Vehicle Mod Store integration - 23 October 2026

Patch Pipeline composition after rollback-only. Three first-party C++ copies
are replaced (Store service, Store installer and launcher), plus the affected
UI includes. One new native adapter and frontend snapshot bridge reuse the
existing vehicle library. Submodules, generated recomp sources, checked-out
runtime files and the separate website/API workflow are untouched.

The public category is Vehicles; the backend ID remains legacy. This preserves
existing published IDs, accounts, reviews, requests and hosted-file mappings.
No remote mutation or backend deployment is performed by the pipeline.

Store service download/resume allowlists include vehicle extensions. The normal
HTTP, package signature, size and SHA verification remain unchanged. Vehicle
ZIPs and standalone exports route to Library::prepare_import/import_prepared
in private transaction storage, never to the ROM patch importer. Old explicit
patch files and proof-matched historical patch archives retain their route.

Prepared artifacts have content-addressed package and portrait paths. Receipt
validation and recovery allow only those exact vehicle paths plus library.json.
The index is journal-protected before publication. The native importer publishes
the verified exports, preserves enabled state, removes only replaced catalogue
entries and leaves immutable files/history recoverable. Other active Store
owners protect shared native entries from retirement/removal.

The native vehicle snapshot enters Store inventory, duplicate detection and
receipt reconciliation. Completion refreshes Vehicles before reconciliation;
busy/pending imports fence Store writes, and Store writes fence vehicle UI jobs.
This prevents a stale snapshot from turning Installed back into Install Mod.

Standalone car uploads are validated and wrapped as deterministic stored ZIPs
inside the private upload cache, preserving exact inner bytes and resumable
upload fingerprints. This works with the existing ZIP-capable deployed API.
It does not enable unsupported hovercraft/planes or change import limits.

The preceding Rollback-only, invitation and spectator layers retain their
contracts. No gameplay, renderer, vehicle parser, seating, texture or LOD logic
is changed. audit.py checks this stage and the retained layers; package.py uses
the existing runtime-only allowlist for Windows ZIP and Linux AppImage.
Validation is compilation/linking and static inspection, not gameplay testing.
