Merge branch 'master' into tooomm-qt5

.ci/Debian12/Dockerfile

@@ -18,12 +18,12 @@ RUN apt-get update && \
         libssl-dev \
         ninja-build \
         protobuf-compiler \
+        qt6-declarative-dev \
         qt6-image-formats-plugins \
         qt6-l10n-tools \
         qt6-multimedia-dev \
-        qt6-declarative-dev \
-        qt6-svg-dev \
         qt6-shadertools-dev \
+        qt6-svg-dev \
         qt6-tools-dev \
         qt6-tools-dev-tools \
         qt6-websockets-dev \

.ci/Debian13/Dockerfile

@@ -19,12 +19,12 @@ RUN apt-get update && \
         libssl-dev \
         ninja-build \
         protobuf-compiler \
+        qt6-declarative-dev \
         qt6-image-formats-plugins \
         qt6-l10n-tools \
         qt6-multimedia-dev \
-        qt6-declarative-dev \
-        qt6-svg-dev \
         qt6-shadertools-dev \
+        qt6-svg-dev \
         qt6-tools-dev \
         qt6-tools-dev-tools \
         qt6-websockets-dev \

.ci/Fedora43/Dockerfile

@@ -9,7 +9,7 @@ RUN dnf install -y \
         ninja-build \
         openssl-devel \
         protobuf-devel \
-        qt6-{qtdeclarative,qtshadertools,qttools,qtsvg,qtmultimedia,qtwebsockets}-devel \
+        qt6-{qtdeclarative,qtmultimedia,qtshadertools,qtsvg,qttools,qtwebsockets}-devel \
         qt6-qtimageformats \
         rpm-build \
         xz-devel \

.ci/Fedora44/Dockerfile

@@ -9,7 +9,7 @@ RUN dnf install -y \
         ninja-build \
         openssl-devel \
         protobuf-devel \
-        qt6-{qtdeclarative,qtshadertools,qttools,qtsvg,qtmultimedia,qtwebsockets}-devel \
+        qt6-{qtdeclarative,qtmultimedia,qtshadertools,qtsvg,qttools,qtwebsockets}-devel \
         qt6-qtimageformats \
         rpm-build \
         xz-devel \

.ci/Ubuntu24.04/Dockerfile

@@ -18,12 +18,12 @@ RUN apt-get update && \
         libssl-dev \
         ninja-build \
         protobuf-compiler \
+        qt6-declarative-dev \
         qt6-image-formats-plugins \
         qt6-l10n-tools \
         qt6-multimedia-dev \
-        qt6-declarative-dev \
-        qt6-svg-dev \
         qt6-shadertools-dev \
+        qt6-svg-dev \
         qt6-tools-dev \
         qt6-tools-dev-tools \
         qt6-websockets-dev \

.ci/Ubuntu26.04/Dockerfile

@@ -19,12 +19,12 @@ RUN apt-get update && \
         libssl-dev \
         ninja-build \
         protobuf-compiler \
+        qt6-declarative-dev \
         qt6-image-formats-plugins \
         qt6-l10n-tools \
         qt6-multimedia-dev \
-        qt6-declarative-dev \
-        qt6-svg-dev \
         qt6-shadertools-dev \
+        qt6-svg-dev \
         qt6-tools-dev \
         qt6-tools-dev-tools \
         qt6-websockets-dev \

.ci/compile.sh

@@ -323,4 +323,88 @@ if [[ $MAKE_PACKAGE ]]; then
     BUILD_DIR="$BUILD_DIR" .ci/name_build.sh "$PACKAGE_SUFFIX"
     echo "::endgroup::"
   fi
+
+  if [[ $RUNNER_OS == Windows ]]; then
+    echo "::group::Check installer for build-tree artifacts"
+    cd "$BUILD_DIR"
+    package="$(find . -maxdepth 1 -type f -name 'Cockatrice-*.exe' -print -quit)"
+    if [[ ! $package ]]; then
+      echo "::error file=$0::Could not find installer to inspect"
+      exit 1
+    fi
+    seven_zip="$(command -v 7z || true)"
+    if [[ ! $seven_zip ]]; then
+      seven_zip="/c/Program Files/7-Zip/7z.exe"
+    fi
+    if [[ ! -f $seven_zip ]]; then
+      echo "::warning file=$0::7-Zip not found, skipping installer content check"
+    else
+      echo "Inspecting $package"
+      # Fail the build if the installer contains any path left behind by the MSBuild or
+      # Qt AUTOMOC tooling (build-tree artifacts must live in the build dir, not the install)
+      if "$seven_zip" l "$package" |
+        grep -E "_autogen|\.dir[\\/]|\.tlog|(^|[\\/])x64[\\/]|(^|[\\/])\.qt[\\/]|(^|[\\/])\.qsb[\\/]|(^|[\\/])\.lupdate[\\/]|CMakeFiles"; then
+        echo "::error file=$0::Installer contains build-tree artifacts"
+        exit 1
+      fi
+      echo "Installer content is clean"
+
+      # Fail the build if the installer is missing a Qt runtime the applications
+      # link against. The DLLs reach the package by globbing every *.dll out of
+      # the build output directories, so a module the client links statically
+      # (Qt6Multimedia.dll, Qt6QuickWidgets.dll) can be left out without anything
+      # else noticing, and the only symptom is a client that refuses to start
+      # after an update. required-qt-runtime.txt is written by the top level
+      # CMakeLists.txt from the same module list the targets are built against.
+      if [[ ! -f required-qt-runtime.txt ]]; then
+        echo "::error file=$0::required-qt-runtime.txt not found in the build dir, cannot verify the Qt runtime"
+        exit 1
+      fi
+      # 7-Zip writes CRLF on Windows, so the \r has to come off before any
+      # whole-line comparison below. Normalize separators to /, and strip the
+      # install-root prefixes an NSIS listing may carry, so the entries can be
+      # compared as exact relative paths. -xF keeps a '.' in a DLL name from
+      # being a wildcard; -i because that is how the installed tree behaves -
+      # the uninstaller clears both $INSTDIR\plugins and $INSTDIR\Plugins.
+      # The archive side and the manifest side have to agree on line endings.
+      # CMake writes required-qt-runtime.txt with the platform's line ending and
+      # 7-Zip writes CRLF on Windows, so a trailing \r survives on $entry and
+      # defeats the whole-line match - every entry then reads as missing even
+      # though the listing holds it verbatim.
+      # [$] rather than \$ so the literal dollar is a bracket expression and the
+      # linter does not read these as unexpanded shell variables (SC2016).
+      installer_paths="$("$seven_zip" l -slt "$package" | tr -d '\r' |
+        sed -n 's/^Path = //p' |
+        sed -e 's|\\|/|g' -e 's|^[$]INSTDIR/||' -e 's|^[$]OUTDIR/||' -e 's|^[$]PLUGINSDIR/||' -e 's|^\./||' -e 's|^/||')"
+      manifest="$(tr -d '\r' <required-qt-runtime.txt)"
+      missing=""
+      checked=0
+      while IFS= read -r entry; do
+        if [[ -z $entry || $entry == \#* ]]; then
+          continue
+        fi
+        checked=$((checked + 1))
+        if ! grep -qxiF "$entry" <<<"$installer_paths"; then
+          missing+=" $entry"
+        fi
+      done <<<"$manifest"
+      if [[ -n $missing ]]; then
+        echo "::error file=$0::Installer is missing required Qt runtime files:$missing"
+        # Print both sides of the comparison. A mismatch here has twice been
+        # caused by the shape of 7-Zip's output rather than by a missing file,
+        # and a bare "missing" line cannot tell those apart.
+        echo "required-qt-runtime.txt asked for $checked path(s); 7-Zip listed $(grep -c '' <<<"$installer_paths") path(s)"
+        # Indent with parameter expansion rather than sed 's/^/  /', which the
+        # linter reports as SC2001.
+        echo "--- required ---"
+        echo "${manifest//$'\n'/$'\n  '}"
+        echo "--- first 40 paths 7-Zip lists in the installer ---"
+        listed_head="$(head -40 <<<"$installer_paths")"
+        echo "${listed_head//$'\n'/$'\n  '}"
+        exit 1
+      fi
+      echo "Installer contains the full Qt runtime ($checked files)"
+    fi
+    echo "::endgroup::"
+  fi
 fi

.dockerignore

@@ -1,4 +1,3 @@
-.git/
 build/
 .github/
 .tx/

.github/workflows/desktop-build.yml

@@ -272,8 +272,8 @@ jobs:
             make_package: 1
             override_target: 13
             package_suffix: "-macOS13_Intel"
-            qt_version: 6.11.1
+            qt_version: 6.11.*
-            qt_modules: qtimageformats qtmultimedia qtwebsockets qtshadertools
+            qt_modules: qtimageformats qtmultimedia qtshadertools qtwebsockets
             soc: Intel
             type: Release
             use_ccache: 1
@@ -288,8 +288,8 @@ jobs:
             make_package: 1
             override_target: 14
             package_suffix: "-macOS14"
-            qt_version: 6.11.1
+            qt_version: 6.11.*
-            qt_modules: qtimageformats qtmultimedia qtwebsockets qtshadertools
+            qt_modules: qtimageformats qtmultimedia qtshadertools qtwebsockets
             soc: Apple
             type: Release
             use_ccache: 1
@@ -304,8 +304,8 @@ jobs:
             make_package: 1
             override_target: 15
             package_suffix: "-macOS15"
-            qt_version: 6.11.1
+            qt_version: 6.11.*
-            qt_modules: qtimageformats qtmultimedia qtwebsockets qtshadertools
+            qt_modules: qtimageformats qtmultimedia qtshadertools qtwebsockets
             soc: Apple
             type: Release
             use_ccache: 1
@@ -317,8 +317,8 @@ jobs:
 
             ccache_eviction_age: 7d
             cmake_generator: Ninja
-            qt_version: 6.11.1
+            qt_version: 6.11.*
-            qt_modules: qtimageformats qtmultimedia qtwebsockets qtshadertools
+            qt_modules: qtimageformats qtmultimedia qtshadertools qtwebsockets
             soc: Apple
             type: Debug
             use_ccache: 1
@@ -332,8 +332,8 @@ jobs:
             cmake_generator_platform: x64
             make_package: 1
             package_suffix: "-Win10"
-            qt_version: 6.11.1
+            qt_version: 6.11.*
-            qt_modules: qtimageformats qtmultimedia qtwebsockets qtshadertools
+            qt_modules: qtimageformats qtmultimedia qtshadertools qtwebsockets
             type: Release
 
     name: ${{ matrix.os }} ${{ matrix.target }}${{ matrix.soc == 'Intel' && ' Intel' || '' }}${{ matrix.type == 'Debug' && ' Debug' || '' }}
@@ -368,18 +368,20 @@ jobs:
           key: ccache-${{ matrix.runner }}_${{ matrix.override_target }}-Xcode${{ matrix.xcode }}
           path: ${{ env.CCACHE_DIR }}
 
-      - name: "Install aqtinstall"
+      - name: "[macOS] Install aqtinstall"
+        if: matrix.os == 'macOS'
         run: pipx install aqtinstall
 
       # Resolve given wildcard versions (e.g. Qt 6.6.*) to latest version via aqtinstall to avoid stale caches on new releases
-      - name: "Resolve latest Qt patch version"
+      - name: "[macOS] Resolve latest Qt from ${{ matrix.qt_version }} input"
+        if: matrix.os == 'macOS'
         env:
           QT_VERSION: ${{ matrix.qt_version }}
         id: resolve_qt_version
         shell: bash
         run: .ci/resolve_latest_aqt_qt_version.sh "$QT_VERSION"
 
-      - name: "[macOS] Restore thin Qt ${{ steps.resolve_qt_version.outputs.version }} libraries"
+      - name: "[macOS] Restore thin Qt ${{ steps.resolve_qt_version.outputs.version }}"
         if: matrix.os == 'macOS'
         id: restore_qt
         uses: actions/cache/restore@v6
@@ -389,21 +391,22 @@ jobs:
 
       # Using jurplel/install-qt-action to install Qt without using brew
       # Qt build using vcpkg either just fails or takes too long to build
-      - name: "[macOS] Install fat Qt ${{ steps.resolve_qt_version.outputs.version }}"
+      - name: "[macOS] Install fat Qt ${{ matrix.qt_version }}"
         if: matrix.os == 'macOS' && steps.restore_qt.outputs.cache-hit != 'true'
         uses: jurplel/install-qt-action@v4
         with:
           cache: false
-          dir: ${{ github.workspace }}
+          # cache-key-prefix: Qt
+          dir: ${{ github.workspace }}    # thinning script depends on this location
           modules: ${{ matrix.qt_modules }}
-          version: ${{ steps.resolve_qt_version.outputs.version }}
+          version: ${{ matrix.qt_version }}
 
       - name: "[macOS] Create thin Qt libraries"
         if: matrix.os == 'macOS' && steps.restore_qt.outputs.cache-hit != 'true'
         run: .ci/thin_macos_qtlib.sh
 
       - name: "[macOS] Cache thin Qt libraries"
-        if: matrix.os == 'macOS' && steps.restore_qt.outputs.cache-hit != 'true'
+        if: matrix.os == 'macOS' && steps.restore_qt.outputs.cache-hit != 'true' && github.ref == 'refs/heads/master'
         uses: actions/cache/save@v6
         with:
           key: ${{ steps.restore_qt.outputs.cache-primary-key }}
@@ -415,10 +418,10 @@ jobs:
         with:
           # Qt 6.11.0 only works with aqtinstall directly from git until aqtinstall 3.4 is released
           aqtsource: git+https://github.com/miurahr/aqtinstall.git
-          cache: true
+          cache: ${{ github.ref == 'refs/heads/master' }}
           cache-key-prefix: Qt
           modules: ${{ matrix.qt_modules }}
-          version: ${{ steps.resolve_qt_version.outputs.version }}
+          version: ${{ matrix.qt_version }}
 
       - name: "[Windows] Install NSIS"
         if: matrix.os == 'Windows'
@@ -450,11 +453,22 @@ jobs:
           PACKAGE_SUFFIX: '${{ matrix.package_suffix }}'
           TARGET_MACOS_VERSION: ${{ matrix.override_target }}
           USE_CCACHE: ${{ matrix.use_ccache }}
-          VCPKG_BINARY_SOURCES: 'clear;files,${{ steps.vcpkg-cache.outputs.path }},readwrite'
+          VCPKG_BINARY_SOURCES: "clear;files,${{ steps.vcpkg-cache.outputs.path }},${{ case(github.ref == 'refs/heads/master', 'readwrite', 'read') }}"
           VCPKG_DISABLE_METRICS: 1
           VCPKG_FEATURE_FLAGS: dependencygraph
         run: .ci/compile.sh --server --test --vcpkg
 
+      # CPack reports a failed makensis run as "Problem running NSIS command"
+      # plus a path to NSISOutput.log, and that log lives only on the runner, so
+      # the actual compile error is otherwise nowhere in the workflow output.
+      # Dump it, or a broken installer script is undiagnosable from CI alone.
+      # shell: bash matters here - the default pwsh resolves `find` to Windows'
+      # text-search find.exe, which errors instead of searching.
+      - name: "Dump NSIS compile log"
+        if: failure() && matrix.os == 'Windows'
+        shell: bash
+        run: find . -name NSISOutput.log -exec cat {} +
+
       # Delete used cache to emulate a ccache update. See https://github.com/actions/cache/issues/342
       - name: "[macOS] Delete remote compiler cache (ccache)"
         if: matrix.os == 'macOS' && matrix.use_ccache == 1 && github.ref == 'refs/heads/master' && steps.restore_ccache.outputs.cache-hit

.github/workflows/docker-release.yml

@@ -20,11 +20,22 @@ on:
   release:
     types:
       - released    # publishing of stable releases
+  workflow_dispatch:    # (re)publish the image for an existing stable release
+    inputs:
+      tag:
+        description: 'Existing release tag to build and publish (e.g. 2026-10-03-Release-3.1.0)'
+        required: true
+        type: string
+      latest:
+        description: 'Also update the "latest" tag'
+        required: true
+        type: boolean
+        default: true
 
-# Cancel earlier, unfinished runs of this workflow on the same branch (unless on release)
+# Cancel earlier, unfinished runs of this workflow on the same branch (unless publishing)
 concurrency:
-  group: "${{ github.workflow }} @ ${{ github.ref_name }}"
+  group: "${{ github.workflow }} @ ${{ inputs.tag || github.ref_name }}"
-  cancel-in-progress: ${{ github.event_name != 'release' }}
+  cancel-in-progress: ${{ github.event_name != 'release' && github.event_name != 'workflow_dispatch' }}
 
 env:
   GHCR_IMAGE: ghcr.io/cockatrice/servatrice
@@ -57,12 +68,14 @@ jobs:
     steps:
       - name: "Checkout"
         uses: actions/checkout@v7
+        with:
+          ref: ${{ case(github.event_name == 'workflow_dispatch', format('refs/tags/{0}', inputs.tag), '') }}
 
       - name: "Set up Docker buildx"
         uses: docker/setup-buildx-action@v4
 
       - name: "Login to GitHub Container Registry (GHCR)"
-        if: github.event_name == 'release' && github.event.release.prerelease == false
+        if: (github.event_name == 'release' && github.event.release.prerelease == false) || github.event_name == 'workflow_dispatch'
         id: login
         uses: docker/login-action@v4
         with:
@@ -70,13 +83,13 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ github.token }}
 
-      # Don't push for non-release triggers
+      # Don't push for non-publishing triggers
       - name: "Build image"
         if: steps.login.outcome != 'success'
         uses: docker/build-push-action@v7
         with:
           cache-from: type=gha,scope=${{ env.CACHE_SCOPE }}
-          cache-to: type=gha,mode=max,scope=${{ env.CACHE_SCOPE }}
+          cache-to: ${{ case(github.ref == 'refs/heads/master', format('type=gha,mode=max,scope={0}', env.CACHE_SCOPE), '') }}
           context: .
           platforms: ${{ matrix.platform }}
           push: false
@@ -111,7 +124,6 @@ jobs:
         if: steps.login.outcome == 'success'
         uses: actions/upload-artifact@v7
         with:
-          archive: false
           if-no-files-found: error
           name: digest-${{ matrix.label }}
           path: ${{ runner.temp }}/digests/*
@@ -121,7 +133,7 @@ jobs:
   # Create an OCI image index from the platform-specific image manifests
   index:
     name: "Publish multi-platform Servatrice image"
-    if: github.repository_owner == 'Cockatrice' && github.event_name == 'release' && github.event.release.prerelease == false
+    if: github.repository_owner == 'Cockatrice' && ((github.event_name == 'release' && github.event.release.prerelease == false) || github.event_name == 'workflow_dispatch')
     needs: build
     runs-on: ubuntu-slim    # https://github.com/actions/runner-images/blob/main/images/ubuntu-slim/ubuntu-slim-Readme.md
 
@@ -147,8 +159,11 @@ jobs:
           images: ${{ env.GHCR_IMAGE }}
           flavor: |
             latest=auto
+          # if semver, also: type=semver,pattern={{version}} / {{major}}.{{minor}}
           tags: |
-            type=ref,event=tag    # if semver, also: type=semver,pattern={{version}} / {{major}}.{{minor}}
+            type=ref,event=tag
+            type=raw,value=${{ inputs.tag }},enable=${{ github.event_name == 'workflow_dispatch' }}
+            type=raw,value=latest,enable=${{ github.event_name == 'workflow_dispatch' && inputs.latest }}
 
       # Add OCI annotations to image index and publish tags
       - name: "Create image index"
@@ -176,7 +191,7 @@ jobs:
 
       - name: "Inspect images"
         env:
-          GITHUB_TAG: ${{ github.ref_name }}
+          GITHUB_TAG: ${{ inputs.tag || github.ref_name }}
         run: |
           docker buildx imagetools inspect "$GHCR_IMAGE:latest"
           docker buildx imagetools inspect "$GHCR_IMAGE:$GITHUB_TAG"

.github/workflows/documentation-build.yml

@@ -41,7 +41,7 @@ jobs:
       - name: "Install Doxygen"
         uses: ssciwr/doxygen-install@v2
         with:
-          version: "1.16.1"
+          version: "1.18.0"
 
       - name: "Update Doxygen Configuration"
         run: |

CMakeLists.txt

@@ -259,7 +259,7 @@ if(UNIX)
     if(CPACK_GENERATOR STREQUAL "RPM")
       set(CPACK_RPM_PACKAGE_LICENSE "GPLv2")
       set(CPACK_RPM_MAIN_COMPONENT "cockatrice")
-      set(CPACK_RPM_PACKAGE_REQUIRES "protobuf, qt6-qttools, qt6-qtsvg, qt6-qtmultimedia, qt6-qtimageformats")
+      set(CPACK_RPM_PACKAGE_REQUIRES "protobuf, qt6-qtimageformats, qt6-qtmultimedia, qt6-qtsvg, qt6-qttools")
       set(CPACK_RPM_PACKAGE_GROUP "Amusements/Games")
       set(CPACK_RPM_PACKAGE_URL "http://github.com/Cockatrice/Cockatrice")
       # stop directories from making package conflicts
@@ -277,7 +277,7 @@ if(UNIX)
       set(CPACK_DEBIAN_PACKAGE_SHLIBDEPS ON)
       set(CPACK_DEBIAN_PACKAGE_SECTION "games")
       set(CPACK_DEBIAN_PACKAGE_HOMEPAGE "http://github.com/Cockatrice/Cockatrice")
-      set(CPACK_DEBIAN_PACKAGE_DEPENDS "libqt6multimedia6, libqt6svg6, qt6-qpa-plugins, qt6-image-formats-plugins")
+      set(CPACK_DEBIAN_PACKAGE_DEPENDS "libqt6multimedia6, libqt6svg6, qt6-image-formats-plugins, qt6-qpa-plugins")
       set(CPACK_DEBIAN_PACKAGE_RECOMMENDS "libqt6sql6-mysql") # for connecting servatrice to a mysql db
     endif()
   endif()
@@ -292,6 +292,39 @@ elseif(WIN32) # Windows (including 64bit)
   # Configure file with custom definitions for NSIS.
   configure_file("${COCKATRICE_CMAKE_PATH}/NSIS.definitions.nsh.in" "${PROJECT_BINARY_DIR}/NSIS.definitions.nsh")
 
+  # Every Qt module the client links against, as the DLL names a Windows install
+  # has to contain, plus the platform plugin without which the client cannot
+  # start. .ci/compile.sh reads this and fails the build when the packaged
+  # installer is missing one of them.
+  #
+  # Only the client is packaged on Windows, so this is the client's module list
+  # rather than the union across server, client and Oracle: demanding Oracle's or
+  # Servatrice's modules of the client installer checks nothing about the client.
+  #
+  # A statically linked Qt module ships no runtime DLL, so requiring one would
+  # fail the package check on a static build for no reason. cockatrice/CMakeLists.txt
+  # installs the runtime of every module listed here, and skips static ones the
+  # same way, so the two can never disagree.
+  #
+  # A DLL missing from the package only surfaces on a user's machine, after an
+  # update has already replaced their install, as "The code execution cannot
+  # proceed because Qt6Multimedia.dll was not found" or as a missing procedure
+  # entry point in a Qt6QuickWidgets.dll left over from the previous version.
+  # Assert it while the installer is still being built instead.
+  set(_required_qt_runtime "")
+  foreach(_qt_module IN LISTS COCKATRICE_QT_MODULES)
+    get_target_property(_qt_module_type ${_qt_module} TYPE)
+    if(_qt_module_type STREQUAL "SHARED_LIBRARY")
+      string(REGEX REPLACE "^Qt6::" "" _qt_component "${_qt_module}")
+      list(APPEND _required_qt_runtime "Qt6${_qt_component}.dll")
+    endif()
+  endforeach()
+  list(APPEND _required_qt_runtime "Plugins/platforms/qwindows.dll")
+  list(REMOVE_DUPLICATES _required_qt_runtime)
+  list(SORT _required_qt_runtime)
+  string(REPLACE ";" "\n" _required_qt_runtime "${_required_qt_runtime}")
+  file(WRITE "${PROJECT_BINARY_DIR}/required-qt-runtime.txt" "${_required_qt_runtime}\n")
+
   # include vcredist into the package; NSIS will take care of running it
   if(VCREDISTRUNTIME_FOUND)
     install(FILES "${VCREDISTRUNTIME_FILE}" DESTINATION ./)

Doxyfile

@@ -1,4 +1,4 @@
-# Doxyfile 1.16.1
+# Doxyfile 1.18.0
 
 # This file describes the settings to be used by the documentation system
 # Doxygen (www.doxygen.org) for a project.
@@ -11,7 +11,7 @@
 # TAG = value [value, ...]
 # For lists, items can also be appended using:
 # TAG += value [value, ...]
-# Values that contain spaces should be placed between quotes (\" \").
+# Values that contain spaces should be placed between quotes (" ").
 #
 # Note:
 #
@@ -81,7 +81,7 @@ OUTPUT_DIRECTORY       = docs
 # and will distribute the generated files over these directories. Enabling this
 # option can be useful when feeding Doxygen a huge amount of source files, where
 # putting all generated files in the same directory would otherwise cause
-# performance problems for the file system. Adapt CREATE_SUBDIRS_LEVEL to
+# performance problems for the file system. Adjust CREATE_SUBDIRS_LEVEL to
 # control the number of sub-directories.
 # The default value is: NO.
 
@@ -802,7 +802,7 @@ GENERATE_REQUIREMENTS  = YES
 
 # The REQ_TRACEABILITY_INFO tag controls if traceability information is shown on
 # the requirements page (only relevant when using \requirement comment blocks).
-# The setting NO will disable the traceablility information altogether. The
+# The setting NO will disable the traceability information altogether. The
 # setting UNSATISFIED_ONLY will show a list of requirements that are missing a
 # satisfies relation (through the command: \satisfies). Similarly the setting
 # UNVERIFIED_ONLY will show a list of requirements that are missing a verifies
@@ -855,8 +855,8 @@ SHOW_NAMESPACES        = YES
 # The FILE_VERSION_FILTER tag can be used to specify a program or script that
 # Doxygen should invoke to get the current version for each file (typically from
 # the version control system). Doxygen will invoke the program by executing (via
-# popen()) the command command input-file, where command is the value of the
+# popen()) the command command input_file, where command is the value of the
-# FILE_VERSION_FILTER tag, and input-file is the name of an input file provided
+# FILE_VERSION_FILTER tag, and input_file is the name of an input file provided
 # by Doxygen. Whatever the program writes to standard output is used as the file
 # version. For an example see the documentation.
 
@@ -1643,8 +1643,8 @@ DOCSET_PUBLISHER_NAME  = Publisher
 # a.o. the download links, offline (the HTML help workshop was already many
 # years in maintenance mode). You can download the HTML help workshop from the
 # web archives at Installation executable (see:
-# http://web.archive.org/web/20160201063255/http://download.microsoft.com/downlo
+# http://web.archive.org/web/20160201063255/https://download.microsoft.com/downl
-# ad/0/A/9/0A939EF6-E31C-430F-A3DF-DFAE7960D564/htmlhelp.exe).
+# oad/0/A/9/0A939EF6-E31C-430F-A3DF-DFAE7960D564/htmlhelp.exe).
 #
 # The HTML Help Workshop contains a compiler that can convert all HTML output
 # generated by Doxygen into a single compiled HTML file (.chm). Compiled HTML
@@ -1951,7 +1951,7 @@ MATHJAX_FORMAT         = HTML-CSS
 # output directory using the MATHJAX_RELPATH option. For Mathjax version 2 the
 # destination directory should contain the MathJax.js script. For instance, if
 # the mathjax directory is located at the same level as the HTML output
-# directory, then MATHJAX_RELPATH should be ../mathjax.s For Mathjax versions 3
+# directory, then MATHJAX_RELPATH should be ../mathjax. For Mathjax versions 3
 # and 4 the destination directory should contain the tex-<format>.js script
 # (where <format> is either chtml or svg). The default value points to the
 # MathJax Content Delivery Network so you can quickly see the result without
@@ -2172,9 +2172,8 @@ EXTRA_PACKAGES         =
 #
 # Note: Only use a user-defined header if you know what you are doing!
 # Note: The header is subject to change so you typically have to regenerate the
-# default header when upgrading to a newer version of Doxygen. The following
+# default header when upgrading to a newer version of Doxygen. For a description
-# commands have a special meaning inside the header (and footer): For a
+# of the possible markers and block names see the documentation.
-# description of the possible markers and block names see the documentation.
 # This tag requires that the tag GENERATE_LATEX is set to YES.
 
 LATEX_HEADER           =
@@ -2657,6 +2656,19 @@ HAVE_DOT               = YES
 
 DOT_NUM_THREADS        = 0
 
+# The DOT_BATCH_SIZE specifies the number of dot graphs Doxygen is allowed to
+# compile in a single invocation of dot. When set to 1 Doxygen will invoke dot
+# for each graph separately, which can cause significant process creation
+# overhead especially on systems with many CPU cores. Together with
+# DOT_NUM_THREADS this setting can be used to optimise the dot processing speed
+# for a particular system. Doxygen will try to give each thread a balanced batch
+# of work. If the total number of graphs to process exceeds DOT_NUM_THREADS *
+# DOT_BATCH_SIZE then additional batches will be created for dot to process.
+# Minimum value: 1, maximum value: 1000, default value: 50.
+# This tag requires that the tag HAVE_DOT is set to YES.
+
+DOT_BATCH_SIZE         = 500
+
 # DOT_COMMON_ATTR is common attributes for nodes, edges and labels of
 # subgraphs. When you want a differently looking font in the dot files that
 # Doxygen generates you can specify fontname, fontcolor and fontsize attributes.
@@ -2948,6 +2960,58 @@ PLANTUML_INCLUDE_PATH  =
 
 PLANTUMLFILE_DIRS      =
 
+# When using Mermaid diagrams with CLI rendering, the MERMAID_PATH tag should be
+# used to specify the directory where the mmdc (Mermaid CLI) executable can be
+# found. If left blank, CLI-based rendering is disabled. For HTML output,
+# client-side rendering via JavaScript is used by default and does not require
+# mmdc. For LaTeX/PDF output, mmdc is required to pre-generate images. Doxygen
+# will generate a warning when CLI rendering is needed but mmdc is not
+# available.
+
+MERMAID_PATH           =
+
+# When using Mermaid diagrams, the MERMAID_CONFIG_FILE tag can be used to
+# specify a JSON configuration file for the Mermaid CLI tool (mmdc). This file
+# can contain theme settings and other Mermaid configuration options.
+
+MERMAID_CONFIG_FILE    =
+
+# The MERMAID_RENDER_MODE tag selects how Mermaid diagrams are rendered.
+# Possible values are: AUTO (use client-side rendering for HTML and mmdc for
+# LaTeX/PDF and other formats. If MERMAID_PATH is not set, non-HTML diagrams
+# will produce a warning), CLI (use the mmdc tool to pre-generate images
+# (requires Node.js and mermaid-js/mermaid-cli). Works for all output formats)
+# and CLIENT_SIDE (embed mermaid.js in HTML output for client-side rendering.
+# Does not require mmdc but only works for HTML output).
+# The default value is: AUTO.
+
+MERMAID_RENDER_MODE    = AUTO
+
+# The MERMAID_JS_URL tag specifies the URL to load mermaid.js from when using
+# client-side rendering (MERMAID_RENDER_MODE is CLIENT_SIDE or AUTO). The
+# default points to the latest Mermaid v11 release on the jsDelivr CDN.
+#
+# The default CDN URL requires internet access when viewing the generated
+# documentation. For offline use, download mermaid.esm.min.mjs and set this to a
+# relative path, or use MERMAID_RENDER_MODE=CLI to pre-generate images instead.
+# Examples:
+# - Latest v11 (default):
+# https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs
+# - Pinned version:
+# https://cdn.jsdelivr.net/npm/mermaid@11.3.0/dist/mermaid.esm.min.mjs
+# - Local copy: ./mermaid.esm.min.mjs (user must place file in HTML output
+# directory)
+# The default value is:
+# https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs.
+
+MERMAID_JS_URL         = https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs
+
+# The MERMAIDFILE_DIRS tag can be used to specify one or more directories that
+# contain Mermaid files that are included in the documentation (see the
+# \mermaidfile command).
+
+MERMAIDFILE_DIRS       =
+
 # The DOT_GRAPH_MAX_NODES tag can be used to set the maximum number of nodes
 # that will be shown in the graph. If the number of nodes in a graph becomes
 # larger than this value, Doxygen will truncate the graph, which is visualized
@@ -2972,15 +3036,6 @@ DOT_GRAPH_MAX_NODES    = 50
 
 MAX_DOT_GRAPH_DEPTH    = 0
 
-# Set the DOT_MULTI_TARGETS tag to YES to allow dot to generate multiple output
-# files in one run (i.e. multiple -o and -T options on the command line). This
-# makes dot run faster, but since only newer versions of dot (>1.8.10) support
-# this, this feature is disabled by default.
-# The default value is: NO.
-# This tag requires that the tag HAVE_DOT is set to YES.
-
-DOT_MULTI_TARGETS      = NO
-
 # If the GENERATE_LEGEND tag is set to YES Doxygen will generate a legend page
 # explaining the meaning of the various boxes and arrows in the dot generated
 # graphs.

cmake/NSIS.template.in

@@ -12,6 +12,15 @@ Var NormalDestDir
 Var PortableDestDir
 Var PortableMode
 Var ReinstallMode
+Var AllowForceClose
+Var GuardDir
+Var OldUninstallString
+Var StaleFindHandle
+Var StaleFindName
+Var IsUpgrade
+Var AbortReason
+Var WaitPid
+Var LauncherExited
 
 !include LogicLib.nsh
 !include FileFunc.nsh
@@ -85,6 +94,7 @@ ${IfNot} ${Errors}
       /PORTABLE : Install in portable mode$\n\
       /S : Silent install$\n\
       /R : Silent upgrade$\n\
+      /PID=%pid% : Process to wait for before replacing files (used by the in-app updater)$\n\
       /D=%directory% : Specify destination directory$\n"
     Quit
 ${EndIf}
@@ -112,6 +122,23 @@ ${Else}
     StrCpy $ReinstallMode 0
 ${EndIf}
 
+; /PID= carries the process id of the application that started this installer.
+; The in-app updater launches the installer and only then quits itself, so
+; without it the installer has to guess whether the launching process is still
+; alive by polling powershell.exe for an image name - a guess that can come back
+; "not running" or "could not determine" while the process is very much alive and
+; still has its Qt DLLs mapped. An older client does not pass /PID= and an older
+; installer ignores it, so both sides of the pair have to keep working.
+; Note that /D= must stay the last parameter on the command line, which is why
+; the client puts it last and this one anywhere.
+StrCpy $WaitPid ""
+StrCpy $LauncherExited 0
+ClearErrors
+${GetOptions} $9 "/PID=" $8
+${IfNot} ${Errors}
+    StrCpy $WaitPid $8
+${EndIf}
+
 ${If} $InstDir == ""
     ; User did not use /D to specify a directory,
     ; we need to set a default based on the install mode
@@ -131,6 +158,27 @@ ${EndIf}
 ; Now that $PortableMode reflects reality, commit InstDir into the correct slot
 Call SetModeDestinationFromInstdir
 
+; Wait for the process that launched this installer to exit before anything is
+; replaced or deleted. It goes first because it is the one check here that needs
+; no powershell.exe: on a machine where the process lookup cannot run at all, the
+; launcher is still proven gone here instead of the whole upgrade being cancelled
+; by a check that was only ever a proxy for this one.
+;
+; Then make sure no *other* application instance is still running (and holding
+; file locks) before the previous version is uninstalled. On a silent update
+; (/R /S) the running processes are asked to close gracefully and waited for;
+; Cockatrice itself is never force-killed (data loss, e.g. an unsaved deck) so the
+; update is aborted instead, while the console applications Oracle and Servatrice
+; are force-stopped by PID once the grace period is over. On interactive installs
+; the user is prompted to close them instead.
+; Only needed this early for /R, where AutoUninstallIfNeeded runs below; for
+; interactive installs the section re-checks after the directory page, when
+; $INSTDIR is the directory the user actually picked.
+${If} $ReinstallMode = 1
+    Call WaitForLauncherToExit
+    Call EnsureAppsNotRunning
+${EndIf}
+
 ${If} $ReinstallMode = 1
 ${AndIf} $PortableMode = 0
     Call AutoUninstallIfNeeded
@@ -144,6 +192,9 @@ ${If} ${NSIS_IS_64_BIT} == 1
     SetRegView 64
 ${EndIf}
 
+; Ensure no application instance is still running before removing files.
+Call un.EnsureAppsNotRunning
+
 FunctionEnd
 
 Function RequireAdmin
@@ -199,6 +250,616 @@ ${EndIf}
 
 FunctionEnd
 
+; --- Running instance handling ---
+; Cockatrice, Oracle and Servatrice must not be running while files are
+; replaced or deleted. A still-running process holds locks on its .exe and
+; Qt runtime DLLs, so a silent upgrade could otherwise end up with a mix of
+; old and new Qt DLLs next to the new executable, failing with
+; "The procedure entry point X could not be located in the dynamic link
+; library ...Qt6Network.dll" on the next start.
+;
+; On a silent update (/R /S) matching processes are asked to close gracefully
+; (WM_CLOSE) and waited for up to 60 s. Cockatrice is never force-stopped: it
+; may be holding an unsaved deck or showing a "really leave this game?"
+; confirmation, so if it refuses to close the install is aborted - nothing has
+; been replaced yet, so the update is simply deferred. Oracle and Servatrice
+; are console applications without a main window, so CloseMainWindow() does
+; nothing for them and waiting cannot help; they hold no unsaved user data and
+; are force-stopped by PID once the grace period is over. On interactive
+; installs and uninstalls the user is prompted to close them instead.
+;
+; Processes are matched by image name AND by their executable path living
+; under the guarded directory ($GuardDir, normally $INSTDIR), so unrelated
+; processes that merely share an image name (e.g. the Oracle DB instance
+; "oracle.exe") are never touched.
+
+; usage: set $R2 to the base image name (without extension, e.g. "cockatrice",
+;        as accepted by Get-Process -Name), call this, result in $R0
+;        (1 = running from $GuardDir, 0 = not running, 2 = could not determine)
+Function IsAppRunning
+    ; Every caller has to set $GuardDir; an empty one would make the path check
+    ; below match every process that merely shares the image name, which is the
+    ; opposite of what this guard is for.
+    ${If} $GuardDir == ""
+        StrCpy $R0 2
+        Return
+    ${EndIf}
+    ; Pass the directory to guard to PowerShell via an environment variable so
+    ; it never has to be embedded into the -Command string: apostrophes in a
+    ; path would terminate the command early, and the path in a -like pattern
+    ; would treat [ and ] as wildcard characters.
+    System::Call 'kernel32::SetEnvironmentVariable(t, t) i ("COCKATRICE_GUARD_DIR", "$GuardDir")'
+    ; Exit the process explicitly so nsExec's pop reflects whether a matching
+    ; process was found: powershell.exe exits 0 whether or not the pipeline
+    ; produced objects. 0 = not running, 1 = running, anything else = could not
+    ; be determined (see IsProcessLookupAvailable).
+    ; A process is only a match when its path is readable and lives under
+    ; $GuardDir. A process we cannot inspect is not one of ours: the updater is
+    ; always started by the application it updates, so it runs in the same user
+    ; session, and an interactive install is elevated and can read the paths of
+    ; the user's own processes. Assuming a match instead would be a hard stop
+    ; rather than a fail-closed guard - an Oracle database instance running as
+    ; SYSTEM has a process named "oracle" whose path raises Access denied, and
+    ; that would make every silent update abort and every interactive install
+    ; loop on the Retry prompt with no way out but Cancel.
+    nsExec::ExecToLog 'powershell -NoProfile -Command "if (Get-Process -Name $\'$R2$\' -ErrorAction SilentlyContinue | Where-Object { try { $$p = $$_.Path; if ($$p) { $$p.StartsWith($$env:COCKATRICE_GUARD_DIR, [StringComparison]::OrdinalIgnoreCase) } else { $$false } } catch { $$false } } | Select-Object -First 1) { exit 1 } else { exit 0 }"'
+    Pop $R0
+    ${If} $R0 == "0"
+        StrCpy $R0 0
+    ${ElseIf} $R0 == "1"
+        StrCpy $R0 1
+    ${Else}
+        ; powershell.exe could not be run at all (nsExec pushes the string
+        ; "error"), or died with an unexpected code. That is "could not
+        ; determine", which has to stay distinguishable from "definitely
+        ; running": a state that can never clear would block the installer
+        ; forever. IsProcessLookupAvailable warns about that case once.
+        StrCpy $R0 2
+    ${EndIf}
+FunctionEnd
+
+; Sets $R0 to 1 if PowerShell can be started at all, 0 if it cannot. The
+; running instance check is built on top of it, so a machine where
+; powershell.exe is missing, blocked by policy or refused by antivirus is
+; reported once instead of being reported as "Cockatrice is running" on every
+; single check.
+Function IsProcessLookupAvailable
+    nsExec::ExecToLog 'powershell -NoProfile -Command "exit 0"'
+    Pop $R0
+    ${If} $R0 == "0"
+        StrCpy $R0 1
+    ${Else}
+        StrCpy $R0 0
+    ${EndIf}
+FunctionEnd
+
+Function CloseMatchingApps
+    ; gracefully ask every matching instance to close (sends WM_CLOSE)
+    ;
+    ; The filter here is deliberately the strict one: a process is only asked to
+    ; close when its path is readable and lives under $GuardDir. Treating a
+    ; process whose path cannot be read (an unrelated oracle.exe / servatrice.exe,
+    ; or one owned by another account running as SYSTEM) as a match would make
+    ; the installer close a third party application, and it runs elevated, so
+    ; CloseMainWindow() would succeed on it.
+    System::Call 'kernel32::SetEnvironmentVariable(t, t) i ("COCKATRICE_GUARD_DIR", "$GuardDir")'
+    nsExec::ExecToLog 'powershell -NoProfile -Command "Get-Process -Name $\'$R2$\' -ErrorAction SilentlyContinue | Where-Object { try { $$p = $$_.Path; if ($$p) { $$p.StartsWith($$env:COCKATRICE_GUARD_DIR, [StringComparison]::OrdinalIgnoreCase) } else { $$false } } catch { $$false } } | ForEach-Object { $$null = $$_.CloseMainWindow() }"'
+    Pop $R3
+FunctionEnd
+
+Function ForceCloseApps
+    ; stop the matching instances by PID once the grace period is over. Only
+    ; used for the console applications ($AllowForceClose), which have no window
+    ; to close and hold no unsaved user data. Same strict filter as above.
+    System::Call 'kernel32::SetEnvironmentVariable(t, t) i ("COCKATRICE_GUARD_DIR", "$GuardDir")'
+    nsExec::ExecToLog 'powershell -NoProfile -Command "Get-Process -Name $\'$R2$\' -ErrorAction SilentlyContinue | Where-Object { try { $$p = $$_.Path; if ($$p) { $$p.StartsWith($$env:COCKATRICE_GUARD_DIR, [StringComparison]::OrdinalIgnoreCase) } else { $$false } } catch { $$false } } | ForEach-Object { Stop-Process -Id $$_.Id -Force -ErrorAction SilentlyContinue }"'
+    Pop $R3
+FunctionEnd
+
+Function WaitForAppToClose
+    ; usage: set $R1 to the display name (e.g. "cockatrice.exe") and $R2 to the
+    ; base image name (e.g. "cockatrice")
+    Call IsAppRunning
+    ; Only a definite "running" is worth waiting for. "Not running" is done, and
+    ; "could not determine" must not keep the installer waiting on an answer it
+    ; will never get - but it cannot simply be waved through either, see
+    ; HandleUnknownAppState.
+    ${If} $R0 = 0
+        Return
+    ${EndIf}
+    ${If} $R0 = 2
+        Call HandleUnknownAppState
+        Return
+    ${EndIf}
+
+    ${If} ${Silent}
+        ; ask the application to close gracefully (WM_CLOSE), then wait for it to exit
+        DetailPrint "Closing $R1 ..."
+        Call CloseMatchingApps
+        ; wall-clock deadline: each poll has to spawn a fresh powershell.exe, so
+        ; a bare loop counter would not bound the real wait time to 60 s.
+        System::Call 'kernel32::GetTickCount()i.s'
+        Pop $R8
+        ck_wait_loop:
+        Sleep 500
+        Call IsAppRunning
+        ${If} $R0 = 0
+            DetailPrint "$R1 closed."
+            Return
+        ${EndIf}
+        ${If} $R0 = 2
+            Call HandleUnknownAppState
+            Return
+        ${EndIf}
+        System::Call 'kernel32::GetTickCount()i.s'
+        Pop $R9
+        IntOp $R9 $R9 - $R8
+        ${If} $R9 < 60000
+            Goto ck_wait_loop
+        ${EndIf}
+        ; The grace period is over. Cockatrice is never force-stopped: it may be
+        ; showing a "really leave this game?" confirmation or holding an unsaved
+        ; deck, and nothing has been replaced yet, so aborting just defers the
+        ; update and preserves the user's data.
+        ${If} $AllowForceClose = 0
+            DetailPrint "$R1 is still running after 60 s; aborting the update so that no data is lost."
+            StrCpy $AbortReason \
+                "$R1 did not close within 60 seconds, so the installation was aborted to avoid losing unsaved data.$\r$\n$\r$\nPlease close $R1 and run the installer again."
+            Call AbortInstall
+        ${EndIf}
+        ; Oracle and Servatrice are console applications: CloseMainWindow()
+        ; returned false for them and waiting longer cannot help. They hold no
+        ; unsaved user data, so stop them by PID.
+        DetailPrint "Force-stopping $R1 ..."
+        Call ForceCloseApps
+        Sleep 2000
+        Call IsAppRunning
+        ${If} $R0 = 0
+            DetailPrint "$R1 closed."
+            Return
+        ${EndIf}
+        ${If} $R0 = 2
+            Call HandleUnknownAppState
+            Return
+        ${EndIf}
+        DetailPrint "$R1 is still running after 60 s; aborting the update."
+        StrCpy $AbortReason \
+            "$R1 could not be stopped, so the installation was aborted.$\r$\n$\r$\nPlease close $R1 and run the installer again."
+        Call AbortInstall
+    ${Else}
+        ck_wait_prompt:
+        MessageBox MB_RETRYCANCEL|MB_ICONEXCLAMATION|MB_DEFBUTTON1 \
+            "$R1 is still running.$\r$\n$\r$\nPlease close it, then click Retry.$\r$\nClick Cancel to abort." \
+            IDCANCEL ck_abort_install
+        Call IsAppRunning
+        ${If} $R0 = 0
+            Return
+        ${EndIf}
+        ${If} $R0 = 2
+            Call HandleUnknownAppState
+            Return
+        ${EndIf}
+        Goto ck_wait_prompt
+        ck_abort_install:
+        Abort
+    ${EndIf}
+FunctionEnd
+
+; A process lookup came back "could not determine": powershell.exe ran but the
+; answer was not usable, e.g. the process could not be inspected at all. That
+; state is fine to carry on from when the user is at the keyboard - they can
+; close the applications by hand and the stale-runtime check still stands
+; between a failed guard and a mismatched install.
+;
+; It is not fine on a silent upgrade. There the whole point of this guard is to
+; know that nothing holds locks on the files about to be replaced, and this is
+; exactly the state where that is unknown, with no one to click a dialog: the
+; old code returned and let the install carry on into the mixed Qt DLL set that
+; made the next start fail. Cancel the update instead; the next attempt runs
+; with the applications closed and succeeds.
+Function HandleUnknownAppState
+    ${If} $ReinstallMode = 1
+        StrCpy $AbortReason \
+            "The installation was cancelled because it could not determine whether Cockatrice is still running.$\r$\n$\r$\nPlease close Cockatrice, Oracle and Servatrice and run the installer again."
+        Call AbortInstall
+    ${EndIf}
+    DetailPrint "Could not determine whether $R1 is running; close Cockatrice, Oracle and Servatrice manually if the installation reports a problem."
+    ${IfNot} ${Silent}
+        MessageBox MB_OK|MB_ICONEXCLAMATION \
+            "This installer could not determine whether $R1 is still running.$\r$\n$\r$\nPlease close Cockatrice, Oracle and Servatrice manually before continuing."
+    ${EndIf}
+FunctionEnd
+
+Function EnsureAppsNotRunning
+    ; guards the install directory
+    StrCpy $GuardDir $INSTDIR
+    Call GuardAppsNotRunning
+FunctionEnd
+
+; Aborts the installation, showing $AbortReason to the user.
+;
+; Every abort goes through here so the unattended case is handled the same way
+; everywhere: the in-app updater runs this installer silent and detached and
+; never looks at its exit code, so a plain Abort would leave the user with no
+; update and no explanation, while a /S install without /R is unattended - by a
+; package manager, for instance - and a message box there would block forever.
+; Only the first of those two gets a dialog; the second reports through the log
+; and the exit code.
+Function AbortInstall
+    ${IfNot} ${Silent}
+        MessageBox MB_OK|MB_ICONEXCLAMATION "$AbortReason"
+    ${EndIf}
+    SetErrorLevel 1
+    Abort
+FunctionEnd
+
+; Waits for the application that launched this installer to exit, using the /PID=
+; it passed. Sets $LauncherExited to 1 when that process is provably gone.
+;
+; This is the authority for the one question the rest of the installer can only
+; approximate: is the process that started us still holding its Qt DLLs mapped?
+; A mapped module cannot be deleted, so an answer of "not running" obtained by
+; enumerating process names is what allows the update to write a new payload on
+; top of files it could not remove. Waiting on a real handle has no such gap,
+; needs no powershell.exe, and is unaffected by a process whose path cannot be
+; read - the case the name based check has to treat as "not ours" so it never
+; closes a third party application.
+;
+; Sets $LauncherExited to 0 when no usable /PID= was given, which is the older
+; client that does not pass one; the caller then has no authority available and
+; falls back to the name based guard.
+Function WaitForLauncherToExit
+    StrCpy $LauncherExited 0
+    ${If} $WaitPid == ""
+        Return
+    ${EndIf}
+    ; PROCESS_SYNCHRONIZE is the only access this needs - enough to wait on the
+    ; handle, and the least likely to be refused for a reason that has nothing to
+    ; do with the upgrade.
+    ClearErrors
+    System::Call 'kernel32::OpenProcess(i 0x00100000, i 0, i $WaitPid) p.r0'
+    ${If} ${Errors}
+    ; The launcher is gone - OpenProcess cannot open a dead process - which is
+    ; exactly the state the wait was for.
+        DetailPrint "The application that started this installer has already exited."
+        StrCpy $LauncherExited 1
+        Return
+    ${EndIf}
+    DetailPrint "Waiting for the application that started this installer to exit ..."
+    ; Same 60 s grace period the name based check uses, so a client that is slow
+    ; to flush its card database does not get less room than it used to.
+    ; WAIT_OBJECT_0 is 0; WAIT_TIMEOUT is 258 and a failed wait reports 0xFFFFFFFF.
+    System::Call 'kernel32::WaitForSingleObject(p r0, i 60000) i.r1'
+    System::Call 'kernel32::CloseHandle(p r0)'
+    ${If} $R1 != 0
+        DetailPrint "The application that started this installer did not exit within 60 s."
+        StrCpy $AbortReason \
+            "The application that started this update has not exited yet, so the installation was cancelled rather than replace files it is still using.$\r$\n$\r$\nPlease close Cockatrice and run the installer again."
+        Call AbortInstall
+    ${EndIf}
+    DetailPrint "The application that started this installer has exited."
+    StrCpy $LauncherExited 1
+FunctionEnd
+
+Function EnsureOldInstallNotRunning
+    ; Guards the directory of a *previous* installation, as recorded in the
+    ; registry. Needed by componentsPagePre, which runs the old uninstaller
+    ; before the directory page, so $INSTDIR is still the default there and not
+    ; the directory the old install lives in. Every uninstaller shipped before
+    ; this change had no running instance guard of its own, so the old one would
+    ; delete files while an instance of the application is still holding them.
+    ReadRegStr $R3 HKLM "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cockatrice" "InstallLocation"
+    ${If} $R3 == ""
+        ; no usable record of where the old install is; $INSTDIR is the default
+        ; install directory at this point, which is where it usually is anyway
+        DetailPrint "Could not read the previous installation directory from the registry; checking $INSTDIR instead."
+        StrCpy $R3 $INSTDIR
+    ${EndIf}
+    StrCpy $GuardDir $R3
+    Call GuardAppsNotRunning
+FunctionEnd
+
+Function GuardAppsNotRunning
+    ; usage: set $GuardDir to the directory to guard, then call this
+    Call IsProcessLookupAvailable
+    ${If} $R0 = 0
+        ; Without PowerShell we cannot tell whether a running instance is
+        ; holding locks on the files we are about to replace.
+        DetailPrint "Could not start powershell.exe; skipping the running instance check. Close Cockatrice, Oracle and Servatrice manually if the installation reports a problem."
+        ; On a silent upgrade that used to be a warning and nothing more, which
+        ; left the very process that launched the installer free to go on
+        ; replacing files it still had mapped - the one outcome this guard exists
+        ; to prevent - and then writing the new payload on top of them. Cancel
+        ; instead. An interactive install can still continue: the user is at the
+        ; keyboard, and refusing outright would leave them with an installer that
+        ; can never complete.
+        ;
+        ; Unless the launcher has already been waited on directly: WaitForLauncherToExit
+        ; needs no powershell.exe, so when it has run, Cockatrice is known to be
+        ; gone and the lookup failing to run costs nothing but the Oracle and
+        ; Servatrice checks. An older client that passes no /PID= leaves no such
+        ; authority, and there the upgrade is cancelled as before.
+        ${If} $LauncherExited != 1
+        ${AndIf} $ReinstallMode = 1
+            StrCpy $AbortReason \
+                "The installation was cancelled because it could not check whether Cockatrice is still running, because powershell.exe could not be started.$\r$\n$\r$\nPlease close Cockatrice, Oracle and Servatrice and run the installer again."
+            Call AbortInstall
+        ${EndIf}
+        ; The user has to be told to close the applications by hand, but a /S
+        ; install without /R is unattended and would block on this forever.
+        ${IfNot} ${Silent}
+            MessageBox MB_OK|MB_ICONEXCLAMATION "This installer could not check whether Cockatrice is still running, because powershell.exe could not be started.$\r$\n$\r$\nPlease close Cockatrice, Oracle and Servatrice manually before continuing."
+        ${EndIf}
+        Return
+    ${EndIf}
+    StrCpy $R1 "cockatrice.exe"
+    StrCpy $R2 "cockatrice"
+    ; a GUI application with unsaved user data: graceful close only
+    StrCpy $AllowForceClose 0
+    Call WaitForAppToClose
+    StrCpy $R1 "oracle.exe"
+    StrCpy $R2 "oracle"
+    StrCpy $AllowForceClose 1
+    Call WaitForAppToClose
+    StrCpy $R1 "servatrice.exe"
+    StrCpy $R2 "servatrice"
+    StrCpy $AllowForceClose 1
+    Call WaitForAppToClose
+FunctionEnd
+
+; Sets $R0 to 1 if $INSTDIR looks like an existing Cockatrice install. Used to
+; guard the stale-runtime-DLL purge so a first-time install into a pre-existing
+; directory with an unrelated "Plugins" folder is never touched, while an
+; install that only ever held e.g. servatrice.exe is still purged.
+Function IsExistingCockatriceInstall
+    StrCpy $R0 0
+    ${If} ${FileExists} "$INSTDIR\cockatrice.exe"
+        StrCpy $R0 1
+    ${EndIf}
+    ${If} ${FileExists} "$INSTDIR\oracle.exe"
+        StrCpy $R0 1
+    ${EndIf}
+    ${If} ${FileExists} "$INSTDIR\servatrice.exe"
+        StrCpy $R0 1
+    ${EndIf}
+    ${If} ${FileExists} "$INSTDIR\uninstall.exe"
+        StrCpy $R0 1
+    ${EndIf}
+    ; A leftover runtime DLL counts as an install as well. A previously failed
+    ; update can leave a directory in which the old uninstaller removed the
+    ; executables and uninstall.exe but silently skipped the DLLs its running
+    ; instance had locked - which is exactly the broken install the purge is
+    ; meant to heal, and without these markers none of the files above would be
+    ; there to prove that it is one. Every Qt module Cockatrice links is part of
+    ; the payload, so match them all: probing only Qt6Core.dll would miss a
+    ; directory where that one file happened to be deletable and the others
+    ; were not.
+    StrCpy $R3 "Qt6*.dll"
+    Call CheckStaleRuntimeMask
+    ${If} ${FileExists} "$INSTDIR\qt.conf"
+        StrCpy $R0 1
+    ${EndIf}
+FunctionEnd
+
+; Sets $R0 to 1 if a runtime file of a previous version is still present after
+; the purge. NSIS silently skips whatever it cannot delete, so one surviving file
+; is enough to prove that something still holds a lock on the install directory.
+;
+; The masks below have to cover the purge above one for one. A check that only
+; probed named files could not see a locked Qt6Multimedia.dll or a Plugins
+; directory the purge was unable to remove, so the exact files that broke the
+; install were also the ones this check was blind to.
+Function HasStaleRuntimeFiles
+    StrCpy $R0 0
+    StrCpy $R3 "Qt*.dll"
+    Call CheckStaleRuntimeMask
+    StrCpy $R3 "libcrypto*.dll"
+    Call CheckStaleRuntimeMask
+    StrCpy $R3 "libssl*.dll"
+    Call CheckStaleRuntimeMask
+    StrCpy $R3 "zlib*.dll"
+    Call CheckStaleRuntimeMask
+    StrCpy $R3 "icu*.dll"
+    Call CheckStaleRuntimeMask
+    StrCpy $R3 "libeay32.dll"
+    Call CheckStaleRuntimeMask
+    StrCpy $R3 "ssleay32.dll"
+    Call CheckStaleRuntimeMask
+    ${If} $R0 = 1
+        Return
+    ${EndIf}
+    ${If} ${FileExists} "$INSTDIR\libmysql.dll"
+        StrCpy $R0 1
+        Return
+    ${EndIf}
+    ; IfFileExists takes wildcards, so a Plugins directory the purge could not
+    ; remove counts as a leftover too.
+    ${If} ${FileExists} "$INSTDIR\Plugins\*.*"
+        StrCpy $R0 1
+    ${EndIf}
+FunctionEnd
+
+; usage: set $R3 to a file mask, call this. Sets $R0 to 1 when $INSTDIR holds a
+; matching file. Returns early once something was found, so $R0 stays 1.
+Function CheckStaleRuntimeMask
+    ${If} $R0 = 1
+        Return
+    ${EndIf}
+    FindFirst $StaleFindHandle $StaleFindName "$INSTDIR\$R3"
+    ${If} $StaleFindHandle != ""
+        StrCpy $R0 1
+        FindClose $StaleFindHandle
+    ${EndIf}
+FunctionEnd
+
+; Uninstaller copies of the same routines (the uninstaller gets its own
+; function set compiled in, it cannot call the installer functions).
+Function un.IsAppRunning
+    ; An unset $GuardDir would match every process that merely shares the image
+    ; name, see IsAppRunning in the installer.
+    ${If} $GuardDir == ""
+        StrCpy $R0 2
+        Return
+    ${EndIf}
+    ; Pass the directory to guard to PowerShell via an environment variable so
+    ; it never has to be embedded into the -Command string: apostrophes in a
+    ; path would terminate the command early, and the path in a -like pattern
+    ; would treat [ and ] as wildcard characters.
+    System::Call 'kernel32::SetEnvironmentVariable(t, t) i ("COCKATRICE_GUARD_DIR", "$GuardDir")'
+    ; Exit the process explicitly so nsExec's pop reflects whether a matching
+    ; process was found: powershell.exe exits 0 whether or not the pipeline
+    ; produced objects. 0 = not running, 1 = running, anything else = could not
+    ; be determined (see un.IsProcessLookupAvailable).
+    ; Strict match: a readable path under $GuardDir, same as in the installer.
+    nsExec::ExecToLog 'powershell -NoProfile -Command "if (Get-Process -Name $\'$R2$\' -ErrorAction SilentlyContinue | Where-Object { try { $$p = $$_.Path; if ($$p) { $$p.StartsWith($$env:COCKATRICE_GUARD_DIR, [StringComparison]::OrdinalIgnoreCase) } else { $$false } } catch { $$false } } | Select-Object -First 1) { exit 1 } else { exit 0 }"'
+    Pop $R0
+    ${If} $R0 == "0"
+        StrCpy $R0 0
+    ${ElseIf} $R0 == "1"
+        StrCpy $R0 1
+    ${Else}
+        ; powershell.exe could not be run at all (nsExec pushes the string
+        ; "error"), or died with an unexpected code. That is "could not
+        ; determine", which has to stay distinguishable from "definitely
+        ; running": a state that can never clear would block the uninstaller
+        ; forever. un.IsProcessLookupAvailable warns about that case once.
+        StrCpy $R0 2
+    ${EndIf}
+FunctionEnd
+
+Function un.IsProcessLookupAvailable
+    nsExec::ExecToLog 'powershell -NoProfile -Command "exit 0"'
+    Pop $R0
+    ${If} $R0 == "0"
+        StrCpy $R0 1
+    ${Else}
+        StrCpy $R0 0
+    ${EndIf}
+FunctionEnd
+
+Function un.CloseMatchingApps
+    ; gracefully ask every matching instance to close (sends WM_CLOSE)
+    ;
+    ; Strict filter, same as in the installer: never close a process whose path
+    ; cannot be read, it is not necessarily one of ours.
+    System::Call 'kernel32::SetEnvironmentVariable(t, t) i ("COCKATRICE_GUARD_DIR", "$GuardDir")'
+    nsExec::ExecToLog 'powershell -NoProfile -Command "Get-Process -Name $\'$R2$\' -ErrorAction SilentlyContinue | Where-Object { try { $$p = $$_.Path; if ($$p) { $$p.StartsWith($$env:COCKATRICE_GUARD_DIR, [StringComparison]::OrdinalIgnoreCase) } else { $$false } } catch { $$false } } | ForEach-Object { $$null = $$_.CloseMainWindow() }"'
+    Pop $R3
+FunctionEnd
+
+Function un.ForceCloseApps
+    ; stop the matching instances by PID once the grace period is over, see
+    ; ForceCloseApps in the installer.
+    System::Call 'kernel32::SetEnvironmentVariable(t, t) i ("COCKATRICE_GUARD_DIR", "$GuardDir")'
+    nsExec::ExecToLog 'powershell -NoProfile -Command "Get-Process -Name $\'$R2$\' -ErrorAction SilentlyContinue | Where-Object { try { $$p = $$_.Path; if ($$p) { $$p.StartsWith($$env:COCKATRICE_GUARD_DIR, [StringComparison]::OrdinalIgnoreCase) } else { $$false } } catch { $$false } } | ForEach-Object { Stop-Process -Id $$_.Id -Force -ErrorAction SilentlyContinue }"'
+    Pop $R3
+FunctionEnd
+
+Function un.WaitForAppToClose
+    Call un.IsAppRunning
+    ; Only a definite "running" is worth waiting for, see WaitForAppToClose.
+    ${If} $R0 != 1
+        Return
+    ${EndIf}
+
+    ${If} ${Silent}
+        DetailPrint "Closing $R1 ..."
+        Call un.CloseMatchingApps
+        ; wall-clock deadline: each poll has to spawn a fresh powershell.exe, so
+        ; a bare loop counter would not bound the real wait time to 60 s.
+        System::Call 'kernel32::GetTickCount()i.s'
+        Pop $R8
+        un_ck_wait_loop:
+        Sleep 500
+        Call un.IsAppRunning
+        ${If} $R0 = 0
+            DetailPrint "$R1 closed."
+            Return
+        ${EndIf}
+        ${If} $R0 != 1
+            Return
+        ${EndIf}
+        System::Call 'kernel32::GetTickCount()i.s'
+        Pop $R9
+        IntOp $R9 $R9 - $R8
+        ${If} $R9 < 60000
+            Goto un_ck_wait_loop
+        ${EndIf}
+        ; The grace period is over. Cockatrice is never force-stopped, see
+        ; WaitForAppToClose in the installer. A silent uninstall only reports
+        ; through the log and its exit code: it is also run unattended (the /R
+        ; updater uses it via QuietUninstallString, package managers use it
+        ; directly), and a message box would block there. The installer that ran
+        ; us reports the incomplete result to the user itself.
+        ${If} $AllowForceClose = 0
+            DetailPrint "$R1 is still running after 60 s; aborting so that no data is lost."
+            SetErrorLevel 1
+            Abort
+        ${EndIf}
+        DetailPrint "Force-stopping $R1 ..."
+        Call un.ForceCloseApps
+        Sleep 2000
+        Call un.IsAppRunning
+        ${If} $R0 = 0
+            DetailPrint "$R1 closed."
+            Return
+        ${EndIf}
+        ${If} $R0 != 1
+            Return
+        ${EndIf}
+        DetailPrint "$R1 is still running after 60 s; aborting."
+        SetErrorLevel 1
+        Abort
+    ${Else}
+        un_ck_wait_prompt:
+        MessageBox MB_RETRYCANCEL|MB_ICONEXCLAMATION|MB_DEFBUTTON1 \
+            "$R1 is still running.$\r$\n$\r$\nPlease close it, then click Retry.$\r$\nClick Cancel to abort." \
+            IDCANCEL un_ck_abort_install
+        Call un.IsAppRunning
+        ${If} $R0 = 0
+            Return
+        ${EndIf}
+        ${If} $R0 != 1
+            Return
+        ${EndIf}
+        Goto un_ck_wait_prompt
+        un_ck_abort_install:
+        Abort
+    ${EndIf}
+FunctionEnd
+
+Function un.EnsureAppsNotRunning
+    ; guards the install directory; the uninstaller only ever has to check this one
+    StrCpy $GuardDir $INSTDIR
+    Call un.GuardAppsNotRunning
+FunctionEnd
+
+Function un.GuardAppsNotRunning
+    Call un.IsProcessLookupAvailable
+    ${If} $R0 = 0
+        ; Same reasoning as in the installer: without PowerShell we cannot tell
+        ; whether a running instance still holds file locks, and refusing to
+        ; uninstall would leave the user with an uninstaller that never
+        ; completes. Warn once and continue.
+        DetailPrint "Could not start powershell.exe; skipping the running instance check. Close Cockatrice, Oracle and Servatrice manually if the uninstall reports a problem."
+        MessageBox MB_OK|MB_ICONEXCLAMATION "This uninstaller could not check whether Cockatrice is still running, because powershell.exe could not be started.$\r$\n$\r$\nPlease close Cockatrice, Oracle and Servatrice manually before continuing."
+        Return
+    ${EndIf}
+    StrCpy $R1 "cockatrice.exe"
+    StrCpy $R2 "cockatrice"
+    ; a GUI application with unsaved user data: graceful close only
+    StrCpy $AllowForceClose 0
+    Call un.WaitForAppToClose
+    StrCpy $R1 "oracle.exe"
+    StrCpy $R2 "oracle"
+    StrCpy $AllowForceClose 1
+    Call un.WaitForAppToClose
+    StrCpy $R1 "servatrice.exe"
+    StrCpy $R2 "servatrice"
+    StrCpy $AllowForceClose 1
+    Call un.WaitForAppToClose
+FunctionEnd
+
 Function PortableModePageCreate
 
 ${If} $ReinstallMode = 1
@@ -258,8 +919,15 @@ ${If} $PortableMode = 0
     ${EndIf}
 
     uninst32:
+    ; the old uninstaller is run here, before the directory page, and every
+    ; uninstaller predating this change has no guard of its own: make sure no
+    ; instance of the application is still running out of the *old* install
+    ; directory before letting it delete anything. The uninstall string is
+    ; stashed away first, the check works on $R0.
+    StrCpy $OldUninstallString $R0
+    Call EnsureOldInstallNotRunning
     ClearErrors
-    ExecWait "$R0"
+    ExecWait "$OldUninstallString"
 
 	done32:
 
@@ -278,8 +946,10 @@ ${If} $PortableMode = 0
         ${EndIf}
 
 	    uninst64:
+	    StrCpy $OldUninstallString $R0
+	    Call EnsureOldInstallNotRunning
 	    ClearErrors
-	    ExecWait "$R0"
+	    ExecWait "$OldUninstallString"
 
 		done64:
 	${EndIf}
@@ -294,6 +964,26 @@ Section "Application" SecApplication
 SetShellVarContext all
 SetOutPath "$INSTDIR"
 
+; No application instance may be running while any file below is deleted or
+; replaced: both upgrade blocks start by removing the old executables and
+; runtime DLLs, and NSIS silently skips whatever is locked, which is how an
+; install ends up with a mix of old and new Qt DLLs next to the new executable
+; ("The procedure entry point X could not be located in the dynamic link
+; library ...Qt6Network.dll"). So the check has to come before the first
+; Delete/RMDir and not after it - an interactive install into an existing
+; portable directory with cockatrice.exe still running would otherwise delete
+; the old files under its feet.
+;
+; It is skipped on the /R path: .onInit already ran it before
+; AutoUninstallIfNeeded removed the previous installation, so by the time this
+; section starts the old files are gone and a second Abort here would leave the
+; user with the old version uninstalled and the new one not installed at all,
+; which is worse than the locked files being prevented. The leftover runtime
+; files are reported at the end of the purge instead.
+${If} $ReinstallMode = 0
+    Call EnsureAppsNotRunning
+${EndIf}
+
 ${If} $PortableMode = 1
 ${AndIf} ${FileExists} "$INSTDIR\portable.dat"
 	; upgrade portable mode
@@ -308,6 +998,8 @@ ${AndIf} ${FileExists} "$INSTDIR\portable.dat"
 	Delete "$INSTDIR\Qt*.dll"
 	Delete "$INSTDIR\libmysql.dll"
 	Delete "$INSTDIR\icu*.dll"
+	Delete "$INSTDIR\libcrypto*.dll"
+	Delete "$INSTDIR\libssl*.dll"
 	Delete "$INSTDIR\libeay32.dll"
 	Delete "$INSTDIR\ssleay32.dll"
 	Delete "$INSTDIR\qt.conf"
@@ -318,6 +1010,57 @@ ${AndIf} ${FileExists} "$INSTDIR\portable.dat"
 	RMDir "$INSTDIR"
 ${EndIf}
 
+; Remove any runtime DLLs left over from older versions, so a mismatched
+; Qt/OpenSSL set cannot survive next to the new executables.
+Call IsExistingCockatriceInstall
+; Remembered because the stale-runtime check below must only ever fire for a
+; directory this installer recognised as a Cockatrice install. Scanning for
+; leftovers in an unrelated directory (a first-time install into a folder that
+; happens to hold some Qt5 DLLs, say) would otherwise turn those files into an
+; abort reason even though the payload is about to overwrite nothing of theirs.
+StrCpy $IsUpgrade $R0
+${If} $PortableMode = 0
+${AndIf} $R0 = 1
+	RMDir /r "$INSTDIR\Plugins"
+	Delete "$INSTDIR\Qt*.dll"
+	Delete "$INSTDIR\libcrypto*.dll"
+	Delete "$INSTDIR\libssl*.dll"
+	Delete "$INSTDIR\zlib*.dll"
+	Delete "$INSTDIR\libmysql.dll"
+	Delete "$INSTDIR\icu*.dll"
+	Delete "$INSTDIR\libeay32.dll"
+	Delete "$INSTDIR\ssleay32.dll"
+${EndIf}
+
+; Whatever was locked during the purge - by an instance that started while the
+; installer was running, or because the running instance check could not be
+; performed at all - is still on disk, and the new executables are about to be
+; written next to it. That mix is exactly what makes the next start fail with
+; "The procedure entry point X could not be located in the dynamic link library
+; ...Qt6QuickWidgets.dll" or "The code execution cannot proceed because
+; Qt6Multimedia.dll was not found", so stop here instead of compounding it.
+; Nothing of the new payload has been written at this point, so the next run -
+; with the applications closed - gets a clean install.
+${If} $IsUpgrade = 1
+    Call HasStaleRuntimeFiles
+${Else}
+    StrCpy $R0 0
+${EndIf}
+${If} $R0 = 1
+    DetailPrint "Files of a previous version could not be removed; aborting the installation."
+    ; The in-app updater runs this installer silent and detached and never looks
+    ; at its exit code, so the user has to be told what happened. A /S install
+    ; without /R is unattended - a package manager, for instance - and a message
+    ; box there would block forever, so that case only reports through the log
+    ; and the exit code.
+    ${IfNot} ${Silent}
+        MessageBox MB_OK|MB_ICONEXCLAMATION \
+            "The installation could not remove all files of a previous version of Cockatrice, most likely because it is still running or was started as administrator, and was cancelled rather than leave a mismatched install behind.$\r$\n$\r$\nPlease close Cockatrice, Oracle and Servatrice and run the installer again."
+    ${EndIf}
+    SetErrorLevel 1
+    Abort
+${EndIf}
+
 @CPACK_NSIS_EXTRA_PREINSTALL_COMMANDS@
 @CPACK_NSIS_FULL_INSTALL@
 
@@ -345,6 +1088,16 @@ ${If} $PortableMode = 0
 	WriteRegDWORD HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\Cockatrice" "VersionMajor" "@CPACK_PACKAGE_VERSION_MAJOR@"
 	WriteRegDWORD HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\Cockatrice" "VersionMinor" "@CPACK_PACKAGE_VERSION_MINOR@"
 
+	; --- Register .cod file type ---
+	WriteRegStr HKCR ".cod" "" "Cockatrice"
+	WriteRegStr HKCR "Cockatrice" "" "Cockatrice Deck File"
+	WriteRegStr HKCR "Cockatrice\shell\open\command" "" '"$INSTDIR\cockatrice.exe" "%1"'
+
+	; --- Register custom URI protocol ---
+	WriteRegStr HKCR "cockatrice" "" "URL: Cockatrice Protocol"
+	WriteRegStr HKCR "cockatrice" "URL Protocol" ""
+	WriteRegStr HKCR "cockatrice\shell\open\command" "" '"$INSTDIR\cockatrice.exe" "%1"'
+
 	IfFileExists "$INSTDIR\vc_redist.x86.exe" VcRedist86Exists PastVcRedist86Check
 	VcRedist86Exists:
 		ExecWait '"$INSTDIR\vc_redist.x86.exe" /passive /norestart'
@@ -387,21 +1140,34 @@ SectionEnd
 
 Section "un.Application" UnSecApplication
 	SetShellVarContext all
-	RMDir /r "$INSTDIR\plugins"
+	StrCpy $R1 0
-	RMDir /r "$INSTDIR\sounds"
-	RMDir /r "$INSTDIR\themes"
-	RMDir /r "$INSTDIR\translations"
-	Delete "$INSTDIR\*.exe"
-	Delete "$INSTDIR\*.dll"
-	Delete "$INSTDIR\qt.conf"
-	Delete "$INSTDIR\qdebug.txt"
-	Delete "$INSTDIR\servatrice.sql"
-	Delete "$INSTDIR\servatrice.ini.example"
-	RMDir "$INSTDIR"
 
-	RMDir "$SMPROGRAMS\Cockatrice"
+	; Record whether this was a portable install before the directory (and the
+	; portable.dat marker inside it) is removed below.
+	IfFileExists "$INSTDIR\portable.dat" 0 +2
+		StrCpy $R1 1
+
+	; Remove the entire application directory so any file that is not part of
+	; the installed payload (e.g. build-tree artifacts such as *.dir folders,
+	; *_autogen and *.tlog files from a build) cannot survive between an
+	; uninstall and a fresh reinstall.
+	RMDir /r "$INSTDIR"
+
+	RMDir /r "$SMPROGRAMS\Cockatrice"
 
 	DeleteRegKey HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\Cockatrice"
+
+	; Only remove the file/protocol associations if we registered them (i.e. the
+	; install was not portable) and .cod is still owned by Cockatrice, so we don't
+	; clobber a .cod association installed by another application.
+	${If} $R1 == 0
+		ReadRegStr $0 HKCR ".cod" ""
+		${If} $0 == "Cockatrice"
+			DeleteRegKey HKCR ".cod"
+			DeleteRegKey HKCR "Cockatrice"
+			DeleteRegKey HKCR "cockatrice"
+		${EndIf}
+	${EndIf}
 SectionEnd
 
 ; unselected because it is /o

cockatrice/CMakeLists.txt

@@ -45,11 +45,14 @@ set(cockatrice_SOURCES
     src/interface/widgets/dialogs/dlg_load_deck_from_website.cpp
     src/interface/widgets/dialogs/dlg_load_remote_deck.cpp
     src/interface/widgets/dialogs/dlg_local_game_options.cpp
+    src/interface/widgets/dialogs/dlg_login_prompt.cpp
     src/interface/widgets/dialogs/dlg_manage_sets.cpp
     src/interface/widgets/dialogs/dlg_my_reports.cpp
     src/interface/widgets/dialogs/dlg_register.cpp
     src/interface/widgets/dialogs/dlg_report_user.cpp
     src/interface/widgets/dialogs/dlg_select_set_for_cards.cpp
+    src/interface/widgets/dialogs/dlg_share_deck.cpp
+    src/interface/widgets/dialogs/dlg_shared_decks_preview.cpp
     src/interface/widgets/dialogs/dlg_settings.cpp
     src/interface/widgets/dialogs/dlg_startup_card_check.cpp
     src/interface/widgets/dialogs/dlg_tip_of_the_day.cpp
@@ -57,6 +60,9 @@ set(cockatrice_SOURCES
     src/interface/widgets/dialogs/dlg_view_log.cpp
     src/interface/widgets/dialogs/override_printing_warning.cpp
     src/interface/widgets/dialogs/tip_of_the_day.cpp
+    src/interface/widgets/deck_share/deck_share_utils.cpp
+    src/interface/widgets/deck_share/shared_deck_preview_widget.cpp
+    src/interface/widgets/deck_share/share_bar_widget.cpp
     src/filters/deck_filter_string.cpp
     src/filters/filter_builder.cpp
     src/filters/filter_tree_model.cpp
@@ -163,6 +169,7 @@ set(cockatrice_SOURCES
     src/interface/palette_editor/palette_grid_widget.cpp
     src/interface/palette_editor/palette_editor_dialog.cpp
     src/interface/widgets/cards/additional_info/color_identity_widget.cpp
+    src/interface/widgets/cards/additional_info/deck_color_identity.cpp
     src/interface/widgets/cards/additional_info/mana_cost_widget.cpp
     src/interface/widgets/cards/additional_info/mana_symbol_widget.cpp
     src/interface/widgets/cards/art_crop_attribution.cpp
@@ -317,6 +324,8 @@ set(cockatrice_SOURCES
     src/interface/widgets/visual_deck_storage/deck_preview/deck_preview_tag_display_widget.cpp
     src/interface/widgets/visual_deck_storage/deck_preview/deck_preview_tag_item_widget.cpp
     src/interface/widgets/visual_deck_storage/deck_preview/deck_preview_widget.cpp
+    src/interface/widgets/visual_deck_storage/deck_preview/public_deck_preview_widget.cpp
+    src/interface/widgets/visual_deck_storage/remote_public_decks_model.cpp
     src/interface/widgets/visual_deck_storage/visual_deck_storage_folder_display_widget.cpp
     src/interface/widgets/visual_deck_storage/visual_deck_storage_model.cpp
     src/interface/widgets/visual_deck_storage/visual_deck_storage_quick_settings_widget.cpp
@@ -388,6 +397,7 @@ set(cockatrice_SOURCES
     src/interface/widgets/tabs/tab_logs.cpp
     src/interface/widgets/tabs/tab_message.cpp
     src/interface/widgets/tabs/tab_moderation.cpp
+    src/interface/widgets/tabs/tab_public_decks.cpp
     src/interface/widgets/tabs/tab_report.cpp
     src/interface/widgets/tabs/tab_replays.cpp
     src/interface/widgets/tabs/tab_room.cpp
@@ -444,6 +454,8 @@ set(cockatrice_SOURCES
     src/interface/intents/intent_login.h
     src/interface/intents/intent_open_server_room_by_name.cpp
     src/interface/intents/intent_open_server_room_by_name.h
+    src/interface/intents/intent_open_shared_deck.cpp
+    src/interface/intents/intent_open_shared_deck.h
     src/interface/intents/url_parser.cpp
     src/interface/intents/url_parser.h
     src/interface/widgets/server/user/user_info_popup.cpp
@@ -654,18 +666,53 @@ if(WIN32) # Windows (including 64bit)
   set(qtconf_dest_dir .)
 
   install(
-    DIRECTORY "${CMAKE_BINARY_DIR}/${PROJECT_NAME}/${CMAKE_BUILD_TYPE}/"
+    DIRECTORY "$<TARGET_FILE_DIR:cockatrice>/"
     DESTINATION ./
     FILES_MATCHING
     PATTERN "*.dll"
+    PATTERN "*.pdb" EXCLUDE
+    PATTERN "*.dir*" EXCLUDE
+    PATTERN "*_autogen*" EXCLUDE
+    PATTERN "*.tlog*" EXCLUDE
+    PATTERN "CMakeFiles*" EXCLUDE
+    PATTERN "x64*" EXCLUDE
+    PATTERN ".qt*" EXCLUDE
+    PATTERN ".qsb*" EXCLUDE
+    PATTERN ".lupdate*" EXCLUDE
   )
 
+  # fixup_bundle further down copies only the DLLs it can find in Cockatrice.exe's
+  # import table, and the glob above only sees DLLs that were already copied next
+  # to the executable. Qt6::Concurrent is linked but never imported - QtConcurrent::run
+  # and QFutureWatcher are header-only in Qt 6 - so neither step ships
+  # Qt6Concurrent.dll, even though required-qt-runtime.txt lists it and the
+  # Windows package check then fails on a package that is fine to run.
+  # Qt6::ShaderTools is skipped for the same reason.
+  #
+  # Install the runtime of every linked module explicitly. An unused DLL costs a
+  # few hundred kilobytes; a missing one is what stops the client starting after
+  # an update, and it stays invisible until then.
+  foreach(_qt_module IN LISTS COCKATRICE_QT_MODULES)
+    get_target_property(_qt_module_type ${_qt_module} TYPE)
+    if(_qt_module_type STREQUAL "SHARED_LIBRARY")
+      install(FILES "$<TARGET_FILE:${_qt_module}>" DESTINATION ./)
+    endif()
+  endforeach()
+
   install(
     DIRECTORY "${CMAKE_BINARY_DIR}/cockatrice/"
     DESTINATION ./
     FILES_MATCHING
-    PATTERN "CMakeFiles" EXCLUDE
     PATTERN "*.ini"
+    PATTERN "CMakeFiles*" EXCLUDE
+    PATTERN "*.dir*" EXCLUDE
+    PATTERN "*_autogen*" EXCLUDE
+    PATTERN "*.tlog*" EXCLUDE
+    PATTERN "*.pdb" EXCLUDE
+    PATTERN "x64*" EXCLUDE
+    PATTERN ".qt*" EXCLUDE
+    PATTERN ".qsb*" EXCLUDE
+    PATTERN ".lupdate*" EXCLUDE
   )
 
   # Qt plugins: iconengines, imageformats, multimedia, platforms, styles, tls
@@ -695,11 +742,15 @@ if(WIN32) # Windows (including 64bit)
     PATTERN "tls/qschannelbackend.dll"
   )
 
+  # The Windows install has no Resources directory: the .qm files go to
+  # ${COCKATRICE_WIN32_QM_INSTALL_DIR} and main.cpp looks for them at
+  # applicationDirPath() + "/translations". The macOS bundle above keeps
+  # Resources/translations, which is correct for it.
   install(
     CODE "
         file(WRITE \"\${CMAKE_INSTALL_PREFIX}/${qtconf_dest_dir}/qt.conf\" \"[Paths]
 Plugins = Plugins
-Translations = Resources/translations
+Translations = translations
 Data = Resources\")
     "
     COMPONENT Runtime
@@ -715,10 +766,6 @@ Data = Resources\")
         "
     COMPONENT Runtime
   )
-
-  if(OPENSSL_FOUND)
-    install(FILES ${OPENSSL_INCLUDE_DIRS} DESTINATION ./)
-  endif()
 endif()
 
 if(Qt6LinguistTools_FOUND)
@@ -746,6 +793,18 @@ if(Qt6LinguistTools_FOUND)
   elseif(WIN32)
     install(FILES ${cockatrice_QM} DESTINATION ${COCKATRICE_WIN32_QM_INSTALL_DIR})
   endif()
+
+  # Qt attaches the .qm files to the default build target only, so building the executable on its own
+  # (CLion, --target cockatrice) leaves it without any translations: nothing is translated and the
+  # language selector stays empty.
+  # Depend on Qt's own lrelease target instead of attaching the .qm custom commands to a second
+  # target: two independent targets owning the same outputs race on MSBuild/Makefiles and are an
+  # error on Xcode. Older Qt versions already add this dependency themselves.
+  foreach(_lrelease_target Cockatrice_lrelease cockatrice_lrelease)
+    if(TARGET ${_lrelease_target})
+      add_dependencies(cockatrice ${_lrelease_target})
+    endif()
+  endforeach()
 endif()
 
 qt6_finalize_target(cockatrice)

cockatrice/cockatrice.qrc

@@ -62,9 +62,9 @@
         <file>resources/icons/mana/U.svg</file>
         <file>resources/icons/mana/W.svg</file>
 
-        <file>resources/backgrounds/home.png</file>
+        <file>resources/backgrounds/home.jpg</file>
-        <file>resources/backgrounds/home-dark.png</file>
+        <file>resources/backgrounds/home-dark.jpg</file>
-        <file>resources/backgrounds/home-light.png</file>
+        <file>resources/backgrounds/home-light.jpg</file>
         <file>resources/backgrounds/card_triplet.svg</file>
         <file>resources/backgrounds/placeholder_printing_selector.svg</file>
 

cockatrice/src/client/network/update/client/release_channel.cpp

@@ -10,6 +10,7 @@
 #include <QRegularExpression>
 #include <QSysInfo>
 #include <QtGlobal>
+#include <optional>
 
 #if defined(Q_OS_MACOS)
 #include <sys/sysctl.h>
@@ -26,6 +27,29 @@
 
 #define GIT_SHORT_HASH_LEN 7
 
+namespace
+{
+
+#if defined(Q_OS_MACOS) || defined(Q_OS_WIN)
+// QSysInfo::productVersion() is not guaranteed to start with a number, e.g. it returns
+// "Server 2022" on Windows Server. Use the first numeric token as the major host version.
+std::optional<int> getProductVersionMajor()
+{
+    const QString versionString = QSysInfo::productVersion();
+    bool ok = false;
+    static const QRegularExpression firstNumber(R"((\d+))");
+    const auto match = firstNumber.match(versionString);
+    const int version = match.hasMatch() ? match.captured(1).toInt(&ok) : 0;
+    if (!ok) {
+        qCWarning(ReleaseChannelLog) << "Unable to determine OS version from" << versionString;
+        return std::nullopt;
+    }
+    return version;
+}
+#endif
+
+} // namespace
+
 ReleaseChannel::ReleaseChannel() : netMan(new QNetworkAccessManager(this)), response(nullptr), lastRelease(nullptr)
 {
 }
@@ -43,53 +67,93 @@ void ReleaseChannel::checkForUpdates()
     connect(response, &QNetworkReply::finished, this, &ReleaseChannel::releaseListFinished);
 }
 
-// Different release channel checking functions for different operating systems
+// Find assets compatible with host platform (Linux is not supported by in-client updater)
-bool ReleaseChannel::downloadMatchesCurrentOS(const QString &fileName)
+std::optional<int> ReleaseChannel::getTargetVersionForCurrentOS(const QString &fileName)
 {
-#if defined(Q_OS_MACOS)
+#if defined(Q_OS_WIN) && Q_PROCESSOR_WORDSIZE == 4
-    static QRegularExpression version_regex("macOS(\\d+)");
+    // The published Windows assets are 64-bit only
-    auto match = version_regex.match(fileName);
+    Q_UNUSED(fileName);
-    if (!match.hasMatch()) {
+    return std::nullopt;
-        return false;
+#endif
+
+    const QRegularExpression *regex = nullptr;
+
+    // Only platforms shipping updater assets (macOS, Windows) need the host version
+    static const std::optional<int> systemVersion =
+#if defined(Q_OS_MACOS) || defined(Q_OS_WIN)
+        getProductVersionMajor();
+#else
+        std::nullopt;
+#endif
+
+    if (!systemVersion) {
+        return std::nullopt;
     }
 
-    auto getSystemVersion = [] {
+#if defined(Q_OS_MACOS)
+    static const bool isIntel = [] {
         // QSysInfo does not go through translation layers
         // We need to use sysctl to reliably detect the underlying architecture
         char arch[255];
         size_t len = sizeof(arch);
         if (sysctlbyname("machdep.cpu.brand_string", arch, &len, nullptr, 0) == 0) {
-            // Intel mac is only supported on macOS 13 versions
+            return QString::fromUtf8(arch).contains("Intel");
-            if (QString::fromUtf8(arch).contains("Intel")) {
-                return 13;
-            }
         }
+        return false;
+    }();
 
-        return QSysInfo::productVersion().split(".")[0].toInt();
+    // Apple (ARM) --> Cockatrice-3.0.0-macOS15.dmg
-    };
+    // Apple (x86) --> Cockatrice-3.0.0-macOS15_Intel.dmg
-
+    static const QRegularExpression macIntelRegex(R"(-macOS(\d+)_Intel\.[^.]+$)",
-    // older(smaller) releases are compatible with a newer or the same system version
+                                                  QRegularExpression::CaseInsensitiveOption);
-    int sys_maj = getSystemVersion();
+    static const QRegularExpression macRegex(R"(-macOS(\d+)\.[^.]+$)", QRegularExpression::CaseInsensitiveOption);
-    int rel_maj = match.captured(1).toInt();
+    regex = isIntel ? &macIntelRegex : &macRegex;
-    return rel_maj == sys_maj;
 
 #elif defined(Q_OS_WIN)
-#if Q_PROCESSOR_WORDSIZE == 8 // 64-bit
+    // Windows (x86) --> Cockatrice-3.0.0-Windows10.exe
-    const QString &version = QSysInfo::productVersion();
+    static const QRegularExpression winRegex(R"(-(?:Win|Windows)(\d+)\.[^.]+$)",
-    if (version.startsWith("7") || version.startsWith("8")) {
+                                             QRegularExpression::CaseInsensitiveOption);
-        return fileName.contains("Win7");
+    regex = &winRegex;
-    } else {
+
-        return fileName.contains("Win10");
+#else // if the OS doesn't fit one of the above #defines, then it will never match
-    }
-#else
     Q_UNUSED(fileName);
-    return false;
+    return std::nullopt;
 #endif
 
-#else // If the OS doesn't fit one of the above #defines, then it will never match
+    // Any asset targeting an OS version up to the current host version works
-    Q_UNUSED(fileName);
+    auto match = regex->match(fileName);
-    return false;
+    if (!match.hasMatch()) {
-#endif
+        return std::nullopt;
+    }
+    const int targetVersion = match.captured(1).toInt();
+    if (targetVersion > *systemVersion) {
+        return std::nullopt;
+    }
+    return targetVersion;
+}
+
+// Pick newest targeted version (highest number) amongst all compatible ones
+QString ReleaseChannel::findBestDownloadUrl(const QVariantList &assets)
+{
+    QString bestUrl;
+    int bestVersion = -1;
+    for (const auto &rawAsset : assets) {
+        QVariantMap asset = rawAsset.toMap();
+        QString name = asset["name"].toString();
+        QString url = asset["browser_download_url"].toString();
+        auto version = getTargetVersionForCurrentOS(name);
+        if (!version) {
+            continue;
+        }
+        if (*version > bestVersion) {
+            bestVersion = *version;
+            bestUrl = url;
+        }
+    }
+    if (!bestUrl.isEmpty()) {
+        qCInfo(ReleaseChannelLog) << "Best compatible asset=" << bestUrl;
+    }
+    return bestUrl;
 }
 
 QString StableReleaseChannel::getManualDownloadUrl() const
@@ -136,16 +200,9 @@ void StableReleaseChannel::releaseListFinished()
     lastRelease->setPublishDate(resultMap["published_at"].toDate());
 
     if (resultMap.contains("assets")) {
-        auto rawAssets = resultMap["assets"].toList();
+        auto url = findBestDownloadUrl(resultMap["assets"].toList());
-        for (const auto &rawAsset : rawAssets) {
+        if (!url.isEmpty()) {
-            QVariantMap asset = rawAsset.toMap();
+            lastRelease->setDownloadUrl(url);
-            QString name = asset["name"].toString();
-            QString url = asset["browser_download_url"].toString();
-
-            if (downloadMatchesCurrentOS(name)) {
-                lastRelease->setDownloadUrl(url);
-                break;
-            }
         }
     }
 
@@ -287,21 +344,10 @@ void BetaReleaseChannel::fileListFinished()
     bool needToUpdate = (QString::compare(shortHash, myHash, Qt::CaseInsensitive) != 0);
     bool compatibleVersion = false;
 
-    QStringList resultUrlList{};
+    QString downloadUrl = findBestDownloadUrl(resultList);
-    for (QVariant file : resultList) {
+    if (!downloadUrl.isEmpty()) {
-        QVariantMap map = file.toMap();
+        compatibleVersion = true;
-        resultUrlList << map["browser_download_url"].toString();
+        lastRelease->setDownloadUrl(downloadUrl);
-    }
-
-    resultUrlList.sort();
-    // iterate in reverse so the first item is the latest os version
-    for (auto url = resultUrlList.rbegin(); url < resultUrlList.rend(); ++url) {
-        if (downloadMatchesCurrentOS(*url)) {
-            compatibleVersion = true;
-            lastRelease->setDownloadUrl(*url);
-            qCInfo(ReleaseChannelLog) << "Found compatible version url=" << *url;
-            break;
-        }
     }
 
     emit finishedCheck(needToUpdate, compatibleVersion, lastRelease);

cockatrice/src/client/network/update/client/release_channel.h

@@ -12,6 +12,7 @@
 #include <QObject>
 #include <QString>
 #include <QVariantMap>
+#include <optional>
 #include <utility>
 
 inline Q_LOGGING_CATEGORY(ReleaseChannelLog, "release_channel");
@@ -96,7 +97,8 @@ protected:
     Release *lastRelease;
 
 protected:
-    static bool downloadMatchesCurrentOS(const QString &fileName);
+    static std::optional<int> getTargetVersionForCurrentOS(const QString &fileName);
+    static QString findBestDownloadUrl(const QVariantList &assets);
     [[nodiscard]] virtual QString getReleaseChannelUrl() const = 0;
 
 public:

cockatrice/src/client/settings/cache_settings.cpp

@@ -110,6 +110,16 @@ SettingsCache::SettingsCache()
 
     settings = new QSettings(settingsPath + "global.ini", QSettings::IniFormat, this);
 
+    // Both migrations below overwrite per-domain files in place, so snapshot the whole settings
+    // folder first: global.ini is preserved as global.ini.old, but pre-existing per-domain files
+    // (and a re-migration after a downgrade) would otherwise have no way back.
+    if (SettingsMigration::isMigrationPending(settingsPath)) {
+        const QString backupPath = SettingsMigration::backupSettingsDirectory(settingsPath);
+        if (!backupPath.isEmpty()) {
+            qCInfo(SettingsCacheLog) << "[SettingsCache] Settings backed up before migration:" << backupPath;
+        }
+    }
+
     // Migrate from legacy NativeFormat settings to per-class INI files (runs at most once)
     if (!isPortableBuild) {
         SettingsMigration::migrateLegacySettings(settingsPath);

cockatrice/src/client/settings/cache_settings.h

@@ -58,33 +58,33 @@ signals:
     void themeChanged();
 
 private:
-    QSettings *settings;
+    QSettings *settings = nullptr;
-    ShortcutsSettings *shortcutsSettings;
+    ShortcutsSettings *shortcutsSettings = nullptr;
-    CardDatabaseSettings *cardDatabaseSettings;
+    CardDatabaseSettings *cardDatabaseSettings = nullptr;
-    ServersSettings *serversSettings;
+    ServersSettings *serversSettings = nullptr;
-    MessageSettings *messageSettings;
+    MessageSettings *messageSettings = nullptr;
-    GameFiltersSettings *gameFiltersSettings;
+    GameFiltersSettings *gameFiltersSettings = nullptr;
-    LayoutsSettings *layoutsSettings;
+    LayoutsSettings *layoutsSettings = nullptr;
-    DownloadSettings *downloadSettings;
+    DownloadSettings *downloadSettings = nullptr;
-    RecentsSettings *recentsSettings;
+    RecentsSettings *recentsSettings = nullptr;
-    CardOverrideSettings *cardOverrideSettings;
+    CardOverrideSettings *cardOverrideSettings = nullptr;
-    DebugSettings *debugSettings;
+    DebugSettings *debugSettings = nullptr;
-    CardCounterSettings *cardCounterSettings;
+    CardCounterSettings *cardCounterSettings = nullptr;
-    TabsSettings *tabsSettings;
+    TabsSettings *tabsSettings = nullptr;
-    SoundSettings *soundSettings;
+    SoundSettings *soundSettings = nullptr;
-    GameSettings *gameSettings;
+    GameSettings *gameSettings = nullptr;
-    ChatSettings *chatSettings;
+    ChatSettings *chatSettings = nullptr;
-    CacheStorageSettings *cacheStorageSettings;
+    CacheStorageSettings *cacheStorageSettings = nullptr;
-    UpdatesSettings *updatesSettings;
+    UpdatesSettings *updatesSettings = nullptr;
-    PersonalSettings *personalSettings;
+    PersonalSettings *personalSettings = nullptr;
-    CardsDisplaySettings *cardsDisplaySettings;
+    CardsDisplaySettings *cardsDisplaySettings = nullptr;
-    InterfaceSettings *interfaceSettings;
+    InterfaceSettings *interfaceSettings = nullptr;
-    DeckEditorSettings *deckEditorSettings;
+    DeckEditorSettings *deckEditorSettings = nullptr;
-    PathsSettings *pathsSettings;
+    PathsSettings *pathsSettings = nullptr;
-    VisualDeckStorageSettings *visualDeckStorageSettings;
+    VisualDeckStorageSettings *visualDeckStorageSettings = nullptr;
-    AppearanceSettings *appearanceSettings;
+    AppearanceSettings *appearanceSettings = nullptr;
-    NetworkSettings *networkSettings;
+    NetworkSettings *networkSettings = nullptr;
-    CommanderBracketSettings *commanderBracketSettings;
+    CommanderBracketSettings *commanderBracketSettings = nullptr;
 
     QString themeName;
 

cockatrice/src/filters/deck_filter_string.cpp

@@ -43,6 +43,12 @@ NumericValue <- [0-9]+
 
 static std::once_flag init;
 
+// The peglib parser is a single permanent object, so the rule actions below cannot see
+// per-instance state. The card language that the nested [[card name]] search matches
+// against is passed through this thread-local context, which is live only while a
+// DeckFilterString is being parsed, and copied into the nested FilterString closures.
+thread_local CardSearchLanguage deckSearchLanguageContext;
+
 static void setupParserRules()
 {
     // plumbing
@@ -116,7 +122,7 @@ static void setupParserRules()
 
     // actual functionality
     search["DeckContentQuery"] = [](const peg::SemanticValues &sv) -> DeckFilter {
-        auto cardFilter = FilterString(std::any_cast<QString>(sv[0]));
+        auto cardFilter = FilterString(std::any_cast<QString>(sv[0]), deckSearchLanguageContext);
         auto numberMatcher = sv.size() > 1 ? std::any_cast<NumberMatcher>(sv[1]) : [](int count) { return count > 0; };
 
         return [=](const DeckSearchData &data) -> bool {
@@ -186,7 +192,7 @@ DeckFilterString::DeckFilterString()
     _error = "Not initialized";
 }
 
-DeckFilterString::DeckFilterString(const QString &expr)
+DeckFilterString::DeckFilterString(const QString &expr, const CardSearchLanguage &searchLanguage)
 {
     QByteArray ba = expr.simplified().toUtf8();
 
@@ -199,6 +205,8 @@ DeckFilterString::DeckFilterString(const QString &expr)
         return;
     }
 
+    deckSearchLanguageContext = searchLanguage;
+
     search.set_logger([&](size_t /*ln*/, size_t col, const std::string &msg) {
         _error = QString("Error at position %1: %2").arg(col).arg(QString::fromStdString(msg));
     });

cockatrice/src/filters/deck_filter_string.h

@@ -12,6 +12,7 @@
 #include <QLoggingCategory>
 #include <QString>
 #include <functional>
+#include <libcockatrice/card/card_localization.h>
 
 inline Q_LOGGING_CATEGORY(DeckFilterStringLog, "deck_filter_string");
 
@@ -35,7 +36,7 @@ class DeckFilterString
 {
 public:
     DeckFilterString();
-    explicit DeckFilterString(const QString &expr);
+    explicit DeckFilterString(const QString &expr, const CardSearchLanguage &searchLanguage = {});
     bool check(const DeckSearchData &data) const
     {
         return filter(data);

cockatrice/src/game/game_state.cpp

@@ -29,13 +29,17 @@ void GameState::incrementGameTime()
 void GameState::setGameTime(int _secondsElapsed)
 {
     secondsElapsed = _secondsElapsed;
+    emit updateTimeElapsedLabel(formatElapsedTime(_secondsElapsed));
+}
+
+QString GameState::formatElapsedTime(int _secondsElapsed)
+{
     int seconds = _secondsElapsed;
     int minutes = seconds / 60;
     seconds -= minutes * 60;
     int hours = minutes / 60;
     minutes -= hours * 60;
 
-    emit updateTimeElapsedLabel(QString::number(hours).rightJustified(2, '0') + ":" +
+    return QString::number(hours).rightJustified(2, '0') + ":" + QString::number(minutes).rightJustified(2, '0') + ":" +
-                                QString::number(minutes).rightJustified(2, '0') + ":" +
+           QString::number(seconds).rightJustified(2, '0');
-                                QString::number(seconds).rightJustified(2, '0'));
 }

cockatrice/src/game/game_state.h

@@ -110,6 +110,11 @@ public:
         return hostId;
     }
 
+    int getSecondsElapsed() const
+    {
+        return secondsElapsed;
+    }
+
 signals:
     void updateTimeElapsedLabel(QString newTime);
     void gameStarted(bool resuming);
@@ -121,6 +126,9 @@ public slots:
     void incrementGameTime();
     void setGameTime(int _secondsElapsed);
 
+public:
+    static QString formatElapsedTime(int _secondsElapsed);
+
 private:
     QTimer *gameTimer;
     int secondsElapsed;

cockatrice/src/game/zones/view_zone_logic.cpp

@@ -154,6 +154,14 @@ void ZoneViewZoneLogic::removeCard(int position, bool toNewZone)
     reorganizeCards();
 }
 
+void ZoneViewZoneLogic::clearCards()
+{
+    for (auto card : cards) {
+        card->deleteLater();
+    }
+    cards.clear();
+}
+
 void ZoneViewZoneLogic::setWriteableRevealZone(bool _writeableRevealZone)
 {
 

cockatrice/src/game/zones/view_zone_logic.h

@@ -41,6 +41,10 @@ public:
     bool prepareAddCard(int x);
     void removeCard(int position, bool toNewZone);
     void updateCardIds(CardAction action);
+
+    /** @brief Removes all cards from the view, without touching anything else. Used in replay rewind */
+    void clearCards();
+
     int getNumberCards() const
     {
         return numberCards;

cockatrice/src/game_graphics/dialogs/dlg_create_token.cpp

@@ -16,11 +16,13 @@
 #include <QLineEdit>
 #include <QRadioButton>
 #include <QTreeView>
+#include <libcockatrice/card/card_localization.h>
 #include <libcockatrice/card/database/card_database_manager.h>
 #include <libcockatrice/deck_list/deck_list.h>
 #include <libcockatrice/models/database/card_database_model.h>
 #include <libcockatrice/models/database/token/token_display_model.h>
 #include <libcockatrice/settings/card_override_settings.h>
+#include <libcockatrice/settings/cards_display_settings.h>
 #include <libcockatrice/settings/interface_settings.h>
 #include <libcockatrice/settings/layouts_settings.h>
 #include <libcockatrice/utility/string_limits.h>
@@ -88,6 +90,17 @@ DlgCreateToken::DlgCreateToken(const QStringList &_predefinedTokens, QWidget *pa
     cardDatabaseDisplayModel = new TokenDisplayModel(this);
     cardDatabaseDisplayModel->setSourceModel(cardDatabaseModel);
 
+    const auto applyCardSearchLanguage = [this]() {
+        const CardsDisplaySettings &cardsDisplay = SettingsCache::instance().cardsDisplay();
+        cardDatabaseDisplayModel->setSearchLanguage(CardSearchLanguage{
+            cardsDisplay.getCardLang(), static_cast<SearchLanguageMode>(cardsDisplay.getCardSearchLanguage())});
+    };
+    applyCardSearchLanguage();
+    connect(&SettingsCache::instance().cardsDisplay(), &CardsDisplaySettings::cardLangChanged, this,
+            applyCardSearchLanguage);
+    connect(&SettingsCache::instance().cardsDisplay(), &CardsDisplaySettings::cardSearchLanguageChanged, this,
+            applyCardSearchLanguage);
+
     chooseTokenFromAllRadioButton = new QRadioButton(tr("Show &all tokens"));
     connect(chooseTokenFromAllRadioButton, &QRadioButton::toggled, this, &DlgCreateToken::actChooseTokenFromAll);
     chooseTokenFromDeckRadioButton = new QRadioButton(tr("Show tokens from this &deck"));

cockatrice/src/game_graphics/dialogs/dlg_move_top_cards_until.cpp

@@ -1,5 +1,6 @@
 #include "dlg_move_top_cards_until.h"
 
+#include <QCompleter>
 #include <QDialogButtonBox>
 #include <QLabel>
 #include <QLineEdit>
@@ -19,6 +20,7 @@ DlgMoveTopCardsUntil::DlgMoveTopCardsUntil(QWidget *parent, const MoveTopCardsUn
     exprComboBox = new QComboBox(this);
     exprComboBox->setFocus();
     exprComboBox->setEditable(true);
+    exprComboBox->completer()->setCaseSensitivity(Qt::CaseSensitive);
     exprComboBox->setInsertPolicy(QComboBox::InsertAtTop);
     exprComboBox->insertItems(0, options.exprs);
     exprLabel->setBuddy(exprComboBox);

cockatrice/src/game_graphics/game_scene.cpp

@@ -735,6 +735,16 @@ void GameScene::clearViews()
     }
 }
 
+void GameScene::emptyActiveViews()
+{
+    for (auto zoneView : zoneViews) {
+        auto logic = qobject_cast<ZoneViewZoneLogic *>(zoneView->getZone()->getLogic());
+        if (!logic->getRevealZone()) {
+            logic->clearCards();
+        }
+    }
+}
+
 /**
  * @brief Closes the most recently added zone view.
  */

cockatrice/src/game_graphics/game_scene.h

@@ -227,6 +227,9 @@ public slots:
     /** @brief Closes all zone views. */
     void clearViews();
 
+    /** @brief Empties the contents of all non-reveal zone views. Used for replay rewinding */
+    void emptyActiveViews();
+
     /** @brief Closes the most recently added zone view. */
     void closeMostRecentZoneView();
     QTransform getViewTransform() const;

cockatrice/src/game_graphics/log/message_log_widget.cpp

@@ -1,15 +1,19 @@
 #include "message_log_widget.h"
 
+#include "../../client/settings/cache_settings.h"
 #include "../../client/settings/card_counter_settings.h"
 #include "../../client/sound_engine.h"
+#include "../../game/game_state.h"
 #include "../../game/phase.h"
 #include "../../game/player/player_logic.h"
+#include "../../interface/card_localization.h"
 #include "../../interface/widgets/tabs/tab_game.h"
 #include "../board/card_item.h"
 #include "../board/translate_counter_name.h"
 
 #include <libcockatrice/protocol/pb/context_move_card.pb.h>
 #include <libcockatrice/protocol/pb/context_mulligan.pb.h>
+#include <libcockatrice/settings/chat_settings.h>
 #include <libcockatrice/utility/zone_names.h>
 #include <utility>
 
@@ -20,7 +24,11 @@ static QString sanitizeHtml(QString dirty)
 
 static QString cardLink(const QString &cardName)
 {
-    return QString("<i><a href=\"card://%1\">%2</a></i>").arg(cardName).arg(cardName);
+    // The href keeps the canonical name so the card popup can resolve it, while the label shows the name
+    // in the configured card language.
+    return QString("<i><a href=\"card://%1\">%2</a></i>")
+        .arg(sanitizeHtml(cardName))
+        .arg(sanitizeHtml(CardLocalization::displayNameFor(cardName)));
 }
 
 QPair<QString, QString>
@@ -626,13 +634,12 @@ void MessageLogWidget::logSetActivePhase(int phaseNumber)
 
     soundEngine->playSound(phase.soundFileName);
 
-    appendHtml("<font color=\"" + phase.color + "\"><b>" + QDateTime::currentDateTime().toString("[hh:mm:ss] ") +
+    appendHtml("<font color=\"" + phase.color + "\"><b>" + getCurrentTime() + phase.getName() + "</b></font>");
-               phase.getName() + "</b></font>");
 }
 
 void MessageLogWidget::logSetActivePlayer(PlayerLogic *player)
 {
-    appendHtml("<br><font color=\"green\"><b>" + QDateTime::currentDateTime().toString("[hh:mm:ss] ") +
+    appendHtml("<br><font color=\"green\"><b>" + getCurrentTime() +
                QString(tr("%1's turn.")).arg(player->getPlayerInfo()->getName()) + "</b></font><br>");
 }
 
@@ -801,10 +808,9 @@ void MessageLogWidget::logUndoDraw(PlayerLogic *player, QString cardName)
     if (cardName.isEmpty()) {
         appendHtmlServerMessage(tr("%1 undoes their last draw.").arg(sanitizeHtml(player->getPlayerInfo()->getName())));
     } else {
-        appendHtmlServerMessage(
+        appendHtmlServerMessage(tr("%1 undoes their last draw (%2).")
-            tr("%1 undoes their last draw (%2).")
+                                    .arg(sanitizeHtml(player->getPlayerInfo()->getName()))
-                .arg(sanitizeHtml(player->getPlayerInfo()->getName()))
+                                    .arg(cardLink(std::move(cardName))));
-                .arg(QString("<a href=\"card://%1\">%2</a>").arg(sanitizeHtml(cardName)).arg(sanitizeHtml(cardName))));
     }
 }
 
@@ -826,6 +832,14 @@ void MessageLogWidget::appendHtmlServerMessage(const QString &html, bool optiona
     ChatView::appendHtmlServerMessage(messagePrefix + html + messageSuffix, optionalIsBold, optionalFontColor);
 }
 
+QString MessageLogWidget::getCurrentTime() const
+{
+    if (SettingsCache::instance().chat().getUseGameTime()) {
+        return "[" + GameState::formatElapsedTime(game->getGameState()->getSecondsElapsed()) + "] ";
+    }
+    return ChatView::getCurrentTime();
+}
+
 void MessageLogWidget::connectToPlayerEventHandler(PlayerEventHandler *playerEventHandler)
 {
     connect(playerEventHandler, &PlayerEventHandler::logSay, this, &MessageLogWidget::logSay);

cockatrice/src/game_graphics/log/message_log_widget.h

@@ -104,6 +104,9 @@ public slots:
     void appendHtmlServerMessage(const QString &html,
                                  bool optionalIsBold = false,
                                  QString optionalFontColor = QString()) override;
+
+private:
+    [[nodiscard]] QString getCurrentTime() const override;
 };
 
 #endif

cockatrice/src/game_graphics/zones/view_zone.cpp

@@ -1,5 +1,6 @@
 #include "view_zone.h"
 
+#include "../../client/settings/cache_settings.h"
 #include "../../game/player/player_actions.h"
 #include "../../game/player/player_logic.h"
 #include "../../game/zones/view_zone_logic.h"
@@ -11,11 +12,13 @@
 #include <QGraphicsSceneWheelEvent>
 #include <QPainter>
 #include <QtMath>
+#include <libcockatrice/card/card_localization.h>
 #include <libcockatrice/protocol/pb/command_dump_zone.pb.h>
 #include <libcockatrice/protocol/pb/command_move_card.pb.h>
 #include <libcockatrice/protocol/pb/response_dump_zone.pb.h>
 #include <libcockatrice/protocol/pb/serverinfo_card.pb.h>
 #include <libcockatrice/protocol/pending_command.h>
+#include <libcockatrice/settings/cards_display_settings.h>
 
 /**
  * @param parent the parent QGraphicsWidget containing the reveal zone
@@ -253,7 +256,10 @@ ZoneViewZone::GridSize ZoneViewZone::positionCardsForDisplay(CardList &cards, Ca
 
 void ZoneViewZone::setFilterString(const QString &_filterString)
 {
-    filterString = FilterString(_filterString);
+    const CardsDisplaySettings &cardsDisplay = SettingsCache::instance().cardsDisplay();
+    filterString = FilterString(
+        _filterString, CardSearchLanguage{cardsDisplay.getCardLang(),
+                                          static_cast<SearchLanguageMode>(cardsDisplay.getCardSearchLanguage())});
     reorganizeCards();
 }
 

cockatrice/src/game_graphics/zones/view_zone_widget.cpp

@@ -21,6 +21,7 @@
 #include <QStyle>
 #include <QStyleOption>
 #include <libcockatrice/protocol/pb/command_shuffle.pb.h>
+#include <libcockatrice/settings/cards_display_settings.h>
 #include <libcockatrice/settings/interface_settings.h>
 
 namespace
@@ -168,6 +169,12 @@ ZoneViewWidget::ZoneViewWidget(PlayerLogic *_player,
         }
 
         connect(&searchEdit, &QLineEdit::textChanged, zone, &ZoneViewZone::setFilterString);
+
+        const auto applyCardSearchLanguage = [this] { zone->setFilterString(searchEdit.text()); };
+        connect(&SettingsCache::instance().cardsDisplay(), &CardsDisplaySettings::cardLangChanged, this,
+                applyCardSearchLanguage);
+        connect(&SettingsCache::instance().cardsDisplay(), &CardsDisplaySettings::cardSearchLanguageChanged, this,
+                applyCardSearchLanguage);
     }
 
     setLayout(vbox);

cockatrice/src/interface/card_localization.h

@@ -5,6 +5,7 @@
 
 #include <QString>
 #include <libcockatrice/card/card_info.h>
+#include <libcockatrice/card/database/card_database_manager.h>
 #include <libcockatrice/settings/cards_display_settings.h>
 
 namespace CardLocalization
@@ -54,6 +55,25 @@ inline QString displayText(const CardInfo &card)
 {
     return card.getLocalizedText(displayLang());
 }
+
+/**
+ * @brief Looks a card up by its canonical name and returns its name in the configured display language.
+ *
+ * Use this where only the canonical name is known, such as the game log or [card] chat tags. Callers that
+ * already hold a resolved card and need to keep the canonical name around (as a link target, say) should
+ * use displayName() directly instead.
+ *
+ * @param cardName The canonical card name.
+ * @return The localized name, or cardName unchanged when the card is unknown to the database.
+ */
+inline QString displayNameFor(const QString &cardName)
+{
+    if (cardName.isEmpty()) {
+        return cardName;
+    }
+    const QString localizedName = displayName(CardDatabaseManager::query()->getCardInfo(cardName));
+    return localizedName.isEmpty() ? cardName : localizedName;
+}
 } // namespace CardLocalization
 
 #endif // COCKATRICE_CARD_LOCALIZATION_H

cockatrice/src/interface/card_picture_loader/card_picture_loader.cpp

@@ -11,6 +11,7 @@
 #include <QDir>
 #include <QFileInfo>
 #include <QMainWindow>
+#include <QMetaObject>
 #include <QMovie>
 #include <QNetworkRequest>
 #include <QPainter>
@@ -43,6 +44,7 @@ CardPictureLoader::CardPictureLoader() : QObject(nullptr)
 
     qRegisterMetaType<ExactCard>("ExactCard");
     connect(worker, &CardPictureLoaderWorker::imageLoaded, this, &CardPictureLoader::imageLoaded);
+    connect(worker, &CardPictureLoaderWorker::networkCacheCleared, this, &CardPictureLoader::networkCacheCleared);
 
     statusBar = new CardPictureLoaderStatusBar(nullptr);
     QMainWindow *mainWindow = qobject_cast<QMainWindow *>(QApplication::activeWindow());
@@ -58,7 +60,18 @@ CardPictureLoader::CardPictureLoader() : QObject(nullptr)
 
 CardPictureLoader::~CardPictureLoader()
 {
-    worker->deleteLater();
+    if (worker) {
+        // Capture the thread first: shutdownThread() blocks until the worker has been freed by the
+        // finished() -> deleteLater chain, after which the worker pointer must not be dereferenced.
+        QThread *pictureLoaderThread = worker->workerThread();
+        const bool stopped = worker->shutdownThread();
+        worker = nullptr;
+        // Deleting a QThread that is still running is undefined behaviour, so only free it once the
+        // bounded wait in shutdownThread() confirmed that it stopped.
+        if (stopped) {
+            delete pictureLoaderThread;
+        }
+    }
 }
 
 void CardPictureLoader::getCardBackPixmap(QPixmap &pixmap, QSize size)
@@ -457,7 +470,17 @@ void CardPictureLoader::clearPixmapCache()
 
 void CardPictureLoader::clearNetworkCache()
 {
-    getInstance().worker->clearNetworkCache();
+    // During teardown the worker is released before this singleton, so a queued clear may still
+    // arrive with no worker left to run it.
+    CardPictureLoaderWorker *worker = getInstance().worker;
+    if (!worker) {
+        return;
+    }
+    // The disk cache and redirect cache are owned by the worker thread, so the clear has to run
+    // there. Invoke it asynchronously to keep the GUI responsive while the worker may be walking
+    // the user's picture directories or recursively deleting the cache directory; callers that
+    // need to know when it is done can listen for networkCacheCleared().
+    QMetaObject::invokeMethod(worker, &CardPictureLoaderWorker::clearNetworkCache, Qt::QueuedConnection);
 }
 
 void CardPictureLoader::cacheCardPixmaps(const QList<ExactCard> &cards)

cockatrice/src/interface/card_picture_loader/card_picture_loader.h

@@ -117,6 +117,9 @@ public:
 public slots:
     /**
      * @brief Clears the network disk cache of the worker.
+     *
+     * The clear runs on the worker thread, so this returns before it has completed; connect to
+     * networkCacheCleared() to act once it is done.
      */
     static void clearNetworkCache();
 
@@ -131,6 +134,10 @@ public slots:
     void installPrintingOverride(const ExactCard &originalCard, const ExactCard &overrideCard);
     void installPrintingOverrideOnLoad(const ExactCard &originalCard, const ExactCard &overrideCard);
 
+signals:
+    /** @brief Emitted after the worker has finished clearing the network and redirect caches. */
+    void networkCacheCleared();
+
 private slots:
     /**
      * @brief Triggered when the user changes the picture download settings.

cockatrice/src/interface/card_picture_loader/card_picture_loader_local.cpp

@@ -101,7 +101,7 @@ QImage CardPictureLoaderLocal::tryLoadCardImageFromDisk(const QString &setName,
         for (const QString &path : candidatePaths) {
             QFileInfo fileInfo(path);
             QDir dir = fileInfo.dir();
-            QString baseName = fileInfo.fileName();
+            QString baseName = fileInfo.completeBaseName();
 
             if (!dir.exists()) {
                 continue;

cockatrice/src/interface/card_picture_loader/card_picture_loader_worker.cpp

@@ -16,13 +16,16 @@
 #include <utility>
 #include <version_string.h>
 
-static constexpr int MAX_REQUESTS_PER_SEC = 10;
+static constexpr int MAX_REQUESTS_PER_SEC = DownloadSettings::DEFAULT_HOST_REQUEST_LIMIT;
-static constexpr int MIN_HOST_QUOTA = 1;          ///< Floor for the per-host request allowance
+static constexpr int MIN_HOST_QUOTA = DownloadSettings::MIN_HOST_REQUEST_LIMIT;
-static constexpr qint64 QUOTA_RECOVER_MS = 60000; ///< Idle time before a reduced quota starts recovering
+static constexpr qint64 QUOTA_RECOVER_MS = 60000;       ///< Idle time before a reduced quota starts recovering
+static constexpr int DISPATCH_INTERVAL_MS = 100;        ///< Pacing between individual network requests
+static constexpr qint64 QUOTA_RESET_INTERVAL_MS = 1000; ///< Interval at which the request quota resets
+static constexpr int THREAD_SHUTDOWN_WAIT_MS = 5000;    ///< Bounded wait for the worker thread to stop at exit
 
 CardPictureLoaderWorker::CardPictureLoaderWorker()
     : QObject(nullptr), picDownload(SettingsCache::instance().downloads().getPicDownload()),
-      requestQuota(MAX_REQUESTS_PER_SEC)
+      hostRequestLimits(SettingsCache::instance().downloads().getHostRequestLimits())
 {
     networkManager = new QNetworkAccessManager(this);
     // We need a timeout to ensure requests don't hang indefinitely in case of
@@ -57,20 +60,59 @@ CardPictureLoaderWorker::CardPictureLoaderWorker()
     localLoader = new CardPictureLoaderLocal(this);
 
     pictureLoaderThread = new QThread;
+    // The worker object frees itself once its thread finishes, so no event loop is left
+    // running and the QThread is never destroyed while still executing.
+    connect(pictureLoaderThread, &QThread::finished, this, &QObject::deleteLater);
     pictureLoaderThread->start(QThread::LowPriority);
     moveToThread(pictureLoaderThread);
 
+    // QTimer value members are not QObject children, so moveToThread on the worker doesn't move
+    // them. They must live in the worker's thread to be started from the slot code that runs there.
+    requestTimer.moveToThread(pictureLoaderThread);
+    dispatchTimer.moveToThread(pictureLoaderThread);
+
     connect(this, &CardPictureLoaderWorker::imageLoadEnqueued, this, &CardPictureLoaderWorker::handleImageLoadEnqueued);
 
     connect(&requestTimer, &QTimer::timeout, this, &CardPictureLoaderWorker::resetRequestQuota);
-    requestTimer.setInterval(1000);
+    requestTimer.setInterval(static_cast<int>(QUOTA_RESET_INTERVAL_MS));
-    requestTimer.start();
+
+    connect(&dispatchTimer, &QTimer::timeout, this, &CardPictureLoaderWorker::dispatchQueuedRequest);
+    dispatchTimer.setInterval(DISPATCH_INTERVAL_MS);
+
+    connect(&SettingsCache::instance().downloads(), &DownloadSettings::hostRequestLimitsChanged, this,
+            [this] { hostRequestLimits = SettingsCache::instance().downloads().getHostRequestLimits(); });
 }
 
 CardPictureLoaderWorker::~CardPictureLoaderWorker()
 {
     saveRedirectCache();
-    pictureLoaderThread->deleteLater();
+}
+
+bool CardPictureLoaderWorker::shutdownThread()
+{
+    // The finished() -> deleteLater chain (wired in the constructor) frees this worker as soon as
+    // its event loop exits, so nothing - not even a member read - may run once wait() returns.
+    // QThread::quit() and QThread::wait() are thread-safe and may be called from the owning thread.
+    QThread *thread = pictureLoaderThread;
+    if (!thread) {
+        return true;
+    }
+    thread->quit();
+    // Only an unbounded wait() would guarantee the thread stops, but this runs from a function-local
+    // static destructor after main() has returned, with no UI left to interrupt a worker stuck in a
+    // slow slot or on a stalled filesystem. Bound the wait and leave such a thread to the OS rather
+    // than hanging the process forever.
+    if (!thread->wait(THREAD_SHUTDOWN_WAIT_MS)) {
+        qCWarning(CardPictureLoaderWorkerLog) << "Picture loader worker thread did not stop within"
+                                              << THREAD_SHUTDOWN_WAIT_MS << "ms; leaving it to be torn down by the OS";
+        return false;
+    }
+    return true;
+}
+
+QThread *CardPictureLoaderWorker::workerThread() const
+{
+    return pictureLoaderThread;
 }
 
 void CardPictureLoaderWorker::queueRequest(const QUrl &url, CardPictureLoaderWorkerWork *worker)
@@ -99,7 +141,17 @@ QNetworkReply *CardPictureLoaderWorker::makeRequest(const QUrl &url, CardPicture
     // Check for cached redirects
     QUrl cachedRedirect = getCachedRedirect(url);
     if (!cachedRedirect.isEmpty()) {
+        // The status bar still needs to reclaim this URL's widget even when we hand the request back
+        // for a deferred retry instead of dispatching it onto the network.
         emit imageRequestSucceeded(url);
+        // The redirect target is a different host, which may itself be in 429 backoff; hand the
+        // entry back to its worker so it waits the backoff out instead of dispatching straight
+        // onto the backed-off host.
+        if (CardPictureLoaderWorkerWork::rateLimiter().isRateLimited(cachedRedirect.host(),
+                                                                     QDateTime::currentDateTime())) {
+            worker->scheduleDeferredRetry(cachedRedirect.host());
+            return nullptr;
+        }
         return makeRequest(cachedRedirect, worker);
     }
 
@@ -110,67 +162,258 @@ QNetworkReply *CardPictureLoaderWorker::makeRequest(const QUrl &url, CardPicture
     // Cached entries are served straight from the disk cache even when picture downloads are
     // enabled: re-fetching an already-cached image would burn the rate limit for nothing. Only a
     // genuine cache miss goes to the network, and only when downloads are enabled.
-    bool useNetworkCache = static_cast<CardPictureLoaderCacheMethod::CacheMethod>(
+    bool useNetworkCache = !requestTouchesNetwork(url);
-                               SettingsCache::instance().cacheStorage().getCardPictureLoaderCacheMethod()) ==
-                               CardPictureLoaderCacheMethod::CacheMethod::NETWORK_CACHE &&
-                           (cache->metaData(url).isValid() || !picDownload);
 
     req.setAttribute(QNetworkRequest::CacheLoadControlAttribute,
                      useNetworkCache ? QNetworkRequest::AlwaysCache : QNetworkRequest::AlwaysNetwork);
 
     QNetworkReply *reply = networkManager->get(req);
 
-    // Connect reply handling
+    // Track in-flight replies per host so the unlocked fast path can bound how many requests it
-    connect(reply, &QNetworkReply::finished, worker, [reply, worker] { worker->handleNetworkReply(reply); });
+    // issues at once, instead of creating replies that time out before Qt opens a connection.
+    const QString host = url.host();
+    hostInFlight.insert(host, hostInFlight.value(host) + 1);
+
+    // Release the in-flight slot when the reply is destroyed, not when it emits `finished`, and use
+    // the worker (not the work object) as the context object: a reply can go away without ever
+    // finishing (aborted, or a work object deleted while a reply is still pending), and a connection
+    // bound to that work object's lifetime would then never run, permanently shrinking the fast
+    // path's concurrency until it wedges. This way the slot is released exactly once.
+    connect(reply, &QObject::destroyed, this,
+            [this, host] { hostInFlight.insert(host, qMax(0, hostInFlight.value(host) - 1)); });
+
+    // Connect reply handling; the work object is the context so its handler dies with it.
+    connect(reply, &QNetworkReply::finished, worker, [worker, reply] { worker->handleNetworkReply(reply); });
 
     return reply;
 }
 
 void CardPictureLoaderWorker::resetRequestQuota()
 {
-    requestQuota = MAX_REQUESTS_PER_SEC;
-
     QDateTime now = QDateTime::currentDateTime();
-    for (auto it = hostRequestQuota.begin(); it != hostRequestQuota.end(); ++it) {
+    for (auto it = hostRequestQuota.begin(); it != hostRequestQuota.end();) {
         if (!hostLast429.contains(it.key()) || now.msecsTo(hostLast429.value(it.key())) < -QUOTA_RECOVER_MS) {
-            it.value() = qMin(MAX_REQUESTS_PER_SEC, it.value() + 1);
+            if (hostAllowanceCeiling(it.key()) == DownloadSettings::UNLIMITED_HOST_QUOTA) {
+                // A developer-unlocked host that fell back after a 429 recovers towards the default
+                // allowance; once it gets there it becomes unlocked (fast-path) again.
+                if (it.value() + 1 >= DownloadSettings::DEFAULT_HOST_REQUEST_LIMIT) {
+                    it = hostRequestQuota.erase(it);
+                    continue;
+                }
+                it.value() += 1;
+            } else {
+                // Recover towards the host's effective allowance ceiling, which may be
+                // lowered by the user's per-host request limits.
+                it.value() = qMin(hostAllowanceCeiling(it.key()), it.value() + 1);
+            }
         }
+        ++it;
     }
 
-    for (const auto &request : requestLoadQueue) {
+    // Forget the per-second allowances; each host's allowance is re-seeded lazily from its
-        const QString host = request.first.host();
+    // reduced sustained quota the first time it is dispatched in the new second, so a host that
-        hostQuotaRemaining.insert(host, hostRequestQuota.value(host, MAX_REQUESTS_PER_SEC));
+    // enters the queue mid-second no longer falls through to a fresh full quota.
-    }
+    hostQuotaRemaining.clear();
 
-    processQueuedRequests();
+    updateTimerState();
 }
 
 void CardPictureLoaderWorker::processQueuedRequests()
 {
-    while (requestQuota > 0 && processSingleRequest()) {
+    // QTimer must be started from the thread it lives in; if this public slot is ever reached from
-        --requestQuota;
+    // another thread, replay it on the worker's event loop instead of letting start() fail silently.
+    if (thread() != QThread::currentThread()) {
+        QMetaObject::invokeMethod(this, &CardPictureLoaderWorker::processQueuedRequests, Qt::QueuedConnection);
+        return;
+    }
+    updateTimerState();
+}
+
+void CardPictureLoaderWorker::dispatchQueuedRequest()
+{
+    if (requestLoadQueue.isEmpty()) {
+        // All queued requests have been dispatched; stop the pacing timers.
+        updateTimerState();
+        return;
+    }
+
+    QDateTime now = QDateTime::currentDateTime();
+    bool dispatched = false;
+    // Set while an unlocked host still has queued work blocked only by the in-flight cap; the
+    // timer must keep running so it gets another try as soon as a slot frees. A host blocked by
+    // its 429 backoff instead waits for the next quota-reset tick to restart the dispatcher.
+    bool unlockedCapped = false;
+
+    // Unlocked hosts (developer cap UNLIMITED_HOST_QUOTA) skip the pacing and the per-host
+    // allowance: dispatch their queued requests back-to-back, bounded by their 429 backoff and the
+    // per-host in-flight cap so a large burst can't queue replies that time out before Qt opens a
+    // connection for them.
+    for (int i = 0; i < requestLoadQueue.size();) {
+        const auto &request = requestLoadQueue.at(i);
+        // Dispatch decisions must key on the host the request will actually go to, not the URL that
+        // merely redirects to it: a redirect learned after this URL was queued would otherwise
+        // bypass the in-flight cap and drain the whole queue onto the target host unchecked.
+        const QUrl resolvedUrl = resolveCachedRedirect(request.first);
+        const QString host = resolvedUrl.host();
+        if (isUnlockedHost(host)) {
+            if (CardPictureLoaderWorkerWork::rateLimiter().isRateLimited(host, now)) {
+                ++i;
+                continue;
+            }
+            if (hostInFlight.value(host) < MAX_IN_FLIGHT_PER_HOST) {
+                makeRequest(resolvedUrl, request.second);
+                requestLoadQueue.removeAt(i);
+                dispatched = true;
+                continue;
+            }
+            unlockedCapped = true;
+        }
+        ++i;
+    }
+
+    if (requestLoadQueue.isEmpty()) {
+        dispatchTimer.stop();
+        requestTimer.stop();
+        return;
+    }
+
+    if (processSingleRequest()) {
+        dispatched = true;
+    }
+
+    // Keep the timer running while there is progress to make or unlocked work waiting on a free
+    // in-flight slot; otherwise no host has allowance left this second, so wait for the quota reset.
+    if (!dispatched && !unlockedCapped) {
+        dispatchTimer.stop();
+    }
+}
+
+void CardPictureLoaderWorker::updateTimerState()
+{
+    // Never restart an active timer: that would reset the pacing countdown and a burst of enqueues
+    // could keep starving the dispatcher, so only (re)start a timer that has actually stopped.
+    if (requestLoadQueue.isEmpty()) {
+        dispatchTimer.stop();
+        // Forget per-second allowances once nothing is pending: a stale zero would otherwise delay
+        // the next single request by a full quota-reset interval.
+        hostQuotaRemaining.clear();
+    } else if (!dispatchTimer.isActive()) {
+        dispatchTimer.start();
+    }
+
+    // The quota timer resets allowances every second and is also the only thing that heals a host
+    // after a 429 (see resetRequestQuota). It must keep ticking while work is queued or a host is
+    // still recovering below the ceiling, and only winds down once no host needs recovery anymore.
+    // Keeping it alive during such idle periods lets reduced quotas recover as intended.
+    bool hostRecovering = false;
+    for (auto it = hostRequestQuota.cbegin(); it != hostRequestQuota.cend(); ++it) {
+        if (it.value() < MAX_REQUESTS_PER_SEC) {
+            hostRecovering = true;
+            break;
+        }
+    }
+
+    if (!requestLoadQueue.isEmpty() || hostRecovering) {
+        if (!requestTimer.isActive()) {
+            requestTimer.start();
+        }
+    } else if (requestTimer.isActive()) {
+        requestTimer.stop();
     }
 }
 
 bool CardPictureLoaderWorker::processSingleRequest()
 {
+    QDateTime now = QDateTime::currentDateTime();
     for (int i = 0; i < requestLoadQueue.size(); ++i) {
-        const auto &request = requestLoadQueue.at(i);
+        // Copy the entry: takeAt(i) below erases within the list this reference points into.
-        QString host = request.first.host();
+        const auto request = requestLoadQueue.at(i);
-        int allowance = hostQuotaRemaining.value(host, MAX_REQUESTS_PER_SEC);
+        // Resolve cached redirects so the rate-limit and allowance arithmetic keys on the host the
+        // request will actually hit (see resolveCachedRedirect).
+        const QUrl resolvedUrl = resolveCachedRedirect(request.first);
+        const QString host = resolvedUrl.host();
+        // Don't dispatch requests to a host that is currently in its 429 backoff; hand the entry
+        // back to its worker so it can wait the backoff out or fall through to another source,
+        // instead of leaving it parked in the queue with no reply pending. Only applies to
+        // requests that will actually touch the network: one that will be served from the disk
+        // cache costs nothing and shouldn't wait out the 429.
+        if (requestTouchesNetwork(request.first) &&
+            CardPictureLoaderWorkerWork::rateLimiter().isRateLimited(host, now)) {
+            // The queued URL is usually a cached-redirect target whose host differs from
+            // cardToDownload.getCurrentUrl(), so scheduleDeferredRetry() (which waits out the
+            // blocked host's deadline) is used instead of startNextPicDownload() looping on the
+            // original host.
+            auto entry = requestLoadQueue.takeAt(i);
+            if (host != entry.first.host()) {
+                // A cached redirect target is what is blocked, which the work object would not
+                // discover from its own URL; wait out that specific host (with jitter) instead.
+                entry.second->scheduleDeferredRetry(host);
+            } else {
+                entry.second->startNextPicDownload();
+            }
+            return true;
+        }
+        // Unlocked hosts are handled by dispatchQueuedRequest's fast path, bounded by the in-flight
+        // cap; they must not fall through to the per-host allowance arithmetic below.
+        if (isUnlockedHost(host)) {
+            continue;
+        }
+        int ceiling = hostAllowanceCeiling(host);
+        if (ceiling == DownloadSettings::UNLIMITED_HOST_QUOTA) {
+            // A 429 dropped this unlocked host out of the fast path and installed a concrete
+            // allowance; pace it against that allowance until the recovery loop unlocks it again.
+            ceiling = hostRequestQuota.value(host, DownloadSettings::DEFAULT_HOST_REQUEST_LIMIT);
+        }
+        // Seed the allowance lazily so a host that enters the queue mid-second gets its reduced
+        // per-host allowance, clamped against the ceiling so a lowered user cap applies from this
+        // second onward.
+        if (!hostQuotaRemaining.contains(host)) {
+            hostQuotaRemaining.insert(host, qMin(ceiling, hostRequestQuota.value(host, ceiling)));
+        }
+        int allowance = hostQuotaRemaining.value(host);
         if (allowance > 0) {
             hostQuotaRemaining.insert(host, allowance - 1);
-            makeRequest(request.first, request.second);
+            auto entry = requestLoadQueue.takeAt(i);
-            requestLoadQueue.removeAt(i);
+            makeRequest(resolvedUrl, entry.second);
             return true;
         }
     }
     return false;
 }
 
+bool CardPictureLoaderWorker::requestTouchesNetwork(const QUrl &url) const
+{
+    bool useNetworkCache = static_cast<CardPictureLoaderCacheMethod::CacheMethod>(
+                               SettingsCache::instance().cacheStorage().getCardPictureLoaderCacheMethod()) ==
+                               CardPictureLoaderCacheMethod::CacheMethod::NETWORK_CACHE &&
+                           (cache->metaData(url).isValid() || !picDownload);
+    return !useNetworkCache;
+}
+
+int CardPictureLoaderWorker::hostAllowanceCeiling(const QString &host) const
+{
+    const int devCap = DownloadSettings::getDeveloperHostCaps().value(host, MAX_REQUESTS_PER_SEC);
+    if (devCap == DownloadSettings::UNLIMITED_HOST_QUOTA && !hostRequestLimits.contains(host)) {
+        return DownloadSettings::UNLIMITED_HOST_QUOTA;
+    }
+    const int requested = hostRequestLimits.value(host, devCap);
+    return SettingsCache::instance().downloads().clampHostRequestLimit(host, requested);
+}
+
+bool CardPictureLoaderWorker::isUnlockedHost(const QString &host) const
+{
+    return hostAllowanceCeiling(host) == DownloadSettings::UNLIMITED_HOST_QUOTA && !hostRequestQuota.contains(host);
+}
+
 void CardPictureLoaderWorker::onHostRateLimited(const QString &host)
 {
-    hostRequestQuota.insert(host, qMax(MIN_HOST_QUOTA, hostRequestQuota.value(host, MAX_REQUESTS_PER_SEC) / 2));
+    const int ceiling = hostAllowanceCeiling(host);
+    // An unlocked host has no per-host allowance to halve. Install one instead so it drops out of
+    // the unlocked fast path and is paced like a throttled host; the recovery loop in
+    // resetRequestQuota() then walks it back up and unlocks it again.
+    const int base =
+        ceiling == DownloadSettings::UNLIMITED_HOST_QUOTA ? DownloadSettings::DEFAULT_HOST_REQUEST_LIMIT : ceiling;
+    hostRequestQuota.insert(host, qMax(MIN_HOST_QUOTA, hostRequestQuota.value(host, base) / 2));
     hostLast429.insert(host, QDateTime::currentDateTime());
 }
 
@@ -228,6 +471,22 @@ QUrl CardPictureLoaderWorker::getCachedRedirect(const QUrl &originalUrl) const
     return {};
 }
 
+QUrl CardPictureLoaderWorker::resolveCachedRedirect(const QUrl &url) const
+{
+    // Follow the whole cached-redirect chain so dispatch keys on the host that is really hit. The
+    // depth bound keeps a corrupt or self-referencing cache entry from spinning us forever.
+    QUrl resolved = url;
+    int depth = 0;
+    while (depth++ < MAX_REDIRECT_CHAIN_DEPTH) {
+        QUrl target = getCachedRedirect(resolved);
+        if (target.isEmpty() || target == resolved) {
+            break;
+        }
+        resolved = target;
+    }
+    return resolved;
+}
+
 void CardPictureLoaderWorker::loadRedirectCache()
 {
     QSettings settings(cacheFilePath, QSettings::IniFormat);
@@ -280,4 +539,5 @@ void CardPictureLoaderWorker::clearNetworkCache()
 {
     networkManager->cache()->clear();
     redirectCache.clear();
+    emit networkCacheCleared();
 }

cockatrice/src/interface/card_picture_loader/card_picture_loader_worker.h

@@ -74,10 +74,37 @@ public:
      */
     void onHostRateLimited(const QString &host);
 
-    /** @brief Clears the network cache and redirect cache. */
+    /**
-    void clearNetworkCache();
+     * @brief Stops the worker thread and reports whether it stopped.
+     *
+     * Called from the owning thread (CardPictureLoader) on its way out. QThread::quit() posts an
+     * exit request to the worker's event loop and QThread::wait() blocks (bounded) until the loop
+     * has returned and the thread finished. Only QThread members are touched here, so this method
+     * is safe to call from the owning thread. The worker object itself is freed by the finished()
+     * -> deleteLater chain (see the constructor); the QThread object is deleted afterwards by the
+     * owner (CardPictureLoader::~CardPictureLoader), not by this method.
+     *
+     * @return true if the thread stopped within the timeout, false if it is still running (in
+     *         which case the owner must not delete the QThread).
+     */
+    [[nodiscard]] bool shutdownThread();
+
+    /**
+     * @brief Returns the worker's QThread.
+     * @return The worker thread
+     *
+     * Only meaningful while the worker object is alive; capture it before calling shutdownThread().
+     */
+    QThread *workerThread() const;
 
 public slots:
+    /**
+     * @brief Clears the network cache and redirect cache.
+     *
+     * Runs on the worker thread; invoke it via a queued call when coming from another thread,
+     * since both caches are owned by the worker thread.
+     */
+    void clearNetworkCache();
     /**
      * @brief Makes a network request for the given URL using the specified worker.
      * @param url URL to load
@@ -86,9 +113,12 @@ public slots:
      */
     QNetworkReply *makeRequest(const QUrl &url, CardPictureLoaderWorkerWork *workThread);
 
-    /** @brief Processes all queued requests respecting the request quota. */
+    /** @brief Ensures the pacing and quota-reset timers reflect the current queue and recovery state. */
     void processQueuedRequests();
 
+    /** @brief Chooses a request from the queue and starts it, respecting the quota and pacing. */
+    void dispatchQueuedRequest();
+
     /**
      * @brief Processes a single queued request.
      * @return true if a request was processed, false if queue is empty.
@@ -118,18 +148,56 @@ private:
     bool picDownload;                                  ///< Whether downloading images from network is enabled
     QQueue<QPair<QUrl, CardPictureLoaderWorkerWork *>> requestLoadQueue; ///< Queue of pending network requests
 
-    int requestQuota;                       ///< Remaining requests allowed per second
     QTimer requestTimer;                    ///< Timer to reset the request quota
+    QTimer dispatchTimer;                   ///< Timer pacing individual network requests
     QHash<QString, int> hostRequestQuota;   ///< Sustained per-host request allowance
+    QHash<QString, int> hostRequestLimits;  ///< User-set per-host request allowances
     QHash<QString, int> hostQuotaRemaining; ///< Per-host allowance left in the current second
     QHash<QString, QDateTime> hostLast429;  ///< When each host was last rate limited
+    QHash<QString, int> hostInFlight;       ///< Network replies currently in flight, per host
+
+    /** @brief Maximum concurrent in-flight network replies per host. */
+    static constexpr int MAX_IN_FLIGHT_PER_HOST = 6;
+
+    /** @brief Bound on how many cached-redirect hops dispatch resolution will follow. */
+    static constexpr int MAX_REDIRECT_CHAIN_DEPTH = 10;
 
     CardPictureLoaderLocal *localLoader; ///< Loader for local images
     QSet<QString> currentlyLoading;      ///< Deduplication: contains pixmapCacheKey currently being loaded
 
+    /**
+     * @brief Effective per-host allowance ceiling for a host.
+     * @param host The host to look up
+     * @return The allowance ceiling in requests/second, or DownloadSettings::UNLIMITED_HOST_QUOTA
+     *         when the developer unlocked the host and no user limit is set for it.
+     */
+    [[nodiscard]] int hostAllowanceCeiling(const QString &host) const;
+
+    /**
+     * @brief Whether a host may skip dispatch pacing and per-host allowance entirely.
+     *
+     * A host is unlocked while it has no user limit and no reduced allowance installed by a 429.
+     * A 429 drops it out of the fast path until resetRequestQuota() walks the allowance back up.
+     */
+    [[nodiscard]] bool isUnlockedHost(const QString &host) const;
+
     /** @brief Returns cached redirect URL for the given original URL, if available. */
     [[nodiscard]] QUrl getCachedRedirect(const QUrl &originalUrl) const;
 
+    /** @brief Whether a request for this URL would actually touch the network, rather than being served from the disk
+     * cache. */
+    [[nodiscard]] bool requestTouchesNetwork(const QUrl &url) const;
+
+    /**
+     * @brief Follows the cached-redirect chain to the URL that will actually be requested.
+     * @param url The URL to resolve
+     * @return The final URL after chasing cached redirects, or @p url itself if none lead elsewhere
+     *
+     * Dispatch decisions (unlocked-host fast path, 429 backoff, in-flight cap) must key on the host
+     * a request really goes to, not the URL that merely redirects to it.
+     */
+    [[nodiscard]] QUrl resolveCachedRedirect(const QUrl &url) const;
+
     /** @brief Loads redirect cache from disk. */
     void loadRedirectCache();
 
@@ -139,6 +207,9 @@ private:
     /** @brief Removes stale redirect entries older than TTL. */
     void cleanStaleEntries();
 
+    /** @brief Starts or stops the pacing and quota-reset timers to match the queue and recovery state. */
+    void updateTimerState();
+
 private slots:
     /** @brief Resets the request quota for rate-limiting. */
     void resetRequestQuota();
@@ -158,6 +229,9 @@ signals:
 
     /** @brief Emitted when a network request successfully completes. */
     void imageRequestSucceeded(const QUrl &url);
+
+    /** @brief Emitted after clearNetworkCache() has finished clearing both caches. */
+    void networkCacheCleared();
 };
 
 #endif // PICTURE_LOADER_WORKER_H

cockatrice/src/interface/card_picture_loader/card_picture_loader_worker_work.cpp

@@ -22,8 +22,13 @@ static const QStringList MD5_BLACKLIST = {
     "fbc7d763c08771c260b39e2115414eeb"  // Current card back hash
 };
 
-CardPictureLoaderWorkerWork::CardPictureLoaderWorkerWork(const CardPictureLoaderWorker *worker, const ExactCard &toLoad)
+const ServerRateLimiter &CardPictureLoaderWorkerWork::rateLimiter()
-    : QObject(nullptr), cardToDownload(CardPictureToLoad(toLoad)),
+{
+    return s_rateLimiter;
+}
+
+CardPictureLoaderWorkerWork::CardPictureLoaderWorkerWork(CardPictureLoaderWorker *worker, const ExactCard &toLoad)
+    : QObject(worker), cardToDownload(CardPictureToLoad(toLoad)),
       picDownload(SettingsCache::instance().downloads().getPicDownload())
 {
     // Hook up signals to the orchestrator
@@ -168,7 +173,7 @@ void CardPictureLoaderWorkerWork::handleFailedReply(const QNetworkReply *reply)
                 << "PictureLoader: [card: " << cardToDownload.getCard().getName()
                 << " set: " << cardToDownload.getSetName() << "]: Too many requests from " << host
                 << ", backing off until " << backoffUntil.toString(Qt::ISODate) << ", retrying the same url";
-            scheduleDeferredRetry();
+            scheduleDeferredRetry(host);
         } else {
             qCWarning(CardPictureLoaderWorkerWorkLog).nospace()
                 << "PictureLoader: [card: " << cardToDownload.getCard().getName()
@@ -273,14 +278,16 @@ QImage CardPictureLoaderWorkerWork::tryLoadImageFromReply(QNetworkReply *reply)
     return imgReader.read();
 }
 
-void CardPictureLoaderWorkerWork::scheduleDeferredRetry()
+void CardPictureLoaderWorkerWork::scheduleDeferredRetry(const QString &preferredHost)
 {
     QDateTime now = QDateTime::currentDateTime();
 
-    // Prefer waiting on the current URL's server so we retry the same source.
+    // Prefer waiting on the server that is actually blocking the request: callers hand in the
-    QString currentHost = QUrl(cardToDownload.getCurrentUrl()).host();
+    // rate-limited host when it differs from the current URL (e.g. a cached redirect target still
-    QDateTime backoffUntil = s_rateLimiter.deadline(currentHost);
+    // in backoff), otherwise fall back to the current URL's server so we retry the same source.
-    if (!s_rateLimiter.isRateLimited(currentHost, now)) {
+    QString waitHost = preferredHost.isEmpty() ? QUrl(cardToDownload.getCurrentUrl()).host() : preferredHost;
+    QDateTime backoffUntil = s_rateLimiter.deadline(waitHost);
+    if (!s_rateLimiter.isRateLimited(waitHost, now)) {
         backoffUntil = s_rateLimiter.earliestDeadline(now);
     }
 

cockatrice/src/interface/card_picture_loader/card_picture_loader_worker_work.h

@@ -10,6 +10,7 @@
 #include <QNetworkAccessManager>
 #include <QObject>
 #include <QRandomGenerator>
+#include <QString>
 #include <QThread>
 #include <libcockatrice/card/database/card_database.h>
 #include <libcockatrice/utility/server_rate_limiter.h>
@@ -36,13 +37,36 @@ class CardPictureLoaderWorkerWork : public QObject
 public:
     /**
      * @brief Constructs a worker for downloading a specific card image.
-     * @param worker The orchestrating CardPictureLoaderWorker
+     * @param worker The orchestrating CardPictureLoaderWorker; the work object becomes its child so
+     *               it is destroyed with the worker even if it never reaches concludeImageLoad().
      * @param toLoad The ExactCard to download
      */
-    explicit CardPictureLoaderWorkerWork(const CardPictureLoaderWorker *worker, const ExactCard &toLoad);
+    explicit CardPictureLoaderWorkerWork(CardPictureLoaderWorker *worker, const ExactCard &toLoad);
 
     CardPictureToLoad cardToDownload; ///< The card and associated URLs to try downloading
 
+    /** @brief Shared per-server 429 backoff state. */
+    static const ServerRateLimiter &rateLimiter();
+
+    /**
+     * @brief Starts downloading the next URL for this card.
+     *
+     * Skips URLs whose server is currently in 429 backoff, either waiting the
+     * backoff out or falling through to the other configured sources.
+     */
+    void startNextPicDownload();
+
+    /**
+     * @brief Schedules a deferred retry after the relevant server backoff expires.
+     * @param preferredHost The server that is actually blocking the request, or an empty
+     *                      string to use the current URL's server
+     *
+     * Waits on the blocking server's backoff deadline, otherwise on the earliest active
+     * backoff. If no servers are in backoff, concludes with failure. Otherwise resets the
+     * CardPictureToLoad indices and retries after the backoff period.
+     */
+    void scheduleDeferredRetry(const QString &preferredHost = {});
+
 public slots:
     /**
      * @brief Handles a finished network reply for the card image.
@@ -55,9 +79,6 @@ private:
 
     static ServerRateLimiter s_rateLimiter; ///< Shared per-server 429 backoff state
 
-    /** @brief Starts downloading the next URL for this card. */
-    void startNextPicDownload();
-
     /** @brief Called when all URLs have been exhausted or download failed. */
     void picDownloadFailed();
 
@@ -82,16 +103,6 @@ private:
      */
     void concludeImageLoad(const QImage &image);
 
-    /**
-     * @brief Schedules a deferred retry after the relevant server backoff expires.
-     *
-     * Waits on the current URL's server when it is the reason we are blocked,
-     * otherwise on the earliest active backoff. If no servers are in backoff,
-     * concludes with failure. Otherwise resets the CardPictureToLoad indices and
-     * retries after the backoff period.
-     */
-    void scheduleDeferredRetry();
-
 private slots:
     /** @brief Updates the picDownload setting when it changes. */
     void picDownloadChanged();

cockatrice/src/interface/card_picture_loader/card_picture_to_load.cpp

@@ -94,8 +94,7 @@ void CardPictureToLoad::populateSetUrls()
         }
     }
 
-    const QStringList orderedTemplates = urlTemplates;
+    for (const QString &urlTemplate : urlTemplates) {
-    for (const QString &urlTemplate : orderedTemplates) {
         QString transformedUrl = transformUrl(urlTemplate);
 
         if (!transformedUrl.isEmpty()) {

cockatrice/src/interface/intents/contexts/context_open_deck.h

@@ -0,0 +1,14 @@
+#ifndef COCKATRICE_CONTEXT_OPEN_DECK_H
+#define COCKATRICE_CONTEXT_OPEN_DECK_H
+
+#include "context_connect_to_server.h"
+
+#include <QString>
+
+struct ContextOpenDeck
+{
+    ContextConnectToServer serverContext;
+    QString shareToken;
+};
+
+#endif // COCKATRICE_CONTEXT_OPEN_DECK_H

cockatrice/src/interface/intents/intent.cpp

@@ -2,10 +2,11 @@
 
 Intent::Intent(QObject *parent) : QObject(parent)
 {
-    // An intent is done as soon as it reports success or failure. Deleting it
+    // An intent is done as soon as it reports success, failure, or cancellation.
-    // also tears down its dependency chain and disconnects any signal wiring.
+    // Deleting it also tears down its dependency chain and disconnects any signal wiring.
     connect(this, &Intent::finished, this, &QObject::deleteLater);
     connect(this, &Intent::failed, this, &QObject::deleteLater);
+    connect(this, &Intent::cancelled, this, &QObject::deleteLater);
 }
 
 Intent::~Intent() = default;
@@ -27,6 +28,7 @@ void Intent::runDependency(Intent *dependency)
         this->execute();
     });
     connect(dependency, &Intent::failed, this, &Intent::failed);
+    connect(dependency, &Intent::cancelled, this, &Intent::cancelled);
 
     dependency->execute();
 }
@@ -46,3 +48,11 @@ void Intent::emitFailed(const QString &reason)
         emit failed(reason);
     }
 }
+
+void Intent::emitCancelled()
+{
+    if (!completed) {
+        completed = true;
+        emit cancelled();
+    }
+}

cockatrice/src/interface/intents/intent.h

@@ -16,6 +16,7 @@ public:
 signals:
     void finished();
     void failed(QString reason);
+    void cancelled();
 
 protected:
     // --- Subclasses must implement these ---
@@ -29,6 +30,7 @@ protected:
     // Emit the outcome exactly once; ignore late signals after the intent is done.
     void emitFinished();
     void emitFailed(const QString &reason);
+    void emitCancelled();
 
 private:
     bool completed = false;

cockatrice/src/interface/intents/intent_join_server_game.cpp

@@ -19,13 +19,15 @@ bool IntentJoinServerGame::checkPrecondition() const
     if (remoteClient->getStatus() != ClientStatus::StatusLoggedIn) {
         return false;
     }
-    // peerPort() reflects the actual TCP peer, which may differ from the
+    // serverName()/serverPort() reflect the server the client was configured
-    // configured server port (e.g. when connecting through a proxy), so only
+    // to connect to, which may differ from the actual TCP peer (e.g. when
-    // the hostname is compared here.
+    // connecting through a proxy), so compare those configured values. A link
-    if (remoteClient->peerName() != context->roomContext.serverContext.hostname) {
+    // naming the same host on another port is a different server and must not
+    // reuse the session there.
+    if (remoteClient->serverName().compare(context->roomContext.serverContext.hostname, Qt::CaseInsensitive) != 0) {
         return false;
     }
-    if (QString::number(remoteClient->peerPort()) != context->roomContext.serverContext.port) {
+    if (QString::number(remoteClient->serverPort()) != context->roomContext.serverContext.port) {
         return false;
     }
 

cockatrice/src/interface/intents/intent_login.cpp

@@ -1,9 +1,14 @@
 #include "intent_login.h"
 
 #include "../../client/settings/cache_settings.h"
+#include "../widgets/dialogs/dlg_login_prompt.h"
 #include "libcockatrice/settings/servers_settings.h"
 
-IntentGetLoginCredentials::IntentGetLoginCredentials(ContextConnectToServer *_context) : Intent(), context(_context)
+#include <QDialog>
+
+IntentGetLoginCredentials::IntentGetLoginCredentials(ContextConnectToServer *_context,
+                                                     bool _promptForMissingCredentials)
+    : Intent(), context(_context), promptForMissingCredentials(_promptForMissingCredentials)
 {
 }
 
@@ -29,5 +34,46 @@ void IntentGetLoginCredentials::onPreconditionSatisfied()
 
 void IntentGetLoginCredentials::onPreconditionNotSatisfied()
 {
-    emitFailed(tr("No saved credentials for this server"));
+    // MainWindow::applyStartupDestination runs this intent on every launch for
+    // users whose startup tab is Server / Server Room; keep that path quiet, as
+    // it was before the link-driven sign-in dialog existed.
+    if (!promptForMissingCredentials) {
+        emitFailed(tr("No saved credentials for this server"));
+        return;
+    }
+
+    // No credentials saved for the target server: ask the user for them. They
+    // opt into saving them so later links to the same server connect directly.
+    const QString serverText = context->hostname + ":" + context->port;
+    DlgLoginPrompt dialog(serverText);
+    // ApplicationModal: the dialog has no parent (the intent is not a widget),
+    // so WindowModal would not actually block any other window.
+    dialog.setWindowModality(Qt::ApplicationModal);
+
+    if (dialog.exec() != QDialog::Accepted) {
+        emitCancelled();
+        return;
+    }
+
+    context->username = dialog.username();
+    context->password = dialog.password();
+
+    if (dialog.savePassword() && !context->username.isEmpty()) {
+        ServersSettings &servers = SettingsCache::instance().servers();
+        // The host may already be saved under a friendly name (e.g. a public-server
+        // list entry) with no credentials; reuse that name instead of overwriting
+        // it with the raw hostname when addNewServer updates the entry in place.
+        QString saveName = context->hostname;
+        const int existingIndex = servers.findServerIndex(context->hostname, context->port);
+        if (existingIndex >= 0) {
+            saveName =
+                servers.getValue(QString("saveName%1").arg(existingIndex), "server", "server_details").toString();
+            if (saveName.isEmpty()) {
+                saveName = context->hostname;
+            }
+        }
+        servers.addNewServer(saveName, context->hostname, context->port, context->username, context->password, true);
+    }
+
+    emitFinished();
 }

cockatrice/src/interface/intents/intent_login.h

@@ -9,7 +9,10 @@ class IntentGetLoginCredentials : public Intent
     Q_OBJECT
 
 public:
-    IntentGetLoginCredentials(ContextConnectToServer *_context);
+    // When promptForMissingCredentials is false (the default) a server without
+    // saved credentials fails silently; only intent chains from cockatrice://
+    // links opt into the interactive sign-in dialog.
+    explicit IntentGetLoginCredentials(ContextConnectToServer *_context, bool _promptForMissingCredentials = false);
 
 protected:
     bool checkPrecondition() const override;
@@ -18,6 +21,7 @@ protected:
 
 private:
     ContextConnectToServer *context;
+    bool promptForMissingCredentials;
 };
 
 #endif // COCKATRICE_INTENT_LOGIN_H

cockatrice/src/interface/intents/intent_open_shared_deck.cpp

@@ -0,0 +1,208 @@
+#include "intent_open_shared_deck.h"
+
+#include "../deck_loader/deck_loader.h"
+#include "../widgets/dialogs/dlg_shared_decks_preview.h"
+#include "../widgets/tabs/tab_supervisor.h"
+#include "intent_connect_to_server.h"
+
+#include <QMessageBox>
+#include <QTimer>
+#include <libcockatrice/card/database/card_database_querier.h>
+#include <libcockatrice/protocol/pb/command_deck_share_download.pb.h>
+#include <libcockatrice/protocol/pb/command_deck_share_list.pb.h>
+#include <libcockatrice/protocol/pb/response.pb.h>
+#include <libcockatrice/protocol/pb/response_deck_share_download.pb.h>
+#include <libcockatrice/protocol/pb/response_deck_share_list.pb.h>
+#include <libcockatrice/protocol/pb/serverinfo_deck_share_item.pb.h>
+#include <libcockatrice/protocol/pending_command.h>
+
+IntentOpenSharedDeck::IntentOpenSharedDeck(TabSupervisor *_tabSupervisor,
+                                           RemoteClient *_remoteClient,
+                                           const CardDatabaseQuerier *_querier,
+                                           std::unique_ptr<ContextOpenDeck> _context)
+    : Intent(), tabSupervisor(_tabSupervisor), remoteClient(_remoteClient), querier(_querier),
+      context(_context.release())
+{
+    downloadTimer = new QTimer(this);
+    downloadTimer->setSingleShot(true);
+    downloadTimer->setInterval(15000);
+    connect(downloadTimer, &QTimer::timeout, this, &IntentOpenSharedDeck::onDownloadTimeout);
+}
+
+bool IntentOpenSharedDeck::checkPrecondition() const
+{
+    if (remoteClient->getStatus() != ClientStatus::StatusLoggedIn) {
+        return false;
+    }
+    // serverName()/serverPort() reflect the server the client was configured
+    // to connect to, which may differ from the actual TCP peer (e.g. when
+    // connecting through a proxy), so compare those configured values. The
+    // share token must be resolved against the host the link named — a link to
+    // the same host on another port is a different server.
+    if (remoteClient->serverName().compare(context->serverContext.hostname, Qt::CaseInsensitive) != 0) {
+        return false;
+    }
+    return QString::number(remoteClient->serverPort()) == context->serverContext.port;
+}
+
+void IntentOpenSharedDeck::onPreconditionSatisfied()
+{
+    // Resolve the share token to its items first; a share can contain more than
+    // one deck, and each item is downloaded by id. Time the round trip like the
+    // downloads, so a silent server cannot hang the chain forever.
+    listPhase = true;
+    downloadTimer->start();
+
+    Command_DeckShareList cmd;
+    cmd.set_token(context->shareToken.toStdString());
+
+    PendingCommand *pend = AbstractClient::prepareSessionCommand(cmd);
+    connect(pend, &PendingCommand::finished, this, &IntentOpenSharedDeck::listShareFinished);
+    remoteClient->sendCommand(pend);
+}
+
+void IntentOpenSharedDeck::onPreconditionNotSatisfied()
+{
+    runDependency(new IntentConnectToServer(remoteClient, &context->serverContext));
+}
+
+void IntentOpenSharedDeck::listShareFinished(const Response &response, const CommandContainer & /* commandContainer */)
+{
+    downloadTimer->stop();
+    listPhase = false;
+
+    if (response.response_code() != Response::RespOk) {
+        emitFailed(tr("The shared deck could not be found or has expired"));
+        return;
+    }
+
+    const Response_DeckShareList &resp = response.GetExtension(Response_DeckShareList::ext);
+    if (resp.items_size() == 0) {
+        emitFailed(tr("The shared deck is empty"));
+        return;
+    }
+
+    QList<ServerInfo_DeckShareItem> items;
+    items.reserve(resp.items_size());
+    for (const ServerInfo_DeckShareItem &item : resp.items()) {
+        items.append(item);
+        itemNames.insert(item.id(), QString::fromStdString(item.name()));
+    }
+
+    const QString serverText = context->serverContext.hostname + ":" + context->serverContext.port;
+
+    // Ask the user which decks to open before downloading anything.
+    previewDialog = new DlgSharedDecksPreview(tabSupervisor, querier, QString::fromStdString(resp.name()),
+                                              resp.expires_at(), serverText, items);
+    connect(previewDialog, &DlgSharedDecksPreview::openRequested, this, &IntentOpenSharedDeck::startDownloads);
+    connect(previewDialog, &DlgSharedDecksPreview::cancelled, this, &IntentOpenSharedDeck::emitCancelled);
+    connect(previewDialog, &DlgSharedDecksPreview::cancelled, previewDialog, &QWidget::deleteLater);
+    previewDialog->show();
+    previewDialog->raise();
+    previewDialog->activateWindow();
+}
+
+void IntentOpenSharedDeck::startDownloads(const QList<int> &itemIds)
+{
+    pendingItemIds = itemIds;
+    totalItems = itemIds.size();
+    completedItems = 0;
+    loadedDecks.clear();
+    downloadNextItem();
+}
+
+void IntentOpenSharedDeck::downloadNextItem()
+{
+    if (pendingItemIds.isEmpty()) {
+        finishAll();
+        return;
+    }
+
+    currentItemId = pendingItemIds.takeFirst();
+    downloadTimer->start();
+
+    Command_DeckShareDownload cmd;
+    cmd.set_token(context->shareToken.toStdString());
+    cmd.set_item_id(currentItemId);
+
+    PendingCommand *pend = AbstractClient::prepareSessionCommand(cmd);
+    connect(pend, &PendingCommand::finished, this, &IntentOpenSharedDeck::downloadShareFinished);
+    remoteClient->sendCommand(pend);
+}
+
+void IntentOpenSharedDeck::downloadShareFinished(const Response &response,
+                                                 const CommandContainer & /* commandContainer */)
+{
+    downloadTimer->stop();
+
+    QString failureReason;
+    if (response.response_code() != Response::RespOk) {
+        failureReason = tr("Failed to download the shared deck");
+    } else {
+        const Response_DeckShareDownload &resp = response.GetExtension(Response_DeckShareDownload::ext);
+        const QString deckString = QString::fromStdString(resp.deck());
+        if (deckString.isEmpty()) {
+            failureReason = tr("The shared deck is empty");
+        } else {
+            std::optional<LoadedDeck> deckOpt =
+                DeckLoader::loadFromRemote(deckString, LoadedDeck::LoadInfo::NON_REMOTE_ID);
+            if (!deckOpt) {
+                failureReason = tr("The shared deck could not be loaded");
+            } else {
+                loadedDecks.append(deckOpt.value());
+                ++completedItems;
+                previewDialog->setDownloadProgress(completedItems, totalItems,
+                                                   itemNames.value(currentItemId, tr("Unknown deck")));
+                downloadNextItem();
+                return;
+            }
+        }
+    }
+
+    onItemFailure(failureReason);
+}
+
+void IntentOpenSharedDeck::onItemFailure(const QString &reason)
+{
+    downloadTimer->stop();
+
+    if (loadedDecks.isEmpty()) {
+        previewDialog->deleteLater();
+        emitFailed(reason);
+        return;
+    }
+
+    const int downloadedCount = loadedDecks.size();
+    const QMessageBox::StandardButton answer = QMessageBox::question(
+        previewDialog, tr("Open shared decks"),
+        tr("Could not download the deck \"%1\".\n\n%n deck(s) were already downloaded. Open them?", "", downloadedCount)
+            .arg(itemNames.value(currentItemId, tr("Unknown deck"))),
+        QMessageBox::Yes | QMessageBox::No, QMessageBox::Yes);
+
+    if (answer == QMessageBox::Yes) {
+        finishAll();
+    } else {
+        previewDialog->deleteLater();
+        emitCancelled();
+    }
+}
+
+void IntentOpenSharedDeck::onDownloadTimeout()
+{
+    // The list phase has no preview dialog yet to report progress into; fail the
+    // whole intent instead of letting the shared deck hang in limbo.
+    if (listPhase) {
+        emitFailed(tr("Timed out while loading the shared deck"));
+        return;
+    }
+    onItemFailure(tr("Timed out while downloading the shared deck"));
+}
+
+void IntentOpenSharedDeck::finishAll()
+{
+    previewDialog->deleteLater();
+    for (const LoadedDeck &deck : loadedDecks) {
+        tabSupervisor->openDeckInNewTab(deck);
+    }
+    emitFinished();
+}

cockatrice/src/interface/intents/intent_open_shared_deck.h

@@ -0,0 +1,60 @@
+#ifndef COCKATRICE_INTENT_OPEN_SHARED_DECK_H
+#define COCKATRICE_INTENT_OPEN_SHARED_DECK_H
+
+#include "contexts/context_open_deck.h"
+#include "intent.h"
+#include "remote_client.h"
+
+#include <QList>
+#include <QMap>
+#include <QScopedPointer>
+#include <memory>
+
+class TabSupervisor;
+struct LoadedDeck;
+class CardDatabaseQuerier;
+class DlgSharedDecksPreview;
+class QTimer;
+
+class IntentOpenSharedDeck : public Intent
+{
+    Q_OBJECT
+
+public:
+    IntentOpenSharedDeck(TabSupervisor *_tabSupervisor,
+                         RemoteClient *_remoteClient,
+                         const CardDatabaseQuerier *_querier,
+                         std::unique_ptr<ContextOpenDeck> _context);
+
+protected:
+    bool checkPrecondition() const override;
+    void onPreconditionSatisfied() override;
+    void onPreconditionNotSatisfied() override;
+
+private slots:
+    void listShareFinished(const Response &response, const CommandContainer &commandContainer);
+    void downloadShareFinished(const Response &response, const CommandContainer &commandContainer);
+    void onDownloadTimeout();
+
+private:
+    void startDownloads(const QList<int> &itemIds);
+    void downloadNextItem();
+    void onItemFailure(const QString &reason);
+    void finishAll();
+
+    TabSupervisor *tabSupervisor;
+    RemoteClient *remoteClient;
+    const CardDatabaseQuerier *querier;
+    QScopedPointer<ContextOpenDeck> context;
+    DlgSharedDecksPreview *previewDialog = nullptr;
+    QTimer *downloadTimer;
+    QMap<int, QString> itemNames;
+    QList<int> pendingItemIds;
+    QList<LoadedDeck> loadedDecks;
+    bool listPhase = true;
+    int currentItemId = 0;
+    int totalItems = 0;
+    int completedItems = 0;
+};
+
+#endif // COCKATRICE_INTENT_OPEN_SHARED_DECK_H

cockatrice/src/interface/intents/url_parser.cpp

@@ -1,19 +1,28 @@
 #include "url_parser.h"
 
+#include "../../client/settings/cache_settings.h"
 #include "../widgets/tabs/tab_room.h"
 #include "../widgets/tabs/tab_supervisor.h"
 #include "../window_main.h"
 #include "contexts/context_join_game.h"
+#include "contexts/context_open_deck.h"
+#include "intent.h"
 #include "intent_join_server_game.h"
 #include "intent_login.h"
+#include "intent_open_shared_deck.h"
 
 #include <QDebug>
+#include <QLoggingCategory>
 #include <QMessageBox>
 #include <QUrl>
 #include <QUrlQuery>
+#include <libcockatrice/card/database/card_database_manager.h>
 #include <libcockatrice/network/client/abstract/abstract_client.h>
+#include <libcockatrice/settings/servers_settings.h>
 #include <memory>
 
+inline Q_LOGGING_CATEGORY(UrlParserLog, "url_parser");
+
 IntentUrlParser::IntentUrlParser(QObject *parent, MainWindow *_mainWindow) : QObject(parent), mainWindow(_mainWindow)
 {
 }
@@ -29,16 +38,33 @@ void IntentUrlParser::handle(const QString &urlStr)
     const QString action = url.host();
     QUrlQuery query(url);
 
+    qCDebug(UrlParserLog) << "Parsing intent URL, action:" << action;
+
+    PendingIntentChain chain;
+    Intent *firstIntent = nullptr;
     if (action == "joingame") {
-        handleJoinGame(query);
+        firstIntent = createJoinGameIntent(query, chain);
     } else if (action == "opendeck") {
-        // handleOpenDeck(query);
+        firstIntent = createOpenDeckIntent(query, chain);
     } else {
         qWarning() << "Unknown intent:" << action;
     }
+
+    if (firstIntent == nullptr) {
+        // The link was invalid or the user declined the confirm: nothing runs.
+        // Report the idle state when no other chain is queued so that a startup
+        // launch (which skipped its own connection for this URL) falls back to it.
+        if (!chainRunning && pendingChains.isEmpty()) {
+            emit urlChainFinished(mainWindow->getRemoteClient()->getStatus() == StatusLoggedIn);
+        }
+        return;
+    }
+
+    pendingChains.append(chain);
+    startNextChain();
 }
 
-void IntentUrlParser::handleJoinGame(const QUrlQuery &query)
+Intent *IntentUrlParser::createJoinGameIntent(const QUrlQuery &query, PendingIntentChain &chain)
 {
     auto showError = [this](const QString &message) { QMessageBox::warning(mainWindow, tr("Open game"), message); };
 
@@ -49,21 +75,21 @@ void IntentUrlParser::handleJoinGame(const QUrlQuery &query)
 
     if (ctx->roomContext.serverContext.hostname.isEmpty()) {
         showError(tr("Missing or empty hostname in the game link"));
-        return;
+        return nullptr;
     }
 
     bool ok = false;
     ctx->roomContext.serverContext.port.toUShort(&ok);
     if (!ok) {
         showError(tr("Invalid or missing port in the game link"));
-        return;
+        return nullptr;
     }
 
     ctx->roomContext.roomId = query.queryItemValue("roomid").toInt(&ok);
 
     if (!ok) {
         showError(tr("Invalid or missing room id in the game link"));
-        return;
+        return nullptr;
     }
 
     ok = false;
@@ -71,7 +97,7 @@ void IntentUrlParser::handleJoinGame(const QUrlQuery &query)
 
     if (!ok) {
         showError(tr("Invalid or missing game id in the game link"));
-        return;
+        return nullptr;
     }
 
     const QString gameDescription = query.queryItemValue("game", QUrl::FullyDecoded);
@@ -80,24 +106,33 @@ void IntentUrlParser::handleJoinGame(const QUrlQuery &query)
     const QMessageBox::StandardButton answer = QMessageBox::question(
         mainWindow, tr("Join game"), message, QMessageBox::Yes | QMessageBox::No, QMessageBox::Yes);
     if (answer != QMessageBox::Yes) {
-        return;
+        return nullptr;
     }
 
+    RemoteClient *client = mainWindow->getRemoteClient();
+    ContextConnectToServer *serverContext = &ctx->roomContext.serverContext;
+
     // The join game intent owns the context and the credential lookup; once the
     // chain finishes (or fails) it deletes the whole tree.
-    ContextConnectToServer *serverContext = &ctx->roomContext.serverContext;
+    auto joinGameIntent = new IntentJoinServerGame(mainWindow->getTabSupervisor(), client, std::move(ctx));
-    auto joinGameIntent =
-        new IntentJoinServerGame(mainWindow->getTabSupervisor(), mainWindow->getRemoteClient(), std::move(ctx));
     joinGameIntent->setParent(this);
-
+    chain.intents.append(joinGameIntent);
-    auto getLoginCredentialsIntent = new IntentGetLoginCredentials(serverContext);
-    getLoginCredentialsIntent->setParent(joinGameIntent);
-
-    connect(getLoginCredentialsIntent, &Intent::finished, joinGameIntent, &Intent::execute);
-    connect(getLoginCredentialsIntent, &Intent::failed, joinGameIntent, &Intent::failed);
     connect(joinGameIntent, &Intent::failed, this, [showError](const QString &reason) { showError(reason); });
 
-    getLoginCredentialsIntent->execute();
+    Intent *firstIntent = joinGameIntent;
+    if (!isConnectedTo(serverContext->hostname, serverContext->port)) {
+        auto getLoginCredentialsIntent =
+            new IntentGetLoginCredentials(serverContext, /*promptForMissingCredentials=*/true);
+        getLoginCredentialsIntent->setParent(joinGameIntent);
+        chain.intents.insert(0, getLoginCredentialsIntent);
+
+        connect(getLoginCredentialsIntent, &Intent::finished, joinGameIntent, &Intent::execute);
+        connect(getLoginCredentialsIntent, &Intent::failed, joinGameIntent, &Intent::failed);
+        connect(getLoginCredentialsIntent, &Intent::cancelled, joinGameIntent, &Intent::cancelled);
+        firstIntent = getLoginCredentialsIntent;
+    }
+
+    return firstIntent;
 }
 
 QString IntentUrlParser::generateJoinGameMessage(const ContextJoinGame &context, const QString &gameDescription)
@@ -134,3 +169,270 @@ QString IntentUrlParser::generateJoinGameMessage(const ContextJoinGame &context,
                          .arg(gameDescription, gameIdStr, roomTab->getRoomName(), server)
                    : tr("Join game \"%1\" (#%2) on %3?").arg(gameDescription, gameIdStr, server);
 }
+
+Intent *IntentUrlParser::createOpenDeckIntent(const QUrlQuery &query, PendingIntentChain &chain)
+{
+    auto showError = [this](const QString &message) {
+        QMessageBox::warning(mainWindow, tr("Open shared deck"), message);
+    };
+
+    auto ctx = std::make_unique<ContextOpenDeck>();
+
+    ctx->serverContext.hostname = query.queryItemValue("hostname");
+    ctx->serverContext.port = query.queryItemValue("port");
+    ctx->shareToken = query.queryItemValue("share");
+
+    qCDebug(UrlParserLog) << "Open-deck intent: host" << ctx->serverContext.hostname << "port"
+                          << ctx->serverContext.port << "token length" << ctx->shareToken.length();
+
+    if (ctx->serverContext.hostname.isEmpty()) {
+        showError(tr("Missing or empty hostname in the share link"));
+        return nullptr;
+    }
+
+    bool ok = false;
+    const quint16 port = ctx->serverContext.port.toUShort(&ok);
+    if (!ok || port == 0) {
+        showError(tr("Invalid or missing port in the share link"));
+        return nullptr;
+    }
+
+    if (ctx->shareToken.isEmpty()) {
+        showError(tr("Missing or empty share value in the share link"));
+        return nullptr;
+    }
+
+    RemoteClient *client = mainWindow->getRemoteClient();
+
+    // The open deck download needs a connection to the link's server. Ask before
+    // taking the session anywhere it isn't already, naming the host we would
+    // connect to. Remember the link's target when it moves us away from a live
+    // session so a failed or cancelled chain can restore the session it left.
+    // The hostname is link-supplied and percent-decoded, so escape it: QMessageBox
+    // renders AutoText, and markup in a hostname would otherwise flip the whole
+    // prompt to rich text and let a link pad the message the user is shown.
+    const bool alreadyConnected = isConnectedTo(ctx->serverContext.hostname, ctx->serverContext.port);
+    if (!alreadyConnected) {
+        const QString target =
+            QStringLiteral("%1:%2").arg(ctx->serverContext.hostname.toHtmlEscaped(), ctx->serverContext.port);
+
+        if (client->getStatus() == StatusLoggedIn) {
+            const QString current =
+                QStringLiteral("%1:%2").arg(client->serverName(), QString::number(client->serverPort()));
+            const QMessageBox::StandardButton answer = QMessageBox::question(
+                mainWindow, tr("Open shared deck"),
+                tr("Opening this share link connects you to %1 instead of %2.\n\nContinue?").arg(target, current),
+                QMessageBox::Yes | QMessageBox::No, QMessageBox::Yes);
+            if (answer != QMessageBox::Yes) {
+                return nullptr;
+            }
+            chain.migrationTargetHost = ctx->serverContext.hostname;
+            chain.migrationTargetPort = ctx->serverContext.port;
+            chain.pendingRestore = true;
+        } else {
+            // Fresh connection is harmless to wander away from, but a server the
+            // client has never been configured for deserves a harder warning (no
+            // by default) so a stray link cannot silently steer the client there.
+            const bool knownHost = SettingsCache::instance().servers().findHostIndex(ctx->serverContext.hostname) >= 0;
+            const QMessageBox::StandardButton answer =
+                knownHost
+                    ? QMessageBox::question(mainWindow, tr("Open shared deck"),
+                                            tr("Opening this share link connects you to %1.\n\nContinue?").arg(target))
+                    : QMessageBox::warning(mainWindow, tr("Open shared deck"),
+                                           tr("Opening this share link connects you to %1, a server you have "
+                                              "never connected to before.\n\nContinue?")
+                                               .arg(target),
+                                           QMessageBox::Yes | QMessageBox::No, QMessageBox::No);
+            if (answer != QMessageBox::Yes) {
+                return nullptr;
+            }
+        }
+    }
+
+    ContextConnectToServer *serverContext = &ctx->serverContext;
+
+    // The open deck intent owns the context and the credential lookup; once
+    // the chain finishes (or fails) it deletes the whole tree.
+    auto openDeckIntent =
+        new IntentOpenSharedDeck(mainWindow->getTabSupervisor(), client, CardDatabaseManager::query(), std::move(ctx));
+    openDeckIntent->setParent(this);
+    chain.intents.append(openDeckIntent);
+    connect(openDeckIntent, &Intent::failed, this, [showError](const QString &reason) { showError(reason); });
+
+    Intent *firstIntent = openDeckIntent;
+    if (!isConnectedTo(serverContext->hostname, serverContext->port)) {
+        auto getLoginCredentialsIntent =
+            new IntentGetLoginCredentials(serverContext, /*promptForMissingCredentials=*/true);
+        getLoginCredentialsIntent->setParent(openDeckIntent);
+        chain.intents.insert(0, getLoginCredentialsIntent);
+
+        connect(getLoginCredentialsIntent, &Intent::finished, openDeckIntent, &Intent::execute);
+        connect(getLoginCredentialsIntent, &Intent::failed, openDeckIntent, &Intent::failed);
+        connect(getLoginCredentialsIntent, &Intent::cancelled, openDeckIntent, &Intent::cancelled);
+        firstIntent = getLoginCredentialsIntent;
+    }
+
+    return firstIntent;
+}
+
+bool IntentUrlParser::isConnectedTo(const QString &hostname, const QString &port) const
+{
+    // serverName() reflects the server the client was configured to connect to,
+    // which may differ from the actual TCP peer (e.g. when connecting through a
+    // proxy), so compare the configured host and port — exactly what a link
+    // names. A link to the same host on another port is a different server and
+    // must not silently reuse an existing session there.
+    RemoteClient *client = mainWindow->getRemoteClient();
+    return client->getStatus() == StatusLoggedIn && client->serverName().compare(hostname, Qt::CaseInsensitive) == 0 &&
+           QString::number(client->serverPort()) == port;
+}
+
+void IntentUrlParser::startNextChain()
+{
+    if (chainRunning || pendingChains.isEmpty()) {
+        return;
+    }
+    chainRunning = true;
+
+    PendingIntentChain &chain = pendingChains.first();
+    if (chain.intents.isEmpty()) {
+        pendingChains.removeFirst();
+        chainRunning = false;
+        startNextChain();
+        return;
+    }
+
+    // Snapshot the session this chain moves away from now that it actually
+    // runs. Chains are parsed while earlier ones are still queued, so a capture
+    // at parse time would follow whichever server the chain before it settled
+    // on, not the one the user is really on when this link is handled.
+    if (chain.pendingRestore) {
+        RemoteClient *client = mainWindow->getRemoteClient();
+        chain.previousServerHost = client->serverName();
+        chain.previousServerPort = QString::number(client->serverPort());
+    }
+
+    // Only the last intent completes the chain; its terminal signal ends the
+    // whole run. Cancellation of an intermediate intent (e.g. declined login
+    // prompt) is forwarded onto the last intent in the chain builders above.
+    Intent *finalIntent = chain.intents.last();
+    connect(finalIntent, &Intent::finished, this, [this]() { chainEnded(true); });
+    connect(finalIntent, &Intent::failed, this, [this]() { chainEnded(false); });
+    connect(finalIntent, &Intent::cancelled, this, [this]() { chainEnded(false); });
+    // Backstop: if the final intent is destroyed without emitting a terminal
+    // signal (e.g. a network error dropped it while running), end the chain so
+    // later links are not queued and dropped for the rest of the session.
+    chainBackstopConnection = connect(finalIntent, &QObject::destroyed, this, &IntentUrlParser::onChainIntentDestroyed);
+
+    chain.intents.first()->execute();
+}
+
+void IntentUrlParser::chainEnded(bool chainSucceeded)
+{
+    chainRunning = false;
+    QObject::disconnect(chainBackstopConnection);
+
+    const PendingIntentChain chain = pendingChains.takeFirst();
+
+    // Only a failed or cancelled chain restores the session the link migrated
+    // away from; a successful one leaves the user where they are.
+    if (chain.pendingRestore && !chainSucceeded) {
+        restorePreviousServer(chain);
+    }
+
+    startNextChain();
+
+    // Only report the terminal state once the queue has fully drained, so a
+    // queued follow-up link keeps the startup fallback out of the picture.
+    if (!chainRunning && pendingChains.isEmpty()) {
+        emit urlChainFinished(mainWindow->getRemoteClient()->getStatus() == StatusLoggedIn);
+    }
+}
+
+void IntentUrlParser::onChainIntentDestroyed()
+{
+    if (!chainRunning) {
+        return;
+    }
+    qCWarning(UrlParserLog) << "Share-link intent destroyed without a terminal signal; ending its chain";
+    chainEnded(false);
+}
+
+void IntentUrlParser::restorePreviousServer(const PendingIntentChain &chain)
+{
+    if (chain.previousServerHost.isEmpty()) {
+        return;
+    }
+
+    RemoteClient *client = mainWindow->getRemoteClient();
+    const ClientStatus status = client->getStatus();
+
+    // A failed/cancelled chain can fire while the client is still settling the
+    // in-flight connection attempt (wrong password, connect timeout). Only
+    // decide once the client has settled into logged-in or disconnected;
+    // deciding mid-connect would strand the user offline from their previous
+    // server.
+    if (status == StatusDisconnected || status == StatusLoggedIn) {
+        restoreToPreviousServer(chain);
+        return;
+    }
+    auto waitConnection = std::make_shared<QMetaObject::Connection>();
+    *waitConnection = connect(client, &RemoteClient::statusChanged, this, [this, chain, client, waitConnection]() {
+        const ClientStatus settled = client->getStatus();
+        if (settled == StatusDisconnected || settled == StatusLoggedIn) {
+            QObject::disconnect(*waitConnection);
+            restoreToPreviousServer(chain);
+        }
+    });
+}
+
+void IntentUrlParser::restoreToPreviousServer(const PendingIntentChain &chain)
+{
+    RemoteClient *client = mainWindow->getRemoteClient();
+
+    // Back on the previous server already → nothing to undo.
+    if (client->serverName().compare(chain.previousServerHost, Qt::CaseInsensitive) == 0 &&
+        QString::number(client->serverPort()) == chain.previousServerPort) {
+        return;
+    }
+
+    // When logged in somewhere, only intervene if that somewhere is the server
+    // the link moved us to; if the user went elsewhere on their own, leave them.
+    if (client->getStatus() == StatusLoggedIn) {
+        const bool onMigrationTarget =
+            client->serverName().compare(chain.migrationTargetHost, Qt::CaseInsensitive) == 0 &&
+            QString::number(client->serverPort()) == chain.migrationTargetPort;
+        if (!onMigrationTarget) {
+            return;
+        }
+
+        ServersSettings &servers = SettingsCache::instance().servers();
+        const int index = servers.findServerIndex(chain.previousServerHost, chain.previousServerPort);
+        if (index >= 0 && servers.hasLoginData(chain.previousServerHost, chain.previousServerPort)) {
+            const QString username =
+                servers.getValue(QString("username%1").arg(index), "server", "server_details").toString();
+            const QString password =
+                servers.getValue(QString("password%1").arg(index), "server", "server_details").toString();
+            client->connectToServer(chain.previousServerHost, chain.previousServerPort.toUInt(), username, password);
+            return;
+        }
+        client->disconnectFromServer();
+        return;
+    }
+
+    if (client->getStatus() != StatusDisconnected) {
+        return;
+    }
+
+    // The link's connection attempt failed: reconnect to the previous server
+    // when credentials are saved, otherwise stay offline.
+    ServersSettings &servers = SettingsCache::instance().servers();
+    const int index = servers.findServerIndex(chain.previousServerHost, chain.previousServerPort);
+    if (index >= 0 && servers.hasLoginData(chain.previousServerHost, chain.previousServerPort)) {
+        const QString username =
+            servers.getValue(QString("username%1").arg(index), "server", "server_details").toString();
+        const QString password =
+            servers.getValue(QString("password%1").arg(index), "server", "server_details").toString();
+        client->connectToServer(chain.previousServerHost, chain.previousServerPort.toUInt(), username, password);
+    }
+}

cockatrice/src/interface/intents/url_parser.h

@@ -1,10 +1,46 @@
 #ifndef COCKATRICE_URL_PARSER_H
 #define COCKATRICE_URL_PARSER_H
+
+#include <QList>
 #include <QObject>
 #include <QUrlQuery>
 
+class Intent;
 class MainWindow;
 struct ContextJoinGame;
+
+/**
+ * @brief One queued intent chain with the session-migration bookkeeping for it.
+ *
+ * The restore fields are per-chain on purpose: chains are parsed while earlier
+ * ones are still queued, so parser-wide state would let one chain's failure
+ * consume the restore data another chain recorded.
+ */
+struct PendingIntentChain
+{
+    QList<Intent *> intents;
+
+    // Snapshot of the session in place when this chain started running, so a
+    // queued chain follows whichever server the chain before it settled on.
+    QString previousServerHost;
+    QString previousServerPort;
+
+    // Recorded at parse time when the user confirmed migrating away from a live
+    // session to the host/port named by the link.
+    QString migrationTargetHost;
+    QString migrationTargetPort;
+    bool pendingRestore = false;
+};
+
+/**
+ * @brief Parses cockatrice:// links and runs them as serialized intent chains.
+ *
+ * Links are parsed by action (joingame/opendeck) and translated into an intent
+ * chain. Chains are queued and run one at a time: a document can hand multiple
+ * links to the window while an earlier chain still connects, and running two
+ * connect chains concurrently tears the connection down. urlChainFinished is
+ * emitted once the queue has fully drained.
+ */
 class IntentUrlParser : public QObject
 {
     Q_OBJECT
@@ -12,12 +48,28 @@ class IntentUrlParser : public QObject
 public:
     IntentUrlParser(QObject *parent, MainWindow *mainWindow);
     void handle(const QString &urlStr);
-    void handleJoinGame(const QUrlQuery &query);
+
+signals:
+    /** @brief Emitted when the last queued chain ended; carries whether the client is logged in. */
+    void urlChainFinished(bool connected);
 
 private:
+    Intent *createJoinGameIntent(const QUrlQuery &query, PendingIntentChain &chain);
+    Intent *createOpenDeckIntent(const QUrlQuery &query, PendingIntentChain &chain);
     QString generateJoinGameMessage(const ContextJoinGame &context, const QString &gameDescription);
+    [[nodiscard]] bool isConnectedTo(const QString &hostname, const QString &port) const;
+    void startNextChain();
+    void chainEnded(bool chainSucceeded);
+    void onChainIntentDestroyed();
+    void restorePreviousServer(const PendingIntentChain &chain);
+    void restoreToPreviousServer(const PendingIntentChain &chain);
 
     MainWindow *mainWindow;
+    QList<PendingIntentChain> pendingChains;
+    bool chainRunning = false;
+    // Disconnects the destroyed-signal backstop once a chain ends, so an old
+    // intent's deferred deletion cannot end the chain that runs after it.
+    QMetaObject::Connection chainBackstopConnection;
 };
 
 #endif // COCKATRICE_URL_PARSER_H

cockatrice/src/interface/theme_manager.cpp

@@ -23,6 +23,7 @@
 #include <libcockatrice/settings/paths_settings.h>
 
 #define SYSTEM_THEME_NAME "System"
+#define LEGACY_SYSTEM_THEME_NAME "Default"
 #define FUSION_THEME_NAME "Fusion"
 #define STYLE_CSS_NAME "style.css"
 #define HANDZONE_BG_NAME "handzone"
@@ -95,9 +96,11 @@ struct PaletteColorInfo
 
 static QString usableDefaultStyle(const QString &style)
 {
-    // The Windows 11 native style is broken: when the OS default
+    // The Windows 11 native style is broken: dragging cards across zones can
-    // ("System" theme selection) would use it, fall back to the Vista style.
+    // shrink the board to a tiny grey window that is unfixable without
-    // Explicitly choosing "windows11" in a theme is still honored.
+    // rejoining. It is never usable, so guard against it no matter how it was
+    // requested (OS default or an explicit "windows11" theme choice) and fall
+    // back to the Vista style.
     return style.compare("windows11", Qt::CaseInsensitive) == 0 ? QStringLiteral("windowsvista") : style;
 }
 
@@ -109,7 +112,10 @@ ThemeManager::ThemeManager(QObject *parent) : QObject(parent)
     ensureThemeDirectoryExists();
 #if (QT_VERSION >= QT_VERSION_CHECK(6, 5, 0))
     connect(QGuiApplication::styleHints(), &QStyleHints::colorSchemeChanged, this, [this] {
-        defaultPalette = qApp->palette();
+        // Reload so scheme-qualified assets and palettes follow the OS, but do
+        // NOT recapture defaultPalette: qApp->palette() already carries the
+        // currently-applied theme palette at this point, so recapturing it
+        // would contaminate the base for every later theme switch.
         themeChangedSlot();
     });
 #endif
@@ -117,12 +123,84 @@ ThemeManager::ThemeManager(QObject *parent) : QObject(parent)
     themeChangedSlot();
 }
 
+// Copy every file of sourceDir into targetDir without ever overwriting an
+// existing file, recursing into subdirectories (zones/, backgrounds/, ...).
+// Returns false as soon as an entry could not be copied, leaving the source
+// untouched so the caller can retry later.
+static bool mergeDirWithoutOverwrite(const QString &sourceDir, const QString &targetDir)
+{
+    const QDir target(targetDir);
+    bool merged = true;
+
+    const QDir::Filters filters = QDir::AllEntries | QDir::NoDotAndDotDot | QDir::Hidden;
+    for (const QFileInfo &entry : QDir(sourceDir).entryInfoList(filters)) {
+        const QString targetEntry = target.absoluteFilePath(entry.fileName());
+        if (entry.isDir()) {
+            if (!QDir().mkpath(targetEntry) || !mergeDirWithoutOverwrite(entry.absoluteFilePath(), targetEntry)) {
+                merged = false;
+            }
+        } else if (!target.exists(entry.fileName()) && !QFile::copy(entry.absoluteFilePath(), targetEntry)) {
+            qCWarning(ThemeManagerLog) << "Could not migrate theme file:" << entry.absoluteFilePath();
+            merged = false;
+        }
+    }
+
+    return merged;
+}
+
+void ThemeManager::migrateLegacyThemeDir(const QString &themesPath, const QString &currentThemeName)
+{
+    const QString legacyPath = QDir(themesPath).absoluteFilePath(LEGACY_SYSTEM_THEME_NAME);
+    if (!QDir(legacyPath).exists()) {
+        return;
+    }
+
+    // Only the renamed theme's own directory is migrated. A user sitting on a
+    // different theme may well have hand-made a "Default" folder of their own,
+    // and silently folding it into "System" would be rude. The check accepts
+    // both the pre-rename name and the post-rename one, since a user who
+    // already ran the rename keeps their settings on "System" while their
+    // customised directory is still called "Default".
+    if (currentThemeName != LEGACY_SYSTEM_THEME_NAME && currentThemeName != SYSTEM_THEME_NAME) {
+        return;
+    }
+
+    const QString targetPath = QDir(themesPath).absoluteFilePath(SYSTEM_THEME_NAME);
+    if (!QDir(targetPath).exists() && QDir().rename(legacyPath, targetPath)) {
+        qCInfo(ThemeManagerLog) << "Migrated customised theme directory" << LEGACY_SYSTEM_THEME_NAME << "to"
+                                << SYSTEM_THEME_NAME;
+        return;
+    }
+
+    // The rename is only possible when the target does not exist yet. When it
+    // does (a partial earlier upgrade, or a user who re-customised the theme
+    // after the rename), fall back to merging so nothing is lost: existing
+    // "System" files win, legacy files only fill gaps. Because every legacy
+    // file either already exists at the target or is copied there, removing
+    // the legacy directory afterwards cannot drop user data.
+    if (!mergeDirWithoutOverwrite(legacyPath, targetPath)) {
+        qCWarning(ThemeManagerLog) << "Could not fully migrate theme directory" << legacyPath << "; keeping it for a"
+                                   << "later retry";
+        return;
+    }
+    if (!QDir(legacyPath).removeRecursively()) {
+        qCWarning(ThemeManagerLog) << "Migrated theme directory but could not remove the legacy one:" << legacyPath;
+        return;
+    }
+    qCInfo(ThemeManagerLog) << "Merged customised theme directory" << LEGACY_SYSTEM_THEME_NAME << "into"
+                            << SYSTEM_THEME_NAME;
+}
+
 void ThemeManager::ensureThemeDirectoryExists()
 {
     auto &settings = SettingsCache::instance();
 
+    // Carry the user's theme customisations (zone graphics, stylesheets,
+    // palettes, theme.cfg) across before the stored name is rewritten.
+    migrateLegacyThemeDir(settings.paths().getThemesPath(), settings.getThemeName());
+
     // Migrate the old "Default" theme name to "System"
-    if (settings.getThemeName() == "Default") {
+    if (settings.getThemeName() == LEGACY_SYSTEM_THEME_NAME) {
         settings.setThemeName(SYSTEM_THEME_NAME);
     }
 
@@ -407,6 +485,10 @@ void ThemeManager::applyStyleAndPalette(const QString &themeName,
         }
     }
 
+    // The Windows 11 style is broken even when selected explicitly in a theme,
+    // so sanitize the resolved name here rather than trusting the theme config.
+    styleName = usableDefaultStyle(styleName);
+
     QStyle *style = QStyleFactory::create(styleName);
     if (!style) {
         style = QStyleFactory::create(usableDefaultStyle(defaultStyleName));

cockatrice/src/interface/theme_manager.h

@@ -71,6 +71,14 @@ public:
     // read-only system themes fall back to the user themes directory, creating
     // it if needed, so customisations never get lost on upgrade.
     static QString writableThemeDir(const QString &themeName);
+    // Carries a user profile's customised "Default" theme directory over to the
+    // "System" directory the theme was renamed to, so zone graphics,
+    // stylesheets, palettes and theme.cfg survive the rename. Renames the
+    // directory when "System" does not exist yet, otherwise merges file by
+    // file without overwriting what "System" already has. No-op unless the
+    // active theme is one of the two names, so a hand-made "Default" folder of
+    // a user on another theme is left alone.
+    static void migrateLegacyThemeDir(const QString &themesPath, const QString &currentThemeName);
     // Probe whether a directory is truly writable by trying to create and remove
     // a temporary file. QFileInfo::isWritable() on a directory is unreliable
     // (notably on Windows where UAC VirtualStore can make a system dir appear

cockatrice/src/interface/widgets/cards/additional_info/color_identity_widget.cpp

@@ -85,7 +85,7 @@ void ColorIdentityWidget::resizeEvent(QResizeEvent *event)
     }
     lastWidth = totalWidth;
 
-    const int totalHeight = totalWidth / 6; // Set height to 1/4 of the width
+    const int totalHeight = qMax(0, totalWidth / 6); // Set height to 1/4 of the width
     setFixedHeight(totalHeight);
 
     const int count = layout->count();
@@ -97,6 +97,10 @@ void ColorIdentityWidget::resizeEvent(QResizeEvent *event)
     const int availableWidth = totalWidth - (spacing * (count - 1));
     const int iconSize = qMin(availableWidth / count, totalHeight); // Ensure icons fit within the new height
 
+    if (iconSize <= 0) {
+        lastIconSize = iconSize;
+        return;
+    }
     if (iconSize == lastIconSize) {
         return;
     }

cockatrice/src/interface/widgets/cards/additional_info/deck_color_identity.cpp

@@ -0,0 +1,37 @@
+#include "deck_color_identity.h"
+
+#include <QSet>
+#include <libcockatrice/card/database/card_database_querier.h>
+#include <libcockatrice/deck_list/deck_list.h>
+#include <libcockatrice/deck_list/tree/inner_deck_list_node.h>
+
+QString getDeckColorIdentity(const DeckList &deck, const CardDatabaseQuerier *db)
+{
+    const QStringList cardList = deck.getCardList({DECK_ZONE_MAIN, DECK_ZONE_SIDE});
+    if (cardList.isEmpty()) {
+        return {};
+    }
+
+    QSet<QChar> colorSet; // A set to collect unique color symbols (e.g., W, U, B, R, G)
+
+    for (const QString &cardName : cardList) {
+        CardInfoPtr currentCard = db->getCardInfo(cardName);
+        if (currentCard) {
+            const QString colors = currentCard->getColors(); // returns something like "WUB"
+            for (const QChar &color : colors) {
+                colorSet.insert(color);
+            }
+        }
+    }
+
+    // Ensure the color identity is in WUBRG order
+    QString colorIdentity;
+    const QString wubrgOrder = "WUBRG";
+    for (const QChar &color : wubrgOrder) {
+        if (colorSet.contains(color)) {
+            colorIdentity.append(color);
+        }
+    }
+
+    return colorIdentity;
+}

cockatrice/src/interface/widgets/cards/additional_info/deck_color_identity.h

@@ -0,0 +1,20 @@
+#ifndef COCKATRICE_DECK_COLOR_IDENTITY_H
+#define COCKATRICE_DECK_COLOR_IDENTITY_H
+
+#include <QString>
+
+class CardDatabaseQuerier;
+class DeckList;
+
+/**
+ * @brief Computes the color identity of a deck (e.g. "WUBRG") from the color
+ *        symbols of all cards in the main deck and sideboard, ordered WUBRG.
+ *
+ * Shared as a free function so the deck storage previews and the deck share
+ * dialog compute identities identically.
+ *
+ * @param db Card database used to look up card color symbols.
+ */
+QString getDeckColorIdentity(const DeckList &deck, const CardDatabaseQuerier *db);
+
+#endif // COCKATRICE_DECK_COLOR_IDENTITY_H

cockatrice/src/interface/widgets/cards/card_group_display_widgets/card_group_display_widget.cpp

@@ -1,11 +1,13 @@
 #include "card_group_display_widget.h"
 
+#include "../../../../client/settings/cache_settings.h"
 #include "../card_info_picture_with_text_overlay_widget.h"
 
 #include <QResizeEvent>
 #include <libcockatrice/card/database/card_database_manager.h>
 #include <libcockatrice/models/deck_list/deck_list_model.h>
 #include <libcockatrice/models/deck_list/deck_list_sort_filter_proxy_model.h>
+#include <libcockatrice/settings/cards_display_settings.h>
 
 CardGroupDisplayWidget::CardGroupDisplayWidget(QWidget *parent,
                                                DeckListModel *_deckListModel,
@@ -30,6 +32,7 @@ CardGroupDisplayWidget::CardGroupDisplayWidget(QWidget *parent,
     layout->addWidget(banner);
 
     CardGroupDisplayWidget::updateCardDisplays();
+    updateCardCount();
 
     connect(deckListModel, &QAbstractItemModel::rowsInserted, this, &CardGroupDisplayWidget::onCardAddition);
     if (selectionModel) {
@@ -38,6 +41,13 @@ CardGroupDisplayWidget::CardGroupDisplayWidget(QWidget *parent,
     }
     connect(deckListModel, &QAbstractItemModel::rowsRemoved, this, &CardGroupDisplayWidget::onCardRemoval);
     connect(deckListModel, &QAbstractItemModel::dataChanged, this, &CardGroupDisplayWidget::onDataChanged);
+    connect(deckListModel, &QAbstractItemModel::rowsInserted, this, &CardGroupDisplayWidget::updateCardCount);
+    connect(deckListModel, &QAbstractItemModel::rowsRemoved, this, &CardGroupDisplayWidget::updateCardCount);
+    connect(deckListModel, &QAbstractItemModel::dataChanged, this, &CardGroupDisplayWidget::updateCardCount);
+    connect(&SettingsCache::instance().cardsDisplay(), &CardsDisplaySettings::visualDeckEditorShowCardCountsChanged,
+            this, &CardGroupDisplayWidget::updateCardCount);
+
+    cardSizeWidget->enableCtrlScrollResize(this);
 }
 
 // Just here so it can get overwritten in subclasses.
@@ -349,3 +359,21 @@ void CardGroupDisplayWidget::onActiveSortCriteriaChanged(QStringList _activeSort
     clearAllDisplayWidgets();
     updateCardDisplays();
 }
+
+void CardGroupDisplayWidget::updateCardCount()
+{
+    if (!banner || !deckListModel || !trackedIndex.isValid()) {
+        return;
+    }
+
+    QString text = cardGroupCategory;
+    if (SettingsCache::instance().cardsDisplay().getVisualDeckEditorShowCardCounts()) {
+        int total = 0;
+        for (int i = 0; i < deckListModel->rowCount(trackedIndex); ++i) {
+            total +=
+                deckListModel->index(i, DeckListModelColumns::CARD_AMOUNT, trackedIndex).data(Qt::EditRole).toInt();
+        }
+        text += QStringLiteral(" (%1)").arg(total);
+    }
+    banner->setText(text);
+}

cockatrice/src/interface/widgets/cards/card_group_display_widgets/card_group_display_widget.h

@@ -55,6 +55,7 @@ public slots:
     virtual void onCardRemoval(const QModelIndex &parent, int first, int last);
     void onDataChanged(const QModelIndex &topLeft, const QModelIndex &bottomRight, const QVector<int> &roles);
     void onActiveSortCriteriaChanged(QStringList activeSortCriteria);
+    void updateCardCount();
     void resizeEvent(QResizeEvent *event) override;
 
 signals:

cockatrice/src/interface/widgets/cards/card_info_picture_with_text_overlay_widget.cpp

@@ -133,12 +133,14 @@ void CardInfoPictureWithTextOverlayWidget::paintEvent(QPaintEvent *event)
         path.addRoundedRect(glowRect, radius, radius);
 
         // Soft outer glow
-        QColor glowColor(0, 150, 255, 80); // subtle blu
+        QColor glowColor = palette().color(QPalette::Highlight);
+        glowColor.setAlpha(80);
         painter.setPen(QPen(glowColor, 6));
         painter.drawPath(path);
 
         // Thin inner border for crispness
-        QColor borderColor(0, 150, 255, 200);
+        QColor borderColor = palette().color(QPalette::Highlight);
+        borderColor.setAlpha(200);
         painter.setPen(QPen(borderColor, 2));
         painter.drawRoundedRect(pixmapRect, radius, radius);
 

cockatrice/src/interface/widgets/cards/card_size_widget.cpp

@@ -3,6 +3,9 @@
 #include "../printing_selector/printing_selector.h"
 #include "../visual_deck_storage/visual_deck_storage_widget.h"
 
+#include <QScrollArea>
+#include <QWheelEvent>
+
 /**
  * @class CardSizeWidget
  * @brief A widget for adjusting card sizes using a slider.
@@ -58,3 +61,39 @@ QSlider *CardSizeWidget::getSlider() const
 {
     return cardSizeSlider;
 }
+
+void CardSizeWidget::enableCtrlScrollResize(QWidget *host)
+{
+    host->installEventFilter(this);
+
+    const auto scrollAreas = host->findChildren<QScrollArea *>();
+    for (QScrollArea *scrollArea : scrollAreas) {
+        if (QWidget *content = scrollArea->widget()) {
+            content->installEventFilter(this);
+        }
+    }
+}
+
+bool CardSizeWidget::eventFilter(QObject *watched, QEvent *event)
+{
+    if (event->type() == QEvent::Wheel && adjustSliderForWheel(static_cast<QWheelEvent *>(event))) {
+        return true;
+    }
+    return QWidget::eventFilter(watched, event);
+}
+
+bool CardSizeWidget::adjustSliderForWheel(QWheelEvent *event)
+{
+    if (!(event->modifiers() & Qt::ControlModifier)) {
+        return false;
+    }
+
+    const int angleDelta = event->angleDelta().y();
+    if (angleDelta == 0) {
+        return false;
+    }
+
+    const int wheelSteps = angleDelta > 0 ? qMax(1, angleDelta / 120) : qMin(-1, angleDelta / 120);
+    cardSizeSlider->setValue(cardSizeSlider->value() + wheelSteps * CARD_SIZE_WHEEL_STEP);
+    return true;
+}

cockatrice/src/interface/widgets/cards/card_size_widget.h

@@ -17,6 +17,8 @@
 #include <QTimer>
 #include <QWidget>
 
+class QWheelEvent;
+
 class CardSizeWidget : public QWidget
 {
     Q_OBJECT
@@ -25,6 +27,18 @@ public:
     explicit CardSizeWidget(QWidget *parent, FlowWidget *flowWidget = nullptr, int defaultValue = 100);
     [[nodiscard]] QSlider *getSlider() const;
 
+    /**
+     * @brief Resizes the cards when the user Ctrl + scrolls over @p host or any of its descendants.
+     *
+     * Installs this widget as an event filter on the given host widget. If the host contains a
+     * scroll area the filter is also installed on the scroll area's content widget, so the resize
+     * intercepts the wheel event before the scroll area would scroll the view.
+     */
+    void enableCtrlScrollResize(QWidget *host);
+
+protected:
+    bool eventFilter(QObject *watched, QEvent *event) override;
+
 private slots:
     void updateCardSizeSetting(int newValue);
 
@@ -44,6 +58,10 @@ private:
     QSlider *cardSizeSlider;
     QTimer debounceTimer; // Debounce timer
     int pendingValue;     // Stores the latest slider value
+
+    bool adjustSliderForWheel(QWheelEvent *event);
+
+    static constexpr int CARD_SIZE_WHEEL_STEP = 10; ///< Slider step applied per Ctrl + scroll notch.
 };
 
 #endif // CARD_SIZE_WIDGET_H

cockatrice/src/interface/widgets/cards/deck_card_zone_display_widget.cpp

@@ -1,8 +1,10 @@
 #include "deck_card_zone_display_widget.h"
 
+#include "../../../client/settings/cache_settings.h"
 #include "card_group_display_widgets/flat_card_group_display_widget.h"
 #include "card_group_display_widgets/overlapped_card_group_display_widget.h"
 #include "libcockatrice/card/database/card_database_manager.h"
+#include "libcockatrice/settings/cards_display_settings.h"
 
 #include <QResizeEvent>
 #include <algorithm>
@@ -39,6 +41,7 @@ DeckCardZoneDisplayWidget::DeckCardZoneDisplayWidget(QWidget *parent,
     banner->setBuddy(cardGroupContainer);
 
     displayCards();
+    updateZoneCardCount();
 
     connect(deckListModel, &QAbstractItemModel::rowsInserted, this, &DeckCardZoneDisplayWidget::onCategoryAddition);
     if (selectionModel) {
@@ -46,6 +49,11 @@ DeckCardZoneDisplayWidget::DeckCardZoneDisplayWidget(QWidget *parent,
                 &DeckCardZoneDisplayWidget::onSelectionChanged);
     }
     connect(deckListModel, &QAbstractItemModel::rowsRemoved, this, &DeckCardZoneDisplayWidget::onCategoryRemoval);
+    connect(deckListModel, &QAbstractItemModel::rowsInserted, this, &DeckCardZoneDisplayWidget::updateZoneCardCount);
+    connect(deckListModel, &QAbstractItemModel::rowsRemoved, this, &DeckCardZoneDisplayWidget::updateZoneCardCount);
+    connect(deckListModel, &QAbstractItemModel::dataChanged, this, &DeckCardZoneDisplayWidget::updateZoneCardCount);
+    connect(&SettingsCache::instance().cardsDisplay(), &CardsDisplaySettings::visualDeckEditorShowCardCountsChanged,
+            this, &DeckCardZoneDisplayWidget::updateZoneCardCount);
 }
 
 // =====================================================================================================================
@@ -245,3 +253,21 @@ QList<QString> DeckCardZoneDisplayWidget::getGroupCriteriaValueList()
 
     return groupCriteriaValues;
 }
+
+void DeckCardZoneDisplayWidget::updateZoneCardCount()
+{
+    if (!banner || !deckListModel) {
+        return;
+    }
+
+    QString text = zoneName;
+    if (SettingsCache::instance().cardsDisplay().getVisualDeckEditorShowCardCounts()) {
+        int total = 0;
+        const auto cardNodes = deckListModel->getCardNodesForZone(zoneName);
+        for (const auto *node : cardNodes) {
+            total += node->getNumber();
+        }
+        text += QStringLiteral(" (%1)").arg(total);
+    }
+    banner->setText(text);
+}

cockatrice/src/interface/widgets/cards/deck_card_zone_display_widget.h

@@ -52,6 +52,7 @@ public slots:
     QList<QString> getGroupCriteriaValueList();
     void onCategoryAddition(const QModelIndex &parent, int first, int last);
     void onCategoryRemoval(const QModelIndex &parent, int first, int last);
+    void updateZoneCardCount();
 
 signals:
     void cardClicked(QMouseEvent *event, const ExactCard &card, const QString &zoneName);

cockatrice/src/interface/widgets/cards/deck_preview_card_picture_widget.cpp

@@ -27,18 +27,23 @@ DeckPreviewCardPictureWidget::DeckPreviewCardPictureWidget(QWidget *parent,
                                                            const QColor &textColor,
                                                            const QColor &outlineColor,
                                                            const int fontSize,
-                                                           const Qt::Alignment alignment)
+                                                           const Qt::Alignment alignment,
+                                                           const bool _emitClickImmediately)
     : CardInfoPictureWithTextOverlayWidget(parent,
                                            hoverToZoomEnabled,
                                            raiseOnEnter,
                                            textColor,
                                            outlineColor,
                                            fontSize,
-                                           alignment)
+                                           alignment),
+      emitClickImmediately(_emitClickImmediately)
 {
     singleClickTimer = new QTimer(this);
     singleClickTimer->setSingleShot(true);
-    connect(singleClickTimer, &QTimer::timeout, this, [this]() { emit imageClicked(lastMouseEvent, this); });
+    connect(singleClickTimer, &QTimer::timeout, this, [this]() {
+        emit imageClicked(lastMouseEvent, this);
+        emit imageSingleClicked();
+    });
     connect(&SettingsCache::instance().visualDeckStorage(),
             &VisualDeckStorageSettings::visualDeckStorageSelectionAnimationChanged, this,
             &CardInfoPictureWidget::setRaiseOnEnterEnabled);
@@ -47,8 +52,13 @@ DeckPreviewCardPictureWidget::DeckPreviewCardPictureWidget(QWidget *parent,
 void DeckPreviewCardPictureWidget::mousePressEvent(QMouseEvent *event)
 {
     if (event->button() == Qt::LeftButton) {
-        lastMouseEvent = event;
+        if (emitClickImmediately) {
-        singleClickTimer->start(QApplication::doubleClickInterval());
+            emit imageClicked(event, this);
+            emit imageSingleClicked();
+        } else {
+            lastMouseEvent = event;
+            singleClickTimer->start(QApplication::doubleClickInterval());
+        }
     } else {
         emit imageClicked(event, this);
         event->accept();
@@ -58,7 +68,14 @@ void DeckPreviewCardPictureWidget::mousePressEvent(QMouseEvent *event)
 void DeckPreviewCardPictureWidget::mouseDoubleClickEvent(QMouseEvent *event)
 {
     if (event->button() == Qt::LeftButton) {
-        singleClickTimer->stop(); // Prevent single-click logic
+        if (emitClickImmediately) {
-        emit imageDoubleClicked(lastMouseEvent, this);
+            // Do not report a second single click for the second press of the
+            // double-click; the consumer maps the double-click to select+open.
+            lastMouseEvent = event;
+            emit imageDoubleClicked(event, this);
+        } else {
+            singleClickTimer->stop(); // Prevent single-click logic
+            emit imageDoubleClicked(lastMouseEvent, this);
+        }
     }
 }

cockatrice/src/interface/widgets/cards/deck_preview_card_picture_widget.h

@@ -20,21 +20,38 @@ class DeckPreviewCardPictureWidget final : public CardInfoPictureWithTextOverlay
     Q_OBJECT
 
 public:
+    /**
+     * @brief Constructs a DeckPreviewCardPictureWidget.
+     * @param parent The parent widget.
+     * @param hoverToZoomEnabled If this widget will spawn a larger widget when hovered over.
+     * @param raiseOnEnter If the widget raises its border when the mouse enters.
+     * @param textColor The color of the overlay text.
+     * @param outlineColor The color of the outline around the text.
+     * @param fontSize The font size of the overlay text.
+     * @param alignment The alignment of the text within the overlay.
+     * @param emitClickImmediately If true, a left click is reported immediately on click
+     *        instead of after the double-click interval. Use this for selection surfaces
+     *        where reacting to a double-click (select-and-open) would needlessly delay the
+     *        single-click feedback. The double-click signal is still emitted.
+     */
     explicit DeckPreviewCardPictureWidget(QWidget *parent,
                                           bool hoverToZoomEnabled = false,
                                           bool raiseOnEnter = false,
                                           const QColor &textColor = Qt::white,
                                           const QColor &outlineColor = Qt::black,
                                           int fontSize = 12,
-                                          Qt::Alignment alignment = Qt::AlignCenter);
+                                          Qt::Alignment alignment = Qt::AlignCenter,
+                                          bool _emitClickImmediately = false);
 
 signals:
     void imageClicked(QMouseEvent *event, DeckPreviewCardPictureWidget *instance);
+    void imageSingleClicked();
     void imageDoubleClicked(QMouseEvent *event, DeckPreviewCardPictureWidget *instance);
 
 private:
     QTimer *singleClickTimer;
     QMouseEvent *lastMouseEvent = nullptr; // Store the last mouse event
+    bool emitClickImmediately;
 
 protected:
     void mousePressEvent(QMouseEvent *event) override;

cockatrice/src/interface/widgets/deck_editor/deck_editor_database_display_widget.cpp

@@ -11,8 +11,10 @@
 #include <QHeaderView>
 #include <QToolButton>
 #include <QTreeView>
+#include <libcockatrice/card/card_localization.h>
 #include <libcockatrice/card/database/card_database_manager.h>
 #include <libcockatrice/card/relation/card_relation.h>
+#include <libcockatrice/settings/cards_display_settings.h>
 
 DeckEditorDatabaseDisplayWidget::DeckEditorDatabaseDisplayWidget(QWidget *parent, CardDatabaseModel *databaseModel)
     : QWidget(parent)
@@ -40,6 +42,17 @@ DeckEditorDatabaseDisplayWidget::DeckEditorDatabaseDisplayWidget(QWidget *parent
     databaseDisplayModel->setSourceModel(databaseModel);
     databaseDisplayModel->setFilterKeyColumn(0);
 
+    const auto applyCardSearchLanguage = [this]() {
+        const CardsDisplaySettings &cardsDisplay = SettingsCache::instance().cardsDisplay();
+        databaseDisplayModel->setSearchLanguage(CardSearchLanguage{
+            cardsDisplay.getCardLang(), static_cast<SearchLanguageMode>(cardsDisplay.getCardSearchLanguage())});
+    };
+    applyCardSearchLanguage();
+    connect(&SettingsCache::instance().cardsDisplay(), &CardsDisplaySettings::cardLangChanged, this,
+            applyCardSearchLanguage);
+    connect(&SettingsCache::instance().cardsDisplay(), &CardsDisplaySettings::cardSearchLanguageChanged, this,
+            applyCardSearchLanguage);
+
     databaseView = new CardDatabaseView(this, databaseDisplayModel);
     databaseView->setObjectName("databaseView");
     databaseView->setFocusProxy(searchEdit);

cockatrice/src/interface/widgets/deck_share/deck_share_utils.cpp

@@ -0,0 +1,59 @@
+#include "deck_share_utils.h"
+
+#include <QClipboard>
+#include <QGuiApplication>
+#include <QLocale>
+#include <QTimeZone>
+#include <QUrl>
+#include <QUrlQuery>
+#include <libcockatrice/network/client/abstract/abstract_client.h>
+#include <libcockatrice/protocol/pb/response.pb.h>
+#include <libcockatrice/protocol/pb/response_deck_share_create.pb.h>
+
+namespace DeckShareUtils
+{
+
+QString buildShareLink(const AbstractClient *client, const QString &token)
+{
+    QUrl url;
+    url.setScheme(QStringLiteral("cockatrice"));
+    url.setHost(QStringLiteral("opendeck"));
+
+    QUrlQuery query;
+    query.addQueryItem(QStringLiteral("share"), token);
+    query.addQueryItem(QStringLiteral("hostname"), client->serverName());
+    query.addQueryItem(QStringLiteral("port"), QString::number(client->serverPort()));
+    url.setQuery(query);
+
+    return url.toString(QUrl::FullyEncoded);
+}
+
+QString copyShareLinkToClipboard(const QString &link)
+{
+    QGuiApplication::clipboard()->setText(link);
+    return link;
+}
+
+QString formatShareExpiry(const QDateTime &expiry)
+{
+    return QLocale().toString(expiry.toLocalTime(), QLocale::ShortFormat);
+}
+
+ShareResponse handleShareResponse(const AbstractClient *client, const Response &response)
+{
+    const Response_DeckShareCreate &resp = response.GetExtension(Response_DeckShareCreate::ext);
+    const QString token = QString::fromStdString(resp.token());
+
+    const QString link = buildShareLink(client, token);
+    copyShareLinkToClipboard(link);
+
+#if QT_VERSION >= QT_VERSION_CHECK(6, 7, 0)
+    const QDateTime expiry = QDateTime::fromSecsSinceEpoch(resp.expires_at(), QTimeZone::UTC);
+#else
+    const QDateTime expiry = QDateTime::fromSecsSinceEpoch(resp.expires_at(), Qt::UTC);
+#endif
+
+    return {link, expiry};
+}
+
+} // namespace DeckShareUtils

cockatrice/src/interface/widgets/deck_share/deck_share_utils.h

@@ -0,0 +1,59 @@
+/**
+ * @file deck_share_utils.h
+ * @ingroup DeckShareWidgets
+ */
+//! \todo Document this file.
+
+#ifndef DECK_SHARE_UTILS_H
+#define DECK_SHARE_UTILS_H
+
+#include <QDateTime>
+#include <QString>
+
+class AbstractClient;
+class Response;
+
+/**
+ * @brief Shared helpers for creating temporary deck shares.
+ */
+namespace DeckShareUtils
+{
+
+/**
+ * @brief The outcome of a successful share-create response.
+ */
+struct ShareResponse
+{
+    QString link;     ///< The share link that was copied to the clipboard.
+    QDateTime expiry; ///< When the share expires (UTC).
+};
+
+/**
+ * @brief Builds the cockatrice:// link for a freshly created deck share.
+ * @param client Used to embed the target server's hostname and port.
+ * @param token The share token from Response_DeckShareCreate.
+ */
+QString buildShareLink(const AbstractClient *client, const QString &token);
+
+/**
+ * @brief Copies the share link to the clipboard.
+ * @return The link that was copied.
+ */
+QString copyShareLinkToClipboard(const QString &link);
+
+/**
+ * @brief Formats the expiration timestamp for a share.
+ */
+QString formatShareExpiry(const QDateTime &expiry);
+
+/**
+ * @brief Handles a successful Response_DeckShareCreate: builds the share link,
+ *        copies it to the clipboard, and derives the share expiry.
+ * @param client Used to embed the target server's hostname and port.
+ * @param response The successful response carrying the share token and expiry.
+ */
+ShareResponse handleShareResponse(const AbstractClient *client, const Response &response);
+
+} // namespace DeckShareUtils
+
+#endif // DECK_SHARE_UTILS_H

cockatrice/src/interface/widgets/deck_share/share_bar_widget.cpp

@@ -0,0 +1,77 @@
+#include "share_bar_widget.h"
+
+#include <QHBoxLayout>
+#include <QLabel>
+#include <QLineEdit>
+#include <QPushButton>
+
+ShareBarWidget::ShareBarWidget(QWidget *parent) : QWidget(parent)
+{
+    auto *layout = new QHBoxLayout(this);
+    layout->setContentsMargins(12, 10, 12, 10);
+    layout->setSpacing(8);
+
+    hintLabel = new QLabel(this);
+    hintLabel->setWordWrap(true);
+
+    nameEdit = new QLineEdit(this);
+    nameEdit->setMaximumWidth(260);
+
+    countLabel = new QLabel(this);
+
+    cancelButton = new QPushButton(this);
+    connect(cancelButton, &QPushButton::clicked, this, &ShareBarWidget::cancelRequested);
+
+    createButton = new QPushButton(this);
+    createButton->setDefault(true);
+    connect(createButton, &QPushButton::clicked, this, &ShareBarWidget::createRequested);
+
+    layout->addWidget(hintLabel, 1);
+    layout->addWidget(nameEdit);
+    layout->addWidget(countLabel);
+    layout->addStretch();
+    layout->addWidget(cancelButton);
+    layout->addWidget(createButton);
+
+    setLayout(layout);
+
+    retranslateUi();
+}
+
+void ShareBarWidget::retranslateUi()
+{
+    nameEdit->setPlaceholderText(tr("Share name"));
+    cancelButton->setText(tr("Cancel"));
+    createButton->setText(tr("Create share link"));
+}
+
+QString ShareBarWidget::name() const
+{
+    return nameEdit->text().trimmed();
+}
+
+void ShareBarWidget::setName(const QString &value)
+{
+    nameEdit->setText(value);
+}
+
+void ShareBarWidget::setCountText(const QString &text)
+{
+    countLabel->setText(text);
+}
+
+void ShareBarWidget::setHintText(const QString &text, bool visible)
+{
+    hintLabel->setText(text);
+    hintLabel->setVisible(visible);
+}
+
+void ShareBarWidget::setCreateEnabled(bool enabled)
+{
+    createButton->setEnabled(enabled);
+}
+
+void ShareBarWidget::focusName()
+{
+    nameEdit->setFocus();
+}

cockatrice/src/interface/widgets/deck_share/share_bar_widget.h

@@ -0,0 +1,63 @@
+/**
+ * @file share_bar_widget.h
+ * @ingroup DeckShareWidgets
+ */
+//! \todo Document this file.
+
+#ifndef SHARE_BAR_WIDGET_H
+#define SHARE_BAR_WIDGET_H
+
+#include <QWidget>
+
+class QLabel;
+class QLineEdit;
+class QPushButton;
+
+/**
+ * @brief The activated toolbar used to create a temporary deck share.
+ *
+ * A single reusable component shared by the local visual deck storage and the
+ * remote server deck storage tabs, so the share workflow renders identically in
+ * both places. It owns its own widgets, strings, and layout; the owning tab only
+ * sets the count/hint text and reacts to the create/cancel signals.
+ */
+class ShareBarWidget final : public QWidget
+{
+    Q_OBJECT
+
+public:
+    explicit ShareBarWidget(QWidget *parent = nullptr);
+
+    void retranslateUi();
+
+    /** @return The trimmed name entered by the user. */
+    [[nodiscard]] QString name() const;
+
+    /** @brief Resets the name field to the given default. */
+    void setName(const QString &name);
+
+    /** @brief Sets the selected-count summary label text. */
+    void setCountText(const QString &text);
+
+    /** @brief Sets the explainer hint text, showing it when @p visible is true. */
+    void setHintText(const QString &text, bool visible);
+
+    /** @brief Enables or disables the create-share-link button (guards double submission). */
+    void setCreateEnabled(bool enabled);
+
+    /** @brief Moves keyboard focus to the name field. */
+    void focusName();
+
+signals:
+    void createRequested();
+    void cancelRequested();
+
+private:
+    QLabel *hintLabel;
+    QLineEdit *nameEdit;
+    QLabel *countLabel;
+    QPushButton *cancelButton;
+    QPushButton *createButton;
+};
+
+#endif // SHARE_BAR_WIDGET_H

cockatrice/src/interface/widgets/deck_share/shared_deck_preview_widget.cpp

@@ -0,0 +1,140 @@
+#include "shared_deck_preview_widget.h"
+
+#include "../cards/additional_info/color_identity_widget.h"
+#include "../cards/deck_preview_card_picture_widget.h"
+
+#include <QCheckBox>
+#include <QFrame>
+#include <QHBoxLayout>
+#include <QKeyEvent>
+#include <QLabel>
+#include <QVBoxLayout>
+#include <libcockatrice/card/database/card_database_querier.h>
+
+SharedDeckPreviewWidget::SharedDeckPreviewWidget(QWidget *parent,
+                                                 const CardDatabaseQuerier *querier,
+                                                 const QString &deckName,
+                                                 const QString &bannerCardName,
+                                                 const QString &colorIdentity,
+                                                 const QString &gameFormat,
+                                                 const QString &deckToolTip)
+    : QWidget(parent)
+{
+    bannerCardDisplayWidget =
+        new DeckPreviewCardPictureWidget(this, false, false, Qt::white, Qt::black, 12, Qt::AlignCenter, true);
+    bannerCardDisplayWidget->setScaleFactor(100);
+    const ExactCard bannerCard = bannerCardName.isEmpty() ? ExactCard() : querier->getCard(CardRef{bannerCardName, {}});
+    bannerCardDisplayWidget->setCard(bannerCard);
+    bannerCardDisplayWidget->setOverlayText(deckName);
+    setToolTip(deckToolTip.isEmpty() ? deckName : deckToolTip);
+    setFocusPolicy(Qt::StrongFocus);
+    setBaseAccessibleName(deckName);
+
+    colorIdentityWidget = new ColorIdentityWidget(this, colorIdentity);
+    colorIdentityWidget->setVisible(!colorIdentity.isEmpty());
+
+    // gameFormat is server-supplied and the QLabel renders AutoText, so escape it.
+    gameFormatLabel = new QLabel(gameFormat.toHtmlEscaped(), this);
+    gameFormatLabel->setAlignment(Qt::AlignCenter);
+    gameFormatLabel->setVisible(!gameFormat.isEmpty());
+
+    selectionCheckBox = new QCheckBox(this);
+    selectionCheckBox->setToolTip(tr("Select this deck"));
+    // The tile itself is focusable (Space/Enter toggles); keep the checkbox
+    // from creating a second tab stop per tile.
+    selectionCheckBox->setFocusPolicy(Qt::NoFocus);
+
+    // Selection frame reused from the deck-preview selection covenant: a
+    // palette(highlight) border around the banner card, shown while selected.
+    selectionFrame = new QFrame(bannerCardDisplayWidget);
+    selectionFrame->setAttribute(Qt::WA_TransparentForMouseEvents);
+    selectionFrame->setStyleSheet(QStringLiteral(
+        "QFrame { border: 2px solid palette(highlight); border-radius: 4px; background: transparent; }"));
+    selectionFrame->setVisible(false);
+
+    auto *selectionRow = new QHBoxLayout;
+    selectionRow->addWidget(selectionCheckBox);
+    selectionRow->addStretch(1);
+
+    auto *layout = new QVBoxLayout(this);
+    layout->setContentsMargins(0, 0, 0, 0);
+    layout->addLayout(selectionRow);
+    layout->addWidget(bannerCardDisplayWidget, 0, Qt::AlignHCenter);
+    layout->addWidget(colorIdentityWidget, 0, Qt::AlignHCenter);
+    layout->addWidget(gameFormatLabel, 0, Qt::AlignHCenter);
+    setLayout(layout);
+
+    connect(selectionCheckBox, &QCheckBox::toggled, this, [this](bool checked) {
+        updateSelectionVisual(checked);
+        emit selectionToggled(checked);
+    });
+    connect(bannerCardDisplayWidget, &DeckPreviewCardPictureWidget::imageClicked, this,
+            &SharedDeckPreviewWidget::toggleSelection);
+    connect(bannerCardDisplayWidget, &DeckPreviewCardPictureWidget::imageDoubleClicked, this,
+            &SharedDeckPreviewWidget::activate);
+}
+
+bool SharedDeckPreviewWidget::isSelected() const
+{
+    return selectionCheckBox->isChecked();
+}
+
+void SharedDeckPreviewWidget::setSelected(bool selected)
+{
+    if (isSelected() == selected) {
+        return;
+    }
+    selectionCheckBox->setChecked(selected);
+}
+
+void SharedDeckPreviewWidget::updateSelectionVisual(bool selected)
+{
+    selectionFrame->setVisible(selected);
+    selectionFrame->raise();
+    if (selected) {
+        setAccessibleName(baseAccessibleName + tr(" (selected)"));
+    } else {
+        setAccessibleName(baseAccessibleName);
+    }
+}
+
+void SharedDeckPreviewWidget::setBaseAccessibleName(const QString &name)
+{
+    baseAccessibleName = name;
+    setAccessibleName(name);
+}
+
+void SharedDeckPreviewWidget::toggleSelection()
+{
+    setSelected(!isSelected());
+}
+
+void SharedDeckPreviewWidget::activate()
+{
+    setSelected(true);
+    emit activated();
+}
+
+void SharedDeckPreviewWidget::resizeEvent(QResizeEvent *event)
+{
+    QWidget::resizeEvent(event);
+    updateSelectionFrameGeometry();
+}
+
+void SharedDeckPreviewWidget::updateSelectionFrameGeometry()
+{
+    if (selectionFrame == nullptr || bannerCardDisplayWidget == nullptr) {
+        return;
+    }
+    selectionFrame->setGeometry(bannerCardDisplayWidget->rect().adjusted(1, 1, -1, -1));
+}
+
+void SharedDeckPreviewWidget::keyPressEvent(QKeyEvent *event)
+{
+    if (event->key() == Qt::Key_Space || event->key() == Qt::Key_Return || event->key() == Qt::Key_Enter) {
+        toggleSelection();
+        event->accept();
+        return;
+    }
+    QWidget::keyPressEvent(event);
+}

cockatrice/src/interface/widgets/deck_share/shared_deck_preview_widget.h

@@ -0,0 +1,77 @@
+/**
+ * @file shared_deck_preview_widget.h
+ * @ingroup DeckShareWidgets
+ */
+//! \todo Document this file.
+
+#ifndef SHARED_DECK_PREVIEW_WIDGET_H
+#define SHARED_DECK_PREVIEW_WIDGET_H
+
+#include <QWidget>
+
+class ColorIdentityWidget;
+class DeckPreviewCardPictureWidget;
+class QCheckBox;
+class QFrame;
+class QKeyEvent;
+class QLabel;
+class QResizeEvent;
+class CardDatabaseQuerier;
+
+/**
+ * @brief A selectable preview tile for a deck that has no local file.
+ *
+ * Renders a banner card picture (looked up by name in the card database), the
+ * deck name, color identity and game format. Used to preview decks shared via a
+ * cockatrice:// link (metadata from Command_DeckShareList) and the deck
+ * currently open in the deck editor.
+ *
+ * Selection follows the deck-preview covenant: the tile reports its click
+ * immediately (no double-click interval delay), a palette(highlight) frame
+ * marks the selected tile, and Space/Enter toggles selection from the keyboard.
+ * A double click selects the tile and emits activated() so the caller can open
+ * just that deck.
+ */
+class SharedDeckPreviewWidget : public QWidget
+{
+    Q_OBJECT
+
+public:
+    explicit SharedDeckPreviewWidget(QWidget *parent,
+                                     const CardDatabaseQuerier *querier,
+                                     const QString &deckName,
+                                     const QString &bannerCardName,
+                                     const QString &colorIdentity,
+                                     const QString &gameFormat = QString(),
+                                     const QString &deckToolTip = QString());
+
+    [[nodiscard]] bool isSelected() const;
+    void setSelected(bool selected);
+
+    void setBaseAccessibleName(const QString &name);
+
+signals:
+    void selectionToggled(bool selected);
+    void activated();
+
+protected:
+    void resizeEvent(QResizeEvent *event) override;
+    void keyPressEvent(QKeyEvent *event) override;
+
+private slots:
+    void toggleSelection();
+    void activate();
+
+private:
+    void updateSelectionVisual(bool selected);
+    void updateSelectionFrameGeometry();
+
+    DeckPreviewCardPictureWidget *bannerCardDisplayWidget;
+    ColorIdentityWidget *colorIdentityWidget;
+    QLabel *gameFormatLabel;
+    QCheckBox *selectionCheckBox;
+    QFrame *selectionFrame;
+    QString baseAccessibleName;
+};
+
+#endif // SHARED_DECK_PREVIEW_WIDGET_H

cockatrice/src/interface/widgets/dialogs/dlg_edit_avatar.cpp

@@ -19,6 +19,9 @@ DlgEditAvatar::DlgEditAvatar(QWidget *parent) : QDialog(parent), image()
 
     textLabel = new QLabel(tr("To change your avatar, choose a new image.\nTo remove your current avatar, confirm "
                               "without choosing a new image."));
+    hintLabel = new QLabel(
+        tr("Images are automatically downscaled to at most %1x%1 pixels.").arg(QString::number(MAX_AVATAR_DIMENSION)));
+
     browseButton = new QPushButton(tr("Browse..."));
     connect(browseButton, &QPushButton::clicked, this, &DlgEditAvatar::actBrowse);
 
@@ -26,6 +29,7 @@ DlgEditAvatar::DlgEditAvatar(QWidget *parent) : QDialog(parent), image()
     grid->addWidget(imageLabel, 0, 0, 1, 2);
     grid->addWidget(textLabel, 1, 0);
     grid->addWidget(browseButton, 1, 1);
+    grid->addWidget(hintLabel, 2, 0, 1, 2);
 
     auto *buttonBox = new QDialogButtonBox(QDialogButtonBox::Ok | QDialogButtonBox::Cancel);
     connect(buttonBox, &QDialogButtonBox::accepted, this, &DlgEditAvatar::actOk);
@@ -72,6 +76,10 @@ QByteArray DlgEditAvatar::getImage()
         return QByteArray();
     }
 
+    if (image.width() > MAX_AVATAR_DIMENSION || image.height() > MAX_AVATAR_DIMENSION) {
+        image = image.scaled(MAX_AVATAR_DIMENSION, MAX_AVATAR_DIMENSION, Qt::KeepAspectRatio, Qt::SmoothTransformation);
+    }
+
     for (;;) {
         QByteArray ba;
         QBuffer buffer(&ba);

cockatrice/src/interface/widgets/dialogs/dlg_edit_avatar.h

@@ -29,8 +29,9 @@ private slots:
     void actBrowse();
 
 private:
+    static constexpr int MAX_AVATAR_DIMENSION = 1024;
     QImage image;
-    QLabel *textLabel, *imageLabel;
+    QLabel *textLabel, *imageLabel, *hintLabel;
     QPushButton *browseButton;
 };
 

cockatrice/src/interface/widgets/dialogs/dlg_login_prompt.cpp

@@ -0,0 +1,50 @@
+#include "dlg_login_prompt.h"
+
+#include <QCheckBox>
+#include <QDialogButtonBox>
+#include <QFormLayout>
+#include <QLabel>
+#include <QLineEdit>
+#include <QVBoxLayout>
+
+DlgLoginPrompt::DlgLoginPrompt(const QString &serverText, QWidget *parent) : QDialog(parent)
+{
+    setWindowTitle(tr("Sign in"));
+
+    auto *mainLayout = new QVBoxLayout(this);
+    mainLayout->addWidget(
+        new QLabel(tr("This link requires you to be signed in.\nSign in to %1:").arg(serverText), this));
+
+    auto *formLayout = new QFormLayout;
+    usernameEdit = new QLineEdit(this);
+    passwordEdit = new QLineEdit(this);
+    passwordEdit->setEchoMode(QLineEdit::Password);
+    formLayout->addRow(tr("Username:"), usernameEdit);
+    formLayout->addRow(tr("Password:"), passwordEdit);
+    mainLayout->addLayout(formLayout);
+
+    savePasswordCheckBox = new QCheckBox(tr("Save password for this server"), this);
+    mainLayout->addWidget(savePasswordCheckBox);
+
+    auto *buttonBox = new QDialogButtonBox(QDialogButtonBox::Ok | QDialogButtonBox::Cancel, this);
+    connect(buttonBox, &QDialogButtonBox::accepted, this, &QDialog::accept);
+    connect(buttonBox, &QDialogButtonBox::rejected, this, &QDialog::reject);
+    mainLayout->addWidget(buttonBox);
+
+    usernameEdit->setFocus();
+}
+
+QString DlgLoginPrompt::username() const
+{
+    return usernameEdit->text().trimmed();
+}
+
+QString DlgLoginPrompt::password() const
+{
+    return passwordEdit->text();
+}
+
+bool DlgLoginPrompt::savePassword() const
+{
+    return savePasswordCheckBox->isChecked();
+}

cockatrice/src/interface/widgets/dialogs/dlg_login_prompt.h

@@ -0,0 +1,40 @@
+/**
+ * @file dlg_login_prompt.h
+ * @ingroup ConnectionDialogs
+ */
+//! \todo Document this file.
+
+#ifndef DLG_LOGIN_PROMPT_H
+#define DLG_LOGIN_PROMPT_H
+
+#include <QDialog>
+
+class QCheckBox;
+class QLineEdit;
+
+/**
+ * @brief Small sign-in dialog used when a cockatrice:// link needs credentials
+ * that are not saved for the target server.
+ *
+ * The entered name and password are handed to the intent chain; when the user
+ * opts to save them, they are stored in the server settings so that later links
+ * to the same server connect seamlessly.
+ */
+class DlgLoginPrompt : public QDialog
+{
+    Q_OBJECT
+
+public:
+    explicit DlgLoginPrompt(const QString &serverText, QWidget *parent = nullptr);
+
+    [[nodiscard]] QString username() const;
+    [[nodiscard]] QString password() const;
+    [[nodiscard]] bool savePassword() const;
+
+private:
+    QLineEdit *usernameEdit;
+    QLineEdit *passwordEdit;
+    QCheckBox *savePasswordCheckBox;
+};
+
+#endif // DLG_LOGIN_PROMPT_H

cockatrice/src/interface/widgets/dialogs/dlg_report_user.cpp

@@ -15,6 +15,7 @@
 #include <QVBoxLayout>
 #include <libcockatrice/protocol/pb/command_report.pb.h>
 #include <libcockatrice/protocol/pending_command.h>
+#include <libcockatrice/utility/report_categories.h>
 
 DlgReportUser::DlgReportUser(AbstractClient *_client,
                              const QString &_reportedUser,
@@ -56,22 +57,14 @@ DlgReportUser::DlgReportUser(AbstractClient *_client,
     auto *categoryGrid = new QGridLayout(categoryGroup);
 
     categoryBox = new QComboBox;
-    categoryBox->addItem(tr("Cheating / Unsporting behavior"), "cheating");
+    for (const QString &key : ReportCategories::keys()) {
-    categoryBox->setItemData(categoryBox->count() - 1,
+        const QString label = categoryLabel(key);
-                             tr("Using external tools, card marked manipulation, or exploiting game bugs"),
+        if (label.isEmpty()) {
-                             Qt::ToolTipRole);
+            continue; // skip keys without a dialog label
-    categoryBox->addItem(tr("Harassment / Abuse"), "harassment");
+        }
-    categoryBox->setItemData(categoryBox->count() - 1, tr("Threatening, bullying, or persistent unwanted contact"),
+        categoryBox->addItem(label, key);
-                             Qt::ToolTipRole);
+        categoryBox->setItemData(categoryBox->count() - 1, categoryToolTip(key), Qt::ToolTipRole);
-    categoryBox->addItem(tr("Hate speech"), "hate_speech");
+    }
-    categoryBox->setItemData(categoryBox->count() - 1,
-                             tr("Discriminatory language targeting race, gender, religion, etc."), Qt::ToolTipRole);
-    categoryBox->addItem(tr("Spam"), "spam");
-    categoryBox->setItemData(categoryBox->count() - 1, tr("Repeated unwanted messages or advertisements"),
-                             Qt::ToolTipRole);
-    categoryBox->addItem(tr("Other"), "other");
-    categoryBox->setItemData(categoryBox->count() - 1, tr("Any behavior not covered by the above categories"),
-                             Qt::ToolTipRole);
 
     categoryGrid->addWidget(new QLabel(tr("Category:")), 0, 0);
     categoryGrid->addWidget(categoryBox, 0, 1);
@@ -189,3 +182,55 @@ void DlgReportUser::reportResponse(const Response &response)
         QMessageBox::warning(this, tr("Submission Failed"), tr("Failed to submit report. Please try again."));
     }
 }
+
+QString DlgReportUser::categoryLabel(const QString &key)
+{
+    if (key == QLatin1String("cheating")) {
+        return tr("Cheating / Unsporting behavior");
+    }
+    if (key == QLatin1String("bug_abuse")) {
+        return tr("Bug Abuse");
+    }
+    if (key == QLatin1String("harassment")) {
+        return tr("Harassment / Abuse");
+    }
+    if (key == QLatin1String("verbal_abuse")) {
+        return tr("Verbal Abuse");
+    }
+    if (key == QLatin1String("hate_speech")) {
+        return tr("Hate speech");
+    }
+    if (key == QLatin1String("spam")) {
+        return tr("Spam");
+    }
+    if (key == QLatin1String("other")) {
+        return tr("Other");
+    }
+    return QString();
+}
+
+QString DlgReportUser::categoryToolTip(const QString &key)
+{
+    if (key == QLatin1String("cheating")) {
+        return tr("Using external tools, cheat programs, or exploiting game bugs");
+    }
+    if (key == QLatin1String("bug_abuse")) {
+        return tr("Exploiting a bug or glitch to gain an unfair advantage");
+    }
+    if (key == QLatin1String("harassment")) {
+        return tr("Threatening, bullying, or persistent unwanted contact");
+    }
+    if (key == QLatin1String("verbal_abuse")) {
+        return tr("Abusive or offensive language directed at another player");
+    }
+    if (key == QLatin1String("hate_speech")) {
+        return tr("Discriminatory language targeting race, gender, religion, etc.");
+    }
+    if (key == QLatin1String("spam")) {
+        return tr("Repeated unwanted messages or advertisements");
+    }
+    if (key == QLatin1String("other")) {
+        return tr("Any behavior not covered by the above categories");
+    }
+    return QString();
+}

cockatrice/src/interface/widgets/dialogs/dlg_report_user.h

@@ -26,6 +26,9 @@ private slots:
     void reportResponse(const Response &response);
 
 private:
+    static QString categoryLabel(const QString &key);
+    static QString categoryToolTip(const QString &key);
+
     AbstractClient *client;
     QString reportedUser;
     int gameId;

cockatrice/src/interface/widgets/dialogs/dlg_share_deck.cpp

@@ -0,0 +1,96 @@
+#include "dlg_share_deck.h"
+
+#include "../../../client/settings/cache_settings.h"
+#include "../cards/additional_info/deck_color_identity.h"
+#include "../deck_share/deck_share_utils.h"
+
+#include <QDialogButtonBox>
+#include <QFormLayout>
+#include <QLineEdit>
+#include <QMessageBox>
+#include <QPushButton>
+#include <QTimer>
+#include <QVBoxLayout>
+#include <libcockatrice/card/database/card_database_manager.h>
+#include <libcockatrice/deck_list/deck_list.h>
+#include <libcockatrice/network/client/abstract/abstract_client.h>
+#include <libcockatrice/protocol/pb/command_deck_share_create.pb.h>
+#include <libcockatrice/protocol/pb/response.pb.h>
+#include <libcockatrice/protocol/pb/response_deck_share_create.pb.h>
+#include <libcockatrice/protocol/pending_command.h>
+#include <libcockatrice/settings/network_settings.h>
+
+DlgShareDeck::DlgShareDeck(AbstractClient *_client, const QSharedPointer<DeckList> &_deck, QWidget *_parent)
+    : QDialog(_parent), client(_client), deck(_deck), shareTimeoutTimer(new QTimer(this))
+{
+    setWindowTitle(tr("Share deck"));
+
+    auto *layout = new QVBoxLayout(this);
+
+    nameEdit = new QLineEdit(this);
+    nameEdit->setText(tr("Shared deck"));
+
+    auto *form = new QFormLayout;
+    form->addRow(tr("Share name:"), nameEdit);
+    layout->addLayout(form);
+
+    auto *buttonBox = new QDialogButtonBox(QDialogButtonBox::Ok | QDialogButtonBox::Cancel, this);
+    buttonBox->button(QDialogButtonBox::Ok)->setText(tr("Create share link"));
+    buttonBox->button(QDialogButtonBox::Cancel)->setText(tr("Cancel"));
+    connect(buttonBox, &QDialogButtonBox::accepted, this, &DlgShareDeck::actShare);
+    connect(buttonBox, &QDialogButtonBox::rejected, this, &DlgShareDeck::reject);
+    this->buttonBox = buttonBox;
+    layout->addWidget(buttonBox);
+
+    shareTimeoutTimer->setSingleShot(true);
+    shareTimeoutTimer->setInterval(
+        static_cast<int>((static_cast<qint64>(SettingsCache::instance().network().getTimeOut()) + 1) *
+                         SettingsCache::instance().network().getKeepAlive() * 1000));
+    connect(shareTimeoutTimer, &QTimer::timeout, this, &DlgShareDeck::onShareTimeout);
+}
+
+void DlgShareDeck::actShare()
+{
+    buttonBox->button(QDialogButtonBox::Ok)->setEnabled(false);
+
+    Command_DeckShareCreate cmd;
+    cmd.set_name(nameEdit->text().trimmed().toStdString());
+    if (cmd.name().empty()) {
+        cmd.set_name(tr("Shared deck").toStdString());
+    }
+
+    DeckShareItem *item = cmd.add_items();
+    item->set_deck_list(deck->writeToString_Native().toStdString());
+    item->set_color_identity(getDeckColorIdentity(*deck, CardDatabaseManager::query()).toStdString());
+
+    PendingCommand *pend = client->prepareSessionCommand(cmd);
+    connect(pend, &PendingCommand::finished, this, &DlgShareDeck::shareFinished);
+    client->sendCommand(pend);
+    shareTimeoutTimer->start();
+}
+
+void DlgShareDeck::shareFinished(const Response &response, const CommandContainer & /*commandContainer*/)
+{
+    shareTimeoutTimer->stop();
+    if (response.response_code() != Response::RespOk) {
+        buttonBox->button(QDialogButtonBox::Ok)->setEnabled(true);
+        QMessageBox::critical(this, tr("Share deck"),
+                              tr("Failed to create the share link (server response code %1).")
+                                  .arg(QString::number(static_cast<int>(response.response_code()))));
+        return;
+    }
+
+    const DeckShareUtils::ShareResponse share = DeckShareUtils::handleShareResponse(client, response);
+
+    QMessageBox::information(this, tr("Share deck"),
+                             tr("Share link created and copied to the clipboard:\n\n%1\n\n"
+                                "The share expires on %2.")
+                                 .arg(share.link, DeckShareUtils::formatShareExpiry(share.expiry)));
+    accept();
+}
+
+void DlgShareDeck::onShareTimeout()
+{
+    buttonBox->button(QDialogButtonBox::Ok)->setEnabled(true);
+    QMessageBox::warning(this, tr("Share deck"), tr("The server did not respond in time. Try again."));
+}

cockatrice/src/interface/widgets/dialogs/dlg_share_deck.h

@@ -0,0 +1,46 @@
+/**
+ * @file dlg_share_deck.h
+ * @ingroup Dialogs
+ */
+//! \todo Document this file.
+
+#ifndef DLG_SHARE_DECK_H
+#define DLG_SHARE_DECK_H
+
+#include <QDialog>
+#include <QSharedPointer>
+
+class AbstractClient;
+class CommandContainer;
+class DeckList;
+class QDialogButtonBox;
+class QLineEdit;
+class QTimer;
+class Response;
+
+/**
+ * @brief Slim dialog to create a temporary share for the deck open in the editor.
+ *
+ * Asks for a share name, sends Command_DeckShareCreate for the single inline
+ * deck, and copies the resulting link to the clipboard.
+ */
+class DlgShareDeck : public QDialog
+{
+    Q_OBJECT
+public:
+    DlgShareDeck(AbstractClient *_client, const QSharedPointer<DeckList> &_deck, QWidget *parent = nullptr);
+
+private slots:
+    void actShare();
+    void shareFinished(const Response &response, const CommandContainer &commandContainer);
+    void onShareTimeout();
+
+private:
+    AbstractClient *client;
+    QSharedPointer<DeckList> deck;
+    QLineEdit *nameEdit;
+    QDialogButtonBox *buttonBox;
+    QTimer *shareTimeoutTimer;
+};
+
+#endif // DLG_SHARE_DECK_H

cockatrice/src/interface/widgets/dialogs/dlg_shared_decks_preview.cpp

@@ -0,0 +1,181 @@
+#include "dlg_shared_decks_preview.h"
+
+#include "../deck_share/shared_deck_preview_widget.h"
+#include "../general/layout_containers/flow_widget.h"
+
+#include <QCloseEvent>
+#include <QDateTime>
+#include <QDialogButtonBox>
+#include <QLabel>
+#include <QPushButton>
+#include <QVBoxLayout>
+#include <libcockatrice/card/database/card_database_querier.h>
+#include <libcockatrice/protocol/pb/serverinfo_deck_share_item.pb.h>
+
+DlgSharedDecksPreview::DlgSharedDecksPreview(QWidget *parent,
+                                             const CardDatabaseQuerier *querier,
+                                             const QString &shareName,
+                                             qint64 expiresAt,
+                                             const QString &serverText,
+                                             const QList<ServerInfo_DeckShareItem> &items)
+    : QDialog(parent)
+{
+    setWindowTitle(tr("Open shared decks"));
+    resize(700, 500);
+
+    auto *mainLayout = new QVBoxLayout(this);
+
+    // shareName and serverText come from the share server, so escape them: the
+    // QLabels render AutoText and markup would otherwise be shown as rich text.
+    auto *titleLabel =
+        new QLabel(tr("Share: %1").arg((shareName.isEmpty() ? tr("Untitled") : shareName).toHtmlEscaped()), this);
+    QFont titleFont = titleLabel->font();
+    titleFont.setBold(true);
+    titleFont.setPointSize(titleFont.pointSize() + 2);
+    titleLabel->setFont(titleFont);
+    mainLayout->addWidget(titleLabel);
+
+    if (!serverText.isEmpty()) {
+        mainLayout->addWidget(new QLabel(tr("From %1").arg(serverText.toHtmlEscaped()), this));
+    }
+
+    if (expiresAt > 0) {
+        const QString expiryText = QDateTime::fromSecsSinceEpoch(expiresAt).toLocalTime().toString(Qt::TextDate);
+        mainLayout->addWidget(new QLabel(tr("This share link expires on %1").arg(expiryText), this));
+    }
+
+    downloadStatusLabel = new QLabel(this);
+    downloadStatusLabel->setVisible(false);
+    mainLayout->addWidget(downloadStatusLabel);
+
+    flowWidget = new FlowWidget(this, Qt::Horizontal, Qt::ScrollBarAlwaysOff, Qt::ScrollBarAsNeeded);
+    mainLayout->addWidget(flowWidget, 1);
+
+    for (const ServerInfo_DeckShareItem &item : items) {
+        QStringList tags;
+        for (const auto &tag : item.tags()) {
+            tags.append(QString::fromStdString(tag));
+        }
+
+        auto *tile = new SharedDeckPreviewWidget(
+            this, querier, QString::fromStdString(item.name()), QString::fromStdString(item.banner_card()),
+            QString::fromStdString(item.color_identity()), QString::fromStdString(item.game_format()), tags.join(", "));
+        flowWidget->addNavigableWidget(tile);
+        tiles.append(tile);
+        itemIds.append(item.id());
+    }
+
+    if (tiles.size() == 1) {
+        tiles.first()->setSelected(true);
+    }
+
+    auto *buttonBox = new QDialogButtonBox(this);
+    openSelectedButton = buttonBox->addButton(tr("Open selected"), QDialogButtonBox::AcceptRole);
+    openAllButton = buttonBox->addButton(tr("Open all"), QDialogButtonBox::ActionRole);
+    buttonBox->addButton(tr("Cancel"), QDialogButtonBox::RejectRole);
+    mainLayout->addWidget(buttonBox);
+
+    connect(buttonBox, &QDialogButtonBox::rejected, this, [this]() {
+        onCancel();
+        close();
+    });
+
+    // Esc calls QDialog::reject() directly (which hides the dialog without a
+    // close event), so route it through the same guarded cancel as the button.
+    connect(this, &QDialog::rejected, this, [this]() {
+        onCancel();
+        close();
+    });
+
+    connect(openSelectedButton, &QPushButton::clicked, this, &DlgSharedDecksPreview::openSelected);
+    connect(buttonBox, &QDialogButtonBox::clicked, this, [this, buttonBox](QAbstractButton *button) {
+        if (buttonBox->buttonRole(button) == QDialogButtonBox::ActionRole) {
+            openAll();
+        }
+    });
+
+    for (SharedDeckPreviewWidget *tile : tiles) {
+        connect(tile, &SharedDeckPreviewWidget::selectionToggled, this,
+                &DlgSharedDecksPreview::updateOpenSelectedEnabled);
+    }
+    for (int i = 0; i < tiles.size(); ++i) {
+        const int itemId = itemIds.at(i);
+        // Double-clicking a tile selects it and opens just that deck.
+        connect(tiles.at(i), &SharedDeckPreviewWidget::activated, this, [this, itemId]() {
+            resultEmitted = true;
+            setDownloading(true);
+            emit openRequested(QList<int>{itemId});
+        });
+    }
+    updateOpenSelectedEnabled();
+}
+
+QList<int> DlgSharedDecksPreview::selectedItemIds() const
+{
+    QList<int> selectedIds;
+    for (int i = 0; i < tiles.size(); ++i) {
+        if (tiles.at(i)->isSelected()) {
+            selectedIds.append(itemIds.at(i));
+        }
+    }
+    return selectedIds;
+}
+
+void DlgSharedDecksPreview::openSelected()
+{
+    const QList<int> selectedIds = selectedItemIds();
+    if (selectedIds.isEmpty()) {
+        return;
+    }
+    resultEmitted = true;
+    setDownloading(true);
+    emit openRequested(selectedIds);
+}
+
+void DlgSharedDecksPreview::openAll()
+{
+    resultEmitted = true;
+    setDownloading(true);
+    emit openRequested(itemIds);
+}
+
+void DlgSharedDecksPreview::setDownloading(bool downloading)
+{
+    if (downloadInProgress == downloading) {
+        return;
+    }
+    downloadInProgress = downloading;
+    downloadStatusLabel->setVisible(downloading);
+    for (SharedDeckPreviewWidget *tile : tiles) {
+        tile->setEnabled(!downloading);
+    }
+    openSelectedButton->setEnabled(!downloading);
+    openAllButton->setEnabled(!downloading);
+}
+
+void DlgSharedDecksPreview::setDownloadProgress(int done, int total, const QString &currentDeckName)
+{
+    if (!downloadInProgress) {
+        return;
+    }
+    downloadStatusLabel->setText(tr("Downloading deck %1 of %2: %3").arg(done).arg(total).arg(currentDeckName));
+}
+
+void DlgSharedDecksPreview::updateOpenSelectedEnabled()
+{
+    openSelectedButton->setEnabled(!selectedItemIds().isEmpty());
+}
+
+void DlgSharedDecksPreview::onCancel()
+{
+    if (!resultEmitted || downloadInProgress) {
+        resultEmitted = true;
+        emit cancelled();
+    }
+}
+
+void DlgSharedDecksPreview::closeEvent(QCloseEvent *event)
+{
+    onCancel();
+    QDialog::closeEvent(event);
+}

cockatrice/src/interface/widgets/dialogs/dlg_shared_decks_preview.h

@@ -0,0 +1,68 @@
+#ifndef COCKATRICE_DLG_SHARED_DECKS_PREVIEW_H
+#define COCKATRICE_DLG_SHARED_DECKS_PREVIEW_H
+
+#include <QDialog>
+#include <QList>
+
+class FlowWidget;
+class QCloseEvent;
+class QLabel;
+class QPushButton;
+class ServerInfo_DeckShareItem;
+class SharedDeckPreviewWidget;
+class CardDatabaseQuerier;
+
+/**
+ * @brief Non-modal preview of the decks contained in a shared-deck link.
+ *
+ * Lets the user pick which of the shared decks to open before anything is
+ * downloaded. Emits openRequested with the ids of the chosen decks, or
+ * cancelled when the user closes the dialog without choosing. Once the user
+ * picks, the dialog switches into a "downloading" state: the tiles and open
+ * buttons are disabled, a progress label shows the current download and Cancel
+ * stays functional so the download can be aborted.
+ */
+class DlgSharedDecksPreview : public QDialog
+{
+    Q_OBJECT
+
+public:
+    explicit DlgSharedDecksPreview(QWidget *parent,
+                                   const CardDatabaseQuerier *querier,
+                                   const QString &shareName,
+                                   qint64 expiresAt,
+                                   const QString &serverText,
+                                   const QList<ServerInfo_DeckShareItem> &items);
+
+    void setDownloadProgress(int done, int total, const QString &currentDeckName);
+
+public slots:
+    void setDownloading(bool downloading);
+
+signals:
+    void openRequested(const QList<int> &itemIds);
+    void cancelled();
+
+protected:
+    void closeEvent(QCloseEvent *event) override;
+
+private slots:
+    void openSelected();
+    void openAll();
+    void updateOpenSelectedEnabled();
+    void onCancel();
+
+private:
+    QList<int> selectedItemIds() const;
+
+    FlowWidget *flowWidget;
+    QList<SharedDeckPreviewWidget *> tiles;
+    QList<int> itemIds;
+    QPushButton *openSelectedButton;
+    QPushButton *openAllButton;
+    QLabel *downloadStatusLabel;
+    bool resultEmitted = false;
+    bool downloadInProgress = false;
+};
+
+#endif // COCKATRICE_DLG_SHARED_DECKS_PREVIEW_H

cockatrice/src/interface/widgets/dialogs/dlg_update.cpp

@@ -5,15 +5,25 @@
 #include "../client/network/update/client/release_channel.h"
 #include "../interface/window_main.h"
 
+#include <QCoreApplication>
 #include <QDesktopServices>
+#include <QDir>
+#include <QFileInfo>
 #include <QLabel>
 #include <QMessageBox>
 #include <QProgressBar>
 #include <QPushButton>
+#include <QTimer>
 #include <QVBoxLayout>
 #include <QtNetwork>
 #include <version_string.h>
 
+// Executable that, when it sits next to the downloaded update installer, is installed instead of
+// it. A packager shipping a custom build - or someone testing one - can drop the file there and
+// have Cockatrice run it rather than the official installer, without the release channel having to
+// host an installer for that build. It is a drop-in and is run with the same arguments.
+static const QString UPDATE_INSTALLER_OVERRIDE = "Cockatrice-Update-Override.exe";
+
 DlgUpdate::DlgUpdate(QWidget *parent) : QDialog(parent)
 {
 
@@ -203,6 +213,24 @@ void DlgUpdate::setLabel(const QString &newText)
     statusLabel->setText(newText);
 }
 
+void DlgUpdate::warnInstallerIsWaiting()
+{
+    // Modeless on purpose: the installer asks the application to close exactly once (see
+    // CloseMatchingApps in NSIS.template.in) and only polls afterwards, while Qt drops spontaneous
+    // close events - a WM_CLOSE from the installer - for windows that are blocked by a modal
+    // widget (QGuiApplicationPrivate::processCloseEvent). An application modal message box here
+    // would therefore swallow the installer's one and only request for the rest of its wait.
+    auto *notification = new QMessageBox(QMessageBox::Warning, tr("Update"),
+                                         tr("The update installer is already running and waits about a "
+                                            "minute for Cockatrice to close. Cockatrice is still busy, so "
+                                            "save your work and close it before then. Otherwise the "
+                                            "installer gives up and the update is cancelled."),
+                                         QMessageBox::Ok, parentWidget());
+    notification->setWindowModality(Qt::NonModal);
+    notification->setAttribute(Qt::WA_DeleteOnClose);
+    notification->show();
+}
+
 void DlgUpdate::updateCheckError(const QString &errorString)
 {
     setLabel(tr("Error"));
@@ -224,6 +252,12 @@ void DlgUpdate::downloadSuccessful(const QUrl &filepath)
 
     QString installerPath = filepath.toLocalFile();
 
+    const QString overridePath = QDir(QFileInfo(installerPath).absolutePath()).filePath(UPDATE_INSTALLER_OVERRIDE);
+    if (QFileInfo::exists(overridePath)) {
+        qCInfo(DlgUpdateLog) << "Installing the update installer override instead of the download:" << overridePath;
+        installerPath = overridePath;
+    }
+
     QString appDir = QDir::toNativeSeparators(QCoreApplication::applicationDirPath());
     QProcess process;
     process.setProgram(installerPath);
@@ -231,8 +265,16 @@ void DlgUpdate::downloadSuccessful(const QUrl &filepath)
     // NSIS needs the /D= argument to be an UNQUOTED string, even if it contains spaces. Qt likes to quote arguments if
     // they contain spaces, so we use the windows exclusive QProcess::setNativeArguments in the only case where this is
     // relevant, which preserves the argument unquoted.
+    //
+    // /PID= tells the installer which process to wait for before it replaces anything. We launch the installer first
+    // and only quit afterwards, so it starts while this process is still alive and still has every Qt runtime DLL
+    // mapped, and a mapped DLL cannot be deleted. Without the handle the installer can only poll for an image name and
+    // guess, and a wrong guess is what leaves the update writing new executables next to runtime files of the previous
+    // version, which fails on the next start with "The procedure entry point ... could not be located in the dynamic
+    // link library
+    // ...Qt6QuickWidgets.dll". /D= has to stay the last parameter, which is why it is last here too.
 #ifdef Q_OS_WIN
-    process.setNativeArguments(QString("/R /D=%1").arg(appDir));
+    process.setNativeArguments(QString("/R /PID=%1 /D=%2").arg(QCoreApplication::applicationPid()).arg(appDir));
 #else
     // Linux/macOS: normal argument passing (not relevant since they update differently.)
     process.setArguments({"/R", QString("/D=%1").arg(appDir)});
@@ -240,8 +282,31 @@ void DlgUpdate::downloadSuccessful(const QUrl &filepath)
 
     // Try to open the installer. If it opens, quit Cockatrice
     if (process.startDetached()) {
-        QMetaObject::invokeMethod(static_cast<MainWindow *>(parent()), "close", Qt::QueuedConnection);
+        qCInfo(DlgUpdateLog) << "Opened update installer successfully - closing Cockatrice";
-        qCInfo(DlgUpdateLog) << "Opened downloaded update file successfully - closing Cockatrice";
+        // Close the main window synchronously so file locks are released before the NSIS installer
+        // (already launched) starts replacing files. This also flushes settings and shuts down the
+        // tabs, but only when the close is actually accepted: MainWindow may veto it for a running
+        // card DB update, an open game, or an unsaved deck, and closeForUpdate() also reports a
+        // close already in progress (reached from a nested event loop while a shutdown prompt is
+        // up). Only quit when the shutdown really ran - otherwise keep running so the user can
+        // resolve the blocker, and warn them that the installer only waits about a minute
+        // before it gives up and cancels the update.
+        if (auto *window = qobject_cast<MainWindow *>(parent())) {
+            if (window->closeForUpdate()) {
+                QTimer::singleShot(0, qApp, [] { QCoreApplication::exit(0); });
+            } else {
+                warnInstallerIsWaiting();
+            }
+        } else {
+            // Not a MainWindow, so no faithful close can be requested - but the parent still gets
+            // its close() call, which is what the code before this change did and lets it flush
+            // settings and shut down its tabs. Leaving is then unconditional: the installer is
+            // already running against a process that still holds locks on the files it replaces.
+            if (auto *widget = parentWidget()) {
+                widget->close();
+            }
+            QTimer::singleShot(0, qApp, [] { QCoreApplication::exit(0); });
+        }
         close();
     } else {
         setLabel(tr("Error"));

cockatrice/src/interface/widgets/dialogs/dlg_update.h

@@ -42,6 +42,7 @@ private:
     void addStopDownloadAndRemoveOthers(bool enable);
     void beginUpdateCheck();
     void setLabel(const QString &text);
+    void warnInstallerIsWaiting();
     QLabel *statusLabel, *descriptionLabel;
     QProgressBar *progress;
     QPushButton *manualDownload, *gotoDownload, *ok, *stopDownload;

cockatrice/src/interface/widgets/general/layout_containers/flow_widget.cpp

@@ -7,6 +7,7 @@
 #include "flow_widget.h"
 
 #include <QHBoxLayout>
+#include <QKeyEvent>
 #include <QResizeEvent>
 #include <QScrollArea>
 #include <QSizePolicy>
@@ -80,13 +81,35 @@ FlowWidget::FlowWidget(QWidget *parent,
 /**
  * @brief Adds a widget to the flow layout within the FlowWidget.
  *
+ * Plain widgets are not filtered for arrow keys: intercepting them would steal
+ * Up/Down/Left/Right from controls that use them (combo boxes, spin boxes
+ * etc.). Widgets that want keyboard navigation between flow items must be
+ * added via addNavigableWidget instead.
+ *
  * @param widget_to_add The widget to add to the flow layout.
  */
-void FlowWidget::addWidget(QWidget *widget_to_add) const
+void FlowWidget::addWidget(QWidget *widget_to_add)
 {
     flowLayout->addWidget(widget_to_add);
 }
 
+/**
+ * @brief Adds a widget and routes its arrow keys to FlowWidget focus navigation.
+ *
+ * The widget is filtered for arrow-key events so keyboard navigation between
+ * the flow items keeps working even when the flow sits inside a QScrollArea,
+ * which swallows arrow keys before they can reach FlowWidget::keyPressEvent.
+ * Only widgets added through this method are affected; anything that needs its
+ * own arrow keys should use plain addWidget.
+ *
+ * @param widget_to_add The widget to add to the flow layout.
+ */
+void FlowWidget::addNavigableWidget(QWidget *widget_to_add)
+{
+    widget_to_add->installEventFilter(this);
+    flowLayout->addWidget(widget_to_add);
+}
+
 void FlowWidget::insertWidgetAtIndex(QWidget *toInsert, int index)
 {
     flowLayout->insertWidgetAtIndex(toInsert, index);
@@ -177,6 +200,66 @@ QLayoutItem *FlowWidget::itemAt(int index) const
     return flowLayout->itemAt(index);
 }
 
+void FlowWidget::keyPressEvent(QKeyEvent *event)
+{
+    if (moveFocus(event)) {
+        event->accept();
+        return;
+    }
+    QWidget::keyPressEvent(event);
+}
+
+bool FlowWidget::eventFilter(QObject *watched, QEvent *event)
+{
+    if (event->type() == QEvent::KeyPress && moveFocus(static_cast<QKeyEvent *>(event))) {
+        return true;
+    }
+    return QWidget::eventFilter(watched, event);
+}
+
+bool FlowWidget::moveFocus(QKeyEvent *event)
+{
+    // Keyboard navigation between the flow items: arrow keys move focus just
+    // like clicking the sibling tiles would. Only items that can take keyboard
+    // focus (e.g. the deck-preview tiles in shared-deck links) are visited.
+    const bool moveForward = event->key() == Qt::Key_Right || event->key() == Qt::Key_Down;
+    const bool moveBackward = event->key() == Qt::Key_Left || event->key() == Qt::Key_Up;
+    if (!moveForward && !moveBackward) {
+        return false;
+    }
+
+    QList<QWidget *> focusableItems;
+    for (int i = 0; i < flowLayout->count(); ++i) {
+        QWidget *item = flowLayout->itemAt(i)->widget();
+        if (item != nullptr && (item->focusPolicy() & Qt::TabFocus)) {
+            focusableItems.append(item);
+        }
+    }
+
+    if (focusableItems.isEmpty()) {
+        return false;
+    }
+
+    int currentIndex = -1;
+    for (int i = 0; i < focusableItems.size(); ++i) {
+        if (focusableItems.at(i)->hasFocus()) {
+            currentIndex = i;
+            break;
+        }
+    }
+
+    const int delta = moveForward ? 1 : -1;
+    int nextIndex;
+    if (currentIndex < 0) {
+        nextIndex = moveForward ? 0 : focusableItems.size() - 1;
+    } else {
+        nextIndex = (currentIndex + delta + focusableItems.size()) % focusableItems.size();
+    }
+    focusableItems.value(nextIndex)->setFocus();
+    event->accept();
+    return true;
+}
+
 int FlowWidget::count() const
 {
     return flowLayout->count();

cockatrice/src/interface/widgets/general/layout_containers/flow_widget.h

@@ -11,6 +11,7 @@
 #include "../../../layouts/flow_layout.h"
 
 #include <QHBoxLayout>
+#include <QKeyEvent>
 #include <QLoggingCategory>
 #include <QScrollArea>
 #include <QWidget>
@@ -28,7 +29,8 @@ public:
                Qt::ScrollBarPolicy horizontalPolicy,
                Qt::ScrollBarPolicy verticalPolicy);
 
-    void addWidget(QWidget *widget_to_add) const;
+    void addWidget(QWidget *widget_to_add);
+    void addNavigableWidget(QWidget *widget_to_add);
     void insertWidgetAtIndex(QWidget *toInsert, int index);
     void removeWidget(QWidget *widgetToRemove) const;
     void clearLayout();
@@ -43,9 +45,15 @@ public slots:
     void setSpacing(int hSpacing, int vSpacing);
 
 protected:
+    bool eventFilter(QObject *watched, QEvent *event) override;
     void resizeEvent(QResizeEvent *event) override;
+    void keyPressEvent(QKeyEvent *event) override;
 
 private:
+    /// @brief Moves keyboard focus to an adjacent flow item for an arrow-key event.
+    /// @return True when the event was an arrow key and was handled.
+    bool moveFocus(QKeyEvent *event);
+
     Qt::Orientation flowDirection;
     QHBoxLayout *mainLayout;
     FlowLayout *flowLayout;

cockatrice/src/interface/widgets/menus/deck_editor_menu.cpp

@@ -28,6 +28,9 @@ DeckEditorMenu::DeckEditorMenu(AbstractTabDeckEditor *parent) : QMenu(parent), d
     aSaveDeckAs = new QAction(QString(), this);
     connect(aSaveDeckAs, &QAction::triggered, deckEditor, &AbstractTabDeckEditor::actSaveDeckAs);
 
+    aShareDeck = new QAction(QString(), this);
+    connect(aShareDeck, &QAction::triggered, deckEditor, &AbstractTabDeckEditor::actShareDeck);
+
     aLoadDeckFromClipboard = new QAction(QString(), this);
     connect(aLoadDeckFromClipboard, &QAction::triggered, deckEditor, &AbstractTabDeckEditor::actLoadDeckFromClipboard);
 
@@ -96,6 +99,7 @@ DeckEditorMenu::DeckEditorMenu(AbstractTabDeckEditor *parent) : QMenu(parent), d
     addMenu(loadRecentDeckMenu);
     addAction(aSaveDeck);
     addAction(aSaveDeckAs);
+    addAction(aShareDeck);
     addSeparator();
     addAction(aLoadDeckFromClipboard);
     addMenu(editDeckInClipboardMenu);
@@ -120,6 +124,7 @@ void DeckEditorMenu::setSaveStatus(bool newStatus)
 {
     aSaveDeck->setEnabled(newStatus);
     aSaveDeckAs->setEnabled(newStatus);
+    aShareDeck->setEnabled(newStatus);
     aSaveDeckToClipboard->setEnabled(newStatus);
     aSaveDeckToClipboardNoSetInfo->setEnabled(newStatus);
     aSaveDeckToClipboardRaw->setEnabled(newStatus);
@@ -157,6 +162,7 @@ void DeckEditorMenu::retranslateUi()
     aClearRecents->setText(tr("Clear"));
     aSaveDeck->setText(tr("&Save deck"));
     aSaveDeckAs->setText(tr("Save deck &as..."));
+    aShareDeck->setText(tr("Share deck..."));
 
     aLoadDeckFromClipboard->setText(tr("Load deck from cl&ipboard..."));
 

cockatrice/src/interface/widgets/menus/deck_editor_menu.h

@@ -21,7 +21,8 @@ public:
     QAction *aNewDeck, *aLoadDeck, *aClearRecents, *aSaveDeck, *aSaveDeckAs, *aLoadDeckFromClipboard,
         *aEditDeckInClipboard, *aEditDeckInClipboardRaw, *aSaveDeckToClipboard, *aSaveDeckToClipboardNoSetInfo,
         *aSaveDeckToClipboardRaw, *aSaveDeckToClipboardRawNoSetInfo, *aPrintDeck, *aLoadDeckFromWebsite,
-        *aExportDeckDecklist, *aExportDeckDecklistXyz, *aAnalyzeDeckDeckstats, *aAnalyzeDeckTappedout, *aClose;
+        *aExportDeckDecklist, *aExportDeckDecklistXyz, *aAnalyzeDeckDeckstats, *aAnalyzeDeckTappedout, *aShareDeck,
+        *aClose;
     QMenu *loadRecentDeckMenu, *analyzeDeckMenu, *editDeckInClipboardMenu, *saveDeckToClipboardMenu;
 
     void setSaveStatus(bool newStatus);

cockatrice/src/interface/widgets/printing_selector/printing_selector.cpp

@@ -58,6 +58,7 @@ PrintingSelector::PrintingSelector(QWidget *parent, AbstractTabDeckEditor *_deck
                                         SettingsCache::instance().cardsDisplay().getPrintingSelectorCardSize());
     connect(cardSizeWidget, &CardSizeWidget::cardSizeSettingUpdated, &SettingsCache::instance().cardsDisplay(),
             &CardsDisplaySettings::setPrintingSelectorCardSize);
+    cardSizeWidget->enableCtrlScrollResize(flowWidget);
 
     displayOptionsWidget->addSettingsWidget(sortToolBar);
     displayOptionsWidget->addSettingsWidget(navigationCheckBox);

cockatrice/src/interface/widgets/server/chat_view/chat_view.cpp

@@ -2,6 +2,7 @@
 
 #include "../../../../client/settings/cache_settings.h"
 #include "../../client/sound_engine.h"
+#include "../../interface/card_localization.h"
 #include "../../interface/pixel_map_generator.h"
 #include "../../interface/widgets/tabs/tab_account.h"
 #include "../user/user_context_menu.h"
@@ -167,7 +168,7 @@ void ChatView::appendHtmlServerMessage(const QString &html, bool optionalIsBold,
 
     QString htmlText =
         "<font color=" + ((optionalFontColor.size() > 0) ? optionalFontColor : serverMessageColor.name()) + ">" +
-        QDateTime::currentDateTime().toString("[hh:mm:ss] ") + html + "</font>";
+        getCurrentTime() + html + "</font>";
 
     if (optionalIsBold) {
         htmlText = "<b>" + htmlText + "</b>";
@@ -179,13 +180,19 @@ void ChatView::appendHtmlServerMessage(const QString &html, bool optionalIsBold,
     }
 }
 
+QString ChatView::getCurrentTime() const
+{
+    return QDateTime::currentDateTime().toString("[hh:mm:ss] ");
+}
+
 void ChatView::appendCardTag(QTextCursor &cursor, const QString &cardName)
 {
     QTextCharFormat oldFormat = cursor.charFormat();
     QTextCharFormat cardFormat = oldFormat;
     cardFormat.setFontItalic(true);
 
-    if (!CardDatabaseManager::query()->lookupCardByName(cardName)) {
+    const CardInfoPtr card = CardDatabaseManager::query()->lookupCardByName(cardName);
+    if (card.isNull()) {
         cardFormat.setForeground(unresolvedCardTagColor);
         cursor.setCharFormat(cardFormat);
         cursor.insertText(cardName);
@@ -195,10 +202,12 @@ void ChatView::appendCardTag(QTextCursor &cursor, const QString &cardName)
 
     cardFormat.setForeground(linkColor);
     cardFormat.setAnchor(true);
+    // The href keeps the canonical name so the card popup can resolve it, while the text shows the name
+    // in the configured card language.
     cardFormat.setAnchorHref("card://" + cardName);
 
     cursor.setCharFormat(cardFormat);
-    cursor.insertText(cardName);
+    cursor.insertText(CardLocalization::displayName(card));
     cursor.setCharFormat(oldFormat);
 }
 
@@ -290,7 +299,7 @@ void ChatView::appendMessage(QString message,
         timeFormat.setForeground(serverMessageColor);
         timeFormat.setFontWeight(QFont::Bold);
         cursor.setCharFormat(timeFormat);
-        cursor.insertText(QDateTime::currentDateTime().toString("[hh:mm:ss] "));
+        cursor.insertText(getCurrentTime());
     }
 
     // nickname
@@ -340,16 +349,27 @@ void ChatView::appendMessage(QString message,
                 pos.relativePosition = match.captured(0).length(); // set message start
                 auto before = match.captured(1);
                 auto sentBy = match.captured(2);
+
+                // The user level is not carried in the room chat history, so history
+                // entries used to render as fixed-level user tags. Resolve online users
+                // against the user list to turn their history entries into full user
+                // tags (correct level, name casing and moderation context menu).
+                QString displayName = sentBy;
+                // Offline users have no known level; render them as zero-level tags.
+                QString levelMarker = "0";
+                if (const ServerInfo_User *onlineUser = userListProxy->getOnlineUser(sentBy)) {
+                    displayName = QString::fromStdString(onlineUser->name());
+                    levelMarker = QString::number(onlineUser->user_level());
+                }
+
                 cursor.insertText(before); // add message timestamp
                 QTextCharFormat senderFormat(defaultFormat);
                 senderFormat.setAnchor(true);
-                // this underscore is important, it is used to add the user level, but in this case the level is
+                senderFormat.setAnchorHref("user://" + levelMarker + "_" + displayName);
-                // unknown, if the name contains an underscore it would split up the name
-                senderFormat.setAnchorHref("user://_" + sentBy);
                 cursor.setCharFormat(senderFormat);
-                cursor.insertText(sentBy);                   // add username with href so it shows the menu
+                cursor.insertText(displayName);                // add username with href so it shows the menu
-                userMessagePositions[sentBy].append(pos);    // save message position
+                userMessagePositions[displayName].append(pos); // save message position
-                message.remove(0, pos.relativePosition - 2); // do not remove semicolon
+                message.remove(0, pos.relativePosition - 2);   // do not remove semicolon
             }
         } else {
             //! \todo Remove hardcoded color.

cockatrice/src/interface/widgets/server/chat_view/chat_view.h

@@ -107,9 +107,8 @@ public:
     ChatView(TabSupervisor *_tabSupervisor, AbstractGame *_game, bool _showTimestamps, QWidget *parent = nullptr);
     void retranslateUi();
     void appendHtml(const QString &html);
-    void virtual appendHtmlServerMessage(const QString &html,
+    virtual void
-                                         bool optionalIsBold = false,
+    appendHtmlServerMessage(const QString &html, bool optionalIsBold = false, QString optionalFontColor = QString());
-                                         QString optionalFontColor = QString());
     void appendMessage(QString message,
                        RoomMessageTypeFlags messageType = {},
                        const ServerInfo_User &userInfo = {},
@@ -119,6 +118,7 @@ public:
     QString getRecentChatLog(int maxMessages = 50) const;
 
 protected:
+    [[nodiscard]] virtual QString getCurrentTime() const;
     void enterEvent(QEnterEvent *event) override;
     void leaveEvent(QEvent *event) override;
     void mouseMoveEvent(QMouseEvent *event) override;

cockatrice/src/interface/widgets/server/remote/remote_decklist_tree_widget.cpp

@@ -113,7 +113,7 @@ int RemoteDeckList_TreeModel::rowCount(const QModelIndex &parent) const
 
 int RemoteDeckList_TreeModel::columnCount(const QModelIndex & /*parent*/) const
 {
-    return 3;
+    return 4;
 }
 
 QVariant RemoteDeckList_TreeModel::data(const QModelIndex &index, int role) const
@@ -121,7 +121,7 @@ QVariant RemoteDeckList_TreeModel::data(const QModelIndex &index, int role) cons
     if (!index.isValid()) {
         return QVariant();
     }
-    if (index.column() >= 3) {
+    if (index.column() >= 4) {
         return QVariant();
     }
 
@@ -134,12 +134,29 @@ QVariant RemoteDeckList_TreeModel::data(const QModelIndex &index, int role) cons
                 switch (index.column()) {
                     case 0:
                         return node->getName();
+                    case 3:
+                        // Report the node's own bit, not the inherited effective
+                        // state, so it stays in step with what publishing toggles.
+                        if (node->isPublic()) {
+                            return tr("Public");
+                        }
+                        return isEffectivelyPublic(node) ? tr("Public (inherited)") : tr("Private");
                     default:
                         return QVariant();
                 }
             }
             case Qt::DecorationRole:
                 return index.column() == 0 ? dirIcon : QVariant();
+            case Qt::ToolTipRole:
+                if (index.column() == 3) {
+                    if (node->isPublic()) {
+                        return tr("This folder is visible to other users");
+                    }
+                    return isEffectivelyPublic(node)
+                               ? tr("This folder is private, but a parent folder is public (inherited).")
+                               : tr("This folder is only visible to you");
+                }
+                return QVariant();
             default:
                 return QVariant();
         }
@@ -153,6 +170,13 @@ QVariant RemoteDeckList_TreeModel::data(const QModelIndex &index, int role) cons
                         return file->getId();
                     case 2:
                         return file->getUploadTime();
+                    case 3:
+                        // Report the node's own bit, not the inherited effective
+                        // state, so it stays in step with what publishing toggles.
+                        if (file->isPublic()) {
+                            return tr("Public");
+                        }
+                        return isEffectivelyPublic(file) ? tr("Public (inherited)") : tr("Private");
                     default:
                         return QVariant();
                 }
@@ -161,6 +185,16 @@ QVariant RemoteDeckList_TreeModel::data(const QModelIndex &index, int role) cons
                 return index.column() == 0 ? fileIcon : QVariant();
             case Qt::TextAlignmentRole:
                 return index.column() == 1 ? Qt::AlignRight : Qt::AlignLeft;
+            case Qt::ToolTipRole:
+                if (index.column() == 3) {
+                    if (file->isPublic()) {
+                        return tr("This deck is visible to other users");
+                    }
+                    return isEffectivelyPublic(file)
+                               ? tr("This deck is private, but a parent folder is public (inherited).")
+                               : tr("This deck is only visible to you");
+                }
+                return QVariant();
             default:
                 return QVariant();
         }
@@ -183,6 +217,8 @@ QVariant RemoteDeckList_TreeModel::headerData(int section, Qt::Orientation orien
                     return tr("ID");
                 case 2:
                     return tr("Upload time");
+                case 3:
+                    return tr("Visibility");
                 default:
                     return QVariant();
             }
@@ -239,13 +275,14 @@ void RemoteDeckList_TreeModel::addFileToTree(const ServerInfo_DeckStorage_TreeIt
     time.setSecsSinceEpoch(fileInfo.creation_time());
 
     beginInsertRows(nodeToIndex(parent), parent->size(), parent->size());
-    parent->append(new FileNode(QString::fromStdString(file.name()), file.id(), time, parent));
+    parent->append(new FileNode(QString::fromStdString(file.name()), file.id(), time, parent, fileInfo.is_public()));
     endInsertRows();
 }
 
 void RemoteDeckList_TreeModel::addFolderToTree(const ServerInfo_DeckStorage_TreeItem &folder, DirectoryNode *parent)
 {
     DirectoryNode *newItem = addNamedFolderToTree(QString::fromStdString(folder.name()), parent);
+    newItem->setIsPublic(folder.folder().is_public());
     const ServerInfo_DeckStorage_Folder &folderInfo = folder.folder();
     const int folderItemsSize = folderInfo.items_size();
     for (int i = 0; i < folderItemsSize; ++i) {
@@ -285,6 +322,21 @@ void RemoteDeckList_TreeModel::refreshTree()
     client->sendCommand(pend);
 }
 
+bool RemoteDeckList_TreeModel::isEffectivelyPublic(const Node *node) const
+{
+    if (node == nullptr || node == root) {
+        return false;
+    }
+    const Node *current = node;
+    while (current != nullptr) {
+        if (current->isPublic()) {
+            return true;
+        }
+        current = current->getParent();
+    }
+    return false;
+}
+
 void RemoteDeckList_TreeModel::clearTree()
 {
     beginResetModel();