The destination list is one blob, sent the same to every player at login. A concealed gate riding in it would sit in every client's memory the moment they joined, and "concealed" would mean only that the window declines to draw it. So these gates are withheld from that list entirely, and each player's own finds are sent to that player alone.

A claim is checked against the world, not taken on trust: the only thing a client sends is which gate it touched. The server checks that the gate exists, that it is concealed, who the claimant really is, and that they are standing within 30 m of it. The record lives on the gate itself, in the world save — no side file, nothing the player can edit.

Concealed gates are placed by the corpse run's own scanner — real edge-to-edge room from every tree, rock, building piece, portal and generated location, with the ground height from the game's own terrain recipe, terraforming included — and every seeded name is checked unique against the whole world, because vanilla connects two portals whose names match. They are deliberately not marked as test litter, so tidying up after a test never deletes them.

EnableConcealedPortals is on, and dormant until an admin seeds a world. Switching it off stops discovery and leaves standing gates where they are; tortal_concealedclear is what removes them.

The server builds the list — it is the only machine that holds the whole world — and hands it to each player at login, so it is complete from the first portal you touch. Install on a world that has been running for months and the startup scan finds every gate already standing; nobody has to visit them first.

The map marks are never saved. Every listed portal is marked on the great map while the window is open, labelled with its name, and the map centres clear of the window so you see the country around your destination. The marks vanish when the window closes; your own pins are your own business. The gate you are standing at is marked too, labelled (here).

Favourites are yours: stored on your own machine, per world, and renaming a portal keeps its star. The gate you stand at is not in the list — you cannot travel to where you already are — so its configuration window has its own Favorite toggle beside the PIN lock, applied on Save.

Typing does not walk you into the gate. While any of the mod's fields has the keyboard your character stands still and hotkeys hold their peace; Esc hands the keyboard back without closing the window. The window can put the cursor straight in the search box as it opens (FocusSearchOnOpen), off by default because a focused field swallows WASD.

It opens when you mean it. The window opens within MenuOpenDistance of the gate, measured flat across the ground, and only within MenuVerticalDistance above or below it — so the storey above a portal, or a flight over it, does not throw a window in your face. A solid floor between you and a gate below keeps it shut.

No portal waits for a visitor. Valheim only builds the world around players, so a gate nobody stood near could never be photographed. The camera anchors one unphotographed portal at a time, streams in a small patch of world around it, waits for the terrain to genuinely finish, takes the shot and lets it all unload seconds later. It works on hosted worlds and dedicated servers alike, and unphotographed portals go first, so an established server fills in its whole album on its own. A background pass re-shoots old pictures so a rebuilt or burnt-out destination stops showing the old view.

The destination gets its own sky. Valheim keeps one sky, one sun, one set of weather and one field of grass, welded to wherever you stand. The anchored camera borrows the destination's own fog, sun, light, weather and grass for the moment it draws, then hands your view straight back. Ash falls in the Ashlands. It rains in the swamp at night. (AnchoredEnvironment.)

The live view ships switched off (EnableLivePreviews). It is not a video: your game builds the destination and holds it standing while you watch — terrain, trees, buildings and creatures, sized by AnchorZoneRing — and on a dedicated server all of it crosses the wire first. Expect several seconds of warm-up on a large or distant destination. The still stands in while it loads, with an amber GOING LIVE badge, then a red LIVE; closing the album unloads everything within seconds. The stored photograph is the finished feature.

Photographs are kept small enough to send. A picture lives on its portal, and a portal crosses the wire whole, so a shot that would not fit is re-encoded a little softer, or dropped while the gate keeps the picture it had. CameraResolution sets the size; existing photographs keep theirs.

Traders stay on the ground. A far shot could catch Haldor, Hildir or the Bog Witch before her zone's terrain had arrived; RepairSunkenTraders watches them for half a minute after they appear and lifts one standing under the ground back up to it — never down onto it, so a trader on a platform stays put.

The icon choice lives on the portal itself and travels in the destination list, so even portals nobody has visited are drawn with their proper marker. A portal's name and its icon are separate: rename it and it keeps its marker; change its marker and it keeps its name.

Icons from the server are cached by content, so each machine downloads one once, ever — across servers and worlds. Icons everyone already has, including the eight that ship with the mod, are never sent. If a server's icon shares a name with one of yours, the server's copy wins, so everyone at the table sees the same thing; your file is left untouched on disk.

Size costs memory, not looks. Vanilla draws every marker into a fixed box — 48 px on the great map, 32 px on the minimap — so any image is scaled into it. A 4096×4096 PNG holds roughly 64 MB of video memory to draw something 48 pixels across, and the log says so. The shipped icons are 48×48, exactly the box. Non-square images are letterboxed rather than stretched.

Both ends are placed properly. The server scans outward from the tombstone (and from the bed) in one-metre rings for a spot with CorpseRunClearanceMeters of room — measured edge to edge from every tree, boulder, building piece, portal and generated location, using each object's real footprint, so a rock that spans eight metres counts as eight metres of rock. That figure is a preference: ten metres of room from everything does not exist in a forest, so it is tried in descending steps — the full figure, then 70 %, 50 % and 35 % — down to the CorpseRunMinRoomMeters floor, and the gate takes the closest spot honouring the largest step the ground can offer. Only if nothing in range meets even the floor does the search widen, and then the log says by how much it fell short.

On the ground, not in it. The ground height is the game's own terrain recipe re-run on the server, terraforming included, so a gate beside a bed on a levelled base stands on the levelled floor, and the frame's four corners are checked so it neither floats off a slope nor wedges against a cliff.

Restarts leave no strays. A gate raised by a previous run and forgotten is reaped at startup; a tombstone still standing after a restart, from a death within CorpseRunMaxGraveAgeMinutes, gets a fresh gate. If either end of a standing gate goes missing, the server raises it again on the same spot.

Not a farm. Corpse gates are never in the destination list, on the map, in the export or counted against anyone's cap. They cannot be hammered down for their materials — dying is not a way to farm surtling cores — they are always self-healing, and they refuse any removal the mod did not ask for. Ordinary player portals stay their builder's to take down.

Self-healing stops damage at the one place every kind of it goes through — blows, fire, weather, ash, collapse. Switch SelfHealingPortals off and portals go back to being as mortal as any other piece, live, with no reload.

The health check looks for what can actually go wrong with a portal under this mod: a gate buried in the terrain, a destination photograph too large to send (one can disconnect every client who walks near the gate, in a loop), a map icon the server does not offer, a stray corpse gate, a player over the portal cap, a portal at dungeon height, leftover scatter litter, and a few notes (gates with no builder, duplicate names, a PIN-locked gate nobody owns).

Repair is bounded. It lifts a buried gate up to the ground (never down onto it), strips an oversized photograph (saved beside the snapshot first, and re-shot later), clears an unknown icon and removes a stray corpse gate. Anything that belongs to a player is reported and left alone. Snapshots are also taken on every world save.

Filters. Fill the whitelist and only those items may pass beyond vanilla's rules — add Bronze and Bronze travels while Iron stays blocked. The blacklist blocks items even if they would normally be allowed.

None of the frame is a shipped image. Every rail, flourish and crest is generated at runtime under a single consistent light — no textures, no shaders, no asset bundles, so it can never show you a missing-texture pink square. The only files the mod installs are the eight map icons, plain PNGs you can open, edit or delete.

Text too small or too large? UITextScale moves it between 0.6× and 3×, UIFontSizeDelta adds up to +24 points on top, and rows, fields, buttons and windows grow with it so nothing clips. VFXTintPortalFrame tints the portal's own glowing panel to the gateway's colour, so the two read as one object.

1. Open the portal's configuration window. The Configure button in the destination window's top row (left of Close) is the reliable way in; E at the gate does the same, but only when no text field has the keyboard.
2. Use the Map icon grid. — means no icon of its own, and the portal falls back to your PortalPinIcon setting. With more icons than fit, the last cell reads +N ▸ and opens a scrolling panel.
3. Hit Save. The choice is stored on the portal, so every player sees it.

Your own artwork: drop PNGs into the TortalPortalPins folder beside TortalPortal.dll and restart. The filename is the icon's name — deep_mine.png shows as deep mine — and the filename is what is stored, so renaming a file later un-marks every portal using it. Transparency is respected.

Your own default marker: set PortalPinIcon = Custom and put the icon's name in DefaultPinIcon (a dropdown in ConfigurationManager). It works for icons the server sent you too. An old single TortalPortalPin.png beside the plugin still works with DefaultPinIcon left empty.

1. Drop PNGs into the TortalPortalPins folder beside the server's TortalPortal.dll.
2. Run tortal_pinreload from any admin's console, or restart the server.
3. Each player downloads only the icons they are missing, once per machine.

Limits: 256×256, 96 KB and 64 icons per world; oversized files are named in the server log and not offered. ShareIconsFromServer = false turns it off.

Test gates. Cheat commands — enable devcommands first, which on a server means being on its adminlist.

• tortal_scatter [count] [radius] — raises portals at random across the world: default 25 within 2 000 m, up to 500 at a time and 10 000 m. Each is named for its biome, and every 5th one is PIN-locked with 1234.
• tortal_scatterclear — removes every portal tortal_scatter raised and nothing else. From a client it also asks the server to sweep the whole world.

Scatter a network on day one — tortal_scatter 100 10000 covers the world — and the camera photographs it portal by portal, so the server opens with an album no player has visited.

Concealed gates. Not cheat commands: typed at the server console they run there; typed in a client's console they go to the server, are checked against its adminlist, and answer back in your console.

• tortal_scatterconcealed [count] [radius] — seeds concealed gates: default 25 within 4 000 m, up to 200 at a time and 10 000 m. The summary comes back when the last one is placed.
• tortal_concealedclear — removes every concealed gate, found or not, and takes it off everyone's list.
• tortal_concealed — how many stand, how many are found, and by whom.

None of these are cheats. At the server console they run there; in a client's console they go to the server, are checked against its adminlist, and answer back. Everything lands in the server log as well.

• tortal_health — scans every portal now and lists what it found, worst first.
• tortal_repair — a dry run: lists exactly what a repair would do and touches nothing.
• tortal_repair --apply — does it, at most RepairMaxActionsPerRun fixes per pass, after saving a snapshot named pre-repair-<time>; the reply names it.
• tortal_snapshot [name] — saves every portal's name, PIN, icon, builder and position to BepInEx/config/TortalPortal/snapshots/.
• tortal_snapshots — lists them, newest first.
• tortal_restore <name> [--recreate] — puts every portal back as the snapshot has it, matched by position. A vanished portal is reported; --recreate raises it again. A snapshot from another world is refused.

AutoRepair runs the repair on the scan's timer; RepairDryRunDefault (on) decides whether that pass may write.