[xib031]

Adds TicketAuthority: the ticket handler answers from validated local material, and one decision drives both the served bytes and the SteamID spoof.

Why

When a DRM-wrapped game launches, Steam asks the client for the app ownership ticket (IClientUser::GetAppOwnershipTicketExtendedData). In the old handler:

• outside the Denuvo authorization window it read the registry AppTicket and, when that was empty, forged from a single cached blob (ConfigStore apptickets\7). If that blob was missing, it returned false and the handler wrote no reply; the DRM aborts the launch (the failure users report as error 54).
• inside the authorization window it was store-only: no stored ticket meant no answer even though a forge source existed.
• stored tickets were served without validation, so a stale blob (embedding another App ID) was answered as-is.
• the SteamID spoof was decided separately from the served bytes, so the DRM's identity cross-checks could disagree even when a reply existed.

Concrete repro (before / after)

State: app configured via addappid; no registry AppTicket for it (HKCU\Software\Valve\Steam\Apps<id>\AppTicket absent); ConfigStore apptickets\7 gone (delete the key, or Steam -> Clear Download Cache).

• before: store empty; the only forge source is apptickets\7; missing -> handler writes no reply -> DRM aborts.
• after: discovery finds a usable base (a Lua-managed app's cached ticket, any credential-store ticket, or the client's own ticket) -> forged reply.

Same shape inside the Denuvo window with an ETicket but no AppTicket (the old store-only path answered nothing). And a stale stored ticket for another App ID: old served it as-is, new rejects it and forges instead.

What changed

TicketAuthority (src/Utils/Tickets/TicketAuthority.{h,cpp}) owns the decision; the handler call site is one TicketAuthority::Resolve(appId):

• validated stored tickets first (embedded App ID, size, signature); invalid blobs fall through to forging and are kept only as a last-resort rung
• the expected identity is derived once (stored ticket, stored SteamID credential, imports, or ETicket) and the SteamID spoof reads the same decision, so bytes and identity cannot disagree
• forge bases are discovered: Lua-managed ids -> credential store ids (each probed in BOTH storage locations) -> the client's own ticket last
• best-effort is the default: a reply is still produced while any usable signed bytes exist, and mixing is recorded; [tickets] identity_mode = "strict" refuses instead
• optional ticket backend as the last resort; imports (setAppTicket / setETicket / redeem) validated at load time
• one log line per decision (LOG_IPC_INFO); refusals carry the reason

Configuration

[tickets]
identity_mode = "best_effort" # or "strict"

Verification

• built Release and Debug from this branch; exported surface unchanged (single TokeerUri export)
• the full-featured fork build this work derives from was verified byte-identical (code sections) against the shipped DLLs during development

Notes

• the diversion / startup work is split into a separate PR for independent review

[madoiscool]

@claude lock in

[xib031]

All review points addressed:

• diversion split out to Load a hooked copy of steamclient64.dll (diversion) + startup hardening #5
• RemoteToml back to remote-first (atomic writes kept)
• config: identity_mode only
• dropped: vault, JSON report (now one log line per decision), installed-app scan
• provenance: stored/forged/none
• EvaluateLocked split into smaller functions

Repro before/after is in the description.

One caveat: the vault stays in the fork build only (it fixed a real cache-clear case here). Not proposing it upstream unless it shows up on a stock build.