POKEMON JOURNEY — LOCAL MULTIPLAYER EDITION START Double-click Launch-Pokemon-Journey.cmd in the outputs folder. Keep the complete pallet-world and journey-server folders beside the launcher. The included Windows Node runtime starts a background loopback server; the account screen opens in your browser. It requires no external internet for offline gameplay. Online accounts on this development server are local test accounts, not public cloud accounts. You can also run: node journey-server/main.cjs Then open http://127.0.0.1:8881/pallet-world/account.html PARTY DOCK Click your active Pokemon in the bottom-left to expand your party. Select a healthy companion to lead. Click the active Pokemon again to collapse the dock. This does not change the existing battle switch cooldown or turn rules. POKE-ROYALE Speak to the host inside Cerulean's Pokemon Fan Club. Choose a club AI practice match, or sign in to join another player's match. Four rotating cards draw from an eight-card arcade deck. Spend regenerating energy to deploy Pokemon in either lane. Defend two lane towers and your core; destroy the rival core or take more towers. Battle earns evolution sparks. Keyboard: 1-4 cards, arrows choose a lane, Enter deploys, E selects evolution. Touch: pick a card, tap your blue half. Return to Fan Club exits safely. Arcade teams and results do not alter your journey party, items or currency. Two accounts can test matchmaking in separate browser profiles. The account name is shown to the rival. OFFLINE AND ONLINE ARE SEPARATE Offline continues the existing browser journey and writes an encrypted binary backup through the loopback service. The first offline launch imports only your existing OFFLINE browser save. The original browser save remains a fallback. Online creates a new server-owned character. No offline import endpoint exists. Never copy offline files into the online account database. Online movement, collisions, encounters and both battle styles execute the same bundled game sources in a server DOM adapter. The online page receives snapshots and sends allowed input tokens. Its position, damage, inventory, RNG and rewards are not accepted as authority. Account actions have sequence/replay checks. Nearby online trainers are visible. NPC/world progress remains per character. Shared PvP is currently the Poké-Royale arena; trading, player battles in the main world, guilds, chat, matchmaking regions and a public economy are not added. The separate embedded PokéSurvivor game remains offline-only. This is a locally tested, single-process multiplayer foundation, not a deployed or load-tested MMO cluster. Large regional scripts run once per active character; the default local limit is two active online characters (JOURNEY_MAX_PLAYERS can change this after memory/load testing). The browser/DOM adapter is a compatibility step toward a smaller renderer-independent shared core. It avoids implementing a second set of gameplay rules. Offline still runs those same sources in the browser; its loopback service owns encrypted file storage. Some source-scripted activities need further online compatibility testing. SAVE LOCATIONS AND BACKUPS By default: %LOCALAPPDATA%/PokemonJourney/server/ offline/offline.sav AES-256-GCM binary offline file offline/offline.key local encryption key; back it up together with the file online/accounts.sqlite account and separate online character database online/session.key server session secret Stop the server before a full directory backup. Do not distribute this private directory. A local computer owner can read the encryption key: local encryption is privacy protection, not a claim that offline cheating is impossible. Browser saves remain tied to the browser and exact origin/port. EMAIL RECOVERY The suggested mailbox is pokepheria@gmail.com (interpreted from the supplied pokepheria.gmail.com). No email has been sent and no password has been configured. To enable Gmail delivery, configure these environment variables before starting: JOURNEY_SMTP_USER=pokepheria@gmail.com JOURNEY_SMTP_PASS= JOURNEY_MAIL_FROM=Pokemon Journey Gmail may require 2-step verification/app-password eligibility. Credentials must stay in server environment settings; never paste them into game client files. Recovery links are expiring and single-use; resetting invalidates prior sessions. Local accounts can be tested without delivered verification. A public production server requires configured mail, HTTPS and verified email. HOSTING AND PHONE ACCESS This release binds to127.0.0.1 only; no firewall ports or public services were opened. A phone cannot use the PC's127.0.0.1 address. For public multiplayer deploy one server process per persistent database shard behind HTTPS, set JOURNEY_PRODUCTION=1, JOURNEY_HOST, JOURNEY_PUBLIC_ORIGIN and the mail settings. Use private persistent storage via JOURNEY_DATA_DIR. Review journey-server/server/API.md for protocol, limits and deployment details. The client and API must share an origin. Mobile touch controls are included. A browser cannot launch a Node loopback server on a phone; a native mobile wrapper or reachable hosted server is still needed. The portable Windows distribution is the two complete folders and the launcher, including its Node runtime. This is not an installer with automatic updates or code signing. Do not send only index.html. Public launch still requires deployment, backup/restore drills, scale and latency tests, and a gameplay/security review. SECURITY REFERENCES USED IN IMPLEMENTATION OWASP Session Management: https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html OWASP Forgot Password: https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html Node24 built-in SQLite/crypto APIs are used by the server.