Hang gen1tls on love.system and forward tls* through LegacyCompat.

We already ship the DLL, but mods can't ffi-load it under the sandbox, and
the compat love.system shim wasn't passing tls* through either. So wss://
still died on stock builds. Engine loads the dialer at boot; compat forwards
those keys; clipboard/openURL stay stubbed.

Co-authored-by: Cursor <cursoragent@cursor.com>

main.lua

@@ -263,6 +263,11 @@ function love.load(args)
   -- of each flashing their own cmd.exe window (#606).  No-op elsewhere.
   require("src.core.HostShell").hideHostConsole()
 
+  -- Hang gen1tls on love.system before mods boot.  Android already has tls*
+  -- from JNI; this is the desktop half.  No DLL / no FFI is fine -- ws://
+  -- rooms still work, wss:// just won't.
+  pcall(function() require("src.net.Gen1Tls").install() end)
+
   -- NX fused mounts are unreliable for the blue|yellow cache overlay: wrap
   -- the love loaders once so every generated-asset read falls back to the
   -- versioned save-dir copy.  Never installed on desktop/Android/iOS.

src/mods/LegacyCompat.lua

@@ -662,7 +662,13 @@ end
 
 local function systemShim(ctx)
   local function real() return _G.love and _G.love.system or nil end
-  return {
+  -- tls* comes from the engine (Android JNI, or desktop gen1tls hung on
+  -- love.system at boot).  Forward those; keep clipboard / openURL stubbed.
+  local TLS = {
+    tlsOpen = true, tlsStatus = true, tlsSend = true,
+    tlsReceive = true, tlsError = true, tlsClose = true,
+  }
+  local shim = {
     getOS = function()
       local sys = real()
       return sys and sys.getOS and sys.getOS() or "Unknown"
@@ -697,6 +703,13 @@ local function systemShim(ctx)
       return false
     end,
   }
+  return setmetatable(shim, {
+    __index = function(_, key)
+      if not TLS[key] then return nil end
+      local sys = real()
+      return sys and sys[key]
+    end,
+  })
 end
 
 local function eventShim(ctx)

tests/modkit/cases/sandbox.lua

@@ -62,6 +62,9 @@ local PROBE = [[
   out.assignGarbage = attempt(function() love.mousemoved = 7 end)
   out.powerInfo = type(love.system.getPowerInfo)
   out.openUrl = love.system.openURL("https://example.com")
+  -- tls* is forwarded from the real love.system when the engine hung it
+  -- (Gen1Tls / Android JNI); without that it's just nil, not an error.
+  out.tlsOpenType = type(love.system.tlsOpen)
   out.eventQuit = love.event.quit()
   out.popen = select(1, io.popen("ls"))
 
@@ -200,6 +203,8 @@ T.check(out.loveAssign ~= false,
   "a mod cannot replace a love module table: " .. tostring(out.loveAssign))
 T.eq(out.powerInfo, "function",
   "love.system reads through to the same information mod.device exposes")
+T.check(out.tlsOpenType == "function" or out.tlsOpenType == "nil",
+  "tls* is readable through the system shim (nil until the engine hangs it)")
 
 -- a wrapped callback has to land on the real table or the wrap never fires
 T.eq(type(installedMouseMoved), "function",