# Ragnarok deployment on memento

Single source: the git checkout `C:\Users\Memento\Desktop\clank-together` (this
repository). Compose file: `deploy/rodecomp/compose.yaml`. All services and compiler
execution run in Linux Docker containers. Persistent repository, SQLite, targets and
downloads live in the external Docker volume `rodecomp_data` (create it before Compose).

The pinned candidate toolchain is MSVC **19.29.30159**, v142, x86 target, Windows
SDK **10.0.19041.0**, under Wine. This is consistent with Ragexe's linker 14.29
and `Release V142 C++20` PDB path; the original exact compiler build is unknown.
`toolchain/msvc-v142/Dockerfile` downloads Microsoft packages with SHA-256 checks
inside its build stage. Check applicable Microsoft redistribution rights before
exposing compiler downloads publicly.

The optional `runners.ragnarok.jobVolume` and `jobVolumeRoot` settings mount only
the job subdirectory into sibling compiler containers using Docker's
`volume-subpath` support. This avoids Docker Desktop host-path translation.
Only the worker receives the Docker socket; this still grants it control over
the Docker daemon. Compiler containers retain upstream network, capability,
read-only-root and resource restrictions.

`tools/rodecomp/configure.sh` runs CMake in `rodecomp/configure:v142` to export
real per-unit flags through `export-compile.py`. Runtime checks use upstream's
direct compiler adapter, not CMake/CTest. Upstream matching and peer-review
policy is unchanged. `tools/build-td/build.mjs` can now package both Windows and
Linux clients from the Linux build container.

The Docker Caddy proxy binds **127.0.0.1:19580** on memento. Cloudflare Tunnel
publishes `https://clank.rodecomp.online`; the native connector targets that
localhost port. Caddy strips `/git/` and forwards it to Forgejo; other paths go
to Clank. Generated installers use the configured public HTTPS hostname.
Do not publish the Desktop directory or Docker socket.

From memento's Debian WSL, after `git pull --ff-only` in that checkout, build and start with:
`docker compose -f /mnt/c/Users/Memento/Desktop/clank-together/deploy/rodecomp/compose.yaml up -d --build`.
Publish new td binaries with `deploy/rodecomp/Dockerfile.client` (output copied to
`rodecomp_data/downloads`); the installers pick up their SHA-256 on the next request.
Back up the volume with the services stopped, including SQLite and repository;
copying only the Desktop deployment files does not back up runtime state.

Forgejo **15.0.10** (the version pinned by upstream's deployment script) serves
`https://clank.rodecomp.online/git/clank/rodecomp`. Registration, SSH, Actions,
packages and pull requests are disabled. The coordinator's `clank-bot` account
is the only whitelisted pusher to protected `main`; `pushRemote=forgejo` publishes
accepted merges. Forgejo accounts are separate from Clank accounts. Its random
`clank-admin` credential is stored privately in `rodecomp_data/forgejo-admin.json`;
the coordinator bot token stays in the canonical repository's `.git/config`.
Back up **both** `rodecomp_data` and `rodecomp_forgejo`. Provisioning is implemented
in `tools/rodecomp/provision-forgejo.mjs`, without changes to Clank source code.
Verified public repository browsing, HTTPS clone and coordinator initial push.

The published project was reset to one root commit, `d456e8f64aa1b73279471149d8cd4d05c98eb541`,
preserving the current tree. Existing contributor clones must be recreated.
Compose sets `TD_GIT_AUTHOR_NAME` and `TD_GIT_AUTHOR_EMAIL` to `ragnarok-clanker`;
the coordinator's optional identity override sets both author and committer for
future commits. Without those variables, upstream identity behavior is unchanged.
The private `rodecomp_history_backup` volume retains pre-rewrite recovery data;
it is not published. Public old Git objects were pruned. Clank progress was preserved.
The maintenance helper accepts the private identity at runtime:
`python tools/rodecomp/rewrite-identity.py <identity> --repo <disposable-clone>`.
It requires git-filter-repo and rewrites history; use a backed-up disposable clone,
keep private arguments out of published logs, and check out the renamed branch afterward.

Installer presentation (`src/server/install.js` only): four numbered steps, a compact
ASCII banner, color/status icons, explicit incomplete-installation reporting, and
an MCP handoff. Detailed td output is retained in a temporary installation log with
the supplied token redacted. `NO_COLOR` and redirected output disable colors.
The displayed AI start prompt matches the guide exactly. The td client binaries,
CLI help, and MCP protocol are unchanged by this presentation update.

Live feed navigation fix: reset its event cursor when replacing the initial feed
snapshot on returning Home. The list fills its parent panel with internal scrolling;
stacked mobile layout retains a viewport-height limit. Versioned frontend asset URLs
avoid stale Cloudflare/browser scripts. Verified Home → Guide → Home retains events
and desktop Live/Progress panel heights match.

Verified deployment: administrator browser login; generated guide and installers;
fresh Linux installer clone/target hash/compiler download/MCP setup followed by
`td check Source/Utility/XorBytes.cpp`; sandboxed server checks of XorBytes,
GPak and BrowserClientSite; Windows standalone client's `--help` and PowerShell
installer parsing. Windows full onboarding and all-source builds are not yet
verified. The imported original-code cache contains 4,480 functions, not all
45,446 function symbols; uncached pseudocode still needs an analysis provider.

Progress migration: upstream `td-server rebuild` measured the existing source.
Historical confirmations are imported with `tools/rodecomp/import-confirmations.mjs`
only when the entire source file matches its historical confirmed commit and the
current rebuild emitted the function. The evidence export is retained under
`deploy/rodecomp/import/confirmed.json`; migration records an audit event and does
not manufacture reviews or recent merge credit. Initial refresh counted 189 exact
and 453 additional peer-confirmed functions (642/43,147, 1.49%); 13 historical
confirmations were deferred because current output was missing.
The full rebuild exposed five failing units: FontCache (SDK min/max),
RenderToTextureDX7 (missing wrl/client.h), TextureDX7 (v142 compiler internal error),
and two Verification units absent from upstream's copied source directories.
These are not counted as successful builds and were not changed by the progress migration.