Merge remote-tracking branch 'origin/main'

# Conflicts:
#	scripts/package-native.sh
#	scripts/stage-build.sh

README.md

@@ -4,6 +4,12 @@ This repository packages the headless NETfishing server produced by the main
 game project. Gameplay and networking code remain in the `netfishing`
 repository so clients and servers use the same protocol implementation.
 
+Production tags follow the coordinated NETfishing release train. Package a
+game release with the same `vX.Y.Z-alpha` tag checked out in this repository.
+The package manifest records both the exact game commit and the exact dedicated
+packaging commit; packaging refuses to run when its matching release tag does
+not point to the current commit.
+
 ## Stage a build
 
 Export the `Linux Dedicated Server` preset from the game project, then stage
@@ -18,9 +24,9 @@ game_commit="$(git -C ../netfishing rev-parse HEAD)"
 ```
 
 The staged binaries under `dist/` are release inputs and are intentionally not
-tracked by Git. `dist/BUILD_INFO` records the version, full game commit, export
-preset, platform, and binary hashes. Packaging refuses a version mismatch or
-failed internal checksum.
+tracked by Git. `dist/BUILD_INFO` records the version, full game and packaging
+commits, export preset, platform, and binary hashes. Packaging refuses a
+version mismatch, packaging-tag mismatch, or failed internal checksum.
 
 Create a deterministic native archive after staging:
 
@@ -61,8 +67,34 @@ to returning players.
 Configuration is applied in this order: config file, environment variables,
 then command-line overrides. Supported command-line options are `--name`,
 `--bind`, `--port`, `--max-players`, `--data-dir`, `--discovery-url`,
-`--public`, and `--private`. Value options use `--option=value`. Keep the first
-standalone `--` shown above; it separates Godot engine flags from server flags.
+`--operators`, `--public`, and `--private`. Value options use `--option=value`.
+Keep the first standalone `--` shown above; it separates Godot engine flags
+from server flags.
+
+### Headless operators
+
+Headless moderation is granted by authenticated player identity, never by a
+display name or shared password. A player can copy their complete 64-character
+fingerprint from **Settings → Data & Identity → Copy Player Fingerprint**.
+
+Add trusted fingerprints to `/etc/netfishing-server.cfg`:
+
+```ini
+[moderation]
+operators=PackedStringArray("0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef")
+```
+
+Alternatively, provide a comma-separated list through
+`NETFISHING_SERVER_OPERATORS` or `--operators=fingerprint1,fingerprint2`.
+Configuration file values are overridden by the environment, then by the
+command line. Restart the server after changing the allowlist.
+
+The server grants operator status only after the connecting player proves
+ownership of that exact identity key. Operators can kick, ban, unban, and clear
+shared session artwork through the in-game Players page. They cannot grant
+operator access, revoke another operator, or moderate another operator. Keep
+the server data directory persistent because it owns the server identity and
+stored bans.
 
 Public listing requires the discovery URL and a publicly reachable ENet UDP
 port. Discovery makes a server findable but does not relay gameplay traffic.
@@ -97,9 +129,10 @@ docker compose up -d
 ```
 
 Set values such as `NETFISHING_SERVER_NAME`, `NETFISHING_SERVER_PORT`,
-`NETFISHING_SERVER_MAX_PLAYERS`, and `NETFISHING_SERVER_PUBLIC` in a local
-`.env` file. The Compose service runs without Linux capabilities, uses a
-read-only root filesystem, and stores persistent state in a named volume.
+`NETFISHING_SERVER_MAX_PLAYERS`, `NETFISHING_SERVER_PUBLIC`, and the optional
+comma-separated `NETFISHING_SERVER_OPERATORS` in a local `.env` file. The
+Compose service runs without Linux capabilities, uses a read-only root
+filesystem, and stores persistent state in a named volume.
 
 ## Steam distribution