PUMPKO - SYSOP ONLINE UPDATES
============================
Linux / Pi: ./PUMPKO-UPDATE --check
            ./PUMPKO-UPDATE
Windows 7+: PUMPKO-UPDATE.exe --check
            double-click PUMPKO-UPDATE.exe
Linux requires bash, curl, openssl and sha256sum. No Python is required.
Windows uses native WinHTTP/CryptoAPI; no PowerShell is required.

Checks fetch a small platform manifest and its RSA-3072/SHA-256 signature from
https://scores.a-net.online/updates/pumpko/. An update is installed only when
a newer version is published and the sysop answers Y. Standard HTTPS validation
remains enabled. A pinned publisher key verifies the manifest; the signed size
and SHA-256 verify the installer. Unavailable hub means no files are changed.

A maintenance marker gates new game launches. Active PUMPKO processes cause
installation to stop without killing callers; retry once sessions finish.
Do not manually launch installers or sync/config workers during an update.
Both platforms back up replaced files into update-backup.* / update-backup-*.
Automatic installation changes game executables, release identity and docs;
configuration, credentials, profiles, scores and chat settings remain intact.
An installation failure attempts rollback and reports if manual recovery is
needed. Keep backups until the new game is verified.
The updater is a stable bootstrap; its own replacement is performed by the
normal interactive installer when required. Automatic game updates retain it.
A stale .pumpko-maintenance marker after power failure requires sysop removal,
only after confirming no updater is running.

The release host must be deployed before online checks will work. The separate
hub-administrator kit provides publication tools and nginx instructions.
Game packages contain only the public verification key, never the signing key.
