diff --git a/bridge/src/main/java/rsx/RsxAgent.java b/bridge/src/main/java/rsx/RsxAgent.java
index 49f52b9..af24acc 100644
--- a/bridge/src/main/java/rsx/RsxAgent.java
+++ b/bridge/src/main/java/rsx/RsxAgent.java
@@ -26,8 +26,8 @@ public final class RsxAgent {
 
     public static void premain(String args, java.lang.instrument.Instrumentation inst) {
         try {
-            home = new File(RsxAgent.class.getProtectionDomain()
-                    .getCodeSource().getLocation().toURI()).getParentFile();
+            home = findHome(new File(RsxAgent.class.getProtectionDomain()
+                    .getCodeSource().getLocation().toURI()));
         } catch (Throwable t) {
             home = new File(".");
         }
@@ -527,6 +527,27 @@ public final class RsxAgent {
 
     // ----------------------------------------------------------------- utils
 
+    /**
+     * Where the modloader lives.
+     *
+     * The agent jar may sit in the home itself or in its bridge\ folder, and
+     * nothing here may assume a fixed depth: walk up until a directory looks
+     * like a modloader home, so libs\, mods\ and config\ resolve the same way
+     * whoever installed it.
+     */
+    private static File findHome(File jarOrDir) throws Exception {
+        File at = jarOrDir.isDirectory() ? jarOrDir : jarOrDir.getParentFile();
+        for (int up = 0; at != null && up < 4; up++) {
+            if (new File(at, "mods").isDirectory()
+                    || new File(at, "libs").isDirectory()
+                    || new File(at, "bridge").isDirectory()) {
+                return at;
+            }
+            at = at.getParentFile();
+        }
+        return jarOrDir.isDirectory() ? jarOrDir : jarOrDir.getParentFile();
+    }
+
     /**
      * Put every jar from libs\ on the system class path.
      *
diff --git a/bridge/src/test/fakeclient/pvdafug.java b/bridge/src/test/fakeclient/pvdafug.java
index 898602b..a357701 100644
--- a/bridge/src/test/fakeclient/pvdafug.java
+++ b/bridge/src/test/fakeclient/pvdafug.java
@@ -11,7 +11,9 @@ public class pvdafug {
 
     public pvdafug(String url) {
         this.url = url;
-        do_.schedule(new TimerTask0(), 1000L);
+        // wide enough that A6 always wins; in the real client the first post is
+          // seconds away, and a stand that fired first would only test timing
+          do_.schedule(new TimerTask0(), 5000L);
     }
 
     public String url() {
diff --git a/scripts/install.ps1 b/scripts/install.ps1
index 2c21496..3888bd8 100644
--- a/scripts/install.ps1
+++ b/scripts/install.ps1
@@ -135,12 +135,15 @@ Say "Модлоадер: $ModHome"
 Say ''
 
 # --------------------------------------------------------------- copy the runtime
-New-Item -ItemType Directory -Force -Path (Join-Path $ModHome 'bridge\profiles') | Out-Null
+New-Item -ItemType Directory -Force -Path (Join-Path $ModHome 'profiles') | Out-Null
 New-Item -ItemType Directory -Force -Path (Join-Path $ModHome 'mods') | Out-Null
-Copy-Item (Join-Path $Dist 'rsx-bridge.jar') (Join-Path $ModHome 'bridge') -Force
+New-Item -ItemType Directory -Force -Path (Join-Path $ModHome 'libs') | Out-Null
+# The agent sits in the home itself, not in a subfolder: then its own directory
+# IS the home, and mods\, libs\ and config\ resolve without any guessing.
+Copy-Item (Join-Path $Dist 'rsx-bridge.jar') $ModHome -Force
 Say 'скопирован rsx-bridge.jar'
 
-$existingProfile = Join-Path $ModHome 'bridge\profiles\latest.rsxp'
+$existingProfile = Join-Path $ModHome 'profiles\latest.rsxp'
 $repoProfile = Join-Path $Repo 'profiles\latest.rsxp'
 $oldProfile = 'G:\rsx-mod\bridge\profiles\latest.rsxp'
 if (Test-Path $existingProfile) {
@@ -182,7 +185,11 @@ if (-not (Test-Path -LiteralPath $Marker)) {
 }
 
 # --------------------------------------------------------------- wire the agent
-$agentArg = "-javaagent:`"$ModHome\bridge\rsx-bridge.jar`""
+# Forward slashes on purpose. The launcher rewrites this config through a
+# properties writer that mangles Windows paths - it dropped a whole path segment
+# from ours once - and a forward slash has nothing to escape. The JVM takes this
+# form happily on Windows.
+$agentArg = '-javaagent:"' + ($ModHome -replace '\\', '/') + '/rsx-bridge.jar"'
 $ErrorActionPreference = 'Continue'
 $out = & $java -jar $patcher setenv $Config $agentArg 2>&1
 $code = $LASTEXITCODE