feat: add automatic multi-platoon management

.gitignore

@@ -62,6 +62,7 @@ Thumbs.db
 .DS_Store
 
 # Local device and UI verification artifacts (repository root only)
+/artifacts/
 /*.xml
 /*.db
 /*.db-*

CHANGELOG.md

@@ -2,6 +2,54 @@
 
 All notable changes to mobileGF2logger are documented here.
 
+## 2.4.0 - 2026-08-25
+
+### Added
+
+- Detect each Platoon from the authoritative `21905` identity plus Android's
+  supported-client flow ownership, and keep separate HaoPlay/Darkwinter and
+  server-region profiles in the Home, Platoon, Weekly, and Settings selectors.
+- Add independently configurable HaoPlay and Darkwinter capture-server
+  presets, scoped database/CSV/checkpoint/report settings, and profile-aware
+  format-v3 `.gf2backup` archives.
+- Add profile-following automatic reset selection; choosing a Platoon also
+  aligns future capture routing with that profile's saved client and region.
+- Add a bounded memory-only admission prompt for a newly detected Platoon and
+  require a compatible server choice before any packet or management data is saved.
+- Add profile management with read-only verified clients, editable compatible
+  servers, and exact-name-confirmed deletion of one isolated Platoon.
+
+### Changed
+
+- Quarantine up to 32 decoded payloads per TCP flow until both its supported
+  Android client and valid Platoon identity are known; unverified flows never
+  enter management storage.
+- Keep one-time-capture completion evidence isolated per detected Platoon so
+  two clients cannot accidentally complete one checklist.
+- Preserve v2.3.x data as an unmoved legacy profile while new Platoons use
+  immutable private databases and retained-evidence directories.
+- Replace the arbitrary timezone list with the six supported server presets;
+  an unconfigured client must be selected once before its first profile is admitted.
+
+### Fixed
+
+- Resolve all six review findings from v2.3.3: clean flow metadata without a
+  parser, order known same-day joins by instant, bound manual weekly notes,
+  preserve captured member names, replace timezone-derived history atomically,
+  and accept `21905` checklist evidence only after identity validation.
+- Bound the profile registry, profile metadata, and pre-identity flow buffer;
+  reject invalid restores before metadata changes, preserve the selected import
+  scope through preview/apply, and restore the matching client-region routing.
+- Quarantine identity-changing or admission-failed flows, admit at most one new
+  profile per client per user-started capture, and let users forget selector
+  metadata without deleting the isolated Platoon data.
+- Remove metadata for non-parsed VPN flows on every close path and prevent a
+  delayed open callback from restoring metadata after a rejected close.
+- Keep backup profile registration and active selection inside the durable
+  restore journal, serialize timezone history rebuilds with ingestion, reject
+  overflowed flows before session creation, use transitive membership ordering,
+  and refresh every retained Activity after a profile switch.
+
 ## 2.3.3 - 2026-08-24
 
 ### Added

README.md

@@ -17,18 +17,25 @@ never stored.
 ## Features
 
 - Captures the mandatory Platoon Profile (`21905`), Members (`21917`), Activity (`21935`), and Updates (`21960`) responses without a computer or root access.
+- Automatically separates detected Platoons by supported Android client,
+  selected server region, and authoritative Platoon ID; switch the active
+  isolated profile from Home, Platoon, Weekly, or Settings.
 - Tracks active and withdrawn members, non-overlapping repeat membership periods, exact Updates timestamps, editable nicknames, and private notes.
-- Builds Sunday-to-Saturday Standard or Gunsmoke Frontline weekly tables around the 05:00 game reset, with cut-off points and manual correction for missing data.
+- Builds Sunday-to-Saturday Standard or Gunsmoke Frontline weekly tables around the selected server's daily reset, with cut-off points and manual correction for missing data.
 - Offers One-time Capture that tracks the four useful Platoon payloads and stops automatically when the checklist is complete.
 - Explains every weekly cell on tap and summarizes missing or uncertain evidence in an Evidence Health panel.
 - Keeps up to 15 complete automatic revisions per weekly table so an earlier projection and its displayed member context can be previewed and restored after an accidental import.
 - Recovers interrupted imports before previewing roster CSV impact and keeps an automatic one-level checkpoint for undo.
 - Saves or shares a weekly PNG with opt-in controls for names, UIDs, and private notes.
 - Can send a validated original CSV to an optional user-owned Discord incoming webhook after confirmation.
 - Stores the latest 100 parsed packets and up to 50 saved packets, with table and raw views, copy, export, selection, and deletion.
-- Supports member sorting, persistent drag ordering, snapshot comparison, single-week and all-week CSV export, and complete `.gf2backup` export/restore.
+- Supports member sorting, persistent drag ordering, snapshot comparison, single-week and all-week CSV export, and profile-aware `.gf2backup` export/restore that leaves other Platoons unchanged.
+- Keeps a newly detected Platoon's packets in bounded memory until the user confirms one of the verified client's compatible servers; unconfirmed data is discarded on force-stop or process death.
+- Provides profile management for correcting server metadata without moving data and for deleting one isolated Platoon behind two confirmations and an exact-name check.
 - Guides first-time users through Main, Settings, Platoon management, weekly controls, and parsed-packet pages, with a persistent English/Korean selector and Skip action.
-- Supports English and Korean, System/Light/Dark themes, explicit Darkwinter/HaoPlay server-region reset presets converted to the phone timezone, and a persistent manual game-timezone fallback.
+- Supports English and Korean, System/Light/Dark themes, and the six known
+  Darkwinter/HaoPlay server-region reset presets converted to the phone timezone.
+  Selecting a detected Platoon automatically follows that profile's saved region.
 - Registers the HaoPlay (`com.haoplay.game.and.exilium`) and Darkwinter
   (`com.Sunborn.SnqxExilium.Glo`) Android clients as separate VPN targets.
 - Creates UTF-8 Platoon-member CSV files with this column order:
@@ -45,6 +52,13 @@ uid,name,level,weeklyMerit,totalMerit,highScore,totalScore,lastLogin,logTime
 4. Enter **Platoon(서클)** and open **Updates(동향)** and **Members(멤버)**.
 5. Return to GF2logger to review the captured packets and Platoon data.
 
+On Android 10 and newer, Android identifies which supported game owns each
+captured connection. Android 8–9 can safely attribute management data only when
+exactly one supported client is installed; with both clients installed,
+unattributed management payloads are deliberately not imported. Because the
+plaintext protocol does not expose a trustworthy server identifier, select the
+correct HaoPlay and Darkwinter server in Settings before first capture.
+
 The app keeps parsed history, management data, and generated CSV files in private on-device storage. It does not bypass TLS, certificate pinning, or anti-cheat systems, and it does not modify game traffic. Server responses may contain only recent incremental history, so older missing membership records can be entered manually.
 
 ## Reference

README_KR.md

@@ -11,18 +11,23 @@ mobileGF2logger는 서클장을 위한 가벼운 비루팅 앱입니다. Android
 ## 기능
 
 - 컴퓨터나 루트 권한 없이 필수 서클 프로필(`21905`), 멤버(`21917`), 활동(`21935`), 동향(`21960`) 응답을 캡처합니다.
+- 지원 Android 클라이언트, 선택한 서버 지역, 서클 ID를 기준으로 감지한
+  서클의 데이터를 자동 분리하며, 홈·서클·주간·설정 화면에서 활성
+  서클을 전환할 수 있습니다.
 - 가입 및 탈퇴 멤버, 서로 겹치지 않는 반복 가입 이력, 동향의 정확한 시각, 수정 가능한 닉네임과 개인 비고를 관리합니다.
-- 05:00 게임 초기화 시각을 기준으로 일요일부터 토요일까지의 일반 주간 또는 흙먼지 주간 표를 만들며, 커트라인과 누락 데이터 수동 수정을 지원합니다.
+- 선택한 서버의 일일 초기화 시각을 기준으로 일요일부터 토요일까지의 일반 주간 또는 흙먼지 주간 표를 만들며, 커트라인과 누락 데이터 수동 수정을 지원합니다.
 - 한 번만 캡처는 네 가지 유용한 서클 페이로드의 수집 상태를 표시하고 체크리스트가 완료되면 자동으로 중지합니다.
 - 모든 주간 셀을 누르면 근거를 설명하고, 근거 상태 패널에서 누락되거나 불확실한 데이터를 요약합니다.
 - 주간 표마다 표시 당시의 멤버 문맥까지 포함한 전체 자동 기록을 최대 15개 보관하여 잘못 가져온 뒤에도 이전 표를 미리 보고 복원할 수 있습니다.
 - 중단된 가져오기를 먼저 복구한 뒤 명단 CSV의 영향을 미리 보여 주고, 실행 취소용 1단계 자동 체크포인트를 보관합니다.
 - 이름, UID, 비공개 메모의 포함 여부를 선택해 주간 PNG를 저장하거나 공유할 수 있습니다.
 - 확인 후 검증된 원본 CSV를 사용자가 소유한 선택적 Discord 수신 웹훅으로 전송할 수 있습니다.
 - 최근 파싱 패킷 100개와 저장 패킷 50개를 보관하며, 표 및 원본 보기, 복사, 내보내기, 선택, 삭제를 지원합니다.
-- 멤버 정렬, 드래그 순서 유지, 최근 스냅샷 비교, 주간 CSV 내보내기, 서클 관리 데이터 백업 및 복원을 지원합니다.
+- 멤버 정렬, 드래그 순서 유지, 최근 스냅샷 비교, 주간 CSV 내보내기, 다른 서클을 변경하지 않는 프로필별 백업 및 복원을 지원합니다.
+- 새 서클은 확인된 클라이언트에 맞는 서버를 사용자가 선택할 때까지 패킷을 제한된 메모리에만 보관하며, 강제 종료 또는 프로세스 종료 시 확인되지 않은 데이터를 버립니다.
+- 서버 정보는 데이터를 이동하지 않고 수정할 수 있으며, 서클 삭제는 두 번의 확인과 정확한 서클 이름 입력을 거쳐 해당 격리 데이터만 제거합니다.
 - 첫 사용 시 메인, 설정, 서클 관리, 주간 기능, 파싱 패킷 화면을 안내하며, 한국어/English 전환과 건너뛰기를 지원합니다.
-- 영어와 한국어, 시스템/라이트/다크 테마를 지원합니다. Darkwinter/HaoPlay 서버 지역별 초기화 시각을 기기 시간대로 환산하며, 예외 상황에는 게임 시간대를 수동으로 설정할 수 있습니다.
+- 영어와 한국어, 시스템/라이트/다크 테마를 지원합니다. 알려진 Darkwinter/HaoPlay 6개 서버 지역의 초기화 시각을 기기 시간대로 환산하며, 감지된 서클을 선택하면 해당 프로필에 저장된 지역을 자동으로 따릅니다.
 - HaoPlay(`com.haoplay.game.and.exilium`)와 Darkwinter(`com.Sunborn.SnqxExilium.Glo`) Android 클라이언트를 별도의 VPN 대상으로 등록합니다.
 - 다음 열 순서의 UTF-8 서클 멤버 CSV 파일을 만듭니다.
 
@@ -38,6 +43,13 @@ uid,name,level,weeklyMerit,totalMerit,highScore,totalScore,lastLogin,logTime
 4. **서클(Platoon)**에 들어가 **동향(Updates)**과 **멤버(Members)**를 엽니다.
 5. GF2logger로 돌아와 캡처한 패킷과 서클 데이터를 확인합니다.
 
+Android 10 이상에서는 Android가 각 연결을 소유한 지원 게임을
+식별합니다. Android 8–9에서는 지원 클라이언트가 하나만 설치된 경우에만
+안전하게 관리 데이터를 분류할 수 있으며, 두 클라이언트가 모두 설치된
+상태의 미식별 데이터는 가져오지 않습니다. 평문 프로토콜에는 신뢰할 수
+있는 서버 식별자가 없으므로 첫 캡처 전에 설정에서 HaoPlay와 Darkwinter의
+서버를 올바르게 선택하세요.
+
 앱은 파싱 내역, 관리 데이터, 생성한 CSV 파일을 기기의 비공개 저장소에 보관합니다. TLS, 인증서 고정 또는 안티치트 체계를 우회하지 않으며 게임 트래픽을 변경하지 않습니다. 서버 응답에는 최근의 일부 이력만 포함될 수 있으므로, 누락된 과거 가입 이력은 직접 추가할 수 있습니다.
 
 ## 참고

SECURITY.md

@@ -7,8 +7,8 @@ Security fixes are made on the latest published release and the current
 
 | Version | Supported |
 | --- | --- |
-| 2.3.x | Yes |
-| 2.2.x and earlier | No |
+| 2.4.x | Yes |
+| 2.3.x and earlier | No |
 
 ## Reporting a vulnerability
 
@@ -44,12 +44,37 @@ plaintext protocol. Parsed data and backups therefore provide local integrity
 and management convenience, not cryptographic proof that a remote payload is
 genuine.
 
-On Android 10 and newer, the active VPN may ask Android for the UID owning an
-original connection tuple and map that UID only to the fixed supported package
+On Android 10 and newer, the active VPN asks Android for the UID owning an
+original connection tuple and maps that UID only to the fixed supported package
 IDs. Remote IP addresses and DNS/SNI labels are diagnostic hints, not trusted
-client or server identities. Payload `21905` supplies a bounded Platoon identity
-for its own decoded flow, but multi-Platoon persistence remains disabled until
-every database, CSV, import, backup, and UI path can enforce the same scope.
+client or server identities. Android 8–9 falls back only when exactly one
+supported client is installed; ambiguous flows remain quarantined. Payload
+`21905` supplies a bounded Platoon identity for its own decoded flow. Only a
+confirmed profile composed from the verified client, user-selected compatible
+server region, and Platoon ID may receive an immutable isolated management
+database, retained CSV directory, checkpoint, weekly settings, or backup scope.
+Pre-identity payloads, admission candidates, registered profiles, and profile
+metadata are independently bounded. A flow is permanently
+quarantined until closure if its identity changes or profile admission fails.
+Each user-started capture may admit at most one new profile per supported
+client; existing profiles remain usable. Full profile removal is an explicit
+destructive workflow and cannot intentionally orphan a selectable scope.
+Closed flows discard address and owner metadata even when no parser was created;
+queue-rejected closes quarantine the flow so delayed open work cannot restore it.
+The app does not turn an IP address, publisher default, or unverified hostname
+into a persistent server-identity guess. A new supported-client/Platoon pair is
+held only in a bounded process-memory admission queue until the user chooses one
+of that client's compatible server regions. Before confirmation, decoded data
+is absent from parsed-packet history, SQLite, retained CSV, and preferences;
+explicit discard, overflow, force-stop, or process death removes it. Selecting
+an existing profile safely restores that profile's saved capture region.
+
+Profile metadata, capture-region routing, active selection, SQLite state,
+scoped settings, and retained CSV retirement share one durable restore journal.
+A process death before the commit marker restores the previous values together.
+Destructive profile deletion requires two confirmations including an exact-name
+match, then uses a durable deletion queue so interrupted scoped cleanup resumes
+before profiles are listed again.
 
 Exports and Discord sends are explicit user actions that move selected data out
 of Android private storage. Backups are checksummed and strictly validated but

app/build.gradle

@@ -154,8 +154,8 @@ android {
         applicationId = 'dev.gf2log'
         minSdk = 26
         targetSdk = 36
-        versionCode = 20303
-        versionName = '2.3.3'
+        versionCode = 20400
+        versionName = '2.4.0'
         testInstrumentationRunner = 'androidx.test.runner.AndroidJUnitRunner'
 
         ndk {