule.as_u64().unwrap()
+                    {
+                        out.push(format!("{at}: shorter than {rule}"));
+                    }
+                }
+                "minimum" => {
+                    if let Some(n) = value.as_f64()
+                        && n < rule.as_f64().unwrap()
+                    {
+                        out.push(format!("{at}: below {rule}"));
+                    }
+                }
+                other => panic!(
+                    "schema keyword {other:?} at {at} isn't checked here; add it or leave it out"
+                ),
+            }
+        }
+        out
+    }
+
+    fn check(&self, file: &str, value: &serde_json::Value) -> Vec<String> {
+        self.errors(file, self.file(file), value, "")
+    }
+}
+
+#[test]
+fn the_examples_follow_the_schemas() {
+    let s = Schemas::load();
+    assert_eq!(
+        s.check("index.schema.json", &example("mods")),
+        Vec::<String>::new()
+    );
+    assert_eq!(
+        s.check("mod.schema.json", &example("asset")),
+        Vec::<String>::new()
+    );
+    // INDEX_FORMAT points at them.
+    assert!(DOC.contains("schema/index.schema.json") && DOC.contains("schema/mod.schema.json"));
+}
+
+/// What the schemas rule out, the launcher drops or refuses too.
+#[test]
+fn the_schemas_and_the_launcher_agree_on_what_is_wrong() {
+    let s = Schemas::load();
+    type Change = fn(&mut serde_json::Value);
+    let builds: &[(&str, Change)] = &[
+        ("no sha256", |v| {
+            v["asset"].as_object_mut().unwrap().remove("sha256");
+        }),
+        ("an uppercase sha256", |v| {
+            v["asset"]["sha256"] = "A".repeat(64).into()
+        }),
+        ("an unknown channel", |v| v["channel"] = "beta".into()),
+        ("a version that isn't semver", |v| {
+            v["version"] = "1.2".into()
+        }),
+        ("a short commit", |v| {
+            v["source"]["commit"] = "cceea78".into()
+        }),
+        ("an abi that isn't 16 hex", |v| {
+            v["weft"]["abi"] = "f470".into()
+        }),
+        ("a dep that isn't a mod id", |v| {
+            v["deps"] = serde_json::json!([{ "id": "Base" }])
+        }),
+        ("no reviewer", |v| v["reviewed"]["by"] = "".into()),
+    ];
+    for (what, change) in builds {
+        let mut raw = example("mods");
+        change(&mut raw["mods"][0]["versions"][0]);
+        assert!(
+            !s.check("index.schema.json", &raw).is_empty(),
+            "the schema allows {what}"
+        );
+        let index = index::parse(raw.to_string().as_bytes()).unwrap();
+        let kept: usize = index.mods.iter().map(|m| m.versions.len()).sum();
+        assert_eq!(kept, 0, "the launcher keeps a build with {what}");
+    }
+
+    let mods: &[(&str, Change)] = &[
+        ("the reserved id", |v| v["id"] = "base".into()),
+        ("an id with capitals", |v| v["id"] = "Lanterns".into()),
+        ("no schema", |v| {
+            v.as_object_mut().unwrap().remove("schema");
+        }),
+    ];
+    for (what, change) in mods {
+        let mut raw = example("asset");
+        change(&mut raw);
+        assert!(
+            !s.check("mod.schema.json", &raw).is_empty(),
+            "the schema allows {what}"
+        );
+        let accepted = serde_json::from_value::<ModJson>(raw)
+            .ok()
+            .and_then(|json| {
+                let zip = GhAsset {
+                    name: json.asset.name.clone(),
+                    browser_download_url: json.asset.url.clone(),
+                    size: json.asset.size,
+                    digest: Some(format!("sha256:{}", json.asset.sha256)),
+                };
+                let release = GhRelease {
+                    tag_name: json.tag.clone(),
+                    draft: false,
+                    prerelease: false,
+                    published_at: None,
+                    assets: vec![zip.clone()],
+                };
+                let repo = json.source.repo.clone();
+                accept(&repo, &release, &zip, json).ok()
+            });
+        assert!(
+            accepted.is_none(),
+            "the launcher accepts a mod.json with {what}"
+        );
+    }
+
+    // An icon off GitHub's hosts: the schema says no, and the launcher drops it.
+    let mut raw = example("mods");
+    raw["mods"][0]["icon"] = "https://tracker.example/icon.png".into();
+    assert!(!s.check("index.schema.json", &raw).is_empty());
+    assert!(
+        index::parse(raw.to_string().as_bytes()).unwrap().mods[0]
+            .icon
+            .is_none()
+    );
+}
diff --git a/src-tauri/src/mods/error.rs b/src-tauri/src/mods/error.rs
new file mode 100644
index 0000000..fbaef75
--- /dev/null
+++ b/src-tauri/src/mods/error.rs
@@ -0,0 +1,303 @@
+use thiserror::Error;
+
+use super::archive::ArchiveProblem;
+use crate::download::DownloadError;
+use crate::error::{AppError, ErrorCode, is_disk_full};
+
+#[derive(Debug, Error)]
+pub enum ModsError {
+    #[error("Network error: {0}")]
+    Network(#[from] reqwest::Error),
+    #[error("I/O error: {0}")]
+    Io(#[from] std::io::Error),
+    #[error("Serialization error: {0}")]
+    Serde(#[from] serde_json::Error),
+    #[error("Unexpected HTTP status {status} for {url}")]
+    Http { status: u16, url: String },
+    /// A mod download that GitHub refused for too many requests.
+    #[error("Too many requests")]
+    RateLimited,
+    /// GitHub's API refused to list a source's releases for too many requests. `reset`: when
+    /// GitHub said the limit ends (`x-ratelimit-reset`, Unix seconds), when it said.
+    #[error("GitHub API rate limit exceeded")]
+    SourceRateLimited { reset: Option<u64> },
+    #[error("Not on the server any more: {0}")]
+    DownloadNotFound(String),
+    #[error("Too large: {0}")]
+    TooLarge(String),
+    #[error("Index signature invalid: {0}")]
+    IndexSignatureInvalid(String),
+    #[error("Index is older than the one already verified")]
+    IndexRollback,
+    #[error("Index unusable: {0}")]
+    IndexInvalid(String),
+    #[error("Mod interface of {0} unknown")]
+    AbiUnavailable(String),
+    #[error("Not in the catalog: {0}")]
+    NotInCatalog(String),
+    #[error("{0} is not built for this game version")]
+    Incompatible(String),
+    #[error("{0} is not built for this system")]
+    NotForPlatform(String),
+    #[error("Revoked: {0}")]
+    Revoked(String),
+    #[error("Not a Weft mod: {0}")]
+    ArchiveInvalid(ArchiveProblem),
+    #[error("SHA256 mismatch: expected {expected}, got {actual}")]
+    Sha256Mismatch { expected: String, actual: String },
+    #[error("The file changed since it was checked")]
+    FileChanged,
+    #[error("Mod not installed: {0}")]
+    NotInstalled(String),
+    /// The store's copy of an installed mod is gone (removed by hand, or a disk restored from an
+    /// older backup): installing the same build again brings it back. The mod's id.
+    #[error("Missing from the store: {0}")]
+    StoreMissing(String),
+    /// The display names of the mods that would stop the game.
+    #[error("Mods stop the game from starting: {0}")]
+    Blocked(String),
+    #[error("Invalid source: {0}")]
+    SourceInvalid(String),
+    #[error("Source not found: {0}")]
+    SourceNotFound(String),
+    /// `sources.json` couldn't be read; it was kept, at this path.
+    #[error("Sources list damaged; kept as {0}")]
+    SourcesDamaged(String),
+    #[error("Invalid name: {0}")]
+    InvalidName(String),
+    /// `base` ships inside every Weft; nothing may install over it.
+    #[error("Reserved mod id: {0}")]
+    IdReserved(String),
+    #[error("Version not installed: {0}")]
+    VersionNotInstalled(String),
+    #[error("The game is running: {0}")]
+    GameRunning(String),
+    /// A download finished, but the profile, the catalogue or the version changed meanwhile in
+    /// a way that makes the plan wrong.
+    #[error("Changed meanwhile: {0}")]
+    ChangedMeanwhile(String),
+    /// `mods.lock.json` can't be used as it is.
+    #[error("Mod set unreadable: {0}")]
+    LockInvalid(String),
+    /// The player cancelled the operation; nothing was changed.
+    #[error("Cancelled")]
+    Cancelled,
+    /// A build's download URL isn't its GitHub release asset.
+    #[error("Refused download URL {url}: {why}")]
+    UrlRefused {
+        url: String,
+        why: super::index::UrlProblem,
+    },
+    /// A mod icon that isn't a PNG.
+    #[error("Not a PNG icon: {0}")]
+    IconInvalid(String),
+}
+
+impl From<ArchiveProblem> for ModsError {
+    fn from(p: ArchiveProblem) -> Self {
+        ModsError::ArchiveInvalid(p)
+    }
+}
+
+impl ModsError {
+    /// A failed mod download, keeping what went wrong: gone, too big, full disk, rate limited
+    /// or the network.
+    pub fn from_download(err: DownloadError, url: &str) -> Self {
+        match err {
+            DownloadError::Status(s) if s.as_u16() == 404 || s.as_u16() == 410 => {
+                ModsError::DownloadNotFound(url.to_string())
+            }
+            DownloadError::Status(s) if s.as_u16() == 429 || s.as_u16() == 403 => {
+                ModsError::RateLimited
+            }
+            DownloadError::Status(s) => ModsError::Http {
+                status: s.as_u16(),
+                url: url.to_string(),
+            },
+            DownloadError::TooLarge(max) => ModsError::TooLarge(format!("more than {max} bytes")),
+            DownloadError::Io(e) => ModsError::Io(e),
+            DownloadError::Network(e) => ModsError::Network(e),
+        }
+    }
+
+    pub fn code(&self) -> ErrorCode {
+        use ErrorCode as C;
+        use ModsError::*;
+        match self {
+            Network(_) => C::Network,
+            // A gateway that couldn't reach what is behind it: as good as unreachable.
+            Http {
+                status: 502..=504, ..
+            } => C::Network,
+            // Otherwise the server answered: the network is up, so never "offline".
+            Http { .. } => C::HttpStatus,
+            Io(e) if is_disk_full(e) => C::DiskFull,
+            Io(_) => C::Io,
+            Serde(_) => C::Serde,
+            RateLimited => C::RateLimited,
+            SourceRateLimited { .. } => C::ModSourceRateLimited,
+            DownloadNotFound(_) => C::ModDownloadNotFound,
+            TooLarge(_) => C::ModTooLarge,
+            IndexSignatureInvalid(_) => C::IndexSignatureInvalid,
+            IndexRollback => C::IndexRollback,
+            IndexInvalid(_) => C::IndexInvalid,
+            AbiUnavailable(_) => C::AbiUnavailable,
+            NotInCatalog(_) => C::ModNotInCatalog,
+            Incompatible(_) => C::ModIncompatible,
+            NotForPlatform(_) => C::ModNotForPlatform,
+            Revoked(_) => C::ModRevoked,
+            ArchiveInvalid(_) => C::ModArchiveInvalid,
+            Sha256Mismatch { .. } => C::Sha256Mismatch,
+            FileChanged => C::ModFileChanged,
+            NotInstalled(_) => C::ModNotInstalled,
+            StoreMissing(_) => C::ModStoreMissing,
+            Blocked(_) => C::ModsBlocked,
+            SourceInvalid(_) => C::ModSourceInvalid,
+            SourceNotFound(_) => C::ModSourceNotFound,
+            SourcesDamaged(_) => C::ModSourcesDamaged,
+            InvalidName(_) => C::InvalidName,
+            IdReserved(_) => C::ModIdReserved,
+            VersionNotInstalled(_) => C::NotInstalled,
+            GameRunning(_) => C::GameRunning,
+            ChangedMeanwhile(_) => C::ModChangedMeanwhile,
+            LockInvalid(_) => C::ModLockInvalid,
+            Cancelled => C::ModCancelled,
+            UrlRefused { .. } => C::ModUrlRefused,
+            IconInvalid(_) => C::ModIconInvalid,
+        }
+    }
+}
+
+impl From<ModsError> for AppError {
+    fn from(err: ModsError) -> Self {
+        use ModsError::*;
+        let code = err.code();
+        let detail = match err {
+            Network(e) => Some(e.to_string()),
+            Io(e) => Some(e.to_string()),
+            Serde(e) => Some(e.to_string()),
+            Http { status, url } => Some(format!("HTTP {status} ({url})")),
+            // The page reads the time from here (src/mods/select.ts `rateLimitReset`).
+            SourceRateLimited { reset } => reset.map(|r| format!("resets at {r}")),
+            RateLimited | IndexRollback | FileChanged | Cancelled => None,
+            ArchiveInvalid(p) => Some(p.to_string()),
+            Sha256Mismatch { expected, actual } => {
+                Some(format!("expected {expected}, got {actual}"))
+            }
+            DownloadNotFound(d)
+            | TooLarge(d)
+            | IndexSignatureInvalid(d)
+            | IndexInvalid(d)
+            | AbiUnavailable(d)
+            | NotInCatalog(d)
+            | Incompatible(d)
+            | NotForPlatform(d)
+            | Revoked(d)
+            | NotInstalled(d)
+            | StoreMissing(d)
+            | Blocked(d)
+            | SourceInvalid(d)
+            | SourceNotFound(d)
+            | SourcesDamaged(d)
+            | InvalidName(d)
+            | IdReserved(d)
+            | VersionNotInstalled(d)
+            | GameRunning(d)
+            | ChangedMeanwhile(d)
+            | IconInvalid(d) => Some(d),
+            // The rule first, which the page says in words (src/i18n/errors.ts `urlRule`).
+            UrlRefused { url, why } => Some(format!("{} {url}", why.rule())),
+            LockInvalid(d) => Some(format!("mods.lock.json: {d}")),
+        };
+        AppError::new(code, detail)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use reqwest::StatusCode;
+
+    #[test]
+    fn an_answer_with_an_error_status_is_not_offline() {
+        let http = |status| {
+            ModsError::Http {
+                status,
+                url: "https://weft-rust.github.io/weft-mods-index/v1/index.json".into(),
+            }
+            .code()
+        };
+        assert_eq!(http(404), ErrorCode::HttpStatus);
+        assert_eq!(http(403), ErrorCode::HttpStatus);
+        assert_eq!(http(500), ErrorCode::HttpStatus);
+        assert_eq!(http(503), ErrorCode::Network);
+    }
+
+    #[test]
+    fn a_refused_url_says_the_rule_first() {
+        use crate::mods::index::UrlProblem;
+        let e = AppError::from(ModsError::UrlRefused {
+            url: "http://github.com/a/b/releases/download/t/x.zip".into(),
+            why: UrlProblem::NotHttps,
+        });
+        assert_eq!(e.code, ErrorCode::ModUrlRefused);
+        assert_eq!(
+            e.detail.as_deref(),
+            Some("notHttps http://github.com/a/b/releases/download/t/x.zip")
+        );
+    }
+
+    #[test]
+    fn a_rate_limit_says_when_it_ends() {
+        let detail = |reset| AppError::from(ModsError::SourceRateLimited { reset }).detail;
+        assert_eq!(
+            detail(Some(1_793_000_000)).as_deref(),
+            Some("resets at 1793000000")
+        );
+        assert_eq!(detail(None), None);
+    }
+
+    #[test]
+    fn an_error_status_is_said_first_in_the_detail() {
+        // The page reads the status from here (src/mods/select.ts `httpStatus`): keep it first.
+        let e = AppError::from(ModsError::Http {
+            status: 404,
+            url: "https://weft-rust.github.io/weft-mods-index/v1/index.json".into(),
+        });
+        assert_eq!(
+            e.detail.as_deref(),
+            Some("HTTP 404 (https://weft-rust.github.io/weft-mods-index/v1/index.json)")
+        );
+    }
+
+    #[test]
+    fn download_failures_keep_their_meaning() {
+        let url = "https://github.com/a/b/releases/download/t/x.zip";
+        let code = |e: DownloadError| AppError::from(ModsError::from_download(e, url)).code;
+        assert_eq!(
+            code(DownloadError::Status(StatusCode::NOT_FOUND)),
+            ErrorCode::ModDownloadNotFound
+        );
+        assert_eq!(
+            code(DownloadError::Status(StatusCode::GONE)),
+            ErrorCode::ModDownloadNotFound
+        );
+        assert_eq!(
+            code(DownloadError::Status(StatusCode::TOO_MANY_REQUESTS)),
+            ErrorCode::RateLimited
+        );
+        assert_eq!(
+            code(DownloadError::Status(StatusCode::BAD_GATEWAY)),
+            ErrorCode::Network
+        );
+        assert_eq!(
+            code(DownloadError::Status(StatusCode::INTERNAL_SERVER_ERROR)),
+            ErrorCode::HttpStatus
+        );
+        assert_eq!(code(DownloadError::TooLarge(10)), ErrorCode::ModTooLarge);
+        assert_eq!(
+            code(DownloadError::Io(std::io::ErrorKind::StorageFull.into())),
+            ErrorCode::DiskFull
+        );
+    }
+}
diff --git a/src-tauri/src/mods/index/cache.rs b/src-tauri/src/mods/index/cache.rs
new file mode 100644
index 0000000..0ca4a44
--- /dev/null
+++ b/src-tauri/src/mods/index/cache.rs
@@ -0,0 +1,553 @@
+//! The verified index on disk, and how far it can be trusted: how old it is, and whether a
+//! fetched one may replace it.
+//!
+//! - `cache/mod-index/<n>/` holds verified generations (index plus signature), checked again on
+//!   every read, so the catalogue works offline.
+//! - `cache/mod-index.state.json` holds the newest (`generated`, `signedAt`) pair ever accepted.
+//!   It is a separate file so that deleting the cached index doesn't reset rollback protection.
+
+use serde::{Deserialize, Serialize};
+use std::path::{Path, PathBuf};
+use time::format_description::well_known::Rfc3339;
+use time::{Duration, OffsetDateTime};
+use ts_rs::TS;
+
+use super::super::error::ModsError;
+use super::super::paths::{unique_suffix, write_atomic};
+use super::format::{Index, generated_at};
+use super::signature::{Signed, verify};
+
+#[derive(Debug, Clone, Copy, Serialize, PartialEq, Eq, TS)]
+#[serde(rename_all = "lowercase")]
+pub enum Freshness {
+    /// Fetched and verified just now.
+    Fresh,
+    /// Verified, but signed more than [`STALE_AFTER`] ago: revocations since then may be missing.
+    /// The entries are still used.
+    Stale,
+    /// The last good copy: not refreshed, or the refresh failed (then an error says why).
+    Cached,
+    /// Nothing usable yet.
+    Unavailable,
+}
+
+/// An index signed longer ago than this is `stale`. The index repository re-signs weekly.
+pub const STALE_AFTER: Duration = Duration::days(30);
+
+/// How far ahead of this computer's clock an index may be dated. Further than that, it would
+/// lock out every honest index until that date, so it is refused.
+pub const FUTURE_SLACK: Duration = Duration::days(1);
+
+pub struct IndexState {
+    pub index: Option<Index>,
+    pub signed_at: Option<OffsetDateTime>,
+    pub freshness: Freshness,
+    pub error: Option<ModsError>,
+    /// The index was fetched and is in use, but couldn't be saved: it is fetched again at the
+    /// next start, and offline until then the older saved copy (if any) is what shows.
+    pub cache_error: Option<ModsError>,
+}
+
+/// How new an index is: `generated`, then the signing time. A re-signed index with the same
+/// `generated` is newer; an index without a signing time is older than the same one with it.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+pub struct Age {
+    pub generated: OffsetDateTime,
+    pub signed_at: Option<OffsetDateTime>,
+}
+
+impl Age {
+    pub fn of(signed: &Signed) -> Option<Age> {
+        Some(Age {
+            generated: generated_at(&signed.index)?,
+            signed_at: signed.signed_at,
+        })
+    }
+
+    /// The time the age is judged by: when it was signed, or else when it was generated.
+    fn reference(&self) -> OffsetDateTime {
+        self.signed_at.unwrap_or(self.generated)
+    }
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct StateFile {
+    generated: String,
+    #[serde(default)]
+    signed_at: Option<String>,
+}
+
+fn rfc3339(t: OffsetDateTime) -> String {
+    t.format(&Rfc3339).unwrap_or_default()
+}
+
+fn parse_time(s: &str) -> Option<OffsetDateTime> {
+    OffsetDateTime::parse(s, &Rfc3339).ok()
+}
+
+/// Verified index generations: `<dir>/<n>/index.json` and `index.json.minisig` are written as
+/// one directory and renamed into place together, then `<dir>/current` names the new one. A crash
+/// at any point leaves a complete pair behind: reading tries `current`, then every other
+/// generation from the newest, then the single pair older launchers wrote.
+pub struct IndexCache {
+    dir: PathBuf,
+    legacy: PathBuf,
+    state: PathBuf,
+    pub(super) key: String,
+}
+
+const KEEP_GENERATIONS: usize = 2;
+
+/// Held while a generation is chosen, written and the old ones pruned.
+static WRITING: std::sync::Mutex<()> = std::sync::Mutex::new(());
+
+impl IndexCache {
+    /// `cache_dir` is the launcher's `cache/` folder.
+    pub fn new(cache_dir: &Path, key: String) -> Self {
+        IndexCache {
+            dir: cache_dir.join("mod-index"),
+            legacy: cache_dir.join("mod-index.json"),
+            state: cache_dir.join("mod-index.state.json"),
+            key,
+        }
+    }
+
+    pub(super) fn generations(&self) -> Vec<u64> {
+        let mut out: Vec<u64> = std::fs::read_dir(&self.dir)
+            .into_iter()
+            .flatten()
+            .flatten()
+            .filter_map(|e| e.file_name().to_str()?.parse().ok())
+            .collect();
+        out.sort_unstable_by(|a, b| b.cmp(a));
+        out
+    }
+
+    fn current(&self) -> Option<u64> {
+        std::fs::read_to_string(self.dir.join("current"))
+            .ok()?
+            .trim()
+            .parse()
+            .ok()
+    }
+
+    fn read_pair(&self, json: &Path) -> Option<Signed> {
+        let bytes = std::fs::read(json).ok()?;
+        let sig = std::fs::read_to_string(json.with_extension("json.minisig")).ok()?;
+        // Checked again: the cache is only a file on disk.
+        verify(&bytes, &sig, &self.key).ok()
+    }
+
+    /// The newest generation that still verifies, and its number (0 for the old single pair).
+    pub fn read(&self) -> Option<(u64, Signed)> {
+        let mut order: Vec<u64> = self.current().into_iter().collect();
+        order.extend(self.generations());
+        order.dedup();
+        for generation in order {
+            let json = self.dir.join(generation.to_string()).join("index.json");
+            if let Some(signed) = self.read_pair(&json) {
+                return Some((generation, signed));
+            }
+        }
+        self.read_pair(&self.legacy).map(|s| (0, s))
+    }
+
+    /// Stores a verified pair as a new generation and drops all but the newest few.
+    ///
+    /// Choosing the generation number, writing it and pruning are one step under one lock: two
+    /// refreshes at once never pick the same number, and neither takes the other's staging
+    /// folder for crash debris. (One launcher runs at a time: the single-instance plugin.)
+    pub fn write(&self, bytes: &[u8], signature: &str) -> Result<u64, ModsError> {
+        let _held = WRITING.lock().unwrap_or_else(|e| e.into_inner());
+        self.write_locked(bytes, signature)
+    }
+
+    /// As [`IndexCache::write`], unless the generation in use is already newer than `age`: a
+    /// refresh that fetched an older index and finished last doesn't replace a newer one.
+    /// `None` when nothing was written.
+    pub fn write_if_newer(
+        &self,
+        bytes: &[u8],
+        signature: &str,
+        age: Age,
+    ) -> Result<Option<u64>, ModsError> {
+        let _held = WRITING.lock().unwrap_or_else(|e| e.into_inner());
+        if self
+            .read()
+            .and_then(|(_, s)| Age::of(&s))
+            .is_some_and(|held| held > age)
+        {
+            return Ok(None);
+        }
+        self.write_locked(bytes, signature).map(Some)
+    }
+
+    fn write_locked(&self, bytes: &[u8], signature: &str) -> Result<u64, ModsError> {
+        std::fs::create_dir_all(&self.dir)?;
+        let next = self.generations().first().map_or(1, |n| n + 1);
+        let staging = self.dir.join(format!(".{next}.{}.tmp", unique_suffix()));
+        let result = (|| {
+            std::fs::create_dir_all(&staging)?;
+            write_atomic(&staging.join("index.json"), bytes)?;
+            write_atomic(&staging.join("index.json.minisig"), signature.as_bytes())?;
+            std::fs::rename(&staging, self.dir.join(next.to_string()))?;
+            write_atomic(&self.dir.join("current"), next.to_string().as_bytes())
+        })();
+        if result.is_err() {
+            let _ = std::fs::remove_dir_all(&staging);
+        }
+        result?;
+        for old in self.generations().into_iter().skip(KEEP_GENERATIONS) {
+            let _ = std::fs::remove_dir_all(self.dir.join(old.to_string()));
+        }
+        // Staging folders a crash left behind.
+        for entry in std::fs::read_dir(&self.dir).into_iter().flatten().flatten() {
+            let name = entry.file_name().to_string_lossy().to_string();
+            if name.starts_with('.') && name.ends_with(".tmp") && entry.path().is_dir() {
+                let _ = std::fs::remove_dir_all(entry.path());
+            }
+        }
+        Ok(next)
+    }
+
+    /// The newest age ever accepted, from the state file.
+    pub fn highest(&self) -> Option<Age> {
+        let bytes = std::fs::read(&self.state).ok()?;
+        let file: StateFile = serde_json::from_slice(&bytes).ok()?;
+        Some(Age {
+            generated: parse_time(&file.generated)?,
+            signed_at: file.signed_at.as_deref().and_then(parse_time),
+        })
+    }
+
+    /// Records `age` as accepted, unless a newer one already is. Two refreshes at once can't
+    /// lower the floor: the read and the write happen under one lock.
+    pub fn raise(&self, age: Age) -> Result<(), ModsError> {
+        static RAISING: std::sync::Mutex<()> = std::sync::Mutex::new(());
+        let _held = RAISING.lock().unwrap_or_else(|e| e.into_inner());
+        if self.highest().is_some_and(|h| h >= age) {
+            return Ok(());
+        }
+        let file = StateFile {
+            generated: rfc3339(age.generated),
+            signed_at: age.signed_at.map(rfc3339),
+        };
+        write_atomic(&self.state, &serde_json::to_vec_pretty(&file)?)
+    }
+}
+
+/// The state of an index the launcher may use: `stale` when it is old and nothing went wrong.
+fn usable(
+    signed: Signed,
+    freshness: Freshness,
+    error: Option<ModsError>,
+    now: OffsetDateTime,
+) -> IndexState {
+    let old = Age::of(&signed).is_some_and(|a| now - a.reference() > STALE_AFTER);
+    let freshness = match freshness {
+        Freshness::Fresh | Freshness::Cached if old && error.is_none() => Freshness::Stale,
+        f => f,
+    };
+    IndexState {
+        signed_at: signed.signed_at,
+        index: Some(signed.index),
+        freshness,
+        error,
+        cache_error: None,
+    }
+}
+
+/// The cached copy, or nothing, with the reason the newer one wasn't used.
+fn fallback(cached: Option<Signed>, error: Option<ModsError>, now: OffsetDateTime) -> IndexState {
+    match cached {
+        Some(signed) => usable(signed, Freshness::Cached, error, now),
+        None => IndexState {
+            index: None,
+            signed_at: None,
+            freshness: Freshness::Unavailable,
+            error,
+            cache_error: None,
+        },
+    }
+}
+
+/// The cached copy as it is, without asking for a newer one.
+pub fn from_cache(cached: Option<Signed>, now: OffsetDateTime) -> IndexState {
+    fallback(cached, None, now)
+}
+
+/// What to do with a freshly fetched index, given the verified copy held and the newest age
+/// ever accepted. An index older than either is refused: someone serving an old index must not
+/// bring back a revoked mod, even after the cache was deleted. So is one dated in the future.
+pub fn decide(
+    cached: Option<Signed>,
+    fetched: Result<Signed, ModsError>,
+    highest: Option<Age>,
+    now: OffsetDateTime,
+) -> (IndexState, bool /* store the fetched one */) {
+    let floor = highest.max(cached.as_ref().and_then(Age::of));
+    let new = match fetched {
+        Err(error) => return (fallback(cached, Some(error), now), false),
+        Ok(new) => new,
+    };
+    let Some(age) = Age::of(&new) else {
+        let error = ModsError::IndexInvalid("no generated time".into());
+        return (fallback(cached, Some(error), now), false);
+    };
+    if age.generated > now + FUTURE_SLACK || age.signed_at.is_some_and(|s| s > now + FUTURE_SLACK) {
+        let error = ModsError::IndexInvalid("dated in the future".into());
+        return (fallback(cached, Some(error), now), false);
+    }
+    if floor.is_some_and(|f| age < f) {
+        return (fallback(cached, Some(ModsError::IndexRollback), now), false);
+    }
+    (usable(new, Freshness::Fresh, None, now), true)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::super::signature::tests::{
+        FIXTURE, FIXTURE_KEY, FIXTURE_RESIGNED_SIG, FIXTURE_SIG, OLDER, OLDER_SIG, at,
+    };
+    use super::*;
+
+    fn signed(bytes: &[u8], sig: &str) -> Signed {
+        verify(bytes, sig, FIXTURE_KEY).unwrap()
+    }
+
+    fn index_at(generated: &str, signed_at: Option<&str>) -> Signed {
+        Signed {
+            index: Index {
+                schema: 1,
+                generated: generated.into(),
+                weft: vec![],
+                mods: vec![],
+                revoked: vec![],
+            },
+            signed_at: signed_at.map(at),
+        }
+    }
+
+    const NOW: &str = "2026-11-05T00:00:00Z";
+
+    #[test]
+    fn an_older_index_is_refused() {
+        let now = at(NOW);
+        let held = || Some(index_at("2026-11-04T18:00:00Z", None));
+        let (state, store) = decide(
+            held(),
+            Ok(index_at("2026-11-01T00:00:00Z", None)),
+            None,
+            now,
+        );
+        assert!(!store);
+        assert_eq!(state.freshness, Freshness::Cached);
+        assert!(matches!(state.error, Some(ModsError::IndexRollback)));
+        assert_eq!(state.index.unwrap().generated, "2026-11-04T18:00:00Z");
+
+        let (state, store) = decide(
+            held(),
+            Ok(index_at("2026-11-04T20:00:00Z", None)),
+            None,
+            now,
+        );
+        assert!(store);
+        assert_eq!(state.freshness, Freshness::Fresh);
+        assert!(state.error.is_none());
+
+        let (state, store) = decide(held(), Err(ModsError::IndexInvalid("x".into())), None, now);
+        assert!(!store);
+        assert_eq!(state.freshness, Freshness::Cached);
+        assert!(state.index.is_some() && state.error.is_some());
+
+        let (state, _) = decide(None, Err(ModsError::IndexInvalid("x".into())), None, now);
+        assert_eq!(state.freshness, Freshness::Unavailable);
+    }
+
+    /// The pair decides: the same `generated` signed later is newer, signed earlier is older.
+    #[test]
+    fn the_signing_time_breaks_ties() {
+        let now = at(NOW);
+        let highest = Age::of(&index_at(
+            "2026-11-04T18:00:00Z",
+            Some("2026-11-04T18:05:00Z"),
+        ));
+        let same_later = index_at("2026-11-04T18:00:00Z", Some("2026-11-04T19:00:00Z"));
+        let same_earlier = index_at("2026-11-04T18:00:00Z", Some("2026-11-04T18:01:00Z"));
+        let same_unsigned = index_at("2026-11-04T18:00:00Z", None);
+        let same_exact = index_at("2026-11-04T18:00:00Z", Some("2026-11-04T18:05:00Z"));
+        assert!(decide(None, Ok(same_later), highest, now).1);
+        assert!(
+            decide(None, Ok(same_exact), highest, now).1,
+            "fetching the same index again"
+        );
+        for older in [same_earlier, same_unsigned] {
+            let (state, store) = decide(None, Ok(older), highest, now);
+            assert!(!store);
+            assert!(matches!(state.error, Some(ModsError::IndexRollback)));
+            assert_eq!(state.freshness, Freshness::Unavailable);
+        }
+    }
+
+    #[test]
+    fn an_index_from_the_future_is_refused() {
+        let now = at(NOW);
+        for (generated, signed_at) in [
+            ("2027-01-01T00:00:00Z", None),
+            ("2026-11-04T00:00:00Z", Some("2027-01-01T00:00:00Z")),
+        ] {
+            let (state, store) = decide(None, Ok(index_at(generated, signed_at)), None, now);
+            assert!(!store, "{generated}");
+            assert!(matches!(state.error, Some(ModsError::IndexInvalid(_))));
+        }
+        // A few hours ahead is only a clock that is off.
+        let (_, store) = decide(None, Ok(index_at("2026-11-05T06:00:00Z", None)), None, now);
+        assert!(store);
+    }
+
+    #[test]
+    fn an_old_signature_makes_it_stale() {
+        let fetched = || {
+            Ok(index_at(
+                "2026-09-01T00:00:00Z",
+                Some("2026-09-01T00:00:00Z"),
+            ))
+        };
+        let (state, store) = decide(None, fetched(), None, at(NOW));
+        assert!(store, "a stale index is still used");
+        assert_eq!(state.freshness, Freshness::Stale);
+        assert!(state.index.is_some() && state.error.is_none());
+        assert_eq!(state.signed_at, Some(at("2026-09-01T00:00:00Z")));
+
+        let (state, _) = decide(None, fetched(), None, at("2026-09-20T00:00:00Z"));
+        assert_eq!(state.freshness, Freshness::Fresh);
+
+        // Without a signing time, `generated` is what counts.
+        let (state, _) = decide(
+            None,
+            Ok(index_at("2026-09-01T00:00:00Z", None)),
+            None,
+            at(NOW),
+        );
+        assert_eq!(state.freshness, Freshness::Stale);
+
+        // A cached copy read without refreshing is stale too; one shown because the refresh
+        // failed stays `cached`, with the error.
+        let old = || Some(index_at("2026-09-01T00:00:00Z", None));
+        assert_eq!(from_cache(old(), at(NOW)).freshness, Freshness::Stale);
+        let (state, _) = decide(old(), Err(ModsError::IndexRollback), None, at(NOW));
+        assert_eq!(state.freshness, Freshness::Cached);
+    }
+
+    fn cache(dir: &Path) -> IndexCache {
+        IndexCache::new(dir, FIXTURE_KEY.to_string())
+    }
+
+    /// Many refreshes storing at once: each gets its own generation, every write succeeds, the
+    /// generation in use verifies, the newest few are kept and no staging folder is left.
+    #[test]
+    fn concurrent_writers_keep_complete_generations() {
+        let tmp = tempfile::tempdir().unwrap();
+        let dir = tmp.path().to_path_buf();
+        let handles: Vec<_> = (0..12)
+            .map(|_| {
+                let dir = dir.clone();
+                std::thread::spawn(move || cache(&dir).write(FIXTURE, FIXTURE_SIG))
+            })
+            .collect();
+        let mut numbers: Vec<u64> = handles
+            .into_iter()
+            .map(|h| h.join().unwrap().unwrap())
+            .collect();
+        numbers.sort_unstable();
+        assert_eq!(numbers, (1..=12).collect::<Vec<_>>(), "one generation each");
+        let c = cache(&dir);
+        assert_eq!(c.read().unwrap().0, 12);
+        assert_eq!(c.generations(), [12, 11]);
+        let leftovers: Vec<_> = std::fs::read_dir(dir.join("mod-index"))
+            .unwrap()
+            .flatten()
+            .filter(|e| e.file_name().to_string_lossy().ends_with(".tmp"))
+            .collect();
+        assert!(leftovers.is_empty(), "no staging folder left behind");
+    }
+
+    #[test]
+    fn an_older_index_finishing_last_does_not_replace_a_newer_one() {
+        use super::super::signature::tests::{OLDER, OLDER_SIG};
+        let tmp = tempfile::tempdir().unwrap();
+        let c = cache(tmp.path());
+        let newer = Age::of(&verify(FIXTURE, FIXTURE_SIG, FIXTURE_KEY).unwrap()).unwrap();
+        let older = Age::of(&verify(OLDER, OLDER_SIG, FIXTURE_KEY).unwrap()).unwrap();
+        assert!(older < newer);
+        assert_eq!(
+            c.write_if_newer(FIXTURE, FIXTURE_SIG, newer).unwrap(),
+            Some(1)
+        );
+        assert_eq!(c.write_if_newer(OLDER, OLDER_SIG, older).unwrap(), None);
+        assert_eq!(c.read().unwrap().0, 1);
+        assert_eq!(
+            c.write_if_newer(FIXTURE, FIXTURE_SIG, newer).unwrap(),
+            Some(2),
+            "the same age again is stored"
+        );
+    }
+
+    #[test]
+    fn the_cache_falls_back_to_the_previous_generation() {
+        let tmp = tempfile::tempdir().unwrap();
+        let c = cache(tmp.path());
+        assert!(c.read().is_none());
+        assert_eq!(c.write(FIXTURE, FIXTURE_SIG).unwrap(), 1);
+        assert_eq!(c.write(FIXTURE, FIXTURE_SIG).unwrap(), 2);
+        assert_eq!(c.read().unwrap().0, 2);
+
+        // The newest pair no longer verifies: the one before it is used.
+        let newest = tmp.path().join("mod-index").join("2").join("index.json");
+        let mut bytes = std::fs::read(&newest).unwrap();
+        bytes[10] ^= 1;
+        std::fs::write(&newest, bytes).unwrap();
+        assert_eq!(c.read().unwrap().0, 1);
+
+        // A crash half way through a write: a third generation without its signature, and
+        // `current` pointing at it.
+        let third = tmp.path().join("mod-index").join("3");
+        std::fs::create_dir_all(&third).unwrap();
+        std::fs::write(third.join("index.json"), FIXTURE).unwrap();
+        std::fs::write(tmp.path().join("mod-index").join("current"), "3").unwrap();
+        assert_eq!(c.read().unwrap().0, 1);
+
+        // Only the newest few are kept.
+        c.write(FIXTURE, FIXTURE_SIG).unwrap();
+        assert_eq!(c.generations(), [4, 3]);
+        assert_eq!(c.read().unwrap().0, 4);
+    }
+
+    #[test]
+    fn the_cache_reads_the_pair_older_launchers_wrote() {
+        let tmp = tempfile::tempdir().unwrap();
+        std::fs::write(tmp.path().join("mod-index.json"), FIXTURE).unwrap();
+        std::fs::write(tmp.path().join("mod-index.json.minisig"), FIXTURE_SIG).unwrap();
+        assert_eq!(cache(tmp.path()).read().unwrap().0, 0);
+        std::fs::write(tmp.path().join("mod-index.json.minisig"), "junk").unwrap();
+        assert!(cache(tmp.path()).read().is_none());
+    }
+
+    #[test]
+    fn the_state_file_only_moves_forward() {
+        let tmp = tempfile::tempdir().unwrap();
+        let c = cache(tmp.path());
+        assert!(c.highest().is_none());
+        let newer = Age::of(&signed(FIXTURE, FIXTURE_SIG)).unwrap();
+        let older = Age::of(&signed(OLDER, OLDER_SIG)).unwrap();
+        let resigned = Age::of(&signed(FIXTURE, FIXTURE_RESIGNED_SIG)).unwrap();
+        assert!(older < newer && newer < resigned);
+        c.raise(newer).unwrap();
+        c.raise(older).unwrap();
+        assert_eq!(c.highest(), Some(newer));
+        c.raise(resigned).unwrap();
+        assert_eq!(c.highest(), Some(resigned));
+        assert!(tmp.path().join("mod-index.state.json").exists());
+    }
+}
diff --git a/src-tauri/src/mods/index/fetch.rs b/src-tauri/src/mods/index/fetch.rs
new file mode 100644
index 0000000..a4b8399
--- /dev/null
+++ b/src-tauri/src/mods/index/fetch.rs
@@ -0,0 +1,216 @@
+//! Getting the index: from GitHub Pages when asked to refresh, else from the cache.
+
+use std::time::Duration;
+use time::OffsetDateTime;
+
+use super::super::error::ModsError;
+use super::cache::{Age, IndexCache, IndexState, decide, from_cache};
+use super::signature::verify;
+
+pub const INDEX_URL: &str = "https://weft-rust.github.io/weft-mods-index/v1/index.json";
+
+pub const MAX_INDEX_BYTES: usize = 8 * 1024 * 1024;
+
+pub fn index_url() -> String {
+    #[cfg(debug_assertions)]
+    if let Ok(url) = std::env::var("WEFT_MOD_INDEX_URL") {
+        return url;
+    }
+    INDEX_URL.to_string()
+}
+
+pub async fn fetch_bytes(client: &reqwest::Client, url: &str) -> Result<Vec<u8>, ModsError> {
+    let response = client
+        .get(url)
+        .timeout(Duration::from_secs(15))
+        .send()
+        .await?;
+    let status = response.status().as_u16();
+    if status != 200 {
+        return Err(ModsError::Http {
+            status,
+            url: url.to_string(),
+        });
+    }
+    crate::download::read_capped(response, MAX_INDEX_BYTES)
+        .await?
+        .ok_or_else(|| ModsError::IndexInvalid("too large".into()))
+}
+
+fn remember(cache: &IndexCache, age: Option<Age>) {
+    if let Some(age) = age
+        && let Err(e) = cache.raise(age)
+    {
+        eprintln!("mod index: could not record its age: {e}");
+    }
+}
+
+/// The cached index, without asking for a newer one.
+pub fn cached(cache: &IndexCache, now: OffsetDateTime) -> IndexState {
+    let cached = cache.read().map(|(_, s)| s);
+    // A cache written before the state file existed still counts as accepted.
+    remember(cache, cached.as_ref().and_then(Age::of));
+    from_cache(cached, now)
+}
+
+/// The newest index this launcher can trust. With `refresh` false only the cache is read, and
+/// nothing touches the network. `fetch` returns the index bytes and their signature.
+pub async fn load<F>(cache: &IndexCache, refresh: bool, now: OffsetDateTime, fetch: F) -> IndexState
+where
+    F: std::future::Future<Output = Result<(Vec<u8>, String), ModsError>>,
+{
+    if !refresh {
+        return cached(cache, now);
+    }
+    let cached = cache.read().map(|(_, s)| s);
+    remember(cache, cached.as_ref().and_then(Age::of));
+    let fetched = fetch.await.and_then(|(bytes, sig)| {
+        let signed = verify(&bytes, &sig, &cache.key)?;
+        Ok((bytes, sig, signed))
+    });
+    let (raw, fetched) = match fetched {
+        Ok((bytes, sig, signed)) => (Some((bytes, sig)), Ok(signed)),
+        Err(e) => (None, Err(e)),
+    };
+    let new_age = fetched.as_ref().ok().and_then(Age::of);
+    let (mut state, store) = decide(cached, fetched, cache.highest(), now);
+    if store
+        && let Some((bytes, sig)) = raw
+        && let Some(age) = new_age
+    {
+        // In use either way; a failure to save it is said with the status, not only logged.
+        if let Err(e) = cache.write_if_newer(&bytes, &sig, age) {
+            eprintln!("mod index: could not cache: {e}");
+            state.cache_error = Some(e);
+        }
+        remember(cache, new_age);
+    }
+    state
+}
+
+#[cfg(test)]
+mod tests {
+    use super::super::cache::Freshness;
+    use super::super::signature::tests::{
+        FIXTURE, FIXTURE_KEY, FIXTURE_RESIGNED_SIG, FIXTURE_SIG, OLDER, OLDER_SIG, at,
+    };
+    use super::*;
+    use std::path::Path;
+
+    fn run<F: std::future::Future>(fut: F) -> F::Output {
+        tokio::runtime::Builder::new_current_thread()
+            .build()
+            .unwrap()
+            .block_on(fut)
+    }
+
+    fn cache(dir: &Path) -> IndexCache {
+        IndexCache::new(dir, FIXTURE_KEY.to_string())
+    }
+
+    const NOW: &str = "2026-11-05T00:00:00Z";
+
+    fn serve(
+        bytes: &[u8],
+        sig: &str,
+    ) -> impl Future<Output = Result<(Vec<u8>, String), ModsError>> {
+        let answer = (bytes.to_vec(), sig.to_string());
+        async move { Ok(answer) }
+    }
+
+    #[test]
+    fn load_keeps_the_cache_when_refresh_fails() {
+        let tmp = tempfile::tempdir().unwrap();
+        let c = cache(tmp.path());
+        c.write(FIXTURE, FIXTURE_SIG).unwrap();
+        let state = run(load(&c, true, at(NOW), serve(FIXTURE, "bad signature")));
+        assert_eq!(state.freshness, Freshness::Cached);
+        assert!(matches!(
+            state.error,
+            Some(ModsError::IndexSignatureInvalid(_))
+        ));
+        assert!(state.index.is_some());
+        assert_eq!(c.generations(), [1], "nothing new was stored");
+
+        let state = run(load(&c, true, at(NOW), serve(FIXTURE, FIXTURE_SIG)));
+        assert_eq!(state.freshness, Freshness::Fresh);
+        assert_eq!(state.signed_at, Some(at("2026-11-04T18:05:00Z")));
+        assert_eq!(c.generations(), [2, 1]);
+    }
+
+    #[test]
+    fn without_refresh_nothing_is_fetched() {
+        let tmp = tempfile::tempdir().unwrap();
+        let c = cache(tmp.path());
+        type Fetch = std::pin::Pin<Box<dyn Future<Output = Result<(Vec<u8>, String), ModsError>>>>;
+        let never: Fetch = Box::pin(async { panic!("fetched without being asked to") });
+        let state = run(load(&c, false, at(NOW), never));
+        assert_eq!(state.freshness, Freshness::Unavailable);
+        assert!(state.error.is_none());
+    }
+
+    /// Deleting the cached index doesn't reset rollback protection: the state file remembers.
+    #[test]
+    fn rollback_protection_survives_a_deleted_cache() {
+        let tmp = tempfile::tempdir().unwrap();
+        let c = cache(tmp.path());
+        let state = run(load(&c, true, at(NOW), serve(FIXTURE, FIXTURE_SIG)));
+        assert_eq!(state.freshness, Freshness::Fresh);
+
+        std::fs::remove_dir_all(tmp.path().join("mod-index")).unwrap();
+        let state = run(load(&c, true, at(NOW), serve(OLDER, OLDER_SIG)));
+        assert_eq!(state.freshness, Freshness::Unavailable);
+        assert!(matches!(state.error, Some(ModsError::IndexRollback)));
+        assert!(c.read().is_none(), "the older index was not stored");
+
+        // The newer one, and the same one signed again, still are.
+        let state = run(load(&c, true, at(NOW), serve(FIXTURE, FIXTURE_SIG)));
+        assert_eq!(state.freshness, Freshness::Fresh);
+        let state = run(load(
+            &c,
+            true,
+            at("2026-11-12T00:00:00Z"),
+            serve(FIXTURE, FIXTURE_RESIGNED_SIG),
+        ));
+        assert_eq!(state.freshness, Freshness::Fresh);
+        assert_eq!(state.signed_at, Some(at("2026-11-11T18:00:00Z")));
+
+        // Now the first signature of those bytes is the older one.
+        std::fs::remove_dir_all(tmp.path().join("mod-index")).unwrap();
+        let state = run(load(&c, true, at(NOW), serve(FIXTURE, FIXTURE_SIG)));
+        assert!(matches!(state.error, Some(ModsError::IndexRollback)));
+    }
+
+    /// A cache from before the state file existed sets the floor the first time it is read.
+    #[test]
+    fn an_existing_cache_sets_the_floor() {
+        let tmp = tempfile::tempdir().unwrap();
+        let c = cache(tmp.path());
+        c.write(FIXTURE, FIXTURE_SIG).unwrap();
+        assert!(c.highest().is_none());
+        let state = run(load(&c, false, at(NOW), serve(OLDER, OLDER_SIG)));
+        assert_eq!(state.freshness, Freshness::Cached);
+        assert!(c.highest().is_some());
+        std::fs::remove_dir_all(tmp.path().join("mod-index")).unwrap();
+        let state = run(load(&c, true, at(NOW), serve(OLDER, OLDER_SIG)));
+        assert!(matches!(state.error, Some(ModsError::IndexRollback)));
+    }
+
+    #[test]
+    fn an_old_cache_is_stale_and_still_used() {
+        let tmp = tempfile::tempdir().unwrap();
+        let c = cache(tmp.path());
+        c.write(FIXTURE, FIXTURE_SIG).unwrap();
+        let later = at("2026-12-10T00:00:00Z");
+        let state = run(load(&c, false, later, serve(FIXTURE, FIXTURE_SIG)));
+        assert_eq!(state.freshness, Freshness::Stale);
+        assert!(state.index.is_some());
+        let state = run(load(&c, true, later, serve(FIXTURE, FIXTURE_SIG)));
+        assert_eq!(
+            state.freshness,
+            Freshness::Stale,
+            "fetched, but signed long ago"
+        );
+        assert!(state.error.is_none());
+    }
+}
diff --git a/src-tauri/src/mods/index/format.rs b/src-tauri/src/mods/index/format.rs
new file mode 100644
index 0000000..abd85c0
--- /dev/null
+++ b/src-tauri/src/mods/index/format.rs
@@ -0,0 +1,937 @@
+//! The format of `index.json` and the rules every entry must follow, as described in
+//! `docs/mod-manager/INDEX_FORMAT.md`. Nothing here checks a signature or touches the disk.
+
+use serde::de::DeserializeOwned;
+use serde::{Deserialize, Deserializer, Serialize};
+use time::OffsetDateTime;
+use time::format_description::well_known::Rfc3339;
+use ts_rs::TS;
+
+use super::super::abi::{is_abi, is_safe_ref};
+use super::super::error::ModsError;
+
+/// Reads a list one entry at a time and leaves out the entries that don't parse, so one bad
+/// entry (an unknown channel, a missing field) never hides the rest.
+fn lenient<'de, D, T>(d: D) -> Result<Vec<T>, D::Error>
+where
+    D: Deserializer<'de>,
+    T: DeserializeOwned,
+{
+    let raw = Vec::<serde_json::Value>::deserialize(d)?;
+    Ok(raw
+        .into_iter()
+        .filter_map(|v| match serde_json::from_value(v) {
+            Ok(t) => Some(t),
+            Err(e) => {
+                eprintln!("mod index: skipping an entry: {e}");
+                None
+            }
+        })
+        .collect())
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Index {
+    pub schema: u32,
+    pub generated: String,
+    #[serde(default, deserialize_with = "lenient")]
+    pub weft: Vec<WeftAbi>,
+    #[serde(default, deserialize_with = "lenient")]
+    pub mods: Vec<IndexMod>,
+    #[serde(default, deserialize_with = "revocations")]
+    pub revoked: Vec<Revoked>,
+}
+
+/// Reads `revoked[]` failing closed: an entry is dropped only when its hash can't be a SHA-256
+/// at all (and that is logged). The hash is lowercased; a missing, empty or odd `reason` is no
+/// reason (`None`: the page says so in the player's language) and an odd `at` unknown. A `revoked` that isn't a list refuses the whole index,
+/// so the last verified one stays in use.
+fn revocations<'de, D>(d: D) -> Result<Vec<Revoked>, D::Error>
+where
+    D: Deserializer<'de>,
+{
+    let raw = Vec::<serde_json::Value>::deserialize(d)?;
+    Ok(raw.into_iter().filter_map(revocation).collect())
+}
+
+/// One `revoked[]` entry, by the rules of [`revocations`].
+pub fn revocation(v: serde_json::Value) -> Option<Revoked> {
+    let text = |key: &str| {
+        v.get(key)
+            .and_then(|x| x.as_str())
+            .map(str::trim)
+            .filter(|x| !x.is_empty())
+            .map(str::to_string)
+    };
+    match text("sha256").map(|s| s.to_ascii_lowercase()) {
+        Some(sha256) if is_sha256(&sha256) => Some(Revoked {
+            sha256,
+            reason: text("reason"),
+            at: text("at"),
+        }),
+        _ => {
+            eprintln!("mod index: dropping a revocation without a SHA-256: {v}");
+            None
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, TS)]
+pub struct WeftAbi {
+    pub tag: String,
+    pub commit: String,
+    pub abi: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct IndexMod {
+    pub id: String,
+    pub name: String,
+    #[serde(default)]
+    pub summary: String,
+    #[serde(default)]
+    pub authors: Vec<String>,
+    #[serde(default)]
+    pub license: Option<String>,
+    #[serde(default)]
+    pub homepage: Option<String>,
+    #[serde(default)]
+    pub icon: Option<String>,
+    #[serde(default, deserialize_with = "lenient")]
+    pub versions: Vec<IndexVersion>,
+}
+
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq, TS)]
+#[serde(rename_all = "lowercase")]
+pub enum Channel {
+    Release,
+    Prerelease,
+    Experimental,
+}
+
+impl Channel {
+    /// How far from a release: a player on `release` never gets a prerelease.
+    pub fn rank(self) -> u8 {
+        match self {
+            Channel::Release => 0,
+            Channel::Prerelease => 1,
+            Channel::Experimental => 2,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq, PartialOrd, Ord, Hash, TS)]
+pub enum Platform {
+    #[serde(rename = "windows-x64")]
+    WindowsX64,
+    #[serde(rename = "linux-x64")]
+    LinuxX64,
+    #[serde(rename = "macos-arm64")]
+    MacosArm64,
+}
+
+impl Platform {
+    pub const ALL: [Platform; 3] = [
+        Platform::WindowsX64,
+        Platform::LinuxX64,
+        Platform::MacosArm64,
+    ];
+
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Platform::WindowsX64 => "windows-x64",
+            Platform::LinuxX64 => "linux-x64",
+            Platform::MacosArm64 => "macos-arm64",
+        }
+    }
+
+    /// `None` for a platform string this launcher doesn't know; such entries are ignored.
+    pub fn parse(s: &str) -> Option<Platform> {
+        Platform::ALL.into_iter().find(|p| p.as_str() == s)
+    }
+
+    /// The system this launcher runs on; `None` where the game isn't built.
+    pub fn current() -> Option<Platform> {
+        if cfg!(all(target_os = "windows", target_arch = "x86_64")) {
+            Some(Platform::WindowsX64)
+        } else if cfg!(all(target_os = "linux", target_arch = "x86_64")) {
+            Some(Platform::LinuxX64)
+        } else if cfg!(all(target_os = "macos", target_arch = "aarch64")) {
+            Some(Platform::MacosArm64)
+        } else {
+            None
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct IndexVersion {
+    pub version: String,
+    pub channel: Channel,
+    pub tag: String,
+    #[serde(default)]
+    pub published: String,
+    pub source: SourceRef,
+    pub weft: WeftRef,
+    #[serde(default)]
+    pub deps: Vec<Dep>,
+    /// Kept as text: a platform this launcher doesn't know is ignored, not an error.
+    #[serde(default)]
+    pub platforms: Vec<String>,
+    pub asset: Asset,
+    #[serde(default)]
+    pub provenance: Option<Provenance>,
+    #[serde(default)]
+    pub reviewed: Option<Reviewed>,
+}
+
+impl IndexVersion {
+    /// The platforms this launcher knows, in the entry's order.
+    pub fn known_platforms(&self) -> Vec<Platform> {
+        let mut out: Vec<Platform> = Vec::new();
+        for p in self.platforms.iter().filter_map(|p| Platform::parse(p)) {
+            if !out.contains(&p) {
+                out.push(p);
+            }
+        }
+        out
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SourceRef {
+    pub repo: String,
+    pub commit: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct WeftRef {
+    #[serde(default)]
+    pub tag: Option<String>,
+    #[serde(default)]
+    pub commit: String,
+    pub abi: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Dep {
+    pub id: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Asset {
+    pub name: String,
+    pub url: String,
+    pub size: u64,
+    pub sha256: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Provenance {
+    pub kind: String,
+    #[serde(default)]
+    pub repo: Option<String>,
+    #[serde(default)]
+    pub workflow: Option<String>,
+    #[serde(default, rename = "ref")]
+    pub git_ref: Option<String>,
+    #[serde(default)]
+    pub verified_at: Option<String>,
+}
+
+/// The only provenance kind the launcher knows: an attestation the index CI checked with
+/// `gh attestation verify`.
+pub const PROVENANCE_GITHUB: &str = "github-attestation";
+
+impl Provenance {
+    /// Whether this record says everything the launcher shows about a build: a GitHub Actions
+    /// build of a repo, by a workflow file, checked by the index at a time. Anything less (another
+    /// kind, a missing field, a malformed one) is a record the launcher can't stand behind.
+    pub fn is_complete(&self) -> bool {
+        self.kind == PROVENANCE_GITHUB
+            && self.repo.as_deref().is_some_and(is_repo)
+            && self.workflow.as_deref().is_some_and(is_workflow_path)
+            && self.verified_at.as_deref().is_some_and(is_rfc3339)
+    }
+}
+
+/// A workflow file in a repo: `.github/workflows/<name>.yml` or `.yaml`, nothing above it.
+pub fn is_workflow_path(s: &str) -> bool {
+    let Some(name) = s.strip_prefix(".github/workflows/") else {
+        return false;
+    };
+    (name.ends_with(".yml") || name.ends_with(".yaml"))
+        && !name.contains('/')
+        && name.len() > 4
+        && name
+            .chars()
+            .all(|c| c.is_ascii_alphanumeric() || matches!(c, '-' | '_' | '.'))
+        && !name.starts_with('.')
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Reviewed {
+    pub by: String,
+    pub at: String,
+}
+
+/// A revoked build. Read with [`revocations`], so `sha256` is lowercase and `reason` is never
+/// empty.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Revoked {
+    pub sha256: String,
+    /// The index's words; `None` when it gave none.
+    #[serde(default)]
+    pub reason: Option<String>,
+    pub at: Option<String>,
+}
+
+/// Ships inside every Weft; nothing may be installed under this id.
+pub const RESERVED_ID: &str = "base";
+
+pub fn is_mod_id(s: &str) -> bool {
+    !s.is_empty()
+        && s.len() <= 64
+        && s.bytes()
+            .all(|b| matches!(b, b'a'..=b'z' | b'0'..=b'9' | b'_'))
+}
+
+pub fn is_sha256(s: &str) -> bool {
+    s.len() == 64 && s.bytes().all(|b| matches!(b, b'0'..=b'9' | b'a'..=b'f'))
+}
+
+pub fn is_repo(s: &str) -> bool {
+    let Some((owner, name)) = s.split_once('/') else {
+        return false;
+    };
+    let part = |p: &str| {
+        !p.is_empty()
+            && p.len() <= 100
+            && p != "."
+            && p != ".."
+            && p.bytes()
+                .all(|b| b.is_ascii_alphanumeric() || matches!(b, b'-' | b'_' | b'.'))
+    };
+    part(owner) && part(name)
+}
+
+/// GitHub treats `Owner/Repo` and `owner/repo` as one repo; so does the launcher.
+pub fn same_repo(a: &str, b: &str) -> bool {
+    a.eq_ignore_ascii_case(b)
+}
+
+/// Which rule a download URL broke: the page says it in the player's language (the detail of
+/// `ModUrlRefused` starts with [`UrlProblem::rule`]).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum UrlProblem {
+    Backslash,
+    PercentEncoded,
+    NotAUrl,
+    NotCanonical,
+    NotHttps,
+    NotGithub,
+    QueryOrFragment,
+    NoPath,
+    BadRepo,
+    NotReleaseAsset,
+}
+
+impl UrlProblem {
+    /// The rule's stable name, which the page reads (src/i18n/errors.ts `urlRule`).
+    pub fn rule(self) -> &'static str {
+        match self {
+            Self::Backslash => "backslash",
+            Self::PercentEncoded => "percentEncoded",
+            Self::NotAUrl => "notAUrl",
+            Self::NotCanonical => "notCanonical",
+            Self::NotHttps => "notHttps",
+            Self::NotGithub => "notGithub",
+            Self::QueryOrFragment => "queryOrFragment",
+            Self::NoPath => "noPath",
+            Self::BadRepo => "badRepo",
+            Self::NotReleaseAsset => "notReleaseAsset",
+        }
+    }
+}
+
+impl std::fmt::Display for UrlProblem {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(match self {
+            Self::Backslash => "contains a backslash",
+            Self::PercentEncoded => "percent-encoded",
+            Self::NotAUrl => "not a URL",
+            Self::NotCanonical => "not in canonical form",
+            Self::NotHttps => "not https",
+            Self::NotGithub => "not github.com",
+            Self::QueryOrFragment => "has a query or fragment",
+            Self::NoPath => "no path",
+            Self::BadRepo => "bad repo",
+            Self::NotReleaseAsset => "not this repo's release asset",
+        })
+    }
+}
+
+/// Why `url` is not the release asset `<id>.zip` of `tag` in `repo`, if it isn't. See
+/// [`release_asset_problem`].
+pub fn asset_url_problem(id: &str, repo: &str, tag: &str, url: &str) -> Option<UrlProblem> {
+    release_asset_problem(repo, tag, &format!("{id}.zip"), url)
+}
+
+/// Why `url` is not the release asset `file` of `tag` in `repo`, if it isn't. It must be
+/// `https://github.com/<owner>/<repo>/releases/download/<tag>/<file>` exactly as written: no
+/// other host, port, user, query or fragment, no `\`, no percent-encoding, no `.` or `..`.
+/// Game versions (`install.rs`) and mods both go through it.
+pub fn release_asset_problem(repo: &str, tag: &str, file: &str, url: &str) -> Option<UrlProblem> {
+    if url.contains('\\') {
+        return Some(UrlProblem::Backslash);
+    }
+    if url.contains('%') {
+        return Some(UrlProblem::PercentEncoded);
+    }
+    let Ok(parsed) = url::Url::parse(url) else {
+        return Some(UrlProblem::NotAUrl);
+    };
+    // The parser resolves `.` and `..` and fixes up odd spellings; a URL that changes when
+    // parsed is not the one that was reviewed.
+    if parsed.as_str() != url {
+        return Some(UrlProblem::NotCanonical);
+    }
+    if parsed.scheme() != "https" {
+        return Some(UrlProblem::NotHttps);
+    }
+    if parsed.host_str() != Some("github.com")
+        || parsed.port().is_some()
+        || !parsed.username().is_empty()
+        || parsed.password().is_some()
+    {
+        return Some(UrlProblem::NotGithub);
+    }
+    if parsed.query().is_some() || parsed.fragment().is_some() {
+        return Some(UrlProblem::QueryOrFragment);
+    }
+    let Some(segments) = parsed.path_segments() else {
+        return Some(UrlProblem::NoPath);
+    };
+    let segments: Vec<&str> = segments.collect();
+    let Some((owner, name)) = repo.split_once('/') else {
+        return Some(UrlProblem::BadRepo);
+    };
+    match segments.as_slice() {
+        [o, r, "releases", "download", t, n]
+            if o.eq_ignore_ascii_case(owner)
+                && r.eq_ignore_ascii_case(name)
+                && *t == tag
+                && is_safe_ref(t)
+                && *n == file =>
+        {
+            None
+        }
+        _ => Some(UrlProblem::NotReleaseAsset),
+    }
+}
+
+/// A full git commit hash: 40 lowercase hex characters, or 64 in a SHA-256 repository.
+pub fn is_commit(s: &str) -> bool {
+    (s.len() == 40 || s.len() == 64) && s.bytes().all(|b| matches!(b, b'0'..=b'9' | b'a'..=b'f'))
+}
+
+/// `MAJOR.MINOR.PATCH`, then optionally `-prerelease` and `+build`: dot-separated parts of
+/// `0-9 A-Z a-z -`, none empty.
+pub fn is_semver(s: &str) -> bool {
+    let (rest, build) = match s.split_once('+') {
+        Some((r, b)) => (r, Some(b)),
+        None => (s, None),
+    };
+    let (core, pre) = match rest.split_once('-') {
+        Some((c, p)) => (c, Some(p)),
+        None => (rest, None),
+    };
+    let ident = |part: &str| {
+        !part.is_empty() && part.bytes().all(|b| b.is_ascii_alphanumeric() || b == b'-')
+    };
+    let dotted = |s: &str| s.split('.').all(ident);
+    let numbers: Vec<&str> = core.split('.').collect();
+    numbers.len() == 3
+        && numbers
+            .iter()
+            .all(|n| !n.is_empty() && n.len() <= 18 && n.bytes().all(|b| b.is_ascii_digit()))
+        && pre.is_none_or(dotted)
+        && build.is_none_or(dotted)
+}
+
+pub fn is_rfc3339(s: &str) -> bool {
+    OffsetDateTime::parse(s, &Rfc3339).is_ok()
+}
+
+/// What the launcher shows of a summary; longer ones are cut, not refused.
+pub const MAX_SUMMARY_CHARS: usize = 140;
+
+pub fn clamp_summary(summary: &mut String) {
+    let line = summary.lines().next().unwrap_or("").trim();
+    *summary = if line.chars().count() > MAX_SUMMARY_CHARS {
+        let cut: String = line.chars().take(MAX_SUMMARY_CHARS - 1).collect();
+        format!("{}…", cut.trim_end())
+    } else {
+        line.to_string()
+    };
+}
+
+/// The contract's rules for one version of one mod. A version that breaks them is left out.
+pub fn version_problem(id: &str, v: &IndexVersion) -> Option<String> {
+    if !is_semver(&v.version) {
+        return Some(format!("version {:?}", v.version));
+    }
+    if !is_repo(&v.source.repo) {
+        return Some(format!("source repo {:?}", v.source.repo));
+    }
+    if !is_commit(&v.source.commit) {
+        return Some(format!("source commit {:?}", v.source.commit));
+    }
+    if !v.weft.commit.is_empty() && !is_commit(&v.weft.commit) {
+        return Some(format!("weft commit {:?}", v.weft.commit));
+    }
+    if !v.published.is_empty() && !is_rfc3339(&v.published) {
+        return Some(format!("published {:?}", v.published));
+    }
+    if !is_safe_ref(&v.tag) {
+        return Some(format!("tag {:?}", v.tag));
+    }
+    if v.asset.name != format!("{id}.zip") {
+        return Some(format!("asset name {:?}", v.asset.name));
+    }
+    if let Some(why) = asset_url_problem(id, &v.source.repo, &v.tag, &v.asset.url) {
+        return Some(format!("asset url {:?}: {why}", v.asset.url));
+    }
+    if !is_sha256(&v.asset.sha256) {
+        return Some("sha256".into());
+    }
+    if !is_abi(&v.weft.abi) {
+        return Some("abi".into());
+    }
+    if let Some(tag) = &v.weft.tag
+        && !is_safe_ref(tag)
+    {
+        return Some(format!("weft tag {tag:?}"));
+    }
+    if v.deps.iter().any(|d| !is_mod_id(&d.id)) {
+        return Some("deps".into());
+    }
+    None
+}
+
+/// Keeps what follows the contract and drops the rest, so one bad entry doesn't hide the others.
+/// Every version in the index must say who reviewed it: that is what Reviewed means.
+pub fn sanitize(mut index: Index) -> Index {
+    index
+        .mods
+        .retain(|m| is_mod_id(&m.id) && m.id != RESERVED_ID);
+    for m in &mut index.mods {
+        let id = m.id.clone();
+        m.versions.retain(|v| {
+            let problem = version_problem(&id, v).or_else(|| match &v.reviewed {
+                Some(r) if !r.by.trim().is_empty() => None,
+                _ => Some("no review recorded".into()),
+            });
+            match problem {
+                None => true,
+                Some(problem) => {
+                    eprintln!("mod index: dropping {id} {}: {problem}", v.version);
+                    false
+                }
+            }
+        });
+        m.icon = m
+            .icon
+            .take()
+            .filter(|u| crate::download::icon_url_allowed(u));
+        m.homepage = m.homepage.take().filter(|u| u.starts_with("https://"));
+        clamp_summary(&mut m.summary);
+    }
+    index.mods.retain(|m| !m.versions.is_empty());
+    // As documented: each entry needs its tag, its full commit and its ABI.
+    index
+        .weft
+        .retain(|w| is_safe_ref(&w.tag) && is_commit(&w.commit) && is_abi(&w.abi));
+    index.revoked.retain(|r| is_sha256(&r.sha256));
+    index
+}
+
+/// Reads index bytes whose signature already verified: `schema` 1 and an RFC 3339 `generated`,
+/// or the whole index is refused; any other bad entry costs only that entry.
+pub fn parse(bytes: &[u8]) -> Result<Index, ModsError> {
+    let index: Index =
+        serde_json::from_slice(bytes).map_err(|e| ModsError::IndexInvalid(e.to_string()))?;
+    if index.schema != 1 {
+        return Err(ModsError::IndexInvalid(format!("schema {}", index.schema)));
+    }
+    if generated_at(&index).is_none() {
+        return Err(ModsError::IndexInvalid(format!(
+            "generated {:?}",
+            index.generated
+        )));
+    }
+    Ok(sanitize(index))
+}
+
+pub fn generated_at(index: &Index) -> Option<OffsetDateTime> {
+    OffsetDateTime::parse(&index.generated, &Rfc3339).ok()
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use super::*;
+
+    pub fn version(id: &str, repo: &str, sha: &str) -> IndexVersion {
+        IndexVersion {
+            version: "0.2.0".into(),
+            channel: Channel::Release,
+            tag: format!("{id}-v0.2.0"),
+            published: "2026-11-04T00:00:00Z".into(),
+            source: SourceRef {
+                repo: repo.into(),
+                commit: "c".repeat(40),
+            },
+            weft: WeftRef {
+                tag: Some("v26.11.1".into()),
+                commit: "f".repeat(40),
+                abi: "f470b1cbb1f9ad91".into(),
+            },
+            deps: vec![Dep { id: "base".into() }],
+            platforms: vec!["linux-x64".into()],
+            asset: Asset {
+                name: format!("{id}.zip"),
+                url: format!("https://github.com/{repo}/releases/download/{id}-v0.2.0/{id}.zip"),
+                size: 10,
+                sha256: sha.into(),
+            },
+            provenance: None,
+            reviewed: Some(Reviewed {
+                by: "Zorro909".into(),
+                at: "2026-11-04".into(),
+            }),
+        }
+    }
+
+    #[test]
+    fn contract_rules_drop_bad_versions() {
+        let sha = "a".repeat(64);
+        let ok = || version("cogwork", "Zorro909/weft-mods", &sha);
+        assert!(version_problem("cogwork", &ok()).is_none());
+
+        type Change = fn(&mut IndexVersion);
+        let cases: &[(&str, Change)] = &[
+            ("other host", |v| {
+                v.asset.url = "https://evil.example/cogwork.zip".into()
+            }),
+            ("other repo", |v| {
+                v.asset.url =
+                    "https://github.com/Someone/else/releases/download/x/cogwork.zip".into()
+            }),
+            ("asset name", |v| v.asset.name = "other.zip".into()),
+            ("sha256 shape", |v| v.asset.sha256 = "ABC".into()),
+            ("repo shape", |v| v.source.repo = "../x".into()),
+            ("tag shape", |v| v.tag = "../x".into()),
+            ("url names another tag", |v| {
+                v.asset.url =
+                    "https://github.com/Zorro909/weft-mods/releases/download/cogwork-v9/cogwork.zip"
+                        .into()
+            }),
+            ("abi shape", |v| v.weft.abi = "F00".into()),
+            ("dep id", |v| v.deps = vec![Dep { id: "A-B".into() }]),
+            ("version not semver", |v| v.version = "0.2".into()),
+            ("version with junk", |v| v.version = "0.2.0-rc..1".into()),
+            ("short commit", |v| v.source.commit = "cceea78".into()),
+            ("commit in capitals", |v| v.source.commit = "C".repeat(40)),
+            ("short weft commit", |v| v.weft.commit = "ff9c712".into()),
+            ("published not a date", |v| v.published = "yesterday".into()),
+        ];
+        for (what, change) in cases {
+            let mut v = ok();
+            change(&mut v);
+            assert!(version_problem("cogwork", &v).is_some(), "{what}");
+        }
+    }
+
+    /// An icon from anywhere but GitHub is dropped while reading, so the launcher never asks
+    /// another host for it (that would tell it the player's address).
+    #[test]
+    fn icons_only_from_github_hosts() {
+        let sha = "a".repeat(64);
+        let with_icon = |icon: &str| IndexMod {
+            id: "cogwork".into(),
+            name: "Cogwork".into(),
+            summary: String::new(),
+            authors: vec![],
+            license: None,
+            homepage: None,
+            icon: Some(icon.into()),
+            versions: vec![version("cogwork", "Zorro909/weft-mods", &sha)],
+        };
+        let icons = |icon: &str| {
+            let index = sanitize(Index {
+                schema: 1,
+                generated: "2026-11-04T00:00:00Z".into(),
+                weft: vec![],
+                mods: vec![with_icon(icon)],
+                revoked: vec![],
+            });
+            index.mods[0].icon.clone()
+        };
+        let ok = "https://raw.githubusercontent.com/Zorro909/weft-mods/main/icon.png";
+        assert_eq!(icons(ok).as_deref(), Some(ok));
+        assert_eq!(
+            icons("https://zorro909.github.io/icon.png").as_deref(),
+            Some("https://zorro909.github.io/icon.png")
+        );
+        for bad in [
+            "https://tracker.example/icon.png",
+            "https://raw.githubusercontent.com.evil.example/icon.png",
+            "http://raw.githubusercontent.com/Zorro909/weft-mods/main/icon.png",
+        ] {
+            assert_eq!(icons(bad), None, "{bad}");
+        }
+    }
+
+    /// The bypasses found in review: each one parsed into a URL in another repo, or a
+    /// different file, while still starting with the right prefix.
+    #[test]
+    fn asset_url_bypasses_are_refused() {
+        let repo = "Zorro909/weft-mods";
+        let tag = "cogwork-v0.2.0";
+        let good =
+            "https://github.com/Zorro909/weft-mods/releases/download/cogwork-v0.2.0/cogwork.zip";
+        assert_eq!(asset_url_problem("cogwork", repo, tag, good), None);
+        // Owner and repo compare without case, like GitHub does.
+        assert_eq!(
+            asset_url_problem("cogwork", "zorro909/WEFT-mods", tag, good),
+            None
+        );
+
+        let bad = [
+            r"https://github.com/Zorro909/weft-mods/releases/download/..\..\..\..\evil\repo\releases\download\x\cogwork.zip",
+            "https://github.com/Zorro909/weft-mods/releases/download/%2e%2e/%2e%2e/%2e%2e/%2e%2e/evil/repo/releases/download/x/cogwork.zip",
+            "https://github.com/Zorro909/weft-mods/releases/download/%2E%2E/x/cogwork.zip",
+            "https://github.com/Zorro909/weft-mods/releases/download/x/..",
+            "https://github.com/Zorro909/weft-mods/releases/download/cogwork-v0.2.0/../cogwork.zip",
+            "https://github.com/Zorro909/weft-mods/releases/download/../../../evil/repo/releases/download/cogwork-v0.2.0/cogwork.zip",
+            "https://github.com/Zorro909/weft-mods/releases/download/./cogwork-v0.2.0/cogwork.zip",
+            "http://github.com/Zorro909/weft-mods/releases/download/cogwork-v0.2.0/cogwork.zip",
+            "https://github.com:8443/Zorro909/weft-mods/releases/download/cogwork-v0.2.0/cogwork.zip",
+            "https://user@github.com/Zorro909/weft-mods/releases/download/cogwork-v0.2.0/cogwork.zip",
+            "https://github.com.evil.example/Zorro909/weft-mods/releases/download/cogwork-v0.2.0/cogwork.zip",
+            "https://GITHUB.com/Zorro909/weft-mods/releases/download/cogwork-v0.2.0/cogwork.zip",
+            "https://github.com/Zorro909/weft-mods/releases/download/cogwork-v0.2.0/cogwork.zip?x=1",
+            "https://github.com/Zorro909/weft-mods/releases/download/cogwork-v0.2.0/cogwork.zip#x",
+            "https://github.com/Zorro909/weft-mods/releases/download/cogwork-v0.2.0/other.zip",
+            "https://github.com/Zorro909/weft-mods/releases/download/cogwork-v0.2.0/sub/cogwork.zip",
+            "https://github.com/Zorro909/weft-mods/releases/latest/download/cogwork.zip",
+            "https://github.com/Zorro909/weft-mods-evil/releases/download/cogwork-v0.2.0/cogwork.zip",
+            "not a url",
+        ];
+        for url in bad {
+            assert!(
+                asset_url_problem("cogwork", repo, tag, url).is_some(),
+                "{url}"
+            );
+        }
+    }
+
+    #[test]
+    fn ids_and_repos() {
+        assert!(is_mod_id("cogwork"));
+        assert!(is_mod_id("my_mod2"));
+        assert!(!is_mod_id("Cogwork"));
+        assert!(!is_mod_id("a-b"));
+        assert!(!is_mod_id(""));
+        assert!(is_repo("Zorro909/weft-mods"));
+        assert!(!is_repo("Zorro909"));
+        assert!(!is_repo("a/b/c"));
+        assert!(!is_repo("../b"));
+        assert!(same_repo("Zorro909/Weft-Mods", "zorro909/weft-mods"));
+    }
+
+    fn mod_json(id: &str, versions: &str) -> String {
+        format!(r#"{{ "id": "{id}", "name": "{id}", "versions": [{versions}] }}"#)
+    }
+
+    fn version_json(id: &str, channel: &str, sha_char: char) -> String {
+        let v = version(id, "Zorro909/weft-mods", &sha_char.to_string().repeat(64));
+        let mut value = serde_json::to_value(&v).unwrap();
+        value["channel"] = serde_json::Value::String(channel.into());
+        value.to_string()
+    }
+
+    /// One broken entry, anywhere, costs only that entry.
+    #[test]
+    fn a_bad_entry_does_not_reject_the_index() {
+        let good = version_json("cogwork", "release", 'a');
+        let unknown_channel = version_json("cogwork", "nightly", 'b');
+        let unreviewed = {
+            let mut v: serde_json::Value =
+                serde_json::from_str(&version_json("cogwork", "release", 'c')).unwrap();
+            v["reviewed"] = serde_json::Value::Null;
+            v.to_string()
+        };
+        let odd_platform = {
+            let mut v: serde_json::Value =
+                serde_json::from_str(&version_json("showcase", "release", 'd')).unwrap();
+            v["platforms"] = serde_json::json!(["linux-x64", "plan9-mips"]);
+            v.to_string()
+        };
+        let mods = [
+            mod_json("cogwork", &[good, unknown_channel, unreviewed].join(",")),
+            mod_json("showcase", &odd_platform),
+            r#"{ "id": "noname", "versions": [] }"#.to_string(),
+            mod_json("base", &version_json("base", "release", 'e')),
+            r#""not even an object""#.to_string(),
+        ];
+        let json = format!(
+            r#"{{ "schema": 1, "generated": "2026-11-04T00:00:00Z",
+                 "weft": [ {{ "tag": "v26.11.1", "commit": "{}", "abi": "f470b1cbb1f9ad91" }}, {{ "tag": 5 }} ],
+                 "mods": [{}],
+                 "revoked": [ {{ "sha256": "{}" }}, {{ "reason": "no hash" }} ] }}"#,
+            "c".repeat(40),
+            mods.join(","),
+            "f".repeat(64)
+        );
+        let index = parse(json.as_bytes()).unwrap();
+        let ids: Vec<&str> = index.mods.iter().map(|m| m.id.as_str()).collect();
+        assert_eq!(ids, ["cogwork", "showcase"]);
+        assert_eq!(index.mods[0].versions.len(), 1, "only the good cogwork");
+        assert_eq!(index.mods[0].versions[0].asset.sha256, "a".repeat(64));
+        assert_eq!(
+            index.mods[1].versions[0].known_platforms(),
+            [Platform::LinuxX64]
+        );
+        assert_eq!(index.weft.len(), 1);
+        assert_eq!(index.revoked.len(), 1);
+    }
+
+    #[test]
+    fn an_index_needs_schema_1_and_a_date() {
+        assert!(parse(br#"{ "schema": 2, "generated": "2026-11-04T00:00:00Z" }"#).is_err());
+        assert!(parse(br#"{ "schema": 1, "generated": "yesterday" }"#).is_err());
+        assert!(parse(br#"{ "schema": 1, "generated": "2026-11-04T00:00:00Z" }"#).is_ok());
+    }
+
+    #[test]
+    fn versions_commits_and_summaries() {
+        for good in [
+            "0.2.0",
+            "0.2.1-rc.1",
+            "0.1.2-experimental.4563878.917596d",
+            "1.0.0+build.5",
+        ] {
+            assert!(is_semver(good), "{good}");
+        }
+        for bad in [
+            "",
+            "0.2",
+            "v0.2.0",
+            "0.2.0.1",
+            "0.2.0-",
+            "0.2.0-rc..1",
+            "a.b.c",
+            "0.2.0 ",
+        ] {
+            assert!(!is_semver(bad), "{bad:?}");
+        }
+        assert!(is_commit(&"a".repeat(40)) && is_commit(&"a".repeat(64)));
+        assert!(!is_commit(&"a".repeat(41)) && !is_commit("cceea78"));
+
+        // An optional weft commit may be left out; an empty `published` too.
+        let mut v = version("cogwork", "Zorro909/weft-mods", &"a".repeat(64));
+        v.weft.commit = String::new();
+        v.published = String::new();
+        assert!(version_problem("cogwork", &v).is_none());
+
+        let mut long = "x".repeat(MAX_SUMMARY_CHARS + 10);
+        clamp_summary(&mut long);
+        assert_eq!(long.chars().count(), MAX_SUMMARY_CHARS);
+        assert!(long.ends_with('…'));
+        let mut two_lines = "First line.\nSecond line.".to_string();
+        clamp_summary(&mut two_lines);
+        assert_eq!(two_lines, "First line.");
+    }
+
+    /// Contract R4 §6: a revocation is dropped only when its hash can't be a SHA-256.
+    #[test]
+    fn revocations_fail_closed() {
+        let upper = "AB".repeat(32);
+        let json = format!(
+            r#"{{ "schema": 1, "generated": "2026-11-04T00:00:00Z", "revoked": [
+                {{ "sha256": "{upper}", "reason": "Corrupts worlds", "at": null }},
+                {{ "sha256": "{}" }},
+                {{ "sha256": "{}", "reason": 5, "at": 7 }},
+                {{ "sha256": " {} ", "reason": "" }},
+                {{ "sha256": "xyz" }},
+                {{ "reason": "no hash" }},
+                "not an object"
+            ] }}"#,
+            "c".repeat(64),
+            "d".repeat(64),
+            "e".repeat(64),
+        );
+        let index = parse(json.as_bytes()).unwrap();
+        let got: Vec<(&str, Option<&str>, Option<&str>)> = index
+            .revoked
+            .iter()
+            .map(|r| (r.sha256.as_str(), r.reason.as_deref(), r.at.as_deref()))
+            .collect();
+        let (ab, c, d, e) = (
+            "ab".repeat(32),
+            "c".repeat(64),
+            "d".repeat(64),
+            "e".repeat(64),
+        );
+        assert_eq!(
+            got,
+            [
+                (ab.as_str(), Some("Corrupts worlds"), None),
+                (c.as_str(), None, None),
+                (d.as_str(), None, None),
+                (e.as_str(), None, None),
+            ]
+        );
+
+        // A `revoked` that isn't a list can't be read safely: the whole index is refused.
+        let bad = br#"{ "schema": 1, "generated": "2026-11-04T00:00:00Z", "revoked": { "x": 1 } }"#;
+        assert!(matches!(parse(bad), Err(ModsError::IndexInvalid(_))));
+    }
+
+    /// `weft[]` entries follow the documented rule: a short or missing commit drops the entry.
+    #[test]
+    fn weft_entries_need_a_full_commit() {
+        let entry = |commit: &str| WeftAbi {
+            tag: "v26.11.1".into(),
+            commit: commit.into(),
+            abi: "0123456789abcdef".into(),
+        };
+        let index = Index {
+            schema: 1,
+            generated: "2026-11-04T00:00:00Z".into(),
+            weft: vec![entry(&"a".repeat(40)), entry("cceea78"), entry("")],
+            mods: vec![],
+            revoked: vec![],
+        };
+        let kept = sanitize(index).weft;
+        assert_eq!(kept.len(), 1);
+        assert_eq!(kept[0].commit, "a".repeat(40));
+    }
+
+    #[test]
+    fn workflow_paths() {
+        assert!(is_workflow_path(".github/workflows/release.yml"));
+        assert!(is_workflow_path(".github/workflows/build-mods.yaml"));
+        for bad in [
+            "release.yml",
+            ".github/workflows/../x.yml",
+            ".github/workflows/a/b.yml",
+            ".github/workflows/.yml",
+            ".github/workflows/x.sh",
+            ".github/workflows/x y.yml",
+        ] {
+            assert!(!is_workflow_path(bad), "{bad}");
+        }
+    }
+}
diff --git a/src-tauri/src/mods/index/mod.rs b/src-tauri/src/mods/index/mod.rs
new file mode 100644
index 0000000..2ad0aae
--- /dev/null
+++ b/src-tauri/src/mods/index/mod.rs
@@ -0,0 +1,25 @@
+//! The curated mod index: `index.json` plus its minisign signature, as described in
+//! `docs/mod-manager/INDEX_FORMAT.md`. Only an index signed with the embedded key is used. The
+//! last one that verified is kept, so the catalogue works offline, and an older one than any
+//! accepted before is refused.
+//!
+//! - `format.rs`: the JSON and the rules each entry must follow;
+//! - `signature.rs`: the signature, and when it was made;
+//! - `cache.rs`: the verified copies on disk, rollback protection and staleness;
+//! - `fetch.rs`: getting it from the network, or not.
+
+mod cache;
+mod fetch;
+mod format;
+mod signature;
+
+pub use cache::{Age, FUTURE_SLACK, Freshness, IndexCache, IndexState, STALE_AFTER, decide};
+pub use fetch::{INDEX_URL, MAX_INDEX_BYTES, cached, fetch_bytes, index_url, load};
+pub use format::*;
+pub use signature::{INDEX_PUBLIC_KEY, Signed, public_key, signed_at, verify};
+
+#[cfg(test)]
+pub(crate) mod tests {
+    pub use super::format::tests::*;
+    pub use super::signature::tests::{FIXTURE, FIXTURE_KEY, FIXTURE_SIG};
+}
diff --git a/src-tauri/src/mods/index/signature.rs b/src-tauri/src/mods/index/signature.rs
new file mode 100644
index 0000000..461aebf
--- /dev/null
+++ b/src-tauri/src/mods/index/signature.rs
@@ -0,0 +1,148 @@
+//! The minisign signature over `index.json`. Only an index signed with the embedded key is used;
+//! the signature's trusted comment, which the key also signs, says when it was signed.
+
+use minisign_verify::{PublicKey, Signature};
+use time::OffsetDateTime;
+
+use super::super::error::ModsError;
+use super::format::{Index, parse};
+
+/// `keys/index.pub` of the index repository.
+pub const INDEX_PUBLIC_KEY: &str = "RWRelY1XUps7n+bc3RVDFwMAWzPYz4orZvxzRTo0M+hK2A0w02cQmfvh";
+
+pub fn public_key() -> String {
+    #[cfg(debug_assertions)]
+    if let Ok(key) = std::env::var("WEFT_MOD_INDEX_PUBKEY") {
+        return key;
+    }
+    INDEX_PUBLIC_KEY.to_string()
+}
+
+/// An index whose signature verified, and when it was signed.
+#[derive(Debug, Clone)]
+pub struct Signed {
+    pub index: Index,
+    /// From the trusted comment's `timestamp:<unix seconds>`, which `minisign -S` writes by
+    /// default. `None` when the comment has none.
+    pub signed_at: Option<OffsetDateTime>,
+}
+
+/// The `timestamp:` of a trusted comment such as `timestamp:1793819114 file:index.json`.
+pub fn signed_at(trusted_comment: &str) -> Option<OffsetDateTime> {
+    trusted_comment
+        .split(['\t', ' '])
+        .find_map(|part| part.strip_prefix("timestamp:"))
+        .and_then(|secs| secs.parse::<i64>().ok())
+        .and_then(|secs| OffsetDateTime::from_unix_timestamp(secs).ok())
+}
+
+pub fn verify(bytes: &[u8], signature: &str, public_key: &str) -> Result<Signed, ModsError> {
+    let key = PublicKey::from_base64(public_key.trim())
+        .or_else(|_| PublicKey::decode(public_key))
+        .map_err(|e| ModsError::IndexSignatureInvalid(format!("public key: {e}")))?;
+    let signature = Signature::decode(signature)
+        .map_err(|e| ModsError::IndexSignatureInvalid(e.to_string()))?;
+    key.verify(bytes, &signature, false)
+        .map_err(|e| ModsError::IndexSignatureInvalid(e.to_string()))?;
+    Ok(Signed {
+        index: parse(bytes)?,
+        signed_at: signed_at(signature.trusted_comment()),
+    })
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use super::*;
+
+    // Signed with a throw-away key made for these tests (`minisign -G -W`); the private half was
+    // never kept. The real key belongs to the index repository.
+    pub const FIXTURE: &[u8] = include_bytes!("../testdata/index.json");
+    /// Signed 2026-11-04T18:05:00Z; `generated` is 2026-11-04T18:00:00Z.
+    pub const FIXTURE_SIG: &str = include_str!("../testdata/index.json.minisig");
+    /// The same bytes signed again a week later, as the index repository does.
+    pub const FIXTURE_RESIGNED_SIG: &str = include_str!("../testdata/index.json.resigned.minisig");
+    /// The same index with `generated` 2026-11-01T00:00:00Z, signed 2026-11-01T00:05:00Z.
+    pub const OLDER: &[u8] = include_bytes!("../testdata/index-older.json");
+    pub const OLDER_SIG: &str = include_str!("../testdata/index-older.json.minisig");
+    pub const FIXTURE_KEY: &str = include_str!("../testdata/test.pub");
+
+    pub fn at(rfc3339: &str) -> OffsetDateTime {
+        OffsetDateTime::parse(rfc3339, &time::format_description::well_known::Rfc3339).unwrap()
+    }
+
+    #[test]
+    fn a_signed_index_verifies_and_says_when_it_was_signed() {
+        let signed = verify(FIXTURE, FIXTURE_SIG, FIXTURE_KEY).unwrap();
+        assert_eq!(signed.index.mods[0].id, "cogwork");
+        assert_eq!(signed.index.weft[0].abi, "f470b1cbb1f9ad91");
+        assert_eq!(signed.signed_at, Some(at("2026-11-04T18:05:00Z")));
+        // The bare base64 line works too, as embedded in the launcher.
+        let key_line = FIXTURE_KEY.lines().nth(1).unwrap();
+        assert!(verify(FIXTURE, FIXTURE_SIG, key_line).is_ok());
+    }
+
+    #[test]
+    fn trusted_comments() {
+        assert_eq!(
+            signed_at("timestamp:1793819114\tfile:index.json\thashed"),
+            Some(at("2026-11-04T19:05:14Z"))
+        );
+        assert_eq!(
+            signed_at("timestamp:1793819114 file:index.json commit:5e4de0c"),
+            Some(at("2026-11-04T19:05:14Z"))
+        );
+        assert_eq!(signed_at("test fixture"), None);
+        assert_eq!(signed_at("timestamp:soon"), None);
+    }
+
+    #[test]
+    fn any_change_breaks_the_signature() {
+        let mut tampered = FIXTURE.to_vec();
+        let at = tampered.windows(7).position(|w| w == b"Cogwork").unwrap();
+        tampered[at] = b'K';
+        assert!(matches!(
+            verify(&tampered, FIXTURE_SIG, FIXTURE_KEY),
+            Err(ModsError::IndexSignatureInvalid(_))
+        ));
+        assert!(matches!(
+            verify(FIXTURE, "not a signature", FIXTURE_KEY),
+            Err(ModsError::IndexSignatureInvalid(_))
+        ));
+        // A trusted comment changed to claim a newer signing time.
+        let forged = FIXTURE_SIG.replace("timestamp:1793815500", "timestamp:1893815500");
+        assert!(matches!(
+            verify(FIXTURE, &forged, FIXTURE_KEY),
+            Err(ModsError::IndexSignatureInvalid(_))
+        ));
+    }
+
+    /// A copy of the live index, signed by the real key: the embedded key is the right
+    /// one, and nothing the index publishes is dropped by the contract checks here.
+    #[test]
+    fn the_published_index_verifies_and_keeps_every_entry() {
+        let bytes = include_bytes!("../testdata/published-index.json");
+        let sig = include_str!("../testdata/published-index.json.minisig");
+        let signed = verify(bytes, sig, INDEX_PUBLIC_KEY).unwrap();
+        assert!(signed.signed_at.is_some());
+        let index = signed.index;
+        let raw: serde_json::Value = serde_json::from_slice(bytes).unwrap();
+        let raw_count: usize = raw["mods"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .map(|m| m["versions"].as_array().unwrap().len())
+            .sum();
+        let count = index.mods.iter().map(|m| m.versions.len()).sum::<usize>();
+        assert!(raw_count > 0);
+        assert_eq!(count, raw_count);
+        assert_eq!(index.weft.len(), raw["weft"].as_array().unwrap().len());
+    }
+
+    #[test]
+    fn another_key_is_refused() {
+        assert!(matches!(
+            verify(FIXTURE, FIXTURE_SIG, INDEX_PUBLIC_KEY),
+            Err(ModsError::IndexSignatureInvalid(_))
+        ));
+    }
+}
diff --git a/src-tauri/src/mods/inspect.rs b/src-tauri/src/mods/inspect.rs
new file mode 100644
index 0000000..db8d03f
--- /dev/null
+++ b/src-tauri/src/mods/inspect.rs
@@ -0,0 +1,274 @@
+//! A zip from the player's computer: what can be told about it before installing, and the lock
+//! entry it becomes when it isn't in the catalogue.
+
+use serde::Serialize;
+use std::path::Path;
+use ts_rs::TS;
+
+use super::archive::{self, ArchiveInfo, MAX_FILE_BYTES};
+use super::catalog::{Catalog, CatalogVersion, Origin, Trust};
+use super::error::ModsError;
+use super::index::{Platform, RESERVED_ID};
+use super::plan::{Consent, plan_token, resolve};
+use super::profile::{Fit, Lock, LockEntry, now};
+use crate::download::sha256_file;
+use crate::error::AppError;
+
+#[derive(Debug, Clone, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+pub struct CatalogMatch {
+    pub key: String,
+    pub name: String,
+    /// Whether the build is for the version's mod interface; null when that is unknown.
+    pub fits_version: Option<bool>,
+    /// The catalogue entry: trust, review, provenance and whether it was verified.
+    pub build: CatalogVersion,
+}
+
+#[derive(Debug, Clone, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+pub struct FileInspection {
+    pub file_name: String,
+    pub size: u64,
+    pub sha256: String,
+    pub archive: Option<ArchiveInfo>,
+    /// Why the file can't be a mod, if it can't.
+    pub problem: Option<AppError>,
+    /// What the mod's own language file calls it. Only what the file says about itself.
+    pub name: Option<String>,
+    pub summary: Option<String>,
+    pub fits_system: bool,
+    pub catalog_match: Option<CatalogMatch>,
+    /// The index revoked this file's hash: it can't be installed.
+    pub revoked: bool,
+    /// The index's reason for that; null when it gave none.
+    pub revoked_reason: Option<String>,
+    /// The installed version of a mod with the same id, which this file would replace.
+    pub replaces: Option<String>,
+    /// Pass to `install_mod_file`: the digest of what installing this file means.
+    pub plan_token: String,
+}
+
+/// The file's size, or `ModTooLarge`. Only a regular file (or a link to one): a device or a
+/// pipe has no size worth trusting and may never end.
+pub fn checked_size(path: &Path) -> Result<u64, ModsError> {
+    let meta = std::fs::metadata(path)?;
+    if !meta.is_file() {
+        return Err(ModsError::ArchiveInvalid(
+            super::archive::ArchiveProblem::NotZip("not a regular file".into()),
+        ));
+    }
+    let size = meta.len();
+    if size > MAX_FILE_BYTES {
+        return Err(ModsError::TooLarge("larger than 512 MB".into()));
+    }
+    Ok(size)
+}
+
+fn file_name(path: &Path) -> String {
+    path.file_name()
+        .map(|n| n.to_string_lossy().to_string())
+        .unwrap_or_default()
+}
+
+/// Everything the launcher can say about the file at `path` for a version with mod interface
+/// `abi` and mod set `lock`. A zip that isn't a mod is still described, with `problem` set.
+pub fn inspect(
+    path: &Path,
+    catalog: &Catalog,
+    abi: Option<&str>,
+    platform: Option<Platform>,
+    lock: &Lock,
+) -> Result<FileInspection, ModsError> {
+    let size = checked_size(path)?;
+    let sha256 = sha256_file(path)?;
+    let inspected = std::fs::File::open(path)
+        .map_err(ModsError::from)
+        .and_then(|f| archive::inspect(f, None))
+        .and_then(|info| {
+            if info.id == RESERVED_ID {
+                Err(ModsError::IdReserved(info.id))
+            } else {
+                Ok(info)
+            }
+        });
+    let (archive, problem) = match inspected {
+        Ok(info) => (Some(info), None),
+        Err(e) => (None, Some(AppError::from(e))),
+    };
+    let (name, summary) = archive
+        .as_ref()
+        .map(|a| archive::read_lang(path, &a.id))
+        .unwrap_or_default();
+    let found = catalog.find(&sha256);
+    let catalog_match = found.map(|(m, v)| CatalogMatch {
+        key: m.key.clone(),
+        name: m.name.clone(),
+        fits_version: abi.map(|a| a == v.abi),
+        build: v.clone(),
+    });
+    let plan_token = match (found, abi) {
+        (Some((m, v)), Some(abi)) => {
+            let fit = Fit { abi, platform };
+            let res = resolve(catalog, lock, vec![(m.clone(), v.clone())], fit);
+            plan_token(Some(abi), lock, &res)
+        }
+        (Some((m, _)), None) => Consent::unverified(None, &m.id, &sha256, false).token(),
+        (None, _) => {
+            let id = archive.as_ref().map_or("", |a| a.id.as_str());
+            file_token(abi, id, &sha256, lock)
+        }
+    };
+    let replaces = archive
+        .as_ref()
+        .and_then(|a| lock.get(&a.id))
+        .map(|e| e.version.clone().unwrap_or_else(|| e.name.clone()));
+    Ok(FileInspection {
+        file_name: file_name(path),
+        size,
+        fits_system: archive
+            .as_ref()
+            .is_some_and(|a| platform.is_some_and(|p| a.platforms.contains(&p))),
+        archive,
+        problem,
+        name,
+        summary,
+        revoked: catalog.revocation(&sha256).is_some(),
+        revoked_reason: catalog.revocation(&sha256).and_then(|r| r.reason.clone()),
+        catalog_match,
+        replaces,
+        plan_token,
+        sha256,
+    })
+}
+
+/// The token of installing a file that isn't in the catalogue into `lock`: it replaces a mod
+/// with its id and keeps that one on or off, else it is on.
+pub fn file_token(abi: Option<&str>, id: &str, sha256: &str, lock: &Lock) -> String {
+    let on = lock.get(id).is_none_or(|e| e.enabled);
+    Consent::unverified(abi, id, sha256, on).token()
+}
+
+/// The lock entry of a file that isn't in the catalogue: Unverified, named by what its language
+/// file says, with nothing known about which version it fits.
+pub fn local_entry(
+    info: &ArchiveInfo,
+    stored: &Path,
+    source: &Path,
+    sha256: &str,
+) -> Result<LockEntry, ModsError> {
+    let (name, summary) = archive::read_lang(stored, &info.id);
+    Ok(LockEntry {
+        id: info.id.clone(),
+        name: name.unwrap_or_else(|| info.id.clone()),
+        summary: summary.unwrap_or_default(),
+        version: None,
+        channel: None,
+        sha256: sha256.to_string(),
+        size: std::fs::metadata(stored)?.len(),
+        enabled: true,
+        trust: Trust::Unverified,
+        origin: Origin::File {
+            name: file_name(source),
+        },
+        abi: None,
+        weft_tag: None,
+        deps: Vec::new(),
+        tag: None,
+        source_repo: None,
+        source_commit: None,
+        icon: None,
+        installed_at: now(),
+        revoked: None,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::super::archive::tests::make_zip;
+    use super::super::catalog::Origin;
+    use super::super::index::Channel;
+    use super::super::profile::tests::{ABI, build, catalog, catalog_mod, entry, lock};
+    use super::*;
+    use crate::download::sha256_hex;
+    use crate::error::ErrorCode;
+
+    const LINUX: Option<Platform> = Some(Platform::LinuxX64);
+
+    fn write(dir: &Path, name: &str, bytes: &[u8]) -> std::path::PathBuf {
+        let path = dir.join(name);
+        std::fs::write(&path, bytes).unwrap();
+        path
+    }
+
+    #[test]
+    fn a_catalogued_file_shows_its_build() {
+        let tmp = tempfile::tempdir().unwrap();
+        let zip = make_zip(&[
+            ("libcogwork.so", b"elf"),
+            ("assets/lang/en_us.lang", b"mod.cogwork.name = Cogwork\n"),
+        ]);
+        let path = write(tmp.path(), "cogwork.zip", &zip);
+        let mut v = build("cogwork", "0.2.0", ABI, Channel::Release, &[]);
+        v.sha256 = sha256_hex(&zip);
+        let c = catalog(vec![catalog_mod("cogwork", Origin::Index, vec![v])], &[]);
+        let installed = lock(vec![entry("cogwork", &[], Some(ABI))]);
+
+        let got = inspect(&path, &c, Some(ABI), LINUX, &installed).unwrap();
+        assert!(got.problem.is_none());
+        assert!(got.fits_system);
+        assert_eq!(got.name.as_deref(), Some("Cogwork"));
+        assert_eq!(got.replaces.as_deref(), Some("0.1.0"));
+        let found = got.catalog_match.unwrap();
+        assert_eq!(found.fits_version, Some(true));
+        assert_eq!(found.build.trust, Trust::Reviewed);
+        assert_eq!(found.build.version, "0.2.0");
+
+        let elsewhere = inspect(&path, &c, Some("0000000000000000"), None, &lock(vec![])).unwrap();
+        assert!(!elsewhere.fits_system);
+        assert_eq!(elsewhere.catalog_match.unwrap().fits_version, Some(false));
+
+        // Contract R4 §5: an unknown interface is unknown, never "no".
+        let unknown = inspect(&path, &c, None, LINUX, &installed).unwrap();
+        assert_eq!(unknown.catalog_match.unwrap().fits_version, None);
+
+        // A device or a pipe is never read as a mod.
+        #[cfg(unix)]
+        assert!(matches!(
+            checked_size(Path::new("/dev/zero")),
+            Err(ModsError::ArchiveInvalid(_))
+        ));
+    }
+
+    #[test]
+    fn a_file_that_is_not_a_mod_is_described_with_its_problem() {
+        let tmp = tempfile::tempdir().unwrap();
+        let c = catalog(vec![], &[]);
+        let path = write(tmp.path(), "x.zip", &make_zip(&[("run.exe", b"")]));
+        let got = inspect(&path, &c, Some(ABI), LINUX, &lock(vec![])).unwrap();
+        assert!(got.archive.is_none());
+        assert_eq!(got.problem.unwrap().code, ErrorCode::ModArchiveInvalid);
+
+        let path = write(tmp.path(), "base.zip", &make_zip(&[("libbase.so", b"")]));
+        let got = inspect(&path, &c, Some(ABI), LINUX, &lock(vec![])).unwrap();
+        assert_eq!(got.problem.unwrap().code, ErrorCode::ModIdReserved);
+    }
+
+    #[test]
+    fn a_local_entry_is_unverified() {
+        let tmp = tempfile::tempdir().unwrap();
+        let zip = make_zip(&[("libmytweak.so", b"elf")]);
+        let path = write(tmp.path(), "my tweak.zip", &zip);
+        let info = archive::inspect(std::fs::File::open(&path).unwrap(), None).unwrap();
+        let e = local_entry(&info, &path, &path, &sha256_hex(&zip)).unwrap();
+        assert_eq!(e.trust, Trust::Unverified);
+        assert_eq!(e.name, "mytweak");
+        assert!(e.abi.is_none() && e.catalog_key().is_none());
+        assert_eq!(
+            e.origin,
+            Origin::File {
+                name: "my tweak.zip".into()
+            }
+        );
+    }
+}
diff --git a/src-tauri/src/mods/install.rs b/src-tauri/src/mods/install.rs
new file mode 100644
index 0000000..ee5a9b6
--- /dev/null
+++ b/src-tauri/src/mods/install.rs
@@ -0,0 +1,96 @@
+//! Getting a catalogue build into the store: download it through the shared `download.rs`, and
+//! hand it to `store::admit`, which checks its hash and its zip and moves it in under its hash.
+//! Callers reserve the hash first (see `store::Reservations`) and hold it until the lock file
+//! names the build. A download belongs to an [`Operation`] and stops when that is cancelled,
+//! leaving no partial file.
+
+use serde::Serialize;
+use ts_rs::TS;
+
+use super::archive::MAX_FILE_BYTES;
+use super::catalog::{CatalogMod, CatalogVersion};
+use super::context::{Operation, blocking};
+use super::error::ModsError;
+use super::index::{Platform, asset_url_problem};
+use super::paths::Paths;
+use super::store;
+use crate::download;
+
+#[derive(Debug, Clone, Copy, Serialize, PartialEq, Eq, TS)]
+#[serde(rename_all = "camelCase")]
+pub enum ProgressStage {
+    Downloading,
+    Verifying,
+    /// Sent before the profile is rewritten.
+    Installing,
+}
+
+/// The `mod-progress` event.
+#[derive(Debug, Clone, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+pub struct ModProgress {
+    /// The id the page gave the operation this file belongs to.
+    pub operation_id: String,
+    pub sha256: String,
+    pub mod_id: String,
+    pub stage: ProgressStage,
+    pub percent: u32,
+    /// This file's place in the operation, 1-based: file `index` of `count`.
+    pub index: u32,
+    pub count: u32,
+}
+
+/// Downloads one build into the store, unless the store already has it intact. Either way the
+/// store's own checks ([`store::admit`], [`store::admit_stored`]) decide what goes in: a
+/// download that doesn't hash to the pinned SHA-256 never reaches the store. With `check_url`,
+/// a URL that isn't the build's own GitHub release asset is refused before anything is fetched,
+/// whatever the catalogue says. Cancelling `op` stops the download: `ModCancelled`, and the
+/// partial file is gone.
+pub async fn fetch_to_store(
+    paths: &Paths,
+    m: &CatalogMod,
+    v: &CatalogVersion,
+    platform: Option<Platform>,
+    op: &Operation,
+    check_url: bool,
+    mut progress: impl FnMut(ProgressStage, u32),
+) -> Result<(), ModsError> {
+    op.check()?;
+    let admit_stored = {
+        let (paths, sha, id) = (paths.clone(), v.sha256.clone(), m.id.clone());
+        blocking(move || store::admit_stored(&paths, &sha, Some(&id), platform))
+    };
+    if admit_stored.await?.is_some() {
+        return Ok(());
+    }
+    if check_url && let Some(why) = asset_url_problem(&m.id, &v.source_repo, &v.tag, &v.url) {
+        return Err(ModsError::UrlRefused {
+            url: v.url.clone(),
+            why,
+        });
+    }
+    let tmp = store::temp_path(paths, &v.sha256)?;
+    progress(ProgressStage::Downloading, 0);
+    let client = download::client()?;
+    let limit = v.size.saturating_add(1024).min(MAX_FILE_BYTES);
+    let result = {
+        let download = std::pin::pin!(download::to_file(&client, &v.url, &tmp, Some(limit), |p| {
+            progress(ProgressStage::Downloading, p.percent)
+        },));
+        let cancelled = std::pin::pin!(op.cancelled());
+        match futures_util::future::select(download, cancelled).await {
+            futures_util::future::Either::Left((r, _)) => {
+                r.map_err(|e| ModsError::from_download(e, &v.url))
+            }
+            futures_util::future::Either::Right(_) => Err(ModsError::Cancelled),
+        }
+    };
+    if let Err(e) = result.and_then(|_| op.check()) {
+        let _ = std::fs::remove_file(&tmp);
+        return Err(e);
+    }
+    progress(ProgressStage::Verifying, 100);
+    let (paths, sha, id) = (paths.clone(), v.sha256.clone(), m.id.clone());
+    blocking(move || store::admit(&paths, &tmp, &sha, Some(&id), platform)).await?;
+    Ok(())
+}
diff --git a/src-tauri/src/mods/mod.rs b/src-tauri/src/mods/mod.rs
new file mode 100644
index 0000000..6d03066
--- /dev/null
+++ b/src-tauri/src/mods/mod.rs
@@ -0,0 +1,66 @@
+//! The mod manager: a per-version mod set handed to the game with `--mods`, a signed index of
+//! reviewed mods, GitHub repos as extra sources, and the checks between them and the game.
+//! Design: `docs/mod-manager/PROPOSAL.md`; index contract: `docs/mod-manager/INDEX_FORMAT.md`.
+//!
+//! - Rules on plain data: `plan/` (installs, copies, on/off, removal), `profile.rs` (statuses,
+//!   updates, revocations), `catalog.rs`, `index/` (the contract), `diagnose.rs`.
+//! - Disk and network: `store.rs`, `install.rs`, `inspect.rs`, `sources.rs`, `abi.rs`, all on a
+//!   [`Paths`].
+//! - `service/`: the operations, on a [`Ctx`] (`context.rs`) that holds what they need from the
+//!   app, so they run without it in tests.
+//! - `commands.rs`: the Tauri commands, one call into `service` each.
+
+pub mod abi;
+pub mod archive;
+pub mod catalog;
+pub mod commands;
+pub mod context;
+pub mod diagnose;
+pub mod error;
+pub mod index;
+pub mod inspect;
+pub mod install;
+pub mod paths;
+pub mod plan;
+pub mod profile;
+pub mod service;
+pub mod sources;
+pub mod store;
+pub mod version;
+
+#[cfg(test)]
+mod doc_tests;
+#[cfg(test)]
+mod rules_fixture;
+#[cfg(test)]
+mod service_tests;
+
+pub use context::{Ctx, ModsLock, Operations};
+pub use paths::Paths;
+pub use service::LaunchMods;
+
+use tauri::AppHandle;
+
+/// Before Play: see [`service::prepare_launch`].
+pub async fn prepare_launch(
+    app: &AppHandle,
+    tag: &str,
+) -> Result<LaunchMods, crate::error::AppError> {
+    Ok(service::prepare_launch(&Ctx::of(app)?, tag).await?)
+}
+
+/// Once a version's game has stopped: what was held back while it ran (revocations) is applied.
+pub async fn after_game(app: &AppHandle, tag: &str) {
+    if let Ok(ctx) = Ctx::of(app)
+        && let Err(e) = service::apply_pending(&ctx, tag).await
+    {
+        eprintln!("mods: couldn't apply what waited for {tag} to stop: {e}");
+    }
+}
+
+/// A deleted game version takes its mod set along, under the mods lock.
+pub async fn forget_version(app: &AppHandle, tag: &str) {
+    if let Ok(ctx) = Ctx::of(app) {
+        service::forget_version(&ctx, tag).await;
+    }
+}
diff --git a/src-tauri/src/mods/paths.rs b/src-tauri/src/mods/paths.rs
new file mode 100644
index 0000000..897de00
--- /dev/null
+++ b/src-tauri/src/mods/paths.rs
@@ -0,0 +1,145 @@
+//! Where the mod manager keeps its files, all under the launcher's own data folder:
+//!
+//! ```text
+//! mods/store/<sha256>.zip              every mod file, verified once, named by its hash
+//! mods/sources.json                    GitHub repos the player added as sources
+//! profiles/<tag>/mods/<id>.zip         the turned-on mods of one game version, handed to `--mods`
+//! profiles/<tag>/mods.lock.json        everything installed for that version
+//! profiles/<tag>/removed.json          the last removal, until the next change (for Undo)
+//! cache/mod-index/<n>/index.json(.minisig)   verified index generations; `current` names one
+//! cache/mod-index.state.json           the newest index age ever accepted (rollback protection)
+//! cache/mod-sources/<owner__repo>.json  the last good answer of each source
+//! cache/abi.json                       the mod interface hash of each Weft tag
+//! downloads/mod-<sha256>-<unique>.part a download in progress
+//! ```
+//!
+//! Everything takes a [`Paths`], so tests can point it at a temporary folder.
+
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicU64, Ordering};
+use tauri::{AppHandle, Manager};
+
+use super::error::ModsError;
+use crate::install::validate_name;
+
+#[derive(Debug, Clone)]
+pub struct Paths {
+    root: PathBuf,
+}
+
+impl Paths {
+    pub fn new(root: impl Into<PathBuf>) -> Self {
+        Paths { root: root.into() }
+    }
+
+    /// The launcher's data folder.
+    pub fn of(app: &AppHandle) -> Result<Self, ModsError> {
+        app.path()
+            .app_data_dir()
+            .map(Paths::new)
+            .map_err(|e| ModsError::Io(std::io::Error::other(e)))
+    }
+
+    pub fn store_dir(&self) -> PathBuf {
+        self.root.join("mods").join("store")
+    }
+
+    pub fn store_object(&self, sha256: &str) -> PathBuf {
+        self.store_dir().join(format!("{sha256}.zip"))
+    }
+
+    pub fn sources_file(&self) -> PathBuf {
+        self.root.join("mods").join("sources.json")
+    }
+
+    pub fn profiles_dir(&self) -> PathBuf {
+        self.root.join("profiles")
+    }
+
+    pub fn profile_dir(&self, tag: &str) -> Result<PathBuf, ModsError> {
+        validate_name(tag).map_err(|_| ModsError::InvalidName(tag.to_string()))?;
+        Ok(self.profiles_dir().join(tag))
+    }
+
+    pub fn lock_file(&self, tag: &str) -> Result<PathBuf, ModsError> {
+        Ok(self.profile_dir(tag)?.join(LOCK_FILE))
+    }
+
+    /// The most recent removal from that version, while it can be undone.
+    pub fn removed_file(&self, tag: &str) -> Result<PathBuf, ModsError> {
+        Ok(self.profile_dir(tag)?.join(REMOVED_FILE))
+    }
+
+    pub fn mods_dir(&self, tag: &str) -> Result<PathBuf, ModsError> {
+        Ok(self.profile_dir(tag)?.join("mods"))
+    }
+
+    pub fn cache_dir(&self) -> PathBuf {
+        self.root.join("cache")
+    }
+
+    pub fn downloads_dir(&self) -> PathBuf {
+        self.root.join("downloads")
+    }
+
+    pub fn versions_dir(&self) -> PathBuf {
+        self.root.join("versions")
+    }
+
+    /// The game logs the launcher writes, one per version.
+    pub fn logs_dir(&self) -> PathBuf {
+        self.root.join("logs")
+    }
+}
+
+pub const LOCK_FILE: &str = "mods.lock.json";
+pub const REMOVED_FILE: &str = "removed.json";
+
+/// A name no other download or write in this process uses, so two of them never share a file.
+pub fn unique_suffix() -> String {
+    static NEXT: AtomicU64 = AtomicU64::new(0);
+    let n = NEXT.fetch_add(1, Ordering::Relaxed);
+    let nanos = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|d| d.subsec_nanos())
+        .unwrap_or(0);
+    format!("{}-{n}-{nanos:08x}", std::process::id())
+}
+
+/// Writes through a temporary file, so a crash never leaves half a file behind.
+pub fn write_atomic(path: &Path, bytes: &[u8]) -> Result<(), ModsError> {
+    if let Some(parent) = path.parent() {
+        std::fs::create_dir_all(parent)?;
+    }
+    let name = path
+        .file_name()
+        .map(|n| n.to_string_lossy().to_string())
+        .unwrap_or_default();
+    let tmp = path.with_file_name(format!(".{name}.{}.tmp", unique_suffix()));
+    let result = (|| -> std::io::Result<()> {
+        use std::io::Write;
+        let mut file = std::fs::File::create(&tmp)?;
+        file.write_all(bytes)?;
+        file.sync_all()?;
+        std::fs::rename(&tmp, path)?;
+        sync_dir(path.parent());
+        Ok(())
+    })();
+    if result.is_err() {
+        let _ = std::fs::remove_file(&tmp);
+    }
+    Ok(result?)
+}
+
+/// So the rename itself survives a power cut. Only where a folder can be opened and synced:
+/// Windows makes the rename durable on its own.
+pub(crate) fn sync_dir(dir: Option<&Path>) {
+    #[cfg(unix)]
+    if let Some(dir) = dir
+        && let Ok(d) = std::fs::File::open(dir)
+    {
+        let _ = d.sync_all();
+    }
+    #[cfg(not(unix))]
+    let _ = dir;
+}
diff --git a/src-tauri/src/mods/plan/consent.rs b/src-tauri/src/mods/plan/consent.rs
new file mode 100644
index 0000000..cb6aefe
--- /dev/null
+++ b/src-tauri/src/mods/plan/consent.rs
@@ -0,0 +1,124 @@
+//! What the player agrees to, as a token, and whether a plan still holds under the lock.
+
+use super::*;
+
+/// What the player agrees to when confirming a plan, as the backend can recompute it: every
+/// build that will be installed (hash and trust), every mod that ends up on, what is turned on,
+/// what is installed off, what is missing, and the version's mod interface. Its [`token`]
+/// (`planToken`) is opaque to the page.
+///
+/// [`token`]: Consent::token
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Consent {
+    abi: Option<String>,
+    wanted: Vec<String>,
+    builds: Vec<String>,
+    on: Vec<String>,
+    enable: Vec<String>,
+    installed_off: Vec<String>,
+    missing: Vec<String>,
+}
+
+fn sorted(mut v: Vec<String>) -> Vec<String> {
+    v.sort();
+    v.dedup();
+    v
+}
+
+impl Consent {
+    pub fn of(abi: Option<&str>, res: &Resolution, out: &Outcome) -> Consent {
+        Consent {
+            abi: abi.map(str::to_string),
+            wanted: sorted(res.wanted.clone()),
+            builds: sorted(
+                res.picks
+                    .iter()
+                    .map(|(m, v)| build_text(&m.id, &v.sha256, v.trust))
+                    .collect(),
+            ),
+            on: out.on.iter().cloned().collect(),
+            enable: sorted(out.enable.clone()),
+            installed_off: sorted(out.installed_off.clone()),
+            missing: sorted(res.missing.clone()),
+        }
+    }
+
+    /// A file that isn't in the catalogue: one Unverified build, on or off.
+    pub fn unverified(abi: Option<&str>, id: &str, sha256: &str, on: bool) -> Consent {
+        Consent {
+            abi: abi.map(str::to_string),
+            wanted: vec![id.to_string()],
+            builds: vec![build_text(id, sha256, Trust::Unverified)],
+            on: if on { vec![id.to_string()] } else { Vec::new() },
+            enable: Vec::new(),
+            installed_off: Vec::new(),
+            missing: Vec::new(),
+        }
+    }
+
+    pub fn token(&self) -> String {
+        let list = |v: &[String]| v.join(",");
+        let text = format!(
+            "weft-plan/1\nabi={}\nwanted={}\nbuilds={}\non={}\nenable={}\noff={}\nmissing={}\n",
+            self.abi.as_deref().unwrap_or("?"),
+            list(&self.wanted),
+            list(&self.builds),
+            list(&self.on),
+            list(&self.enable),
+            list(&self.installed_off),
+            list(&self.missing),
+        );
+        sha256_hex(text.as_bytes())
+    }
+}
+
+fn build_text(id: &str, sha256: &str, trust: Trust) -> String {
+    format!("{id}={}:{trust:?}", sha256.to_ascii_lowercase())
+}
+
+/// The token of a resolution, with the version's mod interface.
+pub fn plan_token(abi: Option<&str>, lock: &Lock, res: &Resolution) -> String {
+    Consent::of(abi, res, &outcome(lock, res)).token()
+}
+
+/// The token of a plan that can't be resolved, because the version's mod interface is unknown.
+pub(super) fn unresolved_token(m: &CatalogMod, v: &CatalogVersion) -> String {
+    let res = Resolution {
+        wanted: vec![m.id.clone()],
+        picks: vec![(m.clone(), v.clone())],
+        installed: Vec::new(),
+        enable: Vec::new(),
+        missing: Vec::new(),
+    };
+    let out = Outcome {
+        on: BTreeSet::new(),
+        enable: Vec::new(),
+        installed_off: Vec::new(),
+    };
+    Consent::of(None, &res, &out).token()
+}
+
+/// Whether a resolution made before a download still describes what committing now would do.
+/// `before` is the lock and resolution the player agreed to; `now` the same against the latest
+/// lock and catalogue. It holds when nothing more needs downloading, nothing more is turned on,
+/// and each wanted mod ends up on or off as agreed. Otherwise, why not.
+pub fn still_holds(before: (&Lock, &Resolution), now: (&Lock, &Resolution)) -> Result<(), String> {
+    let (old_lock, old) = before;
+    let (lock, new) = now;
+    for (m, v) in &new.picks {
+        if !old.picks.iter().any(|(_, o)| o.sha256 == v.sha256) {
+            return Err(format!("{} {} is needed now", m.name, v.version));
+        }
+    }
+    let (was, will) = (outcome(old_lock, old), outcome(lock, new));
+    if let Some(id) = will.enable.iter().find(|id| !was.enable.contains(*id)) {
+        return Err(format!("{} would be turned on too", lock.name_of(id)));
+    }
+    for id in &new.wanted {
+        if was.on.contains(id) != will.on.contains(id) {
+            let state = if will.on.contains(id) { "on" } else { "off" };
+            return Err(format!("{} would end up {state}", lock.name_of(id)));
+        }
+    }
+    Ok(())
+}
diff --git a/src-tauri/src/mods/plan/copies.rs b/src-tauri/src/mods/plan/copies.rs
new file mode 100644
index 0000000..10c7917
--- /dev/null
+++ b/src-tauri/src/mods/plan/copies.rs
@@ -0,0 +1,107 @@
+//! "Copy mods from…": what each turned-on mod of one version gets in another.
+
+use super::*;
+
+#[derive(Debug, Clone, Copy, Serialize, PartialEq, Eq, TS)]
+#[serde(rename_all = "camelCase")]
+pub enum CopyOutcome {
+    /// A build for the new version will be installed.
+    Install,
+    /// The new version already has this mod; it is left as it is.
+    AlreadyThere,
+    /// No build for the new version yet.
+    NoBuild,
+    /// A file from the player's computer: the launcher can't find a build of it.
+    LocalFile,
+    /// The only fitting builds are revoked.
+    Revoked,
+}
+
+#[derive(Debug, Clone, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+pub struct CopyItem {
+    pub id: String,
+    pub name: String,
+    pub outcome: CopyOutcome,
+    /// The build that will be installed (outcome `install`).
+    pub version: Option<String>,
+    pub trust: Option<Trust>,
+    /// That build's hash (outcome `install`).
+    pub sha256: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+pub struct CopyPreview {
+    pub from: String,
+    pub to: String,
+    pub items: Vec<CopyItem>,
+    /// Dependencies of the items that will be downloaded as well.
+    pub deps: Vec<PlanItem>,
+    /// Ids of mods `to` already has, off, that will be turned on.
+    pub enable: Vec<String>,
+    /// Ids of items that will be installed turned off, because something they need is missing.
+    pub installed_off: Vec<String>,
+    /// Ids of dependencies nothing provides for `to`: why `installed_off` are off.
+    pub missing: Vec<String>,
+    /// Pass to `copy_mod_profile`: the digest of what this preview asks the player to agree to.
+    pub plan_token: String,
+}
+
+/// What copying the turned-on mods of `from` into `to` would bring over, each as the build made
+/// for `to`, with what that pulls in, and the builds to install. Mods `to` already has are
+/// skipped.
+pub fn copy_preview(
+    catalog: &Catalog,
+    from: (&str, &Lock),
+    to: (&str, &Lock),
+    fit: Fit<'_>,
+) -> (CopyPreview, Vec<(CatalogMod, CatalogVersion)>) {
+    let mut items = Vec::new();
+    let mut picks = Vec::new();
+    for entry in from.1.mods.iter().filter(|m| m.enabled) {
+        let item = |outcome, pick: Option<&CatalogVersion>| CopyItem {
+            id: entry.id.clone(),
+            name: entry.name.clone(),
+            outcome,
+            version: pick.map(|v| v.version.clone()),
+            trust: pick.map(|v| v.trust),
+            sha256: pick.map(|v| v.sha256.clone()),
+        };
+        if to.1.get(&entry.id).is_some() {
+            items.push(item(CopyOutcome::AlreadyThere, None));
+            continue;
+        }
+        let Some(key) = entry.catalog_key() else {
+            items.push(item(CopyOutcome::LocalFile, None));
+            continue;
+        };
+        let channel = entry.channel.unwrap_or(Channel::Release);
+        if let Some((m, v)) = best_version(catalog, &key, fit, channel) {
+            items.push(item(CopyOutcome::Install, Some(v)));
+            picks.push((m.clone(), v.clone()));
+        } else if fitting(catalog, &key, fit, channel).is_some_and(|(_, vs)| !vs.is_empty()) {
+            items.push(item(CopyOutcome::Revoked, None));
+        } else {
+            items.push(item(CopyOutcome::NoBuild, None));
+        }
+    }
+    let res = resolve(catalog, to.1, picks.clone(), fit);
+    let out = outcome(to.1, &res);
+    let preview = CopyPreview {
+        from: from.0.to_string(),
+        to: to.0.to_string(),
+        items,
+        deps: res
+            .picks
+            .iter()
+            .filter(|(m, _)| !res.wanted.contains(&m.id))
+            .map(|(m, v)| PlanItem::of(m, v))
+            .collect(),
+        plan_token: Consent::of(Some(fit.abi), &res, &out).token(),
+        enable: out.enable,
+        installed_off: out.installed_off,
+        missing: res.missing.clone(),
+    };
+    (preview, picks)
+}
diff --git a/src-tauri/src/mods/plan/mod.rs b/src-tauri/src/mods/plan/mod.rs
new file mode 100644
index 0000000..41a5d47
--- /dev/null
+++ b/src-tauri/src/mods/plan/mod.rs
@@ -0,0 +1,254 @@
+//! The rules for changing a mod set, on plain data: what an install brings along, what a copy
+//! brings over, and what turning a mod on or off or removing it does to the others. Nothing here
+//! touches the disk or the network; `service/` does that around these.
+//!
+//! Dependencies resolve through the whole graph: through the builds an install picks and
+//! through installed mods alike. A wanted mod that needs something no build provides, at any
+//! depth, is installed turned off, so an install never stops Play from working.
+//!
+//! What the player reviews is bound by a [`Consent`] token: the backend recomputes it before
+//! downloading and again at commit, and refuses (`ModChangedMeanwhile`) when it differs.
+
+use serde::Serialize;
+use std::collections::BTreeSet;
+use ts_rs::TS;
+
+use super::catalog::{Catalog, CatalogMod, CatalogVersion, Origin, Trust};
+use super::error::ModsError;
+use super::index::{Channel, RESERVED_ID};
+use super::profile::{BUILTIN, Fit, Lock, LockEntry, ProfileReport, best_version, fitting};
+use crate::download::sha256_hex;
+use crate::error::AppError;
+
+mod consent;
+mod copies;
+mod resolution;
+
+pub use consent::*;
+pub use copies::*;
+pub use resolution::*;
+
+#[derive(Debug, Clone, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+pub struct PlanItem {
+    pub id: String,
+    pub name: String,
+    pub version: String,
+    pub sha256: String,
+    pub trust: Trust,
+    pub channel: Channel,
+    pub size: u64,
+}
+
+impl PlanItem {
+    fn of(m: &CatalogMod, v: &CatalogVersion) -> Self {
+        PlanItem {
+            id: m.id.clone(),
+            name: m.name.clone(),
+            version: v.version.clone(),
+            sha256: v.sha256.clone(),
+            trust: v.trust,
+            channel: v.channel,
+            size: v.size,
+        }
+    }
+}
+
+/// The installed mod an install would replace.
+#[derive(Debug, Clone, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+pub struct PlanReplaces {
+    pub version: Option<String>,
+    pub sha256: String,
+    pub trust: Trust,
+    pub enabled: bool,
+}
+
+/// What `install_mod(tag, sha256)` would do, without doing it.
+#[derive(Debug, Clone, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+pub struct InstallPlan {
+    pub target: PlanItem,
+    pub replaces: Option<PlanReplaces>,
+    /// Dependencies that will be downloaded.
+    pub install: Vec<PlanItem>,
+    /// Ids of installed dependencies that will be turned on.
+    pub enable: Vec<String>,
+    /// Dependency ids with no fitting, non-revoked build.
+    pub missing: Vec<String>,
+    /// Whether the target is on after this install: it is new or on now, and nothing it needs,
+    /// at any depth, is missing. With something missing it is installed turned off. False when
+    /// the version's mod interface is unknown: then nothing can be resolved.
+    pub turns_on: bool,
+    /// Whether the target is built for the version's mod interface; null when that is unknown.
+    pub fits_version: Option<bool>,
+    /// Why the install would fail, if it would.
+    pub problem: Option<AppError>,
+    /// Pass to `install_mod`: the digest of what this plan asks the player to agree to.
+    pub plan_token: String,
+}
+
+/// What a change did, with the profile as it is now. All lists hold mod ids.
+#[derive(Debug, Clone, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+pub struct ChangeResult {
+    pub report: ProfileReport,
+    /// Mods downloaded or replaced by this change, dependencies included.
+    pub installed: Vec<String>,
+    /// Installed mods turned on because something needs them.
+    pub also_enabled: Vec<String>,
+    /// Mods turned off because what they need went away.
+    pub also_disabled: Vec<String>,
+    /// Dependencies nothing in the catalogue provides for this version.
+    pub missing: Vec<String>,
+    /// Mods this change installed turned off, because something they need is missing.
+    pub installed_off: Vec<String>,
+    /// The id of the mod this change removed, while `restore_mod` can still bring it back.
+    pub undo: Option<String>,
+}
+
+impl ChangeResult {
+    /// A change that did nothing beyond what the report shows.
+    pub fn of(report: ProfileReport) -> Self {
+        ChangeResult {
+            report,
+            installed: Vec::new(),
+            also_enabled: Vec::new(),
+            also_disabled: Vec::new(),
+            missing: Vec::new(),
+            installed_off: Vec::new(),
+            undo: None,
+        }
+    }
+}
+
+/// What a copy did; `left_behind` are the turned-on mods of the old version that weren't
+/// brought over, and why.
+#[derive(Debug, Clone, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+pub struct CopyResult {
+    #[serde(flatten)]
+    pub change: ChangeResult,
+    pub left_behind: Vec<CopyItem>,
+}
+
+/// The plan for installing the catalogue build `sha256` into game version `tag`. `fit` is `None`
+/// when the version's mod interface is unknown; `running` when that version's game is running.
+pub fn plan_install(
+    catalog: &Catalog,
+    lock: &Lock,
+    tag: &str,
+    sha256: &str,
+    fit: Option<Fit<'_>>,
+    running: bool,
+) -> Result<InstallPlan, ModsError> {
+    let (m, v) = catalog
+        .find(sha256)
+        .ok_or_else(|| ModsError::NotInCatalog(sha256.to_string()))?;
+    let replaces = lock.get(&m.id).map(|e| PlanReplaces {
+        version: e.version.clone(),
+        sha256: e.sha256.clone(),
+        trust: e.trust,
+        enabled: e.enabled,
+    });
+    let mut plan = InstallPlan {
+        target: PlanItem::of(m, v),
+        turns_on: false,
+        replaces,
+        install: Vec::new(),
+        enable: Vec::new(),
+        missing: Vec::new(),
+        fits_version: fit.map(|f| v.abi == f.abi),
+        problem: None,
+        plan_token: unresolved_token(m, v),
+    };
+    let Some(fit) = fit else {
+        plan.problem = Some(ModsError::AbiUnavailable(tag.to_string()).into());
+        return Ok(plan);
+    };
+    let res = resolve(catalog, lock, vec![(m.clone(), v.clone())], fit);
+    let out = outcome(lock, &res);
+    plan.plan_token = Consent::of(Some(fit.abi), &res, &out).token();
+    plan.install = res
+        .picks
+        .iter()
+        .filter(|(p, _)| p.id != m.id)
+        .map(|(p, pv)| PlanItem::of(p, pv))
+        .collect();
+    plan.enable = out.enable;
+    plan.turns_on = out.on.contains(&m.id);
+    plan.missing = res.missing;
+    plan.problem = check_installable(catalog, m, v, fit)
+        .err()
+        .or_else(|| running.then(|| ModsError::GameRunning(tag.to_string())))
+        .map(AppError::from);
+    Ok(plan)
+}
+
+/// Turns a mod on or off. On turns on the installed mods it needs, and refuses when it or any of
+/// them is revoked; off turns off what needs it. Returns what else changed.
+pub fn set_enabled(
+    lock: &mut Lock,
+    catalog: &Catalog,
+    id: &str,
+    enabled: bool,
+) -> Result<(Vec<String>, Vec<String>), ModsError> {
+    let entry = lock
+        .get(id)
+        .ok_or_else(|| ModsError::NotInstalled(id.to_string()))?;
+    let revoked = |e: &LockEntry| {
+        e.is_revoked(catalog).then(|| {
+            let reason = e
+                .revoked_reason(catalog)
+                .unwrap_or_else(|| "no reason given".into());
+            ModsError::Revoked(format!("{}: {reason}", e.name))
+        })
+    };
+    let (mut also_enabled, mut also_disabled) = (Vec::new(), Vec::new());
+    if enabled {
+        if let Some(e) = revoked(entry) {
+            return Err(e);
+        }
+        let deps = lock.deps_of(id);
+        if let Some(e) = deps.iter().filter_map(|d| lock.get(d)).find_map(revoked) {
+            return Err(e);
+        }
+        for dep in deps {
+            if let Some(d) = lock.get_mut(&dep)
+                && !d.enabled
+            {
+                d.enabled = true;
+                also_enabled.push(dep);
+            }
+        }
+    } else {
+        for dependent in lock.dependents_of(id) {
+            if let Some(d) = lock.get_mut(&dependent) {
+                d.enabled = false;
+                also_disabled.push(dependent);
+            }
+        }
+    }
+    if let Some(e) = lock.get_mut(id) {
+        e.enabled = enabled;
+    }
+    Ok((also_enabled, also_disabled))
+}
+
+/// Removes a mod and turns off what needed it. Returns those.
+pub fn remove(lock: &mut Lock, id: &str) -> Result<Vec<String>, ModsError> {
+    if lock.get(id).is_none() {
+        return Err(ModsError::NotInstalled(id.to_string()));
+    }
+    let also_disabled = lock.dependents_of(id);
+    for dependent in &also_disabled {
+        if let Some(d) = lock.get_mut(dependent) {
+            d.enabled = false;
+        }
+    }
+    lock.mods.retain(|m| m.id != id);
+    Ok(also_disabled)
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/src-tauri/src/mods/plan/resolution.rs b/src-tauri/src/mods/plan/resolution.rs
new file mode 100644
index 0000000..b5f1fc6
--- /dev/null
+++ b/src-tauri/src/mods/plan/resolution.rs
@@ -0,0 +1,250 @@
+//! What an install brings: the builds it needs, transitively, and what is missing; whether a
+//! build can be installed at all; and the set it leaves.
+
+use super::*;
+
+/// Whether this build may be installed here at all.
+pub fn check_installable(
+    catalog: &Catalog,
+    m: &CatalogMod,
+    v: &CatalogVersion,
+    fit: Fit<'_>,
+) -> Result<(), ModsError> {
+    if m.id == RESERVED_ID {
+        return Err(ModsError::IdReserved(m.id.clone()));
+    }
+    if let Some(r) = catalog.revocation(&v.sha256) {
+        return Err(ModsError::Revoked(format!("{}: {}", m.name, r.detail())));
+    }
+    if !fit.platform_ok(v) {
+        return Err(ModsError::NotForPlatform(m.name.clone()));
+    }
+    if v.abi != fit.abi {
+        return Err(ModsError::Incompatible(m.name.clone()));
+    }
+    Ok(())
+}
+
+/// The builds to download for a change, and what else it turns on.
+#[derive(Debug, Clone)]
+pub struct Resolution {
+    /// The mods asked for, by id.
+    pub wanted: Vec<String>,
+    /// The wanted builds first, then the dependencies they pull in.
+    pub picks: Vec<(CatalogMod, CatalogVersion)>,
+    /// Installed mods the graph goes through, on or off, with what they need.
+    pub installed: Vec<(String, Vec<String>)>,
+    /// Installed dependencies that are off and would be turned on.
+    pub enable: Vec<String>,
+    pub missing: Vec<String>,
+}
+
+/// A mod the resolution walks through: a build it picks, or an installed mod.
+enum Node {
+    Pick(Box<(CatalogMod, CatalogVersion)>),
+    Have(String),
+}
+
+/// The requested builds plus whatever they need that isn't on yet, through the whole graph. A
+/// dependency that is installed, fits and isn't revoked is used (and turned on if off), and what
+/// it needs is resolved in turn. Otherwise it comes from the index first, then from the same
+/// source as the mod that needs it, and a revoked build is never picked: with nothing else, the
+/// dependency is missing.
+pub fn resolve(
+    catalog: &Catalog,
+    lock: &Lock,
+    wanted: Vec<(CatalogMod, CatalogVersion)>,
+    fit: Fit<'_>,
+) -> Resolution {
+    let mut res = Resolution {
+        wanted: wanted.iter().map(|(m, _)| m.id.clone()).collect(),
+        picks: Vec::new(),
+        installed: Vec::new(),
+        enable: Vec::new(),
+        missing: Vec::new(),
+    };
+    let node_id = |n: &Node| match n {
+        Node::Pick(p) => p.0.id.clone(),
+        Node::Have(id) => id.clone(),
+    };
+    let mut todo: std::collections::VecDeque<Node> = wanted
+        .into_iter()
+        .map(|p| Node::Pick(Box::new(p)))
+        .collect();
+    while let Some(node) = todo.pop_front() {
+        let id = node_id(&node);
+        if res.picks.iter().any(|(p, _)| p.id == id) || res.installed.iter().any(|(i, _)| *i == id)
+        {
+            continue;
+        }
+        let (deps, origin, channel) = match &node {
+            Node::Pick(p) => (p.1.deps.clone(), p.0.origin.clone(), p.1.channel),
+            Node::Have(id) => {
+                let e = lock.get(id).expect("an installed node is in the lock");
+                (
+                    e.deps.clone(),
+                    e.origin.clone(),
+                    e.channel.unwrap_or(Channel::Release),
+                )
+            }
+        };
+        for dep in &deps {
+            if BUILTIN.contains(&dep.as_str())
+                || res.picks.iter().any(|(p, _)| &p.id == dep)
+                || res.installed.iter().any(|(i, _)| i == dep)
+                || todo.iter().any(|n| &node_id(n) == dep)
+                || res.missing.contains(dep)
+            {
+                continue;
+            }
+            if let Some(have) = lock.get(dep)
+                && have.abi.as_deref().is_none_or(|a| a == fit.abi)
+                && !have.is_revoked(catalog)
+            {
+                if !have.enabled && !res.enable.contains(dep) {
+                    res.enable.push(dep.clone());
+                }
+                todo.push_back(Node::Have(dep.clone()));
+                continue;
+            }
+            let mut keys = vec![format!("index:{dep}")];
+            if let Origin::Source { repo } = &origin {
+                keys.push(format!("source:{repo}:{dep}"));
+            }
+            match keys
+                .iter()
+                .find_map(|k| best_version(catalog, k, fit, channel))
+            {
+                Some((dm, dv)) => todo.push_back(Node::Pick(Box::new((dm.clone(), dv.clone())))),
+                None => res.missing.push(dep.clone()),
+            }
+        }
+        match node {
+            Node::Pick(p) => res.picks.push(*p),
+            Node::Have(id) => res.installed.push((id, deps)),
+        }
+    }
+    res
+}
+
+impl Resolution {
+    /// What `id` needs: its picked build's dependencies, else the installed mod's.
+    fn deps_of(&self, id: &str) -> &[String] {
+        self.picks
+            .iter()
+            .find(|(m, _)| m.id == id)
+            .map(|(_, v)| v.deps.as_slice())
+            .or_else(|| {
+                self.installed
+                    .iter()
+                    .find(|(i, _)| i == id)
+                    .map(|(_, d)| d.as_slice())
+            })
+            .unwrap_or(&[])
+    }
+
+    /// Whether the graph goes through `id`, as a pick or an installed mod.
+    fn has_node(&self, id: &str) -> bool {
+        self.picks.iter().any(|(m, _)| m.id == id) || self.installed.iter().any(|(i, _)| i == id)
+    }
+
+    /// Whether `id`, through the whole graph, needs something missing.
+    fn needs_missing(&self, id: &str) -> bool {
+        let mut seen = BTreeSet::new();
+        let mut todo = vec![id.to_string()];
+        while let Some(next) = todo.pop() {
+            if !seen.insert(next.clone()) {
+                continue;
+            }
+            for dep in self.deps_of(&next) {
+                if self.missing.contains(dep) {
+                    return true;
+                }
+                todo.push(dep.clone());
+            }
+        }
+        false
+    }
+}
+
+/// What committing a resolution to a lock does to on and off.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Outcome {
+    /// Picked and installed mods that end up on because a wanted mod that ends up on needs them,
+    /// and those wanted mods.
+    pub on: BTreeSet<String>,
+    /// Installed mods that are off and are turned on.
+    pub enable: Vec<String>,
+    /// Wanted mods that are installed turned off, because something they need is missing.
+    pub installed_off: Vec<String>,
+}
+
+/// A wanted mod ends up on when it is new or on now, and needs nothing missing; what it needs
+/// ends up on with it. A wanted mod that is off stays off after an update, and so does what it
+/// brings along.
+pub fn outcome(lock: &Lock, res: &Resolution) -> Outcome {
+    let mut installed_off = Vec::new();
+    let mut todo = Vec::new();
+    for id in &res.wanted {
+        if res.needs_missing(id) {
+            installed_off.push(id.clone());
+        } else if lock.get(id).is_none_or(|e| e.enabled) {
+            todo.push(id.clone());
+        }
+    }
+    let mut on = BTreeSet::new();
+    while let Some(id) = todo.pop() {
+        if !on.insert(id.clone()) {
+            continue;
+        }
+        for dep in res.deps_of(&id) {
+            if res.has_node(dep) {
+                todo.push(dep.clone());
+            }
+        }
+    }
+    let enable = res
+        .enable
+        .iter()
+        .filter(|id| on.contains(*id))
+        .cloned()
+        .collect();
+    Outcome {
+        on,
+        enable,
+        installed_off,
+    }
+}
+
+pub struct Committed {
+    pub installed: Vec<String>,
+    pub also_enabled: Vec<String>,
+    pub installed_off: Vec<String>,
+}
+
+/// Writes a resolution into the lock, following [`outcome`].
+pub fn commit(lock: &mut Lock, res: &Resolution) -> Committed {
+    let out = outcome(lock, res);
+    let mut installed = Vec::new();
+    for (m, v) in &res.picks {
+        let was_on = lock.get(&m.id).is_some_and(|e| e.enabled);
+        let wanted = res.wanted.contains(&m.id);
+        let enabled = out.on.contains(&m.id) || (!wanted && was_on);
+        lock.put(LockEntry::from_catalog(m, v, enabled));
+        installed.push(m.id.clone());
+    }
+    let mut also_enabled = Vec::new();
+    for id in &out.enable {
+        if let Some(e) = lock.get_mut(id)
+            && !e.enabled
+        {
+            e.enabled = true;
+            also_enabled.push(id.clone());
+        }
+    }
+    Committed {
+        installed,
+        also_enabled,
+        installed_off: out.installed_off,
+    }
+}
diff --git a/src-tauri/src/mods/plan/tests.rs b/src-tauri/src/mods/plan/tests.rs
new file mode 100644
index 0000000..713016a
--- /dev/null
+++ b/src-tauri/src/mods/plan/tests.rs
@@ -0,0 +1,694 @@
+use super::super::profile::tests::{
+    ABI, OLD_ABI, build, catalog, catalog_mod, entry, fit, lock, sha,
+};
+use super::*;
+use crate::error::ErrorCode;
+
+const REL: Channel = Channel::Release;
+const PRE: Channel = Channel::Prerelease;
+
+fn source() -> Origin {
+    Origin::Source {
+        repo: "Someone/Lanterns".into(),
+    }
+}
+
+/// cogwork needs showcase; lanterns (a source) needs glow, which only its source has;
+/// shiny needs rcdep, which only has a prerelease; bad needs pulled, which is revoked.
+fn world() -> Catalog {
+    catalog(
+        vec![
+            catalog_mod(
+                "cogwork",
+                Origin::Index,
+                vec![
+                    build("cogwork", "0.2.0", ABI, REL, &["base", "showcase"]),
+                    build("cogwork", "0.1.0", OLD_ABI, REL, &["showcase"]),
+                ],
+            ),
+            catalog_mod(
+                "showcase",
+                Origin::Index,
+                vec![build("showcase", "0.1.0", ABI, REL, &[])],
+            ),
+            catalog_mod(
+                "lanterns",
+                source(),
+                vec![build("lanterns", "1.0.0", ABI, REL, &["glow"])],
+            ),
+            catalog_mod(
+                "glow",
+                source(),
+                vec![build("glow", "1.0.0", ABI, REL, &[])],
+            ),
+            catalog_mod(
+                "shiny",
+                Origin::Index,
+                vec![
+                    build("shiny", "1.0.0", ABI, REL, &["rcdep"]),
+                    build("shiny", "1.1.0-rc.1", ABI, PRE, &["rcdep"]),
+                ],
+            ),
+            catalog_mod(
+                "rcdep",
+                Origin::Index,
+                vec![build("rcdep", "0.1.0-rc.1", ABI, PRE, &[])],
+            ),
+            catalog_mod(
+                "bad",
+                Origin::Index,
+                vec![build("bad", "1.0.0", ABI, REL, &["pulled"])],
+            ),
+            catalog_mod(
+                "pulled",
+                Origin::Index,
+                vec![build("pulled", "1.0.0", ABI, REL, &[])],
+            ),
+            catalog_mod(
+                "base",
+                Origin::Index,
+                vec![build("base", "1.0.0", ABI, REL, &[])],
+            ),
+        ],
+        &[&sha("pulled", "1.0.0")],
+    )
+}
+
+fn ids(items: &[PlanItem]) -> Vec<&str> {
+    items.iter().map(|i| i.id.as_str()).collect()
+}
+
+#[test]
+fn plans() {
+    let c = world();
+    let installed_off = |id: &str| {
+        let mut e = entry(id, &[], Some(ABI));
+        e.enabled = false;
+        e
+    };
+    let mut pulled_installed = entry("pulled", &[], Some(ABI));
+    pulled_installed.sha256 = sha("pulled", "1.0.0");
+    struct Case {
+        what: &'static str,
+        sha: String,
+        lock: Lock,
+        install: &'static [&'static str],
+        enable: &'static [&'static str],
+        missing: &'static [&'static str],
+        problem: Option<ErrorCode>,
+    }
+    let cases = [
+        Case {
+            what: "dependency from the index is installed",
+            sha: sha("cogwork", "0.2.0"),
+            lock: lock(vec![]),
+            install: &["showcase"],
+            enable: &[],
+            missing: &[],
+            problem: None,
+        },
+        Case {
+            what: "installed dependency that is off is turned on",
+            sha: sha("cogwork", "0.2.0"),
+            lock: lock(vec![installed_off("showcase")]),
+            install: &[],
+            enable: &["showcase"],
+            missing: &[],
+            problem: None,
+        },
+        Case {
+            what: "dependency from the same source",
+            sha: sha("lanterns", "1.0.0"),
+            lock: lock(vec![]),
+            install: &["glow"],
+            enable: &[],
+            missing: &[],
+            problem: None,
+        },
+        Case {
+            what: "a release never pulls in a prerelease dependency",
+            sha: sha("shiny", "1.0.0"),
+            lock: lock(vec![]),
+            install: &[],
+            enable: &[],
+            missing: &["rcdep"],
+            problem: None,
+        },
+        Case {
+            what: "a prerelease may",
+            sha: sha("shiny", "1.1.0-rc.1"),
+            lock: lock(vec![]),
+            install: &["rcdep"],
+            enable: &[],
+            missing: &[],
+            problem: None,
+        },
+        Case {
+            what: "a revoked dependency is missing, not installed",
+            sha: sha("bad", "1.0.0"),
+            lock: lock(vec![]),
+            install: &[],
+            enable: &[],
+            missing: &["pulled"],
+            problem: None,
+        },
+        Case {
+            what: "an installed revoked dependency doesn't count",
+            sha: sha("bad", "1.0.0"),
+            lock: lock(vec![pulled_installed]),
+            install: &[],
+            enable: &[],
+            missing: &["pulled"],
+            problem: None,
+        },
+        Case {
+            what: "a build for another version (its dependencies are still listed)",
+            sha: sha("cogwork", "0.1.0"),
+            lock: lock(vec![]),
+            install: &["showcase"],
+            enable: &[],
+            missing: &[],
+            problem: Some(ErrorCode::ModIncompatible),
+        },
+        Case {
+            what: "a revoked build",
+            sha: sha("pulled", "1.0.0"),
+            lock: lock(vec![]),
+            install: &[],
+            enable: &[],
+            missing: &[],
+            problem: Some(ErrorCode::ModRevoked),
+        },
+        Case {
+            what: "the reserved id",
+            sha: sha("base", "1.0.0"),
+            lock: lock(vec![]),
+            install: &[],
+            enable: &[],
+            missing: &[],
+            problem: Some(ErrorCode::ModIdReserved),
+        },
+    ];
+    for case in cases {
+        let plan = plan_install(&c, &case.lock, "v1", &case.sha, Some(fit()), false).unwrap();
+        assert_eq!(ids(&plan.install), case.install, "{}", case.what);
+        assert_eq!(plan.enable, case.enable, "{}", case.what);
+        assert_eq!(plan.missing, case.missing, "{}", case.what);
+        assert_eq!(plan.problem.map(|p| p.code), case.problem, "{}", case.what);
+    }
+}
+
+#[test]
+fn plan_problems_and_replacement() {
+    let c = world();
+    let target = sha("cogwork", "0.2.0");
+    let plan = plan_install(&c, &lock(vec![]), "v1", &target, None, false).unwrap();
+    assert_eq!(plan.problem.unwrap().code, ErrorCode::AbiUnavailable);
+
+    let plan = plan_install(&c, &lock(vec![]), "v1", &target, Some(fit()), true).unwrap();
+    assert_eq!(plan.problem.unwrap().code, ErrorCode::GameRunning);
+
+    let mut old = entry("cogwork", &["showcase"], Some(OLD_ABI));
+    old.enabled = false;
+    old.trust = Trust::Unreviewed;
+    let plan = plan_install(&c, &lock(vec![old]), "v1", &target, Some(fit()), false).unwrap();
+    let replaces = plan.replaces.unwrap();
+    assert!(!replaces.enabled);
+    assert_eq!(replaces.trust, Trust::Unreviewed);
+    assert_eq!(ids(&plan.install), ["showcase"]);
+    assert!(
+        plan.enable.is_empty(),
+        "nothing turns on for a mod that stays off"
+    );
+
+    assert!(matches!(
+        plan_install(&c, &lock(vec![]), "v1", &"0".repeat(64), Some(fit()), false),
+        Err(ModsError::NotInCatalog(_))
+    ));
+}
+
+#[test]
+fn an_update_keeps_the_on_off_state() {
+    let c = world();
+    let pick = |id: &str, v: &str| {
+        let (m, v) = c.find(&sha(id, v)).unwrap();
+        (m.clone(), v.clone())
+    };
+    let mut off = entry("cogwork", &["showcase"], Some(OLD_ABI));
+    off.enabled = false;
+    let mut l = lock(vec![off]);
+    let res = resolve(&c, &l, vec![pick("cogwork", "0.2.0")], fit());
+    let done = commit(&mut l, &res);
+    assert_eq!(done.installed, ["cogwork", "showcase"]);
+    assert!(!l.get("cogwork").unwrap().enabled, "off stays off");
+    assert!(
+        !l.get("showcase").unwrap().enabled,
+        "its new dependency too"
+    );
+    assert_eq!(l.get("cogwork").unwrap().version.as_deref(), Some("0.2.0"));
+
+    let mut l = lock(vec![entry("cogwork", &["showcase"], Some(OLD_ABI))]);
+    let res = resolve(&c, &l, vec![pick("cogwork", "0.2.0")], fit());
+    commit(&mut l, &res);
+    assert!(l.get("cogwork").unwrap().enabled, "on stays on");
+    assert!(l.get("showcase").unwrap().enabled);
+
+    let mut showcase_off = entry("showcase", &[], Some(ABI));
+    showcase_off.enabled = false;
+    let mut l = lock(vec![showcase_off]);
+    let res = resolve(&c, &l, vec![pick("cogwork", "0.2.0")], fit());
+    let done = commit(&mut l, &res);
+    assert!(l.get("cogwork").unwrap().enabled, "a new install is on");
+    assert_eq!(done.also_enabled, ["showcase"]);
+}
+
+#[test]
+fn the_enable_cascade() {
+    let c = catalog(vec![], &[&sha("b", "0.1.0")]);
+    let off = |id: &str, deps: &[&str]| {
+        let mut e = entry(id, deps, Some(ABI));
+        e.enabled = false;
+        e
+    };
+    // a needs c needs d: turning a on turns both on.
+    let mut l = lock(vec![off("a", &["c"]), off("c", &["d"]), off("d", &[])]);
+    let (on, off_) = set_enabled(&mut l, &c, "a", true).unwrap();
+    let mut on = on;
+    on.sort();
+    assert_eq!(on, ["c", "d"]);
+    assert!(off_.is_empty());
+
+    // Turning d off turns off everything that needs it.
+    let (_, mut gone) = set_enabled(&mut l, &c, "d", false).unwrap();
+    gone.sort();
+    assert_eq!(gone, ["a", "c"]);
+
+    // e needs the revoked b: refused, and nothing changes.
+    let mut l = lock(vec![off("e", &["b"]), off("b", &[])]);
+    let err = set_enabled(&mut l, &c, "e", true).unwrap_err();
+    assert!(matches!(err, ModsError::Revoked(ref d) if d.starts_with("b name")));
+    assert!(!l.get("e").unwrap().enabled && !l.get("b").unwrap().enabled);
+    assert!(matches!(
+        set_enabled(&mut l, &c, "b", true),
+        Err(ModsError::Revoked(_))
+    ));
+    assert!(matches!(
+        set_enabled(&mut l, &c, "zzz", true),
+        Err(ModsError::NotInstalled(_))
+    ));
+}
+
+#[test]
+fn removing_turns_off_what_needed_it() {
+    let mut l = lock(vec![
+        entry("a", &["b"], Some(ABI)),
+        entry("b", &[], Some(ABI)),
+    ]);
+    assert_eq!(remove(&mut l, "b").unwrap(), ["a"]);
+    assert!(l.get("b").is_none());
+    assert!(!l.get("a").unwrap().enabled);
+    assert!(remove(&mut l, "b").is_err());
+}
+
+#[test]
+fn copy_preview_outcomes() {
+    let c = world();
+    let mut local = entry("mytweak", &[], None);
+    local.origin = Origin::File {
+        name: "t.zip".into(),
+    };
+    let mut lanterns = entry("lanterns", &["glow"], Some(OLD_ABI));
+    lanterns.origin = Origin::Source {
+        repo: "someone/lanterns".into(),
+    };
+    let mut off = entry("shiny", &[], Some(OLD_ABI));
+    off.enabled = false;
+    let from = lock(vec![
+        entry("cogwork", &["showcase"], Some(OLD_ABI)),
+        entry("showcase", &[], Some(OLD_ABI)),
+        entry("nobuild", &[], Some(OLD_ABI)),
+        local,
+        entry("pulled", &[], Some(OLD_ABI)),
+        lanterns,
+        off,
+    ]);
+    let to = lock(vec![entry("showcase", &[], Some(ABI))]);
+    let (preview, picks) = copy_preview(&c, ("v1", &from), ("v2", &to), fit());
+    let outcome = |id: &str| {
+        preview
+            .items
+            .iter()
+            .find(|i| i.id == id)
+            .map(|i| (i.outcome, i.version.clone()))
+    };
+    assert_eq!(
+        outcome("cogwork"),
+        Some((CopyOutcome::Install, Some("0.2.0".into())))
+    );
+    assert_eq!(outcome("showcase"), Some((CopyOutcome::AlreadyThere, None)));
+    assert_eq!(outcome("nobuild"), Some((CopyOutcome::NoBuild, None)));
+    assert_eq!(outcome("mytweak"), Some((CopyOutcome::LocalFile, None)));
+    assert_eq!(outcome("pulled"), Some((CopyOutcome::Revoked, None)));
+    assert_eq!(
+        outcome("lanterns"),
+        Some((CopyOutcome::Install, Some("1.0.0".into())))
+    );
+    assert_eq!(outcome("shiny"), None, "only turned-on mods are copied");
+    let picked: Vec<&str> = picks.iter().map(|(m, _)| m.id.as_str()).collect();
+    assert_eq!(picked, ["cogwork", "lanterns"]);
+    assert_eq!(preview.items[0].trust, Some(Trust::Reviewed));
+    // What the items pull in: glow from the lanterns source; showcase is already there.
+    assert_eq!(ids(&preview.deps), ["glow"]);
+    assert!(preview.enable.is_empty() && preview.installed_off.is_empty());
+}
+
+#[test]
+fn a_copy_lists_what_it_turns_on_and_what_stays_off() {
+    let c = world();
+    let from = lock(vec![
+        entry("cogwork", &["showcase"], Some(OLD_ABI)),
+        entry("shiny", &["rcdep"], Some(OLD_ABI)),
+    ]);
+    let mut showcase_off = entry("showcase", &[], Some(ABI));
+    showcase_off.enabled = false;
+    let to = lock(vec![showcase_off]);
+    let (preview, picks) = copy_preview(&c, ("v1", &from), ("v2", &to), fit());
+    assert_eq!(preview.enable, ["showcase"]);
+    assert_eq!(
+        preview.installed_off,
+        ["shiny"],
+        "rcdep has only a prerelease"
+    );
+
+    let mut l = to.clone();
+    let done = commit(&mut l, &resolve(&c, &to, picks, fit()));
+    assert!(l.get("cogwork").unwrap().enabled && l.get("showcase").unwrap().enabled);
+    assert!(!l.get("shiny").unwrap().enabled);
+    assert_eq!(done.installed_off, ["shiny"]);
+    assert_eq!(done.also_enabled, ["showcase"]);
+}
+
+/// `turnsOn = (replaces === null || replaces.enabled) && missing.length === 0`, and the
+/// commit does what the plan said.
+#[test]
+fn turns_on_rules() {
+    let c = world();
+    let off = |id: &str, deps: &[&str]| {
+        let mut e = entry(id, deps, Some(OLD_ABI));
+        e.enabled = false;
+        e
+    };
+    let mut showcase_off = entry("showcase", &[], Some(ABI));
+    showcase_off.enabled = false;
+    // What, lock, build, turns on, installed off, also enabled.
+    type Case<'a> = (&'a str, Lock, String, bool, &'a [&'a str], &'a [&'a str]);
+    let cases: Vec<Case> = vec![
+        (
+            "new, nothing missing",
+            lock(vec![]),
+            sha("cogwork", "0.2.0"),
+            true,
+            &[],
+            &[],
+        ),
+        (
+            "new, a dependency is missing",
+            lock(vec![]),
+            sha("shiny", "1.0.0"),
+            false,
+            &["shiny"],
+            &[],
+        ),
+        (
+            "an update of a mod that is on, a dependency missing",
+            lock(vec![entry("shiny", &["rcdep"], Some(OLD_ABI))]),
+            sha("shiny", "1.0.0"),
+            false,
+            &["shiny"],
+            &[],
+        ),
+        (
+            "an update of a mod that is off",
+            lock(vec![off("cogwork", &["showcase"])]),
+            sha("cogwork", "0.2.0"),
+            false,
+            &[],
+            &[],
+        ),
+        (
+            "a dependency that is off is turned on",
+            lock(vec![showcase_off.clone()]),
+            sha("cogwork", "0.2.0"),
+            true,
+            &[],
+            &["showcase"],
+        ),
+        (
+            "but not for a mod installed turned off",
+            lock(vec![showcase_off, entry("rcdep", &[], Some(OLD_ABI))]),
+            sha("bad", "1.0.0"),
+            false,
+            &["bad"],
+            &[],
+        ),
+    ];
+    for (what, l, build, turns_on, off_ids, enabled) in cases {
+        let plan = plan_install(&c, &l, "v1", &build, Some(fit()), false).unwrap();
+        assert_eq!(plan.turns_on, turns_on, "{what}: plan");
+        assert_eq!(plan.enable, enabled, "{what}: plan enables");
+        let rule = plan.replaces.as_ref().is_none_or(|r| r.enabled) && plan.missing.is_empty();
+        assert_eq!(plan.turns_on, rule, "{what}: the contract's rule");
+
+        let (m, v) = c.find(&build).unwrap();
+        let mut after = l.clone();
+        let res = resolve(&c, &l, vec![(m.clone(), v.clone())], fit());
+        let done = commit(&mut after, &res);
+        let target = after.get(&m.id).unwrap();
+        assert_eq!(target.enabled, turns_on, "{what}: committed");
+        assert_eq!(done.installed_off, off_ids, "{what}: installed off");
+        assert_eq!(done.also_enabled, enabled, "{what}: also enabled");
+        for dep in res.picks.iter().filter(|(p, _)| p.id != m.id) {
+            assert_eq!(
+                after.get(&dep.0.id).unwrap().enabled,
+                turns_on,
+                "{what}: {} comes along on or off with it",
+                dep.0.id
+            );
+        }
+    }
+}
+
+#[test]
+fn a_plan_holds_until_the_profile_changes_under_it() {
+    let c = world();
+    let pick = |id: &str, v: &str| {
+        let (m, v) = c.find(&sha(id, v)).unwrap();
+        (m.clone(), v.clone())
+    };
+    let before = lock(vec![]);
+    let res = resolve(&c, &before, vec![pick("cogwork", "0.2.0")], fit());
+    assert!(still_holds((&before, &res), (&before, &res)).is_ok());
+
+    // Showcase got installed meanwhile: less to do, still fine.
+    let with_showcase = lock(vec![entry("showcase", &[], Some(ABI))]);
+    let now = resolve(&c, &with_showcase, vec![pick("cogwork", "0.2.0")], fit());
+    assert!(still_holds((&before, &res), (&with_showcase, &now)).is_ok());
+
+    // Planned with showcase installed, which was removed meanwhile: it needs downloading.
+    let res = resolve(&c, &with_showcase, vec![pick("cogwork", "0.2.0")], fit());
+    let now = resolve(&c, &before, vec![pick("cogwork", "0.2.0")], fit());
+    let why = still_holds((&with_showcase, &res), (&before, &now)).unwrap_err();
+    assert!(why.contains("showcase"), "{why}");
+
+    // Showcase was turned off meanwhile: committing would turn it on unasked.
+    let mut showcase_off = with_showcase.clone();
+    showcase_off.get_mut("showcase").unwrap().enabled = false;
+    let now = resolve(&c, &showcase_off, vec![pick("cogwork", "0.2.0")], fit());
+    assert!(still_holds((&with_showcase, &res), (&showcase_off, &now)).is_err());
+
+    // The mod being updated was turned off meanwhile: it would end up off.
+    let on = lock(vec![
+        entry("cogwork", &["showcase"], Some(OLD_ABI)),
+        entry("showcase", &[], Some(ABI)),
+    ]);
+    let mut off = on.clone();
+    off.get_mut("cogwork").unwrap().enabled = false;
+    let res = resolve(&c, &on, vec![pick("cogwork", "0.2.0")], fit());
+    let now = resolve(&c, &off, vec![pick("cogwork", "0.2.0")], fit());
+    let why = still_holds((&on, &res), (&off, &now)).unwrap_err();
+    assert!(why.contains("off"), "{why}");
+}
+
+#[test]
+fn a_recorded_revocation_is_honoured_without_the_catalogue() {
+    let c = catalog(vec![], &[]);
+    let mut pulled = entry("pulled", &[], Some(ABI));
+    pulled.enabled = false;
+    pulled.revoked = Some(super::super::profile::Revocation {
+        reason: Some("deletes saves".into()),
+        at: Some("2026-11-05T00:00:00Z".into()),
+    });
+    let mut needs = entry("needs", &["pulled"], Some(ABI));
+    needs.enabled = false;
+    let mut l = lock(vec![pulled, needs]);
+    let err = set_enabled(&mut l, &c, "pulled", true).unwrap_err();
+    assert!(matches!(err, ModsError::Revoked(ref d) if d.contains("deletes saves")));
+    assert!(set_enabled(&mut l, &c, "needs", true).is_err());
+    assert!(!l.get("pulled").unwrap().enabled && !l.get("needs").unwrap().enabled);
+}
+
+/// Contract R4 §1: a needs b, which is installed and needs c. The graph goes through b.
+#[test]
+fn dependencies_resolve_through_installed_mods() {
+    let a = build("a", "1.0.0", ABI, REL, &["b"]);
+    let c_build = build("c", "1.0.0", ABI, REL, &[]);
+    let catalog_with = |c: bool, revoked: &[&str]| {
+        let mut mods = vec![catalog_mod("a", Origin::Index, vec![a.clone()])];
+        if c {
+            mods.push(catalog_mod("c", Origin::Index, vec![c_build.clone()]));
+        }
+        catalog(mods, revoked)
+    };
+    let off = |mut e: LockEntry| {
+        e.enabled = false;
+        e
+    };
+    let b = |enabled: bool| {
+        let e = entry("b", &["c"], Some(ABI));
+        if enabled { e } else { off(e) }
+    };
+    struct Case {
+        what: &'static str,
+        catalog: Catalog,
+        lock: Lock,
+        install: &'static [&'static str],
+        enable: &'static [&'static str],
+        missing: &'static [&'static str],
+        turns_on: bool,
+    }
+    let cases = [
+        Case {
+            what: "c installed and off: both turn on",
+            catalog: catalog_with(false, &[]),
+            lock: lock(vec![b(false), off(entry("c", &[], Some(ABI)))]),
+            install: &[],
+            enable: &["b", "c"],
+            missing: &[],
+            turns_on: true,
+        },
+        Case {
+            what: "b already on, c off: c turns on too",
+            catalog: catalog_with(false, &[]),
+            lock: lock(vec![b(true), off(entry("c", &[], Some(ABI)))]),
+            install: &[],
+            enable: &["c"],
+            missing: &[],
+            turns_on: true,
+        },
+        Case {
+            what: "c not installed but in the catalogue: downloaded",
+            catalog: catalog_with(true, &[]),
+            lock: lock(vec![b(false)]),
+            install: &["c"],
+            enable: &["b"],
+            missing: &[],
+            turns_on: true,
+        },
+        Case {
+            what: "c missing: a goes in off, b stays off",
+            catalog: catalog_with(false, &[]),
+            lock: lock(vec![b(false)]),
+            install: &[],
+            enable: &[],
+            missing: &["c"],
+            turns_on: false,
+        },
+        Case {
+            what: "c installed for another version, no build here",
+            catalog: catalog_with(false, &[]),
+            lock: lock(vec![b(false), off(entry("c", &[], Some(OLD_ABI)))]),
+            install: &[],
+            enable: &[],
+            missing: &["c"],
+            turns_on: false,
+        },
+        Case {
+            what: "c installed but revoked",
+            catalog: catalog_with(true, &[&sha("c", "0.1.0"), &sha("c", "1.0.0")]),
+            lock: lock(vec![b(false), off(entry("c", &[], Some(ABI)))]),
+            install: &[],
+            enable: &[],
+            missing: &["c"],
+            turns_on: false,
+        },
+    ];
+    for case in cases {
+        let target = sha("a", "1.0.0");
+        let plan =
+            plan_install(&case.catalog, &case.lock, "v1", &target, Some(fit()), false).unwrap();
+        let mut enable = plan.enable.clone();
+        enable.sort();
+        assert_eq!(ids(&plan.install), case.install, "{}", case.what);
+        assert_eq!(enable, case.enable, "{}", case.what);
+        assert_eq!(plan.missing, case.missing, "{}", case.what);
+        assert_eq!(plan.turns_on, case.turns_on, "{}", case.what);
+
+        // The commit does what the plan says, and leaves nothing on that can't load.
+        let (m, v) = case.catalog.find(&target).unwrap();
+        let mut after = case.lock.clone();
+        let res = resolve(
+            &case.catalog,
+            &case.lock,
+            vec![(m.clone(), v.clone())],
+            fit(),
+        );
+        commit(&mut after, &res);
+        assert_eq!(
+            after.get("a").unwrap().enabled,
+            case.turns_on,
+            "{}",
+            case.what
+        );
+        let r = super::super::profile::report(
+            "v1",
+            &after,
+            Some(ABI.into()),
+            None,
+            &case.catalog,
+            fit().platform,
+            vec![],
+        );
+        assert!(r.blocking.is_empty(), "{}: {:?}", case.what, r.blocking);
+    }
+}
+
+/// The token changes with anything the player agreed to, and only with that.
+#[test]
+fn plan_tokens() {
+    let c = world();
+    let target = sha("cogwork", "0.2.0");
+    let token = |l: &Lock, abi: &str| {
+        plan_install(&c, l, "v1", &target, Some(Fit { abi, ..fit() }), false)
+            .unwrap()
+            .plan_token
+    };
+    let empty = lock(vec![]);
+    assert_eq!(token(&empty, ABI), token(&empty, ABI), "stable");
+    assert_eq!(
+        plan_install(&c, &empty, "v1", &target, Some(fit()), true)
+            .unwrap()
+            .plan_token,
+        token(&empty, ABI),
+        "a running game is a problem, not a change of plan"
+    );
+    assert_ne!(token(&empty, ABI), token(&empty, OLD_ABI), "the ABI");
+    let mut showcase_off = entry("showcase", &[], Some(ABI));
+    showcase_off.enabled = false;
+    let with_off = lock(vec![showcase_off]);
+    assert_ne!(token(&empty, ABI), token(&with_off, ABI), "what turns on");
+    assert_ne!(
+        token(&with_off, ABI),
+        token(&lock(vec![entry("showcase", &[], Some(ABI))]), ABI),
+        "nothing turns on any more"
+    );
+}
diff --git a/src-tauri/src/mods/profile.rs b/src-tauri/src/mods/profile.rs
new file mode 100644
index 0000000..4cf4488
--- /dev/null
+++ b/src-tauri/src/mods/profile.rs
@@ -0,0 +1,868 @@
+//! The mod set of one game version, as data. `mods.lock.json` lists what is installed; the `mods/`
+//! folder beside it holds exactly the turned-on ones (see `store.rs`). This module only decides:
+//! the status of each mod, what would block the game, which update fits, and revocations.
+
+use serde::{Deserialize, Serialize};
+use std::collections::{BTreeMap, BTreeSet};
+use ts_rs::TS;
+
+use super::catalog::{Catalog, CatalogMod, CatalogVersion, Origin, Trust};
+use super::index::{Channel, Platform, RESERVED_ID};
+use crate::error::AppError;
+
+/// Ships inside every Weft; never installed or checked by the launcher.
+pub const BUILTIN: &[&str] = &[RESERVED_ID];
+
+#[derive(Debug, Clone, Serialize, Deserialize, TS)]
+#[serde(rename_all = "camelCase")]
+pub struct LockEntry {
+    pub id: String,
+    pub name: String,
+    #[serde(default)]
+    pub summary: String,
+    pub version: Option<String>,
+    pub channel: Option<Channel>,
+    pub sha256: String,
+    pub size: u64,
+    pub enabled: bool,
+    pub trust: Trust,
+    pub origin: Origin,
+    /// Unknown for a file from the player's computer: only the game can read it from the library.
+    pub abi: Option<String>,
+    pub weft_tag: Option<String>,
+    #[serde(default)]
+    pub deps: Vec<String>,
+    pub tag: Option<String>,
+    pub source_repo: Option<String>,
+    pub source_commit: Option<String>,
+    pub icon: Option<String>,
+    pub installed_at: String,
+    /// Set when the index revoked this build, and kept even if the index can't be loaded later:
+    /// the mod stays revoked, and off, until it is replaced or removed.
+    #[serde(default)]
+    pub revoked: Option<Revocation>,
+}
+
+/// Why and when a revocation was applied to an installed build.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, TS)]
+#[serde(rename_all = "camelCase")]
+pub struct Revocation {
+    /// The index's words; null when it gave none. Older launchers wrote "No reason given",
+    /// which reads back as none.
+    #[serde(default, deserialize_with = "given_reason")]
+    #[ts(type = "string | null")]
+    pub reason: Option<String>,
+    /// RFC 3339 time the launcher applied it; unknown in lock files that never said.
+    #[serde(default)]
+    pub at: Option<String>,
+}
+
+impl LockEntry {
+    pub fn from_catalog(m: &CatalogMod, v: &CatalogVersion, enabled: bool) -> Self {
+        LockEntry {
+            id: m.id.clone(),
+            name: m.name.clone(),
+            summary: m.summary.clone(),
+            version: Some(v.version.clone()),
+            channel: Some(v.channel),
+            sha256: v.sha256.clone(),
+            size: v.size,
+            enabled,
+            trust: v.trust,
+            origin: m.origin.clone(),
+            abi: Some(v.abi.clone()),
+            weft_tag: v.weft_tag.clone(),
+            deps: v.deps.clone(),
+            tag: Some(v.tag.clone()),
+            source_repo: Some(v.source_repo.clone()),
+            source_commit: Some(v.source_commit.clone()),
+            icon: m.icon.clone(),
+            installed_at: now(),
+            revoked: None,
+        }
+    }
+
+    /// Why this build may not be used: the revocation recorded in the lock file, else the
+    /// catalogue's.
+    pub fn revoked_reason(&self, catalog: &Catalog) -> Option<String> {
+        match &self.revoked {
+            Some(r) => r.reason.clone(),
+            None => catalog
+                .revocation(&self.sha256)
+                .and_then(|r| r.reason.clone()),
+        }
+    }
+
+    /// Whether this build may not be used: revoked in the lock file or the catalogue.
+    pub fn is_revoked(&self, catalog: &Catalog) -> bool {
+        self.revoked.is_some() || catalog.revocation(&self.sha256).is_some()
+    }
+
+    pub fn catalog_key(&self) -> Option<String> {
+        self.origin.key(&self.id)
+    }
+}
+
+/// A revocation's reason as a lock file has it: a missing or empty one, or the English
+/// placeholder older launchers wrote for one, is none.
+fn given_reason<'de, D>(d: D) -> Result<Option<String>, D::Error>
+where
+    D: serde::Deserializer<'de>,
+{
+    let reason = Option::<String>::deserialize(d)?;
+    Ok(reason
+        .map(|r| r.trim().to_string())
+        .filter(|r| !r.is_empty() && r != "No reason given"))
+}
+
+pub fn now() -> String {
+    time::OffsetDateTime::now_utc()
+        .format(&time::format_description::well_known::Rfc3339)
+        .unwrap_or_default()
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct Lock {
+    pub schema: u32,
+    pub mods: Vec<LockEntry>,
+}
+
+impl Lock {
+    pub fn empty() -> Self {
+        Lock {
+            schema: 1,
+            mods: Vec::new(),
+        }
+    }
+
+    pub fn get(&self, id: &str) -> Option<&LockEntry> {
+        self.mods.iter().find(|m| m.id == id)
+    }
+
+    pub fn get_mut(&mut self, id: &str) -> Option<&mut LockEntry> {
+        self.mods.iter_mut().find(|m| m.id == id)
+    }
+
+    /// Adds the entry, or replaces the installed mod with the same id.
+    pub fn put(&mut self, entry: LockEntry) {
+        match self.get_mut(&entry.id) {
+            Some(existing) => *existing = entry,
+            None => {
+                self.mods.push(entry);
+                self.mods.sort_by(|a, b| a.id.cmp(&b.id));
+            }
+        }
+    }
+
+    /// Installed mods `id` needs, directly or through others.
+    pub fn deps_of(&self, id: &str) -> Vec<String> {
+        let mut out = Vec::new();
+        let mut todo = vec![id.to_string()];
+        while let Some(next) = todo.pop() {
+            let Some(entry) = self.get(&next) else {
+                continue;
+            };
+            for d in &entry.deps {
+                if !out.contains(d) && d != id && self.get(d).is_some() {
+                    out.push(d.clone());
+                    todo.push(d.clone());
+                }
+            }
+        }
+        out
+    }
+
+    /// Turned-on mods that need `id`, directly or through others.
+    pub fn dependents_of(&self, id: &str) -> Vec<String> {
+        let mut out: Vec<String> = Vec::new();
+        let mut todo = vec![id.to_string()];
+        while let Some(next) = todo.pop() {
+            for m in self.mods.iter().filter(|m| m.enabled) {
+                if m.deps.contains(&next) && !out.contains(&m.id) && m.id != id {
+                    out.push(m.id.clone());
+                    todo.push(m.id.clone());
+                }
+            }
+        }
+        out
+    }
+
+    /// The display name of an installed mod, or its id.
+    pub fn name_of(&self, id: &str) -> String {
+        self.get(id)
+            .map(|e| e.name.clone())
+            .unwrap_or_else(|| id.to_string())
+    }
+}
+
+#[derive(Debug, Clone, Copy, Serialize, PartialEq, Eq, TS)]
+#[serde(rename_all = "camelCase")]
+pub enum ModStatus {
+    /// On, and fits this version as far as the launcher can tell.
+    Ready,
+    Off,
+    /// Built for another game version: Weft would refuse to start.
+    WrongVersion,
+    /// Needs a mod that isn't on.
+    MissingDeps,
+    /// Pulled from the index. Turned off and never handed to the game.
+    Revoked,
+    /// A file from the player's computer: whether it fits is only known when the game starts.
+    Unchecked,
+}
+
+#[derive(Debug, Clone, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+pub struct UpdateView {
+    pub version: String,
+    pub sha256: String,
+    pub channel: Channel,
+    pub trust: Trust,
+}
+
+#[derive(Debug, Clone, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+pub struct InstalledMod {
+    #[serde(flatten)]
+    pub entry: LockEntry,
+    pub status: ModStatus,
+    /// Dependencies that aren't on: not installed, or installed and off.
+    pub missing_deps: Vec<String>,
+    /// The part of `missing_deps` with no build installed at all.
+    pub deps_not_installed: Vec<String>,
+    pub revoked_reason: Option<String>,
+    pub update: Option<UpdateView>,
+}
+
+/// Why a mod in `ProfileReport.blocking` stops the game.
+#[derive(Debug, Clone, Copy, Serialize, PartialEq, Eq, TS)]
+#[serde(rename_all = "camelCase")]
+pub enum BlockingReason {
+    WrongVersion,
+    MissingDeps,
+    /// Revoked, but still in the version's folder: the game that is running now started with
+    /// it, and it is turned off once that game stops.
+    Revoked,
+    /// Revoked, and a file with its id in the player's own folder would load in its place.
+    ShadowedRevoked,
+}
+
+/// What the launcher's copy of a shadowed mod is.
+#[derive(Debug, Clone, Copy, Serialize, PartialEq, Eq, TS)]
+#[serde(rename_all = "camelCase")]
+pub enum Managed {
+    On,
+    Off,
+    Revoked,
+}
+
+/// A file in the player's own mods folder with the id of a mod in this set. The engine loads
+/// the first copy of an id it finds and searches the launcher's folder first, so this one loads
+/// whenever the launcher's copy is off or revoked.
+#[derive(Debug, Clone, Serialize, PartialEq, Eq, TS)]
+#[serde(rename_all = "camelCase")]
+pub struct ShadowedMod {
+    pub id: String,
+    pub file: String,
+    pub managed: Managed,
+}
+
+/// One entry of the player's own mods folder, and the mod id the engine would give it: the
+/// stem of `<id>.zip`, or a folder's name. `None` for anything the engine skips.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct PlayerFile {
+    pub file: String,
+    pub id: Option<String>,
+}
+
+impl PlayerFile {
+    /// As `crates/engine/src/modloader.rs` `discover` names it.
+    pub fn new(file: &str, is_dir: bool) -> PlayerFile {
+        let zip_stem = file
+            .len()
+            .checked_sub(4)
+            .filter(|&at| file.is_char_boundary(at) && file[at..].eq_ignore_ascii_case(".zip"))
+            .map(|at| &file[..at]);
+        let id = if is_dir { Some(file) } else { zip_stem };
+        PlayerFile {
+            file: file.to_string(),
+            id: id.filter(|i| !i.is_empty()).map(str::to_string),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, TS)]
+#[serde(rename_all = "camelCase")]
+pub struct ProfileReport {
+    pub tag: String,
+    pub version_abi: Option<String>,
+    pub abi_error: Option<AppError>,
+    pub mods: Vec<InstalledMod>,
+    /// Ids of mods that would stop the game from starting: turned-on mods that can't load, and
+    /// revoked mods a file in the player's folder would stand in for.
+    pub blocking: Vec<String>,
+    /// Why each of `blocking` blocks.
+    pub blocking_reasons: BTreeMap<String, BlockingReason>,
+    /// What sits in the player's own Weft mods folder. Loads into every version, unchecked.
+    pub unmanaged: Vec<String>,
+    /// Files there with the id of a mod in this set.
+    pub shadowed: Vec<ShadowedMod>,
+    /// Ids of revoked mods still on, because the version's game is running: they are turned
+    /// off when it stops.
+    pub revocations_pending: Vec<String>,
+}
+
+/// What a build must match to be used here: the version's mod interface and this system.
+#[derive(Debug, Clone, Copy)]
+pub struct Fit<'a> {
+    pub abi: &'a str,
+    pub platform: Option<Platform>,
+}
+
+impl<'a> Fit<'a> {
+    pub fn here(abi: &'a str) -> Self {
+        Fit {
+            abi,
+            platform: Platform::current(),
+        }
+    }
+
+    pub fn platform_ok(&self, v: &CatalogVersion) -> bool {
+        self.platform.is_some_and(|p| v.platforms.contains(&p))
+    }
+
+    pub fn accepts(&self, v: &CatalogVersion) -> bool {
+        v.abi == self.abi && self.platform_ok(v)
+    }
+}
+
+/// The builds of `key` that fit here, no less stable than `at_most`, revoked ones included.
+pub fn fitting<'a>(
+    catalog: &'a Catalog,
+    key: &str,
+    fit: Fit<'_>,
+    at_most: Channel,
+) -> Option<(&'a CatalogMod, Vec<&'a CatalogVersion>)> {
+    let m = catalog.by_key(key)?;
+    let versions = m
+        .versions
+        .iter()
+        .filter(|v| fit.accepts(v) && v.channel.rank() <= at_most.rank())
+        .collect();
+    Some((m, versions))
+}
+
+/// The newest build of `key` that fits here, no less stable than `at_most`, and not revoked.
+pub fn best_version<'a>(
+    catalog: &'a Catalog,
+    key: &str,
+    fit: Fit<'_>,
+    at_most: Channel,
+) -> Option<(&'a CatalogMod, &'a CatalogVersion)> {
+    let (m, versions) = fitting(catalog, key, fit, at_most)?;
+    versions
+        .into_iter()
+        .filter(|v| catalog.revocation(&v.sha256).is_none())
+        .max_by(|a, b| {
+            super::version::compare(&a.version, &b.version)
+                .then(b.channel.rank().cmp(&a.channel.rank()))
+        })
+        .map(|v| (m, v))
+}
+
+/// A newer build for this version, or any fitting build for a mod that doesn't fit.
+pub fn update_for(
+    entry: &LockEntry,
+    fit: Option<Fit<'_>>,
+    catalog: &Catalog,
+) -> Option<UpdateView> {
+    let fit = fit?;
+    let key = entry.catalog_key()?;
+    let at_most = entry.channel.unwrap_or(Channel::Release);
+    let (_, v) = best_version(catalog, &key, fit, at_most)?;
+    let fits_now = entry.abi.as_deref() == Some(fit.abi);
+    let newer = entry
+        .version
+        .as_deref()
+        .is_none_or(|cur| super::version::compare(&v.version, cur).is_gt());
+    if v.sha256 == entry.sha256 || (fits_now && !newer) {
+        return None;
+    }
+    Some(UpdateView {
+        version: v.version.clone(),
+        sha256: v.sha256.clone(),
+        channel: v.channel,
+        trust: v.trust,
+    })
+}
+
+/// What the launcher knows about each installed mod, and what would stop the game.
+pub fn report(
+    tag: &str,
+    lock: &Lock,
+    version_abi: Option<String>,
+    abi_error: Option<AppError>,
+    catalog: &Catalog,
+    platform: Option<Platform>,
+    unmanaged: Vec<PlayerFile>,
+) -> ProfileReport {
+    let enabled: BTreeSet<&str> = lock
+        .mods
+        .iter()
+        .filter(|m| m.enabled)
+        .map(|m| m.id.as_str())
+        .collect();
+    let fit = version_abi.as_deref().map(|abi| Fit { abi, platform });
+    let mut mods = Vec::new();
+    let mut reasons: Vec<(String, BlockingReason)> = Vec::new();
+    let mut pending = Vec::new();
+    let mut shadowed = Vec::new();
+    for entry in &lock.mods {
+        // Revoked is decided by the record, never by whether it gave a reason.
+        let is_revoked = entry.is_revoked(catalog);
+        let revoked = entry.revoked_reason(catalog);
+        let missing: Vec<String> = entry
+            .deps
+            .iter()
+            .filter(|d| !BUILTIN.contains(&d.as_str()) && !enabled.contains(d.as_str()))
+            .cloned()
+            .collect();
+        let not_installed = missing
+            .iter()
+            .filter(|d| lock.get(d).is_none())
+            .cloned()
+            .collect();
+        let status = if is_revoked {
+            ModStatus::Revoked
+        } else if !entry.enabled {
+            ModStatus::Off
+        } else if let (Some(have), Some(want)) = (entry.abi.as_deref(), version_abi.as_deref())
+            && have != want
+        {
+            ModStatus::WrongVersion
+        } else if !missing.is_empty() {
+            ModStatus::MissingDeps
+        } else if entry.abi.is_none() || version_abi.is_none() {
+            ModStatus::Unchecked
+        } else {
+            ModStatus::Ready
+        };
+        let shadow = unmanaged
+            .iter()
+            .find(|f| f.id.as_deref() == Some(entry.id.as_str()));
+        if let Some(f) = shadow {
+            shadowed.push(ShadowedMod {
+                id: entry.id.clone(),
+                file: f.file.clone(),
+                managed: match (is_revoked, entry.enabled) {
+                    (true, _) => Managed::Revoked,
+                    (false, true) => Managed::On,
+                    (false, false) => Managed::Off,
+                },
+            });
+        }
+        if is_revoked && entry.enabled {
+            pending.push(entry.id.clone());
+        }
+        let reason = match status {
+            ModStatus::Revoked if shadow.is_some() => Some(BlockingReason::ShadowedRevoked),
+            ModStatus::Revoked if entry.enabled => Some(BlockingReason::Revoked),
+            ModStatus::WrongVersion => Some(BlockingReason::WrongVersion),
+            ModStatus::MissingDeps => Some(BlockingReason::MissingDeps),
+            _ => None,
+        };
+        if let Some(reason) = reason {
+            reasons.push((entry.id.clone(), reason));
+        }
+        mods.push(InstalledMod {
+            update: update_for(entry, fit, catalog),
+            entry: entry.clone(),
+            status,
+            missing_deps: missing,
+            deps_not_installed: not_installed,
+            revoked_reason: revoked,
+        });
+    }
+    ProfileReport {
+        tag: tag.to_string(),
+        version_abi,
+        abi_error,
+        mods,
+        blocking: reasons.iter().map(|(id, _)| id.clone()).collect(),
+        blocking_reasons: reasons.into_iter().collect(),
+        unmanaged: unmanaged.into_iter().map(|f| f.file).collect(),
+        shadowed,
+        revocations_pending: pending,
+    }
+}
+
+/// Records every revocation the catalogue lists for an installed build, and turns off every
+/// revoked mod. Returns whether anything changed.
+pub fn apply_revocations(lock: &mut Lock, catalog: &Catalog) -> bool {
+    let mut changed = false;
+    for m in &mut lock.mods {
+        if m.revoked.is_none()
+            && let Some(r) = catalog.revocation(&m.sha256)
+        {
+            m.revoked = Some(Revocation {
+                reason: r.reason.clone(),
+                at: Some(now()),
+            });
+            changed = true;
+        }
+        if m.enabled && m.revoked.is_some() {
+            m.enabled = false;
+            changed = true;
+        }
+    }
+    changed
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use super::super::catalog::{IndexStatus, RevokedView};
+    use super::super::index::Freshness;
+    use super::*;
+
+    pub const ABI: &str = "f470b1cbb1f9ad91";
+    pub const OLD_ABI: &str = "5f0569a6bea71b81";
+
+    pub fn sha(id: &str, version: &str) -> String {
+        crate::download::sha256_hex(format!("{id}@{version}").as_bytes())
+    }
+
+    pub fn entry(id: &str, deps: &[&str], abi: Option<&str>) -> LockEntry {
+        LockEntry {
+            id: id.into(),
+            name: format!("{id} name"),
+            summary: String::new(),
+            version: Some("0.1.0".into()),
+            channel: Some(Channel::Release),
+            sha256: sha(id, "0.1.0"),
+            size: 1,
+            enabled: true,
+            trust: Trust::Reviewed,
+            origin: Origin::Index,
+            abi: abi.map(str::to_string),
+            weft_tag: None,
+            deps: deps.iter().map(|d| d.to_string()).collect(),
+            tag: None,
+            source_repo: None,
+            source_commit: None,
+            icon: None,
+            installed_at: String::new(),
+            revoked: None,
+        }
+    }
+
+    pub fn lock(entries: Vec<LockEntry>) -> Lock {
+        Lock {
+            schema: 1,
+            mods: entries,
+        }
+    }
+
+    /// A catalogue build of `id` at `version` for `abi`, on Linux.
+    pub fn build(
+        id: &str,
+        version: &str,
+        abi: &str,
+        channel: Channel,
+        deps: &[&str],
+    ) -> CatalogVersion {
+        CatalogVersion {
+            version: version.into(),
+            channel,
+            tag: format!("{id}-v{version}"),
+            published: String::new(),
+            source_repo: "Zorro909/weft-mods".into(),
+            source_commit: "c".repeat(40),
+            weft_tag: None,
+            abi: abi.into(),
+            deps: deps.iter().map(|d| d.to_string()).collect(),
+            platforms: vec![Platform::LinuxX64],
+            sha256: sha(id, version),
+            size: 10,
+            url: String::new(),
+            provenance: None,
+            build_record: crate::mods::catalog::BuildRecord::None,
+            reviewed: None,
+            trust: Trust::Reviewed,
+        }
+    }
+
+    pub fn catalog_mod(id: &str, origin: Origin, versions: Vec<CatalogVersion>) -> CatalogMod {
+        CatalogMod {
+            key: origin.key(id).unwrap(),
+            id: id.into(),
+            name: format!("{id} name"),
+            summary: String::new(),
+            authors: vec![],
+            license: None,
+            homepage: None,
+            icon: None,
+            origin,
+            versions,
+        }
+    }
+
+    pub fn catalog(mods: Vec<CatalogMod>, revoked: &[&str]) -> Catalog {
+        Catalog {
+            mods,
+            revoked: revoked
+                .iter()
+                .map(|s| RevokedView {
+                    sha256: s.to_string(),
+                    reason: Some("broken".into()),
+                })
+                .collect(),
+            index: IndexStatus {
+                freshness: Freshness::Fresh,
+                generated: None,
+                signed_at: None,
+                error: None,
+                cache_error: None,
+            },
+            sources: vec![],
+            weft: vec![],
+            platform: String::new(),
+            sources_error: None,
+            revision: 0,
+        }
+    }
+
+    pub fn fit() -> Fit<'static> {
+        Fit {
+            abi: ABI,
+            platform: Some(Platform::LinuxX64),
+        }
+    }
+
+    #[test]
+    fn statuses_and_blocking() {
+        let mut revoked = entry("pulled", &[], Some(ABI));
+        revoked.enabled = false;
+        let mut off = entry("showcase", &[], Some(ABI));
+        off.enabled = false;
+        let l = lock(vec![
+            entry("cogwork", &["base", "showcase"], Some(ABI)),
+            off,
+            entry("old", &[], Some(OLD_ABI)),
+            entry("file", &[], None),
+            entry("fine", &["base"], Some(ABI)),
+            revoked.clone(),
+        ]);
+        let c = catalog(vec![], &[&revoked.sha256]);
+        let cases = [
+            (Some(ABI), "cogwork", ModStatus::MissingDeps),
+            (Some(ABI), "showcase", ModStatus::Off),
+            (Some(ABI), "old", ModStatus::WrongVersion),
+            (Some(ABI), "file", ModStatus::Unchecked),
+            (Some(ABI), "fine", ModStatus::Ready),
+            (Some(ABI), "pulled", ModStatus::Revoked),
+            // Without the version's interface nothing can be called wrong, only unchecked.
+            (None, "old", ModStatus::Unchecked),
+            (None, "fine", ModStatus::Unchecked),
+            (None, "cogwork", ModStatus::MissingDeps),
+        ];
+        for (abi, id, want) in cases {
+            let r = report(
+                "v1",
+                &l,
+                abi.map(str::to_string),
+                None,
+                &c,
+                fit().platform,
+                vec![],
+            );
+            let got = r.mods.iter().find(|m| m.entry.id == id).unwrap().status;
+            assert_eq!(got, want, "{id} with abi {abi:?}");
+        }
+        let r = report("v1", &l, Some(ABI.into()), None, &c, fit().platform, vec![]);
+        assert_eq!(r.blocking, ["cogwork", "old"]);
+        assert_eq!(
+            r.mods
+                .iter()
+                .find(|m| m.entry.id == "pulled")
+                .unwrap()
+                .revoked_reason
+                .as_deref(),
+            Some("broken")
+        );
+    }
+
+    #[test]
+    fn dependency_walks() {
+        let l = lock(vec![
+            entry("a", &["b"], Some(ABI)),
+            entry("b", &["c", "base"], Some(ABI)),
+            entry("c", &[], Some(ABI)),
+            entry("d", &[], Some(ABI)),
+        ]);
+        let mut deps = l.deps_of("a");
+        deps.sort();
+        assert_eq!(deps, ["b", "c"]);
+        let mut dependents = l.dependents_of("c");
+        dependents.sort();
+        assert_eq!(dependents, ["a", "b"]);
+        assert!(l.dependents_of("d").is_empty());
+    }
+
+    #[test]
+    fn update_offers() {
+        let rel = Channel::Release;
+        let c = catalog(
+            vec![
+                catalog_mod(
+                    "cogwork",
+                    Origin::Index,
+                    vec![
+                        build("cogwork", "0.3.0-rc.1", ABI, Channel::Prerelease, &[]),
+                        build("cogwork", "0.2.0", ABI, rel, &[]),
+                        build("cogwork", "0.1.0", ABI, rel, &[]),
+                        build("cogwork", "0.0.9", OLD_ABI, rel, &[]),
+                    ],
+                ),
+                catalog_mod(
+                    "lanterns",
+                    Origin::Source {
+                        repo: "Someone/Lanterns".into(),
+                    },
+                    vec![build("lanterns", "1.1.0", ABI, rel, &[])],
+                ),
+                catalog_mod(
+                    "pulled",
+                    Origin::Index,
+                    vec![build("pulled", "0.2.0", ABI, rel, &[])],
+                ),
+            ],
+            &[&sha("pulled", "0.2.0")],
+        );
+        let installed = |id: &str, version: &str, abi: &str, channel: Channel| {
+            let mut e = entry(id, &[], Some(abi));
+            e.version = Some(version.into());
+            e.sha256 = sha(id, version);
+            e.channel = Some(channel);
+            e
+        };
+        let mut from_source = installed("lanterns", "1.0.0", ABI, rel);
+        // Installed when the source was added with other casing.
+        from_source.origin = Origin::Source {
+            repo: "someone/lanterns".into(),
+        };
+        let mut local = installed("cogwork", "0.1.0", ABI, rel);
+        local.origin = Origin::File {
+            name: "c.zip".into(),
+        };
+        let cases: Vec<(&str, LockEntry, Option<&str>)> = vec![
+            (
+                "older release",
+                installed("cogwork", "0.1.0", ABI, rel),
+                Some("0.2.0"),
+            ),
+            (
+                "newest already",
+                installed("cogwork", "0.2.0", ABI, rel),
+                None,
+            ),
+            (
+                "prerelease player gets the rc",
+                installed("cogwork", "0.2.0", ABI, Channel::Prerelease),
+                Some("0.3.0-rc.1"),
+            ),
+            (
+                "built for another version: any fitting build",
+                installed("cogwork", "0.0.9", OLD_ABI, rel),
+                Some("0.2.0"),
+            ),
+            ("source, repo case differs", from_source, Some("1.1.0")),
+            (
+                "revoked build is never offered",
+                installed("pulled", "0.1.0", ABI, rel),
+                None,
+            ),
+            ("local file has no updates", local, None),
+        ];
+        for (what, e, want) in cases {
+            let got = update_for(&e, Some(fit()), &c).map(|u| u.version);
+            assert_eq!(got.as_deref(), want, "{what}");
+        }
+        assert!(update_for(&installed("cogwork", "0.1.0", ABI, rel), None, &c).is_none());
+    }
+
+    #[test]
+    fn revocations_turn_mods_off() {
+        let mut l = lock(vec![entry("a", &[], Some(ABI)), entry("b", &[], Some(ABI))]);
+        let c = catalog(vec![], &[&sha("a", "0.1.0")]);
+        assert!(apply_revocations(&mut l, &c));
+        assert!(!l.get("a").unwrap().enabled);
+        assert_eq!(
+            l.get("a")
+                .unwrap()
+                .revoked
+                .as_ref()
+                .unwrap()
+                .reason
+                .as_deref(),
+            Some("broken")
+        );
+        assert!(l.get("b").unwrap().enabled);
+        assert!(l.get("b").unwrap().revoked.is_none());
+        assert!(!apply_revocations(&mut l, &c));
+    }
+
+    /// The index can't be loaded any more: the lock file still knows, so the mod stays revoked
+    /// and says why.
+    #[test]
+    fn a_recorded_revocation_survives_without_the_index() {
+        let mut l = lock(vec![entry("a", &[], Some(ABI))]);
+        apply_revocations(&mut l, &catalog(vec![], &[&sha("a", "0.1.0")]));
+        let saved = serde_json::to_vec(&l).unwrap();
+        let mut l: Lock = serde_json::from_slice(&saved).unwrap();
+
+        let unavailable = catalog(vec![], &[]);
+        let r = report(
+            "v1",
+            &l,
+            Some(ABI.into()),
+            None,
+            &unavailable,
+            fit().platform,
+            vec![],
+        );
+        assert_eq!(r.mods[0].status, ModStatus::Revoked);
+        assert_eq!(r.mods[0].revoked_reason.as_deref(), Some("broken"));
+
+        // Even if something turned it back on, the next check turns it off again.
+        l.mods[0].enabled = true;
+        assert!(apply_revocations(&mut l, &unavailable));
+        assert!(!l.mods[0].enabled);
+
+        // A lock file written before revocations were recorded still reads.
+        let old = r#"{"schema":1,"mods":[]}"#;
+        assert!(serde_json::from_str::<Lock>(old).is_ok());
+    }
+
+    #[test]
+    fn missing_dependencies_say_whether_they_are_installed() {
+        let mut off = entry("showcase", &[], Some(ABI));
+        off.enabled = false;
+        let l = lock(vec![
+            entry("cogwork", &["base", "showcase", "signals"], Some(ABI)),
+            off,
+        ]);
+        let r = report(
+            "v1",
+            &l,
+            Some(ABI.into()),
+            None,
+            &catalog(vec![], &[]),
+            fit().platform,
+            vec![],
+        );
+        let cogwork = r.mods.iter().find(|m| m.entry.id == "cogwork").unwrap();
+        assert_eq!(cogwork.status, ModStatus::MissingDeps);
+        assert_eq!(cogwork.missing_deps, ["showcase", "signals"]);
+        assert_eq!(cogwork.deps_not_installed, ["signals"]);
+    }
+}
diff --git a/src-tauri/src/mods/rules_fixture.rs b/src-tauri/src/mods/rules_fixture.rs
new file mode 100644
index 0000000..6a954b3
--- /dev/null
+++ b/src-tauri/src/mods/rules_fixture.rs
@@ -0,0 +1,748 @@
+//! The mock's rule cases, `src/dev/fixtures/rules.json`, run through the real rules here, so the
+//! dev mock (`src/dev/mockRules.ts`, tested against the same file) and the backend can't drift.
+//!
+//! The JSON belongs to the frontend; this file only adapts its shapes:
+//! - a sha is written `<id>@<version>`, which is [`sha`] here;
+//! - a build is `[version, abi, channel, deps]` and an abi is a name from `abi`;
+//! - a lock entry is the test helper [`entry`] with the fields given changed.
+//!
+//! New cases in a known section need nothing here. A section or a case field this test doesn't
+//! know fails it, naming what to adapt: a case that is read but not checked would let the two
+//! sides drift unnoticed.
+
+use serde_json::{Map, Value};
+
+use super::catalog::{Catalog, Origin, Trust};
+use super::index::Channel;
+use super::plan::{self, CopyOutcome};
+use super::profile::tests::{build, catalog_mod, entry, fit, sha};
+use super::profile::{self, Fit, Lock, LockEntry, Revocation};
+use crate::error::AppError;
+
+const RULES: &str = include_str!("../../../src/dev/fixtures/rules.json");
+
+struct Rules {
+    root: Map<String, Value>,
+}
+
+fn obj(v: &Value) -> &Map<String, Value> {
+    v.as_object()
+        .unwrap_or_else(|| panic!("rules.json: expected an object, got {v}"))
+}
+
+fn arr(v: &Value) -> &Vec<Value> {
+    v.as_array()
+        .unwrap_or_else(|| panic!("rules.json: expected a list, got {v}"))
+}
+
+fn text(v: &Value) -> &str {
+    v.as_str()
+        .unwrap_or_else(|| panic!("rules.json: expected a string, got {v}"))
+}
+
+fn strings(v: &Value) -> Vec<String> {
+    arr(v).iter().map(|s| text(s).to_string()).collect()
+}
+
+fn sorted(mut v: Vec<String>) -> Vec<String> {
+    v.sort();
+    v
+}
+
+/// Fails on any key of a case this test doesn't check.
+fn only(what: &str, case: &Map<String, Value>, known: &[&str]) {
+    let unknown: Vec<&String> = case
+        .keys()
+        .filter(|k| !known.contains(&k.as_str()))
+        .collect();
+    assert!(
+        unknown.is_empty(),
+        "rules.json {what}: fields {unknown:?} aren't checked against the backend; \
+         add them to src-tauri/src/mods/rules_fixture.rs"
+    );
+}
+
+/// `<id>@<version>` → the test helpers' sha of that build.
+fn sha_of(s: &str) -> String {
+    let (id, version) = s
+        .split_once('@')
+        .unwrap_or_else(|| panic!("rules.json: {s:?} is not <id>@<version>"));
+    sha(id, version)
+}
+
+fn parse<T: serde::de::DeserializeOwned>(v: &Value) -> T {
+    serde_json::from_value(v.clone()).unwrap_or_else(|e| panic!("rules.json: {v}: {e}"))
+}
+
+impl Rules {
+    fn load() -> Rules {
+        let root: Value = serde_json::from_str(RULES).expect("rules.json is JSON");
+        Rules {
+            root: obj(&root).clone(),
+        }
+    }
+
+    fn section(&self, name: &str) -> &Map<String, Value> {
+        obj(self
+            .root
+            .get(name)
+            .unwrap_or_else(|| panic!("rules.json has no {name}")))
+    }
+
+    fn abi(&self, name: &Value) -> Option<String> {
+        match name {
+            Value::Null => None,
+            v => Some(text(&self.section("abi")[text(v)]).to_string()),
+        }
+    }
+
+    fn catalog(&self, name: &str) -> Catalog {
+        let c = obj(&self.section("catalogs")[name]);
+        only(&format!("catalogs.{name}"), c, &["rust", "mods", "revoked"]);
+        let mods = arr(&c["mods"])
+            .iter()
+            .map(|m| {
+                let m = obj(m);
+                only(
+                    &format!("catalogs.{name}.mods[]"),
+                    m,
+                    &["id", "origin", "builds"],
+                );
+                let id = text(&m["id"]);
+                let origin = match text(&m["origin"]) {
+                    "index" => Origin::Index,
+                    repo => Origin::Source { repo: repo.into() },
+                };
+                let builds = arr(&m["builds"])
+                    .iter()
+                    .map(|b| {
+                        let b = arr(b);
+                        let channel: Channel = parse(&b[2]);
+                        let deps = strings(&b[3]);
+                        let deps: Vec<&str> = deps.iter().map(String::as_str).collect();
+                        let abi = self.abi(&b[1]).expect("a build has an abi");
+                        build(id, text(&b[0]), &abi, channel, &deps)
+                    })
+                    .collect();
+                catalog_mod(id, origin, builds)
+            })
+            .collect();
+        let revoked: Vec<String> = arr(&c["revoked"]).iter().map(|s| sha_of(text(s))).collect();
+        let revoked: Vec<&str> = revoked.iter().map(String::as_str).collect();
+        profile::tests::catalog(mods, &revoked)
+    }
+
+    fn entry(&self, spec: &Value) -> LockEntry {
+        let s = obj(spec);
+        only(
+            "a lock entry",
+            s,
+            &[
+                "id", "deps", "abi", "enabled", "version", "channel", "trust", "origin", "revoked",
+            ],
+        );
+        let deps = s.get("deps").map(strings).unwrap_or_default();
+        let deps: Vec<&str> = deps.iter().map(String::as_str).collect();
+        let abi = match s.get("abi") {
+            None => Some(super::profile::tests::ABI.to_string()),
+            Some(a) => self.abi(a),
+        };
+        let mut e = entry(text(&s["id"]), &deps, abi.as_deref());
+        if let Some(v) = s.get("version") {
+            e.version = Some(text(v).into());
+            e.sha256 = sha(&e.id, text(v));
+        }
+        if let Some(v) = s.get("enabled") {
+            e.enabled = v.as_bool().expect("enabled is a bool");
+        }
+        if let Some(v) = s.get("channel") {
+            e.channel = Some(parse(v));
+        }
+        if let Some(v) = s.get("trust") {
+            e.trust = parse::<Trust>(v);
+        }
+        if let Some(v) = s.get("origin") {
+            e.origin = parse(v);
+        }
+        if let Some(v) = s.get("revoked") {
+            e.revoked = Some(parse::<Revocation>(v));
+        }
+        e
+    }
+
+    fn lock(&self, specs: &Value) -> Lock {
+        super::profile::tests::lock(arr(specs).iter().map(|s| self.entry(s)).collect())
+    }
+
+    fn pick(
+        &self,
+        c: &Catalog,
+        s: &str,
+    ) -> (super::catalog::CatalogMod, super::catalog::CatalogVersion) {
+        let (m, v) = c
+            .find(&sha_of(s))
+            .unwrap_or_else(|| panic!("rules.json: no build {s}"));
+        (m.clone(), v.clone())
+    }
+}
+
+fn code(e: Option<AppError>) -> Value {
+    e.map_or(Value::Null, |e| Value::String(e.code.as_str().into()))
+}
+
+const SECTIONS: &[&str] = &[
+    "_about",
+    "abi",
+    "catalogs",
+    "plans",
+    "commits",
+    "toggles",
+    "copies",
+    "statuses",
+    "cascades",
+    "updates",
+    "shadowing",
+    "revocations",
+    "iconHosts",
+    "buildRecords",
+];
+
+#[test]
+fn every_section_is_read() {
+    let rules = Rules::load();
+    let unknown: Vec<&String> = rules
+        .root
+        .keys()
+        .filter(|k| !SECTIONS.contains(&k.as_str()))
+        .collect();
+    assert!(
+        unknown.is_empty(),
+        "rules.json has sections {unknown:?} that no Rust test reads; \
+         add an adapter for them in src-tauri/src/mods/rules_fixture.rs"
+    );
+}
+
+#[test]
+fn plans() {
+    let r = Rules::load();
+    let s = r.section("plans");
+    let c = r.catalog(text(&s["catalog"]));
+    for case in arr(&s["cases"]) {
+        let case = obj(case);
+        let what = text(&case["what"]);
+        only(
+            &format!("plans: {what}"),
+            case,
+            &[
+                "what",
+                "target",
+                "lock",
+                "abi",
+                "running",
+                "install",
+                "enable",
+                "missing",
+                "problem",
+                "turnsOn",
+                "replaces",
+                "fitsVersion",
+            ],
+        );
+        let lock = r.lock(&case["lock"]);
+        let abi = match case.get("abi") {
+            Some(a) => r.abi(a),
+            None => Some(fit().abi.to_string()),
+        };
+        let f = abi.as_deref().map(|abi| Fit { abi, ..fit() });
+        let running = case
+            .get("running")
+            .and_then(Value::as_bool)
+            .unwrap_or(false);
+        let target = sha_of(text(&case["target"]));
+        let plan = plan::plan_install(&c, &lock, "v1", &target, f, running).unwrap();
+        let installs: Vec<String> = plan.install.iter().map(|i| i.id.clone()).collect();
+        assert_eq!(installs, strings(&case["install"]), "plan: {what}: install");
+        assert_eq!(
+            plan.enable,
+            strings(&case["enable"]),
+            "plan: {what}: enable"
+        );
+        assert_eq!(
+            plan.missing,
+            strings(&case["missing"]),
+            "plan: {what}: missing"
+        );
+        assert_eq!(
+            code(plan.problem.clone()),
+            case["problem"],
+            "plan: {what}: problem"
+        );
+        assert_eq!(
+            Some(plan.turns_on),
+            case["turnsOn"].as_bool(),
+            "plan: {what}: turnsOn"
+        );
+        if let Some(want) = case.get("fitsVersion") {
+            assert_eq!(
+                plan.fits_version.map_or(Value::Null, Value::Bool),
+                *want,
+                "plan: {what}: fitsVersion"
+            );
+        }
+        if let Some(want) = case.get("replaces") {
+            let want = obj(want);
+            only(
+                &format!("plans: {what}: replaces"),
+                want,
+                &["enabled", "trust"],
+            );
+            let got = plan.replaces.as_ref().expect("replaces");
+            if let Some(e) = want.get("enabled") {
+                assert_eq!(
+                    Some(got.enabled),
+                    e.as_bool(),
+                    "plan: {what}: replaces.enabled"
+                );
+            }
+            if let Some(t) = want.get("trust") {
+                assert_eq!(got.trust, parse::<Trust>(t), "plan: {what}: replaces.trust");
+            }
+        }
+    }
+}
+
+#[test]
+fn commits() {
+    let r = Rules::load();
+    let s = r.section("commits");
+    let c = r.catalog(text(&s["catalog"]));
+    for case in arr(&s["cases"]) {
+        let case = obj(case);
+        let what = text(&case["what"]);
+        only(
+            &format!("commits: {what}"),
+            case,
+            &[
+                "what",
+                "wanted",
+                "lock",
+                "installed",
+                "alsoEnabled",
+                "installedOff",
+                "after",
+            ],
+        );
+        let mut lock = r.lock(&case["lock"]);
+        let wanted = strings(&case["wanted"])
+            .iter()
+            .map(|w| r.pick(&c, w))
+            .collect();
+        let res = plan::resolve(&c, &lock, wanted, fit());
+        let done = plan::commit(&mut lock, &res);
+        assert_eq!(
+            done.installed,
+            strings(&case["installed"]),
+            "commit: {what}: installed"
+        );
+        assert_eq!(
+            done.also_enabled,
+            strings(&case["alsoEnabled"]),
+            "commit: {what}: alsoEnabled"
+        );
+        assert_eq!(
+            done.installed_off,
+            strings(&case["installedOff"]),
+            "commit: {what}: installedOff"
+        );
+        for (id, on) in obj(&case["after"]) {
+            assert_eq!(
+                lock.get(id).map(|e| e.enabled),
+                on.as_bool(),
+                "commit: {what}: {id} afterwards"
+            );
+        }
+    }
+}
+
+#[test]
+fn toggles() {
+    let r = Rules::load();
+    let s = r.section("toggles");
+    let c = r.catalog(text(&s["catalog"]));
+    for case in arr(&s["cases"]) {
+        let case = obj(case);
+        let what = text(&case["what"]);
+        only(
+            &format!("toggles: {what}"),
+            case,
+            &[
+                "what",
+                "lock",
+                "action",
+                "alsoEnabled",
+                "alsoDisabled",
+                "error",
+                "after",
+            ],
+        );
+        let mut lock = r.lock(&case["lock"]);
+        let action = strings(&case["action"]);
+        let (verb, id) = (action[0].as_str(), action[1].as_str());
+        let result = match verb {
+            "remove" => plan::remove(&mut lock, id).map(|off| (Vec::new(), off)),
+            "on" | "off" => plan::set_enabled(&mut lock, &c, id, verb == "on"),
+            other => panic!("rules.json toggles: {what}: unknown action {other:?}"),
+        };
+        if let Some(want) = case.get("error") {
+            let err = result
+                .err()
+                .unwrap_or_else(|| panic!("toggle: {what}: expected {want}"));
+            assert_eq!(
+                Value::String(err.code().as_str().into()),
+                *want,
+                "toggle: {what}"
+            );
+            if want == "ModRevoked" {
+                assert!(
+                    lock.mods.iter().all(|e| !e.enabled),
+                    "toggle: {what}: nothing changes"
+                );
+            }
+            continue;
+        }
+        let (on, off) = result.unwrap_or_else(|e| panic!("toggle: {what}: {e}"));
+        assert_eq!(
+            sorted(on),
+            strings(&case["alsoEnabled"]),
+            "toggle: {what}: alsoEnabled"
+        );
+        assert_eq!(
+            sorted(off),
+            strings(&case["alsoDisabled"]),
+            "toggle: {what}: alsoDisabled"
+        );
+        if let Some(after) = case.get("after") {
+            for (id, on) in obj(after) {
+                assert_eq!(
+                    lock.get(id).map(|e| e.enabled),
+                    on.as_bool(),
+                    "toggle: {what}: {id}"
+                );
+            }
+        }
+    }
+}
+
+#[test]
+fn copies() {
+    let r = Rules::load();
+    let s = r.section("copies");
+    only(
+        "copies",
+        s,
+        &["rust", "catalog", "from", "to", "outcomes", "picks"],
+    );
+    let c = r.catalog(text(&s["catalog"]));
+    let (from, to) = (r.lock(&s["from"]), r.lock(&s["to"]));
+    let (preview, picks) = plan::copy_preview(&c, ("v1", &from), ("v2", &to), fit());
+    for (id, want) in obj(&s["outcomes"]) {
+        let got = preview.items.iter().find(|i| &i.id == id).map(|i| {
+            serde_json::json!([serde_json::to_value(i.outcome).unwrap(), i.version.clone()])
+        });
+        assert_eq!(got.unwrap_or(Value::Null), *want, "copy: {id}");
+    }
+    let picked: Vec<String> = picks.iter().map(|(m, _)| m.id.clone()).collect();
+    assert_eq!(picked, strings(&s["picks"]), "copy: picks");
+    assert!(
+        preview
+            .items
+            .iter()
+            .filter(|i| i.outcome == CopyOutcome::Install)
+            .all(|i| i.trust.is_some())
+    );
+}
+
+#[test]
+fn statuses() {
+    let r = Rules::load();
+    let s = r.section("statuses");
+    only(
+        "statuses",
+        s,
+        &[
+            "rust",
+            "catalog",
+            "lock",
+            "cases",
+            "blocking",
+            "missingDeps",
+            "depsNotInstalled",
+            "revokedReason",
+        ],
+    );
+    let c = r.catalog(text(&s["catalog"]));
+    let lock = r.lock(&s["lock"]);
+    let report =
+        |abi: Option<String>| profile::report("v1", &lock, abi, None, &c, fit().platform, vec![]);
+    for case in arr(&s["cases"]) {
+        let case = arr(case);
+        let (abi, id) = (r.abi(&case[0]), text(&case[1]));
+        let got = report(abi.clone())
+            .mods
+            .iter()
+            .find(|m| m.entry.id == id)
+            .map(|m| serde_json::to_value(m.status).unwrap());
+        assert_eq!(got.as_ref(), Some(&case[2]), "status of {id} with {abi:?}");
+    }
+    let full = report(Some(fit().abi.to_string()));
+    assert_eq!(full.blocking, strings(&s["blocking"]), "blocking");
+    let find = |id: &str| full.mods.iter().find(|m| m.entry.id == id).unwrap();
+    for (id, want) in obj(&s["missingDeps"]) {
+        assert_eq!(find(id).missing_deps, strings(want), "missingDeps of {id}");
+    }
+    for (id, want) in obj(&s["depsNotInstalled"]) {
+        assert_eq!(
+            find(id).deps_not_installed,
+            strings(want),
+            "depsNotInstalled of {id}"
+        );
+    }
+    for (id, want) in obj(&s["revokedReason"]) {
+        assert_eq!(
+            find(id).revoked_reason.as_deref(),
+            want.as_str(),
+            "revokedReason of {id}"
+        );
+    }
+}
+
+#[test]
+fn cascades() {
+    let r = Rules::load();
+    let s = r.section("cascades");
+    only(
+        "cascades",
+        s,
+        &[
+            "rust",
+            "catalog",
+            "lock",
+            "turnedOff",
+            "statuses",
+            "blocking",
+            "blockingReasons",
+            "missingDeps",
+            "depsNotInstalled",
+            "revokedReason",
+        ],
+    );
+    let c = r.catalog(text(&s["catalog"]));
+    let mut lock = r.lock(&s["lock"]);
+    assert!(
+        profile::apply_revocations(&mut lock, &c),
+        "the revocation is applied"
+    );
+    let off: Vec<String> = lock
+        .mods
+        .iter()
+        .filter(|m| !m.enabled)
+        .map(|m| m.id.clone())
+        .collect();
+    assert_eq!(off, strings(&s["turnedOff"]), "turned off");
+    assert!(!profile::apply_revocations(&mut lock, &c), "once");
+    let report = profile::report(
+        "v1",
+        &lock,
+        Some(fit().abi.to_string()),
+        None,
+        &c,
+        fit().platform,
+        vec![],
+    );
+    let find = |id: &str| report.mods.iter().find(|m| m.entry.id == id).unwrap();
+    for (id, want) in obj(&s["statuses"]) {
+        assert_eq!(
+            &serde_json::to_value(find(id).status).unwrap(),
+            want,
+            "status of {id}"
+        );
+    }
+    assert_eq!(report.blocking, strings(&s["blocking"]), "blocking");
+    assert_eq!(
+        serde_json::to_value(&report.blocking_reasons).unwrap(),
+        s["blockingReasons"],
+        "blockingReasons"
+    );
+    for (id, want) in obj(&s["missingDeps"]) {
+        assert_eq!(find(id).missing_deps, strings(want), "missingDeps of {id}");
+    }
+    for (id, want) in obj(&s["depsNotInstalled"]) {
+        assert_eq!(
+            find(id).deps_not_installed,
+            strings(want),
+            "depsNotInstalled of {id}"
+        );
+    }
+    for (id, want) in obj(&s["revokedReason"]) {
+        assert_eq!(
+            find(id).revoked_reason.as_deref(),
+            want.as_str(),
+            "revokedReason of {id}"
+        );
+    }
+}
+
+#[test]
+fn updates() {
+    let r = Rules::load();
+    let s = r.section("updates");
+    let c = r.catalog(text(&s["catalog"]));
+    for case in arr(&s["cases"]) {
+        let case = obj(case);
+        let what = text(&case["what"]);
+        only(
+            &format!("updates: {what}"),
+            case,
+            &["what", "entry", "want"],
+        );
+        let e = r.entry(&case["entry"]);
+        let got = profile::update_for(&e, Some(fit()), &c).map(|u| u.version);
+        assert_eq!(got.as_deref(), case["want"].as_str(), "update: {what}");
+        assert!(
+            profile::update_for(&e, None, &c).is_none(),
+            "update: {what}: no ABI"
+        );
+    }
+}
+
+#[test]
+fn shadowing() {
+    let r = Rules::load();
+    let s = r.section("shadowing");
+    only(
+        "shadowing",
+        s,
+        &[
+            "rust",
+            "catalog",
+            "lock",
+            "playerFolder",
+            "unmanaged",
+            "shadowed",
+            "blocking",
+            "blockingReasons",
+        ],
+    );
+    let c = r.catalog(text(&s["catalog"]));
+    let lock = r.lock(&s["lock"]);
+    let folder = arr(&s["playerFolder"])
+        .iter()
+        .map(|f| {
+            let f = obj(f);
+            only("shadowing.playerFolder[]", f, &["file", "id"]);
+            profile::PlayerFile {
+                file: text(&f["file"]).to_string(),
+                id: f["id"].as_str().map(str::to_string),
+            }
+        })
+        .collect();
+    let report = profile::report(
+        "v1",
+        &lock,
+        Some(fit().abi.to_string()),
+        None,
+        &c,
+        fit().platform,
+        folder,
+    );
+    assert_eq!(report.unmanaged, strings(&s["unmanaged"]), "unmanaged");
+    assert_eq!(
+        serde_json::to_value(&report.shadowed).unwrap(),
+        s["shadowed"],
+        "shadowed"
+    );
+    assert_eq!(
+        sorted(report.blocking.clone()),
+        sorted(strings(&s["blocking"])),
+        "blocking"
+    );
+    assert_eq!(
+        serde_json::to_value(&report.blocking_reasons).unwrap(),
+        s["blockingReasons"],
+        "blockingReasons"
+    );
+}
+
+#[test]
+fn revocations() {
+    use super::index::revocation;
+    let r = Rules::load();
+    let s = r.section("revocations");
+    only(
+        "revocations",
+        s,
+        &["rust", "entries", "kept", "dropped", "matches"],
+    );
+    let entries = arr(&s["entries"]);
+    let kept: Vec<_> = entries.iter().cloned().filter_map(revocation).collect();
+    assert_eq!(
+        serde_json::to_value(&kept).unwrap(),
+        s["kept"],
+        "revocations kept"
+    );
+    let dropped = s["dropped"].as_u64().expect("dropped is a count") as usize;
+    assert_eq!(entries.len() - kept.len(), dropped, "revocations dropped");
+    let shas: Vec<&str> = kept.iter().map(|k| k.sha256.as_str()).collect();
+    let c = profile::tests::catalog(vec![], &shas);
+    for m in arr(&s["matches"]) {
+        let m = arr(m);
+        let (sha, want) = (text(&m[0]), m[1].as_bool().expect("a match is a bool"));
+        assert_eq!(c.revocation(sha).is_some(), want, "revocation of {sha}");
+    }
+}
+
+#[test]
+fn icon_hosts() {
+    let r = Rules::load();
+    let s = r.section("iconHosts");
+    only("iconHosts", s, &["rust", "cases"]);
+    for case in arr(&s["cases"]) {
+        let case = arr(case);
+        let (url, want) = (text(&case[0]), case[1].as_bool().expect("a case is a bool"));
+        assert_eq!(
+            crate::download::icon_url_allowed(url),
+            want,
+            "icon from {url}"
+        );
+    }
+}
+
+#[test]
+fn build_records() {
+    let r = Rules::load();
+    let s = r.section("buildRecords");
+    only("buildRecords", s, &["rust", "cases"]);
+    for case in arr(&s["cases"]) {
+        let case = obj(case);
+        only(
+            "buildRecords case",
+            case,
+            &["what", "fromIndex", "provenance", "want"],
+        );
+        let what = text(&case["what"]);
+        let provenance: Option<super::index::Provenance> = parse(&case["provenance"]);
+        let from_index = case["fromIndex"].as_bool().expect("fromIndex is a bool");
+        let want: super::catalog::BuildRecord = match text(&case["want"]) {
+            "none" => super::catalog::BuildRecord::None,
+            "claimed" => super::catalog::BuildRecord::Claimed,
+            "incomplete" => super::catalog::BuildRecord::Incomplete,
+            "recorded" => super::catalog::BuildRecord::Recorded,
+            other => panic!("rules.json buildRecords: unknown record {other:?}"),
+        };
+        assert_eq!(
+            super::catalog::build_record(provenance.as_ref(), from_index),
+            want,
+            "{what}"
+        );
+    }
+}
diff --git a/src-tauri/src/mods/service/changes.rs b/src-tauri/src/mods/service/changes.rs
new file mode 100644
index 0000000..314e5fb
--- /dev/null
+++ b/src-tauri/src/mods/service/changes.rs
@@ -0,0 +1,483 @@
+//! Changes to one version's set: plan, install (from the catalogue or a file), turn on or off,
+//! remove and restore. Each checks the plan again under `ModsLock` before it writes.
+
+use super::*;
+
+/// What `install` would do with this build, without doing it.
+pub async fn plan(ctx: &Ctx, tag: &str, sha256: &str) -> Result<InstallPlan, ModsError> {
+    ensure_installed(&ctx.paths, tag)?;
+    let sha = check_sha(sha256)?;
+    let catalog = current_catalog(ctx).await?;
+    let lock = store::read_lock(&ctx.paths, tag)?;
+    let (abi, _) = version_abi(&ctx.paths, &catalog, tag, true).await;
+    let fit = abi.as_deref().map(Fit::here);
+    plan::plan_install(&catalog, &lock, tag, &sha, fit, ctx.is_running(tag))
+}
+
+// ---------------------------------------------------------------------------------------------
+// Installing: stage, fetch, commit
+
+/// An install resolved against the profile as it was, with its builds reserved, and the token
+/// of what it does.
+pub struct Staged {
+    tag: String,
+    catalog: Catalog,
+    abi: String,
+    wanted: Vec<(CatalogMod, CatalogVersion)>,
+    snapshot: Lock,
+    res: Resolution,
+    held: Vec<Reservation>,
+    pub token: String,
+}
+
+pub(super) fn plan_changed() -> ModsError {
+    ModsError::ChangedMeanwhile("what this does changed since it was shown".into())
+}
+
+impl Staged {
+    /// `ModChangedMeanwhile` unless this is the plan the player agreed to.
+    pub fn agree(&self, plan_token: &str) -> Result<(), ModsError> {
+        if self.token == plan_token {
+            Ok(())
+        } else {
+            Err(plan_changed())
+        }
+    }
+}
+
+/// Resolves what `wanted` needs. `held` are reservations the caller already took.
+pub fn stage(
+    ctx: &Ctx,
+    tag: &str,
+    catalog: Catalog,
+    abi: String,
+    wanted: Vec<(CatalogMod, CatalogVersion)>,
+    mut held: Vec<Reservation>,
+) -> Result<Staged, ModsError> {
+    let snapshot = store::read_lock(&ctx.paths, tag)?;
+    let res = plan::resolve(&catalog, &snapshot, wanted.clone(), Fit::here(&abi));
+    let token = plan_token(Some(&abi), &snapshot, &res);
+    held.extend(
+        res.picks
+            .iter()
+            .map(|(_, v)| ctx.reservations.reserve(&v.sha256)),
+    );
+    Ok(Staged {
+        tag: tag.to_string(),
+        catalog,
+        abi,
+        wanted,
+        snapshot,
+        res,
+        held,
+        token,
+    })
+}
+
+fn step<'a>(op: &'a Operation, picks: &'a [(CatalogMod, CatalogVersion)], i: usize) -> Step<'a> {
+    Step {
+        op,
+        index: i + 1,
+        count: picks.len(),
+        sha256: &picks[i].1.sha256,
+        mod_id: &picks[i].0.id,
+    }
+}
+
+/// Downloads every build the install needs into the store, unless it is there and intact.
+pub async fn fetch(ctx: &Ctx, staged: &Staged, op: &Operation) -> Result<(), ModsError> {
+    let platform = Fit::here(&staged.abi).platform;
+    let picks = &staged.res.picks;
+    for (i, (m, v)) in picks.iter().enumerate() {
+        let at = step(op, picks, i);
+        install::fetch_to_store(
+            &ctx.paths,
+            m,
+            v,
+            platform,
+            op,
+            ctx.checks_urls(),
+            |stage, percent| ctx.emit(at, stage, percent),
+        )
+        .await?;
+    }
+    Ok(())
+}
+
+/// What every write that follows a download checks first, under `ModsLock`: the operation wasn't
+/// cancelled, and the game version is still installed and not running. Gives the latest
+/// catalogue: the one the page last loaded, else `fallback`.
+fn recheck_under_lock(
+    ctx: &Ctx,
+    tag: &str,
+    op: &Operation,
+    fallback: Catalog,
+) -> Result<Catalog, ModsError> {
+    op.check()?;
+    if ensure_installed(&ctx.paths, tag).is_err() {
+        return Err(ModsError::ChangedMeanwhile(format!("{tag} was removed")));
+    }
+    if ctx.is_running(tag) {
+        return Err(ModsError::ChangedMeanwhile(format!("{tag} was started")));
+    }
+    Ok(ctx.held_catalog().unwrap_or(fallback))
+}
+
+/// Writes a downloaded install into the profile. Under `ModsLock`, it first checks that what
+/// the player agreed to still holds ([`recheck_under_lock`]), and then that the consent does:
+/// every wanted build is read again from the latest catalogue (the same hash may come with
+/// other trust, dependencies or interface now) and must still be installable on the version's
+/// mod interface as it is known now; none of the builds is revoked; and resolving again
+/// against the latest profile, catalogue and interface gives the same plan token. Otherwise
+/// `ModChangedMeanwhile` (`ModCancelled` if the operation was cancelled), and nothing is
+/// written.
+pub async fn commit(ctx: &Ctx, staged: Staged, op: &Operation) -> Result<ChangeResult, ModsError> {
+    let Staged {
+        tag,
+        catalog,
+        abi,
+        wanted,
+        snapshot,
+        res,
+        held,
+        token,
+    } = staged;
+    let _guard = ctx.lock_mods().await;
+    let catalog = recheck_under_lock(ctx, &tag, op, catalog)?;
+    let changed = ModsError::ChangedMeanwhile;
+    let abi_now = cached_abi(&ctx.paths, &tag, &catalog.weft).unwrap_or_else(|| abi.clone());
+    if abi_now != abi {
+        return Err(changed(format!("the mod interface of {tag} changed")));
+    }
+    let mut fresh = Vec::with_capacity(wanted.len());
+    for (m, v) in &wanted {
+        let Some((m, v)) = catalog.find(&v.sha256) else {
+            return Err(changed(format!(
+                "{} {} is no longer in the catalogue",
+                m.name, v.version
+            )));
+        };
+        fresh.push((m.clone(), v.clone()));
+    }
+    for (m, v) in &res.picks {
+        if let Some(r) = catalog.revocation(&v.sha256) {
+            return Err(changed(format!(
+                "{} {} was revoked: {}",
+                m.name,
+                v.version,
+                r.detail()
+            )));
+        }
+    }
+    for (m, v) in &fresh {
+        plan::check_installable(&catalog, m, v, Fit::here(&abi_now))
+            .map_err(|e| changed(format!("{} {}: {e}", m.name, v.version)))?;
+    }
+    let mut lock = store::read_lock(&ctx.paths, &tag)?;
+    let now = plan::resolve(&catalog, &lock, fresh, Fit::here(&abi_now));
+    plan::still_holds((&snapshot, &res), (&lock, &now)).map_err(changed)?;
+    if plan_token(Some(&abi_now), &lock, &now) != token {
+        return Err(plan_changed());
+    }
+
+    op.start_writing()?;
+    for i in 0..now.picks.len() {
+        ctx.emit(step(op, &now.picks, i), ProgressStage::Installing, 100);
+    }
+    let done = plan::commit(&mut lock, &now);
+    save(ctx, &tag, &lock, None, held).await?;
+    Ok(ChangeResult {
+        installed: done.installed,
+        also_enabled: done.also_enabled,
+        installed_off: done.installed_off,
+        missing: now.missing,
+        ..change_result(ctx, &tag, &lock, &catalog).await
+    })
+}
+
+/// Downloads and commits a staged install. A cancelled one also takes the builds it already
+/// stored along, so it leaves no trace.
+async fn finish(ctx: &Ctx, staged: Staged, op: &Operation) -> Result<ChangeResult, ModsError> {
+    let result = match fetch(ctx, &staged, op).await {
+        Ok(()) => commit(ctx, staged, op).await,
+        Err(e) => {
+            drop(staged);
+            Err(e)
+        }
+    };
+    if matches!(result, Err(ModsError::Cancelled)) {
+        let _held = ctx.lock_mods().await;
+        ctx.collect_garbage().await;
+    }
+    result
+}
+
+/// The operations a command takes for an install it agreed to.
+pub struct Agreed<'a> {
+    pub plan_token: &'a str,
+    pub op: &'a Operation,
+}
+
+pub(super) async fn run_install(
+    ctx: &Ctx,
+    tag: &str,
+    catalog: Catalog,
+    abi: String,
+    wanted: Vec<(CatalogMod, CatalogVersion)>,
+    held: Vec<Reservation>,
+    agreed: Agreed<'_>,
+) -> Result<ChangeResult, ModsError> {
+    let staged = stage(ctx, tag, catalog, abi, wanted, held)?;
+    staged.agree(agreed.plan_token)?;
+    finish(ctx, staged, agreed.op).await
+}
+
+/// Installs the catalogue build with this hash, and what it needs, as planned by [`plan`] with
+/// `plan_token`. Installing another build of an installed mod replaces it and keeps it on or off
+/// as it was; a mod that needs something missing, at any depth, is installed turned off.
+pub async fn install(
+    ctx: &Ctx,
+    tag: &str,
+    sha256: &str,
+    plan_token: &str,
+    operation_id: &str,
+) -> Result<ChangeResult, ModsError> {
+    let op = ctx.operations.begin(operation_id)?;
+    ensure_installed(&ctx.paths, tag)?;
+    let sha = check_sha(sha256)?;
+    ctx.ensure_not_running(tag)?;
+    let catalog = current_catalog(ctx).await?;
+    let (m, v) = catalog
+        .find(&sha)
+        .map(|(m, v)| (m.clone(), v.clone()))
+        .ok_or_else(|| ModsError::NotInCatalog(sha.clone()))?;
+    let abi = require_abi(&ctx.paths, &catalog, tag).await?;
+    plan::check_installable(&catalog, &m, &v, Fit::here(&abi))?;
+    let agreed = Agreed {
+        plan_token,
+        op: &op,
+    };
+    run_install(ctx, tag, catalog, abi, vec![(m, v)], Vec::new(), agreed).await
+}
+
+/// What the launcher can tell about a zip from the player's computer, before installing it.
+pub async fn inspect_file(ctx: &Ctx, tag: &str, path: &str) -> Result<FileInspection, ModsError> {
+    ensure_installed(&ctx.paths, tag)?;
+    let catalog = current_catalog(ctx).await?;
+    let (abi, _) = version_abi(&ctx.paths, &catalog, tag, true).await;
+    let lock = store::read_lock(&ctx.paths, tag)?;
+    let path = PathBuf::from(path);
+    blocking(move || inspect::inspect(&path, &catalog, abi.as_deref(), current_platform(), &lock))
+        .await
+}
+
+/// Installs a zip from the player's computer. `sha256` and `plan_token` are what
+/// `inspect_file` showed, so a file swapped in between, or a plan that changed, is refused. A
+/// file that is in the catalogue installs from these same bytes, with the catalogue's metadata,
+/// trust and dependencies; anything else is Unverified. Either way, revocations are checked
+/// again under the lock before anything is written, by the file's hash.
+pub async fn install_file(
+    ctx: &Ctx,
+    tag: &str,
+    path: &str,
+    sha256: &str,
+    plan_token: &str,
+    operation_id: &str,
+) -> Result<ChangeResult, ModsError> {
+    let op = ctx.operations.begin(operation_id)?;
+    ensure_installed(&ctx.paths, tag)?;
+    let sha = check_sha(sha256)?;
+    ctx.ensure_not_running(tag)?;
+    let catalog = current_catalog(ctx).await?;
+    if let Some(r) = catalog.revocation(&sha) {
+        return Err(ModsError::Revoked(r.detail()));
+    }
+    let source = PathBuf::from(path);
+    inspect::checked_size(&source)?;
+    let hold = ctx.reservations.reserve(&sha);
+    let admit = |id: Option<String>, platform| {
+        let (paths, source, sha) = (ctx.paths.clone(), source.clone(), sha.clone());
+        blocking(move || store::admit_local(&paths, &source, &sha, id.as_deref(), platform))
+    };
+
+    if let Some((m, v)) = catalog.find(&sha).map(|(m, v)| (m.clone(), v.clone())) {
+        let abi = require_abi(&ctx.paths, &catalog, tag).await?;
+        let platform = Fit::here(&abi).platform;
+        plan::check_installable(&catalog, &m, &v, Fit::here(&abi))?;
+        let staged = stage(ctx, tag, catalog, abi, vec![(m.clone(), v)], vec![hold])?;
+        staged.agree(plan_token)?;
+        let at = step(&op, &staged.res.picks, 0);
+        ctx.emit(at, ProgressStage::Verifying, 0);
+        admit(Some(m.id.clone()), platform).await?;
+        ctx.emit(at, ProgressStage::Verifying, 100);
+        return finish(ctx, staged, &op).await;
+    }
+
+    let (abi, _) = version_abi(&ctx.paths, &catalog, tag, true).await;
+    let at = Step {
+        op: &op,
+        index: 1,
+        count: 1,
+        sha256: &sha,
+        mod_id: "",
+    };
+    let result = async {
+        ctx.emit(at, ProgressStage::Verifying, 0);
+        let info = admit(None, current_platform()).await?;
+        if info.id == RESERVED_ID {
+            return Err(ModsError::IdReserved(info.id));
+        }
+        let at = Step {
+            mod_id: &info.id,
+            ..at
+        };
+        ctx.emit(at, ProgressStage::Verifying, 100);
+        let mut entry = inspect::local_entry(&info, &ctx.paths.store_object(&sha), &source, &sha)?;
+
+        let _guard = ctx.lock_mods().await;
+        let latest = recheck_under_lock(ctx, tag, &op, catalog)?;
+        // A revocation that arrived while the file was copied and hashed.
+        if let Some(r) = latest.revocation(&sha) {
+            return Err(ModsError::Revoked(r.detail()));
+        }
+        let mut lock = store::read_lock(&ctx.paths, tag)?;
+        if inspect::file_token(abi.as_deref(), &info.id, &sha, &lock) != plan_token {
+            return Err(plan_changed());
+        }
+        op.start_writing()?;
+        ctx.emit(at, ProgressStage::Installing, 100);
+        entry.enabled = lock.get(&entry.id).is_none_or(|e| e.enabled);
+        lock.put(entry);
+        save(ctx, tag, &lock, None, vec![hold]).await?;
+        Ok((lock, latest, info.id))
+    }
+    .await;
+    match result {
+        Ok((lock, latest, id)) => Ok(ChangeResult {
+            installed: vec![id],
+            ..change_result(ctx, tag, &lock, &latest).await
+        }),
+        Err(e) => {
+            // Whatever reached the store is nobody's now.
+            let _held = ctx.lock_mods().await;
+            ctx.collect_garbage().await;
+            Err(e)
+        }
+    }
+}
+
+// ---------------------------------------------------------------------------------------------
+// On, off, remove, undo
+
+/// Turning a mod on turns on the installed mods it needs, and is refused when one of them is
+/// revoked; turning it off turns off what needs it.
+pub async fn set_enabled(
+    ctx: &Ctx,
+    tag: &str,
+    id: &str,
+    enabled: bool,
+) -> Result<ChangeResult, ModsError> {
+    ensure_installed(&ctx.paths, tag)?;
+    ctx.ensure_not_running(tag)?;
+    let catalog = current_catalog(ctx).await?;
+    let _guard = ctx.lock_mods().await;
+    ctx.ensure_not_running(tag)?;
+    let mut lock = store::read_lock(&ctx.paths, tag)?;
+    let (also_enabled, also_disabled) = plan::set_enabled(&mut lock, &catalog, id, enabled)?;
+    save(ctx, tag, &lock, None, Vec::new()).await?;
+    Ok(ChangeResult {
+        also_enabled,
+        also_disabled,
+        ..change_result(ctx, tag, &lock, &catalog).await
+    })
+}
+
+/// Removes a mod and turns off what needed it. Until the version's next change, the removal
+/// can be undone with [`restore`]: the entry is kept, and so is its store file.
+pub async fn remove(ctx: &Ctx, tag: &str, id: &str) -> Result<ChangeResult, ModsError> {
+    ensure_installed(&ctx.paths, tag)?;
+    ctx.ensure_not_running(tag)?;
+    let catalog = current_catalog(ctx).await?;
+    let _guard = ctx.lock_mods().await;
+    ctx.ensure_not_running(tag)?;
+    let mut lock = store::read_lock(&ctx.paths, tag)?;
+    let entry = lock
+        .get(id)
+        .cloned()
+        .ok_or_else(|| ModsError::NotInstalled(id.to_string()))?;
+    let also_disabled = plan::remove(&mut lock, id)?;
+    let removed = Removed {
+        entry,
+        also_disabled: also_disabled.clone(),
+    };
+    let kept = save(ctx, tag, &lock, Some(&removed), Vec::new()).await?;
+    Ok(ChangeResult {
+        also_disabled,
+        undo: kept.then(|| id.to_string()),
+        ..change_result(ctx, tag, &lock, &catalog).await
+    })
+}
+
+/// Puts the most recently removed mod back exactly as it was: the same build, on or off as it
+/// was, and the mods its removal turned off on again. `ModNotInstalled` when that isn't
+/// possible any more: the version changed since, or the store file is gone or changed.
+pub async fn restore(
+    ctx: &Ctx,
+    tag: &str,
+    id: &str,
+    operation_id: &str,
+) -> Result<ChangeResult, ModsError> {
+    let op = ctx.operations.begin(operation_id)?;
+    ensure_installed(&ctx.paths, tag)?;
+    ctx.ensure_not_running(tag)?;
+    let catalog = current_catalog(ctx).await?;
+    let _guard = ctx.lock_mods().await;
+    ctx.ensure_not_running(tag)?;
+    let gone = || ModsError::NotInstalled(id.to_string());
+    let removed = store::read_removed(&ctx.paths, tag)?
+        .filter(|r| r.entry.id == id)
+        .ok_or_else(gone)?;
+    let mut lock = store::read_lock(&ctx.paths, tag)?;
+    if lock.get(id).is_some() {
+        return Err(gone());
+    }
+    let (stored, sha) = (
+        ctx.paths.store_object(&removed.entry.sha256),
+        removed.entry.sha256.clone(),
+    );
+    let at = Step {
+        op: &op,
+        index: 1,
+        count: 1,
+        sha256: &removed.entry.sha256,
+        mod_id: &removed.entry.id,
+    };
+    ctx.emit(at, ProgressStage::Verifying, 0);
+    let intact =
+        blocking(move || Ok(sha256_file(&stored).is_ok_and(|actual| actual == sha))).await?;
+    if !intact {
+        return Err(gone());
+    }
+    op.start_writing()?;
+    ctx.emit(at, ProgressStage::Installing, 100);
+    lock.put(removed.entry);
+    let mut also_enabled = Vec::new();
+    for dep in &removed.also_disabled {
+        if let Some(e) = lock.get_mut(dep)
+            && !e.enabled
+        {
+            e.enabled = true;
+            also_enabled.push(dep.clone());
+        }
+    }
+    profile::apply_revocations(&mut lock, &catalog);
+    also_enabled.retain(|id| lock.get(id).is_some_and(|e| e.enabled));
+    save(ctx, tag, &lock, None, Vec::new()).await?;
+    Ok(ChangeResult {
+        also_enabled,
+        ..change_result(ctx, tag, &lock, &catalog).await
+    })
+}
+
+// ---------------------------------------------------------------------------------------------
+// Copying a mod set
diff --git a/src-tauri/src/mods/service/copying.rs b/src-tauri/src/mods/service/copying.rs
new file mode 100644
index 0000000..a54ad72
--- /dev/null
+++ b/src-tauri/src/mods/service/copying.rs
@@ -0,0 +1,82 @@
+//! "Copy mods from…": the preview, and the copy it agrees to.
+
+use super::*;
+
+struct CopyInputs {
+    catalog: Catalog,
+    abi: String,
+    preview: CopyPreview,
+    picks: Vec<(CatalogMod, CatalogVersion)>,
+}
+
+async fn copy_inputs(ctx: &Ctx, from: &str, to: &str) -> Result<CopyInputs, ModsError> {
+    ensure_installed(&ctx.paths, to)?;
+    let source = store::read_lock(&ctx.paths, from)?;
+    let target = store::read_lock(&ctx.paths, to)?;
+    let catalog = current_catalog(ctx).await?;
+    let abi = require_abi(&ctx.paths, &catalog, to).await?;
+    let (preview, picks) =
+        plan::copy_preview(&catalog, (from, &source), (to, &target), Fit::here(&abi));
+    Ok(CopyInputs {
+        catalog,
+        abi,
+        preview,
+        picks,
+    })
+}
+
+/// What `copy` would bring over.
+pub async fn copy_preview(ctx: &Ctx, from: &str, to: &str) -> Result<CopyPreview, ModsError> {
+    Ok(copy_inputs(ctx, from, to).await?.preview)
+}
+
+/// Brings the turned-on mods of one version to another, each as the build made for the new one,
+/// as previewed with `plan_token`. Mods the new version already has are left as they are.
+pub async fn copy(
+    ctx: &Ctx,
+    from: &str,
+    to: &str,
+    plan_token: &str,
+    operation_id: &str,
+) -> Result<CopyResult, ModsError> {
+    let op = ctx.operations.begin(operation_id)?;
+    ctx.ensure_not_running(to)?;
+    let inputs = copy_inputs(ctx, from, to).await?;
+    if inputs.preview.plan_token != plan_token {
+        return Err(plan_changed());
+    }
+    let left_behind = inputs
+        .preview
+        .items
+        .into_iter()
+        .filter(|i| {
+            matches!(
+                i.outcome,
+                CopyOutcome::NoBuild | CopyOutcome::LocalFile | CopyOutcome::Revoked
+            )
+        })
+        .collect();
+    let change = if inputs.picks.is_empty() {
+        let lock = store::read_lock(&ctx.paths, to)?;
+        change_result(ctx, to, &lock, &inputs.catalog).await
+    } else {
+        let agreed = Agreed {
+            plan_token,
+            op: &op,
+        };
+        run_install(
+            ctx,
+            to,
+            inputs.catalog,
+            inputs.abi,
+            inputs.picks,
+            Vec::new(),
+            agreed,
+        )
+        .await?
+    };
+    Ok(CopyResult {
+        change,
+        left_behind,
+    })
+}
diff --git a/src-tauri/src/mods/service/fetching.rs b/src-tauri/src/mods/service/fetching.rs
new file mode 100644
index 0000000..17ee5b2
--- /dev/null
+++ b/src-tauri/src/mods/service/fetching.rs
@@ -0,0 +1,249 @@
+//! The catalogue: the signed index and every source fetched (concurrently, each in its own
+//! order), held in parts so a late answer never replaces a newer one; icons; the list of sources.
+
+use super::*;
+
+fn source_result(repo: String, f: SourceFetch) -> SourceResult {
+    SourceResult {
+        repo,
+        mods: f.mods,
+        freshness: f.freshness,
+        checked: f.checked,
+        error: f.error.map(AppError::from),
+        no_mods: f.no_mods,
+    }
+}
+
+/// The player's sources, or none and why: a damaged list is kept aside and said, never
+/// taken for an empty one.
+fn listed_sources(paths: &Paths) -> (Vec<String>, Option<AppError>) {
+    match sources::list(paths) {
+        Ok(repos) => (repos, None),
+        Err(e) => (Vec::new(), Some(e.into())),
+    }
+}
+
+fn index_status(state: &mut IndexState) -> IndexStatus {
+    IndexStatus {
+        freshness: state.freshness,
+        generated: state.index.as_ref().map(|i| i.generated.clone()),
+        signed_at: state.signed_at.map(rfc3339),
+        error: state.error.take().map(AppError::from),
+        cache_error: state.cache_error.take().map(AppError::from),
+    }
+}
+
+fn build_catalog(mut state: IndexState, sources: Vec<SourceResult>) -> Catalog {
+    let status = index_status(&mut state);
+    catalog::build(state.index.as_ref(), status, sources)
+}
+
+fn index_cache(paths: &Paths) -> IndexCache {
+    IndexCache::new(&paths.cache_dir(), index::public_key())
+}
+
+/// How many sources are asked at once: one slow source doesn't hold up the others.
+const SOURCE_FETCHES_AT_ONCE: usize = 4;
+
+/// The index and every source; refreshed from the network when `refresh` is set.
+///
+/// Each part is held as soon as it is in, so nothing waits on the slowest source: the index (with
+/// its revocations, which Play and every set read apply from what is held) the moment it is
+/// verified, then each source as it answers. Each early part is also said to the page
+/// ([`Ctx::tell_catalog`], the `mod-catalog` event) with the sources still asked. The page sees
+/// this list, and installs only what is in it.
+///
+/// Each call takes a ticket as it starts. What it found is merged into the held catalogue part
+/// by part, and only over parts from refreshes that started before it ([`Ctx::publish_catalog`]):
+/// a slow refresh that finishes last can't put an older answer back. It returns the merged
+/// catalogue, which is what the page should show.
+pub async fn load_catalog(ctx: &Ctx, refresh: bool) -> Result<Catalog, ModsError> {
+    use futures_util::stream::{self, StreamExt};
+    // Read from disk only, it never replaces a part a refresh brought: ticket 0 is the oldest.
+    let ticket = if refresh { ctx.catalog_ticket() } else { 0 };
+    let client = http()?;
+    let cache = IndexCache::new(&ctx.paths.cache_dir(), ctx.index_key());
+    let url = ctx.index_url().to_string();
+    let index_load = index::load(&cache, refresh, OffsetDateTime::now_utc(), async {
+        let bytes = index::fetch_bytes(&client, &url).await?;
+        let sig = index::fetch_bytes(&client, &format!("{url}.minisig")).await?;
+        let sig = String::from_utf8(sig)
+            .map_err(|_| ModsError::IndexSignatureInvalid("not text".into()))?;
+        Ok((bytes, sig))
+    });
+    let (repos, _) = listed_sources(&ctx.paths);
+    // Which sources this refresh still waits on, for what is said early.
+    let pending = std::sync::Mutex::new(repos.clone());
+    let still_asked = || pending.lock().unwrap().clone();
+    let index_part = async {
+        let mut state = index_load.await;
+        let index_status = index_status(&mut state);
+        let (listed, sources_error) = listed_sources(&ctx.paths);
+        let early = CatalogParts {
+            index: state.index.clone(),
+            index_status: index_status.clone(),
+            index_ticket: ticket,
+            sources: Vec::new(),
+            sources_error,
+        };
+        ctx.tell_catalog(ctx.publish_catalog(early, &listed), still_asked());
+        (state.index, index_status)
+    };
+    let sources_load = stream::iter(repos)
+        .map(|repo| {
+            let (paths, client) = (&ctx.paths, &client);
+            async move {
+                let f = sources::fetch(paths, client, ctx.github_api(), &repo, refresh).await;
+                (source_result(repo, f), ticket)
+            }
+        })
+        .buffer_unordered(SOURCE_FETCHES_AT_ONCE)
+        .map(|(result, at)| {
+            pending
+                .lock()
+                .unwrap()
+                .retain(|r| !index::same_repo(r, &result.repo));
+            let (listed, sources_error) = listed_sources(&ctx.paths);
+            // Before the index is in, there is nothing to put it into yet: it waits for the end.
+            if let Some(catalog) = ctx.publish_source(at, result.clone(), &listed, sources_error) {
+                ctx.tell_catalog(catalog, still_asked());
+            }
+            (result, at)
+        })
+        .collect::<Vec<_>>();
+    let ((index, index_status), fetched) =
+        futures_util::future::join(index_part, sources_load).await;
+    // The whole refresh, once more, in the order of the list as it is now: a source removed
+    // meanwhile isn't brought back.
+    let (listed, sources_error) = listed_sources(&ctx.paths);
+    let parts = CatalogParts {
+        index_status,
+        index,
+        index_ticket: ticket,
+        sources: fetched,
+        sources_error,
+    };
+    Ok(ctx.publish_catalog(parts, &listed))
+}
+
+/// Asks one source again, alone: its answer replaces only its own part of the held catalogue,
+/// so the others keep theirs and nothing waits on them. With nothing held yet, a whole load.
+pub async fn refresh_source(ctx: &Ctx, repo: &str) -> Result<Catalog, ModsError> {
+    let (listed, sources_error) = listed_sources(&ctx.paths);
+    let Some(repo) = listed.iter().find(|r| index::same_repo(r, repo)).cloned() else {
+        return Err(ModsError::SourceNotFound(repo.to_string()));
+    };
+    let ticket = ctx.catalog_ticket();
+    let f = sources::fetch(&ctx.paths, &http()?, ctx.github_api(), &repo, true).await;
+    let (listed, _) = listed_sources(&ctx.paths);
+    match ctx.publish_source(ticket, source_result(repo, f), &listed, sources_error) {
+        Some(catalog) => Ok(catalog),
+        None => load_catalog(ctx, false).await,
+    }
+}
+
+/// The catalogue from what is on disk: the cached index and each source's last answer.
+pub fn offline_catalog(paths: &Paths) -> Catalog {
+    let state = index::cached(&index_cache(paths), OffsetDateTime::now_utc());
+    let (repos, sources_error) = listed_sources(paths);
+    let sources = repos
+        .into_iter()
+        .map(|repo| {
+            let f = sources::cached(paths, &repo);
+            source_result(repo, f)
+        })
+        .collect();
+    Catalog {
+        sources_error,
+        ..build_catalog(state, sources)
+    }
+}
+
+/// The list the page last saw, else the one on disk: never touches the network.
+pub async fn current_catalog(ctx: &Ctx) -> Result<Catalog, ModsError> {
+    if let Some(c) = ctx.held_catalog() {
+        return Ok(c);
+    }
+    let paths = ctx.paths.clone();
+    blocking(move || Ok(offline_catalog(&paths))).await
+}
+
+pub const MAX_ICON_BYTES: usize = 512 * 1024;
+const PNG_MAGIC: &[u8] = b"\x89PNG\r\n\x1a\n";
+
+/// An icon's bytes, read up to [`MAX_ICON_BYTES`] and only if they are a PNG.
+pub async fn fetch_icon(client: &reqwest::Client, url: &str) -> Result<Vec<u8>, ModsError> {
+    let response = client
+        .get(url)
+        .timeout(Duration::from_secs(15))
+        .send()
+        .await?;
+    if !response.status().is_success() {
+        return Err(ModsError::Http {
+            status: response.status().as_u16(),
+            url: url.to_string(),
+        });
+    }
+    let bytes = read_capped(response, MAX_ICON_BYTES)
+        .await?
+        .ok_or_else(|| ModsError::TooLarge("icon over 512 KB".into()))?;
+    if !bytes.starts_with(PNG_MAGIC) {
+        return Err(ModsError::IconInvalid(url.to_string()));
+    }
+    Ok(bytes)
+}
+
+/// A catalogue icon as PNG bytes, from the cache or the network. Only icons the catalogue
+/// names, and only from GitHub's hosts ([`crate::download::icon_url_allowed`]); redirects are
+/// held to GitHub too.
+pub async fn icon_png(ctx: &Ctx, url: &str) -> Result<Vec<u8>, ModsError> {
+    let known = ctx
+        .held_catalog()
+        .is_some_and(|c| c.mods.iter().any(|m| m.icon.as_deref() == Some(url)));
+    if !known || !crate::download::icon_url_allowed(url) {
+        return Err(ModsError::NotInCatalog(url.to_string()));
+    }
+    let cache = ctx.paths.cache_dir().join("mod-icons").join(format!(
+        "{}.png",
+        &crate::download::sha256_hex(url.as_bytes())[..32]
+    ));
+    if let Ok(bytes) = std::fs::read(&cache)
+        && bytes.len() <= MAX_ICON_BYTES
+        && bytes.starts_with(PNG_MAGIC)
+    {
+        return Ok(bytes);
+    }
+    let bytes = fetch_icon(&http()?, url).await?;
+    let _ = write_atomic(&cache, &bytes);
+    Ok(bytes)
+}
+
+// ---------------------------------------------------------------------------------------------
+// Sources
+
+/// The player's sources; `ModSourcesDamaged` when the list couldn't be read (it is kept aside).
+pub fn source_list(ctx: &Ctx) -> Result<Vec<String>, ModsError> {
+    sources::list(&ctx.paths)
+}
+
+/// Adds a repo as GitHub spells it. Adding one already there, in any case, keeps one entry.
+pub async fn add_source(ctx: &Ctx, repo: &str) -> Result<Vec<String>, ModsError> {
+    let repo = sources::normalize(repo)?;
+    let canonical = sources::canonical_name(&http()?, ctx.github_api(), &repo).await?;
+    let _held = ctx.lock_mods().await;
+    // A damaged list is already kept aside: this starts a new one.
+    let repos = sources::with_repo(sources::list_for_change(&ctx.paths)?, &canonical);
+    sources::save(&ctx.paths, &repos)?;
+    Ok(repos)
+}
+
+/// Mods installed from the repo stay installed; they just stop getting updates.
+pub async fn remove_source(ctx: &Ctx, repo: &str) -> Result<Vec<String>, ModsError> {
+    let _held = ctx.lock_mods().await;
+    let repos = sources::without_repo(sources::list(&ctx.paths)?, repo);
+    sources::save(&ctx.paths, &repos)?;
+    Ok(repos)
+}
+
+// ---------------------------------------------------------------------------------------------
+// Profiles
diff --git a/src-tauri/src/mods/service/launching.rs b/src-tauri/src/mods/service/launching.rs
new file mode 100644
index 0000000..70d9cff
--- /dev/null
+++ b/src-tauri/src/mods/service/launching.rs
@@ -0,0 +1,62 @@
+//! Before Play: what the game is handed, or why it would not start.
+
+use super::*;
+
+/// What Play does with a version's mod set.
+#[derive(Debug, PartialEq, Eq)]
+pub enum LaunchPlan {
+    /// Nothing is on: the game starts without `--mods`.
+    NoMods,
+    /// `--mods <the version's mods folder>`.
+    Mods,
+    /// The game would refuse to start: the names of the mods that stop it.
+    Blocked(Vec<String>),
+}
+
+/// Blockers come first: the player's own folder loads even without `--mods`, so a revoked mod
+/// shadowed there blocks with nothing on.
+pub fn launch_plan(lock: &Lock, report: &ProfileReport) -> LaunchPlan {
+    if !report.blocking.is_empty() {
+        return LaunchPlan::Blocked(report.blocking.iter().map(|id| lock.name_of(id)).collect());
+    }
+    if lock.mods.iter().any(|m| m.enabled) {
+        LaunchPlan::Mods
+    } else {
+        LaunchPlan::NoMods
+    }
+}
+
+/// The outcome of the pre-Play check. Holds `ModsLock` until [`LaunchMods::release`], so no mod
+/// change can land between this check and the game counting as running.
+pub struct LaunchMods {
+    dir: Option<PathBuf>,
+    _held: OwnedMutexGuard<()>,
+}
+
+impl LaunchMods {
+    /// The folder to hand to `--mods`, letting mod changes go ahead again.
+    pub fn release(self) -> Option<PathBuf> {
+        self.dir
+    }
+}
+
+/// Before Play: the folder to hand to `--mods`, or why the game would not start. Never touches
+/// the network: it uses the catalogue the page last saw or the cached one, and the cached ABI.
+/// Without a known ABI the mods are only unchecked, and the game itself has the last word.
+pub async fn prepare_launch(ctx: &Ctx, tag: &str) -> Result<LaunchMods, ModsError> {
+    let catalog = current_catalog(ctx).await?;
+    let held = ctx.lock_mods().await;
+    ctx.ensure_not_running(tag)?;
+    let mut lock = store::read_lock(&ctx.paths, tag)?;
+    if profile::apply_revocations(&mut lock, &catalog) {
+        store::write_lock(&ctx.paths, tag, &lock)?;
+    }
+    reconcile(ctx, tag, &lock).await?;
+    let report = build_report(ctx, tag, &lock, &catalog, false).await;
+    let dir = match launch_plan(&lock, &report) {
+        LaunchPlan::NoMods => None,
+        LaunchPlan::Mods => Some(ctx.paths.mods_dir(tag)?),
+        LaunchPlan::Blocked(names) => return Err(ModsError::Blocked(names.join(", "))),
+    };
+    Ok(LaunchMods { dir, _held: held })
+}
diff --git a/src-tauri/src/mods/service/mod.rs b/src-tauri/src/mods/service/mod.rs
new file mode 100644
index 0000000..ed75d71
--- /dev/null
+++ b/src-tauri/src/mods/service/mod.rs
@@ -0,0 +1,253 @@
+//! The mod manager's operations, one per command, on a [`Ctx`]. The rules they apply live in
+//! `plan.rs` and `profile.rs`; this is where the disk, the network and the locks come in.
+//!
+//! - Every change to a profile or the store happens under `ModsLock`, so two clicks never write
+//!   `mods.lock.json` at once. Downloads happen before taking it.
+//! - The consent boundary is the plan the player reviewed. `plan`, `copy_preview` and
+//!   `inspect_file` hand the page a `planToken` ([`plan::Consent`]); `install`, `copy` and
+//!   `install_file` take it back. The token is recomputed from the current catalogue, profile
+//!   and ABI before anything is downloaded and again under the lock at commit; when it differs,
+//!   the command fails with `ModChangedMeanwhile` and writes nothing (see [`commit`]).
+//! - Each of those commands, and `restore`, runs as an [`Operation`] with the page's id: its
+//!   progress carries that id, and `cancel_mod_operation` stops it until it starts writing.
+//! - Nothing rewrites a version's `mods/` folder while its game runs. Revocations that arrive
+//!   meanwhile are reported as pending and applied when it stops ([`apply_pending`]).
+//! - Hashing and copying files run off the async runtime ([`blocking`]).
+
+use std::path::PathBuf;
+use std::time::Duration;
+use time::OffsetDateTime;
+use time::format_description::well_known::Rfc3339;
+use tokio::sync::OwnedMutexGuard;
+
+use super::abi::{abi_for_tag, cached_abi};
+use super::archive::current_platform;
+use super::catalog::{
+    self, Catalog, CatalogMod, CatalogParts, CatalogVersion, IndexStatus, SourceResult,
+};
+use super::context::{Ctx, Operation, Step, blocking, check_sha, ensure_installed};
+use super::error::ModsError;
+use super::index::{self, IndexCache, IndexState, RESERVED_ID};
+use super::inspect::{self, FileInspection};
+use super::install::{self, ProgressStage};
+use super::paths::{Paths, write_atomic};
+use super::plan::{
+    self, ChangeResult, CopyOutcome, CopyPreview, CopyResult, InstallPlan, Resolution, plan_token,
+};
+use super::profile::{self, Fit, Lock, PlayerFile, ProfileReport};
+use super::sources::{self, SourceFetch};
+use super::store::{self, Removed, Reservation};
+use crate::download::{read_capped, sha256_file};
+use crate::error::AppError;
+
+mod changes;
+mod copying;
+mod fetching;
+mod launching;
+
+pub use changes::*;
+pub use copying::*;
+pub use fetching::*;
+pub use launching::*;
+
+/// For the index, sources, icons and the ABI: redirects stay on GitHub, over https.
+pub fn http() -> Result<reqwest::Client, ModsError> {
+    Ok(reqwest::Client::builder()
+        .connect_timeout(Duration::from_secs(15))
+        .redirect(crate::download::redirect_policy())
+        .build()?)
+}
+
+// ---------------------------------------------------------------------------------------------
+// Catalogue
+
+fn rfc3339(t: OffsetDateTime) -> String {
+    t.format(&Rfc3339).unwrap_or_default()
+}
+
+pub async fn version_abi(
+    paths: &Paths,
+    catalog: &Catalog,
+    tag: &str,
+    network: bool,
+) -> (Option<String>, Option<AppError>) {
+    if let Some(abi) = cached_abi(paths, tag, &catalog.weft) {
+        return (Some(abi), None);
+    }
+    if !network {
+        return (
+            None,
+            Some(ModsError::AbiUnavailable(tag.to_string()).into()),
+        );
+    }
+    let client = match http() {
+        Ok(c) => c,
+        Err(e) => return (None, Some(e.into())),
+    };
+    match abi_for_tag(paths, &client, tag, &catalog.weft).await {
+        Ok(abi) => (Some(abi), None),
+        Err(e) => (None, Some(e.into())),
+    }
+}
+
+/// The version's mod interface, or why it can't be known: nothing can be installed without it.
+pub async fn require_abi(paths: &Paths, catalog: &Catalog, tag: &str) -> Result<String, ModsError> {
+    match version_abi(paths, catalog, tag, true).await {
+        (Some(abi), _) => Ok(abi),
+        (None, error) => Err(ModsError::AbiUnavailable(
+            error
+                .and_then(|e| e.detail)
+                .unwrap_or_else(|| tag.to_string()),
+        )),
+    }
+}
+
+/// What the player put into their own Weft mods folder, which every version loads after the
+/// launcher's. Only listed, never changed.
+async fn unmanaged(paths: &Paths) -> Vec<PlayerFile> {
+    let Some(folder) = crate::launch::find_game_folder_in(&paths.logs_dir()).await else {
+        return Vec::new();
+    };
+    player_files(&folder.join("mods"))
+}
+
+pub fn player_files(dir: &std::path::Path) -> Vec<PlayerFile> {
+    let Ok(entries) = std::fs::read_dir(dir) else {
+        return Vec::new();
+    };
+    let mut files: Vec<PlayerFile> = entries
+        .flatten()
+        .map(|e| {
+            let name = e.file_name().to_string_lossy().to_string();
+            PlayerFile::new(&name, e.path().is_dir())
+        })
+        .filter(|f| !f.file.starts_with('.'))
+        .collect();
+    files.sort_by(|a, b| a.file.cmp(&b.file));
+    files
+}
+
+pub async fn build_report(
+    ctx: &Ctx,
+    tag: &str,
+    lock: &Lock,
+    catalog: &Catalog,
+    network: bool,
+) -> ProfileReport {
+    let (abi, abi_error) = version_abi(&ctx.paths, catalog, tag, network).await;
+    profile::report(
+        tag,
+        lock,
+        abi,
+        abi_error,
+        catalog,
+        current_platform(),
+        unmanaged(&ctx.paths).await,
+    )
+}
+
+/// The profile after a change, with nothing else to report yet.
+async fn change_result(ctx: &Ctx, tag: &str, lock: &Lock, catalog: &Catalog) -> ChangeResult {
+    ChangeResult::of(build_report(ctx, tag, lock, catalog, false).await)
+}
+
+/// Makes the version's `mods/` folder hold exactly its turned-on mods.
+async fn reconcile(ctx: &Ctx, tag: &str, lock: &Lock) -> Result<(), ModsError> {
+    let (paths, tag, lock) = (ctx.paths.clone(), tag.to_string(), lock.clone());
+    blocking(move || store::reconcile(&paths, &tag, &lock)).await
+}
+
+/// Writes a changed mod set under `ModsLock`. Three files change, each atomically, in an order
+/// where stopping after any step (an error, or the launcher being closed) leaves a state that
+/// is still true:
+///
+/// 1. The undo record of an earlier removal goes first, since this is the version's next
+///    change. If that fails, nothing changed.
+/// 2. `mods.lock.json`, the one record of the set. If that fails, nothing changed but the
+///    lost Undo. Once it is written, the change is made.
+/// 3. For a removal, its undo record. If that fails, the removal stands without an Undo:
+///    `false` says so, and nothing else is wrong.
+/// 4. The version's `mods/` folder, made to match the lock. If that fails, the error is
+///    returned with the change made: the folder is made to match again by the next change and
+///    before every Play ([`prepare_launch`]), so the game never starts with the old one.
+///
+/// `held` reservations are let go once the lock file names their builds, and unused store
+/// files go. Returns whether an undo record for `undo` was kept.
+async fn save(
+    ctx: &Ctx,
+    tag: &str,
+    lock: &Lock,
+    undo: Option<&Removed>,
+    held: Vec<Reservation>,
+) -> Result<bool, ModsError> {
+    if undo.is_none() {
+        store::clear_removed(&ctx.paths, tag)?;
+    }
+    store::write_lock(&ctx.paths, tag, lock)?;
+    let kept = match undo {
+        Some(removed) => match store::write_removed(&ctx.paths, tag, removed) {
+            Ok(()) => true,
+            Err(e) => {
+                eprintln!("mods: the removal from {tag} can't be undone: {e}");
+                false
+            }
+        },
+        None => false,
+    };
+    drop(held);
+    reconcile(ctx, tag, lock).await?;
+    ctx.collect_garbage().await;
+    Ok(kept)
+}
+
+/// Records and applies the catalogue's revocations to the version's mod set, unless its game
+/// is running: then the lock and the folder stay as the game started with them, and the report
+/// lists the revoked mods as pending. The caller holds `ModsLock`.
+async fn apply_revocations(ctx: &Ctx, tag: &str, catalog: &Catalog) -> Result<Lock, ModsError> {
+    let lock = store::read_lock(&ctx.paths, tag)?;
+    let mut applied = lock.clone();
+    if !profile::apply_revocations(&mut applied, catalog) {
+        return Ok(lock);
+    }
+    if ctx.is_running(tag) {
+        return Ok(lock);
+    }
+    store::write_lock(&ctx.paths, tag, &applied)?;
+    reconcile(ctx, tag, &applied).await?;
+    Ok(applied)
+}
+
+/// The version's mod set, with revocations applied (or pending, while its game runs).
+pub async fn profile(ctx: &Ctx, tag: &str) -> Result<ProfileReport, ModsError> {
+    ensure_installed(&ctx.paths, tag)?;
+    let catalog = current_catalog(ctx).await?;
+    let lock = {
+        let _held = ctx.lock_mods().await;
+        apply_revocations(ctx, tag, &catalog).await?
+    };
+    Ok(build_report(ctx, tag, &lock, &catalog, true).await)
+}
+
+/// After the version's game stopped: the revocations that waited for it.
+pub async fn apply_pending(ctx: &Ctx, tag: &str) -> Result<(), ModsError> {
+    if ensure_installed(&ctx.paths, tag).is_err() {
+        return Ok(());
+    }
+    let catalog = current_catalog(ctx).await?;
+    let _held = ctx.lock_mods().await;
+    apply_revocations(ctx, tag, &catalog).await.map(|_| ())
+}
+
+/// A deleted game version takes its mod set along.
+pub async fn forget_version(ctx: &Ctx, tag: &str) {
+    let _guard = ctx.lock_mods().await;
+    let (paths, reservations, tag) = (ctx.paths.clone(), ctx.reservations.clone(), tag.to_string());
+    let _ = blocking(move || {
+        store::forget_version(&paths, &reservations, &tag);
+        Ok(())
+    })
+    .await;
+}
+
+// ---------------------------------------------------------------------------------------------
+// Before Play
diff --git a/src-tauri/src/mods/service_tests.rs b/src-tauri/src/mods/service_tests.rs
new file mode 100644
index 0000000..5a05185
--- /dev/null
+++ b/src-tauri/src/mods/service_tests.rs
@@ -0,0 +1,1883 @@
+//! The operations in `service/`, run as the app runs them but without Tauri: a [`Ctx`] on a
+//! temporary folder, a catalogue held as if the page had loaded it, and a local HTTP server
+//! standing in for GitHub.
+
+use std::io::{Read, Write};
+use std::net::TcpListener;
+use std::sync::{Arc, Mutex};
+
+use super::archive::tests::make_zip;
+use super::catalog::{Catalog, CatalogVersion, Origin, RevokedView};
+use super::context::{Ctx, tests::with_version};
+use super::error::ModsError;
+use super::index::{Channel, Platform, WeftAbi};
+use super::install::ProgressStage;
+use super::plan::ChangeResult;
+use super::profile::tests::{ABI, build, catalog, catalog_mod};
+use super::profile::{Lock, ModStatus};
+use super::service::{self, LaunchPlan};
+use super::store;
+use crate::download::sha256_hex;
+
+const TAG: &str = "v1";
+
+fn run<F: Future>(fut: F) -> F::Output {
+    tokio::runtime::Builder::new_current_thread()
+        .enable_all()
+        .build()
+        .unwrap()
+        .block_on(fut)
+}
+
+/// What the stand-in server answers: status, extra headers, body.
+type Answer = (u16, Vec<(&'static str, String)>, Vec<u8>);
+
+/// Serves `answer(path)` to every request until the test ends. Returns the base URL.
+fn serve(answer: impl Fn(&str) -> Answer + Send + 'static) -> String {
+    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+    let base = format!("http://{}", listener.local_addr().unwrap());
+    std::thread::spawn(move || {
+        for stream in listener.incoming() {
+            let Ok(mut stream) = stream else { continue };
+            let mut request = Vec::new();
+            let mut buf = [0u8; 1024];
+            while !request.windows(4).any(|w| w == b"\r\n\r\n") {
+                match stream.read(&mut buf) {
+                    Ok(0) | Err(_) => break,
+                    Ok(n) => request.extend_from_slice(&buf[..n]),
+                }
+            }
+            let text = String::from_utf8_lossy(&request);
+            let path = text.split_whitespace().nth(1).unwrap_or("/").to_string();
+            let (status, headers, body) = answer(&path);
+            let ours = |k: &str| k == "no-length" || k == "slow";
+            let mut head = format!("HTTP/1.1 {status} X\r\nConnection: close\r\n");
+            if !headers.iter().any(|(k, _)| *k == "no-length") {
+                head.push_str(&format!("Content-Length: {}\r\n", body.len()));
+            }
+            for (k, v) in headers.iter().filter(|(k, _)| !ours(k)) {
+                head.push_str(&format!("{k}: {v}\r\n"));
+            }
+            head.push_str("\r\n");
+            let _ = stream.write_all(head.as_bytes());
+            // `slow`: half the body, a pause of that many milliseconds, then the rest.
+            match headers.iter().find(|(k, _)| *k == "slow") {
+                Some((_, ms)) => {
+                    let half = body.len() / 2;
+                    let _ = stream.write_all(&body[..half]);
+                    let _ = stream.flush();
+                    std::thread::sleep(std::time::Duration::from_millis(ms.parse().unwrap()));
+                    let _ = stream.write_all(&body[half..]);
+                }
+                None => {
+                    let _ = stream.write_all(&body);
+                }
+            }
+        }
+    });
+    base
+}
+
+fn ok(body: Vec<u8>) -> Answer {
+    (200, Vec::new(), body)
+}
+
+/// The library file name of mod `id` for `p`, as the engine looks for it.
+fn library(id: &str, p: Platform) -> String {
+    match p {
+        Platform::WindowsX64 => format!("{id}.dll"),
+        Platform::LinuxX64 => format!("lib{id}.so"),
+        Platform::MacosArm64 => format!("lib{id}.dylib"),
+    }
+}
+
+/// A mod zip with a library for every system, so the tests run on each; `salt` makes builds of
+/// one mod differ.
+fn zip_of(id: &str, salt: &str) -> Vec<u8> {
+    let libs: Vec<String> = Platform::ALL.iter().map(|p| library(id, *p)).collect();
+    let files: Vec<(&str, &[u8])> = libs.iter().map(|l| (l.as_str(), salt.as_bytes())).collect();
+    make_zip(&files)
+}
+
+/// A catalogue build of `id` whose bytes are `zip`, downloaded from `base`.
+fn build_of(id: &str, version: &str, zip: &[u8], deps: &[&str], base: &str) -> CatalogVersion {
+    let mut v = build(id, version, ABI, Channel::Release, deps);
+    v.platforms = Platform::ALL.to_vec();
+    v.sha256 = sha256_hex(zip);
+    v.size = zip.len() as u64;
+    v.url = format!("{base}/{id}.zip");
+    v
+}
+
+/// cogwork needs showcase; railways needs signals, which has no build.
+struct World {
+    catalog: Catalog,
+    cogwork: Vec<u8>,
+    showcase: Vec<u8>,
+    railways: Vec<u8>,
+}
+
+impl World {
+    fn new(base: &str) -> World {
+        let cogwork = zip_of("cogwork", "0.2.0");
+        let showcase = zip_of("showcase", "0.1.0");
+        let railways = zip_of("railways", "1.0.0");
+        let mut catalog = catalog(
+            vec![
+                catalog_mod(
+                    "cogwork",
+                    Origin::Index,
+                    vec![build_of(
+                        "cogwork",
+                        "0.2.0",
+                        &cogwork,
+                        &["base", "showcase"],
+                        base,
+                    )],
+                ),
+                catalog_mod(
+                    "showcase",
+                    Origin::Index,
+                    vec![build_of("showcase", "0.1.0", &showcase, &[], base)],
+                ),
+                catalog_mod(
+                    "railways",
+                    Origin::Index,
+                    vec![build_of("railways", "1.0.0", &railways, &["signals"], base)],
+                ),
+            ],
+            &[],
+        );
+        catalog.weft = vec![WeftAbi {
+            tag: TAG.into(),
+            commit: "f".repeat(40),
+            abi: ABI.into(),
+        }];
+        World {
+            catalog,
+            cogwork,
+            showcase,
+            railways,
+        }
+    }
+
+    fn sha(&self, id: &str) -> String {
+        self.catalog
+            .mods
+            .iter()
+            .find(|m| m.id == id)
+            .unwrap()
+            .versions[0]
+            .sha256
+            .clone()
+    }
+
+    /// Puts every build into the store, as if downloaded before.
+    fn stored(self, ctx: &Ctx) -> World {
+        for zip in [&self.cogwork, &self.showcase, &self.railways] {
+            std::fs::create_dir_all(ctx.paths.store_dir()).unwrap();
+            std::fs::write(ctx.paths.store_object(&sha256_hex(zip)), zip).unwrap();
+        }
+        self
+    }
+}
+
+/// A server for the world's builds, and a context whose page loaded its catalogue.
+fn setup(tmp: &tempfile::TempDir) -> (Ctx, World) {
+    type Files = Arc<Mutex<Vec<(String, Vec<u8>)>>>;
+    let bytes: Files = Arc::default();
+    let served = bytes.clone();
+    let base = serve(move |path| {
+        let files = served.lock().unwrap();
+        match files.iter().find(|(p, _)| p == path) {
+            Some((_, b)) => ok(b.clone()),
+            None => (404, Vec::new(), Vec::new()),
+        }
+    });
+    let world = World::new(&base);
+    *bytes.lock().unwrap() = vec![
+        ("/cogwork.zip".into(), world.cogwork.clone()),
+        ("/showcase.zip".into(), world.showcase.clone()),
+        ("/railways.zip".into(), world.railways.clone()),
+    ];
+    let ctx = with_version(tmp.path(), TAG);
+    ctx.hold_catalog(world.catalog.clone());
+    (ctx, world)
+}
+
+fn next_op() -> String {
+    use std::sync::atomic::{AtomicUsize, Ordering};
+    static N: AtomicUsize = AtomicUsize::new(0);
+    format!("op-{}", N.fetch_add(1, Ordering::Relaxed))
+}
+
+/// Installs as the page does: plans, then installs with that plan's token.
+async fn install(ctx: &Ctx, sha: &str) -> Result<ChangeResult, ModsError> {
+    let plan = service::plan(ctx, TAG, sha).await?;
+    service::install(ctx, TAG, sha, &plan.plan_token, &next_op()).await
+}
+
+async fn restore(ctx: &Ctx, id: &str) -> Result<ChangeResult, ModsError> {
+    service::restore(ctx, TAG, id, &next_op()).await
+}
+
+fn build_mut<'a>(catalog: &'a mut Catalog, id: &str) -> &'a mut CatalogVersion {
+    &mut catalog
+        .mods
+        .iter_mut()
+        .find(|m| m.id == id)
+        .unwrap()
+        .versions[0]
+}
+
+fn lock_of(ctx: &Ctx) -> Lock {
+    store::read_lock(&ctx.paths, TAG).unwrap()
+}
+
+fn handed_to_game(ctx: &Ctx) -> Vec<String> {
+    let mut names: Vec<String> = std::fs::read_dir(ctx.paths.mods_dir(TAG).unwrap())
+        .map(|d| {
+            d.flatten()
+                .map(|e| e.file_name().to_string_lossy().to_string())
+                .collect()
+        })
+        .unwrap_or_default();
+    names.sort();
+    names
+}
+
+#[test]
+fn an_install_downloads_checks_and_commits() {
+    let tmp = tempfile::tempdir().unwrap();
+    let (ctx, world) = setup(&tmp);
+    let stages: Arc<Mutex<Vec<(String, ProgressStage)>>> = Arc::default();
+    let seen = stages.clone();
+    let ctx = ctx.with_progress(move |p| seen.lock().unwrap().push((p.mod_id, p.stage)));
+
+    let done = run(install(&ctx, &world.sha("cogwork"))).unwrap();
+    assert_eq!(done.installed, ["cogwork", "showcase"]);
+    assert!(done.installed_off.is_empty() && done.undo.is_none());
+    assert_eq!(handed_to_game(&ctx), ["cogwork.zip", "showcase.zip"]);
+    assert!(ctx.paths.store_object(&world.sha("cogwork")).exists());
+    let stages = stages.lock().unwrap();
+    for stage in [
+        ProgressStage::Downloading,
+        ProgressStage::Verifying,
+        ProgressStage::Installing,
+    ] {
+        assert!(stages.contains(&("cogwork".into(), stage)), "{stage:?}");
+    }
+    assert!(!ctx.lock.is_held());
+}
+
+/// A download whose bytes aren't the pinned ones never reaches the store or the profile.
+#[test]
+fn a_tampered_download_never_reaches_the_store() {
+    let tmp = tempfile::tempdir().unwrap();
+    let world = World::new("");
+    let tampered = zip_of("showcase", "evil");
+    let base = serve(move |_| ok(tampered.clone()));
+    let mut catalog = world.catalog.clone();
+    for m in &mut catalog.mods {
+        m.versions[0].url = format!("{base}/{}.zip", m.id);
+    }
+    let ctx = with_version(tmp.path(), TAG);
+    ctx.hold_catalog(catalog);
+
+    let err = run(install(&ctx, &world.sha("showcase"))).unwrap_err();
+    assert!(matches!(err, ModsError::Sha256Mismatch { .. }), "{err:?}");
+    assert!(!ctx.paths.store_object(&world.sha("showcase")).exists());
+    let leftovers = std::fs::read_dir(ctx.paths.downloads_dir())
+        .unwrap()
+        .count();
+    assert_eq!(leftovers, 0, "the temporary file is gone");
+    assert!(lock_of(&ctx).mods.is_empty());
+}
+
+#[test]
+fn a_download_larger_than_announced_is_stopped() {
+    for headers in [Vec::new(), vec![("no-length", String::new())]] {
+        let tmp = tempfile::tempdir().unwrap();
+        let world = World::new("");
+        let big = vec![b'x'; world.showcase.len() + 4096];
+        let base = serve(move |_| (200, headers.clone(), big.clone()));
+        let mut catalog = world.catalog.clone();
+        build_mut(&mut catalog, "showcase").url = format!("{base}/showcase.zip");
+        let ctx = with_version(tmp.path(), TAG);
+        ctx.hold_catalog(catalog);
+        let err = run(install(&ctx, &world.sha("showcase"))).unwrap_err();
+        assert!(matches!(err, ModsError::TooLarge(_)), "{err:?}");
+        assert!(!ctx.paths.store_object(&world.sha("showcase")).exists());
+    }
+}
+
+/// The store already has a file under the build's hash, but it is another mod: refused, and
+/// nothing is fetched (the URL leads nowhere).
+#[test]
+fn a_stored_file_with_the_right_hash_is_still_checked() {
+    let tmp = tempfile::tempdir().unwrap();
+    let ctx = with_version(tmp.path(), TAG);
+    let other = zip_of("structures", "x");
+    let mut catalog = World::new("http://127.0.0.1:9").catalog;
+    let showcase = build_mut(&mut catalog, "showcase");
+    showcase.sha256 = sha256_hex(&other);
+    std::fs::create_dir_all(ctx.paths.store_dir()).unwrap();
+    std::fs::write(ctx.paths.store_object(&showcase.sha256), &other).unwrap();
+    let sha = showcase.sha256.clone();
+    ctx.hold_catalog(catalog);
+
+    let err = run(install(&ctx, &sha)).unwrap_err();
+    assert!(matches!(err, ModsError::ArchiveInvalid(_)), "{err:?}");
+    assert!(lock_of(&ctx).mods.is_empty());
+}
+
+/// Contract item 1: a mod that needs something missing is installed turned off, and Play keeps
+/// working.
+#[test]
+fn a_missing_dependency_installs_the_mod_turned_off() {
+    let tmp = tempfile::tempdir().unwrap();
+    let (ctx, world) = setup(&tmp);
+    let plan = run(service::plan(&ctx, TAG, &world.sha("railways"))).unwrap();
+    assert!(!plan.turns_on);
+    assert_eq!(plan.missing, ["signals"]);
+
+    let done = run(install(&ctx, &world.sha("railways"))).unwrap();
+    assert_eq!(done.installed_off, ["railways"]);
+    assert_eq!(done.missing, ["signals"]);
+    assert!(!lock_of(&ctx).get("railways").unwrap().enabled);
+    assert!(done.report.blocking.is_empty());
+    let launch = run(service::prepare_launch(&ctx, TAG)).unwrap();
+    assert_eq!(launch.release(), None, "nothing is on");
+}
+
+mod meanwhile {
+    use super::*;
+
+    /// Stages cogwork with showcase installed, so only cogwork is downloaded; `change` happens
+    /// during the download; the commit must refuse.
+    fn refused(change: impl FnOnce(&Ctx, &World)) -> ModsError {
+        let tmp = tempfile::tempdir().unwrap();
+        let (ctx, world) = setup(&tmp);
+        let world = world.stored(&ctx);
+        run(install(&ctx, &world.sha("showcase"))).unwrap();
+        let before = std::fs::read(ctx.paths.lock_file(TAG).unwrap()).unwrap();
+
+        let (m, v) = world.catalog.find(&world.sha("cogwork")).unwrap();
+        let op = ctx.operations.begin("refused").unwrap();
+        let staged = service::stage(
+            &ctx,
+            TAG,
+            world.catalog.clone(),
+            ABI.into(),
+            vec![(m.clone(), v.clone())],
+            Vec::new(),
+        )
+        .unwrap();
+        run(service::fetch(&ctx, &staged, &op)).unwrap();
+        change(&ctx, &world);
+        let err = run(service::commit(&ctx, staged, &op)).unwrap_err();
+        if ctx.paths.lock_file(TAG).unwrap().exists() {
+            let after = std::fs::read(ctx.paths.lock_file(TAG).unwrap()).unwrap();
+            let unchanged = after == before || !String::from_utf8_lossy(&after).contains("cogwork");
+            assert!(unchanged, "nothing was written");
+        }
+        err
+    }
+
+    fn detail(err: ModsError) -> String {
+        match err {
+            ModsError::ChangedMeanwhile(why) => why,
+            e => panic!("expected ModChangedMeanwhile, got {e:?}"),
+        }
+    }
+
+    #[test]
+    fn the_version_was_removed() {
+        let why = detail(refused(|ctx, _| {
+            std::fs::remove_dir_all(ctx.paths.versions_dir().join(TAG)).unwrap();
+        }));
+        assert!(why.contains("removed"), "{why}");
+    }
+
+    #[test]
+    fn the_build_was_revoked() {
+        let why = detail(refused(|ctx, world| {
+            let mut c = world.catalog.clone();
+            c.revoked.push(RevokedView {
+                sha256: world.sha("cogwork"),
+                reason: Some("deletes saves".into()),
+            });
+            ctx.hold_catalog(c);
+        }));
+        assert!(why.contains("deletes saves"), "{why}");
+    }
+
+    #[test]
+    fn the_build_left_the_catalogue() {
+        let why = detail(refused(|ctx, world| {
+            let mut c = world.catalog.clone();
+            c.mods.retain(|m| m.id != "cogwork");
+            ctx.hold_catalog(c);
+        }));
+        assert!(why.contains("no longer"), "{why}");
+    }
+
+    #[test]
+    fn the_game_was_started() {
+        let why = detail(refused(|ctx, _| ctx.games.insert(TAG)));
+        assert!(why.contains("started"), "{why}");
+    }
+
+    #[test]
+    fn the_plan_no_longer_holds() {
+        // Showcase was removed meanwhile: cogwork would need it downloaded.
+        let why = detail(refused(|ctx, _| {
+            run(service::remove(ctx, TAG, "showcase")).unwrap();
+        }));
+        assert!(why.contains("showcase"), "{why}");
+        // Showcase was turned off meanwhile: committing would turn it on unasked.
+        let why = detail(refused(|ctx, _| {
+            run(service::set_enabled(ctx, TAG, "showcase", false)).unwrap();
+        }));
+        assert!(why.contains("turned on"), "{why}");
+    }
+
+    /// The same hash, described differently by a refreshed catalogue: the consent is checked
+    /// against what the catalogue says now, not what it said when the download started.
+    #[test]
+    fn the_same_builds_metadata_changed() {
+        // Another tier.
+        let why = detail(refused(|ctx, world| {
+            let mut c = world.catalog.clone();
+            build_mut(&mut c, "cogwork").trust = super::super::catalog::Trust::Unreviewed;
+            ctx.hold_catalog(c);
+        }));
+        assert!(why.contains("changed since it was shown"), "{why}");
+        // Another dependency, which would have to be downloaded too.
+        let why = detail(refused(|ctx, world| {
+            let mut c = world.catalog.clone();
+            build_mut(&mut c, "cogwork").deps.push("railways".into());
+            ctx.hold_catalog(c);
+        }));
+        assert!(why.contains("railways"), "{why}");
+        // Built for another mod interface now.
+        let why = detail(refused(|ctx, world| {
+            let mut c = world.catalog.clone();
+            build_mut(&mut c, "cogwork").abi = "0".repeat(16);
+            ctx.hold_catalog(c);
+        }));
+        assert!(why.contains("cogwork"), "{why}");
+    }
+
+    #[test]
+    fn the_versions_mod_interface_changed() {
+        let why = detail(refused(|ctx, world| {
+            let mut c = world.catalog.clone();
+            c.weft[0].abi = "0".repeat(16);
+            ctx.hold_catalog(c);
+        }));
+        assert!(why.contains("mod interface"), "{why}");
+    }
+
+    #[test]
+    fn nothing_changed() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (ctx, world) = setup(&tmp);
+        let (m, v) = world.catalog.find(&world.sha("cogwork")).unwrap();
+        let wanted = vec![(m.clone(), v.clone())];
+        let op = ctx.operations.begin("nothing-changed").unwrap();
+        let staged = service::stage(
+            &ctx,
+            TAG,
+            world.catalog.clone(),
+            ABI.into(),
+            wanted,
+            Vec::new(),
+        )
+        .unwrap();
+        run(service::fetch(&ctx, &staged, &op)).unwrap();
+        let done = run(service::commit(&ctx, staged, &op)).unwrap();
+        assert_eq!(done.installed, ["cogwork", "showcase"]);
+    }
+}
+
+#[test]
+fn remove_can_be_undone_until_the_next_change() {
+    let tmp = tempfile::tempdir().unwrap();
+    let (ctx, world) = setup(&tmp);
+    let world = world.stored(&ctx);
+    run(install(&ctx, &world.sha("cogwork"))).unwrap();
+    let showcase_before = lock_of(&ctx).get("showcase").unwrap().clone();
+
+    let done = run(service::remove(&ctx, TAG, "showcase")).unwrap();
+    assert_eq!(done.undo.as_deref(), Some("showcase"));
+    assert_eq!(done.also_disabled, ["cogwork"]);
+    assert!(
+        ctx.paths.store_object(&world.sha("showcase")).exists(),
+        "its file is kept for Undo"
+    );
+    assert_eq!(handed_to_game(&ctx), Vec::<String>::new());
+
+    let done = run(restore(&ctx, "showcase")).unwrap();
+    assert!(done.undo.is_none());
+    assert_eq!(done.also_enabled, ["cogwork"]);
+    let lock = lock_of(&ctx);
+    let showcase = lock.get("showcase").unwrap();
+    assert_eq!(showcase.sha256, showcase_before.sha256);
+    assert_eq!(showcase.enabled, showcase_before.enabled);
+    assert_eq!(showcase.installed_at, showcase_before.installed_at);
+    assert_eq!(handed_to_game(&ctx), ["cogwork.zip", "showcase.zip"]);
+    assert!(matches!(
+        run(restore(&ctx, "showcase")),
+        Err(ModsError::NotInstalled(_))
+    ));
+
+    // Any other change ends the undo, and the file goes with the next collection.
+    run(service::remove(&ctx, TAG, "showcase")).unwrap();
+    run(service::set_enabled(&ctx, TAG, "cogwork", false)).unwrap();
+    assert!(matches!(
+        run(restore(&ctx, "showcase")),
+        Err(ModsError::NotInstalled(_))
+    ));
+    assert!(!ctx.paths.store_object(&world.sha("showcase")).exists());
+}
+
+#[test]
+fn undo_needs_the_same_bytes() {
+    let tmp = tempfile::tempdir().unwrap();
+    let (ctx, world) = setup(&tmp);
+    let world = world.stored(&ctx);
+    run(install(&ctx, &world.sha("showcase"))).unwrap();
+    run(service::set_enabled(&ctx, TAG, "showcase", false)).unwrap();
+    run(service::remove(&ctx, TAG, "showcase")).unwrap();
+    assert!(matches!(
+        run(restore(&ctx, "cogwork")),
+        Err(ModsError::NotInstalled(_))
+    ));
+    std::fs::write(ctx.paths.store_object(&world.sha("showcase")), b"changed").unwrap();
+    assert!(matches!(
+        run(restore(&ctx, "showcase")),
+        Err(ModsError::NotInstalled(_))
+    ));
+    std::fs::write(
+        ctx.paths.store_object(&world.sha("showcase")),
+        &world.showcase,
+    )
+    .unwrap();
+    run(restore(&ctx, "showcase")).unwrap();
+    assert!(
+        !lock_of(&ctx).get("showcase").unwrap().enabled,
+        "back as it was: off"
+    );
+}
+
+/// Before Play, with no catalogue loaded, nothing cached and no network: statuses are only
+/// unchecked, recorded revocations still apply, and missing dependencies still block.
+#[test]
+fn prepare_launch_needs_neither_tauri_nor_the_network() {
+    let tmp = tempfile::tempdir().unwrap();
+    let world = World::new("http://127.0.0.1:9");
+    let installer = with_version(tmp.path(), TAG);
+    installer.hold_catalog(world.catalog.clone());
+    let world = world.stored(&installer);
+    run(install(&installer, &world.sha("cogwork"))).unwrap();
+    // A fresh start: no catalogue held, no index cached, no ABI cached.
+    let ctx = Ctx::new(installer.paths.clone());
+
+    let launch = run(service::prepare_launch(&ctx, TAG)).unwrap();
+    assert!(ctx.lock.is_held(), "held until the game counts as running");
+    assert_eq!(launch.release(), Some(ctx.paths.mods_dir(TAG).unwrap()));
+    assert!(!ctx.lock.is_held());
+    let offline = service::offline_catalog(&ctx.paths);
+    assert_eq!(
+        offline.index.freshness,
+        super::index::Freshness::Unavailable
+    );
+    let report = run(service::build_report(
+        &ctx,
+        TAG,
+        &lock_of(&ctx),
+        &offline,
+        false,
+    ));
+    assert!(
+        report.mods.iter().all(|m| m.status == ModStatus::Unchecked),
+        "without the index or the ABI nothing can be called wrong"
+    );
+
+    // A revocation recorded earlier still turns the mod off, without the index.
+    let mut lock = lock_of(&ctx);
+    lock.get_mut("showcase").unwrap().revoked = Some(super::profile::Revocation {
+        reason: Some("deletes saves".into()),
+        at: None,
+    });
+    store::write_lock(&ctx.paths, TAG, &lock).unwrap();
+    let err = run(service::prepare_launch(&ctx, TAG)).err().unwrap();
+    assert!(
+        matches!(err, ModsError::Blocked(ref names) if names == "cogwork name"),
+        "{err:?}"
+    );
+    let lock = lock_of(&ctx);
+    assert!(!lock.get("showcase").unwrap().enabled);
+    assert_eq!(handed_to_game(&ctx), ["cogwork.zip"]);
+}
+
+#[test]
+fn the_launch_plan() {
+    use super::profile::tests::{entry, lock};
+    use super::profile::{report, tests::fit};
+    let mut off = entry("showcase", &[], Some(ABI));
+    off.enabled = false;
+    let mut revoked = entry("pulled", &[], Some(ABI));
+    revoked.enabled = false;
+    revoked.revoked = Some(super::profile::Revocation {
+        reason: Some("x".into()),
+        at: None,
+    });
+    let cases: Vec<(&str, Lock, LaunchPlan)> = vec![
+        ("nothing installed", lock(vec![]), LaunchPlan::NoMods),
+        (
+            "only mods that are off",
+            lock(vec![off.clone(), revoked.clone()]),
+            LaunchPlan::NoMods,
+        ),
+        (
+            "a mod that is on",
+            lock(vec![entry("a", &["base"], Some(ABI)), off.clone()]),
+            LaunchPlan::Mods,
+        ),
+        (
+            "a local file, unchecked",
+            lock(vec![entry("mytweak", &[], None)]),
+            LaunchPlan::Mods,
+        ),
+        (
+            "a dependency that is off",
+            lock(vec![
+                entry("cogwork", &["showcase"], Some(ABI)),
+                off.clone(),
+            ]),
+            LaunchPlan::Blocked(vec!["cogwork name".into()]),
+        ),
+        (
+            "built for another version",
+            lock(vec![entry("old", &[], Some("5f0569a6bea71b81"))]),
+            LaunchPlan::Blocked(vec!["old name".into()]),
+        ),
+    ];
+    let c = catalog(vec![], &[]);
+    for (what, l, want) in cases {
+        let r = report(TAG, &l, Some(ABI.into()), None, &c, fit().platform, vec![]);
+        assert_eq!(service::launch_plan(&l, &r), want, "{what}");
+    }
+}
+
+#[test]
+fn forgetting_a_version_waits_for_the_mods_lock() {
+    let tmp = tempfile::tempdir().unwrap();
+    let (ctx, world) = setup(&tmp);
+    let world = world.stored(&ctx);
+    run(install(&ctx, &world.sha("showcase"))).unwrap();
+    run(async {
+        let held = ctx.lock_mods().await;
+        let waited = tokio::time::timeout(
+            std::time::Duration::from_millis(100),
+            service::forget_version(&ctx, TAG),
+        )
+        .await;
+        assert!(waited.is_err(), "it waits while an install holds the lock");
+        assert!(ctx.paths.profile_dir(TAG).unwrap().exists());
+        drop(held);
+        service::forget_version(&ctx, TAG).await;
+    });
+    assert!(!ctx.paths.profile_dir(TAG).unwrap().exists());
+    assert!(!ctx.paths.store_object(&world.sha("showcase")).exists());
+}
+
+mod icons {
+    use super::*;
+
+    fn png(len: usize) -> Vec<u8> {
+        let mut b = b"\x89PNG\r\n\x1a\n".to_vec();
+        b.resize(len, 0);
+        b
+    }
+
+    #[test]
+    fn only_small_pngs() {
+        let base = serve(|path| match path {
+            "/small.png" => ok(png(1000)),
+            "/big.png" => ok(png(service::MAX_ICON_BYTES + 1)),
+            "/big-unannounced.png" => (
+                200,
+                vec![("no-length", String::new())],
+                png(service::MAX_ICON_BYTES + 1),
+            ),
+            "/not.png" => ok(b"<svg/>".to_vec()),
+            _ => (404, Vec::new(), Vec::new()),
+        });
+        let client = service::http().unwrap();
+        let get = |p: &str| run(service::fetch_icon(&client, &format!("{base}{p}")));
+        assert_eq!(get("/small.png").unwrap().len(), 1000);
+        for bad in ["/big.png", "/big-unannounced.png"] {
+            assert!(matches!(get(bad), Err(ModsError::TooLarge(_))), "{bad}");
+        }
+        assert!(matches!(get("/not.png"), Err(ModsError::IconInvalid(_))));
+        assert!(matches!(
+            get("/gone.png"),
+            Err(ModsError::Http { status: 404, .. })
+        ));
+    }
+
+    #[test]
+    fn redirects_stay_on_github_over_https() {
+        let base = serve(|path| match path {
+            "/away" => (
+                302,
+                vec![("Location", "http://127.0.0.1:9/x.png".into())],
+                Vec::new(),
+            ),
+            _ => ok(png(10)),
+        });
+        let client = service::http().unwrap();
+        let got = run(service::fetch_icon(&client, &format!("{base}/away")));
+        assert!(matches!(got, Err(ModsError::Network(_))), "{got:?}");
+    }
+
+    #[test]
+    fn only_catalogue_icons_over_https() {
+        let tmp = tempfile::tempdir().unwrap();
+        let ctx = with_version(tmp.path(), TAG);
+        let mut c = catalog(vec![], &[]);
+        let mut m = catalog_mod("cogwork", Origin::Index, vec![]);
+        m.icon = Some("http://example.com/icon.png".into());
+        c.mods.push(m);
+        ctx.hold_catalog(c);
+        for url in [
+            "http://example.com/icon.png",
+            "https://example.com/other.png",
+        ] {
+            assert!(matches!(
+                run(service::icon_png(&ctx, url)),
+                Err(ModsError::NotInCatalog(_))
+            ));
+        }
+    }
+}
+
+// ---------------------------------------------------------------------------------------------
+// Round 4: consent, operations, files, copies, sources, profiles, shadowing
+
+/// What an error must be.
+type Expect = fn(&ModsError) -> bool;
+
+fn revoke(ctx: &Ctx, world: &World, id: &str, reason: &str) {
+    let mut c = ctx.held_catalog().unwrap_or_else(|| world.catalog.clone());
+    c.revoked.push(RevokedView {
+        sha256: world.sha(id),
+        reason: Some(reason.into()),
+    });
+    ctx.hold_catalog(c);
+}
+
+mod consent {
+    use super::*;
+
+    /// Contract R4 §2: the token is checked before anything is downloaded.
+    #[test]
+    fn a_changed_plan_is_refused_before_downloading() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (ctx, world) = setup(&tmp);
+        let plan = run(service::plan(&ctx, TAG, &world.sha("cogwork"))).unwrap();
+        assert_eq!(ids_of(&plan.install), ["showcase"]);
+        // Showcase is installed meanwhile: the plan the player saw would now do something else.
+        run(install(&ctx, &world.sha("showcase"))).unwrap();
+        let before = std::fs::read(ctx.paths.lock_file(TAG).unwrap()).unwrap();
+        let err = run(service::install(
+            &ctx,
+            TAG,
+            &world.sha("cogwork"),
+            &plan.plan_token,
+            &next_op(),
+        ))
+        .unwrap_err();
+        assert!(matches!(err, ModsError::ChangedMeanwhile(_)), "{err:?}");
+        assert!(
+            !ctx.paths.store_object(&world.sha("cogwork")).exists(),
+            "nothing fetched"
+        );
+        assert_eq!(
+            std::fs::read(ctx.paths.lock_file(TAG).unwrap()).unwrap(),
+            before
+        );
+
+        // Planned again, it goes ahead.
+        let plan = run(service::plan(&ctx, TAG, &world.sha("cogwork"))).unwrap();
+        assert!(plan.install.is_empty());
+        run(service::install(
+            &ctx,
+            TAG,
+            &world.sha("cogwork"),
+            &plan.plan_token,
+            &next_op(),
+        ))
+        .unwrap();
+    }
+
+    /// The token is checked again at commit: less to do is still not what was agreed.
+    #[test]
+    fn a_plan_that_changed_during_the_download_is_refused() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (ctx, world) = setup(&tmp);
+        let (m, v) = world.catalog.find(&world.sha("cogwork")).unwrap();
+        let op = ctx.operations.begin("download").unwrap();
+        let staged = service::stage(
+            &ctx,
+            TAG,
+            world.catalog.clone(),
+            ABI.into(),
+            vec![(m.clone(), v.clone())],
+            Vec::new(),
+        )
+        .unwrap();
+        run(service::fetch(&ctx, &staged, &op)).unwrap();
+        run(install(&ctx, &world.sha("showcase"))).unwrap();
+        let err = run(service::commit(&ctx, staged, &op)).unwrap_err();
+        assert!(matches!(err, ModsError::ChangedMeanwhile(_)), "{err:?}");
+        assert!(lock_of(&ctx).get("cogwork").is_none());
+    }
+
+    /// The token covers trust: a build that became Reviewed is a different plan.
+    #[test]
+    fn the_token_covers_trust_and_the_abi() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (ctx, world) = setup(&tmp);
+        let plan = run(service::plan(&ctx, TAG, &world.sha("showcase"))).unwrap();
+        let mut c = world.catalog.clone();
+        build_mut(&mut c, "showcase").trust = super::super::catalog::Trust::Unreviewed;
+        ctx.hold_catalog(c);
+        let other = run(service::plan(&ctx, TAG, &world.sha("showcase"))).unwrap();
+        assert_ne!(plan.plan_token, other.plan_token);
+        assert_eq!(other.fits_version, Some(true));
+
+        // Unknown ABI: unknown fit, never "no", and a token of its own.
+        let p = super::super::plan::plan_install(
+            &world.catalog,
+            &Lock::empty(),
+            TAG,
+            &world.sha("showcase"),
+            None,
+            false,
+        )
+        .unwrap();
+        assert_eq!(p.fits_version, None);
+        assert!(!p.turns_on);
+        assert_ne!(p.plan_token, plan.plan_token);
+    }
+}
+
+fn ids_of(items: &[super::plan::PlanItem]) -> Vec<&str> {
+    items.iter().map(|i| i.id.as_str()).collect()
+}
+
+mod operations {
+    use super::*;
+
+    /// Contract R4 §3: progress belongs to its operation and says which file of how many.
+    #[test]
+    fn progress_names_the_operation_and_the_file() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (ctx, world) = setup(&tmp);
+        let seen: Arc<Mutex<Vec<super::super::install::ModProgress>>> = Arc::default();
+        let log = seen.clone();
+        let ctx = ctx.with_progress(move |p| log.lock().unwrap().push(p));
+        let plan = run(service::plan(&ctx, TAG, &world.sha("cogwork"))).unwrap();
+        run(service::install(
+            &ctx,
+            TAG,
+            &world.sha("cogwork"),
+            &plan.plan_token,
+            "op-a",
+        ))
+        .unwrap();
+        let seen = seen.lock().unwrap();
+        assert!(
+            seen.iter()
+                .all(|p| p.operation_id == "op-a" && p.count == 2)
+        );
+        let at = |id: &str| seen.iter().find(|p| p.mod_id == id).unwrap().index;
+        assert_eq!((at("cogwork"), at("showcase")), (1, 2));
+        assert!(ctx.operations.is_empty(), "forgotten once it ended");
+        assert!(!ctx.operations.cancel("op-a"));
+    }
+
+    /// The events of an install, step by step, are the ones in `src/dev/fixtures/trace.json`,
+    /// which the mock is held to as well.
+    #[test]
+    fn progress_follows_the_shared_trace() {
+        const TRACE: &str = include_str!("../../../src/dev/fixtures/trace.json");
+        let trace: serde_json::Value = serde_json::from_str(TRACE).unwrap();
+        for (case, stored) in [
+            ("installWithDependency", false),
+            ("installWithStoredDependency", true),
+        ] {
+            let tmp = tempfile::tempdir().unwrap();
+            let (ctx, world) = setup(&tmp);
+            if stored {
+                std::fs::create_dir_all(ctx.paths.store_dir()).unwrap();
+                std::fs::write(
+                    ctx.paths.store_object(&world.sha("showcase")),
+                    &world.showcase,
+                )
+                .unwrap();
+            }
+            let seen: Arc<Mutex<Vec<super::super::install::ModProgress>>> = Arc::default();
+            let log = seen.clone();
+            let ctx = ctx.with_progress(move |p| log.lock().unwrap().push(p));
+            let plan = run(service::plan(&ctx, TAG, &world.sha("cogwork"))).unwrap();
+            run(service::install(
+                &ctx,
+                TAG,
+                &world.sha("cogwork"),
+                &plan.plan_token,
+                "op-t",
+            ))
+            .unwrap();
+            let seen = seen.lock().unwrap();
+            let want = &trace[case];
+            let count = want["count"].as_u64().unwrap() as u32;
+            assert!(
+                seen.iter()
+                    .all(|p| p.operation_id == "op-t" && p.count == count),
+                "{case}"
+            );
+            let want: Vec<String> = want["steps"]
+                .as_array()
+                .unwrap()
+                .iter()
+                .map(|s| s.as_str().unwrap().to_string())
+                .collect();
+            assert_eq!(collapse(&seen), want, "{case}");
+        }
+    }
+
+    /// `file:stage:percent`, keeping the first and last percent of each run of one file's stage.
+    fn collapse(events: &[super::super::install::ModProgress]) -> Vec<String> {
+        let stage = |s: ProgressStage| {
+            serde_json::to_value(s)
+                .unwrap()
+                .as_str()
+                .unwrap()
+                .to_string()
+        };
+        let mut runs: Vec<(u32, String, u32, u32)> = Vec::new();
+        for e in events {
+            let st = stage(e.stage);
+            match runs.last_mut() {
+                Some(r) if r.0 == e.index && r.1 == st => r.3 = e.percent,
+                _ => runs.push((e.index, st, e.percent, e.percent)),
+            }
+        }
+        runs.into_iter()
+            .flat_map(|(i, st, first, last)| {
+                let mut out = vec![format!("{i}:{st}:{first}")];
+                if last != first {
+                    out.push(format!("{i}:{st}:{last}"));
+                }
+                out
+            })
+            .collect()
+    }
+
+    /// Cancelling during the second download stops it at once, and leaves no trace: no lock
+    /// change, no partial file, and not the first build either.
+    #[test]
+    fn a_cancelled_install_leaves_no_trace() {
+        let tmp = tempfile::tempdir().unwrap();
+        let world = World::new("");
+        let (cogwork, showcase) = (world.cogwork.clone(), world.showcase.clone());
+        let base = serve(move |path| match path {
+            "/cogwork.zip" => ok(cogwork.clone()),
+            _ => (200, vec![("slow", "3000".into())], showcase.clone()),
+        });
+        let mut catalog = world.catalog.clone();
+        for m in &mut catalog.mods {
+            m.versions[0].url = format!("{base}/{}.zip", m.id);
+        }
+        let ctx = with_version(tmp.path(), TAG);
+        ctx.hold_catalog(catalog);
+        let ops = ctx.operations.clone();
+        let ctx = ctx.with_progress(move |p| {
+            if p.mod_id == "showcase" && p.stage == ProgressStage::Downloading && p.percent > 0 {
+                assert!(ops.cancel(&p.operation_id));
+            }
+        });
+        let plan = run(service::plan(&ctx, TAG, &world.sha("cogwork"))).unwrap();
+        let started = std::time::Instant::now();
+        let err = run(service::install(
+            &ctx,
+            TAG,
+            &world.sha("cogwork"),
+            &plan.plan_token,
+            "op-c",
+        ))
+        .unwrap_err();
+        assert!(matches!(err, ModsError::Cancelled), "{err:?}");
+        assert!(
+            started.elapsed() < std::time::Duration::from_millis(2500),
+            "it didn't wait"
+        );
+        assert!(!ctx.paths.lock_file(TAG).unwrap().exists());
+        assert_eq!(
+            std::fs::read_dir(ctx.paths.downloads_dir())
+                .unwrap()
+                .count(),
+            0
+        );
+        let stored = std::fs::read_dir(ctx.paths.store_dir())
+            .map(|d| d.count())
+            .unwrap_or(0);
+        assert_eq!(stored, 0, "the build it finished first is gone too");
+        assert!(ctx.operations.is_empty());
+        assert_eq!(
+            crate::error::AppError::from(err).code,
+            crate::error::ErrorCode::ModCancelled
+        );
+    }
+
+    /// Once an operation writes, cancelling it is refused; an unknown id is just false.
+    #[test]
+    fn a_restore_can_be_cancelled_until_it_writes() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (ctx, world) = setup(&tmp);
+        let world = world.stored(&ctx);
+        run(install(&ctx, &world.sha("showcase"))).unwrap();
+        run(service::remove(&ctx, TAG, "showcase")).unwrap();
+        let ops = ctx.operations.clone();
+        let ctx = ctx.with_progress(move |p| {
+            if p.stage == ProgressStage::Verifying {
+                ops.cancel(&p.operation_id);
+            }
+        });
+        let err = run(service::restore(&ctx, TAG, "showcase", "op-r")).unwrap_err();
+        assert!(matches!(err, ModsError::Cancelled), "{err:?}");
+        assert!(lock_of(&ctx).get("showcase").is_none());
+        assert!(matches!(
+            run(service::restore(&ctx, TAG, "showcase", "../bad")),
+            Err(ModsError::InvalidName(_))
+        ));
+    }
+}
+
+mod files {
+    use super::*;
+
+    fn file(tmp: &tempfile::TempDir, name: &str, bytes: &[u8]) -> String {
+        let path = tmp.path().join(name);
+        std::fs::write(&path, bytes).unwrap();
+        path.to_string_lossy().to_string()
+    }
+
+    fn install_file(ctx: &Ctx, path: &str) -> Result<ChangeResult, ModsError> {
+        let seen = run(service::inspect_file(ctx, TAG, path))?;
+        run(service::install_file(
+            ctx,
+            TAG,
+            path,
+            &seen.sha256,
+            &seen.plan_token,
+            &next_op(),
+        ))
+    }
+
+    fn stored_count(ctx: &Ctx) -> usize {
+        std::fs::read_dir(ctx.paths.store_dir())
+            .map(|d| d.count())
+            .unwrap_or(0)
+    }
+
+    #[test]
+    fn an_unknown_file_is_unverified_and_on() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (ctx, _) = setup(&tmp);
+        let path = file(&tmp, "my tweak.zip", &zip_of("mytweak", "1"));
+        let done = install_file(&ctx, &path).unwrap();
+        assert_eq!(done.installed, ["mytweak"]);
+        let e = lock_of(&ctx).get("mytweak").unwrap().clone();
+        assert_eq!(e.trust, super::super::catalog::Trust::Unverified);
+        assert!(e.enabled);
+        assert_eq!(handed_to_game(&ctx), ["mytweak.zip"]);
+    }
+
+    #[test]
+    fn a_catalogued_file_installs_as_its_build() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (ctx, world) = setup(&tmp);
+        let path = file(&tmp, "downloaded.zip", &world.cogwork);
+        let seen = run(service::inspect_file(&ctx, TAG, &path)).unwrap();
+        assert_eq!(
+            seen.catalog_match.as_ref().unwrap().fits_version,
+            Some(true)
+        );
+        let done = run(service::install_file(
+            &ctx,
+            TAG,
+            &path,
+            &seen.sha256,
+            &seen.plan_token,
+            &next_op(),
+        ))
+        .unwrap();
+        assert_eq!(
+            done.installed,
+            ["cogwork", "showcase"],
+            "its dependency comes too"
+        );
+        let e = lock_of(&ctx).get("cogwork").unwrap().clone();
+        assert_eq!(e.trust, super::super::catalog::Trust::Reviewed);
+    }
+
+    #[test]
+    fn refused_files_leave_nothing() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (ctx, world) = setup(&tmp);
+        // A library only for some other system.
+        let other = Platform::ALL
+            .into_iter()
+            .find(|p| Some(*p) != Platform::current())
+            .unwrap();
+        let elsewhere = make_zip(&[(library("elsewhere", other).as_str(), b"x".as_slice())]);
+        let cases: Vec<(&str, Vec<u8>, Expect)> = vec![
+            ("base.zip", zip_of("base", "x"), |e| {
+                matches!(e, ModsError::IdReserved(_))
+            }),
+            ("elsewhere.zip", elsewhere, |e| {
+                matches!(e, ModsError::NotForPlatform(_))
+            }),
+        ];
+        for (name, bytes, want) in cases {
+            let path = file(&tmp, name, &bytes);
+            let err = install_file(&ctx, &path).unwrap_err();
+            assert!(want(&err), "{name}: {err:?}");
+            assert_eq!(stored_count(&ctx), 0, "{name}");
+        }
+
+        // A revoked build, by hash, even when brought as a file.
+        revoke(&ctx, &world, "showcase", "deletes saves");
+        let path = file(&tmp, "showcase.zip", &world.showcase);
+        assert!(matches!(
+            install_file(&ctx, &path),
+            Err(ModsError::Revoked(_))
+        ));
+
+        // A wrong token.
+        let path = file(&tmp, "mytweak.zip", &zip_of("mytweak", "1"));
+        let seen = run(service::inspect_file(&ctx, TAG, &path)).unwrap();
+        let err = run(service::install_file(
+            &ctx,
+            TAG,
+            &path,
+            &seen.sha256,
+            "not the token",
+            &next_op(),
+        ))
+        .unwrap_err();
+        assert!(matches!(err, ModsError::ChangedMeanwhile(_)), "{err:?}");
+        assert!(!ctx.paths.lock_file(TAG).unwrap().exists());
+        assert_eq!(stored_count(&ctx), 0);
+    }
+
+    /// Contract R4 §2: a revocation that arrives while an unknown file is copied and hashed is
+    /// honoured at commit, by hash.
+    #[test]
+    fn a_revocation_during_the_copy_is_honoured() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (ctx, world) = setup(&tmp);
+        let bytes = zip_of("mytweak", "1");
+        let path = file(&tmp, "mytweak.zip", &bytes);
+        let seen = run(service::inspect_file(&ctx, TAG, &path)).unwrap();
+        let (held, catalog) = (ctx.catalog.clone(), world.catalog.clone());
+        let sha = sha256_hex(&bytes);
+        let ctx = ctx.with_progress(move |p| {
+            if p.stage == ProgressStage::Verifying && p.percent == 100 {
+                let mut c = catalog.clone();
+                c.revoked.push(RevokedView {
+                    sha256: sha.to_ascii_uppercase(),
+                    reason: Some("steals passwords".into()),
+                });
+                held.0.lock().unwrap().catalog = Some(c);
+            }
+        });
+        let err = run(service::install_file(
+            &ctx,
+            TAG,
+            &path,
+            &seen.sha256,
+            &seen.plan_token,
+            &next_op(),
+        ))
+        .unwrap_err();
+        assert!(
+            matches!(err, ModsError::Revoked(ref r) if r == "steals passwords"),
+            "{err:?}"
+        );
+        assert!(!ctx.paths.lock_file(TAG).unwrap().exists());
+        assert_eq!(stored_count(&ctx), 0);
+    }
+}
+
+mod copies {
+    use super::super::plan::CopyOutcome;
+    use super::super::profile::tests::entry;
+    use super::*;
+
+    const FROM: &str = "v0";
+
+    fn from_lock() -> Lock {
+        let mut local = entry("mytweak", &[], None);
+        local.origin = Origin::File {
+            name: "t.zip".into(),
+        };
+        let old = "5f0569a6bea71b81";
+        super::super::profile::tests::lock(vec![
+            entry("cogwork", &["showcase"], Some(old)),
+            entry("railways", &["signals"], Some(old)),
+            entry("nobuild", &[], Some(old)),
+            local,
+        ])
+    }
+
+    #[test]
+    fn a_copy_does_what_its_preview_said() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (ctx, _) = setup(&tmp);
+        store::write_lock(&ctx.paths, FROM, &from_lock()).unwrap();
+        let preview = run(service::copy_preview(&ctx, FROM, TAG)).unwrap();
+        assert_eq!(ids_of(&preview.deps), ["showcase"]);
+        assert_eq!(preview.installed_off, ["railways"]);
+        assert_eq!(preview.missing, ["signals"]);
+
+        // A wrong token changes nothing.
+        let err = run(service::copy(&ctx, FROM, TAG, "stale", &next_op())).unwrap_err();
+        assert!(matches!(err, ModsError::ChangedMeanwhile(_)), "{err:?}");
+        assert!(!ctx.paths.lock_file(TAG).unwrap().exists());
+
+        let done = run(service::copy(
+            &ctx,
+            FROM,
+            TAG,
+            &preview.plan_token,
+            &next_op(),
+        ))
+        .unwrap();
+        assert_eq!(done.change.installed, ["cogwork", "railways", "showcase"]);
+        assert_eq!(done.change.installed_off, ["railways"]);
+        assert_eq!(done.change.missing, ["signals"]);
+        let left: Vec<(&str, CopyOutcome)> = done
+            .left_behind
+            .iter()
+            .map(|i| (i.id.as_str(), i.outcome))
+            .collect();
+        assert_eq!(
+            left,
+            [
+                ("nobuild", CopyOutcome::NoBuild),
+                ("mytweak", CopyOutcome::LocalFile)
+            ]
+        );
+        assert_eq!(handed_to_game(&ctx), ["cogwork.zip", "showcase.zip"]);
+        assert!(done.change.report.blocking.is_empty());
+    }
+
+    #[test]
+    fn copying_into_a_running_version_is_refused() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (ctx, _) = setup(&tmp);
+        store::write_lock(&ctx.paths, FROM, &from_lock()).unwrap();
+        let preview = run(service::copy_preview(&ctx, FROM, TAG)).unwrap();
+        ctx.games.insert(TAG);
+        let err = run(service::copy(
+            &ctx,
+            FROM,
+            TAG,
+            &preview.plan_token,
+            &next_op(),
+        ));
+        assert!(matches!(err, Err(ModsError::GameRunning(_))));
+    }
+}
+
+mod sources {
+    use super::*;
+
+    /// A sources list that can't be read is kept and said, in the catalogue too; never read as
+    /// "no sources", and never written over.
+    #[test]
+    fn a_damaged_list_is_kept_and_said() {
+        let tmp = tempfile::tempdir().unwrap();
+        let ctx = with_version(tmp.path(), TAG);
+        let file = ctx.paths.sources_file();
+        std::fs::create_dir_all(file.parent().unwrap()).unwrap();
+        std::fs::write(&file, b"{ \"repos\": [ not json").unwrap();
+        let err = service::source_list(&ctx).unwrap_err();
+        let ModsError::SourcesDamaged(kept) = err else {
+            panic!("{err:?}")
+        };
+        assert_eq!(
+            std::fs::read(&kept).unwrap(),
+            b"{ \"repos\": [ not json",
+            "kept as it was"
+        );
+        let offline = service::offline_catalog(&ctx.paths);
+        assert_eq!(
+            offline.sources_error.map(|e| e.code),
+            Some(crate::error::ErrorCode::ModSourcesDamaged)
+        );
+        // Removing a source from a list that can't be read is refused, not done on an empty one.
+        assert!(matches!(
+            run(service::remove_source(&ctx, "a/b")),
+            Err(ModsError::SourcesDamaged(_))
+        ));
+        assert!(std::path::Path::new(&kept).exists());
+    }
+
+    #[test]
+    fn adding_a_source_asks_github_for_its_name() {
+        let tmp = tempfile::tempdir().unwrap();
+        let api = serve(|path| match path {
+            "/repos/someone/lanterns" | "/repos/SOMEONE/Lanterns" => {
+                ok(br#"{ "full_name": "Someone/Lanterns" }"#.to_vec())
+            }
+            "/repos/a/odd" => ok(br#"{ "full_name": "../../x" }"#.to_vec()),
+            "/repos/a/limited" => (
+                403,
+                vec![("x-ratelimit-reset", "1793000000".into())],
+                Vec::new(),
+            ),
+            _ => (404, Vec::new(), Vec::new()),
+        });
+        let ctx = with_version(tmp.path(), TAG).with_github_api(&api);
+        let got = run(service::add_source(
+            &ctx,
+            "https://github.com/someone/lanterns",
+        ))
+        .unwrap();
+        assert_eq!(got, ["Someone/Lanterns"], "as GitHub spells it");
+        let got = run(service::add_source(&ctx, "SOMEONE/Lanterns")).unwrap();
+        assert_eq!(got, ["Someone/Lanterns"], "once, in any case");
+
+        let failures: Vec<(&str, Expect)> = vec![
+            ("a/gone", |e| matches!(e, ModsError::SourceNotFound(_))),
+            ("a/limited", |e| {
+                matches!(
+                    e,
+                    ModsError::SourceRateLimited {
+                        reset: Some(1_793_000_000)
+                    }
+                )
+            }),
+            ("a/odd", |e| matches!(e, ModsError::SourceInvalid(_))),
+            ("not a repo", |e| matches!(e, ModsError::SourceInvalid(_))),
+            ("https://gitlab.com/a/b", |e| {
+                matches!(e, ModsError::SourceInvalid(_))
+            }),
+        ];
+        for (input, want) in failures {
+            let err = run(service::add_source(&ctx, input)).unwrap_err();
+            assert!(want(&err), "{input}: {err:?}");
+        }
+        assert_eq!(service::source_list(&ctx).unwrap(), ["Someone/Lanterns"]);
+        assert!(
+            run(service::remove_source(&ctx, "someone/LANTERNS"))
+                .unwrap()
+                .is_empty()
+        );
+    }
+}
+
+mod profiles {
+    use super::super::profile::{BlockingReason, Managed};
+    use super::*;
+
+    #[test]
+    fn a_revocation_is_applied_when_the_profile_is_read() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (ctx, world) = setup(&tmp);
+        let world = world.stored(&ctx);
+        run(install(&ctx, &world.sha("cogwork"))).unwrap();
+        revoke(&ctx, &world, "showcase", "deletes saves");
+        let report = run(service::profile(&ctx, TAG)).unwrap();
+        let showcase = lock_of(&ctx).get("showcase").unwrap().clone();
+        assert!(!showcase.enabled);
+        assert_eq!(
+            showcase.revoked.unwrap().reason.as_deref(),
+            Some("deletes saves")
+        );
+        assert_eq!(handed_to_game(&ctx), ["cogwork.zip"]);
+        assert!(report.revocations_pending.is_empty());
+        assert_eq!(report.blocking, ["cogwork"], "it needs what was pulled");
+        assert_eq!(
+            report.blocking_reasons["cogwork"],
+            BlockingReason::MissingDeps
+        );
+    }
+
+    /// Must-do 2: nothing rewrites a running version's folder. The revocation waits, the report
+    /// says so, and it is applied once the game stops.
+    #[test]
+    fn a_revocation_waits_while_the_game_runs() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (ctx, world) = setup(&tmp);
+        let world = world.stored(&ctx);
+        run(install(&ctx, &world.sha("showcase"))).unwrap();
+        let before = std::fs::read(ctx.paths.lock_file(TAG).unwrap()).unwrap();
+        ctx.games.insert(TAG);
+        revoke(&ctx, &world, "showcase", "deletes saves");
+
+        let report = run(service::profile(&ctx, TAG)).unwrap();
+        assert_eq!(report.revocations_pending, ["showcase"]);
+        assert_eq!(report.blocking_reasons["showcase"], BlockingReason::Revoked);
+        assert_eq!(
+            std::fs::read(ctx.paths.lock_file(TAG).unwrap()).unwrap(),
+            before
+        );
+        assert_eq!(
+            handed_to_game(&ctx),
+            ["showcase.zip"],
+            "the running game's folder is left"
+        );
+        run(service::apply_pending(&ctx, TAG)).unwrap();
+        assert_eq!(handed_to_game(&ctx), ["showcase.zip"], "still running");
+
+        ctx.games.remove(TAG);
+        run(service::apply_pending(&ctx, TAG)).unwrap();
+        assert!(!lock_of(&ctx).get("showcase").unwrap().enabled);
+        assert!(handed_to_game(&ctx).is_empty());
+        let report = run(service::profile(&ctx, TAG)).unwrap();
+        assert!(report.revocations_pending.is_empty() && report.blocking.is_empty());
+    }
+
+    /// Contract R4 §6, end to end: an index revocation with an uppercase hash and no reason or
+    /// time still revokes.
+    #[test]
+    fn an_index_revocation_fails_closed() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (ctx, world) = setup(&tmp);
+        let world = world.stored(&ctx);
+        run(install(&ctx, &world.sha("showcase"))).unwrap();
+        let json = format!(
+            r#"{{ "schema": 1, "generated": "2026-11-04T00:00:00Z",
+                 "revoked": [ {{ "sha256": "{}", "at": null }} ] }}"#,
+            world.sha("showcase").to_ascii_uppercase()
+        );
+        let index = super::super::index::parse(json.as_bytes()).unwrap();
+        let status = world.catalog.index.clone();
+        let from_index = super::super::catalog::build(Some(&index), status, Vec::new());
+        let mut c = world.catalog.clone();
+        c.revoked = from_index.revoked;
+        ctx.hold_catalog(c);
+        let report = run(service::profile(&ctx, TAG)).unwrap();
+        let m = &report.mods[0];
+        assert_eq!(m.status, ModStatus::Revoked);
+        // Revoked all the same; no reason is none, said by the page in the player's language.
+        assert_eq!(m.revoked_reason, None);
+        let plan = run(service::plan(&ctx, TAG, &world.sha("showcase"))).unwrap();
+        assert_eq!(
+            plan.problem.unwrap().code,
+            crate::error::ErrorCode::ModRevoked
+        );
+    }
+
+    /// Contract R4 §4: a file in the player's own folder with a managed mod's id.
+    #[test]
+    fn the_players_folder_can_shadow_a_mod() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (ctx, world) = setup(&tmp);
+        let world = world.stored(&ctx);
+        let game = tmp.path().join("game");
+        let mine = game.join("mods");
+        std::fs::create_dir_all(mine.join("cogwork")).unwrap();
+        for f in ["showcase.ZIP", "Railways.zip", "notes.txt", ".hidden.zip"] {
+            std::fs::write(mine.join(f), b"x").unwrap();
+        }
+        std::fs::create_dir_all(ctx.paths.logs_dir()).unwrap();
+        std::fs::write(
+            ctx.paths.logs_dir().join("v1.log"),
+            format!(
+                "[stderr]     0.010 INFO  [weft] game folder {}, cache {}\n",
+                game.display(),
+                tmp.path().join("cache").display()
+            ),
+        )
+        .unwrap();
+        run(install(&ctx, &world.sha("cogwork"))).unwrap();
+        run(install(&ctx, &world.sha("railways"))).unwrap();
+
+        let report = run(service::profile(&ctx, TAG)).unwrap();
+        let shadowed: Vec<(&str, &str, Managed)> = report
+            .shadowed
+            .iter()
+            .map(|s| (s.id.as_str(), s.file.as_str(), s.managed))
+            .collect();
+        assert_eq!(
+            shadowed,
+            [
+                ("cogwork", "cogwork", Managed::On),
+                ("showcase", "showcase.ZIP", Managed::On)
+            ],
+            "Railways.zip is another id to the engine; notes.txt and hidden files are skipped"
+        );
+        assert!(
+            report.blocking.is_empty(),
+            "the launcher's copy loads first"
+        );
+
+        // Turned off: the player's copy loads instead, a warning only.
+        run(service::set_enabled(&ctx, TAG, "cogwork", false)).unwrap();
+        let report = run(service::profile(&ctx, TAG)).unwrap();
+        assert_eq!(report.shadowed[0].managed, Managed::Off);
+        assert!(report.blocking.is_empty());
+
+        // Revoked: the player's copy would load the pulled mod. That blocks, even with
+        // nothing on.
+        run(service::set_enabled(&ctx, TAG, "showcase", false)).unwrap();
+        revoke(&ctx, &world, "showcase", "deletes saves");
+        let report = run(service::profile(&ctx, TAG)).unwrap();
+        assert_eq!(report.shadowed[1].managed, Managed::Revoked);
+        assert_eq!(report.blocking, ["showcase"]);
+        assert_eq!(
+            report.blocking_reasons["showcase"],
+            BlockingReason::ShadowedRevoked
+        );
+        let err = run(service::prepare_launch(&ctx, TAG)).err().unwrap();
+        assert!(
+            matches!(err, ModsError::Blocked(ref n) if n == "showcase name"),
+            "{err:?}"
+        );
+    }
+
+    /// Contract R4 §7, through the service: the file handed to the game is a copy of its own.
+    #[cfg(unix)]
+    #[test]
+    fn an_install_hands_the_game_a_copy() {
+        use std::os::unix::fs::MetadataExt;
+        let tmp = tempfile::tempdir().unwrap();
+        let (ctx, world) = setup(&tmp);
+        run(install(&ctx, &world.sha("showcase"))).unwrap();
+        let handed = ctx.paths.mods_dir(TAG).unwrap().join("showcase.zip");
+        assert_eq!(std::fs::metadata(handed).unwrap().nlink(), 1);
+        let stored = ctx.paths.store_object(&world.sha("showcase"));
+        assert_eq!(std::fs::metadata(stored).unwrap().nlink(), 1);
+    }
+}
+
+mod graph {
+    use super::*;
+
+    /// hearth needs cogwork needs showcase; cogwork and showcase are installed and off.
+    fn with_hearth(tmp: &tempfile::TempDir) -> (Ctx, World, String) {
+        let (ctx, mut world) = setup(tmp);
+        let hearth = zip_of("hearth", "1");
+        let base = world.catalog.mods[0].versions[0]
+            .url
+            .rsplit_once('/')
+            .unwrap()
+            .0
+            .to_string();
+        let v = build_of("hearth", "1.0.0", &hearth, &["cogwork"], &base);
+        let sha = v.sha256.clone();
+        world
+            .catalog
+            .mods
+            .push(catalog_mod("hearth", Origin::Index, vec![v]));
+        ctx.hold_catalog(world.catalog.clone());
+        let world = world.stored(&ctx);
+        run(install(&ctx, &world.sha("cogwork"))).unwrap();
+        run(service::set_enabled(&ctx, TAG, "showcase", false)).unwrap();
+        assert!(lock_of(&ctx).mods.iter().all(|m| !m.enabled));
+        // Stored as if downloaded before; the server doesn't have it.
+        std::fs::write(ctx.paths.store_object(&sha), &hearth).unwrap();
+        (ctx, world, sha)
+    }
+
+    /// Contract R4 §1: turning on through an installed dependency turns on what it needs too.
+    #[test]
+    fn an_install_turns_on_the_whole_chain() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (ctx, _world, hearth) = with_hearth(&tmp);
+        let plan = run(service::plan(&ctx, TAG, &hearth)).unwrap();
+        let mut enable = plan.enable.clone();
+        enable.sort();
+        assert_eq!(enable, ["cogwork", "showcase"]);
+        assert!(plan.turns_on);
+        let done = run(service::install(
+            &ctx,
+            TAG,
+            &hearth,
+            &plan.plan_token,
+            &next_op(),
+        ))
+        .unwrap();
+        let mut also = done.also_enabled.clone();
+        also.sort();
+        assert_eq!(also, ["cogwork", "showcase"]);
+        assert_eq!(
+            handed_to_game(&ctx),
+            ["cogwork.zip", "hearth.zip", "showcase.zip"]
+        );
+        assert!(done.report.blocking.is_empty());
+    }
+
+    /// When the end of the chain is revoked, the wanted mod goes in off and nothing else turns
+    /// on.
+    #[test]
+    fn a_broken_chain_installs_the_mod_off() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (ctx, world, hearth) = with_hearth(&tmp);
+        revoke(&ctx, &world, "showcase", "deletes saves");
+        let plan = run(service::plan(&ctx, TAG, &hearth)).unwrap();
+        assert_eq!(plan.missing, ["showcase"]);
+        assert!(!plan.turns_on);
+        assert!(plan.enable.is_empty());
+        let done = run(service::install(
+            &ctx,
+            TAG,
+            &hearth,
+            &plan.plan_token,
+            &next_op(),
+        ))
+        .unwrap();
+        assert_eq!(done.installed_off, ["hearth"]);
+        assert!(done.also_enabled.is_empty());
+        assert!(handed_to_game(&ctx).is_empty());
+        assert!(done.report.blocking.is_empty(), "Play keeps working");
+    }
+}
+
+/// A change writes three files (the lock, the undo record, the folder). Each step that fails, or
+/// a launcher closed between two, leaves a state that is true, and the next start or Play
+/// finishes the job.
+mod saves {
+    use super::*;
+
+    /// Something stands where the version's mods folder goes, so making it fails.
+    fn block_folder(ctx: &Ctx) -> std::path::PathBuf {
+        let dir = ctx.paths.mods_dir(TAG).unwrap();
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::write(&dir, b"in the way").unwrap();
+        dir
+    }
+
+    #[test]
+    fn a_folder_that_cant_be_written_leaves_the_change_made_and_play_repairs_it() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (ctx, world) = setup(&tmp);
+        run(install(&ctx, &world.sha("cogwork"))).unwrap();
+        assert_eq!(handed_to_game(&ctx), ["cogwork.zip", "showcase.zip"]);
+        let dir = block_folder(&ctx);
+        let err = run(service::set_enabled(&ctx, TAG, "cogwork", false)).unwrap_err();
+        assert!(matches!(err, ModsError::Io(_)), "{err:?}");
+        // The lock is the record of the set: the change is made.
+        assert!(!lock_of(&ctx).get("cogwork").unwrap().enabled);
+
+        // The launcher starts again, the obstacle gone: Play hands the game the set as it is.
+        std::fs::remove_file(&dir).unwrap();
+        let ctx = Ctx::new(ctx.paths.clone());
+        assert!(
+            run(service::prepare_launch(&ctx, TAG))
+                .unwrap()
+                .release()
+                .is_some()
+        );
+        assert_eq!(handed_to_game(&ctx), ["showcase.zip"]);
+    }
+
+    #[test]
+    fn a_launcher_closed_between_the_lock_and_the_folder_is_repaired_at_play() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (ctx, world) = setup(&tmp);
+        run(install(&ctx, &world.sha("cogwork"))).unwrap();
+        // What a change that stopped after the lock and before the folder leaves behind.
+        let mut lock = lock_of(&ctx);
+        lock.get_mut("cogwork").unwrap().enabled = false;
+        store::write_lock(&ctx.paths, TAG, &lock).unwrap();
+        assert_eq!(
+            handed_to_game(&ctx),
+            ["cogwork.zip", "showcase.zip"],
+            "the folder is behind"
+        );
+
+        let ctx = Ctx::new(ctx.paths.clone());
+        let offline = service::offline_catalog(&ctx.paths);
+        let report = run(service::build_report(
+            &ctx,
+            TAG,
+            &lock_of(&ctx),
+            &offline,
+            false,
+        ));
+        let cogwork = report
+            .mods
+            .iter()
+            .find(|m| m.entry.id == "cogwork")
+            .unwrap();
+        assert!(!cogwork.entry.enabled, "the page shows the lock");
+        assert!(
+            run(service::prepare_launch(&ctx, TAG))
+                .unwrap()
+                .release()
+                .is_some()
+        );
+        assert_eq!(handed_to_game(&ctx), ["showcase.zip"]);
+    }
+
+    #[test]
+    fn a_store_copy_that_is_gone_is_said_as_such_and_installing_the_build_again_brings_it_back() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (ctx, world) = setup(&tmp);
+        run(install(&ctx, &world.sha("showcase"))).unwrap();
+        std::fs::remove_file(ctx.paths.store_object(&world.sha("showcase"))).unwrap();
+        // The game's copy goes too, so the launch has to copy it again from the store.
+        let _ = std::fs::remove_file(ctx.paths.mods_dir(TAG).unwrap().join("showcase.zip"));
+        let Err(err) = run(service::prepare_launch(&ctx, TAG)) else {
+            panic!("a launch with a store copy gone went ahead");
+        };
+        assert!(
+            matches!(err, ModsError::StoreMissing(ref id) if id == "showcase"),
+            "{err:?}"
+        );
+        assert_eq!(
+            crate::error::AppError::from(err).code,
+            crate::error::ErrorCode::ModStoreMissing
+        );
+        // The same build installed again: downloaded, and the launch goes ahead.
+        run(install(&ctx, &world.sha("showcase"))).unwrap();
+        assert!(ctx.paths.store_object(&world.sha("showcase")).exists());
+        assert!(
+            run(service::prepare_launch(&ctx, TAG))
+                .unwrap()
+                .release()
+                .is_some()
+        );
+        assert_eq!(handed_to_game(&ctx), ["showcase.zip"]);
+    }
+
+    #[test]
+    fn a_removal_whose_undo_cant_be_kept_still_stands_without_an_undo() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (ctx, world) = setup(&tmp);
+        run(install(&ctx, &world.sha("showcase"))).unwrap();
+        // Something stands where the undo record goes.
+        let record = ctx.paths.removed_file(TAG).unwrap();
+        std::fs::create_dir_all(record.join("in-the-way")).unwrap();
+        let done = run(service::remove(&ctx, TAG, "showcase")).unwrap();
+        assert_eq!(done.undo, None, "no Undo is offered that couldn't work");
+        assert!(lock_of(&ctx).get("showcase").is_none());
+        assert_eq!(handed_to_game(&ctx), Vec::<String>::new());
+
+        // After a restart it is still removed, and there is nothing to undo.
+        let ctx = Ctx::new(ctx.paths.clone());
+        ctx.hold_catalog(world.catalog.clone());
+        let err = run(restore(&ctx, "showcase")).unwrap_err();
+        assert!(matches!(err, ModsError::NotInstalled(_)), "{err:?}");
+    }
+
+    #[test]
+    fn an_old_undo_that_cant_be_cleared_stops_the_change_before_it_is_made() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (ctx, world) = setup(&tmp);
+        run(install(&ctx, &world.sha("showcase"))).unwrap();
+        let before = std::fs::read(ctx.paths.lock_file(TAG).unwrap()).unwrap();
+        let record = ctx.paths.removed_file(TAG).unwrap();
+        std::fs::create_dir_all(record.join("in-the-way")).unwrap();
+        let err = run(service::set_enabled(&ctx, TAG, "showcase", false)).unwrap_err();
+        assert!(matches!(err, ModsError::Io(_)), "{err:?}");
+        assert_eq!(
+            std::fs::read(ctx.paths.lock_file(TAG).unwrap()).unwrap(),
+            before,
+            "nothing changed"
+        );
+        assert_eq!(handed_to_game(&ctx), ["showcase.zip"]);
+    }
+
+    /// A removal's Undo is gone after a restart only if the record is: it is a file, not memory.
+    #[test]
+    fn an_undo_survives_a_restart() {
+        let tmp = tempfile::tempdir().unwrap();
+        let (ctx, world) = setup(&tmp);
+        run(install(&ctx, &world.sha("showcase"))).unwrap();
+        let done = run(service::remove(&ctx, TAG, "showcase")).unwrap();
+        assert_eq!(done.undo.as_deref(), Some("showcase"));
+        let ctx = Ctx::new(ctx.paths.clone());
+        ctx.hold_catalog(world.catalog.clone());
+        run(restore(&ctx, "showcase")).unwrap();
+        assert!(lock_of(&ctx).get("showcase").unwrap().enabled);
+        assert_eq!(handed_to_game(&ctx), ["showcase.zip"]);
+    }
+}
+
+mod catalogue {
+    use super::super::catalog::CatalogUpdate;
+    use super::super::index::Freshness;
+    use super::super::index::tests::{FIXTURE, FIXTURE_KEY, FIXTURE_SIG};
+    use super::super::sources;
+    use super::*;
+    use std::time::{Duration, Instant};
+
+    /// The index (and its revocations) is held and said as soon as it verifies: a source that
+    /// takes long to answer doesn't hold it back. The whole answer still comes at the end.
+    #[test]
+    fn the_index_does_not_wait_for_a_slow_source() {
+        let tmp = tempfile::tempdir().unwrap();
+        let index = serve(|path| match path {
+            "/index.json" => ok(FIXTURE.to_vec()),
+            "/index.json.minisig" => ok(FIXTURE_SIG.as_bytes().to_vec()),
+            _ => (404, Vec::new(), Vec::new()),
+        });
+        // A source whose releases take a second and a half to arrive.
+        let api = serve(|_| (200, vec![("slow", "1500".into())], b"[]".to_vec()));
+        let said: Arc<Mutex<Vec<(Instant, CatalogUpdate, u64)>>> = Arc::default();
+        let ctx = Ctx::new(super::super::paths::Paths::new(tmp.path()))
+            .with_index(&format!("{index}/index.json"), FIXTURE_KEY)
+            .with_github_api(&api);
+        let ctx = {
+            let (said, held) = (said.clone(), ctx.catalog.clone());
+            ctx.with_catalog_listener(move |u| {
+                // What Play and every set read would use at this moment.
+                let revision = held
+                    .0
+                    .lock()
+                    .unwrap()
+                    .catalog
+                    .as_ref()
+                    .map_or(0, |c| c.revision);
+                said.lock().unwrap().push((Instant::now(), u, revision));
+            })
+        };
+        sources::save(&ctx.paths, &["someone/slow".into()]).unwrap();
+
+        let started = Instant::now();
+        let catalog = run(service::load_catalog(&ctx, true)).unwrap();
+        let done = Instant::now();
+        let said = said.lock().unwrap();
+        let (at, first, held_revision) = &said[0];
+        assert_eq!(
+            first.pending,
+            ["someone/slow"],
+            "said while the source is still asked"
+        );
+        assert_eq!(first.catalog.index.freshness, Freshness::Fresh);
+        assert_eq!(first.catalog.mods.len(), 1, "the index's mods are in");
+        assert_eq!(
+            *held_revision, first.catalog.revision,
+            "and held, for Play and set reads"
+        );
+        // Said while the source was still being asked (it is in `pending`), however long the
+        // index took to verify and save; the source itself took its second and a half.
+        assert!(*at < done && done.duration_since(started) >= Duration::from_millis(1500));
+        // Then the source, and the whole answer: nothing left waiting.
+        assert!(said.iter().any(|(_, u, _)| u.pending.is_empty()));
+        assert_eq!(catalog.sources.len(), 1);
+        assert!(catalog.revision >= first.catalog.revision);
+    }
+}
diff --git a/src-tauri/src/mods/sources.rs b/src-tauri/src/mods/sources.rs
new file mode 100644
index 0000000..5f03e2f
--- /dev/null
+++ b/src-tauri/src/mods/sources.rs
@@ -0,0 +1,966 @@
+//! GitHub repos the player added as mod sources. A release counts when it carries `<id>.zip` and
+//! `<id>.mod.json` (see `docs/mod-manager/INDEX_FORMAT.md`). Nobody reviewed these, which the
+//! catalogue says; what is checked is that the description and the zip agree with GitHub's own
+//! record of the release.
+
+use reqwest::header::{ETAG, HeaderMap, IF_NONE_MATCH, LINK, USER_AGENT};
+use serde::{Deserialize, Serialize};
+use std::path::{Path, PathBuf};
+use std::time::Duration;
+use ts_rs::TS;
+
+use super::error::ModsError;
+use super::index::{
+    Asset, Channel, Dep, Freshness, IndexMod, IndexVersion, Provenance, RESERVED_ID, SourceRef,
+    WeftRef, clamp_summary, is_mod_id, is_repo, same_repo, version_problem,
+};
+use super::paths::{Paths, write_atomic};
+use super::profile::now;
+use crate::download::read_capped;
+
+const USER_AGENT_VALUE: &str = concat!("weft-launcher/", env!("CARGO_PKG_VERSION"));
+pub const MAX_MOD_JSON_BYTES: usize = 64 * 1024;
+/// Releases are read 100 at a time, newest first, up to this many pages.
+pub const MAX_RELEASE_PAGES: usize = 5;
+
+#[derive(Debug, Default, Serialize, Deserialize)]
+struct SourcesFile {
+    repos: Vec<String>,
+}
+
+/// The player's sources. No file is no sources. A file that can't be read or isn't a sources
+/// list is never taken for an empty one: it is moved aside, kept, and `ModSourcesDamaged` names
+/// where, until the player saves a new list ([`save`]) or puts that one back.
+pub fn list(paths: &Paths) -> Result<Vec<String>, ModsError> {
+    let file = paths.sources_file();
+    match std::fs::read(&file) {
+        Ok(bytes) => match serde_json::from_slice::<SourcesFile>(&bytes) {
+            Ok(f) => Ok(f.repos.into_iter().filter(|r| is_repo(r)).collect()),
+            Err(e) => Err(set_aside(&file, &e.to_string())),
+        },
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => match damaged_copy(&file) {
+            Some(kept) => Err(ModsError::SourcesDamaged(kept.display().to_string())),
+            None => Ok(Vec::new()),
+        },
+        Err(e) => Err(set_aside(&file, &e.to_string())),
+    }
+}
+
+/// The list to change: a damaged one is already set aside and kept, so a change starts a new one.
+pub fn list_for_change(paths: &Paths) -> Result<Vec<String>, ModsError> {
+    match list(paths) {
+        // Only once it is out of the way: a file that couldn't be moved is never overwritten.
+        Err(ModsError::SourcesDamaged(_)) if !paths.sources_file().exists() => Ok(Vec::new()),
+        other => other,
+    }
+}
+
+/// `sources.json` moved to `sources.damaged-<seconds>.json` beside it, and the error naming it.
+fn set_aside(file: &Path, why: &str) -> ModsError {
+    let stamp = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|d| d.as_secs())
+        .unwrap_or_default();
+    let kept = file.with_file_name(format!("sources.damaged-{stamp}.json"));
+    match std::fs::rename(file, &kept) {
+        Ok(()) => {
+            eprintln!(
+                "mod sources: {} is damaged ({why}); kept as {}",
+                file.display(),
+                kept.display()
+            );
+            ModsError::SourcesDamaged(kept.display().to_string())
+        }
+        // It can't even be moved: it stays where it is, and is still never overwritten
+        // unasked (`list_for_change` only starts over once it is aside).
+        Err(_) => ModsError::SourcesDamaged(file.display().to_string()),
+    }
+}
+
+/// The newest damaged list set aside next to `file`, if there is one.
+fn damaged_copy(file: &Path) -> Option<PathBuf> {
+    let dir = file.parent()?;
+    std::fs::read_dir(dir)
+        .ok()?
+        .flatten()
+        .map(|e| e.path())
+        .filter(|p| {
+            p.file_name()
+                .and_then(|n| n.to_str())
+                .is_some_and(|n| n.starts_with("sources.damaged-") && n.ends_with(".json"))
+        })
+        .max()
+}
+
+/// Writes the list. A damaged one set aside before stays where it is, kept.
+pub fn save(paths: &Paths, repos: &[String]) -> Result<(), ModsError> {
+    let file = SourcesFile {
+        repos: repos.to_vec(),
+    };
+    write_atomic(&paths.sources_file(), &serde_json::to_vec_pretty(&file)?)
+}
+
+/// The list with `canonical` added, or replacing the same repo spelled another way.
+pub fn with_repo(mut repos: Vec<String>, canonical: &str) -> Vec<String> {
+    match repos.iter_mut().find(|r| same_repo(r, canonical)) {
+        Some(r) => *r = canonical.to_string(),
+        None => repos.push(canonical.to_string()),
+    }
+    repos
+}
+
+pub fn without_repo(mut repos: Vec<String>, repo: &str) -> Vec<String> {
+    repos.retain(|r| !same_repo(r, repo));
+    repos
+}
+
+/// Accepts `owner/repo` or a github.com URL of the repo.
+pub fn normalize(input: &str) -> Result<String, ModsError> {
+    let trimmed = input.trim().trim_end_matches('/');
+    let trimmed = trimmed.strip_suffix(".git").unwrap_or(trimmed);
+    let repo = ["https://github.com/", "http://github.com/", "github.com/"]
+        .iter()
+        .find_map(|p| trimmed.strip_prefix(p))
+        .unwrap_or(trimmed);
+    if is_repo(repo) {
+        Ok(repo.to_string())
+    } else {
+        Err(ModsError::SourceInvalid(input.to_string()))
+    }
+}
+
+/// `<id>.mod.json`: one version of one mod, with the mod's own fields beside it.
+#[derive(Debug, Clone, Deserialize)]
+pub struct ModJson {
+    pub schema: u32,
+    pub id: String,
+    pub name: String,
+    #[serde(default)]
+    pub summary: String,
+    #[serde(default)]
+    pub authors: Vec<String>,
+    #[serde(default)]
+    pub license: Option<String>,
+    #[serde(default)]
+    pub homepage: Option<String>,
+    #[serde(default)]
+    pub icon: Option<String>,
+    pub version: String,
+    pub channel: Channel,
+    pub tag: String,
+    #[serde(default)]
+    pub published: String,
+    pub source: SourceRef,
+    pub weft: WeftRef,
+    #[serde(default)]
+    pub deps: Vec<Dep>,
+    #[serde(default)]
+    pub platforms: Vec<String>,
+    pub asset: Asset,
+    #[serde(default)]
+    pub provenance: Option<Provenance>,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub(crate) struct GhAsset {
+    pub name: String,
+    pub browser_download_url: String,
+    pub size: u64,
+    #[serde(default)]
+    pub digest: Option<String>,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub(crate) struct GhRelease {
+    pub tag_name: String,
+    #[serde(default)]
+    pub draft: bool,
+    pub prerelease: bool,
+    #[serde(default)]
+    pub published_at: Option<String>,
+    pub assets: Vec<GhAsset>,
+}
+
+/// Why a source that GitHub answered has no mods to offer, by how far its best release got.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize, TS)]
+#[serde(rename_all = "camelCase")]
+pub enum NoModsReason {
+    /// It has no published releases.
+    NoReleases,
+    /// No release carries an `<id>.zip` with its `<id>.mod.json`.
+    NoModFiles,
+    /// A release's `<id>.mod.json` couldn't be read, or isn't one.
+    Unreadable,
+    /// GitHub has no SHA-256 digest for the zip, so nothing could be checked.
+    NoDigest,
+    /// The description doesn't match GitHub's record of the release (tag, repo, asset, size or
+    /// hash), or names another id.
+    Disagrees,
+    /// It matches, but breaks a rule every mod follows (version, interface, URL, dependencies).
+    Invalid,
+}
+
+/// Keeps the reason that got furthest.
+fn note(seen: &mut Option<NoModsReason>, why: NoModsReason) {
+    *seen = Some(seen.map_or(why, |s| s.max(why)));
+}
+
+#[derive(Debug, Default, Serialize, Deserialize)]
+struct SourceCache {
+    etag: Option<String>,
+    mods: Vec<IndexMod>,
+    /// When GitHub last answered; missing in caches older launchers wrote.
+    #[serde(default)]
+    checked: Option<String>,
+    /// Why there are no mods, when there are none.
+    #[serde(default)]
+    no_mods: Option<NoModsReason>,
+}
+
+fn cache_path(paths: &Paths, repo: &str) -> std::path::PathBuf {
+    paths.cache_dir().join("mod-sources").join(format!(
+        "{}.json",
+        repo.to_ascii_lowercase().replace('/', "__")
+    ))
+}
+
+/// Checks one release's description against GitHub's record of the same release:
+/// schema 1; the id is a mod id (not `base`) and the zip's stem; the tag, repo, asset name, URL
+/// and size equal GitHub's;
+/// the SHA-256 equals GitHub's digest (a release without a digest is skipped); and then every
+/// rule an index entry must follow. A GitHub prerelease is never a plain release.
+pub(crate) fn accept(
+    repo: &str,
+    release: &GhRelease,
+    zip: &GhAsset,
+    json: ModJson,
+) -> Result<IndexMod, NoModsReason> {
+    let stem = zip
+        .name
+        .strip_suffix(".zip")
+        .ok_or(NoModsReason::NoModFiles)?;
+    let digest = zip
+        .digest
+        .as_deref()
+        .and_then(|d| d.strip_prefix("sha256:"))
+        .ok_or(NoModsReason::NoDigest)?;
+    let agrees = json.schema == 1
+        && is_mod_id(&json.id)
+        && json.id != RESERVED_ID
+        && json.id == stem
+        && json.tag == release.tag_name
+        && same_repo(&json.source.repo, repo)
+        && json.asset.name == zip.name
+        && json.asset.url == zip.browser_download_url
+        && json.asset.size == zip.size
+        && json.asset.sha256.eq_ignore_ascii_case(digest);
+    if !agrees {
+        return Err(NoModsReason::Disagrees);
+    }
+    let mut channel = json.channel;
+    if release.prerelease && channel == Channel::Release {
+        channel = Channel::Prerelease;
+    }
+    let version = IndexVersion {
+        version: json.version,
+        channel,
+        tag: json.tag,
+        published: release.published_at.clone().unwrap_or(json.published),
+        source: SourceRef {
+            repo: repo.to_string(),
+            commit: json.source.commit,
+        },
+        weft: json.weft,
+        deps: json.deps,
+        platforms: json.platforms,
+        asset: Asset {
+            sha256: digest.to_ascii_lowercase(),
+            ..json.asset
+        },
+        provenance: json.provenance,
+        // A source can't review itself.
+        reviewed: None,
+    };
+    if version_problem(&json.id, &version).is_some() {
+        return Err(NoModsReason::Invalid);
+    }
+    let mut summary = json.summary;
+    clamp_summary(&mut summary);
+    Ok(IndexMod {
+        id: json.id,
+        name: json.name,
+        summary,
+        authors: json.authors,
+        license: json.license,
+        homepage: json.homepage.filter(|u| u.starts_with("https://")),
+        icon: json.icon.filter(|u| crate::download::icon_url_allowed(u)),
+        versions: vec![version],
+    })
+}
+
+/// Folds one entry per release into one entry per mod, newest version first. `entries` come
+/// in GitHub's order, newest release first: the mod's name, summary and icon come from its
+/// newest release, and a version (or a zip) a later release publishes again replaces nothing.
+fn merge(entries: Vec<IndexMod>) -> Vec<IndexMod> {
+    let mut mods: Vec<IndexMod> = Vec::new();
+    for entry in entries {
+        match mods.iter_mut().find(|m| m.id == entry.id) {
+            Some(m) => {
+                for v in entry.versions {
+                    let seen = m.versions.iter().any(|have| {
+                        have.version == v.version || have.asset.sha256 == v.asset.sha256
+                    });
+                    if !seen {
+                        m.versions.push(v);
+                    }
+                }
+            }
+            None => mods.push(entry),
+        }
+    }
+    for m in &mut mods {
+        m.versions
+            .sort_by(|a, b| super::version::compare(&b.version, &a.version));
+    }
+    mods
+}
+
+async fn get_mod_json(client: &reqwest::Client, url: &str) -> Option<ModJson> {
+    let response = client
+        .get(url)
+        .header(USER_AGENT, USER_AGENT_VALUE)
+        .timeout(Duration::from_secs(15))
+        .send()
+        .await
+        .ok()?;
+    if !response.status().is_success() {
+        return None;
+    }
+    let bytes = read_capped(response, MAX_MOD_JSON_BYTES).await.ok()??;
+    serde_json::from_slice(&bytes).ok()
+}
+
+/// The `rel="next"` URL of a GitHub `Link` header, if it stays on the API.
+/// GitHub refused for too many requests, and said when the limit ends, when it said.
+fn rate_limited(headers: &HeaderMap) -> ModsError {
+    let reset = headers
+        .get("x-ratelimit-reset")
+        .and_then(|v| v.to_str().ok())
+        .and_then(|v| v.trim().parse().ok());
+    ModsError::SourceRateLimited { reset }
+}
+
+pub(crate) fn next_page(link: &str) -> Option<String> {
+    link.split(',').find_map(|part| {
+        let (url, params) = part.split_once(';')?;
+        if !params.split(';').any(|p| p.trim() == r#"rel="next""#) {
+            return None;
+        }
+        let url = url.trim().strip_prefix('<')?.strip_suffix('>')?;
+        url.starts_with("https://api.github.com/")
+            .then(|| url.to_string())
+    })
+}
+
+/// One source as read now.
+pub struct SourceFetch {
+    pub mods: Vec<IndexMod>,
+    pub freshness: Freshness,
+    pub checked: Option<String>,
+    pub error: Option<ModsError>,
+    /// Why GitHub's answer has no mods, when it has none.
+    pub no_mods: Option<NoModsReason>,
+}
+
+/// The last good answer with the reason the refresh failed, or nothing and the reason.
+fn fall_back(cached: Option<SourceCache>, error: ModsError) -> SourceFetch {
+    match cached {
+        Some(c) => SourceFetch {
+            mods: c.mods,
+            freshness: Freshness::Cached,
+            checked: c.checked,
+            error: Some(error),
+            no_mods: c.no_mods,
+        },
+        None => SourceFetch {
+            mods: Vec::new(),
+            freshness: Freshness::Unavailable,
+            checked: None,
+            error: Some(error),
+            no_mods: None,
+        },
+    }
+}
+
+enum Listing {
+    NotModified,
+    Releases(Vec<GhRelease>, Option<String>),
+}
+
+async fn list_releases(
+    client: &reqwest::Client,
+    api: &str,
+    repo: &str,
+    etag: Option<&str>,
+) -> Result<Listing, ModsError> {
+    let mut url = format!("{api}/repos/{repo}/releases?per_page=100");
+    let mut releases = Vec::new();
+    let mut first_etag = None;
+    for page in 0..MAX_RELEASE_PAGES {
+        let mut request = client
+            .get(&url)
+            .header(USER_AGENT, USER_AGENT_VALUE)
+            .timeout(Duration::from_secs(15));
+        if page == 0
+            && let Some(etag) = etag
+        {
+            request = request.header(IF_NONE_MATCH, etag);
+        }
+        let response = request.send().await?;
+        let header = |name| {
+            response
+                .headers()
+                .get(name)
+                .and_then(|v| v.to_str().ok())
+                .map(str::to_string)
+        };
+        let next = header(LINK).as_deref().and_then(next_page);
+        if page == 0 {
+            first_etag = header(ETAG);
+        }
+        match response.status().as_u16() {
+            200 => {}
+            304 if page == 0 => return Ok(Listing::NotModified),
+            404 => return Err(ModsError::SourceNotFound(repo.to_string())),
+            403 | 429 => return Err(rate_limited(response.headers())),
+            status => return Err(ModsError::Http { status, url }),
+        }
+        releases.extend(response.json::<Vec<GhRelease>>().await?);
+        match next {
+            Some(n) => url = n,
+            None => break,
+        }
+    }
+    Ok(Listing::Releases(releases, first_etag))
+}
+
+/// The cached answer, checked again by the rules a fresh one passed ([`revalidate`]): the cache
+/// is only a file on disk.
+fn read_cache(paths: &Paths, repo: &str) -> Option<SourceCache> {
+    let mut cache: SourceCache = std::fs::read(cache_path(paths, repo))
+        .ok()
+        .and_then(|b| serde_json::from_slice(&b).ok())?;
+    cache.mods = revalidate(repo, std::mem::take(&mut cache.mods));
+    Some(cache)
+}
+
+/// What [`accept`] lets through, applied to mods read back from the cache: a mod id that isn't
+/// `base`, versions that follow the contract (`version_problem`, which includes the asset URL
+/// rule), from this repo and claiming no review. Anything else is dropped and logged.
+pub(crate) fn revalidate(repo: &str, mods: Vec<IndexMod>) -> Vec<IndexMod> {
+    mods.into_iter()
+        .filter_map(|mut m| {
+            if !is_mod_id(&m.id) || m.id == RESERVED_ID {
+                eprintln!("mod source {repo}: dropping cached mod {:?}", m.id);
+                return None;
+            }
+            let id = m.id.clone();
+            m.versions.retain(|v| {
+                let problem = version_problem(&id, v)
+                    .or_else(|| {
+                        (!same_repo(&v.source.repo, repo)).then(|| "another repo".to_string())
+                    })
+                    .or_else(|| v.reviewed.is_some().then(|| "claims a review".to_string()));
+                match problem {
+                    None => true,
+                    Some(why) => {
+                        eprintln!(
+                            "mod source {repo}: dropping cached {id} {}: {why}",
+                            v.version
+                        );
+                        false
+                    }
+                }
+            });
+            m.icon = m
+                .icon
+                .take()
+                .filter(|u| crate::download::icon_url_allowed(u));
+            m.homepage = m.homepage.take().filter(|u| u.starts_with("https://"));
+            clamp_summary(&mut m.summary);
+            (!m.versions.is_empty()).then_some(m)
+        })
+        .collect()
+}
+
+/// The last good answer of one source, without asking GitHub.
+pub fn cached(paths: &Paths, repo: &str) -> SourceFetch {
+    match read_cache(paths, repo) {
+        Some(c) => SourceFetch {
+            mods: c.mods,
+            freshness: Freshness::Cached,
+            checked: c.checked,
+            error: None,
+            no_mods: c.no_mods,
+        },
+        None => SourceFetch {
+            mods: Vec::new(),
+            freshness: Freshness::Unavailable,
+            checked: None,
+            error: None,
+            no_mods: None,
+        },
+    }
+}
+
+/// The mods of one source. When GitHub can't be asked or refuses, the last good answer is used
+/// and the error comes along with it.
+/// `api` is GitHub's API (`context::GITHUB_API`), or a stand-in in tests.
+pub async fn fetch(
+    paths: &Paths,
+    client: &reqwest::Client,
+    api: &str,
+    repo: &str,
+    refresh: bool,
+) -> SourceFetch {
+    let path = cache_path(paths, repo);
+    let cached = read_cache(paths, repo);
+    if !refresh && let Some(c) = cached {
+        return SourceFetch {
+            mods: c.mods,
+            freshness: Freshness::Cached,
+            checked: c.checked,
+            error: None,
+            no_mods: c.no_mods,
+        };
+    }
+
+    let etag = cached.as_ref().and_then(|c| c.etag.clone());
+    let (releases, etag) = match list_releases(client, api, repo, etag.as_deref()).await {
+        Ok(Listing::Releases(r, e)) => (r, e),
+        Ok(Listing::NotModified) => {
+            let mut cache = cached.unwrap_or_default();
+            cache.checked = Some(now());
+            let _ = serde_json::to_vec(&cache).map(|b| write_atomic(&path, &b));
+            return SourceFetch {
+                mods: cache.mods,
+                freshness: Freshness::Fresh,
+                checked: cache.checked,
+                error: None,
+                no_mods: cache.no_mods,
+            };
+        }
+        Err(e) => return fall_back(cached, e),
+    };
+
+    let mut entries = Vec::new();
+    let mut why = None;
+    let published: Vec<&GhRelease> = releases.iter().filter(|r| !r.draft).collect();
+    if published.is_empty() {
+        note(&mut why, NoModsReason::NoReleases);
+    }
+    for release in published {
+        let mut pairs = 0;
+        for json_asset in release
+            .assets
+            .iter()
+            .filter(|a| a.name.ends_with(".mod.json"))
+        {
+            let stem = json_asset.name.trim_end_matches(".mod.json");
+            let Some(zip) = release
+                .assets
+                .iter()
+                .find(|a| a.name == format!("{stem}.zip"))
+            else {
+                continue;
+            };
+            pairs += 1;
+            let Some(json) = get_mod_json(client, &json_asset.browser_download_url).await else {
+                note(&mut why, NoModsReason::Unreadable);
+                continue;
+            };
+            match accept(repo, release, zip, json) {
+                Ok(entry) => entries.push(entry),
+                Err(reason) => note(&mut why, reason),
+            }
+        }
+        if pairs == 0 {
+            note(&mut why, NoModsReason::NoModFiles);
+        }
+    }
+    let mods = merge(entries);
+    let cache = SourceCache {
+        etag,
+        no_mods: if mods.is_empty() { why } else { None },
+        mods,
+        checked: Some(now()),
+    };
+    let _ = serde_json::to_vec(&cache).map(|b| write_atomic(&path, &b));
+    SourceFetch {
+        mods: cache.mods,
+        freshness: Freshness::Fresh,
+        checked: cache.checked,
+        error: None,
+        no_mods: cache.no_mods,
+    }
+}
+
+/// The repo as GitHub spells it, if it exists. A renamed repo gives its new name.
+/// `api` is GitHub's API (`https://api.github.com`).
+pub async fn canonical_name(
+    client: &reqwest::Client,
+    api: &str,
+    repo: &str,
+) -> Result<String, ModsError> {
+    #[derive(Deserialize)]
+    struct GhRepo {
+        full_name: String,
+    }
+    let url = format!("{api}/repos/{repo}");
+    let response = client
+        .get(&url)
+        .header(USER_AGENT, USER_AGENT_VALUE)
+        .timeout(Duration::from_secs(15))
+        .send()
+        .await?;
+    match response.status().as_u16() {
+        200 => {}
+        404 => return Err(ModsError::SourceNotFound(repo.to_string())),
+        403 | 429 => return Err(rate_limited(response.headers())),
+        status => return Err(ModsError::Http { status, url }),
+    }
+    let found: GhRepo = response.json().await?;
+    if is_repo(&found.full_name) {
+        Ok(found.full_name)
+    } else {
+        Err(ModsError::SourceInvalid(found.full_name))
+    }
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use super::*;
+
+    #[test]
+    fn a_damaged_list_is_set_aside_kept_and_said_until_a_new_one_is_saved() {
+        let tmp = tempfile::tempdir().unwrap();
+        let paths = Paths::new(tmp.path());
+        let file = paths.sources_file();
+        std::fs::create_dir_all(file.parent().unwrap()).unwrap();
+        assert_eq!(
+            list(&paths).unwrap(),
+            Vec::<String>::new(),
+            "no file is no sources"
+        );
+        std::fs::write(&file, b"{ not json").unwrap();
+        let Err(ModsError::SourcesDamaged(kept)) = list(&paths) else {
+            panic!("a damaged list is said")
+        };
+        assert!(!file.exists(), "set aside");
+        assert_eq!(
+            std::fs::read(&kept).unwrap(),
+            b"{ not json",
+            "kept as it was"
+        );
+        // Said again, not taken for no sources, until a new list is saved.
+        assert!(matches!(list(&paths), Err(ModsError::SourcesDamaged(k)) if k == kept));
+        assert_eq!(list_for_change(&paths).unwrap(), Vec::<String>::new());
+        save(&paths, &["a/b".to_string()]).unwrap();
+        assert_eq!(list(&paths).unwrap(), ["a/b"]);
+        assert!(Path::new(&kept).exists(), "the damaged one is still kept");
+    }
+
+    #[test]
+    fn why_a_source_has_no_mods_is_how_far_it_got() {
+        let mut why = None;
+        note(&mut why, NoModsReason::NoModFiles);
+        note(&mut why, NoModsReason::Disagrees);
+        note(&mut why, NoModsReason::Unreadable);
+        assert_eq!(why, Some(NoModsReason::Disagrees));
+        let (r, zip) = release(false);
+        let mut j = json();
+        j.tag = "another-tag".into();
+        assert_eq!(
+            accept("Zorro909/weft-mods", &r, &zip, j).err(),
+            Some(NoModsReason::Disagrees)
+        );
+    }
+
+    #[test]
+    fn a_source_icon_only_from_github_hosts() {
+        let (r, zip) = release(false);
+        let with = |icon: &str| {
+            let mut j = json();
+            j.icon = Some(icon.into());
+            accept("Zorro909/weft-mods", &r, &zip, j).unwrap().icon
+        };
+        let ok = "https://raw.githubusercontent.com/Zorro909/weft-mods/main/icon.png";
+        assert_eq!(with(ok).as_deref(), Some(ok));
+        assert_eq!(with("https://tracker.example/pixel.png"), None);
+        assert_eq!(with("https://objects.githubusercontent.com/icon.png"), None);
+    }
+
+    fn release(prerelease: bool) -> (GhRelease, GhAsset) {
+        let zip = GhAsset {
+            name: "cogwork.zip".into(),
+            browser_download_url:
+                "https://github.com/Zorro909/weft-mods/releases/download/cogwork-v0.2.0/cogwork.zip"
+                    .into(),
+            size: 10,
+            digest: Some(format!("sha256:{}", "a".repeat(64))),
+        };
+        let r = GhRelease {
+            tag_name: "cogwork-v0.2.0".into(),
+            draft: false,
+            prerelease,
+            published_at: Some("2026-11-04T00:00:00Z".into()),
+            assets: vec![zip.clone()],
+        };
+        (r, zip)
+    }
+
+    fn json() -> ModJson {
+        let v =
+            super::super::index::tests::version("cogwork", "Zorro909/weft-mods", &"a".repeat(64));
+        ModJson {
+            schema: 1,
+            id: "cogwork".into(),
+            name: "Cogwork".into(),
+            summary: String::new(),
+            authors: vec![],
+            license: None,
+            homepage: None,
+            icon: None,
+            version: v.version,
+            channel: v.channel,
+            tag: v.tag,
+            published: v.published,
+            source: v.source,
+            weft: v.weft,
+            deps: v.deps,
+            platforms: v.platforms,
+            asset: v.asset,
+            provenance: None,
+        }
+    }
+
+    #[test]
+    fn description_must_agree_with_github() {
+        let (r, zip) = release(false);
+        let repo = "Zorro909/weft-mods";
+        assert!(accept(repo, &r, &zip, json()).is_ok());
+        assert!(
+            accept("zorro909/WEFT-MODS", &r, &zip, json()).is_ok(),
+            "repos compare without case"
+        );
+
+        type Change = fn(&mut ModJson);
+        let cases: &[(&str, Change)] = &[
+            ("digest", |j| j.asset.sha256 = "b".repeat(64)),
+            ("tag", |j| j.tag = "cogwork-v9".into()),
+            ("schema", |j| j.schema = 2),
+            ("id", |j| j.id = "other".into()),
+            ("asset name", |j| j.asset.name = "other.zip".into()),
+            ("size", |j| j.asset.size = 11),
+            ("url", |j| j.asset.url.push_str("?x")),
+            ("source repo", |j| j.source.repo = "Other/repo".into()),
+        ];
+        for (what, change) in cases {
+            let mut j = json();
+            change(&mut j);
+            assert!(accept(repo, &r, &zip, j).is_err(), "{what} differs");
+        }
+        assert!(
+            accept("Other/repo", &r, &zip, json()).is_err(),
+            "repo differs"
+        );
+
+        let mut no_digest = zip.clone();
+        no_digest.digest = None;
+        assert_eq!(
+            accept(repo, &r, &no_digest, json()).err(),
+            Some(NoModsReason::NoDigest),
+            "no digest"
+        );
+    }
+
+    #[test]
+    fn the_id_must_be_a_mod_id() {
+        let repo = "Zorro909/weft-mods";
+        for id in ["Cogwork", "cog-work", "cog.work", "base", ""] {
+            let (r, mut zip) = release(false);
+            zip.name = format!("{id}.zip");
+            let mut j = json();
+            j.id = id.to_string();
+            j.asset.name = zip.name.clone();
+            j.asset.url =
+                format!("https://github.com/{repo}/releases/download/cogwork-v0.2.0/{id}.zip");
+            zip.browser_download_url = j.asset.url.clone();
+            assert!(accept(repo, &r, &zip, j).is_err(), "{id:?}");
+        }
+    }
+
+    #[test]
+    fn releases_merge_newest_first() {
+        let entry = |name: &str, version: &str, sha: char| {
+            let mut m = super::super::catalog::tests::index_mod(
+                "cogwork",
+                "Zorro909/weft-mods",
+                &sha.to_string().repeat(64),
+            );
+            m.name = name.into();
+            m.versions[0].version = version.into();
+            m
+        };
+        let mods = merge(vec![
+            entry("Cogwork 2", "0.3.0", 'c'),
+            entry("Cogwork", "0.2.0", 'b'),
+            entry("Old name", "0.2.0", 'a'),
+            entry("Old name", "0.1.0", 'c'),
+        ]);
+        assert_eq!(mods.len(), 1);
+        assert_eq!(
+            mods[0].name, "Cogwork 2",
+            "the newest release names the mod"
+        );
+        let versions: Vec<&str> = mods[0]
+            .versions
+            .iter()
+            .map(|v| v.version.as_str())
+            .collect();
+        assert_eq!(versions, ["0.3.0", "0.2.0"]);
+        assert_eq!(mods[0].versions[1].asset.sha256, "b".repeat(64));
+    }
+
+    #[test]
+    fn github_prerelease_wins() {
+        let (r, zip) = release(true);
+        let m = accept("Zorro909/weft-mods", &r, &zip, json()).unwrap();
+        assert_eq!(m.versions[0].channel, Channel::Prerelease);
+        assert!(m.versions[0].reviewed.is_none());
+    }
+
+    #[test]
+    fn repo_input_forms() {
+        assert_eq!(
+            normalize("Zorro909/weft-mods").unwrap(),
+            "Zorro909/weft-mods"
+        );
+        assert_eq!(
+            normalize(" https://github.com/Zorro909/weft-mods.git/ ").unwrap(),
+            "Zorro909/weft-mods"
+        );
+        assert!(normalize("https://gitlab.com/a/b").is_err());
+        assert!(normalize("nope").is_err());
+    }
+
+    #[test]
+    fn repo_lists_ignore_case() {
+        let list = vec!["zorro909/weft-mods".to_string(), "a/b".to_string()];
+        assert_eq!(
+            with_repo(list.clone(), "Zorro909/weft-mods"),
+            ["Zorro909/weft-mods", "a/b"]
+        );
+        assert_eq!(with_repo(list.clone(), "c/d").len(), 3);
+        assert_eq!(without_repo(list, "ZORRO909/Weft-Mods"), ["a/b"]);
+    }
+
+    #[test]
+    fn pages_follow_link_headers() {
+        let link = r#"<https://api.github.com/repositories/1/releases?per_page=100&page=2>; rel="next", <https://api.github.com/repositories/1/releases?per_page=100&page=5>; rel="last""#;
+        assert_eq!(
+            next_page(link).as_deref(),
+            Some("https://api.github.com/repositories/1/releases?per_page=100&page=2")
+        );
+        assert_eq!(next_page(r#"<https://evil.example/x>; rel="next""#), None);
+        assert_eq!(next_page(r#"<https://api.github.com/x>; rel="prev""#), None);
+    }
+
+    #[test]
+    fn a_failed_refresh_keeps_the_cache_and_says_why() {
+        let cache = SourceCache {
+            etag: None,
+            mods: vec![super::super::catalog::tests::index_mod(
+                "cogwork",
+                "Zorro909/weft-mods",
+                &"a".repeat(64),
+            )],
+            checked: Some("2026-11-01T00:00:00Z".into()),
+            no_mods: None,
+        };
+        let got = fall_back(Some(cache), ModsError::SourceRateLimited { reset: None });
+        assert_eq!(got.freshness, Freshness::Cached);
+        assert_eq!(got.mods.len(), 1);
+        assert_eq!(got.checked.as_deref(), Some("2026-11-01T00:00:00Z"));
+        assert!(matches!(
+            got.error,
+            Some(ModsError::SourceRateLimited { .. })
+        ));
+
+        let got = fall_back(None, ModsError::SourceNotFound("a/b".into()));
+        assert_eq!(got.freshness, Freshness::Unavailable);
+        assert!(got.mods.is_empty() && got.error.is_some());
+    }
+
+    /// Contract R4 §6: the cache is checked again on every read, not only when it was fetched.
+    #[test]
+    fn a_tampered_cache_is_checked_again() {
+        let tmp = tempfile::tempdir().unwrap();
+        let paths = Paths::new(tmp.path());
+        let repo = "Zorro909/weft-mods";
+        let good = accept(repo, &release(false).0, &release(false).1, json()).unwrap();
+        let mut elsewhere = good.clone();
+        elsewhere.id = "showcase".into();
+        elsewhere.versions[0].asset.name = "showcase.zip".into();
+        elsewhere.versions[0].asset.url = "https://evil.example/showcase.zip".into();
+        let mut reviewed = good.clone();
+        reviewed.id = "lanterns".into();
+        reviewed.versions[0].reviewed = Some(super::super::index::Reviewed {
+            by: "me".into(),
+            at: "now".into(),
+        });
+        let mut reserved = good.clone();
+        reserved.id = RESERVED_ID.into();
+        let cache = SourceCache {
+            etag: None,
+            mods: vec![good, elsewhere, reviewed, reserved],
+            checked: None,
+            no_mods: None,
+        };
+        write_atomic(
+            &cache_path(&paths, repo),
+            &serde_json::to_vec(&cache).unwrap(),
+        )
+        .unwrap();
+        let got = cached(&paths, repo);
+        let ids: Vec<&str> = got.mods.iter().map(|m| m.id.as_str()).collect();
+        assert_eq!(ids, ["cogwork"]);
+    }
+
+    #[test]
+    fn mod_json_reads_are_capped() {
+        let run = |fut| {
+            tokio::runtime::Builder::new_current_thread()
+                .build()
+                .unwrap()
+                .block_on(fut)
+        };
+        let response = |body: Vec<u8>| reqwest::Response::from(http_response(body));
+        assert_eq!(
+            run(read_capped(response(vec![b'x'; 10]), 10))
+                .unwrap()
+                .unwrap()
+                .len(),
+            10
+        );
+        assert!(
+            run(read_capped(response(vec![b'x'; 11]), 10))
+                .unwrap()
+                .is_none()
+        );
+    }
+
+    fn http_response(body: Vec<u8>) -> ::http::Response<Vec<u8>> {
+        ::http::Response::builder().status(200).body(body).unwrap()
+    }
+}
diff --git a/src-tauri/src/mods/store.rs b/src-tauri/src/mods/store.rs
new file mode 100644
index 0000000..2fcdfed
--- /dev/null
+++ b/src-tauri/src/mods/store.rs
@@ -0,0 +1,745 @@
+//! The files behind the mod sets: `mods/store/<sha256>.zip` holds every verified mod once, each
+//! profile's `mods.lock.json` lists what is installed, and the profile's `mods/` folder holds
+//! exactly the turned-on mods, each as its own copy of the store file (never a hard link, so a
+//! write to one can't reach the store or another version). A mod that is off is not in that folder at all: the engine runs
+//! code even from mods it was told to skip, so leaving the file out is the only real "off".
+//!
+//! [`admit`] is the one way into the store: it hashes the file, checks the zip and the platform.
+//! The callers hold `ModsLock` whenever they write a lock file or delete from the store.
+
+use std::collections::{HashMap, HashSet};
+use std::path::{Path, PathBuf};
+use std::sync::{Arc, Mutex};
+
+use serde::{Deserialize, Serialize};
+
+use super::archive::{self, ArchiveInfo};
+use super::error::ModsError;
+use super::index::{Platform, is_mod_id, is_sha256};
+use super::paths::{LOCK_FILE, Paths, REMOVED_FILE, unique_suffix, write_atomic};
+use super::profile::{Lock, LockEntry};
+use crate::download::sha256_file;
+
+pub fn read_lock(paths: &Paths, tag: &str) -> Result<Lock, ModsError> {
+    read_lock_file(&paths.lock_file(tag)?)
+}
+
+/// A lock file names files and folders by its ids and hashes, so they are checked before use:
+/// a damaged or hand-edited file is an error, never a path.
+fn check_lock(lock: &Lock) -> Result<(), ModsError> {
+    if lock.schema > 1 {
+        return Err(ModsError::LockInvalid(format!(
+            "schema {} is from a newer launcher",
+            lock.schema
+        )));
+    }
+    for m in &lock.mods {
+        if !is_mod_id(&m.id) {
+            return Err(ModsError::LockInvalid(format!("mod id {:?}", m.id)));
+        }
+        if !is_sha256(&m.sha256) {
+            return Err(ModsError::LockInvalid(format!("sha256 of {}", m.id)));
+        }
+    }
+    Ok(())
+}
+
+fn read_lock_file(path: &Path) -> Result<Lock, ModsError> {
+    match std::fs::read(path) {
+        Ok(bytes) => {
+            let lock: Lock = serde_json::from_slice(&bytes)
+                .map_err(|e| ModsError::LockInvalid(e.to_string()))?;
+            check_lock(&lock)?;
+            Ok(lock)
+        }
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(Lock::empty()),
+        Err(e) => Err(e.into()),
+    }
+}
+
+/// The mod most recently removed from a version, kept so the removal can be undone. Its store
+/// file is kept until the version's next change.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct Removed {
+    pub entry: LockEntry,
+    /// Mods the removal turned off because they needed it.
+    #[serde(default)]
+    pub also_disabled: Vec<String>,
+}
+
+fn read_removed_file(path: &Path) -> Option<Removed> {
+    let removed: Removed = serde_json::from_slice(&std::fs::read(path).ok()?).ok()?;
+    (is_mod_id(&removed.entry.id) && is_sha256(&removed.entry.sha256)).then_some(removed)
+}
+
+pub fn read_removed(paths: &Paths, tag: &str) -> Result<Option<Removed>, ModsError> {
+    Ok(read_removed_file(&paths.removed_file(tag)?))
+}
+
+pub fn write_removed(paths: &Paths, tag: &str, removed: &Removed) -> Result<(), ModsError> {
+    write_atomic(
+        &paths.removed_file(tag)?,
+        &serde_json::to_vec_pretty(removed)?,
+    )
+}
+
+/// The version changed again: its last removal can't be undone any more.
+pub fn clear_removed(paths: &Paths, tag: &str) -> Result<(), ModsError> {
+    match std::fs::remove_file(paths.removed_file(tag)?) {
+        Err(e) if e.kind() != std::io::ErrorKind::NotFound => Err(e.into()),
+        _ => Ok(()),
+    }
+}
+
+pub fn write_lock(paths: &Paths, tag: &str, lock: &Lock) -> Result<(), ModsError> {
+    write_atomic(&paths.lock_file(tag)?, &serde_json::to_vec_pretty(lock)?)
+}
+
+/// A copy of `from` at `to`, written beside it and renamed into place. `std::fs::copy` clones
+/// the data where the system can (`clonefile` on APFS, `copy_file_range` on Linux, which
+/// reflinks on Btrfs and XFS); either way the result is a file of its own.
+fn copy_into(from: &Path, to: &Path) -> std::io::Result<()> {
+    let tmp = to.with_file_name(format!(
+        ".{}.{}.part",
+        to.file_name().unwrap_or_default().to_string_lossy(),
+        unique_suffix()
+    ));
+    let result = std::fs::copy(from, &tmp).and_then(|_| std::fs::rename(&tmp, to));
+    if result.is_err() {
+        let _ = std::fs::remove_file(&tmp);
+    }
+    result
+}
+
+/// Makes the profile's `mods/` hold exactly the turned-on mods, each with the bytes that were
+/// verified at install. A file changed since then is replaced from the store; a changed store
+/// file is an error, never handed to the game.
+///
+/// Idempotent, and safe to interrupt: it works out what to do from the lock and the folder as
+/// they are, never from what an earlier run meant to do, and every copy is written beside its
+/// target and renamed into place, so a crash leaves at worst a `.part` file (removed by the next
+/// run, like any name the lock doesn't have) and some mods not yet copied. Every save runs it,
+/// and so does every launch (`service::prepare_launch`, under `ModsLock`), so the folder the
+/// game reads is put right before each start whatever happened before.
+///
+/// Every turned-on file is hashed on every run: one read of each per save and per launch (at
+/// most [`archive::MAX_FILE_BYTES`] a mod). Size and modification time are not trusted in its place: the
+/// folder is the player's to touch, and only the hash says the bytes are the ones checked.
+pub fn reconcile(paths: &Paths, tag: &str, lock: &Lock) -> Result<(), ModsError> {
+    let dir = paths.mods_dir(tag)?;
+    std::fs::create_dir_all(&dir)?;
+    let wanted: Vec<_> = lock.mods.iter().filter(|m| m.enabled).collect();
+
+    for entry in std::fs::read_dir(&dir)?.flatten() {
+        let name = entry.file_name().to_string_lossy().to_string();
+        if !wanted.iter().any(|m| format!("{}.zip", m.id) == name) {
+            let path = entry.path();
+            if path.is_dir() {
+                std::fs::remove_dir_all(&path)?;
+            } else {
+                std::fs::remove_file(&path)?;
+            }
+        }
+    }
+
+    for m in wanted {
+        let target = dir.join(format!("{}.zip", m.id));
+        if target.exists() && sha256_file(&target)? == m.sha256 {
+            continue;
+        }
+        let _ = std::fs::remove_file(&target);
+        let stored = paths.store_object(&m.sha256);
+        if !stored.exists() {
+            return Err(ModsError::StoreMissing(m.id.clone()));
+        }
+        let actual = sha256_file(&stored)?;
+        if actual != m.sha256 {
+            return Err(ModsError::Sha256Mismatch {
+                expected: m.sha256.clone(),
+                actual,
+            });
+        }
+        copy_into(&stored, &target)?;
+    }
+    Ok(())
+}
+
+/// Store objects an install is still working on: downloading, checking, or written to the store
+/// but not yet to a lock file. Garbage collection leaves these alone.
+#[derive(Default, Clone)]
+pub struct Reservations(Arc<Mutex<HashMap<String, usize>>>);
+
+/// Holds a store object until dropped.
+pub struct Reservation {
+    owner: Reservations,
+    sha256: String,
+}
+
+impl Reservations {
+    pub fn reserve(&self, sha256: &str) -> Reservation {
+        *self
+            .0
+            .lock()
+            .unwrap()
+            .entry(sha256.to_string())
+            .or_default() += 1;
+        Reservation {
+            owner: self.clone(),
+            sha256: sha256.to_string(),
+        }
+    }
+
+    pub fn held(&self) -> HashSet<String> {
+        self.0.lock().unwrap().keys().cloned().collect()
+    }
+}
+
+impl Drop for Reservation {
+    fn drop(&mut self) {
+        let mut map = self.owner.0.lock().unwrap();
+        if let Some(n) = map.get_mut(&self.sha256) {
+            *n -= 1;
+            if *n == 0 {
+                map.remove(&self.sha256);
+            }
+        }
+    }
+}
+
+/// Deletes stored files no profile uses and no install holds. If any lock file can't be read,
+/// nothing is deleted: a mod set that can't be read must not lose its files.
+pub fn collect_garbage(paths: &Paths, reservations: &Reservations) -> Result<usize, ModsError> {
+    // Reservations first: an install releases its hold only after its lock file is written, so
+    // whatever isn't held any more is in a lock file read below.
+    let mut keep = reservations.held();
+    match std::fs::read_dir(paths.profiles_dir()) {
+        Ok(entries) => {
+            for entry in entries.flatten() {
+                if !entry.path().is_dir() {
+                    continue;
+                }
+                let lock = read_lock_file(&entry.path().join(LOCK_FILE))?;
+                keep.extend(lock.mods.into_iter().map(|m| m.sha256));
+                if let Some(removed) = read_removed_file(&entry.path().join(REMOVED_FILE)) {
+                    keep.insert(removed.entry.sha256);
+                }
+            }
+        }
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+        Err(e) => return Err(e.into()),
+    }
+    let mut removed = 0;
+    let Ok(entries) = std::fs::read_dir(paths.store_dir()) else {
+        return Ok(0);
+    };
+    for entry in entries.flatten() {
+        let name = entry.file_name().to_string_lossy().to_string();
+        let Some(sha) = name.strip_suffix(".zip").filter(|s| is_sha256(s)) else {
+            continue;
+        };
+        if !keep.contains(sha) && std::fs::remove_file(entry.path()).is_ok() {
+            removed += 1;
+        }
+    }
+    Ok(removed)
+}
+
+/// A deleted game version takes its mod set along. The caller holds `ModsLock`.
+pub fn forget_version(paths: &Paths, reservations: &Reservations, tag: &str) {
+    if let Ok(dir) = paths.profile_dir(tag) {
+        let _ = std::fs::remove_dir_all(dir);
+    }
+    if let Err(e) = collect_garbage(paths, reservations) {
+        eprintln!("mods: garbage collection skipped: {e}");
+    }
+}
+
+/// A new file in `downloads/` that no other download uses.
+pub fn temp_path(paths: &Paths, sha256: &str) -> Result<PathBuf, ModsError> {
+    let dir = paths.downloads_dir();
+    std::fs::create_dir_all(&dir)?;
+    Ok(dir.join(format!("mod-{sha256}-{}.part", unique_suffix())))
+}
+
+/// What every file in the store passed: its bytes hash to `sha256`, it is a mod zip (of mod `id`,
+/// when given), and it has a library for `platform`.
+fn check(
+    path: &Path,
+    sha256: &str,
+    id: Option<&str>,
+    platform: Option<Platform>,
+) -> Result<ArchiveInfo, ModsError> {
+    let actual = sha256_file(path)?;
+    if actual != sha256 {
+        return Err(ModsError::Sha256Mismatch {
+            expected: sha256.to_string(),
+            actual,
+        });
+    }
+    let info = archive::inspect(std::fs::File::open(path)?, id)?;
+    if !platform.is_some_and(|p| info.platforms.contains(&p)) {
+        return Err(ModsError::NotForPlatform(info.id));
+    }
+    Ok(info)
+}
+
+/// Checks a downloaded or copied file (see [`check`]) and moves it into the store under its
+/// hash. The temporary file is gone afterwards, either way.
+pub fn admit(
+    paths: &Paths,
+    tmp: &Path,
+    sha256: &str,
+    id: Option<&str>,
+    platform: Option<Platform>,
+) -> Result<ArchiveInfo, ModsError> {
+    let result = (|| {
+        let info = check(tmp, sha256, id, platform)?;
+        // Opened for writing: Windows only flushes a file through a handle that may write to it.
+        std::fs::OpenOptions::new()
+            .write(true)
+            .open(tmp)?
+            .sync_all()?;
+        std::fs::create_dir_all(paths.store_dir())?;
+        std::fs::rename(tmp, paths.store_object(sha256))?;
+        // As every other write: the rename itself survives a power cut, so a lock that names
+        // this object never outlives it.
+        super::paths::sync_dir(Some(&paths.store_dir()));
+        Ok(info)
+    })();
+    if result.is_err() {
+        let _ = std::fs::remove_file(tmp);
+    }
+    result
+}
+
+/// The same checks for a build the store already has. `None` when it has none, or only a
+/// damaged copy, which a fresh download then replaces (deleting is left to garbage collection,
+/// under `ModsLock`); an error when the stored bytes are right but aren't a mod that fits here.
+pub fn admit_stored(
+    paths: &Paths,
+    sha256: &str,
+    id: Option<&str>,
+    platform: Option<Platform>,
+) -> Result<Option<ArchiveInfo>, ModsError> {
+    let stored = paths.store_object(sha256);
+    if !stored.exists() {
+        return Ok(None);
+    }
+    match check(&stored, sha256, id, platform) {
+        Ok(info) => Ok(Some(info)),
+        Err(ModsError::Sha256Mismatch { .. }) => Ok(None),
+        Err(e) => Err(e),
+    }
+}
+
+/// Copies a file from the player's computer into the store, refusing it if its bytes are not the
+/// ones that were inspected. Only a regular file, and no more than [`archive::MAX_FILE_BYTES`]
+/// is read, even from a file that grows meanwhile.
+pub fn admit_local(
+    paths: &Paths,
+    source: &Path,
+    sha256: &str,
+    id: Option<&str>,
+    platform: Option<Platform>,
+) -> Result<ArchiveInfo, ModsError> {
+    super::inspect::checked_size(source)?;
+    let tmp = temp_path(paths, sha256)?;
+    let copied = (|| -> Result<(), ModsError> {
+        use std::io::Read;
+        let max = archive::MAX_FILE_BYTES;
+        let mut from = std::fs::File::open(source)?.take(max + 1);
+        let mut to = std::fs::File::create(&tmp)?;
+        if std::io::copy(&mut from, &mut to)? > max {
+            return Err(ModsError::TooLarge("larger than 512 MB".into()));
+        }
+        Ok(())
+    })();
+    if let Err(e) = copied {
+        let _ = std::fs::remove_file(&tmp);
+        return Err(e);
+    }
+    admit(paths, &tmp, sha256, id, platform).map_err(|e| match e {
+        ModsError::Sha256Mismatch { .. } => ModsError::FileChanged,
+        e => e,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::super::archive::tests::make_zip;
+    use super::super::profile::tests::{ABI, entry, lock};
+    use super::*;
+    use crate::download::sha256_hex;
+
+    fn setup() -> (tempfile::TempDir, Paths) {
+        let tmp = tempfile::tempdir().unwrap();
+        let paths = Paths::new(tmp.path());
+        (tmp, paths)
+    }
+
+    /// Stores `bytes` and returns their hash.
+    fn store(paths: &Paths, bytes: &[u8]) -> String {
+        let sha = sha256_hex(bytes);
+        std::fs::create_dir_all(paths.store_dir()).unwrap();
+        std::fs::write(paths.store_object(&sha), bytes).unwrap();
+        sha
+    }
+
+    fn installed(id: &str, sha: &str, enabled: bool) -> super::super::profile::LockEntry {
+        let mut e = entry(id, &[], Some(ABI));
+        e.sha256 = sha.to_string();
+        e.enabled = enabled;
+        e
+    }
+
+    #[test]
+    fn reconcile_keeps_only_turned_on_mods() {
+        let (_tmp, paths) = setup();
+        let a = store(&paths, b"mod a");
+        let b = store(&paths, b"mod b");
+        let l = lock(vec![installed("a", &a, true), installed("b", &b, false)]);
+        let dir = paths.mods_dir("v1").unwrap();
+        std::fs::create_dir_all(&dir).unwrap();
+        std::fs::write(dir.join("stray.zip"), b"x").unwrap();
+        std::fs::write(dir.join("b.zip"), b"mod b").unwrap();
+
+        reconcile(&paths, "v1", &l).unwrap();
+        let mut names: Vec<String> = std::fs::read_dir(&dir)
+            .unwrap()
+            .map(|e| e.unwrap().file_name().to_string_lossy().to_string())
+            .collect();
+        names.sort();
+        assert_eq!(names, ["a.zip"], "a mod that is off is absent");
+        assert_eq!(std::fs::read(dir.join("a.zip")).unwrap(), b"mod a");
+
+        // A changed copy in the profile is put back from the store.
+        std::fs::remove_file(dir.join("a.zip")).unwrap();
+        std::fs::write(dir.join("a.zip"), b"tampered").unwrap();
+        reconcile(&paths, "v1", &l).unwrap();
+        assert_eq!(std::fs::read(dir.join("a.zip")).unwrap(), b"mod a");
+    }
+
+    /// A reconcile that stopped partway (a crash, a full disk) is finished by the next one, and a
+    /// reconcile with nothing to do changes nothing.
+    #[test]
+    fn an_interrupted_reconcile_is_finished_by_the_next() {
+        let (_tmp, paths) = setup();
+        let a = store(&paths, b"mod a");
+        let b = store(&paths, b"mod b");
+        let c = store(&paths, b"mod c");
+        let l = lock(vec![
+            installed("a", &a, true),
+            installed("b", &b, true),
+            installed("c", &c, false),
+        ]);
+        let dir = paths.mods_dir("v1").unwrap();
+        std::fs::create_dir_all(&dir).unwrap();
+        // As a run that died left it: a copy half written beside its target, the mod that was
+        // turned off not yet taken away, one mod not copied at all, and one already right.
+        std::fs::write(dir.join(".b.zip.123-4.part"), b"mod").unwrap();
+        std::fs::write(dir.join("c.zip"), b"mod c").unwrap();
+        std::fs::write(dir.join("a.zip"), b"mod a").unwrap();
+
+        reconcile(&paths, "v1", &l).unwrap();
+        let listing = || {
+            let mut names: Vec<(String, Vec<u8>)> = std::fs::read_dir(&dir)
+                .unwrap()
+                .map(|e| {
+                    let e = e.unwrap();
+                    (
+                        e.file_name().to_string_lossy().to_string(),
+                        std::fs::read(e.path()).unwrap(),
+                    )
+                })
+                .collect();
+            names.sort();
+            names
+        };
+        let after = listing();
+        assert_eq!(
+            after,
+            [
+                ("a.zip".to_string(), b"mod a".to_vec()),
+                ("b.zip".to_string(), b"mod b".to_vec())
+            ]
+        );
+        let modified = std::fs::metadata(dir.join("a.zip"))
+            .unwrap()
+            .modified()
+            .unwrap();
+
+        reconcile(&paths, "v1", &l).unwrap();
+        assert_eq!(listing(), after, "again: the same folder");
+        assert_eq!(
+            std::fs::metadata(dir.join("a.zip"))
+                .unwrap()
+                .modified()
+                .unwrap(),
+            modified,
+            "a right copy is left alone, not written again"
+        );
+    }
+
+    /// Contract R4 §7: a version's folder holds copies. Writing into one in place reaches
+    /// neither the store nor another version, and the next reconcile puts it right.
+    #[test]
+    fn profiles_hold_copies_not_links() {
+        use std::io::Write;
+        let (_tmp, paths) = setup();
+        let a = store(&paths, b"mod a");
+        let l = lock(vec![installed("a", &a, true)]);
+        reconcile(&paths, "v1", &l).unwrap();
+        reconcile(&paths, "v2", &l).unwrap();
+        let in_v1 = paths.mods_dir("v1").unwrap().join("a.zip");
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::MetadataExt;
+            assert_eq!(std::fs::metadata(&in_v1).unwrap().nlink(), 1);
+            assert_eq!(
+                std::fs::metadata(paths.store_object(&a)).unwrap().nlink(),
+                1
+            );
+        }
+        let mut f = std::fs::OpenOptions::new()
+            .write(true)
+            .open(&in_v1)
+            .unwrap();
+        f.write_all(b"evil!").unwrap();
+        drop(f);
+        assert_eq!(std::fs::read(paths.store_object(&a)).unwrap(), b"mod a");
+        let in_v2 = paths.mods_dir("v2").unwrap().join("a.zip");
+        assert_eq!(std::fs::read(&in_v2).unwrap(), b"mod a");
+
+        reconcile(&paths, "v1", &l).unwrap();
+        assert_eq!(std::fs::read(&in_v1).unwrap(), b"mod a");
+        let names: Vec<String> = std::fs::read_dir(paths.mods_dir("v1").unwrap())
+            .unwrap()
+            .map(|e| e.unwrap().file_name().to_string_lossy().to_string())
+            .collect();
+        assert_eq!(names, ["a.zip"], "no temporary file is left");
+    }
+
+    #[test]
+    fn reconcile_refuses_a_changed_store_file() {
+        let (_tmp, paths) = setup();
+        let a = store(&paths, b"mod a");
+        std::fs::write(paths.store_object(&a), b"changed").unwrap();
+        let l = lock(vec![installed("a", &a, true)]);
+        assert!(matches!(
+            reconcile(&paths, "v1", &l),
+            Err(ModsError::Sha256Mismatch { .. })
+        ));
+        assert!(!paths.mods_dir("v1").unwrap().join("a.zip").exists());
+    }
+
+    #[test]
+    fn garbage_collection_is_careful() {
+        let (_tmp, paths) = setup();
+        let reservations = Reservations::default();
+        let used = store(&paths, b"used");
+        let unused = store(&paths, b"unused");
+        let in_flight = store(&paths, b"in flight");
+        write_lock(&paths, "v1", &lock(vec![installed("a", &used, false)])).unwrap();
+
+        let hold = reservations.reserve(&in_flight);
+        assert_eq!(collect_garbage(&paths, &reservations).unwrap(), 1);
+        assert!(paths.store_object(&used).exists());
+        assert!(!paths.store_object(&unused).exists());
+        assert!(
+            paths.store_object(&in_flight).exists(),
+            "held by an install"
+        );
+
+        drop(hold);
+        assert!(reservations.held().is_empty());
+
+        // One unreadable lock file: nothing at all is deleted.
+        let dir = paths.profile_dir("v2").unwrap();
+        std::fs::create_dir_all(&dir).unwrap();
+        std::fs::write(dir.join(LOCK_FILE), b"{ not json").unwrap();
+        assert!(collect_garbage(&paths, &reservations).is_err());
+        assert!(paths.store_object(&in_flight).exists());
+
+        std::fs::remove_dir_all(&dir).unwrap();
+        assert_eq!(collect_garbage(&paths, &reservations).unwrap(), 1);
+        assert!(paths.store_object(&used).exists());
+    }
+
+    #[test]
+    fn reservations_count() {
+        let r = Reservations::default();
+        let a = r.reserve("x");
+        let b = r.reserve("x");
+        drop(a);
+        assert!(r.held().contains("x"));
+        drop(b);
+        assert!(r.held().is_empty());
+    }
+
+    #[test]
+    fn temporary_files_never_collide() {
+        let (_tmp, paths) = setup();
+        let sha = "a".repeat(64);
+        assert_ne!(
+            temp_path(&paths, &sha).unwrap(),
+            temp_path(&paths, &sha).unwrap()
+        );
+    }
+
+    #[test]
+    fn admitting_checks_the_file() {
+        let (tmp, paths) = setup();
+        let linux = Some(Platform::LinuxX64);
+        let zip = make_zip(&[("libcogwork.so", b"elf")]);
+        let sha = sha256_hex(&zip);
+        let source = tmp.path().join("cogwork.zip");
+        std::fs::write(&source, &zip).unwrap();
+
+        assert!(matches!(
+            admit_local(&paths, &source, &"0".repeat(64), None, linux),
+            Err(ModsError::FileChanged)
+        ));
+        assert!(matches!(
+            admit_local(&paths, &source, &sha, None, Some(Platform::WindowsX64)),
+            Err(ModsError::NotForPlatform(_))
+        ));
+        assert!(matches!(
+            admit_local(&paths, &source, &sha, Some("structures"), linux),
+            Err(ModsError::ArchiveInvalid(_))
+        ));
+        let info = admit_local(&paths, &source, &sha, Some("cogwork"), linux).unwrap();
+        assert_eq!(info.id, "cogwork");
+        assert_eq!(std::fs::read(paths.store_object(&sha)).unwrap(), zip);
+        let leftovers = std::fs::read_dir(paths.downloads_dir()).unwrap().count();
+        assert_eq!(leftovers, 0, "no temporary file is left behind");
+    }
+
+    /// The store checks what it already has too: right bytes for another mod or system are
+    /// refused, and a damaged copy counts as missing, so it is fetched again and replaced.
+    #[test]
+    fn a_stored_file_is_checked_again() {
+        let (_tmp, paths) = setup();
+        let linux = Some(Platform::LinuxX64);
+        let zip = make_zip(&[("libcogwork.so", b"elf")]);
+        let sha = store(&paths, &zip);
+        assert_eq!(
+            admit_stored(&paths, &sha, Some("cogwork"), linux)
+                .unwrap()
+                .unwrap()
+                .id,
+            "cogwork"
+        );
+        assert!(matches!(
+            admit_stored(&paths, &sha, Some("structures"), linux),
+            Err(ModsError::ArchiveInvalid(_))
+        ));
+        assert!(matches!(
+            admit_stored(&paths, &sha, Some("cogwork"), Some(Platform::WindowsX64)),
+            Err(ModsError::NotForPlatform(_))
+        ));
+        assert!(
+            admit_stored(&paths, &"0".repeat(64), Some("cogwork"), linux)
+                .unwrap()
+                .is_none()
+        );
+
+        std::fs::write(paths.store_object(&sha), b"damaged").unwrap();
+        assert!(
+            admit_stored(&paths, &sha, Some("cogwork"), linux)
+                .unwrap()
+                .is_none()
+        );
+        let fresh = paths.downloads_dir().join("fresh.part");
+        std::fs::create_dir_all(paths.downloads_dir()).unwrap();
+        std::fs::write(&fresh, &zip).unwrap();
+        admit(&paths, &fresh, &sha, Some("cogwork"), linux).unwrap();
+        assert_eq!(
+            std::fs::read(paths.store_object(&sha)).unwrap(),
+            zip,
+            "replaced"
+        );
+    }
+
+    #[test]
+    fn admitting_hashes_the_file_itself() {
+        let (tmp, paths) = setup();
+        let zip = make_zip(&[("libcogwork.so", b"elf")]);
+        let file = tmp.path().join("x.part");
+        std::fs::write(&file, &zip).unwrap();
+        let claimed = sha256_hex(b"something else");
+        assert!(matches!(
+            admit(
+                &paths,
+                &file,
+                &claimed,
+                Some("cogwork"),
+                Some(Platform::LinuxX64)
+            ),
+            Err(ModsError::Sha256Mismatch { .. })
+        ));
+        assert!(!file.exists() && !paths.store_object(&claimed).exists());
+    }
+
+    #[test]
+    fn a_removed_mod_keeps_its_file_until_the_next_change() {
+        let (_tmp, paths) = setup();
+        let a = store(&paths, b"a");
+        write_lock(&paths, "v1", &lock(vec![])).unwrap();
+        let removed = Removed {
+            entry: installed("a", &a, true),
+            also_disabled: vec![],
+        };
+        write_removed(&paths, "v1", &removed).unwrap();
+        assert_eq!(
+            collect_garbage(&paths, &Reservations::default()).unwrap(),
+            0
+        );
+        assert_eq!(read_removed(&paths, "v1").unwrap().unwrap().entry.id, "a");
+
+        clear_removed(&paths, "v1").unwrap();
+        clear_removed(&paths, "v1").unwrap();
+        assert!(read_removed(&paths, "v1").unwrap().is_none());
+        assert_eq!(
+            collect_garbage(&paths, &Reservations::default()).unwrap(),
+            1
+        );
+    }
+
+    #[test]
+    fn a_damaged_lock_file_is_refused() {
+        let (_tmp, paths) = setup();
+        let mut bad = lock(vec![installed("a", &"a".repeat(64), true)]);
+        bad.mods[0].id = "../../evil".into();
+        write_lock(&paths, "v1", &bad).unwrap();
+        assert!(matches!(
+            read_lock(&paths, "v1"),
+            Err(ModsError::LockInvalid(_))
+        ));
+
+        let bad = lock(vec![installed("a", "../x", true)]);
+        write_lock(&paths, "v1", &bad).unwrap();
+        assert!(matches!(
+            read_lock(&paths, "v1"),
+            Err(ModsError::LockInvalid(_))
+        ));
+
+        let mut newer = lock(vec![]);
+        newer.schema = 2;
+        write_lock(&paths, "v1", &newer).unwrap();
+        assert!(matches!(
+            read_lock(&paths, "v1"),
+            Err(ModsError::LockInvalid(_))
+        ));
+    }
+
+    #[test]
+    fn forgetting_a_version_frees_its_files() {
+        let (_tmp, paths) = setup();
+        let a = store(&paths, b"a");
+        write_lock(&paths, "v1", &lock(vec![installed("a", &a, true)])).unwrap();
+        forget_version(&paths, &Reservations::default(), "v1");
+        assert!(!paths.profile_dir("v1").unwrap().exists());
+        assert!(!paths.store_object(&a).exists());
+    }
+}
diff --git a/src-tauri/src/mods/testdata/index-older.json b/src-tauri/src/mods/testdata/index-older.json
new file mode 100644
index 0000000..1fbb499
--- /dev/null
+++ b/src-tauri/src/mods/testdata/index-older.json
@@ -0,0 +1 @@
+{"schema":1,"generated":"2026-11-01T00:00:00Z","weft":[{"tag":"v26.11.1","commit":"ff9c7128511fc0dce7719b67c9a59274d70bdd5a","abi":"f470b1cbb1f9ad91"}],"mods":[{"id":"cogwork","name":"Cogwork","summary":"Gears","authors":["Zorro909"],"license":null,"homepage":null,"icon":null,"versions":[{"version":"0.2.0","channel":"release","tag":"cogwork-v0.2.0","published":"2026-11-04T00:00:00Z","source":{"repo":"Zorro909/weft-mods","commit":"cceea7805df5902d62017d2008d1bb29ed84e152"},"weft":{"tag":"v26.11.1","commit":"ff9c7128511fc0dce7719b67c9a59274d70bdd5a","abi":"f470b1cbb1f9ad91"},"deps":[{"id":"base"}],"platforms":["windows-x64","linux-x64","macos-arm64"],"asset":{"name":"cogwork.zip","url":"https://github.com/Zorro909/weft-mods/releases/download/cogwork-v0.2.0/cogwork.zip","size":2642469,"sha256":"989b2191aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"},"provenance":null,"reviewed":{"by":"Zorro909","at":"2026-11-04"}}]}],"revoked":[]}
diff --git a/src-tauri/src/mods/testdata/index-older.json.minisig b/src-tauri/src/mods/testdata/index-older.json.minisig
new file mode 100644
index 0000000..b6bd163
--- /dev/null
+++ b/src-tauri/src/mods/testdata/index-older.json.minisig
@@ -0,0 +1,4 @@
+untrusted comment: signature from minisign secret key
+RUR87y/Jcn346suBC8b4+krn9FKYGJX1JwggxKtJx4Y+bo43FI3aypRzUDVkJnBMNX6/p6usTP4GYc5LAVo7+p0M3l6h6CUf6g0=
+trusted comment: timestamp:1793491500 file:index.json
+DiOOUAMLrN3rIAKw1qBrRPIk6GzrgzfYLmoNRCZnU/hRIQF7SqGCp5EhTBDIO/67ZX8MjI8INurP/ELV7T/WAA==
diff --git a/src-tauri/src/mods/testdata/index.json b/src-tauri/src/mods/testdata/index.json
new file mode 100644
index 0000000..4356eca
--- /dev/null
+++ b/src-tauri/src/mods/testdata/index.json
@@ -0,0 +1 @@
+{"schema":1,"generated":"2026-11-04T18:00:00Z","weft":[{"tag":"v26.11.1","commit":"ff9c7128511fc0dce7719b67c9a59274d70bdd5a","abi":"f470b1cbb1f9ad91"}],"mods":[{"id":"cogwork","name":"Cogwork","summary":"Gears","authors":["Zorro909"],"license":null,"homepage":null,"icon":null,"versions":[{"version":"0.2.0","channel":"release","tag":"cogwork-v0.2.0","published":"2026-11-04T00:00:00Z","source":{"repo":"Zorro909/weft-mods","commit":"cceea7805df5902d62017d2008d1bb29ed84e152"},"weft":{"tag":"v26.11.1","commit":"ff9c7128511fc0dce7719b67c9a59274d70bdd5a","abi":"f470b1cbb1f9ad91"},"deps":[{"id":"base"}],"platforms":["windows-x64","linux-x64","macos-arm64"],"asset":{"name":"cogwork.zip","url":"https://github.com/Zorro909/weft-mods/releases/download/cogwork-v0.2.0/cogwork.zip","size":2642469,"sha256":"989b2191aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"},"provenance":null,"reviewed":{"by":"Zorro909","at":"2026-11-04"}}]}],"revoked":[]}
diff --git a/src-tauri/src/mods/testdata/index.json.minisig b/src-tauri/src/mods/testdata/index.json.minisig
new file mode 100644
index 0000000..4c74451
--- /dev/null
+++ b/src-tauri/src/mods/testdata/index.json.minisig
@@ -0,0 +1,4 @@
+untrusted comment: signature from minisign secret key
+RUR87y/Jcn346ofVrC9aY6WKGkDKqRWq2NdHMnrBgJ7SjX9omCxk7nEdvIAZ9p0wNbVgLmrOh9/d64qW0O9kf2iahSMt+m2PNgk=
+trusted comment: timestamp:1793815500 file:index.json
+r6NABTl1RS/DrHNf/hKcoJgrV50D94sWCoNpRJIVbdsHE9WnLr4gK/VRwkA1pqFy4wrr0nBf7JxlLZzuoe4CDQ==
diff --git a/src-tauri/src/mods/testdata/index.json.resigned.minisig b/src-tauri/src/mods/testdata/index.json.resigned.minisig
new file mode 100644
index 0000000..33d6314
--- /dev/null
+++ b/src-tauri/src/mods/testdata/index.json.resigned.minisig
@@ -0,0 +1,4 @@
+untrusted comment: signature from minisign secret key
+RUR87y/Jcn346ofVrC9aY6WKGkDKqRWq2NdHMnrBgJ7SjX9omCxk7nEdvIAZ9p0wNbVgLmrOh9/d64qW0O9kf2iahSMt+m2PNgk=
+trusted comment: timestamp:1794420000 file:index.json
+ly/2Z83CHYqjFOVH4SqeD0Kv+Ulx+0N10rKNqzi1DmQp10+1CkypZbGKu/f2aG27I/I2qAp5GSt6Mc0xJxvJAg==
diff --git a/src-tauri/src/mods/testdata/published-index.json b/src-tauri/src/mods/testdata/published-index.json
new file mode 100644
index 0000000..6501578
--- /dev/null
+++ b/src-tauri/src/mods/testdata/published-index.json
@@ -0,0 +1,922 @@
+{
+  "schema": 1,
+  "generated": "2026-11-04T19:04:11Z",
+  "weft": [
+    {
+      "tag": "v26.11.1",
+      "commit": "ff9c7128511fc0dce7719b67c9a59274d70bdd5a",
+      "abi": "f470b1cbb1f9ad91"
+    },
+    {
+      "tag": "v26.10.4",
+      "commit": "34fa22b1b6546aa8a8d3d12252bd7a5b01dbb0ec",
+      "abi": "5f0569a6bea71b81"
+    },
+    {
+      "tag": "v26.10.3",
+      "commit": "7e32b4217b6ada9ae6567845256caf42d203fdeb",
+      "abi": "0c4348eac3c90c5c"
+    },
+    {
+      "tag": "v26.10.2",
+      "commit": "23d2a3b5fa95a674c993ae9f115851e8318c3c8c",
+      "abi": "7f70a596eee22b6f"
+    },
+    {
+      "tag": "v26.10.1",
+      "commit": "d444d448770c5648d452fe76ebe4e1166322d67e",
+      "abi": "7f70a596eee22b6f"
+    },
+    {
+      "tag": "v0.1.0",
+      "commit": "54a5829f3c25fc6975379f6421cd64c9d0e378b0",
+      "abi": "27b2fc40e2fd67eb"
+    }
+  ],
+  "mods": [
+    {
+      "id": "cogwork",
+      "name": "Cogwork",
+      "summary": "Gears, item tubes and engines, an excavator that digs out a whole area layer by layer…",
+      "authors": [
+        "Zorro909"
+      ],
+      "license": null,
+      "homepage": "https://github.com/Zorro909/weft-mods/tree/main/cogwork",
+      "icon": "https://raw.githubusercontent.com/Zorro909/weft-mods/514b2feb25af29f7dabbadfec36a3f24f4c8e6b2/cogwork/assets/textures/gui/icon.png",
+      "versions": [
+        {
+          "version": "0.2.1-rc.1",
+          "channel": "prerelease",
+          "tag": "cogwork-v0.2.1-rc.1",
+          "published": "2026-11-04T12:08:06Z",
+          "source": {
+            "repo": "Zorro909/weft-mods",
+            "commit": "514b2feb25af29f7dabbadfec36a3f24f4c8e6b2"
+          },
+          "weft": {
+            "tag": "v26.11.1",
+            "commit": "ff9c7128511fc0dce7719b67c9a59274d70bdd5a",
+            "abi": "f470b1cbb1f9ad91"
+          },
+          "deps": [
+            {
+              "id": "base"
+            }
+          ],
+          "platforms": [
+            "windows-x64",
+            "linux-x64",
+            "macos-arm64"
+          ],
+          "asset": {
+            "name": "cogwork.zip",
+            "url": "https://github.com/Zorro909/weft-mods/releases/download/cogwork-v0.2.1-rc.1/cogwork.zip",
+            "size": 3114153,
+            "sha256": "f4b03a760afa163167307b57dd8ff10e4443aef9a5fc5f26fe907982aa7b8d07"
+          },
+          "provenance": null,
+          "reviewed": {
+            "by": "Zorro909",
+            "at": "2026-11-04"
+          }
+        },
+        {
+          "version": "0.2.0",
+          "channel": "release",
+          "tag": "cogwork-v0.2.0",
+          "published": "2026-11-04T02:39:03Z",
+          "source": {
+            "repo": "Zorro909/weft-mods",
+            "commit": "cceea7805df5902d62017d2008d1bb29ed84e152"
+          },
+          "weft": {
+            "tag": "v26.11.1",
+            "commit": "ff9c7128511fc0dce7719b67c9a59274d70bdd5a",
+            "abi": "f470b1cbb1f9ad91"
+          },
+          "deps": [
+            {
+              "id": "base"
+            }
+          ],
+          "platforms": [
+            "windows-x64",
+            "linux-x64",
+            "macos-arm64"
+          ],
+          "asset": {
+            "name": "cogwork.zip",
+            "url": "https://github.com/Zorro909/weft-mods/releases/download/cogwork-v0.2.0/cogwork.zip",
+            "size": 2642469,
+            "sha256": "989b21912db1c53d06460cf7bbf9a979ce461c3fe197215124851a427bf7d20c"
+          },
+          "provenance": null,
+          "reviewed": {
+            "by": "Zorro909",
+            "at": "2026-11-04"
+          }
+        },
+        {
+          "version": "0.1.2-experimental.4563878.917596d",
+          "channel": "experimental",
+          "tag": "cogwork-v0.1.2-experimental.4563878.917596d",
+          "published": "2026-11-03T12:00:56Z",
+          "source": {
+            "repo": "Zorro909/weft-mods",
+            "commit": "8c2543e950d06004c66c49fab96b7ecce4e6343b"
+          },
+          "weft": {
+            "tag": "v26.11.1-46-g4563878",
+            "commit": "4563878b067425085701268f074f9483b2625e4c",
+            "abi": "5d449b795eda0099"
+          },
+          "deps": [
+            {
+              "id": "base"
+            }
+          ],
+          "platforms": [
+            "windows-x64",
+            "linux-x64",
+            "macos-arm64"
+          ],
+          "asset": {
+            "name": "cogwork.zip",
+            "url": "https://github.com/Zorro909/weft-mods/releases/download/cogwork-v0.1.2-experimental.4563878.917596d/cogwork.zip",
+            "size": 2591246,
+            "sha256": "322afb5a502472fe5bf05b41416f73d14c40e22794f71eea99063312406609ef"
+          },
+          "provenance": null,
+          "reviewed": {
+            "by": "Zorro909",
+            "at": "2026-11-04"
+          }
+        },
+        {
+          "version": "0.1.2-experimental.b5958a1.917596d",
+          "channel": "experimental",
+          "tag": "cogwork-v0.1.2-experimental.b5958a1.917596d",
+          "published": "2026-11-02T18:03:48Z",
+          "source": {
+            "repo": "Zorro909/weft-mods",
+            "commit": "917596da05afdf1fc87a4e20a20a6e6e427a5a86"
+          },
+          "weft": {
+            "tag": "v26.11.1-5-gb5958a1",
+            "commit": "b5958a15ba4f528cb349d7b8788e3892a18be091",
+            "abi": "d3dae6ede60ad004"
+          },
+          "deps": [
+            {
+              "id": "base"
+            }
+          ],
+          "platforms": [
+            "windows-x64",
+            "linux-x64",
+            "macos-arm64"
+          ],
+          "asset": {
+            "name": "cogwork.zip",
+            "url": "https://github.com/Zorro909/weft-mods/releases/download/cogwork-v0.1.2-experimental.b5958a1.917596d/cogwork.zip",
+            "size": 2589353,
+            "sha256": "fb1cff0624ad2b7f20b61186e27afab48b7f7cfef602f629646e986b1f1792ce"
+          },
+          "provenance": null,
+          "reviewed": {
+            "by": "Zorro909",
+            "at": "2026-11-04"
+          }
+        },
+        {
+          "version": "0.1.2",
+          "channel": "release",
+          "tag": "cogwork-v0.1.2",
+          "published": "2026-11-02T18:03:45Z",
+          "source": {
+            "repo": "Zorro909/weft-mods",
+            "commit": "917596da05afdf1fc87a4e20a20a6e6e427a5a86"
+          },
+          "weft": {
+            "tag": "v26.11.1",
+            "commit": "ff9c7128511fc0dce7719b67c9a59274d70bdd5a",
+            "abi": "f470b1cbb1f9ad91"
+          },
+          "deps": [
+            {
+              "id": "base"
+            }
+          ],
+          "platforms": [
+            "windows-x64",
+            "linux-x64",
+            "macos-arm64"
+          ],
+          "asset": {
+            "name": "cogwork.zip",
+            "url": "https://github.com/Zorro909/weft-mods/releases/download/cogwork-v0.1.2/cogwork.zip",
+            "size": 2586387,
+            "sha256": "cb39cecb64e22ab2a6e6cad761e131b42b7a57e055924776561e72ea87ba0db5"
+          },
+          "provenance": null,
+          "reviewed": {
+            "by": "Zorro909",
+            "at": "2026-11-04"
+          }
+        },
+        {
+          "version": "0.1.1",
+          "channel": "release",
+          "tag": "cogwork-v0.1.1",
+          "published": "2026-11-02T14:13:07Z",
+          "source": {
+            "repo": "Zorro909/weft-mods",
+            "commit": "5855730cc0a423eee7fd7e0a0eebb67bb8f355ac"
+          },
+          "weft": {
+            "tag": "v26.11.1",
+            "commit": "ff9c7128511fc0dce7719b67c9a59274d70bdd5a",
+            "abi": "f470b1cbb1f9ad91"
+          },
+          "deps": [
+            {
+              "id": "base"
+            }
+          ],
+          "platforms": [
+            "windows-x64",
+            "linux-x64",
+            "macos-arm64"
+          ],
+          "asset": {
+            "name": "cogwork.zip",
+            "url": "https://github.com/Zorro909/weft-mods/releases/download/cogwork-v0.1.1/cogwork.zip",
+            "size": 2585995,
+            "sha256": "a35711d9e0188c9e086ac55088283f754d0617f62b4c2a31bcddfe5deed0e65f"
+          },
+          "provenance": null,
+          "reviewed": {
+            "by": "Zorro909",
+            "at": "2026-11-04"
+          }
+        },
+        {
+          "version": "0.1.1-experimental.090722d.5855730",
+          "channel": "experimental",
+          "tag": "cogwork-v0.1.1-experimental.090722d.5855730",
+          "published": "2026-11-02T14:12:55Z",
+          "source": {
+            "repo": "Zorro909/weft-mods",
+            "commit": "5855730cc0a423eee7fd7e0a0eebb67bb8f355ac"
+          },
+          "weft": {
+            "tag": "v26.11.1-2-g090722d",
+            "commit": "090722d8954973e0badcd130446cbebbe0016181",
+            "abi": "f470b1cbb1f9ad91"
+          },
+          "deps": [
+            {
+              "id": "base"
+            }
+          ],
+          "platforms": [
+            "windows-x64",
+            "linux-x64",
+            "macos-arm64"
+          ],
+          "asset": {
+            "name": "cogwork.zip",
+            "url": "https://github.com/Zorro909/weft-mods/releases/download/cogwork-v0.1.1-experimental.090722d.5855730/cogwork.zip",
+            "size": 2585993,
+            "sha256": "98ae1eb863b47855576523529d3c34b004e9eecbc9fb8ec010ce62e2c53b597c"
+          },
+          "provenance": null,
+          "reviewed": {
+            "by": "Zorro909",
+            "at": "2026-11-04"
+          }
+        },
+        {
+          "version": "0.1.0-experimental.090722d.8da6d93",
+          "channel": "experimental",
+          "tag": "cogwork-v0.1.0-experimental.090722d.8da6d93",
+          "published": "2026-11-02T12:34:24Z",
+          "source": {
+            "repo": "Zorro909/weft-mods",
+            "commit": "66de7e3a57c8edb1c6da476948f7092527bdc5c2"
+          },
+          "weft": {
+            "tag": "v26.11.1-2-g090722d",
+            "commit": "090722d8954973e0badcd130446cbebbe0016181",
+            "abi": "f470b1cbb1f9ad91"
+          },
+          "deps": [
+            {
+              "id": "base"
+            }
+          ],
+          "platforms": [
+            "windows-x64",
+            "linux-x64",
+            "macos-arm64"
+          ],
+          "asset": {
+            "name": "cogwork.zip",
+            "url": "https://github.com/Zorro909/weft-mods/releases/download/cogwork-v0.1.0-experimental.090722d.8da6d93/cogwork.zip",
+            "size": 2586504,
+            "sha256": "c4577a2a2abd1ff6d42419a3bfc798f02c5e8392a8311c516ad07c6d2475919e"
+          },
+          "provenance": null,
+          "reviewed": {
+            "by": "Zorro909",
+            "at": "2026-11-04"
+          }
+        },
+        {
+          "version": "0.1.0",
+          "channel": "release",
+          "tag": "cogwork-v0.1.0",
+          "published": "2026-11-02T00:54:53Z",
+          "source": {
+            "repo": "Zorro909/weft-mods",
+            "commit": "f90064856310bcbfd5f00c9f83d5813a8e3fbb21"
+          },
+          "weft": {
+            "tag": "v26.10.4-56-g5faf2e3",
+            "commit": "5faf2e3e57697dd3476b03a300f1231b84f6419e",
+            "abi": "f470b1cbb1f9ad91"
+          },
+          "deps": [
+            {
+              "id": "base"
+            }
+          ],
+          "platforms": [
+            "windows-x64",
+            "linux-x64",
+            "macos-arm64"
+          ],
+          "asset": {
+            "name": "cogwork.zip",
+            "url": "https://github.com/Zorro909/weft-mods/releases/download/cogwork-v0.1.0/cogwork.zip",
+            "size": 2586992,
+            "sha256": "07ca439eb9d20aa1563220097d27b097b4a6c5ac250ce15ee049fc47d86b6774"
+          },
+          "provenance": null,
+          "reviewed": {
+            "by": "Zorro909",
+            "at": "2026-11-04"
+          }
+        },
+        {
+          "version": "0.1.0-experimental.ff9c712.8da6d93",
+          "channel": "experimental",
+          "tag": "cogwork-v0.1.0-experimental.ff9c712.8da6d93",
+          "published": "2026-11-02T00:54:35Z",
+          "source": {
+            "repo": "Zorro909/weft-mods",
+            "commit": "f90064856310bcbfd5f00c9f83d5813a8e3fbb21"
+          },
+          "weft": {
+            "tag": "v26.11.1",
+            "commit": "ff9c7128511fc0dce7719b67c9a59274d70bdd5a",
+            "abi": "f470b1cbb1f9ad91"
+          },
+          "deps": [
+            {
+              "id": "base"
+            }
+          ],
+          "platforms": [
+            "windows-x64",
+            "linux-x64",
+            "macos-arm64"
+          ],
+          "asset": {
+            "name": "cogwork.zip",
+            "url": "https://github.com/Zorro909/weft-mods/releases/download/cogwork-v0.1.0-experimental.ff9c712.8da6d93/cogwork.zip",
+            "size": 2586505,
+            "sha256": "cbac69292b213670369957c94e0eafc4511e6bd1fd5cf6133d2d88328478565a"
+          },
+          "provenance": null,
+          "reviewed": {
+            "by": "Zorro909",
+            "at": "2026-11-04"
+          }
+        }
+      ]
+    },
+    {
+      "id": "showcase",
+      "name": "Showcase",
+      "summary": "Plays the films other mods make of their content: a set built in the world and a camera flying around it in orbits, flybys and cranes.",
+      "authors": [
+        "Zorro909"
+      ],
+      "license": null,
+      "homepage": "https://github.com/Zorro909/weft-mods/tree/main/showcase",
+      "icon": null,
+      "versions": [
+        {
+          "version": "0.1.1-rc.2",
+          "channel": "prerelease",
+          "tag": "showcase-v0.1.1-rc.2",
+          "published": "2026-11-04T12:08:09Z",
+          "source": {
+            "repo": "Zorro909/weft-mods",
+            "commit": "514b2feb25af29f7dabbadfec36a3f24f4c8e6b2"
+          },
+          "weft": {
+            "tag": "v26.11.1",
+            "commit": "ff9c7128511fc0dce7719b67c9a59274d70bdd5a",
+            "abi": "f470b1cbb1f9ad91"
+          },
+          "deps": [],
+          "platforms": [
+            "windows-x64",
+            "linux-x64",
+            "macos-arm64"
+          ],
+          "asset": {
+            "name": "showcase.zip",
+            "url": "https://github.com/Zorro909/weft-mods/releases/download/showcase-v0.1.1-rc.2/showcase.zip",
+            "size": 2115903,
+            "sha256": "707745d8fc940031256060434d0a64ef0e7f5bdb016c716c24458ca4e0a13bf0"
+          },
+          "provenance": null,
+          "reviewed": {
+            "by": "Zorro909",
+            "at": "2026-11-04"
+          }
+        },
+        {
+          "version": "0.1.1-rc.1",
+          "channel": "prerelease",
+          "tag": "showcase-v0.1.1-rc.1",
+          "published": "2026-11-04T02:39:06Z",
+          "source": {
+            "repo": "Zorro909/weft-mods",
+            "commit": "cceea7805df5902d62017d2008d1bb29ed84e152"
+          },
+          "weft": {
+            "tag": "v26.11.1",
+            "commit": "ff9c7128511fc0dce7719b67c9a59274d70bdd5a",
+            "abi": "f470b1cbb1f9ad91"
+          },
+          "deps": [],
+          "platforms": [
+            "windows-x64",
+            "linux-x64",
+            "macos-arm64"
+          ],
+          "asset": {
+            "name": "showcase.zip",
+            "url": "https://github.com/Zorro909/weft-mods/releases/download/showcase-v0.1.1-rc.1/showcase.zip",
+            "size": 2116303,
+            "sha256": "97ab1bbbaae5b3664bfa6164810ebe3af8b4590f1a89b860f0800203b1766d30"
+          },
+          "provenance": null,
+          "reviewed": {
+            "by": "Zorro909",
+            "at": "2026-11-04"
+          }
+        },
+        {
+          "version": "0.1.0-experimental.4563878.7ce8734",
+          "channel": "experimental",
+          "tag": "showcase-v0.1.0-experimental.4563878.7ce8734",
+          "published": "2026-11-03T12:00:58Z",
+          "source": {
+            "repo": "Zorro909/weft-mods",
+            "commit": "8c2543e950d06004c66c49fab96b7ecce4e6343b"
+          },
+          "weft": {
+            "tag": "v26.11.1-46-g4563878",
+            "commit": "4563878b067425085701268f074f9483b2625e4c",
+            "abi": "5d449b795eda0099"
+          },
+          "deps": [],
+          "platforms": [
+            "windows-x64",
+            "linux-x64",
+            "macos-arm64"
+          ],
+          "asset": {
+            "name": "showcase.zip",
+            "url": "https://github.com/Zorro909/weft-mods/releases/download/showcase-v0.1.0-experimental.4563878.7ce8734/showcase.zip",
+            "size": 2107517,
+            "sha256": "d592062bb4d8a77635f46125de20f7f7ac8bd682bc52a6e7f31b938c55dd7cf6"
+          },
+          "provenance": null,
+          "reviewed": {
+            "by": "Zorro909",
+            "at": "2026-11-04"
+          }
+        },
+        {
+          "version": "0.1.0-experimental.b5958a1.7ce8734",
+          "channel": "experimental",
+          "tag": "showcase-v0.1.0-experimental.b5958a1.7ce8734",
+          "published": "2026-11-02T18:03:50Z",
+          "source": {
+            "repo": "Zorro909/weft-mods",
+            "commit": "917596da05afdf1fc87a4e20a20a6e6e427a5a86"
+          },
+          "weft": {
+            "tag": "v26.11.1-5-gb5958a1",
+            "commit": "b5958a15ba4f528cb349d7b8788e3892a18be091",
+            "abi": "d3dae6ede60ad004"
+          },
+          "deps": [],
+          "platforms": [
+            "windows-x64",
+            "linux-x64",
+            "macos-arm64"
+          ],
+          "asset": {
+            "name": "showcase.zip",
+            "url": "https://github.com/Zorro909/weft-mods/releases/download/showcase-v0.1.0-experimental.b5958a1.7ce8734/showcase.zip",
+            "size": 2105349,
+            "sha256": "6c1549b381f3902f88673df293c235366407a878a5e6e00c1bab8436ffe800ae"
+          },
+          "provenance": null,
+          "reviewed": {
+            "by": "Zorro909",
+            "at": "2026-11-04"
+          }
+        },
+        {
+          "version": "0.1.0",
+          "channel": "release",
+          "tag": "showcase-v0.1.0",
+          "published": "2026-11-02T18:03:47Z",
+          "source": {
+            "repo": "Zorro909/weft-mods",
+            "commit": "917596da05afdf1fc87a4e20a20a6e6e427a5a86"
+          },
+          "weft": {
+            "tag": "v26.11.1",
+            "commit": "ff9c7128511fc0dce7719b67c9a59274d70bdd5a",
+            "abi": "f470b1cbb1f9ad91"
+          },
+          "deps": [],
+          "platforms": [
+            "windows-x64",
+            "linux-x64",
+            "macos-arm64"
+          ],
+          "asset": {
+            "name": "showcase.zip",
+            "url": "https://github.com/Zorro909/weft-mods/releases/download/showcase-v0.1.0/showcase.zip",
+            "size": 2102725,
+            "sha256": "45ab76b2768694a68918800260b4058d6b16c3471498fe44c5792cfb905a0331"
+          },
+          "provenance": null,
+          "reviewed": {
+            "by": "Zorro909",
+            "at": "2026-11-04"
+          }
+        }
+      ]
+    },
+    {
+      "id": "structures",
+      "name": "Structures",
+      "summary": "Generates structures from .wst files in the overworld, alone and as hamlets.",
+      "authors": [
+        "Zorro909"
+      ],
+      "license": null,
+      "homepage": "https://github.com/Zorro909/weft-mods/tree/main/structures",
+      "icon": "https://raw.githubusercontent.com/Zorro909/weft-mods/cceea7805df5902d62017d2008d1bb29ed84e152/structures/assets/textures/gui/icon.png",
+      "versions": [
+        {
+          "version": "0.1.3-rc.1",
+          "channel": "prerelease",
+          "tag": "structures-v0.1.3-rc.1",
+          "published": "2026-11-04T02:39:09Z",
+          "source": {
+            "repo": "Zorro909/weft-mods",
+            "commit": "cceea7805df5902d62017d2008d1bb29ed84e152"
+          },
+          "weft": {
+            "tag": "v26.11.1",
+            "commit": "ff9c7128511fc0dce7719b67c9a59274d70bdd5a",
+            "abi": "f470b1cbb1f9ad91"
+          },
+          "deps": [
+            {
+              "id": "base"
+            }
+          ],
+          "platforms": [
+            "windows-x64",
+            "linux-x64",
+            "macos-arm64"
+          ],
+          "asset": {
+            "name": "structures.zip",
+            "url": "https://github.com/Zorro909/weft-mods/releases/download/structures-v0.1.3-rc.1/structures.zip",
+            "size": 2268217,
+            "sha256": "ca444b61dc22c04fe053b8acd9f809b1e659e874df644731ad10918abeaca239"
+          },
+          "provenance": null,
+          "reviewed": {
+            "by": "Zorro909",
+            "at": "2026-11-04"
+          }
+        },
+        {
+          "version": "0.1.2-experimental.4563878.917596d",
+          "channel": "experimental",
+          "tag": "structures-v0.1.2-experimental.4563878.917596d",
+          "published": "2026-11-03T12:01:02Z",
+          "source": {
+            "repo": "Zorro909/weft-mods",
+            "commit": "8c2543e950d06004c66c49fab96b7ecce4e6343b"
+          },
+          "weft": {
+            "tag": "v26.11.1-46-g4563878",
+            "commit": "4563878b067425085701268f074f9483b2625e4c",
+            "abi": "5d449b795eda0099"
+          },
+          "deps": [
+            {
+              "id": "base"
+            }
+          ],
+          "platforms": [
+            "windows-x64",
+            "linux-x64",
+            "macos-arm64"
+          ],
+          "asset": {
+            "name": "structures.zip",
+            "url": "https://github.com/Zorro909/weft-mods/releases/download/structures-v0.1.2-experimental.4563878.917596d/structures.zip",
+            "size": 2274880,
+            "sha256": "abf92f44774cb9fef02e8d7cee365aea1993cb39536b4fb713c5f1b11e48eae1"
+          },
+          "provenance": null,
+          "reviewed": {
+            "by": "Zorro909",
+            "at": "2026-11-04"
+          }
+        },
+        {
+          "version": "0.1.2-experimental.b5958a1.917596d",
+          "channel": "experimental",
+          "tag": "structures-v0.1.2-experimental.b5958a1.917596d",
+          "published": "2026-11-02T18:03:53Z",
+          "source": {
+            "repo": "Zorro909/weft-mods",
+            "commit": "917596da05afdf1fc87a4e20a20a6e6e427a5a86"
+          },
+          "weft": {
+            "tag": "v26.11.1-5-gb5958a1",
+            "commit": "b5958a15ba4f528cb349d7b8788e3892a18be091",
+            "abi": "d3dae6ede60ad004"
+          },
+          "deps": [
+            {
+              "id": "base"
+            }
+          ],
+          "platforms": [
+            "windows-x64",
+            "linux-x64",
+            "macos-arm64"
+          ],
+          "asset": {
+            "name": "structures.zip",
+            "url": "https://github.com/Zorro909/weft-mods/releases/download/structures-v0.1.2-experimental.b5958a1.917596d/structures.zip",
+            "size": 2272769,
+            "sha256": "5d2efc634fa4d091437de643864f79cf2e70ebbd315523b8bb26c1f4573436e0"
+          },
+          "provenance": null,
+          "reviewed": {
+            "by": "Zorro909",
+            "at": "2026-11-04"
+          }
+        },
+        {
+          "version": "0.1.2",
+          "channel": "release",
+          "tag": "structures-v0.1.2",
+          "published": "2026-11-02T18:03:50Z",
+          "source": {
+            "repo": "Zorro909/weft-mods",
+            "commit": "917596da05afdf1fc87a4e20a20a6e6e427a5a86"
+          },
+          "weft": {
+            "tag": "v26.11.1",
+            "commit": "ff9c7128511fc0dce7719b67c9a59274d70bdd5a",
+            "abi": "f470b1cbb1f9ad91"
+          },
+          "deps": [
+            {
+              "id": "base"
+            }
+          ],
+          "platforms": [
+            "windows-x64",
+            "linux-x64",
+            "macos-arm64"
+          ],
+          "asset": {
+            "name": "structures.zip",
+            "url": "https://github.com/Zorro909/weft-mods/releases/download/structures-v0.1.2/structures.zip",
+            "size": 2270608,
+            "sha256": "4579c714fd0768e2f71c41a1e08064199797e1d0378a19dd1d563e8348d415cc"
+          },
+          "provenance": null,
+          "reviewed": {
+            "by": "Zorro909",
+            "at": "2026-11-04"
+          }
+        },
+        {
+          "version": "0.1.1",
+          "channel": "release",
+          "tag": "structures-v0.1.1",
+          "published": "2026-11-02T14:13:10Z",
+          "source": {
+            "repo": "Zorro909/weft-mods",
+            "commit": "5855730cc0a423eee7fd7e0a0eebb67bb8f355ac"
+          },
+          "weft": {
+            "tag": "v26.11.1",
+            "commit": "ff9c7128511fc0dce7719b67c9a59274d70bdd5a",
+            "abi": "f470b1cbb1f9ad91"
+          },
+          "deps": [
+            {
+              "id": "base"
+            }
+          ],
+          "platforms": [
+            "windows-x64",
+            "linux-x64",
+            "macos-arm64"
+          ],
+          "asset": {
+            "name": "structures.zip",
+            "url": "https://github.com/Zorro909/weft-mods/releases/download/structures-v0.1.1/structures.zip",
+            "size": 2268411,
+            "sha256": "dc5c4390c0bc2fd0f458ea6f02208e502fff5eb730ecba4dbed409f9e75f4434"
+          },
+          "provenance": null,
+          "reviewed": {
+            "by": "Zorro909",
+            "at": "2026-11-04"
+          }
+        },
+        {
+          "version": "0.1.1-experimental.090722d.5855730",
+          "channel": "experimental",
+          "tag": "structures-v0.1.1-experimental.090722d.5855730",
+          "published": "2026-11-02T14:12:58Z",
+          "source": {
+            "repo": "Zorro909/weft-mods",
+            "commit": "5855730cc0a423eee7fd7e0a0eebb67bb8f355ac"
+          },
+          "weft": {
+            "tag": "v26.11.1-2-g090722d",
+            "commit": "090722d8954973e0badcd130446cbebbe0016181",
+            "abi": "f470b1cbb1f9ad91"
+          },
+          "deps": [
+            {
+              "id": "base"
+            }
+          ],
+          "platforms": [
+            "windows-x64",
+            "linux-x64",
+            "macos-arm64"
+          ],
+          "asset": {
+            "name": "structures.zip",
+            "url": "https://github.com/Zorro909/weft-mods/releases/download/structures-v0.1.1-experimental.090722d.5855730/structures.zip",
+            "size": 2268414,
+            "sha256": "729a55916c94584c409284eedf6b79bbef53a82e4012554ab194e51b044cc10d"
+          },
+          "provenance": null,
+          "reviewed": {
+            "by": "Zorro909",
+            "at": "2026-11-04"
+          }
+        },
+        {
+          "version": "0.1.0-experimental.090722d.935cf10",
+          "channel": "experimental",
+          "tag": "structures-v0.1.0-experimental.090722d.935cf10",
+          "published": "2026-11-02T12:34:28Z",
+          "source": {
+            "repo": "Zorro909/weft-mods",
+            "commit": "66de7e3a57c8edb1c6da476948f7092527bdc5c2"
+          },
+          "weft": {
+            "tag": "v26.11.1-2-g090722d",
+            "commit": "090722d8954973e0badcd130446cbebbe0016181",
+            "abi": "f470b1cbb1f9ad91"
+          },
+          "deps": [
+            {
+              "id": "base"
+            }
+          ],
+          "platforms": [
+            "windows-x64",
+            "linux-x64",
+            "macos-arm64"
+          ],
+          "asset": {
+            "name": "structures.zip",
+            "url": "https://github.com/Zorro909/weft-mods/releases/download/structures-v0.1.0-experimental.090722d.935cf10/structures.zip",
+            "size": 2268456,
+            "sha256": "079db519167c2cd09eeef42d7234ebc8b1424985dfc95a16798d01f614dd4a7e"
+          },
+          "provenance": null,
+          "reviewed": {
+            "by": "Zorro909",
+            "at": "2026-11-04"
+          }
+        },
+        {
+          "version": "0.1.0",
+          "channel": "release",
+          "tag": "structures-v0.1.0",
+          "published": "2026-11-02T00:54:55Z",
+          "source": {
+            "repo": "Zorro909/weft-mods",
+            "commit": "f90064856310bcbfd5f00c9f83d5813a8e3fbb21"
+          },
+          "weft": {
+            "tag": "v26.10.4-56-g5faf2e3",
+            "commit": "5faf2e3e57697dd3476b03a300f1231b84f6419e",
+            "abi": "f470b1cbb1f9ad91"
+          },
+          "deps": [
+            {
+              "id": "base"
+            }
+          ],
+          "platforms": [
+            "windows-x64",
+            "linux-x64",
+            "macos-arm64"
+          ],
+          "asset": {
+            "name": "structures.zip",
+            "url": "https://github.com/Zorro909/weft-mods/releases/download/structures-v0.1.0/structures.zip",
+            "size": 2268416,
+            "sha256": "417656fde1e77a2eee43def2cba34dc3a87f3f571c5db6ab34435b9de98381de"
+          },
+          "provenance": null,
+          "reviewed": {
+            "by": "Zorro909",
+            "at": "2026-11-04"
+          }
+        },
+        {
+          "version": "0.1.0-experimental.ff9c712.935cf10",
+          "channel": "experimental",
+          "tag": "structures-v0.1.0-experimental.ff9c712.935cf10",
+          "published": "2026-11-02T00:54:37Z",
+          "source": {
+            "repo": "Zorro909/weft-mods",
+            "commit": "f90064856310bcbfd5f00c9f83d5813a8e3fbb21"
+          },
+          "weft": {
+            "tag": "v26.11.1",
+            "commit": "ff9c7128511fc0dce7719b67c9a59274d70bdd5a",
+            "abi": "f470b1cbb1f9ad91"
+          },
+          "deps": [
+            {
+              "id": "base"
+            }
+          ],
+          "platforms": [
+            "windows-x64",
+            "linux-x64",
+            "macos-arm64"
+          ],
+          "asset": {
+            "name": "structures.zip",
+            "url": "https://github.com/Zorro909/weft-mods/releases/download/structures-v0.1.0-experimental.ff9c712.935cf10/structures.zip",
+            "size": 2268460,
+            "sha256": "c9c1bf6797cd91d332397426ab666f3cf2caf41665330d3e5332ac5a8e83e6db"
+          },
+          "provenance": null,
+          "reviewed": {
+            "by": "Zorro909",
+            "at": "2026-11-04"
+          }
+        }
+      ]
+    }
+  ],
+  "revoked": []
+}
diff --git a/src-tauri/src/mods/testdata/published-index.json.minisig b/src-tauri/src/mods/testdata/published-index.json.minisig
new file mode 100644
index 0000000..5c6a1e0
--- /dev/null
+++ b/src-tauri/src/mods/testdata/published-index.json.minisig
@@ -0,0 +1,4 @@
+untrusted comment: signature from minisign secret key
+RURelY1XUps7n2m5kpQu4sUNqi28gQDq9PjETjFDSI10jlYOClgrpOh5ydKKE2IFQ8GkITs0GKyNJO4d0TMlzJ4Q8/JUhi7I8wM=
+trusted comment: timestamp:1793819114 file:index.json commit:5e4de0c8b8b4354646fbd8d56e415089e2b3c300
+d7FsnPifi8cXHXHOnG4UPJKLJtVZMvJjOb054RmcqUX5C7chQEEV+bxuZsTqADMDT8YFWyvGZW27L5xdhxo8Cg==
diff --git a/src-tauri/src/mods/testdata/test.pub b/src-tauri/src/mods/testdata/test.pub
new file mode 100644
index 0000000..e2447bd
--- /dev/null
+++ b/src-tauri/src/mods/testdata/test.pub
@@ -0,0 +1,2 @@
+untrusted comment: minisign public key EAF87D72C92FEF7C
+RWR87y/Jcn346oYW5xzn+XIs4Tl1GaujTfgcqxVJo1OUwatPbwYeU3Wa
diff --git a/src-tauri/src/mods/version.rs b/src-tauri/src/mods/version.rs
new file mode 100644
index 0000000..4c78155
--- /dev/null
+++ b/src-tauri/src/mods/version.rs
@@ -0,0 +1,90 @@
+//! Ordering of mod versions such as `0.2.0`, `0.2.1-rc.1` and `0.1.2-experimental.4563878.917596d`:
+//! semver precedence, which is all the mods use.
+
+use std::cmp::Ordering;
+
+fn split(v: &str) -> (Vec<u64>, Option<&str>) {
+    let v = v.strip_prefix('v').unwrap_or(v);
+    let v = v.split('+').next().unwrap_or(v);
+    let (core, pre) = match v.split_once('-') {
+        Some((c, p)) => (c, Some(p)),
+        None => (v, None),
+    };
+    let nums = core.split('.').map(|n| n.parse().unwrap_or(0)).collect();
+    (nums, pre)
+}
+
+fn cmp_pre(a: &str, b: &str) -> Ordering {
+    let mut ai = a.split('.');
+    let mut bi = b.split('.');
+    loop {
+        match (ai.next(), bi.next()) {
+            (None, None) => return Ordering::Equal,
+            (None, Some(_)) => return Ordering::Less,
+            (Some(_), None) => return Ordering::Greater,
+            (Some(x), Some(y)) => {
+                let ord = match (x.parse::<u64>(), y.parse::<u64>()) {
+                    (Ok(x), Ok(y)) => x.cmp(&y),
+                    (Ok(_), Err(_)) => Ordering::Less,
+                    (Err(_), Ok(_)) => Ordering::Greater,
+                    (Err(_), Err(_)) => x.cmp(y),
+                };
+                if ord != Ordering::Equal {
+                    return ord;
+                }
+            }
+        }
+    }
+}
+
+pub fn compare(a: &str, b: &str) -> Ordering {
+    let (an, ap) = split(a);
+    let (bn, bp) = split(b);
+    let len = an.len().max(bn.len());
+    for i in 0..len {
+        let ord = an
+            .get(i)
+            .copied()
+            .unwrap_or(0)
+            .cmp(&bn.get(i).copied().unwrap_or(0));
+        if ord != Ordering::Equal {
+            return ord;
+        }
+    }
+    match (ap, bp) {
+        (None, None) => Ordering::Equal,
+        (None, Some(_)) => Ordering::Greater,
+        (Some(_), None) => Ordering::Less,
+        (Some(x), Some(y)) => cmp_pre(x, y),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn semver_precedence() {
+        let mut v = vec![
+            "0.2.0",
+            "0.1.2",
+            "0.2.1-rc.1",
+            "0.2.1",
+            "0.2.1-rc.2",
+            "0.10.0",
+        ];
+        v.sort_by(|a, b| compare(a, b));
+        assert_eq!(
+            v,
+            [
+                "0.1.2",
+                "0.2.0",
+                "0.2.1-rc.1",
+                "0.2.1-rc.2",
+                "0.2.1",
+                "0.10.0"
+            ]
+        );
+        assert_eq!(compare("v1.0.0", "1.0"), Ordering::Equal);
+    }
+}
diff --git a/src-tauri/src/releases.rs b/src-tauri/src/releases.rs
index f54960c..c2a850d 100644
--- a/src-tauri/src/releases.rs
+++ b/src-tauri/src/releases.rs
@@ -39,7 +39,7 @@ pub enum ReleasesError {
     UnexpectedStatus(u16),
 }
 
-#[derive(Debug, Clone, Serialize, Deserialize)]
+#[derive(Debug, Clone, Serialize, Deserialize, ts_rs::TS)]
 pub struct AssetInfo {
     pub name: String,
     pub url: String,
@@ -48,7 +48,7 @@ pub struct AssetInfo {
     pub sha256: Option<String>,
 }
 
-#[derive(Debug, Clone, Serialize, Deserialize)]
+#[derive(Debug, Clone, Serialize, Deserialize, ts_rs::TS)]
 pub struct Release {
     pub tag: String,
     pub name: String,
@@ -269,6 +269,7 @@ pub async fn list_versions(
 ) -> Result<Vec<Release>, AppError> {
     let client = reqwest::Client::builder()
         .timeout(GITHUB_API_TIMEOUT)
+        .redirect(crate::download::redirect_policy())
         .build()
         .map_err(ReleasesError::Network)?;
 
diff --git a/src/App.tsx b/src/App.tsx
index d84e33c..0fffbf6 100644
--- a/src/App.tsx
+++ b/src/App.tsx
@@ -1,15 +1,19 @@
 import { useState, useEffect, useMemo } from "react";
-import { invoke } from "@tauri-apps/api/core";
 import { useI18n } from "./i18n/useI18n";
-import { translateError } from "./i18n/errors";
+import { showError, type Shown } from "./i18n/errors";
+import { LiveRegion } from "./components/LiveRegion";
+import { watchFocus } from "./components/focusRescue";
 import { useInstall } from "./hooks/useInstall";
 import { Sidebar } from "./components/Sidebar";
-import { Tabs } from "./components/Tabs";
+import { Tabs, TabId, useMainTabs } from "./components/Tabs";
 import { VoxelField } from "./components/VoxelField";
 import { Home } from "./pages/Home";
 import { VersionsPage } from "./pages/Versions";
 import { NotesPage } from "./pages/Notes";
+import { ModsPage } from "./pages/Mods";
+import { useModProfiles } from "./hooks/useMods";
 import { getLatestTag, getNewTag } from "./utils/version";
+import { launcherApi } from "./mods/api";
 
 interface AssetInfo {
   name: string;
@@ -28,7 +32,6 @@ interface Release {
   from_cache: boolean;
 }
 
-type TabId = "home" | "versions" | "notes";
 
 function lastPlayed(): string | null {
   try {
@@ -41,28 +44,34 @@ function lastPlayed(): string | null {
 function App() {
   const { t, ready } = useI18n();
   const { installedVersions } = useInstall();
+  const { profile } = useModProfiles();
   const [releases, setReleases] = useState<Release[]>([]);
   const [loading, setLoading] = useState(true);
-  const [error, setError] = useState<string | null>(null);
+  const [error, setError] = useState<Shown | null>(null);
   const [fromCache, setFromCache] = useState(false);
   const [activeTab, setActiveTab] = useState<TabId>("home");
   const [selectedTag, setSelectedTag] = useState<string | null>(lastPlayed);
 
   const latestTag = useMemo(() => getLatestTag(releases), [releases]);
   const newTag = useMemo(() => getNewTag(latestTag, installedVersions), [latestTag, installedVersions]);
+  const { panel } = useMainTabs(activeTab, setActiveTab);
+  const modsAttention = installedVersions.some((v) => {
+    const p = profile(v.tag);
+    return !!p && (p.blocking.length > 0 || p.mods.some((m) => m.update !== null && m.status !== "off"));
+  });
 
   /** Resolves to whether the list came from the cache. */
   async function fetchReleases(forceRefresh = false): Promise<boolean> {
     setLoading(true);
     setError(null);
     try {
-      const data = await invoke<Release[]>("list_versions", { forceRefresh: forceRefresh });
+      const data = await launcherApi.versions(forceRefresh);
       const cached = data.some((r) => r.from_cache);
       setReleases(data);
       setFromCache(cached);
       return cached;
     } catch (err) {
-      setError(translateError(err));
+      setError(showError(err));
       return false;
     } finally {
       setLoading(false);
@@ -70,6 +79,9 @@ function App() {
   }
 
   // The cache shows something at once, then GitHub says what is new.
+  // Focus never falls to the page body when what had it goes away.
+  useEffect(() => watchFocus(), []);
+
   useEffect(() => {
     fetchReleases(false).then((cached) => {
       if (cached) fetchReleases(true);
@@ -86,6 +98,7 @@ function App() {
         return (
           <Home
             onGoToVersions={() => setActiveTab("versions")}
+            onGoToMods={() => setActiveTab("mods")}
             latestTag={latestTag}
             selectedTag={selectedTag}
             onSelectTag={setSelectedTag}
@@ -100,6 +113,18 @@ function App() {
             fromCache={fromCache}
             onRefresh={fetchReleases}
             newTag={newTag}
+            onFixMods={(tag) => {
+              setSelectedTag(tag);
+              setActiveTab("mods");
+            }}
+          />
+        );
+      case "mods":
+        return (
+          <ModsPage
+            selectedTag={selectedTag}
+            onSelectTag={setSelectedTag}
+            onGoToVersions={() => setActiveTab("versions")}
           />
         );
       case "notes":
@@ -111,12 +136,18 @@ function App() {
 
   return (
     <div className="app-layout">
+      <LiveRegion />
       <VoxelField />
       <Sidebar />
       <div className="main-content">
-        <Tabs activeTab={activeTab} onChange={setActiveTab} hasNewVersions={newTag !== null} />
+        <Tabs
+          activeTab={activeTab}
+          onChange={setActiveTab}
+          hasNewVersions={newTag !== null}
+          modsAttention={modsAttention}
+        />
         {/* Keyed so a page always opens at its top, not where the last one was scrolled to. */}
-        <div className="page-container" role="main" key={activeTab}>
+        <div className="page-container" {...panel} key={activeTab}>
           {renderPage()}
         </div>
       </div>
diff --git a/src/components/Announce.test.ts b/src/components/Announce.test.ts
new file mode 100644
index 0000000..427347a
--- /dev/null
+++ b/src/components/Announce.test.ts
@@ -0,0 +1,20 @@
+import { describe, expect, it } from "vitest";
+import { sentences } from "./Announce";
+
+describe("announced sentences", () => {
+  it("joins whole sentences with a space, never a comma after a full stop", () => {
+    const said = sentences([
+      "Weft v26.11.1 won't start with these mods on:",
+      "Hearth stops Play: it needs Cogwork, which is off.",
+      "Lanterns stops Play: it needs Glowmoss, which isn't installed.",
+    ]);
+    expect(said).toBe(
+      "Weft v26.11.1 won't start with these mods on: Hearth stops Play: it needs Cogwork, which is off. Lanterns stops Play: it needs Glowmoss, which isn't installed."
+    );
+    expect(said).not.toMatch(/[.!?:],/);
+  });
+
+  it("leaves out empty parts", () => {
+    expect(sentences(["", " One. ", "", "Two."])).toBe("One. Two.");
+  });
+});
diff --git a/src/components/Announce.tsx b/src/components/Announce.tsx
new file mode 100644
index 0000000..d39eeca
--- /dev/null
+++ b/src/components/Announce.tsx
@@ -0,0 +1,37 @@
+import { useEffect, useState } from "react";
+import { useSpeech } from "./LiveRegion";
+
+/**
+ * Whole sentences said one after another: a space between them, never a comma, so a screen
+ * reader doesn't hear "…which is off., Lanterns…". Empty parts are left out.
+ */
+export function sentences(parts: string[]): string {
+  return parts
+    .map((p) => p.trim())
+    .filter(Boolean)
+    .join(" ");
+}
+
+/**
+ * Says the items of a channel that weren't on it before, assertively: blockers that newly appear.
+ * A panel that re-renders, or comes back on another tab with the same problems, stays quiet; one
+ * fixed problem doesn't make the others be said again. An item that goes away is forgotten, so
+ * it is said again if it comes back.
+ */
+export function Announce({ channel, items, prefix = "" }: { channel: string; items: { id: string; text: string }[]; prefix?: string }) {
+  const speech = useSpeech();
+  const [now, setNow] = useState("");
+  const ids = items.map((i) => i.id).join("\u0000");
+  useEffect(() => {
+    const fresh = speech.fresh(channel, items);
+    if (fresh.length) setNow(sentences([prefix, ...fresh.map((i) => i.text)]));
+    else if (!items.length) setNow("");
+    // `items` is read through its ids: the same problems with new objects say nothing.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [speech, channel, ids, prefix]);
+  return (
+    <span className="sr-only" role="alert">
+      {now}
+    </span>
+  );
+}
diff --git a/src/components/Dialog.tsx b/src/components/Dialog.tsx
new file mode 100644
index 0000000..811276c
--- /dev/null
+++ b/src/components/Dialog.tsx
@@ -0,0 +1,161 @@
+import { ReactNode, useCallback, useEffect, useId, useRef } from "react";
+import { tipOpenOn } from "./Truncate";
+import { focusNear, scopesOf } from "./focusRescue";
+
+interface DialogProps {
+  title: ReactNode;
+  subtitle?: ReactNode;
+  onClose: () => void;
+  /** While true, Escape and the backdrop don't close it: work is in flight. */
+  locked?: boolean;
+  /** The body. It scrolls; the title and the footer stay put. */
+  children: ReactNode;
+  /** The action row, always visible at the bottom. */
+  footer: ReactNode;
+}
+
+// Native `<summary>` is a tab stop too (the error Details disclosure), as are selects and text areas.
+const FOCUSABLE =
+  'button:not(:disabled), input:not(:disabled), select:not(:disabled), textarea:not(:disabled), [href], summary, [tabindex]:not([tabindex="-1"]):not(:disabled)';
+
+function usable(el: Element | null): el is HTMLElement {
+  if (!(el instanceof HTMLElement) || (el as HTMLButtonElement).disabled || el.tabIndex < 0) return false;
+  if (el.getClientRects().length === 0 || el.closest("[hidden], [inert]")) return false;
+  // Only a details element's own first summary can be focused.
+  if (el.tagName === "SUMMARY") {
+    const details = el.parentElement;
+    if (!(details instanceof HTMLDetailsElement) || details.querySelector(":scope > summary") !== el) return false;
+  }
+  return true;
+}
+
+/**
+ * A modal. Keeps focus inside, also when its content is replaced (an async inspection) or a
+ * focused button is disabled, and gives focus back to whatever opened it. It first focuses the
+ * element marked `data-autofocus` (the safe choice, e.g. Cancel), else its title. When the opener
+ * is gone by then, focus goes to the nearest place around where it was (components/focusRescue).
+ */
+export function Dialog({ title, subtitle, onClose, locked = false, children, footer }: DialogProps) {
+  const box = useRef<HTMLDivElement>(null);
+  const heading = useRef<HTMLHeadingElement>(null);
+  const titleId = useId();
+  const close = useRef(onClose);
+  close.current = onClose;
+  const isLocked = useRef(locked);
+  isLocked.current = locked;
+
+  /** Where focus goes when it has nowhere sensible to be. */
+  const settle = useCallback(() => {
+    const root = box.current;
+    if (!root) return;
+    const active = document.activeElement;
+    if (active && root.contains(active) && (active === heading.current || usable(active))) return;
+    const preferred = root.querySelector("[data-autofocus]");
+    (usable(preferred) ? preferred : heading.current)?.focus({ preventScroll: true });
+  }, []);
+
+  useEffect(() => {
+    const opener = document.activeElement as HTMLElement | null;
+    // Where the opener was, in case it is gone when this closes: an Install that became "Installed".
+    const openerScopes = scopesOf(opener);
+    settle();
+
+    // Content changes can take focus away: an element unmounts or gets disabled.
+    const observer = new MutationObserver(() => settle());
+    if (box.current) {
+      observer.observe(box.current, { childList: true, subtree: true, attributes: true, attributeFilter: ["disabled"] });
+    }
+
+    // Focus that lands outside (a click on the page behind, a stray script) comes back.
+    const onFocusIn = (e: FocusEvent) => {
+      if (box.current && e.target instanceof Node && !box.current.contains(e.target)) settle();
+    };
+
+    const onKey = (e: KeyboardEvent) => {
+      // An open menu or list takes Escape first; a disclosure (a list shown in place) doesn't.
+      const popupOpen = e.target instanceof Element && !!e.target.closest('[aria-haspopup][aria-expanded="true"], [role=listbox], [role=menu]');
+      // The focused element's own tooltip goes first: that element hides it on this Escape, and
+      // the next one closes the dialog. Only a tip that belongs to the focused element counts,
+      // never one the mouse left elsewhere.
+      const tipShown = tipOpenOn(e.target);
+      if (e.key === "Escape" && !isLocked.current && !popupOpen && !tipShown) {
+        e.stopPropagation();
+        close.current();
+      } else if (e.key === "Tab" && box.current) {
+        const items = [...box.current.querySelectorAll<HTMLElement>(FOCUSABLE)].filter(usable);
+        if (items.length === 0) {
+          e.preventDefault();
+          heading.current?.focus();
+          return;
+        }
+        const [head, tail] = [items[0], items[items.length - 1]];
+        const active = document.activeElement as HTMLElement | null;
+        const inside = !!active && items.includes(active);
+        if (e.shiftKey && (!inside || active === head)) {
+          e.preventDefault();
+          tail.focus();
+        } else if (!e.shiftKey && (!inside || active === tail)) {
+          e.preventDefault();
+          head.focus();
+        }
+      }
+    };
+    document.addEventListener("keydown", onKey, true);
+    document.addEventListener("focusin", onFocusIn);
+    const outside = inertOutside(box.current);
+    return () => {
+      // The page comes back first, so focus can return to the opener.
+      outside.forEach((el) => (el.inert = false));
+      observer.disconnect();
+      document.removeEventListener("keydown", onKey, true);
+      document.removeEventListener("focusin", onFocusIn);
+      if (opener?.isConnected && opener !== document.body) opener.focus?.({ preventScroll: true });
+      else focusNear(openerScopes);
+    };
+  }, [settle]);
+
+  return (
+    <div
+      className="scrim"
+      onMouseDown={(e) => {
+        if (e.target === e.currentTarget && !isLocked.current) onClose();
+      }}
+    >
+      <div
+        className="dialog framed"
+        role="dialog"
+        aria-modal="true"
+        aria-labelledby={titleId}
+        aria-busy={locked || undefined}
+        ref={box}
+      >
+        <div className="dialog-head">
+          <h2 className="dialog-title" id={titleId} tabIndex={-1} ref={heading}>
+            {title}
+          </h2>
+          {subtitle && <p className="dialog-sub">{subtitle}</p>}
+        </div>
+        <div className="dialog-body">{children}</div>
+        <div className="dialog-actions">{footer}</div>
+      </div>
+    </div>
+  );
+}
+
+/**
+ * Makes everything outside an open dialog inert: not clickable, not focusable, not in the
+ * accessibility tree, beyond what `aria-modal` asks of a screen reader. The polite live region
+ * stays, so a result is still said while the dialog is open. Returns what it changed.
+ */
+function inertOutside(dialog: HTMLElement | null): HTMLElement[] {
+  const made: HTMLElement[] = [];
+  for (let n = dialog; n && n.parentElement && n !== document.body; n = n.parentElement) {
+    for (const sibling of n.parentElement.children) {
+      if (sibling === n || !(sibling instanceof HTMLElement) || sibling.inert) continue;
+      if (sibling.matches("[aria-live], script") || sibling.querySelector("[aria-live]")) continue;
+      sibling.inert = true;
+      made.push(sibling);
+    }
+  }
+  return made;
+}
diff --git a/src/components/ErrorText.tsx b/src/components/ErrorText.tsx
new file mode 100644
index 0000000..cd5ba25
--- /dev/null
+++ b/src/components/ErrorText.tsx
@@ -0,0 +1,50 @@
+import { ReactNode, useEffect, useId } from "react";
+import { useI18n } from "../i18n/useI18n";
+import type { Shown } from "../i18n/errors";
+import { useAnnounce } from "./LiveRegion";
+
+interface ErrorTextProps {
+  error: Shown;
+  className?: string;
+  /** Buttons beside the message, e.g. Retry. */
+  children?: ReactNode;
+  /** Words before the message, e.g. "Couldn't read your sources:". */
+  lead?: string;
+  /** Said once, politely, as it appears. On by default; off where the same text is said elsewhere. */
+  speak?: boolean;
+  /** For a field it describes (`aria-describedby`). */
+  id?: string;
+}
+
+/**
+ * A failure: the translated sentence, and the backend's own words behind "Details" when there
+ * are any. Said once in the polite live region, not as an alert.
+ */
+export function ErrorText({ error, className = "inline-error", children, lead, speak = true, id: domId }: ErrorTextProps) {
+  const announce = useAnnounce();
+  const { t } = useI18n();
+  const id = useId();
+  const text = lead ? `${lead} ${error.message}` : error.message;
+  useEffect(() => {
+    if (speak && text) announce(`error:${id}:${text}`, text);
+  }, [speak, text, id, announce]);
+  return (
+    <div className={`${className} error-text${children ? " with-action" : ""}`} id={domId}>
+      <span className="error-message" data-must-fit>
+        {text}
+        {error.detail && <ErrorDetails detail={error.detail} label={t("errors.details")} />}
+      </span>
+      {children}
+    </div>
+  );
+}
+
+/** The backend's words, folded away. */
+export function ErrorDetails({ detail, label }: { detail: string; label: string }) {
+  return (
+    <details className="error-details">
+      <summary>{label}</summary>
+      <code>{detail}</code>
+    </details>
+  );
+}
diff --git a/src/components/LanguageMenu.tsx b/src/components/LanguageMenu.tsx
index 7215349..bef076d 100644
--- a/src/components/LanguageMenu.tsx
+++ b/src/components/LanguageMenu.tsx
@@ -1,63 +1,95 @@
 import { useEffect, useRef, useState } from "react";
 import { useI18n } from "../i18n/useI18n";
+import type { Locale } from "../i18n";
 
-const OPTIONS: { code: 'pt-BR' | 'en' | 'es' | 'ru'; label: string; name: string }[] = [
+const OPTIONS: { code: Locale; label: string; name: string }[] = [
   { code: "en", label: "EN", name: "English" },
-  { code: "pt-BR", label: "BR", name: "Português" },
+  { code: "pt-BR", label: "PT", name: "Português" },
   { code: "es", label: "ES", name: "Español" },
   { code: "ru", label: "RU", name: "Русский" },
 ];
 
+/** A menu of languages: arrows move, Enter picks, Escape closes and returns to the button. */
 export function LanguageMenu() {
   const [open, setOpen] = useState(false);
   const ref = useRef<HTMLDivElement>(null);
+  const button = useRef<HTMLButtonElement>(null);
+  const items = useRef<(HTMLButtonElement | null)[]>([]);
   const { locale, changeLocale } = useI18n();
+  const current = OPTIONS.find((o) => o.code === locale) ?? OPTIONS[0];
 
   useEffect(() => {
     if (!open) return;
+    items.current[Math.max(0, OPTIONS.findIndex((o) => o.code === locale))]?.focus();
     const onClick = (e: MouseEvent) => {
       if (ref.current && !ref.current.contains(e.target as Node)) setOpen(false);
     };
-    const onKey = (e: KeyboardEvent) => {
-      if (e.key === "Escape") setOpen(false);
-    };
     document.addEventListener("mousedown", onClick);
-    document.addEventListener("keydown", onKey);
-    return () => {
-      document.removeEventListener("mousedown", onClick);
-      document.removeEventListener("keydown", onKey);
-    };
-  }, [open]);
+    return () => document.removeEventListener("mousedown", onClick);
+  }, [open, locale]);
 
-  const choose = (code: 'pt-BR' | 'en' | 'es' | 'ru') => {
+  const close = () => {
     setOpen(false);
-    if (code === locale) return;
-    changeLocale(code);
+    button.current?.focus();
+  };
+
+  const choose = (code: Locale) => {
+    close();
+    if (code !== locale) changeLocale(code);
   };
 
-  const currentLabel = OPTIONS.find((o) => o.code === locale)?.label ?? "EN";
+  const onMenuKey = (e: React.KeyboardEvent) => {
+    const i = items.current.findIndex((el) => el === document.activeElement);
+    const move = (n: number) => {
+      e.preventDefault();
+      items.current[(n + OPTIONS.length) % OPTIONS.length]?.focus();
+    };
+    if (e.key === "ArrowDown") move(i + 1);
+    else if (e.key === "ArrowUp") move(i - 1);
+    else if (e.key === "Home") move(0);
+    else if (e.key === "End") move(OPTIONS.length - 1);
+    else if (e.key === "Escape" || e.key === "Tab") {
+      e.preventDefault();
+      close();
+    }
+  };
 
   return (
     <div className="lang" ref={ref}>
       <button
         type="button"
         className="lang-btn"
-        onClick={() => setOpen((o: boolean) => !o)}
-        aria-haspopup="listbox"
+        ref={button}
+        onClick={() => setOpen((o) => !o)}
+        onKeyDown={(e) => {
+          if (e.key === "ArrowDown") {
+            e.preventDefault();
+            setOpen(true);
+          }
+        }}
+        aria-haspopup="menu"
         aria-expanded={open}
+        aria-label={`${current.name} (${current.label})`}
       >
-        {currentLabel}
+        {current.label}
       </button>
       {open && (
-        <ul className="lang-menu" role="listbox">
-          {OPTIONS.map((o) => (
-            <li key={o.code} role="option" aria-selected={o.code === locale}>
+        <ul className="lang-menu" role="menu" aria-label={current.name} onKeyDown={onMenuKey}>
+          {OPTIONS.map((o, i) => (
+            <li key={o.code} role="none">
               <button
                 type="button"
+                role="menuitemradio"
+                aria-checked={o.code === locale}
+                lang={o.code}
+                tabIndex={-1}
+                ref={(el) => {
+                  items.current[i] = el;
+                }}
                 className={`lang-item${o.code === locale ? " active" : ""}`}
                 onClick={() => choose(o.code)}
               >
-                <strong>{o.label}</strong> <span>{o.name}</span>
+                <strong aria-hidden="true">{o.label}</strong> <span>{o.name}</span>
               </button>
             </li>
           ))}
@@ -65,4 +97,4 @@ export function LanguageMenu() {
       )}
     </div>
   );
-}
\ No newline at end of file
+}
diff --git a/src/components/LaunchRefusal.tsx b/src/components/LaunchRefusal.tsx
new file mode 100644
index 0000000..32129fb
--- /dev/null
+++ b/src/components/LaunchRefusal.tsx
@@ -0,0 +1,42 @@
+import { useI18n } from "../i18n/useI18n";
+import type { Launch } from "../hooks/useLaunch";
+import { useModProfiles } from "../hooks/useMods";
+import { ErrorText } from "./ErrorText";
+import type { Review } from "./mods/ModFixes";
+
+/**
+ * A refused start of `tag`, where the blocker panel can't say it: a refusal for another reason as
+ * it is, or a refusal because of mods that couldn't be read again, with a way to check again.
+ */
+export function LaunchRefusal({ tag, launch, review }: { tag: string; launch: Launch; review: Review }) {
+  const { t } = useI18n();
+  const { profile } = useModProfiles();
+  const { shownError, unread, storeMissing } = launch.refusalFor(tag);
+  // A mod whose stored copy is gone: the same build installed again brings it back, through its
+  // install dialog; a file from the player's computer, through From file.
+  const missing = storeMissing ? profile(tag)?.mods.find((m) => m.id === storeMissing) : undefined;
+  if (shownError)
+    return (
+      <ErrorText error={shownError} className="launch-error">
+        {missing && review.canUpdate(missing) && (
+          <button className="btn-primary btn-small" data-fix="reinstall" onClick={() => review.openUpdate(missing, missing.sha256)}>
+            {t("mods.reinstall", missing.name)}
+          </button>
+        )}
+        {missing && !review.canUpdate(missing) && missing.origin.kind === "file" && (
+          <button className="btn-primary btn-small" data-fix="replaceFile" onClick={() => review.openFile().catch(() => {})}>
+            {t("mods.replaceFromFile", missing.name)}
+          </button>
+        )}
+      </ErrorText>
+    );
+  if (!unread) return null;
+  const why = unread.unread ?? unread.shown;
+  return (
+    <ErrorText error={{ ...why, message: t("mods.refusedUnread", why.message) }} className="launch-error refused-unread">
+      <button className="btn-secondary btn-small" disabled={launch.rereading} onClick={launch.checkAgain}>
+        {launch.rereading ? t("mods.retrying") : t("mods.refusedRetry")}
+      </button>
+    </ErrorText>
+  );
+}
diff --git a/src/components/LiveRegion.tsx b/src/components/LiveRegion.tsx
new file mode 100644
index 0000000..32070b4
--- /dev/null
+++ b/src/components/LiveRegion.tsx
@@ -0,0 +1,62 @@
+import { createContext, useCallback, useContext, useEffect, useState, type ReactNode } from "react";
+import { Speech } from "./speech";
+
+/**
+ * The one place results are said to a screen reader: a polite live region that exists from the
+ * start, so a message put into it is read even when the control that caused it has gone (a
+ * removed row, a closed dialog). Each message is said once per key. What has been said is held
+ * by the SpeechProvider, one per app tree (./speech).
+ */
+const SpeechContext = createContext<Speech | null>(null);
+
+export function SpeechProvider({ children }: { children: ReactNode }) {
+  const [speech] = useState(() => new Speech());
+  return <SpeechContext.Provider value={speech}>{children}</SpeechContext.Provider>;
+}
+
+export function useSpeech(): Speech {
+  const speech = useContext(SpeechContext);
+  if (!speech) throw new Error("useSpeech outside a SpeechProvider");
+  return speech;
+}
+
+/** Says `text` politely, once per `key`. */
+export function useAnnounce(): (key: string, text: string) => void {
+  const speech = useSpeech();
+  return useCallback((key: string, text: string) => speech.say(key, text), [speech]);
+}
+
+export function LiveRegion() {
+  const speech = useSpeech();
+  const [text, setText] = useState("");
+  useEffect(() => {
+    let clear: ReturnType<typeof setTimeout> | undefined;
+    let frame = 0;
+    // Messages that arrive in the same frame (a result and an error it caused) are said
+    // together, in order, rather than the last one replacing the others.
+    let pending: string[] = [];
+    const stop = speech.listen((t) => {
+      pending.push(t);
+      if (frame) return;
+      // A message the same as the last one would not change the region; clear it first.
+      setText("");
+      frame = requestAnimationFrame(() => {
+        frame = 0;
+        setText(pending.join(" "));
+        pending = [];
+      });
+      clearTimeout(clear);
+      clear = setTimeout(() => setText(""), 8000);
+    });
+    return () => {
+      stop();
+      cancelAnimationFrame(frame);
+      clearTimeout(clear);
+    };
+  }, [speech]);
+  return (
+    <div className="sr-only" role="status" aria-live="polite" aria-atomic="true" data-testid="live-region">
+      {text}
+    </div>
+  );
+}
diff --git a/src/components/Tabs.tsx b/src/components/Tabs.tsx
index 610927a..8a4152b 100644
--- a/src/components/Tabs.tsx
+++ b/src/components/Tabs.tsx
@@ -1,41 +1,59 @@
 import { useI18n } from "../i18n/useI18n";
+import { useRovingTabs } from "../hooks/useRovingTabs";
 import { LanguageMenu } from "./LanguageMenu";
 import { UpdateButton } from "./UpdateButton";
 
-type TabId = "home" | "versions" | "notes";
+export const TAB_IDS = ["home", "versions", "mods", "notes"] as const;
+export type TabId = (typeof TAB_IDS)[number];
 
 interface TabsProps {
   activeTab: TabId;
   onChange: (tab: TabId) => void;
   hasNewVersions: boolean;
+  /** Something on the Mods tab wants a look: an update, or a mod that would stop the game. */
+  modsAttention: boolean;
 }
 
-export function Tabs({ activeTab, onChange, hasNewVersions }: TabsProps) {
+/** The roving tabindex and panel ids; App puts `panel` on the page container. */
+export function useMainTabs(activeTab: TabId, onChange: (tab: TabId) => void) {
+  return useRovingTabs("main", TAB_IDS, activeTab, onChange);
+}
+
+export function Tabs({ activeTab, onChange, hasNewVersions, modsAttention }: TabsProps) {
   const { t } = useI18n();
+  const { tab } = useMainTabs(activeTab, onChange);
 
-  const tabs: { id: TabId; label: string }[] = [
-    { id: "home", label: t("tabHome") },
-    { id: "versions", label: t("tabVersions") },
-    { id: "notes", label: t("tabNotes") },
-  ];
+  const labels: Record<TabId, string> = {
+    home: t("tabHome"),
+    versions: t("tabVersions"),
+    mods: t("tabMods"),
+    notes: t("tabNotes"),
+  };
 
   return (
-    <nav className="tabs" role="tablist" aria-label={t("tabsLabel")}>
-      <span className="bar-name">WEFT</span>
-      {tabs.map((tab) => (
-        <button
-          key={tab.id}
-          role="tab"
-          aria-selected={activeTab === tab.id}
-          aria-controls={`panel-${tab.id}`}
-          id={`tab-${tab.id}`}
-          className={`tab-btn ${activeTab === tab.id ? "active" : ""}`}
-          onClick={() => onChange(tab.id)}
-        >
-          {tab.label}
-          {tab.id === "versions" && hasNewVersions && <span className="new-dot" aria-label="New versions available" />}
-        </button>
-      ))}
+    <nav className="tabs">
+      <span className="bar-name" aria-hidden="true">
+        WEFT
+      </span>
+      <div className="tab-list" role="tablist" aria-label={t("tabsLabel")}>
+        {TAB_IDS.map((id) => (
+          <button key={id} {...tab(id)} className={`tab-btn ${activeTab === id ? "active" : ""}`}>
+            {labels[id]}
+            {id === "versions" && hasNewVersions && (
+              <>
+                <span className="new-dot" aria-hidden="true" />
+                <span className="sr-only">{t("newVersionsDot")}</span>
+              </>
+            )}
+            {id === "mods" && modsAttention && (
+              <>
+                <span className="new-dot" aria-hidden="true" />
+                <span className="sr-only">{t("mods.attentionDot")}</span>
+              </>
+            )}
+          </button>
+        ))}
+      </div>
       <div className="tabs-right">
         <UpdateButton />
         <LanguageMenu />
diff --git a/src/components/Truncate.tsx b/src/components/Truncate.tsx
new file mode 100644
index 0000000..79c9068
--- /dev/null
+++ b/src/components/Truncate.tsx
@@ -0,0 +1,139 @@
+import { ReactNode, createContext, useCallback, useContext, useEffect, useLayoutEffect, useRef, useState } from "react";
+import { createPortal } from "react-dom";
+
+/**
+ * The one tooltip on screen, and the element it belongs to. Showing one hides any other, so a tip
+ * the mouse left behind can't sit beside the focused element's tip, or be taken for it.
+ */
+let openTip: { owner: HTMLElement; hide: () => void } | null = null;
+
+/** Whether `el` has its tooltip showing: then Escape on it closes that tip, and nothing else. */
+export function tipOpenOn(el: EventTarget | null): boolean {
+  return !!openTip && openTip.owner === el;
+}
+
+/**
+ * A tooltip drawn in <body>, so a framed card's clip-path or a scrolling dialog can't cut it off.
+ * It shows on hover and on keyboard focus. Escape on the focused element hides it; the next
+ * Escape goes on to whatever is around it (a dialog closes).
+ */
+export function useTip(text: string, enabled: boolean) {
+  const [at, setAt] = useState<{ left: number; top: number; below: boolean } | null>(null);
+  const owner = useRef<HTMLElement | null>(null);
+  const hide = useCallback(() => {
+    if (openTip && openTip.owner === owner.current) openTip = null;
+    owner.current = null;
+    setAt(null);
+  }, []);
+  const show = useCallback(
+    (el: HTMLElement) => {
+      if (!enabled) return;
+      if (openTip && openTip.owner !== el) openTip.hide();
+      owner.current = el;
+      openTip = { owner: el, hide };
+      const r = el.getBoundingClientRect();
+      const below = r.top < 64;
+      setAt({ left: Math.max(8, Math.min(r.left, window.innerWidth - 328)), top: below ? r.bottom + 4 : r.top - 4, below });
+    },
+    [enabled, hide]
+  );
+  // Gone with its element.
+  useEffect(() => hide, [hide]);
+  const handlers = {
+    onMouseEnter: (e: React.MouseEvent<HTMLElement>) => show(e.currentTarget),
+    onMouseLeave: (e: React.MouseEvent<HTMLElement>) => {
+      // A focused element keeps its tip when the mouse moves off it.
+      if (document.activeElement !== e.currentTarget) hide();
+    },
+    onFocus: (e: React.FocusEvent<HTMLElement>) => show(e.currentTarget),
+    onBlur: hide,
+    onKeyDown: (e: React.KeyboardEvent<HTMLElement>) => {
+      if (e.key === "Escape" && tipOpenOn(e.currentTarget)) {
+        e.stopPropagation();
+        hide();
+      }
+    },
+  };
+  const tip =
+    at &&
+    createPortal(
+      <div
+        className={`tip${at.below ? " below" : ""}`}
+        style={{ left: Math.round(at.left), top: Math.round(at.top) }}
+        aria-hidden="true"
+      >
+        {text}
+      </div>,
+      document.body
+    );
+  return { handlers, tip };
+}
+
+interface TruncateProps {
+  text: string;
+  className?: string;
+  /** Lines before the ellipsis. */
+  lines?: 1 | 2 | 3;
+  children?: ReactNode;
+  /**
+   * A tab stop of its own when cut, so the keyboard reaches the full text: only for text that
+   * appears once on a page. In a list's rows and cards it isn't one; the row shows the text whole
+   * while focus is in it (style.css, `[data-focus-scope]:focus-within`), so a row stays a few Tabs.
+   */
+  focusable?: boolean;
+  id?: string;
+}
+
+/**
+ * Text that may be cut off with an ellipsis. When it is, the full text shows on hover, and on
+ * focus where it is `focusable`. Screen readers get the full text anyway: the ellipsis is only drawn.
+ */
+export function Truncate({ text, className = "", lines = 1, children, focusable = false, id }: TruncateProps) {
+  const ref = useRef<HTMLSpanElement>(null);
+  const [cut, setCut] = useState(false);
+
+  useLayoutEffect(() => {
+    const el = ref.current;
+    if (!el) return;
+    const check = () => setCut(el.scrollWidth > el.clientWidth + 1 || el.scrollHeight > el.clientHeight + 1);
+    check();
+    const ro = new ResizeObserver(check);
+    ro.observe(el);
+    return () => ro.disconnect();
+  }, [text, lines]);
+
+  const { handlers, tip } = useTip(text, cut);
+  return (
+    <>
+      <span ref={ref} id={id} className={`truncate lines-${lines} ${className}${cut ? " is-cut" : ""}`} tabIndex={cut && focusable ? 0 : undefined} {...handlers}>
+        {children ?? text}
+      </span>
+      {tip}
+    </>
+  );
+}
+
+/**
+ * Whether shortened values show whole: a check list's one "details" control turns it on, so the
+ * keyboard reaches every full hash and commit with one press instead of a Tab per value.
+ */
+export const FullValues = createContext(false);
+
+/**
+ * A shortened hash, commit or interface id. The full value is a hover away, whole where
+ * FullValues is on, and always what a screen reader hears. Never a tab stop of its own.
+ */
+export function Code({ full, short }: { full: string; short: string }) {
+  const whole = useContext(FullValues);
+  const { handlers, tip } = useTip(full, short !== full && !whole);
+  if (short === full || whole) return <code className={short === full ? undefined : "code-full"}>{full}</code>;
+  return (
+    <>
+      <code className="code-short" {...handlers}>
+        <span aria-hidden="true">{short}</span>
+        <span className="sr-only">{full}</span>
+      </code>
+      {tip}
+    </>
+  );
+}
diff --git a/src/components/VersionActions.tsx b/src/components/VersionActions.tsx
index 1dcb811..c7fecbd 100644
--- a/src/components/VersionActions.tsx
+++ b/src/components/VersionActions.tsx
@@ -1,8 +1,16 @@
-import { useState, useEffect } from "react";
 import { useInstall, InstalledVersion, InstallProgress } from "../hooks/useInstall";
 import { useGameState } from "../hooks/useGameState";
+import { useModProfiles } from "../hooks/useMods";
+import { useLaunch } from "../hooks/useLaunch";
+import { useConfirmPress } from "../hooks/useConfirmPress";
 import { useI18n } from "../i18n/useI18n";
 import { StableLabel } from "./StableLabel";
+import { ErrorText } from "./ErrorText";
+import { LaunchRefusal } from "./LaunchRefusal";
+import { useAnnounce } from "./LiveRegion";
+import { BlockerPanel, useReviewDialog } from "./mods/ModFixes";
+import { ModFailureNotice } from "./mods/ModFailureNotice";
+import { unreachable } from "../utils/never";
 
 interface VersionActionsProps {
   release: {
@@ -15,49 +23,44 @@ interface VersionActionsProps {
     };
   };
   installedVersion: InstalledVersion | null;
+  /** Opens the Mods tab on this version, where what blocks it can be fixed. */
+  onFixMods?: (tag: string) => void;
 }
 
-export function VersionActions({ release, installedVersion }: VersionActionsProps) {
-  const { t } = useI18n();
+export function VersionActions({ release, installedVersion, onFixMods }: VersionActionsProps) {
+  const announce = useAnnounce();
+  const { t, tn } = useI18n();
   const { progress, busy: busyTags, errors, install, remove } = useInstall();
-  const { anyRunning, isRunning, launch, runningTags } = useGameState();
-
-  const [confirmDelete, setConfirmDelete] = useState(false);
-  const [launchError, setLaunchError] = useState<string | null>(null);
+  const { profile } = useModProfiles();
+  const report = installedVersion ? profile(release.tag) : undefined;
+  const modCount = report?.mods.length ?? 0;
+  const blocked = (report?.blocking.length ?? 0) > 0;
+  const { anyRunning, isRunning, runningTags, lastCrash } = useGameState();
+  const launch = useLaunch();
+  const review = useReviewDialog(installedVersion ? release.tag : null);
 
   const busy = !!busyTags[release.tag];
   const currentProgress = busy ? progress[release.tag] : undefined;
   const error = errors[release.tag];
   const thisVersionRunning = isRunning(release.tag);
+  const starting = launch.launching === release.tag;
+  // Play was refused here because of mods: the blockers show here, with their fixes, until fixed.
+  const refusedForMods = launch.refusalFor(release.tag).refusedForMods;
+  const crash = installedVersion && lastCrash?.tag === release.tag ? lastCrash : null;
 
-  useEffect(() => {
-    if (confirmDelete) {
-      const timer = setTimeout(() => {
-        setConfirmDelete(false);
-      }, 4000);
-      return () => clearTimeout(timer);
-    }
-  }, [confirmDelete]);
+  // Deleting a version deletes its mod set too: the same deliberate confirmation as a mod's Remove.
+  const deletion = useConfirmPress({
+    onAsk: () =>
+      announce(`delete-ask:${release.tag}:${Date.now()}`, t(modCount > 0 ? "deleteConfirmHint" : "deleteConfirmHintBare", release.tag)),
+    onCancel: (said) => said && announce(`delete-cancelled:${release.tag}:${Date.now()}`, t("deleteCancelled", release.tag)),
+    onDoubleClick: () => announce(`delete-double:${release.tag}:${Date.now()}`, t("deleteDoubleClick", release.tag)),
+    onConfirm: () => remove(release.tag),
+  });
+  const confirmDelete = deletion.confirming;
 
   const handleInstall = () =>
     install(release.tag, release.asset.url, release.asset.name, release.asset.sha256);
 
-  const handleRemove = async () => {
-    if (!confirmDelete) {
-      setConfirmDelete(true);
-      return;
-    }
-
-    // Second click - proceed with deletion
-    setConfirmDelete(false);
-    await remove(release.tag);
-  };
-
-  const handleLaunch = async () => {
-    setLaunchError(null);
-    setLaunchError(await launch(release.tag));
-  };
-
   const getProgressLabel = (current: InstallProgress): string => {
     switch (current.stage) {
       case "downloading":
@@ -72,6 +75,8 @@ export function VersionActions({ release, installedVersion }: VersionActionsProp
         return t("progressExtracting");
       case "finalizing":
         return t("progressFinalizing");
+      default:
+        return unreachable(current.stage);
     }
   };
 
@@ -79,51 +84,65 @@ export function VersionActions({ release, installedVersion }: VersionActionsProp
   const playTooltip = anyRunning && otherRunningTag ? t("playDisabledTooltip", otherRunningTag) : undefined;
 
   const deleteDisabled = anyRunning || busy;
-  const playDisabled = anyRunning || thisVersionRunning || busy;
+  const playDisabled = anyRunning || thisVersionRunning || busy || blocked || !!launch.launching;
+  const blockedId = `blocked-${release.tag}`;
+  const playText = thisVersionRunning ? t("playing") : starting ? t("starting") : t("playButton");
+  const confirmText = modCount > 0 ? tn("deleteWithMods", modCount) : t("deleteForReal");
 
   if (installedVersion) {
     return (
       <div className="version-actions installed">
         <button
           className="play-btn"
-          onClick={handleLaunch}
+          onClick={() => launch.start(release.tag)}
           disabled={playDisabled}
           title={playTooltip}
-          aria-label={thisVersionRunning ? t("playing") : t("playButton")}
+          aria-label={playText}
+          aria-describedby={blocked ? (refusedForMods ? `${blockedId}-why` : blockedId) : undefined}
+          aria-busy={starting || undefined}
         >
-          <StableLabel
-            text={thisVersionRunning ? t("playing") : t("playButton")}
-            widest={[t("playing"), t("playButton")]}
-          />
+          <StableLabel text={playText} widest={[t("playing"), t("starting"), t("playButton")]} />
         </button>
         <button
           className={`delete-btn${confirmDelete ? " confirming" : ""}`}
-          onClick={handleRemove}
           disabled={deleteDisabled}
           title={anyRunning ? t("deleteDisabledTooltip") : undefined}
-          aria-label={confirmDelete ? t("deleteForReal") : t("deleteButton")}
+          aria-label={confirmDelete ? confirmText : t("deleteButton")}
+          {...deletion.handlers}
         >
-          <StableLabel
-            text={confirmDelete ? t("deleteForReal") : t("deleteButton")}
-            widest={[t("deleteForReal"), t("deleteButton")]}
-          />
+          <StableLabel text={confirmDelete ? confirmText : t("deleteButton")} widest={[confirmText, t("deleteButton")]} />
         </button>
-        {(launchError || error) && (
-          <div className="install-error" role="alert">
-            {launchError || error}
+        {blocked && !thisVersionRunning && !refusedForMods && (
+          <span className="version-note bad">
+            <span id={blockedId}>{t("versionModsBlocked")}</span>
+            {onFixMods && (
+              <button className="btn-secondary btn-small" onClick={() => onFixMods(release.tag)}>
+                {t("mods.homeFixInMods")}
+              </button>
+            )}
+          </span>
+        )}
+        {/* Play was refused here: why, and the fixes, here too, as on Home. */}
+        {refusedForMods && blocked && (
+          <div className="version-blockers">
+            <BlockerPanel id={blockedId} tag={release.tag} locked={anyRunning} review={review} />
+          </div>
+        )}
+        <LaunchRefusal tag={release.tag} launch={launch} review={review} />
+        {error && <ErrorText error={error} className="install-error" />}
+        {crash && (
+          <div className="version-crash">
+            <ModFailureNotice crash={crash} review={review} onGoToMods={onFixMods ? () => onFixMods(release.tag) : undefined} />
           </div>
         )}
+        {review.dialog}
       </div>
     );
   }
 
   return (
     <div className="version-actions">
-      {error && (
-        <div className="install-error" role="alert">
-          {error}
-        </div>
-      )}
+      {error && <ErrorText error={error} className="install-error" />}
 
       {/* In the button's place and no taller than it, so the list doesn't jump during an install. */}
       {currentProgress ? (
diff --git a/src/components/VersionSelect.tsx b/src/components/VersionSelect.tsx
index e11fa60..770927c 100644
--- a/src/components/VersionSelect.tsx
+++ b/src/components/VersionSelect.tsx
@@ -1,4 +1,5 @@
-import { useEffect, useRef, useState } from "react";
+import { useEffect, useId, useRef, useState } from "react";
+import { TYPE_AHEAD_MS, typeAhead } from "./typeAhead";
 
 interface Option {
   value: string;
@@ -10,14 +11,29 @@ interface VersionSelectProps {
   options: Option[];
   onChange: (value: string) => void;
   disabled: boolean;
-  label: string;
+  /** The accessible name, when there is no visible label to point at. */
+  label?: string;
+  /** The id of a visible label. */
+  labelledBy?: string;
+  /** One line tall, for dialogs and page headers. */
+  compact?: boolean;
 }
 
-// Not a native <select>: its popup is drawn by the system and can't take the launcher's look.
-export function VersionSelect({ value, options, onChange, disabled, label }: VersionSelectProps) {
+/**
+ * Not a native <select>: its popup is drawn by the system and can't take the launcher's look.
+ * The ARIA select-only combobox: focus stays on the trigger, which is a `combobox` that controls
+ * the `listbox`; `aria-activedescendant` (valid on a combobox) names the option the arrow keys are
+ * on, and that option is the one with `aria-selected`, as the pattern has it. The chosen value
+ * is the trigger's text, and is marked in the list by its look only.
+ */
+export function VersionSelect({ value, options, onChange, disabled, label, labelledBy, compact = false }: VersionSelectProps) {
   const [open, setOpen] = useState(false);
   const [cursor, setCursor] = useState(0);
   const root = useRef<HTMLDivElement>(null);
+  /** What has been typed since the last pause, for type-ahead. */
+  const typed = useRef({ text: "", at: 0 });
+  const listId = useId();
+  const optionId = (i: number) => `${listId}-opt-${i}`;
 
   const current = options.find((o) => o.value === value);
 
@@ -34,6 +50,11 @@ export function VersionSelect({ value, options, onChange, disabled, label }: Ver
     if (disabled) setOpen(false);
   }, [disabled]);
 
+  useEffect(() => {
+    if (open) document.getElementById(optionId(cursor))?.scrollIntoView({ block: "nearest" });
+    // optionId depends only on listId, which never changes.
+  }, [open, cursor]);
+
   const show = () => {
     setCursor(Math.max(0, options.findIndex((o) => o.value === value)));
     setOpen(true);
@@ -41,10 +62,32 @@ export function VersionSelect({ value, options, onChange, disabled, label }: Ver
 
   const choose = (next: string) => {
     setOpen(false);
-    onChange(next);
+    if (next !== value) onChange(next);
+  };
+
+  /** A printable key: moves to the next version that starts with what was typed, opening the list. */
+  const typeKey = (key: string, from: number) => {
+    const now = Date.now();
+    const text = (now - typed.current.at > TYPE_AHEAD_MS ? "" : typed.current.text) + key;
+    typed.current = { text, at: now };
+    const i = typeAhead(
+      options.map((o) => o.label),
+      text,
+      from
+    );
+    if (i >= 0) setCursor(i);
+    if (!open) setOpen(true);
   };
+  const printable = (e: React.KeyboardEvent) => e.key.length === 1 && !e.ctrlKey && !e.metaKey && !e.altKey;
+  const typing = () => Date.now() - typed.current.at <= TYPE_AHEAD_MS && typed.current.text !== "";
 
   const onKeyDown = (e: React.KeyboardEvent) => {
+    // A space while typing is part of the word; otherwise it chooses, as Enter does.
+    if (printable(e) && (e.key !== " " || typing())) {
+      e.preventDefault();
+      typeKey(e.key, open ? cursor : Math.max(0, options.findIndex((o) => o.value === value)));
+      return;
+    }
     if (!open) {
       if (e.key === "ArrowDown" || e.key === "ArrowUp") {
         e.preventDefault();
@@ -53,6 +96,10 @@ export function VersionSelect({ value, options, onChange, disabled, label }: Ver
       return;
     }
     if (e.key === "Escape") {
+      // Closes the list, not the dialog around it: Dialog skips Escape on an open popup.
+      e.preventDefault();
+      setOpen(false);
+    } else if (e.key === "Tab") {
       setOpen(false);
     } else if (e.key === "ArrowDown") {
       e.preventDefault();
@@ -60,6 +107,12 @@ export function VersionSelect({ value, options, onChange, disabled, label }: Ver
     } else if (e.key === "ArrowUp") {
       e.preventDefault();
       setCursor((c) => Math.max(0, c - 1));
+    } else if (e.key === "Home") {
+      e.preventDefault();
+      setCursor(0);
+    } else if (e.key === "End") {
+      e.preventDefault();
+      setCursor(options.length - 1);
     } else if (e.key === "Enter" || e.key === " ") {
       e.preventDefault();
       choose(options[cursor].value);
@@ -67,38 +120,51 @@ export function VersionSelect({ value, options, onChange, disabled, label }: Ver
   };
 
   return (
-    <div className="version-select" ref={root} onKeyDown={onKeyDown}>
+    <div className={`version-select${compact ? " compact" : ""}`} ref={root}>
       <button
         type="button"
+        role="combobox"
         className="version-select-btn"
         disabled={disabled}
-        aria-label={label}
+        aria-label={labelledBy ? undefined : label}
+        aria-labelledby={labelledBy}
         aria-haspopup="listbox"
         aria-expanded={open}
+        aria-controls={listId}
+        aria-activedescendant={open ? optionId(cursor) : undefined}
         onClick={() => (open ? setOpen(false) : show())}
+        onKeyDown={onKeyDown}
       >
         <span>{current?.label ?? ""}</span>
         <svg width="16" height="8" viewBox="0 0 8 4" fill="currentColor" aria-hidden="true">
           <path d="M0 0h8v1h-1v1h-1v1h-1v1h-2v-1h-1v-1h-1v-1h-1z" />
         </svg>
       </button>
-      {open && (
-        <ul className="version-select-menu" role="listbox" aria-label={label}>
-          {options.map((o, i) => (
-            <li key={o.value} role="option" aria-selected={o.value === value}>
-              <button
-                type="button"
-                tabIndex={-1}
-                className={`version-select-item${o.value === value ? " active" : ""}${i === cursor ? " cursor" : ""}`}
-                onMouseEnter={() => setCursor(i)}
-                onClick={() => choose(o.value)}
-              >
-                {o.label}
-              </button>
+      <ul
+        className="version-select-menu"
+        role="listbox"
+        id={listId}
+        aria-label={label}
+        aria-labelledby={labelledBy}
+        tabIndex={-1}
+        hidden={!open}
+      >
+        {open &&
+          options.map((o, i) => (
+            <li
+              key={o.value}
+              id={optionId(i)}
+              role="option"
+              aria-selected={i === cursor}
+              className={`version-select-item${o.value === value ? " active" : ""}${i === cursor ? " cursor" : ""}`}
+              onMouseEnter={() => setCursor(i)}
+              onMouseDown={(e) => e.preventDefault()}
+              onClick={() => choose(o.value)}
+            >
+              {o.label}
             </li>
           ))}
-        </ul>
-      )}
+      </ul>
     </div>
   );
 }
diff --git a/src/components/focusRescue.ts b/src/components/focusRescue.ts
new file mode 100644
index 0000000..cf04683
--- /dev/null
+++ b/src/components/focusRescue.ts
@@ -0,0 +1,72 @@
+// Focus never falls to the page body. When the focused element goes away (a card's Install
+// becomes "Installed", a dialog closes after its opener was replaced), focus moves to the nearest
+// place that is still there: the first control in the closest `data-focus-scope` around where it
+// was (a card, a row, a version), else the page's heading.
+
+const FOCUSABLE =
+  'button:not(:disabled), input:not(:disabled), select:not(:disabled), textarea:not(:disabled), [href], [tabindex]:not([tabindex="-1"])';
+
+function canFocus(el: Element): el is HTMLElement {
+  return el instanceof HTMLElement && el.getClientRects().length > 0 && !el.closest("[hidden], [inert], .sr-only");
+}
+
+/** The scopes around an element, nearest first, kept so they can be found once it is gone. */
+export function scopesOf(el: Element | null): HTMLElement[] {
+  const out: HTMLElement[] = [];
+  for (let a = el?.parentElement ?? null; a; a = a.parentElement) if (a.hasAttribute("data-focus-scope")) out.push(a);
+  return out;
+}
+
+/**
+ * Focuses the first control of the nearest scope still on the page, else the scope itself, else
+ * the page's heading. Returns whether focus went somewhere.
+ */
+export function focusNear(scopes: HTMLElement[]): boolean {
+  for (const scope of scopes) {
+    if (!scope.isConnected) continue;
+    const target = [...scope.querySelectorAll(FOCUSABLE)].find(canFocus);
+    if (target) {
+      target.focus({ preventScroll: true });
+      return true;
+    }
+    if (canFocus(scope)) {
+      if (!scope.hasAttribute("tabindex")) scope.tabIndex = -1;
+      scope.focus({ preventScroll: true });
+      return true;
+    }
+  }
+  const heading = document.querySelector<HTMLElement>("main h1");
+  if (!heading) return false;
+  if (!heading.hasAttribute("tabindex")) heading.tabIndex = -1;
+  heading.focus({ preventScroll: true });
+  return true;
+}
+
+/**
+ * Watches the whole page: remembers where focus was, and when that element leaves the page
+ * while focus is on the body, moves focus near where it was. Returns a function that stops it.
+ */
+export function watchFocus(): () => void {
+  let last: { el: Element; scopes: HTMLElement[]; inDialog: boolean } | null = null;
+  const onFocusIn = (e: FocusEvent) => {
+    if (e.target instanceof Element && e.target !== document.body) {
+      last = { el: e.target, scopes: scopesOf(e.target), inDialog: !!e.target.closest("[role=dialog]") };
+    }
+  };
+  const rescue = () => {
+    const active = document.activeElement;
+    if (!last || last.el.isConnected || (active && active !== document.body)) return;
+    // A dialog keeps its own focus, and gives it back to its opener when it closes (Dialog).
+    if (last.inDialog || document.querySelector("[role=dialog]")) return;
+    const { scopes } = last;
+    last = null;
+    focusNear(scopes);
+  };
+  const observer = new MutationObserver(rescue);
+  observer.observe(document.body, { childList: true, subtree: true });
+  document.addEventListener("focusin", onFocusIn);
+  return () => {
+    observer.disconnect();
+    document.removeEventListener("focusin", onFocusIn);
+  };
+}
diff --git a/src/components/icons.ts b/src/components/icons.ts
new file mode 100644
index 0000000..fbaafd0
--- /dev/null
+++ b/src/components/icons.ts
@@ -0,0 +1,10 @@
+// Pixel icons used in more than one place, on the font's grid.
+
+export const REFRESH_ICON = [
+  ".###.#",
+  "#...##",
+  "#..###",
+  "#.....",
+  "#...#.",
+  ".###..",
+];
diff --git a/src/components/mods/BannerStack.tsx b/src/components/mods/BannerStack.tsx
new file mode 100644
index 0000000..e093372
--- /dev/null
+++ b/src/components/mods/BannerStack.tsx
@@ -0,0 +1,117 @@
+import { ReactNode, useId, useLayoutEffect, useRef, useState } from "react";
+import { useI18n } from "../../i18n/useI18n";
+import { Truncate } from "../Truncate";
+
+export type Tone = "info" | "ok" | "warn" | "bad";
+
+export interface BannerItem {
+  id: string;
+  tone: Tone;
+  text: ReactNode;
+  /**
+   * For the collapsed row: the cause in a few words, never cut ("Index unreachable: no Reviewed
+   * mods"), and what it is about, which may be cut (a repo, a list of names).
+   */
+  cause?: string;
+  subject?: string;
+  actions?: ReactNode;
+  /** The one button the collapsed row offers for it, when that differs from `actions`. */
+  foldActions?: ReactNode;
+  /**
+   * Folded notes are listed by this, lowest first. The first one leads the collapsed row, with
+   * its own buttons, so a note ranked first is never out of sight.
+   */
+  rank?: number;
+  /** Said to a screen reader as it appears: an error from the player's own action. */
+  alert?: boolean;
+}
+
+const ORDER: Record<Tone, number> = { bad: 0, warn: 1, info: 2, ok: 3 };
+
+function Banner({ item, className = "banner" }: { item: BannerItem; className?: string }) {
+  return (
+    <div className={`${className} ${item.tone}`} role={item.alert ? "alert" : undefined} data-banner={item.id}>
+      <span className="banner-text">{item.text}</span>
+      {item.actions && <span className="banner-actions">{item.actions}</span>}
+    </div>
+  );
+}
+
+/**
+ * Banners above a list. What must not be missed shows in full; the rest folds into one row that
+ * opens on demand. Open, the notes scroll inside a box of bounded height, so the list below
+ * keeps its place on screen.
+ *
+ * The toggle is one button in both states, so it keeps focus when it flips.
+ */
+export function BannerStack({ full, quiet }: { full: BannerItem[]; quiet: BannerItem[] }) {
+  const { t, tn } = useI18n();
+  const [open, setOpen] = useState(false);
+  const listId = useId();
+  const sorted = [...quiet].sort((a, b) => (a.rank ?? 9) - (b.rank ?? 9) || ORDER[a.tone] - ORDER[b.tone]);
+  if (!full.length && !sorted.length) return null;
+  const first = sorted[0];
+
+  return (
+    <div className="banners">
+      {full.map((item) => (
+        <Banner key={item.id} item={item} />
+      ))}
+      {first && (
+        <div className={`banner-fold ${open ? "open" : `banner ${first.tone} compact`}${full.length ? " docked" : ""}`} data-banner-fold={first.id}>
+          {!open && (
+            <>
+              <span className="banner-text banner-summary">
+                {first.cause ? (
+                  <>
+                    <span className="banner-cause" data-must-fit>
+                      {first.cause}
+                    </span>
+                    {first.subject && <Truncate focusable className="banner-subject" text={first.subject} />}
+                  </>
+                ) : (
+                  first.text
+                )}
+              </span>
+              {(first.foldActions ?? first.actions) && <span className="banner-actions">{first.foldActions ?? first.actions}</span>}
+            </>
+          )}
+          <div className="banner-group" id={listId} hidden={!open}>
+            {open && sorted.map((item) => <Banner key={item.id} item={item} />)}
+          </div>
+          <button className="btn-flat banner-toggle" aria-expanded={open} aria-controls={listId} onClick={() => setOpen(!open)}>
+            {open ? t("mods.bannersFold") : sorted.length > 1 ? tn("mods.bannersMore", sorted.length) : t("mods.bannersOpen")}
+          </button>
+        </div>
+      )}
+    </div>
+  );
+}
+
+/**
+ * Answers to what the player just did (Removed, with Undo; Installed; Copied; a failed action),
+ * over the bottom of the list. They never push the list down, and the list makes room under its
+ * last row for them (`onHeight`), so no row's buttons stay hidden behind one.
+ */
+export function Toasts({ items, onHeight }: { items: BannerItem[]; onHeight: (px: number) => void }) {
+  const { t } = useI18n();
+  const ref = useRef<HTMLDivElement>(null);
+  const report = useRef(onHeight);
+  report.current = onHeight;
+  useLayoutEffect(() => {
+    const el = ref.current;
+    if (!el) return;
+    const measure = () => report.current(items.length ? Math.ceil(el.getBoundingClientRect().height) : 0);
+    measure();
+    const ro = new ResizeObserver(measure);
+    ro.observe(el);
+    return () => ro.disconnect();
+  }, [items.length]);
+  return (
+    <div className="toasts" ref={ref} role="region" aria-label={t("mods.toastsLabel")} hidden={!items.length}>
+      {items.map((item) => (
+        <Banner key={item.id} item={item} className="banner toast" />
+      ))}
+    </div>
+  );
+}
diff --git a/src/components/mods/BrowseList.tsx b/src/components/mods/BrowseList.tsx
new file mode 100644
index 0000000..e889874
--- /dev/null
+++ b/src/components/mods/BrowseList.tsx
@@ -0,0 +1,200 @@
+import { useId, useMemo, useState } from "react";
+import { useI18n } from "../../i18n/useI18n";
+import { showError } from "../../i18n/errors";
+import { activeStep } from "../../mods/checks";
+import { ErrorText } from "../ErrorText";
+import { useMods } from "../../hooks/useMods";
+import type { CatalogMod, ProfileReport } from "../../mods/types";
+import { fittingVersions, installedFor, matchesSearch, networkDown } from "../../mods/select";
+import { Truncate } from "../Truncate";
+import { ModIcon } from "./ModIcon";
+import { ModProgressBar } from "./ModProgressBar";
+import { InstallDialog } from "./InstallDialog";
+import { ChannelBadge, TrustBadge } from "./TrustBadge";
+
+interface BrowseListProps {
+  report: ProfileReport;
+  locked: boolean;
+}
+
+export function BrowseList({ report, locked }: BrowseListProps) {
+  const { t, formatList } = useI18n();
+  const { catalog, catalogLoading, catalogError, refreshCatalog, progressOf, nameIn } = useMods();
+  const [query, setQuery] = useState("");
+  const [onlyFitting, setOnlyFitting] = useState(true);
+  const [prereleases, setPrereleases] = useState(false);
+  const [open, setOpen] = useState<CatalogMod | null>(null);
+  const searchId = useId();
+  const listId = useId().replace(/:/g, "");
+  const tag = report.tag;
+  const offline = networkDown(catalog, catalogError);
+  const noIndex = !!catalog && (catalog.index.freshness === "unavailable" || !catalog.index.generated);
+  const abi = report.versionAbi;
+
+  const rows = useMemo(() => {
+    return (catalog?.mods ?? [])
+      .filter((m) => matchesSearch(m, query))
+      .map((m) => ({
+        mod: m,
+        best: fittingVersions(catalog, m, abi, prereleases)[0],
+        installed: installedFor(m, report.mods),
+      }))
+      .filter((r) => !onlyFitting || r.best || r.installed)
+      .filter((r) => prereleases || r.mod.versions.some((v) => v.channel === "release") || r.installed);
+  }, [catalog, query, abi, prereleases, onlyFitting, report.mods]);
+
+  // No catalogue at all: say why and offer to try again, never "no mods fit".
+  if (!catalog) {
+    return catalogError && !catalogLoading ? (
+      <div className="empty-state framed-empty">
+        <p>{t("mods.catalogFailed")}</p>
+        <ErrorText error={showError(catalogError)} className="hint" />
+        <div className="empty-actions">
+          <button className="btn-primary" onClick={refreshCatalog}>
+            {t("mods.retry")}
+          </button>
+        </div>
+      </div>
+    ) : (
+      <div className="empty-state" role="status">
+        {t("loading")}
+      </div>
+    );
+  }
+
+  return (
+    <>
+      <div className="filters">
+        <label className="sr-only" htmlFor={searchId}>
+          {t("mods.searchPlaceholder")}
+        </label>
+        <input
+          id={searchId}
+          className="text-input search"
+          type="search"
+          value={query}
+          onChange={(e) => setQuery(e.target.value)}
+          placeholder={t("mods.searchPlaceholder")}
+          spellCheck={false}
+        />
+        <label className="checkbox">
+          <input type="checkbox" checked={onlyFitting} onChange={(e) => setOnlyFitting(e.target.checked)} />
+          <span className="box" aria-hidden="true" />
+          {t("mods.filterFits", tag)}
+        </label>
+        <label className="checkbox">
+          <input type="checkbox" checked={prereleases} onChange={(e) => setPrereleases(e.target.checked)} />
+          <span className="box" aria-hidden="true" />
+          {t("mods.filterPrereleases")}
+        </label>
+      </div>
+
+      {/* No index: every card is from a source, and where Reviewed mods would be, says so. */}
+      {rows.length === 0 ? (
+        <div className="empty-state">
+          <p>
+            {query
+              ? t("mods.browseEmpty")
+              : onlyFitting
+                ? t("mods.browseEmptyFits", tag)
+                : t("mods.browseEmptyAll")}
+          </p>
+          <div className="empty-actions">
+            {query && (
+              <button className="btn-secondary" onClick={() => setQuery("")}>
+                {t("mods.clearSearch")}
+              </button>
+            )}
+            {onlyFitting && catalog.mods.length > 0 && (
+              <button className="btn-secondary" onClick={() => setOnlyFitting(false)}>
+                {t("mods.showAll")}
+              </button>
+            )}
+          </div>
+        </div>
+      ) : (
+        <ul className="mod-grid" aria-label={t("mods.tabBrowse")}>
+          {rows.map(({ mod, best, installed }) => {
+            const shown = best ?? mod.versions[0];
+            // Installed and nothing better to offer: say so instead of a button that can't work.
+            const isCurrent = installed && (!best || installed.sha256 === best.sha256);
+            const onlyPre = !best && fittingVersions(catalog, mod, abi, true).length > 0;
+            const events = progressOf({ kind: "mod", tag, id: mod.id });
+            const p = events.length ? activeStep(events) : undefined;
+            const who = mod.origin.kind === "source" ? mod.origin.repo : formatList(mod.authors) || mod.id;
+            const cardId = `${listId}-${mod.key.replace(/[^A-Za-z0-9_-]/g, "_")}`;
+            const needsNet = offline && !!best && !p && !isCurrent;
+            const what = best ? best.version : onlyPre ? t("mods.onlyPrerelease") : t("mods.notForVersion", tag);
+            return (
+              <li key={mod.key} className={`mod-card framed${needsNet ? " needs-net-card" : ""}`} data-key={mod.key} data-focus-scope>
+                <div className="mod-card-head">
+                  <ModIcon id={mod.id} url={mod.icon} />
+                  {/* The name has the whole width; the tier sits on the line under it. */}
+                  {/* The name opens the mod's details: its whole summary, authors, versions and
+                      checks, in one place rather than a tooltip per field. */}
+                  <div className="mod-card-title">
+                    <button
+                      className="mod-name-btn"
+                      onClick={() => setOpen(mod)}
+                      aria-label={t("mods.detailsLabel", mod.name)}
+                      aria-describedby={shown ? `${cardId}-tier` : undefined}
+                    >
+                      <Truncate className="mod-name" text={mod.name} />
+                    </button>
+                  </div>
+                  {/* The tier, the channel and the version (or why there is none to install),
+                      each whole: what doesn't fit beside the others goes to the next line. */}
+                  <div className="mod-badges">
+                    {shown && <TrustBadge trust={shown.trust} hintId={`${cardId}-tier`} />}
+                    {best && <ChannelBadge channel={best.channel} />}
+                    <span className="mod-card-version" data-must-fit>
+                      {what}
+                    </span>
+                  </div>
+                </div>
+                {/* The start of what it is; all of it, with the authors and checks, is in its details.
+                    Offline, the network note takes its line, so two rows of cards still fit. */}
+                {!needsNet && <Truncate className="mod-summary" text={mod.summary || t("mods.noSummary")} lines={1} />}
+                {/* Who it is from, whole: it wraps rather than being cut. */}
+                <span className="mod-card-by" data-must-fit>
+                  {t("mods.by", who)}
+                </span>
+                <div className="mod-card-foot">
+                  {p ? (
+                    <ModProgressBar progress={p} nameOf={(x) => (x.modId === mod.id ? mod.name : nameIn(tag)(x.modId))} compact />
+                  ) : isCurrent ? (
+                    <span className="installed-mark">{t("mods.installed")}</span>
+                  ) : (
+                    <>
+                      <button
+                        className="btn-primary btn-small"
+                        disabled={!best || locked}
+                        onClick={() => setOpen(mod)}
+                        aria-label={t(installed ? "mods.updateLabel" : "mods.installLabel", mod.name, tag)}
+                        aria-describedby={needsNet ? `${cardId}-net` : undefined}
+                      >
+                        {t(installed ? "mods.updateButton" : "mods.install")}
+                      </button>
+                      {/* A download needs the network, and it was down at the last try. */}
+                      {needsNet && (
+                        <small className="needs-net" id={`${cardId}-net`}>
+                          {t("mods.needsNetworkShort")}
+                        </small>
+                      )}
+                    </>
+                  )}
+                </div>
+              </li>
+            );
+          })}
+        </ul>
+      )}
+      {noIndex && !query && (
+        <p className="browse-note" data-testid="browse-no-index">
+          {t("mods.browseNoIndex")}
+        </p>
+      )}
+      {open && <InstallDialog tag={tag} mod={open} allowPrerelease={prereleases} onClose={() => setOpen(null)} />}
+    </>
+  );
+}
diff --git a/src/components/mods/CheckList.tsx b/src/components/mods/CheckList.tsx
new file mode 100644
index 0000000..f082a6d
--- /dev/null
+++ b/src/components/mods/CheckList.tsx
@@ -0,0 +1,131 @@
+import { useCallback, useId, useRef, useState } from "react";
+import { useI18n } from "../../i18n/useI18n";
+import type { MessageKey } from "../../i18n";
+import type { CheckRow, CheckState } from "../../mods/checks";
+import { PixelIcon } from "../PixelIcon";
+import { CHECK, CROSS, EQUALS, QUESTION } from "./glyphs";
+import { RichText } from "./RichText";
+import { TrustBadge } from "./TrustBadge";
+import { FullValues } from "../Truncate";
+
+const GLYPH: Record<CheckState, string[]> = { yes: CHECK, no: CROSS, unknown: QUESTION, same: EQUALS };
+const SPOKEN: Record<CheckState, MessageKey> = { yes: "mods.ckPassed", no: "mods.ckFailed", unknown: "mods.ckUnknown", same: "mods.ckSame" };
+
+/** A check's mark, and its result in words for a screen reader. */
+export function CheckMark({ state, said }: { state: CheckState; said?: MessageKey | null }) {
+  const { t } = useI18n();
+  return (
+    <>
+      <span className="check-mark" aria-hidden="true">
+        <PixelIcon rows={GLYPH[state]} />
+      </span>
+      {said !== null && <span className="sr-only">{t(said ?? SPOKEN[state])}: </span>}
+    </>
+  );
+}
+
+/** Whether a row carries a shortened value (a hash, a commit) whose full form can be shown. */
+const hasCode = (c: CheckRow) => [c.title, c.detail].some((m) => m?.args?.some((a) => typeof a === "object" && "code" in a));
+
+/**
+ * What was checked, one line each. A list, so a screen reader reads it as one, each row with its
+ * result first. A row that couldn't be found out offers Retry, when there is a way to retry.
+ *
+ * The checks that passed fold into one line ("5 checks passed · Show"), so what failed or is
+ * unknown stays in view above the dialog's buttons in a small window; so do details that only say
+ * again what is above them (`aside`). That line's one control shows them, and every shortened hash
+ * and commit in the list whole: one tab stop for all of it.
+ */
+export function CheckList({
+  checks,
+  label,
+  onRetry,
+  retrying = false,
+  whole = false,
+}: {
+  checks: CheckRow[];
+  label: string;
+  onRetry?: () => void;
+  retrying?: boolean;
+  /** Everything shown, every value whole, no fold: a list the player already asked to see. */
+  whole?: boolean;
+}) {
+  const { t, tn } = useI18n();
+  const [shown, setOpen] = useState(false);
+  const open = whole || shown;
+  const listId = useId();
+  const passed = checks.filter((c) => c.state === "yes" || c.state === "same");
+  const folds = !whole && passed.length >= 2;
+  const codes = !whole && checks.some(hasCode);
+  const asides = !whole && checks.some((c) => c.aside && c.detail && !passed.includes(c));
+  return (
+    <FullValues.Provider value={open}>
+    <ul className="checks" aria-label={label} id={listId}>
+      {checks.map((c) => (
+        <li key={c.id} className={`check check-${c.state}`} data-check={c.id} hidden={folds && !open && passed.includes(c)}>
+          <span className="check-mark" aria-hidden="true">
+            <PixelIcon rows={GLYPH[c.state]} />
+          </span>
+          <span>
+            <span className="sr-only">{t(c.said ?? SPOKEN[c.state])}: </span>
+            <RichText msg={c.title} />
+            {c.trust && (
+              <>
+                {" "}
+                <TrustBadge trust={c.trust} />
+              </>
+            )}
+            {c.retry && onRetry && (
+              <>
+                {" "}
+                <button className="link-btn check-retry" onClick={onRetry} disabled={retrying}>
+                  {retrying ? t("mods.retrying") : t("mods.retry")}
+                </button>
+              </>
+            )}
+            {c.detail && !(c.aside && !open) && (
+              <small>
+                <RichText msg={c.detail} />
+              </small>
+            )}
+          </span>
+        </li>
+      ))}
+      {(folds || codes || asides) && (
+        <li className={`check check-fold${folds ? " check-yes" : ""}`} data-check="fold">
+          <span className="check-mark" aria-hidden="true">
+            {folds && <PixelIcon rows={GLYPH.yes} />}
+          </span>
+          <span>
+            {folds && <>{tn("mods.checksPassed", passed.length)} · </>}
+            <button className="link-btn check-fold-btn" aria-expanded={open} aria-controls={listId} onClick={() => setOpen(!shown)}>
+              {open ? t("mods.checksHide") : folds ? t("mods.checksShow") : t("mods.checksShowDetails")}
+            </button>
+          </span>
+        </li>
+      )}
+    </ul>
+    </FullValues.Provider>
+  );
+}
+
+/**
+ * A Retry that says it is running: on while `run` works, so a second click can't ask twice and
+ * the player sees it was taken.
+ */
+export function useRetry(run: () => Promise<unknown>): [() => Promise<void>, boolean] {
+  const [busy, setBusy] = useState(false);
+  const going = useRef(false);
+  const retry = useCallback(async () => {
+    if (going.current) return;
+    going.current = true;
+    setBusy(true);
+    try {
+      await run();
+    } finally {
+      going.current = false;
+      setBusy(false);
+    }
+  }, [run]);
+  return [retry, busy];
+}
diff --git a/src/components/mods/CopyDialog.tsx b/src/components/mods/CopyDialog.tsx
new file mode 100644
index 0000000..4598ffa
--- /dev/null
+++ b/src/components/mods/CopyDialog.tsx
@@ -0,0 +1,368 @@
+import { useId, useState } from "react";
+import { useI18n } from "../../i18n/useI18n";
+import type { Shown } from "../../i18n/errors";
+import { useMods } from "../../hooks/useMods";
+import { usePlan } from "../../hooks/usePlan";
+import type { Catalog, CopyItem, CopyPreview, CopyResult, InstalledMod, Trust, UiProgress } from "../../mods/types";
+import { activeStep, consentChanges, copyConsentView, evidenceChecks, type CheckState, type ConsentView } from "../../mods/checks";
+import { COPY_OUTCOME, copyConsent } from "../../mods/copyPlan";
+import { buildBySha, networkDown } from "../../mods/select";
+import { useCheckContext } from "../../hooks/useCheckContext";
+import { Dialog } from "../Dialog";
+import { ErrorText } from "../ErrorText";
+import { VersionSelect } from "../VersionSelect";
+import { Truncate } from "../Truncate";
+import { CheckList, CheckMark } from "./CheckList";
+import { ModProgressBar } from "./ModProgressBar";
+import { PlanChanges, useOutcomeNote } from "./PlanChanges";
+import { TrustBadge } from "./TrustBadge";
+
+interface CopyDialogProps {
+  /** The version that gets the mods. */
+  tag: string;
+  /** Versions that have mods turned on to copy, best first. */
+  donors: string[];
+  onClose: () => void;
+}
+
+/**
+ * Copy mods from another version: what each mod gets and everything they bring along, then
+ * progress with Cancel, then what happened. The copy is the preview on screen (contract R4 §2);
+ * a preview for another pair of versions, or for sets that have changed since, never enables it.
+ */
+export function CopyDialog({ tag, donors, onClose }: CopyDialogProps) {
+  const { t, tn, formatList } = useI18n();
+  const mods = useMods();
+  const { copyProfile, isCopying, progressOf, profile, nameIn, catalog, catalogError, cancel, isCancelling } = mods;
+  const [from, setFrom] = useState(donors[0] ?? "");
+  const [result, setResult] = useState<CopyResult | null>(null);
+  /** The preview the player agreed to: what the result is said against, once the plan is gone. */
+  const [accepted, setAccepted] = useState<CopyPreview | null>(null);
+  const [error, setError] = useState<Shown | null>(null);
+  const [changedFrom, setChangedFrom] = useState<ConsentView | null>(null);
+  const outcomeNote = useOutcomeNote();
+  const fromLabelId = useId();
+  const listsId = useId();
+  /** Each build's evidence (review, hash, build record), shown on demand with one control. */
+  const [evidence, setEvidence] = useState(false);
+  const indexFrom = useCheckContext(tag).indexFrom ?? null;
+  const copying = isCopying(tag);
+  const target = profile(tag);
+  const donor = profile(from);
+  const name = nameIn(tag);
+  const op = { kind: "copy", tag } as const;
+
+  // Keyed by both versions; asked again when either set or the catalogue changes. Not after the
+  // copy: the result is what shows then.
+  const request = usePlan<CopyPreview>(from && !result ? `${from}|${tag}` : null, [target, donor, catalog], () => mods.previewCopy(from, tag));
+  const preview = request.value;
+  const consent = preview ? copyConsent(preview, target) : null;
+  const toInstall = consent?.items ?? [];
+  const events = progressOf(op);
+  const byId = (id: string): UiProgress | undefined => events.find((p) => p.modId === id && p.sha256 !== "");
+  const step = activeStep(events);
+  const changes = changedFrom && preview && request.ready ? consentChanges(changedFrom, copyConsentView(preview), name) : null;
+  const offline = networkDown(catalog, catalogError);
+  const blocked = !request.ready || !toInstall.length;
+
+  const confirm = async () => {
+    if (copying || blocked || !preview) return;
+    setError(null);
+    outcomeNote.clear();
+    const r = await copyProfile(preview);
+    if (r.status === "done") {
+      setAccepted(preview);
+      setResult(r.result);
+    }
+    else if (r.status === "cancelled") outcomeNote.cancelled();
+    else if (r.status === "failed") {
+      if (r.error.code === "ModChangedMeanwhile") {
+        setChangedFrom(copyConsentView(preview));
+        request.reload();
+      }
+      setError(r.shown);
+    }
+  };
+
+  const title = result ? t("mods.copyDoneTitle", tag) : t("mods.copyTitle", from, tag);
+  const label = toInstall.length ? tn("mods.copyConfirm", toInstall.length, tag) : t("mods.copyNothing");
+
+  const footer = result ? (
+    <button className="btn-primary" onClick={onClose} data-autofocus>
+      {t("mods.close")}
+    </button>
+  ) : copying ? (
+    <ModProgressBar progress={step} nameOf={(p) => name(p.modId)} onCancel={() => cancel(op)} cancelling={isCancelling(op)} />
+  ) : (
+    <>
+      <button className="btn-primary" onClick={confirm} disabled={blocked}>
+        {offline && toInstall.length ? t("mods.needsNetworkButton", label) : label}
+      </button>
+      <button className="btn-secondary" onClick={onClose} data-autofocus>
+        {t("mods.cancel")}
+      </button>
+    </>
+  );
+
+  // Every build the copy installed, dependencies too, as the new set has it: name, version,
+  // tier, and whether it is on. What the set doesn't list (it can't be read) comes from the preview.
+  const done: DoneRow[] = result
+    ? result.installed.map((id) => {
+        const m: InstalledMod | undefined = result.report.mods.find((x) => x.id === id);
+        const planned = accepted?.items.find((i) => i.id === id) ?? accepted?.deps.find((d) => d.id === id);
+        return {
+          id,
+          name: m?.name ?? planned?.name ?? name(id),
+          version: m?.version ?? planned?.version ?? null,
+          trust: m?.trust ?? planned?.trust ?? null,
+          on: m ? m.enabled : !result.installedOff.includes(id),
+        };
+      })
+    : [];
+  // What won't come along first, so it is seen without scrolling; then what installs; then what
+  // is there already. Each group keeps the backend's order.
+  const items = preview?.items ?? [];
+  const staying = items.filter((i) => STAYS.has(i.outcome));
+  const ordered = [...staying, ...items.filter((i) => i.outcome === "install"), ...items.filter((i) => i.outcome === "alreadyThere")];
+
+  return (
+    <Dialog onClose={onClose} locked={copying} title={title} footer={footer}>
+      {/* One version to copy from: the title names it already. */}
+      {!result && donors.length > 1 && (
+        <div className="dialog-field">
+          <span className="dialog-field-label" id={fromLabelId}>
+            {t("mods.copyFrom")}
+          </span>
+          <VersionSelect
+            value={from}
+            options={donors.map((d) => ({ value: d, label: d }))}
+            onChange={(f) => {
+              setFrom(f);
+              setChangedFrom(null);
+              setError(null);
+            }}
+            disabled={copying}
+            labelledBy={fromLabelId}
+            compact
+          />
+        </div>
+      )}
+      {result ? (
+        <>
+          <p className="dialog-summary">{tn("mods.copyDoneSummary", result.installed.length, from, tag)}</p>
+          {result.installedOff.length > 0 && (
+            <p className="dialog-note trust-change">
+              {tn("mods.copyInstallsOff", result.installedOff.length, formatList(result.installedOff.map(name)), tag)}
+            </p>
+          )}
+          {result.leftBehind.length > 0 && (
+            <>
+              <p className="dialog-note">{tn("mods.copyLeftBehindTitle", result.leftBehind.length)}</p>
+              <CopyList items={result.leftBehind} tag={tag} />
+            </>
+          )}
+          {result.missing.length > 0 && (
+            <p className="dialog-note">{tn("mods.noticeMissing", result.missing.length, formatList(result.missing.map(name)), tag)}</p>
+          )}
+          {done.length > 0 && <DoneList rows={done} tag={tag} />}
+        </>
+      ) : request.error ? (
+        <ErrorText error={request.error} />
+      ) : !preview || !consent ? (
+        <p className="dialog-note" role="status">
+          {t("mods.planning")}
+        </p>
+      ) : (
+        <>
+          {toInstall.length > 0 && (
+            <p className={`dialog-warning ${consent.unreviewed.length ? "red" : "amber"}`}>
+              {consent.unreviewed.length ? t("mods.copyWarnUnreviewed", formatList(consent.unreviewed)) : t("mods.copyWarn")}
+            </p>
+          )}
+          {changes && <PlanChanges changes={changes} />}
+          {offline && toInstall.length > 0 && <p className="dialog-note trust-change">{t("mods.needsNetworkNote")}</p>}
+          {consent.installedOff.length > 0 && (
+            <p className="dialog-note trust-change">
+              {tn("mods.copyInstallsOff", consent.installedOff.length, formatList(consent.installedOff.map(name)), tag)}
+            </p>
+          )}
+          {/* What the copy does, in one line that stays: it adds to the set and replaces nothing. */}
+          <p className="dialog-summary" data-testid="copy-intro">
+            {toInstall.length ? tn("mods.copyIntro", toInstall.length, tag) : t("mods.copyIntroNone", tag)}
+            {toInstall.length > 0 && (
+              <>
+                {" "}
+                <button className="link-btn copy-evidence-btn" aria-expanded={evidence} aria-controls={listsId} onClick={() => setEvidence(!evidence)}>
+                  {evidence ? t("mods.copyEvidenceHide") : t("mods.copyEvidenceShow")}
+                </button>
+              </>
+            )}
+          </p>
+          {staying.length > 0 && (
+            <p className="dialog-note" data-testid="copy-stays">
+              {tn("mods.copyStaysLine", staying.length, formatList(staying.map((i) => i.name)))}
+            </p>
+          )}
+          <div id={listsId}>
+          <CopyList items={ordered} tag={tag} progressFor={copying ? byId : undefined} evidence={evidence ? { catalog, indexFrom } : undefined} />
+          {consent.deps.length > 0 && (
+            <>
+              <p className="dialog-note">{t("mods.copyAlsoInstalls")}</p>
+              <ExtraList
+                rows={consent.deps.map((d) => ({
+                  id: d.id,
+                  state: "yes",
+                  text: t("mods.copyDepInstall", d.name, d.version),
+                  trust: d.trust,
+                  build: { name: d.name, sha256: d.sha256 },
+                }))}
+                progressFor={copying ? byId : undefined}
+                evidence={evidence ? { catalog, indexFrom } : undefined}
+              />
+            </>
+          )}
+          </div>
+          {consent.enable.length > 0 && (
+            <>
+              <p className="dialog-note">{t("mods.copyAlsoEnables")}</p>
+              <ExtraList rows={consent.enable.map((e) => ({ id: e.id, state: "yes", text: t("mods.copyDepEnable", e.name), trust: e.trust }))} />
+            </>
+          )}
+          {consent.missing.length > 0 && (
+            <ExtraList rows={consent.missing.map((id) => ({ id, state: "no", text: t("mods.copyDepMissing", name(id), tag) }))} />
+          )}
+        </>
+      )}
+      {outcomeNote.node}
+      {error && !changes && <ErrorText error={error} />}
+    </Dialog>
+  );
+}
+
+const STAYS: ReadonlySet<CopyItem["outcome"]> = new Set(["noBuild", "localFile", "revoked"]);
+
+interface EvidenceFrom {
+  catalog: Catalog | null;
+  indexFrom: string | null;
+}
+
+/**
+ * What is known of one build the copy installs, as its own install dialog would show it: the
+ * review, the pinned hash whole and the build record.
+ */
+function BuildEvidence({ id, name, sha256, from }: { id: string; name: string; sha256: string; from: EvidenceFrom }) {
+  const { t } = useI18n();
+  const v = buildBySha(from.catalog, id, sha256);
+  if (!v) return <small>{t("mods.copyNoEvidence")}</small>;
+  return <CheckList whole checks={evidenceChecks(v, from.indexFrom)} label={t("mods.copyEvidenceFor", name)} />;
+}
+
+/** Dependencies a copy brings along, each with its tier. */
+function ExtraList({
+  rows,
+  progressFor,
+  evidence,
+}: {
+  rows: { id: string; state: CheckState; text: string; trust?: Trust; build?: { name: string; sha256: string } }[];
+  progressFor?: (id: string) => UiProgress | undefined;
+  evidence?: EvidenceFrom;
+}) {
+  return (
+    <ul className="checks copy-list">
+      {rows.map((r) => {
+        const p = progressFor?.(r.id);
+        return (
+          <li key={r.id} className={`check check-${r.state}`}>
+            <CheckMark state={r.state} />
+            <span className="copy-item">
+              <span className="copy-item-head">
+                <span>{r.text}</span>
+                {r.trust && <TrustBadge trust={r.trust} />}
+              </span>
+              {p && <ModProgressBar progress={p} nameOf={() => r.text} compact />}
+              {evidence && r.build && <BuildEvidence id={r.id} name={r.build.name} sha256={r.build.sha256} from={evidence} />}
+            </span>
+          </li>
+        );
+      })}
+    </ul>
+  );
+}
+
+interface DoneRow {
+  id: string;
+  name: string;
+  version: string | null;
+  trust: Trust | null;
+  on: boolean;
+}
+
+/** What the copy installed, whole: names and versions wrap rather than being cut. */
+function DoneList({ rows, tag }: { rows: DoneRow[]; tag: string }) {
+  const { t } = useI18n();
+  return (
+    <ul className="checks copy-list copy-done" data-testid="copy-done">
+      {rows.map((r) => (
+        <li key={r.id} className={`check check-${r.on ? "yes" : "unknown"}`} data-id={r.id}>
+          {/* The line itself says installed and on or off; the mark adds nothing to hear. */}
+          <CheckMark state={r.on ? "yes" : "unknown"} said={null} />
+          <span className="copy-item">
+            <span className="copy-item-head">
+              <span className="copy-name whole" data-must-fit>
+                {r.name}
+              </span>
+              {r.version && (
+                <span className="mod-version" data-must-fit>
+                  {r.version}
+                </span>
+              )}
+              {r.trust && <TrustBadge trust={r.trust} />}
+            </span>
+            <small>{t(r.on ? "mods.copyInstalledOn" : "mods.copyInstalledOff", tag)}</small>
+          </span>
+        </li>
+      ))}
+    </ul>
+  );
+}
+
+function CopyList({
+  items,
+  tag,
+  progressFor,
+  evidence,
+}: {
+  items: CopyItem[];
+  tag: string;
+  progressFor?: (id: string) => UiProgress | undefined;
+  /** Set: each build that installs shows what is known of it. */
+  evidence?: EvidenceFrom;
+}) {
+  const { t } = useI18n();
+  return (
+    <ul className="checks copy-list">
+      {items.map((item) => {
+        const o = COPY_OUTCOME[item.outcome];
+        const p = progressFor && item.outcome === "install" ? progressFor(item.id) : undefined;
+        return (
+          <li key={item.id} className={`check check-${o.state}`}>
+            <CheckMark state={o.state} said={o.said} />
+            <span className="copy-item">
+              <span className="copy-item-head">
+                <Truncate className="copy-name" text={item.name} />
+                {item.version && <span className="mod-version">{item.version}</span>}
+                {item.trust && <TrustBadge trust={item.trust} />}
+              </span>
+              {p ? (
+                <ModProgressBar progress={p} nameOf={() => item.name} compact />
+              ) : (
+                <small>{t(o.key, tag)}</small>
+              )}
+              {evidence && item.outcome === "install" && item.sha256 && <BuildEvidence id={item.id} name={item.name} sha256={item.sha256} from={evidence} />}
+            </span>
+          </li>
+        );
+      })}
+    </ul>
+  );
+}
diff --git a/src/components/mods/FileInstallDialog.tsx b/src/components/mods/FileInstallDialog.tsx
new file mode 100644
index 0000000..9e34c3c
--- /dev/null
+++ b/src/components/mods/FileInstallDialog.tsx
@@ -0,0 +1,254 @@
+import { useId, useState } from "react";
+import { useI18n } from "../../i18n/useI18n";
+import type { Shown } from "../../i18n/errors";
+import { useMods } from "../../hooks/useMods";
+import { useCheckContext } from "../../hooks/useCheckContext";
+import { usePlan } from "../../hooks/usePlan";
+import type { FileInspection, InstallPlan, UiProgress } from "../../mods/types";
+import { networkDown, shortSha } from "../../mods/select";
+import {
+  activeStep,
+  consentChanges,
+  fileChecks,
+  fileReplaceNotes,
+  fileVerdict,
+  installOutcome,
+  planConsent,
+  planDepChecks,
+  weakerDeps,
+  withProblem,
+  type ConsentView,
+} from "../../mods/checks";
+import { Dialog } from "../Dialog";
+import { ErrorText } from "../ErrorText";
+import { Code } from "../Truncate";
+import { CheckList, useRetry } from "./CheckList";
+import { ModProgressBar } from "./ModProgressBar";
+import { PlanChanges, useOutcomeNote } from "./PlanChanges";
+import { RichText } from "./RichText";
+import { TrustBadge } from "./TrustBadge";
+
+interface FileInstallDialogProps {
+  tag: string;
+  path: string;
+  onClose: () => void;
+}
+
+/** What installing a file asks the player to agree to, for telling a change to it. */
+function fileConsent(inspection: FileInspection, plan: InstallPlan | null): ConsentView {
+  if (plan) return planConsent(plan);
+  const id = inspection.archive?.id ?? "";
+  return { builds: [{ id, name: inspection.name ?? id, version: null, trust: "unverified" }], enable: [], off: [] };
+}
+
+/**
+ * A zip from the player's computer: the warning, what can be checked, and for a file the
+ * catalogue knows, everything that install brings along. A typed "yes" when nothing could be
+ * checked, in the footer beside the button it unlocks. Title and button say the same thing:
+ * install, update, or replace; a replace says when the tier changes.
+ */
+export function FileInstallDialog({ tag, path, onClose }: FileInstallDialogProps) {
+  const { t, tn, tm, tr, formatSize, formatList } = useI18n();
+  const mods = useMods();
+  const { installFile, isBusy, progressOf, cancel, isCancelling, profile, catalog, catalogError, loadProfile, nameIn } = mods;
+  const report = profile(tag);
+  const ctx = useCheckContext(tag);
+  const [error, setError] = useState<Shown | null>(null);
+  const [typed, setTyped] = useState("");
+  const [changedFrom, setChangedFrom] = useState<ConsentView | null>(null);
+  const outcomeNote = useOutcomeNote();
+  const inputId = useId();
+  const whyId = useId();
+  const fileName = path.split(/[\\/]/).pop() ?? path;
+
+  const inspected = usePlan<FileInspection>(`${tag}|${path}`, [report, catalog], () => mods.inspectFile(tag, path));
+  const inspection = inspected.value;
+  // A catalogued file installs like that build: with what it needs, by the same plan.
+  const knownSha = inspection?.catalogMatch?.build.sha256 ?? null;
+  const planned = usePlan<InstallPlan>(knownSha ? `${tag}|${knownSha}` : null, [report, catalog], knownSha ? () => mods.plan(tag, knownSha) : null);
+  // Before any early return: hooks run in the same order every render.
+  const [retry, retrying] = useRetry(async () => {
+    await loadProfile(tag, true);
+    inspected.reload();
+    planned.reload();
+  });
+
+  if (!inspection) {
+    return (
+      <Dialog
+        onClose={onClose}
+        title={t("mods.fileChecking", fileName, tag)}
+        footer={
+          <button className="btn-secondary" onClick={onClose} data-autofocus>
+            {t(inspected.error ? "mods.close" : "mods.cancel")}
+          </button>
+        }
+      >
+        {inspected.error ? (
+          <ErrorText error={inspected.error} />
+        ) : (
+          <p className="dialog-note" role="status">
+            {t("loading")}
+          </p>
+        )}
+      </Dialog>
+    );
+  }
+
+  const { archive, catalogMatch: known } = inspection;
+  const id = archive?.id ?? "";
+  const op = { kind: "mod", tag, id } as const;
+  const working = isBusy(tag, id);
+  const plan = known ? planned.value : null;
+  const { usable, needsTyping } = fileVerdict(inspection);
+  const confirmed = !needsTyping || typed.trim() === id;
+  // Contract R4 §2: the inspection (and for a known file, its plan) on screen must be the
+  // answer for this set and catalogue, and nothing in it may say no.
+  const ready = inspected.ready && (!known || (planned.ready && !!plan));
+  const problem = plan?.problem ?? null;
+  const replacing = !!inspection.replaces;
+  const trust = known?.build.trust ?? "unverified";
+  const name = known?.name ?? inspection.name ?? id;
+  const outcome = plan ? installOutcome(plan, replacing, name, ctx) : null;
+  const weaker = plan ? weakerDeps(plan, ctx) : [];
+  const step = activeStep(progressOf(op));
+  const stepName = (p: UiProgress) =>
+    (plan ? [plan.target, ...plan.install].find((i) => i.sha256 === p.sha256)?.name : undefined) ?? (p.modId === id ? name : nameIn(tag)(p.modId));
+  const checks = withProblem(problem, [...fileChecks(inspection, tag, ctx.indexFrom ?? null), ...(plan && known ? planDepChecks(plan, known.build.deps, ctx) : [])]);
+  const notes = usable ? fileReplaceNotes(inspection, report?.mods.find((m) => m.id === id)?.trust) : [];
+  const changes = changedFrom && ready ? consentChanges(changedFrom, fileConsent(inspection, plan), nameIn(tag)) : null;
+  const offline = !!plan && plan.install.length > 0 && networkDown(catalog, catalogError);
+  const blocked = !ready || !!problem || !usable;
+
+  const confirm = async () => {
+    if (!confirmed || working || blocked) return;
+    setError(null);
+    outcomeNote.clear();
+    const result = await installFile(tag, path, inspection, plan);
+    if (result.status === "done") onClose();
+    else if (result.status === "cancelled") outcomeNote.cancelled();
+    else if (result.status === "failed") {
+      if (result.error.code === "ModChangedMeanwhile") {
+        setChangedFrom(fileConsent(inspection, plan));
+        inspected.reload();
+        planned.reload();
+      }
+      setError(result.shown);
+    }
+  };
+
+  const title = !archive
+    ? t("mods.fileNotAModTitle", fileName, tag)
+    : !usable
+      ? t("mods.fileUnusableTitle", fileName, tag)
+      : known
+        ? replacing
+          ? t("mods.fileKnownUpdateTitle", known.name, known.build.version, tag)
+          : t("mods.fileKnownTitle", known.name, known.build.version, tag)
+        : replacing
+          ? t("mods.fileReplaceTitle", inspection.replaces ?? id, fileName, tag)
+          : t("mods.fileUnverifiedTitle", fileName, tag);
+  const button = needsTyping ? (replacing ? "mods.replaceAnyway" : "mods.installAnyway") : (outcome?.button ?? (replacing ? "mods.updateButton" : "mods.install"));
+  const label = t(button);
+  const notPassed = checks.filter((c) => c.state === "no" || c.state === "unknown");
+
+  return (
+    <Dialog
+      onClose={onClose}
+      locked={working}
+      title={title}
+      subtitle={
+        <>
+          {archive && <TrustBadge trust={trust} />}
+          <span>{t("mods.fileFrom", fileName, formatSize(inspection.size))}</span>
+          <span>
+            SHA-256 <Code full={inspection.sha256} short={shortSha(inspection.sha256)} />
+          </span>
+        </>
+      }
+      footer={
+        working ? (
+          <ModProgressBar progress={step} nameOf={stepName} onCancel={() => cancel(op)} cancelling={isCancelling(op)} />
+        ) : (
+          <>
+            {needsTyping && (
+              <span className="typed-confirm">
+                {/* What wasn't shown, in one line, beside what is asked: seen without scrolling the checks. */}
+                {notPassed.length > 0 && (
+                  <span className="typed-summary" data-testid="typed-summary">
+                    {tn("mods.typedNotPassed", notPassed.length)}{" "}
+                    {notPassed.map((c, i) => (
+                      <span key={c.id} className="typed-summary-item">
+                        {i > 0 && ", "}
+                        <RichText msg={c.title} />
+                      </span>
+                    ))}
+                  </span>
+                )}
+                <label htmlFor={inputId} id={whyId}>
+                  {tr(replacing ? "mods.typeToReplace" : "mods.typeToConfirm", <strong key="id">{id}</strong>)}
+                </label>
+                <input
+                  id={inputId}
+                  className="text-input"
+                  value={typed}
+                  onChange={(e) => setTyped(e.target.value)}
+                  onKeyDown={(e) => {
+                    if (e.key === "Enter" && !e.repeat) confirm();
+                  }}
+                  spellCheck={false}
+                  autoComplete="off"
+                  data-autofocus
+                />
+              </span>
+            )}
+            {usable && (
+              <button
+                className={needsTyping ? "btn-danger" : "btn-primary"}
+                onClick={confirm}
+                disabled={!confirmed || blocked}
+                aria-describedby={needsTyping && !confirmed ? whyId : undefined}
+                title={needsTyping && !confirmed ? t("mods.installAnywayWhy", id) : undefined}
+              >
+                {offline ? t("mods.needsNetworkButton", label) : label}
+              </button>
+            )}
+            <button className="btn-secondary" onClick={onClose} data-autofocus={needsTyping ? undefined : true}>
+              {t(usable ? "mods.cancel" : "mods.close")}
+            </button>
+          </>
+        )
+      }
+    >
+      {usable && (
+        <p className={`dialog-warning ${trust === "reviewed" && !weaker.length ? "amber" : "red"}`}>
+          {trust === "reviewed" ? t("mods.warnNative", name) : t("mods.warnFile")}
+          {weaker.length > 0 && <> {t("mods.warnDepsUnreviewed", formatList(weaker.map((w) => w.name)))}</>}
+        </p>
+      )}
+      {changes && <PlanChanges changes={changes} />}
+      {notes.map((n, i) => (
+        <p key={i} className={`dialog-note${n.key === "mods.fileReplacesTrust" ? " trust-change" : ""}`}>
+          <RichText msg={n} />
+        </p>
+      ))}
+      {offline && <p className="dialog-note trust-change">{t("mods.needsNetworkNote")}</p>}
+      {outcome?.explain && <p className="dialog-note trust-change">{tm(outcome.explain)}</p>}
+      {archive && !known && inspection.name && (
+        <p className="dialog-summary">
+          {t("mods.fileSaysItIs", inspection.name)}
+          {inspection.summary ? ` ${inspection.summary}` : ""}
+        </p>
+      )}
+      <CheckList label={t("mods.checksLabel")} checks={checks} onRetry={retry} retrying={retrying} />
+      {known && !plan && !planned.error && (
+        <p className="dialog-note" role="status">
+          {t("mods.planning")}
+        </p>
+      )}
+      {planned.error && <ErrorText error={planned.error} />}
+      {outcomeNote.node}
+      {error && !changes && <ErrorText error={error} />}
+    </Dialog>
+  );
+}
diff --git a/src/components/mods/InstallDialog.tsx b/src/components/mods/InstallDialog.tsx
new file mode 100644
index 0000000..75d36bb
--- /dev/null
+++ b/src/components/mods/InstallDialog.tsx
@@ -0,0 +1,215 @@
+import { useId, useMemo, useState } from "react";
+import { openUrl } from "@tauri-apps/plugin-opener";
+import { useI18n } from "../../i18n/useI18n";
+import type { Shown } from "../../i18n/errors";
+import { useMods } from "../../hooks/useMods";
+import { useCheckContext } from "../../hooks/useCheckContext";
+import { usePlan } from "../../hooks/usePlan";
+import type { CatalogMod, InstallPlan, UiProgress } from "../../mods/types";
+import { fittingVersions, installedFor, networkDown, sourceUrl } from "../../mods/select";
+import {
+  activeStep,
+  consentChanges,
+  installChecks,
+  installOutcome,
+  planConsent,
+  replaceNotes,
+  weakerDeps,
+  type ConsentView,
+} from "../../mods/checks";
+import { Dialog } from "../Dialog";
+import { ErrorText } from "../ErrorText";
+import { VersionSelect } from "../VersionSelect";
+import { Truncate } from "../Truncate";
+import { CheckList, useRetry } from "./CheckList";
+import { ModProgressBar } from "./ModProgressBar";
+import { PlanChanges, useOutcomeNote } from "./PlanChanges";
+import { RichText } from "./RichText";
+import { ChannelBadge, TrustBadge } from "./TrustBadge";
+
+interface InstallDialogProps {
+  tag: string;
+  mod: CatalogMod;
+  /** The build to show first, e.g. the update an installed row offers. */
+  initialSha?: string;
+  allowPrerelease?: boolean;
+  onClose: () => void;
+}
+
+/**
+ * Every install and update of a catalogue mod goes through here: the plain warning that a mod
+ * is a program first, then what the launcher checked and what else changes. The button installs
+ * exactly the plan on screen (contract R4 §2); when the backend says it changed meanwhile, the
+ * new plan shows with what changed, and the player confirms again.
+ */
+export function InstallDialog({ tag, mod, initialSha, allowPrerelease = false, onClose }: InstallDialogProps) {
+  const { t, tm, formatSize, formatList } = useI18n();
+  const mods = useMods();
+  const { catalog, catalogError, install, isBusy, progressOf, cancel, isCancelling, loadProfile, nameIn } = mods;
+  const report = mods.profile(tag);
+  const installed = report ? installedFor(mod, report.mods) : undefined;
+  const ctx = useCheckContext(tag);
+  const versionLabelId = useId();
+
+  // An offered update, or the build asked for, stays pickable even when prereleases are hidden.
+  const versions = useMemo(
+    () =>
+      fittingVersions(catalog, mod, report?.versionAbi ?? null, true).filter(
+        (x) => allowPrerelease || x.channel === "release" || x.sha256 === initialSha || x.sha256 === installed?.update?.sha256
+      ),
+    [catalog, mod, report?.versionAbi, allowPrerelease, initialSha, installed?.update?.sha256]
+  );
+  const [sha, setSha] = useState(initialSha ?? installed?.update?.sha256 ?? versions[0]?.sha256 ?? "");
+  const v = versions.find((x) => x.sha256 === sha) ?? versions[0];
+  const [error, setError] = useState<Shown | null>(null);
+  const [changedFrom, setChangedFrom] = useState<ConsentView | null>(null);
+  const outcomeNote = useOutcomeNote();
+  const op = { kind: "mod", tag, id: mod.id } as const;
+  const working = isBusy(tag, mod.id);
+
+  // Asked again whenever the set or the catalogue changes; the answer counts only for both.
+  const request = usePlan<InstallPlan>(v ? `${tag}|${v.sha256}` : null, [report, catalog], v ? () => mods.plan(tag, v.sha256) : null);
+
+  if (!v) {
+    return (
+      <Dialog
+        onClose={onClose}
+        title={t("mods.dlgNoBuildTitle", mod.name, tag)}
+        footer={
+          <button className="btn-secondary" onClick={onClose} data-autofocus>
+            {t("mods.close")}
+          </button>
+        }
+      >
+        {mod.summary && <p className="dialog-summary">{mod.summary}</p>}
+        <p className="dialog-summary">{t("mods.dlgNoBuild", mod.name, tag)}</p>
+      </Dialog>
+    );
+  }
+
+  const plan = request.value;
+  const replacing = !!installed && installed.sha256 !== v.sha256;
+  const authors = formatList(mod.authors) || v.sourceRepo;
+  const link = mod.homepage ?? sourceUrl(v);
+  const checks = plan ? installChecks(plan, v, ctx) : [];
+  const notes = plan ? replaceNotes(plan) : [];
+  const outcome = plan ? installOutcome(plan, replacing, mod.name, ctx) : null;
+  const weaker = plan ? weakerDeps(plan, ctx) : [];
+  const blocked = !request.ready || !plan || !!plan.problem;
+  const changes = changedFrom && plan && request.ready ? consentChanges(changedFrom, planConsent(plan), nameIn(tag)) : null;
+  const step = activeStep(progressOf(op));
+  const stepName = (p: UiProgress) => (plan ? [plan.target, ...plan.install].find((i) => i.sha256 === p.sha256)?.name : undefined) ?? nameIn(tag)(p.modId);
+  const offline = networkDown(catalog, catalogError);
+  const label = t(outcome?.button ?? (replacing ? "mods.updateButton" : "mods.install"));
+
+  const confirm = async () => {
+    if (working || blocked || !plan) return;
+    setError(null);
+    outcomeNote.clear();
+    const result = await install(tag, plan);
+    if (result.status === "done") onClose();
+    else if (result.status === "cancelled") outcomeNote.cancelled();
+    else if (result.status === "failed") {
+      if (result.error.code === "ModChangedMeanwhile") {
+        // Show the new plan, and what is different from the one the player agreed to.
+        setChangedFrom(planConsent(plan));
+        request.reload();
+      }
+      setError(result.shown);
+    }
+  };
+
+  const [retry, retrying] = useRetry(async () => {
+    await loadProfile(tag, true);
+    request.reload();
+  });
+
+  return (
+    <Dialog
+      onClose={onClose}
+      locked={working}
+      title={t(replacing ? "mods.dlgUpdateTitle" : "mods.dlgInstallTitle", mod.name, v.version, tag)}
+      subtitle={
+        <>
+          <TrustBadge trust={v.trust} /> <ChannelBadge channel={v.channel} />
+          <span>{formatSize(v.size)}</span>
+          <span>·</span>
+          <Truncate focusable className="dialog-sub-by" text={t("mods.by", authors)} />
+        </>
+      }
+      footer={
+        <>
+          {working ? (
+            <ModProgressBar progress={step} nameOf={stepName} onCancel={() => cancel(op)} cancelling={isCancelling(op)} />
+          ) : (
+            <>
+              <button className="btn-primary" onClick={confirm} disabled={blocked}>
+                {offline ? t("mods.needsNetworkButton", label) : label}
+              </button>
+              <button className="btn-secondary" onClick={onClose} data-autofocus>
+                {t("mods.cancel")}
+              </button>
+            </>
+          )}
+          <span className="spacer" />
+          {link && (
+            <button className="link-btn" onClick={() => openUrl(link)}>
+              {t("mods.viewSource")}
+            </button>
+          )}
+        </>
+      }
+    >
+      {versions.length > 1 && (
+        <div className="dialog-field">
+          <span className="dialog-field-label" id={versionLabelId}>
+            {t("mods.dlgVersion")}
+          </span>
+          <VersionSelect
+            value={v.sha256}
+            options={versions.map((x) => ({
+              value: x.sha256,
+              label:
+                x.channel === "release"
+                  ? x.version
+                  : `${x.version} · ${t(x.channel === "experimental" ? "mods.badgeExperimental" : "mods.badgePrerelease")}`,
+            }))}
+            onChange={(s) => {
+              setSha(s);
+              setChangedFrom(null);
+              setError(null);
+            }}
+            disabled={working}
+            labelledBy={versionLabelId}
+            compact
+          />
+        </div>
+      )}
+      <p className={`dialog-warning ${v.trust === "reviewed" && !weaker.length ? "amber" : "red"}`}>
+        {v.trust === "reviewed" ? t("mods.warnNative", mod.name) : t("mods.warnUnreviewed", mod.name, v.sourceRepo)}
+        {weaker.length > 0 && <> {t("mods.warnDepsUnreviewed", formatList(weaker.map((w) => w.name)))}</>}
+      </p>
+      {changes && <PlanChanges changes={changes} />}
+      {offline && <p className="dialog-note trust-change">{t("mods.needsNetworkNote")}</p>}
+      {outcome?.explain && <p className="dialog-note trust-change">{tm(outcome.explain)}</p>}
+      {request.error ? (
+        <ErrorText error={request.error} />
+      ) : plan ? (
+        <CheckList label={t("mods.checksLabel")} checks={checks} onRetry={retry} retrying={retrying} />
+      ) : (
+        <p className="dialog-note" role="status">
+          {t("mods.planning")}
+        </p>
+      )}
+      {notes.map((n, i) => (
+        <p key={i} className={`dialog-note${i === 0 && n.key === "mods.ckReplacesTrust" ? " trust-change" : ""}`}>
+          <RichText msg={n} />
+        </p>
+      ))}
+      {outcomeNote.node}
+      {error && !changes && <ErrorText error={error} />}
+      {/* What the mod is, whole: the card shows only the start of it. */}
+      {mod.summary && <p className="dialog-summary mod-details-summary">{mod.summary}</p>}
+    </Dialog>
+  );
+}
diff --git a/src/components/mods/InstalledList.tsx b/src/components/mods/InstalledList.tsx
new file mode 100644
index 0000000..ca9757b
--- /dev/null
+++ b/src/components/mods/InstalledList.tsx
@@ -0,0 +1,299 @@
+import { useId, useLayoutEffect, useRef, useState } from "react";
+import { useConfirmPress } from "../../hooks/useConfirmPress";
+import { useI18n } from "../../i18n/useI18n";
+import { useMods } from "../../hooks/useMods";
+import type { InstalledMod, ProfileReport } from "../../mods/types";
+import { keepOrder, sortInstalled } from "../../mods/select";
+import { depStates, modMeta, shadowOf, turnOnWarnings } from "../../mods/status";
+import type { Msg } from "../../i18n";
+import { activeStep } from "../../mods/checks";
+import type { Shown } from "../../i18n/errors";
+import { useAnnounce } from "../LiveRegion";
+import { StableLabel } from "../StableLabel";
+import { Truncate } from "../Truncate";
+import { ModIcon } from "./ModIcon";
+import { PixelIcon } from "../PixelIcon";
+import { ARROW_UP } from "./glyphs";
+import { ModProgressBar } from "./ModProgressBar";
+import { ChannelBadge, RevokedBadge, TrustBadge } from "./TrustBadge";
+
+interface RowProps {
+  tag: string;
+  mod: InstalledMod;
+  report: ProfileReport;
+  onError: (error: Shown | null) => void;
+  onUpdate: (mod: InstalledMod, sha256: string) => void;
+  canUpdate: boolean;
+  /** Why the update can't be opened, when it can't. */
+  updateWhy: string | null;
+  locked: boolean;
+  /** Called before a removal and once the mod is gone, so focus can go to a row that is still there. */
+  onRemoving: (id: string) => void;
+  onRemoved: () => void;
+}
+
+/** Characters of a name that fit beside a row's switch and Remove in the smallest window. */
+const LONG_NAME = 28;
+
+function ModRow({ tag, mod, report, onError, onUpdate, canUpdate, updateWhy, locked, onRemoving, onRemoved }: RowProps) {
+  const announce = useAnnounce();
+  const { t, tm } = useI18n();
+  const { setEnabled, remove, isBusy, progressOf, nameIn, catalog } = useMods();
+  const hintId = useId();
+  // The tier's meaning and the row's details, heard from the switch: the badge isn't a tab stop.
+  const tierId = useId();
+  const metaId = useId();
+  const meta = modMeta(mod, tag, nameIn(tag), mod.status === "missingDeps" ? depStates(mod, report, catalog) : undefined, shadowOf(report, mod.id));
+  const metaText = meta.parts.map(tm).join(" ");
+  const working = isBusy(tag, mod.id);
+  const events = progressOf({ kind: "mod", tag, id: mod.id });
+  const updating = mod.update && events.length ? activeStep(events) : undefined;
+  const disabled = working || locked;
+  // A reason is read whole: it gets the row's width under the buttons, as many lines as it needs.
+  const wide = meta.bad || meta.shadowed;
+  // A name longer than fits beside the switch and Remove takes the row's width, and they move to
+  // the line under it, so it wraps once rather than into a narrow column.
+  const longName = mod.name.length > LONG_NAME;
+
+  const removal = useConfirmPress({
+    onAsk: () => announce(`remove-ask:${mod.id}:${Date.now()}`, t("mods.removeConfirmHint", mod.name)),
+    onCancel: (said) => said && announce(`remove-cancelled:${mod.id}:${Date.now()}`, t("mods.removeCancelled", mod.name)),
+    onDoubleClick: () => announce(`remove-double:${mod.id}:${Date.now()}`, t("mods.removeDoubleClick", mod.name)),
+    onConfirm: async () => {
+      onRemoving(mod.id);
+      const r = await remove(tag, mod.id);
+      onError(r.status === "failed" ? r.shown : null);
+      if (r.status === "done") onRemoved();
+    },
+  });
+  const confirmRemove = removal.confirming;
+
+  // Turning on a mod that would stop Play asks first, with the reason in front of the player.
+  const [askOn, setAskOn] = useState<Msg[] | null>(null);
+  const toggleRef = useRef<HTMLButtonElement>(null);
+  const askRef = useRef<HTMLButtonElement>(null);
+  const toggle = async (enabled: boolean) => {
+    const r = await setEnabled(tag, mod.id, enabled);
+    onError(r.status === "failed" ? r.shown : null);
+  };
+  const onToggle = () => {
+    if (!mod.enabled) {
+      const warnings = turnOnWarnings(report, mod.id, nameIn(tag), catalog);
+      if (warnings.length) {
+        setAskOn(warnings);
+        announce(`turn-on-ask:${mod.id}:${Date.now()}`, [t("mods.turnOnAsk", mod.name), ...warnings.map(tm)].join(" "));
+        return;
+      }
+    }
+    void toggle(!mod.enabled);
+  };
+  const closeAsk = (focusToggle: boolean) => {
+    setAskOn(null);
+    if (focusToggle) requestAnimationFrame(() => toggleRef.current?.focus());
+  };
+  useLayoutEffect(() => {
+    if (askOn) askRef.current?.focus();
+  }, [askOn]);
+
+  const revoked = mod.status === "revoked";
+  const rowClass = ["mod-row framed", mod.enabled ? "" : "is-off", meta.bad ? "has-problem" : "", wide ? "wide" : "", longName ? "long-name" : "", askOn ? "asking" : ""].join(" ");
+
+  return (
+    <li className={rowClass} data-mod={mod.id} data-shadowed={meta.shadowed || undefined} data-focus-scope>
+      <ModIcon id={mod.id} url={mod.icon} />
+      {/* The name whole, and its tier beside it; the tier goes under the name when both don't
+          fit, never shortened. */}
+      <div className="mod-title">
+        <span className="mod-name" data-must-fit>
+          {mod.name}
+        </span>
+        <span className="mod-badges">
+          <ChannelBadge channel={mod.channel} />
+          {revoked ? <RevokedBadge reason={mod.revokedReason} hintId={tierId} /> : <TrustBadge trust={mod.trust} hintId={tierId} />}
+        </span>
+      </div>
+      {/* The version, then what the launcher knows: a reason is never cut, other details (a
+          repo, what it needs) may be, with the full text a hover or a Tab away. */}
+      <div className={`mod-meta${meta.bad ? " bad" : ""}`} data-must-fit={wide || undefined}>
+        {mod.version && (
+          <span className="mod-version" data-must-fit>
+            {mod.version}
+          </span>
+        )}
+        {/* An update sits by the version it replaces: the arrow and the new version; the label
+            says the rest. */}
+        {!updating && mod.update && (
+          <button
+            className="btn-flat primary chip update-btn-row"
+            disabled={disabled || !canUpdate}
+            onClick={() => onUpdate(mod, mod.update!.sha256)}
+            aria-label={t("mods.updateLabelTo", mod.name, mod.update.version, tag)}
+            title={updateWhy ?? t("mods.updateLabelTo", mod.name, mod.update.version, tag)}
+          >
+            <PixelIcon rows={ARROW_UP} />
+            <span data-must-fit>{mod.update.version}</span>
+          </button>
+        )}
+        {wide ? (
+          <span className="mod-reason" id={metaId}>
+            {metaText}
+          </span>
+        ) : (
+          <Truncate className="mod-meta-text" text={metaText} id={metaId} />
+        )}
+        {!updating && mod.update && !canUpdate && updateWhy && (
+          <span className="mod-update-why" data-must-fit>
+            {updateWhy}
+          </span>
+        )}
+      </div>
+      <div className="mod-actions">
+        {updating && <ModProgressBar progress={updating} nameOf={(p) => (p.modId === mod.id ? mod.name : nameIn(tag)(p.modId))} compact />}
+        <button
+          className={`toggle${mod.enabled ? " on" : ""}`}
+          role="switch"
+          aria-checked={mod.enabled}
+          aria-label={mod.name}
+          aria-describedby={`${tierId} ${metaId}`}
+          disabled={disabled || revoked}
+          onClick={onToggle}
+          aria-expanded={askOn ? true : undefined}
+          ref={toggleRef}
+        >
+          <span className="toggle-knob" aria-hidden="true" />
+          <StableLabel text={mod.enabled ? t("mods.on") : t("mods.off")} widest={[t("mods.on"), t("mods.off")]} />
+        </button>
+        <button
+          className={`delete-btn btn-small${confirmRemove ? " confirming" : ""}`}
+          disabled={disabled}
+          {...removal.handlers}
+          aria-label={confirmRemove ? t("mods.removeConfirmLabel", mod.name) : t("mods.removeLabel", mod.name)}
+          aria-describedby={confirmRemove ? hintId : undefined}
+        >
+          <StableLabel
+            text={confirmRemove ? t("mods.removeConfirm") : t("mods.remove")}
+            widest={[t("mods.removeConfirm"), t("mods.remove")]}
+          />
+        </button>
+        <span className="sr-only" id={hintId}>
+          {confirmRemove ? t("mods.removeConfirmHint", mod.name) : ""}
+        </span>
+      </div>
+      {askOn && (
+        <div
+          className="mod-ask"
+          role="group"
+          aria-label={t("mods.turnOnAsk", mod.name)}
+          onKeyDown={(e) => {
+            if (e.key === "Escape") {
+              e.stopPropagation();
+              closeAsk(true);
+            }
+          }}
+        >
+          <span className="mod-ask-text" data-must-fit>
+            <span className="mod-ask-lead">{t("mods.turnOnAsk", mod.name)}</span>
+            {askOn.map((m, i) => (
+              <span key={i} className="mod-ask-line">
+                {tm(m)}
+              </span>
+            ))}
+          </span>
+          <span className="mod-ask-actions">
+            <button className="btn-secondary btn-small" ref={askRef} onClick={() => closeAsk(true)}>
+              {t("mods.keepOff")}
+            </button>
+            <button
+              className="btn-secondary btn-small"
+              onClick={() => {
+                closeAsk(true);
+                void toggle(true);
+              }}
+            >
+              {t("mods.turnOnAnyway")}
+            </button>
+          </span>
+        </div>
+      )}
+    </li>
+  );
+}
+
+interface InstalledListProps {
+  report: ProfileReport;
+  onError: (error: Shown | null) => void;
+  onUpdate: (mod: InstalledMod, sha256: string) => void;
+  canUpdate: (mod: InstalledMod) => boolean;
+  /** Why updates can't be opened right now (the mod list couldn't be loaded), if they can't. */
+  updatesUnavailable: string | null;
+  locked: boolean;
+  /** A mod whose row should take focus once it is shown, e.g. after Undo; then cleared. */
+  focusMod: string | null;
+  onFocused: () => void;
+  /** Where focus goes when the list is empty after a removal. */
+  onEmptied: () => void;
+}
+
+/**
+ * The installed mods. Sorted when the list opens or the version changes, then kept in place: a
+ * toggle never moves a row away from the pointer or from focus. When a row goes, focus goes to
+ * the row that took its place, or the one before.
+ */
+export function InstalledList({ report, onError, onUpdate, canUpdate, updatesUnavailable, locked, focusMod, onFocused, onEmptied }: InstalledListProps) {
+  const { t } = useI18n();
+  const list = useRef<HTMLUListElement>(null);
+  const order = useRef<{ tag: string; ids: string[] } | null>(null);
+  const [focusAfter, setFocusAfter] = useState<{ index: number } | null>(null);
+  if (!order.current || order.current.tag !== report.tag) {
+    order.current = { tag: report.tag, ids: sortInstalled(report.mods) };
+  } else {
+    order.current = { tag: report.tag, ids: keepOrder(order.current.ids, report.mods) };
+  }
+  const byId = new Map(report.mods.map((m) => [m.id, m]));
+  const mods = order.current.ids.map((id) => byId.get(id)!).filter(Boolean);
+
+  const focusRow = (id: string) => {
+    const row = list.current?.querySelector<HTMLElement>(`[data-mod="${CSS.escape(id)}"]`);
+    const target = row?.querySelector<HTMLElement>(".toggle:not(:disabled), .delete-btn:not(:disabled)");
+    target?.focus();
+    return !!target;
+  };
+
+  useLayoutEffect(() => {
+    if (!focusAfter) return;
+    setFocusAfter(null);
+    const next = mods[Math.min(focusAfter.index, mods.length - 1)];
+    if (!next || !focusRow(next.id)) onEmptied();
+  });
+
+  useLayoutEffect(() => {
+    if (focusMod && byId.has(focusMod) && focusRow(focusMod)) onFocused();
+  });
+
+  // The removed row's place, taken before it goes: the row that moves into it gets focus.
+  const removedAt = useRef(0);
+  const onRemoving = (id: string) => {
+    removedAt.current = Math.max(0, order.current!.ids.indexOf(id));
+  };
+  const onRemoved = () => setFocusAfter({ index: removedAt.current });
+
+  return (
+    <ul className="mod-list" aria-label={t("mods.installedListLabel", report.tag)} ref={list}>
+      {mods.map((m) => (
+        <ModRow
+          key={m.id}
+          tag={report.tag}
+          mod={m}
+          report={report}
+          onError={onError}
+          onUpdate={onUpdate}
+          canUpdate={canUpdate(m) && !updatesUnavailable}
+          updateWhy={updatesUnavailable ?? (canUpdate(m) ? null : t("mods.catalogMissing"))}
+          locked={locked}
+          onRemoving={onRemoving}
+          onRemoved={onRemoved}
+        />
+      ))}
+    </ul>
+  );
+}
diff --git a/src/components/mods/ModFailureNotice.tsx b/src/components/mods/ModFailureNotice.tsx
new file mode 100644
index 0000000..8eaf552
--- /dev/null
+++ b/src/components/mods/ModFailureNotice.tsx
@@ -0,0 +1,156 @@
+import { useEffect, useState } from "react";
+import { useI18n } from "../../i18n/useI18n";
+import { showError, type Shown } from "../../i18n/errors";
+import { useMods } from "../../hooks/useMods";
+import { useGameState, type GameCrash } from "../../hooks/useGameState";
+import { modsApi } from "../../mods/api";
+import { crashFixes, failureTitle, shadowOf, shadowStillThere } from "../../mods/status";
+import { useAnnounce } from "../LiveRegion";
+import { ErrorDetails, ErrorText } from "../ErrorText";
+import { FixButtons, useFix, type Review } from "./ModFixes";
+
+const crashIds = new WeakMap<GameCrash, number>();
+let crashCount = 0;
+const crashId = (c: GameCrash) => {
+  if (!crashIds.has(c)) crashIds.set(c, ++crashCount);
+  return String(crashIds.get(c));
+};
+
+interface ModFailureNoticeProps {
+  crash: GameCrash;
+  review: Review;
+  /** On Home: a way to the Mods tab. Left out on the Mods tab itself. */
+  onGoToMods?: () => void;
+}
+
+/**
+ * The game stopped. Says which mod the log blames and why, in names, and offers the fix right
+ * there. It stays until that mod is off, removed or replaced, or the player dismisses it.
+ */
+export function ModFailureNotice({ crash, review, onGoToMods }: ModFailureNoticeProps) {
+  const announce = useAnnounce();
+  const { t, tn, tm } = useI18n();
+  const { profile, nameIn, catalog, crashSnapshot, setEnabledMany } = useMods();
+  const { clearCrash } = useGameState();
+  const { apply, error, lookAgain } = useFix(crash.tag, review);
+  const [actionError, setActionError] = useState<Shown | null>(null);
+  const failure = crash.modFailure;
+  const report = profile(crash.tag);
+  const managed = failure?.modId ? report?.mods.find((m) => m.id === failure.modId) : undefined;
+  const fixes = crashFixes(failure, report, catalog);
+  // A copy in the player's own folder may be what the game loaded, so turning this one off may not
+  // help: it loads instead. Named for as long as it is there, also once the launcher's is gone.
+  const shadow = failure?.modId ? shadowOf(report, failure.modId) : undefined;
+  const leftover = shadowStillThere(crashSnapshot, report);
+  const shadowFile = shadow?.file ?? leftover;
+  const loadsInstead = !!shadowFile && !managed?.enabled;
+  const outside = !!failure?.modId && (!managed || !!shadowFile);
+
+  const attempt = async (work: () => Promise<void>) => {
+    setActionError(null);
+    try {
+      await work();
+    } catch (err) {
+      setActionError(showError(err));
+    }
+  };
+
+  // A crash that names no mod, with mods on: the next step is trying without them, with Undo.
+  const [turnedOff, setTurnedOff] = useState<string[] | null>(null);
+  const [working, setWorking] = useState(false);
+  const enabledIds = (report?.mods ?? []).filter((m) => m.enabled).map((m) => m.id);
+  const unnamed = !failure && (enabledIds.length > 0 || !!turnedOff);
+  const allOff = async () => {
+    setActionError(null);
+    setWorking(true);
+    const r = await setEnabledMany(crash.tag, enabledIds, false);
+    setWorking(false);
+    if (r.status === "failed") return setActionError(r.shown);
+    if (r.status !== "done") return;
+    setTurnedOff(r.result);
+    announce(`crash-all-off:${crashId(crash)}:${Date.now()}`, tn("mods.crashAllOff", r.result.length, crash.tag));
+  };
+  const undoAllOff = async () => {
+    if (!turnedOff) return;
+    setActionError(null);
+    setWorking(true);
+    const r = await setEnabledMany(crash.tag, turnedOff, true);
+    setWorking(false);
+    if (r.status === "failed") return setActionError(r.shown);
+    setTurnedOff(null);
+    announce(`crash-all-on:${crashId(crash)}:${Date.now()}`, tn("mods.crashAllOn", turnedOff.length, crash.tag));
+  };
+
+  const title = failure
+    ? tm(failureTitle(failure, managed?.name ?? failure.modId ?? "", nameIn(crash.tag)))
+    : t("gameClosedError", String(crash.exitCode ?? "?"));
+
+  return (
+    <section className="launch-error mod-failure" aria-label={title}>
+      <CrashSaid id={crashId(crash)} text={title} />
+      <span className="mod-failure-title" data-must-fit>
+        {title}
+      </span>
+      {failure && !managed && failure.modId && !shadowFile && <span className="mod-failure-why">{t("mods.failureOutside")}</span>}
+      {shadowFile && (
+        <span className="mod-failure-why" data-testid="crash-shadow">
+          {t(loadsInstead ? "mods.failureShadowedStill" : "mods.failureShadowed", shadowFile)}
+        </span>
+      )}
+      {unnamed && (
+        <span className="mod-failure-why" data-testid="crash-unnamed">
+          {turnedOff ? tn("mods.crashAllOff", turnedOff.length, crash.tag) : t("mods.crashNoneNamed")}
+        </span>
+      )}
+      {/* The log's own line, folded: the sentence above says what it means. */}
+      {failure?.line && <ErrorDetails detail={failure.line} label={t("mods.failureLogLine")} />}
+      <span className="mod-failure-actions">
+        <FixButtons tag={crash.tag} fixes={fixes} locked={false} review={review} apply={apply} />
+        {unnamed && !turnedOff && (
+          <button className="btn-primary btn-small" data-fix="turnOffAll" disabled={working} onClick={allOff}>
+            {t("mods.crashTurnOffAll", crash.tag)}
+          </button>
+        )}
+        {unnamed && turnedOff && (
+          <button className="btn-secondary btn-small" data-fix="undoTurnOffAll" disabled={working} onClick={undoAllOff}>
+            {t("mods.undo")}
+          </button>
+        )}
+        {managed && onGoToMods && (
+          <button className="btn-secondary btn-small" onClick={onGoToMods}>
+            {t("mods.homeFixInMods")}
+          </button>
+        )}
+        {outside && (
+          <button
+            className="btn-secondary btn-small"
+            onClick={() => {
+              lookAgain();
+              attempt(modsApi.openPlayerModsFolder);
+            }}
+          >
+            {t("mods.openModsFolder")}
+          </button>
+        )}
+        {/* Quieter than the fixes: looking at the log and putting the notice away. */}
+        <span className="mod-failure-quiet">
+          <button className="link-btn" onClick={() => attempt(() => modsApi.openLog(crash.tag))}>
+            {t("openLogButton")}
+          </button>
+          <span aria-hidden="true">·</span>
+          <button className="link-btn" onClick={clearCrash}>
+            {t("mods.dismiss")}
+          </button>
+        </span>
+      </span>
+      {(error || actionError) && <ErrorText error={(error ?? actionError)!} className="blockers-error" />}
+    </section>
+  );
+}
+
+/** A crash is a result of Play: said once, politely. */
+function CrashSaid({ id, text }: { id: string; text: string }) {
+  const announce = useAnnounce();
+  useEffect(() => announce(`crash:${id}`, text), [id, text, announce]);
+  return null;
+}
diff --git a/src/components/mods/ModFixes.tsx b/src/components/mods/ModFixes.tsx
new file mode 100644
index 0000000..4651403
--- /dev/null
+++ b/src/components/mods/ModFixes.tsx
@@ -0,0 +1,331 @@
+import { useEffect, useState, type ReactNode } from "react";
+import { pagerIndex, pagerStep, type PagerAt } from "../../mods/blockerPager";
+import { useI18n } from "../../i18n/useI18n";
+import { showError, type Shown } from "../../i18n/errors";
+import { useModProfiles, useMods, useModsCatalog } from "../../hooks/useMods";
+import { modsApi } from "../../mods/api";
+import { catalogModFor } from "../../mods/select";
+import { blockers, type Fix } from "../../mods/status";
+import type { CatalogMod, InstalledMod } from "../../mods/types";
+import { Announce } from "../Announce";
+import { useAnnounce } from "../LiveRegion";
+import { ErrorText } from "../ErrorText";
+import { InstallDialog } from "./InstallDialog";
+import { FileInstallDialog } from "./FileInstallDialog";
+import { pickModFile } from "./pickModFile";
+import { unreachable } from "../../utils/never";
+
+/** A build to review in the install dialog, opened from a fix button. */
+export interface ReviewRequest {
+  mod: CatalogMod;
+  sha256: string;
+}
+
+/**
+ * The install dialog for a fix's "Update to…" or "Install…", wherever the fix was offered. Every
+ * install goes through the review, also one click away from a problem.
+ */
+export function useReviewDialog(tag: string | null) {
+  const { catalog } = useModsCatalog();
+  const { t } = useI18n();
+  const [request, setRequest] = useState<ReviewRequest | null>(null);
+  /** A zip from the player's computer, in the From file dialog: what replaces a file mod. */
+  const [filePath, setFilePath] = useState<string | null>(null);
+  /** An update for an installed mod: its catalogue entry, if the catalogue still has it. */
+  const openUpdate = (mod: InstalledMod, sha256: string) => {
+    const entry = catalogModFor(catalog, mod);
+    if (entry) setRequest({ mod: entry, sha256 });
+  };
+  const canUpdate = (mod: InstalledMod) => !!catalogModFor(catalog, mod);
+  /** Asks for a zip and shows it in the From file dialog; throws what the picker threw. */
+  const openFile = async () => {
+    const path = await pickModFile(t("mods.fileFilter"));
+    if (path) setFilePath(path);
+  };
+  const dialog =
+    request && tag ? (
+      <InstallDialog tag={tag} mod={request.mod} initialSha={request.sha256} allowPrerelease onClose={() => setRequest(null)} />
+    ) : filePath && tag ? (
+      <FileInstallDialog tag={tag} path={filePath} onClose={() => setFilePath(null)} />
+    ) : null;
+  return { openUpdate, canUpdate, openInstall: (mod: CatalogMod, sha256: string) => setRequest({ mod, sha256 }), openFile, dialog };
+}
+
+export type Review = ReturnType<typeof useReviewDialog>;
+
+/**
+ * Once the player's own folder was shown, the launcher looks at it again each time they come back
+ * to the window: only they can remove a file there, and they may take more than one trip.
+ */
+function useLookAgainOnReturn(tag: string) {
+  const { loadProfile } = useModProfiles();
+  const [armed, setArmed] = useState(false);
+  useEffect(() => {
+    if (!armed) return;
+    const again = () => loadProfile(tag, true);
+    window.addEventListener("focus", again);
+    return () => window.removeEventListener("focus", again);
+  }, [armed, tag, loadProfile]);
+  return () => setArmed(true);
+}
+
+export function useFix(tag: string, review: Review) {
+  const { setEnabled, profile } = useMods();
+  const [error, setError] = useState<Shown | null>(null);
+  const lookAgain = useLookAgainOnReturn(tag);
+  const apply = async (fix: Fix) => {
+    setError(null);
+    if (fix.kind === "install") return review.openInstall(fix.mod, fix.sha256);
+    if (fix.kind === "update") {
+      const mod = profile(tag)?.mods.find((m) => m.id === fix.id);
+      return mod && review.openUpdate(mod, fix.sha256);
+    }
+    if (fix.kind === "replaceFile") {
+      try {
+        await review.openFile();
+      } catch (err) {
+        setError(showError(err));
+      }
+      return;
+    }
+    if (fix.kind === "showFolder") {
+      // Only the player can remove their own file; the launcher looks again when they're back.
+      lookAgain();
+      try {
+        await modsApi.openPlayerModsFolder();
+      } catch (err) {
+        setError(showError(err));
+      }
+      return;
+    }
+    const r = await setEnabled(tag, fix.id, fix.kind === "turnOn");
+    if (r.status === "failed") setError(r.shown);
+  };
+  /** Several turn-offs, one after the other; stops at the first that fails and says why. */
+  const applyAll = async (fixes: Fix[]) => {
+    setError(null);
+    for (const fix of fixes) {
+      if (fix.kind !== "turnOff") continue;
+      const r = await setEnabled(tag, fix.id, false);
+      if (r.status === "failed") return setError(r.shown);
+    }
+  };
+  return { apply, applyAll, error, lookAgain };
+}
+
+/** The buttons for a list of fixes: turn off, turn on, install a dependency, update. */
+export function FixButtons({ tag, fixes, locked, review, apply, flat = false }: { tag: string; fixes: Fix[]; locked: boolean; review: Review; apply: (f: Fix) => void; flat?: boolean }) {
+  const { t } = useI18n();
+  const { isBusy, profile } = useMods();
+  const label = (fix: Fix) => {
+    switch (fix.kind) {
+      case "turnOff":
+        return t("mods.turnOff", fix.name);
+      case "turnOn":
+        return t("mods.turnOn", fix.name);
+      case "install":
+        return t("mods.installDep", fix.name);
+      case "update":
+        return fix.tentative ? t("mods.tryUpdate", fix.version) : t("mods.update", fix.version);
+      case "showFolder":
+        return t("mods.showFolderFix", fix.file);
+      case "replaceFile":
+        return t("mods.replaceFromFile", fix.name);
+      default:
+        return unreachable(fix);
+    }
+  };
+  const disabled = (fix: Fix) => {
+    if (locked || isBusy(tag, fix.id)) return true;
+    if (fix.kind !== "update") return false;
+    const mod = profile(tag)?.mods.find((m) => m.id === fix.id);
+    return !mod || !review.canUpdate(mod);
+  };
+  const primary = (fix: Fix) => fix.kind === "update" || fix.kind === "install" || fix.kind === "showFolder" || fix.kind === "replaceFile";
+  return (
+    <>
+      {fixes.map((fix) => (
+        <button
+          key={`${fix.kind}:${fix.id}`}
+          className={flat ? `btn-flat${primary(fix) ? " primary" : ""}` : `btn-small ${primary(fix) ? "btn-primary" : "btn-secondary"}`}
+          disabled={disabled(fix)}
+          onClick={() => apply(fix)}
+          data-fix={fix.kind}
+        >
+          {label(fix)}
+        </button>
+      ))}
+    </>
+  );
+}
+
+interface BlockerPanelProps {
+  tag: string;
+  locked: boolean;
+  review: Review;
+  id?: string;
+  /**
+   * In a banner on the Mods tab: one blocking mod at a time, whole, with all its fixes, and a
+   * pager to the others. The list below keeps its rows in view however many mods block.
+   */
+  inBanner?: boolean;
+}
+
+type Blockers = ReturnType<typeof blockers>;
+
+/**
+ * Each mod that stops this version, why, and the one-click fixes. The same on Home and on the
+ * Mods tab. Rendered also while nothing blocks, so a problem that comes back is said again.
+ */
+export function BlockerPanel({ tag, locked, review, id, inBanner = false }: BlockerPanelProps) {
+  const { tn, tm } = useI18n();
+  const { profile, nameIn, catalog } = useMods();
+  const fix = useFix(tag, review);
+  const list = blockers(profile(tag), nameIn(tag), catalog);
+  const title = tn("mods.homeBlocked", list.length, tag);
+  // Assertive, and only for what wasn't there a moment ago: a new mod, or a new reason for one.
+  const said = (
+    <Announce
+      channel={`blockers:${tag}`}
+      items={list.map((b) => ({ id: `${b.mod.id}|${b.reasons.map((r) => r.key).join(",")}`, text: [...b.reasons.map(tm), ...(b.quote ? [tm(b.quote)] : [])].join(" ") }))}
+      prefix={title}
+    />
+  );
+  if (!list.length) return said;
+  const view = { tag, list, title, id, locked, review, fix };
+  return (
+    <>
+      {inBanner ? <BannerBlockers {...view} said={said} /> : <ListedBlockers {...view} said={said} />}
+    </>
+  );
+}
+
+interface BlockersView {
+  tag: string;
+  list: Blockers;
+  title: string;
+  id?: string;
+  locked: boolean;
+  review: Review;
+  fix: ReturnType<typeof useFix>;
+  said: ReactNode;
+}
+
+/** One translated sentence per reason, each naming the mod (shown in its colour), never cut. */
+function ReasonLines({ blocker: b, withQuote }: { blocker: Blockers[number]; withQuote: boolean }) {
+  const { tm } = useI18n();
+  return (
+    <span className="blocker-text" data-must-fit>
+      {b.reasons.map(tm).map((text, i) => (
+        <span key={i} className="blocker-line">
+          <Named text={text} name={b.mod.name} />
+        </span>
+      ))}
+      {withQuote && b.quote && <span className="blocker-line blocker-quote">{tm(b.quote)}</span>}
+    </span>
+  );
+}
+
+/** The banner's page among the blocking mods: which one shows, and paging, said politely. */
+export function useBlockerPager(tag: string, list: Blockers) {
+  const announce = useAnnounce();
+  const { t } = useI18n();
+  const [at, setAt] = useState<PagerAt>({ id: null, index: 0 });
+  const index = pagerIndex(
+    list.map((b) => b.mod.id),
+    at
+  );
+  const go = (step: number) => {
+    const next = pagerStep(list.length, index, step);
+    setAt({ id: list[next].mod.id, index: next });
+    announce(`blocker-page:${tag}:${next}:${Date.now()}`, t("mods.blockerPage", String(next + 1), String(list.length)));
+  };
+  return { index, shown: list[index], go, many: list.length > 1 };
+}
+
+/** On the Mods tab: one blocking mod at a time, with its fixes and a pager. */
+function BannerBlockers({ tag, list, title, id, locked, review, fix, said }: BlockersView) {
+  const { t, tn } = useI18n();
+  const { isBusy } = useMods();
+  const { index, shown, go, many } = useBlockerPager(tag, list);
+  // When every mod that blocks can simply be turned off, one press does them all.
+  const offs = list.flatMap((b) => b.fixes.filter((f) => f.kind === "turnOff").slice(0, 1));
+  const allOff = many && offs.length === list.length;
+  return (
+    <section className="blockers in-banner" id={id} aria-label={title}>
+      {said}
+      <div className="blocker" data-blocker={shown.mod.id}>
+        <span className="blocker-head">
+          <ReasonLines blocker={shown} withQuote={false} />
+          {allOff && (
+            <button
+              className="btn-flat blocker-all"
+              data-fix="turnOffAll"
+              disabled={locked || list.some((b) => isBusy(tag, b.mod.id))}
+              onClick={() => fix.applyAll(offs)}
+            >
+              {tn("mods.turnOffAll", list.length)}
+            </button>
+          )}
+        </span>
+        <span className="blocker-foot">
+          <span className="blocker-actions" role="group" aria-label={t("mods.fixesFor", shown.mod.name)}>
+            <FixButtons tag={tag} fixes={shown.fixes} locked={locked} review={review} apply={fix.apply} flat />
+          </span>
+          {many && (
+            <span className="blocker-pager" role="group" aria-label={t("mods.blockerPager")}>
+              <button className="pager-btn" onClick={() => go(-1)} aria-label={t("mods.blockerPrev")}>
+                ‹
+              </button>
+              <span className="pager-at" data-must-fit>
+                {t("mods.blockerPage", String(index + 1), String(list.length))}
+              </span>
+              <button className="pager-btn" onClick={() => go(1)} aria-label={t("mods.blockerNext")}>
+                ›
+              </button>
+            </span>
+          )}
+        </span>
+      </div>
+      {fix.error && <ErrorText error={fix.error} className="blockers-error" />}
+    </section>
+  );
+}
+
+/** On Home and Versions: every blocking mod, each with its reasons and fixes. */
+function ListedBlockers({ tag, list, title, id, locked, review, fix, said }: BlockersView) {
+  const { t, tn } = useI18n();
+  return (
+    <section className="blockers play-blocked" id={id} aria-label={title}>
+      {said}
+      {/* What Play's own description says: why it is off, in a few words. */}
+      <span className="play-off" id={id ? `${id}-why` : undefined}>
+        {list.length === 1 ? t("mods.playOffOne", list[0].mod.name) : tn("mods.playOffMany", list.length)}
+      </span>
+      <ul className="blocker-list">
+        {list.map((b) => (
+          <li key={b.mod.id} className="blocker" data-blocker={b.mod.id}>
+            <ReasonLines blocker={b} withQuote />
+            <span className="blocker-actions" role="group" aria-label={t("mods.fixesFor", b.mod.name)}>
+              <FixButtons tag={tag} fixes={b.fixes} locked={locked} review={review} apply={fix.apply} />
+            </span>
+          </li>
+        ))}
+      </ul>
+      {fix.error && <ErrorText error={fix.error} className="blockers-error" />}
+    </section>
+  );
+}
+
+/** A sentence with the mod's name in it, the name drawn in the name colour. */
+function Named({ text, name }: { text: string; name: string }) {
+  const at = name ? text.indexOf(name) : -1;
+  if (at < 0) return <>{text}</>;
+  return (
+    <>
+      {text.slice(0, at)}
+      <strong>{name}</strong>
+      {text.slice(at + name.length)}
+    </>
+  );
+}
diff --git a/src/components/mods/ModIcon.tsx b/src/components/mods/ModIcon.tsx
new file mode 100644
index 0000000..70dc72b
--- /dev/null
+++ b/src/components/mods/ModIcon.tsx
@@ -0,0 +1,61 @@
+import { useEffect, useState } from "react";
+import { modsApi } from "../../mods/api";
+import { iconUrlAllowed } from "../../mods/select";
+
+const loaded = new Map<string, Promise<string | null>>();
+
+function iconData(url: string): Promise<string | null> {
+  let p = loaded.get(url);
+  if (!p) {
+    p = modsApi.icon(url).catch(() => null);
+    loaded.set(url, p);
+  }
+  return p;
+}
+
+const COLORS = ["#e09632", "#8c97ad", "#4fa25e", "#c2503c", "#ffc457", "#9bb7e3"];
+
+function hash(s: string): number {
+  let h = 2166136261;
+  for (let i = 0; i < s.length; i++) h = Math.imul(h ^ s.charCodeAt(i), 16777619);
+  return h >>> 0;
+}
+
+/** A mirrored 5×5 pixel pattern from the id, so a mod without an icon still looks like itself. */
+function Glyph({ id }: { id: string }) {
+  const h = hash(id);
+  const rects = [];
+  for (let y = 0; y < 5; y++) {
+    for (let x = 0; x < 3; x++) {
+      if ((h >> (y * 3 + x)) & 1) {
+        rects.push(<rect key={`${x},${y}`} x={x} y={y} width="1" height="1" />);
+        if (x < 2) rects.push(<rect key={`m${x},${y}`} x={4 - x} y={y} width="1" height="1" />);
+      }
+    }
+  }
+  return (
+    <svg className="pixel-icon" width="30" height="30" viewBox="0 0 5 5" fill={COLORS[h % COLORS.length]} aria-hidden="true">
+      {rects}
+    </svg>
+  );
+}
+
+/** The mod's icon, when it comes from GitHub; else (or until it loads) its pattern. */
+export function ModIcon({ id, url }: { id: string; url: string | null }) {
+  const [src, setSrc] = useState<string | null>(null);
+
+  useEffect(() => {
+    let live = true;
+    setSrc(null);
+    if (url && iconUrlAllowed(url)) iconData(url).then((d) => live && setSrc(d));
+    return () => {
+      live = false;
+    };
+  }, [url]);
+
+  return (
+    <div className="mod-icon" aria-hidden="true">
+      {src ? <img src={src} alt="" width={40} height={40} /> : <Glyph id={id} />}
+    </div>
+  );
+}
diff --git a/src/components/mods/ModProgressBar.tsx b/src/components/mods/ModProgressBar.tsx
new file mode 100644
index 0000000..bf3a73e
--- /dev/null
+++ b/src/components/mods/ModProgressBar.tsx
@@ -0,0 +1,94 @@
+import { useEffect, useId, useRef, useState } from "react";
+import { useI18n } from "../../i18n/useI18n";
+import type { UiProgress, UiStage } from "../../mods/types";
+import type { MessageKey } from "../../i18n";
+import { useAnnounce } from "../LiveRegion";
+import { dwellDelay, stepKey } from "../../mods/progress";
+
+/** What is shown: "downloading 40%" has the percent in it, the others don't. */
+const STEP: Record<UiStage, MessageKey> = {
+  preparing: "mods.stepPreparing",
+  downloading: "mods.stepDownloading",
+  verifying: "mods.stepVerifying",
+  installing: "mods.stepInstalling",
+};
+/** What is said, once per step: never a number, so nothing like a lone "%" is left behind. */
+const SPOKEN: Record<UiStage, MessageKey> = { ...STEP, downloading: "mods.stepDownloadingSpoken" };
+
+/**
+ * The progress record to show: the newest, except that a file's check is held for
+ * VERIFY_DWELL once it shows, however quickly the backend moves on. The whole record is held,
+ * not only its stage, so the file's number, its name and what is happening to it always describe
+ * the same file. Only what is drawn waits; the operation doesn't.
+ */
+function useDwell(progress: UiProgress | undefined): UiProgress | undefined {
+  const [shown, setShown] = useState(progress);
+  const since = useRef(Date.now());
+  useEffect(() => {
+    if (progress === shown) return;
+    const show = () => {
+      if (stepKey(progress) !== stepKey(shown)) since.current = Date.now();
+      setShown(progress);
+    };
+    const wait = dwellDelay(shown, progress, since.current, Date.now());
+    if (wait <= 0) return show();
+    const timer = setTimeout(show, wait);
+    return () => clearTimeout(timer);
+  }, [progress, shown]);
+  return shown;
+}
+
+interface ModProgressBarProps {
+  progress: UiProgress | undefined;
+  /** The name of the mod a progress record is about: asked of the record shown, never another. */
+  nameOf: (p: UiProgress) => string;
+  /** Offered while the operation can still stop: until its files are being installed. */
+  onCancel?: () => void;
+  cancelling?: boolean;
+  /** Where there is no room for the words, e.g. a Browse card: the bar and the step only. */
+  compact?: boolean;
+}
+
+/**
+ * Which file of the operation is being worked on, what is happening to it, and a way to stop:
+ * "File 2 of 3: Glowmoss, downloading 40%". The step is said once per change, not each percent.
+ */
+export function ModProgressBar({ progress, nameOf, onCancel, cancelling = false, compact = false }: ModProgressBarProps) {
+  const announce = useAnnounce();
+  const { t } = useI18n();
+  const shown = useDwell(progress);
+  const stage = shown?.stage ?? "preparing";
+  const percent = stage === "downloading" ? (shown?.percent ?? 0) : stage === "preparing" ? 0 : 100;
+  const count = shown?.count ?? 1;
+  const index = shown?.index ?? 1;
+  const name = shown ? nameOf(shown) : "";
+  const whole = (step: string) => (count > 1 ? t("mods.progressOf", String(index), String(count), name, step) : t("mods.progressOne", name, step));
+  const step = t(STEP[stage], String(percent));
+  const label = whole(step);
+  // Said on each new file and step, not on each percent.
+  const spoken = whole(t(SPOKEN[stage]));
+  const canCancel = !!onCancel && stage !== "installing";
+  // Said through the one live region, once per file and step of this bar. A compact bar sits
+  // beside a full one that says the same, so only the full one speaks.
+  const bar = useId();
+  useEffect(() => {
+    if (!compact) announce(`progress:${bar}:${spoken}`, spoken);
+  }, [bar, compact, spoken, announce]);
+  return (
+    <div className={`progress-container${compact ? " compact" : ""}`} data-stage={stage}>
+      <div className="progress-row">
+        <div className="progress-bar" role="progressbar" aria-valuenow={percent} aria-valuemin={0} aria-valuemax={100} aria-label={label}>
+          <div className="progress-fill" style={{ width: `round(down, ${percent}%, 4px)` }} />
+        </div>
+        {onCancel && (
+          <button className="btn-secondary btn-small progress-cancel" onClick={onCancel} disabled={!canCancel || cancelling}>
+            {cancelling ? t("mods.cancelling") : t("mods.cancelOperation")}
+          </button>
+        )}
+      </div>
+      <span className="progress-label" aria-hidden="true">
+        {compact ? step : label}
+      </span>
+    </div>
+  );
+}
diff --git a/src/components/mods/PlanChanges.tsx b/src/components/mods/PlanChanges.tsx
new file mode 100644
index 0000000..8bd2c40
--- /dev/null
+++ b/src/components/mods/PlanChanges.tsx
@@ -0,0 +1,42 @@
+import { useState } from "react";
+import { useI18n } from "../../i18n/useI18n";
+import type { RichMsg } from "../../mods/checks";
+import { useAnnounce } from "../LiveRegion";
+import { RichText } from "./RichText";
+
+/** What is different in the new plan, after the backend refused the one the player agreed to. */
+export function PlanChanges({ changes }: { changes: RichMsg[] }) {
+  const { t } = useI18n();
+  return (
+    <div className="plan-changes" data-testid="plan-changes">
+      <p className="plan-changes-title">{t("mods.changedTitle")}</p>
+      <ul>
+        {changes.map((c, i) => (
+          <li key={i}>
+            <RichText msg={c} />
+          </li>
+        ))}
+      </ul>
+    </div>
+  );
+}
+
+/** A calm line in a dialog when the player cancelled: nothing changed, and that isn't an error. */
+export function useOutcomeNote() {
+  const announce = useAnnounce();
+  const { t } = useI18n();
+  const [cancelledAt, setCancelledAt] = useState<number | null>(null);
+  return {
+    cancelled: () => {
+      const at = Date.now();
+      setCancelledAt(at);
+      announce(`cancelled:${at}`, t("errors.modCancelled"));
+    },
+    clear: () => setCancelledAt(null),
+    node: cancelledAt ? (
+      <p className="dialog-note calm-note" data-testid="cancelled-note">
+        {t("errors.modCancelled")}
+      </p>
+    ) : null,
+  };
+}
diff --git a/src/components/mods/RichText.tsx b/src/components/mods/RichText.tsx
new file mode 100644
index 0000000..0da4619
--- /dev/null
+++ b/src/components/mods/RichText.tsx
@@ -0,0 +1,19 @@
+import { ReactNode } from "react";
+import { useI18n } from "../../i18n/useI18n";
+import { translateError } from "../../i18n/errors";
+import type { Arg, RichMsg } from "../../mods/checks";
+import { Code } from "../Truncate";
+import { TRUST_LABEL } from "./TrustBadge";
+
+/** A message from src/mods: placeholders become text, days in the reader's language, short codes with their full value, or tier names. */
+export function RichText({ msg }: { msg: RichMsg }) {
+  const { t, tr, formatDay } = useI18n();
+  const render = (arg: Arg): ReactNode => {
+    if (typeof arg === "string") return arg;
+    if ("day" in arg) return formatDay(arg.day);
+    if ("code" in arg) return <Code full={arg.code} short={arg.short} />;
+    if ("error" in arg) return translateError(arg.error);
+    return t(TRUST_LABEL[arg.trust]);
+  };
+  return <>{tr(msg.key, ...(msg.args ?? []).map(render))}</>;
+}
diff --git a/src/components/mods/SourcesDialog.tsx b/src/components/mods/SourcesDialog.tsx
new file mode 100644
index 0000000..310c0c9
--- /dev/null
+++ b/src/components/mods/SourcesDialog.tsx
@@ -0,0 +1,286 @@
+import { useEffect, useId, useState } from "react";
+import { openUrl } from "@tauri-apps/plugin-opener";
+import { useI18n } from "../../i18n/useI18n";
+import { showError, type Shown } from "../../i18n/errors";
+import { ErrorDetails, ErrorText } from "../ErrorText";
+import { useModsCatalog } from "../../hooks/useMods";
+import { parseRepo, sameRepo } from "../../mods/select";
+import { Dialog } from "../Dialog";
+import { Truncate } from "../Truncate";
+import { PixelIcon } from "../PixelIcon";
+import { BANG, CHECK } from "./glyphs";
+import { indexProblem, sourceProblem } from "./catalogBanners";
+import type { Catalog, NoModsReason, SourceStatus } from "../../mods/types";
+import type { MessageKey } from "../../i18n";
+
+const INDEX_REPO = "https://github.com/Weft-Rust/weft-mods-index";
+/** What a repo must publish to be a source. */
+const SOURCE_FORMAT = "https://github.com/Zorro909/Weft-Launcher/blob/master/docs/mod-manager/AUTHORING.md#when-a-source-shows-no-mods";
+
+/** One whole sentence per reason, so each language words it in its own order. */
+const NO_MODS: Record<NoModsReason, MessageKey> = {
+  noReleases: "mods.sourceNoModsLineNoReleases",
+  noModFiles: "mods.sourceNoModsLineNoFiles",
+  unreadable: "mods.sourceNoModsLineUnreadable",
+  noDigest: "mods.sourceNoModsLineNoDigest",
+  disagrees: "mods.sourceNoModsLineDisagrees",
+  invalid: "mods.sourceNoModsLineInvalid",
+};
+
+/**
+ * The index's own state, not a mod's tier: a mod is Reviewed; the index is signed, and its
+ * signature checked on a day. Amber when that signature is old, or only a saved copy is used.
+ */
+function IndexBadge({ index }: { index: Catalog["index"] | undefined }) {
+  const { t, formatDay } = useI18n();
+  if (!index || index.freshness === "unavailable" || !index.generated) {
+    return (
+      <span className="badge index-badge none" data-state="none">
+        <PixelIcon rows={BANG} />
+        {t("mods.indexBadgeNone")}
+      </span>
+    );
+  }
+  const day = formatDay(index.signedAt ?? index.generated);
+  const ok = index.freshness === "fresh" && !index.error;
+  return (
+    <span className={`badge index-badge ${ok ? "ok" : "stale"}`} data-state={ok ? "ok" : index.freshness}>
+      <PixelIcon rows={ok ? CHECK : BANG} />
+      {t(ok ? "mods.indexBadgeSigned" : index.freshness === "stale" ? "mods.indexBadgeStale" : "mods.indexBadgeCopy", day)}
+    </span>
+  );
+}
+
+/** A source's line: how many mods, when checked, and when there are none, why. */
+function sourceMeta(s: SourceStatus | undefined, checking: boolean, t: (k: MessageKey, ...a: string[]) => string, tn: (k: "mods.sourcesMods", n: number) => string, formatDay: (iso: string | null) => string) {
+  if (!s || (!s.checked && !s.error)) return checking ? t("mods.sourcesChecking") : t("mods.sourcesNotChecked");
+  if (s.mods === 0 && s.noMods) return t(NO_MODS[s.noMods]);
+  return [tn("mods.sourcesMods", s.mods), s.checked ? t("mods.sourcesChecked", formatDay(s.checked)) : ""].filter(Boolean).join(" · ");
+}
+
+export function SourcesDialog({ onClose }: { onClose: () => void }) {
+  const { t, tn, formatDay } = useI18n();
+  const mods = useModsCatalog();
+  const { catalog, catalogError, catalogLoading, refreshCatalog, refreshSource, sourceRefreshing, sourceList: repos, sourceChange } = mods;
+  const loadError = mods.sourceListError ? showError(mods.sourceListError) : null;
+  // The list couldn't be read and was kept aside: adding a source starts a new one.
+  const damaged = mods.sourceListError?.code === "ModSourcesDamaged";
+  const [input, setInput] = useState("");
+  const [error, setError] = useState<Shown | null>(null);
+  const [confirming, setConfirming] = useState<string | null>(null);
+  const [rowError, setRowError] = useState<{ repo: string; error: Shown } | null>(null);
+  const [changed, setChanged] = useState(false);
+  const inputId = useId();
+  const errorId = useId();
+  const adding = sourceChange?.kind === "add";
+  const removing = sourceChange?.kind === "remove" ? sourceChange.repo : null;
+
+  const load = mods.loadSources;
+  useEffect(() => {
+    load();
+  }, [load]);
+
+  const add = async () => {
+    if (sourceChange || !input.trim()) return;
+    const repo = parseRepo(input);
+    if (!repo) {
+      setError(showError({ code: "ModSourceInvalid", detail: input.trim() }));
+      return;
+    }
+    setError(null);
+    const r = await mods.addSource(repo);
+    if (r.status === "failed") return setError(r.shown);
+    if (r.status !== "done") return;
+    setInput("");
+    // Asked at once, alone, so the dialog says what the new source has before it closes.
+    retrySource(repo);
+  };
+
+  const remove = async (repo: string) => {
+    if (sourceChange) return;
+    setRowError(null);
+    const r = await mods.removeSource(repo);
+    if (r.status === "failed") return setRowError({ repo, error: r.shown });
+    if (r.status !== "done") return;
+    setConfirming(null);
+    setChanged(true);
+  };
+
+  /** One source asked again; a failure to even ask is said on its row. */
+  const retrySource = async (repo: string) => {
+    setRowError(null);
+    const failed = await refreshSource(repo);
+    if (failed) setRowError({ repo, error: showError(failed) });
+  };
+
+  const close = () => {
+    if (changed) refreshCatalog();
+    onClose();
+  };
+
+  const locked = adding || removing !== null;
+  const status = (repo: string) => catalog?.sources.find((s) => sameRepo(s.repo, repo));
+  const index = catalog?.index;
+  // The same words as the banner on the Mods tab: stale, cached and why, or never reached.
+  const indexMeta = !index
+    ? t("mods.sourcesIndexNone")
+    : index.freshness === "fresh" && !index.error
+      ? t("mods.sourcesIndexFresh")
+      : index.freshness === "stale" && !index.error
+        ? t("mods.sourcesIndexStale", formatDay(index.signedAt ?? index.generated))
+        : (indexProblem(index, t, formatDay) ?? t("mods.sourcesIndexNone"));
+  const retry = (
+    <button className="btn-secondary btn-small" onClick={refreshCatalog} disabled={catalogLoading || locked}>
+      {catalogLoading ? t("mods.retrying") : t("mods.sourcesRetry")}
+    </button>
+  );
+
+  return (
+    <Dialog
+      onClose={close}
+      locked={locked}
+      title={t("mods.sourcesTitle")}
+      footer={
+        <button className="btn-secondary" onClick={close} disabled={locked} data-autofocus>
+          {t("mods.close")}
+        </button>
+      }
+    >
+      <p className="dialog-summary">{t("mods.sourcesIntro")}</p>
+      <ul className="source-list">
+        <li className="source-row">
+          <span className="source-title">
+            <span className="source-name">{t("mods.sourcesIndex")}</span>
+            <IndexBadge index={index} />
+          </span>
+          <span className={`source-meta${index?.error || index?.freshness === "stale" ? " bad" : ""}`} data-testid="index-meta">
+            {indexMeta}
+            {/* The backend's words, apart from ours, folded like every other error's. */}
+            {index?.error && showError(index.error).detail && <ErrorDetails detail={showError(index.error).detail!} label={t("errors.details")} />}
+            {index?.cacheError && (
+              <span className="source-unsaved">
+                {" "}
+                {t("mods.sourcesIndexUnsaved")}
+                {showError(index.cacheError).detail && <ErrorDetails detail={showError(index.cacheError).detail!} label={t("errors.details")} />}
+              </span>
+            )}
+          </span>
+          <span className="source-actions">
+            {(index?.error || index?.freshness === "stale") && retry}
+            <button className="link-btn" onClick={() => openUrl(INDEX_REPO)}>
+              {t("mods.viewSource")}
+            </button>
+          </span>
+        </li>
+        {catalogError && catalog && (
+          <li className="source-row source-refresh">
+            <ErrorText error={showError(catalogError)} lead={t("mods.refreshFailed")} className="source-meta bad" speak={false} />
+          </li>
+        )}
+        {repos?.map((repo) => {
+          const s = status(repo);
+          const asking = confirming !== null && sameRepo(confirming, repo);
+          const working = removing !== null && sameRepo(removing, repo);
+          const none = !!s && !s.error && s.mods === 0 && !!s.noMods;
+          const asked = sourceRefreshing(repo);
+          return (
+            <li className={`source-row${asking ? " confirming" : ""}`} key={repo} data-repo={repo}>
+              <span className="source-title">
+                <Truncate focusable className="source-name" text={repo} />
+                <span className="badge channel">{t("mods.sourceBadgeRepo")}</span>
+              </span>
+              <span className={`source-meta${s?.error ? " bad" : none ? " warn" : ""}`} data-testid="source-meta">
+                {asked ? t("mods.sourcesChecking") : s?.error ? sourceProblem(s, t, formatDay) : sourceMeta(s, catalogLoading, t, tn, formatDay)}
+                {none && (
+                  <>
+                    {" "}
+                    <button className="link-btn" onClick={() => openUrl(SOURCE_FORMAT)}>
+                      {t("mods.sourceFormatLink")}
+                    </button>
+                  </>
+                )}
+              </span>
+              {(s?.error || asked) && !asking && (
+                <span className="source-row-retry">
+                  <button
+                    className="btn-secondary btn-small"
+                    onClick={() => retrySource(repo)}
+                    disabled={asked || locked}
+                    aria-label={t("mods.sourceRetryLabel", repo)}
+                  >
+                    {asked ? t("mods.retrying") : t("mods.sourcesRetry")}
+                  </button>
+                </span>
+              )}
+              {asking ? (
+                <span className="source-confirm">
+                  <span className="source-confirm-text">{t("mods.sourcesRemoveConfirm", repo)}</span>
+                  <span className="source-confirm-actions">
+                    <button className="btn-danger btn-small" onClick={() => remove(repo)} disabled={locked}>
+                      {working ? t("mods.sourcesRemoving") : t("mods.sourcesRemove")}
+                    </button>
+                    <button className="btn-secondary btn-small" onClick={() => setConfirming(null)} disabled={locked} data-autofocus>
+                      {t("mods.sourcesKeep")}
+                    </button>
+                  </span>
+                </span>
+              ) : (
+                <button
+                  className="btn-secondary btn-small"
+                  onClick={() => {
+                    setRowError(null);
+                    setConfirming(repo);
+                  }}
+                  disabled={locked}
+                  aria-label={t("mods.sourcesRemoveLabel", repo)}
+                >
+                  {t("mods.sourcesRemove")}
+                </button>
+              )}
+              {rowError && sameRepo(rowError.repo, repo) && (
+                <ErrorText error={rowError.error} className="inline-error source-error" />
+              )}
+            </li>
+          );
+        })}
+      </ul>
+      {repos === null &&
+        (loadError ? (
+          <ErrorText error={loadError} lead={damaged ? undefined : t("mods.sourcesLoadFailedLead")}>
+            <button className="btn-secondary btn-small" onClick={load}>
+              {t("mods.retry")}
+            </button>
+          </ErrorText>
+        ) : (
+          <p className="dialog-note" role="status">
+            {t("loading")}
+          </p>
+        ))}
+      <div className="dialog-field">
+        <label className="dialog-field-label" htmlFor={inputId}>
+          {t("mods.sourcesAddLabel")}
+        </label>
+        <input
+          id={inputId}
+          className="text-input"
+          value={input}
+          placeholder={t("mods.sourcesAddPlaceholder")}
+          onChange={(e) => setInput(e.target.value)}
+          onKeyDown={(e) => {
+            if (e.key === "Enter" && !e.repeat) add();
+          }}
+          spellCheck={false}
+          autoComplete="off"
+          readOnly={adding}
+          aria-invalid={!!error || undefined}
+          aria-describedby={error ? errorId : undefined}
+        />
+        <button className="btn-secondary" onClick={add} disabled={locked || !input.trim()}>
+          {adding ? t("mods.sourcesAdding") : t("mods.sourcesAdd")}
+        </button>
+      </div>
+      <p className="dialog-note">{t("mods.sourcesWarning")}</p>
+      {error && <ErrorText error={error} id={errorId} />}
+    </Dialog>
+  );
+}
diff --git a/src/components/mods/TrustBadge.tsx b/src/components/mods/TrustBadge.tsx
new file mode 100644
index 0000000..c7b90e3
--- /dev/null
+++ b/src/components/mods/TrustBadge.tsx
@@ -0,0 +1,70 @@
+import { useId } from "react";
+import { useI18n } from "../../i18n/useI18n";
+import type { MessageKey } from "../../i18n";
+import type { Channel, Trust } from "../../mods/types";
+import { PixelIcon } from "../PixelIcon";
+import { useTip } from "../Truncate";
+import { BANG, CHECK, CROSS, HAMMER } from "./glyphs";
+
+const GLYPH: Record<Trust, string[]> = { reviewed: CHECK, unreviewed: HAMMER, unverified: BANG };
+export const TRUST_LABEL: Record<Trust, MessageKey> = {
+  reviewed: "mods.badgeReviewed",
+  unreviewed: "mods.badgeUnreviewed",
+  unverified: "mods.badgeUnverified",
+};
+const HINT: Record<Trust, MessageKey> = {
+  reviewed: "mods.badgeReviewedHint",
+  unreviewed: "mods.badgeUnreviewedHint",
+  unverified: "mods.badgeUnverifiedHint",
+};
+
+/**
+ * A badge whose word is always shown whole, with what it means a hover away. Not a tab stop: in
+ * a list that would be one per row. The explanation is a hidden element with `hintId`, which the
+ * row's own control (a switch, a card's details button) names in its `aria-describedby`, so it is
+ * heard from where focus already is; the details dialog says it in full.
+ */
+function ExplainedBadge({ className, glyph, word, hint, hintId }: { className: string; glyph?: string[]; word: string; hint: string; hintId?: string }) {
+  const { handlers, tip } = useTip(hint, true);
+  const ownId = useId();
+  const id = hintId ?? ownId;
+  return (
+    <>
+      <span className={`badge ${className}`} aria-describedby={id} data-must-fit {...handlers}>
+        {glyph && <PixelIcon rows={glyph} />}
+        <span className="badge-text">{word}</span>
+      </span>
+      {/* Hidden, yet it still describes the badge: a screen reader says the word, then this. */}
+      <span hidden id={id}>
+        {hint}
+      </span>
+      {tip}
+    </>
+  );
+}
+
+/** The tier, as a word and a glyph, never colour alone. */
+export function TrustBadge({ trust, hintId }: { trust: Trust; hintId?: string }) {
+  const { t } = useI18n();
+  return <ExplainedBadge className={`trust-${trust}`} glyph={GLYPH[trust]} word={t(TRUST_LABEL[trust])} hint={t(HINT[trust])} hintId={hintId} />;
+}
+
+/**
+ * In place of the tier on a mod pulled from the index: whatever it was, it isn't usable now. The
+ * index's reason is quoted, in the words (and language) the index gave it; the row says it too.
+ */
+export function RevokedBadge({ reason, hintId }: { reason: string | null; hintId?: string }) {
+  const { t } = useI18n();
+  const why = (reason ?? "").trim();
+  return <ExplainedBadge className="revoked" glyph={CROSS} word={t("mods.badgeRevoked")} hint={why ? t("mods.badgeRevokedHint", why) : t("mods.badgeRevokedHintNoReason")} hintId={hintId} />;
+}
+
+export function ChannelBadge({ channel }: { channel: Channel | null }) {
+  const { t } = useI18n();
+  if (!channel || channel === "release") return null;
+  return (
+    <span className="badge channel" data-must-fit>
+      <span className="badge-text">{t(channel === "experimental" ? "mods.badgeExperimental" : "mods.badgePrerelease")}</span>
+    </span>
+  );
+}
diff --git a/src/components/mods/catalogBanners.tsx b/src/components/mods/catalogBanners.tsx
new file mode 100644
index 0000000..0878316
--- /dev/null
+++ b/src/components/mods/catalogBanners.tsx
@@ -0,0 +1,211 @@
+import type { MessageKey } from "../../i18n";
+import { useI18n } from "../../i18n/useI18n";
+import { useModsCatalog } from "../../hooks/useMods";
+import type { Catalog, ErrorCode, SourceStatus } from "../../mods/types";
+import type { BannerItem } from "./BannerStack";
+import { rateLimitReset, showError } from "../../i18n/errors";
+import { formatTime } from "../../i18n";
+import { ErrorDetails } from "../ErrorText";
+import { httpStatus } from "../../mods/select";
+
+type T = (key: MessageKey, ...args: string[]) => string;
+
+/** Why a refresh failed, by what the player can do about it. */
+function cause(code: ErrorCode | undefined): "rate" | "gone" | "invalid" | "disk" | "server" | "network" {
+  switch (code) {
+    case "ModSourceRateLimited":
+    case "RateLimited":
+      return "rate";
+    case "ModSourceNotFound":
+      return "gone";
+    case "ModSourceInvalid":
+    case "IndexInvalid":
+    case "Serde":
+      return "invalid";
+    case "DiskFull":
+    case "Io":
+    case "CreateDir":
+      return "disk";
+    // It answered: never said as offline.
+    case "HttpStatus":
+      return "server";
+    default:
+      return "network";
+  }
+}
+
+/** The cause in a few words, for the folded row; the repo follows it. */
+const SOURCE_SHORT: Record<ReturnType<typeof cause>, MessageKey> = {
+  rate: "mods.sourceCauseRate",
+  gone: "mods.sourceCauseGone",
+  invalid: "mods.sourceCauseInvalid",
+  disk: "mods.sourceCauseDisk",
+  server: "mods.sourceCauseServer",
+  network: "mods.sourceCauseNetwork",
+};
+
+const SOURCE_CAUSE: Record<ReturnType<typeof cause>, MessageKey> = {
+  rate: "mods.sourceErrRate",
+  gone: "mods.sourceErrGone",
+  invalid: "mods.sourceErrInvalid",
+  disk: "mods.sourceErrDisk",
+  server: "mods.sourceErrServer",
+  network: "mods.sourceErrNetwork",
+};
+
+/** Why a source couldn't be refreshed and what is shown instead, as whole sentences. */
+export function sourceProblem(s: SourceStatus, t: T, formatDay: (iso: string | null) => string): string {
+  const shown =
+    s.freshness === "unavailable" || !s.checked ? t("mods.sourceShowingNone") : t("mods.sourceShowingFrom", formatDay(s.checked));
+  const until = rateLimitReset(s.error);
+  const why = until ? t("mods.sourceErrRateUntil", s.repo, formatTime(until)) : t(SOURCE_CAUSE[cause(s.error?.code)], s.repo);
+  return `${why} ${shown}`;
+}
+
+/** A new index arrived and was refused (bad signature, malformed, older than one accepted). */
+const refused = (code: ErrorCode | undefined) => code === "IndexSignatureInvalid" || code === "IndexInvalid" || code === "IndexRollback";
+
+/** The index's state as a sentence, or null when it is fresh. */
+export function indexProblem(index: Catalog["index"], t: T, formatDay: (iso: string | null) => string): string | null {
+  if (index.freshness === "fresh" && !index.error) return null;
+  if (index.freshness === "stale" && !index.error) return t("mods.indexStale", formatDay(index.signedAt ?? index.generated));
+  const code = index.error?.code;
+  const why =
+    code === "IndexSignatureInvalid" || code === "IndexInvalid"
+      ? t("mods.indexInvalid")
+      : code === "IndexRollback"
+        ? t("mods.indexRollback")
+        : cause(code) === "disk"
+          ? t("mods.indexDisk")
+          : cause(code) === "server"
+            ? t("mods.indexServerError")
+            : t("mods.indexUnreachable");
+  // Say why, also when there is nothing saved to show instead.
+  if (index.freshness === "unavailable" || !index.generated) return `${t("mods.indexUnavailable")} ${why}`;
+  return `${t("mods.indexShowingFrom", formatDay(index.generated))} ${why}`;
+}
+
+/** The index's state in a few words, for the folded row. */
+export function indexSummary(index: Catalog["index"], t: T, formatDay: (iso: string | null) => string): string | null {
+  if (index.freshness === "fresh" && !index.error) return null;
+  if (index.freshness === "unavailable" || !index.generated) {
+    if (index.error && cause(index.error.code) === "network" && !refused(index.error.code)) return t("mods.indexUnreachableShort");
+    // The server answered: which status it said is the first thing to know.
+    const status = httpStatus(index.error);
+    return status ? t("mods.indexUnavailableStatusShort", status) : t("mods.indexUnavailableShort");
+  }
+  const day = formatDay(index.signedAt ?? index.generated);
+  if (index.freshness === "stale" && !index.error) return t("mods.indexStaleShort", day);
+  // A refused index is never "offline": the network worked, and what came was not accepted.
+  if (refused(index.error?.code)) return t("mods.indexRefusedShort", day);
+  return cause(index.error?.code) === "network" ? t("mods.indexOfflineShort", day) : t("mods.indexCachedShort", day);
+}
+
+/**
+ * The catalogue's notes, by the ids `bannerPlan` places: a refresh that failed while an older
+ * catalogue still shows, the index's state, and sources that failed, each with its cause in
+ * words, the backend's own words behind Details, and a way forward.
+ */
+export function useCatalogBanners(onManageSources: () => void): Record<string, BannerItem> {
+  const { t, formatDay } = useI18n();
+  const { catalog, catalogLoading, catalogError, refreshCatalog, refreshSource, sourceRefreshing } = useModsCatalog();
+  if (!catalog) return {};
+  const retry = (
+    <button className="btn-flat" onClick={refreshCatalog} disabled={catalogLoading}>
+      {catalogLoading ? t("mods.retrying") : t("mods.retry")}
+    </button>
+  );
+  const retryOne = (repo: string) => (
+    <button className="btn-flat" onClick={() => refreshSource(repo)} disabled={sourceRefreshing(repo)} aria-label={t("mods.sourceRetryLabel", repo)}>
+      {sourceRefreshing(repo) ? t("mods.retrying") : t("mods.retry")}
+    </button>
+  );
+  const out: Record<string, BannerItem> = {};
+  if (catalogError) {
+    const shown = showError(catalogError);
+    out.refresh = {
+      id: "refresh",
+      tone: "warn",
+      text: (
+        <>
+          {t("mods.refreshFailed")} {shown.message}
+          {shown.detail && <ErrorDetails detail={shown.detail} label={t("errors.details")} />}
+        </>
+      ),
+      cause: t("mods.refreshFailedShort"),
+      actions: retry,
+    };
+  }
+  const index = indexProblem(catalog.index, t, formatDay);
+  if (index) {
+    const e = catalog.index.error;
+    const detail = e ? showError(e).detail : null;
+    out.index = {
+      id: "index",
+      tone: catalog.index.freshness === "cached" && !refused(catalog.index.error?.code) ? "info" : "warn",
+      text: (
+        <>
+          {index}
+          {detail && <ErrorDetails detail={detail} label={t("errors.details")} />}
+        </>
+      ),
+      cause: indexSummary(catalog.index, t, formatDay) ?? index,
+      actions: retry,
+    };
+  }
+  if (!index && catalog.index.cacheError) {
+    // Fresh and in use, but not saved: said, since offline after a restart it won't be there.
+    const detail = showError(catalog.index.cacheError).detail;
+    out.index = {
+      id: "index",
+      tone: "info",
+      text: (
+        <>
+          {t("mods.indexUnsaved")}
+          {detail && <ErrorDetails detail={detail} label={t("errors.details")} />}
+        </>
+      ),
+      cause: t("mods.indexUnsavedShort"),
+    };
+  }
+  if (catalog.sourcesError) {
+    // Kept aside, never read as "no sources": where it is, behind Details.
+    out.sourcesDamaged = {
+      id: "sourcesDamaged",
+      tone: "warn",
+      text: (
+        <>
+          {t("mods.sourcesDamaged")}
+          {catalog.sourcesError.detail && <ErrorDetails detail={catalog.sourcesError.detail} label={t("errors.details")} />}
+        </>
+      ),
+      cause: t("mods.sourcesDamagedShort"),
+      actions: (
+        <button className="btn-flat" onClick={onManageSources}>
+          {t("mods.manageSources")}
+        </button>
+      ),
+    };
+  }
+  for (const s of catalog.sources.filter((x) => x.error)) {
+    const text = sourceProblem(s, t, formatDay);
+    out[`source:${s.repo}`] = {
+      id: `source:${s.repo}`,
+      tone: "warn",
+      text,
+      cause: t(SOURCE_SHORT[cause(s.error?.code)]),
+      subject: s.repo,
+      // This source alone, asked again: the others keep their answers and nothing waits on them.
+      foldActions: retryOne(s.repo),
+      actions: (
+        <>
+          {retryOne(s.repo)}
+          <button className="btn-flat" onClick={onManageSources}>
+            {t("mods.manageSources")}
+          </button>
+        </>
+      ),
+    };
+  }
+  return out;
+}
diff --git a/src/components/mods/glyphs.ts b/src/components/mods/glyphs.ts
new file mode 100644
index 0000000..344c1f0
--- /dev/null
+++ b/src/components/mods/glyphs.ts
@@ -0,0 +1,10 @@
+// Pixel glyphs on the font's grid, for PixelIcon.
+
+export const CHECK = ["......#", ".....##", "#...##.", "##.##..", ".###...", "..#...."];
+export const CROSS = ["#....#", "##..##", ".####.", ".####.", "##..##", "#....#"];
+export const BANG = ["##", "##", "##", "##", "..", "##"];
+export const QUESTION = [".####.", "##..##", "...##.", "..##..", "......", "..##.."];
+export const HAMMER = ["#####.", "#####.", "..#...", "..#...", "..#...", "..#..."];
+export const PLUS = ["..##..", "..##..", "######", "######", "..##..", "..##.."];
+export const ARROW_UP = ["..##..", ".####.", "######", "..##..", "..##..", "..##.."];
+export const EQUALS = ["......", "######", "######", "......", "######", "######"];
diff --git a/src/components/mods/pickModFile.ts b/src/components/mods/pickModFile.ts
new file mode 100644
index 0000000..4c767ef
--- /dev/null
+++ b/src/components/mods/pickModFile.ts
@@ -0,0 +1,7 @@
+import { open as openFileDialog } from "@tauri-apps/plugin-dialog";
+
+/** Asks the player for one mod zip. The path, or null when they closed the picker. */
+export async function pickModFile(filterName: string): Promise<string | null> {
+  const path = await openFileDialog({ multiple: false, directory: false, filters: [{ name: filterName, extensions: ["zip"] }] });
+  return typeof path === "string" ? path : null;
+}
diff --git a/src/components/speech.test.ts b/src/components/speech.test.ts
new file mode 100644
index 0000000..357b91f
--- /dev/null
+++ b/src/components/speech.test.ts
@@ -0,0 +1,39 @@
+import { describe, expect, it } from "vitest";
+import { Speech } from "./speech";
+
+describe("speech", () => {
+  it("says each key once, and again once it is forgotten", () => {
+    const s = new Speech();
+    const heard: string[] = [];
+    const stop = s.listen((t) => heard.push(t));
+    s.say("a", "Removed Cogwork.");
+    s.say("a", "Removed Cogwork.");
+    s.say("b", "");
+    s.forget("a");
+    s.say("a", "Removed Cogwork.");
+    stop();
+    s.say("c", "Not heard.");
+    expect(heard).toEqual(["Removed Cogwork.", "Removed Cogwork."]);
+  });
+
+  it("finds what is new on a channel, and forgets what went away", () => {
+    const s = new Speech();
+    const a = { id: "hearth" };
+    const b = { id: "lanterns" };
+    expect(s.fresh("v1", [a, b])).toEqual([a, b]);
+    // The same problems, re-rendered or on another tab: nothing new.
+    expect(s.fresh("v1", [a, b])).toEqual([]);
+    // One fixed: the other isn't said again.
+    expect(s.fresh("v1", [b])).toEqual([]);
+    // The fixed one comes back: new again. Channels are apart.
+    expect(s.fresh("v1", [a, b])).toEqual([a]);
+    expect(s.fresh("v2", [a])).toEqual([a]);
+  });
+
+  it("is one memory per app tree: a second tree says it all again", () => {
+    const one = new Speech();
+    const two = new Speech();
+    expect(one.fresh("v1", [{ id: "x" }])).toHaveLength(1);
+    expect(two.fresh("v1", [{ id: "x" }])).toHaveLength(1);
+  });
+});
diff --git a/src/components/speech.ts b/src/components/speech.ts
new file mode 100644
index 0000000..f9a8246
--- /dev/null
+++ b/src/components/speech.ts
@@ -0,0 +1,42 @@
+// What has been said to a screen reader, without React: one per app tree, held by the
+// SpeechProvider in ./LiveRegion. Pure, so its memory is tested apart from any page.
+
+type Listener = (text: string) => void;
+
+/** Keys kept before the oldest is let go: keys are per notice, per error and per blocker set. */
+const MEMORY = 500;
+
+export class Speech {
+  private said = new Set<string>();
+  private channels = new Map<string, Set<string>>();
+  private listeners = new Set<Listener>();
+
+  /** Says `text` politely, once per `key`. */
+  say(key: string, text: string) {
+    if (!text || this.said.has(key)) return;
+    this.said.add(key);
+    if (this.said.size > MEMORY) this.said.delete(this.said.values().next().value!);
+    this.listeners.forEach((l) => l(text));
+  }
+
+  /** Forgets a key, so the same thing coming back later is said again. */
+  forget(key: string) {
+    this.said.delete(key);
+  }
+
+  /** The polite region hears what is said from here on; the returned function stops that. */
+  listen(l: Listener): () => void {
+    this.listeners.add(l);
+    return () => this.listeners.delete(l);
+  }
+
+  /**
+   * The items of `channel` that weren't on it the last time, which it now remembers: blockers
+   * that newly appear. An item that went away is forgotten, so it is new again if it comes back.
+   */
+  fresh<T extends { id: string }>(channel: string, items: T[]): T[] {
+    const before = this.channels.get(channel) ?? new Set<string>();
+    this.channels.set(channel, new Set(items.map((i) => i.id)));
+    return items.filter((i) => !before.has(i.id));
+  }
+}
diff --git a/src/components/typeAhead.test.ts b/src/components/typeAhead.test.ts
new file mode 100644
index 0000000..b1a9914
--- /dev/null
+++ b/src/components/typeAhead.test.ts
@@ -0,0 +1,29 @@
+import { describe, expect, it } from "vitest";
+import { typeAhead } from "./typeAhead";
+
+const tags = ["v26.11.1", "v26.10.4", "v26.9.0", "v25.12.2", "nightly-2026-11-03"];
+
+describe("type-ahead in the version list", () => {
+  it("finds a version by what it starts with, with or without its v", () => {
+    expect(typeAhead(tags, "v26.9", 0)).toBe(2);
+    expect(typeAhead(tags, "26.10", 0)).toBe(1);
+    expect(typeAhead(tags, "25", 0)).toBe(3);
+    expect(typeAhead(tags, "n", 0)).toBe(4);
+  });
+
+  it("steps through the matches when one key is typed again, round to the first", () => {
+    expect(typeAhead(tags, "v", 0)).toBe(1);
+    expect(typeAhead(tags, "vv", 1)).toBe(2);
+    expect(typeAhead(tags, "v", 3)).toBe(0);
+  });
+
+  it("keeps the label it is on while the word still fits it", () => {
+    expect(typeAhead(tags, "v26.1", 0)).toBe(0);
+  });
+
+  it("finds nothing for nothing, or for what no label starts with", () => {
+    expect(typeAhead(tags, "", 0)).toBe(-1);
+    expect(typeAhead(tags, "x", 0)).toBe(-1);
+    expect(typeAhead([], "v", 0)).toBe(-1);
+  });
+});
diff --git a/src/components/typeAhead.ts b/src/components/typeAhead.ts
new file mode 100644
index 0000000..c83b645
--- /dev/null
+++ b/src/components/typeAhead.ts
@@ -0,0 +1,26 @@
+/**
+ * Type-ahead for a list of labels, as the ARIA listbox pattern has it: the typed letters pick the
+ * next label that starts with them, from the one after `from` and round again. A version's
+ * leading "v" can be left out ("26.10" finds "v26.10.4"). Typing one key again and again steps
+ * through the labels that start with it. -1 when nothing matches.
+ */
+export function typeAhead(labels: string[], typed: string, from: number): number {
+  const want = typed.toLowerCase();
+  if (!want) return -1;
+  const repeated = [...want].every((c) => c === want[0]);
+  const prefix = repeated ? want[0] : want;
+  const fits = (label: string) => {
+    const l = label.toLowerCase();
+    return l.startsWith(prefix) || l.replace(/^v(?=\d)/, "").startsWith(prefix);
+  };
+  // A longer word goes on matching the label it is on; one key repeated moves on.
+  const start = repeated ? from + 1 : from;
+  for (let k = 0; k < labels.length; k++) {
+    const i = (((start + k) % labels.length) + labels.length) % labels.length;
+    if (fits(labels[i])) return i;
+  }
+  return -1;
+}
+
+/** How long a pause ends a typed word. */
+export const TYPE_AHEAD_MS = 600;
diff --git a/src/dev/crashes.ts b/src/dev/crashes.ts
new file mode 100644
index 0000000..0dbb33e
--- /dev/null
+++ b/src/dev/crashes.ts
@@ -0,0 +1,27 @@
+// The mock's crashes: what the engine would write to the log for each failure, in the shape the
+// launcher's log has (`[stderr]`, then `<time> <LEVEL> [<target>] <message>`), as in the
+// fixtures of src-tauri/src/mods/diagnose.rs. The mock reads the failure out of the log with
+// ./diagnose, as the backend does; diagnose.test.ts checks both.
+
+import type { FailureKind } from "../mods/types";
+
+const ENGINE_ABI = "f470b1cbb1f9ad91";
+
+/** Each names a mod of the `crash` scenario's set: Cogwork, Structures and the local My Tweak. */
+export const CRASH_LOGS: Record<FailureKind, string> = {
+  wrongVersion:
+    "[stderr] \x1b[90m    0.512\x1b[0m \x1b[1;31mERROR\x1b[0m \x1b[90m[weft]\x1b[0m " +
+    `mod mytweak was built against another mod ABI (5f0569a6bea71b81, this engine has ${ENGINE_ABI}); rebuild it against the current weft_sdk`,
+  loadFailed:
+    "[stderr]     0.40 INFO  [modloader] unpacked mod structures\n" +
+    "[stderr]     0.40 ERROR [weft] loading mod structures from /home/player/.cache/weft/mods/4242-libstructures.so: undefined symbol: weft_world_spawn_v3",
+  notAMod: "[stderr]     0.40 ERROR [weft] /home/player/.local/share/weft/mods/4242-liboldtweak.so is not a Weft mod",
+  wrongName: "[stderr]     0.40 ERROR [weft] mod mytweak is the crate my_tweak: name its folder or zip my_tweak",
+  // My Tweak is a file from the player's computer: the launcher can't know what it needs, so
+  // nothing blocked Play. Cogwork is installed but off in this scenario.
+  missingDep: "[stderr]     0.40 ERROR [weft] mod mytweak requires missing mod cogwork",
+  initPanicked:
+    "[stderr]     0.10 INFO  [modloader] unpacked mod cogwork\n" +
+    "[stderr]     0.31 ERROR [mod:cogwork] panicked at src/tubes.rs:88:14: index out of bounds\n" +
+    "[stderr]     0.32 ERROR [weft] cogwork: init panicked",
+};
diff --git a/src/dev/diagnose.test.ts b/src/dev/diagnose.test.ts
new file mode 100644
index 0000000..716f0bd
--- /dev/null
+++ b/src/dev/diagnose.test.ts
@@ -0,0 +1,58 @@
+// The mock reads crashes like the backend: the TypeScript port runs on the fixtures written in
+// diagnose.rs (read from that file, so a changed fixture is seen here), and on the mock's logs.
+import { describe, expect, it } from "vitest";
+import rust from "../../src-tauri/src/mods/diagnose.rs?raw";
+import { findFailure } from "./diagnose";
+import { CRASH_LOGS } from "./crashes";
+import type { FailureKind } from "../mods/types";
+
+const KIND: Record<string, FailureKind> = {
+  WrongVersion: "wrongVersion",
+  LoadFailed: "loadFailed",
+  NotAMod: "notAMod",
+  WrongName: "wrongName",
+  MissingDep: "missingDep",
+  InitPanicked: "initPanicked",
+};
+
+/** The `every_failure_kind` cases: (what, log, K::Kind, Some("id") | None, Some("other") | None). */
+function rustCases() {
+  const body = rust.slice(rust.indexOf("fn every_failure_kind"), rust.indexOf("fn an_init_panic"));
+  const str = String.raw`(r?)"((?:[^"\\]|\\.)*)"`;
+  const opt = String.raw`(?:Some\("([^"]*)"\)|None)`;
+  const re = new RegExp(String.raw`\(\s*"([^"]+)",\s*${str},\s*K::(\w+),\s*${opt},\s*${opt},?\s*\)`, "g");
+  return [...body.matchAll(re)].map(([, what, raw, log, kind, id, other]) => ({
+    what,
+    log: raw ? log : log.replace(/\\x1b/g, "\x1b").replace(/\\\\/g, "\\"),
+    kind: KIND[kind],
+    id: id ?? null,
+    other: other ?? null,
+  }));
+}
+
+describe("crash diagnosis", () => {
+  const cases = rustCases();
+
+  it("finds every fixture in diagnose.rs", () => {
+    expect(cases.length).toBeGreaterThanOrEqual(6);
+    expect(new Set(cases.map((c) => c.kind))).toEqual(new Set(Object.values(KIND)));
+  });
+
+  it.each(cases)("reads the Rust fixture: $what", (c) => {
+    const f = findFailure(c.log);
+    expect(f).not.toBeNull();
+    const named = f!.kind === "missingDep" ? f!.dependency : f!.kind === "wrongName" ? f!.crate : null;
+    expect([f!.kind, f!.modId, named]).toEqual([c.kind, c.id, c.other]);
+    expect(f!.line).not.toContain("\x1b");
+  });
+
+  it("names the mod of an init panic from the lines before", () => {
+    const log = "[stderr] ERROR [mod:cogwork::pipes] panicked at src/pipes.rs:3:1: x\n[stderr] ERROR [app] init panicked";
+    expect(findFailure(log)?.modId).toBe("cogwork");
+  });
+
+  it.each(Object.entries(CRASH_LOGS))("the mock's %s log reads as that kind", (kind, log) => {
+    expect(findFailure(log)?.kind).toBe(kind);
+    expect(findFailure(log)?.modId).toBeTruthy();
+  });
+});
diff --git a/src/dev/diagnose.ts b/src/dev/diagnose.ts
new file mode 100644
index 0000000..bd22d68
--- /dev/null
+++ b/src/dev/diagnose.ts
@@ -0,0 +1,98 @@
+// src-tauri/src/mods/diagnose.rs, for the mock backend: it writes the engine's own log line and
+// reads the failure out of it the way the launcher does. diagnose.test.ts runs this against the
+// fixtures in diagnose.rs itself, so a changed engine message breaks the mock's crashes too.
+
+import type { FailureKind, ModFailure } from "../mods/types";
+
+/** `launch::strip_ansi_codes`: drops `ESC [ ... <letter>`. */
+export function stripAnsi(s: string): string {
+  return s.replace(/\x1b\[[^A-Za-z]*[A-Za-z]/g, "");
+}
+
+function wordAfter(line: string, prefix: string): string | null {
+  const at = line.indexOf(prefix);
+  if (at < 0) return null;
+  const m = line.slice(at + prefix.length).match(/^[A-Za-z0-9_]+/);
+  return m ? m[0] : null;
+}
+
+/** `…/mods/libcogwork.so` or `C:\…\123-cogwork.dll` → `cogwork`. */
+function idFromLibrary(path: string): string | null {
+  const file = path.split(/[/\\]/).pop() ?? "";
+  const m = file.match(/^(.*)\.(dll|so|dylib)$/);
+  if (!m) return null;
+  let stem = m[1];
+  const dash = stem.indexOf("-");
+  if (dash >= 0 && /^\d*$/.test(stem.slice(0, dash))) stem = stem.slice(dash + 1);
+  const id = stem.startsWith("lib") ? stem.slice(3) : stem;
+  return id || null;
+}
+
+/** The message part of a log line: after the last `] `. */
+function message(line: string): string {
+  const i = line.lastIndexOf("] ");
+  return i < 0 ? line : line.slice(i + 2);
+}
+
+/** `is_error`: the line was logged at ERROR; the level stands on its own before the message. */
+function isError(line: string): boolean {
+  const i = line.lastIndexOf("] ");
+  const before = i < 0 ? line : line.slice(0, i);
+  return before.split(/\s+/).includes("ERROR");
+}
+
+const isId = (s: string) => /^[A-Za-z0-9_]+$/.test(s);
+
+function classify(line: string): ModFailure | null {
+  if (!isError(line)) return null;
+  const trimmed = line.trim();
+  const failure = (kind: Exclude<FailureKind, "missingDep" | "wrongName">, modId: string | null): ModFailure => ({ kind, modId, line: trimmed });
+  if (line.includes("was built against another mod ABI")) return failure("wrongVersion", wordAfter(line, "mod "));
+  // The engine always names the missing mod and the crate; a line without them isn't its.
+  if (line.includes(" requires missing mod ")) {
+    const dependency = wordAfter(line, " requires missing mod ");
+    return dependency ? { kind: "missingDep", modId: wordAfter(line, "mod "), dependency, line: trimmed } : null;
+  }
+  if (line.includes(" is the crate ")) {
+    const crate = wordAfter(line, " is the crate ");
+    return crate ? { kind: "wrongName", modId: wordAfter(line, "mod "), crate, line: trimmed } : null;
+  }
+  const loading = wordAfter(line, "loading mod ");
+  if (loading && line.includes(`loading mod ${loading} from `)) return failure("loadFailed", loading);
+  const notMod = line.indexOf(" is not a Weft mod");
+  if (notMod >= 0) return failure("notAMod", idFromLibrary(message(line.slice(0, notMod)).trim()));
+  const msg = message(line).trimEnd();
+  if (msg.endsWith("init panicked")) {
+    // The engine prefixes each registration error with the mod's id: `showcase: init panicked`.
+    const before = msg.slice(0, -"init panicked".length).trimEnd();
+    const id = before.endsWith(":") ? before.slice(0, -1).trim() : "";
+    return failure("initPanicked", isId(id) ? id : null);
+  }
+  return null;
+}
+
+function panickedMod(before: string[]): string | null {
+  for (let i = before.length - 1; i >= 0; i--) {
+    if (before[i].includes("panicked")) {
+      const id = wordAfter(before[i], "[mod:");
+      if (id) return id;
+    }
+  }
+  for (let i = before.length - 1; i >= 0; i--) {
+    const id = wordAfter(before[i], "loading mod ");
+    if (id) return id;
+  }
+  return null;
+}
+
+/** `diagnose::find`: the first mod failure in the log of one run. */
+export function findFailure(log: string): ModFailure | null {
+  const lines = log.split(/\r?\n/).map(stripAnsi);
+  for (let i = 0; i < lines.length; i++) {
+    const f = classify(lines[i]);
+    if (!f) continue;
+    if (f.kind === "initPanicked" && f.modId === null) f.modId = panickedMod(lines.slice(0, i));
+    return f;
+  }
+  return null;
+}
diff --git a/src/dev/fixtures/rules.json b/src/dev/fixtures/rules.json
new file mode 100644
index 0000000..f2ddd8b
--- /dev/null
+++ b/src/dev/fixtures/rules.json
@@ -0,0 +1,350 @@
+{
+  "_about": "Input/output cases for the mod-set rules, written from the Rust table tests in src-tauri/src/mods/plan/ and profile.rs (the test each block follows is named in `rust`). mockRules.test.ts runs them against src/dev/mockRules.ts. Builds are [version, abi, channel, deps]; an entry is the Rust test helper `entry(id, deps, abi)` (version 0.1.0, on, Reviewed, from the index, abi ABI) with the fields given changed. A sha is `<id>@<version>`. Contract R4 adds transitive cases (§1) to plans and commits, and the blocks `shadowing` (§4) and `revocations` (§6); `cascades` follows a revocation through to what needs the revoked mod.",
+  "abi": { "ABI": "f470b1cbb1f9ad91", "OLD": "5f0569a6bea71b81" },
+  "catalogs": {
+    "world": {
+      "rust": "plan/tests.rs world",
+      "mods": [
+        { "id": "cogwork", "origin": "index", "builds": [["0.2.0", "ABI", "release", ["base", "showcase"]], ["0.1.0", "OLD", "release", ["showcase"]]] },
+        { "id": "showcase", "origin": "index", "builds": [["0.1.0", "ABI", "release", []]] },
+        { "id": "lanterns", "origin": "Someone/Lanterns", "builds": [["1.0.0", "ABI", "release", ["glow"]]] },
+        { "id": "glow", "origin": "Someone/Lanterns", "builds": [["1.0.0", "ABI", "release", []]] },
+        { "id": "shiny", "origin": "index", "builds": [["1.0.0", "ABI", "release", ["rcdep"]], ["1.1.0-rc.1", "ABI", "prerelease", ["rcdep"]]] },
+        { "id": "rcdep", "origin": "index", "builds": [["0.1.0-rc.1", "ABI", "prerelease", []]] },
+        { "id": "bad", "origin": "index", "builds": [["1.0.0", "ABI", "release", ["pulled"]]] },
+        { "id": "pulled", "origin": "index", "builds": [["1.0.0", "ABI", "release", []]] },
+        { "id": "base", "origin": "index", "builds": [["1.0.0", "ABI", "release", []]] },
+        { "id": "top", "origin": "index", "builds": [["1.0.0", "ABI", "release", ["mid"]]] },
+        { "id": "mid", "origin": "index", "builds": [["1.0.0", "ABI", "release", ["leaf"]]] },
+        { "id": "leaf", "origin": "index", "builds": [["1.0.0", "ABI", "release", []]] },
+        { "id": "top2", "origin": "index", "builds": [["1.0.0", "ABI", "release", ["mid2"]]] },
+        { "id": "top3", "origin": "index", "builds": [["1.0.0", "ABI", "release", ["mid3"]]] }
+      ],
+      "revoked": ["pulled@1.0.0"]
+    },
+    "updates": {
+      "rust": "profile.rs tests::update_offers",
+      "mods": [
+        { "id": "cogwork", "origin": "index", "builds": [["0.3.0-rc.1", "ABI", "prerelease", []], ["0.2.0", "ABI", "release", []], ["0.1.0", "ABI", "release", []], ["0.0.9", "OLD", "release", []]] },
+        { "id": "lanterns", "origin": "Someone/Lanterns", "builds": [["1.1.0", "ABI", "release", []]] },
+        { "id": "pulled", "origin": "index", "builds": [["0.2.0", "ABI", "release", []]] }
+      ],
+      "revoked": ["pulled@0.2.0"]
+    },
+    "empty": { "rust": "catalog(vec![], &[sha(\"b\", \"0.1.0\")])", "mods": [], "revoked": ["b@0.1.0"] },
+    "statuses": { "rust": "profile.rs tests::statuses_and_blocking", "mods": [], "revoked": ["pulled@0.1.0"] }
+  },
+  "plans": {
+    "rust": "plan/tests.rs plans, plan_problems_and_replacement; contract R3 §1 for turnsOn; contract R4 §1 for the transitive cases",
+    "catalog": "world",
+    "cases": [
+      { "what": "dependency from the index is installed", "target": "cogwork@0.2.0", "lock": [], "install": ["showcase"], "enable": [], "missing": [], "problem": null, "turnsOn": true },
+      { "what": "installed dependency that is off is turned on", "target": "cogwork@0.2.0", "lock": [{ "id": "showcase", "enabled": false }], "install": [], "enable": ["showcase"], "missing": [], "problem": null, "turnsOn": true },
+      { "what": "dependency from the same source", "target": "lanterns@1.0.0", "lock": [], "install": ["glow"], "enable": [], "missing": [], "problem": null, "turnsOn": true },
+      { "what": "a release never pulls in a prerelease dependency", "target": "shiny@1.0.0", "lock": [], "install": [], "enable": [], "missing": ["rcdep"], "problem": null, "turnsOn": false },
+      { "what": "a prerelease may", "target": "shiny@1.1.0-rc.1", "lock": [], "install": ["rcdep"], "enable": [], "missing": [], "problem": null, "turnsOn": true },
+      { "what": "a revoked dependency is missing, not installed", "target": "bad@1.0.0", "lock": [], "install": [], "enable": [], "missing": ["pulled"], "problem": null, "turnsOn": false },
+      { "what": "an installed revoked dependency doesn't count", "target": "bad@1.0.0", "lock": [{ "id": "pulled", "version": "1.0.0" }], "install": [], "enable": [], "missing": ["pulled"], "problem": null, "turnsOn": false },
+      { "what": "a build for another version (its dependencies are still listed)", "target": "cogwork@0.1.0", "lock": [], "install": ["showcase"], "enable": [], "missing": [], "problem": "ModIncompatible", "turnsOn": true },
+      { "what": "a revoked build", "target": "pulled@1.0.0", "lock": [], "install": [], "enable": [], "missing": [], "problem": "ModRevoked", "turnsOn": true },
+      { "what": "the reserved id", "target": "base@1.0.0", "lock": [], "install": [], "enable": [], "missing": [], "problem": "ModIdReserved", "turnsOn": true },
+      { "what": "unknown mod interface", "target": "cogwork@0.2.0", "lock": [], "abi": null, "install": [], "enable": [], "missing": [], "problem": "AbiUnavailable", "turnsOn": false },
+      { "what": "the game is running", "target": "cogwork@0.2.0", "lock": [], "running": true, "install": ["showcase"], "enable": [], "missing": [], "problem": "GameRunning", "turnsOn": true },
+      {
+        "what": "an update of a mod that is off: nothing turns on, and it stays off",
+        "target": "cogwork@0.2.0",
+        "lock": [{ "id": "cogwork", "deps": ["showcase"], "abi": "OLD", "enabled": false, "trust": "unreviewed" }],
+        "install": ["showcase"],
+        "enable": [],
+        "missing": [],
+        "problem": null,
+        "turnsOn": false,
+        "replaces": { "enabled": false, "trust": "unreviewed" }
+      },
+      {
+        "what": "R4: an installed dependency that is off turns on with everything it needs",
+        "target": "top@1.0.0",
+        "lock": [{ "id": "mid", "deps": ["leaf"], "enabled": false }, { "id": "leaf", "enabled": false }],
+        "install": [],
+        "enable": ["mid", "leaf"],
+        "missing": [],
+        "problem": null,
+        "turnsOn": true
+      },
+      {
+        "what": "R4: what an installed dependency needs is installed too",
+        "target": "top@1.0.0",
+        "lock": [{ "id": "mid", "deps": ["leaf"], "enabled": false }],
+        "install": ["leaf"],
+        "enable": ["mid"],
+        "missing": [],
+        "problem": null,
+        "turnsOn": true
+      },
+      {
+        "what": "R4: an installed dependency that is on still gets what it lacks",
+        "target": "top@1.0.0",
+        "lock": [{ "id": "mid", "deps": ["leaf"] }, { "id": "leaf", "enabled": false }],
+        "install": [],
+        "enable": ["leaf"],
+        "missing": [],
+        "problem": null,
+        "turnsOn": true
+      },
+      {
+        "what": "R4: a dependency's dependency with no build installs the mod off",
+        "target": "top2@1.0.0",
+        "lock": [{ "id": "mid2", "deps": ["gone"], "enabled": false }],
+        "install": [],
+        "enable": [],
+        "missing": ["gone"],
+        "problem": null,
+        "turnsOn": false
+      },
+      {
+        "what": "R4: a dependency's revoked dependency installs the mod off",
+        "target": "top3@1.0.0",
+        "lock": [{ "id": "mid3", "deps": ["pulled"], "enabled": false }, { "id": "pulled", "version": "1.0.0", "enabled": false }],
+        "install": [],
+        "enable": [],
+        "missing": ["pulled"],
+        "problem": null,
+        "turnsOn": false
+      },
+      {
+        "what": "R4: a dependency's dependency built for another version is replaced by a fitting build",
+        "target": "top@1.0.0",
+        "lock": [{ "id": "mid", "deps": ["leaf"], "enabled": false }, { "id": "leaf", "abi": "OLD", "enabled": false }],
+        "install": ["leaf"],
+        "enable": ["mid"],
+        "missing": [],
+        "problem": null,
+        "turnsOn": true
+      }
+    ]
+  },
+  "commits": {
+    "rust": "plan/tests.rs an_update_keeps_the_on_off_state; contract R3 §1 for installedOff; contract R4 §1 for the transitive cases",
+    "catalog": "world",
+    "cases": [
+      {
+        "what": "off stays off, and so does its new dependency",
+        "wanted": ["cogwork@0.2.0"],
+        "lock": [{ "id": "cogwork", "deps": ["showcase"], "abi": "OLD", "enabled": false }],
+        "installed": ["cogwork", "showcase"],
+        "alsoEnabled": [],
+        "installedOff": [],
+        "after": { "cogwork": false, "showcase": false }
+      },
+      {
+        "what": "on stays on",
+        "wanted": ["cogwork@0.2.0"],
+        "lock": [{ "id": "cogwork", "deps": ["showcase"], "abi": "OLD" }],
+        "installed": ["cogwork", "showcase"],
+        "alsoEnabled": [],
+        "installedOff": [],
+        "after": { "cogwork": true, "showcase": true }
+      },
+      {
+        "what": "a new install is on and turns on what it needs",
+        "wanted": ["cogwork@0.2.0"],
+        "lock": [{ "id": "showcase", "enabled": false }],
+        "installed": ["cogwork"],
+        "alsoEnabled": ["showcase"],
+        "installedOff": [],
+        "after": { "cogwork": true, "showcase": true }
+      },
+      { "what": "a missing dependency installs the mod turned off", "wanted": ["shiny@1.0.0"], "lock": [], "installed": ["shiny"], "alsoEnabled": [], "installedOff": ["shiny"], "after": { "shiny": false } },
+      {
+        "what": "copying two mods: only the one missing a dependency stays off",
+        "wanted": ["cogwork@0.2.0", "bad@1.0.0"],
+        "lock": [],
+        "installed": ["cogwork", "bad", "showcase"],
+        "alsoEnabled": [],
+        "installedOff": ["bad"],
+        "after": { "cogwork": true, "bad": false, "showcase": true }
+      },
+      {
+        "what": "R4: a new install turns on its whole chain",
+        "wanted": ["top@1.0.0"],
+        "lock": [{ "id": "mid", "deps": ["leaf"], "enabled": false }, { "id": "leaf", "enabled": false }],
+        "installed": ["top"],
+        "alsoEnabled": ["mid", "leaf"],
+        "installedOff": [],
+        "after": { "top": true, "mid": true, "leaf": true }
+      },
+      {
+        "what": "R4: a chain with a missing end installs the mod off and turns nothing on",
+        "wanted": ["top2@1.0.0"],
+        "lock": [{ "id": "mid2", "deps": ["gone"], "enabled": false }],
+        "installed": ["top2"],
+        "alsoEnabled": [],
+        "installedOff": ["top2"],
+        "after": { "top2": false, "mid2": false }
+      }
+    ]
+  },
+  "toggles": {
+    "rust": "plan/tests.rs the_enable_cascade, removing_turns_off_what_needed_it; contract R3 §2",
+    "catalog": "empty",
+    "cases": [
+      {
+        "what": "turning a on turns on what it needs, transitively",
+        "lock": [{ "id": "a", "deps": ["c"], "enabled": false }, { "id": "c", "deps": ["d"], "enabled": false }, { "id": "d", "enabled": false }],
+        "action": ["on", "a"],
+        "alsoEnabled": ["c", "d"],
+        "alsoDisabled": []
+      },
+      { "what": "turning d off turns off everything that needs it", "lock": [{ "id": "a", "deps": ["c"] }, { "id": "c", "deps": ["d"] }, { "id": "d" }], "action": ["off", "d"], "alsoEnabled": [], "alsoDisabled": ["a", "c"] },
+      { "what": "a revoked dependency refuses the cascade", "lock": [{ "id": "e", "deps": ["b"], "enabled": false }, { "id": "b", "enabled": false }], "action": ["on", "e"], "error": "ModRevoked" },
+      { "what": "a revoked mod can't be turned on", "lock": [{ "id": "b", "enabled": false }], "action": ["on", "b"], "error": "ModRevoked" },
+      { "what": "a revocation remembered in the lock refuses too", "lock": [{ "id": "kept", "enabled": false, "revoked": { "reason": "broken", "at": "2026-11-04T00:00:00Z" } }], "action": ["on", "kept"], "error": "ModRevoked" },
+      { "what": "not installed", "lock": [], "action": ["on", "zzz"], "error": "ModNotInstalled" },
+      { "what": "removing turns off what needed it", "lock": [{ "id": "a", "deps": ["b"] }, { "id": "b" }], "action": ["remove", "b"], "alsoEnabled": [], "alsoDisabled": ["a"], "after": { "a": false } },
+      { "what": "removing what isn't there", "lock": [], "action": ["remove", "b"], "error": "ModNotInstalled" }
+    ]
+  },
+  "copies": {
+    "rust": "plan/tests.rs copy_preview_outcomes",
+    "catalog": "world",
+    "from": [
+      { "id": "cogwork", "deps": ["showcase"], "abi": "OLD" },
+      { "id": "showcase", "abi": "OLD" },
+      { "id": "nobuild", "abi": "OLD" },
+      { "id": "mytweak", "abi": null, "origin": { "kind": "file", "name": "t.zip" } },
+      { "id": "pulled", "abi": "OLD" },
+      { "id": "lanterns", "deps": ["glow"], "abi": "OLD", "origin": { "kind": "source", "repo": "someone/lanterns" } },
+      { "id": "shiny", "abi": "OLD", "enabled": false }
+    ],
+    "to": [{ "id": "showcase" }],
+    "outcomes": { "cogwork": ["install", "0.2.0"], "showcase": ["alreadyThere", null], "nobuild": ["noBuild", null], "mytweak": ["localFile", null], "pulled": ["revoked", null], "lanterns": ["install", "1.0.0"], "shiny": null },
+    "picks": ["cogwork", "lanterns"]
+  },
+  "statuses": {
+    "rust": "profile.rs tests::statuses_and_blocking; contract R3 §1 (depsNotInstalled) and §2 (kept revocations)",
+    "catalog": "statuses",
+    "lock": [
+      { "id": "cogwork", "deps": ["base", "showcase", "signals"] },
+      { "id": "showcase", "enabled": false },
+      { "id": "old", "abi": "OLD" },
+      { "id": "file", "abi": null },
+      { "id": "fine", "deps": ["base"] },
+      { "id": "pulled", "enabled": false },
+      { "id": "kept", "enabled": false, "revoked": { "reason": "remembered", "at": "2026-11-04T00:00:00Z" } }
+    ],
+    "cases": [
+      ["ABI", "cogwork", "missingDeps"],
+      ["ABI", "showcase", "off"],
+      ["ABI", "old", "wrongVersion"],
+      ["ABI", "file", "unchecked"],
+      ["ABI", "fine", "ready"],
+      ["ABI", "pulled", "revoked"],
+      ["ABI", "kept", "revoked"],
+      [null, "old", "unchecked"],
+      [null, "fine", "unchecked"],
+      [null, "cogwork", "missingDeps"]
+    ],
+    "blocking": ["cogwork", "old"],
+    "missingDeps": { "cogwork": ["showcase", "signals"] },
+    "depsNotInstalled": { "cogwork": ["signals"] },
+    "revokedReason": { "pulled": "broken", "kept": "remembered" }
+  },
+  "updates": {
+    "rust": "profile.rs tests::update_offers",
+    "catalog": "updates",
+    "cases": [
+      { "what": "older release", "entry": { "id": "cogwork", "version": "0.1.0" }, "want": "0.2.0" },
+      { "what": "newest already", "entry": { "id": "cogwork", "version": "0.2.0" }, "want": null },
+      { "what": "prerelease player gets the rc", "entry": { "id": "cogwork", "version": "0.2.0", "channel": "prerelease" }, "want": "0.3.0-rc.1" },
+      { "what": "built for another version: any fitting build", "entry": { "id": "cogwork", "version": "0.0.9", "abi": "OLD" }, "want": "0.2.0" },
+      { "what": "source, repo case differs", "entry": { "id": "lanterns", "version": "1.0.0", "origin": { "kind": "source", "repo": "someone/lanterns" } }, "want": "1.1.0" },
+      { "what": "revoked build is never offered", "entry": { "id": "pulled", "version": "0.1.0" }, "want": null },
+      { "what": "local file has no updates", "entry": { "id": "cogwork", "version": "0.1.0", "origin": { "kind": "file", "name": "c.zip" } }, "want": null }
+    ]
+  },
+  "shadowing": {
+    "rust": "contract R4 §4: profile::report with files in the player's own mods folder",
+    "catalog": "statuses",
+    "lock": [{ "id": "fine" }, { "id": "kept", "enabled": false, "revoked": { "reason": "remembered", "at": "2026-11-04T00:00:00Z" } }, { "id": "old", "abi": "OLD" }, { "id": "showcase", "enabled": false }],
+    "playerFolder": [{ "file": "fine-copy.zip", "id": "fine" }, { "file": "kept-old.zip", "id": "kept" }, { "file": "tweak.zip", "id": "showcase" }, { "file": "notes.zip", "id": null }],
+    "unmanaged": ["fine-copy.zip", "kept-old.zip", "tweak.zip", "notes.zip"],
+    "shadowed": [{ "id": "fine", "file": "fine-copy.zip", "managed": "on" }, { "id": "kept", "file": "kept-old.zip", "managed": "revoked" }, { "id": "showcase", "file": "tweak.zip", "managed": "off" }],
+    "blocking": ["kept", "old"],
+    "blockingReasons": { "kept": "shadowedRevoked", "old": "wrongVersion" }
+  },
+  "cascades": {
+    "rust": "profile.rs apply_revocations, then report: a revoked dependency turned off blocks what needs it",
+    "catalog": "statuses",
+    "lock": [{ "id": "user", "deps": ["pulled"] }, { "id": "pulled" }, { "id": "bystander" }],
+    "turnedOff": ["pulled"],
+    "statuses": { "user": "missingDeps", "pulled": "revoked", "bystander": "ready" },
+    "blocking": ["user"],
+    "blockingReasons": { "user": "missingDeps" },
+    "missingDeps": { "user": ["pulled"] },
+    "depsNotInstalled": { "user": [] },
+    "revokedReason": { "pulled": "broken" }
+  },
+  "revocations": {
+    "rust": "contract R4 §6: index::format revoked[] entries fail closed",
+    "entries": [
+      { "sha256": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "reason": null, "at": null },
+      { "sha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", "reason": "Corrupts worlds", "at": "2026-11-03T00:00:00Z" },
+      { "sha256": " cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc " },
+      { "sha256": "not-a-hash", "reason": "dropped", "at": null },
+      { "sha256": "ddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd", "reason": "too short" },
+      { "sha256": null }
+    ],
+    "kept": [
+      { "sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "reason": null, "at": null },
+      { "sha256": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", "reason": "Corrupts worlds", "at": "2026-11-03T00:00:00Z" },
+      { "sha256": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", "reason": null, "at": null }
+    ],
+    "dropped": 3,
+    "matches": [
+      ["AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", true],
+      ["aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", true],
+      ["eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee", false]
+    ]
+  },
+  "iconHosts": {
+    "rust": "download.rs icon_url_allowed",
+    "cases": [
+      ["https://raw.githubusercontent.com/owner/repo/main/icon.png", true],
+      ["https://github.com/owner/repo/raw/main/icon.png", true],
+      ["https://user-images.githubusercontent.com/1/icon.png", true],
+      ["https://owner.github.io/mod/icon.png", true],
+      ["https://OWNER.GitHub.io/icon.png", true],
+      ["https://raw.githubusercontent.com:443/owner/repo/main/icon.png", true],
+      ["http://raw.githubusercontent.com/owner/repo/main/icon.png", false],
+      ["https://github.io/icon.png", false],
+      ["https://evil.example/icon.png", false],
+      ["https://github.com.evil.example/icon.png", false],
+      ["https://evilgithub.com/icon.png", false],
+      ["https://objects.githubusercontent.com/icon.png", false],
+      ["https://avatars.githubusercontent.com/u/1", false],
+      ["https://raw.githubusercontent.com:8443/owner/repo/main/icon.png", false],
+      ["https://user@raw.githubusercontent.com/owner/repo/main/icon.png", false],
+      ["https://127.0.0.1/icon.png", false],
+      ["mock://cogwork", false],
+      ["not a url", false],
+      ["", false]
+    ]
+  },
+  "buildRecords": {
+    "rust": "catalog.rs build_record, index::Provenance::is_complete",
+    "cases": [
+      {"what": "a whole record in the signed index", "fromIndex": true, "provenance": {"kind": "github-attestation", "repo": "Zorro909/weft-mods", "workflow": ".github/workflows/release.yml", "ref": "refs/heads/main", "verified_at": "2026-11-04T18:00:00Z"}, "want": "recorded"},
+      {"what": "no ref is still whole: the ref isn't shown", "fromIndex": true, "provenance": {"kind": "github-attestation", "repo": "Zorro909/weft-mods", "workflow": ".github/workflows/release.yml", "verified_at": "2026-11-04T18:00:00Z"}, "want": "recorded"},
+      {"what": "the same record from a source is only its claim", "fromIndex": false, "provenance": {"kind": "github-attestation", "repo": "Zorro909/weft-mods", "workflow": ".github/workflows/release.yml", "ref": "refs/heads/main", "verified_at": "2026-11-04T18:00:00Z"}, "want": "claimed"},
+      {"what": "nothing given", "fromIndex": true, "provenance": null, "want": "none"},
+      {"what": "nothing given by a source", "fromIndex": false, "provenance": null, "want": "none"},
+      {"what": "a kind the launcher doesn't know", "fromIndex": true, "provenance": {"kind": "unknown", "repo": "Zorro909/weft-mods", "workflow": ".github/workflows/release.yml", "ref": "refs/heads/main", "verified_at": "2026-11-04T18:00:00Z"}, "want": "incomplete"},
+      {"what": "no repo", "fromIndex": true, "provenance": {"kind": "github-attestation", "workflow": ".github/workflows/release.yml", "ref": "refs/heads/main", "verified_at": "2026-11-04T18:00:00Z"}, "want": "incomplete"},
+      {"what": "a repo that isn't owner/name", "fromIndex": true, "provenance": {"kind": "github-attestation", "repo": "weft-mods", "workflow": ".github/workflows/release.yml", "ref": "refs/heads/main", "verified_at": "2026-11-04T18:00:00Z"}, "want": "incomplete"},
+      {"what": "no workflow", "fromIndex": true, "provenance": {"kind": "github-attestation", "repo": "Zorro909/weft-mods", "ref": "refs/heads/main", "verified_at": "2026-11-04T18:00:00Z"}, "want": "incomplete"},
+      {"what": "a workflow outside .github/workflows", "fromIndex": true, "provenance": {"kind": "github-attestation", "repo": "Zorro909/weft-mods", "workflow": "scripts/build.yml", "ref": "refs/heads/main", "verified_at": "2026-11-04T18:00:00Z"}, "want": "incomplete"},
+      {"what": "no check time", "fromIndex": true, "provenance": {"kind": "github-attestation", "repo": "Zorro909/weft-mods", "workflow": ".github/workflows/release.yml", "ref": "refs/heads/main"}, "want": "incomplete"},
+      {"what": "a check time that isn't RFC 3339", "fromIndex": true, "provenance": {"kind": "github-attestation", "repo": "Zorro909/weft-mods", "workflow": ".github/workflows/release.yml", "ref": "refs/heads/main", "verified_at": "2026-11-04"}, "want": "incomplete"}
+    ]
+  }
+}
diff --git a/src/dev/fixtures/trace.json b/src/dev/fixtures/trace.json
new file mode 100644
index 0000000..493db92
--- /dev/null
+++ b/src/dev/fixtures/trace.json
@@ -0,0 +1,28 @@
+{
+  "about": "The mod-progress events of one install, as the backend sends them, run against the backend (src-tauri/src/mods/service_tests.rs, `traces`) and the mock (e2e/flows.spec.ts, `the mock's progress follows the backend's trace`). Each step is `file:stage:percent`; a run of events for the same file and stage keeps only its first and last percent, since how many come in between depends on the connection. Every event carries the operation's id and the plan's file count.",
+  "installWithDependency": {
+    "about": "Installing a mod that brings one dependency, neither in the store yet: the mod first, then what it needs, each downloaded and checked before the next; `installing` for both once the plan is checked again under the lock, before the set is written.",
+    "count": 2,
+    "steps": [
+      "1:downloading:0",
+      "1:downloading:100",
+      "1:verifying:100",
+      "2:downloading:0",
+      "2:downloading:100",
+      "2:verifying:100",
+      "1:installing:100",
+      "2:installing:100"
+    ]
+  },
+  "installWithStoredDependency": {
+    "about": "The same install when the dependency's build is already in the store and intact: nothing is said about it until it is installed.",
+    "count": 2,
+    "steps": [
+      "1:downloading:0",
+      "1:downloading:100",
+      "1:verifying:100",
+      "1:installing:100",
+      "2:installing:100"
+    ]
+  }
+}
diff --git a/src/dev/mockBackend.ts b/src/dev/mockBackend.ts
new file mode 100644
index 0000000..63594e5
--- /dev/null
+++ b/src/dev/mockBackend.ts
@@ -0,0 +1,1024 @@
+// A stand-in for the Rust side, so the UI runs in a plain browser: `npm run dev:mock`.
+//
+// Pick a state with `?scenario=<name>` and adjust it with URL flags, e.g.
+// `?scenario=mods&index=cached&revoked=cogwork&slow=1`. SCENARIOS and FLAGS in ./scenarios are the
+// one list of both; docs/dev-mock.md and the tests read them from there.
+//
+// The rules are src-tauri/src/mods' own, ported in ./mockRules and tested against the Rust table
+// tests' cases; crashes are read out of engine log lines with ./diagnose, like the backend does.
+// This file holds the state (catalogue, locks, what is running) and answers the commands.
+
+import { mockIPC, mockWindows } from "@tauri-apps/api/mocks";
+import { emit } from "@tauri-apps/api/event";
+import { EVENTS } from "../mods/ipc";
+import type { CommandSignatures } from "../mods/bindings/commands";
+import { iconUrlAllowed, parseRepo, sameRepo } from "../mods/select";
+import { SCENARIOS } from "./scenarios";
+import { CRASH_LOGS } from "./crashes";
+import { findFailure } from "./diagnose";
+import * as R from "./mockRules";
+import type { Entry, Fit, PlayerFile } from "./mockRules";
+import type {
+  AppErrorPayload,
+  Catalog,
+  CatalogMod,
+  CatalogVersion,
+  ChangeResult,
+  CopyResult,
+  ErrorCode,
+  FailureKind,
+  FileInspection,
+  ModProgress,
+  NoModsReason,
+  ProgressStage,
+} from "../mods/types";
+
+export { SCENARIOS, FLAGS } from "./scenarios";
+
+const params = new URLSearchParams(location.search);
+const scenarioName = params.get("scenario") ?? "mods";
+const scenario = SCENARIOS.find((s) => s.name === scenarioName) ?? SCENARIOS[0];
+const flag = (name: string): string | null => params.get(name) ?? scenario.flags[name] ?? null;
+const failures = new Set((flag("fail") ?? "").split(",").filter(Boolean));
+/** `slow=1`: four times as long, time enough to press Cancel; `fast=1`: a quarter, for screenshots. */
+const SLOW = flag("slow") === "1" ? 4 : flag("fast") === "1" ? 0.25 : 1;
+const LONG = flag("long") === "1";
+const NOW = "2026-11-04T18:00:00Z";
+
+// ---------------------------------------------------------------------------------------------
+// Catalogue
+
+const NEW = "v26.11.1";
+const OLD = "v26.10.4";
+const ABI: Record<string, string> = { [NEW]: "f470b1cbb1f9ad91", [OLD]: "5f0569a6bea71b81" };
+const PLATFORM = "linux-x64";
+const LANTERN_REPO = LONG ? "an-unusually-long-organisation-name/an-even-longer-repository-of-lanterns" : "lantern-dev/lanterns";
+
+// Stable fake SHA-256s: FNV-1a over the whole seed, once per 8 hex digits.
+const sha = (seed: string) => {
+  let out = "";
+  for (let round = 0; out.length < 64; round++) {
+    let h = 2166136261 ^ round;
+    for (let i = 0; i < seed.length; i++) h = Math.imul(h ^ seed.charCodeAt(i), 16777619);
+    out += (h >>> 0).toString(16).padStart(8, "0");
+  }
+  return out.slice(0, 64);
+};
+
+function version(id: string, v: string, weftTag: string, extra: Partial<CatalogVersion> = {}): CatalogVersion {
+  const repo = extra.sourceRepo ?? "Zorro909/weft-mods";
+  return {
+    version: v,
+    channel: "release",
+    tag: `${id}-v${v}`,
+    published: "2026-11-04T02:39:03Z",
+    sourceRepo: repo,
+    sourceCommit: "cceea7805df5902d62017d2008d1bb29ed84e152",
+    weftTag,
+    abi: ABI[weftTag],
+    deps: ["base"],
+    platforms: ["windows-x64", "linux-x64", "macos-arm64"],
+    sha256: sha(`${id}${v}${weftTag}`),
+    size: 2_642_469,
+    url: `https://github.com/${repo}/releases/download/${id}-v${v}/${id}.zip`,
+    provenance: {
+      repo,
+      workflow: ".github/workflows/release.yml",
+      gitRef: "refs/heads/main",
+      verifiedAt: "2026-11-04T18:00:00Z",
+    },
+    buildRecord: R.buildRecord(
+      { kind: "github-attestation", repo, workflow: ".github/workflows/release.yml", ref: "refs/heads/main", verified_at: "2026-11-04T18:00:00Z" },
+      true
+    ),
+    reviewed: { by: "Zorro909", at: "2026-11-04" },
+    trust: "reviewed",
+    ...extra,
+  };
+}
+
+/** A build from an added repo: nobody reviewed it, and its provenance, if any, is its own claim. */
+const fromSource = (commit: string, claimsProvenance: boolean, extra: Partial<CatalogVersion> = {}): Partial<CatalogVersion> => ({
+  trust: "unreviewed",
+  reviewed: null,
+  buildRecord: claimsProvenance ? "claimed" : "none",
+  sourceRepo: LANTERN_REPO,
+  sourceCommit: commit,
+  provenance: claimsProvenance
+    ? { repo: LANTERN_REPO, workflow: ".github/workflows/build.yml", gitRef: "refs/tags/glowmoss-v0.3.0", verifiedAt: null }
+    : null,
+  ...extra,
+});
+
+const indexMod = (id: string, name: string, summary: string, versions: CatalogVersion[], icon: string | null = null): CatalogMod => ({
+  key: `index:${id}`,
+  id,
+  name,
+  summary,
+  authors: ["Zorro909"],
+  license: "MPL-2.0",
+  homepage: null,
+  icon,
+  origin: { kind: "index" },
+  versions,
+});
+
+/** Where the mock's icons are said to be: GitHub, as an index or a source would name them. */
+const mockIcon = (id: string) => `https://raw.githubusercontent.com/Zorro909/weft-mods/main/${id}/assets/textures/gui/icon.png`;
+
+// A source's `<id>.mod.json` names this icon on a tracker's host: it is dropped while reading, as
+// the backend does (`icon_url_allowed`), so browsing never asks that host for anything.
+const TRACKER_ICON = "https://tracker.example/lanterns/icon.png";
+
+const sourceMod = (id: string, name: string, summary: string, versions: CatalogVersion[]): CatalogMod => ({
+  key: `source:${LANTERN_REPO}:${id}`,
+  id,
+  name,
+  summary,
+  authors: ["lantern-dev"],
+  license: "MIT",
+  homepage: null,
+  icon: [id === "lanterns" ? TRACKER_ICON : null].find((u) => u && iconUrlAllowed(u)) ?? null,
+  origin: { kind: "source", repo: LANTERN_REPO },
+  versions,
+});
+
+const LONG_ID = "extraordinarily-verbose-decorative-lighting-and-atmosphere-overhaul";
+const revokedId = flag("revoked");
+
+const allMods: CatalogMod[] = [
+  {
+    ...indexMod(
+      "cogwork",
+      "Cogwork",
+      "Gears, item tubes and engines, an excavator, an assembly bench and a leveler.",
+      [
+        // The fix a revocation's reason points to.
+        ...(revokedId === "cogwork" ? [version("cogwork", "0.2.1", NEW)] : []),
+        version("cogwork", "0.2.1-rc.1", NEW, { channel: "prerelease" }),
+        version("cogwork", "0.2.0", NEW),
+        version("cogwork", "0.1.2", OLD),
+      ],
+      mockIcon("cogwork")
+    ),
+    homepage: "https://github.com/Zorro909/weft-mods/tree/main/cogwork",
+  },
+  indexMod(
+    "structures",
+    "Structures",
+    "Overworld buildings and hamlets, a wand, and /structure.",
+    [version("structures", "0.1.3", NEW), version("structures", "0.1.2", NEW), version("structures", "0.1.1", OLD)],
+    mockIcon("structures")
+  ),
+  indexMod("showcase", "Showcase", "Developer tool: plays and records films that mods define in code.", [
+    version("showcase", "0.1.1-rc.2", NEW, { channel: "prerelease", deps: [] }),
+  ]),
+  indexMod("hearth", "Hearth", "Stoves, chimneys and a kettle. Runs on Cogwork's engines.", [
+    version("hearth", "0.4.0", NEW, { deps: ["base", "cogwork"] }),
+    version("hearth", "0.3.2", OLD, { deps: ["base", "cogwork"] }),
+  ]),
+  indexMod("railways", "Railways", "Tracks, switches and minecarts that follow signals.", [
+    version("railways", "0.2.0", NEW, { deps: ["base", "signals"] }),
+  ]),
+  indexMod("signals", "Signals", "Block signals and pressure plates for Railways.", [version("signals", "0.1.0", OLD)]),
+  sourceMod("lanterns", "Lanterns", "Hanging lanterns in eight colours that sway in the wind and light up caves.", [
+    // Glowmoss lights them; only the same source has it, as the backend's resolver allows.
+    version("lanterns", "1.1.0", NEW, fromSource("2b3c4d5e6f708192a3b4c5d6e7f8091a2b3c4d5e", false, { deps: ["base", "glowmoss"] })),
+    version("lanterns", "1.0.0", OLD, fromSource("9a1b2c3d4e5f60718293a4b5c6d7e8f901234567", false)),
+  ]),
+  sourceMod("glowmoss", "Glowmoss", "A soft blue moss that spreads on damp stone and glows at night.", [
+    version("glowmoss", "0.3.0", NEW, fromSource("1f2e3d4c5b6a79881726354a5b6c7d8e9f012345", true)),
+  ]),
+];
+// `chain=1`: mods that need mods that need others (contract R4 §1).
+if (flag("chain") === "1") {
+  allMods.push(
+    indexMod("chimneys", "Chimneys", "Tall brick chimneys for Hearth's stoves.", [version("chimneys", "0.1.0", NEW, { deps: ["base", "hearth"] })]),
+    indexMod("junctions", "Junctions", "Switches and crossings for Railways.", [version("junctions", "0.1.0", NEW, { deps: ["base", "railways"] })])
+  );
+}
+if (LONG) {
+  allMods.push(
+    indexMod(
+      LONG_ID,
+      "Extraordinarily Verbose Decorative Lighting and Atmosphere Overhaul",
+      "A mod whose name, id and summary are far longer than any sensible mod would use, to see what the layout does with them when the window is at its smallest.",
+      [version(LONG_ID, "12.34.56-experimental.4563878.917596d", NEW, { channel: "experimental" }), version(LONG_ID, "12.34.55", NEW)]
+    )
+  );
+}
+
+const indexFlag = flag("index") ?? "fresh";
+const sourceFlag = flag("source") ?? "ok";
+const INDEX_DATE = indexFlag === "fresh" ? "2026-11-04T18:00:00Z" : "2026-11-02T12:00:00Z";
+const err = (code: ErrorCode, detail: string | null = null): AppErrorPayload => ({ code, detail });
+/** GitHub's word on when a rate limit ends, as the backend passes it on: 20 minutes from now. */
+const resetsAt = () => `resets at ${Math.floor(Date.now() / 1000) + 20 * 60}`;
+
+const catalog: Catalog = {
+  mods: allMods.filter((m) => !((indexFlag === "unavailable" || indexFlag === "unreachable") && m.origin.kind === "index")),
+  revoked: [],
+  index:
+    indexFlag === "stale"
+      ? { freshness: "stale", generated: "2026-09-21T12:00:00Z", signedAt: "2026-09-21T12:00:00Z", error: null, cacheError: null }
+      : indexFlag === "cached"
+        ? { freshness: "cached", generated: INDEX_DATE, signedAt: INDEX_DATE, error: err("Network", "offline"), cacheError: null }
+        : indexFlag === "unavailable"
+          ? // Pages answered 404: the network is up, there is just no index there (yet).
+            {
+              freshness: "unavailable",
+              generated: null,
+              signedAt: null,
+              error: err("HttpStatus", "HTTP 404 (https://weft-rust.github.io/weft-mods-index/v1/index.json)"),
+              cacheError: null,
+            }
+          : indexFlag === "unreachable"
+            ? { freshness: "unavailable", generated: null, signedAt: null, error: err("Network", "dns error: failed to lookup address information"), cacheError: null }
+          : indexFlag === "invalid"
+            ? { freshness: "cached", generated: INDEX_DATE, signedAt: INDEX_DATE, error: err("IndexSignatureInvalid", "signature by an unknown key"), cacheError: null }
+            : indexFlag === "rollback"
+              ? { freshness: "cached", generated: INDEX_DATE, signedAt: INDEX_DATE, error: err("IndexRollback"), cacheError: null }
+              : indexFlag === "unsaved"
+                ? { freshness: "fresh", generated: INDEX_DATE, signedAt: INDEX_DATE, error: null, cacheError: err("DiskFull", "No space left on device (os error 28)") }
+                : { freshness: "fresh", generated: INDEX_DATE, signedAt: INDEX_DATE, error: null, cacheError: null },
+  sources: [
+    {
+      repo: LANTERN_REPO,
+      mods: 2,
+      freshness: sourceFlag === "ok" ? "fresh" : sourceFlag === "notfound" ? "unavailable" : "cached",
+      checked: sourceFlag === "notfound" ? null : sourceFlag === "ok" ? "2026-11-04T18:05:00Z" : "2026-11-03T09:30:00Z",
+      error:
+        sourceFlag === "notfound"
+          ? err("ModSourceNotFound", LANTERN_REPO)
+          : sourceFlag === "ratelimited"
+            ? err("ModSourceRateLimited", resetsAt())
+            : sourceFlag === "offline"
+              ? err("Network", "offline")
+              : null,
+      noMods: null,
+    },
+  ],
+  weft: [
+    { tag: NEW, commit: "ff9c7128511fc0dce7719b67c9a59274d70bdd5a", abi: ABI[NEW] },
+    { tag: OLD, commit: "34fa22b0000000000000000000000000000000000", abi: ABI[OLD] },
+  ],
+  platform: PLATFORM,
+  sourcesError: null,
+  revision: 0,
+};
+if (sourceFlag === "notfound") {
+  catalog.mods = catalog.mods.filter((m) => m.origin.kind !== "source");
+  catalog.sources[0].mods = 0;
+}
+// `nomods=<reason>`: GitHub answers for the source, with nothing usable in it, for that reason.
+const noModsFlag = flag("nomods") as NoModsReason | null;
+if (noModsFlag) {
+  catalog.mods = catalog.mods.filter((m) => m.origin.kind !== "source");
+  Object.assign(catalog.sources[0], { mods: 0, freshness: "fresh", error: null, noMods: noModsFlag });
+}
+
+// ---------------------------------------------------------------------------------------------
+// Mod sets
+
+const modById = (id: string) => allMods.find((m) => m.id === id)!;
+const pick = (id: string, v: string, enabled = true): Entry => {
+  const m = modById(id);
+  return R.entryFrom(m, m.versions.find((x) => x.version === v)!, enabled, "2026-11-04T12:00:00Z");
+};
+
+const fileEntry: Entry = {
+  id: "mytweak",
+  name: "My Tweak",
+  summary: "",
+  version: null,
+  channel: null,
+  sha256: sha("mytweak"),
+  size: 1_153_433,
+  enabled: true,
+  trust: "unverified",
+  origin: { kind: "file", name: "mytweak.zip" },
+  abi: null,
+  weftTag: null,
+  deps: [],
+  tag: null,
+  sourceRepo: null,
+  sourceCommit: null,
+  icon: null,
+  installedAt: "2026-11-04T12:00:00Z",
+  revoked: null,
+};
+
+/** Which mods each scenario starts with. */
+const SETS: Record<string, "full" | "quiet" | "donor" | "needs" | "late" | "chain" | "none"> = {
+  mods: "full",
+  revoked: "full",
+  ratelimited: "full",
+  offline: "full",
+  indexdown: "full",
+  stale: "full",
+  long: "full",
+  crash: "quiet",
+  knownfile: "quiet",
+  empty: "donor",
+  missingdep: "needs",
+  lateblock: "late",
+  shadowed: "late",
+  chain: "chain",
+  fresh: "none",
+};
+
+const locks: Record<string, Entry[]> = { [NEW]: [], [OLD]: [] };
+const set = SETS[scenario.name] ?? "full";
+if (set === "full") {
+  locks[NEW] = [pick("cogwork", "0.2.0"), pick("structures", "0.1.2"), pick("showcase", "0.1.1-rc.2", false), pick("lanterns", "1.0.0"), { ...fileEntry }];
+  locks[OLD] = [pick("cogwork", "0.1.2"), pick("structures", "0.1.1")];
+} else if (set === "quiet") {
+  // A missing-dependency crash needs something the launcher couldn't see: Cogwork is off.
+  locks[NEW] = [pick("cogwork", "0.2.0", flag("crash") !== "missingDep"), pick("structures", "0.1.2"), { ...fileEntry }];
+} else if (set === "donor") {
+  locks[OLD] = [
+    pick("cogwork", "0.1.2"),
+    pick("structures", "0.1.1"),
+    pick("lanterns", "1.0.0"),
+    pick("signals", "0.1.0"),
+    pick("hearth", "0.3.2"),
+    { ...fileEntry },
+  ];
+} else if (set === "needs") {
+  locks[NEW] = [pick("cogwork", "0.2.0", false), pick("hearth", "0.4.0"), pick("lanterns", "1.1.0"), pick("railways", "0.2.0"), pick("structures", "0.1.3")];
+  locks[OLD] = [pick("cogwork", "0.1.2")];
+} else if (set === "late") {
+  locks[NEW] = [pick("cogwork", "0.2.0"), pick("hearth", "0.4.0"), pick("structures", "0.1.3")];
+} else if (set === "chain") {
+  // Hearth needs Cogwork, both off; Railways needs Signals, which has no build for this version.
+  locks[NEW] = [pick("cogwork", "0.2.0", false), pick("hearth", "0.4.0", false), pick("railways", "0.2.0", false), pick("structures", "0.1.3")];
+}
+if (LONG) locks[NEW].push(pick(LONG_ID, "12.34.55"));
+for (const l of Object.values(locks)) l.sort((a, b) => (a.id < b.id ? -1 : 1));
+/** The player's own mods folder. `shadow=<id>` puts a copy of that managed mod there (contract R4 §4). */
+const playerFolder: PlayerFile[] = set === "full" ? [{ file: "oldtweak.zip", id: "oldtweak" }] : [];
+const shadowId = flag("shadow");
+if (shadowId) playerFolder.push({ file: `${shadowId}-old.zip`, id: shadowId });
+
+const REASON = "Corrupts worlds that use its tubes. Get 0.2.1 or later.";
+/**
+ * Revokes the installed builds of `id`. The entries go through the index's own reading of
+ * `revoked[]` (contract R4 §6); with `revocations=messy` they come uppercased, without a reason or
+ * time, next to one that isn't a hash at all, and still revoke.
+ */
+function revoke(id: string) {
+  const shas = new Set(Object.values(locks).flatMap((l) => l.filter((e) => e.id === id).map((e) => e.sha256)));
+  const messy = flag("revocations") === "messy";
+  const raw: R.RawRevocation[] = [...shas].map((s) =>
+    messy ? { sha256: s.toUpperCase(), reason: null, at: null } : { sha256: s, reason: REASON, at: "2026-11-03T00:00:00Z" }
+  );
+  if (messy) raw.push({ sha256: "not-a-hash", reason: "a typo in the index", at: null });
+  const { kept, dropped } = R.readRevocations(raw);
+  if (dropped.length) console.warn("mock backend: dropped revocations that aren't SHA-256s", dropped);
+  catalog.revoked.push(...kept.map(({ sha256, reason }) => ({ sha256, reason })));
+  // The backend turns a revoked mod off and remembers why in the lock.
+  Object.values(locks).forEach((l) => R.applyRevocations(l, catalog, NOW));
+}
+if (revokedId) revoke(revokedId);
+// Without an index there is no revocation list; the lock still remembers.
+if (indexFlag === "unavailable") catalog.revoked = [];
+
+const versions = set === "none" ? [] : [NEW, OLD];
+const running = new Set<string>();
+/** The last removal per version, which `restore_mod` can undo until the next change. */
+const removed: Record<string, Entry | undefined> = {};
+
+// ---------------------------------------------------------------------------------------------
+// The commands' work
+
+const ABI_ERROR = flag("abi") === "error";
+const abiOf = (tag: string): string | null => (ABI_ERROR ? null : (ABI[tag] ?? null));
+const fitOf = (tag: string): Fit | null => {
+  const abi = abiOf(tag);
+  return abi === null ? null : { abi, platform: PLATFORM };
+};
+
+const fail = (code: ErrorCode, detail: string | null = null): never => {
+  throw { code, detail } satisfies AppErrorPayload;
+};
+
+function lockOf(tag: string): Entry[] {
+  return locks[tag] ?? fail("NotInstalled", tag);
+}
+
+const report = (tag: string) => R.report(tag, lockOf(tag), abiOf(tag), ABI_ERROR ? err("AbiUnavailable", tag) : null, catalog, playerFolder);
+
+// `profile=fail`: every read of a set fails. `profile=failafterplay`: the first read after a
+// refused Play fails, the ones after it work (Retry gets through).
+const profileFlag = flag("profile");
+let failNextRead = false;
+function readProfile(tag: string) {
+  if (profileFlag === "fail" || failNextRead) {
+    failNextRead = false;
+    fail("Io", `could not read ${tag}/mods.lock: permission denied`);
+  }
+  return report(tag);
+}
+
+function findBuild(sha256: string) {
+  return R.findBuild(catalog, sha256) ?? fail("ModNotInCatalog", sha256);
+}
+
+const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms * SLOW));
+
+// ---------------------------------------------------------------------------------------------
+// Operations (contract R4 §3): each has the client's id; its progress says which file of how many,
+// and `cancel_mod_operation` aborts its downloads, leaving nothing behind.
+
+/** Like the backend's `OpState`: running, then cancelled or writing, never both. */
+type Phase = "running" | "cancelled" | "writing";
+const operations = new Map<string, { phase: Phase }>();
+
+/** Runs `work` as operation `id`; a cancel makes it fail with `ModCancelled` at its next step. */
+async function operation<T>(id: string, work: (op: Op) => Promise<T>): Promise<T> {
+  const state: { phase: Phase } = { phase: "running" };
+  operations.set(id, state);
+  try {
+    return await work({
+      id,
+      check: () => {
+        if (state.phase === "cancelled") fail("ModCancelled", id);
+      },
+      startWriting: () => {
+        if (state.phase !== "running") fail("ModCancelled", id);
+        state.phase = "writing";
+      },
+    });
+  } finally {
+    operations.delete(id);
+  }
+}
+
+/** What `cancel_mod_operation` does (`Operations::cancel`): only a running operation, once. */
+export function cancelOperation(id: string): boolean {
+  const op = operations.get(id);
+  if (!op || op.phase !== "running") return false;
+  op.phase = "cancelled";
+  return true;
+}
+
+interface Op {
+  id: string;
+  /** Throws `ModCancelled` once the operation has been cancelled. */
+  check: () => void;
+  /**
+   * From here on it writes, and a cancel is refused (`Operation::start_writing`); `ModCancelled`
+   * if it already was. Called right before `installing`, as the backend does.
+   */
+  startWriting: () => void;
+}
+
+const progress = (op: Op, file: { sha256: string; id: string; index: number; count: number }, stage: ProgressStage, percent: number) =>
+  emit(EVENTS.modProgress, {
+    operationId: op.id,
+    sha256: file.sha256,
+    modId: file.id,
+    stage,
+    percent,
+    index: file.index,
+    count: file.count,
+  } satisfies ModProgress);
+
+/** Download and check one file, with the backend's stages and failures. */
+async function fetchBuild(op: Op, file: { sha256: string; id: string; index: number; count: number }, isDep: boolean) {
+  if (failures.has("toolarge")) fail("ModTooLarge", `${file.id}.zip is over 512 MB`);
+  for (let p = 0; p <= 100; p += 10) {
+    op.check();
+    await progress(op, file, "downloading", p);
+    if (p === 40 && failures.has("network")) fail("Network", "connection reset by peer");
+    if (p === 60 && isDep && failures.has("dep")) fail("ModDownloadNotFound", `${file.id}.zip`);
+    await sleep(50);
+  }
+  op.check();
+  await progress(op, file, "verifying", 100);
+  await sleep(200);
+  if (failures.has("install")) fail("Sha256Mismatch", `expected ${file.sha256.slice(0, 12)}…, got 0b5e1c9d2a77…`);
+}
+
+/** Every change but a restore forgets the last removal: its file may go at the next clean-up. */
+function changed(tag: string) {
+  removed[tag] = undefined;
+}
+
+function result(tag: string, parts: Partial<Omit<ChangeResult, "report">> = {}): ChangeResult {
+  return { report: report(tag), installed: [], alsoEnabled: [], alsoDisabled: [], missing: [], installedOff: [], undo: null, ...parts };
+}
+
+/**
+ * `fail=meanwhile`: the first install, copy or file install finds that a newer Glowmoss was
+ * published after the dialog planned it, so any plan with Glowmoss in it has changed.
+ */
+let meanwhileDone = false;
+function somethingChangesMeanwhile() {
+  if (!failures.has("meanwhile") || meanwhileDone) return;
+  meanwhileDone = true;
+  const glowmoss = catalog.mods.find((m) => m.id === "glowmoss");
+  glowmoss?.versions.unshift(version("glowmoss", "0.3.1", NEW, fromSource("2f3e4d5c6b7a89901827364a5b6c7d8e9f012346", true)));
+}
+
+/**
+ * `service::run_install`: re-plan, refuse a plan that isn't the one the player saw (contract R4
+ * §2), download what is needed, check the plan again under the lock, then write the set.
+ */
+async function runInstall(
+  op: Op,
+  tag: string,
+  wanted: { mod: CatalogMod; v: CatalogVersion }[],
+  token: () => string,
+  expected: string,
+  skipFetch: string[] = []
+): Promise<ChangeResult> {
+  const fit = fitOf(tag) ?? fail("AbiUnavailable", tag);
+  if (token() !== expected) fail("ModChangedMeanwhile", tag);
+  const res = R.resolve(catalog, lockOf(tag), wanted, fit);
+  // In the backend's order (`plan::resolve`): what was asked for first, then what it needs.
+  const files = res.picks.map((p, i) => ({ sha256: p.v.sha256, id: p.mod.id, index: i + 1, count: res.picks.length }));
+  for (const [i, p] of res.picks.entries()) {
+    if (!skipFetch.includes(p.v.sha256)) await fetchBuild(op, files[i], !res.wanted.includes(p.mod.id));
+  }
+  op.check();
+  // Checked again under the lock, as `service::commit` does, before anything says `installing`.
+  if (!locks[tag] || token() !== expected) fail("ModChangedMeanwhile", tag);
+  if (running.has(tag)) fail("GameRunning", tag);
+  for (const p of res.picks) if (R.revocation(catalog, p.v.sha256)) fail("ModChangedMeanwhile", p.mod.name);
+  // `installing` comes before the set is rewritten; past this, a cancel is too late.
+  op.startWriting();
+  for (const f of files) await progress(op, f, "installing", 100);
+  await sleep(350);
+  const lock = lockOf(tag);
+  const done = R.commit(lock, res, new Date().toISOString());
+  changed(tag);
+  return result(tag, { installed: done.installed, alsoEnabled: done.alsoEnabled, installedOff: done.installedOff, missing: res.missing });
+}
+
+const planOf = (tag: string, sha256: string) => R.planInstall(catalog, lockOf(tag), tag, sha256, fitOf(tag), running.has(tag));
+
+/** `prelaunch=storemissing`: mods whose store copy is gone, until installed again. */
+const storeMissing = new Set(flag("prelaunch") === "storemissing" ? ["structures"] : []);
+
+async function installMod(tag: string, sha256: string, planToken: string, operationId: string): Promise<ChangeResult> {
+  somethingChangesMeanwhile();
+  const plan = planOf(tag, sha256);
+  if (plan.problem) throw plan.problem;
+  const done = await operation(operationId, (op) => runInstall(op, tag, [findBuild(sha256)], () => planOf(tag, sha256).planToken, planToken));
+  storeMissing.delete(plan.target.id);
+  return done;
+}
+
+function previewCopy(from: string, to: string) {
+  const fit = fitOf(to) ?? fail("AbiUnavailable", to);
+  return R.copyPreview(catalog, [from, lockOf(from)], [to, lockOf(to)], fit);
+}
+
+async function copyProfile(from: string, to: string, planToken: string, operationId: string): Promise<CopyResult> {
+  if (running.has(to)) fail("GameRunning", to);
+  somethingChangesMeanwhile();
+  const { preview, picks } = previewCopy(from, to);
+  if (preview.planToken !== planToken) fail("ModChangedMeanwhile", to);
+  const leftBehind = preview.items.filter((i) => i.outcome === "noBuild" || i.outcome === "localFile" || i.outcome === "revoked");
+  const change = picks.length
+    ? await operation(operationId, (op) => runInstall(op, to, picks, () => previewCopy(from, to).preview.planToken, planToken))
+    : result(to);
+  return { ...change, leftBehind };
+}
+
+function setEnabled(tag: string, id: string, enabled: boolean): ChangeResult {
+  if (running.has(tag)) fail("GameRunning", tag);
+  const out = R.setEnabled(lockOf(tag), catalog, id, enabled);
+  changed(tag);
+  return result(tag, out);
+}
+
+function removeMod(tag: string, id: string): ChangeResult {
+  if (running.has(tag)) fail("GameRunning", tag);
+  const out = R.remove(lockOf(tag), id);
+  changed(tag);
+  removed[tag] = out.removed;
+  return result(tag, { alsoDisabled: out.alsoDisabled, undo: id });
+}
+
+/**
+ * Contract R3 §6: the entry back exactly as it was, while its file is still in the store. Runs as
+ * the page's operation, like `service::restore`: the stored file is checked (`verifying`), then
+ * written (`installing`), and a cancel before that leaves it removed.
+ */
+async function restoreMod(tag: string, id: string, operationId: string): Promise<ChangeResult> {
+  if (running.has(tag)) fail("GameRunning", tag);
+  const entry = removed[tag];
+  if (!entry || entry.id !== id) fail("ModNotInstalled", id);
+  return operation(operationId, async (op) => {
+    const file = { sha256: entry!.sha256, id, index: 1, count: 1 };
+    await progress(op, file, "verifying", 0);
+    await sleep(150);
+    op.startWriting();
+    await progress(op, file, "installing", 100);
+    R.put(lockOf(tag), { ...entry! });
+    removed[tag] = undefined;
+    return result(tag);
+  });
+}
+
+// ---------------------------------------------------------------------------------------------
+// Local files
+
+/** The `known` file is Cogwork 0.2.0: same id, hash and libraries as the catalogue build. */
+const knownBuild = () => findBuild(modById("cogwork").versions.find((v) => v.version === "0.2.0")!.sha256);
+
+/** What a file asks the player to agree to: its own hash and tier, or a catalogued build's plan. */
+function fileToken(tag: string, info: Omit<FileInspection, "planToken">): string {
+  if (info.catalogMatch) return planOf(tag, info.catalogMatch.build.sha256).planToken;
+  return R.planToken({ builds: [{ sha256: info.sha256, trust: "unverified" }], on: info.archive ? [info.archive.id] : [], turnsOn: true, installedOff: [], abi: abiOf(tag) });
+}
+
+function inspect(tag: string): FileInspection {
+  const info = inspectBare(tag);
+  return { ...info, planToken: fileToken(tag, info) };
+}
+
+function inspectBare(tag: string): Omit<FileInspection, "planToken"> {
+  const kind = flag("file") ?? "unverified";
+  const lock = lockOf(tag);
+  if (kind === "known") {
+    const { mod, v } = knownBuild();
+    const abi = abiOf(tag);
+    return {
+      fileName: "cogwork.zip",
+      size: v.size,
+      sha256: v.sha256,
+      archive: { id: "cogwork", libraries: ["libcogwork.so", "cogwork.dll", "libcogwork.dylib"], platforms: v.platforms, hasAssets: true, entries: 31 },
+      problem: null,
+      name: mod.name,
+      summary: mod.summary,
+      fitsSystem: true,
+      // Contract R4 §5: unknown when the version's interface is.
+      catalogMatch: { key: mod.key, name: mod.name, fitsVersion: abi === null ? null : v.abi === abi, build: v },
+      revoked: R.revocation(catalog, v.sha256) !== null,
+      revokedReason: R.revocation(catalog, v.sha256)?.reason ?? null,
+      replaces: lock.find((e) => e.id === "cogwork")?.name ?? null,
+    };
+  }
+  const base: Omit<FileInspection, "planToken"> = {
+    fileName: "mytweak.zip",
+    size: 1_153_433,
+    sha256: sha("mytweak"),
+    archive: { id: "mytweak", libraries: ["libmytweak.so", "mytweak.dll"], platforms: ["linux-x64", "windows-x64"], hasAssets: true, entries: 14 },
+    problem: null,
+    name: "My Tweak",
+    summary: "Makes torches brighter.",
+    fitsSystem: true,
+    catalogMatch: null,
+    revoked: false,
+    revokedReason: null,
+    replaces: lock.find((e) => e.id === "mytweak")?.name ?? null,
+  };
+  if (kind === "notamod") {
+    return {
+      ...base,
+      fileName: "screenshots.zip",
+      archive: null,
+      name: null,
+      summary: null,
+      fitsSystem: false,
+      problem: err("ModArchiveInvalid", "no mod library at the top of the zip"),
+      replaces: null,
+    };
+  }
+  if (kind === "wrongplatform") {
+    return { ...base, fitsSystem: false, archive: { ...base.archive!, libraries: ["mytweak.dll"], platforms: ["windows-x64"] } };
+  }
+  if (kind === "revoked") return { ...base, revoked: true, revokedReason: "Steals saved logins. Removed on 2026-11-03." };
+  return base;
+}
+
+/** `file=revokedlate`: the index revokes the file's hash while it is being copied in. */
+const REVOKED_LATE = "Steals saved logins. Revoked while you were installing it.";
+
+async function installFile(tag: string, sha256: string, planToken: string, operationId: string): Promise<ChangeResult> {
+  somethingChangesMeanwhile();
+  const info = inspect(tag);
+  if (info.sha256 !== sha256) fail("ModFileChanged");
+  if (!info.archive) throw info.problem;
+  if (info.revoked) fail("ModRevoked", info.revokedReason ?? "no reason given");
+  if (running.has(tag)) fail("GameRunning", tag);
+  if (info.planToken !== planToken) fail("ModChangedMeanwhile", tag);
+  return operation(operationId, async (op) => {
+    const self = { sha256, id: info.archive!.id, index: 1, count: 1 };
+    await progress(op, self, "verifying", 100);
+    await sleep(300);
+    op.check();
+    // A catalogued file installs from these bytes, recorded with the catalogue's metadata and
+    // tier, and brings what it needs like any install.
+    if (info.catalogMatch) {
+      return runInstall(op, tag, [knownBuild()], () => inspect(tag).planToken, planToken, [sha256]);
+    }
+    if (flag("file") === "revokedlate") catalog.revoked.push({ sha256, reason: REVOKED_LATE });
+    await sleep(300);
+    // Contract R4 §2: revocation is checked again at commit, for an unknown file by its hash,
+    // under the lock and before anything is written.
+    const late = R.revocation(catalog, sha256);
+    if (late) fail("ModRevoked", late.reason ?? "no reason given");
+    op.startWriting();
+    await progress(op, self, "installing", 100);
+    const lock = lockOf(tag);
+    const existing = lock.find((e) => e.id === fileEntry.id);
+    R.put(lock, { ...fileEntry, enabled: existing?.enabled ?? true, installedAt: new Date().toISOString() });
+    changed(tag);
+    return result(tag, { installed: [fileEntry.id] });
+  });
+}
+
+// ---------------------------------------------------------------------------------------------
+// Launch and crashes
+
+async function launch(tag: string) {
+  if (running.size) fail("AnotherGameRunning", [...running][0]);
+  // `prepare_launch` applies what the catalogue says before anything starts.
+  if (flag("prelaunch") === "revoke" && !catalog.revoked.length) revoke("cogwork");
+  // The store's copy of Structures is gone until it is installed again.
+  if (flag("prelaunch") === "storemissing" && storeMissing.has("structures") && lockOf(tag).some((e) => e.id === "structures" && e.enabled)) {
+    fail("ModStoreMissing", "structures");
+  }
+  // Then it reads the set and hashes what it hands the game: not instant.
+  await sleep(250);
+  const r = report(tag);
+  if (r.blocking.length) {
+    if (profileFlag === "failafterplay") failNextRead = true;
+    fail("ModsBlocked", r.blocking.map((id) => r.mods.find((m) => m.id === id)?.name ?? id).join(", "));
+  }
+  running.add(tag);
+  await emit(EVENTS.gameState, { tag, state: "running", exitCode: null, crashed: false, modFailure: null });
+  const kind = flag("crash");
+  setTimeout(
+    () => {
+      running.delete(tag);
+      const log = kind && kind in CRASH_LOGS ? CRASH_LOGS[kind as FailureKind] : "";
+      emit(EVENTS.gameState, {
+        tag,
+        state: "stopped",
+        exitCode: kind ? 1 : 0,
+        crashed: !!kind,
+        modFailure: findFailure(log),
+      });
+    },
+    (kind ? 1500 : 4000) * SLOW
+  );
+}
+
+// ---------------------------------------------------------------------------------------------
+// Icons
+
+/** Every icon the page asked for, for the tests: `window.mockIconRequests`. */
+const iconRequests: string[] = [];
+(window as unknown as { mockIconRequests: string[] }).mockIconRequests = iconRequests;
+
+function iconUrl(id: string): string {
+  const art: Record<string, string[]> = {
+    cogwork: ["...##...", ".#.##.#.", "########", ".##..##.", ".##..##.", "########", ".#.##.#.", "...##..."],
+    structures: ["...##...", "..####..", ".######.", "########", ".##..##.", ".##..##.", ".##..##.", ".######."],
+  };
+  const rows = art[id] ?? fail("ModNotInCatalog", id);
+  const c = document.createElement("canvas");
+  c.width = c.height = 8;
+  const g = c.getContext("2d")!;
+  g.fillStyle = id === "cogwork" ? "#e09632" : "#8c97ad";
+  rows.forEach((row, y) => [...row].forEach((ch, x) => ch === "#" && g.fillRect(x, y, 1, 1)));
+  return c.toDataURL("image/png");
+}
+
+// ---------------------------------------------------------------------------------------------
+// Commands
+
+/** Repos that exist, as GitHub spells them. `add_mod_source` asks GitHub; anything else is a 404. */
+const KNOWN_REPOS = [LANTERN_REPO, "Zorro909/weft-mods", "glow-team/fireflies"];
+
+const raceFlag = flag("race");
+let raced = false;
+/** Counts up with every catalogue the mock answers with, like the backend's held revision. */
+let revision = 0;
+/** `slowsource=<repo>`: that source takes long to answer, in a whole refresh or one of its own. */
+const slowSource = flag("slowsource");
+/** `refreshrevokes=<id>`: the index a forced refresh brings revokes that mod (once). */
+let refreshRevoked = false;
+/** What GitHub has in repos added here: `glow-team/fireflies` publishes releases without mods. */
+const EMPTY_REPOS: Record<string, NoModsReason> = { "glow-team/fireflies": "noModFiles" };
+
+/** The mock's own file of sources, which `fail=sources` damages. */
+const DAMAGED_SOURCES = "/home/player/.local/share/weft-launcher/mods/sources.damaged-1762300800.json";
+let sourcesDamaged = failures.has("sources");
+if (sourcesDamaged) {
+  catalog.sources = [];
+  catalog.mods = catalog.mods.filter((m) => m.origin.kind !== "source");
+  catalog.sourcesError = err("ModSourcesDamaged", DAMAGED_SOURCES);
+}
+
+type Handlers = {
+  [K in keyof CommandSignatures]: (args: CommandSignatures[K]["args"]) => Promise<CommandSignatures[K]["result"]> | CommandSignatures[K]["result"];
+};
+
+/**
+ * Every backend command, typed by the generated `CommandSignatures`: a command added, renamed or
+ * changed in Rust fails `tsc` here until the mock follows.
+ */
+const handlers: Handlers = {
+  list_versions: () =>
+    versions.map((tag, i) => ({
+      tag,
+      name: tag,
+      published_at: i === 0 ? "2026-11-01T12:00:00Z" : "2026-10-20T12:00:00Z",
+      body: i === 0 ? "## What's new\n- A **mod manager** in the launcher\n- Faster world loading" : "",
+      prerelease: false,
+      asset: { name: `Weft-${tag}-linux-x64.tar.gz`, url: "", size: 48_000_000, sha256: "a".repeat(64) },
+      from_cache: false,
+    })),
+  install_version: () => fail("AlreadyInstalled"),
+  get_installed_versions: () => versions.map((tag) => ({ tag, path: `/versions/${tag}`, executable: "weft", installed_at: "2026-11-02T10:00:00Z" })),
+  remove_version: async ({ tag }) => {
+    await sleep(300);
+    versions.splice(versions.indexOf(tag), 1);
+    delete locks[tag];
+  },
+  launch_version: ({ tag }) => launch(tag),
+  get_running_versions: () => [...running],
+  open_game_folder: () => undefined,
+  open_log: () => undefined,
+  // Opening the folder only opens it; the player deleting a file there is `mockPlayer.deleteFile`.
+  open_player_mods_folder: () => undefined,
+  list_mod_catalog: async ({ forceRefresh }) => {
+    // `slowsource` in a whole refresh: the index is in at once and said early (`mod-catalog`,
+    // as `service::load_catalog` does), with its revocations (`refreshrevokes`); the slow
+    // source answers three seconds later, and only then does the refresh answer.
+    const slow = forceRefresh && slowSource ? catalog.sources.find((s) => sameRepo(s.repo, slowSource)) : undefined;
+    if (slow) {
+      await sleep(400);
+      const pulled = flag("refreshrevokes");
+      if (pulled && !refreshRevoked) {
+        refreshRevoked = true;
+        revoke(pulled);
+      }
+      await emit(EVENTS.modCatalog, { catalog: { ...structuredClone(catalog), revision: ++revision }, pending: [slow.repo] });
+      await sleep(2600);
+      return { ...structuredClone(catalog), revision: ++revision };
+    }
+    // `race`: the first refresh is slow, and what it found is older than what the next one
+    // finds; it answers last, with the older revision (`stale`) or an error (`error`).
+    const late = forceRefresh && raceFlag && !raced;
+    if (late) raced = true;
+    const answer = { ...structuredClone(catalog), revision: ++revision };
+    if (late && raceFlag === "stale") answer.sources = answer.sources.map((x) => ({ ...x, freshness: "cached", error: err("ModSourceRateLimited", resetsAt()) }));
+    await sleep(late ? 2500 : forceRefresh ? 400 : 0);
+    if (late && raceFlag === "error") fail("Network", "the slow refresh timed out");
+    if (failures.has("catalog")) fail("Network", "the catalogue request timed out");
+    return answer;
+  },
+  refresh_mod_source: async ({ repo }) => {
+    const s = catalog.sources.find((x) => sameRepo(x.repo, repo)) ?? fail("ModSourceNotFound", repo);
+    await sleep(slowSource && sameRepo(repo, slowSource) ? 3000 : 400);
+    if (addedSources.has(s.repo)) {
+      Object.assign(s, { freshness: "fresh", checked: new Date().toISOString(), error: null, noMods: EMPTY_REPOS[s.repo] ?? null });
+    }
+    return { ...structuredClone(catalog), revision: ++revision };
+  },
+  get_mod_sources: async () => {
+    await sleep(150);
+    if (sourcesDamaged) fail("ModSourcesDamaged", DAMAGED_SOURCES);
+    return catalog.sources.map((s) => s.repo);
+  },
+  add_mod_source: async ({ repo: input }) => {
+    await sleep(500);
+    const repo = parseRepo(input) ?? fail("ModSourceInvalid", input);
+    if (sourceFlag === "ratelimited") fail("ModSourceRateLimited", resetsAt());
+    const canonical = KNOWN_REPOS.find((k) => sameRepo(k, repo)) ?? fail("ModSourceNotFound", repo);
+    // A damaged list stays where it was set aside; this starts a new one.
+    if (sourcesDamaged) {
+      sourcesDamaged = false;
+      catalog.sourcesError = null;
+    }
+    if (!catalog.sources.some((s) => sameRepo(s.repo, canonical))) {
+      catalog.sources.push({ repo: canonical, mods: 0, freshness: "unavailable", checked: null, error: null, noMods: null });
+      addedSources.add(canonical);
+    }
+    return catalog.sources.map((s) => s.repo);
+  },
+  remove_mod_source: async ({ repo }) => {
+    await sleep(400);
+    if (sourcesDamaged) fail("ModSourcesDamaged", DAMAGED_SOURCES);
+    // Mods installed from it stay installed; they just stop getting updates.
+    catalog.sources = catalog.sources.filter((s) => !sameRepo(s.repo, repo));
+    catalog.mods = catalog.mods.filter((m) => m.origin.kind !== "source" || !sameRepo(m.origin.repo, repo));
+    return catalog.sources.map((s) => s.repo);
+  },
+  // Finding out a version's mod interface asks the game; when that fails it takes a while to.
+  get_mod_profile: async ({ tag }) => {
+    if (ABI_ERROR) await sleep(600);
+    return readProfile(tag);
+  },
+  get_mod_icon: ({ url }) => {
+    iconRequests.push(url);
+    const known = catalog.mods.some((m) => m.icon === url);
+    if (!known || !iconUrlAllowed(url)) fail("ModNotInCatalog", url);
+    const parts = url.split("/");
+    return iconUrl(parts[parts.length - 5] ?? "");
+  },
+  plan_mod_install: async ({ tag, sha256 }) => {
+    await sleep(120);
+    return R.planInstall(catalog, lockOf(tag), tag, sha256, fitOf(tag), running.has(tag));
+  },
+  install_mod: ({ tag, sha256, planToken, operationId }) => installMod(tag, sha256, planToken, operationId),
+  inspect_mod_file: async ({ tag }) => {
+    await sleep(300);
+    return inspect(tag);
+  },
+  install_mod_file: ({ tag, sha256, planToken, operationId }) => installFile(tag, sha256, planToken, operationId),
+  set_mod_enabled: async ({ tag, id, enabled }) => {
+    await sleep(150);
+    return setEnabled(tag, id, enabled);
+  },
+  remove_mod: async ({ tag, id }) => {
+    await sleep(150);
+    return removeMod(tag, id);
+  },
+  restore_mod: ({ tag, id, operationId }) => restoreMod(tag, id, operationId),
+  preview_copy_mod_profile: async ({ from, to }) => {
+    await sleep(200);
+    return previewCopy(from, to).preview;
+  },
+  copy_mod_profile: ({ from, to, planToken, operationId }) => copyProfile(from, to, planToken, operationId),
+  cancel_mod_operation: ({ operationId }) => cancelOperation(operationId),
+};
+
+/** Sources added in this session: refreshing the catalogue fetches them, as GitHub would answer. */
+const addedSources = new Set<string>();
+function refreshAddedSources() {
+  for (const s of catalog.sources) {
+    if (!addedSources.has(s.repo)) continue;
+    s.freshness = "fresh";
+    s.checked = new Date().toISOString();
+    s.noMods = EMPTY_REPOS[s.repo] ?? null;
+  }
+}
+
+/** What the player does outside the launcher, for tests: `window.mockPlayer.deleteFile(name)`. */
+const mockPlayer = {
+  /** Deletes a file from the player's own mods folder, as they would after Show folder. */
+  deleteFile(file: string) {
+    const at = playerFolder.findIndex((f) => f.file === file);
+    if (at >= 0) playerFolder.splice(at, 1);
+  },
+};
+
+/** The plugin commands the page calls, which aren't the backend's own. */
+const plugins: Record<string, () => unknown> = {
+  "plugin:app|version": () => "1.2.0",
+  "plugin:updater|check": () => null,
+  "plugin:dialog|open": () => (flag("file") === "known" ? "/home/player/Downloads/cogwork.zip" : "/home/player/Downloads/mytweak.zip"),
+  "plugin:opener|open_url": () => null,
+  "plugin:opener|open_path": () => null,
+};
+
+/** Commands being answered now, so a test can wait until the start-up reads are done. */
+let inFlight = 0;
+const settledWaiters: (() => void)[] = [];
+/** `window.mockSettled()`: resolves once no command has been in flight for a moment. */
+function mockSettled(): Promise<void> {
+  return new Promise((resolve) => {
+    const check = () => (inFlight === 0 ? setTimeout(() => (inFlight === 0 ? resolve() : settledWaiters.push(check)), 50) : settledWaiters.push(check));
+    check();
+  });
+}
+
+export function installMockBackend() {
+  mockWindows("main");
+  // Which scenario a window or screenshot shows, and the flags given beside it.
+  const extra = [...params].filter(([k]) => k !== "scenario").map(([k, v]) => `${k}=${v}`);
+  document.title = `Weft (mock: ${scenario.name}${extra.length ? `, ${extra.join(", ")}` : ""})`;
+  (window as unknown as { mockPlayer: typeof mockPlayer }).mockPlayer = mockPlayer;
+  (window as unknown as { mockSettled: typeof mockSettled }).mockSettled = mockSettled;
+  mockIPC(
+    async (cmd, raw) => {
+      if (cmd in plugins) return plugins[cmd]();
+      if (cmd === "list_mod_catalog" && (raw as { forceRefresh?: boolean } | undefined)?.forceRefresh) refreshAddedSources();
+      const handler = handlers[cmd as keyof Handlers] as ((args: unknown) => unknown) | undefined;
+      // A command this mock doesn't know is a bug in the mock, never a silent null.
+      if (!handler) throw new Error(`mock backend: no command ${cmd}`);
+      inFlight++;
+      try {
+        return await handler(raw ?? {});
+      } finally {
+        inFlight--;
+        if (inFlight === 0) settledWaiters.splice(0).forEach((w) => w());
+      }
+    },
+    { shouldMockEvents: true }
+  );
+  // The shim's unlisten looks for `id`, but @tauri-apps/api sends `eventId`: a listener that was
+  // let go stayed registered, and every later event warned "Couldn't find callback id". Pass it
+  // on under the name the shim reads.
+  const internals = (window as unknown as { __TAURI_INTERNALS__: { invoke: (cmd: string, args?: Record<string, unknown>, o?: unknown) => Promise<unknown> } }).__TAURI_INTERNALS__;
+  const invoke = internals.invoke;
+  internals.invoke = (cmd, args, o) => invoke(cmd, cmd === "plugin:event|unlisten" && args ? { ...args, id: args.eventId } : args, o);
+}
diff --git a/src/dev/mockRules.test.ts b/src/dev/mockRules.test.ts
new file mode 100644
index 0000000..e6ba46a
--- /dev/null
+++ b/src/dev/mockRules.test.ts
@@ -0,0 +1,284 @@
+// The mock's rules against the cases of the Rust table tests (fixtures/rules.json). A rule that
+// drifts from src-tauri/src/mods fails here, not in a UI test that trusts the mock.
+import { describe, expect, it } from "vitest";
+import rules from "./fixtures/rules.json";
+import * as R from "./mockRules";
+import { iconUrlAllowed } from "../mods/select";
+import type { Catalog, CatalogMod, Channel, Origin, Trust } from "../mods/types";
+
+type AbiName = keyof typeof rules.abi;
+const abi = (name: string | null | undefined): string | null => (name ? rules.abi[name as AbiName] : null);
+const FIT = { abi: rules.abi.ABI, platform: "linux-x64" };
+
+interface EntrySpec {
+  id: string;
+  deps?: string[];
+  abi?: string | null;
+  enabled?: boolean;
+  version?: string;
+  channel?: string;
+  trust?: string;
+  origin?: { kind: string; name?: string; repo?: string };
+  revoked?: { reason: string; at: string };
+}
+
+/** The Rust test helper `entry(id, deps, abi)`, with the fields given changed. */
+function entry(s: EntrySpec): R.Entry {
+  const version = s.version ?? "0.1.0";
+  return {
+    id: s.id,
+    name: `${s.id} name`,
+    summary: "",
+    version,
+    channel: (s.channel ?? "release") as Channel,
+    sha256: `${s.id}@${version}`,
+    size: 1,
+    enabled: s.enabled ?? true,
+    trust: (s.trust ?? "reviewed") as Trust,
+    origin: (s.origin ?? { kind: "index" }) as Origin,
+    abi: s.abi === undefined ? rules.abi.ABI : abi(s.abi),
+    weftTag: null,
+    deps: s.deps ?? [],
+    tag: null,
+    sourceRepo: null,
+    sourceCommit: null,
+    icon: null,
+    installedAt: "",
+    revoked: s.revoked ?? null,
+  };
+}
+
+function catalog(name: keyof typeof rules.catalogs): Catalog {
+  const c = rules.catalogs[name];
+  const mods: CatalogMod[] = c.mods.map((m) => {
+    const origin: Origin = m.origin === "index" ? { kind: "index" } : { kind: "source", repo: m.origin };
+    return {
+      key: R.originKey(origin, m.id)!,
+      id: m.id,
+      name: `${m.id} name`,
+      summary: "",
+      authors: [],
+      license: null,
+      homepage: null,
+      icon: null,
+      origin,
+      versions: m.builds.map(([version, a, channel, deps]) => ({
+        version: version as string,
+        channel: channel as Channel,
+        tag: `${m.id}-v${version}`,
+        published: "",
+        sourceRepo: "Zorro909/weft-mods",
+        sourceCommit: "c".repeat(40),
+        weftTag: null,
+        abi: abi(a as string)!,
+        deps: deps as string[],
+        platforms: ["linux-x64"],
+        sha256: `${m.id}@${version}`,
+        size: 10,
+        url: "",
+        provenance: null,
+        buildRecord: "none",
+        reviewed: null,
+        trust: "reviewed",
+      })),
+    };
+  });
+  return {
+    mods,
+    revoked: c.revoked.map((sha256) => ({ sha256, reason: "broken" })),
+    index: { freshness: "fresh", generated: null, error: null, signedAt: null, cacheError: null },
+    sources: [],
+    weft: [],
+    platform: "linux-x64",
+    sourcesError: null,
+    revision: 0,
+  };
+}
+
+const build = (c: Catalog, sha: string) => {
+  const b = R.findBuild(c, sha);
+  if (!b) throw new Error(`no build ${sha}`);
+  return b;
+};
+const codeOf = (fn: () => unknown): string | null => {
+  try {
+    fn();
+    return null;
+  } catch (e) {
+    return (e as { code: string }).code;
+  }
+};
+
+describe("mock rules follow the backend's", () => {
+  it.each(rules.plans.cases)("plan: $what", (c) => {
+    const cat = catalog(rules.plans.catalog as "world");
+    const fit = "abi" in c && c.abi === null ? null : FIT;
+    const plan = R.planInstall(cat, (c.lock as EntrySpec[]).map(entry), "v1", c.target, fit, "running" in c && !!c.running);
+    expect(plan.install.map((i) => i.id)).toEqual(c.install);
+    expect(plan.enable).toEqual(c.enable);
+    expect(plan.missing).toEqual(c.missing);
+    expect(plan.problem?.code ?? null).toBe(c.problem);
+    expect(plan.turnsOn).toBe(c.turnsOn);
+    if ("replaces" in c) expect(plan.replaces).toMatchObject(c.replaces!);
+  });
+
+  it.each(rules.commits.cases)("commit: $what", (c) => {
+    const cat = catalog(rules.commits.catalog as "world");
+    const lock = (c.lock as EntrySpec[]).map(entry);
+    const res = R.resolve(cat, lock, c.wanted.map((s) => build(cat, s)), FIT);
+    const done = R.commit(lock, res, "");
+    expect(done.installed).toEqual(c.installed);
+    expect(done.alsoEnabled).toEqual(c.alsoEnabled);
+    expect(done.installedOff).toEqual(c.installedOff);
+    for (const [id, on] of Object.entries(c.after)) expect(lock.find((e) => e.id === id)?.enabled, id).toBe(on);
+  });
+
+  it.each(rules.toggles.cases)("toggle: $what", (c) => {
+    const cat = catalog(rules.toggles.catalog as "empty");
+    const lock = (c.lock as EntrySpec[]).map(entry);
+    const [action, id] = c.action;
+    let out: { alsoEnabled: string[]; alsoDisabled: string[] } | undefined;
+    const code = codeOf(() => {
+      out = action === "remove" ? { alsoEnabled: [], ...R.remove(lock, id) } : R.setEnabled(lock, cat, id, action === "on");
+    });
+    if ("error" in c) {
+      expect(code).toBe(c.error);
+      if (c.error === "ModRevoked") expect(lock.every((e) => !e.enabled), "nothing changes").toBe(true);
+      return;
+    }
+    expect(code).toBeNull();
+    expect([...out!.alsoEnabled].sort()).toEqual(c.alsoEnabled);
+    expect([...out!.alsoDisabled].sort()).toEqual(c.alsoDisabled);
+    for (const [k, on] of Object.entries(("after" in c && c.after) || {})) expect(lock.find((e) => e.id === k)?.enabled).toBe(on);
+  });
+
+  it("copy preview", () => {
+    const c = rules.copies;
+    const cat = catalog(c.catalog as "world");
+    const { preview, picks } = R.copyPreview(cat, ["v1", (c.from as EntrySpec[]).map(entry)], ["v2", c.to.map(entry)], FIT);
+    for (const [id, want] of Object.entries(c.outcomes)) {
+      const item = preview.items.find((i) => i.id === id);
+      expect(item ? [item.outcome, item.version] : null, id).toEqual(want);
+    }
+    expect(picks.map((p) => p.mod.id)).toEqual(c.picks);
+    expect(preview.items[0].trust).toBe("reviewed");
+  });
+
+  it("statuses, blocking and missing dependencies", () => {
+    const s = rules.statuses;
+    const cat = catalog(s.catalog as "statuses");
+    const lock = (s.lock as EntrySpec[]).map(entry);
+    for (const [a, id, want] of s.cases) {
+      const r = R.report("v1", lock, abi(a), null, cat, []);
+      expect(r.mods.find((m) => m.id === id)?.status, `${id} with ${a}`).toBe(want);
+    }
+    const r = R.report("v1", lock, rules.abi.ABI, null, cat, []);
+    expect(r.blocking).toEqual(s.blocking);
+    for (const [id, want] of Object.entries(s.missingDeps)) expect(r.mods.find((m) => m.id === id)?.missingDeps).toEqual(want);
+    for (const [id, want] of Object.entries(s.depsNotInstalled)) expect(r.mods.find((m) => m.id === id)?.depsNotInstalled).toEqual(want);
+    for (const [id, want] of Object.entries(s.revokedReason)) expect(r.mods.find((m) => m.id === id)?.revokedReason).toBe(want);
+  });
+
+  it.each(rules.updates.cases)("update: $what", (c) => {
+    const cat = catalog(rules.updates.catalog as "updates");
+    expect(R.updateFor(entry(c.entry as EntrySpec), FIT, cat)?.version ?? null).toBe(c.want);
+    expect(R.updateFor(entry(c.entry as EntrySpec), null, cat)).toBeNull();
+  });
+
+  it("remembers a revocation in the lock and keeps it", () => {
+    const cat = catalog("statuses");
+    const lock = [entry({ id: "pulled" }), entry({ id: "fine" })];
+    expect(R.applyRevocations(lock, cat, "2026-11-04T00:00:00Z")).toBe(true);
+    expect(lock[0]).toMatchObject({ enabled: false, revoked: { reason: "broken" } });
+    expect(lock[1].enabled).toBe(true);
+    expect(R.applyRevocations(lock, cat, "later")).toBe(false);
+    // The index is gone: the lock still says so.
+    const r = R.report("v1", lock, rules.abi.ABI, null, { ...cat, revoked: [] }, []);
+    expect(r.mods[0]).toMatchObject({ status: "revoked", revokedReason: "broken" });
+  });
+
+  it("cascades: a revoked dependency turned off blocks what needs it", () => {
+    const s = rules.cascades;
+    const cat = catalog(s.catalog as "statuses");
+    const lock = (s.lock as EntrySpec[]).map(entry);
+    expect(R.applyRevocations(lock, cat, "2026-11-04T00:00:00Z")).toBe(true);
+    expect(lock.filter((e) => !e.enabled).map((e) => e.id)).toEqual(s.turnedOff);
+    expect(R.applyRevocations(lock, cat, "later")).toBe(false);
+    const r = R.report("v1", lock, rules.abi.ABI, null, cat, []);
+    for (const [id, want] of Object.entries(s.statuses)) expect(r.mods.find((m) => m.id === id)?.status, id).toBe(want);
+    expect(r.blocking).toEqual(s.blocking);
+    expect(r.blockingReasons).toEqual(s.blockingReasons);
+    for (const [id, want] of Object.entries(s.missingDeps)) expect(r.mods.find((m) => m.id === id)?.missingDeps).toEqual(want);
+    for (const [id, want] of Object.entries(s.depsNotInstalled)) expect(r.mods.find((m) => m.id === id)?.depsNotInstalled).toEqual(want);
+    for (const [id, want] of Object.entries(s.revokedReason)) expect(r.mods.find((m) => m.id === id)?.revokedReason).toBe(want);
+  });
+
+  it("shadowing: a player-folder copy of a managed mod, and a revoked one blocks", () => {
+    const s = rules.shadowing;
+    const cat = catalog(s.catalog as "statuses");
+    const r = R.report("v1", (s.lock as EntrySpec[]).map(entry), rules.abi.ABI, null, cat, s.playerFolder);
+    expect(r.unmanaged).toEqual(s.unmanaged);
+    expect(r.shadowed).toEqual(s.shadowed);
+    expect(r.blocking).toEqual(s.blocking);
+    expect(r.blockingReasons).toEqual(s.blockingReasons);
+  });
+
+  it("revocations fail closed", () => {
+    const v = rules.revocations;
+    const { kept, dropped } = R.readRevocations(v.entries as R.RawRevocation[]);
+    expect(kept).toEqual(v.kept);
+    expect(dropped).toHaveLength(v.dropped);
+    const cat = { ...catalog("empty"), revoked: kept.map(({ sha256, reason }) => ({ sha256, reason })) };
+    for (const [sha, revoked] of v.matches) expect(R.revocation(cat, sha as string) !== null, String(sha)).toBe(revoked);
+  });
+
+  it("every blocking id has a reason", () => {
+    const s = rules.statuses;
+    const r = R.report("v1", (s.lock as EntrySpec[]).map(entry), rules.abi.ABI, null, catalog(s.catalog as "statuses"), []);
+    expect(Object.keys(r.blockingReasons).sort()).toEqual([...r.blocking].sort());
+    expect(r.blockingReasons).toEqual({ cogwork: "missingDeps", old: "wrongVersion" });
+  });
+});
+
+describe("plan tokens and fit (contract R4 §2, §5)", () => {
+  const cat = catalog("world");
+  it("the same plan gives the same token; a changed consent another", () => {
+    const lock = [entry({ id: "mid", deps: ["leaf"], enabled: false }), entry({ id: "leaf", enabled: false })];
+    const a = R.planInstall(cat, lock, "v1", "top@1.0.0", FIT, false);
+    const b = R.planInstall(cat, lock.map((e) => ({ ...e })), "v1", "top@1.0.0", FIT, false);
+    expect(a.planToken).toBe(b.planToken);
+    // Leaf is on now: one fewer mod turns on, so the player agreed to something else.
+    const c = R.planInstall(cat, [lock[0], { ...lock[1], enabled: true }], "v1", "top@1.0.0", FIT, false);
+    expect(c.planToken).not.toBe(a.planToken);
+    // A dependency's tier changes.
+    const swapped = { ...cat, mods: cat.mods.map((m) => (m.id === "leaf" ? { ...m, versions: m.versions.map((v) => ({ ...v, trust: "unreviewed" as Trust })) } : m)) };
+    const d = R.planInstall(swapped, [lock[0]], "v1", "top@1.0.0", FIT, false);
+    const e = R.planInstall(cat, [lock[0]], "v1", "top@1.0.0", FIT, false);
+    expect(d.planToken).not.toBe(e.planToken);
+  });
+
+  it("fitsVersion is unknown, never false, without the version's interface", () => {
+    expect(R.planInstall(cat, [], "v1", "cogwork@0.2.0", null, false).fitsVersion).toBeNull();
+    expect(R.planInstall(cat, [], "v1", "cogwork@0.2.0", FIT, false).fitsVersion).toBe(true);
+    expect(R.planInstall(cat, [], "v1", "cogwork@0.1.0", FIT, false).fitsVersion).toBe(false);
+  });
+
+  it("a copy preview carries a token", () => {
+    const { preview } = R.copyPreview(cat, ["v1", [entry({ id: "cogwork", deps: ["showcase"], abi: "OLD" })]], ["v2", []], FIT);
+    expect(preview.planToken).toMatch(/^plan-/);
+  });
+});
+
+describe("icon hosts (rules.json iconHosts, the backend's icon_url_allowed)", () => {
+  it("allows GitHub's hosts and nothing else", () => {
+    for (const [url, allowed] of rules.iconHosts.cases as [string, boolean][]) expect(iconUrlAllowed(url), url).toBe(allowed);
+  });
+});
+
+describe("build records (rules.json buildRecords, the backend's build_record)", () => {
+  it("is a record only when the signed index has all of it", () => {
+    for (const c of rules.buildRecords.cases as { what: string; fromIndex: boolean; provenance: R.RawProvenance | null; want: string }[]) {
+      expect(R.buildRecord(c.provenance, c.fromIndex), c.what).toBe(c.want);
+    }
+  });
+});
diff --git a/src/dev/mockRules.ts b/src/dev/mockRules.ts
new file mode 100644
index 0000000..d431c56
--- /dev/null
+++ b/src/dev/mockRules.ts
@@ -0,0 +1,674 @@
+// The mod-set rules of src-tauri/src/mods (plan/ and profile.rs), on plain data, for the mock
+// backend. Each function names the Rust function it follows; mockRules.test.ts runs the Rust table
+// tests' cases against them (src/dev/fixtures/rules.json), so a rule that drifts fails a test.
+//
+// Nothing here touches mock state: the backend in mockBackend.ts holds the locks and calls these.
+
+import { compareVersions } from "../mods/select";
+import type {
+  AppErrorPayload,
+  BuildRecord,
+  Catalog,
+  CatalogMod,
+  CatalogVersion,
+  Channel,
+  CopyItem,
+  CopyPreview,
+  InstallPlan,
+  InstalledMod,
+  ModStatus,
+  Origin,
+  PlanItem,
+  ProfileReport,
+  BlockingReason,
+  ShadowedMod,
+  UpdateView,
+} from "../mods/types";
+
+/** One lock entry: what `profiles/<tag>/mods.lock.json` holds per mod. */
+export type Entry = Omit<InstalledMod, "status" | "missingDeps" | "depsNotInstalled" | "revokedReason" | "update">;
+
+/** `profile::BUILTIN`: what every game has, never a dependency to install. */
+export const BUILTIN = ["base"];
+
+export interface Fit {
+  abi: string;
+  platform: string;
+}
+
+const RANK: Record<Channel, number> = { release: 0, prerelease: 1, experimental: 2 };
+
+const err = (code: AppErrorPayload["code"], detail: string | null = null): AppErrorPayload => ({ code, detail });
+
+/** `Origin::key`. A file from the player's computer has no catalogue key. */
+export function originKey(origin: Origin, id: string): string | null {
+  if (origin.kind === "index") return `index:${id}`;
+  if (origin.kind === "source") return `source:${origin.repo}:${id}`;
+  return null;
+}
+
+/** `Catalog::by_key`: keys hold a repo name, and repos compare without case. */
+export function byKey(catalog: Catalog, key: string): CatalogMod | undefined {
+  const k = key.toLowerCase();
+  return catalog.mods.find((m) => m.key.toLowerCase() === k);
+}
+
+export function findBuild(catalog: Catalog, sha256: string): { mod: CatalogMod; v: CatalogVersion } | undefined {
+  for (const mod of catalog.mods) {
+    const v = mod.versions.find((x) => x.sha256 === sha256);
+    if (v) return { mod, v };
+  }
+  return undefined;
+}
+
+/**
+ * The catalogue's revocation of a hash, compared without case (contract R4 §6). Revoked is the
+ * record, never whether it gave a reason: `reason` may be null.
+ */
+export function revocation(catalog: Catalog, sha256: string): { sha256: string; reason: string | null } | null {
+  const s = sha256.toLowerCase();
+  return catalog.revoked.find((r) => r.sha256.toLowerCase() === s) ?? null;
+}
+
+/** For an error's detail, the backend's own words. */
+const detailOf = (reason: string | null) => reason ?? "no reason given";
+
+/** One `revoked[]` entry as the index sends it: `at` and `reason` may be missing or null. */
+export interface RawRevocation {
+  sha256: unknown;
+  reason?: string | null;
+  at?: string | null;
+}
+
+/**
+ * `index::format` revocations, failing closed (contract R4 §6): hashes are lowercased, a missing
+ * or empty reason is none (the page says "No reason given" in the player's language), a missing
+ * time unknown, and an entry is dropped only when its hash can't be a SHA-256 at all; `dropped`
+ * lists those, for the log.
+ */
+export function readRevocations(entries: RawRevocation[]): { kept: { sha256: string; reason: string | null; at: string | null }[]; dropped: unknown[] } {
+  const kept: { sha256: string; reason: string | null; at: string | null }[] = [];
+  const dropped: unknown[] = [];
+  for (const e of entries) {
+    const sha = typeof e.sha256 === "string" ? e.sha256.trim().toLowerCase() : "";
+    if (!/^[0-9a-f]{64}$/.test(sha)) {
+      dropped.push(e.sha256);
+      continue;
+    }
+    const reason = typeof e.reason === "string" && e.reason.trim() ? e.reason.trim() : null;
+    kept.push({ sha256: sha, reason, at: typeof e.at === "string" ? e.at : null });
+  }
+  return { kept, dropped };
+}
+
+/** Revoked in the catalogue, or remembered in the lock (contract R3 §2), and why if it said. */
+export function entryRevocation(catalog: Catalog, e: Entry): { reason: string | null } | null {
+  if (e.revoked) return { reason: e.revoked.reason };
+  const r = revocation(catalog, e.sha256);
+  return r ? { reason: r.reason } : null;
+}
+
+const accepts = (fit: Fit, v: CatalogVersion) => v.abi === fit.abi && (v.platforms as string[]).includes(fit.platform);
+
+/** `profile::fitting`: builds of `key` that fit, no less stable than `atMost`, revoked ones included. */
+export function fitting(catalog: Catalog, key: string, fit: Fit, atMost: Channel): { mod: CatalogMod; versions: CatalogVersion[] } | null {
+  const mod = byKey(catalog, key);
+  if (!mod) return null;
+  return { mod, versions: mod.versions.filter((v) => accepts(fit, v) && RANK[v.channel] <= RANK[atMost]) };
+}
+
+/** `profile::best_version`: the newest fitting build that isn't revoked. */
+export function bestVersion(catalog: Catalog, key: string, fit: Fit, atMost: Channel): { mod: CatalogMod; v: CatalogVersion } | null {
+  const f = fitting(catalog, key, fit, atMost);
+  if (!f) return null;
+  const best = f.versions
+    .filter((v) => revocation(catalog, v.sha256) === null)
+    .reduce<CatalogVersion | null>((a, b) => {
+      if (!a) return b;
+      const d = compareVersions(b.version, a.version) || RANK[a.channel] - RANK[b.channel];
+      return d > 0 ? b : a;
+    }, null);
+  return best ? { mod: f.mod, v: best } : null;
+}
+
+/** `profile::update_for`. */
+export function updateFor(e: Entry, fit: Fit | null, catalog: Catalog): UpdateView | null {
+  if (!fit) return null;
+  const key = originKey(e.origin, e.id);
+  if (!key) return null;
+  const best = bestVersion(catalog, key, fit, e.channel ?? "release");
+  if (!best) return null;
+  const fitsNow = e.abi === fit.abi;
+  const newer = e.version === null || compareVersions(best.v.version, e.version) > 0;
+  if (best.v.sha256 === e.sha256 || (fitsNow && !newer)) return null;
+  return { version: best.v.version, sha256: best.v.sha256, channel: best.v.channel, trust: best.v.trust };
+}
+
+/** A file in the player's own mods folder, and the mod id it says it is, when it says. */
+export interface PlayerFile {
+  file: string;
+  id: string | null;
+}
+
+/**
+ * `profile::report`. The engine loads the first copy of an id it finds, the launcher's folder
+ * first: a file in the player's folder with a managed id wins whenever the managed copy is off or
+ * revoked (contract R4 §4). A revoked one that is shadowed blocks Play.
+ */
+export function report(
+  tag: string,
+  lock: Entry[],
+  versionAbi: string | null,
+  abiError: AppErrorPayload | null,
+  catalog: Catalog,
+  playerFolder: PlayerFile[]
+): ProfileReport {
+  const enabled = new Set(lock.filter((m) => m.enabled).map((m) => m.id));
+  const installed = new Set(lock.map((m) => m.id));
+  const fit = versionAbi === null ? null : { abi: versionAbi, platform: catalog.platform };
+  const blocking: string[] = [];
+  const blockingReasons: Record<string, BlockingReason> = {};
+  const shadowed: ShadowedMod[] = [];
+  const mods: InstalledMod[] = lock.map((e) => {
+    const revoked = entryRevocation(catalog, e);
+    const revokedReason = revoked?.reason ?? null;
+    const missingDeps = e.deps.filter((d) => !BUILTIN.includes(d) && !enabled.has(d));
+    const status: ModStatus =
+      revoked !== null
+        ? "revoked"
+        : !e.enabled
+          ? "off"
+          : e.abi !== null && versionAbi !== null && e.abi !== versionAbi
+            ? "wrongVersion"
+            : missingDeps.length
+              ? "missingDeps"
+              : e.abi === null || versionAbi === null
+                ? "unchecked"
+                : "ready";
+    const shadow = playerFolder.find((f) => f.id === e.id);
+    if (shadow) shadowed.push({ id: e.id, file: shadow.file, managed: status === "revoked" ? "revoked" : e.enabled ? "on" : "off" });
+    if (status === "wrongVersion" || status === "missingDeps") {
+      blocking.push(e.id);
+      blockingReasons[e.id] = status;
+    } else if (status === "revoked" && shadow) {
+      blocking.push(e.id);
+      blockingReasons[e.id] = "shadowedRevoked";
+    }
+    return {
+      ...e,
+      status,
+      missingDeps,
+      depsNotInstalled: missingDeps.filter((d) => !installed.has(d)),
+      revokedReason,
+      update: updateFor(e, fit, catalog),
+    };
+  });
+  return { tag, versionAbi, abiError, mods, blocking, blockingReasons, unmanaged: playerFolder.map((f) => f.file), shadowed, revocationsPending: [] };
+}
+
+/** `profile::apply_revocations`, remembering each in the lock. Returns whether anything changed. */
+export function applyRevocations(lock: Entry[], catalog: Catalog, at: string): boolean {
+  let changed = false;
+  for (const e of lock) {
+    const r = revocation(catalog, e.sha256);
+    if (r === null) continue;
+    if (e.enabled || !e.revoked) changed = true;
+    e.enabled = false;
+    e.revoked ??= { reason: r.reason, at };
+  }
+  return changed;
+}
+
+/** `Lock::deps_of`: installed mods `id` needs, directly or through others. */
+export function depsOf(lock: Entry[], id: string): string[] {
+  const out: string[] = [];
+  const todo = [id];
+  while (todo.length) {
+    const next = todo.pop();
+    const e = lock.find((m) => m.id === next);
+    if (!e) continue;
+    for (const d of e.deps) {
+      if (!out.includes(d) && d !== id && lock.some((m) => m.id === d)) {
+        out.push(d);
+        todo.push(d);
+      }
+    }
+  }
+  return out;
+}
+
+/** `Lock::dependents_of`: turned-on mods that need `id`, directly or through others. */
+export function dependentsOf(lock: Entry[], id: string): string[] {
+  const out: string[] = [];
+  const todo = [id];
+  while (todo.length) {
+    const next = todo.pop()!;
+    for (const m of lock.filter((x) => x.enabled)) {
+      if (m.deps.includes(next) && !out.includes(m.id) && m.id !== id) {
+        out.push(m.id);
+        todo.push(m.id);
+      }
+    }
+  }
+  return out;
+}
+
+/** `LockEntry::from_catalog`. */
+export function entryFrom(mod: CatalogMod, v: CatalogVersion, enabled: boolean, installedAt: string): Entry {
+  return {
+    id: mod.id,
+    name: mod.name,
+    summary: mod.summary,
+    version: v.version,
+    channel: v.channel,
+    sha256: v.sha256,
+    size: v.size,
+    enabled,
+    trust: v.trust,
+    origin: mod.origin,
+    abi: v.abi,
+    weftTag: v.weftTag,
+    deps: v.deps,
+    tag: v.tag,
+    sourceRepo: v.sourceRepo,
+    sourceCommit: v.sourceCommit,
+    icon: mod.icon,
+    installedAt,
+    revoked: null,
+  };
+}
+
+/** `Lock::put`: adds the entry, or replaces the mod with the same id; kept in id order. */
+export function put(lock: Entry[], entry: Entry) {
+  const at = lock.findIndex((e) => e.id === entry.id);
+  if (at >= 0) lock[at] = entry;
+  else {
+    lock.push(entry);
+    lock.sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+  }
+}
+
+export interface Resolution {
+  wanted: string[];
+  picks: { mod: CatalogMod; v: CatalogVersion }[];
+  /** Installed, usable mods the wanted ones need, directly or through others, with what each needs. */
+  installed: Record<string, string[]>;
+  /** The part of `installed` that is off now. */
+  enable: string[];
+  missing: string[];
+}
+
+type Node = { kind: "pick"; mod: CatalogMod; v: CatalogVersion } | { kind: "have"; entry: Entry };
+
+/**
+ * `plan::resolve` (contract R4 §1): the wanted builds and everything they need, walking the whole
+ * graph: through picked builds and through installed mods alike. An installed dependency counts
+ * when it fits and isn't revoked; otherwise a catalogue build replaces it, or it is missing.
+ */
+export function resolve(catalog: Catalog, lock: Entry[], wanted: { mod: CatalogMod; v: CatalogVersion }[], fit: Fit): Resolution {
+  const res: Resolution = { wanted: wanted.map((w) => w.mod.id), picks: [], installed: {}, enable: [], missing: [] };
+  const todo: Node[] = wanted.map((w) => ({ kind: "pick", ...w }));
+  const seen = (id: string) =>
+    res.picks.some((p) => p.mod.id === id) ||
+    id in res.installed ||
+    res.missing.includes(id) ||
+    todo.some((n) => (n.kind === "pick" ? n.mod.id : n.entry.id) === id);
+  while (todo.length) {
+    const node = todo.shift()!;
+    const deps = node.kind === "pick" ? node.v.deps : node.entry.deps;
+    const origin = node.kind === "pick" ? node.mod.origin : node.entry.origin;
+    const channel = (node.kind === "pick" ? node.v.channel : node.entry.channel) ?? "release";
+    if (node.kind === "pick") {
+      if (res.picks.some((p) => p.mod.id === node.mod.id)) continue;
+      res.picks.push({ mod: node.mod, v: node.v });
+    } else {
+      res.installed[node.entry.id] = node.entry.deps.filter((d) => !BUILTIN.includes(d));
+      if (!node.entry.enabled) res.enable.push(node.entry.id);
+    }
+    for (const dep of deps) {
+      if (BUILTIN.includes(dep) || seen(dep)) continue;
+      const have = lock.find((e) => e.id === dep);
+      if (have && (have.abi === null || have.abi === fit.abi) && entryRevocation(catalog, have) === null) {
+        todo.push({ kind: "have", entry: have });
+        continue;
+      }
+      const keys = [`index:${dep}`];
+      if (origin.kind === "source") keys.push(`source:${origin.repo}:${dep}`);
+      const found = keys.map((k) => bestVersion(catalog, k, fit, channel)).find((x) => x !== null);
+      if (found) todo.push({ kind: "pick", ...found });
+      else res.missing.push(dep);
+    }
+  }
+  return res;
+}
+
+/** What `id` needs within this resolution: a picked build's dependencies, or an installed mod's. */
+function depsIn(res: Resolution, id: string): string[] {
+  const pick = res.picks.find((p) => p.mod.id === id);
+  if (pick) return pick.v.deps;
+  return res.installed[id] ?? [];
+}
+
+/** `Resolution::needs_missing`: whether `id`, through picked and installed mods, needs something missing. */
+export function needsMissing(res: Resolution, id: string): boolean {
+  const seen = new Set<string>();
+  const todo = [id];
+  while (todo.length) {
+    const next = todo.pop()!;
+    if (seen.has(next)) continue;
+    seen.add(next);
+    for (const dep of depsIn(res, next)) {
+      if (res.missing.includes(dep)) return true;
+      todo.push(dep);
+    }
+  }
+  return false;
+}
+
+export interface Outcome {
+  /** Wanted mods that end up on, and the picked or installed mods they need. */
+  on: Set<string>;
+  /** Installed, off mods that will be turned on. */
+  enable: string[];
+  /** Wanted mods installed turned off because something they need is missing. */
+  installedOff: string[];
+}
+
+/**
+ * `plan::outcome` (contracts R3 §1, R4 §1): a wanted mod is on afterwards when it was on (or is
+ * new) and nothing it needs, at any depth, is missing; everything it needs is on with it.
+ */
+export function outcome(lock: Entry[], res: Resolution): Outcome {
+  const installedOff: string[] = [];
+  const todo: string[] = [];
+  for (const id of res.wanted) {
+    if (needsMissing(res, id)) installedOff.push(id);
+    else if (lock.find((e) => e.id === id)?.enabled ?? true) todo.push(id);
+  }
+  const on = new Set<string>();
+  while (todo.length) {
+    const id = todo.pop()!;
+    if (on.has(id)) continue;
+    on.add(id);
+    for (const dep of depsIn(res, id)) {
+      if (res.picks.some((p) => p.mod.id === dep) || dep in res.installed) todo.push(dep);
+    }
+  }
+  return { on, enable: res.enable.filter((id) => on.has(id)), installedOff };
+}
+
+/** `InstallPlan.turnsOn` for a wanted mod. */
+export function turnsOn(lock: Entry[], res: Resolution, id: string): boolean {
+  return outcome(lock, res).on.has(id);
+}
+
+export interface Committed {
+  installed: string[];
+  alsoEnabled: string[];
+  installedOff: string[];
+}
+
+/** `plan::commit`: writes a resolution into the lock, following `outcome`. */
+export function commit(lock: Entry[], res: Resolution, at: string): Committed {
+  const out = outcome(lock, res);
+  const installed: string[] = [];
+  for (const { mod, v } of res.picks) {
+    const wasOn = lock.find((e) => e.id === mod.id)?.enabled ?? false;
+    const enabled = out.on.has(mod.id) || (!res.wanted.includes(mod.id) && wasOn);
+    put(lock, entryFrom(mod, v, enabled, at));
+    installed.push(mod.id);
+  }
+  const alsoEnabled: string[] = [];
+  for (const id of out.enable) {
+    const e = lock.find((x) => x.id === id);
+    if (e && !e.enabled) {
+      e.enabled = true;
+      alsoEnabled.push(id);
+    }
+  }
+  return { installed, alsoEnabled, installedOff: out.installedOff };
+}
+
+const planItem = (mod: CatalogMod, v: CatalogVersion): PlanItem => ({
+  id: mod.id,
+  name: mod.name,
+  version: v.version,
+  sha256: v.sha256,
+  trust: v.trust,
+  channel: v.channel,
+  size: v.size,
+});
+
+/** FNV-1a over a string, as hex: stable, and enough to tell two plans apart in the mock. */
+export function fnv(text: string, rounds = 2): string {
+  let out = "";
+  for (let round = 0; round < rounds; round++) {
+    let h = 2166136261 ^ round;
+    for (let i = 0; i < text.length; i++) h = Math.imul(h ^ text.charCodeAt(i), 16777619);
+    out += (h >>> 0).toString(16).padStart(8, "0");
+  }
+  return out;
+}
+
+/** What the player consents to (contract R4 §2). */
+export interface Consent {
+  builds: { sha256: string; trust: string }[];
+  on: string[];
+  turnsOn: boolean;
+  installedOff: string[];
+  abi: string | null;
+}
+
+/**
+ * `plan::plan_token`: an opaque digest of a consent. The same consent gives the same token,
+ * whatever order its lists come in; any change to it gives another.
+ */
+export function planToken(c: Consent): string {
+  const canonical = JSON.stringify({
+    builds: c.builds.map((b) => `${b.sha256.toLowerCase()}:${b.trust}`).sort(),
+    on: [...c.on].sort(),
+    turnsOn: c.turnsOn,
+    installedOff: [...c.installedOff].sort(),
+    abi: c.abi,
+  });
+  return `plan-${fnv(canonical)}`;
+}
+
+/** The consent of a resolution: what it installs, and every mod it turns on (installed or new). */
+export function consentOf(lock: Entry[], res: Resolution, abi: string | null, turnsOn: boolean): Consent {
+  const out = outcome(lock, res);
+  return {
+    builds: res.picks.map((p) => ({ sha256: p.v.sha256, trust: p.v.trust })),
+    on: [...out.enable, ...res.picks.map((p) => p.mod.id).filter((id) => out.on.has(id))],
+    turnsOn,
+    installedOff: out.installedOff,
+    abi,
+  };
+}
+
+/** `plan::check_installable`. */
+export function checkInstallable(catalog: Catalog, mod: CatalogMod, v: CatalogVersion, fit: Fit): AppErrorPayload | null {
+  if (BUILTIN.includes(mod.id)) return err("ModIdReserved", mod.id);
+  const r = revocation(catalog, v.sha256);
+  if (r !== null) return err("ModRevoked", `${mod.name}: ${detailOf(r.reason)}`);
+  if (!(v.platforms as string[]).includes(fit.platform)) return err("ModNotForPlatform", mod.name);
+  if (v.abi !== fit.abi) return err("ModIncompatible", mod.name);
+  return null;
+}
+
+/** `plan::plan_install`. Throws `ModNotInCatalog` for a hash the catalogue doesn't have. */
+export function planInstall(catalog: Catalog, lock: Entry[], tag: string, sha256: string, fit: Fit | null, running: boolean): InstallPlan {
+  const found = findBuild(catalog, sha256);
+  if (!found) throw err("ModNotInCatalog", sha256);
+  const { mod, v } = found;
+  const existing = lock.find((e) => e.id === mod.id);
+  const plan: InstallPlan = {
+    target: planItem(mod, v),
+    replaces: existing ? { version: existing.version, sha256: existing.sha256, trust: existing.trust, enabled: existing.enabled } : null,
+    install: [],
+    enable: [],
+    missing: [],
+    problem: null,
+    turnsOn: false,
+    fitsVersion: null,
+    planToken: "",
+  };
+  if (!fit) {
+    // Contract R4 §5: unknown, not "no".
+    plan.problem = err("AbiUnavailable", tag);
+    plan.planToken = planToken({ builds: [{ sha256: v.sha256, trust: v.trust }], on: [], turnsOn: false, installedOff: [], abi: null });
+    return plan;
+  }
+  const res = resolve(catalog, lock, [{ mod, v }], fit);
+  const out = outcome(lock, res);
+  plan.turnsOn = out.on.has(mod.id);
+  plan.install = res.picks.filter((p) => p.mod.id !== mod.id).map((p) => planItem(p.mod, p.v));
+  plan.enable = out.enable;
+  plan.missing = res.missing;
+  plan.fitsVersion = v.abi === fit.abi;
+  plan.problem = checkInstallable(catalog, mod, v, fit) ?? (running ? err("GameRunning", tag) : null);
+  plan.planToken = planToken(consentOf(lock, res, fit.abi, plan.turnsOn));
+  return plan;
+}
+
+/** `plan::set_enabled`. Returns what else changed; throws `ModRevoked` or `ModNotInstalled`. */
+export function setEnabled(lock: Entry[], catalog: Catalog, id: string, enabled: boolean): { alsoEnabled: string[]; alsoDisabled: string[] } {
+  const entry = lock.find((e) => e.id === id);
+  if (!entry) throw err("ModNotInstalled", id);
+  const revoked = (e: Entry) => {
+    const r = entryRevocation(catalog, e);
+    return r === null ? null : err("ModRevoked", `${e.name}: ${detailOf(r.reason)}`);
+  };
+  const alsoEnabled: string[] = [];
+  const alsoDisabled: string[] = [];
+  if (enabled) {
+    const own = revoked(entry);
+    if (own) throw own;
+    const deps = depsOf(lock, id);
+    for (const d of deps) {
+      const e = lock.find((x) => x.id === d);
+      const r = e && revoked(e);
+      if (r) throw r;
+    }
+    for (const d of deps) {
+      const e = lock.find((x) => x.id === d)!;
+      if (!e.enabled) {
+        e.enabled = true;
+        alsoEnabled.push(d);
+      }
+    }
+  } else {
+    for (const d of dependentsOf(lock, id)) {
+      lock.find((x) => x.id === d)!.enabled = false;
+      alsoDisabled.push(d);
+    }
+  }
+  entry.enabled = enabled;
+  return { alsoEnabled, alsoDisabled };
+}
+
+/** `plan::remove`: removes a mod and turns off what needed it. Returns those and the removed entry. */
+export function remove(lock: Entry[], id: string): { alsoDisabled: string[]; removed: Entry } {
+  const at = lock.findIndex((e) => e.id === id);
+  if (at < 0) throw err("ModNotInstalled", id);
+  const alsoDisabled = dependentsOf(lock, id);
+  for (const d of alsoDisabled) lock.find((x) => x.id === d)!.enabled = false;
+  const [removed] = lock.splice(at, 1);
+  return { alsoDisabled, removed };
+}
+
+/** `plan::copy_preview`: what copying the turned-on mods of `from` into `to` brings, and the builds. */
+export function copyPreview(
+  catalog: Catalog,
+  from: [string, Entry[]],
+  to: [string, Entry[]],
+  fit: Fit
+): { preview: CopyPreview; picks: { mod: CatalogMod; v: CatalogVersion }[]; res: Resolution } {
+  const items: CopyItem[] = [];
+  const picks: { mod: CatalogMod; v: CatalogVersion }[] = [];
+  for (const e of from[1].filter((m) => m.enabled)) {
+    const item = (outcome: CopyItem["outcome"], v: CatalogVersion | null = null): CopyItem => ({
+      id: e.id,
+      name: e.name,
+      outcome,
+      version: v?.version ?? null,
+      trust: v?.trust ?? null,
+      sha256: v?.sha256 ?? null,
+    });
+    if (to[1].some((x) => x.id === e.id)) {
+      items.push(item("alreadyThere"));
+      continue;
+    }
+    const key = originKey(e.origin, e.id);
+    if (!key) {
+      items.push(item("localFile"));
+      continue;
+    }
+    const channel = e.channel ?? "release";
+    const best = bestVersion(catalog, key, fit, channel);
+    if (best) {
+      items.push(item("install", best.v));
+      picks.push(best);
+    } else if ((fitting(catalog, key, fit, channel)?.versions.length ?? 0) > 0) {
+      items.push(item("revoked"));
+    } else {
+      items.push(item("noBuild"));
+    }
+  }
+  const res = resolve(catalog, to[1], picks, fit);
+  const out = outcome(to[1], res);
+  const deps = res.picks.filter((p) => !res.wanted.includes(p.mod.id)).map((p) => planItem(p.mod, p.v));
+  return {
+    preview: {
+      from: from[0],
+      to: to[0],
+      items,
+      deps,
+      enable: out.enable,
+      installedOff: out.installedOff,
+      missing: res.missing,
+      planToken: planToken(consentOf(to[1], res, fit.abi, out.installedOff.length === 0)),
+    },
+    picks,
+    res,
+  };
+}
+
+// ---------------------------------------------------------------------------------------------
+// Build records: catalog.rs `build_record` and index::Provenance::is_complete
+
+/** A provenance object as the index (or a source's `<id>.mod.json`) writes it. */
+export interface RawProvenance {
+  kind: string;
+  repo?: string | null;
+  workflow?: string | null;
+  ref?: string | null;
+  verified_at?: string | null;
+}
+
+/** index::is_repo: `owner/name`, each 1–100 of `A–Z a–z 0–9 . - _`, neither `.` nor `..`. */
+function isRepo(s: string): boolean {
+  const halves = s.split("/");
+  const part = (p: string) => p.length > 0 && p.length <= 100 && p !== "." && p !== ".." && /^[A-Za-z0-9._-]+$/.test(p);
+  return halves.length === 2 && part(halves[0]) && part(halves[1]);
+}
+
+/** index::is_workflow_path: `.github/workflows/<name>.yml` or `.yaml`, nothing above it. */
+function isWorkflowPath(s: string): boolean {
+  if (!s.startsWith(".github/workflows/")) return false;
+  const name = s.slice(".github/workflows/".length);
+  return /\.ya?ml$/.test(name) && name.length > 4 && !name.startsWith(".") && /^[A-Za-z0-9._-]+$/.test(name);
+}
+
+/** index::is_rfc3339, for the forms an index writes. */
+function isRfc3339(s: string): boolean {
+  return /^\d{4}-\d{2}-\d{2}[Tt ]\d{2}:\d{2}:\d{2}(\.\d+)?([Zz]|[+-]\d{2}:\d{2})$/.test(s) && !Number.isNaN(Date.parse(s));
+}
+
+/** catalog::build_record: a record only when the signed index has all of it. */
+export function buildRecord(p: RawProvenance | null, fromIndex: boolean): BuildRecord {
+  if (!p) return "none";
+  if (!fromIndex) return "claimed";
+  const whole = p.kind === "github-attestation" && !!p.repo && isRepo(p.repo) && !!p.workflow && isWorkflowPath(p.workflow) && !!p.verified_at && isRfc3339(p.verified_at);
+  return whole ? "recorded" : "incomplete";
+}
diff --git a/src/dev/scenarios.test.ts b/src/dev/scenarios.test.ts
new file mode 100644
index 0000000..1a94c99
--- /dev/null
+++ b/src/dev/scenarios.test.ts
@@ -0,0 +1,22 @@
+import { describe, expect, it } from "vitest";
+import { FLAGS, SCENARIOS } from "./scenarios";
+import reference from "../../docs/dev-mock.md?raw";
+
+// docs/dev-mock.md is written from SCENARIOS and FLAGS; this keeps the two together.
+describe("mock scenarios", () => {
+  it("are each listed in docs/dev-mock.md", () => {
+    for (const s of SCENARIOS) expect(reference, s.name).toContain(`\`${s.name}\``);
+  });
+
+  it("have every flag listed in docs/dev-mock.md with its values", () => {
+    for (const f of FLAGS) {
+      expect(reference, f.name).toContain(`\`${f.name}\``);
+      for (const v of f.values) expect(reference, `${f.name}=${v}`).toContain(v);
+    }
+  });
+
+  it("only set flags that exist", () => {
+    const names = new Set(FLAGS.map((f) => f.name));
+    for (const s of SCENARIOS) for (const k of Object.keys(s.flags)) expect(names.has(k), `${s.name}: ${k}`).toBe(true);
+  });
+});
diff --git a/src/dev/scenarios.ts b/src/dev/scenarios.ts
new file mode 100644
index 0000000..4ce44ad
--- /dev/null
+++ b/src/dev/scenarios.ts
@@ -0,0 +1,134 @@
+// The mock backend's scenarios and URL flags, in one table: docs/dev-mock.md lists them and the tests
+// check that list. Kept apart from mockBackend.ts so reading them pulls in nothing from Tauri.
+
+export interface Scenario {
+  name: string;
+  description: string;
+  /** Flags this scenario sets; flags in the URL win. */
+  flags: Record<string, string>;
+}
+
+export const SCENARIOS: Scenario[] = [
+  {
+    name: "mods",
+    description:
+      "The default. A mod built for another version (with a fitting update), an update, a prerelease that is off, a source, a local file and a file in the player's own folder.",
+    flags: {},
+  },
+  { name: "empty", description: "The newest version has no mods; the older one has mods to copy.", flags: {} },
+  { name: "fresh", description: "No game version installed.", flags: {} },
+  { name: "offline", description: "No network: the cached index and a source's cached mods.", flags: { index: "cached", source: "offline" } },
+  {
+    name: "crash",
+    description: "Nothing blocks Play; the game then stops while loading Structures, which has an update.",
+    flags: { crash: "loadFailed" },
+  },
+  { name: "knownfile", description: "From file picks a zip that is a catalogued build (Cogwork 0.2.0).", flags: { file: "known" } },
+  { name: "revoked", description: "The installed Cogwork build has been pulled from the index.", flags: { revoked: "cogwork" } },
+  { name: "ratelimited", description: "GitHub rate-limits the source; its last mods are shown.", flags: { source: "ratelimited" } },
+  { name: "indexdown", description: "There is no index to fetch (the server answers 404) and none saved, so there are no Reviewed mods.", flags: { index: "unavailable" } },
+  { name: "stale", description: "The index verifies, but its signature is over 30 days old.", flags: { index: "stale" } },
+  { name: "invalid", description: "The new index's signature doesn't verify; the last good one is shown.", flags: { index: "invalid" } },
+  { name: "rollback", description: "The new index is older than one already accepted, so it is refused; the last good one is shown.", flags: { index: "rollback" } },
+  {
+    name: "missingdep",
+    description:
+      "Mods that need others: Hearth needs Cogwork, which is off; Lanterns needs Glowmoss, which isn't installed; Railways needs Signals, which has no build yet.",
+    flags: {},
+  },
+  {
+    name: "lateblock",
+    description: "Nothing blocks Play until Play itself finds Cogwork revoked; Hearth, which needs it, then blocks the start.",
+    flags: { prelaunch: "revoke" },
+  },
+  { name: "long", description: "Very long mod names, ids and repos, for overflow checks.", flags: { long: "1" } },
+  {
+    name: "shadowed",
+    description:
+      "Cogwork is revoked, and the player's own mods folder has a copy of it, which would load in its place: Play is blocked until that file goes.",
+    flags: { revoked: "cogwork", shadow: "cogwork" },
+  },
+  {
+    name: "slowrefresh",
+    description:
+      "A refresh whose index is in at once and pulls Cogwork, while the source lantern-dev/lanterns takes three seconds: Cogwork shows revoked before the source answers.",
+    flags: { slowsource: "lantern-dev/lanterns", refreshrevokes: "cogwork" },
+  },
+  {
+    name: "chain",
+    description:
+      "Mods that need mods that need others: Chimneys needs Hearth, which needs Cogwork, both installed and off; Junctions needs Railways, which needs Signals, which has no build.",
+    flags: { chain: "1" },
+  },
+];
+
+export interface Flag {
+  name: string;
+  values: string[];
+  description: string;
+}
+
+export const FLAGS: Flag[] = [
+  {
+    name: "index",
+    values: ["fresh", "stale", "cached", "unavailable", "unreachable", "invalid", "rollback", "unsaved"],
+    description:
+      "State of the signed mod index; `unavailable` is none saved and the server answers 404 (`HttpStatus`), `unreachable` none saved and no network to it; `unsaved` is fresh but couldn't be saved to disk (`cacheError`).",
+  },
+  { name: "source", values: ["ok", "notfound", "ratelimited", "offline"], description: "State of the added GitHub source." },
+  {
+    name: "nomods",
+    values: ["noReleases", "noModFiles", "unreadable", "noDigest", "disagrees", "invalid"],
+    description: "GitHub answers for the added source, but it has no usable mods, for this reason.",
+  },
+  {
+    name: "race",
+    values: ["stale", "error"],
+    description: "The first catalogue refresh is slow and answers last: with an older catalogue (`stale`) or an error (`error`). The page keeps the newer answer.",
+  },
+  {
+    name: "slowsource",
+    values: ["<repo>"],
+    description:
+      "That source takes three seconds to answer, in a refresh of its own or a whole one; in a whole one the index is shown (`mod-catalog`) as soon as it is in, without waiting for it.",
+  },
+  { name: "refreshrevokes", values: ["<mod id>"], description: "The index a refresh brings revokes the installed builds of that mod, once." },
+  { name: "revoked", values: ["<mod id>"], description: "Revokes the installed builds of that mod." },
+  { name: "abi", values: ["error"], description: "The game version's mod interface can't be found out." },
+  {
+    name: "fail",
+    values: ["install", "network", "toolarge", "dep", "meanwhile", "catalog", "sources"],
+    description:
+      "Comma-separated. Installs fail at the hash check, mid-download, before it, or while downloading a dependency; `meanwhile` publishes a newer Glowmoss after the first plan, so a plan with Glowmoss in it is refused as changed and planned again; the catalogue fails to load; `sources` finds the list of sources damaged (kept aside, `ModSourcesDamaged`).",
+  },
+  {
+    name: "file",
+    values: ["unverified", "known", "notamod", "revoked", "revokedlate", "wrongplatform"],
+    description: "What From file picks; `revokedlate` is revoked by the index while it is being installed.",
+  },
+  { name: "shadow", values: ["<mod id>"], description: "The player's own mods folder has a copy of that mod, which loads when the launcher's is off or revoked. Showing the folder only opens it; tests stand in for the player deleting the file with `window.mockPlayer.deleteFile(name)`." },
+  {
+    name: "revocations",
+    values: ["messy"],
+    description: "Revocations come with uppercase hashes, no reason or time, and one entry that isn't a hash: they still revoke, and only that one is dropped.",
+  },
+  { name: "chain", values: ["1"], description: "Adds Chimneys and Junctions, which need mods that need others." },
+  {
+    name: "crash",
+    values: ["wrongVersion", "loadFailed", "notAMod", "wrongName", "missingDep", "initPanicked", "exit"],
+    description: "Play starts the game and it stops with this failure; `exit` is a crash that names no mod.",
+  },
+  {
+    name: "prelaunch",
+    values: ["revoke", "storemissing"],
+    description: "Play finds Cogwork revoked, as a fresh index would, before it starts the game; or finds the store's copy of Structures gone (`ModStoreMissing`) until it is installed again.",
+  },
+  { name: "long", values: ["1"], description: "Adds very long names, ids and repos." },
+  { name: "slow", values: ["1"], description: "Everything takes four times as long: time enough to press Cancel." },
+  { name: "fast", values: ["1"], description: "Everything takes a quarter as long, for screenshots of results." },
+  {
+    name: "profile",
+    values: ["fail", "failafterplay"],
+    description: "Reading a version's set fails (`Io`): always, or only the first read after Play is refused, so Retry gets through.",
+  },
+];
diff --git a/src/fonts/weft.woff2 b/src/fonts/weft.woff2
index e5d232f..693c02b 100644
Binary files a/src/fonts/weft.woff2 and b/src/fonts/weft.woff2 differ
diff --git a/src/hooks/result.ts b/src/hooks/result.ts
new file mode 100644
index 0000000..93e546c
--- /dev/null
+++ b/src/hooks/result.ts
@@ -0,0 +1,24 @@
+import type { UiError } from "../mods/types";
+import { asAppError } from "../mods/api";
+import { showError, type Shown } from "../i18n/errors";
+
+/**
+ * How an action ended. "skipped": the same action was already running, so nothing was sent.
+ * "cancelled": the player stopped it (contract R4 §3); nothing changed, and that isn't a failure.
+ */
+export type ActionResult<R = void> =
+  | { status: "done"; result: R }
+  | { status: "failed"; error: UiError; shown: Shown }
+  | { status: "cancelled" }
+  | { status: "skipped" };
+
+export function failed(err: unknown): ActionResult<never> {
+  const error = asAppError(err);
+  if (error.code === "ModCancelled") return { status: "cancelled" };
+  return { status: "failed", error, shown: showError(err) };
+}
+
+/** What to show for a result, or null when there is nothing to say. */
+export function errorOf(result: ActionResult<unknown>): Shown | null {
+  return result.status === "failed" ? result.shown : null;
+}
diff --git a/src/hooks/useCatalog.ts b/src/hooks/useCatalog.ts
new file mode 100644
index 0000000..520eb98
--- /dev/null
+++ b/src/hooks/useCatalog.ts
@@ -0,0 +1,188 @@
+import { useCallback, useEffect, useRef, useState } from "react";
+import { asAppError, listenTo, modsApi } from "../mods/api";
+import { EVENTS } from "../mods/ipc";
+import type { Catalog, UiError } from "../mods/types";
+import { failed, type ActionResult } from "./result";
+
+export interface CatalogState {
+  catalog: Catalog | null;
+  /** The newest refresh is still running. */
+  catalogLoading: boolean;
+  /** Why the newest finished refresh failed; kept until one succeeds, also while an older catalogue shows. */
+  catalogError: UiError | null;
+  refreshCatalog: () => Promise<void>;
+  /** Asks one source again; the others keep their answers and nothing waits on them. */
+  refreshSource: (repo: string) => Promise<UiError | null>;
+  /** The sources being asked again: on their own, or still by a whole refresh whose index is in. */
+  sourceRefreshing: (repo: string) => boolean;
+  /** The sources a whole refresh still waits on, while what else it brought already shows. */
+  pendingSources: string[];
+
+  /** The player's list of sources, once read; null before, or when it couldn't be. */
+  sourceList: string[] | null;
+  /** Why the list couldn't be read (`ModSourcesDamaged`: it was kept aside). */
+  sourceListError: UiError | null;
+  loadSources: () => Promise<void>;
+  /** Adds a source; one change to the list at a time ("skipped" while another runs). */
+  addSource: (repo: string) => Promise<ActionResult<string[]>>;
+  removeSource: (repo: string) => Promise<ActionResult<string[]>>;
+  /** The change to the list that is running. */
+  sourceChange: { kind: "add" | "remove"; repo: string } | null;
+}
+
+/**
+ * The catalogue, kept in order. Answers can arrive in any order (a slow refresh finishing after
+ * a quick one); each carries the backend's revision, and only a higher one replaces what shows.
+ * Errors and the loading state belong to the newest request only: an older one failing late
+ * neither shows its error over a newer success nor ends the newer one's loading.
+ *
+ * `afterRefresh` runs once a refresh is done: revocations and updates come with the catalogue,
+ * so every version's set is read again then.
+ */
+export function useCatalog(afterRefresh: () => Promise<unknown>): CatalogState {
+  const [catalog, setCatalog] = useState<Catalog | null>(null);
+  const [catalogLoading, setCatalogLoading] = useState(true);
+  const [catalogError, setCatalogError] = useState<UiError | null>(null);
+  const [refreshing, setRefreshing] = useState<Record<string, number>>({});
+  const issued = useRef(0);
+  /** The newest request that has answered, either way. */
+  const settled = useRef(0);
+  const after = useRef(afterRefresh);
+  after.current = afterRefresh;
+  /** The sources a whole refresh still waits on, by its early parts (`mod-catalog`). */
+  const [pending, setPending] = useState<string[]>([]);
+
+  /** Shows `next` unless what shows is newer. */
+  const offer = useCallback((next: Catalog) => {
+    setCatalog((shown) => (shown && shown.revision > next.revision ? shown : next));
+  }, []);
+
+  const refreshCatalog = useCallback(async () => {
+    const id = ++issued.current;
+    setCatalogLoading(true);
+    try {
+      const next = await modsApi.catalog(true);
+      offer(next);
+      if (id > settled.current) {
+        settled.current = id;
+        setCatalogError(null);
+      }
+    } catch (err) {
+      // The catalogue shown so far stays; the banner says it couldn't be refreshed, and why,
+      // unless a newer request has answered meanwhile.
+      if (id > settled.current) {
+        settled.current = id;
+        setCatalogError(asAppError(err));
+      }
+    } finally {
+      if (id === issued.current) {
+        setCatalogLoading(false);
+        setPending([]);
+      }
+    }
+    await after.current();
+  }, [offer]);
+
+  // A refresh's early parts: the index as soon as it verifies, then each source. Shown at once,
+  // and every set read again, since revocations come with the index: a slow source doesn't hold
+  // them back. The command's own answer comes last and is the whole refresh.
+  useEffect(() => {
+    let cancelled = false;
+    let unlisten: (() => void) | undefined;
+    listenTo(EVENTS.modCatalog, (e) => {
+      offer(e.payload.catalog);
+      setPending(e.payload.pending);
+      void after.current();
+    }).then((fn) => {
+      if (cancelled) fn();
+      else unlisten = fn;
+    });
+    return () => {
+      cancelled = true;
+      unlisten?.();
+    };
+  }, [offer]);
+
+  const refreshSource = useCallback(
+    async (repo: string) => {
+      setRefreshing((r) => ({ ...r, [repo]: (r[repo] ?? 0) + 1 }));
+      try {
+        offer(await modsApi.refreshSource(repo));
+        return null;
+      } catch (err) {
+        return asAppError(err);
+      } finally {
+        setRefreshing((r) => {
+          const left = (r[repo] ?? 1) - 1;
+          const { [repo]: _, ...rest } = r;
+          return left > 0 ? { ...r, [repo]: left } : rest;
+        });
+        await after.current();
+      }
+    },
+    [offer]
+  );
+
+  const sourceRefreshing = useCallback(
+    (repo: string) => !!refreshing[repo] || pending.some((r) => r.toLowerCase() === repo.toLowerCase()),
+    [refreshing, pending]
+  );
+
+  // The cache shows something at once, then the network says what is new.
+  useEffect(() => {
+    modsApi
+      .catalog(false)
+      .then(offer)
+      .catch(() => {})
+      .finally(() => refreshCatalog());
+  }, [offer, refreshCatalog]);
+
+  // The list of sources: read, added to and taken from here, one change at a time, so the
+  // dialog that shows it only renders.
+  const [sourceList, setSourceList] = useState<string[] | null>(null);
+  const [sourceListError, setSourceListError] = useState<UiError | null>(null);
+  const [sourceChange, setSourceChange] = useState<CatalogState["sourceChange"]>(null);
+  const changing = useRef(false);
+  const loadSources = useCallback(async () => {
+    setSourceListError(null);
+    try {
+      setSourceList(await modsApi.sources());
+    } catch (err) {
+      setSourceListError(asAppError(err));
+    }
+  }, []);
+  const changeSources = useCallback(async (kind: "add" | "remove", repo: string): Promise<ActionResult<string[]>> => {
+    if (changing.current) return { status: "skipped" };
+    changing.current = true;
+    setSourceChange({ kind, repo });
+    try {
+      const list = await (kind === "add" ? modsApi.addSource(repo) : modsApi.removeSource(repo));
+      setSourceList(list);
+      setSourceListError(null);
+      return { status: "done", result: list };
+    } catch (err) {
+      return failed(err);
+    } finally {
+      changing.current = false;
+      setSourceChange(null);
+    }
+  }, []);
+  const addSource = useCallback((repo: string) => changeSources("add", repo), [changeSources]);
+  const removeSource = useCallback((repo: string) => changeSources("remove", repo), [changeSources]);
+
+  return {
+    catalog,
+    catalogLoading,
+    catalogError,
+    refreshCatalog,
+    refreshSource,
+    sourceRefreshing,
+    pendingSources: pending,
+    sourceList,
+    sourceListError,
+    loadSources,
+    addSource,
+    removeSource,
+    sourceChange,
+  };
+}
diff --git a/src/hooks/useCheckContext.ts b/src/hooks/useCheckContext.ts
new file mode 100644
index 0000000..84f9ac6
--- /dev/null
+++ b/src/hooks/useCheckContext.ts
@@ -0,0 +1,24 @@
+import { useMemo } from "react";
+import { useI18n } from "../i18n/useI18n";
+import type { InstallCheckContext } from "../mods/checks";
+import { useMods } from "./useMods";
+
+/** What the plan checks need from a version's set and the catalogue. */
+export function useCheckContext(tag: string): InstallCheckContext {
+  const { profile, nameIn, catalog } = useMods();
+  const { formatDay } = useI18n();
+  const report = profile(tag);
+  const index = catalog?.index;
+  const indexFrom = index && index.freshness !== "fresh" ? formatDay(index.signedAt ?? index.generated) || null : null;
+  return useMemo(() => {
+    const mods = report?.mods ?? [];
+    return {
+      tag,
+      name: nameIn(tag),
+      enabled: new Set(mods.filter((m) => m.enabled).map((m) => m.id)),
+      trustOf: (id: string) => mods.find((m) => m.id === id)?.trust,
+      versionAbi: report?.versionAbi ?? null,
+      indexFrom,
+    };
+  }, [tag, report, nameIn, indexFrom]);
+}
diff --git a/src/hooks/useConfirmPress.ts b/src/hooks/useConfirmPress.ts
new file mode 100644
index 0000000..ef5f045
--- /dev/null
+++ b/src/hooks/useConfirmPress.ts
@@ -0,0 +1,67 @@
+import { useLayoutEffect, useRef, useState, type KeyboardEvent, type MouseEvent } from "react";
+
+interface ConfirmPressOptions {
+  /** The second, confirming press. */
+  onConfirm: () => void;
+  /** The first press: the button now asks. */
+  onAsk?: () => void;
+  /** The question lapsed: on Escape (`said` true, the player asked for it) or when focus left. */
+  onCancel?: (said: boolean) => void;
+  /** The second click of a double-click: it doesn't confirm, and the player is told why. */
+  onDoubleClick?: () => void;
+}
+
+/**
+ * A button that does something that can't be taken back on its second press, never its first.
+ *
+ * - The first press asks; the question stays while the button has focus, never on a timer, so a
+ *   player reading it (or a screen reader saying it) keeps it.
+ * - Any later press confirms, once the question is on screen, except the second click of a mouse
+ *   double-click: the system's own click count says which that is, so there is no dead time
+ *   after the question appears. A dropped double-click is said, so it is never silent.
+ * - A held Enter doesn't repeat into a confirmation.
+ * - Escape, or focus leaving the button, takes the question back.
+ */
+export function useConfirmPress({ onConfirm, onAsk, onCancel, onDoubleClick }: ConfirmPressOptions) {
+  const [confirming, setConfirming] = useState(false);
+  const shown = useRef(false);
+  useLayoutEffect(() => {
+    shown.current = confirming;
+  }, [confirming]);
+
+  const cancel = (said: boolean) => {
+    setConfirming(false);
+    onCancel?.(said);
+  };
+
+  const onClick = (e: MouseEvent<HTMLButtonElement>) => {
+    if (!confirming) {
+      setConfirming(true);
+      onAsk?.();
+      return;
+    }
+    if (!shown.current) return;
+    // `detail` counts the clicks of one double-click; a keyboard press has 0.
+    if (e.detail > 1) {
+      onDoubleClick?.();
+      return;
+    }
+    setConfirming(false);
+    onConfirm();
+  };
+
+  const onKeyDown = (e: KeyboardEvent<HTMLButtonElement>) => {
+    if (e.key === "Escape" && confirming) {
+      e.stopPropagation();
+      cancel(true);
+    } else if (e.repeat && (e.key === "Enter" || e.key === " ")) {
+      e.preventDefault();
+    }
+  };
+
+  const onBlur = () => {
+    if (confirming) cancel(false);
+  };
+
+  return { confirming, reset: () => setConfirming(false), handlers: { onClick, onKeyDown, onBlur } };
+}
diff --git a/src/hooks/useGameState.tsx b/src/hooks/useGameState.tsx
index 38ddb30..a8e0195 100644
--- a/src/hooks/useGameState.tsx
+++ b/src/hooks/useGameState.tsx
@@ -1,25 +1,22 @@
 import { createContext, useContext, useEffect, useState, useCallback, ReactNode } from "react";
-import { invoke } from "@tauri-apps/api/core";
-import { listen } from "@tauri-apps/api/event";
-import { translateError } from "../i18n/errors";
-
-interface GameStateEvent {
-  tag: string;
-  state: "running" | "stopped";
-  exitCode: number | null;
-  crashed: boolean;
-}
+import { launcherApi, listenTo } from "../mods/api";
+import { EVENTS } from "../mods/ipc";
+import type { ModFailure } from "../mods/types";
+import { failed, type ActionResult } from "./result";
 
 export interface GameCrash {
   tag: string;
   exitCode: number | null;
+  /** The mod the log blames, when the game stopped while loading mods. */
+  modFailure: ModFailure | null;
 }
 
 interface GameStateContextValue {
   runningTags: Set<string>;
   anyRunning: boolean;
   isRunning: (tag: string) => boolean;
-  launch: (tag: string) => Promise<string | null>;
+  launch: (tag: string) => Promise<ActionResult>;
+  /** The last crash, until its problem is fixed, the player dismisses it or the game starts again. */
   lastCrash: GameCrash | null;
   clearCrash: () => void;
 }
@@ -38,7 +35,7 @@ export function GameStateProvider({ children }: { children: ReactNode }) {
   // Fetch initially running versions on mount
   useEffect(() => {
     let mounted = true;
-    invoke<string[]>("get_running_versions")
+    launcherApi.runningVersions()
       .then((tags) => {
         if (mounted) setRunningTags(new Set(tags));
       })
@@ -54,8 +51,8 @@ export function GameStateProvider({ children }: { children: ReactNode }) {
     let cancelled = false;
     let unlisten: (() => void) | undefined;
 
-    listen<GameStateEvent>("game-state", (event) => {
-      const { tag, state, exitCode, crashed } = event.payload;
+    listenTo(EVENTS.gameState, (event) => {
+      const { tag, state, exitCode, crashed, modFailure } = event.payload;
       setRunningTags((prev) => {
         const next = new Set(prev);
         if (state === "running") {
@@ -66,7 +63,7 @@ export function GameStateProvider({ children }: { children: ReactNode }) {
         return next;
       });
       if (state === "stopped" && crashed) {
-        setLastCrash({ tag, exitCode });
+        setLastCrash({ tag, exitCode, modFailure: modFailure ?? null });
       }
     }).then((fn) => {
       if (cancelled) fn();
@@ -79,18 +76,19 @@ export function GameStateProvider({ children }: { children: ReactNode }) {
     };
   }, []);
 
-  const launch = useCallback(async (tag: string): Promise<string | null> => {
-    setLastCrash(null);
+  const launch = useCallback(async (tag: string): Promise<ActionResult> => {
     try {
-      await invoke("launch_version", { tag });
+      await launcherApi.launch(tag);
+      // Only now: a launch the mods refused leaves the last crash's advice in place.
+      setLastCrash(null);
       try {
         localStorage.setItem("lastPlayed", tag);
       } catch {
         // ignore localStorage errors
       }
-      return null; // success
+      return { status: "done", result: undefined };
     } catch (err) {
-      return translateError(err);
+      return failed(err);
     }
   }, []);
 
diff --git a/src/hooks/useInstall.tsx b/src/hooks/useInstall.tsx
index ca4b79a..466f244 100644
--- a/src/hooks/useInstall.tsx
+++ b/src/hooks/useInstall.tsx
@@ -1,23 +1,10 @@
 import { createContext, useContext, useState, useCallback, useEffect, ReactNode } from "react";
-import { invoke } from "@tauri-apps/api/core";
-import { listen } from "@tauri-apps/api/event";
-import { translateError } from "../i18n/errors";
+import { showError, type Shown } from "../i18n/errors";
+import { launcherApi, listenTo } from "../mods/api";
+import { EVENTS } from "../mods/ipc";
+import type { InstalledVersion, InstallProgress } from "../mods/types";
 
-export interface InstalledVersion {
-  tag: string;
-  path: string;
-  executable: string;
-  installed_at: string;
-}
-
-export interface InstallProgress {
-  tag: string;
-  stage: "downloading" | "verifying" | "extracting" | "finalizing";
-  percent?: number;
-  downloaded?: number;
-  total?: number;
-  speedMbps?: number;
-}
+export type { InstalledVersion, InstallProgress };
 
 interface InstallContextValue {
   installedVersions: InstalledVersion[];
@@ -25,7 +12,7 @@ interface InstallContextValue {
   loaded: boolean;
   progress: Record<string, InstallProgress>;
   busy: Record<string, boolean>;
-  errors: Record<string, string>;
+  errors: Record<string, Shown>;
   install: (tag: string, assetUrl: string, assetName: string, expectedSha256: string | null) => Promise<void>;
   remove: (tag: string) => Promise<void>;
 }
@@ -43,11 +30,11 @@ export function InstallProvider({ children }: { children: ReactNode }) {
   const [loaded, setLoaded] = useState(false);
   const [progress, setProgress] = useState<Record<string, InstallProgress>>({});
   const [busy, setBusy] = useState<Record<string, boolean>>({});
-  const [errors, setErrors] = useState<Record<string, string>>({});
+  const [errors, setErrors] = useState<Record<string, Shown>>({});
 
   const refreshInstalled = useCallback(async () => {
     try {
-      setInstalledVersions(await invoke<InstalledVersion[]>("get_installed_versions"));
+      setInstalledVersions(await launcherApi.installedVersions());
     } catch (err) {
       console.error("Failed to load installed versions:", err);
     } finally {
@@ -62,7 +49,7 @@ export function InstallProvider({ children }: { children: ReactNode }) {
   useEffect(() => {
     let cancelled = false;
     let unlisten: (() => void) | undefined;
-    listen<InstallProgress>("install-progress", (event) => {
+    listenTo(EVENTS.installProgress, (event) => {
       setProgress((prev) => ({ ...prev, [event.payload.tag]: event.payload }));
     }).then((fn) => {
       if (cancelled) fn();
@@ -82,7 +69,7 @@ export function InstallProvider({ children }: { children: ReactNode }) {
         await work();
         await refreshInstalled();
       } catch (err) {
-        setErrors((prev) => ({ ...prev, [tag]: translateError(err) }));
+        setErrors((prev) => ({ ...prev, [tag]: showError(err) }));
       } finally {
         setBusy((prev) => without(prev, tag));
         setProgress((prev) => without(prev, tag));
@@ -93,13 +80,13 @@ export function InstallProvider({ children }: { children: ReactNode }) {
 
   const install = useCallback(
     (tag: string, assetUrl: string, assetName: string, expectedSha256: string | null) => {
-      setProgress((prev) => ({ ...prev, [tag]: { tag, stage: "downloading", percent: 0 } }));
-      return run(tag, () => invoke("install_version", { tag, assetUrl, assetName, expectedSha256 }));
+      setProgress((prev) => ({ ...prev, [tag]: { tag, stage: "downloading", percent: 0, downloaded: 0, total: 0, speedMbps: 0 } }));
+      return run(tag, () => launcherApi.installVersion(tag, assetUrl, assetName, expectedSha256));
     },
     [run]
   );
 
-  const remove = useCallback((tag: string) => run(tag, () => invoke("remove_version", { tag })), [run]);
+  const remove = useCallback((tag: string) => run(tag, () => launcherApi.removeVersion(tag)), [run]);
 
   const value: InstallContextValue = { installedVersions, loaded, progress, busy, errors, install, remove };
 
diff --git a/src/hooks/useLaunch.ts b/src/hooks/useLaunch.ts
new file mode 100644
index 0000000..2a26664
--- /dev/null
+++ b/src/hooks/useLaunch.ts
@@ -0,0 +1,119 @@
+import { useCallback, useEffect, useRef, useState } from "react";
+import type { ProfileReport, UiError } from "../mods/types";
+import type { Shown } from "../i18n/errors";
+import { useGameState } from "./useGameState";
+import { useModProfiles } from "./useMods";
+
+/**
+ * A refused start. For a refusal because of mods, `seen` is the set as it was known once the
+ * launcher tried to read it again: only a newer one can say the refusal no longer holds.
+ */
+export interface LaunchError {
+  tag: string;
+  error: UiError;
+  shown: Shown;
+  seen?: ProfileReport;
+  /** The read again failed: the blocker panel can't say which mods, so this notice does. */
+  unread?: Shown;
+}
+
+/** What a page shows of a refused start of `tag`. */
+export interface Refusal {
+  /** A refusal for any other reason: shown as it is. */
+  shownError: Shown | null;
+  /** The mod whose stored copy is gone (`ModStoreMissing`): installing it again is the fix. */
+  storeMissing: string | null;
+  /** A refusal because of mods that couldn't be read again: shown with "Check mods again". */
+  unread: LaunchError | null;
+  /** The last start was refused because of mods, and that still holds. */
+  refusedForMods: boolean;
+}
+
+/**
+ * Starting a version, wherever Play is: Home and Versions start the same way and handle a
+ * refusal the same way. A refusal because of mods the shown set doesn't have (a revocation Play
+ * applied, a change from elsewhere) reads the set again, so the blocker panel can say what and
+ * offer the fixes; once a newer read of the set has nothing blocking, the refusal goes.
+ */
+export function useLaunch() {
+  const { launch } = useGameState();
+  const { profile, readProfile } = useModProfiles();
+  const [launchError, setLaunchError] = useState<LaunchError | null>(null);
+  const [launching, setLaunching] = useState<string | null>(null);
+  const [rereading, setRereading] = useState(false);
+  const going = useRef(false);
+
+  /** Reads a refused version's set again; the refusal then holds until a newer set clears it. */
+  const reread = useCallback(
+    async (refusal: LaunchError): Promise<LaunchError> => {
+      setRereading(true);
+      // Play found something the shown set doesn't have: only a read from after it says what.
+      const r = await readProfile(refusal.tag, true);
+      setRereading(false);
+      if ("report" in r) return { ...refusal, seen: r.report, unread: undefined };
+      return { ...refusal, seen: profile(refusal.tag), unread: r.error };
+    },
+    [readProfile, profile]
+  );
+
+  /** Starts `tag`; a press while a start is being checked is not sent again. */
+  const start = useCallback(
+    async (tag: string) => {
+      if (going.current) return;
+      going.current = true;
+      setLaunching(tag);
+      setLaunchError(null);
+      try {
+        const r = await launch(tag);
+        if (r.status !== "failed") return;
+        const refusal: LaunchError = { tag, error: r.error, shown: r.shown };
+        // If the read fails, the refusal stays on screen, with a way to read it again.
+        setLaunchError(r.error.code === "ModsBlocked" ? await reread(refusal) : refusal);
+      } finally {
+        going.current = false;
+        setLaunching(null);
+      }
+    },
+    [launch, reread]
+  );
+
+  const checkAgain = useCallback(async () => {
+    if (launchError) setLaunchError(await reread(launchError));
+  }, [launchError, reread]);
+
+  // A refusal because mods blocked is about that set: once a report of it newer than the one
+  // known at the refusal has nothing blocking (the player fixed it, on any page), the refusal no
+  // longer holds. An older report, or none, never clears it.
+  const report = profile(launchError?.tag);
+  const reportBlocks = (report?.blocking.length ?? 0) > 0;
+  useEffect(() => {
+    if (launchError?.error.code !== "ModsBlocked" || !report || report === launchError.seen) return;
+    if (!reportBlocks) setLaunchError(null);
+    // A read that succeeds after a failed one: the panel takes over.
+    else if (launchError.unread) setLaunchError({ ...launchError, seen: report, unread: undefined });
+  }, [launchError, report, reportBlocks]);
+
+  /** What to show about `tag`'s last refused start, if there is one. */
+  const refusalFor = useCallback(
+    (tag: string | null): Refusal => {
+      const refusal = tag && launchError?.tag === tag ? launchError : null;
+      if (!refusal) return { shownError: null, unread: null, refusedForMods: false, storeMissing: null };
+      if (refusal.error.code !== "ModsBlocked") {
+        const storeMissing = refusal.error.code === "ModStoreMissing" ? refusal.error.detail : null;
+        return { shownError: refusal.shown, unread: null, refusedForMods: false, storeMissing };
+      }
+      // Said by the blocker panel, with its fixes, unless the set couldn't be read or shows nothing.
+      const blocks = (profile(tag)?.blocking.length ?? 0) > 0;
+      return { shownError: null, unread: refusal.unread || !blocks ? refusal : null, refusedForMods: true, storeMissing: null };
+    },
+    [launchError, profile]
+  );
+
+  /** Shows an error of another action next to Play, e.g. a folder that wouldn't open. */
+  const fail = useCallback((tag: string, error: UiError, shown: Shown) => setLaunchError({ tag, error, shown }), []);
+  const clear = useCallback(() => setLaunchError(null), []);
+
+  return { start, launching, rereading, checkAgain, refusalFor, fail, clear };
+}
+
+export type Launch = ReturnType<typeof useLaunch>;
diff --git a/src/hooks/useMods.tsx b/src/hooks/useMods.tsx
new file mode 100644
index 0000000..8f1d298
--- /dev/null
+++ b/src/hooks/useMods.tsx
@@ -0,0 +1,465 @@
+import { createContext, useCallback, useContext, useEffect, useMemo, useRef, useState, ReactNode } from "react";
+import { modsApi } from "../mods/api";
+import { modName } from "../mods/select";
+import {
+  crashResolved,
+  describeChange,
+  describeCopy,
+  describeRemove,
+  describeRestore,
+  describeToggle,
+  snapshotFor,
+  type CrashSnapshot,
+  type NameOf,
+  type NoticeText,
+} from "../mods/status";
+import type {
+  Catalog,
+  ChangeResult,
+  CopyPreview,
+  CopyResult,
+  FileInspection,
+  InstallPlan,
+  ProfileReport,
+  UiError,
+  UiProgress,
+} from "../mods/types";
+import { showError, type Shown } from "../i18n/errors";
+import { tm } from "../i18n";
+import { useAnnounce } from "../components/LiveRegion";
+import { useInstall } from "./useInstall";
+import { useGameState } from "./useGameState";
+import { failed, type ActionResult } from "./result";
+import { useCatalog, type CatalogState } from "./useCatalog";
+import { useOperations, type FirstFile } from "./useOperations";
+import { useProfileCoordinator } from "./useProfileCoordinator";
+
+export interface Notice extends NoticeText {
+  id: number;
+  tag: string;
+  /** A removal that `restore` can still put back: until the next change to that version. */
+  undo?: { id: string; name: string };
+}
+
+export { keyOf, type Operation } from "./useOperations";
+import { keyOf, type Operation } from "./useOperations";
+
+interface ModsContextValue {
+  catalog: Catalog | null;
+  catalogLoading: boolean;
+  /** Why the last catalogue load failed; kept until one succeeds, also while an older catalogue shows. */
+  catalogError: UiError | null;
+  refreshCatalog: () => Promise<void>;
+  /** Asks one source again, alone; resolves with why it failed, if it did. */
+  refreshSource: (repo: string) => Promise<UiError | null>;
+  sourceRefreshing: (repo: string) => boolean;
+  /** The sources a whole refresh still waits on, while what else it brought already shows. */
+  pendingSources: string[];
+  /** The player's list of sources and changes to it (hooks/useCatalog). */
+  sourceList: CatalogState["sourceList"];
+  sourceListError: CatalogState["sourceListError"];
+  loadSources: CatalogState["loadSources"];
+  addSource: CatalogState["addSource"];
+  removeSource: CatalogState["removeSource"];
+  sourceChange: CatalogState["sourceChange"];
+
+  profile: (tag: string | null | undefined) => ProfileReport | undefined;
+  profileError: (tag: string) => Shown | null;
+  /**
+   * Reads a version's set. `fresh`: after something changed it (a refresh, a refused Play, the
+   * player's own folder), so a read that began earlier doesn't answer it.
+   */
+  loadProfile: (tag: string, fresh?: boolean) => Promise<ProfileReport | undefined>;
+  /** The same read, saying why it failed when it did. */
+  readProfile: (tag: string, fresh?: boolean) => Promise<{ report: ProfileReport } | { error: Shown }>;
+  /** A mod's display name in a version's set, falling back to the catalogue and then the id. */
+  nameIn: (tag: string) => NameOf;
+
+  /** Whether this mod is being changed, or the whole set is (a copy into it). */
+  isBusy: (tag: string, modId: string) => boolean;
+  isCopying: (tag: string) => boolean;
+  /** The progress events of a running operation, in the order they came (contract R4 §3). */
+  progressOf: (op: Operation) => UiProgress[];
+  /** Asks the backend to stop a running operation; it then ends as "cancelled". */
+  cancel: (op: Operation) => Promise<void>;
+  isCancelling: (op: Operation) => boolean;
+
+  notices: (tag: string) => Notice[];
+  dismissNotice: (id: number) => void;
+
+  /** The blamed mod as it was when the last crash happened, for its notice. */
+  crashSnapshot: CrashSnapshot | null;
+
+  plan: (tag: string, sha256: string) => Promise<InstallPlan>;
+  previewCopy: (from: string, to: string) => Promise<CopyPreview>;
+  inspectFile: (tag: string, path: string) => Promise<FileInspection>;
+  /** Installs what the player reviewed: the plan's token goes with it (contract R4 §2). */
+  install: (tag: string, plan: InstallPlan) => Promise<ActionResult<ChangeResult>>;
+  installFile: (tag: string, path: string, inspection: FileInspection, plan: InstallPlan | null) => Promise<ActionResult<ChangeResult>>;
+  setEnabled: (tag: string, id: string, enabled: boolean) => Promise<ActionResult<ChangeResult>>;
+  /**
+   * Turns several mods on or off, one after the other, without a notice for each: the caller says
+   * the whole. Resolves with the ids changed; stops at the first failure.
+   */
+  setEnabledMany: (tag: string, ids: string[], enabled: boolean) => Promise<ActionResult<string[]>>;
+  remove: (tag: string, id: string) => Promise<ActionResult<ChangeResult>>;
+  restore: (tag: string, id: string) => Promise<ActionResult<ChangeResult>>;
+  copyProfile: (preview: CopyPreview) => Promise<ActionResult<CopyResult>>;
+}
+
+const ModsContext = createContext<ModsContextValue | null>(null);
+
+function without<T>(record: Record<string, T>, key: string): Record<string, T> {
+  const { [key]: _, ...rest } = record;
+  return rest;
+}
+
+export function ModsProvider({ children }: { children: ReactNode }) {
+  const announce = useAnnounce();
+  const { installedVersions } = useInstall();
+  const { lastCrash, clearCrash } = useGameState();
+  const [profiles, setProfiles] = useState<Record<string, ProfileReport>>({});
+  const [profileErrors, setProfileErrors] = useState<Record<string, Shown>>({});
+  const [notices, setNotices] = useState<Notice[]>([]);
+  const noticeId = useRef(0);
+  const { read, changed } = useProfileCoordinator(setProfiles);
+  const { progress, running, begin, end, markCancelling } = useOperations();
+
+  const readProfile = useCallback(
+    async (tag: string, fresh = false): Promise<{ report: ProfileReport } | { error: Shown }> => {
+      try {
+        const report = await read(tag, fresh);
+        setProfileErrors((e) => without(e, tag));
+        return { report };
+      } catch (err) {
+        const error = showError(err);
+        setProfileErrors((e) => ({ ...e, [tag]: error }));
+        return { error };
+      }
+    },
+    [read]
+  );
+  const loadProfile = useCallback(async (tag: string, fresh = false) => {
+    const r = await readProfile(tag, fresh);
+    return "report" in r ? r.report : undefined;
+  }, [readProfile]);
+
+  const tags = useMemo(() => installedVersions.map((v) => v.tag), [installedVersions]);
+  const tagsRef = useRef(tags);
+  tagsRef.current = tags;
+
+  // Every version's set: Home, Versions (mod counts) and Mods (copy donors) all use them.
+  useEffect(() => {
+    tags.forEach((tag) => loadProfile(tag));
+  }, [tags, loadProfile]);
+
+  // The catalogue, in order; every version's set is read again after each refresh, since
+  // revocations and updates come with it.
+  const catalogState = useCatalog(() => Promise.all(tagsRef.current.map((tag) => loadProfile(tag, true))));
+  const { catalog, catalogLoading, catalogError, refreshCatalog, refreshSource, sourceRefreshing, pendingSources } = catalogState;
+  const { sourceList, sourceListError, loadSources, addSource, removeSource, sourceChange } = catalogState;
+
+  // A crash notice stays until its problem is fixed: the blamed mod is off, gone or replaced, or
+  // the dependency it lacked is on and usable.
+  // A copy in the player's own folder counts too: it loads whenever the launcher's doesn't, so the
+  // notice stays until that file is gone or a launcher build that is on stands in for it.
+  const [crashSnap, setCrashSnap] = useState<{ crash: unknown; snapshot: CrashSnapshot | null } | null>(null);
+  useEffect(() => {
+    if (!lastCrash) {
+      setCrashSnap(null);
+      return;
+    }
+    if (crashSnap?.crash !== lastCrash) {
+      setCrashSnap({ crash: lastCrash, snapshot: snapshotFor(lastCrash.modFailure, profiles[lastCrash.tag]) });
+      return;
+    }
+    if (crashResolved(crashSnap.snapshot, profiles[lastCrash.tag])) clearCrash();
+  }, [lastCrash, profiles, clearCrash, crashSnap]);
+  const crashSnapshot = crashSnap && crashSnap.crash === lastCrash ? crashSnap.snapshot : null;
+
+  const nameIn = useCallback((tag: string): NameOf => (id) => modName(id, profiles[tag], catalog), [profiles, catalog]);
+
+  /**
+   * The answer to a version's last change. One per version: a newer change replaces it, and with
+   * it any Undo, which the backend forgets at the next change anyway. Said once, politely.
+   */
+  const pushNotice = useCallback((tag: string, text: NoticeText | null, undo?: Notice["undo"]) => {
+    const id = ++noticeId.current;
+    if (text) announce(`notice:${id}`, text.lines.map(tm).join(" "));
+    setNotices((all) => {
+      const others = all.filter((n) => n.tag !== tag);
+      if (!text) return others;
+      return [...others, { ...text, id, tag, undo }];
+    });
+  }, [announce]);
+
+  const dismissNotice = useCallback((id: number) => setNotices((all) => all.filter((n) => n.id !== id)), []);
+
+  /** Runs one change. The same change while it runs is refused, not sent twice. */
+  const run = useCallback(
+    async <R extends ChangeResult>(
+      op: Operation,
+      first: FirstFile | null,
+      work: (operationId: string) => Promise<R>,
+      after: (r: R) => void
+    ): Promise<ActionResult<R>> => {
+      const operationId = begin(op, first);
+      if (!operationId) return { status: "skipped" };
+      try {
+        const result = await work(operationId);
+        changed(op.tag, result.report);
+        after(result);
+        return { status: "done", result };
+      } catch (err) {
+        // The set may have changed before the failure: read what it is now.
+        loadProfile(op.tag, true);
+        return failed(err);
+      } finally {
+        end(op);
+      }
+    },
+    [begin, end, changed, loadProfile]
+  );
+
+  const namer = useCallback((r: ChangeResult, before?: ProfileReport): NameOf => (id) =>
+    modName(id, r.report.mods.some((m) => m.id === id) ? r.report : before, catalog), [catalog]);
+
+  const install = useCallback(
+    (tag: string, plan: InstallPlan) => {
+      const modId = plan.target.id;
+      // As the backend works (`plan::resolve`): the build asked for first, then what it needs.
+      return run(
+        { kind: "mod", tag, id: modId },
+        { sha256: plan.target.sha256, modId, count: plan.install.length + 1 },
+        (operationId) => modsApi.install(tag, plan.target.sha256, plan.planToken, operationId),
+        (r) => pushNotice(tag, describeChange(r, modId, tag, namer(r)))
+      );
+    },
+    [run, pushNotice, namer]
+  );
+
+  const installFile = useCallback(
+    (tag: string, path: string, inspection: FileInspection, plan: InstallPlan | null) => {
+      const modId = inspection.archive?.id ?? "";
+      return run(
+        { kind: "mod", tag, id: modId },
+        // The file itself is checked first, then what it needs is fetched.
+        { sha256: inspection.sha256, modId, count: (plan?.install.length ?? 0) + 1, local: true },
+        (operationId) => modsApi.installFile(tag, path, inspection.sha256, inspection.planToken, operationId),
+        (r) => pushNotice(tag, describeChange(r, modId, tag, namer(r)))
+      );
+    },
+    [run, pushNotice, namer]
+  );
+
+  const setEnabled = useCallback(
+    (tag: string, id: string, enabled: boolean) =>
+      run({ kind: "mod", tag, id }, null, () => modsApi.setEnabled(tag, id, enabled), (r) =>
+        pushNotice(tag, describeToggle(r, id, enabled, tag, namer(r)))
+      ),
+    [run, pushNotice, namer]
+  );
+
+  const setEnabledMany = useCallback(
+    async (tag: string, ids: string[], enabled: boolean): Promise<ActionResult<string[]>> => {
+      const done: string[] = [];
+      for (const id of ids) {
+        const op = { kind: "mod", tag, id } as const;
+        if (!begin(op, null)) continue;
+        try {
+          const r = await modsApi.setEnabled(tag, id, enabled);
+          changed(tag, r.report);
+          done.push(id);
+        } catch (err) {
+          loadProfile(tag, true);
+          return failed(err);
+        } finally {
+          end(op);
+        }
+      }
+      return { status: "done", result: done };
+    },
+    [begin, end, changed, loadProfile]
+  );
+
+  const profilesRef = useRef(profiles);
+  profilesRef.current = profiles;
+
+  const remove = useCallback(
+    (tag: string, id: string) => {
+      const before = profilesRef.current[tag];
+      return run({ kind: "mod", tag, id }, null, () => modsApi.remove(tag, id), (r) => {
+        // The removed mod is no longer in the new report; name it from the old one.
+        const name = namer(r, before);
+        pushNotice(tag, describeRemove(r, id, tag, name), r.undo ? { id: r.undo, name: name(r.undo) } : undefined);
+      });
+    },
+    [run, pushNotice, namer]
+  );
+
+  const restore = useCallback(
+    (tag: string, id: string) =>
+      run({ kind: "mod", tag, id }, null, (operationId) => modsApi.restore(tag, id, operationId), (r) =>
+        pushNotice(tag, describeRestore(r, id, tag, namer(r)))
+      ),
+    [run, pushNotice, namer]
+  );
+
+  const copyProfile = useCallback(
+    (preview: CopyPreview) => {
+      const { from, to } = preview;
+      const items = preview.items.filter((i) => i.outcome === "install");
+      // The copied mods first, in the source set's order, then what they need.
+      const first = items[0] ?? preview.deps[0];
+      return run(
+        { kind: "copy", tag: to },
+        first ? { sha256: first.sha256 ?? "", modId: first.id, count: items.length + preview.deps.length } : null,
+        (operationId) => modsApi.copyProfile(from, to, preview.planToken, operationId),
+        (r) => pushNotice(to, describeCopy(r, from, to, namer(r)))
+      );
+    },
+    [run, pushNotice, namer]
+  );
+
+  const isCopying = useCallback((tag: string) => !!running[keyOf({ kind: "copy", tag })], [running]);
+  const isBusy = useCallback(
+    (tag: string, id: string) => !!running[keyOf({ kind: "mod", tag, id })] || isCopying(tag),
+    [running, isCopying]
+  );
+  const progressOf = useCallback(
+    (op: Operation) => {
+      const r = running[keyOf(op)];
+      return r ? (progress[r.operationId] ?? []) : [];
+    },
+    [running, progress]
+  );
+  const cancel = useCallback(
+    async (op: Operation) => {
+      const operationId = markCancelling(op);
+      if (!operationId) return;
+      // False: it had already ended, or got past the point where it can stop. Either way its
+      // own answer says what happened.
+      await modsApi.cancel(operationId).catch(() => false);
+    },
+    [markCancelling]
+  );
+  const isCancelling = useCallback((op: Operation) => !!running[keyOf(op)]?.cancelling, [running]);
+  const noticesFor = useCallback((tag: string) => notices.filter((n) => n.tag === tag), [notices]);
+  const profile = useCallback((tag: string | null | undefined) => (tag ? profiles[tag] : undefined), [profiles]);
+  const profileError = useCallback((tag: string) => profileErrors[tag] ?? null, [profileErrors]);
+
+  const value = useMemo<ModsContextValue>(
+    () => ({
+      catalog,
+      catalogLoading,
+      catalogError,
+      refreshCatalog,
+      refreshSource,
+      sourceRefreshing,
+      pendingSources,
+      sourceList,
+      sourceListError,
+      loadSources,
+      addSource,
+      removeSource,
+      sourceChange,
+      profile,
+      profileError,
+      loadProfile,
+      readProfile,
+      nameIn,
+      isBusy,
+      isCopying,
+      progressOf,
+      cancel,
+      isCancelling,
+      notices: noticesFor,
+      dismissNotice,
+      crashSnapshot,
+      plan: modsApi.plan,
+      previewCopy: modsApi.previewCopy,
+      inspectFile: modsApi.inspectFile,
+      install,
+      installFile,
+      setEnabled,
+      setEnabledMany,
+      remove,
+      restore,
+      copyProfile,
+    }),
+    [
+      catalog,
+      catalogLoading,
+      catalogError,
+      refreshCatalog,
+      refreshSource,
+      sourceRefreshing,
+      pendingSources,
+      sourceList,
+      sourceListError,
+      loadSources,
+      addSource,
+      removeSource,
+      sourceChange,
+      profile,
+      profileError,
+      loadProfile,
+      readProfile,
+      nameIn,
+      isBusy,
+      isCopying,
+      progressOf,
+      cancel,
+      isCancelling,
+      noticesFor,
+      dismissNotice,
+      crashSnapshot,
+      install,
+      installFile,
+      setEnabled,
+      setEnabledMany,
+      remove,
+      restore,
+      copyProfile,
+    ]
+  );
+
+  return <ModsContext.Provider value={value}>{children}</ModsContext.Provider>;
+}
+
+export function useMods(): ModsContextValue {
+  const context = useContext(ModsContext);
+  if (!context) throw new Error("useMods must be used within a ModsProvider");
+  return context;
+}
+
+/**
+ * The parts of the mods state, for a component that needs only one: what it uses is in its
+ * type. One context still holds them all; most components use two or three of these, so a
+ * context each would spare few renders.
+ */
+export type ModsCatalog = Pick<
+  ModsContextValue,
+  | "catalog"
+  | "catalogLoading"
+  | "catalogError"
+  | "refreshCatalog"
+  | "refreshSource"
+  | "sourceRefreshing"
+  | "pendingSources"
+  | "sourceList"
+  | "sourceListError"
+  | "loadSources"
+  | "addSource"
+  | "removeSource"
+  | "sourceChange"
+>;
+export type ModProfiles = Pick<ModsContextValue, "profile" | "profileError" | "loadProfile" | "readProfile" | "nameIn" | "notices" | "dismissNotice" | "crashSnapshot">;
+export type ModOperations = Omit<ModsContextValue, keyof ModsCatalog | keyof ModProfiles>;
+
+/** The catalogue and the player's sources. */
+export const useModsCatalog: () => ModsCatalog = useMods;
+/** Each version's set, read in order, with its notices. */
+export const useModProfiles: () => ModProfiles = useMods;
+/** Plans, changes and their progress. */
+export const useModOperations: () => ModOperations = useMods;
diff --git a/src/hooks/useOperations.ts b/src/hooks/useOperations.ts
new file mode 100644
index 0000000..181d84a
--- /dev/null
+++ b/src/hooks/useOperations.ts
@@ -0,0 +1,94 @@
+import { useCallback, useEffect, useRef, useState } from "react";
+import { listenTo, newOperationId } from "../mods/api";
+import { EVENTS } from "../mods/ipc";
+import type { UiProgress } from "../mods/types";
+
+/** What a running change is about, so the busy state has one owner. */
+export type Operation = { kind: "mod"; tag: string; id: string } | { kind: "copy"; tag: string };
+
+export const keyOf = (op: Operation) => (op.kind === "mod" ? `mod:${op.tag}:${op.id}` : `copy:${op.tag}`);
+
+function without<T>(record: Record<string, T>, key: string): Record<string, T> {
+  const { [key]: _, ...rest } = record;
+  return rest;
+}
+
+/** The first file an operation will work on, so its progress shows at once, before any event. */
+export interface FirstFile {
+  sha256: string;
+  modId: string;
+  count: number;
+  /** A file already on the player's computer: its first step is checking it, not a download. */
+  local?: boolean;
+}
+
+/**
+ * Running operations and their progress. The client names each operation (contract R4 §3) and
+ * every event carries that id, so progress always belongs to the operation that caused it; an
+ * event for an operation that isn't running is dropped. When one ends, however it ends, its
+ * progress goes with it.
+ */
+export function useOperations() {
+  const [progress, setProgress] = useState<Record<string, UiProgress[]>>({});
+  const [running, setRunning] = useState<Record<string, { op: Operation; operationId: string; cancelling: boolean }>>({});
+  const live = useRef<Map<string, string>>(new Map());
+
+  useEffect(() => {
+    let cancelled = false;
+    let unlisten: (() => void) | undefined;
+    listenTo(EVENTS.modProgress, (e) => {
+      const id = e.payload.operationId;
+      if (![...live.current.values()].includes(id)) return;
+      setProgress((p) => {
+        const list = (p[id] ?? []).filter((x) => x.sha256 !== e.payload.sha256 && x.sha256 !== "");
+        return { ...p, [id]: [...list, e.payload] };
+      });
+    }).then((fn) => {
+      if (cancelled) fn();
+      else unlisten = fn;
+    });
+    return () => {
+      cancelled = true;
+      unlisten?.();
+    };
+  }, []);
+
+  /** Starts an operation and says its id, or null when the same one is already running. */
+  const begin = useCallback((op: Operation, first: FirstFile | null): string | null => {
+    const key = keyOf(op);
+    if (live.current.has(key)) return null;
+    const operationId = newOperationId();
+    live.current.set(key, operationId);
+    setRunning((r) => ({ ...r, [key]: { op, operationId, cancelling: false } }));
+    // The first file shows at once, before its first event: getting ready, or being checked when
+    // it is a file the player picked. Never "downloading" before anything is.
+    const waiting: UiProgress = {
+      operationId,
+      sha256: first?.sha256 ?? "",
+      modId: first?.modId ?? (op.kind === "mod" ? op.id : ""),
+      stage: first?.local ? "verifying" : "preparing",
+      percent: 0,
+      index: 1,
+      count: Math.max(1, first?.count ?? 1),
+    };
+    setProgress((p) => ({ ...p, [operationId]: [waiting] }));
+    return operationId;
+  }, []);
+
+  const end = useCallback((op: Operation) => {
+    const key = keyOf(op);
+    const operationId = live.current.get(key);
+    live.current.delete(key);
+    setRunning((r) => without(r, key));
+    if (operationId) setProgress((p) => without(p, operationId));
+  }, []);
+
+  const markCancelling = useCallback((op: Operation) => {
+    const key = keyOf(op);
+    setRunning((r) => (r[key] ? { ...r, [key]: { ...r[key], cancelling: true } } : r));
+    return live.current.get(key) ?? null;
+  }, []);
+
+  return { progress, running, begin, end, markCancelling };
+}
+
diff --git a/src/hooks/usePlan.test.ts b/src/hooks/usePlan.test.ts
new file mode 100644
index 0000000..547784c
--- /dev/null
+++ b/src/hooks/usePlan.test.ts
@@ -0,0 +1,15 @@
+import { describe, expect, it } from "vitest";
+import { contentKey } from "./usePlan";
+
+describe("contentKey", () => {
+  it("is the same for the same content read twice", () => {
+    expect(contentKey({ tag: "v1", mods: [{ id: "a" }] })).toBe(contentKey({ tag: "v1", mods: [{ id: "a" }] }));
+  });
+  it("differs when the content does", () => {
+    expect(contentKey({ tag: "v1", mods: [{ id: "a" }] })).not.toBe(contentKey({ tag: "v1", mods: [{ id: "b" }] }));
+  });
+  it("tells a missing input from an empty one", () => {
+    expect(contentKey(undefined)).not.toBe(contentKey(null));
+    expect(contentKey(null)).not.toBe(contentKey({}));
+  });
+});
diff --git a/src/hooks/usePlan.ts b/src/hooks/usePlan.ts
new file mode 100644
index 0000000..f19daee
--- /dev/null
+++ b/src/hooks/usePlan.ts
@@ -0,0 +1,97 @@
+import { useCallback, useEffect, useRef, useState } from "react";
+import { showError, type Shown } from "../i18n/errors";
+
+/**
+ * One request for a dialog's plan (an install plan, a copy preview, a file inspection), keyed
+ * by everything the answer depends on.
+ *
+ * - `key` names the request: the version, the build or file, the source version. A new key
+ *   drops what was shown: it was about something else.
+ * - `inputs` are what the answer was computed from (the version's set, the catalogue), compared
+ *   by content: a reload that brings the same set or catalogue asks nothing again. When one of
+ *   them does change, it asks again.
+ * - While it asks again, the plan on screen stays usable: the backend checks the token of the
+ *   plan the player agreed to when they press the button, and refuses one that changed
+ *   (`ModChangedMeanwhile`). An answer with the same token keeps the plan on screen as it is, so
+ *   the button never flickers; one with another token replaces it.
+ *
+ * `ready` is false only before the first answer for this key, after `reload` until its answer
+ * comes, and on an error: a late answer to an older key can never enable a button. Every dialog
+ * that asks the player to agree to a plan guards its button with it.
+ */
+export interface PlanRequest<T> {
+  /** The answer on screen; null before the first one for this key. */
+  value: T | null;
+  /** The answer on screen is for this key, and can be agreed to. */
+  ready: boolean;
+  error: Shown | null;
+  /** Asks again for the same key, e.g. after the backend refused a plan as out of date. */
+  reload: () => void;
+}
+
+type Answer<T> = { key: string; revision: number; nonce: number; value: T | null; error: Shown | null };
+
+export function usePlan<T extends { planToken: string }>(
+  key: string | null,
+  inputs: readonly unknown[],
+  load: (() => Promise<T>) | null
+): PlanRequest<T> {
+  const revision = useRevision(inputs);
+  const [answer, setAnswer] = useState<Answer<T> | null>(null);
+  const [nonce, setNonce] = useState(0);
+  const loader = useRef(load);
+  loader.current = load;
+
+  useEffect(() => {
+    const run = loader.current;
+    if (key === null || !run) return;
+    let live = true;
+    run()
+      .then((value) => {
+        if (!live) return;
+        setAnswer((prev) =>
+          // The same plan again: the one on screen stays, object and all.
+          prev && prev.key === key && prev.value && prev.value.planToken === value.planToken
+            ? { ...prev, revision, nonce, error: null }
+            : { key, revision, nonce, value, error: null }
+        );
+      })
+      .catch((err) => live && setAnswer({ key, revision, nonce, value: null, error: showError(err) }));
+    return () => {
+      live = false;
+    };
+  }, [key, revision, nonce]);
+
+  const reload = useCallback(() => setNonce((n) => n + 1), []);
+  const sameKey = answer !== null && answer.key === key;
+  // After `reload`, the plan on screen is the one the backend refused: it waits for the new one.
+  const current = sameKey && answer.nonce === nonce;
+  return {
+    value: sameKey ? answer.value : null,
+    ready: current && answer.value !== null && answer.error === null,
+    error: current ? answer.error : null,
+    reload,
+  };
+}
+
+const keys = new WeakMap<object, string>();
+
+/** What an input is, by content: the same set read twice is the same input. */
+export function contentKey(x: unknown): string {
+  if (x === null || typeof x !== "object") return `${typeof x}:${String(x)}`;
+  let k = keys.get(x);
+  if (k === undefined) {
+    k = JSON.stringify(x);
+    keys.set(x, k);
+  }
+  return k;
+}
+
+/** A number that goes up whenever one of `inputs` changes content. */
+function useRevision(inputs: readonly unknown[]): number {
+  const now = inputs.map(contentKey);
+  const last = useRef<{ keys: string[]; n: number }>({ keys: now, n: 0 });
+  const same = last.current.keys.length === now.length && now.every((k, i) => k === last.current.keys[i]);
+  if (!same) last.current = { keys: now, n: last.current.n + 1 };
+  return last.current.n;
+}
diff --git a/src/hooks/useProfileCoordinator.ts b/src/hooks/useProfileCoordinator.ts
new file mode 100644
index 0000000..f40eac2
--- /dev/null
+++ b/src/hooks/useProfileCoordinator.ts
@@ -0,0 +1,25 @@
+import { useCallback, useRef } from "react";
+import { modsApi } from "../mods/api";
+import { ProfileReads } from "../mods/profileReads";
+import type { ProfileReport } from "../mods/types";
+
+/**
+ * Profile answers per version, in order (mods/profileReads): a slow read can't undo a change,
+ * reads share, and a fresh read is never served by one that began before it was asked.
+ */
+export function useProfileCoordinator(setProfiles: (fn: (p: Record<string, ProfileReport>) => Record<string, ProfileReport>) => void) {
+  const set = useRef(setProfiles);
+  set.current = setProfiles;
+  const reads = useRef<ProfileReads | null>(null);
+  reads.current ??= new ProfileReads(
+    (tag) => modsApi.profile(tag),
+    (tag, report) => set.current((p) => ({ ...p, [tag]: report }))
+  );
+
+  /** One read per version at a time; with `fresh`, one that began after this call. */
+  const read = useCallback((tag: string, fresh = false) => reads.current!.read(tag, fresh), []);
+  /** A change's report is the newest state when it arrives. */
+  const changed = useCallback((tag: string, report: ProfileReport) => reads.current!.changed(tag, report), []);
+
+  return { read, changed };
+}
diff --git a/src/hooks/useRovingTabs.ts b/src/hooks/useRovingTabs.ts
new file mode 100644
index 0000000..a2297bb
--- /dev/null
+++ b/src/hooks/useRovingTabs.ts
@@ -0,0 +1,51 @@
+import { KeyboardEvent, useCallback, useRef } from "react";
+
+/**
+ * A tablist the way the ARIA pattern has it: one tab stop, Left/Right/Home/End move and select,
+ * and each tab points at its panel.
+ */
+export function useRovingTabs<T extends string>(prefix: string, ids: readonly T[], active: T, onChange: (id: T) => void) {
+  const refs = useRef<Partial<Record<T, HTMLButtonElement | null>>>({});
+
+  const onKeyDown = useCallback(
+    (e: KeyboardEvent<HTMLButtonElement>) => {
+      // From the tab that has focus, which need not be the selected one (a click elsewhere, a
+      // tab focused by script): the arrows move from where the player is.
+      const focusedId = ids.find((id) => refs.current[id] === e.currentTarget);
+      const i = ids.indexOf(focusedId ?? active);
+      const last = ids.length - 1;
+      const next =
+        e.key === "ArrowRight" ? (i + 1) % ids.length
+        : e.key === "ArrowLeft" ? (i - 1 + ids.length) % ids.length
+        : e.key === "Home" ? 0
+        : e.key === "End" ? last
+        : -1;
+      if (next < 0) return;
+      e.preventDefault();
+      onChange(ids[next]);
+      refs.current[ids[next]]?.focus();
+    },
+    [ids, active, onChange]
+  );
+
+  const tab = (id: T) => ({
+    role: "tab" as const,
+    id: `${prefix}-tab-${id}`,
+    "aria-selected": active === id,
+    "aria-controls": `${prefix}-panel-${id}`,
+    tabIndex: active === id ? 0 : -1,
+    ref: (el: HTMLButtonElement | null) => {
+      refs.current[id] = el;
+    },
+    onKeyDown,
+    onClick: () => onChange(id),
+  });
+
+  const panel = {
+    role: "tabpanel" as const,
+    id: `${prefix}-panel-${active}`,
+    "aria-labelledby": `${prefix}-tab-${active}`,
+  };
+
+  return { tab, panel };
+}
diff --git a/src/i18n/I18nProvider.tsx b/src/i18n/I18nProvider.tsx
index 0013ebe..7af43d8 100644
--- a/src/i18n/I18nProvider.tsx
+++ b/src/i18n/I18nProvider.tsx
@@ -1,45 +1,72 @@
-import { createContext, useContext, useState, useEffect, useCallback, ReactNode } from 'react';
-import { initI18n, getLocale, setLocale, formatSize as i18nFormatSize, t as translate, Locale } from './index';
+import { createContext, useContext, useState, useCallback, useMemo, ReactNode, Fragment } from 'react';
+import {
+  initI18n,
+  getLocale,
+  setLocale,
+  formatSize as i18nFormatSize,
+  formatDay as i18nFormatDay,
+  formatList as i18nFormatList,
+  t as translate,
+  tn as translatePlural,
+  tm as translateMsg,
+  Locale,
+  MessageKey,
+  PluralKey,
+  Msg,
+} from './index';
 
 interface I18nContextValue {
   locale: Locale;
-  t: (key: string, ...args: string[]) => string;
+  t: (key: MessageKey, ...args: string[]) => string;
+  /** A counted message: picks the plural form for `count` and fills `{n}`. */
+  tn: (key: PluralKey, count: number, ...args: string[]) => string;
+  tm: (msg: Msg) => string;
+  /** A message whose `{0}`, `{1}`... are elements, e.g. a `<strong>` inside one sentence. */
+  tr: (key: MessageKey, ...parts: ReactNode[]) => ReactNode;
   formatSize: (bytes: number) => string;
+  formatDay: (iso: string | null | undefined) => string;
+  formatList: (items: string[]) => string;
   changeLocale: (newLocale: Locale) => void;
   ready: boolean;
 }
 
 const I18nContext = createContext<I18nContextValue | null>(null);
 
-export function I18nProvider({ children }: { children: ReactNode }) {
-  const [locale, setLocaleState] = useState<Locale>(() => getLocale());
-  const [ready, setReady] = useState(false);
+/** Splits a translated template on `{n}` placeholders and puts elements in their place. */
+export function interpolate(template: string, parts: ReactNode[]): ReactNode {
+  return template.split(/(\{\d+\})/).map((piece, i) => {
+    const m = piece.match(/^\{(\d+)\}$/);
+    return <Fragment key={i}>{m ? parts[Number(m[1])] ?? piece : piece}</Fragment>;
+  });
+}
 
-  useEffect(() => {
-    initI18n();
-    setReady(true);
-    // Sync with localStorage on init
-    const saved = localStorage.getItem('locale');
-    if (saved && (saved as Locale) !== locale) {
-      setLocaleState(saved as Locale);
-    }
-  }, [locale]);
+initI18n();
 
-  const t = useCallback((key: string, ...args: string[]) => translate(key, ...args), []);
-  const formatSize = useCallback((bytes: number) => i18nFormatSize(bytes), []);
+export function I18nProvider({ children }: { children: ReactNode }) {
+  const [locale, setLocaleState] = useState<Locale>(() => getLocale());
 
   const changeLocale = useCallback((newLocale: Locale) => {
     setLocale(newLocale);
     setLocaleState(newLocale);
+    document.documentElement.lang = newLocale;
   }, []);
 
-  const value: I18nContextValue = {
-    locale,
-    t,
-    formatSize,
-    changeLocale,
-    ready,
-  };
+  // Every function changes identity with the locale, so memoised text follows a language switch.
+  const value = useMemo<I18nContextValue>(() => {
+    const placeholders = ['{0}', '{1}', '{2}', '{3}'];
+    return {
+      locale,
+      t: (key, ...args) => translate(key, ...args),
+      tn: (key, count, ...args) => translatePlural(key, count, ...args),
+      tm: (msg) => translateMsg(msg),
+      tr: (key, ...parts) => interpolate(translate(key, ...placeholders.slice(0, parts.length)), parts),
+      formatSize: (bytes) => i18nFormatSize(bytes),
+      formatDay: (iso) => i18nFormatDay(iso),
+      formatList: (items) => i18nFormatList(items),
+      changeLocale,
+      ready: true,
+    };
+  }, [locale, changeLocale]);
 
   return <I18nContext.Provider value={value}>{children}</I18nContext.Provider>;
 }
@@ -50,4 +77,4 @@ export function useI18n(): I18nContextValue {
     throw new Error('useI18n must be used within an I18nProvider');
   }
   return context;
-}
\ No newline at end of file
+}
diff --git a/src/i18n/en.json b/src/i18n/en.json
index 6b86f8b..e6edd28 100644
--- a/src/i18n/en.json
+++ b/src/i18n/en.json
@@ -1,21 +1,17 @@
 {
   "updateAvailable": "UPDATE AVAILABLE",
-"updateDownloading": "UPDATING {0}%",
-"updateFailed": "UPDATE FAILED · RETRY",
-"updateTooltip": "Update to version {0} and restart",
-"updateCloseGame": "Close the game before updating",
+  "updateDownloading": "UPDATING {0}%",
+  "updateFailed": "UPDATE FAILED · RETRY",
+  "updateTooltip": "Update to version {0} and restart",
+  "updateCloseGame": "Close the game before updating",
   "latestBadge": "Latest",
-  "appTitle": "Weft Launcher",
   "refreshButton": "Refresh list",
   "loading": "Loading...",
   "cacheBanner": "Showing cache (offline or no updates)",
-  "errorPrefix": "Error: ",
   "emptyState": "No versions found.",
   "installButton": "Install",
-  "installedBadge": "Installed",
   "deleteButton": "Delete",
   "deleteForReal": "Delete for real",
-  "confirmDelete": "Are you sure you want to delete this version? This action cannot be undone.",
   "playButton": "Play",
   "playing": "Playing...",
   "progressDownloading": "Downloading... {0}% — {1} Mbps",
@@ -25,10 +21,6 @@
   "deleteDisabledTooltip": "Close the game to delete",
   "playDisabledTooltip": "Another game is running: {0}",
   "installedAtLabel": "Installed at",
-  "linkDiscord": "Discord",
-  "linkWebsite": "Website",
-  "releasedLabel": "Released",
-  "inUseBadge": "In use",
   "noChangelog": "No release notes.",
   "newBadge": "New",
   "openFolderButton": "Open folder",
@@ -36,6 +28,8 @@
   "openLogButton": "Open log",
   "tabHome": "Home",
   "tabVersions": "Versions",
+  "tabMods": "Mods",
+  "newVersionsDot": "New versions available",
   "tabNotes": "Release Notes",
   "tabsLabel": "Main tabs",
   "selectVersionLabel": "Select version",
@@ -45,45 +39,511 @@
   "instanceCardTitle": "Instance",
   "versionLabel": "Version",
   "gameFolderTitle": "Game folder",
-  "prereleaseBadge": "Pre-release",
+  "prereleaseBadge": "Prerelease",
   "heroBadge": "VERSION {0} · READY",
   "heroBadgePlaying": "VERSION {0} · PLAYING",
   "errors": {
     "invalidName": "Invalid name: {0}",
     "installInProgress": "Already installing: {0}",
-    "network": "Network error: {0}",
-    "io": "I/O error: {0}",
-    "serialization": "Serialization error: {0}",
-    "httpHeader": "HTTP header error: {0}",
-    "cacheCorrupted": "Cache corrupted: {0}",
-    "assetNotFound": "Asset not found for current platform",
-    "missingDigest": "SHA256 digest missing in asset",
+    "network": "The launcher couldn't reach the server. Check your connection and try again.",
+    "httpStatus": "The server answered, but with an error. Try again later.",
+    "io": "Couldn't read or write a file.",
+    "serialization": "Got an answer the launcher couldn't read.",
+    "httpHeader": "The server sent an answer the launcher couldn't use.",
+    "cacheCorrupted": "The saved copy is damaged. Refresh to fetch it again.",
+    "assetNotFound": "This release has no file for your system.",
+    "missingDigest": "This release doesn't publish a SHA-256 for its file, so the launcher can't check it.",
     "rateLimited": "GitHub API rate limit exceeded. Try again later.",
     "forbidden": "GitHub API access denied (403). Using cache if available.",
     "offlineNoCache": "Offline and no cache available",
-    "zip": "ZIP error: {0}",
-    "createDir": "Failed to create directory: {0}",
-    "sha256Mismatch": "SHA256 mismatch",
-    "hashMissing": "Required SHA256 not provided",
+    "zip": "The download isn't a zip the launcher can open.",
+    "createDir": "Couldn't create a folder.",
+    "sha256Mismatch": "The download didn't match its pinned SHA-256, so nothing was installed. Try again; if it keeps happening, the file on the server changed.",
+    "hashMissing": "Nothing says what this file's SHA-256 should be, so it can't be checked.",
     "alreadyInstalled": "Version already installed: {0}",
     "notInstalled": "Version not installed: {0}",
-    "downloadFailed": "Download failed: {0}",
-    "extractFailed": "Extraction failed: {0}",
+    "downloadFailed": "The download failed. Try again.",
+    "extractFailed": "Couldn't unpack the game.",
     "gameRunning": "Another game is running: {0}. Close it before starting another.",
     "versionInUse": "Version in use (file locked): {0}. Close the game to delete.",
     "alreadyRunning": "This version is already running",
     "anotherGameRunning": "Another game is running: {0}",
     "executableNotFound": "Executable not found: {0}",
-    "processSpawnFailed": "Failed to spawn process: {0}",
-    "logDirCreateFailed": "Failed to create log directory: {0}",
-    "gameFolderNotFound": "Game folder not found: {0}",
-    "unsupportedPlatform": "Game folder location not confirmed on this platform",
-    "openerError": "Failed to open: {0}"
+    "processSpawnFailed": "Couldn't start the game.",
+    "logDirCreateFailed": "Couldn't create the log folder.",
+    "gameFolderNotFound": "The game folder isn't known yet. Start the game once, and the launcher finds it.",
+    "openerError": "Couldn't open it.",
+    "indexSignatureInvalid": "The mod index failed its signature check.",
+    "indexRollback": "The mod index that came in is older than the one already verified, so it was ignored.",
+    "indexInvalid": "The mod index can't be read.",
+    "abiUnavailable": "Couldn't find out which mods fit {0}. Check your connection.",
+    "modNotInCatalog": "That mod isn't in the catalogue any more. Refresh and try again.",
+    "modIncompatible": "{0} isn't built for this game version",
+    "modNotForPlatform": "{0} has no library for this system",
+    "modRevoked": "Pulled from the index: {0}",
+    "modArchiveInvalid": "This file isn't a Weft mod.",
+    "modFileChanged": "The file changed after it was checked. Choose it again.",
+    "modNotInstalled": "That mod isn't installed any more: {0}",
+    "modsBlocked": "Weft won't start with these mods on: {0}.",
+    "modSourceInvalid": "Not a GitHub repo: {0}",
+    "modSourceNotFound": "No such GitHub repo: {0}",
+    "diskFull": "The disk is full.",
+    "modSourceRateLimited": "GitHub is limiting requests. Try again in a few minutes.",
+    "modDownloadNotFound": "The mod's file is gone from GitHub ({0}), so nothing was installed. Refresh and try again.",
+    "modTooLarge": "The mod's file is larger than the launcher accepts, so nothing was installed.",
+    "modIdReserved": "\"{0}\" is reserved for Weft itself and can't be a mod's id.",
+    "modChangedMeanwhile": "Something changed since you looked, so nothing was installed. Look at what changed and confirm again.",
+    "unknownBare": "Something went wrong that the launcher didn't expect.",
+    "modCancelled": "Cancelled. Nothing was changed.",
+    "modLockInvalid": "This version's mod list is damaged, so the launcher won't change it. Remove the version's mods folder or reinstall the version.",
+    "modUrlRefused": "A download link didn't point where the mod's listing says it should, so the launcher refused it. Nothing was downloaded.",
+    "modIconInvalid": "This mod's icon isn't a small PNG, so it isn't shown.",
+    "details": "Details",
+    "modSourcesDamaged": "Your list of mod sources couldn't be read, so it was set aside and kept. Add your sources again; the old list is behind Details.",
+    "modSourceRateLimitedUntil": "GitHub is limiting requests until {0}. Try again then.",
+    "modUrlRefusedHost": "A download link pointed away from github.com, or not over https, so the launcher refused it. Nothing was downloaded.",
+    "modUrlRefusedForm": "A download link wasn't written the one plain way a GitHub download link is, so the launcher refused it. Nothing was downloaded.",
+    "modUrlRefusedAsset": "A download link pointed at a file other than this mod's release on its GitHub repo, so the launcher refused it. Nothing was downloaded.",
+    "modStoreMissing": "The launcher's stored copy of {0} is gone, so it can't be handed to the game. Install it again to play with it."
+  },
+  "mods": {
+    "title": "Mods",
+    "fromFile": "From file",
+    "fileFilter": "Weft mod",
+    "sources": "Sources",
+    "refresh": "Check for new mods",
+    "tabInstalled": "Installed",
+    "tabInstalledLabel_one": "Installed in {0}: {n} mod",
+    "tabBrowse": "Browse",
+    "installedListLabel": "Mods installed for {0}",
+    "noVersions": "Install a game version first. Each version keeps its own mods.",
+    "emptyInstalled": "No mods for {0} yet.",
+    "browseMods": "Browse mods",
+    "copyButton": "Copy mods from {0}",
+    "runningBanner": "{0} is running. Close it to change its mods.",
+    "revocationsPending": "Pulled from the index: {0}. It is turned off as soon as the game stops.",
+    "unmanagedBanner": "Your own Weft mods folder has {0}. Mods there load in every version, and the launcher can't check them.",
+    "unmanagedShow": "Show folder",
+    "abiUnknown": "Couldn't check which mods fit {0}. The game checks them when it starts.",
+    "dismiss": "Dismiss",
+    "metaBuiltFor": "built for {0}",
+    "metaBuiltForThis": "fits {0}",
+    "metaFromSource": "from {0}",
+    "metaNeeds": "needs {0}",
+    "statusOff": "Off. The game doesn't see it.",
+    "statusWrongVersion": "Built for another game version: stops Play.",
+    "statusWrongVersionTag": "Built for {0}: stops Play.",
+    "statusRevoked": "Turned off, pulled from the index: “{0}”",
+    "statusUnchecked": "Can't be checked before the game starts.",
+    "statusUncheckedFile": "From your computer ({0}). Checked when the game starts.",
+    "on": "On",
+    "off": "Off",
+    "remove": "Remove",
+    "removeConfirm": "Confirm",
+    "removeLabel": "Remove {0}",
+    "update": "Update to {0}…",
+    "updateButton": "Update",
+    "badgeReviewed": "Reviewed",
+    "badgeUnreviewed": "Unreviewed",
+    "badgeUnverified": "Unverified",
+    "badgeReviewedHint": "In the signed Weft mod index: someone reviewed exactly this file.",
+    "badgeUnreviewedHint": "From a GitHub repo you added. Published by that repo; nobody reviewed it.",
+    "badgeUnverifiedHint": "A file from your computer. Where it came from can't be checked.",
+    "badgePrerelease": "Prerelease",
+    "badgeExperimental": "Experimental",
+    "searchPlaceholder": "Search mods",
+    "filterFits": "Fits {0}",
+    "filterPrereleases": "Prereleases",
+    "install": "Install",
+    "installed": "Installed",
+    "notForVersion": "No build for {0}",
+    "onlyPrerelease": "Prereleases only",
+    "noSummary": "No description.",
+    "browseEmpty": "No mods match your search.",
+    "browseEmptyFits": "No mods have a build for {0} yet.",
+    "browseEmptyAll": "No mods found.",
+    "showAll": "Show all mods",
+    "indexInvalid": "The newer index that came in failed its signature check and was ignored.",
+    "indexRollback": "The index that came in is older than the one already verified, so it was ignored.",
+    "by": "by {0}",
+    "dlgInstallTitle": "Install {0} {1} for {2}?",
+    "dlgUpdateTitle": "Update {0} to {1} for {2}?",
+    "dlgVersion": "Version",
+    "checksLabel": "What the launcher checked",
+    "ckIndex": "Listed in the Weft mod index",
+    "ckIndexDetail": "Reviewed by {0} on {1} · index signature verified",
+    "ckNotIndex": "Not in the Weft mod index",
+    "ckNotIndexDetail": "Published by {0}. Nobody reviewed it.",
+    "ckPinned": "Download pinned to SHA-256 {0} by the signed index",
+    "ckBuilt": "The signed index records: built by GitHub Actions in {0} @ {1}, checked by {2} on {3}",
+    "ckNoBuild": "No build record",
+    "ckNoBuildDetail": "Nothing shows which source code this file was built from",
+    "ckFits": "Declared mod interface matches this version",
+    "ckFitsDetail": "The build declares mod interface {0}.",
+    "warnNative": "Mods are programs. {0} can do anything you can do on this computer. These checks show where it came from. They don't show that it's harmless.",
+    "warnUnreviewed": "Nobody reviewed {0}. It can do anything you can do on this computer. Install it only if you trust {1}.",
+    "viewSource": "View source",
+    "cancel": "Cancel",
+    "close": "Close",
+    "fileChecking": "Checking {0} for {1}…",
+    "fileUnverifiedTitle": "Install unverified {0} for {1}?",
+    "fileKnownTitle": "Install {0} {1} for {2} from this file?",
+    "fileNotAModTitle": "{0} can't be installed for {1}",
+    "fileFrom": "{0} from your computer · {1}",
+    "fileSaysItIs": "It calls itself {0}.",
+    "ckFileNotKnown": "Not in the Weft mod index or any of your sources",
+    "ckFileKnown": "Same file as {0} {1} in the catalogue",
+    "ckFileFitUnknown": "Fit unknown",
+    "ckFileFitUnknownDetail": "Weft checks it when it starts. If it doesn't fit, the game won't start.",
+    "ckFileFitsNo": "Not built for {0}",
+    "ckLooksLikeMod": "Looks like a Weft mod",
+    "ckNotForSystem": "No library for this system",
+    "ckNotForSystemDetail": "It has one for: {0}",
+    "ckNotAMod": "Not a Weft mod",
+    "ckRevoked": "Pulled from the index: {0}",
+    "warnFile": "Only install files from people you trust. A mod can read, change or delete your files and send them anywhere.",
+    "installAnyway": "Install anyway",
+    "sourcesTitle": "Mod sources",
+    "sourcesIntro": "The Weft mod index is always on. You can also add GitHub repos that publish mods; their releases show up as Unreviewed.",
+    "sourcesIndex": "Weft mod index",
+    "sourcesIndexFresh": "Checked on this refresh.",
+    "sourcesIndexNone": "not reached yet",
+    "sourcesAddLabel": "GitHub repo",
+    "sourcesAddPlaceholder": "owner/repo or a github.com link",
+    "sourcesAdd": "Add",
+    "sourcesRemove": "Remove",
+    "sourcesWarning": "Anyone can publish a repo. Add only ones you trust.",
+    "noticeInstalled": "{0} is installed and on.",
+    "noticeDepsInstalled": "Also installed what it needs: {0}.",
+    "noticeAlsoEnabled": "Also turned on what it needs: {0}.",
+    "noticeAlsoDisabled": "Also turned off what needs it: {0}.",
+    "attentionDot": "Mods need a look",
+    "homeMods": "Mods for {0}: {1}",
+    "homeModsNone": "No mods for {0}",
+    "homeChange": "Change",
+    "homeAdd": "Add mods",
+    "homeFixInMods": "Fix in Mods",
+    "failureWrongVersion": "{0} stopped Weft from starting: it was built for another version.",
+    "failureMissingDep": "{0} stopped Weft from starting: it needs {1}.",
+    "failureLoad": "{0} stopped Weft from starting: its library didn't load.",
+    "failureNotAMod": "{0} stopped Weft from starting: it isn't a Weft mod.",
+    "failureWrongName": "{0} stopped Weft from starting: its file has the wrong name.",
+    "failureInit": "A mod crashed while Weft was starting. Open the log to see which one, or turn mods off one at a time to find it.",
+    "failureOutside": "It's in your own Weft mods folder, which the launcher doesn't manage.",
+    "turnOff": "Turn off {0}",
+    "openModsFolder": "Open mods folder",
+    "versionPicker": "Version",
+    "viewsLabel": "Mods for {0}",
+    "copyHeader": "Copy mods from…",
+    "copying": "Copying…",
+    "retry": "Retry",
+    "retrying": "Retrying…",
+    "manageSources": "Manage sources",
+    "bannersOpen": "More",
+    "bannersMore_one": "{n} note",
+    "bannersMore_other": "{n} notes",
+    "bannersFold": "Show less",
+    "abiUnknownBrowse": "Couldn't find out which mods fit {0}, so none can be installed right now. Check your connection, then refresh.",
+    "catalogFailed": "Couldn't load the mod list.",
+    "catalogMissing": "This mod isn't in the loaded catalogue. Refresh and try again.",
+    "installLabel": "Install {0} for {1}…",
+    "indexShowingFrom": "Showing the mod index from {0}.",
+    "indexUnreachable": "The launcher couldn't reach the Weft mod index.",
+    "indexServerError": "The Weft mod index's server answered with an error.",
+    "sourceErrRate": "GitHub is limiting requests, so {0} couldn't be refreshed.",
+    "sourceErrGone": "{0} doesn't exist on GitHub any more.",
+    "sourceErrNetwork": "{0} couldn't be reached.",
+    "sourceErrServer": "GitHub answered with an error for {0}, so it couldn't be refreshed.",
+    "sourceShowingFrom": "Showing its mods from {0}.",
+    "sourceShowingNone": "Its mods show up once it can be read.",
+    "dlgNoBuildTitle": "{0} has no build for {1}",
+    "dlgNoBuild": "No build of {0} fits {1} on this system right now.",
+    "planning": "Working out what this would change…",
+    "ckPassed": "Passed",
+    "ckFailed": "Failed",
+    "ckNotCopied": "Not copied",
+    "ckUnknown": "Unknown",
+    "ckWontInstall": "Can't install: {0}",
+    "ckPinnedGithub": "Download pinned to GitHub's SHA-256 checksum {0}",
+    "ckPinnedGithubDetail": "The checksum comes from the same server as the file. It catches a broken download, not a swapped one.",
+    "ckBuiltDetail": "Workflow {0} · the launcher doesn't check the build itself",
+    "ckBuiltClaimed": "Built by GitHub Actions, the repo says",
+    "ckBuiltClaimedDetail": "Claimed by the repo, not checked: {0} @ {1} · {2}",
+    "ckDepInstall": "Needs {0}: installs {1} with it",
+    "ckDepEnable": "Needs {0}: turns it on too",
+    "ckDepMissing": "Needs {0}: no build for {1}",
+    "ckDepHave": "Needs {0}: installed and on",
+    "ckDepUnknown": "Needs {0}: it isn't on, and the launcher can't tell whether it will be",
+    "ckReplaces": "Replaces your installed {0}.",
+    "ckReplacesTrust": "Your installed {0} was {1}; this build is {2}.",
+    "ckReplacesOff": "Your installed one is off, and the update stays off.",
+    "warnDepsUnreviewed": "It also brings mods nobody reviewed: {0}.",
+    "fileUnusableTitle": "{0} can't be installed for {1}",
+    "fileReplaces": "Replaces the installed {0}.",
+    "ckLooksLikeModDetail": "{0} · nothing else in the zip",
+    "ckNotAModDetail": "{0}",
+    "typeToConfirm": "Type {0} to install it anyway",
+    "typedNotPassed_one": "Not shown to be safe ({n}):",
+    "sourcesMods_one": "{n} mod",
+    "sourcesMods_other": "{n} mods",
+    "sourcesChecked": "checked {0}",
+    "sourcesNotChecked": "not checked yet",
+    "sourcesRemoveConfirm": "Remove {0}? Mods you installed from it stay, but they won't get updates.",
+    "sourcesKeep": "Keep",
+    "sourcesRemoving": "Removing…",
+    "sourcesRemoveLabel": "Remove {0}",
+    "sourcesAdding": "Adding…",
+    "removeConfirmLabel": "Confirm: remove {0}",
+    "noticeInstalledOff": "{0} is updated and stays off.",
+    "noticeMissing_one": "No build of {0} fits {1} yet, so what needs it can't load.",
+    "noticeMissing_other": "No builds of {0} fit {1} yet, so what needs them can't load.",
+    "noticeLeftBehind_one": "Not copied: {0}.",
+    "noticeLeftBehind_other": "Not copied: {0}.",
+    "noticeCopied_one": "Copied {n} mod from {0}.",
+    "noticeCopied_other": "Copied {n} mods from {0}.",
+    "homeBlocked_one": "Weft {0} won't start with this mod on:",
+    "homeBlocked_other": "Weft {0} won't start with these mods on:",
+    "turnOn": "Turn on {0}",
+    "failureInitNamed": "{0} crashed while Weft was starting.",
+    "copyTitle": "Copy mods from {0} to {1}?",
+    "copyDoneTitle": "Mods copied to {0}",
+    "copyInstalledOn": "Installed for {0}, turned on",
+    "copyInstalledOff": "Installed for {0}, turned off",
+    "copyFrom": "Copy mods from",
+    "copyWillInstall": "Installs its build for {0}",
+    "copyAlreadyThere": "Already in {0}: left as it is",
+    "copyNoBuild": "No build for {0} yet",
+    "copyLocalFile": "A file from your computer: add it again with From file",
+    "copyRevoked": "Pulled from the index: not copied",
+    "copyConfirm_one": "Copy {n} mod to {0}",
+    "copyConfirm_other": "Copy {n} mods to {0}",
+    "copyNothing": "Nothing to copy",
+    "copyWarn": "Mods are programs. Each one can do anything you can do on this computer.",
+    "copyWarnUnreviewed": "Mods are programs, and nobody reviewed these: {0}. Each one can do anything you can do on this computer.",
+    "copyLeftBehindTitle_one": "This one wasn't copied:",
+    "copyLeftBehindTitle_other": "These weren't copied:",
+    "statusDepsOff_one": "Needs {0}, which is off.",
+    "statusDepsOff_other": "Needs {0}, which are off.",
+    "statusDepsRevoked_one": "Needs {0}, which was pulled from the index.",
+    "statusDepsRevoked_other": "Needs {0}, which were pulled from the index.",
+    "statusDepsNotInstalled_one": "Needs {0}, which isn't installed.",
+    "statusDepsNotInstalled_other": "Needs {0}, which aren't installed.",
+    "statusDepsNoBuild_one": "Needs {0}, which has no build for {1} yet.",
+    "statusDepsNoBuild_other": "Needs {0}, which have no builds for {1} yet.",
+    "installDep": "Install {0}…",
+    "installTurnedOff": "Install turned off",
+    "updateTurnedOff": "Update turned off",
+    "installsOff_one": "{0} has no build for {1} yet, so {2} is installed turned off. Play keeps working.",
+    "installsOff_other": "{0} have no builds for {1} yet, so {2} is installed turned off. Play keeps working.",
+    "noticeInstalledOffMissing_one": "{0} is installed turned off: {1} has no build for {2} yet. Play keeps working.",
+    "noticeInstalledOffMissing_other": "{0} is installed turned off: {1} have no builds for {2} yet. Play keeps working.",
+    "noticeRemoved": "Removed {0} from {1}.",
+    "noticeRestored": "{0} is back in {1}.",
+    "noticeRestoredOff": "{0} is back in {1}, turned off as before.",
+    "noticeCopiedOff_one": "Installed turned off, because what it needs has no build for {1} yet: {0}.",
+    "noticeCopiedOff_other": "Installed turned off, because what they need has no build for {1} yet: {0}.",
+    "undo": "Undo",
+    "undoLabel": "Undo: put {0} back",
+    "ckFitUnchecked": "Whether it fits {0} couldn't be checked",
+    "badgeRevoked": "Revoked",
+    "badgeRevokedHint": "Pulled from the index. The index says: “{0}”",
+    "indexStale": "The mod index was last signed on {0}; revocations since then may be missing.",
+    "indexStaleShort": "Mod index signed {0}: may be out of date",
+    "indexUnavailable": "Reviewed mods are unavailable: there is no saved copy of the Weft mod index. Only mods from your sources show.",
+    "indexDisk": "The launcher couldn't save the mod index.",
+    "sourceErrInvalid": "{0} sent mod data the launcher couldn't read.",
+    "sourceErrDisk": "{0} couldn't be saved on this computer.",
+    "sourcesIndexStale": "verified, but signed {0}: revocations since then may be missing",
+    "profileFailed": "Couldn't read the mods of {0}: {1}",
+    "profileRetry": "Retry loading mods",
+    "removeConfirmHint": "Press again to remove {0}.",
+    "installAnywayWhy": "Type {0} below to turn this on.",
+    "copyAlsoInstalls": "Also installs what they need:",
+    "copyAlsoEnables": "Turns on what they need:",
+    "copyDepInstall": "{0} {1}: a copied mod needs it",
+    "copyDepEnable": "{0}: a copied mod needs it, so it's turned on",
+    "copyDepMissing": "{0}: no build for {1} yet",
+    "copyInstallsOff_one": "Installed turned off, because what it needs has no build for {1} yet: {0}.",
+    "copyInstallsOff_other": "Installed turned off, because what they need has no build for {1} yet: {0}.",
+    "fixesFor": "Fixes for {0}",
+    "folderFailed": "Couldn't open the folder: {0}",
+    "indexUnavailableShort": "No mod index: no Reviewed mods",
+    "noticeTurnedOn": "Turned on {0}.",
+    "noticeTurnedOff": "Turned off {0}.",
+    "shadowOffRow": "A copy in your own mods folder ({0}) loads instead.",
+    "shadowRevokedRow": "Your own folder's copy ({0}) would load: stops Play.",
+    "ckIndexDetailDated": "Reviewed by {0} on {1} · from the index signed {2}",
+    "ckFitUncheckedDetail": "The launcher couldn't find out this version's mod interface. Retry once you're online.",
+    "fileReplacesTrust": "Replaces your installed {0}, which is {1}, with a file that is {2}.",
+    "changedTitle": "This changed since you looked:",
+    "changedAdded": "Now also installs {0} {1}",
+    "changedVersion": "{0} {1} instead of {2}",
+    "changedTrust": "{0} is now {1}",
+    "changedDropped": "No longer installs {0}",
+    "changedEnables": "Now also turns on {0}",
+    "changedNoEnable": "No longer turns on {0}",
+    "changedOff": "{0} is now installed turned off",
+    "changedOn": "{0} now turns on",
+    "changedOther": "The plan changed. Look again before you confirm.",
+    "ckSame": "No change",
+    "stepDownloading": "downloading {0}%",
+    "stepPreparing": "getting ready",
+    "stepDownloadingSpoken": "downloading",
+    "stepVerifying": "checking the file",
+    "stepInstalling": "installing",
+    "progressOf": "File {0} of {1}: {2}, {3}",
+    "progressOne": "{0}: {1}",
+    "cancelling": "Cancelling…",
+    "cancelOperation": "Cancel",
+    "needsNetworkButton": "{0} (needs internet)",
+    "needsNetworkNote": "The launcher couldn't reach the internet at its last try, and this has to download. It won't work until you're back online.",
+    "fileKnownUpdateTitle": "Update {0} to {1} for {2} from this file?",
+    "fileReplaceTitle": "Replace {0} with unverified {1} for {2}?",
+    "replaceAnyway": "Replace anyway",
+    "typeToReplace": "Type {0} to replace it anyway",
+    "clearSearch": "Clear search",
+    "needsNetworkShort": "needs internet",
+    "removeCancelled": "Kept {0}.",
+    "showFolderFix": "Show {0}",
+    "indexOfflineShort": "Offline: mod index from {0}",
+    "indexCachedShort": "Using the mod index from {0}",
+    "refreshFailed": "Couldn't refresh the mod list, so the one shown is from before.",
+    "refreshFailedShort": "Couldn't refresh: showing the previous mod list",
+    "abiUnknownShort": "Couldn't check which mods fit {0}",
+    "shadowBanner": "Your own mods folder has its own copy of {0}. The launcher's copy is off, so the game loads that one instead.",
+    "updatesNeedCatalog": "Couldn't load the mod list, so updates can't be reviewed. Retry above.",
+    "updateLabelTo": "Update {0} to {1} for {2}…",
+    "sourcesRetry": "Retry",
+    "updateLabel": "Update {0} for {1}…",
+    "sourcesLoadFailedLead": "Couldn't read your sources.",
+    "noticeShadowLoads": "Your own mods folder has a copy of {0} ({1}), so the game loads that one instead.",
+    "failureShadowed": "Your own mods folder has a copy of it ({0}); the game may have loaded that one.",
+    "blockerPager": "Mods that stop the game",
+    "blockerPrev": "Previous mod that stops the game",
+    "blockerNext": "Next mod that stops the game",
+    "blockerPage": "{0} of {1}",
+    "playOffOne": "Play is off: {0} needs a fix.",
+    "playOffMany_one": "Play is off: {n} mod needs a fix.",
+    "playOffMany_other": "Play is off: {n} mods need a fix.",
+    "toastsLabel": "What just happened",
+    "statusRevokedNoReason": "Turned off, pulled from the index. No reason given.",
+    "ckRevokedNoReason": "Pulled from the index. No reason given.",
+    "indexBadgeSigned": "Signed · verified {0}",
+    "indexBadgeStale": "Signed {0} · may be out of date",
+    "indexBadgeCopy": "Signed copy from {0}",
+    "indexBadgeNone": "Not verified",
+    "sourceBadgeRepo": "GitHub repo",
+    "sourcesChecking": "checking…",
+    "sourceFormatLink": "What a source needs",
+    "sourcesDamaged": "Your list of sources couldn't be read; it was kept aside. Add your sources again in Sources.",
+    "sourcesDamagedShort": "Your list of sources couldn't be read",
+    "failureShadowedStill": "Your own mods folder still has {0}, which loads in its place, so it may still cause this. Remove that file to be sure.",
+    "copyDoneSummary_one": "Copied {n} mod from {0} to {1}.",
+    "copyDoneSummary_other": "Copied {n} mods from {0} to {1}.",
+    "copyStaysLine_one": "{n} mod stays behind: {0}.",
+    "copyStaysLine_other": "{n} mods stay behind: {0}.",
+    "indexRefusedShort": "Index refused: using the copy from {0}",
+    "blockLineWrongVersionTag": "{0} stops Play: it was built for {1}.",
+    "blockLineWrongVersion": "{0} stops Play: it was built for another game version.",
+    "blockLineRevoked": "{0} stops Play: it was pulled from the index.",
+    "blockLineShadowedRevoked": "{0} stops Play: it was pulled from the index, but the copy in your own mods folder ({1}) would load instead.",
+    "blockLineDepsOff_one": "{0} stops Play: it needs {1}, which is off.",
+    "blockLineDepsOff_other": "{0} stops Play: it needs {1}, which are off.",
+    "blockLineDepsRevoked_one": "{0} stops Play: it needs {1}, which was pulled from the index.",
+    "blockLineDepsRevoked_other": "{0} stops Play: it needs {1}, which were pulled from the index.",
+    "blockLineDepsNotInstalled_one": "{0} stops Play: it needs {1}, which isn't installed.",
+    "blockLineDepsNotInstalled_other": "{0} stops Play: it needs {1}, which aren't installed.",
+    "blockLineDepsNoBuild_one": "{0} stops Play: it needs {1}, which has no build for {2} yet.",
+    "blockLineDepsNoBuild_other": "{0} stops Play: it needs {1}, which have no builds for {2} yet.",
+    "badgeRevokedHintNoReason": "Pulled from the index, with no reason given.",
+    "unmanagedCause_one": "Own folder: {n} file, loads in every version",
+    "unmanagedCause_other": "Own folder: {n} files, load in every version",
+    "indexUnreachableShort": "Index unreachable: no Reviewed mods",
+    "sourceCauseRate": "GitHub rate limit:",
+    "sourceCauseGone": "Source not found:",
+    "sourceCauseInvalid": "Source unreadable:",
+    "sourceCauseDisk": "Couldn't save source:",
+    "sourceCauseNetwork": "Source unreachable:",
+    "sourceCauseServer": "GitHub error:",
+    "shadowCause": "Your own folder's copy loads instead of:",
+    "tryUpdate": "Try {0}…",
+    "turnOffAll_one": "Turn off all {n}",
+    "turnOffAll_other": "Turn off all {n}",
+    "failureLogLine": "Log line",
+    "indexSays": "The index says: “{0}”",
+    "indexGaveNoReason": "The index gave no reason.",
+    "detailsLabel": "{0}: details",
+    "refusedUnread": "Weft didn't start because of its mods, and they couldn't be read again to say which: {0}",
+    "refusedRetry": "Check mods again",
+    "homeProfileFailed": "Couldn't read the mods for {0}: {1}",
+    "sourceNoModsLineNoReleases": "No compatible mod releases found: it has no releases yet.",
+    "sourceNoModsLineNoFiles": "No compatible mod releases found: no release has an <id>.zip with its <id>.mod.json.",
+    "sourceNoModsLineUnreadable": "No compatible mod releases found: a release's <id>.mod.json couldn't be read.",
+    "sourceNoModsLineNoDigest": "No compatible mod releases found: GitHub has no SHA-256 for its zips, so they can't be checked.",
+    "sourceNoModsLineDisagrees": "No compatible mod releases found: a release's <id>.mod.json doesn't match that release on GitHub.",
+    "sourceNoModsLineInvalid": "No compatible mod releases found: its releases break a rule every mod follows.",
+    "sourcesIndexUnsaved": "It couldn't be saved on this computer: it is fetched again at the next start, and until then an older saved copy is what shows offline.",
+    "indexUnsaved": "The mod index in use couldn't be saved on this computer. It works now; it is fetched again at the next start.",
+    "indexUnsavedShort": "Mod index not saved: works until restart",
+    "sourceRetryLabel": "Ask {0} again",
+    "tabInstalledLabel_other": "Installed in {0}: {n} mods",
+    "typedNotPassed_other": "Not shown to be safe ({n}):",
+    "removeDoubleClick": "A double-click doesn't remove {0}. Press Remove again to confirm.",
+    "ckBuiltIncomplete": "The signed index has an incomplete build record",
+    "ckBuiltIncompleteDetail": "It doesn't give all of the repo, workflow, commit and when it was checked, so how this file was built is unknown",
+    "sourcePending": "Still checking {0}…",
+    "sourcesPending_one": "Still checking {n} source…",
+    "sourcesPending_other": "Still checking {n} sources…",
+    "turnOnAsk": "Turn on {0}? Play stops until this is fixed:",
+    "keepOff": "Keep it off",
+    "turnOnAnyway": "Turn on anyway",
+    "crashNoneNamed": "The log names no mod. If it happens again, try without mods.",
+    "crashTurnOffAll": "Turn off all mods for {0}",
+    "crashAllOff_one": "Turned off {n} mod for {0}. Press Play to try without it.",
+    "crashAllOff_other": "Turned off {n} mods for {0}. Press Play to try without them.",
+    "crashAllOn_one": "Turned {n} mod for {0} back on.",
+    "crashAllOn_other": "Turned {n} mods for {0} back on.",
+    "checksPassed_one": "{n} check passed",
+    "checksPassed_other": "{n} checks passed",
+    "checksShow": "Show",
+    "checksHide": "Hide",
+    "checksShowDetails": "Show details",
+    "copyIntroNone": "Nothing in {0} changes:",
+    "copyEvidenceShow": "Show checks",
+    "copyEvidenceHide": "Hide checks",
+    "copyEvidenceFor": "What is known of {0}",
+    "copyNoEvidence": "The catalogue no longer lists this build",
+    "copyIntro_one": "Copying adds {n} mod to {0}. Nothing {0} has now is removed or replaced.",
+    "copyIntro_other": "Copying adds {n} mods to {0}. Nothing {0} has now is removed or replaced.",
+    "ckTierDrop": "Was {0}, this build is {1}",
+    "ckTierDropSaid": "Lower tier",
+    "replaceFromFile": "Replace {0} from file…",
+    "homeModsOwn_one": "Mods for {0}: {1}, and {n} file from your own folder",
+    "homeModsOwn_other": "Mods for {0}: {1}, and {n} files from your own folder",
+    "homeModsOnlyOwn_one": "No mods for {0}, but {n} file from your own folder loads",
+    "homeModsOnlyOwn_other": "No mods for {0}, but {n} files from your own folder load",
+    "indexUnavailableStatusShort": "No mod index (server said {0}): no Reviewed mods",
+    "browseNoIndex": "Reviewed mods appear here once the Weft mod index can be fetched.",
+    "sourceErrRateUntil": "GitHub is limiting requests until {1}, so {0} couldn't be refreshed.",
+    "reinstall": "Install {0} again…"
   },
   "sizeUnits": {
     "B": "B",
     "KB": "KB",
     "MB": "MB",
     "GB": "GB"
-  }
-}
\ No newline at end of file
+  },
+  "heroBadgeBlocked": "VERSION {0} · MODS NEED A FIX",
+  "deleteWithMods_one": "Delete with its {n} mod",
+  "deleteWithMods_other": "Delete with its {n} mods",
+  "versionModCount_one": "{n} mod",
+  "versionModCount_other": "{n} mods",
+  "versionModsBlocked": "Mods stop it from starting. Fix them on Home or the Mods tab.",
+  "heroBadgeChecking": "VERSION {0} · CHECKING MODS",
+  "heroBadgeUnchecked": "VERSION {0} · MODS NOT CHECKED",
+  "starting": "Starting...",
+  "deleteConfirmHint": "Press again to delete {0} with its mods. This can't be undone.",
+  "deleteConfirmHintBare": "Press again to delete {0}. This can't be undone.",
+  "deleteCancelled": "{0} stays installed.",
+  "deleteDoubleClick": "A double-click doesn't delete {0}. Press Delete again to confirm."
+}
diff --git a/src/i18n/errors.test.ts b/src/i18n/errors.test.ts
new file mode 100644
index 0000000..3e62ea7
--- /dev/null
+++ b/src/i18n/errors.test.ts
@@ -0,0 +1,52 @@
+import { describe, expect, it } from "vitest";
+import { asAppError, rateLimitReset, showError, urlRule } from "./errors";
+
+describe("one parser for rejections", () => {
+  it("keeps a known code and its detail", () => {
+    expect(asAppError({ code: "DiskFull", detail: "os error 28" })).toEqual({ code: "DiskFull", detail: "os error 28" });
+    expect(showError({ code: "DiskFull", detail: "os error 28" }).detail).toBe("os error 28");
+  });
+
+  it("never passes off an unknown code, a thrown Error or a string as a known failure", () => {
+    expect(asAppError({ code: "SomethingNew", detail: "x" })).toEqual({ code: "Unknown", detail: "SomethingNew: x" });
+    expect(asAppError(new Error("boom"))).toEqual({ code: "Unknown", detail: "boom" });
+    expect(asAppError("plugin said no")).toEqual({ code: "Unknown", detail: "plugin said no" });
+    expect(asAppError({ code: "Unknown", detail: "  " })).toEqual({ code: "Unknown", detail: null });
+    // showError says the same as asAppError parsed, for every one of them.
+    for (const err of [{ code: "SomethingNew", detail: "x" }, new Error("boom"), "plugin said no"]) {
+      expect(showError(err).detail).toBe(asAppError(err).detail);
+    }
+  });
+
+  it("says nothing for nothing", () => {
+    expect(showError(null)).toEqual({ message: "", detail: null });
+  });
+});
+
+describe("a source's rate limit", () => {
+  it("says until when, when GitHub said, and never puts the detail in the sentence", () => {
+    const at = Date.UTC(2026, 10, 5, 14, 32) / 1000;
+    const limited = { code: "ModSourceRateLimited", detail: `resets at ${at}` } as const;
+    expect(rateLimitReset(limited)?.getTime()).toBe(at * 1000);
+    const shown = showError(limited);
+    expect(shown.message).toMatch(/^GitHub is limiting requests until .+\. Try again then\.$/);
+    expect(shown.message).not.toContain("resets at");
+    expect(shown.detail).toBeNull();
+    expect(showError({ code: "ModSourceRateLimited", detail: null }).message).toBe("GitHub is limiting requests. Try again in a few minutes.");
+    expect(rateLimitReset({ code: "RateLimited", detail: `resets at ${at}` })).toBeNull();
+  });
+});
+
+describe("a refused download link", () => {
+  it("says which rule it broke, with the link behind Details", () => {
+    const url = "http://github.com/a/b/releases/download/t/x.zip";
+    expect(urlRule(`notHttps ${url}`)).toEqual({ kind: "host", url });
+    const shown = showError({ code: "ModUrlRefused", detail: `notReleaseAsset ${url}` });
+    expect(shown.message).toBe("A download link pointed at a file other than this mod's release on its GitHub repo, so the launcher refused it. Nothing was downloaded.");
+    expect(shown.detail).toBe(url);
+    // A rule this build doesn't know: the general sentence, and the whole detail.
+    const other = showError({ code: "ModUrlRefused", detail: `somethingNew ${url}` });
+    expect(other.message).toMatch(/^A download link didn't point where/);
+    expect(other.detail).toBe(`somethingNew ${url}`);
+  });
+});
diff --git a/src/i18n/errors.ts b/src/i18n/errors.ts
index 49d732a..6431445 100644
--- a/src/i18n/errors.ts
+++ b/src/i18n/errors.ts
@@ -1,42 +1,176 @@
-import { t } from './index';
+import { formatTime, t, type MessageKey } from './index';
+import type { ErrorCode, UiError } from '../mods/types';
 
-// Rust sends variant names, the language files use camelCase keys.
-const KEY_FOR_CODE: Record<string, string> = {
-  Serde: 'serialization',
-  InvalidHeader: 'httpHeader',
+// Every code the backend can send, and the message for it. A Record over the closed union, so a
+// new code fails `tsc` until it has a message; `npm run check:i18n` checks every locale has it.
+export const ERROR_KEY: Record<ErrorCode, MessageKey> = {
+  Network: 'errors.network',
+  HttpStatus: 'errors.httpStatus',
+  Io: 'errors.io',
+  Serde: 'errors.serialization',
+  InvalidHeader: 'errors.httpHeader',
+  CacheCorrupted: 'errors.cacheCorrupted',
+  RateLimited: 'errors.rateLimited',
+  Forbidden: 'errors.forbidden',
+  OfflineNoCache: 'errors.offlineNoCache',
+  DiskFull: 'errors.diskFull',
+  AssetNotFound: 'errors.assetNotFound',
+  MissingDigest: 'errors.missingDigest',
+  Zip: 'errors.zip',
+  CreateDir: 'errors.createDir',
+  Sha256Mismatch: 'errors.sha256Mismatch',
+  HashMissing: 'errors.hashMissing',
+  AlreadyInstalled: 'errors.alreadyInstalled',
+  NotInstalled: 'errors.notInstalled',
+  DownloadFailed: 'errors.downloadFailed',
+  ExtractFailed: 'errors.extractFailed',
+  GameRunning: 'errors.gameRunning',
+  VersionInUse: 'errors.versionInUse',
+  InvalidName: 'errors.invalidName',
+  InstallInProgress: 'errors.installInProgress',
+  AlreadyRunning: 'errors.alreadyRunning',
+  AnotherGameRunning: 'errors.anotherGameRunning',
+  ExecutableNotFound: 'errors.executableNotFound',
+  ProcessSpawnFailed: 'errors.processSpawnFailed',
+  LogDirCreateFailed: 'errors.logDirCreateFailed',
+  GameFolderNotFound: 'errors.gameFolderNotFound',
+  OpenerError: 'errors.openerError',
+  IndexSignatureInvalid: 'errors.indexSignatureInvalid',
+  IndexRollback: 'errors.indexRollback',
+  IndexInvalid: 'errors.indexInvalid',
+  AbiUnavailable: 'errors.abiUnavailable',
+  ModNotInCatalog: 'errors.modNotInCatalog',
+  ModIncompatible: 'errors.modIncompatible',
+  ModNotForPlatform: 'errors.modNotForPlatform',
+  ModRevoked: 'errors.modRevoked',
+  ModArchiveInvalid: 'errors.modArchiveInvalid',
+  ModFileChanged: 'errors.modFileChanged',
+  ModNotInstalled: 'errors.modNotInstalled',
+  ModStoreMissing: 'errors.modStoreMissing',
+  ModsBlocked: 'errors.modsBlocked',
+  ModSourceInvalid: 'errors.modSourceInvalid',
+  ModSourceNotFound: 'errors.modSourceNotFound',
+  ModSourcesDamaged: 'errors.modSourcesDamaged',
+  ModSourceRateLimited: 'errors.modSourceRateLimited',
+  ModDownloadNotFound: 'errors.modDownloadNotFound',
+  ModTooLarge: 'errors.modTooLarge',
+  ModIdReserved: 'errors.modIdReserved',
+  ModChangedMeanwhile: 'errors.modChangedMeanwhile',
+  ModCancelled: 'errors.modCancelled',
+  ModLockInvalid: 'errors.modLockInvalid',
+  ModUrlRefused: 'errors.modUrlRefused',
+  ModIconInvalid: 'errors.modIconInvalid',
 };
 
-export function errorKey(code: string): string {
-  const name = KEY_FOR_CODE[code] ?? code.charAt(0).toLowerCase() + code.slice(1);
-  return `errors.${name}`;
+export function isErrorCode(code: unknown): code is ErrorCode {
+  return typeof code === 'string' && code in ERROR_KEY;
 }
 
-export function translateError(err: unknown): string {
-  if (err === null || err === undefined) {
-    return '';
-  }
+export function errorKey(code: ErrorCode): MessageKey {
+  return ERROR_KEY[code];
+}
 
-  if (typeof err === 'string') {
-    return err;
-  }
+/** A failure as the player sees it: a translated sentence, and what the backend said, if anything more. */
+export interface Shown {
+  message: string;
+  /**
+   * The backend's own words (an OS error, a parser's complaint), in English. Never spliced into the
+   * sentence; shown behind "Details", for the player to search for or report.
+   */
+  detail: string | null;
+}
 
-  if (err instanceof Error) {
-    return err.message;
+/**
+ * A failure as a sentence. A message with a `{0}` takes the detail when the backend sends a name
+ * there (a mod, a version, a repo); every other detail is kept apart, for "Details". Anything
+ * this build doesn't know says so, with what there is as its detail.
+ */
+export function showError(err: unknown): Shown {
+  if (err === null || err === undefined) return { message: '', detail: null };
+  const e = asAppError(err);
+  if (e.code === 'ModUrlRefused') {
+    // Which rule the link broke, in words; the link itself behind Details.
+    const refusal = urlRule(e.detail);
+    if (refusal) return { message: t(URL_RULE_MESSAGE[refusal.kind]), detail: refusal.url || null };
+  }
+  if (e.code === 'ModSourceRateLimited') {
+    // When GitHub said the limit ends, that is what to say: "until 14:32".
+    const until = rateLimitReset(e);
+    return { message: until ? t('errors.modSourceRateLimitedUntil', formatTime(until)) : t('errors.modSourceRateLimited'), detail: null };
   }
+  if (e.code !== 'Unknown') {
+    const key = ERROR_KEY[e.code];
+    if (takesDetail(key)) return { message: t(key, e.detail ?? ''), detail: null };
+    return { message: t(key), detail: e.detail };
+  }
+  return { message: t('errors.unknownBare'), detail: e.detail };
+}
 
-  if (typeof err === 'object' && err !== null) {
-    const obj = err as Record<string, unknown>;
-    if (typeof obj.code === 'string') {
-      const code = obj.code;
-      const detail = typeof obj.detail === 'string' ? obj.detail : '';
-      const translationKey = errorKey(code);
-      const translated = t(translationKey, detail);
-      if (translated !== translationKey) {
-        return translated;
-      }
-      return code;
-    }
+/**
+ * Whatever a command rejected with. A payload with a code this build knows stays as it is;
+ * anything else (a code from a newer backend, a thrown Error, a plain string) is "Unknown" with
+ * what there is to say, never passed off as a known failure. In development, such a rejection is
+ * logged: a Tauri plugin's or a newer backend's errors drifting from `AppErrorPayload` show up.
+ */
+export function asAppError(err: unknown): UiError {
+  if (err && typeof err === 'object' && 'code' in err) {
+    const { code, detail } = err as { code: unknown; detail?: unknown };
+    const text = typeof detail === 'string' && detail.trim() ? detail : null;
+    if (isErrorCode(code)) return { code, detail: text };
+    if (code === 'Unknown') return { code: 'Unknown', detail: text };
+    drifted(err);
+    return { code: 'Unknown', detail: typeof code === 'string' ? (text ? `${code}: ${text}` : code) : text };
   }
+  drifted(err);
+  const detail = err instanceof Error ? err.message : err == null ? null : String(err);
+  return { code: 'Unknown', detail: detail || null };
+}
+
+function drifted(err: unknown) {
+  if (import.meta.env.DEV && import.meta.env.MODE !== 'test') console.warn('A rejection that is not an AppErrorPayload:', err);
+}
 
-  return String(err);
-}
\ No newline at end of file
+/** The sentence alone, where there is no room for Details (a check row, a banner line). */
+export function translateError(err: unknown): string {
+  return showError(err).message;
+}
+
+/**
+ * When GitHub said a source's rate limit ends: the backend's detail for `ModSourceRateLimited`
+ * is "resets at <Unix seconds>" (src-tauri/src/mods/error.rs) when it said. Null otherwise.
+ */
+export function rateLimitReset(error: { code: string; detail: string | null } | null | undefined): Date | null {
+  if (error?.code !== 'ModSourceRateLimited') return null;
+  const m = /^resets at (\d+)$/.exec(error.detail ?? '');
+  return m ? new Date(Number(m[1]) * 1000) : null;
+}
+
+/** The rules a download link can break (src-tauri/src/mods/index/format.rs `UrlProblem`), by what the player can tell from them. */
+const URL_RULES: Record<string, 'host' | 'form' | 'asset'> = {
+  notHttps: 'host',
+  notGithub: 'host',
+  backslash: 'form',
+  percentEncoded: 'form',
+  notAUrl: 'form',
+  notCanonical: 'form',
+  queryOrFragment: 'form',
+  noPath: 'form',
+  badRepo: 'asset',
+  notReleaseAsset: 'asset',
+};
+const URL_RULE_MESSAGE: Record<'host' | 'form' | 'asset', MessageKey> = {
+  host: 'errors.modUrlRefusedHost',
+  form: 'errors.modUrlRefusedForm',
+  asset: 'errors.modUrlRefusedAsset',
+};
+
+/** The rule a refused download link broke and the link, from `ModUrlRefused`'s detail ("<rule> <url>"). */
+export function urlRule(detail: string | null): { kind: 'host' | 'form' | 'asset'; url: string } | null {
+  const m = /^([A-Za-z]+) (.*)$/s.exec(detail ?? '');
+  const kind = m ? URL_RULES[m[1]] : undefined;
+  return m && kind ? { kind, url: m[2] } : null;
+}
+
+function takesDetail(key: MessageKey): boolean {
+  return t(key, '\u0000').includes('\u0000');
+}
diff --git a/src/i18n/es.json b/src/i18n/es.json
index 45d13b8..d3556d4 100644
--- a/src/i18n/es.json
+++ b/src/i18n/es.json
@@ -1,21 +1,17 @@
 {
-  "appTitle": "Weft Launcher",
   "latestBadge": "Última",
   "updateAvailable": "ACTUALIZACIÓN DISPONIBLE",
-"updateDownloading": "ACTUALIZANDO {0}%",
-"updateFailed": "ERROR AL ACTUALIZAR · REINTENTAR",
-"updateTooltip": "Actualizar a la versión {0} y reiniciar",
-"updateCloseGame": "Cierra el juego antes de actualizar",
+  "updateDownloading": "ACTUALIZANDO {0}%",
+  "updateFailed": "ERROR AL ACTUALIZAR · REINTENTAR",
+  "updateTooltip": "Actualizar a la versión {0} y reiniciar",
+  "updateCloseGame": "Cierra el juego antes de actualizar",
   "refreshButton": "Actualizar lista",
   "loading": "Cargando...",
   "cacheBanner": "Mostrando caché (sin conexión o sin actualizaciones)",
-  "errorPrefix": "Error: ",
   "emptyState": "No se encontraron versiones.",
   "installButton": "Instalar",
-  "installedBadge": "Instalada",
   "deleteButton": "Eliminar",
   "deleteForReal": "Eliminar ya",
-  "confirmDelete": "¿Seguro que quieres eliminar esta versión? Esta acción no se puede deshacer.",
   "playButton": "Jugar",
   "playing": "Jugando...",
   "progressDownloading": "Descargando... {0}% — {1} Mbps",
@@ -25,10 +21,6 @@
   "deleteDisabledTooltip": "Cierra el juego para eliminar",
   "playDisabledTooltip": "Otro juego se está ejecutando: {0}",
   "installedAtLabel": "Instalada el",
-  "linkDiscord": "Discord",
-  "linkWebsite": "Sitio web",
-  "releasedLabel": "Lanzamiento",
-  "inUseBadge": "En uso",
   "noChangelog": "Sin notas de versión.",
   "newBadge": "Nueva",
   "openFolderButton": "Abrir carpeta",
@@ -36,6 +28,8 @@
   "openLogButton": "Abrir registro",
   "tabHome": "Inicio",
   "tabVersions": "Versiones",
+  "tabMods": "Mods",
+  "newVersionsDot": "Hay versiones nuevas",
   "tabNotes": "Notas de versión",
   "tabsLabel": "Pestañas principales",
   "selectVersionLabel": "Seleccionar versión",
@@ -45,40 +39,547 @@
   "instanceCardTitle": "Instancia",
   "versionLabel": "Versión",
   "gameFolderTitle": "Carpeta del juego",
-  "prereleaseBadge": "Preliminar",
+  "prereleaseBadge": "Preversión",
   "heroBadge": "VERSIÓN {0} · LISTO",
   "heroBadgePlaying": "VERSIÓN {0} · JUGANDO",
   "errors": {
     "invalidName": "Nombre no válido: {0}",
     "installInProgress": "Ya se está instalando: {0}",
-    "network": "Error de red: {0}",
-    "io": "Error de E/S: {0}",
-    "serialization": "Error de serialización: {0}",
-    "httpHeader": "Error de cabecera HTTP: {0}",
-    "cacheCorrupted": "Caché dañada: {0}",
-    "assetNotFound": "Archivo no encontrado para la plataforma actual",
-    "missingDigest": "Falta el digest SHA256 en el archivo",
+    "network": "El launcher no pudo conectar con el servidor. Revisa tu conexión y vuelve a intentarlo.",
+    "httpStatus": "El servidor respondió, pero con un error. Inténtalo de nuevo más tarde.",
+    "io": "No se pudo leer o escribir un archivo.",
+    "serialization": "Llegó una respuesta que el launcher no pudo leer.",
+    "httpHeader": "El servidor envió una respuesta que el launcher no puede usar.",
+    "cacheCorrupted": "La copia guardada está dañada. Actualiza para descargarla de nuevo.",
+    "assetNotFound": "Esta versión no tiene un archivo para tu sistema.",
+    "missingDigest": "Esta versión no publica el SHA-256 de su archivo, así que el launcher no puede comprobarlo.",
     "rateLimited": "Límite de la API de GitHub superado. Inténtalo más tarde.",
     "forbidden": "Acceso denegado a la API de GitHub (403). Usando caché si existe.",
     "offlineNoCache": "Sin conexión y sin caché disponible",
-    "zip": "Error en ZIP: {0}",
-    "createDir": "Error al crear directorio: {0}",
-    "sha256Mismatch": "El SHA256 no coincide",
-    "hashMissing": "Falta el SHA256 obligatorio",
+    "zip": "La descarga no es un zip que el launcher pueda abrir.",
+    "createDir": "No se pudo crear una carpeta.",
+    "sha256Mismatch": "La descarga no coincidió con su SHA-256 fijado, así que no se instaló nada. Vuelve a intentarlo; si se repite, el archivo del servidor cambió.",
+    "hashMissing": "Nada indica cuál debe ser el SHA-256 de este archivo, así que no se puede comprobar.",
     "alreadyInstalled": "Versión ya instalada: {0}",
     "notInstalled": "Versión no instalada: {0}",
-    "downloadFailed": "Error de descarga: {0}",
-    "extractFailed": "Error de extracción: {0}",
+    "downloadFailed": "La descarga falló. Vuelve a intentarlo.",
+    "extractFailed": "No se pudo descomprimir el juego.",
     "gameRunning": "Otro juego se está ejecutando: {0}. Ciérralo antes de iniciar otro.",
     "versionInUse": "Versión en uso (archivo bloqueado): {0}. Cierra el juego para eliminarla.",
     "alreadyRunning": "Esta versión ya se está ejecutando",
     "anotherGameRunning": "Otro juego se está ejecutando: {0}",
     "executableNotFound": "Ejecutable no encontrado: {0}",
-    "processSpawnFailed": "Error al iniciar proceso: {0}",
-    "logDirCreateFailed": "Error al crear directorio de logs: {0}",
-    "gameFolderNotFound": "Carpeta del juego no encontrada: {0}",
-    "unsupportedPlatform": "Ubicación de la carpeta del juego no confirmada en esta plataforma",
-    "openerError": "Error al abrir: {0}"
+    "processSpawnFailed": "No se pudo iniciar el juego.",
+    "logDirCreateFailed": "No se pudo crear la carpeta de registros.",
+    "gameFolderNotFound": "Aún no se conoce la carpeta del juego. Inicia el juego una vez y el launcher la encontrará.",
+    "openerError": "No se pudo abrir.",
+    "indexSignatureInvalid": "El índice de mods no pasó la comprobación de firma.",
+    "indexRollback": "El índice de mods que llegó es más antiguo que el ya verificado, así que se ignoró.",
+    "indexInvalid": "No se puede leer el índice de mods.",
+    "abiUnavailable": "No se pudo averiguar qué mods sirven para {0}. Revisa tu conexión.",
+    "modNotInCatalog": "Ese mod ya no está en el catálogo. Actualiza e inténtalo de nuevo.",
+    "modIncompatible": "{0} no está compilado para esta versión del juego",
+    "modNotForPlatform": "{0} no tiene biblioteca para este sistema",
+    "modRevoked": "Retirado del índice: {0}",
+    "modArchiveInvalid": "Este archivo no es un mod de Weft.",
+    "modFileChanged": "El archivo cambió después de comprobarlo. Vuelve a elegirlo.",
+    "modNotInstalled": "Ese mod ya no está instalado: {0}",
+    "modsBlocked": "Weft no arrancará con estos mods activados: {0}.",
+    "modSourceInvalid": "No es un repositorio de GitHub: {0}",
+    "modSourceNotFound": "No existe ese repositorio de GitHub: {0}",
+    "diskFull": "El disco está lleno.",
+    "modSourceRateLimited": "GitHub está limitando las peticiones. Vuelve a intentarlo en unos minutos.",
+    "modDownloadNotFound": "El archivo del mod ya no está en GitHub ({0}), así que no se instaló nada. Actualiza y vuelve a intentarlo.",
+    "modTooLarge": "El archivo del mod es más grande de lo que acepta el launcher, así que no se instaló nada.",
+    "modIdReserved": "\"{0}\" está reservado para el propio Weft y no puede ser el id de un mod.",
+    "modChangedMeanwhile": "Algo cambió desde que lo miraste, así que no se instaló nada. Mira qué cambió y vuelve a confirmar.",
+    "unknownBare": "Pasó algo que el launcher no esperaba.",
+    "modCancelled": "Cancelado. No se cambió nada.",
+    "modLockInvalid": "La lista de mods de esta versión está dañada, así que el launcher no la cambiará. Elimina la carpeta de mods de la versión o reinstala la versión.",
+    "modUrlRefused": "Un enlace de descarga no apuntaba adonde dice la ficha del mod, así que el launcher lo rechazó. No se descargó nada.",
+    "modIconInvalid": "El icono de este mod no es un PNG pequeño, así que no se muestra.",
+    "details": "Detalles",
+    "modSourcesDamaged": "No se pudo leer tu lista de fuentes de mods, así que se apartó y se guardó. Vuelve a añadir tus fuentes; la lista antigua está en Detalles.",
+    "modSourceRateLimitedUntil": "GitHub está limitando las peticiones hasta las {0}. Vuelve a intentarlo entonces.",
+    "modUrlRefusedHost": "Un enlace de descarga apuntaba fuera de github.com, o no usaba https, así que el launcher lo rechazó. No se descargó nada.",
+    "modUrlRefusedForm": "Un enlace de descarga no estaba escrito de la forma sencilla de un enlace de descarga de GitHub, así que el launcher lo rechazó. No se descargó nada.",
+    "modUrlRefusedAsset": "Un enlace de descarga apuntaba a un archivo que no es la versión de este mod en su repositorio de GitHub, así que el launcher lo rechazó. No se descargó nada.",
+    "modStoreMissing": "La copia de {0} que guardaba el launcher ya no está, así que no se puede pasar al juego. Vuelve a instalarlo para jugar con él."
   },
-  "sizeUnits": { "B": "B", "KB": "KB", "MB": "MB", "GB": "GB" }
-}
\ No newline at end of file
+  "mods": {
+    "title": "Mods",
+    "fromFile": "Desde archivo",
+    "fileFilter": "Mod de Weft",
+    "sources": "Fuentes",
+    "refresh": "Buscar mods nuevos",
+    "tabInstalled": "Instalados",
+    "tabInstalledLabel_one": "Instalados en {0}: {n} mod",
+    "tabBrowse": "Explorar",
+    "installedListLabel": "Mods instalados para {0}",
+    "noVersions": "Primero instala una versión del juego. Cada versión guarda sus propios mods.",
+    "emptyInstalled": "Todavía no hay mods para {0}.",
+    "browseMods": "Explorar mods",
+    "copyButton": "Copiar mods de {0}",
+    "runningBanner": "{0} está en ejecución. Ciérralo para cambiar sus mods.",
+    "revocationsPending": "Retirado del índice: {0}. Se desactivará en cuanto se cierre el juego.",
+    "unmanagedBanner": "Tu propia carpeta de mods de Weft contiene {0}. Esos mods cargan en todas las versiones y el launcher no puede comprobarlos.",
+    "unmanagedShow": "Abrir carpeta",
+    "abiUnknown": "No se pudo comprobar qué mods sirven para {0}. El juego los comprueba al arrancar.",
+    "dismiss": "Cerrar",
+    "metaBuiltFor": "compilado para {0}",
+    "metaBuiltForThis": "sirve para {0}",
+    "metaFromSource": "de {0}",
+    "metaNeeds": "necesita {0}",
+    "statusOff": "Desactivado. El juego no lo ve.",
+    "statusWrongVersion": "Compilado para otra versión del juego: impide Jugar.",
+    "statusWrongVersionTag": "Compilado para {0}: impide Jugar.",
+    "statusRevoked": "Desactivado, retirado del índice (en inglés): «{0}»",
+    "statusUnchecked": "No se puede comprobar antes de que arranque el juego.",
+    "statusUncheckedFile": "De tu equipo ({0}). Se comprueba al arrancar el juego.",
+    "on": "Activado",
+    "off": "Desactivado",
+    "remove": "Quitar",
+    "removeConfirm": "Confirmar",
+    "removeLabel": "Quitar {0}",
+    "update": "Actualizar a {0}…",
+    "updateButton": "Actualizar",
+    "badgeReviewed": "Revisado",
+    "badgeUnreviewed": "Sin revisar",
+    "badgeUnverified": "Sin verificar",
+    "badgeReviewedHint": "En el índice firmado de mods de Weft: alguien revisó exactamente este archivo.",
+    "badgeUnreviewedHint": "De un repositorio de GitHub que añadiste. Lo publica ese repositorio; nadie lo revisó.",
+    "badgeUnverifiedHint": "Un archivo de tu equipo. No se puede comprobar de dónde viene.",
+    "badgePrerelease": "Preversión",
+    "badgeExperimental": "Experimental",
+    "searchPlaceholder": "Buscar mods",
+    "filterFits": "Sirve para {0}",
+    "filterPrereleases": "Preversiones",
+    "install": "Instalar",
+    "installed": "Instalado",
+    "notForVersion": "Sin compilación para {0}",
+    "onlyPrerelease": "Solo preversiones",
+    "noSummary": "Sin descripción.",
+    "browseEmpty": "Ningún mod coincide con la búsqueda.",
+    "browseEmptyFits": "Ningún mod tiene todavía una compilación para {0}.",
+    "browseEmptyAll": "No se encontraron mods.",
+    "showAll": "Mostrar todos los mods",
+    "indexInvalid": "El índice más reciente que llegó no pasó la comprobación de firma y se ignoró.",
+    "indexRollback": "El índice que llegó es más antiguo que el ya verificado, así que se ignoró.",
+    "by": "de {0}",
+    "dlgInstallTitle": "¿Instalar {0} {1} para {2}?",
+    "dlgUpdateTitle": "¿Actualizar {0} a {1} en {2}?",
+    "dlgVersion": "Versión",
+    "checksLabel": "Lo que comprobó el launcher",
+    "ckIndex": "Está en el índice de mods de Weft",
+    "ckIndexDetail": "Revisado por {0} el {1} · firma del índice verificada",
+    "ckNotIndex": "No está en el índice de mods de Weft",
+    "ckNotIndexDetail": "Publicado por {0}. Nadie lo revisó.",
+    "ckPinned": "Descarga fijada por el SHA-256 {0} del índice firmado",
+    "ckBuilt": "El índice firmado registra: compilado por GitHub Actions en {0} @ {1}, comprobado por {2} el {3}",
+    "ckNoBuild": "Sin registro de compilación",
+    "ckNoBuildDetail": "Nada indica a partir de qué código se compiló este archivo",
+    "ckFits": "La interfaz de mods declarada coincide con esta versión",
+    "ckFitsDetail": "La compilación declara la interfaz de mods {0}.",
+    "warnNative": "Los mods son programas. {0} puede hacer todo lo que tú puedes hacer en este equipo. Estas comprobaciones muestran de dónde viene, no que sea inofensivo.",
+    "warnUnreviewed": "Nadie revisó {0}. Puede hacer todo lo que tú puedes hacer en este equipo. Instálalo solo si confías en {1}.",
+    "viewSource": "Ver código",
+    "cancel": "Cancelar",
+    "close": "Cerrar",
+    "fileChecking": "Comprobando {0} para {1}…",
+    "fileUnverifiedTitle": "¿Instalar {0}, sin verificar, para {1}?",
+    "fileKnownTitle": "¿Instalar {0} {1} para {2} desde este archivo?",
+    "fileNotAModTitle": "{0} no se puede instalar para {1}",
+    "fileFrom": "{0} de tu equipo · {1}",
+    "fileSaysItIs": "Dice llamarse {0}.",
+    "ckFileNotKnown": "No está en el índice de mods de Weft ni en tus fuentes",
+    "ckFileKnown": "Es el mismo archivo que {0} {1} del catálogo",
+    "ckFileFitUnknown": "No se sabe si sirve",
+    "ckFileFitUnknownDetail": "Weft lo comprueba al arrancar. Si no sirve, el juego no arrancará.",
+    "ckFileFitsNo": "No está compilado para {0}",
+    "ckLooksLikeMod": "Parece un mod de Weft",
+    "ckNotForSystem": "No hay biblioteca para este sistema",
+    "ckNotForSystemDetail": "Tiene una para: {0}",
+    "ckNotAMod": "No es un mod de Weft",
+    "ckRevoked": "Retirado del índice. Motivo, en inglés: {0}",
+    "warnFile": "Instala solo archivos de personas en las que confíes. Un mod puede leer, cambiar o borrar tus archivos y enviarlos a cualquier sitio.",
+    "installAnyway": "Instalar de todos modos",
+    "sourcesTitle": "Fuentes de mods",
+    "sourcesIntro": "El índice de mods de Weft siempre está activo. También puedes añadir repositorios de GitHub que publiquen mods; sus versiones aparecen como Sin revisar.",
+    "sourcesIndex": "Índice de mods de Weft",
+    "sourcesIndexFresh": "Comprobado en esta actualización.",
+    "sourcesIndexNone": "aún no se ha alcanzado",
+    "sourcesAddLabel": "Repositorio de GitHub",
+    "sourcesAddPlaceholder": "usuario/repo o enlace de GitHub",
+    "sourcesAdd": "Añadir",
+    "sourcesRemove": "Quitar",
+    "sourcesWarning": "Cualquiera puede publicar un repositorio. Añade solo los que sean de confianza.",
+    "noticeInstalled": "{0} está instalado y activado.",
+    "noticeDepsInstalled": "También se instaló lo que necesita: {0}.",
+    "noticeAlsoEnabled": "También se activó lo que necesita: {0}.",
+    "noticeAlsoDisabled": "También se desactivó lo que lo necesita: {0}.",
+    "attentionDot": "Hay mods que revisar",
+    "homeMods": "Mods para {0}: {1}",
+    "homeModsNone": "Sin mods para {0}",
+    "homeChange": "Cambiar",
+    "homeAdd": "Añadir mods",
+    "homeFixInMods": "Arreglar en Mods",
+    "failureWrongVersion": "{0} impidió que Weft arrancara: se compiló para otra versión.",
+    "failureMissingDep": "{0} impidió que Weft arrancara: necesita {1}.",
+    "failureLoad": "{0} impidió que Weft arrancara: su biblioteca no cargó.",
+    "failureNotAMod": "{0} impidió que Weft arrancara: no es un mod de Weft.",
+    "failureWrongName": "{0} impidió que Weft arrancara: su archivo tiene un nombre incorrecto.",
+    "failureInit": "Un mod falló mientras Weft arrancaba. Abre el registro para ver cuál, o desactiva los mods de uno en uno para encontrarlo.",
+    "failureOutside": "Está en tu propia carpeta de mods de Weft, que el launcher no gestiona.",
+    "turnOff": "Desactivar {0}",
+    "openModsFolder": "Abrir carpeta de mods",
+    "versionPicker": "Versión",
+    "viewsLabel": "Mods para {0}",
+    "copyHeader": "Copiar mods de…",
+    "copying": "Copiando…",
+    "retry": "Reintentar",
+    "retrying": "Reintentando…",
+    "manageSources": "Gestionar fuentes",
+    "bannersOpen": "Más",
+    "bannersMore_one": "{n} aviso",
+    "bannersMore_many": "{n} avisos",
+    "bannersMore_other": "{n} avisos",
+    "bannersFold": "Mostrar menos",
+    "abiUnknownBrowse": "No se pudo averiguar qué mods sirven para {0}, así que ahora no se puede instalar ninguno. Revisa tu conexión y actualiza.",
+    "catalogFailed": "No se pudo cargar la lista de mods.",
+    "catalogMissing": "Este mod no está en el catálogo cargado. Actualiza y vuelve a intentarlo.",
+    "installLabel": "Instalar {0} para {1}…",
+    "updateLabel": "Actualizar {0} para {1}…",
+    "indexShowingFrom": "Se muestra el índice de mods del {0}.",
+    "indexUnreachable": "El launcher no pudo acceder al índice de mods de Weft.",
+    "indexServerError": "El servidor del índice de mods de Weft respondió con un error.",
+    "sourceErrRate": "GitHub está limitando las peticiones, así que no se pudo actualizar {0}.",
+    "sourceErrGone": "{0} ya no existe en GitHub.",
+    "sourceErrNetwork": "No se pudo acceder a {0}.",
+    "sourceErrServer": "GitHub respondió con un error para {0}, así que no se pudo actualizar.",
+    "sourceShowingFrom": "Se muestran sus mods del {0}.",
+    "sourceShowingNone": "Sus mods aparecerán cuando se pueda leer.",
+    "dlgNoBuildTitle": "{0} no tiene compilación para {1}",
+    "dlgNoBuild": "Ninguna compilación de {0} sirve ahora para {1} en este sistema.",
+    "planning": "Calculando qué cambiaría…",
+    "ckPassed": "Correcto",
+    "ckFailed": "Fallido",
+    "ckNotCopied": "Sin copiar",
+    "ckUnknown": "Desconocido",
+    "ckWontInstall": "No se puede instalar: {0}",
+    "ckPinnedGithub": "Descarga fijada por la suma de verificación SHA-256 de GitHub {0}",
+    "ckPinnedGithubDetail": "La suma de verificación viene del mismo servidor que el archivo. Detecta una descarga rota, no un archivo cambiado.",
+    "ckBuiltDetail": "Workflow {0} · el launcher no comprueba la compilación por sí mismo",
+    "ckBuiltClaimed": "Compilado por GitHub Actions, según el repositorio",
+    "ckBuiltClaimedDetail": "Lo afirma el repositorio, sin comprobar: {0} @ {1} · {2}",
+    "ckDepInstall": "Necesita {0}: instala {1} con él",
+    "ckDepEnable": "Necesita {0}: también lo activa",
+    "ckDepMissing": "Necesita {0}: no hay compilación para {1}",
+    "ckDepHave": "Necesita {0}: instalado y activado",
+    "ckDepUnknown": "Necesita {0}: no está activado, y el launcher no sabe si lo estará",
+    "ckReplacesTrust": "Tu {0} instalado era {1}; esta compilación es {2}.",
+    "ckReplacesOff": "El instalado está desactivado, y la actualización sigue desactivada.",
+    "warnDepsUnreviewed": "También trae mods que nadie revisó: {0}.",
+    "fileUnusableTitle": "{0} no se puede instalar para {1}",
+    "fileReplaces": "Sustituye al {0} instalado.",
+    "ckLooksLikeModDetail": "{0} · nada más en el zip",
+    "ckNotAModDetail": "{0}",
+    "typeToConfirm": "Escribe {0} para instalarlo de todos modos",
+    "typedNotPassed_one": "Sin prueba de que sea seguro ({n}):",
+    "sourcesMods_one": "{n} mod",
+    "sourcesMods_many": "{n} mods",
+    "sourcesMods_other": "{n} mods",
+    "sourcesChecked": "comprobado el {0}",
+    "sourcesNotChecked": "aún sin comprobar",
+    "sourcesRemoveConfirm": "¿Quitar {0}? Los mods que instalaste desde ahí se quedan, pero ya no recibirán actualizaciones.",
+    "sourcesKeep": "Mantener",
+    "sourcesRemoving": "Quitando…",
+    "sourcesRemoveLabel": "Quitar {0}",
+    "sourcesAdding": "Añadiendo…",
+    "removeConfirmLabel": "Confirmar: quitar {0}",
+    "noticeInstalledOff": "{0} se actualizó y sigue desactivado.",
+    "noticeMissing_one": "Ninguna compilación de {0} sirve todavía para {1}, así que lo que lo necesita no puede cargar.",
+    "noticeMissing_many": "Ninguna compilación de {0} sirve todavía para {1}, así que lo que los necesita no puede cargar.",
+    "noticeMissing_other": "Ninguna compilación de {0} sirve todavía para {1}, así que lo que los necesita no puede cargar.",
+    "noticeLeftBehind_one": "Sin copiar: {0}.",
+    "noticeLeftBehind_many": "Sin copiar: {0}.",
+    "noticeLeftBehind_other": "Sin copiar: {0}.",
+    "noticeCopied_one": "Se copió {n} mod de {0}.",
+    "noticeCopied_many": "Se copiaron {n} mods de {0}.",
+    "noticeCopied_other": "Se copiaron {n} mods de {0}.",
+    "homeBlocked_one": "Weft {0} no arrancará con este mod activado:",
+    "homeBlocked_many": "Weft {0} no arrancará con estos mods activados:",
+    "homeBlocked_other": "Weft {0} no arrancará con estos mods activados:",
+    "turnOn": "Activar {0}",
+    "failureInitNamed": "{0} falló mientras Weft arrancaba.",
+    "copyTitle": "¿Copiar mods de {0} a {1}?",
+    "copyDoneTitle": "Mods copiados a {0}",
+    "copyInstalledOn": "Instalado para {0}, activado",
+    "copyInstalledOff": "Instalado para {0}, desactivado",
+    "copyFrom": "Copiar mods de",
+    "copyWillInstall": "Instala su compilación para {0}",
+    "copyAlreadyThere": "Ya está en {0}: se queda como está",
+    "copyNoBuild": "Todavía sin compilación para {0}",
+    "copyLocalFile": "Un archivo de tu equipo: añádelo de nuevo con Desde archivo",
+    "copyRevoked": "Retirado del índice: no se copia",
+    "copyConfirm_one": "Copiar {n} mod a {0}",
+    "copyConfirm_many": "Copiar {n} mods a {0}",
+    "copyConfirm_other": "Copiar {n} mods a {0}",
+    "copyNothing": "Nada que copiar",
+    "copyWarn": "Los mods son programas. Cada uno puede hacer todo lo que tú puedes hacer en este equipo.",
+    "copyWarnUnreviewed": "Los mods son programas, y nadie revisó estos: {0}. Cada uno puede hacer todo lo que tú puedes hacer en este equipo.",
+    "copyLeftBehindTitle_one": "Este no se copió:",
+    "copyLeftBehindTitle_many": "Estos no se copiaron:",
+    "copyLeftBehindTitle_other": "Estos no se copiaron:",
+    "ckReplaces": "Sustituye a tu {0} instalado.",
+    "installDep": "Instalar {0}…",
+    "installTurnedOff": "Instalar desactivado",
+    "updateTurnedOff": "Actualizar desactivado",
+    "noticeRemoved": "Se quitó {0} de {1}.",
+    "noticeRestored": "{0} vuelve a estar en {1}.",
+    "noticeRestoredOff": "{0} vuelve a estar en {1}, desactivado como antes.",
+    "undo": "Deshacer",
+    "undoLabel": "Deshacer: recuperar {0}",
+    "ckFitUnchecked": "No se pudo comprobar si sirve para {0}",
+    "badgeRevoked": "Retirado",
+    "badgeRevokedHint": "Retirado del índice. El índice dice: «{0}»",
+    "indexStale": "El índice de mods se firmó por última vez el {0}; pueden faltar retiradas posteriores.",
+    "indexStaleShort": "Índice de mods firmado el {0}: puede estar desactualizado",
+    "indexUnavailable": "Los mods revisados no están disponibles: no hay copia guardada del índice de mods de Weft. Solo se muestran los mods de tus fuentes.",
+    "indexDisk": "El launcher no pudo guardar el índice de mods.",
+    "sourceErrInvalid": "{0} envió datos de mods que el launcher no pudo leer.",
+    "sourceErrDisk": "No se pudo guardar {0} en este equipo.",
+    "sourcesIndexStale": "verificado, pero firmado el {0}: pueden faltar retiradas posteriores",
+    "profileFailed": "No se pudieron leer los mods de {0}: {1}",
+    "profileRetry": "Volver a cargar los mods",
+    "removeConfirmHint": "Pulsa otra vez para quitar {0}.",
+    "installAnywayWhy": "Primero escribe {0} abajo.",
+    "copyAlsoInstalls": "También instala lo que necesitan:",
+    "copyAlsoEnables": "Activa lo que necesitan:",
+    "copyDepInstall": "{0} {1}: lo necesita un mod copiado",
+    "copyDepEnable": "{0}: lo necesita un mod copiado, así que se activa",
+    "copyDepMissing": "{0}: todavía sin compilación para {1}",
+    "fixesFor": "Soluciones para {0}",
+    "folderFailed": "No se pudo abrir la carpeta: {0}",
+    "statusDepsOff_one": "Necesita {0}, que está desactivado.",
+    "statusDepsOff_many": "Necesita {0}, que están desactivados.",
+    "statusDepsOff_other": "Necesita {0}, que están desactivados.",
+    "statusDepsRevoked_one": "Necesita {0}, que se retiró del índice.",
+    "statusDepsRevoked_many": "Necesita {0}, que se retiraron del índice.",
+    "statusDepsRevoked_other": "Necesita {0}, que se retiraron del índice.",
+    "statusDepsNotInstalled_one": "Necesita {0}, que no está instalado.",
+    "statusDepsNotInstalled_many": "Necesita {0}, que no están instalados.",
+    "statusDepsNotInstalled_other": "Necesita {0}, que no están instalados.",
+    "statusDepsNoBuild_one": "Necesita {0}, que aún no tiene compilación para {1}.",
+    "statusDepsNoBuild_many": "Necesita {0}, que aún no tienen compilaciones para {1}.",
+    "statusDepsNoBuild_other": "Necesita {0}, que aún no tienen compilaciones para {1}.",
+    "installsOff_one": "{0} aún no tiene compilación para {1}, así que {2} se instala desactivado. Puedes seguir jugando.",
+    "installsOff_many": "{0} aún no tienen compilaciones para {1}, así que {2} se instala desactivado. Puedes seguir jugando.",
+    "installsOff_other": "{0} aún no tienen compilaciones para {1}, así que {2} se instala desactivado. Puedes seguir jugando.",
+    "noticeInstalledOffMissing_one": "{0} se instaló desactivado: {1} aún no tiene compilación para {2}. Puedes seguir jugando.",
+    "noticeInstalledOffMissing_many": "{0} se instaló desactivado: {1} aún no tienen compilaciones para {2}. Puedes seguir jugando.",
+    "noticeInstalledOffMissing_other": "{0} se instaló desactivado: {1} aún no tienen compilaciones para {2}. Puedes seguir jugando.",
+    "noticeCopiedOff_one": "Instalado desactivado, porque lo que necesita aún no tiene compilación para {1}: {0}.",
+    "noticeCopiedOff_many": "Instalados desactivados, porque lo que necesitan aún no tiene compilación para {1}: {0}.",
+    "noticeCopiedOff_other": "Instalados desactivados, porque lo que necesitan aún no tiene compilación para {1}: {0}.",
+    "copyInstallsOff_one": "Se instalará desactivado, porque lo que necesita aún no tiene compilación para {1}: {0}.",
+    "copyInstallsOff_many": "Se instalarán desactivados, porque lo que necesitan aún no tiene compilación para {1}: {0}.",
+    "copyInstallsOff_other": "Se instalarán desactivados, porque lo que necesitan aún no tiene compilación para {1}: {0}.",
+    "indexUnavailableShort": "Sin índice de mods: sin mods revisados",
+    "noticeTurnedOn": "{0} activado.",
+    "noticeTurnedOff": "{0} desactivado.",
+    "shadowOffRow": "Una copia en tu carpeta de mods ({0}) se carga en su lugar.",
+    "shadowRevokedRow": "La copia de tu carpeta ({0}) se cargaría: impide Jugar.",
+    "ckIndexDetailDated": "Revisado por {0} el {1} · del índice firmado el {2}",
+    "ckFitUncheckedDetail": "El launcher no pudo averiguar la interfaz de mods de esta versión. Reintenta cuando tengas conexión.",
+    "fileReplacesTrust": "Sustituye tu {0} instalado, que es {1}, por un archivo que es {2}.",
+    "changedTitle": "Esto cambió desde que lo miraste:",
+    "changedAdded": "Ahora también instala {0} {1}",
+    "changedVersion": "{0} {1} en lugar de {2}",
+    "changedTrust": "{0} ahora es {1}",
+    "changedDropped": "Ya no instala {0}",
+    "changedEnables": "Ahora también activa {0}",
+    "changedNoEnable": "Ya no activa {0}",
+    "changedOff": "{0} ahora se instala desactivado",
+    "changedOn": "{0} ahora se activa",
+    "changedOther": "El plan cambió. Vuelve a mirarlo antes de confirmar.",
+    "ckSame": "Sin cambios",
+    "stepDownloading": "descargando {0}%",
+    "stepPreparing": "preparando",
+    "stepDownloadingSpoken": "descargando",
+    "stepVerifying": "comprobando el archivo",
+    "stepInstalling": "instalando",
+    "progressOf": "Archivo {0} de {1}: {2}, {3}",
+    "progressOne": "{0}: {1}",
+    "cancelling": "Cancelando…",
+    "cancelOperation": "Cancelar",
+    "needsNetworkButton": "{0} (necesita internet)",
+    "needsNetworkNote": "En el último intento el launcher no pudo conectarse a internet, y esto tiene que descargar. No funcionará hasta que vuelvas a tener conexión.",
+    "fileKnownUpdateTitle": "¿Actualizar {0} a {1} para {2} desde este archivo?",
+    "fileReplaceTitle": "¿Sustituir {0} por el archivo sin verificar {1} para {2}?",
+    "replaceAnyway": "Sustituir de todos modos",
+    "typeToReplace": "Escribe {0} para sustituirlo de todos modos",
+    "clearSearch": "Borrar búsqueda",
+    "needsNetworkShort": "necesita internet",
+    "removeCancelled": "{0} se queda.",
+    "showFolderFix": "Mostrar {0}",
+    "indexOfflineShort": "Sin conexión: índice del {0}",
+    "indexCachedShort": "Usando el índice del {0}",
+    "refreshFailed": "No se pudo actualizar la lista de mods; la que se muestra es la anterior.",
+    "refreshFailedShort": "No se pudo actualizar: se muestra la lista anterior",
+    "abiUnknownShort": "No se pudo comprobar qué mods sirven para {0}",
+    "shadowBanner": "Tu carpeta de mods tiene su propia copia de {0}. La copia del launcher está desactivada, así que el juego carga esa.",
+    "updatesNeedCatalog": "No se pudo cargar la lista de mods, así que no se pueden revisar las actualizaciones. Reintenta arriba.",
+    "updateLabelTo": "Actualizar {0} a {1} para {2}…",
+    "sourcesRetry": "Reintentar",
+    "sourcesLoadFailedLead": "No se pudieron leer tus fuentes.",
+    "noticeShadowLoads": "Tu propia carpeta de mods tiene una copia de {0} ({1}), así que el juego carga esa en su lugar.",
+    "failureShadowed": "Tu propia carpeta de mods tiene una copia ({0}); puede que el juego haya cargado esa.",
+    "blockerPager": "Mods que impiden el juego",
+    "blockerPrev": "Mod anterior que impide el juego",
+    "blockerNext": "Siguiente mod que impide el juego",
+    "blockerPage": "{0} de {1}",
+    "playOffOne": "Jugar está desactivado: {0} necesita un arreglo.",
+    "playOffMany_one": "Jugar está desactivado: {n} mod necesita un arreglo.",
+    "playOffMany_many": "Jugar está desactivado: {n} mods necesitan un arreglo.",
+    "playOffMany_other": "Jugar está desactivado: {n} mods necesitan un arreglo.",
+    "toastsLabel": "Lo que acaba de pasar",
+    "statusRevokedNoReason": "Desactivado, retirado del índice. No se indicó ningún motivo.",
+    "ckRevokedNoReason": "Retirado del índice. No se indicó ningún motivo.",
+    "indexBadgeSigned": "Firmado · verificado el {0}",
+    "indexBadgeStale": "Firmado el {0} · puede estar desactualizado",
+    "indexBadgeCopy": "Copia firmada del {0}",
+    "indexBadgeNone": "Sin verificar",
+    "sourceBadgeRepo": "Repositorio de GitHub",
+    "sourcesChecking": "comprobando…",
+    "sourceFormatLink": "Qué necesita una fuente",
+    "sourcesDamaged": "No se pudo leer tu lista de fuentes; se guardó aparte. Vuelve a añadir tus fuentes en Fuentes.",
+    "sourcesDamagedShort": "No se pudo leer tu lista de fuentes",
+    "failureShadowedStill": "Tu carpeta de mods todavía tiene {0}, que se carga en su lugar, así que puede seguir pasando. Quita ese archivo para estar seguro.",
+    "copyDoneSummary_one": "Se copió {n} mod de {0} a {1}.",
+    "copyDoneSummary_many": "Se copiaron {n} mods de {0} a {1}.",
+    "copyDoneSummary_other": "Se copiaron {n} mods de {0} a {1}.",
+    "copyStaysLine_one": "{n} mod se queda atrás: {0}.",
+    "copyStaysLine_many": "{n} mods se quedan atrás: {0}.",
+    "copyStaysLine_other": "{n} mods se quedan atrás: {0}.",
+    "indexRefusedShort": "Índice rechazado: se usa la copia del {0}",
+    "blockLineWrongVersionTag": "{0} impide Jugar: se compiló para {1}.",
+    "blockLineWrongVersion": "{0} impide Jugar: se compiló para otra versión del juego.",
+    "blockLineRevoked": "{0} impide Jugar: se retiró del índice.",
+    "blockLineShadowedRevoked": "{0} impide Jugar: se retiró del índice, pero la copia de tu carpeta de mods ({1}) se cargaría en su lugar.",
+    "blockLineDepsOff_one": "{0} impide Jugar: necesita {1}, que está desactivado.",
+    "blockLineDepsOff_many": "{0} impide Jugar: necesita {1}, que están desactivados.",
+    "blockLineDepsOff_other": "{0} impide Jugar: necesita {1}, que están desactivados.",
+    "blockLineDepsRevoked_one": "{0} impide Jugar: necesita {1}, que se retiró del índice.",
+    "blockLineDepsRevoked_many": "{0} impide Jugar: necesita {1}, que se retiraron del índice.",
+    "blockLineDepsRevoked_other": "{0} impide Jugar: necesita {1}, que se retiraron del índice.",
+    "blockLineDepsNotInstalled_one": "{0} impide Jugar: necesita {1}, que no está instalado.",
+    "blockLineDepsNotInstalled_many": "{0} impide Jugar: necesita {1}, que no están instalados.",
+    "blockLineDepsNotInstalled_other": "{0} impide Jugar: necesita {1}, que no están instalados.",
+    "blockLineDepsNoBuild_one": "{0} impide Jugar: necesita {1}, que aún no tiene compilación para {2}.",
+    "blockLineDepsNoBuild_many": "{0} impide Jugar: necesita {1}, que aún no tienen compilaciones para {2}.",
+    "blockLineDepsNoBuild_other": "{0} impide Jugar: necesita {1}, que aún no tienen compilaciones para {2}.",
+    "badgeRevokedHintNoReason": "Retirado del índice sin indicar motivo.",
+    "unmanagedCause_one": "Tu carpeta: {n} archivo, en toda versión",
+    "unmanagedCause_many": "Tu carpeta: {n} archivos, en toda versión",
+    "unmanagedCause_other": "Tu carpeta: {n} archivos, en toda versión",
+    "indexUnreachableShort": "Índice inaccesible: sin mods revisados",
+    "sourceCauseRate": "Límite de GitHub:",
+    "sourceCauseGone": "Fuente no encontrada:",
+    "sourceCauseInvalid": "Fuente ilegible:",
+    "sourceCauseDisk": "No se pudo guardar la fuente:",
+    "sourceCauseNetwork": "Fuente inaccesible:",
+    "sourceCauseServer": "Error de GitHub:",
+    "shadowCause": "La copia de tu carpeta se carga en lugar de:",
+    "tryUpdate": "Probar {0}…",
+    "turnOffAll_one": "Desactivar los {n}",
+    "turnOffAll_many": "Desactivar los {n}",
+    "turnOffAll_other": "Desactivar los {n}",
+    "failureLogLine": "Línea del registro",
+    "indexSays": "El índice dice, en inglés: «{0}»",
+    "indexGaveNoReason": "El índice no indicó ningún motivo.",
+    "detailsLabel": "{0}: detalles",
+    "refusedUnread": "Weft no arrancó por sus mods, y no se pudieron volver a leer para decir cuáles: {0}",
+    "refusedRetry": "Volver a comprobar los mods",
+    "homeProfileFailed": "No se pudieron leer los mods de {0}: {1}",
+    "sourceNoModsLineNoReleases": "No se encontraron versiones de mods compatibles: todavía no tiene versiones publicadas.",
+    "sourceNoModsLineNoFiles": "No se encontraron versiones de mods compatibles: ninguna versión tiene un <id>.zip con su <id>.mod.json.",
+    "sourceNoModsLineUnreadable": "No se encontraron versiones de mods compatibles: no se pudo leer el <id>.mod.json de una versión.",
+    "sourceNoModsLineNoDigest": "No se encontraron versiones de mods compatibles: GitHub no tiene el SHA-256 de sus zips, así que no se pueden comprobar.",
+    "sourceNoModsLineDisagrees": "No se encontraron versiones de mods compatibles: el <id>.mod.json de una versión no coincide con esa versión en GitHub.",
+    "sourceNoModsLineInvalid": "No se encontraron versiones de mods compatibles: sus versiones rompen una regla que cumple todo mod.",
+    "sourcesIndexUnsaved": "No se pudo guardar en este equipo: se descarga de nuevo en el próximo inicio y, hasta entonces, sin conexión se muestra una copia guardada anterior.",
+    "indexUnsaved": "No se pudo guardar en este equipo el índice de mods en uso. Funciona ahora; se descarga de nuevo en el próximo inicio.",
+    "indexUnsavedShort": "Índice no guardado: funciona hasta reiniciar",
+    "sourceRetryLabel": "Volver a consultar {0}",
+    "tabInstalledLabel_many": "Instalados en {0}: {n} de mods",
+    "tabInstalledLabel_other": "Instalados en {0}: {n} mods",
+    "typedNotPassed_many": "Sin prueba de que sea seguro ({n}):",
+    "typedNotPassed_other": "Sin prueba de que sea seguro ({n}):",
+    "removeDoubleClick": "Un doble clic no quita {0}. Pulsa Quitar otra vez para confirmar.",
+    "ckBuiltIncomplete": "El índice firmado tiene un registro de compilación incompleto",
+    "ckBuiltIncompleteDetail": "Le falta el repositorio, el workflow, el commit o la fecha de comprobación, así que no se sabe cómo se compiló este archivo",
+    "sourcePending": "Aún comprobando {0}…",
+    "sourcesPending_one": "Aún comprobando {n} fuente…",
+    "sourcesPending_many": "Aún comprobando {n} fuentes…",
+    "sourcesPending_other": "Aún comprobando {n} fuentes…",
+    "turnOnAsk": "¿Activar {0}? Jugar queda bloqueado hasta que se arregle esto:",
+    "keepOff": "Dejarlo desactivado",
+    "turnOnAnyway": "Activar de todos modos",
+    "crashNoneNamed": "El registro no nombra ningún mod. Si vuelve a pasar, prueba sin mods.",
+    "crashTurnOffAll": "Desactivar todos los mods de {0}",
+    "crashAllOff_one": "Desactivado {n} mod de {0}. Pulsa Jugar para probar sin él.",
+    "crashAllOff_many": "Desactivados {n} de mods de {0}. Pulsa Jugar para probar sin ellos.",
+    "crashAllOff_other": "Desactivados {n} mods de {0}. Pulsa Jugar para probar sin ellos.",
+    "crashAllOn_one": "Reactivado {n} mod de {0}.",
+    "crashAllOn_many": "Reactivados {n} de mods de {0}.",
+    "crashAllOn_other": "Reactivados {n} mods de {0}.",
+    "checksPassed_one": "{n} comprobación superada",
+    "checksPassed_many": "{n} de comprobaciones superadas",
+    "checksPassed_other": "{n} comprobaciones superadas",
+    "checksShow": "Mostrar",
+    "checksHide": "Ocultar",
+    "checksShowDetails": "Mostrar detalles",
+    "copyIntroNone": "Nada cambia en {0}:",
+    "copyEvidenceShow": "Mostrar comprobaciones",
+    "copyEvidenceHide": "Ocultar comprobaciones",
+    "copyEvidenceFor": "Lo que se sabe de {0}",
+    "copyNoEvidence": "El catálogo ya no incluye esta versión",
+    "copyIntro_one": "Copiar añade {n} mod a {0}. Nada de lo que {0} tiene ahora se quita ni se reemplaza.",
+    "copyIntro_many": "Copiar añade {n} mods a {0}. Nada de lo que {0} tiene ahora se quita ni se reemplaza.",
+    "copyIntro_other": "Copiar añade {n} mods a {0}. Nada de lo que {0} tiene ahora se quita ni se reemplaza.",
+    "ckTierDrop": "Era {0}; esta versión es {1}",
+    "ckTierDropSaid": "Nivel más bajo",
+    "replaceFromFile": "Reemplazar {0} con un archivo…",
+    "homeModsOwn_one": "Mods para {0}: {1} y {n} archivo de tu carpeta",
+    "homeModsOwn_many": "Mods para {0}: {1} y {n} archivos de tu carpeta",
+    "homeModsOwn_other": "Mods para {0}: {1} y {n} archivos de tu carpeta",
+    "homeModsOnlyOwn_one": "Sin mods para {0}, pero se carga {n} archivo de tu carpeta",
+    "homeModsOnlyOwn_many": "Sin mods para {0}, pero se cargan {n} archivos de tu carpeta",
+    "homeModsOnlyOwn_other": "Sin mods para {0}, pero se cargan {n} archivos de tu carpeta",
+    "indexUnavailableStatusShort": "Sin índice de mods (servidor: {0}): sin mods revisados",
+    "browseNoIndex": "Los mods revisados aparecen aquí cuando se pueda descargar el índice de mods de Weft.",
+    "sourceErrRateUntil": "GitHub está limitando las peticiones hasta las {1}, así que no se pudo actualizar {0}.",
+    "reinstall": "Instalar {0} de nuevo…"
+  },
+  "sizeUnits": {
+    "B": "B",
+    "KB": "KB",
+    "MB": "MB",
+    "GB": "GB"
+  },
+  "heroBadgeBlocked": "VERSIÓN {0} · HAY MODS QUE ARREGLAR",
+  "deleteWithMods_one": "Borrar con {n} mod",
+  "deleteWithMods_many": "Borrar con {n} mods",
+  "deleteWithMods_other": "Borrar con {n} mods",
+  "versionModCount_one": "{n} mod",
+  "versionModCount_many": "{n} mods",
+  "versionModCount_other": "{n} mods",
+  "versionModsBlocked": "Hay mods que impiden arrancar. Arréglalos en Inicio o en la pestaña Mods.",
+  "heroBadgeChecking": "VERSIÓN {0} · COMPROBANDO MODS",
+  "heroBadgeUnchecked": "VERSIÓN {0} · MODS SIN COMPROBAR",
+  "starting": "Iniciando...",
+  "deleteConfirmHint": "Pulsa otra vez para eliminar {0} con sus mods. No se puede deshacer.",
+  "deleteConfirmHintBare": "Pulsa otra vez para eliminar {0}. No se puede deshacer.",
+  "deleteCancelled": "La versión {0} sigue instalada.",
+  "deleteDoubleClick": "Un doble clic no elimina {0}. Pulsa Eliminar otra vez para confirmar."
+}
diff --git a/src/i18n/index.ts b/src/i18n/index.ts
index 7564fe1..aa47ab2 100644
--- a/src/i18n/index.ts
+++ b/src/i18n/index.ts
@@ -1,109 +1,54 @@
-export type Locale = 'pt-BR' | 'en' | 'es' | 'ru';
-
-interface I18nMessages {
-  updateAvailable: string;
-updateDownloading: string;
-updateFailed: string;
-updateTooltip: string;
-updateCloseGame: string;
-  latestBadge: string;
-  appTitle: string;
-  refreshButton: string;
-  loading: string;
-  cacheBanner: string;
-  errorPrefix: string;
-  emptyState: string;
-  installButton: string;
-  installedBadge: string;
-  deleteButton: string;
-  deleteForReal: string;
-  confirmDelete: string;
-  playButton: string;
-  playing: string;
-  progressDownloading: string;
-  progressVerifying: string;
-  progressExtracting: string;
-  progressFinalizing: string;
-  deleteDisabledTooltip: string;
-  playDisabledTooltip: string;
-  installedAtLabel: string;
-  linkDiscord: string;
-  linkWebsite: string;
-  releasedLabel: string;
-  inUseBadge: string;
-  noChangelog: string;
-  newBadge: string;
-  openFolderButton: string;
-  gameClosedError: string;
-  openLogButton: string;
-  tabHome: string;
-  tabVersions: string;
-  tabNotes: string;
-  tabsLabel: string;
-  selectVersionLabel: string;
-  selectVersionHint: string;
-  noVersionsInstalled: string;
-  goToVersionsTab: string;
-  instanceCardTitle: string;
-  versionLabel: string;
-  gameFolderTitle: string;
-  prereleaseBadge: string;
-  heroBadge: string;
-  heroBadgePlaying: string;
-  errors: {
-    network: string;
-    io: string;
-    serialization: string;
-    httpHeader: string;
-    cacheCorrupted: string;
-    assetNotFound: string;
-    missingDigest: string;
-    rateLimited: string;
-    forbidden: string;
-    offlineNoCache: string;
-    zip: string;
-    createDir: string;
-    sha256Mismatch: string;
-    hashMissing: string;
-    alreadyInstalled: string;
-    notInstalled: string;
-    downloadFailed: string;
-    extractFailed: string;
-    gameRunning: string;
-    versionInUse: string;
-    alreadyRunning: string;
-    anotherGameRunning: string;
-    executableNotFound: string;
-    processSpawnFailed: string;
-    logDirCreateFailed: string;
-    gameFolderNotFound: string;
-    unsupportedPlatform: string;
-    openerError: string;
-    invalidName: string;
-    installInProgress: string;
-  };
-  sizeUnits: {
-    B: string;
-    KB: string;
-    MB: string;
-    GB: string;
-  };
-}
+// Messages, typed from en.json: a key that isn't there fails `tsc`. Counted messages have one key
+// per CLDR plural category (`_one`, `_few`, `_many`, `_other`) and are read with `tn`.
 
 import ptBR from './pt-BR.json';
 import en from './en.json';
 import es from './es.json';
 import ru from './ru.json';
 
-const messagesMap: Record<Locale, I18nMessages> = {
-  'pt-BR': ptBR,
-  en,
-  es,
-  ru,
+export type Locale = 'pt-BR' | 'en' | 'es' | 'ru';
+export const LOCALES: Locale[] = ['en', 'pt-BR', 'es', 'ru'];
+
+type Leaves<T, P extends string = ''> = {
+  [K in keyof T & string]: T[K] extends string ? `${P}${K}` : Leaves<T[K], `${P}${K}.`>;
+}[keyof T & string];
+
+type AllKeys = Leaves<typeof en>;
+type PluralCategory = 'zero' | 'one' | 'two' | 'few' | 'many' | 'other';
+type PluralForm<K> = K extends `${string}_${PluralCategory}` ? K : never;
+
+/** A plain message. */
+export type MessageKey = Exclude<AllKeys, PluralForm<AllKeys>>;
+/** A counted message: `mods.noticeCopied` stands for `mods.noticeCopied_one`, `_other`... */
+export type PluralKey = AllKeys extends infer K ? (K extends `${infer B}_other` ? B : never) : never;
+
+/** A message to show later, for code that decides what to say but doesn't render it. */
+export type Msg =
+  | { key: MessageKey; args?: string[] }
+  | { key: PluralKey; count: number; args?: string[] };
+
+type Tree = { [key: string]: string | Tree };
+
+const messagesMap: Record<Locale, Tree> = {
+  'pt-BR': ptBR as Tree,
+  en: en as Tree,
+  es: es as Tree,
+  ru: ru as Tree,
 };
 
 let currentLocale: Locale = 'en';
-let messages: I18nMessages = messagesMap.en;
+let messages: Tree = messagesMap.en;
+let plurals = new Intl.PluralRules('en');
+
+function use(locale: Locale) {
+  currentLocale = locale;
+  messages = messagesMap[locale];
+  plurals = new Intl.PluralRules(locale);
+}
+
+export function isLocale(s: string | null | undefined): s is Locale {
+  return !!s && (LOCALES as string[]).includes(s);
+}
 
 export function initI18n(locale?: Locale): void {
   let saved: string | null = null;
@@ -112,9 +57,8 @@ export function initI18n(locale?: Locale): void {
   } catch {
     saved = null;
   }
-  const candidate = (locale || saved) as Locale | null;
-  currentLocale = candidate && candidate in messagesMap ? candidate : 'en';
-  messages = messagesMap[currentLocale];
+  const candidate = locale ?? saved;
+  use(isLocale(candidate) ? candidate : 'en');
 }
 
 export function getLocale(): Locale {
@@ -122,56 +66,91 @@ export function getLocale(): Locale {
 }
 
 export function setLocale(locale: Locale): void {
-  currentLocale = locale;
+  use(locale);
   try {
     localStorage.setItem('locale', locale);
   } catch {
-    /* ignora */
+    /* ignore */
   }
-  messages = messagesMap[locale];
 }
 
-export function t(key: string, ...args: string[]): string {
-  if (!messages) {
-    return key;
-  }
-  
-  const keys = key.split('.');
-  let value: any = messages;
-  
-  for (const k of keys) {
-    if (value && typeof value === 'object' && k in value) {
-      value = value[k];
-    } else {
-      return key;
-    }
+function lookup(tree: Tree, key: string): string | null {
+  let value: string | Tree | undefined = tree;
+  for (const k of key.split('.')) {
+    if (value && typeof value === 'object' && k in value) value = value[k];
+    else return null;
   }
-  
-  if (typeof value === 'string') {
-    return args.reduce((str, arg, i) => str.replace(`{${i}}`, arg), value);
-  }
-  
-  return key;
+  return typeof value === 'string' ? value : null;
+}
+
+/** Fills `{0}`, `{1}`... and, for counted messages, `{n}`. */
+export function fill(template: string, args: readonly string[], count?: string): string {
+  return template.replace(/\{(\d+|n)\}/g, (whole, name: string) => {
+    if (name === 'n') return count ?? whole;
+    return args[Number(name)] ?? whole;
+  });
+}
+
+export function t(key: MessageKey, ...args: string[]): string {
+  const value = lookup(messages, key) ?? lookup(messagesMap.en, key);
+  return value === null ? key : fill(value, args);
+}
+
+/** The key a count picks in a locale: `mods.noticeCopied_few` for 3 in Russian. */
+export function pluralKey(key: PluralKey, count: number, locale: Locale = currentLocale): string {
+  const rules = locale === currentLocale ? plurals : new Intl.PluralRules(locale);
+  return `${key}_${rules.select(count)}`;
+}
+
+export function tn(key: PluralKey, count: number, ...args: string[]): string {
+  const value =
+    lookup(messages, pluralKey(key, count)) ??
+    lookup(messages, `${key}_other`) ??
+    lookup(messagesMap.en, pluralKey(key, count, 'en'));
+  return value === null ? key : fill(value, args, count.toLocaleString(currentLocale));
+}
+
+export function tm(msg: Msg): string {
+  const args = msg.args ?? [];
+  return 'count' in msg ? tn(msg.key, msg.count, ...args) : t(msg.key, ...args);
+}
+
+/** A list of names the way the language joins them: "A, B and C". */
+export function formatList(items: string[]): string {
+  return new Intl.ListFormat(currentLocale, { style: 'long', type: 'conjunction' }).format(items);
+}
+
+/** A time of day, as the language writes it: "14:32", "2:32 PM". */
+export function formatTime(d: Date): string {
+  return new Intl.DateTimeFormat(currentLocale, { hour: 'numeric', minute: '2-digit' }).format(d);
+}
+
+/** A day, short: "2 Nov" this year, "2 Nov 2025" before it. */
+export function formatDay(iso: string | null | undefined, now: Date = new Date()): string {
+  if (!iso) return '';
+  const d = new Date(iso);
+  if (Number.isNaN(d.getTime())) return iso;
+  const year = d.getFullYear() === now.getFullYear() ? undefined : 'numeric';
+  // Messages put their own punctuation after a date, so it never ends in a dot of its own:
+  // a short month that is an abbreviation ("нояб.", "nov.") gives way to the long one, and a
+  // trailing marker after the year (Russian "г.") is left off.
+  const day = (month: 'short' | 'long') => {
+    const parts = new Intl.DateTimeFormat(currentLocale, { day: 'numeric', month, year }).formatToParts(d);
+    while (parts.length && parts[parts.length - 1].type === 'literal') parts.pop();
+    return parts.map((p) => p.value).join('');
+  };
+  const short = day('short');
+  return short.endsWith('.') ? day('long') : short;
 }
 
 export function formatSize(bytes: number): string {
-  if (!messages) {
-    const units = ['B', 'KB', 'MB', 'GB'];
-    let size = bytes;
-    let unitIndex = 0;
-    while (size >= 1024 && unitIndex < units.length - 1) {
-      size /= 1024;
-      unitIndex++;
-    }
-    return `${size.toFixed(1)} ${units[unitIndex]}`;
-  }
-  
-  const units = [messages.sizeUnits.B, messages.sizeUnits.KB, messages.sizeUnits.MB, messages.sizeUnits.GB];
+  const units = ['B', 'KB', 'MB', 'GB'] as const;
   let size = bytes;
   let unitIndex = 0;
   while (size >= 1024 && unitIndex < units.length - 1) {
     size /= 1024;
     unitIndex++;
   }
-  return `${size.toFixed(1)} ${units[unitIndex]}`;
-}
\ No newline at end of file
+  const unit = lookup(messages, `sizeUnits.${units[unitIndex]}`) ?? units[unitIndex];
+  return `${size.toFixed(1)} ${unit}`;
+}
diff --git a/src/i18n/plural.test.ts b/src/i18n/plural.test.ts
new file mode 100644
index 0000000..6ae966e
--- /dev/null
+++ b/src/i18n/plural.test.ts
@@ -0,0 +1,137 @@
+import { describe, expect, it } from "vitest";
+import { fill, formatDay, initI18n, pluralKey, tn, t } from "./index";
+import en from "./en.json";
+import ru from "./ru.json";
+import ptBR from "./pt-BR.json";
+import es from "./es.json";
+
+describe("pluralKey", () => {
+  it("picks Russian's one, few and many", () => {
+    const cases: [number, string][] = [
+      [0, "many"],
+      [1, "one"],
+      [2, "few"],
+      [4, "few"],
+      [5, "many"],
+      [11, "many"],
+      [21, "one"],
+      [22, "few"],
+      [25, "many"],
+      [101, "one"],
+    ];
+    for (const [n, form] of cases) expect(pluralKey("mods.noticeCopied", n, "ru"), String(n)).toBe(`mods.noticeCopied_${form}`);
+  });
+
+  it("picks English one and other", () => {
+    expect(pluralKey("mods.noticeCopied", 1, "en")).toBe("mods.noticeCopied_one");
+    expect(pluralKey("mods.noticeCopied", 0, "en")).toBe("mods.noticeCopied_other");
+    expect(pluralKey("mods.noticeCopied", 2, "en")).toBe("mods.noticeCopied_other");
+  });
+});
+
+describe("tn", () => {
+  it("never says 'Brought 1 mods'", () => {
+    initI18n("en");
+    expect(tn("mods.noticeCopied", 1, "v26.10.4")).toBe("Copied 1 mod from v26.10.4.");
+    expect(tn("mods.noticeCopied", 3, "v26.10.4")).toBe("Copied 3 mods from v26.10.4.");
+  });
+
+  it("uses the right Russian form for 1, 2, 5 and 21", () => {
+    initI18n("ru");
+    expect(tn("mods.sourcesMods", 1)).toBe("1 мод");
+    expect(tn("mods.sourcesMods", 2)).toBe("2 мода");
+    expect(tn("mods.sourcesMods", 5)).toBe("5 модов");
+    expect(tn("mods.sourcesMods", 21)).toBe("21 мод");
+    initI18n("en");
+  });
+});
+
+describe("fill", () => {
+  it("fills numbered placeholders and the count", () => {
+    expect(fill("{0} and {1}: {n}", ["a", "b"], "3")).toBe("a and b: 3");
+    expect(fill("{0} {2}", ["a"])).toBe("a {2}");
+  });
+
+  it("keeps a sentence whole, the placeholder inside it", () => {
+    initI18n("en");
+    expect(t("mods.typeToConfirm", "mytweak")).toBe("Type mytweak to install it anyway");
+  });
+});
+
+describe("locale files", () => {
+  type Tree = { [k: string]: string | Tree };
+  const flat = (o: Tree, p = ""): string[] =>
+    Object.entries(o).flatMap(([k, v]) => (typeof v === "string" ? [`${p}${k}`] : flat(v, `${p}${k}.`)));
+
+  it("have every plural form their language needs", () => {
+    const files: [string, Tree][] = [["en", en], ["ru", ru], ["pt-BR", ptBR], ["es", es]];
+    const bases = flat(en as Tree)
+      .filter((k) => k.endsWith("_other"))
+      .map((k) => k.slice(0, -"_other".length));
+    expect(bases.length).toBeGreaterThan(5);
+    for (const [locale, tree] of files) {
+      const keys = new Set(flat(tree));
+      const needed = new Intl.PluralRules(locale).resolvedOptions().pluralCategories;
+      for (const base of bases) for (const c of needed) expect(keys.has(`${base}_${c}`), `${locale} ${base}_${c}`).toBe(true);
+    }
+  });
+
+  it("use the Russian glossary for the tiers, everywhere", () => {
+    const mods = (ru as unknown as { mods: Record<string, string> }).mods;
+    // Three steps a reader tells apart: approved by the index's reviewers, published without
+    // moderation, from your computer (of unknown origin). None of them with «провер…», the word of
+    // the signature, file and version checks, or «источник», the word for an added GitHub repo.
+    const tiers = [mods.badgeReviewed, mods.badgeUnreviewed, mods.badgeUnverified];
+    expect(tiers).toEqual(["Одобрен", "Без модерации", "С компьютера"]);
+    for (const tier of tiers) expect(tier).not.toMatch(/провер|источник/i);
+    // "Не верифицирован" read as a synonym of a failed check, not as the weaker tier.
+    const all = JSON.stringify(ru);
+    expect(all).not.toMatch(/верифиц/);
+    expect(mods.fileUnverifiedTitle).toMatch(/с вашего компьютера/);
+    expect(mods.ckIndexDetail).toMatch(/^Одобрил/);
+    // «Отзыв» also means a review: a revocation is always «отозван…».
+    expect(all).not.toMatch(/[Оо]тзыв/);
+    // A copy leaves the mods where they were: «Скопировать», never «Перенести» (move).
+    expect(all).not.toMatch(/[Пп]еренес|[Пп]еренос/);
+    // Only the words: a key may still be called "digest".
+    const words = all.replace(/"[^"]*":/g, "");
+    expect(words).not.toMatch(/дайджест|digest/i);
+  });
+
+  it("say on and off in full in Spanish", () => {
+    const mods = (es as unknown as { mods: Record<string, string> }).mods;
+    expect([mods.on, mods.off]).toEqual(["Activado", "Desactivado"]);
+  });
+
+  it("have no doubled punctuation", () => {
+    const flatValues = (tree: object, prefix = ""): Record<string, string> =>
+      Object.entries(tree).reduce<Record<string, string>>(
+        (out, [k, v]) => (typeof v === "string" ? { ...out, [prefix + k]: v } : { ...out, ...flatValues(v, `${prefix}${k}.`) }),
+        {}
+      );
+    for (const [locale, tree] of Object.entries({ en, ru, es, ptBR })) {
+      for (const [key, value] of Object.entries(flatValues(tree))) {
+        expect(value, `${locale} ${key}`).not.toMatch(/(?<!\.)\.\.(?!\.)|[!?:]\.|\s[.,:;]/);
+      }
+    }
+  });
+});
+
+describe("formatDay", () => {
+  // Messages end "… from {0}." or go on with "{0}: …", so a date that ends in its own dot reads "нояб..".
+  it("never ends in a dot of its own, this year or an earlier one", () => {
+    const now = new Date("2026-11-05T12:00:00Z");
+    for (const locale of ["en", "ru", "pt-BR", "es"] as const) {
+      initI18n(locale);
+      for (const iso of ["2026-11-03T12:00:00Z", "2025-11-03T12:00:00Z"]) {
+        const day = formatDay(iso, now);
+        expect(day, `${locale} ${iso}`).not.toMatch(/\.$/);
+        expect(day, `${locale} ${iso}`).toMatch(/3/);
+      }
+    }
+    initI18n("ru");
+    expect(formatDay("2026-11-03T12:00:00Z", now)).toBe("3 ноября");
+    expect(formatDay("2025-11-03T12:00:00Z", now)).toBe("3 нояб. 2025");
+    initI18n("en");
+  });
+});
diff --git a/src/i18n/pt-BR.json b/src/i18n/pt-BR.json
index ee4e00d..c621b8c 100644
--- a/src/i18n/pt-BR.json
+++ b/src/i18n/pt-BR.json
@@ -1,21 +1,17 @@
 {
   "updateAvailable": "ATUALIZAÇÃO DISPONÍVEL",
-"updateDownloading": "ATUALIZANDO {0}%",
-"updateFailed": "FALHA NA ATUALIZAÇÃO · TENTAR DE NOVO",
-"updateTooltip": "Atualizar para a versão {0} e reiniciar",
-"updateCloseGame": "Feche o jogo antes de atualizar",
+  "updateDownloading": "ATUALIZANDO {0}%",
+  "updateFailed": "FALHA NA ATUALIZAÇÃO · TENTAR DE NOVO",
+  "updateTooltip": "Atualizar para a versão {0} e reiniciar",
+  "updateCloseGame": "Feche o jogo antes de atualizar",
   "latestBadge": "Mais recente",
-  "appTitle": "Weft Launcher",
   "refreshButton": "Atualizar lista",
   "loading": "Carregando...",
   "cacheBanner": "Mostrando cache (offline ou sem atualizações)",
-  "errorPrefix": "Erro: ",
   "emptyState": "Nenhuma versão encontrada.",
   "installButton": "Instalar",
-  "installedBadge": "Instalada",
   "deleteButton": "Excluir",
   "deleteForReal": "Excluir de vez",
-  "confirmDelete": "Tem certeza que deseja excluir esta versão? Esta ação não pode ser desfeita.",
   "playButton": "Jogar",
   "playing": "Jogando...",
   "progressDownloading": "Baixando... {0}% — {1} Mbps",
@@ -25,10 +21,6 @@
   "deleteDisabledTooltip": "Feche o jogo para excluir",
   "playDisabledTooltip": "Outro jogo está rodando: {0}",
   "installedAtLabel": "Instalada em",
-  "linkDiscord": "Discord",
-  "linkWebsite": "Site",
-  "releasedLabel": "Lançamento",
-  "inUseBadge": "Em uso",
   "noChangelog": "Sem notas de versão.",
   "newBadge": "Nova",
   "openFolderButton": "Abrir pasta",
@@ -36,6 +28,8 @@
   "openLogButton": "Abrir log",
   "tabHome": "Início",
   "tabVersions": "Versões",
+  "tabMods": "Mods",
+  "newVersionsDot": "Novas versões disponíveis",
   "tabNotes": "Notas de versão",
   "tabsLabel": "Abas principais",
   "selectVersionLabel": "Selecionar versão",
@@ -51,39 +45,541 @@
   "errors": {
     "invalidName": "Nome inválido: {0}",
     "installInProgress": "Já está instalando: {0}",
-    "network": "Erro de rede: {0}",
-    "io": "Erro de I/O: {0}",
-    "serialization": "Erro de serialização: {0}",
-    "httpHeader": "Erro de cabeçalho HTTP: {0}",
-    "cacheCorrupted": "Cache corrompido: {0}",
-    "assetNotFound": "Asset não encontrado para a plataforma atual",
-    "missingDigest": "Digest SHA256 ausente no asset",
+    "network": "O launcher não conseguiu falar com o servidor. Verifique sua conexão e tente de novo.",
+    "httpStatus": "O servidor respondeu, mas com um erro. Tente de novo mais tarde.",
+    "io": "Não foi possível ler ou gravar um arquivo.",
+    "serialization": "Chegou uma resposta que o launcher não conseguiu ler.",
+    "httpHeader": "O servidor mandou uma resposta que o launcher não consegue usar.",
+    "cacheCorrupted": "A cópia salva está corrompida. Atualize para baixá-la de novo.",
+    "assetNotFound": "Esta versão não tem arquivo para o seu sistema.",
+    "missingDigest": "Esta versão não publica o SHA-256 do arquivo, então o launcher não consegue verificá-lo.",
     "rateLimited": "Limite de taxa da API GitHub excedido. Tente novamente mais tarde.",
     "forbidden": "Acesso negado à API GitHub (403). Usando cache se disponível.",
     "offlineNoCache": "Sem conexão e sem cache disponível",
-    "zip": "Erro no ZIP: {0}",
-    "createDir": "Falha ao criar diretório: {0}",
-    "sha256Mismatch": "SHA256 não confere",
-    "hashMissing": "SHA256 obrigatório não fornecido",
+    "zip": "O download não é um zip que o launcher consiga abrir.",
+    "createDir": "Não foi possível criar uma pasta.",
+    "sha256Mismatch": "O download não bateu com o SHA-256 fixado, então nada foi instalado. Tente de novo; se continuar, o arquivo no servidor mudou.",
+    "hashMissing": "Nada diz qual deve ser o SHA-256 deste arquivo, então ele não pode ser verificado.",
     "alreadyInstalled": "Versão já instalada: {0}",
     "notInstalled": "Versão não instalada: {0}",
-    "downloadFailed": "Falha no download: {0}",
-    "extractFailed": "Falha na extração: {0}",
+    "downloadFailed": "O download falhou. Tente de novo.",
+    "extractFailed": "Não foi possível descompactar o jogo.",
     "gameRunning": "Outro jogo está rodando: {0}. Feche-o antes de iniciar outro.",
     "versionInUse": "Versão em uso (arquivo bloqueado): {0}. Feche o jogo para excluir.",
     "alreadyRunning": "Esta versão já está rodando",
     "anotherGameRunning": "Outro jogo está rodando: {0}",
     "executableNotFound": "Executável não encontrado: {0}",
-    "processSpawnFailed": "Falha ao iniciar processo: {0}",
-    "logDirCreateFailed": "Falha ao criar diretório de logs: {0}",
-    "gameFolderNotFound": "Pasta do jogo não encontrada: {0}",
-    "unsupportedPlatform": "Localização da pasta do jogo não confirmada nesta plataforma",
-    "openerError": "Falha ao abrir: {0}"
+    "processSpawnFailed": "Não foi possível iniciar o jogo.",
+    "logDirCreateFailed": "Não foi possível criar a pasta de logs.",
+    "gameFolderNotFound": "A pasta do jogo ainda não é conhecida. Inicie o jogo uma vez e o launcher vai encontrá-la.",
+    "openerError": "Não foi possível abrir.",
+    "indexSignatureInvalid": "O índice de mods falhou na conferência da assinatura.",
+    "indexRollback": "O índice de mods que chegou é mais antigo que o já verificado, então foi ignorado.",
+    "indexInvalid": "Não foi possível ler o índice de mods.",
+    "abiUnavailable": "Não foi possível descobrir quais mods servem para {0}. Verifique sua conexão.",
+    "modNotInCatalog": "Esse mod não está mais no catálogo. Atualize e tente de novo.",
+    "modIncompatible": "{0} não foi compilado para esta versão do jogo",
+    "modNotForPlatform": "{0} não tem biblioteca para este sistema",
+    "modRevoked": "Retirado do índice: {0}",
+    "modArchiveInvalid": "Este arquivo não é um mod do Weft.",
+    "modFileChanged": "O arquivo mudou depois da verificação. Escolha-o de novo.",
+    "modNotInstalled": "Esse mod não está mais instalado: {0}",
+    "modsBlocked": "O Weft não vai iniciar com estes mods ligados: {0}.",
+    "modSourceInvalid": "Não é um repositório do GitHub: {0}",
+    "modSourceNotFound": "Esse repositório do GitHub não existe: {0}",
+    "diskFull": "O disco está cheio.",
+    "modSourceRateLimited": "O GitHub está limitando as requisições. Tente de novo em alguns minutos.",
+    "modDownloadNotFound": "O arquivo do mod não está mais no GitHub ({0}), então nada foi instalado. Atualize e tente de novo.",
+    "modTooLarge": "O arquivo do mod é maior do que o launcher aceita, então nada foi instalado.",
+    "modIdReserved": "\"{0}\" é reservado ao próprio Weft e não pode ser o id de um mod.",
+    "modChangedMeanwhile": "Algo mudou desde que você olhou, então nada foi instalado. Veja o que mudou e confirme de novo.",
+    "unknownBare": "Aconteceu algo que o launcher não esperava.",
+    "modCancelled": "Cancelado. Nada foi alterado.",
+    "modLockInvalid": "A lista de mods desta versão está danificada, então o launcher não vai alterá-la. Remova a pasta de mods da versão ou reinstale a versão.",
+    "modUrlRefused": "Um link de download não apontava para onde a ficha do mod diz, então o launcher o recusou. Nada foi baixado.",
+    "modIconInvalid": "O ícone deste mod não é um PNG pequeno, então ele não é exibido.",
+    "details": "Detalhes",
+    "modSourcesDamaged": "Não foi possível ler sua lista de fontes de mods, então ela foi deixada de lado e guardada. Adicione suas fontes de novo; a lista antiga está em Detalhes.",
+    "modSourceRateLimitedUntil": "O GitHub está limitando as requisições até {0}. Tente de novo depois disso.",
+    "modUrlRefusedHost": "Um link de download apontava para fora do github.com, ou não usava https, então o launcher o recusou. Nada foi baixado.",
+    "modUrlRefusedForm": "Um link de download não estava escrito da forma simples de um link de download do GitHub, então o launcher o recusou. Nada foi baixado.",
+    "modUrlRefusedAsset": "Um link de download apontava para um arquivo que não é a versão deste mod no repositório do GitHub, então o launcher o recusou. Nada foi baixado.",
+    "modStoreMissing": "A cópia de {0} guardada pelo launcher sumiu, então ela não pode ser entregue ao jogo. Instale de novo para jogar com ele."
+  },
+  "mods": {
+    "title": "Mods",
+    "fromFile": "De arquivo",
+    "fileFilter": "Mod do Weft",
+    "sources": "Fontes",
+    "refresh": "Procurar mods novos",
+    "tabInstalled": "Instalados",
+    "tabInstalledLabel_one": "Instalados em {0}: {n} mod",
+    "tabBrowse": "Explorar",
+    "installedListLabel": "Mods instalados para {0}",
+    "noVersions": "Instale uma versão do jogo primeiro. Cada versão guarda os próprios mods.",
+    "emptyInstalled": "Ainda não há mods para {0}.",
+    "browseMods": "Explorar mods",
+    "copyButton": "Copiar mods de {0}",
+    "runningBanner": "{0} está em execução. Feche-o para mudar os mods.",
+    "revocationsPending": "Retirado do índice: {0}. Será desativado assim que o jogo fechar.",
+    "unmanagedBanner": "Sua própria pasta de mods do Weft tem {0}. Esses mods carregam em todas as versões, e o launcher não consegue verificá-los.",
+    "unmanagedShow": "Abrir pasta",
+    "abiUnknown": "Não foi possível verificar quais mods servem para {0}. O jogo verifica ao iniciar.",
+    "dismiss": "Fechar",
+    "metaBuiltFor": "compilado para {0}",
+    "metaBuiltForThis": "serve para {0}",
+    "metaFromSource": "de {0}",
+    "metaNeeds": "precisa de {0}",
+    "statusOff": "Desligado. O jogo não o vê.",
+    "statusWrongVersion": "Compilado para outra versão do jogo: impede Jogar.",
+    "statusWrongVersionTag": "Compilado para {0}: impede Jogar.",
+    "statusRevoked": "Desligado, retirado do índice (em inglês): “{0}”",
+    "statusUnchecked": "Não dá para verificar antes de o jogo iniciar.",
+    "statusUncheckedFile": "Do seu computador ({0}). Verificado quando o jogo inicia.",
+    "on": "Ligado",
+    "off": "Desligado",
+    "remove": "Remover",
+    "removeConfirm": "Confirmar",
+    "removeLabel": "Remover {0}",
+    "update": "Atualizar para {0}…",
+    "updateButton": "Atualizar",
+    "badgeReviewed": "Revisado",
+    "badgeUnreviewed": "Não revisado",
+    "badgeUnverified": "Não verificado",
+    "badgeReviewedHint": "No índice assinado de mods do Weft: alguém revisou exatamente este arquivo.",
+    "badgeUnreviewedHint": "De um repositório do GitHub que você adicionou. Publicado por esse repositório; ninguém revisou.",
+    "badgeUnverifiedHint": "Um arquivo do seu computador. Não dá para verificar de onde veio.",
+    "badgePrerelease": "Pré-lançamento",
+    "badgeExperimental": "Experimental",
+    "searchPlaceholder": "Buscar mods",
+    "filterFits": "Serve para {0}",
+    "filterPrereleases": "Pré-lançamentos",
+    "install": "Instalar",
+    "installed": "Instalado",
+    "notForVersion": "Sem compilação para {0}",
+    "onlyPrerelease": "Só pré-lançamentos",
+    "noSummary": "Sem descrição.",
+    "browseEmpty": "Nenhum mod corresponde à busca.",
+    "browseEmptyFits": "Nenhum mod tem compilação para {0} ainda.",
+    "browseEmptyAll": "Nenhum mod encontrado.",
+    "showAll": "Mostrar todos os mods",
+    "indexInvalid": "O índice mais novo que chegou falhou na verificação de assinatura e foi ignorado.",
+    "indexRollback": "O índice que chegou é mais antigo que o já verificado, então foi ignorado.",
+    "by": "por {0}",
+    "dlgInstallTitle": "Instalar {0} {1} para {2}?",
+    "dlgUpdateTitle": "Atualizar {0} para {1} em {2}?",
+    "dlgVersion": "Versão",
+    "checksLabel": "O que o launcher verificou",
+    "ckIndex": "Está no índice de mods do Weft",
+    "ckIndexDetail": "Revisado por {0} em {1} · assinatura do índice conferida",
+    "ckNotIndex": "Não está no índice de mods do Weft",
+    "ckNotIndexDetail": "Publicado por {0}. Ninguém revisou.",
+    "ckPinned": "Download fixado pelo SHA-256 {0} do índice assinado",
+    "ckBuilt": "O índice assinado registra: compilado pelo GitHub Actions em {0} @ {1}, conferido por {2} em {3}",
+    "ckNoBuild": "Sem registro de compilação",
+    "ckNoBuildDetail": "Nada mostra de qual código este arquivo foi compilado",
+    "ckFits": "A interface de mods declarada corresponde a esta versão",
+    "ckFitsDetail": "A compilação declara a interface de mods {0}.",
+    "warnNative": "Mods são programas. {0} pode fazer tudo o que você pode fazer neste computador. Estas verificações mostram de onde ele veio, não que seja inofensivo.",
+    "warnUnreviewed": "Ninguém revisou {0}. Ele pode fazer tudo o que você pode fazer neste computador. Instale só se confiar em {1}.",
+    "viewSource": "Ver código",
+    "cancel": "Cancelar",
+    "close": "Fechar",
+    "fileChecking": "Verificando {0} para {1}…",
+    "fileUnverifiedTitle": "Instalar o arquivo não verificado {0} em {1}?",
+    "fileKnownTitle": "Instalar {0} {1} para {2} a partir deste arquivo?",
+    "fileNotAModTitle": "{0} não pode ser instalado para {1}",
+    "fileFrom": "{0} do seu computador · {1}",
+    "fileSaysItIs": "Ele se chama de {0}.",
+    "ckFileNotKnown": "Não está no índice de mods do Weft nem nas suas fontes",
+    "ckFileKnown": "Mesmo arquivo que {0} {1} do catálogo",
+    "ckFileFitUnknown": "Não se sabe se serve",
+    "ckFileFitUnknownDetail": "O Weft verifica ao iniciar. Se não servir, o jogo não vai iniciar.",
+    "ckFileFitsNo": "Não foi compilado para {0}",
+    "ckLooksLikeMod": "Parece um mod do Weft",
+    "ckNotForSystem": "Sem biblioteca para este sistema",
+    "ckNotForSystemDetail": "Tem uma para: {0}",
+    "ckNotAMod": "Não é um mod do Weft",
+    "ckRevoked": "Retirado do índice. Motivo, em inglês: {0}",
+    "warnFile": "Só instale arquivos de pessoas em quem você confia. Um mod pode ler, mudar ou apagar seus arquivos e enviá-los para qualquer lugar.",
+    "installAnyway": "Instalar mesmo assim",
+    "sourcesTitle": "Fontes de mods",
+    "sourcesIntro": "O índice de mods do Weft está sempre ativo. Você também pode adicionar repositórios do GitHub que publicam mods; os lançamentos deles aparecem como Não revisado.",
+    "sourcesIndex": "Índice de mods do Weft",
+    "sourcesIndexFresh": "Conferido nesta atualização.",
+    "sourcesIndexNone": "ainda não acessado",
+    "sourcesAddLabel": "Repositório do GitHub",
+    "sourcesAddPlaceholder": "dono/repo ou link do GitHub",
+    "sourcesAdd": "Adicionar",
+    "sourcesRemove": "Remover",
+    "sourcesWarning": "Qualquer pessoa pode publicar um repositório. Adicione só os que você confia.",
+    "noticeInstalled": "{0} está instalado e ligado.",
+    "noticeDepsInstalled": "Também foi instalado o que ele precisa: {0}.",
+    "noticeAlsoEnabled": "Também foi ligado o que ele precisa: {0}.",
+    "noticeAlsoDisabled": "Também foi desligado o que precisa dele: {0}.",
+    "attentionDot": "Mods precisam de atenção",
+    "homeMods": "Mods para {0}: {1}",
+    "homeModsNone": "Sem mods para {0}",
+    "homeChange": "Mudar",
+    "homeAdd": "Adicionar mods",
+    "homeFixInMods": "Resolver em Mods",
+    "failureWrongVersion": "{0} impediu o Weft de iniciar: foi compilado para outra versão.",
+    "failureMissingDep": "{0} impediu o Weft de iniciar: precisa de {1}.",
+    "failureLoad": "{0} impediu o Weft de iniciar: a biblioteca dele não carregou.",
+    "failureNotAMod": "{0} impediu o Weft de iniciar: não é um mod do Weft.",
+    "failureWrongName": "{0} impediu o Weft de iniciar: o arquivo tem o nome errado.",
+    "failureInit": "Um mod travou enquanto o Weft iniciava. Abra o log para ver qual, ou desligue os mods um de cada vez para encontrá-lo.",
+    "failureOutside": "Ele está na sua própria pasta de mods do Weft, que o launcher não gerencia.",
+    "turnOff": "Desligar {0}",
+    "openModsFolder": "Abrir pasta de mods",
+    "versionPicker": "Versão",
+    "viewsLabel": "Mods para {0}",
+    "copyHeader": "Copiar mods de…",
+    "copying": "Copiando…",
+    "retry": "Tentar de novo",
+    "retrying": "Tentando…",
+    "manageSources": "Gerenciar fontes",
+    "bannersOpen": "Mais",
+    "bannersMore_one": "{n} aviso",
+    "bannersMore_many": "{n} avisos",
+    "bannersMore_other": "{n} avisos",
+    "bannersFold": "Mostrar menos",
+    "abiUnknownBrowse": "Não foi possível saber quais mods servem para {0}, então nenhum pode ser instalado agora. Verifique sua conexão e atualize.",
+    "catalogFailed": "Não foi possível carregar a lista de mods.",
+    "catalogMissing": "Este mod não está no catálogo carregado. Atualize e tente de novo.",
+    "installLabel": "Instalar {0} em {1}…",
+    "updateLabel": "Atualizar {0} em {1}…",
+    "indexShowingFrom": "Mostrando o índice de mods de {0}.",
+    "indexUnreachable": "O launcher não conseguiu acessar o índice de mods do Weft.",
+    "indexServerError": "O servidor do índice de mods do Weft respondeu com um erro.",
+    "sourceErrRate": "O GitHub está limitando as requisições, então não foi possível atualizar {0}.",
+    "sourceErrGone": "{0} não existe mais no GitHub.",
+    "sourceErrNetwork": "Não foi possível acessar {0}.",
+    "sourceErrServer": "O GitHub respondeu com um erro para {0}, então não foi possível atualizá-la.",
+    "sourceShowingFrom": "Mostrando os mods dele de {0}.",
+    "sourceShowingNone": "Os mods dele aparecem quando ele puder ser lido.",
+    "dlgNoBuildTitle": "{0} não tem compilação para {1}",
+    "dlgNoBuild": "Nenhuma compilação de {0} serve para {1} neste sistema agora.",
+    "planning": "Calculando o que isto mudaria…",
+    "ckPassed": "Aprovado",
+    "ckFailed": "Reprovado",
+    "ckNotCopied": "Não copiado",
+    "ckUnknown": "Desconhecido",
+    "ckWontInstall": "Não pode ser instalado: {0}",
+    "ckPinnedGithub": "Download fixado pela soma de verificação SHA-256 do GitHub {0}",
+    "ckPinnedGithubDetail": "A soma de verificação vem do mesmo servidor que o arquivo. Ela detecta um download corrompido, não um arquivo trocado.",
+    "ckBuiltDetail": "Workflow {0} · o launcher não confere a compilação por conta própria",
+    "ckBuiltClaimed": "Compilado pelo GitHub Actions, segundo o repositório",
+    "ckBuiltClaimedDetail": "Afirmado pelo repositório, não verificado: {0} @ {1} · {2}",
+    "ckDepInstall": "Precisa de {0}: instala {1} junto",
+    "ckDepEnable": "Precisa de {0}: também o liga",
+    "ckDepMissing": "Precisa de {0}: sem compilação para {1}",
+    "ckDepHave": "Precisa de {0}: instalado e ligado",
+    "ckDepUnknown": "Precisa de {0}: não está ligado, e o launcher não sabe se vai estar",
+    "ckReplacesTrust": "O {0} instalado era {1}; esta compilação é {2}.",
+    "ckReplacesOff": "O instalado está desligado, e a atualização continua desligada.",
+    "warnDepsUnreviewed": "Ele também traz mods que ninguém revisou: {0}.",
+    "fileUnusableTitle": "{0} não pode ser instalado para {1}",
+    "fileReplaces": "Substitui o {0} instalado.",
+    "ckLooksLikeModDetail": "{0} · nada mais no zip",
+    "ckNotAModDetail": "{0}",
+    "typeToConfirm": "Digite {0} para instalar mesmo assim",
+    "typedNotPassed_one": "Sem prova de segurança ({n}):",
+    "sourcesMods_one": "{n} mod",
+    "sourcesMods_many": "{n} mods",
+    "sourcesMods_other": "{n} mods",
+    "sourcesChecked": "verificado em {0}",
+    "sourcesNotChecked": "ainda não verificado",
+    "sourcesRemoveConfirm": "Remover {0}? Os mods que você instalou dele continuam, mas não recebem mais atualizações.",
+    "sourcesKeep": "Manter",
+    "sourcesRemoving": "Removendo…",
+    "sourcesRemoveLabel": "Remover {0}",
+    "sourcesAdding": "Adicionando…",
+    "removeConfirmLabel": "Confirmar: remover {0}",
+    "noticeInstalledOff": "{0} foi atualizado e continua desligado.",
+    "noticeMissing_one": "Nenhuma compilação de {0} serve para {1} ainda, então o que precisa dele não carrega.",
+    "noticeMissing_many": "Nenhuma compilação de {0} serve para {1} ainda, então o que precisa deles não carrega.",
+    "noticeMissing_other": "Nenhuma compilação de {0} serve para {1} ainda, então o que precisa deles não carrega.",
+    "noticeLeftBehind_one": "Não copiado: {0}.",
+    "noticeLeftBehind_many": "Não copiados: {0}.",
+    "noticeLeftBehind_other": "Não copiados: {0}.",
+    "noticeCopied_one": "{n} mod copiado de {0}.",
+    "noticeCopied_many": "{n} mods copiados de {0}.",
+    "noticeCopied_other": "{n} mods copiados de {0}.",
+    "homeBlocked_one": "O Weft {0} não vai iniciar com este mod ligado:",
+    "homeBlocked_many": "O Weft {0} não vai iniciar com estes mods ligados:",
+    "homeBlocked_other": "O Weft {0} não vai iniciar com estes mods ligados:",
+    "turnOn": "Ligar {0}",
+    "failureInitNamed": "{0} travou enquanto o Weft iniciava.",
+    "copyTitle": "Copiar mods de {0} para {1}?",
+    "copyDoneTitle": "Mods copiados para {0}",
+    "copyInstalledOn": "Instalado para {0}, ligado",
+    "copyInstalledOff": "Instalado para {0}, desligado",
+    "copyFrom": "Copiar mods de",
+    "copyWillInstall": "Instala a compilação para {0}",
+    "copyAlreadyThere": "Já está em {0}: fica como está",
+    "copyNoBuild": "Ainda sem compilação para {0}",
+    "copyLocalFile": "Um arquivo do seu computador: adicione de novo com De arquivo",
+    "copyRevoked": "Retirado do índice: não copiado",
+    "copyConfirm_one": "Copiar {n} mod para {0}",
+    "copyConfirm_many": "Copiar {n} mods para {0}",
+    "copyConfirm_other": "Copiar {n} mods para {0}",
+    "copyNothing": "Nada para copiar",
+    "copyWarn": "Mods são programas. Cada um pode fazer tudo o que você pode fazer neste computador.",
+    "copyWarnUnreviewed": "Mods são programas, e ninguém revisou estes: {0}. Cada um pode fazer tudo o que você pode fazer neste computador.",
+    "copyLeftBehindTitle_one": "Este não foi copiado:",
+    "copyLeftBehindTitle_many": "Estes não foram copiados:",
+    "copyLeftBehindTitle_other": "Estes não foram copiados:",
+    "ckReplaces": "Substitui o {0} instalado.",
+    "installDep": "Instalar {0}…",
+    "installTurnedOff": "Instalar desligado",
+    "updateTurnedOff": "Atualizar desligado",
+    "noticeRemoved": "{0} removido de {1}.",
+    "noticeRestored": "{0} voltou para {1}.",
+    "noticeRestoredOff": "{0} voltou para {1}, desligado como antes.",
+    "undo": "Desfazer",
+    "undoLabel": "Desfazer: trazer {0} de volta",
+    "ckFitUnchecked": "Não foi possível verificar se serve para {0}",
+    "badgeRevoked": "Retirado",
+    "badgeRevokedHint": "Retirado do índice. O índice diz: “{0}”",
+    "indexStale": "O índice de mods foi assinado pela última vez em {0}; retiradas posteriores podem estar faltando.",
+    "indexStaleShort": "Índice de mods assinado em {0}: pode estar desatualizado",
+    "indexUnavailable": "Os mods revisados não estão disponíveis: não há cópia salva do índice de mods do Weft. Só aparecem os mods das suas fontes.",
+    "indexDisk": "O launcher não conseguiu salvar o índice de mods.",
+    "sourceErrInvalid": "{0} mandou dados de mods que o launcher não conseguiu ler.",
+    "sourceErrDisk": "Não foi possível salvar {0} neste computador.",
+    "sourcesIndexStale": "conferido, mas assinado em {0}: retiradas posteriores podem estar faltando",
+    "profileFailed": "Não foi possível ler os mods de {0}: {1}",
+    "profileRetry": "Carregar os mods de novo",
+    "removeConfirmHint": "Pressione de novo para remover {0}.",
+    "installAnywayWhy": "Primeiro digite {0} abaixo.",
+    "copyAlsoInstalls": "Também instala o que eles precisam:",
+    "copyAlsoEnables": "Liga o que eles precisam:",
+    "copyDepInstall": "{0} {1}: um mod copiado precisa dele",
+    "copyDepEnable": "{0}: um mod copiado precisa dele, então ele é ligado",
+    "copyDepMissing": "{0}: ainda sem compilação para {1}",
+    "fixesFor": "Soluções para {0}",
+    "folderFailed": "Não foi possível abrir a pasta: {0}",
+    "statusDepsOff_one": "Precisa de {0}, que está desligado.",
+    "statusDepsOff_many": "Precisa de {0}, que estão desligados.",
+    "statusDepsOff_other": "Precisa de {0}, que estão desligados.",
+    "statusDepsRevoked_one": "Precisa de {0}, que foi retirado do índice.",
+    "statusDepsRevoked_many": "Precisa de {0}, que foram retirados do índice.",
+    "statusDepsRevoked_other": "Precisa de {0}, que foram retirados do índice.",
+    "statusDepsNotInstalled_one": "Precisa de {0}, que não está instalado.",
+    "statusDepsNotInstalled_many": "Precisa de {0}, que não estão instalados.",
+    "statusDepsNotInstalled_other": "Precisa de {0}, que não estão instalados.",
+    "statusDepsNoBuild_one": "Precisa de {0}, que ainda não tem compilação para {1}.",
+    "statusDepsNoBuild_many": "Precisa de {0}, que ainda não têm compilações para {1}.",
+    "statusDepsNoBuild_other": "Precisa de {0}, que ainda não têm compilações para {1}.",
+    "installsOff_one": "{0} ainda não tem compilação para {1}, então {2} é instalado desligado. Você continua podendo jogar.",
+    "installsOff_many": "{0} ainda não têm compilações para {1}, então {2} é instalado desligado. Você continua podendo jogar.",
+    "installsOff_other": "{0} ainda não têm compilações para {1}, então {2} é instalado desligado. Você continua podendo jogar.",
+    "noticeInstalledOffMissing_one": "{0} foi instalado desligado: {1} ainda não tem compilação para {2}. Você continua podendo jogar.",
+    "noticeInstalledOffMissing_many": "{0} foi instalado desligado: {1} ainda não têm compilações para {2}. Você continua podendo jogar.",
+    "noticeInstalledOffMissing_other": "{0} foi instalado desligado: {1} ainda não têm compilações para {2}. Você continua podendo jogar.",
+    "noticeCopiedOff_one": "Instalado desligado, porque o que ele precisa ainda não tem compilação para {1}: {0}.",
+    "noticeCopiedOff_many": "Instalados desligados, porque o que eles precisam ainda não tem compilação para {1}: {0}.",
+    "noticeCopiedOff_other": "Instalados desligados, porque o que eles precisam ainda não tem compilação para {1}: {0}.",
+    "copyInstallsOff_one": "Será instalado desligado, porque o que ele precisa ainda não tem compilação para {1}: {0}.",
+    "copyInstallsOff_many": "Serão instalados desligados, porque o que eles precisam ainda não tem compilação para {1}: {0}.",
+    "copyInstallsOff_other": "Serão instalados desligados, porque o que eles precisam ainda não tem compilação para {1}: {0}.",
+    "indexUnavailableShort": "Sem índice de mods: sem mods revisados",
+    "noticeTurnedOn": "{0} ligado.",
+    "noticeTurnedOff": "{0} desligado.",
+    "shadowOffRow": "Uma cópia na sua pasta de mods ({0}) carrega no lugar dele.",
+    "shadowRevokedRow": "A cópia da sua pasta ({0}) carregaria: impede Jogar.",
+    "ckIndexDetailDated": "Revisado por {0} em {1} · do índice assinado em {2}",
+    "ckFitUncheckedDetail": "O launcher não conseguiu descobrir a interface de mods desta versão. Tente de novo quando estiver online.",
+    "fileReplacesTrust": "Substitui o {0} instalado, que é {1}, por um arquivo que é {2}.",
+    "changedTitle": "Isto mudou desde que você olhou:",
+    "changedAdded": "Agora também instala {0} {1}",
+    "changedVersion": "{0} {1} em vez de {2}",
+    "changedTrust": "{0} agora é {1}",
+    "changedDropped": "Não instala mais {0}",
+    "changedEnables": "Agora também liga {0}",
+    "changedNoEnable": "Não liga mais {0}",
+    "changedOff": "{0} agora é instalado desligado",
+    "changedOn": "{0} agora é ligado",
+    "changedOther": "O plano mudou. Olhe de novo antes de confirmar.",
+    "ckSame": "Sem mudança",
+    "stepDownloading": "baixando {0}%",
+    "stepPreparing": "preparando",
+    "stepDownloadingSpoken": "baixando",
+    "stepVerifying": "conferindo o arquivo",
+    "stepInstalling": "instalando",
+    "progressOf": "Arquivo {0} de {1}: {2}, {3}",
+    "progressOne": "{0}: {1}",
+    "cancelling": "Cancelando…",
+    "cancelOperation": "Cancelar",
+    "needsNetworkButton": "{0} (precisa de internet)",
+    "needsNetworkNote": "Na última tentativa o launcher não conseguiu acessar a internet, e isto precisa baixar arquivos. Não vai funcionar até você estar online.",
+    "fileKnownUpdateTitle": "Atualizar {0} para {1} em {2} a partir deste arquivo?",
+    "fileReplaceTitle": "Substituir {0} pelo arquivo não verificado {1} em {2}?",
+    "replaceAnyway": "Substituir mesmo assim",
+    "typeToReplace": "Digite {0} para substituir mesmo assim",
+    "clearSearch": "Limpar busca",
+    "needsNetworkShort": "precisa de internet",
+    "removeCancelled": "{0} mantido.",
+    "showFolderFix": "Mostrar {0}",
+    "indexOfflineShort": "Offline: índice de {0}",
+    "indexCachedShort": "Usando o índice de {0}",
+    "refreshFailed": "Não foi possível atualizar a lista de mods; a mostrada é a de antes.",
+    "refreshFailedShort": "Não foi possível atualizar: mostrando a lista anterior",
+    "abiUnknownShort": "Não foi possível verificar quais mods servem para {0}",
+    "shadowBanner": "Sua pasta de mods tem uma cópia própria de {0}. A cópia do launcher está desligada, então o jogo carrega aquela.",
+    "updatesNeedCatalog": "Não foi possível carregar a lista de mods, então as atualizações não podem ser revisadas. Tente de novo acima.",
+    "updateLabelTo": "Atualizar {0} para {1} em {2}…",
+    "sourcesRetry": "Tentar de novo",
+    "sourcesLoadFailedLead": "Não foi possível ler suas fontes.",
+    "noticeShadowLoads": "Sua própria pasta de mods tem uma cópia de {0} ({1}), então o jogo carrega essa no lugar.",
+    "failureShadowed": "Sua própria pasta de mods tem uma cópia dele ({0}); o jogo pode ter carregado essa.",
+    "blockerPager": "Mods que impedem o jogo",
+    "blockerPrev": "Mod anterior que impede o jogo",
+    "blockerNext": "Próximo mod que impede o jogo",
+    "blockerPage": "{0} de {1}",
+    "playOffOne": "Jogar está desligado: {0} precisa de uma correção.",
+    "playOffMany_one": "Jogar está desligado: {n} mod precisa de uma correção.",
+    "playOffMany_many": "Jogar está desligado: {n} mods precisam de uma correção.",
+    "playOffMany_other": "Jogar está desligado: {n} mods precisam de uma correção.",
+    "toastsLabel": "O que acabou de acontecer",
+    "statusRevokedNoReason": "Desligado, retirado do índice. Nenhum motivo informado.",
+    "ckRevokedNoReason": "Retirado do índice. Nenhum motivo informado.",
+    "indexBadgeSigned": "Assinado · verificado em {0}",
+    "indexBadgeStale": "Assinado em {0} · pode estar desatualizado",
+    "indexBadgeCopy": "Cópia assinada de {0}",
+    "indexBadgeNone": "Não verificado",
+    "sourceBadgeRepo": "Repositório do GitHub",
+    "sourcesChecking": "verificando…",
+    "sourceFormatLink": "O que uma fonte precisa",
+    "sourcesDamaged": "Não foi possível ler sua lista de fontes; ela foi guardada à parte. Adicione suas fontes de novo em Fontes.",
+    "sourcesDamagedShort": "Não foi possível ler sua lista de fontes",
+    "failureShadowedStill": "Sua pasta de mods ainda tem {0}, que carrega no lugar dele, então isso ainda pode acontecer. Remova esse arquivo para ter certeza.",
+    "copyDoneSummary_one": "{n} mod copiado de {0} para {1}.",
+    "copyDoneSummary_many": "{n} mods copiados de {0} para {1}.",
+    "copyDoneSummary_other": "{n} mods copiados de {0} para {1}.",
+    "copyStaysLine_one": "{n} mod fica para trás: {0}.",
+    "copyStaysLine_many": "{n} mods ficam para trás: {0}.",
+    "copyStaysLine_other": "{n} mods ficam para trás: {0}.",
+    "indexRefusedShort": "Índice recusado: usando a cópia de {0}",
+    "blockLineWrongVersionTag": "{0} impede Jogar: foi compilado para {1}.",
+    "blockLineWrongVersion": "{0} impede Jogar: foi compilado para outra versão do jogo.",
+    "blockLineRevoked": "{0} impede Jogar: foi retirado do índice.",
+    "blockLineShadowedRevoked": "{0} impede Jogar: foi retirado do índice, mas a cópia na sua pasta de mods ({1}) carregaria no lugar dele.",
+    "blockLineDepsOff_one": "{0} impede Jogar: precisa de {1}, que está desligado.",
+    "blockLineDepsOff_many": "{0} impede Jogar: precisa de {1}, que estão desligados.",
+    "blockLineDepsOff_other": "{0} impede Jogar: precisa de {1}, que estão desligados.",
+    "blockLineDepsRevoked_one": "{0} impede Jogar: precisa de {1}, que foi retirado do índice.",
+    "blockLineDepsRevoked_many": "{0} impede Jogar: precisa de {1}, que foram retirados do índice.",
+    "blockLineDepsRevoked_other": "{0} impede Jogar: precisa de {1}, que foram retirados do índice.",
+    "blockLineDepsNotInstalled_one": "{0} impede Jogar: precisa de {1}, que não está instalado.",
+    "blockLineDepsNotInstalled_many": "{0} impede Jogar: precisa de {1}, que não estão instalados.",
+    "blockLineDepsNotInstalled_other": "{0} impede Jogar: precisa de {1}, que não estão instalados.",
+    "blockLineDepsNoBuild_one": "{0} impede Jogar: precisa de {1}, que ainda não tem compilação para {2}.",
+    "blockLineDepsNoBuild_many": "{0} impede Jogar: precisa de {1}, que ainda não têm compilações para {2}.",
+    "blockLineDepsNoBuild_other": "{0} impede Jogar: precisa de {1}, que ainda não têm compilações para {2}.",
+    "badgeRevokedHintNoReason": "Retirado do índice, sem motivo informado.",
+    "unmanagedCause_one": "Pasta própria: {n} arquivo, em toda versão",
+    "unmanagedCause_many": "Pasta própria: {n} arquivos, em toda versão",
+    "unmanagedCause_other": "Pasta própria: {n} arquivos, em toda versão",
+    "indexUnreachableShort": "Índice inacessível: sem mods revisados",
+    "sourceCauseRate": "Limite do GitHub:",
+    "sourceCauseGone": "Fonte não encontrada:",
+    "sourceCauseInvalid": "Fonte ilegível:",
+    "sourceCauseDisk": "Não deu para salvar a fonte:",
+    "sourceCauseNetwork": "Fonte inacessível:",
+    "sourceCauseServer": "Erro do GitHub:",
+    "shadowCause": "A cópia da sua pasta carrega no lugar de:",
+    "tryUpdate": "Tentar {0}…",
+    "turnOffAll_one": "Desligar os {n}",
+    "turnOffAll_many": "Desligar os {n}",
+    "turnOffAll_other": "Desligar os {n}",
+    "failureLogLine": "Linha do log",
+    "indexSays": "O índice diz, em inglês: “{0}”",
+    "indexGaveNoReason": "O índice não informou motivo.",
+    "detailsLabel": "{0}: detalhes",
+    "refusedUnread": "O Weft não iniciou por causa dos mods, e não foi possível lê-los de novo para dizer quais: {0}",
+    "refusedRetry": "Verificar os mods de novo",
+    "homeProfileFailed": "Não foi possível ler os mods de {0}: {1}",
+    "sourceNoModsLineNoReleases": "Nenhuma versão de mod compatível encontrada: ele ainda não tem versões publicadas.",
+    "sourceNoModsLineNoFiles": "Nenhuma versão de mod compatível encontrada: nenhuma versão tem um <id>.zip com o seu <id>.mod.json.",
+    "sourceNoModsLineUnreadable": "Nenhuma versão de mod compatível encontrada: não foi possível ler o <id>.mod.json de uma versão.",
+    "sourceNoModsLineNoDigest": "Nenhuma versão de mod compatível encontrada: o GitHub não tem SHA-256 dos zips, então eles não podem ser verificados.",
+    "sourceNoModsLineDisagrees": "Nenhuma versão de mod compatível encontrada: o <id>.mod.json de uma versão não confere com essa versão no GitHub.",
+    "sourceNoModsLineInvalid": "Nenhuma versão de mod compatível encontrada: as versões quebram uma regra que todo mod segue.",
+    "sourcesIndexUnsaved": "Não foi possível salvá-lo neste computador: ele é baixado de novo no próximo início e, até lá, offline aparece uma cópia salva mais antiga.",
+    "indexUnsaved": "Não foi possível salvar neste computador o índice de mods em uso. Ele funciona agora; é baixado de novo no próximo início.",
+    "indexUnsavedShort": "Índice não salvo: funciona até reiniciar",
+    "sourceRetryLabel": "Consultar {0} de novo",
+    "tabInstalledLabel_many": "Instalados em {0}: {n} de mods",
+    "tabInstalledLabel_other": "Instalados em {0}: {n} mods",
+    "typedNotPassed_many": "Sem prova de segurança ({n}):",
+    "typedNotPassed_other": "Sem prova de segurança ({n}):",
+    "removeDoubleClick": "Um clique duplo não remove {0}. Pressione Remover de novo para confirmar.",
+    "ckBuiltIncomplete": "O índice assinado tem um registro de compilação incompleto",
+    "ckBuiltIncompleteDetail": "Faltam o repositório, o workflow, o commit ou a data da conferência, então não se sabe como este arquivo foi compilado",
+    "sourcePending": "Ainda verificando {0}…",
+    "sourcesPending_one": "Ainda verificando {n} fonte…",
+    "sourcesPending_many": "Ainda verificando {n} fontes…",
+    "sourcesPending_other": "Ainda verificando {n} fontes…",
+    "turnOnAsk": "Ativar {0}? O Jogar fica bloqueado até isto ser resolvido:",
+    "keepOff": "Manter desativado",
+    "turnOnAnyway": "Ativar mesmo assim",
+    "crashNoneNamed": "O log não cita nenhum mod. Se acontecer de novo, tente sem mods.",
+    "crashTurnOffAll": "Desativar todos os mods de {0}",
+    "crashAllOff_one": "{n} mod de {0} desativado. Pressione Jogar para tentar sem ele.",
+    "crashAllOff_many": "{n} de mods de {0} desativados. Pressione Jogar para tentar sem eles.",
+    "crashAllOff_other": "{n} mods de {0} desativados. Pressione Jogar para tentar sem eles.",
+    "crashAllOn_one": "{n} mod de {0} reativado.",
+    "crashAllOn_many": "{n} de mods de {0} reativados.",
+    "crashAllOn_other": "{n} mods de {0} reativados.",
+    "checksPassed_one": "{n} verificação aprovada",
+    "checksPassed_many": "{n} de verificações aprovadas",
+    "checksPassed_other": "{n} verificações aprovadas",
+    "checksShow": "Mostrar",
+    "checksHide": "Ocultar",
+    "checksShowDetails": "Mostrar detalhes",
+    "copyIntroNone": "Nada muda em {0}:",
+    "copyEvidenceShow": "Mostrar verificações",
+    "copyEvidenceHide": "Ocultar verificações",
+    "copyEvidenceFor": "O que se sabe de {0}",
+    "copyNoEvidence": "O catálogo não lista mais esta versão",
+    "copyIntro_one": "Copiar adiciona {n} mod a {0}. Nada do que {0} tem agora é removido ou substituído.",
+    "copyIntro_many": "Copiar adiciona {n} mods a {0}. Nada do que {0} tem agora é removido ou substituído.",
+    "copyIntro_other": "Copiar adiciona {n} mods a {0}. Nada do que {0} tem agora é removido ou substituído.",
+    "ckTierDrop": "Era {0}; esta versão é {1}",
+    "ckTierDropSaid": "Nível mais baixo",
+    "replaceFromFile": "Substituir {0} por um arquivo…",
+    "homeModsOwn_one": "Mods para {0}: {1} e {n} arquivo da sua pasta",
+    "homeModsOwn_many": "Mods para {0}: {1} e {n} arquivos da sua pasta",
+    "homeModsOwn_other": "Mods para {0}: {1} e {n} arquivos da sua pasta",
+    "homeModsOnlyOwn_one": "Sem mods para {0}, mas {n} arquivo da sua pasta carrega",
+    "homeModsOnlyOwn_many": "Sem mods para {0}, mas {n} arquivos da sua pasta carregam",
+    "homeModsOnlyOwn_other": "Sem mods para {0}, mas {n} arquivos da sua pasta carregam",
+    "indexUnavailableStatusShort": "Sem índice de mods (servidor: {0}): sem mods revisados",
+    "browseNoIndex": "Os mods revisados aparecem aqui quando o índice de mods do Weft puder ser baixado.",
+    "sourceErrRateUntil": "O GitHub está limitando as requisições até {1}, então não foi possível atualizar {0}.",
+    "reinstall": "Instalar {0} de novo…"
   },
   "sizeUnits": {
     "B": "B",
     "KB": "KB",
     "MB": "MB",
     "GB": "GB"
-  }
-}
\ No newline at end of file
+  },
+  "heroBadgeBlocked": "VERSÃO {0} · MODS PRECISAM DE AJUSTE",
+  "deleteWithMods_one": "Excluir com {n} mod",
+  "deleteWithMods_many": "Excluir com {n} mods",
+  "deleteWithMods_other": "Excluir com {n} mods",
+  "versionModCount_one": "{n} mod",
+  "versionModCount_many": "{n} mods",
+  "versionModCount_other": "{n} mods",
+  "versionModsBlocked": "Mods impedem o início. Resolva na aba Início ou Mods.",
+  "heroBadgeChecking": "VERSÃO {0} · VERIFICANDO MODS",
+  "heroBadgeUnchecked": "VERSÃO {0} · MODS NÃO VERIFICADOS",
+  "starting": "Iniciando...",
+  "deleteConfirmHint": "Pressione de novo para excluir {0} com seus mods. Isso não pode ser desfeito.",
+  "deleteConfirmHintBare": "Pressione de novo para excluir {0}. Isso não pode ser desfeito.",
+  "deleteCancelled": "A versão {0} continua instalada.",
+  "deleteDoubleClick": "Um clique duplo não exclui {0}. Pressione Excluir de novo para confirmar."
+}
diff --git a/src/i18n/ru.json b/src/i18n/ru.json
index 4260a2f..c5cbecf 100644
--- a/src/i18n/ru.json
+++ b/src/i18n/ru.json
@@ -1,21 +1,17 @@
 {
-  "appTitle": "Weft Launcher",
   "latestBadge": "Последняя",
   "updateAvailable": "ДОСТУПНО ОБНОВЛЕНИЕ",
-"updateDownloading": "ОБНОВЛЕНИЕ {0}%",
-"updateFailed": "ОШИБКА ОБНОВЛЕНИЯ · ПОВТОРИТЬ",
-"updateTooltip": "Обновить до версии {0} и перезапустить",
-"updateCloseGame": "Закройте игру перед обновлением",
+  "updateDownloading": "ОБНОВЛЕНИЕ {0}%",
+  "updateFailed": "ОШИБКА ОБНОВЛЕНИЯ · ПОВТОРИТЬ",
+  "updateTooltip": "Обновить до версии {0} и перезапустить",
+  "updateCloseGame": "Закройте игру перед обновлением",
   "refreshButton": "Обновить список",
   "loading": "Загрузка...",
   "cacheBanner": "Показан кэш (нет сети или нет обновлений)",
-  "errorPrefix": "Ошибка: ",
   "emptyState": "Версии не найдены.",
   "installButton": "Установить",
-  "installedBadge": "Установлена",
   "deleteButton": "Удалить",
   "deleteForReal": "Удалить навсегда",
-  "confirmDelete": "Вы уверены, что хотите удалить эту версию? Это действие нельзя отменить.",
   "playButton": "Играть",
   "playing": "В игре",
   "progressDownloading": "Загрузка... {0}% — {1} Мбит/с",
@@ -25,10 +21,6 @@
   "deleteDisabledTooltip": "Закройте игру, чтобы удалить",
   "playDisabledTooltip": "Уже запущена другая игра: {0}",
   "installedAtLabel": "Установлена",
-  "linkDiscord": "Discord",
-  "linkWebsite": "Сайт",
-  "releasedLabel": "Выпуск",
-  "inUseBadge": "Используется",
   "noChangelog": "Нет списка изменений.",
   "newBadge": "Новая",
   "openFolderButton": "Открыть папку",
@@ -36,6 +28,8 @@
   "openLogButton": "Открыть лог",
   "tabHome": "Главная",
   "tabVersions": "Версии",
+  "tabMods": "Моды",
+  "newVersionsDot": "Есть новые версии",
   "tabNotes": "Список изменений",
   "tabsLabel": "Основные вкладки",
   "selectVersionLabel": "Выбор версии",
@@ -51,34 +45,577 @@
   "errors": {
     "invalidName": "Недопустимое имя: {0}",
     "installInProgress": "Уже устанавливается: {0}",
-    "network": "Ошибка сети: {0}",
-    "io": "Ошибка ввода-вывода: {0}",
-    "serialization": "Ошибка сериализации: {0}",
-    "httpHeader": "Ошибка HTTP-заголовка: {0}",
-    "cacheCorrupted": "Кэш повреждён: {0}",
-    "assetNotFound": "Файл для текущей платформы не найден",
-    "missingDigest": "В файле отсутствует SHA256",
+    "network": "Лаунчер не смог связаться с сервером. Проверьте подключение и попробуйте снова.",
+    "httpStatus": "Сервер ответил, но с ошибкой. Попробуйте позже.",
+    "io": "Не удалось прочитать или записать файл.",
+    "serialization": "Пришёл ответ, который лаунчер не смог прочитать.",
+    "httpHeader": "Сервер прислал ответ, которым лаунчер не может воспользоваться.",
+    "cacheCorrupted": "Сохранённая копия повреждена. Обновите список, чтобы скачать её заново.",
+    "assetNotFound": "У этого релиза нет файла для вашей системы.",
+    "missingDigest": "Этот релиз не публикует SHA-256 своего файла, поэтому лаунчер не может его проверить.",
     "rateLimited": "Превышен лимит запросов к API GitHub. Повторите позже.",
     "forbidden": "Доступ к API GitHub запрещён (403). Используется кэш, если он есть.",
     "offlineNoCache": "Нет сети и нет кэша",
-    "zip": "Ошибка ZIP: {0}",
-    "createDir": "Не удалось создать директорию: {0}",
-    "sha256Mismatch": "SHA256 не совпадает",
-    "hashMissing": "Не указан обязательный SHA256",
+    "zip": "Загруженный файл — не zip, который лаунчер может открыть.",
+    "createDir": "Не удалось создать папку.",
+    "sha256Mismatch": "Загруженный файл не совпал с закреплённым SHA-256, поэтому ничего не установлено. Попробуйте снова; если повторится, файл на сервере изменился.",
+    "hashMissing": "Нигде не указано, каким должен быть SHA-256 этого файла, поэтому его нельзя проверить.",
     "alreadyInstalled": "Версия уже установлена: {0}",
     "notInstalled": "Версия не установлена: {0}",
-    "downloadFailed": "Ошибка загрузки: {0}",
-    "extractFailed": "Ошибка распаковки: {0}",
+    "downloadFailed": "Загрузка не удалась. Попробуйте снова.",
+    "extractFailed": "Не удалось распаковать игру.",
     "gameRunning": "Уже запущена другая игра: {0}. Закройте её перед запуском новой.",
     "versionInUse": "Версия используется (файл заблокирован): {0}. Закройте игру, чтобы удалить.",
     "alreadyRunning": "Эта версия уже запущена",
     "anotherGameRunning": "Уже запущена другая игра: {0}",
     "executableNotFound": "Исполняемый файл не найден: {0}",
-    "processSpawnFailed": "Не удалось запустить процесс: {0}",
-    "logDirCreateFailed": "Не удалось создать директорию для логов: {0}",
-    "gameFolderNotFound": "Папка игры не найдена: {0}",
-    "unsupportedPlatform": "Расположение папки игры не подтверждено на этой платформе",
-    "openerError": "Не удалось открыть: {0}"
+    "processSpawnFailed": "Не удалось запустить игру.",
+    "logDirCreateFailed": "Не удалось создать папку для логов.",
+    "gameFolderNotFound": "Папка игры пока неизвестна. Запустите игру один раз, и лаунчер её найдёт.",
+    "openerError": "Не удалось открыть.",
+    "indexSignatureInvalid": "Индекс модов не прошёл проверку подписи.",
+    "indexRollback": "Пришедший индекс модов старше уже проверенного, поэтому он проигнорирован.",
+    "indexInvalid": "Не удалось прочитать индекс модов.",
+    "abiUnavailable": "Не удалось узнать, какие моды подходят к {0}. Проверьте подключение.",
+    "modNotInCatalog": "Этого мода больше нет в каталоге. Обновите список и попробуйте снова.",
+    "modIncompatible": "{0} собран не для этой версии игры",
+    "modNotForPlatform": "У {0} нет библиотеки для этой системы",
+    "modRevoked": "Отозван из индекса: {0}",
+    "modArchiveInvalid": "Этот файл — не мод Weft.",
+    "modFileChanged": "Файл изменился после проверки. Выберите его заново.",
+    "modNotInstalled": "Этот мод уже не установлен: {0}",
+    "modsBlocked": "Weft не запустится с этими включёнными модами: {0}.",
+    "modSourceInvalid": "Это не репозиторий GitHub: {0}",
+    "modSourceNotFound": "Такого репозитория GitHub нет: {0}",
+    "diskFull": "Диск заполнен.",
+    "modSourceRateLimited": "GitHub ограничивает запросы. Попробуйте через несколько минут.",
+    "modDownloadNotFound": "Файла мода больше нет на GitHub ({0}), поэтому ничего не установлено. Обновите список и попробуйте снова.",
+    "modTooLarge": "Файл мода больше, чем принимает лаунчер, поэтому ничего не установлено.",
+    "modIdReserved": "«{0}» зарезервирован для самого Weft и не может быть id мода.",
+    "modChangedMeanwhile": "С тех пор как вы смотрели, что-то изменилось, поэтому ничего не установлено. Посмотрите, что изменилось, и подтвердите ещё раз.",
+    "unknownBare": "Произошло то, чего лаунчер не ожидал.",
+    "modCancelled": "Отменено. Ничего не изменилось.",
+    "modLockInvalid": "Список модов этой версии повреждён, поэтому лаунчер не будет его менять. Удалите папку модов этой версии или переустановите версию.",
+    "modUrlRefused": "Ссылка для загрузки вела не туда, куда указано в описании мода, поэтому лаунчер её отклонил. Ничего не загружено.",
+    "modIconInvalid": "Значок этого мода — не маленький PNG, поэтому он не показан.",
+    "details": "Подробности",
+    "modSourcesDamaged": "Не удалось прочитать ваш список источников модов, поэтому он отложен и сохранён. Добавьте источники заново; старый список — в «Подробностях».",
+    "modSourceRateLimitedUntil": "GitHub ограничивает запросы до {0}. Попробуйте после этого.",
+    "modUrlRefusedHost": "Ссылка для загрузки вела не на github.com или не по https, поэтому лаунчер её отклонил. Ничего не загружено.",
+    "modUrlRefusedForm": "Ссылка для загрузки записана не так, как пишется обычная ссылка загрузки GitHub, поэтому лаунчер её отклонил. Ничего не загружено.",
+    "modUrlRefusedAsset": "Ссылка для загрузки вела не на релиз этого мода в его репозитории GitHub, поэтому лаунчер её отклонил. Ничего не загружено.",
+    "modStoreMissing": "Сохранённая лаунчером копия {0} пропала, поэтому её нельзя передать игре. Установите мод снова, чтобы играть с ним."
   },
-  "sizeUnits": { "B": "Б", "KB": "КБ", "MB": "МБ", "GB": "ГБ" }
-}
\ No newline at end of file
+  "mods": {
+    "title": "Моды",
+    "fromFile": "Из файла",
+    "fileFilter": "Мод Weft",
+    "sources": "Источники",
+    "refresh": "Проверить новые моды",
+    "tabInstalled": "Установлено",
+    "tabInstalledLabel_one": "Установлено в {0}: {n} мод",
+    "tabInstalledLabel_few": "Установлено в {0}: {n} мода",
+    "tabInstalledLabel_many": "Установлено в {0}: {n} модов",
+    "tabInstalledLabel_other": "Установлено в {0}: {n} мода",
+    "tabBrowse": "Каталог",
+    "installedListLabel": "Моды, установленные для {0}",
+    "noVersions": "Сначала установите версию игры. У каждой версии свой набор модов.",
+    "emptyInstalled": "Для {0} модов пока нет.",
+    "browseMods": "Открыть каталог",
+    "copyButton": "Скопировать моды из {0}",
+    "runningBanner": "{0} запущена. Закройте игру, чтобы менять её моды.",
+    "revocationsPending": "Отозвано из индекса: {0}. Будет выключено, как только игра закроется.",
+    "unmanagedBanner": "В вашей папке модов Weft лежит: {0}. Эти моды загружаются во всех версиях, и лаунчер не может их проверить.",
+    "unmanagedShow": "Открыть папку",
+    "abiUnknown": "Не удалось проверить, какие моды подходят к {0}. Игра проверит их при запуске.",
+    "dismiss": "Скрыть",
+    "metaBuiltFor": "собран для {0}",
+    "metaBuiltForThis": "подходит к {0}",
+    "metaFromSource": "из {0}",
+    "metaNeeds": "нужен {0}",
+    "statusOff": "Выключен. Игра его не видит.",
+    "statusWrongVersion": "Собран для другой версии игры: не даёт играть.",
+    "statusWrongVersionTag": "Собран для {0}: не даёт играть.",
+    "statusRevoked": "Выключен, отозван из индекса (англ.): «{0}»",
+    "statusUnchecked": "Проверить можно только при запуске игры.",
+    "statusUncheckedFile": "С вашего компьютера ({0}). Проверяется при запуске игры.",
+    "on": "Вкл",
+    "off": "Выкл",
+    "remove": "Удалить",
+    "removeConfirm": "Точно?",
+    "removeLabel": "Удалить {0}",
+    "update": "Обновить до {0}…",
+    "updateButton": "Обновить",
+    "badgeReviewed": "Одобрен",
+    "badgeUnreviewed": "Без модерации",
+    "badgeUnverified": "С компьютера",
+    "badgeReviewedHint": "В подписанном индексе модов Weft: модератор одобрил именно этот файл.",
+    "badgeUnreviewedHint": "Из добавленного вами репозитория GitHub. Опубликован этим репозиторием без модерации.",
+    "badgeUnverifiedHint": "Файл с вашего компьютера: откуда он взялся, узнать нельзя.",
+    "badgePrerelease": "Предрелиз",
+    "badgeExperimental": "Экспериментальный",
+    "searchPlaceholder": "Поиск модов",
+    "filterFits": "Подходит к {0}",
+    "filterPrereleases": "Предрелизы",
+    "install": "Установить",
+    "installed": "Установлен",
+    "notForVersion": "Нет сборки для {0}",
+    "onlyPrerelease": "Только предрелизы",
+    "noSummary": "Нет описания.",
+    "browseEmpty": "По запросу ничего не нашлось.",
+    "browseEmptyFits": "Пока ни у одного мода нет сборки для {0}.",
+    "browseEmptyAll": "Модов не найдено.",
+    "showAll": "Показать все моды",
+    "indexInvalid": "Полученный новый индекс не прошёл проверку подписи и был проигнорирован.",
+    "indexRollback": "Полученный индекс старше уже проверенного, поэтому он проигнорирован.",
+    "by": "автор: {0}",
+    "dlgInstallTitle": "Установить {0} {1} для {2}?",
+    "dlgUpdateTitle": "Обновить {0} до {1} для {2}?",
+    "dlgVersion": "Версия",
+    "checksLabel": "Что проверил лаунчер",
+    "ckIndex": "Есть в индексе модов Weft",
+    "ckIndexDetail": "Одобрил {0}, {1} · подпись индекса верна",
+    "ckNotIndex": "Нет в индексе модов Weft",
+    "ckNotIndexDetail": "Опубликован в {0} без модерации.",
+    "ckPinned": "Загрузка закреплена по SHA-256 {0} из подписанного индекса",
+    "ckBuilt": "Подписанный индекс записал: собран GitHub Actions в {0} @ {1}, проверил {2}, {3}",
+    "ckNoBuild": "Нет записи о сборке",
+    "ckNoBuildDetail": "Нельзя узнать, из какого кода собран этот файл",
+    "ckFits": "Заявленный интерфейс модов совпадает с этой версией",
+    "ckFitsDetail": "Сборка заявляет интерфейс модов {0}.",
+    "warnNative": "Моды — это программы. {0} может делать на этом компьютере всё то же, что и вы. Эти проверки показывают, откуда он, но не то, что он безвреден.",
+    "warnUnreviewed": "{0} опубликован без модерации. Он может делать на этом компьютере всё то же, что и вы. Устанавливайте, только если доверяете {1}.",
+    "viewSource": "Исходный код",
+    "cancel": "Отмена",
+    "close": "Закрыть",
+    "fileChecking": "Проверка {0} для {1}…",
+    "fileUnverifiedTitle": "Установить файл {0} с вашего компьютера для {1}?",
+    "fileKnownTitle": "Установить {0} {1} для {2} из этого файла?",
+    "fileNotAModTitle": "{0} нельзя установить для {1}",
+    "fileFrom": "{0} с вашего компьютера · {1}",
+    "fileSaysItIs": "Он называет себя {0}.",
+    "ckFileNotKnown": "Нет ни в индексе модов Weft, ни в ваших источниках",
+    "ckFileKnown": "Тот же файл, что {0} {1} из каталога",
+    "ckFileFitUnknown": "Неизвестно, подходит ли",
+    "ckFileFitUnknownDetail": "Weft проверит при запуске. Если не подходит, игра не запустится.",
+    "ckFileFitsNo": "Собран не для {0}",
+    "ckLooksLikeMod": "Похоже на мод Weft",
+    "ckNotForSystem": "Нет библиотеки для этой системы",
+    "ckNotForSystemDetail": "Есть только для: {0}",
+    "ckNotAMod": "Это не мод Weft",
+    "ckRevoked": "Отозван из индекса. Причина по-английски: {0}",
+    "warnFile": "Устанавливайте файлы только от тех, кому доверяете. Мод может читать, менять и удалять ваши файлы и отправлять их куда угодно.",
+    "installAnyway": "Всё равно установить",
+    "sourcesTitle": "Источники модов",
+    "sourcesIntro": "Индекс модов Weft включён всегда. Можно добавить и репозитории GitHub, которые публикуют моды: их релизы будут помечены как «Без модерации».",
+    "sourcesIndex": "Индекс модов Weft",
+    "sourcesIndexFresh": "Проверен при этом обновлении.",
+    "sourcesIndexNone": "пока недоступен",
+    "sourcesAddLabel": "Репозиторий GitHub",
+    "sourcesAddPlaceholder": "владелец/репо или ссылка",
+    "sourcesAdd": "Добавить",
+    "sourcesRemove": "Убрать",
+    "sourcesWarning": "Репозиторий может опубликовать кто угодно. Добавляйте только те, которым доверяете.",
+    "noticeInstalled": "{0} установлен и включён.",
+    "noticeDepsInstalled": "Заодно установлено то, что ему нужно: {0}.",
+    "noticeAlsoEnabled": "Заодно включено то, что ему нужно: {0}.",
+    "noticeAlsoDisabled": "Заодно выключено то, чему он нужен: {0}.",
+    "attentionDot": "Модам нужно внимание",
+    "homeMods": "Моды для {0}: {1}",
+    "homeModsNone": "Без модов для {0}",
+    "homeChange": "Изменить",
+    "homeAdd": "Добавить моды",
+    "homeFixInMods": "Исправить в «Модах»",
+    "failureWrongVersion": "{0} не дал Weft запуститься: он собран для другой версии.",
+    "failureMissingDep": "{0} не дал Weft запуститься: ему нужен {1}.",
+    "failureLoad": "{0} не дал Weft запуститься: его библиотека не загрузилась.",
+    "failureNotAMod": "{0} не дал Weft запуститься: это не мод Weft.",
+    "failureWrongName": "{0} не дал Weft запуститься: у файла неверное имя.",
+    "failureInit": "Мод упал при запуске Weft. Откройте лог, чтобы узнать какой, или выключайте моды по одному, чтобы его найти.",
+    "failureOutside": "Он лежит в вашей собственной папке модов Weft, которой лаунчер не управляет.",
+    "turnOff": "Выключить {0}",
+    "openModsFolder": "Открыть папку модов",
+    "versionPicker": "Версия",
+    "viewsLabel": "Моды для {0}",
+    "copyHeader": "Скопировать моды из…",
+    "copying": "Копирую…",
+    "retry": "Повторить",
+    "retrying": "Повтор…",
+    "manageSources": "Источники",
+    "bannersOpen": "Ещё",
+    "bannersMore_one": "{n} заметка",
+    "bannersMore_few": "{n} заметки",
+    "bannersMore_many": "{n} заметок",
+    "bannersMore_other": "{n} заметки",
+    "bannersFold": "Свернуть",
+    "abiUnknownBrowse": "Не удалось узнать, какие моды подходят к {0}, поэтому сейчас ничего установить нельзя. Проверьте подключение и обновите список.",
+    "catalogFailed": "Не удалось загрузить список модов.",
+    "catalogMissing": "Этого мода нет в загруженном каталоге. Обновите список и попробуйте снова.",
+    "installLabel": "Установить {0} для {1}…",
+    "updateLabel": "Обновить {0} для {1}…",
+    "indexShowingFrom": "Показан индекс модов от {0}.",
+    "indexUnreachable": "Лаунчер не смог связаться с индексом модов Weft.",
+    "indexServerError": "Сервер индекса модов Weft ответил ошибкой.",
+    "sourceErrRate": "GitHub ограничивает запросы, поэтому {0} не удалось обновить.",
+    "sourceErrGone": "{0} больше нет на GitHub.",
+    "sourceErrNetwork": "{0} недоступен.",
+    "sourceErrServer": "GitHub ответил ошибкой для {0}, поэтому источник не обновлён.",
+    "sourceShowingFrom": "Показаны его моды от {0}.",
+    "sourceShowingNone": "Его моды появятся, когда его удастся прочитать.",
+    "dlgNoBuildTitle": "У {0} нет сборки для {1}",
+    "dlgNoBuild": "Сейчас ни одна сборка {0} не подходит к {1} на этой системе.",
+    "planning": "Выясняем, что изменится…",
+    "ckPassed": "Пройдено",
+    "ckFailed": "Не пройдено",
+    "ckNotCopied": "Не копируется",
+    "ckUnknown": "Неизвестно",
+    "ckWontInstall": "Установить нельзя: {0}",
+    "ckPinnedGithub": "Загрузка закреплена по контрольной сумме SHA-256 от GitHub {0}",
+    "ckPinnedGithubDetail": "Контрольная сумма приходит с того же сервера, что и файл. Она ловит повреждённую загрузку, но не подменённый файл.",
+    "ckBuiltDetail": "Workflow {0} · сам лаунчер сборку не проверяет",
+    "ckBuiltClaimed": "Собран GitHub Actions, по словам репозитория",
+    "ckBuiltClaimedDetail": "Так утверждает репозиторий, никто не проверял: {0} @ {1} · {2}",
+    "ckDepInstall": "Нужен {0}: вместе с ним установится {1}",
+    "ckDepEnable": "Нужен {0}: он тоже включится",
+    "ckDepMissing": "Нужен {0}: нет сборки для {1}",
+    "ckDepHave": "Нужен {0}: установлен и включён",
+    "ckDepUnknown": "Нужен {0}: он выключен, и лаунчер не знает, включится ли он",
+    "ckReplacesTrust": "Установленная версия {0} — {1}; эта сборка — {2}.",
+    "ckReplacesOff": "Установленный мод выключен, и после обновления останется выключенным.",
+    "warnDepsUnreviewed": "С ним придут и моды без модерации: {0}.",
+    "fileUnusableTitle": "{0} нельзя установить для {1}",
+    "fileReplaces": "Заменит установленный {0}.",
+    "ckLooksLikeModDetail": "{0} · больше ничего в архиве",
+    "ckNotAModDetail": "{0}",
+    "typeToConfirm": "Введите {0}, чтобы всё равно установить",
+    "typedNotPassed_one": "Безопасность не подтверждена ({n}):",
+    "typedNotPassed_few": "Безопасность не подтверждена ({n}):",
+    "typedNotPassed_many": "Безопасность не подтверждена ({n}):",
+    "typedNotPassed_other": "Безопасность не подтверждена ({n}):",
+    "sourcesMods_one": "{n} мод",
+    "sourcesMods_few": "{n} мода",
+    "sourcesMods_many": "{n} модов",
+    "sourcesMods_other": "{n} мода",
+    "sourcesChecked": "обновлён {0}",
+    "sourcesNotChecked": "ещё не обновлялся",
+    "sourcesRemoveConfirm": "Убрать {0}? Установленные из него моды останутся, но перестанут обновляться.",
+    "sourcesKeep": "Оставить",
+    "sourcesRemoving": "Удаление…",
+    "sourcesRemoveLabel": "Убрать {0}",
+    "sourcesAdding": "Добавление…",
+    "removeConfirmLabel": "Подтвердить удаление {0}",
+    "noticeInstalledOff": "{0} обновлён и остался выключенным.",
+    "noticeMissing_one": "Ни одна сборка {0} пока не подходит к {1}, поэтому зависящие от него моды не загрузятся.",
+    "noticeMissing_few": "Ни одна сборка {0} пока не подходит к {1}, поэтому зависящие от них моды не загрузятся.",
+    "noticeMissing_many": "Ни одна сборка {0} пока не подходит к {1}, поэтому зависящие от них моды не загрузятся.",
+    "noticeMissing_other": "Ни одна сборка {0} пока не подходит к {1}, поэтому зависящие от них моды не загрузятся.",
+    "noticeLeftBehind_one": "Не скопирован: {0}.",
+    "noticeLeftBehind_few": "Не скопированы: {0}.",
+    "noticeLeftBehind_many": "Не скопированы: {0}.",
+    "noticeLeftBehind_other": "Не скопированы: {0}.",
+    "noticeCopied_one": "Скопирован {n} мод из {0}.",
+    "noticeCopied_few": "Скопировано {n} мода из {0}.",
+    "noticeCopied_many": "Скопировано {n} модов из {0}.",
+    "noticeCopied_other": "Скопировано {n} мода из {0}.",
+    "homeBlocked_one": "Weft {0} не запустится с этим включённым модом:",
+    "homeBlocked_few": "Weft {0} не запустится с этими включёнными модами:",
+    "homeBlocked_many": "Weft {0} не запустится с этими включёнными модами:",
+    "homeBlocked_other": "Weft {0} не запустится с этими включёнными модами:",
+    "turnOn": "Включить {0}",
+    "failureInitNamed": "{0} упал при запуске Weft.",
+    "copyTitle": "Скопировать моды из {0} в {1}?",
+    "copyDoneTitle": "Моды скопированы в {0}",
+    "copyInstalledOn": "Установлен для {0}, включён",
+    "copyInstalledOff": "Установлен для {0}, выключен",
+    "copyFrom": "Скопировать моды из",
+    "copyWillInstall": "Установится его сборка для {0}",
+    "copyAlreadyThere": "Уже есть в {0}: останется как есть",
+    "copyNoBuild": "Пока нет сборки для {0}",
+    "copyLocalFile": "Файл с вашего компьютера: добавьте его снова через «Из файла»",
+    "copyRevoked": "Отозван из индекса: не копируется",
+    "copyConfirm_one": "Скопировать {n} мод в {0}",
+    "copyConfirm_many": "Скопировать {n} модов в {0}",
+    "copyConfirm_other": "Скопировать {n} мода в {0}",
+    "copyNothing": "Нечего копировать",
+    "copyWarn": "Моды — это программы. Каждый может делать на этом компьютере всё то же, что и вы.",
+    "copyWarnUnreviewed": "Моды — это программы, а эти опубликованы без модерации: {0}. Каждый может делать на этом компьютере всё то же, что и вы.",
+    "copyLeftBehindTitle_one": "Этот не скопирован:",
+    "copyLeftBehindTitle_few": "Эти не скопированы:",
+    "copyLeftBehindTitle_many": "Эти не скопированы:",
+    "copyLeftBehindTitle_other": "Эти не скопированы:",
+    "ckReplaces": "Заменит установленную версию {0}.",
+    "copyConfirm_few": "Скопировать {n} мода в {0}",
+    "installDep": "Установить {0}…",
+    "installTurnedOff": "Установить выключенным",
+    "updateTurnedOff": "Обновить выключенным",
+    "noticeRemoved": "{0} удалён из {1}.",
+    "noticeRestored": "{0} снова в {1}.",
+    "noticeRestoredOff": "{0} снова в {1}, выключен, как и был.",
+    "undo": "Вернуть",
+    "undoLabel": "Вернуть {0}",
+    "ckFitUnchecked": "Не удалось проверить, подходит ли к {0}",
+    "badgeRevoked": "Отозван",
+    "badgeRevokedHint": "Отозван из индекса. Индекс сообщает: «{0}»",
+    "indexStale": "Индекс модов последний раз подписан {0}: моды, отозванные позже, могут быть не помечены.",
+    "indexStaleShort": "Индекс модов подписан {0}: может быть устаревшим",
+    "indexUnavailable": "Одобренные моды недоступны: сохранённой копии индекса модов Weft нет. Показаны только моды из ваших источников.",
+    "indexDisk": "Лаунчер не смог сохранить индекс модов.",
+    "sourceErrInvalid": "{0} прислал данные о модах, которые лаунчер не смог прочитать.",
+    "sourceErrDisk": "Не удалось сохранить {0} на этом компьютере.",
+    "sourcesIndexStale": "подпись верна, но поставлена {0}: моды, отозванные позже, могут быть не помечены",
+    "profileFailed": "Не удалось прочитать моды {0}: {1}",
+    "profileRetry": "Загрузить моды снова",
+    "removeConfirmHint": "Нажмите ещё раз, чтобы удалить {0}.",
+    "installAnywayWhy": "Сначала введите {0} ниже.",
+    "copyAlsoInstalls": "Заодно установится то, что им нужно:",
+    "copyAlsoEnables": "Заодно включится то, что им нужно:",
+    "copyDepInstall": "{0} {1}: нужен скопированному моду",
+    "copyDepEnable": "{0}: нужен скопированному моду, поэтому включится",
+    "copyDepMissing": "{0}: пока нет сборки для {1}",
+    "fixesFor": "Исправления для {0}",
+    "folderFailed": "Не удалось открыть папку: {0}",
+    "statusDepsOff_one": "Нужен {0}, а он выключен.",
+    "statusDepsOff_few": "Нужны {0}, а они выключены.",
+    "statusDepsOff_many": "Нужны {0}, а они выключены.",
+    "statusDepsOff_other": "Нужны {0}, а они выключены.",
+    "statusDepsRevoked_one": "Нужен {0}, а он отозван из индекса.",
+    "statusDepsRevoked_few": "Нужны {0}, а они отозваны из индекса.",
+    "statusDepsRevoked_many": "Нужны {0}, а они отозваны из индекса.",
+    "statusDepsRevoked_other": "Нужны {0}, а они отозваны из индекса.",
+    "statusDepsNotInstalled_one": "Нужен {0}, а он не установлен.",
+    "statusDepsNotInstalled_few": "Нужны {0}, а они не установлены.",
+    "statusDepsNotInstalled_many": "Нужны {0}, а они не установлены.",
+    "statusDepsNotInstalled_other": "Нужны {0}, а они не установлены.",
+    "statusDepsNoBuild_one": "Нужен {0}, а у него пока нет сборки для {1}.",
+    "statusDepsNoBuild_few": "Нужны {0}, а у них пока нет сборок для {1}.",
+    "statusDepsNoBuild_many": "Нужны {0}, а у них пока нет сборок для {1}.",
+    "statusDepsNoBuild_other": "Нужны {0}, а у них пока нет сборок для {1}.",
+    "installsOff_one": "У {0} пока нет сборки для {1}, поэтому {2} установится выключенным. Играть можно и дальше.",
+    "installsOff_few": "У {0} пока нет сборок для {1}, поэтому {2} установится выключенным. Играть можно и дальше.",
+    "installsOff_many": "У {0} пока нет сборок для {1}, поэтому {2} установится выключенным. Играть можно и дальше.",
+    "installsOff_other": "У {0} пока нет сборок для {1}, поэтому {2} установится выключенным. Играть можно и дальше.",
+    "noticeInstalledOffMissing_one": "{0} установлен выключенным: у {1} пока нет сборки для {2}. Играть можно и дальше.",
+    "noticeInstalledOffMissing_few": "{0} установлен выключенным: у {1} пока нет сборок для {2}. Играть можно и дальше.",
+    "noticeInstalledOffMissing_many": "{0} установлен выключенным: у {1} пока нет сборок для {2}. Играть можно и дальше.",
+    "noticeInstalledOffMissing_other": "{0} установлен выключенным: у {1} пока нет сборок для {2}. Играть можно и дальше.",
+    "noticeCopiedOff_one": "Установлен выключенным, потому что у нужного ему мода пока нет сборки для {1}: {0}.",
+    "noticeCopiedOff_few": "Установлены выключенными, потому что у нужных им модов пока нет сборок для {1}: {0}.",
+    "noticeCopiedOff_many": "Установлены выключенными, потому что у нужных им модов пока нет сборок для {1}: {0}.",
+    "noticeCopiedOff_other": "Установлены выключенными, потому что у нужных им модов пока нет сборок для {1}: {0}.",
+    "copyInstallsOff_one": "Установится выключенным, потому что у нужного ему мода пока нет сборки для {1}: {0}.",
+    "copyInstallsOff_few": "Установятся выключенными, потому что у нужных им модов пока нет сборок для {1}: {0}.",
+    "copyInstallsOff_many": "Установятся выключенными, потому что у нужных им модов пока нет сборок для {1}: {0}.",
+    "copyInstallsOff_other": "Установятся выключенными, потому что у нужных им модов пока нет сборок для {1}: {0}.",
+    "indexUnavailableShort": "Нет индекса: нет одобренных модов",
+    "noticeTurnedOn": "{0} включён.",
+    "noticeTurnedOff": "{0} выключен.",
+    "shadowOffRow": "Вместо него загружается копия из вашей папки модов ({0}).",
+    "shadowRevokedRow": "Копия из вашей папки ({0}) загрузится: не даёт играть.",
+    "ckIndexDetailDated": "Одобрил {0}, {1} · из индекса, подписанного {2}",
+    "ckFitUncheckedDetail": "Лаунчер не смог узнать интерфейс модов этой версии. Повторите, когда будете в сети.",
+    "fileReplacesTrust": "Заменит установленный {0} (уровень: {1}) файлом с уровнем «{2}».",
+    "changedTitle": "С тех пор как вы смотрели, изменилось:",
+    "changedAdded": "Теперь ещё устанавливается {0} {1}",
+    "changedVersion": "{0} {1} вместо {2}",
+    "changedTrust": "{0} теперь: {1}",
+    "changedDropped": "Больше не устанавливается {0}",
+    "changedEnables": "Теперь ещё включается {0}",
+    "changedNoEnable": "Больше не включается {0}",
+    "changedOff": "{0} теперь устанавливается выключенным",
+    "changedOn": "{0} теперь включается",
+    "changedOther": "План изменился. Посмотрите ещё раз, прежде чем подтвердить.",
+    "ckSame": "Без изменений",
+    "stepDownloading": "загрузка {0}%",
+    "stepPreparing": "подготовка",
+    "stepDownloadingSpoken": "загрузка",
+    "stepVerifying": "проверка файла",
+    "stepInstalling": "установка",
+    "progressOf": "Файл {0} из {1}: {2}, {3}",
+    "progressOne": "{0}: {1}",
+    "cancelling": "Отменяю…",
+    "cancelOperation": "Отмена",
+    "needsNetworkButton": "{0} (нужен интернет)",
+    "needsNetworkNote": "В прошлый раз лаунчер не смог выйти в интернет, а здесь нужна загрузка. Пока вы не в сети, ничего не получится.",
+    "fileKnownUpdateTitle": "Обновить {0} до {1} для {2} из этого файла?",
+    "fileReplaceTitle": "Заменить {0} файлом {1} с вашего компьютера для {2}?",
+    "replaceAnyway": "Всё равно заменить",
+    "typeToReplace": "Введите {0}, чтобы всё равно заменить",
+    "clearSearch": "Сбросить поиск",
+    "needsNetworkShort": "нужен интернет",
+    "removeCancelled": "{0} оставлен.",
+    "showFolderFix": "Показать {0}",
+    "indexOfflineShort": "Нет сети: индекс от {0}",
+    "indexCachedShort": "Индекс от {0}",
+    "refreshFailed": "Не удалось обновить список модов, показан прежний.",
+    "refreshFailedShort": "Не удалось обновить: показан прежний список модов",
+    "abiUnknownShort": "Не удалось проверить, какие моды подходят к {0}",
+    "shadowBanner": "В вашей папке модов есть своя копия: {0}. Копия лаунчера выключена, поэтому игра загрузит ту.",
+    "updatesNeedCatalog": "Список модов не загрузился, поэтому обновления нельзя просмотреть. Повторите выше.",
+    "updateLabelTo": "Обновить {0} до {1} для {2}…",
+    "sourcesRetry": "Повторить",
+    "sourcesLoadFailedLead": "Не удалось прочитать ваши источники.",
+    "noticeShadowLoads": "В вашей папке модов есть копия {0} ({1}), поэтому игра загрузит её.",
+    "failureShadowed": "В вашей папке модов есть его копия ({0}); возможно, игра загрузила её.",
+    "blockerPager": "Моды, которые не дают запустить игру",
+    "blockerPrev": "Предыдущий мод, который не даёт запустить игру",
+    "blockerNext": "Следующий мод, который не даёт запустить игру",
+    "blockerPage": "{0} из {1}",
+    "playOffOne": "Играть нельзя: {0} нужно исправить.",
+    "playOffMany_one": "Играть нельзя: {n} мод нужно исправить.",
+    "playOffMany_few": "Играть нельзя: {n} мода нужно исправить.",
+    "playOffMany_many": "Играть нельзя: {n} модов нужно исправить.",
+    "playOffMany_other": "Играть нельзя: {n} мода нужно исправить.",
+    "toastsLabel": "Что только что произошло",
+    "statusRevokedNoReason": "Выключен, отозван из индекса. Причина не указана.",
+    "ckRevokedNoReason": "Отозван из индекса. Причина не указана.",
+    "indexBadgeSigned": "Подписан · проверен {0}",
+    "indexBadgeStale": "Подписан {0} · мог устареть",
+    "indexBadgeCopy": "Подписанная копия от {0}",
+    "indexBadgeNone": "Не проверен",
+    "sourceBadgeRepo": "Репозиторий GitHub",
+    "sourcesChecking": "проверяется…",
+    "sourceFormatLink": "Что нужно источнику",
+    "sourcesDamaged": "Не удалось прочитать ваш список источников; он отложен и сохранён. Добавьте источники заново в «Источниках».",
+    "sourcesDamagedShort": "Не удалось прочитать ваш список источников",
+    "failureShadowedStill": "В вашей папке модов всё ещё есть {0}, и он загружается вместо него, так что это может повториться. Удалите этот файл, чтобы наверняка.",
+    "copyDoneSummary_one": "Скопирован {n} мод из {0} в {1}.",
+    "copyDoneSummary_few": "Скопировано {n} мода из {0} в {1}.",
+    "copyDoneSummary_many": "Скопировано {n} модов из {0} в {1}.",
+    "copyDoneSummary_other": "Скопировано {n} мода из {0} в {1}.",
+    "copyStaysLine_one": "{n} мод не скопируется: {0}.",
+    "copyStaysLine_few": "{n} мода не скопируются: {0}.",
+    "copyStaysLine_many": "{n} модов не скопируются: {0}.",
+    "copyStaysLine_other": "{n} мода не скопируются: {0}.",
+    "indexRefusedShort": "Индекс отклонён: используется копия от {0}",
+    "blockLineWrongVersionTag": "{0} не даёт играть: он собран для {1}.",
+    "blockLineWrongVersion": "{0} не даёт играть: он собран для другой версии игры.",
+    "blockLineRevoked": "{0} не даёт играть: он отозван из индекса.",
+    "blockLineShadowedRevoked": "{0} не даёт играть: он отозван из индекса, но вместо него загрузится копия из вашей папки модов ({1}).",
+    "blockLineDepsOff_one": "{0} не даёт играть: ему нужен {1}, а он выключен.",
+    "blockLineDepsOff_few": "{0} не даёт играть: ему нужны {1}, а они выключены.",
+    "blockLineDepsOff_many": "{0} не даёт играть: ему нужны {1}, а они выключены.",
+    "blockLineDepsOff_other": "{0} не даёт играть: ему нужны {1}, а они выключены.",
+    "blockLineDepsRevoked_one": "{0} не даёт играть: ему нужен {1}, а он отозван из индекса.",
+    "blockLineDepsRevoked_few": "{0} не даёт играть: ему нужны {1}, а они отозваны из индекса.",
+    "blockLineDepsRevoked_many": "{0} не даёт играть: ему нужны {1}, а они отозваны из индекса.",
+    "blockLineDepsRevoked_other": "{0} не даёт играть: ему нужны {1}, а они отозваны из индекса.",
+    "blockLineDepsNotInstalled_one": "{0} не даёт играть: ему нужен {1}, а он не установлен.",
+    "blockLineDepsNotInstalled_few": "{0} не даёт играть: ему нужны {1}, а они не установлены.",
+    "blockLineDepsNotInstalled_many": "{0} не даёт играть: ему нужны {1}, а они не установлены.",
+    "blockLineDepsNotInstalled_other": "{0} не даёт играть: ему нужны {1}, а они не установлены.",
+    "blockLineDepsNoBuild_one": "{0} не даёт играть: ему нужен {1}, а у него пока нет сборки для {2}.",
+    "blockLineDepsNoBuild_few": "{0} не даёт играть: ему нужны {1}, а у них пока нет сборок для {2}.",
+    "blockLineDepsNoBuild_many": "{0} не даёт играть: ему нужны {1}, а у них пока нет сборок для {2}.",
+    "blockLineDepsNoBuild_other": "{0} не даёт играть: ему нужны {1}, а у них пока нет сборок для {2}.",
+    "badgeRevokedHintNoReason": "Отозван из индекса, причина не указана.",
+    "unmanagedCause_one": "Своя папка: {n} файл, во всех версиях",
+    "unmanagedCause_few": "Своя папка: {n} файла, во всех версиях",
+    "unmanagedCause_many": "Своя папка: {n} файлов, во всех версиях",
+    "unmanagedCause_other": "Своя папка: {n} файла, во всех версиях",
+    "indexUnreachableShort": "Индекс недоступен: нет одобренных модов",
+    "sourceCauseRate": "Лимит GitHub:",
+    "sourceCauseGone": "Источник не найден:",
+    "sourceCauseInvalid": "Источник не читается:",
+    "sourceCauseDisk": "Не удалось сохранить источник:",
+    "sourceCauseNetwork": "Источник недоступен:",
+    "sourceCauseServer": "Ошибка GitHub:",
+    "shadowCause": "Вместо мода грузится копия из вашей папки:",
+    "tryUpdate": "Попробовать {0}…",
+    "turnOffAll_one": "Выключить все {n}",
+    "turnOffAll_few": "Выключить все {n}",
+    "turnOffAll_many": "Выключить все {n}",
+    "turnOffAll_other": "Выключить все {n}",
+    "failureLogLine": "Строка журнала",
+    "indexSays": "Индекс сообщает по-английски: «{0}»",
+    "indexGaveNoReason": "Индекс не указал причину.",
+    "detailsLabel": "{0}: подробности",
+    "refusedUnread": "Weft не запустился из-за модов, а прочитать их снова, чтобы сказать каких, не удалось: {0}",
+    "refusedRetry": "Проверить моды снова",
+    "homeProfileFailed": "Не удалось прочитать моды {0}: {1}",
+    "sourceNoModsLineNoReleases": "Подходящих выпусков модов не найдено: в нём пока нет выпусков.",
+    "sourceNoModsLineNoFiles": "Подходящих выпусков модов не найдено: ни в одном выпуске нет <id>.zip вместе с его <id>.mod.json.",
+    "sourceNoModsLineUnreadable": "Подходящих выпусков модов не найдено: не удалось прочитать <id>.mod.json одного из выпусков.",
+    "sourceNoModsLineNoDigest": "Подходящих выпусков модов не найдено: у GitHub нет SHA-256 для его zip-файлов, поэтому их нельзя проверить.",
+    "sourceNoModsLineDisagrees": "Подходящих выпусков модов не найдено: <id>.mod.json одного из выпусков не совпадает с этим выпуском на GitHub.",
+    "sourceNoModsLineInvalid": "Подходящих выпусков модов не найдено: его выпуски нарушают правило, которому следует каждый мод.",
+    "sourcesIndexUnsaved": "Его не удалось сохранить на этом компьютере: он загрузится снова при следующем запуске, а до тех пор без сети показывается более старая сохранённая копия.",
+    "indexUnsaved": "Используемый индекс модов не удалось сохранить на этом компьютере. Сейчас он работает; при следующем запуске загрузится снова.",
+    "indexUnsavedShort": "Индекс не сохранён: работает до перезапуска",
+    "sourceRetryLabel": "Запросить {0} снова",
+    "removeDoubleClick": "Двойной щелчок не удаляет {0}. Нажмите «Удалить» ещё раз, чтобы подтвердить.",
+    "ckBuiltIncomplete": "В подписанном индексе неполная запись о сборке",
+    "ckBuiltIncompleteDetail": "В ней нет репозитория, workflow, коммита или даты проверки, поэтому неизвестно, как собран этот файл",
+    "sourcePending": "Ещё проверяется {0}…",
+    "sourcesPending_one": "Ещё проверяется {n} источник…",
+    "sourcesPending_few": "Ещё проверяются {n} источника…",
+    "sourcesPending_many": "Ещё проверяются {n} источников…",
+    "sourcesPending_other": "Ещё проверяются {n} источника…",
+    "turnOnAsk": "Включить {0}? Играть будет нельзя, пока это не исправить:",
+    "keepOff": "Оставить выключенным",
+    "turnOnAnyway": "Всё равно включить",
+    "crashNoneNamed": "В журнале не назван ни один мод. Если это повторится, попробуйте без модов.",
+    "crashTurnOffAll": "Выключить все моды для {0}",
+    "crashAllOff_one": "Выключен {n} мод для {0}. Нажмите «Играть», чтобы попробовать без него.",
+    "crashAllOff_few": "Выключено {n} мода для {0}. Нажмите «Играть», чтобы попробовать без них.",
+    "crashAllOff_many": "Выключено {n} модов для {0}. Нажмите «Играть», чтобы попробовать без них.",
+    "crashAllOff_other": "Выключено {n} мода для {0}. Нажмите «Играть», чтобы попробовать без них.",
+    "crashAllOn_one": "Снова включён {n} мод для {0}.",
+    "crashAllOn_few": "Снова включено {n} мода для {0}.",
+    "crashAllOn_many": "Снова включено {n} модов для {0}.",
+    "crashAllOn_other": "Снова включено {n} мода для {0}.",
+    "checksPassed_one": "{n} проверка пройдена",
+    "checksPassed_few": "{n} проверки пройдены",
+    "checksPassed_many": "{n} проверок пройдено",
+    "checksPassed_other": "{n} проверки пройдено",
+    "checksShow": "Показать",
+    "checksHide": "Скрыть",
+    "checksShowDetails": "Подробнее",
+    "copyIntroNone": "В {0} ничего не изменится:",
+    "copyEvidenceShow": "Показать проверки",
+    "copyEvidenceHide": "Скрыть проверки",
+    "copyEvidenceFor": "Что известно о {0}",
+    "copyNoEvidence": "Этой сборки больше нет в каталоге",
+    "copyIntro_one": "Копирование добавит в {0} {n} мод. Ничего из того, что уже есть в {0}, не удалится и не заменится.",
+    "copyIntro_few": "Копирование добавит в {0} {n} мода. Ничего из того, что уже есть в {0}, не удалится и не заменится.",
+    "copyIntro_many": "Копирование добавит в {0} {n} модов. Ничего из того, что уже есть в {0}, не удалится и не заменится.",
+    "copyIntro_other": "Копирование добавит в {0} {n} мода. Ничего из того, что уже есть в {0}, не удалится и не заменится.",
+    "ckTierDrop": "Было: {0}; эта сборка: {1}",
+    "ckTierDropSaid": "Уровень ниже",
+    "replaceFromFile": "Заменить {0} из файла…",
+    "homeModsOwn_one": "Моды для {0}: {1} и {n} файл из своей папки",
+    "homeModsOwn_few": "Моды для {0}: {1} и {n} файла из своей папки",
+    "homeModsOwn_many": "Моды для {0}: {1} и {n} файлов из своей папки",
+    "homeModsOwn_other": "Моды для {0}: {1} и {n} файла из своей папки",
+    "homeModsOnlyOwn_one": "Без модов для {0}, но загрузится {n} файл из своей папки",
+    "homeModsOnlyOwn_few": "Без модов для {0}, но загрузятся {n} файла из своей папки",
+    "homeModsOnlyOwn_many": "Без модов для {0}, но загрузятся {n} файлов из своей папки",
+    "homeModsOnlyOwn_other": "Без модов для {0}, но загрузятся {n} файла из своей папки",
+    "indexUnavailableStatusShort": "Нет индекса (сервер: {0}): нет одобренных модов",
+    "browseNoIndex": "Одобренные моды появятся здесь, когда удастся загрузить индекс модов Weft.",
+    "sourceErrRateUntil": "GitHub ограничивает запросы до {1}, поэтому {0} не удалось обновить.",
+    "reinstall": "Установить {0} снова…"
+  },
+  "sizeUnits": {
+    "B": "Б",
+    "KB": "КБ",
+    "MB": "МБ",
+    "GB": "ГБ"
+  },
+  "heroBadgeBlocked": "ВЕРСИЯ {0} · МОДЫ НУЖНО ИСПРАВИТЬ",
+  "deleteWithMods_one": "Удалить с {n} модом",
+  "deleteWithMods_few": "Удалить с {n} модами",
+  "deleteWithMods_many": "Удалить с {n} модами",
+  "deleteWithMods_other": "Удалить с {n} модами",
+  "versionModCount_one": "{n} мод",
+  "versionModCount_few": "{n} мода",
+  "versionModCount_many": "{n} модов",
+  "versionModCount_other": "{n} мода",
+  "versionModsBlocked": "Моды мешают запуску. Исправьте их на «Главной» или во вкладке «Моды».",
+  "heroBadgeChecking": "ВЕРСИЯ {0} · ПРОВЕРКА МОДОВ",
+  "heroBadgeUnchecked": "ВЕРСИЯ {0} · МОДЫ НЕ ПРОВЕРЕНЫ",
+  "starting": "Запуск...",
+  "deleteConfirmHint": "Нажмите ещё раз, чтобы удалить {0} вместе с модами. Это нельзя отменить.",
+  "deleteConfirmHintBare": "Нажмите ещё раз, чтобы удалить {0}. Это нельзя отменить.",
+  "deleteCancelled": "Версия {0} остаётся.",
+  "deleteDoubleClick": "Двойной щелчок не удаляет {0}. Нажмите «Удалить» ещё раз, чтобы подтвердить."
+}
diff --git a/src/main.tsx b/src/main.tsx
index 8ecb915..a40f01f 100644
--- a/src/main.tsx
+++ b/src/main.tsx
@@ -3,10 +3,13 @@ import ReactDOM from "react-dom/client";
 import App from "./App";
 import { GameStateProvider } from "./hooks/useGameState";
 import { InstallProvider } from "./hooks/useInstall";
-import { initI18n } from "./i18n";
+import { ModsProvider } from "./hooks/useMods";
+import { SpeechProvider } from "./components/LiveRegion";
+import { getLocale, initI18n } from "./i18n";
 import "./style.css";
 
 initI18n();
+document.documentElement.lang = getLocale();
 
 document.addEventListener("contextmenu", (e) => e.preventDefault());
 
@@ -24,14 +27,30 @@ document.addEventListener("keydown", (e) => {
 
 import { I18nProvider } from "./i18n/I18nProvider";
 
-ReactDOM.createRoot(document.getElementById("root") as HTMLElement).render(
+// `npm run dev:mock` runs the UI in a browser against src/dev/mockBackend.ts. The check is on a
+// build-time constant, so a real build leaves the mock out entirely.
+async function start() {
+  if (import.meta.env.MODE === "mock") {
+    const { installMockBackend } = await import("./dev/mockBackend");
+    installMockBackend();
+  }
+  render();
+}
+
+const render = () => ReactDOM.createRoot(document.getElementById("root") as HTMLElement).render(
   <React.StrictMode>
     <I18nProvider>
-      <GameStateProvider>
-        <InstallProvider>
-          <App />
-        </InstallProvider>
-      </GameStateProvider>
+      <SpeechProvider>
+        <GameStateProvider>
+          <InstallProvider>
+            <ModsProvider>
+              <App />
+            </ModsProvider>
+          </InstallProvider>
+        </GameStateProvider>
+      </SpeechProvider>
     </I18nProvider>
   </React.StrictMode>,
-);
\ No newline at end of file
+);
+
+start();
diff --git a/src/mods/api.test.ts b/src/mods/api.test.ts
new file mode 100644
index 0000000..f552852
--- /dev/null
+++ b/src/mods/api.test.ts
@@ -0,0 +1,43 @@
+import { describe, expect, it, vi } from "vitest";
+
+// A plain function, not a spy: a spy keeps a handle on each promise it returns, and a rejected
+// one then counts as unhandled after the test.
+const backend = vi.hoisted(() => ({ answer: (): Promise<unknown> => Promise.resolve(null) }));
+vi.mock("@tauri-apps/api/core", () => ({ invoke: () => backend.answer() }));
+vi.mock("@tauri-apps/api/event", () => ({ listen: vi.fn() }));
+
+const { CommandError, asAppError, call } = await import("./api");
+const { showError } = await import("../i18n/errors");
+const { COMMANDS } = await import("./ipc");
+
+describe("a command that fails", () => {
+  it("rejects with the backend's payload as a CommandError", async () => {
+    backend.answer = () => Promise.reject({ code: "DiskFull", detail: "No space left on device" });
+    const err = await call("get_mod_profile", { tag: "v1" }).catch((e: unknown) => e);
+    expect(err).toBeInstanceOf(CommandError);
+    const e = err as InstanceType<typeof CommandError>;
+    expect([e.code, e.detail, e.command]).toEqual(["DiskFull", "No space left on device", "get_mod_profile"]);
+    // What the page does with it is the same as with the payload itself.
+    expect(asAppError(err)).toEqual({ code: "DiskFull", detail: "No space left on device" });
+    expect(showError(err).message).toBe(showError({ code: "DiskFull", detail: null }).message);
+  });
+
+  it("is Unknown, with what there was, for a string, an Error or a code this build doesn't know", async () => {
+    for (const [raw, detail] of [
+      ["plugin failed", "plugin failed"],
+      [new Error("boom"), "boom"],
+      [{ code: "SomethingNewer", detail: "x" }, "SomethingNewer: x"],
+    ] as const) {
+      backend.answer = () => Promise.reject(raw);
+      const err = await call("get_mod_profile", { tag: "v1" }).catch((e: unknown) => e);
+      expect(err).toBeInstanceOf(CommandError);
+      const e = err as InstanceType<typeof CommandError>;
+      expect([e.code, e.detail]).toEqual(["Unknown", detail]);
+    }
+  });
+
+  it("passes results through", async () => {
+    backend.answer = () => Promise.resolve(["a/b"]);
+    await expect(call(COMMANDS.getModSources, {})).resolves.toEqual(["a/b"]);
+  });
+});
diff --git a/src/mods/api.ts b/src/mods/api.ts
new file mode 100644
index 0000000..888c1e4
--- /dev/null
+++ b/src/mods/api.ts
@@ -0,0 +1,99 @@
+// Every backend command goes through `call`, typed by the generated `CommandSignatures`: a renamed
+// command or argument, or a changed result, fails to compile here instead of failing at runtime.
+// A command that fails rejects with a CommandError, always: the backend's AppErrorPayload as it
+// was, or "Unknown" with what there was for anything else (`asAppError`), so no caller is handed
+// a bare string or an unknown shape.
+
+import { invoke, type InvokeArgs } from "@tauri-apps/api/core";
+import { listen, type EventCallback, type UnlistenFn } from "@tauri-apps/api/event";
+import type { CommandSignatures, EventPayloads } from "./bindings/commands";
+import { COMMANDS } from "./ipc";
+import { asAppError } from "../i18n/errors";
+import type { ErrorCode, UiError } from "./types";
+
+/** How every backend command fails: an Error, with the code and detail of the payload. */
+export class CommandError extends Error implements UiError {
+  readonly code: ErrorCode | "Unknown";
+  readonly detail: string | null;
+  constructor(readonly command: string, e: UiError) {
+    super(e.detail ? `${command}: ${e.code}: ${e.detail}` : `${command}: ${e.code}`);
+    this.name = "CommandError";
+    this.code = e.code;
+    this.detail = e.detail;
+  }
+}
+
+export type CommandArgs<K extends keyof CommandSignatures> = CommandSignatures[K]["args"];
+export type CommandResult<K extends keyof CommandSignatures> = CommandSignatures[K]["result"];
+
+/** Calls a backend command with the arguments and result its Rust declaration has. */
+export function call<K extends keyof CommandSignatures>(
+  cmd: K,
+  args: CommandSignatures[K]["args"],
+): Promise<CommandSignatures[K]["result"]> {
+  return invoke<CommandSignatures[K]["result"]>(cmd, args as InvokeArgs).catch((err: unknown) => {
+    throw err instanceof CommandError ? err : new CommandError(cmd, asAppError(err));
+  });
+}
+
+/** Listens to a backend event with its generated payload type. */
+export function listenTo<E extends keyof EventPayloads>(
+  event: E,
+  handler: EventCallback<EventPayloads[E]>,
+): Promise<UnlistenFn> {
+  return listen<EventPayloads[E]>(event, handler);
+}
+
+/** A fresh id for one operation, chosen by the client: its progress and `cancel` refer to it. */
+export function newOperationId(): string {
+  return typeof crypto !== "undefined" && "randomUUID" in crypto
+    ? crypto.randomUUID()
+    : `op-${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
+}
+
+export const modsApi = {
+  catalog: (forceRefresh: boolean) => call(COMMANDS.listModCatalog, { forceRefresh }),
+  /** One source asked again; the catalogue as the backend holds it afterwards. */
+  refreshSource: (repo: string) => call(COMMANDS.refreshModSource, { repo }),
+  profile: (tag: string) => call(COMMANDS.getModProfile, { tag }),
+  plan: (tag: string, sha256: string) => call(COMMANDS.planModInstall, { tag, sha256 }),
+  /** `planToken` is the reviewed plan's; `ModChangedMeanwhile` when what it would do changed. */
+  install: (tag: string, sha256: string, planToken: string, operationId: string) =>
+    call(COMMANDS.installMod, { tag, sha256, planToken, operationId }),
+  inspectFile: (tag: string, path: string) => call(COMMANDS.inspectModFile, { tag, path }),
+  installFile: (tag: string, path: string, sha256: string, planToken: string, operationId: string) =>
+    call(COMMANDS.installModFile, { tag, path, sha256, planToken, operationId }),
+  setEnabled: (tag: string, id: string, enabled: boolean) =>
+    call(COMMANDS.setModEnabled, { tag, id, enabled }),
+  remove: (tag: string, id: string) => call(COMMANDS.removeMod, { tag, id }),
+  /** Undoes the most recent `remove` for this version; `ModNotInstalled` once it can't. */
+  restore: (tag: string, id: string, operationId: string) =>
+    call(COMMANDS.restoreMod, { tag, id, operationId }),
+  previewCopy: (from: string, to: string) => call(COMMANDS.previewCopyModProfile, { from, to }),
+  copyProfile: (from: string, to: string, planToken: string, operationId: string) =>
+    call(COMMANDS.copyModProfile, { from, to, planToken, operationId }),
+  /** Aborts that operation's downloads; it then fails with `ModCancelled`. False when it had already ended or started writing. */
+  cancel: (operationId: string) => call(COMMANDS.cancelModOperation, { operationId }),
+  sources: () => call(COMMANDS.getModSources, {}),
+  addSource: (repo: string) => call(COMMANDS.addModSource, { repo }),
+  removeSource: (repo: string) => call(COMMANDS.removeModSource, { repo }),
+  icon: (url: string) => call(COMMANDS.getModIcon, { url }),
+  openPlayerModsFolder: () => call(COMMANDS.openPlayerModsFolder, {}),
+  openLog: (tag: string) => call(COMMANDS.openLog, { tag }),
+};
+
+/** The game version and launch commands. */
+export const launcherApi = {
+  versions: (forceRefresh: boolean) => call(COMMANDS.listVersions, { forceRefresh }),
+  installVersion: (tag: string, assetUrl: string, assetName: string, expectedSha256: string | null) =>
+    call(COMMANDS.installVersion, { tag, assetUrl, assetName, expectedSha256 }),
+  installedVersions: () => call(COMMANDS.getInstalledVersions, {}),
+  removeVersion: (tag: string) => call(COMMANDS.removeVersion, { tag }),
+  launch: (tag: string) => call(COMMANDS.launchVersion, { tag }),
+  runningVersions: () => call(COMMANDS.getRunningVersions, {}),
+  openGameFolder: (tag: string) => call(COMMANDS.openGameFolder, { tag }),
+  openLog: (tag: string) => call(COMMANDS.openLog, { tag }),
+};
+
+/** Whatever a command rejected with, as a `UiError`: one parser, in `i18n/errors`. */
+export { asAppError };
diff --git a/src/mods/banners.test.ts b/src/mods/banners.test.ts
new file mode 100644
index 0000000..1b4e72e
--- /dev/null
+++ b/src/mods/banners.test.ts
@@ -0,0 +1,57 @@
+import { describe, expect, it } from "vitest";
+import { bannerPlan, type BannerFacts } from "./banners";
+
+const base: BannerFacts = {
+  view: "installed",
+  running: false,
+  notices: [],
+  blocked: false,
+  rowError: false,
+  index: "fresh",
+  indexTrouble: false,
+  refreshFailed: false,
+  sources: [],
+  abiUnknown: false,
+  shadowed: false,
+  unmanaged: false,
+};
+const ids = (xs: { id: string }[]) => xs.map((x) => x.id);
+
+describe("bannerPlan", () => {
+  it("shows what blocks in full on Installed, and folds the rest", () => {
+    const p = bannerPlan({ ...base, blocked: true, unmanaged: true, index: "cached", indexTrouble: true });
+    expect(ids(p.full)).toEqual(["blocking"]);
+    expect(ids(p.quiet)).toEqual(["index", "unmanaged"]);
+  });
+
+  it("keeps the offline index first on Browse, also while something blocks", () => {
+    const p = bannerPlan({ ...base, view: "browse", blocked: true, unmanaged: true, index: "cached", indexTrouble: true, sources: ["a/b"] });
+    expect(p.full).toEqual([]);
+    expect(ids(p.quiet)).toEqual(["index", "blocking", "source:a/b", "unmanaged"]);
+  });
+
+  it("puts a failed refresh of a catalogue it still shows first", () => {
+    const p = bannerPlan({ ...base, view: "browse", blocked: true, refreshFailed: true });
+    expect(ids(p.quiet)[0]).toBe("refresh");
+  });
+
+  it("answers the player's action in a toast, never above the list", () => {
+    const p = bannerPlan({ ...base, notices: [3], rowError: true, running: true, blocked: true });
+    expect(ids(p.full)).toEqual(["running", "blocking"]);
+    expect(ids(p.toasts)).toEqual(["notice:3", "error"]);
+  });
+
+  it("says a damaged list of sources before the sources it lists", () => {
+    const p = bannerPlan({ ...base, sourcesDamaged: true, sources: ["a/b"], unmanaged: true });
+    expect(ids(p.quiet)).toEqual(["sourcesDamaged", "source:a/b", "unmanaged"]);
+  });
+
+  it("ranks copies in the player's folder before the folder itself", () => {
+    const p = bannerPlan({ ...base, shadowed: true, unmanaged: true, abiUnknown: true });
+    expect(ids(p.quiet)).toEqual(["abi", "shadowed", "unmanaged"]);
+  });
+
+  it("says nothing when all is well", () => {
+    expect(bannerPlan(base)).toEqual({ full: [], quiet: [], toasts: [] });
+  });
+});
diff --git a/src/mods/banners.ts b/src/mods/banners.ts
new file mode 100644
index 0000000..5f24866
--- /dev/null
+++ b/src/mods/banners.ts
@@ -0,0 +1,71 @@
+// Which notes above the Mods list show in full and which fold into the one-line row, and in what
+// order. Data only, so the policy is tested without React; Mods.tsx renders the result.
+
+import type { Catalog } from "./types";
+
+export type View = "installed" | "browse";
+
+export interface BannerFacts {
+  view: View;
+  /** The version is running: its mods can't change. */
+  running: boolean;
+  /** Notices answering the player's last change, by id. */
+  notices: number[];
+  /** Something in the set stops the game. */
+  blocked: boolean;
+  /** The player's last action on a row failed. */
+  rowError: boolean;
+  /** The index's state, and whether it had trouble. */
+  index: Catalog["index"]["freshness"] | null;
+  indexTrouble: boolean;
+  /** The last catalogue refresh failed, while an older catalogue still shows. */
+  refreshFailed: boolean;
+  /** Sources whose last refresh failed, by repo. */
+  sources: string[];
+  /** The list of sources couldn't be read; it was kept aside. */
+  sourcesDamaged?: boolean;
+  /** The version's mod interface couldn't be found out. */
+  abiUnknown: boolean;
+  /** Copies in the player's own folder load instead of managed mods that are off. */
+  shadowed: boolean;
+  /** The player's own folder has files. */
+  unmanaged: boolean;
+}
+
+export interface Placed {
+  id: string;
+  /** Folded notes are listed by rank, lowest first; the first leads the folded row. */
+  rank: number;
+}
+
+/**
+ * - What answers the player's last action (a notice, a failed action) is a toast at the bottom of
+ *   the list: it never pushes the list down, and the list makes room under it for its last row.
+ * - What must not be missed shows in full above the list: a running game, and on Installed what
+ *   stops the game (one mod at a time with all its fixes, and a pager to the others).
+ * - Everything else folds into one row. The catalogue's state leads it on Browse, also while
+ *   something blocks: a player browsing offline or from an old index sees that first. On
+ *   Installed what blocks is in full, so the row leads with the catalogue too.
+ * - Then sources, the version's interface, copies in the player's folder, the folder itself.
+ */
+export function bannerPlan(f: BannerFacts): { full: Placed[]; quiet: Placed[]; toasts: Placed[] } {
+  const full: Placed[] = [];
+  const quiet: Placed[] = [];
+  const toasts: Placed[] = [];
+  if (f.running) full.push({ id: "running", rank: 0 });
+  for (const n of f.notices) toasts.push({ id: `notice:${n}`, rank: 0 });
+  if (f.rowError) toasts.push({ id: "error", rank: 0 });
+  if (f.blocked) {
+    if (f.view === "installed") full.push({ id: "blocking", rank: 0 });
+    else quiet.push({ id: "blocking", rank: 1 });
+  }
+  if (f.refreshFailed) quiet.push({ id: "refresh", rank: 0 });
+  if (f.indexTrouble || (f.index !== null && f.index !== "fresh")) quiet.push({ id: "index", rank: 0.5 });
+  if (f.sourcesDamaged) quiet.push({ id: "sourcesDamaged", rank: 1.5 });
+  for (const repo of f.sources) quiet.push({ id: `source:${repo}`, rank: 2 });
+  if (f.abiUnknown) quiet.push({ id: "abi", rank: 3 });
+  if (f.shadowed) quiet.push({ id: "shadowed", rank: 3.5 });
+  if (f.unmanaged) quiet.push({ id: "unmanaged", rank: 4 });
+  quiet.sort((a, b) => a.rank - b.rank);
+  return { full, quiet, toasts };
+}
diff --git a/src/mods/bindings/AppErrorPayload.ts b/src/mods/bindings/AppErrorPayload.ts
new file mode 100644
index 0000000..0601d04
--- /dev/null
+++ b/src/mods/bindings/AppErrorPayload.ts
@@ -0,0 +1,7 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { ErrorCode } from "./ErrorCode";
+
+/**
+ * What a command rejects with, and what successful payloads carry as an embedded error.
+ */
+export type AppErrorPayload = { code: ErrorCode, detail: string | null, };
diff --git a/src/mods/bindings/ArchiveInfo.ts b/src/mods/bindings/ArchiveInfo.ts
new file mode 100644
index 0000000..808096a
--- /dev/null
+++ b/src/mods/bindings/ArchiveInfo.ts
@@ -0,0 +1,4 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { Platform } from "./Platform";
+
+export type ArchiveInfo = { id: string, libraries: Array<string>, platforms: Array<Platform>, hasAssets: boolean, entries: number, };
diff --git a/src/mods/bindings/AssetInfo.ts b/src/mods/bindings/AssetInfo.ts
new file mode 100644
index 0000000..4fc5f7e
--- /dev/null
+++ b/src/mods/bindings/AssetInfo.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type AssetInfo = { name: string, url: string, size: number, sha256: string | null, };
diff --git a/src/mods/bindings/BlockingReason.ts b/src/mods/bindings/BlockingReason.ts
new file mode 100644
index 0000000..9fa78c3
--- /dev/null
+++ b/src/mods/bindings/BlockingReason.ts
@@ -0,0 +1,6 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+/**
+ * Why a mod in `ProfileReport.blocking` stops the game.
+ */
+export type BlockingReason = "wrongVersion" | "missingDeps" | "revoked" | "shadowedRevoked";
diff --git a/src/mods/bindings/BuildRecord.ts b/src/mods/bindings/BuildRecord.ts
new file mode 100644
index 0000000..aa4e76a
--- /dev/null
+++ b/src/mods/bindings/BuildRecord.ts
@@ -0,0 +1,8 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+/**
+ * Where a build's provenance comes from, and whether it says enough to be shown as a record.
+ * The launcher never verifies an attestation itself: at best the signed index records that its
+ * CI did.
+ */
+export type BuildRecord = "none" | "claimed" | "incomplete" | "recorded";
diff --git a/src/mods/bindings/Catalog.ts b/src/mods/bindings/Catalog.ts
new file mode 100644
index 0000000..7dc32b2
--- /dev/null
+++ b/src/mods/bindings/Catalog.ts
@@ -0,0 +1,24 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { AppErrorPayload } from "./AppErrorPayload";
+import type { CatalogMod } from "./CatalogMod";
+import type { IndexStatus } from "./IndexStatus";
+import type { RevokedView } from "./RevokedView";
+import type { SourceStatus } from "./SourceStatus";
+import type { WeftAbi } from "./WeftAbi";
+
+export type Catalog = { mods: Array<CatalogMod>, revoked: Array<RevokedView>, index: IndexStatus, sources: Array<SourceStatus>, weft: Array<WeftAbi>, 
+/**
+ * The system the launcher runs on (`windows-x64`, `linux-x64`, `macos-arm64`), or empty.
+ */
+platform: string, 
+/**
+ * The player's list of sources couldn't be read (`ModSourcesDamaged`): it was kept aside,
+ * and `sources` is empty until they save a new one.
+ */
+sourcesError: AppErrorPayload | null, 
+/**
+ * Counts up each time the launcher holds a new catalogue (0: read from disk, never held).
+ * Answers can reach the page in any order; it keeps the one with the highest revision.
+ * A count of refreshes in one session, far below 2^53, so a JavaScript number holds it.
+ */
+revision: number, };
diff --git a/src/mods/bindings/CatalogMatch.ts b/src/mods/bindings/CatalogMatch.ts
new file mode 100644
index 0000000..f695fb8
--- /dev/null
+++ b/src/mods/bindings/CatalogMatch.ts
@@ -0,0 +1,12 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { CatalogVersion } from "./CatalogVersion";
+
+export type CatalogMatch = { key: string, name: string, 
+/**
+ * Whether the build is for the version's mod interface; null when that is unknown.
+ */
+fitsVersion: boolean | null, 
+/**
+ * The catalogue entry: trust, review, provenance and whether it was verified.
+ */
+build: CatalogVersion, };
diff --git a/src/mods/bindings/CatalogMod.ts b/src/mods/bindings/CatalogMod.ts
new file mode 100644
index 0000000..63728fc
--- /dev/null
+++ b/src/mods/bindings/CatalogMod.ts
@@ -0,0 +1,9 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { CatalogVersion } from "./CatalogVersion";
+import type { Origin } from "./Origin";
+
+export type CatalogMod = { 
+/**
+ * Unique across origins: the index and a source may both have a `cogwork`.
+ */
+key: string, id: string, name: string, summary: string, authors: Array<string>, license: string | null, homepage: string | null, icon: string | null, origin: Origin, versions: Array<CatalogVersion>, };
diff --git a/src/mods/bindings/CatalogUpdate.ts b/src/mods/bindings/CatalogUpdate.ts
new file mode 100644
index 0000000..64e39c6
--- /dev/null
+++ b/src/mods/bindings/CatalogUpdate.ts
@@ -0,0 +1,9 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { Catalog } from "./Catalog";
+
+/**
+ * A part of a refresh that is in before the rest: the catalogue held now, and the sources this
+ * refresh still waits on. Sent as the `mod-catalog` event, so the index (and its revocations)
+ * shows without waiting for a slow source.
+ */
+export type CatalogUpdate = { catalog: Catalog, pending: Array<string>, };
diff --git a/src/mods/bindings/CatalogVersion.ts b/src/mods/bindings/CatalogVersion.ts
new file mode 100644
index 0000000..e03ebd4
--- /dev/null
+++ b/src/mods/bindings/CatalogVersion.ts
@@ -0,0 +1,13 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { BuildRecord } from "./BuildRecord";
+import type { Channel } from "./Channel";
+import type { Platform } from "./Platform";
+import type { ProvenanceView } from "./ProvenanceView";
+import type { ReviewedView } from "./ReviewedView";
+import type { Trust } from "./Trust";
+
+export type CatalogVersion = { version: string, channel: Channel, tag: string, published: string, sourceRepo: string, sourceCommit: string, weftTag: string | null, abi: string, deps: Array<string>, platforms: Array<Platform>, sha256: string, size: number, url: string, provenance: ProvenanceView | null, 
+/**
+ * What `provenance` is worth: only a complete record in the signed index is `recorded`.
+ */
+buildRecord: BuildRecord, reviewed: ReviewedView | null, trust: Trust, };
diff --git a/src/mods/bindings/ChangeResult.ts b/src/mods/bindings/ChangeResult.ts
new file mode 100644
index 0000000..1b606f9
--- /dev/null
+++ b/src/mods/bindings/ChangeResult.ts
@@ -0,0 +1,31 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { ProfileReport } from "./ProfileReport";
+
+/**
+ * What a change did, with the profile as it is now. All lists hold mod ids.
+ */
+export type ChangeResult = { report: ProfileReport, 
+/**
+ * Mods downloaded or replaced by this change, dependencies included.
+ */
+installed: Array<string>, 
+/**
+ * Installed mods turned on because something needs them.
+ */
+alsoEnabled: Array<string>, 
+/**
+ * Mods turned off because what they need went away.
+ */
+alsoDisabled: Array<string>, 
+/**
+ * Dependencies nothing in the catalogue provides for this version.
+ */
+missing: Array<string>, 
+/**
+ * Mods this change installed turned off, because something they need is missing.
+ */
+installedOff: Array<string>, 
+/**
+ * The id of the mod this change removed, while `restore_mod` can still bring it back.
+ */
+undo: string | null, };
diff --git a/src/mods/bindings/Channel.ts b/src/mods/bindings/Channel.ts
new file mode 100644
index 0000000..eddd6ca
--- /dev/null
+++ b/src/mods/bindings/Channel.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type Channel = "release" | "prerelease" | "experimental";
diff --git a/src/mods/bindings/CopyItem.ts b/src/mods/bindings/CopyItem.ts
new file mode 100644
index 0000000..feed20a
--- /dev/null
+++ b/src/mods/bindings/CopyItem.ts
@@ -0,0 +1,13 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { CopyOutcome } from "./CopyOutcome";
+import type { Trust } from "./Trust";
+
+export type CopyItem = { id: string, name: string, outcome: CopyOutcome, 
+/**
+ * The build that will be installed (outcome `install`).
+ */
+version: string | null, trust: Trust | null, 
+/**
+ * That build's hash (outcome `install`).
+ */
+sha256: string | null, };
diff --git a/src/mods/bindings/CopyOutcome.ts b/src/mods/bindings/CopyOutcome.ts
new file mode 100644
index 0000000..42497c8
--- /dev/null
+++ b/src/mods/bindings/CopyOutcome.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type CopyOutcome = "install" | "alreadyThere" | "noBuild" | "localFile" | "revoked";
diff --git a/src/mods/bindings/CopyPreview.ts b/src/mods/bindings/CopyPreview.ts
new file mode 100644
index 0000000..12752f9
--- /dev/null
+++ b/src/mods/bindings/CopyPreview.ts
@@ -0,0 +1,25 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { CopyItem } from "./CopyItem";
+import type { PlanItem } from "./PlanItem";
+
+export type CopyPreview = { from: string, to: string, items: Array<CopyItem>, 
+/**
+ * Dependencies of the items that will be downloaded as well.
+ */
+deps: Array<PlanItem>, 
+/**
+ * Ids of mods `to` already has, off, that will be turned on.
+ */
+enable: Array<string>, 
+/**
+ * Ids of items that will be installed turned off, because something they need is missing.
+ */
+installedOff: Array<string>, 
+/**
+ * Ids of dependencies nothing provides for `to`: why `installed_off` are off.
+ */
+missing: Array<string>, 
+/**
+ * Pass to `copy_mod_profile`: the digest of what this preview asks the player to agree to.
+ */
+planToken: string, };
diff --git a/src/mods/bindings/CopyResult.ts b/src/mods/bindings/CopyResult.ts
new file mode 100644
index 0000000..a593ff8
--- /dev/null
+++ b/src/mods/bindings/CopyResult.ts
@@ -0,0 +1,33 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { CopyItem } from "./CopyItem";
+import type { ProfileReport } from "./ProfileReport";
+
+/**
+ * What a copy did; `left_behind` are the turned-on mods of the old version that weren't
+ * brought over, and why.
+ */
+export type CopyResult = { leftBehind: Array<CopyItem>, report: ProfileReport, 
+/**
+ * Mods downloaded or replaced by this change, dependencies included.
+ */
+installed: Array<string>, 
+/**
+ * Installed mods turned on because something needs them.
+ */
+alsoEnabled: Array<string>, 
+/**
+ * Mods turned off because what they need went away.
+ */
+alsoDisabled: Array<string>, 
+/**
+ * Dependencies nothing in the catalogue provides for this version.
+ */
+missing: Array<string>, 
+/**
+ * Mods this change installed turned off, because something they need is missing.
+ */
+installedOff: Array<string>, 
+/**
+ * The id of the mod this change removed, while `restore_mod` can still bring it back.
+ */
+undo: string | null, };
diff --git a/src/mods/bindings/ErrorCode.ts b/src/mods/bindings/ErrorCode.ts
new file mode 100644
index 0000000..239750c
--- /dev/null
+++ b/src/mods/bindings/ErrorCode.ts
@@ -0,0 +1,7 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+/**
+ * Every code an [`AppError`] can carry, across the whole app. On the wire a code is its
+ * variant name; `src/i18n/errors.ts` turns it into a translation key.
+ */
+export type ErrorCode = "Network" | "HttpStatus" | "Io" | "DiskFull" | "Serde" | "RateLimited" | "InvalidName" | "InvalidHeader" | "CacheCorrupted" | "AssetNotFound" | "MissingDigest" | "Forbidden" | "OfflineNoCache" | "Zip" | "CreateDir" | "Sha256Mismatch" | "HashMissing" | "AlreadyInstalled" | "NotInstalled" | "DownloadFailed" | "ExtractFailed" | "GameRunning" | "VersionInUse" | "InstallInProgress" | "AlreadyRunning" | "AnotherGameRunning" | "ExecutableNotFound" | "ProcessSpawnFailed" | "LogDirCreateFailed" | "GameFolderNotFound" | "OpenerError" | "IndexSignatureInvalid" | "IndexRollback" | "IndexInvalid" | "AbiUnavailable" | "ModNotInCatalog" | "ModIncompatible" | "ModNotForPlatform" | "ModRevoked" | "ModArchiveInvalid" | "ModFileChanged" | "ModNotInstalled" | "ModStoreMissing" | "ModsBlocked" | "ModSourceInvalid" | "ModSourceNotFound" | "ModSourcesDamaged" | "ModSourceRateLimited" | "ModDownloadNotFound" | "ModTooLarge" | "ModIdReserved" | "ModChangedMeanwhile" | "ModCancelled" | "ModLockInvalid" | "ModUrlRefused" | "ModIconInvalid";
diff --git a/src/mods/bindings/FailureKind.ts b/src/mods/bindings/FailureKind.ts
new file mode 100644
index 0000000..152f91a
--- /dev/null
+++ b/src/mods/bindings/FailureKind.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type FailureKind = "wrongVersion" | "loadFailed" | "notAMod" | "wrongName" | "missingDep" | "initPanicked";
diff --git a/src/mods/bindings/FileInspection.ts b/src/mods/bindings/FileInspection.ts
new file mode 100644
index 0000000..5264b5b
--- /dev/null
+++ b/src/mods/bindings/FileInspection.ts
@@ -0,0 +1,30 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { AppErrorPayload } from "./AppErrorPayload";
+import type { ArchiveInfo } from "./ArchiveInfo";
+import type { CatalogMatch } from "./CatalogMatch";
+
+export type FileInspection = { fileName: string, size: number, sha256: string, archive: ArchiveInfo | null, 
+/**
+ * Why the file can't be a mod, if it can't.
+ */
+problem: AppErrorPayload | null, 
+/**
+ * What the mod's own language file calls it. Only what the file says about itself.
+ */
+name: string | null, summary: string | null, fitsSystem: boolean, catalogMatch: CatalogMatch | null, 
+/**
+ * The index revoked this file's hash: it can't be installed.
+ */
+revoked: boolean, 
+/**
+ * The index's reason for that; null when it gave none.
+ */
+revokedReason: string | null, 
+/**
+ * The installed version of a mod with the same id, which this file would replace.
+ */
+replaces: string | null, 
+/**
+ * Pass to `install_mod_file`: the digest of what installing this file means.
+ */
+planToken: string, };
diff --git a/src/mods/bindings/Freshness.ts b/src/mods/bindings/Freshness.ts
new file mode 100644
index 0000000..0f4d4d1
--- /dev/null
+++ b/src/mods/bindings/Freshness.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type Freshness = "fresh" | "stale" | "cached" | "unavailable";
diff --git a/src/mods/bindings/GameState.ts b/src/mods/bindings/GameState.ts
new file mode 100644
index 0000000..9dea23d
--- /dev/null
+++ b/src/mods/bindings/GameState.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type GameState = "running" | "stopped";
diff --git a/src/mods/bindings/GameStateEvent.ts b/src/mods/bindings/GameStateEvent.ts
new file mode 100644
index 0000000..7135979
--- /dev/null
+++ b/src/mods/bindings/GameStateEvent.ts
@@ -0,0 +1,17 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { GameState } from "./GameState";
+import type { ModFailure } from "./ModFailure";
+
+/**
+ * The `game-state` event.
+ */
+export type GameStateEvent = { tag: string, state: GameState, exitCode: number | null, 
+/**
+ * The game only ends with an error of its own, a panic or a fault when something went
+ * wrong. On Unix a signal leaves no exit code at all, so the code alone can't tell.
+ */
+crashed: boolean, 
+/**
+ * The mod that stopped the game from starting, when the log names one.
+ */
+modFailure: ModFailure | null, };
diff --git a/src/mods/bindings/IndexStatus.ts b/src/mods/bindings/IndexStatus.ts
new file mode 100644
index 0000000..6029a6e
--- /dev/null
+++ b/src/mods/bindings/IndexStatus.ts
@@ -0,0 +1,14 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { AppErrorPayload } from "./AppErrorPayload";
+import type { Freshness } from "./Freshness";
+
+export type IndexStatus = { freshness: Freshness, generated: string | null, 
+/**
+ * RFC 3339, from the signature's trusted comment (`timestamp:`).
+ */
+signedAt: string | null, error: AppErrorPayload | null, 
+/**
+ * The index shown was fetched and checked, but couldn't be saved: it is fetched again at
+ * the next start, and offline until then the older saved copy, if any, is what shows.
+ */
+cacheError: AppErrorPayload | null, };
diff --git a/src/mods/bindings/InstallPlan.ts b/src/mods/bindings/InstallPlan.ts
new file mode 100644
index 0000000..55be042
--- /dev/null
+++ b/src/mods/bindings/InstallPlan.ts
@@ -0,0 +1,39 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { AppErrorPayload } from "./AppErrorPayload";
+import type { PlanItem } from "./PlanItem";
+import type { PlanReplaces } from "./PlanReplaces";
+
+/**
+ * What `install_mod(tag, sha256)` would do, without doing it.
+ */
+export type InstallPlan = { target: PlanItem, replaces: PlanReplaces | null, 
+/**
+ * Dependencies that will be downloaded.
+ */
+install: Array<PlanItem>, 
+/**
+ * Ids of installed dependencies that will be turned on.
+ */
+enable: Array<string>, 
+/**
+ * Dependency ids with no fitting, non-revoked build.
+ */
+missing: Array<string>, 
+/**
+ * Whether the target is on after this install: it is new or on now, and nothing it needs,
+ * at any depth, is missing. With something missing it is installed turned off. False when
+ * the version's mod interface is unknown: then nothing can be resolved.
+ */
+turnsOn: boolean, 
+/**
+ * Whether the target is built for the version's mod interface; null when that is unknown.
+ */
+fitsVersion: boolean | null, 
+/**
+ * Why the install would fail, if it would.
+ */
+problem: AppErrorPayload | null, 
+/**
+ * Pass to `install_mod`: the digest of what this plan asks the player to agree to.
+ */
+planToken: string, };
diff --git a/src/mods/bindings/InstallProgress.ts b/src/mods/bindings/InstallProgress.ts
new file mode 100644
index 0000000..2231a31
--- /dev/null
+++ b/src/mods/bindings/InstallProgress.ts
@@ -0,0 +1,11 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { InstallStage } from "./InstallStage";
+
+/**
+ * The `install-progress` event.
+ */
+export type InstallProgress = { tag: string, downloaded: number, 
+/**
+ * 0 when the server doesn't say.
+ */
+total: number, percent: number, stage: InstallStage, speedMbps: number, };
diff --git a/src/mods/bindings/InstallStage.ts b/src/mods/bindings/InstallStage.ts
new file mode 100644
index 0000000..293e8a0
--- /dev/null
+++ b/src/mods/bindings/InstallStage.ts
@@ -0,0 +1,6 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+/**
+ * What a game version install is doing.
+ */
+export type InstallStage = "downloading" | "verifying" | "extracting" | "finalizing";
diff --git a/src/mods/bindings/InstalledMod.ts b/src/mods/bindings/InstalledMod.ts
new file mode 100644
index 0000000..aa1cb7f
--- /dev/null
+++ b/src/mods/bindings/InstalledMod.ts
@@ -0,0 +1,26 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { Channel } from "./Channel";
+import type { ModStatus } from "./ModStatus";
+import type { Origin } from "./Origin";
+import type { Revocation } from "./Revocation";
+import type { Trust } from "./Trust";
+import type { UpdateView } from "./UpdateView";
+
+export type InstalledMod = { status: ModStatus, 
+/**
+ * Dependencies that aren't on: not installed, or installed and off.
+ */
+missingDeps: Array<string>, 
+/**
+ * The part of `missing_deps` with no build installed at all.
+ */
+depsNotInstalled: Array<string>, revokedReason: string | null, update: UpdateView | null, id: string, name: string, summary: string, version: string | null, channel: Channel | null, sha256: string, size: number, enabled: boolean, trust: Trust, origin: Origin, 
+/**
+ * Unknown for a file from the player's computer: only the game can read it from the library.
+ */
+abi: string | null, weftTag: string | null, deps: Array<string>, tag: string | null, sourceRepo: string | null, sourceCommit: string | null, icon: string | null, installedAt: string, 
+/**
+ * Set when the index revoked this build, and kept even if the index can't be loaded later:
+ * the mod stays revoked, and off, until it is replaced or removed.
+ */
+revoked: Revocation | null, };
diff --git a/src/mods/bindings/InstalledVersion.ts b/src/mods/bindings/InstalledVersion.ts
new file mode 100644
index 0000000..2fc2fe6
--- /dev/null
+++ b/src/mods/bindings/InstalledVersion.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type InstalledVersion = { tag: string, path: string, executable: string, installed_at: string, };
diff --git a/src/mods/bindings/Managed.ts b/src/mods/bindings/Managed.ts
new file mode 100644
index 0000000..93aac72
--- /dev/null
+++ b/src/mods/bindings/Managed.ts
@@ -0,0 +1,6 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+/**
+ * What the launcher's copy of a shadowed mod is.
+ */
+export type Managed = "on" | "off" | "revoked";
diff --git a/src/mods/bindings/ModFailure.ts b/src/mods/bindings/ModFailure.ts
new file mode 100644
index 0000000..ecf2335
--- /dev/null
+++ b/src/mods/bindings/ModFailure.ts
@@ -0,0 +1,16 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+/**
+ * The first mod failure in a run's log, by kind, each with what that kind names. `modId` is the
+ * mod the engine blamed, when the line names one; `line` is the log line, so the player can
+ * search for it.
+ */
+export type ModFailure = { "kind": "wrongVersion", modId: string | null, line: string, } | { "kind": "loadFailed", modId: string | null, line: string, } | { "kind": "notAMod", modId: string | null, line: string, } | { "kind": "wrongName", modId: string | null, 
+/**
+ * The crate the library is: the name its folder or zip needs.
+ */
+crate: string, line: string, } | { "kind": "missingDep", modId: string | null, 
+/**
+ * The mod that is missing.
+ */
+dependency: string, line: string, } | { "kind": "initPanicked", modId: string | null, line: string, };
diff --git a/src/mods/bindings/ModProgress.ts b/src/mods/bindings/ModProgress.ts
new file mode 100644
index 0000000..a2d5cc2
--- /dev/null
+++ b/src/mods/bindings/ModProgress.ts
@@ -0,0 +1,15 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { ProgressStage } from "./ProgressStage";
+
+/**
+ * The `mod-progress` event.
+ */
+export type ModProgress = { 
+/**
+ * The id the page gave the operation this file belongs to.
+ */
+operationId: string, sha256: string, modId: string, stage: ProgressStage, percent: number, 
+/**
+ * This file's place in the operation, 1-based: file `index` of `count`.
+ */
+index: number, count: number, };
diff --git a/src/mods/bindings/ModStatus.ts b/src/mods/bindings/ModStatus.ts
new file mode 100644
index 0000000..0117d70
--- /dev/null
+++ b/src/mods/bindings/ModStatus.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type ModStatus = "ready" | "off" | "wrongVersion" | "missingDeps" | "revoked" | "unchecked";
diff --git a/src/mods/bindings/NoModsReason.ts b/src/mods/bindings/NoModsReason.ts
new file mode 100644
index 0000000..904b392
--- /dev/null
+++ b/src/mods/bindings/NoModsReason.ts
@@ -0,0 +1,6 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+/**
+ * Why a source that GitHub answered has no mods to offer, by how far its best release got.
+ */
+export type NoModsReason = "noReleases" | "noModFiles" | "unreadable" | "noDigest" | "disagrees" | "invalid";
diff --git a/src/mods/bindings/Origin.ts b/src/mods/bindings/Origin.ts
new file mode 100644
index 0000000..0c3a299
--- /dev/null
+++ b/src/mods/bindings/Origin.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type Origin = { "kind": "index" } | { "kind": "source", repo: string, } | { "kind": "file", name: string, };
diff --git a/src/mods/bindings/PlanItem.ts b/src/mods/bindings/PlanItem.ts
new file mode 100644
index 0000000..39fe1d7
--- /dev/null
+++ b/src/mods/bindings/PlanItem.ts
@@ -0,0 +1,5 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { Channel } from "./Channel";
+import type { Trust } from "./Trust";
+
+export type PlanItem = { id: string, name: string, version: string, sha256: string, trust: Trust, channel: Channel, size: number, };
diff --git a/src/mods/bindings/PlanReplaces.ts b/src/mods/bindings/PlanReplaces.ts
new file mode 100644
index 0000000..4a3cc9b
--- /dev/null
+++ b/src/mods/bindings/PlanReplaces.ts
@@ -0,0 +1,7 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { Trust } from "./Trust";
+
+/**
+ * The installed mod an install would replace.
+ */
+export type PlanReplaces = { version: string | null, sha256: string, trust: Trust, enabled: boolean, };
diff --git a/src/mods/bindings/Platform.ts b/src/mods/bindings/Platform.ts
new file mode 100644
index 0000000..55d1e96
--- /dev/null
+++ b/src/mods/bindings/Platform.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type Platform = "windows-x64" | "linux-x64" | "macos-arm64";
diff --git a/src/mods/bindings/ProfileReport.ts b/src/mods/bindings/ProfileReport.ts
new file mode 100644
index 0000000..259444c
--- /dev/null
+++ b/src/mods/bindings/ProfileReport.ts
@@ -0,0 +1,29 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { AppErrorPayload } from "./AppErrorPayload";
+import type { BlockingReason } from "./BlockingReason";
+import type { InstalledMod } from "./InstalledMod";
+import type { ShadowedMod } from "./ShadowedMod";
+
+export type ProfileReport = { tag: string, versionAbi: string | null, abiError: AppErrorPayload | null, mods: Array<InstalledMod>, 
+/**
+ * Ids of mods that would stop the game from starting: turned-on mods that can't load, and
+ * revoked mods a file in the player's folder would stand in for.
+ */
+blocking: Array<string>, 
+/**
+ * Why each of `blocking` blocks.
+ */
+blockingReasons: { [key in string]: BlockingReason }, 
+/**
+ * What sits in the player's own Weft mods folder. Loads into every version, unchecked.
+ */
+unmanaged: Array<string>, 
+/**
+ * Files there with the id of a mod in this set.
+ */
+shadowed: Array<ShadowedMod>, 
+/**
+ * Ids of revoked mods still on, because the version's game is running: they are turned
+ * off when it stops.
+ */
+revocationsPending: Array<string>, };
diff --git a/src/mods/bindings/ProgressStage.ts b/src/mods/bindings/ProgressStage.ts
new file mode 100644
index 0000000..6090a14
--- /dev/null
+++ b/src/mods/bindings/ProgressStage.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type ProgressStage = "downloading" | "verifying" | "installing";
diff --git a/src/mods/bindings/ProvenanceView.ts b/src/mods/bindings/ProvenanceView.ts
new file mode 100644
index 0000000..6db9dad
--- /dev/null
+++ b/src/mods/bindings/ProvenanceView.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type ProvenanceView = { repo: string | null, workflow: string | null, gitRef: string | null, verifiedAt: string | null, };
diff --git a/src/mods/bindings/Release.ts b/src/mods/bindings/Release.ts
new file mode 100644
index 0000000..8fdf258
--- /dev/null
+++ b/src/mods/bindings/Release.ts
@@ -0,0 +1,4 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { AssetInfo } from "./AssetInfo";
+
+export type Release = { tag: string, name: string, published_at: string, body: string, prerelease: boolean, asset: AssetInfo, from_cache: boolean, };
diff --git a/src/mods/bindings/ReviewedView.ts b/src/mods/bindings/ReviewedView.ts
new file mode 100644
index 0000000..5427e9c
--- /dev/null
+++ b/src/mods/bindings/ReviewedView.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type ReviewedView = { by: string, at: string, };
diff --git a/src/mods/bindings/Revocation.ts b/src/mods/bindings/Revocation.ts
new file mode 100644
index 0000000..f051bb3
--- /dev/null
+++ b/src/mods/bindings/Revocation.ts
@@ -0,0 +1,15 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+/**
+ * Why and when a revocation was applied to an installed build.
+ */
+export type Revocation = { 
+/**
+ * The index's words; null when it gave none. Older launchers wrote "No reason given",
+ * which reads back as none.
+ */
+reason: string | null, 
+/**
+ * RFC 3339 time the launcher applied it; unknown in lock files that never said.
+ */
+at: string | null, };
diff --git a/src/mods/bindings/RevokedView.ts b/src/mods/bindings/RevokedView.ts
new file mode 100644
index 0000000..9db5855
--- /dev/null
+++ b/src/mods/bindings/RevokedView.ts
@@ -0,0 +1,7 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type RevokedView = { sha256: string, 
+/**
+ * The index's words; null when it gave none (the page says "No reason given" itself).
+ */
+reason: string | null, };
diff --git a/src/mods/bindings/ShadowedMod.ts b/src/mods/bindings/ShadowedMod.ts
new file mode 100644
index 0000000..84f4aa6
--- /dev/null
+++ b/src/mods/bindings/ShadowedMod.ts
@@ -0,0 +1,9 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { Managed } from "./Managed";
+
+/**
+ * A file in the player's own mods folder with the id of a mod in this set. The engine loads
+ * the first copy of an id it finds and searches the launcher's folder first, so this one loads
+ * whenever the launcher's copy is off or revoked.
+ */
+export type ShadowedMod = { id: string, file: string, managed: Managed, };
diff --git a/src/mods/bindings/SourceStatus.ts b/src/mods/bindings/SourceStatus.ts
new file mode 100644
index 0000000..6d8252a
--- /dev/null
+++ b/src/mods/bindings/SourceStatus.ts
@@ -0,0 +1,26 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { AppErrorPayload } from "./AppErrorPayload";
+import type { Freshness } from "./Freshness";
+import type { NoModsReason } from "./NoModsReason";
+
+export type SourceStatus = { 
+/**
+ * As GitHub spells it.
+ */
+repo: string, mods: number, 
+/**
+ * `cached`: the last good answer, because it wasn't refreshed or the refresh failed.
+ */
+freshness: Freshness, 
+/**
+ * RFC 3339 time the data shown was fetched.
+ */
+checked: string | null, 
+/**
+ * Set whenever the last refresh failed, even when cached data is shown.
+ */
+error: AppErrorPayload | null, 
+/**
+ * Why GitHub's answer has no mods in it, when it has none.
+ */
+noMods: NoModsReason | null, };
diff --git a/src/mods/bindings/Trust.ts b/src/mods/bindings/Trust.ts
new file mode 100644
index 0000000..10b3db2
--- /dev/null
+++ b/src/mods/bindings/Trust.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type Trust = "reviewed" | "unreviewed" | "unverified";
diff --git a/src/mods/bindings/UpdateView.ts b/src/mods/bindings/UpdateView.ts
new file mode 100644
index 0000000..17e26a4
--- /dev/null
+++ b/src/mods/bindings/UpdateView.ts
@@ -0,0 +1,5 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { Channel } from "./Channel";
+import type { Trust } from "./Trust";
+
+export type UpdateView = { version: string, sha256: string, channel: Channel, trust: Trust, };
diff --git a/src/mods/bindings/WeftAbi.ts b/src/mods/bindings/WeftAbi.ts
new file mode 100644
index 0000000..0ddec69
--- /dev/null
+++ b/src/mods/bindings/WeftAbi.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type WeftAbi = { tag: string, commit: string, abi: string, };
diff --git a/src/mods/bindings/commands.ts b/src/mods/bindings/commands.ts
new file mode 100644
index 0000000..33b705c
--- /dev/null
+++ b/src/mods/bindings/commands.ts
@@ -0,0 +1,95 @@
+// Generated from the Rust types by src-tauri/src/bindings.rs. Do not edit.
+
+import type { Catalog } from "./Catalog";
+import type { CatalogUpdate } from "./CatalogUpdate";
+import type { ChangeResult } from "./ChangeResult";
+import type { CopyPreview } from "./CopyPreview";
+import type { CopyResult } from "./CopyResult";
+import type { FileInspection } from "./FileInspection";
+import type { GameStateEvent } from "./GameStateEvent";
+import type { InstallPlan } from "./InstallPlan";
+import type { InstallProgress } from "./InstallProgress";
+import type { InstalledVersion } from "./InstalledVersion";
+import type { ModProgress } from "./ModProgress";
+import type { ProfileReport } from "./ProfileReport";
+import type { Release } from "./Release";
+
+/** Every Tauri command, by the name `invoke` takes. */
+export const COMMANDS = {
+  listVersions: "list_versions",
+  installVersion: "install_version",
+  getInstalledVersions: "get_installed_versions",
+  removeVersion: "remove_version",
+  launchVersion: "launch_version",
+  getRunningVersions: "get_running_versions",
+  openGameFolder: "open_game_folder",
+  openLog: "open_log",
+  listModCatalog: "list_mod_catalog",
+  refreshModSource: "refresh_mod_source",
+  getModSources: "get_mod_sources",
+  addModSource: "add_mod_source",
+  removeModSource: "remove_mod_source",
+  getModProfile: "get_mod_profile",
+  planModInstall: "plan_mod_install",
+  installMod: "install_mod",
+  inspectModFile: "inspect_mod_file",
+  installModFile: "install_mod_file",
+  setModEnabled: "set_mod_enabled",
+  removeMod: "remove_mod",
+  restoreMod: "restore_mod",
+  previewCopyModProfile: "preview_copy_mod_profile",
+  copyModProfile: "copy_mod_profile",
+  cancelModOperation: "cancel_mod_operation",
+  getModIcon: "get_mod_icon",
+  openPlayerModsFolder: "open_player_mods_folder",
+} as const;
+
+export type CommandName = (typeof COMMANDS)[keyof typeof COMMANDS];
+
+/** Every event the backend emits. */
+export const EVENTS = {
+  modProgress: "mod-progress",
+  gameState: "game-state",
+  installProgress: "install-progress",
+  modCatalog: "mod-catalog",
+} as const;
+
+export type EventName = (typeof EVENTS)[keyof typeof EVENTS];
+
+/** Every command's arguments and result, read from its declaration in Rust. */
+export interface CommandSignatures {
+  list_versions: { args: { forceRefresh: boolean }; result: Array<Release> };
+  install_version: { args: { tag: string; assetUrl: string; assetName: string; expectedSha256: string | null }; result: InstalledVersion };
+  get_installed_versions: { args: Record<string, never>; result: Array<InstalledVersion> };
+  remove_version: { args: { tag: string }; result: void };
+  launch_version: { args: { tag: string }; result: void };
+  get_running_versions: { args: Record<string, never>; result: Array<string> };
+  open_game_folder: { args: { tag: string }; result: void };
+  open_log: { args: { tag: string }; result: void };
+  list_mod_catalog: { args: { forceRefresh: boolean }; result: Catalog };
+  refresh_mod_source: { args: { repo: string }; result: Catalog };
+  get_mod_sources: { args: Record<string, never>; result: Array<string> };
+  add_mod_source: { args: { repo: string }; result: Array<string> };
+  remove_mod_source: { args: { repo: string }; result: Array<string> };
+  get_mod_profile: { args: { tag: string }; result: ProfileReport };
+  plan_mod_install: { args: { tag: string; sha256: string }; result: InstallPlan };
+  install_mod: { args: { tag: string; sha256: string; planToken: string; operationId: string }; result: ChangeResult };
+  inspect_mod_file: { args: { tag: string; path: string }; result: FileInspection };
+  install_mod_file: { args: { tag: string; path: string; sha256: string; planToken: string; operationId: string }; result: ChangeResult };
+  set_mod_enabled: { args: { tag: string; id: string; enabled: boolean }; result: ChangeResult };
+  remove_mod: { args: { tag: string; id: string }; result: ChangeResult };
+  restore_mod: { args: { tag: string; id: string; operationId: string }; result: ChangeResult };
+  preview_copy_mod_profile: { args: { from: string; to: string }; result: CopyPreview };
+  copy_mod_profile: { args: { from: string; to: string; planToken: string; operationId: string }; result: CopyResult };
+  cancel_mod_operation: { args: { operationId: string }; result: boolean };
+  get_mod_icon: { args: { url: string }; result: string };
+  open_player_mods_folder: { args: Record<string, never>; result: void };
+}
+
+/** Every event's payload. */
+export interface EventPayloads {
+  "mod-progress": ModProgress;
+  "game-state": GameStateEvent;
+  "install-progress": InstallProgress;
+  "mod-catalog": CatalogUpdate;
+}
diff --git a/src/mods/bindings/index.ts b/src/mods/bindings/index.ts
new file mode 100644
index 0000000..f8a1f99
--- /dev/null
+++ b/src/mods/bindings/index.ts
@@ -0,0 +1,52 @@
+// Generated from the Rust types by src-tauri/src/bindings.rs. Do not edit.
+
+export type * from "./AppErrorPayload";
+export type * from "./ArchiveInfo";
+export type * from "./AssetInfo";
+export type * from "./BlockingReason";
+export type * from "./BuildRecord";
+export type * from "./Catalog";
+export type * from "./CatalogMatch";
+export type * from "./CatalogMod";
+export type * from "./CatalogUpdate";
+export type * from "./CatalogVersion";
+export type * from "./ChangeResult";
+export type * from "./Channel";
+export type * from "./CopyItem";
+export type * from "./CopyOutcome";
+export type * from "./CopyPreview";
+export type * from "./CopyResult";
+export type * from "./ErrorCode";
+export type * from "./FailureKind";
+export type * from "./FileInspection";
+export type * from "./Freshness";
+export type * from "./GameState";
+export type * from "./GameStateEvent";
+export type * from "./IndexStatus";
+export type * from "./InstallPlan";
+export type * from "./InstallProgress";
+export type * from "./InstallStage";
+export type * from "./InstalledMod";
+export type * from "./InstalledVersion";
+export type * from "./Managed";
+export type * from "./ModFailure";
+export type * from "./ModProgress";
+export type * from "./ModStatus";
+export type * from "./NoModsReason";
+export type * from "./Origin";
+export type * from "./PlanItem";
+export type * from "./PlanReplaces";
+export type * from "./Platform";
+export type * from "./ProfileReport";
+export type * from "./ProgressStage";
+export type * from "./ProvenanceView";
+export type * from "./Release";
+export type * from "./ReviewedView";
+export type * from "./Revocation";
+export type * from "./RevokedView";
+export type * from "./ShadowedMod";
+export type * from "./SourceStatus";
+export type * from "./Trust";
+export type * from "./UpdateView";
+export type * from "./WeftAbi";
+export * from "./commands";
diff --git a/src/mods/blockerPager.test.ts b/src/mods/blockerPager.test.ts
new file mode 100644
index 0000000..22f7199
--- /dev/null
+++ b/src/mods/blockerPager.test.ts
@@ -0,0 +1,22 @@
+import { describe, expect, it } from "vitest";
+import { pagerIndex, pagerStep } from "./blockerPager";
+
+describe("blocker pager", () => {
+  it("keeps the mod on screen while the list changes around it", () => {
+    expect(pagerIndex(["a", "b", "c"], { id: "b", index: 1 })).toBe(1);
+    // One before it is fixed: it moves up and stays shown.
+    expect(pagerIndex(["b", "c"], { id: "b", index: 1 })).toBe(0);
+  });
+
+  it("gives a fixed mod's place to the next, or the last", () => {
+    expect(pagerIndex(["a", "c"], { id: "b", index: 1 })).toBe(1);
+    expect(pagerIndex(["a"], { id: "c", index: 2 })).toBe(0);
+    expect(pagerIndex([], { id: "c", index: 2 })).toBe(0);
+    expect(pagerIndex(["a", "b"], { id: null, index: 0 })).toBe(0);
+  });
+
+  it("steps round the ends", () => {
+    expect(pagerStep(3, 2, 1)).toBe(0);
+    expect(pagerStep(3, 0, -1)).toBe(2);
+  });
+});
diff --git a/src/mods/blockerPager.ts b/src/mods/blockerPager.ts
new file mode 100644
index 0000000..74271b7
--- /dev/null
+++ b/src/mods/blockerPager.ts
@@ -0,0 +1,24 @@
+// Which blocking mod the Mods tab's banner shows, as the list changes around it. No React:
+// components/mods/ModFixes `useBlockerPager` holds the page.
+
+export interface PagerAt {
+  /** The mod on screen, by id; null before the player paged. */
+  id: string | null;
+  /** Where it was in the list: the place a fixed mod gives to the next. */
+  index: number;
+}
+
+/**
+ * The index to show in `ids` (the blocking mods, in order): the mod on screen stays on screen
+ * while others come and go; a fixed one gives its place to the next, or the last.
+ */
+export function pagerIndex(ids: string[], at: PagerAt): number {
+  if (!ids.length) return 0;
+  const found = at.id === null ? -1 : ids.indexOf(at.id);
+  return found >= 0 ? found : Math.min(at.index, ids.length - 1);
+}
+
+/** One step back or on from `index`, round the ends. */
+export function pagerStep(length: number, index: number, step: number): number {
+  return (index + step + length) % length;
+}
diff --git a/src/mods/checks.test.ts b/src/mods/checks.test.ts
new file mode 100644
index 0000000..d8561c5
--- /dev/null
+++ b/src/mods/checks.test.ts
@@ -0,0 +1,369 @@
+import { describe, expect, it } from "vitest";
+import {
+  activeStep,
+  buildChecks,
+  consentChanges,
+  copyConsentView,
+  fileReplaceNotes,
+  planConsent,
+  fileChecks,
+  fileVerdict,
+  installChecks,
+  installOutcome,
+  pinCheck,
+  replaceNotes,
+  tierDropCheck,
+  weakerDeps,
+  type CheckRow,
+} from "./checks";
+import { ABI, OLD_ABI, build } from "./fixtures";
+import type { FileInspection, InstallPlan } from "./types";
+
+const row = (rows: CheckRow[], id: string) => rows.find((r) => r.id === id);
+
+function plan(extra: Partial<InstallPlan> = {}): InstallPlan {
+  return {
+    target: { id: "hearth", name: "Hearth", version: "0.4.0", sha256: "h".repeat(64), trust: "reviewed", channel: "release", size: 1 },
+    replaces: null,
+    install: [],
+    enable: [],
+    missing: [],
+    problem: null,
+    turnsOn: true,
+    fitsVersion: true,
+    planToken: "plan-x",
+    ...extra,
+  };
+}
+
+const ctx = {
+  tag: "v26.11.1",
+  name: (id: string) => id.toUpperCase(),
+  enabled: new Set<string>(),
+  trustOf: (id: string) => (id === "lamps" ? ("unverified" as const) : undefined),
+  versionAbi: ABI as string | null,
+};
+
+describe("provenance", () => {
+  it("is a green check only when the signed index records all of it, and says it is the index's record", () => {
+    const r = row(buildChecks(build("1.0.0")), "provenance")!;
+    expect(r.state).toBe("yes");
+    expect(r.title.key).toBe("mods.ckBuilt");
+    // Repo @ commit, who checked it, and when: the index's words, not the launcher's check.
+    expect(r.title.args).toEqual(["Zorro909/weft-mods", expect.objectContaining({ code: "cceea7805df5902d62017d2008d1bb29ed84e152" }), "Zorro909", { day: "2026-11-04T18:00:00Z" }]);
+  });
+
+  it("is unknown, never green, when the index's record is incomplete", () => {
+    const r = row(buildChecks(build("1.0.0", { buildRecord: "incomplete" })), "provenance")!;
+    expect(r).toMatchObject({ state: "unknown", title: { key: "mods.ckBuiltIncomplete" } });
+  });
+
+  it("is unknown, never green, when only the repo claims it", () => {
+    const claimed = build("1.0.0", { trust: "unreviewed", reviewed: null, buildRecord: "claimed" });
+    const r = row(buildChecks(claimed), "provenance")!;
+    expect(r.state).toBe("unknown");
+    expect(r.title.key).toBe("mods.ckBuiltClaimed");
+  });
+
+  it("says 'no build record' as unknown", () => {
+    const r = row(buildChecks(build("1.0.0", { provenance: null, buildRecord: "none" })), "provenance")!;
+    expect(r).toMatchObject({ state: "unknown", title: { key: "mods.ckNoBuild" } });
+  });
+});
+
+describe("review and pin", () => {
+  it("says a Reviewed build is in the index, an Unreviewed one isn't", () => {
+    expect(row(buildChecks(build("1.0.0")), "review")?.state).toBe("yes");
+    expect(row(buildChecks(build("1.0.0", { trust: "unreviewed", reviewed: null })), "review")?.state).toBe("no");
+    // Not reviewed isn't a failure: the mark is heard as the tier's own word.
+    expect(row(buildChecks(build("1.0.0", { trust: "unreviewed", reviewed: null })), "review")?.said).toBe("mods.badgeUnreviewed");
+    expect(row(buildChecks(build("1.0.0")), "review")?.said).toBeUndefined();
+  });
+
+  it("only counts the index's pin as a check; GitHub's digest is unknown", () => {
+    expect(pinCheck(build("1.0.0")).state).toBe("yes");
+    const github = pinCheck(build("1.0.0", { trust: "unreviewed", reviewed: null }));
+    expect(github).toMatchObject({ state: "unknown", title: { key: "mods.ckPinnedGithub" } });
+  });
+});
+
+describe("installChecks", () => {
+  it("names each dependency and what happens to it", () => {
+    const v = build("0.4.0", { deps: ["base", "cogwork", "signals", "lamps", "glue"] });
+    const rows = installChecks(
+      plan({
+        install: [{ id: "cogwork", name: "Cogwork", version: "0.2.0", sha256: "c".repeat(64), trust: "unreviewed", channel: "release", size: 1 }],
+        enable: ["lamps"],
+        missing: ["signals"],
+      }),
+      v,
+      { ...ctx, enabled: new Set(["glue"]) }
+    );
+    expect(row(rows, "dep:cogwork")).toMatchObject({ state: "yes", title: { key: "mods.ckDepInstall", args: ["Cogwork", "0.2.0"] }, trust: "unreviewed" });
+    expect(row(rows, "dep:lamps")).toMatchObject({ state: "yes", title: { key: "mods.ckDepEnable", args: ["LAMPS"] }, trust: "unverified" });
+    expect(row(rows, "dep:signals")).toMatchObject({ state: "no", title: { key: "mods.ckDepMissing", args: ["SIGNALS", "v26.11.1"] } });
+    expect(row(rows, "dep:glue")).toMatchObject({ state: "yes", title: { key: "mods.ckDepHave" } });
+    expect(rows.some((r) => r.id === "dep:base")).toBe(false);
+  });
+
+  it("doesn't call a dependency fine when the plan says nothing about it and it's off", () => {
+    const rows = installChecks(plan(), build("0.4.0", { deps: ["base", "glue"] }), ctx);
+    expect(row(rows, "dep:glue")?.state).toBe("unknown");
+  });
+
+  it("leads with the problem when the install would fail", () => {
+    const rows = installChecks(plan({ problem: { code: "ModIncompatible", detail: "Hearth" }, fitsVersion: false }), build("0.4.0"), ctx);
+    expect(rows[0]).toMatchObject({ id: "problem", state: "no" });
+    expect(row(rows, "abi")?.state).toBe("no");
+  });
+});
+
+describe("fit with the version", () => {
+  it("is yes only when both mod interfaces are known and equal", () => {
+    expect(row(installChecks(plan(), build("0.4.0"), ctx), "abi")?.state).toBe("yes");
+    expect(row(installChecks(plan({ fitsVersion: false }), build("0.4.0", { abi: OLD_ABI }), ctx), "abi")?.state).toBe("no");
+  });
+
+  it("is unknown, never a green check, when the version's interface couldn't be found out", () => {
+    const rows = installChecks(plan({ problem: { code: "AbiUnavailable", detail: "v" }, fitsVersion: null }), build("0.4.0"), { ...ctx, versionAbi: null });
+    expect(row(rows, "abi")).toMatchObject({ state: "unknown", title: { key: "mods.ckFitUnchecked" } });
+  });
+});
+
+describe("installOutcome", () => {
+  it("installs turned off when a dependency has no build, and says so", () => {
+    const o = installOutcome(plan({ missing: ["signals"], turnsOn: false }), false, "Railways", ctx);
+    expect(o.button).toBe("mods.installTurnedOff");
+    expect(o.explain).toEqual({ key: "mods.installsOff", count: 1, args: ["SIGNALS", "v26.11.1", "Railways"] });
+  });
+
+  it("is a plain install or update otherwise, also for an off mod that stays off", () => {
+    expect(installOutcome(plan(), false, "Hearth", ctx)).toEqual({ button: "mods.install", explain: null });
+    const off = plan({ turnsOn: false, replaces: { version: "1", sha256: "o".repeat(64), trust: "reviewed", enabled: false } });
+    expect(installOutcome(off, true, "Hearth", ctx)).toEqual({ button: "mods.updateButton", explain: null });
+  });
+});
+
+describe("weakerDeps", () => {
+  it("names what an install brings that nobody reviewed, downloaded or turned on", () => {
+    const p = plan({
+      install: [
+        { id: "glow", name: "Glowmoss", version: "1", sha256: "g".repeat(64), trust: "unreviewed", channel: "release", size: 1 },
+        { id: "fine", name: "Fine", version: "1", sha256: "f".repeat(64), trust: "reviewed", channel: "release", size: 1 },
+      ],
+      enable: ["lamps"],
+    });
+    expect(weakerDeps(p, ctx)).toEqual([
+      { name: "Glowmoss", trust: "unreviewed" },
+      { name: "LAMPS", trust: "unverified" },
+    ]);
+  });
+});
+
+describe("activeStep", () => {
+  const ev = (sha: string, modId: string, stage: "downloading" | "verifying" | "installing", percent: number, index: number) => ({
+    operationId: "op",
+    sha256: sha.repeat(64),
+    modId,
+    stage,
+    percent,
+    index,
+    count: 3,
+  });
+
+  it("follows the newest event: a file that finished checking never hides the next download", () => {
+    // The sequence from review sol-r3 §4: A checked at 100%, then B downloading at 25%.
+    const entries = [ev("a", "cogwork", "verifying", 100, 1), ev("b", "glowmoss", "downloading", 25, 2)];
+    expect(activeStep(entries)).toMatchObject({ modId: "glowmoss", percent: 25, index: 2, count: 3 });
+  });
+
+  it("shows the install step at the end, and nothing before the first event", () => {
+    expect(activeStep([ev("a", "cogwork", "installing", 100, 3)])).toMatchObject({ stage: "installing", index: 3 });
+    expect(activeStep([])).toBeUndefined();
+  });
+});
+
+describe("fit (contract R4 §5)", () => {
+  it("is unknown with Retry when the backend can't tell, never 'no'", () => {
+    const rows = installChecks(plan({ fitsVersion: null, problem: { code: "AbiUnavailable", detail: "v26.11.1" } }), build("1.0.0"), { ...ctx, versionAbi: null });
+    expect(row(rows, "abi")).toMatchObject({ state: "unknown", retry: true, title: { key: "mods.ckFitUnchecked" } });
+    // The fit row says why the button is off; no red "can't install" says it again as a "no".
+    expect(rows[0].id).toBe("abi");
+    expect(rows.filter((r) => r.state === "no")).toEqual([]);
+  });
+
+  it("puts any other problem first, as a no", () => {
+    const rows = installChecks(plan({ problem: { code: "GameRunning", detail: "v26.11.1" } }), build("1.0.0"), ctx);
+    expect(rows[0]).toMatchObject({ id: "problem", state: "no" });
+  });
+
+  it("says no only when it is no", () => {
+    expect(row(installChecks(plan({ fitsVersion: false }), build("1.0.0", { abi: OLD_ABI }), ctx), "abi")?.state).toBe("no");
+    expect(row(installChecks(plan({ fitsVersion: true }), build("1.0.0"), ctx), "abi")?.state).toBe("yes");
+  });
+
+  it("dates a review from an index that isn't fresh", () => {
+    const rows = installChecks(plan(), build("1.0.0"), { ...ctx, indexFrom: "Sep 21, 2026" });
+    expect(row(rows, "review")?.detail).toMatchObject({ key: "mods.ckIndexDetailDated" });
+  });
+});
+
+describe("consentChanges", () => {
+  const glow = (version: string, trust: "reviewed" | "unreviewed" = "unreviewed") => ({
+    id: "glowmoss",
+    name: "Glowmoss",
+    version,
+    sha256: version.repeat(8).slice(0, 64),
+    trust,
+    channel: "release" as const,
+    size: 1,
+  });
+
+  it("names a dependency that got a newer build, and one that turns on now", () => {
+    const before = planConsent(plan({ install: [glow("0.3.0")] }));
+    const after = planConsent(plan({ install: [glow("0.3.1")], enable: ["cogwork"] }));
+    expect(consentChanges(before, after, ctx.name)).toEqual([
+      { key: "mods.changedVersion", args: ["Glowmoss", "0.3.1", "0.3.0"] },
+      { key: "mods.changedEnables", args: ["COGWORK"] },
+    ]);
+  });
+
+  it("names a tier change, an added and a dropped build, and a mod now installed off", () => {
+    const before = planConsent(plan({ install: [glow("0.3.0")] }));
+    const after = planConsent(
+      plan({ install: [glow("0.3.0", "reviewed"), { ...glow("1.0.0"), id: "moss", name: "Moss" }], turnsOn: false, missing: ["x"] })
+    );
+    const keys = consentChanges(before, after, ctx.name).map((c) => c.key);
+    expect(keys).toEqual(["mods.changedTrust", "mods.changedAdded", "mods.changedOff"]);
+    expect(consentChanges(after, before, ctx.name).map((c) => c.key)).toEqual(["mods.changedTrust", "mods.changedDropped", "mods.changedOn"]);
+  });
+
+  it("says the plan changed when nothing visible did", () => {
+    const same = planConsent(plan());
+    expect(consentChanges(same, same, ctx.name)).toEqual([{ key: "mods.changedOther" }]);
+  });
+
+  it("reads a copy preview the same way", () => {
+    const v = copyConsentView({
+      from: "a",
+      to: "b",
+      items: [{ id: "c", name: "C", outcome: "install", version: "1", trust: "reviewed", sha256: "c".repeat(64) }],
+      deps: [],
+      enable: ["e"],
+      installedOff: [],
+      missing: [],
+      planToken: "t",
+    });
+    expect(v).toEqual({ builds: [{ id: "c", name: "C", version: "1", trust: "reviewed" }], enable: ["e"], off: [] });
+  });
+});
+
+describe("replaceNotes", () => {
+  it("says when an update raises the tier and that an off mod stays off", () => {
+    const notes = replaceNotes(
+      plan({
+        target: { ...plan().target, trust: "reviewed" },
+        replaces: { version: "0.1.2", sha256: "o".repeat(64), trust: "unreviewed", enabled: false },
+      })
+    );
+    expect(notes[0]).toEqual({ key: "mods.ckReplacesTrust", args: ["0.1.2", { trust: "unreviewed" }, { trust: "reviewed" }] });
+    expect(notes[1]).toEqual({ key: "mods.ckReplacesOff" });
+  });
+
+  it("leaves a drop in tier to the first check row, and says it once", () => {
+    const dropping = plan({
+      target: { ...plan().target, trust: "unreviewed" },
+      replaces: { version: "0.1.2", sha256: "o".repeat(64), trust: "reviewed", enabled: true },
+    });
+    expect(replaceNotes(dropping)).toEqual([{ key: "mods.ckReplaces", args: ["0.1.2"] }]);
+    const rows = installChecks(dropping, build("0.4.0", { trust: "unreviewed" }), ctx);
+    expect(rows[0]).toMatchObject({ id: "tierDrop", state: "no", title: { key: "mods.ckTierDrop", args: [{ trust: "reviewed" }, { trust: "unreviewed" }] } });
+    expect(tierDropCheck(plan({ replaces: { version: "0.1.2", sha256: "o".repeat(64), trust: "unreviewed", enabled: true } }))).toBeNull();
+    expect(tierDropCheck(plan())).toBeNull();
+  });
+
+  it("is a plain note when the tier stays", () => {
+    const notes = replaceNotes(plan({ replaces: { version: "0.3.0", sha256: "o".repeat(64), trust: "reviewed", enabled: true } }));
+    expect(notes).toEqual([{ key: "mods.ckReplaces", args: ["0.3.0"] }]);
+  });
+});
+
+describe("fileChecks", () => {
+  const inspection = (extra: Partial<FileInspection> = {}): FileInspection => ({
+    fileName: "x.zip",
+    size: 1,
+    sha256: "f".repeat(64),
+    archive: { id: "x", libraries: ["libx.so"], platforms: ["linux-x64"], hasAssets: false, entries: 2 },
+    problem: null,
+    name: "X",
+    summary: null,
+    fitsSystem: true,
+    catalogMatch: null,
+    revoked: false,
+    revokedReason: null,
+    replaces: null,
+    planToken: "plan-f",
+    ...extra,
+  });
+
+  it("shows a catalogued file's review and provenance like the catalogue does", () => {
+    const rows = fileChecks(
+      inspection({ catalogMatch: { key: "index:x", name: "X", fitsVersion: true, build: build("1.0.0") } }),
+      "v26.11.1"
+    );
+    expect(row(rows, "known")?.state).toBe("yes");
+    expect(row(rows, "review")?.state).toBe("yes");
+    expect(row(rows, "provenance")?.state).toBe("yes");
+    expect(fileVerdict(inspection({ catalogMatch: { key: "k", name: "X", fitsVersion: true, build: build("1.0.0") } }))).toEqual({
+      usable: true,
+      needsTyping: false,
+    });
+  });
+
+  it("uses one 'no build record' state for unknown files: unknown", () => {
+    const r = row(fileChecks(inspection(), "v26.11.1"), "provenance")!;
+    expect(r).toMatchObject({ state: "unknown", title: { key: "mods.ckNoBuild" } });
+    expect(fileVerdict(inspection())).toEqual({ usable: true, needsTyping: true });
+  });
+
+  it("refuses files that aren't mods, are for another system or were revoked", () => {
+    expect(fileVerdict(inspection({ archive: null })).usable).toBe(false);
+    expect(fileVerdict(inspection({ fitsSystem: false })).usable).toBe(false);
+    expect(fileVerdict(inspection({ revoked: true, revokedReason: "bad" })).usable).toBe(false);
+    expect(row(fileChecks(inspection({ revoked: true, revokedReason: "bad" }), "v"), "revoked")?.state).toBe("no");
+  });
+});
+
+describe("file fit and replacing (contract R4 §5)", () => {
+  const inspection = (extra: Partial<FileInspection> = {}): FileInspection => ({
+    fileName: "x.zip",
+    size: 1,
+    sha256: "f".repeat(64),
+    archive: { id: "x", libraries: ["libx.so"], platforms: ["linux-x64"], hasAssets: false, entries: 2 },
+    problem: null,
+    name: "X",
+    summary: null,
+    fitsSystem: true,
+    catalogMatch: null,
+    revoked: false,
+    revokedReason: null,
+    replaces: null,
+    planToken: "plan-f",
+    ...extra,
+  });
+
+  it("an unknown fit of a known file is unknown with Retry, and doesn't make it unusable", () => {
+    const i = inspection({ catalogMatch: { key: "k", name: "X", fitsVersion: null, build: build("1.0.0") } });
+    expect(row(fileChecks(i, "v26.11.1"), "abi")).toMatchObject({ state: "unknown", retry: true });
+    expect(fileVerdict(i).usable).toBe(true);
+    expect(fileVerdict(inspection({ catalogMatch: { key: "k", name: "X", fitsVersion: false, build: build("1.0.0") } })).usable).toBe(false);
+  });
+
+  it("states a change of tier when a file replaces an installed mod", () => {
+    expect(fileReplaceNotes(inspection({ replaces: "X" }), "reviewed")).toEqual([
+      { key: "mods.fileReplacesTrust", args: ["X", { trust: "reviewed" }, { trust: "unverified" }] },
+    ]);
+    expect(fileReplaceNotes(inspection({ replaces: "X" }), "unverified")).toEqual([{ key: "mods.fileReplaces", args: ["X"] }]);
+    expect(fileReplaceNotes(inspection(), "reviewed")).toEqual([]);
+  });
+});
diff --git a/src/mods/checks.ts b/src/mods/checks.ts
new file mode 100644
index 0000000..6c49ce7
--- /dev/null
+++ b/src/mods/checks.ts
@@ -0,0 +1,437 @@
+// What the install dialogs say was checked, decided from backend data only. No JSX and no
+// translation: rows are message keys with arguments, rendered by components/mods/CheckList.
+
+import { formatList, type MessageKey, type Msg } from "../i18n";
+import type { AppErrorPayload, CatalogVersion, CopyPreview, FileInspection, InstallPlan, ModProgress, Trust } from "./types";
+import { shortCommit, shortSha } from "./select";
+import { unreachable } from "../utils/never";
+
+/** "same": nothing to check, because nothing changes (a mod a copy leaves as it is). */
+export type CheckState = "yes" | "no" | "unknown" | "same";
+
+/** One argument of a message: text, a day, a shortened value whose full form stays reachable, an error or a tier name. */
+export type Arg =
+  | string
+  | { day: string }
+  | { code: string; short: string }
+  | { error: AppErrorPayload }
+  | { trust: Trust };
+
+export interface RichMsg {
+  key: MessageKey;
+  args?: Arg[];
+}
+
+export interface CheckRow {
+  /** Stable within one list. */
+  id: string;
+  state: CheckState;
+  title: RichMsg;
+  detail?: RichMsg;
+  /** Shown as a badge after the title, e.g. the tier of a dependency that will be installed. */
+  trust?: Trust;
+  /** Something that couldn't be found out, which asking again may answer: the row offers Retry. */
+  retry?: boolean;
+  /**
+   * What a screen reader says for the mark, when the state's own word would be wrong: a mod
+   * nobody reviewed hasn't failed anything, it is Unreviewed.
+   */
+  said?: MessageKey;
+  /**
+   * The detail says again what the title, or the dialog's warning, already says: it folds with
+   * the checks that passed, so what is new stays in view in a small window.
+   */
+  aside?: boolean;
+}
+
+const sha = (s: string) => ({ code: s, short: shortSha(s) });
+const abi = (s: string) => ({ code: s, short: s.slice(0, 8) });
+const commit = (s: string) => ({ code: s, short: shortCommit(s) });
+
+/**
+ * Review and provenance of one catalogue build, the same wherever a build is shown. `indexFrom` is
+ * the day of the index the review comes from when that index isn't fresh, so an old review says so.
+ */
+export function buildChecks(v: CatalogVersion, indexFrom: string | null = null): CheckRow[] {
+  const rows: CheckRow[] = [];
+  if (v.trust === "reviewed" && v.reviewed) {
+    rows.push({
+      id: "review",
+      state: "yes",
+      title: { key: "mods.ckIndex" },
+      detail: indexFrom
+        ? { key: "mods.ckIndexDetailDated", args: [v.reviewed.by, { day: v.reviewed.at }, indexFrom] }
+        : { key: "mods.ckIndexDetail", args: [v.reviewed.by, { day: v.reviewed.at }] },
+    });
+  } else {
+    rows.push({
+      id: "review",
+      state: "no",
+      said: "mods.badgeUnreviewed",
+      title: { key: "mods.ckNotIndex" },
+      detail: { key: "mods.ckNotIndexDetail", args: [v.sourceRepo] },
+      // Every dialog showing this row warns, above it, whose repo it is and that nobody reviewed it.
+      aside: true,
+    });
+  }
+  // The file name shows; the whole path is a hover or a Tab away, so two workflows of the same name differ.
+  const path = v.provenance?.workflow;
+  const workflow: Arg = path ? { code: path, short: path.split("/").pop() ?? path } : "—";
+  rows.push(buildRecordCheck(v, workflow));
+  return rows;
+}
+
+/**
+ * What is known of how a build was made. Only a whole record in the signed index is a yes, and it
+ * says whose word it is: the index records a GitHub Actions build that its CI checked; the
+ * launcher checks no attestation itself. Anything less is unknown, never yes.
+ */
+function buildRecordCheck(v: CatalogVersion, workflow: Arg): CheckRow {
+  const p = v.provenance;
+  switch (v.buildRecord) {
+    case "recorded":
+      // `recorded` means the backend found every one of these (catalog.rs, `Provenance::is_complete`).
+      return {
+        id: "provenance",
+        state: "yes",
+        title: {
+          key: "mods.ckBuilt",
+          args: [p?.repo ?? v.sourceRepo, commit(v.sourceCommit), v.reviewed?.by ?? "—", p?.verifiedAt ? { day: p.verifiedAt } : "—"],
+        },
+        detail: { key: "mods.ckBuiltDetail", args: [workflow] },
+      };
+    case "incomplete":
+      return { id: "provenance", state: "unknown", title: { key: "mods.ckBuiltIncomplete" }, detail: { key: "mods.ckBuiltIncompleteDetail" } };
+    case "claimed":
+      // The repo's own <id>.mod.json says so. Nothing checked it, so it can't be a green check.
+      return {
+        id: "provenance",
+        state: "unknown",
+        title: { key: "mods.ckBuiltClaimed" },
+        detail: { key: "mods.ckBuiltClaimedDetail", args: [p?.repo ?? v.sourceRepo, commit(v.sourceCommit), workflow] },
+      };
+    case "none":
+      return { id: "provenance", state: "unknown", title: { key: "mods.ckNoBuild" }, detail: { key: "mods.ckNoBuildDetail" }, aside: true };
+    default:
+      return unreachable(v.buildRecord);
+  }
+}
+
+/** How the download is pinned. Only the signed index pins it independently of the file's server. */
+export function pinCheck(v: CatalogVersion): CheckRow {
+  return v.trust === "reviewed"
+    ? { id: "pin", state: "yes", title: { key: "mods.ckPinned", args: [sha(v.sha256)] } }
+    : {
+        id: "pin",
+        state: "unknown",
+        title: { key: "mods.ckPinnedGithub", args: [sha(v.sha256)] },
+        detail: { key: "mods.ckPinnedGithubDetail" },
+      };
+}
+
+/**
+ * What is known of one catalogue build wherever it is offered: its review, how its download is
+ * pinned (with the hash) and its build record. The install dialog's first rows; a copy shows the
+ * same for each build it installs.
+ */
+export function evidenceChecks(v: CatalogVersion, indexFrom: string | null = null): CheckRow[] {
+  const build = buildChecks(v, indexFrom);
+  return [...build.slice(0, 1), pinCheck(v), ...build.slice(1)];
+}
+
+export interface InstallCheckContext {
+  tag: string;
+  /** A mod's display name by id. */
+  name: (id: string) => string;
+  /** Ids of mods installed and on in this version. */
+  enabled: Set<string>;
+  /** The tier of an installed mod, by id. */
+  trustOf: (id: string) => Trust | undefined;
+  /** The version's mod interface, when it is known. */
+  versionAbi: string | null;
+  /** The day of the index reviews come from, when it isn't fresh. */
+  indexFrom?: string | null;
+}
+
+/**
+ * Whether a build fits the version (contract R4 §5): "yes" and "no" only when the backend knows;
+ * unknown (null) is unknown, with Retry, never "no".
+ */
+export function fitCheck(fits: boolean | null, buildAbi: string, tag: string): CheckRow {
+  const detail: RichMsg = { key: "mods.ckFitsDetail", args: [abi(buildAbi)] };
+  if (fits === null) {
+    return { id: "abi", state: "unknown", title: { key: "mods.ckFitUnchecked", args: [tag] }, detail: { key: "mods.ckFitUncheckedDetail" }, retry: true };
+  }
+  if (!fits) return { id: "abi", state: "no", title: { key: "mods.ckFileFitsNo", args: [tag] }, detail };
+  return { id: "abi", state: "yes", title: { key: "mods.ckFits" }, detail };
+}
+
+function abiCheck(plan: InstallPlan, v: CatalogVersion, ctx: InstallCheckContext): CheckRow {
+  // The backend's word on fit (null when the version's interface is unknown); never guessed here.
+  return fitCheck(plan.fitsVersion, v.abi, ctx.tag);
+}
+
+/** What else an install brings: dependencies it downloads, turns on, or can't find. */
+export function planDepChecks(plan: InstallPlan, deps: string[], ctx: InstallCheckContext): CheckRow[] {
+  const rows: CheckRow[] = [];
+  const planned = new Set([...plan.install.map((i) => i.id), ...plan.enable, ...plan.missing]);
+  for (const item of plan.install) {
+    rows.push({
+      id: `dep:${item.id}`,
+      state: "yes",
+      title: { key: "mods.ckDepInstall", args: [item.name, item.version] },
+      trust: item.trust,
+    });
+  }
+  for (const id of plan.enable) {
+    rows.push({ id: `dep:${id}`, state: "yes", title: { key: "mods.ckDepEnable", args: [ctx.name(id)] }, trust: ctx.trustOf(id) });
+  }
+  for (const id of plan.missing) {
+    rows.push({ id: `dep:${id}`, state: "no", title: { key: "mods.ckDepMissing", args: [ctx.name(id), ctx.tag] } });
+  }
+  for (const id of deps) {
+    if (id === "base" || planned.has(id)) continue;
+    rows.push(
+      ctx.enabled.has(id)
+        ? { id: `dep:${id}`, state: "yes", title: { key: "mods.ckDepHave", args: [ctx.name(id)] } }
+        : // Not in the plan and not on: the backend didn't say. Say that, not "fine".
+          { id: `dep:${id}`, state: "unknown", title: { key: "mods.ckDepUnknown", args: [ctx.name(id)] } }
+    );
+  }
+  return rows;
+}
+
+/**
+ * The plan's problem as the first row, so the reason the button is off is the first thing read.
+ * Not knowing the version's interface is not a "no" (contract R4 §5): then the fit row, unknown
+ * with Retry, goes first instead and says it.
+ */
+export function withProblem(problem: AppErrorPayload | null, rows: CheckRow[]): CheckRow[] {
+  if (!problem) return rows;
+  if (problem.code === "AbiUnavailable") {
+    const fit = rows.find((r) => r.id === "abi" && r.state === "unknown");
+    if (fit) return [fit, ...rows.filter((r) => r !== fit)];
+  }
+  return [{ id: "problem", state: "no", title: { key: "mods.ckWontInstall", args: [{ error: problem }] } }, ...rows];
+}
+
+const TIER_RANK: Record<Trust, number> = { reviewed: 2, unreviewed: 1, unverified: 0 };
+
+/**
+ * An update to a build of a lower tier than the one installed (Reviewed → Unreviewed): the first
+ * row, so the drop is said in words above everything else, not only by the badge.
+ */
+export function tierDropCheck(plan: InstallPlan): CheckRow | null {
+  const r = plan.replaces;
+  if (!r || TIER_RANK[plan.target.trust] >= TIER_RANK[r.trust]) return null;
+  return {
+    id: "tierDrop",
+    state: "no",
+    said: "mods.ckTierDropSaid",
+    title: { key: "mods.ckTierDrop", args: [{ trust: r.trust }, { trust: plan.target.trust }] },
+  };
+}
+
+/** Everything the install and update dialogs show, from the backend's plan. */
+export function installChecks(plan: InstallPlan, v: CatalogVersion, ctx: InstallCheckContext): CheckRow[] {
+  const rows: CheckRow[] = [];
+  const drop = tierDropCheck(plan);
+  if (drop) rows.push(drop);
+  rows.push(...evidenceChecks(v, ctx.indexFrom ?? null));
+  rows.push(abiCheck(plan, v, ctx));
+  rows.push(...planDepChecks(plan, v.deps, ctx));
+  return withProblem(plan.problem, rows);
+}
+
+/**
+ * What the primary button does and the line that explains it. A plan with a missing dependency
+ * installs the mod turned off (contract R3 §1), so Play keeps working.
+ */
+export function installOutcome(
+  plan: InstallPlan,
+  replacing: boolean,
+  modName: string,
+  ctx: Pick<InstallCheckContext, "tag" | "name">
+): { button: MessageKey; explain: Msg | null } {
+  const missingOff = !plan.turnsOn && plan.missing.length > 0 && (plan.replaces === null || plan.replaces.enabled);
+  if (missingOff) {
+    return {
+      button: replacing ? "mods.updateTurnedOff" : "mods.installTurnedOff",
+      explain: {
+        key: "mods.installsOff",
+        count: plan.missing.length,
+        args: [formatList(plan.missing.map(ctx.name)), ctx.tag, modName],
+      },
+    };
+  }
+  return { button: replacing ? "mods.updateButton" : "mods.install", explain: null };
+}
+
+/**
+ * Mods this install brings that nobody reviewed: dependencies it downloads or turns on, with
+ * their tier. The warning names them, also when the mod itself is Reviewed.
+ */
+export function weakerDeps(plan: InstallPlan, ctx: Pick<InstallCheckContext, "name" | "trustOf">): { name: string; trust: Trust }[] {
+  const out: { name: string; trust: Trust }[] = [];
+  for (const i of plan.install) if (i.trust !== "reviewed") out.push({ name: i.name, trust: i.trust });
+  for (const id of plan.enable) {
+    const trust = ctx.trustOf(id);
+    if (trust && trust !== "reviewed") out.push({ name: ctx.name(id), trust });
+  }
+  return out;
+}
+
+/**
+ * The step to show while an operation runs: the file its newest event is about (contract R4 §3).
+ * Events come in the order the backend works, so a file that finished checking and waits for
+ * the final install never hides the one now downloading.
+ */
+export function activeStep<P extends Pick<ModProgress, "sha256">>(entries: P[]): P | undefined {
+  return entries[entries.length - 1];
+}
+
+/**
+ * The lines under the checks that say what an update replaces, including a rise in tier (a drop
+ * is the first check row instead: tierDropCheck).
+ */
+export function replaceNotes(plan: InstallPlan): RichMsg[] {
+  const r = plan.replaces;
+  if (!r) return [];
+  const notes: RichMsg[] = [];
+  const old = r.version ?? shortSha(r.sha256);
+  notes.push(
+    r.trust !== plan.target.trust && !tierDropCheck(plan)
+      ? { key: "mods.ckReplacesTrust", args: [old, { trust: r.trust }, { trust: plan.target.trust }] }
+      : { key: "mods.ckReplaces", args: [old] }
+  );
+  if (!r.enabled) notes.push({ key: "mods.ckReplacesOff" });
+  return notes;
+}
+
+/** A zip from the player's computer. */
+export function fileChecks(inspection: FileInspection, tag: string, indexFrom: string | null = null): CheckRow[] {
+  const rows: CheckRow[] = [];
+  const { archive, catalogMatch: known } = inspection;
+  if (inspection.revoked) {
+    const why = (inspection.revokedReason ?? "").trim();
+    rows.push({ id: "revoked", state: "no", title: why ? { key: "mods.ckRevoked", args: [why] } : { key: "mods.ckRevokedNoReason" } });
+  }
+  if (known) {
+    rows.push({ id: "known", state: "yes", title: { key: "mods.ckFileKnown", args: [known.name, known.build.version] } });
+    rows.push(...buildChecks(known.build, indexFrom));
+    rows.push(fitCheck(known.fitsVersion, known.build.abi, tag));
+  } else if (archive) {
+    rows.push({ id: "known", state: "no", title: { key: "mods.ckFileNotKnown" } });
+    rows.push({ id: "provenance", state: "unknown", title: { key: "mods.ckNoBuild" }, detail: { key: "mods.ckNoBuildDetail" } });
+    rows.push({
+      id: "abi",
+      state: "unknown",
+      title: { key: "mods.ckFileFitUnknown" },
+      detail: { key: "mods.ckFileFitUnknownDetail" },
+    });
+  }
+  if (archive) {
+    const contents = formatList([...archive.libraries, ...(archive.hasAssets ? ["assets/"] : [])]);
+    rows.push(
+      inspection.fitsSystem
+        ? { id: "contents", state: "yes", title: { key: "mods.ckLooksLikeMod" }, detail: { key: "mods.ckLooksLikeModDetail", args: [contents] } }
+        : {
+            id: "contents",
+            state: "no",
+            title: { key: "mods.ckNotForSystem" },
+            detail: { key: "mods.ckNotForSystemDetail", args: [formatList(archive.platforms.map(platformLabel))] },
+          }
+    );
+  } else {
+    rows.push({
+      id: "contents",
+      state: "no",
+      title: { key: "mods.ckNotAMod" },
+      detail: inspection.problem ? { key: "mods.ckNotAModDetail", args: [{ error: inspection.problem }] } : undefined,
+    });
+  }
+  return rows;
+}
+
+const PLATFORM_LABEL: Record<string, string> = {
+  "windows-x64": "Windows",
+  "linux-x64": "Linux",
+  "macos-arm64": "macOS",
+};
+
+export function platformLabel(p: string): string {
+  return PLATFORM_LABEL[p] ?? p;
+}
+
+/** Whether a file can be installed, and whether it needs the typed confirmation. */
+export function fileVerdict(inspection: FileInspection): { usable: boolean; needsTyping: boolean } {
+  const { archive, catalogMatch: known } = inspection;
+  // Unknown fit isn't "no": the plan's own problem (if any) says whether it can install.
+  const usable = !!archive && inspection.fitsSystem && !inspection.revoked && (known === null || known.fitsVersion !== false);
+  return { usable, needsTyping: usable && known === null };
+}
+
+/**
+ * What replacing an installed mod with a file means: the version it replaces, and a change of
+ * tier when there is one, e.g. a Reviewed build replaced by an Unverified file.
+ */
+export function fileReplaceNotes(inspection: FileInspection, installedTrust: Trust | undefined): RichMsg[] {
+  if (!inspection.replaces) return [];
+  const now: Trust = inspection.catalogMatch?.build.trust ?? "unverified";
+  if (installedTrust && installedTrust !== now) {
+    return [{ key: "mods.fileReplacesTrust", args: [inspection.replaces, { trust: installedTrust }, { trust: now }] }];
+  }
+  return [{ key: "mods.fileReplaces", args: [inspection.replaces] }];
+}
+
+/** What a player agreed to, in the terms a change to it is told in. */
+export interface ConsentView {
+  /** Builds that will be installed. */
+  builds: { id: string; name: string; version: string | null; trust: Trust | null }[];
+  /** Installed mods that will be turned on. */
+  enable: string[];
+  /** Mods that will be installed turned off. */
+  off: string[];
+}
+
+export function planConsent(plan: InstallPlan): ConsentView {
+  return {
+    builds: [plan.target, ...plan.install].map((i) => ({ id: i.id, name: i.name, version: i.version, trust: i.trust })),
+    enable: plan.enable,
+    off: plan.turnsOn || (plan.replaces && !plan.replaces.enabled) ? [] : [plan.target.id],
+  };
+}
+
+export function copyConsentView(preview: CopyPreview): ConsentView {
+  return {
+    builds: [
+      ...preview.items.filter((i) => i.outcome === "install").map((i) => ({ id: i.id, name: i.name, version: i.version, trust: i.trust })),
+      ...preview.deps.map((d) => ({ id: d.id, name: d.name, version: d.version, trust: d.trust })),
+    ],
+    enable: preview.enable,
+    off: preview.installedOff,
+  };
+}
+
+/**
+ * What changed between the plan the player saw and the one there is now, after the backend
+ * refused the old one (`ModChangedMeanwhile`). One line per change; when the difference isn't one
+ * the player can see (the version's interface, say), one line that says it changed.
+ */
+export function consentChanges(before: ConsentView, after: ConsentView, name: (id: string) => string): RichMsg[] {
+  const out: RichMsg[] = [];
+  const old = new Map(before.builds.map((b) => [b.id, b]));
+  const now = new Map(after.builds.map((b) => [b.id, b]));
+  for (const b of after.builds) {
+    const was = old.get(b.id);
+    if (!was) out.push({ key: "mods.changedAdded", args: [b.name, b.version ?? ""] });
+    else if (was.version !== b.version) out.push({ key: "mods.changedVersion", args: [b.name, b.version ?? "", was.version ?? ""] });
+    if (was && b.trust && was.trust && was.trust !== b.trust) out.push({ key: "mods.changedTrust", args: [b.name, { trust: b.trust }] });
+  }
+  for (const b of before.builds) if (!now.has(b.id)) out.push({ key: "mods.changedDropped", args: [b.name] });
+  for (const id of after.enable) if (!before.enable.includes(id)) out.push({ key: "mods.changedEnables", args: [name(id)] });
+  for (const id of before.enable) if (!after.enable.includes(id)) out.push({ key: "mods.changedNoEnable", args: [name(id)] });
+  for (const id of after.off) if (!before.off.includes(id)) out.push({ key: "mods.changedOff", args: [name(id)] });
+  for (const id of before.off) if (!after.off.includes(id)) out.push({ key: "mods.changedOn", args: [name(id)] });
+  return out.length ? out : [{ key: "mods.changedOther" }];
+}
diff --git a/src/mods/copyPlan.test.ts b/src/mods/copyPlan.test.ts
new file mode 100644
index 0000000..6131a7b
--- /dev/null
+++ b/src/mods/copyPlan.test.ts
@@ -0,0 +1,53 @@
+import { describe, expect, it } from "vitest";
+import { COPY_OUTCOME, copyConsent } from "./copyPlan";
+import type { CopyPreview, ProfileReport } from "./types";
+
+const preview: CopyPreview = {
+  from: "v26.10.4",
+  to: "v26.11.1",
+  items: [
+    { id: "cogwork", name: "Cogwork", outcome: "install", version: "0.2.0", trust: "reviewed", sha256: "a".repeat(64) },
+    { id: "lanterns", name: "Lanterns", outcome: "install", version: "1.1.0", trust: "unreviewed", sha256: "b".repeat(64) },
+    { id: "mytweak", name: "My Tweak", outcome: "localFile", version: null, trust: null, sha256: null },
+  ],
+  deps: [{ id: "glowmoss", name: "Glowmoss", version: "0.3.0", sha256: "c".repeat(64), trust: "unreviewed", channel: "release", size: 1 }],
+  enable: ["structures"],
+  installedOff: ["lanterns"],
+  missing: ["signals"],
+  planToken: "plan-1",
+};
+
+const target = {
+  tag: "v26.11.1",
+  mods: [{ id: "structures", name: "Structures", trust: "reviewed" }],
+} as unknown as ProfileReport;
+
+describe("copyConsent", () => {
+  const c = copyConsent(preview, target);
+
+  it("lists only what will be installed", () => {
+    expect(c.items.map((i) => i.id)).toEqual(["cogwork", "lanterns"]);
+  });
+
+  it("takes dependencies, turn-ons, missing and turned-off mods from the preview", () => {
+    expect(c.deps.map((d) => d.id)).toEqual(["glowmoss"]);
+    expect(c.enable).toEqual([{ id: "structures", name: "Structures", trust: "reviewed" }]);
+    expect(c.missing).toEqual(["signals"]);
+    expect(c.installedOff).toEqual(["lanterns"]);
+  });
+
+  it("names everything unreviewed it brings, dependencies included", () => {
+    expect(c.unreviewed).toEqual(["Lanterns", "Glowmoss"]);
+  });
+
+  it("tracks progress for every download, copied mods first", () => {
+    expect(c.shas).toEqual(["a".repeat(64), "b".repeat(64), "c".repeat(64)]);
+  });
+});
+
+describe("copy outcomes", () => {
+  it("say what stays behind as not copied, never as failed", () => {
+    for (const o of ["noBuild", "localFile", "revoked"] as const) expect(COPY_OUTCOME[o].said).toBe("mods.ckNotCopied");
+    expect(COPY_OUTCOME.install.said).toBeUndefined();
+  });
+});
diff --git a/src/mods/copyPlan.ts b/src/mods/copyPlan.ts
new file mode 100644
index 0000000..d078f93
--- /dev/null
+++ b/src/mods/copyPlan.ts
@@ -0,0 +1,55 @@
+// What a copy will do, for the consent the copy dialog asks: each mod it brings, and everything
+// those bring along, all from the backend's copy preview. Pure, so it is tested without React.
+
+import type { MessageKey } from "../i18n";
+import type { CopyItem, CopyPreview, ProfileReport, Trust } from "./types";
+import type { CheckState } from "./checks";
+
+/** Each outcome's mark, its words, and what a screen reader says for the mark: staying behind isn't failing. */
+export const COPY_OUTCOME: Record<CopyItem["outcome"], { state: CheckState; key: MessageKey; said?: MessageKey }> = {
+  install: { state: "yes", key: "mods.copyWillInstall" },
+  alreadyThere: { state: "same", key: "mods.copyAlreadyThere" },
+  noBuild: { state: "no", key: "mods.copyNoBuild", said: "mods.ckNotCopied" },
+  localFile: { state: "no", key: "mods.copyLocalFile", said: "mods.ckNotCopied" },
+  revoked: { state: "no", key: "mods.copyRevoked", said: "mods.ckNotCopied" },
+};
+
+export interface CopyConsent {
+  /** The copied mods that will be installed. */
+  items: CopyItem[];
+  /** What they need that isn't in the target or in the copy: downloaded too. */
+  deps: { id: string; name: string; version: string; trust: Trust; sha256: string }[];
+  /** Mods of the target, now off, that the copied mods turn on. */
+  enable: { id: string; name: string; trust: Trust }[];
+  /** What nothing provides for the target version. */
+  missing: string[];
+  /** Copied mods that are installed turned off because of that. */
+  installedOff: string[];
+  /** Everything this brings that nobody reviewed, by name. */
+  unreviewed: string[];
+  /** Every hash the copy downloads, in plan order: what its progress will show. */
+  shas: string[];
+}
+
+/** The consent for a copy: the preview's items, dependencies and turn-ons, with names and trust. */
+export function copyConsent(preview: CopyPreview, target: ProfileReport | undefined): CopyConsent {
+  const items = preview.items.filter((i) => i.outcome === "install");
+  const deps = preview.deps.map((d) => ({ id: d.id, name: d.name, version: d.version, trust: d.trust, sha256: d.sha256 }));
+  const enable = preview.enable.map((id) => {
+    const mod = target?.mods.find((m) => m.id === id);
+    return { id, name: mod?.name ?? id, trust: mod?.trust ?? ("unverified" as Trust) };
+  });
+  return {
+    items,
+    deps,
+    enable,
+    missing: preview.missing,
+    installedOff: preview.installedOff,
+    unreviewed: [
+      ...items.filter((i) => i.trust !== "reviewed").map((i) => i.name),
+      ...deps.filter((d) => d.trust !== "reviewed").map((d) => d.name),
+      ...enable.filter((e) => e.trust !== "reviewed").map((e) => e.name),
+    ],
+    shas: [...items.flatMap((i) => (i.sha256 ? [i.sha256] : [])), ...deps.map((d) => d.sha256)],
+  };
+}
diff --git a/src/mods/fixtures.ts b/src/mods/fixtures.ts
new file mode 100644
index 0000000..b05a4c5
--- /dev/null
+++ b/src/mods/fixtures.ts
@@ -0,0 +1,106 @@
+// Small builders for the unit tests: a catalogue build, a mod, an installed mod, a report.
+
+import type { Catalog, CatalogMod, CatalogVersion, InstalledMod, ProfileReport } from "./types";
+
+export const ABI = "f470b1cbb1f9ad91";
+export const OLD_ABI = "5f0569a6bea71b81";
+
+export function build(version: string, extra: Partial<CatalogVersion> = {}): CatalogVersion {
+  return {
+    version,
+    channel: "release",
+    tag: `x-v${version}`,
+    published: "2026-11-04T00:00:00Z",
+    sourceRepo: "Zorro909/weft-mods",
+    sourceCommit: "cceea7805df5902d62017d2008d1bb29ed84e152",
+    weftTag: "v26.11.1",
+    abi: ABI,
+    deps: ["base"],
+    platforms: ["linux-x64", "windows-x64"],
+    sha256: `${version}`.padEnd(64, "0"),
+    size: 1000,
+    url: "https://github.com/Zorro909/weft-mods/releases/download/x/x.zip",
+    provenance: { repo: "Zorro909/weft-mods", workflow: ".github/workflows/release.yml", gitRef: "refs/heads/main", verifiedAt: "2026-11-04T18:00:00Z" },
+    buildRecord: "recorded",
+    reviewed: { by: "Zorro909", at: "2026-11-04" },
+    trust: "reviewed",
+    ...extra,
+  };
+}
+
+export function catalogMod(id: string, versions: CatalogVersion[], extra: Partial<CatalogMod> = {}): CatalogMod {
+  return {
+    key: `index:${id}`,
+    id,
+    name: id[0].toUpperCase() + id.slice(1),
+    summary: "",
+    authors: ["someone"],
+    license: null,
+    homepage: null,
+    icon: null,
+    origin: { kind: "index" },
+    versions,
+    ...extra,
+  };
+}
+
+export function catalog(mods: CatalogMod[], extra: Partial<Catalog> = {}): Catalog {
+  return {
+    mods,
+    revoked: [],
+    index: { freshness: "fresh", generated: "2026-11-04T00:00:00Z", signedAt: "2026-11-04T00:00:00Z", error: null, cacheError: null },
+    sources: [],
+    weft: [],
+    platform: "linux-x64",
+    sourcesError: null,
+    revision: 0,
+    ...extra,
+  };
+}
+
+export function installed(id: string, extra: Partial<InstalledMod> = {}): InstalledMod {
+  return {
+    id,
+    name: id[0].toUpperCase() + id.slice(1),
+    summary: "",
+    version: "1.0.0",
+    channel: "release",
+    sha256: `${id}`.padEnd(64, "a"),
+    size: 1000,
+    enabled: true,
+    trust: "reviewed",
+    origin: { kind: "index" },
+    abi: ABI,
+    weftTag: "v26.11.1",
+    deps: ["base"],
+    tag: null,
+    sourceRepo: null,
+    sourceCommit: null,
+    icon: null,
+    installedAt: "2026-11-04T00:00:00Z",
+    status: "ready",
+    missingDeps: [],
+    depsNotInstalled: [],
+    revoked: null,
+    revokedReason: null,
+    update: null,
+    ...extra,
+  };
+}
+
+export function report(mods: InstalledMod[], extra: Partial<ProfileReport> = {}): ProfileReport {
+  return {
+    tag: "v26.11.1",
+    versionAbi: ABI,
+    abiError: null,
+    mods,
+    revocationsPending: [],
+    blocking: mods.filter((m) => m.status === "wrongVersion" || m.status === "missingDeps").map((m) => m.id),
+    blockingReasons: Object.fromEntries(
+      mods.filter((m) => m.status === "wrongVersion" || m.status === "missingDeps").map((m) => [m.id, m.status as "wrongVersion" | "missingDeps"])
+    ),
+    unmanaged: [],
+    shadowed: [],
+    ...extra,
+  };
+}
diff --git a/src/mods/ipc.ts b/src/mods/ipc.ts
new file mode 100644
index 0000000..4b079f1
--- /dev/null
+++ b/src/mods/ipc.ts
@@ -0,0 +1,4 @@
+// Command and event names, generated from the backend. Used by src/mods/api.ts, the hooks and the
+// mock backend, so a renamed command fails to compile instead of failing at runtime.
+export { COMMANDS, EVENTS } from "./bindings/commands";
+export type { CommandName as Command, EventName } from "./bindings/commands";
diff --git a/src/mods/modsRoute.test.ts b/src/mods/modsRoute.test.ts
new file mode 100644
index 0000000..61ffa1c
--- /dev/null
+++ b/src/mods/modsRoute.test.ts
@@ -0,0 +1,27 @@
+import { describe, expect, it } from "vitest";
+import { MODS_START, modsRoute } from "./modsRoute";
+
+describe("the Mods tab's route", () => {
+  it("opens one dialog at a time, and closes it", () => {
+    let s = modsRoute(MODS_START, { type: "open", dialog: { kind: "sources" } });
+    expect(s.dialog).toEqual({ kind: "sources" });
+    s = modsRoute(s, { type: "open", dialog: { kind: "file", path: "/a.zip" } });
+    expect(s.dialog).toEqual({ kind: "file", path: "/a.zip" });
+    s = modsRoute(s, { type: "close" });
+    expect(s.dialog).toBeNull();
+    expect(modsRoute(s, { type: "close" })).toBe(s);
+  });
+
+  it("brings an undone removal to the Installed list, with focus on its row once", () => {
+    let s = modsRoute(MODS_START, { type: "view", view: "browse" });
+    s = modsRoute(s, { type: "restored", id: "cogwork" });
+    expect(s).toMatchObject({ view: "installed", focusMod: "cogwork" });
+    s = modsRoute(s, { type: "focused" });
+    expect(s.focusMod).toBeNull();
+    expect(modsRoute(s, { type: "focused" })).toBe(s);
+  });
+
+  it("keeps the same state for the view it is already on", () => {
+    expect(modsRoute(MODS_START, { type: "view", view: "installed" })).toBe(MODS_START);
+  });
+});
diff --git a/src/mods/modsRoute.ts b/src/mods/modsRoute.ts
new file mode 100644
index 0000000..d20af5c
--- /dev/null
+++ b/src/mods/modsRoute.ts
@@ -0,0 +1,40 @@
+// Where the Mods tab is: Installed or Browse, the one dialog open over it, and the row focus
+// goes to next. A reducer without React, so the rules are tested apart from the page.
+
+export const MODS_VIEWS = ["installed", "browse"] as const;
+export type ModsView = (typeof MODS_VIEWS)[number];
+
+export type ModsDialog = { kind: "file"; path: string } | { kind: "sources" } | { kind: "copy" };
+
+export interface ModsRoute {
+  view: ModsView;
+  /** One dialog at a time: what the player opened last is what shows. */
+  dialog: ModsDialog | null;
+  /** A row to focus once it is there (a mod put back by Undo). */
+  focusMod: string | null;
+}
+
+export type ModsRouteAction =
+  | { type: "view"; view: ModsView }
+  | { type: "open"; dialog: ModsDialog }
+  | { type: "close" }
+  /** Undo put a mod back: it is on the Installed list, and focus goes to its row. */
+  | { type: "restored"; id: string }
+  | { type: "focused" };
+
+export const MODS_START: ModsRoute = { view: "installed", dialog: null, focusMod: null };
+
+export function modsRoute(state: ModsRoute, action: ModsRouteAction): ModsRoute {
+  switch (action.type) {
+    case "view":
+      return state.view === action.view ? state : { ...state, view: action.view };
+    case "open":
+      return { ...state, dialog: action.dialog };
+    case "close":
+      return state.dialog ? { ...state, dialog: null } : state;
+    case "restored":
+      return { ...state, view: "installed", focusMod: action.id };
+    case "focused":
+      return state.focusMod ? { ...state, focusMod: null } : state;
+  }
+}
diff --git a/src/mods/profileReads.test.ts b/src/mods/profileReads.test.ts
new file mode 100644
index 0000000..3456585
--- /dev/null
+++ b/src/mods/profileReads.test.ts
@@ -0,0 +1,106 @@
+import { describe, expect, it } from "vitest";
+import { ProfileReads } from "./profileReads";
+import type { ProfileReport } from "./types";
+
+/** A report told apart by its label. */
+const report = (label: string) => ({ tag: "v1", label }) as unknown as ProfileReport;
+const label = (r: ProfileReport | undefined) => (r as unknown as { label: string } | undefined)?.label;
+
+/** A backend whose reads answer when the test says, each with the state at the time it began. */
+function backend() {
+  let state = "old";
+  const calls: { began: string; answer: () => void; fail: () => void }[] = [];
+  const shown: string[] = [];
+  const reads = new ProfileReads(
+    () =>
+      new Promise<ProfileReport>((resolve, reject) => {
+        const began = state;
+        calls.push({ began, answer: () => resolve(report(began)), fail: () => reject(new Error("io")) });
+      }),
+    (_tag, r) => shown.push(label(r)!)
+  );
+  return { reads, calls, shown, change: (s: string) => (state = s) };
+}
+
+const tick = () => new Promise((r) => setTimeout(r, 0));
+
+describe("profile reads", () => {
+  it("share one read between callers that don't need it fresh", async () => {
+    const b = backend();
+    const one = b.reads.read("v1");
+    const two = b.reads.read("v1");
+    expect(b.calls).toHaveLength(1);
+    b.calls[0].answer();
+    expect(label(await one)).toBe("old");
+    expect(label(await two)).toBe("old");
+  });
+
+  it("never serve a fresh read with one that began before it was asked", async () => {
+    const b = backend();
+    const older = b.reads.read("v1");
+    // The catalogue refresh lands meanwhile (revocations): the set is now "new".
+    b.change("new");
+    const fresh = b.reads.read("v1", true);
+    // It waits for the older read to end, then reads again.
+    expect(b.calls).toHaveLength(1);
+    b.calls[0].answer();
+    expect(label(await older)).toBe("old");
+    await tick();
+    expect(b.calls).toHaveLength(2);
+    b.calls[1].answer();
+    expect(label(await fresh)).toBe("new");
+    expect(b.shown).toEqual(["old", "new"]);
+  });
+
+  it("share the read queued for freshness among the fresh reads asked before it began", async () => {
+    const b = backend();
+    b.reads.read("v1");
+    b.change("new");
+    const a = b.reads.read("v1", true);
+    const c = b.reads.read("v1", true);
+    const plain = b.reads.read("v1");
+    b.calls[0].answer();
+    await tick();
+    expect(b.calls).toHaveLength(2);
+    b.calls[1].answer();
+    expect([label(await a), label(await c), label(await plain)]).toEqual(["new", "new", "new"]);
+  });
+
+  it("read again when the older read failed", async () => {
+    const b = backend();
+    const older = b.reads.read("v1");
+    b.change("new");
+    const fresh = b.reads.read("v1", true);
+    b.calls[0].fail();
+    await expect(older).rejects.toThrow("io");
+    await tick();
+    b.calls[1].answer();
+    expect(label(await fresh)).toBe("new");
+  });
+
+  it("drop an answer older than a change already shown", async () => {
+    const b = backend();
+    const slow = b.reads.read("v1");
+    b.reads.changed("v1", report("changed"));
+    b.calls[0].answer();
+    await slow;
+    expect(b.shown).toEqual(["changed"]);
+  });
+
+  it("let a refresh finishing during an older read end on the refreshed set", async () => {
+    const b = backend();
+    // The start-up read of the set is slow.
+    const startup = b.reads.read("v1");
+    // A catalogue refresh ends meanwhile and reads every set again, fresh.
+    b.change("refreshed");
+    const afterRefresh = b.reads.read("v1", true);
+    // The fresh read can't start before the start-up one ends; the start-up one answers last
+    // of the old state, and the refreshed set is what stays shown.
+    b.calls[0].answer();
+    await startup;
+    await tick();
+    b.calls[1].answer();
+    await afterRefresh;
+    expect(b.shown[b.shown.length - 1]).toBe("refreshed");
+  });
+});
diff --git a/src/mods/profileReads.ts b/src/mods/profileReads.ts
new file mode 100644
index 0000000..f13740c
--- /dev/null
+++ b/src/mods/profileReads.ts
@@ -0,0 +1,83 @@
+// Reads of a version's mod set, in order, without React: hooks/useProfileCoordinator holds one.
+
+import type { ProfileReport } from "./types";
+
+interface Running {
+  promise: Promise<ProfileReport>;
+  /** The freshness epoch the read began in; null while it waits for an older read to end. */
+  began: number | null;
+}
+
+/**
+ * Profile answers per version, in order, and fresh when asked to be.
+ *
+ * - Every read and every finished change takes a ticket; an answer older than one already shown
+ *   is dropped, so a slow read can't undo a change.
+ * - Reads share: a caller during a read gets that read, not a second one.
+ * - A fresh read (after the catalogue or the set changed: a refresh brought revocations, Play was
+ *   refused) never shares a read that began before it was asked. It waits for that one to end and
+ *   reads again, so its answer is from after the change. Fresh reads asked while that second read
+ *   hasn't begun share it.
+ */
+export class ProfileReads {
+  private issued: Record<string, number> = {};
+  private shown: Record<string, number> = {};
+  private epoch: Record<string, number> = {};
+  private running: Record<string, Running> = {};
+
+  constructor(
+    private fetch: (tag: string) => Promise<ProfileReport>,
+    private show: (tag: string, report: ProfileReport) => void
+  ) {}
+
+  private ticket(tag: string): number {
+    return (this.issued[tag] = (this.issued[tag] ?? 0) + 1);
+  }
+
+  private offer(tag: string, at: number, report: ProfileReport) {
+    if (at <= (this.shown[tag] ?? 0)) return;
+    this.shown[tag] = at;
+    this.show(tag, report);
+  }
+
+  /** Starts a read now, in the current epoch. */
+  private begin(tag: string): Promise<ProfileReport> {
+    const at = this.ticket(tag);
+    const entry: Running = { promise: Promise.resolve(null as unknown as ProfileReport), began: this.epoch[tag] ?? 0 };
+    entry.promise = this.fetch(tag)
+      .then((report) => {
+        this.offer(tag, at, report);
+        return report;
+      })
+      .finally(() => {
+        if (this.running[tag] === entry) delete this.running[tag];
+      });
+    this.running[tag] = entry;
+    return entry.promise;
+  }
+
+  /** The set of `tag`; with `fresh`, read after anything that began before this call. */
+  read(tag: string, fresh = false): Promise<ProfileReport> {
+    if (fresh) this.epoch[tag] = (this.epoch[tag] ?? 0) + 1;
+    const now = this.epoch[tag] ?? 0;
+    const running = this.running[tag];
+    if (!running) return this.begin(tag);
+    // Waiting to begin, or begun in this epoch: fresh enough to share.
+    if (running.began === null || running.began >= now) return running.promise;
+    // Begun before a change this read must see: read again once it ends.
+    const queued: Running = { promise: Promise.resolve(null as unknown as ProfileReport), began: null };
+    queued.promise = running.promise
+      .catch(() => undefined)
+      .then(() => {
+        if (this.running[tag] === queued) delete this.running[tag];
+        return this.begin(tag);
+      });
+    this.running[tag] = queued;
+    return queued.promise;
+  }
+
+  /** A change's report is the newest state when it arrives: its ticket is taken then. */
+  changed(tag: string, report: ProfileReport) {
+    this.offer(tag, this.ticket(tag), report);
+  }
+}
diff --git a/src/mods/progress.test.ts b/src/mods/progress.test.ts
new file mode 100644
index 0000000..009c811
--- /dev/null
+++ b/src/mods/progress.test.ts
@@ -0,0 +1,73 @@
+import { describe, expect, it } from "vitest";
+import trace from "../dev/fixtures/trace.json";
+import { dwellDelay, stepKey, VERIFY_DWELL } from "./progress";
+import type { UiProgress, UiStage } from "./types";
+
+const MODS = ["cogwork", "hearth"];
+
+/** The backend's trace as records, arriving `gap` ms apart. */
+function records(steps: string[], count: number, gap: number): { at: number; p: UiProgress }[] {
+  return steps.map((s, i) => {
+    const [index, stage, percent] = s.split(":");
+    const id = MODS[Number(index) - 1];
+    return {
+      at: i * gap,
+      p: { operationId: "op", sha256: `${id}-sha`, modId: id, stage: stage as UiStage, percent: Number(percent), index: Number(index), count },
+    };
+  });
+}
+
+/** What the bar shows over time, stepping through it as the hook does: each record whole. */
+function shown(events: { at: number; p: UiProgress }[]): { at: number; p: UiProgress }[] {
+  const out: { at: number; p: UiProgress }[] = [];
+  let on: UiProgress | undefined;
+  let since = 0;
+  const end = events[events.length - 1].at + VERIFY_DWELL * 4;
+  for (let now = 0, i = 0; now <= end; now++) {
+    while (i < events.length && events[i].at <= now) i++;
+    const next = i ? events[i - 1].p : undefined;
+    if (next && next !== on && dwellDelay(on, next, since, now) === 0) {
+      if (stepKey(next) !== stepKey(on)) {
+        since = now;
+        out.push({ at: now, p: next });
+      }
+      on = next;
+    }
+  }
+  return out;
+}
+
+describe("progress dwell", () => {
+  it("holds a file's check, and never pairs it with the next file's number or name", () => {
+    // The backend moves on from checking Cogwork to downloading Hearth well within the dwell.
+    const events = records(trace.installWithDependency.steps, trace.installWithDependency.count, 150);
+    const seen = shown(events);
+    for (const { p } of seen) {
+      // Every record shown is one the backend sent: index, mod and step belong together.
+      expect(MODS[p.index - 1]).toBe(p.modId);
+    }
+    const checks = seen.filter((s) => s.p.stage === "verifying");
+    expect(checks.map((c) => `${c.p.index}:${c.p.modId}`)).toEqual(["1:cogwork", "2:hearth"]);
+    // Each check stays on screen for the dwell, then gives way to what came next.
+    for (const c of checks) {
+      const after = seen[seen.indexOf(c) + 1];
+      expect(after.at - c.at).toBeGreaterThanOrEqual(VERIFY_DWELL);
+    }
+  });
+
+  it("a check is only shown for a file whose download was shown first", () => {
+    const seen = shown(records(trace.installWithDependency.steps, 2, 3)).map((s) => `${s.p.index}:${s.p.stage}`);
+    for (const [i, step] of seen.entries()) {
+      if (step.endsWith(":verifying")) expect(seen.slice(0, i)).toContain(step.replace("verifying", "downloading"));
+    }
+  });
+
+  it("gives way at once when nothing is being checked, or the check goes on", () => {
+    const [a, b] = records(["1:downloading:10", "1:downloading:40"], 1, 0).map((r) => r.p);
+    expect(dwellDelay(a, b, 0, 0)).toBe(0);
+    const [check, again] = records(["1:verifying:100", "1:verifying:100"], 1, 0).map((r) => r.p);
+    expect(dwellDelay(check, again, 0, 0)).toBe(0);
+    const [, next] = records(["1:verifying:100", "2:downloading:0"], 2, 0).map((r) => r.p);
+    expect(dwellDelay(check, next, 100, 300)).toBe(VERIFY_DWELL - 200);
+  });
+});
diff --git a/src/mods/progress.ts b/src/mods/progress.ts
new file mode 100644
index 0000000..1316617
--- /dev/null
+++ b/src/mods/progress.ts
@@ -0,0 +1,19 @@
+// What a progress bar shows while the backend moves from file to file. No React: the bar holds
+// the record this says to hold (components/mods/ModProgressBar).
+import type { UiProgress } from "./types";
+
+/** The check of a file stays on screen at least this long, so the player sees it happen. */
+export const VERIFY_DWELL = 400;
+
+/** One file's one step: a new percent of the same step is the same step. */
+export const stepKey = (p: UiProgress | undefined) => (p ? `${p.index}:${p.sha256}:${p.stage}` : "");
+
+/**
+ * How long to keep showing `shown` (on screen since `shownSince`) before `next` replaces it: a
+ * file's check is held for VERIFY_DWELL, everything else gives way at once. The record is replaced
+ * whole, so the number, the name and the step on screen always belong to one file.
+ */
+export function dwellDelay(shown: UiProgress | undefined, next: UiProgress | undefined, shownSince: number, now: number): number {
+  if (!shown || shown.stage !== "verifying" || stepKey(shown) === stepKey(next)) return 0;
+  return Math.max(0, VERIFY_DWELL - (now - shownSince));
+}
diff --git a/src/mods/select.test.ts b/src/mods/select.test.ts
new file mode 100644
index 0000000..4c737b1
--- /dev/null
+++ b/src/mods/select.test.ts
@@ -0,0 +1,171 @@
+import { describe, expect, it } from "vitest";
+import {
+  httpStatus,
+  buildBySha,
+  compareVersions,
+  copyDonors,
+  fittingVersions,
+  installedFor,
+  keepOrder,
+  networkDown,
+  parseRepo,
+  sameRepo,
+  sortInstalled,
+} from "./select";
+import { ABI, OLD_ABI, build, catalog, catalogMod, installed, report } from "./fixtures";
+
+describe("compareVersions", () => {
+  // The vectors of src-tauri/src/mods/version.rs, so both sides order versions the same way.
+  it("orders like the backend's semver_precedence test", () => {
+    const v = ["0.2.0", "0.1.2", "0.2.1-rc.1", "0.2.1", "0.2.1-rc.2", "0.10.0"];
+    v.sort(compareVersions);
+    expect(v).toEqual(["0.1.2", "0.2.0", "0.2.1-rc.1", "0.2.1-rc.2", "0.2.1", "0.10.0"]);
+    expect(compareVersions("v1.0.0", "1.0")).toBe(0);
+  });
+
+  it("ranks a numeric prerelease identifier below an alphanumeric one", () => {
+    // Semver 11.4.3: numeric identifiers always have lower precedence. String order said otherwise.
+    expect(compareVersions("1.0.0-2", "1.0.0-1a")).toBe(-1);
+    expect(compareVersions("1.0.0-1a", "1.0.0-2")).toBe(1);
+  });
+
+  it("follows the semver spec's example chain", () => {
+    const chain = [
+      "1.0.0-alpha",
+      "1.0.0-alpha.1",
+      "1.0.0-alpha.beta",
+      "1.0.0-beta",
+      "1.0.0-beta.2",
+      "1.0.0-beta.11",
+      "1.0.0-rc.1",
+      "1.0.0",
+    ];
+    for (let i = 0; i < chain.length - 1; i++) {
+      expect(compareVersions(chain[i], chain[i + 1]), `${chain[i]} < ${chain[i + 1]}`).toBe(-1);
+      expect(compareVersions(chain[i + 1], chain[i])).toBe(1);
+    }
+  });
+
+  it("ignores build metadata and compares words by ASCII", () => {
+    expect(compareVersions("1.0.0+abc", "1.0.0+xyz")).toBe(0);
+    expect(compareVersions("0.1.2-experimental.4563878.917596d", "0.1.2-experimental.4563878.a")).toBe(-1);
+    expect(compareVersions("1.0.0-Beta", "1.0.0-alpha")).toBe(-1);
+  });
+});
+
+describe("fittingVersions", () => {
+  const mod = catalogMod("cogwork", [
+    build("0.1.0", { abi: OLD_ABI }),
+    build("0.2.0"),
+    build("0.2.1-rc.1", { channel: "prerelease" }),
+    build("0.3.0", { platforms: ["windows-x64"] }),
+    build("0.2.5"),
+  ]);
+
+  it("keeps builds for this interface and system, best first", () => {
+    const c = catalog([mod]);
+    expect(fittingVersions(c, mod, ABI, false).map((v) => v.version)).toEqual(["0.2.5", "0.2.0"]);
+    expect(fittingVersions(c, mod, ABI, true).map((v) => v.version)).toEqual(["0.2.5", "0.2.1-rc.1", "0.2.0"]);
+  });
+
+  it("drops revoked builds and offers nothing without a known interface", () => {
+    const c = catalog([mod], { revoked: [{ sha256: build("0.2.5").sha256, reason: "bad" }] });
+    expect(fittingVersions(c, mod, ABI, false).map((v) => v.version)).toEqual(["0.2.0"]);
+    expect(fittingVersions(c, mod, null, true)).toEqual([]);
+  });
+});
+
+describe("repos", () => {
+  it("compare without case, like GitHub", () => {
+    expect(sameRepo("Lantern-Dev/Lanterns", "lantern-dev/lanterns")).toBe(true);
+    expect(sameRepo("a/b", "a/c")).toBe(false);
+    const source = catalogMod("lanterns", [], { origin: { kind: "source", repo: "Lantern-Dev/Lanterns" } });
+    const mine = installed("lanterns", { origin: { kind: "source", repo: "lantern-dev/lanterns" } });
+    expect(installedFor(source, [mine])).toBe(mine);
+  });
+
+  it("parse what the backend accepts", () => {
+    expect(parseRepo("lantern-dev/lanterns")).toBe("lantern-dev/lanterns");
+    expect(parseRepo("https://github.com/lantern-dev/lanterns.git/")).toBe("lantern-dev/lanterns");
+    expect(parseRepo("github.com/a/b")).toBe("a/b");
+    expect(parseRepo("not a repo")).toBeNull();
+    expect(parseRepo("a/b/c")).toBeNull();
+    expect(parseRepo("../x")).toBeNull();
+    expect(parseRepo("a/..")).toBeNull();
+  });
+});
+
+describe("installed order", () => {
+  const mods = [
+    installed("b", { enabled: false, status: "off" }),
+    installed("a"),
+    installed("c", { status: "wrongVersion" }),
+  ];
+
+  it("puts problems first, then on, then off", () => {
+    expect(sortInstalled(mods)).toEqual(["c", "a", "b"]);
+  });
+
+  it("keeps rows in place after a toggle and adds new ones after", () => {
+    const toggled = mods.map((m) => (m.id === "a" ? { ...m, enabled: false, status: "off" as const } : m));
+    expect(keepOrder(["c", "a", "b"], toggled)).toEqual(["c", "a", "b"]);
+    expect(keepOrder(["c", "a", "b"], [...toggled.filter((m) => m.id !== "c"), installed("d")])).toEqual(["a", "b", "d"]);
+  });
+});
+
+describe("copyDonors", () => {
+  it("lists other versions that have mods", () => {
+    const profiles = { v3: report([installed("a")]), v2: report([]), v1: report([installed("b")]) };
+    expect(copyDonors(["v3", "v2", "v1"], "v3", profiles)).toEqual(["v1"]);
+    expect(copyDonors(["v3", "v2", "v1"], "v2", profiles)).toEqual(["v3", "v1"]);
+  });
+});
+
+describe("networkDown", () => {
+  const net = { code: "Network", detail: "offline" } as const;
+  const fresh = { repo: "a/b", mods: 1, freshness: "fresh", checked: "2026-11-04T00:00:00Z", error: null, noMods: null } as const;
+  const offline = { ...fresh, freshness: "cached", error: net } as const;
+  const indexDown = { freshness: "unavailable", generated: null, signedAt: null, error: net, cacheError: null } as const;
+
+  it("is down when the catalogue itself couldn't be fetched for want of a connection", () => {
+    expect(networkDown(null, net)).toBe(true);
+    expect(networkDown(null, { code: "Io" })).toBe(false);
+  });
+
+  it("is down when every origin failed with Network", () => {
+    expect(networkDown(catalog([], { index: indexDown, sources: [offline] }), null)).toBe(true);
+    expect(networkDown(catalog([], { index: indexDown }), null)).toBe(true);
+  });
+
+  it("is not down when only the index is unreachable and a source answered", () => {
+    expect(networkDown(catalog([], { index: indexDown, sources: [fresh] }), null)).toBe(false);
+  });
+
+  it("is not down when a failing source got a reply (a rate limit is an answer)", () => {
+    const limited = { ...fresh, freshness: "cached", error: { code: "ModSourceRateLimited", detail: null } } as const;
+    expect(networkDown(catalog([], { index: indexDown, sources: [limited] }), null)).toBe(false);
+  });
+
+  it("is not down when the index answered and only a source lost its connection", () => {
+    expect(networkDown(catalog([], { sources: [offline] }), null)).toBe(false);
+  });
+});
+
+describe("httpStatus", () => {
+  it("reads the status the backend puts first in an HttpStatus detail", () => {
+    expect(httpStatus({ code: "HttpStatus", detail: "HTTP 404 (https://example.org/index.json)" })).toBe("404");
+    expect(httpStatus({ code: "HttpStatus", detail: null })).toBeNull();
+    expect(httpStatus({ code: "Network", detail: "HTTP 404 (x)" })).toBeNull();
+    expect(httpStatus(null)).toBeNull();
+  });
+});
+
+describe("buildBySha", () => {
+  it("finds a mod's catalogue build by hash, and nothing for another mod's", () => {
+    const v = build("0.2.0");
+    const c = catalog([catalogMod("cogwork", [build("0.1.0"), v])]);
+    expect(buildBySha(c, "cogwork", v.sha256)).toBe(v);
+    expect(buildBySha(c, "hearth", v.sha256)).toBeUndefined();
+    expect(buildBySha(null, "cogwork", v.sha256)).toBeUndefined();
+  });
+});
diff --git a/src/mods/select.ts b/src/mods/select.ts
new file mode 100644
index 0000000..463297e
--- /dev/null
+++ b/src/mods/select.ts
@@ -0,0 +1,227 @@
+// Pure choices over catalogue and profile data, shared by the pages, the mock backend and the tests.
+
+import type { Catalog, CatalogMod, CatalogVersion, Channel, InstalledMod, Origin, ProfileReport } from "./types";
+
+const RANK: Record<Channel, number> = { release: 0, prerelease: 1, experimental: 2 };
+
+function parts(v: string): [number[], string | null] {
+  const clean = v.replace(/^v/, "").split("+")[0];
+  const dash = clean.indexOf("-");
+  const core = dash < 0 ? clean : clean.slice(0, dash);
+  const pre = dash < 0 ? null : clean.slice(dash + 1);
+  return [core.split(".").map((n) => (/^\d+$/.test(n) ? Number(n) : 0)), pre];
+}
+
+const NUMERIC = /^\d+$/;
+
+/** Prerelease identifiers: numbers by value and below words, words by ASCII order. */
+function comparePre(a: string, b: string): number {
+  const as = a.split(".");
+  const bs = b.split(".");
+  for (let i = 0; i < Math.max(as.length, bs.length); i++) {
+    const x = as[i];
+    const y = bs[i];
+    if (x === undefined) return -1;
+    if (y === undefined) return 1;
+    const xn = NUMERIC.test(x);
+    const yn = NUMERIC.test(y);
+    let d: number;
+    if (xn && yn) d = Number(x) - Number(y);
+    else if (xn) d = -1;
+    else if (yn) d = 1;
+    else d = x < y ? -1 : x > y ? 1 : 0;
+    if (d !== 0) return Math.sign(d);
+  }
+  return 0;
+}
+
+/** Semver precedence, exactly like the backend's `mods::version::compare`. */
+export function compareVersions(a: string, b: string): number {
+  const [an, ap] = parts(a);
+  const [bn, bp] = parts(b);
+  for (let i = 0; i < Math.max(an.length, bn.length); i++) {
+    const d = (an[i] ?? 0) - (bn[i] ?? 0);
+    if (d !== 0) return Math.sign(d);
+  }
+  if (ap === null && bp === null) return 0;
+  if (ap === null) return 1;
+  if (bp === null) return -1;
+  return comparePre(ap, bp);
+}
+
+export function sameRepo(a: string | null | undefined, b: string | null | undefined): boolean {
+  return !!a && !!b && a.toLowerCase() === b.toLowerCase();
+}
+
+export function revocation(catalog: Catalog | null, sha256: string): string | null {
+  const s = sha256.toLowerCase();
+  return catalog?.revoked.find((r) => r.sha256.toLowerCase() === s)?.reason ?? null;
+}
+
+export function isRevoked(catalog: Catalog | null, sha256: string): boolean {
+  return revocation(catalog, sha256) !== null;
+}
+
+/** Versions that would load into a game with `abi` on this system, best first. */
+export function fittingVersions(
+  catalog: Catalog | null,
+  mod: CatalogMod,
+  abi: string | null,
+  allowPrerelease: boolean
+): CatalogVersion[] {
+  return mod.versions
+    .filter((v) => abi !== null && v.abi === abi)
+    .filter((v) => catalog === null || (v.platforms as string[]).includes(catalog.platform))
+    .filter((v) => allowPrerelease || v.channel === "release")
+    .filter((v) => !isRevoked(catalog, v.sha256))
+    .sort((a, b) => compareVersions(b.version, a.version) || RANK[a.channel] - RANK[b.channel]);
+}
+
+function sameOrigin(a: Origin, b: Origin): boolean {
+  if (a.kind === "index") return b.kind === "index";
+  if (a.kind === "source") return b.kind === "source" && sameRepo(a.repo, b.repo);
+  return false;
+}
+
+/** The installed mod a catalogue entry describes, if any. */
+export function installedFor(mod: CatalogMod, installed: InstalledMod[]): InstalledMod | undefined {
+  return installed.find((m) => m.id === mod.id && sameOrigin(mod.origin, m.origin));
+}
+
+/** The catalogue entry an installed mod came from, if the catalogue still has it. */
+export function catalogModFor(catalog: Catalog | null, mod: InstalledMod): CatalogMod | undefined {
+  return catalog?.mods.find((c) => c.id === mod.id && sameOrigin(c.origin, mod.origin));
+}
+
+/** A mod's display name: from the profile, then the catalogue, then its id. */
+export function modName(id: string, report: ProfileReport | undefined, catalog: Catalog | null): string {
+  return report?.mods.find((m) => m.id === id)?.name ?? catalog?.mods.find((m) => m.id === id)?.name ?? id;
+}
+
+export function matchesSearch(mod: CatalogMod, query: string): boolean {
+  const q = query.trim().toLowerCase();
+  if (!q) return true;
+  return [mod.name, mod.id, mod.summary, ...mod.authors].some((s) => s.toLowerCase().includes(q));
+}
+
+/** Problems first, then what's on, then what's off: what needs a look is on top. */
+function installedRank(m: InstalledMod): number {
+  if (m.status === "wrongVersion" || m.status === "missingDeps") return 0;
+  if (m.status === "revoked") return 1;
+  return m.enabled ? 2 : 3;
+}
+
+/** Ids in display order. Called on load and on a version change, not after every toggle. */
+export function sortInstalled(mods: InstalledMod[]): string[] {
+  return [...mods]
+    .sort((a, b) => installedRank(a) - installedRank(b) || a.name.localeCompare(b.name))
+    .map((m) => m.id);
+}
+
+/**
+ * Keeps an earlier order stable: ids still present keep their place, new ones follow in sorted
+ * order. So a row never jumps away from the pointer or from focus.
+ */
+export function keepOrder(previous: string[], mods: InstalledMod[]): string[] {
+  const present = new Set(mods.map((m) => m.id));
+  const kept = previous.filter((id) => present.has(id));
+  const known = new Set(kept);
+  const added = sortInstalled(mods.filter((m) => !known.has(m.id)));
+  return [...kept, ...added];
+}
+
+/** Other versions with mods turned on, which is what a copy brings over; newest first as given. */
+export function copyDonors(tags: string[], to: string, profiles: Record<string, ProfileReport | undefined>): string[] {
+  return tags.filter((t) => t !== to && (profiles[t]?.mods.some((m) => m.enabled) ?? false));
+}
+
+/** The catalogue build of mod `id` with this hash: where a copied build's evidence comes from. */
+export function buildBySha(catalog: Catalog | null, id: string, sha256: string): CatalogVersion | undefined {
+  for (const m of catalog?.mods ?? []) {
+    if (m.id !== id) continue;
+    const v = m.versions.find((x) => x.sha256 === sha256);
+    if (v) return v;
+  }
+  return undefined;
+}
+
+/**
+ * The status a server answered with, for an `HttpStatus` error: its detail starts "HTTP 404"
+ * (src-tauri/src/mods/error.rs keeps it so). Null for any other error.
+ */
+export function httpStatus(error: { code: string; detail: string | null } | null | undefined): string | null {
+  if (error?.code !== "HttpStatus") return null;
+  return /^HTTP (\d{3})\b/.exec(error.detail ?? "")?.[1] ?? null;
+}
+
+export function shortSha(sha: string): string {
+  return `${sha.slice(0, 8)}…${sha.slice(-4)}`;
+}
+
+export function shortCommit(commit: string | null | undefined): string {
+  return (commit ?? "").slice(0, 7);
+}
+
+/** A link to the exact source a version was built from. */
+export function sourceUrl(v: { sourceRepo: string | null; sourceCommit: string | null }): string | null {
+  if (!v.sourceRepo) return null;
+  return v.sourceCommit
+    ? `https://github.com/${v.sourceRepo}/tree/${v.sourceCommit}`
+    : `https://github.com/${v.sourceRepo}`;
+}
+
+/** `owner/repo` from what a player typed, or null: the backend's `sources::normalize` and `is_repo`. */
+export function parseRepo(input: string): string | null {
+  let s = input.trim().replace(/\/+$/, "");
+  if (s.endsWith(".git")) s = s.slice(0, -4);
+  for (const prefix of ["https://github.com/", "http://github.com/", "github.com/"]) {
+    if (s.startsWith(prefix)) {
+      s = s.slice(prefix.length);
+      break;
+    }
+  }
+  const halves = s.split("/");
+  const part = (p: string) => p.length > 0 && p.length <= 100 && p !== "." && p !== ".." && /^[A-Za-z0-9._-]+$/.test(p);
+  return halves.length === 2 && part(halves[0]) && part(halves[1]) ? s : null;
+}
+
+/**
+ * Whether the network was down at the last look, so a download would fail for want of a
+ * connection. True when the catalogue couldn't be refreshed for that reason, or when an origin
+ * failed with `Network` and no origin got an answer at all.
+ *
+ * One origin failing is not the network failing: when a source just answered (or failed with a
+ * reply, like a rate limit), the index being unreachable is the index host's trouble, and builds
+ * still download from GitHub. Install buttons then don't claim to need internet.
+ */
+export function networkDown(catalog: Catalog | null, catalogError: { code: string } | null): boolean {
+  if (catalogError?.code === "Network") return true;
+  if (!catalog) return false;
+  const origins = [catalog.index.error, ...catalog.sources.map((s) => s.error)];
+  const lostConnection = origins.some((e) => e?.code === "Network");
+  const answered = origins.some((e) => !e || e.code !== "Network");
+  return lostConnection && !answered;
+}
+
+/**
+ * Where a mod's icon may come from: GitHub's hosts for repository files and images, and GitHub
+ * Pages. The backend's `download::icon_url_allowed`, checked against the same cases
+ * (`rules.json` iconHosts). Any other icon isn't asked for: the mod shows its pattern instead.
+ */
+export function iconUrlAllowed(raw: string): boolean {
+  let url: URL;
+  try {
+    url = new URL(raw);
+  } catch {
+    return false;
+  }
+  const host = url.hostname;
+  const page = host.endsWith(".github.io") ? host.slice(0, -".github.io".length) : null;
+  return (
+    url.protocol === "https:" &&
+    url.port === "" &&
+    url.username === "" &&
+    url.password === "" &&
+    (["github.com", "raw.githubusercontent.com", "user-images.githubusercontent.com"].includes(host) || (!!page && !page.includes(".")))
+  );
+}
diff --git a/src/mods/status.test.ts b/src/mods/status.test.ts
new file mode 100644
index 0000000..1d8c70e
--- /dev/null
+++ b/src/mods/status.test.ts
@@ -0,0 +1,372 @@
+import { describe, expect, it } from "vitest";
+import {
+  blockers,
+  crashFixes,
+  crashResolved,
+  describeChange,
+  describeCopy,
+  describeRemove,
+  describeToggle,
+  failureTitle,
+  heroState,
+  modMeta,
+  snapshotFor,
+  turnOnWarnings,
+} from "./status";
+import { build, catalog, catalogMod, installed, report } from "./fixtures";
+import type { ChangeResult } from "./types";
+import type { FailureKind, ModFailure, ModStatus } from "./types";
+
+const name = (id: string) => id.toUpperCase();
+
+describe("modMeta", () => {
+  it("has a line for every status", () => {
+    const statuses: ModStatus[] = ["ready", "off", "wrongVersion", "missingDeps", "revoked", "unchecked"];
+    for (const status of statuses) {
+      const meta = modMeta(installed("a", { status, missingDeps: ["b"] }), "v26.11.1", name);
+      expect(meta.parts.length).toBeGreaterThan(0);
+      expect(meta.bad).toBe(status === "wrongVersion" || status === "missingDeps" || status === "revoked");
+    }
+  });
+
+  it("tells a dependency that is off from one that isn't installed", () => {
+    const meta = modMeta(installed("a", { status: "missingDeps", missingDeps: ["b", "c", "d"], depsNotInstalled: ["d"] }), "v", name);
+    expect(meta.parts).toEqual([
+      { key: "mods.statusDepsOff", count: 2, args: ["B and C"] },
+      { key: "mods.statusDepsNotInstalled", count: 1, args: ["D"] },
+    ]);
+  });
+
+  it("says a dependency has no build when the catalogue has none for this version", () => {
+    const railways = installed("railways", { status: "missingDeps", missingDeps: ["signals"], depsNotInstalled: ["signals"] });
+    const r = report([railways]);
+    const [b] = blockers(r, name, catalog([catalogMod("signals", [build("0.1.0", { abi: "other" })])]));
+    expect(b.reasons).toEqual([{ key: "mods.blockLineDepsNoBuild", count: 1, args: [b.mod.name, "SIGNALS", "v26.11.1"] }]);
+    expect(b.fixes.map((f) => f.kind)).toEqual(["turnOff"]);
+  });
+
+  it("keeps the index's reason apart from its own sentence", () => {
+    const meta = modMeta(installed("a", { status: "revoked", revokedReason: "Corrupts worlds. " }), "v", name);
+    expect(meta.parts[0]).toEqual({ key: "mods.statusRevoked", args: ["Corrupts worlds."] });
+  });
+});
+
+describe("blockers", () => {
+  it("offers the fitting update and turning the mod off", () => {
+    const r = report([
+      installed("lanterns", { status: "wrongVersion", weftTag: "v26.10.4", update: { version: "1.1.0", sha256: "u".repeat(64), channel: "release", trust: "unreviewed" } }),
+    ]);
+    const [b] = blockers(r, name);
+    expect(b.fixes.map((f) => f.kind)).toEqual(["update", "turnOff"]);
+    expect(b.fixes[0]).toMatchObject({ version: "1.1.0" });
+    expect(b.reasons).toEqual([{ key: "mods.blockLineWrongVersionTag", args: [b.mod.name, "v26.10.4"] }]);
+  });
+
+  it("offers turning on an installed dependency that is off, and installing one that has a build", () => {
+    const r = report([
+      installed("hearth", { status: "missingDeps", missingDeps: ["cogwork", "signals"], depsNotInstalled: ["signals"] }),
+      installed("cogwork", { enabled: false, status: "off" }),
+    ]);
+    const signals = catalogMod("signals", [build("0.1.0")]);
+    const [b] = blockers(r, name, catalog([signals]));
+    expect(b.fixes).toEqual([
+      { kind: "turnOn", id: "cogwork", name: "Cogwork" },
+      { kind: "install", id: "signals", name: "Signals", mod: signals, sha256: signals.versions[0].sha256 },
+      { kind: "turnOff", id: "hearth", name: "Hearth" },
+    ]);
+    expect(b.reasons.map((m) => m.key)).toEqual(["mods.blockLineDepsOff", "mods.blockLineDepsNotInstalled"]);
+  });
+
+  it("never offers turning on a revoked dependency", () => {
+    const r = report([
+      installed("hearth", { status: "missingDeps", missingDeps: ["cogwork"] }),
+      installed("cogwork", { enabled: false, status: "revoked", revokedReason: "bad" }),
+    ]);
+    const [b] = blockers(r, name);
+    expect(b.fixes.map((f) => f.kind)).toEqual(["turnOff"]);
+    expect(b.reasons[0].key).toBe("mods.blockLineDepsRevoked");
+  });
+
+  it("is empty without a report or blockers", () => {
+    expect(blockers(undefined, name)).toEqual([]);
+    expect(blockers(report([installed("a")]), name)).toEqual([]);
+  });
+});
+
+describe("turning a mod on", () => {
+  const off = (id: string, extra = {}) => installed(id, { enabled: false, status: "off", ...extra });
+
+  it("warns when a dependency it needs has no build, through the chain it turns on", () => {
+    // Junctions needs Railways (installed, off), which needs Signals (not installed).
+    const r = report([off("junctions", { deps: ["base", "railways"] }), off("railways", { deps: ["base", "signals"] })]);
+    const lines = turnOnWarnings(r, "junctions", name, catalog([]));
+    expect(lines).toEqual([{ key: "mods.blockLineDepsNoBuild", count: 1, args: ["Railways", "SIGNALS", "v26.11.1"] }]);
+  });
+
+  it("says a dependency that has a fitting build isn't installed, so it can be", () => {
+    const r = report([off("railways", { deps: ["base", "signals"] })]);
+    const signals = catalogMod("signals", [build("0.1.0")]);
+    const [line] = turnOnWarnings(r, "railways", name, catalog([signals]));
+    expect(line.key).toBe("mods.blockLineDepsNotInstalled");
+  });
+
+  it("warns when it, or a mod it turns on, is built for another version", () => {
+    const r = report([off("old", { abi: "0000000000000000", weftTag: "v26.10.4" })]);
+    expect(turnOnWarnings(r, "old", name, null)).toEqual([{ key: "mods.blockLineWrongVersionTag", args: ["Old", "v26.10.4"] }]);
+  });
+
+  it("warns about a revoked dependency, which stays off", () => {
+    const r = report([off("hearth", { deps: ["base", "cogwork"] }), installed("cogwork", { enabled: false, status: "revoked", revokedReason: "bad" })]);
+    expect(turnOnWarnings(r, "hearth", name, null).map((m) => m.key)).toEqual(["mods.blockLineDepsRevoked"]);
+  });
+
+  it("says nothing when everything it needs is installed and turns on with it", () => {
+    const r = report([off("hearth", { deps: ["base", "cogwork"] }), off("cogwork")]);
+    expect(turnOnWarnings(r, "hearth", name, null)).toEqual([]);
+    expect(turnOnWarnings(r, "cogwork", name, null)).toEqual([]);
+  });
+});
+
+describe("heroState", () => {
+  it("reads blocked only when something blocks and the game isn't running", () => {
+    const blocked = report([installed("a", { status: "wrongVersion" })]);
+    expect(heroState(blocked, false)).toBe("blocked");
+    expect(heroState(blocked, true)).toBe("playing");
+    expect(heroState(report([]), false)).toBe("ready");
+    // Not read yet, or not readable: never "ready".
+    expect(heroState(undefined, false)).toBe("checking");
+    expect(heroState(undefined, false, true)).toBe("unchecked");
+  });
+});
+
+describe("crash notices", () => {
+  const failure: ModFailure = { kind: "loadFailed", modId: "structures", line: "x" };
+  const before = report([installed("structures")]);
+  const snap = snapshotFor(failure, before);
+
+  it("stay while the blamed mod is unchanged", () => {
+    expect(crashResolved(snap, before)).toBe(false);
+  });
+
+  it("go once the mod is off, removed or replaced", () => {
+    expect(crashResolved(snap, report([installed("structures", { enabled: false, status: "off" })]))).toBe(true);
+    expect(crashResolved(snap, report([]))).toBe(true);
+    expect(crashResolved(snap, report([installed("structures", { sha256: "n".repeat(64) })]))).toBe(true);
+  });
+
+  it("stay while a copy in the player's own folder can still load in its place", () => {
+    const shadowed = { unmanaged: ["structures-old.zip"], shadowed: [{ id: "structures", file: "structures-old.zip", managed: "on" as const }] };
+    const at = report([installed("structures")], shadowed);
+    const snap = snapshotFor(failure, at);
+    expect(snap?.shadowFile).toBe("structures-old.zip");
+    // Off or removed: the player's copy loads now. Still there, so the warning stays.
+    const off = report([installed("structures", { enabled: false, status: "off" })], { unmanaged: ["structures-old.zip"], shadowed: [{ id: "structures", file: "structures-old.zip", managed: "off" }] });
+    expect(crashResolved(snap, off)).toBe(false);
+    expect(crashResolved(snap, report([], { unmanaged: ["structures-old.zip"] }))).toBe(false);
+    // Replaced by a build that is on: that one loads instead of the player's copy.
+    expect(crashResolved(snap, report([installed("structures", { sha256: "n".repeat(64) })], shadowed))).toBe(true);
+    // The file is gone: as for any crash.
+    expect(crashResolved(snap, report([installed("structures", { enabled: false, status: "off" })]))).toBe(true);
+    expect(crashResolved(snap, report([installed("structures")]))).toBe(false);
+  });
+
+  it("go with the player's copy that crashed while the launcher's was off", () => {
+    const off = { unmanaged: ["structures-old.zip"], shadowed: [{ id: "structures", file: "structures-old.zip", managed: "off" as const }] };
+    const snap = snapshotFor(failure, report([installed("structures", { enabled: false, status: "off" })], off));
+    expect(crashResolved(snap, report([installed("structures", { enabled: false, status: "off" })], off))).toBe(false);
+    expect(crashResolved(snap, report([installed("structures", { enabled: false, status: "off" })]))).toBe(true);
+  });
+
+  it("never go on their own when no managed mod is blamed", () => {
+    expect(snapshotFor({ ...failure, modId: "oldtweak" }, before)).toBeNull();
+    expect(crashResolved(null, report([]))).toBe(false);
+  });
+
+  it("have a title for every failure kind", () => {
+    const all: ModFailure[] = [
+      { kind: "wrongVersion", modId: "structures", line: "x" },
+      { kind: "loadFailed", modId: "structures", line: "x" },
+      { kind: "notAMod", modId: "structures", line: "x" },
+      { kind: "wrongName", modId: "structures", crate: "structure", line: "x" },
+      { kind: "missingDep", modId: "structures", dependency: "cogwork", line: "x" },
+      { kind: "initPanicked", modId: "structures", line: "x" },
+    ];
+    const kinds: FailureKind[] = ["wrongVersion", "loadFailed", "notAMod", "wrongName", "missingDep", "initPanicked"];
+    expect(all.map((f) => f.kind)).toEqual(kinds);
+    for (const f of all) expect(failureTitle(f, "Structures", name).key).toMatch(/^mods\.failure/);
+    expect(failureTitle({ ...failure, kind: "initPanicked", modId: null }, "", name)).toEqual({ key: "mods.failureInit" });
+  });
+
+  it("name the missing dependency by its display name", () => {
+    expect(failureTitle({ ...failure, kind: "missingDep", dependency: "cogwork" }, "Structures", name)).toEqual({
+      key: "mods.failureMissingDep",
+      args: ["Structures", "COGWORK"],
+    });
+  });
+
+  it("offer turning on a missing dependency that is off, and no update for it", () => {
+    const r = report([
+      installed("structures", { update: { version: "0.1.3", sha256: "u".repeat(64), channel: "release", trust: "reviewed" } }),
+      installed("cogwork", { enabled: false, status: "off" }),
+    ]);
+    const fixes = crashFixes({ ...failure, kind: "missingDep", dependency: "cogwork" }, r, null);
+    expect(fixes.map((f) => f.kind)).toEqual(["turnOn", "turnOff"]);
+    // A library that didn't load: turning it off surely helps, so it leads; the update is a try.
+    const loadFixes = crashFixes(failure, r, null);
+    expect(loadFixes.map((f) => f.kind)).toEqual(["turnOff", "update"]);
+    expect(loadFixes[1]).toMatchObject({ kind: "update", tentative: true });
+    // A build for another version: the update is the fix, and leads.
+    expect(crashFixes({ ...failure, kind: "wrongVersion" }, r, null)).toMatchObject([{ kind: "update", tentative: false }, { kind: "turnOff" }]);
+  });
+
+  it("offer another file for a mod from the player's computer, where a build would be the fix", () => {
+    const mine = installed("structures", { origin: { kind: "file", name: "structures.zip" }, trust: "unverified" });
+    const r = report([mine]);
+    // Built for another version, or named wrong: another file is the fix, and leads.
+    expect(crashFixes({ ...failure, kind: "wrongVersion" }, r, null).map((f) => f.kind)).toEqual(["replaceFile", "turnOff"]);
+    expect(crashFixes({ kind: "wrongName", modId: "structures", crate: "x", line: "x" }, r, null).map((f) => f.kind)).toEqual(["replaceFile", "turnOff"]);
+    // A library that didn't load: turning it off surely helps; another file is a try.
+    expect(crashFixes(failure, r, null).map((f) => f.kind)).toEqual(["turnOff", "replaceFile"]);
+    // What it needs is missing: another file of it doesn't help.
+    expect(crashFixes({ ...failure, kind: "missingDep", dependency: "cogwork" }, r, null).map((f) => f.kind)).not.toContain("replaceFile");
+    // A catalogued mod gets its update, never a file.
+    expect(crashFixes({ ...failure, kind: "wrongVersion" }, report([installed("structures")]), null).map((f) => f.kind)).toEqual(["turnOff"]);
+  });
+
+  it("offer installing a missing dependency the catalogue has", () => {
+    const cogwork = catalogMod("cogwork", [build("0.2.0")]);
+    const fixes = crashFixes({ ...failure, kind: "missingDep", dependency: "cogwork" }, report([installed("structures")]), catalog([cogwork]));
+    expect(fixes[0]).toMatchObject({ kind: "install", id: "cogwork", sha256: cogwork.versions[0].sha256 });
+  });
+});
+
+const change = (extra: Partial<ChangeResult> = {}): ChangeResult => ({
+  report: report([]),
+  installed: [],
+  alsoEnabled: [],
+  alsoDisabled: [],
+  missing: [],
+  installedOff: [],
+  undo: null,
+  ...extra,
+});
+
+describe("result notices", () => {
+  const T = "v26.11.1";
+
+  it("name mods, never ids, and join them as the language does", () => {
+    const r = report([installed("hearth"), installed("cogwork")]);
+    const text = describeChange(change({ report: r, installed: ["hearth", "cogwork"], alsoDisabled: ["rails", "carts"], missing: ["signals"] }), "hearth", T, name)!;
+    expect(text.tone).toBe("warn");
+    expect(text.lines).toEqual([
+      { key: "mods.noticeInstalled", args: ["HEARTH", T] },
+      { key: "mods.noticeDepsInstalled", args: ["COGWORK"] },
+      { key: "mods.noticeAlsoDisabled", args: ["RAILS and CARTS"] },
+      { key: "mods.noticeMissing", count: 1, args: ["SIGNALS", T] },
+    ]);
+  });
+
+  it("say a mod with a missing dependency was installed turned off, once", () => {
+    const r = report([installed("railways", { enabled: false, status: "off" })]);
+    const text = describeChange(change({ report: r, installed: ["railways"], missing: ["signals"], installedOff: ["railways"] }), "railways", T, name)!;
+    expect(text.lines).toEqual([{ key: "mods.noticeInstalledOffMissing", count: 1, args: ["RAILWAYS", "SIGNALS", T] }]);
+  });
+
+  it("say an update of an off mod left it off", () => {
+    const r = report([installed("hearth", { enabled: false, status: "off" })]);
+    expect(describeChange(change({ report: r, installed: ["hearth"] }), "hearth", T, name)!.lines[0].key).toBe("mods.noticeInstalledOff");
+  });
+
+  it("say what a removal did", () => {
+    const text = describeRemove(change({ alsoDisabled: ["hearth"], undo: "cogwork" }), "cogwork", T, name);
+    expect(text.lines).toEqual([
+      { key: "mods.noticeRemoved", args: ["COGWORK", T] },
+      { key: "mods.noticeAlsoDisabled", args: ["HEARTH"] },
+    ]);
+  });
+
+  it("count copied mods and list what stayed behind or stayed off", () => {
+    const text = describeCopy(
+      {
+        ...change({ installed: ["a", "railways"], installedOff: ["railways"], missing: ["signals"] }),
+        leftBehind: [{ id: "t", name: "My Tweak", outcome: "localFile", version: null, trust: null, sha256: null }],
+      },
+      "v26.10.4",
+      T,
+      name
+    );
+    expect(text.lines).toEqual([
+      { key: "mods.noticeCopied", count: 2, args: ["v26.10.4"] },
+      { key: "mods.noticeCopiedOff", count: 1, args: ["RAILWAYS", T] },
+      { key: "mods.noticeLeftBehind", count: 1, args: ["My Tweak"] },
+      { key: "mods.noticeMissing", count: 1, args: ["SIGNALS", T] },
+    ]);
+  });
+
+  it("say nothing when nothing happened worth saying", () => {
+    expect(describeChange(change(), null, T, name)).toBeNull();
+  });
+});
+
+describe("contract R4: shadowing, reasons and recovery", () => {
+  it("a revoked mod with a copy in the player's folder blocks, and the fix is that folder", () => {
+    const r = report([installed("cogwork", { status: "revoked", enabled: false, revokedReason: "Corrupts worlds." })], {
+      blocking: ["cogwork"],
+      blockingReasons: { cogwork: "shadowedRevoked" },
+      shadowed: [{ id: "cogwork", file: "cogwork-old.zip", managed: "revoked" }],
+    });
+    const [b] = blockers(r, name);
+    expect(b.reasons).toEqual([{ key: "mods.blockLineShadowedRevoked", args: ["Cogwork", "cogwork-old.zip"] }]);
+    expect(b.quote).toEqual({ key: "mods.indexSays", args: ["Corrupts worlds."] });
+    expect(b.fixes.map((f) => f.kind)).toEqual(["showFolder"]);
+    // Turning it off can't help: it is off already.
+    expect(b.fixes.some((f) => f.kind === "turnOff")).toBe(false);
+  });
+
+  it("the row says a copy in the player's folder loads instead", () => {
+    const m = installed("showcase", { status: "off", enabled: false });
+    const meta = modMeta(m, "v26.11.1", name, undefined, { id: "showcase", file: "tweak.zip", managed: "off" });
+    expect(meta.shadowed).toBe(true);
+    expect(meta.parts[meta.parts.length - 1]).toEqual({ key: "mods.shadowOffRow", args: ["tweak.zip"] });
+    expect(meta.bad).toBe(false);
+    const on = modMeta(installed("fine"), "v26.11.1", name, undefined, { id: "fine", file: "f.zip", managed: "on" });
+    expect(on.shadowed).toBe(false);
+  });
+
+  it("uses the backend's reason for the wording", () => {
+    const r = report([installed("old", { status: "wrongVersion", weftTag: "v26.10.4" })], { blockingReasons: { old: "wrongVersion" } });
+    expect(blockers(r, name)[0].reasons[0]).toEqual({ key: "mods.blockLineWrongVersionTag", args: [blockers(r, name)[0].mod.name, "v26.10.4"] });
+  });
+
+  it("a missing-dependency crash clears once that dependency is on and usable", () => {
+    const failure: ModFailure = { kind: "missingDep", modId: "hearth", dependency: "cogwork", line: "x" };
+    const before = report([installed("hearth"), installed("cogwork", { enabled: false, status: "off" })]);
+    const snap = snapshotFor(failure, before);
+    expect(crashResolved(snap, before)).toBe(false);
+    expect(crashResolved(snap, report([installed("hearth"), installed("cogwork", { status: "revoked", revokedReason: "x" })]))).toBe(false);
+    expect(crashResolved(snap, report([installed("hearth"), installed("cogwork")]))).toBe(true);
+  });
+
+  it("a toggle with side effects names what the player did first", () => {
+    const r: ChangeResult = { report: report([]), installed: [], alsoEnabled: [], alsoDisabled: ["hearth"], missing: [], installedOff: [], undo: null };
+    expect(describeToggle(r, "cogwork", false, "v", name)?.lines).toEqual([
+      { key: "mods.noticeTurnedOff", args: ["COGWORK"] },
+      { key: "mods.noticeAlsoDisabled", args: ["HEARTH"] },
+    ]);
+    expect(describeToggle({ ...r, alsoDisabled: [] }, "cogwork", false, "v", name)).toBeNull();
+  });
+
+  it("turning off a mod with a copy in the player's folder says that copy loads instead", () => {
+    const shadowed = { ...report([]), shadowed: [{ id: "cogwork", file: "cogwork-old.zip", managed: "off" as const }] };
+    const r: ChangeResult = { report: shadowed, installed: [], alsoEnabled: [], alsoDisabled: [], missing: [], installedOff: [], undo: null };
+    expect(describeToggle(r, "cogwork", false, "v", name)).toEqual({
+      tone: "warn",
+      lines: [
+        { key: "mods.noticeTurnedOff", args: ["COGWORK"] },
+        { key: "mods.noticeShadowLoads", args: ["COGWORK", "cogwork-old.zip"] },
+      ],
+    });
+    expect(describeToggle(r, "cogwork", true, "v", name)).toBeNull();
+  });
+});
+
diff --git a/src/mods/status.ts b/src/mods/status.ts
new file mode 100644
index 0000000..8cb8446
--- /dev/null
+++ b/src/mods/status.ts
@@ -0,0 +1,526 @@
+// What a mod's state means for the player and what fixes it. Pure: messages are keys with
+// arguments, so this is testable without React. Lists of names are joined the way the current
+// language joins them (formatList).
+
+import { formatList, type Msg } from "../i18n";
+import { fittingVersions, sameRepo } from "./select";
+import type {
+  BlockingReason,
+  Catalog,
+  CatalogMod,
+  ChangeResult,
+  CopyResult,
+  FailureKind,
+  InstalledMod,
+  ModFailure,
+  ModStatus,
+  ProfileReport,
+  ShadowedMod,
+} from "./types";
+import { unreachable } from "../utils/never";
+
+export type NameOf = (id: string) => string;
+
+const names = (ids: string[], name: NameOf) => formatList(ids.map(name));
+
+/** Where a dependency that isn't on stands, and so what can be done about it. */
+export type DepState =
+  | { kind: "off"; mod: InstalledMod }
+  | { kind: "revoked"; mod: InstalledMod }
+  | { kind: "notInstalled"; build: { mod: CatalogMod; sha256: string; version: string } | null };
+
+/**
+ * The catalogue build that would install `dep` for a mod that needs it, as the backend's resolver
+ * picks it: the index first, then the same source as the mod; no prerelease for a release.
+ */
+export function dependencyBuild(
+  catalog: Catalog | null,
+  dep: string,
+  neededBy: Pick<InstalledMod, "origin" | "channel">,
+  abi: string | null
+): { mod: CatalogMod; sha256: string; version: string } | null {
+  if (!catalog) return null;
+  const candidates = catalog.mods.filter(
+    (m) =>
+      m.id === dep &&
+      (m.origin.kind === "index" || (m.origin.kind === "source" && neededBy.origin.kind === "source" && sameRepo(m.origin.repo, neededBy.origin.repo)))
+  );
+  candidates.sort((a, b) => Number(a.origin.kind !== "index") - Number(b.origin.kind !== "index"));
+  for (const mod of candidates) {
+    const best = fittingVersions(catalog, mod, abi, (neededBy.channel ?? "release") !== "release")[0];
+    if (best) return { mod, sha256: best.sha256, version: best.version };
+  }
+  return null;
+}
+
+/** Each dependency of `mod` that isn't on, and why. */
+export function depStates(mod: InstalledMod, report: ProfileReport, catalog: Catalog | null): Map<string, DepState> {
+  const out = new Map<string, DepState>();
+  const notInstalled = new Set(mod.depsNotInstalled ?? []);
+  for (const dep of mod.missingDeps) {
+    const have = notInstalled.has(dep) ? undefined : report.mods.find((m) => m.id === dep);
+    if (!have) out.set(dep, { kind: "notInstalled", build: dependencyBuild(catalog, dep, mod, report.versionAbi) });
+    else out.set(dep, { kind: have.status === "revoked" ? "revoked" : "off", mod: have });
+  }
+  return out;
+}
+
+/** "Needs X, which is off." and the other cases, one message per case. */
+export function missingDepsReasons(mod: InstalledMod, tag: string, name: NameOf, states?: Map<string, DepState>): Msg[] {
+  if (!states) {
+    // Without the report around it: what the backend's two lists alone say.
+    const off = mod.missingDeps.filter((d) => !(mod.depsNotInstalled ?? []).includes(d));
+    const gone = mod.depsNotInstalled ?? [];
+    const out: Msg[] = [];
+    if (off.length) out.push({ key: "mods.statusDepsOff", count: off.length, args: [names(off, name)] });
+    if (gone.length) out.push({ key: "mods.statusDepsNotInstalled", count: gone.length, args: [names(gone, name)] });
+    return out;
+  }
+  const by = (k: string, pred: (s: DepState) => boolean) => [...states].filter(([, s]) => s.kind === k && pred(s)).map(([id]) => id);
+  const groups: [string[], Msg["key"]][] = [
+    [by("off", () => true), "mods.statusDepsOff"],
+    [by("revoked", () => true), "mods.statusDepsRevoked"],
+    [by("notInstalled", (s) => s.kind === "notInstalled" && s.build !== null), "mods.statusDepsNotInstalled"],
+    [by("notInstalled", (s) => s.kind === "notInstalled" && s.build === null), "mods.statusDepsNoBuild"],
+  ];
+  return groups
+    .filter(([ids]) => ids.length)
+    .map(([ids, key]) => ({ key, count: ids.length, args: [names(ids, name), tag] }) as Msg);
+}
+
+/** The same groups as `missingDepsReasons`, each as a whole sentence that names the mod that stops Play. */
+const BLOCK_LINE: Record<string, Msg["key"]> = {
+  "mods.statusDepsOff": "mods.blockLineDepsOff",
+  "mods.statusDepsRevoked": "mods.blockLineDepsRevoked",
+  "mods.statusDepsNotInstalled": "mods.blockLineDepsNotInstalled",
+  "mods.statusDepsNoBuild": "mods.blockLineDepsNoBuild",
+};
+
+/** The index's reason for pulling a build, quoted, or that it gave none. */
+export function indexQuote(reason: string | null): Msg {
+  const r = (reason ?? "").trim();
+  return r ? { key: "mods.indexSays", args: [r] } : { key: "mods.indexGaveNoReason" };
+}
+
+/** Why a build was pulled, in the index's words, or that it gave none (in the player's language). */
+export function revokedMsg(reason: string | null): Msg {
+  const r = (reason ?? "").trim();
+  return r ? { key: "mods.statusRevoked", args: [r] } : { key: "mods.statusRevokedNoReason" };
+}
+
+/** The line under a mod's name: what the launcher knows about it, or what is wrong. */
+export function modMeta(
+  mod: InstalledMod,
+  tag: string,
+  name: NameOf,
+  states?: Map<string, DepState>,
+  shadow?: ShadowedMod
+): { parts: Msg[]; bad: boolean; shadowed: boolean } {
+  const base = baseMeta(mod, tag, name, states);
+  // Contract R4 §4: the engine loads the first copy of an id; the player's own copy wins whenever
+  // this one is off or revoked.
+  if (shadow && shadow.managed !== "on") {
+    const revoked = shadow.managed === "revoked";
+    return {
+      parts: [...base.parts, { key: revoked ? "mods.shadowRevokedRow" : "mods.shadowOffRow", args: [shadow.file] }],
+      bad: base.bad || revoked,
+      shadowed: true,
+    };
+  }
+  return { ...base, shadowed: false };
+}
+
+function baseMeta(mod: InstalledMod, tag: string, name: NameOf, states?: Map<string, DepState>): { parts: Msg[]; bad: boolean } {
+  const status: ModStatus = mod.status;
+  switch (status) {
+    case "off":
+      return { parts: [{ key: "mods.statusOff" }], bad: false };
+    case "wrongVersion":
+      return {
+        parts: [mod.weftTag ? { key: "mods.statusWrongVersionTag", args: [mod.weftTag] } : { key: "mods.statusWrongVersion" }],
+        bad: true,
+      };
+    case "missingDeps":
+      return { parts: missingDepsReasons(mod, tag, name, states), bad: true };
+    case "revoked":
+      // The index's reason is its own sentence; ours stands apart from it.
+      return { parts: [revokedMsg(mod.revokedReason)], bad: true };
+    case "unchecked":
+      return {
+        parts: [
+          mod.origin.kind === "file"
+            ? { key: "mods.statusUncheckedFile", args: [mod.origin.name] }
+            : { key: "mods.statusUnchecked" },
+        ],
+        bad: false,
+      };
+    case "ready": {
+      const parts: Msg[] = [mod.weftTag ? { key: "mods.metaBuiltFor", args: [mod.weftTag] } : { key: "mods.metaBuiltForThis", args: [tag] }];
+      if (mod.origin.kind === "source") parts.push({ key: "mods.metaFromSource", args: [mod.origin.repo] });
+      const deps = mod.deps.filter((d) => d !== "base");
+      if (deps.length) parts.push({ key: "mods.metaNeeds", args: [names(deps, name)] });
+      return { parts, bad: false };
+    }
+    default:
+      return unreachable(status);
+  }
+}
+
+/** A one-click fix for a mod that stops the game. `install` and `update` open the review dialog. */
+export type Fix =
+  | { kind: "turnOff"; id: string; name: string }
+  /** A copy in the player's own folder loads instead of a revoked mod: only the player can remove it. */
+  | { kind: "showFolder"; id: string; name: string; file: string }
+  | { kind: "turnOn"; id: string; name: string }
+  | { kind: "install"; id: string; name: string; mod: CatalogMod; sha256: string }
+  /** `tentative`: nothing says the update fixes this (a library that didn't load); offered as "Try". */
+  | { kind: "update"; id: string; name: string; version: string; sha256: string; tentative?: boolean }
+  /** A mod from the player's computer: no newer build to fetch, but another file can replace it. */
+  | { kind: "replaceFile"; id: string; name: string };
+
+/** What gets each dependency that isn't on back on, where something can. */
+function depFixes(states: Map<string, DepState>): Fix[] {
+  const fixes: Fix[] = [];
+  for (const [id, s] of states) {
+    if (s.kind === "off") fixes.push({ kind: "turnOn", id, name: s.mod.name });
+    else if (s.kind === "notInstalled" && s.build) fixes.push({ kind: "install", id, name: s.build.mod.name, mod: s.build.mod, sha256: s.build.sha256 });
+  }
+  return fixes;
+}
+
+export interface Blocker {
+  mod: InstalledMod;
+  /** Whole sentences, each naming the mod: "Lanterns stops Play: it was built for v26.10.4." */
+  reasons: Msg[];
+  /**
+   * For a mod pulled from the index: what the index says about it, quoted, in its own words.
+   * Home shows it under the reason; the Mods tab's row says it already, right below the banner.
+   */
+  quote?: Msg;
+  fixes: Fix[];
+}
+
+/**
+ * Why a blocking mod blocks: the backend says (contract R4 §4), for every id in `blocking`. A
+ * blocking id without one is a malformed report, and is said as the most general reason rather
+ * than guessed from the mod's status.
+ */
+export function blockingReason(report: ProfileReport, mod: InstalledMod): BlockingReason {
+  return report.blockingReasons[mod.id] ?? "wrongVersion";
+}
+
+/** The copy of a mod in the player's own folder that the engine would load, if there is one. */
+export function shadowOf(report: ProfileReport | undefined, id: string): ShadowedMod | undefined {
+  return report?.shadowed?.find((s) => s.id === id);
+}
+
+/** Each mod that stops this version from starting, why, and what fixes it. */
+export function blockers(report: ProfileReport | undefined, name: NameOf, catalog: Catalog | null = null): Blocker[] {
+  if (!report) return [];
+  const byId = new Map(report.mods.map((m) => [m.id, m]));
+  return report.blocking.flatMap((id) => {
+    const mod = byId.get(id);
+    if (!mod) return [];
+    const fixes: Fix[] = [];
+    let reasons: Msg[];
+    let quote: Msg | undefined;
+    const why: BlockingReason = blockingReason(report, mod);
+    switch (why) {
+      case "missingDeps": {
+        const states = depStates(mod, report, catalog);
+        // One sentence per kind of trouble, each naming the mod: "Hearth stops Play: it needs
+        // Cogwork, which is off."
+        reasons = missingDepsReasons(mod, report.tag, name, states).map((m) => ({ ...m, key: BLOCK_LINE[m.key], args: [mod.name, ...(m.args ?? [])] }) as Msg);
+        fixes.push(...depFixes(states));
+        break;
+      }
+      case "shadowedRevoked": {
+        // Turning it off can't help: it is off. The player's own copy has to go.
+        const shadow = shadowOf(report, mod.id);
+        reasons = [{ key: "mods.blockLineShadowedRevoked", args: [mod.name, shadow?.file ?? mod.id] }];
+        if (mod.update) fixes.push({ kind: "update", id: mod.id, name: mod.name, version: mod.update.version, sha256: mod.update.sha256 });
+        fixes.push({ kind: "showFolder", id: mod.id, name: mod.name, file: shadow?.file ?? "" });
+        return [{ mod, reasons, fixes, quote: indexQuote(mod.revokedReason) }];
+      }
+      case "revoked":
+        reasons = [{ key: "mods.blockLineRevoked", args: [mod.name] }];
+        quote = indexQuote(mod.revokedReason);
+        break;
+      case "wrongVersion":
+        // Under "won't start", the build is the whole reason.
+        reasons = [mod.weftTag ? { key: "mods.blockLineWrongVersionTag", args: [mod.name, mod.weftTag] } : { key: "mods.blockLineWrongVersion", args: [mod.name] }];
+        break;
+      default:
+        return unreachable(why);
+    }
+    if (mod.update) {
+      fixes.push({ kind: "update", id: mod.id, name: mod.name, version: mod.update.version, sha256: mod.update.sha256 });
+    }
+    if (why === "wrongVersion" && mod.origin.kind === "file") fixes.push({ kind: "replaceFile", id: mod.id, name: mod.name });
+    fixes.push({ kind: "turnOff", id: mod.id, name: mod.name });
+    return [{ mod, reasons, fixes, quote }];
+  });
+}
+
+/** The fixes a crash notice offers, beside Open log and Dismiss. */
+export function crashFixes(failure: ModFailure | null, report: ProfileReport | undefined, catalog: Catalog | null): Fix[] {
+  const mod = failure?.modId ? report?.mods.find((m) => m.id === failure.modId) : undefined;
+  if (!failure || !report) return [];
+  const fixes: Fix[] = [];
+  if (failure.kind === "missingDep") {
+    const { dependency } = failure;
+    const dep = report.mods.find((m) => m.id === dependency);
+    if (dep && !dep.enabled && dep.status !== "revoked") fixes.push({ kind: "turnOn", id: dep.id, name: dep.name });
+    if (!dep) {
+      const build = dependencyBuild(catalog, dependency, mod ?? { origin: { kind: "index" }, channel: "release" }, report.versionAbi);
+      if (build) fixes.push({ kind: "install", id: dependency, name: build.mod.name, mod: build.mod, sha256: build.sha256 });
+    }
+  }
+  // A newer build can fix a build that doesn't load; it can't fix a missing dependency or a file.
+  // For a build for another version it is the fix; for a library that didn't load or crashed it
+  // is only a guess, so turning the mod off, which surely helps, comes first.
+  const sure = failure.kind === "wrongVersion";
+  const guess: FailureKind[] = ["loadFailed", "initPanicked"];
+  const update: Fix | null =
+    mod?.update && (sure || guess.includes(failure.kind))
+      ? { kind: "update", id: mod.id, name: mod.name, version: mod.update.version, sha256: mod.update.sha256, tentative: !sure }
+      : null;
+  // A file from the player's computer has no newer build here; another file is its update.
+  const replaceable: FailureKind[] = ["wrongVersion", "wrongName", ...guess];
+  const replace: Fix | null =
+    !update && mod?.origin.kind === "file" && replaceable.includes(failure.kind) ? { kind: "replaceFile", id: mod.id, name: mod.name } : null;
+  const off: Fix | null = mod?.enabled ? { kind: "turnOff", id: mod.id, name: mod.name } : null;
+  for (const f of sure || failure.kind === "wrongName" ? [update ?? replace, off] : [off, update ?? replace]) if (f) fixes.push(f);
+  return fixes;
+}
+
+/**
+ * What Home says about the selected version. "ready" only once its mods were read and nothing
+ * blocks: before that it is checking them, and when they couldn't be read it says so, never ready.
+ */
+export type HeroState = "ready" | "playing" | "blocked" | "checking" | "unchecked";
+
+export function heroState(report: ProfileReport | undefined, running: boolean, readFailed = false): HeroState {
+  if (running) return "playing";
+  if (!report) return readFailed ? "unchecked" : "checking";
+  return report.blocking.length > 0 ? "blocked" : "ready";
+}
+
+/** What stopped the game, in display names. `name` is the blamed mod's; `nameOf` names the others. */
+export function failureTitle(failure: ModFailure, name: string, nameOf: NameOf): Msg {
+  switch (failure.kind) {
+    case "wrongVersion":
+      return { key: "mods.failureWrongVersion", args: [name] };
+    case "missingDep":
+      return { key: "mods.failureMissingDep", args: [name, nameOf(failure.dependency)] };
+    case "loadFailed":
+      return { key: "mods.failureLoad", args: [name] };
+    case "notAMod":
+      return { key: "mods.failureNotAMod", args: [name] };
+    case "wrongName":
+      return { key: "mods.failureWrongName", args: [name] };
+    case "initPanicked":
+      return failure.modId ? { key: "mods.failureInitNamed", args: [name] } : { key: "mods.failureInit" };
+    default:
+      return unreachable(failure);
+  }
+}
+
+/** The mod a crash blames, as it was when the game stopped, and what kind of failure it was. */
+export interface CrashSnapshot {
+  id: string;
+  sha256: string;
+  enabled: boolean;
+  kind: FailureKind;
+  /** For `missingDep`: the mod it lacked. */
+  dependency: string | null;
+  /**
+   * A copy of the mod in the player's own folder at the time (contract R4 §4): it loads whenever
+   * the launcher's copy doesn't, so it may be what crashed.
+   */
+  shadowFile: string | null;
+}
+
+export function snapshotFor(failure: ModFailure | null, report: ProfileReport | undefined): CrashSnapshot | null {
+  const mod = failure?.modId ? report?.mods.find((m) => m.id === failure.modId) : undefined;
+  if (!mod || !failure) return null;
+  return {
+    id: mod.id,
+    sha256: mod.sha256,
+    enabled: mod.enabled,
+    kind: failure.kind,
+    dependency: failure.kind === "missingDep" ? failure.dependency : null,
+    shadowFile: shadowOf(report, mod.id)?.file ?? null,
+  };
+}
+
+/** The player's own copy a crash snapshot names, while it is still in their folder. */
+export function shadowStillThere(snapshot: CrashSnapshot | null, report: ProfileReport | undefined): string | null {
+  const file = snapshot?.shadowFile;
+  return file && report?.unmanaged.includes(file) ? file : null;
+}
+
+/**
+ * Whether the problem a crash named has been dealt with: the blamed mod is off, removed or
+ * replaced by another build, or, for a missing dependency, that dependency is now on and usable.
+ * A crash the launcher can't tie to a mod it manages only goes away when the player dismisses it
+ * or starts the game again.
+ */
+export function crashResolved(snapshot: CrashSnapshot | null, report: ProfileReport | undefined): boolean {
+  if (!snapshot || !report) return false;
+  const now = report.mods.find((m) => m.id === snapshot.id);
+  const usable = !!now && now.enabled && now.status !== "revoked";
+  if (shadowStillThere(snapshot, report)) {
+    // The player's copy loads whenever the launcher's doesn't: turning that off or removing it
+    // only lets the player's copy load. Only a launcher copy that is on, and isn't what ran at
+    // the crash, loads in its place.
+    return usable && (!snapshot.enabled || now!.sha256 !== snapshot.sha256);
+  }
+  // The player's copy was what loaded, and it is gone.
+  if (snapshot.shadowFile && !snapshot.enabled) return true;
+  if (!now || !now.enabled || now.sha256 !== snapshot.sha256) return true;
+  if (snapshot.kind === "missingDep" && snapshot.dependency) {
+    const dep = report.mods.find((m) => m.id === snapshot.dependency);
+    return !!dep && dep.enabled && (dep.status === "ready" || dep.status === "unchecked");
+  }
+  return false;
+}
+
+export interface NoticeText {
+  tone: "ok" | "warn" | "info";
+  lines: Msg[];
+}
+
+/** What else a change did: dependencies turned on or off, and what has no build. */
+function sideEffects(result: ChangeResult, tag: string, name: NameOf, lines: Msg[]) {
+  if (result.alsoEnabled.length) lines.push({ key: "mods.noticeAlsoEnabled", args: [names(result.alsoEnabled, name)] });
+  if (result.alsoDisabled.length) lines.push({ key: "mods.noticeAlsoDisabled", args: [names(result.alsoDisabled, name)] });
+  // A mod installed turned off already says which dependency has no build.
+  if (result.missing.length && !result.installedOff.length) {
+    lines.push({ key: "mods.noticeMissing", count: result.missing.length, args: [names(result.missing, name), tag] });
+  }
+}
+
+/** What a change did, in names. `primary` is the mod the player acted on, if any. */
+export function describeChange(result: ChangeResult, primary: string | null, tag: string, name: NameOf): NoticeText | null {
+  const lines: Msg[] = [];
+  if (primary && result.installed.includes(primary)) {
+    const after = result.report.mods.find((m) => m.id === primary);
+    if (result.installedOff.includes(primary)) {
+      lines.push({
+        key: "mods.noticeInstalledOffMissing",
+        count: result.missing.length,
+        args: [name(primary), names(result.missing, name), tag],
+      });
+    } else {
+      lines.push({ key: after && !after.enabled ? "mods.noticeInstalledOff" : "mods.noticeInstalled", args: [name(primary), tag] });
+    }
+  }
+  const deps = result.installed.filter((id) => id !== primary);
+  if (deps.length && primary) lines.push({ key: "mods.noticeDepsInstalled", args: [names(deps, name)] });
+  sideEffects(result, tag, name, lines);
+  if (!lines.length) return null;
+  return { tone: result.missing.length ? "warn" : "ok", lines };
+}
+
+/**
+ * A toggle that changed other mods too: what the player did, then what else. A plain toggle says
+ * nothing; its switch already does.
+ */
+export function describeToggle(result: ChangeResult, id: string, enabled: boolean, tag: string, name: NameOf): NoticeText | null {
+  const lines: Msg[] = [];
+  sideEffects(result, tag, name, lines);
+  // Off, but a copy in the player's own folder loads in its place (contract R4 §4): say so now,
+  // not only in a note the player may not open.
+  const shadow = enabled ? undefined : shadowOf(result.report, id);
+  if (shadow && shadow.managed !== "on") lines.push({ key: "mods.noticeShadowLoads", args: [name(id), shadow.file] });
+  if (!lines.length) return null;
+  return { tone: shadow ? "warn" : "ok", lines: [{ key: enabled ? "mods.noticeTurnedOn" : "mods.noticeTurnedOff", args: [name(id)] }, ...lines] };
+}
+
+export function describeRemove(result: ChangeResult, id: string, tag: string, name: NameOf): NoticeText {
+  const lines: Msg[] = [{ key: "mods.noticeRemoved", args: [name(id), tag] }];
+  sideEffects(result, tag, name, lines);
+  return { tone: "ok", lines };
+}
+
+export function describeRestore(result: ChangeResult, id: string, tag: string, name: NameOf): NoticeText {
+  const after = result.report.mods.find((m) => m.id === id);
+  return { tone: "ok", lines: [{ key: after?.enabled ? "mods.noticeRestored" : "mods.noticeRestoredOff", args: [name(id), tag] }] };
+}
+
+export function describeCopy(result: CopyResult, from: string, tag: string, name: NameOf): NoticeText {
+  const lines: Msg[] = [{ key: "mods.noticeCopied", count: result.installed.length, args: [from] }];
+  if (result.installedOff.length) {
+    lines.push({ key: "mods.noticeCopiedOff", count: result.installedOff.length, args: [names(result.installedOff, name), tag] });
+  }
+  if (result.leftBehind.length) {
+    lines.push({
+      key: "mods.noticeLeftBehind",
+      count: result.leftBehind.length,
+      args: [formatList(result.leftBehind.map((i) => i.name))],
+    });
+  }
+  sideEffects({ ...result, installedOff: [] }, tag, name, lines);
+  return { tone: result.leftBehind.length || result.missing.length ? "warn" : "ok", lines };
+}
+
+/** Mods turned on in this version, for the line on Home. */
+export function enabledNames(report: ProfileReport | undefined): string[] {
+  return report?.mods.filter((m) => m.enabled).map((m) => m.name) ?? [];
+}
+
+/** `profile::BUILTIN`: what every game has, never a dependency. */
+const BUILTIN = new Set(["base"]);
+
+/**
+ * The set as it would be once `id` is turned on: the backend turns on, with it, every installed
+ * mod it needs that is off, transitively (contract R3 §2); a revoked one stays off. Each mod that
+ * this turns on has its status and blocking reason worked out as `profile::report` does.
+ * Returns that set and the mods that would newly stop Play.
+ */
+export function afterTurningOn(report: ProfileReport, id: string): { report: ProfileReport; newlyBlocking: string[] } {
+  const byId = new Map(report.mods.map((m) => [m.id, m]));
+  const on = new Set(report.mods.filter((m) => m.enabled).map((m) => m.id));
+  const turned: string[] = [];
+  const walk = (mid: string) => {
+    const m = byId.get(mid);
+    if (!m || m.status === "revoked" || on.has(mid)) return;
+    on.add(mid);
+    turned.push(mid);
+    for (const d of m.deps) if (!BUILTIN.has(d)) walk(d);
+  };
+  walk(id);
+  const reasons: Record<string, BlockingReason> = { ...report.blockingReasons };
+  const newlyBlocking: string[] = [];
+  const mods = report.mods.map((m) => {
+    if (!turned.includes(m.id)) return m;
+    const missingDeps = m.deps.filter((d) => !BUILTIN.has(d) && !on.has(d));
+    const depsNotInstalled = missingDeps.filter((d) => !byId.has(d));
+    const wrong = !!m.abi && !!report.versionAbi && m.abi !== report.versionAbi;
+    const status: InstalledMod["status"] = wrong ? "wrongVersion" : missingDeps.length ? "missingDeps" : !m.abi || !report.versionAbi ? "unchecked" : "ready";
+    if (status === "wrongVersion" || status === "missingDeps") {
+      reasons[m.id] = status;
+      newlyBlocking.push(m.id);
+    }
+    return { ...m, enabled: true, status, missingDeps, depsNotInstalled };
+  });
+  return {
+    report: { ...report, mods, blocking: [...report.blocking, ...newlyBlocking], blockingReasons: reasons },
+    newlyBlocking,
+  };
+}
+
+/**
+ * Why turning `id` on would stop Play, one sentence per mod it would put in the way, the same
+ * sentences the blocker panel would then say; empty when Play keeps working. Asked before the
+ * switch is turned, so the player can choose with the reason in front of them.
+ */
+export function turnOnWarnings(report: ProfileReport | undefined, id: string, name: NameOf, catalog: Catalog | null): Msg[] {
+  if (!report) return [];
+  const { report: after, newlyBlocking } = afterTurningOn(report, id);
+  if (!newlyBlocking.length) return [];
+  return blockers(after, name, catalog)
+    .filter((b) => newlyBlocking.includes(b.mod.id))
+    .flatMap((b) => b.reasons);
+}
diff --git a/src/mods/types.ts b/src/mods/types.ts
new file mode 100644
index 0000000..cde4812
--- /dev/null
+++ b/src/mods/types.ts
@@ -0,0 +1,20 @@
+// The IPC types, generated from the Rust structs into ./bindings (`cargo test export_bindings
+// -- --ignored` in src-tauri regenerates them; a test fails while they're out of date).
+export type * from "./bindings";
+
+import type { ErrorCode } from "./bindings";
+
+/**
+ * Frontend only: what an action failed with. "Unknown" is anything that isn't an AppError this
+ * build knows: a thrown Error, or a code from a newer backend. Its detail says what there is.
+ */
+export type UiError = { code: ErrorCode | "Unknown"; detail: string | null };
+
+import type { ModProgress, ProgressStage } from "./bindings";
+
+/**
+ * Frontend only: a step of a running operation. `preparing` is the moment before the backend's
+ * first event, when nothing is being downloaded yet; the backend's own stages follow.
+ */
+export type UiStage = ProgressStage | "preparing";
+export type UiProgress = Omit<ModProgress, "stage"> & { stage: UiStage };
diff --git a/src/pages/Home.tsx b/src/pages/Home.tsx
index 4abacf0..b6fbe1f 100644
--- a/src/pages/Home.tsx
+++ b/src/pages/Home.tsx
@@ -1,67 +1,80 @@
-import { useState, useMemo } from "react";
-import { invoke } from "@tauri-apps/api/core";
+import { useId, useMemo, useState } from "react";
 import { useI18n } from "../i18n/useI18n";
-import { translateError } from "../i18n/errors";
+import { showError } from "../i18n/errors";
+import { ErrorText } from "../components/ErrorText";
 import { useInstall } from "../hooks/useInstall";
 import { useGameState } from "../hooks/useGameState";
+import { useMods } from "../hooks/useMods";
+import { useLaunch } from "../hooks/useLaunch";
+import { LaunchRefusal } from "../components/LaunchRefusal";
+import { launcherApi } from "../mods/api";
+import { enabledNames, heroState } from "../mods/status";
 import { StableLabel } from "../components/StableLabel";
 import { VersionSelect } from "../components/VersionSelect";
+import { Truncate } from "../components/Truncate";
+import { BlockerPanel, useReviewDialog } from "../components/mods/ModFixes";
+import { ModFailureNotice } from "../components/mods/ModFailureNotice";
 import { compareTags } from "../utils/version";
+import type { MessageKey } from "../i18n";
+import type { HeroState } from "../mods/status";
 
 interface HomeProps {
   onGoToVersions: () => void;
+  onGoToMods: () => void;
   latestTag: string | null;
   selectedTag: string | null;
   onSelectTag: (tag: string | null) => void;
 }
 
-export function Home({ onGoToVersions, latestTag, selectedTag, onSelectTag }: HomeProps) {
-  const { t, locale } = useI18n();
-  const { installedVersions, loaded } = useInstall();
-  const { anyRunning, isRunning, launch, lastCrash, clearCrash } = useGameState();
+const BADGE: Record<HeroState, MessageKey> = {
+  ready: "heroBadge",
+  playing: "heroBadgePlaying",
+  blocked: "heroBadgeBlocked",
+  checking: "heroBadgeChecking",
+  unchecked: "heroBadgeUnchecked",
+};
 
-  const [launchError, setLaunchError] = useState<string | null>(null);
+export function Home({ onGoToVersions, onGoToMods, latestTag, selectedTag, onSelectTag }: HomeProps) {
+  const { t, tn, locale, formatList } = useI18n();
+  const { installedVersions, loaded } = useInstall();
+  const { anyRunning, isRunning, lastCrash } = useGameState();
+  const { profile, profileError, isCopying, loadProfile } = useMods();
+  const launch = useLaunch();
+  const [rereading, setRereading] = useState(false);
+  const blockersId = useId();
+  const folderLabelId = useId();
+  const folderButtonId = useId();
 
-  const sortedVersions = useMemo(
-  () => [...installedVersions].sort((a, b) => compareTags(b.tag, a.tag)),
-  [installedVersions]
-  );
+  const sortedVersions = useMemo(() => [...installedVersions].sort((a, b) => compareTags(b.tag, a.tag)), [installedVersions]);
 
   // The selection may be a version that has been deleted since.
   const selectedVersion = useMemo(
-  () => sortedVersions.find((v) => v.tag === selectedTag) ?? sortedVersions[0] ?? null,
-  [sortedVersions, selectedTag]
-);
+    () => sortedVersions.find((v) => v.tag === selectedTag) ?? sortedVersions[0] ?? null,
+    [sortedVersions, selectedTag]
+  );
 
   const effectiveTag = selectedVersion?.tag ?? null;
-
-  const handleLaunch = async (tag: string) => {
-    setLaunchError(null);
-    setLaunchError(await launch(tag));
-  };
-
-  const handleOpenLog = async (tag: string) => {
-    clearCrash();
-    try {
-      await invoke("open_log", { tag });
-    } catch (err) {
-      setLaunchError(translateError(err));
-    }
-  };
+  const report = profile(effectiveTag);
+  const review = useReviewDialog(effectiveTag);
+  const isSelectedRunning = effectiveTag ? isRunning(effectiveTag) : false;
+  const readError = effectiveTag ? profileError(effectiveTag) : null;
+  const state = heroState(report, isSelectedRunning, !!readError);
+  const blocked = state === "blocked";
+  const crash = lastCrash && lastCrash.tag === effectiveTag ? lastCrash : null;
+  const busyWithMods = effectiveTag ? isCopying(effectiveTag) : false;
+  const launching = !!launch.launching;
+  const playDisabled = !effectiveTag || anyRunning || isSelectedRunning || blocked || launching || busyWithMods;
 
   const handleOpenFolder = async () => {
     if (!effectiveTag) return;
-    setLaunchError(null);
+    launch.clear();
     try {
-      await invoke("open_game_folder", { tag: effectiveTag });
+      await launcherApi.openGameFolder(effectiveTag);
     } catch (err) {
-      setLaunchError(translateError(err));
+      launch.fail(effectiveTag, { code: "Unknown", detail: null }, showError(err));
     }
   };
 
-  const isSelectedRunning = effectiveTag ? isRunning(effectiveTag) : false;
-  const playDisabled = anyRunning || isSelectedRunning;
-
   if (!loaded) {
     return <main className="page home-page" />;
   }
@@ -80,13 +93,28 @@ export function Home({ onGoToVersions, latestTag, selectedTag, onSelectTag }: Ho
     );
   }
 
+  // A refused launch says why, unless the blocker panel below already says it with its fixes.
+  const { shownError, unread: unreadRefusal } = launch.refusalFor(effectiveTag);
+  // The set couldn't be read at all (no refusal involved): say so, with Retry, also here.
+  const shownReadError = !report && readError && !unreadRefusal ? readError : null;
+  // With something to read under Play, the title steps back so the actions stay in view.
+  const compact = blocked || !!crash || !!shownError || !!unreadRefusal || !!shownReadError;
+  const names = enabledNames(report);
+  // What loads, said whole: the launcher's mods, and the files in the player's own folder, which
+  // load in every version.
+  const modsLine = (own: number) => {
+    if (!effectiveTag) return "";
+    if (!own) return names.length ? t("mods.homeMods", effectiveTag, formatList(names)) : t("mods.homeModsNone", effectiveTag);
+    return names.length ? tn("mods.homeModsOwn", own, effectiveTag, formatList(names)) : tn("mods.homeModsOnlyOwn", own, effectiveTag);
+  };
+
   return (
     <main className="page home-page">
-      <section className="hero clear">
+      <section className={`hero clear${compact ? " compact" : ""}`}>
         <div className="hero-header">
           <h1 className="hero-title">WEFT</h1>
-          <div className="hero-version-badge">
-            {t(isSelectedRunning ? "heroBadgePlaying" : "heroBadge", effectiveTag || "—")}
+          <div className={`hero-version-badge${blocked ? " bad" : ""}`} role="status">
+            {t(BADGE[state], effectiveTag || "—")}
           </div>
         </div>
         <div className="hero-play-area">
@@ -101,61 +129,76 @@ export function Home({ onGoToVersions, latestTag, selectedTag, onSelectTag }: Ho
             label={t("selectVersionLabel")}
           />
           <button
-              className="btn-play"
-              onClick={() => effectiveTag && handleLaunch(effectiveTag)}
-              disabled={!effectiveTag || playDisabled}
-              aria-label={isSelectedRunning ? t("playing") : t("playButton")}
-            >
+            className="btn-play"
+            onClick={() => effectiveTag && launch.start(effectiveTag)}
+            disabled={playDisabled}
+            aria-describedby={blocked ? `${blockersId}-why` : undefined}
+          >
             <StableLabel
               text={isSelectedRunning ? t("playing") : t("playButton")}
               widest={[t("playing"), t("playButton")]}
             />
           </button>
         </div>
-        {launchError && (
-          <div className="launch-error" role="alert">
-            {launchError}
-          </div>
+        {/* Why Play is off, and the fixes, right under it. */}
+        {effectiveTag && <BlockerPanel id={blockersId} tag={effectiveTag} locked={anyRunning} review={review} />}
+        {effectiveTag && <LaunchRefusal tag={effectiveTag} launch={launch} review={review} />}
+        {shownReadError && effectiveTag && (
+          <ErrorText error={{ ...shownReadError, message: t("mods.homeProfileFailed", effectiveTag, shownReadError.message) }} className="launch-error">
+            <button className="btn-secondary btn-small" disabled={rereading} onClick={async () => {
+              setRereading(true);
+              await loadProfile(effectiveTag, true);
+              setRereading(false);
+            }}>
+              {rereading ? t("mods.retrying") : t("mods.profileRetry")}
+            </button>
+          </ErrorText>
         )}
-        {lastCrash && (
-          <div className="launch-error" role="alert">
-            <span>{t("gameClosedError", String(lastCrash.exitCode ?? "?"))}</span>
-            <button className="btn-secondary" onClick={() => handleOpenLog(lastCrash.tag)}>
-              {t("openLogButton")}
+        {report && effectiveTag && (
+          <p className="mods-line">
+            <Truncate focusable text={modsLine(report.unmanaged.length)} />
+            <button className="link-btn" onClick={onGoToMods}>
+              {names.length ? t("mods.homeChange") : t("mods.homeAdd")}
             </button>
-          </div>
+          </p>
         )}
+        {crash && <ModFailureNotice crash={crash} review={review} onGoToMods={onGoToMods} />}
       </section>
 
       <section className="card clear">
-        <div className="card-header">
+        {/* The folder's button on the title's line: in view under a crash notice at 565px. */}
+        <div className="card-header instance-head">
           <h2 className="card-title">{t("instanceCardTitle")}</h2>
+          {selectedVersion && (
+            <>
+              <span className="sr-only" id={folderLabelId}>
+                {t("gameFolderTitle")}
+              </span>
+              <button className="btn-secondary btn-small btn-open-folder" id={folderButtonId} aria-labelledby={`${folderLabelId} ${folderButtonId}`} onClick={handleOpenFolder}>
+                {t("openFolderButton")}
+              </button>
+            </>
+          )}
         </div>
         <div className="card-body">
           {selectedVersion ? (
-            <>
-              <div className="detail-row">
-                <span className="detail-label">{t("versionLabel")}</span>
-                <span className="detail-value">{selectedVersion.tag}</span>
+            // One line that wraps, so the card stays short.
+            <dl className="instance-line">
+              <div className="instance-pair">
+                <dt className="detail-label">{t("versionLabel")}</dt>
+                <dd className="detail-value">{selectedVersion.tag}</dd>
               </div>
-              <div className="detail-row">
-                <span className="detail-label">{t("installedAtLabel")}</span>
-                <span className="detail-value">
-                  {new Date(selectedVersion.installed_at).toLocaleString(locale)}
-                </span>
+              <div className="instance-pair">
+                <dt className="detail-label">{t("installedAtLabel")}</dt>
+                <dd className="detail-value">{new Date(selectedVersion.installed_at).toLocaleString(locale)}</dd>
               </div>
-              <div className="detail-row">
-  <span className="detail-label">{t("gameFolderTitle")}</span>
-  <button className="btn-secondary btn-open-folder" onClick={handleOpenFolder}>
-  {t("openFolderButton")}
-</button>
-</div>
-            </>
+            </dl>
           ) : (
             <p className="select-version-hint">{t("selectVersionHint")}</p>
           )}
         </div>
       </section>
+      {review.dialog}
     </main>
   );
 }
diff --git a/src/pages/Mods.tsx b/src/pages/Mods.tsx
new file mode 100644
index 0000000..c5903d0
--- /dev/null
+++ b/src/pages/Mods.tsx
@@ -0,0 +1,413 @@
+import { useCallback, useEffect, useId, useMemo, useReducer, useRef, useState, type CSSProperties } from "react";
+import { useI18n } from "../i18n/useI18n";
+import { showError, type Shown } from "../i18n/errors";
+import { bannerPlan } from "../mods/banners";
+import { ErrorDetails } from "../components/ErrorText";
+import { useAnnounce } from "../components/LiveRegion";
+import { useInstall } from "../hooks/useInstall";
+import { useGameState } from "../hooks/useGameState";
+import { useMods, type Notice } from "../hooks/useMods";
+import { useRovingTabs } from "../hooks/useRovingTabs";
+import { modsApi } from "../mods/api";
+import { copyDonors } from "../mods/select";
+import { compareTags } from "../utils/version";
+import { PixelIcon } from "../components/PixelIcon";
+import { VersionSelect } from "../components/VersionSelect";
+import { InstalledList } from "../components/mods/InstalledList";
+import { BrowseList } from "../components/mods/BrowseList";
+import { FileInstallDialog } from "../components/mods/FileInstallDialog";
+import { pickModFile } from "../components/mods/pickModFile";
+import { SourcesDialog } from "../components/mods/SourcesDialog";
+import { CopyDialog } from "../components/mods/CopyDialog";
+import { BannerStack, Toasts, type BannerItem } from "../components/mods/BannerStack";
+import { useCatalogBanners } from "../components/mods/catalogBanners";
+import { BlockerPanel, useReviewDialog } from "../components/mods/ModFixes";
+import { ModFailureNotice } from "../components/mods/ModFailureNotice";
+import { REFRESH_ICON } from "../components/icons";
+import { MODS_START, MODS_VIEWS, modsRoute, type ModsView } from "../mods/modsRoute";
+
+const VIEWS = MODS_VIEWS;
+
+interface ModsPageProps {
+  selectedTag: string | null;
+  onSelectTag: (tag: string) => void;
+  onGoToVersions: () => void;
+}
+
+export function ModsPage({ selectedTag, onSelectTag, onGoToVersions }: ModsPageProps) {
+  const announce = useAnnounce();
+  const { t, tn, tm, formatList } = useI18n();
+  const { installedVersions, loaded } = useInstall();
+  const { isRunning, lastCrash } = useGameState();
+  const mods = useMods();
+  const { profile, profileError, loadProfile, notices, dismissNotice, catalogLoading, refreshCatalog, nameIn, restore } = mods;
+  // Installed or Browse, the one dialog over the tab, and the row focus goes to next (mods/modsRoute).
+  const [route, go] = useReducer(modsRoute, MODS_START);
+  const { view, dialog, focusMod } = route;
+  const setView = useCallback((v: ModsView) => go({ type: "view", view: v }), []);
+  const closeDialog = () => go({ type: "close" });
+  const [rowError, setRowError] = useState<Shown | null>(null);
+  const [toastRoom, setToastRoom] = useState(0);
+  const panel = useRef<HTMLElement>(null);
+  const versionLabelId = useId();
+  const pendingId = useId();
+  const tabs = useRovingTabs("mods", VIEWS, view, setView);
+
+  const versions = useMemo(() => [...installedVersions].sort((a, b) => compareTags(b.tag, a.tag)), [installedVersions]);
+  const tag = versions.find((v) => v.tag === selectedTag)?.tag ?? versions[0]?.tag ?? null;
+  const report = profile(tag);
+  const running = tag ? isRunning(tag) : false;
+  const review = useReviewDialog(tag);
+  const catalogBanners = useCatalogBanners(() => go({ type: "open", dialog: { kind: "sources" } }));
+  const donors = tag
+    ? copyDonors(
+        versions.map((v) => v.tag),
+        tag,
+        Object.fromEntries(versions.map((v) => [v.tag, profile(v.tag)]))
+      )
+    : [];
+
+  useEffect(() => setRowError(null), [tag, view]);
+  // A toast that appears over the row with focus (the row after a removed one) moves that row
+  // into the room the list keeps above it.
+  useEffect(() => {
+    const active = document.activeElement;
+    if (toastRoom && active instanceof HTMLElement && panel.current?.contains(active)) active.scrollIntoView({ block: "nearest" });
+  }, [toastRoom]);
+  // A failed row action is said once, politely, like every result.
+  useEffect(() => {
+    if (rowError) announce(`row-error:${Date.now()}`, rowError.message);
+  }, [rowError, announce]);
+
+  if (!loaded) return <main className="page mods-page" />;
+
+  if (!tag) {
+    return (
+      <main className="page mods-page">
+        <header className="page-header clear">
+          <h1>{t("mods.title")}</h1>
+        </header>
+        <div className="empty-state framed-empty">
+          <p>{t("mods.noVersions")}</p>
+          <button className="btn-primary" onClick={onGoToVersions}>
+            {t("goToVersionsTab")}
+          </button>
+        </div>
+      </main>
+    );
+  }
+
+  const pickFile = async () => {
+    try {
+      const path = await pickModFile(t("mods.fileFilter"));
+      if (path) go({ type: "open", dialog: { kind: "file", path } });
+    } catch (err) {
+      setRowError(showError(err));
+    }
+  };
+
+  const openFolder = () =>
+    modsApi.openPlayerModsFolder().catch((err) => {
+      const shown = showError(err);
+      setRowError({ ...shown, message: t("mods.folderFailed", shown.message) });
+    });
+
+  /** Focus that was on something that went away lands on the list. */
+  const settleFocus = () => panel.current?.focus({ preventScroll: true });
+
+  const undo = async (n: Notice) => {
+    if (!n.undo) return;
+    const r = await restore(tag, n.undo.id);
+    if (r.status === "failed") setRowError(r.shown);
+    else if (r.status === "done") {
+      go({ type: "restored", id: n.undo.id });
+    }
+  };
+
+  const name = nameIn(tag);
+  const empty = report && report.mods.length === 0;
+  const loadFailed = profileError(tag);
+  const blocked = (report?.blocking.length ?? 0) > 0;
+  const shadowedOff = (report?.shadowed ?? []).filter((x) => x.managed === "off");
+  const catalog = mods.catalog;
+
+  const plan = bannerPlan({
+    view,
+    running,
+    notices: notices(tag).map((n) => n.id),
+    blocked,
+    rowError: !!rowError,
+    index: catalog?.index.freshness ?? null,
+    indexTrouble: !!catalog?.index.error || !!catalog?.index.cacheError,
+    refreshFailed: !!catalog && !!mods.catalogError,
+    sources: (catalog?.sources ?? []).filter((x) => x.error).map((x) => x.repo),
+    sourcesDamaged: !!catalog?.sourcesError,
+    abiUnknown: !!report?.abiError,
+    shadowed: shadowedOff.length > 0,
+    unmanaged: (report?.unmanaged.length ?? 0) > 0,
+  });
+
+  const showFolder = (
+    <button className="btn-flat" onClick={openFolder}>
+      {t("mods.unmanagedShow")}
+    </button>
+  );
+  const item = (id: string): BannerItem | null => {
+    if (id === "running") {
+      // A revocation that arrived while the game runs is applied when it stops (the backend
+      // never rewrites a running version's mods); say so rather than look like nothing happened.
+      const pending = report?.revocationsPending ?? [];
+      return {
+        id,
+        tone: pending.length ? "warn" : "info",
+        text: pending.length ? (
+          <>
+            <span className="banner-line">{t("mods.runningBanner", tag)}</span>
+            <span className="banner-line">{t("mods.revocationsPending", formatList(pending.map(name)))}</span>
+          </>
+        ) : (
+          t("mods.runningBanner", tag)
+        ),
+      };
+    }
+    if (id.startsWith("notice:")) {
+      const n = notices(tag).find((x) => `notice:${x.id}` === id);
+      if (!n) return null;
+      return {
+        id,
+        tone: n.tone,
+        text: n.lines.map((l, i) => (
+          <span key={i} className="banner-line">
+            {tm(l)}
+          </span>
+        )),
+        actions: (
+          <>
+            {n.undo && (
+              <button className="btn-flat" onClick={() => undo(n)} aria-label={t("mods.undoLabel", n.undo.name)} disabled={running}>
+                {t("mods.undo")}
+              </button>
+            )}
+            <button
+              className="btn-flat"
+              onClick={() => {
+                dismissNotice(n.id);
+                settleFocus();
+              }}
+            >
+              {t("mods.dismiss")}
+            </button>
+          </>
+        ),
+      };
+    }
+    if (id === "error" && rowError) {
+      return {
+        id,
+        tone: "bad",
+        text: (
+          <>
+            {rowError.message}
+            {rowError.detail && <ErrorDetails detail={rowError.detail} label={t("errors.details")} />}
+          </>
+        ),
+        actions: (
+          <button
+            className="btn-flat"
+            onClick={() => {
+              setRowError(null);
+              settleFocus();
+            }}
+          >
+            {t("mods.dismiss")}
+          </button>
+        ),
+      };
+    }
+    if (id === "blocking" && report) {
+      // Folded (on Browse): Play is off, and for which mod, never cut.
+      const cause = report.blocking.length === 1 ? t("mods.playOffOne", name(report.blocking[0])) : tn("mods.playOffMany", report.blocking.length);
+      return { id, tone: "bad", text: <BlockerPanel tag={tag} locked={running} review={review} inBanner />, cause };
+    }
+    if (id === "abi") {
+      const text = t(view === "browse" ? "mods.abiUnknownBrowse" : "mods.abiUnknown", tag);
+      return { id, tone: "info", text, cause: t("mods.abiUnknownShort", tag), actions: <RetryProfile tag={tag} /> };
+    }
+    if (id === "shadowed") {
+      const list = formatList(shadowedOff.map((x) => `${name(x.id)} (${x.file})`));
+      return { id, tone: "warn", text: t("mods.shadowBanner", list), cause: t("mods.shadowCause"), subject: formatList(shadowedOff.map((x) => name(x.id))), actions: showFolder };
+    }
+    if (id === "unmanaged" && report) {
+      return {
+        id,
+        tone: "warn",
+        text: t("mods.unmanagedBanner", formatList(report.unmanaged)),
+        cause: tn("mods.unmanagedCause", report.unmanaged.length),
+        actions: showFolder,
+      };
+    }
+    return catalogBanners[id] ?? null;
+  };
+  const full = plan.full.map((p) => item(p.id)).filter((x): x is BannerItem => !!x);
+  const quiet = plan.quiet.map((p) => item(p.id)).filter((x): x is BannerItem => !!x).map((x, i) => ({ ...x, rank: i }));
+  const toasts = plan.toasts.map((p) => item(p.id)).filter((x): x is BannerItem => !!x);
+
+  const count = report?.mods.length ?? 0;
+  const copying = mods.isCopying(tag);
+  const pending = mods.pendingSources;
+  const pendingText = pending.length === 0 ? null : pending.length === 1 ? t("mods.sourcePending", pending[0]) : tn("mods.sourcesPending", pending.length);
+
+  return (
+    <main className="page mods-page">
+      <header className="page-header clear">
+        <h1>{t("mods.title")}</h1>
+        <div className="header-actions">
+          <span className="header-for" id={versionLabelId}>
+            {t("mods.versionPicker")}
+          </span>
+          <VersionSelect
+            value={tag}
+            options={versions.map((v) => ({ value: v.tag, label: v.tag }))}
+            onChange={onSelectTag}
+            disabled={false}
+            labelledBy={versionLabelId}
+            compact
+          />
+          <button className="btn-flat" onClick={() => go({ type: "open", dialog: { kind: "sources" } })}>
+            {t("mods.sources")}
+          </button>
+          <button
+            className={`btn-flat icon-btn mods-refresh${pendingText ? " pending" : ""}`}
+            onClick={refreshCatalog}
+            disabled={catalogLoading}
+            title={pendingText ?? t("mods.refresh")}
+            aria-label={t("mods.refresh")}
+            aria-describedby={pendingText ? pendingId : undefined}
+          >
+            <PixelIcon rows={REFRESH_ICON} scale={3} />
+          </button>
+          {/* The index is in and shows; a slow source is still being asked. Said, and named on
+              the refresh button (and in Sources), without taking room from the list. */}
+          <span className="sr-only" role="status" id={pendingId}>
+            {pendingText}
+          </span>
+        </div>
+      </header>
+
+      <div className="mods-toolbar">
+        <div className="switch" role="tablist" aria-label={t("mods.viewsLabel", tag)}>
+          {VIEWS.map((v) => (
+            <button
+              key={v}
+              {...tabs.tab(v)}
+              className={view === v ? "on" : ""}
+              // The count alone says nothing heard out of context: which version, and of what.
+              aria-label={v === "installed" && count > 0 ? tn("mods.tabInstalledLabel", count, tag) : undefined}
+            >
+              {t(v === "installed" ? "mods.tabInstalled" : "mods.tabBrowse")}
+              {v === "installed" && count > 0 && <span className="count">{count}</span>}
+            </button>
+          ))}
+        </div>
+        <div className="toolbar-actions">
+          <button className="btn-flat" onClick={pickFile} disabled={running || copying}>
+            {t("mods.fromFile")}
+          </button>
+          {donors.length > 0 && (
+            <button className="btn-flat" onClick={() => go({ type: "open", dialog: { kind: "copy" } })} disabled={running || copying}>
+              {copying ? t("mods.copying") : t("mods.copyHeader")}
+            </button>
+          )}
+        </div>
+      </div>
+
+      {lastCrash && lastCrash.tag === tag && <ModFailureNotice crash={lastCrash} review={review} />}
+      <BannerStack full={full} quiet={quiet} />
+
+      <div className="mods-list-area">
+      <section
+        {...tabs.panel}
+        className="mods-panel"
+        data-focus-scope
+        ref={panel}
+        tabIndex={-1}
+        style={{ "--toast-room": `${toastRoom}px` } as CSSProperties}
+      >
+        {!report ? (
+          loadFailed ? (
+            <div className="empty-state framed-empty">
+              <p>{t("mods.profileFailed", tag, loadFailed.message)}</p>
+              {loadFailed.detail && <ErrorDetails detail={loadFailed.detail} label={t("errors.details")} />}
+              <div className="empty-actions">
+                <button className="btn-primary" onClick={() => loadProfile(tag, true)}>
+                  {t("mods.profileRetry")}
+                </button>
+              </div>
+            </div>
+          ) : (
+            <div className="empty-state" role="status">
+              {t("loading")}
+            </div>
+          )
+        ) : view === "installed" ? (
+          empty ? (
+            <div className="empty-state framed-empty">
+              <p>{t("mods.emptyInstalled", tag)}</p>
+              <div className="empty-actions">
+                <button className="btn-primary" onClick={() => setView("browse")}>
+                  {t("mods.browseMods")}
+                </button>
+                {donors.length > 0 && (
+                  <button className="btn-secondary" disabled={running} onClick={() => go({ type: "open", dialog: { kind: "copy" } })}>
+                    {t("mods.copyButton", donors[0])}
+                  </button>
+                )}
+              </div>
+            </div>
+          ) : (
+            <InstalledList
+              report={report}
+              onError={setRowError}
+              onUpdate={review.openUpdate}
+              canUpdate={review.canUpdate}
+              updatesUnavailable={!catalog && mods.catalogError ? t("mods.updatesNeedCatalog") : null}
+              locked={running}
+              focusMod={focusMod}
+              onFocused={() => go({ type: "focused" })}
+              onEmptied={settleFocus}
+            />
+          )
+        ) : (
+          <BrowseList report={report} locked={running} />
+        )}
+      </section>
+      <Toasts items={toasts} onHeight={setToastRoom} />
+      </div>
+
+      {dialog?.kind === "file" && <FileInstallDialog tag={tag} path={dialog.path} onClose={closeDialog} />}
+      {dialog?.kind === "sources" && <SourcesDialog onClose={closeDialog} />}
+      {dialog?.kind === "copy" && <CopyDialog tag={tag} donors={donors} onClose={closeDialog} />}
+      {review.dialog}
+    </main>
+  );
+}
+
+/** Asks for the version's set again: the mod interface may be found out this time. */
+function RetryProfile({ tag }: { tag: string }) {
+  const { t } = useI18n();
+  const { loadProfile, refreshCatalog } = useMods();
+  const [busy, setBusy] = useState(false);
+  return (
+    <button
+      className="btn-flat"
+      disabled={busy}
+      onClick={async () => {
+        setBusy(true);
+        await Promise.all([loadProfile(tag, true), refreshCatalog()]);
+        setBusy(false);
+      }}
+    >
+      {busy ? t("mods.retrying") : t("mods.retry")}
+    </button>
+  );
+}
diff --git a/src/pages/Versions.tsx b/src/pages/Versions.tsx
index be6fbec..3370507 100644
--- a/src/pages/Versions.tsx
+++ b/src/pages/Versions.tsx
@@ -1,17 +1,12 @@
 import { useI18n } from "../i18n/useI18n";
 import { useInstall } from "../hooks/useInstall";
+import { useModProfiles } from "../hooks/useMods";
 import { PixelIcon } from "../components/PixelIcon";
 import { VersionActions } from "../components/VersionActions";
 import { getLocale } from "../i18n";
-
-const REFRESH_ICON = [
-  ".###.#",
-  "#...##",
-  "#..###",
-  "#.....",
-  "#...#.",
-  ".###..",
-];
+import { REFRESH_ICON } from "../components/icons";
+import { ErrorText } from "../components/ErrorText";
+import type { Shown } from "../i18n/errors";
 
 interface Release {
   tag: string;
@@ -31,10 +26,11 @@ interface Release {
 interface VersionsPageProps {
   releases: Release[];
   loading: boolean;
-  error: string | null;
+  error: Shown | null;
   fromCache: boolean;
   onRefresh: (forceRefresh?: boolean) => void;
   newTag: string | null;
+  onFixMods?: (tag: string) => void;
 }
 
 export function VersionsPage({
@@ -44,9 +40,11 @@ export function VersionsPage({
   fromCache,
   onRefresh,
   newTag,
+  onFixMods,
 }: VersionsPageProps) {
-  const { t, formatSize: fmtSize } = useI18n();
+  const { t, tn, formatSize: fmtSize } = useI18n();
   const { installedVersions } = useInstall();
+  const { profile } = useModProfiles();
 
   const installedMap = new Map(installedVersions.map((v) => [v.tag, v]));
 
@@ -63,11 +61,7 @@ export function VersionsPage({
           {fromCache && !loading && (
             <span className="cache-banner" role="status">{t("cacheBanner")}</span>
           )}
-          {error && (
-            <div className="error-banner" role="alert">
-              {t("errorPrefix")}{error}
-            </div>
-          )}
+          {error && <ErrorText error={error} className="error-banner" />}
           <button
             className="btn-refresh"
             onClick={() => onRefresh(true)}
@@ -95,6 +89,7 @@ export function VersionsPage({
                 key={release.tag}
                 className={`version-entry${installedVersion ? " in-use" : ""}${isNew ? " is-new" : ""}`}
                 role="listitem"
+                data-focus-scope
               >
                 <div className="version-header">
                   <div className="version-main">
@@ -111,6 +106,9 @@ export function VersionsPage({
                     <span className="version-size">
                       {fmtSize(asset.size)}
                     </span>
+                    {installedVersion && profile(release.tag) && (
+                      <span className="version-mods">{tn("versionModCount", profile(release.tag)!.mods.length)}</span>
+                    )}
                   </div>
                 </div>
 
@@ -125,6 +123,7 @@ export function VersionsPage({
                     },
                   }}
                   installedVersion={installedVersion}
+                  onFixMods={onFixMods}
                 />
               </article>
             );
diff --git a/src/style.css b/src/style.css
index 2874bf0..218ffef 100644
--- a/src/style.css
+++ b/src/style.css
@@ -18,6 +18,9 @@
   --r1: #7c2c22;
   --r2: #c2503c;
   --r3: #ff9a80;
+  --v1: #2e6b3e;
+  --v2: #4fa25e;
+  --v3: #9be3a4;
   --px: 4px;
   --sidebar: 192px;
   color-scheme: dark;
@@ -104,12 +107,13 @@ button:disabled { cursor: not-allowed; }
 }
 .new-dot { display: inline-block; width: 8px; height: 8px; margin-left: 8px; background: var(--a3); box-shadow: 0 2px 0 var(--a1); }
 .tab-btn.active .new-dot { background: var(--ink); box-shadow: none; }
+.tab-list { display: flex; align-items: center; }
 .tabs-right { margin-left: auto; display: flex; align-items: center; gap: 8px; }
 
 /* Blocks seen from the front: lit top edge, side face below, pressing pushes them in. The side
    belongs to the button, so it can be clicked too, and pressing moves only what's drawn: the box
    stays put, so nothing around it shifts and a press on the top edge doesn't slip off it. */
-:is(.btn-play, .install-btn, .play-btn, .btn-primary, .btn-refresh, .btn-secondary, .delete-btn, .version-select-btn) {
+:is(.btn-play, .install-btn, .play-btn, .btn-primary, .btn-refresh, .btn-secondary, .delete-btn, .version-select-btn, .btn-danger, .toggle) {
   --top: 8px;
   --side: 16px;
   --face: var(--g2);
@@ -125,20 +129,20 @@ button:disabled { cursor: not-allowed; }
     linear-gradient(var(--lit) 0 var(--px), var(--face) 0) 0 0 / 100% calc(100% - 12px) no-repeat,
     linear-gradient(var(--edge) 0 8px, var(--ink) 0) 0 100% / 100% 12px no-repeat;
 }
-:is(.btn-refresh, .btn-secondary, .delete-btn, .version-select-btn):hover:not(:disabled) { --face: var(--g3); --lit: var(--g4); }
+:is(.btn-refresh, .btn-secondary, .delete-btn, .version-select-btn, .toggle):hover:not(:disabled) { --face: var(--g3); --lit: var(--g4); }
 
 :is(.btn-play, .install-btn, .play-btn, .btn-primary) { --face: var(--a2); --lit: var(--a3); --edge: var(--a1); color: var(--ink); }
 :is(.btn-play, .install-btn, .play-btn, .btn-primary):hover:not(:disabled) { --face: var(--a3); --lit: #ffe0a0; }
 
-.delete-btn.confirming, .delete-btn.confirming:hover:not(:disabled) { --face: var(--r2); --lit: var(--r3); --edge: var(--r1); color: var(--ink); }
+:is(.btn-danger, .delete-btn.confirming), :is(.btn-danger, .delete-btn.confirming):hover:not(:disabled) { --face: var(--r2); --lit: var(--r3); --edge: var(--r1); color: var(--ink); }
 
-:is(.btn-play, .install-btn, .play-btn, .btn-primary, .btn-refresh, .btn-secondary, .delete-btn, .version-select-btn):is(:active:not(:disabled), :disabled) {
+:is(.btn-play, .install-btn, .play-btn, .btn-primary, .btn-refresh, .btn-secondary, .delete-btn, .version-select-btn, .btn-danger, .toggle):is(:active:not(:disabled), :disabled) {
   padding: calc(var(--top) + 8px) var(--side) calc(var(--top) + 4px);
   background:
     linear-gradient(var(--lit) 0 var(--px), var(--face) 0) 0 8px / 100% calc(100% - 12px) no-repeat,
     linear-gradient(var(--ink), var(--ink)) 0 100% / 100% 4px no-repeat;
 }
-:is(.btn-play, .install-btn, .play-btn, .btn-primary, .btn-refresh, .btn-secondary, .delete-btn, .version-select-btn):disabled {
+:is(.btn-play, .install-btn, .play-btn, .btn-primary, .btn-refresh, .btn-secondary, .delete-btn, .version-select-btn, .btn-danger, .toggle):disabled {
   --face: var(--g1); --lit: var(--g1);
   color: var(--g4);
 }
@@ -165,7 +169,7 @@ button:disabled { cursor: not-allowed; }
 .lang-menu, .version-select-menu { margin: 0; padding: var(--px); list-style: none; background: var(--ink); }
 .lang-menu { position: absolute; right: 0; top: 40px; min-width: 176px; }
 .lang-item { display: flex; gap: 16px; width: 100%; padding: 2px 8px; text-align: left; }
-.lang-item:hover { background: var(--g2); }
+.lang-item:hover, .lang-item:focus-visible { background: var(--g2); outline: none; }
 .lang-item strong { color: var(--g5); }
 .lang-item.active strong { color: var(--a3); }
 
@@ -185,6 +189,7 @@ button:disabled { cursor: not-allowed; }
 
 /* Pages sit over the voxel field. A long page's scrollbar must not shift it against a short one. */
 .page-container { grid-area: page; min-height: 0; overflow: hidden auto; scrollbar-gutter: stable; }
+.page-container:has(> .mods-page) { overflow: hidden; }
 .page { max-width: 960px; padding: 24px 32px 32px; }
 .page-header { display: flex; flex-wrap: wrap; align-items: center; justify-content: space-between; gap: 16px 24px; margin-bottom: 24px; }
 .page h1 { font-size: 32px; line-height: 44px; text-shadow: 2px 2px 0 var(--ink); }
@@ -192,7 +197,7 @@ button:disabled { cursor: not-allowed; }
 .cache-banner { line-height: 24px; color: var(--a3); text-shadow: 2px 2px 0 var(--ink); }
 .empty-state { color: var(--g5); text-shadow: 2px 2px 0 var(--ink); }
 
-.error-banner, .launch-error, .install-error {
+.error-banner, .launch-error, .install-error, .inline-error {
   padding: 8px 16px;
   background: var(--ink); color: var(--r3);
   box-shadow: inset var(--px) 0 0 var(--r2);
@@ -201,7 +206,7 @@ button:disabled { cursor: not-allowed; }
 }
 
 /* The banner's corner, a three pixel step, on anything framed. */
-.card, .version-entry, .note-entry {
+.card, .version-entry, .note-entry, .framed {
   background: var(--g1);
   clip-path: polygon(
     calc(var(--px) * 2) 0, calc(100% - var(--px) * 2) 0, calc(100% - var(--px) * 2) var(--px), calc(100% - var(--px)) var(--px),
@@ -215,6 +220,12 @@ button:disabled { cursor: not-allowed; }
 .hero { margin-bottom: 24px; }
 .page .hero-title { font-size: 80px; line-height: 72px; text-shadow: 4px 4px 0 var(--ink); }
 .hero-version-badge { margin-top: 8px; font-size: 16px; line-height: 24px; color: var(--a2); text-shadow: 2px 2px 0 var(--ink); }
+.hero-version-badge.bad { color: var(--r3); }
+.hero.compact { margin-bottom: 16px; }
+.hero.compact .hero-header { display: flex; flex-wrap: wrap; align-items: baseline; gap: 0 24px; }
+.page .hero.compact .hero-title { font-size: 48px; line-height: 48px; text-shadow: 2px 2px 0 var(--ink); }
+.hero.compact .hero-version-badge { margin-top: 0; }
+.hero.compact .hero-play-area { margin-top: 16px; }
 .hero-play-area { display: flex; flex-wrap: wrap; align-items: flex-start; gap: 16px; margin-top: 24px; }
 .btn-play { --top: 12px; --side: 32px; font-size: 32px; line-height: 32px; }
 .launch-error { display: flex; align-items: center; justify-content: space-between; gap: 16px; margin-top: 16px; max-width: 640px; }
@@ -234,6 +245,12 @@ button:disabled { cursor: not-allowed; }
 .detail-row { display: grid; grid-template-columns: 160px minmax(0, 1fr); gap: 24px; align-items: baseline; }
 .detail-row + .detail-row { margin-top: 4px; }
 .detail-label { color: var(--g5); }
+/* Home's instance card: the folder's button on the title's line, the details on one line that wraps. */
+.instance-head { display: flex; align-items: center; justify-content: space-between; gap: 12px; margin-bottom: 8px; }
+.instance-head .card-title { margin-bottom: 0; }
+.instance-line { display: flex; flex-wrap: wrap; align-items: center; gap: 4px 32px; margin: 0; }
+.instance-pair { display: flex; align-items: center; gap: 12px; min-width: 0; }
+.instance-pair dd { margin: 0; min-width: 0; overflow-wrap: anywhere; }
 .btn-open-folder { justify-self: start; margin-top: 4px; }
 .select-version-hint { color: var(--g5); }
 
@@ -249,8 +266,10 @@ button:disabled { cursor: not-allowed; }
 .prerelease-badge { background: var(--g3); color: var(--pale); }
 .version-meta { display: flex; flex-wrap: wrap; gap: 0 24px; margin-top: 4px; line-height: 24px; color: var(--g5); }
 .version-actions { display: flex; flex-wrap: wrap; align-items: center; justify-content: flex-end; gap: 8px 16px; }
-.version-actions:has(.install-error) { flex-basis: 100%; }
-.install-error { flex-basis: 100%; }
+.version-actions:has(.install-error, .launch-error, .version-blockers, .version-crash) { flex-basis: 100%; }
+.install-error, .version-actions .launch-error, .version-blockers, .version-crash { flex-basis: 100%; }
+.version-blockers, .version-crash { text-align: left; }
+.version-crash .mod-failure, .version-blockers .blockers.play-blocked { max-width: none; margin: 0; }
 
 .progress-container { width: 320px; }
 .progress-bar { height: 16px; padding: var(--px); background: var(--ink); }
@@ -269,3 +288,392 @@ button:disabled { cursor: not-allowed; }
 .note-gap { height: 12px; }
 .note-item { position: relative; padding-left: 24px; margin-top: 4px; }
 .note-item::before { content: ""; position: absolute; left: 0; top: 8px; width: 8px; height: 8px; background: var(--a2); box-shadow: 0 2px 0 var(--a1); }
+
+/* Mods */
+.btn-small { --top: 2px; --side: 12px; }
+.toggle.on { --face: var(--a2); --lit: var(--a3); --edge: var(--a1); color: var(--ink); }
+.toggle.on:hover:not(:disabled) { --face: var(--a3); --lit: #ffe0a0; }
+.toggle { --top: 2px; --side: 12px; display: inline-flex; align-items: center; gap: 8px; }
+.toggle-knob { width: 12px; height: 12px; box-shadow: inset 0 0 0 var(--px) currentColor; }
+.toggle.on .toggle-knob { background: currentColor; }
+.link-btn { color: var(--g5); line-height: 24px; text-decoration: underline; text-decoration-thickness: 2px; text-underline-offset: 4px; white-space: nowrap; }
+.link-btn:hover { color: var(--a3); }
+
+.header-for { color: var(--g5); text-shadow: 2px 2px 0 var(--ink); }
+/* A refresh whose index is in while a source is still asked: the button pulses, its title names the source. */
+.mods-refresh.pending { animation: pending-pulse 1s steps(2) infinite; }
+@keyframes pending-pulse { 50% { opacity: .5; } }
+@media (prefers-reduced-motion: reduce) { .mods-refresh.pending { animation: none; box-shadow: inset 0 calc(-1 * var(--px)) 0 var(--a2); } }
+.version-select.compact .version-select-btn { --top: 8px; min-width: 160px; }
+.version-select.compact .version-select-menu { top: 56px; }
+
+.switch { display: flex; }
+.mods-toolbar { display: flex; flex-wrap: wrap; align-items: center; justify-content: space-between; gap: 8px 16px; margin-bottom: 8px; }
+.toolbar-actions .btn-flat { min-width: 0; }
+.toolbar-actions { display: flex; flex-wrap: wrap; gap: 8px; }
+/* The Mods page fills the window: its header, version picker, switch, toolbar and notes stay put,
+   and only the list under them scrolls. */
+.page.mods-page { display: flex; flex-direction: column; height: 100%; padding-top: 8px; padding-bottom: 0; }
+.mods-page > * { flex: none; }
+.mods-page .page-header { margin-bottom: 4px; }
+.mods-page .page-header h1 { line-height: 40px; }
+/* The page's own controls are flat, like the switch beside them and the bar above: two short
+   lines of chrome, so the list keeps the height. Raised blocks are for what acts on a mod. */
+.mods-page .page-header h1 { font-size: 24px; line-height: 32px; }
+.mods-page .header-actions { gap: 8px 12px; }
+.mods-page .version-select.compact .version-select-btn,
+.mods-page .version-select.compact .version-select-btn:is(:active:not(:disabled), :disabled) {
+  height: 32px; padding: 4px 12px; gap: 12px; min-width: 144px;
+  background: var(--g2); box-shadow: inset 0 calc(-1 * var(--px)) 0 var(--g1);
+}
+.mods-page .version-select.compact .version-select-btn:hover:not(:disabled) { background: var(--g3); }
+.mods-page .version-select.compact .version-select-menu { top: 36px; }
+.mods-page .icon-btn { width: 40px; padding: 0; display: grid; place-items: center; }
+.mods-panel { flex: 1 1 auto; min-height: 0; scroll-padding-bottom: calc(16px + var(--toast-room, 0px)); overflow-y: auto; overscroll-behavior: contain; padding-bottom: 16px; scrollbar-gutter: stable; margin-right: -8px; padding-right: 8px; }
+.mods-panel:focus { outline: none; }
+/* Behind the rows and cards, a near-opaque backing: the field's bright seams don't show between them and compete with the text. */
+.mods-panel { background: #14161ef2; }
+/* Browse's filters stay on top as the cards scroll: a card brought into view by focus stops
+   below them, not half under them. (Banners and toasts are outside the scroller.) */
+.mods-panel:has(.filters) { scroll-padding-top: 64px; }
+/* Browse's search and filters stay above its cards. */
+.mods-panel .filters { position: sticky; top: 0; z-index: 2; padding-bottom: 8px; margin-bottom: 0; background: linear-gradient(var(--seam) 0 calc(100% - 8px), transparent 0); }
+.switch button { height: 32px; padding: 2px 12px; background: var(--g2); box-shadow: inset 0 calc(-1 * var(--px)) 0 var(--g1); }
+.switch button:hover:not(.on) { background: var(--g3); }
+/* The selected view is the dark tab with the amber underline. Amber on a pale tab can't be both
+   amber and readable; on the dark one the count stays bright amber (10.5:1). */
+.switch button.on { background: var(--deep); color: var(--pale); box-shadow: inset 0 calc(-1 * var(--px)) 0 var(--a2); }
+/* The count is only coloured text, selected or not: the same box both ways, so neither tab moves
+   when the selection changes. */
+.switch .count { margin-left: 8px; color: var(--a2); font-variant-numeric: tabular-nums; }
+.switch button.on .count { color: var(--a3); }
+
+.banners { display: grid; grid-template-columns: minmax(0, 1fr); gap: 8px; margin-bottom: 8px; }
+.banners:empty { display: none; }
+.banner { display: flex; align-items: center; justify-content: space-between; gap: 16px; padding: 4px 8px 4px 16px; min-height: 40px; background: var(--ink); line-height: 24px; }
+.banner > span { padding: 0; }
+.banner-text { min-width: 0; }
+/* The folded row: the cause in a few words, whole (it wraps rather than being cut), then what it
+   is about (a repo, names), which may be cut with the full text a hover or Tab away. */
+.banner-summary { display: flex; flex-wrap: wrap; align-items: baseline; column-gap: 8px; flex: 1 1 auto; }
+.banner-cause { min-width: 0; overflow-wrap: anywhere; }
+.banner-subject { flex: 1 1 0; min-width: 8ch; }
+/* Right under a banner shown in full: one block of notes, not two with a gap between. */
+.banner-fold.docked { margin-top: -6px; }
+.banner-actions { display: flex; flex-wrap: wrap; justify-content: flex-end; gap: 8px; flex: none; }
+.banner.compact { min-height: 32px; padding-top: 0; padding-bottom: 0; }
+.banner.compact .banner-toggle { flex: none; }
+/* Open, the notes scroll in a box of their own, so the list below stays on screen. */
+.banner-fold.open { display: grid; gap: 4px; }
+.banner-group { display: grid; gap: 8px; max-height: 168px; overflow-y: auto; overscroll-behavior: contain; }
+.banner-group[hidden] { display: none; }
+.banner-fold.open .banner-toggle { justify-self: start; }
+.banner-detail { color: var(--g5); }
+/* One blocking mod at a time, whole: its name, why, and every fix, never cut by a scroller. A
+   pager goes to the others. However many mods block, the banner is the same few lines tall. */
+.blockers.in-banner { width: 100%; gap: 4px; }
+.blocker-pager { display: inline-flex; align-items: center; gap: 4px; flex: none; margin-left: auto; color: var(--pale); }
+.pager-btn { width: 28px; height: 28px; line-height: 24px; background: var(--g2); color: var(--pale); box-shadow: inset 0 calc(-1 * var(--px)) 0 var(--g1); }
+.pager-btn:hover { background: var(--g3); }
+.pager-at { min-width: 56px; text-align: center; white-space: nowrap; }
+.banner .blocker { display: grid; gap: 4px; }
+/* The sentence (with "Turn off all" at its right when that fixes every one); the fixes and the
+   pager to the other mods on the line below. */
+.blocker-head { display: flex; align-items: flex-start; gap: 4px 12px; }
+.blocker-head > .blocker-text { flex: 1 1 auto; min-width: 0; }
+.blocker-line { display: block; }
+.blocker-line strong { color: var(--a3); }
+.banner .blocker-text { color: var(--g5); }
+.blocker-lead { color: var(--r3); }
+.blocker-foot { display: flex; flex-wrap: wrap; align-items: center; gap: 4px 12px; }
+.banner .blocker-actions { gap: 8px; }
+
+/* The banners' buttons: flat, like the switch and the bar's, so a banner is a line or two, not
+   the height of a raised block. */
+.btn-flat { height: 32px; padding: 2px 12px; line-height: 24px; white-space: nowrap; flex: none; background: var(--g2); color: var(--pale); box-shadow: inset 0 calc(-1 * var(--px)) 0 var(--g1); }
+.btn-flat:hover:not(:disabled) { background: var(--g3); }
+.btn-flat.primary { background: var(--a2); color: var(--ink); box-shadow: inset 0 var(--px) 0 var(--a3), inset 0 calc(-1 * var(--px)) 0 var(--a1); }
+.btn-flat.primary:hover:not(:disabled) { background: var(--a3); }
+.btn-flat:disabled { background: var(--g1); color: var(--g4); box-shadow: none; }
+
+/* Results over the bottom of the list. The list's own padding makes room for them under its last row. */
+.mods-list-area { flex: 1 1 auto; min-height: 0; display: flex; flex-direction: column; position: relative; }
+.mods-list-area > .mods-panel { padding-bottom: calc(16px + var(--toast-room, 0px)); }
+.toasts { position: absolute; left: 0; right: 8px; bottom: 8px; z-index: 3; display: grid; gap: 8px; }
+.toasts[hidden] { display: none; }
+.banner.toast { box-shadow: inset var(--px) 0 0 currentColor, 0 0 0 var(--px) var(--seam); }
+.banner.toast.ok { box-shadow: inset var(--px) 0 0 var(--v2), 0 0 0 var(--px) var(--seam); }
+.banner.toast.warn { box-shadow: inset var(--px) 0 0 var(--a2), 0 0 0 var(--px) var(--seam); }
+.banner.toast.bad { box-shadow: inset var(--px) 0 0 var(--r2), 0 0 0 var(--px) var(--seam); }
+.banner.toast.info { box-shadow: inset var(--px) 0 0 var(--g4), 0 0 0 var(--px) var(--seam); }
+.banner-line { display: block; }
+.banner .btn-secondary { flex: none; }
+.banner.info { color: var(--pale); box-shadow: inset var(--px) 0 0 var(--g4); }
+.banner.ok { color: var(--v3); box-shadow: inset var(--px) 0 0 var(--v2); }
+.banner.warn { color: var(--a3); box-shadow: inset var(--px) 0 0 var(--a2); }
+.banner.bad { color: var(--r3); box-shadow: inset var(--px) 0 0 var(--r2); }
+
+.text-input { height: 40px; padding: 6px 12px; background: var(--ink); color: var(--pale); border: 0; border-radius: 0; font: inherit; box-shadow: inset 0 var(--px) 0 #07080c; -webkit-user-select: text; user-select: text; min-width: 0; }
+.text-input::placeholder { color: var(--g5); }
+.text-input:focus-visible { outline: var(--px) solid var(--a2); outline-offset: 0; }
+.text-input::-webkit-search-cancel-button { display: none; }
+
+.filters { display: flex; flex-wrap: wrap; align-items: center; gap: 8px 20px; margin-bottom: 8px; }
+.filters .text-input { height: 36px; }
+.filters .search { flex: 1 1 160px; }
+.checkbox { display: inline-flex; align-items: center; gap: 8px; cursor: pointer; white-space: nowrap; text-shadow: 2px 2px 0 var(--ink); }
+.checkbox input { position: absolute; opacity: 0; width: 1px; height: 1px; }
+.checkbox .box { width: 16px; height: 16px; flex: none; background: var(--ink); box-shadow: inset 0 0 0 var(--px) var(--g3); }
+.checkbox input:checked + .box { background: var(--a2); box-shadow: inset 0 0 0 var(--px) var(--a1); }
+.checkbox input:focus-visible + .box { outline: var(--px) solid var(--pale); outline-offset: 2px; }
+
+.mod-list, .mod-grid, .checks, .source-list { margin: 0; padding: 0; list-style: none; }
+.mod-list { display: grid; gap: 8px; }
+/* A row: the icon; the name with its tier; under them the version and what the launcher knows;
+   the buttons at the right. A row with a reason gives that reason the width under the buttons
+   too, so it is read whole in a line or two rather than squeezed into the name's column. */
+.mod-row {
+  display: grid; grid-template-columns: 48px minmax(0, 1fr) auto;
+  grid-template-areas: "icon title actions" "icon meta actions";
+  align-items: center; gap: 0 8px; padding: 4px 4px 4px 8px;
+}
+.mod-row.wide { grid-template-areas: "icon title actions" "icon meta meta"; }
+/* A very long name has the row's width; the switch and Remove go to the line under it. */
+.mod-row.long-name { grid-template-areas: "icon title title" "icon meta actions"; }
+.mod-row.long-name.wide { grid-template-areas: "icon title title" "icon meta meta" "icon . actions"; }
+/* Asked before a switch is turned on that would stop Play: the reason and the choice, under the row. */
+.mod-ask { grid-column: 2 / -1; display: flex; flex-wrap: wrap; align-items: center; justify-content: space-between; gap: 4px 12px; margin-top: 4px; padding: 4px 8px; background: var(--ink); box-shadow: inset var(--px) 0 0 var(--r2); line-height: 24px; }
+.mod-ask-text { flex: 1 1 320px; min-width: 0; overflow-wrap: anywhere; color: var(--g5); }
+.mod-ask-lead { display: block; color: var(--r3); }
+.mod-ask-line { display: block; }
+.mod-ask-actions { display: flex; flex-wrap: wrap; gap: 8px; }
+.mod-row > .mod-icon { grid-area: icon; align-self: start; }
+.mod-row.is-off { background: #20252f; }
+/* Off: the switch and its word say so. The name turns a solid grey that still reads (5.6:1), never faded by opacity. */
+.mod-row.is-off .mod-name { color: var(--g5); }
+.mod-row.is-off .mod-icon { opacity: .55; }
+.mod-row.has-problem { box-shadow: inset var(--px) 0 0 var(--r2); }
+.mod-icon { width: 48px; height: 48px; display: grid; place-items: center; background: var(--ink); flex: none; }
+.mod-icon img { image-rendering: pixelated; }
+/* The name whole, and its tier beside it: both are what the player decides by, so neither is
+   cut. When they don't fit side by side the tier goes under the name, a line of its own. */
+.mod-title { grid-area: title; display: flex; flex-wrap: wrap; align-items: center; gap: 0 12px; min-width: 0; align-self: end; }
+.mod-name { font-size: 24px; line-height: 32px; color: var(--a3); }
+.mod-row .mod-name { min-width: 0; overflow-wrap: anywhere; }
+.mod-title .mod-badges { display: flex; flex-wrap: wrap; align-items: center; gap: 0 8px; min-width: 0; }
+.mod-title .mod-badges > .badge { flex: none; }
+.mod-version { color: var(--g5); }
+.mod-meta { grid-area: meta; display: flex; flex-wrap: wrap; align-items: baseline; gap: 0 8px; min-width: 0; color: var(--g5); line-height: 24px; align-self: start; }
+.mod-meta > .mod-version { flex: none; }
+.mod-meta > .mod-version:not(:last-child)::after { content: "·"; margin-left: 8px; }
+.mod-meta > .mod-meta-text { flex: 1 1 0; min-width: 8ch; }
+/* A reason reads as a sentence after the version: it wraps under it, across the row. */
+.mod-row.wide .mod-meta { display: block; overflow-wrap: anywhere; }
+.mod-row.wide .mod-meta > * { margin-right: 8px; }
+.mod-row.wide .mod-meta > .mod-version:not(:last-child)::after { margin-left: 8px; }
+.mod-row.wide .mod-meta > .chip { display: inline-flex; vertical-align: bottom; }
+.mod-meta.bad > .mod-reason { color: var(--r3); }
+.mod-update-why { flex-basis: 100%; color: var(--a3); line-height: 24px; }
+.update-btn-row { display: inline-flex; align-items: center; gap: 8px; }
+.update-btn-row .pixel-icon { margin-top: 0; }
+/* A flat button the height of a line of text, for an action inside a line (an update by its version). */
+.btn-flat.chip { height: 24px; padding: 0 8px; box-shadow: inset 0 calc(-1 * var(--px)) 0 var(--a1); align-self: center; }
+.btn-flat.chip:disabled { box-shadow: none; }
+.mod-actions { grid-area: actions; display: flex; align-items: center; gap: 8px; }
+/* Narrow blocks, so the name and its tier keep the room. */
+.mod-actions :is(.btn-small, .toggle) { --side: 8px; }
+.mod-actions .toggle { gap: 4px; }
+.mod-actions .progress-container { width: 200px; }
+.mod-card-foot .progress-container { width: 160px; }
+.progress-container.compact .progress-label { margin-top: 0; }
+
+.badge { display: inline-flex; align-items: center; gap: 6px; padding: 0 8px; line-height: 24px; white-space: nowrap; cursor: default; }
+.trust-reviewed { background: var(--v2); color: var(--ink); box-shadow: inset 0 calc(-1 * var(--px)) 0 var(--v1); }
+.trust-unreviewed { background: var(--g3); color: var(--pale); box-shadow: inset 0 calc(-1 * var(--px)) 0 var(--g2); }
+.trust-unverified { background: var(--r3); color: var(--ink); box-shadow: inset 0 calc(-1 * var(--px)) 0 var(--r2); }
+/* Small text at 4.5:1 or more: #b9c1d3 on --g2 is 6.6:1, ink on #e0705a 5.2:1. */
+.badge.channel { background: var(--g2); color: #b9c1d3; }
+/* The index's own state, never a mod's tier: signed and checked (7.6:1), old or a saved copy
+   (amber, ink on --a2 8:1), or never verified (5.7:1). */
+.badge.index-badge.ok { background: var(--g2); color: var(--v3); box-shadow: inset 0 calc(-1 * var(--px)) 0 var(--g1); }
+.badge.index-badge.stale { background: var(--a2); color: var(--ink); box-shadow: inset 0 calc(-1 * var(--px)) 0 var(--a1); }
+.badge.index-badge.none { background: var(--g2); color: var(--r3); box-shadow: inset 0 calc(-1 * var(--px)) 0 var(--g1); }
+.source-meta.warn { color: var(--a3); }
+.badge.revoked { background: #e0705a; color: var(--ink); box-shadow: inset 0 calc(-1 * var(--px)) 0 var(--r1); }
+
+.mod-grid { display: grid; grid-template-columns: repeat(auto-fill, minmax(300px, 1fr)); gap: 8px; }
+/* The name has the card's whole width: the tier and where it is from sit on the line under it,
+   and the button beside the summary. */
+.mod-card { display: grid; align-content: start; grid-template-columns: 48px minmax(0, 1fr) auto; grid-template-areas: "icon title title" "icon badges badges" "summary summary summary" "by by foot"; gap: 0 12px; padding: 8px 12px; }
+.mod-card-head { display: contents; }
+.mod-card-head .mod-icon { grid-area: icon; align-self: start; }
+.mod-card-title { grid-area: title; min-width: 0; }
+.mod-card-title .mod-name { display: block; }
+.mod-name-btn { display: block; max-width: 100%; text-align: left; }
+.mod-name-btn:hover .mod-name { text-decoration: underline; text-decoration-thickness: 2px; text-underline-offset: 4px; }
+.mod-card-version { flex: none; color: var(--g5); line-height: 24px; }
+.mod-badges { grid-area: badges; display: flex; flex-wrap: wrap; align-items: center; gap: 0 8px; min-width: 0; }
+.mod-card-by { grid-area: by; align-self: center; min-width: 0; color: var(--g5); line-height: 24px; overflow-wrap: anywhere; margin-top: 4px; }
+.mod-badges > .badge { flex: none; }
+.mod-summary { grid-area: summary; color: #b9c1d3; line-height: 24px; height: 24px; margin-top: 4px; align-self: start; }
+.mod-card-foot { grid-area: foot; display: flex; flex-direction: column; align-items: flex-end; justify-content: flex-end; gap: 0; margin-top: 4px; }
+.mod-card-foot .needs-net { color: var(--a3); font-size: 16px; line-height: 24px; white-space: nowrap; }
+/* Offline, the note goes beside the button on a line of its own, under who it is from. */
+.mod-card.needs-net-card { grid-template-areas: "icon title title" "icon badges badges" "by by by" "foot foot foot"; }
+.needs-net-card .mod-card-foot { flex-direction: row; align-items: center; justify-content: flex-end; gap: 12px; }
+.needs-net-card .needs-net { order: -1; }
+.installed-mark { color: var(--v3); line-height: 24px; white-space: nowrap; }
+
+.empty-state p + p { margin-top: 8px; }
+.framed-empty { padding: 24px; background: #1a1e28cc; max-width: 640px; }
+.empty-state .hint { color: var(--g5); }
+.empty-actions { display: flex; flex-wrap: wrap; gap: 12px; margin-top: 16px; }
+.framed-empty > .btn-primary { margin-top: 16px; }
+
+/* Dialog */
+.scrim { position: fixed; inset: 0; z-index: 20; display: grid; place-items: center; padding: 16px; background: #07080ccc; }
+.dialog { display: flex; flex-direction: column; width: min(720px, 100%); max-height: 100%; overflow: hidden; box-shadow: 0 0 0 var(--px) var(--ink); }
+.dialog-head { flex: none; padding: 16px 24px 0; }
+.dialog-body { flex: 1 1 auto; min-height: 0; overflow-y: auto; padding: 0 24px 4px; overscroll-behavior: contain; }
+.dialog-body > :first-child { margin-top: 12px; }
+.dialog-title { font-size: 24px; line-height: 32px; color: var(--a3); overflow-wrap: anywhere; }
+.dialog-title:focus { outline: none; }
+.dialog-sub { margin-top: 4px; color: var(--g5); line-height: 24px; display: flex; flex-wrap: wrap; align-items: center; gap: 4px 8px; }
+.dialog-sub code, .check code { color: var(--a3); }
+.dialog-summary { margin-top: 12px; color: #b9c1d3; line-height: 24px; }
+.dialog-field { display: flex; flex-wrap: wrap; align-items: center; gap: 8px 12px; margin-top: 12px; }
+.dialog-field .dialog-note { margin: 0; }
+.dialog-field .text-input { flex: 1; }
+.dialog-field-label { color: var(--g5); white-space: nowrap; }
+.dialog-field-value { color: var(--a3); }
+.checks { display: grid; gap: 6px; margin-top: 16px; }
+.check { display: grid; grid-template-columns: 24px minmax(0, 1fr); gap: 12px; align-items: start; line-height: 24px; }
+.check[hidden] { display: none; }
+.check-fold { color: var(--g5); }
+.check-fold:not(.check-yes) .check-mark { background: none; }
+.check-mark { width: 24px; height: 24px; display: grid; place-items: center; }
+.check-yes .check-mark { background: var(--v2); color: var(--ink); }
+.check-no .check-mark { background: var(--r2); color: var(--ink); }
+.check-unknown .check-mark { background: var(--g3); color: var(--pale); }
+.check small { display: block; font-size: 16px; color: var(--g5); overflow-wrap: anywhere; }
+.dialog-warning { margin-top: 16px; padding: 10px 16px; background: var(--ink); line-height: 24px; }
+.dialog-warning.amber { color: var(--a3); box-shadow: inset var(--px) 0 0 var(--a2); }
+.dialog-warning.red { color: var(--r3); box-shadow: inset var(--px) 0 0 var(--r2); }
+.dialog-note { margin-top: 12px; color: var(--g5); line-height: 24px; }
+.dialog .inline-error { margin-top: 12px; }
+.dialog-actions { flex: none; display: flex; flex-wrap: wrap; align-items: center; gap: 12px; padding: 12px 24px 16px; background: var(--g1); box-shadow: 0 calc(-1 * var(--px)) 0 var(--seam); }
+.dialog-actions .progress-container { width: 280px; }
+.dialog-sub .truncate { max-width: 320px; }
+.dialog-note.trust-change { color: var(--a3); }
+.dialog-actions .spacer { flex: 1; }
+/* In the footer, beside the button it unlocks: never below the fold. */
+.typed-confirm { display: flex; flex-wrap: wrap; align-items: center; gap: 8px 12px; flex: 1 1 100%; line-height: 24px; color: var(--pale); }
+.typed-confirm strong { color: var(--a3); }
+.typed-summary { flex: 1 1 100%; color: var(--a3); line-height: 24px; }
+.typed-confirm .text-input { flex: 1 1 160px; height: 36px; }
+.source-list { display: grid; gap: 4px; margin-top: 16px; }
+.source-row { display: grid; grid-template-columns: minmax(0, 1fr) auto auto; grid-template-areas: "name retry action" "meta meta meta"; gap: 0 12px; align-items: center; padding: 8px 12px; background: var(--ink); }
+.source-row-retry { grid-area: retry; }
+.source-actions { grid-area: action; display: flex; align-items: center; gap: 12px; }
+.source-detail { color: var(--g5); overflow-wrap: anywhere; }
+.source-refresh { display: block; }
+/* The name, then what kind of source it is; the badge goes under the name when both don't fit. */
+.source-title { grid-area: name; display: flex; flex-wrap: wrap; align-items: center; gap: 4px 12px; min-width: 0; }
+.source-name { overflow-wrap: anywhere; min-width: 0; max-width: 100%; }
+/* Under the name and the buttons, across the row: a cause in Russian has room to say itself. */
+.source-meta { grid-area: meta; color: var(--g5); line-height: 24px; margin-top: 4px; }
+.source-meta.bad { color: var(--r3); }
+.source-row > button { grid-area: action; }
+.source-name.truncate { display: block; }
+.source-row.confirming { grid-template-areas: "name name name" "meta meta meta" "confirm confirm confirm"; }
+.source-confirm { grid-area: confirm; display: flex; flex-wrap: wrap; align-items: center; justify-content: space-between; gap: 8px 12px; margin-top: 8px; color: var(--a3); line-height: 24px; }
+.source-confirm-actions { display: flex; gap: 8px; }
+.source-error { grid-column: 1 / -1; margin-top: 8px; }
+.inline-error.with-action { display: flex; align-items: center; justify-content: space-between; gap: 12px; margin-top: 12px; }
+.copy-list { margin-top: 12px; }
+.browse-note { margin: 12px 0 0; color: var(--g5); }
+.copy-item { display: grid; gap: 2px; min-width: 0; }
+.copy-item-head { display: flex; flex-wrap: wrap; align-items: center; gap: 4px 12px; min-width: 0; }
+.copy-item .progress-container { width: 240px; }
+.copy-name { max-width: 100%; }
+.copy-name.whole { overflow-wrap: anywhere; }
+
+/* Home: what will load */
+.mods-line { display: flex; flex-wrap: wrap; align-items: baseline; gap: 4px 16px; margin-top: 16px; color: var(--g5); text-shadow: 2px 2px 0 var(--ink); line-height: 24px; max-width: 640px; }
+.mod-failure { display: grid; gap: 4px; justify-content: stretch; }
+.mod-failure-title { color: var(--r3); }
+.mod-failure-line { color: var(--g5); font-size: 16px; overflow-wrap: anywhere; }
+.mod-failure-why { color: var(--pale); }
+.mod-failure-actions { display: flex; flex-wrap: wrap; align-items: center; gap: 8px; margin-top: 8px; }
+/* Looking at the log and putting the notice away: links after the fixes, apart from them. */
+.mod-failure-quiet { display: flex; align-items: center; gap: 8px; margin-left: auto; color: var(--g5); }
+.mods-page .mod-failure { max-width: none; margin: 0 0 8px; }
+/* The log's own line, opened: at most four lines, scrolling inside, so the notice stays bounded. */
+.mod-failure .error-details[open] code { max-height: 96px; overflow-y: auto; overscroll-behavior: contain; }
+.mods-line .truncate { min-width: 0; max-width: 520px; }
+.blockers { display: grid; gap: 8px; justify-content: stretch; }
+/* Home: why Play is off, as big as the title over it, and the fixes right under Play. */
+.blockers.play-blocked { display: grid; align-items: stretch; margin-top: 16px; max-width: 720px; padding: 8px 16px 12px; background: var(--ink); box-shadow: inset var(--px) 0 0 var(--r2); line-height: 24px; }
+.play-off { font-size: 24px; line-height: 32px; color: var(--r3); }
+.play-blocked .blockers-title { color: var(--g5); }
+.blockers-title { color: var(--r3); }
+.blocker-list { display: grid; gap: 8px; margin: 0; padding: 0; list-style: none; }
+.blocker { display: flex; flex-wrap: wrap; align-items: center; justify-content: space-between; gap: 4px 12px; }
+.blocker-text { min-width: 0; flex: 1 1 320px; color: var(--g5); }
+.blocker-text strong { color: var(--a3); }
+.blocker-actions { display: flex; flex-wrap: wrap; gap: 8px; }
+.blockers-error { color: var(--r3); }
+
+/* Versions: mod counts and why Play is off. */
+.version-mods { color: var(--g5); }
+.version-note { flex-basis: 100%; text-align: right; line-height: 24px; }
+.version-note.bad { color: var(--r3); }
+
+/* Text cut deliberately: an ellipsis, and the full value on hover or focus. */
+.truncate { min-width: 0; overflow: hidden; }
+.truncate.lines-1 { display: inline-block; max-width: 100%; vertical-align: bottom; white-space: nowrap; text-overflow: ellipsis; }
+.truncate.lines-2 { display: -webkit-box; -webkit-box-orient: vertical; -webkit-line-clamp: 2; overflow-wrap: anywhere; }
+.truncate.lines-3 { display: -webkit-box; -webkit-box-orient: vertical; -webkit-line-clamp: 3; overflow-wrap: anywhere; }
+.truncate[tabindex]:focus-visible { outline: var(--px) solid var(--pale); outline-offset: 0; }
+/* A row with focus in it shows its cut details whole: the keyboard reads them there, with no tab
+   stop per line. (A card's summary is whole in its details, one press on its name.) */
+.mod-row:focus-within .truncate.is-cut { display: block; white-space: normal; overflow: visible; overflow-wrap: anywhere; -webkit-line-clamp: unset; }
+.code-short { cursor: help; }
+.code-full { overflow-wrap: anywhere; }
+.tip {
+  position: fixed; z-index: 40; max-width: 320px; padding: 4px 8px;
+  background: var(--ink); color: var(--pale); box-shadow: 0 0 0 var(--px) var(--g3);
+  line-height: 24px; overflow-wrap: anywhere; pointer-events: none;
+  transform: translateY(-100%);
+}
+.tip.below { transform: none; }
+
+.sr-only {
+  position: absolute; width: 1px; height: 1px; padding: 0; margin: -1px;
+  overflow: hidden; clip: rect(0, 0, 0, 0); white-space: nowrap; border: 0;
+}
+
+/* Errors: the sentence, and the backend's own words behind Details. */
+.error-text { display: block; }
+.error-text.with-action { display: flex; align-items: center; justify-content: space-between; gap: 12px; }
+.error-details { display: inline; margin-left: 8px; }
+.error-details summary { display: inline; cursor: pointer; color: var(--g5); text-decoration: underline; text-decoration-thickness: 2px; text-underline-offset: 4px; }
+.error-details summary::-webkit-details-marker { display: none; }
+.error-details[open] code { display: block; margin-top: 4px; color: var(--pale); overflow-wrap: anywhere; -webkit-user-select: text; user-select: text; }
+
+/* Progress: which file of how many, and Cancel beside the bar. */
+.progress-row { display: flex; align-items: center; gap: 12px; }
+.progress-row .progress-bar { flex: 1 1 auto; }
+.progress-label { overflow: hidden; text-overflow: ellipsis; }
+.dialog-actions .progress-container { width: auto; flex: 1 1 360px; min-width: 0; }
+.progress-container.compact .progress-row { gap: 8px; }
+
+/* A plan that changed since the player looked. */
+.plan-changes { margin-top: 12px; padding: 8px 16px; background: var(--ink); color: var(--a3); box-shadow: inset var(--px) 0 0 var(--a2); line-height: 24px; }
+.plan-changes ul { margin: 4px 0 0; padding-left: 24px; }
+.dialog-note.calm-note { color: var(--pale); }
+.check-retry { margin-left: 4px; }
+.check-same .check-mark { background: var(--g2); color: var(--pale); }
+.version-note { display: inline-flex; flex-wrap: wrap; justify-content: flex-end; align-items: center; gap: 8px 12px; }
+.filters { padding-right: 4px; }
+.mod-meta .mod-version { color: var(--g5); }
diff --git a/src/utils/never.ts b/src/utils/never.ts
new file mode 100644
index 0000000..04e2be5
--- /dev/null
+++ b/src/utils/never.ts
@@ -0,0 +1,7 @@
+/**
+ * The default of a switch that handles every case of a union: `tsc` fails here when the union
+ * grows a case the switch doesn't handle.
+ */
+export function unreachable(x: never): never {
+  throw new Error(`unhandled: ${JSON.stringify(x)}`);
+}
diff --git a/tsconfig.json b/tsconfig.json
index 8177803..be611b0 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -2,7 +2,7 @@
   "compilerOptions": {
     "target": "ES2020",
     "useDefineForClassFields": true,
-    "lib": ["ES2020", "DOM"],
+    "lib": ["ES2021", "DOM"],
     "module": "ESNext",
     "skipLibCheck": true,
 
diff --git a/vite.config.ts b/vite.config.ts
index 9b4a9db..e014d84 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -1,3 +1,4 @@
+/// <reference types="vitest/config" />
 import { defineConfig } from "vite";
 import react from "@vitejs/plugin-react";
 // @ts-expect-error type error without @types/node package
@@ -8,6 +9,12 @@ const host = process.env.TAURI_DEV_HOST;
 export default defineConfig(() => ({
   plugins: [react()],
 
+  // `npm test`: unit tests for the pure logic in src/mods and src/i18n. No DOM needed.
+  test: {
+    include: ["src/**/*.test.ts"],
+    environment: "node",
+  },
+
   // Vite options tailored for Tauri development and only applied in `tauri dev` or `tauri build`
   //
   // 1. prevent Vite from obscuring rust errors