diff --git a/patches/airborne-submarine-squadron.patch b/patches/airborne-submarine-squadron.patch
new file mode 100644
index 00000000..616d3d9c
--- /dev/null
+++ b/patches/airborne-submarine-squadron.patch
@@ -0,0 +1,341 @@
+diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
+index 9efbbfc..52f7e80 100644
+--- a/.github/workflows/actions.lock
++++ b/.github/workflows/actions.lock
+@@ -8,7 +8,7 @@ workflows:
+         - 'denoland/setup-deno@v2.0.5'
+     '.github/workflows/codeql-analysis.yml':
+         - 'actions/checkout@v7.0.1'
+-        - 'github/codeql-action@v4.38.0'
++        - 'github/codeql-action@v4.38.1'
+     '.github/workflows/dogfood-gate.yml':
+         - 'actions/checkout@v7.0.1'
+         - 'hyperpolymath/deed-ecosystem@main'
+@@ -61,9 +61,9 @@ dependencies:
+         commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
+         owner_id: 42048915
+         repo_id: 356423100
+-    'github/codeql-action@v4.38.0':
+-        ref: 'v4.38.0'
+-        commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63'
++    'github/codeql-action@v4.38.1':
++        ref: 'v4.38.1'
++        commit: 'sha1-1c5b675653bb5c22dbe9b12b556ec555138e09fd'
+         owner_id: 9919
+         repo_id: 259445878
+     'hyperpolymath/deed-ecosystem@main':
+diff --git a/.github/workflows/build-chain.yml b/.github/workflows/build-chain.yml
+index aa03266..200dd1a 100644
+--- a/.github/workflows/build-chain.yml
++++ b/.github/workflows/build-chain.yml
+@@ -1,7 +1,5 @@
+-# This workflow is managed by gh actions-lock.
+ # SPDX-License-Identifier: AGPL-3.0-or-later
+ # This workflow is managed by gh actions-lock.
+-# This workflow is managed by gh actions-lock.
+ # AffineScript build-chain gate — validates that build.sh produces a
+ # usable WASM artifact under the three supported scenarios:
+ #   1. affinescript is on PATH (real compile)
+diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
+index 7b2c1e9..103c539 100644
+--- a/.github/workflows/codeql-analysis.yml
++++ b/.github/workflows/codeql-analysis.yml
+@@ -1,7 +1,5 @@
+-# This workflow is managed by gh actions-lock.
+ # SPDX-License-Identifier: AGPL-3.0-or-later
+ # This workflow is managed by gh actions-lock.
+-# This workflow is managed by gh actions-lock.
+ # For most projects, this workflow file will not need changing; you simply need
+ # to commit it to your repository.
+ #
+diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml
+index bb18b45..d97c733 100644
+--- a/.github/workflows/dogfood-gate.yml
++++ b/.github/workflows/dogfood-gate.yml
+@@ -1,7 +1,5 @@
+-# This workflow is managed by gh actions-lock.
+ # SPDX-License-Identifier: AGPL-3.0-or-later
+ # This workflow is managed by gh actions-lock.
+-# This workflow is managed by gh actions-lock.
+ # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+ #
+ # dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate
+diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
+index 431048f..37c9690 100644
+--- a/.github/workflows/governance.yml
++++ b/.github/workflows/governance.yml
+@@ -1,7 +1,5 @@
+-# This workflow is managed by gh actions-lock.
+ # SPDX-License-Identifier: AGPL-3.0-or-later
+ # This workflow is managed by gh actions-lock.
+-# This workflow is managed by gh actions-lock.
+ name: Governance
+ 
+ on:
+diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
+index eeea328..350aa63 100644
+--- a/.github/workflows/hypatia-scan.yml
++++ b/.github/workflows/hypatia-scan.yml
+@@ -1,7 +1,5 @@
+-# This workflow is managed by gh actions-lock.
+ # SPDX-License-Identifier: AGPL-3.0-or-later
+ # This workflow is managed by gh actions-lock.
+-# This workflow is managed by gh actions-lock.
+ name: Hypatia Security Scan
+ 
+ on:
+diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml
+index 1684675..b323e6e 100644
+--- a/.github/workflows/instant-sync.yml
++++ b/.github/workflows/instant-sync.yml
+@@ -1,7 +1,5 @@
+-# This workflow is managed by gh actions-lock.
+ # SPDX-License-Identifier: AGPL-3.0-or-later
+ # This workflow is managed by gh actions-lock.
+-# This workflow is managed by gh actions-lock.
+ # Instant sync — lightweight forge propagation on every push to any branch.
+ # Keeps GitLab and Bitbucket mirrors up to date without waiting for the main-only mirror.
+ 
+diff --git a/.github/workflows/label-triage.yml b/.github/workflows/label-triage.yml
+index 814a192..fc79947 100644
+--- a/.github/workflows/label-triage.yml
++++ b/.github/workflows/label-triage.yml
+@@ -1,5 +1,5 @@
+-# This workflow is managed by gh actions-lock.
+ # SPDX-License-Identifier: MPL-2.0
++# This workflow is managed by gh actions-lock.
+ name: Label Triage
+ 
+ # Classify newly-filed issues against the estate label taxonomy.
+diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
+index 83ab941..af34c6b 100644
+--- a/.github/workflows/labels.yml
++++ b/.github/workflows/labels.yml
+@@ -1,5 +1,5 @@
+-# This workflow is managed by gh actions-lock.
+ # SPDX-License-Identifier: MPL-2.0
++# This workflow is managed by gh actions-lock.
+ name: Labels
+ 
+ # Applies the canonical estate label set from .github/labels.json.
+diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
+index d31cb38..d12c355 100644
+--- a/.github/workflows/mirror.yml
++++ b/.github/workflows/mirror.yml
+@@ -1,7 +1,5 @@
+-# This workflow is managed by gh actions-lock.
+ # SPDX-License-Identifier: AGPL-3.0-or-later
+ # This workflow is managed by gh actions-lock.
+-# This workflow is managed by gh actions-lock.
+ name: Mirror to Git Forges
+ 
+ on:
+diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
+index 02e72c2..de6cdce 100644
+--- a/.github/workflows/pages.yml
++++ b/.github/workflows/pages.yml
+@@ -1,7 +1,5 @@
+-# This workflow is managed by gh actions-lock.
+ # SPDX-License-Identifier: AGPL-3.0
+ # This workflow is managed by gh actions-lock.
+-# This workflow is managed by gh actions-lock.
+ name: GitHub Pages (Ddraig SSG)
+ on:
+   push:
+diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml
+index 2f1b3ab..4252069 100644
+--- a/.github/workflows/push-email-notify.yml
++++ b/.github/workflows/push-email-notify.yml
+@@ -1,4 +1,3 @@
+-# This workflow is managed by gh actions-lock.
+ # SPDX-License-Identifier: AGPL-3.0-or-later
+ # This workflow is managed by gh actions-lock.
+ # Dormant push-email notification. ARMED by setting the repo variable
+diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
+index d2158a0..2f564ef 100644
+--- a/.github/workflows/scorecard.yml
++++ b/.github/workflows/scorecard.yml
+@@ -1,7 +1,5 @@
+-# This workflow is managed by gh actions-lock.
+ # SPDX-License-Identifier: AGPL-3.0-or-later
+ # This workflow is managed by gh actions-lock.
+-# This workflow is managed by gh actions-lock.
+ name: OSSF Scorecard
+ 
+ on:
+diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
+index 85b26e9..00cf1ca 100644
+--- a/.github/workflows/secret-scanner.yml
++++ b/.github/workflows/secret-scanner.yml
+@@ -1,7 +1,5 @@
+-# This workflow is managed by gh actions-lock.
+ # SPDX-License-Identifier: AGPL-3.0-or-later
+ # This workflow is managed by gh actions-lock.
+-# This workflow is managed by gh actions-lock.
+ name: Secret Scanner
+ 
+ on:
+diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
+index 3b5785e..7e414c4 100644
+--- a/.github/workflows/test.yml
++++ b/.github/workflows/test.yml
+@@ -1,7 +1,5 @@
+-# This workflow is managed by gh actions-lock.
+ # SPDX-License-Identifier: AGPL-3.0-or-later
+ # This workflow is managed by gh actions-lock.
+-# This workflow is managed by gh actions-lock.
+ # Multi-platform test suite — runs blitz tests on Linux + macOS
+ name: Test Suite
+ 
+diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml
+index 22bc284..faef2c6 100644
+--- a/.github/workflows/workflow-linter.yml
++++ b/.github/workflows/workflow-linter.yml
+@@ -1,7 +1,5 @@
+-# This workflow is managed by gh actions-lock.
+ # SPDX-License-Identifier: AGPL-3.0-or-later
+ # This workflow is managed by gh actions-lock.
+-# This workflow is managed by gh actions-lock.
+ # Prevention workflow - validates all workflows have proper security config
+ name: Workflow Security Linter
+ 
+@@ -26,7 +24,7 @@ jobs:
+           errors=0
+           for f in .github/workflows/*.yml .github/workflows/*.yaml; do
+             [ -f "$f" ] || continue
+-            if ! head -1 "$f" | grep -q "SPDX-License-Identifier"; then
++            if ! awk '/^---[[:space:]]*$/ { next } /^#/ { print; next } { exit }' "$f" | grep -q "^# SPDX-License-Identifier:"; then
+               echo "ERROR: $f missing SPDX header"
+               errors=$((errors + 1))
+             fi
+diff --git a/dist/airborne-submarine-squadron.wasm b/dist/airborne-submarine-squadron.wasm
+new file mode 100644
+index 0000000000000000000000000000000000000000..ca2481cd30b107e1cd6c50149c7883ccd7191bfe
+GIT binary patch
+literal 8099
+zcmd5>%a0z#5$~CAzUR#D_P6i%*6jOfFp54Ak^?PRVjDjYb|6wB*=xLp{nqQXcbAZy
+z>|+i@igJoj4qP}S61n8g4T)PM5K<IHN)A3m`~{H`iTtW+dS=#MJC;vid#a|otLxYG
+z>Yfj?b+{K8V}b|a3)iB1_%FD3&1C<A@(T+q$H)D=G7V(~(Nwnl6mhnQ@WrFbw%J~3
+zfk$R~faNty^ULB)S4C5@_~RZh`hO>smln{x=h?@tSjaIepAMC9E*Sn`>u~4l;q9$E
+zhwtqlUA=R#{qvpe4^B63-nja~!OqdPF_jli2Vo_u*6NLBD^7ZP`)s>^U~p)7WOQtN
+zVsdJFhSJ%&`Gv)$<(1X7^^H@{J%2h1Otli2pjL-DcfS$W*P`0q_TK)%FGJJXxxI6A
+z_3&s5t8cUpkGAh*FQ=ltt)1KEbTcrm&tE(p8E0ZVf;ct={<Xew2&%??T;u0oBYyrW
+zidQg7!I|hD1w5mQx9}X^!t71dV%GgZ5Zs$HbH)vJ=S|9s{-)9inSK#;!ibG@!iJIr
+z<N;nS8Cl@_kLX6KT2oCd#G1SitClohd_)t2vZIr1mK0BWMeE@{K~X?Hv#HmEP(9P|
+zrmzoS6mN<7fC48w4&1*&1|F!hge0W?6A-@+f{HG->=#qqRwvnpxXL!gQ({4^!h&tF
+zRUt4S&M(G83T@2eLLvf+LG|>gl1VbQrxOxL(h29Yz|CMAw!+!rf-VEBGPf&GIVm<c
+z6b}qC22UL~?)UeQPk3hUGFejS-C{LX$(Q0qjpSfqCD)QcogIqd((KS<%4dt6tMDP2
+zW%dRhU2D_u_-my|<cN^En8m*F9LwOK1_&}U$>o+JF|-#{0bbN>U%on+3Zxa=PT_wz
+zx}8=FJ2k2)hN#P?vX?4eBD^3u8X#4+rb8URnppd(-;Faivh`FA<E4g|u&_`enCG=C
+z3?9(4eKm3}$vI0ES^GQ^0)dbiTdjF3jez~gj{djVNAq~X6fJOZ`xGYw$I*ewLZ!o;
+zDkBhLNZX7n<l3KpByfI=q7~F^kR^aX;l2xiKsGAXRHZ7%#el$X5mns_?7phQ?h~r2
+zUJ2J4>eKzrAPIOe1PKmu;T{9c&`7Gv9>#!@6W*yabb^e08U(c*Two_8*r6RquqD+h
+zyD7RSCtcKa%eLkQcM%`N)ZK!m0)3t89A^U}-LIa9sm@Iyp}K6KP-qbL#tO&~-Yz<&
+z<SXR5<A(T7yj8gMiy&YpVrE8!@1~kP*$X@Zbm$ooy85{TxaHOvJOO?guNi9T_fM5v
+z+PEdNN}12qBzY-CRn!}om+k}=#yj!l_0UeP`lN8&G>Uvj%ggjp=NZR^=e^@O^jDFg
+zZ?O%3&UvTB|CGR@cHk@I`rV8<cb7s)Ht&{gdi1U(RqQtav8zkN&=C6VJlp`-1V^$a
+zHnj9r#?>zX7$katL!U<jNb9m+Y4Mx~Fv59&bU+>yc_QOYYO0@`TK~;_hkpozCUSub
+z09nia5nI?<@v>`&eI_#wenok?+8HEp?Tnx5#&*+M5dzL-zbDT{xeRc#Q6#nIMjiHR
+z&YUk71n)~@##>VkyJH1TajA($8lo8#HNkuJI-ZLlLxD7?sb$e*9qD5wQn<54E%uWE
+zK{JV{CGPrD7_^R;jrT_B2w~@N4{4pD3LfkniCy1r8WqmrHszh;IW((Gh9Kt7kv?Xr
+znz>e*9J|)<&~xlsmBF>@n0nd}iwWNr*el2zqmF<-*b(qYkti~acP?qz;(Wo*)z#_%
+zF1}*Lm|~q8>(p4M#(8StzKCSnM<01iL)FvE&D&XSJ+1@#<TJ}n^NGW_k*aP(U*zP%
+z{ZQZh>9q#qKAAUt-JVA{{AHwc%&b0k?jtAC#{muuU743hA1n?d7F;Z6FE>Vw2_L-5
+z;p|n<S2Rf45lJ)1_b`dF?<X9zax;<Kmo9?dDB;U4WU-t@TfQZV!7@O=d#Jo{^UDEx
+z4xLy78EUCKdfWd`;P21>HJn;gH07ol<&>M^oSEXZXn-Jt5)f391wkbZg5X#l1wosd
+z1VK>}2zu8%2oiJ|q-jSw;W`-HTAv5O<@9?X35#C@gS+StL3%sk%OHI$eie-Egl9n7
+zo$x$Je<yqcWPnGnfEnzBKLHu)gg*lr?u6GsFm?lEv=hDuGS&%ifsA*;J0KIRc?4#X
+znP1S9B=$clL0r0oWA9o7vRmxEsPSo<)+REoO=Mbca?`x^1Y_8`CHM`VDwJkuhP`i;
+zL`oVo!yZaNr1j5;Uqwl}I}sHtq?EGX3<&%dQL51tl0ewB*sZ0Mr<BxYX_ozJK;YMi
+zW>rl{0%4+Rvphx;(8B&4&B=?T?L5tMBn${55rH5Q4Uj%wA)$F5E6rb^1&)mYL2M!r
+z#HIl<pz{}4IH$RTIB@P@9pp}7e~}hBR}C!|FqUYE<7q$;&j@6K*K2^8)P<K=yeRpn
+zpEVlbFQZ^xD;ysjY1Y|sI-+{)P<}+({*>#pVh8MCs&_j(%{RL2ijLW;GLxcP<1Iy7
+zUJfJl;c9l0m8PKU@|2iKlqQJLRN4cVPo=$5pFA~mAL7bgb$<`+SlU+-e-^k0Rrk9P
+zVoQB|fwhxqo6rb_>!&vLAl?Hsz%~Y%MClL>QZJ;#G|bWwCQ&*{{WJvW7>%)XoJo{U
+z&^V1kI!Ti(MM1E1nntK<(-axYQeqONDZ-ONigaS>9Fr(TD$s~s!0J<Wq02KHcBIQ=
+zOw$D!MxtPNzMC$}=4hdtF6G-?!d@2BWm=|ryOgd-oR_)ztkSAh*{W9ADkoS2LL`4e
+zt3{Hm(Hc!~LacGoMYP6ATpC}ebxv#pf^3Uuol|aAp)BG?H;Nae%w$<-gEl-u*4&^K
+z*4*HnTIKFHPpi^2-jUBVBoppf;mehmaR!)kn?3mCfRprZiAB$LCdHJh2$6<%4%rq`
+zWLL391(#JG<!+ytIM&}|;vqx$ldosj#PY`>dbRCMbx3#PEj}ZKiISb~40~*EPlM4e
+zi-*3f$hR9l1mIefG*@sPCECPID5ivZs25dbk)r)HfT|gyVPyU&jiD+g&`VbEBc1U-
+zeW4Q)&OkIcO|m(f(XKN`q+MqY<sl7tE}bv*xCx5hg6b`Jy#=qg;Pn<zAG5TGR6vX4
+zedZ7U@(i@3@?Bz&?d@rRWikD8Gw9bIF5m0-Z5kj#e8FY1iz4E$Tm7{q1kG;S#vuvh
+zU!!Xc%4;0cdsM4Ov|OuWxD^LoZ92^H(Sz%lNQE>rWfZXc5I_7JGcBh^W;$Zi73>Qc
+z15I8eawnRGmYT+#F5e??B`ld%9-_i@JbrRza&!5}^2cY%AN&JUH3L;+P}Lk%4WRJF
+zd6GY%rJyjU%hwrvyp}*I4^aWC>OQsn*;+C!U#^+y2Ak%?QvHFSFz}6cqG|s4lTctz
+zSHEkR^Px~4a|+W>^2cX3Z5{)~UqQ_bREt41b5JdSYMl%US_%qtx_Sp=&Vy1Oa|%#Z
+z_q9#qW2O_doH#R`u<1BAoxpT*vT10kY0T*oexx-J6sDDjs4#uZAIOPsY}#`SNH6+c
+zPX?ryf%N1+dI6;OWFXK|AehtTo1}rD0HQoZ1rWVFVQu^cj&E(+cMOL`@9oQQSjN$p
+z<FLSCPsRZ)#eq3py^k{IW1&3elyJD;w$t`8)BR}q?aXvPn{MZ(`(e8OWYf@6)0orc
+z%ddf;Fs(d9g=zh8`!)<3_uMD#RGL)Ys{))%CIi7eOUhac1V6W<jh$E^JRk+aKhE=2
+z1lQ3L2<0KlL44KbZ|_oJ>QABCBP(o|?<#5+HxS%HPP7XxwTn6EZETl0?|0=P@^*1G
+zk=|z4aEq?m=f>Ure*USW1cZO>;HJcD)fq@F2T})+`pH0`r9dzTO+}RpAS@MS4+QtA
+zKZdxb>0QaLr|=-`6c7LM478;3U1E>z?P-A7Wj;CO))fCGOpLp4<D_AX*}VAHOXSYJ
+zX>i`fy)7?!+g;g&>?0cw^oeZq!r9HsnEA?;vu|x090qZ_r#x`+(nW|rv+>9P#BaQL
+z>D(r!o-gZsZR4T#!-J~#O*VAl?B&a6FI{|zUb%GPjq{sVu;jNHgnZ~Vhh<+isCmVf
+z4|r^!wBu8&u;X?PuJ0e*-log%U*Fq0*kSJO`&%~-_HWa&yLl6W%kLcQ+&Nk??yGjZ
+zu>zg9-Q^1#H+K#WkLX}q{%`L~^v?dlHtp@-*uF*A_xF!>Zohl#)G2tdKdyyPx%B$~
+E0E7_r_W%F@
+
+literal 0
+HcmV?d00001
+
+diff --git a/gossamer/app_gossamer.js b/gossamer/app_gossamer.js
+index ee2a91f..26688b3 100644
+--- a/gossamer/app_gossamer.js
++++ b/gossamer/app_gossamer.js
+@@ -771,8 +771,6 @@ function drawEvelCameratron() {
+   ctx.moveTo(-2, -5);
+   ctx.quadraticCurveTo(-8 - Math.sin(world.tick * 0.1) * 3, -8, -6 - Math.sin(world.tick * 0.15) * 4, -3);
+   ctx.stroke();
+-  ctx.restore();
+-
+   ctx.restore(); // Undo zoom transform
+ 
+   // Frame border + label
+diff --git a/index.html b/index.html
+index 03139ba..c0c5332 100644
+--- a/index.html
++++ b/index.html
+@@ -704,9 +704,19 @@
+         })();
+     </script>
+ 
+-    <!-- Game engine -->
+-    <script src="gossamer/camera_layers.js"></script>
+-    <script src="gossamer/wasm_abi.js"></script>
+-    <script src="gossamer/app_gossamer.js"></script>
++    <!-- Game engine (modular: support → enemies → HUD → core) -->
++    <!-- SFX must be first so the SFX object is available to all game scripts -->
++    <script src="gossamer/sfx.js?v=2"></script>
++    <script src="gossamer/verisimdb.js?v=2"></script>
++    <script src="gossamer/enemies.js?v=2"></script>
++    <script src="gossamer/hud.js?v=2"></script>
++    <script src="gossamer/weapons.js?v=2"></script>
++    <script src="gossamer/orbital.js?v=2"></script>
++    <script src="gossamer/controls.js?v=2"></script>
++    <script src="gossamer/persist.js?v=2"></script>
++    <script src="gossamer/terrain.js?v=2"></script>
++    <script src="gossamer/camera_layers.js?v=1"></script>
++    <script src="gossamer/wasm_abi.js?v=1"></script>
++    <script src="gossamer/app_gossamer.js?v=2"></script>
+ </body>
+ </html>
+diff --git a/test/compatibility_test.js b/test/compatibility_test.js
+index edd0f7b..aec1669 100644
+--- a/test/compatibility_test.js
++++ b/test/compatibility_test.js
+@@ -116,7 +116,12 @@ Deno.test("compat: HTML entry points load gossamer/wasm_abi.js", async () => {
+ 
+ // ── 10. Groove manifest shape remains explicit and passive ───────────────
+ Deno.test("compat: .well-known/groove/manifest.json keeps current ASS contract", async () => {
+-  const raw = await Deno.readTextFile(ROOT + ".well-known/groove/manifest.json");
++  let raw;
++  try {
++    raw = await Deno.readTextFile(ROOT + "www/.well-known/groove/manifest.json");
++  } catch {
++    raw = await Deno.readTextFile(ROOT + ".well-known/groove/manifest.json");
++  }
+   const manifest = JSON.parse(raw);
+ 
+   assertEquals(manifest.service_id, "airborne-submarine-squadron");