Enable assembly trimming for Eagle Installer

Enable PublishTrimmed to reduce installer size from ~73MB to potentially
~15-25MB by removing unused .NET framework code.

Using TrimMode=partial for conservative trimming that's safer with
Windows Forms. Can try TrimMode=full later for more aggressive trimming.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.github/workflows/artifact_storage_check.yml

@@ -0,0 +1,37 @@
+name: Artifact Storage Check
+
+on:
+  schedule:
+    # Run every 6 hours
+    - cron: '0 */6 * * *'
+  workflow_dispatch:
+
+jobs:
+  check-storage:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check artifact storage size
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Calculate total artifact storage
+          total_bytes=$(gh api "repos/${{ github.repository }}/actions/artifacts" \
+            --paginate -q '.artifacts[].size_in_bytes' | awk '{sum+=$1} END {print sum}')
+
+          total_mb=$((total_bytes / 1024 / 1024))
+          echo "Total artifact storage: ${total_mb} MB"
+
+          # Fail if over 500MB
+          if [ "$total_mb" -gt 500 ]; then
+            echo "::error::Artifact storage is ${total_mb} MB, which exceeds the 500 MB threshold!"
+            echo ""
+            echo "Largest artifacts:"
+            gh api "repos/${{ github.repository }}/actions/artifacts" \
+              --paginate -q '.artifacts[] | "\(.size_in_bytes)\t\(.name)\t\(.created_at)"' | \
+              sort -rn | head -20 | \
+              awk -F'\t' '{printf "%d MB\t%s\t%s\n", $1/1024/1024, $2, $3}'
+            exit 1
+          fi
+
+          echo "Storage is within acceptable limits."

.github/workflows/auth_build.yml

@@ -24,7 +24,7 @@ permissions:
 
 jobs:
   build-auth:
-    runs-on: self-hosted
+    runs-on: [self-hosted, bazel]
     outputs:
       image_tag: ${{ steps.push-auth.outputs.image_tag }}
     steps:
@@ -104,6 +104,14 @@ jobs:
       DISCORD_CLIENT_SECRET: ${{ secrets.DISCORD_CLIENT_SECRET }}
       GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
       GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
+      GH_OAUTH_CLIENT_ID: ${{ secrets.GH_OAUTH_CLIENT_ID }}
+      GH_OAUTH_CLIENT_SECRET: ${{ secrets.GH_OAUTH_CLIENT_SECRET }}
+      APPLE_SIGNIN_CLIENT_ID: ${{ secrets.APPLE_SIGNIN_CLIENT_ID }}
+      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+      APPLE_SIGNIN_KEY_ID: ${{ secrets.APPLE_SIGNIN_KEY_ID }}
+      APPLE_SIGNIN_PRIVATE_KEY: ${{ secrets.APPLE_SIGNIN_PRIVATE_KEY }}
+      TWITCH_CLIENT_ID: ${{ secrets.TWITCH_CLIENT_ID }}
+      TWITCH_CLIENT_SECRET: ${{ secrets.TWITCH_CLIENT_SECRET }}
       JWT_PRIVATE_KEY: ${{ secrets.JWT_PRIVATE_KEY }}
       FASTMAIL_API_TOKEN: ${{ secrets.FASTMAIL_API_TOKEN }}
       FASTMAIL_FROM_EMAIL: ${{ secrets.FASTMAIL_FROM_EMAIL }}
@@ -112,16 +120,6 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Copy update-env script to server
-        uses: appleboy/scp-action@v0.1.7
-        with:
-          host: ${{ secrets.DO_DROPLET_IP }}
-          username: deploy
-          key: ${{ secrets.DO_SSH_KEY }}
-          source: "deploy/update-env.sh,deploy/env.template"
-          target: /opt/eagle0/
-          strip_components: 1
-
       - name: Deploy auth service to production
         uses: appleboy/ssh-action@v1.0.3
         with:
@@ -129,51 +127,75 @@ jobs:
           username: deploy
           key: ${{ secrets.DO_SSH_KEY }}
           script_stop: true
-          envs: AUTH_IMAGE,DISCORD_CLIENT_ID,DISCORD_CLIENT_SECRET,GOOGLE_CLIENT_ID,GOOGLE_CLIENT_SECRET,JWT_PRIVATE_KEY,FASTMAIL_API_TOKEN,FASTMAIL_FROM_EMAIL,FASTMAIL_FROM_NAME
+          envs: AUTH_IMAGE,DISCORD_CLIENT_ID,DISCORD_CLIENT_SECRET,GOOGLE_CLIENT_ID,GOOGLE_CLIENT_SECRET,GH_OAUTH_CLIENT_ID,GH_OAUTH_CLIENT_SECRET,APPLE_SIGNIN_CLIENT_ID,APPLE_TEAM_ID,APPLE_SIGNIN_KEY_ID,APPLE_SIGNIN_PRIVATE_KEY,TWITCH_CLIENT_ID,TWITCH_CLIENT_SECRET,JWT_PRIVATE_KEY,FASTMAIL_API_TOKEN,FASTMAIL_FROM_EMAIL,FASTMAIL_FROM_NAME
           script: |
             set -x
             cd /opt/eagle0
 
-            # Update env vars using shared script (preserves vars set by other workflows)
-            chmod +x update-env.sh
-            ./update-env.sh \
-              "AUTH_IMAGE=${AUTH_IMAGE}" \
-              "DISCORD_CLIENT_ID=${DISCORD_CLIENT_ID}" \
-              "DISCORD_CLIENT_SECRET=${DISCORD_CLIENT_SECRET}" \
-              "GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID}" \
-              "GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET}" \
-              "JWT_PRIVATE_KEY=${JWT_PRIVATE_KEY}" \
-              "FASTMAIL_API_TOKEN=${FASTMAIL_API_TOKEN}" \
-              "FASTMAIL_FROM_EMAIL=${FASTMAIL_FROM_EMAIL}" \
-              "FASTMAIL_FROM_NAME=${FASTMAIL_FROM_NAME}"
+            # Export env vars for docker compose (appleboy/ssh-action sets them but doesn't export)
+            export AUTH_IMAGE="${AUTH_IMAGE}"
+            export DISCORD_CLIENT_ID="${DISCORD_CLIENT_ID}"
+            export DISCORD_CLIENT_SECRET="${DISCORD_CLIENT_SECRET}"
+            export GOOGLE_CLIENT_ID="${GOOGLE_CLIENT_ID}"
+            export GOOGLE_CLIENT_SECRET="${GOOGLE_CLIENT_SECRET}"
+            export GH_OAUTH_CLIENT_ID="${GH_OAUTH_CLIENT_ID}"
+            export GH_OAUTH_CLIENT_SECRET="${GH_OAUTH_CLIENT_SECRET}"
+            export APPLE_SIGNIN_CLIENT_ID="${APPLE_SIGNIN_CLIENT_ID}"
+            export APPLE_TEAM_ID="${APPLE_TEAM_ID}"
+            export APPLE_SIGNIN_KEY_ID="${APPLE_SIGNIN_KEY_ID}"
+            export APPLE_SIGNIN_PRIVATE_KEY="${APPLE_SIGNIN_PRIVATE_KEY}"
+            export TWITCH_CLIENT_ID="${TWITCH_CLIENT_ID}"
+            export TWITCH_CLIENT_SECRET="${TWITCH_CLIENT_SECRET}"
+            export JWT_PRIVATE_KEY="${JWT_PRIVATE_KEY}"
+            export FASTMAIL_API_TOKEN="${FASTMAIL_API_TOKEN}"
+            export FASTMAIL_FROM_EMAIL="${FASTMAIL_FROM_EMAIL}"
+            export FASTMAIL_FROM_NAME="${FASTMAIL_FROM_NAME}"
 
             # Login to registry
             echo "${{ secrets.DO_REGISTRY_TOKEN }}" | docker login registry.digitalocean.com -u "${{ secrets.DO_REGISTRY_TOKEN }}" --password-stdin
 
             echo "Deploying auth service: $AUTH_IMAGE"
 
-            # Use crane to pull image
-            echo "Installing crane..."
-            curl -sL https://github.com/google/go-containerregistry/releases/download/v0.20.2/go-containerregistry_Linux_x86_64.tar.gz | tar xzf - crane
-            chmod +x crane
+            # Pull the image directly (docker is already logged in)
+            echo "Pulling Auth image..."
+            docker pull "${AUTH_IMAGE}" || { echo "ERROR: Failed to pull auth image"; exit 1; }
 
-            echo "Pulling Auth image with crane..."
-            ./crane pull "${AUTH_IMAGE}" auth.tar || { echo "ERROR: Failed to pull auth image"; exit 1; }
-            echo "Loading Auth image into Docker..."
-            docker load -i auth.tar
-            rm auth.tar
-            rm ./crane
+            # Tag as :latest locally so any fallback uses correct image
+            docker tag "${AUTH_IMAGE}" registry.digitalocean.com/eagle0/auth-server:latest
 
-            # Only recreate the auth container (not eagle, shardok, etc.)
-            docker compose -f docker-compose.prod.yml up -d --no-deps --force-recreate auth
+            # Debug: check environment and .env file
+            echo "DEBUG: AUTH_IMAGE=$AUTH_IMAGE"
+            env | grep AUTH || echo "AUTH_IMAGE not in env output"
+            if [ -f .env ]; then
+              echo "DEBUG: .env file contents related to AUTH:"
+              grep AUTH .env || echo "No AUTH in .env"
+            fi
+
+            # Recreate auth container - pass AUTH_IMAGE explicitly on command line
+            AUTH_IMAGE="${AUTH_IMAGE}" docker compose -f docker-compose.prod.yml up -d --no-deps --force-recreate auth
 
             # Wait for health check
             sleep 5
-            docker compose -f docker-compose.prod.yml ps auth
 
-            # Verify container is using correct image
+            # Verify container is using the correct image
+            # Note: docker-compose may use :latest tag (which we tagged to the correct image)
             echo "=== Verifying auth container image ==="
-            docker compose -f docker-compose.prod.yml images auth
+            RUNNING_IMAGE=$(docker inspect auth-server --format '{{.Config.Image}}')
+            RUNNING_DIGEST=$(docker inspect auth-server --format '{{.Image}}')
+            EXPECTED_DIGEST=$(docker inspect "${AUTH_IMAGE}" --format '{{.Id}}')
+            echo "Expected image: ${AUTH_IMAGE}"
+            echo "Running image:  ${RUNNING_IMAGE}"
+            echo "Expected digest: ${EXPECTED_DIGEST}"
+            echo "Running digest:  ${RUNNING_DIGEST}"
+
+            if [ "$RUNNING_DIGEST" != "$EXPECTED_DIGEST" ]; then
+              echo "ERROR: Container is running wrong image!"
+              exit 1
+            fi
+            echo "Image digests match - correct image is running"
+
+            # Show container status
+            docker compose -f docker-compose.prod.yml ps auth
 
             # Cleanup old images
             docker image prune -f

.github/workflows/bazel_test.yml

@@ -26,13 +26,15 @@ permissions:
 
 jobs:
   test:
-    runs-on: self-hosted
+    runs-on: [self-hosted, bazel]
 
     steps:
     - name: Checkout repository
       uses: actions/checkout@v4
       with:
         lfs: false
+    - name: Check BUILD.bazel dependencies
+      run: ./scripts/check_build_deps.sh --strict
     - name: Run tests
       id: test
       continue-on-error: true
@@ -75,6 +77,7 @@ jobs:
       with:
         name: test.json
         path: test.json
+        retention-days: 5
     - name: Archive failed test logs
       if: always()
       uses: actions/upload-artifact@v4
@@ -82,6 +85,7 @@ jobs:
         name: failed-test-logs
         path: failed_test_logs/
         if-no-files-found: ignore
+        retention-days: 5
     - name: Fail if tests failed
       if: steps.test.outcome == 'failure'
       run: exit 1

.github/workflows/build_protos_test.yml

@@ -1,21 +0,0 @@
-name: Build Protos
-
-on:
-  pull_request:
-    paths:
-      - "src/main/protobuf/**"
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    runs-on: self-hosted
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          lfs: false
-      - name: Run tests
-        run: ./scripts/build_protos.sh

.github/workflows/build_sysroot.yml

@@ -37,6 +37,7 @@ jobs:
         with:
           name: ubuntu-noble-sysroot-amd64
           path: tools/sysroot/output/
+          retention-days: 1
 
       - name: Install AWS CLI
         run: |
@@ -98,6 +99,7 @@ jobs:
         with:
           name: ubuntu-noble-sysroot-arm64
           path: tools/sysroot/output/
+          retention-days: 1
 
       - name: Install AWS CLI
         run: |

.github/workflows/client_presigner.yml

@@ -1,35 +0,0 @@
-name: Client Presigner
-
-on:
-  push:
-    branches: [ "main" ]
-    paths:
-      - ".github/workflows/client_presigner.yml"
-      - "src/main/go/net/eagle0/client_download/**"
-      - "src/main/go/net/eagle0/util/**"
-  pull_request:
-    paths:
-      - ".github/workflows/client_presigner.yml"
-      - "src/main/go/net/eagle0/client_download/**"
-      - "src/main/go/net/eagle0/util/**"
-
-permissions:
-  contents: read
-
-jobs:
-  client-presigner:
-    runs-on: self-hosted
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          lfs: false
-          clean: false
-      - name: Build Client Presigner
-        run: bazel build --platforms=@io_bazel_rules_go//go/toolchain:linux_amd64 //src/main/go/net/eagle0/client_download
-      - name: Archive presigner binary
-        if: success() || failure()
-        uses: actions/upload-artifact@v4
-        with:
-          name: client_download
-          path: bazel-bin/src/main/go/net/eagle0/client_download/client_download_/client_download

.github/workflows/docker_build.yml

@@ -4,10 +4,16 @@ on:
   push:
     branches: [ "main" ]
     paths:
-      - 'src/main/cpp/**'
+      # Note: C++ changes trigger shardok_arm64_build.yml instead
+      # Note: Auth changes trigger auth_build.yml instead
       - 'src/main/go/**'
+      - '!src/main/go/net/eagle0/authservice/**'
+      - '!src/main/go/net/eagle0/authcli/**'
       - 'src/main/scala/**'
       - 'src/main/protobuf/**'
+      - '!src/main/protobuf/net/eagle0/eagle/api/auth.proto'
+      - '!src/main/protobuf/net/eagle0/eagle/api/admin/**'
+      - '!src/main/protobuf/net/eagle0/eagle/internal/auth_internal.proto'
       - 'src/main/resources/**'
       - 'ci/BUILD.bazel'
       - 'MODULE.bazel'
@@ -22,17 +28,22 @@ on:
         default: 'false'
         type: boolean
 
+# Only allow one deployment at a time to prevent race conditions
+concurrency:
+  group: docker-build-deploy
+  cancel-in-progress: false  # Don't cancel running deployments, queue new ones
+
 permissions:
   contents: read
 
 jobs:
   # Single consolidated build job - builds all images with one bazel invocation
   # This uses 1 runner slot instead of 4, and Bazel parallelizes internally
+  # NOTE: Must run on a runner with the bazel label to ensure consistent Bazel cache
   build-all:
-    runs-on: self-hosted
+    runs-on: [self-hosted, bazel]
     outputs:
       eagle_image_tag: ${{ steps.push-images.outputs.eagle_image_tag }}
-      shardok_image_tag: ${{ steps.push-images.outputs.shardok_image_tag }}
       admin_image_tag: ${{ steps.push-images.outputs.admin_image_tag }}
       jfr_sidecar_image_tag: ${{ steps.push-images.outputs.jfr_sidecar_image_tag }}
     steps:
@@ -47,13 +58,12 @@ jobs:
           set -ex
 
           # Build ALL images in a single bazel command - Bazel parallelizes internally
-          # This is much more efficient than 4 separate GitHub Actions jobs
-          echo "=== Building all Docker images ==="
+          # Note: Shardok is built separately for ARM64 and deployed to Hetzner
+          echo "=== Building Docker images ==="
           bazel build \
             --platforms=//:linux_x86_64 \
             --extra_toolchains=@llvm_toolchain_linux//:all \
             //ci:eagle_server_image \
-            //ci:shardok_server_image \
             //ci:admin_server_image \
             //ci:jfr_sidecar_image \
             //src/main/go/net/eagle0/warmup:warmup_linux_amd64
@@ -64,35 +74,18 @@ jobs:
 
           # Save all image paths before any other bazel command changes bazel-bin symlink
           EAGLE_PATH=$(readlink -f bazel-bin/ci/eagle_server_image)
-          SHARDOK_PATH=$(readlink -f bazel-bin/ci/shardok_server_image)
           ADMIN_PATH=$(readlink -f bazel-bin/ci/admin_server_image)
           JFR_PATH=$(readlink -f bazel-bin/ci/jfr_sidecar_image)
 
           echo "eagle_path=$EAGLE_PATH" >> $GITHUB_OUTPUT
-          echo "shardok_path=$SHARDOK_PATH" >> $GITHUB_OUTPUT
           echo "admin_path=$ADMIN_PATH" >> $GITHUB_OUTPUT
           echo "jfr_path=$JFR_PATH" >> $GITHUB_OUTPUT
 
           echo "=== Image paths ==="
           echo "Eagle: $EAGLE_PATH"
-          echo "Shardok: $SHARDOK_PATH"
           echo "Admin: $ADMIN_PATH"
           echo "JFR Sidecar: $JFR_PATH"
 
-          # Verify Shardok binary is ELF (Linux) format
-          echo "=== Verifying Shardok binary format ==="
-          BINARY_TAR="bazel-bin/ci/shardok_binary_layer.tar"
-          if [ -f "$BINARY_TAR" ]; then
-            MAGIC=$(tar -xOf "$BINARY_TAR" app/shardok-server 2>/dev/null | head -c 4 | xxd -p)
-            echo "Binary magic in tar: $MAGIC"
-            if [ "$MAGIC" = "7f454c46" ]; then
-              echo "SUCCESS: Binary is ELF format (Linux)"
-            else
-              echo "ERROR: Binary is NOT ELF format!"
-              exit 1
-            fi
-          fi
-
       - name: Login to DigitalOcean Container Registry
         if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
         env:
@@ -138,14 +131,6 @@ jobs:
           $CRANE copy "$EAGLE_TAG" "registry.digitalocean.com/eagle0/eagle-server:latest"
           echo "eagle_image_tag=$EAGLE_TAG" >> $GITHUB_OUTPUT
 
-          # Push Shardok image
-          SHARDOK_IMAGE="${{ steps.build-all.outputs.shardok_path }}"
-          SHARDOK_TAG="registry.digitalocean.com/eagle0/shardok-server:${GIT_SHA}"
-          echo "Pushing Shardok: $SHARDOK_TAG"
-          $CRANE push "$SHARDOK_IMAGE" "$SHARDOK_TAG"
-          $CRANE copy "$SHARDOK_TAG" "registry.digitalocean.com/eagle0/shardok-server:latest"
-          echo "shardok_image_tag=$SHARDOK_TAG" >> $GITHUB_OUTPUT
-
           # Push Admin image
           ADMIN_IMAGE="${{ steps.build-all.outputs.admin_path }}"
           ADMIN_TAG="registry.digitalocean.com/eagle0/admin-server:${GIT_SHA}"
@@ -165,13 +150,12 @@ jobs:
           echo "=== All images pushed successfully ==="
 
   deploy:
-    runs-on: self-hosted
+    runs-on: [self-hosted, bazel]
     needs: [build-all]
     if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
     environment: production
     env:
       EAGLE_IMAGE: ${{ needs.build-all.outputs.eagle_image_tag }}
-      SHARDOK_IMAGE: ${{ needs.build-all.outputs.shardok_image_tag }}
       ADMIN_IMAGE: ${{ needs.build-all.outputs.admin_image_tag }}
       JFR_SIDECAR_IMAGE: ${{ needs.build-all.outputs.jfr_sidecar_image_tag }}
       OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
@@ -184,6 +168,14 @@ jobs:
       DISCORD_CLIENT_SECRET: ${{ secrets.DISCORD_CLIENT_SECRET }}
       GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
       GOOGLE_CLIENT_SECRET: ${{ secrets.GOOGLE_CLIENT_SECRET }}
+      GH_OAUTH_CLIENT_ID: ${{ secrets.GH_OAUTH_CLIENT_ID }}
+      GH_OAUTH_CLIENT_SECRET: ${{ secrets.GH_OAUTH_CLIENT_SECRET }}
+      APPLE_SIGNIN_CLIENT_ID: ${{ secrets.APPLE_SIGNIN_CLIENT_ID }}
+      APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+      APPLE_SIGNIN_KEY_ID: ${{ secrets.APPLE_SIGNIN_KEY_ID }}
+      APPLE_SIGNIN_PRIVATE_KEY: ${{ secrets.APPLE_SIGNIN_PRIVATE_KEY }}
+      TWITCH_CLIENT_ID: ${{ secrets.TWITCH_CLIENT_ID }}
+      TWITCH_CLIENT_SECRET: ${{ secrets.TWITCH_CLIENT_SECRET }}
       SHARDOK_ADDRESS: ${{ secrets.SHARDOK_ADDRESS }}
       SHARDOK_AUTH_TOKEN: ${{ secrets.SHARDOK_AUTH_TOKEN }}
       SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
@@ -214,7 +206,7 @@ jobs:
           # Create directory structure on remote
           ssh -i ~/.ssh/deploy_key deploy@"$DO_DROPLET_IP" bash -s << 'SETUP_DIRS'
           set -e
-          mkdir -p /opt/eagle0/scripts/bin /opt/eagle0/nginx /opt/eagle0/deploy
+          mkdir -p /opt/eagle0/scripts/bin /opt/eagle0/nginx
           rm -f /opt/eagle0/scripts/bin/warmup
           SETUP_DIRS
 
@@ -223,7 +215,6 @@ jobs:
           scp -i ~/.ssh/deploy_key nginx/nginx.conf deploy@"$DO_DROPLET_IP":/opt/eagle0/nginx/
           scp -i ~/.ssh/deploy_key scripts/deploy-blue-green.sh scripts/warmup-eagle.sh deploy@"$DO_DROPLET_IP":/opt/eagle0/scripts/
           scp -i ~/.ssh/deploy_key scripts/bin/warmup deploy@"$DO_DROPLET_IP":/opt/eagle0/scripts/bin/
-          scp -i ~/.ssh/deploy_key deploy/env.template deploy/update-env.sh deploy@"$DO_DROPLET_IP":/opt/eagle0/deploy/
 
       - name: Deploy to production droplet
         run: |
@@ -231,63 +222,95 @@ jobs:
           set -ex
           cd /opt/eagle0
 
-          # Environment variables passed via heredoc
-          EAGLE_IMAGE="${EAGLE_IMAGE}"
-          SHARDOK_IMAGE="${SHARDOK_IMAGE}"
-          ADMIN_IMAGE="${ADMIN_IMAGE}"
-          JFR_SIDECAR_IMAGE="${JFR_SIDECAR_IMAGE}"
-          OPENAI_API_KEY="${OPENAI_API_KEY}"
-          GPT_MODEL_NAME="${GPT_MODEL_NAME}"
-          EAGLE_ENABLE_S3="${EAGLE_ENABLE_S3}"
-          DO_SPACES_ACCESS_KEY="${DO_SPACES_ACCESS_KEY}"
-          DO_SPACES_SECRET_KEY="${DO_SPACES_SECRET_KEY}"
-          JWT_PRIVATE_KEY="${JWT_PRIVATE_KEY}"
-          DISCORD_CLIENT_ID="${DISCORD_CLIENT_ID}"
-          DISCORD_CLIENT_SECRET="${DISCORD_CLIENT_SECRET}"
-          GOOGLE_CLIENT_ID="${GOOGLE_CLIENT_ID}"
-          GOOGLE_CLIENT_SECRET="${GOOGLE_CLIENT_SECRET}"
-          SHARDOK_ADDRESS="${SHARDOK_ADDRESS}"
-          SHARDOK_AUTH_TOKEN="${SHARDOK_AUTH_TOKEN}"
-          SENTRY_DSN="${SENTRY_DSN}"
-          FASTMAIL_API_TOKEN="${FASTMAIL_API_TOKEN}"
-          FASTMAIL_FROM_EMAIL="${FASTMAIL_FROM_EMAIL}"
-          FASTMAIL_FROM_NAME="${FASTMAIL_FROM_NAME}"
-          DO_REGISTRY_TOKEN="${DO_REGISTRY_TOKEN}"
+          # =================================================================
+          # CRITICAL: Validate environment variables before proceeding
+          # This catches GitHub Actions secret store hiccups early
+          # =================================================================
+          validate_env() {
+              local var_name="\$1"
+              local var_value="\$2"
+              local default_value="\${3:-}"
+
+              if [ -z "\${var_value}" ]; then
+                  echo "ERROR: \${var_name} is empty. GitHub Actions secrets may have failed to load."
+                  echo "Please retry the workflow."
+                  return 1
+              fi
+
+              # Check if we got a default value instead of the real secret
+              if [ -n "\${default_value}" ] && [ "\${var_value}" = "\${default_value}" ]; then
+                  echo "ERROR: \${var_name} has default value '\${default_value}' instead of the actual secret."
+                  echo "This indicates GitHub Actions secrets failed to load. Please retry the workflow."
+                  return 1
+              fi
+
+              return 0
+          }
+
+          echo "Validating critical environment variables..."
+
+          # These are the raw values from GitHub Actions (before export)
+          # We check them before exporting to catch issues early
+          VALIDATION_FAILED=0
+
+          validate_env "SHARDOK_ADDRESS" "${SHARDOK_ADDRESS}" "" || VALIDATION_FAILED=1
+          validate_env "EAGLE_IMAGE" "${EAGLE_IMAGE}" "" || VALIDATION_FAILED=1
+          validate_env "JWT_PRIVATE_KEY" "${JWT_PRIVATE_KEY}" "" || VALIDATION_FAILED=1
+          validate_env "DO_REGISTRY_TOKEN" "${DO_REGISTRY_TOKEN}" "" || VALIDATION_FAILED=1
+
+          if [ "\${VALIDATION_FAILED}" -eq 1 ]; then
+              echo ""
+              echo "========================================="
+              echo "DEPLOYMENT ABORTED: Missing critical secrets"
+              echo "This is likely a transient GitHub Actions issue."
+              echo "Please retry the workflow."
+              echo "========================================="
+              exit 1
+          fi
+
+          echo "All critical environment variables validated successfully."
+
+          # =================================================================
+          # Export environment variables for docker compose
+          # These are passed via heredoc and exported so child processes (docker compose) can access them
+          export EAGLE_IMAGE="${EAGLE_IMAGE}"
+          export ADMIN_IMAGE="${ADMIN_IMAGE}"
+          export JFR_SIDECAR_IMAGE="${JFR_SIDECAR_IMAGE}"
+          export OPENAI_API_KEY="${OPENAI_API_KEY}"
+          export GPT_MODEL_NAME="${GPT_MODEL_NAME:-gpt-4o}"
+          export EAGLE_ENABLE_S3="${EAGLE_ENABLE_S3:-false}"
+          export DO_SPACES_ACCESS_KEY="${DO_SPACES_ACCESS_KEY}"
+          export DO_SPACES_SECRET_KEY="${DO_SPACES_SECRET_KEY}"
+          export JWT_PRIVATE_KEY="${JWT_PRIVATE_KEY}"
+          export DISCORD_CLIENT_ID="${DISCORD_CLIENT_ID}"
+          export DISCORD_CLIENT_SECRET="${DISCORD_CLIENT_SECRET}"
+          export GOOGLE_CLIENT_ID="${GOOGLE_CLIENT_ID}"
+          export GOOGLE_CLIENT_SECRET="${GOOGLE_CLIENT_SECRET}"
+          export GH_OAUTH_CLIENT_ID="${GH_OAUTH_CLIENT_ID}"
+          export GH_OAUTH_CLIENT_SECRET="${GH_OAUTH_CLIENT_SECRET}"
+          export APPLE_SIGNIN_CLIENT_ID="${APPLE_SIGNIN_CLIENT_ID}"
+          export APPLE_TEAM_ID="${APPLE_TEAM_ID}"
+          export APPLE_SIGNIN_KEY_ID="${APPLE_SIGNIN_KEY_ID}"
+          export APPLE_SIGNIN_PRIVATE_KEY="${APPLE_SIGNIN_PRIVATE_KEY}"
+          export TWITCH_CLIENT_ID="${TWITCH_CLIENT_ID}"
+          export TWITCH_CLIENT_SECRET="${TWITCH_CLIENT_SECRET}"
+          export SHARDOK_ADDRESS="${SHARDOK_ADDRESS}"
+          export SHARDOK_AUTH_TOKEN="${SHARDOK_AUTH_TOKEN}"
+          export SENTRY_DSN="${SENTRY_DSN}"
+          export FASTMAIL_API_TOKEN="${FASTMAIL_API_TOKEN}"
+          export FASTMAIL_FROM_EMAIL="${FASTMAIL_FROM_EMAIL}"
+          export FASTMAIL_FROM_NAME="${FASTMAIL_FROM_NAME}"
+          export DO_REGISTRY_TOKEN="${DO_REGISTRY_TOKEN}"
 
           # Check Docker has IPv6 support
           if ! cat /etc/docker/daemon.json 2>/dev/null | grep -q '"ip6tables"'; then
             echo "WARNING: Docker IPv6 not configured. Eagle may not reach Hetzner Shardok."
           fi
 
-          # Update env vars
-          chmod +x deploy/update-env.sh
-          cd deploy && ./update-env.sh \
-            "EAGLE_IMAGE=\${EAGLE_IMAGE}" \
-            "SHARDOK_IMAGE=\${SHARDOK_IMAGE}" \
-            "ADMIN_IMAGE=\${ADMIN_IMAGE}" \
-            "JFR_SIDECAR_IMAGE=\${JFR_SIDECAR_IMAGE}" \
-            "OPENAI_API_KEY=\${OPENAI_API_KEY}" \
-            "GPT_MODEL_NAME=\${GPT_MODEL_NAME:-gpt-4o}" \
-            "EAGLE_ENABLE_S3=\${EAGLE_ENABLE_S3:-false}" \
-            "DO_SPACES_ACCESS_KEY=\${DO_SPACES_ACCESS_KEY}" \
-            "DO_SPACES_SECRET_KEY=\${DO_SPACES_SECRET_KEY}" \
-            "JWT_PRIVATE_KEY=\${JWT_PRIVATE_KEY}" \
-            "DISCORD_CLIENT_ID=\${DISCORD_CLIENT_ID}" \
-            "DISCORD_CLIENT_SECRET=\${DISCORD_CLIENT_SECRET}" \
-            "GOOGLE_CLIENT_ID=\${GOOGLE_CLIENT_ID}" \
-            "GOOGLE_CLIENT_SECRET=\${GOOGLE_CLIENT_SECRET}" \
-            "SHARDOK_ADDRESS=\${SHARDOK_ADDRESS:-shardok:40042}" \
-            "SHARDOK_AUTH_TOKEN=\${SHARDOK_AUTH_TOKEN}" \
-            "SENTRY_DSN=\${SENTRY_DSN}" \
-            "FASTMAIL_API_TOKEN=\${FASTMAIL_API_TOKEN}" \
-            "FASTMAIL_FROM_EMAIL=\${FASTMAIL_FROM_EMAIL}" \
-            "FASTMAIL_FROM_NAME=\${FASTMAIL_FROM_NAME}"
-          cd ..
-
           # Login to registry
           echo "\$DO_REGISTRY_TOKEN" | docker login registry.digitalocean.com -u "\$DO_REGISTRY_TOKEN" --password-stdin
 
-          echo "Using images: \$EAGLE_IMAGE, \$SHARDOK_IMAGE, \$ADMIN_IMAGE, \$JFR_SIDECAR_IMAGE"
+          echo "Using images: \$EAGLE_IMAGE, \$ADMIN_IMAGE, \$JFR_SIDECAR_IMAGE"
 
           # Install crane for pulling OCI images
           echo "Installing crane..."
@@ -299,9 +322,6 @@ jobs:
           echo "Pulling Eagle image..."
           ./crane pull "\${EAGLE_IMAGE}" eagle.tar && docker load -i eagle.tar && rm eagle.tar
 
-          echo "Pulling Shardok image..."
-          ./crane pull "\${SHARDOK_IMAGE}" shardok.tar && docker load -i shardok.tar && rm shardok.tar
-
           echo "Pulling Admin image..."
           ./crane pull "\${ADMIN_IMAGE}" admin.tar && docker load -i admin.tar && rm admin.tar
 
@@ -314,31 +334,42 @@ jobs:
 
           echo "All images pulled successfully"
 
-          # Recreate non-Eagle services
-          docker compose -f docker-compose.prod.yml up -d --no-deps --force-recreate shardok admin
+          # =================================================================
+          # Verify Shardok connectivity before proceeding with deployment
+          # This catches network/firewall issues early
+          # =================================================================
+          echo "Verifying Shardok connectivity..."
+          SHARDOK_HOST=\$(echo "\${SHARDOK_ADDRESS}" | cut -d: -f1)
+          SHARDOK_PORT=\$(echo "\${SHARDOK_ADDRESS}" | cut -d: -f2)
 
-          # Deploy Eagle with blue-green
-          if [ -x "/opt/eagle0/scripts/deploy-blue-green.sh" ]; then
-            echo "Using blue-green deployment for Eagle..."
-            chmod +x /opt/eagle0/scripts/*.sh
-            [ -f "/opt/eagle0/scripts/bin/warmup" ] && chmod +x /opt/eagle0/scripts/bin/warmup
-            GIT_SHA=\$(echo "\${EAGLE_IMAGE}" | sed 's/.*://')
-            /opt/eagle0/scripts/deploy-blue-green.sh "\${GIT_SHA}" || {
-              echo "Blue-green failed, falling back to direct restart"
-              docker compose -f docker-compose.prod.yml up -d --no-deps --force-recreate eagle-blue
-            }
+          # Try to connect to Shardok (timeout after 10 seconds)
+          if nc -z -w 10 "\${SHARDOK_HOST}" "\${SHARDOK_PORT}" 2>/dev/null; then
+              echo "Shardok connectivity verified: \${SHARDOK_ADDRESS} is reachable"
           else
-            docker compose -f docker-compose.prod.yml up -d --no-deps --force-recreate eagle-blue
+              echo ""
+              echo "========================================="
+              echo "ERROR: Cannot reach Shardok at \${SHARDOK_ADDRESS}"
+              echo "This may indicate:"
+              echo "  - Shardok server is not running on Hetzner"
+              echo "  - Network/firewall issues between DigitalOcean and Hetzner"
+              echo "  - Incorrect SHARDOK_ADDRESS configuration"
+              echo ""
+              echo "DEPLOYMENT ABORTED: Shardok must be reachable for battles to work."
+              echo "========================================="
+              exit 1
           fi
 
-          # Start jfr-sidecar after eagle-blue
-          docker compose -f docker-compose.prod.yml up -d --no-deps --force-recreate jfr-sidecar
+          # Stop local shardok container if running (now runs on Hetzner)
+          docker stop shardok-server 2>/dev/null || true
+          docker rm shardok-server 2>/dev/null || true
 
-          # Ensure auth is running
-          docker compose -f docker-compose.prod.yml up -d auth
-
-          # Restart nginx
-          docker compose -f docker-compose.prod.yml up -d --force-recreate nginx
+          # Deploy Eagle with blue-green (handles eagle, nginx, admin, jfr-sidecar)
+          # Note: Shardok runs on Hetzner, deployed separately via shardok_arm64_build.yml
+          # Note: Auth is deployed separately via auth_build.yml - do NOT touch auth here
+          chmod +x /opt/eagle0/scripts/*.sh
+          [ -f "/opt/eagle0/scripts/bin/warmup" ] && chmod +x /opt/eagle0/scripts/bin/warmup
+          GIT_SHA=\$(echo "\${EAGLE_IMAGE}" | sed 's/.*://')
+          /opt/eagle0/scripts/deploy-blue-green.sh "\${GIT_SHA}"
 
           # Verify
           sleep 10

.github/workflows/eagle_build.yml

@@ -0,0 +1,37 @@
+name: Eagle Build
+
+on:
+  push:
+    branches: [ "main" ]
+    paths:
+      - 'src/main/scala/**'
+      - 'src/main/protobuf/net/eagle0/eagle/**'
+      - 'src/main/protobuf/net/eagle0/common/**'
+      - 'WORKSPACE'
+      - 'MODULE.bazel'
+      - 'BUILD.bazel'
+      - '.github/workflows/eagle_build.yml'
+  pull_request:
+    paths:
+      - 'src/main/scala/**'
+      - 'src/main/protobuf/net/eagle0/eagle/**'
+      - 'src/main/protobuf/net/eagle0/common/**'
+      - 'WORKSPACE'
+      - 'MODULE.bazel'
+      - 'BUILD.bazel'
+      - '.github/workflows/eagle_build.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: [self-hosted, bazel]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          lfs: false
+      - name: Build Eagle server
+        run: bazel build //src/main/scala/net/eagle0/eagle:eagle_server

.github/workflows/installer_build.yml

@@ -14,10 +14,11 @@ on:
 
 permissions:
   contents: read
+  actions: write  # Required to delete artifacts after deploy
 
 jobs:
   build-installer:
-    runs-on: self-hosted
+    runs-on: [self-hosted, bazel]
 
     steps:
       - uses: actions/checkout@v4
@@ -55,6 +56,7 @@ jobs:
         with:
           name: eagle-installer
           path: ./installer-output/EagleInstaller.exe
+          retention-days: 1
 
       - name: Verify installer exists
         if: success()
@@ -108,4 +110,20 @@ jobs:
           bazel run //src/main/go/net/eagle0/build/manifest_manager:manifest_manager -- installer /tmp/installer_manifest.txt $SIGNING_ARGS
 
           # Cleanup
-          rm -f /tmp/manifest_signing_key
+          rm -f /tmp/manifest_signing_key
+
+      - name: Delete all installer artifacts
+        if: success() && github.ref == 'refs/heads/main' && github.event_name == 'push'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Delete ALL eagle-installer artifacts to free up storage
+          # The installer is deployed to S3, so artifacts are redundant
+          echo "Fetching all eagle-installer artifacts..."
+          artifact_ids=$(gh api "repos/${{ github.repository }}/actions/artifacts" \
+            --paginate -q '.artifacts[] | select(.name == "eagle-installer") | .id')
+          for id in $artifact_ids; do
+            echo "Deleting artifact ID: $id"
+            gh api -X DELETE "repos/${{ github.repository }}/actions/artifacts/$id" || true
+          done
+          echo "Cleanup complete"

.github/workflows/mac_build.yml

@@ -6,27 +6,40 @@ on:
     paths:
       - ".github/workflows/mac_build.yml"
       - "src/main/csharp/net/eagle0/clients/unity/**"
-      - "src/main/proto/**"
+      - "src/main/protobuf/net/eagle0/common/**"
+      - "src/main/protobuf/net/eagle0/shardok/**"
+      - "src/main/protobuf/net/eagle0/eagle/api/**"
+      - "src/main/protobuf/net/eagle0/eagle/common/**"
+      - "src/main/protobuf/net/eagle0/eagle/views/**"
       - "src/main/go/net/eagle0/build/mac_build_handler/**"
       - "scripts/build_protos.sh"
       - "scripts/build_mac_plugin.sh"
       - "scripts/inject_sparkle.sh"
       - "scripts/codesign_mac_app.sh"
-      - "scripts/notarize_mac_app.sh"
+      - "scripts/notarize_submit.sh"
+      - "scripts/notarize_wait.sh"
       - "ci/github_actions/build_mac.sh"
       - "ci/github_actions/build_unity_mac.sh"
+      - "ci/github_actions/upload_addressables.sh"
       - "ci/mac/**"
   pull_request:
     paths:
       - ".github/workflows/mac_build.yml"
       - "src/main/csharp/net/eagle0/clients/unity/**"
+      - "src/main/protobuf/net/eagle0/common/**"
+      - "src/main/protobuf/net/eagle0/shardok/**"
+      - "src/main/protobuf/net/eagle0/eagle/api/**"
+      - "src/main/protobuf/net/eagle0/eagle/common/**"
+      - "src/main/protobuf/net/eagle0/eagle/views/**"
       - "src/main/go/net/eagle0/build/mac_build_handler/**"
       - "scripts/build_mac_plugin.sh"
       - "scripts/inject_sparkle.sh"
       - "scripts/codesign_mac_app.sh"
-      - "scripts/notarize_mac_app.sh"
+      - "scripts/notarize_submit.sh"
+      - "scripts/notarize_wait.sh"
       - "ci/github_actions/build_mac.sh"
       - "ci/github_actions/build_unity_mac.sh"
+      - "ci/github_actions/upload_addressables.sh"
       - "ci/mac/**"
   workflow_dispatch:
     inputs:
@@ -38,30 +51,46 @@ on:
 
 permissions:
   contents: read
+  actions: write  # Required to delete artifacts after deploy
 
 jobs:
-  mac-unity:
-    runs-on: self-hosted
+  build-and-sign:
+    runs-on: [self-hosted, macOS, unity-mac]
+    outputs:
+      submission_id: ${{ steps.notarize-submit.outputs.submission_id }}
+      should_deploy: ${{ steps.check-deploy.outputs.should_deploy }}
 
     steps:
       - uses: actions/checkout@v4
         with:
           lfs: true
-          clean: false
+          clean: true  # Remove untracked files like old SparklePlugin.bundle
           fetch-depth: 0  # For version numbering from git history
 
       - name: Pull LFS files
         run: git lfs pull
 
       - name: Restore Library/
+        env:
+          UNITY_CACHE_PLATFORM: mac
         run: ./ci/github_actions/restore_library.sh
 
       - name: Build Mac Unity
         run: ./ci/github_actions/build_unity_mac.sh "/tmp/eagle0/eagle0MAC"
 
       - name: Persist Library/
+        if: success()
+        env:
+          UNITY_CACHE_PLATFORM: mac
         run: ./ci/github_actions/persist_library.sh
 
+      - name: Upload Addressables to CDN
+        if: success() && github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
+        env:
+          ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
+          SECRET_KEY: ${{ secrets.SECRET_KEY }}
+        run: ./ci/github_actions/upload_addressables.sh StandaloneOSX
+
       - name: Inject Sparkle Framework
         if: success()
         env:
@@ -70,8 +99,21 @@ jobs:
           chmod +x ./scripts/inject_sparkle.sh
           ./scripts/inject_sparkle.sh "/tmp/eagle0/eagle0MAC/eagle0.app"
 
+      - name: Check if should deploy
+        id: check-deploy
+        run: |
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" && "${{ github.event.inputs.skip_signing }}" == "true" ]]; then
+            echo "should_deploy=false" >> $GITHUB_OUTPUT
+          elif [[ "${{ github.event_name }}" == "push" && "${{ github.ref }}" == "refs/heads/main" ]]; then
+            echo "should_deploy=true" >> $GITHUB_OUTPUT
+          elif [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            echo "should_deploy=true" >> $GITHUB_OUTPUT
+          else
+            echo "should_deploy=false" >> $GITHUB_OUTPUT
+          fi
+
       - name: Import Code Signing Certificate
-        if: success() && ((github.event_name == 'workflow_dispatch' && github.event.inputs.skip_signing != 'true') || (github.event_name == 'push' && github.ref == 'refs/heads/main'))
+        if: success() && steps.check-deploy.outputs.should_deploy == 'true'
         env:
           MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
           MACOS_CERTIFICATE_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }}
@@ -101,25 +143,125 @@ jobs:
           rm certificate.p12
 
       - name: Code Sign App
-        if: success() && ((github.event_name == 'workflow_dispatch' && github.event.inputs.skip_signing != 'true') || (github.event_name == 'push' && github.ref == 'refs/heads/main'))
+        if: success() && steps.check-deploy.outputs.should_deploy == 'true'
         env:
           SIGNING_IDENTITY: ${{ secrets.SIGNING_IDENTITY }}
         run: |
           chmod +x ./scripts/codesign_mac_app.sh
           ./scripts/codesign_mac_app.sh "/tmp/eagle0/eagle0MAC/eagle0.app" "ci/mac/eagle0.entitlements"
 
-      - name: Notarize App
-        if: success() && ((github.event_name == 'workflow_dispatch' && github.event.inputs.skip_signing != 'true') || (github.event_name == 'push' && github.ref == 'refs/heads/main'))
+      - name: Submit for Notarization
+        id: notarize-submit
+        if: success() && steps.check-deploy.outputs.should_deploy == 'true'
         env:
           APPLE_ID: ${{ secrets.APPLE_ID }}
           APP_SPECIFIC_PASSWORD: ${{ secrets.APP_SPECIFIC_PASSWORD }}
           TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
         run: |
-          chmod +x ./scripts/notarize_mac_app.sh
-          ./scripts/notarize_mac_app.sh "/tmp/eagle0/eagle0MAC/eagle0.app"
+          chmod +x ./scripts/notarize_submit.sh
+          ./scripts/notarize_submit.sh "/tmp/eagle0/eagle0MAC/eagle0.app" >> $GITHUB_OUTPUT
+
+      - name: Cleanup Keychain
+        if: always()
+        run: |
+          security delete-keychain build.keychain 2>/dev/null || true
+
+      - name: Zip signed app for artifact
+        if: success() && steps.check-deploy.outputs.should_deploy == 'true'
+        run: |
+          cd /tmp/eagle0/eagle0MAC
+          ditto -c -k --keepParent eagle0.app eagle0.app.zip
+
+      - name: Upload signed app
+        if: success() && steps.check-deploy.outputs.should_deploy == 'true'
+        uses: actions/upload-artifact@v4
+        with:
+          name: signed-mac-app-${{ github.run_id }}
+          path: /tmp/eagle0/eagle0MAC/eagle0.app.zip
+          retention-days: 1
+
+      - name: Archive Build Log
+        if: success() || failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: editor_mac.log
+          path: /tmp/eagle0/editor_mac.log
+          retention-days: 5
+
+  wait-notarization:
+    needs: build-and-sign
+    if: needs.build-and-sign.outputs.should_deploy == 'true'
+    runs-on: [self-hosted, macOS, notarize]
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: scripts
+
+      - name: Clean download directory
+        run: rm -rf /tmp/eagle0/eagle0MAC
+
+      - name: Download signed app
+        uses: actions/download-artifact@v4
+        with:
+          name: signed-mac-app-${{ github.run_id }}
+          path: /tmp/eagle0/eagle0MAC
+
+      - name: Unzip signed app
+        run: |
+          cd /tmp/eagle0/eagle0MAC
+          ditto -x -k eagle0.app.zip .
+          rm eagle0.app.zip
+          ls -la /tmp/eagle0/eagle0MAC/eagle0.app/
+
+      - name: Wait for Notarization and Staple
+        env:
+          APPLE_ID: ${{ secrets.APPLE_ID }}
+          APP_SPECIFIC_PASSWORD: ${{ secrets.APP_SPECIFIC_PASSWORD }}
+          TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+        run: |
+          chmod +x ./scripts/notarize_wait.sh
+          ./scripts/notarize_wait.sh "${{ needs.build-and-sign.outputs.submission_id }}" "/tmp/eagle0/eagle0MAC/eagle0.app"
+
+      - name: Zip notarized app for artifact
+        run: |
+          cd /tmp/eagle0/eagle0MAC
+          rm -f eagle0.app.zip
+          ditto -c -k --keepParent eagle0.app eagle0.app.zip
+
+      - name: Upload notarized app
+        uses: actions/upload-artifact@v4
+        with:
+          name: notarized-mac-app-${{ github.run_id }}
+          path: /tmp/eagle0/eagle0MAC/eagle0.app.zip
+          retention-days: 1
+
+  deploy:
+    needs: [build-and-sign, wait-notarization]
+    if: needs.build-and-sign.outputs.should_deploy == 'true'
+    runs-on: [self-hosted, macOS, unity-mac]
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # For version numbering
+
+      - name: Clean download directory
+        run: rm -rf /tmp/eagle0/eagle0MAC
+
+      - name: Download notarized app
+        uses: actions/download-artifact@v4
+        with:
+          name: notarized-mac-app-${{ github.run_id }}
+          path: /tmp/eagle0/eagle0MAC
+
+      - name: Unzip notarized app
+        run: |
+          cd /tmp/eagle0/eagle0MAC
+          ditto -x -k eagle0.app.zip .
+          rm eagle0.app.zip
 
       - name: Deploy Mac Build
-        if: success() && ((github.event_name == 'workflow_dispatch' && github.event.inputs.skip_signing != 'true') || (github.event_name == 'push' && github.ref == 'refs/heads/main'))
         env:
           ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
           SECRET_KEY: ${{ secrets.SECRET_KEY }}
@@ -130,25 +272,61 @@ jobs:
           echo "$SPARKLE_EDDSA_PRIVATE_KEY" > "$SPARKLE_PRIVATE_KEY_PATH"
           chmod 600 "$SPARKLE_PRIVATE_KEY_PATH"
 
-          VERSION=$(git describe --tags --always)
-          BUILD_NUMBER=$(git rev-list --count HEAD)
+          # Install dmgbuild (creates .DS_Store programmatically, no AppleScript needed)
+          pip3 install dmgbuild
+
+          # Background image for styled DMG
+          BACKGROUND_PATH="$(pwd)/ci/mac/dmg/background.png"
+
+          # Read version from the built app's Info.plist to ensure appcast matches the actual app
+          APP_PATH="/tmp/eagle0/eagle0MAC/eagle0.app"
+          BUILD_NUMBER=$(/usr/libexec/PlistBuddy -c "Print :CFBundleVersion" "$APP_PATH/Contents/Info.plist")
+          VERSION=$(/usr/libexec/PlistBuddy -c "Print :CFBundleShortVersionString" "$APP_PATH/Contents/Info.plist")
 
           bazel run //src/main/go/net/eagle0/build/mac_build_handler:mac_build_handler -- \
             "/tmp/eagle0/eagle0MAC/eagle0.app" \
             "$VERSION" \
             "$BUILD_NUMBER" \
+            "$BACKGROUND_PATH" \
             "$SPARKLE_PRIVATE_KEY_PATH"
 
           rm "$SPARKLE_PRIVATE_KEY_PATH"
 
-      - name: Cleanup Keychain
-        if: always()
+      - name: Delete this run's Mac app artifacts
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
-          security delete-keychain build.keychain 2>/dev/null || true
+          # Delete this run's artifacts (names include run ID to avoid conflicts)
+          for artifact_name in signed-mac-app-${{ github.run_id }} notarized-mac-app-${{ github.run_id }}; do
+            echo "Deleting artifact: $artifact_name"
+            artifact_id=$(gh api "repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts" \
+              -q ".artifacts[] | select(.name == \"$artifact_name\") | .id")
+            if [ -n "$artifact_id" ]; then
+              echo "Deleting artifact ID: $artifact_id"
+              gh api -X DELETE "repos/${{ github.repository }}/actions/artifacts/$artifact_id" || true
+            fi
+          done
+          echo "Cleanup complete"
 
-      - name: Archive Build Log
-        if: success() || failure()
-        uses: actions/upload-artifact@v4
-        with:
-          name: editor_mac.log
-          path: /tmp/eagle0/editor_mac.log
+  # Cleanup job runs regardless of success/failure to prevent artifact accumulation
+  cleanup:
+    needs: [build-and-sign, wait-notarization, deploy]
+    if: always()
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Delete this run's Mac app artifacts
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Delete this run's artifacts (names include run ID to avoid conflicts)
+          for artifact_name in signed-mac-app-${{ github.run_id }} notarized-mac-app-${{ github.run_id }}; do
+            echo "Deleting artifact: $artifact_name"
+            artifact_id=$(gh api "repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts" \
+              -q ".artifacts[] | select(.name == \"$artifact_name\") | .id")
+            if [ -n "$artifact_id" ]; then
+              echo "Deleting artifact ID: $artifact_id"
+              gh api -X DELETE "repos/${{ github.repository }}/actions/artifacts/$artifact_id" || true
+            fi
+          done
+          echo "Cleanup complete"

.github/workflows/registry_cleanup.yml

@@ -46,26 +46,26 @@ jobs:
           for REPO in $REPOS; do
             echo "=== Processing repository: ${REPO} ==="
 
-            # Get all manifests with their tags and dates
-            # Filter out header row and empty lines
-            MANIFESTS=$(doctl registry repository list-manifests "${REPO}" --format Digest,UpdatedAt,Tags --no-header 2>/dev/null | grep -v '^Digest' | grep -v '^$' || echo "")
+            # Get all manifests with their tags and dates using JSON output for reliable parsing
+            MANIFESTS_JSON=$(doctl registry repository list-manifests "${REPO}" --output json 2>/dev/null || echo "[]")
 
-            if [ -z "$MANIFESTS" ]; then
+            if [ "$MANIFESTS_JSON" = "[]" ] || [ -z "$MANIFESTS_JSON" ]; then
               echo "  No manifests found"
               continue
             fi
 
-            echo "$MANIFESTS" | while read -r DIGEST UPDATED_AT TAGS; do
+            # Parse JSON and process each manifest
+            echo "$MANIFESTS_JSON" | jq -r '.[] | "\(.digest) \(.updated_at) \(.tags // [] | join(","))"' | while read -r DIGEST UPDATED_AT TAGS; do
               # Skip if no digest or if it doesn't look like a valid digest (sha256:...)
               if [ -z "$DIGEST" ] || ! echo "$DIGEST" | grep -q '^sha256:'; then
                 continue
               fi
 
-              # Parse the date
+              # Parse the date (ISO 8601 format from JSON)
               MANIFEST_DATE=$(date -d "$UPDATED_AT" +%s 2>/dev/null || echo "0")
 
               # Skip protected tags (latest, arm64-latest)
-              if echo "$TAGS" | grep -qE '(^|,)(latest|arm64-latest)(,|$)'; then
+              if echo ",$TAGS," | grep -qE ',(latest|arm64-latest),'; then
                 echo "  KEEP: ${DIGEST:0:20}... (protected tag: $TAGS)"
                 continue
               fi

.github/workflows/shardok_arm64_build.yml

@@ -24,7 +24,7 @@ permissions:
 
 jobs:
   build-shardok-arm64:
-    runs-on: self-hosted
+    runs-on: [self-hosted, bazel]
     outputs:
       image_tag: ${{ steps.push-shardok.outputs.image_tag }}
     steps:
@@ -159,7 +159,7 @@ jobs:
           echo "Also tagged as: registry.digitalocean.com/eagle0/shardok-server:arm64-latest"
 
   deploy-hetzner:
-    runs-on: self-hosted
+    runs-on: [self-hosted, bazel]
     needs: [build-shardok-arm64]
     if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.push_images == 'true')
     environment: production

.github/workflows/shardok_build.yml

@@ -28,7 +28,7 @@ permissions:
 
 jobs:
   build:
-    runs-on: self-hosted
+    runs-on: [self-hosted, bazel]
 
     steps:
       - name: Checkout repository

.github/workflows/unity_build.yml

@@ -6,51 +6,71 @@ on:
     paths:
       - ".github/workflows/unity_build.yml"
       - "src/main/csharp/net/eagle0/clients/unity/**"
-      - "src/main/proto/**"
+      - "src/main/protobuf/net/eagle0/common/**"
+      - "src/main/protobuf/net/eagle0/shardok/**"
+      - "src/main/protobuf/net/eagle0/eagle/api/**"
+      - "src/main/protobuf/net/eagle0/eagle/common/**"
+      - "src/main/protobuf/net/eagle0/eagle/views/**"
       - "scripts/build_protos.sh"
       - "scripts/build_plugins.sh"
       - "scripts/build_windows_plugin.sh"
       - "ci/github_actions/build_unity.sh"
       - "ci/github_actions/restore_library.sh"
       - "ci/github_actions/persist_library.sh"
+      - "ci/github_actions/upload_addressables.sh"
       - "MODULE.bazel"
       - "WORKSPACE"
-      - "src/main/proto/net/eagle0/eagle/**/BUILD.bazel"
+  workflow_dispatch:
   pull_request:
     paths:
       - ".github/workflows/unity_build.yml"
       - "src/main/csharp/net/eagle0/clients/unity/**"
-      - "src/main/proto/**"
+      - "src/main/protobuf/net/eagle0/common/**"
+      - "src/main/protobuf/net/eagle0/shardok/**"
+      - "src/main/protobuf/net/eagle0/eagle/api/**"
+      - "src/main/protobuf/net/eagle0/eagle/common/**"
+      - "src/main/protobuf/net/eagle0/eagle/views/**"
       - "scripts/build_protos.sh"
       - "scripts/build_plugins.sh"
       - "scripts/build_windows_plugin.sh"
       - "ci/github_actions/build_unity.sh"
       - "ci/github_actions/restore_library.sh"
       - "ci/github_actions/persist_library.sh"
+      - "ci/github_actions/upload_addressables.sh"
       - "MODULE.bazel"
       - "WORKSPACE"
-      - "src/main/proto/**/BUILD.bazel"
 
 permissions:
   contents: read
 
 jobs:
   windows-unity:
-    runs-on: self-hosted
+    runs-on: [self-hosted, macOS, unity-windows]
 
     steps:
       - uses: actions/checkout@v4
         with:
           lfs: true
-          clean: false
+          clean: true  # Remove untracked files from previous builds
       - name: Pull lfs files
         run: git lfs pull
       - name: Restore Library/
+        env:
+          UNITY_CACHE_PLATFORM: windows
         run: ./ci/github_actions/restore_library.sh
       - name: Build Windows unity
         run: ./ci/github_actions/build_unity.sh "/tmp/eagle0/eagle0WIN"
       - name: Persist Library/
+        if: success()
+        env:
+          UNITY_CACHE_PLATFORM: windows
         run: ./ci/github_actions/persist_library.sh
+      - name: Upload Addressables to CDN
+        if: success() && github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
+        env:
+          ACCESS_KEY_ID: ${{ secrets.ACCESS_KEY_ID }}
+          SECRET_KEY: ${{ secrets.SECRET_KEY }}
+        run: ./ci/github_actions/upload_addressables.sh StandaloneWindows64
       - name: Deploy Windows unity
         if: success() && github.ref == 'refs/heads/main' && github.event_name == 'push'
         env:
@@ -86,4 +106,5 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: editor_win.log
-          path: /tmp/eagle0/editor_win.log
+          path: /tmp/eagle0/editor_win.log
+          retention-days: 5

BUILD.bazel

@@ -32,3 +32,15 @@ nogo(
     vet = True,
     visibility = ["//visibility:public"],
 )
+
+# Dependency constraint tests
+# These verify architectural boundaries are maintained
+sh_test(
+    name = "build_deps_test",
+    srcs = ["scripts/check_build_deps.sh"],
+    args = ["--ci"],
+    tags = [
+        "local",  # Needs bazel query access
+        "no-sandbox",
+    ],
+)

DEPROTO_PLAN.md

@@ -1,213 +0,0 @@
-# Deproto Migration Plan
-
-This document tracks the migration from protobuf types to native Scala models inside the Eagle game engine.
-
-## Architectural Decisions
-
-1. **Keep proto for persistence**: Yes - protobuf is used for persisting game state
-2. **Keep proto for Shardok communication**: Yes - protobuf is used for Eagle-Shardok gRPC communication
-3. **Use Scala views inside the library**: Yes - use native Scala types like `ProvinceView`, `FactionView`, `HeroView`, etc. within the library code
-
-## Recent Completed Work
-
-### GameState Round-Trip Elimination (PRs #4913, #4914, #4915)
-
-Eliminated wasteful Scala→proto→Scala conversions in the hot path:
-
-1. **LLM Pipeline** (#4913): `LlmRequestWithGameState` now uses Scala `GameState` instead of proto. All ~38 prompt generators updated to use Scala model types (`FactionT`, `HeroT`, `ProvinceT`).
-
-2. **ActionWithResultingState Caching** (#4914): Added `precomputedScalaState: Option[GameState]` to cache Scala state when available, avoiding `fromProto()` conversion in `stateAfter()`.
-
-3. **PostResults Simplification** (#4915): Changed `PostResults.gameState` from proto to `Option[GameState]` (Scala), eliminating `toProto()` calls when creating PostResults.
-
-## Migration Pattern
-
-The codebase follows a **Legacy* pattern** for separating proto-dependent and protoless code:
-
-- **Protoless utilities**: `FactionUtils`, `HeroUtils`, `ProvinceUtils`, `ProvinceDistances`, etc.
-- **Proto-dependent utilities**: `LegacyFactionUtils`, `LegacyHeroUtils`, `LegacyProvinceUtils`, `LegacyProvinceDistances`, etc.
-
-When migrating a file:
-1. Create a `Legacy*` version containing the proto-dependent methods
-2. Keep the original file name for protoless methods
-3. Update callers to use the appropriate version based on their context
-
-## Migration Status
-
-### Fully Protoless (no proto imports)
-
-**Utilities:**
-- [x] `FactionUtils` - has protoless `ownedNeighbors` method
-- [x] `ProvinceDistances` - split into protoless + `LegacyProvinceDistances`
-- [x] `SwornBrotherChooser` - fully protoless (removed `bestChoiceProto`)
-
-**Command Selectors (all use native GameState):**
-- [x] `AllianceOfferCommandSelector`
-- [x] `AlmsCommandSelector`
-- [x] `AttackCommandChooser`
-- [x] `ExpandCommandSelector`
-- [x] `HeroGiftCommandSelector`
-- [x] `ImproveCommandSelector`
-- [x] `MarchTowardProvinceCommandChooser` - in AI folder, uses native GameState (callers convert)
-- [x] `OrganizeCommandSelector`
-- [x] `RansomOfferHelpers`
-- [x] `SeekMoreLeadersCommandChooser` - in AI folder, uses native GameState
-- [x] `TruceOfferCommandSelector`
-- [x] `TrustForDiplomacy`
-
-**Quest Command Selectors (all protoless):**
-- [x] `AllianceQuestCommandChooser`
-- [x] `AlmsAcrossRealmQuestCommandChooser`
-- [x] `AlmsToProvinceQuestCommandChooser`
-- [x] `DismissSpecificVassalCommandChooser`
-- [x] `GiveToHeroesAcrossRealmQuestCommandChooser`
-- [x] `GiveToHeroesInProvinceQuestCommandChooser`
-- [x] `ImproveQuestCommandChooser`
-- [x] `QuestCommandChooser`
-- [x] `TruceCountQuestCommandChooser`
-- [x] `TruceWithFactionQuestCommandChooser`
-
-### Fully Protoless
-
-- [x] `AIClientUtils` - has protoless overloads (`takenHeroIdsForMarchTowardFocus`, `mostPowerfulHeroes`)
-- [x] `AttackCommandChooser` - uses Scala `GameState` and `BattalionViewC` (Scala view type)
-- [x] `BattalionPower` - has `estimatedPower(BattalionViewC)` for recon data with optional stats
-- [x] `CommandChoiceHelpers` - fully protoless, uses Scala `GameState` throughout
-- [x] `ProvinceGoldSurplusCalculator` - fully protoless (callers use converters)
-- [x] `HeroSelector` - fully protoless (removed dead `minimallyFatiguedHeroesProto`)
-
-### AI Layer ✅ COMPLETE
-
-All AI and command chooser code is now fully protoless:
-- [x] `AttackDecisionCommandChooser` - uses Scala GameState
-- [x] `CommandChooser` - trait uses Scala GameState
-- [x] `FulfillQuestsCommandSelector` - uses Scala GameState
-- [x] `MidGameAIClient` - uses Scala GameState internally
-
-### Still Using Proto GameState (Boundary Code)
-
-These files use proto GameState because they're at system boundaries:
-
-**View Filters (client projection):**
-- `view_filters/GameStateViewFilter` - has Scala overload, uses Scala sub-filters
-- `view_filters/ProvinceViewFilter` - has Scala overloads for some methods
-- `view_filters/FactionViewFilter` - has Scala overload
-- `view_filters/HeroViewFilter` - has Scala overload
-- `view_filters/BattalionNameFilter` - has Scala overload
-- `view_filters/BattleFilter` - has Scala overload
-
-**Legacy Utilities (to be deprecated):**
-- `LegacyProvinceDistances`, `LegacyFactionUtils`, `LegacyHeroUtils`, etc.
-- Used by code that still needs proto GameState
-
-**Persistence/Action System:**
-- `ActionResultTApplier`, `ActionResultProtoApplier` - apply results to proto state
-- `ActionWithResultingState` - caches both proto and Scala state
-
-**Shardok Interface (gRPC boundary):**
-- `ShardokInterfaceGrpcClient`, `ShardokInterfaceProxy` - must use proto for C++ communication
-
-## Next Steps
-
-### Phase 1-3: AI Layer ✅ COMPLETE
-
-The entire AI decision-making layer is now protoless.
-
-### Phase 4: View Filters ✅ COMPLETE
-
-The view_filters package migration is complete:
-
-**Completed:**
-- [x] `GameStateViewFilter` - added Scala GameState overload (uses Scala sub-filters)
-- [x] `ProvinceViewFilter` - already has Scala overloads for server-side views
-- [x] `HumanPlayerClientConnectionState` - updated to pass Scala GameState directly
-- [x] `HeroViewFilter` - added Scala overload
-- [x] `FactionViewFilter` - added Scala overload
-- [x] `Visibility` - added Scala overloads
-
-**Still Using Proto:**
-- [x] `BattalionNameFilter` - has Scala overload
-- [x] `BattleFilter` - has Scala overload
-- [ ] `ActionResultFilter` - uses proto internally (boundary code)
-
-**Strategy:**
-1. Add Scala GameState overloads to view filter methods
-2. Update callers to pass Scala GameState where available
-3. Eventually deprecate proto versions
-
-### Phase 5: Legacy Utility Cleanup (IN PROGRESS)
-
-Remove Legacy* utilities by migrating remaining callers:
-1. Identify callers of each Legacy* util
-2. Update callers to use protoless versions
-3. Delete Legacy* files when no longer needed
-
-**Deleted (no production callers):**
-- [x] `LegacyProvinceDistances` - deleted (no callers)
-- [x] `LegacyBattalionSuitability` - deleted (no callers)
-- [x] `LegacyFoodConsumptionUtils` - deleted (no callers)
-- [x] `LegacyHandleRiotUtils` - deleted (no callers)
-
-**Refactored to Thin Wrappers (delegating to protoless versions):**
-- [x] `LegacyRansomValidity` - already a thin wrapper delegating to `RansomValidity`
-- [x] `LegacyRecruitmentOdds` - refactored to delegate to `RecruitmentOdds`
-
-**Parallel Implementations (proto mirrors protoless):**
-- [x] `FactionUtils` / `LegacyFactionUtils` - both have matching APIs; LegacyFactionUtils used by boundary code (24+ callers)
-- [x] `HeroUtils` / `LegacyHeroUtils` - both have matching APIs; LegacyHeroUtils used by boundary code (10 callers)
-- [x] `ProvinceUtils` / `LegacyProvinceUtils` - both have matching APIs; LegacyProvinceUtils used by boundary code (20 callers: availability factories, view filters)
-
-**Parallel Implementations (awaiting migration of callers):**
-- [x] `BattalionUtils` / `LegacyBattalionUtils` - both have matching core methods; LegacyBattalionUtils used by boundary code (4 callers)
-- [x] `BattalionViewFilter` / `LegacyBattalionViewFilter` - protoless version exists; Legacy used by view filters, action appliers (3 callers)
-- [x] `BattalionTypeFinder` / `LegacyBattalionTypeFinder` - protoless version exists; Legacy used by validators (1 caller: RuntimeValidator)
-
-### Recent Caller Migration
-
-**CheckForFulfilledQuestsAction** - migrated to use protoless `BattalionTypeFinder`:
-- Changed `battalionTypes` parameter from proto `Vector[BattalionType]` to Scala `Vector[BattalionType]`
-- Updated callers (EngineImpl, EndVassalCommandsPhaseAction) to pass Scala types directly
-- Eliminated wasteful `BattalionTypeConverter.toProto()` conversions
-
-**ExpandedUnaffiliatedHeroUtils** - added Scala overload:
-- New overload takes Scala `GameState` and `UnaffiliatedHeroT` directly
-- Added `UnaffiliatedHeroConverter.unaffiliatedHeroTypeToProto()` helper for efficient enum conversion
-- Proto overload retained for backward compatibility
-
-**AvailablePleaseRecruitMeCommandFactory** - eliminated wasteful proto conversions:
-- Now uses `ExpandedUnaffiliatedHeroUtils.expandedUnaffiliatedHero(ScalaGameState, UnaffiliatedHeroT)` directly
-- Removed `GameStateConverter.toProto()` and `UnaffiliatedHeroConverter.toProto()` calls
-- Factory is now fully protoless internally (still returns proto types for API boundary)
-
-**ProvinceViewFilter** - added Scala overload with faction filtering:
-- New `filteredProvinceView(province: ProvinceT, gs: ScalaGameState, factionId: FactionId)` overload
-- Uses protoless `FactionUtils.hasAlliance`, `Visibility.hasFullVisibility`, and `ProvinceUtils.incomingOthers`
-- Handles reconned provinces directly from Scala `FactionT.reconnedProvinces` (already Scala type)
-- Added helper methods: `fullProvinceInfoScala`, `maybeIncomingAttackersScala`, `unaffiliatedHeroInfoScala`
-- Events still converted to proto at the end (ProvinceView.knownEvents uses proto events)
-
-**GameStateViewFilter** - eliminated GameStateConverter.toProto() call:
-- Scala overload now fully protoless internally
-- Uses the new ProvinceViewFilter Scala overload with faction filtering
-- Converts `battalionTypes` and `chronicleEntries` to proto only at output boundary
-
-## Key Files
-
-### Protoless Model Types
-
-- `src/main/scala/net/eagle0/eagle/model/state/game_state/GameState.scala` - native Scala GameState
-- `src/main/scala/net/eagle0/eagle/model/state/province/ProvinceView.scala` - province view type
-- `src/main/scala/net/eagle0/eagle/model/state/faction/FactionView.scala` - faction view type
-- `src/main/scala/net/eagle0/eagle/model/state/hero/HeroView.scala` - hero view type
-
-### Proto Converters
-
-- `src/main/scala/net/eagle0/eagle/model/proto_converters/game_state/` - converts between proto and Scala types
-
-## Notes
-
-- The AI client code (`src/main/scala/net/eagle0/eagle/ai/`) is now fully protoless
-- Proto GameState is still needed at boundaries: persistence, gRPC to Shardok
-- `PerformUnaffiliatedHeroesAction` and the LLM pipeline use protoless `GameState`
-- `GameStateViewFilter` Scala overload is now fully protoless internally (converts to proto only at output)
-- `ProvinceViewFilter` has Scala overloads for all three modes: no filtering, faction filtering, and withdrawn-from view

MODULE.bazel

@@ -130,6 +130,13 @@ bazel_dep(name = "apple_support", version = "1.21.1", repo_name = "build_bazel_a
 bazel_dep(name = "rules_apple", version = "4.3.3", repo_name = "build_bazel_rules_apple")
 bazel_dep(name = "rules_swift", version = "2.4.0", repo_name = "build_bazel_rules_swift")
 
+# Register Apple CC toolchain for Objective-C compilation
+apple_cc_configure = use_extension(
+    "@build_bazel_apple_support//crosstool:setup.bzl",
+    "apple_cc_configure_extension",
+)
+use_repo(apple_cc_configure, "local_config_apple_cc")
+
 #
 # Protocol Buffers & RPC
 #
@@ -137,7 +144,7 @@ bazel_dep(name = "rules_swift", version = "2.4.0", repo_name = "build_bazel_rule
 bazel_dep(name = "protobuf", version = "29.2", repo_name = "com_google_protobuf")
 bazel_dep(name = "grpc", version = "1.71.0")
 bazel_dep(name = "grpc-java", version = "1.71.0")
-bazel_dep(name = "flatbuffers", version = "25.2.10")
+bazel_dep(name = "flatbuffers", version = "25.9.23")
 
 #
 # Testing
@@ -293,6 +300,17 @@ http_archive(
     ],
 )
 
+# Sparkle framework for macOS auto-updates
+SPARKLE_VERSION = "2.6.4"
+
+http_archive(
+    name = "sparkle",
+    build_file = "@//external:BUILD.sparkle",
+    sha256 = "50612a06038abc931f16011d7903b8326a362c1074dabccb718404ce8e585f0b",
+    strip_prefix = "",
+    url = "https://github.com/sparkle-project/Sparkle/releases/download/%s/Sparkle-%s.tar.xz" % (SPARKLE_VERSION, SPARKLE_VERSION),
+)
+
 # Busybox static binary for Docker health checks (provides nc, wget, etc.)
 # Primary: DigitalOcean Spaces (public, reliable)
 # Fallback: busybox.net (can be unreliable/slow)

MODULE.bazel.lock

@@ -39,11 +39,11 @@
     "https://bcr.bazel.build/modules/aspect_rules_js/1.33.1/MODULE.bazel": "db3e7f16e471cf6827059d03af7c21859e7a0d2bc65429a3a11f005d46fc501b",
     "https://bcr.bazel.build/modules/aspect_rules_js/1.39.0/MODULE.bazel": "aece421d479e3c31dc3e5f6d49a12acc2700457c03c556650ec7a0ff23fc0d95",
     "https://bcr.bazel.build/modules/aspect_rules_js/2.0.0/MODULE.bazel": "b45b507574aa60a92796e3e13c195cd5744b3b8aff516a9c0cb5ae6a048161c5",
-    "https://bcr.bazel.build/modules/aspect_rules_js/2.1.3/MODULE.bazel": "47cc48eec374d69dced3cf9b9e5926beac2f927441acfb1a3568bbb709b25666",
-    "https://bcr.bazel.build/modules/aspect_rules_js/2.1.3/source.json": "6b0fe67780c101430be087381b7a79d75eeebe1a1eae6a2cee937713603634ac",
+    "https://bcr.bazel.build/modules/aspect_rules_js/2.3.8/MODULE.bazel": "74bf20a7a6bd5f2be09607fdb4196cfd6f203422ea271752ec2b1afe95426101",
+    "https://bcr.bazel.build/modules/aspect_rules_js/2.3.8/source.json": "411ec9d79d6f5fe8a083359588c21d01a5b48d88a2cbd334a4c90365015b7836",
     "https://bcr.bazel.build/modules/aspect_rules_lint/0.12.0/MODULE.bazel": "e767c5dbfeb254ec03275a7701b5cfde2c4d2873676804bc7cb27ddff3728fed",
-    "https://bcr.bazel.build/modules/aspect_rules_ts/3.4.0/MODULE.bazel": "5b554d5de90d96ee14117527c0519037713dd33884f3212eae391beccb2e94ff",
-    "https://bcr.bazel.build/modules/aspect_rules_ts/3.4.0/source.json": "9ada3722b716853b6dccdb7b650d8e776a23bc8a190de0c59bd15f21afea6f8a",
+    "https://bcr.bazel.build/modules/aspect_rules_ts/3.6.0/MODULE.bazel": "d0045b5eabb012be550a609589b3e5e47eba682344b19cfd9365d4d896ed07df",
+    "https://bcr.bazel.build/modules/aspect_rules_ts/3.6.0/source.json": "5593e3f1cd0dd5147f7748e163307fd5c2e1077913d6945b58739ad8d770a290",
     "https://bcr.bazel.build/modules/bazel_features/0.1.0/MODULE.bazel": "47011d645b0f949f42ee67f2e8775188a9cf4a0a1528aa2fa4952f2fd00906fd",
     "https://bcr.bazel.build/modules/bazel_features/1.1.0/MODULE.bazel": "cfd42ff3b815a5f39554d97182657f8c4b9719568eb7fded2b9135f084bf760b",
     "https://bcr.bazel.build/modules/bazel_features/1.1.1/MODULE.bazel": "27b8c79ef57efe08efccbd9dd6ef70d61b4798320b8d3c134fd571f78963dbcd",
@@ -108,8 +108,8 @@
     "https://bcr.bazel.build/modules/envoy_api/0.0.0-20241214-918efc9/MODULE.bazel": "24e05f6f52f37be63a795192848555a2c8c855e7814dbc1ed419fb04a7005464",
     "https://bcr.bazel.build/modules/envoy_api/0.0.0-20250128-4de3c74/MODULE.bazel": "1fe72489212c530086e3ffb0e018b2bfef4663200ca03571570f9f006bef1d75",
     "https://bcr.bazel.build/modules/envoy_api/0.0.0-20250128-4de3c74/source.json": "028519164a2e24563f4b43d810fdedc702daed90e71e7042d45ba82ad807b46f",
-    "https://bcr.bazel.build/modules/flatbuffers/25.2.10/MODULE.bazel": "dab15cafe8512d2c4a8daa44c2d7968c5c79f01e220d40076cdc260bf58605e2",
-    "https://bcr.bazel.build/modules/flatbuffers/25.2.10/source.json": "7eae7ea3eb913b9802426e4d5df11d6c6072a3573a548f8cabf1e965f5cca4d0",
+    "https://bcr.bazel.build/modules/flatbuffers/25.9.23/MODULE.bazel": "32753ba60bf3bacfe7737c0f3e8e3e55624b19af5d398c485580d57492d145d8",
+    "https://bcr.bazel.build/modules/flatbuffers/25.9.23/source.json": "a2116f0017f6896353fd3abf65ef2b89b0a257e8a87f395c5000f53934829f31",
     "https://bcr.bazel.build/modules/gawk/5.3.2.bcr.1/MODULE.bazel": "cdf8cbe5ee750db04b78878c9633cc76e80dcf4416cbe982ac3a9222f80713c8",
     "https://bcr.bazel.build/modules/gawk/5.3.2.bcr.1/source.json": "fa7b512dfcb5eafd90ce3959cf42a2a6fe96144ebbb4b3b3928054895f2afac2",
     "https://bcr.bazel.build/modules/gazelle/0.27.0/MODULE.bazel": "3446abd608295de6d90b4a8a118ed64a9ce11dcb3dda2dc3290a22056bd20996",
@@ -396,7 +396,7 @@
     "@@apple_support~//crosstool:setup.bzl%apple_cc_configure_extension": {
       "general": {
         "bzlTransitiveDigest": "Z3yAd66IJL0GAZUTSeMOjoHiE1SZPPwiIs/XQui5BvE=",
-        "usagesDigest": "tl3VVeQX3Hzh7FhM2gjnkCwEJpRMlY5S6a850WY/xvc=",
+        "usagesDigest": "DqQsfZN5lA8z+nLEEY+EpKGzQ8M73mDm/A8lofDSyus=",
         "recordedFileInputs": {},
         "recordedDirentsInputs": {},
         "envVariables": {},
@@ -423,7 +423,7 @@
     },
     "@@aspect_rules_esbuild~//esbuild:extensions.bzl%esbuild": {
       "general": {
-        "bzlTransitiveDigest": "RzTo7pj0Tdkwa3Ld5BAVhGFSvWroST8GAQLuwwC0jdQ=",
+        "bzlTransitiveDigest": "8L5Llfl6uxIWXd5GR+Qmmm04/jxp6TuJH5LFhIZIUCA=",
         "usagesDigest": "iDVoyPxUeADmfK8ssoyG3Ehq1bj6p7A43LpEiE266os=",
         "recordedFileInputs": {},
         "recordedDirentsInputs": {},
@@ -502,6 +502,7 @@
               "extra_build_content": "",
               "generate_bzl_library_targets": false,
               "extract_full_archive": false,
+              "exclude_package_contents": [],
               "system_tar": "auto"
             }
           },
@@ -526,7 +527,8 @@
               "package_visibility": [
                 "//visibility:public"
               ],
-              "replace_package": ""
+              "replace_package": "",
+              "exclude_package_contents": []
             }
           }
         },
@@ -546,6 +548,11 @@
             "bazel_tools",
             "bazel_tools"
           ],
+          [
+            "aspect_bazel_lib~",
+            "tar.bzl",
+            "tar.bzl~"
+          ],
           [
             "aspect_rules_esbuild~",
             "aspect_rules_js",
@@ -561,6 +568,11 @@
             "aspect_bazel_lib",
             "aspect_bazel_lib~"
           ],
+          [
+            "aspect_rules_js~",
+            "aspect_rules_js",
+            "aspect_rules_js~"
+          ],
           [
             "aspect_rules_js~",
             "bazel_skylib",
@@ -571,10 +583,30 @@
             "bazel_tools",
             "bazel_tools"
           ],
+          [
+            "bazel_lib~",
+            "bazel_skylib",
+            "bazel_skylib~"
+          ],
           [
             "bazel_lib~",
             "bazel_tools",
             "bazel_tools"
+          ],
+          [
+            "tar.bzl~",
+            "aspect_bazel_lib",
+            "aspect_bazel_lib~"
+          ],
+          [
+            "tar.bzl~",
+            "bazel_skylib",
+            "bazel_skylib~"
+          ],
+          [
+            "tar.bzl~",
+            "tar.bzl",
+            "tar.bzl~"
           ]
         ]
       }
@@ -1182,7 +1214,7 @@
     "@@rules_nodejs~//nodejs:extensions.bzl%node": {
       "general": {
         "bzlTransitiveDigest": "q44Ox2Nwogn6OsO0Xw5lhjkd/xmxkvvpwVOn5P4pmHQ=",
-        "usagesDigest": "WQpLKLujnBfrx9sMWCJgyaK9P04binseT6CGBy3vP4E=",
+        "usagesDigest": "Py5Wgc5kr5fTMe1FKrlFK276B6SodesXp6nw2Fq5XA8=",
         "recordedFileInputs": {},
         "recordedDirentsInputs": {},
         "envVariables": {},

ci/github_actions/build_mac.sh

@@ -15,10 +15,12 @@ echo "Cleaning up $BUILD_DIR"
 /bin/rm -rf "$BUILD_DIR"
 /bin/mkdir -p "$BUILD_DIR"
 
+# Use custom build script that builds Addressables before the player
 ${UNITY_INSTALL_PATH}/${UNITY_VERSION}/Unity.app/Contents/MacOS/Unity \
    -nographics \
    -batchmode \
    -quit \
-   -buildOSXUniversalPlayer "$BUILD_DIR/eagle0.app" \
+   -executeMethod BuildScript.BuildMacPlayer \
+   -buildPath "$BUILD_DIR/eagle0.app" \
    -logFile "$LOG_PATH" \
    -projectPath "$WORKSPACE/src/main/csharp/net/eagle0/clients/unity/eagle0"

ci/github_actions/build_unity.sh

@@ -9,9 +9,6 @@ COMMIT=$(/usr/bin/git rev-parse --short HEAD)
 /bin/echo "build protos"
 ./scripts/build_protos.sh
 
-/bin/echo "build plugins"
-./scripts/build_windows_plugin.sh
-
 git log -3
 
 /bin/echo "build Windows"

ci/github_actions/build_unity_mac.sh

@@ -7,8 +7,8 @@ COMMIT=$(/usr/bin/git rev-parse --short HEAD)
 /bin/echo "build protos"
 ./scripts/build_protos.sh
 
-/bin/echo "build Mac plugin"
-./scripts/build_mac_plugin.sh
+/bin/echo "build Sparkle plugin"
+./scripts/build_sparkle_plugin.sh
 
 git log -3
 

ci/github_actions/build_windows.sh

@@ -15,10 +15,12 @@ echo "Cleaning up $1"
 /bin/rm -rf $1
 /bin/mkdir -p $1
 
+# Use custom build script that builds Addressables before the player
 ${UNITY_INSTALL_PATH}/${UNITY_VERSION}/Unity.app/Contents/MacOS/Unity \
    -nographics \
    -batchmode \
    -quit \
-   -buildWindows64Player $BUILD_DIR/eagle0.exe \
+   -executeMethod BuildScript.BuildWindowsPlayer \
+   -buildPath "$BUILD_DIR/eagle0.exe" \
    -logFile $LOG_PATH \
    -projectPath "$WORKSPACE/src/main/csharp/net/eagle0/clients/unity/eagle0"

ci/github_actions/persist_library.sh

@@ -1,12 +1,25 @@
 #!/bin/bash
+#
+# Persist Unity Library/ cache to persistent storage
+#
+# Environment variables:
+#   UNITY_CACHE_PLATFORM - Platform identifier (e.g., "mac", "windows")
+#                          Defaults to "mac" if not set
+#
+# Note: Library/Bee/ is excluded because it contains DAG files with hardcoded
+# file paths that become stale when project files change. This prevents
+# "Data at the root level is invalid" XML errors from stale references.
 
 set -uxo pipefail
 
-/bin/echo "persist Library/"
+PLATFORM="${UNITY_CACHE_PLATFORM:-mac}"
+CACHE_DIR="/tmp/eagle0/Library-${PLATFORM}"
+
+/bin/echo "persist Library/ to $CACHE_DIR (excluding Bee/)"
 
 # rsync may exit with code 23 ("partial transfer due to error") if Unity's
 # temporary files vanish during the copy. This is acceptable for a cache.
-/usr/bin/rsync -rtlDvq src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ /tmp/eagle0/Library/
+/usr/bin/rsync -rtlDvq --exclude='Bee/' src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ "$CACHE_DIR/"
 rsync_exit=$?
 
 if [ $rsync_exit -eq 0 ]; then

ci/github_actions/restore_library.sh

@@ -1,7 +1,16 @@
 #!/bin/bash
+#
+# Restore Unity Library/ cache from persistent storage
+#
+# Environment variables:
+#   UNITY_CACHE_PLATFORM - Platform identifier (e.g., "mac", "windows")
+#                          Defaults to "mac" if not set
 
 set -euxo pipefail
 
-/bin/echo "restore Library/"
-/bin/mkdir -p /tmp/eagle0/Library
-/usr/bin/rsync -rtlDvq /tmp/eagle0/Library/ src/main/csharp/net/eagle0/clients/unity/eagle0/Library/
+PLATFORM="${UNITY_CACHE_PLATFORM:-mac}"
+CACHE_DIR="/tmp/eagle0/Library-${PLATFORM}"
+
+/bin/echo "restore Library/ from $CACHE_DIR"
+/bin/mkdir -p "$CACHE_DIR"
+/usr/bin/rsync -rtlDvq "$CACHE_DIR/" src/main/csharp/net/eagle0/clients/unity/eagle0/Library/

ci/github_actions/upload_addressables.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+
+# Upload Addressables bundles to DigitalOcean Spaces
+# Usage: ./upload_addressables.sh <build_target>
+# Example: ./upload_addressables.sh StandaloneOSX
+#
+# Required environment variables:
+#   ACCESS_KEY_ID - DigitalOcean Spaces access key (same as other deploys)
+#   SECRET_KEY    - DigitalOcean Spaces secret key (same as other deploys)
+
+set -euxo pipefail
+
+BUILD_TARGET=$1
+WORKSPACE=$(pwd)
+UNITY_PROJECT="$WORKSPACE/src/main/csharp/net/eagle0/clients/unity/eagle0"
+SERVER_DATA="$UNITY_PROJECT/ServerData/$BUILD_TARGET"
+
+# DigitalOcean Spaces configuration (same region as other eagle0 buckets)
+DO_ENDPOINT="https://sfo3.digitaloceanspaces.com"
+DO_BUCKET="eagle0-assets"
+
+if [ ! -d "$SERVER_DATA" ]; then
+    echo "No Addressables bundles found at $SERVER_DATA"
+    echo "Skipping upload (this is expected if Addressables are bundled locally)"
+    exit 0
+fi
+
+echo "Uploading Addressables bundles from $SERVER_DATA"
+echo "Target: s3://$DO_BUCKET/addressables/$BUILD_TARGET/"
+
+# Configure AWS CLI for DigitalOcean Spaces
+export AWS_ACCESS_KEY_ID="$ACCESS_KEY_ID"
+export AWS_SECRET_ACCESS_KEY="$SECRET_KEY"
+
+# Sync bundles to Spaces
+# --delete removes files in destination that don't exist in source
+# --acl public-read makes files publicly accessible
+aws s3 sync "$SERVER_DATA" "s3://$DO_BUCKET/addressables/$BUILD_TARGET/" \
+    --endpoint-url "$DO_ENDPOINT" \
+    --acl public-read \
+    --delete
+
+echo "Addressables upload complete"
+echo "Files available at: https://assets.eagle0.net/addressables/$BUILD_TARGET/"

deploy/env.template

@@ -1,40 +0,0 @@
-# Environment template for production deployment
-# This file defines all env vars used by docker-compose.prod.yml
-# Workflows should update their specific vars without overwriting others
-
-# Container images (managed by respective build workflows)
-EAGLE_IMAGE=registry.digitalocean.com/eagle0/eagle-server:latest
-SHARDOK_IMAGE=registry.digitalocean.com/eagle0/shardok-server:latest
-ADMIN_IMAGE=registry.digitalocean.com/eagle0/admin-server:latest
-JFR_SIDECAR_IMAGE=registry.digitalocean.com/eagle0/jfr-sidecar:latest
-AUTH_IMAGE=registry.digitalocean.com/eagle0/auth-server:latest
-
-# OpenAI / LLM
-OPENAI_API_KEY=
-GPT_MODEL_NAME=gpt-4o
-
-# DigitalOcean Spaces (S3-compatible storage)
-EAGLE_ENABLE_S3=false
-DO_SPACES_ACCESS_KEY=
-DO_SPACES_SECRET_KEY=
-
-# JWT authentication
-JWT_PRIVATE_KEY=
-
-# OAuth providers
-DISCORD_CLIENT_ID=
-DISCORD_CLIENT_SECRET=
-GOOGLE_CLIENT_ID=
-GOOGLE_CLIENT_SECRET=
-
-# Shardok connection
-SHARDOK_ADDRESS=shardok:40042
-SHARDOK_AUTH_TOKEN=
-
-# Monitoring
-SENTRY_DSN=
-
-# Email (Fastmail JMAP)
-FASTMAIL_API_TOKEN=
-FASTMAIL_FROM_EMAIL=
-FASTMAIL_FROM_NAME=

deploy/update-env.sh

@@ -1,59 +0,0 @@
-#!/bin/bash
-# Update .env file without losing other variables
-# Usage: ./update-env.sh KEY1=value1 KEY2=value2 ...
-#
-# This script:
-# 1. Creates .env from template if it doesn't exist
-# 2. Updates only the specified KEY=value pairs
-# 3. Preserves all other existing values
-
-set -e
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-ENV_FILE="${ENV_FILE:-/opt/eagle0/.env}"
-TEMPLATE_FILE="${TEMPLATE_FILE:-$SCRIPT_DIR/env.template}"
-
-# Create .env from template if it doesn't exist
-if [ ! -f "$ENV_FILE" ]; then
-    if [ -f "$TEMPLATE_FILE" ]; then
-        echo "Creating .env from template..."
-        grep -v '^#' "$TEMPLATE_FILE" | grep -v '^$' > "$ENV_FILE"
-    else
-        echo "Creating empty .env..."
-        touch "$ENV_FILE"
-    fi
-    chmod 600 "$ENV_FILE"
-fi
-
-# Process each KEY=VALUE argument
-for arg in "$@"; do
-    # Skip empty args
-    [ -z "$arg" ] && continue
-
-    # Parse KEY=VALUE
-    KEY="${arg%%=*}"
-    VALUE="${arg#*=}"
-
-    # Skip if no key
-    [ -z "$KEY" ] && continue
-
-    # Skip setting empty values (keeps existing value)
-    if [ -z "$VALUE" ]; then
-        echo "Skipping $KEY (empty value)"
-        continue
-    fi
-
-    # Remove existing line for this key and add new one
-    if grep -q "^${KEY}=" "$ENV_FILE" 2>/dev/null; then
-        # Key exists, update it
-        sed -i "s|^${KEY}=.*|${KEY}=${VALUE}|" "$ENV_FILE"
-        echo "Updated $KEY"
-    else
-        # Key doesn't exist, add it
-        echo "${KEY}=${VALUE}" >> "$ENV_FILE"
-        echo "Added $KEY"
-    fi
-done
-
-chmod 600 "$ENV_FILE"
-echo "Done updating $ENV_FILE"

docker-compose.prod.yml

@@ -1,11 +1,13 @@
 # Docker Compose for production deployment
 #
 # Local testing:
-#   Build images: bazel run //ci:eagle_server_load && bazel run //ci:shardok_server_load && bazel run //ci:auth_server_load
+#   Build images: bazel run //ci:eagle_server_load && bazel run //ci:auth_server_load
 #   Run: docker compose -f docker-compose.prod.yml up
 #
 # Production deployment:
 #   Run: docker compose -f docker-compose.prod.yml up -d
+#
+# Note: Shardok runs on Hetzner ARM64 server, deployed via shardok_arm64_build.yml workflow.
 
 services:
   # Blue-green deployment: eagle-blue is the primary (production) instance
@@ -19,7 +21,7 @@ services:
       - "--gpt-model-name"
       - "${GPT_MODEL_NAME:-gpt-5.1}"
       - "--shardok-interface-remote-address"
-      - "${SHARDOK_ADDRESS:-shardok:40042}"
+      - "${SHARDOK_ADDRESS}"
       - "--auth-service-url"
       - "auth:40033"
     ports:
@@ -30,10 +32,9 @@ services:
       DO_SPACES_ENDPOINT: "${DO_SPACES_ENDPOINT:-https://sfo3.digitaloceanspaces.com}"
       DO_SPACES_ACCESS_KEY: "${DO_SPACES_ACCESS_KEY:-}"
       DO_SPACES_SECRET_KEY: "${DO_SPACES_SECRET_KEY:-}"
-      JWT_PRIVATE_KEY: "${JWT_PRIVATE_KEY:-}"
-      DISCORD_CLIENT_ID: "${DISCORD_CLIENT_ID:-}"
-      DISCORD_CLIENT_SECRET: "${DISCORD_CLIENT_SECRET:-}"
-      # Auth token for remote Shardok on Hetzner (only used when shardok address contains .eagle0.net)
+      # JWT public key for token validation (auth service handles signing)
+      # Reads from /etc/eagle0/keys/public.pem via shared volume
+      # Auth token for Shardok on Hetzner (required)
       SHARDOK_AUTH_TOKEN: "${SHARDOK_AUTH_TOKEN:-}"
       # Use persistent volume for save data (users, games, etc.)
       EAGLE_SAVE_DIR: "/app/saves"
@@ -45,9 +46,8 @@ services:
       - ./archived:/app/archived     # Archived completed games
       - ./jfr:/app/jfr  # JFR recordings - dump with: docker exec eagle-blue jcmd 1 JFR.dump filename=/app/jfr/profile.jfr
       - jvm-tmp:/tmp  # Shared with jfr-sidecar for JVM attach socket files
-      - jwt-keys:/etc/eagle0/keys  # Shared JWT keys with auth service
+      - jwt-keys:/etc/eagle0/keys:ro  # JWT public key from auth service (read-only)
     depends_on:
-      - shardok
       - auth
     restart: unless-stopped
     logging:
@@ -70,7 +70,7 @@ services:
       - "--gpt-model-name"
       - "${GPT_MODEL_NAME:-gpt-5.1}"
       - "--shardok-interface-remote-address"
-      - "${SHARDOK_ADDRESS:-shardok:40042}"
+      - "${SHARDOK_ADDRESS}"
       - "--auth-service-url"
       - "auth:40033"
     ports:
@@ -81,9 +81,8 @@ services:
       DO_SPACES_ENDPOINT: "${DO_SPACES_ENDPOINT:-https://sfo3.digitaloceanspaces.com}"
       DO_SPACES_ACCESS_KEY: "${DO_SPACES_ACCESS_KEY:-}"
       DO_SPACES_SECRET_KEY: "${DO_SPACES_SECRET_KEY:-}"
-      JWT_PRIVATE_KEY: "${JWT_PRIVATE_KEY:-}"
-      DISCORD_CLIENT_ID: "${DISCORD_CLIENT_ID:-}"
-      DISCORD_CLIENT_SECRET: "${DISCORD_CLIENT_SECRET:-}"
+      # JWT public key for token validation (auth service handles signing)
+      # Reads from /etc/eagle0/keys/public.pem via shared volume
       SHARDOK_AUTH_TOKEN: "${SHARDOK_AUTH_TOKEN:-}"
       EAGLE_SAVE_DIR: "/app/saves"
       EAGLE_ARCHIVE_DIR: "/app/archived"
@@ -92,9 +91,10 @@ services:
     volumes:
       - ./saves:/app/saves           # Same save directory as blue
       - ./archived:/app/archived     # Same archive directory as blue
-      - jwt-keys:/etc/eagle0/keys    # Shared JWT keys with auth service
+      - ./jfr:/app/jfr               # JFR recordings (same as blue)
+      - jvm-tmp:/tmp                 # Shared with jfr-sidecar-green for JVM attach socket files
+      - jwt-keys:/etc/eagle0/keys:ro # JWT public key from auth service (read-only)
     depends_on:
-      - shardok
       - auth
     restart: "no"  # Don't auto-restart during deployment
     logging:
@@ -131,6 +131,16 @@ services:
       DISCORD_CLIENT_SECRET: "${DISCORD_CLIENT_SECRET:-}"
       GOOGLE_CLIENT_ID: "${GOOGLE_CLIENT_ID:-}"
       GOOGLE_CLIENT_SECRET: "${GOOGLE_CLIENT_SECRET:-}"
+      GH_OAUTH_CLIENT_ID: "${GH_OAUTH_CLIENT_ID:-}"
+      GH_OAUTH_CLIENT_SECRET: "${GH_OAUTH_CLIENT_SECRET:-}"
+      # Apple Sign-In credentials
+      APPLE_SIGNIN_CLIENT_ID: "${APPLE_SIGNIN_CLIENT_ID:-}"
+      APPLE_TEAM_ID: "${APPLE_TEAM_ID:-}"
+      APPLE_SIGNIN_KEY_ID: "${APPLE_SIGNIN_KEY_ID:-}"
+      APPLE_SIGNIN_PRIVATE_KEY: "${APPLE_SIGNIN_PRIVATE_KEY:-}"
+      # Twitch OAuth credentials
+      TWITCH_CLIENT_ID: "${TWITCH_CLIENT_ID:-}"
+      TWITCH_CLIENT_SECRET: "${TWITCH_CLIENT_SECRET:-}"
       # Server base URL for OAuth callbacks
       SERVER_BASE_URL: "${SERVER_BASE_URL:-https://prod.eagle0.net}"
       # JWT keys - PEM files in volume, bootstrapped from JWK on first run
@@ -140,6 +150,8 @@ services:
       FASTMAIL_API_TOKEN: "${FASTMAIL_API_TOKEN:-}"
       FASTMAIL_FROM_EMAIL: "${FASTMAIL_FROM_EMAIL:-}"
       FASTMAIL_FROM_NAME: "${FASTMAIL_FROM_NAME:-}"
+      # Require invitation codes for new user registration
+      REQUIRE_INVITATION_CODE: "true"
     # Note: port 40033 is exposed via nginx, not directly
     volumes:
       - jwt-keys:/etc/eagle0/keys  # Shared JWT keys with Eagle
@@ -158,30 +170,8 @@ services:
       retries: 3
       start_period: 10s
 
-  shardok:
-    image: ${SHARDOK_IMAGE:-registry.digitalocean.com/eagle0/shardok-server:latest}
-    container_name: shardok-server
-    mem_limit: 1g
-    memswap_limit: 1g  # Prevent swap, OOM-kill cleanly instead
-    ports:
-      - "40042:40042"
-      - "40052:40052"
-    environment:
-      SHARDOK_RESOURCES_PATH: "/app/resources"
-      SHARDOK_MAPS_PATH: "/app/resources/maps"
-      SHARDOK_EAGLE_INTERFACE_ADDRESS: "0.0.0.0:40042"
-    restart: unless-stopped
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "100m"
-        max-file: "5"
-    healthcheck:
-      test: ["CMD-SHELL", "nc -z localhost 40042 || exit 1"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 10s
+  # Note: Shardok runs on Hetzner ARM64 server, not in this docker-compose.
+  # Configure SHARDOK_ADDRESS to point to the Hetzner instance.
 
   nginx:
     image: nginx:alpine
@@ -196,8 +186,9 @@ services:
       - ./certbot/www:/var/www/certbot:ro
       - ./auth:/etc/nginx/auth:ro
     depends_on:
-      - eagle-blue
       - admin
+    # Note: nginx connects to eagle via EAGLE_ADDR (default: eagle-blue:40032)
+    # For blue-green deployments, update EAGLE_ADDR in .env before switching
     restart: unless-stopped
     logging:
       driver: "json-file"
@@ -214,14 +205,14 @@ services:
       - "--auth-addr"
       - "auth:40033"
       - "--jfr-sidecar-addr"
-      - "jfr-sidecar:8081"
+      - "${JFR_SIDECAR_ADDR:-jfr-sidecar:8081}"  # Can be switched for blue-green
       - "--http-port"
       - "8080"
     # No external port - accessed via nginx at admin.eagle0.net
     depends_on:
-      - eagle-blue
       - auth
-      - jfr-sidecar
+    # Note: admin connects to eagle via EAGLE_ADDR and jfr-sidecar via JFR_SIDECAR_ADDR
+    # For blue-green deployments, set both in .env before switching
     restart: unless-stopped
     logging:
       driver: "json-file"
@@ -239,6 +230,7 @@ services:
     image: ${JFR_SIDECAR_IMAGE:-registry.digitalocean.com/eagle0/jfr-sidecar:latest}
     container_name: jfr-sidecar
     # Share PID namespace with Eagle to access its JVM via jcmd
+    # For blue-green: use JFR_SIDECAR_ADDR=jfr-sidecar-green:8081 when green is active
     pid: "service:eagle-blue"
     volumes:
       - jvm-tmp:/tmp  # Shared with Eagle for JVM attach socket files
@@ -257,6 +249,29 @@ services:
       retries: 3
       start_period: 10s
 
+  jfr-sidecar-green:
+    image: ${JFR_SIDECAR_IMAGE:-registry.digitalocean.com/eagle0/jfr-sidecar:latest}
+    container_name: jfr-sidecar-green
+    profiles: ["blue-green"]  # Only started during blue-green deployment
+    # Share PID namespace with Eagle green instance
+    pid: "service:eagle-green"
+    volumes:
+      - jvm-tmp:/tmp  # Shared with Eagle for JVM attach socket files
+    depends_on:
+      - eagle-green
+    restart: "no"  # Don't auto-restart during deployment
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "2"
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q --spider http://localhost:8081/health || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+
   certbot:
     image: certbot/certbot
     container_name: certbot

docs/ASSET_AUDIT.md

@@ -109,11 +109,20 @@ All 26 tracks have CC licenses with proper attribution:
 | Dragon Castle | Makai Symphony | CC BY-SA 3.0 |
 | Durandal | Makai Symphony | CC BY-SA 3.0 |
 
-**Tracks without specific license (verify):**
-- Market Day
-- Shopping List
-- Medieval: Victory Theme
-- Tracks by Dima Koltsov (AUDIUS): No Time for Greatness, Warriors of Demacia, Forest Queen Tale, Valor, Clouds
+**Tracks with non-CC licenses:**
+
+| Track | Artist | License | Source |
+|-------|--------|---------|--------|
+| Market Day | RandomMind | Free without attribution | [Chosic](https://www.chosic.com/download-audio/27016/) |
+| Shopping List | Komiku | Free without attribution | [Chosic](https://www.chosic.com/download-audio/24714/) |
+| Medieval: Victory Theme | Unknown | **NEEDS VERIFICATION** | Unknown |
+| No Time for Greatness | Dima Koltsov | Audius Open Music License | [Audius](https://audius.co/dimathecomposer) |
+| Warriors of Demacia | Dima Koltsov | Audius Open Music License | [Audius](https://audius.co/dimathecomposer) |
+| Forest Queen Tale | Dima Koltsov | Audius Open Music License | [Audius](https://audius.co/dimathecomposer) |
+| Valor | Dima Koltsov | Audius Open Music License | [Audius](https://audius.co/dimathecomposer) |
+| Clouds | Dima Koltsov | Audius Open Music License | [Audius](https://audius.co/dimathecomposer) |
+
+**Note on Dima Koltsov tracks:** Audius uses an "Open Music License" by default, which is not the same as Creative Commons. These should eventually be replaced with CC-licensed alternatives.
 
 ---
 
@@ -129,16 +138,6 @@ All 26 tracks have CC licenses with proper attribution:
 
 ## 4. Potentially Problematic Assets (Review Needed)
 
-### Stock Images (Possible License Issues)
-These appear to be stock images that may have been used as placeholders:
-
-| File | Concern |
-|------|---------|
-| ~~`Assets/Eagle/79066358-stock-illustration-raster-illustration-medieval-purse-bag...jpg`~~ | **DELETED** (2025-01-04) |
-| ~~`Assets/Images/kisspng-hammer-hand-saws-tool-clip-art...jpg`~~ | **DELETED** (2025-01-04) |
-| ~~`Assets/Images/lee-ermy-cropped.jpg`~~ | **DELETED** (2025-01-04) |
-| ~~`Assets/Eagle/images.jpeg`~~ | **DELETED** (2025-01-04) |
-
 ### Clip Art (Unknown License)
 | File | Concern |
 |------|---------|
@@ -196,24 +195,24 @@ NuGet packages in `Assets/Packages/` all include LICENSE.TXT files:
 
 ### Must Verify Before Opening Public Access:
 
-1. ~~**Stock images** - The JPG files with stock image filenames need review.~~ **DONE** - Deleted lee-ermy, kisspng, stock-illustration, Yosemite Sam, and images.jpeg (2025-01-04)
-
-2. **Clip art images** - Unknown license, need replacement with properly licensed alternatives:
+1. **Clip art images** - Unknown license, need replacement with properly licensed alternatives:
    - `Assets/Shardok/commandImages/bridge.png` - wooden bridge icon
    - `Assets/Images/startFire.png` - fire icon
 
-3. **Shardok sound effects** - 56 MP3 files of unknown origin. Either:
+2. **Shardok sound effects** - 56 MP3 files of unknown origin. Either:
    - Document their source
    - Replace with known-licensed alternatives
    - Confirm they were custom-created
 
-4. **Terrain Hexes** - 85 hex tiles of unknown source
+3. **Terrain Hexes** - 85 hex tiles of unknown source
    - **TODO:** Confirm if this is a Unity Asset Store purchase (owner believes it is)
 
-5. **StrategyGameIcons** - 138 icons of unknown source
+4. **StrategyGameIcons** - 138 icons of unknown source
    - **TODO:** Investigate origin - check Unity Asset Store purchase history
 
-6. **AUDIUS music tracks** - Verify Dima Koltsov tracks are licensed for commercial use
+5. **Medieval: Victory Theme** - Cannot find source or license. Either verify origin or replace.
+
+6. **Dima Koltsov (Audius) tracks** - 5 tracks under Audius "Open Music License" (not Creative Commons). Replace with CC-licensed alternatives eventually.
 
 7. **Discord logo** (`Eagle/Discord-Logo-Blurple.png`) - Likely fine for "Login with Discord" button per Discord brand guidelines, but verify usage complies with their terms
 
@@ -229,12 +228,12 @@ NuGet packages in `Assets/Packages/` all include LICENSE.TXT files:
 
 ## Recommendation
 
-Before removing HTTP basic auth:
+Before public release:
 
-1. ~~Delete or replace the 4 suspicious JPG/JPEG files in `Assets/Eagle/` and `Assets/Images/`~~ **DONE** (2025-01-04)
-2. Replace clip art images (`bridge.png`, `startFire.png`) with properly licensed alternatives (e.g., from [game-icons.net](https://game-icons.net) CC BY 3.0)
-3. Verify source of `Assets/Shardok/soundEffects/` MP3s
-4. Verify source of `Assets/Terrain Hexes/` and `Assets/StrategyGameIcons/`
-5. If any are from early development with unclear licensing, replace them
+1. Replace clip art images (`bridge.png`, `startFire.png`) with properly licensed alternatives (e.g., from [game-icons.net](https://game-icons.net) CC BY 3.0)
+2. Verify source of `Assets/Shardok/soundEffects/` MP3s
+3. Verify source of `Assets/Terrain Hexes/` and `Assets/StrategyGameIcons/`
+4. Replace Dima Koltsov Audius tracks with CC-licensed alternatives
+5. Find source of Medieval: Victory Theme or replace
 
 The bulk of your assets (95%+) are properly licensed Asset Store purchases or CC content.

docs/DEPROTO_PLAN.md

@@ -33,356 +33,147 @@
 
 ---
 
-## Current State
+## Current State (January 2026)
 
-### Completed Phases
-
-| Phase | Status | Summary |
-|-------|--------|---------|
-| Phase 1: GameStateC | **Complete** | Scala `GameState` model with 22 fields |
-| Phase 2: EngineImpl | **Complete** | Holds Scala `GameState` internally |
-| Phase 3: GameHistory | **Complete** | `stateAfter` returns Scala GameState |
-| Phase 4: ActionResultT | **Complete** | All 59 actions return `ActionResultT` |
-| Phase 5: Action Base Classes | **Complete** | All `RandomSequentialResultsAction` and `DeterministicSingleResultAction` converted to T-type base classes |
-| Phase 5b: Base Class Cleanup | **Complete** | `RandomSequentialResultsAction` and `DeterministicSingleResultAction` deleted |
-| Phase 5c: RoundPhaseAdvancer Actions | **Complete** | All actions called by RoundPhaseAdvancer accept Scala GameState |
-| Phase 5d: RoundPhaseAdvancer Itself | **Complete** | RoundPhaseAdvancer.checkForPhaseAdvancement takes Scala GameState |
-
-### Phase 5c/5d Progress (Complete)
-
-`RoundPhaseAdvancer.checkForPhaseAdvancement` now accepts Scala `GameState` and `ActionResultApplier` directly (PR #4677).
-
-| Action | PR | Status |
-|--------|-----|--------|
-| `PrisonerExchangeAction` | #4670 | ✅ Merged |
-| `PerformForcedTurnBackAction` | #4671 | ✅ Merged |
-| `PerformHeroDeparturesAction` | #4672 | ✅ Merged |
-| `RequestFreeForAllBattlesAction` | #4673 | ✅ Merged |
-| `EndPlayerCommandsPhaseAction` | #4674 | ✅ Merged |
-| `EndDiplomacyResolutionPhaseAction` | #4675 | ✅ Merged |
-| `RoundPhaseAdvancer` itself | #4677 | ✅ Merged |
-
-### EngineImpl Progress
-
-| Change | PR | Status |
-|--------|-----|--------|
-| `recursiveTransform` deleted | #4677 | ✅ Merged |
-| `recursiveTransformT` uses `RandomStateTSequencer` | #4677 | ✅ Merged |
-
-### Current Architecture
-
-**ActionResultT Production (100% Complete):**
-- All actions produce `ActionResultT`
-- Conversion to `ActionResultProto` happens via `ActionResultProtoConverter.toProto()`
-- No direct `ActionResultProto` construction outside the converter
-
-**ActionResultProto Consumption (Next Target):**
-- `ActionResultProtoApplierImpl` - applies proto results to proto GameState
-- `RoundPhaseAdvancer` - calls converter, passes protos to applier
-- `InMemoryHistory` / `PersistedHistory` - stores proto results
-- Service layer (`GameController`, `GamesManager`, etc.) - uses proto for client communication
-
----
-
-## Phase 6: Migrate to ActionResultT Consumers
-
-### Objective
-
-Eliminate internal consumption of `ActionResultProto`. Everything inside the engine should work with `ActionResultT`.
-
-### Current Flow (Proto-Heavy)
-```
-Action.execute()
-    → ActionResultT
-    → ActionResultProtoConverter.toProto()
-    → ActionResultProto
-    → ActionResultProtoApplierImpl.applyActionResults()
-    → GameStateProto
-    → GameStateConverter.fromProto()
-    → GameStateC
-```
-
-### Target Flow (T-Types Throughout)
-```
-Action.execute()
-    → ActionResultT
-    → ActionResultApplier.applyActionResults()
-    → GameStateC
-
-    (Proto conversion only at boundaries)
-```
-
-### Key Files to Convert
-
-**Tier 1 - Core Applier:** ✅ **Complete**
-```
-src/main/scala/net/eagle0/eagle/library/actions/applier/ActionResultApplierImpl.scala
-```
-`ActionResultApplier` applies `ActionResultT` directly to Scala `GameState`. The legacy `ActionResultTApplierImpl` wraps it and converts to/from proto for callers that still need proto types.
-
-**Tier 2 - RoundPhaseAdvancer:** ✅ **Complete**
-```
-src/main/scala/net/eagle0/eagle/library/RoundPhaseAdvancer.scala
-```
-Now accepts Scala `GameState` and `ActionResultApplier`. Only converts to proto lazily for `AvailableCommandsFactory` calls.
-
-**Tier 3 - Sequencers:**
-```
-src/main/scala/net/eagle0/eagle/library/actions/impl/common/RandomStateTSequencer.scala
-src/main/scala/net/eagle0/eagle/library/actions/impl/common/RandomStateProtoSequencer.scala
-```
-Modify `RandomStateTSequencer` to thread Scala `GameState` throughout (currently converts to proto internally). Then evaluate whether `RandomStateProtoSequencer` is still needed at all.
-
-**Current State**: `RandomStateTSequencer` accepts Scala `GameState` via its `apply()` method but internally converts to proto. All callback methods (`withRandomActionResult`, `withActionResults`, etc.) pass `GameStateProto` to callers, forcing actions that use the sequencer to work with proto types internally.
-
-**Target State**: Create a fully protoless sequencer where:
-1. `lastState` returns Scala `GameState` (not `lastStateProto`)
-2. All callback methods pass Scala `GameState` to callers
-3. Actions using the sequencer can be fully protoless
-
-**Migration Path**:
-1. Add `lastState: GameState` method alongside `lastStateProto` (non-breaking)
-2. Add parallel callback methods that pass Scala GameState (e.g., `withScalaActionResult`)
-3. Migrate actions one by one to use the new Scala-based callbacks
-4. Once all actions migrated, deprecate/remove proto-based callbacks
-5. Remove `lastStateProto` once no longer used
-
-**RandomStateSequencer Migration Progress** (PR #4679 introduced protoless `RandomStateSequencer`):
-
-| Action | Status |
-|--------|--------|
-| `TruceTurnBackPhaseAction` | ✅ Migrated (PR #4680) |
-| `EndHandleRiotsPhaseAction` | ✅ Migrated (PR #4684) |
-| `PerformVassalCommandsPhaseAction` | ✅ Migrated |
-| `PerformVassalDefenseDecisionsAction` | ✅ Migrated |
-| `EndVassalCommandsPhaseAction` | ✅ Migrated |
-| `PerformReconResolutionAction` | ✅ Migrated |
-| `NewRoundAction` | ✅ Migrated (PR #4698) |
-| `EndBattleAftermathPhaseAction` | ✅ Migrated (PR #4699) |
-| `EndDiplomacyResolutionPhaseAction` | ✅ Migrated |
-| `PerformUnaffiliatedHeroesAction` | ✅ Migrated |
-| `EngineImpl.recursiveTransformT` | ✅ Migrated (PR #4704) |
-| `ProtolessSequentialResultsActionWrapper` | ✅ Migrated (PR #4705) |
-| `LegacyRandomStateTSequencer` | ✅ **Deleted** (PR #4705) |
-
-**TCommandFactory Extraction** (PR #4684):
-
-To enable lightweight mocking of command creation in tests, `TCommandFactory` trait was extracted from `CommandFactory`. This allows tests to mock just the `makeTCommand` method without pulling in all 40+ command dependencies that `CommandFactory` requires.
-
-- `TCommandFactory` - lightweight trait with just `makeTCommand`
-- `CommandFactory extends TCommandFactory` - maintains backward compatibility
-- Actions accepting command factories now use `TCommandFactory` type for better testability
-
-**Tier 4 - History APIs:**
-```
-src/main/scala/net/eagle0/eagle/service/InMemoryHistory.scala
-src/main/scala/net/eagle0/eagle/service/PersistedHistory.scala
-```
-Change APIs to vend Scala `GameState` and `ActionResultT` instead of proto versions. `PersistedHistory` converts to proto internally for disk persistence; `InMemoryHistory` doesn't need proto at all.
-
-### ActionResultProto Consumer Inventory
-
-| File | Usage | Status |
-|------|-------|--------|
-| `ActionResultApplierImpl.scala` | Applies ActionResultT to Scala GameState | ✅ **Complete** |
-| `ActionResultTApplierImpl.scala` | Legacy wrapper - converts to/from proto | Keep until all callers migrated |
-| `RoundPhaseAdvancer.scala` | Uses Scala GameState | ✅ **Complete** |
-| `RandomStateSequencer.scala` | Threads Scala GameState | ✅ **Complete** |
-| `VigorXPApplier.scala` | Has both proto and Scala methods | Scala method exists, delete proto method when unused |
-| `PerformForcedTurnBackAction.scala` | Fully protoless | ✅ **Complete** |
-| `ResolveBattleAction.scala` | ✅ Fully protoless | Complete (PR #5048) |
-| `InMemoryHistory.scala` | Stores proto results | Pending - vend Scala types |
-| `PersistedHistory.scala` | Stores proto results | Pending - vend Scala types, convert for disk |
-| `GameController.scala` | Uses proto for client communication | Keep proto (gRPC boundary) |
-
-### Remaining Proto Usage in Actions
-
-**Progress: 52 of 52 action files (100%) are fully protoless.** ✅
-
-All action files have been migrated to use Scala types:
-
-| Action | Status | Notes |
-|--------|--------|-------|
-| `ResolveBattleAction` | ✅ Complete | PR #5048 - uses Scala GameState and ActionResultApplier |
-| `PerformVassalCommandsPhaseAction` | ✅ Complete | Uses Scala types via CommandChoiceHelpers |
-| `EndHandleRiotsPhaseAction` | ✅ Complete | Uses Scala types via CommandChoiceHelpers |
-| `PerformVassalDefenseDecisionsAction` | ✅ Complete | Uses Scala types via CommandChoiceHelpers |
-| `EndVassalCommandsPhaseAction` | ✅ Complete | Uses Scala types via CommandChoiceHelpers |
-
-**Note:** `NewRoundAction` is now fully protoless after converting `ChronicleEventGenerator` to return Scala `ChronicleEvent` types directly.
-
-**Deleted Dead Code:**
-- `UnaffiliatedHeroMovedAction` - Was never called; `PerformUnaffiliatedHeroesAction.heroMovedResult` constructs `ActionResultC` directly
-- `HeroBackstoryUpdateActionGenerator.fromGameState` - Dead method that converted proto to Scala; only `apply(GameState)` is used
-
-**Note**: `PerformReconResolutionAction` and `EndBattleAftermathPhaseAction` are now fully protoless after:
-1. Migrating `FactionT.reconnedProvinces` and `ChangedFactionC.updatedReconnedProvinces` to use Scala `ProvinceView`
-2. Adding Scala overload of `ProvinceViewFilter.withdrawnFromProvinceView`
-
-### Estimated Effort (Remaining)
-
-| Component | Lines | Complexity | Blocks |
-|-----------|-------|------------|--------|
-| History API updates | ~100 | Low | - |
-| **Total Remaining** | **~100** | | |
-
-**Completed:**
-- ✅ `ChronicleEventGenerator` converted to return Scala `ChronicleEvent` types directly
-- ✅ `CommandChoiceHelpers` migrated to Scala types
-- ✅ `ResolveBattleAction` refactored to use Scala GameState and ActionResultApplier (PR #5048)
-
-### Enum Type Migrations
-
-Proto enums are being converted to Scala sealed traits with converters at boundaries:
-
-| Enum | Scala Type | Status | Notes |
-|------|------------|--------|-------|
-| `DiplomacyOfferStatus` | `Status` sealed trait | ✅ **Complete** | PR #5093 - `EligibleDiplomacyStatuses` uses Scala types internally |
-| `RoundPhase` | `RoundPhase` sealed trait | Partial | Some usages converted |
-| `BattalionType` | `BattalionType` sealed trait | Partial | Some usages converted |
-
-**DiplomacyOfferStatus Migration (PR #5093):**
-- `EligibleDiplomacyStatuses.scala` now returns `Vector[Status]` instead of `Vector[DiplomacyOfferStatus]`
-- Call sites in `AvailableResolve*CommandFactory` files convert to proto via `StatusConverter.toProto` at the boundary
-- This pattern should be applied to other proto enums
-
-### CommandChoiceHelpers Migration Status
-
-Several command selectors have already been converted to use Scala types:
-
-| File | Status | Notes |
-|------|--------|-------|
-| `AttackCommandChooser.scala` | ✅ **Protoless** | Uses Scala `GameState`, `HeroT`, `ProvinceT` |
-| `AlmsCommandSelector.scala` | ✅ **Protoless** | Uses Scala `GameState`, `HeroT`, `ProvinceT` |
-| `FoodConsumptionUtils.scala` | ✅ **Protoless** | Uses Scala `GameState`, `ProvinceT`, `RoundPhase` |
-| `MarchSuppliesHelpers.scala` | ✅ **Protoless** | Uses `BattalionT` |
-| `CombatUnitSelector.scala` | ✅ **Protoless** | Uses `HeroT`, `BattalionT`, `BattalionType` |
-| `ExpandCommandSelector.scala` | ✅ **Protoless** | Uses Scala `GameState`, `ProvinceT`, `FactionT` |
-| `ImproveCommandSelector.scala` | ✅ **Protoless** | Uses Scala `GameState`, `ProvinceT`, `HeroT` |
-| `OrganizeCommandSelector.scala` | ✅ **Protoless** | Uses Scala `GameState`, `BattalionT`, `BattalionType` |
-| `RansomOfferHelpers.scala` | ✅ **Protoless** | Uses Scala `GameState`, `FactionT` |
-| `CommandChoiceHelpers.scala` | ✅ **Protoless** | Uses Scala `GameState` throughout |
-| `ProvinceGoldSurplusCalculator.scala` | ✅ **Protoless** | Uses Scala types |
-
-**All CommandChoiceHelpers selectors have been migrated to Scala types.** ✅
-
-### Progress Summary
-
-| Metric | Value |
-|--------|-------|
-| Action files fully protoless | 52 / 52 (100%) ✅ |
-| Proto usages in remaining actions | 0 |
-| Next target | See "Next Candidates" section below |
-
-### Next Candidates
-
-Priority candidates for further deproto work:
-
-1. **More Enum Migrations** - Apply the `DiplomacyOfferStatus` pattern to other proto enums:
-   - Files importing `net.eagle0.eagle.common.round_phase.RoundPhase` (proto) could use Scala `RoundPhase`
-   - Files importing `net.eagle0.eagle.common.battalion_type.BattalionType` (proto) could use Scala `BattalionType`
-
-2. **AvailableCommandsFactory Files** - Many still use proto `GameState` internally:
-   - These files build proto `AvailableCommand` messages but could use Scala types for internal logic
-   - Convert to accept Scala `GameState`, only convert fields to proto when building the response
-
-3. **History APIs** - `InMemoryHistory` and `PersistedHistory`:
-   - Change to vend Scala `GameState` and `ActionResultT` instead of proto versions
-   - `PersistedHistory` converts to proto internally for disk persistence
-
-### Validation
-- [x] `ActionResultApplier` created and tested
-- [x] `RandomStateSequencer` threads Scala GameState throughout
-- [x] `RoundPhaseAdvancer` uses T-types internally
-- [x] `ProvinceViewFilter` has Scala overload for server-side use (PR #4752)
-- [x] `FactionT.reconnedProvinces` and `ChangedFactionC.updatedReconnedProvinces` use Scala `ProvinceView`
-- [x] `ProvinceViewFilter.withdrawnFromProvinceView` has Scala overload
-- [x] `CommandChoiceHelpers` uses Scala types ✅
-- [x] All action files (52/52) are fully protoless ✅
-- [ ] `ProvinceViewFilter` faction-filtered views use Scala types
-- [ ] History APIs vend Scala types
-- [ ] No `ActionResultProtoConverter.toProto()` calls except at persistence/gRPC boundaries
-- [ ] All tests pass
-
----
-
-## Phase 7: Clean Up Legacy Utilities
-
-### Objective
-Remove remaining direct proto imports from utility classes.
-
-### Files to Modify
-
-| File | Status |
+| Area | Status |
 |------|--------|
-| `CommandChoiceHelpers.scala` | Accepts proto `GameState`; blocks full deproto of `PerformVassalCommandsPhaseAction` and `PerformVassalDefenseDecisionsAction` |
-| `LegacyProvinceUtils.scala` | Replace with `ProvinceUtils.scala` - `hasImminentRiot` added (PR #4683) |
-| `LegacyFactionUtils.scala` | Replace proto imports with `FactionT` |
-| `LegacyUnaffiliatedHeroUtils.scala` | Replace proto imports with Scala models |
-| `BattalionTypeLoader.scala` | Keep proto for file loading, convert immediately after |
-| `BeastUtils.scala` | **Complete** - now uses Scala `BeastInfo` only |
+| Production code (`src/main/scala/.../library/`) | ✅ **Complete** - zero proto imports |
+| Test code (`src/test/scala/.../library/`) | ✅ **Complete** - 20 migrated, 6 deferred, 1 deleted |
+| Hostility proto migration | ✅ **Complete** - all 4 files migrated to Scala enum |
 
-### View Filters (Partially Complete)
-
-The view filter utilities now have Scala overloads for server-side use:
-
-| File | Status | Notes |
-|------|--------|-------|
-| `ProvinceViewFilter.scala` | **Partial** | `filteredProvinceView(ProvinceT, ScalaGameState)` added (PR #4752) |
-| `ArmyFilter.scala` | **Partial** | `filterArmy(ScalaArmy, Map[BattalionId, BattalionT], Option[FactionId])` added |
-| `BattalionViewFilter.scala` | **Complete** | Uses Scala `BattalionT` throughout |
-| `GameStateViewFilter.scala` | Pending | Uses proto types throughout |
-| `GameStateViewDiffer.scala` | Pending | Works with view protos |
-
-**Unblocked Actions** (PR #4752):
-- `EndBattleAftermathPhaseAction` - can now use `filteredProvinceView(province, scalaGameState)`
-- `PerformReconResolutionAction` - can now use Scala overload
-- `GameStateFactionExtensions` - can now use `updatedReconnedProvinces` with Scala types
-
-**Remaining Work**:
-- Faction-filtered `filteredProvinceView(Province, GameState, FactionId)` still uses proto types
-- `withdrawnFromProvinceView` still uses proto types
-- These are needed for client-facing views with visibility restrictions
+**Note:** The `bazel query` for proto dependencies still shows ~26 targets, but these are transitive build-graph dependencies from map data generation (C++/Go tools), not Scala code imports.
 
 ---
 
-## Phase 8: Verify Boundaries
+## Phase 10: Library Test Migration ✅ Complete
 
-### Objective
-Confirm protos are used correctly at boundaries — and ONLY there.
+### Overview
+
+27 test files in `src/test/scala/.../library/` were reviewed for proto type usage. 20 files were successfully migrated to use Scala model types exclusively.
+
+### Migration Results
+
+#### Successfully Migrated (20 files)
+
+| File | PR | Notes |
+|------|-----|-------|
+| `QuestFulfillmentUtilsTest.scala` | Merged | Light migration |
+| `FeastCommandTest.scala` | Merged | Light migration |
+| `FriendlyMoveActionTest.scala` | Merged | Light migration |
+| `DeclineQuestCommandTest.scala` | Merged | Light migration |
+| `PerformHostileArmySetupActionTest.scala` | Merged | Medium migration |
+| `NewYearActionTest.scala` | Merged | Medium migration |
+| `ProvinceHeldActionTest.scala` | Merged | Medium migration |
+| `AvailableMarchCommandFactoryTest.scala` | Merged | Medium migration |
+| `AvailableCommandsFactoryTest.scala` | Merged | Heavy migration |
+| `AvailablePleaseRecruitMeCommandFactoryTest.scala` | Merged | Heavy migration |
+| `PerformReconResolutionActionTest.scala` | Merged | Heavy migration |
+| `AttackDecisionCommandChooserTest.scala` | Merged | Heavy migration |
+| `PerformProvinceEventsActionTest.scala` | #5499 | Heavy migration |
+| `PerformFoodConsumptionPhaseActionTest.scala` | #5500 | Heavy migration |
+| `AvailableDiplomacyCommandsFactoryTest.scala` | #5502 | Heavy migration |
+| `EndPlayerCommandsPhaseActionTest.scala` | #5504 | Heavy migration |
+| `ProvinceConqueredActionTest.scala` | #5505 | Heavy migration |
+| `NewRoundActionTest.scala` | #5506 | Heavy migration (22 imports) |
+| `EngineImplTest.scala` | #5488 | Added InMemoryHistory.fromScalaResults |
+| `GameStateViewFilterTest.scala` | #5510 | Heavy migration with view types |
+
+#### Deferred - Shared Test Utilities (4 files)
+
+These files provide shared test utilities used by multiple tests. They retain proto types for now as migrating them requires coordinating with all dependent tests:
+
+| File | Reason |
+|------|--------|
+| `BattalionTypesTestData.scala` | Shared utility, used by multiple tests |
+| `impl/package.scala` | Shared utility with cascading dependencies |
+| `IDable.scala` | Shared utility with cascading dependencies |
+| `availability/package.scala` | Shared utility with cascading dependencies |
+
+#### Deferred - Complex Proto Integration (2 files)
+
+These tests use `ProtoMatchers` with `equalProto` for complex object comparisons. Migrating them would require significant rewriting:
+
+| File | Reason |
+|------|--------|
+| `EndBattleAftermathPhaseActionTest.scala` | Deep ProtoMatchers/equalProto integration |
+| `ResolveBattleActionTest.scala` | 34+ proto imports, heavy equalProto usage |
+
+#### Deleted (1 file)
+
+| File | Reason |
+|------|--------|
+| `RansomCommandTest.scala` | Orphaned test with no corresponding implementation |
+
+### Key Migration Patterns Used
+
+**Import aliasing to avoid naming conflicts:**
+```scala
+import net.eagle0.eagle.model.action_result.types.ActionResultType.{
+  NewRoundAction as NewRoundActionType,
+  NewYearAction as NewYearActionType
+}
+```
+
+**Using `inside()` for concrete type access:**
+```scala
+inside(result.changedProvinces.head) { case cp: ChangedProvinceC =>
+  cp.foodDelta shouldBe Some(-258)
+}
+```
+
+**Scala model construction:**
+```scala
+HeroC(id = 9, vigor = 50, factionId = Some(actingFactionId))
+ProvinceC(id = 7, rulingFactionId = Some(5), food = 2987)
+FactionC(id = 5, factionHeadId = 9, name = "Test Faction")
+```
+
+### Key Conversions Reference
+
+| Proto Type | Scala Equivalent |
+|------------|------------------|
+| `GameState` | `GameState` (model/state/game_state) |
+| `Province` | `ProvinceC` |
+| `Hero` | `HeroC` |
+| `Faction` | `FactionC` |
+| `Battalion` | `BattalionC` |
+| `Army` | `Army` (already Scala) |
+| `Date` | `Date` (model/state/date) |
+| `ChangedHero` | `ChangedHeroC` |
+| `ChangedProvince` | `ChangedProvinceC` |
+| `ActionResultType.*` | `ActionResultType.*` (Scala enum) |
+
+### Success Criteria
+
+- [x] 20 test files fully migrated to Scala types
+- [x] All tests pass
+- [x] Deferred files documented with clear rationale
+- [ ] Zero proto imports in `src/test/scala/.../library/` (6 files deferred)
+
+---
+
+## Architecture Summary
+
+### Fully Protoless ✅
+
+- **Production library code** (`src/main/scala/.../library/`)
+- **AI layer** (`/ai/`)
+- **Actions** (`/library/actions/impl/action/`)
+- **Commands** (`/library/actions/impl/command/`)
+- **Availability** (`/library/actions/availability/`)
+- **Command helpers** (`/library/util/command_choice_helpers/`)
+- **View filters** (`/library/util/view_filters/`)
+- **LLM generators** (`/library/actions/llm_prompt_generators/`)
+- **Most library tests** (`src/test/scala/.../library/`) - 20 files migrated
+
+### Proto at Boundaries (Expected) ✅
 
-### Expected Proto Usage (Keep)
 - `EagleServiceImpl.scala` - gRPC boundary
-- `InMemoryHistory.scala` / `PersistedHistory.scala` - Persistence boundary
+- `GameController.scala` - Client communication
 - `*Converter.scala` - Explicit conversion utilities
-- `*Loader.scala` - File loading utilities
+- `PersistedHistory.scala` - Disk persistence
 
-### Expected No Proto Usage (Verify)
-- `/library/actions/impl/` - Pure Scala models
-- `/library/util/` - Pure Scala models (except loaders)
-- `/model/state/` - Pure Scala models
+### Deferred (Documented) 📋
 
----
-
-## Open Questions
-
-1. **Persistence Format**: Currently game state is persisted as proto. Should we keep proto for persistence (good for schema evolution) or switch to a different format?
-
-2. **Shardok Integration**: `ResolveBattleAction` communicates with Shardok. Should the Shardok interface use protos (external service) or Scala models?
-
-3. **View Generation**: `GameStateViewDiffer` works with view protos for client updates. Views need Scala models (`ProvinceViewT`, etc.) to allow actions like `EndBattleAftermathPhaseAction` to be fully protoless. The Scala views would be converted to proto only at the gRPC boundary when sending updates to clients.
-
----
-
-## Success Criteria
-
-### Code Quality
-- [ ] Zero proto imports in `/library/actions/` (except boundaries)
-- [ ] Zero proto imports in `/library/` utilities (except loaders)
-- [ ] `GameStateT` used throughout engine internals
-- [ ] Proto usage limited to: `EagleServiceImpl`, loaders, converters, persistence
-
-### Architecture
-- [ ] Clear separation: Scala models (internal) vs Proto (boundaries)
-- [ ] Converters as the only bridge between domains
-- [ ] No "proto creep" into business logic
+- **Shared test utilities** - 4 files (BattalionTypesTestData, IDable, package objects)
+- **Complex proto tests** - 2 files (EndBattleAftermathPhaseActionTest, ResolveBattleActionTest)

docs/SMALL_EAGLE_TODO.md

@@ -0,0 +1,78 @@
+# The Small Eagle TODO
+
+## Goals
+
+Be able to support a small (10-50 user) private alpha, including with strangers.
+
+Larger set of goals in [The Big Eagle TODO](https://docs.google.com/document/d/17RTt3-4Wl2AAVMRLodaC3a84E4de6xuQTWBPvCRM484/edit?pli=1&tab=t.0), but most of that is not necessary for MVP.
+
+## Required
+
+### Gameplay Productionization
+
+- [x] ~~All functionality works on production eagle / shardok servers~~
+- [x] ~~Acceptable latency in all regions~~
+- [x] ~~Shardok performance similar to QA~~
+- [x] ~~Error logging & alerting~~
+- [x] ~~Fix long disconnects on deployments~~
+- [ ] Fix the Mac installer
+- [x] ~~Still not reconnecting after deployments~~
+- [ ] Notify about client updates, button to come directly back
+- [ ] Generatedtext healing
+- [ ] Kill outstanding shardok requests when game is deleted
+
+### Other Productionization
+
+- [x] ~~Oauth sign-in~~
+  - [x] ~~Add Google, others?~~
+- [ ] User management
+  - [x] ~~Invite codes~~
+  - [ ] Link accounts
+  - [x] ~~Choose display name~~
+  - [x] ~~Just do account setup from the landing page?~~
+- [x] ~~Download client directly from DO, avoid basic auth/my home network~~
+- [ ] "Message of the day"
+- [ ] Support plan
+
+### Alpha Tester Support
+
+- [ ] Feedback channel (Discord server? Bug report form?)
+- [ ] Crash reporting from Unity client
+- [ ] Known issues doc (so testers don't report the same things)
+
+### IP / Legal
+
+- [ ] Document and make available licenses for art & music
+- [ ] Required open source disclosures
+- [ ] Audit assets for anything we don't have rights to and replace it
+- [ ] Replace heroes that are based on real 20th or 21st century people or IP
+- [ ] Privacy policy (collecting accounts, OAuth data, gameplay data)
+- [ ] Terms of service (basic liability protection)
+- [ ] Data deletion capability (user requests account removal)
+
+### Basic Gameplay
+
+- [ ] Tutorial
+  - [ ] In the Your Warlord panel, say what the profession is
+  - [x] ~~And separate panels for each profession when you encounter one~~
+  - [x] ~~Command tutorial for each command the first time it's clicked~~
+  - [x] ~~Time to recruit / expand~~
+    - [x] ~~And how expansion works~~
+  - [ ] Province events
+  - [ ] Running low on food
+  - [x] ~~Time to swear brotherhood~~
+    - [x] ~~When you get large, or~~
+    - [x] ~~When you get a good candidate~~
+  - [ ] Shardok tutorial!
+- [ ] Basic Shardok AI stuff fixed
+- [ ] Lobby fixes
+- [ ] Have goals / ending
+- [ ] First-session onboarding (beyond mechanics tutorial)
+  - [ ] Narrative hook in first few minutes - why should I care about my warlord?
+  - [ ] Clear first-session goal ("try to capture your first province" or similar)
+  - [ ] Early small victory to build momentum
+  - [ ] Guided first scenario vs. overwhelming sandbox?
+
+## Nice to have
+
+<!-- Add nice-to-have items here as they come up -->

docs/SPARKLE_DELTA_UPDATES.md

@@ -0,0 +1,568 @@
+# Sparkle Delta Updates Implementation Plan
+
+## Overview
+
+This document outlines the implementation plan for adding delta update support to the Eagle0 macOS auto-update system using Sparkle's BinaryDelta feature.
+
+### Current State
+- Full DMG downloads (~200MB) for every update
+- `mac_build_handler.go` creates DMG, signs it, uploads to S3, updates appcast.xml
+- Keeps last 10 versions in appcast, deletes older DMGs
+- Users must download full app even for small changes
+
+### Goals
+- Reduce update download size from ~200MB to ~10-30MB (85% reduction)
+- Maintain backward compatibility with full DMG downloads
+- Automatic fallback for users who are many versions behind
+
+## Sparkle Delta Update Architecture
+
+Sparkle supports binary delta updates through the `<sparkle:deltas>` element in the appcast. When a user updates, Sparkle:
+1. Checks if a delta patch exists from their current version to the new version
+2. If found, downloads the smaller delta patch instead of the full DMG
+3. Applies the patch locally to create the new app version
+4. Falls back to full DMG if no matching delta exists
+
+### Appcast XML Structure with Deltas
+
+```xml
+<?xml version="1.0" encoding="UTF-8"?>
+<rss version="2.0" xmlns:sparkle="http://www.andymatuschak.org/xml-namespaces/sparkle">
+  <channel>
+    <title>Eagle0</title>
+    <link>https://assets.eagle0.net/mac/appcast.xml</link>
+    <description>Eagle0 game updates</description>
+    <language>en</language>
+    <item>
+      <title>Version 1.0.9615</title>
+      <pubDate>Sun, 19 Jan 2026 12:00:00 -0800</pubDate>
+      <sparkle:version>9615</sparkle:version>
+      <sparkle:shortVersionString>1.0.9615</sparkle:shortVersionString>
+      <enclosure
+        url="https://assets.eagle0.net/mac/builds/eagle0-1.0.9615.dmg"
+        length="200000000"
+        type="application/octet-stream"
+        sparkle:edSignature="..." />
+      <sparkle:deltas>
+        <enclosure
+          url="https://assets.eagle0.net/mac/deltas/9614-9615.delta"
+          sparkle:deltaFrom="9614"
+          length="15000000"
+          type="application/octet-stream"
+          sparkle:edSignature="..." />
+        <enclosure
+          url="https://assets.eagle0.net/mac/deltas/9613-9615.delta"
+          sparkle:deltaFrom="9613"
+          length="18000000"
+          type="application/octet-stream"
+          sparkle:edSignature="..." />
+        <enclosure
+          url="https://assets.eagle0.net/mac/deltas/9612-9615.delta"
+          sparkle:deltaFrom="9612"
+          length="22000000"
+          type="application/octet-stream"
+          sparkle:edSignature="..." />
+      </sparkle:deltas>
+    </item>
+    <!-- older versions... -->
+  </channel>
+</rss>
+```
+
+## Implementation Plan
+
+### Phase 1: Add S3 Utility Functions
+
+**File:** `src/main/go/net/eagle0/util/aws/bucket_basics.go`
+
+Add two new functions to support delta generation:
+
+```go
+// ListObjectsWithPrefix returns all object keys matching the given prefix
+func (bb BucketBasics) ListObjectsWithPrefix(bucket, prefix string) ([]string, error) {
+    var keys []string
+    paginator := s3.NewListObjectsV2Paginator(bb.S3Client, &s3.ListObjectsV2Input{
+        Bucket: aws.String(bucket),
+        Prefix: aws.String(prefix),
+    })
+
+    for paginator.HasMorePages() {
+        page, err := paginator.NextPage(context.TODO())
+        if err != nil {
+            return nil, err
+        }
+        for _, obj := range page.Contents {
+            keys = append(keys, *obj.Key)
+        }
+    }
+    return keys, nil
+}
+
+// DownloadFile downloads an object to a local file path
+func (bb BucketBasics) DownloadFile(bucket, key, localPath string) error {
+    result, err := bb.S3Client.GetObject(context.TODO(), &s3.GetObjectInput{
+        Bucket: aws.String(bucket),
+        Key:    aws.String(key),
+    })
+    if err != nil {
+        return err
+    }
+    defer result.Body.Close()
+
+    file, err := os.Create(localPath)
+    if err != nil {
+        return err
+    }
+    defer file.Close()
+
+    _, err = io.Copy(file, result.Body)
+    return err
+}
+```
+
+### Phase 2: Store App Bundles for Delta Generation
+
+**File:** `src/main/go/net/eagle0/build/mac_build_handler/mac_build_handler.go`
+
+Add storage paths:
+```go
+var appsRoot = "mac/apps/"      // Zipped app bundles for delta generation
+var deltasRoot = "mac/deltas/"  // Delta patches
+```
+
+After DMG creation, upload the zipped app bundle:
+```go
+func uploadAppBundle(bb aws.BucketBasics, appPath string, buildNumber string) error {
+    appZipPath := filepath.Join("/tmp", fmt.Sprintf("eagle0-%s.app.zip", buildNumber))
+
+    // Create zip of app bundle using ditto (preserves metadata)
+    cmd := exec.Command("ditto", "-c", "-k", "--keepParent", appPath, appZipPath)
+    if output, err := cmd.CombinedOutput(); err != nil {
+        return fmt.Errorf("failed to zip app: %s: %w", string(output), err)
+    }
+    defer os.Remove(appZipPath)
+
+    // Upload to S3
+    remotePath := appsRoot + fmt.Sprintf("eagle0-%s.app.zip", buildNumber)
+    log.Printf("Uploading app bundle to S3: %s", remotePath)
+    return bb.UploadFilePublic(bucketName, remotePath, appZipPath)
+}
+```
+
+### Phase 3: Add Delta XML Structures
+
+**File:** `src/main/go/net/eagle0/build/mac_build_handler/mac_build_handler.go`
+
+Add new structs for delta representation:
+```go
+// Delta represents a delta patch from a previous version
+type Delta struct {
+    XMLName   xml.Name `xml:"enclosure"`
+    URL       string   `xml:"url,attr"`
+    DeltaFrom string   `xml:"sparkle:deltaFrom,attr"`
+    Length    int64    `xml:"length,attr"`
+    Type      string   `xml:"type,attr"`
+    EdSig     string   `xml:"sparkle:edSignature,attr"`
+}
+
+// Deltas wraps the sparkle:deltas element
+type Deltas struct {
+    XMLName xml.Name `xml:"sparkle:deltas"`
+    Items   []Delta  `xml:"enclosure"`
+}
+
+// Update Item struct to include Deltas
+type Item struct {
+    Title               string     `xml:"title"`
+    PubDate             string     `xml:"pubDate"`
+    SparkleVersion      string     `xml:"sparkle:version"`
+    SparkleShortVersion string     `xml:"sparkle:shortVersionString"`
+    Description         string     `xml:"description,omitempty"`
+    Enclosure           Enclosure  `xml:"enclosure"`
+    Deltas              *Deltas    `xml:"sparkle:deltas,omitempty"`
+}
+```
+
+### Phase 4: Generate Delta Patches
+
+**File:** `src/main/go/net/eagle0/build/mac_build_handler/mac_build_handler.go`
+
+```go
+// Maximum number of versions to generate deltas from
+const maxDeltaVersions = 5
+
+// generateDeltas creates delta patches from previous versions to the new version
+func generateDeltas(bb aws.BucketBasics, newBuildNumber string, newAppPath string, privateKeyPath string) ([]Delta, error) {
+    var deltas []Delta
+
+    // Ensure BinaryDelta tool is available
+    binaryDeltaPath, err := ensureBinaryDelta()
+    if err != nil {
+        return nil, fmt.Errorf("failed to get BinaryDelta: %w", err)
+    }
+
+    // List available app bundles
+    appKeys, err := bb.ListObjectsWithPrefix(bucketName, appsRoot+"eagle0-")
+    if err != nil {
+        log.Printf("Warning: failed to list app bundles: %v", err)
+        return deltas, nil // Continue without deltas
+    }
+
+    // Parse build numbers from keys and sort descending
+    var buildNumbers []string
+    for _, key := range appKeys {
+        // Extract build number from "mac/apps/eagle0-9614.app.zip"
+        base := filepath.Base(key)
+        if strings.HasPrefix(base, "eagle0-") && strings.HasSuffix(base, ".app.zip") {
+            bn := strings.TrimSuffix(strings.TrimPrefix(base, "eagle0-"), ".app.zip")
+            if bn != newBuildNumber {
+                buildNumbers = append(buildNumbers, bn)
+            }
+        }
+    }
+
+    // Sort descending (most recent first) and limit to maxDeltaVersions
+    sort.Sort(sort.Reverse(sort.StringSlice(buildNumbers)))
+    if len(buildNumbers) > maxDeltaVersions {
+        buildNumbers = buildNumbers[:maxDeltaVersions]
+    }
+
+    // Generate delta from each previous version
+    for _, oldBuild := range buildNumbers {
+        delta, err := generateSingleDelta(bb, binaryDeltaPath, oldBuild, newBuildNumber, newAppPath, privateKeyPath)
+        if err != nil {
+            log.Printf("Warning: failed to generate delta from %s: %v", oldBuild, err)
+            continue // Skip this delta but continue with others
+        }
+        deltas = append(deltas, delta)
+    }
+
+    return deltas, nil
+}
+
+func generateSingleDelta(bb aws.BucketBasics, binaryDeltaPath, oldBuild, newBuild, newAppPath, privateKeyPath string) (Delta, error) {
+    // Download old app bundle
+    oldAppZipKey := appsRoot + fmt.Sprintf("eagle0-%s.app.zip", oldBuild)
+    oldAppZipLocal := filepath.Join("/tmp", fmt.Sprintf("eagle0-%s.app.zip", oldBuild))
+    defer os.Remove(oldAppZipLocal)
+
+    if err := bb.DownloadFile(bucketName, oldAppZipKey, oldAppZipLocal); err != nil {
+        return Delta{}, fmt.Errorf("failed to download old app: %w", err)
+    }
+
+    // Unzip old app
+    oldAppDir := filepath.Join("/tmp", fmt.Sprintf("old-app-%s", oldBuild))
+    defer os.RemoveAll(oldAppDir)
+
+    cmd := exec.Command("ditto", "-x", "-k", oldAppZipLocal, oldAppDir)
+    if output, err := cmd.CombinedOutput(); err != nil {
+        return Delta{}, fmt.Errorf("failed to unzip old app: %s: %w", string(output), err)
+    }
+
+    oldAppPath := filepath.Join(oldAppDir, "eagle0.app")
+
+    // Generate delta
+    deltaPath := filepath.Join("/tmp", fmt.Sprintf("%s-%s.delta", oldBuild, newBuild))
+    defer os.Remove(deltaPath)
+
+    cmd = exec.Command(binaryDeltaPath, "create", oldAppPath, newAppPath, deltaPath)
+    if output, err := cmd.CombinedOutput(); err != nil {
+        return Delta{}, fmt.Errorf("failed to create delta: %s: %w", string(output), err)
+    }
+
+    // Get delta size
+    deltaSize, err := getFileSize(deltaPath)
+    if err != nil {
+        return Delta{}, fmt.Errorf("failed to get delta size: %w", err)
+    }
+    log.Printf("Delta %s->%s size: %d bytes (%.1f MB)", oldBuild, newBuild, deltaSize, float64(deltaSize)/1024/1024)
+
+    // Sign delta
+    signature, err := signWithSparkle(deltaPath, privateKeyPath)
+    if err != nil {
+        return Delta{}, fmt.Errorf("failed to sign delta: %w", err)
+    }
+
+    // Upload delta
+    deltaKey := deltasRoot + fmt.Sprintf("%s-%s.delta", oldBuild, newBuild)
+    if err := bb.UploadFilePublic(bucketName, deltaKey, deltaPath); err != nil {
+        return Delta{}, fmt.Errorf("failed to upload delta: %w", err)
+    }
+
+    deltaURL := fmt.Sprintf("https://assets.eagle0.net/%s", deltaKey)
+    return Delta{
+        URL:       deltaURL,
+        DeltaFrom: oldBuild,
+        Length:    deltaSize,
+        Type:      "application/octet-stream",
+        EdSig:     signature,
+    }, nil
+}
+
+func ensureBinaryDelta() (string, error) {
+    binaryDeltaPath := "/tmp/sparkle-cache/Sparkle-2.6.4/bin/BinaryDelta"
+
+    if _, err := os.Stat(binaryDeltaPath); os.IsNotExist(err) {
+        log.Println("Sparkle BinaryDelta not found, downloading...")
+        cmd := exec.Command("bash", "-c", `
+            mkdir -p /tmp/sparkle-cache
+            curl -sL https://github.com/sparkle-project/Sparkle/releases/download/2.6.4/Sparkle-2.6.4.tar.xz | tar -xJ -C /tmp/sparkle-cache
+        `)
+        if output, err := cmd.CombinedOutput(); err != nil {
+            return "", fmt.Errorf("failed to download Sparkle: %s: %w", string(output), err)
+        }
+    }
+
+    return binaryDeltaPath, nil
+}
+```
+
+### Phase 5: Update Main Deploy Flow
+
+**File:** `src/main/go/net/eagle0/build/mac_build_handler/mac_build_handler.go`
+
+Modify `main()` to integrate delta generation:
+
+```go
+func main() {
+    // ... existing argument parsing ...
+
+    // Create DMG (existing)
+    if err := createDMG(appPath, dmgPath, "Eagle0"); err != nil {
+        log.Fatalf("Failed to create DMG: %v", err)
+    }
+
+    // ... existing DMG upload ...
+
+    if privateKeyPath != "" {
+        // Upload app bundle for future delta generation (NEW)
+        log.Println("Uploading app bundle for delta generation...")
+        if err := uploadAppBundle(bb, appPath, buildNumber); err != nil {
+            log.Printf("Warning: failed to upload app bundle: %v", err)
+            // Continue - delta generation is optional
+        }
+
+        // Generate deltas from previous versions (NEW)
+        log.Println("Generating delta patches...")
+        deltas, err := generateDeltas(bb, buildNumber, appPath, privateKeyPath)
+        if err != nil {
+            log.Printf("Warning: failed to generate deltas: %v", err)
+        } else {
+            log.Printf("Generated %d delta patches", len(deltas))
+        }
+
+        // Update appcast with deltas
+        log.Println("Updating appcast.xml...")
+        appcast, err := fetchAppcast(bb)
+        if err != nil {
+            log.Fatalf("Failed to fetch appcast: %v", err)
+        }
+
+        // Create new item with deltas
+        newItem := Item{
+            Title:               fmt.Sprintf("Version %s", version),
+            PubDate:             time.Now().Format(time.RFC1123Z),
+            SparkleVersion:      buildNumber,
+            SparkleShortVersion: version,
+            Description:         "",
+            Enclosure: Enclosure{
+                URL:    downloadURL,
+                Length: fileSize,
+                Type:   "application/octet-stream",
+                EdSig:  signature,
+            },
+        }
+
+        // Add deltas if any were generated
+        if len(deltas) > 0 {
+            newItem.Deltas = &Deltas{Items: deltas}
+        }
+
+        // ... rest of appcast handling ...
+    }
+}
+```
+
+### Phase 6: Cleanup Old Artifacts
+
+**File:** `src/main/go/net/eagle0/build/mac_build_handler/mac_build_handler.go`
+
+When pruning old versions from appcast, also delete associated artifacts:
+
+```go
+// In the appcast pruning section, after removing old items:
+if len(appcast.Channel.Items) > 10 {
+    oldItems := appcast.Channel.Items[10:]
+    for _, item := range oldItems {
+        oldBuild := item.SparkleVersion
+
+        // Delete old DMG (existing)
+        dmgKey := strings.TrimPrefix(item.Enclosure.URL, "https://assets.eagle0.net/")
+        log.Printf("Deleting old build: %s", dmgKey)
+        bb.DeleteObject(bucketName, dmgKey)
+
+        // Delete old app bundle (NEW)
+        appKey := appsRoot + fmt.Sprintf("eagle0-%s.app.zip", oldBuild)
+        log.Printf("Deleting old app bundle: %s", appKey)
+        bb.DeleteObject(bucketName, appKey)
+
+        // Delete deltas TO this version (NEW)
+        deltaKeys, _ := bb.ListObjectsWithPrefix(bucketName, deltasRoot)
+        for _, key := range deltaKeys {
+            if strings.HasSuffix(key, fmt.Sprintf("-%s.delta", oldBuild)) {
+                log.Printf("Deleting old delta: %s", key)
+                bb.DeleteObject(bucketName, key)
+            }
+        }
+    }
+    appcast.Channel.Items = appcast.Channel.Items[:10]
+}
+```
+
+## S3 Storage Structure
+
+After implementation, the S3 bucket will have this structure:
+
+```
+eagle0-windows/
+├── mac/
+│   ├── appcast.xml                    # Update feed with delta info
+│   ├── builds/                        # Full DMG downloads
+│   │   ├── eagle0-1.0.9620.dmg
+│   │   ├── eagle0-1.0.9619.dmg
+│   │   ├── ...
+│   │   └── eagle0-latest.dmg          # Symlink to latest
+│   ├── apps/                          # Zipped app bundles (NEW)
+│   │   ├── eagle0-9620.app.zip
+│   │   ├── eagle0-9619.app.zip
+│   │   ├── eagle0-9618.app.zip
+│   │   ├── eagle0-9617.app.zip
+│   │   └── eagle0-9616.app.zip        # Keep last 5 for delta gen
+│   └── deltas/                        # Delta patches (NEW)
+│       ├── 9619-9620.delta
+│       ├── 9618-9620.delta
+│       ├── 9617-9620.delta
+│       ├── 9616-9620.delta
+│       ├── 9615-9620.delta
+│       ├── 9618-9619.delta
+│       ├── 9617-9619.delta
+│       └── ...
+```
+
+## Storage Impact Analysis
+
+### Current Storage (without deltas)
+- 10 DMGs × 200MB = **~2GB**
+
+### Estimated Storage (with deltas)
+- 10 DMGs × 200MB = 2GB
+- 5 app bundles × 150MB = 0.75GB (zip compression)
+- ~25 delta files × 20MB avg = 0.5GB
+- **Total: ~3.25GB**
+
+### Trade-offs
+- **+1.25GB storage** (~60% increase)
+- **-170MB per user update** (~85% bandwidth savings)
+- Break-even: ~8 user updates to recoup storage cost
+
+## Bandwidth Savings
+
+| Scenario | Without Deltas | With Deltas | Savings |
+|----------|---------------|-------------|---------|
+| 1 version behind | 200MB | ~15MB | 92% |
+| 2 versions behind | 200MB | ~20MB | 90% |
+| 3 versions behind | 200MB | ~25MB | 87% |
+| 5 versions behind | 200MB | ~35MB | 82% |
+| 6+ versions behind | 200MB | 200MB (full) | 0% |
+
+## Migration Strategy
+
+The implementation is backward-compatible and requires no changes to existing clients:
+
+1. **First deploy after implementation:**
+   - Stores app bundle for the first time
+   - No deltas generated (no previous app bundles exist)
+   - Appcast has no `<sparkle:deltas>` element
+
+2. **Second deploy:**
+   - Generates delta from previous version
+   - Appcast now has `<sparkle:deltas>` with one entry
+   - Users on previous version get delta update
+
+3. **Subsequent deploys:**
+   - Generate deltas from last 5 versions
+   - Users within 5 versions get delta updates
+   - Users more than 5 versions behind get full DMG
+
+4. **Client behavior:**
+   - Sparkle automatically checks for matching delta
+   - Falls back to full DMG if no delta matches
+   - No client code changes required
+
+## Error Handling
+
+The implementation handles failures gracefully:
+
+1. **S3 list/download fails:** Skip delta generation, use full DMG
+2. **BinaryDelta fails for one version:** Log warning, continue with other versions
+3. **Signing fails:** Skip that delta, continue with others
+4. **Upload fails:** Skip that delta, continue with others
+
+The deploy never fails due to delta issues - deltas are optional enhancements.
+
+## Verification Plan
+
+### Manual Testing
+
+1. **Deploy version N:**
+   - Verify app bundle uploaded to `mac/apps/eagle0-N.app.zip`
+   - Verify appcast has no deltas (first deploy)
+
+2. **Deploy version N+1:**
+   - Verify delta generated at `mac/deltas/N-(N+1).delta`
+   - Verify appcast contains `<sparkle:deltas>` element
+   - Verify delta signature is valid
+
+3. **Test update from N to N+1:**
+   - Install version N manually
+   - Check for updates
+   - Monitor download size in Player.log (should be ~15-30MB, not 200MB)
+   - Verify app updated successfully
+
+4. **Test fresh install:**
+   - Download latest DMG directly
+   - Verify installation works normally
+
+5. **Test fallback scenario:**
+   - Install a version more than 5 versions behind
+   - Update should download full DMG
+
+### Automated Verification
+
+Add to CI workflow (optional):
+```yaml
+- name: Verify delta generation
+  run: |
+    # Check app bundle exists
+    aws s3 ls s3://eagle0-windows/mac/apps/ | grep eagle0-${BUILD_NUMBER}.app.zip
+
+    # Check deltas exist (after second deploy)
+    aws s3 ls s3://eagle0-windows/mac/deltas/ | head -5
+
+    # Verify appcast has deltas
+    curl -s https://assets.eagle0.net/mac/appcast.xml | grep "sparkle:deltas"
+```
+
+## Security Considerations
+
+1. **All deltas are EdDSA signed:** Same signature verification as full DMG
+2. **BinaryDelta is Sparkle's official tool:** Well-audited, production-ready
+3. **App bundles in S3 are public:** Same as DMGs, no additional exposure
+4. **Cleanup removes old artifacts:** No indefinite storage of old versions
+
+## Future Enhancements
+
+1. **Parallel delta generation:** Generate multiple deltas concurrently
+2. **Delta size threshold:** Skip uploading deltas larger than X% of full DMG
+3. **Delta metrics:** Track delta download rates vs full DMG
+4. **Configurable delta count:** Allow adjusting how many versions to keep

docs/TUTORIAL_CONTENT.md

@@ -0,0 +1,181 @@
+# Tutorial Content Guide
+
+This document defines all tutorial content. Edit this to refine the text, then update `TutorialContentDefinitions.cs` to match.
+
+---
+
+## Onboarding Sequence
+
+Shown to first-time players. Guides them through the basics of strategic and tactical gameplay.
+
+| Step | ID | Display | Trigger | Title | Description |
+|------|-----|---------|---------|-------|-------------|
+| 1 | `welcome` | Modal | Auto (game start) | Welcome to Eagle0 | Command your armies, recruit heroes, and conquer provinces in this turn-based strategy game.<br><br>Let's walk through the basics! |
+| 2 | `select_province` | Overlay | Completes on: `province_selected` | The Strategic Map | This is your kingdom. Each colored region is a province.<br><br>Tap a province you control (shown in your color) to see what you can do there. |
+| 3 | `province_panel` | Modal | Button click | Province Information | This panel shows province details: its name, terrain, any armies present, and the commands available to you.<br><br>Commands let you move troops, recruit heroes, and more. |
+| 4 | `try_march` | Overlay | Completes on: `command_issued` | Issue a Command | Try issuing a March command to move your army to an adjacent province.<br><br>Select a destination and confirm the order. |
+| 5 | `turn_cycle` | Modal | Button click | The Turn Cycle | Eagle0 uses simultaneous turns. All players give orders at the same time, then turns resolve together.<br><br>When all players are ready, the server processes everyone's commands and shows the results. |
+| 6 | `wait_for_battle` | Hidden | Completes on: `first_battle_available` | *(none)* | *(Invisible step - waits for a battle to become available)* |
+| 7 | `battle_intro` | Modal | Button click | Battle Time! | When armies collide, you'll fight tactical battles on a hex grid.<br><br>You command individual units - infantry, cavalry, archers, and heroes with special abilities. |
+| 8 | `enter_battle` | Overlay | Completes on: `battle_entered` | Enter the Battle | Tap the Battle button to enter tactical combat. |
+| 9 | `tactical_overview` | Modal | Button click | Tactical Combat | Each unit has movement points and attack power. Position your troops wisely!<br><br>Units attack adjacent enemies. Flanking (attacking from multiple sides) deals bonus damage. |
+| 10 | `move_unit` | Overlay | Completes on: `battle_action` | Move Your Units | Tap one of your units to select it, then tap a highlighted hex to move there.<br><br>Blue hexes show where you can move. |
+| 11 | `attack_enemy` | Overlay | Completes on: `battle_action` | Attack! | Move next to an enemy unit, then tap the enemy to attack.<br><br>Red highlights show valid attack targets. |
+| 12 | `end_turn` | Overlay | Completes on: `turn_ended` | End Your Turn | When you've moved all units or want to pass, tap End Turn.<br><br>The enemy will then take their turn. |
+| 13 | `complete` | Modal | Button click (no skip) | You're Ready! | You now know the basics of Eagle0!<br><br>Explore diplomacy, recruit powerful heroes, and conquer the realm. Good luck, commander! |
+
+### Notes on Onboarding Flow
+
+- Steps 1-5 cover strategic gameplay
+- Step 6 is invisible - just waits for a battle
+- Steps 7-12 cover tactical combat
+- Step 13 celebrates completion
+
+**Questions to consider:**
+- Should we skip tactical tutorial if player skips to first battle themselves?
+- Should there be a "skip all" option visible from step 1?
+- Is the step order correct for typical first-game flow?
+
+---
+
+## Strategic Contextual Tutorials
+
+Triggered when players encounter features for the first time.
+
+### Diplomacy Introduction
+| Field | Value |
+|-------|-------|
+| ID | `diplomacy_intro` |
+| Trigger | `diplomacy_available` (diplomacy commands appear) |
+| Display | Modal |
+| Title | Diplomacy |
+| Description | You can negotiate with other factions!<br><br>Offer alliances, declare war, or propose tribute. Your diplomatic choices shape the realm. |
+
+### Hero Recruitment
+| Field | Value |
+|-------|-------|
+| ID | `hero_recruitment` |
+| Trigger | `hero_recruitment_available` (free heroes detected) |
+| Display | Modal |
+| Title | Heroes Available |
+| Description | Free heroes wander the realm seeking a lord to serve.<br><br>Recruit them to lead your armies! Heroes have unique abilities and grow stronger with experience. |
+
+### Weather Control
+| Field | Value |
+|-------|-------|
+| ID | `weather_control` |
+| Trigger | `weather_control_available` (weather command appears) |
+| Display | Overlay |
+| Title | Weather Magic |
+| Description | Your mages can influence the weather!<br><br>Rain slows movement, storms disrupt enemies, and clear skies speed your march. |
+
+### Prisoner Management
+| Field | Value |
+|-------|-------|
+| ID | `prisoner_management` |
+| Trigger | `prisoner_command_issued` (player uses prisoner command) |
+| Display | Modal |
+| Title | Prisoners Captured |
+| Description | You've captured enemy soldiers!<br><br>You can ransom them for gold, recruit them into your army, or execute them as a warning. |
+
+---
+
+## Tactical Contextual Tutorials
+
+Triggered during battles when players encounter spells, terrain, or abilities.
+
+### Lightning Bolt Spell
+| Field | Value |
+|-------|-------|
+| ID | `spell_lightning` |
+| Trigger | `spell_lightning_available` |
+| Display | Tooltip |
+| Title | Lightning Bolt |
+| Description | Your mage can cast Lightning Bolt!<br><br>This spell strikes a single target for heavy damage. Great for eliminating key enemy units. |
+
+### Meteor Strike Spell
+| Field | Value |
+|-------|-------|
+| ID | `spell_meteor` |
+| Trigger | `spell_meteor_available` |
+| Display | Modal |
+| Title | Meteor Strike |
+| Description | Meteor is a devastating area spell!<br><br>It takes a turn to cast: first select target, then it lands next turn. Plan ahead! |
+
+### Holy Wave Spell
+| Field | Value |
+|-------|-------|
+| ID | `spell_holywave` |
+| Trigger | `spell_holywave_available` |
+| Display | Tooltip |
+| Title | Holy Wave |
+| Description | Holy Wave heals your units and damages undead!<br><br>Position your troops carefully to maximize its effect. |
+
+### Raise Dead Spell
+| Field | Value |
+|-------|-------|
+| ID | `spell_raisedead` |
+| Trigger | `spell_raisedead_available` |
+| Display | Modal |
+| Title | Raise Dead |
+| Description | Dark magic can raise fallen soldiers as undead!<br><br>They fight for you, but beware - they may crumble if your necromancer falls. |
+
+### Fire Terrain
+| Field | Value |
+|-------|-------|
+| ID | `terrain_fire` |
+| Trigger | `terrain_fire_encountered` (fire damage occurs) |
+| Display | Tooltip |
+| Title | Fire Hazard |
+| Description | Fire spreads across the battlefield!<br><br>Units in burning hexes take damage. Use fire to block enemy routes or avoid it yourself. |
+
+### Water Crossing
+| Field | Value |
+|-------|-------|
+| ID | `terrain_water` |
+| Trigger | `terrain_water_encountered` (water crossing attempted) |
+| Display | Tooltip |
+| Title | Water Crossing |
+| Description | Units can cross shallow water, but it's risky.<br><br>Crossing takes extra movement and may fail. Some units swim better than others. |
+
+### Cavalry Charge
+| Field | Value |
+|-------|-------|
+| ID | `ability_charge` |
+| Trigger | `ability_charge_available` |
+| Display | Overlay |
+| Title | Cavalry Charge |
+| Description | Your cavalry can Charge!<br><br>Charging deals bonus damage based on distance traveled. Use open terrain for maximum impact. |
+
+---
+
+## Display Modes
+
+| Mode | Description | Use For |
+|------|-------------|---------|
+| **Modal** | Full popup with dimmed background, blocks interaction | Important concepts, multi-paragraph explanations |
+| **Overlay** | Semi-transparent overlay, can highlight UI elements | Guiding player to interact with specific UI |
+| **Tooltip** | Small popup near target element | Quick tips, less important info |
+| **Hint** | Pulsing dot indicator only | Subtle suggestions |
+| **None** | Invisible, just waits for event | Transition steps |
+
+---
+
+## Adding New Tutorials
+
+1. Add entry to this document
+2. Update `TutorialContentDefinitions.cs`:
+   - For onboarding: add to `CreateOnboardingSequence()`
+   - For contextual: add to `RegisterStrategicTutorials()` or `RegisterTacticalTutorials()`
+3. Ensure trigger event exists in `TutorialTriggerRegistry.cs`
+4. Test the flow
+
+---
+
+## Content Guidelines
+
+- Keep descriptions to 2-3 short paragraphs max
+- Use `<br><br>` for paragraph breaks (renders as newlines in Unity)
+- Avoid jargon - explain game terms when first introduced
+- Be encouraging, not condescending
+- Focus on "what to do" not exhaustive "how it works"

external/BUILD.sparkle

@@ -0,0 +1,8 @@
+load("@build_bazel_rules_apple//apple:apple.bzl", "apple_dynamic_framework_import")
+
+# Import pre-built Sparkle framework
+apple_dynamic_framework_import(
+    name = "Sparkle",
+    framework_imports = glob(["Sparkle.framework/**"]),
+    visibility = ["//visibility:public"],
+)

nginx/nginx.conf

@@ -3,6 +3,9 @@ events {
 }
 
 http {
+    # Allow large request bodies for game uploads (default is 1MB)
+    client_max_body_size 50M;
+
     # Logging
     log_format grpc_json escape=json '{'
         '"time":"$time_iso8601",'
@@ -24,11 +27,10 @@ http {
     # This prevents stale IP caching when containers restart
     resolver 127.0.0.11 valid=10s ipv6=off;
 
-    # Eagle backend address - configured via variable for blue-green deployments
-    # Using a variable makes nginx resolve the hostname at request time, not config load time
-    # This allows nginx to reload even when the backend is temporarily down
-    # For blue-green deployments, this is switched between eagle-blue:40032 and eagle-green:40032
-    # by scripts/deploy-blue-green.sh, then nginx is reloaded with 'nginx -s reload'
+    # Eagle backend - blue-green deployment with variable-based routing
+    # Uses a variable so nginx only resolves the configured backend (not all backends).
+    # This allows nginx to start/reload even when the inactive backend is stopped.
+    # The deploy script updates this map, then recreates nginx.
     map $host $eagle_backend {
         default "eagle-blue:40032";
     }
@@ -74,7 +76,7 @@ http {
             # Rate limiting
             limit_req zone=grpc_limit burst=50 nodelay;
 
-            # gRPC proxy - uses variable for blue-green deployment support
+            # gRPC proxy - uses variable for blue-green deployment
             grpc_pass grpc://$eagle_backend;
 
             # Timeouts for long-running streams
@@ -86,13 +88,14 @@ http {
             error_page 502 = /error502grpc;
         }
 
-        # gRPC proxy for Auth service
+        # gRPC proxy for Auth service (routes to Go auth service, not Eagle)
         location /net.eagle0.eagle.api.auth.Auth {
             # Rate limiting
             limit_req zone=grpc_limit burst=50 nodelay;
 
-            # gRPC proxy - uses variable for blue-green deployment support
-            grpc_pass grpc://$eagle_backend;
+            # Route to auth service directly (not through Eagle)
+            set $auth_backend "auth:40033";
+            grpc_pass grpc://$auth_backend;
 
             # Timeouts
             grpc_read_timeout 30s;
@@ -109,6 +112,20 @@ http {
             proxy_set_header X-Real-IP $remote_addr;
         }
 
+        # Apple OAuth callback (Apple uses POST with form_post response mode)
+        location /oauth/apple/callback {
+            proxy_pass http://auth:8080;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+        }
+
+        # Steam OAuth callback (Steam uses OpenID 2.0)
+        location /oauth/steam/callback {
+            proxy_pass http://auth:8080;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+        }
+
         # Invitation landing page (proxied to Go auth service)
         location /invite/ {
             proxy_pass http://auth:8080;

scripts/build_deps_baseline.txt

@@ -0,0 +1,3 @@
+# BUILD dependency baseline - updated Tue Jan 20 21:22:24 PST 2026
+# Do not increase these numbers - only decrease!
+library_proto_deps=26

scripts/build_mac_plugin.sh

@@ -8,3 +8,6 @@ ZIP_LOCATION=$(bazel cquery --config=mactools --output=files @net_eagle0_unity_g
 /usr/bin/unzip -o $ZIP_LOCATION -d src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Plugins/
 
 /usr/bin/plutil -convert xml1 src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Plugins/DarwinGodiceBundle.bundle/Contents/Info.plist
+
+/bin/echo "building sparkle plugin"
+./scripts/build_sparkle_plugin.sh

scripts/build_sparkle_plugin.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+#
+# Build the SparklePlugin native library for Unity using Bazel
+#
+# Usage: build_sparkle_plugin.sh [output_dir]
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+OUTPUT_DIR="${1:-$PROJECT_ROOT/src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/Plugins/macOS}"
+
+echo "=== Building SparklePlugin with Bazel ==="
+
+bazel build --config=mactools //src/main/objc/net/eagle0/sparkle:SparklePlugin
+
+# Get the zip path from bazel
+ZIP_PATH=$(bazel cquery --config=mactools --output=files //src/main/objc/net/eagle0/sparkle:SparklePlugin 2>/dev/null)
+
+echo "=== Extracting SparklePlugin.bundle ==="
+mkdir -p "$OUTPUT_DIR"
+rm -rf "$OUTPUT_DIR/SparklePlugin.bundle"
+unzip -o "$ZIP_PATH" -d "$OUTPUT_DIR/"
+
+# Convert Info.plist from binary to XML format (Unity requires XML)
+/usr/bin/plutil -convert xml1 "$OUTPUT_DIR/SparklePlugin.bundle/Contents/Info.plist"
+
+echo "=== SparklePlugin built successfully ==="
+ls -la "$OUTPUT_DIR/SparklePlugin.bundle/"

scripts/check_build_deps.sh

@@ -0,0 +1,182 @@
+#!/bin/bash
+# Check BUILD.bazel dependency constraints
+# This script enforces architectural boundaries in the codebase.
+#
+# Usage:
+#   ./scripts/check_build_deps.sh           # Check all rules
+#   ./scripts/check_build_deps.sh --ci      # CI mode (fail on any violation)
+#   ./scripts/check_build_deps.sh --count   # Just count current violations (for tracking progress)
+#   ./scripts/check_build_deps.sh --strict  # Fail if proto deps in library/ exceed baseline
+#
+# The baseline for proto deps is stored in scripts/build_deps_baseline.txt
+# Update it with: ./scripts/check_build_deps.sh --update-baseline
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+BASELINE_FILE="$SCRIPT_DIR/build_deps_baseline.txt"
+cd "$REPO_ROOT"
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+MODE="${1:-check}"
+EXIT_CODE=0
+
+# Get baseline proto count (default to a high number if no baseline exists)
+get_baseline() {
+    if [ -f "$BASELINE_FILE" ]; then
+        grep "^library_proto_deps=" "$BASELINE_FILE" | cut -d= -f2
+    else
+        echo "999999"  # No baseline = don't fail
+    fi
+}
+
+# Rule 1: src/main should not depend on src/test
+check_main_depends_on_test() {
+    echo -e "${YELLOW}Checking: src/main should not depend on src/test...${NC}"
+
+    violations=$(bazel query 'deps(//src/main/...) intersect //src/test/...' 2>/dev/null || true)
+
+    if [ -n "$violations" ]; then
+        echo -e "${RED}VIOLATION: src/main depends on src/test:${NC}"
+        echo "$violations"
+        return 1
+    else
+        echo -e "${GREEN}✓ No violations${NC}"
+        return 0
+    fi
+}
+
+# Rule 2: library/ should not depend on src/main/protobuf
+# Note: This rule is aspirational - there are currently many violations as part of ongoing deproto effort
+check_library_depends_on_proto() {
+    echo -e "${YELLOW}Checking: library/ should not depend on src/main/protobuf...${NC}"
+
+    violations=$(bazel query 'deps(//src/main/scala/net/eagle0/eagle/library/...) intersect //src/main/protobuf/...' 2>/dev/null || true)
+    count=$(echo "$violations" | grep -c "^//" || echo "0")
+
+    if [ "$count" -gt 0 ]; then
+        echo -e "${YELLOW}Found $count proto dependencies in library/ (deproto in progress)${NC}"
+        if [ "$MODE" == "--count" ]; then
+            echo "$violations" | head -20
+            if [ "$count" -gt 20 ]; then
+                echo "... and $((count - 20)) more"
+            fi
+        fi
+        # Don't fail on this rule yet - it's aspirational
+        return 0
+    else
+        echo -e "${GREEN}✓ No proto dependencies in library/${NC}"
+        return 0
+    fi
+}
+
+# Rule 3: library/ should not depend on proto_converters
+# Proto conversions should happen at service boundaries, not in library code
+check_library_depends_on_proto_converters() {
+    echo -e "${YELLOW}Checking: library/ should not depend on proto_converters...${NC}"
+
+    violations=$(bazel query 'deps(//src/main/scala/net/eagle0/eagle/library/...) intersect //src/main/scala/net/eagle0/eagle/model/proto_converters/...' 2>/dev/null | grep "^//" || true)
+
+    if [ -n "$violations" ]; then
+        count=$(echo "$violations" | wc -l | tr -d ' ')
+        echo -e "${RED}VIOLATION: library/ depends on $count proto_converters targets:${NC}"
+        echo "$violations"
+        echo ""
+        echo "Proto conversions should happen at service boundaries (ShardokInterfaceGrpcClient,"
+        echo "EagleServiceImpl, etc.), not in library code."
+        return 1
+    else
+        echo -e "${GREEN}✓ No proto_converters dependencies in library/${NC}"
+        return 0
+    fi
+}
+
+# Count proto deps for tracking deproto progress
+count_proto_deps() {
+    echo -e "${YELLOW}=== Proto dependency counts ===${NC}"
+
+    library_count=$(bazel query 'deps(//src/main/scala/net/eagle0/eagle/library/...) intersect //src/main/protobuf/...' 2>/dev/null | grep -c "^//" || echo "0")
+    echo "library/: $library_count proto dependencies"
+
+    baseline=$(get_baseline)
+    if [ "$baseline" != "999999" ]; then
+        echo "baseline: $baseline"
+        if [ "$library_count" -lt "$baseline" ]; then
+            echo -e "${GREEN}↓ Reduced by $((baseline - library_count)) from baseline${NC}"
+        elif [ "$library_count" -gt "$baseline" ]; then
+            echo -e "${RED}↑ Increased by $((library_count - baseline)) from baseline${NC}"
+        fi
+    fi
+}
+
+# Check if proto deps exceed baseline (for strict mode)
+check_proto_baseline() {
+    library_count=$(bazel query 'deps(//src/main/scala/net/eagle0/eagle/library/...) intersect //src/main/protobuf/...' 2>/dev/null | grep -c "^//" || echo "0")
+    baseline=$(get_baseline)
+
+    echo -e "${YELLOW}Checking: proto deps in library/ should not exceed baseline...${NC}"
+    echo "Current: $library_count, Baseline: $baseline"
+
+    if [ "$library_count" -gt "$baseline" ]; then
+        echo -e "${RED}VIOLATION: Proto dependencies increased from $baseline to $library_count${NC}"
+        echo "Run './scripts/check_build_deps.sh --count' to see which protos are used"
+        return 1
+    else
+        echo -e "${GREEN}✓ Proto deps at or below baseline${NC}"
+        return 0
+    fi
+}
+
+# Update baseline file
+update_baseline() {
+    library_count=$(bazel query 'deps(//src/main/scala/net/eagle0/eagle/library/...) intersect //src/main/protobuf/...' 2>/dev/null | grep -c "^//" || echo "0")
+
+    echo "# BUILD dependency baseline - updated $(date)" > "$BASELINE_FILE"
+    echo "# Do not increase these numbers - only decrease!" >> "$BASELINE_FILE"
+    echo "library_proto_deps=$library_count" >> "$BASELINE_FILE"
+
+    echo -e "${GREEN}Updated baseline: library_proto_deps=$library_count${NC}"
+}
+
+echo "=== BUILD.bazel Dependency Check ==="
+echo ""
+
+case "$MODE" in
+    --count)
+        count_proto_deps
+        ;;
+    --ci)
+        check_main_depends_on_test || EXIT_CODE=1
+        check_library_depends_on_proto || EXIT_CODE=1
+        check_library_depends_on_proto_converters || EXIT_CODE=1
+        ;;
+    --strict)
+        check_main_depends_on_test || EXIT_CODE=1
+        check_proto_baseline || EXIT_CODE=1
+        check_library_depends_on_proto_converters || EXIT_CODE=1
+        ;;
+    --update-baseline)
+        update_baseline
+        ;;
+    *)
+        check_main_depends_on_test || EXIT_CODE=1
+        check_library_depends_on_proto
+        check_library_depends_on_proto_converters || EXIT_CODE=1
+        echo ""
+        count_proto_deps
+        ;;
+esac
+
+echo ""
+if [ $EXIT_CODE -eq 0 ]; then
+    echo -e "${GREEN}=== All checks passed ===${NC}"
+else
+    echo -e "${RED}=== Some checks failed ===${NC}"
+fi
+
+exit $EXIT_CODE

scripts/codesign_mac_app.sh

@@ -39,32 +39,51 @@ find "$APP_PATH" -name "*.bundle" -print0 | while IFS= read -r -d '' item; do
         --sign "$SIGNING_IDENTITY" "$item"
 done
 
-# Sign XPC services (inside Sparkle framework)
+# Sign XPC services (but skip ones inside Sparkle.framework - they're already signed)
 find "$APP_PATH" -name "*.xpc" -print0 | while IFS= read -r -d '' item; do
+    if [[ "$item" == *"Sparkle.framework"* ]]; then
+        echo "Skipping Sparkle XPC service (pre-signed): $item"
+        continue
+    fi
     echo "Signing XPC service: $item"
     codesign --force --verify --verbose --timestamp --options runtime \
         --sign "$SIGNING_IDENTITY" "$item"
 done
 
-# Sign nested apps (like Sparkle's Updater.app)
+# Sign nested apps (but skip ones inside Sparkle.framework - they're already signed)
 find "$APP_PATH" -path "*/Frameworks/*.app" -print0 | while IFS= read -r -d '' item; do
+    if [[ "$item" == *"Sparkle.framework"* ]]; then
+        echo "Skipping Sparkle nested app (pre-signed): $item"
+        continue
+    fi
     echo "Signing nested app: $item"
     codesign --force --verify --verbose --timestamp --options runtime \
         --sign "$SIGNING_IDENTITY" "$item"
 done
 
-# Sign standalone executables inside frameworks (like Autoupdate)
+# Sign standalone executables inside frameworks (but skip Sparkle.framework internals)
 find "$APP_PATH" -path "*/Frameworks/*/Versions/*/Autoupdate" -type f -print0 | while IFS= read -r -d '' item; do
+    if [[ "$item" == *"Sparkle.framework"* ]]; then
+        echo "Skipping Sparkle executable (pre-signed): $item"
+        continue
+    fi
     echo "Signing executable: $item"
     codesign --force --verify --verbose --timestamp --options runtime \
         --sign "$SIGNING_IDENTITY" "$item"
 done
 
 # Sign all frameworks (after their contents are signed)
+# Use --deep for Sparkle.framework to handle its XPC services
 find "$APP_PATH" -name "*.framework" -print0 | while IFS= read -r -d '' item; do
-    echo "Signing framework: $item"
-    codesign --force --verify --verbose --timestamp --options runtime \
-        --sign "$SIGNING_IDENTITY" "$item"
+    if [[ "$item" == *"Sparkle.framework" ]]; then
+        echo "Signing Sparkle framework with --deep: $item"
+        codesign --deep --force --verify --verbose --timestamp --options runtime \
+            --sign "$SIGNING_IDENTITY" "$item"
+    else
+        echo "Signing framework: $item"
+        codesign --force --verify --verbose --timestamp --options runtime \
+            --sign "$SIGNING_IDENTITY" "$item"
+    fi
 done
 
 echo "=== Signing main app bundle ==="

scripts/deploy-blue-green.sh

@@ -2,14 +2,21 @@
 #
 # Blue-Green Deployment Script for Eagle Server
 #
-# This script performs a zero-downtime deployment by:
-# 1. Starting the new version on a staging port (green)
-# 2. Waiting for it to become healthy
-# 3. Running warmup traffic to pre-heat the JIT
-# 4. Stopping the old version (blue) - which flushes state to disk
-# 5. Telling green to reload games from disk
-# 6. Switching nginx to route traffic to green
-# 7. Cleaning up
+# This script performs a zero-downtime deployment with state consistency:
+# 1. Create .deployment_in_progress marker (signals deployment started)
+# 2. Start the staging instance (green) with new image
+# 3. Run warmup/smoke tests against staging (warms JIT)
+# 4. Switch nginx to staging (zero downtime - users immediately route to staging)
+# 5. Stop the active instance (blue) - blocks until flush completes
+# 6. Create .flush_complete marker (signals disk state is fresh)
+#
+# The flush marker coordination ensures green never serves stale game data:
+# - When users reconnect to green and trigger lazy-load, the code checks for markers
+# - If .deployment_in_progress exists, lazy-load WAITS for .flush_complete
+# - Once blue's flush completes and marker is created, lazy-load proceeds with fresh data
+#
+# Key insight: nginx switches to green BEFORE blue stops, achieving zero downtime.
+# Users who trigger lazy-load during blue's shutdown will wait for the flush marker.
 #
 # Usage: ./deploy-blue-green.sh [NEW_IMAGE_TAG]
 #
@@ -25,6 +32,9 @@ APP_DIR="${APP_DIR:-/opt/eagle0}"
 NGINX_CONF="${APP_DIR}/nginx/nginx.conf"
 COMPOSE_FILE="${APP_DIR}/docker-compose.prod.yml"
 WARMUP_SCRIPT="${SCRIPT_DIR}/warmup-eagle.sh"
+SAVES_DIR="${APP_DIR}/saves"
+FLUSH_MARKER="${SAVES_DIR}/.flush_complete"
+DEPLOYMENT_IN_PROGRESS="${SAVES_DIR}/.deployment_in_progress"
 
 # Colors for output
 RED='\033[0;31m'
@@ -36,15 +46,57 @@ log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
 log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
 log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
 
-# Determine which instance is currently active
-get_active_instance() {
-    if grep -q "eagle-blue:40032" "${NGINX_CONF}"; then
+# Marker file operations use docker exec because saves directory is owned by root (Docker).
+# We run commands inside a container that has the saves directory mounted.
+create_deployment_marker() {
+    local deploy_id=$1
+    local container=$2  # Container to use for file operations
+    docker exec "${container}" rm -f /app/saves/.flush_complete
+    docker exec "${container}" sh -c "echo '${deploy_id}' > /app/saves/.deployment_in_progress"
+}
+
+create_flush_marker() {
+    local deploy_id=$1
+    local container=$2  # Container to use for file operations
+    docker exec "${container}" sh -c "echo '${deploy_id}' > /app/saves/.flush_complete"
+    docker exec "${container}" rm -f /app/saves/.deployment_in_progress
+}
+
+cleanup_markers_on_failure() {
+    local container=$1  # Container to use for file operations
+    docker exec "${container}" rm -f /app/saves/.deployment_in_progress 2>/dev/null || true
+    docker exec "${container}" touch /app/saves/.flush_complete 2>/dev/null || true
+}
+
+remove_stale_deployment_marker() {
+    # Try any running eagle container
+    local container
+    container=$(docker ps --filter "name=eagle-" --format "{{.Names}}" | head -1)
+    if [ -n "${container}" ]; then
+        docker exec "${container}" rm -f /app/saves/.deployment_in_progress 2>/dev/null || true
+    fi
+}
+
+# Determine which instance is currently running (not from nginx config)
+get_running_instance() {
+    local blue_running green_running
+    blue_running=$(docker inspect --format='{{.State.Running}}' eagle-blue 2>/dev/null || echo "false")
+    green_running=$(docker inspect --format='{{.State.Running}}' eagle-green 2>/dev/null || echo "false")
+
+    if [ "$blue_running" = "true" ] && [ "$green_running" = "true" ]; then
+        # Both running - use nginx config to determine primary
+        if grep -q "server eagle-blue:40032;" "${NGINX_CONF}" | head -1 | grep -qv backup; then
+            echo "blue"
+        else
+            echo "green"
+        fi
+    elif [ "$blue_running" = "true" ]; then
         echo "blue"
-    elif grep -q "eagle-green:40032" "${NGINX_CONF}"; then
+    elif [ "$green_running" = "true" ]; then
         echo "green"
     else
-        log_error "Cannot determine active instance from nginx config"
-        exit 1
+        # Neither running - default to blue (first deploy or recovery)
+        echo "none"
     fi
 }
 
@@ -54,6 +106,12 @@ pull_with_retry() {
     local max_attempts=${2:-3}
     local attempt=1
 
+    # Skip pull if image already exists locally (e.g., CI already pulled it)
+    if docker image inspect "${image}" &>/dev/null; then
+        log_info "Image ${image} already exists locally, skipping pull"
+        return 0
+    fi
+
     # Use crane if available (handles OCI format correctly)
     if [ -x "${APP_DIR}/crane" ]; then
         while [ $attempt -le $max_attempts ]; do
@@ -114,46 +172,63 @@ main() {
     local registry="registry.digitalocean.com/eagle0/eagle-server"
     local new_image="${registry}:${new_tag}"
 
+    # Generate deployment ID for log correlation with server logs
+    local deploy_id
+    deploy_id=$(date +%s)
+    local deploy_start_time=$deploy_id
+
+    log_info "========================================="
     log_info "Starting blue-green deployment"
+    log_info "Deployment ID: ${deploy_id}"
     log_info "New image: ${new_image}"
+    log_info "========================================="
 
     cd "${APP_DIR}"
 
-    # Determine current active instance
-    local active=$(get_active_instance)
+    # Determine current active instance (need this before creating marker)
+    local active=$(get_running_instance)
     local staging
-    if [ "$active" = "blue" ]; then
+    if [ "$active" = "blue" ] || [ "$active" = "none" ]; then
         staging="green"
+        active="blue"  # Normalize "none" to "blue" for first deploy
     else
         staging="blue"
     fi
 
-    log_info "Active instance: eagle-${active}"
-    log_info "Staging instance: eagle-${staging}"
+    # Step 1: Signal deployment in progress
+    log_info "[DEPLOY:${deploy_id}] Step 1: Signaling deployment in progress..."
+    # Use active container for marker operations (it's the one currently running)
+    if [ "$active" != "none" ] && docker ps --filter "name=eagle-${active}" --format "{{.Names}}" | grep -q .; then
+        create_deployment_marker "${deploy_id}" "eagle-${active}"
+        log_info "[DEPLOY:${deploy_id}] Deployment marker created via eagle-${active}"
+    else
+        log_warn "[DEPLOY:${deploy_id}] No running container to create marker (first deploy?)"
+    fi
 
     # Pull the new image (with retry for intermittent registry issues)
     if ! pull_with_retry "${new_image}" 3; then
         log_error "Failed to pull new image, aborting deployment"
+        cleanup_markers_on_failure "eagle-${active}"
         exit 1
     fi
 
-    # Start staging instance with new image
-    log_info "Starting eagle-${staging} with new image..."
+    # Step 2: Start staging instance with new image
+    log_info "Step 2: Starting eagle-${staging} with new image..."
     if [ "$staging" = "green" ]; then
-        EAGLE_IMAGE_NEW="${new_image}" docker compose -f "${COMPOSE_FILE}" --profile blue-green up -d eagle-green
+        EAGLE_IMAGE_NEW="${new_image}" docker compose -f "${COMPOSE_FILE}" --profile blue-green up -d eagle-green jfr-sidecar-green
     else
-        EAGLE_IMAGE="${new_image}" docker compose -f "${COMPOSE_FILE}" up -d eagle-blue
+        EAGLE_IMAGE="${new_image}" docker compose -f "${COMPOSE_FILE}" up -d eagle-blue jfr-sidecar
     fi
 
     # Wait for staging to be healthy
     if ! wait_for_healthy "eagle-${staging}" 90; then
         log_error "Staging instance failed health check, aborting deployment"
         docker compose -f "${COMPOSE_FILE}" stop "eagle-${staging}"
-        docker compose -f "${COMPOSE_FILE}" rm -f "eagle-${staging}"
+        cleanup_markers_on_failure "eagle-${active}"
         exit 1
     fi
 
-    # Run warmup/smoke test
+    # Step 3: Run warmup/smoke test
     local staging_port
     if [ "$staging" = "green" ]; then
         staging_port=40034
@@ -161,12 +236,12 @@ main() {
         staging_port=40032
     fi
 
-    log_info "Running warmup against eagle-${staging}..."
+    log_info "Step 3: Running warmup against eagle-${staging}..."
     if [ -x "${WARMUP_SCRIPT}" ]; then
         if ! "${WARMUP_SCRIPT}" "localhost:${staging_port}"; then
             log_error "Warmup/smoke test failed, aborting deployment"
             docker compose -f "${COMPOSE_FILE}" stop "eagle-${staging}"
-            docker compose -f "${COMPOSE_FILE}" rm -f "eagle-${staging}"
+            cleanup_markers_on_failure "eagle-${active}"
             exit 1
         fi
     else
@@ -174,49 +249,100 @@ main() {
         log_warn "JIT will be cold on first requests"
     fi
 
-    # Stop the active instance (this flushes state to disk)
-    log_info "Stopping eagle-${active} (flushing state to disk)..."
-    docker compose -f "${COMPOSE_FILE}" stop "eagle-${active}"
+    # Step 4: Switch nginx to staging BEFORE stopping active
+    # This achieves zero downtime - users immediately route to staging.
+    # Any lazy-loads will wait for the flush marker (created in step 6).
+    local nginx_switch_start
+    nginx_switch_start=$(date +%s)
+    log_info "[DEPLOY:${deploy_id}] Step 4: Switching nginx to eagle-${staging}..."
 
-    # Tell staging to reload games from disk
-    log_info "Telling eagle-${staging} to reload games from disk..."
-    if command -v grpcurl &> /dev/null; then
-        grpcurl -plaintext -d '{}' "localhost:${staging_port}" net.eagle0.eagle.api.Eagle/ReloadGames || true
-    else
-        log_warn "grpcurl not installed, skipping game reload"
-        log_warn "New instance will use games loaded at startup"
-    fi
-
-    # Switch nginx upstream
-    log_info "Switching nginx upstream to eagle-${staging}..."
+    # Update nginx config (variable-based routing)
     if [ "$staging" = "green" ]; then
         sed -i.bak 's/eagle-blue:40032/eagle-green:40032/g' "${NGINX_CONF}"
     else
         sed -i.bak 's/eagle-green:40032/eagle-blue:40032/g' "${NGINX_CONF}"
     fi
 
-    # Reload nginx
-    log_info "Reloading nginx..."
-    docker compose -f "${COMPOSE_FILE}" exec nginx nginx -s reload
+    # Recreate nginx to pick up new config
+    # Use --no-deps to prevent cascading to auth (which has secrets not available here)
+    docker compose -f "${COMPOSE_FILE}" up -d --force-recreate --no-deps nginx
 
-    # Clean up old instance
-    log_info "Removing old eagle-${active} container..."
-    docker compose -f "${COMPOSE_FILE}" rm -f "eagle-${active}"
-
-    # Update the staging instance's restart policy and image var
-    # For blue, we need to update EAGLE_IMAGE; for green, update EAGLE_IMAGE_NEW
-    if [ "$staging" = "blue" ]; then
-        log_info "Updating EAGLE_IMAGE to ${new_image} for future restarts"
-        # User should update their .env file
+    # Verify nginx picked up the correct config
+    local nginx_backend
+    nginx_backend=$(docker exec nginx grep -o 'eagle-[a-z]*:40032' /etc/nginx/nginx.conf | head -1 || echo "unknown")
+    if [ "$nginx_backend" = "eagle-${staging}:40032" ]; then
+        log_info "[DEPLOY:${deploy_id}] Verified: nginx routing to eagle-${staging}"
     else
-        log_info "Green is now active. Consider switching to blue on next deployment."
+        log_error "[DEPLOY:${deploy_id}] nginx config mismatch! Expected eagle-${staging}:40032, got ${nginx_backend}"
+        exit 1
+    fi
+    log_info "[DEPLOY:${deploy_id}] Traffic switched to eagle-${staging} (lazy-loads will wait for flush marker)"
+    local nginx_switch_end
+    nginx_switch_end=$(date +%s)
+
+    # Step 5: Stop active instance (blocks until exit, ensuring flush completes)
+    # Users may be lazy-loading on staging during this time - they'll wait for the marker.
+    local flush_start
+    flush_start=$(date +%s)
+    log_info "[DEPLOY:${deploy_id}] Step 5: Stopping eagle-${active} (waiting for flush)..."
+    docker compose -f "${COMPOSE_FILE}" stop "eagle-${active}"
+    local flush_end
+    flush_end=$(date +%s)
+    local flush_duration=$((flush_end - flush_start))
+    log_info "[DEPLOY:${deploy_id}] eagle-${active} stopped, flush completed in ${flush_duration}s"
+
+    # Step 6: Create flush marker - signals that disk state is fresh
+    # Any waiting lazy-loads on staging will now proceed with fresh data.
+    # The Eagle server automatically detects the flush marker update and invalidates any stale cached games.
+    log_info "[DEPLOY:${deploy_id}] Step 6: Creating flush marker..."
+    create_flush_marker "${deploy_id}" "eagle-${staging}"
+    log_info "[DEPLOY:${deploy_id}] Flush marker created - server will auto-invalidate stale cache"
+
+    # Update .env for admin service
+    local env_file="${APP_DIR}/.env"
+    if [ "$staging" = "green" ]; then
+        log_info "Updating .env for green instance..."
+        sed -i.bak '/^EAGLE_ADDR=/d; /^JFR_SIDECAR_ADDR=/d' "${env_file}" 2>/dev/null || true
+        echo "EAGLE_ADDR=eagle-green:40032" >> "${env_file}"
+        echo "JFR_SIDECAR_ADDR=jfr-sidecar-green:8081" >> "${env_file}"
+    else
+        log_info "Updating .env for blue instance..."
+        sed -i.bak '/^EAGLE_ADDR=/d; /^JFR_SIDECAR_ADDR=/d' "${env_file}" 2>/dev/null || true
+        echo "EAGLE_ADDR=eagle-blue:40032" >> "${env_file}"
+        echo "JFR_SIDECAR_ADDR=jfr-sidecar:8081" >> "${env_file}"
     fi
 
-    log_info "Deployment complete!"
-    log_info "Active instance: eagle-${staging}"
+    # Restart admin to pick up new .env
+    # Use --no-deps to prevent cascading to auth (which has secrets not available here)
+    log_info "Restarting admin service..."
+    docker compose -f "${COMPOSE_FILE}" up -d --force-recreate --no-deps admin
+
+    # Clean up old instance
+    log_info "Cleaning up old eagle-${active}..."
+    docker compose -f "${COMPOSE_FILE}" rm -f "eagle-${active}" 2>/dev/null || true
+
+    # Stop the old jfr-sidecar (it can't attach to removed container anyway)
+    if [ "$active" = "green" ]; then
+        docker compose -f "${COMPOSE_FILE}" stop "jfr-sidecar-green" 2>/dev/null || true
+        docker compose -f "${COMPOSE_FILE}" rm -f "jfr-sidecar-green" 2>/dev/null || true
+    else
+        docker compose -f "${COMPOSE_FILE}" stop "jfr-sidecar" 2>/dev/null || true
+        docker compose -f "${COMPOSE_FILE}" rm -f "jfr-sidecar" 2>/dev/null || true
+    fi
+
+    local deploy_end_time
+    deploy_end_time=$(date +%s)
+    local total_duration=$((deploy_end_time - deploy_start_time))
+    local user_wait_window=$((flush_end - nginx_switch_end))
+
     log_info ""
-    log_info "Note: Update your .env file with EAGLE_IMAGE=${new_image}"
-    log_info "      if you want future 'docker compose up' to use this version."
+    log_info "========================================="
+    log_info "[DEPLOY:${deploy_id}] Deployment complete!"
+    log_info "  Active instance: eagle-${staging}"
+    log_info "  Total duration: ${total_duration}s"
+    log_info "  Flush duration: ${flush_duration}s"
+    log_info "  Max user wait window: ${user_wait_window}s"
+    log_info "========================================="
 }
 
 # Check for required tools
@@ -240,6 +366,18 @@ check_requirements() {
         log_error "docker-compose file not found at ${COMPOSE_FILE}"
         exit 1
     fi
+
+    # Ensure saves directory exists
+    if [ ! -d "${SAVES_DIR}" ]; then
+        log_info "Creating saves directory at ${SAVES_DIR}"
+        mkdir -p "${SAVES_DIR}"
+    fi
+
+    # Clean up any stale deployment-in-progress marker from a previous failed deploy
+    if [ -f "${DEPLOYMENT_IN_PROGRESS}" ]; then
+        log_warn "Found stale deployment-in-progress marker, removing it"
+        remove_stale_deployment_marker
+    fi
 }
 
 # Run

scripts/inject_sparkle.sh

@@ -27,33 +27,59 @@ if [ -z "${SPARKLE_EDDSA_PUBLIC_KEY:-}" ]; then
     exit 1
 fi
 
-# Download Sparkle if not cached
+# Always use a fresh Sparkle download to avoid cache corruption issues
 SPARKLE_DIR="$SPARKLE_CACHE_DIR/Sparkle-$SPARKLE_VERSION"
-if [ ! -d "$SPARKLE_DIR/Sparkle.framework" ]; then
-    echo "=== Downloading Sparkle $SPARKLE_VERSION ==="
-    mkdir -p "$SPARKLE_CACHE_DIR"
-    SPARKLE_URL="https://github.com/sparkle-project/Sparkle/releases/download/${SPARKLE_VERSION}/Sparkle-${SPARKLE_VERSION}.tar.xz"
-    curl -L "$SPARKLE_URL" | tar -xJ -C "$SPARKLE_CACHE_DIR"
-    mv "$SPARKLE_CACHE_DIR/Sparkle-$SPARKLE_VERSION" "$SPARKLE_DIR" 2>/dev/null || true
-    # If the extracted directory doesn't match version pattern, it may just be "Sparkle"
-    if [ ! -d "$SPARKLE_DIR" ]; then
-        mkdir -p "$SPARKLE_DIR"
-        mv "$SPARKLE_CACHE_DIR/Sparkle.framework" "$SPARKLE_DIR/" 2>/dev/null || true
-        mv "$SPARKLE_CACHE_DIR/bin" "$SPARKLE_DIR/" 2>/dev/null || true
-    fi
+echo "=== Clearing Sparkle cache and downloading fresh copy ==="
+rm -rf "$SPARKLE_DIR"
+mkdir -p "$SPARKLE_DIR"
+
+SPARKLE_URL="https://github.com/sparkle-project/Sparkle/releases/download/${SPARKLE_VERSION}/Sparkle-${SPARKLE_VERSION}.tar.xz"
+echo "Downloading from: $SPARKLE_URL"
+curl -L "$SPARKLE_URL" -o /tmp/sparkle.tar.xz
+tar -xJf /tmp/sparkle.tar.xz -C "$SPARKLE_DIR"
+rm /tmp/sparkle.tar.xz
+
+# Show what was extracted
+echo "=== Extracted contents ==="
+ls -la "$SPARKLE_DIR/"
+
+# The tarball extracts files directly, not into a subdirectory
+# Verify the framework has proper symlink structure
+echo "=== Verifying Sparkle.framework structure ==="
+ls -la "$SPARKLE_DIR/Sparkle.framework/"
+
+if [ ! -L "$SPARKLE_DIR/Sparkle.framework/Sparkle" ]; then
+    echo "ERROR: Sparkle.framework/Sparkle is not a symlink"
+    file "$SPARKLE_DIR/Sparkle.framework/Sparkle"
+    exit 1
 fi
 
+if [ ! -L "$SPARKLE_DIR/Sparkle.framework/Versions/Current" ]; then
+    echo "ERROR: Sparkle.framework/Versions/Current is not a symlink"
+    ls -la "$SPARKLE_DIR/Sparkle.framework/Versions/"
+    exit 1
+fi
+
+echo "Sparkle framework structure verified OK"
+
 echo "=== Injecting Sparkle framework ==="
 FRAMEWORKS_DIR="$APP_PATH/Contents/Frameworks"
 mkdir -p "$FRAMEWORKS_DIR"
 
-# Copy Sparkle framework
-cp -R "$SPARKLE_DIR/Sparkle.framework" "$FRAMEWORKS_DIR/"
+# Remove any existing Sparkle.framework in the app
+rm -rf "$FRAMEWORKS_DIR/Sparkle.framework"
 
-# Also copy the XPC services if present
-if [ -d "$SPARKLE_DIR/Sparkle.framework/Versions/B/XPCServices" ]; then
-    echo "Sparkle XPC services present"
+# Copy Sparkle framework (use ditto to preserve symlinks and bundle structure)
+ditto "$SPARKLE_DIR/Sparkle.framework" "$FRAMEWORKS_DIR/Sparkle.framework"
+
+# Verify the copied framework still has proper structure
+echo "=== Verifying copied Sparkle.framework structure ==="
+ls -la "$FRAMEWORKS_DIR/Sparkle.framework/"
+if [ ! -L "$FRAMEWORKS_DIR/Sparkle.framework/Sparkle" ]; then
+    echo "ERROR: Copied framework lost symlink structure"
+    exit 1
 fi
+echo "Copied framework structure OK"
 
 echo "=== Updating Info.plist ==="
 PLIST_PATH="$APP_PATH/Contents/Info.plist"
@@ -69,8 +95,9 @@ PLIST_PATH="$APP_PATH/Contents/Info.plist"
 /usr/libexec/PlistBuddy -c "Add :SUEnableAutomaticChecks bool true" "$PLIST_PATH"
 
 # Set bundle version from git for Sparkle version comparison
-VERSION=$(git describe --tags --always 2>/dev/null || echo "1.0.0")
+# Use commit count for automatic incrementing versions (e.g., 1.0.9548)
 BUILD_NUMBER=$(git rev-list --count HEAD 2>/dev/null || echo "1")
+VERSION="1.0.${BUILD_NUMBER}"
 
 echo "Setting version: $VERSION (build $BUILD_NUMBER)"
 /usr/libexec/PlistBuddy -c "Set :CFBundleShortVersionString $VERSION" "$PLIST_PATH" 2>/dev/null || \
@@ -83,7 +110,7 @@ echo "=== Adding URL scheme for invitation codes ==="
 /usr/libexec/PlistBuddy -c "Delete :CFBundleURLTypes" "$PLIST_PATH" 2>/dev/null || true
 /usr/libexec/PlistBuddy -c "Add :CFBundleURLTypes array" "$PLIST_PATH"
 /usr/libexec/PlistBuddy -c "Add :CFBundleURLTypes:0 dict" "$PLIST_PATH"
-/usr/libexec/PlistBuddy -c "Add :CFBundleURLTypes:0:CFBundleURLName string 'com.Shardok-Games.eagle0'" "$PLIST_PATH"
+/usr/libexec/PlistBuddy -c "Add :CFBundleURLTypes:0:CFBundleURLName string 'net.eagle0.eagle0'" "$PLIST_PATH"
 /usr/libexec/PlistBuddy -c "Add :CFBundleURLTypes:0:CFBundleURLSchemes array" "$PLIST_PATH"
 /usr/libexec/PlistBuddy -c "Add :CFBundleURLTypes:0:CFBundleURLSchemes:0 string 'eagle0'" "$PLIST_PATH"
 

scripts/notarize_mac_app.sh

@@ -46,8 +46,8 @@ STATUS=$(echo "$SUBMIT_OUTPUT" | grep "^  status:" | awk '{print $2}')
 echo "Submission ID: $SUBMISSION_ID"
 echo "Status: $STATUS"
 
-# Clean up the zip
-rm "$ZIP_PATH"
+# Clean up the zip (use -f to avoid failure if already deleted)
+rm -f "$ZIP_PATH"
 
 if [ "$STATUS" != "Accepted" ]; then
     echo "=== Notarization failed! Fetching log for details ==="

scripts/notarize_submit.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+#
+# Submit a macOS .app bundle to Apple for notarization (no waiting)
+# Usage: notarize_submit.sh <app_path>
+# Outputs: submission_id=<id> to stdout (for GitHub Actions)
+#
+# Environment variables (required):
+#   APPLE_ID - Apple Developer account email
+#   APP_SPECIFIC_PASSWORD - App-specific password for notarytool
+#   TEAM_ID - Apple Developer Team ID
+
+set -euo pipefail
+
+APP_PATH="$1"
+
+if [ ! -d "$APP_PATH" ]; then
+    echo "ERROR: App not found at $APP_PATH" >&2
+    exit 1
+fi
+
+if [ -z "${APPLE_ID:-}" ] || [ -z "${APP_SPECIFIC_PASSWORD:-}" ] || [ -z "${TEAM_ID:-}" ]; then
+    echo "ERROR: Required environment variables not set" >&2
+    echo "  APPLE_ID: ${APPLE_ID:-<not set>}" >&2
+    echo "  APP_SPECIFIC_PASSWORD: ${APP_SPECIFIC_PASSWORD:+<set>}" >&2
+    echo "  TEAM_ID: ${TEAM_ID:-<not set>}" >&2
+    exit 1
+fi
+
+# Create ZIP for notarization submission
+ZIP_PATH="${APP_PATH%.app}.zip"
+echo "=== Creating ZIP for notarization: $ZIP_PATH ===" >&2
+ditto -c -k --keepParent "$APP_PATH" "$ZIP_PATH"
+
+echo "=== Submitting to Apple for notarization ===" >&2
+SUBMIT_OUTPUT=$(xcrun notarytool submit "$ZIP_PATH" \
+    --apple-id "$APPLE_ID" \
+    --password "$APP_SPECIFIC_PASSWORD" \
+    --team-id "$TEAM_ID" 2>&1)
+
+echo "$SUBMIT_OUTPUT" >&2
+
+# Extract submission ID
+SUBMISSION_ID=$(echo "$SUBMIT_OUTPUT" | grep "id:" | head -1 | awk '{print $2}')
+
+if [ -z "$SUBMISSION_ID" ]; then
+    echo "ERROR: Failed to get submission ID" >&2
+    exit 1
+fi
+
+# Clean up the zip
+rm "$ZIP_PATH"
+
+echo "Submission ID: $SUBMISSION_ID" >&2
+
+# Output for GitHub Actions
+echo "submission_id=$SUBMISSION_ID"

scripts/notarize_wait.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+#
+# Wait for Apple notarization to complete and staple the ticket
+# Usage: notarize_wait.sh <submission_id> <app_path>
+#
+# Environment variables (required):
+#   APPLE_ID - Apple Developer account email
+#   APP_SPECIFIC_PASSWORD - App-specific password for notarytool
+#   TEAM_ID - Apple Developer Team ID
+
+set -euo pipefail
+
+SUBMISSION_ID="$1"
+APP_PATH="$2"
+
+if [ -z "$SUBMISSION_ID" ]; then
+    echo "ERROR: submission_id is required" >&2
+    exit 1
+fi
+
+if [ ! -d "$APP_PATH" ]; then
+    echo "ERROR: App not found at $APP_PATH" >&2
+    exit 1
+fi
+
+if [ -z "${APPLE_ID:-}" ] || [ -z "${APP_SPECIFIC_PASSWORD:-}" ] || [ -z "${TEAM_ID:-}" ]; then
+    echo "ERROR: Required environment variables not set" >&2
+    exit 1
+fi
+
+echo "=== Waiting for notarization of submission $SUBMISSION_ID ==="
+WAIT_OUTPUT=$(xcrun notarytool wait "$SUBMISSION_ID" \
+    --apple-id "$APPLE_ID" \
+    --password "$APP_SPECIFIC_PASSWORD" \
+    --team-id "$TEAM_ID" 2>&1) || true
+
+echo "$WAIT_OUTPUT"
+
+# Extract status (look for "  status:" to avoid matching "Current status:")
+STATUS=$(echo "$WAIT_OUTPUT" | grep "^  status:" | awk '{print $2}')
+
+echo "Status: $STATUS"
+
+if [ "$STATUS" != "Accepted" ]; then
+    echo "=== Notarization failed! Fetching log for details ==="
+    xcrun notarytool log "$SUBMISSION_ID" \
+        --apple-id "$APPLE_ID" \
+        --password "$APP_SPECIFIC_PASSWORD" \
+        --team-id "$TEAM_ID"
+    exit 1
+fi
+
+echo "=== Verifying code signature before stapling ==="
+if ! codesign --verify --deep --strict "$APP_PATH" 2>&1; then
+    echo "ERROR: Code signature verification failed - app may have been damaged during transfer"
+    echo "Attempting to show signature details:"
+    codesign -dvvv "$APP_PATH" 2>&1 || true
+    exit 1
+fi
+echo "Code signature verified successfully"
+
+echo "=== Stapling notarization ticket to app ==="
+# Retry stapling - Apple's CloudKit can take several minutes to propagate the ticket
+MAX_STAPLE_ATTEMPTS=10
+STAPLE_WAIT_SECONDS=30
+STAPLE_ATTEMPT=1
+while [ $STAPLE_ATTEMPT -le $MAX_STAPLE_ATTEMPTS ]; do
+    echo "Stapling attempt $STAPLE_ATTEMPT/$MAX_STAPLE_ATTEMPTS..."
+    if STAPLE_OUTPUT=$(xcrun stapler staple "$APP_PATH" 2>&1); then
+        echo "$STAPLE_OUTPUT"
+        echo "Stapling successful"
+        break
+    fi
+    echo "Stapler output: $STAPLE_OUTPUT"
+    if [ $STAPLE_ATTEMPT -eq $MAX_STAPLE_ATTEMPTS ]; then
+        echo "ERROR: Stapling failed after $MAX_STAPLE_ATTEMPTS attempts (total wait: $((MAX_STAPLE_ATTEMPTS * STAPLE_WAIT_SECONDS)) seconds)"
+        exit 1
+    fi
+    echo "Stapling failed, waiting $STAPLE_WAIT_SECONDS seconds before retry..."
+    sleep $STAPLE_WAIT_SECONDS
+    STAPLE_ATTEMPT=$((STAPLE_ATTEMPT + 1))
+done
+
+echo "=== Verifying notarization ==="
+xcrun stapler validate "$APP_PATH"
+spctl --assess --type exec -v "$APP_PATH"
+
+echo "Notarization complete: $APP_PATH"

scripts/warmup-eagle.sh

@@ -65,7 +65,8 @@ fi
 # If we found the Go tool, use it
 if [ -n "${WARMUP_TOOL}" ]; then
     log_info "Using Go warmup tool: ${WARMUP_TOOL}"
-    if "${WARMUP_TOOL}" --address="${HOST}" --timeout=60s; then
+    # Use 5 minute timeout to allow for slow operations on cold JVM
+    if "${WARMUP_TOOL}" --address="${HOST}" --timeout=300s; then
         log_info "Warmup complete!"
         exit 0
     else

src/main/cpp/net/eagle0/shardok/ai/AIWaterCrossingCalculator.cpp

@@ -20,8 +20,9 @@ auto UnitIdsRequiringWaterCrossing(
     fb::HexMapW mapCopy = fb::CopyHexMap(gameState->hex_map());
     for (uint32_t index = 0; index < mapCopy->terrain()->size(); index++) {
         if (IsWater(mapCopy->terrain()->Get(index)->type())) continue;
-        mapCopy->mutable_terrain()
-                ->GetMutableObject(index)
+        // const_cast is safe because we own the mutable buffer (mapCopy)
+        const_cast<net::eagle0::shardok::storage::fb::Terrain *>(
+                mapCopy->mutable_terrain()->GetMutableObject(index))
                 ->mutable_modifier()
                 .mutable_fire()
                 .mutate_present(false);
@@ -164,16 +165,11 @@ auto WaterCrossingTiles(
         if (modifier.ice().present() && !modifier.fire().present()) continue;
 
         // Now try adding a bridge to the tile to see if it helps
-        mapCopy->mutable_terrain()
-                ->GetMutableObject(index)
-                ->mutable_modifier()
-                .mutable_bridge()
-                .mutate_present(true);
-        mapCopy->mutable_terrain()
-                ->GetMutableObject(index)
-                ->mutable_modifier()
-                .mutable_fire()
-                .mutate_present(false);
+        // const_cast is safe because we own the mutable buffer (mapCopy)
+        auto *terr = const_cast<net::eagle0::shardok::storage::fb::Terrain *>(
+                mapCopy->mutable_terrain()->GetMutableObject(index));
+        terr->mutable_modifier().mutable_bridge().mutate_present(true);
+        terr->mutable_modifier().mutable_fire().mutate_present(false);
 
         auto hash = ActionPointDistancesCache::GetMapId(mapCopy);
 
@@ -183,11 +179,7 @@ auto WaterCrossingTiles(
         }
 
         // Undo the new bridge for the next iteration of the loop
-        mapCopy->mutable_terrain()
-                ->GetMutableObject(index)
-                ->mutable_modifier()
-                .mutable_bridge()
-                .mutate_present(false);
+        terr->mutable_modifier().mutable_bridge().mutate_present(false);
     }
 
     return returnCoords;

src/main/cpp/net/eagle0/shardok/library/action_point_distances/ActionPointDistancesCache.cpp

@@ -76,11 +76,13 @@ static auto CreateIceClearedMap(const HexMap* map) -> fb::HexMapW {
 
     // Now modify the ice on the mutable copy
     auto* mutableMap = mapCopy.Get();
-    const auto* terrainVec = mutableMap->mutable_terrain();
+    auto* terrainVec = mutableMap->mutable_terrain();
 
     for (size_t i = 0; i < terrainVec->size(); i++) {
         // Only process tiles with ice
-        if (auto* terrain = terrainVec->GetMutableObject(i); terrain->modifier().ice().present()) {
+        // const_cast is safe here because we own the mutable buffer (mapCopy)
+        if (auto* terrain = const_cast<Terrain*>(terrainVec->GetMutableObject(i));
+            terrain->modifier().ice().present()) {
             terrain->mutable_modifier().mutable_ice().mutate_present(false);
             terrain->mutable_modifier().mutable_ice().mutate_integrity(0.0f);
         }

src/main/cpp/net/eagle0/shardok/library/action_result_applier/ActionResultApplier.cpp

@@ -22,6 +22,13 @@ using std::unique_ptr;
 using ResolvedUnitProto = net::eagle0::shardok::storage::ResolvedUnit;
 using GameState = net::eagle0::shardok::storage::fb::GameState;
 using GameStateT = net::eagle0::shardok::storage::fb::GameStateT;
+using Unit = net::eagle0::shardok::storage::fb::Unit;
+
+// Helper to get a mutable unit from the units vector.
+// const_cast is safe because we're accessing through a mutable GameState pointer.
+inline auto GetMutableUnit(GameState *state, UnitId unitId) -> Unit * {
+    return const_cast<Unit *>(state->mutable_units()->GetMutableObject(unitId));
+}
 using net::eagle0::shardok::storage::fb::DrawType;
 using net::eagle0::shardok::storage::fb::VictoryCondition;
 using net::eagle0::shardok::storage::fb::VictoryType;
@@ -37,7 +44,7 @@ void ApplyResolvedUnit(
     if (unit.has_attached_hero() &&
         unit.attached_hero().control_info().controlled_unit_id() != -1) {
         const UnitId controlledUnitId = unit.attached_hero().control_info().controlled_unit_id();
-        auto *controlledUnit = inoutState->mutable_units()->GetMutableObject(controlledUnitId);
+        auto *controlledUnit = GetMutableUnit(inoutState, controlledUnitId);
         internalAssert(controlledUnit->unit_id() == controlledUnitId);
         internalAssert(controlledUnit->commanding_unit_id() == unitId);
         controlledUnit->mutate_commanding_unit_id(-1);
@@ -47,7 +54,7 @@ void ApplyResolvedUnit(
     if (unit.commanding_unit_id() != -1) {
         const UnitId commandingUnitId = unit.commanding_unit_id();
 
-        auto *commandingUnit = inoutState->mutable_units()->GetMutableObject(commandingUnitId);
+        auto *commandingUnit = GetMutableUnit(inoutState, commandingUnitId);
         internalAssert(commandingUnit->unit_id() == commandingUnitId);
         internalAssert(
                 commandingUnit->attached_hero().control_info().controlled_unit_id() == unitId);
@@ -58,7 +65,7 @@ void ApplyResolvedUnit(
     if (status == net::eagle0::shardok::storage::fb::UnitStatus_CAPTURED_UNIT &&
         unit.has_attached_hero() && unit.attached_hero().is_vip()) {
         for (uint32_t i = 0; i < inoutState->units()->size(); i++) {
-            auto *playerUnit = inoutState->mutable_units()->GetMutableObject(i);
+            auto *playerUnit = GetMutableUnit(inoutState, i);
             if (playerUnit->player_id() != unit.player_id()) continue;
             if (playerUnit->unit_id() == unit.unit_id()) continue;
 
@@ -70,7 +77,7 @@ void ApplyResolvedUnit(
         }
     }
 
-    inoutState->mutable_units()->GetMutableObject(unitId)->mutate_status(status);
+    GetMutableUnit(inoutState, unitId)->mutate_status(status);
 }
 
 void ApplyResolvedUnit(
@@ -189,7 +196,7 @@ void MutatingAddUnits(GameStateW &mutatingState, const ActionResultProto &result
         // We only need to process the units that are being changed
         for (const auto &unitBytes : result.changed_units_fb()) {
             const auto *unit = (Unit *)unitBytes.data();
-            auto *mutableUnit = mutatingState->mutable_units()->GetMutableObject(unit->unit_id());
+            auto *mutableUnit = GetMutableUnit(mutatingState.Get(), unit->unit_id());
             if (mutableUnit->status() ==
                 net::eagle0::shardok::storage::fb::UnitStatus_RESERVED_SLOT) {
                 // Convert this reserved slot to a real unit
@@ -340,7 +347,7 @@ void MutatingApplyResult(
         }
 
         // Capture old position before applying changes
-        auto *mutableUnit = mutatingGameState->units()->GetMutableObject(changedUnit->unit_id());
+        auto *mutableUnit = GetMutableUnit(mutatingGameState.Get(), changedUnit->unit_id());
         const auto oldLocation = mutableUnit->location();
 
         fb::ApplyUnit(mutableUnit, changedUnit, status);

src/main/cpp/net/eagle0/shardok/library/commands/MoveCommand.cpp

@@ -191,6 +191,7 @@ auto MoveCommand::GetCommandProto() const -> CommandProto {
     proto.mutable_action_points()->set_value(pointCost);
     proto.mutable_actor()->set_value(moverId);
     *proto.mutable_target() = ToCoordsProto(interimTargets.back());
+    for (const auto& coords : interimTargets) { *proto.add_path() = ToCoordsProto(coords); }
     for (const auto& fup : followUpCommandTypes) { proto.add_follow_up_command_types(fup); }
     proto.set_will_unhide(willUnhide);
 

src/main/cpp/net/eagle0/shardok/library/util/HexMapUtils.cpp

@@ -64,8 +64,16 @@ auto GetTerrain(const HexMap *map, const Coords &coords) -> const Terrain * {
     return map->terrain()->Get(coords.row() * map->column_count() + coords.column());
 }
 
+auto GetMutableTerrain(HexMap *map, const Coords &coords) -> Terrain * {
+    // const_cast is safe because we're accessing through a mutable HexMap pointer
+    return const_cast<Terrain *>(map->mutable_terrain()->GetMutableObject(
+            coords.row() * map->column_count() + coords.column()));
+}
+
 auto GetMutableTerrain(const HexMap *map, const Coords &coords) -> Terrain * {
-    return map->terrain()->GetMutableObject(coords.row() * map->column_count() + coords.column());
+    // const_cast is safe when the underlying buffer is known to be mutable
+    return const_cast<Terrain *>(
+            map->terrain()->Get(coords.row() * map->column_count() + coords.column()));
 }
 
 auto HasForestAccess(
@@ -597,7 +605,9 @@ void MutatingSetTileModifier(
         const int row,
         const int column,
         const TileModifierProto &TileModifierProto) {
-    auto *terr = hexMap->mutable_terrain()->GetMutableObject(row * hexMap->column_count() + column);
+    // const_cast is safe because we're accessing through a mutable HexMap pointer
+    auto *terr = const_cast<Terrain *>(
+            hexMap->mutable_terrain()->GetMutableObject(row * hexMap->column_count() + column));
 
     if (TileModifierProto.has_bridge()) {
         terr->mutable_modifier().mutable_bridge().mutate_present(true);

src/main/cpp/net/eagle0/shardok/library/util/HexMapUtils.hpp

@@ -82,6 +82,9 @@ auto HasForestAccess(
         PlayerId player) -> bool;
 
 auto GetTerrain(const HexMap *map, const Coords &coords) -> const Terrain *;
+auto GetMutableTerrain(HexMap *map, const Coords &coords) -> Terrain *;
+// Overload for const HexMap - uses const_cast internally. Safe when the underlying buffer is
+// mutable.
 auto GetMutableTerrain(const HexMap *map, const Coords &coords) -> Terrain *;
 
 auto CoordsAreValid(const HexMap *map, const Coords &coords) -> bool;

src/main/cpp/net/eagle0/shardok/library/view_filters/GameStateGuesser.cpp

@@ -29,6 +29,13 @@ using UnitViewProto = net::eagle0::shardok::api::UnitView;
 
 using Coords = net::eagle0::shardok::storage::fb::Coords;
 using Unit = net::eagle0::shardok::storage::fb::Unit;
+using GameState = net::eagle0::shardok::storage::fb::GameState;
+
+// Helper to get a mutable unit from the units vector.
+// const_cast is safe because we're accessing through a mutable GameState pointer.
+inline auto GetMutableUnit(GameState *state, UnitId unitId) -> Unit * {
+    return const_cast<Unit *>(state->mutable_units()->GetMutableObject(unitId));
+}
 
 constexpr int8_t kGuessedHeroStat = 75;
 constexpr int8_t kGuessedBattalionStat = 0;
@@ -412,16 +419,13 @@ auto GameStateGuesser::GuessedState(
         if (unit->has_attached_hero()) {
             UnitId controlledUnitId = unit->attached_hero().control_info().controlled_unit_id();
             if (controlledUnitId != -1) {
-                gsw->mutable_units()
-                        ->GetMutableObject(controlledUnitId)
-                        ->mutate_commanding_unit_id(unitId);
+                GetMutableUnit(gsw.Get(), controlledUnitId)->mutate_commanding_unit_id(unitId);
             }
         }
 
         UnitId commandingUnitId = unit->commanding_unit_id();
         if (unit->commanding_unit_id() != -1) {
-            gsw->mutable_units()
-                    ->GetMutableObject(commandingUnitId)
+            GetMutableUnit(gsw.Get(), commandingUnitId)
                     ->mutable_attached_hero()
                     .mutable_control_info()
                     .mutate_controlled_unit_id(unitId);

src/main/csharp/net/eagle0/clients/unity/eagle0/Assembly-CSharp.csproj

@@ -87,7 +87,6 @@
     <Compile Include="Assets/Modern UI Pack/Scripts/Demo/LaunchURL.cs" />
     <Compile Include="Assets/Shardok/HexCoordinates.cs" />
     <Compile Include="Assets/Eagle/Table Rows/OrganizeTroopsTableRow.cs" />
-    <Compile Include="Assets/Bluetooth/PickerRowController.cs" />
     <Compile Include="Assets/TouchHandler.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/TravelCommandSelector.cs" />
     <Compile Include="Assets/Eagle/ConnectionStatusUI.cs" />
@@ -98,7 +97,6 @@
     <Compile Include="Assets/HoveringTooltipTextProvider.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/util/KeyModifiedAmount.cs" />
     <Compile Include="Assets/HoveringTooltip.cs" />
-    <Compile Include="Assets/Bluetooth/DiceInterface.cs" />
     <Compile Include="Assets/ButtonColors.cs" />
     <Compile Include="Assets/Eagle/MapController.cs" />
     <Compile Include="Assets/common/DisclosureTriangle.cs" />
@@ -151,10 +149,8 @@
     <Compile Include="Assets/Eagle/GeneratedTextUpdater.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/OutlawApprehendedDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Shardok/HexMetrics.cs" />
-    <Compile Include="Assets/Bluetooth/OneDiceRollController.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Switch/SwitchManager.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/ProvinceHeldDetailsNotificationGenerator.cs" />
-    <Compile Include="Assets/Bluetooth/DieInfo.cs" />
     <Compile Include="Assets/common/ResourceFetcher.cs" />
     <Compile Include="Assets/Tutorial/Content/TutorialStep.cs" />
     <Compile Include="Assets/Auth/AuthClient.cs" />
@@ -162,10 +158,10 @@
     <Compile Include="Assets/Eagle/Notifications/RiotSuppressedNotificationGenerator.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Modal Window/ModalWindowManagerEditor.cs" />
     <Compile Include="Assets/common/GUIUtils/AutoScrollingText.cs" />
-    <Compile Include="Assets/Bluetooth/NativeDiceInterfaceImports.cs" />
     <Compile Include="Assets/Eagle/Notifications/ProvinceConqueredNotificationGenerator.cs" />
     <Compile Include="Assets/Eagle/Table Rows/ExtraTroopsRowController.cs" />
     <Compile Include="Assets/Auth/JwtAuthInterceptor.cs" />
+    <Compile Include="Assets/Tutorial/Content/TutorialContentDefinitions.cs" />
     <Compile Include="Assets/Eagle/CommandPanelController.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/ShatteredArmyDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Shardok/TurnHistoryPanelController.cs" />
@@ -207,10 +203,10 @@
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/RansomRejectedDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Eagle/FactionsTableController.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Slider/RangeSlider.cs" />
+    <Compile Include="Assets/Tutorial/UI/TutorialOverlayBuilder.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/ExileVassalCommandSelector.cs" />
     <Compile Include="Assets/Tutorial/TutorialState.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Button/ButtonManagerBasicWithIconEditor.cs" />
-    <Compile Include="Assets/Bluetooth/DiceVectors.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/UI Manager/UIManagerProgressBarLoop.cs" />
     <Compile Include="Assets/Eagle/MovingArmiesTableController.cs" />
     <Compile Include="Assets/ConnectionHandler/ConnectionHandler.cs" />
@@ -231,9 +227,11 @@
     <Compile Include="Assets/Eagle/CommandSelectors/DiplomacyCommandSelector.cs" />
     <Compile Include="Assets/Tutorial/Triggers/TutorialTriggerRegistry.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/ResolveBreakAllianceCommandSelector.cs" />
+    <Compile Include="Assets/common/WindowFocusManager.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/ResolveAllianceCommandSelector.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/WithdrewForTruceDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/MarchCommandSelector.cs" />
+    <Compile Include="Assets/Tutorial/TutorialTargetRegistry.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/TrainCommandSelector.cs" />
     <Compile Include="Assets/Eagle/CustomFileLogger.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/InvitationAcceptedDetailsNotificationGenerator.cs" />
@@ -267,7 +265,6 @@
     <Compile Include="Assets/Shardok/AnimationTestController.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/TradeCommandSelector.cs" />
     <Compile Include="Assets/Eagle/Table Rows/DominionTableRowController.cs" />
-    <Compile Include="Assets/Bluetooth/RollPanelController.cs" />
     <Compile Include="Assets/Shardok/ChargeAnimator.cs" />
     <Compile Include="Assets/Eagle/ClientTextProvider.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/UI Manager/UIManager.cs" />
@@ -302,6 +299,7 @@
     <Compile Include="Assets/Shardok/ControlAnimator.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Horizontal Selector/HorizontalSelector.cs" />
     <Compile Include="Assets/Eagle/Table Rows/OrganizeTroopsResultRow.cs" />
+    <Compile Include="Assets/Eagle/SparkleUpdater.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Slider/SliderManagerEditor.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/SwearBrotherhoodDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Eagle/PersistentClientConnection.cs" />
@@ -320,10 +318,10 @@
     <Compile Include="Assets/Shardok/ShardokGameModel.cs" />
     <Compile Include="Assets/common/GUIUtils/GeneralClickDetector.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/UI Manager/UIManagerContextMenu.cs" />
+    <Compile Include="Assets/Eagle/SparkleInitializer.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/TruceAmbassadorImprisonedDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Button/ButtonManagerBasicWithIcon.cs" />
     <Compile Include="Assets/Tutorial/UI/TutorialHintIndicator.cs" />
-    <Compile Include="Assets/Bluetooth/UnityDieColors.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/OrganizeTroopsCommandSelector.cs" />
     <Compile Include="Assets/Shardok/ExtinguishAnimator.cs" />
     <Compile Include="Assets/Eagle/PanelPositions.cs" />
@@ -336,7 +334,6 @@
     <Compile Include="Assets/EagleConnection.cs" />
     <Compile Include="Assets/GUI Pro Kit Fantasy RPG/Scripts/CtrPanel.cs" />
     <Compile Include="Assets/UI/Scripts/SceneLoadTester.cs" />
-    <Compile Include="Assets/Bluetooth/RollFetcher.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/HandleRiotGiveCommandSelector.cs" />
     <Compile Include="Assets/Eagle/ProvinceUtils.cs" />
     <Compile Include="Assets/common/GUIUtils/ProvinceStatUtils.cs" />
@@ -370,16 +367,15 @@
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/SuppressBeastsFailedDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Terrain Hexes/Example Scene/BasicHexArranger.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/ManagePrisonersCommandSelector.cs" />
-    <Compile Include="Assets/Eagle/CommandSelectors/SendSuppliesCommandSelector.cs" />
+    <Compile Include="Assets/ConnectionHandler/StoredAccountButton.cs" />
     <Compile Include="Assets/Tutorial/UI/TutorialUIManager.cs" />
+    <Compile Include="Assets/Eagle/CommandSelectors/SendSuppliesCommandSelector.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/Window/WindowManager.cs" />
-    <Compile Include="Assets/Auth/InvitationCodeManager.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/CapturedHeroExiledDetailsNotificationGenerator.cs" />
     <Compile Include="Assets/Eagle/Notifications/ARNNotifications/SuppressBeastsSucceededNotificationGenerator.cs" />
     <Compile Include="Assets/Shardok/ReservesTableController.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/CommandSelector.cs" />
     <Compile Include="Assets/Eagle/CommandSelectors/RestCommandSelector.cs" />
-    <Compile Include="Assets/Bluetooth/DiceConfigurationPanelController.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/UI Manager/UIManagerDropdown.cs" />
     <Compile Include="Assets/Modern UI Pack/Scripts/UI Manager/UIManagerButton.cs" />
     <Compile Include="Assets/common/GUIUtils/GUIUtils.cs" />
@@ -448,7 +444,7 @@
     <None Include="Assets/Packages/System.ComponentModel.Annotations.5.0.0/useSharedDesignerContext.txt" />
     <None Include="Assets/Packages/System.Runtime.CompilerServices.Unsafe.6.0.0/useSharedDesignerContext.txt" />
     <None Include="Assets/TextMesh Pro/Resources/Shaders/TMP_SDF-Mobile Masking.shader" />
-    <None Include="Assets/Resources/Music/Music Credits.txt" />
+    <None Include="Assets/Music/Music Credits.txt" />
     <None Include="Assets/Packages/System.Diagnostics.DiagnosticSource.8.0.0/useSharedDesignerContext.txt" />
     <None Include="Assets/Packages/Microsoft.Extensions.Logging.8.0.0/useSharedDesignerContext.txt" />
     <None Include="Assets/Packages/Microsoft.Extensions.DependencyInjection.Abstractions.8.0.0/useSharedDesignerContext.txt" />
@@ -1310,6 +1306,9 @@
     <Reference Include="Unity.TextMeshPro">
       <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Unity.TextMeshPro.dll</HintPath>
     </Reference>
+    <Reference Include="Unity.ResourceManager">
+      <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Unity.ResourceManager.dll</HintPath>
+    </Reference>
     <Reference Include="Unity.VisualStudio.Editor">
       <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Unity.VisualStudio.Editor.dll</HintPath>
     </Reference>
@@ -1322,9 +1321,15 @@
     <Reference Include="Unity.AI.Navigation">
       <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Unity.AI.Navigation.dll</HintPath>
     </Reference>
+    <Reference Include="Unity.Profiling.Core">
+      <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Unity.Profiling.Core.dll</HintPath>
+    </Reference>
     <Reference Include="Unity.Timeline.Editor">
       <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Unity.Timeline.Editor.dll</HintPath>
     </Reference>
+    <Reference Include="Unity.ScriptableBuildPipeline">
+      <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Unity.ScriptableBuildPipeline.dll</HintPath>
+    </Reference>
     <Reference Include="Cysharp.Net.Http.YetAnotherHttpHandler">
       <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Cysharp.Net.Http.YetAnotherHttpHandler.dll</HintPath>
     </Reference>
@@ -1352,9 +1357,15 @@
     <Reference Include="Unity.Multiplayer.Center.Editor">
       <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Unity.Multiplayer.Center.Editor.dll</HintPath>
     </Reference>
+    <Reference Include="Unity.ScriptableBuildPipeline.Editor">
+      <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Unity.ScriptableBuildPipeline.Editor.dll</HintPath>
+    </Reference>
     <Reference Include="Unity.PlasticSCM.Editor">
       <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Unity.PlasticSCM.Editor.dll</HintPath>
     </Reference>
+    <Reference Include="Unity.Addressables">
+      <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Unity.Addressables.dll</HintPath>
+    </Reference>
     <Reference Include="Unity.Services.Core.Components">
       <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Unity.Services.Core.Components.dll</HintPath>
     </Reference>
@@ -1370,6 +1381,9 @@
     <Reference Include="Unity.AI.Navigation.Editor.ConversionSystem">
       <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Unity.AI.Navigation.Editor.ConversionSystem.dll</HintPath>
     </Reference>
+    <Reference Include="Unity.Addressables.Editor">
+      <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/Unity.Addressables.Editor.dll</HintPath>
+    </Reference>
     <Reference Include="UnityEditor.UI">
       <HintPath>/Users/dancrosby/CodingProjects/github/eagle0-unity-client/src/main/csharp/net/eagle0/clients/unity/eagle0/Library/ScriptAssemblies/UnityEditor.UI.dll</HintPath>
     </Reference>

src/main/csharp/net/eagle0/clients/unity/eagle0/Assets/4000_Fantasy_Icons/InUse.meta

@@ -1,5 +1,5 @@
 fileFormatVersion: 2
-guid: 6ddb90d3140384d50a98a19e72539b62
+guid: fb38e3be95e9247c5a451d60236def15
 folderAsset: yes
 DefaultImporter:
   externalObjects: {}