Changelog

1.0.8

Fixed stale/incorrect blocked lists surviving across save deletion. The ES3 data (stored inside the save file) is now the single source of truth on load; the JSON mirror in BepInEx/config is no longer read back as a fallback (that could "resurrect" an old list into a freshly recreated save slot). The mirror stays for inspection/export only.
Clears our data when a save is deleted — hooked ES3.DeleteFile, so deleting a save removes the corresponding blocked list (JSON mirror + in-memory). ES3 data goes with the deleted save file.
On loading a fresh save (no ES3 data), any orphaned JSON mirror for that slot is cleaned up.
The one-shot ResetBlockedListOnNextLoad now also deletes the JSON mirror.

Fixes a freeze/crash when pulling the ship lever with many destroyed moons. With enough moons blocked, RandomMoonFX could be left with no selectable moon and spin in a re-roll loop (game freeze) or throw on an empty pool. Added:
- A re-roll-storm guard: if RandomMoonFX hammers our filter far more than any real moon count (i.e. it's stuck), we stop blocking and briefly allow routing so its selection always terminates.
- A safety-net finalizer on RandomMoonFX's routing methods that swallows any exception instead of letting it crash the game.
- New config Compatibility/FilterRandomMoonFXPool (default on) to fully disable the random-pool filtering if ever needed — destroyed moons stay blocked by the terminal/level-change guard.

Performance/stability hardening. The routing / RandomMoonFX "all-blocked" fail-safe check is now cached (recomputed only when the blocked list, config lists or moon count change) instead of scanning every moon and re-parsing config on each call — removes per-call allocation/GC pressure.
Parsed whitelist/blacklist are cached too.
Strikethrough now skips any text that already contains a <s> tag, eliminating any possibility of compounding/nesting rich-text tags.

Crash safety: our filters can never leave zero moons available. When every routable (non-Company) moon is blocked, blocking is ignored for ROUTING purposes, so RandomMoonFX's random pool can never be emptied by us (an empty pool could crash on selection). Combined with the existing auto-reset, you can always fly somewhere.
Every game-facing patch is now wrapped in try/catch (RandomMoonFX filter, terminal routing, level-change guard, strikethrough, commands) so an internal error degrades gracefully instead of crashing the game.
New: Moon buyback. Pay to restore a destroyed moon from the terminal.
- Config Buyback/EnableMoonBuyback (on) and Buyback/MoonBuybackPrice (default 500).
- A MOON BUYBACK section is appended to the terminal HELP page once any moon has been destroyed.
- Commands: BUYBACK (list + prices) and BUYBACK [moon name] (purchase). Credits are charged via the game's own credit sync; restoring is host-authoritative and synced to clients.

Auto-reset when everything is destroyed. Once every routable (non-Company) moon has been blocked, the destroyed-moon list clears itself automatically so the moons become available again and you are never left with nowhere to go. Toggle with General/AutoResetWhenAllBlocked. The Company building (Gordion) is excluded from the count since it can't melt down.

Removed the destroymoon and restoremoons terminal commands. Only moonstatus remains (lists destroyed moons, now with proper names like "20 Adamance").
Strikethrough in the terminal is now more robust: matches the moon name case-insensitively and tries both the full name ("20 Adamance") and the numberless name ("Adamance"), so it reliably strikes exploded moons in the >MOONS list regardless of how the list is formatted.

Fixed the save-list lifecycle patches never applying. They used method-level Harmony attributes with no class-level [HarmonyPatch], which HarmonyX's PatchAll skips — so the destroyed-moon list was never loaded on game start (a moon blocked in one session was not restored in the next) and multiplayer sync never registered. Split into properly attributed classes with diagnostic logging (StartOfRound.Start — IsHost=...).
Meltdown detection now also hooks the meltdown START (MeltdownHandler.StartMeltdownClientRpc), not just the final fireball. A started FacilityMeltdown always explodes, so this reliably catches meltdowns even when the crew leaves before the blast. Configurable via General/BlockOnMeltdownStart.
Detonation handler now logs unconditionally (Meltdown signal received. moon=..., IsHost=...), de-dupes, and ensure-loads the list before blocking so it can never overwrite saved data.
New: destroyed moons are struck through in the terminal (e.g. the >MOONS list) via a strikethrough line. Toggle with Visuals/StrikethroughBlockedMoons.

Fixed a crash in the FacilityMeltdown detonation auto-detector that aborted mod init when an uninstalled soft-dependency (e.g. me.loaforc.diomedes) was referenced by a scanned method. Method scanning is now fully crash-proof and each integration is isolated.
Meltdown detection now targets the real explosion directly: FacilityMeltdown.MeltdownSequence.Behaviours.FacilityExplosionHandler.Awake (verified against FacilityMeltdown 2.7.5), with the public MeltdownAPI as a fallback.
RandomMoonFX integration now Harmony-patches RandomMoonFX.Utils.IsMoonBlacklisted / IsMoonValid (verified against 1.4.3) instead of poking a field, so destroyed moons are reliably excluded from the random lever pool.
Soft-dependency presence checks are now case-insensitive (fixes RandomMoonFX zigzag.randommoonfx and Meltdown_Chance den.meltdownchance not being detected).