# Building from the source offer

`openq4-web-source.tar.xz` contains a sanitized code-only export of the pinned OpenQ4
commit and a pinned OpenQ4-GameLibs snapshot. The OpenQ4 `.source-revision` records
the upstream commit, its complete Git tree, and the separately authenticated pruned
export tree; the GameLib marker records its commit and complete tree. The engine and
GameLib changes are the numbered patches in `port/native/patches/`; no patched vendor
worktree is embedded.

Verify and unpack the archive:

```bash
sha256sum -c openq4-web-source.tar.xz.sha256
tar -xJf openq4-web-source.tar.xz
cd q4-web-source
tools/build-wasm.sh --clean --verify-sources-only
python3 tools/native-source-identity.py --root .
```

The browser source-only command copies both snapshots to `build/wasm-src`, creates local
baseline Git commits, checks the OpenQ4 baseline against its recorded export tree
while retaining the complete upstream tree as provenance, checks the GameLib baseline
against its complete tree, applies every patch in order, and runs the patched-source
invariants. It does not run Meson or modify `engine/`.

The native identity command independently authenticates the same snapshots, applies
the exact native patch subset (including the dedicated stdout flush), and reports its
own patch-manifest and patched-tree SHA-256 values. This identity is separate from the
browser engine build ID and does not alter the frozen WebAssembly artifacts.

For a complete browser-engine build, install Meson, Ninja, Python 3, Git, and the
Emscripten toolchain referenced by `port/wasm/emscripten.ini`. This deployment
uses Emscripten 6.0.2 under `/opt/emsdk`:

```bash
tools/build-wasm.sh --clean --jobs 4
sha256sum -c engine/SHA256SUMS
npm ci
npm test
python3 tools/test-wasm-network.py
```

The build produces separate Emscripten `MAIN_MODULE` engines and SP/MP GameLib
`SIDE_MODULE`s under `engine/`. Retail Quake 4 data and upstream media without
established redistribution rights are absent. Compilation uses only the deterministic
minimal CC0 runtime sources under `content-src/`; retail data is needed only for
playable runtime tests. The archive carries the shared voice implementation at
`_shared/voice/voicechat.js`, with `public/js/voicechat.js` linked to it by a
relative symlink so the extracted tree is self-contained.
