Runtime Paths and User Data Locations

Launcher application data

The Launcher uses the operating system’s application-data directory. On Windows this is %APPDATA%/Anomaly/; a native Linux Launcher uses Environment.SpecialFolder.ApplicationData/Anomaly (normally $XDG_CONFIG_HOME/Anomaly or ~/.config/Anomaly):

<launcher-application-data>/Anomaly/
+-- launcher.json
+-- launcher.json.lock
+-- installed_mods.json
+-- catalog_cache.json
+-- game_builds_cache.json
+-- installer_logs/
+-- patch_audit.json
+-- cache/
+-- CrashReports/        launcher crash reports

launcher.json is owned by the Launcher and stores GameRoot, active-loadout state, and the highest accepted signed official-core version used to reject downgrades.

Client instance data

The client uses Path.Combine(MelonEnvironment.UserDataDirectory, "Anomaly"), normally the selected game’s UserData/Anomaly directory. Paths.AnomalyPath and Paths.AnomalyUserDataPath resolve to that same root. Each game instance owns these files:

<MelonLoader UserData>/Anomaly/
+-- user.json
+-- user.json.bak
+-- server-trust.json
+-- content-consent.json
+-- FileCache/
|   +-- manifest.json
|   +-- .incoming/
|   +-- .quarantine/
+-- CrashReports/       client crash reports and opted-in minidumps

user.json is owned by the client runtime. It contains nickname, DPAPI current-user protected private identity, non-secret identity_public, and optional rotation lineage. A missing instance-local profile creates a new identity; an existing profile is reused. Protection remains bound to the current Windows user or Wine prefix. A failed decrypt preserves the original file and blocks identity-dependent operations.

server-trust.json stores endpoint-keyed server identity pins and signed rotations. A malformed or unreadable trust store makes server authentication fail closed.

content-consent.json stores approvals scoped to server fingerprint, catalog digest, and manifest digest. It is separate from physical cached blobs.

FileCache stores SHA-256-addressed PNG/OGG blobs and an atomic index. Startup reconciliation quarantines orphan, corrupt, temporary, or over-budget files.

CrashReports contains local JSON reports and opted-in minidumps. See Logs and Crash Reports.

GameRoot and loadouts

GameRoot/
+-- games/<version>/
+-- mods-cache/
+-- loadouts/<name>/
|   +-- loadout.json
|   +-- local/
|   +-- runtime/
|       +-- Mods/
|       +-- UserLibs/
|       +-- Plugins/
|       +-- UserData/
+-- wineprefixes/<loadout>/

The runtime view is materialized for one selected loadout. The development Launcher inventories DLL load surfaces and the Anomaly managed-module directory under an audit policy. New and rebuilt local assemblies remain in place without individual hash approvals or automatic quarantine. A local/Mods/Anomaly.Client.dll selects the local core; otherwise the Launcher resolves and verifies a signed official package. The Quarantine directory holds files already listed in the loadout’s quarantine panel.

MelonLoader UserData

The active loadout links its runtime UserData into the selected game build:

<UserData>/
+-- MelonPreferences.cfg
+-- i18n/<namespace>/<locale>.yaml
+-- Skins/
+-- Anomaly/
    +-- bindings.json
    +-- Modules/
    +-- modules.lock.json
    +-- module-health.json
    +-- module-startup-marker.json
    +-- safe-mode.flag
    +-- Quarantine/managed-runtime/
    +-- Overrides/AudioClip/
    +-- Release/
        +-- LICENSE
        +-- NOTICE
        +-- THIRD_PARTY_DEPENDENCIES.md

Modules holds Anomaly-owned IAnomalyMod assemblies and their .anomaly.json sidecars. Quarantine/managed-runtime holds modules moved after repeated startup failures. safe-mode.flag disables managed-module loading.

The CASSIE audio catalog lists player-local replacement paths. The runtime scans the audio directory at startup.

Linux and Proton

Launcher-owned files retain their platform-specific application-data location. Client files use the game’s MelonLoader UserData root on both Windows and Proton. The Wine prefix remains the protection context for private identity material; a local file path does not make the identity portable between prefixes. A missing instance-local profile creates a new identity.

Server data

Anomaly.Server stores server_identity and accepted_client_identities.json in the plugin’s LabAPI configuration directory. Keep them private and include them in operator backups. The identity protects the server fingerprint and the accepted-client journal prevents identity rollback/forks.

Continue to Logs and Crash Reports.