Resolve Sony's hosts past blocked DNS; version 0.3.0

The resolver asked one server over UDP and took the first answer, even a blocker's 0.0.0.0. It now tries UDP on four public resolvers, then TCP, then DNS over HTTPS (Cloudflare, Google), then the addresses the last good lookup saved. Sinkhole answers count as blocked, curl gets every address of a host, and a host whose addresses refuse or drop the connection is looked up again. Sony hosts stay pinned to Sony's root; only the DoH requests use public roots. The network check reports where each answer came from and what failed before it.
Redesign game cards and the Other versions dialog
2026-10-17 19:00:54 +02:00 · 2026-10-17 15:19:00 +02:00 · 2026-10-17 15:19:00 +02:00 · 2026-10-17 11:52:00 +02:00 · 2026-10-17 11:51:02 +02:00 · 2026-10-17 11:44:40 +02:00
17 changed files with 5646 additions and 655 deletions
@@ -20,6 +20,7 @@ SRCS := src/main.c \
        src/patchdl_scan.c \
        src/patchdl_appdb.c \
        src/patchdl_net.c \
+        src/patchdl_dns.c \
        src/patchdl_prospero.c \
        src/patchdl_resolve.c \
        src/patchdl_verxml.c \
@@ -31,7 +32,7 @@ SRCS := src/main.c \
 # assets must trigger a rebuild.
 TILE_ASSETS := assets/param.json assets/icon0.png

-WEB_ASSETS := web/index.html web/styles.css web/app.js
+WEB_ASSETS := web/index.html web/styles.css web/i18n.js web/app.js
 GEN_SRCS := $(patsubst web/%,gen/web/%.c,$(WEB_ASSETS))

 SQLITE_DIR := vendor/sqlite
@@ -90,7 +90,7 @@ No. It fetches updates for games that are already installed on your console. Not
 PS5 and PS4 games you installed from disc or from the PlayStation Store. PatchDL reads each game's package before it offers anything, and it leaves every other title alone.

 **Where do the updates come from?**
-From Sony's official update servers, the same files your console downloads on its own. PatchDL downloads only from a short list of PlayStation CDN hosts. To find older patches it also asks [Prospero Patches](https://prosperopatches.com/) which versions exist for a game. That lookup sends the game's title ID and nothing else.
+From Sony's official update servers, the same files your console downloads on its own. PatchDL downloads only from a short list of PlayStation CDN hosts. It finds them through public DNS (Cloudflare and Google, encrypted if your network blocks plain DNS) and never touches the console's own DNS settings, so a DNS block that keeps the system from updating stays in place. To find older patches it also asks [Prospero Patches](https://prosperopatches.com/) which versions exist for a game. That lookup sends the game's title ID and nothing else.

 **Can I get an older patch that runs on my firmware?**
 Yes. Sony still hosts older patches, but its servers only tell your console about the newest one. When that one needs a newer firmware, PatchDL looks up the version history on [Prospero Patches](https://prosperopatches.com/) and lists the game under *Updates* with an **Old FW patch** button. Tap it and scan the QR code with your phone. Open the game on Prospero, pick the version PatchDL names (confirm the human check if one shows up) and copy the **SC** link. Paste it on your phone, and the PS5 downloads the patch from Sony and handles it like any other update.
@@ -0,0 +1,630 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later
+ * Copyright (C) 2026 Knutwurst
+ *
+ * PatchDL is free software: you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option)
+ * any later version. See the LICENSE file in the project root for details.
+ */
+
+#include "patchdl_dns.h"
+
+#include <arpa/inet.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <netinet/in.h>
+#include <poll.h>
+#include <pthread.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/time.h>
+#include <time.h>
+#include <unistd.h>
+
+#ifdef PATCHDL_HAVE_CURL
+#include <curl/curl.h>
+#include "patchdl_doh_ca.h"
+#endif
+
+#ifndef PATCHDL_DNS_SAVE_FILE
+#define PATCHDL_DNS_SAVE_FILE "/data/patchdl/dns_cache.txt"
+#endif
+
+/* Worst case with everything blocked: 4 x 1.2 s UDP, 2 x 2 s TCP, 3 x 4 s
+   DoH; about 21 s, once per host, then the failure is cached. */
+#define UDP_TIMEOUT_MS   1200
+#define TCP_TIMEOUT_MS   2000
+#define DOH_TIMEOUT_S    4L
+#define POSITIVE_TTL_S   600     /* CDN edges rotate; ask again after 10 min */
+#define NEGATIVE_TTL_S   20      /* don't run the whole chain for every piece */
+#define CACHE_SLOTS      32
+#define MAX_SAVED        32
+
+static const char *PLAIN_SERVERS[] = { "1.1.1.1", "8.8.8.8", "9.9.9.9", "1.0.0.1", NULL };
+static const char *TCP_SERVERS[]   = { "1.1.1.1", "8.8.8.8", NULL };
+
+/* DoH endpoints by name, pinned to an address so no DNS is needed to reach
+   them. The certificate is checked against the name. Only servers that
+   answer over HTTP/1.1: the SDK's libcurl has no HTTP/2 (Quad9 needs it). */
+#ifdef PATCHDL_HAVE_CURL
+static const struct { const char *name, *ip; } DOH_SERVERS[] = {
+    { "cloudflare-dns.com", "1.1.1.1" },
+    { "dns.google",         "8.8.8.8" },
+    { "cloudflare-dns.com", "1.0.0.1" },
+    { NULL, NULL },
+};
+#endif
+
+/* ---------- wire format ------------------------------------------------- */
+
+enum {
+    ANS_OK = 0,
+    ANS_MALFORMED = -1,
+    ANS_NXDOMAIN = -2,
+    ANS_RCODE = -6,      /* REFUSED, SERVFAIL ... */
+    ANS_NO_A = -3,
+    ANS_SINKHOLE = -4,   /* only private/loopback/zero addresses */
+    ANS_TRUNCATED = -5,
+};
+
+static long long
+now_ms(void) {
+    struct timespec ts;
+    clock_gettime(CLOCK_MONOTONIC, &ts);
+    return (long long)ts.tv_sec * 1000 + ts.tv_nsec / 1000000;
+}
+
+static uint16_t
+next_query_id(void) {
+    static unsigned counter;
+    struct timeval  tv;
+    gettimeofday(&tv, NULL);
+    return (uint16_t)((unsigned)tv.tv_usec * 2654435761u +
+                      __atomic_fetch_add(&counter, 1, __ATOMIC_RELAXED) * 40503u +
+                      (unsigned)getpid());
+}
+
+/* Query for host's A record. Returns the length, or -1. */
+static int
+build_query(const char *host, uint16_t id, uint8_t *buf, size_t sz) {
+    size_t      pos = 12;
+    const char *p = host;
+
+    if (sz < 12 + 2 + 4) return -1;
+    memset(buf, 0, 12);
+    buf[0] = (uint8_t)(id >> 8); buf[1] = (uint8_t)id;
+    buf[2] = 0x01;                 /* RD */
+    buf[5] = 0x01;                 /* QDCOUNT = 1 */
+    while (*p) {
+        const char *dot = strchr(p, '.');
+        size_t      len = dot ? (size_t)(dot - p) : strlen(p);
+        if (!len || len > 63 || pos + 1 + len + 1 + 4 > sz) return -1;
+        buf[pos++] = (uint8_t)len;
+        memcpy(buf + pos, p, len);
+        pos += len;
+        p += len;
+        if (*p == '.') p++;
+    }
+    buf[pos++] = 0;
+    buf[pos++] = 0; buf[pos++] = 1;   /* QTYPE A */
+    buf[pos++] = 0; buf[pos++] = 1;   /* QCLASS IN */
+    return (int)pos;
+}
+
+/* Past a (possibly compressed) name; 0 on success. */
+static int
+skip_name(const uint8_t *r, size_t n, size_t *pos) {
+    while (*pos < n) {
+        uint8_t len = r[*pos];
+        if (!len) { (*pos)++; return 0; }
+        if ((len & 0xC0) == 0xC0) { *pos += 2; return *pos <= n ? 0 : -1; }
+        if (len & 0xC0) return -1;
+        *pos += 1 + (size_t)len;
+    }
+    return -1;
+}
+
+/* Addresses a filtering resolver answers with instead of the real one. */
+static int
+is_sinkhole(const uint8_t a[4]) {
+    return a[0] == 0 || a[0] == 127 || a[0] == 10 || a[0] >= 224 ||
+           (a[0] == 172 && (a[1] & 0xF0) == 16) ||
+           (a[0] == 192 && a[1] == 168) ||
+           (a[0] == 169 && a[1] == 254) ||
+           (a[0] == 100 && (a[1] & 0xC0) == 64);
+}
+
+static int
+parse_answer(const uint8_t *r, size_t n, uint16_t id, patchdl_dns_answer_t *out,
+             char *sinkhole_ip, size_t sinkhole_sz) {
+    size_t   pos = 12;
+    uint16_t qd, an;
+
+    out->n = 0;
+    if (n < 12) return ANS_MALFORMED;
+    if (((r[0] << 8) | r[1]) != id || !(r[2] & 0x80)) return ANS_MALFORMED;
+    if (r[2] & 0x02) return ANS_TRUNCATED;
+    if ((r[3] & 0x0F) == 3) return ANS_NXDOMAIN;
+    if (r[3] & 0x0F) return ANS_RCODE;
+    qd = (uint16_t)((r[4] << 8) | r[5]);
+    an = (uint16_t)((r[6] << 8) | r[7]);
+    for (int q = 0; q < qd; q++) {
+        if (skip_name(r, n, &pos) || pos + 4 > n) return ANS_MALFORMED;
+        pos += 4;
+    }
+    for (int a = 0; a < an; a++) {
+        uint16_t type, rdlen;
+        if (skip_name(r, n, &pos) || pos + 10 > n) return ANS_MALFORMED;
+        type  = (uint16_t)((r[pos] << 8) | r[pos + 1]);
+        rdlen = (uint16_t)((r[pos + 8] << 8) | r[pos + 9]);
+        pos += 10;
+        if (pos + rdlen > n) return ANS_MALFORMED;
+        if (type == 1 && rdlen == 4) {
+            if (is_sinkhole(r + pos)) {
+                if (sinkhole_ip && !sinkhole_ip[0])
+                    snprintf(sinkhole_ip, sinkhole_sz, "%u.%u.%u.%u",
+                             r[pos], r[pos + 1], r[pos + 2], r[pos + 3]);
+            } else if (out->n < PATCHDL_DNS_MAX_IPS) {
+                snprintf(out->ip[out->n++], sizeof out->ip[0], "%u.%u.%u.%u",
+                         r[pos], r[pos + 1], r[pos + 2], r[pos + 3]);
+            }
+        }
+        pos += rdlen;   /* CNAMEs and the like */
+    }
+    if (out->n) return ANS_OK;
+    return sinkhole_ip && sinkhole_ip[0] ? ANS_SINKHOLE : ANS_NO_A;
+}
+
+static const char *
+answer_text(int rc) {
+    switch (rc) {
+    case ANS_NXDOMAIN:  return "no such name";
+    case ANS_RCODE:     return "refused";
+    case ANS_NO_A:      return "no address";
+    case ANS_TRUNCATED: return "truncated";
+    default:            return "bad reply";
+    }
+}
+
+/* ---------- transports -------------------------------------------------- */
+
+static void
+trail_add(char *trail, size_t sz, const char *fmt, const char *a, const char *b) {
+    size_t len = strlen(trail);
+    if (len + 3 >= sz) return;
+    if (len) { memcpy(trail + len, "; ", 3); len += 2; }
+    snprintf(trail + len, sz - len, fmt, a, b);
+}
+
+/* Shared tail of every transport: parse, log the outcome, 0 on a usable
+   answer. */
+static int
+finish(const uint8_t *resp, size_t n, uint16_t id, patchdl_dns_answer_t *out,
+       const char *label, char *trail, size_t trail_sz, int *truncated) {
+    char sink[16] = "";
+    int  rc = parse_answer(resp, n, id, out, sink, sizeof sink);
+    if (truncated) *truncated = (rc == ANS_TRUNCATED);
+    if (rc == ANS_OK) return 0;
+    if (rc == ANS_SINKHOLE) trail_add(trail, trail_sz, "%s: blocked (%s)", label, sink);
+    else trail_add(trail, trail_sz, "%s: %s", label, answer_text(rc));
+    return -1;
+}
+
+static int
+query_udp(const char *server, const char *host, patchdl_dns_answer_t *out,
+          char *trail, size_t trail_sz, int *truncated) {
+    uint8_t            q[300], resp[1500];
+    struct sockaddr_in sa;
+    uint16_t           id = next_query_id();
+    char               label[32];
+    int                qlen, fd;
+    ssize_t            n = -1;
+
+    snprintf(label, sizeof label, "udp %s", server);
+    if ((qlen = build_query(host, id, q, sizeof q)) < 0) return -1;
+    if ((fd = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
+        trail_add(trail, trail_sz, "%s: socket %s", label, strerror(errno));
+        return -1;
+    }
+    memset(&sa, 0, sizeof sa);
+    sa.sin_family = AF_INET;
+    sa.sin_port = htons(53);
+    sa.sin_addr.s_addr = inet_addr(server);
+    /* Connected socket: replies from anyone but this server are dropped. */
+    if (connect(fd, (struct sockaddr *)&sa, sizeof sa) || send(fd, q, (size_t)qlen, 0) != qlen) {
+        trail_add(trail, trail_sz, "%s: %s", label, strerror(errno));
+        close(fd);
+        return -1;
+    }
+    /* Skip stray datagrams (an older query's late answer) until ours or
+       the deadline. */
+    errno = EAGAIN;
+    for (long long deadline = now_ms() + UDP_TIMEOUT_MS, left;
+         (left = deadline - now_ms()) > 0;) {
+        struct pollfd pfd = { fd, POLLIN, 0 };
+        if (poll(&pfd, 1, (int)left) != 1) { errno = EAGAIN; break; }
+        n = recv(fd, resp, sizeof resp, 0);
+        if (n < 0) break;
+        if (n >= 2 && ((resp[0] << 8) | resp[1]) == id) {
+            close(fd);
+            if (!finish(resp, (size_t)n, id, out, label, trail, trail_sz, truncated)) {
+                snprintf(out->source, sizeof out->source, "%s", label);
+                return 0;
+            }
+            return -1;
+        }
+    }
+    trail_add(trail, trail_sz, "%s: %s", label, errno == EAGAIN || errno == EWOULDBLOCK
+              ? "no answer" : strerror(errno));
+    close(fd);
+    return -1;
+}
+
+/* Send or receive exactly len bytes on a non-blocking socket before the
+   deadline. A server trickling bytes can't stretch the exchange. */
+static int
+io_until(int fd, uint8_t *buf, size_t len, int sending, long long deadline) {
+    size_t done = 0;
+    while (done < len) {
+        struct pollfd pfd = { fd, (short)(sending ? POLLOUT : POLLIN), 0 };
+        long long     left = deadline - now_ms();
+        ssize_t       k;
+        if (left <= 0 || poll(&pfd, 1, (int)left) != 1) return -1;
+        k = sending ? send(fd, buf + done, len - done, 0)
+                    : recv(fd, buf + done, len - done, 0);
+        if (k < 0 && (errno == EAGAIN || errno == EWOULDBLOCK || errno == EINTR)) continue;
+        if (k <= 0) return -1;
+        done += (size_t)k;
+    }
+    return 0;
+}
+
+/* One DNS exchange over TCP, connect included, within TCP_TIMEOUT_MS. */
+static int
+query_tcp(const char *server, const char *host, patchdl_dns_answer_t *out,
+          char *trail, size_t trail_sz) {
+    uint8_t            q[302], resp[4096], lenb[2];
+    struct sockaddr_in sa;
+    long long          deadline = now_ms() + TCP_TIMEOUT_MS;
+    uint16_t           id = next_query_id();
+    char               label[32];
+    int                qlen, fd, err = 0;
+    socklen_t          elen = sizeof err;
+    size_t             rlen;
+
+    snprintf(label, sizeof label, "tcp %s", server);
+    if ((qlen = build_query(host, id, q + 2, sizeof q - 2)) < 0) return -1;
+    q[0] = (uint8_t)(qlen >> 8); q[1] = (uint8_t)qlen;
+    if ((fd = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
+        trail_add(trail, trail_sz, "%s: socket %s", label, strerror(errno));
+        return -1;
+    }
+    memset(&sa, 0, sizeof sa);
+    sa.sin_family = AF_INET;
+    sa.sin_port = htons(53);
+    sa.sin_addr.s_addr = inet_addr(server);
+    fcntl(fd, F_SETFL, fcntl(fd, F_GETFL, 0) | O_NONBLOCK);
+    if (connect(fd, (struct sockaddr *)&sa, sizeof sa) && errno != EINPROGRESS) {
+        trail_add(trail, trail_sz, "%s: %s", label, strerror(errno));
+        close(fd);
+        return -1;
+    }
+    {
+        struct pollfd pfd = { fd, POLLOUT, 0 };
+        if (poll(&pfd, 1, TCP_TIMEOUT_MS) != 1 ||
+            getsockopt(fd, SOL_SOCKET, SO_ERROR, &err, &elen) || err) {
+            trail_add(trail, trail_sz, "%s: %s", label, err ? strerror(err) : "no connection");
+            close(fd);
+            return -1;
+        }
+    }
+    if (io_until(fd, q, (size_t)qlen + 2, 1, deadline) || io_until(fd, lenb, 2, 0, deadline) ||
+        (rlen = (size_t)((lenb[0] << 8) | lenb[1])) > sizeof resp ||
+        io_until(fd, resp, rlen, 0, deadline)) {
+        trail_add(trail, trail_sz, "%s: %s", label, "no answer");
+        close(fd);
+        return -1;
+    }
+    close(fd);
+    if (finish(resp, rlen, id, out, label, trail, trail_sz, NULL)) return -1;
+    snprintf(out->source, sizeof out->source, "%s", label);
+    return 0;
+}
+
+#ifdef PATCHDL_HAVE_CURL
+typedef struct { uint8_t data[8192]; size_t len; } doh_buf_t;
+
+static size_t
+doh_write(void *p, size_t size, size_t nmemb, void *ud) {
+    doh_buf_t *b = ud;
+    size_t     total = size * nmemb;
+    if (total > sizeof b->data - b->len) return 0;
+    memcpy(b->data + b->len, p, total);
+    b->len += total;
+    return total;
+}
+
+static int
+query_doh(const char *name, const char *ip, const char *host,
+          patchdl_dns_answer_t *out, char *trail, size_t trail_sz) {
+    uint8_t            q[300];
+    char               url[96], pin[96], label[48];
+    doh_buf_t         *buf;
+    CURL              *curl;
+    CURLcode           res;
+    long               http = 0;
+    struct curl_slist *hdr = NULL, *rl = NULL;
+    struct curl_blob   ca;
+    uint16_t           id = next_query_id();
+    int                qlen, rc = -1;
+
+    snprintf(label, sizeof label, "doh %s", name);
+    if ((qlen = build_query(host, id, q, sizeof q)) < 0) return -1;
+    if (!(buf = calloc(1, sizeof *buf))) return -1;
+    if (!(curl = curl_easy_init())) { free(buf); return -1; }
+    snprintf(url, sizeof url, "https://%s/dns-query", name);
+    snprintf(pin, sizeof pin, "%s:443:%s", name, ip);
+    rl  = curl_slist_append(NULL, pin);
+    hdr = curl_slist_append(NULL, "Content-Type: application/dns-message");
+    hdr = curl_slist_append(hdr, "Accept: application/dns-message");
+    ca.data  = (void *)PATCHDL_DOH_ROOTS_PEM;
+    ca.len   = strlen(PATCHDL_DOH_ROOTS_PEM);
+    ca.flags = CURL_BLOB_COPY;
+
+    curl_easy_setopt(curl, CURLOPT_URL,              url);
+    curl_easy_setopt(curl, CURLOPT_RESOLVE,          rl);
+    curl_easy_setopt(curl, CURLOPT_HTTPHEADER,       hdr);
+    curl_easy_setopt(curl, CURLOPT_POSTFIELDS,       (const char *)q);
+    curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE,    (long)qlen);
+    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION,    doh_write);
+    curl_easy_setopt(curl, CURLOPT_WRITEDATA,        buf);
+    curl_easy_setopt(curl, CURLOPT_CAINFO_BLOB,      &ca);
+    curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER,   1L);
+    curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST,   2L);
+    curl_easy_setopt(curl, CURLOPT_PROTOCOLS_STR,    "https");
+    curl_easy_setopt(curl, CURLOPT_HTTP_VERSION,     (long)CURL_HTTP_VERSION_1_1);
+    curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION,   0L);
+    curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT,   2L);
+    curl_easy_setopt(curl, CURLOPT_TIMEOUT,          DOH_TIMEOUT_S);
+    curl_easy_setopt(curl, CURLOPT_NOSIGNAL,         1L);
+    curl_easy_setopt(curl, CURLOPT_USERAGENT,        "patchdl/1.0");
+
+    res = curl_easy_perform(curl);
+    curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &http);
+    curl_easy_cleanup(curl);
+    curl_slist_free_all(rl);
+    curl_slist_free_all(hdr);
+
+    if (res != CURLE_OK) {
+        trail_add(trail, trail_sz, "%s: %s", label,
+                  res == CURLE_PEER_FAILED_VERIFICATION ? "certificate rejected"
+                  : curl_easy_strerror(res));
+    } else if (http != 200) {
+        char code[16];
+        snprintf(code, sizeof code, "http %ld", http);
+        trail_add(trail, trail_sz, "%s: %s", label, code);
+    } else if (!finish(buf->data, buf->len, id, out, label, trail, trail_sz, NULL)) {
+        snprintf(out->source, sizeof out->source, "%s", label);
+        rc = 0;
+    }
+    free(buf);
+    return rc;
+}
+#endif
+
+/* ---------- last-known-good addresses on disk --------------------------- */
+
+static pthread_mutex_t g_save_mtx = PTHREAD_MUTEX_INITIALIZER;
+
+/* One line per host: "host ip,ip,...". */
+static int
+saved_get(const char *host, patchdl_dns_answer_t *out) {
+    char  line[512];
+    FILE *f;
+    int   found = -1;
+
+    pthread_mutex_lock(&g_save_mtx);
+    if ((f = fopen(PATCHDL_DNS_SAVE_FILE, "r"))) {
+        while (found && fgets(line, sizeof line, f)) {
+            char *sp = strchr(line, ' ');
+            if (!sp) continue;
+            *sp = '\0';
+            if (strcmp(line, host)) continue;
+            out->n = 0;
+            for (char *save = NULL, *tok = strtok_r(sp + 1, ",\r\n", &save);
+                 tok && out->n < PATCHDL_DNS_MAX_IPS; tok = strtok_r(NULL, ",\r\n", &save)) {
+                struct in_addr a;
+                if (inet_pton(AF_INET, tok, &a) == 1 && !is_sinkhole((uint8_t *)&a))
+                    snprintf(out->ip[out->n++], sizeof out->ip[0], "%s", tok);
+            }
+            if (out->n) found = 0;
+        }
+        fclose(f);
+    }
+    pthread_mutex_unlock(&g_save_mtx);
+    return found;
+}
+
+static void
+saved_put(const char *host, const patchdl_dns_answer_t *a) {
+    char  lines[MAX_SAVED][512], line[512], tmp[sizeof PATCHDL_DNS_SAVE_FILE + 8];
+    int   n = 0, fd;
+    FILE *f;
+
+    pthread_mutex_lock(&g_save_mtx);
+    /* This host first, then the others it already knew. */
+    snprintf(lines[n], sizeof lines[0], "%s ", host);
+    for (int i = 0; i < a->n; i++) {
+        size_t len = strlen(lines[n]);
+        snprintf(lines[n] + len, sizeof lines[0] - len, "%s%s", i ? "," : "", a->ip[i]);
+    }
+    n++;
+    if ((f = fopen(PATCHDL_DNS_SAVE_FILE, "r"))) {
+        size_t hl = strlen(host);
+        while (n < MAX_SAVED && fgets(line, sizeof line, f)) {
+            line[strcspn(line, "\r\n")] = '\0';
+            if (!line[0] || (!strncmp(line, host, hl) && line[hl] == ' ')) continue;
+            snprintf(lines[n++], sizeof lines[0], "%s", line);
+        }
+        fclose(f);
+    }
+    snprintf(tmp, sizeof tmp, "%s.tmp", PATCHDL_DNS_SAVE_FILE);
+    fd = open(tmp, O_WRONLY | O_CREAT | O_TRUNC | O_NOFOLLOW | O_CLOEXEC, 0600);
+    if (fd >= 0 && (f = fdopen(fd, "w"))) {
+        for (int i = 0; i < n; i++) fprintf(f, "%s\n", lines[i]);
+        if (!fclose(f)) rename(tmp, PATCHDL_DNS_SAVE_FILE);
+        else unlink(tmp);
+    } else if (fd >= 0) {
+        close(fd);
+        unlink(tmp);
+    }
+    pthread_mutex_unlock(&g_save_mtx);
+}
+
+/* ---------- the chain --------------------------------------------------- */
+
+static int
+resolve_fresh(const char *host, patchdl_dns_answer_t *out) {
+    char *trail = out->trail;
+    size_t tsz = sizeof out->trail;
+    int   truncated = 0;
+
+    trail[0] = '\0';
+    for (int i = 0; PLAIN_SERVERS[i]; i++) {
+        truncated = 0;
+        if (!query_udp(PLAIN_SERVERS[i], host, out, trail, tsz, &truncated)) return 0;
+        if (truncated && !query_tcp(PLAIN_SERVERS[i], host, out, trail, tsz)) return 0;
+    }
+    for (int i = 0; TCP_SERVERS[i]; i++)
+        if (!query_tcp(TCP_SERVERS[i], host, out, trail, tsz)) return 0;
+#ifdef PATCHDL_HAVE_CURL
+    for (int i = 0; DOH_SERVERS[i].name; i++)
+        if (!query_doh(DOH_SERVERS[i].name, DOH_SERVERS[i].ip, host, out, trail, tsz)) return 0;
+#endif
+    if (!saved_get(host, out)) {
+        snprintf(out->source, sizeof out->source, "saved");
+        trail_add(trail, tsz, "%s%s", "using saved addresses", "");
+        return 0;
+    }
+    out->n = 0;
+    out->source[0] = '\0';
+    return -1;
+}
+
+/* ---------- cache ------------------------------------------------------- */
+
+typedef struct {
+    char                 host[256];
+    patchdl_dns_answer_t ans;
+    int                  ok;
+    int                  inflight;
+    time_t               expires;
+    time_t               used;
+} cache_slot_t;
+
+static pthread_mutex_t g_mtx = PTHREAD_MUTEX_INITIALIZER;
+static pthread_cond_t  g_cv  = PTHREAD_COND_INITIALIZER;
+static cache_slot_t    g_cache[CACHE_SLOTS];
+
+static time_t
+now_s(void) {
+    struct timespec ts;
+    clock_gettime(CLOCK_MONOTONIC, &ts);
+    return ts.tv_sec;
+}
+
+static cache_slot_t *
+slot_find(const char *host) {
+    for (int i = 0; i < CACHE_SLOTS; i++)
+        if (g_cache[i].host[0] && !strcmp(g_cache[i].host, host)) return &g_cache[i];
+    return NULL;
+}
+
+/* A free slot, else the least recently used one nobody is resolving. */
+static cache_slot_t *
+slot_claim(const char *host) {
+    cache_slot_t *pick = NULL;
+    for (int i = 0; i < CACHE_SLOTS; i++) {
+        cache_slot_t *s = &g_cache[i];
+        if (s->inflight) continue;
+        if (!s->host[0]) { pick = s; break; }
+        if (!pick || s->used < pick->used) pick = s;
+    }
+    if (pick) {
+        memset(pick, 0, sizeof *pick);
+        snprintf(pick->host, sizeof pick->host, "%s", host);
+    }
+    return pick;
+}
+
+int
+patchdl_dns_lookup(const char *host, patchdl_dns_answer_t *out) {
+    patchdl_dns_answer_t fresh;
+    cache_slot_t        *s;
+    int                  rc;
+
+    memset(out, 0, sizeof *out);
+    if (!host || !host[0] || strlen(host) >= sizeof g_cache[0].host) return -1;
+
+    pthread_mutex_lock(&g_mtx);
+    /* One lookup per host at a time: the download workers all want the same
+       CDN host at once, and the others wait for its answer. */
+    for (;;) {
+        s = slot_find(host);
+        if (!s || !s->inflight) break;
+        pthread_cond_wait(&g_cv, &g_mtx);
+    }
+    if (s && s->expires > now_s()) {
+        s->used = now_s();
+        *out = s->ans;
+        rc = s->ok ? 0 : -1;
+        pthread_mutex_unlock(&g_mtx);
+        return rc;
+    }
+    if (!s) s = slot_claim(host);
+    if (s) s->inflight = 1;
+    pthread_mutex_unlock(&g_mtx);
+
+    memset(&fresh, 0, sizeof fresh);
+    rc = resolve_fresh(host, &fresh);
+    if (!rc && strcmp(fresh.source, "saved")) saved_put(host, &fresh);
+
+    pthread_mutex_lock(&g_mtx);
+    if (s) {
+        s->ans      = fresh;
+        s->ok       = !rc;
+        s->expires  = now_s() + (rc ? NEGATIVE_TTL_S : POSITIVE_TTL_S);
+        s->used     = now_s();
+        s->inflight = 0;
+        pthread_cond_broadcast(&g_cv);
+    }
+    pthread_mutex_unlock(&g_mtx);
+    *out = fresh;
+    return rc;
+}
+
+void
+patchdl_dns_forget(const char *host) {
+    cache_slot_t *s;
+    pthread_mutex_lock(&g_mtx);
+    if ((s = slot_find(host)) && !s->inflight) s->expires = 0;
+    pthread_mutex_unlock(&g_mtx);
+}
+
+int
+patchdl_dns_resolve_entry(const patchdl_dns_answer_t *a, const char *host,
+                          int port, char *out, size_t sz) {
+    size_t len;
+    int    k = snprintf(out, sz, "%s:%d:", host, port);
+    if (k < 0 || (size_t)k >= sz) return -1;
+    for (int i = 0; i < a->n; i++) {
+        len = strlen(out);
+        k = snprintf(out + len, sz - len, "%s%s", i ? "," : "", a->ip[i]);
+        if (k < 0 || (size_t)k >= sz - len) return -1;
+    }
+    return 0;
+}
@@ -0,0 +1,52 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later
+ * Copyright (C) 2026 Knutwurst
+ *
+ * PatchDL is free software: you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option)
+ * any later version. See the LICENSE file in the project root for details.
+ */
+
+#pragma once
+
+#include <stddef.h>
+
+/*
+ * PatchDL's own resolver. The console's DNS is often set up to block Sony's
+ * hosts (that is how people keep the system from updating), so PatchDL never
+ * asks it. A lookup tries, in this order, until one gives a usable answer:
+ *
+ *   1. plain DNS over UDP to 1.1.1.1, 8.8.8.8, 9.9.9.9, 1.0.0.1
+ *   2. DNS over TCP to 1.1.1.1 and 8.8.8.8 (UDP/53 blocked or truncated)
+ *   3. DNS over HTTPS to Cloudflare and Google (port 53 blocked or
+ *      redirected to a filtering resolver)
+ *   4. the addresses the last successful lookup saved to disk
+ *
+ * Answers in private, loopback or "this network" ranges count as blocked:
+ * that is what filtering resolvers send back for Sony's hosts.
+ */
+
+#define PATCHDL_DNS_MAX_IPS 8
+
+typedef struct {
+    int  n;
+    char ip[PATCHDL_DNS_MAX_IPS][16];
+    char source[40];     /* e.g. "udp 1.1.1.1", "doh dns.google", "saved" */
+    char trail[384];     /* what each step answered on the last fresh lookup */
+} patchdl_dns_answer_t;
+
+/* Resolve host (IPv4). Answers are cached for a few minutes and failures for
+   a short while. 0 on success, -1 if every source failed. */
+int  patchdl_dns_lookup(const char *host, patchdl_dns_answer_t *out);
+
+/* Drop host's cached answer, e.g. after none of its addresses accepted a
+   connection, so the next lookup asks again. */
+void patchdl_dns_forget(const char *host);
+
+/* Room for any entry: a 255-character host, port and every address. */
+#define PATCHDL_DNS_ENTRY_MAX (256 + 8 + PATCHDL_DNS_MAX_IPS * 16)
+
+/* "host:port:ip1,ip2,..." for CURLOPT_RESOLVE. curl moves on to the next
+   address when one doesn't connect. -1 if it doesn't fit in sz. */
+int  patchdl_dns_resolve_entry(const patchdl_dns_answer_t *a, const char *host,
+                               int port, char *out, size_t sz);
@@ -0,0 +1,142 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later
+ * Copyright (C) 2026 Knutwurst
+ *
+ * PatchDL is free software: you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option)
+ * any later version. See the LICENSE file in the project root for details.
+ */
+
+#pragma once
+
+/*
+ * Public root CAs of the DNS-over-HTTPS resolvers PatchDL falls back to when
+ * plain DNS is blocked or answers with a sinkhole address. Only the DoH
+ * requests use these; Sony's hosts stay pinned to the SCEI root
+ * (patchdl_ca.h). Public, non-secret certificates.
+ */
+static const char PATCHDL_DOH_ROOTS_PEM[] =
+    /* SSL.com Root Certification Authority ECC (Cloudflare 1.1.1.1 / 1.0.0.1) */
+    "-----BEGIN CERTIFICATE-----\n"
+    "MIICjTCCAhSgAwIBAgIIdebfy8FoW6gwCgYIKoZIzj0EAwIwfDELMAkGA1UEBhMC\n"
+    "VVMxDjAMBgNVBAgMBVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMRgwFgYDVQQKDA9T\n"
+    "U0wgQ29ycG9yYXRpb24xMTAvBgNVBAMMKFNTTC5jb20gUm9vdCBDZXJ0aWZpY2F0\n"
+    "aW9uIEF1dGhvcml0eSBFQ0MwHhcNMTYwMjEyMTgxNDAzWhcNNDEwMjEyMTgxNDAz\n"
+    "WjB8MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hvdXN0\n"
+    "b24xGDAWBgNVBAoMD1NTTCBDb3Jwb3JhdGlvbjExMC8GA1UEAwwoU1NMLmNvbSBS\n"
+    "b290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IEVDQzB2MBAGByqGSM49AgEGBSuB\n"
+    "BAAiA2IABEVuqVDEpiM2nl8ojRfLliJkP9x6jh3MCLOicSS6jkm5BBtHllirLZXI\n"
+    "7Z4INcgn64mMU1jrYor+8FsPazFSY0E7ic3s7LaNGdM0B9y7xgZ/wkWV7Mt/qCPg\n"
+    "CemB+vNH06NjMGEwHQYDVR0OBBYEFILRhXMw5zUE044CkvvlpNHEIejNMA8GA1Ud\n"
+    "EwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAUgtGFczDnNQTTjgKS++Wk0cQh6M0wDgYD\n"
+    "VR0PAQH/BAQDAgGGMAoGCCqGSM49BAMCA2cAMGQCMG/n61kRpGDPYbCWe+0F+S8T\n"
+    "kdzt5fxQaxFGRrMcIQBiu77D5+jNB5n5DQtdcj7EqgIwH7y6C+IwJPt8bYBVCpk+\n"
+    "gA0z5Wajs6O7pdWLjwkspl1+4vAHCGht0nxpbl/f5Wpl\n"
+    "-----END CERTIFICATE-----\n"
+    /* GTS Root R1 (Google 8.8.8.8) */
+    "-----BEGIN CERTIFICATE-----\n"
+    "MIIFVzCCAz+gAwIBAgINAgPlk28xsBNJiGuiFzANBgkqhkiG9w0BAQwFADBHMQsw\n"
+    "CQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEU\n"
+    "MBIGA1UEAxMLR1RTIFJvb3QgUjEwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAw\n"
+    "MDAwWjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZp\n"
+    "Y2VzIExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjEwggIiMA0GCSqGSIb3DQEBAQUA\n"
+    "A4ICDwAwggIKAoICAQC2EQKLHuOhd5s73L+UPreVp0A8of2C+X0yBoJx9vaMf/vo\n"
+    "27xqLpeXo4xL+Sv2sfnOhB2x+cWX3u+58qPpvBKJXqeqUqv4IyfLpLGcY9vXmX7w\n"
+    "Cl7raKb0xlpHDU0QM+NOsROjyBhsS+z8CZDfnWQpJSMHobTSPS5g4M/SCYe7zUjw\n"
+    "TcLCeoiKu7rPWRnWr4+wB7CeMfGCwcDfLqZtbBkOtdh+JhpFAz2weaSUKK0Pfybl\n"
+    "qAj+lug8aJRT7oM6iCsVlgmy4HqMLnXWnOunVmSPlk9orj2XwoSPwLxAwAtcvfaH\n"
+    "szVsrBhQf4TgTM2S0yDpM7xSma8ytSmzJSq0SPly4cpk9+aCEI3oncKKiPo4Zor8\n"
+    "Y/kB+Xj9e1x3+naH+uzfsQ55lVe0vSbv1gHR6xYKu44LtcXFilWr06zqkUspzBmk\n"
+    "MiVOKvFlRNACzqrOSbTqn3yDsEB750Orp2yjj32JgfpMpf/VjsPOS+C12LOORc92\n"
+    "wO1AK/1TD7Cn1TsNsYqiA94xrcx36m97PtbfkSIS5r762DL8EGMUUXLeXdYWk70p\n"
+    "aDPvOmbsB4om3xPXV2V4J95eSRQAogB/mqghtqmxlbCluQ0WEdrHbEg8QOB+DVrN\n"
+    "VjzRlwW5y0vtOUucxD/SVRNuJLDWcfr0wbrM7Rv1/oFB2ACYPTrIrnqYNxgFlQID\n"
+    "AQABo0IwQDAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E\n"
+    "FgQU5K8rJnEaK0gnhS9SZizv8IkTcT4wDQYJKoZIhvcNAQEMBQADggIBAJ+qQibb\n"
+    "C5u+/x6Wki4+omVKapi6Ist9wTrYggoGxval3sBOh2Z5ofmmWJyq+bXmYOfg6LEe\n"
+    "QkEzCzc9zolwFcq1JKjPa7XSQCGYzyI0zzvFIoTgxQ6KfF2I5DUkzps+GlQebtuy\n"
+    "h6f88/qBVRRiClmpIgUxPoLW7ttXNLwzldMXG+gnoot7TiYaelpkttGsN/H9oPM4\n"
+    "7HLwEXWdyzRSjeZ2axfG34arJ45JK3VmgRAhpuo+9K4l/3wV3s6MJT/KYnAK9y8J\n"
+    "ZgfIPxz88NtFMN9iiMG1D53Dn0reWVlHxYciNuaCp+0KueIHoI17eko8cdLiA6Ef\n"
+    "MgfdG+RCzgwARWGAtQsgWSl4vflVy2PFPEz0tv/bal8xa5meLMFrUKTX5hgUvYU/\n"
+    "Z6tGn6D/Qqc6f1zLXbBwHSs09dR2CQzreExZBfMzQsNhFRAbd03OIozUhfJFfbdT\n"
+    "6u9AWpQKXCBfTkBdYiJ23//OYb2MI3jSNwLgjt7RETeJ9r/tSQdirpLsQBqvFAnZ\n"
+    "0E6yove+7u7Y/9waLd64NnHi/Hm3lCXRSHNboTXns5lndcEZOitHTtNCjv0xyBZm\n"
+    "2tIMPNuzjsmhDYAPexZ3FL//2wmUspO8IFgV6dtxQ/PeEMMA3KgqlbbC1j+Qa3bb\n"
+    "bP6MvPJwNQzcmRk13NfIRmPVNnGuV/u3gm3c\n"
+    "-----END CERTIFICATE-----\n"
+    /* GTS Root R4 (Google 8.8.8.8) */
+    "-----BEGIN CERTIFICATE-----\n"
+    "MIICCTCCAY6gAwIBAgINAgPlwGjvYxqccpBQUjAKBggqhkjOPQQDAzBHMQswCQYD\n"
+    "VQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2VzIExMQzEUMBIG\n"
+    "A1UEAxMLR1RTIFJvb3QgUjQwHhcNMTYwNjIyMDAwMDAwWhcNMzYwNjIyMDAwMDAw\n"
+    "WjBHMQswCQYDVQQGEwJVUzEiMCAGA1UEChMZR29vZ2xlIFRydXN0IFNlcnZpY2Vz\n"
+    "IExMQzEUMBIGA1UEAxMLR1RTIFJvb3QgUjQwdjAQBgcqhkjOPQIBBgUrgQQAIgNi\n"
+    "AATzdHOnaItgrkO4NcWBMHtLSZ37wWHO5t5GvWvVYRg1rkDdc/eJkTBa6zzuhXyi\n"
+    "QHY7qca4R9gq55KRanPpsXI5nymfopjTX15YhmUPoYRlBtHci8nHc8iMai/lxKvR\n"
+    "HYqjQjBAMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQW\n"
+    "BBSATNbrdP9JNqPV2Py1PsVq8JQdjDAKBggqhkjOPQQDAwNpADBmAjEA6ED/g94D\n"
+    "9J+uHXqnLrmvT/aDHQ4thQEd0dlq7A/Cr8deVl5c1RxYIigL9zC2L7F8AjEA8GE8\n"
+    "p/SgguMh1YQdc4acLa/KNJvxn7kjNuK8YAOdgLOaVsjh4rsUecrNIdSUtUlD\n"
+    "-----END CERTIFICATE-----\n"
+    /* GlobalSign Root CA (cross-signs the GTS roots) */
+    "-----BEGIN CERTIFICATE-----\n"
+    "MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG\n"
+    "A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv\n"
+    "b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw\n"
+    "MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i\n"
+    "YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT\n"
+    "aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ\n"
+    "jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp\n"
+    "xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz8kHp\n"
+    "1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG\n"
+    "snUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ\n"
+    "U26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8\n"
+    "9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8E\n"
+    "BTADAQH/MB0GA1UdDgQWBBRge2YaRQ2XyolQL30EzTSo//z9SzANBgkqhkiG9w0B\n"
+    "AQUFAAOCAQEA1nPnfE920I2/7LqivjTFKDK1fPxsnCwrvQmeU79rXqoRSLblCKOz\n"
+    "yj1hTdNGCbM+w6DjY1Ub8rrvrTnhQ7k4o+YviiY776BQVvnGCv04zcQLcFGUl5gE\n"
+    "38NflNUVyRRBnMRddWQVDf9VMOyGj/8N7yy5Y0b2qvzfvGn9LhJIZJrglfCm7ymP\n"
+    "AbEVtQwdpf5pLGkkeB6zpxxxYu7KyJesF12KwvhHhm4qxFYxldBniYUr+WymXUad\n"
+    "DKqC5JlR3XC321Y9YeRq4VzW9v493kHMB65jUr9TU/Qr6cf9tveCX4XSQRjbgbME\n"
+    "HMUfpIBvFSDJ3gyICh3WZlXi/EjJKSZp4A==\n"
+    "-----END CERTIFICATE-----\n"
+    /* DigiCert Global Root G2 */
+    "-----BEGIN CERTIFICATE-----\n"
+    "MIIDjjCCAnagAwIBAgIQAzrx5qcRqaC7KGSxHQn65TANBgkqhkiG9w0BAQsFADBh\n"
+    "MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3\n"
+    "d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBH\n"
+    "MjAeFw0xMzA4MDExMjAwMDBaFw0zODAxMTUxMjAwMDBaMGExCzAJBgNVBAYTAlVT\n"
+    "MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j\n"
+    "b20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IEcyMIIBIjANBgkqhkiG\n"
+    "9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuzfNNNx7a8myaJCtSnX/RrohCgiN9RlUyfuI\n"
+    "2/Ou8jqJkTx65qsGGmvPrC3oXgkkRLpimn7Wo6h+4FR1IAWsULecYxpsMNzaHxmx\n"
+    "1x7e/dfgy5SDN67sH0NO3Xss0r0upS/kqbitOtSZpLYl6ZtrAGCSYP9PIUkY92eQ\n"
+    "q2EGnI/yuum06ZIya7XzV+hdG82MHauVBJVJ8zUtluNJbd134/tJS7SsVQepj5Wz\n"
+    "tCO7TG1F8PapspUwtP1MVYwnSlcUfIKdzXOS0xZKBgyMUNGPHgm+F6HmIcr9g+UQ\n"
+    "vIOlCsRnKPZzFBQ9RnbDhxSJITRNrw9FDKZJobq7nMWxM4MphQIDAQABo0IwQDAP\n"
+    "BgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAdBgNVHQ4EFgQUTiJUIBiV\n"
+    "5uNu5g/6+rkS7QYXjzkwDQYJKoZIhvcNAQELBQADggEBAGBnKJRvDkhj6zHd6mcY\n"
+    "1Yl9PMWLSn/pvtsrF9+wX3N3KjITOYFnQoQj8kVnNeyIv/iPsGEMNKSuIEyExtv4\n"
+    "NeF22d+mQrvHRAiGfzZ0JFrabA0UWTW98kndth/Jsw1HKj2ZL7tcu7XUIOGZX1NG\n"
+    "Fdtom/DzMNU+MeKNhJ7jitralj41E6Vf8PlwUHBHQRFXGU7Aj64GxJUTFy8bJZ91\n"
+    "8rGOmaFvE7FBcf6IKshPECBV1/MUReXgRPTqh5Uykw7+U0b6LJ3/iyK5S9kJRaTe\n"
+    "pLiaWN0bfVKfjllDiIGknibVb63dDcY3fe0Dkhvld1927jyNxF1WW6LZZm6zNTfl\n"
+    "MrY=\n"
+    "-----END CERTIFICATE-----\n"
+    /* DigiCert Global Root G3 */
+    "-----BEGIN CERTIFICATE-----\n"
+    "MIICPzCCAcWgAwIBAgIQBVVWvPJepDU1w6QP1atFcjAKBggqhkjOPQQDAzBhMQsw\n"
+    "CQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cu\n"
+    "ZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBHMzAe\n"
+    "Fw0xMzA4MDExMjAwMDBaFw0zODAxMTUxMjAwMDBaMGExCzAJBgNVBAYTAlVTMRUw\n"
+    "EwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20x\n"
+    "IDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IEczMHYwEAYHKoZIzj0CAQYF\n"
+    "K4EEACIDYgAE3afZu4q4C/sLfyHS8L6+c/MzXRq8NOrexpu80JX28MzQC7phW1FG\n"
+    "fp4tn+6OYwwX7Adw9c+ELkCDnOg/QW07rdOkFFk2eJ0DQ+4QE2xy3q6Ip6FrtUPO\n"
+    "Z9wj/wMco+I+o0IwQDAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAd\n"
+    "BgNVHQ4EFgQUs9tIpPmhxdiuNkHMEWNpYim8S8YwCgYIKoZIzj0EAwMDaAAwZQIx\n"
+    "AK288mw/EkrRLTnDCgmXc/SINoyIJ7vmiI1Qhadj+Z4y3maTD/HMsQmP3Wyr+mt/\n"
+    "oAIwOWZbwmSNuJ5Q3KjVSaLtx9zRSX8XAbjIho9OjIgrqJqpisXRAL34VOKa5Vt8\n"
+    "sycX\n"
+    "-----END CERTIFICATE-----\n";
@@ -8,6 +8,7 @@
 */

 #include "patchdl_net.h"
+#include "patchdl_dns.h"

 #include <arpa/inet.h>
 #include <errno.h>
@@ -29,10 +30,6 @@
 #include "patchdl_ca.h"
 #endif

-#define DNS_SERVER     "1.1.1.1"
-#define DNS_PORT       53
-#define DNS_TIMEOUT_MS 3000
-
 /* Manifest sanity caps — reject anything bigger than a real PS5 patch. The
   largest title we've seen tops out around 70 GB / 18 pieces. */
 #define PATCHDL_MAX_PIECES         4096
@@ -95,6 +92,63 @@ host_allowed(const char *host) {
 }

 /* Extract hostname from https://host/path or http://host/path */
+/* Why the calling thread's last patchdl_http_get failed (or what status it
+   got), for error reports. */
+static _Thread_local struct {
+    char step[24];
+    int  curl_rc;
+    long http_code;
+} g_last;
+
+static void
+set_last(const char *step, int curl_rc, long http_code) {
+    snprintf(g_last.step, sizeof g_last.step, "%s", step);
+    g_last.curl_rc   = curl_rc;
+    g_last.http_code = http_code;
+}
+
+/* CURLOPT_RESOLVE entries for host on 443 and 80 from PatchDL's own
+   resolver (patchdl_dns.c), with every address it found. NULL when the host
+   can't be resolved. */
+static struct curl_slist *
+resolve_list_for(const char *host) {
+    patchdl_dns_answer_t a;
+    char                 entry[PATCHDL_DNS_ENTRY_MAX];
+    struct curl_slist   *rl, *both;
+
+    if (patchdl_dns_lookup(host, &a) ||
+        patchdl_dns_resolve_entry(&a, host, 443, entry, sizeof entry) ||
+        !(rl = curl_slist_append(NULL, entry)))
+        return NULL;
+    if (patchdl_dns_resolve_entry(&a, host, 80, entry, sizeof entry) ||
+        !(both = curl_slist_append(rl, entry))) {
+        curl_slist_free_all(rl);
+        return NULL;
+    }
+    return both;
+}
+
+/* None of the host's addresses took the connection (refused, or silently
+   dropped until the timeout): the next request asks DNS again instead of
+   reusing the cached answer. A timeout on an established transfer says
+   nothing about the addresses. Call before curl_easy_cleanup. */
+static void
+note_curl_result(CURL *curl, const char *host, CURLcode res) {
+    curl_off_t connect_us = 0;
+    if (res == CURLE_OPERATION_TIMEDOUT)
+        curl_easy_getinfo(curl, CURLINFO_CONNECT_TIME_T, &connect_us);
+    if (res == CURLE_COULDNT_CONNECT || res == CURLE_COULDNT_RESOLVE_HOST ||
+        (res == CURLE_OPERATION_TIMEDOUT && connect_us == 0))
+        patchdl_dns_forget(host);
+}
+
+void
+patchdl_http_last_error(char *step, size_t step_sz, int *curl_rc, long *http_code) {
+    if (step && step_sz) snprintf(step, step_sz, "%s", g_last.step);
+    if (curl_rc) *curl_rc = g_last.curl_rc;
+    if (http_code) *http_code = g_last.http_code;
+}
+
 /* Manifest piece hashes: PS5 manifests carry SHA-256 (64 hex digits), PS4
   manifests SHA-1 (40). */
 static const EVP_MD *
@@ -118,164 +172,6 @@ url_host(const char *url, char *out, size_t out_sz) {
    return 0;
 }

-/* ---------- raw UDP DNS resolver ---------------------------------------- */
-
-/* Diagnostics from the last dns_resolve() call (read by patchdl_net_diag).
-   step: 0=ok 1=socket 2=sendto 3=recv<12 4=no-answer. */
-static int g_dns_step, g_dns_errno, g_dns_n, g_dns_ancount;
-
-static int
-dns_encode_name(const char *host, uint8_t *buf, size_t bufsz) {
-    size_t pos = 0;
-    const char *p = host;
-
-    while (*p) {
-        const char *dot = strchr(p, '.');
-        size_t lablen = dot ? (size_t)(dot - p) : strlen(p);
-        if (lablen > 63 || pos + 1 + lablen + 1 >= bufsz) return -1;
-        buf[pos++] = (uint8_t)lablen;
-        memcpy(buf + pos, p, lablen);
-        pos += lablen;
-        p += lablen;
-        if (*p == '.') p++;
-    }
-    buf[pos++] = 0;
-    return (int)pos;
-}
-
-static int
-dns_resolve(const char *host, char *ip_out, size_t ip_sz) {
-    int              fd;
-    struct sockaddr_in srv;
-    uint8_t          pkt[512], resp[512];
-    ssize_t          n;
-    int              name_len;
-    size_t           pos;
-    struct timeval   tv;
-
-    g_dns_step = 0; g_dns_errno = 0; g_dns_n = 0; g_dns_ancount = 0;
-
-    fd = socket(AF_INET, SOCK_DGRAM, 0);
-    if (fd < 0) { g_dns_step = 1; g_dns_errno = errno; return -1; }
-
-    tv.tv_sec  = DNS_TIMEOUT_MS / 1000;
-    tv.tv_usec = (DNS_TIMEOUT_MS % 1000) * 1000;
-    setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
-
-    memset(&srv, 0, sizeof(srv));
-    srv.sin_family      = AF_INET;
-    srv.sin_port        = htons(DNS_PORT);
-    srv.sin_addr.s_addr = inet_addr(DNS_SERVER);
-
-    memset(pkt, 0, sizeof(pkt));
-    pkt[0] = 0xDE; pkt[1] = 0xAD; /* ID */
-    pkt[2] = 0x01; pkt[3] = 0x00; /* standard query, RD */
-    pkt[4] = 0x00; pkt[5] = 0x01; /* QDCOUNT = 1 */
-    pos = 12;
-
-    name_len = dns_encode_name(host, pkt + pos, sizeof(pkt) - pos - 4);
-    if (name_len < 0) { close(fd); return -1; }
-    pos += (size_t)name_len;
-    pkt[pos++] = 0x00; pkt[pos++] = 0x01; /* QTYPE = A */
-    pkt[pos++] = 0x00; pkt[pos++] = 0x01; /* QCLASS = IN */
-
-    if (sendto(fd, pkt, pos, 0,
-               (struct sockaddr *)&srv, sizeof(srv)) < 0) {
-        g_dns_step = 2; g_dns_errno = errno; close(fd); return -1;
-    }
-
-    n = recv(fd, resp, sizeof(resp), 0);
-    g_dns_n = (int)n;
-    if (n < 0) g_dns_errno = errno;
-    close(fd);
-    if (n < 12) { g_dns_step = 3; return -1; }
-
-    uint16_t ancount = (uint16_t)((resp[6] << 8) | resp[7]);
-    g_dns_ancount = ancount;
-    if (!ancount) { g_dns_step = 4; return -1; }
-
-    /* Skip header and question section */
-    pos = 12;
-    while (pos < (size_t)n) {
-        if (!resp[pos]) { pos++; break; }
-        if ((resp[pos] & 0xC0) == 0xC0) { pos += 2; break; }
-        /* Bounds-check the label length BEFORE the increment — a malformed
-           response with a 0xFF label byte near the end would otherwise walk
-           past `n`. */
-        if (pos + 1 + (size_t)resp[pos] >= (size_t)n) { g_dns_step = 5; return -1; }
-        pos += 1 + resp[pos];
-    }
-    if (pos + 4 > (size_t)n) { g_dns_step = 5; return -1; }
-    pos += 4; /* QTYPE + QCLASS */
-
-    /* Walk every answer RR; the CDN returns a CNAME chain, so skip
-       non-A records and return the first A (type 1, rdlen 4). */
-    for (int a = 0; a < ancount && pos < (size_t)n; a++) {
-        if ((resp[pos] & 0xC0) == 0xC0) {
-            pos += 2;
-        } else {
-            while (pos < (size_t)n && resp[pos]) {
-                if (pos + 1 + (size_t)resp[pos] >= (size_t)n) break;
-                pos += 1 + resp[pos];
-            }
-            pos++;
-        }
-        if (pos + 10 > (size_t)n) break;
-
-        uint16_t type  = (uint16_t)((resp[pos] << 8) | resp[pos + 1]); pos += 2;
-        pos += 6; /* CLASS + TTL */
-        uint16_t rdlen = (uint16_t)((resp[pos] << 8) | resp[pos + 1]); pos += 2;
-
-        if (type == 1 && rdlen == 4 && pos + 4 <= (size_t)n) {
-            snprintf(ip_out, ip_sz, "%u.%u.%u.%u",
-                     resp[pos], resp[pos + 1], resp[pos + 2], resp[pos + 3]);
-            return 0;
-        }
-        pos += rdlen; /* skip this RR's data (e.g. a CNAME target) */
-    }
-
-    g_dns_step = 6; /* no A record among the answers */
-    return -1;
-}
-
-/* Cache resolved IPs by host. The batch fetch hits the same CDN host dozens
-   of times; a burst of identical raw-UDP queries gets dropped/rate-limited,
-   so resolve once (with retries) and reuse. */
-static pthread_mutex_t dns_cache_mtx = PTHREAD_MUTEX_INITIALIZER;
-static struct { char host[256]; char ip[INET_ADDRSTRLEN]; } dns_cache[64];
-static int dns_cache_n;
-
-static int
-dns_lookup(const char *host, char *ip_out, size_t ip_sz) {
-    int rc = -1;
-
-    pthread_mutex_lock(&dns_cache_mtx);
-    for (int i = 0; i < dns_cache_n; i++) {
-        if (!strcmp(dns_cache[i].host, host)) {
-            strncpy(ip_out, dns_cache[i].ip, ip_sz - 1);
-            ip_out[ip_sz - 1] = '\0';
-            pthread_mutex_unlock(&dns_cache_mtx);
-            return 0;
-        }
-    }
-    /* Cold miss: resolve while HOLDING the cache lock (single-flight). N pool
-       workers needing the same CDN host would otherwise each blast Sony's
-       rate-limited resolver; this way one resolves and the rest get the cache.
-       It also serializes dns_resolve so its diagnostic globals can't be raced.
-       (This is the DNS lock, independent of the pool lock.) */
-    for (int attempt = 0; attempt < 4 && rc; attempt++)
-        rc = dns_resolve(host, ip_out, ip_sz);
-    if (!rc && dns_cache_n < (int)(sizeof(dns_cache) / sizeof(dns_cache[0]))) {
-        strncpy(dns_cache[dns_cache_n].host, host,
-                sizeof(dns_cache[0].host) - 1);
-        strncpy(dns_cache[dns_cache_n].ip, ip_out,
-                sizeof(dns_cache[0].ip) - 1);
-        dns_cache_n++;
-    }
-    pthread_mutex_unlock(&dns_cache_mtx);
-    return rc;
-}
-
 /* ---------- HTTP GET via curl ------------------------------------------- */

 static size_t
@@ -300,25 +196,18 @@ int
 patchdl_http_get(const char *url, patchdl_buf_t *out) {
    CURL             *curl;
    CURLcode          res;
-    char              host[256], ip[INET_ADDRSTRLEN];
-    char              resolve_str[512];
+    char              host[256];
    struct curl_slist *resolve_list = NULL;
    struct curl_blob  ca_blob;

    int plain = !strncmp(url, "http://", 7);
+    long http_code = 0;

-    if (url_host(url, host, sizeof(host))) return -1;
-    if (!host_allowed(host)) return -1;
-    if (plain && strcasecmp(host, PLAIN_HTTP_HOST)) return -1;
-    if (dns_lookup(host, ip, sizeof(ip))) return -1;
-
-    snprintf(resolve_str, sizeof(resolve_str), "%s:443:%s", host, ip);
-    resolve_list = curl_slist_append(NULL, resolve_str);
-
-    /* Also cover port 80 in case a redirect lands there */
-    char resolve_80[512];
-    snprintf(resolve_80, sizeof(resolve_80), "%s:80:%s", host, ip);
-    resolve_list = curl_slist_append(resolve_list, resolve_80);
+    set_last("", 0, 0);
+    if (url_host(url, host, sizeof(host))) { set_last("bad_url", 0, 0); return -1; }
+    if (!host_allowed(host)) { set_last("host_not_allowed", 0, 0); return -1; }
+    if (plain && strcasecmp(host, PLAIN_HTTP_HOST)) { set_last("http_not_allowed", 0, 0); return -1; }
+    if (!(resolve_list = resolve_list_for(host))) { set_last("dns", 0, 0); return -1; }

    {
        size_t caller_max = out->max;
@@ -359,15 +248,24 @@ patchdl_http_get(const char *url, patchdl_buf_t *out) {
    curl_easy_setopt(curl, CURLOPT_USERAGENT,       "patchdl/1.0");

    res = curl_easy_perform(curl);
+    curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &http_code);
+    note_curl_result(curl, host, res);
    curl_easy_cleanup(curl);
    curl_slist_free_all(resolve_list);

    if (res != CURLE_OK) {
+        set_last(res == CURLE_COULDNT_CONNECT ? "connect" :
+                 res == CURLE_PEER_FAILED_VERIFICATION ||
+                 res == CURLE_SSL_CONNECT_ERROR ? "tls"
+                 : res == CURLE_UNSUPPORTED_PROTOCOL ? "redirect"
+                 : res == CURLE_OPERATION_TIMEDOUT ? "timeout" : "network",
+                 (int)res, http_code);
        free(out->data);
        out->data = NULL;
        out->size = 0;
        return -1;
    }
+    set_last(http_code >= 400 ? "http_status" : "", 0, http_code);
    return 0;
 }

@@ -383,16 +281,12 @@ http_external(const char *url, const char *method,
 #else
    CURL             *curl;
    CURLcode          res;
-    char              host[256], ip[INET_ADDRSTRLEN];
-    char              resolve_str[512];
+    char              host[256];
    struct curl_slist *resolve_list = NULL;
    struct curl_slist *headers      = NULL;

    if (url_host(url, host, sizeof(host))) return -1;
-    if (dns_lookup(host, ip, sizeof(ip))) return -1;
-
-    snprintf(resolve_str, sizeof(resolve_str), "%s:443:%s", host, ip);
-    resolve_list = curl_slist_append(NULL, resolve_str);
+    if (!(resolve_list = resolve_list_for(host))) return -1;

    {
        size_t caller_max = out->max;
@@ -430,6 +324,7 @@ http_external(const char *url, const char *method,
    }

    res = curl_easy_perform(curl);
+    note_curl_result(curl, host, res);
    curl_easy_cleanup(curl);
    curl_slist_free_all(resolve_list);
    curl_slist_free_all(headers);
@@ -518,7 +413,7 @@ http_download_to_file_progress(const char *url, FILE *fp, long long *bytes_out,
                               long long range_start) {
    CURL             *curl;
    CURLcode          res;
-    char              host[256], ip[INET_ADDRSTRLEN], rs443[512], rs80[512];
+    char              host[256];
    char              range_hdr[48];
    long              http_code = 0;
    struct curl_slist *rl = NULL;
@@ -530,7 +425,7 @@ http_download_to_file_progress(const char *url, FILE *fp, long long *bytes_out,
    if (bytes_out) *bytes_out = 0;
    if (url_host(url, host, sizeof(host))) return -1;
    if (!host_allowed(host)) return -1;
-    if (dns_lookup(host, ip, sizeof(ip))) return -1;
+    if (!(rl = resolve_list_for(host))) return -1;

    if (verify) {
        sink.md = EVP_MD_CTX_new();
@@ -538,11 +433,6 @@ http_download_to_file_progress(const char *url, FILE *fp, long long *bytes_out,
            EVP_DigestInit_ex(sink.md, digest_for(expected_sha256_hex), NULL);
    }

-    snprintf(rs443, sizeof(rs443), "%s:443:%s", host, ip);
-    rl = curl_slist_append(NULL, rs443);
-    snprintf(rs80, sizeof(rs80), "%s:80:%s", host, ip);
-    rl = curl_slist_append(rl, rs80);
-
    ca_blob.data  = (void *)PATCHDL_SCEI_DNAS_ROOT_PEM;
    ca_blob.len   = strlen(PATCHDL_SCEI_DNAS_ROOT_PEM);
    ca_blob.flags = CURL_BLOB_COPY;
@@ -589,6 +479,7 @@ http_download_to_file_progress(const char *url, FILE *fp, long long *bytes_out,
    res = curl_easy_perform(curl);
    curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &http_code);
    curl_easy_getinfo(curl, CURLINFO_SIZE_DOWNLOAD_T, &dl);
+    note_curl_result(curl, host, res);
    curl_easy_cleanup(curl);
    curl_slist_free_all(rl);

@@ -943,7 +834,7 @@ patchdl_http_download_piece(const char *url, int fd,
    CURL             *curl;
    CURLcode          res;
    long              http_code = 0;
-    char              host[256], ip[INET_ADDRSTRLEN], rs443[512], rs80[512];
+    char              host[256];
    struct curl_slist *rl = NULL;
    struct curl_blob  ca_blob;
    piece_sink_t      sink;
@@ -954,7 +845,7 @@ patchdl_http_download_piece(const char *url, int fd,

    if (url_host(url, host, sizeof(host))) return -1;
    if (!host_allowed(host)) return -1;
-    if (dns_lookup(host, ip, sizeof(ip))) return -1;
+    if (!(rl = resolve_list_for(host))) return -1;

    memset(&sink, 0, sizeof(sink));
    sink.fd         = fd;
@@ -965,11 +856,6 @@ patchdl_http_download_piece(const char *url, int fd,
        if (sink.md) EVP_DigestInit_ex(sink.md, digest_for(expected_sha256_or_null), NULL);
    }

-    snprintf(rs443, sizeof(rs443), "%s:443:%s", host, ip);
-    rl = curl_slist_append(NULL, rs443);
-    snprintf(rs80, sizeof(rs80), "%s:80:%s", host, ip);
-    rl = curl_slist_append(rl, rs80);
-
    ca_blob.data  = (void *)PATCHDL_SCEI_DNAS_ROOT_PEM;
    ca_blob.len   = strlen(PATCHDL_SCEI_DNAS_ROOT_PEM);
    ca_blob.flags = CURL_BLOB_COPY;
@@ -1007,6 +893,7 @@ patchdl_http_download_piece(const char *url, int fd,

    res = curl_easy_perform(curl);
    curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &http_code);
+    note_curl_result(curl, host, res);
    curl_easy_cleanup(curl);
    curl_slist_free_all(rl);

@@ -1094,10 +981,18 @@ patchdl_fetch_manifest(const char *manifest_url, patchdl_manifest_t *out) {
    memset(&buf, 0, sizeof(buf));
    buf.max = PATCHDL_BUF_MAX_MANIFEST;
    if (patchdl_http_get(manifest_url, &buf)) return -1;
-    if (!buf.data || !buf.size) { free(buf.data); return -1; }
+    if (!buf.data || !buf.size) {
+        free(buf.data);
+        if (!g_last.step[0]) set_last("empty_reply", 0, g_last.http_code);
+        return -1;
+    }

    pieces = strstr(buf.data, "\"pieces\"");
-    if (!pieces || !(pieces = strchr(pieces, '['))) { free(buf.data); return -1; }
+    if (!pieces || !(pieces = strchr(pieces, '['))) {
+        free(buf.data);
+        if (!g_last.step[0]) set_last("bad_manifest", 0, g_last.http_code);
+        return -1;
+    }
    pieces_end = strchr(pieces, ']');

    for (p = pieces; (p = strstr(p, "\"url\"")) && (!pieces_end || p < pieces_end); p += 5)
@@ -1162,26 +1057,31 @@ patchdl_fetch_manifest(const char *manifest_url, patchdl_manifest_t *out) {

 void
 patchdl_net_diag(const char *url, char *out_json, size_t sz) {
-    char     host[256] = {0}, ip[INET_ADDRSTRLEN] = {0};
-    int      hostrc, allowrc, dnsrc;
-    long     http_code = 0;
-    CURLcode res = CURLE_OK;
-    int      did_curl = 0;
+    char                 host[256] = {0};
+    int                  hostrc, allowrc, dnsrc = -1;
+    long                 http_code = 0;
+    CURLcode             res = CURLE_OK;
+    int                  did_curl = 0;
+    patchdl_dns_answer_t a;

+    memset(&a, 0, sizeof a);
    hostrc  = url_host(url, host, sizeof(host));
    allowrc = (hostrc == 0) ? host_allowed(host) : 0;
-    dnsrc   = (hostrc == 0) ? dns_resolve(host, ip, sizeof(ip)) : -1;
+    if (hostrc == 0) {
+        patchdl_dns_forget(host);
+        dnsrc = patchdl_dns_lookup(host, &a);
+    }

    if (hostrc == 0 && allowrc && dnsrc == 0) {
        patchdl_buf_t buf;
        memset(&buf, 0, sizeof(buf));
        CURL *curl = curl_easy_init();
        if (curl) {
-            char rs[512];
+            char rs[PATCHDL_DNS_ENTRY_MAX];
            struct curl_slist *rl;
            struct curl_blob ca_blob;
-            snprintf(rs, sizeof(rs), "%s:443:%s", host, ip);
-            rl = curl_slist_append(NULL, rs);
+            rl = patchdl_dns_resolve_entry(&a, host, 443, rs, sizeof rs)
+                 ? NULL : curl_slist_append(NULL, rs);
            ca_blob.data = (void *)PATCHDL_SCEI_DNAS_ROOT_PEM;
            ca_blob.len = strlen(PATCHDL_SCEI_DNAS_ROOT_PEM);
            ca_blob.flags = CURL_BLOB_COPY;
@@ -1206,13 +1106,13 @@ patchdl_net_diag(const char *url, char *out_json, size_t sz) {
        }
    }

+    /* host, source and trail are plain ASCII from our own resolver; quotes
+       can't occur in them. */
    snprintf(out_json, sz,
             "{\"host\":\"%s\",\"host_ok\":%d,\"allowed\":%d,"
-             "\"dns_rc\":%d,\"ip\":\"%s\","
-             "\"dns_step\":%d,\"dns_errno\":%d,\"dns_recv\":%d,\"dns_ancount\":%d,"
+             "\"dns_rc\":%d,\"ip\":\"%s\",\"dns_source\":\"%s\",\"dns_trail\":\"%s\","
             "\"curl_ran\":%d,\"curl_rc\":%d,\"curl_err\":\"%s\",\"http_code\":%ld}",
-             host, hostrc == 0, allowrc, dnsrc, ip,
-             g_dns_step, g_dns_errno, g_dns_n, g_dns_ancount,
+             host, hostrc == 0, allowrc, dnsrc, a.n ? a.ip[0] : "", a.source, a.trail,
             did_curl, (int)res,
             did_curl ? curl_easy_strerror(res) : "n/a", http_code);
 }
@@ -1226,6 +1126,13 @@ patchdl_http_get(const char *url, patchdl_buf_t *out) {
    return -1; /* curl not available in this build; set CURL_DIR= to enable */
 }

+void
+patchdl_http_last_error(char *step, size_t step_sz, int *curl_rc, long *http_code) {
+    if (step && step_sz) snprintf(step, step_sz, "no_curl");
+    if (curl_rc) *curl_rc = 0;
+    if (http_code) *http_code = 0;
+}
+
 int
 patchdl_http_download(const char *url, const char *dest_path,
                      long long *bytes_out) {
@@ -57,6 +57,13 @@ typedef struct {
   piece list. Returns 0 on success (caller frees with patchdl_manifest_free),
   -1 on fetch/parse/tiling failure. */
 int  patchdl_fetch_manifest(const char *manifest_url, patchdl_manifest_t *out);
+
+/* Why this thread's last patchdl_http_get / patchdl_fetch_manifest failed:
+   step is "" on success, else e.g. "dns", "connect", "tls", "network",
+   "timeout", "redirect", "http_status", "bad_manifest". curl_rc and
+   http_code as seen. */
+void patchdl_http_last_error(char *step, size_t step_sz, int *curl_rc, long *http_code);
+
 void patchdl_manifest_free(patchdl_manifest_t *m);


@@ -10,6 +10,7 @@
 #include "patchdl_prospero.h"
 #include "patchdl_net.h"

+#include <ctype.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -79,25 +80,50 @@ json_success(const char *json) {
    return !strncmp(p, "true", 4);
 }

+/* PS5 titles live on Prospero Patches, PS4 titles on its sister site Orbis
+   Patches; both serve the same page and API. */
+const char *
+patchdl_patchsite_base(const char *title_id) {
+    return (title_id && !strncmp(title_id, "CUSA", 4))
+        ? "https://orbispatches.com" : PROSPERO_BASE;
+}
+
+/* The API key on the title page: Prospero puts it in data-key="<hex>",
+   Orbis in data-loadparams="{ 'titleid': ..., 'key': '<hex>' }". */
+static int
+extract_key(const char *html, char *out, size_t out_sz) {
+    const char *p;
+    size_t      len = 0;
+
+    if (!extract_data_key(html, out, out_sz)) return 0;
+    if (!(p = strstr(html, "'key': '"))) return -1;
+    p += strlen("'key': '");
+    while (isxdigit((unsigned char)p[len]) && len < out_sz - 1) len++;
+    if (!len || p[len] != '\'') return -1;
+    memcpy(out, p, len);
+    out[len] = '\0';
+    return 0;
+}
+
 int
-patchdl_prospero_query(const char *title_id, uint32_t fw_bin,
-                       patchdl_prospero_result_t *out) {
+patchdl_patchsite_versions(const char *title_id, patchdl_patch_version_t *out,
+                           int max, int *count) {
    patchdl_buf_t buf;
-    char url[256], key[128], body[256];
-    char best_ver[16] = {0}, best_size[16] = {0};
-    uint32_t best_fw = 0;
+    char          url[256], key[128], body[256];
+    const char   *base = patchdl_patchsite_base(title_id);
+    const char   *cur, *next;
+    int           n = 0;

-    if (!title_id || !out) return -1;
-    memset(out, 0, sizeof(*out));
+    *count = 0;
+    if (!title_id || !out || max <= 0) return -1;

-    /* Step 1: fetch the title page to get the data-key. */
+    /* Step 1: fetch the title page for the API key. */
    memset(&buf, 0, sizeof(buf));
    buf.max = BUF_MAX;
-    snprintf(url, sizeof(url), "%s/%.16s", PROSPERO_BASE, title_id);
+    snprintf(url, sizeof(url), "%s/%.16s", base, title_id);
    if (patchdl_http_get_external(url, &buf)) return -1;
    if (!buf.data) return -1;
-
-    if (extract_data_key(buf.data, key, sizeof(key))) {
+    if (extract_key(buf.data, key, sizeof(key))) {
        free(buf.data);
        return -1;
    }
@@ -108,50 +134,80 @@ patchdl_prospero_query(const char *title_id, uint32_t fw_bin,
       the website and every known third-party client calls it. */
    snprintf(body, sizeof(body),
             "{\"titleid\":\"%.16s\",\"key\":\"%s\"}", title_id, key);
-
+    snprintf(url, sizeof(url), "%s/api/internal/loadpatches", base);
    memset(&buf, 0, sizeof(buf));
    buf.max = BUF_MAX;
-    if (patchdl_http_post_external(
-            PROSPERO_API "/loadpatches",
+    if (patchdl_http_post_external(url,
            "application/x-www-form-urlencoded; charset=UTF-8",
            body, &buf)) return -1;
    if (!buf.data) return -1;
-
    if (!json_success(buf.data)) {
        free(buf.data);
        return -1;
    }

-    /* Walk the patches array. Each entry looks like:
-       {"content_ver":"01.003.000","required_firmware":"07.01.01.00",...}
-       Find the newest version whose firmware requirement is met. */
-    const char *cursor = buf.data;
-    while ((cursor = strstr(cursor, "\"content_ver\""))) {
-        char ver[16] = {0}, fw[32] = {0}, size[16] = {0};
+    /* Each entry starts with "is_latest" and carries content_ver (Prospero)
+       or version (Orbis), filesize and required_firmware. Bound each lookup
+       to its own entry. */
+    for (cur = strstr(buf.data, "\"is_latest\""); cur && n < max; cur = next) {
+        char  entry[2048], fw[32] = {0};
+        size_t len;
+        patchdl_patch_version_t *v = &out[n];

-        json_str_val(cursor, "content_ver", ver, sizeof(ver));
-        json_str_val(cursor, "filesize", size, sizeof(size));
-        json_str_val(cursor, "required_firmware", fw, sizeof(fw));
+        next = strstr(cur + 1, "\"is_latest\"");
+        len  = next ? (size_t)(next - cur) : strlen(cur);
+        if (len >= sizeof entry) len = sizeof entry - 1;
+        memcpy(entry, cur, len);
+        entry[len] = '\0';

-        if (ver[0] && fw[0]) {
-            uint32_t pkg_fw = fw_str_to_bin(fw);
-            if (pkg_fw <= fw_bin) {
-                if (!best_ver[0] || strcmp(ver, best_ver) > 0) {
-                    strncpy(best_ver, ver, sizeof(best_ver) - 1);
-                    memcpy(best_size, size, sizeof(best_size));
-                    best_fw = pkg_fw;
-                }
-            }
+        memset(v, 0, sizeof *v);
+        if (!json_str_val(entry, "content_ver", v->version, sizeof v->version))
+            json_str_val(entry, "version", v->version, sizeof v->version);
+        json_str_val(entry, "filesize", v->size, sizeof v->size);
+        json_str_val(entry, "required_firmware", fw, sizeof fw);
+        if (!v->version[0]) continue;
+        if (strchr(fw, '.') && strchr(strchr(fw, '.') + 1, '.')) {
+            /* PS5 style "07.01.01.00": packed like Sony's system_ver */
+            v->fw_bin = fw_str_to_bin(fw);
+            fw_bin_to_display(v->fw_bin, v->required_fw, sizeof v->required_fw);
+        } else {
+            /* PS4 style "3.00": a PS4 firmware, never a limit on the PS5 */
+            snprintf(v->required_fw, sizeof v->required_fw, "%s", fw);
+            v->fw_bin = 0;
        }
-        cursor++;
+        n++;
    }
    free(buf.data);
+    *count = n;
+    return 0;
+}

-    if (best_ver[0]) {
-        strncpy(out->version, best_ver, sizeof(out->version) - 1);
-        fw_bin_to_display(best_fw, out->required_fw, sizeof(out->required_fw));
-        memcpy(out->size, best_size, sizeof(out->size));
+int
+patchdl_prospero_query(const char *title_id, uint32_t fw_bin,
+                       patchdl_prospero_result_t *out) {
+    patchdl_patch_version_t *list;
+    int                      n = 0, best = -1;
+
+    if (!title_id || !out) return -1;
+    memset(out, 0, sizeof(*out));
+    /* The whole history: the newest versions may all need newer firmware. */
+    if (!(list = calloc(PATCHSITE_MAX_VERSIONS, sizeof *list))) return -1;
+    if (patchdl_patchsite_versions(title_id, list, PATCHSITE_MAX_VERSIONS, &n)) {
+        free(list);
+        return -1;
+    }
+
+    /* the newest version whose firmware requirement is met */
+    for (int i = 0; i < n; i++)
+        if (list[i].fw_bin <= fw_bin &&
+            (best < 0 || strcmp(list[i].version, list[best].version) > 0))
+            best = i;
+    if (best >= 0) {
+        snprintf(out->version, sizeof out->version, "%s", list[best].version);
+        snprintf(out->required_fw, sizeof out->required_fw, "%s", list[best].required_fw);
+        snprintf(out->size, sizeof out->size, "%s", list[best].size);
        out->found = 1;
    }
+    free(list);
    return 0;
 }
@@ -25,3 +25,22 @@ typedef struct {
   data, nothing breaks. */
 int patchdl_prospero_query(const char *title_id, uint32_t fw_bin,
                           patchdl_prospero_result_t *out);
+
+/* One patch version as Prospero Patches (PS5) or Orbis Patches (PS4) lists it. */
+typedef struct {
+    char     version[16];      /* "01.003.000" (PS5) or "01.07" (PS4) */
+    char     required_fw[16];  /* display form; for PS4 a PS4 firmware */
+    char     size[16];         /* the site's label, e.g. "8.7GB" */
+    uint32_t fw_bin;           /* PS5 firmware it needs, 0 for PS4 */
+} patchdl_patch_version_t;
+
+/* More versions than any game has had (the response is capped at 512 KB). */
+#define PATCHSITE_MAX_VERSIONS 512
+
+/* Base URL of the site that lists this title's patches. */
+const char *patchdl_patchsite_base(const char *title_id);
+
+/* Every version the site lists for title_id, newest first as the site
+   orders them. 0 on success with *count entries (up to max). */
+int patchdl_patchsite_versions(const char *title_id, patchdl_patch_version_t *out,
+                               int max, int *count);
@@ -26,6 +26,10 @@

 #define MAX_TITLES 512

+#ifndef PATCHDL_HTTP_PORT
+#define PATCHDL_HTTP_PORT 12880
+#endif
+
 static const char *SCAN_DIRS[] = {
    "/user/app",
    "/mnt/ext0/user/app",
@@ -373,6 +377,20 @@ scan_one(const char *base, const char *name, patchdl_title_t *t,
                       : (is_fake || t->pkg_sign == PATCHDL_PKG_FAKE)
                                                   ? PATCHDL_SOURCE_FAKE
                                                   : PATCHDL_SOURCE_UNKNOWN;
+        /* A Sony-signed package someone installed with another tool, often
+           to keep one exact app version. PatchDL's own installs name its
+           loopback server in app.json. An update would replace that
+           version. */
+        {
+            /* PatchDL installs from its server (loopback or LAN address,
+               both on its port) or, as a fallback, from its download folder
+               (/user/data/patchdl/...). app.json escapes slashes, so match
+               pieces without them. */
+            char port[16];
+            snprintf(port, sizeof port, ":%d", PATCHDL_HTTP_PORT);
+            t->sideloaded = is_fake && t->source_type == PATCHDL_SOURCE_OFFICIAL &&
+                            !strstr(appjson, port) && !strstr(appjson, "patchdl");
+        }
    } else if (is_shadow || has_mountlnk || has_paramjson ||
               path_exists(dir, "sce_sys/param.sfo")) {
        if (try_param_json(dir, t)) /* metadata from the mounted sce_sys */
@@ -38,6 +38,8 @@ typedef struct {
    char             version_file_uri[256]; /* from app.db, for version.xml */
    patchdl_source_t source_type;
    patchdl_pkg_sign_t pkg_sign;      /* app.pkg header verdict, for diagnostics */
+    int              sideloaded;       /* Sony-signed, but installed by another
+                                          tool (not Store, disc or PatchDL) */
    int              icon_fd;          /* open icon0.png, or -1; see patchdl_scan */
    /* populated by background verxml fetch — guarded by websrv mutex */
    char             compatible_version[16];
@@ -9,4 +9,4 @@

 #pragma once

-#define PATCHDL_VERSION "0.2.0"
+#define PATCHDL_VERSION "0.3.0"
@@ -13,6 +13,7 @@
 #include "patchdl_scan.h"
 #include "patchdl_install.h"
 #include "patchdl_net.h"
+#include "patchdl_dns.h"
 #include "patchdl_resolve.h"
 #include "patchdl_tile.h"
 #include "patchdl_verxml.h"
@@ -232,6 +233,7 @@ typedef struct dl_job {
    long long          verify_bytes;   /* bytes hashed so far */
    long long          free_bytes;     /* rc -3: bytes free on /data at the time */
    int                last_curl_rc;   /* CURLcode from the most recent piece */
+    char               fail_step[24];  /* why admit failed (manifest fetch), or "" */
    long               last_http_code; /* HTTP status from the most recent piece */
    struct dl_job     *next;
 } dl_job_t;
@@ -1018,6 +1020,12 @@ save_config(void) {
    for (size_t i = 0; i < g_title_count; i++)
        fprintf(f, "%s\"%s\":%s", i ? "," : "",
                g_titles[i].title_id, g_titles[i].enabled ? "true" : "false");
+    /* Sideloaded titles the user switched on, kept apart so a switch saved
+       before sideloaded titles started off can't turn one on. */
+    fprintf(f, "},\n\"sideload_updates\":{");
+    for (size_t i = 0, n = 0; i < g_title_count; i++)
+        if (g_titles[i].sideloaded && g_titles[i].enabled)
+            fprintf(f, "%s\"%s\":true", n++ ? "," : "", g_titles[i].title_id);
    fprintf(f, "}\n}\n");
    pthread_mutex_unlock(&g_mutex);

@@ -1026,27 +1034,46 @@ save_config(void) {

 /* Load persisted settings over the defaults. Called once at startup, after the
   scan, while still single-threaded. */
+/* The whole config file, malloc'd and NUL-terminated, or NULL. It holds a
+   switch per title (twice for sideloaded ones), so no fixed buffer. */
+static char *
+read_config_file(void) {
+    FILE  *f = fopen(PATCHDL_CFG_PATH, "r");
+    long   len;
+    char  *buf;
+    size_t n;
+
+    if (!f) return NULL;
+    if (fseek(f, 0, SEEK_END) || (len = ftell(f)) < 0 || len > 1024 * 1024 ||
+        fseek(f, 0, SEEK_SET) || !(buf = malloc((size_t)len + 1))) {
+        fclose(f);
+        return NULL;
+    }
+    n = fread(buf, 1, (size_t)len, f);
+    fclose(f);
+    buf[n] = '\0';
+    return buf;
+}
+
 /* Per-title overrides live under "titles": { "<id>": true|false, ... }. */
 static void
 overlay_title_policy(const char *cfg, patchdl_title_t *arr, size_t cnt) {
    const char *titles = strstr(cfg, "\"titles\"");
-    if (titles)
-        for (size_t i = 0; i < cnt; i++)
+    const char *side   = strstr(cfg, "\"sideload_updates\"");
+    for (size_t i = 0; i < cnt; i++) {
+        if (arr[i].sideloaded)   /* off unless switched on as sideloaded */
+            arr[i].enabled = side ? json_get_bool(side, arr[i].title_id, 0) : 0;
+        else if (titles)
            arr[i].enabled = json_get_bool(titles, arr[i].title_id, arr[i].enabled);
+    }
 }

 static void
 load_config(void) {
-    FILE  *f;
-    char   buf[16384];
-    size_t n;
+    char  *buf = read_config_file();
    char   pol[8];

-    f = fopen(PATCHDL_CFG_PATH, "r");
-    if (!f) return;
-    n = fread(buf, 1, sizeof(buf) - 1, f);
-    fclose(f);
-    buf[n] = '\0';
+    if (!buf) return;

    json_get_str(buf, "default_policy", pol, sizeof(pol));
    if (pol[0]) {
@@ -1067,24 +1094,20 @@ load_config(void) {
    if (g_cfg.max_connections > POOL_MAX_CONN) g_cfg.max_connections = POOL_MAX_CONN;

    overlay_title_policy(buf, g_titles, g_title_count);
+    free(buf);
 }

 /* Per-title switches for a freshly scanned list: unknown sources start off,
   a saved choice from config.json wins, and a fake package stays off. */
 static void
 apply_title_policy(patchdl_title_t *arr, size_t cnt) {
-    FILE  *f;
-    char   buf[16384];
-    size_t n = 0;
+    char *buf = read_config_file();

    for (size_t i = 0; i < cnt; i++)
-        arr[i].enabled = (arr[i].source_type != PATCHDL_SOURCE_UNKNOWN);
-    if ((f = fopen(PATCHDL_CFG_PATH, "r"))) {
-        n = fread(buf, 1, sizeof(buf) - 1, f);
-        fclose(f);
-    }
-    buf[n] = '\0';
-    overlay_title_policy(buf, arr, cnt);
+        arr[i].enabled = (arr[i].source_type != PATCHDL_SOURCE_UNKNOWN) &&
+                         !arr[i].sideloaded;
+    overlay_title_policy(buf ? buf : "", arr, cnt);
+    free(buf);
    for (size_t i = 0; i < cnt; i++)
        if (arr[i].source_type == PATCHDL_SOURCE_FAKE)
            arr[i].enabled = 0;
@@ -1202,6 +1225,7 @@ build_titles_json(void) {
        jbuf_appendf(&j, ",\"resumable\":%s", t->resumable ? "true" : "false");
        jbuf_appendf(&j, ",\"partial_bytes\":%lld", t->partial_bytes);
        jbuf_appendf(&j, ",\"downloaded\":%s", t->downloaded ? "true" : "false");
+        jbuf_appendf(&j, ",\"sideloaded\":%s", t->sideloaded ? "true" : "false");
        jbuf_append(&j, ",\"mode\":");
            jbuf_append_str(&j, title_mode_str(t->source_type));
        jbuf_append(&j, ",\"queued\":false");
@@ -1267,6 +1291,10 @@ build_downloads_json(void) {
        if (job->rc == -3)
            jbuf_appendf(&j, ",\"need_bytes\":%lld,\"free_bytes\":%lld",
                         job->need_bytes, job->free_bytes);
+        if (job->fail_step[0]) {
+            jbuf_append(&j, ",\"fail_step\":");
+            jbuf_append_str(&j, job->fail_step);
+        }
        jbuf_append(&j, "}");
    }
    jbuf_append(&j, "]");
@@ -1901,6 +1929,9 @@ admit_next(void) {
    char               murl[768], dest[320], dir[288];
    int                is_manifest, fd = -1, ok = 0, no_space = 0;
    unsigned char     *pre_done = NULL;   /* pieces proven good by hash */
+    char               fstep[24] = "";
+    int                fcurl = 0;
+    long               fhttp = 0;
    int                adopted = 0;
    long long          total = 0, old_size = 0, need = 0, free_b = 0;
    dl_pstate_t       *ps = NULL;
@@ -1925,7 +1956,10 @@ admit_next(void) {
    mkdir(PATCHDL_DL_DIR, 0777);
    mkdir(dir, 0777);
    if (is_manifest) {
-        if (patchdl_fetch_manifest(murl, &mf) == 0 && mf.count > 0) {
+        if (patchdl_fetch_manifest(murl, &mf) != 0 || mf.count <= 0) {
+            patchdl_http_last_error(fstep, sizeof fstep, &fcurl, &fhttp);
+            if (!fstep[0]) snprintf(fstep, sizeof fstep, "manifest");
+        } else {
            total = mf.total;
            adopted = adopt_by_size(dir, dest, total);
            need  = space_needed(dest, total);
@@ -2003,6 +2037,11 @@ admit_next(void) {
            q->rc = no_space ? -3 : -1;
            q->need_bytes = need;
            q->free_bytes = free_b;
+            /* the manifest fetch failed: say where, so a report can tell a
+               blocked host from a TLS or HTTP problem */
+            snprintf(q->fail_step, sizeof q->fail_step, "%s", fstep);
+            q->last_curl_rc   = fcurl;
+            q->last_http_code = fhttp;
        }
        pthread_cond_broadcast(&g_pool.cv);
        return;
@@ -2017,6 +2056,7 @@ admit_next(void) {
    free(q->bitmap); q->bitmap = NULL;
    q->done_bytes = 0; q->pieces_failed = 0; q->rc = 0;
    q->last_curl_rc = 0; q->last_http_code = 0;
+    q->fail_step[0] = '\0';

    q->mf = mf; q->ps = ps; q->bitmap = bitmap; q->fd = fd; q->total = total;
    for (int i = 0; i < mf.count; i++) q->ps[i].slot = -1;
@@ -2526,6 +2566,167 @@ build_storage_json(void) {
    return j.buf;
 }

+/* Host part of a URL into out ("" if none). */
+static void
+url_host_of(const char *url, char *out, size_t sz) {
+    const char *p = strstr(url, "://");
+    size_t      n;
+    out[0] = '\0';
+    if (!p) return;
+    p += 3;
+    n = strcspn(p, "/:?");
+    if (n < sz) { memcpy(out, p, n); out[n] = '\0'; }
+}
+
+/* GET /api/versions?title=<id>: every patch version Prospero Patches (PS5)
+   or Orbis Patches (PS4) lists for the game, each marked whether it can be
+   picked here: newer than the installed version and, on PS5, runnable on
+   this firmware. Older versions are not offered (no downgrades). */
+static enum MHD_Result
+queue_versions(struct MHD_Connection *conn, const char *tid) {
+    patchdl_patch_version_t *list;
+    char                     inst[16] = "", tid9[16];
+    int                      n = 0, ps4;
+    jbuf_t                   j = {0};
+
+    if (!path_segment_safe(tid) || strlen(tid) < 9 || strlen(tid) >= 32)
+        return queue_text(conn, MHD_HTTP_FORBIDDEN, "forbidden");
+    snprintf(tid9, sizeof tid9, "%.9s", tid);
+    ps4 = !strncmp(tid9, "CUSA", 4);
+    pthread_mutex_lock(&g_mutex);
+    for (size_t i = 0; i < g_title_count; i++)
+        if (!strcmp(g_titles[i].title_id, tid)) {
+            snprintf(inst, sizeof inst, "%s", g_titles[i].installed_version);
+            break;
+        }
+    pthread_mutex_unlock(&g_mutex);
+
+    if (!(list = calloc(PATCHSITE_MAX_VERSIONS, sizeof *list)))
+        return queue_text(conn, MHD_HTTP_INTERNAL_SERVER_ERROR, "oom");
+    if (patchdl_patchsite_versions(tid9, list, PATCHSITE_MAX_VERSIONS, &n)) {
+        free(list);
+        return queue_json(conn, MHD_HTTP_BAD_GATEWAY,
+                          "{\"ok\":false,\"reason\":\"versions_unavailable\"}");
+    }
+    jbuf_append(&j, "{\"ok\":true,\"site\":");
+    jbuf_append_str(&j, ps4 ? "Orbis Patches" : "Prospero Patches");
+    jbuf_appendf(&j, ",\"page\":\"%s/%s\",\"ps4\":%s,\"installed\":",
+                 patchdl_patchsite_base(tid9), tid9, ps4 ? "true" : "false");
+    jbuf_append_str(&j, inst);
+    jbuf_append(&j, ",\"versions\":[");
+    for (int i = 0; i < n; i++) {
+        const char *state =
+            inst[0] && !strcmp(list[i].version, inst)  ? "installed"
+          : inst[0] && strcmp(list[i].version, inst) < 0 ? "older"
+          : !ps4 && list[i].fw_bin > g_fw.bin          ? "needs_fw"
+                                                       : "ok";
+        jbuf_append(&j, i ? ",{\"version\":" : "{\"version\":");
+        jbuf_append_str(&j, list[i].version);
+        jbuf_append(&j, ",\"fw\":");    jbuf_append_str(&j, list[i].required_fw);
+        jbuf_append(&j, ",\"size\":");  jbuf_append_str(&j, list[i].size);
+        jbuf_append(&j, ",\"state\":"); jbuf_append_str(&j, state);
+        jbuf_append(&j, "}");
+    }
+    jbuf_append(&j, "]}");
+    free(list);
+    return queue_json_owned(conn, MHD_HTTP_OK, j.buf);
+}
+
+/* A fresh DNS answer for host as "ip", "ips", "dns" (where it came from)
+   and "dns_trail" (what failed before), so a report tells a blocked DNS
+   apart from a blocked connection. */
+static void
+append_dns(jbuf_t *j, const char *host) {
+    patchdl_dns_answer_t a;
+    char                 ips[PATCHDL_DNS_MAX_IPS * 16 + 8] = "";
+
+    memset(&a, 0, sizeof a);
+    if (host[0]) {
+        patchdl_dns_forget(host);
+        patchdl_dns_lookup(host, &a);
+    }
+    for (int i = 0; i < a.n; i++) {
+        size_t len = strlen(ips);
+        snprintf(ips + len, sizeof ips - len, "%s%s", i ? "," : "", a.ip[i]);
+    }
+    jbuf_append(j, ",\"ip\":");        jbuf_append_str(j, a.n ? a.ip[0] : "");
+    jbuf_append(j, ",\"ips\":");       jbuf_append_str(j, ips);
+    jbuf_append(j, ",\"dns\":");       jbuf_append_str(j, a.source);
+    jbuf_append(j, ",\"dns_trail\":"); jbuf_append_str(j, a.trail);
+}
+
+/* GET /api/netcheck?title=<id>: walk one title's update chain the way a
+   download does (update list, then the package manifest) and report each
+   step with PatchDL's own DNS answer, so a report shows where it breaks. */
+static enum MHD_Result
+queue_netcheck_title(struct MHD_Connection *conn, const char *tid) {
+    char              vurl[512] = "", host[128], step[24], tid9[16];
+    char              murl[768] = "", durl[512], ptid[16], pstid[16], cid[64];
+    char              nm[128], ver[16];
+    patchdl_source_t  src;
+    int               en;
+    char             *out;
+    int               curl_rc = 0, vrc, mrc = -1, pieces = 0;
+    long              http = 0;
+    patchdl_verinfo_t info;
+    patchdl_manifest_t mf;
+    jbuf_t            j = {0};
+
+    /* Same ids as the title actions; Sony's URLs use the 9-character id. */
+    if (!path_segment_safe(tid) || strlen(tid) < 9 || strlen(tid) >= 32)
+        return queue_text(conn, MHD_HTTP_FORBIDDEN, "forbidden");
+    snprintf(tid9, sizeof tid9, "%.9s", tid);
+    pthread_mutex_lock(&g_mutex);
+    for (size_t i = 0; i < g_title_count; i++)
+        if (!strncmp(g_titles[i].title_id, tid, 9)) {
+            snprintf(vurl, sizeof vurl, "%s", g_titles[i].version_file_uri);
+            break;
+        }
+    pthread_mutex_unlock(&g_mutex);
+    if (!vurl[0]) patchdl_resolve_url(tid9, vurl, sizeof vurl);
+
+    jbuf_append(&j, "{\"title_id\":");  jbuf_append_str(&j, tid);
+    jbuf_append(&j, ",\"update_list\":{\"url\":"); jbuf_append_str(&j, vurl);
+    url_host_of(vurl, host, sizeof host);
+    append_dns(&j, host);
+    memset(&info, 0, sizeof info);
+    vrc = vurl[0] ? patchdl_verxml_query(vurl, g_fw.bin, &info) : -1;
+    patchdl_http_last_error(step, sizeof step, &curl_rc, &http);
+    jbuf_appendf(&j, ",\"ok\":%s,\"curl\":%d,\"http\":%ld,\"step\":",
+                 vrc == 0 ? "true" : "false", curl_rc, http);
+    jbuf_append_str(&j, step);
+    jbuf_append(&j, ",\"latest\":"); jbuf_append_str(&j, info.latest_version);
+    /* The package a download would use: a pasted Prospero link wins over
+       Sony's current list, exactly as for the download itself. */
+    if (!get_title_action_info(tid, &src, murl, sizeof murl, durl, sizeof durl,
+                               ptid, sizeof ptid, pstid, sizeof pstid,
+                               cid, sizeof cid, nm, sizeof nm, ver, sizeof ver, &en) ||
+        !murl[0])
+        snprintf(murl, sizeof murl, "%s", info.compatible_url);
+    jbuf_append(&j, "},\"manifest\":{\"url\":"); jbuf_append_str(&j, murl);
+    url_host_of(murl, host, sizeof host);
+    append_dns(&j, host);
+    memset(&mf, 0, sizeof mf);
+    step[0] = '\0'; curl_rc = 0; http = 0;
+    if (url_is_manifest(murl)) {
+        mrc = patchdl_fetch_manifest(murl, &mf);
+        patchdl_http_last_error(step, sizeof step, &curl_rc, &http);
+        pieces = mf.count;
+        patchdl_manifest_free(&mf);
+    } else if (murl[0]) {
+        /* a single package without a piece list: nothing to fetch here */
+        mrc = 0;
+        pieces = 1;
+        snprintf(step, sizeof step, "direct");
+    }
+    jbuf_appendf(&j, ",\"ok\":%s,\"pieces\":%d,\"curl\":%d,\"http\":%ld,\"step\":",
+                 mrc == 0 ? "true" : "false", pieces, curl_rc, http);
+    jbuf_append_str(&j, step);
+    jbuf_append(&j, "}}");
+    out = j.buf;
+    return queue_json_owned(conn, MHD_HTTP_OK, out);
+}
+
 static enum MHD_Result
 do_install(struct MHD_Connection *conn, const char *title_id,
           patchdl_source_t src, const char *patch_url, const char *delta_url,
@@ -2655,6 +2856,7 @@ manifest_from_link(const char *tid, const char *in, char *canon, size_t sz) {
    char        tag[16];
    const char *p, *rest, *base, *stem_end = NULL;
    size_t      n = strlen(in);
+    int         ps4_piece = 0;

    /* The URL ends up unescaped in JSON sidecars and responses, and dot
       segments could walk the path into another title's folder. */
@@ -2671,6 +2873,16 @@ manifest_from_link(const char *tid, const char *in, char *canon, size_t sz) {
        size_t el = strlen(ends[i]);
        if (n > el && !strcmp(in + n - el, ends[i])) { stem_end = in + n - el; break; }
    }
+    /* PS4: Orbis Patches lists the pieces, which sit in the same gs2 folder
+       as the manifest "<name>.json": "<name>_0.pkg", "_1.pkg", ... for a
+       split package, or just "<name>.pkg" when it is a single piece. */
+    if (!stem_end && !strncmp(rest, "gs2.ww.prod.dl.playstation.net/", 31) &&
+        n > 5 && !strcmp(in + n - 4, ".pkg")) {
+        const char *d = in + n - 4;
+        while (d > in && isdigit((unsigned char)d[-1])) d--;
+        stem_end = (d < in + n - 4 && d > in && d[-1] == '_') ? d - 1 : in + n - 4;
+        ps4_piece = 1;
+    }
    if (!stem_end)                  return "not_an_sc_link";
    base = strrchr(in, '/') + 1;    /* the scheme guarantees a '/' */
    if (stem_end <= base)           return "not_an_sc_link";
@@ -2682,10 +2894,12 @@ manifest_from_link(const char *tid, const char *in, char *canon, size_t sz) {
    tag[0] = '-';
    if (!strstr(base, tag))         return "url_title_mismatch";

-    /* Manifests are fetched over https with the pinned Sony root. */
+    /* PS5 manifests are fetched over https with the pinned Sony root; PS4
+       manifests only exist over plain http on gs2 (see PLAIN_HTTP_HOST). */
    if (sizeof("https://") - 1 + (size_t)(stem_end - rest) + sizeof(".json") > sz)
        return "url_too_long";
-    snprintf(canon, sz, "https://%.*s.json", (int)(stem_end - rest), rest);
+    snprintf(canon, sz, "%s%.*s.json", ps4_piece ? "http://" : "https://",
+             (int)(stem_end - rest), rest);
    return NULL;
 }

@@ -2694,23 +2908,30 @@ manifest_from_link(const char *tid, const char *in, char *canon, size_t sz) {
   for `ver`, i.e. the user most likely copied a link of another version.
   Versions of (nearly) equal size can't be told apart this way. */
 static int
-size_mismatch(const char *tid, const char *ver, long long found,
-              char *label, size_t lsz) {
+size_mismatch(const char *tid, const char *ver, const char *given_size,
+              long long found, char *label, size_t lsz) {
    char   lbl[16] = {0}, pver[16] = {0}, unit[8] = {0};
    double v, unit_bytes, expect, diff, tol;

-    pthread_mutex_lock(&g_mutex);
-    for (size_t i = 0; i < g_title_count; i++)
-        if (!strcmp(g_titles[i].title_id, tid)) {
-            memcpy(lbl, g_titles[i].prospero_size, sizeof lbl - 1);
-            memcpy(pver, g_titles[i].prospero_version, sizeof pver - 1);
-            break;
-        }
-    pthread_mutex_unlock(&g_mutex);
+    if (given_size && given_size[0]) {
+        /* the size the version list showed for the version picked */
+        snprintf(lbl, sizeof lbl, "%s", given_size);
+        snprintf(pver, sizeof pver, "%s", ver);
+    } else {
+        pthread_mutex_lock(&g_mutex);
+        for (size_t i = 0; i < g_title_count; i++)
+            if (!strcmp(g_titles[i].title_id, tid)) {
+                memcpy(lbl, g_titles[i].prospero_size, sizeof lbl - 1);
+                memcpy(pver, g_titles[i].prospero_version, sizeof pver - 1);
+                break;
+            }
+        pthread_mutex_unlock(&g_mutex);
+    }
    for (char *c = lbl; *c; c++)          /* external text, echoed into JSON */
        if (!isalnum((unsigned char)*c) && *c != '.' && *c != ' ') *c = '?';
    snprintf(label, lsz, "%s", lbl);

+    /* "8.7GB" (Orbis) and "71.7 GB" (Prospero) */
    if (strcmp(pver, ver) || sscanf(lbl, "%lf %7s", &v, unit) != 2) return 0;
    if (!strcmp(unit, "TB"))      unit_bytes = 1099511627776.0;
    else if (!strcmp(unit, "GB")) unit_bytes = 1073741824.0;
@@ -2730,7 +2951,7 @@ size_mismatch(const char *tid, const char *ver, long long found,
 static enum MHD_Result
 handle_download_url(struct MHD_Connection *conn, const char *body) {
    char             tid[32], in[768], ver[16], canon[512], state[320], resp[192];
-    char             expect[16];
+    char             expect[16], given[16] = "";
    patchdl_manifest_t mf;
    char             purl[512], durl[512], ptid[16], pstid[16];
    char             cid[64], tname[128], tv[16];
@@ -2802,7 +3023,8 @@ handle_download_url(struct MHD_Connection *conn, const char *body) {
            return queue_json_owned(conn, 507, strdup(resp));
        }
    }
-    if (size_mismatch(tid, ver, found, expect, sizeof expect) &&
+    json_get_str(body, "size", given, sizeof given);
+    if (size_mismatch(tid, ver, given, found, expect, sizeof expect) &&
        !json_get_bool(body, "force", 0)) {
        snprintf(resp, sizeof resp,
                 "{\"ok\":false,\"reason\":\"size_mismatch\","
@@ -3375,6 +3597,15 @@ on_request(void *cls, struct MHD_Connection *conn, const char *url,
        return queue_json_owned(conn, MHD_HTTP_OK, strdup(resp));
    }

+    if (!strcmp(url, "/api/versions")) {
+        const char *want = MHD_lookup_connection_value(conn, MHD_GET_ARGUMENT_KIND, "title");
+        return queue_versions(conn, want ? want : "");
+    }
+    if (!strcmp(url, "/api/netcheck")) {
+        const char *want = MHD_lookup_connection_value(conn, MHD_GET_ARGUMENT_KIND, "title");
+        if (want && want[0])
+            return queue_netcheck_title(conn, want);
+    }
    if (!strcmp(url, "/api/netcheck")) {
        char diag[1024] = "{\"error\":\"no title with version_file_uri\"}";
        char uri[256] = "";
@@ -3448,7 +3679,11 @@ stop_verxml(void) {
   and the rescan isn't an explicit refresh; otherwise it runs again. */
 static void
 carry_title_state(patchdl_title_t *dst, const patchdl_title_t *src, int recheck) {
-    dst->enabled       = src->enabled;
+    /* A title that turned sideloaded (or back) keeps the switch its new
+       state starts with, so a sideloaded copy is never updated without the
+       user switching it on. */
+    if (dst->sideloaded == src->sideloaded)
+        dst->enabled = src->enabled;
    dst->resumable     = src->resumable;
    dst->partial_bytes = src->partial_bytes;
    dst->downloaded    = src->downloaded;
@@ -3662,7 +3897,8 @@ patchdl_websrv_start(unsigned short port) {
    /* Default per-title policy (unknown sources off), then overlay anything the
       user previously saved to /data/patchdl/config.json. */
    for (size_t i = 0; i < g_title_count; i++)
-        g_titles[i].enabled = (g_titles[i].source_type != PATCHDL_SOURCE_UNKNOWN);
+        g_titles[i].enabled = (g_titles[i].source_type != PATCHDL_SOURCE_UNKNOWN) &&
+                              !g_titles[i].sideloaded;
    load_config();
    /* A saved config must not switch a fake package back on. */
    for (size_t i = 0; i < g_title_count; i++)
@@ -31,34 +31,58 @@
      <symbol id="icon-grid" viewBox="0 0 24 24">
        <path d="M4 4h7v7H4zM13 4h7v7h-7zM4 13h7v7H4zM13 13h7v7h-7z" />
      </symbol>
+      <symbol id="icon-close" viewBox="0 0 24 24">
+        <path d="M6 6l12 12M18 6L6 18" />
+      </symbol>
+      <symbol id="icon-arrow" viewBox="0 0 24 24">
+        <path d="M5 12h14" /><path d="M13 6l6 6-6 6" />
+      </symbol>
+      <symbol id="icon-layers" viewBox="0 0 24 24">
+        <path d="M12 3l9 5-9 5-9-5 9-5z" /><path d="M3 13l9 5 9-5" />
+      </symbol>
+      <symbol id="icon-alert" viewBox="0 0 24 24">
+        <path d="M12 3l10 18H2L12 3z" /><path d="M12 10v5" /><path d="M12 18h.01" />
+      </symbol>
+      <symbol id="icon-check" viewBox="0 0 24 24">
+        <path d="M5 12.5l4.5 4.5L19 7" />
+      </symbol>
+      <symbol id="icon-lock" viewBox="0 0 24 24">
+        <path d="M6 11h12v10H6z" /><path d="M8.5 11V8a3.5 3.5 0 0 1 7 0v3" />
+      </symbol>
+      <symbol id="icon-external" viewBox="0 0 24 24">
+        <path d="M14 4h6v6" /><path d="M20 4l-9 9" /><path d="M18 14v6H4V6h6" />
+      </symbol>
+      <symbol id="icon-chevron" viewBox="0 0 24 24">
+        <path d="M9 6l6 6-6 6" />
+      </symbol>
    </svg>

    <div class="app-shell">
-      <aside class="rail" aria-label="Navigation">
+      <aside class="rail" aria-label="Navigation" data-i18n-aria-label="nav.label">
        <div class="brand">
          <div class="brand-mark">PD</div>
          <div>
            <strong>PatchDL</strong>
-            <span>by Knutwurst · <span id="brandVersion">--</span></span>
+            <span><span class="brand-by" data-i18n="brand.by">by Knutwurst</span> · <span id="brandVersion">--</span></span>
          </div>
        </div>

-        <nav class="nav-list" aria-label="Sections">
-          <button class="nav-link is-active" data-view="games" aria-label="Games" aria-current="page">
-            <svg><use href="#icon-grid"></use></svg><span>Games</span>
+        <nav class="nav-list" aria-label="Sections" data-i18n-aria-label="nav.sections">
+          <button class="nav-link is-active" data-view="games" aria-label="Games" data-i18n-aria-label="nav.games" aria-current="page">
+            <svg><use href="#icon-grid"></use></svg><span data-i18n="nav.games">Games</span>
          </button>
-          <button class="nav-link" data-view="settings" aria-label="Settings">
-            <svg><use href="#icon-settings"></use></svg><span>Settings</span>
+          <button class="nav-link" data-view="settings" aria-label="Settings" data-i18n-aria-label="nav.settings">
+            <svg><use href="#icon-settings"></use></svg><span data-i18n="nav.settings">Settings</span>
          </button>
-          <button class="nav-link" data-view="logs" aria-label="Logs">
-            <svg><use href="#icon-log"></use></svg><span>Logs</span>
+          <button class="nav-link" data-view="logs" aria-label="Logs" data-i18n-aria-label="nav.logs">
+            <svg><use href="#icon-log"></use></svg><span data-i18n="nav.logs">Logs</span>
          </button>
        </nav>

        <div class="rail-foot">
          <span id="railFw">FW --</span>
-          <span id="railSpace">-- free</span>
-          <button type="button" class="link-button rail-donate" data-donate>Buy me a coffee</button>
+          <span id="railSpace" data-i18n="rail.freeUnknown">-- free</span>
+          <button type="button" class="link-button rail-donate" data-donate data-i18n="donate.button">Buy me a coffee</button>
        </div>
      </aside>

@@ -67,15 +91,15 @@
        <section class="view is-active" data-view="games">
          <header class="topbar">
            <div>
-              <p class="eyebrow">PS5 &amp; PS4 game updates</p>
-              <h1>Games</h1>
+              <p class="eyebrow" data-i18n="games.eyebrow">PS5 &amp; PS4 game updates</p>
+              <h1 data-i18n="games.title">Games</h1>
            </div>
            <div class="topbar-actions">
-              <button class="primary-button" id="updateAllBtn" title="Download (and optionally install) every game that has an available, allowed update">
+              <button class="primary-button" id="updateAllBtn" title="Download (and optionally install) every game that has an available, allowed update" data-i18n-title="games.updateAllTitle">
                <svg><use href="#icon-download"></use></svg>
-                Update all
+                <span data-i18n="games.updateAll">Update all</span>
              </button>
-              <button class="icon-button" id="refreshBtn" title="Refresh status and games" aria-label="Refresh">
+              <button class="icon-button" id="refreshBtn" title="Refresh status and games" data-i18n-title="games.refreshTitle" aria-label="Refresh" data-i18n-aria-label="games.refresh">
                <svg><use href="#icon-refresh"></use></svg>
              </button>
            </div>
@@ -86,7 +110,7 @@
              <span class="global-dl-pulse" aria-hidden="true"></span>
              <div class="global-dl-text">
                <div class="global-dl-line1">
-                  <span class="global-dl-eyebrow" id="globalDlState">Downloading</span>
+                  <span class="global-dl-eyebrow" id="globalDlState" data-i18n="dl.downloading">Downloading</span>
                  <strong class="global-dl-name" id="globalDlName">—</strong>
                  <span class="global-dl-position" id="globalDlPosition" hidden></span>
                </div>
@@ -104,39 +128,39 @@
            </div>
          </aside>

-          <section class="status-strip" aria-label="System status">
+          <section class="status-strip" aria-label="System status" data-i18n-aria-label="status.label">
            <article class="metric">
-              <span>Firmware</span>
+              <span data-i18n="metric.firmware">Firmware</span>
              <strong id="firmwareValue">--</strong>
-              <em id="firmwareBuild">System version</em>
+              <em id="firmwareBuild" data-i18n="metric.firmwareBuild">System version</em>
            </article>
            <article class="metric">
-              <span>DNS Guard</span>
+              <span data-i18n="metric.dns">DNS Guard</span>
              <strong id="dnsValue">--</strong>
-              <em>System DNS left untouched</em>
+              <em data-i18n="metric.dnsNote">System DNS left untouched</em>
            </article>
            <article class="metric">
-              <span>CDN Access</span>
+              <span data-i18n="metric.cdn">CDN Access</span>
              <strong id="resolverValue">--</strong>
-              <em>PatchDL resolver only</em>
+              <em data-i18n="metric.cdnNote">PatchDL resolver only</em>
            </article>
            <article class="metric">
-              <span>Storage</span>
+              <span data-i18n="metric.storage">Storage</span>
              <strong id="spaceValue">--</strong>
-              <em id="downloadDirValue">Download target</em>
+              <em id="downloadDirValue" data-i18n="metric.downloadTarget">Download target</em>
            </article>
          </section>

          <div class="toolbar">
            <div class="search-box">
              <svg><use href="#icon-search"></use></svg>
-              <input id="searchInput" type="search" placeholder="Search title, Title ID, or Content ID" />
+              <input id="searchInput" type="search" placeholder="Search title, Title ID, or Content ID" data-i18n-placeholder="search.placeholder" />
            </div>
-            <div class="segmented" role="group" aria-label="Filter">
-              <button class="is-selected" data-filter="updates" aria-pressed="true">Updates <span class="chip-count"></span></button>
-              <button data-filter="uptodate" aria-pressed="false">Up to date <span class="chip-count"></span></button>
-              <button data-filter="blocked" aria-pressed="false">Not supported <span class="chip-count"></span></button>
-              <button data-filter="all" aria-pressed="false">All <span class="chip-count"></span></button>
+            <div class="segmented" role="group" aria-label="Filter" data-i18n-aria-label="filter.label">
+              <button class="is-selected" data-filter="updates" aria-pressed="true"><span data-i18n="filter.updates">Updates</span> <span class="chip-count"></span></button>
+              <button data-filter="uptodate" aria-pressed="false"><span data-i18n="filter.uptodate">Up to date</span> <span class="chip-count"></span></button>
+              <button data-filter="blocked" aria-pressed="false"><span data-i18n="filter.blocked">Not supported</span> <span class="chip-count"></span></button>
+              <button data-filter="all" aria-pressed="false"><span data-i18n="filter.all">All</span> <span class="chip-count"></span></button>
            </div>
          </div>

@@ -147,13 +171,13 @@
        <section class="view" data-view="settings">
          <header class="topbar">
            <div>
-              <p class="eyebrow">Policy</p>
-              <h1>Settings</h1>
+              <p class="eyebrow" data-i18n="settings.eyebrow">Policy</p>
+              <h1 data-i18n="settings.title">Settings</h1>
            </div>
            <div class="topbar-actions">
              <button class="primary-button" id="saveBtn">
                <svg><use href="#icon-save"></use></svg>
-                Save
+                <span data-i18n="settings.save">Save</span>
              </button>
            </div>
          </header>
@@ -161,89 +185,94 @@
          <div class="panel">
            <div class="settings-grid">
              <label class="field">
-                <span>Default Policy</span>
+                <span data-i18n="settings.defaultPolicy">Default Policy</span>
                <select id="defaultPolicy">
-                  <option value="deny">Deny by default</option>
-                  <option value="allow">Allow by default</option>
+                  <option value="deny" data-i18n="settings.policyDeny">Deny by default</option>
+                  <option value="allow" data-i18n="settings.policyAllow">Allow by default</option>
                </select>
              </label>
              <label class="field">
-                <span>Download Folder</span>
+                <span data-i18n="settings.downloadFolder">Download Folder</span>
                <input id="downloadDir" type="text" spellcheck="false" readonly
-                       title="Patches always download to the console's internal storage" />
+                       title="Patches always download to the console's internal storage"
+                       data-i18n-title="settings.downloadFolderTitle" />
+              </label>
+              <label class="field">
+                <span data-i18n="settings.language">Language</span>
+                <select id="language"></select>
              </label>

              <label class="switch-row">
                <span>
-                  <strong>Install after download</strong>
-                  <em>Global default, overridable per game</em>
+                  <strong data-i18n="settings.installAfter">Install after download</strong>
+                  <em data-i18n="settings.installAfterHint">Global default, overridable per game</em>
                </span>
                <span class="toggle">
-                  <input id="installAfterDownload" type="checkbox" aria-label="Install after download" />
+                  <input id="installAfterDownload" type="checkbox" aria-label="Install after download" data-i18n-aria-label="settings.installAfter" />
                  <span class="track"></span>
                </span>
              </label>
              <label class="switch-row">
                <span>
-                  <strong>Delete PKG after install</strong>
-                  <em>Only after a successful install</em>
+                  <strong data-i18n="settings.deleteAfter">Delete PKG after install</strong>
+                  <em data-i18n="settings.deleteAfterHint">Only after a successful install</em>
                </span>
                <span class="toggle">
-                  <input id="deleteAfterInstall" type="checkbox" aria-label="Delete package after install" />
+                  <input id="deleteAfterInstall" type="checkbox" aria-label="Delete package after install" data-i18n-aria-label="settings.deleteAfterAria" />
                  <span class="track"></span>
                </span>
              </label>
              <label class="switch-row">
                <span>
-                  <strong>Verify downloaded pieces (SHA-256)</strong>
-                  <em>Checks each manifest piece; off by default, verify on-device first</em>
+                  <strong data-i18n="settings.verify">Verify downloaded pieces (SHA-256)</strong>
+                  <em data-i18n="settings.verifyHint">Checks each manifest piece; off by default, verify on-device first</em>
                </span>
                <span class="toggle">
-                  <input id="verifyDownloads" type="checkbox" aria-label="Verify downloaded pieces" />
+                  <input id="verifyDownloads" type="checkbox" aria-label="Verify downloaded pieces" data-i18n-aria-label="settings.verifyAria" />
                  <span class="track"></span>
                </span>
              </label>
              <label class="switch-row">
                <span>
-                  <strong>Home-screen shortcut</strong>
-                  <em id="shortcutHint">Add a PS5 home-screen icon that opens this UI in the browser</em>
+                  <strong data-i18n="settings.shortcut">Home-screen shortcut</strong>
+                  <em id="shortcutHint" data-i18n="settings.shortcutHint">Add a PS5 home-screen icon that opens this UI in the browser</em>
                </span>
                <span class="toggle">
-                  <input id="homeShortcut" type="checkbox" aria-label="Install home-screen shortcut" />
+                  <input id="homeShortcut" type="checkbox" aria-label="Install home-screen shortcut" data-i18n-aria-label="settings.shortcutAria" />
                  <span class="track"></span>
                </span>
              </label>
              <div class="switch-row">
                <span>
-                  <strong>Parallel download connections</strong>
-                  <em>1–16 · applies live, no payload restart</em>
+                  <strong data-i18n="settings.connections">Parallel download connections</strong>
+                  <em data-i18n="settings.connectionsHint">1–16 · applies live, no payload restart</em>
                </span>
-                <div class="stepper" role="group" aria-label="Parallel download connections">
-                  <button type="button" class="stepper-btn" id="connMinus" aria-label="Fewer connections">−</button>
+                <div class="stepper" role="group" aria-label="Parallel download connections" data-i18n-aria-label="settings.connections">
+                  <button type="button" class="stepper-btn" id="connMinus" aria-label="Fewer connections" data-i18n-aria-label="settings.connFewer">−</button>
                  <output class="stepper-value" id="connValue" aria-live="polite">4</output>
-                  <button type="button" class="stepper-btn" id="connPlus" aria-label="More connections">+</button>
+                  <button type="button" class="stepper-btn" id="connPlus" aria-label="More connections" data-i18n-aria-label="settings.connMore">+</button>
                </div>
              </div>
            </div>

            <div class="allowlist">
-              <span>Internal CDN Allowlist</span>
+              <span data-i18n="settings.allowlist">Internal CDN Allowlist</span>
              <div id="allowlistHosts"></div>
            </div>

            <div class="source-policy">
-              <span>Install Protection</span>
+              <span data-i18n="settings.installProtection">Install Protection</span>
              <div id="sourcePolicyList"></div>
            </div>

            <div class="storage-list">
-              <span>Downloads on console <em id="storageTotal"></em></span>
+              <span><span data-i18n="settings.storage">Downloads on console</span> <em id="storageTotal"></em></span>
              <div id="storageList"></div>
            </div>

            <div class="donate-row">
-              <span>Like PatchDL? You can buy me a coffee.</span>
-              <button type="button" class="row-button is-ghost" data-donate>Buy me a coffee</button>
+              <span data-i18n="settings.donateText">Like PatchDL? You can buy me a coffee.</span>
+              <button type="button" class="row-button is-ghost" data-donate data-i18n="donate.button">Buy me a coffee</button>
            </div>
          </div>
        </section>
@@ -252,11 +281,11 @@
        <section class="view" data-view="logs">
          <header class="topbar">
            <div>
-              <p class="eyebrow">Runtime</p>
-              <h1>Logs</h1>
+              <p class="eyebrow" data-i18n="logs.eyebrow">Runtime</p>
+              <h1 data-i18n="logs.title">Logs</h1>
            </div>
            <div class="topbar-actions">
-              <button class="icon-button" id="clearLogBtn" title="Clear log" aria-label="Clear log">
+              <button class="icon-button" id="clearLogBtn" title="Clear log" data-i18n-title="logs.clear" aria-label="Clear log" data-i18n-aria-label="logs.clear">
                <svg><use href="#icon-log"></use></svg>
              </button>
            </div>
@@ -267,6 +296,7 @@
    </div>

    <div class="toast" id="toast" role="status" aria-live="polite"></div>
+    <script src="i18n.js"></script>
    <script src="app.js"></script>
  </body>
 </html>
@@ -1,11 +1,13 @@
 :root {
  color-scheme: dark;
-  --bg: #0b0d10;
-  --surface: #14181d;
-  --surface-2: #1b2027;
-  --ink: #edf2f7;
-  --muted: #9aa6b2;
-  --border: #2a313a;
+  --bg: #0a0c0f;
+  --surface: #13171c;
+  --surface-2: #1a1f26;
+  --surface-3: #212731;
+  --ink: #eef2f6;
+  --muted: #a4afba;
+  --border: #262d36;
+  --border-strong: #36404b;
  --green: #38c172;
  --green-dark: #63d994;
  --green-soft: rgba(56, 193, 114, 0.16);
@@ -18,7 +20,12 @@
  --blue-dark: #8cc2ff;
  --blue-soft: rgba(88, 166, 255, 0.16);
  --shadow: 0 18px 50px rgba(0, 0, 0, 0.38);
-  --radius: 10px;
+  --radius: 12px;
+  --focus: 0 0 0 3px rgba(88, 166, 255, 0.55);
+  --fs-xs: 13px;
+  --fs-sm: 14px;
+  --fs-md: 16px;
+  --ease: cubic-bezier(0.2, 0.8, 0.2, 1);
  --rail-w: 240px;
  font-family: Inter, ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
 }
@@ -30,9 +37,23 @@ body {
  min-height: 100dvh;
  background: var(--bg);
  color: var(--ink);
+  font-size: var(--fs-md);
+  line-height: 1.5;
  -webkit-text-size-adjust: 100%;
 }

+/* One focus ring for everything the controller, keyboard or a phone can
+   reach. */
+:where(button, a, summary, select, input, textarea, [tabindex]):focus-visible {
+  outline: none;
+  box-shadow: var(--focus);
+}
+
+.visually-hidden {
+  position: absolute; width: 1px; height: 1px; margin: -1px;
+  overflow: hidden; clip: rect(0 0 0 0); white-space: nowrap;
+}
+
 button, input, select { font: inherit; }
 button { cursor: pointer; }

@@ -82,7 +103,8 @@ svg {
 }

 .brand strong { display: block; font-size: 16px; }
-.brand span { display: block; margin-top: 2px; color: var(--muted); font-size: 12px; }
+.brand span { display: block; margin-top: 2px; color: var(--muted); font-size: var(--fs-xs); }
+.brand .brand-by { display: inline; margin-top: 0; }

 .nav-list { display: grid; gap: 6px; }

@@ -113,7 +135,7 @@ svg {
  border-radius: 8px;
  background: var(--surface);
  color: var(--muted);
-  font-size: 12px;
+  font-size: var(--fs-xs);
 }
 .rail-foot span { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 .rail-foot .rail-donate { justify-self: start; margin-top: 4px; }
@@ -132,6 +154,25 @@ svg {
  color: var(--muted);
 }
 .donate-row .row-button { width: auto; padding: 0 16px; }
+.diag-body { display: grid; gap: 14px; }
+.diag-list { display: grid; gap: 8px; margin: 0; padding: 0; list-style: none; }
+.diag-row { display: grid; grid-template-columns: 22px minmax(0, 1fr); gap: 8px; align-items: start; }
+.diag-row > b { font-size: 16px; }
+.diag-row.is-ok > b { color: var(--green); }
+.diag-row.is-bad > b { color: var(--red); }
+.diag-row em { color: var(--muted); font-style: normal; font-size: var(--fs-sm); }
+.diag-report {
+  width: 100%;
+  box-sizing: border-box;
+  padding: 10px;
+  border: 1px solid var(--border);
+  border-radius: 8px;
+  background: var(--surface-2);
+  color: var(--ink);
+  font: 12px/1.45 ui-monospace, SFMono-Regular, Menlo, monospace;
+  resize: vertical;
+}
+.diag-copy { justify-self: start; width: auto; padding: 0 18px; }
 .donate-open { display: inline-flex; align-items: center; justify-content: center; text-decoration: none; justify-self: start; padding: 0 18px; }

 /* ---------------- views + topbar ---------------- */
@@ -153,8 +194,9 @@ svg {
 .eyebrow {
  margin: 0 0 6px;
  color: var(--green-dark);
-  font-size: 11px;
+  font-size: 12px;
  font-weight: 800;
+  letter-spacing: 0.06em;
  text-transform: uppercase;
 }

@@ -169,15 +211,20 @@ h2 { font-size: 18px; line-height: 1.2; }
  align-items: center;
  justify-content: center;
  gap: 8px;
-  min-height: 40px;
+  min-height: 44px;
  border: 1px solid var(--border);
  background: var(--surface);
  color: var(--ink);
-  border-radius: 8px;
+  border-radius: 10px;
  font-weight: 700;
+  font-size: var(--fs-sm);
+  transition: background 150ms ease, border-color 150ms ease, color 150ms ease, transform 90ms ease;
+  -webkit-tap-highlight-color: transparent;
 }
+.icon-button:hover { border-color: var(--border-strong); background: var(--surface-2); }
+.icon-button:active, .primary-button:active, .row-button:not(:disabled):active { transform: scale(0.97); }

-.icon-button { width: 40px; padding: 0; flex: none; }
+.icon-button { width: 44px; padding: 0; flex: none; }
 .primary-button { padding: 0 16px; border-color: var(--green-dark); background: var(--green); color: #fff; }
 .primary-button:hover { background: var(--green-dark); }

@@ -243,7 +290,7 @@ h2 { font-size: 18px; line-height: 1.2; }
 }
 .global-dl-eyebrow {
  text-transform: uppercase; letter-spacing: 0.08em;
-  font-size: 11px; font-weight: 600; color: var(--green-dark);
+  font-size: 12px; font-weight: 600; color: var(--green-dark);
 }
 .global-dl-name {
  font-size: 16px; font-weight: 600; color: #fff;
@@ -251,7 +298,7 @@ h2 { font-size: 18px; line-height: 1.2; }
  min-width: 0; flex: 1;
 }
 .global-dl-position {
-  font-size: 12px; color: var(--muted);
+  font-size: var(--fs-xs); color: var(--muted);
  padding: 2px 8px; border-radius: 999px;
  background: rgba(255, 255, 255, 0.04); border: 1px solid var(--border);
 }
@@ -259,7 +306,7 @@ h2 { font-size: 18px; line-height: 1.2; }

 .global-dl-line2 {
  display: flex; align-items: center; gap: 8px;
-  font-size: 12px; color: var(--muted);
+  font-size: var(--fs-xs); color: var(--muted);
  font-variant-numeric: tabular-nums;
 }
 .global-dl-line2 b { color: #d6dde4; font-weight: 600; }
@@ -300,7 +347,7 @@ h2 { font-size: 18px; line-height: 1.2; }
 .metric span, .metric em {
  display: block;
  color: var(--muted);
-  font-size: 12px;
+  font-size: var(--fs-xs);
  font-style: normal;
 }

@@ -370,15 +417,17 @@ h2 { font-size: 18px; line-height: 1.2; }
  border: 1px solid var(--border);
  background: var(--surface);
  border-radius: var(--radius);
+  transition: border-color 150ms ease;
 }
+.game-card:hover { border-color: var(--border-strong); }
 .game-card.is-downloading { border-color: rgba(56, 193, 114, 0.5); box-shadow: inset 3px 0 0 var(--green); }
 .game-card.is-installing { border-color: rgba(242, 184, 75, 0.5); box-shadow: inset 3px 0 0 var(--amber); }

 .card-row {
  display: grid;
  grid-template-columns: auto minmax(0, 1fr) auto;
-  gap: 14px;
-  align-items: center;
+  gap: 16px;
+  align-items: start;
 }

 .lead { display: flex; flex-direction: column; align-items: center; gap: 10px; flex: none; }
@@ -387,55 +436,112 @@ h2 { font-size: 18px; line-height: 1.2; }
 .cover {
  display: grid;
  place-items: center;
-  width: 64px; height: 64px;
+  width: 72px; height: 72px;
  color: #fff;
  background: linear-gradient(135deg, #2d6d9d, #247857);
  border-radius: 12px;
-  font-size: 16px;
+  font-size: 18px;
  font-weight: 800;
  overflow: hidden;
+  box-shadow: 0 0 0 1px rgba(255, 255, 255, 0.06), 0 6px 18px rgba(0, 0, 0, 0.35);
 }
 .cover img { width: 100%; height: 100%; object-fit: cover; display: block; }

-.card-body { min-width: 0; }
-.card-body h3 { margin: 0 0 6px; overflow-wrap: anywhere; font-size: 16px; }
+.card-body { min-width: 0; display: grid; gap: 10px; align-content: start; }
+.card-body h3 { margin: 0; overflow-wrap: anywhere; font-size: 18px; line-height: 1.25; }

-.subline { display: flex; flex-wrap: wrap; gap: 4px 10px; color: var(--muted); font-size: 12px; }
-.pills { display: flex; flex-wrap: wrap; gap: 6px; margin-top: 8px; }
+.tid {
+  color: var(--muted);
+  font-size: var(--fs-xs);
+  font-variant-numeric: tabular-nums;
+  letter-spacing: 0.02em;
+  margin-right: 2px;
+}
+.pills { display: flex; flex-wrap: wrap; align-items: center; gap: 6px; }

-.versions {
+/* Installed -> update -> newest, read left to right. */
+.vtrack {
  display: flex;
  flex-wrap: wrap;
-  gap: 4px 16px;
-  margin-top: 10px;
-  font-size: 12px;
-  color: var(--muted);
+  align-items: stretch;
+  gap: 8px;
 }
-.versions b { color: var(--ink); font-weight: 700; }
-.card-note { flex-basis: 100%; line-height: 1.45; }
-.card-note.is-warn { color: var(--amber); }
-.prospero-line a { color: var(--blue); text-decoration: none; }
-.prospero-line a:hover { text-decoration: underline; }
+.vstep {
+  display: grid;
+  align-content: start;
+  gap: 2px;
+  min-width: 0;
+  padding: 8px 12px;
+  border: 1px solid var(--border);
+  border-radius: 10px;
+  background: var(--surface-2);
+}
+.vstep > span {
+  color: var(--muted);
+  font-size: 12px;
+  font-weight: 700;
+  letter-spacing: 0.04em;
+  text-transform: uppercase;
+}
+.vstep > b { font-size: var(--fs-md); font-variant-numeric: tabular-nums; }
+.vstep > em { color: var(--muted); font-size: var(--fs-xs); font-style: normal; }
+.vstep.is-target { border-color: rgba(56, 193, 114, 0.45); background: var(--green-soft); }
+.vstep.is-target > span { color: var(--green-dark); }
+.vstep.is-dim { background: transparent; border-style: dashed; }
+.vstep.is-dim > b { color: var(--muted); }
+.vtrack-arrow { display: grid; place-items: center; color: var(--muted); }
+.vtrack-arrow svg { width: 20px; height: 20px; }
+
+/* A note that belongs to a card or dialog: icon, text, optional action. */
+.callout {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: flex-start;
+  gap: 6px 10px;
+  padding: 10px 12px;
+  border: 1px solid var(--border);
+  border-radius: 10px;
+  background: var(--surface-2);
+  color: var(--ink);
+  font-size: var(--fs-sm);
+  line-height: 1.45;
+}
+.callout > svg { flex: none; margin-top: 1px; color: var(--green-dark); }
+.callout > span { flex: 1 1 220px; min-width: 0; }
+.callout .link-button { flex: none; font-weight: 700; }
+.callout.is-warn { border-color: rgba(242, 184, 75, 0.38); background: var(--amber-soft); }
+.callout.is-warn > svg { color: var(--amber); }
+.callout.is-quiet { color: var(--muted); }
+
+.spinner {
+  flex: none;
+  width: 16px; height: 16px; margin-top: 2px;
+  border: 2px solid var(--border-strong);
+  border-top-color: var(--green);
+  border-radius: 50%;
+  animation: spin 0.9s linear infinite;
+}
+@keyframes spin { to { transform: rotate(360deg); } }

 .card-actions {
  display: flex;
  flex-direction: column;
  gap: 8px;
  flex: none;
-  width: 136px;
+  width: 168px;
 }

 .pill {
  display: inline-flex;
  align-items: center;
-  min-height: 24px;
-  padding: 0 9px;
+  min-height: 26px;
+  padding: 0 10px;
  border: 1px solid var(--border);
  background: var(--surface-2);
  color: var(--muted);
  border-radius: 999px;
-  font-size: 12px;
-  font-weight: 800;
+  font-size: var(--fs-xs);
+  font-weight: 700;
 }
 .pill.ok { border-color: rgba(56, 193, 114, 0.34); background: var(--green-soft); color: var(--green-dark); }
 .pill.warn { border-color: rgba(242, 184, 75, 0.38); background: var(--amber-soft); color: var(--amber); }
@@ -455,6 +561,7 @@ h2 { font-size: 18px; line-height: 1.2; }
 .row-button {
  width: 100%;            /* fills the fixed-width actions column -> never reflows */
  padding: 0 12px;
+  font-size: 15px;
 }
 /* go = green (Update / Resume / Install), pause = amber, cancel/stop = red */
 .row-button.is-update  { border-color: var(--green); color: #04150c; background: var(--green); }
@@ -463,8 +570,9 @@ h2 { font-size: 18px; line-height: 1.2; }
 .row-button.is-pause:hover   { background: var(--amber-dark); }
 .row-button.is-cancel  { border-color: var(--red);   color: #1a0606; background: var(--red); }
 .row-button.is-cancel:hover  { background: #ff8a8a; }
-.row-button.is-ghost   { background: transparent; color: var(--muted); }
-.row-button.is-ghost:hover { color: var(--ink); border-color: var(--muted); }
+.row-button.is-ghost   { background: transparent; color: var(--ink); border-color: var(--border-strong); }
+.row-button.is-ghost:hover { background: var(--surface-2); border-color: var(--muted); }
+.row-button.is-ghost svg { color: var(--muted); }
 .row-button:disabled { opacity: 0.6; cursor: default; }

 /* ---------------- in-tile download progress ---------------- */
@@ -500,7 +608,7 @@ h2 { font-size: 18px; line-height: 1.2; }
  justify-content: space-between;
  gap: 4px 14px;
  color: var(--muted);
-  font-size: 12px;
+  font-size: var(--fs-xs);
 }
 .progress-meta b { color: var(--ink); font-weight: 700; font-variant-numeric: tabular-nums; }

@@ -510,7 +618,7 @@ h2 { font-size: 18px; line-height: 1.2; }

 .settings-grid { display: grid; gap: 12px; }
 .field { display: grid; gap: 6px; }
-.field span, .allowlist > span, .source-policy > span { color: var(--muted); font-size: 12px; font-weight: 700; }
+.field span, .allowlist > span, .source-policy > span { color: var(--muted); font-size: var(--fs-xs); font-weight: 700; }
 .field input, .field select {
  min-height: 44px;
  padding: 0 12px;
@@ -560,7 +668,7 @@ h2 { font-size: 18px; line-height: 1.2; }
  color: var(--ink);
 }
 .switch-row > span:first-child strong { display: block; font-size: 14px; }
-.switch-row > span:first-child em { display: block; margin-top: 3px; color: var(--muted); font-size: 12px; font-style: normal; }
+.switch-row > span:first-child em { display: block; margin-top: 3px; color: var(--muted); font-size: var(--fs-xs); font-style: normal; }

 /* slider toggle (used for per-game enable + settings) */
 .toggle { display: inline-flex; align-items: center; gap: 8px; cursor: pointer; user-select: none; flex: none; }
@@ -586,7 +694,7 @@ h2 { font-size: 18px; line-height: 1.2; }
 .toggle input:checked + .track { background: var(--green-soft); border-color: var(--green); }
 .toggle input:checked + .track::after { transform: translateX(18px); background: var(--green); }
 .toggle input:focus-visible + .track { outline: 2px solid var(--blue); outline-offset: 2px; }
-.toggle .label { font-size: 12px; color: var(--muted); min-width: 22px; }
+.toggle .label { font-size: var(--fs-xs); color: var(--muted); min-width: 22px; }
 .lead .toggle .label { white-space: nowrap; }

 .allowlist, .source-policy, .storage-list { display: grid; gap: 8px; margin-top: 16px; }
@@ -602,10 +710,10 @@ h2 { font-size: 18px; line-height: 1.2; }
  border: 1px solid var(--border);
  border-radius: 8px;
 }
-.storage-row strong { font-size: 13px; overflow-wrap: anywhere; }
-.storage-row em { color: var(--muted); font-style: normal; font-size: 12px; }
+.storage-row strong { font-size: var(--fs-sm); overflow-wrap: anywhere; }
+.storage-row em { color: var(--muted); font-style: normal; font-size: var(--fs-xs); }
 .storage-row b { font-variant-numeric: tabular-nums; }
-.storage-empty { color: var(--muted); font-size: 13px; }
+.storage-empty { color: var(--muted); font-size: var(--fs-sm); }
 .link-button {
  padding: 0;
  border: 0;
@@ -633,8 +741,8 @@ h2 { font-size: 18px; line-height: 1.2; }
  border: 1px solid var(--border);
  border-radius: 8px;
 }
-.policy-row strong { font-size: 13px; }
-.policy-row em { overflow: hidden; color: var(--muted); font-size: 12px; font-style: normal; text-overflow: ellipsis; white-space: nowrap; }
+.policy-row strong { font-size: var(--fs-sm); }
+.policy-row em { overflow: hidden; color: var(--muted); font-size: var(--fs-xs); font-style: normal; text-overflow: ellipsis; white-space: nowrap; }

 .host-chip {
  display: inline-flex;
@@ -644,7 +752,7 @@ h2 { font-size: 18px; line-height: 1.2; }
  background: var(--blue-soft);
  color: var(--blue);
  border-radius: 999px;
-  font-size: 12px;
+  font-size: var(--fs-xs);
  font-weight: 800;
 }

@@ -659,7 +767,7 @@ pre {
  border: 1px solid var(--border);
  color: #dfe7ef;
  border-radius: var(--radius);
-  font-size: 12px;
+  font-size: var(--fs-xs);
  line-height: 1.55;
  white-space: pre-wrap;
  word-break: break-word;
@@ -707,24 +815,123 @@ pre {
  align-content: center;
  padding: 24px 16px;
  overflow-y: auto;
-  background: rgba(5, 7, 9, 0.72);
+  background: rgba(5, 7, 9, 0.74);
+  -webkit-backdrop-filter: blur(6px);
+  backdrop-filter: blur(6px);
+  animation: fadeIn 160ms ease-out;
 }
+@keyframes fadeIn { from { opacity: 0; } }
+@keyframes sheetIn { from { opacity: 0; transform: translateY(10px) scale(0.985); } }
 .guide {
  display: grid;
  gap: 16px;
  padding: 22px;
  border: 1px solid var(--border);
-  border-radius: 14px;
+  border-radius: 16px;
  background: var(--surface);
  box-shadow: var(--shadow);
+  animation: sheetIn 220ms var(--ease);
 }
+@media (prefers-reduced-motion: reduce) {
+  .guide, .guide-backdrop { animation: none; }
+}
+
+/* Dialog with a long list: the header stays, the list scrolls. */
+.guide-backdrop:has(.is-sheet) { grid-template-columns: minmax(0, 620px); }
+.guide.is-sheet {
+  grid-template-rows: auto minmax(0, 1fr);
+  max-height: calc(100dvh - 48px);
+  padding: 0;
+  gap: 0;
+  overflow: hidden;
+}
+.is-sheet .guide-head { padding: 20px 22px 16px; border-bottom: 1px solid var(--border); }
+.sheet-body { display: grid; gap: 18px; align-content: start; padding: 18px 22px 22px; overflow-y: auto; overscroll-behavior: contain; }
+.sheet-title { display: flex; align-items: center; gap: 14px; min-width: 0; }
+.sheet-title > div { min-width: 0; }
+.cover.cover-sm { width: 56px; height: 56px; flex: none; border-radius: 10px; font-size: 16px; }
+
+.vgroup { display: grid; gap: 8px; }
+.vgroup h3 {
+  display: flex; align-items: center; gap: 8px;
+  margin: 0;
+  color: var(--muted);
+  font-size: 12px;
+  font-weight: 800;
+  letter-spacing: 0.06em;
+  text-transform: uppercase;
+}
+.vgroup h3 span {
+  min-width: 22px; padding: 1px 7px; border-radius: 999px;
+  background: var(--surface-3); color: var(--ink);
+  font-size: 12px; letter-spacing: 0; text-align: center;
+}
+.vlist { display: grid; gap: 8px; margin: 0; padding: 0; list-style: none; }
+.vrow {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  justify-content: space-between;
+  gap: 10px 14px;
+  padding: 12px 14px;
+  border: 1px solid var(--border);
+  border-radius: 12px;
+  background: var(--surface-2);
+}
+.vrow-main { display: grid; gap: 2px; min-width: 0; }
+.vrow-main strong { font-size: 18px; font-variant-numeric: tabular-nums; letter-spacing: 0.01em; }
+.vrow-main span { color: var(--muted); font-size: var(--fs-sm); font-variant-numeric: tabular-nums; }
+.vrow .row-button { width: auto; padding: 0 18px; }
+.vrow.is-ok { border-color: rgba(56, 193, 114, 0.35); }
+.vrow.is-ok:hover { background: var(--surface-3); }
+.vrow.is-needs_fw .vrow-main strong { color: var(--muted); }
+.vrow.is-installed { background: transparent; border-style: dashed; }
+.vrow.is-older { padding: 8px 14px; background: transparent; }
+.vrow.is-older .vrow-main strong { font-size: var(--fs-md); color: var(--muted); }
+
+.vbadge {
+  display: inline-flex; align-items: center; gap: 6px;
+  min-height: 30px; padding: 0 12px;
+  border: 1px solid var(--border); border-radius: 999px;
+  font-size: var(--fs-xs); font-weight: 700; white-space: nowrap;
+}
+.vbadge svg { width: 15px; height: 15px; }
+.vbadge.is-warn { border-color: rgba(242, 184, 75, 0.38); background: var(--amber-soft); color: var(--amber); }
+.vbadge.is-ok { border-color: rgba(56, 193, 114, 0.34); background: var(--green-soft); color: var(--green-dark); }
+
+.volder summary {
+  display: inline-flex; align-items: center; gap: 6px;
+  min-height: 40px; padding: 0 10px 0 4px;
+  border-radius: 8px;
+  color: var(--muted); font-size: var(--fs-sm); font-weight: 700;
+  cursor: pointer; list-style: none;
+}
+.volder summary::-webkit-details-marker { display: none; }
+.volder summary:hover { color: var(--ink); }
+.volder summary svg { transition: transform 150ms ease; }
+.volder[open] summary svg { transform: rotate(90deg); }
+
+.sheet-source { margin: 0; color: var(--muted); font-size: var(--fs-sm); }
+.sheet-source a { display: inline-flex; align-items: center; gap: 4px; color: var(--blue-dark); text-decoration: none; }
+.sheet-source a:hover { text-decoration: underline; }
+.sheet-source svg { width: 14px; height: 14px; }
+
+.vskeleton { display: grid; gap: 8px; }
+.vskeleton i {
+  display: block; height: 62px; border-radius: 12px;
+  background: linear-gradient(90deg, var(--surface-2) 0%, var(--surface-3) 50%, var(--surface-2) 100%);
+  background-size: 200% 100%;
+  animation: shimmer 1.2s ease-in-out infinite;
+}
+@keyframes shimmer { from { background-position: 100% 0; } to { background-position: -100% 0; } }
+@media (prefers-reduced-motion: reduce) { .vskeleton i, .spinner { animation: none; } }
 /* minmax(0, 1fr): without it an <input>'s intrinsic width pushes the tracks wider than the sheet */
 .guide, .guide-steps, .guide-steps li { grid-template-columns: minmax(0, 1fr); }
 .guide-head { display: flex; align-items: flex-start; justify-content: space-between; gap: 12px; }
 .guide-head > div { min-width: 0; }
 .guide-head h2 { margin: 0; font-size: 22px; }
 .guide-game { margin: 4px 0 0; color: var(--muted); }
-.guide-close { flex: none; width: 40px; padding: 0; font-size: 22px; line-height: 1; }
+.guide-close { flex: none; width: 44px; padding: 0; }
 .guide-why { margin: 0; color: var(--muted); line-height: 1.55; }
 .guide-why b { color: var(--ink); }

@@ -740,7 +947,7 @@ pre {
 .guide-qr .qr { flex: none; width: 148px; height: 148px; border-radius: 6px; }
 .guide-qr > div { display: grid; gap: 6px; min-width: 0; }
 .guide-qr span { color: var(--muted); line-height: 1.5; }
-.guide-qr code { overflow-wrap: anywhere; color: var(--blue-dark); font-size: 13px; }
+.guide-qr code { overflow-wrap: anywhere; color: var(--blue-dark); font-size: var(--fs-sm); }

 /* Console view: the PS5 can't copy links, so it only hands over to a phone. */
 .guide.is-handoff { width: min(560px, 100%); justify-self: center; text-align: center; }
@@ -773,7 +980,7 @@ pre {
  background: var(--green-soft);
  color: var(--green-dark);
  font-weight: 800;
-  font-size: 13px;
+  font-size: var(--fs-sm);
 }
 .guide-step-text { display: grid; gap: 4px; }
 .guide-step-text span { color: var(--muted); line-height: 1.5; }
@@ -805,7 +1012,7 @@ pre {
 .guide-msg.is-warn { color: var(--amber-dark); }
 .guide-msg.is-error { color: var(--red); }
 .guide-action { width: auto; justify-self: start; padding: 0 16px; }
-.guide-progress { display: grid; gap: 6px; margin-top: 8px; color: var(--muted); font-size: 13px; }
+.guide-progress { display: grid; gap: 6px; margin-top: 8px; color: var(--muted); font-size: var(--fs-sm); }

@media (max-width: 720px) {
  /* Already on a phone: the hand-off QR has nothing to add. */
@@ -822,9 +1029,7 @@ pre {
  .game-card { padding: 18px 20px; }
  .cover { width: 104px; height: 104px; border-radius: 14px; font-size: 22px; }
  .card-row { gap: 20px; }
-  .card-body h3 { font-size: 19px; margin-bottom: 8px; }
-  .subline { font-size: 13px; }
-  .versions { font-size: 13px; }
+  .card-body h3 { font-size: 20px; }
 }

@media (max-width: 1024px) {
@@ -856,12 +1061,31 @@ pre {
  .toolbar { grid-template-columns: 1fr; }
  .segmented { overflow-x: auto; }
  .segmented button { flex: 0 0 auto; }
-  .card-row { grid-template-columns: auto minmax(0, 1fr); }
-  .card-actions { grid-column: 1 / -1; width: 100%; flex-direction: row; }
-  .card-actions .row-button { flex: 1; }
+  /* The card body's parts join the card's grid, so the versions and notes
+     use the full width under the cover instead of a narrow column. */
+  .card-row { grid-template-columns: auto minmax(0, 1fr); column-gap: 14px; row-gap: 10px; }
+  .card-body { display: contents; }
+  .lead { grid-row: span 2; }
+  .card-body h3 { align-self: end; }
+  .card-body .pills { align-self: start; }
+  .vtrack, .card-body .callout, .card-actions { grid-column: 1 / -1; }
+  .cover { width: 64px; height: 64px; }
+  .card-actions { width: 100%; flex-direction: row; flex-wrap: wrap; }
+  .card-actions .row-button { flex: 1 1 140px; }
+  .vstep { flex: 1 1 110px; }
+  .global-dl-name { order: 3; flex-basis: 100%; }
+  .guide.is-sheet { max-height: none; }
+  .sheet-body { padding: 16px; }
+  .is-sheet .guide-head { padding: 16px; }
 }

@media (max-width: 460px) {
-  .status-strip { grid-template-columns: 1fr; }
+  .status-strip { gap: 8px; }
+  .metric { padding: 12px; }
+  .metric strong { font-size: 17px; }
+  .topbar .eyebrow { display: none; }
  .switch-row { align-items: flex-start; }
+  .vrow { flex-wrap: nowrap; padding: 12px; }
+  .vrow .row-button { padding: 0 14px; }
+  .vrow .row-button svg { display: none; }
 }
Author	SHA1	Message	Date
Knutwurst	3b58a77a70	Resolve Sony's hosts past blocked DNS; version 0.3.0 The resolver asked one server over UDP and took the first answer, even a blocker's 0.0.0.0. It now tries UDP on four public resolvers, then TCP, then DNS over HTTPS (Cloudflare, Google), then the addresses the last good lookup saved. Sinkhole answers count as blocked, curl gets every address of a host, and a host whose addresses refuse or drop the connection is looked up again. Sony hosts stay pinned to Sony's root; only the DoH requests use public roots. The network check reports where each answer came from and what failed before it.	2026-10-17 15:19:00 +02:00
Knutwurst	23e4dda1e2	Redesign game cards and the Other versions dialog Cards show installed, update and newest version side by side, and problems as notes with their action. Other versions became a button. The dialog groups versions into available, needs newer firmware, installed and older (folded), with larger type throughout. Text is at least 13px, buttons 44px tall, and every control has a focus ring. Phones get two status tiles per row and full-width card content.	2026-10-17 15:19:00 +02:00
Knutwurst	b8899c6b02	Revert "README: static license badge (shields.io's GitHub license badge shows invalid)" This reverts commit `4816a0fbd7`.	2026-10-17 11:52:00 +02:00
Knutwurst	4816a0fbd7	README: static license badge (shields.io's GitHub license badge shows invalid)	2026-10-17 11:51:02 +02:00
Knutwurst	1cc12e2640	Search the whole patch history for an older-firmware patch The lookup took only the 64 newest versions, so a game whose 64 newest patches all need newer firmware lost its compatible older patch.	2026-10-17 11:44:40 +02:00
Knutwurst	4dd254c20d	Accept single-piece PS4 links, Orbis error text, natural UI terminology A PS4 patch that fits in one piece is listed by Orbis as "<name>.pkg" without a number; its manifest is "<name>.json" in the same gs2 folder, like split packages. A wrong link on a PS4 game now explains Orbis' "Copy all links!" instead of asking for Prospero's SC link. All translations were reviewed against per-language glossaries (PS5 and common app wording): e.g. German "Herunterladen" instead of "Holen", status texts as "Wird ... ", requirements as "erfordert FW".	2026-10-17 11:43:05 +02:00
Knutwurst	76d40a5327	Translate the UI into ten languages The UI follows the browser language, which on the PS5 is the system language, and Settings has a selector to override it per device (kept in localStorage). All UI text moved into web/i18n.js (306 keys) with English, German, French, Spanish, Italian, Portuguese (Brazil), Japanese, Simplified Chinese, Korean and Russian; missing keys fall back to English. Log entries keep their key and values, so the Logs view shows them in the chosen language while the diagnostic report stays English for issues.	2026-10-17 11:33:21 +02:00
Knutwurst	a8aace1e55	Pick another patch version from Prospero (PS5) or Orbis (PS4) An optional "Other versions" link on a game card lists every version the patch site knows: Prospero Patches for PS5, its sister site Orbis Patches for PS4 (same API). Versions newer than the installed one that run on this firmware can be picked; older ones are shown but not offered, since installing an older patch over a newer one is untested. Picking a version opens the existing guide for exactly that version: QR code to the phone, copy the link on the site, paste it. Orbis offers the piece links of a PS4 patch ("Copy all links!"); they sit in the same gs2 folder as the manifest, so PatchDL derives "<name>.json" from any "<name>_<n>.pkg" and fetches it over http like other PS4 manifests. The size check uses the size the list showed for the version picked. The Prospero lookup behind "Old FW patch" now uses the same list.	2026-10-17 11:18:38 +02:00
Knutwurst	b4fbdd4681	Bump version to 0.2.1	2026-10-17 10:45:52 +02:00
Knutwurst	8053f5395b	Mark sideloaded apps, explain failed downloads, diagnose from the UI Sideloaded apps - A Sony-signed package installed with another tool ("fake": true in app.json, but no PatchDL loopback URL) stays Official but is marked Sideloaded, and its Updates switch starts off, so Update all skips it. Switching it on is saved separately, so a switch saved earlier can't turn it on. The card says an update replaces this exact version. Failed downloads - When the package list can't be fetched, the download job records why (DNS, connection, timeout, TLS, redirect, HTTP status, not a manifest) with the curl and HTTP codes; the card says so with a Details link. - Details runs /api/netcheck?title=<id>, which walks the game's update list and manifest the way a download does and reports PatchDL's own DNS answer for each host. The dialog shows a checklist and a report to copy into an issue; on the PS5 a QR code opens it on a phone.	2026-10-17 10:39:49 +02:00