fix: enforce explicit multi-platoon data ownership

CHANGELOG.md

@@ -26,8 +26,17 @@ All notable changes to mobileGF2logger are documented here.
   enter management storage.
 - Keep one-time-capture completion evidence isolated per detected Platoon so
   two clients cannot accidentally complete one checklist.
-- Preserve v2.3.x data as an unmoved legacy profile while new Platoons use
-  immutable private databases and retained-evidence directories.
+- Leave unscoped v2.3.x files untouched but remove them from selectable
+  production profiles; captured packets require a confirmed `21905` identity
+  before they can create or enter an immutable data scope.
+- Require roster CSV imports to target an explicitly selected existing
+  profile or a newly user-declared client/server/name/ID profile, name that
+  destination in the preview, and explain that `21917` cannot identify or
+  verify a Platoon by itself.
+- Scope recent and saved parsed-packet history to the admitted profile and
+  keep unconfirmed flow payloads out of history as well as management storage.
+- Allow a scoped v3 backup to recreate its embedded Platoon profile on an empty
+  installation, while continuing to reject identity-free legacy archives.
 - Replace the arbitrary timezone list with the six supported server presets;
   an unconfigured client must be selected once before its first profile is admitted.
 

README.md

@@ -26,6 +26,10 @@ never stored.
 - Explains every weekly cell on tap and summarizes missing or uncertain evidence in an Evidence Health panel.
 - Keeps up to 15 complete automatic revisions per weekly table so an earlier projection and its displayed member context can be previewed and restored after an accidental import.
 - Recovers interrupted imports before previewing roster CSV impact and keeps an automatic one-level checkpoint for undo.
+- Imports a roster CSV only into an explicitly selected, already confirmed
+  Platoon or a profile whose client, server, name, and ID the user explicitly
+  enters. Because `21917` contains no Platoon identity, the preview always
+  names the target and asks the user to verify it.
 - Saves or shares a weekly PNG with opt-in controls for names, UIDs, and private notes.
 - Can send a validated original CSV to an optional user-owned Discord incoming webhook after confirmation.
 - Stores the latest 100 parsed packets and up to 50 saved packets, with table and raw views, copy, export, selection, and deletion.
@@ -59,7 +63,11 @@ unattributed management payloads are deliberately not imported. Because the
 plaintext protocol does not expose a trustworthy server identifier, select the
 correct HaoPlay and Darkwinter server in Settings before first capture.
 
-The app keeps parsed history, management data, and generated CSV files in private on-device storage. It does not bypass TLS, certificate pinning, or anti-cheat systems, and it does not modify game traffic. Server responses may contain only recent incremental history, so older missing membership records can be entered manually.
+The app keeps each confirmed Platoon's parsed history, management data, and
+generated CSV files in separate private on-device storage. It does not bypass
+TLS, certificate pinning, or anti-cheat systems, and it does not modify game
+traffic. Server responses may contain only recent incremental history, so older
+missing membership records can be entered manually.
 
 ## Reference
 

README_KR.md

@@ -20,6 +20,10 @@ mobileGF2logger는 서클장을 위한 가벼운 비루팅 앱입니다. Android
 - 모든 주간 셀을 누르면 근거를 설명하고, 근거 상태 패널에서 누락되거나 불확실한 데이터를 요약합니다.
 - 주간 표마다 표시 당시의 멤버 문맥까지 포함한 전체 자동 기록을 최대 15개 보관하여 잘못 가져온 뒤에도 이전 표를 미리 보고 복원할 수 있습니다.
 - 중단된 가져오기를 먼저 복구한 뒤 명단 CSV의 영향을 미리 보여 주고, 실행 취소용 1단계 자동 체크포인트를 보관합니다.
+- 명단 CSV는 사용자가 명시적으로 선택한 서클이나 클라이언트·서버·이름·
+  ID를 직접 입력한 신규 서클에만 가져옵니다. `21917`에는 서클 식별
+  정보가 없으므로 미리보기에는 항상 적용 대상을 표시하고 확인을
+  요청합니다.
 - 이름, UID, 비공개 메모의 포함 여부를 선택해 주간 PNG를 저장하거나 공유할 수 있습니다.
 - 확인 후 검증된 원본 CSV를 사용자가 소유한 선택적 Discord 수신 웹훅으로 전송할 수 있습니다.
 - 최근 파싱 패킷 100개와 저장 패킷 50개를 보관하며, 표 및 원본 보기, 복사, 내보내기, 선택, 삭제를 지원합니다.
@@ -50,7 +54,11 @@ Android 10 이상에서는 Android가 각 연결을 소유한 지원 게임을
 있는 서버 식별자가 없으므로 첫 캡처 전에 설정에서 HaoPlay와 Darkwinter의
 서버를 올바르게 선택하세요.
 
-앱은 파싱 내역, 관리 데이터, 생성한 CSV 파일을 기기의 비공개 저장소에 보관합니다. TLS, 인증서 고정 또는 안티치트 체계를 우회하지 않으며 게임 트래픽을 변경하지 않습니다. 서버 응답에는 최근의 일부 이력만 포함될 수 있으므로, 누락된 과거 가입 이력은 직접 추가할 수 있습니다.
+앱은 확정된 각 서클의 파싱 내역, 관리 데이터, 생성한 CSV 파일을 서로
+분리된 기기 비공개 저장소에 보관합니다. TLS, 인증서 고정 또는 안티치트
+체계를 우회하지 않으며 게임 트래픽을 변경하지 않습니다. 서버 응답에는
+최근의 일부 이력만 포함될 수 있으므로, 누락된 과거 가입 이력은 직접
+추가할 수 있습니다.
 
 ## 참고
 

SECURITY.md

@@ -49,10 +49,12 @@ original connection tuple and maps that UID only to the fixed supported package
 IDs. Remote IP addresses and DNS/SNI labels are diagnostic hints, not trusted
 client or server identities. Android 8–9 falls back only when exactly one
 supported client is installed; ambiguous flows remain quarantined. Payload
-`21905` supplies a bounded Platoon identity for its own decoded flow. Only a
-confirmed profile composed from the verified client, user-selected compatible
-server region, and Platoon ID may receive an immutable isolated management
-database, retained CSV directory, checkpoint, weekly settings, or backup scope.
+`21905` supplies a bounded Platoon identity for its own decoded flow. Captured
+packets may enter an immutable isolated management scope only after that profile
+combines the Android-verified client, user-selected compatible server region,
+and Platoon ID. An identity-free `21917` document can enter a scope only through
+the explicit user-driven CSV flow, where the preview names either an existing
+profile or a newly declared client/server/name/ID destination before mutation.
 Pre-identity payloads, admission candidates, registered profiles, and profile
 metadata are independently bounded. A flow is permanently
 quarantined until closure if its identity changes or profile admission fails.
@@ -69,6 +71,13 @@ is absent from parsed-packet history, SQLite, retained CSV, and preferences;
 explicit discard, overflow, force-stop, or process death removes it. Selecting
 an existing profile safely restores that profile's saved capture region.
 
+Roster CSV payload `21917` has no Platoon identity. Import never infers a target
+from member overlap. It requires an explicitly selected existing profile or a
+new profile whose client, compatible server, name, and ID the user declares,
+displays that destination before mutation, and aborts if the scope is no longer
+available. This prevents an identity-free roster from silently crossing Platoon
+storage boundaries.
+
 Profile metadata, capture-region routing, active selection, SQLite state,
 scoped settings, and retained CSV retirement share one durable restore journal.
 A process death before the commit marker restores the previous values together.