debug: disable DualAuth agent to test fastutil classloader issue

Temporarily skip -javaagent injection to determine if agent's
appendToBootstrapClassLoaderSearch() causes the fastutil
ClassNotFoundException on affected Windows systems.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/managers/gameLauncher.js

@@ -482,15 +482,11 @@ async function launchGame(playerNameOverride = null, progressCallback, javaPathO
     }
   }
 
-  // DualAuth Agent: Set JAVA_TOOL_OPTIONS so java picks up -javaagent: flag
-  // This enables runtime auth patching without modifying the server JAR
+  // DualAuth Agent: DISABLED for debug - testing fastutil classloader issue
+  // TODO: re-enable after testing
   const agentJar = path.join(gameLatest, 'Server', 'dualauth-agent.jar');
   if (fs.existsSync(agentJar)) {
-    const agentFlag = `-javaagent:"${agentJar}"`;
-    env.JAVA_TOOL_OPTIONS = env.JAVA_TOOL_OPTIONS
-      ? `${env.JAVA_TOOL_OPTIONS} ${agentFlag}`
-      : agentFlag;
-    console.log('DualAuth Agent: enabled via JAVA_TOOL_OPTIONS');
+    console.log('DualAuth Agent: SKIPPED (debug build - fastutil classloader test)');
   }
 
   try {

docs/FASTUTIL_CLASSLOADER_ISSUE.md

@@ -1,6 +1,6 @@
 # Singleplayer Server Crash: fastutil ClassNotFoundException
 
-## Status: Open (user-specific, Feb 24 2026)
+## Status: Open (multiple users, Feb 24-27 2026)
 
 ## Symptom
 
@@ -16,12 +16,14 @@ Caused by: java.lang.ClassNotFoundException: it.unimi.dsi.fastutil.objects.Objec
 
 Server exits with code 1. Multiplayer works fine for the same user.
 
-## Affected User
+## Affected Users
+
+1. **ヅ𝚃 JAYED !** (Feb 24) — Windows x86_64, had AOT cache errors before fastutil crash
+2. **Asentrix** (Feb 27) — Windows x86_64 (NT 10.0.26200.0), RTX 4060, Launcher v2.4.4, NO AOT cache errors
 
-- Discord: ヅ𝚃 JAYED !
-- Platform: Windows (standard x86_64, NOT ARM)
 - Reproduces 100% on singleplayer, every attempt
-- Other users (including macOS/Linux) are NOT affected
+- Multiplayer works fine for both users
+- macOS/Linux users are NOT affected
 
 ## What Works
 
@@ -43,42 +45,49 @@ Server exits with code 1. Multiplayer works fine for the same user.
 - **Corrupted game files**: Repair/reinstall didn't help
 - **ARM64/Parallels**: User is on standard Windows, not ARM
 
-### Likely Causes (user-specific)
+### Likely Cause
 
-1. **Antivirus interference** — Windows Defender or third-party AV blocking Java from reading classes out of JAR files, especially with `-javaagent` active
-2. **Corrupted/incompatible JRE** — bundled JRE might be broken on their system
-3. **File locking** — another process holding HytaleServer.jar open
+**CDS (Class Data Sharing) broken by bootstrap classloader modification.** DualAuth agent calls `appendToBootstrapClassLoaderSearch()` which triggers JVM warning: `"Sharing is only supported for boot loader classes because bootstrap classpath has been appended"`. This disables AppCDS for application classes. On some Windows systems, this breaks the classloader's ability to find classes (including fastutil) from the fat JAR.
 
-## Debugging Steps (ask user)
+This warning appears for ALL users, but only breaks classloading on some Windows systems — reason unknown.
 
-1. **Does official Hytale singleplayer work?** (without F2P launcher)
-   - Yes → something about our launch setup
-   - No → their system/JRE issue
+### Other Possible Causes
 
-2. **Check antivirus** — add game directory to Windows Defender exclusions:
-   - Settings → Windows Security → Virus & threat protection → Exclusions
-   - Add their HytaleF2P install folder
+1. **Antivirus interference** — AV blocking Java from reading classes out of JAR files
+2. **File locking** — another process holding HytaleServer.jar open (Asentrix had stalled java.exe killed at launch)
 
-3. **Verify fastutil is in the JAR**:
-   ```cmd
-   jar tf "D:\path\to\Server\HytaleServer.jar" | findstr fastutil
-   ```
-   - If output shows fastutil classes → JAR is fine, classloader issue
-   - If no output → JAR is incomplete/corrupt (different from other users)
+## Potential Fix: `-Xshare:off` (testing Feb 27)
 
-4. **Try without DualAuth agent** — rename `dualauth-agent.jar` in Server/ folder, retry singleplayer
-   - If works → agent's classloader manipulation breaks fastutil on their setup
-   - If still fails → unrelated to agent
+Disables CDS entirely, forcing standard classloading. User can add via launcher:
+1. **Settings** → **Java Wrapper Configuration** → **Arguments to Inject**
+2. Add `-Xshare:off` with **Server Only** condition
+3. Retry singleplayer
 
-5. **Check JRE version** — have them run:
-   ```cmd
-   "D:\path\to\jre\latest\bin\java.exe" -version
-   ```
+Sent to affected users for testing — **awaiting results**.
 
-## Update (Feb 24): `-XX:+UseCompactObjectHeaders` stripping removed from defaults
+If confirmed, should be added as default inject arg (server-only) in launcher config.
 
+## Debugging Steps (for reference)
+
+Most steps are impractical for F2P users:
+- ~~Official Hytale singleplayer~~ — F2P users don't have official access
+- ~~Try without DualAuth agent~~ — not possible, agent required for F2P token validation
+- ~~Verify fastutil in JAR~~ — same JAR for all users, not a user-actionable step
+- ~~Check JRE version~~ — bundled with launcher, same for all users
+
+**Practical steps:**
+1. **Add `-Xshare:off`** via wrapper inject args (server-only) — testing now
+2. **Check antivirus** — add game directory to Windows Defender exclusions
+3. **Check for stalled processes** — kill any leftover java.exe/HytaleServer before launch
+
+## Update History
+
+### Feb 24: `-XX:+UseCompactObjectHeaders` stripping removed from defaults
 Stripping this flag did NOT fix the issue. The server already has `-XX:+IgnoreUnrecognizedVMOptions` so unrecognized flags are harmless. The flag was removed from default `stripFlags` in `backend/core/config.js`.
 
+### Feb 27: Second user (Asentrix) reported, `-Xshare:off` sent for testing
+Asentrix hit the same crash on Launcher v2.4.4. Unlike JAYED, no AOT cache errors — just the CDS sharing warning followed by fastutil ClassNotFoundException. This confirms the issue is not AOT-specific but related to CDS/classloader interaction with the DualAuth agent's bootstrap CL modification. Sent `-Xshare:off` workaround to affected users — awaiting results.
+
 ## Using the Java Wrapper to Strip JVM Flags
 
 If a user needs to strip a specific JVM flag (e.g., for debugging or compatibility), they can do it via the launcher UI:
@@ -110,4 +119,5 @@ Config is stored in `config.json` under `javaWrapperConfig`:
 
 - Java wrapper config: `backend/core/config.js` (stripFlags / injectArgs)
 - DualAuth Agent: v1.1.12, package `ws.sanasol.dualauth`
-- Game version at time of report: `2026.02.19-1a311a592`
+- Game version at time of reports: `2026.02.19-1a311a592`
+- Log submission ID (Asentrix): `c88e7b71`