vdmkenny · Oct 13, 2026 · Oct 12, 2026
diff --git a/docs/engine/front-end.md b/docs/engine/front-end.md
@@ -338,10 +338,10 @@ Each change is written to `starlancer.ini` at once, in the section `[OpenReliant
 
 - GET MODS in white, centred on (320, 95).
 - The framed list from (45, 136), with the catalogue's mods grouped by their top category, the first folder of their category path: a heading row for each group, in the large font and blue as the controls tab's headings are, with the group's name in capitals (`- SHIPS`), then the group's mods sorted by their full path and their name, indented by 14 pixels, each as its name and version from the index. A click on a heading folds the group, which hides its mods and turns the heading's `-` into a `+`; another click unfolds it. Mods without a category come last, under OTHER MODS. A mod that needs a newer OpenReliant is red; otherwise the selected mod is white, a mod installed in an older version is gold, and an installed mod is dimmed. While the repositories are read, the list says READING THE CATALOG. If none can be read, the list says CAN'T READ THE CATALOG and why, in red. If one of several can't be read, its name and the reason are in red above the list, ending at the panel's right edge where the mods screen's RESTART TO APPLY is, and the others' mods are listed. An empty catalogue says THE CATALOG OFFERS NO MODS. The screen lists at most 127 mods, since each mod and each group takes one of the list's 255 rows.
-- The framed panel from (401, 136), which says CHOOSE A MOD while nothing is selected, and otherwise shows the selected mod's thumbnail, downloaded when the mod is selected and fitted into the same box as on the mods screen; its name; right under it, its status line, in gold: INSTALLED with the installed version, BY HAND where the settings file doesn't record the install, and UPDATE TO with the catalogue's version where it is newer, INSTALLED BY HAND AS A FOLDER: INSTALL WON'T REPLACE IT where a folder mod of the name is in the `mods` folder, DOWNLOADING with the percentage, or INSTALLED: RESTART TO APPLY; in red: NEEDS OPENRELIANT with the version, or why the install failed. Then its version and author; its full category, as IN SHIPS / FIGHTERS / ALLIANCE; the repository that lists it, as FROM openreliant-mods; the OpenReliant it needs, in red when it is newer than this one; its size and its description, which takes the lines left. During a download, a progress bar at the bottom of the panel, measured against the size the catalogue gives.
-- The settings screen's buttons: OK and MAIN MENU in the left column. In the right column, INSTALL (or UPDATE when an older version is installed) where RESET DEFAULTS is, dimmed when there is nothing to do, and RELOAD where CANCEL CHANGES is, which reads the repositories again and tries again the thumbnails that failed. Both are dimmed while a mod downloads: one download runs at a time, and the catalogue can't change under it. OK and Escape go back to the mods screen, which rereads the `mods` folder if a mod was installed.
+- The framed panel from (401, 136), which says CHOOSE A MOD while nothing is selected, and otherwise shows the selected mod's thumbnail, downloaded when the mod is selected and fitted into the same box as on the mods screen; its name; right under it, its status line, in gold: INSTALLED with the installed version, BY HAND where the settings file doesn't record the install, and UPDATE TO with the catalogue's version where it is newer, INSTALLED BY HAND AS A FOLDER: INSTALL WON'T REPLACE IT where a folder mod of the name is in the `mods` folder, DOWNLOADING with the percentage, CANCELING once CANCEL was pressed, or INSTALLED: RESTART TO APPLY; in red: NEEDS OPENRELIANT with the version, or why the install failed. Then its version and author; its full category, as IN SHIPS / FIGHTERS / ALLIANCE; the repository that lists it, as FROM openreliant-mods; the OpenReliant it needs, in red when it is newer than this one; its size and its description, which takes the lines left. During a download, a progress bar at the bottom of the panel, measured against the size the catalogue gives.
+- The settings screen's buttons: OK and MAIN MENU in the left column. In the right column, INSTALL (or UPDATE when an older version is installed) where RESET DEFAULTS is, dimmed when there is nothing to do, and RELOAD where CANCEL CHANGES is, which reads the repositories again and tries again the thumbnails that failed. While a mod downloads, one download runs at a time and the catalogue can't change under it, so RELOAD is dimmed, and INSTALL reads CANCEL while the downloading mod is chosen and is dimmed while another is. CANCEL stops the download, which deletes its part file; the panel says CANCELING until the download's thread has stopped, then shows the mod as it was before. OK and Escape go back to the mods screen, which rereads the `mods` folder if a mod was installed.
 
-The repositories `starlancer.ini` names ([Repositories](../guide/modding.md#repositories)) are read one after another into one catalogue, where the first repository to list an id wins, and the catalogue is kept until RELOAD or until the front end closes. A mod without the keys it needs (`id`, `archive`, `sha256`, `size`), whose id can't name a mod, or whose size is over 4294967295 bytes, the most a HOG archive's 32-bit offsets reach, is skipped with a line in the log, which escapes the id; an index in a newer format fails with THE CATALOG NEEDS A NEWER OPENRELIANT. Every download goes through [`web.zig`](../../src/engine/web.zig), on a thread of its own with its own HTTP client, and over HTTPS: `http` is changed to `https` before each request and each redirect, which the download follows itself, five at most; any other scheme is refused. Each request sends `OpenReliant` as its user agent. The player's own machine (`localhost` and the names under it, `127.0.0.0/8` and `0.0.0.0` in every form the system's resolver reads, such as `127.1`, and `::1`, `::` and the IPv4 addresses mapped into IPv6) is read only for a repository whose URL names it, and for the thumbnails and archives its index links, over plain HTTP. Anywhere else, a link to the player's machine, or a redirect to it from another host, fails with THE CATALOG POINTS AT THIS COMPUTER, so that a repository on the web can't make OpenReliant send requests to the services on the player's machine. A host name that the system's resolver turns into the player's own address isn't caught, since only the link itself is checked, but such a link is read over HTTPS, so a service there gets the start of a secure connection that it can't complete, never a request. A failure says what happened: the server's name can't be found, a secure connection can't be made, the system's certificates can't be loaded, too many redirects, a bad redirect, and so on. An index or a thumbnail gives up after 60 seconds, or after 15 seconds without anything arriving, and an archive after 30 seconds without anything arriving, with THE SERVER DOESN'T ANSWER. An index is read up to 4 MiB and a thumbnail up to 2 MiB; an archive is read up to the size the catalogue gives, and a download that goes past it, or that the server announces at another size, stops at once. INSTALL downloads the archive into `<id>.hog.part` in the `mods` folder, hashing the bytes on their way to the file. Once the archive is complete and matches the catalogue's digest, the digest is written as `<id>.hog.sha256.part`, the archive's part is renamed to `<id>.hog`, replacing an older copy, and the checksum file's part is renamed to `<id>.hog.sha256`; then the install is recorded in `[OpenReliantInstalledMods]` with the repository's name, so that the loader refuses the archive without its checksum file from then on. A download that fails or doesn't match leaves nothing behind; if the checksum file can't be put in place, the archive is removed again, with the checksum file of the copy it replaced. Leaving the screen lets a download continue. Closing the front end lets go of it without waiting, so that quitting is never held up, not even by a lookup of a host's address, which nothing can interrupt: the download's thread cancels it and ends on its own, deleting an archive's part file, unless OpenReliant has ended first, in which case the next install of the mod replaces the part file. Not yet: cancelling a download from the screen ([#1040](https://github.com/OpenReliant/openreliant/issues/1040)), and updates shown on the mods screen ([#1041](https://github.com/OpenReliant/openreliant/issues/1041)). The GET MODS button on the mods screen uses the settings screen's shapes, at (45, 116) with its label to its right, and is shown only when the settings file names a repository.
+The repositories `starlancer.ini` names ([Repositories](../guide/modding.md#repositories)) are read one after another into one catalogue, where the first repository to list an id wins, and the catalogue is kept until RELOAD or until the front end closes. A mod without the keys it needs (`id`, `archive`, `sha256`, `size`), whose id can't name a mod, or whose size is over 4294967295 bytes, the most a HOG archive's 32-bit offsets reach, is skipped with a line in the log, which escapes the id; an index in a newer format fails with THE CATALOG NEEDS A NEWER OPENRELIANT. Every download goes through [`web.zig`](../../src/engine/web.zig), on a thread of its own with its own HTTP client, and over HTTPS: `http` is changed to `https` before each request and each redirect, which the download follows itself, five at most; any other scheme is refused. Each request sends `OpenReliant` as its user agent. The player's own machine (`localhost` and the names under it, `127.0.0.0/8` and `0.0.0.0` in every form the system's resolver reads, such as `127.1`, and `::1`, `::` and the IPv4 addresses mapped into IPv6) is read only for a repository whose URL names it, and for the thumbnails and archives its index links, over plain HTTP. Anywhere else, a link to the player's machine, or a redirect to it from another host, fails with THE CATALOG POINTS AT THIS COMPUTER, so that a repository on the web can't make OpenReliant send requests to the services on the player's machine. A host name that the system's resolver turns into the player's own address isn't caught, since only the link itself is checked, but such a link is read over HTTPS, so a service there gets the start of a secure connection that it can't complete, never a request. A failure says what happened: the server's name can't be found, a secure connection can't be made, the system's certificates can't be loaded, too many redirects, a bad redirect, and so on. An index or a thumbnail gives up after 60 seconds, or after 15 seconds without anything arriving, and an archive after 30 seconds without anything arriving, with THE SERVER DOESN'T ANSWER. An index is read up to 4 MiB and a thumbnail up to 2 MiB; an archive is read up to the size the catalogue gives, and a download that goes past it, or that the server announces at another size, stops at once. INSTALL downloads the archive into `<id>.hog.part` in the `mods` folder, hashing the bytes on their way to the file. Once the archive is complete and matches the catalogue's digest, the digest is written as `<id>.hog.sha256.part`, the archive's part is renamed to `<id>.hog`, replacing an older copy, and the checksum file's part is renamed to `<id>.hog.sha256`; then the install is recorded in `[OpenReliantInstalledMods]` with the repository's name, so that the loader refuses the archive without its checksum file from then on. A download that fails or doesn't match leaves nothing behind; if the checksum file can't be put in place, the archive is removed again, with the checksum file of the copy it replaced. Leaving the screen lets a download continue. CANCEL stops it: its thread cancels the request, deletes the archive's part file and ends, and only then does the screen let the install go, so that an install of the same mod started right after can't run into the part file being deleted. Closing the front end lets go of a download without waiting, so that quitting is never held up, not even by a lookup of a host's address, which nothing can interrupt: the download's thread cancels it and ends on its own, deleting an archive's part file, unless OpenReliant has ended first, in which case the next install of the mod replaces the part file. Not yet: updates shown on the mods screen ([#1041](https://github.com/OpenReliant/openreliant/issues/1041)). The GET MODS button on the mods screen uses the settings screen's shapes, at (45, 116) with its label to its right, and is shown only when the settings file names a repository.
 
 ## The mod's options
 

diff --git a/docs/guide/modding.md b/docs/guide/modding.md
@@ -200,8 +200,10 @@ list, with the panel saying which version is installed and which one the update
 needs a newer OpenReliant is red and can't be installed. A mod you copied into the `mods` folder as
 a folder is left alone, and the panel says so, since OpenReliant would load both the folder and the
 archive. RELOAD reads the repositories again. One download runs at a time: INSTALL and RELOAD wait
-for it. OK goes back to the mods screen, which now lists the installed mods. Like every change on
-the mods screen, they take effect at the next start.
+for it. While the mod you chose downloads, INSTALL reads CANCEL instead: it stops the download and
+leaves nothing in the `mods` folder, and the panel says CANCELING for a moment while the download
+stops. Leaving the screen lets a download go on. OK goes back to the mods screen, which now lists
+the installed mods. Like every change on the mods screen, they take effect at the next start.
 
 The catalogue and the downloads run in the background, so the menus keep working, and the panel
 shows the download's progress. Besides the check for a newer release ([Newer
@@ -217,9 +219,7 @@ CATALOG POINTS AT THIS COMPUTER. A server that stops answering fails with THE SE
 an index or a thumbnail gives up after a minute, or after 15 seconds with nothing arriving, and an
 archive after 30 seconds with nothing arriving. RELOAD then reads the repositories again, and tries
 again the thumbnails that failed. Quitting OpenReliant never waits for a download. The screen lists
-at most 127 mods. A download can't be cancelled yet
-([#1040](https://github.com/OpenReliant/openreliant/issues/1040)), and the mods screen doesn't say
-yet which of its mods have an update
+at most 127 mods. The mods screen doesn't say yet which of its mods have an update
 ([#1041](https://github.com/OpenReliant/openreliant/issues/1041)).
 
 OpenReliant records the mods GET MODS installs in `starlancer.ini`, in the section